deepspace 0.10.3 → 0.12.0

package/dist/cli.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 
 // src/cli/cli.ts
-import { defineCommand as defineCommand13, runMain, runCommand } from "citty";
+import { defineCommand as defineCommand14, runMain, runCommand } from "citty";
 import { sync as spawnSync8 } from "cross-spawn";
-import { readFileSync as readFileSync27, existsSync as existsSync25 } from "fs";
+import { readFileSync as readFileSync28, existsSync as existsSync26 } from "fs";
 import { dirname as dirname10, join as join24 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 
@@ -709,7 +709,7 @@ async function provisionProfile(jwt) {
   }
 }
 function sleep(ms) {
-  return new Promise((resolve18) => setTimeout(resolve18, ms));
+  return new Promise((resolve19) => setTimeout(resolve19, ms));
 }
 function base64url(bytes) {
   return bytes.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
@@ -929,6 +929,7 @@ import { dirname as dirname2, join as join5, resolve as resolve3 } from "path";
 // src/cli/lib/git/process.ts
 import { sync as spawnSync } from "cross-spawn";
 var MAX_GIT_BUFFER = 512 * 1024 * 1024;
+var GIT_TIMEOUT_MS = 3e5;
 var GitError = class extends Error {
   constructor(message, code) {
     super(message);
@@ -937,10 +938,16 @@ var GitError = class extends Error {
   }
 };
 function runGit(cwd, args, opts = {}) {
+  const timeout = opts.timeoutMs ?? GIT_TIMEOUT_MS;
   const result = spawnSync("git", args, {
     cwd,
     input: opts.input,
     maxBuffer: MAX_GIT_BUFFER,
+    timeout,
+    // SIGKILL, not the default SIGTERM: a child that ignores or traps TERM
+    // would otherwise keep running for its full duration and the "timeout"
+    // would bound nothing.
+    killSignal: "SIGKILL",
     stdio: ["pipe", "pipe", "pipe"],
     env: {
       ...process.env,
@@ -949,6 +956,12 @@ function runGit(cwd, args, opts = {}) {
       ...opts.env ?? {}
     }
   });
+  if (result.error?.code === "ETIMEDOUT") {
+    throw new GitError(
+      `git ${args[0]} did not finish within ${Math.round(timeout / 1e3)}s and was stopped. If this was a push, the history is probably too large to transfer \u2014 see \`deepspace push\` for the size limits; otherwise retry, and report it with \`deepspace feedback\` if it persists.`,
+      "git_timeout"
+    );
+  }
   if (result.error) {
     const code = result.error.code;
     if (code === "ENOENT") {
@@ -2534,10 +2547,10 @@ function formatSchemaLintFindings(findings) {
 import { createServer } from "net";
 var DEFAULT_PORT = 5173;
 function checkPortAvailable(port, host = "0.0.0.0") {
-  return new Promise((resolve18) => {
+  return new Promise((resolve19) => {
     const srv = createServer();
-    srv.once("error", () => resolve18(false));
-    srv.once("listening", () => srv.close(() => resolve18(true)));
+    srv.once("error", () => resolve19(false));
+    srv.once("listening", () => srv.close(() => resolve19(true)));
     srv.listen(port, host);
   });
 }
@@ -3679,8 +3692,8 @@ var clear = defineDeepspaceCommand({
         failures.push({ email: a.email, error: err.message });
       }
     }
-    const deleted = targets.filter((target) => !failures.some((failure) => failure.email === target.email));
-    removeTestAccounts(deleted.map((target) => target.id), deleted.map((target) => target.email));
+    const deleted = targets.filter((target2) => !failures.some((failure) => failure.email === target2.email));
+    removeTestAccounts(deleted.map((target2) => target2.id), deleted.map((target2) => target2.email));
     if (failures.length > 0) {
       throw new Refusal(
         `Deleted ${ok2}/${targets.length} test account(s).
@@ -3715,6 +3728,7 @@ import { resolve as resolve12 } from "path";
 // src/cli/commands/deploy/build.ts
 import * as p6 from "@clack/prompts";
 import { execSync as execSync2 } from "child_process";
+import { createHash as createHash2 } from "crypto";
 import { existsSync as existsSync15, readFileSync as readFileSync17, readdirSync as readdirSync4 } from "fs";
 import { dirname as dirname5, join as join16, resolve as resolve10 } from "path";
 
@@ -4174,9 +4188,12 @@ function collectAssets(dir) {
       if (entry.isDirectory()) {
         walk(fullPath, relativePath);
       } else {
+        const bytes = readFileSync17(fullPath);
         assets.push({
           path: `/${relativePath}`,
-          contentBase64: readFileSync17(fullPath).toString("base64")
+          hash: createHash2("sha256").update(bytes).digest("hex"),
+          size: bytes.byteLength,
+          sourcePath: fullPath
         });
       }
     }
@@ -4463,7 +4480,7 @@ function createDeployOutput(json) {
 
 // src/cli/commands/deploy/request.ts
 import * as p10 from "@clack/prompts";
-import { randomUUID as randomUUID2 } from "crypto";
+import { readFileSync as readFileSync18 } from "fs";
 
 // src/cli/commands/deploy/repository.ts
 import * as p9 from "@clack/prompts";
@@ -4653,6 +4670,37 @@ function repoApi(deployUrl, token, appId) {
   };
 }
 
+// src/shared/app-files.ts
+var MAX_APP_FILE_BYTES = 25 * 1024 * 1024;
+function formatBytes(bytes) {
+  if (bytes >= 1024 * 1024) return `${(bytes / (1024 * 1024)).toFixed(1)} MiB`;
+  if (bytes >= 1024) return `${Math.round(bytes / 1024)} KiB`;
+  return `${bytes} B`;
+}
+function encodeKeyPath(key) {
+  return key.split("/").map(encodeURIComponent).join("/");
+}
+function oversizeMessage(bytes) {
+  return `That file is ${formatBytes(bytes)}; the limit is ${formatBytes(MAX_APP_FILE_BYTES)} per file.`;
+}
+function describeFilesFailure(status3, body) {
+  const trimmed = body.trim();
+  if (trimmed.startsWith("{")) {
+    try {
+      const parsed = JSON.parse(trimmed);
+      if (parsed.error) return parsed.error;
+    } catch {
+    }
+  }
+  if (status3 === 413) {
+    return `The file is too large to upload. The limit is ${formatBytes(MAX_APP_FILE_BYTES)} per file; larger uploads are rejected by the network before the app receives them.`;
+  }
+  if (status3 === 401 || status3 === 403) return "Not authorized to write these files.";
+  if (status3 === 415) return "That file type is not accepted.";
+  if (status3 >= 500) return `The files service failed (HTTP ${status3}). Retry shortly.`;
+  return `Upload failed (HTTP ${status3}).`;
+}
+
 // src/cli/lib/vc-remote.ts
 import { existsSync as existsSync17 } from "fs";
 import { tmpdir } from "os";
@@ -4817,7 +4865,7 @@ function isThinPackRejection(result) {
 function isRecoverablePushFailure(status3) {
   return status3 === "non_fast_forward" || status3 === "ref_conflict";
 }
-function classifyPushTransportFailure(error) {
+function classifyPushTransportFailure(error, cwd) {
   const message = error instanceof Error ? error.message : String(error);
   if (/(?:HTTP |error: )409\b/i.test(message)) {
     return {
@@ -4837,6 +4885,9 @@ function classifyPushTransportFailure(error) {
       error: "The cloud repo rate-limited this push. Wait a few seconds, then retry."
     };
   }
+  if (/(?:HTTP |error: )413\b/i.test(message)) {
+    return { code: "push_too_large", error: pushTooLargeMessage(cwd) };
+  }
   return null;
 }
 function pushToSpace(cwd, token, refspec, opts = {}) {
@@ -4861,18 +4912,28 @@ function pushToSpace(cwd, token, refspec, opts = {}) {
 }
 var OVERSIZED_PUSH_RE = /too large|exceeds|\bLFS\b/i;
 var SERVER_OBJECT_CAP_BYTES = 20 * 1024 * 1024;
-var OVERSIZED_PUSH_FIX = `Find the offending object with \`git rev-list --objects --all | git cat-file --batch-check='%(objecttype) %(objectsize) %(rest)' | sort -k2 -n | tail\`, then .gitignore it (or move it to Git LFS) and re-commit.`;
-function formatBytes(bytes) {
-  if (bytes >= 1024 * 1024) return `${(bytes / (1024 * 1024)).toFixed(1)} MiB`;
-  if (bytes >= 1024) return `${Math.round(bytes / 1024)} KiB`;
-  return `${bytes} B`;
-}
-function oversizedPushFix(cwd, cap = SERVER_OBJECT_CAP_BYTES) {
-  const objects = cwd ? findOversizedObjects(cwd, cap) : [];
-  if (objects.length === 0) return OVERSIZED_PUSH_FIX;
+var SERVER_PACK_CAP_BYTES = 32 * 1024 * 1024;
+var OVERSIZED_PUSH_FIX = `Find the offending object with \`git rev-list --objects --all | git cat-file --batch-check='%(objecttype) %(objectsize) %(rest)' | sort -k2 -n | tail\`.`;
+function removeFromHistoryAdvice(path) {
+  const file = path ? shQuote(path) : "<file>";
+  return `Media belongs in the app's files rather than Git history \u2014 \`deepspace app files put ${file}\` stores it in the app's own allocation and serves it over HTTP. Then get it out of the push: add it to .gitignore, and drop it from the commits that carry it \u2014 if those commits are still local, \`git reset --soft <last pushed commit>\` and re-commit without the file. \`git rm --cached\` plus a new commit is NOT sufficient on its own: the blob stays reachable from the earlier commit and the push is rejected the same way. If it already reached pushed history, rewrite it out (\`git filter-repo --path ${file} --invert-paths\`).`;
+}
+function fixForObjects(objects) {
+  if (objects.length === 0) return `${OVERSIZED_PUSH_FIX} ${removeFromHistoryAdvice(null)}`;
   const one = objects.length === 1;
   const named = objects.map((object) => `${object.path} (${formatBytes(object.bytes)})`).join(", ");
-  return `The oversized ${one ? "file is" : "files are"} ${named}. Remove ${one ? "it" : "them"} from history (\`git rm --cached ${one ? shQuote(objects[0].path) : "<path>"}\`, add to .gitignore, re-commit) or track ${one ? "it" : "them"} with Git LFS.`;
+  return `The oversized ${one ? "file is" : "files are"} ${named}. ${removeFromHistoryAdvice(one ? objects[0].path : null)}`;
+}
+function oversizedPushFix(cwd, cap = SERVER_OBJECT_CAP_BYTES) {
+  return fixForObjects(cwd ? findOversizedObjects(cwd, cap) : []);
+}
+function pushTooLargeMessage(cwd) {
+  const ceilings = `The cloud repo refused this push as too large (HTTP 413). The ceilings are ${formatBytes(SERVER_OBJECT_CAP_BYTES)} per file and ${formatBytes(SERVER_PACK_CAP_BYTES)} of compressed history per push. Large media never compresses, so every clone would pay for it forever.`;
+  const objects = cwd ? findOversizedObjects(cwd, SERVER_OBJECT_CAP_BYTES) : [];
+  if (objects.length === 0) {
+    return `${ceilings} No single file is over the per-file cap, so this is the volume of history \u2014 push it in smaller batches (\`git push space <earlier-commit>:refs/heads/<branch>\` first, then the rest). ${OVERSIZED_PUSH_FIX}`;
+  }
+  return `${ceilings} ${fixForObjects(objects)}`;
 }
 function pushFailureMessage(label, push, cwd) {
   const reason = push.reason ?? push.summary ?? "";
@@ -4962,7 +5023,7 @@ function remotePublicRefs(cwd, remote) {
 function remoteBranchOid(cwd, remote, branch) {
   return remotePublicRefs(cwd, remote).find((ref) => ref.name === `refs/heads/${branch}`)?.oid ?? null;
 }
-function localTransferRefs(cwd, prefix, target) {
+function localTransferRefs(cwd, prefix, target2) {
   const output = runGit(cwd, [
     "for-each-ref",
     "--format=%(refname) %(objectname)",
@@ -4970,7 +5031,7 @@ function localTransferRefs(cwd, prefix, target) {
   ]).stdout.toString("utf-8");
   return output.split("\n").map((line) => line.trim()).filter(Boolean).map((line) => {
     const [name, oid] = line.split(/\s+/, 2);
-    return { name: `${target}/${name.slice(`${prefix}/`.length)}`, oid };
+    return { name: `${target2}/${name.slice(`${prefix}/`.length)}`, oid };
   }).filter((ref) => /^[0-9a-f]{40}$/.test(ref.oid));
 }
 
@@ -5083,7 +5144,7 @@ async function syncDeployRepository(options) {
         }
       } else if (pushResult.status === "rejected") {
         output.die(
-          `Cloud repo rejected ${branch}${pushResult.reason ? `: ${pushResult.reason}` : ""}. Resolve the rejection and publish the commit before deploying.`,
+          `${pushFailureMessage("Cloud repo push", pushResult, appDir)} Publish the commit before deploying.`,
           "vc_push_rejected"
         );
       } else {
@@ -5127,7 +5188,7 @@ async function syncDeployRepository(options) {
       sourceRevision = claimed.revision;
     }
   } catch (error) {
-    const failure = deployRepositoryFailure(error);
+    const failure = deployRepositoryFailure(error, appDir);
     output.die(failure.error, failure.code);
   }
   return { commitOid, recoverable, deployKey, source, sourceRevision, baseReleaseId };
@@ -5154,8 +5215,8 @@ function classifyRemoteState(appDir, token, branch, localTip, remote) {
 function errorMessage3(error) {
   return error instanceof Error ? error.message : String(error);
 }
-function deployRepositoryFailure(error) {
-  const transportFailure = classifyPushTransportFailure(error);
+function deployRepositoryFailure(error, cwd) {
+  const transportFailure = classifyPushTransportFailure(error, cwd);
   if (transportFailure) return transportFailure;
   const code = errorCode(error);
   const message = errorMessage3(error);
@@ -5165,15 +5226,18 @@ function deployRepositoryFailure(error) {
     error: `Version-control sync failed: ${message}`
   };
 }
+var PUSH_RETRY_BUDGET_MS = 12e4;
 async function pushWithTransientRetry(push) {
   const backoffMs = [500, 1500, 3500];
+  const deadline = Date.now() + PUSH_RETRY_BUDGET_MS;
   for (let attempt = 0; ; attempt++) {
     try {
       return push();
     } catch (error) {
       const message = errorMessage3(error);
-      if (/(?:HTTP |error: )(?:429|503)\b/i.test(message) && attempt < backoffMs.length) {
-        await new Promise((resolve18) => setTimeout(resolve18, backoffMs[attempt]));
+      const transient = /(?:HTTP |error: )(?:429|503)\b/i.test(message);
+      if (transient && attempt < backoffMs.length && Date.now() + backoffMs[attempt] < deadline) {
+        await new Promise((resolve19) => setTimeout(resolve19, backoffMs[attempt]));
         continue;
       }
       throw error;
@@ -5203,12 +5267,9 @@ function detachedHeadRefusal() {
 
 // src/cli/commands/deploy/request.ts
 var CLOUDFLARE_DEPLOY_ERROR_HINT = "Deployment reached the DeepSpace deploy worker, but Cloudflare's deployment control-plane API failed. This is often caused by a Cloudflare Dashboard/API incident or Workers for Platforms entitlement outage. Already deployed apps should keep serving; wait for Cloudflare to recover and retry.";
-var MAX_GROUP_BYTES = 40 * 1024 * 1024;
-var GROUP_BYTES = (() => {
-  const configured = Number(process.env.DEEPSPACE_DEPLOY_GROUP_BYTES);
-  const bytes = Number.isInteger(configured) && configured > 0 ? configured : 3 * 1024 * 1024;
-  return Math.min(bytes, MAX_GROUP_BYTES);
-})();
+var DEPLOY_SERVICE_LIMIT_HINT = "The DeepSpace deploy service hit a resource limit processing this deploy (the deploy worker was terminated before it could answer). This is a DeepSpace-side failure, not a Cloudflare incident \u2014 your app was not changed. Retry; if it keeps happening, report the app id and asset count.";
+var REQUIRED_ASSET_TRANSPORT = "content-addressed-v1";
+var UPLOAD_CONCURRENCY = 4;
 async function deployBuiltBundle(options) {
   const {
     deployUrl,
@@ -5229,44 +5290,11 @@ async function deployBuiltBundle(options) {
   } else if (bundle.extraRoutes.length) {
     p10.log.info(`Custom worker-first routes: ${bundle.extraRoutes.join(", ")}`);
   }
-  const assetGroups = packAssetGroups(bundle.assets, GROUP_BYTES);
-  if (assetGroups.length === 0) assetGroups.push([]);
-  const uploadId = randomUUID2();
-  const totalGroups = assetGroups.length;
-  try {
-    for (let index = 0; index < totalGroups; index++) {
-      const groupJson = JSON.stringify(assetGroups[index]);
-      spinner2.message(`Uploading assets \u2014 group ${index + 1}/${totalGroups}...`);
-      const groupResponse = await postWithRetry(
-        `${deployUrl}/api/deploy/${appId}/assets?uploadId=${uploadId}&groupIndex=${index}&totalGroups=${totalGroups}`,
-        () => ({
-          method: "POST",
-          headers: {
-            Authorization: `Bearer ${token}`,
-            "Content-Type": "application/json"
-          },
-          body: groupJson
-        })
-      );
-      if (!groupResponse.ok) {
-        const errorBody = await groupResponse.json().catch(() => ({}));
-        await abortStagedUpload(deployUrl, appId, uploadId, totalGroups, token);
-        spinner2.stop("Deploy failed");
-        output.die(
-          `Asset upload failed on group ${index + 1}/${totalGroups}: ${errorBody.error ?? `HTTP ${groupResponse.status}`}`,
-          "upload_failed"
-        );
-      }
-    }
-  } catch (error) {
-    await abortStagedUpload(deployUrl, appId, uploadId, totalGroups, token);
-    spinner2.stop("Deploy failed");
-    output.die(`Asset upload failed (network): ${errorMessage4(error)}`, "upload_failed");
-  }
+  await requireAssetTransport(deployUrl, spinner2, output);
+  await uploadDeployAssets({ deployUrl, appId, token, assets: bundle.assets, output, spinner: spinner2 });
   spinner2.message(`Deploying ${appName}...`);
   let confirmRename = options.rename;
   const bail = async (message, stopLabel = "Deploy failed", code, actionRequired = false, action) => {
-    await abortStagedUpload(deployUrl, appId, uploadId, totalGroups, token);
     if (stopLabel !== null) spinner2.stop(stopLabel);
     p10.cancel(code ? withSlug(message, code) : message);
     if (action) printAction(action);
@@ -5288,8 +5316,7 @@ async function deployBuiltBundle(options) {
       new Blob([bundle.workerJs], { type: "application/javascript" }),
       "worker.js"
     );
-    form.append("uploadId", uploadId);
-    form.append("totalGroups", String(totalGroups));
+    form.append("assetManifest", JSON.stringify(assetManifest(bundle.assets)));
     form.append("appMigrations", JSON.stringify(bundle.appMigrations));
     if (bundle.doManifest) form.append("doManifest", JSON.stringify(bundle.doManifest));
     if (bundle.customBindings.length) {
@@ -5368,7 +5395,11 @@ async function deployBuiltBundle(options) {
     );
   }
   if (!response.ok || !body.success) {
-    await bail(formatDeployWorkerError(response.status, body.error), "Deploy failed", body.code);
+    await bail(
+      formatDeployWorkerError(response.status, body.error, body.code),
+      "Deploy failed",
+      body.code
+    );
   }
   if (body.onBehalfOfOwner) {
     p10.log.warn(`Deployed on behalf of owner ${body.onBehalfOfOwner}`);
@@ -5385,17 +5416,139 @@ async function deployBuiltBundle(options) {
   }
   return body;
 }
-async function abortStagedUpload(deployUrl, appId, uploadId, totalGroups, token) {
+function assetManifest(assets) {
+  return assets.map((asset) => ({ path: asset.path, hash: asset.hash, size: asset.size }));
+}
+async function requireAssetTransport(deployUrl, spinner2, output) {
+  let advertised;
   try {
-    await fetch(
-      `${deployUrl}/api/deploy/${appId}/assets?uploadId=${uploadId}&totalGroups=${totalGroups}`,
-      { method: "DELETE", headers: { Authorization: `Bearer ${token}` } }
+    const response = await fetch(`${deployUrl}/api/health`);
+    if (!response.ok) throw new Error(`HTTP ${response.status}`);
+    const body = await response.json();
+    advertised = body.capabilities?.assetTransport;
+  } catch (error) {
+    spinner2.stop("Deploy failed");
+    output.die(
+      `Could not reach the DeepSpace deploy service at ${deployUrl} to check its capabilities: ${errorMessage4(error)}`,
+      "deploy_service_unreachable"
     );
-  } catch {
+  }
+  if (advertised !== REQUIRED_ASSET_TRANSPORT) {
+    spinner2.stop("Deploy failed");
+    output.die(
+      `The DeepSpace deploy service at ${deployUrl} does not support this CLI's asset transport (needs "${REQUIRED_ASSET_TRANSPORT}", found ${advertised === void 0 ? "none" : `"${String(advertised)}"`}). Wait for the platform to finish updating, or pin an older deepspace CLI.`,
+      "asset_transport_unsupported"
+    );
+  }
+}
+async function uploadDeployAssets(options) {
+  const { deployUrl, appId, token, assets, spinner: spinner2 } = options;
+  const output = options.output;
+  const byHash = new Map(assets.map((asset) => [asset.hash, asset]));
+  spinner2.message("Checking which assets are already uploaded...");
+  let planResponse;
+  try {
+    planResponse = await postWithRetry(`${deployUrl}/api/deploy/${appId}/asset-plan`, () => ({
+      method: "POST",
+      headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+      body: JSON.stringify({
+        assets: [...byHash.values()].map((asset) => ({ hash: asset.hash, size: asset.size }))
+      })
+    }));
+  } catch (error) {
+    spinner2.stop("Deploy failed");
+    output.die(`Asset plan failed (network): ${errorMessage4(error)}`, "upload_failed");
+  }
+  const planBody = await planResponse.json().catch(() => ({}));
+  if (!planResponse.ok) {
+    spinner2.stop("Deploy failed");
+    output.die(
+      formatDeployWorkerError(planResponse.status, planBody.error, planBody.code),
+      planBody.code ?? "upload_failed"
+    );
+  }
+  const missing = [];
+  for (const hash of planBody.missing ?? []) {
+    const asset = byHash.get(hash);
+    if (!asset) {
+      spinner2.stop("Deploy failed");
+      output.die(
+        `The deploy service asked for asset ${hash}, which is not part of this build. Re-run the deploy; if it persists, report the app id.`,
+        "upload_failed"
+      );
+    }
+    missing.push(asset);
+  }
+  if (missing.length === 0) {
+    p10.log.info(`Assets: ${byHash.size} file(s), all already uploaded`);
+    return;
+  }
+  const missingBytes = missing.reduce((total, asset) => total + asset.size, 0);
+  p10.log.info(
+    `Assets: ${byHash.size} file(s), uploading ${missing.length} (${Math.ceil(missingBytes / 1024)} KiB); the rest are already stored`
+  );
+  let uploaded = 0;
+  const next = () => missing.pop();
+  const worker = async () => {
+    for (let asset = next(); asset; asset = next()) {
+      const response = await postWithRetry(
+        `${deployUrl}/api/deploy/${appId}/assets/${asset.hash}`,
+        () => ({
+          method: "PUT",
+          headers: {
+            Authorization: `Bearer ${token}`,
+            "Content-Type": "application/octet-stream"
+          },
+          // Read whole, per attempt. The platform matches Content-Length
+          // against the plan before it touches storage, and a stream body
+          // would be sent chunked with no length at all; a retry also needs a
+          // body it can send again.
+          body: readFileSync18(asset.sourcePath)
+        })
+      );
+      if (!response.ok) {
+        const body = await response.json().catch(() => ({}));
+        throw new AssetUploadError(
+          body.error ?? `Upload of ${asset.path} failed: HTTP ${response.status}`,
+          body.code ?? "upload_failed",
+          response.status
+        );
+      }
+      uploaded++;
+      spinner2.message(`Uploading assets \u2014 ${uploaded}/${uploaded + missing.length}...`);
+    }
+  };
+  try {
+    await Promise.all(
+      Array.from({ length: Math.min(UPLOAD_CONCURRENCY, missing.length) }, worker)
+    );
+  } catch (error) {
+    spinner2.stop("Deploy failed");
+    if (error instanceof AssetUploadError) {
+      output.die(formatDeployWorkerError(error.status, error.message, error.code), error.code);
+    }
+    output.die(`Asset upload failed (network): ${errorMessage4(error)}`, "upload_failed");
   }
 }
-function formatDeployWorkerError(status3, error) {
+var AssetUploadError = class extends Error {
+  constructor(message, code, status3) {
+    super(message);
+    this.code = code;
+    this.status = status3;
+  }
+};
+function isDeployServiceResourceLimit(status3, error) {
+  if (!error) return status3 === 500 || status3 === 502;
+  return /\b110[12]\b/.test(error) && /worker|error code/i.test(error);
+}
+function formatDeployWorkerError(status3, error, code) {
   const detail = error ?? `Deployment error (${status3})`;
+  if (code === "cli_outdated") return detail;
+  if (isDeployServiceResourceLimit(status3, error)) {
+    return `${DEPLOY_SERVICE_LIMIT_HINT}
+
+Underlying error: ${detail}`;
+  }
   if (status3 < 500 && ![
     "Upload session failed",
     "Asset upload failed",
@@ -5412,23 +5565,6 @@ Underlying error: ${detail}`;
 function errorMessage4(error) {
   return error instanceof Error ? error.message : String(error);
 }
-function packAssetGroups(assets, maxBytes) {
-  const groups = [];
-  let current = [];
-  let currentBytes = 2;
-  for (const asset of assets) {
-    const entryBytes = Buffer.byteLength(JSON.stringify(asset), "utf-8") + 1;
-    if (current.length > 0 && currentBytes + entryBytes > maxBytes) {
-      groups.push(current);
-      current = [];
-      currentBytes = 2;
-    }
-    current.push(asset);
-    currentBytes += entryBytes;
-  }
-  if (current.length > 0) groups.push(current);
-  return groups;
-}
 async function postWithRetry(url, makeInit, {
   attempts = 4,
   retryServerErrors = true
@@ -5445,7 +5581,7 @@ async function postWithRetry(url, makeInit, {
       lastError = error;
     }
     if (attempt < attempts) {
-      await new Promise((resolve18) => setTimeout(resolve18, Math.min(8e3, 500 * 2 ** (attempt - 1))));
+      await new Promise((resolve19) => setTimeout(resolve19, Math.min(8e3, 500 * 2 ** (attempt - 1))));
     }
   }
   if (lastResponse) return lastResponse;
@@ -5454,7 +5590,7 @@ async function postWithRetry(url, makeInit, {
 
 // src/cli/commands/deploy/secrets.ts
 import * as p11 from "@clack/prompts";
-import { existsSync as existsSync18, readFileSync as readFileSync18 } from "fs";
+import { existsSync as existsSync18, readFileSync as readFileSync19 } from "fs";
 function classifyDevVarsSecrets(options) {
   const store = new Set(options.storeSecretNames);
   const strayKeys = options.handEditedDevVarKeys.filter((key) => !store.has(key));
@@ -5553,7 +5689,7 @@ function prepareDeploySecrets(options) {
 }
 function readCustomDevVars(path, output) {
   if (!existsSync18(path)) return {};
-  const section = extractCustomDevVars(stripGeneratedSecretsCache(readFileSync18(path, "utf-8")));
+  const section = extractCustomDevVars(stripGeneratedSecretsCache(readFileSync19(path, "utf-8")));
   if (!section) return {};
   try {
     return parseDevVars(section);
@@ -5827,7 +5963,7 @@ async function waitForAssetsReady(url, timeoutMs) {
       if (!body.includes("Assets have not yet deployed") && !body.includes("No app configured")) {
         streak++;
         if (streak >= 3) return true;
-        await new Promise((resolve18) => setTimeout(resolve18, 1500));
+        await new Promise((resolve19) => setTimeout(resolve19, 1500));
         continue;
       }
       streak = 0;
@@ -5835,7 +5971,7 @@ async function waitForAssetsReady(url, timeoutMs) {
       streak = 0;
     }
     const waitMs = Math.min(8e3, 1e3 * 2 ** (attempt - 1));
-    await new Promise((resolve18) => setTimeout(resolve18, waitMs));
+    await new Promise((resolve19) => setTimeout(resolve19, waitMs));
   }
   return false;
 }
@@ -6479,7 +6615,7 @@ var usage_default = defineDeepspaceCommand({
 });
 
 // src/cli/commands/add.ts
-import { existsSync as existsSync20, readFileSync as readFileSync20, realpathSync as realpathSync3 } from "fs";
+import { existsSync as existsSync20, readFileSync as readFileSync21, realpathSync as realpathSync3 } from "fs";
 import { dirname as dirname7, join as join19, resolve as resolve14 } from "path";
 import { pathToFileURL as pathToFileURL3 } from "url";
 
@@ -6492,7 +6628,7 @@ import {
   mkdirSync as mkdirSync6,
   mkdtempSync,
   openSync as openSync2,
-  readFileSync as readFileSync19,
+  readFileSync as readFileSync20,
   readSync,
   readdirSync as readdirSync5,
   rmSync as rmSync4,
@@ -6509,7 +6645,7 @@ function featurePackageRoot(moduleUrl = import.meta.url) {
     const packagePath = join18(dir, "package.json");
     if (existsSync19(packagePath)) {
       try {
-        const pkg2 = JSON.parse(readFileSync19(packagePath, "utf-8"));
+        const pkg2 = JSON.parse(readFileSync20(packagePath, "utf-8"));
         if (pkg2.name === "deepspace") return dir;
       } catch {
       }
@@ -6526,7 +6662,7 @@ function readFeatureConfig(id, packageRoot = featurePackageRoot()) {
   const configPath = join18(packageRoot, "features", id, "feature.json");
   if (!existsSync19(configPath)) return null;
   try {
-    const config = JSON.parse(readFileSync19(configPath, "utf-8"));
+    const config = JSON.parse(readFileSync20(configPath, "utf-8"));
     if (typeof config.id !== "string" || typeof config.name !== "string" || !Array.isArray(config.files)) {
       return null;
     }
@@ -6591,7 +6727,7 @@ function copyFile(src, dest) {
 function copyFileWithImportShift(src, dest, levels) {
   mkdirSync6(dirname6(dest), { recursive: true });
   const prefix = "../".repeat(levels);
-  const shifted = readFileSync19(src, "utf-8").replace(
+  const shifted = readFileSync20(src, "utf-8").replace(
     /(from\s+|import\s+|import\()(['"])(\.\.\/)/g,
     `$1$2${prefix}$3`
   );
@@ -6650,7 +6786,7 @@ function integrateSchema(config, targetDir, emit) {
   if (!existsSync19(schemasPath)) {
     return [unresolvedSchema(config.schema, "src/schemas.ts was not found.", emit)];
   }
-  let content = readFileSync19(schemasPath, "utf-8");
+  let content = readFileSync20(schemasPath, "utf-8");
   const { exportName, importPath, spreadOperator } = config.schema;
   const importPattern = new RegExp(`^import\\s+\\{[^}]*\\b${exportName}\\b`, "m");
   if (importPattern.test(content)) {
@@ -6707,7 +6843,7 @@ function integrateActions(config, targetDir, emit) {
   if (!existsSync19(actionsPath)) {
     return [unresolvedActions(config.actions, "src/actions/index.ts was not found.", emit)];
   }
-  let content = readFileSync19(actionsPath, "utf-8");
+  let content = readFileSync20(actionsPath, "utf-8");
   const registryPattern = /export const actions:\s*Record<string,\s*ActionHandler(?:<[^>]*>)?>\s*=\s*\{/;
   if (!registryPattern.test(content)) {
     const reason = "src/actions/index.ts has an unexpected structure.";
@@ -6762,7 +6898,7 @@ function integrateCode(config, targetDir, emit) {
       });
       continue;
     }
-    const original = readFileSync19(targetPath, "utf-8");
+    const original = readFileSync20(targetPath, "utf-8");
     if (original.includes(insertion.insert.trim())) {
       emit(`   Integration already present: ${insertion.file}`);
       continue;
@@ -6798,7 +6934,7 @@ ${content.slice(importIndex < 0 ? 0 : importIndex)}`;
 function integrateIgnore(config, targetDir) {
   if (!config.ignore?.length) return;
   const targetPath = join18(targetDir, ".gitignore");
-  const current = existsSync19(targetPath) ? readFileSync19(targetPath, "utf-8") : "";
+  const current = existsSync19(targetPath) ? readFileSync20(targetPath, "utf-8") : "";
   const present = new Set(current.split(/\r?\n/).map((line) => line.trim()));
   const missing = config.ignore.filter((pattern) => !present.has(pattern));
   if (missing.length === 0) return;
@@ -6818,7 +6954,7 @@ function integrateWrangler(config, targetDir, emit) {
   if (!existsSync19(targetPath)) {
     return [{ area: "wrangler", reason: "wrangler.toml was not found.", steps }];
   }
-  let source = readFileSync19(targetPath, "utf-8");
+  let source = readFileSync20(targetPath, "utf-8");
   if (runWorkerFirst && !/^\[assets\]\s*$/m.test(source)) {
     return [{ area: "wrangler", reason: "wrangler.toml has no [assets] section.", steps }];
   }
@@ -6907,7 +7043,7 @@ function integrateCss(packageRoot, config, targetDir, emit) {
       }
     ];
   }
-  let styles = readFileSync19(stylesPath, "utf-8");
+  let styles = readFileSync20(stylesPath, "utf-8");
   let integrated = 0;
   const unresolved = [];
   for (const cssFile of config.css) {
@@ -6921,7 +7057,7 @@ function integrateCss(packageRoot, config, targetDir, emit) {
       });
       continue;
     }
-    const css = readFileSync19(srcPath, "utf-8");
+    const css = readFileSync20(srcPath, "utf-8");
     const fingerprint = css.match(/\.([\w-]+)\s*\{|@keyframes\s+([\w-]+)/);
     const marker = fingerprint?.[1] ?? fingerprint?.[2];
     if (marker && styles.includes(marker)) {
@@ -6952,7 +7088,7 @@ function integrateRoute(config, targetDir, emit) {
   if (!existsSync19(navPath)) {
     return [unresolvedRoute(config.route, config, "src/nav.ts was not found.", emit)];
   }
-  let content = readFileSync19(navPath, "utf-8");
+  let content = readFileSync20(navPath, "utf-8");
   const routePath = config.route.path;
   if (content.includes(`'${routePath}'`)) {
     emit(`   Nav already present: ${routePath}`);
@@ -7033,7 +7169,7 @@ function integrateDependencies(config, targetDir, runInstall, outputVisible, emi
   }
   let pkg2;
   try {
-    pkg2 = JSON.parse(readFileSync19(packagePath, "utf-8"));
+    pkg2 = JSON.parse(readFileSync20(packagePath, "utf-8"));
   } catch (error) {
     emit(
       `   Could not patch package.json (parse error: ${error instanceof Error ? error.message : String(error)})`
@@ -7093,7 +7229,7 @@ ${child.diagnosticTail}` : "";
 }
 function dependencySnapshot(targetDir) {
   try {
-    const pkg2 = JSON.parse(readFileSync19(join18(targetDir, "package.json"), "utf-8"));
+    const pkg2 = JSON.parse(readFileSync20(join18(targetDir, "package.json"), "utf-8"));
     return {
       dependencies: pkg2.dependencies ?? {},
       devDependencies: pkg2.devDependencies ?? {}
@@ -7342,7 +7478,7 @@ function isDeepSpaceApp(dir) {
   const packagePath = join19(dir, "package.json");
   if (!existsSync20(packagePath)) return false;
   try {
-    const pkg2 = JSON.parse(readFileSync20(packagePath, "utf-8"));
+    const pkg2 = JSON.parse(readFileSync21(packagePath, "utf-8"));
     return Boolean(pkg2.dependencies?.deepspace || pkg2.devDependencies?.deepspace);
   } catch {
     return false;
@@ -7545,11 +7681,11 @@ function fmtDate(iso) {
 }
 async function confirm4(message) {
   process.stdout.write(`${message} [y/N] `);
-  return new Promise((resolve18) => {
+  return new Promise((resolve19) => {
     process.stdin.setEncoding("utf-8");
     process.stdin.once("data", (data) => {
       const answer = data.toString().trim().toLowerCase();
-      resolve18(answer === "y" || answer === "yes");
+      resolve19(answer === "y" || answer === "yes");
     });
   });
 }
@@ -7837,8 +7973,289 @@ var domain_default = defineCommand5({
   subCommands: { search, buy, list: list2, status, attach, detach, renew }
 });
 
-// src/cli/commands/collaborators.ts
+// src/cli/commands/app-files.ts
 import { defineCommand as defineCommand6 } from "citty";
+import { basename as basename4, resolve as resolve15 } from "path";
+import { existsSync as existsSync21, statSync as statSync2 } from "fs";
+
+// src/cli/lib/app-files-api.ts
+import { createWriteStream, openAsBlob, statSync } from "fs";
+import { basename as basename3, extname } from "path";
+import { Readable } from "stream";
+import { pipeline } from "stream/promises";
+import { randomUUID as randomUUID2 } from "crypto";
+var CONTENT_TYPES = {
+  ".avif": "image/avif",
+  ".css": "text/css",
+  ".csv": "text/csv",
+  ".gif": "image/gif",
+  ".ico": "image/x-icon",
+  ".jpeg": "image/jpeg",
+  ".jpg": "image/jpeg",
+  ".json": "application/json",
+  ".md": "text/markdown",
+  ".mp3": "audio/mpeg",
+  ".mp4": "video/mp4",
+  ".otf": "font/otf",
+  ".pdf": "application/pdf",
+  ".png": "image/png",
+  ".txt": "text/plain",
+  ".wasm": "application/wasm",
+  ".wav": "audio/wav",
+  ".webm": "video/webm",
+  ".webp": "image/webp",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2",
+  ".zip": "application/zip"
+};
+function contentTypeFor(path) {
+  return CONTENT_TYPES[extname(path).toLowerCase()] ?? "application/octet-stream";
+}
+function filesPath(appId, rest = "") {
+  return `/api/app-files/${appId}${rest}`;
+}
+async function request(baseUrl, token, path, init = {}) {
+  let res;
+  try {
+    res = await fetch(`${baseUrl}${path}`, {
+      ...init,
+      headers: { Authorization: `Bearer ${token}`, ...init.headers ?? {} }
+    });
+  } catch (err) {
+    throw new ApiError(
+      `Could not reach the DeepSpace platform at ${baseUrl}: ${err instanceof Error ? err.message : String(err)}. Check your connection (and DEEPSPACE_PLATFORM_URL), then retry.`,
+      0,
+      "network_error",
+      path
+    );
+  }
+  if (res.ok) return res;
+  const text2 = await res.text();
+  let code;
+  try {
+    code = JSON.parse(text2.trim()).code;
+  } catch {
+  }
+  throw new ApiError(
+    describeFilesFailure(res.status, text2),
+    res.status,
+    code ?? (res.status === 413 ? "file_too_large" : res.status >= 500 ? "server_error" : "http_error"),
+    path
+  );
+}
+async function readJson(res, path) {
+  const text2 = await res.text();
+  try {
+    return JSON.parse(text2);
+  } catch {
+    throw new ApiError(
+      `The DeepSpace platform returned a malformed (non-JSON) response.`,
+      res.status,
+      "invalid_response",
+      path
+    );
+  }
+}
+async function multipartBody(localPath, fileName, contentType) {
+  const boundary = `----deepspace${randomUUID2().replace(/-/g, "")}`;
+  const safeName = fileName.replace(/["\\\r\n]/g, "_");
+  const head = `--${boundary}\r
+Content-Disposition: form-data; name="file"; filename="${safeName}"\r
+Content-Type: ${contentType}\r
+\r
+`;
+  const file = await openAsBlob(localPath, { type: contentType });
+  return {
+    blob: new Blob([head, file, `\r
+--${boundary}--\r
+`]),
+    contentType: `multipart/form-data; boundary=${boundary}`
+  };
+}
+async function uploadAppFile(baseUrl, token, appId, localPath, key) {
+  const path = filesPath(appId, `/upload?key=${encodeKeyPath(key)}`);
+  const size = statSync(localPath).size;
+  if (size > MAX_APP_FILE_BYTES) {
+    throw new ApiError(oversizeMessage(size), 0, "file_too_large", path);
+  }
+  const { blob, contentType } = await multipartBody(
+    localPath,
+    basename3(localPath),
+    contentTypeFor(localPath)
+  );
+  const res = await request(baseUrl, token, path, {
+    method: "POST",
+    headers: { "Content-Type": contentType },
+    body: blob
+  });
+  const body = await readJson(res, path);
+  return { key: body.key, name: body.name, size };
+}
+async function listAppFiles(baseUrl, token, appId, query) {
+  const path = filesPath(appId, `?${query}`);
+  return readJson(await request(baseUrl, token, path), path);
+}
+async function deleteAppFile(baseUrl, token, appId, key) {
+  await request(baseUrl, token, filesPath(appId, `/${encodeKeyPath(key)}`), { method: "DELETE" });
+}
+async function downloadAppFile(baseUrl, token, appId, key, destination) {
+  const path = filesPath(appId, `/${encodeKeyPath(key)}`);
+  const res = await request(baseUrl, token, path);
+  if (!res.body) {
+    throw new ApiError("The server returned an empty response", 502, "invalid_response", path);
+  }
+  let bytes = 0;
+  await pipeline(
+    Readable.fromWeb(res.body),
+    async function* (chunks) {
+      for await (const chunk of chunks) {
+        bytes += chunk.length;
+        yield chunk;
+      }
+    },
+    createWriteStream(destination)
+  );
+  return { bytes, contentType: res.headers.get("content-type") ?? "application/octet-stream" };
+}
+
+// src/cli/commands/app-files.ts
+var DEPLOY_URL8 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
+var PLATFORM_URL = process.env.DEEPSPACE_PLATFORM_URL ?? PLATFORM_URLS.platform;
+async function target(app2) {
+  const token = await ensureToken();
+  const appId = await resolveAppTarget(DEPLOY_URL8, token, app2);
+  return { token, appId };
+}
+var MAX_LIST_LIMIT = 1e3;
+function parseLimit(raw) {
+  const limit = Number(raw ?? 100);
+  if (!Number.isInteger(limit) || limit < 1 || limit > MAX_LIST_LIMIT) {
+    throw new Refusal(`--limit must be a whole number from 1 to ${MAX_LIST_LIMIT}.`, "invalid_limit");
+  }
+  return limit;
+}
+function requireKey(raw) {
+  const key = raw.trim().replace(/^\/+/, "");
+  if (!key) throw new Refusal("A key is required (for example `logo.png`).", "invalid_key");
+  if (key.split("/").some((segment) => segment === ".." || segment === ".")) {
+    throw new Refusal(
+      `"${raw}" contains a path traversal segment. Keys are relative to the app, e.g. \`img/hero.jpg\`.`,
+      "invalid_key"
+    );
+  }
+  return key;
+}
+function appPrefixOf(key) {
+  const segments = key.split("/");
+  return segments.length > 2 ? `${segments[0]}/${segments[1]}/` : "";
+}
+function relativeKey(key, prefix) {
+  return prefix && key.startsWith(prefix) ? key.slice(prefix.length) : key;
+}
+function servedPath(key) {
+  return `/api/files/${encodeKeyPath(key)}?scope=app`;
+}
+var put = defineDeepspaceCommand({
+  meta: { name: "put", description: "Upload a file to the app\u2019s files" },
+  args: {
+    file: { type: "positional", description: "Local file to upload", required: true },
+    key: { type: "string", description: "Key to store it under (default: the file name)" },
+    app: { type: "string", description: "App id or live name (defaults to ./wrangler.toml)" }
+  },
+  async run({ args }) {
+    const localPath = resolve15(String(args.file));
+    if (!existsSync21(localPath) || !statSync2(localPath).isFile()) {
+      throw new Refusal(`No such file: ${args.file}`, "file_not_found");
+    }
+    const key = requireKey(args.key ?? basename4(localPath));
+    const { token, appId } = await target(args.app);
+    const result = await uploadAppFile(PLATFORM_URL, token, appId, localPath, key);
+    if (!args.json) {
+      console.log(`\u2713 ${key} (${formatBytes(result.size)})`);
+      console.log(`  Served from your app at ${servedPath(result.key)}`);
+    }
+    return { data: { appId, key, storedKey: result.key, size: result.size, path: servedPath(result.key) } };
+  }
+});
+var list3 = defineDeepspaceCommand({
+  meta: { name: "list", description: "List the app\u2019s files" },
+  args: {
+    prefix: { type: "string", description: "Only keys starting with this prefix" },
+    limit: {
+      type: "string",
+      description: `Max entries, 1-${MAX_LIST_LIMIT} (default 100)`,
+      default: "100"
+    },
+    app: { type: "string", description: "App id or live name (defaults to ./wrangler.toml)" }
+  },
+  async run({ args }) {
+    const limit = parseLimit(args.limit);
+    const { token, appId } = await target(args.app);
+    const query = new URLSearchParams({ limit: String(limit) });
+    if (args.prefix) query.set("prefix", String(args.prefix));
+    const result = await listAppFiles(PLATFORM_URL, token, appId, query);
+    const prefix = result.files.length ? appPrefixOf(result.files[0].key) : "";
+    const files = result.files.map((file) => ({
+      key: relativeKey(file.key, prefix),
+      size: file.size,
+      uploaded: file.uploaded,
+      path: servedPath(file.key)
+    }));
+    if (!args.json) {
+      if (files.length === 0) {
+        console.log("No files. Upload one with `deepspace app files put <file>`.");
+      } else {
+        const keyWidth = Math.max(3, ...files.map((file) => file.key.length));
+        console.log(`${"KEY".padEnd(keyWidth)}  ${"SIZE".padStart(9)}  UPLOADED`);
+        for (const file of files) {
+          console.log(
+            `${file.key.padEnd(keyWidth)}  ${formatBytes(file.size).padStart(9)}  ${file.uploaded.slice(0, 10)}`
+          );
+        }
+        const more = limit < MAX_LIST_LIMIT ? "raise --limit or narrow with --prefix" : "narrow with --prefix";
+        if (result.truncated) console.log(`(truncated at ${limit} \u2014 ${more})`);
+      }
+    }
+    return { data: { appId, files, truncated: result.truncated } };
+  }
+});
+var get = defineDeepspaceCommand({
+  meta: { name: "get", description: "Download one file" },
+  args: {
+    key: { type: "positional", description: "Key to download", required: true },
+    out: { type: "string", description: "Write here (default: the key\u2019s file name)" },
+    app: { type: "string", description: "App id or live name (defaults to ./wrangler.toml)" }
+  },
+  async run({ args }) {
+    const key = requireKey(String(args.key));
+    const destination = resolve15(String(args.out ?? basename4(key)));
+    const { token, appId } = await target(args.app);
+    const result = await downloadAppFile(PLATFORM_URL, token, appId, key, destination);
+    if (!args.json) console.log(`\u2713 ${key} \u2192 ${destination} (${formatBytes(result.bytes)})`);
+    return { data: { appId, key, out: destination, size: result.bytes, contentType: result.contentType } };
+  }
+});
+var rm = defineDeepspaceCommand({
+  meta: { name: "rm", description: "Delete one file" },
+  args: {
+    key: { type: "positional", description: "Key to delete", required: true },
+    app: { type: "string", description: "App id or live name (defaults to ./wrangler.toml)" }
+  },
+  async run({ args }) {
+    const key = requireKey(String(args.key));
+    const { token, appId } = await target(args.app);
+    await deleteAppFile(PLATFORM_URL, token, appId, key);
+    if (!args.json) console.log(`\u2713 deleted ${key}`);
+    return { data: { appId, key, deleted: true } };
+  }
+});
+var app_files_default = defineCommand6({
+  meta: { name: "files", description: "Upload and manage the app\u2019s files (images, media)" },
+  subCommands: { put, list: list3, get, rm }
+});
+
+// src/cli/commands/collaborators.ts
+import { defineCommand as defineCommand7 } from "citty";
 
 // src/server/auth/testAccounts.ts
 var TEST_ACCOUNT_EMAIL_SUFFIX = "@deepspace.test";
@@ -7848,18 +8265,18 @@ function isTestAccountEmail(email) {
 
 // src/cli/commands/collaborators.ts
 var API_URL5 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
-var DEPLOY_URL8 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
+var DEPLOY_URL9 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 function api2(token, path, init) {
   return apiFetch(API_URL5, token, path, init);
 }
-var list3 = defineDeepspaceCommand({
+var list4 = defineDeepspaceCommand({
   meta: { name: "list", description: "List collaborators on your app" },
   args: {
     app: { type: "string", alias: "a", description: "App id or name (defaults to ./wrangler.toml)" }
   },
   async run({ args }) {
     const token = await ensureToken();
-    const app2 = await resolveAppTarget(DEPLOY_URL8, token, args.app);
+    const app2 = await resolveAppTarget(DEPLOY_URL9, token, args.app);
     const { collaborators, pending = [] } = await api2(token, `/api/app-collaborators/${encodeURIComponent(app2)}`);
     if (!collaborators.length && !pending.length) {
       if (!args.json) {
@@ -7897,7 +8314,7 @@ var add = defineDeepspaceCommand({
   async run({ args }) {
     const email = String(args.email);
     const token = await ensureToken();
-    const app2 = await resolveAppTarget(DEPLOY_URL8, token, args.app);
+    const app2 = await resolveAppTarget(DEPLOY_URL9, token, args.app);
     if (isTestAccountEmail(email)) {
       throw new Refusal(
         "Test accounts (@deepspace.test) cannot be added as collaborators. Use a real DeepSpace account.",
@@ -7939,13 +8356,13 @@ var remove = defineDeepspaceCommand({
   async run({ args }) {
     const email = String(args.email);
     const token = await ensureToken();
-    const app2 = await resolveAppTarget(DEPLOY_URL8, token, args.app);
+    const app2 = await resolveAppTarget(DEPLOY_URL9, token, args.app);
     const { collaborators } = await api2(
       token,
       `/api/app-collaborators/${encodeURIComponent(app2)}`
     );
-    const target = email.trim().toLowerCase();
-    const found = collaborators.find((c) => c.emailDisplay.toLowerCase() === target);
+    const target2 = email.trim().toLowerCase();
+    const found = collaborators.find((c) => c.emailDisplay.toLowerCase() === target2);
     if (!found) {
       throw new Refusal(`${email} is not a collaborator on ${app2}`, "not_a_collaborator", {
         action: cliAction("deepspace", "app", "collaborators", "list", "--app", app2)
@@ -7969,13 +8386,13 @@ var cancel3 = defineDeepspaceCommand({
   async run({ args }) {
     const email = String(args.email);
     const token = await ensureToken();
-    const app2 = await resolveAppTarget(DEPLOY_URL8, token, args.app);
+    const app2 = await resolveAppTarget(DEPLOY_URL9, token, args.app);
     const { pending = [] } = await api2(
       token,
       `/api/app-collaborators/${encodeURIComponent(app2)}`
     );
-    const target = email.trim().toLowerCase();
-    const found = pending.find((p34) => p34.email.toLowerCase() === target);
+    const target2 = email.trim().toLowerCase();
+    const found = pending.find((p34) => p34.email.toLowerCase() === target2);
     if (!found) {
       throw new Refusal(`${email} has no pending invite on ${app2}`, "no_pending_invite", {
         action: cliAction("deepspace", "app", "collaborators", "list", "--app", app2)
@@ -7990,16 +8407,16 @@ var cancel3 = defineDeepspaceCommand({
     return { data: { cancelled: found } };
   }
 });
-var collaborators_default = defineCommand6({
+var collaborators_default = defineCommand7({
   meta: { name: "collaborators", description: "Manage who can deploy your app" },
-  subCommands: { list: list3, add, remove, cancel: cancel3 }
+  subCommands: { list: list4, add, remove, cancel: cancel3 }
 });
 
 // src/cli/commands/transfer.ts
-import { defineCommand as defineCommand7 } from "citty";
+import { defineCommand as defineCommand8 } from "citty";
 import * as p14 from "@clack/prompts";
 var API_URL6 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
-var DEPLOY_URL9 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
+var DEPLOY_URL10 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 var offer = defineDeepspaceCommand({
   meta: { name: "offer", description: "Offer this app to another DeepSpace user" },
   args: {
@@ -8013,7 +8430,7 @@ var offer = defineDeepspaceCommand({
   async run({ args }) {
     const email = String(args.email);
     const token = await ensureToken();
-    const app2 = await resolveAppTarget(DEPLOY_URL9, token, args.app);
+    const app2 = await resolveAppTarget(DEPLOY_URL10, token, args.app);
     const pending = await apiFetch(
       API_URL6,
       token,
@@ -8065,7 +8482,7 @@ var status2 = defineDeepspaceCommand({
   },
   async run({ args }) {
     const token = await ensureToken();
-    const app2 = await resolveAppTarget(DEPLOY_URL9, token, args.app);
+    const app2 = await resolveAppTarget(DEPLOY_URL10, token, args.app);
     const { transfer } = await apiFetch(API_URL6, token, `/api/app-transfers/${encodeURIComponent(app2)}`);
     if (!transfer) {
       if (!args.json) console.log(`No pending transfer for ${app2}.`);
@@ -8092,7 +8509,7 @@ var accept = defineDeepspaceCommand({
       const msg = err instanceof Error ? err.message : String(err);
       throw new Refusal(msg, msg.startsWith("No app id") ? "not_in_app_repo" : "invalid_app");
     }
-    await apiFetch(DEPLOY_URL9, token, `/api/apps/${encodeURIComponent(app2)}/transfer/accept`, {
+    await apiFetch(DEPLOY_URL10, token, `/api/apps/${encodeURIComponent(app2)}/transfer/accept`, {
       method: "POST"
     });
     if (!args.json) {
@@ -8110,37 +8527,37 @@ var cancel4 = defineDeepspaceCommand({
   },
   async run({ args }) {
     const token = await ensureToken();
-    const app2 = await resolveAppTarget(DEPLOY_URL9, token, args.app);
+    const app2 = await resolveAppTarget(DEPLOY_URL10, token, args.app);
     await apiFetch(API_URL6, token, `/api/app-transfers/${encodeURIComponent(app2)}`, { method: "DELETE" });
     if (!args.json) console.log(`\u2713 Transfer offer for ${app2} cancelled.`);
     return { data: { app: app2, cancelled: true } };
   }
 });
-var transfer_default = defineCommand7({
+var transfer_default = defineCommand8({
   meta: { name: "transfer", description: "Transfer app ownership to another user" },
   subCommands: { offer, status: status2, accept, cancel: cancel4 }
 });
 
 // src/cli/commands/integrations.ts
-import { defineCommand as defineCommand8 } from "citty";
+import { defineCommand as defineCommand9 } from "citty";
 
 // src/cli/commands/_invoke-impl.ts
-import { readFileSync as readFileSync21 } from "fs";
+import { readFileSync as readFileSync22 } from "fs";
 import * as p15 from "@clack/prompts";
 var API_URL7 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
 var DEFAULT_TIMEOUT_MS = 12e4;
-function parseTarget(target) {
-  if (!target || typeof target !== "string") {
+function parseTarget(target2) {
+  if (!target2 || typeof target2 !== "string") {
     throw new Refusal(
       "Missing target. Expected '<integration>/<endpoint>' (e.g. 'openai/chat-completion').",
       "missing_target",
       { action: cliAction("deepspace", "integrations", "list") }
     );
   }
-  const parts = target.split("/");
+  const parts = target2.split("/");
   if (parts.length !== 2 || !parts[0] || !parts[1]) {
     throw new Refusal(
-      `Bad target '${target}'. Expected '<integration>/<endpoint>' (e.g. 'openai/chat-completion').`,
+      `Bad target '${target2}'. Expected '<integration>/<endpoint>' (e.g. 'openai/chat-completion').`,
       "bad_target",
       { action: cliAction("deepspace", "integrations", "list") }
     );
@@ -8166,7 +8583,7 @@ function resolveBody(opts) {
   if (opts.body != null) {
     raw = opts.body;
   } else if (opts.bodyFile != null) {
-    raw = opts.bodyFile === "-" ? readFileSync21(0, "utf-8") : readFileSync21(opts.bodyFile, "utf-8");
+    raw = opts.bodyFile === "-" ? readFileSync22(0, "utf-8") : readFileSync22(opts.bodyFile, "utf-8");
   } else {
     return "{}";
   }
@@ -8360,7 +8777,7 @@ async function runInvoke(args) {
 }
 
 // src/cli/commands/integrations.ts
-var list4 = defineDeepspaceCommand({
+var list5 = defineDeepspaceCommand({
   meta: {
     name: "list",
     description: "List all available integrations"
@@ -8431,13 +8848,13 @@ var invoke = defineDeepspaceCommand({
     });
   }
 });
-var integrations_default = defineCommand8({
+var integrations_default = defineCommand9({
   meta: {
     name: "integrations",
     description: "List, inspect, and invoke platform integrations"
   },
   subCommands: {
-    list: list4,
+    list: list5,
     info,
     invoke
   }
@@ -8445,7 +8862,7 @@ var integrations_default = defineCommand8({
 
 // src/cli/commands/feedback.ts
 import * as p16 from "@clack/prompts";
-import { existsSync as existsSync21, readFileSync as readFileSync22 } from "fs";
+import { existsSync as existsSync22, readFileSync as readFileSync23 } from "fs";
 import { dirname as dirname8, join as join20 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { release } from "os";
@@ -8473,8 +8890,8 @@ function readCliVersion() {
       join20(here, "..", "..", "..", "package.json")
     ];
     for (const path of candidates) {
-      if (!existsSync21(path)) continue;
-      const pkg2 = JSON.parse(readFileSync22(path, "utf-8"));
+      if (!existsSync22(path)) continue;
+      const pkg2 = JSON.parse(readFileSync23(path, "utf-8"));
       if (pkg2.name === "deepspace" && pkg2.version) return pkg2.version;
     }
   } catch {
@@ -8669,8 +9086,8 @@ Context: deepspace ${payload.cliVersion} \xB7 ${payload.nodeVersion} \xB7 ${payl
 });
 
 // src/cli/commands/secrets.ts
-import { defineCommand as defineCommand9 } from "citty";
-import { readFileSync as readFileSync23 } from "fs";
+import { defineCommand as defineCommand10 } from "citty";
+import { readFileSync as readFileSync24 } from "fs";
 
 // src/cli/lib/citty-args.ts
 function dedupePositionals(bound, rest) {
@@ -8703,7 +9120,7 @@ function parseCursorArg(raw) {
 }
 
 // src/cli/commands/secrets.ts
-var DEPLOY_URL10 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
+var DEPLOY_URL11 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 var COMMON_ARGS = {
   app: {
     type: "string",
@@ -8773,7 +9190,7 @@ function warnIfDebugRoutesEnabled(secrets) {
 }
 var APPLY_HINT = "Run `deepspace deploy` to apply \u2014 secrets take effect at deploy time.";
 var LOCAL_DEV_HINT = "Running `deepspace dev start`? Restart it to load the change locally.";
-var list5 = defineCommand9({
+var list6 = defineCommand10({
   meta: { name: "list", description: "List masked secrets in a config" },
   args: {
     ...COMMON_ARGS,
@@ -8786,7 +9203,7 @@ var list5 = defineCommand9({
   async run({ args }) {
     try {
       const t = await resolveTarget(args);
-      const { secrets } = await listSecrets(DEPLOY_URL10, t.token, t.appId, t.configName);
+      const { secrets } = await listSecrets(DEPLOY_URL11, t.token, t.appId, t.configName);
       if (args.json) {
         console.log(JSON.stringify({ ok: true, appId: t.appId, config: t.configName, secrets }));
         return;
@@ -8803,7 +9220,7 @@ var list5 = defineCommand9({
     }
   }
 });
-var set = defineCommand9({
+var set = defineCommand10({
   meta: { name: "set", description: "Set secrets from KEY=value pairs" },
   args: {
     ...COMMON_ARGS,
@@ -8831,9 +9248,9 @@ var set = defineCommand9({
       }
       if (Object.keys(secrets).length === 1) {
         const [[k, v]] = Object.entries(secrets);
-        await setSecret(DEPLOY_URL10, t.token, t.appId, t.configName, k, v);
+        await setSecret(DEPLOY_URL11, t.token, t.appId, t.configName, k, v);
       } else {
-        await uploadSecrets(DEPLOY_URL10, t.token, t.appId, t.configName, secrets, false);
+        await uploadSecrets(DEPLOY_URL11, t.token, t.appId, t.configName, secrets, false);
       }
       const n = Object.keys(secrets).length;
       ok(
@@ -8852,7 +9269,7 @@ var set = defineCommand9({
     }
   }
 });
-var get = defineCommand9({
+var get2 = defineCommand10({
   meta: { name: "get", description: "Get a secret; pass --plain to print the value" },
   args: {
     ...COMMON_ARGS,
@@ -8864,11 +9281,11 @@ var get = defineCommand9({
       const t = await resolveTarget(args);
       const key = validateSecretName(args.key);
       if (args.plain) {
-        const { value } = await getSecretPlain(DEPLOY_URL10, t.token, t.appId, t.configName, key);
+        const { value } = await getSecretPlain(DEPLOY_URL11, t.token, t.appId, t.configName, key);
         process.stdout.write(process.stdout.isTTY ? value + "\n" : value);
         return;
       }
-      const { secrets } = await listSecrets(DEPLOY_URL10, t.token, t.appId, t.configName);
+      const { secrets } = await listSecrets(DEPLOY_URL11, t.token, t.appId, t.configName);
       const item = secrets.find((s) => s.key === key);
       if (!item)
         fail(new InputError(`Secret "${key}" not found in ${t.configName}`, "secret_not_found"));
@@ -8888,7 +9305,7 @@ var get = defineCommand9({
     }
   }
 });
-var del2 = defineCommand9({
+var del2 = defineCommand10({
   meta: { name: "delete", description: "Delete one or more secrets" },
   args: {
     ...COMMON_ARGS,
@@ -8903,7 +9320,7 @@ var del2 = defineCommand9({
       for (const key of keys) {
         const name = validateSecretName(key);
         try {
-          await deleteSecret(DEPLOY_URL10, t.token, t.appId, t.configName, name);
+          await deleteSecret(DEPLOY_URL11, t.token, t.appId, t.configName, name);
           deleted++;
         } catch (err) {
           if (err?.status === 404) absent++;
@@ -8922,7 +9339,7 @@ var del2 = defineCommand9({
     }
   }
 });
-var upload = defineCommand9({
+var upload = defineCommand10({
   meta: { name: "upload", description: "Upload secrets from a dotenv or JSON file" },
   args: {
     ...COMMON_ARGS,
@@ -8940,11 +9357,11 @@ var upload = defineCommand9({
   async run({ args }) {
     try {
       const t = await resolveTarget(args);
-      const content = args.file === "-" ? readFileSync23(0, "utf-8") : readFileSync23(args.file, "utf-8");
+      const content = args.file === "-" ? readFileSync24(0, "utf-8") : readFileSync24(args.file, "utf-8");
       const secrets = parseSecretsUpload(content);
       if (Object.keys(secrets).length === 0)
         fail(new InputError("No secrets found in the input.", "empty_input"));
-      await uploadSecrets(DEPLOY_URL10, t.token, t.appId, t.configName, secrets, args.replace);
+      await uploadSecrets(DEPLOY_URL11, t.token, t.appId, t.configName, secrets, args.replace);
       const uploaded = Object.keys(secrets);
       ok(
         args.json === true,
@@ -8959,7 +9376,7 @@ var upload = defineCommand9({
     }
   }
 });
-var download = defineCommand9({
+var download = defineCommand10({
   meta: { name: "download", description: "Download a config\u2019s secrets (dotenv/json/shell)" },
   args: {
     ...COMMON_ARGS,
@@ -8981,14 +9398,14 @@ var download = defineCommand9({
           )
         );
       }
-      const { secrets } = await fetchSecretsValues(DEPLOY_URL10, t.token, t.appId, t.configName);
+      const { secrets } = await fetchSecretsValues(DEPLOY_URL11, t.token, t.appId, t.configName);
       process.stdout.write(formatSecretsDownload(secrets, format));
     } catch (err) {
       fail(err);
     }
   }
 });
-var pull = defineCommand9({
+var pull = defineCommand10({
   meta: { name: "pull", description: "Refresh the .dev.vars cache from the app store" },
   args: { ...COMMON_ARGS },
   async run({ args }) {
@@ -9004,7 +9421,7 @@ var pull = defineCommand9({
         );
       const t = await resolveTarget(args);
       const ownerId = decodeJwtPayload(t.token).sub;
-      const pulled = await pullAppSecretsCache(DEPLOY_URL10, t.token, t.appId, t.configName);
+      const pulled = await pullAppSecretsCache(DEPLOY_URL11, t.token, t.appId, t.configName);
       if (!pulled) {
         ok(
           args.json === true,
@@ -9031,13 +9448,13 @@ var pull = defineCommand9({
     }
   }
 });
-var configsList = defineCommand9({
+var configsList = defineCommand10({
   meta: { name: "list", description: "List the app\u2019s configs" },
   args: { ...COMMON_ARGS },
   async run({ args }) {
     try {
       const t = await resolveTarget(args);
-      const { configs: configs2 } = await listConfigs(DEPLOY_URL10, t.token, t.appId);
+      const { configs: configs2 } = await listConfigs(DEPLOY_URL11, t.token, t.appId);
       ok(args.json === true, { appId: t.appId, configs: configs2 }, () => {
         if (configs2.length === 0) {
           console.log("No configs yet \u2014 the first `secrets set` creates one.");
@@ -9052,7 +9469,7 @@ var configsList = defineCommand9({
     }
   }
 });
-var configsCreate = defineCommand9({
+var configsCreate = defineCommand10({
   meta: { name: "create", description: "Create a config (optionally copying another)" },
   args: {
     ...COMMON_ARGS,
@@ -9064,7 +9481,7 @@ var configsCreate = defineCommand9({
       const t = await resolveTarget(args);
       const name = validateConfigName(args.name);
       const copyFrom = args["copy-from"] || void 0;
-      const { configs: configs2 } = await listConfigs(DEPLOY_URL10, t.token, t.appId);
+      const { configs: configs2 } = await listConfigs(DEPLOY_URL11, t.token, t.appId);
       if (configs2.some((c) => c.name === name)) {
         if (copyFrom) {
           fail(
@@ -9081,7 +9498,7 @@ var configsCreate = defineCommand9({
         );
         return;
       }
-      await createConfig(DEPLOY_URL10, t.token, t.appId, name, copyFrom);
+      await createConfig(DEPLOY_URL11, t.token, t.appId, name, copyFrom);
       ok(
         args.json === true,
         { appId: t.appId, config: name, created: true, ...copyFrom ? { copyFrom } : {} },
@@ -9092,7 +9509,7 @@ var configsCreate = defineCommand9({
     }
   }
 });
-var configsDelete = defineCommand9({
+var configsDelete = defineCommand10({
   meta: { name: "delete", description: "Delete a config and all of its secrets" },
   args: {
     ...COMMON_ARGS,
@@ -9102,7 +9519,7 @@ var configsDelete = defineCommand9({
     try {
       const t = await resolveTarget(args);
       const name = validateConfigName(args.name);
-      await deleteConfig(DEPLOY_URL10, t.token, t.appId, name);
+      await deleteConfig(DEPLOY_URL11, t.token, t.appId, name);
       ok(
         args.json === true,
         { appId: t.appId, config: name, deleted: true },
@@ -9113,16 +9530,16 @@ var configsDelete = defineCommand9({
     }
   }
 });
-var configs = defineCommand9({
+var configs = defineCommand10({
   meta: { name: "configs", description: "Manage the app\u2019s secrets configs" },
   subCommands: { list: configsList, create: configsCreate, delete: configsDelete }
 });
-var secrets_default = defineCommand9({
+var secrets_default = defineCommand10({
   meta: { name: "secrets", description: "Manage the app\u2019s secrets store" },
   subCommands: {
-    list: list5,
+    list: list6,
     set,
-    get,
+    get: get2,
     delete: del2,
     upload,
     download,
@@ -9194,9 +9611,9 @@ var init_default = defineDeepspaceCommand({
 });
 
 // src/cli/commands/status.ts
-import { defineCommand as defineCommand10 } from "citty";
+import { defineCommand as defineCommand11 } from "citty";
 import * as p17 from "@clack/prompts";
-import { existsSync as existsSync22, readFileSync as readFileSync24 } from "fs";
+import { existsSync as existsSync23, readFileSync as readFileSync25 } from "fs";
 function timeAgo(iso) {
   const ms = Date.now() - Date.parse(iso);
   if (!Number.isFinite(ms) || ms < 0) return iso;
@@ -9229,7 +9646,7 @@ function resolveStatusApp(appDir, wranglerEnv) {
   if (!resolved.ok) throw new InputError(resolved.reason, "invalid_env");
   return { appName: resolved.name, appId: readAppId(appDir, wranglerEnv) };
 }
-var status_default = defineCommand10({
+var status_default = defineCommand11({
   meta: {
     name: "status",
     description: "One screenful of current state: session, app, workspace, and live release"
@@ -9281,7 +9698,7 @@ var status_default = defineCommand10({
       json.services = urls;
       if (urlOverrides.length > 0) json.urlOverrides = urlOverrides;
     }
-    facts.loggedIn = existsSync22(SESSION_PATH);
+    facts.loggedIn = existsSync23(SESSION_PATH);
     let userId = null;
     if (!facts.loggedIn) {
       lines.push(["Session", "not logged in"]);
@@ -9290,7 +9707,7 @@ var status_default = defineCommand10({
       let who = "logged in";
       try {
         const payload = decodeJwtPayload(
-          readFileSync24(TOKEN_PATH, "utf-8").trim()
+          readFileSync25(TOKEN_PATH, "utf-8").trim()
         );
         if (payload.email) who = payload.email;
         userId = payload.sub ?? null;
@@ -9520,8 +9937,8 @@ var push_default = defineDeepspaceCommand({
     const branchArg = args.branch === void 0 ? void 0 : String(args.branch);
     const appArg = typeof args.app === "string" ? args.app : void 0;
     const force = args.force === true;
+    const appDir = findAppDir();
     try {
-      const appDir = findAppDir();
       if (!appDir)
         throw new Refusal(
           "No wrangler.toml found \u2014 run from inside an app directory.",
@@ -9650,7 +10067,7 @@ var push_default = defineDeepspaceCommand({
       }
       const recoverable = isRecoverablePushFailure(result.status);
       const rejectReason = result.reason ?? result.summary;
-      const errorMsg = ok2 ? null : result.status === "ref_conflict" ? `The cloud repo's ${branch} moved while you worked (${rejectReason}). Run \`deepspace pull --app ${shQuote(appId)} --branch ${shQuote(branch)}\` to integrate, then push again.` : result.status === "rejected" ? `The cloud repo rejected ${branch}: ${rejectReason}.` + (OVERSIZED_PUSH_RE.test(rejectReason) ? ` ${oversizedPushFix(appDir)}` : "") : `The cloud repo's ${branch} has commit(s) your local ${branch} doesn't. Run \`deepspace pull --app ${shQuote(appId)} --branch ${shQuote(branch)}\` and merge (or rebase), then push. Avoid --force here \u2014 it's guarded and will refuse rather than silently drop a peer's commits.`;
+      const errorMsg = ok2 ? null : result.status === "ref_conflict" ? `The cloud repo's ${branch} moved while you worked (${rejectReason}). Run \`deepspace pull --app ${shQuote(appId)} --branch ${shQuote(branch)}\` to integrate, then push again.` : result.status === "rejected" ? pushFailureMessage(`The cloud repo rejected ${branch}`, result, appDir ?? void 0) : `The cloud repo's ${branch} has commit(s) your local ${branch} doesn't. Run \`deepspace pull --app ${shQuote(appId)} --branch ${shQuote(branch)}\` and merge (or rebase), then push. Avoid --force here \u2014 it's guarded and will refuse rather than silently drop a peer's commits.`;
       if (!args.json && ok2) p18.log.info(`App: ${appId}`);
       const action = recoverable ? pullRecoveryAction(pullRecoveryCwd, appId, branch) : void 0;
       if (!ok2) {
@@ -9663,7 +10080,7 @@ var push_default = defineDeepspaceCommand({
       return { data: { status: result.status, appId, branch, oid: tipOid } };
     } catch (err) {
       if (err instanceof Refusal) throw err;
-      const transportFailure = classifyPushTransportFailure(err);
+      const transportFailure = classifyPushTransportFailure(err, appDir ?? void 0);
       if (transportFailure) {
         throw new Refusal(transportFailure.error, transportFailure.code);
       }
@@ -9955,14 +10372,14 @@ var pull_default = defineDeepspaceCommand({
 
 // src/cli/commands/clone.ts
 import * as p20 from "@clack/prompts";
-import { existsSync as existsSync23, readdirSync as readdirSync6, rmSync as rmSync5 } from "fs";
-import { resolve as resolve15, basename as basename3, join as join21 } from "path";
+import { existsSync as existsSync24, readdirSync as readdirSync6, rmSync as rmSync5 } from "fs";
+import { resolve as resolve16, basename as basename5, join as join21 } from "path";
 function cleanFailedCloneDir(dir) {
   let entries;
   try {
     entries = readdirSync6(dir);
   } catch {
-    return existsSync23(dir) ? ["<unreadable>"] : [];
+    return existsSync24(dir) ? ["<unreadable>"] : [];
   }
   if (entries.length === 1 && entries[0] === ".git") {
     try {
@@ -9975,7 +10392,7 @@ function cleanFailedCloneDir(dir) {
   return entries;
 }
 function validateCloneTarget(dir) {
-  if (!existsSync23(dir)) return false;
+  if (!existsSync24(dir)) return false;
   let entries;
   try {
     entries = readdirSync6(dir);
@@ -10010,7 +10427,7 @@ var clone_default = defineDeepspaceCommand({
   async run({ args }) {
     assertAppTargetResolvable(String(args.app));
     const selector = String(args.app).trim();
-    const dir = resolve15(String(args.dir ?? selector));
+    const dir = resolve16(String(args.dir ?? selector));
     const dirPreexisted = validateCloneTarget(dir);
     const spinner2 = args.json ? null : createSpinner();
     spinner2?.start(`Resolving ${selector}\u2026`);
@@ -10053,7 +10470,7 @@ var clone_default = defineDeepspaceCommand({
     const head = resolveCommit(dir, "HEAD");
     const branch = currentBranch(dir);
     spinner2?.stop(
-      `Cloned ${selector} (${branches.length} ${branches.length === 1 ? "branch" : "branches"}) into ${basename3(dir)}/ at ${head?.slice(0, 10) ?? "(unborn)"}.`
+      `Cloned ${selector} (${branches.length} ${branches.length === 1 ? "branch" : "branches"}) into ${basename5(dir)}/ at ${head?.slice(0, 10) ?? "(unborn)"}.`
     );
     if (!args.json && !branch) {
       p20.log.warn("HEAD is detached \u2014 check `git branch -a`.");
@@ -10076,7 +10493,7 @@ var clone_default = defineDeepspaceCommand({
 
 // src/cli/commands/releases.ts
 import * as p21 from "@clack/prompts";
-var DEPLOY_URL11 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
+var DEPLOY_URL12 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 var releases_default = defineDeepspaceCommand({
   meta: {
     name: "releases",
@@ -10111,8 +10528,8 @@ var releases_default = defineDeepspaceCommand({
     const spinner2 = args.json ? null : createSpinner();
     spinner2?.start("Loading release history\u2026");
     const token = await ensureToken();
-    const appId = await resolveAppTarget(DEPLOY_URL11, token, appArg, { wranglerEnv: envArg });
-    const { releases } = await repoApi(DEPLOY_URL11, token, appId).listReleases(limit);
+    const appId = await resolveAppTarget(DEPLOY_URL12, token, appArg, { wranglerEnv: envArg });
+    const { releases } = await repoApi(DEPLOY_URL12, token, appId).listReleases(limit);
     spinner2?.stop(`Loaded ${releases.length} ${releases.length === 1 ? "release" : "releases"}.`);
     if (!args.json) {
       if (releases.length === 0) {
@@ -10144,7 +10561,7 @@ Retry in a moment, or re-run with --allow-do-deletion to accept the risk.`,
     "do_guard_unavailable"
   );
 }
-var DEPLOY_URL12 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
+var DEPLOY_URL13 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 function pickPreviousRelease(releases) {
   if (releases.length === 0) {
     return { error: "No releases recorded yet \u2014 nothing to roll back to.", code: "no_releases" };
@@ -10206,8 +10623,8 @@ var rollback_default = defineDeepspaceCommand({
     const spinner2 = args.json ? null : createSpinner();
     spinner2?.start("Preparing rollback\u2026");
     const token = await ensureToken();
-    const appId = await resolveAppTarget(DEPLOY_URL12, token, appArg, { wranglerEnv: envArg });
-    const api4 = repoApi(DEPLOY_URL12, token, appId);
+    const appId = await resolveAppTarget(DEPLOY_URL13, token, appArg, { wranglerEnv: envArg });
+    const api4 = repoApi(DEPLOY_URL13, token, appId);
     let releaseId = args.release ? String(args.release).trim() : "";
     if (!releaseId) {
       const { releases } = await api4.listReleases(2);
@@ -10218,7 +10635,7 @@ var rollback_default = defineDeepspaceCommand({
     spinner2?.message(`Rolling back to ${releaseId}\u2026`);
     let result;
     try {
-      result = await apiFetch(DEPLOY_URL12, token, `/api/deploy/${appId}/rollback`, {
+      result = await apiFetch(DEPLOY_URL13, token, `/api/deploy/${appId}/rollback`, {
         method: "POST",
         body: JSON.stringify({
           releaseId,
@@ -10279,11 +10696,11 @@ Re-run with --allow-do-deletion to accept the data loss.`,
 });
 
 // src/cli/commands/workspace.ts
-import { defineCommand as defineCommand11 } from "citty";
+import { defineCommand as defineCommand12 } from "citty";
 
 // src/cli/commands/workspace/new.ts
 import * as p25 from "@clack/prompts";
-import { isAbsolute as isAbsolute6, resolve as resolve16 } from "path";
+import { isAbsolute as isAbsolute6, resolve as resolve17 } from "path";
 
 // src/cli/commands/workspace/analysis.ts
 import * as p23 from "@clack/prompts";
@@ -10408,7 +10825,7 @@ function printOverlaps(overlaps, json) {
 
 // src/cli/commands/workspace/local.ts
 import * as p24 from "@clack/prompts";
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync25, realpathSync as realpathSync5, renameSync as renameSync2, statSync, writeFileSync as writeFileSync9 } from "fs";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync26, realpathSync as realpathSync5, renameSync as renameSync2, statSync as statSync3, writeFileSync as writeFileSync9 } from "fs";
 import { dirname as dirname9, isAbsolute as isAbsolute5, join as join22, relative as relative2, sep as sep2 } from "path";
 var WORKSPACE_MARKER = "deepspace-workspace.json";
 function excludeWorktreeDir(appDir, dir) {
@@ -10466,7 +10883,7 @@ function isManagedWorkspaceWorktree(worktreeRoot, workspaceId) {
   const markerPath = worktreeMarkerPath(worktreeRoot);
   if (!markerPath) return false;
   try {
-    const marker = JSON.parse(readFileSync25(markerPath, "utf-8"));
+    const marker = JSON.parse(readFileSync26(markerPath, "utf-8"));
     return marker.version === 1 && marker.workspaceId === workspaceId && marker.mode === "managed-linked";
   } catch {
     return false;
@@ -10497,7 +10914,7 @@ function materializeWorkspaceWorktree(appDir, worktreeRoot, branch, startPoint,
 function inOwnLinkedWorktree(appDir, id) {
   if (workspaceIdFromBranch(currentBranch(appDir)) !== id) return false;
   try {
-    return statSync(join22(repoToplevel(appDir), ".git")).isFile();
+    return statSync3(join22(repoToplevel(appDir), ".git")).isFile();
   } catch {
     return false;
   }
@@ -10843,7 +11260,7 @@ var newWorkspaceCommand = defineDeepspaceCommand({
       idempotencyKey: mintIdempotencyKey()
     });
     const dirInput = typeof args.dir === "string" ? args.dir.trim() : "";
-    const worktreeRoot = dirInput ? isAbsolute6(dirInput) ? dirInput : resolve16(appDir, dirInput) : defaultWorkspaceRoot(appDir, id);
+    const worktreeRoot = dirInput ? isAbsolute6(dirInput) ? dirInput : resolve17(appDir, dirInput) : defaultWorkspaceRoot(appDir, id);
     const dir = appDirInWorktree(appDir, worktreeRoot);
     try {
       materializeWorkspaceWorktree(appDir, worktreeRoot, branch, baseOid, id);
@@ -10881,8 +11298,8 @@ var newWorkspaceCommand = defineDeepspaceCommand({
 
 // src/cli/commands/workspace/attach.ts
 import * as p26 from "@clack/prompts";
-import { existsSync as existsSync24, readdirSync as readdirSync7, rmSync as rmSync6 } from "fs";
-import { isAbsolute as isAbsolute7, resolve as resolve17 } from "path";
+import { existsSync as existsSync25, readdirSync as readdirSync7, rmSync as rmSync6 } from "fs";
+import { isAbsolute as isAbsolute7, resolve as resolve18 } from "path";
 function finishedWorkspaceMessage(id, view) {
   const workspace = view.workspace;
   if (workspace.status === "landed") {
@@ -10891,7 +11308,7 @@ function finishedWorkspaceMessage(id, view) {
   return `Workspace ${id} is ${workspace.status} \u2014 its ref is retained briefly (fetch ${workspace.ref} to inspect), but attach only works on active workspaces.`;
 }
 function cleanFailedFreshAttachDir(dir) {
-  if (!existsSync24(dir)) return [];
+  if (!existsSync25(dir)) return [];
   let entries;
   try {
     entries = readdirSync7(dir);
@@ -10967,7 +11384,7 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
         );
       }
       const requestedDir = typeof args.dir === "string" ? args.dir.trim() : "";
-      const worktreeRoot = requestedDir ? isAbsolute7(requestedDir) ? requestedDir : resolve17(appDir, requestedDir) : defaultWorkspaceRoot(appDir, id);
+      const worktreeRoot = requestedDir ? isAbsolute7(requestedDir) ? requestedDir : resolve18(appDir, requestedDir) : defaultWorkspaceRoot(appDir, id);
       const dir2 = appDirInWorktree(appDir, worktreeRoot);
       if (resolveCommit(appDir, `refs/heads/${branch}`)) {
         throw new Refusal(
@@ -11006,11 +11423,11 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
         extra: { status: view.workspace.status }
       });
     }
-    const dir = resolve17(
+    const dir = resolve18(
       process.cwd(),
       (typeof args.dir === "string" ? args.dir.trim() : "") || `ws-${id.slice(3).toLowerCase()}`
     );
-    if (existsSync24(dir)) {
+    if (existsSync25(dir)) {
       spinner2?.stop("Target exists.");
       throw new Refusal(`${dir} already exists \u2014 pass a different directory.`, "dir_exists");
     }
@@ -11328,13 +11745,13 @@ import * as p30 from "@clack/prompts";
 
 // src/cli/lib/validation.ts
 import { sync as spawnSync7 } from "cross-spawn";
-import { readFileSync as readFileSync26 } from "fs";
+import { readFileSync as readFileSync27 } from "fs";
 import { join as join23 } from "path";
 var MAX_SUMMARY_CHARS = 4e3;
 var MAX_OUTPUT_BUFFER = 64 * 1024 * 1024;
 function configuredCommand(appDir) {
   try {
-    const pkg2 = JSON.parse(readFileSync26(join23(appDir, "package.json"), "utf-8"));
+    const pkg2 = JSON.parse(readFileSync27(join23(appDir, "package.json"), "utf-8"));
     if (pkg2.scripts?.validate) return `${detectPackageManager(appDir)} run --silent validate`;
   } catch {
   }
@@ -11754,7 +12171,7 @@ var dropWorkspaceCommand = defineDeepspaceCommand({
 });
 
 // src/cli/commands/workspace.ts
-var workspace_default = defineCommand11({
+var workspace_default = defineCommand12({
   meta: {
     name: "workspace",
     description: "Durable parallel-agent workspaces (new/attach/sync/list/status/land/drop)"
@@ -11925,7 +12342,7 @@ var activity_default = defineDeepspaceCommand({
 });
 
 // src/cli/commands/git-credential.ts
-import { defineCommand as defineCommand12 } from "citty";
+import { defineCommand as defineCommand13 } from "citty";
 function parseFields(input) {
   const fields = /* @__PURE__ */ new Map();
   for (const line of input.split("\n")) {
@@ -11974,7 +12391,7 @@ async function readStdin() {
   for await (const chunk of process.stdin) data += chunk;
   return data;
 }
-var git_credential_default = defineCommand12({
+var git_credential_default = defineCommand13({
   meta: {
     name: "git-credential",
     description: "Git credential helper (installed automatically; not for direct use)"
@@ -12092,8 +12509,8 @@ function reportSource(appId, state, json) {
 async function moveToGitHub(input) {
   const { appDir, appId, token, deployUrl, state, remoteArg } = input;
   const selected = requireGitHubRemote(appDir, remoteArg);
-  const target = { provider: "github", repository: selected.repository };
-  if (sameSource(state.source, target)) return { source: target, revision: state.revision };
+  const target2 = { provider: "github", repository: selected.repository };
+  if (sameSource(state.source, target2)) return { source: target2, revision: state.revision };
   if (state.source?.provider === "deepspace") {
     requireLocalHead(appDir);
     const api4 = repoApi(deployUrl, token, appId);
@@ -12149,7 +12566,7 @@ async function moveToGitHub(input) {
       );
     }
     return setAppSource(deployUrl, token, appId, {
-      source: target,
+      source: target2,
       expectedRevision: state.revision,
       refs: wanted,
       ...releaseExpectation(latest)
@@ -12157,17 +12574,17 @@ async function moveToGitHub(input) {
   }
   requirePublishedHead(appDir, selected, appId);
   return setAppSource(deployUrl, token, appId, {
-    source: target,
+    source: target2,
     expectedRevision: state.revision
   });
 }
 async function moveToDeepSpace(input) {
   const { appDir, appId, token, deployUrl, state, remoteArg } = input;
-  const target = { provider: "deepspace" };
-  if (sameSource(state.source, target)) return { source: target, revision: state.revision };
+  const target2 = { provider: "deepspace" };
+  if (sameSource(state.source, target2)) return { source: target2, revision: state.revision };
   if (state.source?.provider !== "github") {
     return setAppSource(deployUrl, token, appId, {
-      source: target,
+      source: target2,
       expectedRevision: state.revision
     });
   }
@@ -12201,7 +12618,7 @@ async function moveToDeepSpace(input) {
     );
   }
   return setAppSource(deployUrl, token, appId, {
-    source: target,
+    source: target2,
     expectedRevision: state.revision,
     branch,
     commitOid: oid,
@@ -12828,11 +13245,11 @@ function reportMigration(migration, json) {
 
 // src/cli/cli.ts
 var __dirname = dirname10(fileURLToPath3(import.meta.url));
-var pkg = JSON.parse(readFileSync27(join24(__dirname, "..", "package.json"), "utf-8"));
-if (process.platform === "linux" && !process.env.SSL_CERT_FILE && existsSync25("/etc/ssl/certs/ca-certificates.crt")) {
+var pkg = JSON.parse(readFileSync28(join24(__dirname, "..", "package.json"), "utf-8"));
+if (process.platform === "linux" && !process.env.SSL_CERT_FILE && existsSync26("/etc/ssl/certs/ca-certificates.crt")) {
   process.env.SSL_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt";
 }
-var create2 = defineCommand13({
+var create2 = defineCommand14({
   meta: {
     name: "create",
     description: "Create a new DeepSpace app (runs create-deepspace; all flags are forwarded)"
@@ -12871,19 +13288,20 @@ var create2 = defineCommand13({
   }
 });
 var rename = (cmd, name) => ({ ...cmd, meta: { ...cmd.meta ?? {}, name } });
-var auth = defineCommand13({
+var auth = defineCommand14({
   meta: { name: "auth", description: "Session: login, logout, whoami" },
   subCommands: { login: login_default, logout: logout_default, whoami: whoami_default }
 });
-var app = defineCommand13({
+var app = defineCommand14({
   meta: {
     name: "app",
-    description: "The app itself: create, init, list, source, migrate, undeploy, transfer, collaborators, domain, usage"
+    description: "The app itself: create, init, list, files, source, migrate, undeploy, transfer, collaborators, domain, usage"
   },
   subCommands: {
     create: create2,
     init: init_default,
     list: rename(apps_default, "list"),
+    files: app_files_default,
     undeploy: undeploy_default,
     transfer: transfer_default,
     collaborators: collaborators_default,
@@ -12893,11 +13311,11 @@ var app = defineCommand13({
     migrate: migrate_default
   }
 });
-var devGroup = defineCommand13({
+var devGroup = defineCommand14({
   meta: { name: "dev", description: "Local development" },
   subCommands: { start: rename(dev_default, "start"), kill: kill_default }
 });
-var testGroup = defineCommand13({
+var testGroup = defineCommand14({
   meta: { name: "test", description: "App tests and test tooling" },
   subCommands: {
     run: rename(test_default, "run"),
@@ -12905,7 +13323,7 @@ var testGroup = defineCommand13({
     accounts: rename(test_accounts_default, "accounts")
   }
 });
-var main = defineCommand13({
+var main = defineCommand14({
   meta: {
     name: "deepspace",
     version: pkg.version,