deepspace 0.10.2 → 0.11.0

package/dist/cli.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 
 // src/cli/cli.ts
-import { defineCommand as defineCommand14, runMain, runCommand } from "citty";
+import { defineCommand as defineCommand13, runMain, runCommand } from "citty";
 import { sync as spawnSync8 } from "cross-spawn";
-import { readFileSync as readFileSync28, existsSync as existsSync26 } from "fs";
-import { dirname as dirname10, join as join25 } from "path";
+import { readFileSync as readFileSync28, existsSync as existsSync25 } from "fs";
+import { dirname as dirname10, join as join24 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 
 // src/cli/lib/spinner.ts
@@ -709,7 +709,7 @@ async function provisionProfile(jwt) {
   }
 }
 function sleep(ms) {
-  return new Promise((resolve19) => setTimeout(resolve19, ms));
+  return new Promise((resolve18) => setTimeout(resolve18, ms));
 }
 function base64url(bytes) {
   return bytes.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
@@ -1267,7 +1267,7 @@ function upsertWorktreeLaunchConfig(mainRepoRoot, worktreeName, appDir, opts) {
     let port = opts.port;
     if (opts.probePort) {
       const taken = new Set(
-        config.configurations.map((c) => Number(c?.port)).filter((p35) => Number.isInteger(p35) && p35 > 0)
+        config.configurations.map((c) => Number(c?.port)).filter((p34) => Number.isInteger(p34) && p34 > 0)
       );
       for (let i = 0; i < WORKTREE_PORT_RANGE && taken.has(port); i++) {
         port = WORKTREE_PORT_MIN + (port - WORKTREE_PORT_MIN + 1) % WORKTREE_PORT_RANGE;
@@ -1838,7 +1838,8 @@ async function refreshSecretsCache(deployUrl, token, appId, wranglerEnv) {
   return {
     pulled,
     rendered: renderSecretsCache(pulled.values, pulled),
-    summary: `Secrets: ${pulled.configName} (${count} secret${count === 1 ? "" : "s"})`
+    // An empty store is the common case and not worth a status line.
+    summary: count ? `Secrets: ${pulled.configName} (${count} secret${count === 1 ? "" : "s"})` : null
   };
 }
 
@@ -2289,18 +2290,18 @@ function ensureInstallReady(appDir) {
   const logPath = join9(sentinelDir, "install.log");
   if (existsSync9(errPath)) {
     const detail = readFileSync11(errPath, "utf-8").trimEnd();
-    const log29 = existsSync9(logPath) ? ` Full log: ${logPath}.` : "";
+    const log28 = existsSync9(logPath) ? ` Full log: ${logPath}.` : "";
     throw new Refusal(
-      `Dependency install failed: ${detail}.${log29} Run \`npm install\` (or \`bun install\`) manually, then retry.`,
+      `Dependency install failed: ${detail}.${log28} Run \`npm install\` (or \`bun install\`) manually, then retry.`,
       "install_failed",
       { action: { cwd: appDir, argv: [detectPackageManager(appDir), "install"] } }
     );
   }
   if (existsSync9(startedPath) && !existsSync9(donePath)) {
     if (!installWorkerAlive(sentinelDir)) {
-      const log29 = existsSync9(logPath) ? ` See what happened: ${logPath}.` : "";
+      const log28 = existsSync9(logPath) ? ` See what happened: ${logPath}.` : "";
       throw new Refusal(
-        `The dependency install is no longer running and never finished.${log29} Run \`npm install\` (or \`bun install\`) manually, then retry.`,
+        `The dependency install is no longer running and never finished.${log28} Run \`npm install\` (or \`bun install\`) manually, then retry.`,
         "install_failed",
         { action: { cwd: appDir, argv: [detectPackageManager(appDir), "install"] } }
       );
@@ -2449,7 +2450,7 @@ function lintSchema(schema) {
     const offendingRoles = Object.entries(schema.permissions).filter(([, perms]) => perms.read === true).map(([role]) => role);
     if (offendingRoles.length > 0) {
       const usesAware = Object.values(schema.permissions).some(
-        (p35) => typeof p35.read === "string" && VISIBILITY_AWARE.includes(p35.read)
+        (p34) => typeof p34.read === "string" && VISIBILITY_AWARE.includes(p34.read)
       );
       if (!usesAware) {
         warnings.push(
@@ -2533,10 +2534,10 @@ function formatSchemaLintFindings(findings) {
 import { createServer } from "net";
 var DEFAULT_PORT = 5173;
 function checkPortAvailable(port, host = "0.0.0.0") {
-  return new Promise((resolve19) => {
+  return new Promise((resolve18) => {
     const srv = createServer();
-    srv.once("error", () => resolve19(false));
-    srv.once("listening", () => srv.close(() => resolve19(true)));
+    srv.once("error", () => resolve18(false));
+    srv.once("listening", () => srv.close(() => resolve18(true)));
     srv.listen(port, host);
   });
 }
@@ -2664,7 +2665,7 @@ var dev_default = defineDeepspaceCommand({
         const refreshed = await refreshSecretsCache(DEPLOY_URL, token, appIdForSecrets, wranglerEnv);
         if (refreshed) {
           generatedSecretsCache = refreshed.rendered;
-          say(refreshed.summary);
+          if (refreshed.summary) say(refreshed.summary);
         }
       } catch (err) {
         throw new Refusal(
@@ -3261,7 +3262,7 @@ var test_default = defineDeepspaceCommand({
         const refreshed = await refreshSecretsCache(DEPLOY_URL2, token, appIdForSecrets, wranglerEnv);
         if (refreshed) {
           generatedSecretsCache = refreshed.rendered;
-          say(refreshed.summary);
+          if (refreshed.summary) say(refreshed.summary);
         }
       } catch (err) {
         throw new Refusal(
@@ -3714,6 +3715,7 @@ import { resolve as resolve12 } from "path";
 // src/cli/commands/deploy/build.ts
 import * as p6 from "@clack/prompts";
 import { execSync as execSync2 } from "child_process";
+import { createHash as createHash2 } from "crypto";
 import { existsSync as existsSync15, readFileSync as readFileSync17, readdirSync as readdirSync4 } from "fs";
 import { dirname as dirname5, join as join16, resolve as resolve10 } from "path";
 
@@ -4173,9 +4175,12 @@ function collectAssets(dir) {
       if (entry.isDirectory()) {
         walk(fullPath, relativePath);
       } else {
+        const bytes = readFileSync17(fullPath);
         assets.push({
           path: `/${relativePath}`,
-          contentBase64: readFileSync17(fullPath).toString("base64")
+          hash: createHash2("sha256").update(bytes).digest("hex"),
+          size: bytes.byteLength,
+          sourcePath: fullPath
         });
       }
     }
@@ -4462,7 +4467,7 @@ function createDeployOutput(json) {
 
 // src/cli/commands/deploy/request.ts
 import * as p10 from "@clack/prompts";
-import { randomUUID as randomUUID2 } from "crypto";
+import { readFileSync as readFileSync18 } from "fs";
 
 // src/cli/commands/deploy/repository.ts
 import * as p9 from "@clack/prompts";
@@ -5172,7 +5177,7 @@ async function pushWithTransientRetry(push) {
     } catch (error) {
       const message = errorMessage3(error);
       if (/(?:HTTP |error: )(?:429|503)\b/i.test(message) && attempt < backoffMs.length) {
-        await new Promise((resolve19) => setTimeout(resolve19, backoffMs[attempt]));
+        await new Promise((resolve18) => setTimeout(resolve18, backoffMs[attempt]));
         continue;
       }
       throw error;
@@ -5202,12 +5207,9 @@ function detachedHeadRefusal() {
 
 // src/cli/commands/deploy/request.ts
 var CLOUDFLARE_DEPLOY_ERROR_HINT = "Deployment reached the DeepSpace deploy worker, but Cloudflare's deployment control-plane API failed. This is often caused by a Cloudflare Dashboard/API incident or Workers for Platforms entitlement outage. Already deployed apps should keep serving; wait for Cloudflare to recover and retry.";
-var MAX_GROUP_BYTES = 40 * 1024 * 1024;
-var GROUP_BYTES = (() => {
-  const configured = Number(process.env.DEEPSPACE_DEPLOY_GROUP_BYTES);
-  const bytes = Number.isInteger(configured) && configured > 0 ? configured : 3 * 1024 * 1024;
-  return Math.min(bytes, MAX_GROUP_BYTES);
-})();
+var DEPLOY_SERVICE_LIMIT_HINT = "The DeepSpace deploy service hit a resource limit processing this deploy (the deploy worker was terminated before it could answer). This is a DeepSpace-side failure, not a Cloudflare incident \u2014 your app was not changed. Retry; if it keeps happening, report the app id and asset count.";
+var REQUIRED_ASSET_TRANSPORT = "content-addressed-v1";
+var UPLOAD_CONCURRENCY = 4;
 async function deployBuiltBundle(options) {
   const {
     deployUrl,
@@ -5228,44 +5230,11 @@ async function deployBuiltBundle(options) {
   } else if (bundle.extraRoutes.length) {
     p10.log.info(`Custom worker-first routes: ${bundle.extraRoutes.join(", ")}`);
   }
-  const assetGroups = packAssetGroups(bundle.assets, GROUP_BYTES);
-  if (assetGroups.length === 0) assetGroups.push([]);
-  const uploadId = randomUUID2();
-  const totalGroups = assetGroups.length;
-  try {
-    for (let index = 0; index < totalGroups; index++) {
-      const groupJson = JSON.stringify(assetGroups[index]);
-      spinner2.message(`Uploading assets \u2014 group ${index + 1}/${totalGroups}...`);
-      const groupResponse = await postWithRetry(
-        `${deployUrl}/api/deploy/${appId}/assets?uploadId=${uploadId}&groupIndex=${index}&totalGroups=${totalGroups}`,
-        () => ({
-          method: "POST",
-          headers: {
-            Authorization: `Bearer ${token}`,
-            "Content-Type": "application/json"
-          },
-          body: groupJson
-        })
-      );
-      if (!groupResponse.ok) {
-        const errorBody = await groupResponse.json().catch(() => ({}));
-        await abortStagedUpload(deployUrl, appId, uploadId, totalGroups, token);
-        spinner2.stop("Deploy failed");
-        output.die(
-          `Asset upload failed on group ${index + 1}/${totalGroups}: ${errorBody.error ?? `HTTP ${groupResponse.status}`}`,
-          "upload_failed"
-        );
-      }
-    }
-  } catch (error) {
-    await abortStagedUpload(deployUrl, appId, uploadId, totalGroups, token);
-    spinner2.stop("Deploy failed");
-    output.die(`Asset upload failed (network): ${errorMessage4(error)}`, "upload_failed");
-  }
+  await requireAssetTransport(deployUrl, spinner2, output);
+  await uploadDeployAssets({ deployUrl, appId, token, assets: bundle.assets, output, spinner: spinner2 });
   spinner2.message(`Deploying ${appName}...`);
   let confirmRename = options.rename;
   const bail = async (message, stopLabel = "Deploy failed", code, actionRequired = false, action) => {
-    await abortStagedUpload(deployUrl, appId, uploadId, totalGroups, token);
     if (stopLabel !== null) spinner2.stop(stopLabel);
     p10.cancel(code ? withSlug(message, code) : message);
     if (action) printAction(action);
@@ -5287,8 +5256,7 @@ async function deployBuiltBundle(options) {
       new Blob([bundle.workerJs], { type: "application/javascript" }),
       "worker.js"
     );
-    form.append("uploadId", uploadId);
-    form.append("totalGroups", String(totalGroups));
+    form.append("assetManifest", JSON.stringify(assetManifest(bundle.assets)));
     form.append("appMigrations", JSON.stringify(bundle.appMigrations));
     if (bundle.doManifest) form.append("doManifest", JSON.stringify(bundle.doManifest));
     if (bundle.customBindings.length) {
@@ -5367,7 +5335,11 @@ async function deployBuiltBundle(options) {
     );
   }
   if (!response.ok || !body.success) {
-    await bail(formatDeployWorkerError(response.status, body.error), "Deploy failed", body.code);
+    await bail(
+      formatDeployWorkerError(response.status, body.error, body.code),
+      "Deploy failed",
+      body.code
+    );
   }
   if (body.onBehalfOfOwner) {
     p10.log.warn(`Deployed on behalf of owner ${body.onBehalfOfOwner}`);
@@ -5384,17 +5356,139 @@ async function deployBuiltBundle(options) {
   }
   return body;
 }
-async function abortStagedUpload(deployUrl, appId, uploadId, totalGroups, token) {
+function assetManifest(assets) {
+  return assets.map((asset) => ({ path: asset.path, hash: asset.hash, size: asset.size }));
+}
+async function requireAssetTransport(deployUrl, spinner2, output) {
+  let advertised;
   try {
-    await fetch(
-      `${deployUrl}/api/deploy/${appId}/assets?uploadId=${uploadId}&totalGroups=${totalGroups}`,
-      { method: "DELETE", headers: { Authorization: `Bearer ${token}` } }
+    const response = await fetch(`${deployUrl}/api/health`);
+    if (!response.ok) throw new Error(`HTTP ${response.status}`);
+    const body = await response.json();
+    advertised = body.capabilities?.assetTransport;
+  } catch (error) {
+    spinner2.stop("Deploy failed");
+    output.die(
+      `Could not reach the DeepSpace deploy service at ${deployUrl} to check its capabilities: ${errorMessage4(error)}`,
+      "deploy_service_unreachable"
+    );
+  }
+  if (advertised !== REQUIRED_ASSET_TRANSPORT) {
+    spinner2.stop("Deploy failed");
+    output.die(
+      `The DeepSpace deploy service at ${deployUrl} does not support this CLI's asset transport (needs "${REQUIRED_ASSET_TRANSPORT}", found ${advertised === void 0 ? "none" : `"${String(advertised)}"`}). Wait for the platform to finish updating, or pin an older deepspace CLI.`,
+      "asset_transport_unsupported"
     );
-  } catch {
   }
 }
-function formatDeployWorkerError(status3, error) {
+async function uploadDeployAssets(options) {
+  const { deployUrl, appId, token, assets, spinner: spinner2 } = options;
+  const output = options.output;
+  const byHash = new Map(assets.map((asset) => [asset.hash, asset]));
+  spinner2.message("Checking which assets are already uploaded...");
+  let planResponse;
+  try {
+    planResponse = await postWithRetry(`${deployUrl}/api/deploy/${appId}/asset-plan`, () => ({
+      method: "POST",
+      headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+      body: JSON.stringify({
+        assets: [...byHash.values()].map((asset) => ({ hash: asset.hash, size: asset.size }))
+      })
+    }));
+  } catch (error) {
+    spinner2.stop("Deploy failed");
+    output.die(`Asset plan failed (network): ${errorMessage4(error)}`, "upload_failed");
+  }
+  const planBody = await planResponse.json().catch(() => ({}));
+  if (!planResponse.ok) {
+    spinner2.stop("Deploy failed");
+    output.die(
+      formatDeployWorkerError(planResponse.status, planBody.error, planBody.code),
+      planBody.code ?? "upload_failed"
+    );
+  }
+  const missing = [];
+  for (const hash of planBody.missing ?? []) {
+    const asset = byHash.get(hash);
+    if (!asset) {
+      spinner2.stop("Deploy failed");
+      output.die(
+        `The deploy service asked for asset ${hash}, which is not part of this build. Re-run the deploy; if it persists, report the app id.`,
+        "upload_failed"
+      );
+    }
+    missing.push(asset);
+  }
+  if (missing.length === 0) {
+    p10.log.info(`Assets: ${byHash.size} file(s), all already uploaded`);
+    return;
+  }
+  const missingBytes = missing.reduce((total, asset) => total + asset.size, 0);
+  p10.log.info(
+    `Assets: ${byHash.size} file(s), uploading ${missing.length} (${Math.ceil(missingBytes / 1024)} KiB); the rest are already stored`
+  );
+  let uploaded = 0;
+  const next = () => missing.pop();
+  const worker = async () => {
+    for (let asset = next(); asset; asset = next()) {
+      const response = await postWithRetry(
+        `${deployUrl}/api/deploy/${appId}/assets/${asset.hash}`,
+        () => ({
+          method: "PUT",
+          headers: {
+            Authorization: `Bearer ${token}`,
+            "Content-Type": "application/octet-stream"
+          },
+          // Read whole, per attempt. The platform matches Content-Length
+          // against the plan before it touches storage, and a stream body
+          // would be sent chunked with no length at all; a retry also needs a
+          // body it can send again.
+          body: readFileSync18(asset.sourcePath)
+        })
+      );
+      if (!response.ok) {
+        const body = await response.json().catch(() => ({}));
+        throw new AssetUploadError(
+          body.error ?? `Upload of ${asset.path} failed: HTTP ${response.status}`,
+          body.code ?? "upload_failed",
+          response.status
+        );
+      }
+      uploaded++;
+      spinner2.message(`Uploading assets \u2014 ${uploaded}/${uploaded + missing.length}...`);
+    }
+  };
+  try {
+    await Promise.all(
+      Array.from({ length: Math.min(UPLOAD_CONCURRENCY, missing.length) }, worker)
+    );
+  } catch (error) {
+    spinner2.stop("Deploy failed");
+    if (error instanceof AssetUploadError) {
+      output.die(formatDeployWorkerError(error.status, error.message, error.code), error.code);
+    }
+    output.die(`Asset upload failed (network): ${errorMessage4(error)}`, "upload_failed");
+  }
+}
+var AssetUploadError = class extends Error {
+  constructor(message, code, status3) {
+    super(message);
+    this.code = code;
+    this.status = status3;
+  }
+};
+function isDeployServiceResourceLimit(status3, error) {
+  if (!error) return status3 === 500 || status3 === 502;
+  return /\b110[12]\b/.test(error) && /worker|error code/i.test(error);
+}
+function formatDeployWorkerError(status3, error, code) {
   const detail = error ?? `Deployment error (${status3})`;
+  if (code === "cli_outdated") return detail;
+  if (isDeployServiceResourceLimit(status3, error)) {
+    return `${DEPLOY_SERVICE_LIMIT_HINT}
+
+Underlying error: ${detail}`;
+  }
   if (status3 < 500 && ![
     "Upload session failed",
     "Asset upload failed",
@@ -5411,23 +5505,6 @@ Underlying error: ${detail}`;
 function errorMessage4(error) {
   return error instanceof Error ? error.message : String(error);
 }
-function packAssetGroups(assets, maxBytes) {
-  const groups = [];
-  let current = [];
-  let currentBytes = 2;
-  for (const asset of assets) {
-    const entryBytes = Buffer.byteLength(JSON.stringify(asset), "utf-8") + 1;
-    if (current.length > 0 && currentBytes + entryBytes > maxBytes) {
-      groups.push(current);
-      current = [];
-      currentBytes = 2;
-    }
-    current.push(asset);
-    currentBytes += entryBytes;
-  }
-  if (current.length > 0) groups.push(current);
-  return groups;
-}
 async function postWithRetry(url, makeInit, {
   attempts = 4,
   retryServerErrors = true
@@ -5444,7 +5521,7 @@ async function postWithRetry(url, makeInit, {
       lastError = error;
     }
     if (attempt < attempts) {
-      await new Promise((resolve19) => setTimeout(resolve19, Math.min(8e3, 500 * 2 ** (attempt - 1))));
+      await new Promise((resolve18) => setTimeout(resolve18, Math.min(8e3, 500 * 2 ** (attempt - 1))));
     }
   }
   if (lastResponse) return lastResponse;
@@ -5453,7 +5530,7 @@ async function postWithRetry(url, makeInit, {
 
 // src/cli/commands/deploy/secrets.ts
 import * as p11 from "@clack/prompts";
-import { existsSync as existsSync18, readFileSync as readFileSync18 } from "fs";
+import { existsSync as existsSync18, readFileSync as readFileSync19 } from "fs";
 function classifyDevVarsSecrets(options) {
   const store = new Set(options.storeSecretNames);
   const strayKeys = options.handEditedDevVarKeys.filter((key) => !store.has(key));
@@ -5480,7 +5557,7 @@ async function loadDeploySecrets(options) {
         generatedSecretsCache: refreshed.rendered,
         sharedDevVarsCache: true
       });
-      p11.log.info(refreshed.summary);
+      if (refreshed.summary) p11.log.info(refreshed.summary);
     }
   } catch (error) {
     if (error?.status === 403) {
@@ -5552,7 +5629,7 @@ function prepareDeploySecrets(options) {
 }
 function readCustomDevVars(path, output) {
   if (!existsSync18(path)) return {};
-  const section = extractCustomDevVars(stripGeneratedSecretsCache(readFileSync18(path, "utf-8")));
+  const section = extractCustomDevVars(stripGeneratedSecretsCache(readFileSync19(path, "utf-8")));
   if (!section) return {};
   try {
     return parseDevVars(section);
@@ -5826,7 +5903,7 @@ async function waitForAssetsReady(url, timeoutMs) {
       if (!body.includes("Assets have not yet deployed") && !body.includes("No app configured")) {
         streak++;
         if (streak >= 3) return true;
-        await new Promise((resolve19) => setTimeout(resolve19, 1500));
+        await new Promise((resolve18) => setTimeout(resolve18, 1500));
         continue;
       }
       streak = 0;
@@ -5834,7 +5911,7 @@ async function waitForAssetsReady(url, timeoutMs) {
       streak = 0;
     }
     const waitMs = Math.min(8e3, 1e3 * 2 ** (attempt - 1));
-    await new Promise((resolve19) => setTimeout(resolve19, waitMs));
+    await new Promise((resolve18) => setTimeout(resolve18, waitMs));
   }
   return false;
 }
@@ -6127,12 +6204,20 @@ var apps_default = defineDeepspaceCommand({
       if (!apps.length) {
         console.log("No apps yet. Create one with `npx create-deepspace <name>` and `deepspace deploy`.");
       } else {
-        const nameWidth = Math.max(4, ...apps.map((a) => (a.name ?? "\u2014").length));
-        const idWidth = Math.max(6, ...apps.map((a) => a.appId.length));
-        console.log(`${"NAME".padEnd(nameWidth)}  ${"APP ID".padEnd(idWidth)}  URL`);
-        for (const a of apps) {
+        const rows = [...apps].sort(
+          (left, right) => Number(right.status !== "undeployed") - Number(left.status !== "undeployed")
+        );
+        const nameWidth = Math.max(4, ...rows.map((a) => (a.name ?? "\u2014").length));
+        const statusWidth = Math.max(6, ...rows.map((a) => a.status.length));
+        const idWidth = Math.max(6, ...rows.map((a) => a.appId.length));
+        console.log(
+          `${"NAME".padEnd(nameWidth)}  ${"STATUS".padEnd(statusWidth)}  ${"APP ID".padEnd(idWidth)}  URL`
+        );
+        for (const a of rows) {
           const url = a.url ?? "(not deployed)";
-          console.log(`${(a.name ?? "\u2014").padEnd(nameWidth)}  ${a.appId.padEnd(idWidth)}  ${url}`);
+          console.log(
+            `${(a.name ?? "\u2014").padEnd(nameWidth)}  ${a.status.padEnd(statusWidth)}  ${a.appId.padEnd(idWidth)}  ${url}`
+          );
         }
       }
     }
@@ -6470,7 +6555,7 @@ var usage_default = defineDeepspaceCommand({
 });
 
 // src/cli/commands/add.ts
-import { existsSync as existsSync20, readFileSync as readFileSync20, realpathSync as realpathSync3 } from "fs";
+import { existsSync as existsSync20, readFileSync as readFileSync21, realpathSync as realpathSync3 } from "fs";
 import { dirname as dirname7, join as join19, resolve as resolve14 } from "path";
 import { pathToFileURL as pathToFileURL3 } from "url";
 
@@ -6483,7 +6568,7 @@ import {
   mkdirSync as mkdirSync6,
   mkdtempSync,
   openSync as openSync2,
-  readFileSync as readFileSync19,
+  readFileSync as readFileSync20,
   readSync,
   readdirSync as readdirSync5,
   rmSync as rmSync4,
@@ -6500,7 +6585,7 @@ function featurePackageRoot(moduleUrl = import.meta.url) {
     const packagePath = join18(dir, "package.json");
     if (existsSync19(packagePath)) {
       try {
-        const pkg2 = JSON.parse(readFileSync19(packagePath, "utf-8"));
+        const pkg2 = JSON.parse(readFileSync20(packagePath, "utf-8"));
         if (pkg2.name === "deepspace") return dir;
       } catch {
       }
@@ -6517,7 +6602,7 @@ function readFeatureConfig(id, packageRoot = featurePackageRoot()) {
   const configPath = join18(packageRoot, "features", id, "feature.json");
   if (!existsSync19(configPath)) return null;
   try {
-    const config = JSON.parse(readFileSync19(configPath, "utf-8"));
+    const config = JSON.parse(readFileSync20(configPath, "utf-8"));
     if (typeof config.id !== "string" || typeof config.name !== "string" || !Array.isArray(config.files)) {
       return null;
     }
@@ -6582,7 +6667,7 @@ function copyFile(src, dest) {
 function copyFileWithImportShift(src, dest, levels) {
   mkdirSync6(dirname6(dest), { recursive: true });
   const prefix = "../".repeat(levels);
-  const shifted = readFileSync19(src, "utf-8").replace(
+  const shifted = readFileSync20(src, "utf-8").replace(
     /(from\s+|import\s+|import\()(['"])(\.\.\/)/g,
     `$1$2${prefix}$3`
   );
@@ -6641,7 +6726,7 @@ function integrateSchema(config, targetDir, emit) {
   if (!existsSync19(schemasPath)) {
     return [unresolvedSchema(config.schema, "src/schemas.ts was not found.", emit)];
   }
-  let content = readFileSync19(schemasPath, "utf-8");
+  let content = readFileSync20(schemasPath, "utf-8");
   const { exportName, importPath, spreadOperator } = config.schema;
   const importPattern = new RegExp(`^import\\s+\\{[^}]*\\b${exportName}\\b`, "m");
   if (importPattern.test(content)) {
@@ -6698,7 +6783,7 @@ function integrateActions(config, targetDir, emit) {
   if (!existsSync19(actionsPath)) {
     return [unresolvedActions(config.actions, "src/actions/index.ts was not found.", emit)];
   }
-  let content = readFileSync19(actionsPath, "utf-8");
+  let content = readFileSync20(actionsPath, "utf-8");
   const registryPattern = /export const actions:\s*Record<string,\s*ActionHandler(?:<[^>]*>)?>\s*=\s*\{/;
   if (!registryPattern.test(content)) {
     const reason = "src/actions/index.ts has an unexpected structure.";
@@ -6753,7 +6838,7 @@ function integrateCode(config, targetDir, emit) {
       });
       continue;
     }
-    const original = readFileSync19(targetPath, "utf-8");
+    const original = readFileSync20(targetPath, "utf-8");
     if (original.includes(insertion.insert.trim())) {
       emit(`   Integration already present: ${insertion.file}`);
       continue;
@@ -6789,7 +6874,7 @@ ${content.slice(importIndex < 0 ? 0 : importIndex)}`;
 function integrateIgnore(config, targetDir) {
   if (!config.ignore?.length) return;
   const targetPath = join18(targetDir, ".gitignore");
-  const current = existsSync19(targetPath) ? readFileSync19(targetPath, "utf-8") : "";
+  const current = existsSync19(targetPath) ? readFileSync20(targetPath, "utf-8") : "";
   const present = new Set(current.split(/\r?\n/).map((line) => line.trim()));
   const missing = config.ignore.filter((pattern) => !present.has(pattern));
   if (missing.length === 0) return;
@@ -6809,7 +6894,7 @@ function integrateWrangler(config, targetDir, emit) {
   if (!existsSync19(targetPath)) {
     return [{ area: "wrangler", reason: "wrangler.toml was not found.", steps }];
   }
-  let source = readFileSync19(targetPath, "utf-8");
+  let source = readFileSync20(targetPath, "utf-8");
   if (runWorkerFirst && !/^\[assets\]\s*$/m.test(source)) {
     return [{ area: "wrangler", reason: "wrangler.toml has no [assets] section.", steps }];
   }
@@ -6898,7 +6983,7 @@ function integrateCss(packageRoot, config, targetDir, emit) {
       }
     ];
   }
-  let styles = readFileSync19(stylesPath, "utf-8");
+  let styles = readFileSync20(stylesPath, "utf-8");
   let integrated = 0;
   const unresolved = [];
   for (const cssFile of config.css) {
@@ -6912,7 +6997,7 @@ function integrateCss(packageRoot, config, targetDir, emit) {
       });
       continue;
     }
-    const css = readFileSync19(srcPath, "utf-8");
+    const css = readFileSync20(srcPath, "utf-8");
     const fingerprint = css.match(/\.([\w-]+)\s*\{|@keyframes\s+([\w-]+)/);
     const marker = fingerprint?.[1] ?? fingerprint?.[2];
     if (marker && styles.includes(marker)) {
@@ -6943,7 +7028,7 @@ function integrateRoute(config, targetDir, emit) {
   if (!existsSync19(navPath)) {
     return [unresolvedRoute(config.route, config, "src/nav.ts was not found.", emit)];
   }
-  let content = readFileSync19(navPath, "utf-8");
+  let content = readFileSync20(navPath, "utf-8");
   const routePath = config.route.path;
   if (content.includes(`'${routePath}'`)) {
     emit(`   Nav already present: ${routePath}`);
@@ -7024,7 +7109,7 @@ function integrateDependencies(config, targetDir, runInstall, outputVisible, emi
   }
   let pkg2;
   try {
-    pkg2 = JSON.parse(readFileSync19(packagePath, "utf-8"));
+    pkg2 = JSON.parse(readFileSync20(packagePath, "utf-8"));
   } catch (error) {
     emit(
       `   Could not patch package.json (parse error: ${error instanceof Error ? error.message : String(error)})`
@@ -7084,7 +7169,7 @@ ${child.diagnosticTail}` : "";
 }
 function dependencySnapshot(targetDir) {
   try {
-    const pkg2 = JSON.parse(readFileSync19(join18(targetDir, "package.json"), "utf-8"));
+    const pkg2 = JSON.parse(readFileSync20(join18(targetDir, "package.json"), "utf-8"));
     return {
       dependencies: pkg2.dependencies ?? {},
       devDependencies: pkg2.devDependencies ?? {}
@@ -7333,7 +7418,7 @@ function isDeepSpaceApp(dir) {
   const packagePath = join19(dir, "package.json");
   if (!existsSync20(packagePath)) return false;
   try {
-    const pkg2 = JSON.parse(readFileSync20(packagePath, "utf-8"));
+    const pkg2 = JSON.parse(readFileSync21(packagePath, "utf-8"));
     return Boolean(pkg2.dependencies?.deepspace || pkg2.devDependencies?.deepspace);
   } catch {
     return false;
@@ -7536,11 +7621,11 @@ function fmtDate(iso) {
 }
 async function confirm4(message) {
   process.stdout.write(`${message} [y/N] `);
-  return new Promise((resolve19) => {
+  return new Promise((resolve18) => {
     process.stdin.setEncoding("utf-8");
     process.stdin.once("data", (data) => {
       const answer = data.toString().trim().toLowerCase();
-      resolve19(answer === "y" || answer === "yes");
+      resolve18(answer === "y" || answer === "yes");
     });
   });
 }
@@ -7867,8 +7952,8 @@ var list3 = defineDeepspaceCommand({
       }
       if (pending.length) {
         console.log(`PENDING INVITES ON ${app2}`);
-        for (const p35 of pending) {
-          console.log(`  ${p35.email} (expires ${new Date(p35.expiresAt).toLocaleDateString()})`);
+        for (const p34 of pending) {
+          console.log(`  ${p34.email} (expires ${new Date(p34.expiresAt).toLocaleDateString()})`);
         }
       }
     }
@@ -7966,7 +8051,7 @@ var cancel3 = defineDeepspaceCommand({
       `/api/app-collaborators/${encodeURIComponent(app2)}`
     );
     const target = email.trim().toLowerCase();
-    const found = pending.find((p35) => p35.email.toLowerCase() === target);
+    const found = pending.find((p34) => p34.email.toLowerCase() === target);
     if (!found) {
       throw new Refusal(`${email} has no pending invite on ${app2}`, "no_pending_invite", {
         action: cliAction("deepspace", "app", "collaborators", "list", "--app", app2)
@@ -8116,7 +8201,7 @@ var transfer_default = defineCommand7({
 import { defineCommand as defineCommand8 } from "citty";
 
 // src/cli/commands/_invoke-impl.ts
-import { readFileSync as readFileSync21 } from "fs";
+import { readFileSync as readFileSync22 } from "fs";
 import * as p15 from "@clack/prompts";
 var API_URL7 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
 var DEFAULT_TIMEOUT_MS = 12e4;
@@ -8157,7 +8242,7 @@ function resolveBody(opts) {
   if (opts.body != null) {
     raw = opts.body;
   } else if (opts.bodyFile != null) {
-    raw = opts.bodyFile === "-" ? readFileSync21(0, "utf-8") : readFileSync21(opts.bodyFile, "utf-8");
+    raw = opts.bodyFile === "-" ? readFileSync22(0, "utf-8") : readFileSync22(opts.bodyFile, "utf-8");
   } else {
     return "{}";
   }
@@ -8434,227 +8519,10 @@ var integrations_default = defineCommand8({
   }
 });
 
-// src/cli/commands/library.ts
-import { defineCommand as defineCommand9 } from "citty";
-import { existsSync as existsSync21, readFileSync as readFileSync22 } from "fs";
-import { join as join20, resolve as resolve15 } from "path";
-import { parse as parseToml4 } from "smol-toml";
-import * as p16 from "@clack/prompts";
-var DEFAULT_LIBRARY_APP = "deepdotspace-site";
-var str = (v) => typeof v === "string" && v ? v : void 0;
-var publish = defineDeepspaceCommand({
-  meta: {
-    name: "publish",
-    description: "Publish the current app to the DeepSpace library"
-  },
-  args: {
-    dir: {
-      type: "string",
-      description: "App directory (default: current directory)",
-      required: false
-    },
-    app: {
-      type: "string",
-      description: "App name (default: read from wrangler.toml)",
-      required: false
-    },
-    name: {
-      type: "string",
-      description: "Display name (default: app name)",
-      required: false
-    },
-    description: {
-      type: "string",
-      description: "Short description",
-      required: false
-    },
-    category: {
-      type: "string",
-      description: "Category (e.g. Productivity, Finance, AI). Default: General",
-      required: false
-    },
-    tags: {
-      type: "string",
-      description: "Comma-separated tags",
-      required: false
-    },
-    visibility: {
-      type: "string",
-      description: "'public' (default), 'unlisted', or 'private'",
-      required: false
-    },
-    screenshot: {
-      type: "string",
-      description: "Override the auto-captured preview with a public PNG URL",
-      required: false
-    },
-    "library-app": {
-      type: "string",
-      description: `Target library app subdomain (default: ${DEFAULT_LIBRARY_APP})`,
-      required: false
-    }
-  },
-  async run({ args }) {
-    const json = args.json;
-    const intro6 = (s) => {
-      if (!json) p16.intro(s);
-    };
-    const info2 = (s) => {
-      if (!json) p16.log.info(s);
-    };
-    intro6("Publishing to the DeepSpace library");
-    const appErr = parseAppArg(str(args.app)).error;
-    if (appErr) throw new Refusal(appErr, "invalid_app");
-    let appName = str(args.app)?.trim();
-    if (!appName) {
-      const appDir = resolve15(str(args.dir) ?? ".");
-      const wranglerPath = join20(appDir, "wrangler.toml");
-      if (!existsSync21(wranglerPath)) {
-        throw new Refusal(
-          "No --app provided and no wrangler.toml found. Either pass --app <name> or run from your app's directory.",
-          "not_in_app_repo"
-        );
-      }
-      const cfg = parseToml4(readFileSync22(wranglerPath, "utf-8"));
-      const nameRes = resolveAppName(cfg.name);
-      if (!nameRes.ok) throw new Refusal(`wrangler.toml: ${nameRes.reason}`, "invalid_config");
-      appName = nameRes.name;
-    }
-    info2(`App: ${appName}`);
-    const visibility = str(args.visibility) ?? "public";
-    if (!["public", "private", "unlisted"].includes(visibility)) {
-      throw new Refusal("--visibility must be 'public', 'unlisted', or 'private'.", "invalid_visibility");
-    }
-    const tags = str(args.tags) ? String(args.tags).split(",").map((t) => t.trim()).filter(Boolean) : void 0;
-    const libraryApp = str(args["library-app"]) ?? DEFAULT_LIBRARY_APP;
-    const libraryHost = process.env.DEEPSPACE_LIBRARY_HOST ?? `https://${libraryApp}.app.space`;
-    let token;
-    try {
-      token = await ensureToken();
-    } catch (err) {
-      throw new Refusal(err instanceof Error ? err.message : String(err), "not_authenticated", {
-        action: cliAction("deepspace", "auth", "login")
-      });
-    }
-    const payload = {
-      appName,
-      ...args.name ? { name: args.name } : {},
-      ...args.description ? { description: args.description } : {},
-      ...args.category ? { category: args.category } : {},
-      ...tags ? { tags } : {},
-      visibility,
-      ...args.screenshot ? { screenshotUrl: args.screenshot } : {}
-    };
-    const url = `${libraryHost}/api/actions/library.publish`;
-    let res;
-    try {
-      res = await fetch(url, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          Authorization: `Bearer ${token}`
-        },
-        body: JSON.stringify(payload)
-      });
-    } catch (err) {
-      throw new Refusal(
-        `Network error reaching ${url}: ${err instanceof Error ? err.message : String(err)}`,
-        "network_error"
-      );
-    }
-    const body = await res.text();
-    let parsed;
-    try {
-      parsed = JSON.parse(body);
-    } catch {
-      throw new Refusal(`Server returned non-JSON (${res.status}): ${body.slice(0, 400)}`, "invalid_response");
-    }
-    if (!parsed.success) {
-      throw new Refusal(parsed.error ?? `Publish failed (HTTP ${res.status}).`, "publish_failed");
-    }
-    if (!json) {
-      p16.log.success(`Published ${appName} as ${parsed.data?.templateHandle} (v${parsed.data?.version})`);
-      if (parsed.data?.url) p16.log.message(parsed.data.url);
-      p16.outro("Done");
-    }
-    return {
-      data: {
-        appName,
-        templateHandle: parsed.data?.templateHandle ?? null,
-        url: parsed.data?.url ?? null,
-        version: parsed.data?.version ?? null,
-        visibility
-      }
-    };
-  }
-});
-var unpublish = defineDeepspaceCommand({
-  meta: {
-    name: "unpublish",
-    description: "Remove a library entry (owner or admin only)"
-  },
-  args: {
-    handle: {
-      type: "positional",
-      description: "templateHandle to remove (usually your app name)",
-      required: true
-    },
-    "library-app": {
-      type: "string",
-      description: `Target library app subdomain (default: ${DEFAULT_LIBRARY_APP})`,
-      required: false
-    }
-  },
-  async run({ args }) {
-    const json = args.json;
-    if (!json) p16.intro("Unpublishing library entry");
-    let token;
-    try {
-      token = await ensureToken();
-    } catch (err) {
-      throw new Refusal(err instanceof Error ? err.message : String(err), "not_authenticated", {
-        action: cliAction("deepspace", "auth", "login")
-      });
-    }
-    const libraryApp = str(args["library-app"]) ?? DEFAULT_LIBRARY_APP;
-    const libraryHost = process.env.DEEPSPACE_LIBRARY_HOST ?? `https://${libraryApp}.app.space`;
-    const res = await fetch(`${libraryHost}/api/actions/library.unpublish`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
-      body: JSON.stringify({ templateHandle: String(args.handle) })
-    });
-    const body = await res.text();
-    let parsed;
-    try {
-      parsed = JSON.parse(body);
-    } catch {
-      throw new Refusal(`Server returned non-JSON (${res.status}): ${body.slice(0, 400)}`, "invalid_response");
-    }
-    if (!parsed.success) {
-      throw new Refusal(parsed.error ?? `HTTP ${res.status}`, "unpublish_failed");
-    }
-    if (!json) {
-      p16.log.success(`Unpublished ${parsed.data?.templateHandle}`);
-      p16.outro("Done");
-    }
-    return { data: { templateHandle: parsed.data?.templateHandle ?? String(args.handle) } };
-  }
-});
-var library_default = defineCommand9({
-  meta: {
-    name: "library",
-    description: "Manage your DeepSpace library entries"
-  },
-  subCommands: {
-    publish,
-    unpublish
-  }
-});
-
 // src/cli/commands/feedback.ts
-import * as p17 from "@clack/prompts";
-import { existsSync as existsSync22, readFileSync as readFileSync23 } from "fs";
-import { dirname as dirname8, join as join21 } from "path";
+import * as p16 from "@clack/prompts";
+import { existsSync as existsSync21, readFileSync as readFileSync23 } from "fs";
+import { dirname as dirname8, join as join20 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { release } from "os";
 var API_URL8 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
@@ -8677,11 +8545,11 @@ function readCliVersion() {
   try {
     const here = dirname8(fileURLToPath2(import.meta.url));
     const candidates = [
-      join21(here, "..", "package.json"),
-      join21(here, "..", "..", "..", "package.json")
+      join20(here, "..", "package.json"),
+      join20(here, "..", "..", "..", "package.json")
     ];
     for (const path of candidates) {
-      if (!existsSync22(path)) continue;
+      if (!existsSync21(path)) continue;
       const pkg2 = JSON.parse(readFileSync23(path, "utf-8"));
       if (pkg2.name === "deepspace" && pkg2.version) return pkg2.version;
     }
@@ -8775,21 +8643,21 @@ var feedback_default = defineDeepspaceCommand({
       );
     }
     if (interactive && (!args.type || !title || !body)) {
-      p17.intro("DeepSpace Feedback");
+      p16.intro("DeepSpace Feedback");
       if (!args.type) {
-        const picked = await p17.select({
+        const picked = await p16.select({
           message: "What kind of feedback is this?",
           options: TYPES.map((t) => ({ value: t, label: TYPE_LABELS[t] })),
           initialValue: type
         });
-        if (p17.isCancel(picked)) {
-          p17.cancel("Cancelled.");
+        if (p16.isCancel(picked)) {
+          p16.cancel("Cancelled.");
           return { data: { submitted: false, cancelled: true } };
         }
         type = picked;
       }
       if (!title) {
-        const t = await p17.text({
+        const t = await p16.text({
           message: "Title",
           placeholder: "Short summary of the issue",
           validate: (v) => {
@@ -8799,14 +8667,14 @@ var feedback_default = defineDeepspaceCommand({
             return void 0;
           }
         });
-        if (p17.isCancel(t)) {
-          p17.cancel("Cancelled.");
+        if (p16.isCancel(t)) {
+          p16.cancel("Cancelled.");
           return { data: { submitted: false, cancelled: true } };
         }
         title = String(t);
       }
       if (!body) {
-        const m = await p17.text({
+        const m = await p16.text({
           message: "Details",
           placeholder: "What happened? Steps to reproduce, what you expected\u2026",
           validate: (v) => {
@@ -8816,8 +8684,8 @@ var feedback_default = defineDeepspaceCommand({
             return void 0;
           }
         });
-        if (p17.isCancel(m)) {
-          p17.cancel("Cancelled.");
+        if (p16.isCancel(m)) {
+          p16.cancel("Cancelled.");
           return { data: { submitted: false, cancelled: true } };
         }
         body = String(m);
@@ -8835,7 +8703,7 @@ var feedback_default = defineDeepspaceCommand({
       throw new Refusal(err.message, "invalid_input");
     }
     if (interactive && !args.yes) {
-      p17.note(
+      p16.note(
         `${TYPE_LABELS[payload.type]}
 ${payload.title}
 
@@ -8844,9 +8712,9 @@ ${payload.body}
 Context: deepspace ${payload.cliVersion} \xB7 ${payload.nodeVersion} \xB7 ${payload.platform}` + (payload.appName ? ` \xB7 app ${payload.appName}` : ""),
         "Review"
       );
-      const ok2 = await p17.confirm({ message: "Send this to the DeepSpace team?" });
-      if (p17.isCancel(ok2) || !ok2) {
-        p17.cancel("Not sent.");
+      const ok2 = await p16.confirm({ message: "Send this to the DeepSpace team?" });
+      if (p16.isCancel(ok2) || !ok2) {
+        p16.cancel("Not sent.");
         return { data: { submitted: false, cancelled: true } };
       }
     }
@@ -8866,7 +8734,7 @@ Context: deepspace ${payload.cliVersion} \xB7 ${payload.nodeVersion} \xB7 ${payl
     });
     if (!args.json) {
       if (interactive) {
-        p17.outro(`Thanks! Submitted as ${result.report.id}.`);
+        p16.outro(`Thanks! Submitted as ${result.report.id}.`);
       } else {
         console.log(`Submitted feedback ${result.report.id} (${result.report.type}).`);
       }
@@ -8877,7 +8745,7 @@ Context: deepspace ${payload.cliVersion} \xB7 ${payload.nodeVersion} \xB7 ${payl
 });
 
 // src/cli/commands/secrets.ts
-import { defineCommand as defineCommand10 } from "citty";
+import { defineCommand as defineCommand9 } from "citty";
 import { readFileSync as readFileSync24 } from "fs";
 
 // src/cli/lib/citty-args.ts
@@ -8981,7 +8849,7 @@ function warnIfDebugRoutesEnabled(secrets) {
 }
 var APPLY_HINT = "Run `deepspace deploy` to apply \u2014 secrets take effect at deploy time.";
 var LOCAL_DEV_HINT = "Running `deepspace dev start`? Restart it to load the change locally.";
-var list5 = defineCommand10({
+var list5 = defineCommand9({
   meta: { name: "list", description: "List masked secrets in a config" },
   args: {
     ...COMMON_ARGS,
@@ -9011,7 +8879,7 @@ var list5 = defineCommand10({
     }
   }
 });
-var set = defineCommand10({
+var set = defineCommand9({
   meta: { name: "set", description: "Set secrets from KEY=value pairs" },
   args: {
     ...COMMON_ARGS,
@@ -9060,7 +8928,7 @@ var set = defineCommand10({
     }
   }
 });
-var get = defineCommand10({
+var get = defineCommand9({
   meta: { name: "get", description: "Get a secret; pass --plain to print the value" },
   args: {
     ...COMMON_ARGS,
@@ -9096,7 +8964,7 @@ var get = defineCommand10({
     }
   }
 });
-var del2 = defineCommand10({
+var del2 = defineCommand9({
   meta: { name: "delete", description: "Delete one or more secrets" },
   args: {
     ...COMMON_ARGS,
@@ -9130,7 +8998,7 @@ var del2 = defineCommand10({
     }
   }
 });
-var upload = defineCommand10({
+var upload = defineCommand9({
   meta: { name: "upload", description: "Upload secrets from a dotenv or JSON file" },
   args: {
     ...COMMON_ARGS,
@@ -9167,7 +9035,7 @@ var upload = defineCommand10({
     }
   }
 });
-var download = defineCommand10({
+var download = defineCommand9({
   meta: { name: "download", description: "Download a config\u2019s secrets (dotenv/json/shell)" },
   args: {
     ...COMMON_ARGS,
@@ -9196,7 +9064,7 @@ var download = defineCommand10({
     }
   }
 });
-var pull = defineCommand10({
+var pull = defineCommand9({
   meta: { name: "pull", description: "Refresh the .dev.vars cache from the app store" },
   args: { ...COMMON_ARGS },
   async run({ args }) {
@@ -9239,7 +9107,7 @@ var pull = defineCommand10({
     }
   }
 });
-var configsList = defineCommand10({
+var configsList = defineCommand9({
   meta: { name: "list", description: "List the app\u2019s configs" },
   args: { ...COMMON_ARGS },
   async run({ args }) {
@@ -9260,7 +9128,7 @@ var configsList = defineCommand10({
     }
   }
 });
-var configsCreate = defineCommand10({
+var configsCreate = defineCommand9({
   meta: { name: "create", description: "Create a config (optionally copying another)" },
   args: {
     ...COMMON_ARGS,
@@ -9300,7 +9168,7 @@ var configsCreate = defineCommand10({
     }
   }
 });
-var configsDelete = defineCommand10({
+var configsDelete = defineCommand9({
   meta: { name: "delete", description: "Delete a config and all of its secrets" },
   args: {
     ...COMMON_ARGS,
@@ -9321,11 +9189,11 @@ var configsDelete = defineCommand10({
     }
   }
 });
-var configs = defineCommand10({
+var configs = defineCommand9({
   meta: { name: "configs", description: "Manage the app\u2019s secrets configs" },
   subCommands: { list: configsList, create: configsCreate, delete: configsDelete }
 });
-var secrets_default = defineCommand10({
+var secrets_default = defineCommand9({
   meta: { name: "secrets", description: "Manage the app\u2019s secrets store" },
   subCommands: {
     list: list5,
@@ -9402,9 +9270,9 @@ var init_default = defineDeepspaceCommand({
 });
 
 // src/cli/commands/status.ts
-import { defineCommand as defineCommand11 } from "citty";
-import * as p18 from "@clack/prompts";
-import { existsSync as existsSync23, readFileSync as readFileSync25 } from "fs";
+import { defineCommand as defineCommand10 } from "citty";
+import * as p17 from "@clack/prompts";
+import { existsSync as existsSync22, readFileSync as readFileSync25 } from "fs";
 function timeAgo(iso) {
   const ms = Date.now() - Date.parse(iso);
   if (!Number.isFinite(ms) || ms < 0) return iso;
@@ -9437,7 +9305,7 @@ function resolveStatusApp(appDir, wranglerEnv) {
   if (!resolved.ok) throw new InputError(resolved.reason, "invalid_env");
   return { appName: resolved.name, appId: readAppId(appDir, wranglerEnv) };
 }
-var status_default = defineCommand11({
+var status_default = defineCommand10({
   meta: {
     name: "status",
     description: "One screenful of current state: session, app, workspace, and live release"
@@ -9489,7 +9357,7 @@ var status_default = defineCommand11({
       json.services = urls;
       if (urlOverrides.length > 0) json.urlOverrides = urlOverrides;
     }
-    facts.loggedIn = existsSync23(SESSION_PATH);
+    facts.loggedIn = existsSync22(SESSION_PATH);
     let userId = null;
     if (!facts.loggedIn) {
       lines.push(["Session", "not logged in"]);
@@ -9670,12 +9538,12 @@ var status_default = defineCommand11({
       return;
     }
     const width = Math.max(...lines.map(([k]) => k.length));
-    for (const [k, v] of lines) p18.log.message(`${k.padEnd(width)}  ${v}`);
+    for (const [k, v] of lines) p17.log.message(`${k.padEnd(width)}  ${v}`);
   }
 });
 
 // src/cli/commands/push.ts
-import * as p19 from "@clack/prompts";
+import * as p18 from "@clack/prompts";
 function pullRecoveryAction(cwd, appId, branch) {
   return {
     cwd,
@@ -9859,7 +9727,7 @@ var push_default = defineDeepspaceCommand({
       const recoverable = isRecoverablePushFailure(result.status);
       const rejectReason = result.reason ?? result.summary;
       const errorMsg = ok2 ? null : result.status === "ref_conflict" ? `The cloud repo's ${branch} moved while you worked (${rejectReason}). Run \`deepspace pull --app ${shQuote(appId)} --branch ${shQuote(branch)}\` to integrate, then push again.` : result.status === "rejected" ? `The cloud repo rejected ${branch}: ${rejectReason}.` + (OVERSIZED_PUSH_RE.test(rejectReason) ? ` ${oversizedPushFix(appDir)}` : "") : `The cloud repo's ${branch} has commit(s) your local ${branch} doesn't. Run \`deepspace pull --app ${shQuote(appId)} --branch ${shQuote(branch)}\` and merge (or rebase), then push. Avoid --force here \u2014 it's guarded and will refuse rather than silently drop a peer's commits.`;
-      if (!args.json && ok2) p19.log.info(`App: ${appId}`);
+      if (!args.json && ok2) p18.log.info(`App: ${appId}`);
       const action = recoverable ? pullRecoveryAction(pullRecoveryCwd, appId, branch) : void 0;
       if (!ok2) {
         throw new Refusal(errorMsg ?? `Push did not complete.`, result.status, {
@@ -9881,7 +9749,7 @@ var push_default = defineDeepspaceCommand({
 });
 
 // src/cli/commands/pull.ts
-import * as p20 from "@clack/prompts";
+import * as p19 from "@clack/prompts";
 import { realpathSync as realpathSync4 } from "fs";
 function targetedVcAction(command, cwd, appId, branch) {
   return {
@@ -10143,7 +10011,7 @@ var pull_default = defineDeepspaceCommand({
     }
     const actionRequired = recoveryAction !== void 0;
     spinner2?.stop(codeForState ? `Fetched ${SPACE_REMOTE}/${branch}.` : line);
-    if (!args.json) p20.log.info(`App: ${appId} \xB7 ${SPACE_REMOTE}/${branch} at ${remoteOid.slice(0, 10)}`);
+    if (!args.json) p19.log.info(`App: ${appId} \xB7 ${SPACE_REMOTE}/${branch} at ${remoteOid.slice(0, 10)}`);
     if (codeForState) {
       throw new Refusal(line, codeForState, {
         actionRequired,
@@ -10162,19 +10030,19 @@ var pull_default = defineDeepspaceCommand({
 });
 
 // src/cli/commands/clone.ts
-import * as p21 from "@clack/prompts";
-import { existsSync as existsSync24, readdirSync as readdirSync6, rmSync as rmSync5 } from "fs";
-import { resolve as resolve16, basename as basename3, join as join22 } from "path";
+import * as p20 from "@clack/prompts";
+import { existsSync as existsSync23, readdirSync as readdirSync6, rmSync as rmSync5 } from "fs";
+import { resolve as resolve15, basename as basename3, join as join21 } from "path";
 function cleanFailedCloneDir(dir) {
   let entries;
   try {
     entries = readdirSync6(dir);
   } catch {
-    return existsSync24(dir) ? ["<unreadable>"] : [];
+    return existsSync23(dir) ? ["<unreadable>"] : [];
   }
   if (entries.length === 1 && entries[0] === ".git") {
     try {
-      rmSync5(join22(dir, ".git"), { recursive: true, force: true });
+      rmSync5(join21(dir, ".git"), { recursive: true, force: true });
       return [];
     } catch {
       return entries;
@@ -10183,7 +10051,7 @@ function cleanFailedCloneDir(dir) {
   return entries;
 }
 function validateCloneTarget(dir) {
-  if (!existsSync24(dir)) return false;
+  if (!existsSync23(dir)) return false;
   let entries;
   try {
     entries = readdirSync6(dir);
@@ -10218,7 +10086,7 @@ var clone_default = defineDeepspaceCommand({
   async run({ args }) {
     assertAppTargetResolvable(String(args.app));
     const selector = String(args.app).trim();
-    const dir = resolve16(String(args.dir ?? selector));
+    const dir = resolve15(String(args.dir ?? selector));
     const dirPreexisted = validateCloneTarget(dir);
     const spinner2 = args.json ? null : createSpinner();
     spinner2?.start(`Resolving ${selector}\u2026`);
@@ -10264,7 +10132,7 @@ var clone_default = defineDeepspaceCommand({
       `Cloned ${selector} (${branches.length} ${branches.length === 1 ? "branch" : "branches"}) into ${basename3(dir)}/ at ${head?.slice(0, 10) ?? "(unborn)"}.`
     );
     if (!args.json && !branch) {
-      p21.log.warn("HEAD is detached \u2014 check `git branch -a`.");
+      p20.log.warn("HEAD is detached \u2014 check `git branch -a`.");
     }
     return {
       data: {
@@ -10283,7 +10151,7 @@ var clone_default = defineDeepspaceCommand({
 });
 
 // src/cli/commands/releases.ts
-import * as p22 from "@clack/prompts";
+import * as p21 from "@clack/prompts";
 var DEPLOY_URL11 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 var releases_default = defineDeepspaceCommand({
   meta: {
@@ -10324,7 +10192,7 @@ var releases_default = defineDeepspaceCommand({
     spinner2?.stop(`Loaded ${releases.length} ${releases.length === 1 ? "release" : "releases"}.`);
     if (!args.json) {
       if (releases.length === 0) {
-        p22.log.info("No releases yet \u2014 the history starts with the next `deepspace deploy`.");
+        p21.log.info("No releases yet \u2014 the history starts with the next `deepspace deploy`.");
       } else {
         for (const r of releases) {
           const source = r.commitOid ? `commit ${r.commitOid.slice(0, 10)}` : "(no source recorded)";
@@ -10333,7 +10201,7 @@ var releases_default = defineDeepspaceCommand({
             `#${r.seq}  ${r.id}  ${r.kind.padEnd(8)}  ${r.createdAt}  ${r.actor}  ${source}  ${rollback}`
           );
         }
-        p22.log.info(
+        p21.log.info(
           `Roll back an available release with: deepspace rollback <release-id>${wranglerEnv ? ` --env ${wranglerEnv}` : ""}`
         );
       }
@@ -10343,7 +10211,7 @@ var releases_default = defineDeepspaceCommand({
 });
 
 // src/cli/commands/rollback.ts
-import * as p23 from "@clack/prompts";
+import * as p22 from "@clack/prompts";
 var REL_ID_RE = /^rel_[0-9A-HJKMNP-TV-Z]{26}$/;
 function unavailableDoGuardRefusal(message) {
   return new Refusal(
@@ -10456,18 +10324,18 @@ Re-run with --allow-do-deletion to accept the data loss.`,
     spinner2?.stop(`Rolled back to ${result.rolledBackTo ?? releaseId}.`);
     const doClassGuard = result.doClassGuard === "unverified" ? "unverified" : void 0;
     if (!args.json) {
-      if (result.url) p23.log.success(`Live at: ${result.url}`);
+      if (result.url) p22.log.success(`Live at: ${result.url}`);
       if (result.bundleRetained === false) {
-        p23.log.warn(
+        p22.log.warn(
           "The rollback is live, but its bundle was concurrently retired and is not available for a future rollback."
         );
       }
       if (doClassGuard === "unverified") {
-        p23.log.warn(
+        p22.log.warn(
           "DO-class guard bypassed (--allow-do-deletion): this rollback was NOT checked against the live Durable Object classes \u2014 any class the target doesn't declare has been deleted with its data."
         );
       }
-      p23.log.info(
+      p22.log.info(
         "This rollback is itself the newest release \u2014 `deepspace releases` shows the full history."
       );
     }
@@ -10487,14 +10355,14 @@ Re-run with --allow-do-deletion to accept the data loss.`,
 });
 
 // src/cli/commands/workspace.ts
-import { defineCommand as defineCommand12 } from "citty";
+import { defineCommand as defineCommand11 } from "citty";
 
 // src/cli/commands/workspace/new.ts
-import * as p26 from "@clack/prompts";
-import { isAbsolute as isAbsolute6, resolve as resolve17 } from "path";
+import * as p25 from "@clack/prompts";
+import { isAbsolute as isAbsolute6, resolve as resolve16 } from "path";
 
 // src/cli/commands/workspace/analysis.ts
-import * as p24 from "@clack/prompts";
+import * as p23 from "@clack/prompts";
 var MAX_OVERLAP_PATHS = 20;
 var PEER_REF_PREFIX = `${spacePrivateRef("peers")}/`;
 function peerWorkspaceRef(workspaceId) {
@@ -10608,16 +10476,16 @@ function printOverlaps(overlaps, json) {
   for (const overlap of overlaps) {
     const sample = overlap.paths.slice(0, 5).join(", ");
     const more = overlap.paths.length - 5 + overlap.morePaths;
-    p24.log.warn(
+    p23.log.warn(
       `Overlap: ${overlap.workspaceId} ("${overlap.task}") also modified ${sample}${more > 0 ? ` (+${more} more)` : ""} \u2014 coordinate before landing.`
     );
   }
 }
 
 // src/cli/commands/workspace/local.ts
-import * as p25 from "@clack/prompts";
+import * as p24 from "@clack/prompts";
 import { mkdirSync as mkdirSync7, readFileSync as readFileSync26, realpathSync as realpathSync5, renameSync as renameSync2, statSync, writeFileSync as writeFileSync9 } from "fs";
-import { dirname as dirname9, isAbsolute as isAbsolute5, join as join23, relative as relative2, sep as sep2 } from "path";
+import { dirname as dirname9, isAbsolute as isAbsolute5, join as join22, relative as relative2, sep as sep2 } from "path";
 var WORKSPACE_MARKER = "deepspace-workspace.json";
 function excludeWorktreeDir(appDir, dir) {
   try {
@@ -10638,7 +10506,7 @@ function worktreeMarkerPath(worktreeRoot) {
     const result = runGit(worktreeRoot, ["rev-parse", "--absolute-git-dir"], { allowFail: true });
     if (result.status !== 0) return null;
     const gitDir = result.stdout.toString("utf-8").trim();
-    return isAbsolute5(gitDir) ? join23(gitDir, WORKSPACE_MARKER) : null;
+    return isAbsolute5(gitDir) ? join22(gitDir, WORKSPACE_MARKER) : null;
   } catch {
     return null;
   }
@@ -10683,11 +10551,11 @@ function isManagedWorkspaceWorktree(worktreeRoot, workspaceId) {
 function defaultWorkspaceRoot(appDir, workspaceId) {
   const primary = listWorktrees(appDir)[0];
   if (!primary) throw new Error("Git did not report a primary worktree");
-  return join23(primary.path, ".deepspace", "ws", workspaceId.slice(3).toLowerCase());
+  return join22(primary.path, ".deepspace", "ws", workspaceId.slice(3).toLowerCase());
 }
 function appDirInWorktree(appDir, worktreeRoot) {
   const appRelative = relative2(realpathSync5(repoToplevel(appDir)), realpathSync5(appDir));
-  return appRelative ? join23(worktreeRoot, appRelative) : worktreeRoot;
+  return appRelative ? join22(worktreeRoot, appRelative) : worktreeRoot;
 }
 function materializeWorkspaceWorktree(appDir, worktreeRoot, branch, startPoint, workspaceId, options = {}) {
   const createdOid = resolveCommit(appDir, startPoint);
@@ -10705,7 +10573,7 @@ function materializeWorkspaceWorktree(appDir, worktreeRoot, branch, startPoint,
 function inOwnLinkedWorktree(appDir, id) {
   if (workspaceIdFromBranch(currentBranch(appDir)) !== id) return false;
   try {
-    return statSync(join23(repoToplevel(appDir), ".git")).isFile();
+    return statSync(join22(repoToplevel(appDir), ".git")).isFile();
   } catch {
     return false;
   }
@@ -10851,7 +10719,7 @@ function cleanupAction(outcome) {
 }
 function reportCleanupHuman(outcome) {
   if (outcome.error) {
-    p25.log.warn(
+    p24.log.warn(
       cleanupRefusalMessage({
         error: outcome.error,
         worktreeDir: outcome.worktreeDir,
@@ -10864,12 +10732,12 @@ function reportCleanupHuman(outcome) {
     outcome.worktreeRemoved ? "worktree" : null,
     outcome.branchDeleted ? `branch ${outcome.branch}` : null
   ].filter(Boolean);
-  if (parts.length) p25.log.success(`Removed ${parts.join(" + ")}.`);
+  if (parts.length) p24.log.success(`Removed ${parts.join(" + ")}.`);
   if (outcome.worktreeRetained) {
-    p25.log.info(`Retained externally managed worktree: ${outcome.worktreeRetained}`);
+    p24.log.info(`Retained externally managed worktree: ${outcome.worktreeRetained}`);
   }
   if (outcome.worktreeRemoved && outcome.mainDir) {
-    p25.log.info(`This directory was removed \u2014 run: cd ${shQuote(outcome.mainDir)}`);
+    p24.log.info(`This directory was removed \u2014 run: cd ${shQuote(outcome.mainDir)}`);
   }
 }
 
@@ -11051,7 +10919,7 @@ var newWorkspaceCommand = defineDeepspaceCommand({
       idempotencyKey: mintIdempotencyKey()
     });
     const dirInput = typeof args.dir === "string" ? args.dir.trim() : "";
-    const worktreeRoot = dirInput ? isAbsolute6(dirInput) ? dirInput : resolve17(appDir, dirInput) : defaultWorkspaceRoot(appDir, id);
+    const worktreeRoot = dirInput ? isAbsolute6(dirInput) ? dirInput : resolve16(appDir, dirInput) : defaultWorkspaceRoot(appDir, id);
     const dir = appDirInWorktree(appDir, worktreeRoot);
     try {
       materializeWorkspaceWorktree(appDir, worktreeRoot, branch, baseOid, id);
@@ -11066,8 +10934,8 @@ var newWorkspaceCommand = defineDeepspaceCommand({
     }
     spinner2?.stop(`Workspace ${id} created.`);
     if (!args.json) {
-      p26.log.info(`Work in: cd ${dir}`);
-      p26.log.info(
+      p25.log.info(`Work in: cd ${dir}`);
+      p25.log.info(
         `Then: commit as usual, \`deepspace workspace sync\` to publish, \`deepspace workspace land\` when done.`
       );
     }
@@ -11088,9 +10956,9 @@ var newWorkspaceCommand = defineDeepspaceCommand({
 });
 
 // src/cli/commands/workspace/attach.ts
-import * as p27 from "@clack/prompts";
-import { existsSync as existsSync25, readdirSync as readdirSync7, rmSync as rmSync6 } from "fs";
-import { isAbsolute as isAbsolute7, resolve as resolve18 } from "path";
+import * as p26 from "@clack/prompts";
+import { existsSync as existsSync24, readdirSync as readdirSync7, rmSync as rmSync6 } from "fs";
+import { isAbsolute as isAbsolute7, resolve as resolve17 } from "path";
 function finishedWorkspaceMessage(id, view) {
   const workspace = view.workspace;
   if (workspace.status === "landed") {
@@ -11099,7 +10967,7 @@ function finishedWorkspaceMessage(id, view) {
   return `Workspace ${id} is ${workspace.status} \u2014 its ref is retained briefly (fetch ${workspace.ref} to inspect), but attach only works on active workspaces.`;
 }
 function cleanFailedFreshAttachDir(dir) {
-  if (!existsSync25(dir)) return [];
+  if (!existsSync24(dir)) return [];
   let entries;
   try {
     entries = readdirSync7(dir);
@@ -11175,7 +11043,7 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
         );
       }
       const requestedDir = typeof args.dir === "string" ? args.dir.trim() : "";
-      const worktreeRoot = requestedDir ? isAbsolute7(requestedDir) ? requestedDir : resolve18(appDir, requestedDir) : defaultWorkspaceRoot(appDir, id);
+      const worktreeRoot = requestedDir ? isAbsolute7(requestedDir) ? requestedDir : resolve17(appDir, requestedDir) : defaultWorkspaceRoot(appDir, id);
       const dir2 = appDirInWorktree(appDir, worktreeRoot);
       if (resolveCommit(appDir, `refs/heads/${branch}`)) {
         throw new Refusal(
@@ -11186,8 +11054,8 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
       materializeWorkspaceWorktree(appDir, worktreeRoot, branch, tip2, id);
       spinner2?.stop(`Attached ${id}.`);
       if (!args.json) {
-        p27.log.info(`Task: ${view2.workspace.task}`);
-        p27.log.info(`Work in: cd ${dir2}`);
+        p26.log.info(`Task: ${view2.workspace.task}`);
+        p26.log.info(`Work in: cd ${dir2}`);
       }
       const action2 = { cwd: dir2, argv: [detectPackageManager(dir2), "install"] };
       return {
@@ -11214,11 +11082,11 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
         extra: { status: view.workspace.status }
       });
     }
-    const dir = resolve18(
+    const dir = resolve17(
       process.cwd(),
       (typeof args.dir === "string" ? args.dir.trim() : "") || `ws-${id.slice(3).toLowerCase()}`
     );
-    if (existsSync25(dir)) {
+    if (existsSync24(dir)) {
       spinner2?.stop("Target exists.");
       throw new Refusal(`${dir} already exists \u2014 pass a different directory.`, "dir_exists");
     }
@@ -11259,8 +11127,8 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
     spinner2?.stop(`Attached ${id}.`);
     const action = { cwd: dir, argv: [detectPackageManager(dir), "install"] };
     if (!args.json) {
-      p27.log.info(`Task: ${view.workspace.task}`);
-      p27.log.info("Pull app secrets after install if this workspace needs them.");
+      p26.log.info(`Task: ${view.workspace.task}`);
+      p26.log.info("Pull app secrets after install if this workspace needs them.");
     }
     return {
       data: {
@@ -11277,7 +11145,7 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
 });
 
 // src/cli/commands/workspace/sync.ts
-import * as p28 from "@clack/prompts";
+import * as p27 from "@clack/prompts";
 var syncWorkspaceCommand = defineDeepspaceCommand({
   meta: {
     name: "sync",
@@ -11338,12 +11206,12 @@ var syncWorkspaceCommand = defineDeepspaceCommand({
     );
     printOverlaps(overlaps, args.json);
     if (!args.json && trunkOverlap.length > 0) {
-      p28.log.warn(
+      p27.log.warn(
         `Trunk already changed ${trunkOverlap.length} file(s) you also touch \u2014 landed work you haven't merged: ${trunkOverlap.slice(0, 5).join(", ")}${trunkOverlap.length > 5 ? ` (+${trunkOverlap.length - 5} more)` : ""}. Merge trunk before landing (\`deepspace workspace status\` shows the full picture).`
       );
     }
     if (!args.json && dirty.length > 0) {
-      p28.log.warn(
+      p27.log.warn(
         `${dirty.length} uncommitted ${dirty.length === 1 ? "file" : "files"} NOT synced \u2014 commit them to this workspace branch (WIP commits are fine \u2014 they land with the merge).`
       );
     }
@@ -11363,7 +11231,7 @@ var syncWorkspaceCommand = defineDeepspaceCommand({
 });
 
 // src/cli/commands/workspace/list.ts
-import * as p29 from "@clack/prompts";
+import * as p28 from "@clack/prompts";
 
 // src/cli/lib/actor-labels.ts
 var API_URL9 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
@@ -11411,7 +11279,7 @@ var listWorkspacesCommand = defineDeepspaceCommand({
     if (views.length === 0) {
       spinner2?.stop("No workspaces found.");
       if (!args.json) {
-        p29.log.info(
+        p28.log.info(
           all ? "No workspaces." : 'No active workspaces. Create one with `deepspace workspace new -t "\u2026"`.'
         );
       }
@@ -11440,13 +11308,13 @@ var listWorkspacesCommand = defineDeepspaceCommand({
         );
       }
     }
-    p29.log.info("\u2191 commits ahead of base \xB7 \u2193 trunk commits since base (staleness)");
+    p28.log.info("\u2191 commits ahead of base \xB7 \u2193 trunk commits since base (staleness)");
     return { data: { workspaces } };
   }
 });
 
 // src/cli/commands/workspace/status.ts
-import * as p30 from "@clack/prompts";
+import * as p29 from "@clack/prompts";
 var workspaceStatusCommand = defineDeepspaceCommand({
   meta: { name: "status", description: "This workspace: base staleness, overlaps, sync state" },
   args: {
@@ -11506,22 +11374,22 @@ var workspaceStatusCommand = defineDeepspaceCommand({
       overlaps
     };
     if (!args.json) {
-      p30.log.info(`Task: ${workspace.task}`);
-      p30.log.info(
+      p29.log.info(`Task: ${workspace.task}`);
+      p29.log.info(
         `Base: ${workspace.baseOid.slice(0, 10)} \xB7 ahead ${aheadExact ?? "?"} commit(s) \xB7 trunk moved ${behindExact ?? "?"} commit(s) since your base`
       );
       if (!attached) {
-        p30.log.info(
+        p29.log.info(
           `Not checked out in this clone \u2014 showing the published state (local HEAD/uncommitted unavailable). Attach it with \`deepspace workspace attach ${id} <dir>\`.`
         );
       }
       if (unsynced)
-        p30.log.warn(
+        p29.log.warn(
           `Local HEAD ${headOid?.slice(0, 10)} is not synced (server has ${view.tipOid?.slice(0, 10) ?? "nothing"}) \u2014 run \`deepspace workspace sync\`.`
         );
-      if (dirty.length > 0) p30.log.warn(`${dirty.length} uncommitted file(s) in the worktree.`);
+      if (dirty.length > 0) p29.log.warn(`${dirty.length} uncommitted file(s) in the worktree.`);
       if (trunkOverlap.length > 0) {
-        p30.log.warn(
+        p29.log.warn(
           `Trunk also modified: ${trunkOverlap.slice(0, 5).join(", ")}${trunkOverlap.length > 5 ? ` (+${trunkOverlap.length - 5} more)` : ""} \u2014 expect merge attention at land time.`
         );
       }
@@ -11532,17 +11400,17 @@ var workspaceStatusCommand = defineDeepspaceCommand({
 });
 
 // src/cli/commands/workspace/land.ts
-import * as p31 from "@clack/prompts";
+import * as p30 from "@clack/prompts";
 
 // src/cli/lib/validation.ts
 import { sync as spawnSync7 } from "cross-spawn";
 import { readFileSync as readFileSync27 } from "fs";
-import { join as join24 } from "path";
+import { join as join23 } from "path";
 var MAX_SUMMARY_CHARS = 4e3;
 var MAX_OUTPUT_BUFFER = 64 * 1024 * 1024;
 function configuredCommand(appDir) {
   try {
-    const pkg2 = JSON.parse(readFileSync27(join24(appDir, "package.json"), "utf-8"));
+    const pkg2 = JSON.parse(readFileSync27(join23(appDir, "package.json"), "utf-8"));
     if (pkg2.scripts?.validate) return `${detectPackageManager(appDir)} run --silent validate`;
   } catch {
   }
@@ -11818,7 +11686,7 @@ var landWorkspaceCommand = defineDeepspaceCommand({
     if (!args.json && cleanup && !cleanup.error) {
       reportCleanupHuman(cleanup);
     } else if (!args.json && retainedWorktree) {
-      p31.log.info(`Retained checkout: ${retainedWorktree}`);
+      p30.log.info(`Retained checkout: ${retainedWorktree}`);
     }
     if (cleanup?.error) {
       const action = cleanupAction({
@@ -11840,7 +11708,7 @@ var landWorkspaceCommand = defineDeepspaceCommand({
 });
 
 // src/cli/commands/workspace/drop.ts
-import * as p32 from "@clack/prompts";
+import * as p31 from "@clack/prompts";
 function isWorkspaceTipPublished(appDir, localTip, publishedOids) {
   return publishedOids.some(
     (publishedOid) => publishedOid === localTip || isAncestor(appDir, localTip, publishedOid)
@@ -11849,9 +11717,9 @@ function isWorkspaceTipPublished(appDir, localTip, publishedOids) {
 function workspaceUnsyncedRefusal(args) {
   const syncArgv = ["deepspace", "workspace", "sync", "--app", args.appId, "--workspace", args.id];
   const dropArgv = ["deepspace", "workspace", "drop", args.id, "--app", args.appId];
-  const publish2 = args.workspaceDir ? `Publish them first with \`${humanCommand(syncArgv)}\`, then re-run \`${humanCommand(dropArgv)}\`.` : `Recreate a worktree from the branch (\`git worktree add <dir> ${args.branch}\`), publish from there with \`${humanCommand(syncArgv)}\`, then re-run \`${humanCommand(dropArgv)}\`.`;
+  const publish = args.workspaceDir ? `Publish them first with \`${humanCommand(syncArgv)}\`, then re-run \`${humanCommand(dropArgv)}\`.` : `Recreate a worktree from the branch (\`git worktree add <dir> ${args.branch}\`), publish from there with \`${humanCommand(syncArgv)}\`, then re-run \`${humanCommand(dropArgv)}\`.`;
   return new Refusal(
-    `${args.id} has committed work that isn't published yet. ${publish2} Alternatively, pass \`--keep-worktree\` to drop the cloud workspace while retaining the local branch/worktree for manual disposal. Nothing was dropped.`,
+    `${args.id} has committed work that isn't published yet. ${publish} Alternatively, pass \`--keep-worktree\` to drop the cloud workspace while retaining the local branch/worktree for manual disposal. Nothing was dropped.`,
     "workspace_unsynced",
     {
       ...args.workspaceDir ? { action: { cwd: args.workspaceDir, argv: syncArgv } } : {},
@@ -11886,7 +11754,7 @@ var dropWorkspaceCommand = defineDeepspaceCommand({
       const { view: view2 } = await api5.dropWorkspace(explicitId);
       spinner2?.stop();
       if (!args.json) {
-        p32.log.success(
+        p31.log.success(
           `Dropped ${explicitId}. Its ref sticks around briefly for undo, then is reaped.`
         );
       }
@@ -11938,9 +11806,9 @@ var dropWorkspaceCommand = defineDeepspaceCommand({
     };
     spinner2?.stop();
     if (!args.json) {
-      p32.log.success(`Dropped ${id}. Its ref sticks around briefly for undo, then is reaped.`);
+      p31.log.success(`Dropped ${id}. Its ref sticks around briefly for undo, then is reaped.`);
       if (cleanup && !cleanup.error) reportCleanupHuman(cleanup);
-      else if (retainedWorktree) p32.log.info(`Retained checkout: ${retainedWorktree}`);
+      else if (retainedWorktree) p31.log.info(`Retained checkout: ${retainedWorktree}`);
     }
     if (cleanup?.error) {
       const action = cleanupAction({
@@ -11962,7 +11830,7 @@ var dropWorkspaceCommand = defineDeepspaceCommand({
 });
 
 // src/cli/commands/workspace.ts
-var workspace_default = defineCommand12({
+var workspace_default = defineCommand11({
   meta: {
     name: "workspace",
     description: "Durable parallel-agent workspaces (new/attach/sync/list/status/land/drop)"
@@ -11979,7 +11847,7 @@ var workspace_default = defineCommand12({
 });
 
 // src/cli/commands/activity.ts
-import * as p33 from "@clack/prompts";
+import * as p32 from "@clack/prompts";
 var FOLLOW_INTERVAL_MS = 5e3;
 function landIndex(events) {
   const m = /* @__PURE__ */ new Map();
@@ -12092,7 +11960,7 @@ var activity_default = defineDeepspaceCommand({
           const lands = landIndex(page.events);
           for (const e of page.events) console.log(formatEvent2(e, lands, actors));
           if (page.events.length === 0 && !args.follow) {
-            p33.log.info(cursor > 0 ? `No activity after #${cursor}.` : "No activity yet.");
+            p32.log.info(cursor > 0 ? `No activity after #${cursor}.` : "No activity yet.");
           }
         }
         cursor = page.cursor;
@@ -12102,7 +11970,7 @@ var activity_default = defineDeepspaceCommand({
         }
         if (!args.follow) {
           if (page.events.length > 0) {
-            p33.log.info(
+            p32.log.info(
               `Cursor: ${cursor}` + (page.hasMore ? ` \xB7 more available (next page: --since ${cursor})` : ` (resume later with --since ${cursor})`)
             );
           }
@@ -12124,7 +11992,7 @@ var activity_default = defineDeepspaceCommand({
             })
           );
         } else {
-          p33.log.warn(`Activity feed interrupted (${code}); retrying in 5s.`);
+          p32.log.warn(`Activity feed interrupted (${code}); retrying in 5s.`);
         }
       }
       await new Promise((resolveSleep) => setTimeout(resolveSleep, FOLLOW_INTERVAL_MS));
@@ -12133,7 +12001,7 @@ var activity_default = defineDeepspaceCommand({
 });
 
 // src/cli/commands/git-credential.ts
-import { defineCommand as defineCommand13 } from "citty";
+import { defineCommand as defineCommand12 } from "citty";
 function parseFields(input) {
   const fields = /* @__PURE__ */ new Map();
   for (const line of input.split("\n")) {
@@ -12182,7 +12050,7 @@ async function readStdin() {
   for await (const chunk of process.stdin) data += chunk;
   return data;
 }
-var git_credential_default = defineCommand13({
+var git_credential_default = defineCommand12({
   meta: {
     name: "git-credential",
     description: "Git credential helper (installed automatically; not for direct use)"
@@ -12217,7 +12085,7 @@ var git_credential_default = defineCommand13({
 });
 
 // src/cli/commands/source.ts
-import * as p34 from "@clack/prompts";
+import * as p33 from "@clack/prompts";
 var TRANSFER_PREFIX = spacePrivateRef("source-transfer");
 var source_default = defineDeepspaceCommand({
   meta: {
@@ -12270,7 +12138,7 @@ var source_default = defineDeepspaceCommand({
     const remoteArg = typeof args.remote === "string" ? args.remote.trim() : void 0;
     const result = requested === "github" ? await moveToGitHub({ appDir, appId, token, deployUrl, state, remoteArg }) : await moveToDeepSpace({ appDir, appId, token, deployUrl, state, remoteArg });
     if (!args.json) {
-      p34.log.success(
+      p33.log.success(
         result.source.provider === "github" ? `Source: GitHub \xB7 ${result.source.repository} (revision ${result.revision})` : `Source: DeepSpace (revision ${result.revision})`
       );
     }
@@ -13036,11 +12904,11 @@ function reportMigration(migration, json) {
 
 // src/cli/cli.ts
 var __dirname = dirname10(fileURLToPath3(import.meta.url));
-var pkg = JSON.parse(readFileSync28(join25(__dirname, "..", "package.json"), "utf-8"));
-if (process.platform === "linux" && !process.env.SSL_CERT_FILE && existsSync26("/etc/ssl/certs/ca-certificates.crt")) {
+var pkg = JSON.parse(readFileSync28(join24(__dirname, "..", "package.json"), "utf-8"));
+if (process.platform === "linux" && !process.env.SSL_CERT_FILE && existsSync25("/etc/ssl/certs/ca-certificates.crt")) {
   process.env.SSL_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt";
 }
-var create2 = defineCommand14({
+var create2 = defineCommand13({
   meta: {
     name: "create",
     description: "Create a new DeepSpace app (runs create-deepspace; all flags are forwarded)"
@@ -13079,14 +12947,14 @@ var create2 = defineCommand14({
   }
 });
 var rename = (cmd, name) => ({ ...cmd, meta: { ...cmd.meta ?? {}, name } });
-var auth = defineCommand14({
+var auth = defineCommand13({
   meta: { name: "auth", description: "Session: login, logout, whoami" },
   subCommands: { login: login_default, logout: logout_default, whoami: whoami_default }
 });
-var app = defineCommand14({
+var app = defineCommand13({
   meta: {
     name: "app",
-    description: "The app itself: create, init, list, source, migrate, undeploy, transfer, collaborators, domain, library, usage"
+    description: "The app itself: create, init, list, source, migrate, undeploy, transfer, collaborators, domain, usage"
   },
   subCommands: {
     create: create2,
@@ -13096,17 +12964,16 @@ var app = defineCommand14({
     transfer: transfer_default,
     collaborators: collaborators_default,
     domain: domain_default,
-    library: library_default,
     usage: usage_default,
     source: source_default,
     migrate: migrate_default
   }
 });
-var devGroup = defineCommand14({
+var devGroup = defineCommand13({
   meta: { name: "dev", description: "Local development" },
   subCommands: { start: rename(dev_default, "start"), kill: kill_default }
 });
-var testGroup = defineCommand14({
+var testGroup = defineCommand13({
   meta: { name: "test", description: "App tests and test tooling" },
   subCommands: {
     run: rename(test_default, "run"),
@@ -13114,7 +12981,7 @@ var testGroup = defineCommand14({
     accounts: rename(test_accounts_default, "accounts")
   }
 });
-var main = defineCommand14({
+var main = defineCommand13({
   meta: {
     name: "deepspace",
     version: pkg.version,