@dashai/cli 0.30.1 → 0.31.0

package/dist/bin.js

@@ -5,7 +5,7 @@ import { hostname, tmpdir, platform, homedir } from 'os';
 import { resolve, join, relative, dirname, basename, win32, sep } from 'path';
 import { execFileSync, spawn, spawnSync } from 'child_process';
 import { intro, log, select, isCancel, cancel, spinner, outro, confirm as confirm$1, password, text, multiselect } from '@clack/prompts';
-import { Command, Option } from 'commander';
+import { Command, Option, InvalidArgumentError } from 'commander';
 import open from 'open';
 import AdmZip from 'adm-zip';
 import * as tar from 'tar';
@@ -13013,6 +13013,10 @@ generate\` and the schema commands. When the task needs them:
   a command reports that the login is missing.
 `;
 }
+function hostedAppOrigin(apiUrl) {
+  const host = companyApiHost(apiUrl);
+  return host ? `https://${HOSTED_API_HOSTS[host]}` : null;
+}
 function companyApiHost(apiUrl) {
   if (!apiUrl) return null;
   try {
@@ -13913,325 +13917,68 @@ var init_init = __esm({
   }
 });
 
-// src/lib/manifest-evolution.ts
-function compareManifests(base, head, history = []) {
-  const violations = [];
-  const additions = [];
-  const warnings = [];
-  const v = (rule, where, detail) => violations.push({ rule, where, detail });
-  const baseTables = tablesOf(base);
-  const headTables = tablesOf(head);
-  const everTables = /* @__PURE__ */ new Set();
-  const everFields = /* @__PURE__ */ new Set();
-  for (const m of history) {
-    for (const [slug, t] of tablesOf(m)) {
-      everTables.add(slug);
-      for (const f of t.fields ?? []) everFields.add(`${slug}.${f.slug}`);
-    }
-  }
-  for (const [slug, bt] of baseTables) {
-    const ht = headTables.get(slug);
-    if (!ht) {
-      v("removed_table", slug, "tables are never removed; deprecate instead");
-      continue;
-    }
-    const bf = fieldsOf(bt);
-    const hf = fieldsOf(ht);
-    for (const [fs, f] of bf) {
-      const g = hf.get(fs);
-      const where = `${slug}.${fs}`;
-      if (!g) {
-        v("removed_field", where, "fields are never removed; stop writing it and set human_edit: open");
-        continue;
-      }
-      if (f.type !== g.type) v("retyped_field", where, `${f.type} \u2192 ${g.type}`);
-      if ((f.decimal_places ?? null) !== (g.decimal_places ?? null)) {
-        v("retyped_field", where, `decimal_places ${f.decimal_places ?? "none"} \u2192 ${g.decimal_places ?? "none"}`);
-      }
-      if ((f.target ?? null) !== (g.target ?? null)) v("retyped_field", where, `link target ${f.target} \u2192 ${g.target}`);
-      if (f.required !== true && g.required === true) {
-        v("required_tightened", where, "old rows are empty; enforce it in the tool layer instead");
-      }
-      const bo = f.options ?? [];
-      const ho = g.options ?? [];
-      for (const [i, o] of bo.entries()) {
-        if (!ho.includes(o)) v("removed_option", where, `option "${String(o)}" removed`);
-        else if (ho[i] !== o) {
-          v("reordered_option", where, `option "${String(o)}" moved from ${i} to ${ho.indexOf(o)}; options are append-only`);
-        }
-      }
-      for (const o of ho.slice(bo.length)) if (!bo.includes(o)) additions.push(`option ${where} "${String(o)}"`);
-    }
-    for (const [fs] of hf) {
-      if (bf.has(fs)) continue;
-      if (everFields.has(`${slug}.${fs}`)) {
-        v("slug_reused", `${slug}.${fs}`, "this slug was removed in an earlier version and may not come back");
-      } else additions.push(`field ${slug}.${fs}`);
-    }
-    const hu = new Set(uniqueIndexes(ht));
-    for (const idx of uniqueIndexes(bt)) {
-      if (!hu.has(idx)) v("dropped_unique_index", `${slug}(${idx})`, "a unique index is a protocol lock; it may not be dropped or changed");
-    }
-    const bu = new Set(uniqueIndexes(bt));
-    for (const idx of hu) {
-      if (bu.has(idx)) continue;
-      const overExisting = idx.split(",").some((f) => f.length > 0 && bf.has(f));
-      if (overExisting) {
-        v("unique_on_populated", `${slug}(${idx})`, "a new unique index (indexes[].unique) over existing fields fails on duplicates already stored; add a new field instead");
-      } else additions.push(`unique index ${slug}(${idx})`);
-    }
-  }
-  for (const [slug] of headTables) {
-    if (baseTables.has(slug)) continue;
-    if (everTables.has(slug)) v("slug_reused", slug, "this table slug was removed in an earlier version and may not come back");
-    else additions.push(`table ${slug}`);
-  }
-  const baseViews = new Set((base?.owns?.views ?? []).map((x) => x.slug));
-  const headViews = new Set((head?.owns?.views ?? []).map((x) => x.slug));
-  for (const s of baseViews) if (!headViews.has(s)) warnings.push(`view ${s} removed (callers of qbViews.${s} break)`);
-  for (const s of headViews) if (!baseViews.has(s)) additions.push(`view ${s}`);
-  return { violations, additions, warnings };
+// src/lib/permission-hint.ts
+function str(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
 }
-var tablesOf, fieldsOf, uniqueIndexes;
-var init_manifest_evolution = __esm({
-  "src/lib/manifest-evolution.ts"() {
-    tablesOf = (m) => new Map((m?.owns?.tables ?? []).map((t) => [t.slug, t]));
-    fieldsOf = (t) => new Map((t?.fields ?? []).map((f) => [f.slug, f]));
-    uniqueIndexes = (t) => (t?.indexes ?? []).filter((i) => i.unique === true).map((i) => (i.fields ?? []).join(","));
-  }
-});
-
-// src/commands/module/diff-check.ts
-var diff_check_exports = {};
-__export(diff_check_exports, {
-  EvolutionCheckError: () => EvolutionCheckError,
-  moduleDiffCheckCommand: () => moduleDiffCheckCommand,
-  printEvolutionReport: () => printEvolutionReport,
-  publishEvolutionGate: () => publishEvolutionGate,
-  runEvolutionCheck: () => runEvolutionCheck
-});
-function readJson(path) {
-  try {
-    return JSON.parse(readFileSync(path, "utf8"));
-  } catch (err) {
-    throw new EvolutionCheckError(`could not read ${path}: ${err.message}`);
-  }
+function num(v) {
+  return typeof v === "number" && Number.isFinite(v) ? v : void 0;
 }
-function git(cwd, args) {
-  try {
-    return execFileSync("git", ["-C", cwd, ...args], {
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "pipe"],
-      maxBuffer: 64 * 1024 * 1024
-    });
-  } catch (err) {
-    const stderr = err.stderr?.trim();
-    throw new EvolutionCheckError(`git ${args.join(" ")} failed${stderr ? `: ${stderr}` : ""}`);
-  }
+function featureFromPermission(permission) {
+  const m = permission ? /^workspace\.feature\.([a-z0-9_]+)\.use$/.exec(permission) : null;
+  return m?.[1];
 }
-async function runEvolutionCheck(options) {
-  const projectRoot = resolve(options.dir ?? process.cwd());
-  const headPath = options.head ? resolve(options.head) : join(projectRoot, "module.json");
-  if (!existsSync(headPath)) throw new EvolutionCheckError(`no manifest at ${headPath}`);
-  const head = readJson(headPath);
-  const baseFile = options.baseFile ?? (options.base && existsSync(options.base) ? options.base : void 0);
-  if (baseFile) {
-    const base = readJson(baseFile);
-    return { ...compareManifests(base, head), base: baseFile, head: headPath, history: 0, nothingReleased: false };
-  }
-  if (options.base) {
-    const ref = options.base;
-    const base = JSON.parse(git(projectRoot, ["show", `${ref}:./module.json`]));
-    let history2 = [];
-    if (!options.noHistory) {
-      const shas = git(projectRoot, ["log", "--format=%H", "--reverse", ref, "--", "module.json"]).split("\n").filter(Boolean);
-      history2 = shas.slice(0, -1).map((sha) => JSON.parse(git(projectRoot, ["show", `${sha}:./module.json`])));
-    }
+function featureSubject(ctx) {
+  const feature = str(ctx.feature) ?? featureFromPermission(str(ctx.permission));
+  if (feature && FEATURE_SUBJECTS[feature]) return FEATURE_SUBJECTS[feature];
+  return str(ctx.feature_label) ?? (feature ? `"${feature}"` : void 0);
+}
+function needsAdmin(what, module, ask) {
+  const scope = module ? ` for ${module}` : "";
+  return `${what}${scope} needs a Dashwise admin. Ask your Dashwise admin to ${ask}.`;
+}
+function refusalHint(code2, context2, subject = {}) {
+  const ctx = context2 ?? {};
+  const module = subject.module ?? str(ctx.module_slug);
+  const installationId = subject.installationId ?? num(ctx.installation_id);
+  const installLabel = installationId !== void 0 ? ` (install #${installationId})` : "";
+  const named = module ?? "this module";
+  const reason = str(ctx.reason);
+  if (code2 === "MODULE_CAPABILITY_DENIED" && reason === "authoring_access_required") {
     return {
-      ...compareManifests(base, head, history2),
-      base: `${ref}:module.json`,
-      head: headPath,
-      history: history2.length,
-      nothingReleased: false
+      message: "You need authoring access to export development data; ask someone who manages module access.",
+      needsGrant: true
     };
   }
-  const slug = head.module?.slug;
-  if (!slug) throw new EvolutionCheckError(`${headPath} has no module.slug`);
-  let mod;
-  let versions;
-  try {
-    mod = await apiRequest(
-      "GET",
-      `/api/modules/by-slug/${encodeURIComponent(slug)}`
-    );
-    if (!mod.current_version) {
+  if (code2 === "RAW_DATA_NOT_ALLOWED") {
+    if (reason === "raw_data_write_required") {
       return {
-        violations: [],
-        additions: [],
-        warnings: [],
-        base: "(nothing released)",
-        head: headPath,
-        history: 0,
-        nothingReleased: true
+        message: "You don't have access to change this data. Ask a data list Admin for Editor access in the Data Hub Permissions tab.",
+        needsGrant: true
       };
     }
-    versions = await apiRequest("GET", `/api/modules/${mod.id}/versions`);
-  } catch (err) {
-    const why = err instanceof ApiError ? `${err.code || err.status} ${err.message}` : err.message;
-    throw new EvolutionCheckError(
-      `could not read the released manifest of ${slug} (${why}); pass --base <ref|file> to check offline`
-    );
-  }
-  const released = versions.find((v) => v.version === mod.current_version);
-  if (!released?.manifest_jsonb) {
-    throw new EvolutionCheckError(
-      `the platform returned no manifest for ${slug} v${mod.current_version}; pass --base <ref|file> to check offline`
-    );
-  }
-  const releasedAt = released.created_on ? Date.parse(released.created_on) : Number.POSITIVE_INFINITY;
-  const history = options.noHistory ? [] : versions.filter((v) => v !== released && v.manifest_jsonb && v.created_on && Date.parse(v.created_on) < releasedAt).sort((a, b) => Date.parse(a.created_on) - Date.parse(b.created_on)).map((v) => v.manifest_jsonb);
-  return {
-    ...compareManifests(released.manifest_jsonb, head, history),
-    base: `${slug} v${mod.current_version} (released)`,
-    head: headPath,
-    history: history.length,
-    nothingReleased: false
-  };
-}
-function printEvolutionReport(r, print = out) {
-  print(`module diff --check: ${r.head} against ${r.base} (${r.history} older version${r.history === 1 ? "" : "s"} scanned)`);
-  for (const a of r.additions) print(`  + ${a}`);
-  for (const w of r.warnings) print(`  ! ${w}`);
-  for (const x of r.violations) print(`  \u2717 ${x.rule}: ${x.where}: ${x.detail}`);
-}
-async function moduleDiffCheckCommand(options) {
-  let r;
-  try {
-    r = await runEvolutionCheck(options);
-  } catch (err) {
-    if (err instanceof EvolutionCheckError) {
-      if (options.json) out(JSON.stringify({ ok: false, error: { code: "CHECK_FAILED", message: err.message } }));
-      else fail(`module diff --check: ${err.message}`);
-      return 2;
+    if (reason === "installation_access_required") {
+      return {
+        message: "You cannot open this installation with your current access; ask someone who manages installation access.",
+        needsGrant: true
+      };
     }
-    throw err;
-  }
-  if (options.json) {
-    out(JSON.stringify({ ok: r.violations.length === 0, ...r }, null, 2));
-    return r.violations.length === 0 ? 0 : 1;
+    return {
+      message: "You don't have access to view this data. Ask a data list Admin for Viewer access in the Data Hub Permissions tab.",
+      needsGrant: true
+    };
   }
-  if (r.nothingReleased) {
-    success("Nothing released yet: every change is additive.");
-    return 0;
+  if (code2 === "VALIDATION_ERROR" && reason === "module_context_required") {
+    return {
+      message: "Open the intended module project and select the company and installation.",
+      needsGrant: false
+    };
   }
-  printEvolutionReport(r);
-  if (r.violations.length === 0) {
-    success("additive");
-    return 0;
-  }
-  fail(`${r.violations.length} violation(s): not additive. Released copies would lose data or fail to upgrade.`);
-  info(`Add a new field or table instead, and stop writing the old one (${code('human_edit: "open"')}).`);
-  return 1;
-}
-async function publishEvolutionGate(projectRoot, strict) {
-  let r;
-  try {
-    r = await runEvolutionCheck({ dir: projectRoot });
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    if (strict) {
-      fail(`Evolution check could not run (${msg}). Refusing with --strict. Nothing was published.`);
-      return 1;
-    }
-    warn(`Evolution check skipped: ${msg}.`);
-    return 0;
-  }
-  if (r.nothingReleased || r.violations.length === 0) return 0;
-  printEvolutionReport(r, (s) => (strict ? fail : warn)(s));
-  if (strict) {
-    fail(
-      `module.json is not an additive evolution of the released version (${r.violations.length} violation(s)). Refusing with --strict. Nothing was published.`
-    );
-    return 1;
-  }
-  warn(
-    `module.json is not an additive evolution of the released version: installs that upgrade lose the data above. ${code("--strict")} turns this into a refusal; ${code("dashwise module diff --check")} shows it on its own.`
-  );
-  return 0;
-}
-var EvolutionCheckError;
-var init_diff_check = __esm({
-  "src/commands/module/diff-check.ts"() {
-    init_api_client();
-    init_manifest_evolution();
-    init_output();
-    EvolutionCheckError = class extends Error {
-    };
-  }
-});
-
-// src/lib/permission-hint.ts
-function str(v) {
-  return typeof v === "string" && v.length > 0 ? v : void 0;
-}
-function num(v) {
-  return typeof v === "number" && Number.isFinite(v) ? v : void 0;
-}
-function featureFromPermission(permission) {
-  const m = permission ? /^workspace\.feature\.([a-z0-9_]+)\.use$/.exec(permission) : null;
-  return m?.[1];
-}
-function featureSubject(ctx) {
-  const feature = str(ctx.feature) ?? featureFromPermission(str(ctx.permission));
-  if (feature && FEATURE_SUBJECTS[feature]) return FEATURE_SUBJECTS[feature];
-  return str(ctx.feature_label) ?? (feature ? `"${feature}"` : void 0);
-}
-function needsAdmin(what, module, ask) {
-  const scope = module ? ` for ${module}` : "";
-  return `${what}${scope} needs a Dashwise admin. Ask your Dashwise admin to ${ask}.`;
-}
-function refusalHint(code2, context2, subject = {}) {
-  const ctx = context2 ?? {};
-  const module = subject.module ?? str(ctx.module_slug);
-  const installationId = subject.installationId ?? num(ctx.installation_id);
-  const installLabel = installationId !== void 0 ? ` (install #${installationId})` : "";
-  const named = module ?? "this module";
-  const reason = str(ctx.reason);
-  if (code2 === "MODULE_CAPABILITY_DENIED" && reason === "authoring_access_required") {
-    return {
-      message: "You need authoring access to export development data; ask someone who manages module access.",
-      needsGrant: true
-    };
-  }
-  if (code2 === "RAW_DATA_NOT_ALLOWED") {
-    if (reason === "raw_data_write_required") {
-      return {
-        message: "You don't have access to change this data. Ask a data list Admin for Editor access in the Data Hub Permissions tab.",
-        needsGrant: true
-      };
-    }
-    if (reason === "installation_access_required") {
-      return {
-        message: "You cannot open this installation with your current access; ask someone who manages installation access.",
-        needsGrant: true
-      };
-    }
-    return {
-      message: "You don't have access to view this data. Ask a data list Admin for Viewer access in the Data Hub Permissions tab.",
-      needsGrant: true
-    };
-  }
-  if (code2 === "VALIDATION_ERROR" && reason === "module_context_required") {
-    return {
-      message: "Open the intended module project and select the company and installation.",
-      needsGrant: false
-    };
-  }
-  if (code2 === "VALIDATION_ERROR" && reason === "context_mismatch") {
-    return {
-      message: "The selected company and installation do not match; check your selection.",
-      needsGrant: false
-    };
+  if (code2 === "VALIDATION_ERROR" && reason === "context_mismatch") {
+    return {
+      message: "The selected company and installation do not match; check your selection.",
+      needsGrant: false
+    };
   }
   if (code2 === "UNAUTHENTICATED" && reason === "module_api_credential_missing") {
     return {
@@ -14398,107 +14145,364 @@ function reportFailedOutcome(failure, hint, opts) {
         ...opts.extra
       })
     );
-  } else {
-    fail(hint?.message ?? opts.fallback);
+  } else {
+    fail(hint?.message ?? opts.fallback);
+  }
+  return hint?.needsGrant ? EXIT_NEEDS_GRANT : 1;
+}
+function isTransientPollError(err) {
+  if (!(err instanceof ApiError)) return true;
+  return err.status === 0 || err.status === 429 || err.status >= 500;
+}
+function isTypedRequestError(err) {
+  if (err instanceof ApiError) return true;
+  if (!(err instanceof Error)) return false;
+  const candidate = err;
+  return typeof candidate.code === "string" && typeof candidate.status === "number" && (candidate.context === void 0 || candidate.context !== null && typeof candidate.context === "object" && !Array.isArray(candidate.context));
+}
+function reportRefusal(err, subject, opts) {
+  const writeJson = (message) => {
+    if (opts.stderr) process.stderr.write(`${message}
+`);
+    else out(message);
+  };
+  if (!isTypedRequestError(err)) {
+    const message = err?.message ?? String(err);
+    if (opts.json) {
+      writeJson(
+        JSON.stringify({
+          error: {
+            code: "CLI_ERROR",
+            message: message.replace(ANSI, ""),
+            status: null,
+            context: null
+          },
+          hint: null,
+          needs_grant: false
+        })
+      );
+    } else {
+      fail(`${opts.action} failed: ${message}`);
+    }
+    return 1;
+  }
+  const hint = err.status === 401 && err.context?.reason !== "module_api_credential_missing" ? {
+    message: opts.moduleKey ? MODULE_KEY_REFUSED[opts.moduleKey] : "Your login has expired. Run: dashwise login",
+    needsGrant: false
+  } : refusalHint(err.code, err.context, subject);
+  if (opts.json) {
+    writeJson(
+      JSON.stringify({
+        error: {
+          code: err.code,
+          message: err.message,
+          status: err.status,
+          context: err.context ?? null
+        },
+        hint: hint?.message ?? null,
+        needs_grant: hint?.needsGrant ?? false
+      })
+    );
+  } else if (hint) {
+    fail(
+      `${hint.message} (${err.code})${err.context ? ` context=${JSON.stringify(err.context)}` : ""}`
+    );
+  } else {
+    fail(
+      `${opts.action} failed (${err.code}): ${err.message}${err.context ? ` context=${JSON.stringify(err.context)}` : ""}`
+    );
+  }
+  return hint?.needsGrant ? EXIT_NEEDS_GRANT : 1;
+}
+var EXIT_NEEDS_GRANT, EXIT_TIMED_OUT, REBUILD_BUMP_OPERATOR_ONLY, FEATURE_SUBJECTS, OPTION_SUBJECTS, MODULE_RIGHT_CODES, ANSI, MODULE_KEY_REFUSED;
+var init_permission_hint = __esm({
+  "src/lib/permission-hint.ts"() {
+    init_api_client();
+    init_output();
+    EXIT_NEEDS_GRANT = 3;
+    EXIT_TIMED_OUT = 4;
+    REBUILD_BUMP_OPERATOR_ONLY = "REBUILD_BUMP_OPERATOR_ONLY";
+    FEATURE_SUBJECTS = {
+      module_runtime_streaming: "Streaming",
+      module_rebuild: "Rebuild",
+      module_building: "Building modules",
+      module_runtime_sizing: "Memory size"
+    };
+    OPTION_SUBJECTS = {
+      streaming: "Streaming",
+      memory_mb: "Memory size",
+      reapply: "Re-applying the runtime",
+      timeout: "The timeout",
+      reserved_concurrency: "Reserved concurrency",
+      log_retention: "Log retention"
+    };
+    MODULE_RIGHT_CODES = /* @__PURE__ */ new Set([
+      "MODULE_CAPABILITY_DENIED",
+      "PUBLISH_REQUIRES_ADMIN",
+      "NOT_COPY_OWNER"
+    ]);
+    ANSI = /\x1b\[[0-9;]*m/g;
+    MODULE_KEY_REFUSED = {
+      env: "The module key in DASHWISE_API_KEY was refused (expired or revoked). Replace it with a current key, or unset it to use this module's saved key. dashwise login does not renew module keys.",
+      env_file: "The module key in .env.local (DASHWISE_API_KEY) was refused (expired or revoked). Replace it, or remove that line to use this module's saved key. dashwise login does not renew module keys.",
+      saved: `This module's saved key was refused (expired or revoked). In your CLI auth.json, set only modules[<slug>].apiKey to an empty string (""), keeping installationId and all other fields. Then run dashwise dev from this module's directory with DASHWISE_API_KEY unset to mint and save a replacement key for the same installation. dashwise login does not renew module keys.`
+    };
+  }
+});
+
+// src/lib/manifest-evolution.ts
+function compareManifests(base, head, history = []) {
+  const violations = [];
+  const additions = [];
+  const warnings = [];
+  const v = (rule, where, detail) => violations.push({ rule, where, detail });
+  const baseTables = tablesOf(base);
+  const headTables = tablesOf(head);
+  const everTables = /* @__PURE__ */ new Set();
+  const everFields = /* @__PURE__ */ new Set();
+  for (const m of history) {
+    for (const [slug, t] of tablesOf(m)) {
+      everTables.add(slug);
+      for (const f of t.fields ?? []) everFields.add(`${slug}.${f.slug}`);
+    }
+  }
+  for (const [slug, bt] of baseTables) {
+    const ht = headTables.get(slug);
+    if (!ht) {
+      v("removed_table", slug, "tables are never removed; deprecate instead");
+      continue;
+    }
+    const bf = fieldsOf(bt);
+    const hf = fieldsOf(ht);
+    for (const [fs, f] of bf) {
+      const g = hf.get(fs);
+      const where = `${slug}.${fs}`;
+      if (!g) {
+        v("removed_field", where, "fields are never removed; stop writing it and set human_edit: open");
+        continue;
+      }
+      if (f.type !== g.type) v("retyped_field", where, `${f.type} \u2192 ${g.type}`);
+      if ((f.decimal_places ?? null) !== (g.decimal_places ?? null)) {
+        v("retyped_field", where, `decimal_places ${f.decimal_places ?? "none"} \u2192 ${g.decimal_places ?? "none"}`);
+      }
+      if ((f.target ?? null) !== (g.target ?? null)) v("retyped_field", where, `link target ${f.target} \u2192 ${g.target}`);
+      if (f.required !== true && g.required === true) {
+        v("required_tightened", where, "old rows are empty; enforce it in the tool layer instead");
+      }
+      const bo = f.options ?? [];
+      const ho = g.options ?? [];
+      for (const [i, o] of bo.entries()) {
+        if (!ho.includes(o)) v("removed_option", where, `option "${String(o)}" removed`);
+        else if (ho[i] !== o) {
+          v("reordered_option", where, `option "${String(o)}" moved from ${i} to ${ho.indexOf(o)}; options are append-only`);
+        }
+      }
+      for (const o of ho.slice(bo.length)) if (!bo.includes(o)) additions.push(`option ${where} "${String(o)}"`);
+    }
+    for (const [fs] of hf) {
+      if (bf.has(fs)) continue;
+      if (everFields.has(`${slug}.${fs}`)) {
+        v("slug_reused", `${slug}.${fs}`, "this slug was removed in an earlier version and may not come back");
+      } else additions.push(`field ${slug}.${fs}`);
+    }
+    const hu = new Set(uniqueIndexes(ht));
+    for (const idx of uniqueIndexes(bt)) {
+      if (!hu.has(idx)) v("dropped_unique_index", `${slug}(${idx})`, "a unique index is a protocol lock; it may not be dropped or changed");
+    }
+    const bu = new Set(uniqueIndexes(bt));
+    for (const idx of hu) {
+      if (bu.has(idx)) continue;
+      const overExisting = idx.split(",").some((f) => f.length > 0 && bf.has(f));
+      if (overExisting) {
+        v("unique_on_populated", `${slug}(${idx})`, "a new unique index (indexes[].unique) over existing fields fails on duplicates already stored; add a new field instead");
+      } else additions.push(`unique index ${slug}(${idx})`);
+    }
+  }
+  for (const [slug] of headTables) {
+    if (baseTables.has(slug)) continue;
+    if (everTables.has(slug)) v("slug_reused", slug, "this table slug was removed in an earlier version and may not come back");
+    else additions.push(`table ${slug}`);
+  }
+  const baseViews = new Set((base?.owns?.views ?? []).map((x) => x.slug));
+  const headViews = new Set((head?.owns?.views ?? []).map((x) => x.slug));
+  for (const s of baseViews) if (!headViews.has(s)) warnings.push(`view ${s} removed (callers of qbViews.${s} break)`);
+  for (const s of headViews) if (!baseViews.has(s)) additions.push(`view ${s}`);
+  return { violations, additions, warnings };
+}
+var tablesOf, fieldsOf, uniqueIndexes;
+var init_manifest_evolution = __esm({
+  "src/lib/manifest-evolution.ts"() {
+    tablesOf = (m) => new Map((m?.owns?.tables ?? []).map((t) => [t.slug, t]));
+    fieldsOf = (t) => new Map((t?.fields ?? []).map((f) => [f.slug, f]));
+    uniqueIndexes = (t) => (t?.indexes ?? []).filter((i) => i.unique === true).map((i) => (i.fields ?? []).join(","));
+  }
+});
+
+// src/commands/module/diff-check.ts
+var diff_check_exports = {};
+__export(diff_check_exports, {
+  EvolutionCheckError: () => EvolutionCheckError,
+  moduleDiffCheckCommand: () => moduleDiffCheckCommand,
+  printEvolutionReport: () => printEvolutionReport,
+  publishEvolutionGate: () => publishEvolutionGate,
+  runEvolutionCheck: () => runEvolutionCheck
+});
+function readJson(path) {
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch (err) {
+    throw new EvolutionCheckError(`could not read ${path}: ${err.message}`);
+  }
+}
+function git(cwd, args) {
+  try {
+    return execFileSync("git", ["-C", cwd, ...args], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+      maxBuffer: 64 * 1024 * 1024
+    });
+  } catch (err) {
+    const stderr = err.stderr?.trim();
+    throw new EvolutionCheckError(`git ${args.join(" ")} failed${stderr ? `: ${stderr}` : ""}`);
+  }
+}
+async function runEvolutionCheck(options) {
+  const projectRoot = resolve(options.dir ?? process.cwd());
+  const headPath = options.head ? resolve(options.head) : join(projectRoot, "module.json");
+  if (!existsSync(headPath)) throw new EvolutionCheckError(`no manifest at ${headPath}`);
+  const head = readJson(headPath);
+  const baseFile = options.baseFile ?? (options.base && existsSync(options.base) ? options.base : void 0);
+  if (baseFile) {
+    const base = readJson(baseFile);
+    return { ...compareManifests(base, head), base: baseFile, head: headPath, history: 0, nothingReleased: false };
+  }
+  if (options.base) {
+    const ref = options.base;
+    const base = JSON.parse(git(projectRoot, ["show", `${ref}:./module.json`]));
+    let history2 = [];
+    if (!options.noHistory) {
+      const shas = git(projectRoot, ["log", "--format=%H", "--reverse", ref, "--", "module.json"]).split("\n").filter(Boolean);
+      history2 = shas.slice(0, -1).map((sha) => JSON.parse(git(projectRoot, ["show", `${sha}:./module.json`])));
+    }
+    return {
+      ...compareManifests(base, head, history2),
+      base: `${ref}:module.json`,
+      head: headPath,
+      history: history2.length,
+      nothingReleased: false
+    };
+  }
+  const slug = head.module?.slug;
+  if (!slug) throw new EvolutionCheckError(`${headPath} has no module.slug`);
+  let mod;
+  let versions;
+  try {
+    mod = await apiRequest(
+      "GET",
+      `/api/modules/by-slug/${encodeURIComponent(slug)}`
+    );
+    if (!mod.current_version) {
+      return {
+        violations: [],
+        additions: [],
+        warnings: [],
+        base: "(nothing released)",
+        head: headPath,
+        history: 0,
+        nothingReleased: true
+      };
+    }
+    versions = await apiRequest("GET", `/api/modules/${mod.id}/versions`);
+  } catch (err) {
+    const why = err instanceof ApiError ? `${err.code || err.status} ${err.message}` : err.message;
+    throw new EvolutionCheckError(
+      `could not read the released manifest of ${slug} (${why}); pass --base <ref|file> to check offline`
+    );
   }
-  return hint?.needsGrant ? EXIT_NEEDS_GRANT : 1;
+  const released = versions.find((v) => v.version === mod.current_version);
+  if (!released?.manifest_jsonb) {
+    throw new EvolutionCheckError(
+      `the platform returned no manifest for ${slug} v${mod.current_version}; pass --base <ref|file> to check offline`
+    );
+  }
+  const releasedAt = released.created_on ? Date.parse(released.created_on) : Number.POSITIVE_INFINITY;
+  const history = options.noHistory ? [] : versions.filter((v) => v !== released && v.manifest_jsonb && v.created_on && Date.parse(v.created_on) < releasedAt).sort((a, b) => Date.parse(a.created_on) - Date.parse(b.created_on)).map((v) => v.manifest_jsonb);
+  return {
+    ...compareManifests(released.manifest_jsonb, head, history),
+    base: `${slug} v${mod.current_version} (released)`,
+    head: headPath,
+    history: history.length,
+    nothingReleased: false
+  };
 }
-function isTransientPollError(err) {
-  if (!(err instanceof ApiError)) return true;
-  return err.status === 0 || err.status === 429 || err.status >= 500;
+function printEvolutionReport(r, print = out) {
+  print(`module diff --check: ${r.head} against ${r.base} (${r.history} older version${r.history === 1 ? "" : "s"} scanned)`);
+  for (const a of r.additions) print(`  + ${a}`);
+  for (const w of r.warnings) print(`  ! ${w}`);
+  for (const x of r.violations) print(`  \u2717 ${x.rule}: ${x.where}: ${x.detail}`);
 }
-function isTypedRequestError(err) {
-  if (err instanceof ApiError) return true;
-  if (!(err instanceof Error)) return false;
-  const candidate = err;
-  return typeof candidate.code === "string" && typeof candidate.status === "number" && (candidate.context === void 0 || candidate.context !== null && typeof candidate.context === "object" && !Array.isArray(candidate.context));
+async function moduleDiffCheckCommand(options) {
+  let r;
+  try {
+    r = await runEvolutionCheck(options);
+  } catch (err) {
+    if (err instanceof EvolutionCheckError) {
+      if (options.json) out(JSON.stringify({ ok: false, error: { code: "CHECK_FAILED", message: err.message } }));
+      else fail(`module diff --check: ${err.message}`);
+      return 2;
+    }
+    throw err;
+  }
+  if (options.json) {
+    out(JSON.stringify({ ok: r.violations.length === 0, ...r }, null, 2));
+    return r.violations.length === 0 ? 0 : 1;
+  }
+  if (r.nothingReleased) {
+    success("Nothing released yet: every change is additive.");
+    return 0;
+  }
+  printEvolutionReport(r);
+  if (r.violations.length === 0) {
+    success("additive");
+    return 0;
+  }
+  fail(`${r.violations.length} violation(s): not additive. Released copies would lose data or fail to upgrade.`);
+  info(`Add a new field or table instead, and stop writing the old one (${code('human_edit: "open"')}).`);
+  return 1;
 }
-function reportRefusal(err, subject, opts) {
-  const writeJson = (message) => {
-    if (opts.stderr) process.stderr.write(`${message}
-`);
-    else out(message);
-  };
-  if (!isTypedRequestError(err)) {
-    const message = err?.message ?? String(err);
-    if (opts.json) {
-      writeJson(
-        JSON.stringify({
-          error: {
-            code: "CLI_ERROR",
-            message: message.replace(ANSI, ""),
-            status: null,
-            context: null
-          },
-          hint: null,
-          needs_grant: false
-        })
-      );
-    } else {
-      fail(`${opts.action} failed: ${message}`);
+async function publishEvolutionGate(projectRoot, strict) {
+  let r;
+  try {
+    r = await runEvolutionCheck({ dir: projectRoot });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (strict) {
+      fail(`Evolution check could not run (${msg}). Refusing with --strict. Nothing was published.`);
+      return 1;
     }
-    return 1;
+    warn(`Evolution check skipped: ${msg}.`);
+    return 0;
   }
-  const hint = err.status === 401 && err.context?.reason !== "module_api_credential_missing" ? {
-    message: opts.moduleKey ? MODULE_KEY_REFUSED[opts.moduleKey] : "Your login has expired. Run: dashwise login",
-    needsGrant: false
-  } : refusalHint(err.code, err.context, subject);
-  if (opts.json) {
-    writeJson(
-      JSON.stringify({
-        error: {
-          code: err.code,
-          message: err.message,
-          status: err.status,
-          context: err.context ?? null
-        },
-        hint: hint?.message ?? null,
-        needs_grant: hint?.needsGrant ?? false
-      })
-    );
-  } else if (hint) {
-    fail(
-      `${hint.message} (${err.code})${err.context ? ` context=${JSON.stringify(err.context)}` : ""}`
-    );
-  } else {
+  if (r.nothingReleased || r.violations.length === 0) return 0;
+  printEvolutionReport(r, (s) => (strict ? fail : warn)(s));
+  if (strict) {
     fail(
-      `${opts.action} failed (${err.code}): ${err.message}${err.context ? ` context=${JSON.stringify(err.context)}` : ""}`
+      `module.json is not an additive evolution of the released version (${r.violations.length} violation(s)). Refusing with --strict. Nothing was published.`
     );
+    return 1;
   }
-  return hint?.needsGrant ? EXIT_NEEDS_GRANT : 1;
+  warn(
+    `module.json is not an additive evolution of the released version: installs that upgrade lose the data above. ${code("--strict")} turns this into a refusal; ${code("dashwise module diff --check")} shows it on its own.`
+  );
+  return 0;
 }
-var EXIT_NEEDS_GRANT, EXIT_TIMED_OUT, REBUILD_BUMP_OPERATOR_ONLY, FEATURE_SUBJECTS, OPTION_SUBJECTS, MODULE_RIGHT_CODES, ANSI, MODULE_KEY_REFUSED;
-var init_permission_hint = __esm({
-  "src/lib/permission-hint.ts"() {
+var EvolutionCheckError;
+var init_diff_check = __esm({
+  "src/commands/module/diff-check.ts"() {
     init_api_client();
+    init_manifest_evolution();
     init_output();
-    EXIT_NEEDS_GRANT = 3;
-    EXIT_TIMED_OUT = 4;
-    REBUILD_BUMP_OPERATOR_ONLY = "REBUILD_BUMP_OPERATOR_ONLY";
-    FEATURE_SUBJECTS = {
-      module_runtime_streaming: "Streaming",
-      module_rebuild: "Rebuild",
-      module_building: "Building modules",
-      module_runtime_sizing: "Memory size"
-    };
-    OPTION_SUBJECTS = {
-      streaming: "Streaming",
-      memory_mb: "Memory size",
-      reapply: "Re-applying the runtime",
-      timeout: "The timeout",
-      reserved_concurrency: "Reserved concurrency",
-      log_retention: "Log retention"
-    };
-    MODULE_RIGHT_CODES = /* @__PURE__ */ new Set([
-      "MODULE_CAPABILITY_DENIED",
-      "PUBLISH_REQUIRES_ADMIN",
-      "NOT_COPY_OWNER"
-    ]);
-    ANSI = /\x1b\[[0-9;]*m/g;
-    MODULE_KEY_REFUSED = {
-      env: "The module key in DASHWISE_API_KEY was refused (expired or revoked). Replace it with a current key, or unset it to use this module's saved key. dashwise login does not renew module keys.",
-      env_file: "The module key in .env.local (DASHWISE_API_KEY) was refused (expired or revoked). Replace it, or remove that line to use this module's saved key. dashwise login does not renew module keys.",
-      saved: `This module's saved key was refused (expired or revoked). In your CLI auth.json, set only modules[<slug>].apiKey to an empty string (""), keeping installationId and all other fields. Then run dashwise dev from this module's directory with DASHWISE_API_KEY unset to mint and save a replacement key for the same installation. dashwise login does not renew module keys.`
+    EvolutionCheckError = class extends Error {
     };
   }
 });
@@ -19243,6 +19247,150 @@ function agentSessionMarker(env = process.env) {
   return null;
 }
 
+// src/lib/go-live.ts
+init_api_client();
+init_output();
+init_permission_hint();
+init_scaffold();
+var EXIT_AWAITING_PERSON = 5;
+var DEFAULT_GO_LIVE_WAIT_SEC = 900;
+var AGENT_GO_LIVE_WAIT_SEC = 240;
+function isGoLiveNeedsPerson(err) {
+  return err instanceof ApiError && err.code === "GO_LIVE_NEEDS_PERSON";
+}
+function liveTabLink(apiUrl, moduleId, installationId) {
+  const path = `/modules?module=${moduleId}&tab=live&copy=${installationId}`;
+  const origin = hostedAppOrigin(apiUrl);
+  return origin ? `${origin}${path}` : path;
+}
+async function proposeGoLive(args, auth) {
+  const emit = (exit2, request2, extra = {}) => {
+    if (args.json)
+      out(
+        JSON.stringify({
+          go_live_request_id: request2?.id ?? null,
+          installation_id: args.installationId,
+          version: args.version,
+          status: request2?.status ?? null,
+          outcome: request2?.outcome ?? null,
+          reason: request2?.reason ?? null,
+          approve_at: liveTabLink(args.apiUrl, args.moduleId, args.installationId),
+          awaiting_person: exit2 === EXIT_AWAITING_PERSON,
+          ...extra
+        })
+      );
+    return exit2;
+  };
+  let filed;
+  try {
+    filed = await apiRequest(
+      "POST",
+      `/api/modules/${args.moduleId}/go-live-requests`,
+      { installation_id: args.installationId, version: args.version },
+      auth
+    );
+  } catch (err) {
+    if (err instanceof ApiError && err.code === "ALREADY_LIVE") {
+      success(`Installation ${args.installationId} already runs v${args.version}.`);
+      return emit(0, null, { already_live: true });
+    }
+    const why = err instanceof ApiError ? `${err.code || err.status} ${err.message}` : err.message;
+    fail(`Could not propose v${args.version} for installation ${args.installationId}: ${why}`);
+    return emit(1, null, { error: err instanceof ApiError ? err.code || err.status : "NETWORK" });
+  }
+  const link = liveTabLink(args.apiUrl, args.moduleId, args.installationId);
+  info(
+    `Proposed v${args.version} for installation ${args.installationId}` + (filed.from_version ? ` (runs v${filed.from_version} now)` : "") + `. A person takes it live in Dashwise: ${code(link)}`
+  );
+  if (args.waitSec <= 0) {
+    info(awaitingLine(filed.request.id, args.checkCommand));
+    return emit(EXIT_AWAITING_PERSON, filed.request);
+  }
+  const { exit, request } = await waitForGoLive(filed.request.id, args, auth);
+  return emit(exit, request ?? filed.request);
+}
+function awaitingLine(requestId, checkCommand) {
+  return `Go-live request #${requestId} waits for a person; nothing was installed. ${checkAgain(checkCommand)}`;
+}
+function checkAgain(checkCommand) {
+  return checkCommand ? `Check again with ${code(checkCommand)} (it files nothing new while this one is open).` : "Run the same command again to check (it files nothing new while this one is open).";
+}
+function isFinalClientError(err) {
+  return err instanceof ApiError && err.status >= 400 && err.status < 500 && err.status !== 429;
+}
+async function waitForGoLive(requestId, args, auth) {
+  const interval = args.pollIntervalMs ?? 5e3;
+  const deadline = Date.now() + args.waitSec * 1e3;
+  info(`Waiting for the approval (go-live request #${requestId}, up to ${formatWait(args.waitSec)})\u2026`);
+  let last = null;
+  let announcedApproval = false;
+  for (; ; ) {
+    let request = null;
+    try {
+      ({ request } = await apiRequest(
+        "GET",
+        `/api/modules/${args.moduleId}/go-live-requests/${requestId}`,
+        void 0,
+        auth
+      ));
+      last = request;
+    } catch (err) {
+      const why = err instanceof ApiError ? `${err.code || err.status}` : err.message;
+      if (isFinalClientError(err)) {
+        fail(`Could not read go-live request #${requestId} (${why}). Check it on the module's Live tab.`);
+        return { exit: 1, request: last };
+      }
+      warn(`Could not read go-live request #${requestId} (${why}); trying again.`);
+    }
+    if (request && request.status !== "pending") {
+      if (request.status !== "approved" || request.outcome !== null) {
+        return { exit: reportOutcome(request, args), request };
+      }
+      if (!announcedApproval) {
+        info(`A person approved it; v${args.version} is going live on installation ${args.installationId}\u2026`);
+        announcedApproval = true;
+      }
+    }
+    if (Date.now() + interval > deadline) {
+      warn(
+        announcedApproval ? `Go-live request #${requestId} was approved and is still going live. ${checkAgain(args.checkCommand)}` : awaitingLine(requestId, args.checkCommand)
+      );
+      return { exit: EXIT_AWAITING_PERSON, request: last };
+    }
+    await new Promise((r) => setTimeout(r, interval));
+  }
+}
+function formatWait(sec) {
+  return sec < 120 ? `${sec} s` : `${Math.round(sec / 60)} min`;
+}
+function parseWaitSeconds(value) {
+  const trimmed = value.trim();
+  if (!/^[0-9]+$/.test(trimmed)) {
+    throw new InvalidArgumentError("Expected whole seconds, 0 or more.");
+  }
+  return Number(trimmed);
+}
+function reportOutcome(request, args) {
+  switch (request.outcome) {
+    case "live":
+      success(`v${args.version} is live on installation ${args.installationId}.`);
+      return 0;
+    case "declined":
+      fail(
+        `A person declined v${args.version} for installation ${args.installationId}` + (request.reason ? `: ${request.reason}` : ".")
+      );
+      return EXIT_NEEDS_GRANT;
+    case "superseded":
+      warn("A newer proposal for this installation replaced this one.");
+      return EXIT_NEEDS_GRANT;
+    default:
+      fail(
+        `The update did not go through after the approval (${request.reason ?? request.outcome ?? request.status}). Nothing changed; propose again.`
+      );
+      return 1;
+  }
+}
+
 // src/lib/drift-preview.ts
 init_api_client();
 function redactedConsumer(redacted) {
@@ -19578,6 +19726,17 @@ async function moduleInstallCommand(slugArg, options) {
       );
     }
   }
+  const agentMarker = agentSessionMarker();
+  if (agentMarker !== null) {
+    if (!existing) {
+      fail(
+        `This is an AI agent session (${code(agentMarker)} is set), and ${code(mod.slug)} has no production installation in ${code(workspace2.slug)} yet: a person creates the first one in Dashwise.`
+      );
+      return 1;
+    }
+    info(`AI agent session (${code(agentMarker)}): proposing instead of installing; a person approves it.`);
+    return goLiveByProposal(mod, existing.id, targetVersion, options, auth);
+  }
   let preview;
   let lossy = false;
   let lossAccepted = false;
@@ -19639,6 +19798,25 @@ async function moduleInstallCommand(slugArg, options) {
       );
       break;
     } catch (err) {
+      if (isGoLiveNeedsPerson(err)) {
+        if (!existing) {
+          fail(
+            `Taking ${code(mod.slug)} live in ${code(workspace2.slug)} is done by a person in Dashwise: create its first installation there.`
+          );
+          if (devInstallReplaced) printDevInstallAftermath(mod.slug, workspace2.slug);
+          return 1;
+        }
+        info("Dashwise takes modules live through a person: proposing this update instead.");
+        const proposed = await goLiveByProposal(
+          mod,
+          existing.id,
+          confirmedPlan?.to_version ?? targetVersion,
+          options,
+          auth
+        );
+        if (devInstallReplaced) printDevInstallAftermath(mod.slug, workspace2.slug);
+        return proposed;
+      }
       let plan = null;
       if (confirmedPlan && err instanceof ApiError && err.code === "DRIFT_CHANGED" && round < MAX_PLAN_ROUNDS) {
         warn(
@@ -20094,6 +20272,22 @@ function rerunLine(slug, workspaceSlug, targetVersion, installationId, options,
     `--accept-data-loss ${hash}`
   ].join(" ");
 }
+function goLiveByProposal(mod, installationId, version, options, auth) {
+  return proposeGoLive(
+    {
+      moduleId: mod.id,
+      moduleSlug: mod.slug,
+      installationId,
+      version,
+      apiUrl: auth.baseUrl,
+      waitSec: options.waitSec ?? (agentSessionMarker() !== null ? AGENT_GO_LIVE_WAIT_SEC : DEFAULT_GO_LIVE_WAIT_SEC),
+      ...options.pollIntervalMs !== void 0 ? { pollIntervalMs: options.pollIntervalMs } : {},
+      ...options.json ? { json: true } : {},
+      ...options.goLiveCheckCommand ? { checkCommand: options.goLiveCheckCommand } : {}
+    },
+    auth
+  );
+}
 
 // src/commands/module/list.ts
 init_api_client();
@@ -21106,10 +21300,9 @@ init_permission_hint();
 async function moduleShipCommand(slugArg, options) {
   const marker = agentSessionMarker();
   if (marker !== null) {
-    fail(
-      `\`dashwise module ship\` takes a module live, which a person does (detected an AI agent session: ${marker}). An agent may release (${code("dashwise module release --commit-sha <sha> --yes")}); a person then installs it.`
+    info(
+      `AI agent session (${code(marker)}): \`ship\` releases, then proposes the update; a person takes it live in Dashwise.`
     );
-    return 2;
   }
   if (options.build !== void 0 && options.commitSha !== void 0) {
     fail("--build resumes an existing release; do not combine it with --commit-sha.");
@@ -21150,15 +21343,30 @@ async function moduleShipCommand(slugArg, options) {
     return 1;
   }
   info(`Installing v${build.version} (build #${build.id}, revision ${build.commit_sha.slice(0, 12)}).`);
-  return moduleInstallCommand(slugArg, {
+  const checkCommand = [
+    "dashwise module install",
+    slugArg,
+    `--version ${build.version}`,
+    options.dir !== void 0 ? `--dir ${shellWord(options.dir)}` : void 0,
+    options.workspace !== void 0 ? `--workspace ${shellWord(options.workspace)}` : void 0,
+    options.installation !== void 0 ? `--installation ${options.installation}` : void 0
+  ].filter(Boolean).join(" ");
+  const installExit = await moduleInstallCommand(slugArg, {
     ...options.dir !== void 0 ? { dir: options.dir } : {},
     ...options.workspace !== void 0 ? { workspace: options.workspace } : {},
     ...options.installation !== void 0 ? { installation: options.installation } : {},
     ...options.keepDevInstall !== void 0 ? { keepDevInstall: options.keepDevInstall } : {},
     ...options.replaceDevInstall !== void 0 ? { replaceDevInstall: options.replaceDevInstall } : {},
     ...options.yes !== void 0 ? { yes: options.yes } : {},
+    ...options.waitSec !== void 0 ? { waitSec: options.waitSec } : {},
+    ...options.pollIntervalMs !== void 0 ? { pollIntervalMs: options.pollIntervalMs } : {},
+    goLiveCheckCommand: checkCommand,
     version: build.version
   });
+  if (installExit === EXIT_AWAITING_PERSON) {
+    info(`v${build.version} is released; only its go-live waits for a person (not a build: do not ship again).`);
+  }
+  return installExit;
 }
 async function defaultBranchHead(slugArg, dir) {
   const cfg = readConfig();
@@ -21192,6 +21400,9 @@ async function defaultBranchHead(slugArg, dir) {
     return void 0;
   }
 }
+function shellWord(value) {
+  return /^[\w./@:=-]+$/.test(value) ? value : `'${value.replace(/'/g, `'\\''`)}'`;
+}
 
 // src/commands/module/status.ts
 init_api_client();
@@ -27156,8 +27367,12 @@ moduleCmd.command("build-log [slug] [buildId]").description(
   }
 );
 moduleCmd.command("ship [slug]").description(
-  "Release and install in one command, for a person: releases the latest push to the default branch (or --commit-sha), waits for the build, then installs that version, showing what the update does to the data and asking once. Refused inside an AI agent session (an agent releases; a person takes it live)."
-).option("--dir <path>", "Project root for module.json slug lookup (default: current directory).").option("--commit-sha <sha>", "Release this pushed revision (full 40-character SHA) instead of the default-branch head.").option("--build <id>", "Resume a ship whose release was still building: wait for that build, then install it. Never queues a release.", parsePositiveIdOption).option("--bump <direction>", "Semver bump: patch | minor | major (default minor).").option("--workspace <slug-or-id>", "Target workspace (as for module install).").option("--installation <id>", "Update exactly this production installation.", parsePositiveIdOption).option("--keep-dev-install", "Install alongside the workspace's dev install (as for module install).").option("--replace-dev-install", "Replace the workspace's dev install (as for module install).").option("-y, --yes", "Skip the install question when nothing is lost. Never accepts data loss.").option("--timeout <seconds>", "Max seconds to wait for the build (default 360); exit 4 means still building.", Number).action(
+  "Release and install in one command: releases the latest push to the default branch (or --commit-sha), waits for the build, then installs that version, showing what the update does to the data and asking once. Inside an AI agent session (or when Dashwise requires it) it proposes the update instead and waits for a person to take it live on the Live tab."
+).option("--dir <path>", "Project root for module.json slug lookup (default: current directory).").option("--commit-sha <sha>", "Release this pushed revision (full 40-character SHA) instead of the default-branch head.").option("--build <id>", "Resume a ship whose release was still building: wait for that build, then install it. Never queues a release.", parsePositiveIdOption).option("--bump <direction>", "Semver bump: patch | minor | major (default minor).").option("--workspace <slug-or-id>", "Target workspace (as for module install).").option("--installation <id>", "Update exactly this production installation.", parsePositiveIdOption).option("--keep-dev-install", "Install alongside the workspace's dev install (as for module install).").option("--replace-dev-install", "Replace the workspace's dev install (as for module install).").option("-y, --yes", "Skip the install question when nothing is lost. Never accepts data loss.").option("--timeout <seconds>", "Max seconds to wait for the build (default 360); exit 4 means still building.", Number).option(
+  "--wait <seconds>",
+  "Max seconds to wait for a person to approve a go-live proposal (default 900, 240 inside an AI agent session; 0 proposes and returns). Exit 5: the proposal still waits; run the same command again to check (exit 4 is a release still building).",
+  parseWaitSeconds
+).action(
   async (slug, opts) => {
     process.exitCode = await moduleShipCommand(slug, {
       ...opts.dir !== void 0 ? { dir: opts.dir } : {},
@@ -27169,7 +27384,8 @@ moduleCmd.command("ship [slug]").description(
       ...opts.keepDevInstall !== void 0 ? { keepDevInstall: opts.keepDevInstall } : {},
       ...opts.replaceDevInstall !== void 0 ? { replaceDevInstall: opts.replaceDevInstall } : {},
       ...opts.yes !== void 0 ? { yes: opts.yes } : {},
-      ...opts.timeout !== void 0 ? { timeoutSec: opts.timeout } : {}
+      ...opts.timeout !== void 0 ? { timeoutSec: opts.timeout } : {},
+      ...opts.wait !== void 0 ? { waitSec: opts.wait } : {}
     });
   }
 );
@@ -27230,7 +27446,11 @@ moduleCmd.command("install [slug]").alias("deploy").alias("upgrade").description
 ).option("--dir <path>", "Project root for the module.json slug lookup (default: current directory).").option("-y, --yes", "Skip the confirmation prompt (for CI / scripted use). Never accepts data loss: see --accept-data-loss.").option(
   "--accept-data-loss <drift_hash>",
   "Accept the data loss of this upgrade: the drift_hash its preview printed. Only that exact hash accepts it (a person decides; an agent stops and reports the hash)."
-).option("--json", "Emit the final result as machine-readable JSON.").action(
+).option("--json", "Emit the final result as machine-readable JSON.").option(
+  "--wait <seconds>",
+  "Max seconds to wait for a person to approve a go-live proposal (made inside an AI agent session or when Dashwise requires a person; default 900, 240 inside an AI agent session; 0 proposes and returns). Exit 5: the proposal still waits; run the same command again to check, it files nothing new.",
+  parseWaitSeconds
+).action(
   async (slug, cmdOpts) => {
     process.exitCode = await moduleInstallCommand(slug, {
       ...cmdOpts.installation !== void 0 ? { installation: cmdOpts.installation } : {},
@@ -27242,7 +27462,8 @@ moduleCmd.command("install [slug]").alias("deploy").alias("upgrade").description
       ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
       ...cmdOpts.yes !== void 0 ? { yes: cmdOpts.yes } : {},
       ...cmdOpts.acceptDataLoss !== void 0 ? { acceptDataLoss: cmdOpts.acceptDataLoss } : {},
-      ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
+      ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {},
+      ...cmdOpts.wait !== void 0 ? { waitSec: cmdOpts.wait } : {}
     });
   }
 );
@@ -27596,7 +27817,7 @@ fieldCmd.command("set-type <table-slug> <field-slug> <new-type>").description(
   }
 );
 function getVersion() {
-  return "0.30.1";
+  return "0.31.0";
 }
 function parsePositiveIdOption(value) {
   if (!/^[1-9][0-9]*$/.test(value.trim())) {