@dashai/cli 0.26.0 → 0.28.0

package/dist/bin.js

@@ -4,7 +4,7 @@ import { existsSync, readFileSync, writeFileSync, rmSync, mkdirSync, watch, read
 import { hostname, tmpdir, platform, homedir } from 'os';
 import { resolve, join, relative, dirname, basename, win32, sep } from 'path';
 import { execFileSync, spawn, spawnSync } from 'child_process';
-import { intro, log, select, isCancel, cancel, spinner, outro, text, confirm, multiselect } from '@clack/prompts';
+import { intro, log, select, isCancel, cancel, spinner, outro, text, confirm as confirm$1, multiselect } from '@clack/prompts';
 import { Command, Option } from 'commander';
 import open from 'open';
 import AdmZip from 'adm-zip';
@@ -178,16 +178,12 @@ function removeModuleEntry(slug) {
 function isLoggedIn() {
   return readSavedToken() !== null;
 }
-var FILE_NAME, DIR_NAME, DEFAULT_API_URL, KNOWN_API_URLS;
+var FILE_NAME, DIR_NAME, DEFAULT_API_URL;
 var init_config = __esm({
   "src/lib/config.ts"() {
     FILE_NAME = "auth.json";
     DIR_NAME = "dashwise";
-    DEFAULT_API_URL = "https://api.dashwise.dev";
-    KNOWN_API_URLS = {
-      dev: "https://api.dashwise.dev",
-      prod: "https://api.dashwise.net"
-    };
+    DEFAULT_API_URL = "https://api.dashwise.net";
   }
 });
 
@@ -283,7 +279,7 @@ async function apiRequest(method, path, body, options = {}) {
 function asEnvelope(v) {
   if (!v || typeof v !== "object") return null;
   const env = v;
-  const out2 = {};
+  const out2 = { body: env };
   if (typeof env.code === "string") out2.code = env.code;
   else if (typeof env.error === "string" && CODE_SHAPE.test(env.error)) out2.code = env.error;
   if (typeof env.message === "string") out2.message = env.message;
@@ -557,6 +553,14 @@ async function getModuleBySlug(slug, options = {}) {
 function isInstallGated(r) {
   return r.install_gated === true;
 }
+async function getUpgradePreview(installationId, version, options = {}) {
+  return apiRequest(
+    "GET",
+    `/api/installations/${installationId}/upgrade-preview?version=${encodeURIComponent(version)}`,
+    void 0,
+    options
+  );
+}
 async function installModule(moduleId, body, options = {}) {
   return apiRequest(
     "POST",
@@ -640,6 +644,8 @@ var init_api_client = __esm({
       code;
       context;
       retriable;
+      /** The whole parsed error body, when the backend sent a JSON object. */
+      body;
       constructor(status, envelope, fallbackMessage) {
         const code2 = envelope?.code ?? codeFromStatus(status);
         const message = envelope?.message ?? fallbackMessage;
@@ -649,6 +655,7 @@ var init_api_client = __esm({
         this.code = code2;
         this.context = envelope?.context;
         this.retriable = envelope?.retriable ?? status >= 500;
+        this.body = envelope?.body;
       }
     };
     CODE_SHAPE = /^[A-Z][A-Z0-9_]*$/;
@@ -1187,16 +1194,16 @@ async function devCommand(options) {
     }
     const callbackOrigins = computeCallbackOrigins(port, options.callbackOrigin ?? []);
     try {
-      const session = await registerDevSession(apiUrl, apiToken, {
+      const session2 = await registerDevSession(apiUrl, apiToken, {
         target_workspace_id: workspaceContext.id,
         callback_origins: callbackOrigins
       });
-      revokeDevSession = () => revokeDevSessionBestEffort(apiUrl, apiToken, session.id);
-      devHandoffEnv = devSessionHandoffEnv(session);
-      info(`  ${dim("dev session")} ${session.id}`);
+      revokeDevSession = () => revokeDevSessionBestEffort(apiUrl, apiToken, session2.id);
+      devHandoffEnv = devSessionHandoffEnv(session2);
+      info(`  ${dim("dev session")} ${session2.id}`);
       info(`  ${dim("workspace")}   ${workspaceContext.name} (id=${workspaceContext.id}, slug=${workspaceContext.slug})`);
       info(`  ${dim("callbacks")}   ${callbackOrigins.join(", ")}`);
-      info(`  ${dim("expires")}     ${session.expires_at}`);
+      info(`  ${dim("expires")}     ${session2.expires_at}`);
       info(
         `  ${dim("sign-in")}     ${Object.keys(devHandoffEnv).length > 0 ? "zero-click (server-side dev handoff armed)" : "browser SSO (backend issued no handoff secret \u2014 pre-2026-07-15 backend)"}`
       );
@@ -1455,11 +1462,11 @@ async function resolveModuleApiKey(slug, entry, apiUrl, cliBearer) {
   success(`Upgraded ${code(slug)} to a dwk_ API key (id=${minted.api_key.id}).`);
   return upgraded;
 }
-function devSessionHandoffEnv(session) {
-  const secret = session.handoff_secret;
+function devSessionHandoffEnv(session2) {
+  const secret = session2.handoff_secret;
   if (typeof secret !== "string" || secret.length === 0) return {};
   return {
-    DASHWISE_DEV_SESSION_ID: session.id,
+    DASHWISE_DEV_SESSION_ID: session2.id,
     DASHWISE_DEV_HANDOFF_SECRET: secret
   };
 }
@@ -2742,6 +2749,7 @@ var init_custom = __esm({
             "@tailwindcss/postcss": "^4",
             "class-variance-authority": "^0.7.1",
             clsx: "^2.1.1",
+            geist: "^1.7.2",
             "lucide-react": "^0.577.0",
             next: "^15.0.0",
             "next-themes": "^0.4.6",
@@ -7266,6 +7274,15 @@ var init_custom = __esm({
           integrity: "sha512-sR9BNCjBg6LNgwvxlBd0sBABvQitkLzoVY9MYYROQVX/FvfJ4Mai9LsGhDgd8qYdds0bY77VzYd5iuB+v5rwQQ==",
           license: "MIT"
         },
+        "node_modules/geist": {
+          version: "1.7.2",
+          resolved: "https://registry.npmjs.org/geist/-/geist-1.7.2.tgz",
+          integrity: "sha512-Gu5lDFa3pLRyoBlBPf0QIFHVdWAnpco7fS1bJm41jyLPFoguBgiubseUN2oLXMgqZ7uxAxDoXcHMhCY/fOTTgg==",
+          license: "SIL OPEN FONT LICENSE",
+          peerDependencies: {
+            next: ">=13.2.0"
+          }
+        },
         "node_modules/gensync": {
           version: "1.0.0-beta.2",
           resolved: "https://registry.npmjs.org/gensync/-/gensync-1.0.0-beta.2.tgz",
@@ -10168,7 +10185,13 @@ function nextConfig() {
 // we DERIVE NEXT_PUBLIC_DASHWISE_API_URL here from DASHWISE_API_URL at
 // build/start time \u2014 you never set the NEXT_PUBLIC_ var yourself. If
 // you already have one set (e.g. a custom setup), it wins.
-const apiUrl = process.env.DASHWISE_API_URL;
+const apiUrl = process.env.DASHWISE_API_URL ?? ${JSON.stringify(DEFAULT_API_URL)};
+// The browser-facing API target: an explicit NEXT_PUBLIC_ override wins (the
+// server may reach the API on an internal address). The embedding app is the
+// app next to THAT public target, never the internal one.
+const publicApiUrl = process.env.NEXT_PUBLIC_DASHWISE_API_URL ?? apiUrl;
+const appUrl = new URL(publicApiUrl);
+appUrl.hostname = appUrl.hostname.replace(/^api\\./, "app.");
 
 const nextConfig = {
   // Required for the platform-hosted (per-install Lambda) runtime: the
@@ -10179,8 +10202,7 @@ const nextConfig = {
   typescript: { ignoreBuildErrors: true },
   eslint: { ignoreDuringBuilds: true },
   env: {
-    NEXT_PUBLIC_DASHWISE_API_URL:
-      process.env.NEXT_PUBLIC_DASHWISE_API_URL ?? apiUrl,
+    NEXT_PUBLIC_DASHWISE_API_URL: publicApiUrl,
   },
   // WHO MAY FRAME THIS MODULE.
   //
@@ -10196,7 +10218,7 @@ const nextConfig = {
   async headers() {
     const ancestors =
       process.env.DASHWISE_FRAME_ANCESTORS ??
-      "https://app.dashwise.dev https://app.dashwise.net";
+      appUrl.origin;
     return [
       {
         source: '/:path*',
@@ -10526,12 +10548,34 @@ export const config = {
 }
 function appLayoutCustomTsx(opts) {
   return `import './globals.css';
+import { GeistSans } from 'geist/font/sans';
+import { GeistMono } from 'geist/font/mono';
 import { AuthProvider, HostRouteSync } from '@dashai/sdk/auth/client';
 import { PlatformProvider, PLATFORM_PREPAINT_SCRIPT } from '@dashai/sdk/platform';
 import { ThemeProvider } from '@/components/theme-provider';
 import { PlatformThemeSync } from '@/components/platform-theme-sync';
 import { getSession } from '@/lib/session';
 
+// The Dashwise app renders in Geist, and \`globals.css\` names that family at the
+// front of \`--font-sans\`. Loading it here is what makes that name resolve: drop
+// these two lines and the stack falls straight through to system-ui, so the
+// module reads as a different product the moment anyone looks at text.
+//
+// The \`geist\` package ships the font files and loads them through
+// \`next/font/local\`: no download at build time (a cloud sandbox may only
+// reach npm and Dashwise, L434) and no runtime request, so nothing to declare
+// in \`runtime.outbound_apis\`. Never switch to \`next/font/google\`: that
+// fetches from Google during \`next build\`. The \`.variable\` classes on
+// <html> are what make Next emit the @font-face rules at all; they also expose
+// \`var(--font-geist-sans)\` for components that want it directly.
+//
+// They sit on <html>, not <body>: \`--font-sans\` in globals.css is declared on
+// :root (= <html>) and reads \`var(--font-geist-sans)\`, and a custom property
+// resolves where it is declared. The family name next/font generates is not
+// "Geist", so naming the family literally would not find the loaded files.
+const geistSans = GeistSans;
+const geistMono = GeistMono;
+
 export const metadata = {
   title: ${JSON.stringify(opts.name)},
   description: ${JSON.stringify(`Dashwise module: ${opts.slug}`)},
@@ -10556,7 +10600,12 @@ export default async function RootLayout({ children }: { children: React.ReactNo
     // renders inside the Dashwise app shell, where the header/nav/theme toggle
     // already exist. The pre-paint script below only ever UPGRADES it to
     // "standalone", so chrome can never flash on top of the app's own.
-    <html lang="en" data-dw-surface="embedded" suppressHydrationWarning>
+    <html
+      lang="en"
+      data-dw-surface="embedded"
+      className={\`\${geistSans.variable} \${geistMono.variable}\`}
+      suppressHydrationWarning
+    >
       <head>
         {/* Runs before first paint: stamps data-dw-surface on <html> and
             re-applies the cached workspace brand. Keeps \`.dw-standalone-only\`
@@ -11219,6 +11268,7 @@ function packageJsonCustom(opts) {
         // below that fails with "every import from @dashai/generated
         // throws", which points nowhere near the cause.
         "@dashai/sdk": SCAFFOLD_SDK_RANGE,
+        geist: GEIST_DEP_RANGE,
         next: "^15.0.0",
         react: "^19.0.0",
         "react-dom": "^19.0.0",
@@ -11367,13 +11417,18 @@ function globalsCss() {
   --code-bg: oklch(0.14 0 0);
   --code-fg: oklch(0.97 0 0);
 
+  /* Geist is loaded from the \`geist\` package in app/layout.tsx, which puts
+     --font-geist-sans/--font-geist-mono on <html> (= :root), so they resolve
+     here. Keep those classes on <html>: on <body> the var() below would be
+     unresolved at :root and the whole stack would fall back silently. The
+     second argument of var() keeps "Geist" as a fallback name. */
   --font-sans:
-    "Geist", "Geist Fallback", ui-sans-serif, system-ui, -apple-system,
+    var(--font-geist-sans, "Geist"), ui-sans-serif, system-ui, -apple-system,
     BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial,
     "Noto Sans", sans-serif, "Apple Color Emoji", "Segoe UI Emoji",
     "Segoe UI Symbol", "Noto Color Emoji";
   --font-mono:
-    "Geist Mono", "Geist Mono Fallback", ui-monospace, SFMono-Regular, Menlo,
+    var(--font-geist-mono, "Geist Mono"), ui-monospace, SFMono-Regular, Menlo,
     Monaco, Consolas, "Liberation Mono", "Courier New", monospace;
 
   --radius: 0.625rem;
@@ -11583,27 +11638,42 @@ import { Slot } from "radix-ui";
 
 import { cn } from "@/lib/utils";
 
+// A faithful copy of the Dashwise app's own button kit \u2014 only the \`cn\` import
+// path and the "use client" directive above differ. Variants your module does
+// not use yet are kept on purpose: divergence is what makes a vendored
+// design-system file drift out of sync with the app it is supposed to match.
 const buttonVariants = cva(
-  "inline-flex shrink-0 items-center justify-center gap-2 rounded-md text-sm font-medium whitespace-nowrap transition-all outline-none focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
+  // Focus ring: full-opacity \`ring\` with a background-coloured offset.
+  // The stock shadcn ring (\`ring-ring/50\` drawn directly on the button)
+  // measures 2.30:1 against the page and 2.73:1 against a primary fill \u2014
+  // below the 3:1 that WCAG 1.4.11 / 2.4.11 require of a focus indicator,
+  // i.e. effectively invisible on the most-used control in any module.
+  "inline-flex shrink-0 items-center justify-center gap-2 rounded-md text-sm font-medium whitespace-nowrap transition-all outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 focus-visible:ring-offset-background disabled:pointer-events-none disabled:opacity-50 aria-invalid:border-destructive aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
   {
     variants: {
       variant: {
         default: "bg-primary text-primary-foreground hover:bg-primary/90",
         destructive:
-          "bg-destructive text-white hover:bg-destructive/90",
+          "bg-destructive text-white hover:bg-destructive/90 focus-visible:ring-destructive/20 dark:bg-destructive/60 dark:focus-visible:ring-destructive/40",
         outline:
-          "border bg-background shadow-xs hover:bg-accent hover:text-accent-foreground",
+          "border bg-background shadow-xs hover:bg-accent hover:text-accent-foreground dark:border-input dark:bg-input/30 dark:hover:bg-input/50",
         secondary:
           "bg-secondary text-secondary-foreground hover:bg-secondary/80",
         ghost:
-          "hover:bg-accent hover:text-accent-foreground",
+          "hover:bg-accent hover:text-accent-foreground dark:hover:bg-accent/50",
         link: "text-primary underline-offset-4 hover:underline",
+        "destructive-soft":
+          "bg-destructive/10 text-destructive border border-destructive/20 shadow-xs hover:bg-destructive/20",
       },
       size: {
         default: "h-9 px-4 py-2 has-[>svg]:px-3",
+        xs: "h-6 gap-1 rounded-md px-2 text-xs has-[>svg]:px-1.5 [&_svg:not([class*='size-'])]:size-3",
         sm: "h-8 gap-1.5 rounded-md px-3 has-[>svg]:px-2.5",
         lg: "h-10 rounded-md px-6 has-[>svg]:px-4",
         icon: "size-9",
+        "icon-xs": "size-6 rounded-md [&_svg:not([class*='size-'])]:size-3",
+        "icon-sm": "size-8",
+        "icon-lg": "size-10",
       },
     },
     defaultVariants: {
@@ -11627,6 +11697,8 @@ function Button({
   return (
     <Comp
       data-slot="button"
+      data-variant={variant}
+      data-size={size}
       className={cn(buttonVariants({ variant, size, className }))}
       {...props}
     />
@@ -12351,6 +12423,15 @@ the workspace's theme and branding.
 | corners / elevation | \`rounded-md\`/\`rounded-lg\`, \`shadow-xs\`\u2026\`shadow-md\` |
 | type | inherit \`--font-sans\`; ids and code use \`font-mono\` |
 
+**Don't re-declare the font.** \`app/layout.tsx\` loads Geist from the
+\`geist\` package and puts its variables on \`<html>\`; \`globals.css\` reads
+them with \`var(--font-geist-sans, "Geist")\`. Leave both alone. Never switch to
+\`next/font/google\` (it downloads from Google during \`next build\`, which fails
+in a cloud sandbox) and never move the variables to \`<body>\` (the var() at
+\`:root\` would be unresolved and text silently falls back to Tailwind's default
+sans). Same class of trap for \`--shadow-*\`, which must be mapped into
+\`@theme\` to be reachable by \`shadow-xs\`/\`shadow-sm\`.
+
 **Theme and branding arrive from the host.** \`PlatformProvider\` +
 \`PlatformThemeSync\` (already wired in \`app/layout.tsx\`) follow the app's
 light/dark choice and apply the workspace's brand colour to \`--primary\` /
@@ -12853,9 +12934,7 @@ or in their own \`CLAUDE.md\` / \`AGENTS.md\`), follow them instead.
     person in plain words that the changes are saved and that Release in
     Dashwise includes them. Don't ask them to merge anything.
 - Never force-push and never rewrite the default branch's history.
-- The person only confirms Release and Take live in Dashwise. When the work is
-  pushed, tell them it is ready: in Dashwise open the module, click Release,
-  then Take live.
+- When the work is pushed, tell the person it is ready to release.
 
 ## Cloud workflow
 
@@ -12866,8 +12945,8 @@ or in their own \`CLAUDE.md\` / \`AGENTS.md\`), follow them instead.
 - \`npm run smoke:production\` starts the built app on a local loopback port. If a cloud sandbox refuses that port, rerun the command with the network permission; never skip the check.
 - Report what you changed, the pushed SHA and the checks you ran, including failures, in plain words.
 - Never print, persist or commit secrets. Repository code delivery needs no Dashwise token. Do not log in or access company data for setup or checks; see "Dashwise login" for full development.
-- Never automatically release, publish, deploy or take an installation live. Release and Live require an explicit human action.
-- Even when the person says you may release, you can't do it for them: tell them in one sentence where to click (in Dashwise open the module, click Release, then Take live). Never ask for a \`dashwise login\` or a token just to release.
+- Before releasing, installing/updating an installation or taking live, propose the exact action in the chat and wait for the person to accept or change it; never do it on your own.
+- When the person accepts, do exactly that action if your Dashwise connection allows it; if Dashwise refuses, tell them what it said (for example a permission to turn on in My Account). If you have no way to do it, tell them in one sentence where to click (in Dashwise open the module, click Release, then Take live). Never ask for a \`dashwise login\` or a token just to release.
 
 ## If you can't see the repository
 
@@ -12911,13 +12990,15 @@ function companyApiHost(apiUrl) {
     return null;
   }
 }
+function docsApiHost(apiUrl) {
+  return companyApiHost(apiUrl) ?? new URL(DEFAULT_API_URL).host;
+}
 function apiHostLine(apiUrl) {
-  const host = companyApiHost(apiUrl);
-  return host ? `\`${host}\` (this company's Dashwise API; the company uses Dashwise at ${HOSTED_API_HOSTS[host]})` : "the company's Dashwise API host: `api.dashwise.net` if the person opens Dashwise at app.dashwise.net, `api.dashwise.dev` if at app.dashwise.dev. If you can't tell, ask them which address they use";
+  const host = docsApiHost(apiUrl);
+  return `\`${host}\` (this company's Dashwise API; the company uses Dashwise at ${HOSTED_API_HOSTS[host] ?? host})`;
 }
 function codexEnvironmentInstructions(apiUrl) {
-  const host = companyApiHost(apiUrl);
-  const apiUrlValue = host ? `https://${host}` : "https://<the company API host above>";
+  const apiUrlValue = `https://${docsApiHost(apiUrl)}`;
   return `## Codex cloud environment
 
 When the person asks you to set up the Codex cloud environment for this
@@ -12964,14 +13045,13 @@ Publishing is their click.
 `;
 }
 function claudeCloudNote(apiUrl) {
-  const host = companyApiHost(apiUrl);
   return `## Claude cloud
 
 Claude Code on the web has no environment setup chat. It reads this repository
 and \`CLAUDE.md\`, and \`.claude/settings.json\` runs \`scripts/cloud-setup.sh\`
 when a cloud session starts. Node 22 or 24 both work. If
 the environment has a network setting, allow the same domains as for Codex:
-${CLOUD_ALLOWED_HOSTS.map((h) => `\`${h}\``).join(", ")} and ${host ? `\`${host}\`` : "the company's Dashwise API host (`api.dashwise.net` for app.dashwise.net, `api.dashwise.dev` for app.dashwise.dev)"}. No secrets.
+${CLOUD_ALLOWED_HOSTS.map((h) => `\`${h}\``).join(", ")} and \`${docsApiHost(apiUrl)}\`. No secrets.
 `;
 }
 function agentsMd(opts) {
@@ -13215,15 +13295,17 @@ remain human actions. No Dashwise token is needed for
 repository code delivery.
 `;
 }
-var NODE_ENGINES, DEPLOY_TARGETS, SCAFFOLD_DEFAULT_API_URL, MODULE_SLUG_REGEX, CLOUD_ALLOWED_HOSTS, HOSTED_API_HOSTS;
+var NODE_ENGINES, DEPLOY_TARGETS, SCAFFOLD_DEFAULT_API_URL, GEIST_DEP_RANGE, MODULE_SLUG_REGEX, CLOUD_ALLOWED_HOSTS, HOSTED_API_HOSTS;
 var init_scaffold = __esm({
   "src/lib/scaffold.ts"() {
+    init_config();
     init_sdk_version();
     init_simple();
     init_custom();
     NODE_ENGINES = "22.x || 24.x";
     DEPLOY_TARGETS = ["railway", "vercel", "fly"];
     SCAFFOLD_DEFAULT_API_URL = "http://localhost:3000";
+    GEIST_DEP_RANGE = "^1.7.2";
     MODULE_SLUG_REGEX = /^[a-z]([a-z0-9-]*[a-z0-9])?$/;
     CLOUD_ALLOWED_HOSTS = [
       "registry.npmjs.org",
@@ -14056,6 +14138,339 @@ var init_diff_check = __esm({
   }
 });
 
+// src/lib/permission-hint.ts
+function str(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+function num(v) {
+  return typeof v === "number" && Number.isFinite(v) ? v : void 0;
+}
+function featureFromPermission(permission) {
+  const m = permission ? /^workspace\.feature\.([a-z0-9_]+)\.use$/.exec(permission) : null;
+  return m?.[1];
+}
+function featureSubject(ctx) {
+  const feature = str(ctx.feature) ?? featureFromPermission(str(ctx.permission));
+  if (feature && FEATURE_SUBJECTS[feature]) return FEATURE_SUBJECTS[feature];
+  return str(ctx.feature_label) ?? (feature ? `"${feature}"` : void 0);
+}
+function needsAdmin(what, module, ask) {
+  const scope = module ? ` for ${module}` : "";
+  return `${what}${scope} needs a Dashwise admin. Ask your Dashwise admin to ${ask}.`;
+}
+function refusalHint(code2, context, subject = {}) {
+  const ctx = context ?? {};
+  const module = subject.module ?? str(ctx.module_slug);
+  const installationId = subject.installationId ?? num(ctx.installation_id);
+  const installLabel = installationId !== void 0 ? ` (install #${installationId})` : "";
+  const named = module ?? "this module";
+  const reason = str(ctx.reason);
+  if (code2 === "MODULE_CAPABILITY_DENIED" && reason === "authoring_access_required") {
+    return {
+      message: "You need authoring access to export development data; ask someone who manages module access.",
+      needsGrant: true
+    };
+  }
+  if (code2 === "RAW_DATA_NOT_ALLOWED") {
+    if (reason === "raw_data_write_required") {
+      return {
+        message: "You don't have access to change this data. Ask a data list Admin for Editor access in the Data Hub Permissions tab.",
+        needsGrant: true
+      };
+    }
+    if (reason === "installation_access_required") {
+      return {
+        message: "You cannot open this installation with your current access; ask someone who manages installation access.",
+        needsGrant: true
+      };
+    }
+    return {
+      message: "You don't have access to view this data. Ask a data list Admin for Viewer access in the Data Hub Permissions tab.",
+      needsGrant: true
+    };
+  }
+  if (code2 === "VALIDATION_ERROR" && reason === "module_context_required") {
+    return {
+      message: "Open the intended module project and select the company and installation.",
+      needsGrant: false
+    };
+  }
+  if (code2 === "VALIDATION_ERROR" && reason === "context_mismatch") {
+    return {
+      message: "The selected company and installation do not match; check your selection.",
+      needsGrant: false
+    };
+  }
+  if (code2 === "UNAUTHENTICATED" && reason === "module_api_credential_missing") {
+    return {
+      message: "No module API key is configured; configure an existing key for the intended installation.",
+      needsGrant: false
+    };
+  }
+  switch (code2) {
+    case "DRAFT_INSTALLATION_MISSING":
+    case "DEV_INSTALLATION_MISSING":
+      return {
+        message: "This module has no dev installation; ask a module builder to create one.",
+        needsGrant: false
+      };
+    case "MANIFEST_MANAGED_BY_REPOSITORY":
+      return {
+        message: "This module's column rules are managed in module.json. Change human_edit and human_edit_reason there, then build and release the module.",
+        needsGrant: false
+      };
+    case "NOT_FOUND":
+    case "MODULE_NOT_FOUND":
+      return { message: "Not found; check your selection or ask for access.", needsGrant: false };
+    case "UNAUTHORIZED":
+    case "UNAUTHENTICATED":
+    case "TOKEN_EXPIRED":
+      return { message: "Run dashwise login, then retry.", needsGrant: false };
+    case "FEATURE_DISABLED":
+    case "PERMISSION_DENIED": {
+      const what = featureSubject(ctx);
+      if (!what) {
+        return {
+          message: `You don't have permission to do this${module ? ` for ${module}` : ""}. Ask your Dashwise admin for access.`,
+          needsGrant: true
+        };
+      }
+      return { message: needsAdmin(what, module, "enable it"), needsGrant: true };
+    }
+    case "RUNTIME_OPTION_OPERATOR_ONLY": {
+      const option = str(ctx.option);
+      const what = (option && OPTION_SUBJECTS[option]) ?? (option ? `"${option}"` : "This runtime option");
+      return { message: needsAdmin(what, module, "change it"), needsGrant: true };
+    }
+    case REBUILD_BUMP_OPERATOR_ONLY: {
+      const bump = str(ctx.bump) ?? "minor";
+      return {
+        message: needsAdmin(`A rebuild with a ${bump} version bump`, module, "run it"),
+        needsGrant: true
+      };
+    }
+    case "IMAGE_TAG_EXISTS":
+      return {
+        message: `This rebuild of ${named} needs a higher version bump than patch. A rebuild with a minor version bump needs a Dashwise admin. Ask your Dashwise admin to run it.`,
+        needsGrant: true
+      };
+    case "RUNTIME_IMAGE_NOT_ELIGIBLE": {
+      const version = str(ctx.version);
+      const target = installationId !== void 0 ? ` --rollout installs:${installationId}` : "";
+      return {
+        message: `${named}${version ? ` v${version}` : ""} was built before streaming support. Rebuild it and upgrade this install first: dashwise module rebuild${module ? ` ${module}` : ""}${target}`,
+        needsGrant: false
+      };
+    }
+    case "RUNTIME_SWAP_PENDING": {
+      const version = str(ctx.version);
+      return {
+        message: `${named}${installLabel} is still finishing its update${version ? ` to v${version}` : ""}, so streaming cannot be turned on yet. Try again in a few minutes.`,
+        needsGrant: false
+      };
+    }
+    case "RUNTIME_OPTION_UNAVAILABLE": {
+      const option = str(ctx.option);
+      const what = (option && OPTION_SUBJECTS[option]) ?? "This runtime option";
+      return { message: `${what} is switched off platform-wide right now.`, needsGrant: false };
+    }
+    case "RUNTIME_CHANGE_IN_PROGRESS": {
+      const op = num(ctx.operation_id);
+      return {
+        message: `A runtime change is already being applied to ${named}${op !== void 0 ? ` (operation #${op})` : ""}. Wait for it, then check: dashwise module runtime${module ? ` ${module}` : ""}`,
+        needsGrant: false
+      };
+    }
+    case "BUILD_IN_PROGRESS": {
+      const buildId = num(ctx.build_id);
+      const status = str(ctx.status);
+      const which = buildId !== void 0 ? ` (#${buildId}${status ? `, ${status}` : ""})` : "";
+      return {
+        message: `A build of ${named} is already running${which}. Wait for it to finish, then run the rebuild again.`,
+        needsGrant: false
+      };
+    }
+    case "REBUILD_SOURCE_NOT_FOUND":
+      return {
+        message: `${named} has no build from source to rebuild. Publish it first: dashwise module publish`,
+        needsGrant: false
+      };
+    case "INSTALLATION_NOT_FOUND":
+      return {
+        message: `${installationId !== void 0 ? `Installation #${installationId}` : "The installation"} was not found, or you cannot see it.`,
+        needsGrant: false
+      };
+    case "PUBLISH_RATE_LIMITED":
+    case "PUBLISH_USER_RATE_LIMITED":
+      return {
+        message: `Too many builds of ${named} in the last hour. Try again later.`,
+        needsGrant: false
+      };
+    // Install invitations (`dashwise module invites`, Südbau retro 6).
+    case "AUTHOR_ADMIN_REQUIRED":
+      return {
+        message: `Only an admin of the company that owns ${named} can manage its install invitations. Ask that company's admin.`,
+        needsGrant: true
+      };
+    case "COMPANY_ADMIN_REQUIRED":
+      return {
+        message: "Only an admin of this company can see or decline its install invitations. Ask your company's admin.",
+        needsGrant: true
+      };
+    case "MODULE_PRIVATE_SHARE_FIRST":
+      return {
+        message: `${named} is still private. Share it with your company in Dashwise first, then invite another company.`,
+        needsGrant: false
+      };
+    default:
+      if (MODULE_RIGHT_CODES.has(code2)) {
+        return {
+          message: `You can't manage ${named}${installLabel}. Ask your Dashwise admin for access.`,
+          needsGrant: true
+        };
+      }
+      return null;
+  }
+}
+function reportCliError(message, opts) {
+  if (opts.json) {
+    out(
+      JSON.stringify({
+        error: {
+          code: opts.code ?? "CLI_ERROR",
+          message: message.replace(ANSI, ""),
+          status: null,
+          context: null
+        },
+        hint: null,
+        needs_grant: false
+      })
+    );
+  } else {
+    fail(message);
+  }
+  return 1;
+}
+function reportFailedOutcome(failure, hint, opts) {
+  if (opts.json) {
+    out(
+      JSON.stringify({
+        error: {
+          code: failure.code,
+          message: failure.message ?? null,
+          status: null,
+          context: null
+        },
+        hint: hint?.message ?? null,
+        needs_grant: hint?.needsGrant ?? false,
+        ...opts.extra
+      })
+    );
+  } else {
+    fail(hint?.message ?? opts.fallback);
+  }
+  return hint?.needsGrant ? EXIT_NEEDS_GRANT : 1;
+}
+function isTransientPollError(err) {
+  if (!(err instanceof ApiError)) return true;
+  return err.status === 0 || err.status === 429 || err.status >= 500;
+}
+function isTypedRequestError(err) {
+  if (err instanceof ApiError) return true;
+  if (!(err instanceof Error)) return false;
+  const candidate = err;
+  return typeof candidate.code === "string" && typeof candidate.status === "number" && (candidate.context === void 0 || candidate.context !== null && typeof candidate.context === "object" && !Array.isArray(candidate.context));
+}
+function reportRefusal(err, subject, opts) {
+  const writeJson = (message) => {
+    if (opts.stderr) process.stderr.write(`${message}
+`);
+    else out(message);
+  };
+  if (!isTypedRequestError(err)) {
+    const message = err?.message ?? String(err);
+    if (opts.json) {
+      writeJson(
+        JSON.stringify({
+          error: {
+            code: "CLI_ERROR",
+            message: message.replace(ANSI, ""),
+            status: null,
+            context: null
+          },
+          hint: null,
+          needs_grant: false
+        })
+      );
+    } else {
+      fail(`${opts.action} failed: ${message}`);
+    }
+    return 1;
+  }
+  const hint = err.status === 401 && err.context?.reason !== "module_api_credential_missing" ? {
+    message: opts.moduleKey ? MODULE_KEY_REFUSED[opts.moduleKey] : "Your login has expired. Run: dashwise login",
+    needsGrant: false
+  } : refusalHint(err.code, err.context, subject);
+  if (opts.json) {
+    writeJson(
+      JSON.stringify({
+        error: {
+          code: err.code,
+          message: err.message,
+          status: err.status,
+          context: err.context ?? null
+        },
+        hint: hint?.message ?? null,
+        needs_grant: hint?.needsGrant ?? false
+      })
+    );
+  } else if (hint) {
+    fail(
+      `${hint.message} (${err.code})${err.context ? ` context=${JSON.stringify(err.context)}` : ""}`
+    );
+  } else {
+    fail(
+      `${opts.action} failed (${err.code}): ${err.message}${err.context ? ` context=${JSON.stringify(err.context)}` : ""}`
+    );
+  }
+  return hint?.needsGrant ? EXIT_NEEDS_GRANT : 1;
+}
+var EXIT_NEEDS_GRANT, EXIT_TIMED_OUT, REBUILD_BUMP_OPERATOR_ONLY, FEATURE_SUBJECTS, OPTION_SUBJECTS, MODULE_RIGHT_CODES, ANSI, MODULE_KEY_REFUSED;
+var init_permission_hint = __esm({
+  "src/lib/permission-hint.ts"() {
+    init_api_client();
+    init_output();
+    EXIT_NEEDS_GRANT = 3;
+    EXIT_TIMED_OUT = 4;
+    REBUILD_BUMP_OPERATOR_ONLY = "REBUILD_BUMP_OPERATOR_ONLY";
+    FEATURE_SUBJECTS = {
+      module_runtime_streaming: "Streaming",
+      module_rebuild: "Rebuild",
+      module_building: "Building modules",
+      module_runtime_sizing: "Memory size"
+    };
+    OPTION_SUBJECTS = {
+      streaming: "Streaming",
+      memory_mb: "Memory size",
+      reapply: "Re-applying the runtime",
+      timeout: "The timeout",
+      reserved_concurrency: "Reserved concurrency",
+      log_retention: "Log retention"
+    };
+    MODULE_RIGHT_CODES = /* @__PURE__ */ new Set([
+      "MODULE_CAPABILITY_DENIED",
+      "PUBLISH_REQUIRES_ADMIN",
+      "NOT_COPY_OWNER"
+    ]);
+    ANSI = /\x1b\[[0-9;]*m/g;
+    MODULE_KEY_REFUSED = {
+      env: "The module key in DASHWISE_API_KEY was refused (expired or revoked). Replace it with a current key, or unset it to use this module's saved key. dashwise login does not renew module keys.",
+      env_file: "The module key in .env.local (DASHWISE_API_KEY) was refused (expired or revoked). Replace it, or remove that line to use this module's saved key. dashwise login does not renew module keys.",
+      saved: `This module's saved key was refused (expired or revoked). In your CLI auth.json, set only modules[<slug>].apiKey to an empty string (""), keeping installationId and all other fields. Then run dashwise dev from this module's directory with DASHWISE_API_KEY unset to mint and save a replacement key for the same installation. dashwise login does not renew module keys.`
+    };
+  }
+});
+
 // src/lib/manifest-reference-lint.ts
 function referenceFieldWarnings(manifest) {
   const tables = manifest?.owns?.tables;
@@ -14394,7 +14809,7 @@ async function destroyDevInstallCommand(options) {
     return 0;
   }
   if (!options.yes && process.stdout.isTTY) {
-    const choice = await confirm({
+    const choice = await confirm$1({
       message: `Destroy dev install ${code(`${slug} (id=${entry.installationId})`)}? Tables and rows will be soft-deleted (recoverable for 30 days via dashboard trash).`
     });
     if (isCancel(choice) || !choice) {
@@ -14532,48 +14947,58 @@ __export(push_exports, {
   schemaPushCommand: () => schemaPushCommand
 });
 async function schemaPushCommand(options) {
+  const report = (err) => reportRefusal(err, {}, { ...options, stderr: true, action: "Schema push" });
+  const contextError = (message) => report(
+    new ApiError(
+      0,
+      {
+        code: "VALIDATION_ERROR",
+        message,
+        context: { reason: "module_context_required" }
+      },
+      message
+    )
+  );
   const projectRoot = resolve(options.dir ?? process.cwd());
   let manifest;
   try {
     manifest = readManifestOrThrow(projectRoot);
   } catch (err) {
-    fail(err.message);
-    return 1;
+    return contextError(err.message);
   }
   const slug = manifest.module?.slug;
   if (!slug) {
-    fail(`module.json has no ${code("module.slug")} \u2014 the manifest is malformed.`);
-    return 1;
+    return contextError("module.json has no module.slug.");
   }
   const cfg = readConfig();
   if (!cfg) {
-    fail(`Not logged in. Run ${code("dashwise login")} first.`);
-    return 1;
+    return report(
+      new ApiError(401, { code: "UNAUTHENTICATED", message: "Not logged in." }, "Not logged in.")
+    );
   }
   const auth = { baseUrl: resolveApiUrl(), auth: { token: cfg.token } };
   let moduleId;
   try {
     moduleId = (await getModuleBySlug(slug, auth)).id;
   } catch (err) {
-    if (err instanceof ApiError && err.status === 404) {
-      fail(
-        `Module ${code(slug)} isn't registered on the backend yet. Run ${code("dashwise init")} (or ${code("dashwise module register")}) first.`
-      );
-      return 1;
-    }
-    fail(`Could not resolve module ${code(slug)}: ${err.message}`);
-    return 1;
+    return reportRefusal(
+      err,
+      { module: slug },
+      { ...options, stderr: true, action: "Resolve module" }
+    );
   }
   const entry = readModuleEntry(slug);
   const dwkAuth = entry?.apiKey ? { baseUrl: resolveApiUrl(), auth: { token: entry.apiKey } } : null;
   let remote = null;
   let previewUnavailableReason = null;
+  let previewError = null;
   if (!dwkAuth) {
-    previewUnavailableReason = `no dev-install ${code("dwk_")} key is cached for ${code(slug)} in auth.json`;
+    previewUnavailableReason = `no dev-install dwk_ key is cached for ${slug} in auth.json`;
   } else {
     try {
       remote = (await getInstallationSchema(dwkAuth)).manifest;
     } catch (err) {
+      previewError = err;
       const detail = err instanceof ApiError ? `${err.code} ${err.status}: ${err.message}` : err.message;
       previewUnavailableReason = `reading the dev-install manifest failed (${detail}) \u2014 the cached key may be expired or revoked`;
     }
@@ -14613,15 +15038,32 @@ async function schemaPushCommand(options) {
       }
     }
   } else {
-    warn(
-      `Cannot preview what this push would change: ${previewUnavailableReason}.
+    if (!options.json) {
+      warn(
+        `Cannot preview what this push would change: ${previewUnavailableReason}.
   Without the preview there is no way to know whether the push REMOVES tables/fields (live DDL on the dev install).`
-    );
+      );
+    }
     if (!options.yes) {
-      fail(
-        `Refusing to push without the destructive-change preview. Re-run with ${code("--yes")} to push anyway (the backend still validates the apply).`
+      if (previewError instanceof ApiError && [401, 403, 404].includes(previewError.status)) {
+        return reportRefusal(
+          previewError,
+          { module: slug },
+          { ...options, stderr: true, action: "Schema preview", moduleKey: "saved" }
+        );
+      }
+      const message = `Refusing to push without the destructive-change preview (${previewUnavailableReason}). Re-run with --yes to push anyway (the backend still validates the apply).`;
+      return report(
+        new ApiError(
+          0,
+          {
+            code: "PREVIEW_UNAVAILABLE",
+            message,
+            context: { reason: dwkAuth ? "preview_read_failed" : "module_key_missing" }
+          },
+          message
+        )
       );
-      return 1;
     }
     info(
       dim(
@@ -14638,7 +15080,7 @@ async function schemaPushCommand(options) {
       auth
     );
   } catch (err) {
-    return surfaceSchemaPushError(err, slug);
+    return surfaceSchemaPushError(err, slug, options.json);
   }
   printApplySummary(applied);
   for (const w of referenceFieldWarnings(manifest)) warn(w.message);
@@ -14715,21 +15157,23 @@ function strProp(v, key) {
   }
   return void 0;
 }
-function surfaceSchemaPushError(err, slug) {
+function surfaceSchemaPushError(err, slug, json) {
+  if (json || !(err instanceof ApiError) || refusalHint(err.code, err.context, { module: slug }) || err.status === 401) {
+    return reportRefusal(err, { module: slug }, { json, stderr: true, action: "Schema push" });
+  }
+  process.stderr.write(
+    `(${err.code})${err.context ? ` context=${JSON.stringify(err.context)}` : ""}
+`
+  );
   if (err instanceof ApiError) {
     switch (err.code) {
       case "MANIFEST_INVALID":
         fail(`Manifest rejected by the backend validator: ${err.message}`);
         for (const issue of extractIssues2(err.context)) {
-          out(`    ${dim("-")} ${issue}`);
+          process.stderr.write(`    ${dim("-")} ${issue}
+`);
         }
         return 1;
-      case "DRAFT_INSTALLATION_MISSING":
-        fail(
-          `Module ${code(slug)} has no dev (local/sandbox) install in its owner workspace \u2014 production installs have NO draft plane, so there is nothing to push onto.
-  This happens after ${code("dashwise module install --replace-dev-install")}. Schema changes now ship as published versions: edit module.json, ${code("dashwise module publish --bump <patch|minor|major>")}, then ${code("dashwise module install")} to upgrade.`
-        );
-        return 1;
       case "UNIQUE_INDEX_BACKFILL_CONFLICT":
         fail(
           `Cannot create a UNIQUE index \u2014 existing live rows already violate it: ${err.message}
@@ -14750,14 +15194,15 @@ function surfaceSchemaPushError(err, slug) {
       case "FORBIDDEN":
       case "NOT_WORKSPACE_MEMBER":
         fail(
-          `Not authorized: pushing a draft manifest requires membership of the module's owner workspace.`
+          `Not authorized: pushing a draft manifest requires membership of the module's owner company.`
         );
         return 1;
       default:
         if (err.status === 400) {
           fail(`Manifest rejected: ${err.message}`);
           for (const issue of extractIssues2(err.context)) {
-            out(`    ${dim("-")} ${issue}`);
+            process.stderr.write(`    ${dim("-")} ${issue}
+`);
           }
           return 1;
         }
@@ -14789,6 +15234,7 @@ var init_push = __esm({
     init_config();
     init_manifest_io();
     init_manifest_merge();
+    init_permission_hint();
     init_output();
     init_manifest_reference_lint();
   }
@@ -15965,29 +16411,11 @@ async function runDoctorChecks(dir, deps) {
   return checks;
 }
 function targetCheck(apiUrl) {
-  const source = process.env.DASHWISE_API_URL?.trim() ? "from DASHWISE_API_URL" : "from your saved login";
-  if (sameOrigin(apiUrl, KNOWN_API_URLS.prod)) {
-    return {
-      id: "target",
-      label: "Target",
-      status: "warn",
-      detail: `PRODUCTION (${apiUrl}, ${source}). Commands here change real company data.`,
-      fix: `To build against dev, run ${code(`dashwise login --api-url ${KNOWN_API_URLS.dev}`)} or set ${code(`DASHWISE_API_URL=${KNOWN_API_URLS.dev}`)}.`
-    };
-  }
-  if (sameOrigin(apiUrl, KNOWN_API_URLS.dev)) {
-    return {
-      id: "target",
-      label: "Target",
-      status: "ok",
-      detail: `dev (${apiUrl}, ${source})`
-    };
-  }
   return {
     id: "target",
     label: "Target",
     status: "ok",
-    detail: `custom (${apiUrl}, ${source})`
+    detail: apiUrl
   };
 }
 async function connectionOnly(apiUrl) {
@@ -16168,13 +16596,6 @@ function sameRepo(a, b) {
   const ka = repoKey(a);
   return ka !== null && ka === repoKey(b);
 }
-function sameOrigin(a, b) {
-  try {
-    return new URL(a).origin === new URL(b).origin;
-  } catch {
-    return false;
-  }
-}
 function safeReadConfig2() {
   try {
     return readConfig();
@@ -16335,7 +16756,7 @@ function startMcpProxy(opts) {
   const reconnectMs = opts.reconnectMs ?? 2e3;
   const verbose = opts.verbose === true;
   const readOnly = opts.readOnly === true;
-  let session = opts.session;
+  let session2 = opts.session;
   let sessionId = null;
   let protocolVersion = null;
   let readTools = null;
@@ -16364,7 +16785,7 @@ function startMcpProxy(opts) {
       parsed = JSON.parse(text4);
     } catch {
       log2(
-        `Discarded a non-JSON response from ${redactUrl(session.connectUrl)} (${source}); stdout carries MCP frames only.`
+        `Discarded a non-JSON response from ${redactUrl(session2.connectUrl)} (${source}); stdout carries MCP frames only.`
       );
       trace(`discarded ${Buffer.byteLength(text4, "utf8")} bytes of non-JSON`);
       return;
@@ -16374,7 +16795,7 @@ function startMcpProxy(opts) {
     ) : parsed !== null && typeof parsed === "object" && "jsonrpc" in parsed;
     if (!looksJsonRpc) {
       log2(
-        `Discarded a JSON response from ${redactUrl(session.connectUrl)} that is not JSON-RPC (${source}).`
+        `Discarded a JSON response from ${redactUrl(session2.connectUrl)} that is not JSON-RPC (${source}).`
       );
       return;
     }
@@ -16405,7 +16826,7 @@ function startMcpProxy(opts) {
     reauthAttempt = (async () => {
       log2("The session key expired or was rotated \u2014 re-authenticating once.");
       try {
-        session = await reauth();
+        session2 = await reauth();
         sessionId = null;
         return true;
       } catch (err) {
@@ -16446,7 +16867,7 @@ function startMcpProxy(opts) {
   };
   const post = async (text4, isInitialize) => {
     if (stopped) return null;
-    return doFetch(session.connectUrl, {
+    return doFetch(session2.connectUrl, {
       method: "POST",
       headers: requestHeaders(isInitialize),
       body: text4
@@ -16474,7 +16895,7 @@ function startMcpProxy(opts) {
       res = await post(text4, isInitialize);
     } catch (err) {
       const message = err.message;
-      log2(`Transport error talking to ${redactUrl(session.connectUrl)}: ${message}`);
+      log2(`Transport error talking to ${redactUrl(session2.connectUrl)}: ${message}`);
       emit(transportErrorFrame(frame?.id ?? null, `Transport error: ${message}`));
       return { kind: "failed" };
     }
@@ -16498,7 +16919,7 @@ function startMcpProxy(opts) {
     const bodyText = await res.text();
     if (!res.ok) {
       const detail = res.status === 401 ? "the endpoint key is no longer valid (expired, rotated by another `dashwise mcp`, or revoked)" : `HTTP ${res.status}`;
-      log2(`Refused by ${redactUrl(session.connectUrl)}: ${detail}`);
+      log2(`Refused by ${redactUrl(session2.connectUrl)}: ${detail}`);
       emit(transportErrorFrame(frame?.id ?? null, `Dashwise MCP server: ${detail}`));
       if (res.status === 401) {
         exitCode = 1;
@@ -16585,7 +17006,7 @@ function startMcpProxy(opts) {
     streamAbort = new AbortController();
     let res;
     try {
-      res = await doFetch(session.connectUrl, {
+      res = await doFetch(session2.connectUrl, {
         method: "GET",
         headers: {
           Accept: "text/event-stream",
@@ -16621,7 +17042,7 @@ function startMcpProxy(opts) {
       }
       streamUnavailable = true;
       log2(
-        `Server stream refused by ${redactUrl(session.connectUrl)}: the session could not be renewed (the endpoint key expired, was rotated, or was revoked).`
+        `Server stream refused by ${redactUrl(session2.connectUrl)}: the session could not be renewed (the endpoint key expired, was rotated, or was revoked).`
       );
       emit(
         transportErrorFrame(
@@ -16898,9 +17319,9 @@ async function mcpCommand(options = {}) {
     return 1;
   }
   const label = options.endpointName ?? defaultEndpointLabel();
-  let session;
+  let session2;
   try {
-    session = await openCliSession({
+    session2 = await openCliSession({
       workspaceId: workspace2.id,
       label,
       ...scopes !== void 0 ? { scopes } : {}
@@ -16909,24 +17330,24 @@ async function mcpCommand(options = {}) {
     fail(describeSessionError(err, apiUrl, scopes));
     return 1;
   }
-  if (scopes !== void 0 && !Array.isArray(session.scopes)) {
-    await revokeSession(session.endpointId);
+  if (scopes !== void 0 && !Array.isArray(session2.scopes)) {
+    await revokeSession(session2.endpointId);
     fail(SCOPES_NOT_APPLIED);
     return 1;
   }
   info(
-    `Dashwise MCP \u2014 workspace ${workspace2.slug}, endpoint #${session.endpointId} (${session.name}).`
+    `Dashwise MCP \u2014 workspace ${workspace2.slug}, endpoint #${session2.endpointId} (${session2.name}).`
   );
-  info(`Session key expires ${dim(session.expiresAt)}.`);
-  info(describeScopes(session.scopes));
+  info(`Session key expires ${dim(session2.expiresAt)}.`);
+  info(describeScopes(session2.scopes));
   if (options.readOnly) {
     warn(
       "Read-only: write tools are refused by this proxy (a client-side guard, not a server-enforced scope \u2014 for that, use --scope)."
     );
   }
-  let ownedEndpointId = session.endpointId;
+  let ownedEndpointId = session2.endpointId;
   const proxy = startMcpProxy({
-    session,
+    session: session2,
     reauth: async () => {
       const fresh = await openCliSession({
         workspaceId: workspace2.id,
@@ -17939,7 +18360,9 @@ function convertModule(opts) {
     "app/layout.jsx",
     "src/app/layout.tsx"
   ].find((f) => existsSync(join(dir, f)));
+  let layoutCreated = false;
   if (!layoutFile) {
+    layoutCreated = true;
     writeIfMissing("app/layout.tsx", appLayoutCustomTsx(sopts));
   } else if (!readFileSync(join(dir, layoutFile), "utf-8").includes("AuthProvider")) {
     warnings.push(
@@ -17955,10 +18378,13 @@ function convertModule(opts) {
       `${nextConfigFile}: add \`output: 'standalone'\` \u2014 required for the module runtime bundle.`
     );
   }
-  if (!pkg.dependencies?.["@dashai/sdk"]) {
-    pkg.dependencies = { ...pkg.dependencies ?? {}, "@dashai/sdk": SDK_DEP_RANGE };
+  const addDeps = {};
+  if (!pkg.dependencies?.["@dashai/sdk"]) addDeps["@dashai/sdk"] = SDK_DEP_RANGE;
+  if (layoutCreated && !pkg.dependencies?.geist) addDeps.geist = GEIST_DEP_RANGE;
+  if (Object.keys(addDeps).length > 0) {
+    pkg.dependencies = { ...pkg.dependencies ?? {}, ...addDeps };
     writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf-8");
-    created.push("package.json (added @dashai/sdk)");
+    created.push(`package.json (added ${Object.keys(addDeps).join(", ")})`);
   }
   const outboundApis = scanOutboundHosts(dir);
   const runtimeBlockAdded = normalizeManifest(join(dir, "module.json"), {
@@ -18782,13 +19208,13 @@ init_api_client();
 function redactedConsumer(redacted) {
   switch (redacted) {
     case "private_copy":
-      return "someone's private copy";
+      return "someone's private installation";
     case "other_team_copy":
-      return "another team's copy";
+      return "another team's installation";
     case "development_copy":
-      return "a development copy you cannot see";
+      return "a development installation you cannot see";
     default:
-      return "a copy you cannot see";
+      return "an installation you cannot see";
   }
 }
 var WIDEN_WORDS = {
@@ -18806,7 +19232,7 @@ var WIDEN_WORDS = {
 function describeWidening(widening) {
   return widening.map((w) => WIDEN_WORDS[w] ?? w).join(", ");
 }
-async function getUpgradePreview(installationId, version, options = {}) {
+async function getUpgradePreview2(installationId, version, options = {}) {
   return apiRequest(
     "GET",
     `/api/installations/${installationId}/upgrade-preview?version=${encodeURIComponent(version)}`,
@@ -18873,6 +19299,9 @@ function selectInstallsByKind(installs, moduleId) {
 function isRealRuntimeUrl(url) {
   return !!url && /^https:\/\//i.test(url);
 }
+function isRuntimeProvisioned(row) {
+  return row.runtime_https ?? isRealRuntimeUrl(row.runtime_url);
+}
 function isDraftVersion(v) {
   return !v || v.includes("draft");
 }
@@ -18916,6 +19345,71 @@ async function resolveWorkspaceWithFallback(opts) {
 // src/commands/module/install.ts
 init_output();
 init_connect_status();
+
+// src/lib/upgrade-plan.ts
+init_api_client();
+init_output();
+function upgradePlanOf(err) {
+  if (!(err instanceof ApiError) || err.code !== "UPGRADE_CONFIRM_REQUIRED") {
+    return null;
+  }
+  const body = err.body;
+  if (!body || typeof body.drift_hash !== "string") return null;
+  return {
+    ...body,
+    drift_hash: body.drift_hash,
+    breaks_consumers: Array.isArray(body.breaks_consumers) ? body.breaks_consumers : []
+  };
+}
+var REDACTED_LABEL = {
+  private_copy: "someone's private installation",
+  other_team_copy: "another team's installation",
+  development_copy: "a development installation"
+};
+function consumerLabel(c2) {
+  if (c2.redacted) return REDACTED_LABEL[c2.redacted] ?? "an installation you cannot see";
+  const name = c2.module_name ?? c2.module_slug ?? "a module";
+  const slug = c2.module_slug && c2.module_name ? ` (${c2.module_slug})` : "";
+  const id = c2.installation_id != null ? ` #${c2.installation_id}` : "";
+  return `${name}${slug}${id}`;
+}
+var count2 = (n, noun) => n == null ? "" : `, ${n} ${noun}${n === 1 ? "" : "s"}`;
+function renderUpgradePlan(slug, plan) {
+  const n = plan.breaks_consumers.length;
+  const to = plan.to_version ? ` to ${code(`v${plan.to_version}`)}` : "";
+  if (n === 0) {
+    info(`Upgrading ${code(slug)}${to} no longer disconnects any module that reads from it.`);
+  } else {
+    warn(
+      `Upgrading ${code(slug)}${to} breaks ${n} module${n === 1 ? "" : "s"} that read from it. ${n === 1 ? "It is" : "They are"} disconnected until updated:`
+    );
+    for (const c2 of plan.breaks_consumers) info(`  - ${consumerLabel(c2)}`);
+  }
+  const d = plan.drift?.details;
+  const lines = [
+    ...(d?.tables_to_remove ?? []).map(
+      (t) => `remove table ${code(t.name)}${count2(t.rows, "row")}`
+    ),
+    ...(d?.fields_to_remove ?? []).map(
+      (f) => `remove field ${code(`${f.table}.${f.name}`)}${count2(f.values, "value")}`
+    ),
+    ...(d?.fields_to_retype ?? []).map(
+      (f) => `change field ${code(`${f.table}.${f.name}`)} from ${f.from} to ${f.to}${count2(f.values, "value")}`
+    )
+  ];
+  if (lines.length > 0) {
+    info("It also changes this installation:");
+    for (const line of lines) info(`  - ${line}`);
+  }
+}
+function planLosesData(plan) {
+  const drift = plan.drift;
+  if (!drift) return true;
+  const details = drift.details;
+  return (details?.tables_to_remove?.some((t) => t.rows !== 0) ?? (drift.tables_to_remove?.length ?? 0) > 0) || (details?.fields_to_remove?.some((f) => f.values !== 0) ?? (drift.fields_to_remove?.length ?? 0) > 0) || (details?.fields_to_retype?.some((f) => f.values !== 0) ?? (drift.fields_to_retype?.length ?? 0) > 0);
+}
+
+// src/commands/module/install.ts
 async function moduleInstallCommand(slugArg, options) {
   const slug = resolveSlug(slugArg, options.dir);
   if (!slug) {
@@ -18973,14 +19467,27 @@ async function moduleInstallCommand(slugArg, options) {
     const installs = await listWorkspaceInstallations(workspace2.id, auth);
     const byKind = selectInstallsByKind(installs, mod.id);
     const production = byKind.all.filter((row2) => !isDevInstallKind(row2.kind));
-    if (production.length > 1) {
-      fail(
-        "Several production installations exist for this module in this company. Select the installation to update in the app. Nothing was changed."
-      );
-      return 1;
-    }
-    existing = production[0];
     devInstall = byKind.dev;
+    if (options.installation !== void 0) {
+      existing = production.find((row2) => row2.id === options.installation);
+      if (!existing) {
+        fail(
+          `Installation #${options.installation} is not a production installation of ${code(mod.slug)} you can see in this company. Nothing was changed.`
+        );
+        listInstallationCandidates(production);
+        return 1;
+      }
+    } else {
+      const candidates = production.filter((row2) => row2.held !== true);
+      if (candidates.length > 1 || candidates.length === 0 && production.length > 0) {
+        fail(
+          candidates.length > 1 ? `Several production installations of ${code(mod.slug)} exist in this company. Choose one with ${code("--installation <id>")}. Nothing was changed.` : `The only production installations of ${code(mod.slug)} here are held. To update one, choose it with ${code("--installation <id>")}. Nothing was changed.`
+        );
+        listInstallationCandidates(production);
+        return 1;
+      }
+      existing = candidates[0];
+    }
   } catch (err) {
     fail(
       `Could not read workspace installations: ${err.message}`
@@ -19027,7 +19534,7 @@ async function moduleInstallCommand(slugArg, options) {
       );
     } else {
       info(
-        `Existing production install #${existing.id}${installedVersion2 ? ` at ${code(`v${installedVersion2}`)}` : ""} \u2014 this will upgrade it to ${code(`v${targetVersion}`)}.`
+        `Existing production install ${describeInstallation(existing)}${installedVersion2 ? ` at ${code(`v${installedVersion2}`)}` : ""} \u2014 this will upgrade it to ${code(`v${targetVersion}`)}.`
       );
     }
   }
@@ -19035,15 +19542,19 @@ async function moduleInstallCommand(slugArg, options) {
   let lossy = false;
   let lossAccepted = false;
   if (existing) {
-    const rerun = rerunLine(mod.slug, workspace2.slug, targetVersion, options, devInstallToReplace !== void 0);
+    const rerun = rerunLine(mod.slug, workspace2.slug, targetVersion, existing.id, options, devInstallToReplace !== void 0);
     const previewed = await previewUpgrade(existing.id, targetVersion, options, auth, rerun, devInstallToReplace?.id);
     if (typeof previewed === "number") return previewed;
     preview = previewed.preview;
     lossy = previewed.lossy;
     lossAccepted = previewed.accepted;
   }
+  if (options.force && (preview?.breaks_consumers?.length ?? 0) > 0 && !options.yes && (!process.stdout.isTTY || !process.stdin.isTTY || options.json)) {
+    fail(`Nothing was changed. Re-run with ${code("--force --yes")} to confirm the listed disconnections, or run in a terminal to be asked.`);
+    return 1;
+  }
   const askForLoss = lossy && !lossAccepted;
-  if (askForLoss || !options.yes && process.stdout.isTTY && !confirmedViaPicker) {
+  if (askForLoss || !options.yes && process.stdout.isTTY && process.stdin.isTTY && !confirmedViaPicker) {
     const lossClause = lossy ? " It moves the data listed above to the Trash or converts it." : "";
     const message = devInstallToReplace ? isUpgrade ? `Destroy the dev install (revokes local-dev credentials) and upgrade ${code(mod.slug)} to ${code(`v${targetVersion}`)} in ${code(workspace2.slug)}?${lossClause}` : `Replace the dev install (revokes local-dev credentials) and install ${code(mod.slug)} ${code(`v${targetVersion}`)} into ${code(workspace2.slug)} as production?` : `${isUpgrade ? "Upgrade" : "Install"} ${code(mod.slug)} ${code(`v${targetVersion}`)} into workspace ${code(workspace2.slug)}?${lossClause}`;
     const answer = await select({
@@ -19070,26 +19581,63 @@ async function moduleInstallCommand(slugArg, options) {
   }
   info("Provisioning the runtime \u2014 this can take a minute\u2026");
   let result;
-  try {
-    result = await installModule(
-      mod.id,
-      {
-        workspaceId: workspace2.id,
-        version: targetVersion,
-        ...existing ? { installation_id: existing.id } : {},
-        ...options.force !== void 0 ? { force: options.force } : {},
-        // P5-08: confirms exactly the delta that was shown (409 DRIFT_CHANGED otherwise).
-        ...preview ? { drift_hash: preview.drift_hash } : {}
-      },
-      auth
-    );
-  } catch (err) {
-    return surfaceInstallError(err, mod.slug, workspace2.slug, devInstallReplaced);
+  let confirmedPlan;
+  for (let round = 0; ; round++) {
+    try {
+      result = await installModule(
+        mod.id,
+        {
+          workspaceId: workspace2.id,
+          // L420(3): always the resolved version and, for an upgrade, the
+          // announced installation; after a confirm, the plan's version.
+          version: confirmedPlan?.to_version ?? targetVersion,
+          ...existing ? { installation_id: existing.id } : {},
+          ...options.force !== void 0 ? { force: options.force } : {},
+          ...confirmedPlan ? { drift_hash: confirmedPlan.drift_hash } : preview ? { drift_hash: preview.drift_hash } : {}
+        },
+        auth
+      );
+      break;
+    } catch (err) {
+      let plan = null;
+      if (confirmedPlan && err instanceof ApiError && err.code === "DRIFT_CHANGED" && round < MAX_PLAN_ROUNDS) {
+        warn(
+          "What this upgrade changes has changed since it was shown. Showing the new plan."
+        );
+        plan = await refetchUpgradePlan(confirmedPlan, auth);
+        if (!plan) {
+          return surfaceInstallError(err, mod.slug, workspace2.slug, devInstallReplaced);
+        }
+      } else {
+        plan = options.force && !confirmedPlan ? upgradePlanOf(err) : null;
+        if (!plan || round >= MAX_PLAN_ROUNDS) {
+          return surfaceInstallError(err, mod.slug, workspace2.slug, devInstallReplaced);
+        }
+      }
+      if (!existing || plan.installation_id !== existing.id || plan.to_version !== targetVersion || !plan.drift_hash) {
+        fail("The upgrade plan does not match the announced installation and version. Nothing was changed; check the installation in the app.");
+        if (devInstallReplaced) printDevInstallAftermath(mod.slug, workspace2.slug);
+        return 1;
+      }
+      const confirmed = await confirmUpgradePlan(
+        mod.slug,
+        plan,
+        options,
+        preview?.drift_hash,
+        rerunLine(mod.slug, workspace2.slug, targetVersion, existing.id, options, devInstallToReplace !== void 0)
+      );
+      if (confirmed !== 0) {
+        if (devInstallReplaced) printDevInstallAftermath(mod.slug, workspace2.slug);
+        return confirmed;
+      }
+      confirmedPlan = plan;
+    }
   }
   if (existing && (isInstallGated(result) || result.installation.id !== existing.id)) {
     fail(
       `The backend did not confirm an in-place update of installation #${existing.id}. Check its state in the app before retrying; no fallback install will be attempted.`
     );
+    if (devInstallReplaced) printDevInstallAftermath(mod.slug, workspace2.slug);
     return 1;
   }
   if (isInstallGated(result)) {
@@ -19119,7 +19667,7 @@ async function moduleInstallCommand(slugArg, options) {
   }
   const publicUrl = row?.public_url ?? null;
   const installedVersion = row?.module_version?.version ?? targetVersion;
-  const runtimeProvisioned = isRealRuntimeUrl(row?.runtime_url);
+  const runtimeProvisioned = row ? isRuntimeProvisioned(row) : false;
   const readiness = await fetchUsesReadiness(result.installation.id, auth);
   const setupPending = readiness?.setupPending ?? false;
   if (options.json) {
@@ -19132,8 +19680,8 @@ async function moduleInstallCommand(slugArg, options) {
         public_url: publicUrl,
         verified,
         // P5-08: the confirmed preview; `null` for a fresh install (nothing to preview).
-        drift_hash: preview?.drift_hash ?? null,
-        data_loss: preview ? lossy : null,
+        drift_hash: confirmedPlan?.drift_hash ?? preview?.drift_hash ?? null,
+        data_loss: confirmedPlan ? planLosesData(confirmedPlan) : preview ? lossy : null,
         // `null` when the binding surface was unreachable; `[]` when the
         // module declares no slots. The two are not the same thing.
         uses: readiness === null ? null : usesInstallJson(readiness),
@@ -19232,7 +19780,7 @@ async function resolveDevInstallCollision(existing, slug, workspaceSlug, options
     info(explanation);
     return "replace";
   }
-  if (process.stdout.isTTY && !options.yes) {
+  if (process.stdout.isTTY && process.stdin.isTTY && !options.yes) {
     info(explanation);
     const answer = await select({
       message: `How should ${code(slug)} be installed into ${code(workspaceSlug)}?`,
@@ -19293,6 +19841,62 @@ async function replaceDevInstall(existing, slug, auth) {
   }
   return 0;
 }
+var MAX_PLAN_ROUNDS = 3;
+async function refetchUpgradePlan(previous, auth) {
+  if (previous.installation_id === void 0 || previous.to_version === void 0) {
+    return null;
+  }
+  try {
+    const preview = await getUpgradePreview(
+      previous.installation_id,
+      previous.to_version,
+      auth
+    );
+    return typeof preview.drift_hash === "string" ? {
+      ...preview,
+      breaks_consumers: Array.isArray(preview.breaks_consumers) ? preview.breaks_consumers : []
+    } : null;
+  } catch {
+    return null;
+  }
+}
+async function confirmUpgradePlan(slug, plan, options, acceptedPreviewHash, rerun) {
+  renderUpgradePlan(slug, plan);
+  const losesData = planLosesData(plan);
+  const lossAccepted = plan.drift_hash === acceptedPreviewHash || options.acceptDataLoss === plan.drift_hash;
+  if (losesData && !lossAccepted && (agentSessionMarker() || !process.stdout.isTTY || !process.stdin.isTTY || options.json)) {
+    fail("This upgrade loses data. --yes does not accept data loss. Nothing was changed.");
+    info(`To accept exactly the loss listed above, a person re-runs:
+  ${rerun(plan.drift_hash)}`);
+    return 1;
+  }
+  if (options.yes && (!losesData || lossAccepted)) {
+    info(`${code("--yes")}: confirming this plan.`);
+    return 0;
+  }
+  if (!process.stdout.isTTY || !process.stdin.isTTY || options.json) {
+    fail(
+      `Nothing was changed. Re-run with ${code("--force --yes")} to confirm this plan, or run it in a terminal to be asked.`
+    );
+    return 1;
+  }
+  const answer = await select({
+    message: losesData ? `Upgrade ${code(slug)}, lose the data listed above and disconnect the listed modules?` : plan.breaks_consumers.length === 0 ? `Upgrade ${code(slug)} with these changes?` : `Disconnect ${plan.breaks_consumers.length === 1 ? "this module" : "these modules"} and upgrade ${code(slug)}?`,
+    options: [
+      {
+        value: "go",
+        label: losesData ? "Yes, upgrade and lose the data listed above" : plan.breaks_consumers.length === 0 ? "Yes, upgrade" : "Yes, upgrade and disconnect them"
+      },
+      { value: "cancel", label: "No, abort" }
+    ],
+    initialValue: "cancel"
+  });
+  if (isCancel(answer) || answer === "cancel") {
+    fail("Aborted. Nothing was changed.");
+    return 130;
+  }
+  return 0;
+}
 function surfaceInstallError(err, slug, workspaceSlug, devInstallReplaced) {
   if (err instanceof ApiError) {
     switch (err.code) {
@@ -19317,8 +19921,8 @@ function surfaceInstallError(err, slug, workspaceSlug, devInstallReplaced) {
         break;
       case "UPGRADE_BREAKS_CONSUMERS":
         fail(
-          `Upgrading ${code(slug)} would break modules that consume its current schema.
-  Review the breaking changes, then re-run with ${code("--force")} to upgrade anyway.`
+          `Upgrading ${code(slug)} would break modules that read from it.
+  Re-run with ${code("--force")} to see which ones and confirm the upgrade.`
         );
         break;
       case "FORBIDDEN":
@@ -19364,10 +19968,26 @@ function usesInstallJson(readiness) {
     }))
   };
 }
+var AUDIENCE = {
+  company: "company",
+  teams: "Team Spaces",
+  people: "named people"
+};
+function describeInstallation(row) {
+  const details = [
+    row.reach?.kind ? AUDIENCE[row.reach.kind] ?? row.reach.kind : null,
+    row.held ? "held" : null,
+    row.public_url
+  ].filter((part) => Boolean(part));
+  return `#${row.id}${row.name ? ` "${row.name}"` : ""}${details.length ? ` (${details.join(", ")})` : ""}`;
+}
+function listInstallationCandidates(rows) {
+  for (const row of rows) info(`  ${describeInstallation(row)}`);
+}
 async function previewUpgrade(installationId, targetVersion, options, auth, rerun, devInstallToReplaceId) {
   let preview;
   try {
-    preview = await getUpgradePreview(installationId, targetVersion, auth);
+    preview = await getUpgradePreview2(installationId, targetVersion, auth);
   } catch (err) {
     const why = err instanceof ApiError ? `${err.code || err.status} ${err.message}` : err.message;
     const checkNote = options.acceptDataLoss !== void 0 ? `, so ${code("--accept-data-loss")} cannot be checked` : "";
@@ -19391,7 +20011,7 @@ async function previewUpgrade(installationId, targetVersion, options, auth, reru
   const broken = preview.breaks_consumers ?? [];
   if (broken.length > 0) {
     const names = broken.map(
-      (c2) => c2.module_slug ? `${c2.module_slug}${c2.installation_id ? ` #${c2.installation_id}` : ""}` : redactedConsumer(c2.redacted)
+      (c2) => !c2.redacted && c2.module_slug ? `${c2.module_slug}${c2.installation_id ? ` #${c2.installation_id}` : ""}` : redactedConsumer(c2.redacted)
     );
     warn(`  Breaks ${broken.length} module${broken.length === 1 ? "" : "s"} that read${broken.length === 1 ? "s" : ""} this one: ${names.join(", ")}`);
   }
@@ -19401,7 +20021,7 @@ async function previewUpgrade(installationId, targetVersion, options, auth, reru
   }
   if (options.acceptDataLoss !== void 0 && options.acceptDataLoss !== preview.drift_hash) {
     fail(
-      `${code("--accept-data-loss")} does not match this upgrade's preview: the copy or the release changed since that hash was printed. Nothing was changed.`
+      `${code("--accept-data-loss")} does not match this upgrade's preview: the installation or the release changed since that hash was printed. Nothing was changed.`
     );
     info(`To accept the change listed above, a person re-runs:
   ${rerun(preview.drift_hash)}`);
@@ -19411,7 +20031,7 @@ async function previewUpgrade(installationId, targetVersion, options, auth, reru
   if (lossy && !accepted) {
     const yesNote = options.yes ? ` ${code("--yes")} does not accept data loss.` : "";
     const marker = agentSessionMarker();
-    const why = marker ? `this is an agent session (${code(marker)} is set): a person decides` : !process.stdout.isTTY ? "there is no terminal to ask in" : null;
+    const why = marker ? `this is an agent session (${code(marker)} is set): a person decides` : !process.stdout.isTTY || !process.stdin.isTTY || options.json ? "there is no terminal to ask in" : null;
     if (why) {
       const alsoDev = devInstallToReplaceId !== void 0 ? ` and destroys dev install #${devInstallToReplaceId} first` : "";
       fail(`This upgrade loses the data listed above${alsoDev}, and ${why}.${yesNote} Refused. Nothing was changed.`);
@@ -19422,12 +20042,13 @@ async function previewUpgrade(installationId, targetVersion, options, auth, reru
   }
   return { preview, lossy, accepted };
 }
-function rerunLine(slug, workspaceSlug, targetVersion, options, replacingDevInstall) {
+function rerunLine(slug, workspaceSlug, targetVersion, installationId, options, replacingDevInstall) {
   return (hash) => [
     "dashwise module install",
     slug,
     `--workspace ${workspaceSlug}`,
     `--version ${targetVersion}`,
+    `--installation ${installationId}`,
     ...options.force ? ["--force"] : [],
     ...replacingDevInstall ? ["--replace-dev-install"] : [],
     `--accept-data-loss ${hash}`
@@ -20117,270 +20738,61 @@ init_api_client();
 init_config();
 init_manifest_io();
 init_output();
-
-// src/lib/permission-hint.ts
-init_api_client();
-init_output();
-var EXIT_NEEDS_GRANT = 3;
-var EXIT_TIMED_OUT = 4;
-var REBUILD_BUMP_OPERATOR_ONLY = "REBUILD_BUMP_OPERATOR_ONLY";
-var FEATURE_SUBJECTS = {
-  module_runtime_streaming: "Streaming",
-  module_rebuild: "Rebuild",
-  module_building: "Building modules",
-  module_runtime_sizing: "Memory size"
-};
-var OPTION_SUBJECTS = {
-  streaming: "Streaming",
-  memory_mb: "Memory size",
-  reapply: "Re-applying the runtime",
-  timeout: "The timeout",
-  reserved_concurrency: "Reserved concurrency",
-  log_retention: "Log retention"
-};
-var MODULE_RIGHT_CODES = /* @__PURE__ */ new Set([
-  "MODULE_CAPABILITY_DENIED",
-  "PUBLISH_REQUIRES_ADMIN",
-  "NOT_COPY_OWNER"
-]);
-function str(v) {
-  return typeof v === "string" && v.length > 0 ? v : void 0;
-}
-function num(v) {
-  return typeof v === "number" && Number.isFinite(v) ? v : void 0;
-}
-function featureFromPermission(permission) {
-  const m = permission ? /^workspace\.feature\.([a-z0-9_]+)\.use$/.exec(permission) : null;
-  return m?.[1];
-}
-function featureSubject(ctx) {
-  const feature = str(ctx.feature) ?? featureFromPermission(str(ctx.permission));
-  if (feature && FEATURE_SUBJECTS[feature]) return FEATURE_SUBJECTS[feature];
-  return str(ctx.feature_label) ?? (feature ? `"${feature}"` : void 0);
-}
-function needsAdmin(what, module, ask) {
-  const scope = module ? ` for ${module}` : "";
-  return `${what}${scope} needs a Dashwise admin. Ask your Dashwise admin to ${ask}.`;
+init_permission_hint();
+var FULL_SHA = /^[0-9a-f]{40}$/i;
+var positiveId = (value) => typeof value === "number" && Number.isSafeInteger(value) && value > 0;
+function isRepositoryBuild(value, moduleId, buildId) {
+  if (!value || typeof value !== "object") return false;
+  const build = value;
+  return positiveId(build.id) && build.module_id === moduleId && (buildId === void 0 || build.id === buildId) && build.source === "repo" && typeof build.commit_sha === "string" && FULL_SHA.test(build.commit_sha) && ["queued", "building", "succeeded", "failed"].includes(build.status ?? "");
 }
-function refusalHint(code2, context, subject = {}) {
-  const ctx = context ?? {};
-  const module = subject.module ?? str(ctx.module_slug);
-  const installationId = subject.installationId ?? num(ctx.installation_id);
-  const installLabel = installationId !== void 0 ? ` (install #${installationId})` : "";
-  const named = module ?? "this module";
-  switch (code2) {
-    case "FEATURE_DISABLED":
-    case "PERMISSION_DENIED": {
-      const what = featureSubject(ctx);
-      if (!what) {
-        return {
-          message: `You don't have permission to do this${module ? ` for ${module}` : ""}. Ask your Dashwise admin for access.`,
-          needsGrant: true
-        };
-      }
-      return { message: needsAdmin(what, module, "enable it"), needsGrant: true };
+async function moduleReleaseCommand(slugArg, options) {
+  const json = options.json;
+  const usage2 = (message) => reportCliError(message, { json, code: "USAGE" });
+  let slug = slugArg;
+  if (!slug) {
+    try {
+      const localSlug = readManifest(options.dir)?.module?.slug;
+      if (typeof localSlug === "string" && localSlug.length > 0) slug = localSlug;
+    } catch {
     }
-    case "RUNTIME_OPTION_OPERATOR_ONLY": {
-      const option = str(ctx.option);
-      const what = (option && OPTION_SUBJECTS[option]) ?? (option ? `"${option}"` : "This runtime option");
-      return { message: needsAdmin(what, module, "change it"), needsGrant: true };
+  }
+  if (!slug) return usage2("Pass a module slug or run from a directory with a valid module.json.");
+  const resuming = options.build !== void 0;
+  if (resuming && !positiveId(options.build)) return usage2("--build expects a positive build id.");
+  if (resuming && (options.commitSha !== void 0 || options.bump !== void 0 || options.noWait)) {
+    return usage2("--build only reads an existing release; do not combine it with --commit-sha, --bump or --no-wait.");
+  }
+  if (!resuming && (!options.commitSha || !FULL_SHA.test(options.commitSha))) {
+    return usage2("--commit-sha requires the full 40-character SHA already pushed to the linked repository.");
+  }
+  const bump = options.bump ?? "minor";
+  if (!["patch", "minor", "major"].includes(bump)) return usage2("--bump expects patch, minor or major.");
+  const timeoutMs = (options.timeoutSec ?? 360) * 1e3;
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) return usage2("--timeout expects a positive number of seconds.");
+  const cfg = readConfig();
+  if (!isLoggedIn() || !cfg) return reportCliError("Not logged in. Run `dashwise login` first.", { json });
+  const auth = { baseUrl: resolveApiUrl(), auth: { token: cfg.token } };
+  let moduleId;
+  try {
+    const mod = await getModuleBySlug(slug, auth);
+    moduleId = mod.id;
+    slug = mod.slug;
+  } catch (err) {
+    return reportRefusal(err, { module: slug }, { json, action: "Resolving the module" });
+  }
+  if (!resuming && !options.yes) {
+    if (json || !process.stdin.isTTY || !process.stdout.isTTY) {
+      return usage2("Release creates a version. Pass --yes to confirm in non-interactive or --json mode.");
     }
-    case REBUILD_BUMP_OPERATOR_ONLY: {
-      const bump = str(ctx.bump) ?? "minor";
-      return {
-        message: needsAdmin(`A rebuild with a ${bump} version bump`, module, "run it"),
-        needsGrant: true
-      };
-    }
-    case "IMAGE_TAG_EXISTS":
-      return {
-        message: `This rebuild of ${named} needs a higher version bump than patch. A rebuild with a minor version bump needs a Dashwise admin. Ask your Dashwise admin to run it.`,
-        needsGrant: true
-      };
-    case "RUNTIME_IMAGE_NOT_ELIGIBLE": {
-      const version = str(ctx.version);
-      const target = installationId !== void 0 ? ` --rollout installs:${installationId}` : "";
-      return {
-        message: `${named}${version ? ` v${version}` : ""} was built before streaming support. Rebuild it and upgrade this install first: dashwise module rebuild${module ? ` ${module}` : ""}${target}`,
-        needsGrant: false
-      };
-    }
-    case "RUNTIME_SWAP_PENDING": {
-      const version = str(ctx.version);
-      return {
-        message: `${named}${installLabel} is still finishing its update${version ? ` to v${version}` : ""}, so streaming cannot be turned on yet. Try again in a few minutes.`,
-        needsGrant: false
-      };
-    }
-    case "RUNTIME_OPTION_UNAVAILABLE": {
-      const option = str(ctx.option);
-      const what = (option && OPTION_SUBJECTS[option]) ?? "This runtime option";
-      return { message: `${what} is switched off platform-wide right now.`, needsGrant: false };
-    }
-    case "RUNTIME_CHANGE_IN_PROGRESS": {
-      const op = num(ctx.operation_id);
-      return {
-        message: `A runtime change is already being applied to ${named}${op !== void 0 ? ` (operation #${op})` : ""}. Wait for it, then check: dashwise module runtime${module ? ` ${module}` : ""}`,
-        needsGrant: false
-      };
-    }
-    case "BUILD_IN_PROGRESS": {
-      const buildId = num(ctx.build_id);
-      const status = str(ctx.status);
-      const which = buildId !== void 0 ? ` (#${buildId}${status ? `, ${status}` : ""})` : "";
-      return {
-        message: `A build of ${named} is already running${which}. Wait for it to finish, then run the rebuild again.`,
-        needsGrant: false
-      };
-    }
-    case "REBUILD_SOURCE_NOT_FOUND":
-      return {
-        message: `${named} has no build from source to rebuild. Publish it first: dashwise module publish`,
-        needsGrant: false
-      };
-    case "INSTALLATION_NOT_FOUND":
-      return {
-        message: `${installationId !== void 0 ? `Installation #${installationId}` : "The installation"} was not found, or you cannot see it.`,
-        needsGrant: false
-      };
-    case "PUBLISH_RATE_LIMITED":
-    case "PUBLISH_USER_RATE_LIMITED":
-      return {
-        message: `Too many builds of ${named} in the last hour. Try again later.`,
-        needsGrant: false
-      };
-    default:
-      if (MODULE_RIGHT_CODES.has(code2)) {
-        return {
-          message: `You can't manage ${named}${installLabel}. Ask your Dashwise admin for access.`,
-          needsGrant: true
-        };
-      }
-      return null;
-  }
-}
-var ANSI = /\x1b\[[0-9;]*m/g;
-function reportCliError(message, opts) {
-  if (opts.json) {
-    out(
-      JSON.stringify({
-        error: { code: opts.code ?? "CLI_ERROR", message: message.replace(ANSI, ""), status: null, context: null },
-        hint: null,
-        needs_grant: false
-      })
-    );
-  } else {
-    fail(message);
-  }
-  return 1;
-}
-function reportFailedOutcome(failure, hint, opts) {
-  if (opts.json) {
-    out(
-      JSON.stringify({
-        error: { code: failure.code, message: failure.message ?? null, status: null, context: null },
-        hint: hint?.message ?? null,
-        needs_grant: hint?.needsGrant ?? false,
-        ...opts.extra
-      })
-    );
-  } else {
-    fail(hint?.message ?? opts.fallback);
-  }
-  return hint?.needsGrant ? EXIT_NEEDS_GRANT : 1;
-}
-function isTransientPollError(err) {
-  if (!(err instanceof ApiError)) return true;
-  return err.status === 0 || err.status === 429 || err.status >= 500;
-}
-function reportRefusal(err, subject, opts) {
-  if (!(err instanceof ApiError)) {
-    const message = err?.message ?? String(err);
-    if (opts.json) {
-      out(
-        JSON.stringify({
-          error: { code: "CLI_ERROR", message: message.replace(ANSI, ""), status: null, context: null },
-          hint: null,
-          needs_grant: false
-        })
-      );
-    } else {
-      fail(`${opts.action} failed: ${message}`);
-    }
-    return 1;
-  }
-  const hint = err.status === 401 ? { message: "Your login has expired. Run: dashwise login", needsGrant: false } : refusalHint(err.code, err.context, subject);
-  if (opts.json) {
-    out(
-      JSON.stringify({
-        error: { code: err.code, message: err.message, status: err.status, context: err.context ?? null },
-        hint: hint?.message ?? null,
-        needs_grant: hint?.needsGrant ?? false
-      })
-    );
-  } else if (hint) {
-    fail(hint.message);
-  } else {
-    fail(`${opts.action} failed (${err.code}): ${err.message}`);
-  }
-  return hint?.needsGrant ? EXIT_NEEDS_GRANT : 1;
-}
-
-// src/commands/module/release.ts
-var FULL_SHA = /^[0-9a-f]{40}$/i;
-var positiveId = (value) => typeof value === "number" && Number.isSafeInteger(value) && value > 0;
-function isRepositoryBuild(value, moduleId, buildId) {
-  if (!value || typeof value !== "object") return false;
-  const build = value;
-  return positiveId(build.id) && build.module_id === moduleId && (buildId === void 0 || build.id === buildId) && build.source === "repo" && typeof build.commit_sha === "string" && FULL_SHA.test(build.commit_sha) && ["queued", "building", "succeeded", "failed"].includes(build.status ?? "");
-}
-async function moduleReleaseCommand(slugArg, options) {
-  const json = options.json;
-  const usage2 = (message) => reportCliError(message, { json, code: "USAGE" });
-  let slug = slugArg;
-  if (!slug) {
-    try {
-      const localSlug = readManifest(options.dir)?.module?.slug;
-      if (typeof localSlug === "string" && localSlug.length > 0) slug = localSlug;
-    } catch {
-    }
-  }
-  if (!slug) return usage2("Pass a module slug or run from a directory with a valid module.json.");
-  const resuming = options.build !== void 0;
-  if (resuming && !positiveId(options.build)) return usage2("--build expects a positive build id.");
-  if (resuming && (options.commitSha !== void 0 || options.bump !== void 0 || options.noWait)) {
-    return usage2("--build only reads an existing release; do not combine it with --commit-sha, --bump or --no-wait.");
-  }
-  if (!resuming && (!options.commitSha || !FULL_SHA.test(options.commitSha))) {
-    return usage2("--commit-sha requires the full 40-character SHA already pushed to the linked repository.");
-  }
-  const bump = options.bump ?? "minor";
-  if (!["patch", "minor", "major"].includes(bump)) return usage2("--bump expects patch, minor or major.");
-  const timeoutMs = (options.timeoutSec ?? 360) * 1e3;
-  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) return usage2("--timeout expects a positive number of seconds.");
-  const cfg = readConfig();
-  if (!isLoggedIn() || !cfg) return reportCliError("Not logged in. Run `dashwise login` first.", { json });
-  const auth = { baseUrl: resolveApiUrl(), auth: { token: cfg.token } };
-  let moduleId;
-  try {
-    const mod = await getModuleBySlug(slug, auth);
-    moduleId = mod.id;
-    slug = mod.slug;
-  } catch (err) {
-    return reportRefusal(err, { module: slug }, { json, action: "Resolving the module" });
-  }
-  if (!resuming && !options.yes) {
-    if (json || !process.stdin.isTTY || !process.stdout.isTTY) {
-      return usage2("Release creates a version. Pass --yes to confirm in non-interactive or --json mode.");
-    }
-    const answer = await select({
-      message: `Release ${slug} at ${options.commitSha} with a ${bump} bump?`,
-      options: [{ value: "cancel", label: "Cancel" }, { value: "release", label: "Release this revision" }],
-      initialValue: "cancel"
-    });
-    if (isCancel(answer) || answer !== "release") {
-      reportCliError("Aborted.", { json });
-      return 130;
+    const answer = await select({
+      message: `Release ${slug} at ${options.commitSha} with a ${bump} bump?`,
+      options: [{ value: "cancel", label: "Cancel" }, { value: "release", label: "Release this revision" }],
+      initialValue: "cancel"
+    });
+    if (isCancel(answer) || answer !== "release") {
+      reportCliError("Aborted.", { json });
+      return 130;
     }
   }
   let buildId = options.build;
@@ -20575,7 +20987,7 @@ async function moduleStatusCommand(slugArg, options) {
     );
     return 0;
   }
-  const runtimeProvisioned = isRealRuntimeUrl(row.runtime_url);
+  const runtimeProvisioned = isRuntimeProvisioned(row);
   const state = runtimeProvisioned && row.public_url ? "live" : runtimeProvisioned ? "deployed" : "not_deployed";
   const installedVersion = row.module_version?.version ?? null;
   const updateAvailable = isUpdateAvailable(installedVersion, latestVersion);
@@ -20592,7 +21004,9 @@ async function moduleStatusCommand(slugArg, options) {
         latest_version: latestVersion,
         update_available: updateAvailable,
         runtime_provisioned: runtimeProvisioned,
-        runtime_url: row.runtime_url,
+        // The raw runtime endpoint is not printed any more: it reaches the
+        // module's server code past the platform's doors. `public_url` is
+        // the address to open.
         public_url: row.public_url,
         state,
         // C-09: per-slot data-plane readiness for THIS install. `null`
@@ -20618,7 +21032,7 @@ async function moduleStatusCommand(slugArg, options) {
   );
   kv(
     "Runtime:",
-    runtimeProvisioned ? `provisioned ${dim(`(${row.runtime_url})`)}` : "not provisioned"
+    runtimeProvisioned ? "provisioned" : "not provisioned"
   );
   kv("Public URL:", row.public_url ?? dim("(none)"));
   kv(
@@ -20658,6 +21072,133 @@ function usesJson(readiness) {
   };
 }
 
+// src/commands/module/installations.ts
+init_api_client();
+init_config();
+init_output();
+var AUDIENCE2 = {
+  company: "company",
+  teams: "Team Spaces",
+  people: "named people"
+};
+var givesRole = (roleKey) => typeof roleKey === "string" && roleKey !== "none";
+function governanceAudience(row) {
+  if (!row.rules) return null;
+  if (givesRole(row.rules.company)) return AUDIENCE2.company;
+  if (row.rules.teams.some((t) => t.live === true && givesRole(t.role_key))) return AUDIENCE2.teams;
+  return AUDIENCE2.people;
+}
+function toListEntry(row) {
+  return {
+    id: row.id,
+    module_slug: row.module?.slug ?? null,
+    name: row.name ?? row.module?.name ?? null,
+    audience: row.reach?.kind ? AUDIENCE2[row.reach.kind] ?? row.reach.kind : null,
+    version: row.module_version?.version ?? null,
+    held: row.held === true,
+    development: isDevInstallKind(row.kind),
+    public_url: row.public_url,
+    admin_view_only: false
+  };
+}
+async function moduleInstallationsCommand(slug, options) {
+  if (!isLoggedIn()) {
+    fail(`Not logged in. Run ${code("dashwise login")} first.`);
+    return 1;
+  }
+  const cfg = readConfig();
+  if (!cfg) {
+    fail(`CLI config missing. Run ${code("dashwise login")}.`);
+    return 1;
+  }
+  const auth = { baseUrl: resolveApiUrl(), auth: { token: cfg.token } };
+  let workspace2;
+  try {
+    workspace2 = await resolveWorkspaceWithFallback({
+      userFlag: options.workspace,
+      cachedWorkspaceId: slug ? readModuleEntry(slug)?.workspaceId : void 0,
+      configDefault: cfg.workspaceSlug,
+      apiUrl: resolveApiUrl(),
+      apiToken: cfg.token
+    });
+  } catch (err) {
+    fail(`Company selection failed: ${err.message}`);
+    return 1;
+  }
+  let rows;
+  try {
+    rows = await listWorkspaceInstallations(workspace2.id, auth);
+  } catch (err) {
+    fail(`Could not read the installations in ${code(workspace2.slug)}: ${err.message}`);
+    return 1;
+  }
+  const governance = [];
+  try {
+    const govRows = await apiRequest(
+      "GET",
+      `/api/modules/workspaces/${workspace2.id}/installations/governance`,
+      void 0,
+      auth
+    );
+    const seen = new Set(rows.map((row) => row.id));
+    const slugOf = new Map(rows.map((row) => [row.module_id, row.module?.slug ?? null]));
+    let slugModuleId;
+    if (slug) {
+      slugModuleId = rows.find((row) => row.module?.slug === slug)?.module_id;
+      if (slugModuleId === void 0) {
+        try {
+          slugModuleId = (await getModuleBySlug(slug, auth)).id;
+        } catch {
+        }
+      }
+    }
+    for (const g of govRows) {
+      if (g.trashed || seen.has(g.installation_id)) continue;
+      if (slug && g.module_id !== slugModuleId) continue;
+      governance.push({
+        id: g.installation_id,
+        module_slug: slugOf.get(g.module_id) ?? (slug && g.module_id === slugModuleId ? slug : null),
+        name: g.name || null,
+        audience: governanceAudience(g),
+        version: null,
+        held: g.held === true,
+        development: null,
+        public_url: null,
+        admin_view_only: true
+      });
+    }
+  } catch (err) {
+    if (!(err instanceof ApiError && (err.status === 403 || err.status === 404))) {
+      fail(`Could not read the company's full installation list: ${err.message}`);
+      return 1;
+    }
+  }
+  const entries = rows.filter((row) => !slug || row.module?.slug === slug).map(toListEntry).concat(governance).filter((entry) => options.dev || !entry.development).sort((a, b) => (a.module_slug ?? "").localeCompare(b.module_slug ?? "") || a.id - b.id);
+  if (options.json) {
+    out(JSON.stringify({ workspace: workspace2.slug, installations: entries }));
+    return 0;
+  }
+  if (entries.length === 0) {
+    info(
+      slug ? `No installations of ${code(slug)} you can see in ${code(workspace2.slug)}.` : `No installations you can see in ${code(workspace2.slug)}.`
+    );
+    return 0;
+  }
+  for (const e of entries) {
+    const tags = [
+      e.audience,
+      e.version ? `v${e.version}` : null,
+      e.held ? "held" : null,
+      e.development ? "development" : null,
+      e.admin_view_only ? "admin view, not open to you" : null
+    ].filter(Boolean);
+    out(
+      `#${e.id}  ${e.module_slug ?? "?"}  ${e.name ? `"${e.name}"` : ""}  ${dim(tags.join(", "))}${e.public_url ? `  ${e.public_url}` : ""}`.replace(/ {3,}/g, "  ")
+    );
+  }
+  return 0;
+}
+
 // src/commands/module/uninstall.ts
 init_api_client();
 init_config();
@@ -20828,29 +21369,301 @@ function surfaceUninstallError(err, slug, workspaceSlug) {
   return 1;
 }
 
+// src/commands/module/invites.ts
+init_api_client();
+init_config();
+init_output();
+init_permission_hint();
+var positiveId2 = (value) => typeof value === "number" && Number.isSafeInteger(value) && value > 0;
+function session(json) {
+  const cfg = readConfig();
+  if (!isLoggedIn() || !cfg) return reportCliError(`Not logged in. Run ${code("dashwise login")} first.`, { json });
+  return {
+    auth: { baseUrl: resolveApiUrl(), auth: { token: cfg.token } },
+    token: cfg.token,
+    workspaceSlug: cfg.workspaceSlug
+  };
+}
+async function resolveModule(slug, s, json) {
+  try {
+    const mod = await getModuleBySlug(slug, s.auth);
+    return { id: mod.id, slug: mod.slug };
+  } catch (err) {
+    return reportRefusal(err, { module: slug }, { json, action: "Resolving the module" });
+  }
+}
+async function confirm(question, confirmLabel, opts) {
+  if (opts.yes) return null;
+  if (opts.json || !process.stdin.isTTY || !process.stdout.isTTY) {
+    return reportCliError("This changes an invitation. Pass --yes to confirm in non-interactive or --json mode.", {
+      json: opts.json,
+      code: "USAGE"
+    });
+  }
+  const answer = await select({
+    message: question,
+    options: [
+      { value: "cancel", label: "Cancel" },
+      { value: "go", label: confirmLabel }
+    ],
+    initialValue: "cancel"
+  });
+  if (isCancel(answer) || answer !== "go") {
+    reportCliError("Aborted.", {});
+    return 130;
+  }
+  return null;
+}
+function companyLabel(row) {
+  return row.company_name ? `${row.company_name} (company #${row.workspace_id})` : `company #${row.workspace_id}`;
+}
+async function moduleInvitesListCommand(slug, options) {
+  const { json } = options;
+  const s = session(json);
+  if (typeof s === "number") return s;
+  const mod = await resolveModule(slug, s, json);
+  if (typeof mod === "number") return mod;
+  let rows;
+  try {
+    rows = await apiRequest("GET", `/api/modules/${mod.id}/invites`, void 0, s.auth);
+  } catch (err) {
+    return reportRefusal(err, { module: mod.slug }, { json, action: "Reading the invitations" });
+  }
+  if (json) {
+    out(JSON.stringify({ module: mod.slug, invites: rows }));
+    return 0;
+  }
+  if (rows.length === 0) {
+    info(`No open invitations for ${code(mod.slug)}.`);
+    return 0;
+  }
+  for (const row of rows) {
+    const note = row.note ? `  ${dim(`"${row.note}"`)}` : "";
+    out(`#${row.id}  ${companyLabel(row)}  ${dim(row.invited_at.slice(0, 10))}${note}`);
+  }
+  return 0;
+}
+async function moduleInvitesSendCommand(slug, options) {
+  const { json } = options;
+  const usage2 = (message) => reportCliError(message, { json, code: "USAGE" });
+  if (!options.to) return usage2("Pass --to <company id> to name the company to invite.");
+  const s = session(json);
+  if (typeof s === "number") return s;
+  let target;
+  const numeric = /^[1-9][0-9]*$/.test(options.to) ? Number(options.to) : void 0;
+  let mine;
+  try {
+    mine = await apiRequest("GET", "/api/workspaces", void 0, s.auth);
+  } catch (err) {
+    return reportRefusal(err, {}, { json, action: "Reading your companies" });
+  }
+  const own = mine.find((w) => numeric !== void 0 ? w.id === numeric : w.slug === options.to);
+  if (own) {
+    target = { id: own.id, label: `${own.name} (company #${own.id})` };
+  } else if (positiveId2(numeric)) {
+    target = { id: numeric, label: `company #${numeric}` };
+  } else {
+    return usage2(
+      `${options.to} is not one of your companies. For another company, pass its company id (an admin of that company finds it in its settings).`
+    );
+  }
+  const mod = await resolveModule(slug, s, json);
+  if (typeof mod === "number") return mod;
+  const stop = await confirm(
+    [
+      `Invite ${target.label} to install ${mod.slug}?`,
+      `- Admins of that company can then see ${mod.slug} and install it.`,
+      "- Their data stays theirs; you do not see it.",
+      `- Your module's logic and its updates reach their installations.`,
+      "- You see their company name only after one of their admins installs it or asks to.",
+      `- You can withdraw the invitation at any time with ${code(`dashwise module invites revoke ${mod.slug} <invitation id>`)}.`
+    ].join("\n"),
+    "Send the invitation",
+    options
+  );
+  if (stop !== null) return stop;
+  let invite;
+  try {
+    const body = await apiRequest(
+      "POST",
+      `/api/modules/${mod.id}/invites`,
+      { workspaceId: target.id, ...options.note !== void 0 ? { note: options.note } : {} },
+      s.auth
+    );
+    invite = body.invite;
+  } catch (err) {
+    return reportRefusal(err, { module: mod.slug }, { json, action: "Sending the invitation" });
+  }
+  if (json) out(JSON.stringify({ module: mod.slug, invite }));
+  else success(`Invited ${target.label} to install ${mod.slug} (invitation #${invite.id}).`);
+  return 0;
+}
+async function moduleInvitesRevokeCommand(slug, inviteId, options) {
+  const { json } = options;
+  if (!positiveId2(inviteId)) {
+    return reportCliError(`Pass the invitation id. List them with ${code(`dashwise module invites list ${slug}`)}.`, {
+      json,
+      code: "USAGE"
+    });
+  }
+  const s = session(json);
+  if (typeof s === "number") return s;
+  const mod = await resolveModule(slug, s, json);
+  if (typeof mod === "number") return mod;
+  const stop = await confirm(
+    [
+      `Withdraw invitation #${inviteId} for ${mod.slug}?`,
+      `- Installations made with it stay, but they no longer receive updates of ${mod.slug}.`,
+      "- No new installation can start from it."
+    ].join("\n"),
+    "Withdraw the invitation",
+    options
+  );
+  if (stop !== null) return stop;
+  try {
+    await apiRequest("DELETE", `/api/modules/${mod.id}/invites/${inviteId}`, void 0, s.auth);
+  } catch (err) {
+    return reportRefusal(err, { module: mod.slug }, { json, action: "Withdrawing the invitation" });
+  }
+  if (json) out(JSON.stringify({ module: mod.slug, revoked: inviteId }));
+  else success(`Withdrew invitation #${inviteId} for ${mod.slug}.`);
+  return 0;
+}
+async function resolveOwnCompany(s, flag, opts) {
+  const { json } = opts;
+  let mine;
+  try {
+    mine = await apiRequest("GET", "/api/workspaces", void 0, s.auth);
+  } catch (err) {
+    return reportRefusal(err, {}, { json, action: "Reading your companies" });
+  }
+  const list = mine.map((w) => `${w.slug} (company #${w.id})`).join(", ");
+  const wanted = flag ?? s.workspaceSlug;
+  if (wanted !== void 0) {
+    const found = mine.find((w) => w.slug === wanted || String(w.id) === wanted);
+    if (found) return found;
+    return reportCliError(`${wanted} is not one of your companies. Your companies: ${list}.`, { json, code: "USAGE" });
+  }
+  if (mine.length === 1) return mine[0];
+  if (mine.length === 0) return reportCliError("Your account belongs to no company yet.", { json });
+  if (!opts.interactive || json || !process.stdin.isTTY || !process.stdout.isTTY) {
+    return reportCliError(`Choose the company with --workspace <slug or id>. Your companies: ${list}.`, {
+      json,
+      code: "USAGE"
+    });
+  }
+  const choice = await select({
+    message: "Which company?",
+    options: mine.map((w) => ({ value: String(w.id), label: w.name, hint: w.slug }))
+  });
+  const picked = isCancel(choice) ? void 0 : mine.find((w) => String(w.id) === choice);
+  if (!picked) {
+    reportCliError("Aborted.", {});
+    return 130;
+  }
+  return picked;
+}
+async function moduleInvitesReceivedCommand(options) {
+  const { json } = options;
+  const s = session(json);
+  if (typeof s === "number") return s;
+  const company = await resolveOwnCompany(s, options.workspace, { json, interactive: true });
+  if (typeof company === "number") return company;
+  let rows;
+  try {
+    rows = await apiRequest(
+      "GET",
+      `/api/modules/workspaces/${company.id}/invites`,
+      void 0,
+      s.auth
+    );
+  } catch (err) {
+    return reportRefusal(err, {}, { json, action: "Reading the invitations" });
+  }
+  if (json) {
+    out(JSON.stringify({ workspace: company.slug, invites: rows }));
+    return 0;
+  }
+  if (rows.length === 0) {
+    info(`No open invitations for ${code(company.slug)}.`);
+    return 0;
+  }
+  for (const row of rows) {
+    const note = row.note ? `  ${dim(`"${row.note}"`)}` : "";
+    out(
+      `#${row.id}  ${row.module.slug} ${dim(`v${row.module.current_version}`)}  from ${row.from_company.name}  ${dim(row.invited_at.slice(0, 10))}${note}`
+    );
+  }
+  const inCompany = `--workspace ${company.slug}`;
+  info(
+    `Install one with ${code(`dashwise module install <slug> ${inCompany}`)}, or decline it with ${code(`dashwise module invites decline <id> ${inCompany}`)}.`
+  );
+  return 0;
+}
+async function moduleInvitesDeclineCommand(inviteId, options) {
+  const { json } = options;
+  if (!positiveId2(inviteId)) {
+    return reportCliError(`Pass the invitation id. List them with ${code("dashwise module invites received")}.`, {
+      json,
+      code: "USAGE"
+    });
+  }
+  const s = session(json);
+  if (typeof s === "number") return s;
+  const company = await resolveOwnCompany(s, options.workspace, { json, interactive: !options.yes });
+  if (typeof company === "number") return company;
+  const stop = await confirm(
+    `Decline invitation #${inviteId} for ${company.slug}? The module's company may invite you again.`,
+    "Decline the invitation",
+    options
+  );
+  if (stop !== null) return stop;
+  try {
+    await apiRequest(
+      "POST",
+      `/api/modules/workspaces/${company.id}/invites/${inviteId}/decline`,
+      void 0,
+      s.auth
+    );
+  } catch (err) {
+    return reportRefusal(err, {}, { json, action: "Declining the invitation" });
+  }
+  if (json) out(JSON.stringify({ workspace: company.slug, declined: inviteId }));
+  else success(`Declined invitation #${inviteId}.`);
+  return 0;
+}
+
 // src/commands/module/pull-data.ts
 init_api_client();
+init_permission_hint();
 init_output();
 async function modulePullDataCommand(options) {
+  const report = (err) => reportRefusal(err, {}, { ...options, stderr: true, action: "Pull data" });
+  const contextError = (message) => report(
+    new ApiError(
+      0,
+      {
+        code: "VALIDATION_ERROR",
+        message,
+        context: { reason: "module_context_required" }
+      },
+      message
+    )
+  );
   const projectRoot = resolve(options.dir ?? process.cwd());
   const manifestPath2 = join(projectRoot, "module.json");
   if (!existsSync(manifestPath2)) {
-    fail(
-      `No ${code("module.json")} found in ${code(projectRoot)}. Run \`dashwise module init <slug>\` first.`
-    );
-    return 1;
+    return contextError(`No module.json found in ${projectRoot}.`);
   }
   let manifest;
   try {
     manifest = JSON.parse(readFileSync(manifestPath2, "utf-8"));
   } catch (err) {
-    fail(`Could not parse ${code(manifestPath2)}: ${err.message}`);
-    return 1;
+    return contextError(`Could not parse module.json: ${err.message}`);
   }
   const slug = manifest.module?.slug;
   if (!slug) {
-    fail(`${code("module.json")} is missing ${code("module.slug")}.`);
-    return 1;
+    return contextError("module.json is missing module.slug.");
   }
   let mod;
   try {
@@ -20859,16 +21672,7 @@ async function modulePullDataCommand(options) {
       `/api/modules/by-slug/${encodeURIComponent(slug)}`
     );
   } catch (err) {
-    if (err instanceof ApiError && err.status === 404) {
-      fail(`Module ${code(slug)} not found on the backend.`);
-      return 1;
-    }
-    if (err instanceof ApiError && err.status === 401) {
-      fail("Not logged in. Run `dashwise login` first.");
-      return 1;
-    }
-    fail(`Could not resolve module: ${err.message}`);
-    return 1;
+    return report(err);
   }
   const limit = options.limit ?? 100;
   let res;
@@ -20878,18 +21682,15 @@ async function modulePullDataCommand(options) {
       `/api/modules/${mod.id}/own-data?limit=${limit}`
     );
   } catch (err) {
-    if (err instanceof ApiError && err.status === 400) {
-      fail(`Invalid request: ${err.message}`);
-      return 1;
-    }
-    fail(`Could not pull data: ${err.message}`);
-    return 1;
+    return report(err);
   }
   const outPath = options.out ? resolve(options.out) : join(projectRoot, "dashwise-data.json");
   writeFileSync(outPath, JSON.stringify(res, null, 2) + "\n", "utf-8");
   let totalRows = 0;
   for (const t of res.tables) totalRows += t.rows.length;
-  success(`Wrote ${totalRows} row${totalRows === 1 ? "" : "s"} across ${res.tables.length} table${res.tables.length === 1 ? "" : "s"} to ${code(outPath)}`);
+  success(
+    `Wrote ${totalRows} row${totalRows === 1 ? "" : "s"} across ${res.tables.length} table${res.tables.length === 1 ? "" : "s"} to ${code(outPath)}`
+  );
   for (const t of res.tables) {
     if (t.total_rows > t.rows.length) {
       warn(
@@ -20898,7 +21699,7 @@ async function modulePullDataCommand(options) {
     }
   }
   if (res.tables.length === 0) {
-    info(dim("No owned tables on this module. (Did you publish a manifest with `owns.tables`?)"));
+    info(dim("No tables available."));
   }
   return 0;
 }
@@ -23509,16 +24310,43 @@ init_config();
 init_dotenv_local();
 init_manifest_io();
 init_output();
+init_api_client();
+init_permission_hint();
 init_install_target();
-init_dev();
 async function queryCommand(options) {
   const projectRoot = resolve(options.dir ?? process.cwd());
   let manifestSlug;
   try {
     manifestSlug = readManifestOrThrow(projectRoot).module?.slug;
   } catch (err) {
-    fail(err.message);
-    return 1;
+    return reportRefusal(
+      new ApiError(
+        0,
+        {
+          code: "VALIDATION_ERROR",
+          message: err.message,
+          context: { reason: "module_context_required" }
+        },
+        "Module context required."
+      ),
+      {},
+      { ...options, stderr: true, action: "Query" }
+    );
+  }
+  if (!manifestSlug) {
+    return reportRefusal(
+      new ApiError(
+        0,
+        {
+          code: "VALIDATION_ERROR",
+          message: "module.json is missing module.slug.",
+          context: { reason: "module_context_required" }
+        },
+        "Module context required."
+      ),
+      {},
+      { ...options, stderr: true, action: "Query" }
+    );
   }
   const generatedPath = join(
     projectRoot,
@@ -23532,8 +24360,10 @@ async function queryCommand(options) {
     );
     return 1;
   }
-  const keyInShell = process.env.DASHWISE_API_KEY !== void 0;
+  const keyFromProcessEnv = Boolean(process.env.DASHWISE_API_KEY);
   hydrateEnvFromDotenvLocal(projectRoot);
+  let moduleKey = keyFromProcessEnv ? "env" : process.env.DASHWISE_API_KEY ? "env_file" : "saved";
+  let keySource = keyFromProcessEnv ? "environment" : ".env.local";
   const cfg = (() => {
     try {
       return readConfig();
@@ -23542,46 +24372,47 @@ async function queryCommand(options) {
     }
   })();
   const apiUrl = process.env.DASHWISE_API_URL ?? cfg?.apiUrl ?? "http://localhost:3000";
-  let keySource = keyInShell ? "environment" : ".env.local";
-  let entry = manifestSlug ? readModuleEntry(manifestSlug) : null;
-  if (!process.env.DASHWISE_API_KEY && manifestSlug) {
+  const entry = readModuleEntry(manifestSlug);
+  if (!process.env.DASHWISE_API_KEY) {
     if (entry && options.install !== void 0 && entry.installationId !== options.install) {
       fail(
-        `No key for install #${options.install}: the cached ${code("dwk_")} key of ${code(manifestSlug)} belongs to install #${entry.installationId}. Nothing was run.`
+        `No key for installation #${options.install}: the cached ${code("dwk_")} key of ${code(manifestSlug)} belongs to installation #${entry.installationId}. Nothing was run.`
       );
       return 1;
     }
-    if (cfg) {
-      const healed = await resolveModuleApiKey(
-        manifestSlug,
-        entry,
-        apiUrl,
-        cfg.token
-      );
-      if (healed) entry = healed;
-    }
     if (entry?.apiKey) {
       process.env.DASHWISE_API_KEY = entry.apiKey;
+      moduleKey = "saved";
       keySource = "cached";
       if (!process.env.DASHWISE_API_URL) {
         process.env.DASHWISE_API_URL = apiUrl;
       }
     }
   }
-  if (process.env.DASHWISE_API_KEY) {
-    const target = await nameKeyTarget({
-      apiKey: process.env.DASHWISE_API_KEY,
-      keySource,
-      entry,
-      cfg,
-      apiUrl: process.env.DASHWISE_API_URL ?? apiUrl,
-      ...options.install !== void 0 ? { install: options.install } : {}
-    });
-    if (target !== 0) return target;
-  } else if (options.install !== void 0) {
-    fail(`No ${code("dwk_")} key to check against install #${options.install}. Set ${code("DASHWISE_API_KEY")}. Nothing was run.`);
-    return 1;
+  if (!process.env.DASHWISE_API_KEY) {
+    return reportRefusal(
+      new ApiError(
+        0,
+        {
+          code: "UNAUTHENTICATED",
+          context: { reason: "module_api_credential_missing" },
+          message: "No module API key is configured."
+        },
+        "No module API key is configured."
+      ),
+      {},
+      { ...options, stderr: true, action: "Query" }
+    );
   }
+  const target = await nameKeyTarget({
+    apiKey: process.env.DASHWISE_API_KEY,
+    keySource,
+    entry,
+    cfg,
+    apiUrl,
+    ...options.install !== void 0 ? { install: options.install } : {}
+  });
+  if (target !== 0) return target;
   const modes = [
     options.inline !== void 0 ? "inline" : null,
     options.file !== void 0 ? "file" : null,
@@ -23611,7 +24442,7 @@ async function queryCommand(options) {
   const stream = options.stream === true;
   if (options.repl) return runRepl(generatedPath);
   if (options.file !== void 0)
-    return runFile(options.file, projectRoot, options.json === true, explain, stream);
+    return runFile(options.file, projectRoot, options.json === true, explain, stream, moduleKey);
   if (options.inline !== void 0)
     return runInline(
       options.inline,
@@ -23619,11 +24450,12 @@ async function queryCommand(options) {
       generatedPath,
       options.json === true,
       explain,
-      stream
+      stream,
+      moduleKey
     );
   return 1;
 }
-async function runInline(expression, projectRoot, generatedPath, jsonCompact, explain, stream) {
+async function runInline(expression, projectRoot, generatedPath, jsonCompact, explain, stream, moduleKey) {
   let entryUrl;
   try {
     entryUrl = generatedEntryUrl(generatedPath);
@@ -23644,7 +24476,7 @@ async function runInline(expression, projectRoot, generatedPath, jsonCompact, ex
   ].join("\n");
   writeFileSync(tmpFile, source, "utf-8");
   try {
-    return await importAndPrint(tmpFile, projectRoot, jsonCompact, explain, stream);
+    return await importAndPrint(tmpFile, projectRoot, jsonCompact, explain, stream, moduleKey);
   } finally {
     try {
       rmSync(tmpDir, { recursive: true, force: true });
@@ -23652,7 +24484,7 @@ async function runInline(expression, projectRoot, generatedPath, jsonCompact, ex
     }
   }
 }
-async function runFile(file, projectRoot, jsonCompact, explain, stream) {
+async function runFile(file, projectRoot, jsonCompact, explain, stream, moduleKey) {
   const abs = resolve(projectRoot, file);
   if (!existsSync(abs)) {
     fail(`File not found: ${code(abs)}`);
@@ -23664,7 +24496,7 @@ async function runFile(file, projectRoot, jsonCompact, explain, stream) {
     );
     return 1;
   }
-  return importAndPrint(abs, projectRoot, jsonCompact, explain, stream);
+  return importAndPrint(abs, projectRoot, jsonCompact, explain, stream, moduleKey);
 }
 async function runRepl(generatedPath) {
   let generated;
@@ -23703,7 +24535,7 @@ async function runRepl(generatedPath) {
     });
   });
 }
-async function importAndPrint(file, projectRoot, jsonCompact, explain, stream) {
+async function importAndPrint(file, projectRoot, jsonCompact, explain, stream, moduleKey) {
   const originalCwd = process.cwd();
   try {
     process.chdir(projectRoot);
@@ -23739,11 +24571,11 @@ async function importAndPrint(file, projectRoot, jsonCompact, explain, stream) {
     }
     return 0;
   } catch (err) {
-    fail(`Query failed: ${err.message}`);
+    const exit = reportRefusal(err, {}, { json: jsonCompact, stderr: true, action: "Query", moduleKey });
     if (process.env.DASHWISE_DEBUG) {
       console.error(err);
     }
-    return 1;
+    return exit;
   } finally {
     process.chdir(originalCwd);
   }
@@ -24444,6 +25276,7 @@ init_api_client();
 init_config();
 init_manifest_io();
 init_output();
+init_permission_hint();
 var PLATFORM_DEFAULTS = ["manifest", "on", "off"];
 var BUMPS = ["patch", "minor", "major"];
 function parseRollout(raw) {
@@ -24667,6 +25500,7 @@ init_api_client();
 init_config();
 init_manifest_io();
 init_output();
+init_permission_hint();
 var TERMINAL_OPERATION = /* @__PURE__ */ new Set(["succeeded", "failed", "superseded"]);
 async function moduleRuntimeShowCommand(slugArg, options) {
   const auth = authOrFail(options.json);
@@ -24775,7 +25609,7 @@ async function moduleRuntimeSetCommand(slugArg, options) {
   const slug = before.module.slug;
   const subject = { module: slug, installationId: before.installation_id };
   if (streaming !== void 0 && !options.yes && !options.json && process.stdin.isTTY) {
-    const ok = await confirm({
+    const ok = await confirm$1({
       message: `Turn streaming ${streaming === "RESPONSE_STREAM" ? "on" : "off"} for ${slug} (install #${before.installation_id})? The switch takes about a minute, and pages may come back empty while it runs.`
     });
     if (isCancel(ok) || ok !== true) {
@@ -24963,10 +25797,11 @@ function sleep5(ms) {
 
 // src/program.ts
 init_output();
+init_permission_hint();
 var program = new Command();
 program.name("dashwise").description("Dashwise CLI \u2014 log in, author modules, publish to the marketplace.").version(getVersion(), "-v, --version", "Show the CLI version + exit").option(
   "--api-url <url>",
-  `Override Dashwise backend URL (default: $DASHWISE_API_URL, else your saved login, else ${KNOWN_API_URLS.dev}). Prod is ${KNOWN_API_URLS.prod}; pass a localhost URL to target a backend you are running yourself.`
+  `Override Dashwise backend URL (default: $DASHWISE_API_URL, else your saved login, else ${DEFAULT_API_URL}).`
 );
 program.hook("preAction", () => {
   const apiUrl = program.opts().apiUrl?.trim();
@@ -24985,7 +25820,7 @@ program.command("login").description("Sign in via the device-code flow.").option
   process.exitCode = exit;
 });
 program.command("doctor").description(
-  "Check your setup: which Dashwise you target (dev or prod), login, connection, Node, CLI and SDK versions, and inside a module folder module.json, the repository link and the cloud setup files. Each item says what to do. Exits 1 when something fails."
+  "Check your setup: target URL, login, connection, Node, CLI and SDK versions, and inside a module folder module.json, the repository link and the cloud setup files. Each item says what to do. Exits 1 when something fails."
 ).option("--dir <path>", "Module folder to check (default: current directory).").option("--json", "Print one JSON object { ok, checks } instead of the report.").action(async (cmdOpts) => {
   process.exitCode = await doctorCommand(
     {
@@ -25288,8 +26123,9 @@ moduleCmd.command("diff").description(
     });
   }
 );
-moduleCmd.command("pull-data").description("Export the module's own-table rows to a local JSON file (for fixtures, local dev seeding).").option("--dir <path>", "Project root (default: current directory).").option("--limit <n>", "Max rows per table (1-1000, default 100).", parseIntOption).option("--out <path>", "Output file path (default: ./dashwise-data.json).").action(async (cmdOpts) => {
+moduleCmd.command("pull-data").description("Export the module's own-table rows to a local JSON file (for fixtures, local dev seeding).").option("--dir <path>", "Project root (default: current directory).").option("--limit <n>", "Max rows per table (1-1000, default 100).", parseIntOption).option("--out <path>", "Output file path (default: ./dashwise-data.json).").option("--json", "Emit structured errors on stderr.").action(async (cmdOpts) => {
   process.exitCode = await modulePullDataCommand({
+    ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {},
     ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
     ...cmdOpts.limit !== void 0 ? { limit: cmdOpts.limit } : {},
     ...cmdOpts.out !== void 0 ? { out: cmdOpts.out } : {}
@@ -25655,8 +26491,15 @@ moduleCmd.command("publish").description("Pack the current directory + upload it
   }
 );
 moduleCmd.command("install [slug]").alias("deploy").alias("upgrade").description(
-  "Install (deploy) a published module into a workspace \u2014 provisions the runtime and prints the public URL. Upgrades/repairs an existing production install idempotently: an upgrade first prints what it does to the copy's data (tables and fields it moves to the Trash or converts, with their counts), asks once, and sends the preview's drift_hash. A move that loses data is accepted only by a person: the one question in a terminal, or --accept-data-loss <drift_hash> with the hash the preview printed. --yes never accepts data loss; with no terminal, or inside an AI agent session, a lossy move is refused and the refusal prints the re-run line. When only a dev install exists it asks whether to install alongside it (--keep-dev-install) or replace it (--replace-dev-install), rather than silently landing on the dev row. Exits 3 \u2014 \"deployed, setup pending\" \u2014 when a required `uses` slot is still unbound: the deploy succeeded but the module throws on its first data call until an admin binds it."
-).option("--workspace <slug-or-id>", "Target workspace (default: cached module workspace, config default, or interactive picker).").option("--version <semver>", "Install a specific published version (default: latest).").option("--force", "Proceed even when the upgrade breaks consumer modules (UPGRADE_BREAKS_CONSUMERS).").option(
+  "Install (deploy) a published module into a workspace \u2014 provisions the runtime and prints the public URL. Upgrades/repairs an existing production install idempotently: an upgrade first prints what it does to the installation's data (tables and fields it moves to the Trash or converts, with their counts), asks once, and sends the preview's drift_hash. A move that loses data is accepted only by a person: the one question in a terminal, or --accept-data-loss <drift_hash> with the hash the preview printed. --yes never accepts data loss; with no terminal, or inside an AI agent session, a lossy move is refused and the refusal prints the re-run line. When only a dev install exists it asks whether to install alongside it (--keep-dev-install) or replace it (--replace-dev-install), rather than silently landing on the dev row. Exits 3 \u2014 \"deployed, setup pending\" \u2014 when a required `uses` slot is still unbound: the deploy succeeded but the module throws on its first data call until an admin binds it."
+).option("--workspace <slug-or-id>", "Target workspace (default: cached module workspace, config default, or interactive picker).").option("--version <semver>", "Install a specific published version (default: latest).").option(
+  "--force",
+  "Upgrade even when it breaks consumer modules (UPGRADE_BREAKS_CONSUMERS): shows which modules it disconnects and what it changes, asks to confirm (--yes confirms disconnections, never data loss), then upgrades exactly that plan."
+).option(
+  "--installation <id>",
+  "Update exactly this production installation (needed when several exist, or to update a held one).",
+  parsePositiveIdOption
+).option(
   "--keep-dev-install",
   "Install production ALONGSIDE the workspace's kind=local dev install, leaving local dev working. Non-destructive. Backends >= 2026-07-15 keep a separate live-install slot per kind group, so the two coexist."
 ).option(
@@ -25668,6 +26511,7 @@ moduleCmd.command("install [slug]").alias("deploy").alias("upgrade").description
 ).option("--json", "Emit the final result as machine-readable JSON.").action(
   async (slug, cmdOpts) => {
     process.exitCode = await moduleInstallCommand(slug, {
+      ...cmdOpts.installation !== void 0 ? { installation: cmdOpts.installation } : {},
       ...cmdOpts.workspace !== void 0 ? { workspace: cmdOpts.workspace } : {},
       ...cmdOpts.version !== void 0 ? { version: cmdOpts.version } : {},
       ...cmdOpts.force !== void 0 ? { force: cmdOpts.force } : {},
@@ -25695,6 +26539,63 @@ moduleCmd.command("uninstall [slug]").description(
     });
   }
 );
+var invitesCmd = moduleCmd.command("invites").description(
+  "Install invitations: send, list and withdraw them for your module, or see and decline the ones your company received."
+);
+var inviteIdArg = (value) => value !== void 0 && /^[1-9][0-9]*$/.test(value) ? Number(value) : void 0;
+invitesCmd.command("list <slug>").description("List the open install invitations for your module.").option("--json", "Emit machine-readable JSON.").action(async (slug, cmdOpts) => {
+  process.exitCode = await moduleInvitesListCommand(slug, {
+    ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
+  });
+});
+invitesCmd.command("send <slug>").description(
+  "Invite another company to install your module. Needs admin rights in the module's company. Asks before sending; pass --yes in scripts."
+).option("--to <company>", "The company id to invite, or the slug of a company you belong to.").option("--note <text>", "A short note shown to the invited company (max 1000 characters).").option("-y, --yes", "Send without asking (required in non-interactive or --json mode).").option("--json", "Emit machine-readable JSON.").action(
+  async (slug, cmdOpts) => {
+    process.exitCode = await moduleInvitesSendCommand(slug, {
+      ...cmdOpts.to !== void 0 ? { to: cmdOpts.to } : {},
+      ...cmdOpts.note !== void 0 ? { note: cmdOpts.note } : {},
+      ...cmdOpts.yes !== void 0 ? { yes: cmdOpts.yes } : {},
+      ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
+    });
+  }
+);
+invitesCmd.command("revoke <slug> <invite-id>").description(
+  "Withdraw an install invitation. Installations made before stay. Asks first; pass --yes in scripts."
+).option("-y, --yes", "Withdraw without asking (required in non-interactive or --json mode).").option("--json", "Emit machine-readable JSON.").action(async (slug, inviteId, cmdOpts) => {
+  process.exitCode = await moduleInvitesRevokeCommand(slug, inviteIdArg(inviteId), {
+    ...cmdOpts.yes !== void 0 ? { yes: cmdOpts.yes } : {},
+    ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
+  });
+});
+invitesCmd.command("received").description("List the open install invitations your company received (company admins).").option("--workspace <slug-or-id>", "Company (default: config default or interactive picker).").option("--json", "Emit machine-readable JSON.").action(async (cmdOpts) => {
+  process.exitCode = await moduleInvitesReceivedCommand({
+    ...cmdOpts.workspace !== void 0 ? { workspace: cmdOpts.workspace } : {},
+    ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
+  });
+});
+invitesCmd.command("decline <invite-id>").description(
+  "Decline an install invitation your company received (company admins). Asks first; pass --yes in scripts."
+).option("--workspace <slug-or-id>", "Company (default: config default or interactive picker).").option("-y, --yes", "Decline without asking (required in non-interactive or --json mode).").option("--json", "Emit machine-readable JSON.").action(
+  async (inviteId, cmdOpts) => {
+    process.exitCode = await moduleInvitesDeclineCommand(inviteIdArg(inviteId), {
+      ...cmdOpts.workspace !== void 0 ? { workspace: cmdOpts.workspace } : {},
+      ...cmdOpts.yes !== void 0 ? { yes: cmdOpts.yes } : {},
+      ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
+    });
+  }
+);
+moduleCmd.command("installations [slug]").description(
+  "List the installations in a company that you can see: id, module, name, audience, version, held state and public address. With a slug, only that module. Read-only."
+).option("--workspace <slug-or-id>", "Company (default: cached module company, config default, or interactive picker).").option("--dev", "Include development installations.").option("--json", "Emit machine-readable JSON.").action(
+  async (slug, cmdOpts) => {
+    process.exitCode = await moduleInstallationsCommand(slug, {
+      ...cmdOpts.workspace !== void 0 ? { workspace: cmdOpts.workspace } : {},
+      ...cmdOpts.dev !== void 0 ? { dev: cmdOpts.dev } : {},
+      ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
+    });
+  }
+);
 moduleCmd.command("status [slug]").description(
   "Show a module's deploy state in a workspace: install kind, installed vs latest published version, runtime provisioning, and the public URL."
 ).option("--workspace <slug-or-id>", "Target workspace (default: cached module workspace, config default, or interactive picker).").option("--dir <path>", "Project root for the module.json slug lookup (default: current directory).").option("--json", "Emit machine-readable JSON.").action(
@@ -25889,9 +26790,10 @@ var schemaCmd = program.command("schema").description(
 );
 schemaCmd.command("push").description(
   "Apply the LOCAL module.json to the dev install via PUT /api/modules/:id/draft/manifest (greenfield or delta). Destructive removals (tables/fields) are previewed and require confirmation unless --yes. Afterwards the canonical manifest is synced back with merge semantics (local-only rbac/indexes blocks survive)."
-).option("--dir <path>", "Project root containing `module.json` (default: current directory).").option("-y, --yes", "Skip the destructive-change confirmation (CI / scripted runs).").action(async (cmdOpts) => {
+).option("--dir <path>", "Project root containing `module.json` (default: current directory).").option("-y, --yes", "Skip the destructive-change confirmation (CI / scripted runs).").option("--json", "Emit structured errors on stderr.").action(async (cmdOpts) => {
   const { schemaPushCommand: schemaPushCommand2 } = await Promise.resolve().then(() => (init_push(), push_exports));
   process.exitCode = await schemaPushCommand2({
+    ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {},
     ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
     ...cmdOpts.yes !== void 0 ? { yes: cmdOpts.yes } : {}
   });
@@ -25972,7 +26874,13 @@ fieldCmd.command("set-type <table-slug> <field-slug> <new-type>").description(
   }
 );
 function getVersion() {
-  return "0.26.0";
+  return "0.28.0";
+}
+function parsePositiveIdOption(value) {
+  if (!/^[1-9][0-9]*$/.test(value.trim())) {
+    throw new Error(`Expected an installation id (a positive whole number), got '${value}'`);
+  }
+  return Number(value.trim());
 }
 function parseIntOption(value) {
   const n = Number.parseInt(value, 10);