@playcademy/vite-plugin 1.1.3-beta.6 → 1.1.3-beta.8

package/dist/index.js

@@ -24314,7 +24314,7 @@ import path2 from "node:path";
 // package.json
 var package_default = {
   name: "@playcademy/vite-plugin",
-  version: "1.1.3-beta.6",
+  version: "1.1.3-beta.8",
   type: "module",
   exports: {
     ".": {
@@ -25056,6 +25056,7 @@ var WORKER_NAMING;
 var MAX_WORKER_NAME_LENGTH = 63;
 var SECRETS_PREFIX = "secrets_";
 var CLOUDFLARE_COMPATIBILITY_DATE = "2025-10-11";
+var D1_TIME_TRAVEL_RETENTION_DAYS = 30;
 var init_cloudflare = __esm(() => {
   WORKER_NAMING = {
     STAGING_PREFIX: "staging-",
@@ -25845,7 +25846,7 @@ var package_default2;
 var init_package = __esm(() => {
   package_default2 = {
     name: "@playcademy/sandbox",
-    version: "0.6.1-beta.6",
+    version: "0.6.1-beta.8",
     description: "Local development server for Playcademy game development",
     type: "module",
     exports: {
@@ -25912,6 +25913,16 @@ var init_package = __esm(() => {
     }
   };
 });
+function deployErrorCode(error) {
+  if (!(error instanceof DomainError)) {
+    return null;
+  }
+  const details = error.details;
+  if (typeof details !== "object" || details === null || !("code" in details)) {
+    return null;
+  }
+  return typeof details.code === "string" ? details.code : null;
+}
 var DomainError;
 var BadRequestError;
 var UnauthorizedError;
@@ -26004,6 +26015,171 @@ var init_domain_error = __esm(() => {
     }
   };
 });
+var DEPLOY_ERROR_CODES;
+var REFUSAL_CODES;
+var DEPLOY_REFUSAL_CODES;
+var DELETED_ACCOUNT_LABEL = "(deleted account)";
+var init_game2 = __esm(() => {
+  DEPLOY_ERROR_CODES = {
+    deployIdPayloadMismatch: "deploy-id-payload-mismatch",
+    stateConflict: "deployment-state-conflict",
+    stateDrift: "deployment-state-drift",
+    destructiveSchema: "destructive-schema-changes",
+    upgradeRequired: "deploy-upgrade-required",
+    checksumMismatch: "migration-checksum-mismatch",
+    journalDivergence: "migration-journal-divergence",
+    outOfOrder: "migration-out-of-order",
+    migrationFailed: "migration-failed",
+    strategyMismatch: "strategy-mismatch",
+    pushFailed: "push-failed",
+    pruneUnmanagedSecrets: "secrets-prune-unmanaged",
+    baselineLedgerNotEmpty: "baseline-ledger-not-empty",
+    baselineDatabaseEmpty: "baseline-database-empty",
+    baselineAlreadyAdopted: "baseline-already-adopted",
+    baselineClaimRejected: "baseline-claim-rejected",
+    restoreUnsupported: "restore-unsupported",
+    restoreIncomplete: "restore-incomplete",
+    restoreBlockedByDeploy: "restore-blocked-by-deploy",
+    restoreExpired: "restore-expired"
+  };
+  REFUSAL_CODES = [
+    DEPLOY_ERROR_CODES.deployIdPayloadMismatch,
+    DEPLOY_ERROR_CODES.stateConflict,
+    DEPLOY_ERROR_CODES.stateDrift,
+    DEPLOY_ERROR_CODES.destructiveSchema,
+    DEPLOY_ERROR_CODES.upgradeRequired,
+    DEPLOY_ERROR_CODES.checksumMismatch,
+    DEPLOY_ERROR_CODES.journalDivergence,
+    DEPLOY_ERROR_CODES.outOfOrder,
+    DEPLOY_ERROR_CODES.strategyMismatch,
+    DEPLOY_ERROR_CODES.pruneUnmanagedSecrets,
+    DEPLOY_ERROR_CODES.baselineLedgerNotEmpty,
+    DEPLOY_ERROR_CODES.baselineDatabaseEmpty,
+    DEPLOY_ERROR_CODES.baselineAlreadyAdopted,
+    DEPLOY_ERROR_CODES.baselineClaimRejected
+  ];
+  DEPLOY_REFUSAL_CODES = new Set(REFUSAL_CODES);
+});
+var DeployIdConflictError;
+var DeploymentStateConflictError;
+var DeploymentStateDriftError;
+var LegacySchemaUpgradeRequiredError;
+var DestructiveSchemaError;
+var MigrationChecksumMismatchError;
+var MigrationJournalDivergenceError;
+var MigrationOrderError;
+var SecretsPruneUnmanagedError;
+var BaselineLedgerNotEmptyError;
+var BaselineDatabaseEmptyError;
+var BaselineAlreadyAdoptedError;
+var BaselineClaimRejectedError;
+var MigrationExecutionError;
+var PushExecutionError;
+var init_deploy_error = __esm(() => {
+  init_game2();
+  init_domain_error();
+  DeployIdConflictError = class DeployIdConflictError2 extends ConflictError {
+    constructor(deployId, existingJobId) {
+      super(`Deploy '${deployId}' was already created with a different payload — ` + "generate a fresh deployId for a new deploy", { code: DEPLOY_ERROR_CODES.deployIdPayloadMismatch, deployId, existingJobId });
+      this.name = "DeployIdConflictError";
+    }
+  };
+  DeploymentStateConflictError = class DeploymentStateConflictError2 extends ConflictError {
+    constructor(payload) {
+      super("Deployment state conflict: the schema baseline changed since this deploy was " + "prepared — refetch the deployment state, re-diff, and retry", { code: DEPLOY_ERROR_CODES.stateConflict, ...payload });
+      this.name = "DeploymentStateConflictError";
+    }
+  };
+  DeploymentStateDriftError = class DeploymentStateDriftError2 extends ConflictError {
+    constructor(payload) {
+      super("Deployment state drift: the live database schema does not match the recorded " + "fingerprint (out-of-band change or partial prior apply) — repair the " + "database state before deploying", { code: DEPLOY_ERROR_CODES.stateDrift, ...payload });
+      this.name = "DeploymentStateDriftError";
+    }
+  };
+  LegacySchemaUpgradeRequiredError = class LegacySchemaUpgradeRequiredError2 extends ValidationError {
+    constructor() {
+      super("This game's database state is server-managed; the legacy schema payload is no " + "longer accepted — update the Playcademy CLI and redeploy", { code: DEPLOY_ERROR_CODES.upgradeRequired });
+      this.name = "LegacySchemaUpgradeRequiredError";
+    }
+  };
+  DestructiveSchemaError = class DestructiveSchemaError2 extends ValidationError {
+    constructor(statements) {
+      super(`Push contains ${statements.length} destructive statement(s) that can drop data — ` + "review them and re-run with --accept-data-loss to proceed", { code: DEPLOY_ERROR_CODES.destructiveSchema, statements });
+      this.name = "DestructiveSchemaError";
+    }
+  };
+  MigrationChecksumMismatchError = class MigrationChecksumMismatchError2 extends ConflictError {
+    constructor(mismatches) {
+      const tags = mismatches.map((mismatch) => mismatch.tag).join(", ");
+      super(`Applied migration(s) ${tags} no longer match their recorded checksums.`, {
+        code: DEPLOY_ERROR_CODES.checksumMismatch,
+        mismatches
+      });
+      this.name = "MigrationChecksumMismatchError";
+    }
+  };
+  MigrationJournalDivergenceError = class MigrationJournalDivergenceError2 extends ConflictError {
+    constructor(tags) {
+      super(`The database ledger records applied migration(s) missing from the deploy's ` + `journal: ${tags.join(", ")}. Restore the missing migration files (or resolve ` + "the ledger) before deploying", { code: DEPLOY_ERROR_CODES.journalDivergence, tags });
+      this.name = "MigrationJournalDivergenceError";
+    }
+  };
+  MigrationOrderError = class MigrationOrderError2 extends ValidationError {
+    constructor(tags) {
+      super(`Out-of-order migration(s): ${tags.join(", ")} are ordered before migrations that ` + "already applied. This usually means a branch merged with older-numbered " + "migrations — regenerate them after the applied ones and redeploy", { code: DEPLOY_ERROR_CODES.outOfOrder, tags });
+      this.name = "MigrationOrderError";
+    }
+  };
+  SecretsPruneUnmanagedError = class SecretsPruneUnmanagedError2 extends ValidationError {
+    constructor(keys) {
+      super(`Cannot prune secret(s) not managed by the platform: ${keys.join(", ")}. ` + "Only keys the platform previously pushed can be pruned", { code: DEPLOY_ERROR_CODES.pruneUnmanagedSecrets, keys });
+      this.name = "SecretsPruneUnmanagedError";
+    }
+  };
+  BaselineLedgerNotEmptyError = class BaselineLedgerNotEmptyError2 extends ConflictError {
+    constructor(tags) {
+      super(`Cannot baseline: the migration ledger already records ${tags.length} applied ` + "migration(s) — this database is already server-managed. Just deploy", { code: DEPLOY_ERROR_CODES.baselineLedgerNotEmpty, tags });
+      this.name = "BaselineLedgerNotEmptyError";
+    }
+  };
+  BaselineDatabaseEmptyError = class BaselineDatabaseEmptyError2 extends ValidationError {
+    constructor() {
+      super("Cannot baseline an empty database — there is no applied history to claim. " + "An empty database needs no baseline: deploy directly and the full " + "journal (or schema) applies fresh.", { code: DEPLOY_ERROR_CODES.baselineDatabaseEmpty });
+      this.name = "BaselineDatabaseEmptyError";
+    }
+  };
+  BaselineAlreadyAdoptedError = class BaselineAlreadyAdoptedError2 extends ConflictError {
+    constructor(baselineSource) {
+      super("Cannot baseline: deployment state already records a schema baseline" + `${baselineSource ? ` (source: ${baselineSource})` : ""} — ` + "use realign/resolve to repair drift instead", { code: DEPLOY_ERROR_CODES.baselineAlreadyAdopted, baselineSource });
+      this.name = "BaselineAlreadyAdoptedError";
+    }
+  };
+  BaselineClaimRejectedError = class BaselineClaimRejectedError2 extends ConflictError {
+    constructor(details) {
+      const [first] = details.contradictions;
+      super(first ? `Cannot baseline: the claim contradicts the live database — ${first.tag} ${first.detail ?? ""}` : "Cannot baseline: the claim includes migrations that cannot be verified against the live database — " + "pass --allow-unverified to record them anyway", { code: DEPLOY_ERROR_CODES.baselineClaimRejected, ...details });
+      this.name = "BaselineClaimRejectedError";
+    }
+  };
+  MigrationExecutionError = class MigrationExecutionError2 extends ValidationError {
+    tag;
+    offset;
+    constructor(input) {
+      super(`Migration '${input.tag}' failed and rolled back: ${input.d1Message}. ` + "Fix the migration SQL and redeploy — the deploy resumes from this migration", { code: DEPLOY_ERROR_CODES.migrationFailed, ...input });
+      this.name = "MigrationExecutionError";
+      this.tag = input.tag;
+      this.offset = input.offset;
+    }
+  };
+  PushExecutionError = class PushExecutionError2 extends ValidationError {
+    offset;
+    constructor(input) {
+      super(`Push schema changes failed and rolled back: ${input.d1Message}. ` + "Fix the schema and redeploy — nothing was applied", { code: DEPLOY_ERROR_CODES.pushFailed, ...input });
+      this.name = "PushExecutionError";
+      this.offset = input.offset;
+    }
+  };
+});
 var STATUS_MAP;
 var ApiError;
 var init_api_error = __esm(() => {
@@ -26101,6 +26277,7 @@ var init_api_error = __esm(() => {
 });
 var init_errors = __esm(() => {
   init_domain_error();
+  init_deploy_error();
   init_api_error();
 });
 function isBrowser() {
@@ -30546,7 +30723,8 @@ var init_schema = __esm(() => {
     ltiTestMode: exports_external.boolean().default(false),
     platformServiceJwt: platformServiceJwtConfigSchema.optional(),
     uploadBucket: exports_external.string().optional(),
-    queueIngressSecret: exports_external.string().optional()
+    queueIngressSecret: exports_external.string().optional(),
+    secretsManifestPepper: exports_external.string().optional()
   }).superRefine((config2, ctx) => {
     if (config2.isLocal && !config2.baseUrl) {
       ctx.addIssue({
@@ -36005,6 +36183,8 @@ var deploymentTargetEnum;
 var deployJobStatusEnum;
 var gameDeployments;
 var gameDeployJobs;
+var gameDeployEvents;
+var gameDeploymentState;
 var customHostnameStatusEnum;
 var customHostnameSslStatusEnum;
 var customHostnameEnvironmentEnum;
@@ -36097,15 +36277,20 @@ var init_table5 = __esm(() => {
     target: deploymentTargetEnum("target").notNull().default("game"),
     url: text("url").notNull(),
     codeHash: text("code_hash"),
+    schemaHash: text("schema_hash"),
+    schemaFingerprint: text("schema_fingerprint"),
+    timeTravelBookmark: text("time_travel_bookmark"),
+    bookmarkCapturedAt: timestamp("bookmark_captured_at", { withTimezone: true }),
     isActive: boolean("is_active").notNull().default(false),
     resources: jsonb("resources").$type(),
     deployedAt: timestamp("deployed_at", { withTimezone: true }).notNull().defaultNow()
-  });
+  }, (table3) => [index("game_deployments_game_target_idx").on(table3.gameId, table3.target)]);
   gameDeployJobs = pgTable("game_deploy_jobs", {
     id: uuid("id").primaryKey().defaultRandom(),
     gameId: uuid("game_id").notNull().references(() => games.id, { onDelete: "cascade" }),
-    userId: text("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+    userId: text("user_id").references(() => users.id, { onDelete: "set null" }),
     status: deployJobStatusEnum("status").notNull().default("pending"),
+    deployId: text("deploy_id"),
     request: jsonb("request").$type().notNull(),
     events: jsonb("events").$type().notNull().default([]),
     error: text("error"),
@@ -36119,6 +36304,27 @@ var init_table5 = __esm(() => {
     createdAt: timestamp("created_at", { mode: "date", withTimezone: true }).notNull().defaultNow(),
     startedAt: timestamp("started_at", { mode: "date", withTimezone: true }),
     completedAt: timestamp("completed_at", { mode: "date", withTimezone: true })
+  }, (table3) => [uniqueIndex("game_deploy_jobs_game_deploy_id_idx").on(table3.gameId, table3.deployId)]);
+  gameDeployEvents = pgTable("game_deploy_events", {
+    id: uuid("id").primaryKey().defaultRandom(),
+    gameId: uuid("game_id").notNull().references(() => games.id, { onDelete: "cascade" }),
+    userId: text("user_id").references(() => users.id, { onDelete: "set null" }),
+    kind: text("kind").$type().notNull(),
+    payload: jsonb("payload").$type().notNull(),
+    createdAt: timestamp("created_at", { mode: "date", withTimezone: true }).notNull().defaultNow()
+  }, (table3) => [index("game_deploy_events_game_idx").on(table3.gameId, table3.createdAt)]);
+  gameDeploymentState = pgTable("game_deployment_state", {
+    id: uuid("id").primaryKey().defaultRandom(),
+    gameId: uuid("game_id").notNull().unique().references(() => games.id, { onDelete: "cascade" }),
+    schemaHash: text("schema_hash"),
+    schemaSnapshot: jsonb("schema_snapshot"),
+    schemaFingerprint: text("schema_fingerprint"),
+    secretsManifest: jsonb("secrets_manifest").$type(),
+    integrationsHash: text("integrations_hash"),
+    buildHash: text("build_hash"),
+    compatibilityDate: text("compatibility_date"),
+    baselineSource: text("baseline_source").$type(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
   });
   customHostnameStatusEnum = pgEnum("custom_hostname_status", [
     "pending",
@@ -36280,7 +36486,9 @@ __export(exports_tables_index, {
   gameMembers: () => gameMembers,
   gameMemberRoleEnum: () => gameMemberRoleEnum,
   gameDeployments: () => gameDeployments,
+  gameDeploymentState: () => gameDeploymentState,
   gameDeployJobs: () => gameDeployJobs,
+  gameDeployEvents: () => gameDeployEvents,
   gameDashboardUsersRelations: () => gameDashboardUsersRelations,
   gameDashboardUsers: () => gameDashboardUsers,
   gameDashboardUserRoleEnum: () => gameDashboardUserRoleEnum,
@@ -47055,6 +47263,107 @@ var init_zip = __esm(() => {
   init_src2();
   import_jszip = __toESM2(require_lib3(), 1);
 });
+function isPreviewStage(stage) {
+  return PREVIEW_STAGE_PATTERN.test(stage);
+}
+var PREVIEW_STAGE_PATTERN;
+var init_stages = __esm(() => {
+  PREVIEW_STAGE_PATTERN = /^pr-\d+$/;
+});
+function deployJobInstant() {
+  return sql`COALESCE(${gameDeployJobs.completedAt}, ${gameDeployJobs.createdAt})`;
+}
+async function findLastSuccessfulDeploy(db2, gameId) {
+  const job = await db2.query.gameDeployJobs.findFirst({
+    where: and(eq(gameDeployJobs.gameId, gameId), eq(gameDeployJobs.status, "succeeded")),
+    orderBy: desc(deployJobInstant()),
+    columns: { userId: true, createdAt: true, completedAt: true }
+  });
+  if (!job) {
+    return null;
+  }
+  return { userId: job.userId, at: job.completedAt ?? job.createdAt };
+}
+async function findLastSuccessfulDeployWithEmail(db2, gameId) {
+  const lastDeploy = await findLastSuccessfulDeploy(db2, gameId);
+  if (!lastDeploy) {
+    return null;
+  }
+  const deployer = lastDeploy.userId ? await db2.query.users.findFirst({
+    where: eq(users.id, lastDeploy.userId),
+    columns: { email: true }
+  }) : null;
+  return { ...lastDeploy, email: deployer?.email ?? null };
+}
+function getGameDeploymentId(gameSlug, sstStage) {
+  if (sstStage === "production") {
+    return gameSlug;
+  }
+  if (sstStage === "dev" || isPreviewStage(sstStage)) {
+    return `${WORKER_NAMING.STAGING_PREFIX}${gameSlug}`;
+  }
+  return `${WORKER_NAMING.LOCAL_PREFIX}${sstStage}-${gameSlug}`;
+}
+function getDashboardDeploymentId(gameSlug, sstStage) {
+  return `${getGameDeploymentId(gameSlug, sstStage)}${DASHBOARD_WORKER_SUFFIX}`;
+}
+function getGameWorkerApiKeyName(slug) {
+  return `${GAME_WORKER_KEY_PREFIX}${slug}`.substring(0, 32);
+}
+function getDashboardWorkerApiKeyName(slug) {
+  return `${DASHBOARD_WORKER_KEY_PREFIX}${slug}`;
+}
+function toBindingName(queueKey) {
+  return `${queueKey.replace(/-/g, "_").toUpperCase()}_QUEUE`;
+}
+function isSchemaAdopted(state) {
+  if (!state) {
+    return false;
+  }
+  return state.schemaHash !== null || state.schemaFingerprint !== null || state.schemaSnapshot !== null;
+}
+function isPushAdopted(state) {
+  return Boolean(state?.schemaHash);
+}
+function isMigrateManaged(state) {
+  return Boolean(state?.schemaFingerprint) && !state?.schemaHash;
+}
+function generateDeploymentHash(code) {
+  return sha256Hex(code);
+}
+function computeDeployPayloadFingerprint(payload) {
+  return sha256Hex(canonicalJson(payload));
+}
+function canonicalJson(value) {
+  if (value === null || typeof value !== "object") {
+    return JSON.stringify(value) ?? "null";
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map((item) => canonicalJson(item)).join(",")}]`;
+  }
+  const entries = Object.entries(value).filter(([, entryValue]) => entryValue !== undefined).toSorted(([a], [b]) => compareKeys(a, b)).map(([key, entryValue]) => `${JSON.stringify(key)}:${canonicalJson(entryValue)}`);
+  return `{${entries.join(",")}}`;
+}
+function compareKeys(a, b) {
+  if (a < b) {
+    return -1;
+  }
+  if (a > b) {
+    return 1;
+  }
+  return 0;
+}
+var GAME_WORKER_KEY_PREFIX = "game-worker-";
+var DASHBOARD_WORKER_KEY_PREFIX = "dash-worker-";
+var init_deployment_util = __esm(() => {
+  init_drizzle_orm();
+  init_src();
+  init_tables_index();
+  init_stages();
+});
+function isEventDetails(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 
 class DeployJobService {
   deps;
@@ -47068,6 +47377,9 @@ class DeployJobService {
     if (leaseLost) {
       return "lease_lost";
     }
+    if (DEPLOY_REFUSAL_CODES.has(deployErrorCode(error) ?? "")) {
+      return "refused";
+    }
     if (error instanceof DomainError) {
       return "domain_error";
     }
@@ -47147,13 +47459,28 @@ class DeployJobService {
     const bucketName = this.getUploadBucket();
     this.deps.storage.deleteObject(bucketName, codeUploadToken).catch(catchAttrs("deploy_job.temp_cleanup"));
   }
-  sanitizeRequestForPersistence(request) {
-    const sanitized = { ...request };
+  async sanitizeRequestForPersistence(request) {
+    const sanitized = {
+      ...request
+    };
     delete sanitized._headers;
     delete sanitized.code;
     delete sanitized.codeUploadToken;
+    const codeFingerprint = await this.computeCodeFingerprint(request);
+    if (codeFingerprint) {
+      sanitized.codeFingerprint = codeFingerprint;
+    }
     return sanitized;
   }
+  async computeCodeFingerprint(request) {
+    if (request.codeUploadToken) {
+      return `upload:${request.codeUploadToken}`;
+    }
+    if (request.code) {
+      return `sha256:${await generateDeploymentHash(request.code)}`;
+    }
+    return;
+  }
   getLeaseExpiry() {
     return new Date(Date.now() + DEPLOY_JOB_LEASE_MS);
   }
@@ -47186,8 +47513,36 @@ class DeployJobService {
       heartbeatAt: null
     }).where(and(eq(gameDeployJobs.id, jobId), eq(gameDeployJobs.leaseId, leaseId)));
   }
+  async findByDeployId(gameId, deployId) {
+    const job = await this.deps.db.query.gameDeployJobs.findFirst({
+      where: and(eq(gameDeployJobs.gameId, gameId), eq(gameDeployJobs.deployId, deployId))
+    });
+    return job ?? null;
+  }
+  async resolveIdempotentReplay(existing, request) {
+    const [incoming, stored] = await Promise.all([
+      this.sanitizeRequestForPersistence(request).then(computeDeployPayloadFingerprint),
+      computeDeployPayloadFingerprint(existing.request)
+    ]);
+    if (incoming !== stored) {
+      setAttribute("app.deploy_job.idempotency", "payload_mismatch");
+      throw new DeployIdConflictError(request.deployId, existing.id);
+    }
+    setAttributes({
+      "app.deploy_job.idempotency": "replayed",
+      "app.deploy_job.id": existing.id,
+      "app.deploy_job.status": existing.status
+    });
+    return this.toResponse(existing);
+  }
   async create(slug, request, user) {
     const game2 = await this.deps.validateDeveloperAccessBySlug(user, slug);
+    if (request.deployId) {
+      const existing = await this.findByDeployId(game2.id, request.deployId);
+      if (existing) {
+        return this.resolveIdempotentReplay(existing, request);
+      }
+    }
     const jobId = crypto.randomUUID();
     let codeSource = "none";
     if (request.code) {
@@ -47203,7 +47558,7 @@ class DeployJobService {
       request.code = await this.loadUploadedCode(request.codeUploadToken, game2.id);
     }
     setAttribute("app.deploy_job.code_bundle_size", request.code?.length ?? 0);
-    const sanitizedRequest = this.sanitizeRequestForPersistence(request);
+    const sanitizedRequest = await this.sanitizeRequestForPersistence(request);
     if (request.code) {
       await this.storeCodeBundle(jobId, request.code);
     }
@@ -47213,6 +47568,7 @@ class DeployJobService {
         id: jobId,
         gameId: game2.id,
         userId: user.id,
+        deployId: request.deployId ?? null,
         request: sanitizedRequest,
         events: [
           {
@@ -47224,6 +47580,12 @@ class DeployJobService {
       }).returning();
     } catch (error) {
       await this.deleteCodeBundle(jobId);
+      if (request.deployId) {
+        const winner = await this.findByDeployId(game2.id, request.deployId);
+        if (winner) {
+          return this.resolveIdempotentReplay(winner, request);
+        }
+      }
       throw error;
     }
     if (!job) {
@@ -47338,7 +47700,11 @@ class DeployJobService {
       "app.deploy_job.error_status": errorClassification?.errorStatus
     });
     if (!effectiveLeaseLost) {
-      await this.addStatusEvent(jobId, "Deployment failed", { error: message });
+      const structuredDetails = error instanceof DomainError && isEventDetails(error.details) ? error.details : undefined;
+      await this.addStatusEvent(jobId, "Deployment failed", {
+        error: message,
+        ...structuredDetails
+      });
       const failed = await this.markFailed(jobId, leaseId, message, errorClassification);
       if (!failed) {
         await this.clearLease(jobId, leaseId);
@@ -47351,18 +47717,21 @@ class DeployJobService {
         displayName: game2.displayName,
         error: message,
         target,
-        developer: { id: user.id, email: user.email }
+        developer: { id: user.id, email: user.email },
+        errorCode: deployErrorCode(error)
       });
     }
     await this.deleteCodeBundle(jobId);
   }
   async loadJobActors(job, jobId, leaseId, onMissing) {
-    const game2 = await this.deps.db.query.games.findFirst({
-      where: eq(games.id, job.gameId)
-    });
-    const user = await this.deps.db.query.users.findFirst({
-      where: eq(users.id, job.userId)
-    });
+    const [game2, user] = await Promise.all([
+      this.deps.db.query.games.findFirst({
+        where: eq(games.id, job.gameId)
+      }),
+      job.userId ? this.deps.db.query.users.findFirst({
+        where: eq(users.id, job.userId)
+      }) : undefined
+    ]);
     if (!game2 || !user) {
       const message = !game2 ? "Deploy job game no longer exists" : "Deploy job user no longer exists";
       onMissing();
@@ -47448,7 +47817,8 @@ class DeployJobService {
       for await (const step of this.deps.runDeploy(game2.slug, request, user, uploadDeps, extractZipToDirectory)) {
         assertLease();
         if (step.type === "status" && "message" in step.data && typeof step.data.message === "string") {
-          await this.addStatusEvent(jobId, step.data.message);
+          const details = "details" in step.data && isEventDetails(step.data.details) ? step.data.details : undefined;
+          await this.addStatusEvent(jobId, step.data.message, details);
         }
       }
       assertLease();
@@ -47509,8 +47879,10 @@ var init_deploy_job_service = __esm(() => {
   init_helpers_index();
   init_tables_index();
   init_spans();
+  init_game2();
   init_zip();
   init_errors();
+  init_deployment_util();
   STATUS_MAP2 = {
     BAD_REQUEST: 400,
     UNAUTHORIZED: 401,
@@ -47532,7 +47904,154 @@ var init_deploy_job_service = __esm(() => {
   DEPLOY_JOB_LEASE_MS = 2 * 60 * 1000;
   DEPLOY_JOB_HEARTBEAT_MS = 30 * 1000;
 });
-var init_d1 = () => {};
+function normalizeSqlForChecksum(sql4) {
+  const unified = sql4.replace(/\r\n/g, `
+`).replace(/\r/g, `
+`);
+  const stripped = stripSqlComments(unified);
+  return stripped.split(`
+`).map((line3) => line3.replace(/\s+$/, "")).filter((line3) => line3 !== "").join(`
+`);
+}
+function stripSqlComments(sql4) {
+  let output = "";
+  let i2 = 0;
+  while (i2 < sql4.length) {
+    const char3 = sql4[i2];
+    const next = sql4[i2 + 1];
+    if (char3 === "-" && next === "-") {
+      i2 = skipLineComment(sql4, i2);
+    } else if (char3 === "/" && next === "*") {
+      output += " ";
+      i2 = skipBlockComment(sql4, i2);
+    } else if (char3 === "'" || char3 === '"' || char3 === "`") {
+      const quoted = copyQuoted(sql4, i2, char3);
+      output += quoted.text;
+      i2 = quoted.end;
+    } else if (char3 === "[") {
+      const bracketed = copyBracketed(sql4, i2);
+      output += bracketed.text;
+      i2 = bracketed.end;
+    } else {
+      output += char3;
+      i2++;
+    }
+  }
+  return output;
+}
+function skipLineComment(sql4, start2) {
+  let i2 = start2 + 2;
+  while (i2 < sql4.length && sql4[i2] !== `
+`) {
+    i2++;
+  }
+  return i2;
+}
+function skipBlockComment(sql4, start2) {
+  let i2 = start2 + 2;
+  while (i2 < sql4.length && !(sql4[i2] === "*" && sql4[i2 + 1] === "/")) {
+    i2++;
+  }
+  return i2 + 2;
+}
+function copyQuoted(sql4, start2, quote) {
+  let text3 = quote;
+  let i2 = start2 + 1;
+  while (i2 < sql4.length) {
+    text3 += sql4[i2];
+    if (sql4[i2] !== quote) {
+      i2++;
+    } else if (sql4[i2 + 1] === quote) {
+      text3 += quote;
+      i2 += 2;
+    } else {
+      i2++;
+      break;
+    }
+  }
+  return { text: text3, end: i2 };
+}
+function copyBracketed(sql4, start2) {
+  let text3 = "[";
+  let i2 = start2 + 1;
+  while (i2 < sql4.length) {
+    text3 += sql4[i2];
+    i2++;
+    if (sql4[i2 - 1] === "]") {
+      break;
+    }
+  }
+  return { text: text3, end: i2 };
+}
+function findOversizedStatement(statements) {
+  for (const [index2, statement] of statements.entries()) {
+    const byteLength = Buffer.byteLength(statement, "utf8");
+    if (byteLength > D1_MAX_STATEMENT_BYTES) {
+      return { index: index2, byteLength };
+    }
+  }
+  return null;
+}
+var MIGRATION_LEDGER_TABLE = "_playcademy_migrations";
+var MIGRATION_CHECKSUM_ALGO = "sha256-v1";
+var D1_MAX_STATEMENT_BYTES;
+var init_schema3 = __esm(() => {
+  D1_MAX_STATEMENT_BYTES = 100 * 1024;
+});
+function parseD1ErrorOffset(message) {
+  const match = message.match(/at offset (\d+)/);
+  return match ? Number(match[1]) : null;
+}
+var MIGRATION_LEDGER_DDL;
+var D1StatementTooLargeError;
+var D1BatchError;
+var D1MigrationError;
+var init_d1 = __esm(() => {
+  init_schema3();
+  MIGRATION_LEDGER_DDL = `CREATE TABLE IF NOT EXISTS ${MIGRATION_LEDGER_TABLE} (
+    id               INTEGER PRIMARY KEY AUTOINCREMENT,
+    tag              TEXT NOT NULL UNIQUE,
+    checksum         TEXT NOT NULL,
+    checksum_algo    TEXT NOT NULL DEFAULT 'sha256-v1',
+    deploy_id        TEXT NOT NULL,
+    applied_by       TEXT,
+    applied_at       TEXT NOT NULL,
+    source           TEXT NOT NULL DEFAULT 'deploy',
+    statements_total INTEGER
+)`;
+  D1StatementTooLargeError = class D1StatementTooLargeError2 extends Error {
+    name = "D1StatementTooLargeError";
+    statementIndex;
+    byteLength;
+    constructor(tag, statementIndex, byteLength) {
+      super(`Migration '${tag}' statement ${statementIndex} is ${byteLength} bytes — ` + `over D1's ${D1_MAX_STATEMENT_BYTES / 1024} KB per-statement limit. ` + "Split the statement or reduce its size.");
+      this.statementIndex = statementIndex;
+      this.byteLength = byteLength;
+    }
+  };
+  D1BatchError = class D1BatchError2 extends Error {
+    name = "D1BatchError";
+    d1Message;
+    offset;
+    constructor(d1Message, cause) {
+      super(`Failed to execute batch: ${d1Message}`, { cause });
+      this.d1Message = d1Message;
+      this.offset = parseD1ErrorOffset(d1Message);
+    }
+  };
+  D1MigrationError = class D1MigrationError2 extends Error {
+    name = "D1MigrationError";
+    tag;
+    d1Message;
+    offset;
+    constructor(tag, d1Message, cause) {
+      super(`Migration '${tag}' failed and rolled back: ${d1Message}`, { cause });
+      this.tag = tag;
+      this.d1Message = d1Message;
+      this.offset = parseD1ErrorOffset(d1Message);
+    }
+  };
+});
 var init_kv = () => {};
 var RESERVED_SUBDOMAINS;
 var init_hostname = __esm(() => {
@@ -47542,6 +48061,159 @@ var init_mime = () => {};
 var init_assets = __esm(() => {
   init_mime();
 });
+function findOutOfOrderTags(orderedTags, applied) {
+  let lastAppliedIndex = -1;
+  orderedTags.forEach((tag, index2) => {
+    if (applied.has(tag)) {
+      lastAppliedIndex = index2;
+    }
+  });
+  return orderedTags.filter((tag, index2) => index2 < lastAppliedIndex && !applied.has(tag));
+}
+function detectDestructiveStatements(statements) {
+  return statements.filter((statement) => {
+    const scannable = blankStringLiterals(normalizeSqlForChecksum(statement));
+    return DESTRUCTIVE_SQL_PATTERNS.some((pattern) => pattern.test(scannable));
+  });
+}
+function splitSqlStatements(sql4) {
+  const statements = [];
+  let current = "";
+  let i2 = 0;
+  while (i2 < sql4.length) {
+    const char3 = sql4[i2];
+    const next = sql4[i2 + 1];
+    if (char3 === ";") {
+      statements.push(current);
+      current = "";
+      i2++;
+    } else if (char3 === "-" && next === "-") {
+      const end = scanLineCommentEnd(sql4, i2);
+      current += sql4.slice(i2, end);
+      i2 = end;
+    } else if (char3 === "/" && next === "*") {
+      const end = scanBlockCommentEnd(sql4, i2);
+      current += sql4.slice(i2, end);
+      i2 = end;
+    } else if (char3 === "'" || char3 === '"' || char3 === "`") {
+      const end = scanQuoteEnd(sql4, i2, char3);
+      current += sql4.slice(i2, end);
+      i2 = end;
+    } else if (char3 === "[") {
+      const end = scanBracketEnd(sql4, i2);
+      current += sql4.slice(i2, end);
+      i2 = end;
+    } else {
+      current += char3;
+      i2++;
+    }
+  }
+  statements.push(current);
+  return statements.map((statement) => statement.trim()).filter((statement) => normalizeSqlForChecksum(statement).trim() !== "");
+}
+function blankStringLiterals(sql4) {
+  let output = "";
+  let i2 = 0;
+  while (i2 < sql4.length) {
+    const char3 = sql4[i2];
+    if (char3 === "'") {
+      output += "''";
+      i2 = scanQuoteEnd(sql4, i2, char3);
+    } else if (char3 === '"' || char3 === "`") {
+      const end = scanQuoteEnd(sql4, i2, char3);
+      output += sql4.slice(i2, end);
+      i2 = end;
+    } else if (char3 === "[") {
+      const end = scanBracketEnd(sql4, i2);
+      output += sql4.slice(i2, end);
+      i2 = end;
+    } else {
+      output += char3;
+      i2++;
+    }
+  }
+  return output;
+}
+function scanLineCommentEnd(sql4, start2) {
+  let i2 = start2 + 2;
+  while (i2 < sql4.length && sql4[i2] !== `
+`) {
+    i2++;
+  }
+  return i2;
+}
+function scanBlockCommentEnd(sql4, start2) {
+  let i2 = start2 + 2;
+  while (i2 < sql4.length && !(sql4[i2] === "*" && sql4[i2 + 1] === "/")) {
+    i2++;
+  }
+  return Math.min(i2 + 2, sql4.length);
+}
+function scanQuoteEnd(sql4, start2, quote) {
+  let i2 = start2 + 1;
+  while (i2 < sql4.length) {
+    if (sql4[i2] !== quote) {
+      i2++;
+    } else if (sql4[i2 + 1] === quote) {
+      i2 += 2;
+    } else {
+      return i2 + 1;
+    }
+  }
+  return i2;
+}
+function scanBracketEnd(sql4, start2) {
+  let i2 = start2 + 1;
+  while (i2 < sql4.length) {
+    if (sql4[i2] === "]") {
+      return i2 + 1;
+    }
+    i2++;
+  }
+  return i2;
+}
+function isAlreadyExistsSqlError(message) {
+  return /already exists|duplicate column/i.test(message);
+}
+function readIdentifier(groups) {
+  return groups.find((group) => group !== undefined) ?? "";
+}
+function extractCreatedObjects(statements) {
+  const tables = [];
+  const columns2 = [];
+  for (const statement of statements) {
+    const scannable = blankStringLiterals(normalizeSqlForChecksum(statement));
+    for (const match of scannable.matchAll(CREATE_TABLE_RE)) {
+      const name2 = readIdentifier(match.slice(1, 5));
+      if (name2 && !name2.startsWith("__new_")) {
+        tables.push(name2);
+      }
+    }
+    for (const match of scannable.matchAll(ADD_COLUMN_RE)) {
+      const table8 = readIdentifier(match.slice(1, 5));
+      const column2 = readIdentifier(match.slice(5, 9));
+      if (table8 && column2 && !table8.startsWith("__new_")) {
+        columns2.push({ table: table8, column: column2 });
+      }
+    }
+  }
+  return { tables, columns: columns2 };
+}
+var DESTRUCTIVE_SQL_PATTERNS;
+var IDENTIFIER_SOURCE;
+var CREATE_TABLE_RE;
+var ADD_COLUMN_RE;
+var init_sql3 = __esm(() => {
+  init_schema3();
+  DESTRUCTIVE_SQL_PATTERNS = [
+    /\bDROP\s+TABLE\b/i,
+    /\bALTER\s+TABLE\b[\s\S]*\bDROP\b/i,
+    /\bCREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?["'`[]?__new_/i
+  ];
+  IDENTIFIER_SOURCE = String.raw`(?:"([^"]+)"|\`([^\`]+)\`|\[([^\]]+)\]|([A-Za-z_][\w$]*))`;
+  CREATE_TABLE_RE = new RegExp(String.raw`\bCREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?${IDENTIFIER_SOURCE}`, "gi");
+  ADD_COLUMN_RE = new RegExp(String.raw`\bALTER\s+TABLE\s+${IDENTIFIER_SOURCE}\s+ADD\s+(?:COLUMN\s+)?${IDENTIFIER_SOURCE}`, "gi");
+});
 var require_sbmh = __commonJS2((exports, module2) => {
   var { EventEmitter } = __require2("node:events");
   var { inherits } = __require2("node:util");
@@ -49444,6 +50116,8 @@ var init_multipart = __esm(() => {
 var init_utils5 = __esm(() => {
   init_hostname();
   init_assets();
+  init_schema3();
+  init_sql3();
   init_multipart();
 });
 var init_r2 = __esm(() => {
@@ -49584,6 +50258,12 @@ var init_client = __esm(() => {
 var init_core = __esm(() => {
   init_client();
 });
+var init_src4 = __esm(() => {
+  init_core();
+  init_namespaces();
+  init_utils5();
+  init_utils5();
+});
 var CUSTOM_DOMAINS_KV_NAME = "cademy-custom-domains";
 var QUEUE_NAME_PREFIX = "playcademy";
 var GAME_WORKER_DOMAIN_PRODUCTION;
@@ -52074,43 +52754,374 @@ var matchedPorts;
 var init_tunnel = __esm(() => {
   matchedPorts = new Map;
 });
-function isPreviewStage(stage) {
-  return PREVIEW_STAGE_PATTERN.test(stage);
+function assertBaselineClaimValid(args2) {
+  const validation = validateBaselineClaim(args2);
+  const blocked = validation.contradictions.length > 0 || validation.unverified.length > 0 && !args2.allowUnverified;
+  if (blocked) {
+    addEvent("deployment_state.baseline_claim_rejected", {
+      "app.game.id": args2.gameId,
+      "app.deployment_state.baseline_claim_source": args2.source,
+      "app.deployment_state.baseline_contradictions": validation.contradictions.length,
+      "app.deployment_state.baseline_unverified": validation.unverified.length,
+      "app.deployment_state.baseline_suggested_tag": validation.suggestedTag ?? "none"
+    });
+    throw new BaselineClaimRejectedError({
+      contradictions: validation.contradictions,
+      unverified: validation.unverified,
+      suggestedTag: validation.suggestedTag,
+      claimedTag: args2.claimedTag
+    });
+  }
+  if (validation.unverified.length > 0) {
+    addEvent("deployment_state.baseline_unverified_overridden", {
+      "app.game.id": args2.gameId,
+      "app.user.id": args2.userId,
+      "app.deployment_state.baseline_overridden_tags": validation.unverified.map((entry2) => entry2.tag).join(",")
+    });
+  }
+}
+function validateBaselineClaim(args2) {
+  const { claimedTag, evidence, tables, indexes: indexes2, views, lastDeployAt } = args2;
+  const claimedIndex = evidence.findIndex((entry2) => entry2.tag === claimedTag);
+  const expected = replayEvidence(evidence, claimedIndex);
+  const live = { tables, indexes: indexes2, views };
+  const verdicts = [];
+  const unverified = [];
+  evidence.forEach((entry2, index2) => {
+    if (claimedIndex === -1 || index2 > claimedIndex) {
+      verdicts.push(judgeBeyond(entry2, expected, live));
+      return;
+    }
+    const judged = judgeClaimed(entry2, expected, live, lastDeployAt);
+    verdicts.push(judged.verdict);
+    if (judged.unverifiable) {
+      unverified.push(judged.verdict);
+    }
+  });
+  return {
+    verdicts,
+    contradictions: verdicts.filter((verdict) => verdict.verdict === "contradicted"),
+    unverified,
+    suggestedTag: suggestTag(evidence, tables)
+  };
 }
-var PREVIEW_STAGE_PATTERN;
-var init_stages = __esm(() => {
-  PREVIEW_STAGE_PATTERN = /^pr-\d+$/;
+function replayEvidence(evidence, claimedIndex) {
+  const state = { tables: new Map, indexes: new Map, views: new Map };
+  for (let index2 = 0;index2 <= claimedIndex; index2++) {
+    applyEvidenceEntry(state, evidence[index2]);
+  }
+  return state;
+}
+function applyEvidenceEntry(state, entry2) {
+  for (const table8 of entry2.dropsTables) {
+    state.tables.delete(table8);
+  }
+  for (const dropped of entry2.dropsColumns) {
+    state.tables.get(dropped.table)?.columns.delete(dropped.column);
+  }
+  for (const droppedIndex of entry2.dropsIndexes) {
+    state.indexes.delete(droppedIndex);
+  }
+  for (const view2 of entry2.dropsViews) {
+    state.views.delete(view2);
+  }
+  for (const table8 of entry2.createsTables) {
+    state.tables.set(table8.name, {
+      creator: entry2.tag,
+      columns: new Map(table8.columns.map((column2) => [column2, entry2.tag]))
+    });
+  }
+  for (const added of entry2.addsColumns) {
+    state.tables.get(added.table)?.columns.set(added.column, entry2.tag);
+  }
+  for (const createdIndex of entry2.createsIndexes) {
+    state.indexes.set(createdIndex, entry2.tag);
+  }
+  for (const view2 of entry2.createsViews) {
+    state.views.set(view2, entry2.tag);
+  }
+}
+function judgeClaimed(entry2, expected, live, lastDeployAt) {
+  let surviving = 0;
+  for (const table8 of entry2.createsTables) {
+    const expectation = expected.tables.get(table8.name);
+    if (expectation?.creator === entry2.tag) {
+      surviving++;
+      const columns2 = live.tables.get(table8.name);
+      if (!columns2) {
+        return {
+          verdict: {
+            tag: entry2.tag,
+            verdict: "contradicted",
+            detail: `creates table \`${table8.name}\`, which is not in the live database`
+          },
+          unverifiable: false
+        };
+      }
+      const missing = [...expectation.columns.entries()].filter(([, creator]) => creator === entry2.tag).map(([column2]) => column2).filter((column2) => !columns2.includes(column2));
+      if (missing.length > 0) {
+        return {
+          verdict: {
+            tag: entry2.tag,
+            verdict: "contradicted",
+            detail: `table \`${table8.name}\` exists but is missing column(s) ${missing.map((column2) => `\`${column2}\``).join(", ")} this migration defines`
+          },
+          unverifiable: false
+        };
+      }
+    }
+  }
+  for (const added of entry2.addsColumns) {
+    if (expected.tables.get(added.table)?.columns.get(added.column) === entry2.tag) {
+      surviving++;
+      const columns2 = live.tables.get(added.table);
+      if (columns2 && !columns2.includes(added.column)) {
+        return {
+          verdict: {
+            tag: entry2.tag,
+            verdict: "contradicted",
+            detail: `adds column \`${added.column}\` to \`${added.table}\`, which the live table does not have`
+          },
+          unverifiable: false
+        };
+      }
+    }
+  }
+  for (const name2 of entry2.createsIndexes) {
+    if (expected.indexes.get(name2) === entry2.tag && live.indexes.has(name2)) {
+      surviving++;
+    }
+  }
+  for (const name2 of entry2.createsViews) {
+    if (expected.views.get(name2) === entry2.tag && live.views.has(name2)) {
+      surviving++;
+    }
+  }
+  if (surviving === 0) {
+    const generated = new Date(entry2.generatedAt);
+    if (lastDeployAt && generated > lastDeployAt) {
+      return {
+        verdict: {
+          tag: entry2.tag,
+          verdict: "no-signal",
+          detail: `no schema footprint to verify, and it was generated after the last deploy (${lastDeployAt.toISOString()})`
+        },
+        unverifiable: true
+      };
+    }
+    return { verdict: { tag: entry2.tag, verdict: "no-signal" }, unverifiable: false };
+  }
+  return { verdict: { tag: entry2.tag, verdict: "verified" }, unverifiable: false };
+}
+function judgeBeyond(entry2, expected, live) {
+  for (const table8 of entry2.createsTables) {
+    if (live.tables.has(table8.name) && !expected.tables.has(table8.name)) {
+      return {
+        tag: entry2.tag,
+        verdict: "contradicted",
+        detail: `is beyond the claim, but the table it creates (\`${table8.name}\`) already exists in the live database — the claim looks too old`
+      };
+    }
+  }
+  for (const added of entry2.addsColumns) {
+    const columns2 = live.tables.get(added.table);
+    const explained = expected.tables.get(added.table)?.columns.has(added.column);
+    if (columns2?.includes(added.column) && !explained) {
+      return {
+        tag: entry2.tag,
+        verdict: "contradicted",
+        detail: `is beyond the claim, but the column it adds (\`${added.table}.${added.column}\`) already exists — the claim looks too old`
+      };
+    }
+  }
+  for (const index2 of entry2.createsIndexes) {
+    if (live.indexes.has(index2) && !expected.indexes.has(index2)) {
+      return {
+        tag: entry2.tag,
+        verdict: "contradicted",
+        detail: `is beyond the claim, but the index it creates (\`${index2}\`) already exists — the claim looks too old`
+      };
+    }
+  }
+  for (const view2 of entry2.createsViews) {
+    if (live.views.has(view2) && !expected.views.has(view2)) {
+      return {
+        tag: entry2.tag,
+        verdict: "contradicted",
+        detail: `is beyond the claim, but the view it creates (\`${view2}\`) already exists — the claim looks too old`
+      };
+    }
+  }
+  return { tag: entry2.tag, verdict: "verified" };
+}
+function suggestTag(evidence, tables) {
+  const liveCreated = [
+    ...new Set(evidence.flatMap((entry2) => entry2.createsTables.map((table8) => table8.name)))
+  ].filter((name2) => tables.has(name2));
+  const state = { tables: new Map, indexes: new Map, views: new Map };
+  let best = null;
+  for (const entry2 of evidence) {
+    applyEvidenceEntry(state, entry2);
+    const allPresent = [...state.tables.keys()].every((name2) => tables.has(name2));
+    const noStray = liveCreated.every((name2) => state.tables.has(name2));
+    if (allPresent && noStray) {
+      best = entry2.tag;
+    }
+  }
+  return best;
+}
+var init_baseline_validation_util = __esm(() => {
+  init_spans();
+  init_errors();
 });
-function getGameDeploymentId(gameSlug, sstStage) {
-  if (sstStage === "production") {
-    return gameSlug;
+function sliceJournalToTag(journal, lastAppliedMigrationTag) {
+  const index2 = journal.findIndex((entry2) => entry2.tag === lastAppliedMigrationTag);
+  return index2 === -1 ? null : journal.slice(0, index2 + 1);
+}
+function evaluateBaselineGuardrails(input) {
+  if (input.ledgerTags.length > 0) {
+    return "ledger-not-empty";
   }
-  if (sstStage === "dev" || isPreviewStage(sstStage)) {
-    return `${WORKER_NAMING.STAGING_PREFIX}${gameSlug}`;
+  if (input.liveTables.length === 0) {
+    return "database-empty";
   }
-  return `${WORKER_NAMING.LOCAL_PREFIX}${sstStage}-${gameSlug}`;
+  return "ok";
 }
-function getDashboardDeploymentId(gameSlug, sstStage) {
-  return `${getGameDeploymentId(gameSlug, sstStage)}${DASHBOARD_WORKER_SUFFIX}`;
+function planMigrations(journal, ledger) {
+  const ledgerByTag = new Map(ledger.map((row) => [row.tag, row]));
+  const journalTags = new Set(journal.map((entry2) => entry2.tag));
+  const pendingTags = [];
+  const checksumMismatches = [];
+  for (const entry2 of journal) {
+    const applied = ledgerByTag.get(entry2.tag);
+    if (!applied) {
+      pendingTags.push(entry2.tag);
+    } else {
+      const comparable = applied.checksumAlgo === MIGRATION_CHECKSUM_ALGO;
+      if (comparable && applied.checksum !== entry2.checksum) {
+        checksumMismatches.push({
+          tag: entry2.tag,
+          ledgerChecksum: applied.checksum,
+          journalChecksum: entry2.checksum
+        });
+      }
+    }
+  }
+  const outOfOrderTags = findOutOfOrderTags(journal.map((entry2) => entry2.tag), new Set(ledgerByTag.keys()));
+  const missingFromJournalTags = ledger.filter((row) => !journalTags.has(row.tag)).map((row) => row.tag);
+  return { pendingTags, checksumMismatches, outOfOrderTags, missingFromJournalTags };
 }
-function getGameWorkerApiKeyName(slug) {
-  return `${GAME_WORKER_KEY_PREFIX}${slug}`.substring(0, 32);
+function assessMigrationAlreadyApplied(statements, liveTables) {
+  const created = extractCreatedObjects(statements);
+  const present = [];
+  const missing = [];
+  for (const table8 of created.tables) {
+    (liveTables.has(table8) ? present : missing).push(`table ${table8}`);
+  }
+  for (const added of created.columns) {
+    const live = Boolean(liveTables.get(added.table)?.includes(added.column));
+    (live ? present : missing).push(`column ${added.table}.${added.column}`);
+  }
+  if (present.length === 0) {
+    return { verdict: "no-signal", present, missing };
+  }
+  return {
+    verdict: missing.length === 0 ? "all-present" : "partial",
+    present,
+    missing
+  };
 }
-function getDashboardWorkerApiKeyName(slug) {
-  return `${DASHBOARD_WORKER_KEY_PREFIX}${slug}`;
+function parseMigrationFailure(events) {
+  if (!events) {
+    return null;
+  }
+  for (let i2 = events.length - 1;i2 >= 0; i2--) {
+    const event = events[i2];
+    const failure = event ? parseFailureEvent(event) : null;
+    if (failure) {
+      return failure;
+    }
+  }
+  return null;
 }
-function toBindingName(queueKey) {
-  return `${queueKey.replace(/-/g, "_").toUpperCase()}_QUEUE`;
+function parseFailureEvent(event) {
+  const details = event.details;
+  if (!details) {
+    return null;
+  }
+  const { code, tag, statementIndex, error, d1Message } = details;
+  if (code !== DEPLOY_ERROR_CODES.migrationFailed || typeof tag !== "string") {
+    return null;
+  }
+  return {
+    tag,
+    error: failureMessage(error, d1Message),
+    statementIndex: typeof statementIndex === "number" ? statementIndex : null,
+    at: event.createdAt
+  };
 }
-function generateDeploymentHash(code) {
-  return sha256Hex(code);
+function failureMessage(error, d1Message) {
+  if (typeof error === "string") {
+    return error;
+  }
+  if (typeof d1Message === "string") {
+    return d1Message;
+  }
+  return "Migration failed";
 }
-var GAME_WORKER_KEY_PREFIX = "game-worker-";
-var DASHBOARD_WORKER_KEY_PREFIX = "dash-worker-";
-var init_deployment_util = __esm(() => {
-  init_src();
-  init_stages();
+var init_migration_util = __esm(() => {
+  init_src4();
+  init_errors();
 });
+async function deriveSecretsManifestPepper(platformSecret) {
+  const encoder = new TextEncoder;
+  const keyMaterial = await crypto.subtle.importKey("raw", encoder.encode(platformSecret), "HKDF", false, ["deriveBits"]);
+  const bits = await crypto.subtle.deriveBits({
+    name: "HKDF",
+    hash: "SHA-256",
+    salt: new Uint8Array(32),
+    info: encoder.encode(SECRETS_MANIFEST_HKDF_INFO)
+  }, keyMaterial, 256);
+  return new Uint8Array(bits);
+}
+async function computeSecretDigest(pepper, input) {
+  const key = await crypto.subtle.importKey("raw", new Uint8Array(pepper), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  const message = JSON.stringify([input.gameId, input.key, input.value]);
+  const signature = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(message));
+  return [...new Uint8Array(signature)].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function computeSecretsDiff(input) {
+  const { localDigests, manifest, remoteKeys } = input;
+  const added = [];
+  const changed = [];
+  const unchanged = [];
+  for (const [key, digest] of Object.entries(localDigests)) {
+    const recorded = manifest[key];
+    if (recorded === undefined) {
+      added.push(key);
+    } else if (recorded === digest) {
+      unchanged.push(key);
+    } else {
+      changed.push(key);
+    }
+  }
+  const localKeys = new Set(Object.keys(localDigests));
+  const managedKeys = new Set(Object.keys(manifest));
+  const remoteOnlyManaged = [...managedKeys].filter((key) => !localKeys.has(key));
+  const remoteOnlyUnmanaged = remoteKeys.filter((key) => !managedKeys.has(key) && !localKeys.has(key));
+  return {
+    added: added.toSorted(),
+    changed: changed.toSorted(),
+    unchanged: unchanged.toSorted(),
+    remoteOnlyManaged: remoteOnlyManaged.toSorted(),
+    remoteOnlyUnmanaged: remoteOnlyUnmanaged.toSorted()
+  };
+}
+function findUnmanagedPruneKeys(pruneSecrets, manifest) {
+  const managed = new Set(Object.keys(manifest ?? {}));
+  return pruneSecrets.filter((key) => !managed.has(key));
+}
+var SECRETS_MANIFEST_HKDF_INFO = "playcademy:secrets-manifest:v1";
 async function sweepDashboardWorkerKeys(deleteApiKeysByName, slug) {
   try {
     await deleteApiKeysByName(getDashboardWorkerApiKeyName(slug));
@@ -52125,6 +53136,9 @@ var init_worker_keys_util = __esm(() => {
   init_spans();
   init_deployment_util();
 });
+function hasBinding(binding) {
+  return binding === true || Array.isArray(binding) && binding.length > 0;
+}
 function readDashboardTheme(config2) {
   const theme = config2?.dashboard?.theme;
   return {
@@ -52192,7 +53206,7 @@ class DeployService {
       data: { message: hasBackend ? "Deploying backend code" : "Deploying to platform" }
     };
     const keepAssets = hasBackend && !hasFrontend;
-    const deploymentOptions = this.mapGameBindingsToOptions(deploymentId, request.bindings, request.schema);
+    const deploymentOptions = this.mapGameBindingsToOptions(deploymentId, request.bindings);
     const bindings = deploymentOptions?.bindings;
     setAttributes({
       "app.deploy.has_d1": Boolean(bindings?.d1?.length),
@@ -52201,13 +53215,49 @@ class DeployService {
       "app.deploy.queue_count": bindings?.queues?.length ?? 0,
       "app.deploy.dead_letter_queue_count": DeployService.countDeadLetterQueues(bindings)
     });
-    const activeDeployment = await db2.query.gameDeployments.findFirst({
-      where: activeDeploymentWhere(game2.id, "game"),
-      columns: { resources: true }
-    });
-    if (deploymentOptions?.bindings?.d1?.length) {
+    const [activeDeployment, deploymentState] = await Promise.all([
+      db2.query.gameDeployments.findFirst({
+        where: activeDeploymentWhere(game2.id, "game"),
+        columns: { resources: true }
+      }),
+      db2.query.gameDeploymentState.findFirst({
+        where: eq(gameDeploymentState.gameId, game2.id)
+      })
+    ]);
+    if (request.pruneSecrets?.length) {
+      const unmanaged = findUnmanagedPruneKeys(request.pruneSecrets, deploymentState?.secretsManifest);
+      if (unmanaged.length > 0) {
+        throw new SecretsPruneUnmanagedError(unmanaged);
+      }
+    }
+    let state = deploymentState;
+    if (request.baseline) {
+      if (isSchemaAdopted(state)) {
+        addEvent("deploy.baseline_skipped", {
+          "app.deploy.baseline_source": state?.baselineSource ?? "unknown"
+        });
+      } else {
+        state = yield* this.adoptClientBaseline({
+          game: game2,
+          request,
+          user,
+          deploymentId,
+          baseline: request.baseline,
+          existingResources: activeDeployment?.resources ?? undefined
+        });
+      }
+    }
+    if (deploymentOptions?.bindings?.d1?.length && !isSchemaAdopted(state)) {
       await this.cleanupOrphanD1Databases(cf, deploymentOptions.bindings.d1, slug, game2.id);
     }
+    const databaseOutcome = yield* this.executeDatabaseStep({
+      game: game2,
+      request,
+      user,
+      deploymentId,
+      state,
+      existingResources: activeDeployment?.resources ?? undefined
+    });
     const result = await this.deployToCloudflare({
       deploymentId,
       code: request.code,
@@ -52215,6 +53265,7 @@ class DeployService {
       tempDir,
       options: {
         ...deploymentOptions,
+        ...databaseOutcome.legacySchema && { schema: databaseOutcome.legacySchema },
         compatibilityDate: request.compatibilityDate ?? CLOUDFLARE_COMPATIBILITY_DATE,
         compatibilityFlags: request.compatibilityFlags,
         existingResources: activeDeployment?.resources ?? undefined,
@@ -52230,8 +53281,12 @@ class DeployService {
       result,
       request,
       user,
-      flags: flags2
+      flags: flags2,
+      database: databaseOutcome
     });
+    if (request.pruneSecrets?.length) {
+      yield* this.pruneManagedSecretsStep(game2.id, result.deploymentId, request.pruneSecrets);
+    }
     yield { type: "complete", data: updatedGame };
   }
   async* deployDashboard(context2) {
@@ -52358,7 +53413,10 @@ class DeployService {
       "app.deploy.code_size": request.code?.length ?? 0,
       "app.deploy.compatibility_date": request.compatibilityDate ?? CLOUDFLARE_COMPATIBILITY_DATE,
       "app.deploy.compatibility_flag_count": request.compatibilityFlags?.length ?? 0,
-      "app.deploy.has_schema": Boolean(request.schema)
+      "app.deploy.has_schema": Boolean(request.schema),
+      "app.deploy.has_database_payload": Boolean(request.database),
+      "app.deploy.has_baseline": Boolean(request.baseline),
+      "app.deploy.prune_secret_count": request.pruneSecrets?.length ?? 0
     });
     if (!hasBackend && !hasFrontend && !hasMetadata) {
       throw new ValidationError("Must provide at least one of: uploadToken (frontend), code (backend), or metadata");
@@ -52395,18 +53453,18 @@ class DeployService {
     }
     return "metadata_only";
   }
-  mapGameBindingsToOptions(deploymentId, bindings, schema2) {
-    if (!bindings && !schema2) {
+  mapGameBindingsToOptions(deploymentId, bindings) {
+    if (!bindings) {
       return;
     }
     const workerBindings = {};
-    if (bindings?.database) {
+    if (hasBinding(bindings.database)) {
       workerBindings.d1 = [deploymentId];
     }
-    if (bindings?.keyValue) {
+    if (hasBinding(bindings.keyValue)) {
       workerBindings.kv = [deploymentId];
     }
-    if (bindings?.bucket) {
+    if (hasBinding(bindings.bucket)) {
       workerBindings.r2 = [deploymentId];
     }
     if (bindings?.queues) {
@@ -52435,10 +53493,7 @@ class DeployService {
       });
     }
     const hasBindings = workerBindings.d1?.length || workerBindings.kv?.length || workerBindings.r2?.length || workerBindings.queues?.length;
-    return {
-      ...hasBindings && { bindings: workerBindings },
-      ...schema2 && { schema: schema2 }
-    };
+    return hasBindings ? { bindings: workerBindings } : undefined;
   }
   static countDeadLetterQueues(bindings) {
     return bindings?.queues?.filter((queue) => Boolean(queue.deadLetterQueue)).length ?? 0;
@@ -52462,6 +53517,473 @@ class DeployService {
       }
     }
   }
+  async* executeDatabaseStep(context2) {
+    const { game: game2, request, user, deploymentId, state } = context2;
+    if (request.schema) {
+      if (isSchemaAdopted(state)) {
+        throw new LegacySchemaUpgradeRequiredError;
+      }
+      const legacyDbId = context2.existingResources?.d1?.find((db2) => db2.name === deploymentId)?.id;
+      if (legacyDbId) {
+        const ledger = await this.getCloudflare().d1.readMigrationLedger(legacyDbId);
+        if (ledger.length > 0) {
+          throw new LegacySchemaUpgradeRequiredError;
+        }
+      }
+      setAttribute("app.deploy.db_mode", "legacy");
+      return { ...NO_DATABASE_WORK, legacySchema: request.schema };
+    }
+    const database = request.database;
+    if (!database) {
+      return NO_DATABASE_WORK;
+    }
+    if (!hasBinding(request.bindings?.database)) {
+      throw new ValidationError("The database payload requires a database binding");
+    }
+    if (!request.deployId) {
+      throw new ValidationError("deployId is required when a database payload is present");
+    }
+    setAttribute("app.deploy.db_mode", database.mode);
+    const cf = this.getCloudflare();
+    const persistedId = context2.existingResources?.d1?.find((db2) => db2.name === deploymentId)?.id;
+    const databaseId = persistedId ?? await cf.d1.create(deploymentId);
+    if (database.mode === "migrate") {
+      return yield* this.runMigrateMode({
+        game: game2,
+        user,
+        deployId: request.deployId,
+        databaseId,
+        migrations: database.migrations,
+        state
+      });
+    }
+    return yield* this.runPushMode({ game: game2, databaseId, payload: database, state });
+  }
+  async* runMigrateMode(args2) {
+    const { game: game2, user, deployId, databaseId, migrations, state } = args2;
+    const cf = this.getCloudflare();
+    yield { type: "status", data: { message: "Preparing database migrations" } };
+    await this.assertNoSchemaDrift(databaseId, state);
+    await cf.d1.ensureMigrationLedger(databaseId);
+    const ledger = await cf.d1.readMigrationLedger(databaseId);
+    const plan = planMigrations(migrations.map((migration) => ({ tag: migration.tag, checksum: migration.checksum })), ledger.map((row) => ({
+      tag: row.tag,
+      checksum: row.checksum,
+      checksumAlgo: row.checksum_algo
+    })));
+    setAttributes({
+      "app.deploy.migrations_total": migrations.length,
+      "app.deploy.migrations_applied_before": ledger.length,
+      "app.deploy.migrations_pending": plan.pendingTags.length
+    });
+    if (plan.checksumMismatches.length > 0) {
+      throw new MigrationChecksumMismatchError(plan.checksumMismatches);
+    }
+    if (plan.missingFromJournalTags.length > 0) {
+      throw new MigrationJournalDivergenceError(plan.missingFromJournalTags);
+    }
+    if (plan.outOfOrderTags.length > 0) {
+      throw new MigrationOrderError(plan.outOfOrderTags);
+    }
+    if (plan.pendingTags.length === 0) {
+      yield { type: "status", data: { message: "Database schema is up to date" } };
+      if (ledger.length > 0 && !state?.schemaFingerprint) {
+        const fingerprint2 = await cf.d1.fingerprintSchema(databaseId);
+        await this.persistDeploymentState(game2.id, {
+          schemaFingerprint: fingerprint2.fingerprint
+        });
+        return {
+          ...NO_DATABASE_WORK,
+          schemaFingerprint: fingerprint2.fingerprint
+        };
+      }
+      return {
+        ...NO_DATABASE_WORK,
+        schemaFingerprint: state?.schemaFingerprint ?? null
+      };
+    }
+    const capture = yield* this.captureBookmarkStep(databaseId);
+    const migrationsByTag = new Map(migrations.map((migration) => [migration.tag, migration]));
+    let appliedCount = 0;
+    for (const tag of plan.pendingTags) {
+      const migration = migrationsByTag.get(tag);
+      const count = migration.statements.length;
+      yield {
+        type: "status",
+        data: { message: `Applying ${tag} (${count} statement${count === 1 ? "" : "s"})` }
+      };
+      const startedAt = Date.now();
+      try {
+        await withSpan("deploy.apply_migration", () => cf.d1.applyMigration(databaseId, {
+          tag,
+          statements: migration.statements,
+          checksum: migration.checksum,
+          deployId,
+          appliedBy: user.id
+        }));
+      } catch (error) {
+        if (appliedCount > 0) {
+          await this.recordAppliedPrefixFingerprint(game2.id, databaseId);
+        }
+        throw await this.toMigrationStepError(databaseId, error, migration);
+      }
+      appliedCount++;
+      const seconds = ((Date.now() - startedAt) / 1000).toFixed(1);
+      yield { type: "status", data: { message: `Applied ${tag} (${seconds}s)` } };
+    }
+    setAttribute("app.deploy.migrations_applied", plan.pendingTags.length);
+    const fingerprint = await cf.d1.fingerprintSchema(databaseId);
+    await this.persistDeploymentState(game2.id, {
+      schemaFingerprint: fingerprint.fingerprint,
+      schemaHash: null,
+      schemaSnapshot: null
+    });
+    return {
+      schemaHash: null,
+      schemaFingerprint: fingerprint.fingerprint,
+      timeTravelBookmark: capture?.bookmark ?? null,
+      bookmarkCapturedAt: capture?.capturedAt ?? null
+    };
+  }
+  async* runPushMode(args2) {
+    const { game: game2, databaseId, payload, state } = args2;
+    const cf = this.getCloudflare();
+    yield { type: "status", data: { message: "Verifying database schema state" } };
+    if (typeof payload.baselineHash !== "string" && payload.baselineHash !== null) {
+      throw new ValidationError("Push deploys require baselineHash (null on first deploy)");
+    }
+    if (isMigrateManaged(state)) {
+      const ledger = await cf.d1.readMigrationLedger(databaseId);
+      throw new ValidationError(`This database is migrate-managed (${ledger.length} applied ` + "migration(s)) and does not accept push-mode SQL.", { code: DEPLOY_ERROR_CODES.strategyMismatch });
+    }
+    const storedHash = state?.schemaHash ?? null;
+    if (payload.baselineHash !== storedHash) {
+      throw await this.buildStateConflictError(game2.id, payload.baselineHash);
+    }
+    const statements = splitSqlStatements(payload.sql);
+    const oversized = findOversizedStatement(statements);
+    if (oversized) {
+      throw new ValidationError(`Push statement ${oversized.index} is ${oversized.byteLength} bytes — over ` + `D1's ${D1_MAX_STATEMENT_BYTES / 1024} KB per-statement limit. Split the ` + "statement or reduce its size.", {
+        code: DEPLOY_ERROR_CODES.pushFailed,
+        statementIndex: oversized.index,
+        offset: null
+      });
+    }
+    const destructive = detectDestructiveStatements(statements);
+    setAttributes({
+      "app.deploy.push_statement_count": statements.length,
+      "app.deploy.push_destructive_count": destructive.length,
+      "app.deploy.push_accept_data_loss": Boolean(payload.acceptDataLoss)
+    });
+    if (destructive.length > 0 && !payload.acceptDataLoss) {
+      throw new DestructiveSchemaError(destructive);
+    }
+    await this.assertNoSchemaDrift(databaseId, state);
+    const reserved = await this.persistPushDeploymentState(game2.id, payload.baselineHash, {
+      schemaFingerprint: PUSH_RESERVATION_FINGERPRINT,
+      schemaHash: payload.nextHash,
+      schemaSnapshot: payload.nextSnapshot
+    });
+    if (!reserved) {
+      throw await this.buildStateConflictError(game2.id, payload.baselineHash);
+    }
+    let capture = null;
+    if (statements.length > 0) {
+      capture = yield* this.captureBookmarkStep(databaseId);
+      yield {
+        type: "status",
+        data: {
+          message: `Applying database schema changes (${statements.length} statements)`
+        }
+      };
+      try {
+        await cf.d1.batch(databaseId, [
+          { sql: "PRAGMA defer_foreign_keys = on" },
+          ...statements.map((statement) => ({ sql: statement })),
+          { sql: "PRAGMA defer_foreign_keys = off" }
+        ]);
+      } catch (error) {
+        await this.persistPushDeploymentState(game2.id, payload.nextHash, {
+          schemaFingerprint: state?.schemaFingerprint ?? null,
+          schemaHash: state?.schemaHash ?? null,
+          schemaSnapshot: state?.schemaSnapshot ?? null
+        });
+        throw this.toPushStepError(error);
+      }
+    }
+    const fingerprint = await cf.d1.fingerprintSchema(databaseId);
+    await this.persistDeploymentState(game2.id, {
+      schemaFingerprint: fingerprint.fingerprint
+    });
+    return {
+      schemaHash: payload.nextHash,
+      schemaFingerprint: fingerprint.fingerprint,
+      timeTravelBookmark: capture?.bookmark ?? null,
+      bookmarkCapturedAt: capture?.capturedAt ?? null
+    };
+  }
+  async* captureBookmarkStep(databaseId) {
+    const cf = this.getCloudflare();
+    const bookmark = await cf.d1.captureBookmark(databaseId);
+    const capturedAt = new Date;
+    setAttribute("app.deploy.db_bookmark_captured", bookmark.captured);
+    if (!bookmark.captured) {
+      yield {
+        type: "status",
+        data: { message: `Time Travel bookmark unavailable (${bookmark.error})` }
+      };
+      return null;
+    }
+    yield {
+      type: "status",
+      data: {
+        message: "Captured Time Travel bookmark",
+        details: { bookmark: bookmark.bookmark }
+      }
+    };
+    return { bookmark: bookmark.bookmark, capturedAt };
+  }
+  async toMigrationStepError(databaseId, error, migration) {
+    if (error instanceof D1StatementTooLargeError) {
+      return new ValidationError(error.message, {
+        code: DEPLOY_ERROR_CODES.migrationFailed,
+        tag: migration.tag,
+        statementIndex: error.statementIndex,
+        offset: null,
+        d1Message: error.message
+      });
+    }
+    if (error instanceof D1MigrationError) {
+      addEvent("deploy.migration_failed", {
+        "app.d1.migration_tag": migration.tag,
+        "app.error.message": error.d1Message,
+        ...error.offset !== null && { "app.d1.error_offset": error.offset }
+      });
+      const alreadyApplied = isAlreadyExistsSqlError(error.d1Message) ? await this.assessAlreadyApplied(databaseId, migration.statements) : null;
+      return new MigrationExecutionError({
+        tag: migration.tag,
+        d1Message: error.d1Message,
+        offset: error.offset,
+        ...alreadyApplied ? { alreadyApplied } : {}
+      });
+    }
+    return error;
+  }
+  async assessAlreadyApplied(databaseId, statements) {
+    try {
+      const cf = this.getCloudflare();
+      const live = await cf.d1.fingerprintSchema(databaseId);
+      const tables = await cf.d1.readTableColumns(databaseId, live.tables);
+      const assessment = assessMigrationAlreadyApplied(statements, tables);
+      addEvent("deploy.already_applied_assessment", {
+        "app.deploy.already_applied_verdict": assessment.verdict,
+        "app.deploy.already_applied_present": assessment.present.length,
+        "app.deploy.already_applied_missing": assessment.missing.length
+      });
+      return assessment.verdict === "no-signal" ? null : assessment;
+    } catch (assessError) {
+      addEvent("deploy.already_applied_check_failed", {
+        "app.error.message": errorMessage2(assessError)
+      });
+      return null;
+    }
+  }
+  toPushStepError(error) {
+    if (error instanceof D1BatchError) {
+      addEvent("deploy.push_failed", {
+        "app.error.message": error.d1Message,
+        ...error.offset !== null && { "app.d1.error_offset": error.offset }
+      });
+      return new PushExecutionError({ d1Message: error.d1Message, offset: error.offset });
+    }
+    return error;
+  }
+  async assertNoSchemaDrift(databaseId, state) {
+    if (!state?.schemaFingerprint) {
+      return;
+    }
+    const live = await this.getCloudflare().d1.fingerprintSchema(databaseId);
+    if (live.fingerprint !== state.schemaFingerprint) {
+      addEvent("deploy.state_drift", {
+        "app.deploy.expected_fingerprint": state.schemaFingerprint,
+        "app.deploy.actual_fingerprint": live.fingerprint
+      });
+      throw new DeploymentStateDriftError({
+        expectedFingerprint: state.schemaFingerprint,
+        actualFingerprint: live.fingerprint
+      });
+    }
+  }
+  async buildStateConflictError(gameId, claimedHash) {
+    const [row, lastDeploy] = await Promise.all([
+      this.deps.db.query.gameDeploymentState.findFirst({
+        where: eq(gameDeploymentState.gameId, gameId),
+        columns: { schemaHash: true }
+      }),
+      findLastSuccessfulDeployWithEmail(this.deps.db, gameId)
+    ]);
+    const currentHash = row?.schemaHash ?? null;
+    addEvent("deploy.state_conflict", {
+      "app.deploy.baseline_hash": claimedHash ?? "null",
+      "app.deploy.current_hash": currentHash ?? "null"
+    });
+    return new DeploymentStateConflictError({
+      currentHash,
+      lastDeployAt: lastDeploy?.at.toISOString() ?? null,
+      lastDeployBy: lastDeploy?.email ?? lastDeploy?.userId ?? null
+    });
+  }
+  async recordAppliedPrefixFingerprint(gameId, databaseId) {
+    try {
+      const fingerprint = await this.getCloudflare().d1.fingerprintSchema(databaseId);
+      await this.persistDeploymentState(gameId, {
+        schemaFingerprint: fingerprint.fingerprint
+      });
+    } catch (error) {
+      addEvent("deploy.fingerprint_persist_failed", {
+        "exception.type": errorType(error),
+        "app.error.message": errorMessage2(error)
+      });
+    }
+  }
+  async persistDeploymentState(gameId, patch) {
+    const set = {
+      ...patch,
+      updatedAt: new Date
+    };
+    await this.deps.db.insert(gameDeploymentState).values({ gameId, baselineSource: "deploy", ...set }).onConflictDoUpdate({ target: gameDeploymentState.gameId, set });
+  }
+  async persistArtifactHashes(gameId, patch) {
+    const set = {
+      ...patch.buildHash !== undefined && { buildHash: patch.buildHash },
+      ...patch.integrationsHash !== undefined && {
+        integrationsHash: patch.integrationsHash
+      }
+    };
+    if (Object.keys(set).length === 0) {
+      return;
+    }
+    await this.deps.db.insert(gameDeploymentState).values({ gameId, ...set, updatedAt: new Date }).onConflictDoUpdate({
+      target: gameDeploymentState.gameId,
+      set: { ...set, updatedAt: new Date }
+    });
+  }
+  async persistPushDeploymentState(gameId, baselineHash, patch) {
+    const set = { ...patch, updatedAt: new Date };
+    if (baselineHash === null) {
+      const claimed2 = await this.deps.db.insert(gameDeploymentState).values({ gameId, baselineSource: "deploy", ...set }).onConflictDoUpdate({
+        target: gameDeploymentState.gameId,
+        set,
+        setWhere: isNull(gameDeploymentState.schemaHash)
+      }).returning({ gameId: gameDeploymentState.gameId });
+      return claimed2.length > 0;
+    }
+    const claimed = await this.deps.db.update(gameDeploymentState).set(set).where(and(eq(gameDeploymentState.gameId, gameId), eq(gameDeploymentState.schemaHash, baselineHash))).returning({ gameId: gameDeploymentState.gameId });
+    return claimed.length > 0;
+  }
+  async* adoptClientBaseline(context2) {
+    const { game: game2, request, user, deploymentId, baseline } = context2;
+    const cf = this.getCloudflare();
+    const persistedId = context2.existingResources?.d1?.find((db2) => db2.name === deploymentId)?.id;
+    const databaseId = persistedId ?? (hasBinding(request.bindings?.database) ? await cf.d1.create(deploymentId) : null);
+    if (baseline.lastAppliedMigrationTag && !databaseId) {
+      throw new ValidationError("Baseline claims applied migrations, but the deploy has no database binding");
+    }
+    const live = databaseId ? await cf.d1.fingerprintSchema(databaseId) : null;
+    let recordedRows = 0;
+    if (databaseId && baseline.lastAppliedMigrationTag) {
+      if (live.tables.length === 0) {
+        throw new BaselineDatabaseEmptyError;
+      }
+      const slice = sliceJournalToTag(baseline.journal ?? [], baseline.lastAppliedMigrationTag);
+      if (!slice) {
+        throw new ValidationError(`Baseline lastAppliedMigrationTag '${baseline.lastAppliedMigrationTag}' ` + "is not in the submitted journal");
+      }
+      if (baseline.evidence?.length) {
+        const [tables, lastDeploy] = await Promise.all([
+          cf.d1.readTableColumns(databaseId, live.tables),
+          findLastSuccessfulDeploy(this.deps.db, game2.id)
+        ]);
+        assertBaselineClaimValid({
+          claimedTag: baseline.lastAppliedMigrationTag,
+          evidence: baseline.evidence,
+          tables,
+          indexes: new Set(live.indexes),
+          views: new Set(live.views),
+          lastDeployAt: lastDeploy?.at ?? null,
+          allowUnverified: false,
+          source: "seed",
+          gameId: game2.id,
+          userId: user.id
+        });
+      }
+      await cf.d1.ensureMigrationLedger(databaseId);
+      const ledger = await cf.d1.readMigrationLedger(databaseId);
+      const plan = planMigrations(slice, ledger.map((row) => ({
+        tag: row.tag,
+        checksum: row.checksum,
+        checksumAlgo: row.checksum_algo
+      })));
+      if (plan.checksumMismatches.length > 0) {
+        throw new MigrationChecksumMismatchError(plan.checksumMismatches);
+      }
+      if (plan.missingFromJournalTags.length > 0) {
+        throw new MigrationJournalDivergenceError(plan.missingFromJournalTags);
+      }
+      if (plan.outOfOrderTags.length > 0) {
+        throw new MigrationOrderError(plan.outOfOrderTags);
+      }
+      const checksumByTag = new Map(slice.map((entry2) => [entry2.tag, entry2.checksum]));
+      const rows = plan.pendingTags.map((tag) => ({
+        tag,
+        checksum: checksumByTag.get(tag)
+      }));
+      if (rows.length > 0) {
+        await cf.d1.recordLedgerRows(databaseId, {
+          rows,
+          deployId: `baseline:${request.deployId ?? crypto.randomUUID()}`,
+          appliedBy: user.id,
+          source: "baseline"
+        });
+      }
+      recordedRows = rows.length;
+    }
+    const fingerprint = live?.fingerprint ?? null;
+    const set = {
+      ...baseline.schemaHash !== undefined && { schemaHash: baseline.schemaHash },
+      ...baseline.schemaSnapshot !== undefined && {
+        schemaSnapshot: baseline.schemaSnapshot
+      },
+      ...baseline.integrationsHash !== undefined && {
+        integrationsHash: baseline.integrationsHash
+      },
+      ...baseline.buildHash !== undefined && { buildHash: baseline.buildHash },
+      ...fingerprint !== null && { schemaFingerprint: fingerprint },
+      baselineSource: "client-baseline",
+      updatedAt: new Date
+    };
+    await this.deps.db.insert(gameDeploymentState).values({ gameId: game2.id, ...set }).onConflictDoUpdate({ target: gameDeploymentState.gameId, set });
+    setAttributes({
+      "app.deploy.baseline_adopted": true,
+      "app.deploy.baseline_ledger_rows": recordedRows,
+      "app.deploy.baseline_has_snapshot": baseline.schemaSnapshot !== undefined
+    });
+    yield {
+      type: "status",
+      data: {
+        message: "Adopted deployment state from client baseline",
+        details: {
+          ledgerRows: recordedRows,
+          ...baseline.lastAppliedMigrationTag && {
+            lastAppliedMigrationTag: baseline.lastAppliedMigrationTag
+          }
+        }
+      }
+    };
+    return this.deps.db.query.gameDeploymentState.findFirst({
+      where: eq(gameDeploymentState.gameId, game2.id)
+    });
+  }
   async applyGameMetadata(gameId, request, hasFrontend, hasMetadata, deploymentUrl) {
     const updates = { updatedAt: new Date };
     if (hasFrontend) {
@@ -52487,7 +54009,8 @@ class DeployService {
     result,
     request,
     user,
-    flags: flags2
+    flags: flags2,
+    database
   }) {
     const { hasBackend, hasFrontend, hasMetadata } = flags2;
     const db2 = this.deps.db;
@@ -52497,9 +54020,17 @@ class DeployService {
       deploymentId: result.deploymentId,
       url: result.url,
       codeHash,
+      schemaHash: database.schemaHash,
+      schemaFingerprint: database.schemaFingerprint,
+      timeTravelBookmark: database.timeTravelBookmark,
+      bookmarkCapturedAt: database.bookmarkCapturedAt,
       resources: result.resources,
       target: "game"
     });
+    await this.persistArtifactHashes(game2.id, {
+      buildHash: hasFrontend ? request.buildHash : undefined,
+      integrationsHash: request.integrationsHash
+    });
     if (hasBackend) {
       await withSpan("deploy.configure_worker_secrets", async () => {
         await this.ensureWorkerApiKeyOnWorker(user, DeployService.gameWorkerKeySpec(slug), result.deploymentId);
@@ -52636,6 +54167,29 @@ class DeployService {
     const cf = this.getCloudflare();
     await cf.setSecrets(deploymentId, { QUEUE_INGRESS_SECRET: secret });
   }
+  async* pruneManagedSecretsStep(gameId, deploymentId, pruneSecrets) {
+    const cf = this.getCloudflare();
+    const keys = [...new Set(pruneSecrets)];
+    yield {
+      type: "status",
+      data: {
+        message: `Pruning ${keys.length} managed secret(s)`,
+        details: { keys }
+      }
+    };
+    await withSpan("deploy.prune_secrets", async () => {
+      const existing = await cf.listSecrets(deploymentId);
+      for (const key of keys) {
+        const prefixedKey = `${SECRETS_PREFIX}${key}`;
+        if (existing.includes(prefixedKey)) {
+          await cf.deleteSecret(deploymentId, prefixedKey);
+        }
+      }
+      const pruned = keys.reduce((expr, key) => sql`${expr} - ${key}::text`, sql`coalesce(${gameDeploymentState.secretsManifest}, '{}'::jsonb)`);
+      await this.deps.db.update(gameDeploymentState).set({ secretsManifest: pruned, updatedAt: new Date }).where(eq(gameDeploymentState.gameId, gameId));
+    });
+    setAttribute("app.deploy.pruned_secret_count", keys.length);
+  }
   async ensureDashboardSessionSecret(deploymentId, existingSecrets, hasPriorDeployment) {
     if (existingSecrets === null && hasPriorDeployment) {
       setAttribute("app.deploy.session_secret_outcome", "check_failed_kept");
@@ -52740,6 +54294,10 @@ class DeployService {
         target: record.target,
         url: record.url,
         codeHash: record.codeHash,
+        schemaHash: record.schemaHash ?? null,
+        schemaFingerprint: record.schemaFingerprint ?? null,
+        timeTravelBookmark: record.timeTravelBookmark ?? null,
+        bookmarkCapturedAt: record.bookmarkCapturedAt ?? null,
         resources: record.resources,
         isActive: true
       });
@@ -52749,8 +54307,11 @@ class DeployService {
     await this.deps.alerts.notifyDeploymentFailure(failure).catch(catchAttrs("alerts.delivery", { "app.alerts.type": "deployment_failure" }));
   }
 }
+var PUSH_RESERVATION_FINGERPRINT = "reserved:push-in-flight";
+var NO_DATABASE_WORK;
 var init_deploy_service = __esm(() => {
   init_drizzle_orm();
+  init_src4();
   init_playcademy();
   init_src();
   init_helpers_index();
@@ -52758,9 +54319,17 @@ var init_deploy_service = __esm(() => {
   init_spans();
   init_tunnel();
   init_errors();
+  init_baseline_validation_util();
   init_dashboard_util();
   init_deployment_util();
+  init_migration_util();
   init_worker_keys_util();
+  NO_DATABASE_WORK = {
+    schemaHash: null,
+    schemaFingerprint: null,
+    timeTravelBookmark: null,
+    bookmarkCapturedAt: null
+  };
 });
 
 class DeveloperService {
@@ -54205,7 +55774,7 @@ function createGameServices(deps) {
     }
   };
 }
-var init_game2 = __esm(() => {
+var init_game3 = __esm(() => {
   init_dashboard_service();
   init_deploy_job_service();
   init_deploy_service();
@@ -54395,16 +55964,37 @@ class AlertsService {
     await this.sendAlert(discord, embed.build());
   }
   async notifyDeploymentFailure(failure) {
-    const discord = this.recordAlert("deployment_failure");
+    const refused = DEPLOY_REFUSAL_CODES.has(failure.errorCode ?? "");
+    const discord = this.recordAlert(refused ? "deployment_blocked" : "deployment_failure");
     if (!discord) {
       return;
     }
-    const [title, subject] = failure.target === "dashboard" ? ["❌ Dashboard Deployment Failed", "Dashboard deployment"] : ["❌ Deployment Failed", "Deployment"];
-    const embed = new DiscordEmbedBuilder().setTitle(title).setDescription(`${subject} failed for **${failure.displayName || failure.slug}** (**${this.getEnvironment()}**).`).setColor(DiscordColors.RED).addField("Slug", failure.slug, true);
+    const [noun, subject] = failure.target === "dashboard" ? ["Dashboard Deployment", "Dashboard deployment"] : ["Deployment", "Deployment"];
+    const title = refused ? `\uD83D\uDEA7 ${noun} Blocked` : `❌ ${noun} Failed`;
+    const verb = refused ? "was blocked" : "failed";
+    const embed = new DiscordEmbedBuilder().setTitle(title).setDescription(`${subject} ${verb} for **${failure.displayName || failure.slug}** (**${this.getEnvironment()}**).`).setColor(refused ? DiscordColors.YELLOW : DiscordColors.RED).addField("Slug", failure.slug, true);
     if (failure.developer) {
       embed.addField("Developer", failure.developer.email || failure.developer.id, true);
     }
-    embed.addField("Error", failure.error, false).setFooter("Playcademy Developer Platform").setTimestamp();
+    embed.addField(refused ? "Reason" : "Error", failure.error, false);
+    if (refused) {
+      embed.addField("Next step", "The developer received repair guidance in their terminal", false);
+    }
+    embed.setFooter("Playcademy Developer Platform").setTimestamp();
+    await this.sendAlert(discord, embed.build());
+  }
+  async notifyDeployBlocked(blocked) {
+    const discord = this.recordAlert("deployment_blocked");
+    if (!discord) {
+      return;
+    }
+    const embed = new DiscordEmbedBuilder().setTitle("\uD83D\uDEA7 Deployment Blocked").setDescription(`Deployment was blocked for **${blocked.displayName || blocked.slug}** (**${this.getEnvironment()}**).`).setColor(DiscordColors.YELLOW).addField("Slug", blocked.slug, true);
+    if (blocked.developer) {
+      embed.addField("Developer", blocked.developer.email || blocked.developer.id, true);
+    }
+    embed.addField("Reason", blocked.reason, false);
+    embed.addField("Next step", "The developer received repair guidance in their terminal", false);
+    embed.setFooter("Playcademy Developer Platform").setTimestamp();
     await this.sendAlert(discord, embed.build());
   }
   async notifyGameDeletion(game2) {
@@ -54465,6 +56055,7 @@ var DISCORD_FIELD_LIMIT = 1024;
 var init_alerts_service = __esm(() => {
   init_discord();
   init_spans();
+  init_game2();
 });
 
 class KVBackupService {
@@ -54893,6 +56484,15 @@ class DatabaseService {
   constructor(deps) {
     this.deps = deps;
   }
+  static remapD1Resource(resources, d1ResourceName, databaseId) {
+    return {
+      resources: {
+        ...resources,
+        d1: resources.d1?.map((dbResource) => dbResource.name === d1ResourceName ? { ...dbResource, id: databaseId } : dbResource)
+      },
+      timeTravelBookmark: null
+    };
+  }
   getD1() {
     const d1 = this.deps.cloudflare?.d1;
     if (!d1) {
@@ -54911,11 +56511,7 @@ class DatabaseService {
     try {
       await this.deps.cloudflare.updateD1Binding(dashboardDeployment.deploymentId, databaseId);
       if (dashboardDeployment.resources?.d1?.length) {
-        const updatedResources = {
-          ...dashboardDeployment.resources,
-          d1: dashboardDeployment.resources.d1.map((dbResource) => dbResource.name === d1ResourceName ? { ...dbResource, id: databaseId } : dbResource)
-        };
-        await this.deps.db.update(gameDeployments).set({ resources: updatedResources }).where(eq(gameDeployments.id, dashboardDeployment.id));
+        await this.deps.db.update(gameDeployments).set(DatabaseService.remapD1Resource(dashboardDeployment.resources, d1ResourceName, databaseId)).where(eq(gameDeployments.id, dashboardDeployment.id));
       }
       setAttribute("app.database.dashboard_binding", "updated");
     } catch (error) {
@@ -54926,20 +56522,36 @@ class DatabaseService {
       });
     }
   }
-  async reset(slug, user, schema2) {
+  async reset(slug, user, request = {}) {
+    const { schema: schema2, database } = request;
     setAttributes({
       "app.database.operation": "reset",
+      "app.database.mode": database?.mode ?? (schema2 ? "legacy" : "none"),
       "app.database.schema_size": schema2?.sql.length,
       "app.database.schema_version": schema2?.hash
     });
     const d1 = this.getD1();
     const game2 = await this.deps.validateDeveloperAccessBySlug(user, slug);
+    const state = await this.deps.db.query.gameDeploymentState.findFirst({
+      where: eq(gameDeploymentState.gameId, game2.id)
+    });
+    if (isSchemaAdopted(state) && !database) {
+      if (schema2) {
+        throw new LegacySchemaUpgradeRequiredError;
+      }
+      throw new ValidationError("This game's database state is server-managed: resetting it requires the mode-aware rebuild payload so the recorded state matches the new database. Run the reset through the Playcademy CLI.");
+    }
     const deploymentId = getGameDeploymentId(slug, this.deps.config.sstStage);
+    let resetDatabaseId = null;
     try {
       const databaseId = await d1.reset(deploymentId);
+      resetDatabaseId = databaseId;
       setAttribute("app.database.id", databaseId);
       let schemaPushed = false;
-      if (schema2?.sql) {
+      if (database) {
+        await this.rebuildDatabase(databaseId, database, game2.id, user);
+        schemaPushed = true;
+      } else if (schema2?.sql) {
         await d1.executeSchema(databaseId, schema2);
         schemaPushed = true;
       }
@@ -54955,11 +56567,7 @@ class DatabaseService {
       });
       setAttribute("app.database.active_deployment_found", Boolean(activeDeployment));
       if (activeDeployment?.resources?.d1?.length) {
-        const updatedResources = {
-          ...activeDeployment.resources,
-          d1: activeDeployment.resources.d1.map((dbResource) => dbResource.name === deploymentId ? { ...dbResource, id: databaseId } : dbResource)
-        };
-        await this.deps.db.update(gameDeployments).set({ resources: updatedResources }).where(eq(gameDeployments.id, activeDeployment.id));
+        await this.deps.db.update(gameDeployments).set(DatabaseService.remapD1Resource(activeDeployment.resources, deploymentId, databaseId)).where(eq(gameDeployments.id, activeDeployment.id));
       }
       await this.syncDashboardD1Binding(game2.id, deploymentId, databaseId);
       setAttributes({
@@ -54973,24 +56581,604 @@ class DatabaseService {
         schemaPushed
       };
     } catch (error) {
+      if (database && resetDatabaseId) {
+        await this.recordLiveFingerprint(game2.id, resetDatabaseId);
+      }
       this.deps.alerts.notifyDatabaseResetFailure({
         slug,
         displayName: game2.displayName,
         error: errorMessage2(error),
         developer: { id: user.id, email: user.email }
       }).catch(catchAttrs("alerts.delivery", { "app.alerts.type": "database_reset" }));
+      if (error instanceof DomainError) {
+        throw error;
+      }
       throw new ValidationError(`Database reset failed: ${errorMessage2(error)}`);
     }
   }
+  async rebuildDatabase(databaseId, payload, gameId, user) {
+    const d1 = this.getD1();
+    if (payload.mode === "migrate") {
+      const deployId = `reset:${crypto.randomUUID()}`;
+      await d1.ensureMigrationLedger(databaseId);
+      for (const migration of payload.migrations) {
+        await d1.applyMigration(databaseId, {
+          tag: migration.tag,
+          statements: migration.statements,
+          checksum: migration.checksum,
+          deployId,
+          appliedBy: user.id
+        });
+      }
+      setAttribute("app.database.migrations_replayed", payload.migrations.length);
+      const fingerprint2 = await d1.fingerprintSchema(databaseId);
+      await this.persistDeploymentState(gameId, {
+        schemaFingerprint: fingerprint2.fingerprint,
+        schemaHash: null,
+        schemaSnapshot: null
+      });
+      return;
+    }
+    const statements = splitSqlStatements(payload.sql);
+    if (statements.length > 0) {
+      await d1.batch(databaseId, [
+        { sql: "PRAGMA defer_foreign_keys = on" },
+        ...statements.map((statement) => ({ sql: statement })),
+        { sql: "PRAGMA defer_foreign_keys = off" }
+      ]);
+    }
+    setAttribute("app.database.push_statement_count", statements.length);
+    const fingerprint = await d1.fingerprintSchema(databaseId);
+    await this.persistDeploymentState(gameId, {
+      schemaFingerprint: fingerprint.fingerprint,
+      schemaHash: payload.nextHash,
+      schemaSnapshot: payload.nextSnapshot
+    });
+  }
+  async persistDeploymentState(gameId, patch) {
+    const set = { ...patch, updatedAt: new Date };
+    await this.deps.db.insert(gameDeploymentState).values({ gameId, baselineSource: "deploy", ...set }).onConflictDoUpdate({ target: gameDeploymentState.gameId, set });
+  }
+  async recordLiveFingerprint(gameId, databaseId) {
+    try {
+      const fingerprint = await this.getD1().fingerprintSchema(databaseId);
+      await this.persistDeploymentState(gameId, {
+        schemaFingerprint: fingerprint.fingerprint
+      });
+    } catch (error) {
+      addEvent("database.fingerprint_persist_failed", {
+        "exception.type": errorType(error),
+        "app.error.message": errorMessage2(error)
+      });
+    }
+  }
 }
 var init_database_service = __esm(() => {
   init_drizzle_orm();
+  init_src4();
   init_helpers_index();
   init_tables_index();
   init_spans();
   init_errors();
   init_deployment_util();
 });
+async function listUserSecretKeys(cloudflare2, deploymentId) {
+  try {
+    const allKeys = await cloudflare2.listSecrets(deploymentId);
+    return allKeys.filter((key) => key.startsWith(SECRETS_PREFIX)).map((key) => key.slice(SECRETS_PREFIX.length));
+  } catch (error) {
+    const message = errorMessage2(error);
+    if (message.includes("not found") || message.includes("10007")) {
+      return null;
+    }
+    throw error;
+  }
+}
+var init_secrets_util = __esm(() => {
+  init_src();
+});
+function historyEventEntry(event) {
+  const base = { at: event.createdAt.toISOString(), by: event.email ?? DELETED_ACCOUNT_LABEL };
+  if (event.kind === "restore" && "restoredTo" in event.payload) {
+    return [{ kind: "restore", ...base, restoredTo: event.payload.restoredTo }];
+  }
+  if (event.kind === "blocked" && "code" in event.payload) {
+    return [
+      { kind: "blocked", ...base, code: event.payload.code, reason: event.payload.reason }
+    ];
+  }
+  return [];
+}
+function databaseIdFromResources(resources, deploymentId) {
+  const database = resources?.d1?.find((db2) => db2.name === deploymentId) ?? resources?.d1?.[0];
+  return database?.id ?? null;
+}
+function restorePointCapturedAt(row) {
+  return row.bookmarkCapturedAt ?? row.deployedAt;
+}
+
+class DeploymentStateService {
+  deps;
+  constructor(deps) {
+    this.deps = deps;
+  }
+  async partitionSecretKeys(slug, manifest) {
+    const managedKeys = Object.keys(manifest ?? {});
+    if (!this.deps.cloudflare) {
+      addEvent("deployment_state.secret_keys_unavailable", {
+        "app.error.message": "Cloudflare provider not configured"
+      });
+      return { managedKeys, unmanagedKeys: null };
+    }
+    const deploymentId = getGameDeploymentId(slug, this.deps.config.sstStage);
+    const remoteKeys = await listUserSecretKeys(this.deps.cloudflare, deploymentId);
+    if (remoteKeys === null) {
+      return { managedKeys, unmanagedKeys: [] };
+    }
+    const managed = new Set(managedKeys);
+    return {
+      managedKeys,
+      unmanagedKeys: remoteKeys.filter((key) => !managed.has(key))
+    };
+  }
+  async readAppliedMigrations(slug, resources) {
+    if (!this.deps.cloudflare || !resources?.d1?.length) {
+      return null;
+    }
+    const deploymentId = getGameDeploymentId(slug, this.deps.config.sstStage);
+    const databaseId = databaseIdFromResources(resources, deploymentId);
+    if (!databaseId) {
+      return null;
+    }
+    const ledger = await this.deps.cloudflare.d1.readMigrationLedger(databaseId);
+    setAttributes({ "app.deployment_state.applied_migrations": ledger.length });
+    return ledger.map((row) => ({
+      tag: row.tag,
+      checksum: row.checksum,
+      checksumAlgo: row.checksum_algo
+    }));
+  }
+  async get(slug, user, options = {}) {
+    const game2 = await this.deps.validateDeveloperAccessBySlug(user, slug);
+    const [state, gameDeployment, dashboardDeployment, lastSucceededJob, lastFailedJob] = await Promise.all([
+      this.deps.db.query.gameDeploymentState.findFirst({
+        where: eq(gameDeploymentState.gameId, game2.id)
+      }),
+      this.deps.db.query.gameDeployments.findFirst({
+        where: activeDeploymentWhere(game2.id, "game"),
+        columns: { codeHash: true, url: true, deployedAt: true, resources: true }
+      }),
+      this.deps.db.query.gameDeployments.findFirst({
+        where: activeDeploymentWhere(game2.id, "dashboard"),
+        columns: { url: true, deployedAt: true }
+      }),
+      findLastSuccessfulDeployWithEmail(this.deps.db, game2.id),
+      this.deps.db.query.gameDeployJobs.findFirst({
+        where: and(eq(gameDeployJobs.gameId, game2.id), eq(gameDeployJobs.status, "failed")),
+        orderBy: desc(deployJobInstant()),
+        columns: { events: true }
+      })
+    ]);
+    const [secrets, appliedMigrations] = await Promise.all([
+      this.partitionSecretKeys(slug, state?.secretsManifest ?? null),
+      this.readAppliedMigrations(slug, gameDeployment?.resources ?? null)
+    ]);
+    setAttributes({
+      "app.deployment_state.seeded": Boolean(state),
+      "app.deployment_state.game_deployed": Boolean(gameDeployment),
+      "app.deployment_state.dashboard_deployed": Boolean(dashboardDeployment)
+    });
+    return {
+      gameId: game2.id,
+      seeded: Boolean(state),
+      game: gameDeployment ? {
+        codeHash: gameDeployment.codeHash,
+        buildHash: state?.buildHash ?? null,
+        url: gameDeployment.url,
+        deployedAt: gameDeployment.deployedAt.toISOString()
+      } : null,
+      dashboard: dashboardDeployment ? {
+        url: dashboardDeployment.url,
+        deployedAt: dashboardDeployment.deployedAt.toISOString()
+      } : null,
+      database: {
+        appliedMigrations,
+        lastFailure: parseMigrationFailure(lastFailedJob?.events ?? null),
+        schemaHash: state?.schemaHash ?? null,
+        schemaFingerprint: state?.schemaFingerprint ?? null,
+        ...options.includeSchemaSnapshot && {
+          schemaSnapshot: state?.schemaSnapshot ?? null
+        }
+      },
+      secrets,
+      integrationsHash: state?.integrationsHash ?? null,
+      compatibilityDate: state?.compatibilityDate ?? null,
+      lastDeploy: lastSucceededJob ? {
+        at: lastSucceededJob.at.toISOString(),
+        by: lastSucceededJob.email ?? DELETED_ACCOUNT_LABEL
+      } : null
+    };
+  }
+  requireCloudflare() {
+    if (!this.deps.cloudflare) {
+      throw new ValidationError("Deployment-state operations are not available in this environment");
+    }
+    return this.deps.cloudflare;
+  }
+  async resolveDatabaseId(slug, gameId) {
+    const databaseId = await this.findDatabaseId(slug, gameId);
+    if (!databaseId) {
+      throw new ValidationError("Game has no deployed database — deploy with a database binding first");
+    }
+    return databaseId;
+  }
+  findSchemaHashState(gameId) {
+    return this.deps.db.query.gameDeploymentState.findFirst({
+      where: eq(gameDeploymentState.gameId, gameId),
+      columns: { schemaHash: true }
+    });
+  }
+  async findDatabaseId(slug, gameId) {
+    const deployment = await this.deps.db.query.gameDeployments.findFirst({
+      where: activeDeploymentWhere(gameId, "game"),
+      columns: { resources: true }
+    });
+    return databaseIdFromResources(deployment?.resources, getGameDeploymentId(slug, this.deps.config.sstStage));
+  }
+  async baseline(slug, input, user) {
+    const game2 = await this.deps.validateDeveloperAccessBySlug(user, slug);
+    const cf = this.requireCloudflare();
+    const state = await this.deps.db.query.gameDeploymentState.findFirst({
+      where: eq(gameDeploymentState.gameId, game2.id)
+    });
+    const schemaAdopted = isSchemaAdopted(state);
+    const migrateOnlyClaim = Boolean(input.lastAppliedMigrationTag) && input.schemaHash === undefined && input.schemaSnapshot === undefined;
+    if (schemaAdopted && !migrateOnlyClaim) {
+      throw new BaselineAlreadyAdoptedError(state?.baselineSource ?? null);
+    }
+    const databaseId = await this.resolveDatabaseId(slug, game2.id);
+    const [ledger, live] = await Promise.all([
+      cf.d1.readMigrationLedger(databaseId),
+      cf.d1.fingerprintSchema(databaseId)
+    ]);
+    const verdict = evaluateBaselineGuardrails({
+      ledgerTags: ledger.map((row) => row.tag),
+      liveTables: live.tables
+    });
+    if (verdict === "ledger-not-empty") {
+      throw new BaselineLedgerNotEmptyError(ledger.map((row) => row.tag));
+    }
+    if (verdict === "database-empty") {
+      throw new BaselineDatabaseEmptyError;
+    }
+    if (schemaAdopted && state?.schemaFingerprint && live.fingerprint !== state.schemaFingerprint) {
+      throw new DeploymentStateDriftError({
+        expectedFingerprint: state.schemaFingerprint,
+        actualFingerprint: live.fingerprint
+      });
+    }
+    if (input.lastAppliedMigrationTag && input.evidence?.length) {
+      const [tables, lastDeploy] = await Promise.all([
+        cf.d1.readTableColumns(databaseId, live.tables),
+        findLastSuccessfulDeploy(this.deps.db, game2.id)
+      ]);
+      assertBaselineClaimValid({
+        claimedTag: input.lastAppliedMigrationTag,
+        evidence: input.evidence,
+        tables,
+        indexes: new Set(live.indexes),
+        views: new Set(live.views),
+        lastDeployAt: lastDeploy?.at ?? null,
+        allowUnverified: Boolean(input.allowUnverified),
+        source: "manual",
+        gameId: game2.id,
+        userId: user.id
+      });
+    }
+    let recordedTags = [];
+    if (input.lastAppliedMigrationTag) {
+      const slice = sliceJournalToTag(input.journal ?? [], input.lastAppliedMigrationTag);
+      if (!slice) {
+        throw new ValidationError(`lastAppliedMigrationTag '${input.lastAppliedMigrationTag}' is not in the submitted journal`);
+      }
+      await cf.d1.ensureMigrationLedger(databaseId);
+      await cf.d1.recordLedgerRows(databaseId, {
+        rows: slice,
+        deployId: `baseline:${crypto.randomUUID()}`,
+        appliedBy: user.id,
+        source: "baseline"
+      });
+      recordedTags = slice.map((entry2) => entry2.tag);
+    }
+    const graduating = migrateOnlyClaim && isPushAdopted(state);
+    const set = {
+      ...graduating ? { schemaHash: null, schemaSnapshot: null } : {
+        ...input.schemaHash !== undefined && { schemaHash: input.schemaHash },
+        ...input.schemaSnapshot !== undefined && {
+          schemaSnapshot: input.schemaSnapshot
+        }
+      },
+      schemaFingerprint: live.fingerprint,
+      baselineSource: "manual-baseline",
+      updatedAt: new Date
+    };
+    await this.persistDeploymentState(game2.id, set);
+    addEvent("deployment_state.baseline_recorded", {
+      "app.game.id": game2.id,
+      "app.deployment_state.baseline_source": "manual-baseline",
+      "app.deployment_state.baseline_ledger_rows": recordedTags.length,
+      "app.deployment_state.baseline_has_snapshot": input.schemaSnapshot !== undefined,
+      "app.deployment_state.baseline_graduated_from_push": graduating
+    });
+    return this.get(slug, user);
+  }
+  async realignMigration(slug, tag, checksum, user) {
+    const game2 = await this.deps.validateDeveloperAccessBySlug(user, slug);
+    const cf = this.requireCloudflare();
+    const databaseId = await this.resolveDatabaseId(slug, game2.id);
+    const ledger = await cf.d1.readMigrationLedger(databaseId);
+    if (!ledger.some((row) => row.tag === tag)) {
+      throw new NotFoundError("Applied migration", tag);
+    }
+    const updated = await cf.d1.updateLedgerChecksum(databaseId, { tag, checksum });
+    if (!updated) {
+      throw new NotFoundError("Applied migration", tag);
+    }
+    addEvent("deployment_state.migration_realigned", {
+      "app.game.id": game2.id,
+      "app.d1.migration_tag": tag,
+      "app.user.id": user.id
+    });
+    return { tag, checksum, checksumAlgo: MIGRATION_CHECKSUM_ALGO };
+  }
+  async persistDeploymentState(gameId, set) {
+    await this.deps.db.insert(gameDeploymentState).values({ gameId, ...set }).onConflictDoUpdate({ target: gameDeploymentState.gameId, set });
+  }
+  async updateDeploymentState(gameId, set) {
+    const updated = await this.deps.db.update(gameDeploymentState).set(set).where(eq(gameDeploymentState.gameId, gameId)).returning({ gameId: gameDeploymentState.gameId });
+    return updated.length > 0;
+  }
+  async resolveMigration(slug, tag, input, user) {
+    const game2 = await this.deps.validateDeveloperAccessBySlug(user, slug);
+    const cf = this.requireCloudflare();
+    const databaseId = await this.resolveDatabaseId(slug, game2.id);
+    const [ledger, live] = await Promise.all([
+      cf.d1.readMigrationLedger(databaseId),
+      cf.d1.fingerprintSchema(databaseId)
+    ]);
+    const exists2 = ledger.some((row) => row.tag === tag);
+    if (input.resolution === "applied") {
+      if (!input.checksum) {
+        throw new ValidationError("Resolving a migration as 'applied' requires its checksum");
+      }
+      if (exists2) {
+        throw new AlreadyExistsError(`Migration '${tag}' is already recorded as applied`);
+      }
+      await cf.d1.ensureMigrationLedger(databaseId);
+      await cf.d1.recordLedgerRows(databaseId, {
+        rows: [{ tag, checksum: input.checksum }],
+        deployId: `resolve:${crypto.randomUUID()}`,
+        appliedBy: user.id,
+        source: "resolve"
+      });
+    } else {
+      if (!exists2) {
+        throw new NotFoundError("Migration ledger row", tag);
+      }
+      await cf.d1.deleteLedgerRow(databaseId, tag);
+    }
+    const fingerprintRecorded = await this.updateDeploymentState(game2.id, {
+      schemaFingerprint: live.fingerprint,
+      updatedAt: new Date
+    });
+    addEvent("deployment_state.migration_resolved", {
+      "app.game.id": game2.id,
+      "app.d1.migration_tag": tag,
+      "app.deployment_state.resolution": input.resolution,
+      "app.deployment_state.fingerprint_rerecorded": fingerprintRecorded,
+      "app.user.id": user.id
+    });
+    return {
+      tag,
+      resolution: input.resolution,
+      schemaFingerprint: live.fingerprint,
+      fingerprintRecorded
+    };
+  }
+  async history(slug, user, options = {}) {
+    const game2 = await this.deps.validateDeveloperAccessBySlug(user, slug);
+    const limit = options.limit ?? 20;
+    const [jobs, events] = await Promise.all([
+      this.deps.db.select({
+        status: gameDeployJobs.status,
+        createdAt: gameDeployJobs.createdAt,
+        completedAt: gameDeployJobs.completedAt,
+        deployId: gameDeployJobs.deployId,
+        error: gameDeployJobs.error,
+        email: users.email
+      }).from(gameDeployJobs).leftJoin(users, eq(gameDeployJobs.userId, users.id)).where(eq(gameDeployJobs.gameId, game2.id)).orderBy(desc(deployJobInstant())).limit(limit),
+      this.deps.db.select({
+        kind: gameDeployEvents.kind,
+        payload: gameDeployEvents.payload,
+        createdAt: gameDeployEvents.createdAt,
+        email: users.email
+      }).from(gameDeployEvents).leftJoin(users, eq(gameDeployEvents.userId, users.id)).where(eq(gameDeployEvents.gameId, game2.id)).orderBy(desc(gameDeployEvents.createdAt)).limit(limit)
+    ]);
+    setAttributes({
+      "app.deployment_state.history_jobs": jobs.length,
+      "app.deployment_state.history_events": events.length
+    });
+    const deploys = jobs.map((job) => ({
+      kind: "deploy",
+      status: job.status,
+      at: (job.completedAt ?? job.createdAt).toISOString(),
+      completedAt: job.completedAt?.toISOString() ?? null,
+      by: job.email ?? DELETED_ACCOUNT_LABEL,
+      deployId: job.deployId,
+      error: job.error
+    }));
+    const merged = [...deploys, ...events.flatMap(historyEventEntry)].toSorted((a, b) => a.at < b.at ? 1 : -1).slice(0, limit);
+    return { deploys: merged };
+  }
+  async restorePoints(slug, user) {
+    const game2 = await this.deps.validateDeveloperAccessBySlug(user, slug);
+    const retentionCutoff = new Date(Date.now() - D1_TIME_TRAVEL_RETENTION_DAYS * 24 * 60 * 60 * 1000);
+    const [currentDatabaseId, rows, state] = await Promise.all([
+      this.findDatabaseId(slug, game2.id),
+      this.deps.db.query.gameDeployments.findMany({
+        where: and(eq(gameDeployments.gameId, game2.id), eq(gameDeployments.target, "game"), isNotNull(gameDeployments.timeTravelBookmark), gte(gameDeployments.deployedAt, retentionCutoff)),
+        orderBy: desc(gameDeployments.deployedAt),
+        limit: 100,
+        columns: {
+          id: true,
+          deployedAt: true,
+          bookmarkCapturedAt: true,
+          isActive: true,
+          resources: true
+        }
+      }),
+      this.findSchemaHashState(game2.id)
+    ]);
+    if (isPushAdopted(state)) {
+      return { restorePoints: [], restoreUnsupported: true };
+    }
+    if (!currentDatabaseId) {
+      return { restorePoints: [], restoreUnsupported: false };
+    }
+    const deploymentId = getGameDeploymentId(slug, this.deps.config.sstStage);
+    const restorable = rows.filter((row) => databaseIdFromResources(row.resources, deploymentId) === currentDatabaseId && restorePointCapturedAt(row) >= retentionCutoff).slice(0, 20);
+    setAttributes({ "app.deployment_state.restore_points": restorable.length });
+    return {
+      restorePoints: restorable.map((row) => ({
+        id: row.id,
+        capturedAt: restorePointCapturedAt(row).toISOString(),
+        active: row.isActive
+      })),
+      restoreUnsupported: false
+    };
+  }
+  async restoreToBookmark(slug, input, user) {
+    const game2 = await this.deps.validateDeveloperAccessBySlug(user, slug);
+    const cf = this.requireCloudflare();
+    const [row, state, currentDatabaseId, runningJob] = await Promise.all([
+      this.deps.db.query.gameDeployments.findFirst({
+        where: and(eq(gameDeployments.id, input.restorePointId), eq(gameDeployments.gameId, game2.id), eq(gameDeployments.target, "game")),
+        columns: {
+          id: true,
+          timeTravelBookmark: true,
+          deployedAt: true,
+          bookmarkCapturedAt: true,
+          resources: true
+        }
+      }),
+      this.findSchemaHashState(game2.id),
+      this.findDatabaseId(slug, game2.id),
+      this.deps.db.query.gameDeployJobs.findFirst({
+        where: and(eq(gameDeployJobs.gameId, game2.id), or(eq(gameDeployJobs.status, "pending"), and(eq(gameDeployJobs.status, "running"), gt(gameDeployJobs.leaseExpiresAt, new Date)))),
+        columns: { id: true }
+      })
+    ]);
+    if (!row?.timeTravelBookmark) {
+      throw new NotFoundError("Bookmark", input.restorePointId);
+    }
+    if (isPushAdopted(state)) {
+      throw new ValidationError("Restore is not supported for push-mode projects: rewinding the database would leave future push deploys diffing against the wrong schema.", { code: DEPLOY_ERROR_CODES.restoreUnsupported });
+    }
+    if (!currentDatabaseId) {
+      throw new ValidationError("Game has no deployed database — deploy with a database binding first");
+    }
+    const databaseId = currentDatabaseId;
+    const deploymentId = getGameDeploymentId(slug, this.deps.config.sstStage);
+    if (databaseIdFromResources(row.resources, deploymentId) !== databaseId) {
+      throw new ValidationError("This bookmark was captured on a previous database (a reset replaced it since) and can no longer be restored");
+    }
+    const retentionCutoff = new Date(Date.now() - D1_TIME_TRAVEL_RETENTION_DAYS * 24 * 60 * 60 * 1000);
+    if (restorePointCapturedAt(row) < retentionCutoff) {
+      throw new ValidationError(`This bookmark is older than Time Travel's ${D1_TIME_TRAVEL_RETENTION_DAYS}-day retention window and can no longer be restored.`, { code: DEPLOY_ERROR_CODES.restoreExpired });
+    }
+    if (runningJob) {
+      throw new ValidationError("A deploy is currently running for this game. Wait for it to finish, then restore.", { code: DEPLOY_ERROR_CODES.restoreBlockedByDeploy });
+    }
+    const restored = await cf.d1.restoreBookmark(databaseId, row.timeTravelBookmark);
+    const restoredTo = restorePointCapturedAt(row).toISOString();
+    let live;
+    let fingerprintRecorded;
+    try {
+      live = await cf.d1.fingerprintSchema(databaseId);
+      fingerprintRecorded = await this.updateDeploymentState(game2.id, {
+        schemaFingerprint: live.fingerprint,
+        updatedAt: new Date
+      });
+      await this.deps.db.insert(gameDeployEvents).values({
+        gameId: game2.id,
+        userId: user.id,
+        kind: "restore",
+        payload: { restoredTo, previousBookmark: restored.previousBookmark }
+      });
+    } catch (error) {
+      throw new ValidationError(`The database WAS restored, but re-recording its schema fingerprint failed (${errorMessage2(error)}). Run the same restore again to complete it.`, { code: DEPLOY_ERROR_CODES.restoreIncomplete });
+    }
+    addEvent("deployment_state.bookmark_restored", {
+      "app.game.id": game2.id,
+      "app.deployment_state.restore_point": row.id,
+      "app.deployment_state.fingerprint_rerecorded": fingerprintRecorded,
+      "app.user.id": user.id
+    });
+    return {
+      restorePointId: row.id,
+      restoredTo,
+      schemaFingerprint: live.fingerprint,
+      fingerprintRecorded,
+      previousBookmark: restored.previousBookmark
+    };
+  }
+  async reportDeployBlocked(slug, user, report) {
+    const game2 = await this.deps.validateDeveloperAccessBySlug(user, slug);
+    const recent = await this.deps.db.query.gameDeployEvents.findMany({
+      where: and(eq(gameDeployEvents.gameId, game2.id), eq(gameDeployEvents.kind, "blocked"), gt(gameDeployEvents.createdAt, new Date(Date.now() - BLOCKED_ALERT_DEDUP_MS))),
+      orderBy: desc(gameDeployEvents.createdAt),
+      limit: 10,
+      columns: { payload: true }
+    });
+    const duplicate = recent.some((event) => ("code" in event.payload) && event.payload.code === report.code);
+    await this.deps.db.insert(gameDeployEvents).values({
+      gameId: game2.id,
+      userId: user.id,
+      kind: "blocked",
+      payload: { code: report.code, reason: report.reason }
+    });
+    addEvent("deployment_state.deploy_blocked", {
+      "app.game.id": game2.id,
+      "app.deploy.blocked_code": report.code,
+      "app.user.id": user.id,
+      "app.alerts.deduped": duplicate
+    });
+    if (!duplicate) {
+      await this.deps.alerts.notifyDeployBlocked({
+        slug,
+        displayName: game2.displayName,
+        reason: report.reason,
+        developer: { id: user.id, email: user.email ?? null }
+      });
+    }
+  }
+}
+var BLOCKED_ALERT_DEDUP_MS;
+var init_deployment_state_service = __esm(() => {
+  init_drizzle_orm();
+  init_src4();
+  init_src();
+  init_helpers_index();
+  init_tables_index();
+  init_spans();
+  init_game2();
+  init_errors();
+  init_baseline_validation_util();
+  init_deployment_util();
+  init_migration_util();
+  init_secrets_util();
+  BLOCKED_ALERT_DEDUP_MS = 600000;
+});
 
 class DomainService {
   deps;
@@ -55355,6 +57543,7 @@ var init_kv_service = __esm(() => {
 
 class SecretsService {
   deps;
+  pepperPromise = null;
   constructor(deps) {
     this.deps = deps;
   }
@@ -55367,36 +57556,69 @@ class SecretsService {
   getGameDeploymentId(slug) {
     return getGameDeploymentId(slug, this.deps.config.sstStage);
   }
-  async listKeys(slug, user) {
-    await this.deps.validateDeveloperAccessBySlug(user, slug);
-    const cf = this.getCloudflare();
-    const deploymentId = this.getGameDeploymentId(slug);
-    try {
-      const allKeys = await cf.listSecrets(deploymentId);
-      const userKeys = allKeys.filter((k) => k.startsWith(SECRETS_PREFIX)).map((k) => k.slice(SECRETS_PREFIX.length));
-      setAttributes({
-        "app.secrets.operation": "list",
-        "app.secrets.count": userKeys.length,
-        "app.secrets.game_deployed": true
-      });
-      return userKeys;
-    } catch (error) {
-      const message = errorMessage2(error);
-      if (message.includes("not found") || message.includes("10007")) {
+  getPepper() {
+    const pepperSecret = this.deps.config.secretsManifestPepper;
+    if (!pepperSecret) {
+      throw new ValidationError("Secrets manifest is not configured (missing manifest pepper secret)");
+    }
+    this.pepperPromise ??= deriveSecretsManifestPepper(pepperSecret);
+    return this.pepperPromise;
+  }
+  async computeManifestEntries(gameId, secrets) {
+    const pepper = await this.getPepper();
+    const entries = {};
+    for (const [key, value] of Object.entries(secrets)) {
+      entries[key] = await computeSecretDigest(pepper, { gameId, key, value });
+    }
+    return entries;
+  }
+  async readManifest(gameId) {
+    const state = await this.deps.db.query.gameDeploymentState.findFirst({
+      where: eq(gameDeploymentState.gameId, gameId),
+      columns: { secretsManifest: true }
+    });
+    return state?.secretsManifest ?? {};
+  }
+  async upsertManifestEntries(gameId, entries) {
+    const merged = sql`coalesce(${gameDeploymentState.secretsManifest}, '{}'::jsonb) || ${JSON.stringify(entries)}::jsonb`;
+    await this.deps.db.insert(gameDeploymentState).values({ gameId, secretsManifest: entries, updatedAt: new Date }).onConflictDoUpdate({
+      target: gameDeploymentState.gameId,
+      set: { secretsManifest: merged, updatedAt: new Date }
+    });
+  }
+  async removeManifestKey(gameId, key) {
+    await this.deps.db.update(gameDeploymentState).set({
+      secretsManifest: sql`coalesce(${gameDeploymentState.secretsManifest}, '{}'::jsonb) - ${key}::text`,
+      updatedAt: new Date
+    }).where(eq(gameDeploymentState.gameId, gameId));
+  }
+  assertNoReservedKeys(keys, operation) {
+    for (const key of keys) {
+      if (INTERNAL_SECRET_KEYS.includes(key)) {
         setAttributes({
-          "app.secrets.operation": "list",
-          "app.secrets.count": 0,
-          "app.secrets.game_deployed": false
+          "app.secrets.operation": operation,
+          "app.secrets.reserved_key_rejected": true
         });
-        return [];
+        throw new ValidationError(operation === "set" ? `Cannot set reserved secret "${key}"` : `Reserved secret "${key}" cannot be managed — remove it locally`);
       }
-      throw error;
     }
   }
-  async setSecrets(slug, newSecrets, user) {
+  async listKeys(slug, user) {
     await this.deps.validateDeveloperAccessBySlug(user, slug);
     const cf = this.getCloudflare();
     const deploymentId = this.getGameDeploymentId(slug);
+    const userKeys = await listUserSecretKeys(cf, deploymentId);
+    setAttributes({
+      "app.secrets.operation": "list",
+      "app.secrets.count": userKeys?.length ?? 0,
+      "app.secrets.game_deployed": userKeys !== null
+    });
+    return userKeys ?? [];
+  }
+  async setSecrets(slug, newSecrets, user) {
+    const game2 = await this.deps.validateDeveloperAccessBySlug(user, slug);
+    const cf = this.getCloudflare();
+    const deploymentId = this.getGameDeploymentId(slug);
     const secretKeys = Object.keys(newSecrets);
     if (secretKeys.length === 0) {
       throw new ValidationError("At least one secret must be provided");
@@ -55405,14 +57627,9 @@ class SecretsService {
       if (typeof value !== "string") {
         throw new ValidationError(`Secret value for "${key}" must be a string`);
       }
-      if (INTERNAL_SECRET_KEYS.includes(key)) {
-        setAttributes({
-          "app.secrets.operation": "set",
-          "app.secrets.reserved_key_rejected": true
-        });
-        throw new ValidationError(`Cannot set reserved secret "${key}"`);
-      }
     }
+    this.assertNoReservedKeys(secretKeys, "set");
+    const manifestEntries = await this.computeManifestEntries(game2.id, newSecrets);
     try {
       const prefixedSecrets = {};
       for (const [key, value] of Object.entries(newSecrets)) {
@@ -55425,8 +57642,6 @@ class SecretsService {
         "app.secrets.game_deployed": true,
         "app.secrets.reserved_key_rejected": false
       });
-      const allKeys = await cf.listSecrets(deploymentId);
-      return allKeys.filter((k) => k.startsWith(SECRETS_PREFIX)).map((k) => k.slice(SECRETS_PREFIX.length));
     } catch (error) {
       const message = errorMessage2(error);
       if (message.includes("not found") || message.includes("10007")) {
@@ -55438,6 +57653,9 @@ class SecretsService {
       }
       throw error;
     }
+    await this.upsertManifestEntries(game2.id, manifestEntries);
+    const allKeys = await cf.listSecrets(deploymentId);
+    return allKeys.filter((k) => k.startsWith(SECRETS_PREFIX)).map((k) => k.slice(SECRETS_PREFIX.length));
   }
   async deleteSecret(slug, key, user) {
     if (INTERNAL_SECRET_KEYS.includes(key)) {
@@ -55447,19 +57665,25 @@ class SecretsService {
       });
       throw new ValidationError(`Cannot delete reserved secret "${key}"`);
     }
-    await this.deps.validateDeveloperAccessBySlug(user, slug);
+    const game2 = await this.deps.validateDeveloperAccessBySlug(user, slug);
     const cf = this.getCloudflare();
     const deploymentId = this.getGameDeploymentId(slug);
+    const manifest = await this.readManifest(game2.id);
+    const managed = key in manifest;
     try {
       const prefixedKey = `${SECRETS_PREFIX}${key}`;
       const existingKeys = await cf.listSecrets(deploymentId);
-      if (!existingKeys.includes(prefixedKey)) {
+      const onWorker = existingKeys.includes(prefixedKey);
+      if (!onWorker && !managed) {
         throw new NotFoundError("Secret", key);
       }
-      await cf.deleteSecret(deploymentId, prefixedKey);
+      if (onWorker) {
+        await cf.deleteSecret(deploymentId, prefixedKey);
+      }
       setAttributes({
         "app.secrets.operation": "delete",
         "app.secrets.game_deployed": true,
+        "app.secrets.managed": managed,
         "app.secrets.reserved_key_rejected": false
       });
     } catch (error) {
@@ -55476,14 +57700,45 @@ class SecretsService {
       }
       throw error;
     }
+    if (managed) {
+      await this.removeManifestKey(game2.id, key);
+    }
+  }
+  async diff(slug, localSecrets, user) {
+    const game2 = await this.deps.validateDeveloperAccessBySlug(user, slug);
+    const deploymentId = this.getGameDeploymentId(slug);
+    this.assertNoReservedKeys(Object.keys(localSecrets), "diff");
+    const [manifest, remoteKeys, localDigests] = await Promise.all([
+      this.readManifest(game2.id),
+      this.deps.cloudflare ? listUserSecretKeys(this.deps.cloudflare, deploymentId) : null,
+      this.computeManifestEntries(game2.id, localSecrets)
+    ]);
+    const verdicts = computeSecretsDiff({
+      localDigests,
+      manifest,
+      remoteKeys: remoteKeys ?? []
+    });
+    setAttributes({
+      "app.secrets.operation": "diff",
+      "app.secrets.game_deployed": remoteKeys !== null,
+      "app.secrets.diff_added": verdicts.added.length,
+      "app.secrets.diff_changed": verdicts.changed.length,
+      "app.secrets.diff_unchanged": verdicts.unchanged.length,
+      "app.secrets.diff_remote_only_managed": verdicts.remoteOnlyManaged.length,
+      "app.secrets.diff_remote_only_unmanaged": verdicts.remoteOnlyUnmanaged.length
+    });
+    return verdicts;
   }
 }
 var INTERNAL_SECRET_KEYS;
 var init_secrets_service = __esm(() => {
+  init_drizzle_orm();
   init_src();
+  init_tables_index();
   init_spans();
   init_errors();
   init_deployment_util();
+  init_secrets_util();
   INTERNAL_SECRET_KEYS = ["PLAYCADEMY_API_KEY", "GAME_ID", "PLAYCADEMY_BASE_URL"];
 });
 function prefixSecrets(secrets) {
@@ -56019,6 +58274,9 @@ var SINGLE_EMOJI_REGEX;
 var init_emoji = __esm(() => {
   SINGLE_EMOJI_REGEX = /^(?:(?:\p{Regional_Indicator}{2})|(?:[#*0-9]\uFE0F?\u20E3)|(?:\p{Extended_Pictographic}(?:\uFE0F|\p{Emoji_Modifier})?(?:\u200D\p{Extended_Pictographic}(?:\uFE0F|\p{Emoji_Modifier})?)*))$/u;
 });
+function requestsBinding(binding) {
+  return binding === true || Array.isArray(binding) && binding.length > 0;
+}
 var HttpUrlSchema;
 var GameEmojiSchema;
 var GameMetadataRecordSchema;
@@ -56026,6 +58284,7 @@ var InsertGameSchema;
 var UpdateGameSchema;
 var InsertGameDeploymentSchema;
 var InsertGameDeployJobSchema;
+var InsertGameDeploymentStateSchema;
 var UpsertGameMetadataSchema;
 var PatchGameMetadataSchema;
 var AddGameMemberSchema;
@@ -56038,11 +58297,22 @@ var ALLOWED_UPLOAD_EXTENSIONS;
 var InitiateUploadSchema;
 var AddCustomHostnameSchema;
 var SetSecretsRequestSchema;
+var SecretsDiffRequestSchema;
 var SeedRequestSchema;
 var SchemaInfoSchema;
-var DatabaseResetRequestSchema;
 var VerifyTokenSchema;
 var KVSeedRequestSchema;
+var DeployMigrationSchema;
+var DeployDatabaseSchema;
+var DatabaseResetDatabaseSchema;
+var DatabaseResetRequestSchema;
+var BaselineEvidenceSchema;
+var DeployBaselineSchema;
+var DeploymentStateBaselineSchema;
+var MigrationRealignSchema;
+var MigrationResolveSchema;
+var DatabaseRestoreSchema;
+var DeployBlockedReportSchema;
 var DeployRequestSchema;
 var init_schemas2 = __esm(() => {
   init_drizzle_zod();
@@ -56122,6 +58392,9 @@ var init_schemas2 = __esm(() => {
   InsertGameDeployJobSchema = createInsertSchema(gameDeployJobs, {
     status: exports_external.enum(deployJobStatusEnum.enumValues)
   });
+  InsertGameDeploymentStateSchema = createInsertSchema(gameDeploymentState, {
+    secretsManifest: exports_external.record(exports_external.string(), exports_external.string()).nullable().optional()
+  });
   UpsertGameMetadataSchema = exports_external.object({
     displayName: exports_external.string().min(1),
     platform: exports_external.enum(gamePlatformEnum.enumValues),
@@ -56179,6 +58452,9 @@ var init_schemas2 = __esm(() => {
     hostname: exports_external.string().min(1).max(255)
   });
   SetSecretsRequestSchema = exports_external.record(exports_external.string().min(1), exports_external.string());
+  SecretsDiffRequestSchema = exports_external.object({
+    secrets: exports_external.record(exports_external.string().min(1), exports_external.string())
+  });
   SeedRequestSchema = exports_external.object({
     code: exports_external.string().min(1, "Seed code is required"),
     secrets: exports_external.record(exports_external.string(), exports_external.string()).optional()
@@ -56187,9 +58463,6 @@ var init_schemas2 = __esm(() => {
     sql: exports_external.string(),
     hash: exports_external.string()
   });
-  DatabaseResetRequestSchema = exports_external.object({
-    schema: SchemaInfoSchema.optional()
-  });
   VerifyTokenSchema = exports_external.object({
     token: exports_external.string().min(1, "Token is required")
   });
@@ -56201,8 +58474,126 @@ var init_schemas2 = __esm(() => {
       metadata: exports_external.record(exports_external.unknown()).optional()
     }))
   });
+  DeployMigrationSchema = exports_external.object({
+    tag: exports_external.string().min(1),
+    statements: exports_external.array(exports_external.string().min(1)).min(1),
+    checksum: exports_external.string().min(1)
+  });
+  DeployDatabaseSchema = exports_external.discriminatedUnion("mode", [
+    exports_external.object({
+      mode: exports_external.literal("push"),
+      sql: exports_external.string(),
+      baselineHash: exports_external.string().nullable(),
+      nextSnapshot: exports_external.record(exports_external.string(), exports_external.unknown()),
+      nextHash: exports_external.string().min(1),
+      acceptDataLoss: exports_external.boolean().optional()
+    }),
+    exports_external.object({
+      mode: exports_external.literal("migrate"),
+      migrations: exports_external.array(DeployMigrationSchema)
+    })
+  ]);
+  DatabaseResetDatabaseSchema = exports_external.discriminatedUnion("mode", [
+    exports_external.object({
+      mode: exports_external.literal("push"),
+      sql: exports_external.string(),
+      nextSnapshot: exports_external.record(exports_external.string(), exports_external.unknown()),
+      nextHash: exports_external.string().min(1)
+    }),
+    exports_external.object({
+      mode: exports_external.literal("migrate"),
+      migrations: exports_external.array(DeployMigrationSchema)
+    })
+  ]);
+  DatabaseResetRequestSchema = exports_external.object({
+    schema: SchemaInfoSchema.optional(),
+    database: DatabaseResetDatabaseSchema.optional()
+  }).refine((data) => !(data.schema && data.database), {
+    message: "Send either the database payload or the legacy schema field, not both",
+    path: ["database"]
+  });
+  BaselineEvidenceSchema = exports_external.array(exports_external.object({
+    tag: exports_external.string().min(1),
+    generatedAt: exports_external.string().min(1),
+    createsTables: exports_external.array(exports_external.object({
+      name: exports_external.string().min(1),
+      columns: exports_external.array(exports_external.string())
+    })),
+    addsColumns: exports_external.array(exports_external.object({
+      table: exports_external.string().min(1),
+      column: exports_external.string().min(1)
+    })),
+    createsIndexes: exports_external.array(exports_external.string()),
+    createsViews: exports_external.array(exports_external.string()),
+    dropsTables: exports_external.array(exports_external.string()),
+    dropsColumns: exports_external.array(exports_external.object({
+      table: exports_external.string().min(1),
+      column: exports_external.string().min(1)
+    })),
+    dropsIndexes: exports_external.array(exports_external.string()),
+    dropsViews: exports_external.array(exports_external.string())
+  })).optional();
+  DeployBaselineSchema = exports_external.object({
+    lastAppliedMigrationTag: exports_external.string().min(1).optional(),
+    journal: exports_external.array(exports_external.object({
+      tag: exports_external.string().min(1),
+      checksum: exports_external.string().min(1)
+    })).optional(),
+    evidence: BaselineEvidenceSchema,
+    schemaSnapshot: exports_external.unknown().optional(),
+    schemaHash: exports_external.string().min(1).optional(),
+    integrationsHash: exports_external.string().min(1).optional(),
+    buildHash: exports_external.string().min(1).optional()
+  }).refine((data) => !data.lastAppliedMigrationTag === !data.journal, {
+    message: "lastAppliedMigrationTag and journal must be provided together",
+    path: ["journal"]
+  }).refine((data) => data.schemaSnapshot === undefined === !data.schemaHash, {
+    message: "schemaSnapshot and schemaHash must be provided together",
+    path: ["schemaHash"]
+  }).refine((data) => Boolean(data.lastAppliedMigrationTag || data.schemaHash || data.integrationsHash || data.buildHash), {
+    message: "A baseline must claim something — migration history, a schema snapshot, or artifact hashes",
+    path: ["lastAppliedMigrationTag"]
+  });
+  DeploymentStateBaselineSchema = exports_external.object({
+    lastAppliedMigrationTag: exports_external.string().min(1).optional(),
+    journal: exports_external.array(exports_external.object({
+      tag: exports_external.string().min(1),
+      checksum: exports_external.string().min(1)
+    })).optional(),
+    schemaSnapshot: exports_external.unknown().optional(),
+    schemaHash: exports_external.string().min(1).optional(),
+    evidence: BaselineEvidenceSchema,
+    allowUnverified: exports_external.boolean().optional()
+  }).refine((data) => !data.lastAppliedMigrationTag === !data.journal, {
+    message: "lastAppliedMigrationTag and journal must be provided together",
+    path: ["journal"]
+  }).refine((data) => data.schemaSnapshot === undefined === !data.schemaHash, {
+    message: "schemaSnapshot and schemaHash must be provided together",
+    path: ["schemaHash"]
+  }).refine((data) => Boolean(data.lastAppliedMigrationTag) || Boolean(data.schemaHash), {
+    message: "A baseline needs a migration claim, a schema snapshot, or both",
+    path: ["lastAppliedMigrationTag"]
+  });
+  MigrationRealignSchema = exports_external.object({
+    checksum: exports_external.string().min(1)
+  });
+  MigrationResolveSchema = exports_external.object({
+    resolution: exports_external.enum(["applied", "rolled-back"]),
+    checksum: exports_external.string().min(1).optional()
+  }).refine((data) => data.resolution !== "applied" || Boolean(data.checksum), {
+    message: "Resolving a migration as 'applied' requires its checksum",
+    path: ["checksum"]
+  });
+  DatabaseRestoreSchema = exports_external.object({
+    restorePointId: exports_external.string().uuid()
+  });
+  DeployBlockedReportSchema = exports_external.object({
+    code: exports_external.string().regex(/^blocked:[a-z-]+$/).max(64),
+    reason: exports_external.string().min(1).max(2000)
+  });
   DeployRequestSchema = exports_external.object({
     target: exports_external.enum(deploymentTargetEnum.enumValues).optional().default("game"),
+    deployId: exports_external.string().min(1).optional(),
     uploadToken: exports_external.string().optional(),
     code: exports_external.string().optional(),
     codeUploadToken: exports_external.string().optional(),
@@ -56229,6 +58620,11 @@ var init_schemas2 = __esm(() => {
       sql: exports_external.string(),
       hash: exports_external.string()
     }).optional(),
+    database: DeployDatabaseSchema.optional(),
+    baseline: DeployBaselineSchema.optional(),
+    buildHash: exports_external.string().min(1).optional(),
+    integrationsHash: exports_external.string().min(1).optional(),
+    pruneSecrets: exports_external.array(exports_external.string().min(1)).optional(),
     metadata: exports_external.object({
       displayName: exports_external.string().optional(),
       description: exports_external.string().optional(),
@@ -56238,9 +58634,24 @@ var init_schemas2 = __esm(() => {
   }).refine((data) => !(data.code && data.codeUploadToken), {
     message: "Specify either code or codeUploadToken, not both",
     path: ["codeUploadToken"]
-  }).refine((data) => !(data.target === "dashboard" && (data.schema || data.bindings)), {
-    message: "Dashboard deployments cannot include schema or bindings — they attach to the game deployment’s existing resources",
+  }).refine((data) => !(data.target === "dashboard" && (data.schema || data.bindings || data.database)), {
+    message: "Dashboard deployments cannot include schema, database, or bindings — they attach to the game deployment’s existing resources",
     path: ["target"]
+  }).refine((data) => !(data.target === "dashboard" && (data.baseline || data.pruneSecrets)), {
+    message: "Dashboard deployments cannot adopt a baseline or prune secrets",
+    path: ["target"]
+  }).refine((data) => !(data.database && !data.deployId), {
+    message: "deployId is required when a database payload is present",
+    path: ["deployId"]
+  }).refine((data) => !(data.database && data.schema), {
+    message: "Send either the database payload or the legacy schema field, not both",
+    path: ["database"]
+  }).refine((data) => !(data.baseline && data.schema), {
+    message: "The legacy schema field cannot ride a baseline-adopting deploy",
+    path: ["baseline"]
+  }).refine((data) => !(data.database && !requestsBinding(data.bindings?.database)), {
+    message: "The database payload requires a database binding",
+    path: ["database"]
   });
 });
 var LeaderboardQuerySchema;
@@ -101209,7 +103620,7 @@ var init_pure = __esm(() => {
   init_log();
   init_spinner();
 });
-var init_src4 = __esm(() => {
+var init_src5 = __esm(() => {
   init_pure();
 });
 function createOneRosterUrls(baseUrl) {
@@ -103185,7 +105596,7 @@ var init_dist5 = __esm(async () => {
   init_spans();
   init_src();
   init_spans();
-  init_src4();
+  init_src5();
   init_src();
   init_spans();
   init_spans();
@@ -103760,7 +106171,7 @@ function selectTimebackMetricDiscrepancyQueueItems(candidates, options) {
 }
 var DATE_INPUT_RE;
 var init_timeback_discrepancy_queue_util = __esm(() => {
-  init_src4();
+  init_src5();
   init_timeback_util();
   DATE_INPUT_RE = /^\d{4}-\d{2}-\d{2}$/;
 });
@@ -106273,7 +108684,7 @@ var init_timeback_admin_service = __esm(async () => {
   init_constants3();
   init_types2();
   init_utils6();
-  init_src4();
+  init_src5();
   init_timeback3();
   init_errors();
   init_timeback_admin_metrics_util();
@@ -108707,8 +111118,15 @@ function createPlatformServices(deps) {
     validateDeveloperAccess
   });
   const kv = new KVService({ db: db2, cloudflare: cloudflare2, validateDeveloperAccessBySlug });
-  const secrets = new SecretsService({ config: config4, cloudflare: cloudflare2, validateDeveloperAccessBySlug });
+  const secrets = new SecretsService({ db: db2, config: config4, cloudflare: cloudflare2, validateDeveloperAccessBySlug });
   const domain3 = new DomainService({ db: db2, cloudflare: cloudflare2, corsKvs, validateDeveloperAccessBySlug });
+  const deploymentState = new DeploymentStateService({
+    db: db2,
+    config: config4,
+    cloudflare: cloudflare2,
+    alerts,
+    validateDeveloperAccessBySlug
+  });
   const database = new DatabaseService({
     db: db2,
     config: config4,
@@ -108747,6 +111165,7 @@ function createPlatformServices(deps) {
     kv,
     secrets,
     domain: domain3,
+    deploymentState,
     database,
     seed,
     timeback: timeback2,
@@ -108757,6 +111176,7 @@ function createPlatformServices(deps) {
 var init_platform2 = __esm(async () => {
   init_bucket_service();
   init_database_service();
+  init_deployment_state_service();
   init_domain_service();
   init_kv_service();
   init_secrets_service();
@@ -109474,7 +111894,7 @@ function createServices(ctx) {
   };
 }
 var init_factory = __esm(async () => {
-  init_game2();
+  init_game3();
   init_infra2();
   init_player();
   init_standalone();
@@ -109767,6 +112187,7 @@ function buildConfig(options) {
     gameDomain: "localhost",
     uploadBucket: "sandbox-uploads",
     ltiTestMode: true,
+    secretsManifestPepper: "sandbox-secrets-manifest-pepper",
     ...options.config
   });
 }
@@ -127811,7 +130232,7 @@ var _a27;
 var _b12;
 var _c2;
 var View3;
-var init_sql3;
+var init_sql4;
 var _a28;
 var ColumnAliasProxyHandler2;
 var _a29;
@@ -128304,7 +130725,7 @@ var PgSequence;
 var init_sequence2;
 var _a164;
 var PgSchema5;
-var init_schema3;
+var init_schema4;
 var _a165;
 var Cache;
 var _a166;
@@ -149783,7 +152204,7 @@ globstar while`, file3, fr, pattern, pr2, swallowee);
       });
     }
   });
-  init_sql3 = __esm2({
+  init_sql4 = __esm2({
     "../drizzle-orm/dist/sql/sql.js"() {
       init_entity2();
       init_enum2();
@@ -150136,7 +152557,7 @@ globstar while`, file3, fr, pattern, pr2, swallowee);
     "../drizzle-orm/dist/alias.js"() {
       init_column2();
       init_entity2();
-      init_sql3();
+      init_sql4();
       init_table8();
       init_view_common3();
       _a28 = entityKind2;
@@ -150310,7 +152731,7 @@ params: ${params}`);
     "../drizzle-orm/dist/utils.js"() {
       init_column2();
       init_entity2();
-      init_sql3();
+      init_sql4();
       init_subquery2();
       init_table8();
       init_view_common3();
@@ -150569,7 +152990,7 @@ params: ${params}`);
   init_date_common2 = __esm2({
     "../drizzle-orm/dist/pg-core/columns/date.common.js"() {
       init_entity2();
-      init_sql3();
+      init_sql4();
       init_common22();
       PgDateColumnBaseBuilder2 = class extends (_b33 = PgColumnBuilder2, _a54 = entityKind2, _b33) {
         defaultNow() {
@@ -151354,7 +153775,7 @@ params: ${params}`);
   init_uuid3 = __esm2({
     "../drizzle-orm/dist/pg-core/columns/uuid.js"() {
       init_entity2();
-      init_sql3();
+      init_sql4();
       init_common22();
       PgUUIDBuilder2 = class extends (_b88 = PgColumnBuilder2, _a109 = entityKind2, _b88) {
         constructor(name22) {
@@ -151625,7 +154046,7 @@ params: ${params}`);
       init_column2();
       init_entity2();
       init_table8();
-      init_sql3();
+      init_sql4();
       eq2 = (left, right) => {
         return sql4`${left} = ${bindIfParam2(right, left)}`;
       };
@@ -151648,7 +154069,7 @@ params: ${params}`);
   });
   init_select3 = __esm2({
     "../drizzle-orm/dist/sql/expressions/select.js"() {
-      init_sql3();
+      init_sql4();
     }
   });
   init_expressions2 = __esm2({
@@ -151664,7 +154085,7 @@ params: ${params}`);
       init_entity2();
       init_primary_keys2();
       init_expressions2();
-      init_sql3();
+      init_sql4();
       _a124 = entityKind2;
       Relation2 = class {
         constructor(sourceTable, referencedTable, relationName) {
@@ -151718,12 +154139,12 @@ params: ${params}`);
     "../drizzle-orm/dist/sql/functions/aggregate.js"() {
       init_column2();
       init_entity2();
-      init_sql3();
+      init_sql4();
     }
   });
   init_vector22 = __esm2({
     "../drizzle-orm/dist/sql/functions/vector.js"() {
-      init_sql3();
+      init_sql4();
     }
   });
   init_functions2 = __esm2({
@@ -151736,7 +154157,7 @@ params: ${params}`);
     "../drizzle-orm/dist/sql/index.js"() {
       init_expressions2();
       init_functions2();
-      init_sql3();
+      init_sql4();
     }
   });
   dist_exports = {};
@@ -151953,7 +154374,7 @@ params: ${params}`);
       init_alias3();
       init_column2();
       init_entity2();
-      init_sql3();
+      init_sql4();
       init_subquery2();
       init_view_common3();
       _a130 = entityKind2;
@@ -152012,7 +154433,7 @@ params: ${params}`);
   });
   init_indexes2 = __esm2({
     "../drizzle-orm/dist/pg-core/indexes.js"() {
-      init_sql3();
+      init_sql4();
       init_entity2();
       init_columns2();
       _a131 = entityKind2;
@@ -152175,7 +154596,7 @@ params: ${params}`);
   init_view_base2 = __esm2({
     "../drizzle-orm/dist/pg-core/view-base.js"() {
       init_entity2();
-      init_sql3();
+      init_sql4();
       PgViewBase2 = class extends (_b103 = View3, _a136 = entityKind2, _b103) {
       };
       __publicField(PgViewBase2, _a136, "PgViewBase");
@@ -152192,7 +154613,7 @@ params: ${params}`);
       init_table22();
       init_relations2();
       init_sql22();
-      init_sql3();
+      init_sql4();
       init_subquery2();
       init_table8();
       init_utils22();
@@ -152776,7 +155197,7 @@ params: ${params}`);
       init_query_builder3();
       init_query_promise2();
       init_selection_proxy2();
-      init_sql3();
+      init_sql4();
       init_subquery2();
       init_table8();
       init_tracing2();
@@ -153397,7 +155818,7 @@ params: ${params}`);
     "../drizzle-orm/dist/pg-core/utils.js"() {
       init_entity2();
       init_table22();
-      init_sql3();
+      init_sql4();
       init_subquery2();
       init_table8();
       init_view_common3();
@@ -153485,7 +155906,7 @@ params: ${params}`);
       init_entity2();
       init_query_promise2();
       init_selection_proxy2();
-      init_sql3();
+      init_sql4();
       init_table8();
       init_tracing2();
       init_utils22();
@@ -153679,7 +156100,7 @@ params: ${params}`);
       init_table22();
       init_query_promise2();
       init_selection_proxy2();
-      init_sql3();
+      init_sql4();
       init_subquery2();
       init_table8();
       init_utils22();
@@ -153853,7 +156274,7 @@ params: ${params}`);
   init_count2 = __esm2({
     "../drizzle-orm/dist/pg-core/query-builders/count.js"() {
       init_entity2();
-      init_sql3();
+      init_sql4();
       _PgCountBuilder = class _PgCountBuilder2 extends (_c6 = SQL2, _b116 = entityKind2, _a157 = Symbol.toStringTag, _c6) {
         constructor(params) {
           super(_PgCountBuilder2.buildEmbeddedCount(params.source, params.filters).queryChunks);
@@ -154021,7 +156442,7 @@ params: ${params}`);
       init_entity2();
       init_query_builders2();
       init_selection_proxy2();
-      init_sql3();
+      init_sql4();
       init_subquery2();
       init_count2();
       init_query2();
@@ -154193,10 +156614,10 @@ params: ${params}`);
       __publicField(PgSequence, _a163, "PgSequence");
     }
   });
-  init_schema3 = __esm2({
+  init_schema4 = __esm2({
     "../drizzle-orm/dist/pg-core/schema.js"() {
       init_entity2();
-      init_sql3();
+      init_sql4();
       init_enum2();
       init_sequence2();
       init_table22();
@@ -154412,7 +156833,7 @@ params: ${params}`);
       init_primary_keys2();
       init_query_builders2();
       init_roles2();
-      init_schema3();
+      init_schema4();
       init_sequence2();
       init_session3();
       init_subquery22();
@@ -156220,7 +158641,7 @@ ORDER BY
   init_integer22 = __esm2({
     "../drizzle-orm/dist/sqlite-core/columns/integer.js"() {
       init_entity2();
-      init_sql3();
+      init_sql4();
       init_utils22();
       init_common3();
       SQLiteBaseIntegerBuilder = class extends (_b131 = SQLiteColumnBuilder, _a187 = entityKind2, _b131) {
@@ -156583,7 +159004,7 @@ ORDER BY
   init_utils72 = __esm2({
     "../drizzle-orm/dist/sqlite-core/utils.js"() {
       init_entity2();
-      init_sql3();
+      init_sql4();
       init_subquery2();
       init_table8();
       init_view_common3();
@@ -156677,7 +159098,7 @@ ORDER BY
   init_view_base22 = __esm2({
     "../drizzle-orm/dist/sqlite-core/view-base.js"() {
       init_entity2();
-      init_sql3();
+      init_sql4();
       SQLiteViewBase = class extends (_b153 = View3, _a214 = entityKind2, _b153) {
       };
       __publicField(SQLiteViewBase, _a214, "SQLiteViewBase");
@@ -156692,7 +159113,7 @@ ORDER BY
       init_errors22();
       init_relations2();
       init_sql22();
-      init_sql3();
+      init_sql4();
       init_columns22();
       init_table32();
       init_subquery2();
@@ -157272,7 +159693,7 @@ ORDER BY
       init_query_builder3();
       init_query_promise2();
       init_selection_proxy2();
-      init_sql3();
+      init_sql4();
       init_subquery2();
       init_table8();
       init_utils22();
@@ -157635,7 +160056,7 @@ ORDER BY
     "../drizzle-orm/dist/sqlite-core/query-builders/insert.js"() {
       init_entity2();
       init_query_promise2();
-      init_sql3();
+      init_sql4();
       init_table32();
       init_table8();
       init_utils22();
@@ -157882,7 +160303,7 @@ ORDER BY
   init_count22 = __esm2({
     "../drizzle-orm/dist/sqlite-core/query-builders/count.js"() {
       init_entity2();
-      init_sql3();
+      init_sql4();
       _SQLiteCountBuilder = class _SQLiteCountBuilder2 extends (_c8 = SQL2, _b160 = entityKind2, _a226 = Symbol.toStringTag, _c8) {
         constructor(params) {
           super(_SQLiteCountBuilder2.buildEmbeddedCount(params.source, params.filters).queryChunks);
@@ -158051,7 +160472,7 @@ ORDER BY
     "../drizzle-orm/dist/sqlite-core/db.js"() {
       init_entity2();
       init_selection_proxy2();
-      init_sql3();
+      init_sql4();
       init_query_builders22();
       init_subquery2();
       init_count22();
@@ -160022,7 +162443,7 @@ ${withStyle.errorWarning(`We've found duplicated view name across ${source_defau
   init_date_common22 = __esm2({
     "../drizzle-orm/dist/mysql-core/columns/date.common.js"() {
       init_entity2();
-      init_sql3();
+      init_sql4();
       init_common4();
       MySqlDateColumnBaseBuilder = class extends (_b223 = MySqlColumnBuilder, _a301 = entityKind2, _b223) {
         defaultNow() {
@@ -160248,7 +162669,7 @@ ${withStyle.errorWarning(`We've found duplicated view name across ${source_defau
   init_count3 = __esm2({
     "../drizzle-orm/dist/mysql-core/query-builders/count.js"() {
       init_entity2();
-      init_sql3();
+      init_sql4();
       _MySqlCountBuilder = class _MySqlCountBuilder2 extends (_c9 = SQL2, _b237 = entityKind2, _a315 = Symbol.toStringTag, _c9) {
         constructor(params) {
           super(_MySqlCountBuilder2.buildEmbeddedCount(params.source, params.filters).queryChunks);
@@ -160510,7 +162931,7 @@ ${withStyle.errorWarning(`We've found duplicated view name across ${source_defau
   init_view_base3 = __esm2({
     "../drizzle-orm/dist/mysql-core/view-base.js"() {
       init_entity2();
-      init_sql3();
+      init_sql4();
       MySqlViewBase = class extends (_b240 = View3, _a323 = entityKind2, _b240) {
       };
       __publicField(MySqlViewBase, _a323, "MySqlViewBase");
@@ -160525,7 +162946,7 @@ ${withStyle.errorWarning(`We've found duplicated view name across ${source_defau
       init_errors22();
       init_relations2();
       init_expressions2();
-      init_sql3();
+      init_sql4();
       init_subquery2();
       init_table8();
       init_utils22();
@@ -161291,7 +163712,7 @@ ${withStyle.errorWarning(`We've found duplicated view name across ${source_defau
       init_query_builder3();
       init_query_promise2();
       init_selection_proxy2();
-      init_sql3();
+      init_sql4();
       init_subquery2();
       init_table8();
       init_utils22();
@@ -161692,7 +164113,7 @@ ${withStyle.errorWarning(`We've found duplicated view name across ${source_defau
     "../drizzle-orm/dist/mysql-core/query-builders/insert.js"() {
       init_entity2();
       init_query_promise2();
-      init_sql3();
+      init_sql4();
       init_table8();
       init_utils22();
       init_utils8();
@@ -161972,7 +164393,7 @@ ${withStyle.errorWarning(`We've found duplicated view name across ${source_defau
     "../drizzle-orm/dist/mysql-core/db.js"() {
       init_entity2();
       init_selection_proxy2();
-      init_sql3();
+      init_sql4();
       init_subquery2();
       init_count3();
       init_query_builders3();
@@ -162201,7 +164622,7 @@ ${withStyle.errorWarning(`We've found duplicated view name across ${source_defau
       init_cache();
       init_entity2();
       init_errors22();
-      init_sql3();
+      init_sql4();
       init_db3();
       _a341 = entityKind2;
       MySqlPreparedQuery = class {
@@ -164224,7 +166645,7 @@ AND
   init_date_common3 = __esm2({
     "../drizzle-orm/dist/singlestore-core/columns/date.common.js"() {
       init_entity2();
-      init_sql3();
+      init_sql4();
       init_common5();
       SingleStoreDateColumnBaseBuilder = class extends (_b302 = SingleStoreColumnBuilder, _a399 = entityKind2, _b302) {
         defaultNow() {
@@ -164249,7 +166670,7 @@ AND
   init_timestamp3 = __esm2({
     "../drizzle-orm/dist/singlestore-core/columns/timestamp.js"() {
       init_entity2();
-      init_sql3();
+      init_sql4();
       init_utils22();
       init_date_common3();
       SingleStoreTimestampBuilder = class extends (_b304 = SingleStoreDateColumnBaseBuilder, _a401 = entityKind2, _b304) {
@@ -164484,7 +166905,7 @@ AND
   init_count4 = __esm2({
     "../drizzle-orm/dist/singlestore-core/query-builders/count.js"() {
       init_entity2();
-      init_sql3();
+      init_sql4();
       _SingleStoreCountBuilder = class _SingleStoreCountBuilder2 extends (_c12 = SQL2, _b318 = entityKind2, _a415 = Symbol.toStringTag, _c12) {
         constructor(params) {
           super(_SingleStoreCountBuilder2.buildEmbeddedCount(params.source, params.filters).queryChunks);
@@ -164654,7 +167075,7 @@ AND
   init_utils10 = __esm2({
     "../drizzle-orm/dist/singlestore-core/utils.js"() {
       init_entity2();
-      init_sql3();
+      init_sql4();
       init_subquery2();
       init_table8();
       init_indexes4();
@@ -164732,7 +167153,7 @@ AND
     "../drizzle-orm/dist/singlestore-core/query-builders/insert.js"() {
       init_entity2();
       init_query_promise2();
-      init_sql3();
+      init_sql4();
       init_table8();
       init_utils22();
       init_utils10();
@@ -164829,7 +167250,7 @@ AND
       init_errors22();
       init_relations2();
       init_expressions2();
-      init_sql3();
+      init_sql4();
       init_subquery2();
       init_table8();
       init_utils22();
@@ -165360,7 +167781,7 @@ AND
       init_query_builder3();
       init_query_promise2();
       init_selection_proxy2();
-      init_sql3();
+      init_sql4();
       init_subquery2();
       init_table8();
       init_utils22();
@@ -165818,7 +168239,7 @@ AND
     "../drizzle-orm/dist/singlestore-core/db.js"() {
       init_entity2();
       init_selection_proxy2();
-      init_sql3();
+      init_sql4();
       init_subquery2();
       init_count4();
       init_query_builders4();
@@ -165932,7 +168353,7 @@ AND
       init_cache();
       init_entity2();
       init_errors22();
-      init_sql3();
+      init_sql4();
       init_db4();
       _a434 = entityKind2;
       SingleStorePreparedQuery = class {
@@ -168168,7 +170589,7 @@ function requireUserId(userId) {
   return userId;
 }
 var init_params_util = __esm(() => {
-  init_src4();
+  init_src5();
   init_errors();
 });
 function formatZodError(error89) {
@@ -168218,6 +170639,7 @@ var init_utils11 = __esm(() => {
   init_lti_util();
   init_lti_provisioning();
   init_params_util();
+  init_secrets_util();
   init_timeback_util();
   init_validation_util();
 });
@@ -168414,7 +170836,7 @@ var init_database_controller = __esm(() => {
         throw ApiError.unprocessableEntity("Validation failed", details);
       }
     }
-    return ctx.services.database.reset(slug2, ctx.user, body2.schema);
+    return ctx.services.database.reset(slug2, ctx.user, body2);
   });
   database = defineControllerNames("database", {
     reset
@@ -168464,6 +170886,91 @@ var init_deploy_controller = __esm(() => {
     getJob: requireDeveloper(getJob)
   });
 });
+var get;
+var baseline;
+var realignMigration;
+var resolveMigration;
+var history;
+var restorePoints;
+var restore;
+var reportBlocked;
+var deploymentState;
+var init_deployment_state_controller = __esm(() => {
+  init_schemas_index();
+  init_errors();
+  init_utils11();
+  get = requireDeveloper(async (ctx) => {
+    const slug2 = requireSlug(ctx.params.slug);
+    const include = ctx.url.searchParams.getAll("include").flatMap((value) => value.split(",")).filter(Boolean);
+    const unsupported = include.filter((value) => value !== "schemaSnapshot");
+    if (unsupported.length > 0) {
+      throw ApiError.badRequest(`Unsupported include value(s): ${unsupported.join(", ")}`);
+    }
+    return ctx.services.deploymentState.get(slug2, ctx.user, {
+      includeSchemaSnapshot: include.includes("schemaSnapshot")
+    });
+  });
+  baseline = requireDeveloper(async (ctx) => {
+    const slug2 = requireSlug(ctx.params.slug);
+    const body2 = await parseRequestBody(ctx.request, DeploymentStateBaselineSchema);
+    return ctx.services.deploymentState.baseline(slug2, body2, ctx.user);
+  });
+  realignMigration = requireDeveloper(async (ctx) => {
+    const slug2 = requireSlug(ctx.params.slug);
+    const tag = ctx.params.tag;
+    if (!tag) {
+      throw ApiError.badRequest("Missing migration tag");
+    }
+    const body2 = await parseRequestBody(ctx.request, MigrationRealignSchema);
+    return ctx.services.deploymentState.realignMigration(slug2, tag, body2.checksum, ctx.user);
+  });
+  resolveMigration = requireDeveloper(async (ctx) => {
+    const slug2 = requireSlug(ctx.params.slug);
+    const tag = ctx.params.tag;
+    if (!tag) {
+      throw ApiError.badRequest("Missing migration tag");
+    }
+    const body2 = await parseRequestBody(ctx.request, MigrationResolveSchema);
+    return ctx.services.deploymentState.resolveMigration(slug2, tag, body2, ctx.user);
+  });
+  history = requireDeveloper(async (ctx) => {
+    const slug2 = requireSlug(ctx.params.slug);
+    const limitParam = ctx.url.searchParams.get("limit");
+    let limit;
+    if (limitParam !== null) {
+      limit = Number(limitParam);
+      if (!Number.isInteger(limit) || limit < 1 || limit > 100) {
+        throw ApiError.badRequest("limit must be an integer between 1 and 100");
+      }
+    }
+    return ctx.services.deploymentState.history(slug2, ctx.user, { limit });
+  });
+  restorePoints = requireDeveloper(async (ctx) => {
+    const slug2 = requireSlug(ctx.params.slug);
+    return ctx.services.deploymentState.restorePoints(slug2, ctx.user);
+  });
+  restore = requireDeveloper(async (ctx) => {
+    const slug2 = requireSlug(ctx.params.slug);
+    const body2 = await parseRequestBody(ctx.request, DatabaseRestoreSchema);
+    return ctx.services.deploymentState.restoreToBookmark(slug2, body2, ctx.user);
+  });
+  reportBlocked = requireDeveloper(async (ctx) => {
+    const slug2 = requireSlug(ctx.params.slug);
+    const body2 = await parseRequestBody(ctx.request, DeployBlockedReportSchema);
+    await ctx.services.deploymentState.reportDeployBlocked(slug2, ctx.user, body2);
+    return { recorded: true };
+  });
+  deploymentState = defineControllerNames("deploymentState", {
+    get,
+    baseline,
+    realignMigration,
+    resolveMigration,
+    history,
+    restorePoints,
+    restore,
+    reportBlocked
+  });
+});
 var apply;
 var getStatus;
 var developer;
@@ -168953,6 +171460,7 @@ var init_lti_controller = __esm(() => {
 var listKeys2;
 var setSecrets;
 var deleteSecret;
+var diff;
 var secrets;
 var init_secrets_controller = __esm(() => {
   init_esm();
@@ -168999,10 +171507,19 @@ var init_secrets_controller = __esm(() => {
     await ctx.services.secrets.deleteSecret(slug2, key, ctx.user);
     return { success: true };
   });
+  diff = requireDeveloper(async (ctx) => {
+    const slug2 = ctx.params.slug;
+    if (!slug2) {
+      throw ApiError.badRequest("Missing game slug");
+    }
+    const body2 = await parseRequestBody(ctx.request, SecretsDiffRequestSchema);
+    return ctx.services.secrets.diff(slug2, body2.secrets, ctx.user);
+  });
   secrets = defineControllerNames("secrets", {
     listKeys: listKeys2,
     setSecrets,
-    deleteSecret
+    deleteSecret,
+    diff
   });
 });
 var seed2;
@@ -169126,7 +171643,7 @@ var timeback2;
 var init_timeback_controller = __esm(() => {
   init_esm();
   init_schemas_index();
-  init_src4();
+  init_src5();
   init_timeback3();
   init_errors();
   init_utils11();
@@ -169889,6 +172406,7 @@ var init_controllers = __esm(() => {
   init_dashboard_controller();
   init_database_controller();
   init_deploy_controller();
+  init_deployment_state_controller();
   init_developer_controller();
   init_domain_controller();
   init_game_member_controller();
@@ -170409,6 +172927,21 @@ var init_deploy = __esm(async () => {
     });
   });
 });
+var gameDeploymentStateRouter;
+var init_deployment_state = __esm(async () => {
+  init_dist7();
+  init_controllers();
+  await init_api3();
+  gameDeploymentStateRouter = new Hono2;
+  gameDeploymentStateRouter.get("/:slug/deployment-state", handle2(deploymentState.get));
+  gameDeploymentStateRouter.post("/:slug/deployment-state/baseline", handle2(deploymentState.baseline));
+  gameDeploymentStateRouter.post("/:slug/deployment-state/migrations/:tag/realign", handle2(deploymentState.realignMigration));
+  gameDeploymentStateRouter.post("/:slug/deployment-state/migrations/:tag/resolve", handle2(deploymentState.resolveMigration));
+  gameDeploymentStateRouter.get("/:slug/deployments", handle2(deploymentState.history));
+  gameDeploymentStateRouter.post("/:slug/deployments/blocked", handle2(deploymentState.reportBlocked));
+  gameDeploymentStateRouter.get("/:slug/database/restore-points", handle2(deploymentState.restorePoints));
+  gameDeploymentStateRouter.post("/:slug/database/restore", handle2(deploymentState.restore));
+});
 var gameDomainsRouter;
 var init_domains2 = __esm(async () => {
   init_dist7();
@@ -170447,6 +172980,7 @@ var init_secrets = __esm(async () => {
   gameSecretsRouter = new Hono2;
   gameSecretsRouter.get("/:slug/secrets", handle2(secrets.listKeys));
   gameSecretsRouter.post("/:slug/secrets", handle2(secrets.setSecrets));
+  gameSecretsRouter.post("/:slug/secrets/diff", handle2(secrets.diff));
   gameSecretsRouter.delete("/:slug/secrets/:key", handle2(secrets.deleteSecret));
 });
 var gameSeedRouter;
@@ -170641,6 +173175,7 @@ var init_games2 = __esm(async () => {
   await __promiseAll([
     init_crud(),
     init_deploy(),
+    init_deployment_state(),
     init_domains2(),
     init_logs(),
     init_scores(),
@@ -170655,6 +173190,7 @@ var init_games2 = __esm(async () => {
   gamesRouter.route("/", gameVerifyRouter);
   gamesRouter.route("/", gameUploadsRouter);
   gamesRouter.route("/", gameDeployRouter);
+  gamesRouter.route("/", gameDeploymentStateRouter);
   gamesRouter.route("/", gameDomainsRouter);
   gamesRouter.route("/", gameLogsRouter);
   gamesRouter.route("/", gameScoresRouter);
@@ -171586,7 +174122,7 @@ var init_domains3 = __esm3(() => {
 });
 var init_env_vars2 = () => {};
 var GAME_MEMBER_ROLES2;
-var init_game3 = __esm3(() => {
+var init_game4 = __esm3(() => {
   GAME_MEMBER_ROLES2 = {
     OWNER: "owner",
     COLLABORATOR: "collaborator"
@@ -171661,13 +174197,13 @@ var init_cloudflare2 = __esm3(() => {
     LOCAL_PREFIX: "local-"
   };
 });
-var init_src5 = __esm3(() => {
+var init_src6 = __esm3(() => {
   init_auth3();
   init_dashboard2();
   init_typescript2();
   init_domains3();
   init_env_vars2();
-  init_game3();
+  init_game4();
   init_platform3();
   init_timeback8();
   init_cloudflare2();
@@ -171677,7 +174213,7 @@ var DEMO_USER_IDS2;
 var DEMO_USERS2;
 var DEMO_USER2;
 var init_demo_users2 = __esm3(() => {
-  init_src5();
+  init_src6();
   now2 = new Date;
   DEMO_USER_IDS2 = {
     player: "00000000-0000-0000-0000-000000000001",