deepspace 0.10.3 → 0.11.0

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # deepspace
 
+## 0.11.0
+
+### Minor Changes
+
+- Replace the base64 deploy asset transport with a content-addressed one. The CLI now hashes the build output locally, asks the platform which files it is missing, and streams only those into the app's release store; unchanged files are never re-uploaded, and no deploy ever serializes its assets into a JSON payload. This removes the "Worker exceeded memory limit" failure that surfaced as a misleading Cloudflare-incident 503 on asset-heavy deploys, and a deploy-service resource limit is now reported distinctly from a genuine Cloudflare API incident.
+
+  **This release requires an updated deploy service and is required to deploy.** The old grouped-upload endpoints are gone: an older CLI is answered with a clear "update to deploy" instruction, and this CLI refuses to start against a deploy service that does not advertise the new transport. Releases recorded before the cutover can no longer be rolled back to directly — redeploy that commit instead.
+
 ## 0.10.3
 
 ### Patch Changes

package/dist/cli.js

@@ -3,7 +3,7 @@
 // src/cli/cli.ts
 import { defineCommand as defineCommand13, runMain, runCommand } from "citty";
 import { sync as spawnSync8 } from "cross-spawn";
-import { readFileSync as readFileSync27, existsSync as existsSync25 } from "fs";
+import { readFileSync as readFileSync28, existsSync as existsSync25 } from "fs";
 import { dirname as dirname10, join as join24 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 
@@ -3715,6 +3715,7 @@ import { resolve as resolve12 } from "path";
 // src/cli/commands/deploy/build.ts
 import * as p6 from "@clack/prompts";
 import { execSync as execSync2 } from "child_process";
+import { createHash as createHash2 } from "crypto";
 import { existsSync as existsSync15, readFileSync as readFileSync17, readdirSync as readdirSync4 } from "fs";
 import { dirname as dirname5, join as join16, resolve as resolve10 } from "path";
 
@@ -4174,9 +4175,12 @@ function collectAssets(dir) {
       if (entry.isDirectory()) {
         walk(fullPath, relativePath);
       } else {
+        const bytes = readFileSync17(fullPath);
         assets.push({
           path: `/${relativePath}`,
-          contentBase64: readFileSync17(fullPath).toString("base64")
+          hash: createHash2("sha256").update(bytes).digest("hex"),
+          size: bytes.byteLength,
+          sourcePath: fullPath
         });
       }
     }
@@ -4463,7 +4467,7 @@ function createDeployOutput(json) {
 
 // src/cli/commands/deploy/request.ts
 import * as p10 from "@clack/prompts";
-import { randomUUID as randomUUID2 } from "crypto";
+import { readFileSync as readFileSync18 } from "fs";
 
 // src/cli/commands/deploy/repository.ts
 import * as p9 from "@clack/prompts";
@@ -5203,12 +5207,9 @@ function detachedHeadRefusal() {
 
 // src/cli/commands/deploy/request.ts
 var CLOUDFLARE_DEPLOY_ERROR_HINT = "Deployment reached the DeepSpace deploy worker, but Cloudflare's deployment control-plane API failed. This is often caused by a Cloudflare Dashboard/API incident or Workers for Platforms entitlement outage. Already deployed apps should keep serving; wait for Cloudflare to recover and retry.";
-var MAX_GROUP_BYTES = 40 * 1024 * 1024;
-var GROUP_BYTES = (() => {
-  const configured = Number(process.env.DEEPSPACE_DEPLOY_GROUP_BYTES);
-  const bytes = Number.isInteger(configured) && configured > 0 ? configured : 3 * 1024 * 1024;
-  return Math.min(bytes, MAX_GROUP_BYTES);
-})();
+var DEPLOY_SERVICE_LIMIT_HINT = "The DeepSpace deploy service hit a resource limit processing this deploy (the deploy worker was terminated before it could answer). This is a DeepSpace-side failure, not a Cloudflare incident \u2014 your app was not changed. Retry; if it keeps happening, report the app id and asset count.";
+var REQUIRED_ASSET_TRANSPORT = "content-addressed-v1";
+var UPLOAD_CONCURRENCY = 4;
 async function deployBuiltBundle(options) {
   const {
     deployUrl,
@@ -5229,44 +5230,11 @@ async function deployBuiltBundle(options) {
   } else if (bundle.extraRoutes.length) {
     p10.log.info(`Custom worker-first routes: ${bundle.extraRoutes.join(", ")}`);
   }
-  const assetGroups = packAssetGroups(bundle.assets, GROUP_BYTES);
-  if (assetGroups.length === 0) assetGroups.push([]);
-  const uploadId = randomUUID2();
-  const totalGroups = assetGroups.length;
-  try {
-    for (let index = 0; index < totalGroups; index++) {
-      const groupJson = JSON.stringify(assetGroups[index]);
-      spinner2.message(`Uploading assets \u2014 group ${index + 1}/${totalGroups}...`);
-      const groupResponse = await postWithRetry(
-        `${deployUrl}/api/deploy/${appId}/assets?uploadId=${uploadId}&groupIndex=${index}&totalGroups=${totalGroups}`,
-        () => ({
-          method: "POST",
-          headers: {
-            Authorization: `Bearer ${token}`,
-            "Content-Type": "application/json"
-          },
-          body: groupJson
-        })
-      );
-      if (!groupResponse.ok) {
-        const errorBody = await groupResponse.json().catch(() => ({}));
-        await abortStagedUpload(deployUrl, appId, uploadId, totalGroups, token);
-        spinner2.stop("Deploy failed");
-        output.die(
-          `Asset upload failed on group ${index + 1}/${totalGroups}: ${errorBody.error ?? `HTTP ${groupResponse.status}`}`,
-          "upload_failed"
-        );
-      }
-    }
-  } catch (error) {
-    await abortStagedUpload(deployUrl, appId, uploadId, totalGroups, token);
-    spinner2.stop("Deploy failed");
-    output.die(`Asset upload failed (network): ${errorMessage4(error)}`, "upload_failed");
-  }
+  await requireAssetTransport(deployUrl, spinner2, output);
+  await uploadDeployAssets({ deployUrl, appId, token, assets: bundle.assets, output, spinner: spinner2 });
   spinner2.message(`Deploying ${appName}...`);
   let confirmRename = options.rename;
   const bail = async (message, stopLabel = "Deploy failed", code, actionRequired = false, action) => {
-    await abortStagedUpload(deployUrl, appId, uploadId, totalGroups, token);
     if (stopLabel !== null) spinner2.stop(stopLabel);
     p10.cancel(code ? withSlug(message, code) : message);
     if (action) printAction(action);
@@ -5288,8 +5256,7 @@ async function deployBuiltBundle(options) {
       new Blob([bundle.workerJs], { type: "application/javascript" }),
       "worker.js"
     );
-    form.append("uploadId", uploadId);
-    form.append("totalGroups", String(totalGroups));
+    form.append("assetManifest", JSON.stringify(assetManifest(bundle.assets)));
     form.append("appMigrations", JSON.stringify(bundle.appMigrations));
     if (bundle.doManifest) form.append("doManifest", JSON.stringify(bundle.doManifest));
     if (bundle.customBindings.length) {
@@ -5368,7 +5335,11 @@ async function deployBuiltBundle(options) {
     );
   }
   if (!response.ok || !body.success) {
-    await bail(formatDeployWorkerError(response.status, body.error), "Deploy failed", body.code);
+    await bail(
+      formatDeployWorkerError(response.status, body.error, body.code),
+      "Deploy failed",
+      body.code
+    );
   }
   if (body.onBehalfOfOwner) {
     p10.log.warn(`Deployed on behalf of owner ${body.onBehalfOfOwner}`);
@@ -5385,17 +5356,139 @@ async function deployBuiltBundle(options) {
   }
   return body;
 }
-async function abortStagedUpload(deployUrl, appId, uploadId, totalGroups, token) {
+function assetManifest(assets) {
+  return assets.map((asset) => ({ path: asset.path, hash: asset.hash, size: asset.size }));
+}
+async function requireAssetTransport(deployUrl, spinner2, output) {
+  let advertised;
   try {
-    await fetch(
-      `${deployUrl}/api/deploy/${appId}/assets?uploadId=${uploadId}&totalGroups=${totalGroups}`,
-      { method: "DELETE", headers: { Authorization: `Bearer ${token}` } }
+    const response = await fetch(`${deployUrl}/api/health`);
+    if (!response.ok) throw new Error(`HTTP ${response.status}`);
+    const body = await response.json();
+    advertised = body.capabilities?.assetTransport;
+  } catch (error) {
+    spinner2.stop("Deploy failed");
+    output.die(
+      `Could not reach the DeepSpace deploy service at ${deployUrl} to check its capabilities: ${errorMessage4(error)}`,
+      "deploy_service_unreachable"
+    );
+  }
+  if (advertised !== REQUIRED_ASSET_TRANSPORT) {
+    spinner2.stop("Deploy failed");
+    output.die(
+      `The DeepSpace deploy service at ${deployUrl} does not support this CLI's asset transport (needs "${REQUIRED_ASSET_TRANSPORT}", found ${advertised === void 0 ? "none" : `"${String(advertised)}"`}). Wait for the platform to finish updating, or pin an older deepspace CLI.`,
+      "asset_transport_unsupported"
     );
-  } catch {
   }
 }
-function formatDeployWorkerError(status3, error) {
+async function uploadDeployAssets(options) {
+  const { deployUrl, appId, token, assets, spinner: spinner2 } = options;
+  const output = options.output;
+  const byHash = new Map(assets.map((asset) => [asset.hash, asset]));
+  spinner2.message("Checking which assets are already uploaded...");
+  let planResponse;
+  try {
+    planResponse = await postWithRetry(`${deployUrl}/api/deploy/${appId}/asset-plan`, () => ({
+      method: "POST",
+      headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+      body: JSON.stringify({
+        assets: [...byHash.values()].map((asset) => ({ hash: asset.hash, size: asset.size }))
+      })
+    }));
+  } catch (error) {
+    spinner2.stop("Deploy failed");
+    output.die(`Asset plan failed (network): ${errorMessage4(error)}`, "upload_failed");
+  }
+  const planBody = await planResponse.json().catch(() => ({}));
+  if (!planResponse.ok) {
+    spinner2.stop("Deploy failed");
+    output.die(
+      formatDeployWorkerError(planResponse.status, planBody.error, planBody.code),
+      planBody.code ?? "upload_failed"
+    );
+  }
+  const missing = [];
+  for (const hash of planBody.missing ?? []) {
+    const asset = byHash.get(hash);
+    if (!asset) {
+      spinner2.stop("Deploy failed");
+      output.die(
+        `The deploy service asked for asset ${hash}, which is not part of this build. Re-run the deploy; if it persists, report the app id.`,
+        "upload_failed"
+      );
+    }
+    missing.push(asset);
+  }
+  if (missing.length === 0) {
+    p10.log.info(`Assets: ${byHash.size} file(s), all already uploaded`);
+    return;
+  }
+  const missingBytes = missing.reduce((total, asset) => total + asset.size, 0);
+  p10.log.info(
+    `Assets: ${byHash.size} file(s), uploading ${missing.length} (${Math.ceil(missingBytes / 1024)} KiB); the rest are already stored`
+  );
+  let uploaded = 0;
+  const next = () => missing.pop();
+  const worker = async () => {
+    for (let asset = next(); asset; asset = next()) {
+      const response = await postWithRetry(
+        `${deployUrl}/api/deploy/${appId}/assets/${asset.hash}`,
+        () => ({
+          method: "PUT",
+          headers: {
+            Authorization: `Bearer ${token}`,
+            "Content-Type": "application/octet-stream"
+          },
+          // Read whole, per attempt. The platform matches Content-Length
+          // against the plan before it touches storage, and a stream body
+          // would be sent chunked with no length at all; a retry also needs a
+          // body it can send again.
+          body: readFileSync18(asset.sourcePath)
+        })
+      );
+      if (!response.ok) {
+        const body = await response.json().catch(() => ({}));
+        throw new AssetUploadError(
+          body.error ?? `Upload of ${asset.path} failed: HTTP ${response.status}`,
+          body.code ?? "upload_failed",
+          response.status
+        );
+      }
+      uploaded++;
+      spinner2.message(`Uploading assets \u2014 ${uploaded}/${uploaded + missing.length}...`);
+    }
+  };
+  try {
+    await Promise.all(
+      Array.from({ length: Math.min(UPLOAD_CONCURRENCY, missing.length) }, worker)
+    );
+  } catch (error) {
+    spinner2.stop("Deploy failed");
+    if (error instanceof AssetUploadError) {
+      output.die(formatDeployWorkerError(error.status, error.message, error.code), error.code);
+    }
+    output.die(`Asset upload failed (network): ${errorMessage4(error)}`, "upload_failed");
+  }
+}
+var AssetUploadError = class extends Error {
+  constructor(message, code, status3) {
+    super(message);
+    this.code = code;
+    this.status = status3;
+  }
+};
+function isDeployServiceResourceLimit(status3, error) {
+  if (!error) return status3 === 500 || status3 === 502;
+  return /\b110[12]\b/.test(error) && /worker|error code/i.test(error);
+}
+function formatDeployWorkerError(status3, error, code) {
   const detail = error ?? `Deployment error (${status3})`;
+  if (code === "cli_outdated") return detail;
+  if (isDeployServiceResourceLimit(status3, error)) {
+    return `${DEPLOY_SERVICE_LIMIT_HINT}
+
+Underlying error: ${detail}`;
+  }
   if (status3 < 500 && ![
     "Upload session failed",
     "Asset upload failed",
@@ -5412,23 +5505,6 @@ Underlying error: ${detail}`;
 function errorMessage4(error) {
   return error instanceof Error ? error.message : String(error);
 }
-function packAssetGroups(assets, maxBytes) {
-  const groups = [];
-  let current = [];
-  let currentBytes = 2;
-  for (const asset of assets) {
-    const entryBytes = Buffer.byteLength(JSON.stringify(asset), "utf-8") + 1;
-    if (current.length > 0 && currentBytes + entryBytes > maxBytes) {
-      groups.push(current);
-      current = [];
-      currentBytes = 2;
-    }
-    current.push(asset);
-    currentBytes += entryBytes;
-  }
-  if (current.length > 0) groups.push(current);
-  return groups;
-}
 async function postWithRetry(url, makeInit, {
   attempts = 4,
   retryServerErrors = true
@@ -5454,7 +5530,7 @@ async function postWithRetry(url, makeInit, {
 
 // src/cli/commands/deploy/secrets.ts
 import * as p11 from "@clack/prompts";
-import { existsSync as existsSync18, readFileSync as readFileSync18 } from "fs";
+import { existsSync as existsSync18, readFileSync as readFileSync19 } from "fs";
 function classifyDevVarsSecrets(options) {
   const store = new Set(options.storeSecretNames);
   const strayKeys = options.handEditedDevVarKeys.filter((key) => !store.has(key));
@@ -5553,7 +5629,7 @@ function prepareDeploySecrets(options) {
 }
 function readCustomDevVars(path, output) {
   if (!existsSync18(path)) return {};
-  const section = extractCustomDevVars(stripGeneratedSecretsCache(readFileSync18(path, "utf-8")));
+  const section = extractCustomDevVars(stripGeneratedSecretsCache(readFileSync19(path, "utf-8")));
   if (!section) return {};
   try {
     return parseDevVars(section);
@@ -6479,7 +6555,7 @@ var usage_default = defineDeepspaceCommand({
 });
 
 // src/cli/commands/add.ts
-import { existsSync as existsSync20, readFileSync as readFileSync20, realpathSync as realpathSync3 } from "fs";
+import { existsSync as existsSync20, readFileSync as readFileSync21, realpathSync as realpathSync3 } from "fs";
 import { dirname as dirname7, join as join19, resolve as resolve14 } from "path";
 import { pathToFileURL as pathToFileURL3 } from "url";
 
@@ -6492,7 +6568,7 @@ import {
   mkdirSync as mkdirSync6,
   mkdtempSync,
   openSync as openSync2,
-  readFileSync as readFileSync19,
+  readFileSync as readFileSync20,
   readSync,
   readdirSync as readdirSync5,
   rmSync as rmSync4,
@@ -6509,7 +6585,7 @@ function featurePackageRoot(moduleUrl = import.meta.url) {
     const packagePath = join18(dir, "package.json");
     if (existsSync19(packagePath)) {
       try {
-        const pkg2 = JSON.parse(readFileSync19(packagePath, "utf-8"));
+        const pkg2 = JSON.parse(readFileSync20(packagePath, "utf-8"));
         if (pkg2.name === "deepspace") return dir;
       } catch {
       }
@@ -6526,7 +6602,7 @@ function readFeatureConfig(id, packageRoot = featurePackageRoot()) {
   const configPath = join18(packageRoot, "features", id, "feature.json");
   if (!existsSync19(configPath)) return null;
   try {
-    const config = JSON.parse(readFileSync19(configPath, "utf-8"));
+    const config = JSON.parse(readFileSync20(configPath, "utf-8"));
     if (typeof config.id !== "string" || typeof config.name !== "string" || !Array.isArray(config.files)) {
       return null;
     }
@@ -6591,7 +6667,7 @@ function copyFile(src, dest) {
 function copyFileWithImportShift(src, dest, levels) {
   mkdirSync6(dirname6(dest), { recursive: true });
   const prefix = "../".repeat(levels);
-  const shifted = readFileSync19(src, "utf-8").replace(
+  const shifted = readFileSync20(src, "utf-8").replace(
     /(from\s+|import\s+|import\()(['"])(\.\.\/)/g,
     `$1$2${prefix}$3`
   );
@@ -6650,7 +6726,7 @@ function integrateSchema(config, targetDir, emit) {
   if (!existsSync19(schemasPath)) {
     return [unresolvedSchema(config.schema, "src/schemas.ts was not found.", emit)];
   }
-  let content = readFileSync19(schemasPath, "utf-8");
+  let content = readFileSync20(schemasPath, "utf-8");
   const { exportName, importPath, spreadOperator } = config.schema;
   const importPattern = new RegExp(`^import\\s+\\{[^}]*\\b${exportName}\\b`, "m");
   if (importPattern.test(content)) {
@@ -6707,7 +6783,7 @@ function integrateActions(config, targetDir, emit) {
   if (!existsSync19(actionsPath)) {
     return [unresolvedActions(config.actions, "src/actions/index.ts was not found.", emit)];
   }
-  let content = readFileSync19(actionsPath, "utf-8");
+  let content = readFileSync20(actionsPath, "utf-8");
   const registryPattern = /export const actions:\s*Record<string,\s*ActionHandler(?:<[^>]*>)?>\s*=\s*\{/;
   if (!registryPattern.test(content)) {
     const reason = "src/actions/index.ts has an unexpected structure.";
@@ -6762,7 +6838,7 @@ function integrateCode(config, targetDir, emit) {
       });
       continue;
     }
-    const original = readFileSync19(targetPath, "utf-8");
+    const original = readFileSync20(targetPath, "utf-8");
     if (original.includes(insertion.insert.trim())) {
       emit(`   Integration already present: ${insertion.file}`);
       continue;
@@ -6798,7 +6874,7 @@ ${content.slice(importIndex < 0 ? 0 : importIndex)}`;
 function integrateIgnore(config, targetDir) {
   if (!config.ignore?.length) return;
   const targetPath = join18(targetDir, ".gitignore");
-  const current = existsSync19(targetPath) ? readFileSync19(targetPath, "utf-8") : "";
+  const current = existsSync19(targetPath) ? readFileSync20(targetPath, "utf-8") : "";
   const present = new Set(current.split(/\r?\n/).map((line) => line.trim()));
   const missing = config.ignore.filter((pattern) => !present.has(pattern));
   if (missing.length === 0) return;
@@ -6818,7 +6894,7 @@ function integrateWrangler(config, targetDir, emit) {
   if (!existsSync19(targetPath)) {
     return [{ area: "wrangler", reason: "wrangler.toml was not found.", steps }];
   }
-  let source = readFileSync19(targetPath, "utf-8");
+  let source = readFileSync20(targetPath, "utf-8");
   if (runWorkerFirst && !/^\[assets\]\s*$/m.test(source)) {
     return [{ area: "wrangler", reason: "wrangler.toml has no [assets] section.", steps }];
   }
@@ -6907,7 +6983,7 @@ function integrateCss(packageRoot, config, targetDir, emit) {
       }
     ];
   }
-  let styles = readFileSync19(stylesPath, "utf-8");
+  let styles = readFileSync20(stylesPath, "utf-8");
   let integrated = 0;
   const unresolved = [];
   for (const cssFile of config.css) {
@@ -6921,7 +6997,7 @@ function integrateCss(packageRoot, config, targetDir, emit) {
       });
       continue;
     }
-    const css = readFileSync19(srcPath, "utf-8");
+    const css = readFileSync20(srcPath, "utf-8");
     const fingerprint = css.match(/\.([\w-]+)\s*\{|@keyframes\s+([\w-]+)/);
     const marker = fingerprint?.[1] ?? fingerprint?.[2];
     if (marker && styles.includes(marker)) {
@@ -6952,7 +7028,7 @@ function integrateRoute(config, targetDir, emit) {
   if (!existsSync19(navPath)) {
     return [unresolvedRoute(config.route, config, "src/nav.ts was not found.", emit)];
   }
-  let content = readFileSync19(navPath, "utf-8");
+  let content = readFileSync20(navPath, "utf-8");
   const routePath = config.route.path;
   if (content.includes(`'${routePath}'`)) {
     emit(`   Nav already present: ${routePath}`);
@@ -7033,7 +7109,7 @@ function integrateDependencies(config, targetDir, runInstall, outputVisible, emi
   }
   let pkg2;
   try {
-    pkg2 = JSON.parse(readFileSync19(packagePath, "utf-8"));
+    pkg2 = JSON.parse(readFileSync20(packagePath, "utf-8"));
   } catch (error) {
     emit(
       `   Could not patch package.json (parse error: ${error instanceof Error ? error.message : String(error)})`
@@ -7093,7 +7169,7 @@ ${child.diagnosticTail}` : "";
 }
 function dependencySnapshot(targetDir) {
   try {
-    const pkg2 = JSON.parse(readFileSync19(join18(targetDir, "package.json"), "utf-8"));
+    const pkg2 = JSON.parse(readFileSync20(join18(targetDir, "package.json"), "utf-8"));
     return {
       dependencies: pkg2.dependencies ?? {},
       devDependencies: pkg2.devDependencies ?? {}
@@ -7342,7 +7418,7 @@ function isDeepSpaceApp(dir) {
   const packagePath = join19(dir, "package.json");
   if (!existsSync20(packagePath)) return false;
   try {
-    const pkg2 = JSON.parse(readFileSync20(packagePath, "utf-8"));
+    const pkg2 = JSON.parse(readFileSync21(packagePath, "utf-8"));
     return Boolean(pkg2.dependencies?.deepspace || pkg2.devDependencies?.deepspace);
   } catch {
     return false;
@@ -8125,7 +8201,7 @@ var transfer_default = defineCommand7({
 import { defineCommand as defineCommand8 } from "citty";
 
 // src/cli/commands/_invoke-impl.ts
-import { readFileSync as readFileSync21 } from "fs";
+import { readFileSync as readFileSync22 } from "fs";
 import * as p15 from "@clack/prompts";
 var API_URL7 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
 var DEFAULT_TIMEOUT_MS = 12e4;
@@ -8166,7 +8242,7 @@ function resolveBody(opts) {
   if (opts.body != null) {
     raw = opts.body;
   } else if (opts.bodyFile != null) {
-    raw = opts.bodyFile === "-" ? readFileSync21(0, "utf-8") : readFileSync21(opts.bodyFile, "utf-8");
+    raw = opts.bodyFile === "-" ? readFileSync22(0, "utf-8") : readFileSync22(opts.bodyFile, "utf-8");
   } else {
     return "{}";
   }
@@ -8445,7 +8521,7 @@ var integrations_default = defineCommand8({
 
 // src/cli/commands/feedback.ts
 import * as p16 from "@clack/prompts";
-import { existsSync as existsSync21, readFileSync as readFileSync22 } from "fs";
+import { existsSync as existsSync21, readFileSync as readFileSync23 } from "fs";
 import { dirname as dirname8, join as join20 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { release } from "os";
@@ -8474,7 +8550,7 @@ function readCliVersion() {
     ];
     for (const path of candidates) {
       if (!existsSync21(path)) continue;
-      const pkg2 = JSON.parse(readFileSync22(path, "utf-8"));
+      const pkg2 = JSON.parse(readFileSync23(path, "utf-8"));
       if (pkg2.name === "deepspace" && pkg2.version) return pkg2.version;
     }
   } catch {
@@ -8670,7 +8746,7 @@ Context: deepspace ${payload.cliVersion} \xB7 ${payload.nodeVersion} \xB7 ${payl
 
 // src/cli/commands/secrets.ts
 import { defineCommand as defineCommand9 } from "citty";
-import { readFileSync as readFileSync23 } from "fs";
+import { readFileSync as readFileSync24 } from "fs";
 
 // src/cli/lib/citty-args.ts
 function dedupePositionals(bound, rest) {
@@ -8940,7 +9016,7 @@ var upload = defineCommand9({
   async run({ args }) {
     try {
       const t = await resolveTarget(args);
-      const content = args.file === "-" ? readFileSync23(0, "utf-8") : readFileSync23(args.file, "utf-8");
+      const content = args.file === "-" ? readFileSync24(0, "utf-8") : readFileSync24(args.file, "utf-8");
       const secrets = parseSecretsUpload(content);
       if (Object.keys(secrets).length === 0)
         fail(new InputError("No secrets found in the input.", "empty_input"));
@@ -9196,7 +9272,7 @@ var init_default = defineDeepspaceCommand({
 // src/cli/commands/status.ts
 import { defineCommand as defineCommand10 } from "citty";
 import * as p17 from "@clack/prompts";
-import { existsSync as existsSync22, readFileSync as readFileSync24 } from "fs";
+import { existsSync as existsSync22, readFileSync as readFileSync25 } from "fs";
 function timeAgo(iso) {
   const ms = Date.now() - Date.parse(iso);
   if (!Number.isFinite(ms) || ms < 0) return iso;
@@ -9290,7 +9366,7 @@ var status_default = defineCommand10({
       let who = "logged in";
       try {
         const payload = decodeJwtPayload(
-          readFileSync24(TOKEN_PATH, "utf-8").trim()
+          readFileSync25(TOKEN_PATH, "utf-8").trim()
         );
         if (payload.email) who = payload.email;
         userId = payload.sub ?? null;
@@ -10408,7 +10484,7 @@ function printOverlaps(overlaps, json) {
 
 // src/cli/commands/workspace/local.ts
 import * as p24 from "@clack/prompts";
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync25, realpathSync as realpathSync5, renameSync as renameSync2, statSync, writeFileSync as writeFileSync9 } from "fs";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync26, realpathSync as realpathSync5, renameSync as renameSync2, statSync, writeFileSync as writeFileSync9 } from "fs";
 import { dirname as dirname9, isAbsolute as isAbsolute5, join as join22, relative as relative2, sep as sep2 } from "path";
 var WORKSPACE_MARKER = "deepspace-workspace.json";
 function excludeWorktreeDir(appDir, dir) {
@@ -10466,7 +10542,7 @@ function isManagedWorkspaceWorktree(worktreeRoot, workspaceId) {
   const markerPath = worktreeMarkerPath(worktreeRoot);
   if (!markerPath) return false;
   try {
-    const marker = JSON.parse(readFileSync25(markerPath, "utf-8"));
+    const marker = JSON.parse(readFileSync26(markerPath, "utf-8"));
     return marker.version === 1 && marker.workspaceId === workspaceId && marker.mode === "managed-linked";
   } catch {
     return false;
@@ -11328,13 +11404,13 @@ import * as p30 from "@clack/prompts";
 
 // src/cli/lib/validation.ts
 import { sync as spawnSync7 } from "cross-spawn";
-import { readFileSync as readFileSync26 } from "fs";
+import { readFileSync as readFileSync27 } from "fs";
 import { join as join23 } from "path";
 var MAX_SUMMARY_CHARS = 4e3;
 var MAX_OUTPUT_BUFFER = 64 * 1024 * 1024;
 function configuredCommand(appDir) {
   try {
-    const pkg2 = JSON.parse(readFileSync26(join23(appDir, "package.json"), "utf-8"));
+    const pkg2 = JSON.parse(readFileSync27(join23(appDir, "package.json"), "utf-8"));
     if (pkg2.scripts?.validate) return `${detectPackageManager(appDir)} run --silent validate`;
   } catch {
   }
@@ -12828,7 +12904,7 @@ function reportMigration(migration, json) {
 
 // src/cli/cli.ts
 var __dirname = dirname10(fileURLToPath3(import.meta.url));
-var pkg = JSON.parse(readFileSync27(join24(__dirname, "..", "package.json"), "utf-8"));
+var pkg = JSON.parse(readFileSync28(join24(__dirname, "..", "package.json"), "utf-8"));
 if (process.platform === "linux" && !process.env.SSL_CERT_FILE && existsSync25("/etc/ssl/certs/ca-certificates.crt")) {
   process.env.SSL_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt";
 }