@dashai/cli 0.28.1 → 0.29.0

package/README.md

@@ -8,7 +8,7 @@ The CLI defaults to `https://api.dashwise.net`. `DASHWISE_API_URL` takes precede
 
 ## Status
 
-`0.5.x` — full author workflow + **Query Plane v1 author tooling** + **P7 cross-module-action observability** (shipped 2026-05-20) + **BaaS Phase 1 deploy loop** (`api-keys`, `env export`, `--deploy-target`; shipped 2026-05-24). Commands: `login`, `logout`, `profile`, `workspace`, `init` / `module init` (incl. `--custom`, `--deploy-target railway|vercel|fly`) / `connect-git` / `generate` / `dev` / `validate` / `list` / `publish` / `diff` / `pull-data` / `clone` / `query-log` / `action-log`, plus `query` (run AST queries against the local module), `pull` (sync canonical manifest from backend), `api-keys list|create|revoke`, `origins list|add|remove` (SSO callback allowlist), `env export`, and `deps` (live connect status) / `add` / `list` / `remove` / `check` / `bind` / `unbind` (cross-module dependency connect lifecycle).
+`0.5.x` — full author workflow + **Query Plane v1 author tooling** + **P7 cross-module-action observability** (shipped 2026-05-20) + **BaaS Phase 1 deploy loop** (`api-keys`, `env export`, `--deploy-target`; shipped 2026-05-24). Commands: `login`, `logout`, `profile`, `workspace`, `init` / `module init` (incl. `--custom`, `--deploy-target railway|vercel|fly`) / `connect-git` / `generate` / `dev` / `validate` / `list` / `publish` / `diff` / `pull-data` / `clone` / `query-log` / `action-log`, plus `query` (run AST queries against the local module), `pull` (sync canonical manifest from backend), `api-keys list|create|revoke`, `origins list|add|remove` (SSO callback allowlist), `secrets list|set|clear` (write-only runtime secrets), `env export`, and `deps` (live connect status) / `add` / `list` / `remove` / `check` / `bind` / `unbind` (cross-module dependency connect lifecycle).
 
 ## Install
 
@@ -563,6 +563,32 @@ Flags:
 - `--dir <path>` — Project root.
 - `--json` (list only) — Emit a JSON array of origins.
 
+### `dashwise secrets list|set|clear`
+
+Manage the install's runtime secrets: the values your module declares in `module.json#runtime.secrets[]` (API tokens, webhook signing secrets). They are **write-only**: the backend never returns a value, and the CLI never prints one or takes one from the command line (it would land in shell history).
+
+```sh
+dashwise secrets list                                   # declared keys, which are set (names only)
+dashwise secrets set GITHUB_TOKEN SLACK_BOT_TOKEN       # hidden prompt for each value
+printf %s "$TOKEN" | dashwise secrets set GITHUB_TOKEN --from-stdin
+dashwise secrets set --from-env-file .env.secrets       # every declared key found in the file
+dashwise secrets set --from-env-file .env.secrets --keys GITHUB_TOKEN
+dashwise secrets clear --yes                            # remove every value
+```
+
+Env-file format (read strictly, so a value is never guessed at): `KEY=value` lines with no spaces around `=`, `#` comment lines, an optional `export ` prefix. An unquoted value runs to the end of the line and may not start or end with a space or contain ` #`; quote such a value. `"double quotes"` understand `\\`, `\"` and `\n`; `'single quotes'` are literal; only a ` # comment` may follow a closing quote. Errors name the line number, never its content. `--from-stdin` with nothing piped in asks at the hidden prompt instead.
+
+`set` **replaces the whole map** (the backend has no per-key route yet): a key that is set now but not given is removed, and `set` names those keys and asks first (`--yes` in scripts; without a terminal it refuses). Right before writing it reads the set keys again and stops if they changed meanwhile. An argument that is not a declared key is named by its position only (it may be a mistyped value). Where the backend delivers secrets to the hosted app, `set` says whether the running app picks the values up on its next request. An oversize map is refused with the byte count and the largest key names.
+
+Install resolution as for `origins`: the cached dev install of the project's module, or any install (production included) with `--install <id>`. Setting values needs a company admin or an installation manager.
+
+Flags:
+- `--dir <path>` — Project root.
+- `--install <id>` — Target a specific installation.
+- `--from-stdin` / `--from-env-file <path>` / `--keys <list>` (set) — Where values come from.
+- `-y, --yes` (set, clear) — Do not ask.
+- `--json` (list, set) — JSON output (names only).
+
 ### `dashwise module query-log`
 
 Read the per-module SDK query log (each cross-module / `.execute()` / `.stream()` / `.explain()` dispatch writes a row to `module_query_log` server-side). Workspace-member-scoped on the backend.

package/dist/bin.js

@@ -4,7 +4,7 @@ import { existsSync, readFileSync, writeFileSync, rmSync, mkdirSync, watch, read
 import { hostname, tmpdir, platform, homedir } from 'os';
 import { resolve, join, relative, dirname, basename, win32, sep } from 'path';
 import { execFileSync, spawn, spawnSync } from 'child_process';
-import { intro, log, select, isCancel, cancel, spinner, outro, text, confirm as confirm$1, multiselect } from '@clack/prompts';
+import { intro, log, select, isCancel, cancel, spinner, outro, confirm as confirm$1, password, text, multiselect } from '@clack/prompts';
 import { Command, Option } from 'commander';
 import open from 'open';
 import AdmZip from 'adm-zip';
@@ -364,6 +364,30 @@ async function setOrigins(installationId, allowedOrigins, options = {}) {
     options
   );
 }
+async function listInstallationSecrets(installationId, options = {}) {
+  return apiRequest(
+    "GET",
+    `/api/modules/installations/${installationId}/secrets`,
+    void 0,
+    options
+  );
+}
+async function setInstallationSecrets(installationId, secrets, options = {}) {
+  return apiRequest(
+    "PUT",
+    `/api/modules/installations/${installationId}/secrets`,
+    { secrets },
+    options
+  );
+}
+async function clearInstallationSecrets(installationId, options = {}) {
+  await apiRequest(
+    "DELETE",
+    `/api/modules/installations/${installationId}/secrets`,
+    void 0,
+    options
+  );
+}
 async function createTable(body, options = {}) {
   return apiRequest(
     "POST",
@@ -14158,8 +14182,8 @@ function needsAdmin(what, module, ask) {
   const scope = module ? ` for ${module}` : "";
   return `${what}${scope} needs a Dashwise admin. Ask your Dashwise admin to ${ask}.`;
 }
-function refusalHint(code2, context, subject = {}) {
-  const ctx = context ?? {};
+function refusalHint(code2, context2, subject = {}) {
+  const ctx = context2 ?? {};
   const module = subject.module ?? str(ctx.module_slug);
   const installationId = subject.installationId ?? num(ctx.installation_id);
   const installLabel = installationId !== void 0 ? ` (install #${installationId})` : "";
@@ -15213,9 +15237,9 @@ function surfaceSchemaPushError(err, slug, json) {
   fail(`Schema push failed: ${err.message}`);
   return 1;
 }
-function extractIssues2(context) {
-  if (!context) return [];
-  const raw = context.issues;
+function extractIssues2(context2) {
+  if (!context2) return [];
+  const raw = context2.issues;
   if (!Array.isArray(raw)) return [];
   return raw.map((i) => {
     if (typeof i === "string") return i;
@@ -21760,9 +21784,9 @@ async function moduleValidateCommand(options) {
     return 1;
   }
 }
-function readIssues(context) {
-  if (!context) return [];
-  const v = context["issues"];
+function readIssues(context2) {
+  if (!context2) return [];
+  const v = context2["issues"];
   if (!Array.isArray(v)) return [];
   return v.map((entry) => {
     if (!entry || typeof entry !== "object") return null;
@@ -23344,9 +23368,9 @@ async function pushManifest(ctx) {
     return { ok: false, rejected: false };
   }
 }
-function extractIssues(context) {
-  if (!context) return [];
-  const raw = context.issues;
+function extractIssues(context2) {
+  if (!context2) return [];
+  const raw = context2.issues;
   if (!Array.isArray(raw)) return [];
   return raw.map((i) => {
     if (typeof i === "string") return i;
@@ -24130,6 +24154,356 @@ function surfaceOriginsError(err) {
   return 1;
 }
 
+// src/commands/secrets.ts
+init_api_client();
+init_output();
+var KEY_SHAPE = /^[A-Z][A-Z0-9_]{0,63}$/;
+function context(opts) {
+  try {
+    return loadContext5(opts);
+  } catch (err) {
+    fail(err.message);
+    return null;
+  }
+}
+function interactive() {
+  return Boolean(process.stdin.isTTY && process.stdout.isTTY);
+}
+async function secretsListCommand(options) {
+  const ctx = context(options);
+  if (!ctx) return 1;
+  let resp;
+  try {
+    resp = await listInstallationSecrets(ctx.installationId, ctx.requestOptions);
+  } catch (err) {
+    return surfaceSecretsError(err);
+  }
+  const set = new Set(resp.set);
+  const declared = new Set(resp.declared.map((d) => d.key));
+  if (options.json) {
+    process.stdout.write(
+      `${JSON.stringify(
+        {
+          installation_id: ctx.installationId,
+          declared: resp.declared.map((d) => ({
+            key: d.key,
+            description: d.description,
+            set: set.has(d.key)
+          })),
+          // Stored but no longer declared by the installed version: not
+          // delivered to the app; `set` removes them.
+          undeclared_set: resp.set.filter((k) => !declared.has(k))
+        },
+        null,
+        2
+      )}
+`
+    );
+    return 0;
+  }
+  info(`Secrets of ${code(ctx.slug)} ${dim("(names only; values are never shown)")}:`);
+  if (resp.declared.length === 0) {
+    info(`  ${dim("(the module declares none in module.json#runtime.secrets)")}`);
+  }
+  for (const d of resp.declared) {
+    const state = set.has(d.key) ? "set" : dim("not set");
+    process.stdout.write(
+      `  ${d.key}  ${state}${d.description ? `  ${dim(d.description)}` : ""}
+`
+    );
+  }
+  const stray = resp.set.filter((k) => !declared.has(k));
+  if (stray.length > 0) {
+    warn(
+      `Stored but no longer declared (not delivered): ${stray.join(", ")}. The next ${code("dashwise secrets set")} removes them.`
+    );
+  }
+  return 0;
+}
+function parseEnvFile(text4) {
+  const out2 = {};
+  const lines = text4.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i++) {
+    const n = i + 1;
+    const line = lines[i].replace(/^\s+/, "");
+    if (line === "" || line.startsWith("#")) continue;
+    const m = /^(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.*)$/.exec(line);
+    if (!m) {
+      throw new Error(`line ${n} is not KEY=value (no spaces around "=")`);
+    }
+    const [, key, raw] = m;
+    out2[key] = parseValue(raw, n);
+  }
+  return out2;
+}
+function parseValue(raw, n) {
+  const quote2 = raw[0];
+  if (quote2 === '"' || quote2 === "'") {
+    let value = "";
+    let j = 1;
+    for (; j < raw.length; j++) {
+      const ch = raw[j];
+      if (ch === quote2) break;
+      if (quote2 === '"' && ch === "\\" && j + 1 < raw.length) {
+        const next = raw[++j];
+        value += next === "n" ? "\n" : next === '"' || next === "\\" ? next : `\\${next}`;
+        continue;
+      }
+      value += ch;
+    }
+    if (j >= raw.length) throw new Error(`line ${n}: the quoted value is not closed`);
+    const rest = raw.slice(j + 1);
+    if (rest.trim() !== "" && !/^\s+#/.test(rest)) {
+      throw new Error(`line ${n}: only a " # comment" may follow the closing quote`);
+    }
+    return value;
+  }
+  if (/^\s|\s$/.test(raw)) {
+    throw new Error(
+      `line ${n}: an unquoted value may not start or end with a space; quote it`
+    );
+  }
+  if (/\s#/.test(raw)) {
+    throw new Error(
+      `line ${n}: an unquoted value may not contain " #" (comment or value?); quote it`
+    );
+  }
+  return raw;
+}
+async function readStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(chunk);
+  return Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
+}
+async function secretsSetCommand(keyArgs, options) {
+  const inline = keyArgs.findIndex((k) => k.includes("=") || !KEY_SHAPE.test(k));
+  if (inline !== -1) {
+    fail(
+      `Argument ${inline + 1} is not a secret key name; values must not be passed as arguments (shell history). Enter values at the prompt, or use ${code("--from-stdin")} or ${code("--from-env-file <path>")}.`
+    );
+    return 1;
+  }
+  if (options.fromStdin && options.fromEnvFile) {
+    fail(`Use one of ${code("--from-stdin")} or ${code("--from-env-file")}, not both.`);
+    return 1;
+  }
+  if (options.keys && !options.fromEnvFile) {
+    fail(`${code("--keys")} goes with ${code("--from-env-file")}.`);
+    return 1;
+  }
+  const ctx = context(options);
+  if (!ctx) return 1;
+  let current;
+  try {
+    current = await listInstallationSecrets(ctx.installationId, ctx.requestOptions);
+  } catch (err) {
+    return surfaceSecretsError(err);
+  }
+  const declared = current.declared.map((d) => d.key);
+  let keys = [...new Set(keyArgs)];
+  const values = {};
+  if (options.fromEnvFile) {
+    let fileValues;
+    try {
+      fileValues = parseEnvFile(readFileSync(options.fromEnvFile, "utf8"));
+    } catch (err) {
+      fail(`Could not read ${code(options.fromEnvFile)}: ${err.message}`);
+      return 1;
+    }
+    const wanted = options.keys ? options.keys.split(",").map((k) => k.trim()).filter(Boolean) : keys.length > 0 ? keys : declared.filter((k) => k in fileValues);
+    const undeclaredAt2 = wanted.findIndex(
+      (k) => !KEY_SHAPE.test(k) || !declared.includes(k)
+    );
+    if (undeclaredAt2 !== -1) {
+      fail(
+        `${options.keys ? `Item ${undeclaredAt2 + 1} of --keys` : `Argument ${undeclaredAt2 + 1}`} is not a declared key; values must not be passed as arguments. Declared: ${declared.length > 0 ? declared.join(", ") : "none"}.`
+      );
+      return 1;
+    }
+    const missing = wanted.filter((k) => !(k in fileValues));
+    if (missing.length > 0) {
+      fail(`Not in ${code(options.fromEnvFile)}: ${missing.join(", ")}.`);
+      return 1;
+    }
+    for (const k of wanted) values[k] = fileValues[k];
+    keys = wanted;
+  } else if (options.fromStdin) {
+    if (keys.length !== 1) {
+      fail(`${code("--from-stdin")} reads the value of exactly one key: ${code("dashwise secrets set KEY --from-stdin")}.`);
+      return 1;
+    }
+    if (process.stdin.isTTY) {
+      info(`Nothing is piped into stdin; asking at a hidden prompt instead.`);
+    } else {
+      values[keys[0]] = await readStdin();
+    }
+  } else {
+    if (keys.length === 0) {
+      fail(
+        `Name the keys to set (${declared.length > 0 ? declared.join(", ") : "none declared"}), or use ${code("--from-env-file <path>")}.`
+      );
+      return 1;
+    }
+    if (!interactive()) {
+      fail(`No terminal to prompt in. Use ${code("--from-stdin")} or ${code("--from-env-file <path>")}.`);
+      return 1;
+    }
+  }
+  if (keys.length === 0) {
+    fail(`Nothing to set: no declared key was found.`);
+    return 1;
+  }
+  const undeclaredAt = keys.findIndex(
+    (k) => !KEY_SHAPE.test(k) || !declared.includes(k)
+  );
+  if (undeclaredAt !== -1) {
+    const where = options.keys ? `Item ${undeclaredAt + 1} of --keys` : keyArgs.length > 0 ? `Argument ${keyArgs.indexOf(keys[undeclaredAt]) + 1}` : `Key ${undeclaredAt + 1}`;
+    fail(
+      `${where} is not a declared key; values must not be passed as arguments. Declared: ${declared.length > 0 ? declared.join(", ") : "none"}.`
+    );
+    return 1;
+  }
+  const removed = current.set.filter((k) => !keys.includes(k));
+  if (removed.length > 0 && !options.yes) {
+    if (!interactive()) {
+      fail(
+        `This replaces the whole map and would remove ${removed.join(", ")}. Include them, or pass ${code("--yes")} to remove them.`
+      );
+      return 1;
+    }
+    const ok = await confirm$1({
+      message: `This replaces the whole map: ${removed.join(", ")} will be removed. Continue?`,
+      initialValue: false
+    });
+    if (isCancel(ok) || ok !== true) {
+      info("Nothing changed.");
+      return 1;
+    }
+  }
+  for (const k of keys) {
+    if (k in values) continue;
+    const entered = await password({ message: `Value for ${k}` });
+    if (isCancel(entered)) {
+      info("Nothing changed.");
+      return 1;
+    }
+    values[k] = entered;
+  }
+  const empty = keys.filter((k) => values[k] === "");
+  if (empty.length > 0) {
+    fail(`Empty value for ${empty.join(", ")}; nothing changed. (To remove every value: ${code("dashwise secrets clear")}.)`);
+    return 1;
+  }
+  try {
+    const now = await listInstallationSecrets(ctx.installationId, ctx.requestOptions);
+    const before = [...current.set].sort().join(",");
+    if ([...now.set].sort().join(",") !== before) {
+      fail(
+        `The set keys changed while you were entering values (now: ${now.set.length > 0 ? [...now.set].sort().join(", ") : "none"}). Nothing changed; run ${code("dashwise secrets set")} again.`
+      );
+      return 1;
+    }
+  } catch (err) {
+    return surfaceSecretsError(err);
+  }
+  let resp;
+  try {
+    resp = await setInstallationSecrets(ctx.installationId, values, ctx.requestOptions);
+  } catch (err) {
+    return surfaceSecretsError(err);
+  }
+  if (options.json) {
+    process.stdout.write(
+      `${JSON.stringify({ installation_id: ctx.installationId, keys_set: resp.keys_set, removed, runtime: resp.runtime ?? null }, null, 2)}
+`
+    );
+    return 0;
+  }
+  success(`Saved ${resp.keys_set.join(", ")} for ${code(ctx.slug)}.`);
+  if (removed.length > 0) info(`  ${dim(`Removed: ${removed.join(", ")}.`)}`);
+  info(`  ${dim(runtimeLine(resp.runtime))}`);
+  return 0;
+}
+function runtimeLine(runtime) {
+  const status = runtime?.status;
+  switch (status) {
+    case "queued":
+      return "The running app picks the new values up on its next request (about a minute).";
+    case "deferred":
+      return "Another change of this app is in progress; the values are applied right after it.";
+    case "no_runtime":
+      return "Nothing is deployed yet; the next deploy carries the values.";
+    case "frozen":
+      return "This installation is held; the values apply once it is released.";
+    case void 0:
+      return "The values reach the hosted app at its next deploy (or are read at runtime, where the backend delivers them).";
+    default:
+      return `Runtime: ${status}.`;
+  }
+}
+async function secretsClearCommand(options) {
+  const ctx = context(options);
+  if (!ctx) return 1;
+  if (!options.yes) {
+    if (!interactive()) {
+      fail(`This removes every value. Pass ${code("--yes")} to confirm.`);
+      return 1;
+    }
+    const ok = await confirm$1({
+      message: `Remove every secret value of ${ctx.slug}?`,
+      initialValue: false
+    });
+    if (isCancel(ok) || ok !== true) {
+      info("Nothing changed.");
+      return 1;
+    }
+  }
+  try {
+    await clearInstallationSecrets(ctx.installationId, ctx.requestOptions);
+  } catch (err) {
+    return surfaceSecretsError(err);
+  }
+  success(`Removed every secret value of ${code(ctx.slug)}.`);
+  return 0;
+}
+function surfaceSecretsError(err) {
+  if (err instanceof ApiError) {
+    const ctx = err.context ?? {};
+    switch (err.code) {
+      case "UNAUTHENTICATED":
+        fail(`Auth rejected by backend. Your CLI token may be stale \u2014 run ${code("dashwise login")} then retry.`);
+        return 1;
+      case "SECRETS_ENV_TOO_LARGE": {
+        const largest = Array.isArray(ctx.largest_keys) ? ctx.largest_keys.map(String).join(", ") : "";
+        fail(
+          `These values take ${String(ctx.bytes ?? "?")} bytes; an installation may hold at most ${String(ctx.budget ?? 3072)}. Shorten or remove a value${largest ? ` (largest: ${largest})` : ""}. Nothing changed.`
+        );
+        return 1;
+      }
+      case "UNKNOWN_SECRET_KEY":
+        fail(`The backend does not know these keys: ${Array.isArray(ctx.unknown) ? ctx.unknown.join(", ") : err.message}.`);
+        return 1;
+      case "SECRETS_NOT_CONFIGURED":
+        fail("Secrets are not configured on this backend (its master key is unset).");
+        return 1;
+      case "FORBIDDEN":
+      case "PERMISSION_DENIED":
+      case "NOT_WORKSPACE_ADMIN":
+        fail("Not authorized. Setting secrets needs a company admin or an installation manager.");
+        return 1;
+      case "NOT_FOUND":
+      case "INSTALLATION_NOT_FOUND":
+        fail(`Installation not found (or not visible to you). Check the id with ${code("dashwise module status <slug>")}.`);
+        return 1;
+      default:
+        fail(`Backend rejected: ${err.code} ${err.status} \u2014 ${err.message}`);
+        return 1;
+    }
+  }
+  fail(`Secrets operation failed: ${err.message}`);
+  return 1;
+}
+
 // src/commands/env-export.ts
 init_api_client();
 init_config();
@@ -26418,6 +26792,55 @@ originsCmd.command("remove <url>").description("Remove an SSO callback origin fr
     ...cmdOpts.install !== void 0 ? { install: cmdOpts.install } : {}
   });
 });
+var secretsCmd = program.command("secrets").description(
+  "Manage the current module install's runtime secrets (write-only: names are shown, values never are)."
+);
+secretsCmd.command("list").description("Show the declared secret keys and which have a value (names only).").option("--dir <path>", "Project root (default: current directory).").option(
+  "--install <id>",
+  "Target a specific installation id instead of the cached dev install (production installs included). Find ids via `dashwise module status <slug>`.",
+  parseIntOption
+).option("--json", "Emit JSON instead of the human-friendly list.").action(async (cmdOpts) => {
+  process.exitCode = await secretsListCommand({
+    ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+    ...cmdOpts.install !== void 0 ? { install: cmdOpts.install } : {},
+    ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
+  });
+});
+secretsCmd.command("set [keys...]").description(
+  "Set secret values, REPLACING the whole map (keys set now but not given are removed; you are asked first). Values come from a hidden prompt, --from-stdin or --from-env-file, never from the command line."
+).option("--dir <path>", "Project root (default: current directory).").option(
+  "--install <id>",
+  "Target a specific installation id instead of the cached dev install (production installs included). Find ids via `dashwise module status <slug>`.",
+  parseIntOption
+).option("--from-stdin", "Read the value of exactly one key from stdin.").option("--from-env-file <path>", "Read values from a dotenv-style file (all declared keys found in it, or the keys named).").option("--keys <list>", "With --from-env-file: only these keys (comma-separated).").option("-y, --yes", "Remove keys that are set now but not in the new map without asking.").option("--json", "Emit a JSON summary (key names only).").addHelpText(
+  "before",
+  pc.bold(
+    "set REPLACES THE WHOLE MAP: every key you do not give is removed (you are asked first; --yes skips the question)."
+  )
+).action(
+  async (keys, cmdOpts) => {
+    process.exitCode = await secretsSetCommand(keys ?? [], {
+      ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+      ...cmdOpts.install !== void 0 ? { install: cmdOpts.install } : {},
+      ...cmdOpts.fromStdin !== void 0 ? { fromStdin: cmdOpts.fromStdin } : {},
+      ...cmdOpts.fromEnvFile !== void 0 ? { fromEnvFile: cmdOpts.fromEnvFile } : {},
+      ...cmdOpts.keys !== void 0 ? { keys: cmdOpts.keys } : {},
+      ...cmdOpts.yes !== void 0 ? { yes: cmdOpts.yes } : {},
+      ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
+    });
+  }
+);
+secretsCmd.command("clear").description("Remove every secret value of the install.").option("--dir <path>", "Project root (default: current directory).").option(
+  "--install <id>",
+  "Target a specific installation id instead of the cached dev install (production installs included). Find ids via `dashwise module status <slug>`.",
+  parseIntOption
+).option("-y, --yes", "Do not ask for confirmation.").action(async (cmdOpts) => {
+  process.exitCode = await secretsClearCommand({
+    ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+    ...cmdOpts.install !== void 0 ? { install: cmdOpts.install } : {},
+    ...cmdOpts.yes !== void 0 ? { yes: cmdOpts.yes } : {}
+  });
+});
 var envCmd = program.command("env").description("Environment-variable helpers for deploying a module.");
 envCmd.command("export").description(
   "Emit the env vars a deployed module needs to authenticate against Dashwise. By default emits .env-style KEY=value lines; --format = env | json | railway | vercel | fly to wrap in platform-native syntax. Use --new-key <name> to mint + inline an API key in one step."
@@ -26874,7 +27297,7 @@ fieldCmd.command("set-type <table-slug> <field-slug> <new-type>").description(
   }
 );
 function getVersion() {
-  return "0.28.1";
+  return "0.29.0";
 }
 function parsePositiveIdOption(value) {
   if (!/^[1-9][0-9]*$/.test(value.trim())) {