@dashai/cli 0.27.0 → 0.28.1

package/dist/bin.js

@@ -178,16 +178,12 @@ function removeModuleEntry(slug) {
 function isLoggedIn() {
   return readSavedToken() !== null;
 }
-var FILE_NAME, DIR_NAME, DEFAULT_API_URL, KNOWN_API_URLS;
+var FILE_NAME, DIR_NAME, DEFAULT_API_URL;
 var init_config = __esm({
   "src/lib/config.ts"() {
     FILE_NAME = "auth.json";
     DIR_NAME = "dashwise";
-    DEFAULT_API_URL = "https://api.dashwise.dev";
-    KNOWN_API_URLS = {
-      dev: "https://api.dashwise.dev",
-      prod: "https://api.dashwise.net"
-    };
+    DEFAULT_API_URL = "https://api.dashwise.net";
   }
 });
 
@@ -283,7 +279,7 @@ async function apiRequest(method, path, body, options = {}) {
 function asEnvelope(v) {
   if (!v || typeof v !== "object") return null;
   const env = v;
-  const out2 = {};
+  const out2 = { body: env };
   if (typeof env.code === "string") out2.code = env.code;
   else if (typeof env.error === "string" && CODE_SHAPE.test(env.error)) out2.code = env.error;
   if (typeof env.message === "string") out2.message = env.message;
@@ -557,6 +553,14 @@ async function getModuleBySlug(slug, options = {}) {
 function isInstallGated(r) {
   return r.install_gated === true;
 }
+async function getUpgradePreview(installationId, version, options = {}) {
+  return apiRequest(
+    "GET",
+    `/api/installations/${installationId}/upgrade-preview?version=${encodeURIComponent(version)}`,
+    void 0,
+    options
+  );
+}
 async function installModule(moduleId, body, options = {}) {
   return apiRequest(
     "POST",
@@ -640,6 +644,8 @@ var init_api_client = __esm({
       code;
       context;
       retriable;
+      /** The whole parsed error body, when the backend sent a JSON object. */
+      body;
       constructor(status, envelope, fallbackMessage) {
         const code2 = envelope?.code ?? codeFromStatus(status);
         const message = envelope?.message ?? fallbackMessage;
@@ -649,6 +655,7 @@ var init_api_client = __esm({
         this.code = code2;
         this.context = envelope?.context;
         this.retriable = envelope?.retriable ?? status >= 500;
+        this.body = envelope?.body;
       }
     };
     CODE_SHAPE = /^[A-Z][A-Z0-9_]*$/;
@@ -2742,6 +2749,7 @@ var init_custom = __esm({
             "@tailwindcss/postcss": "^4",
             "class-variance-authority": "^0.7.1",
             clsx: "^2.1.1",
+            geist: "^1.7.2",
             "lucide-react": "^0.577.0",
             next: "^15.0.0",
             "next-themes": "^0.4.6",
@@ -7266,6 +7274,15 @@ var init_custom = __esm({
           integrity: "sha512-sR9BNCjBg6LNgwvxlBd0sBABvQitkLzoVY9MYYROQVX/FvfJ4Mai9LsGhDgd8qYdds0bY77VzYd5iuB+v5rwQQ==",
           license: "MIT"
         },
+        "node_modules/geist": {
+          version: "1.7.2",
+          resolved: "https://registry.npmjs.org/geist/-/geist-1.7.2.tgz",
+          integrity: "sha512-Gu5lDFa3pLRyoBlBPf0QIFHVdWAnpco7fS1bJm41jyLPFoguBgiubseUN2oLXMgqZ7uxAxDoXcHMhCY/fOTTgg==",
+          license: "SIL OPEN FONT LICENSE",
+          peerDependencies: {
+            next: ">=13.2.0"
+          }
+        },
         "node_modules/gensync": {
           version: "1.0.0-beta.2",
           resolved: "https://registry.npmjs.org/gensync/-/gensync-1.0.0-beta.2.tgz",
@@ -10168,7 +10185,13 @@ function nextConfig() {
 // we DERIVE NEXT_PUBLIC_DASHWISE_API_URL here from DASHWISE_API_URL at
 // build/start time \u2014 you never set the NEXT_PUBLIC_ var yourself. If
 // you already have one set (e.g. a custom setup), it wins.
-const apiUrl = process.env.DASHWISE_API_URL;
+const apiUrl = process.env.DASHWISE_API_URL ?? ${JSON.stringify(DEFAULT_API_URL)};
+// The browser-facing API target: an explicit NEXT_PUBLIC_ override wins (the
+// server may reach the API on an internal address). The embedding app is the
+// app next to THAT public target, never the internal one.
+const publicApiUrl = process.env.NEXT_PUBLIC_DASHWISE_API_URL ?? apiUrl;
+const appUrl = new URL(publicApiUrl);
+appUrl.hostname = appUrl.hostname.replace(/^api\\./, "app.");
 
 const nextConfig = {
   // Required for the platform-hosted (per-install Lambda) runtime: the
@@ -10179,8 +10202,7 @@ const nextConfig = {
   typescript: { ignoreBuildErrors: true },
   eslint: { ignoreDuringBuilds: true },
   env: {
-    NEXT_PUBLIC_DASHWISE_API_URL:
-      process.env.NEXT_PUBLIC_DASHWISE_API_URL ?? apiUrl,
+    NEXT_PUBLIC_DASHWISE_API_URL: publicApiUrl,
   },
   // WHO MAY FRAME THIS MODULE.
   //
@@ -10196,7 +10218,7 @@ const nextConfig = {
   async headers() {
     const ancestors =
       process.env.DASHWISE_FRAME_ANCESTORS ??
-      "https://app.dashwise.dev https://app.dashwise.net";
+      appUrl.origin;
     return [
       {
         source: '/:path*',
@@ -10526,12 +10548,34 @@ export const config = {
 }
 function appLayoutCustomTsx(opts) {
   return `import './globals.css';
+import { GeistSans } from 'geist/font/sans';
+import { GeistMono } from 'geist/font/mono';
 import { AuthProvider, HostRouteSync } from '@dashai/sdk/auth/client';
 import { PlatformProvider, PLATFORM_PREPAINT_SCRIPT } from '@dashai/sdk/platform';
 import { ThemeProvider } from '@/components/theme-provider';
 import { PlatformThemeSync } from '@/components/platform-theme-sync';
 import { getSession } from '@/lib/session';
 
+// The Dashwise app renders in Geist, and \`globals.css\` names that family at the
+// front of \`--font-sans\`. Loading it here is what makes that name resolve: drop
+// these two lines and the stack falls straight through to system-ui, so the
+// module reads as a different product the moment anyone looks at text.
+//
+// The \`geist\` package ships the font files and loads them through
+// \`next/font/local\`: no download at build time (a cloud sandbox may only
+// reach npm and Dashwise, L434) and no runtime request, so nothing to declare
+// in \`runtime.outbound_apis\`. Never switch to \`next/font/google\`: that
+// fetches from Google during \`next build\`. The \`.variable\` classes on
+// <html> are what make Next emit the @font-face rules at all; they also expose
+// \`var(--font-geist-sans)\` for components that want it directly.
+//
+// They sit on <html>, not <body>: \`--font-sans\` in globals.css is declared on
+// :root (= <html>) and reads \`var(--font-geist-sans)\`, and a custom property
+// resolves where it is declared. The family name next/font generates is not
+// "Geist", so naming the family literally would not find the loaded files.
+const geistSans = GeistSans;
+const geistMono = GeistMono;
+
 export const metadata = {
   title: ${JSON.stringify(opts.name)},
   description: ${JSON.stringify(`Dashwise module: ${opts.slug}`)},
@@ -10556,7 +10600,12 @@ export default async function RootLayout({ children }: { children: React.ReactNo
     // renders inside the Dashwise app shell, where the header/nav/theme toggle
     // already exist. The pre-paint script below only ever UPGRADES it to
     // "standalone", so chrome can never flash on top of the app's own.
-    <html lang="en" data-dw-surface="embedded" suppressHydrationWarning>
+    <html
+      lang="en"
+      data-dw-surface="embedded"
+      className={\`\${geistSans.variable} \${geistMono.variable}\`}
+      suppressHydrationWarning
+    >
       <head>
         {/* Runs before first paint: stamps data-dw-surface on <html> and
             re-applies the cached workspace brand. Keeps \`.dw-standalone-only\`
@@ -11219,6 +11268,7 @@ function packageJsonCustom(opts) {
         // below that fails with "every import from @dashai/generated
         // throws", which points nowhere near the cause.
         "@dashai/sdk": SCAFFOLD_SDK_RANGE,
+        geist: GEIST_DEP_RANGE,
         next: "^15.0.0",
         react: "^19.0.0",
         "react-dom": "^19.0.0",
@@ -11367,13 +11417,18 @@ function globalsCss() {
   --code-bg: oklch(0.14 0 0);
   --code-fg: oklch(0.97 0 0);
 
+  /* Geist is loaded from the \`geist\` package in app/layout.tsx, which puts
+     --font-geist-sans/--font-geist-mono on <html> (= :root), so they resolve
+     here. Keep those classes on <html>: on <body> the var() below would be
+     unresolved at :root and the whole stack would fall back silently. The
+     second argument of var() keeps "Geist" as a fallback name. */
   --font-sans:
-    "Geist", "Geist Fallback", ui-sans-serif, system-ui, -apple-system,
+    var(--font-geist-sans, "Geist"), ui-sans-serif, system-ui, -apple-system,
     BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial,
     "Noto Sans", sans-serif, "Apple Color Emoji", "Segoe UI Emoji",
     "Segoe UI Symbol", "Noto Color Emoji";
   --font-mono:
-    "Geist Mono", "Geist Mono Fallback", ui-monospace, SFMono-Regular, Menlo,
+    var(--font-geist-mono, "Geist Mono"), ui-monospace, SFMono-Regular, Menlo,
     Monaco, Consolas, "Liberation Mono", "Courier New", monospace;
 
   --radius: 0.625rem;
@@ -11583,27 +11638,42 @@ import { Slot } from "radix-ui";
 
 import { cn } from "@/lib/utils";
 
+// A faithful copy of the Dashwise app's own button kit \u2014 only the \`cn\` import
+// path and the "use client" directive above differ. Variants your module does
+// not use yet are kept on purpose: divergence is what makes a vendored
+// design-system file drift out of sync with the app it is supposed to match.
 const buttonVariants = cva(
-  "inline-flex shrink-0 items-center justify-center gap-2 rounded-md text-sm font-medium whitespace-nowrap transition-all outline-none focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
+  // Focus ring: full-opacity \`ring\` with a background-coloured offset.
+  // The stock shadcn ring (\`ring-ring/50\` drawn directly on the button)
+  // measures 2.30:1 against the page and 2.73:1 against a primary fill \u2014
+  // below the 3:1 that WCAG 1.4.11 / 2.4.11 require of a focus indicator,
+  // i.e. effectively invisible on the most-used control in any module.
+  "inline-flex shrink-0 items-center justify-center gap-2 rounded-md text-sm font-medium whitespace-nowrap transition-all outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 focus-visible:ring-offset-background disabled:pointer-events-none disabled:opacity-50 aria-invalid:border-destructive aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
   {
     variants: {
       variant: {
         default: "bg-primary text-primary-foreground hover:bg-primary/90",
         destructive:
-          "bg-destructive text-white hover:bg-destructive/90",
+          "bg-destructive text-white hover:bg-destructive/90 focus-visible:ring-destructive/20 dark:bg-destructive/60 dark:focus-visible:ring-destructive/40",
         outline:
-          "border bg-background shadow-xs hover:bg-accent hover:text-accent-foreground",
+          "border bg-background shadow-xs hover:bg-accent hover:text-accent-foreground dark:border-input dark:bg-input/30 dark:hover:bg-input/50",
         secondary:
           "bg-secondary text-secondary-foreground hover:bg-secondary/80",
         ghost:
-          "hover:bg-accent hover:text-accent-foreground",
+          "hover:bg-accent hover:text-accent-foreground dark:hover:bg-accent/50",
         link: "text-primary underline-offset-4 hover:underline",
+        "destructive-soft":
+          "bg-destructive/10 text-destructive border border-destructive/20 shadow-xs hover:bg-destructive/20",
       },
       size: {
         default: "h-9 px-4 py-2 has-[>svg]:px-3",
+        xs: "h-6 gap-1 rounded-md px-2 text-xs has-[>svg]:px-1.5 [&_svg:not([class*='size-'])]:size-3",
         sm: "h-8 gap-1.5 rounded-md px-3 has-[>svg]:px-2.5",
         lg: "h-10 rounded-md px-6 has-[>svg]:px-4",
         icon: "size-9",
+        "icon-xs": "size-6 rounded-md [&_svg:not([class*='size-'])]:size-3",
+        "icon-sm": "size-8",
+        "icon-lg": "size-10",
       },
     },
     defaultVariants: {
@@ -11627,6 +11697,8 @@ function Button({
   return (
     <Comp
       data-slot="button"
+      data-variant={variant}
+      data-size={size}
       className={cn(buttonVariants({ variant, size, className }))}
       {...props}
     />
@@ -12351,6 +12423,15 @@ the workspace's theme and branding.
 | corners / elevation | \`rounded-md\`/\`rounded-lg\`, \`shadow-xs\`\u2026\`shadow-md\` |
 | type | inherit \`--font-sans\`; ids and code use \`font-mono\` |
 
+**Don't re-declare the font.** \`app/layout.tsx\` loads Geist from the
+\`geist\` package and puts its variables on \`<html>\`; \`globals.css\` reads
+them with \`var(--font-geist-sans, "Geist")\`. Leave both alone. Never switch to
+\`next/font/google\` (it downloads from Google during \`next build\`, which fails
+in a cloud sandbox) and never move the variables to \`<body>\` (the var() at
+\`:root\` would be unresolved and text silently falls back to Tailwind's default
+sans). Same class of trap for \`--shadow-*\`, which must be mapped into
+\`@theme\` to be reachable by \`shadow-xs\`/\`shadow-sm\`.
+
 **Theme and branding arrive from the host.** \`PlatformProvider\` +
 \`PlatformThemeSync\` (already wired in \`app/layout.tsx\`) follow the app's
 light/dark choice and apply the workspace's brand colour to \`--primary\` /
@@ -12909,13 +12990,15 @@ function companyApiHost(apiUrl) {
     return null;
   }
 }
+function docsApiHost(apiUrl) {
+  return companyApiHost(apiUrl) ?? new URL(DEFAULT_API_URL).host;
+}
 function apiHostLine(apiUrl) {
-  const host = companyApiHost(apiUrl);
-  return host ? `\`${host}\` (this company's Dashwise API; the company uses Dashwise at ${HOSTED_API_HOSTS[host]})` : "the company's Dashwise API host: `api.dashwise.net` if the person opens Dashwise at app.dashwise.net, `api.dashwise.dev` if at app.dashwise.dev. If you can't tell, ask them which address they use";
+  const host = docsApiHost(apiUrl);
+  return `\`${host}\` (this company's Dashwise API; the company uses Dashwise at ${HOSTED_API_HOSTS[host] ?? host})`;
 }
 function codexEnvironmentInstructions(apiUrl) {
-  const host = companyApiHost(apiUrl);
-  const apiUrlValue = host ? `https://${host}` : "https://<the company API host above>";
+  const apiUrlValue = `https://${docsApiHost(apiUrl)}`;
   return `## Codex cloud environment
 
 When the person asks you to set up the Codex cloud environment for this
@@ -12962,14 +13045,13 @@ Publishing is their click.
 `;
 }
 function claudeCloudNote(apiUrl) {
-  const host = companyApiHost(apiUrl);
   return `## Claude cloud
 
 Claude Code on the web has no environment setup chat. It reads this repository
 and \`CLAUDE.md\`, and \`.claude/settings.json\` runs \`scripts/cloud-setup.sh\`
 when a cloud session starts. Node 22 or 24 both work. If
 the environment has a network setting, allow the same domains as for Codex:
-${CLOUD_ALLOWED_HOSTS.map((h) => `\`${h}\``).join(", ")} and ${host ? `\`${host}\`` : "the company's Dashwise API host (`api.dashwise.net` for app.dashwise.net, `api.dashwise.dev` for app.dashwise.dev)"}. No secrets.
+${CLOUD_ALLOWED_HOSTS.map((h) => `\`${h}\``).join(", ")} and \`${docsApiHost(apiUrl)}\`. No secrets.
 `;
 }
 function agentsMd(opts) {
@@ -13213,15 +13295,17 @@ remain human actions. No Dashwise token is needed for
 repository code delivery.
 `;
 }
-var NODE_ENGINES, DEPLOY_TARGETS, SCAFFOLD_DEFAULT_API_URL, MODULE_SLUG_REGEX, CLOUD_ALLOWED_HOSTS, HOSTED_API_HOSTS;
+var NODE_ENGINES, DEPLOY_TARGETS, SCAFFOLD_DEFAULT_API_URL, GEIST_DEP_RANGE, MODULE_SLUG_REGEX, CLOUD_ALLOWED_HOSTS, HOSTED_API_HOSTS;
 var init_scaffold = __esm({
   "src/lib/scaffold.ts"() {
+    init_config();
     init_sdk_version();
     init_simple();
     init_custom();
     NODE_ENGINES = "22.x || 24.x";
     DEPLOY_TARGETS = ["railway", "vercel", "fly"];
     SCAFFOLD_DEFAULT_API_URL = "http://localhost:3000";
+    GEIST_DEP_RANGE = "^1.7.2";
     MODULE_SLUG_REGEX = /^[a-z]([a-z0-9-]*[a-z0-9])?$/;
     CLOUD_ALLOWED_HOSTS = [
       "registry.npmjs.org",
@@ -14054,214 +14138,547 @@ var init_diff_check = __esm({
   }
 });
 
-// src/lib/manifest-reference-lint.ts
-function referenceFieldWarnings(manifest) {
-  const tables = manifest?.owns?.tables;
-  if (!Array.isArray(tables)) return [];
-  const warnings = [];
-  for (const table of tables) {
-    if (typeof table?.slug !== "string" || !Array.isArray(table.fields)) continue;
-    for (const field of table.fields) {
-      if (typeof field?.slug !== "string" || typeof field.type !== "string") continue;
-      if (field.slug === "id" || !REFERENCE_NAME.test(field.slug)) continue;
-      if (!PLAIN_TYPES.has(field.type)) continue;
-      warnings.push({
-        table: table.slug,
-        field: field.slug,
-        type: field.type,
-        message: `${table.slug}.${field.slug} is a ${field.type} field named like a reference. If it points at a row in Dashwise, use a link_row field: plain ids break silently when data is copied to another installation. Ignore this for ids from outside systems.`
-      });
-    }
-  }
-  return warnings;
-}
-var REFERENCE_NAME, PLAIN_TYPES;
-var init_manifest_reference_lint = __esm({
-  "src/lib/manifest-reference-lint.ts"() {
-    REFERENCE_NAME = /(?:_id|_ref|Id|Ref)$/;
-    PLAIN_TYPES = /* @__PURE__ */ new Set(["number", "text", "autonumber"]);
-  }
-});
-function loadSchemaCommandContext(opts) {
-  const projectRoot = resolve(opts.dir ?? process.cwd());
-  const manifestPath2 = join(projectRoot, "module.json");
-  const manifest = readManifestOrThrow(projectRoot);
-  const manifestRawBytes = readFileSync(manifestPath2, "utf-8");
-  const slug = manifest.module?.slug;
-  if (!slug) {
-    throw new Error(
-      `module.json at ${manifestPath2} has no module.slug \u2014 the manifest is malformed.`
-    );
-  }
-  const cfg = readConfig();
-  if (!cfg) {
-    throw new Error("Not logged in. Run `dashwise login` first.");
-  }
-  const entry = readModuleEntry(slug);
-  if (!entry) {
-    throw new Error(
-      `No dev install cached for module "${slug}". Run \`dashwise init ${slug}\` to provision one (existing files are preserved).`
-    );
-  }
-  const token = resolveSchemaAuthToken(entry, slug);
-  return {
-    projectRoot,
-    manifestPath: manifestPath2,
-    manifest,
-    manifestRawBytes,
-    slug,
-    cfg,
-    entry,
-    requestOptions: {
-      baseUrl: resolveApiUrl(),
-      auth: { token }
-    }
-  };
-}
-function resolveSchemaAuthToken(entry, slug) {
-  if (entry.apiKey) return entry.apiKey;
-  throw new Error(
-    `The cached credential for "${slug}" is a legacy runtime token, which the schema endpoints no longer accept. Run \`dashwise dev\` once (it mints a dwk_ API key and updates your config), or \`dashwise init ${slug}\` to re-provision (existing files are preserved).`
-  );
+// src/lib/permission-hint.ts
+function str(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
 }
-var init_schema_command_context = __esm({
-  "src/lib/schema-command-context.ts"() {
-    init_config();
-    init_manifest_io();
-  }
-});
-function hydrateEnvFromDotenvLocal(projectRoot) {
-  const envFile = join(projectRoot, ".env.local");
-  if (!existsSync(envFile)) return;
-  const raw = readFileSync(envFile, "utf-8");
-  for (const line of raw.split(/\r?\n/)) {
-    const trimmed = line.trim();
-    if (trimmed.length === 0 || trimmed.startsWith("#")) continue;
-    const eq = trimmed.indexOf("=");
-    if (eq <= 0) continue;
-    const key = trimmed.slice(0, eq).trim();
-    let value = trimmed.slice(eq + 1).trim();
-    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
-      value = value.slice(1, -1);
-    }
-    if (process.env[key] === void 0) {
-      process.env[key] = value;
-    }
-  }
+function num(v) {
+  return typeof v === "number" && Number.isFinite(v) ? v : void 0;
 }
-var init_dotenv_local = __esm({
-  "src/lib/dotenv-local.ts"() {
-  }
-});
-
-// src/lib/install-target.ts
-function keyDisplayPrefix(apiKey) {
-  if (!apiKey.startsWith(KEY_SCHEME)) return null;
-  const prefix = apiKey.slice(KEY_SCHEME.length, KEY_SCHEME.length + KEY_PREFIX_CHARS);
-  return prefix.length === KEY_PREFIX_CHARS ? prefix : null;
+function featureFromPermission(permission) {
+  const m = permission ? /^workspace\.feature\.([a-z0-9_]+)\.use$/.exec(permission) : null;
+  return m?.[1];
 }
-async function keyBelongsToInstall(apiKey, installationId, options, now = /* @__PURE__ */ new Date()) {
-  const prefix = keyDisplayPrefix(apiKey);
-  if (prefix === null) return false;
-  const { api_keys } = await listApiKeys(installationId, options);
-  return api_keys.some(
-    (k) => k.installation_id === installationId && k.key_prefix === prefix && (k.status === void 0 || k.status === "active") && k.revoked_at === null && (k.expires_at === null || new Date(k.expires_at) > now)
-  );
+function featureSubject(ctx) {
+  const feature = str(ctx.feature) ?? featureFromPermission(str(ctx.permission));
+  if (feature && FEATURE_SUBJECTS[feature]) return FEATURE_SUBJECTS[feature];
+  return str(ctx.feature_label) ?? (feature ? `"${feature}"` : void 0);
 }
-function formatInstallTarget(id, detail) {
-  return detail ? `\u2192 install #${id} (${detail})` : `\u2192 install #${id}`;
+function needsAdmin(what, module, ask) {
+  const scope = module ? ` for ${module}` : "";
+  return `${what}${scope} needs a Dashwise admin. Ask your Dashwise admin to ${ask}.`;
 }
-async function nameKeyTarget(args) {
-  const { apiKey, keySource, entry, cfg, apiUrl, install } = args;
-  const request = cfg ? { baseUrl: apiUrl, auth: { token: cfg.token }, signal: AbortSignal.timeout(LOOKUP_TIMEOUT_MS) } : null;
-  if (install === void 0) {
-    if (keySource !== "cached" || !entry) {
-      info(
-        `\u2192 install not checked: ${code("DASHWISE_API_KEY")} comes from ${keySource === "environment" ? "the environment" : code(".env.local")}. Pass ${code("--install <id>")} to name its target and refuse a mismatch.`
-      );
-      return 0;
-    }
-    if (!request || entry.workspaceId === void 0) {
-      info(formatInstallTarget(entry.installationId, "the cached dev install"));
-      return 0;
+function refusalHint(code2, context, subject = {}) {
+  const ctx = context ?? {};
+  const module = subject.module ?? str(ctx.module_slug);
+  const installationId = subject.installationId ?? num(ctx.installation_id);
+  const installLabel = installationId !== void 0 ? ` (install #${installationId})` : "";
+  const named = module ?? "this module";
+  const reason = str(ctx.reason);
+  if (code2 === "MODULE_CAPABILITY_DENIED" && reason === "authoring_access_required") {
+    return {
+      message: "You need authoring access to export development data; ask someone who manages module access.",
+      needsGrant: true
+    };
+  }
+  if (code2 === "RAW_DATA_NOT_ALLOWED") {
+    if (reason === "raw_data_write_required") {
+      return {
+        message: "You don't have access to change this data. Ask a data list Admin for Editor access in the Data Hub Permissions tab.",
+        needsGrant: true
+      };
     }
-    try {
-      const workspaces = await apiRequest("GET", "/api/workspaces", void 0, request);
-      const ws = workspaces.find((w) => w.id === entry.workspaceId);
-      info(formatInstallTarget(entry.installationId, `${ws ? ws.slug : `workspace #${entry.workspaceId}`}, local`));
-    } catch {
-      info(formatInstallTarget(entry.installationId));
+    if (reason === "installation_access_required") {
+      return {
+        message: "You cannot open this installation with your current access; ask someone who manages installation access.",
+        needsGrant: true
+      };
     }
-    return 0;
-  }
-  const source = keySource === "cached" ? "the cached key" : `${code("DASHWISE_API_KEY")} (from ${keySource === "environment" ? "the environment" : code(".env.local")})`;
-  if (!request) {
-    fail(
-      `${code("--install")} looks the install up with your CLI login, and there is none. Run ${code("dashwise login")} first. Nothing was run.`
-    );
-    return 1;
-  }
-  let belongs;
-  try {
-    belongs = await keyBelongsToInstall(apiKey, install, request);
-  } catch (err) {
-    fail(
-      `Could not read the keys of install #${install} to confirm ${source} (${describe(err)}). Refusing to run against an unconfirmed install. Nothing was run.`
-    );
-    return 1;
-  }
-  const cachedDev = entry?.installationId === install ? "the cached dev install, " : "";
-  if (!belongs) {
-    const other = entry && entry.installationId !== install && entry.apiKey === apiKey ? ` It is the cached key of install #${entry.installationId}.` : "";
-    fail(`${source} is not a live key of install #${install}.${other} Nothing was run.`);
-    info(
-      `Use a key of install #${install} (mint one with ${code(`dashwise api-keys create <name> --install ${install}`)}), or drop ${code("--install")} to run against the key's own install.`
-    );
-    return 1;
-  }
-  info(formatInstallTarget(install, `${cachedDev}key checked`));
-  return 0;
-}
-function describe(err) {
-  if (err instanceof ApiError) return `${err.code || err.status} ${err.message}`;
-  return err.message;
-}
-var KEY_PREFIX_CHARS, KEY_SCHEME, LOOKUP_TIMEOUT_MS;
-var init_install_target = __esm({
-  "src/lib/install-target.ts"() {
-    init_api_client();
-    init_output();
-    KEY_PREFIX_CHARS = 8;
-    KEY_SCHEME = "dwk_";
-    LOOKUP_TIMEOUT_MS = 1500;
+    return {
+      message: "You don't have access to view this data. Ask a data list Admin for Viewer access in the Data Hub Permissions tab.",
+      needsGrant: true
+    };
   }
-});
-
-// src/commands/run.ts
-var run_exports = {};
-__export(run_exports, {
-  runCommand: () => runCommand
-});
-async function runCommand(cmdArgs, options) {
-  if (!cmdArgs || cmdArgs.length === 0) {
-    fail(
-      `Usage: ${code("dashwise run -- <command\u2026>")} (e.g. ${code("dashwise run -- node seed.mjs")})`
-    );
-    return 1;
+  if (code2 === "VALIDATION_ERROR" && reason === "module_context_required") {
+    return {
+      message: "Open the intended module project and select the company and installation.",
+      needsGrant: false
+    };
   }
-  if (options.install !== void 0 && (!Number.isInteger(options.install) || options.install <= 0)) {
-    fail(`--install expects a positive integer installation id (got "${options.install}").`);
-    return 1;
+  if (code2 === "VALIDATION_ERROR" && reason === "context_mismatch") {
+    return {
+      message: "The selected company and installation do not match; check your selection.",
+      needsGrant: false
+    };
   }
-  const projectRoot = resolve(options.dir ?? process.cwd());
-  let manifestSlug;
-  try {
-    manifestSlug = readManifestOrThrow(projectRoot).module?.slug;
-  } catch (err) {
-    fail(err.message);
-    return 1;
+  if (code2 === "UNAUTHENTICATED" && reason === "module_api_credential_missing") {
+    return {
+      message: "No module API key is configured; configure an existing key for the intended installation.",
+      needsGrant: false
+    };
   }
-  if (!manifestSlug) {
+  switch (code2) {
+    case "DRAFT_INSTALLATION_MISSING":
+    case "DEV_INSTALLATION_MISSING":
+      return {
+        message: "This module has no dev installation; ask a module builder to create one.",
+        needsGrant: false
+      };
+    case "MANIFEST_MANAGED_BY_REPOSITORY":
+      return {
+        message: "This module's column rules are managed in module.json. Change human_edit and human_edit_reason there, then build and release the module.",
+        needsGrant: false
+      };
+    case "NOT_FOUND":
+    case "MODULE_NOT_FOUND":
+      return { message: "Not found; check your selection or ask for access.", needsGrant: false };
+    case "UNAUTHORIZED":
+    case "UNAUTHENTICATED":
+    case "TOKEN_EXPIRED":
+      return { message: "Run dashwise login, then retry.", needsGrant: false };
+    case "FEATURE_DISABLED":
+    case "PERMISSION_DENIED": {
+      const what = featureSubject(ctx);
+      if (!what) {
+        return {
+          message: `You don't have permission to do this${module ? ` for ${module}` : ""}. Ask your Dashwise admin for access.`,
+          needsGrant: true
+        };
+      }
+      return { message: needsAdmin(what, module, "enable it"), needsGrant: true };
+    }
+    case "RUNTIME_OPTION_OPERATOR_ONLY": {
+      const option = str(ctx.option);
+      const what = (option && OPTION_SUBJECTS[option]) ?? (option ? `"${option}"` : "This runtime option");
+      return { message: needsAdmin(what, module, "change it"), needsGrant: true };
+    }
+    case REBUILD_BUMP_OPERATOR_ONLY: {
+      const bump = str(ctx.bump) ?? "minor";
+      return {
+        message: needsAdmin(`A rebuild with a ${bump} version bump`, module, "run it"),
+        needsGrant: true
+      };
+    }
+    case "IMAGE_TAG_EXISTS":
+      return {
+        message: `This rebuild of ${named} needs a higher version bump than patch. A rebuild with a minor version bump needs a Dashwise admin. Ask your Dashwise admin to run it.`,
+        needsGrant: true
+      };
+    case "RUNTIME_IMAGE_NOT_ELIGIBLE": {
+      const version = str(ctx.version);
+      const target = installationId !== void 0 ? ` --rollout installs:${installationId}` : "";
+      return {
+        message: `${named}${version ? ` v${version}` : ""} was built before streaming support. Rebuild it and upgrade this install first: dashwise module rebuild${module ? ` ${module}` : ""}${target}`,
+        needsGrant: false
+      };
+    }
+    case "RUNTIME_SWAP_PENDING": {
+      const version = str(ctx.version);
+      return {
+        message: `${named}${installLabel} is still finishing its update${version ? ` to v${version}` : ""}, so streaming cannot be turned on yet. Try again in a few minutes.`,
+        needsGrant: false
+      };
+    }
+    case "RUNTIME_OPTION_UNAVAILABLE": {
+      const option = str(ctx.option);
+      const what = (option && OPTION_SUBJECTS[option]) ?? "This runtime option";
+      return { message: `${what} is switched off platform-wide right now.`, needsGrant: false };
+    }
+    case "RUNTIME_CHANGE_IN_PROGRESS": {
+      const op = num(ctx.operation_id);
+      return {
+        message: `A runtime change is already being applied to ${named}${op !== void 0 ? ` (operation #${op})` : ""}. Wait for it, then check: dashwise module runtime${module ? ` ${module}` : ""}`,
+        needsGrant: false
+      };
+    }
+    case "BUILD_IN_PROGRESS": {
+      const buildId = num(ctx.build_id);
+      const status = str(ctx.status);
+      const which = buildId !== void 0 ? ` (#${buildId}${status ? `, ${status}` : ""})` : "";
+      return {
+        message: `A build of ${named} is already running${which}. Wait for it to finish, then run the rebuild again.`,
+        needsGrant: false
+      };
+    }
+    case "REBUILD_SOURCE_NOT_FOUND":
+      return {
+        message: `${named} has no build from source to rebuild. Publish it first: dashwise module publish`,
+        needsGrant: false
+      };
+    case "INSTALLATION_NOT_FOUND":
+      return {
+        message: `${installationId !== void 0 ? `Installation #${installationId}` : "The installation"} was not found, or you cannot see it.`,
+        needsGrant: false
+      };
+    case "PUBLISH_RATE_LIMITED":
+    case "PUBLISH_USER_RATE_LIMITED":
+      return {
+        message: `Too many builds of ${named} in the last hour. Try again later.`,
+        needsGrant: false
+      };
+    // Install invitations (`dashwise module invites`, Südbau retro 6).
+    case "AUTHOR_ADMIN_REQUIRED":
+      return {
+        message: `Only an admin of the company that owns ${named} can manage its install invitations. Ask that company's admin.`,
+        needsGrant: true
+      };
+    case "COMPANY_ADMIN_REQUIRED":
+      return {
+        message: "Only an admin of this company can see or decline its install invitations. Ask your company's admin.",
+        needsGrant: true
+      };
+    case "MODULE_PRIVATE_SHARE_FIRST":
+      return {
+        message: `${named} is still private. Share it with your company in Dashwise first, then invite another company.`,
+        needsGrant: false
+      };
+    default:
+      if (MODULE_RIGHT_CODES.has(code2)) {
+        return {
+          message: `You can't manage ${named}${installLabel}. Ask your Dashwise admin for access.`,
+          needsGrant: true
+        };
+      }
+      return null;
+  }
+}
+function reportCliError(message, opts) {
+  if (opts.json) {
+    out(
+      JSON.stringify({
+        error: {
+          code: opts.code ?? "CLI_ERROR",
+          message: message.replace(ANSI, ""),
+          status: null,
+          context: null
+        },
+        hint: null,
+        needs_grant: false
+      })
+    );
+  } else {
+    fail(message);
+  }
+  return 1;
+}
+function reportFailedOutcome(failure, hint, opts) {
+  if (opts.json) {
+    out(
+      JSON.stringify({
+        error: {
+          code: failure.code,
+          message: failure.message ?? null,
+          status: null,
+          context: null
+        },
+        hint: hint?.message ?? null,
+        needs_grant: hint?.needsGrant ?? false,
+        ...opts.extra
+      })
+    );
+  } else {
+    fail(hint?.message ?? opts.fallback);
+  }
+  return hint?.needsGrant ? EXIT_NEEDS_GRANT : 1;
+}
+function isTransientPollError(err) {
+  if (!(err instanceof ApiError)) return true;
+  return err.status === 0 || err.status === 429 || err.status >= 500;
+}
+function isTypedRequestError(err) {
+  if (err instanceof ApiError) return true;
+  if (!(err instanceof Error)) return false;
+  const candidate = err;
+  return typeof candidate.code === "string" && typeof candidate.status === "number" && (candidate.context === void 0 || candidate.context !== null && typeof candidate.context === "object" && !Array.isArray(candidate.context));
+}
+function reportRefusal(err, subject, opts) {
+  const writeJson = (message) => {
+    if (opts.stderr) process.stderr.write(`${message}
+`);
+    else out(message);
+  };
+  if (!isTypedRequestError(err)) {
+    const message = err?.message ?? String(err);
+    if (opts.json) {
+      writeJson(
+        JSON.stringify({
+          error: {
+            code: "CLI_ERROR",
+            message: message.replace(ANSI, ""),
+            status: null,
+            context: null
+          },
+          hint: null,
+          needs_grant: false
+        })
+      );
+    } else {
+      fail(`${opts.action} failed: ${message}`);
+    }
+    return 1;
+  }
+  const hint = err.status === 401 && err.context?.reason !== "module_api_credential_missing" ? {
+    message: opts.moduleKey ? MODULE_KEY_REFUSED[opts.moduleKey] : "Your login has expired. Run: dashwise login",
+    needsGrant: false
+  } : refusalHint(err.code, err.context, subject);
+  if (opts.json) {
+    writeJson(
+      JSON.stringify({
+        error: {
+          code: err.code,
+          message: err.message,
+          status: err.status,
+          context: err.context ?? null
+        },
+        hint: hint?.message ?? null,
+        needs_grant: hint?.needsGrant ?? false
+      })
+    );
+  } else if (hint) {
+    fail(
+      `${hint.message} (${err.code})${err.context ? ` context=${JSON.stringify(err.context)}` : ""}`
+    );
+  } else {
+    fail(
+      `${opts.action} failed (${err.code}): ${err.message}${err.context ? ` context=${JSON.stringify(err.context)}` : ""}`
+    );
+  }
+  return hint?.needsGrant ? EXIT_NEEDS_GRANT : 1;
+}
+var EXIT_NEEDS_GRANT, EXIT_TIMED_OUT, REBUILD_BUMP_OPERATOR_ONLY, FEATURE_SUBJECTS, OPTION_SUBJECTS, MODULE_RIGHT_CODES, ANSI, MODULE_KEY_REFUSED;
+var init_permission_hint = __esm({
+  "src/lib/permission-hint.ts"() {
+    init_api_client();
+    init_output();
+    EXIT_NEEDS_GRANT = 3;
+    EXIT_TIMED_OUT = 4;
+    REBUILD_BUMP_OPERATOR_ONLY = "REBUILD_BUMP_OPERATOR_ONLY";
+    FEATURE_SUBJECTS = {
+      module_runtime_streaming: "Streaming",
+      module_rebuild: "Rebuild",
+      module_building: "Building modules",
+      module_runtime_sizing: "Memory size"
+    };
+    OPTION_SUBJECTS = {
+      streaming: "Streaming",
+      memory_mb: "Memory size",
+      reapply: "Re-applying the runtime",
+      timeout: "The timeout",
+      reserved_concurrency: "Reserved concurrency",
+      log_retention: "Log retention"
+    };
+    MODULE_RIGHT_CODES = /* @__PURE__ */ new Set([
+      "MODULE_CAPABILITY_DENIED",
+      "PUBLISH_REQUIRES_ADMIN",
+      "NOT_COPY_OWNER"
+    ]);
+    ANSI = /\x1b\[[0-9;]*m/g;
+    MODULE_KEY_REFUSED = {
+      env: "The module key in DASHWISE_API_KEY was refused (expired or revoked). Replace it with a current key, or unset it to use this module's saved key. dashwise login does not renew module keys.",
+      env_file: "The module key in .env.local (DASHWISE_API_KEY) was refused (expired or revoked). Replace it, or remove that line to use this module's saved key. dashwise login does not renew module keys.",
+      saved: `This module's saved key was refused (expired or revoked). In your CLI auth.json, set only modules[<slug>].apiKey to an empty string (""), keeping installationId and all other fields. Then run dashwise dev from this module's directory with DASHWISE_API_KEY unset to mint and save a replacement key for the same installation. dashwise login does not renew module keys.`
+    };
+  }
+});
+
+// src/lib/manifest-reference-lint.ts
+function referenceFieldWarnings(manifest) {
+  const tables = manifest?.owns?.tables;
+  if (!Array.isArray(tables)) return [];
+  const warnings = [];
+  for (const table of tables) {
+    if (typeof table?.slug !== "string" || !Array.isArray(table.fields)) continue;
+    for (const field of table.fields) {
+      if (typeof field?.slug !== "string" || typeof field.type !== "string") continue;
+      if (field.slug === "id" || !REFERENCE_NAME.test(field.slug)) continue;
+      if (!PLAIN_TYPES.has(field.type)) continue;
+      warnings.push({
+        table: table.slug,
+        field: field.slug,
+        type: field.type,
+        message: `${table.slug}.${field.slug} is a ${field.type} field named like a reference. If it points at a row in Dashwise, use a link_row field: plain ids break silently when data is copied to another installation. Ignore this for ids from outside systems.`
+      });
+    }
+  }
+  return warnings;
+}
+var REFERENCE_NAME, PLAIN_TYPES;
+var init_manifest_reference_lint = __esm({
+  "src/lib/manifest-reference-lint.ts"() {
+    REFERENCE_NAME = /(?:_id|_ref|Id|Ref)$/;
+    PLAIN_TYPES = /* @__PURE__ */ new Set(["number", "text", "autonumber"]);
+  }
+});
+function loadSchemaCommandContext(opts) {
+  const projectRoot = resolve(opts.dir ?? process.cwd());
+  const manifestPath2 = join(projectRoot, "module.json");
+  const manifest = readManifestOrThrow(projectRoot);
+  const manifestRawBytes = readFileSync(manifestPath2, "utf-8");
+  const slug = manifest.module?.slug;
+  if (!slug) {
+    throw new Error(
+      `module.json at ${manifestPath2} has no module.slug \u2014 the manifest is malformed.`
+    );
+  }
+  const cfg = readConfig();
+  if (!cfg) {
+    throw new Error("Not logged in. Run `dashwise login` first.");
+  }
+  const entry = readModuleEntry(slug);
+  if (!entry) {
+    throw new Error(
+      `No dev install cached for module "${slug}". Run \`dashwise init ${slug}\` to provision one (existing files are preserved).`
+    );
+  }
+  const token = resolveSchemaAuthToken(entry, slug);
+  return {
+    projectRoot,
+    manifestPath: manifestPath2,
+    manifest,
+    manifestRawBytes,
+    slug,
+    cfg,
+    entry,
+    requestOptions: {
+      baseUrl: resolveApiUrl(),
+      auth: { token }
+    }
+  };
+}
+function resolveSchemaAuthToken(entry, slug) {
+  if (entry.apiKey) return entry.apiKey;
+  throw new Error(
+    `The cached credential for "${slug}" is a legacy runtime token, which the schema endpoints no longer accept. Run \`dashwise dev\` once (it mints a dwk_ API key and updates your config), or \`dashwise init ${slug}\` to re-provision (existing files are preserved).`
+  );
+}
+var init_schema_command_context = __esm({
+  "src/lib/schema-command-context.ts"() {
+    init_config();
+    init_manifest_io();
+  }
+});
+function hydrateEnvFromDotenvLocal(projectRoot) {
+  const envFile = join(projectRoot, ".env.local");
+  if (!existsSync(envFile)) return;
+  const raw = readFileSync(envFile, "utf-8");
+  for (const line of raw.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (trimmed.length === 0 || trimmed.startsWith("#")) continue;
+    const eq = trimmed.indexOf("=");
+    if (eq <= 0) continue;
+    const key = trimmed.slice(0, eq).trim();
+    let value = trimmed.slice(eq + 1).trim();
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+      value = value.slice(1, -1);
+    }
+    if (process.env[key] === void 0) {
+      process.env[key] = value;
+    }
+  }
+}
+var init_dotenv_local = __esm({
+  "src/lib/dotenv-local.ts"() {
+  }
+});
+
+// src/lib/install-target.ts
+function keyDisplayPrefix(apiKey) {
+  if (!apiKey.startsWith(KEY_SCHEME)) return null;
+  const prefix = apiKey.slice(KEY_SCHEME.length, KEY_SCHEME.length + KEY_PREFIX_CHARS);
+  return prefix.length === KEY_PREFIX_CHARS ? prefix : null;
+}
+async function keyBelongsToInstall(apiKey, installationId, options, now = /* @__PURE__ */ new Date()) {
+  const prefix = keyDisplayPrefix(apiKey);
+  if (prefix === null) return false;
+  const { api_keys } = await listApiKeys(installationId, options);
+  return api_keys.some(
+    (k) => k.installation_id === installationId && k.key_prefix === prefix && (k.status === void 0 || k.status === "active") && k.revoked_at === null && (k.expires_at === null || new Date(k.expires_at) > now)
+  );
+}
+function formatInstallTarget(id, detail) {
+  return detail ? `\u2192 install #${id} (${detail})` : `\u2192 install #${id}`;
+}
+async function nameKeyTarget(args) {
+  const { apiKey, keySource, entry, cfg, apiUrl, install } = args;
+  const request = cfg ? { baseUrl: apiUrl, auth: { token: cfg.token }, signal: AbortSignal.timeout(LOOKUP_TIMEOUT_MS) } : null;
+  if (install === void 0) {
+    if (keySource !== "cached" || !entry) {
+      info(
+        `\u2192 install not checked: ${code("DASHWISE_API_KEY")} comes from ${keySource === "environment" ? "the environment" : code(".env.local")}. Pass ${code("--install <id>")} to name its target and refuse a mismatch.`
+      );
+      return 0;
+    }
+    if (!request || entry.workspaceId === void 0) {
+      info(formatInstallTarget(entry.installationId, "the cached dev install"));
+      return 0;
+    }
+    try {
+      const workspaces = await apiRequest("GET", "/api/workspaces", void 0, request);
+      const ws = workspaces.find((w) => w.id === entry.workspaceId);
+      info(formatInstallTarget(entry.installationId, `${ws ? ws.slug : `workspace #${entry.workspaceId}`}, local`));
+    } catch {
+      info(formatInstallTarget(entry.installationId));
+    }
+    return 0;
+  }
+  const source = keySource === "cached" ? "the cached key" : `${code("DASHWISE_API_KEY")} (from ${keySource === "environment" ? "the environment" : code(".env.local")})`;
+  if (!request) {
+    fail(
+      `${code("--install")} looks the install up with your CLI login, and there is none. Run ${code("dashwise login")} first. Nothing was run.`
+    );
+    return 1;
+  }
+  let belongs;
+  try {
+    belongs = await keyBelongsToInstall(apiKey, install, request);
+  } catch (err) {
+    fail(
+      `Could not read the keys of install #${install} to confirm ${source} (${describe(err)}). Refusing to run against an unconfirmed install. Nothing was run.`
+    );
+    return 1;
+  }
+  const cachedDev = entry?.installationId === install ? "the cached dev install, " : "";
+  if (!belongs) {
+    const other = entry && entry.installationId !== install && entry.apiKey === apiKey ? ` It is the cached key of install #${entry.installationId}.` : "";
+    fail(`${source} is not a live key of install #${install}.${other} Nothing was run.`);
+    info(
+      `Use a key of install #${install} (mint one with ${code(`dashwise api-keys create <name> --install ${install}`)}), or drop ${code("--install")} to run against the key's own install.`
+    );
+    return 1;
+  }
+  info(formatInstallTarget(install, `${cachedDev}key checked`));
+  return 0;
+}
+function describe(err) {
+  if (err instanceof ApiError) return `${err.code || err.status} ${err.message}`;
+  return err.message;
+}
+var KEY_PREFIX_CHARS, KEY_SCHEME, LOOKUP_TIMEOUT_MS;
+var init_install_target = __esm({
+  "src/lib/install-target.ts"() {
+    init_api_client();
+    init_output();
+    KEY_PREFIX_CHARS = 8;
+    KEY_SCHEME = "dwk_";
+    LOOKUP_TIMEOUT_MS = 1500;
+  }
+});
+
+// src/commands/run.ts
+var run_exports = {};
+__export(run_exports, {
+  runCommand: () => runCommand
+});
+async function runCommand(cmdArgs, options) {
+  if (!cmdArgs || cmdArgs.length === 0) {
+    fail(
+      `Usage: ${code("dashwise run -- <command\u2026>")} (e.g. ${code("dashwise run -- node seed.mjs")})`
+    );
+    return 1;
+  }
+  if (options.install !== void 0 && (!Number.isInteger(options.install) || options.install <= 0)) {
+    fail(`--install expects a positive integer installation id (got "${options.install}").`);
+    return 1;
+  }
+  const projectRoot = resolve(options.dir ?? process.cwd());
+  let manifestSlug;
+  try {
+    manifestSlug = readManifestOrThrow(projectRoot).module?.slug;
+  } catch (err) {
+    fail(err.message);
+    return 1;
+  }
+  if (!manifestSlug) {
     fail(`module.json has no ${code("module.slug")} \u2014 the manifest is malformed.`);
     return 1;
   }
@@ -14530,48 +14947,58 @@ __export(push_exports, {
   schemaPushCommand: () => schemaPushCommand
 });
 async function schemaPushCommand(options) {
+  const report = (err) => reportRefusal(err, {}, { ...options, stderr: true, action: "Schema push" });
+  const contextError = (message) => report(
+    new ApiError(
+      0,
+      {
+        code: "VALIDATION_ERROR",
+        message,
+        context: { reason: "module_context_required" }
+      },
+      message
+    )
+  );
   const projectRoot = resolve(options.dir ?? process.cwd());
   let manifest;
   try {
     manifest = readManifestOrThrow(projectRoot);
   } catch (err) {
-    fail(err.message);
-    return 1;
+    return contextError(err.message);
   }
   const slug = manifest.module?.slug;
   if (!slug) {
-    fail(`module.json has no ${code("module.slug")} \u2014 the manifest is malformed.`);
-    return 1;
+    return contextError("module.json has no module.slug.");
   }
   const cfg = readConfig();
   if (!cfg) {
-    fail(`Not logged in. Run ${code("dashwise login")} first.`);
-    return 1;
+    return report(
+      new ApiError(401, { code: "UNAUTHENTICATED", message: "Not logged in." }, "Not logged in.")
+    );
   }
   const auth = { baseUrl: resolveApiUrl(), auth: { token: cfg.token } };
   let moduleId;
   try {
     moduleId = (await getModuleBySlug(slug, auth)).id;
   } catch (err) {
-    if (err instanceof ApiError && err.status === 404) {
-      fail(
-        `Module ${code(slug)} isn't registered on the backend yet. Run ${code("dashwise init")} (or ${code("dashwise module register")}) first.`
-      );
-      return 1;
-    }
-    fail(`Could not resolve module ${code(slug)}: ${err.message}`);
-    return 1;
+    return reportRefusal(
+      err,
+      { module: slug },
+      { ...options, stderr: true, action: "Resolve module" }
+    );
   }
   const entry = readModuleEntry(slug);
   const dwkAuth = entry?.apiKey ? { baseUrl: resolveApiUrl(), auth: { token: entry.apiKey } } : null;
   let remote = null;
   let previewUnavailableReason = null;
+  let previewError = null;
   if (!dwkAuth) {
-    previewUnavailableReason = `no dev-install ${code("dwk_")} key is cached for ${code(slug)} in auth.json`;
+    previewUnavailableReason = `no dev-install dwk_ key is cached for ${slug} in auth.json`;
   } else {
     try {
       remote = (await getInstallationSchema(dwkAuth)).manifest;
     } catch (err) {
+      previewError = err;
       const detail = err instanceof ApiError ? `${err.code} ${err.status}: ${err.message}` : err.message;
       previewUnavailableReason = `reading the dev-install manifest failed (${detail}) \u2014 the cached key may be expired or revoked`;
     }
@@ -14611,15 +15038,32 @@ async function schemaPushCommand(options) {
       }
     }
   } else {
-    warn(
-      `Cannot preview what this push would change: ${previewUnavailableReason}.
+    if (!options.json) {
+      warn(
+        `Cannot preview what this push would change: ${previewUnavailableReason}.
   Without the preview there is no way to know whether the push REMOVES tables/fields (live DDL on the dev install).`
-    );
+      );
+    }
     if (!options.yes) {
-      fail(
-        `Refusing to push without the destructive-change preview. Re-run with ${code("--yes")} to push anyway (the backend still validates the apply).`
+      if (previewError instanceof ApiError && [401, 403, 404].includes(previewError.status)) {
+        return reportRefusal(
+          previewError,
+          { module: slug },
+          { ...options, stderr: true, action: "Schema preview", moduleKey: "saved" }
+        );
+      }
+      const message = `Refusing to push without the destructive-change preview (${previewUnavailableReason}). Re-run with --yes to push anyway (the backend still validates the apply).`;
+      return report(
+        new ApiError(
+          0,
+          {
+            code: "PREVIEW_UNAVAILABLE",
+            message,
+            context: { reason: dwkAuth ? "preview_read_failed" : "module_key_missing" }
+          },
+          message
+        )
       );
-      return 1;
     }
     info(
       dim(
@@ -14636,7 +15080,7 @@ async function schemaPushCommand(options) {
       auth
     );
   } catch (err) {
-    return surfaceSchemaPushError(err, slug);
+    return surfaceSchemaPushError(err, slug, options.json);
   }
   printApplySummary(applied);
   for (const w of referenceFieldWarnings(manifest)) warn(w.message);
@@ -14713,21 +15157,23 @@ function strProp(v, key) {
   }
   return void 0;
 }
-function surfaceSchemaPushError(err, slug) {
+function surfaceSchemaPushError(err, slug, json) {
+  if (json || !(err instanceof ApiError) || refusalHint(err.code, err.context, { module: slug }) || err.status === 401) {
+    return reportRefusal(err, { module: slug }, { json, stderr: true, action: "Schema push" });
+  }
+  process.stderr.write(
+    `(${err.code})${err.context ? ` context=${JSON.stringify(err.context)}` : ""}
+`
+  );
   if (err instanceof ApiError) {
     switch (err.code) {
       case "MANIFEST_INVALID":
         fail(`Manifest rejected by the backend validator: ${err.message}`);
         for (const issue of extractIssues2(err.context)) {
-          out(`    ${dim("-")} ${issue}`);
+          process.stderr.write(`    ${dim("-")} ${issue}
+`);
         }
         return 1;
-      case "DRAFT_INSTALLATION_MISSING":
-        fail(
-          `Module ${code(slug)} has no dev (local/sandbox) install in its owner workspace \u2014 production installs have NO draft plane, so there is nothing to push onto.
-  This happens after ${code("dashwise module install --replace-dev-install")}. Schema changes now ship as published versions: edit module.json, ${code("dashwise module publish --bump <patch|minor|major>")}, then ${code("dashwise module install")} to upgrade.`
-        );
-        return 1;
       case "UNIQUE_INDEX_BACKFILL_CONFLICT":
         fail(
           `Cannot create a UNIQUE index \u2014 existing live rows already violate it: ${err.message}
@@ -14748,14 +15194,15 @@ function surfaceSchemaPushError(err, slug) {
       case "FORBIDDEN":
       case "NOT_WORKSPACE_MEMBER":
         fail(
-          `Not authorized: pushing a draft manifest requires membership of the module's owner workspace.`
+          `Not authorized: pushing a draft manifest requires membership of the module's owner company.`
         );
         return 1;
       default:
         if (err.status === 400) {
           fail(`Manifest rejected: ${err.message}`);
           for (const issue of extractIssues2(err.context)) {
-            out(`    ${dim("-")} ${issue}`);
+            process.stderr.write(`    ${dim("-")} ${issue}
+`);
           }
           return 1;
         }
@@ -14787,6 +15234,7 @@ var init_push = __esm({
     init_config();
     init_manifest_io();
     init_manifest_merge();
+    init_permission_hint();
     init_output();
     init_manifest_reference_lint();
   }
@@ -15963,29 +16411,11 @@ async function runDoctorChecks(dir, deps) {
   return checks;
 }
 function targetCheck(apiUrl) {
-  const source = process.env.DASHWISE_API_URL?.trim() ? "from DASHWISE_API_URL" : "from your saved login";
-  if (sameOrigin(apiUrl, KNOWN_API_URLS.prod)) {
-    return {
-      id: "target",
-      label: "Target",
-      status: "warn",
-      detail: `PRODUCTION (${apiUrl}, ${source}). Commands here change real company data.`,
-      fix: `To build against dev, run ${code(`dashwise login --api-url ${KNOWN_API_URLS.dev}`)} or set ${code(`DASHWISE_API_URL=${KNOWN_API_URLS.dev}`)}.`
-    };
-  }
-  if (sameOrigin(apiUrl, KNOWN_API_URLS.dev)) {
-    return {
-      id: "target",
-      label: "Target",
-      status: "ok",
-      detail: `dev (${apiUrl}, ${source})`
-    };
-  }
   return {
     id: "target",
     label: "Target",
     status: "ok",
-    detail: `custom (${apiUrl}, ${source})`
+    detail: apiUrl
   };
 }
 async function connectionOnly(apiUrl) {
@@ -16166,13 +16596,6 @@ function sameRepo(a, b) {
   const ka = repoKey(a);
   return ka !== null && ka === repoKey(b);
 }
-function sameOrigin(a, b) {
-  try {
-    return new URL(a).origin === new URL(b).origin;
-  } catch {
-    return false;
-  }
-}
 function safeReadConfig2() {
   try {
     return readConfig();
@@ -17937,7 +18360,9 @@ function convertModule(opts) {
     "app/layout.jsx",
     "src/app/layout.tsx"
   ].find((f) => existsSync(join(dir, f)));
+  let layoutCreated = false;
   if (!layoutFile) {
+    layoutCreated = true;
     writeIfMissing("app/layout.tsx", appLayoutCustomTsx(sopts));
   } else if (!readFileSync(join(dir, layoutFile), "utf-8").includes("AuthProvider")) {
     warnings.push(
@@ -17953,10 +18378,13 @@ function convertModule(opts) {
       `${nextConfigFile}: add \`output: 'standalone'\` \u2014 required for the module runtime bundle.`
     );
   }
-  if (!pkg.dependencies?.["@dashai/sdk"]) {
-    pkg.dependencies = { ...pkg.dependencies ?? {}, "@dashai/sdk": SDK_DEP_RANGE };
+  const addDeps = {};
+  if (!pkg.dependencies?.["@dashai/sdk"]) addDeps["@dashai/sdk"] = SDK_DEP_RANGE;
+  if (layoutCreated && !pkg.dependencies?.geist) addDeps.geist = GEIST_DEP_RANGE;
+  if (Object.keys(addDeps).length > 0) {
+    pkg.dependencies = { ...pkg.dependencies ?? {}, ...addDeps };
     writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf-8");
-    created.push("package.json (added @dashai/sdk)");
+    created.push(`package.json (added ${Object.keys(addDeps).join(", ")})`);
   }
   const outboundApis = scanOutboundHosts(dir);
   const runtimeBlockAdded = normalizeManifest(join(dir, "module.json"), {
@@ -18780,13 +19208,13 @@ init_api_client();
 function redactedConsumer(redacted) {
   switch (redacted) {
     case "private_copy":
-      return "someone's private copy";
+      return "someone's private installation";
     case "other_team_copy":
-      return "another team's copy";
+      return "another team's installation";
     case "development_copy":
-      return "a development copy you cannot see";
+      return "a development installation you cannot see";
     default:
-      return "a copy you cannot see";
+      return "an installation you cannot see";
   }
 }
 var WIDEN_WORDS = {
@@ -18804,7 +19232,7 @@ var WIDEN_WORDS = {
 function describeWidening(widening) {
   return widening.map((w) => WIDEN_WORDS[w] ?? w).join(", ");
 }
-async function getUpgradePreview(installationId, version, options = {}) {
+async function getUpgradePreview2(installationId, version, options = {}) {
   return apiRequest(
     "GET",
     `/api/installations/${installationId}/upgrade-preview?version=${encodeURIComponent(version)}`,
@@ -18871,6 +19299,9 @@ function selectInstallsByKind(installs, moduleId) {
 function isRealRuntimeUrl(url) {
   return !!url && /^https:\/\//i.test(url);
 }
+function isRuntimeProvisioned(row) {
+  return row.runtime_https ?? isRealRuntimeUrl(row.runtime_url);
+}
 function isDraftVersion(v) {
   return !v || v.includes("draft");
 }
@@ -18912,8 +19343,73 @@ async function resolveWorkspaceWithFallback(opts) {
 }
 
 // src/commands/module/install.ts
-init_output();
-init_connect_status();
+init_output();
+init_connect_status();
+
+// src/lib/upgrade-plan.ts
+init_api_client();
+init_output();
+function upgradePlanOf(err) {
+  if (!(err instanceof ApiError) || err.code !== "UPGRADE_CONFIRM_REQUIRED") {
+    return null;
+  }
+  const body = err.body;
+  if (!body || typeof body.drift_hash !== "string") return null;
+  return {
+    ...body,
+    drift_hash: body.drift_hash,
+    breaks_consumers: Array.isArray(body.breaks_consumers) ? body.breaks_consumers : []
+  };
+}
+var REDACTED_LABEL = {
+  private_copy: "someone's private installation",
+  other_team_copy: "another team's installation",
+  development_copy: "a development installation"
+};
+function consumerLabel(c2) {
+  if (c2.redacted) return REDACTED_LABEL[c2.redacted] ?? "an installation you cannot see";
+  const name = c2.module_name ?? c2.module_slug ?? "a module";
+  const slug = c2.module_slug && c2.module_name ? ` (${c2.module_slug})` : "";
+  const id = c2.installation_id != null ? ` #${c2.installation_id}` : "";
+  return `${name}${slug}${id}`;
+}
+var count2 = (n, noun) => n == null ? "" : `, ${n} ${noun}${n === 1 ? "" : "s"}`;
+function renderUpgradePlan(slug, plan) {
+  const n = plan.breaks_consumers.length;
+  const to = plan.to_version ? ` to ${code(`v${plan.to_version}`)}` : "";
+  if (n === 0) {
+    info(`Upgrading ${code(slug)}${to} no longer disconnects any module that reads from it.`);
+  } else {
+    warn(
+      `Upgrading ${code(slug)}${to} breaks ${n} module${n === 1 ? "" : "s"} that read from it. ${n === 1 ? "It is" : "They are"} disconnected until updated:`
+    );
+    for (const c2 of plan.breaks_consumers) info(`  - ${consumerLabel(c2)}`);
+  }
+  const d = plan.drift?.details;
+  const lines = [
+    ...(d?.tables_to_remove ?? []).map(
+      (t) => `remove table ${code(t.name)}${count2(t.rows, "row")}`
+    ),
+    ...(d?.fields_to_remove ?? []).map(
+      (f) => `remove field ${code(`${f.table}.${f.name}`)}${count2(f.values, "value")}`
+    ),
+    ...(d?.fields_to_retype ?? []).map(
+      (f) => `change field ${code(`${f.table}.${f.name}`)} from ${f.from} to ${f.to}${count2(f.values, "value")}`
+    )
+  ];
+  if (lines.length > 0) {
+    info("It also changes this installation:");
+    for (const line of lines) info(`  - ${line}`);
+  }
+}
+function planLosesData(plan) {
+  const drift = plan.drift;
+  if (!drift) return true;
+  const details = drift.details;
+  return (details?.tables_to_remove?.some((t) => t.rows !== 0) ?? (drift.tables_to_remove?.length ?? 0) > 0) || (details?.fields_to_remove?.some((f) => f.values !== 0) ?? (drift.fields_to_remove?.length ?? 0) > 0) || (details?.fields_to_retype?.some((f) => f.values !== 0) ?? (drift.fields_to_retype?.length ?? 0) > 0);
+}
+
+// src/commands/module/install.ts
 async function moduleInstallCommand(slugArg, options) {
   const slug = resolveSlug(slugArg, options.dir);
   if (!slug) {
@@ -18971,14 +19467,27 @@ async function moduleInstallCommand(slugArg, options) {
     const installs = await listWorkspaceInstallations(workspace2.id, auth);
     const byKind = selectInstallsByKind(installs, mod.id);
     const production = byKind.all.filter((row2) => !isDevInstallKind(row2.kind));
-    if (production.length > 1) {
-      fail(
-        "Several production installations exist for this module in this company. Select the installation to update in the app. Nothing was changed."
-      );
-      return 1;
-    }
-    existing = production[0];
     devInstall = byKind.dev;
+    if (options.installation !== void 0) {
+      existing = production.find((row2) => row2.id === options.installation);
+      if (!existing) {
+        fail(
+          `Installation #${options.installation} is not a production installation of ${code(mod.slug)} you can see in this company. Nothing was changed.`
+        );
+        listInstallationCandidates(production);
+        return 1;
+      }
+    } else {
+      const candidates = production.filter((row2) => row2.held !== true);
+      if (candidates.length > 1 || candidates.length === 0 && production.length > 0) {
+        fail(
+          candidates.length > 1 ? `Several production installations of ${code(mod.slug)} exist in this company. Choose one with ${code("--installation <id>")}. Nothing was changed.` : `The only production installations of ${code(mod.slug)} here are held. To update one, choose it with ${code("--installation <id>")}. Nothing was changed.`
+        );
+        listInstallationCandidates(production);
+        return 1;
+      }
+      existing = candidates[0];
+    }
   } catch (err) {
     fail(
       `Could not read workspace installations: ${err.message}`
@@ -19025,7 +19534,7 @@ async function moduleInstallCommand(slugArg, options) {
       );
     } else {
       info(
-        `Existing production install #${existing.id}${installedVersion2 ? ` at ${code(`v${installedVersion2}`)}` : ""} \u2014 this will upgrade it to ${code(`v${targetVersion}`)}.`
+        `Existing production install ${describeInstallation(existing)}${installedVersion2 ? ` at ${code(`v${installedVersion2}`)}` : ""} \u2014 this will upgrade it to ${code(`v${targetVersion}`)}.`
       );
     }
   }
@@ -19033,15 +19542,19 @@ async function moduleInstallCommand(slugArg, options) {
   let lossy = false;
   let lossAccepted = false;
   if (existing) {
-    const rerun = rerunLine(mod.slug, workspace2.slug, targetVersion, options, devInstallToReplace !== void 0);
+    const rerun = rerunLine(mod.slug, workspace2.slug, targetVersion, existing.id, options, devInstallToReplace !== void 0);
     const previewed = await previewUpgrade(existing.id, targetVersion, options, auth, rerun, devInstallToReplace?.id);
     if (typeof previewed === "number") return previewed;
     preview = previewed.preview;
     lossy = previewed.lossy;
     lossAccepted = previewed.accepted;
   }
+  if (options.force && (preview?.breaks_consumers?.length ?? 0) > 0 && !options.yes && (!process.stdout.isTTY || !process.stdin.isTTY || options.json)) {
+    fail(`Nothing was changed. Re-run with ${code("--force --yes")} to confirm the listed disconnections, or run in a terminal to be asked.`);
+    return 1;
+  }
   const askForLoss = lossy && !lossAccepted;
-  if (askForLoss || !options.yes && process.stdout.isTTY && !confirmedViaPicker) {
+  if (askForLoss || !options.yes && process.stdout.isTTY && process.stdin.isTTY && !confirmedViaPicker) {
     const lossClause = lossy ? " It moves the data listed above to the Trash or converts it." : "";
     const message = devInstallToReplace ? isUpgrade ? `Destroy the dev install (revokes local-dev credentials) and upgrade ${code(mod.slug)} to ${code(`v${targetVersion}`)} in ${code(workspace2.slug)}?${lossClause}` : `Replace the dev install (revokes local-dev credentials) and install ${code(mod.slug)} ${code(`v${targetVersion}`)} into ${code(workspace2.slug)} as production?` : `${isUpgrade ? "Upgrade" : "Install"} ${code(mod.slug)} ${code(`v${targetVersion}`)} into workspace ${code(workspace2.slug)}?${lossClause}`;
     const answer = await select({
@@ -19068,26 +19581,63 @@ async function moduleInstallCommand(slugArg, options) {
   }
   info("Provisioning the runtime \u2014 this can take a minute\u2026");
   let result;
-  try {
-    result = await installModule(
-      mod.id,
-      {
-        workspaceId: workspace2.id,
-        version: targetVersion,
-        ...existing ? { installation_id: existing.id } : {},
-        ...options.force !== void 0 ? { force: options.force } : {},
-        // P5-08: confirms exactly the delta that was shown (409 DRIFT_CHANGED otherwise).
-        ...preview ? { drift_hash: preview.drift_hash } : {}
-      },
-      auth
-    );
-  } catch (err) {
-    return surfaceInstallError(err, mod.slug, workspace2.slug, devInstallReplaced);
+  let confirmedPlan;
+  for (let round = 0; ; round++) {
+    try {
+      result = await installModule(
+        mod.id,
+        {
+          workspaceId: workspace2.id,
+          // L420(3): always the resolved version and, for an upgrade, the
+          // announced installation; after a confirm, the plan's version.
+          version: confirmedPlan?.to_version ?? targetVersion,
+          ...existing ? { installation_id: existing.id } : {},
+          ...options.force !== void 0 ? { force: options.force } : {},
+          ...confirmedPlan ? { drift_hash: confirmedPlan.drift_hash } : preview ? { drift_hash: preview.drift_hash } : {}
+        },
+        auth
+      );
+      break;
+    } catch (err) {
+      let plan = null;
+      if (confirmedPlan && err instanceof ApiError && err.code === "DRIFT_CHANGED" && round < MAX_PLAN_ROUNDS) {
+        warn(
+          "What this upgrade changes has changed since it was shown. Showing the new plan."
+        );
+        plan = await refetchUpgradePlan(confirmedPlan, auth);
+        if (!plan) {
+          return surfaceInstallError(err, mod.slug, workspace2.slug, devInstallReplaced);
+        }
+      } else {
+        plan = options.force && !confirmedPlan ? upgradePlanOf(err) : null;
+        if (!plan || round >= MAX_PLAN_ROUNDS) {
+          return surfaceInstallError(err, mod.slug, workspace2.slug, devInstallReplaced);
+        }
+      }
+      if (!existing || plan.installation_id !== existing.id || plan.to_version !== targetVersion || !plan.drift_hash) {
+        fail("The upgrade plan does not match the announced installation and version. Nothing was changed; check the installation in the app.");
+        if (devInstallReplaced) printDevInstallAftermath(mod.slug, workspace2.slug);
+        return 1;
+      }
+      const confirmed = await confirmUpgradePlan(
+        mod.slug,
+        plan,
+        options,
+        preview?.drift_hash,
+        rerunLine(mod.slug, workspace2.slug, targetVersion, existing.id, options, devInstallToReplace !== void 0)
+      );
+      if (confirmed !== 0) {
+        if (devInstallReplaced) printDevInstallAftermath(mod.slug, workspace2.slug);
+        return confirmed;
+      }
+      confirmedPlan = plan;
+    }
   }
   if (existing && (isInstallGated(result) || result.installation.id !== existing.id)) {
     fail(
       `The backend did not confirm an in-place update of installation #${existing.id}. Check its state in the app before retrying; no fallback install will be attempted.`
     );
+    if (devInstallReplaced) printDevInstallAftermath(mod.slug, workspace2.slug);
     return 1;
   }
   if (isInstallGated(result)) {
@@ -19117,7 +19667,7 @@ async function moduleInstallCommand(slugArg, options) {
   }
   const publicUrl = row?.public_url ?? null;
   const installedVersion = row?.module_version?.version ?? targetVersion;
-  const runtimeProvisioned = isRealRuntimeUrl(row?.runtime_url);
+  const runtimeProvisioned = row ? isRuntimeProvisioned(row) : false;
   const readiness = await fetchUsesReadiness(result.installation.id, auth);
   const setupPending = readiness?.setupPending ?? false;
   if (options.json) {
@@ -19130,8 +19680,8 @@ async function moduleInstallCommand(slugArg, options) {
         public_url: publicUrl,
         verified,
         // P5-08: the confirmed preview; `null` for a fresh install (nothing to preview).
-        drift_hash: preview?.drift_hash ?? null,
-        data_loss: preview ? lossy : null,
+        drift_hash: confirmedPlan?.drift_hash ?? preview?.drift_hash ?? null,
+        data_loss: confirmedPlan ? planLosesData(confirmedPlan) : preview ? lossy : null,
         // `null` when the binding surface was unreachable; `[]` when the
         // module declares no slots. The two are not the same thing.
         uses: readiness === null ? null : usesInstallJson(readiness),
@@ -19230,7 +19780,7 @@ async function resolveDevInstallCollision(existing, slug, workspaceSlug, options
     info(explanation);
     return "replace";
   }
-  if (process.stdout.isTTY && !options.yes) {
+  if (process.stdout.isTTY && process.stdin.isTTY && !options.yes) {
     info(explanation);
     const answer = await select({
       message: `How should ${code(slug)} be installed into ${code(workspaceSlug)}?`,
@@ -19291,6 +19841,62 @@ async function replaceDevInstall(existing, slug, auth) {
   }
   return 0;
 }
+var MAX_PLAN_ROUNDS = 3;
+async function refetchUpgradePlan(previous, auth) {
+  if (previous.installation_id === void 0 || previous.to_version === void 0) {
+    return null;
+  }
+  try {
+    const preview = await getUpgradePreview(
+      previous.installation_id,
+      previous.to_version,
+      auth
+    );
+    return typeof preview.drift_hash === "string" ? {
+      ...preview,
+      breaks_consumers: Array.isArray(preview.breaks_consumers) ? preview.breaks_consumers : []
+    } : null;
+  } catch {
+    return null;
+  }
+}
+async function confirmUpgradePlan(slug, plan, options, acceptedPreviewHash, rerun) {
+  renderUpgradePlan(slug, plan);
+  const losesData = planLosesData(plan);
+  const lossAccepted = plan.drift_hash === acceptedPreviewHash || options.acceptDataLoss === plan.drift_hash;
+  if (losesData && !lossAccepted && (agentSessionMarker() || !process.stdout.isTTY || !process.stdin.isTTY || options.json)) {
+    fail("This upgrade loses data. --yes does not accept data loss. Nothing was changed.");
+    info(`To accept exactly the loss listed above, a person re-runs:
+  ${rerun(plan.drift_hash)}`);
+    return 1;
+  }
+  if (options.yes && (!losesData || lossAccepted)) {
+    info(`${code("--yes")}: confirming this plan.`);
+    return 0;
+  }
+  if (!process.stdout.isTTY || !process.stdin.isTTY || options.json) {
+    fail(
+      `Nothing was changed. Re-run with ${code("--force --yes")} to confirm this plan, or run it in a terminal to be asked.`
+    );
+    return 1;
+  }
+  const answer = await select({
+    message: losesData ? `Upgrade ${code(slug)}, lose the data listed above and disconnect the listed modules?` : plan.breaks_consumers.length === 0 ? `Upgrade ${code(slug)} with these changes?` : `Disconnect ${plan.breaks_consumers.length === 1 ? "this module" : "these modules"} and upgrade ${code(slug)}?`,
+    options: [
+      {
+        value: "go",
+        label: losesData ? "Yes, upgrade and lose the data listed above" : plan.breaks_consumers.length === 0 ? "Yes, upgrade" : "Yes, upgrade and disconnect them"
+      },
+      { value: "cancel", label: "No, abort" }
+    ],
+    initialValue: "cancel"
+  });
+  if (isCancel(answer) || answer === "cancel") {
+    fail("Aborted. Nothing was changed.");
+    return 130;
+  }
+  return 0;
+}
 function surfaceInstallError(err, slug, workspaceSlug, devInstallReplaced) {
   if (err instanceof ApiError) {
     switch (err.code) {
@@ -19315,8 +19921,8 @@ function surfaceInstallError(err, slug, workspaceSlug, devInstallReplaced) {
         break;
       case "UPGRADE_BREAKS_CONSUMERS":
         fail(
-          `Upgrading ${code(slug)} would break modules that consume its current schema.
-  Review the breaking changes, then re-run with ${code("--force")} to upgrade anyway.`
+          `Upgrading ${code(slug)} would break modules that read from it.
+  Re-run with ${code("--force")} to see which ones and confirm the upgrade.`
         );
         break;
       case "FORBIDDEN":
@@ -19362,10 +19968,26 @@ function usesInstallJson(readiness) {
     }))
   };
 }
+var AUDIENCE = {
+  company: "company",
+  teams: "Team Spaces",
+  people: "named people"
+};
+function describeInstallation(row) {
+  const details = [
+    row.reach?.kind ? AUDIENCE[row.reach.kind] ?? row.reach.kind : null,
+    row.held ? "held" : null,
+    row.public_url
+  ].filter((part) => Boolean(part));
+  return `#${row.id}${row.name ? ` "${row.name}"` : ""}${details.length ? ` (${details.join(", ")})` : ""}`;
+}
+function listInstallationCandidates(rows) {
+  for (const row of rows) info(`  ${describeInstallation(row)}`);
+}
 async function previewUpgrade(installationId, targetVersion, options, auth, rerun, devInstallToReplaceId) {
   let preview;
   try {
-    preview = await getUpgradePreview(installationId, targetVersion, auth);
+    preview = await getUpgradePreview2(installationId, targetVersion, auth);
   } catch (err) {
     const why = err instanceof ApiError ? `${err.code || err.status} ${err.message}` : err.message;
     const checkNote = options.acceptDataLoss !== void 0 ? `, so ${code("--accept-data-loss")} cannot be checked` : "";
@@ -19389,7 +20011,7 @@ async function previewUpgrade(installationId, targetVersion, options, auth, reru
   const broken = preview.breaks_consumers ?? [];
   if (broken.length > 0) {
     const names = broken.map(
-      (c2) => c2.module_slug ? `${c2.module_slug}${c2.installation_id ? ` #${c2.installation_id}` : ""}` : redactedConsumer(c2.redacted)
+      (c2) => !c2.redacted && c2.module_slug ? `${c2.module_slug}${c2.installation_id ? ` #${c2.installation_id}` : ""}` : redactedConsumer(c2.redacted)
     );
     warn(`  Breaks ${broken.length} module${broken.length === 1 ? "" : "s"} that read${broken.length === 1 ? "s" : ""} this one: ${names.join(", ")}`);
   }
@@ -19399,7 +20021,7 @@ async function previewUpgrade(installationId, targetVersion, options, auth, reru
   }
   if (options.acceptDataLoss !== void 0 && options.acceptDataLoss !== preview.drift_hash) {
     fail(
-      `${code("--accept-data-loss")} does not match this upgrade's preview: the copy or the release changed since that hash was printed. Nothing was changed.`
+      `${code("--accept-data-loss")} does not match this upgrade's preview: the installation or the release changed since that hash was printed. Nothing was changed.`
     );
     info(`To accept the change listed above, a person re-runs:
   ${rerun(preview.drift_hash)}`);
@@ -19409,7 +20031,7 @@ async function previewUpgrade(installationId, targetVersion, options, auth, reru
   if (lossy && !accepted) {
     const yesNote = options.yes ? ` ${code("--yes")} does not accept data loss.` : "";
     const marker = agentSessionMarker();
-    const why = marker ? `this is an agent session (${code(marker)} is set): a person decides` : !process.stdout.isTTY ? "there is no terminal to ask in" : null;
+    const why = marker ? `this is an agent session (${code(marker)} is set): a person decides` : !process.stdout.isTTY || !process.stdin.isTTY || options.json ? "there is no terminal to ask in" : null;
     if (why) {
       const alsoDev = devInstallToReplaceId !== void 0 ? ` and destroys dev install #${devInstallToReplaceId} first` : "";
       fail(`This upgrade loses the data listed above${alsoDev}, and ${why}.${yesNote} Refused. Nothing was changed.`);
@@ -19420,12 +20042,13 @@ async function previewUpgrade(installationId, targetVersion, options, auth, reru
   }
   return { preview, lossy, accepted };
 }
-function rerunLine(slug, workspaceSlug, targetVersion, options, replacingDevInstall) {
+function rerunLine(slug, workspaceSlug, targetVersion, installationId, options, replacingDevInstall) {
   return (hash) => [
     "dashwise module install",
     slug,
     `--workspace ${workspaceSlug}`,
     `--version ${targetVersion}`,
+    `--installation ${installationId}`,
     ...options.force ? ["--force"] : [],
     ...replacingDevInstall ? ["--replace-dev-install"] : [],
     `--accept-data-loss ${hash}`
@@ -20023,324 +20646,99 @@ async function modulePublishCommand(options) {
       success(`Build ${code(`#${enq.build_id}`)} queued for ${code(mod.slug)}.`);
       info(`Not waiting (${code("--no-wait")}). Re-run publish or poll the build to check.`);
       if (options.json) out(JSON.stringify(enq));
-      return 0;
-    }
-    if (!options.json) {
-      info(`Build ${code(`#${enq.build_id}`)} queued \u2014 building on the platform\u2026`);
-    }
-    return pollBuild(enq.build_id, enq.module_id, mod.slug, options);
-  }
-  const result = body;
-  if (!result) {
-    fail("Publish succeeded but the response body was empty or malformed.");
-    return 1;
-  }
-  if (options.json) {
-    out(JSON.stringify(result));
-    return 0;
-  }
-  success(`Published ${code(mod.slug)} ${code(`v${result.version}`)}`);
-  info(`Bundle: ${code(result.bundle_url)}`);
-  info(`Hash:   ${dim(result.bundle_hash)}`);
-  info(`Size:   ${formatBytes2(result.bytes_uploaded)}`);
-  if (result.warnings.length > 0) {
-    warn(`${result.warnings.length} warning${result.warnings.length === 1 ? "" : "s"}:`);
-    for (const w of result.warnings) {
-      out(`  ${dim("\u2022")} ${w}`);
-    }
-  }
-  if (process.stdout.isTTY) outro("Done.");
-  return 0;
-}
-async function pollBuild(buildId, moduleId, slug, options) {
-  const timeoutMs = (options.timeoutSec ?? 360) * 1e3;
-  const intervalMs = options.pollIntervalMs ?? 4e3;
-  const deadline = Date.now() + timeoutMs;
-  let lastStatus = "";
-  while (Date.now() < deadline) {
-    let build;
-    try {
-      build = await apiRequest(
-        "GET",
-        `/api/modules/${moduleId}/builds/${buildId}`
-      );
-    } catch {
-      await sleep(intervalMs);
-      continue;
-    }
-    if (!options.json && build.status !== lastStatus) {
-      info(`Build ${code(`#${buildId}`)}: ${build.status}`);
-      lastStatus = build.status;
-    }
-    if (build.status === "succeeded") {
-      if (options.json) {
-        out(JSON.stringify(build));
-      } else {
-        success(`Published ${code(slug)} ${code(`v${build.version ?? "?"}`)}`);
-        info(`Build:  ${dim(`#${buildId}`)}`);
-        if (process.stdout.isTTY) outro("Done.");
-      }
-      return 0;
-    }
-    if (build.status === "failed") {
-      if (options.json) {
-        out(JSON.stringify(build));
-      } else {
-        fail(
-          `Build ${code(`#${buildId}`)} failed (${build.error_code ?? "BUILD_FAILED"}): ${build.error_message ?? "(no detail)"}`
-        );
-        if (build.log_url) info(`Logs: ${code(build.log_url)}`);
-        info(`Re-run ${code("dashwise module publish")} to try again.`);
-      }
-      return 1;
-    }
-    await sleep(intervalMs);
-  }
-  warn(
-    `Still building after ${options.timeoutSec ?? 360}s \u2014 the build is likely still running. Re-run ${code("dashwise module publish")} to check, or inspect build ${code(`#${buildId}`)}.`
-  );
-  return 0;
-}
-function sleep(ms) {
-  return new Promise((r) => setTimeout(r, ms));
-}
-function formatBytes2(n) {
-  if (n < 1024) return `${n}B`;
-  if (n < 1024 * 1024) return `${(n / 1024).toFixed(1)}KB`;
-  return `${(n / 1024 / 1024).toFixed(1)}MB`;
-}
-
-// src/commands/module/release.ts
-init_api_client();
-init_config();
-init_manifest_io();
-init_output();
-
-// src/lib/permission-hint.ts
-init_api_client();
-init_output();
-var EXIT_NEEDS_GRANT = 3;
-var EXIT_TIMED_OUT = 4;
-var REBUILD_BUMP_OPERATOR_ONLY = "REBUILD_BUMP_OPERATOR_ONLY";
-var FEATURE_SUBJECTS = {
-  module_runtime_streaming: "Streaming",
-  module_rebuild: "Rebuild",
-  module_building: "Building modules",
-  module_runtime_sizing: "Memory size"
-};
-var OPTION_SUBJECTS = {
-  streaming: "Streaming",
-  memory_mb: "Memory size",
-  reapply: "Re-applying the runtime",
-  timeout: "The timeout",
-  reserved_concurrency: "Reserved concurrency",
-  log_retention: "Log retention"
-};
-var MODULE_RIGHT_CODES = /* @__PURE__ */ new Set([
-  "MODULE_CAPABILITY_DENIED",
-  "PUBLISH_REQUIRES_ADMIN",
-  "NOT_COPY_OWNER"
-]);
-function str(v) {
-  return typeof v === "string" && v.length > 0 ? v : void 0;
-}
-function num(v) {
-  return typeof v === "number" && Number.isFinite(v) ? v : void 0;
-}
-function featureFromPermission(permission) {
-  const m = permission ? /^workspace\.feature\.([a-z0-9_]+)\.use$/.exec(permission) : null;
-  return m?.[1];
-}
-function featureSubject(ctx) {
-  const feature = str(ctx.feature) ?? featureFromPermission(str(ctx.permission));
-  if (feature && FEATURE_SUBJECTS[feature]) return FEATURE_SUBJECTS[feature];
-  return str(ctx.feature_label) ?? (feature ? `"${feature}"` : void 0);
-}
-function needsAdmin(what, module, ask) {
-  const scope = module ? ` for ${module}` : "";
-  return `${what}${scope} needs a Dashwise admin. Ask your Dashwise admin to ${ask}.`;
-}
-function refusalHint(code2, context, subject = {}) {
-  const ctx = context ?? {};
-  const module = subject.module ?? str(ctx.module_slug);
-  const installationId = subject.installationId ?? num(ctx.installation_id);
-  const installLabel = installationId !== void 0 ? ` (install #${installationId})` : "";
-  const named = module ?? "this module";
-  switch (code2) {
-    case "FEATURE_DISABLED":
-    case "PERMISSION_DENIED": {
-      const what = featureSubject(ctx);
-      if (!what) {
-        return {
-          message: `You don't have permission to do this${module ? ` for ${module}` : ""}. Ask your Dashwise admin for access.`,
-          needsGrant: true
-        };
-      }
-      return { message: needsAdmin(what, module, "enable it"), needsGrant: true };
-    }
-    case "RUNTIME_OPTION_OPERATOR_ONLY": {
-      const option = str(ctx.option);
-      const what = (option && OPTION_SUBJECTS[option]) ?? (option ? `"${option}"` : "This runtime option");
-      return { message: needsAdmin(what, module, "change it"), needsGrant: true };
-    }
-    case REBUILD_BUMP_OPERATOR_ONLY: {
-      const bump = str(ctx.bump) ?? "minor";
-      return {
-        message: needsAdmin(`A rebuild with a ${bump} version bump`, module, "run it"),
-        needsGrant: true
-      };
-    }
-    case "IMAGE_TAG_EXISTS":
-      return {
-        message: `This rebuild of ${named} needs a higher version bump than patch. A rebuild with a minor version bump needs a Dashwise admin. Ask your Dashwise admin to run it.`,
-        needsGrant: true
-      };
-    case "RUNTIME_IMAGE_NOT_ELIGIBLE": {
-      const version = str(ctx.version);
-      const target = installationId !== void 0 ? ` --rollout installs:${installationId}` : "";
-      return {
-        message: `${named}${version ? ` v${version}` : ""} was built before streaming support. Rebuild it and upgrade this install first: dashwise module rebuild${module ? ` ${module}` : ""}${target}`,
-        needsGrant: false
-      };
-    }
-    case "RUNTIME_SWAP_PENDING": {
-      const version = str(ctx.version);
-      return {
-        message: `${named}${installLabel} is still finishing its update${version ? ` to v${version}` : ""}, so streaming cannot be turned on yet. Try again in a few minutes.`,
-        needsGrant: false
-      };
-    }
-    case "RUNTIME_OPTION_UNAVAILABLE": {
-      const option = str(ctx.option);
-      const what = (option && OPTION_SUBJECTS[option]) ?? "This runtime option";
-      return { message: `${what} is switched off platform-wide right now.`, needsGrant: false };
-    }
-    case "RUNTIME_CHANGE_IN_PROGRESS": {
-      const op = num(ctx.operation_id);
-      return {
-        message: `A runtime change is already being applied to ${named}${op !== void 0 ? ` (operation #${op})` : ""}. Wait for it, then check: dashwise module runtime${module ? ` ${module}` : ""}`,
-        needsGrant: false
-      };
+      return 0;
     }
-    case "BUILD_IN_PROGRESS": {
-      const buildId = num(ctx.build_id);
-      const status = str(ctx.status);
-      const which = buildId !== void 0 ? ` (#${buildId}${status ? `, ${status}` : ""})` : "";
-      return {
-        message: `A build of ${named} is already running${which}. Wait for it to finish, then run the rebuild again.`,
-        needsGrant: false
-      };
+    if (!options.json) {
+      info(`Build ${code(`#${enq.build_id}`)} queued \u2014 building on the platform\u2026`);
     }
-    case "REBUILD_SOURCE_NOT_FOUND":
-      return {
-        message: `${named} has no build from source to rebuild. Publish it first: dashwise module publish`,
-        needsGrant: false
-      };
-    case "INSTALLATION_NOT_FOUND":
-      return {
-        message: `${installationId !== void 0 ? `Installation #${installationId}` : "The installation"} was not found, or you cannot see it.`,
-        needsGrant: false
-      };
-    case "PUBLISH_RATE_LIMITED":
-    case "PUBLISH_USER_RATE_LIMITED":
-      return {
-        message: `Too many builds of ${named} in the last hour. Try again later.`,
-        needsGrant: false
-      };
-    // Install invitations (`dashwise module invites`, Südbau retro 6).
-    case "AUTHOR_ADMIN_REQUIRED":
-      return {
-        message: `Only an admin of the company that owns ${named} can manage its install invitations. Ask that company's admin.`,
-        needsGrant: true
-      };
-    case "COMPANY_ADMIN_REQUIRED":
-      return {
-        message: "Only an admin of this company can see or decline its install invitations. Ask your company's admin.",
-        needsGrant: true
-      };
-    case "MODULE_PRIVATE_SHARE_FIRST":
-      return {
-        message: `${named} is still private. Share it with your company in Dashwise first, then invite another company.`,
-        needsGrant: false
-      };
-    default:
-      if (MODULE_RIGHT_CODES.has(code2)) {
-        return {
-          message: `You can't manage ${named}${installLabel}. Ask your Dashwise admin for access.`,
-          needsGrant: true
-        };
-      }
-      return null;
+    return pollBuild(enq.build_id, enq.module_id, mod.slug, options);
   }
-}
-var ANSI = /\x1b\[[0-9;]*m/g;
-function reportCliError(message, opts) {
-  if (opts.json) {
-    out(
-      JSON.stringify({
-        error: { code: opts.code ?? "CLI_ERROR", message: message.replace(ANSI, ""), status: null, context: null },
-        hint: null,
-        needs_grant: false
-      })
-    );
-  } else {
-    fail(message);
+  const result = body;
+  if (!result) {
+    fail("Publish succeeded but the response body was empty or malformed.");
+    return 1;
   }
-  return 1;
-}
-function reportFailedOutcome(failure, hint, opts) {
-  if (opts.json) {
-    out(
-      JSON.stringify({
-        error: { code: failure.code, message: failure.message ?? null, status: null, context: null },
-        hint: hint?.message ?? null,
-        needs_grant: hint?.needsGrant ?? false,
-        ...opts.extra
-      })
-    );
-  } else {
-    fail(hint?.message ?? opts.fallback);
+  if (options.json) {
+    out(JSON.stringify(result));
+    return 0;
   }
-  return hint?.needsGrant ? EXIT_NEEDS_GRANT : 1;
-}
-function isTransientPollError(err) {
-  if (!(err instanceof ApiError)) return true;
-  return err.status === 0 || err.status === 429 || err.status >= 500;
+  success(`Published ${code(mod.slug)} ${code(`v${result.version}`)}`);
+  info(`Bundle: ${code(result.bundle_url)}`);
+  info(`Hash:   ${dim(result.bundle_hash)}`);
+  info(`Size:   ${formatBytes2(result.bytes_uploaded)}`);
+  if (result.warnings.length > 0) {
+    warn(`${result.warnings.length} warning${result.warnings.length === 1 ? "" : "s"}:`);
+    for (const w of result.warnings) {
+      out(`  ${dim("\u2022")} ${w}`);
+    }
+  }
+  if (process.stdout.isTTY) outro("Done.");
+  return 0;
 }
-function reportRefusal(err, subject, opts) {
-  if (!(err instanceof ApiError)) {
-    const message = err?.message ?? String(err);
-    if (opts.json) {
-      out(
-        JSON.stringify({
-          error: { code: "CLI_ERROR", message: message.replace(ANSI, ""), status: null, context: null },
-          hint: null,
-          needs_grant: false
-        })
+async function pollBuild(buildId, moduleId, slug, options) {
+  const timeoutMs = (options.timeoutSec ?? 360) * 1e3;
+  const intervalMs = options.pollIntervalMs ?? 4e3;
+  const deadline = Date.now() + timeoutMs;
+  let lastStatus = "";
+  while (Date.now() < deadline) {
+    let build;
+    try {
+      build = await apiRequest(
+        "GET",
+        `/api/modules/${moduleId}/builds/${buildId}`
       );
-    } else {
-      fail(`${opts.action} failed: ${message}`);
+    } catch {
+      await sleep(intervalMs);
+      continue;
     }
-    return 1;
-  }
-  const hint = err.status === 401 ? { message: "Your login has expired. Run: dashwise login", needsGrant: false } : refusalHint(err.code, err.context, subject);
-  if (opts.json) {
-    out(
-      JSON.stringify({
-        error: { code: err.code, message: err.message, status: err.status, context: err.context ?? null },
-        hint: hint?.message ?? null,
-        needs_grant: hint?.needsGrant ?? false
-      })
-    );
-  } else if (hint) {
-    fail(hint.message);
-  } else {
-    fail(`${opts.action} failed (${err.code}): ${err.message}`);
+    if (!options.json && build.status !== lastStatus) {
+      info(`Build ${code(`#${buildId}`)}: ${build.status}`);
+      lastStatus = build.status;
+    }
+    if (build.status === "succeeded") {
+      if (options.json) {
+        out(JSON.stringify(build));
+      } else {
+        success(`Published ${code(slug)} ${code(`v${build.version ?? "?"}`)}`);
+        info(`Build:  ${dim(`#${buildId}`)}`);
+        if (process.stdout.isTTY) outro("Done.");
+      }
+      return 0;
+    }
+    if (build.status === "failed") {
+      if (options.json) {
+        out(JSON.stringify(build));
+      } else {
+        fail(
+          `Build ${code(`#${buildId}`)} failed (${build.error_code ?? "BUILD_FAILED"}): ${build.error_message ?? "(no detail)"}`
+        );
+        if (build.log_url) info(`Logs: ${code(build.log_url)}`);
+        info(`Re-run ${code("dashwise module publish")} to try again.`);
+      }
+      return 1;
+    }
+    await sleep(intervalMs);
   }
-  return hint?.needsGrant ? EXIT_NEEDS_GRANT : 1;
+  warn(
+    `Still building after ${options.timeoutSec ?? 360}s \u2014 the build is likely still running. Re-run ${code("dashwise module publish")} to check, or inspect build ${code(`#${buildId}`)}.`
+  );
+  return 0;
+}
+function sleep(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+function formatBytes2(n) {
+  if (n < 1024) return `${n}B`;
+  if (n < 1024 * 1024) return `${(n / 1024).toFixed(1)}KB`;
+  return `${(n / 1024 / 1024).toFixed(1)}MB`;
 }
 
 // src/commands/module/release.ts
+init_api_client();
+init_config();
+init_manifest_io();
+init_output();
+init_permission_hint();
 var FULL_SHA = /^[0-9a-f]{40}$/i;
 var positiveId = (value) => typeof value === "number" && Number.isSafeInteger(value) && value > 0;
 function isRepositoryBuild(value, moduleId, buildId) {
@@ -20589,7 +20987,7 @@ async function moduleStatusCommand(slugArg, options) {
     );
     return 0;
   }
-  const runtimeProvisioned = isRealRuntimeUrl(row.runtime_url);
+  const runtimeProvisioned = isRuntimeProvisioned(row);
   const state = runtimeProvisioned && row.public_url ? "live" : runtimeProvisioned ? "deployed" : "not_deployed";
   const installedVersion = row.module_version?.version ?? null;
   const updateAvailable = isUpdateAvailable(installedVersion, latestVersion);
@@ -20606,7 +21004,9 @@ async function moduleStatusCommand(slugArg, options) {
         latest_version: latestVersion,
         update_available: updateAvailable,
         runtime_provisioned: runtimeProvisioned,
-        runtime_url: row.runtime_url,
+        // The raw runtime endpoint is not printed any more: it reaches the
+        // module's server code past the platform's doors. `public_url` is
+        // the address to open.
         public_url: row.public_url,
         state,
         // C-09: per-slot data-plane readiness for THIS install. `null`
@@ -20632,7 +21032,7 @@ async function moduleStatusCommand(slugArg, options) {
   );
   kv(
     "Runtime:",
-    runtimeProvisioned ? `provisioned ${dim(`(${row.runtime_url})`)}` : "not provisioned"
+    runtimeProvisioned ? "provisioned" : "not provisioned"
   );
   kv("Public URL:", row.public_url ?? dim("(none)"));
   kv(
@@ -20676,7 +21076,7 @@ function usesJson(readiness) {
 init_api_client();
 init_config();
 init_output();
-var AUDIENCE = {
+var AUDIENCE2 = {
   company: "company",
   teams: "Team Spaces",
   people: "named people"
@@ -20684,16 +21084,16 @@ var AUDIENCE = {
 var givesRole = (roleKey) => typeof roleKey === "string" && roleKey !== "none";
 function governanceAudience(row) {
   if (!row.rules) return null;
-  if (givesRole(row.rules.company)) return AUDIENCE.company;
-  if (row.rules.teams.some((t) => t.live === true && givesRole(t.role_key))) return AUDIENCE.teams;
-  return AUDIENCE.people;
+  if (givesRole(row.rules.company)) return AUDIENCE2.company;
+  if (row.rules.teams.some((t) => t.live === true && givesRole(t.role_key))) return AUDIENCE2.teams;
+  return AUDIENCE2.people;
 }
 function toListEntry(row) {
   return {
     id: row.id,
     module_slug: row.module?.slug ?? null,
     name: row.name ?? row.module?.name ?? null,
-    audience: row.reach?.kind ? AUDIENCE[row.reach.kind] ?? row.reach.kind : null,
+    audience: row.reach?.kind ? AUDIENCE2[row.reach.kind] ?? row.reach.kind : null,
     version: row.module_version?.version ?? null,
     held: row.held === true,
     development: isDevInstallKind(row.kind),
@@ -20973,6 +21373,7 @@ function surfaceUninstallError(err, slug, workspaceSlug) {
 init_api_client();
 init_config();
 init_output();
+init_permission_hint();
 var positiveId2 = (value) => typeof value === "number" && Number.isSafeInteger(value) && value > 0;
 function session(json) {
   const cfg = readConfig();
@@ -21234,27 +21635,35 @@ async function moduleInvitesDeclineCommand(inviteId, options) {
 
 // src/commands/module/pull-data.ts
 init_api_client();
+init_permission_hint();
 init_output();
 async function modulePullDataCommand(options) {
+  const report = (err) => reportRefusal(err, {}, { ...options, stderr: true, action: "Pull data" });
+  const contextError = (message) => report(
+    new ApiError(
+      0,
+      {
+        code: "VALIDATION_ERROR",
+        message,
+        context: { reason: "module_context_required" }
+      },
+      message
+    )
+  );
   const projectRoot = resolve(options.dir ?? process.cwd());
   const manifestPath2 = join(projectRoot, "module.json");
   if (!existsSync(manifestPath2)) {
-    fail(
-      `No ${code("module.json")} found in ${code(projectRoot)}. Run \`dashwise module init <slug>\` first.`
-    );
-    return 1;
+    return contextError(`No module.json found in ${projectRoot}.`);
   }
   let manifest;
   try {
     manifest = JSON.parse(readFileSync(manifestPath2, "utf-8"));
   } catch (err) {
-    fail(`Could not parse ${code(manifestPath2)}: ${err.message}`);
-    return 1;
+    return contextError(`Could not parse module.json: ${err.message}`);
   }
   const slug = manifest.module?.slug;
   if (!slug) {
-    fail(`${code("module.json")} is missing ${code("module.slug")}.`);
-    return 1;
+    return contextError("module.json is missing module.slug.");
   }
   let mod;
   try {
@@ -21263,16 +21672,7 @@ async function modulePullDataCommand(options) {
       `/api/modules/by-slug/${encodeURIComponent(slug)}`
     );
   } catch (err) {
-    if (err instanceof ApiError && err.status === 404) {
-      fail(`Module ${code(slug)} not found on the backend.`);
-      return 1;
-    }
-    if (err instanceof ApiError && err.status === 401) {
-      fail("Not logged in. Run `dashwise login` first.");
-      return 1;
-    }
-    fail(`Could not resolve module: ${err.message}`);
-    return 1;
+    return report(err);
   }
   const limit = options.limit ?? 100;
   let res;
@@ -21282,18 +21682,15 @@ async function modulePullDataCommand(options) {
       `/api/modules/${mod.id}/own-data?limit=${limit}`
     );
   } catch (err) {
-    if (err instanceof ApiError && err.status === 400) {
-      fail(`Invalid request: ${err.message}`);
-      return 1;
-    }
-    fail(`Could not pull data: ${err.message}`);
-    return 1;
+    return report(err);
   }
   const outPath = options.out ? resolve(options.out) : join(projectRoot, "dashwise-data.json");
   writeFileSync(outPath, JSON.stringify(res, null, 2) + "\n", "utf-8");
   let totalRows = 0;
   for (const t of res.tables) totalRows += t.rows.length;
-  success(`Wrote ${totalRows} row${totalRows === 1 ? "" : "s"} across ${res.tables.length} table${res.tables.length === 1 ? "" : "s"} to ${code(outPath)}`);
+  success(
+    `Wrote ${totalRows} row${totalRows === 1 ? "" : "s"} across ${res.tables.length} table${res.tables.length === 1 ? "" : "s"} to ${code(outPath)}`
+  );
   for (const t of res.tables) {
     if (t.total_rows > t.rows.length) {
       warn(
@@ -21302,7 +21699,7 @@ async function modulePullDataCommand(options) {
     }
   }
   if (res.tables.length === 0) {
-    info(dim("No owned tables on this module. (Did you publish a manifest with `owns.tables`?)"));
+    info(dim("No tables available."));
   }
   return 0;
 }
@@ -23913,16 +24310,43 @@ init_config();
 init_dotenv_local();
 init_manifest_io();
 init_output();
+init_api_client();
+init_permission_hint();
 init_install_target();
-init_dev();
 async function queryCommand(options) {
   const projectRoot = resolve(options.dir ?? process.cwd());
   let manifestSlug;
   try {
     manifestSlug = readManifestOrThrow(projectRoot).module?.slug;
   } catch (err) {
-    fail(err.message);
-    return 1;
+    return reportRefusal(
+      new ApiError(
+        0,
+        {
+          code: "VALIDATION_ERROR",
+          message: err.message,
+          context: { reason: "module_context_required" }
+        },
+        "Module context required."
+      ),
+      {},
+      { ...options, stderr: true, action: "Query" }
+    );
+  }
+  if (!manifestSlug) {
+    return reportRefusal(
+      new ApiError(
+        0,
+        {
+          code: "VALIDATION_ERROR",
+          message: "module.json is missing module.slug.",
+          context: { reason: "module_context_required" }
+        },
+        "Module context required."
+      ),
+      {},
+      { ...options, stderr: true, action: "Query" }
+    );
   }
   const generatedPath = join(
     projectRoot,
@@ -23936,8 +24360,10 @@ async function queryCommand(options) {
     );
     return 1;
   }
-  const keyInShell = process.env.DASHWISE_API_KEY !== void 0;
+  const keyFromProcessEnv = Boolean(process.env.DASHWISE_API_KEY);
   hydrateEnvFromDotenvLocal(projectRoot);
+  let moduleKey = keyFromProcessEnv ? "env" : process.env.DASHWISE_API_KEY ? "env_file" : "saved";
+  let keySource = keyFromProcessEnv ? "environment" : ".env.local";
   const cfg = (() => {
     try {
       return readConfig();
@@ -23946,46 +24372,47 @@ async function queryCommand(options) {
     }
   })();
   const apiUrl = process.env.DASHWISE_API_URL ?? cfg?.apiUrl ?? "http://localhost:3000";
-  let keySource = keyInShell ? "environment" : ".env.local";
-  let entry = manifestSlug ? readModuleEntry(manifestSlug) : null;
-  if (!process.env.DASHWISE_API_KEY && manifestSlug) {
+  const entry = readModuleEntry(manifestSlug);
+  if (!process.env.DASHWISE_API_KEY) {
     if (entry && options.install !== void 0 && entry.installationId !== options.install) {
       fail(
-        `No key for install #${options.install}: the cached ${code("dwk_")} key of ${code(manifestSlug)} belongs to install #${entry.installationId}. Nothing was run.`
+        `No key for installation #${options.install}: the cached ${code("dwk_")} key of ${code(manifestSlug)} belongs to installation #${entry.installationId}. Nothing was run.`
       );
       return 1;
     }
-    if (cfg) {
-      const healed = await resolveModuleApiKey(
-        manifestSlug,
-        entry,
-        apiUrl,
-        cfg.token
-      );
-      if (healed) entry = healed;
-    }
     if (entry?.apiKey) {
       process.env.DASHWISE_API_KEY = entry.apiKey;
+      moduleKey = "saved";
       keySource = "cached";
       if (!process.env.DASHWISE_API_URL) {
         process.env.DASHWISE_API_URL = apiUrl;
       }
     }
   }
-  if (process.env.DASHWISE_API_KEY) {
-    const target = await nameKeyTarget({
-      apiKey: process.env.DASHWISE_API_KEY,
-      keySource,
-      entry,
-      cfg,
-      apiUrl: process.env.DASHWISE_API_URL ?? apiUrl,
-      ...options.install !== void 0 ? { install: options.install } : {}
-    });
-    if (target !== 0) return target;
-  } else if (options.install !== void 0) {
-    fail(`No ${code("dwk_")} key to check against install #${options.install}. Set ${code("DASHWISE_API_KEY")}. Nothing was run.`);
-    return 1;
+  if (!process.env.DASHWISE_API_KEY) {
+    return reportRefusal(
+      new ApiError(
+        0,
+        {
+          code: "UNAUTHENTICATED",
+          context: { reason: "module_api_credential_missing" },
+          message: "No module API key is configured."
+        },
+        "No module API key is configured."
+      ),
+      {},
+      { ...options, stderr: true, action: "Query" }
+    );
   }
+  const target = await nameKeyTarget({
+    apiKey: process.env.DASHWISE_API_KEY,
+    keySource,
+    entry,
+    cfg,
+    apiUrl,
+    ...options.install !== void 0 ? { install: options.install } : {}
+  });
+  if (target !== 0) return target;
   const modes = [
     options.inline !== void 0 ? "inline" : null,
     options.file !== void 0 ? "file" : null,
@@ -24015,7 +24442,7 @@ async function queryCommand(options) {
   const stream = options.stream === true;
   if (options.repl) return runRepl(generatedPath);
   if (options.file !== void 0)
-    return runFile(options.file, projectRoot, options.json === true, explain, stream);
+    return runFile(options.file, projectRoot, options.json === true, explain, stream, moduleKey);
   if (options.inline !== void 0)
     return runInline(
       options.inline,
@@ -24023,11 +24450,12 @@ async function queryCommand(options) {
       generatedPath,
       options.json === true,
       explain,
-      stream
+      stream,
+      moduleKey
     );
   return 1;
 }
-async function runInline(expression, projectRoot, generatedPath, jsonCompact, explain, stream) {
+async function runInline(expression, projectRoot, generatedPath, jsonCompact, explain, stream, moduleKey) {
   let entryUrl;
   try {
     entryUrl = generatedEntryUrl(generatedPath);
@@ -24048,7 +24476,7 @@ async function runInline(expression, projectRoot, generatedPath, jsonCompact, ex
   ].join("\n");
   writeFileSync(tmpFile, source, "utf-8");
   try {
-    return await importAndPrint(tmpFile, projectRoot, jsonCompact, explain, stream);
+    return await importAndPrint(tmpFile, projectRoot, jsonCompact, explain, stream, moduleKey);
   } finally {
     try {
       rmSync(tmpDir, { recursive: true, force: true });
@@ -24056,7 +24484,7 @@ async function runInline(expression, projectRoot, generatedPath, jsonCompact, ex
     }
   }
 }
-async function runFile(file, projectRoot, jsonCompact, explain, stream) {
+async function runFile(file, projectRoot, jsonCompact, explain, stream, moduleKey) {
   const abs = resolve(projectRoot, file);
   if (!existsSync(abs)) {
     fail(`File not found: ${code(abs)}`);
@@ -24068,7 +24496,7 @@ async function runFile(file, projectRoot, jsonCompact, explain, stream) {
     );
     return 1;
   }
-  return importAndPrint(abs, projectRoot, jsonCompact, explain, stream);
+  return importAndPrint(abs, projectRoot, jsonCompact, explain, stream, moduleKey);
 }
 async function runRepl(generatedPath) {
   let generated;
@@ -24107,7 +24535,7 @@ async function runRepl(generatedPath) {
     });
   });
 }
-async function importAndPrint(file, projectRoot, jsonCompact, explain, stream) {
+async function importAndPrint(file, projectRoot, jsonCompact, explain, stream, moduleKey) {
   const originalCwd = process.cwd();
   try {
     process.chdir(projectRoot);
@@ -24143,11 +24571,11 @@ async function importAndPrint(file, projectRoot, jsonCompact, explain, stream) {
     }
     return 0;
   } catch (err) {
-    fail(`Query failed: ${err.message}`);
+    const exit = reportRefusal(err, {}, { json: jsonCompact, stderr: true, action: "Query", moduleKey });
     if (process.env.DASHWISE_DEBUG) {
       console.error(err);
     }
-    return 1;
+    return exit;
   } finally {
     process.chdir(originalCwd);
   }
@@ -24848,6 +25276,7 @@ init_api_client();
 init_config();
 init_manifest_io();
 init_output();
+init_permission_hint();
 var PLATFORM_DEFAULTS = ["manifest", "on", "off"];
 var BUMPS = ["patch", "minor", "major"];
 function parseRollout(raw) {
@@ -25071,6 +25500,7 @@ init_api_client();
 init_config();
 init_manifest_io();
 init_output();
+init_permission_hint();
 var TERMINAL_OPERATION = /* @__PURE__ */ new Set(["succeeded", "failed", "superseded"]);
 async function moduleRuntimeShowCommand(slugArg, options) {
   const auth = authOrFail(options.json);
@@ -25367,10 +25797,11 @@ function sleep5(ms) {
 
 // src/program.ts
 init_output();
+init_permission_hint();
 var program = new Command();
 program.name("dashwise").description("Dashwise CLI \u2014 log in, author modules, publish to the marketplace.").version(getVersion(), "-v, --version", "Show the CLI version + exit").option(
   "--api-url <url>",
-  `Override Dashwise backend URL (default: $DASHWISE_API_URL, else your saved login, else ${KNOWN_API_URLS.dev}). Prod is ${KNOWN_API_URLS.prod}; pass a localhost URL to target a backend you are running yourself.`
+  `Override Dashwise backend URL (default: $DASHWISE_API_URL, else your saved login, else ${DEFAULT_API_URL}).`
 );
 program.hook("preAction", () => {
   const apiUrl = program.opts().apiUrl?.trim();
@@ -25389,7 +25820,7 @@ program.command("login").description("Sign in via the device-code flow.").option
   process.exitCode = exit;
 });
 program.command("doctor").description(
-  "Check your setup: which Dashwise you target (dev or prod), login, connection, Node, CLI and SDK versions, and inside a module folder module.json, the repository link and the cloud setup files. Each item says what to do. Exits 1 when something fails."
+  "Check your setup: target URL, login, connection, Node, CLI and SDK versions, and inside a module folder module.json, the repository link and the cloud setup files. Each item says what to do. Exits 1 when something fails."
 ).option("--dir <path>", "Module folder to check (default: current directory).").option("--json", "Print one JSON object { ok, checks } instead of the report.").action(async (cmdOpts) => {
   process.exitCode = await doctorCommand(
     {
@@ -25692,8 +26123,9 @@ moduleCmd.command("diff").description(
     });
   }
 );
-moduleCmd.command("pull-data").description("Export the module's own-table rows to a local JSON file (for fixtures, local dev seeding).").option("--dir <path>", "Project root (default: current directory).").option("--limit <n>", "Max rows per table (1-1000, default 100).", parseIntOption).option("--out <path>", "Output file path (default: ./dashwise-data.json).").action(async (cmdOpts) => {
+moduleCmd.command("pull-data").description("Export the module's own-table rows to a local JSON file (for fixtures, local dev seeding).").option("--dir <path>", "Project root (default: current directory).").option("--limit <n>", "Max rows per table (1-1000, default 100).", parseIntOption).option("--out <path>", "Output file path (default: ./dashwise-data.json).").option("--json", "Emit structured errors on stderr.").action(async (cmdOpts) => {
   process.exitCode = await modulePullDataCommand({
+    ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {},
     ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
     ...cmdOpts.limit !== void 0 ? { limit: cmdOpts.limit } : {},
     ...cmdOpts.out !== void 0 ? { out: cmdOpts.out } : {}
@@ -26059,8 +26491,15 @@ moduleCmd.command("publish").description("Pack the current directory + upload it
   }
 );
 moduleCmd.command("install [slug]").alias("deploy").alias("upgrade").description(
-  "Install (deploy) a published module into a workspace \u2014 provisions the runtime and prints the public URL. Upgrades/repairs an existing production install idempotently: an upgrade first prints what it does to the copy's data (tables and fields it moves to the Trash or converts, with their counts), asks once, and sends the preview's drift_hash. A move that loses data is accepted only by a person: the one question in a terminal, or --accept-data-loss <drift_hash> with the hash the preview printed. --yes never accepts data loss; with no terminal, or inside an AI agent session, a lossy move is refused and the refusal prints the re-run line. When only a dev install exists it asks whether to install alongside it (--keep-dev-install) or replace it (--replace-dev-install), rather than silently landing on the dev row. Exits 3 \u2014 \"deployed, setup pending\" \u2014 when a required `uses` slot is still unbound: the deploy succeeded but the module throws on its first data call until an admin binds it."
-).option("--workspace <slug-or-id>", "Target workspace (default: cached module workspace, config default, or interactive picker).").option("--version <semver>", "Install a specific published version (default: latest).").option("--force", "Proceed even when the upgrade breaks consumer modules (UPGRADE_BREAKS_CONSUMERS).").option(
+  "Install (deploy) a published module into a workspace \u2014 provisions the runtime and prints the public URL. Upgrades/repairs an existing production install idempotently: an upgrade first prints what it does to the installation's data (tables and fields it moves to the Trash or converts, with their counts), asks once, and sends the preview's drift_hash. A move that loses data is accepted only by a person: the one question in a terminal, or --accept-data-loss <drift_hash> with the hash the preview printed. --yes never accepts data loss; with no terminal, or inside an AI agent session, a lossy move is refused and the refusal prints the re-run line. When only a dev install exists it asks whether to install alongside it (--keep-dev-install) or replace it (--replace-dev-install), rather than silently landing on the dev row. Exits 3 \u2014 \"deployed, setup pending\" \u2014 when a required `uses` slot is still unbound: the deploy succeeded but the module throws on its first data call until an admin binds it."
+).option("--workspace <slug-or-id>", "Target workspace (default: cached module workspace, config default, or interactive picker).").option("--version <semver>", "Install a specific published version (default: latest).").option(
+  "--force",
+  "Upgrade even when it breaks consumer modules (UPGRADE_BREAKS_CONSUMERS): shows which modules it disconnects and what it changes, asks to confirm (--yes confirms disconnections, never data loss), then upgrades exactly that plan."
+).option(
+  "--installation <id>",
+  "Update exactly this production installation (needed when several exist, or to update a held one).",
+  parsePositiveIdOption
+).option(
   "--keep-dev-install",
   "Install production ALONGSIDE the workspace's kind=local dev install, leaving local dev working. Non-destructive. Backends >= 2026-07-15 keep a separate live-install slot per kind group, so the two coexist."
 ).option(
@@ -26072,6 +26511,7 @@ moduleCmd.command("install [slug]").alias("deploy").alias("upgrade").description
 ).option("--json", "Emit the final result as machine-readable JSON.").action(
   async (slug, cmdOpts) => {
     process.exitCode = await moduleInstallCommand(slug, {
+      ...cmdOpts.installation !== void 0 ? { installation: cmdOpts.installation } : {},
       ...cmdOpts.workspace !== void 0 ? { workspace: cmdOpts.workspace } : {},
       ...cmdOpts.version !== void 0 ? { version: cmdOpts.version } : {},
       ...cmdOpts.force !== void 0 ? { force: cmdOpts.force } : {},
@@ -26350,9 +26790,10 @@ var schemaCmd = program.command("schema").description(
 );
 schemaCmd.command("push").description(
   "Apply the LOCAL module.json to the dev install via PUT /api/modules/:id/draft/manifest (greenfield or delta). Destructive removals (tables/fields) are previewed and require confirmation unless --yes. Afterwards the canonical manifest is synced back with merge semantics (local-only rbac/indexes blocks survive)."
-).option("--dir <path>", "Project root containing `module.json` (default: current directory).").option("-y, --yes", "Skip the destructive-change confirmation (CI / scripted runs).").action(async (cmdOpts) => {
+).option("--dir <path>", "Project root containing `module.json` (default: current directory).").option("-y, --yes", "Skip the destructive-change confirmation (CI / scripted runs).").option("--json", "Emit structured errors on stderr.").action(async (cmdOpts) => {
   const { schemaPushCommand: schemaPushCommand2 } = await Promise.resolve().then(() => (init_push(), push_exports));
   process.exitCode = await schemaPushCommand2({
+    ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {},
     ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
     ...cmdOpts.yes !== void 0 ? { yes: cmdOpts.yes } : {}
   });
@@ -26433,7 +26874,13 @@ fieldCmd.command("set-type <table-slug> <field-slug> <new-type>").description(
   }
 );
 function getVersion() {
-  return "0.27.0";
+  return "0.28.1";
+}
+function parsePositiveIdOption(value) {
+  if (!/^[1-9][0-9]*$/.test(value.trim())) {
+    throw new Error(`Expected an installation id (a positive whole number), got '${value}'`);
+  }
+  return Number(value.trim());
 }
 function parseIntOption(value) {
   const n = Number.parseInt(value, 10);