@dashai/cli 0.28.1 → 0.30.1

package/dist/bin.js

@@ -4,7 +4,7 @@ import { existsSync, readFileSync, writeFileSync, rmSync, mkdirSync, watch, read
 import { hostname, tmpdir, platform, homedir } from 'os';
 import { resolve, join, relative, dirname, basename, win32, sep } from 'path';
 import { execFileSync, spawn, spawnSync } from 'child_process';
-import { intro, log, select, isCancel, cancel, spinner, outro, text, confirm as confirm$1, multiselect } from '@clack/prompts';
+import { intro, log, select, isCancel, cancel, spinner, outro, confirm as confirm$1, password, text, multiselect } from '@clack/prompts';
 import { Command, Option } from 'commander';
 import open from 'open';
 import AdmZip from 'adm-zip';
@@ -364,6 +364,38 @@ async function setOrigins(installationId, allowedOrigins, options = {}) {
     options
   );
 }
+async function getModuleBuildLog(moduleId, buildId, options = {}) {
+  return apiRequest(
+    "GET",
+    `/api/modules/${moduleId}/builds/${buildId}/log`,
+    void 0,
+    options
+  );
+}
+async function listInstallationSecrets(installationId, options = {}) {
+  return apiRequest(
+    "GET",
+    `/api/modules/installations/${installationId}/secrets`,
+    void 0,
+    options
+  );
+}
+async function setInstallationSecrets(installationId, secrets, options = {}) {
+  return apiRequest(
+    "PUT",
+    `/api/modules/installations/${installationId}/secrets`,
+    { secrets },
+    options
+  );
+}
+async function clearInstallationSecrets(installationId, options = {}) {
+  await apiRequest(
+    "DELETE",
+    `/api/modules/installations/${installationId}/secrets`,
+    void 0,
+    options
+  );
+}
 async function createTable(body, options = {}) {
   return apiRequest(
     "POST",
@@ -14158,8 +14190,8 @@ function needsAdmin(what, module, ask) {
   const scope = module ? ` for ${module}` : "";
   return `${what}${scope} needs a Dashwise admin. Ask your Dashwise admin to ${ask}.`;
 }
-function refusalHint(code2, context, subject = {}) {
-  const ctx = context ?? {};
+function refusalHint(code2, context2, subject = {}) {
+  const ctx = context2 ?? {};
   const module = subject.module ?? str(ctx.module_slug);
   const installationId = subject.installationId ?? num(ctx.installation_id);
   const installLabel = installationId !== void 0 ? ` (install #${installationId})` : "";
@@ -15213,9 +15245,9 @@ function surfaceSchemaPushError(err, slug, json) {
   fail(`Schema push failed: ${err.message}`);
   return 1;
 }
-function extractIssues2(context) {
-  if (!context) return [];
-  const raw = context.issues;
+function extractIssues2(context2) {
+  if (!context2) return [];
+  const raw = context2.issues;
   if (!Array.isArray(raw)) return [];
   return raw.map((i) => {
     if (typeof i === "string") return i;
@@ -19193,8 +19225,16 @@ var MARKERS = [
   ["CODEX_SANDBOX_NETWORK_DISABLED", (v) => v.length > 0],
   ["CURSOR_AGENT", (v) => v.length > 0],
   ["DW_AGENT", (v) => v.length > 0],
-  ["DASHWISE_AGENT_SESSION", (v) => v === "1" || v === "true"]
+  ["DASHWISE_AGENT_SESSION", (v) => v === "1" || v === "true"],
+  ["CLAUDE_CODE_ENTRYPOINT", (v) => v.length > 0],
+  ["GEMINI_CLI", (v) => v === "1"],
+  ["COPILOT_AGENT_SESSION_ID", (v) => v.length > 0],
+  ["COPILOT_AGENT_JOB_ID", (v) => v.length > 0],
+  ["AI_AGENT", (v) => v.length > 0]
 ];
+MARKERS.map(
+  ([name]) => name
+);
 function agentSessionMarker(env = process.env) {
   for (const [name, test] of MARKERS) {
     const value = env[name];
@@ -20763,7 +20803,10 @@ async function moduleReleaseCommand(slugArg, options) {
   if (resuming && (options.commitSha !== void 0 || options.bump !== void 0 || options.noWait)) {
     return usage2("--build only reads an existing release; do not combine it with --commit-sha, --bump or --no-wait.");
   }
-  if (!resuming && (!options.commitSha || !FULL_SHA.test(options.commitSha))) {
+  if (!resuming && options.commitSha !== void 0 && !FULL_SHA.test(options.commitSha)) {
+    return usage2("--commit-sha requires the full 40-character SHA already pushed to the linked repository.");
+  }
+  if (!resuming && options.commitSha === void 0 && !options.defaultBranchHead) {
     return usage2("--commit-sha requires the full 40-character SHA already pushed to the linked repository.");
   }
   const bump = options.bump ?? "minor";
@@ -20786,7 +20829,7 @@ async function moduleReleaseCommand(slugArg, options) {
       return usage2("Release creates a version. Pass --yes to confirm in non-interactive or --json mode.");
     }
     const answer = await select({
-      message: `Release ${slug} at ${options.commitSha} with a ${bump} bump?`,
+      message: `Release ${slug} at ${options.commitSha ?? "the head of its default branch"} with a ${bump} bump?`,
       options: [{ value: "cancel", label: "Cancel" }, { value: "release", label: "Release this revision" }],
       initialValue: "cancel"
     });
@@ -20801,7 +20844,7 @@ async function moduleReleaseCommand(slugArg, options) {
   if (!resuming) {
     try {
       initial = await apiRequest("POST", `/api/modules/${moduleId}/builds`, {
-        commit_sha: pinnedSha,
+        ...pinnedSha !== void 0 ? { commit_sha: pinnedSha } : {},
         version_bump: bump
       }, auth);
     } catch (err) {
@@ -20815,12 +20858,13 @@ async function moduleReleaseCommand(slugArg, options) {
       if (!json && isTransientPollError(err)) info("Check the module build history in Dashwise before retrying; the release may already be queued.");
       return reportRefusal(err, { module: slug }, { json, action: "Release" });
     }
-    if (!isRepositoryBuild(initial, moduleId) || initial.commit_sha.toLowerCase() !== pinnedSha) {
+    if (!isRepositoryBuild(initial, moduleId) || pinnedSha !== void 0 && initial.commit_sha.toLowerCase() !== pinnedSha) {
       return reportCliError("Release response did not confirm the requested repository revision. Check the module build history before retrying.", { json });
     }
     buildId = initial.id;
   }
   const id = buildId;
+  options.onBuildId?.(id);
   const resume = `dashwise module release ${slug} --build ${id}`;
   if (!json) info(`Build #${id}. Resume checking: ${code(resume)}`);
   if (options.noWait && isRepositoryBuild(initial, moduleId) && (initial.status === "queued" || initial.status === "building")) {
@@ -20859,6 +20903,13 @@ async function moduleReleaseCommand(slugArg, options) {
       }
       if (json) out(JSON.stringify(value));
       else success(`Released ${slug} v${value.version} (build #${id}, revision ${pinnedSha}).`);
+      options.onReleased?.({
+        id,
+        module_id: moduleId,
+        commit_sha: pinnedSha,
+        version: value.version,
+        module_version_id: value.module_version_id
+      });
       return 0;
     }
     if (value.status === "failed") {
@@ -20900,6 +20951,248 @@ async function moduleReleaseCommand(slugArg, options) {
   }
 }
 
+// src/commands/module/build-log.ts
+init_api_client();
+init_config();
+init_manifest_io();
+init_output();
+init_permission_hint();
+var RUNNING = /* @__PURE__ */ new Set(["queued", "building"]);
+var FOLLOW_BASE_MS = 5e3;
+var FOLLOW_MAX_MS = 1e4;
+var MIN_OVERLAP = 64;
+function newLogText(printed, next) {
+  if (printed === "") return { text: next, moved: false };
+  if (next.startsWith(printed)) return { text: next.slice(printed.length), moved: false };
+  const min = Math.min(MIN_OVERLAP, printed.length);
+  const head = next.slice(0, min);
+  for (let j = printed.indexOf(head); j !== -1; j = printed.indexOf(head, j + 1)) {
+    const tail = printed.slice(j);
+    if (tail.length >= min && next.startsWith(tail)) {
+      return { text: next.slice(tail.length), moved: false };
+    }
+  }
+  return { text: next, moved: true };
+}
+function sanitizeForTerminal(text4, keepColour = false) {
+  const ESCAPE = /\u001b(?:\[[0-?]*[ -/]*[@-~]|\][\s\S]*?(?:\u0007|\u001b\\|$)|[PX^_][\s\S]*?(?:\u001b\\|$)|[ -/]*[0-~]|$)/g;
+  const SGR = /^\u001b\[[0-9;]*m$/;
+  return text4.replace(/\r\n/g, "\n").replace(ESCAPE, (seq) => keepColour && SGR.test(seq) ? seq : "").replace(
+    /[\u0000-\u0008\u000b-\u001f\u007f-\u009f]/g,
+    (ch, at, all) => (
+      // Keep the ESC that opens a kept SGR sequence; drop every other control.
+      ch === "\x1B" && keepColour && SGR.test((/^\u001b\[[0-9;]*m/.exec(all.slice(at)) ?? [""])[0]) ? ch : ""
+    )
+  );
+}
+async function moduleBuildLogCommand(slugArg, buildIdArg, options) {
+  const json = options.json;
+  const usage2 = (message) => reportCliError(message, { json, code: "USAGE" });
+  let slug = slugArg;
+  let rawId = buildIdArg;
+  if (rawId === void 0 && slug !== void 0 && /^\d+$/.test(slug)) {
+    rawId = slug;
+    slug = void 0;
+  }
+  const buildId = rawId === void 0 ? Number.NaN : Number(rawId);
+  if (!Number.isSafeInteger(buildId) || buildId <= 0) {
+    return usage2("Pass the build id: `dashwise module build-log [slug] <buildId>` (ids are in `dashwise module status`).");
+  }
+  if (json && options.follow) return usage2("--follow streams text; drop --json.");
+  if (!slug) {
+    try {
+      const local = readManifest(options.dir)?.module?.slug;
+      if (typeof local === "string" && local) slug = local;
+    } catch {
+    }
+  }
+  if (!slug) return usage2("Pass a module slug or run from a directory with a valid module.json.");
+  const timeoutMs = (options.timeoutSec ?? 900) * 1e3;
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) return usage2("--timeout expects a positive number of seconds.");
+  const cfg = readConfig();
+  if (!isLoggedIn() || !cfg) return reportCliError("Not logged in. Run `dashwise login` first.", { json });
+  const auth = { baseUrl: resolveApiUrl(), auth: { token: cfg.token } };
+  let moduleId;
+  try {
+    const mod = await getModuleBySlug(slug, auth);
+    moduleId = mod.id;
+    slug = mod.slug;
+  } catch (err) {
+    return reportRefusal(err, { module: slug }, { json, action: "Resolving the module" });
+  }
+  const read = async () => {
+    try {
+      return await getModuleBuildLog(moduleId, buildId, auth);
+    } catch (err) {
+      if (err instanceof ApiError && err.code === "FEATURE_DISABLED") {
+        return reportCliError(
+          "Build logs are not available on this Dashwise yet (the backend serves them once its build-log scrubber is switched on).",
+          { json }
+        );
+      }
+      return reportRefusal(err, { module: slug }, { json, action: `Reading the log of build #${buildId}` });
+    }
+  };
+  const first = await read();
+  if (typeof first === "number") return first;
+  if (json) {
+    out(JSON.stringify(first));
+    return 0;
+  }
+  const printLog = (view, printed2) => {
+    if (!view.available || view.text === null) return printed2;
+    const delta = newLogText(printed2, view.text);
+    if (delta.moved) info(dim("\u2026 (earlier lines scrolled out of the window the server keeps)"));
+    if (delta.text) {
+      const safe = sanitizeForTerminal(delta.text, Boolean(process.stdout.isTTY));
+      process.stdout.write(safe.endsWith("\n") ? safe : `${safe}
+`);
+    }
+    return view.text;
+  };
+  if (!first.available && !(options.follow && RUNNING.has(first.status))) {
+    info(`Build #${buildId} (${first.status}) has no log: it did not run on the build service, or the log expired.`);
+    return 0;
+  }
+  if (first.truncated) info(dim("(showing the newest part of the log)"));
+  let printed = printLog(first, "");
+  const footer = (view) => {
+    if (view.redactions > 0) info(dim(`${view.redactions} value(s) were hidden by the server's scrubber.`));
+  };
+  if (!options.follow || !RUNNING.has(first.status)) {
+    footer(first);
+    return 0;
+  }
+  const deadline = Date.now() + timeoutMs;
+  let last = first;
+  const base = options.pollIntervalMs ?? FOLLOW_BASE_MS;
+  const cap = options.pollIntervalMs !== void 0 ? options.pollIntervalMs * 2 : FOLLOW_MAX_MS;
+  let interval = base;
+  while (Date.now() < deadline) {
+    await new Promise(
+      (resolve16) => setTimeout(resolve16, Math.min(interval, Math.max(0, deadline - Date.now())))
+    );
+    let view;
+    try {
+      view = await getModuleBuildLog(moduleId, buildId, auth);
+    } catch (err) {
+      if (isTransientPollError(err)) continue;
+      return reportRefusal(err, { module: slug }, { json, action: `Reading the log of build #${buildId}` });
+    }
+    const grew = view.text !== null && view.text !== last.text;
+    interval = grew ? base : Math.min(cap, Math.round(interval * 1.5));
+    printed = printLog(view, printed);
+    last = view;
+    if (!RUNNING.has(view.status)) {
+      footer(view);
+      if (view.status === "failed") {
+        fail(`Build #${buildId} failed.`);
+        return 1;
+      }
+      info(`Build #${buildId}: ${view.status}.`);
+      return 0;
+    }
+  }
+  warn(`Stopped following build #${buildId} (still ${last.status}). Resume: ${code(`dashwise module build-log ${slug} ${buildId} --follow`)}`);
+  return EXIT_TIMED_OUT;
+}
+
+// src/commands/module/ship.ts
+init_api_client();
+init_config();
+init_manifest_io();
+init_output();
+init_permission_hint();
+async function moduleShipCommand(slugArg, options) {
+  const marker = agentSessionMarker();
+  if (marker !== null) {
+    fail(
+      `\`dashwise module ship\` takes a module live, which a person does (detected an AI agent session: ${marker}). An agent may release (${code("dashwise module release --commit-sha <sha> --yes")}); a person then installs it.`
+    );
+    return 2;
+  }
+  if (options.build !== void 0 && options.commitSha !== void 0) {
+    fail("--build resumes an existing release; do not combine it with --commit-sha.");
+    return 1;
+  }
+  const commitSha = options.build !== void 0 ? void 0 : options.commitSha ?? await defaultBranchHead(slugArg, options.dir);
+  if (options.commitSha !== void 0) {
+    info(`Releasing ${options.commitSha.slice(0, 12)} (--commit-sha).`);
+  }
+  let released = null;
+  let buildId = options.build;
+  const releaseExit = await moduleReleaseCommand(slugArg, {
+    ...options.dir !== void 0 ? { dir: options.dir } : {},
+    ...commitSha !== void 0 ? { commitSha } : {},
+    ...options.build !== void 0 ? { build: options.build } : {},
+    ...options.bump !== void 0 && options.build === void 0 ? { bump: options.bump } : {},
+    ...options.timeoutSec !== void 0 ? { timeoutSec: options.timeoutSec } : {},
+    ...options.pollIntervalMs !== void 0 ? { pollIntervalMs: options.pollIntervalMs } : {},
+    // `ship` is the person's go for the release; the install below asks.
+    yes: true,
+    defaultBranchHead: commitSha === void 0 && options.build === void 0,
+    onBuildId: (id) => {
+      buildId = id;
+    },
+    onReleased: (build2) => {
+      released = build2;
+    }
+  });
+  if (releaseExit === EXIT_TIMED_OUT && buildId !== void 0) {
+    info(
+      `Resume the ship (wait for build #${buildId}, then install it): ${code(["dashwise module ship", slugArg, `--build ${buildId}`].filter(Boolean).join(" "))}`
+    );
+  }
+  if (releaseExit !== 0) return releaseExit;
+  const build = released;
+  if (!build) {
+    fail("The release finished without naming its version; nothing was installed.");
+    return 1;
+  }
+  info(`Installing v${build.version} (build #${build.id}, revision ${build.commit_sha.slice(0, 12)}).`);
+  return moduleInstallCommand(slugArg, {
+    ...options.dir !== void 0 ? { dir: options.dir } : {},
+    ...options.workspace !== void 0 ? { workspace: options.workspace } : {},
+    ...options.installation !== void 0 ? { installation: options.installation } : {},
+    ...options.keepDevInstall !== void 0 ? { keepDevInstall: options.keepDevInstall } : {},
+    ...options.replaceDevInstall !== void 0 ? { replaceDevInstall: options.replaceDevInstall } : {},
+    ...options.yes !== void 0 ? { yes: options.yes } : {},
+    version: build.version
+  });
+}
+async function defaultBranchHead(slugArg, dir) {
+  const cfg = readConfig();
+  let slug = slugArg;
+  if (!slug) {
+    try {
+      slug = readManifest(dir)?.module?.slug;
+    } catch {
+      slug = void 0;
+    }
+  }
+  if (!slug || !cfg || !isLoggedIn()) return void 0;
+  const auth = { baseUrl: resolveApiUrl(), auth: { token: cfg.token } };
+  try {
+    const mod = await getModuleBySlug(slug, auth);
+    const plan = await apiRequest("GET", `/api/modules/${mod.id}/builds/release-plan`, void 0, auth);
+    const sha = plan.default_branch_sha ?? void 0;
+    if (!sha || !/^[0-9a-f]{40}$/i.test(sha)) {
+      info("Releasing the head of the default branch.");
+      return void 0;
+    }
+    info(`Releasing ${sha.slice(0, 12)} from ${plan.default_branch ?? "the default branch"}.`);
+    if (plan.pending_branch) {
+      warn(
+        `Newer work on ${plan.pending_branch.name}${plan.pending_branch.commits_ahead ? ` (${plan.pending_branch.commits_ahead} commit(s) ahead)` : ""} is not in this release: merge it to ${plan.default_branch ?? "the default branch"} first to ship it.`
+      );
+    }
+    return sha.toLowerCase();
+  } catch {
+    info("Releasing the head of the default branch.");
+    return void 0;
+  }
+}
+
 // src/commands/module/status.ts
 init_api_client();
 init_config();
@@ -21760,9 +22053,9 @@ async function moduleValidateCommand(options) {
     return 1;
   }
 }
-function readIssues(context) {
-  if (!context) return [];
-  const v = context["issues"];
+function readIssues(context2) {
+  if (!context2) return [];
+  const v = context2["issues"];
   if (!Array.isArray(v)) return [];
   return v.map((entry) => {
     if (!entry || typeof entry !== "object") return null;
@@ -23344,9 +23637,9 @@ async function pushManifest(ctx) {
     return { ok: false, rejected: false };
   }
 }
-function extractIssues(context) {
-  if (!context) return [];
-  const raw = context.issues;
+function extractIssues(context2) {
+  if (!context2) return [];
+  const raw = context2.issues;
   if (!Array.isArray(raw)) return [];
   return raw.map((i) => {
     if (typeof i === "string") return i;
@@ -24130,6 +24423,356 @@ function surfaceOriginsError(err) {
   return 1;
 }
 
+// src/commands/secrets.ts
+init_api_client();
+init_output();
+var KEY_SHAPE = /^[A-Z][A-Z0-9_]{0,63}$/;
+function context(opts) {
+  try {
+    return loadContext5(opts);
+  } catch (err) {
+    fail(err.message);
+    return null;
+  }
+}
+function interactive() {
+  return Boolean(process.stdin.isTTY && process.stdout.isTTY);
+}
+async function secretsListCommand(options) {
+  const ctx = context(options);
+  if (!ctx) return 1;
+  let resp;
+  try {
+    resp = await listInstallationSecrets(ctx.installationId, ctx.requestOptions);
+  } catch (err) {
+    return surfaceSecretsError(err);
+  }
+  const set = new Set(resp.set);
+  const declared = new Set(resp.declared.map((d) => d.key));
+  if (options.json) {
+    process.stdout.write(
+      `${JSON.stringify(
+        {
+          installation_id: ctx.installationId,
+          declared: resp.declared.map((d) => ({
+            key: d.key,
+            description: d.description,
+            set: set.has(d.key)
+          })),
+          // Stored but no longer declared by the installed version: not
+          // delivered to the app; `set` removes them.
+          undeclared_set: resp.set.filter((k) => !declared.has(k))
+        },
+        null,
+        2
+      )}
+`
+    );
+    return 0;
+  }
+  info(`Secrets of ${code(ctx.slug)} ${dim("(names only; values are never shown)")}:`);
+  if (resp.declared.length === 0) {
+    info(`  ${dim("(the module declares none in module.json#runtime.secrets)")}`);
+  }
+  for (const d of resp.declared) {
+    const state = set.has(d.key) ? "set" : dim("not set");
+    process.stdout.write(
+      `  ${d.key}  ${state}${d.description ? `  ${dim(d.description)}` : ""}
+`
+    );
+  }
+  const stray = resp.set.filter((k) => !declared.has(k));
+  if (stray.length > 0) {
+    warn(
+      `Stored but no longer declared (not delivered): ${stray.join(", ")}. The next ${code("dashwise secrets set")} removes them.`
+    );
+  }
+  return 0;
+}
+function parseEnvFile(text4) {
+  const out2 = {};
+  const lines = text4.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i++) {
+    const n = i + 1;
+    const line = lines[i].replace(/^\s+/, "");
+    if (line === "" || line.startsWith("#")) continue;
+    const m = /^(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.*)$/.exec(line);
+    if (!m) {
+      throw new Error(`line ${n} is not KEY=value (no spaces around "=")`);
+    }
+    const [, key, raw] = m;
+    out2[key] = parseValue(raw, n);
+  }
+  return out2;
+}
+function parseValue(raw, n) {
+  const quote2 = raw[0];
+  if (quote2 === '"' || quote2 === "'") {
+    let value = "";
+    let j = 1;
+    for (; j < raw.length; j++) {
+      const ch = raw[j];
+      if (ch === quote2) break;
+      if (quote2 === '"' && ch === "\\" && j + 1 < raw.length) {
+        const next = raw[++j];
+        value += next === "n" ? "\n" : next === '"' || next === "\\" ? next : `\\${next}`;
+        continue;
+      }
+      value += ch;
+    }
+    if (j >= raw.length) throw new Error(`line ${n}: the quoted value is not closed`);
+    const rest = raw.slice(j + 1);
+    if (rest.trim() !== "" && !/^\s+#/.test(rest)) {
+      throw new Error(`line ${n}: only a " # comment" may follow the closing quote`);
+    }
+    return value;
+  }
+  if (/^\s|\s$/.test(raw)) {
+    throw new Error(
+      `line ${n}: an unquoted value may not start or end with a space; quote it`
+    );
+  }
+  if (/\s#/.test(raw)) {
+    throw new Error(
+      `line ${n}: an unquoted value may not contain " #" (comment or value?); quote it`
+    );
+  }
+  return raw;
+}
+async function readStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(chunk);
+  return Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
+}
+async function secretsSetCommand(keyArgs, options) {
+  const inline = keyArgs.findIndex((k) => k.includes("=") || !KEY_SHAPE.test(k));
+  if (inline !== -1) {
+    fail(
+      `Argument ${inline + 1} is not a secret key name; values must not be passed as arguments (shell history). Enter values at the prompt, or use ${code("--from-stdin")} or ${code("--from-env-file <path>")}.`
+    );
+    return 1;
+  }
+  if (options.fromStdin && options.fromEnvFile) {
+    fail(`Use one of ${code("--from-stdin")} or ${code("--from-env-file")}, not both.`);
+    return 1;
+  }
+  if (options.keys && !options.fromEnvFile) {
+    fail(`${code("--keys")} goes with ${code("--from-env-file")}.`);
+    return 1;
+  }
+  const ctx = context(options);
+  if (!ctx) return 1;
+  let current;
+  try {
+    current = await listInstallationSecrets(ctx.installationId, ctx.requestOptions);
+  } catch (err) {
+    return surfaceSecretsError(err);
+  }
+  const declared = current.declared.map((d) => d.key);
+  let keys = [...new Set(keyArgs)];
+  const values = {};
+  if (options.fromEnvFile) {
+    let fileValues;
+    try {
+      fileValues = parseEnvFile(readFileSync(options.fromEnvFile, "utf8"));
+    } catch (err) {
+      fail(`Could not read ${code(options.fromEnvFile)}: ${err.message}`);
+      return 1;
+    }
+    const wanted = options.keys ? options.keys.split(",").map((k) => k.trim()).filter(Boolean) : keys.length > 0 ? keys : declared.filter((k) => k in fileValues);
+    const undeclaredAt2 = wanted.findIndex(
+      (k) => !KEY_SHAPE.test(k) || !declared.includes(k)
+    );
+    if (undeclaredAt2 !== -1) {
+      fail(
+        `${options.keys ? `Item ${undeclaredAt2 + 1} of --keys` : `Argument ${undeclaredAt2 + 1}`} is not a declared key; values must not be passed as arguments. Declared: ${declared.length > 0 ? declared.join(", ") : "none"}.`
+      );
+      return 1;
+    }
+    const missing = wanted.filter((k) => !(k in fileValues));
+    if (missing.length > 0) {
+      fail(`Not in ${code(options.fromEnvFile)}: ${missing.join(", ")}.`);
+      return 1;
+    }
+    for (const k of wanted) values[k] = fileValues[k];
+    keys = wanted;
+  } else if (options.fromStdin) {
+    if (keys.length !== 1) {
+      fail(`${code("--from-stdin")} reads the value of exactly one key: ${code("dashwise secrets set KEY --from-stdin")}.`);
+      return 1;
+    }
+    if (process.stdin.isTTY) {
+      info(`Nothing is piped into stdin; asking at a hidden prompt instead.`);
+    } else {
+      values[keys[0]] = await readStdin();
+    }
+  } else {
+    if (keys.length === 0) {
+      fail(
+        `Name the keys to set (${declared.length > 0 ? declared.join(", ") : "none declared"}), or use ${code("--from-env-file <path>")}.`
+      );
+      return 1;
+    }
+    if (!interactive()) {
+      fail(`No terminal to prompt in. Use ${code("--from-stdin")} or ${code("--from-env-file <path>")}.`);
+      return 1;
+    }
+  }
+  if (keys.length === 0) {
+    fail(`Nothing to set: no declared key was found.`);
+    return 1;
+  }
+  const undeclaredAt = keys.findIndex(
+    (k) => !KEY_SHAPE.test(k) || !declared.includes(k)
+  );
+  if (undeclaredAt !== -1) {
+    const where = options.keys ? `Item ${undeclaredAt + 1} of --keys` : keyArgs.length > 0 ? `Argument ${keyArgs.indexOf(keys[undeclaredAt]) + 1}` : `Key ${undeclaredAt + 1}`;
+    fail(
+      `${where} is not a declared key; values must not be passed as arguments. Declared: ${declared.length > 0 ? declared.join(", ") : "none"}.`
+    );
+    return 1;
+  }
+  const removed = current.set.filter((k) => !keys.includes(k));
+  if (removed.length > 0 && !options.yes) {
+    if (!interactive()) {
+      fail(
+        `This replaces the whole map and would remove ${removed.join(", ")}. Include them, or pass ${code("--yes")} to remove them.`
+      );
+      return 1;
+    }
+    const ok = await confirm$1({
+      message: `This replaces the whole map: ${removed.join(", ")} will be removed. Continue?`,
+      initialValue: false
+    });
+    if (isCancel(ok) || ok !== true) {
+      info("Nothing changed.");
+      return 1;
+    }
+  }
+  for (const k of keys) {
+    if (k in values) continue;
+    const entered = await password({ message: `Value for ${k}` });
+    if (isCancel(entered)) {
+      info("Nothing changed.");
+      return 1;
+    }
+    values[k] = entered;
+  }
+  const empty = keys.filter((k) => values[k] === "");
+  if (empty.length > 0) {
+    fail(`Empty value for ${empty.join(", ")}; nothing changed. (To remove every value: ${code("dashwise secrets clear")}.)`);
+    return 1;
+  }
+  try {
+    const now = await listInstallationSecrets(ctx.installationId, ctx.requestOptions);
+    const before = [...current.set].sort().join(",");
+    if ([...now.set].sort().join(",") !== before) {
+      fail(
+        `The set keys changed while you were entering values (now: ${now.set.length > 0 ? [...now.set].sort().join(", ") : "none"}). Nothing changed; run ${code("dashwise secrets set")} again.`
+      );
+      return 1;
+    }
+  } catch (err) {
+    return surfaceSecretsError(err);
+  }
+  let resp;
+  try {
+    resp = await setInstallationSecrets(ctx.installationId, values, ctx.requestOptions);
+  } catch (err) {
+    return surfaceSecretsError(err);
+  }
+  if (options.json) {
+    process.stdout.write(
+      `${JSON.stringify({ installation_id: ctx.installationId, keys_set: resp.keys_set, removed, runtime: resp.runtime ?? null }, null, 2)}
+`
+    );
+    return 0;
+  }
+  success(`Saved ${resp.keys_set.join(", ")} for ${code(ctx.slug)}.`);
+  if (removed.length > 0) info(`  ${dim(`Removed: ${removed.join(", ")}.`)}`);
+  info(`  ${dim(runtimeLine(resp.runtime))}`);
+  return 0;
+}
+function runtimeLine(runtime) {
+  const status = runtime?.status;
+  switch (status) {
+    case "queued":
+      return "The running app picks the new values up on its next request (about a minute).";
+    case "deferred":
+      return "Another change of this app is in progress; the values are applied right after it.";
+    case "no_runtime":
+      return "Nothing is deployed yet; the next deploy carries the values.";
+    case "frozen":
+      return "This installation is held; the values apply once it is released.";
+    case void 0:
+      return "The values reach the hosted app at its next deploy (or are read at runtime, where the backend delivers them).";
+    default:
+      return `Runtime: ${status}.`;
+  }
+}
+async function secretsClearCommand(options) {
+  const ctx = context(options);
+  if (!ctx) return 1;
+  if (!options.yes) {
+    if (!interactive()) {
+      fail(`This removes every value. Pass ${code("--yes")} to confirm.`);
+      return 1;
+    }
+    const ok = await confirm$1({
+      message: `Remove every secret value of ${ctx.slug}?`,
+      initialValue: false
+    });
+    if (isCancel(ok) || ok !== true) {
+      info("Nothing changed.");
+      return 1;
+    }
+  }
+  try {
+    await clearInstallationSecrets(ctx.installationId, ctx.requestOptions);
+  } catch (err) {
+    return surfaceSecretsError(err);
+  }
+  success(`Removed every secret value of ${code(ctx.slug)}.`);
+  return 0;
+}
+function surfaceSecretsError(err) {
+  if (err instanceof ApiError) {
+    const ctx = err.context ?? {};
+    switch (err.code) {
+      case "UNAUTHENTICATED":
+        fail(`Auth rejected by backend. Your CLI token may be stale \u2014 run ${code("dashwise login")} then retry.`);
+        return 1;
+      case "SECRETS_ENV_TOO_LARGE": {
+        const largest = Array.isArray(ctx.largest_keys) ? ctx.largest_keys.map(String).join(", ") : "";
+        fail(
+          `These values take ${String(ctx.bytes ?? "?")} bytes; an installation may hold at most ${String(ctx.budget ?? 3072)}. Shorten or remove a value${largest ? ` (largest: ${largest})` : ""}. Nothing changed.`
+        );
+        return 1;
+      }
+      case "UNKNOWN_SECRET_KEY":
+        fail(`The backend does not know these keys: ${Array.isArray(ctx.unknown) ? ctx.unknown.join(", ") : err.message}.`);
+        return 1;
+      case "SECRETS_NOT_CONFIGURED":
+        fail("Secrets are not configured on this backend (its master key is unset).");
+        return 1;
+      case "FORBIDDEN":
+      case "PERMISSION_DENIED":
+      case "NOT_WORKSPACE_ADMIN":
+        fail("Not authorized. Setting secrets needs a company admin or an installation manager.");
+        return 1;
+      case "NOT_FOUND":
+      case "INSTALLATION_NOT_FOUND":
+        fail(`Installation not found (or not visible to you). Check the id with ${code("dashwise module status <slug>")}.`);
+        return 1;
+      default:
+        fail(`Backend rejected: ${err.code} ${err.status} \u2014 ${err.message}`);
+        return 1;
+    }
+  }
+  fail(`Secrets operation failed: ${err.message}`);
+  return 1;
+}
+
 // src/commands/env-export.ts
 init_api_client();
 init_config();
@@ -26418,6 +27061,55 @@ originsCmd.command("remove <url>").description("Remove an SSO callback origin fr
     ...cmdOpts.install !== void 0 ? { install: cmdOpts.install } : {}
   });
 });
+var secretsCmd = program.command("secrets").description(
+  "Manage the current module install's runtime secrets (write-only: names are shown, values never are)."
+);
+secretsCmd.command("list").description("Show the declared secret keys and which have a value (names only).").option("--dir <path>", "Project root (default: current directory).").option(
+  "--install <id>",
+  "Target a specific installation id instead of the cached dev install (production installs included). Find ids via `dashwise module status <slug>`.",
+  parseIntOption
+).option("--json", "Emit JSON instead of the human-friendly list.").action(async (cmdOpts) => {
+  process.exitCode = await secretsListCommand({
+    ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+    ...cmdOpts.install !== void 0 ? { install: cmdOpts.install } : {},
+    ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
+  });
+});
+secretsCmd.command("set [keys...]").description(
+  "Set secret values, REPLACING the whole map (keys set now but not given are removed; you are asked first). Values come from a hidden prompt, --from-stdin or --from-env-file, never from the command line."
+).option("--dir <path>", "Project root (default: current directory).").option(
+  "--install <id>",
+  "Target a specific installation id instead of the cached dev install (production installs included). Find ids via `dashwise module status <slug>`.",
+  parseIntOption
+).option("--from-stdin", "Read the value of exactly one key from stdin.").option("--from-env-file <path>", "Read values from a dotenv-style file (all declared keys found in it, or the keys named).").option("--keys <list>", "With --from-env-file: only these keys (comma-separated).").option("-y, --yes", "Remove keys that are set now but not in the new map without asking.").option("--json", "Emit a JSON summary (key names only).").addHelpText(
+  "before",
+  pc.bold(
+    "set REPLACES THE WHOLE MAP: every key you do not give is removed (you are asked first; --yes skips the question)."
+  )
+).action(
+  async (keys, cmdOpts) => {
+    process.exitCode = await secretsSetCommand(keys ?? [], {
+      ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+      ...cmdOpts.install !== void 0 ? { install: cmdOpts.install } : {},
+      ...cmdOpts.fromStdin !== void 0 ? { fromStdin: cmdOpts.fromStdin } : {},
+      ...cmdOpts.fromEnvFile !== void 0 ? { fromEnvFile: cmdOpts.fromEnvFile } : {},
+      ...cmdOpts.keys !== void 0 ? { keys: cmdOpts.keys } : {},
+      ...cmdOpts.yes !== void 0 ? { yes: cmdOpts.yes } : {},
+      ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
+    });
+  }
+);
+secretsCmd.command("clear").description("Remove every secret value of the install.").option("--dir <path>", "Project root (default: current directory).").option(
+  "--install <id>",
+  "Target a specific installation id instead of the cached dev install (production installs included). Find ids via `dashwise module status <slug>`.",
+  parseIntOption
+).option("-y, --yes", "Do not ask for confirmation.").action(async (cmdOpts) => {
+  process.exitCode = await secretsClearCommand({
+    ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+    ...cmdOpts.install !== void 0 ? { install: cmdOpts.install } : {},
+    ...cmdOpts.yes !== void 0 ? { yes: cmdOpts.yes } : {}
+  });
+});
 var envCmd = program.command("env").description("Environment-variable helpers for deploying a module.");
 envCmd.command("export").description(
   "Emit the env vars a deployed module needs to authenticate against Dashwise. By default emits .env-style KEY=value lines; --format = env | json | railway | vercel | fly to wrap in platform-native syntax. Use --new-key <name> to mint + inline an API key in one step."
@@ -26451,6 +27143,36 @@ moduleCmd.command("release [slug]").description("Release an exact pushed reposit
     timeoutSec: opts.timeout
   });
 });
+moduleCmd.command("build-log [slug] [buildId]").description(
+  "Print a build's log, scrubbed by the server (credentials and internal hosts hidden) and bounded to its newest part. One positional is the build id (module from module.json). --follow prints new lines until the build ends."
+).option("--dir <path>", "Project root for module.json slug lookup (default: current directory).").option("--follow", "Keep printing new lines while the build is queued or building.").option("--timeout <seconds>", "Max seconds to follow (default 900); exit 4 means still building.", Number).option("--json", "Emit the log response as JSON (not with --follow).").action(
+  async (slug, buildId, opts) => {
+    process.exitCode = await moduleBuildLogCommand(slug, buildId, {
+      ...opts.dir !== void 0 ? { dir: opts.dir } : {},
+      ...opts.follow !== void 0 ? { follow: opts.follow } : {},
+      ...opts.timeout !== void 0 ? { timeoutSec: opts.timeout } : {},
+      ...opts.json !== void 0 ? { json: opts.json } : {}
+    });
+  }
+);
+moduleCmd.command("ship [slug]").description(
+  "Release and install in one command, for a person: releases the latest push to the default branch (or --commit-sha), waits for the build, then installs that version, showing what the update does to the data and asking once. Refused inside an AI agent session (an agent releases; a person takes it live)."
+).option("--dir <path>", "Project root for module.json slug lookup (default: current directory).").option("--commit-sha <sha>", "Release this pushed revision (full 40-character SHA) instead of the default-branch head.").option("--build <id>", "Resume a ship whose release was still building: wait for that build, then install it. Never queues a release.", parsePositiveIdOption).option("--bump <direction>", "Semver bump: patch | minor | major (default minor).").option("--workspace <slug-or-id>", "Target workspace (as for module install).").option("--installation <id>", "Update exactly this production installation.", parsePositiveIdOption).option("--keep-dev-install", "Install alongside the workspace's dev install (as for module install).").option("--replace-dev-install", "Replace the workspace's dev install (as for module install).").option("-y, --yes", "Skip the install question when nothing is lost. Never accepts data loss.").option("--timeout <seconds>", "Max seconds to wait for the build (default 360); exit 4 means still building.", Number).action(
+  async (slug, opts) => {
+    process.exitCode = await moduleShipCommand(slug, {
+      ...opts.dir !== void 0 ? { dir: opts.dir } : {},
+      ...opts.commitSha !== void 0 ? { commitSha: opts.commitSha } : {},
+      ...opts.build !== void 0 ? { build: opts.build } : {},
+      ...opts.bump !== void 0 ? { bump: opts.bump } : {},
+      ...opts.workspace !== void 0 ? { workspace: opts.workspace } : {},
+      ...opts.installation !== void 0 ? { installation: opts.installation } : {},
+      ...opts.keepDevInstall !== void 0 ? { keepDevInstall: opts.keepDevInstall } : {},
+      ...opts.replaceDevInstall !== void 0 ? { replaceDevInstall: opts.replaceDevInstall } : {},
+      ...opts.yes !== void 0 ? { yes: opts.yes } : {},
+      ...opts.timeout !== void 0 ? { timeoutSec: opts.timeout } : {}
+    });
+  }
+);
 moduleCmd.command("publish").description("Pack the current directory + upload it as a new module version.").option("--dir <path>", "Project root (default: current directory).").option("--bump <direction>", "Semver bump: patch | minor | major.").option("--dry-run", "Validate + upload but do not persist the version row.").option("-y, --yes", "Skip the confirmation prompt (for CI / scripted use).").option(
   "--from-local",
   "Publish local files to a module that has a linked repository (the next repository build replaces them)."
@@ -26874,7 +27596,7 @@ fieldCmd.command("set-type <table-slug> <field-slug> <new-type>").description(
   }
 );
 function getVersion() {
-  return "0.28.1";
+  return "0.30.1";
 }
 function parsePositiveIdOption(value) {
   if (!/^[1-9][0-9]*$/.test(value.trim())) {