deepspace 0.10.1 → 0.10.3

package/dist/cli.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 
 // src/cli/cli.ts
-import { defineCommand as defineCommand14, runMain, runCommand } from "citty";
+import { defineCommand as defineCommand13, runMain, runCommand } from "citty";
 import { sync as spawnSync8 } from "cross-spawn";
-import { readFileSync as readFileSync26, existsSync as existsSync25 } from "fs";
+import { readFileSync as readFileSync27, existsSync as existsSync25 } from "fs";
 import { dirname as dirname10, join as join24 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 
@@ -709,7 +709,7 @@ async function provisionProfile(jwt) {
   }
 }
 function sleep(ms) {
-  return new Promise((resolve19) => setTimeout(resolve19, ms));
+  return new Promise((resolve18) => setTimeout(resolve18, ms));
 }
 function base64url(bytes) {
   return bytes.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
@@ -1267,7 +1267,7 @@ function upsertWorktreeLaunchConfig(mainRepoRoot, worktreeName, appDir, opts) {
     let port = opts.port;
     if (opts.probePort) {
       const taken = new Set(
-        config.configurations.map((c) => Number(c?.port)).filter((p35) => Number.isInteger(p35) && p35 > 0)
+        config.configurations.map((c) => Number(c?.port)).filter((p34) => Number.isInteger(p34) && p34 > 0)
       );
       for (let i = 0; i < WORKTREE_PORT_RANGE && taken.has(port); i++) {
         port = WORKTREE_PORT_MIN + (port - WORKTREE_PORT_MIN + 1) % WORKTREE_PORT_RANGE;
@@ -1372,7 +1372,8 @@ var ALLOWED_BINDING_TYPES = /* @__PURE__ */ new Set([
   "queue",
   "browser_rendering",
   "analytics_engine",
-  "hyperdrive"
+  "hyperdrive",
+  "ratelimit"
 ]);
 var RESERVED_BINDING_NAMES = /* @__PURE__ */ new Set([
   "ASSETS",
@@ -1380,6 +1381,7 @@ var RESERVED_BINDING_NAMES = /* @__PURE__ */ new Set([
   "API_WORKER",
   "DEEPSPACE_APP_ID",
   "DEEPSPACE_RESOURCE_ID",
+  "DEEPSPACE_RELEASE_OPERATION_ID",
   "APP_NAME",
   "OWNER_USER_ID",
   "AUTH_JWT_PUBLIC_KEY",
@@ -1470,6 +1472,17 @@ function requiredFieldError(b) {
         return `hyperdrive binding "${b.name}": auto-provisioning not yet supported (provide a real id)`;
       }
       return null;
+    case "ratelimit":
+      if (!/^\d+$/u.test(b.namespace_id) || Number(b.namespace_id) <= 0) {
+        return `ratelimit binding "${b.name}" requires a positive integer namespace_id string`;
+      }
+      if (!Number.isInteger(b.simple?.limit) || b.simple.limit <= 0) {
+        return `ratelimit binding "${b.name}" requires simple.limit (positive integer)`;
+      }
+      if (b.simple.period !== 10 && b.simple.period !== 60) {
+        return `ratelimit binding "${b.name}" requires simple.period (10 or 60)`;
+      }
+      return null;
     case "ai":
     case "browser_rendering":
     case "analytics_engine":
@@ -1547,6 +1560,15 @@ function bindingManifestFromOutputConfig(outputConfig) {
     const id = pluckString(h, "id");
     if (name && id) out.push({ type: "hyperdrive", name, id });
   }
+  for (const r of asObjectArray(outputConfig.ratelimits)) {
+    const name = pluckString(r, "name");
+    const namespace_id = pluckString(r, "namespace_id");
+    const simple = isObject(r.simple) ? r.simple : null;
+    const limit = pluckNumber(simple, "limit");
+    const period = pluckNumber(simple, "period");
+    if (!name || !namespace_id || limit === null || period !== 10 && period !== 60) continue;
+    out.push({ type: "ratelimit", name, namespace_id, simple: { limit, period } });
+  }
   return out;
 }
 function isObject(v) {
@@ -1816,7 +1838,8 @@ async function refreshSecretsCache(deployUrl, token, appId, wranglerEnv) {
   return {
     pulled,
     rendered: renderSecretsCache(pulled.values, pulled),
-    summary: `Secrets: ${pulled.configName} (${count} secret${count === 1 ? "" : "s"})`
+    // An empty store is the common case and not worth a status line.
+    summary: count ? `Secrets: ${pulled.configName} (${count} secret${count === 1 ? "" : "s"})` : null
   };
 }
 
@@ -1897,6 +1920,7 @@ var NON_INHERITABLE_ENV_KEYS = /* @__PURE__ */ new Set([
   "r2_buckets",
   "ai_search_namespaces",
   "ai_search",
+  "ratelimits",
   "vectorize",
   "services",
   "queues",
@@ -1998,6 +2022,13 @@ function flattenWranglerEnvConfig(config, envName) {
   for (const [key, value] of Object.entries(envBlock)) {
     flattened[key] = value;
   }
+  if (!("durable_objects" in envBlock) && config.durable_objects) {
+    flattened.durable_objects = config.durable_objects;
+  }
+  const envVars = asTomlRecord(envBlock.vars) ?? {};
+  if (!("APP_NAME" in envVars) && typeof envBlock.name === "string") {
+    flattened.vars = { ...envVars, APP_NAME: envBlock.name };
+  }
   return flattened;
 }
 function asTomlRecord(value) {
@@ -2259,18 +2290,18 @@ function ensureInstallReady(appDir) {
   const logPath = join9(sentinelDir, "install.log");
   if (existsSync9(errPath)) {
     const detail = readFileSync11(errPath, "utf-8").trimEnd();
-    const log29 = existsSync9(logPath) ? ` Full log: ${logPath}.` : "";
+    const log28 = existsSync9(logPath) ? ` Full log: ${logPath}.` : "";
     throw new Refusal(
-      `Dependency install failed: ${detail}.${log29} Run \`npm install\` (or \`bun install\`) manually, then retry.`,
+      `Dependency install failed: ${detail}.${log28} Run \`npm install\` (or \`bun install\`) manually, then retry.`,
       "install_failed",
       { action: { cwd: appDir, argv: [detectPackageManager(appDir), "install"] } }
     );
   }
   if (existsSync9(startedPath) && !existsSync9(donePath)) {
     if (!installWorkerAlive(sentinelDir)) {
-      const log29 = existsSync9(logPath) ? ` See what happened: ${logPath}.` : "";
+      const log28 = existsSync9(logPath) ? ` See what happened: ${logPath}.` : "";
       throw new Refusal(
-        `The dependency install is no longer running and never finished.${log29} Run \`npm install\` (or \`bun install\`) manually, then retry.`,
+        `The dependency install is no longer running and never finished.${log28} Run \`npm install\` (or \`bun install\`) manually, then retry.`,
         "install_failed",
         { action: { cwd: appDir, argv: [detectPackageManager(appDir), "install"] } }
       );
@@ -2419,7 +2450,7 @@ function lintSchema(schema) {
     const offendingRoles = Object.entries(schema.permissions).filter(([, perms]) => perms.read === true).map(([role]) => role);
     if (offendingRoles.length > 0) {
       const usesAware = Object.values(schema.permissions).some(
-        (p35) => typeof p35.read === "string" && VISIBILITY_AWARE.includes(p35.read)
+        (p34) => typeof p34.read === "string" && VISIBILITY_AWARE.includes(p34.read)
       );
       if (!usesAware) {
         warnings.push(
@@ -2503,10 +2534,10 @@ function formatSchemaLintFindings(findings) {
 import { createServer } from "net";
 var DEFAULT_PORT = 5173;
 function checkPortAvailable(port, host = "0.0.0.0") {
-  return new Promise((resolve19) => {
+  return new Promise((resolve18) => {
     const srv = createServer();
-    srv.once("error", () => resolve19(false));
-    srv.once("listening", () => srv.close(() => resolve19(true)));
+    srv.once("error", () => resolve18(false));
+    srv.once("listening", () => srv.close(() => resolve18(true)));
     srv.listen(port, host);
   });
 }
@@ -2532,6 +2563,9 @@ function noAppDirMessage(start, children) {
   }
   return lines.join("\n");
 }
+function devExitSucceeded(code, stopping) {
+  return stopping || code === null || code === 0;
+}
 var dev_default = defineDeepspaceCommand({
   meta: {
     name: "dev",
@@ -2631,7 +2665,7 @@ var dev_default = defineDeepspaceCommand({
         const refreshed = await refreshSecretsCache(DEPLOY_URL, token, appIdForSecrets, wranglerEnv);
         if (refreshed) {
           generatedSecretsCache = refreshed.rendered;
-          say(refreshed.summary);
+          if (refreshed.summary) say(refreshed.summary);
         }
       } catch (err) {
         throw new Refusal(
@@ -2668,7 +2702,9 @@ Free it with \`${killCmd}\`, or start on another port: \`deepspace dev start --p
       stdio: "inherit",
       env: wranglerViteEnv(process.env, wranglerConfig, { DEEPSPACE_PORT: String(port) })
     });
+    let stopping = false;
     const stop = () => {
+      stopping = true;
       wranglerConfig.cleanup();
       vite.kill();
     };
@@ -2680,7 +2716,9 @@ Free it with \`${killCmd}\`, or start on another port: \`deepspace dev start --p
         res(c);
       });
     });
-    if (code !== null && code !== 0) {
+    process.off("SIGINT", stop);
+    process.off("SIGTERM", stop);
+    if (!devExitSucceeded(code, stopping)) {
       throw new Refusal(`Dev server exited with code ${code}.`, "dev_server_failed", {
         extra: { port, appDir, exitCode: code }
       });
@@ -3000,6 +3038,169 @@ function ensurePlaywright(appDir) {
   }
 }
 
+// src/cli/lib/test-account-service.ts
+import { readFileSync as readFileSync14 } from "fs";
+
+// src/testing/accounts.ts
+import { existsSync as existsSync12, mkdirSync as mkdirSync5, readFileSync as readFileSync13, writeFileSync as writeFileSync7 } from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join13 } from "path";
+var TEST_ACCOUNTS_PATH = join13(homedir3(), ".deepspace", "test-accounts.json");
+var PRODUCTION_AUTH_ORIGIN = "https://auth.deep.space";
+var STAGING_AUTH_ORIGIN = "https://auth.deepspacesites.com";
+function currentTestAccountScope(env = process.env) {
+  const selected = env.DEEPSPACE_AUTH_URL ?? (env.DEEPSPACE_ENV === "staging" ? STAGING_AUTH_ORIGIN : PRODUCTION_AUTH_ORIGIN);
+  return normalizeTestAccountScope(selected);
+}
+function normalizeTestAccountScope(value) {
+  try {
+    return new URL(value).origin;
+  } catch {
+    return value;
+  }
+}
+function loadAllTestAccounts(scope = currentTestAccountScope()) {
+  const store = readTestAccountStore();
+  return mergeTestAccounts(store.scopes[scope] ?? [], store.unscoped);
+}
+function reconcileTestAccountStore(remote, scope = currentTestAccountScope()) {
+  const result = reconcileTestAccountScopes(readTestAccountStore(), remote, scope);
+  saveTestAccountStore(result.store);
+  return { accounts: result.accounts, removed: result.removed };
+}
+function reconcileTestAccountScopes(store, remote, scope) {
+  const scoped = store.scopes[scope] ?? [];
+  const current = reconcileTestAccounts(scoped, remote);
+  const migrated = reconcileTestAccounts(store.unscoped, remote);
+  const accounts = mergeTestAccounts(current, migrated);
+  return {
+    accounts,
+    removed: Math.max(0, scoped.length - current.length),
+    store: {
+      version: 2,
+      scopes: { ...store.scopes, [scope]: accounts },
+      unscoped: store.unscoped.filter((account) => !remote.some((item) => accountMatchesRemote(account, item)))
+    }
+  };
+}
+function reconcileTestAccounts(local, remote) {
+  const localById = new Map(local.filter((account) => account.id).map((account) => [account.id, account]));
+  const legacyByEmail = new Map(local.filter((account) => !account.id).map((account) => [account.email, account]));
+  return remote.flatMap((account) => {
+    const stored = localById.get(account.id) ?? legacyByEmail.get(account.email);
+    return stored ? [{ ...stored, ...account }] : [];
+  });
+}
+function upsertTestAccount(account, scope = currentTestAccountScope()) {
+  const store = readTestAccountStore();
+  const accounts = (store.scopes[scope] ?? []).filter(
+    (stored) => stored.id !== account.id && stored.email !== account.email
+  );
+  saveTestAccountStore({
+    version: 2,
+    scopes: { ...store.scopes, [scope]: [...accounts, account] },
+    unscoped: store.unscoped.filter(
+      (stored) => stored.id !== account.id && stored.email !== account.email
+    )
+  });
+}
+function removeTestAccounts(ids, emails = [], scope = currentTestAccountScope()) {
+  const idSet = new Set(ids);
+  const emailSet = new Set(emails);
+  const keep = (account) => !idSet.has(account.id ?? "") && !emailSet.has(account.email);
+  const store = readTestAccountStore();
+  saveTestAccountStore({
+    version: 2,
+    scopes: { ...store.scopes, [scope]: (store.scopes[scope] ?? []).filter(keep) },
+    unscoped: store.unscoped.filter(keep)
+  });
+}
+function readTestAccountStore() {
+  if (!existsSync12(TEST_ACCOUNTS_PATH)) return { version: 2, scopes: {}, unscoped: [] };
+  try {
+    const raw = JSON.parse(readFileSync13(TEST_ACCOUNTS_PATH, "utf-8"));
+    if (Array.isArray(raw)) return { version: 2, scopes: {}, unscoped: validTestAccounts(raw) };
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+      return { version: 2, scopes: {}, unscoped: [] };
+    }
+    const candidate = raw;
+    const scopes = candidate.scopes && typeof candidate.scopes === "object" && !Array.isArray(candidate.scopes) ? Object.fromEntries(Object.entries(candidate.scopes).map(([key, value]) => [key, validTestAccounts(value)])) : {};
+    return { version: 2, scopes, unscoped: validTestAccounts(candidate.unscoped) };
+  } catch {
+    return { version: 2, scopes: {}, unscoped: [] };
+  }
+}
+function validTestAccounts(value) {
+  if (!Array.isArray(value)) return [];
+  return value.filter((item) => Boolean(
+    item && typeof item === "object" && typeof item.email === "string" && typeof item.password === "string"
+  ));
+}
+function mergeTestAccounts(...groups) {
+  const accounts = /* @__PURE__ */ new Map();
+  for (const account of groups.flat()) {
+    const key = account.id ? `id:${account.id}` : `email:${account.email}`;
+    if (!accounts.has(key)) accounts.set(key, account);
+  }
+  return [...accounts.values()];
+}
+function accountMatchesRemote(local, remote) {
+  return local.id ? local.id === remote.id : local.email === remote.email;
+}
+function saveTestAccountStore(store) {
+  mkdirSync5(join13(homedir3(), ".deepspace"), { recursive: true });
+  writeFileSync7(TEST_ACCOUNTS_PATH, JSON.stringify(store, null, 2), { mode: 384 });
+}
+
+// src/cli/lib/test-account-service.ts
+var SESSION_COOKIE2 = "__Secure-better-auth.session_token";
+var AUTH_URL4 = process.env.DEEPSPACE_AUTH_URL ?? PLATFORM_URLS.auth;
+function sessionCookie() {
+  const token = readFileSync14(SESSION_PATH, "utf-8").trim();
+  return `${SESSION_COOKIE2}=${encodeURIComponent(token)}`;
+}
+async function fetchRemoteTestAccounts() {
+  const response = await fetch(`${AUTH_URL4}/api/auth/test-accounts`, {
+    headers: { Cookie: sessionCookie(), Origin: AUTH_URL4 }
+  });
+  const data = await response.json().catch(() => ({}));
+  if (!response.ok || !data.accounts) {
+    throw new Error(data.error ?? "Failed to list test accounts");
+  }
+  return data.accounts;
+}
+async function createRemoteTestAccount(input) {
+  const response = await fetch(`${AUTH_URL4}/api/auth/test-accounts`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Cookie: sessionCookie(),
+      Origin: AUTH_URL4
+    },
+    body: JSON.stringify(input)
+  });
+  const data = await response.json().catch(() => ({}));
+  if (!response.ok || typeof data.id !== "string" || typeof data.email !== "string" || typeof data.userId !== "string" || typeof data.createdAt !== "number") {
+    throw new Error(data.error ?? "Unknown error");
+  }
+  return { ...data, label: data.label ?? null };
+}
+async function deleteRemoteTestAccount(id) {
+  const response = await fetch(`${AUTH_URL4}/api/auth/test-accounts/${id}`, {
+    method: "DELETE",
+    headers: { Cookie: sessionCookie(), Origin: AUTH_URL4 }
+  });
+  if (!response.ok) {
+    const data = await response.json().catch(() => ({}));
+    throw new Error(data.error ?? `DELETE returned ${response.status}`);
+  }
+}
+async function syncTestAccountStore() {
+  const accounts = await fetchRemoteTestAccounts();
+  const { removed } = reconcileTestAccountStore(accounts, normalizeTestAccountScope(AUTH_URL4));
+  return { accounts, removed };
+}
+
 // src/cli/commands/test.ts
 var DEPLOY_URL2 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 var test_default = defineDeepspaceCommand({
@@ -3061,7 +3262,7 @@ var test_default = defineDeepspaceCommand({
         const refreshed = await refreshSecretsCache(DEPLOY_URL2, token, appIdForSecrets, wranglerEnv);
         if (refreshed) {
           generatedSecretsCache = refreshed.rendered;
-          say(refreshed.summary);
+          if (refreshed.summary) say(refreshed.summary);
         }
       } catch (err) {
         throw new Refusal(
@@ -3075,6 +3276,14 @@ var test_default = defineDeepspaceCommand({
       generatedSecretsCache,
       sharedDevVarsCache
     });
+    if (suite !== "unit") {
+      try {
+        const { removed } = await syncTestAccountStore();
+        if (removed > 0) say(`Removed ${removed} stale test account credential(s).`);
+      } catch (error) {
+        say(`Warning: could not reconcile test accounts: ${error instanceof Error ? error.message : String(error)}`);
+      }
+    }
     if (suite !== "unit") {
       preflightWindowsWorkerd(appDir);
       ensurePlaywright(appDir);
@@ -3226,49 +3435,6 @@ var screenshot_default = defineDeepspaceCommand({
 // src/cli/commands/test-accounts.ts
 import { defineCommand as defineCommand2 } from "citty";
 import * as p5 from "@clack/prompts";
-import { readFileSync as readFileSync13, writeFileSync as writeFileSync7, existsSync as existsSync12, mkdirSync as mkdirSync5 } from "fs";
-import { join as join13 } from "path";
-import { homedir as homedir3 } from "os";
-var SESSION_COOKIE2 = "__Secure-better-auth.session_token";
-var AUTH_URL4 = process.env.DEEPSPACE_AUTH_URL ?? PLATFORM_URLS.auth;
-var DIR2 = join13(homedir3(), ".deepspace");
-var ACCOUNTS_PATH = join13(DIR2, "test-accounts.json");
-function loadAccounts() {
-  if (!existsSync12(ACCOUNTS_PATH)) return [];
-  try {
-    return JSON.parse(readFileSync13(ACCOUNTS_PATH, "utf-8"));
-  } catch {
-    return [];
-  }
-}
-function saveAccounts(accounts) {
-  mkdirSync5(DIR2, { recursive: true });
-  writeFileSync7(ACCOUNTS_PATH, JSON.stringify(accounts, null, 2), { mode: 384 });
-}
-function sessionCookie() {
-  const token = readFileSync13(SESSION_PATH, "utf-8").trim();
-  return `${SESSION_COOKIE2}=${encodeURIComponent(token)}`;
-}
-async function fetchRemoteAccounts() {
-  const res = await fetch(`${AUTH_URL4}/api/auth/test-accounts`, {
-    headers: { Cookie: sessionCookie(), Origin: AUTH_URL4 }
-  });
-  const data = await res.json().catch(() => ({}));
-  if (!res.ok || !data.accounts) {
-    throw new Error(data.error ?? "Failed to list test accounts");
-  }
-  return data.accounts;
-}
-async function deleteRemote(id) {
-  const res = await fetch(`${AUTH_URL4}/api/auth/test-accounts/${id}`, {
-    method: "DELETE",
-    headers: { Cookie: sessionCookie(), Origin: AUTH_URL4 }
-  });
-  if (!res.ok) {
-    const data = await res.json().catch(() => ({}));
-    throw new Error(data.error ?? `DELETE returned ${res.status}`);
-  }
-}
 var create = defineDeepspaceCommand({
   meta: {
     name: "create",
@@ -3298,45 +3464,37 @@ var create = defineDeepspaceCommand({
   },
   async run({ args }) {
     await ensureToken();
-    const res = await fetch(`${AUTH_URL4}/api/auth/test-accounts`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        Cookie: sessionCookie(),
-        Origin: AUTH_URL4
-      },
-      body: JSON.stringify({
-        email: args.email,
-        password: args.password,
-        name: args.name,
-        label: args.label
-      })
-    });
-    const data = await res.json().catch(() => ({}));
-    if (!res.ok || !data.id) {
-      throw new Refusal(`Failed: ${data.error ?? "Unknown error"}`, "test_account_create_failed");
+    const email = args.email;
+    const password = args.password;
+    const name = args.name;
+    const label = args.label;
+    let account;
+    try {
+      account = await createRemoteTestAccount({ email, password, name, label });
+    } catch (error) {
+      throw new Refusal(
+        `Failed: ${error instanceof Error ? error.message : String(error)}`,
+        "test_account_create_failed"
+      );
     }
-    const account = data;
-    const accounts = loadAccounts();
-    accounts.push({
+    upsertTestAccount({
       id: account.id,
-      email: args.email,
-      password: args.password,
+      email,
+      password,
       userId: account.userId,
-      name: args.name,
+      name,
       label: account.label,
       createdAt: account.createdAt
     });
-    saveAccounts(accounts);
     if (!args.json) {
       console.log(`Created test account:`);
       console.log(`  ID:       ${account.id}`);
       console.log(`  Email:    ${account.email}`);
-      console.log(`  Password: ${args.password}`);
+      console.log(`  Password: ${password}`);
       console.log(`  UserID:   ${account.userId}`);
       if (account.label) console.log(`  Label:    ${account.label}`);
       console.log(`
-Saved to ${ACCOUNTS_PATH}`);
+Saved to ${TEST_ACCOUNTS_PATH}`);
     }
     return {
       data: {
@@ -3345,11 +3503,11 @@ Saved to ${ACCOUNTS_PATH}`);
         // The password is already echoed on the human path and stored 0600 in
         // ACCOUNTS_PATH — withholding it from --json would only force scripts
         // to parse the file themselves.
-        password: args.password,
+        password,
         userId: account.userId,
         label: account.label ?? null,
         createdAt: account.createdAt,
-        savedTo: ACCOUNTS_PATH
+        savedTo: TEST_ACCOUNTS_PATH
       }
     };
   }
@@ -3363,11 +3521,11 @@ var list = defineDeepspaceCommand({
     await ensureToken();
     let remote;
     try {
-      remote = await fetchRemoteAccounts();
+      remote = (await syncTestAccountStore()).accounts;
     } catch (err) {
       throw new Refusal(`Failed: ${err.message}`, "test_accounts_list_failed");
     }
-    const local = loadAccounts();
+    const local = loadAllTestAccounts();
     const localByEmail = new Map(local.map((a) => [a.email, a]));
     if (remote.length === 0) {
       if (!args.json) {
@@ -3438,7 +3596,7 @@ var del = defineDeepspaceCommand({
     if (targetEmail && !targetId) {
       let remote;
       try {
-        remote = await fetchRemoteAccounts();
+        remote = await fetchRemoteTestAccounts();
       } catch (err) {
         throw new Refusal(`Failed: ${err.message}`, "test_accounts_list_failed");
       }
@@ -3451,14 +3609,11 @@ var del = defineDeepspaceCommand({
       targetId = match.id;
     }
     try {
-      await deleteRemote(targetId);
+      await deleteRemoteTestAccount(targetId);
     } catch (err) {
       throw new Refusal(`Failed: ${err.message}`, "test_account_delete_failed");
     }
-    const accounts = loadAccounts().filter(
-      (a) => a.id !== targetId && (!targetEmail || a.email !== targetEmail)
-    );
-    saveAccounts(accounts);
+    removeTestAccounts([targetId], targetEmail ? [targetEmail] : []);
     if (!args.json) {
       console.log(`Test account deleted${targetEmail ? `: ${targetEmail}` : `: ${targetId}`}`);
     }
@@ -3487,7 +3642,7 @@ var clear = defineDeepspaceCommand({
     await ensureToken();
     let remote;
     try {
-      remote = await fetchRemoteAccounts();
+      remote = await fetchRemoteTestAccounts();
     } catch (err) {
       throw new Refusal(`Failed: ${err.message}`, "test_accounts_list_failed");
     }
@@ -3518,16 +3673,14 @@ var clear = defineDeepspaceCommand({
     const failures = [];
     for (const a of targets) {
       try {
-        await deleteRemote(a.id);
+        await deleteRemoteTestAccount(a.id);
         ok2++;
       } catch (err) {
         failures.push({ email: a.email, error: err.message });
       }
     }
-    const deletedIds = new Set(
-      targets.filter((t) => !failures.find((f) => f.email === t.email)).map((t) => t.id)
-    );
-    saveAccounts(loadAccounts().filter((a) => !deletedIds.has(a.id)));
+    const deleted = targets.filter((target) => !failures.some((failure) => failure.email === target.email));
+    removeTestAccounts(deleted.map((target) => target.id), deleted.map((target) => target.email));
     if (failures.length > 0) {
       throw new Refusal(
         `Deleted ${ok2}/${targets.length} test account(s).
@@ -3562,22 +3715,36 @@ import { resolve as resolve12 } from "path";
 // src/cli/commands/deploy/build.ts
 import * as p6 from "@clack/prompts";
 import { execSync as execSync2 } from "child_process";
-import { existsSync as existsSync14, readFileSync as readFileSync15, readdirSync as readdirSync4 } from "fs";
-import { dirname as dirname5, join as join15, resolve as resolve10 } from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync17, readdirSync as readdirSync4 } from "fs";
+import { dirname as dirname5, join as join16, resolve as resolve10 } from "path";
+
+// src/documentation/deploy.ts
+import { existsSync as existsSync13, readFileSync as readFileSync15 } from "fs";
+import { join as join14 } from "path";
+function readDocumentationDeployManifest(appDir, clientDir) {
+  if (!existsSync13(join14(appDir, "documentation.json"))) return void 0;
+  const manifestPath = join14(clientDir, "_documentation", "manifest.json");
+  if (!existsSync13(manifestPath)) {
+    throw new Error(
+      "documentation.json exists but the build produced no documentation manifest. Ensure vite.config.ts includes deepSpaceDocumentation() from deepspace/documentation."
+    );
+  }
+  return JSON.parse(readFileSync15(manifestPath, "utf8"));
+}
 
 // src/cli/commands/migrate/app-migrations.ts
 import {
   closeSync,
   constants,
-  existsSync as existsSync13,
+  existsSync as existsSync14,
   fstatSync,
   ftruncateSync,
   lstatSync,
   openSync,
-  readFileSync as readFileSync14,
+  readFileSync as readFileSync16,
   writeSync
 } from "fs";
-import { join as join14 } from "path";
+import { join as join15 } from "path";
 
 // src/shared/protocol/app-migrations.ts
 var APP_MIGRATION_ID_RE = /^[a-z0-9][a-z0-9._-]{0,127}$/;
@@ -3622,8 +3789,8 @@ var APP_MIGRATION_DEFINITIONS = SOURCE_MIGRATIONS.map(
   ({ id, description }) => ({ id, description })
 );
 function readAppliedAppMigrations(appDir) {
-  const path = join14(appDir, APP_MIGRATIONS_MANIFEST);
-  if (!existsSync13(path)) return [];
+  const path = join15(appDir, APP_MIGRATIONS_MANIFEST);
+  if (!existsSync14(path)) return [];
   const source = readRegularFile(path);
   let parsed;
   try {
@@ -3649,7 +3816,7 @@ function planAppMigrations(appDir) {
   const edits = [];
   for (const repoPath of tracked) {
     if (!isSourcePath(repoPath, appPrefix)) continue;
-    const absolutePath = join14(repo, repoPath);
+    const absolutePath = join15(repo, repoPath);
     let stat;
     try {
       stat = lstatSync(absolutePath);
@@ -3683,8 +3850,8 @@ function planAppMigrations(appDir) {
   });
   if (pending.length > 0 && blockers.length === 0) {
     const manifestPath = `${appPrefix}${APP_MIGRATIONS_MANIFEST}`;
-    const absoluteManifestPath = join14(repo, manifestPath);
-    const before = existsSync13(absoluteManifestPath) ? readRegularFile(absoluteManifestPath) : null;
+    const absoluteManifestPath = join15(repo, manifestPath);
+    const before = existsSync14(absoluteManifestPath) ? readRegularFile(absoluteManifestPath) : null;
     const after = `${JSON.stringify([...appliedIds, ...pending.map(({ id }) => id)], null, 2)}
 `;
     if (before !== after) edits.push({ path: manifestPath, before, after });
@@ -3702,13 +3869,13 @@ function applyAppMigrationPlan(appDir, plan) {
   }
   const repo = repoToplevel(appDir);
   for (const edit of plan.edits) {
-    const absolutePath = join14(repo, edit.path);
-    const current = existsSync13(absolutePath) ? readRegularFile(absolutePath) : null;
+    const absolutePath = join15(repo, edit.path);
+    const current = existsSync14(absolutePath) ? readRegularFile(absolutePath) : null;
     if (current !== edit.before) {
       throw new Error(`Migration input changed after planning: ${edit.path}`);
     }
   }
-  for (const edit of plan.edits) writeRegularFile(join14(repo, edit.path), edit.before, edit.after);
+  for (const edit of plan.edits) writeRegularFile(join15(repo, edit.path), edit.before, edit.after);
 }
 function readRegularFile(path) {
   const before = lstatSync(path);
@@ -3722,7 +3889,7 @@ function readRegularFile(path) {
     if (!opened.isFile() || opened.dev !== after.dev || opened.ino !== after.ino) {
       throw new Error(`Migration input changed while opening: ${path}`);
     }
-    return readFileSync14(fd, "utf-8");
+    return readFileSync16(fd, "utf-8");
   } finally {
     closeSync(fd);
   }
@@ -3748,7 +3915,7 @@ function writeRegularFile(path, before, after) {
     if (!opened.isFile() || opened.dev !== currentPath.dev || opened.ino !== currentPath.ino) {
       throw new Error(`Migration input changed while opening: ${path}`);
     }
-    if (readFileSync14(fd, "utf-8") !== before) {
+    if (readFileSync16(fd, "utf-8") !== before) {
       throw new Error(`Migration input changed after planning: ${path}`);
     }
     ftruncateSync(fd, 0);
@@ -3859,10 +4026,14 @@ var RESERVED_RUN_WORKER_FIRST = /* @__PURE__ */ new Set([
   "/ws/*",
   "/internal/*",
   "/v1/*",
-  "/_deepspace/*"
+  "/_deepspace/*",
+  "/_documentation",
+  "/_documentation/*",
+  "/_documentation-root",
+  "/_documentation-root/*"
 ]);
 async function buildDeployBundle(options) {
-  const { appDir, appName, envName, sharedDevVarsCache, wranglerConfig, output, spinner: spinner2 } = options;
+  const { appDir, appName, envName, sharedDevVarsCache, output, spinner: spinner2 } = options;
   const junk = removeMacosJunk(appDir);
   if (junk > 0) p6.log.info(`Removed ${junk} macOS metadata file(s) (._*, .DS_Store)`);
   const lintFindings = await lintProjectSchemas(appDir);
@@ -3875,10 +4046,15 @@ async function buildDeployBundle(options) {
     preparedWranglerConfig = prepareWranglerEnvConfig(appDir, envName, {
       sharedDevVarsCache
     });
+    const appDomain = DEEPSPACE_ENV === "staging" ? "spacestest.com" : "app.space";
     execSync2("npx vite build", {
       cwd: appDir,
       stdio: "pipe",
-      env: wranglerViteEnv(process.env, preparedWranglerConfig)
+      env: {
+        ...wranglerViteEnv(process.env, preparedWranglerConfig),
+        // The Vite plugin's one documentation compile stamps release URLs.
+        DEEPSPACE_DOCUMENTATION_BASE_URL: `https://${appName}.${appDomain}/docs`
+      }
     });
   } catch (error) {
     spinner2.stop("Build failed");
@@ -3889,19 +4065,19 @@ async function buildDeployBundle(options) {
     preparedWranglerConfig?.cleanup();
   }
   spinner2.stop("Built");
-  const deployConfigPath = join15(appDir, ".wrangler", "deploy", "config.json");
-  if (!existsSync14(deployConfigPath)) {
+  const deployConfigPath = join16(appDir, ".wrangler", "deploy", "config.json");
+  if (!existsSync15(deployConfigPath)) {
     output.die(
       "Build output config not found at .wrangler/deploy/config.json",
       "build_output_missing"
     );
   }
-  const deployConfig = JSON.parse(readFileSync15(deployConfigPath, "utf-8"));
+  const deployConfig = JSON.parse(readFileSync17(deployConfigPath, "utf-8"));
   const outputWranglerPath = resolve10(dirname5(deployConfigPath), deployConfig.configPath);
-  if (!existsSync14(outputWranglerPath)) {
+  if (!existsSync15(outputWranglerPath)) {
     output.die(`Output wrangler.json not found at ${outputWranglerPath}`, "build_output_missing");
   }
-  const outputConfig = JSON.parse(readFileSync15(outputWranglerPath, "utf-8"));
+  const outputConfig = JSON.parse(readFileSync17(outputWranglerPath, "utf-8"));
   if (outputConfig.name && outputConfig.name !== appName) {
     const envHint = envName ? ` (--env ${envName})` : "";
     output.die(
@@ -3910,18 +4086,25 @@ async function buildDeployBundle(options) {
     );
   }
   const workerDir = dirname5(outputWranglerPath);
-  const workerBundlePath = join15(workerDir, outputConfig.main);
+  const workerBundlePath = join16(workerDir, outputConfig.main);
   const clientDir = outputConfig.assets?.directory ? resolve10(workerDir, outputConfig.assets.directory) : null;
-  if (!existsSync14(workerBundlePath)) {
+  if (!existsSync15(workerBundlePath)) {
     output.die(`Worker bundle not found at ${workerBundlePath}`, "build_output_missing");
   }
-  if (!clientDir || !existsSync14(clientDir)) {
+  if (!clientDir || !existsSync15(clientDir)) {
     return output.die(`Client assets not found at ${clientDir}`, "build_output_missing");
   }
+  try {
+    const manifest = readDocumentationDeployManifest(appDir, clientDir);
+    if (manifest) p6.log.info(`Documentation: ${manifest.pageCount} page(s)`);
+  } catch (error) {
+    output.die(errorMessage(error), "documentation_build_failed");
+  }
   spinner2.start("Collecting assets...");
   const assets = collectAssets(clientDir);
+  const assetConfig = readDeployAssetConfig(clientDir);
   spinner2.stop(`Collected ${assets.length} assets`);
-  const workerJs = readFileSync15(workerBundlePath, "utf-8");
+  const workerJs = readFileSync17(workerBundlePath, "utf-8");
   const doBindings = outputConfig.durable_objects?.bindings;
   const sqliteClasses = new Set(
     outputConfig.migrations?.flatMap((migration) => migration.new_sqlite_classes ?? []) ?? []
@@ -3946,7 +4129,7 @@ async function buildDeployBundle(options) {
       `Custom bindings: ${customBindings.map((binding) => `${binding.name} (${binding.type})`).join(", ")}`
     );
   }
-  const extraRoutes = extractRunWorkerFirst(wranglerConfig);
+  const extraRoutes = resolveDeployRunWorkerFirst(outputConfig);
   let appMigrations = [];
   try {
     appMigrations = readAppliedAppMigrations(appDir);
@@ -3955,6 +4138,7 @@ async function buildDeployBundle(options) {
   }
   return {
     assets,
+    assetConfig,
     workerJs,
     appMigrations,
     doManifest,
@@ -3963,8 +4147,7 @@ async function buildDeployBundle(options) {
   };
 }
 function extractRunWorkerFirst(config) {
-  const raw = config.assets?.run_worker_first;
-  if (!Array.isArray(raw)) return [];
+  const raw = Array.isArray(config.assets?.run_worker_first) ? config.assets.run_worker_first : [];
   const routes = [];
   const seen = /* @__PURE__ */ new Set();
   for (const entry of raw) {
@@ -3976,19 +4159,24 @@ function extractRunWorkerFirst(config) {
   }
   return routes;
 }
+function resolveDeployRunWorkerFirst(config) {
+  if (config.assets?.run_worker_first === true) return true;
+  const routes = extractRunWorkerFirst(config);
+  return routes;
+}
 function collectAssets(dir) {
   const assets = [];
   const walk = (currentDir, prefix) => {
     for (const entry of readdirSync4(currentDir, { withFileTypes: true })) {
-      if (entry.name === ".assetsignore") continue;
-      const fullPath = join15(currentDir, entry.name);
+      if (isDeployAssetControlFile(entry.name)) continue;
+      const fullPath = join16(currentDir, entry.name);
       const relativePath = prefix ? `${prefix}/${entry.name}` : entry.name;
       if (entry.isDirectory()) {
         walk(fullPath, relativePath);
       } else {
         assets.push({
           path: `/${relativePath}`,
-          contentBase64: readFileSync15(fullPath).toString("base64")
+          contentBase64: readFileSync17(fullPath).toString("base64")
         });
       }
     }
@@ -3996,24 +4184,37 @@ function collectAssets(dir) {
   walk(dir, "");
   return assets;
 }
+function readDeployAssetConfig(clientDir) {
+  const config = {};
+  for (const [file, key] of [["_headers", "_headers"], ["_redirects", "_redirects"]]) {
+    const filePath = join16(clientDir, file);
+    if (!existsSync15(filePath)) continue;
+    const content = readFileSync17(filePath, "utf8");
+    if (content.trim()) config[key] = content;
+  }
+  return config;
+}
+function isDeployAssetControlFile(name) {
+  return name === ".assetsignore" || name === "_headers" || name === "_redirects";
+}
 function errorMessage(error) {
   return error instanceof Error ? error.message : String(error);
 }
 
 // src/cli/commands/deploy/commerce.ts
 import * as p7 from "@clack/prompts";
-import { existsSync as existsSync15 } from "fs";
-import { join as join16 } from "path";
+import { existsSync as existsSync16 } from "fs";
+import { join as join17 } from "path";
 import { pathToFileURL as pathToFileURL2 } from "url";
 var API_URL2 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
 function errorMessage2(error) {
   return error instanceof Error ? error.message : String(error);
 }
 async function loadDeclaration(appDir, sourceFile, outputFile, exportName) {
-  const sourcePath = join16(appDir, "src", sourceFile);
-  if (!existsSync15(sourcePath)) return void 0;
+  const sourcePath = join17(appDir, "src", sourceFile);
+  if (!existsSync16(sourcePath)) return void 0;
   const esbuild = await import("esbuild");
-  const outputPath = join16(appDir, ".wrangler", "deploy", outputFile);
+  const outputPath = join17(appDir, ".wrangler", "deploy", outputFile);
   await esbuild.build({
     entryPoints: [sourcePath],
     bundle: true,
@@ -4106,7 +4307,7 @@ Stripe will keep charging them until you cancel. Cancel at the end of their curr
   }
 }
 async function syncSubscriptionPlans(appDir, appName, token, nonInteractive) {
-  if (!existsSync15(join16(appDir, "src", "subscriptions.ts"))) return;
+  if (!existsSync16(join17(appDir, "src", "subscriptions.ts"))) return;
   let plans;
   try {
     plans = await loadDeclaration(
@@ -4161,7 +4362,7 @@ async function syncSubscriptionPlans(appDir, appName, token, nonInteractive) {
   }
 }
 async function syncOneTimeProducts(appDir, appName, token) {
-  if (!existsSync15(join16(appDir, "src", "products.ts"))) return;
+  if (!existsSync16(join17(appDir, "src", "products.ts"))) return;
   let products;
   try {
     products = await loadDeclaration(
@@ -4453,10 +4654,22 @@ function repoApi(deployUrl, token, appId) {
 }
 
 // src/cli/lib/vc-remote.ts
-import { existsSync as existsSync16 } from "fs";
+import { existsSync as existsSync17 } from "fs";
 import { tmpdir } from "os";
 import { isAbsolute as isAbsolute3, relative, resolve as resolve11 } from "path";
-var SPACE_REMOTE = "space";
+function spaceRemoteName(environment = DEEPSPACE_ENV) {
+  if (environment === "staging") return "space-staging";
+  if (environment === "production") return "space";
+  return "space-invalid";
+}
+var SPACE_REMOTE = spaceRemoteName();
+function spaceTrackingRef(branch, remote = SPACE_REMOTE) {
+  return `refs/remotes/${remote}/${branch}`;
+}
+function spacePrivateRef(path, environment = DEEPSPACE_ENV) {
+  const root = environment === "production" ? "refs/deepspace" : `refs/deepspace/${environment}`;
+  return `${root}/${path}`;
+}
 function deployBaseUrl() {
   return process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 }
@@ -4493,13 +4706,16 @@ function entryIsTransient(cwd) {
   return rel === "" || !rel.startsWith("..") && !isAbsolute3(rel);
 }
 function helperEntryUsable(command) {
-  const match = /^!'([^']*)' '([^']*)' git-credential$/.exec(command);
-  return match !== null && existsSync16(match[1]) && existsSync16(match[2]);
+  const match = /^!(?:DEEPSPACE_ENV=(production|staging) )?'([^']*)' '([^']*)' git-credential$/.exec(command);
+  const expectedEnvironment = DEEPSPACE_ENV === "production" ? void 0 : DEEPSPACE_ENV;
+  if (!match || match[1] !== expectedEnvironment) return false;
+  return existsSync17(match[2]) && existsSync17(match[3]);
 }
-function credentialHelperCommand() {
+function credentialHelperCommand(environment = DEEPSPACE_ENV) {
   const entry = process.argv[1];
   if (!entry) throw new Error("CLI entry path is unavailable");
-  return `!${shQuote(process.execPath)} ${shQuote(entry)} git-credential`;
+  const environmentPrefix = environment === "staging" ? "DEEPSPACE_ENV=staging " : "";
+  return `!${environmentPrefix}${shQuote(process.execPath)} ${shQuote(entry)} git-credential`;
 }
 function installCredentialHelper(cwd, url) {
   try {
@@ -4538,22 +4754,22 @@ function installCredentialHelper(cwd, url) {
   } catch {
   }
 }
-function ensureSpaceRemote(cwd, appId) {
+function ensureSpaceRemote(cwd, appId, remote = SPACE_REMOTE) {
   const url = repoUrl(appId);
-  const current = runGit(cwd, ["remote", "get-url", SPACE_REMOTE], { allowFail: true });
+  const current = runGit(cwd, ["remote", "get-url", remote], { allowFail: true });
   if (current.status !== 0) {
-    runGit(cwd, ["remote", "add", SPACE_REMOTE, url]);
+    runGit(cwd, ["remote", "add", remote, url]);
   } else {
     const existing = current.stdout.toString("utf-8").trim();
     if (existing !== url) {
       const priorApp = appIdFromRepoUrl(existing);
       if (priorApp && priorApp !== appId && !process.argv.includes("--json")) {
         process.stderr.write(
-          `warning: remote '${SPACE_REMOTE}' was pointed at app ${priorApp}; re-aiming it at ${appId}.
+          `warning: remote '${remote}' was pointed at app ${priorApp}; re-aiming it at ${appId}.
 `
         );
       }
-      runGit(cwd, ["remote", "set-url", SPACE_REMOTE, url]);
+      runGit(cwd, ["remote", "set-url", remote, url]);
     }
   }
   installCredentialHelper(cwd, url);
@@ -4628,7 +4844,7 @@ function pushToSpace(cwd, token, refspec, opts = {}) {
     const result = runGitRemote(
       cwd,
       token,
-      ["push", "--porcelain", ...opts.force ? ["--force"] : [], ...extra, SPACE_REMOTE, refspec],
+      ["push", "--porcelain", ...opts.force ? ["--force"] : [], ...extra, opts.remote ?? SPACE_REMOTE, refspec],
       { allowFail: true }
     );
     const parsed = parsePushPorcelain(result.stdout.toString("utf-8"));
@@ -4811,7 +5027,8 @@ async function syncDeployRepository(options) {
         "source_unclaimed"
       );
     }
-    ensureSpaceRemote(appDir, appId);
+    const sourceRemote = spaceRemoteName();
+    ensureSpaceRemote(appDir, appId, sourceRemote);
     const branch = currentBranch(appDir);
     const workspaceBranchId = workspaceIdFromBranch(branch);
     if (!isWorkTreeClean(appDir)) {
@@ -4855,7 +5072,9 @@ async function syncDeployRepository(options) {
       );
     } else {
       const pushResult = await pushWithTransientRetry(
-        () => pushToSpace(appDir, token, `refs/heads/${branch}:refs/heads/${branch}`)
+        () => pushToSpace(appDir, token, `refs/heads/${branch}:refs/heads/${branch}`, {
+          remote: sourceRemote
+        })
       );
       if (pushResult.status === "committed" || pushResult.status === "up_to_date") {
         recoverable = true;
@@ -4868,7 +5087,7 @@ async function syncDeployRepository(options) {
           "vc_push_rejected"
         );
       } else {
-        const remoteState = classifyRemoteState(appDir, token, branch, tip);
+        const remoteState = classifyRemoteState(appDir, token, branch, tip, sourceRemote);
         if (remoteState.strictlyBehind && !ignoreStale) {
           let behind = "several";
           try {
@@ -4913,16 +5132,17 @@ async function syncDeployRepository(options) {
   }
   return { commitOid, recoverable, deployKey, source, sourceRevision, baseReleaseId };
 }
-function classifyRemoteState(appDir, token, branch, localTip) {
+function classifyRemoteState(appDir, token, branch, localTip, remote) {
   let remoteTip = null;
+  const remoteRef = `refs/remotes/${remote}/${branch}`;
   try {
     runGitRemote(appDir, token, [
       "fetch",
       "--quiet",
-      SPACE_REMOTE,
-      `+refs/heads/${branch}:refs/remotes/space/${branch}`
+      remote,
+      `+refs/heads/${branch}:${remoteRef}`
     ]);
-    remoteTip = resolveCommit(appDir, `refs/remotes/space/${branch}`);
+    remoteTip = resolveCommit(appDir, remoteRef);
     return {
       remoteTip,
       strictlyBehind: remoteTip !== null && remoteTip !== localTip && isAncestor(appDir, localTip, remoteTip)
@@ -4953,7 +5173,7 @@ async function pushWithTransientRetry(push) {
     } catch (error) {
       const message = errorMessage3(error);
       if (/(?:HTTP |error: )(?:429|503)\b/i.test(message) && attempt < backoffMs.length) {
-        await new Promise((resolve19) => setTimeout(resolve19, backoffMs[attempt]));
+        await new Promise((resolve18) => setTimeout(resolve18, backoffMs[attempt]));
         continue;
       }
       throw error;
@@ -5004,7 +5224,9 @@ async function deployBuiltBundle(options) {
     spinner: spinner2
   } = options;
   spinner2.start(`Deploying ${appName}...`);
-  if (bundle.extraRoutes.length) {
+  if (bundle.extraRoutes === true) {
+    p10.log.info("Worker-first routing: all requests");
+  } else if (bundle.extraRoutes.length) {
     p10.log.info(`Custom worker-first routes: ${bundle.extraRoutes.join(", ")}`);
   }
   const assetGroups = packAssetGroups(bundle.assets, GROUP_BYTES);
@@ -5074,9 +5296,12 @@ async function deployBuiltBundle(options) {
       form.append("bindingManifest", JSON.stringify(bundle.customBindings));
     }
     if (secrets.names.length) form.append("userSecrets", JSON.stringify(secrets.values));
-    if (bundle.extraRoutes.length) {
+    if (bundle.extraRoutes === true || bundle.extraRoutes.length) {
       form.append("extraRunWorkerFirst", JSON.stringify(bundle.extraRoutes));
     }
+    if (Object.keys(bundle.assetConfig).length) {
+      form.append("assetConfig", JSON.stringify(bundle.assetConfig));
+    }
     form.append("name", appName);
     if (confirmRename) form.append("confirmRename", "true");
     if (shouldSendLineage(repository.commitOid, repository.recoverable)) {
@@ -5115,11 +5340,6 @@ async function deployBuiltBundle(options) {
     throw error;
   }
   let body = await response.json().catch(() => ({}));
-  for (let attempt = 0; response.status === 503 && body.code === "release_finalization_pending" && attempt < 3; attempt++) {
-    await new Promise((resolve19) => setTimeout(resolve19, 250 * 2 ** attempt));
-    response = await postCommit();
-    body = await response.json().catch(() => ({}));
-  }
   if (response.status === 409 && body.code === "rename_required" && !confirmRename) {
     spinner2.stop("Rename confirmation needed");
     if (output.nonInteractive) {
@@ -5225,7 +5445,7 @@ async function postWithRetry(url, makeInit, {
       lastError = error;
     }
     if (attempt < attempts) {
-      await new Promise((resolve19) => setTimeout(resolve19, Math.min(8e3, 500 * 2 ** (attempt - 1))));
+      await new Promise((resolve18) => setTimeout(resolve18, Math.min(8e3, 500 * 2 ** (attempt - 1))));
     }
   }
   if (lastResponse) return lastResponse;
@@ -5234,7 +5454,7 @@ async function postWithRetry(url, makeInit, {
 
 // src/cli/commands/deploy/secrets.ts
 import * as p11 from "@clack/prompts";
-import { existsSync as existsSync17, readFileSync as readFileSync16 } from "fs";
+import { existsSync as existsSync18, readFileSync as readFileSync18 } from "fs";
 function classifyDevVarsSecrets(options) {
   const store = new Set(options.storeSecretNames);
   const strayKeys = options.handEditedDevVarKeys.filter((key) => !store.has(key));
@@ -5261,7 +5481,7 @@ async function loadDeploySecrets(options) {
         generatedSecretsCache: refreshed.rendered,
         sharedDevVarsCache: true
       });
-      p11.log.info(refreshed.summary);
+      if (refreshed.summary) p11.log.info(refreshed.summary);
     }
   } catch (error) {
     if (error?.status === 403) {
@@ -5332,8 +5552,8 @@ function prepareDeploySecrets(options) {
   return { values, names };
 }
 function readCustomDevVars(path, output) {
-  if (!existsSync17(path)) return {};
-  const section = extractCustomDevVars(stripGeneratedSecretsCache(readFileSync16(path, "utf-8")));
+  if (!existsSync18(path)) return {};
+  const section = extractCustomDevVars(stripGeneratedSecretsCache(readFileSync18(path, "utf-8")));
   if (!section) return {};
   try {
     return parseDevVars(section);
@@ -5502,7 +5722,6 @@ var deploy_default = defineCommand3({
       appName,
       envName,
       sharedDevVarsCache: secretsCache.linked !== null,
-      wranglerConfig,
       output,
       spinner: spinner2
     });
@@ -5608,7 +5827,7 @@ async function waitForAssetsReady(url, timeoutMs) {
       if (!body.includes("Assets have not yet deployed") && !body.includes("No app configured")) {
         streak++;
         if (streak >= 3) return true;
-        await new Promise((resolve19) => setTimeout(resolve19, 1500));
+        await new Promise((resolve18) => setTimeout(resolve18, 1500));
         continue;
       }
       streak = 0;
@@ -5616,7 +5835,7 @@ async function waitForAssetsReady(url, timeoutMs) {
       streak = 0;
     }
     const waitMs = Math.min(8e3, 1e3 * 2 ** (attempt - 1));
-    await new Promise((resolve19) => setTimeout(resolve19, waitMs));
+    await new Promise((resolve18) => setTimeout(resolve18, waitMs));
   }
   return false;
 }
@@ -5684,18 +5903,15 @@ async function resolveAppSelector(deployUrl, token, selector) {
     "app_not_found"
   );
 }
-async function resolveAppTarget(deployUrl, token, explicit) {
+async function resolveAppTarget(deployUrl, token, explicit, options = {}) {
+  assertAppTargetResolvable(explicit, options);
   const { app: app2, error } = parseAppArg(explicit);
   if (error) throw new InputError(error, "invalid_app");
   if (app2 !== void 0) return resolveAppSelector(deployUrl, token, app2);
+  const { wranglerEnv } = parseWranglerEnvArg(options.wranglerEnv);
   const appDir = findAppDir();
-  const id = appDir ? readAppId(appDir) : null;
-  if (!id) {
-    throw new InputError(
-      "No app id. Run from an app directory whose wrangler.toml carries DEEPSPACE_APP_ID, or pass --app <id or name>.",
-      "not_in_app_repo"
-    );
-  }
+  const id = appDir ? readAppId(appDir, wranglerEnv) : null;
+  if (!id) throw appTargetMissingError(wranglerEnv);
   return id;
 }
 function parseAppArg(raw) {
@@ -5721,17 +5937,42 @@ function parseAppArg(raw) {
   }
   return { app: selector };
 }
-function assertAppTargetResolvable(appArg) {
+function parseWranglerEnvArg(raw) {
+  if (raw === void 0) return {};
+  const wranglerEnv = raw.trim();
+  if (!wranglerEnv) {
+    return {
+      error: "--env was given an empty environment name \u2014 pass a wrangler.toml environment name, or omit --env to use the top-level app."
+    };
+  }
+  return { wranglerEnv };
+}
+function appTargetMissingError(wranglerEnv) {
+  if (wranglerEnv) {
+    return new InputError(
+      `No app id for env "${wranglerEnv}" \u2014 wrangler.toml has no [env.${wranglerEnv}] block with its own DEEPSPACE_APP_ID.`,
+      "no_app_id_for_env"
+    );
+  }
+  return new InputError(
+    "No app id. Run from an app directory whose wrangler.toml carries DEEPSPACE_APP_ID, or pass --app <id or name>.",
+    "not_in_app_repo"
+  );
+}
+function assertAppTargetResolvable(appArg, options = {}) {
   const { app: app2, error } = parseAppArg(appArg);
   if (error) throw new InputError(error, "invalid_app");
-  if (app2 !== void 0) return;
-  const appDir = findAppDir();
-  if (!appDir || !readAppId(appDir)) {
+  const { wranglerEnv, error: envError } = parseWranglerEnvArg(options.wranglerEnv);
+  if (envError) throw new InputError(envError, "invalid_env");
+  if (app2 !== void 0 && wranglerEnv) {
     throw new InputError(
-      "No app id. Run from an app directory whose wrangler.toml carries DEEPSPACE_APP_ID, or pass --app <id or name>.",
-      "not_in_app_repo"
+      "Pass either --app or --env, not both \u2014 --env reads the [env.<name>] block's own app id, while --app names an app directly.",
+      "ambiguous_target"
     );
   }
+  if (app2 !== void 0) return;
+  const appDir = findAppDir();
+  if (!appDir || !readAppId(appDir, wranglerEnv)) throw appTargetMissingError(wranglerEnv);
 }
 async function warnIfPhantomApp(deployUrl, token, appId, explicit) {
   if (!explicit || !STRICT_APP_ID_RE.test(explicit.trim())) return;
@@ -5887,12 +6128,20 @@ var apps_default = defineDeepspaceCommand({
       if (!apps.length) {
         console.log("No apps yet. Create one with `npx create-deepspace <name>` and `deepspace deploy`.");
       } else {
-        const nameWidth = Math.max(4, ...apps.map((a) => (a.name ?? "\u2014").length));
-        const idWidth = Math.max(6, ...apps.map((a) => a.appId.length));
-        console.log(`${"NAME".padEnd(nameWidth)}  ${"APP ID".padEnd(idWidth)}  URL`);
-        for (const a of apps) {
+        const rows = [...apps].sort(
+          (left, right) => Number(right.status !== "undeployed") - Number(left.status !== "undeployed")
+        );
+        const nameWidth = Math.max(4, ...rows.map((a) => (a.name ?? "\u2014").length));
+        const statusWidth = Math.max(6, ...rows.map((a) => a.status.length));
+        const idWidth = Math.max(6, ...rows.map((a) => a.appId.length));
+        console.log(
+          `${"NAME".padEnd(nameWidth)}  ${"STATUS".padEnd(statusWidth)}  ${"APP ID".padEnd(idWidth)}  URL`
+        );
+        for (const a of rows) {
           const url = a.url ?? "(not deployed)";
-          console.log(`${(a.name ?? "\u2014").padEnd(nameWidth)}  ${a.appId.padEnd(idWidth)}  ${url}`);
+          console.log(
+            `${(a.name ?? "\u2014").padEnd(nameWidth)}  ${a.status.padEnd(statusWidth)}  ${a.appId.padEnd(idWidth)}  ${url}`
+          );
         }
       }
     }
@@ -6058,28 +6307,10 @@ var logs_default = defineCommand4({
     }
   },
   async run({ args }) {
+    const envArg = args.env;
+    assertAppTargetResolvable(args.app, { wranglerEnv: envArg });
     const token = await ensureToken();
-    const wranglerEnv = args.env?.trim() || void 0;
-    if (args.app && wranglerEnv) {
-      throw new InputError(
-        "Pass either --app or --env, not both \u2014 --env reads the [env.<name>] block\u2019s own app id, --app names an app directly.",
-        "ambiguous_target"
-      );
-    }
-    let appId;
-    if (!args.app && wranglerEnv) {
-      const appDir = findAppDir();
-      const id = appDir ? readAppId(appDir, wranglerEnv) : null;
-      if (!id) {
-        throw new InputError(
-          `No app id for env "${wranglerEnv}" \u2014 wrangler.toml has no [env.${wranglerEnv}] block with its own DEEPSPACE_APP_ID.`,
-          "no_app_id_for_env"
-        );
-      }
-      appId = id;
-    } else {
-      appId = await resolveAppTarget(DEPLOY_URL6, token, args.app);
-    }
+    const appId = await resolveAppTarget(DEPLOY_URL6, token, args.app, { wranglerEnv: envArg });
     if (args.level && !LOG_LEVELS.includes(args.level)) {
       throw new InputError(`Invalid --level "${args.level}". Use: ${LOG_LEVELS.join(", ")}`, "invalid_level");
     }
@@ -6248,20 +6479,20 @@ var usage_default = defineDeepspaceCommand({
 });
 
 // src/cli/commands/add.ts
-import { existsSync as existsSync19, readFileSync as readFileSync18, realpathSync as realpathSync3 } from "fs";
-import { dirname as dirname7, join as join18, resolve as resolve14 } from "path";
+import { existsSync as existsSync20, readFileSync as readFileSync20, realpathSync as realpathSync3 } from "fs";
+import { dirname as dirname7, join as join19, resolve as resolve14 } from "path";
 import { pathToFileURL as pathToFileURL3 } from "url";
 
 // src/cli/commands/feature-installer.ts
 import {
   closeSync as closeSync2,
   copyFileSync,
-  existsSync as existsSync18,
+  existsSync as existsSync19,
   fstatSync as fstatSync2,
   mkdirSync as mkdirSync6,
   mkdtempSync,
   openSync as openSync2,
-  readFileSync as readFileSync17,
+  readFileSync as readFileSync19,
   readSync,
   readdirSync as readdirSync5,
   rmSync as rmSync4,
@@ -6269,16 +6500,16 @@ import {
 } from "fs";
 import { spawnSync as spawnSync6 } from "child_process";
 import { tmpdir as tmpdir2 } from "os";
-import { dirname as dirname6, isAbsolute as isAbsolute4, join as join17, resolve as resolve13 } from "path";
+import { dirname as dirname6, isAbsolute as isAbsolute4, join as join18, resolve as resolve13 } from "path";
 import { fileURLToPath } from "url";
 var NAV_MARKER = "// \u2500\u2500 Features add nav items below this line \u2500\u2500";
 function featurePackageRoot(moduleUrl = import.meta.url) {
   let dir = dirname6(fileURLToPath(moduleUrl));
   for (; ; ) {
-    const packagePath = join17(dir, "package.json");
-    if (existsSync18(packagePath)) {
+    const packagePath = join18(dir, "package.json");
+    if (existsSync19(packagePath)) {
       try {
-        const pkg2 = JSON.parse(readFileSync17(packagePath, "utf-8"));
+        const pkg2 = JSON.parse(readFileSync19(packagePath, "utf-8"));
         if (pkg2.name === "deepspace") return dir;
       } catch {
       }
@@ -6289,13 +6520,13 @@ function featurePackageRoot(moduleUrl = import.meta.url) {
   }
 }
 function hasFeatureCatalog(packageRoot = featurePackageRoot()) {
-  return existsSync18(join17(packageRoot, "features"));
+  return existsSync19(join18(packageRoot, "features"));
 }
 function readFeatureConfig(id, packageRoot = featurePackageRoot()) {
-  const configPath = join17(packageRoot, "features", id, "feature.json");
-  if (!existsSync18(configPath)) return null;
+  const configPath = join18(packageRoot, "features", id, "feature.json");
+  if (!existsSync19(configPath)) return null;
   try {
-    const config = JSON.parse(readFileSync17(configPath, "utf-8"));
+    const config = JSON.parse(readFileSync19(configPath, "utf-8"));
     if (typeof config.id !== "string" || typeof config.name !== "string" || !Array.isArray(config.files)) {
       return null;
     }
@@ -6305,8 +6536,8 @@ function readFeatureConfig(id, packageRoot = featurePackageRoot()) {
   }
 }
 function listFeatureConfigs(packageRoot = featurePackageRoot()) {
-  const featuresDir = join17(packageRoot, "features");
-  if (!existsSync18(featuresDir)) return [];
+  const featuresDir = join18(packageRoot, "features");
+  if (!existsSync19(featuresDir)) return [];
   return readdirSync5(featuresDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => readFeatureConfig(entry.name, packageRoot)).filter((config) => config !== null && !config.internal).sort((a, b) => a.id.localeCompare(b.id));
 }
 function featureCatalog(packageRoot = featurePackageRoot()) {
@@ -6360,7 +6591,7 @@ function copyFile(src, dest) {
 function copyFileWithImportShift(src, dest, levels) {
   mkdirSync6(dirname6(dest), { recursive: true });
   const prefix = "../".repeat(levels);
-  const shifted = readFileSync17(src, "utf-8").replace(
+  const shifted = readFileSync19(src, "utf-8").replace(
     /(from\s+|import\s+|import\()(['"])(\.\.\/)/g,
     `$1$2${prefix}$3`
   );
@@ -6373,12 +6604,12 @@ function installFiles(packageRoot, config, targetDir, emit) {
   const preexisting = [];
   const missing = [];
   for (const file of config.files) {
-    const srcPath = join17(packageRoot, "features", config.id, file.src);
+    const srcPath = join18(packageRoot, "features", config.id, file.src);
     const resolvedDest = resolveFeatureDestPath(file.dest, config.route);
-    const destPath = join17(targetDir, resolvedDest);
-    const existed = existsSync18(destPath);
+    const destPath = join18(targetDir, resolvedDest);
+    const existed = existsSync19(destPath);
     if (existed) preexisting.push(resolvedDest);
-    if (!existsSync18(srcPath)) {
+    if (!existsSync19(srcPath)) {
       emit(`   Warning: source not found: ${file.src}`, "stderr");
       if (!existed) missing.push(resolvedDest);
       continue;
@@ -6415,11 +6646,11 @@ function unresolvedSchema(schema, reason, emit) {
 }
 function integrateSchema(config, targetDir, emit) {
   if (!config.schema) return [];
-  const schemasPath = join17(targetDir, "src", "schemas.ts");
-  if (!existsSync18(schemasPath)) {
+  const schemasPath = join18(targetDir, "src", "schemas.ts");
+  if (!existsSync19(schemasPath)) {
     return [unresolvedSchema(config.schema, "src/schemas.ts was not found.", emit)];
   }
-  let content = readFileSync17(schemasPath, "utf-8");
+  let content = readFileSync19(schemasPath, "utf-8");
   const { exportName, importPath, spreadOperator } = config.schema;
   const importPattern = new RegExp(`^import\\s+\\{[^}]*\\b${exportName}\\b`, "m");
   if (importPattern.test(content)) {
@@ -6472,11 +6703,11 @@ function unresolvedActions(actions, reason, emit) {
 }
 function integrateActions(config, targetDir, emit) {
   if (!config.actions?.length) return [];
-  const actionsPath = join17(targetDir, "src", "actions", "index.ts");
-  if (!existsSync18(actionsPath)) {
+  const actionsPath = join18(targetDir, "src", "actions", "index.ts");
+  if (!existsSync19(actionsPath)) {
     return [unresolvedActions(config.actions, "src/actions/index.ts was not found.", emit)];
   }
-  let content = readFileSync17(actionsPath, "utf-8");
+  let content = readFileSync19(actionsPath, "utf-8");
   const registryPattern = /export const actions:\s*Record<string,\s*ActionHandler(?:<[^>]*>)?>\s*=\s*\{/;
   if (!registryPattern.test(content)) {
     const reason = "src/actions/index.ts has an unexpected structure.";
@@ -6519,10 +6750,152 @@ ${registryEntry}`);
   if (integrated > 0) writeFileSync8(actionsPath, content);
   return unresolved;
 }
+function integrateCode(config, targetDir, emit) {
+  const unresolved = [];
+  for (const insertion of config.code ?? []) {
+    const targetPath = join18(targetDir, insertion.file);
+    if (!existsSync19(targetPath)) {
+      unresolved.push({
+        area: "code",
+        reason: `${insertion.file} was not found.`,
+        steps: [`Add ${insertion.insert.trim()} to ${insertion.file}.`]
+      });
+      continue;
+    }
+    const original = readFileSync19(targetPath, "utf-8");
+    if (original.includes(insertion.insert.trim())) {
+      emit(`   Integration already present: ${insertion.file}`);
+      continue;
+    }
+    const markerIndex = original.indexOf(insertion.marker);
+    if (markerIndex < 0) {
+      unresolved.push({
+        area: "code",
+        reason: `${insertion.file} does not contain the expected insertion point.`,
+        steps: [
+          ...insertion.import ? [`Add ${insertion.import} to ${insertion.file}.`] : [],
+          `Add ${insertion.insert.trim()} to ${insertion.file}.`
+        ]
+      });
+      continue;
+    }
+    let content = original;
+    if (insertion.import && !content.includes(insertion.import)) {
+      const importIndex = content.search(/^import\s/m);
+      content = `${content.slice(0, importIndex < 0 ? 0 : importIndex)}${insertion.import}
+${content.slice(importIndex < 0 ? 0 : importIndex)}`;
+    }
+    const currentMarkerIndex = content.indexOf(insertion.marker);
+    const insertAt = insertion.placement === "before" ? currentMarkerIndex : currentMarkerIndex + insertion.marker.length;
+    const prefix = insertion.placement === "before" ? "" : "\n";
+    const suffix = insertion.placement === "before" ? "\n" : "";
+    content = `${content.slice(0, insertAt)}${prefix}${insertion.insert}${suffix}${content.slice(insertAt)}`;
+    writeFileSync8(targetPath, content);
+    emit(`   Integrated: ${insertion.file}`);
+  }
+  return unresolved;
+}
+function integrateIgnore(config, targetDir) {
+  if (!config.ignore?.length) return;
+  const targetPath = join18(targetDir, ".gitignore");
+  const current = existsSync19(targetPath) ? readFileSync19(targetPath, "utf-8") : "";
+  const present = new Set(current.split(/\r?\n/).map((line) => line.trim()));
+  const missing = config.ignore.filter((pattern) => !present.has(pattern));
+  if (missing.length === 0) return;
+  const separator = current === "" || current.endsWith("\n") ? "" : "\n";
+  writeFileSync8(targetPath, `${current}${separator}${missing.join("\n")}
+`);
+}
+function integrateWrangler(config, targetDir, emit) {
+  const runWorkerFirst = config.wrangler?.runWorkerFirst === true;
+  const rateLimits = config.wrangler?.rateLimits ?? [];
+  if (!runWorkerFirst && rateLimits.length === 0) return [];
+  const targetPath = join18(targetDir, "wrangler.toml");
+  const steps = [
+    ...runWorkerFirst ? ["Set assets.run_worker_first = true in wrangler.toml."] : [],
+    ...rateLimits.map((binding) => `Add the ${binding.name} rate-limit binding to wrangler.toml.`)
+  ];
+  if (!existsSync19(targetPath)) {
+    return [{ area: "wrangler", reason: "wrangler.toml was not found.", steps }];
+  }
+  let source = readFileSync19(targetPath, "utf-8");
+  if (runWorkerFirst && !/^\[assets\]\s*$/m.test(source)) {
+    return [{ area: "wrangler", reason: "wrangler.toml has no [assets] section.", steps }];
+  }
+  let changed = false;
+  if (runWorkerFirst) {
+    const updated = setRunWorkerFirst(source);
+    changed ||= updated !== source;
+    source = updated;
+  }
+  const scopes = ["", ...wranglerEnvironmentNames(source)];
+  for (const scope of scopes) {
+    for (const binding of rateLimits) {
+      if (hasRateLimitBinding(source, scope, binding.name)) continue;
+      source = `${source.trimEnd()}
+
+${rateLimitBindingBlock(scope, binding)}
+`;
+      changed = true;
+    }
+  }
+  if (changed) {
+    writeFileSync8(targetPath, source);
+    emit("   Integrated: wrangler.toml");
+  } else emit("   Integration already present: wrangler.toml");
+  return [];
+}
+function setRunWorkerFirst(source) {
+  const headers = [...source.matchAll(/^\[(?:env\.[^\]]+\.)?assets\]\s*$/gm)];
+  for (const header of headers.reverse()) {
+    const start = header.index;
+    const bodyStart = start + header[0].length;
+    const nextHeader = source.slice(bodyStart).search(/^\[\[?[^\]]+\]\]?\s*$/m);
+    const end = nextHeader < 0 ? source.length : bodyStart + nextHeader;
+    const section = source.slice(start, end);
+    if (/^\s*run_worker_first\s*=\s*true(?:\s*#.*)?$/m.test(section)) continue;
+    const setting = /^(\s*)run_worker_first\s*=\s*(?:false|\[(?:[^\]"']|"(?:[^"\\]|\\[\s\S])*"|'[^']*')*\])(\s*(?:#.*)?)$/m;
+    const updated = setting.test(section) ? section.replace(setting, "$1run_worker_first = true$2") : section.replace(/^\[(?:env\.[^\]]+\.)?assets\]\s*$/m, "$&\nrun_worker_first = true");
+    source = source.slice(0, start) + updated + source.slice(end);
+  }
+  return source;
+}
+function wranglerEnvironmentNames(source) {
+  return [
+    ...new Set(
+      [...source.matchAll(/^\[\[?env\.([^.\]]+)(?:\.|\]\]?\s*$)/gm)].map((match) => match[1])
+    )
+  ];
+}
+function hasRateLimitBinding(source, scope, name) {
+  const header = scope ? `[[env.${scope}.ratelimits]]` : "[[ratelimits]]";
+  const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const namePattern = new RegExp(
+    `^\\s*name\\s*=\\s*(?:"${escaped}"|'${escaped}')\\s*(?:#.*)?$`,
+    "m"
+  );
+  let offset = 0;
+  while ((offset = source.indexOf(header, offset)) >= 0) {
+    const end = source.slice(offset + header.length).search(/^\[/m);
+    const blockEnd = end < 0 ? source.length : offset + header.length + end;
+    if (namePattern.test(source.slice(offset, blockEnd))) return true;
+    offset += header.length;
+  }
+  return false;
+}
+function rateLimitBindingBlock(scope, binding) {
+  const header = scope ? `[[env.${scope}.ratelimits]]` : "[[ratelimits]]";
+  return [
+    header,
+    `name = ${JSON.stringify(binding.name)}`,
+    `namespace_id = ${JSON.stringify(binding.namespaceId)}`,
+    `simple = { limit = ${binding.limit}, period = ${binding.period} }`
+  ].join("\n");
+}
 function integrateCss(packageRoot, config, targetDir, emit) {
   if (!config.css?.length) return [];
-  const stylesPath = join17(targetDir, "src", "styles.css");
-  if (!existsSync18(stylesPath)) {
+  const stylesPath = join18(targetDir, "src", "styles.css");
+  if (!existsSync19(stylesPath)) {
     emit("   Warning: Cannot integrate CSS \u2014 src/styles.css not found");
     return [
       {
@@ -6534,12 +6907,12 @@ function integrateCss(packageRoot, config, targetDir, emit) {
       }
     ];
   }
-  let styles = readFileSync17(stylesPath, "utf-8");
+  let styles = readFileSync19(stylesPath, "utf-8");
   let integrated = 0;
   const unresolved = [];
   for (const cssFile of config.css) {
-    const srcPath = join17(packageRoot, "features", config.id, cssFile);
-    if (!existsSync18(srcPath)) {
+    const srcPath = join18(packageRoot, "features", config.id, cssFile);
+    if (!existsSync19(srcPath)) {
       emit(`   Warning: CSS source not found: ${cssFile}`, "stderr");
       unresolved.push({
         area: "css",
@@ -6548,7 +6921,7 @@ function integrateCss(packageRoot, config, targetDir, emit) {
       });
       continue;
     }
-    const css = readFileSync17(srcPath, "utf-8");
+    const css = readFileSync19(srcPath, "utf-8");
     const fingerprint = css.match(/\.([\w-]+)\s*\{|@keyframes\s+([\w-]+)/);
     const marker = fingerprint?.[1] ?? fingerprint?.[2];
     if (marker && styles.includes(marker)) {
@@ -6575,11 +6948,11 @@ function unresolvedRoute(route, config, reason, emit) {
 }
 function integrateRoute(config, targetDir, emit) {
   if (!config.route) return [];
-  const navPath = join17(targetDir, "src", "nav.ts");
-  if (!existsSync18(navPath)) {
+  const navPath = join18(targetDir, "src", "nav.ts");
+  if (!existsSync19(navPath)) {
     return [unresolvedRoute(config.route, config, "src/nav.ts was not found.", emit)];
   }
-  let content = readFileSync17(navPath, "utf-8");
+  let content = readFileSync19(navPath, "utf-8");
   const routePath = config.route.path;
   if (content.includes(`'${routePath}'`)) {
     emit(`   Nav already present: ${routePath}`);
@@ -6626,10 +6999,10 @@ function runPackageInstall(packageManager, targetDir, outputVisible) {
     const child = spawnSync6(packageManager, ["install"], { ...options, stdio: "inherit" });
     return { error: child.error, status: child.status };
   }
-  const captureDir = mkdtempSync(join17(tmpdir2(), "deepspace-add-install-"));
+  const captureDir = mkdtempSync(join18(tmpdir2(), "deepspace-add-install-"));
   let outputFd;
   try {
-    outputFd = openSync2(join17(captureDir, "output.log"), "w+");
+    outputFd = openSync2(join18(captureDir, "output.log"), "w+");
     const child = spawnSync6(packageManager, ["install"], {
       ...options,
       stdio: ["ignore", outputFd, outputFd]
@@ -6653,14 +7026,14 @@ function integrateDependencies(config, targetDir, runInstall, outputVisible, emi
   if (declarations.every(({ values }) => !values || Object.keys(values).length === 0)) {
     return { added: [], installRan: false, packageManager };
   }
-  const packagePath = join17(targetDir, "package.json");
-  if (!existsSync18(packagePath)) {
+  const packagePath = join18(targetDir, "package.json");
+  if (!existsSync19(packagePath)) {
     emit("   Could not patch package.json (file not found)");
     return { added: [], installRan: false, packageManager };
   }
   let pkg2;
   try {
-    pkg2 = JSON.parse(readFileSync17(packagePath, "utf-8"));
+    pkg2 = JSON.parse(readFileSync19(packagePath, "utf-8"));
   } catch (error) {
     emit(
       `   Could not patch package.json (parse error: ${error instanceof Error ? error.message : String(error)})`
@@ -6720,7 +7093,7 @@ ${child.diagnosticTail}` : "";
 }
 function dependencySnapshot(targetDir) {
   try {
-    const pkg2 = JSON.parse(readFileSync17(join17(targetDir, "package.json"), "utf-8"));
+    const pkg2 = JSON.parse(readFileSync19(join18(targetDir, "package.json"), "utf-8"));
     return {
       dependencies: pkg2.dependencies ?? {},
       devDependencies: pkg2.devDependencies ?? {}
@@ -6732,7 +7105,7 @@ function dependencySnapshot(targetDir) {
 function installedNavFeatures(packageRoot, targetDir) {
   return listFeatureConfigs(packageRoot).filter((feature) => feature.category === "nav" && feature.files.length > 0).filter((feature) => {
     const signature = resolveFeatureDestPath(feature.files[0].dest, feature.route);
-    return existsSync18(join17(targetDir, signature));
+    return existsSync19(join18(targetDir, signature));
   }).map((feature) => feature.id);
 }
 function warnNavConflicts(packageRoot, config, targetDir, emit) {
@@ -6770,6 +7143,7 @@ function installFeature(options) {
   emit(`   ${config.description ?? ""}`);
   emit(`   Target: ${targetDir}`);
   const installedFiles = installFiles(packageRoot, config, targetDir, emit);
+  integrateIgnore(config, targetDir);
   emit("");
   emit(
     `Copied ${installedFiles.copied} file(s)${installedFiles.skipped > 0 ? `, skipped ${installedFiles.skipped} existing` : ""}`
@@ -6777,6 +7151,8 @@ function installFeature(options) {
   const unresolvedIntegrations = [
     ...integrateSchema(config, targetDir, emit),
     ...integrateActions(config, targetDir, emit),
+    ...integrateWrangler(config, targetDir, emit),
+    ...integrateCode(config, targetDir, emit),
     ...integrateCss(packageRoot, config, targetDir, emit),
     ...integrateRoute(config, targetDir, emit)
   ];
@@ -6869,9 +7245,10 @@ var CATEGORY_LABELS = {
   nav: "Navigation",
   layout: "Layouts",
   display: "Display",
-  landing: "Landing Page Sections"
+  landing: "Landing Page Sections",
+  publishing: "Publishing"
 };
-var CATEGORY_ORDER = ["assistant", "data", "nav", "layout", "display", "landing"];
+var CATEGORY_ORDER = ["assistant", "data", "publishing", "nav", "layout", "display", "landing"];
 function groupByCategory(features) {
   const groups = /* @__PURE__ */ new Map();
   for (const feature of features) {
@@ -6961,11 +7338,11 @@ function renderFeatureInfo(config) {
   return lines.join("\n");
 }
 function isDeepSpaceApp(dir) {
-  if (existsSync19(join18(dir, "wrangler.toml"))) return true;
-  const packagePath = join18(dir, "package.json");
-  if (!existsSync19(packagePath)) return false;
+  if (existsSync20(join19(dir, "wrangler.toml"))) return true;
+  const packagePath = join19(dir, "package.json");
+  if (!existsSync20(packagePath)) return false;
   try {
-    const pkg2 = JSON.parse(readFileSync18(packagePath, "utf-8"));
+    const pkg2 = JSON.parse(readFileSync20(packagePath, "utf-8"));
     return Boolean(pkg2.dependencies?.deepspace || pkg2.devDependencies?.deepspace);
   } catch {
     return false;
@@ -6974,8 +7351,8 @@ function isDeepSpaceApp(dir) {
 function installedPackageRoot(fromDir) {
   let dir = fromDir;
   for (; ; ) {
-    const candidate = join18(dir, "node_modules", "deepspace");
-    if (existsSync19(join18(candidate, "package.json"))) return candidate;
+    const candidate = join19(dir, "node_modules", "deepspace");
+    if (existsSync20(join19(candidate, "package.json"))) return candidate;
     const parent = dirname7(dir);
     if (parent === dir) return null;
     dir = parent;
@@ -6992,9 +7369,9 @@ async function targetInstaller(appDir) {
   if (realpathSync3(installedRoot) === realpathSync3(featurePackageRoot())) {
     return { installFeature };
   }
-  const entry = join18(installedRoot, "dist", "feature-installer.js");
-  const catalog = join18(installedRoot, "features");
-  if (!existsSync19(entry) || !existsSync19(catalog)) {
+  const entry = join19(installedRoot, "dist", "feature-installer.js");
+  const catalog = join19(installedRoot, "features");
+  if (!existsSync20(entry) || !existsSync20(catalog)) {
     throw new Refusal(
       `The app's installed deepspace package does not contain the typed feature installer.
 Expected: ${entry}
@@ -7087,7 +7464,7 @@ var add_default = defineDeepspaceCommand({
       return { data: { features: featureCatalog(root) } };
     }
     const appDir = resolve14(args.dir ?? ".");
-    if (!existsSync19(appDir)) {
+    if (!existsSync20(appDir)) {
       throw new Refusal(
         `Target directory not found: ${appDir}
 Create a new app first: deepspace app create <name>`,
@@ -7168,11 +7545,11 @@ function fmtDate(iso) {
 }
 async function confirm4(message) {
   process.stdout.write(`${message} [y/N] `);
-  return new Promise((resolve19) => {
+  return new Promise((resolve18) => {
     process.stdin.setEncoding("utf-8");
     process.stdin.once("data", (data) => {
       const answer = data.toString().trim().toLowerCase();
-      resolve19(answer === "y" || answer === "yes");
+      resolve18(answer === "y" || answer === "yes");
     });
   });
 }
@@ -7499,8 +7876,8 @@ var list3 = defineDeepspaceCommand({
       }
       if (pending.length) {
         console.log(`PENDING INVITES ON ${app2}`);
-        for (const p35 of pending) {
-          console.log(`  ${p35.email} (expires ${new Date(p35.expiresAt).toLocaleDateString()})`);
+        for (const p34 of pending) {
+          console.log(`  ${p34.email} (expires ${new Date(p34.expiresAt).toLocaleDateString()})`);
         }
       }
     }
@@ -7598,7 +7975,7 @@ var cancel3 = defineDeepspaceCommand({
       `/api/app-collaborators/${encodeURIComponent(app2)}`
     );
     const target = email.trim().toLowerCase();
-    const found = pending.find((p35) => p35.email.toLowerCase() === target);
+    const found = pending.find((p34) => p34.email.toLowerCase() === target);
     if (!found) {
       throw new Refusal(`${email} has no pending invite on ${app2}`, "no_pending_invite", {
         action: cliAction("deepspace", "app", "collaborators", "list", "--app", app2)
@@ -7748,7 +8125,7 @@ var transfer_default = defineCommand7({
 import { defineCommand as defineCommand8 } from "citty";
 
 // src/cli/commands/_invoke-impl.ts
-import { readFileSync as readFileSync19 } from "fs";
+import { readFileSync as readFileSync21 } from "fs";
 import * as p15 from "@clack/prompts";
 var API_URL7 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
 var DEFAULT_TIMEOUT_MS = 12e4;
@@ -7789,7 +8166,7 @@ function resolveBody(opts) {
   if (opts.body != null) {
     raw = opts.body;
   } else if (opts.bodyFile != null) {
-    raw = opts.bodyFile === "-" ? readFileSync19(0, "utf-8") : readFileSync19(opts.bodyFile, "utf-8");
+    raw = opts.bodyFile === "-" ? readFileSync21(0, "utf-8") : readFileSync21(opts.bodyFile, "utf-8");
   } else {
     return "{}";
   }
@@ -8066,226 +8443,9 @@ var integrations_default = defineCommand8({
   }
 });
 
-// src/cli/commands/library.ts
-import { defineCommand as defineCommand9 } from "citty";
-import { existsSync as existsSync20, readFileSync as readFileSync20 } from "fs";
-import { join as join19, resolve as resolve15 } from "path";
-import { parse as parseToml4 } from "smol-toml";
-import * as p16 from "@clack/prompts";
-var DEFAULT_LIBRARY_APP = "deepdotspace-site";
-var str = (v) => typeof v === "string" && v ? v : void 0;
-var publish = defineDeepspaceCommand({
-  meta: {
-    name: "publish",
-    description: "Publish the current app to the DeepSpace library"
-  },
-  args: {
-    dir: {
-      type: "string",
-      description: "App directory (default: current directory)",
-      required: false
-    },
-    app: {
-      type: "string",
-      description: "App name (default: read from wrangler.toml)",
-      required: false
-    },
-    name: {
-      type: "string",
-      description: "Display name (default: app name)",
-      required: false
-    },
-    description: {
-      type: "string",
-      description: "Short description",
-      required: false
-    },
-    category: {
-      type: "string",
-      description: "Category (e.g. Productivity, Finance, AI). Default: General",
-      required: false
-    },
-    tags: {
-      type: "string",
-      description: "Comma-separated tags",
-      required: false
-    },
-    visibility: {
-      type: "string",
-      description: "'public' (default), 'unlisted', or 'private'",
-      required: false
-    },
-    screenshot: {
-      type: "string",
-      description: "Override the auto-captured preview with a public PNG URL",
-      required: false
-    },
-    "library-app": {
-      type: "string",
-      description: `Target library app subdomain (default: ${DEFAULT_LIBRARY_APP})`,
-      required: false
-    }
-  },
-  async run({ args }) {
-    const json = args.json;
-    const intro6 = (s) => {
-      if (!json) p16.intro(s);
-    };
-    const info2 = (s) => {
-      if (!json) p16.log.info(s);
-    };
-    intro6("Publishing to the DeepSpace library");
-    const appErr = parseAppArg(str(args.app)).error;
-    if (appErr) throw new Refusal(appErr, "invalid_app");
-    let appName = str(args.app)?.trim();
-    if (!appName) {
-      const appDir = resolve15(str(args.dir) ?? ".");
-      const wranglerPath = join19(appDir, "wrangler.toml");
-      if (!existsSync20(wranglerPath)) {
-        throw new Refusal(
-          "No --app provided and no wrangler.toml found. Either pass --app <name> or run from your app's directory.",
-          "not_in_app_repo"
-        );
-      }
-      const cfg = parseToml4(readFileSync20(wranglerPath, "utf-8"));
-      const nameRes = resolveAppName(cfg.name);
-      if (!nameRes.ok) throw new Refusal(`wrangler.toml: ${nameRes.reason}`, "invalid_config");
-      appName = nameRes.name;
-    }
-    info2(`App: ${appName}`);
-    const visibility = str(args.visibility) ?? "public";
-    if (!["public", "private", "unlisted"].includes(visibility)) {
-      throw new Refusal("--visibility must be 'public', 'unlisted', or 'private'.", "invalid_visibility");
-    }
-    const tags = str(args.tags) ? String(args.tags).split(",").map((t) => t.trim()).filter(Boolean) : void 0;
-    const libraryApp = str(args["library-app"]) ?? DEFAULT_LIBRARY_APP;
-    const libraryHost = process.env.DEEPSPACE_LIBRARY_HOST ?? `https://${libraryApp}.app.space`;
-    let token;
-    try {
-      token = await ensureToken();
-    } catch (err) {
-      throw new Refusal(err instanceof Error ? err.message : String(err), "not_authenticated", {
-        action: cliAction("deepspace", "auth", "login")
-      });
-    }
-    const payload = {
-      appName,
-      ...args.name ? { name: args.name } : {},
-      ...args.description ? { description: args.description } : {},
-      ...args.category ? { category: args.category } : {},
-      ...tags ? { tags } : {},
-      visibility,
-      ...args.screenshot ? { screenshotUrl: args.screenshot } : {}
-    };
-    const url = `${libraryHost}/api/actions/library.publish`;
-    let res;
-    try {
-      res = await fetch(url, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          Authorization: `Bearer ${token}`
-        },
-        body: JSON.stringify(payload)
-      });
-    } catch (err) {
-      throw new Refusal(
-        `Network error reaching ${url}: ${err instanceof Error ? err.message : String(err)}`,
-        "network_error"
-      );
-    }
-    const body = await res.text();
-    let parsed;
-    try {
-      parsed = JSON.parse(body);
-    } catch {
-      throw new Refusal(`Server returned non-JSON (${res.status}): ${body.slice(0, 400)}`, "invalid_response");
-    }
-    if (!parsed.success) {
-      throw new Refusal(parsed.error ?? `Publish failed (HTTP ${res.status}).`, "publish_failed");
-    }
-    if (!json) {
-      p16.log.success(`Published ${appName} as ${parsed.data?.templateHandle} (v${parsed.data?.version})`);
-      if (parsed.data?.url) p16.log.message(parsed.data.url);
-      p16.outro("Done");
-    }
-    return {
-      data: {
-        appName,
-        templateHandle: parsed.data?.templateHandle ?? null,
-        url: parsed.data?.url ?? null,
-        version: parsed.data?.version ?? null,
-        visibility
-      }
-    };
-  }
-});
-var unpublish = defineDeepspaceCommand({
-  meta: {
-    name: "unpublish",
-    description: "Remove a library entry (owner or admin only)"
-  },
-  args: {
-    handle: {
-      type: "positional",
-      description: "templateHandle to remove (usually your app name)",
-      required: true
-    },
-    "library-app": {
-      type: "string",
-      description: `Target library app subdomain (default: ${DEFAULT_LIBRARY_APP})`,
-      required: false
-    }
-  },
-  async run({ args }) {
-    const json = args.json;
-    if (!json) p16.intro("Unpublishing library entry");
-    let token;
-    try {
-      token = await ensureToken();
-    } catch (err) {
-      throw new Refusal(err instanceof Error ? err.message : String(err), "not_authenticated", {
-        action: cliAction("deepspace", "auth", "login")
-      });
-    }
-    const libraryApp = str(args["library-app"]) ?? DEFAULT_LIBRARY_APP;
-    const libraryHost = process.env.DEEPSPACE_LIBRARY_HOST ?? `https://${libraryApp}.app.space`;
-    const res = await fetch(`${libraryHost}/api/actions/library.unpublish`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
-      body: JSON.stringify({ templateHandle: String(args.handle) })
-    });
-    const body = await res.text();
-    let parsed;
-    try {
-      parsed = JSON.parse(body);
-    } catch {
-      throw new Refusal(`Server returned non-JSON (${res.status}): ${body.slice(0, 400)}`, "invalid_response");
-    }
-    if (!parsed.success) {
-      throw new Refusal(parsed.error ?? `HTTP ${res.status}`, "unpublish_failed");
-    }
-    if (!json) {
-      p16.log.success(`Unpublished ${parsed.data?.templateHandle}`);
-      p16.outro("Done");
-    }
-    return { data: { templateHandle: parsed.data?.templateHandle ?? String(args.handle) } };
-  }
-});
-var library_default = defineCommand9({
-  meta: {
-    name: "library",
-    description: "Manage your DeepSpace library entries"
-  },
-  subCommands: {
-    publish,
-    unpublish
-  }
-});
-
 // src/cli/commands/feedback.ts
-import * as p17 from "@clack/prompts";
-import { existsSync as existsSync21, readFileSync as readFileSync21 } from "fs";
+import * as p16 from "@clack/prompts";
+import { existsSync as existsSync21, readFileSync as readFileSync22 } from "fs";
 import { dirname as dirname8, join as join20 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { release } from "os";
@@ -8314,7 +8474,7 @@ function readCliVersion() {
     ];
     for (const path of candidates) {
       if (!existsSync21(path)) continue;
-      const pkg2 = JSON.parse(readFileSync21(path, "utf-8"));
+      const pkg2 = JSON.parse(readFileSync22(path, "utf-8"));
       if (pkg2.name === "deepspace" && pkg2.version) return pkg2.version;
     }
   } catch {
@@ -8407,21 +8567,21 @@ var feedback_default = defineDeepspaceCommand({
       );
     }
     if (interactive && (!args.type || !title || !body)) {
-      p17.intro("DeepSpace Feedback");
+      p16.intro("DeepSpace Feedback");
       if (!args.type) {
-        const picked = await p17.select({
+        const picked = await p16.select({
           message: "What kind of feedback is this?",
           options: TYPES.map((t) => ({ value: t, label: TYPE_LABELS[t] })),
           initialValue: type
         });
-        if (p17.isCancel(picked)) {
-          p17.cancel("Cancelled.");
+        if (p16.isCancel(picked)) {
+          p16.cancel("Cancelled.");
           return { data: { submitted: false, cancelled: true } };
         }
         type = picked;
       }
       if (!title) {
-        const t = await p17.text({
+        const t = await p16.text({
           message: "Title",
           placeholder: "Short summary of the issue",
           validate: (v) => {
@@ -8431,14 +8591,14 @@ var feedback_default = defineDeepspaceCommand({
             return void 0;
           }
         });
-        if (p17.isCancel(t)) {
-          p17.cancel("Cancelled.");
+        if (p16.isCancel(t)) {
+          p16.cancel("Cancelled.");
           return { data: { submitted: false, cancelled: true } };
         }
         title = String(t);
       }
       if (!body) {
-        const m = await p17.text({
+        const m = await p16.text({
           message: "Details",
           placeholder: "What happened? Steps to reproduce, what you expected\u2026",
           validate: (v) => {
@@ -8448,8 +8608,8 @@ var feedback_default = defineDeepspaceCommand({
             return void 0;
           }
         });
-        if (p17.isCancel(m)) {
-          p17.cancel("Cancelled.");
+        if (p16.isCancel(m)) {
+          p16.cancel("Cancelled.");
           return { data: { submitted: false, cancelled: true } };
         }
         body = String(m);
@@ -8467,7 +8627,7 @@ var feedback_default = defineDeepspaceCommand({
       throw new Refusal(err.message, "invalid_input");
     }
     if (interactive && !args.yes) {
-      p17.note(
+      p16.note(
         `${TYPE_LABELS[payload.type]}
 ${payload.title}
 
@@ -8476,9 +8636,9 @@ ${payload.body}
 Context: deepspace ${payload.cliVersion} \xB7 ${payload.nodeVersion} \xB7 ${payload.platform}` + (payload.appName ? ` \xB7 app ${payload.appName}` : ""),
         "Review"
       );
-      const ok2 = await p17.confirm({ message: "Send this to the DeepSpace team?" });
-      if (p17.isCancel(ok2) || !ok2) {
-        p17.cancel("Not sent.");
+      const ok2 = await p16.confirm({ message: "Send this to the DeepSpace team?" });
+      if (p16.isCancel(ok2) || !ok2) {
+        p16.cancel("Not sent.");
         return { data: { submitted: false, cancelled: true } };
       }
     }
@@ -8498,7 +8658,7 @@ Context: deepspace ${payload.cliVersion} \xB7 ${payload.nodeVersion} \xB7 ${payl
     });
     if (!args.json) {
       if (interactive) {
-        p17.outro(`Thanks! Submitted as ${result.report.id}.`);
+        p16.outro(`Thanks! Submitted as ${result.report.id}.`);
       } else {
         console.log(`Submitted feedback ${result.report.id} (${result.report.type}).`);
       }
@@ -8509,8 +8669,8 @@ Context: deepspace ${payload.cliVersion} \xB7 ${payload.nodeVersion} \xB7 ${payl
 });
 
 // src/cli/commands/secrets.ts
-import { defineCommand as defineCommand10 } from "citty";
-import { readFileSync as readFileSync22 } from "fs";
+import { defineCommand as defineCommand9 } from "citty";
+import { readFileSync as readFileSync23 } from "fs";
 
 // src/cli/lib/citty-args.ts
 function dedupePositionals(bound, rest) {
@@ -8613,7 +8773,7 @@ function warnIfDebugRoutesEnabled(secrets) {
 }
 var APPLY_HINT = "Run `deepspace deploy` to apply \u2014 secrets take effect at deploy time.";
 var LOCAL_DEV_HINT = "Running `deepspace dev start`? Restart it to load the change locally.";
-var list5 = defineCommand10({
+var list5 = defineCommand9({
   meta: { name: "list", description: "List masked secrets in a config" },
   args: {
     ...COMMON_ARGS,
@@ -8643,7 +8803,7 @@ var list5 = defineCommand10({
     }
   }
 });
-var set = defineCommand10({
+var set = defineCommand9({
   meta: { name: "set", description: "Set secrets from KEY=value pairs" },
   args: {
     ...COMMON_ARGS,
@@ -8692,7 +8852,7 @@ var set = defineCommand10({
     }
   }
 });
-var get = defineCommand10({
+var get = defineCommand9({
   meta: { name: "get", description: "Get a secret; pass --plain to print the value" },
   args: {
     ...COMMON_ARGS,
@@ -8728,7 +8888,7 @@ var get = defineCommand10({
     }
   }
 });
-var del2 = defineCommand10({
+var del2 = defineCommand9({
   meta: { name: "delete", description: "Delete one or more secrets" },
   args: {
     ...COMMON_ARGS,
@@ -8762,7 +8922,7 @@ var del2 = defineCommand10({
     }
   }
 });
-var upload = defineCommand10({
+var upload = defineCommand9({
   meta: { name: "upload", description: "Upload secrets from a dotenv or JSON file" },
   args: {
     ...COMMON_ARGS,
@@ -8780,7 +8940,7 @@ var upload = defineCommand10({
   async run({ args }) {
     try {
       const t = await resolveTarget(args);
-      const content = args.file === "-" ? readFileSync22(0, "utf-8") : readFileSync22(args.file, "utf-8");
+      const content = args.file === "-" ? readFileSync23(0, "utf-8") : readFileSync23(args.file, "utf-8");
       const secrets = parseSecretsUpload(content);
       if (Object.keys(secrets).length === 0)
         fail(new InputError("No secrets found in the input.", "empty_input"));
@@ -8799,7 +8959,7 @@ var upload = defineCommand10({
     }
   }
 });
-var download = defineCommand10({
+var download = defineCommand9({
   meta: { name: "download", description: "Download a config\u2019s secrets (dotenv/json/shell)" },
   args: {
     ...COMMON_ARGS,
@@ -8828,7 +8988,7 @@ var download = defineCommand10({
     }
   }
 });
-var pull = defineCommand10({
+var pull = defineCommand9({
   meta: { name: "pull", description: "Refresh the .dev.vars cache from the app store" },
   args: { ...COMMON_ARGS },
   async run({ args }) {
@@ -8871,7 +9031,7 @@ var pull = defineCommand10({
     }
   }
 });
-var configsList = defineCommand10({
+var configsList = defineCommand9({
   meta: { name: "list", description: "List the app\u2019s configs" },
   args: { ...COMMON_ARGS },
   async run({ args }) {
@@ -8892,7 +9052,7 @@ var configsList = defineCommand10({
     }
   }
 });
-var configsCreate = defineCommand10({
+var configsCreate = defineCommand9({
   meta: { name: "create", description: "Create a config (optionally copying another)" },
   args: {
     ...COMMON_ARGS,
@@ -8932,7 +9092,7 @@ var configsCreate = defineCommand10({
     }
   }
 });
-var configsDelete = defineCommand10({
+var configsDelete = defineCommand9({
   meta: { name: "delete", description: "Delete a config and all of its secrets" },
   args: {
     ...COMMON_ARGS,
@@ -8953,11 +9113,11 @@ var configsDelete = defineCommand10({
     }
   }
 });
-var configs = defineCommand10({
+var configs = defineCommand9({
   meta: { name: "configs", description: "Manage the app\u2019s secrets configs" },
   subCommands: { list: configsList, create: configsCreate, delete: configsDelete }
 });
-var secrets_default = defineCommand10({
+var secrets_default = defineCommand9({
   meta: { name: "secrets", description: "Manage the app\u2019s secrets store" },
   subCommands: {
     list: list5,
@@ -9034,9 +9194,9 @@ var init_default = defineDeepspaceCommand({
 });
 
 // src/cli/commands/status.ts
-import { defineCommand as defineCommand11 } from "citty";
-import * as p18 from "@clack/prompts";
-import { existsSync as existsSync22, readFileSync as readFileSync23 } from "fs";
+import { defineCommand as defineCommand10 } from "citty";
+import * as p17 from "@clack/prompts";
+import { existsSync as existsSync22, readFileSync as readFileSync24 } from "fs";
 function timeAgo(iso) {
   const ms = Date.now() - Date.parse(iso);
   if (!Number.isFinite(ms) || ms < 0) return iso;
@@ -9061,7 +9221,15 @@ function statusRemoteFailure(error) {
     json: { state: "unavailable", error: message, ...code ? { code } : {} }
   };
 }
-var status_default = defineCommand11({
+function resolveStatusApp(appDir, wranglerEnv) {
+  if (!wranglerEnv) {
+    return { appName: detectAppName(appDir) ?? "(unnamed)", appId: readAppId(appDir) };
+  }
+  const resolved = resolveAppNameForEnv(readWranglerConfig(appDir), wranglerEnv);
+  if (!resolved.ok) throw new InputError(resolved.reason, "invalid_env");
+  return { appName: resolved.name, appId: readAppId(appDir, wranglerEnv) };
+}
+var status_default = defineCommand10({
   meta: {
     name: "status",
     description: "One screenful of current state: session, app, workspace, and live release"
@@ -9071,9 +9239,17 @@ var status_default = defineCommand11({
       type: "boolean",
       description: "Emit a single-line JSON result for scripts/agents",
       default: false
+    },
+    env: {
+      type: "string",
+      alias: "e",
+      description: "wrangler.toml [env.<name>] slot \u2014 reads that environment\u2019s app identity",
+      required: false
     }
   },
   async run({ args }) {
+    const { wranglerEnv, error: envError } = parseWranglerEnvArg(args.env);
+    if (envError) throw new InputError(envError, "invalid_env");
     const lines = [];
     const facts = {
       loggedIn: false,
@@ -9114,7 +9290,7 @@ var status_default = defineCommand11({
       let who = "logged in";
       try {
         const payload = decodeJwtPayload(
-          readFileSync23(TOKEN_PATH, "utf-8").trim()
+          readFileSync24(TOKEN_PATH, "utf-8").trim()
         );
         if (payload.email) who = payload.email;
         userId = payload.sub ?? null;
@@ -9129,15 +9305,15 @@ var status_default = defineCommand11({
       lines.push(["App", "not inside a DeepSpace app directory"]);
       json.inApp = false;
     } else {
-      const appName = detectAppName(appDir) ?? "(unnamed)";
-      const appId = readAppId(appDir);
+      const { appName, appId } = resolveStatusApp(appDir, wranglerEnv);
       lines.push([
         "App",
-        `${appName}${appId ? ` (${appId})` : " \u2014 no DEEPSPACE_APP_ID; run `deepspace app init`"}`
+        `${appName}${wranglerEnv ? ` [env.${wranglerEnv}]` : ""}${appId ? ` (${appId})` : " \u2014 no DEEPSPACE_APP_ID; run `deepspace app init`"}`
       ]);
       json.inApp = true;
       json.appName = appName;
       json.appId = appId;
+      if (wranglerEnv) json.wranglerEnv = wranglerEnv;
       const deps = installState(appDir);
       const depsInstallCommand = installCommand(appDir);
       lines.push([
@@ -9286,12 +9462,12 @@ var status_default = defineCommand11({
       return;
     }
     const width = Math.max(...lines.map(([k]) => k.length));
-    for (const [k, v] of lines) p18.log.message(`${k.padEnd(width)}  ${v}`);
+    for (const [k, v] of lines) p17.log.message(`${k.padEnd(width)}  ${v}`);
   }
 });
 
 // src/cli/commands/push.ts
-import * as p19 from "@clack/prompts";
+import * as p18 from "@clack/prompts";
 function pullRecoveryAction(cwd, appId, branch) {
   return {
     cwd,
@@ -9425,7 +9601,7 @@ var push_default = defineDeepspaceCommand({
       ensureSpaceRemote(appDir, appId);
       if (force) {
         spinner2?.message(`Checking the cloud ${branch} tip before force-push\u2026`);
-        const lastPushed = resolveCommit(appDir, `refs/deepspace/pushed/${branch}`);
+        const lastPushed = resolveCommit(appDir, spacePrivateRef(`pushed/${branch}`));
         let remoteTip = null;
         try {
           runGitRemote(appDir, token, [
@@ -9470,12 +9646,12 @@ var push_default = defineDeepspaceCommand({
       );
       const ok2 = result.status === "up_to_date" || result.status === "committed";
       if (ok2) {
-        updateRef(appDir, `refs/deepspace/pushed/${branch}`, tipOid);
+        updateRef(appDir, spacePrivateRef(`pushed/${branch}`), tipOid);
       }
       const recoverable = isRecoverablePushFailure(result.status);
       const rejectReason = result.reason ?? result.summary;
       const errorMsg = ok2 ? null : result.status === "ref_conflict" ? `The cloud repo's ${branch} moved while you worked (${rejectReason}). Run \`deepspace pull --app ${shQuote(appId)} --branch ${shQuote(branch)}\` to integrate, then push again.` : result.status === "rejected" ? `The cloud repo rejected ${branch}: ${rejectReason}.` + (OVERSIZED_PUSH_RE.test(rejectReason) ? ` ${oversizedPushFix(appDir)}` : "") : `The cloud repo's ${branch} has commit(s) your local ${branch} doesn't. Run \`deepspace pull --app ${shQuote(appId)} --branch ${shQuote(branch)}\` and merge (or rebase), then push. Avoid --force here \u2014 it's guarded and will refuse rather than silently drop a peer's commits.`;
-      if (!args.json && ok2) p19.log.info(`App: ${appId}`);
+      if (!args.json && ok2) p18.log.info(`App: ${appId}`);
       const action = recoverable ? pullRecoveryAction(pullRecoveryCwd, appId, branch) : void 0;
       if (!ok2) {
         throw new Refusal(errorMsg ?? `Push did not complete.`, result.status, {
@@ -9497,7 +9673,7 @@ var push_default = defineDeepspaceCommand({
 });
 
 // src/cli/commands/pull.ts
-import * as p20 from "@clack/prompts";
+import * as p19 from "@clack/prompts";
 import { realpathSync as realpathSync4 } from "fs";
 function targetedVcAction(command, cwd, appId, branch) {
   return {
@@ -9512,7 +9688,7 @@ function workspaceBranchPullRefusal(branch, trunkBranch) {
   const id = workspaceIdFromBranch(branch);
   if (!id) return null;
   const trunk = trunkBranch || "main";
-  const merge = `git merge refs/remotes/space/${shQuote(trunk)}`;
+  const merge = `git merge ${spaceTrackingRef(shQuote(trunk))}`;
   return {
     code: "workspace_branch",
     trunk,
@@ -9535,7 +9711,7 @@ function worktreeHoldingBranch(worktrees, branch, selfPath) {
 }
 function divergedMergeAdvice(branch, hasSelectedCheckout) {
   const b = shQuote(branch);
-  return hasSelectedCheckout ? `git merge refs/remotes/space/${b}` : `git checkout ${b} && git merge refs/remotes/space/${b}`;
+  return hasSelectedCheckout ? `git merge ${spaceTrackingRef(b)}` : `git checkout ${b} && git merge ${spaceTrackingRef(b)}`;
 }
 var pull_default = defineDeepspaceCommand({
   meta: {
@@ -9608,11 +9784,12 @@ var pull_default = defineDeepspaceCommand({
     const wsRefusal = workspaceBranchPullRefusal(branch, trunkBranch);
     if (wsRefusal) {
       const trunkRef = `refs/heads/${wsRefusal.trunk}`;
+      const trunkTrackingRef = spaceTrackingRef(wsRefusal.trunk);
       runGitRemote(appDir, token, [
         "fetch",
         "--quiet",
         SPACE_REMOTE,
-        `+${trunkRef}:refs/remotes/space/${wsRefusal.trunk}`
+        `+${trunkRef}:${trunkTrackingRef}`
       ]);
       spinner2?.stop("Workspace branch.");
       const { path: branchWorktreePath2 } = selectedBranchCheckout2();
@@ -9625,7 +9802,7 @@ var pull_default = defineDeepspaceCommand({
       const step = branchWorktreePath2 ? selectedCheckoutClean2 ? `Merge the fetched trunk in the checkout that owns ${branch} (${branchWorktreePath2}).` : `The checkout that owns ${branch} (${branchWorktreePath2}) is dirty. Commit or stash there, then rerun \`${pullCommand2}\` from that checkout.` : localBranchExists ? canCheckoutHere2 ? `The branch is not checked out. Check it out here, then rerun \`${pullCommand2}\` to receive the merge step.` : `The branch is not checked out and this checkout is dirty. Commit or stash first (or use a clean worktree), check out ${shQuote(branch)}, then rerun \`${pullCommand2}\`.` : `This clone has not attached the workspace. Attach ${workspaceId}, then rerun \`${pullCommand2}\` from its checkout.`;
       const action = branchWorktreePath2 && selectedCheckoutClean2 ? {
         cwd: branchWorktreePath2,
-        argv: ["git", "merge", `refs/remotes/space/${wsRefusal.trunk}`]
+        argv: ["git", "merge", trunkTrackingRef]
       } : canCheckoutHere2 ? { cwd: appDir, argv: ["git", "checkout", branch] } : !localBranchExists ? {
         cwd: appDir,
         argv: ["deepspace", "workspace", "attach", workspaceId, "--app", appId]
@@ -9649,17 +9826,18 @@ var pull_default = defineDeepspaceCommand({
       );
     }
     spinner2?.message(`Fetching ${branch} from the cloud repo\u2026`);
+    const trackingRef = spaceTrackingRef(branch);
     runGitRemote(appDir, token, [
       "fetch",
       "--quiet",
       SPACE_REMOTE,
-      `+${refName}:refs/remotes/space/${branch}`
+      `+${refName}:${trackingRef}`
     ]);
-    const remoteOid = resolveCommit(appDir, `refs/remotes/space/${branch}`);
+    const remoteOid = resolveCommit(appDir, trackingRef);
     if (!remoteOid) {
       spinner2?.stop("Fetch failed.");
       throw new Refusal(
-        `Fetched, but refs/remotes/space/${branch} did not materialize \u2014 retry; if it persists, report it with \`deepspace feedback\`.`,
+        `Fetched, but ${trackingRef} did not materialize \u2014 retry; if it persists, report it with \`deepspace feedback\`.`,
         "fetch_incomplete"
       );
     }
@@ -9696,8 +9874,8 @@ var pull_default = defineDeepspaceCommand({
       integration = "fetched_only_diverged";
     }
     const qBranch = shQuote(branch);
-    const ffRef = `git merge --ff-only refs/remotes/space/${qBranch}`;
-    const mergeRef = `git merge refs/remotes/space/${qBranch}`;
+    const ffRef = `git merge --ff-only ${spaceTrackingRef(qBranch)}`;
+    const mergeRef = `git merge ${spaceTrackingRef(qBranch)}`;
     const pullCommand = targetedVcCommand("pull", appId, branch);
     const pushCommand = targetedVcCommand("push", appId, branch);
     const selectedCheckoutClean = branchWorktreePath !== null && isWorkTreeClean(branchWorktreePath);
@@ -9719,35 +9897,35 @@ var pull_default = defineDeepspaceCommand({
         codeForState = "diverged";
         if (branchWorktreePath && selectedCheckoutClean) {
           const mergeAdvice = divergedMergeAdvice(branch, true);
-          line = `Fetched space/${branch}. ${branch} and the cloud repo diverged \u2014 run \`${mergeAdvice}\` in ${branchWorktreePath} (no network needed), then \`${pushCommand}\`.`;
+          line = `Fetched ${SPACE_REMOTE}/${branch}. ${branch} and the cloud repo diverged \u2014 run \`${mergeAdvice}\` in ${branchWorktreePath} (no network needed), then \`${pushCommand}\`.`;
           recoveryAction = {
             cwd: branchWorktreePath,
-            argv: ["git", "merge", `refs/remotes/space/${branch}`]
+            argv: ["git", "merge", trackingRef]
           };
         } else if (branchWorktreePath) {
-          line = `Fetched space/${branch}. ${branch} and the cloud repo diverged, but its checkout (${branchWorktreePath}) is dirty. Commit or stash there, then rerun \`${pullCommand}\` from that checkout.`;
+          line = `Fetched ${SPACE_REMOTE}/${branch}. ${branch} and the cloud repo diverged, but its checkout (${branchWorktreePath}) is dirty. Commit or stash there, then rerun \`${pullCommand}\` from that checkout.`;
         } else if (canCheckoutHere) {
-          line = `Fetched space/${branch}. ${branch} and the cloud repo diverged, but ${branch} is not checked out. Check it out here, then rerun \`${pullCommand}\` to receive the merge step.`;
+          line = `Fetched ${SPACE_REMOTE}/${branch}. ${branch} and the cloud repo diverged, but ${branch} is not checked out. Check it out here, then rerun \`${pullCommand}\` to receive the merge step.`;
           recoveryAction = { cwd: appDir, argv: ["git", "checkout", branch] };
         } else {
-          line = `Fetched space/${branch}. ${branch} and the cloud repo diverged, but ${branch} is not checked out and this checkout is dirty. Commit or stash first (or use a clean worktree), check out ${qBranch}, then rerun \`${pullCommand}\`.`;
+          line = `Fetched ${SPACE_REMOTE}/${branch}. ${branch} and the cloud repo diverged, but ${branch} is not checked out and this checkout is dirty. Commit or stash first (or use a clean worktree), check out ${qBranch}, then rerun \`${pullCommand}\`.`;
         }
         break;
       case "fetched_only_dirty":
         codeForState = "dirty_worktree";
-        line = `Fetched space/${branch}, but the worktree is dirty. Either stash \u2192 \`${ffRef}\` \u2192 \`git stash pop\`, or commit first \u2192 \`${mergeRef}\` (or \`git rebase\`).`;
+        line = `Fetched ${SPACE_REMOTE}/${branch}, but the worktree is dirty. Either stash \u2192 \`${ffRef}\` \u2192 \`git stash pop\`, or commit first \u2192 \`${mergeRef}\` (or \`git rebase\`).`;
         break;
       case "fetched_only_unborn":
         codeForState = "dirty_worktree";
-        line = `Fetched space/${branch} and created ${branch}, but the worktree has uncommitted files. Preserve them in a commit or stash (including untracked files), then restore the checkout; do not run reset --hard until \`git status\` confirms nothing worth keeping remains.`;
+        line = `Fetched ${SPACE_REMOTE}/${branch} and created ${branch}, but the worktree has uncommitted files. Preserve them in a commit or stash (including untracked files), then restore the checkout; do not run reset --hard until \`git status\` confirms nothing worth keeping remains.`;
         break;
       case "fetched_only_worktree":
         codeForState = "branch_in_worktree";
         if (branchWorktreePath && selectedCheckoutClean) {
-          line = `Fetched space/${branch}, but ${branch} is checked out in another worktree (${branchWorktreePath}) \u2014 its ref was left untouched to keep that worktree in sync. Run \`${pullCommand}\` from there.`;
+          line = `Fetched ${SPACE_REMOTE}/${branch}, but ${branch} is checked out in another worktree (${branchWorktreePath}) \u2014 its ref was left untouched to keep that worktree in sync. Run \`${pullCommand}\` from there.`;
           recoveryAction = targetedVcAction("pull", branchWorktreePath, appId, branch);
         } else {
-          line = `Fetched space/${branch}, but its checkout (${branchWorktreePath ?? "a linked worktree"}) is dirty, so the ref and worktree were left untouched. Commit or stash there, then run \`${pullCommand}\` from that checkout.`;
+          line = `Fetched ${SPACE_REMOTE}/${branch}, but its checkout (${branchWorktreePath ?? "a linked worktree"}) is dirty, so the ref and worktree were left untouched. Commit or stash there, then run \`${pullCommand}\` from that checkout.`;
         }
         break;
       default: {
@@ -9756,8 +9934,8 @@ var pull_default = defineDeepspaceCommand({
       }
     }
     const actionRequired = recoveryAction !== void 0;
-    spinner2?.stop(codeForState ? `Fetched space/${branch}.` : line);
-    if (!args.json) p20.log.info(`App: ${appId} \xB7 space/${branch} at ${remoteOid.slice(0, 10)}`);
+    spinner2?.stop(codeForState ? `Fetched ${SPACE_REMOTE}/${branch}.` : line);
+    if (!args.json) p19.log.info(`App: ${appId} \xB7 ${SPACE_REMOTE}/${branch} at ${remoteOid.slice(0, 10)}`);
     if (codeForState) {
       throw new Refusal(line, codeForState, {
         actionRequired,
@@ -9776,9 +9954,9 @@ var pull_default = defineDeepspaceCommand({
 });
 
 // src/cli/commands/clone.ts
-import * as p21 from "@clack/prompts";
+import * as p20 from "@clack/prompts";
 import { existsSync as existsSync23, readdirSync as readdirSync6, rmSync as rmSync5 } from "fs";
-import { resolve as resolve16, basename as basename3, join as join21 } from "path";
+import { resolve as resolve15, basename as basename3, join as join21 } from "path";
 function cleanFailedCloneDir(dir) {
   let entries;
   try {
@@ -9832,7 +10010,7 @@ var clone_default = defineDeepspaceCommand({
   async run({ args }) {
     assertAppTargetResolvable(String(args.app));
     const selector = String(args.app).trim();
-    const dir = resolve16(String(args.dir ?? selector));
+    const dir = resolve15(String(args.dir ?? selector));
     const dirPreexisted = validateCloneTarget(dir);
     const spinner2 = args.json ? null : createSpinner();
     spinner2?.start(`Resolving ${selector}\u2026`);
@@ -9878,7 +10056,7 @@ var clone_default = defineDeepspaceCommand({
       `Cloned ${selector} (${branches.length} ${branches.length === 1 ? "branch" : "branches"}) into ${basename3(dir)}/ at ${head?.slice(0, 10) ?? "(unborn)"}.`
     );
     if (!args.json && !branch) {
-      p21.log.warn("HEAD is detached \u2014 check `git branch -a`.");
+      p20.log.warn("HEAD is detached \u2014 check `git branch -a`.");
     }
     return {
       data: {
@@ -9897,7 +10075,7 @@ var clone_default = defineDeepspaceCommand({
 });
 
 // src/cli/commands/releases.ts
-import * as p22 from "@clack/prompts";
+import * as p21 from "@clack/prompts";
 var DEPLOY_URL11 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 var releases_default = defineDeepspaceCommand({
   meta: {
@@ -9911,6 +10089,12 @@ var releases_default = defineDeepspaceCommand({
       description: "App id or subdomain name (default: the surrounding app directory)",
       required: false
     },
+    env: {
+      type: "string",
+      alias: "e",
+      description: "wrangler.toml [env.<name>] slot \u2014 selects that environment's app id",
+      required: false
+    },
     limit: {
       type: "string",
       description: "Max entries (default 20)",
@@ -9919,18 +10103,20 @@ var releases_default = defineDeepspaceCommand({
   },
   async run({ args }) {
     const appArg = args.app;
+    const envArg = args.env;
     const { limit, error: limitError } = parseLimitArg(args.limit);
     if (limitError) throw new Refusal(limitError, "invalid_limit");
-    assertAppTargetResolvable(appArg);
+    assertAppTargetResolvable(appArg, { wranglerEnv: envArg });
+    const { wranglerEnv } = parseWranglerEnvArg(envArg);
     const spinner2 = args.json ? null : createSpinner();
     spinner2?.start("Loading release history\u2026");
     const token = await ensureToken();
-    const appId = await resolveAppTarget(DEPLOY_URL11, token, appArg);
+    const appId = await resolveAppTarget(DEPLOY_URL11, token, appArg, { wranglerEnv: envArg });
     const { releases } = await repoApi(DEPLOY_URL11, token, appId).listReleases(limit);
     spinner2?.stop(`Loaded ${releases.length} ${releases.length === 1 ? "release" : "releases"}.`);
     if (!args.json) {
       if (releases.length === 0) {
-        p22.log.info("No releases yet \u2014 the history starts with the next `deepspace deploy`.");
+        p21.log.info("No releases yet \u2014 the history starts with the next `deepspace deploy`.");
       } else {
         for (const r of releases) {
           const source = r.commitOid ? `commit ${r.commitOid.slice(0, 10)}` : "(no source recorded)";
@@ -9939,15 +10125,17 @@ var releases_default = defineDeepspaceCommand({
             `#${r.seq}  ${r.id}  ${r.kind.padEnd(8)}  ${r.createdAt}  ${r.actor}  ${source}  ${rollback}`
           );
         }
-        p22.log.info("Roll back an available release with: deepspace rollback <release-id>");
+        p21.log.info(
+          `Roll back an available release with: deepspace rollback <release-id>${wranglerEnv ? ` --env ${wranglerEnv}` : ""}`
+        );
       }
     }
-    return { data: { appId, releases } };
+    return { data: { appId, wranglerEnv: wranglerEnv ?? null, releases } };
   }
 });
 
 // src/cli/commands/rollback.ts
-import * as p23 from "@clack/prompts";
+import * as p22 from "@clack/prompts";
 var REL_ID_RE = /^rel_[0-9A-HJKMNP-TV-Z]{26}$/;
 function unavailableDoGuardRefusal(message) {
   return new Refusal(
@@ -9986,6 +10174,12 @@ var rollback_default = defineDeepspaceCommand({
       description: "App id or subdomain name (default: the surrounding app directory)",
       required: false
     },
+    env: {
+      type: "string",
+      alias: "e",
+      description: "wrangler.toml [env.<name>] slot \u2014 selects that environment's app id",
+      required: false
+    },
     "allow-do-deletion": {
       type: "boolean",
       description: "Proceed even though the target release declares fewer Durable Object classes than the current one \u2014 THEIR STORED DATA IS DELETED.",
@@ -9994,6 +10188,7 @@ var rollback_default = defineDeepspaceCommand({
   },
   async run({ args }) {
     const appArg = args.app;
+    const envArg = args.env;
     if (args.release !== void 0) {
       const r = String(args.release).trim();
       if (!r) {
@@ -10006,11 +10201,12 @@ var rollback_default = defineDeepspaceCommand({
         throw new Refusal(`Invalid release id: ${r} (expected rel_<ULID>).`, "invalid_release");
       }
     }
-    assertAppTargetResolvable(appArg);
+    assertAppTargetResolvable(appArg, { wranglerEnv: envArg });
+    const { wranglerEnv } = parseWranglerEnvArg(envArg);
     const spinner2 = args.json ? null : createSpinner();
     spinner2?.start("Preparing rollback\u2026");
     const token = await ensureToken();
-    const appId = await resolveAppTarget(DEPLOY_URL12, token, appArg);
+    const appId = await resolveAppTarget(DEPLOY_URL12, token, appArg, { wranglerEnv: envArg });
     const api4 = repoApi(DEPLOY_URL12, token, appId);
     let releaseId = args.release ? String(args.release).trim() : "";
     if (!releaseId) {
@@ -10052,18 +10248,18 @@ Re-run with --allow-do-deletion to accept the data loss.`,
     spinner2?.stop(`Rolled back to ${result.rolledBackTo ?? releaseId}.`);
     const doClassGuard = result.doClassGuard === "unverified" ? "unverified" : void 0;
     if (!args.json) {
-      if (result.url) p23.log.success(`Live at: ${result.url}`);
+      if (result.url) p22.log.success(`Live at: ${result.url}`);
       if (result.bundleRetained === false) {
-        p23.log.warn(
+        p22.log.warn(
           "The rollback is live, but its bundle was concurrently retired and is not available for a future rollback."
         );
       }
       if (doClassGuard === "unverified") {
-        p23.log.warn(
+        p22.log.warn(
           "DO-class guard bypassed (--allow-do-deletion): this rollback was NOT checked against the live Durable Object classes \u2014 any class the target doesn't declare has been deleted with its data."
         );
       }
-      p23.log.info(
+      p22.log.info(
         "This rollback is itself the newest release \u2014 `deepspace releases` shows the full history."
       );
     }
@@ -10075,6 +10271,7 @@ Re-run with --allow-do-deletion to accept the data loss.`,
         bundleRetained: result.bundleRetained ?? null,
         url: result.url ?? null,
         versionId: result.versionId ?? null,
+        wranglerEnv: wranglerEnv ?? null,
         ...doClassGuard ? { doClassGuard } : {}
       }
     };
@@ -10082,16 +10279,16 @@ Re-run with --allow-do-deletion to accept the data loss.`,
 });
 
 // src/cli/commands/workspace.ts
-import { defineCommand as defineCommand12 } from "citty";
+import { defineCommand as defineCommand11 } from "citty";
 
 // src/cli/commands/workspace/new.ts
-import * as p26 from "@clack/prompts";
-import { isAbsolute as isAbsolute6, resolve as resolve17 } from "path";
+import * as p25 from "@clack/prompts";
+import { isAbsolute as isAbsolute6, resolve as resolve16 } from "path";
 
 // src/cli/commands/workspace/analysis.ts
-import * as p24 from "@clack/prompts";
+import * as p23 from "@clack/prompts";
 var MAX_OVERLAP_PATHS = 20;
-var PEER_REF_PREFIX = "refs/deepspace/peers/";
+var PEER_REF_PREFIX = `${spacePrivateRef("peers")}/`;
 function peerWorkspaceRef(workspaceId) {
   return `${PEER_REF_PREFIX}${workspaceId}`;
 }
@@ -10102,7 +10299,7 @@ function formatCount(count) {
 function fetchTrunk(appDir, token, head) {
   if (!head?.startsWith("refs/heads/")) return null;
   const branch = head.slice("refs/heads/".length);
-  const remoteRef = `refs/remotes/space/${branch}`;
+  const remoteRef = spaceTrackingRef(branch);
   runGitRemote(appDir, token, ["fetch", "--quiet", SPACE_REMOTE, `+${head}:${remoteRef}`]);
   const oid = resolveCommit(appDir, remoteRef);
   return oid ? { branch, ref: remoteRef, oid } : null;
@@ -10112,7 +10309,7 @@ function localTrunkOid(appDir, refs) {
   if (!head?.startsWith("refs/heads/")) return null;
   const advertised = refs?.refs.find((ref) => ref.name === head)?.oid ?? null;
   if (advertised && resolveCommit(appDir, advertised)) return advertised;
-  return resolveCommit(appDir, `refs/remotes/space/${head.slice("refs/heads/".length)}`);
+  return resolveCommit(appDir, spaceTrackingRef(head.slice("refs/heads/".length)));
 }
 function fetchPeerWorkspaceRefs(appDir, token) {
   try {
@@ -10203,15 +10400,15 @@ function printOverlaps(overlaps, json) {
   for (const overlap of overlaps) {
     const sample = overlap.paths.slice(0, 5).join(", ");
     const more = overlap.paths.length - 5 + overlap.morePaths;
-    p24.log.warn(
+    p23.log.warn(
       `Overlap: ${overlap.workspaceId} ("${overlap.task}") also modified ${sample}${more > 0 ? ` (+${more} more)` : ""} \u2014 coordinate before landing.`
     );
   }
 }
 
 // src/cli/commands/workspace/local.ts
-import * as p25 from "@clack/prompts";
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync24, realpathSync as realpathSync5, renameSync as renameSync2, statSync, writeFileSync as writeFileSync9 } from "fs";
+import * as p24 from "@clack/prompts";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync25, realpathSync as realpathSync5, renameSync as renameSync2, statSync, writeFileSync as writeFileSync9 } from "fs";
 import { dirname as dirname9, isAbsolute as isAbsolute5, join as join22, relative as relative2, sep as sep2 } from "path";
 var WORKSPACE_MARKER = "deepspace-workspace.json";
 function excludeWorktreeDir(appDir, dir) {
@@ -10269,7 +10466,7 @@ function isManagedWorkspaceWorktree(worktreeRoot, workspaceId) {
   const markerPath = worktreeMarkerPath(worktreeRoot);
   if (!markerPath) return false;
   try {
-    const marker = JSON.parse(readFileSync24(markerPath, "utf-8"));
+    const marker = JSON.parse(readFileSync25(markerPath, "utf-8"));
     return marker.version === 1 && marker.workspaceId === workspaceId && marker.mode === "managed-linked";
   } catch {
     return false;
@@ -10371,7 +10568,7 @@ function switchOffWsBranch(mainDir, trunkBranch) {
     if (resolveCommit(mainDir, `refs/heads/${trunkBranch}`)) {
       return runGit(mainDir, ["switch", "--quiet", trunkBranch], { allowFail: true }).status === 0;
     }
-    const remote = resolveCommit(mainDir, `refs/remotes/space/${trunkBranch}`);
+    const remote = resolveCommit(mainDir, spaceTrackingRef(trunkBranch));
     if (remote) {
       return runGit(mainDir, ["switch", "--quiet", "-c", trunkBranch, remote], { allowFail: true }).status === 0;
     }
@@ -10446,7 +10643,7 @@ function cleanupAction(outcome) {
 }
 function reportCleanupHuman(outcome) {
   if (outcome.error) {
-    p25.log.warn(
+    p24.log.warn(
       cleanupRefusalMessage({
         error: outcome.error,
         worktreeDir: outcome.worktreeDir,
@@ -10459,12 +10656,12 @@ function reportCleanupHuman(outcome) {
     outcome.worktreeRemoved ? "worktree" : null,
     outcome.branchDeleted ? `branch ${outcome.branch}` : null
   ].filter(Boolean);
-  if (parts.length) p25.log.success(`Removed ${parts.join(" + ")}.`);
+  if (parts.length) p24.log.success(`Removed ${parts.join(" + ")}.`);
   if (outcome.worktreeRetained) {
-    p25.log.info(`Retained externally managed worktree: ${outcome.worktreeRetained}`);
+    p24.log.info(`Retained externally managed worktree: ${outcome.worktreeRetained}`);
   }
   if (outcome.worktreeRemoved && outcome.mainDir) {
-    p25.log.info(`This directory was removed \u2014 run: cd ${shQuote(outcome.mainDir)}`);
+    p24.log.info(`This directory was removed \u2014 run: cd ${shQuote(outcome.mainDir)}`);
   }
 }
 
@@ -10646,7 +10843,7 @@ var newWorkspaceCommand = defineDeepspaceCommand({
       idempotencyKey: mintIdempotencyKey()
     });
     const dirInput = typeof args.dir === "string" ? args.dir.trim() : "";
-    const worktreeRoot = dirInput ? isAbsolute6(dirInput) ? dirInput : resolve17(appDir, dirInput) : defaultWorkspaceRoot(appDir, id);
+    const worktreeRoot = dirInput ? isAbsolute6(dirInput) ? dirInput : resolve16(appDir, dirInput) : defaultWorkspaceRoot(appDir, id);
     const dir = appDirInWorktree(appDir, worktreeRoot);
     try {
       materializeWorkspaceWorktree(appDir, worktreeRoot, branch, baseOid, id);
@@ -10661,8 +10858,8 @@ var newWorkspaceCommand = defineDeepspaceCommand({
     }
     spinner2?.stop(`Workspace ${id} created.`);
     if (!args.json) {
-      p26.log.info(`Work in: cd ${dir}`);
-      p26.log.info(
+      p25.log.info(`Work in: cd ${dir}`);
+      p25.log.info(
         `Then: commit as usual, \`deepspace workspace sync\` to publish, \`deepspace workspace land\` when done.`
       );
     }
@@ -10683,9 +10880,9 @@ var newWorkspaceCommand = defineDeepspaceCommand({
 });
 
 // src/cli/commands/workspace/attach.ts
-import * as p27 from "@clack/prompts";
+import * as p26 from "@clack/prompts";
 import { existsSync as existsSync24, readdirSync as readdirSync7, rmSync as rmSync6 } from "fs";
-import { isAbsolute as isAbsolute7, resolve as resolve18 } from "path";
+import { isAbsolute as isAbsolute7, resolve as resolve17 } from "path";
 function finishedWorkspaceMessage(id, view) {
   const workspace = view.workspace;
   if (workspace.status === "landed") {
@@ -10754,11 +10951,12 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
         });
       }
       ensureSpaceRemote(appDir, appId2);
+      const localWorkspaceRef = spacePrivateRef(`workspaces/${id}`);
       runGitRemote(appDir, token2, [
         "fetch",
         "--quiet",
         SPACE_REMOTE,
-        `+${view2.workspace.ref}:${view2.workspace.ref}`
+        `+${view2.workspace.ref}:${localWorkspaceRef}`
       ]);
       const tip2 = view2.tipOid ?? view2.workspace.baseOid;
       if (!resolveCommit(appDir, tip2)) {
@@ -10769,7 +10967,7 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
         );
       }
       const requestedDir = typeof args.dir === "string" ? args.dir.trim() : "";
-      const worktreeRoot = requestedDir ? isAbsolute7(requestedDir) ? requestedDir : resolve18(appDir, requestedDir) : defaultWorkspaceRoot(appDir, id);
+      const worktreeRoot = requestedDir ? isAbsolute7(requestedDir) ? requestedDir : resolve17(appDir, requestedDir) : defaultWorkspaceRoot(appDir, id);
       const dir2 = appDirInWorktree(appDir, worktreeRoot);
       if (resolveCommit(appDir, `refs/heads/${branch}`)) {
         throw new Refusal(
@@ -10780,8 +10978,8 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
       materializeWorkspaceWorktree(appDir, worktreeRoot, branch, tip2, id);
       spinner2?.stop(`Attached ${id}.`);
       if (!args.json) {
-        p27.log.info(`Task: ${view2.workspace.task}`);
-        p27.log.info(`Work in: cd ${dir2}`);
+        p26.log.info(`Task: ${view2.workspace.task}`);
+        p26.log.info(`Work in: cd ${dir2}`);
       }
       const action2 = { cwd: dir2, argv: [detectPackageManager(dir2), "install"] };
       return {
@@ -10808,7 +11006,7 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
         extra: { status: view.workspace.status }
       });
     }
-    const dir = resolve18(
+    const dir = resolve17(
       process.cwd(),
       (typeof args.dir === "string" ? args.dir.trim() : "") || `ws-${id.slice(3).toLowerCase()}`
     );
@@ -10827,11 +11025,12 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
     try {
       runGit(process.cwd(), ["init", "--quiet", dir]);
       ensureSpaceRemote(dir, appId);
+      const localWorkspaceRef = spacePrivateRef(`workspaces/${id}`);
       runGitRemote(dir, token, [
         "fetch",
         "--quiet",
         SPACE_REMOTE,
-        `+${view.workspace.ref}:${view.workspace.ref}`
+        `+${view.workspace.ref}:${localWorkspaceRef}`
       ]);
       tip = view.tipOid ?? view.workspace.baseOid;
       if (!resolveCommit(dir, tip)) {
@@ -10852,8 +11051,8 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
     spinner2?.stop(`Attached ${id}.`);
     const action = { cwd: dir, argv: [detectPackageManager(dir), "install"] };
     if (!args.json) {
-      p27.log.info(`Task: ${view.workspace.task}`);
-      p27.log.info("Pull app secrets after install if this workspace needs them.");
+      p26.log.info(`Task: ${view.workspace.task}`);
+      p26.log.info("Pull app secrets after install if this workspace needs them.");
     }
     return {
       data: {
@@ -10870,7 +11069,7 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
 });
 
 // src/cli/commands/workspace/sync.ts
-import * as p28 from "@clack/prompts";
+import * as p27 from "@clack/prompts";
 var syncWorkspaceCommand = defineDeepspaceCommand({
   meta: {
     name: "sync",
@@ -10931,12 +11130,12 @@ var syncWorkspaceCommand = defineDeepspaceCommand({
     );
     printOverlaps(overlaps, args.json);
     if (!args.json && trunkOverlap.length > 0) {
-      p28.log.warn(
+      p27.log.warn(
         `Trunk already changed ${trunkOverlap.length} file(s) you also touch \u2014 landed work you haven't merged: ${trunkOverlap.slice(0, 5).join(", ")}${trunkOverlap.length > 5 ? ` (+${trunkOverlap.length - 5} more)` : ""}. Merge trunk before landing (\`deepspace workspace status\` shows the full picture).`
       );
     }
     if (!args.json && dirty.length > 0) {
-      p28.log.warn(
+      p27.log.warn(
         `${dirty.length} uncommitted ${dirty.length === 1 ? "file" : "files"} NOT synced \u2014 commit them to this workspace branch (WIP commits are fine \u2014 they land with the merge).`
       );
     }
@@ -10956,7 +11155,7 @@ var syncWorkspaceCommand = defineDeepspaceCommand({
 });
 
 // src/cli/commands/workspace/list.ts
-import * as p29 from "@clack/prompts";
+import * as p28 from "@clack/prompts";
 
 // src/cli/lib/actor-labels.ts
 var API_URL9 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
@@ -11004,7 +11203,7 @@ var listWorkspacesCommand = defineDeepspaceCommand({
     if (views.length === 0) {
       spinner2?.stop("No workspaces found.");
       if (!args.json) {
-        p29.log.info(
+        p28.log.info(
           all ? "No workspaces." : 'No active workspaces. Create one with `deepspace workspace new -t "\u2026"`.'
         );
       }
@@ -11033,13 +11232,13 @@ var listWorkspacesCommand = defineDeepspaceCommand({
         );
       }
     }
-    p29.log.info("\u2191 commits ahead of base \xB7 \u2193 trunk commits since base (staleness)");
+    p28.log.info("\u2191 commits ahead of base \xB7 \u2193 trunk commits since base (staleness)");
     return { data: { workspaces } };
   }
 });
 
 // src/cli/commands/workspace/status.ts
-import * as p30 from "@clack/prompts";
+import * as p29 from "@clack/prompts";
 var workspaceStatusCommand = defineDeepspaceCommand({
   meta: { name: "status", description: "This workspace: base staleness, overlaps, sync state" },
   args: {
@@ -11099,22 +11298,22 @@ var workspaceStatusCommand = defineDeepspaceCommand({
       overlaps
     };
     if (!args.json) {
-      p30.log.info(`Task: ${workspace.task}`);
-      p30.log.info(
+      p29.log.info(`Task: ${workspace.task}`);
+      p29.log.info(
         `Base: ${workspace.baseOid.slice(0, 10)} \xB7 ahead ${aheadExact ?? "?"} commit(s) \xB7 trunk moved ${behindExact ?? "?"} commit(s) since your base`
       );
       if (!attached) {
-        p30.log.info(
+        p29.log.info(
           `Not checked out in this clone \u2014 showing the published state (local HEAD/uncommitted unavailable). Attach it with \`deepspace workspace attach ${id} <dir>\`.`
         );
       }
       if (unsynced)
-        p30.log.warn(
+        p29.log.warn(
           `Local HEAD ${headOid?.slice(0, 10)} is not synced (server has ${view.tipOid?.slice(0, 10) ?? "nothing"}) \u2014 run \`deepspace workspace sync\`.`
         );
-      if (dirty.length > 0) p30.log.warn(`${dirty.length} uncommitted file(s) in the worktree.`);
+      if (dirty.length > 0) p29.log.warn(`${dirty.length} uncommitted file(s) in the worktree.`);
       if (trunkOverlap.length > 0) {
-        p30.log.warn(
+        p29.log.warn(
           `Trunk also modified: ${trunkOverlap.slice(0, 5).join(", ")}${trunkOverlap.length > 5 ? ` (+${trunkOverlap.length - 5} more)` : ""} \u2014 expect merge attention at land time.`
         );
       }
@@ -11125,17 +11324,17 @@ var workspaceStatusCommand = defineDeepspaceCommand({
 });
 
 // src/cli/commands/workspace/land.ts
-import * as p31 from "@clack/prompts";
+import * as p30 from "@clack/prompts";
 
 // src/cli/lib/validation.ts
 import { sync as spawnSync7 } from "cross-spawn";
-import { readFileSync as readFileSync25 } from "fs";
+import { readFileSync as readFileSync26 } from "fs";
 import { join as join23 } from "path";
 var MAX_SUMMARY_CHARS = 4e3;
 var MAX_OUTPUT_BUFFER = 64 * 1024 * 1024;
 function configuredCommand(appDir) {
   try {
-    const pkg2 = JSON.parse(readFileSync25(join23(appDir, "package.json"), "utf-8"));
+    const pkg2 = JSON.parse(readFileSync26(join23(appDir, "package.json"), "utf-8"));
     if (pkg2.scripts?.validate) return `${detectPackageManager(appDir)} run --silent validate`;
   } catch {
   }
@@ -11266,7 +11465,7 @@ var landWorkspaceCommand = defineDeepspaceCommand({
       );
     }
     const intoRef = `refs/heads/${intoBranch}`;
-    const remoteRef = `refs/remotes/space/${intoBranch}`;
+    const remoteRef = spaceTrackingRef(intoBranch);
     runGitRemote(appDir, token, ["fetch", "--quiet", SPACE_REMOTE, `+${intoRef}:${remoteRef}`], {
       allowFail: true
     });
@@ -11411,7 +11610,7 @@ var landWorkspaceCommand = defineDeepspaceCommand({
     if (!args.json && cleanup && !cleanup.error) {
       reportCleanupHuman(cleanup);
     } else if (!args.json && retainedWorktree) {
-      p31.log.info(`Retained checkout: ${retainedWorktree}`);
+      p30.log.info(`Retained checkout: ${retainedWorktree}`);
     }
     if (cleanup?.error) {
       const action = cleanupAction({
@@ -11433,7 +11632,7 @@ var landWorkspaceCommand = defineDeepspaceCommand({
 });
 
 // src/cli/commands/workspace/drop.ts
-import * as p32 from "@clack/prompts";
+import * as p31 from "@clack/prompts";
 function isWorkspaceTipPublished(appDir, localTip, publishedOids) {
   return publishedOids.some(
     (publishedOid) => publishedOid === localTip || isAncestor(appDir, localTip, publishedOid)
@@ -11442,9 +11641,9 @@ function isWorkspaceTipPublished(appDir, localTip, publishedOids) {
 function workspaceUnsyncedRefusal(args) {
   const syncArgv = ["deepspace", "workspace", "sync", "--app", args.appId, "--workspace", args.id];
   const dropArgv = ["deepspace", "workspace", "drop", args.id, "--app", args.appId];
-  const publish2 = args.workspaceDir ? `Publish them first with \`${humanCommand(syncArgv)}\`, then re-run \`${humanCommand(dropArgv)}\`.` : `Recreate a worktree from the branch (\`git worktree add <dir> ${args.branch}\`), publish from there with \`${humanCommand(syncArgv)}\`, then re-run \`${humanCommand(dropArgv)}\`.`;
+  const publish = args.workspaceDir ? `Publish them first with \`${humanCommand(syncArgv)}\`, then re-run \`${humanCommand(dropArgv)}\`.` : `Recreate a worktree from the branch (\`git worktree add <dir> ${args.branch}\`), publish from there with \`${humanCommand(syncArgv)}\`, then re-run \`${humanCommand(dropArgv)}\`.`;
   return new Refusal(
-    `${args.id} has committed work that isn't published yet. ${publish2} Alternatively, pass \`--keep-worktree\` to drop the cloud workspace while retaining the local branch/worktree for manual disposal. Nothing was dropped.`,
+    `${args.id} has committed work that isn't published yet. ${publish} Alternatively, pass \`--keep-worktree\` to drop the cloud workspace while retaining the local branch/worktree for manual disposal. Nothing was dropped.`,
     "workspace_unsynced",
     {
       ...args.workspaceDir ? { action: { cwd: args.workspaceDir, argv: syncArgv } } : {},
@@ -11479,7 +11678,7 @@ var dropWorkspaceCommand = defineDeepspaceCommand({
       const { view: view2 } = await api5.dropWorkspace(explicitId);
       spinner2?.stop();
       if (!args.json) {
-        p32.log.success(
+        p31.log.success(
           `Dropped ${explicitId}. Its ref sticks around briefly for undo, then is reaped.`
         );
       }
@@ -11531,9 +11730,9 @@ var dropWorkspaceCommand = defineDeepspaceCommand({
     };
     spinner2?.stop();
     if (!args.json) {
-      p32.log.success(`Dropped ${id}. Its ref sticks around briefly for undo, then is reaped.`);
+      p31.log.success(`Dropped ${id}. Its ref sticks around briefly for undo, then is reaped.`);
       if (cleanup && !cleanup.error) reportCleanupHuman(cleanup);
-      else if (retainedWorktree) p32.log.info(`Retained checkout: ${retainedWorktree}`);
+      else if (retainedWorktree) p31.log.info(`Retained checkout: ${retainedWorktree}`);
     }
     if (cleanup?.error) {
       const action = cleanupAction({
@@ -11555,7 +11754,7 @@ var dropWorkspaceCommand = defineDeepspaceCommand({
 });
 
 // src/cli/commands/workspace.ts
-var workspace_default = defineCommand12({
+var workspace_default = defineCommand11({
   meta: {
     name: "workspace",
     description: "Durable parallel-agent workspaces (new/attach/sync/list/status/land/drop)"
@@ -11572,7 +11771,7 @@ var workspace_default = defineCommand12({
 });
 
 // src/cli/commands/activity.ts
-import * as p33 from "@clack/prompts";
+import * as p32 from "@clack/prompts";
 var FOLLOW_INTERVAL_MS = 5e3;
 function landIndex(events) {
   const m = /* @__PURE__ */ new Map();
@@ -11685,7 +11884,7 @@ var activity_default = defineDeepspaceCommand({
           const lands = landIndex(page.events);
           for (const e of page.events) console.log(formatEvent2(e, lands, actors));
           if (page.events.length === 0 && !args.follow) {
-            p33.log.info(cursor > 0 ? `No activity after #${cursor}.` : "No activity yet.");
+            p32.log.info(cursor > 0 ? `No activity after #${cursor}.` : "No activity yet.");
           }
         }
         cursor = page.cursor;
@@ -11695,7 +11894,7 @@ var activity_default = defineDeepspaceCommand({
         }
         if (!args.follow) {
           if (page.events.length > 0) {
-            p33.log.info(
+            p32.log.info(
               `Cursor: ${cursor}` + (page.hasMore ? ` \xB7 more available (next page: --since ${cursor})` : ` (resume later with --since ${cursor})`)
             );
           }
@@ -11717,7 +11916,7 @@ var activity_default = defineDeepspaceCommand({
             })
           );
         } else {
-          p33.log.warn(`Activity feed interrupted (${code}); retrying in 5s.`);
+          p32.log.warn(`Activity feed interrupted (${code}); retrying in 5s.`);
         }
       }
       await new Promise((resolveSleep) => setTimeout(resolveSleep, FOLLOW_INTERVAL_MS));
@@ -11726,7 +11925,7 @@ var activity_default = defineDeepspaceCommand({
 });
 
 // src/cli/commands/git-credential.ts
-import { defineCommand as defineCommand13 } from "citty";
+import { defineCommand as defineCommand12 } from "citty";
 function parseFields(input) {
   const fields = /* @__PURE__ */ new Map();
   for (const line of input.split("\n")) {
@@ -11775,7 +11974,7 @@ async function readStdin() {
   for await (const chunk of process.stdin) data += chunk;
   return data;
 }
-var git_credential_default = defineCommand13({
+var git_credential_default = defineCommand12({
   meta: {
     name: "git-credential",
     description: "Git credential helper (installed automatically; not for direct use)"
@@ -11810,8 +12009,8 @@ var git_credential_default = defineCommand13({
 });
 
 // src/cli/commands/source.ts
-import * as p34 from "@clack/prompts";
-var TRANSFER_PREFIX = "refs/deepspace/source-transfer";
+import * as p33 from "@clack/prompts";
+var TRANSFER_PREFIX = spacePrivateRef("source-transfer");
 var source_default = defineDeepspaceCommand({
   meta: {
     name: "source",
@@ -11863,7 +12062,7 @@ var source_default = defineDeepspaceCommand({
     const remoteArg = typeof args.remote === "string" ? args.remote.trim() : void 0;
     const result = requested === "github" ? await moveToGitHub({ appDir, appId, token, deployUrl, state, remoteArg }) : await moveToDeepSpace({ appDir, appId, token, deployUrl, state, remoteArg });
     if (!args.json) {
-      p34.log.success(
+      p33.log.success(
         result.source.provider === "github" ? `Source: GitHub \xB7 ${result.source.repository} (revision ${result.revision})` : `Source: DeepSpace (revision ${result.revision})`
       );
     }
@@ -12629,11 +12828,11 @@ function reportMigration(migration, json) {
 
 // src/cli/cli.ts
 var __dirname = dirname10(fileURLToPath3(import.meta.url));
-var pkg = JSON.parse(readFileSync26(join24(__dirname, "..", "package.json"), "utf-8"));
+var pkg = JSON.parse(readFileSync27(join24(__dirname, "..", "package.json"), "utf-8"));
 if (process.platform === "linux" && !process.env.SSL_CERT_FILE && existsSync25("/etc/ssl/certs/ca-certificates.crt")) {
   process.env.SSL_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt";
 }
-var create2 = defineCommand14({
+var create2 = defineCommand13({
   meta: {
     name: "create",
     description: "Create a new DeepSpace app (runs create-deepspace; all flags are forwarded)"
@@ -12672,14 +12871,14 @@ var create2 = defineCommand14({
   }
 });
 var rename = (cmd, name) => ({ ...cmd, meta: { ...cmd.meta ?? {}, name } });
-var auth = defineCommand14({
+var auth = defineCommand13({
   meta: { name: "auth", description: "Session: login, logout, whoami" },
   subCommands: { login: login_default, logout: logout_default, whoami: whoami_default }
 });
-var app = defineCommand14({
+var app = defineCommand13({
   meta: {
     name: "app",
-    description: "The app itself: create, init, list, source, migrate, undeploy, transfer, collaborators, domain, library, usage"
+    description: "The app itself: create, init, list, source, migrate, undeploy, transfer, collaborators, domain, usage"
   },
   subCommands: {
     create: create2,
@@ -12689,17 +12888,16 @@ var app = defineCommand14({
     transfer: transfer_default,
     collaborators: collaborators_default,
     domain: domain_default,
-    library: library_default,
     usage: usage_default,
     source: source_default,
     migrate: migrate_default
   }
 });
-var devGroup = defineCommand14({
+var devGroup = defineCommand13({
   meta: { name: "dev", description: "Local development" },
   subCommands: { start: rename(dev_default, "start"), kill: kill_default }
 });
-var testGroup = defineCommand14({
+var testGroup = defineCommand13({
   meta: { name: "test", description: "App tests and test tooling" },
   subCommands: {
     run: rename(test_default, "run"),
@@ -12707,7 +12905,7 @@ var testGroup = defineCommand14({
     accounts: rename(test_accounts_default, "accounts")
   }
 });
-var main = defineCommand14({
+var main = defineCommand13({
   meta: {
     name: "deepspace",
     version: pkg.version,