deepspace 0.16.0 → 0.18.0

package/dist/cli.js

@@ -1,10 +1,15 @@
 #!/usr/bin/env node
 
 // src/cli/cli.ts
-import { defineCommand as defineCommand14, runMain, runCommand, renderUsage } from "citty";
+import {
+  defineCommand as defineCommand14,
+  runMain,
+  runCommand,
+  renderUsage
+} from "citty";
 import { sync as spawnSync8 } from "cross-spawn";
-import { readFileSync as readFileSync29, existsSync as existsSync27 } from "fs";
-import { dirname as dirname10, join as join25 } from "path";
+import { readFileSync as readFileSync28, existsSync as existsSync25 } from "fs";
+import { dirname as dirname11, join as join25 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 
 // src/cli/lib/spinner.ts
@@ -41,7 +46,8 @@ function stopActiveSpinner() {
 
 // src/cli/lib/output.ts
 import * as p2 from "@clack/prompts";
-import { isAbsolute } from "path";
+import { readFileSync, realpathSync } from "fs";
+import { dirname, isAbsolute, resolve } from "path";
 
 // src/cli/lib/cli-format.ts
 var ANSI_RE = /\[[0-9;]*m/g;
@@ -59,10 +65,35 @@ function humanCommand(argv) {
 }
 
 // src/cli/lib/output.ts
+function resolveActionArgv(argv) {
+  if (argv[0] !== "deepspace") return argv;
+  const entry = cliEntryPath();
+  return entry ? [process.execPath, entry, ...argv.slice(1)] : argv;
+}
+function cliEntryPath() {
+  const entry = process.argv[1];
+  if (!entry || !isAbsolute(entry)) return null;
+  let real;
+  try {
+    real = realpathSync(entry);
+  } catch {
+    return null;
+  }
+  if (!/(^|[\\/])cli\.[cm]?js$/.test(real)) return null;
+  try {
+    const pkg2 = JSON.parse(readFileSync(resolve(dirname(real), "..", "package.json"), "utf-8"));
+    return pkg2.name === "deepspace" ? real : null;
+  } catch {
+    return null;
+  }
+}
+function executableAction(action) {
+  const pinned = { ...action, argv: resolveActionArgv(action.argv) };
+  assertExecutableAction(pinned);
+  return pinned;
+}
 function cliAction(...argv) {
-  const action = { cwd: process.cwd(), argv };
-  assertExecutableAction(action);
-  return action;
+  return executableAction({ cwd: process.cwd(), argv });
 }
 function assertExecutableAction(action) {
   if (!isAbsolute(action.cwd)) throw new TypeError("CLI action cwd must be absolute");
@@ -78,7 +109,9 @@ function withSlug(msg, code) {
   return msg.trimEnd().endsWith(tag) ? msg : `${msg.trimEnd()} ${tag}`;
 }
 function displayArg(arg) {
-  return /^[A-Za-z0-9_./:@%+=,-]+$/.test(arg) ? arg : shQuote(arg);
+  if (/^[A-Za-z0-9_./:@%+=,-]+$/.test(arg)) return arg;
+  if (process.platform === "win32") return `"${arg.replaceAll('"', '""')}"`;
+  return shQuote(arg);
 }
 function printAction(action) {
   assertExecutableAction(action);
@@ -232,6 +265,146 @@ function wrapCommandErrors(cmd) {
   return cmd;
 }
 
+// src/cli/lib/command.ts
+import { defineCommand, parseArgs } from "citty";
+import * as p3 from "@clack/prompts";
+var Refusal = class extends Error {
+  code;
+  action;
+  actionRequired;
+  extra;
+  constructor(message, code, opts = {}) {
+    super(message);
+    this.name = "Refusal";
+    this.code = code;
+    this.action = opts.action ? executableAction(opts.action) : void 0;
+    this.actionRequired = opts.actionRequired ?? false;
+    this.extra = opts.extra ?? {};
+  }
+};
+function apiErrorDetails(err) {
+  return err instanceof ApiError ? err.details : void 0;
+}
+function withoutReservedKeys(payload) {
+  return Object.fromEntries(
+    Object.entries(payload).filter(
+      ([key]) => ![
+        "ok",
+        "code",
+        "error",
+        "action",
+        "actionRequired",
+        "next",
+        "nextAction",
+        "resume"
+      ].includes(key)
+    )
+  );
+}
+function exitWhenFlushed(code) {
+  if (process.stdout.writableLength === 0) process.exit(code);
+  process.stdout.write("", () => process.exit(code));
+  return void 0;
+}
+function nameVariants(name) {
+  return [
+    name,
+    name.replace(/-([a-z])/g, (_, c) => c.toUpperCase()),
+    name.replace(/[A-Z]/g, (c) => `-${c.toLowerCase()}`)
+  ];
+}
+function unknownOptionNames(parsed, args) {
+  const known = /* @__PURE__ */ new Set(["_"]);
+  for (const [name, def] of Object.entries(args)) {
+    for (const variant of nameVariants(name)) known.add(variant);
+    const alias = def.alias;
+    for (const a of Array.isArray(alias) ? alias : alias ? [alias] : []) {
+      for (const variant of nameVariants(a)) known.add(variant);
+    }
+  }
+  return Object.keys(parsed).filter((key) => !known.has(key));
+}
+function unknownOptionNamesFromRaw(rawArgs2, args) {
+  const relaxedArgs = Object.fromEntries(
+    Object.entries(args).map(([name, definition]) => [
+      name,
+      definition.type === "enum" ? { ...definition, type: "string", required: false, options: void 0 } : { ...definition, required: false }
+    ])
+  );
+  return unknownOptionNames(parseArgs(rawArgs2, relaxedArgs), args);
+}
+function unknownOptionMessage(commandName, unknown, args) {
+  const valid = Object.entries(args).filter(([, definition]) => definition.type !== "positional").map(([name]) => name).sort().join(", ");
+  return `Unknown ${unknown.length === 1 ? "option" : "options"}: ${unknown.map((name) => `--${name}`).join(", ")}. \`${commandName}\` accepts: ${valid || "(none)"}.`;
+}
+function defineDeepspaceCommand(def) {
+  const declaredArgs = {
+    ...def.args ?? {},
+    json: {
+      type: "boolean",
+      description: "Emit a single-line JSON result for scripts/agents",
+      default: false
+    }
+  };
+  return defineCommand({
+    meta: def.meta,
+    args: declaredArgs,
+    async run({ args }) {
+      const json = Boolean(args.json);
+      let succeeded = false;
+      try {
+        const unknown = unknownOptionNames(args, declaredArgs);
+        if (unknown.length > 0) {
+          throw new Refusal(
+            unknownOptionMessage(def.meta.name, unknown, declaredArgs),
+            "unknown_option"
+          );
+        }
+        const out = await def.run({
+          args
+        }) ?? {};
+        if (out.action) out.action = executableAction(out.action);
+        if (json) {
+          console.log(
+            JSON.stringify({
+              ok: true,
+              ...withoutReservedKeys(out.data ?? {}),
+              ...out.action ? { action: out.action } : {}
+            })
+          );
+        } else if (out.action) {
+          printAction(out.action);
+        }
+        succeeded = true;
+      } catch (err) {
+        stopActiveSpinner();
+        const refusal = err instanceof Refusal ? err : null;
+        const code = refusal?.code ?? errorCode(err);
+        const message = err instanceof Error ? err.message : String(err);
+        if (json) {
+          console.log(
+            JSON.stringify({
+              ok: false,
+              ...code ? { code } : {},
+              ...refusal?.actionRequired ? { actionRequired: true } : {},
+              error: message,
+              ...refusal?.action ? { action: refusal.action } : {},
+              ...withoutReservedKeys(refusal?.extra ?? apiErrorDetails(err) ?? {})
+            })
+          );
+        } else {
+          const line = code ? withSlug(message, code) : message;
+          if (refusal?.actionRequired) p3.log.warn(line);
+          else p3.log.error(line);
+          if (refusal?.action) printAction(refusal.action);
+        }
+        exitWhenFlushed(refusal?.actionRequired ? 2 : 1);
+      }
+      if (succeeded) exitWhenFlushed(0);
+    }
+  });
+}
+
 // src/cli/lib/command-suggestions.ts
 function splitTokenPath(token, table) {
   const parts = token.trim().split(/\s+/);
@@ -342,7 +515,7 @@ function effectivePlatformUrls(env = process.env) {
 var DASHBOARD_URL = DEEPSPACE_ENV === "production" ? "https://dashboard.deep.space" : DEEPSPACE_ENV === "staging" ? "https://dashboard.deepspacesites.com" : "http://127.0.0.1:9";
 
 // src/cli/auth.ts
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";
+import { readFileSync as readFileSync2, writeFileSync, existsSync, mkdirSync } from "fs";
 import { join } from "path";
 import { homedir } from "os";
 
@@ -370,106 +543,6 @@ async function exchangeSession(authUrl, sessionToken) {
   return data.token ?? null;
 }
 
-// src/cli/lib/command.ts
-import { defineCommand } from "citty";
-import * as p3 from "@clack/prompts";
-var Refusal = class extends Error {
-  code;
-  action;
-  actionRequired;
-  extra;
-  constructor(message, code, opts = {}) {
-    super(message);
-    this.name = "Refusal";
-    this.code = code;
-    if (opts.action) assertExecutableAction(opts.action);
-    this.action = opts.action;
-    this.actionRequired = opts.actionRequired ?? false;
-    this.extra = opts.extra ?? {};
-  }
-};
-function apiErrorDetails(err) {
-  return err instanceof ApiError ? err.details : void 0;
-}
-function withoutReservedKeys(payload) {
-  return Object.fromEntries(
-    Object.entries(payload).filter(
-      ([key]) => ![
-        "ok",
-        "code",
-        "error",
-        "action",
-        "actionRequired",
-        "next",
-        "nextAction",
-        "resume"
-      ].includes(key)
-    )
-  );
-}
-function exitWhenFlushed(code) {
-  if (process.stdout.writableLength === 0) process.exit(code);
-  process.stdout.write("", () => process.exit(code));
-  return void 0;
-}
-function defineDeepspaceCommand(def) {
-  return defineCommand({
-    meta: def.meta,
-    args: {
-      ...def.args ?? {},
-      json: {
-        type: "boolean",
-        description: "Emit a single-line JSON result for scripts/agents",
-        default: false
-      }
-    },
-    async run({ args }) {
-      const json = Boolean(args.json);
-      let succeeded = false;
-      try {
-        const out = await def.run({ args }) ?? {};
-        if (out.action) assertExecutableAction(out.action);
-        if (json) {
-          console.log(
-            JSON.stringify({
-              ok: true,
-              ...withoutReservedKeys(out.data ?? {}),
-              ...out.action ? { action: out.action } : {}
-            })
-          );
-        } else if (out.action) {
-          printAction(out.action);
-        }
-        succeeded = true;
-      } catch (err) {
-        stopActiveSpinner();
-        const refusal = err instanceof Refusal ? err : null;
-        const code = refusal?.code ?? errorCode(err);
-        const message = err instanceof Error ? err.message : String(err);
-        if (json) {
-          console.log(
-            JSON.stringify({
-              ok: false,
-              ...code ? { code } : {},
-              ...refusal?.actionRequired ? { actionRequired: true } : {},
-              error: message,
-              ...refusal?.action ? { action: refusal.action } : {},
-              ...withoutReservedKeys(refusal?.extra ?? apiErrorDetails(err) ?? {})
-            })
-          );
-        } else {
-          const line = code ? withSlug(message, code) : message;
-          if (refusal?.actionRequired) p3.log.warn(line);
-          else p3.log.error(line);
-          if (refusal?.action) printAction(refusal.action);
-        }
-        exitWhenFlushed(refusal?.actionRequired ? 2 : 1);
-      }
-      if (succeeded) exitWhenFlushed(0);
-    }
-  });
-}
-
 // src/cli/auth.ts
 var AUTH_URL = process.env.DEEPSPACE_AUTH_URL ?? PLATFORM_URLS.auth;
 var PROD_AUTH_URL = "https://auth.deep.space";
@@ -492,7 +565,7 @@ function credentialPaths(authUrl = AUTH_URL) {
 var { sessionPath: SESSION_PATH, tokenPath: TOKEN_PATH } = credentialPaths();
 async function ensureToken() {
   if (existsSync(TOKEN_PATH)) {
-    const existing = readFileSync(TOKEN_PATH, "utf-8").trim();
+    const existing = readFileSync2(TOKEN_PATH, "utf-8").trim();
     if (isTokenValid(existing)) {
       return existing;
     }
@@ -502,7 +575,7 @@ async function ensureToken() {
       action: cliAction("deepspace", "auth", "login")
     });
   }
-  const sessionToken = readFileSync(SESSION_PATH, "utf-8").trim();
+  const sessionToken = readFileSync2(SESSION_PATH, "utf-8").trim();
   const token = await exchangeSession(AUTH_URL, sessionToken);
   if (!token) {
     throw new Refusal(
@@ -526,7 +599,7 @@ function isTokenValid(jwt) {
 registerAuthRefresh(async () => {
   try {
     if (!existsSync(SESSION_PATH)) return null;
-    const sessionToken = readFileSync(SESSION_PATH, "utf-8").trim();
+    const sessionToken = readFileSync2(SESSION_PATH, "utf-8").trim();
     const token = await exchangeSession(AUTH_URL, sessionToken);
     if (!token) return null;
     mkdirSync(DIR, { recursive: true, mode: 448 });
@@ -538,7 +611,7 @@ registerAuthRefresh(async () => {
 });
 
 // src/cli/commands/login.ts
-import { writeFileSync as writeFileSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2 } from "fs";
+import { writeFileSync as writeFileSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3 } from "fs";
 import { join as join2 } from "path";
 import { homedir as homedir2 } from "os";
 import { randomBytes, createHash } from "crypto";
@@ -697,7 +770,7 @@ function readPasswordFromStdin() {
       "password_stdin_needs_pipe"
     );
   }
-  return readFileSync2(0, "utf-8").replace(/\r?\n$/, "");
+  return readFileSync3(0, "utf-8").replace(/\r?\n$/, "");
 }
 async function pollForCompletion(sessionId, codeVerifier) {
   const maxAttempts = 120;
@@ -738,7 +811,7 @@ async function provisionProfile(jwt) {
   }
 }
 function sleep(ms) {
-  return new Promise((resolve20) => setTimeout(resolve20, ms));
+  return new Promise((resolve21) => setTimeout(resolve21, ms));
 }
 function base64url(bytes) {
   return bytes.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
@@ -775,7 +848,7 @@ async function doEmailLogin(email, password) {
 }
 
 // src/cli/commands/logout.ts
-import { existsSync as existsSync2, readFileSync as readFileSync3, rmSync } from "fs";
+import { existsSync as existsSync2, readFileSync as readFileSync4, rmSync } from "fs";
 var AUTH_URL3 = process.env.DEEPSPACE_AUTH_URL ?? PLATFORM_URLS.auth;
 var { sessionPath: SESSION_PATH2, tokenPath: TOKEN_PATH2 } = credentialPaths(AUTH_URL3);
 var logout_default = defineDeepspaceCommand({
@@ -784,7 +857,7 @@ var logout_default = defineDeepspaceCommand({
     description: "Sign out and remove cached credentials"
   },
   async run({ args }) {
-    const sessionToken = existsSync2(SESSION_PATH2) ? readFileSync3(SESSION_PATH2, "utf-8").trim() : null;
+    const sessionToken = existsSync2(SESSION_PATH2) ? readFileSync4(SESSION_PATH2, "utf-8").trim() : null;
     if (sessionToken) {
       try {
         await fetch(`${AUTH_URL3}/api/auth/sign-out`, {
@@ -810,8 +883,8 @@ var logout_default = defineDeepspaceCommand({
 });
 
 // src/cli/lib/app-identity.ts
-import { existsSync as existsSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
-import { join as join3, resolve } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
+import { join as join3, resolve as resolve2 } from "path";
 import { parse as parseToml } from "smol-toml";
 
 // src/server/utils/registry-client.ts
@@ -846,10 +919,10 @@ function mintAppId(now = Date.now()) {
   return `app_${mintUlid(now)}`;
 }
 function readWranglerIdentityConfig(cwd) {
-  const wranglerPath = join3(resolve(cwd), "wrangler.toml");
+  const wranglerPath = join3(resolve2(cwd), "wrangler.toml");
   if (!existsSync3(wranglerPath)) return null;
   try {
-    return parseToml(readFileSync4(wranglerPath, "utf-8"));
+    return parseToml(readFileSync5(wranglerPath, "utf-8"));
   } catch (err) {
     throw new InputError(
       `Could not parse ${wranglerPath}: ${err instanceof Error ? err.message : String(err)}`,
@@ -865,9 +938,9 @@ function readAppId(cwd = process.cwd(), wranglerEnv) {
   return typeof id === "string" && APP_ID_RE.test(id) ? id : null;
 }
 function writeAppId(cwd, appId, opts = {}) {
-  const wranglerPath = join3(resolve(cwd), "wrangler.toml");
+  const wranglerPath = join3(resolve2(cwd), "wrangler.toml");
   if (!existsSync3(wranglerPath)) {
-    throw new Error(`No wrangler.toml in ${resolve(cwd)}`);
+    throw new Error(`No wrangler.toml in ${resolve2(cwd)}`);
   }
   const existing = readAppId(cwd, opts.wranglerEnv);
   if (existing && !opts.force) {
@@ -876,7 +949,7 @@ function writeAppId(cwd, appId, opts = {}) {
       `wrangler.toml already carries ${existing}. The app id is immutable \u2014 use --new-id only to fork this repo as a separate app.`
     );
   }
-  let src = readFileSync4(wranglerPath, "utf-8");
+  let src = readFileSync5(wranglerPath, "utf-8");
   const header = opts.wranglerEnv ? `[env.${opts.wranglerEnv}.vars]` : "[vars]";
   const line = `DEEPSPACE_APP_ID = "${appId}"`;
   const headerRe = new RegExp(`^\\${header.replace(/\./g, "\\.")}[ \\t]*$`, "m");
@@ -902,18 +975,18 @@ ${line}
 }
 
 // src/cli/commands/dev.ts
-import { resolve as resolve7, basename as basename2, join as join12 } from "path";
+import { resolve as resolve8, basename as basename2, join as join12 } from "path";
 import spawn from "cross-spawn";
 
 // src/cli/lib/app-context.ts
-import { existsSync as existsSync4, readFileSync as readFileSync5, readdirSync } from "fs";
-import { dirname, join as join4, resolve as resolve2 } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync6, readdirSync } from "fs";
+import { dirname as dirname2, join as join4, resolve as resolve3 } from "path";
 import { parse as parseToml2 } from "smol-toml";
 function detectAppName(cwd = process.cwd()) {
-  const wranglerPath = join4(resolve2(cwd), "wrangler.toml");
+  const wranglerPath = join4(resolve3(cwd), "wrangler.toml");
   if (!existsSync4(wranglerPath)) return null;
   try {
-    const config = parseToml2(readFileSync5(wranglerPath, "utf-8"));
+    const config = parseToml2(readFileSync6(wranglerPath, "utf-8"));
     return typeof config.name === "string" && config.name.length > 0 ? config.name : null;
   } catch (error) {
     throw new InputError(
@@ -923,10 +996,10 @@ function detectAppName(cwd = process.cwd()) {
   }
 }
 function findAppDir(start = process.cwd()) {
-  let dir = resolve2(start);
+  let dir = resolve3(start);
   for (; ; ) {
     if (existsSync4(join4(dir, "wrangler.toml"))) return dir;
-    const parent = dirname(dir);
+    const parent = dirname2(dir);
     if (parent === dir) return null;
     dir = parent;
   }
@@ -942,18 +1015,18 @@ function findChildApps(dir) {
 // src/cli/lib/launch-config.ts
 import {
   existsSync as existsSync5,
-  readFileSync as readFileSync7,
-  realpathSync,
+  readFileSync as readFileSync8,
+  realpathSync as realpathSync2,
   writeFileSync as writeFileSync4,
   mkdirSync as mkdirSync4,
   renameSync,
   unlinkSync
 } from "fs";
-import { join as join6, resolve as resolve4, dirname as dirname3, basename, isAbsolute as isAbsolute2, sep } from "path";
+import { join as join6, resolve as resolve5, dirname as dirname4, basename, isAbsolute as isAbsolute2, sep } from "path";
 
 // src/cli/lib/git/repository.ts
-import { appendFileSync, mkdirSync as mkdirSync3, readFileSync as readFileSync6 } from "fs";
-import { dirname as dirname2, join as join5, resolve as resolve3 } from "path";
+import { appendFileSync, mkdirSync as mkdirSync3, readFileSync as readFileSync7 } from "fs";
+import { dirname as dirname3, join as join5, resolve as resolve4 } from "path";
 
 // src/cli/lib/git/process.ts
 import { sync as spawnSync } from "cross-spawn";
@@ -1156,16 +1229,16 @@ function listWorktrees(cwd) {
   return worktrees;
 }
 function ensureLocalExclude(cwd, pattern) {
-  const commonDir = resolve3(cwd, gitLine(cwd, ["rev-parse", "--git-common-dir"]));
+  const commonDir = resolve4(cwd, gitLine(cwd, ["rev-parse", "--git-common-dir"]));
   const excludePath = join5(commonDir, "info", "exclude");
   let current = "";
   try {
-    current = readFileSync6(excludePath, "utf-8");
+    current = readFileSync7(excludePath, "utf-8");
   } catch {
   }
   if (current.split("\n").some((line) => line.trim() === pattern)) return;
   try {
-    mkdirSync3(dirname2(excludePath), { recursive: true });
+    mkdirSync3(dirname3(excludePath), { recursive: true });
     appendFileSync(
       excludePath,
       `${current.endsWith("\n") || current === "" ? "" : "\n"}${pattern}
@@ -1177,7 +1250,7 @@ function ensureLocalExclude(cwd, pattern) {
 
 // src/cli/lib/launch-config.ts
 function writeLaunchFile(launchPath, config) {
-  mkdirSync4(dirname3(launchPath), { recursive: true });
+  mkdirSync4(dirname4(launchPath), { recursive: true });
   const tmpPath = `${launchPath}.${process.pid}.tmp`;
   writeFileSync4(tmpPath, JSON.stringify(config, null, 2) + "\n");
   try {
@@ -1193,7 +1266,7 @@ function writeLaunchFile(launchPath, config) {
 function readLaunchFile(launchPath) {
   const empty = { version: "0.0.1", configurations: [] };
   if (!existsSync5(launchPath)) return empty;
-  const raw = readFileSync7(launchPath, "utf-8").trim();
+  const raw = readFileSync8(launchPath, "utf-8").trim();
   if (!raw) return empty;
   const parsed = JSON.parse(raw);
   if (!parsed || typeof parsed !== "object" || !Array.isArray(parsed.configurations)) return null;
@@ -1258,10 +1331,10 @@ function detectClaudeWorktree(appDir) {
       listWorktrees(appDir).map((worktree) => canonicalPath(worktree.path))
     );
     if (!registered.has(worktreeRoot)) return null;
-    const worktreesDir = dirname3(worktreeRoot);
-    const claudeDir = dirname3(worktreesDir);
+    const worktreesDir = dirname4(worktreeRoot);
+    const claudeDir = dirname4(worktreesDir);
     if (basename(worktreesDir) !== "worktrees" || basename(claudeDir) !== ".claude") return null;
-    const ownerRoot = canonicalPath(dirname3(claudeDir));
+    const ownerRoot = canonicalPath(dirname4(claudeDir));
     if (!registered.has(ownerRoot)) return null;
     return { mainRepoRoot: ownerRoot, worktreeName: basename(worktreeRoot) };
   } catch {
@@ -1270,9 +1343,9 @@ function detectClaudeWorktree(appDir) {
 }
 function canonicalPath(path) {
   try {
-    return realpathSync(path);
+    return realpathSync2(path);
   } catch {
-    return resolve4(path);
+    return resolve5(path);
   }
 }
 function detectLinkedWorktree(appDir) {
@@ -1324,7 +1397,7 @@ function upsertWorktreeLaunchConfig(mainRepoRoot, worktreeName, appDir, opts) {
       // the Claude Code desktop launch.json reference alongside `port`) and
       // verified end-to-end: with it set, the preview server builds from the
       // worktree instead of the session's main repo.
-      cwd: resolve4(appDir)
+      cwd: resolve5(appDir)
     });
     writeLaunchFile(launchPath, config);
     return { entryName, port };
@@ -1350,9 +1423,6 @@ function resolveWorktreePort(appDir) {
   return deriveWorktreePort(linked.worktreeRoot);
 }
 
-// src/cli/lib/dev-vars.ts
-import { existsSync as existsSync7, readFileSync as readFileSync9 } from "fs";
-
 // src/cli/lib/app-tokens.ts
 async function fetchPublicKey(authUrl) {
   const response = await fetch(`${authUrl}/api/auth/jwks`);
@@ -1402,501 +1472,18 @@ async function fetchAppIdentityToken(deployUrl, callerJwt, appId) {
   return body.token;
 }
 
-// src/server/rooms/binding-manifest.ts
-var AUTO_PROVISION_SENTINEL = "auto";
-var VECTORIZE_METRICS = /* @__PURE__ */ new Set(["cosine", "euclidean", "dot-product"]);
-var ALLOWED_BINDING_TYPES = /* @__PURE__ */ new Set([
-  "vectorize",
-  "ai",
-  "r2_bucket",
-  "kv_namespace",
-  "d1",
-  "queue",
-  "browser_rendering",
-  "analytics_engine",
-  "hyperdrive",
-  "ratelimit"
-]);
-var RESERVED_BINDING_NAMES = /* @__PURE__ */ new Set([
-  "ASSETS",
-  "PLATFORM_WORKER",
-  "API_WORKER",
-  "DEEPSPACE_APP_ID",
-  "DEEPSPACE_RESOURCE_ID",
-  "DEEPSPACE_RELEASE_OPERATION_ID",
-  "APP_NAME",
-  "OWNER_USER_ID",
-  "AUTH_JWT_PUBLIC_KEY",
-  "AUTH_JWT_ISSUER",
-  "AUTH_WORKER_URL",
-  "APP_IDENTITY_TOKEN",
-  "APP_OWNER_JWT",
-  "USAGE_EVENTS"
-]);
-function validateBindingManifest(manifest) {
-  if (!Array.isArray(manifest)) {
-    return { valid: false, errors: [{ reason: "Manifest must be an array" }] };
-  }
-  const errors = [];
-  const seenNames = /* @__PURE__ */ new Set();
-  for (const entry of manifest) {
-    if (!entry || typeof entry !== "object") {
-      errors.push({
-        reason: `Entry must be an object (got ${entry === null ? "null" : typeof entry})`
-      });
-      continue;
-    }
-    const e = entry;
-    const type = e.type;
-    const name = e.name;
-    if (typeof type !== "string" || !ALLOWED_BINDING_TYPES.has(type)) {
-      errors.push({
-        reason: `Disallowed binding type: ${typeof type === "string" ? type : `(${typeof type})`}. Allowed: ${[...ALLOWED_BINDING_TYPES].sort().join(", ")}`
-      });
-      continue;
-    }
-    if (typeof name !== "string" || !name) {
-      errors.push({ reason: `Binding of type "${type}" missing 'name' (string)` });
-      continue;
-    }
-    if (RESERVED_BINDING_NAMES.has(name)) {
-      errors.push({ reason: `Binding name "${name}" is reserved by the SDK` });
-      continue;
-    }
-    if (seenNames.has(name)) {
-      errors.push({ reason: `Duplicate binding name "${name}"` });
-      continue;
-    }
-    seenNames.add(name);
-    const binding = entry;
-    const fieldErr = requiredFieldError(binding);
-    if (fieldErr) errors.push({ binding, reason: fieldErr });
-  }
-  if (errors.length) return { valid: false, errors };
-  return { valid: true, bindings: manifest };
-}
-function requiredFieldError(b) {
-  switch (b.type) {
-    case "vectorize": {
-      if (!b.index_name) return `vectorize binding "${b.name}" missing index_name (or "auto")`;
-      if (b.index_name === AUTO_PROVISION_SENTINEL) {
-        if (typeof b.dimensions !== "number" || b.dimensions <= 0) {
-          return `vectorize binding "${b.name}" with index_name="auto" requires "dimensions" (positive number)`;
-        }
-        if (!b.metric || !VECTORIZE_METRICS.has(b.metric)) {
-          return `vectorize binding "${b.name}" with index_name="auto" requires "metric" (one of: ${[...VECTORIZE_METRICS].join(", ")})`;
-        }
-      }
-      return null;
-    }
-    case "r2_bucket":
-      return b.bucket_name ? null : `r2_bucket binding "${b.name}" missing bucket_name (or "auto")`;
-    case "kv_namespace": {
-      if (!b.namespace_id)
-        return `kv_namespace binding "${b.name}" missing namespace_id (or "auto")`;
-      if (b.namespace_id === AUTO_PROVISION_SENTINEL && !b.title) {
-        return `kv_namespace binding "${b.name}" with namespace_id="auto" requires "title"`;
-      }
-      return null;
-    }
-    case "d1": {
-      if (!b.id) return `d1 binding "${b.name}" missing id (or "auto")`;
-      if (b.id === AUTO_PROVISION_SENTINEL && !b.database_name) {
-        return `d1 binding "${b.name}" with id="auto" requires "database_name"`;
-      }
-      return null;
-    }
-    case "queue":
-      return b.queue_name ? null : `queue binding "${b.name}" missing queue_name (or "auto")`;
-    case "hyperdrive":
-      if (!b.id) return `hyperdrive binding "${b.name}" missing id`;
-      if (b.id === AUTO_PROVISION_SENTINEL) {
-        return `hyperdrive binding "${b.name}": auto-provisioning not yet supported (provide a real id)`;
-      }
-      return null;
-    case "ratelimit":
-      if (!/^\d+$/u.test(b.namespace_id) || Number(b.namespace_id) <= 0) {
-        return `ratelimit binding "${b.name}" requires a positive integer namespace_id string`;
-      }
-      if (!Number.isInteger(b.simple?.limit) || b.simple.limit <= 0) {
-        return `ratelimit binding "${b.name}" requires simple.limit (positive integer)`;
-      }
-      if (b.simple.period !== 10 && b.simple.period !== 60) {
-        return `ratelimit binding "${b.name}" requires simple.period (10 or 60)`;
-      }
-      return null;
-    case "ai":
-    case "browser_rendering":
-    case "analytics_engine":
-      return null;
-    // no required fields beyond `name`
-    default: {
-      const _exhaustive = b;
-      void _exhaustive;
-      return null;
-    }
-  }
-}
-function bindingManifestFromOutputConfig(outputConfig) {
-  const out = [];
-  const aiBinding = pluckString(outputConfig.ai, "binding");
-  if (aiBinding) out.push({ type: "ai", name: aiBinding });
-  for (const v of asObjectArray(outputConfig.vectorize)) {
-    const name = pluckString(v, "binding");
-    const index_name = pluckString(v, "index_name");
-    if (!name || !index_name) continue;
-    const dimensions = pluckNumber(v, "dimensions");
-    const metric = pluckString(v, "metric");
-    out.push({
-      type: "vectorize",
-      name,
-      index_name,
-      ...dimensions != null && { dimensions },
-      ...metric && (metric === "cosine" || metric === "euclidean" || metric === "dot-product") && { metric }
-    });
-  }
-  for (const r of asObjectArray(outputConfig.r2_buckets)) {
-    const name = pluckString(r, "binding");
-    const bucket_name = pluckString(r, "bucket_name");
-    if (name && bucket_name) out.push({ type: "r2_bucket", name, bucket_name });
-  }
-  for (const k of asObjectArray(outputConfig.kv_namespaces)) {
-    const name = pluckString(k, "binding");
-    const namespace_id = pluckString(k, "id");
-    if (!name || !namespace_id) continue;
-    const title = pluckString(k, "title");
-    out.push({
-      type: "kv_namespace",
-      name,
-      namespace_id,
-      ...title && { title }
-    });
-  }
-  for (const d of asObjectArray(outputConfig.d1_databases)) {
-    const name = pluckString(d, "binding");
-    const id = pluckString(d, "database_id");
-    if (!name || !id) continue;
-    const database_name = pluckString(d, "database_name");
-    out.push({
-      type: "d1",
-      name,
-      id,
-      ...database_name && { database_name }
-    });
-  }
-  const queues = isObject(outputConfig.queues) ? outputConfig.queues : null;
-  for (const q of asObjectArray(queues?.producers)) {
-    const name = pluckString(q, "binding");
-    const queue_name = pluckString(q, "queue");
-    if (name && queue_name) out.push({ type: "queue", name, queue_name });
-  }
-  const browserBinding = pluckString(outputConfig.browser, "binding");
-  if (browserBinding) out.push({ type: "browser_rendering", name: browserBinding });
-  for (const a of asObjectArray(outputConfig.analytics_engine_datasets)) {
-    const name = pluckString(a, "binding");
-    const dataset = pluckString(a, "dataset");
-    if (name) out.push({ type: "analytics_engine", name, dataset: dataset ?? void 0 });
-  }
-  for (const h of asObjectArray(outputConfig.hyperdrive)) {
-    const name = pluckString(h, "binding");
-    const id = pluckString(h, "id");
-    if (name && id) out.push({ type: "hyperdrive", name, id });
-  }
-  for (const r of asObjectArray(outputConfig.ratelimits)) {
-    const name = pluckString(r, "name");
-    const namespace_id = pluckString(r, "namespace_id");
-    const simple = isObject(r.simple) ? r.simple : null;
-    const limit = pluckNumber(simple, "limit");
-    const period = pluckNumber(simple, "period");
-    if (!name || !namespace_id || limit === null || period !== 10 && period !== 60) continue;
-    out.push({ type: "ratelimit", name, namespace_id, simple: { limit, period } });
-  }
-  return out;
-}
-function isObject(v) {
-  return v !== null && typeof v === "object" && !Array.isArray(v);
-}
-function pluckString(v, key) {
-  if (!isObject(v)) return null;
-  const val = v[key];
-  return typeof val === "string" && val.length > 0 ? val : null;
-}
-function pluckNumber(v, key) {
-  if (!isObject(v)) return null;
-  const val = v[key];
-  return typeof val === "number" && Number.isFinite(val) ? val : null;
-}
-function asObjectArray(v) {
-  if (!Array.isArray(v)) return [];
-  return v.filter(isObject);
-}
-
-// src/cli/lib/secrets.ts
-var GENERATED_SECRETS_DIVIDER = "# --- DeepSpace secrets cache: generated by `npx deepspace secrets`; do not edit manually ---";
-var RESERVED_SECRET_NAMES = /* @__PURE__ */ new Set([
-  ...RESERVED_BINDING_NAMES,
-  "API_WORKER_URL",
-  "PLATFORM_WORKER_URL"
-]);
-var SECRET_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
-var CONFIG_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
-var MAX_SECRET_VALUE_BYTES = 32 * 1024;
-function validateConfigName(configName) {
-  if (!CONFIG_NAME_RE.test(configName)) {
-    throw new Error(
-      `Invalid config "${configName}". Use letters, numbers, underscores, or hyphens; start with a letter or number.`
-    );
-  }
-  return configName;
-}
-function validateSecretName(name) {
-  if (!SECRET_NAME_RE.test(name)) {
-    throw new Error(
-      `Invalid secret name "${name}". Use letters, numbers, and underscores; start with a letter or underscore.`
-    );
-  }
-  if (RESERVED_SECRET_NAMES.has(name)) {
-    throw new Error(
-      `"${name}" is managed by the DeepSpace SDK and can't be set as an app secret \u2014 the platform injects it at deploy time.`
-    );
-  }
-  return name;
-}
-function validateSecretValue(key, value) {
-  if (new TextEncoder().encode(value).byteLength > MAX_SECRET_VALUE_BYTES) {
-    throw new Error(`Secret "${key}" exceeds ${MAX_SECRET_VALUE_BYTES} bytes`);
-  }
-}
-function defaultConfigNameForEnv(wranglerEnv) {
-  return wranglerEnv ?? "prd";
-}
-async function secretsApi(deployUrl, token, path, init = {}) {
-  const res = await fetch(`${deployUrl}/api/secrets${path}`, {
-    ...init,
-    headers: {
-      Authorization: `Bearer ${token}`,
-      "Content-Type": "application/json",
-      ...init.headers ?? {}
-    }
-  });
-  const body = await res.json().catch(() => ({}));
-  if (!res.ok) {
-    const err = new Error(body.error ?? `Secrets request failed (${res.status})`);
-    err.status = res.status;
-    err.apiPath = path;
-    throw err;
-  }
-  return body;
-}
-function listSecrets(deployUrl, token, appId, configName) {
-  return secretsApi(deployUrl, token, `/${appId}/configs/${encodeURIComponent(configName)}`);
-}
-function fetchSecretsValues(deployUrl, token, appId, configName) {
-  return secretsApi(deployUrl, token, `/${appId}/configs/${encodeURIComponent(configName)}/values`);
-}
-function getSecretPlain(deployUrl, token, appId, configName, key) {
-  return secretsApi(
-    deployUrl,
-    token,
-    `/${appId}/configs/${encodeURIComponent(configName)}/secrets/${encodeURIComponent(key)}?plain=true`
-  );
-}
-function setSecret(deployUrl, token, appId, configName, key, value) {
-  return secretsApi(
-    deployUrl,
-    token,
-    `/${appId}/configs/${encodeURIComponent(configName)}/secrets/${encodeURIComponent(key)}`,
-    { method: "PUT", body: JSON.stringify({ value }) }
-  );
-}
-function deleteSecret(deployUrl, token, appId, configName, key) {
-  return secretsApi(
-    deployUrl,
-    token,
-    `/${appId}/configs/${encodeURIComponent(configName)}/secrets/${encodeURIComponent(key)}`,
-    { method: "DELETE" }
-  );
-}
-function uploadSecrets(deployUrl, token, appId, configName, secrets, replace) {
-  return secretsApi(
-    deployUrl,
-    token,
-    `/${appId}/configs/${encodeURIComponent(configName)}/secrets`,
-    { method: "PUT", body: JSON.stringify({ secrets, replace }) }
-  );
-}
-function listConfigs(deployUrl, token, appId) {
-  return secretsApi(deployUrl, token, `/${appId}/configs`);
-}
-function createConfig(deployUrl, token, appId, configName, copyFrom) {
-  return secretsApi(deployUrl, token, `/${appId}/configs`, {
-    method: "POST",
-    body: JSON.stringify({ name: configName, ...copyFrom ? { copyFrom } : {} })
-  });
-}
-function deleteConfig(deployUrl, token, appId, configName) {
-  return secretsApi(deployUrl, token, `/${appId}/configs/${encodeURIComponent(configName)}`, {
-    method: "DELETE"
-  });
-}
-async function pullAppSecretsCache(deployUrl, token, appId, configName) {
-  try {
-    const { secrets } = await fetchSecretsValues(deployUrl, token, appId, configName);
-    if (secrets === null || typeof secrets !== "object" || Array.isArray(secrets)) {
-      throw new ApiError(
-        `The secrets service at ${deployUrl} returned an unexpected response shape \u2014 check DEEPSPACE_DEPLOY_URL (is this the service the app lives on?).`,
-        200,
-        "invalid_response",
-        `/${appId}/configs/${configName}/values`
-      );
-    }
-    return { appId, configName, values: secrets };
-  } catch (err) {
-    if (err?.status === 404) return null;
-    throw err;
-  }
-}
-function quoteDotenvValue(value) {
-  if (/^[A-Za-z0-9_./:@+-]*$/.test(value) && value !== "") return value;
-  const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r");
-  return `"${escaped}"`;
-}
-function renderSecretsCache(secrets, source) {
-  const keys = Object.keys(secrets).sort();
-  const lines = [
-    GENERATED_SECRETS_DIVIDER,
-    `# app ${source.appId} \xB7 config ${source.configName}`,
-    "# Use `npx deepspace secrets` to change these values."
-  ];
-  for (const key of keys) {
-    validateSecretValue(key, secrets[key]);
-    lines.push(`${key}=${quoteDotenvValue(secrets[key])}`);
-  }
-  return lines.join("\n");
-}
-function stripGeneratedSecretsCache(content) {
-  const idx = content.indexOf(GENERATED_SECRETS_DIVIDER);
-  if (idx === -1) return content;
-  return content.slice(0, idx).trimEnd() + "\n";
-}
-function parseSecretsUpload(content) {
-  const trimmed = content.trim();
-  if (!trimmed) return {};
-  if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
-    const parsed = JSON.parse(trimmed);
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-      throw new Error("JSON upload must be an object of KEY=value strings.");
-    }
-    const out2 = {};
-    for (const [key, value] of Object.entries(parsed)) {
-      validateSecretName(key);
-      if (typeof value !== "string") throw new Error(`Secret "${key}" must be a string`);
-      validateSecretValue(key, value);
-      out2[key] = value;
-    }
-    return out2;
-  }
-  const out = {};
-  const lines = trimmed.split(/\r?\n/);
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i].trim();
-    if (!line || line.startsWith("#")) continue;
-    const eq = line.indexOf("=");
-    if (eq <= 0) continue;
-    const key = line.slice(0, eq).trim();
-    if (!SECRET_NAME_RE.test(key)) continue;
-    validateSecretName(key);
-    const raw = line.slice(eq + 1).trim();
-    const quote = raw[0] === '"' || raw[0] === "'" ? raw[0] : null;
-    let value;
-    if (!quote) {
-      value = raw;
-    } else if (endsWithUnescapedQuote(raw.slice(1), quote)) {
-      const inner = raw.slice(1, -1);
-      value = quote === '"' ? unescapeDotenv(inner) : inner;
-    } else {
-      const startLine = i + 1;
-      const parts = [raw.slice(1)];
-      let closed = false;
-      while (++i < lines.length) {
-        const cont = lines[i].trimEnd();
-        if (endsWithUnescapedQuote(cont, quote)) {
-          parts.push(cont.slice(0, -1));
-          closed = true;
-          break;
-        }
-        parts.push(lines[i]);
-      }
-      if (!closed) {
-        throw new Error(
-          `Unterminated quoted value for "${key}" (opens on line ${startLine}). Close the ${quote === '"' ? "double" : "single"} quote, or escape newlines as \\n on one line.`
-        );
-      }
-      value = parts.join("\n");
-      if (quote === '"') value = unescapeDotenv(value);
-    }
-    validateSecretValue(key, value);
-    out[key] = value;
-  }
-  return out;
-}
-function endsWithUnescapedQuote(s, q) {
-  if (!s.endsWith(q)) return false;
-  if (q === "'") return true;
-  let backslashes = 0;
-  for (let j = s.length - 2; j >= 0 && s[j] === "\\"; j--) backslashes++;
-  return backslashes % 2 === 0;
-}
-function unescapeDotenv(v) {
-  let out = "";
-  for (let i = 0; i < v.length; i++) {
-    if (v[i] === "\\" && i + 1 < v.length) {
-      const c = v[++i];
-      out += c === "n" ? "\n" : c === "r" ? "\r" : c;
-    } else {
-      out += v[i];
-    }
-  }
-  return out;
-}
-function shellSingleQuote(value) {
-  return `'${value.replace(/'/g, "'\\''")}'`;
-}
-function formatSecretsDownload(secrets, format) {
-  const entries = Object.entries(secrets).sort(([a], [b]) => a.localeCompare(b));
-  if (format === "json") {
-    return JSON.stringify(Object.fromEntries(entries), null, 2) + "\n";
-  }
-  if (format === "shell") {
-    return entries.map(([k, v]) => `export ${k}=${shellSingleQuote(v)}`).join("\n") + "\n";
-  }
-  return entries.map(([k, v]) => `${k}=${quoteDotenvValue(v)}`).join("\n") + "\n";
-}
-async function refreshSecretsCache(deployUrl, token, appId, wranglerEnv) {
-  const configName = defaultConfigNameForEnv(wranglerEnv);
-  const pulled = await pullAppSecretsCache(deployUrl, token, appId, configName);
-  if (!pulled) return null;
-  const count = Object.keys(pulled.values).length;
-  return {
-    pulled,
-    rendered: renderSecretsCache(pulled.values, pulled),
-    // An empty store is the common case and not worth a status line.
-    summary: count ? `Secrets: ${pulled.configName} (${count} secret${count === 1 ? "" : "s"})` : null
-  };
-}
-
-// src/cli/lib/secure-file.ts
-import { chmodSync, writeFileSync as writeFileSync5 } from "fs";
-function writeSecretFileSync(path, content) {
-  writeFileSync5(path, content, { mode: 384 });
-  try {
-    chmodSync(path, 384);
-  } catch {
+// src/cli/lib/secure-file.ts
+import { chmodSync, writeFileSync as writeFileSync5 } from "fs";
+function writeSecretFileSync(path, content) {
+  writeFileSync5(path, content, { mode: 384 });
+  try {
+    chmodSync(path, 384);
+  } catch {
   }
 }
 
 // src/cli/lib/wrangler-env.ts
-import { existsSync as existsSync6, readFileSync as readFileSync8, rmSync as rmSync2, writeFileSync as writeFileSync6 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync9, rmSync as rmSync2, writeFileSync as writeFileSync6 } from "fs";
 import { join as join7 } from "path";
 import { parse as parseToml3, stringify as stringifyToml } from "smol-toml";
 
@@ -1997,26 +1584,12 @@ function resolveAppNameForEnv(config, envName) {
   }
   return resolveAppName(envBlock.name);
 }
-function devVarsPathFor(appDir, envName, opts = {}) {
-  if (opts.sharedDevVarsCache || !envName) return join7(appDir, ".dev.vars");
-  return join7(appDir, `.dev.vars.${envName}`);
-}
-function legacyEnvDevVarsPathFor(appDir, envName) {
-  return envName ? join7(appDir, `.dev.vars.${envName}`) : void 0;
-}
-function warnIfLegacyEnvDevVarsExists(appDir, envName, warn = console.warn) {
-  const legacyPath = legacyEnvDevVarsPathFor(appDir, envName);
-  if (!legacyPath || !existsSync6(legacyPath)) return;
-  warn(
-    `Warning: ${legacyPath} exists, but DeepSpace now uses ${devVarsPathFor(appDir, envName, { sharedDevVarsCache: true })} for every environment. This run will ignore ${legacyPath}; move any secrets you still need into .dev.vars, then remove the env-specific file when you're ready.`
-  );
+function devVarsPathFor(appDir) {
+  return join7(appDir, ".dev.vars");
 }
-function prepareWranglerEnvConfig(appDir, envName, opts = {}) {
+function prepareWranglerEnvConfig(appDir, envName) {
   if (!envName) return { cleanup() {
   } };
-  if (!opts.sharedDevVarsCache) return { wranglerEnv: envName, cleanup() {
-  } };
-  warnIfLegacyEnvDevVarsExists(appDir, envName, opts.warn);
   const config = readWranglerConfig(appDir);
   const resolved = resolveAppNameForEnv(config, envName);
   if (!resolved.ok) throw new Error(resolved.reason);
@@ -2045,8 +1618,6 @@ function wranglerViteEnv(baseEnv, prepared, extraEnv = {}) {
   if (prepared.configPath) {
     delete env.CLOUDFLARE_ENV;
     env.CLOUDFLARE_VITE_WRANGLER_CONFIG_PATH = prepared.configPath;
-  } else if (prepared.wranglerEnv) {
-    env.CLOUDFLARE_ENV = prepared.wranglerEnv;
   }
   return env;
 }
@@ -2090,7 +1661,7 @@ var WranglerConfigError = class extends Error {
 };
 function readWranglerConfig(appDir) {
   const path = join7(appDir, "wrangler.toml");
-  const raw = readFileSync8(path, "utf-8");
+  const raw = readFileSync9(path, "utf-8");
   try {
     return parseToml3(raw);
   } catch (err) {
@@ -2102,369 +1673,706 @@ function hasWranglerConfig(appDir) {
 }
 
 // src/cli/lib/dev-vars.ts
-var SDK_MANAGED_KEYS = /* @__PURE__ */ new Set([
+var HEADER = [
+  "# Generated by deepspace \u2014 do not edit; this file is rewritten on every",
+  "# dev, test, deploy, and secrets pull run. App values live in the secret store:",
+  "#   npx deepspace secrets set KEY=value"
+].join("\n");
+function requireAppIdFor(appDir, wranglerEnv) {
+  const id = readAppId(appDir, wranglerEnv);
+  if (id) return id;
+  throw new Error(
+    "wrangler.toml has no DEEPSPACE_APP_ID" + (wranglerEnv ? ` for [env.${wranglerEnv}]` : "") + ". Run `deepspace app init` (or `deepspace app init --env <name>`) and retry."
+  );
+}
+async function writeDevVars(appDir, ownerId, callerJwt, wranglerEnv, opts = {}) {
+  const urls = PLATFORM_URLS;
+  const publicKey = await fetchPublicKey(urls.auth);
+  const appId = opts.appId ?? requireAppIdFor(appDir, wranglerEnv);
+  const appOwnerJwt = await mintAppOwnerJwt(urls.auth, callerJwt, appId);
+  const appIdentityToken = await fetchAppIdentityToken(urls.deploy, callerJwt, appId);
+  const sdkVars = [
+    `AUTH_JWT_PUBLIC_KEY="${publicKey}"`,
+    `AUTH_JWT_ISSUER=${urls.auth}/api/auth`,
+    `AUTH_WORKER_URL=${urls.auth}`,
+    `API_WORKER_URL=${urls.api}`,
+    `PLATFORM_WORKER_URL=${urls.platform}`,
+    `OWNER_USER_ID=${ownerId}`,
+    `APP_OWNER_JWT=${appOwnerJwt}`,
+    ...appIdentityToken ? [`APP_IDENTITY_TOKEN=${appIdentityToken}`] : [],
+    `ALLOW_DEBUG_ROUTES=true`
+  ].join("\n");
+  const devVarsPath = devVarsPathFor(appDir);
+  const cache = opts.generatedSecretsCache;
+  writeSecretFileSync(
+    devVarsPath,
+    [HEADER, "", sdkVars, ...cache ? ["", cache] : [], ""].join("\n")
+  );
+}
+
+// src/cli/lib/install-status.ts
+import { existsSync as existsSync8, readFileSync as readFileSync11, realpathSync as realpathSync3 } from "fs";
+import { dirname as dirname5, join as join9, resolve as resolve6 } from "path";
+
+// src/cli/lib/package-manager.ts
+import { existsSync as existsSync7, readFileSync as readFileSync10 } from "fs";
+import { join as join8 } from "path";
+function detectPackageManager(appDir) {
+  try {
+    const pkg2 = JSON.parse(readFileSync10(join8(appDir, "package.json"), "utf-8"));
+    const name = typeof pkg2.packageManager === "string" ? pkg2.packageManager.split("@")[0] : "";
+    if (name === "npm" || name === "pnpm" || name === "yarn" || name === "bun") return name;
+  } catch {
+  }
+  if (existsSync7(join8(appDir, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync7(join8(appDir, "yarn.lock"))) return "yarn";
+  if (existsSync7(join8(appDir, "bun.lock")) || existsSync7(join8(appDir, "bun.lockb"))) return "bun";
+  return "npm";
+}
+function installCommand(appDir) {
+  return `${detectPackageManager(appDir)} install`;
+}
+
+// src/cli/lib/install-status.ts
+function installState(appDir) {
+  if (resolvesDeepspace(appDir)) return "ready";
+  const sentinelDir = join9(appDir, ".deepspace");
+  if (existsSync8(join9(sentinelDir, "install.err"))) return "failed";
+  if (existsSync8(join9(sentinelDir, "install.started"))) {
+    if (!existsSync8(join9(sentinelDir, "install.done")) && installWorkerAlive(sentinelDir)) {
+      return "installing";
+    }
+    return "failed";
+  }
+  return "missing";
+}
+function tailHint(logPath, platform = process.platform) {
+  return platform === "win32" ? `Get-Content -Wait ${logPath}` : `tail -f ${logPath}`;
+}
+function ensureInstallReady(appDir) {
+  if (resolvesDeepspace(appDir)) return;
+  const sentinelDir = join9(appDir, ".deepspace");
+  const errPath = join9(sentinelDir, "install.err");
+  const startedPath = join9(sentinelDir, "install.started");
+  const donePath = join9(sentinelDir, "install.done");
+  const logPath = join9(sentinelDir, "install.log");
+  if (existsSync8(errPath)) {
+    const detail = readFileSync11(errPath, "utf-8").trimEnd();
+    const log29 = existsSync8(logPath) ? ` Full log: ${logPath}.` : "";
+    throw new Refusal(
+      `Dependency install failed: ${detail}.${log29} Run \`npm install\` (or \`bun install\`) manually, then retry.`,
+      "install_failed",
+      { action: { cwd: appDir, argv: [detectPackageManager(appDir), "install"] } }
+    );
+  }
+  if (existsSync8(startedPath) && !existsSync8(donePath)) {
+    if (!installWorkerAlive(sentinelDir)) {
+      const log29 = existsSync8(logPath) ? ` See what happened: ${logPath}.` : "";
+      throw new Refusal(
+        `The dependency install is no longer running and never finished.${log29} Run \`npm install\` (or \`bun install\`) manually, then retry.`,
+        "install_failed",
+        { action: { cwd: appDir, argv: [detectPackageManager(appDir), "install"] } }
+      );
+    }
+    const tail = existsSync8(logPath) ? ` Tail progress: ${tailHint(logPath)}.` : "";
+    throw new Refusal(
+      `Dependencies are still installing.${tail} Retry once it finishes.`,
+      "install_in_progress"
+    );
+  }
+  throw new Refusal(
+    "Dependencies not installed. Run `npm install` (or `bun install`) first.",
+    "deps_missing",
+    {
+      action: { cwd: appDir, argv: [detectPackageManager(appDir), "install"] }
+    }
+  );
+}
+function resolvesDeepspace(fromDir) {
+  let dir = canonicalPath2(fromDir);
+  let checkoutRoot = null;
+  try {
+    checkoutRoot = canonicalPath2(repoToplevel(dir));
+  } catch {
+  }
+  for (; ; ) {
+    if (existsSync8(join9(dir, "node_modules", "deepspace", "package.json"))) return true;
+    if (dir === checkoutRoot) return false;
+    const parent = dirname5(dir);
+    if (parent === dir) return false;
+    dir = parent;
+  }
+}
+function canonicalPath2(path) {
+  try {
+    return realpathSync3(path);
+  } catch {
+    return resolve6(path);
+  }
+}
+function installWorkerAlive(sentinelDir) {
+  const pidPath = join9(sentinelDir, "install.pid");
+  if (!existsSync8(pidPath)) return false;
+  const pid = Number(readFileSync11(pidPath, "utf-8").trim());
+  if (!Number.isSafeInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err.code === "EPERM";
+  }
+}
+
+// src/cli/lib/preflight.ts
+import { execFileSync } from "child_process";
+import { existsSync as existsSync9 } from "fs";
+import * as nodeModule from "module";
+import { resolve as resolve7 } from "path";
+function preflightNodeVersion(command, hasRegisterHooks = typeof nodeModule.registerHooks === "function", version = process.versions.node) {
+  const [major, minor] = version.split(".").map(Number);
+  const supportedLine = major === 22 && minor >= 15 || major === 24 || major === 26;
+  if (hasRegisterHooks && supportedLine) return;
+  throw new Refusal(
+    `deepspace ${command} requires a supported Node release: 22.15+, 24, or 26 (found v${version}). Install the current LTS from https://nodejs.org and re-run.`,
+    supportedLine ? "node_capability_missing" : "node_unsupported"
+  );
+}
+var DLL_NOT_FOUND = -1073741515;
+function preflightWindowsWorkerd(appDir) {
+  if (process.platform !== "win32") return;
+  const workerdExe = resolve7(
+    appDir,
+    "node_modules",
+    "@cloudflare",
+    "workerd-windows-64",
+    "bin",
+    "workerd.exe"
+  );
+  if (!existsSync9(workerdExe)) return;
+  try {
+    execFileSync(workerdExe, ["--help"], { stdio: "pipe", timeout: 1e4 });
+    return;
+  } catch (err) {
+    const status3 = err.status;
+    if (status3 !== DLL_NOT_FOUND) return;
+    throw new Refusal(
+      "workerd (Cloudflare Workers runtime) cannot start on this system: it needs the Microsoft Visual C++ Redistributable, which is not installed. Install it with `winget install Microsoft.VCRedist.2015+.x64` (or choco install -y vcredist140, or https://aka.ms/vs/17/release/vc_redist.x64.exe), then restart this terminal and re-run.",
+      "vcredist_missing"
+    );
+  }
+}
+
+// src/cli/lib/macos-junk.ts
+import { readdirSync as readdirSync2, rmSync as rmSync3 } from "fs";
+import { join as join10 } from "path";
+var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", ".wrangler", ".vite"]);
+function removeMacosJunk(dir) {
+  let removed = 0;
+  let entries;
+  try {
+    entries = readdirSync2(dir, { withFileTypes: true });
+  } catch {
+    return removed;
+  }
+  for (const entry of entries) {
+    const path = join10(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (!SKIP_DIRS.has(entry.name)) removed += removeMacosJunk(path);
+      continue;
+    }
+    if (entry.name === ".DS_Store" || entry.name.startsWith("._")) {
+      try {
+        rmSync3(path, { force: true });
+        removed++;
+      } catch {
+      }
+    }
+  }
+  return removed;
+}
+
+// src/server/rooms/binding-manifest.ts
+var AUTO_PROVISION_SENTINEL = "auto";
+var VECTORIZE_METRICS = /* @__PURE__ */ new Set(["cosine", "euclidean", "dot-product"]);
+var ALLOWED_BINDING_TYPES = /* @__PURE__ */ new Set([
+  "vectorize",
+  "ai",
+  "r2_bucket",
+  "kv_namespace",
+  "d1",
+  "queue",
+  "browser_rendering",
+  "analytics_engine",
+  "hyperdrive",
+  "ratelimit"
+]);
+var RESERVED_BINDING_NAMES = /* @__PURE__ */ new Set([
+  "ASSETS",
+  "PLATFORM_WORKER",
+  "API_WORKER",
+  "DEEPSPACE_APP_ID",
+  "DEEPSPACE_RESOURCE_ID",
+  "DEEPSPACE_RELEASE_OPERATION_ID",
+  "APP_NAME",
+  "OWNER_USER_ID",
   "AUTH_JWT_PUBLIC_KEY",
   "AUTH_JWT_ISSUER",
   "AUTH_WORKER_URL",
-  "API_WORKER_URL",
-  "PLATFORM_WORKER_URL",
-  "OWNER_USER_ID",
-  "APP_OWNER_JWT",
   "APP_IDENTITY_TOKEN",
-  "ALLOW_DEBUG_ROUTES"
+  "APP_OWNER_JWT",
+  "USAGE_EVENTS"
 ]);
-var DEV_VARS_DIVIDER = "# --- not managed by the SDK; preserved across dev/test runs ---";
-function extractCustomDevVars(content) {
-  const lines = content.split("\n");
-  const out = [];
-  let belowDivider = false;
-  let i = 0;
-  while (i < lines.length) {
-    const line = lines[i];
-    if (line.trim() === DEV_VARS_DIVIDER.trim()) {
-      belowDivider = true;
-      i++;
-      continue;
-    }
-    const eq = line.indexOf("=");
-    const keyMatch = eq >= 0 ? line.slice(0, eq).match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*$/) : null;
-    if (!keyMatch) {
-      out.push(line);
-      i++;
-      continue;
-    }
-    const key = keyMatch[1];
-    const valueStart = line.slice(eq + 1);
-    const block = [line];
-    if (valueStart.startsWith('"') && !hasUnescapedQuote(valueStart.slice(1))) {
-      i++;
-      while (i < lines.length) {
-        block.push(lines[i]);
-        const closed = hasUnescapedQuote(lines[i]);
-        i++;
-        if (closed) break;
-      }
-    } else {
-      i++;
-    }
-    if (belowDivider || !SDK_MANAGED_KEYS.has(key)) out.push(...block);
+function validateBindingManifest(manifest) {
+  if (!Array.isArray(manifest)) {
+    return { valid: false, errors: [{ reason: "Manifest must be an array" }] };
   }
-  while (out.length && out[out.length - 1].trim() === "") out.pop();
-  return out.join("\n");
-}
-function hasUnescapedQuote(value) {
-  let escaped = false;
-  for (const char of value) {
-    if (escaped) {
-      escaped = false;
+  const errors = [];
+  const seenNames = /* @__PURE__ */ new Set();
+  for (const entry of manifest) {
+    if (!entry || typeof entry !== "object") {
+      errors.push({
+        reason: `Entry must be an object (got ${entry === null ? "null" : typeof entry})`
+      });
       continue;
     }
-    if (char === "\\") {
-      escaped = true;
+    const e = entry;
+    const type = e.type;
+    const name = e.name;
+    if (typeof type !== "string" || !ALLOWED_BINDING_TYPES.has(type)) {
+      errors.push({
+        reason: `Disallowed binding type: ${typeof type === "string" ? type : `(${typeof type})`}. Allowed: ${[...ALLOWED_BINDING_TYPES].sort().join(", ")}`
+      });
       continue;
     }
-    if (char === '"') return true;
-  }
-  return false;
-}
-function parseDevVars(content) {
-  const result = {};
-  const lines = content.split("\n");
-  let i = 0;
-  while (i < lines.length) {
-    const line = lines[i];
-    const trimmed = line.trim();
-    if (!trimmed || trimmed.startsWith("#")) {
-      i++;
+    if (typeof name !== "string" || !name) {
+      errors.push({ reason: `Binding of type "${type}" missing 'name' (string)` });
       continue;
     }
-    const eq = line.indexOf("=");
-    if (eq < 0) {
-      i++;
+    if (RESERVED_BINDING_NAMES.has(name)) {
+      errors.push({ reason: `Binding name "${name}" is reserved by the SDK` });
       continue;
     }
-    const keyMatch = line.slice(0, eq).match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*$/);
-    if (!keyMatch) {
-      i++;
+    if (seenNames.has(name)) {
+      errors.push({ reason: `Duplicate binding name "${name}"` });
       continue;
     }
-    const key = keyMatch[1];
-    let value = line.slice(eq + 1);
-    let closed = !value.startsWith('"') || hasUnescapedQuote(value.slice(1));
-    if (!closed) {
-      i++;
-      while (i < lines.length) {
-        value += "\n" + lines[i];
-        if (hasUnescapedQuote(lines[i])) {
-          closed = true;
-          i++;
-          break;
+    seenNames.add(name);
+    const binding = entry;
+    const fieldErr = requiredFieldError(binding);
+    if (fieldErr) errors.push({ binding, reason: fieldErr });
+  }
+  if (errors.length) return { valid: false, errors };
+  return { valid: true, bindings: manifest };
+}
+function requiredFieldError(b) {
+  switch (b.type) {
+    case "vectorize": {
+      if (!b.index_name) return `vectorize binding "${b.name}" missing index_name (or "auto")`;
+      if (b.index_name === AUTO_PROVISION_SENTINEL) {
+        if (typeof b.dimensions !== "number" || b.dimensions <= 0) {
+          return `vectorize binding "${b.name}" with index_name="auto" requires "dimensions" (positive number)`;
+        }
+        if (!b.metric || !VECTORIZE_METRICS.has(b.metric)) {
+          return `vectorize binding "${b.name}" with index_name="auto" requires "metric" (one of: ${[...VECTORIZE_METRICS].join(", ")})`;
         }
-        i++;
       }
-    } else {
-      i++;
+      return null;
     }
-    if (value.startsWith('"') && !closed) {
-      throw new Error(
-        `parseDevVars: unterminated quoted value for key "${key}" \u2014 check your .dev.vars file for a missing closing quote.`
-      );
+    case "r2_bucket":
+      return b.bucket_name ? null : `r2_bucket binding "${b.name}" missing bucket_name (or "auto")`;
+    case "kv_namespace": {
+      if (!b.namespace_id)
+        return `kv_namespace binding "${b.name}" missing namespace_id (or "auto")`;
+      if (b.namespace_id === AUTO_PROVISION_SENTINEL && !b.title) {
+        return `kv_namespace binding "${b.name}" with namespace_id="auto" requires "title"`;
+      }
+      return null;
     }
-    if (value.startsWith('"') && value.endsWith('"') && value.length >= 2) {
-      value = unescapeQuotedDevVar(value.slice(1, -1));
+    case "d1": {
+      if (!b.id) return `d1 binding "${b.name}" missing id (or "auto")`;
+      if (b.id === AUTO_PROVISION_SENTINEL && !b.database_name) {
+        return `d1 binding "${b.name}" with id="auto" requires "database_name"`;
+      }
+      return null;
+    }
+    case "queue":
+      return b.queue_name ? null : `queue binding "${b.name}" missing queue_name (or "auto")`;
+    case "hyperdrive":
+      if (!b.id) return `hyperdrive binding "${b.name}" missing id`;
+      if (b.id === AUTO_PROVISION_SENTINEL) {
+        return `hyperdrive binding "${b.name}": auto-provisioning not yet supported (provide a real id)`;
+      }
+      return null;
+    case "ratelimit":
+      if (!/^\d+$/u.test(b.namespace_id) || Number(b.namespace_id) <= 0) {
+        return `ratelimit binding "${b.name}" requires a positive integer namespace_id string`;
+      }
+      if (!Number.isInteger(b.simple?.limit) || b.simple.limit <= 0) {
+        return `ratelimit binding "${b.name}" requires simple.limit (positive integer)`;
+      }
+      if (b.simple.period !== 10 && b.simple.period !== 60) {
+        return `ratelimit binding "${b.name}" requires simple.period (10 or 60)`;
+      }
+      return null;
+    case "ai":
+    case "browser_rendering":
+    case "analytics_engine":
+      return null;
+    // no required fields beyond `name`
+    default: {
+      const _exhaustive = b;
+      void _exhaustive;
+      return null;
     }
-    result[key] = value;
   }
-  return result;
 }
-function unescapeQuotedDevVar(value) {
-  let out = "";
-  for (let i = 0; i < value.length; i++) {
-    const char = value[i];
-    if (char !== "\\" || i === value.length - 1) {
-      out += char;
-      continue;
-    }
-    const next = value[i + 1];
-    if (next === "\\" || next === '"') {
-      out += next;
-      i++;
-      continue;
-    }
-    out += char;
+function bindingManifestFromOutputConfig(outputConfig) {
+  const out = [];
+  const aiBinding = pluckString(outputConfig.ai, "binding");
+  if (aiBinding) out.push({ type: "ai", name: aiBinding });
+  for (const v of asObjectArray(outputConfig.vectorize)) {
+    const name = pluckString(v, "binding");
+    const index_name = pluckString(v, "index_name");
+    if (!name || !index_name) continue;
+    const dimensions = pluckNumber(v, "dimensions");
+    const metric = pluckString(v, "metric");
+    out.push({
+      type: "vectorize",
+      name,
+      index_name,
+      ...dimensions != null && { dimensions },
+      ...metric && (metric === "cosine" || metric === "euclidean" || metric === "dot-product") && { metric }
+    });
+  }
+  for (const r of asObjectArray(outputConfig.r2_buckets)) {
+    const name = pluckString(r, "binding");
+    const bucket_name = pluckString(r, "bucket_name");
+    if (name && bucket_name) out.push({ type: "r2_bucket", name, bucket_name });
+  }
+  for (const k of asObjectArray(outputConfig.kv_namespaces)) {
+    const name = pluckString(k, "binding");
+    const namespace_id = pluckString(k, "id");
+    if (!name || !namespace_id) continue;
+    const title = pluckString(k, "title");
+    out.push({
+      type: "kv_namespace",
+      name,
+      namespace_id,
+      ...title && { title }
+    });
+  }
+  for (const d of asObjectArray(outputConfig.d1_databases)) {
+    const name = pluckString(d, "binding");
+    const id = pluckString(d, "database_id");
+    if (!name || !id) continue;
+    const database_name = pluckString(d, "database_name");
+    out.push({
+      type: "d1",
+      name,
+      id,
+      ...database_name && { database_name }
+    });
+  }
+  const queues = isObject(outputConfig.queues) ? outputConfig.queues : null;
+  for (const q of asObjectArray(queues?.producers)) {
+    const name = pluckString(q, "binding");
+    const queue_name = pluckString(q, "queue");
+    if (name && queue_name) out.push({ type: "queue", name, queue_name });
+  }
+  const browserBinding = pluckString(outputConfig.browser, "binding");
+  if (browserBinding) out.push({ type: "browser_rendering", name: browserBinding });
+  for (const a of asObjectArray(outputConfig.analytics_engine_datasets)) {
+    const name = pluckString(a, "binding");
+    const dataset = pluckString(a, "dataset");
+    if (name) out.push({ type: "analytics_engine", name, dataset: dataset ?? void 0 });
+  }
+  for (const h of asObjectArray(outputConfig.hyperdrive)) {
+    const name = pluckString(h, "binding");
+    const id = pluckString(h, "id");
+    if (name && id) out.push({ type: "hyperdrive", name, id });
+  }
+  for (const r of asObjectArray(outputConfig.ratelimits)) {
+    const name = pluckString(r, "name");
+    const namespace_id = pluckString(r, "namespace_id");
+    const simple = isObject(r.simple) ? r.simple : null;
+    const limit = pluckNumber(simple, "limit");
+    const period = pluckNumber(simple, "period");
+    if (!name || !namespace_id || limit === null || period !== 10 && period !== 60) continue;
+    out.push({ type: "ratelimit", name, namespace_id, simple: { limit, period } });
   }
   return out;
 }
-function requireAppIdFor(appDir, wranglerEnv) {
-  const id = readAppId(appDir, wranglerEnv);
-  if (id) return id;
-  throw new Error(
-    "wrangler.toml has no DEEPSPACE_APP_ID" + (wranglerEnv ? ` for [env.${wranglerEnv}]` : "") + ". Run `deepspace app init` (or `deepspace app init --env <name>`) and retry."
-  );
+function isObject(v) {
+  return v !== null && typeof v === "object" && !Array.isArray(v);
 }
-async function writeDevVars(appDir, ownerId, callerJwt, wranglerEnv, opts = {}) {
-  const urls = PLATFORM_URLS;
-  const publicKey = await fetchPublicKey(urls.auth);
-  const appId = opts.appId ?? requireAppIdFor(appDir, wranglerEnv);
-  const appOwnerJwt = await mintAppOwnerJwt(urls.auth, callerJwt, appId);
-  const appIdentityToken = await fetchAppIdentityToken(urls.deploy, callerJwt, appId);
-  const sdkVars = [
-    `AUTH_JWT_PUBLIC_KEY="${publicKey}"`,
-    `AUTH_JWT_ISSUER=${urls.auth}/api/auth`,
-    `AUTH_WORKER_URL=${urls.auth}`,
-    `API_WORKER_URL=${urls.api}`,
-    `PLATFORM_WORKER_URL=${urls.platform}`,
-    `OWNER_USER_ID=${ownerId}`,
-    `APP_OWNER_JWT=${appOwnerJwt}`,
-    ...appIdentityToken ? [`APP_IDENTITY_TOKEN=${appIdentityToken}`] : [],
-    `ALLOW_DEBUG_ROUTES=true`
-  ].join("\n");
-  const useSharedDevVarsCache = opts.sharedDevVarsCache ?? opts.generatedSecretsCache !== void 0;
-  const devVarsPath = devVarsPathFor(appDir, wranglerEnv, {
-    sharedDevVarsCache: useSharedDevVarsCache
-  });
-  const existing = existsSync7(devVarsPath) ? readFileSync9(devVarsPath, "utf-8") : "";
-  const custom = opts.generatedSecretsCache ?? extractCustomDevVars(stripGeneratedSecretsCache(existing).trimEnd());
-  let body;
-  if (!custom) {
-    body = `${sdkVars}
-`;
-  } else if (opts.generatedSecretsCache) {
-    body = `${sdkVars}
-
-${custom}
-`;
-  } else {
-    body = `${sdkVars}
-
-${DEV_VARS_DIVIDER}
-${custom}
-`;
-  }
-  writeSecretFileSync(devVarsPath, body);
+function pluckString(v, key) {
+  if (!isObject(v)) return null;
+  const val = v[key];
+  return typeof val === "string" && val.length > 0 ? val : null;
 }
-
-// src/cli/lib/install-status.ts
-import { existsSync as existsSync9, readFileSync as readFileSync11, realpathSync as realpathSync2 } from "fs";
-import { dirname as dirname4, join as join9, resolve as resolve5 } from "path";
-
-// src/cli/lib/package-manager.ts
-import { existsSync as existsSync8, readFileSync as readFileSync10 } from "fs";
-import { join as join8 } from "path";
-function detectPackageManager(appDir) {
-  try {
-    const pkg2 = JSON.parse(readFileSync10(join8(appDir, "package.json"), "utf-8"));
-    const name = typeof pkg2.packageManager === "string" ? pkg2.packageManager.split("@")[0] : "";
-    if (name === "npm" || name === "pnpm" || name === "yarn" || name === "bun") return name;
-  } catch {
-  }
-  if (existsSync8(join8(appDir, "pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync8(join8(appDir, "yarn.lock"))) return "yarn";
-  if (existsSync8(join8(appDir, "bun.lock")) || existsSync8(join8(appDir, "bun.lockb"))) return "bun";
-  return "npm";
+function pluckNumber(v, key) {
+  if (!isObject(v)) return null;
+  const val = v[key];
+  return typeof val === "number" && Number.isFinite(val) ? val : null;
 }
-function installCommand(appDir) {
-  return `${detectPackageManager(appDir)} install`;
+function asObjectArray(v) {
+  if (!Array.isArray(v)) return [];
+  return v.filter(isObject);
 }
 
-// src/cli/lib/install-status.ts
-function installState(appDir) {
-  if (resolvesDeepspace(appDir)) return "ready";
-  const sentinelDir = join9(appDir, ".deepspace");
-  if (existsSync9(join9(sentinelDir, "install.err"))) return "failed";
-  if (existsSync9(join9(sentinelDir, "install.started"))) {
-    if (!existsSync9(join9(sentinelDir, "install.done")) && installWorkerAlive(sentinelDir)) {
-      return "installing";
-    }
-    return "failed";
+// src/cli/lib/secrets.ts
+var RESERVED_SECRET_NAMES = /* @__PURE__ */ new Set([
+  ...RESERVED_BINDING_NAMES,
+  "API_WORKER_URL",
+  "PLATFORM_WORKER_URL"
+]);
+var SECRET_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var CONFIG_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+var MAX_SECRET_VALUE_BYTES = 32 * 1024;
+function validateConfigName(configName) {
+  if (!CONFIG_NAME_RE.test(configName)) {
+    throw new Error(
+      `Invalid config "${configName}". Use letters, numbers, underscores, or hyphens; start with a letter or number.`
+    );
   }
-  return "missing";
-}
-function tailHint(logPath, platform = process.platform) {
-  return platform === "win32" ? `Get-Content -Wait ${logPath}` : `tail -f ${logPath}`;
+  return configName;
 }
-function ensureInstallReady(appDir) {
-  if (resolvesDeepspace(appDir)) return;
-  const sentinelDir = join9(appDir, ".deepspace");
-  const errPath = join9(sentinelDir, "install.err");
-  const startedPath = join9(sentinelDir, "install.started");
-  const donePath = join9(sentinelDir, "install.done");
-  const logPath = join9(sentinelDir, "install.log");
-  if (existsSync9(errPath)) {
-    const detail = readFileSync11(errPath, "utf-8").trimEnd();
-    const log29 = existsSync9(logPath) ? ` Full log: ${logPath}.` : "";
-    throw new Refusal(
-      `Dependency install failed: ${detail}.${log29} Run \`npm install\` (or \`bun install\`) manually, then retry.`,
-      "install_failed",
-      { action: { cwd: appDir, argv: [detectPackageManager(appDir), "install"] } }
+function validateSecretName(name) {
+  if (!SECRET_NAME_RE.test(name)) {
+    throw new Error(
+      `Invalid secret name "${name}". Use letters, numbers, and underscores; start with a letter or underscore.`
     );
   }
-  if (existsSync9(startedPath) && !existsSync9(donePath)) {
-    if (!installWorkerAlive(sentinelDir)) {
-      const log29 = existsSync9(logPath) ? ` See what happened: ${logPath}.` : "";
-      throw new Refusal(
-        `The dependency install is no longer running and never finished.${log29} Run \`npm install\` (or \`bun install\`) manually, then retry.`,
-        "install_failed",
-        { action: { cwd: appDir, argv: [detectPackageManager(appDir), "install"] } }
-      );
-    }
-    const tail = existsSync9(logPath) ? ` Tail progress: ${tailHint(logPath)}.` : "";
-    throw new Refusal(
-      `Dependencies are still installing.${tail} Retry once it finishes.`,
-      "install_in_progress"
+  if (RESERVED_SECRET_NAMES.has(name)) {
+    throw new Error(
+      `"${name}" is managed by the DeepSpace SDK and can't be set as an app secret \u2014 the platform injects it at deploy time.`
     );
   }
-  throw new Refusal(
-    "Dependencies not installed. Run `npm install` (or `bun install`) first.",
-    "deps_missing",
-    {
-      action: { cwd: appDir, argv: [detectPackageManager(appDir), "install"] }
-    }
-  );
+  return name;
 }
-function resolvesDeepspace(fromDir) {
-  let dir = canonicalPath2(fromDir);
-  let checkoutRoot = null;
-  try {
-    checkoutRoot = canonicalPath2(repoToplevel(dir));
-  } catch {
-  }
-  for (; ; ) {
-    if (existsSync9(join9(dir, "node_modules", "deepspace", "package.json"))) return true;
-    if (dir === checkoutRoot) return false;
-    const parent = dirname4(dir);
-    if (parent === dir) return false;
-    dir = parent;
+function validateSecretValue(key, value) {
+  if (new TextEncoder().encode(value).byteLength > MAX_SECRET_VALUE_BYTES) {
+    throw new Error(`Secret "${key}" exceeds ${MAX_SECRET_VALUE_BYTES} bytes`);
   }
 }
-function canonicalPath2(path) {
-  try {
-    return realpathSync2(path);
-  } catch {
-    return resolve5(path);
+function defaultConfigNameForEnv(wranglerEnv) {
+  return wranglerEnv ?? "prd";
+}
+async function secretsApi(deployUrl, token, path, init = {}) {
+  const res = await fetch(`${deployUrl}/api/secrets${path}`, {
+    ...init,
+    headers: {
+      Authorization: `Bearer ${token}`,
+      "Content-Type": "application/json",
+      ...init.headers ?? {}
+    }
+  });
+  const body = await res.json().catch(() => ({}));
+  if (!res.ok) {
+    const err = new Error(body.error ?? `Secrets request failed (${res.status})`);
+    err.status = res.status;
+    err.apiPath = path;
+    throw err;
   }
+  return body;
 }
-function installWorkerAlive(sentinelDir) {
-  const pidPath = join9(sentinelDir, "install.pid");
-  if (!existsSync9(pidPath)) return false;
-  const pid = Number(readFileSync11(pidPath, "utf-8").trim());
-  if (!Number.isSafeInteger(pid) || pid <= 0) return false;
+function listSecrets(deployUrl, token, appId, configName) {
+  return secretsApi(deployUrl, token, `/${appId}/configs/${encodeURIComponent(configName)}`);
+}
+function fetchSecretsValues(deployUrl, token, appId, configName) {
+  return secretsApi(deployUrl, token, `/${appId}/configs/${encodeURIComponent(configName)}/values`);
+}
+function getSecretPlain(deployUrl, token, appId, configName, key) {
+  return secretsApi(
+    deployUrl,
+    token,
+    `/${appId}/configs/${encodeURIComponent(configName)}/secrets/${encodeURIComponent(key)}?plain=true`
+  );
+}
+function setSecret(deployUrl, token, appId, configName, key, value) {
+  return secretsApi(
+    deployUrl,
+    token,
+    `/${appId}/configs/${encodeURIComponent(configName)}/secrets/${encodeURIComponent(key)}`,
+    { method: "PUT", body: JSON.stringify({ value }) }
+  );
+}
+function deleteSecret(deployUrl, token, appId, configName, key) {
+  return secretsApi(
+    deployUrl,
+    token,
+    `/${appId}/configs/${encodeURIComponent(configName)}/secrets/${encodeURIComponent(key)}`,
+    { method: "DELETE" }
+  );
+}
+function uploadSecrets(deployUrl, token, appId, configName, secrets, replace) {
+  return secretsApi(
+    deployUrl,
+    token,
+    `/${appId}/configs/${encodeURIComponent(configName)}/secrets`,
+    { method: "PUT", body: JSON.stringify({ secrets, replace }) }
+  );
+}
+function listConfigs(deployUrl, token, appId) {
+  return secretsApi(deployUrl, token, `/${appId}/configs`);
+}
+function createConfig(deployUrl, token, appId, configName, copyFrom) {
+  return secretsApi(deployUrl, token, `/${appId}/configs`, {
+    method: "POST",
+    body: JSON.stringify({ name: configName, ...copyFrom ? { copyFrom } : {} })
+  });
+}
+function deleteConfig(deployUrl, token, appId, configName) {
+  return secretsApi(deployUrl, token, `/${appId}/configs/${encodeURIComponent(configName)}`, {
+    method: "DELETE"
+  });
+}
+async function pullAppSecretsCache(deployUrl, token, appId, configName) {
   try {
-    process.kill(pid, 0);
-    return true;
+    const { secrets } = await fetchSecretsValues(deployUrl, token, appId, configName);
+    if (secrets === null || typeof secrets !== "object" || Array.isArray(secrets)) {
+      throw new ApiError(
+        `The secrets service at ${deployUrl} returned an unexpected response shape \u2014 check DEEPSPACE_DEPLOY_URL (is this the service the app lives on?).`,
+        200,
+        "invalid_response",
+        `/${appId}/configs/${configName}/values`
+      );
+    }
+    return { appId, configName, values: secrets };
   } catch (err) {
-    return err.code === "EPERM";
+    if (err?.status === 404) return null;
+    throw err;
   }
 }
-
-// src/cli/lib/preflight.ts
-import { execFileSync } from "child_process";
-import { existsSync as existsSync10 } from "fs";
-import * as nodeModule from "module";
-import { resolve as resolve6 } from "path";
-function preflightNodeVersion(command, hasRegisterHooks = typeof nodeModule.registerHooks === "function") {
-  if (hasRegisterHooks) return;
-  throw new Refusal(
-    `deepspace ${command} requires Node 22.15 or newer (found v${process.versions.node}). Install the current LTS from https://nodejs.org and re-run.`,
-    "node_too_old"
-  );
+function quoteDotenvValue(value) {
+  if (/^[A-Za-z0-9_./:@+-]*$/.test(value) && value !== "") return value;
+  const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r");
+  return `"${escaped}"`;
+}
+function renderSecretsCache(secrets, source) {
+  const keys = Object.keys(secrets).sort();
+  const lines = [`# App secrets \xB7 config ${source.configName} \xB7 app ${source.appId}`];
+  for (const key of keys) {
+    validateSecretValue(key, secrets[key]);
+    lines.push(`${key}=${quoteDotenvValue(secrets[key])}`);
+  }
+  return lines.join("\n");
+}
+function parseSecretsUpload(content) {
+  const trimmed = content.trim();
+  if (!trimmed) return {};
+  if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
+    const parsed = JSON.parse(trimmed);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw new Error("JSON upload must be an object of KEY=value strings.");
+    }
+    const out2 = {};
+    for (const [key, value] of Object.entries(parsed)) {
+      validateSecretName(key);
+      if (typeof value !== "string") throw new Error(`Secret "${key}" must be a string`);
+      validateSecretValue(key, value);
+      out2[key] = value;
+    }
+    return out2;
+  }
+  const out = {};
+  const lines = trimmed.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i].trim();
+    if (!line || line.startsWith("#")) continue;
+    const lineNumber = i + 1;
+    const eq = line.indexOf("=");
+    if (eq <= 0) {
+      throw new Error(`Invalid dotenv assignment on line ${lineNumber}: expected KEY=value.`);
+    }
+    const key = line.slice(0, eq).trim();
+    if (!SECRET_NAME_RE.test(key)) {
+      throw new Error(
+        `Invalid secret name on line ${lineNumber}: use letters, numbers, and underscores; start with a letter or underscore.`
+      );
+    }
+    validateSecretName(key);
+    const raw = line.slice(eq + 1).trim();
+    const quote = raw[0] === '"' || raw[0] === "'" ? raw[0] : null;
+    let value;
+    if (!quote) {
+      value = raw;
+    } else if (endsWithUnescapedQuote(raw.slice(1), quote)) {
+      const inner = raw.slice(1, -1);
+      value = quote === '"' ? unescapeDotenv(inner) : inner;
+    } else {
+      const startLine = i + 1;
+      const parts = [raw.slice(1)];
+      let closed = false;
+      while (++i < lines.length) {
+        const cont = lines[i].trimEnd();
+        if (endsWithUnescapedQuote(cont, quote)) {
+          parts.push(cont.slice(0, -1));
+          closed = true;
+          break;
+        }
+        parts.push(lines[i]);
+      }
+      if (!closed) {
+        throw new Error(
+          `Unterminated quoted value for "${key}" (opens on line ${startLine}). Close the ${quote === '"' ? "double" : "single"} quote, or escape newlines as \\n on one line.`
+        );
+      }
+      value = parts.join("\n");
+      if (quote === '"') value = unescapeDotenv(value);
+    }
+    validateSecretValue(key, value);
+    out[key] = value;
+  }
+  return out;
 }
-var DLL_NOT_FOUND = -1073741515;
-function preflightWindowsWorkerd(appDir) {
-  if (process.platform !== "win32") return;
-  const workerdExe = resolve6(
-    appDir,
-    "node_modules",
-    "@cloudflare",
-    "workerd-windows-64",
-    "bin",
-    "workerd.exe"
-  );
-  if (!existsSync10(workerdExe)) return;
-  try {
-    execFileSync(workerdExe, ["--help"], { stdio: "pipe", timeout: 1e4 });
-    return;
-  } catch (err) {
-    const status3 = err.status;
-    if (status3 !== DLL_NOT_FOUND) return;
-    throw new Refusal(
-      "workerd (Cloudflare Workers runtime) cannot start on this system: it needs the Microsoft Visual C++ Redistributable, which is not installed. Install it with `winget install Microsoft.VCRedist.2015+.x64` (or choco install -y vcredist140, or https://aka.ms/vs/17/release/vc_redist.x64.exe), then restart this terminal and re-run.",
-      "vcredist_missing"
-    );
+function endsWithUnescapedQuote(s, q) {
+  if (!s.endsWith(q)) return false;
+  if (q === "'") return true;
+  let backslashes = 0;
+  for (let j = s.length - 2; j >= 0 && s[j] === "\\"; j--) backslashes++;
+  return backslashes % 2 === 0;
+}
+function unescapeDotenv(v) {
+  let out = "";
+  for (let i = 0; i < v.length; i++) {
+    if (v[i] === "\\" && i + 1 < v.length) {
+      const c = v[++i];
+      out += c === "n" ? "\n" : c === "r" ? "\r" : c;
+    } else {
+      out += v[i];
+    }
   }
+  return out;
 }
-
-// src/cli/lib/macos-junk.ts
-import { readdirSync as readdirSync2, rmSync as rmSync3 } from "fs";
-import { join as join10 } from "path";
-var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", ".wrangler", ".vite"]);
-function removeMacosJunk(dir) {
-  let removed = 0;
-  let entries;
-  try {
-    entries = readdirSync2(dir, { withFileTypes: true });
-  } catch {
-    return removed;
+function shellSingleQuote(value) {
+  return `'${value.replace(/'/g, "'\\''")}'`;
+}
+function formatSecretsDownload(secrets, format) {
+  const entries = Object.entries(secrets).sort(([a], [b]) => a.localeCompare(b));
+  if (format === "json") {
+    return JSON.stringify(Object.fromEntries(entries), null, 2) + "\n";
   }
-  for (const entry of entries) {
-    const path = join10(dir, entry.name);
-    if (entry.isDirectory()) {
-      if (!SKIP_DIRS.has(entry.name)) removed += removeMacosJunk(path);
-      continue;
-    }
-    if (entry.name === ".DS_Store" || entry.name.startsWith("._")) {
-      try {
-        rmSync3(path, { force: true });
-        removed++;
-      } catch {
-      }
-    }
+  if (format === "shell") {
+    return entries.map(([k, v]) => `export ${k}=${shellSingleQuote(v)}`).join("\n") + "\n";
   }
-  return removed;
+  return entries.map(([k, v]) => `${k}=${quoteDotenvValue(v)}`).join("\n") + "\n";
+}
+async function refreshSecretsCache(deployUrl, token, appId, wranglerEnv, selectedConfigName = defaultConfigNameForEnv(wranglerEnv)) {
+  const configName = selectedConfigName;
+  const pulled = await pullAppSecretsCache(deployUrl, token, appId, configName);
+  const values = pulled?.values ?? {};
+  const count = Object.keys(values).length;
+  return {
+    pulled,
+    rendered: renderSecretsCache(values, { appId, configName }),
+    // An empty store is the common case and not worth a status line.
+    summary: count ? `Secrets: ${configName} (${count} secret${count === 1 ? "" : "s"})` : null
+  };
 }
 
 // src/cli/lib/schema-lint.ts
-import { existsSync as existsSync11 } from "fs";
+import { existsSync as existsSync10 } from "fs";
 import { join as join11 } from "path";
 import { pathToFileURL } from "url";
 
@@ -2525,7 +2433,7 @@ function lintSchema(schema) {
 // src/cli/lib/schema-lint.ts
 async function lintProjectSchemas(appDir) {
   const schemasPath = join11(appDir, "src", "schemas.ts");
-  if (!existsSync11(schemasPath)) return null;
+  if (!existsSync10(schemasPath)) return null;
   let schemas;
   try {
     const esbuild = await import("esbuild");
@@ -2577,11 +2485,11 @@ import { createServer, Socket } from "net";
 var DEFAULT_PORT = 5173;
 function isPortListening(port, host, timeoutMs = 500) {
   const target2 = host === "0.0.0.0" || host === "::" ? "127.0.0.1" : host;
-  return new Promise((resolve20) => {
+  return new Promise((resolve21) => {
     const socket = new Socket();
     const done = (listening) => {
       socket.destroy();
-      resolve20(listening);
+      resolve21(listening);
     };
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => done(true));
@@ -2594,7 +2502,7 @@ async function waitForPortListening(port, host, timeoutMs) {
   const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline) {
     if (await isPortListening(port, host)) return true;
-    await new Promise((resolve20) => setTimeout(resolve20, 250));
+    await new Promise((resolve21) => setTimeout(resolve21, 250));
   }
   return false;
 }
@@ -2660,7 +2568,7 @@ var dev_default = defineDeepspaceCommand({
     preflightNodeVersion("dev start");
     const wranglerEnv = typeof args.env === "string" && args.env.trim() ? args.env.trim() : void 0;
     const host = typeof args.host === "string" && args.host.trim() ? args.host.trim() : DEFAULT_DEV_HOST;
-    const start = resolve7(args.dir ?? ".");
+    const start = resolve8(args.dir ?? ".");
     const appDir = findAppDir(start);
     if (!appDir) {
       throw new Refusal(noAppDirMessage(start, findChildApps(start)), "no_app_dir");
@@ -2729,10 +2637,8 @@ var dev_default = defineDeepspaceCommand({
     if (appIdForSecrets) {
       try {
         const refreshed = await refreshSecretsCache(DEPLOY_URL, token, appIdForSecrets, wranglerEnv);
-        if (refreshed) {
-          generatedSecretsCache = refreshed.rendered;
-          if (refreshed.summary) say(refreshed.summary);
-        }
+        generatedSecretsCache = refreshed.rendered;
+        if (refreshed.summary) say(refreshed.summary);
       } catch (err) {
         throw new Refusal(
           `Failed to refresh app secrets: ${err instanceof Error ? err.message : String(err)}`,
@@ -2740,16 +2646,10 @@ var dev_default = defineDeepspaceCommand({
         );
       }
     }
-    const sharedDevVarsCache = generatedSecretsCache !== void 0;
     await writeDevVars(appDir, payload.sub, token, wranglerEnv, {
-      generatedSecretsCache,
-      sharedDevVarsCache
+      generatedSecretsCache
     });
-    const wranglerConfig = prepareWranglerEnvConfig(
-      appDir,
-      wranglerEnv,
-      { sharedDevVarsCache }
-    );
+    const wranglerConfig = prepareWranglerEnvConfig(appDir, wranglerEnv);
     preflightWindowsWorkerd(appDir);
     if (await isPortListening(port, host)) {
       const killArgv = port === DEFAULT_PORT ? ["deepspace", "dev", "kill"] : ["deepspace", "dev", "kill", "--port", String(port)];
@@ -2764,15 +2664,11 @@ Free it with \`${killCmd}\`, or start on another port: \`deepspace dev start --p
     }
     const url = `http://${host === DEFAULT_DEV_HOST ? "localhost" : host}:${port}`;
     say("Starting dev server...\n");
-    const vite = spawn(
-      "npx",
-      ["vite", "--port", String(port), "--strictPort", "--host", host],
-      {
-        cwd: appDir,
-        stdio: "inherit",
-        env: wranglerViteEnv(process.env, wranglerConfig, { DEEPSPACE_PORT: String(port) })
-      }
-    );
+    const vite = spawn("npx", ["vite", "--port", String(port), "--strictPort", "--host", host], {
+      cwd: appDir,
+      stdio: "inherit",
+      env: wranglerViteEnv(process.env, wranglerConfig, { DEEPSPACE_PORT: String(port) })
+    });
     if (args.json) {
       void waitForPortListening(port, host, READINESS_TIMEOUT_MS).then((ready) => {
         console.log(
@@ -3098,7 +2994,7 @@ function isAlive(pid) {
 }
 
 // src/cli/commands/test.ts
-import { resolve as resolve8 } from "path";
+import { resolve as resolve9 } from "path";
 import { sync as spawnSync4 } from "cross-spawn";
 
 // src/cli/lib/playwright.ts
@@ -3130,7 +3026,7 @@ function ensurePlaywright(appDir) {
 import { readFileSync as readFileSync14 } from "fs";
 
 // src/testing/accounts.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync5, readFileSync as readFileSync13, writeFileSync as writeFileSync7 } from "fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync13, writeFileSync as writeFileSync7 } from "fs";
 import { homedir as homedir3 } from "os";
 import { join as join13 } from "path";
 var TEST_ACCOUNTS_PATH = join13(homedir3(), ".deepspace", "test-accounts.json");
@@ -3204,7 +3100,7 @@ function removeTestAccounts(ids, emails = [], scope = currentTestAccountScope())
   });
 }
 function readTestAccountStore() {
-  if (!existsSync12(TEST_ACCOUNTS_PATH)) return { version: 2, scopes: {}, unscoped: [] };
+  if (!existsSync11(TEST_ACCOUNTS_PATH)) return { version: 2, scopes: {}, unscoped: [] };
   try {
     const raw = JSON.parse(readFileSync13(TEST_ACCOUNTS_PATH, "utf-8"));
     if (Array.isArray(raw)) return { version: 2, scopes: {}, unscoped: validTestAccounts(raw) };
@@ -3321,7 +3217,7 @@ var test_default = defineDeepspaceCommand({
     preflightNodeVersion("test run");
     const suite = args.suite ?? "default";
     const wranglerEnv = typeof args.env === "string" && args.env.trim() ? args.env.trim() : void 0;
-    const start = resolve8(".");
+    const start = resolve9(".");
     const appDir = findAppDir(start);
     if (!appDir) {
       throw new Refusal(noAppDirMessage(start, findChildApps(start)), "no_app_dir");
@@ -3348,10 +3244,8 @@ var test_default = defineDeepspaceCommand({
     if (appIdForSecrets) {
       try {
         const refreshed = await refreshSecretsCache(DEPLOY_URL2, token, appIdForSecrets, wranglerEnv);
-        if (refreshed) {
-          generatedSecretsCache = refreshed.rendered;
-          if (refreshed.summary) say(refreshed.summary);
-        }
+        generatedSecretsCache = refreshed.rendered;
+        if (refreshed.summary) say(refreshed.summary);
       } catch (err) {
         throw new Refusal(
           `Failed to refresh app secrets: ${err instanceof Error ? err.message : String(err)}`,
@@ -3359,17 +3253,17 @@ var test_default = defineDeepspaceCommand({
         );
       }
     }
-    const sharedDevVarsCache = generatedSecretsCache !== void 0;
     await writeDevVars(appDir, ownerId, token, wranglerEnv, {
-      generatedSecretsCache,
-      sharedDevVarsCache
+      generatedSecretsCache
     });
     if (suite !== "unit") {
       try {
         const { removed } = await syncTestAccountStore();
         if (removed > 0) say(`Removed ${removed} stale test account credential(s).`);
       } catch (error) {
-        say(`Warning: could not reconcile test accounts: ${error instanceof Error ? error.message : String(error)}`);
+        say(
+          `Warning: could not reconcile test accounts: ${error instanceof Error ? error.message : String(error)}`
+        );
       }
     }
     if (suite !== "unit") {
@@ -3379,46 +3273,32 @@ var test_default = defineDeepspaceCommand({
     let exitCode = 0;
     switch (suite) {
       case "smoke":
-        exitCode = runPlaywright(
-          appDir,
-          ["tests/smoke.spec.ts"],
-          port,
-          wranglerEnv,
-          sharedDevVarsCache
-        );
+        exitCode = runPlaywright(appDir, ["tests/smoke.spec.ts"], port, wranglerEnv);
         break;
       case "api":
-        exitCode = runPlaywright(
-          appDir,
-          ["tests/api.spec.ts"],
-          port,
-          wranglerEnv,
-          sharedDevVarsCache
-        );
+        exitCode = runPlaywright(appDir, ["tests/api.spec.ts"], port, wranglerEnv);
         break;
       case "e2e":
-        exitCode = runPlaywright(appDir, [], port, wranglerEnv, sharedDevVarsCache);
+        exitCode = runPlaywright(appDir, [], port, wranglerEnv);
         break;
       case "unit":
         exitCode = runVitest(appDir);
         break;
       case "all":
         exitCode = runVitest(appDir);
-        if (exitCode === 0)
-          exitCode = runPlaywright(appDir, [], port, wranglerEnv, sharedDevVarsCache);
+        if (exitCode === 0) exitCode = runPlaywright(appDir, [], port, wranglerEnv);
         break;
       case "default":
         exitCode = runPlaywright(
           appDir,
           ["tests/smoke.spec.ts", "tests/api.spec.ts"],
           port,
-          wranglerEnv,
-          sharedDevVarsCache
+          wranglerEnv
         );
         break;
       default:
         if (suite.endsWith(".spec.ts")) {
-          exitCode = runPlaywright(appDir, [suite], port, wranglerEnv, sharedDevVarsCache);
+          exitCode = runPlaywright(appDir, [suite], port, wranglerEnv);
         } else {
           throw new Refusal(
             `Unknown test suite: ${suite}
@@ -3435,10 +3315,10 @@ Available: smoke, api, e2e, unit, all`,
     return { data: { suite, port, appDir, wranglerEnv: wranglerEnv ?? null } };
   }
 });
-function runPlaywright(appDir, testFiles, port, wranglerEnv, sharedDevVarsCache = false) {
+function runPlaywright(appDir, testFiles, port, wranglerEnv) {
   let wranglerConfig;
   try {
-    wranglerConfig = prepareWranglerEnvConfig(appDir, wranglerEnv, { sharedDevVarsCache });
+    wranglerConfig = prepareWranglerEnvConfig(appDir, wranglerEnv);
   } catch (err) {
     console.error(err instanceof Error ? err.message : String(err));
     return 1;
@@ -3468,7 +3348,7 @@ function runVitest(appDir) {
 
 // src/cli/commands/screenshot.ts
 import { sync as spawnSync5 } from "cross-spawn";
-import { resolve as resolve9 } from "path";
+import { resolve as resolve10 } from "path";
 var screenshot_default = defineDeepspaceCommand({
   meta: {
     name: "screenshot",
@@ -3497,7 +3377,7 @@ var screenshot_default = defineDeepspaceCommand({
     }
   },
   async run({ args }) {
-    const appDir = resolve9(".");
+    const appDir = resolve10(".");
     ensurePlaywright(appDir);
     const url = String(args.url);
     const output = String(args.output);
@@ -3798,7 +3678,7 @@ var test_accounts_default = defineCommand2({
 // src/cli/commands/deploy.ts
 import * as p12 from "@clack/prompts";
 import { defineCommand as defineCommand3 } from "citty";
-import { resolve as resolve12 } from "path";
+import { resolve as resolve13 } from "path";
 
 // src/cli/lib/edge-propagation.ts
 import { request as httpRequest } from "http";
@@ -3863,14 +3743,14 @@ async function servesRelease(probe, releaseStamp) {
 }
 function getOnFreshConnection(url, timeoutMs = 5e3) {
   const send = url.protocol === "http:" ? httpRequest : httpsRequest;
-  return new Promise((resolve20) => {
+  return new Promise((resolve21) => {
     const request2 = send(
       url,
       { method: "GET", agent: false, timeout: timeoutMs, headers: { "cache-control": "no-cache" } },
       (response) => {
         if (response.statusCode !== 200) {
           response.resume();
-          resolve20(null);
+          resolve21(null);
           return;
         }
         let body = "";
@@ -3878,20 +3758,20 @@ function getOnFreshConnection(url, timeoutMs = 5e3) {
         response.on("data", (chunk) => {
           if (body.length < 4096) body += chunk;
         });
-        response.on("end", () => resolve20(body));
-        response.on("error", () => resolve20(null));
+        response.on("end", () => resolve21(body));
+        response.on("error", () => resolve21(null));
       }
     );
     request2.on("timeout", () => {
       request2.destroy();
-      resolve20(null);
+      resolve21(null);
     });
-    request2.on("error", () => resolve20(null));
+    request2.on("error", () => resolve21(null));
     request2.end();
   });
 }
 function sleep2(ms) {
-  return new Promise((resolve20) => setTimeout(resolve20, ms));
+  return new Promise((resolve21) => setTimeout(resolve21, ms));
 }
 
 // src/shared/app-files.ts
@@ -3970,16 +3850,16 @@ function describeFilesFailure(status3, body) {
 import * as p6 from "@clack/prompts";
 import { execSync as execSync2 } from "child_process";
 import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync15, readFileSync as readFileSync17, readdirSync as readdirSync4 } from "fs";
-import { dirname as dirname5, join as join16, resolve as resolve10 } from "path";
+import { existsSync as existsSync14, readFileSync as readFileSync17, readdirSync as readdirSync4 } from "fs";
+import { dirname as dirname6, join as join16, resolve as resolve11 } from "path";
 
 // src/documentation/deploy.ts
-import { existsSync as existsSync13, readFileSync as readFileSync15 } from "fs";
+import { existsSync as existsSync12, readFileSync as readFileSync15 } from "fs";
 import { join as join14 } from "path";
 function readDocumentationDeployManifest(appDir, clientDir) {
-  if (!existsSync13(join14(appDir, "documentation.json"))) return void 0;
+  if (!existsSync12(join14(appDir, "documentation.json"))) return void 0;
   const manifestPath = join14(clientDir, "_documentation", "manifest.json");
-  if (!existsSync13(manifestPath)) {
+  if (!existsSync12(manifestPath)) {
     throw new Error(
       "documentation.json exists but the build produced no documentation manifest. Ensure vite.config.ts includes deepSpaceDocumentation() from deepspace/documentation."
     );
@@ -3991,7 +3871,7 @@ function readDocumentationDeployManifest(appDir, clientDir) {
 import {
   closeSync,
   constants,
-  existsSync as existsSync14,
+  existsSync as existsSync13,
   fstatSync,
   ftruncateSync,
   lstatSync,
@@ -4045,7 +3925,7 @@ var APP_MIGRATION_DEFINITIONS = SOURCE_MIGRATIONS.map(
 );
 function readAppliedAppMigrations(appDir) {
   const path = join15(appDir, APP_MIGRATIONS_MANIFEST);
-  if (!existsSync14(path)) return [];
+  if (!existsSync13(path)) return [];
   const source = readRegularFile(path);
   let parsed;
   try {
@@ -4106,7 +3986,7 @@ function planAppMigrations(appDir) {
   if (pending.length > 0 && blockers.length === 0) {
     const manifestPath = `${appPrefix}${APP_MIGRATIONS_MANIFEST}`;
     const absoluteManifestPath = join15(repo, manifestPath);
-    const before = existsSync14(absoluteManifestPath) ? readRegularFile(absoluteManifestPath) : null;
+    const before = existsSync13(absoluteManifestPath) ? readRegularFile(absoluteManifestPath) : null;
     const after = `${JSON.stringify([...appliedIds, ...pending.map(({ id }) => id)], null, 2)}
 `;
     if (before !== after) edits.push({ path: manifestPath, before, after });
@@ -4122,7 +4002,7 @@ function applyAppMigrationPlan(appDir, plan) {
   const repo = repoToplevel(appDir);
   for (const edit of plan.edits) {
     const absolutePath = join15(repo, edit.path);
-    const current = existsSync14(absolutePath) ? readRegularFile(absolutePath) : null;
+    const current = existsSync13(absolutePath) ? readRegularFile(absolutePath) : null;
     if (current !== edit.before) {
       throw new Error(`Migration input changed after planning: ${edit.path}`);
     }
@@ -4251,7 +4131,7 @@ function declaredCompatibilityDate(config) {
   return typeof declared === "string" && /^\d{4}-\d{2}-\d{2}$/.test(declared) ? declared : null;
 }
 async function buildDeployBundle(options) {
-  const { appDir, appName, envName, sharedDevVarsCache, output, spinner: spinner2 } = options;
+  const { appDir, appName, envName, output, spinner: spinner2 } = options;
   const junk = removeMacosJunk(appDir);
   if (junk > 0) p6.log.info(`Removed ${junk} macOS metadata file(s) (._*, .DS_Store)`);
   const lintFindings = await lintProjectSchemas(appDir);
@@ -4261,9 +4141,7 @@ async function buildDeployBundle(options) {
   spinner2.start("Building...");
   let preparedWranglerConfig;
   try {
-    preparedWranglerConfig = prepareWranglerEnvConfig(appDir, envName, {
-      sharedDevVarsCache
-    });
+    preparedWranglerConfig = prepareWranglerEnvConfig(appDir, envName);
     const appDomain = DEEPSPACE_ENV === "staging" ? "spacestest.com" : "app.space";
     execSync2("npx vite build", {
       cwd: appDir,
@@ -4284,15 +4162,15 @@ async function buildDeployBundle(options) {
   }
   spinner2.stop("Built");
   const deployConfigPath = join16(appDir, ".wrangler", "deploy", "config.json");
-  if (!existsSync15(deployConfigPath)) {
+  if (!existsSync14(deployConfigPath)) {
     output.die(
       "Build output config not found at .wrangler/deploy/config.json",
       "build_output_missing"
     );
   }
   const deployConfig = JSON.parse(readFileSync17(deployConfigPath, "utf-8"));
-  const outputWranglerPath = resolve10(dirname5(deployConfigPath), deployConfig.configPath);
-  if (!existsSync15(outputWranglerPath)) {
+  const outputWranglerPath = resolve11(dirname6(deployConfigPath), deployConfig.configPath);
+  if (!existsSync14(outputWranglerPath)) {
     output.die(`Output wrangler.json not found at ${outputWranglerPath}`, "build_output_missing");
   }
   const outputConfig = JSON.parse(readFileSync17(outputWranglerPath, "utf-8"));
@@ -4303,13 +4181,13 @@ async function buildDeployBundle(options) {
       "build_output_mismatch"
     );
   }
-  const workerDir = dirname5(outputWranglerPath);
+  const workerDir = dirname6(outputWranglerPath);
   const workerBundlePath = join16(workerDir, outputConfig.main);
-  const clientDir = outputConfig.assets?.directory ? resolve10(workerDir, outputConfig.assets.directory) : null;
-  if (!existsSync15(workerBundlePath)) {
+  const clientDir = outputConfig.assets?.directory ? resolve11(workerDir, outputConfig.assets.directory) : null;
+  if (!existsSync14(workerBundlePath)) {
     output.die(`Worker bundle not found at ${workerBundlePath}`, "build_output_missing");
   }
-  if (!clientDir || !existsSync15(clientDir)) {
+  if (!clientDir || !existsSync14(clientDir)) {
     return output.die(`Client assets not found at ${clientDir}`, "build_output_missing");
   }
   try {
@@ -4416,9 +4294,12 @@ function collectAssets(dir) {
 }
 function readDeployAssetConfig(clientDir) {
   const config = {};
-  for (const [file, key] of [["_headers", "_headers"], ["_redirects", "_redirects"]]) {
+  for (const [file, key] of [
+    ["_headers", "_headers"],
+    ["_redirects", "_redirects"]
+  ]) {
     const filePath = join16(clientDir, file);
-    if (!existsSync15(filePath)) continue;
+    if (!existsSync14(filePath)) continue;
     const content = readFileSync17(filePath, "utf8");
     if (content.trim()) config[key] = content;
   }
@@ -4433,7 +4314,7 @@ function errorMessage(error) {
 
 // src/cli/commands/deploy/commerce.ts
 import * as p7 from "@clack/prompts";
-import { existsSync as existsSync16 } from "fs";
+import { existsSync as existsSync15 } from "fs";
 import { join as join17 } from "path";
 import { pathToFileURL as pathToFileURL2 } from "url";
 var API_URL2 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
@@ -4442,7 +4323,7 @@ function errorMessage2(error) {
 }
 async function loadDeclaration(appDir, sourceFile, outputFile, exportName) {
   const sourcePath = join17(appDir, "src", sourceFile);
-  if (!existsSync16(sourcePath)) return void 0;
+  if (!existsSync15(sourcePath)) return void 0;
   const esbuild = await import("esbuild");
   const outputPath = join17(appDir, ".wrangler", "deploy", outputFile);
   await esbuild.build({
@@ -4537,7 +4418,7 @@ Stripe will keep charging them until you cancel. Cancel at the end of their curr
   }
 }
 async function syncSubscriptionPlans(appDir, appName, token, nonInteractive) {
-  if (!existsSync16(join17(appDir, "src", "subscriptions.ts"))) return;
+  if (!existsSync15(join17(appDir, "src", "subscriptions.ts"))) return;
   let plans;
   try {
     plans = await loadDeclaration(
@@ -4592,7 +4473,7 @@ async function syncSubscriptionPlans(appDir, appName, token, nonInteractive) {
   }
 }
 async function syncOneTimeProducts(appDir, appName, token) {
-  if (!existsSync16(join17(appDir, "src", "products.ts"))) return;
+  if (!existsSync15(join17(appDir, "src", "products.ts"))) return;
   let products;
   try {
     products = await loadDeclaration(
@@ -4672,19 +4553,20 @@ function createDeployOutput(json) {
       introShown = true;
     },
     die(message, code, opts = {}) {
+      const action = opts.action ? executableAction(opts.action) : void 0;
       if (json) {
         emitJson({
           ok: false,
           code,
           error: message,
           ...opts.actionRequired ? { actionRequired: true } : {},
-          ...opts.action ? { action: opts.action } : {}
+          ...action ? { action } : {}
         });
       } else {
         if (introShown && opts.actionRequired) p8.log.warn(withSlug(message, code));
         else if (introShown) p8.cancel(withSlug(message, code));
         else console.error(withSlug(message, code));
-        if (opts.action) printAction(opts.action);
+        if (action) printAction(action);
       }
       process.exit(opts.actionRequired ? 2 : 1);
     }
@@ -4884,9 +4766,9 @@ function repoApi(deployUrl, token, appId) {
 }
 
 // src/cli/lib/vc-remote.ts
-import { existsSync as existsSync17 } from "fs";
+import { existsSync as existsSync16 } from "fs";
 import { tmpdir } from "os";
-import { isAbsolute as isAbsolute3, relative, resolve as resolve11 } from "path";
+import { isAbsolute as isAbsolute3, relative, resolve as resolve12 } from "path";
 function spaceRemoteName(environment = DEEPSPACE_ENV) {
   if (environment === "staging") return "space-staging";
   if (environment === "production") return "space";
@@ -4932,14 +4814,14 @@ function entryIsTransient(cwd) {
   const entry = process.argv[1];
   if (!entry) return true;
   if (/[\\/]_npx[\\/]/.test(entry) || entry.startsWith(tmpdir())) return true;
-  const rel = relative(resolve11(cwd), resolve11(entry));
+  const rel = relative(resolve12(cwd), resolve12(entry));
   return rel === "" || !rel.startsWith("..") && !isAbsolute3(rel);
 }
 function helperEntryUsable(command) {
   const match = /^!(?:DEEPSPACE_ENV=(production|staging) )?'([^']*)' '([^']*)' git-credential$/.exec(command);
   const expectedEnvironment = DEEPSPACE_ENV === "production" ? void 0 : DEEPSPACE_ENV;
   if (!match || match[1] !== expectedEnvironment) return false;
-  return existsSync17(match[2]) && existsSync17(match[3]);
+  return existsSync16(match[2]) && existsSync16(match[3]);
 }
 function credentialHelperCommand(environment = DEEPSPACE_ENV) {
   const entry = process.argv[1];
@@ -5005,6 +4887,25 @@ function ensureSpaceRemote(cwd, appId, remote = SPACE_REMOTE) {
   installCredentialHelper(cwd, url);
   return url;
 }
+function ensureGitIdentity(cwd, token) {
+  try {
+    const configured = (key) => runGit(cwd, ["config", "--get", key], { allowFail: true }).stdout.toString("utf-8").trim() !== "";
+    const missingName = !configured("user.name");
+    const missingEmail = !configured("user.email");
+    if (!missingName && !missingEmail) return;
+    const payload = decodeJwtPayload(token);
+    if (!payload.email) return;
+    if (missingName) {
+      runGit(cwd, ["config", "--local", "user.name", payload.name || payload.email], {
+        allowFail: true
+      });
+    }
+    if (missingEmail) {
+      runGit(cwd, ["config", "--local", "user.email", payload.email], { allowFail: true });
+    }
+  } catch {
+  }
+}
 function appIdFromRepoUrl(url) {
   const match = /\/api\/repo\/([^/]+)\/?$/.exec(url);
   return match ? decodeURIComponent(match[1]) : null;
@@ -5420,7 +5321,7 @@ async function pushWithTransientRetry(push) {
       const message = errorMessage3(error);
       const transient = /(?:HTTP |error: )(?:429|503)\b/i.test(message);
       if (transient && attempt < backoffMs.length && Date.now() + backoffMs[attempt] < deadline) {
-        await new Promise((resolve20) => setTimeout(resolve20, backoffMs[attempt]));
+        await new Promise((resolve21) => setTimeout(resolve21, backoffMs[attempt]));
         continue;
       }
       throw error;
@@ -5460,6 +5361,7 @@ async function deployBuiltBundle(options) {
     appId,
     appName,
     token,
+    claimReleased,
     ignoreStale,
     bundle,
     secrets,
@@ -5477,7 +5379,8 @@ async function deployBuiltBundle(options) {
   await uploadDeployAssets({ deployUrl, appId, token, assets: bundle.assets, output, spinner: spinner2 });
   spinner2.message(`Deploying ${appName}...`);
   let confirmRename = options.rename;
-  const bail = async (message, stopLabel = "Deploy failed", code, actionRequired = false, action) => {
+  const bail = async (message, stopLabel = "Deploy failed", code, actionRequired = false, rawAction) => {
+    const action = rawAction ? executableAction(rawAction) : void 0;
     if (stopLabel !== null) spinner2.stop(stopLabel);
     p10.cancel(code ? withSlug(message, code) : message);
     if (action) printAction(action);
@@ -5505,7 +5408,7 @@ async function deployBuiltBundle(options) {
     if (bundle.customBindings.length) {
       form.append("bindingManifest", JSON.stringify(bundle.customBindings));
     }
-    if (secrets.names.length) form.append("userSecrets", JSON.stringify(secrets.values));
+    if (secrets.authoritative) form.append("userSecrets", JSON.stringify(secrets.values));
     if (bundle.extraRoutes === true || bundle.extraRoutes.length) {
       form.append("extraRunWorkerFirst", JSON.stringify(bundle.extraRoutes));
     }
@@ -5523,6 +5426,7 @@ async function deployBuiltBundle(options) {
     }
     form.append("name", appName);
     if (confirmRename) form.append("confirmRename", "true");
+    if (claimReleased) form.append("claimReleased", "true");
     if (shouldSendLineage(repository.commitOid, repository.recoverable)) {
       form.append("commitOid", repository.commitOid);
     }
@@ -5712,9 +5616,7 @@ async function uploadDeployAssets(options) {
     }
   };
   try {
-    await Promise.all(
-      Array.from({ length: Math.min(UPLOAD_CONCURRENCY, missing.length) }, worker)
-    );
+    await Promise.all(Array.from({ length: Math.min(UPLOAD_CONCURRENCY, missing.length) }, worker));
   } catch (error) {
     spinner2.stop("Deploy failed");
     if (error instanceof AssetUploadError) {
@@ -5774,7 +5676,7 @@ async function postWithRetry(url, makeInit, {
       lastError = error;
     }
     if (attempt < attempts) {
-      await new Promise((resolve20) => setTimeout(resolve20, Math.min(8e3, 500 * 2 ** (attempt - 1))));
+      await new Promise((resolve21) => setTimeout(resolve21, Math.min(8e3, 500 * 2 ** (attempt - 1))));
     }
   }
   if (lastResponse) return lastResponse;
@@ -5783,35 +5685,17 @@ async function postWithRetry(url, makeInit, {
 
 // src/cli/commands/deploy/secrets.ts
 import * as p11 from "@clack/prompts";
-import { existsSync as existsSync18, readFileSync as readFileSync19 } from "fs";
-function classifyDevVarsSecrets(options) {
-  const store = new Set(options.storeSecretNames);
-  const strayKeys = options.handEditedDevVarKeys.filter((key) => !store.has(key));
-  if (strayKeys.length === 0) return { kind: "ok" };
-  if (options.storeSecretNames.length === 0 && !options.allowMissing) {
-    return { kind: "block", strayKeys };
-  }
-  return { kind: "warn", strayKeys };
-}
 async function loadDeploySecrets(options) {
   const { deployUrl, appDir, appId, envName, ownerId, token, output } = options;
   let linked = null;
-  let localOnlyDevVars = {};
   try {
     const refreshed = await refreshSecretsCache(deployUrl, token, appId, envName);
-    if (refreshed) {
-      linked = refreshed.pulled;
-      localOnlyDevVars = readCustomDevVars(
-        devVarsPathFor(appDir, envName, { sharedDevVarsCache: true }),
-        output
-      );
-      await writeDevVars(appDir, ownerId, token, envName, {
-        appId,
-        generatedSecretsCache: refreshed.rendered,
-        sharedDevVarsCache: true
-      });
-      if (refreshed.summary) p11.log.info(refreshed.summary);
-    }
+    linked = refreshed.pulled;
+    await writeDevVars(appDir, ownerId, token, envName, {
+      appId,
+      generatedSecretsCache: refreshed.rendered
+    });
+    if (refreshed.summary) p11.log.info(refreshed.summary);
   } catch (error) {
     if (error?.status === 403) {
       output.die(
@@ -5824,40 +5708,31 @@ async function loadDeploySecrets(options) {
       "secrets_refresh_failed"
     );
   }
-  return { linked, localOnlyDevVars };
-}
-function prepareDeploySecrets(options) {
-  const { appDir, envName, cache, allowMissing, customBindings, doManifest, output } = options;
-  const values = cache.linked ? { ...cache.linked.values } : {};
-  const devVarsPath = devVarsPathFor(appDir, envName, {
-    sharedDevVarsCache: cache.linked !== null
-  });
-  const handEditedDevVars = cache.linked ? cache.localOnlyDevVars : readCustomDevVars(devVarsPath, output);
-  const decision = classifyDevVarsSecrets({
-    storeSecretNames: Object.keys(values),
-    handEditedDevVarKeys: Object.keys(handEditedDevVars),
-    allowMissing
-  });
-  if (decision.kind === "block") {
-    const uploadArgv = [
-      "deepspace",
-      "secrets",
-      "upload",
-      ".dev.vars",
-      ...envName ? ["-e", envName] : []
-    ];
+  if (!linked) {
+    const configName = defaultConfigNameForEnv(envName);
     output.die(
-      `Refusing to deploy: the app store has no secrets, but .dev.vars has ${decision.strayKeys.join(", ")}. Deploying now would ship the app with no secrets \u2014 replacing any secrets a previous deploy set (they would be dropped from production). Upload them first, then redeploy. (Pass --allow-missing-secrets to deploy without them.)`,
-      "secrets_not_uploaded",
-      { action: { cwd: appDir, argv: uploadArgv } }
-    );
-  }
-  if (decision.kind === "warn") {
-    const stray = decision.strayKeys;
-    p11.log.warn(
-      `.dev.vars has ${stray.join(", ")} not in the app store \u2014 ${stray.length === 1 ? "it is" : "they are"} NOT deployed. \`.dev.vars\` is a local dev cache, not deploy config. Move ${stray.length === 1 ? "it" : "them"} into the store with \`deepspace secrets set KEY=value\` (or \`deepspace secrets upload .dev.vars\`), then redeploy.`
+      `Secrets config "${configName}" does not exist. Create it explicitly before deploying; this distinguishes an intentional empty config from an uninitialized app and protects live Worker secrets during the platform rollout.`,
+      "secrets_config_missing",
+      {
+        action: {
+          cwd: appDir,
+          argv: [
+            "deepspace",
+            "secrets",
+            "configs",
+            "create",
+            configName,
+            ...envName ? ["--env", envName] : []
+          ]
+        }
+      }
     );
   }
+  return { linked };
+}
+function prepareDeploySecrets(options) {
+  const { cache, customBindings, doManifest, output } = options;
+  const values = cache.linked ? { ...cache.linked.values } : {};
   const names = Object.keys(values);
   const declaredBindingNames = /* @__PURE__ */ new Set([
     ...customBindings.map((binding) => binding.name),
@@ -5878,17 +5753,7 @@ function prepareDeploySecrets(options) {
     }
   }
   if (names.length) p11.log.info(`App secrets: ${names.join(", ")}`);
-  return { values, names };
-}
-function readCustomDevVars(path, output) {
-  if (!existsSync18(path)) return {};
-  const section = extractCustomDevVars(stripGeneratedSecretsCache(readFileSync19(path, "utf-8")));
-  if (!section) return {};
-  try {
-    return parseDevVars(section);
-  } catch (error) {
-    output.die(`.dev.vars: ${errorMessage5(error)}`, "invalid_dev_vars");
-  }
+  return { values, names, authoritative: cache.linked !== null };
 }
 function errorMessage5(error) {
   return error instanceof Error ? error.message : String(error);
@@ -5922,9 +5787,9 @@ var deploy_default = defineCommand3({
       description: "Confirm that a changed wrangler `name` renames this app (its URL moves; data, secrets, and collaborators travel). Without this flag an interactive prompt asks.",
       default: false
     },
-    "allow-missing-secrets": {
+    "claim-released": {
       type: "boolean",
-      description: "Deploy even though hand-edited .dev.vars secrets are absent from the store (they will NOT be deployed, and any a previous deploy set are dropped).",
+      description: "Platform admins only: claim an app name still inside its 30-day release cooldown. The previous owner permanently loses their reserved reclaim. Non-admin accounts are refused.",
       default: false
     },
     // Citty maps --no-push to the negation of an argument named `push`.
@@ -5947,7 +5812,7 @@ var deploy_default = defineCommand3({
   async run({ args }) {
     const output = createDeployOutput(args.json === true);
     preflightNodeVersion("deploy");
-    const appDir = resolve12(args.dir ?? ".");
+    const appDir = resolve13(args.dir ?? ".");
     const selectorRefusal = blankSelectorRefusal(args);
     if (selectorRefusal) output.die(selectorRefusal.error, selectorRefusal.code);
     const envName = typeof args.env === "string" && args.env.trim() ? args.env.trim() : void 0;
@@ -6000,7 +5865,6 @@ var deploy_default = defineCommand3({
       appDir,
       appName,
       envName,
-      sharedDevVarsCache: secretsCache.linked !== null,
       output,
       spinner: spinner2
     });
@@ -6020,10 +5884,7 @@ var deploy_default = defineCommand3({
       sourceState
     });
     const secrets = prepareDeploySecrets({
-      appDir,
-      envName,
       cache: secretsCache,
-      allowMissing: Boolean(args["allow-missing-secrets"]),
       customBindings: bundle.customBindings,
       doManifest: bundle.doManifest,
       output
@@ -6035,6 +5896,7 @@ var deploy_default = defineCommand3({
       appName,
       token,
       rename: args.rename === true,
+      claimReleased: args["claim-released"] === true,
       ignoreStale: Boolean(args["ignore-stale"]),
       bundle,
       secrets,
@@ -6063,10 +5925,7 @@ var deploy_default = defineCommand3({
             url: body.url,
             releaseId: body.releaseId ?? null,
             bundleRetained: body.bundleRetained ?? null,
-            // `serving` says what was actually established; `edgePropagating`
-            // stays for callers written against the old shape.
             serving,
-            edgePropagating: serving === "unconfirmed",
             recoverable: repository.recoverable,
             ...staleBaseGuardFields(body)
           });
@@ -6085,7 +5944,7 @@ var deploy_default = defineCommand3({
         appName,
         url: body.url ?? null,
         // Always present, so a caller branches on one field instead of
-        // inferring success from the absence of `edgePropagating`.
+        // inferring success from an absent one.
         serving,
         releaseId: body.releaseId ?? null,
         bundleRetained: body.bundleRetained ?? null,
@@ -6765,20 +6624,20 @@ var usage_default = defineDeepspaceCommand({
 });
 
 // src/cli/commands/add.ts
-import { existsSync as existsSync20, readFileSync as readFileSync21, realpathSync as realpathSync3 } from "fs";
-import { dirname as dirname7, join as join19, resolve as resolve14 } from "path";
+import { existsSync as existsSync18, readFileSync as readFileSync20, realpathSync as realpathSync4 } from "fs";
+import { dirname as dirname8, join as join19, resolve as resolve15 } from "path";
 import { pathToFileURL as pathToFileURL3 } from "url";
 
 // src/cli/commands/feature-installer.ts
 import {
   closeSync as closeSync2,
   copyFileSync,
-  existsSync as existsSync19,
+  existsSync as existsSync17,
   fstatSync as fstatSync2,
   mkdirSync as mkdirSync6,
   mkdtempSync,
   openSync as openSync2,
-  readFileSync as readFileSync20,
+  readFileSync as readFileSync19,
   readSync,
   readdirSync as readdirSync5,
   rmSync as rmSync4,
@@ -6786,33 +6645,33 @@ import {
 } from "fs";
 import { spawnSync as spawnSync6 } from "child_process";
 import { tmpdir as tmpdir2 } from "os";
-import { dirname as dirname6, isAbsolute as isAbsolute4, join as join18, resolve as resolve13 } from "path";
+import { dirname as dirname7, isAbsolute as isAbsolute4, join as join18, resolve as resolve14 } from "path";
 import { fileURLToPath } from "url";
 var NAV_MARKER = "// \u2500\u2500 Features add nav items below this line \u2500\u2500";
 function featurePackageRoot(moduleUrl = import.meta.url) {
-  let dir = dirname6(fileURLToPath(moduleUrl));
+  let dir = dirname7(fileURLToPath(moduleUrl));
   for (; ; ) {
     const packagePath = join18(dir, "package.json");
-    if (existsSync19(packagePath)) {
+    if (existsSync17(packagePath)) {
       try {
-        const pkg2 = JSON.parse(readFileSync20(packagePath, "utf-8"));
+        const pkg2 = JSON.parse(readFileSync19(packagePath, "utf-8"));
         if (pkg2.name === "deepspace") return dir;
       } catch {
       }
     }
-    const parent = dirname6(dir);
+    const parent = dirname7(dir);
     if (parent === dir) throw new Error("Could not locate the deepspace package root");
     dir = parent;
   }
 }
 function hasFeatureCatalog(packageRoot = featurePackageRoot()) {
-  return existsSync19(join18(packageRoot, "features"));
+  return existsSync17(join18(packageRoot, "features"));
 }
 function readFeatureConfig(id, packageRoot = featurePackageRoot()) {
   const configPath = join18(packageRoot, "features", id, "feature.json");
-  if (!existsSync19(configPath)) return null;
+  if (!existsSync17(configPath)) return null;
   try {
-    const config = JSON.parse(readFileSync20(configPath, "utf-8"));
+    const config = JSON.parse(readFileSync19(configPath, "utf-8"));
     if (typeof config.id !== "string" || typeof config.name !== "string" || !Array.isArray(config.files)) {
       return null;
     }
@@ -6823,7 +6682,7 @@ function readFeatureConfig(id, packageRoot = featurePackageRoot()) {
 }
 function listFeatureConfigs(packageRoot = featurePackageRoot()) {
   const featuresDir = join18(packageRoot, "features");
-  if (!existsSync19(featuresDir)) return [];
+  if (!existsSync17(featuresDir)) return [];
   return readdirSync5(featuresDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => readFeatureConfig(entry.name, packageRoot)).filter((config) => config !== null && !config.internal).sort((a, b) => a.id.localeCompare(b.id));
 }
 function featureCatalog(packageRoot = featurePackageRoot()) {
@@ -6861,7 +6720,7 @@ function suggestFeature(featureId, packageRoot = featurePackageRoot()) {
   return closest !== null && closestDistance <= threshold ? closest : null;
 }
 function resolveTargetDir(raw) {
-  return isAbsolute4(raw) ? raw : resolve13(raw);
+  return isAbsolute4(raw) ? raw : resolve14(raw);
 }
 function resolveFeatureDestPath(fileDest, route) {
   const pages = "src/pages/";
@@ -6871,13 +6730,13 @@ function resolveFeatureDestPath(fileDest, route) {
   return route?.protected === false ? `${appPages}${rest}` : `${appPages}(protected)/${rest}`;
 }
 function copyFile(src, dest) {
-  mkdirSync6(dirname6(dest), { recursive: true });
+  mkdirSync6(dirname7(dest), { recursive: true });
   copyFileSync(src, dest);
 }
 function copyFileWithImportShift(src, dest, levels) {
-  mkdirSync6(dirname6(dest), { recursive: true });
+  mkdirSync6(dirname7(dest), { recursive: true });
   const prefix = "../".repeat(levels);
-  const shifted = readFileSync20(src, "utf-8").replace(
+  const shifted = readFileSync19(src, "utf-8").replace(
     /(from\s+|import\s+|import\()(['"])(\.\.\/)/g,
     `$1$2${prefix}$3`
   );
@@ -6893,9 +6752,9 @@ function installFiles(packageRoot, config, targetDir, emit) {
     const srcPath = join18(packageRoot, "features", config.id, file.src);
     const resolvedDest = resolveFeatureDestPath(file.dest, config.route);
     const destPath = join18(targetDir, resolvedDest);
-    const existed = existsSync19(destPath);
+    const existed = existsSync17(destPath);
     if (existed) preexisting.push(resolvedDest);
-    if (!existsSync19(srcPath)) {
+    if (!existsSync17(srcPath)) {
       emit(`   Warning: source not found: ${file.src}`, "stderr");
       if (!existed) missing.push(resolvedDest);
       continue;
@@ -6933,10 +6792,10 @@ function unresolvedSchema(schema, reason, emit) {
 function integrateSchema(config, targetDir, emit) {
   if (!config.schema) return [];
   const schemasPath = join18(targetDir, "src", "schemas.ts");
-  if (!existsSync19(schemasPath)) {
+  if (!existsSync17(schemasPath)) {
     return [unresolvedSchema(config.schema, "src/schemas.ts was not found.", emit)];
   }
-  let content = readFileSync20(schemasPath, "utf-8");
+  let content = readFileSync19(schemasPath, "utf-8");
   const { exportName, importPath, spreadOperator } = config.schema;
   const importPattern = new RegExp(`^import\\s+\\{[^}]*\\b${exportName}\\b`, "m");
   if (importPattern.test(content)) {
@@ -6990,10 +6849,10 @@ function unresolvedActions(actions, reason, emit) {
 function integrateActions(config, targetDir, emit) {
   if (!config.actions?.length) return [];
   const actionsPath = join18(targetDir, "src", "actions", "index.ts");
-  if (!existsSync19(actionsPath)) {
+  if (!existsSync17(actionsPath)) {
     return [unresolvedActions(config.actions, "src/actions/index.ts was not found.", emit)];
   }
-  let content = readFileSync20(actionsPath, "utf-8");
+  let content = readFileSync19(actionsPath, "utf-8");
   const registryPattern = /export const actions:\s*Record<string,\s*ActionHandler(?:<[^>]*>)?>\s*=\s*\{/;
   if (!registryPattern.test(content)) {
     const reason = "src/actions/index.ts has an unexpected structure.";
@@ -7040,7 +6899,7 @@ function integrateCode(config, targetDir, emit) {
   const unresolved = [];
   for (const insertion of config.code ?? []) {
     const targetPath = join18(targetDir, insertion.file);
-    if (!existsSync19(targetPath)) {
+    if (!existsSync17(targetPath)) {
       unresolved.push({
         area: "code",
         reason: `${insertion.file} was not found.`,
@@ -7048,7 +6907,7 @@ function integrateCode(config, targetDir, emit) {
       });
       continue;
     }
-    const original = readFileSync20(targetPath, "utf-8");
+    const original = readFileSync19(targetPath, "utf-8");
     if (original.includes(insertion.insert.trim())) {
       emit(`   Integration already present: ${insertion.file}`);
       continue;
@@ -7084,7 +6943,7 @@ ${content.slice(importIndex < 0 ? 0 : importIndex)}`;
 function integrateIgnore(config, targetDir) {
   if (!config.ignore?.length) return;
   const targetPath = join18(targetDir, ".gitignore");
-  const current = existsSync19(targetPath) ? readFileSync20(targetPath, "utf-8") : "";
+  const current = existsSync17(targetPath) ? readFileSync19(targetPath, "utf-8") : "";
   const present = new Set(current.split(/\r?\n/).map((line) => line.trim()));
   const missing = config.ignore.filter((pattern) => !present.has(pattern));
   if (missing.length === 0) return;
@@ -7101,10 +6960,10 @@ function integrateWrangler(config, targetDir, emit) {
     ...runWorkerFirst ? ["Set assets.run_worker_first = true in wrangler.toml."] : [],
     ...rateLimits.map((binding) => `Add the ${binding.name} rate-limit binding to wrangler.toml.`)
   ];
-  if (!existsSync19(targetPath)) {
+  if (!existsSync17(targetPath)) {
     return [{ area: "wrangler", reason: "wrangler.toml was not found.", steps }];
   }
-  let source = readFileSync20(targetPath, "utf-8");
+  let source = readFileSync19(targetPath, "utf-8");
   if (runWorkerFirst && !/^\[assets\]\s*$/m.test(source)) {
     return [{ area: "wrangler", reason: "wrangler.toml has no [assets] section.", steps }];
   }
@@ -7181,7 +7040,7 @@ function rateLimitBindingBlock(scope, binding) {
 function integrateCss(packageRoot, config, targetDir, emit) {
   if (!config.css?.length) return [];
   const stylesPath = join18(targetDir, "src", "styles.css");
-  if (!existsSync19(stylesPath)) {
+  if (!existsSync17(stylesPath)) {
     emit("   Warning: Cannot integrate CSS \u2014 src/styles.css not found");
     return [
       {
@@ -7193,12 +7052,12 @@ function integrateCss(packageRoot, config, targetDir, emit) {
       }
     ];
   }
-  let styles = readFileSync20(stylesPath, "utf-8");
+  let styles = readFileSync19(stylesPath, "utf-8");
   let integrated = 0;
   const unresolved = [];
   for (const cssFile of config.css) {
     const srcPath = join18(packageRoot, "features", config.id, cssFile);
-    if (!existsSync19(srcPath)) {
+    if (!existsSync17(srcPath)) {
       emit(`   Warning: CSS source not found: ${cssFile}`, "stderr");
       unresolved.push({
         area: "css",
@@ -7207,7 +7066,7 @@ function integrateCss(packageRoot, config, targetDir, emit) {
       });
       continue;
     }
-    const css = readFileSync20(srcPath, "utf-8");
+    const css = readFileSync19(srcPath, "utf-8");
     const fingerprint = css.match(/\.([\w-]+)\s*\{|@keyframes\s+([\w-]+)/);
     const marker = fingerprint?.[1] ?? fingerprint?.[2];
     if (marker && styles.includes(marker)) {
@@ -7235,10 +7094,10 @@ function unresolvedRoute(route, config, reason, emit) {
 function integrateRoute(config, targetDir, emit) {
   if (!config.route) return [];
   const navPath = join18(targetDir, "src", "nav.ts");
-  if (!existsSync19(navPath)) {
+  if (!existsSync17(navPath)) {
     return [unresolvedRoute(config.route, config, "src/nav.ts was not found.", emit)];
   }
-  let content = readFileSync20(navPath, "utf-8");
+  let content = readFileSync19(navPath, "utf-8");
   const routePath = config.route.path;
   if (content.includes(`'${routePath}'`)) {
     emit(`   Nav already present: ${routePath}`);
@@ -7313,13 +7172,13 @@ function integrateDependencies(config, targetDir, runInstall, outputVisible, emi
     return { added: [], installRan: false, packageManager };
   }
   const packagePath = join18(targetDir, "package.json");
-  if (!existsSync19(packagePath)) {
+  if (!existsSync17(packagePath)) {
     emit("   Could not patch package.json (file not found)");
     return { added: [], installRan: false, packageManager };
   }
   let pkg2;
   try {
-    pkg2 = JSON.parse(readFileSync20(packagePath, "utf-8"));
+    pkg2 = JSON.parse(readFileSync19(packagePath, "utf-8"));
   } catch (error) {
     emit(
       `   Could not patch package.json (parse error: ${error instanceof Error ? error.message : String(error)})`
@@ -7379,7 +7238,7 @@ ${child.diagnosticTail}` : "";
 }
 function dependencySnapshot(targetDir) {
   try {
-    const pkg2 = JSON.parse(readFileSync20(join18(targetDir, "package.json"), "utf-8"));
+    const pkg2 = JSON.parse(readFileSync19(join18(targetDir, "package.json"), "utf-8"));
     return {
       dependencies: pkg2.dependencies ?? {},
       devDependencies: pkg2.devDependencies ?? {}
@@ -7391,7 +7250,7 @@ function dependencySnapshot(targetDir) {
 function installedNavFeatures(packageRoot, targetDir) {
   return listFeatureConfigs(packageRoot).filter((feature) => feature.category === "nav" && feature.files.length > 0).filter((feature) => {
     const signature = resolveFeatureDestPath(feature.files[0].dest, feature.route);
-    return existsSync19(join18(targetDir, signature));
+    return existsSync17(join18(targetDir, signature));
   }).map((feature) => feature.id);
 }
 function warnNavConflicts(packageRoot, config, targetDir, emit) {
@@ -7624,11 +7483,11 @@ function renderFeatureInfo(config) {
   return lines.join("\n");
 }
 function isDeepSpaceApp(dir) {
-  if (existsSync20(join19(dir, "wrangler.toml"))) return true;
+  if (existsSync18(join19(dir, "wrangler.toml"))) return true;
   const packagePath = join19(dir, "package.json");
-  if (!existsSync20(packagePath)) return false;
+  if (!existsSync18(packagePath)) return false;
   try {
-    const pkg2 = JSON.parse(readFileSync21(packagePath, "utf-8"));
+    const pkg2 = JSON.parse(readFileSync20(packagePath, "utf-8"));
     return Boolean(pkg2.dependencies?.deepspace || pkg2.devDependencies?.deepspace);
   } catch {
     return false;
@@ -7638,8 +7497,8 @@ function installedPackageRoot(fromDir) {
   let dir = fromDir;
   for (; ; ) {
     const candidate = join19(dir, "node_modules", "deepspace");
-    if (existsSync20(join19(candidate, "package.json"))) return candidate;
-    const parent = dirname7(dir);
+    if (existsSync18(join19(candidate, "package.json"))) return candidate;
+    const parent = dirname8(dir);
     if (parent === dir) return null;
     dir = parent;
   }
@@ -7652,12 +7511,12 @@ async function targetInstaller(appDir) {
       "feature_installer_missing"
     );
   }
-  if (realpathSync3(installedRoot) === realpathSync3(featurePackageRoot())) {
+  if (realpathSync4(installedRoot) === realpathSync4(featurePackageRoot())) {
     return { installFeature };
   }
   const entry = join19(installedRoot, "dist", "feature-installer.js");
   const catalog = join19(installedRoot, "features");
-  if (!existsSync20(entry) || !existsSync20(catalog)) {
+  if (!existsSync18(entry) || !existsSync18(catalog)) {
     throw new Refusal(
       `The app's installed deepspace package does not contain the typed feature installer.
 Expected: ${entry}
@@ -7749,8 +7608,8 @@ var add_default = defineDeepspaceCommand({
       }
       return { data: { features: featureCatalog(root) } };
     }
-    const appDir = resolve14(args.dir ?? ".");
-    if (!existsSync20(appDir)) {
+    const appDir = resolve15(args.dir ?? ".");
+    if (!existsSync18(appDir)) {
       throw new Refusal(
         `Target directory not found: ${appDir}
 Create a new app first: deepspace app create <name>`,
@@ -7831,11 +7690,11 @@ function fmtDate(iso) {
 }
 async function confirm4(message) {
   process.stdout.write(`${message} [y/N] `);
-  return new Promise((resolve20) => {
+  return new Promise((resolve21) => {
     process.stdin.setEncoding("utf-8");
     process.stdin.once("data", (data) => {
       const answer = data.toString().trim().toLowerCase();
-      resolve20(answer === "y" || answer === "yes");
+      resolve21(answer === "y" || answer === "yes");
     });
   });
 }
@@ -8125,8 +7984,8 @@ var domain_default = defineCommand5({
 
 // src/cli/commands/app-files.ts
 import { defineCommand as defineCommand6 } from "citty";
-import { basename as basename4, resolve as resolve15 } from "path";
-import { existsSync as existsSync21, statSync as statSync2 } from "fs";
+import { basename as basename4, resolve as resolve16 } from "path";
+import { existsSync as existsSync19, statSync as statSync2 } from "fs";
 
 // src/cli/lib/app-files-api.ts
 import { createWriteStream, openAsBlob, statSync } from "fs";
@@ -8326,7 +8185,7 @@ async function deleteAppFile(baseUrl, token, appId, key) {
   const path = filesPath(appId, `/${encodeKeyPath(key)}`);
   const res = await request(baseUrl, token, path, { method: "DELETE" });
   const body = await readJson(res, path);
-  return { existed: body.existed !== false };
+  return { existed: body.existed };
 }
 async function downloadAppFile(baseUrl, token, appId, key, destination) {
   const path = filesPath(appId, `/${encodeKeyPath(key)}`);
@@ -8396,8 +8255,8 @@ var put = defineDeepspaceCommand({
     app: { type: "string", description: "App id or live name (defaults to ./wrangler.toml)" }
   },
   async run({ args }) {
-    const localPath = resolve15(String(args.file));
-    if (!existsSync21(localPath) || !statSync2(localPath).isFile()) {
+    const localPath = resolve16(String(args.file));
+    if (!existsSync19(localPath) || !statSync2(localPath).isFile()) {
       throw new Refusal(`No such file: ${args.file}`, "file_not_found");
     }
     const key = requireKey(args.key ?? basename4(localPath));
@@ -8497,7 +8356,7 @@ var get = defineDeepspaceCommand({
   },
   async run({ args }) {
     const key = requireKey(String(args.key));
-    const destination = resolve15(String(args.out ?? basename4(key)));
+    const destination = resolve16(String(args.out ?? basename4(key)));
     const { token, appId } = await target(args.app);
     const result = await downloadAppFile(PLATFORM_URL, token, appId, key, destination);
     if (!args.json) console.log(`\u2713 ${key} \u2192 ${destination} (${formatBytes(result.bytes)})`);
@@ -8867,7 +8726,7 @@ var transfer_default = defineCommand8({
 import { defineCommand as defineCommand9 } from "citty";
 
 // src/cli/commands/_invoke-impl.ts
-import { readFileSync as readFileSync22 } from "fs";
+import { readFileSync as readFileSync21 } from "fs";
 import * as p15 from "@clack/prompts";
 var API_URL7 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
 var DEFAULT_TIMEOUT_MS = 12e4;
@@ -8908,7 +8767,7 @@ function resolveBody(opts) {
   if (opts.body != null) {
     raw = opts.body;
   } else if (opts.bodyFile != null) {
-    raw = opts.bodyFile === "-" ? readFileSync22(0, "utf-8") : readFileSync22(opts.bodyFile, "utf-8");
+    raw = opts.bodyFile === "-" ? readFileSync21(0, "utf-8") : readFileSync21(opts.bodyFile, "utf-8");
   } else {
     return "{}";
   }
@@ -9187,8 +9046,8 @@ var integrations_default = defineCommand9({
 
 // src/cli/commands/feedback.ts
 import * as p16 from "@clack/prompts";
-import { existsSync as existsSync22, readFileSync as readFileSync23 } from "fs";
-import { dirname as dirname8, join as join20 } from "path";
+import { existsSync as existsSync20, readFileSync as readFileSync22 } from "fs";
+import { dirname as dirname9, join as join20 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { release } from "os";
 var API_URL8 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
@@ -9209,14 +9068,14 @@ function normalizeType(raw) {
 }
 function readCliVersion() {
   try {
-    const here = dirname8(fileURLToPath2(import.meta.url));
+    const here = dirname9(fileURLToPath2(import.meta.url));
     const candidates = [
       join20(here, "..", "package.json"),
       join20(here, "..", "..", "..", "package.json")
     ];
     for (const path of candidates) {
-      if (!existsSync22(path)) continue;
-      const pkg2 = JSON.parse(readFileSync23(path, "utf-8"));
+      if (!existsSync20(path)) continue;
+      const pkg2 = JSON.parse(readFileSync22(path, "utf-8"));
       if (pkg2.name === "deepspace" && pkg2.version) return pkg2.version;
     }
   } catch {
@@ -9412,7 +9271,7 @@ Context: deepspace ${payload.cliVersion} \xB7 ${payload.nodeVersion} \xB7 ${payl
 
 // src/cli/commands/secrets.ts
 import { defineCommand as defineCommand10 } from "citty";
-import { readFileSync as readFileSync24 } from "fs";
+import { readFileSync as readFileSync23 } from "fs";
 
 // src/cli/lib/citty-args.ts
 function dedupePositionals(bound, rest) {
@@ -9682,7 +9541,7 @@ var upload = defineCommand10({
   async run({ args }) {
     try {
       const t = await resolveTarget(args);
-      const content = args.file === "-" ? readFileSync24(0, "utf-8") : readFileSync24(args.file, "utf-8");
+      const content = args.file === "-" ? readFileSync23(0, "utf-8") : readFileSync23(args.file, "utf-8");
       const secrets = parseSecretsUpload(content);
       if (Object.keys(secrets).length === 0)
         fail(new InputError("No secrets found in the input.", "empty_input"));
@@ -9746,27 +9605,24 @@ var pull = defineCommand10({
         );
       const t = await resolveTarget(args);
       const ownerId = decodeJwtPayload(t.token).sub;
-      const pulled = await pullAppSecretsCache(DEPLOY_URL11, t.token, t.appId, t.configName);
-      if (!pulled) {
-        ok(
-          args.json === true,
-          { appId: t.appId, config: t.configName, pulled: 0 },
-          () => console.log(
-            `No secrets in ${t.configName} yet \u2014 nothing to pull. Whoever has them adds them with \`deepspace secrets set KEY=value\` (or \`secrets upload <file>\`); if the app truly needs none, you're ready as-is.`
-          )
-        );
-        return;
-      }
+      const refreshed = await refreshSecretsCache(
+        DEPLOY_URL11,
+        t.token,
+        t.appId,
+        wranglerEnv,
+        t.configName
+      );
       await writeDevVars(appDir, ownerId, t.token, wranglerEnv, {
         appId: t.appId,
-        generatedSecretsCache: renderSecretsCache(pulled.values, pulled),
-        sharedDevVarsCache: true
+        generatedSecretsCache: refreshed.rendered
       });
-      const count = Object.keys(pulled.values).length;
+      const count = Object.keys(refreshed.pulled?.values ?? {}).length;
       ok(
         args.json === true,
         { appId: t.appId, config: t.configName, pulled: count },
-        () => console.log(`Pulled ${count} secrets (${t.configName}) into .dev.vars.`)
+        () => console.log(
+          refreshed.pulled ? `Pulled ${count} secrets (${t.configName}) into .dev.vars.` : `Config ${t.configName} does not exist yet; regenerated .dev.vars without app secrets.`
+        )
       );
     } catch (err) {
       fail(err);
@@ -9938,7 +9794,7 @@ var init_default = defineDeepspaceCommand({
 // src/cli/commands/status.ts
 import { defineCommand as defineCommand11 } from "citty";
 import * as p17 from "@clack/prompts";
-import { existsSync as existsSync23, readFileSync as readFileSync25 } from "fs";
+import { existsSync as existsSync21, readFileSync as readFileSync24 } from "fs";
 function timeAgo(iso) {
   const ms = Date.now() - Date.parse(iso);
   if (!Number.isFinite(ms) || ms < 0) return iso;
@@ -10023,7 +9879,7 @@ var status_default = defineCommand11({
       json.services = urls;
       if (urlOverrides.length > 0) json.urlOverrides = urlOverrides;
     }
-    facts.loggedIn = existsSync23(SESSION_PATH);
+    facts.loggedIn = existsSync21(SESSION_PATH);
     let userId = null;
     if (!facts.loggedIn) {
       lines.push(["Session", "not logged in"]);
@@ -10032,7 +9888,7 @@ var status_default = defineCommand11({
       let who = "logged in";
       try {
         const payload = decodeJwtPayload(
-          readFileSync25(TOKEN_PATH, "utf-8").trim()
+          readFileSync24(TOKEN_PATH, "utf-8").trim()
         );
         if (payload.email) who = payload.email;
         userId = payload.sub ?? null;
@@ -10184,21 +10040,24 @@ var status_default = defineCommand11({
           }
           const refs = refsResult.ok ? refsResult.value : void 0;
           const trunkRef = refs?.refs.find((r) => `refs/heads/${branch}` === r.name);
+          const defaultBranch = refs?.head && refs.head.startsWith("refs/heads/") ? refs.head.slice("refs/heads/".length) : null;
           if (!facts.workspaceId && branch) {
+            const isTrunk = defaultBranch === null ? null : branch === defaultBranch;
+            const label = isTrunk === false ? "Branch sync" : "Trunk";
             if (githubSource) {
-              lines.push(["Trunk", `${branch} is owned through normal Git/GitHub`]);
-              json.trunk = { state: "external", provider: "github", branch };
-            } else if (!refsResult.ok) reportRemoteFailure2("Trunk", "trunk", refsResult.error);
+              lines.push([label, `${branch} is owned through normal Git/GitHub`]);
+              json.trunk = { state: "external", provider: "github", branch, isTrunk };
+            } else if (!refsResult.ok) reportRemoteFailure2(label, "trunk", refsResult.error);
             else {
               const remoteOid = trunkRef?.oid ?? null;
               const localOid = resolveCommit(appDir, `refs/heads/${branch}`);
               const remoteKnownLocally = remoteOid ? resolveCommit(appDir, remoteOid) !== null : false;
               facts.trunkState = remoteOid === null && localOid === null ? "unknown" : remoteOid === localOid ? "in_sync" : remoteOid && localOid && remoteKnownLocally && isAncestor(appDir, remoteOid, localOid) ? "local_ahead" : remoteOid && localOid && remoteKnownLocally && isAncestor(appDir, localOid, remoteOid) ? "local_behind" : remoteOid && localOid && remoteKnownLocally ? "diverged" : "differs";
               lines.push([
-                "Trunk",
+                label,
                 remoteOid === null ? `cloud repo has no ${branch} yet` : facts.trunkState === "in_sync" ? `${branch} in sync with the cloud repo (${remoteOid.slice(0, 10)})` : `${branch} ${facts.trunkState.replace("_", " ")} relative to the cloud repo (local ${localOid?.slice(0, 10) ?? "none"}, cloud ${remoteOid.slice(0, 10)})`
               ]);
-              json.trunk = { state: facts.trunkState, localOid, remoteOid };
+              json.trunk = { state: facts.trunkState, localOid, remoteOid, branch, isTrunk };
             }
           }
           if (!releaseResult.ok) reportRemoteFailure2("Live", "live", releaseResult.error);
@@ -10425,7 +10284,7 @@ var push_default = defineDeepspaceCommand({
 
 // src/cli/commands/pull.ts
 import * as p19 from "@clack/prompts";
-import { realpathSync as realpathSync4 } from "fs";
+import { realpathSync as realpathSync5 } from "fs";
 function targetedVcAction(command, cwd, appId, branch) {
   return {
     cwd,
@@ -10449,7 +10308,7 @@ function workspaceBranchPullRefusal(branch, trunkBranch) {
 function worktreeHoldingBranch(worktrees, branch, selfPath) {
   const real = (pth) => {
     try {
-      return realpathSync4(pth);
+      return realpathSync5(pth);
     } catch {
       return pth;
     }
@@ -10578,12 +10437,7 @@ var pull_default = defineDeepspaceCommand({
     }
     spinner2?.message(`Fetching ${branch} from the cloud repo\u2026`);
     const trackingRef = spaceTrackingRef(branch);
-    runGitRemote(appDir, token, [
-      "fetch",
-      "--quiet",
-      SPACE_REMOTE,
-      `+${refName}:${trackingRef}`
-    ]);
+    runGitRemote(appDir, token, ["fetch", "--quiet", SPACE_REMOTE, `+${refName}:${trackingRef}`]);
     const remoteOid = resolveCommit(appDir, trackingRef);
     if (!remoteOid) {
       spinner2?.stop("Fetch failed.");
@@ -10621,6 +10475,8 @@ var pull_default = defineDeepspaceCommand({
           integration = "fast_forwarded";
         }
       }
+    } else if (isAncestor(appDir, remoteOid, localOid)) {
+      integration = "local_ahead";
     } else {
       integration = "fetched_only_diverged";
     }
@@ -10634,10 +10490,15 @@ var pull_default = defineDeepspaceCommand({
     let line;
     let codeForState;
     let recoveryAction;
+    let successAction;
     switch (integration) {
       case "up_to_date":
         line = `${branch} is already up to date.`;
         break;
+      case "local_ahead":
+        line = `${branch} already contains ${SPACE_REMOTE}/${branch} at ${remoteOid.slice(0, 10)} \u2014 nothing to pull. Local work is not on the cloud repo yet: run \`${pushCommand}\`.`;
+        successAction = targetedVcAction("push", appDir, appId, branch);
+        break;
       case "fast_forwarded":
         line = `Fast-forwarded ${branch} to ${remoteOid.slice(0, 10)}.`;
         break;
@@ -10686,7 +10547,8 @@ var pull_default = defineDeepspaceCommand({
     }
     const actionRequired = recoveryAction !== void 0;
     spinner2?.stop(codeForState ? `Fetched ${SPACE_REMOTE}/${branch}.` : line);
-    if (!args.json) p19.log.info(`App: ${appId} \xB7 ${SPACE_REMOTE}/${branch} at ${remoteOid.slice(0, 10)}`);
+    if (!args.json)
+      p19.log.info(`App: ${appId} \xB7 ${SPACE_REMOTE}/${branch} at ${remoteOid.slice(0, 10)}`);
     if (codeForState) {
       throw new Refusal(line, codeForState, {
         actionRequired,
@@ -10700,20 +10562,20 @@ var pull_default = defineDeepspaceCommand({
         }
       });
     }
-    return { data: { status: integration, appId, branch, remoteOid } };
+    return { data: { status: integration, appId, branch, remoteOid }, action: successAction };
   }
 });
 
 // src/cli/commands/clone.ts
 import * as p20 from "@clack/prompts";
-import { existsSync as existsSync24, readdirSync as readdirSync6, rmSync as rmSync5 } from "fs";
-import { resolve as resolve16, basename as basename5, join as join21 } from "path";
+import { existsSync as existsSync22, readdirSync as readdirSync6, rmSync as rmSync5 } from "fs";
+import { resolve as resolve17, basename as basename5, join as join21 } from "path";
 function cleanFailedCloneDir(dir) {
   let entries;
   try {
     entries = readdirSync6(dir);
   } catch {
-    return existsSync24(dir) ? ["<unreadable>"] : [];
+    return existsSync22(dir) ? ["<unreadable>"] : [];
   }
   if (entries.length === 1 && entries[0] === ".git") {
     try {
@@ -10726,7 +10588,7 @@ function cleanFailedCloneDir(dir) {
   return entries;
 }
 function validateCloneTarget(dir) {
-  if (!existsSync24(dir)) return false;
+  if (!existsSync22(dir)) return false;
   let entries;
   try {
     entries = readdirSync6(dir);
@@ -10761,7 +10623,7 @@ var clone_default = defineDeepspaceCommand({
   async run({ args }) {
     assertAppTargetResolvable(String(args.app));
     const selector = String(args.app).trim();
-    const dir = resolve16(String(args.dir ?? selector));
+    const dir = resolve17(String(args.dir ?? selector));
     const dirPreexisted = validateCloneTarget(dir);
     const spinner2 = args.json ? null : createSpinner();
     spinner2?.start(`Resolving ${selector}\u2026`);
@@ -10801,6 +10663,7 @@ var clone_default = defineDeepspaceCommand({
       throw err;
     }
     ensureSpaceRemote(dir, appId);
+    ensureGitIdentity(dir, token);
     const head = resolveCommit(dir, "HEAD");
     const branch = currentBranch(dir);
     spinner2?.stop(
@@ -11023,14 +10886,13 @@ Re-run with --allow-do-deletion to accept the data loss.`,
       spinner2?.message("Waiting for the edge to serve this release...");
       serving = await waitForLiveRelease(result.url, result.releaseStamp, 9e4);
     }
-    const edgePropagating = serving === "unconfirmed";
     spinner2?.stop(
       serving === "confirmed" ? `Rolled back to ${result.rolledBackTo ?? releaseId}.` : serving === "unconfirmed" ? `Rolled back to ${result.rolledBackTo ?? releaseId} \u2014 the edge is still rolling it out.` : `Rolled back to ${result.rolledBackTo ?? releaseId} \u2014 serving could not be verified from here.`
     );
     const doClassGuard = result.doClassGuard === "unverified" ? "unverified" : void 0;
     if (!args.json) {
       if (result.url) {
-        if (edgePropagating) p22.log.warn(`URL: ${result.url} (accepted; serving not yet verified)`);
+        if (serving === "unconfirmed") p22.log.warn(`URL: ${result.url} (accepted; serving not yet verified)`);
         else p22.log.success(`Live at: ${result.url}`);
       }
       if (result.bundleRetained === false) {
@@ -11058,7 +10920,6 @@ Re-run with --allow-do-deletion to accept the data loss.`,
         wranglerEnv: wranglerEnv ?? null,
         // Always present, matching `deploy`: one field to branch on.
         serving,
-        ...edgePropagating ? { edgePropagating: true } : {},
         ...doClassGuard ? { doClassGuard } : {}
       }
     };
@@ -11070,7 +10931,7 @@ import { defineCommand as defineCommand12 } from "citty";
 
 // src/cli/commands/workspace/new.ts
 import * as p25 from "@clack/prompts";
-import { isAbsolute as isAbsolute6, resolve as resolve17 } from "path";
+import { isAbsolute as isAbsolute6, resolve as resolve18 } from "path";
 
 // src/cli/commands/workspace/analysis.ts
 import * as p23 from "@clack/prompts";
@@ -11079,6 +10940,14 @@ var PEER_REF_PREFIX = `${spacePrivateRef("peers")}/`;
 function peerWorkspaceRef(workspaceId) {
   return `${PEER_REF_PREFIX}${workspaceId}`;
 }
+function workspaceSyncRelation(dir, localOid, publishedOid) {
+  if (localOid !== null && localOid === publishedOid) return "in_sync";
+  if (localOid === null || publishedOid === null) return "unknown";
+  if (resolveCommit(dir, publishedOid) === null) return "unknown";
+  if (isAncestor(dir, localOid, publishedOid)) return "behind";
+  if (isAncestor(dir, publishedOid, localOid)) return "ahead";
+  return "diverged";
+}
 function formatCount(count) {
   if (!count) return "?";
   return count.capped ? `${count.count}+` : String(count.count);
@@ -11195,18 +11064,18 @@ function printOverlaps(overlaps, json) {
 
 // src/cli/commands/workspace/local.ts
 import * as p24 from "@clack/prompts";
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync26, realpathSync as realpathSync5, renameSync as renameSync2, statSync as statSync3, writeFileSync as writeFileSync9 } from "fs";
-import { dirname as dirname9, isAbsolute as isAbsolute5, join as join22, relative as relative2, sep as sep2 } from "path";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync25, realpathSync as realpathSync6, renameSync as renameSync2, statSync as statSync3, writeFileSync as writeFileSync9 } from "fs";
+import { dirname as dirname10, isAbsolute as isAbsolute5, join as join22, relative as relative2, sep as sep2 } from "path";
 var WORKSPACE_MARKER = "deepspace-workspace.json";
 function excludeWorktreeDir(appDir, dir) {
   try {
     ensureLocalExclude(appDir, ".deepspace/");
-    const realDir = realpathSync5(dir);
-    const rel = relative2(realpathSync5(repoToplevel(appDir)), realDir);
+    const realDir = realpathSync6(dir);
+    const rel = relative2(realpathSync6(repoToplevel(appDir)), realDir);
     if (!rel || rel === ".." || rel.startsWith(`..${sep2}`) || isAbsolute5(rel)) return;
     const pattern = rel.split(sep2).join("/");
     if (pattern === ".deepspace" || pattern.startsWith(".deepspace/")) return;
-    const relApp = relative2(realpathSync5(appDir), realDir).split(sep2).join("/");
+    const relApp = relative2(realpathSync6(appDir), realDir).split(sep2).join("/");
     if (relApp === ".deepspace" || relApp.startsWith(".deepspace/")) return;
     ensureLocalExclude(appDir, `/${pattern}/`);
   } catch {
@@ -11228,7 +11097,7 @@ function markManagedWorkspace(worktreeRoot, workspaceId) {
   const marker = { version: 1, workspaceId, mode: "managed-linked" };
   const tempPath = `${markerPath}.${process.pid}.tmp`;
   try {
-    mkdirSync7(dirname9(markerPath), { recursive: true });
+    mkdirSync7(dirname10(markerPath), { recursive: true });
     writeFileSync9(tempPath, JSON.stringify(marker) + "\n");
     renameSync2(tempPath, markerPath);
     return true;
@@ -11253,7 +11122,7 @@ function isManagedWorkspaceWorktree(worktreeRoot, workspaceId) {
   const markerPath = worktreeMarkerPath(worktreeRoot);
   if (!markerPath) return false;
   try {
-    const marker = JSON.parse(readFileSync26(markerPath, "utf-8"));
+    const marker = JSON.parse(readFileSync25(markerPath, "utf-8"));
     return marker.version === 1 && marker.workspaceId === workspaceId && marker.mode === "managed-linked";
   } catch {
     return false;
@@ -11265,7 +11134,7 @@ function defaultWorkspaceRoot(appDir, workspaceId) {
   return join22(primary.path, ".deepspace", "ws", workspaceId.slice(3).toLowerCase());
 }
 function appDirInWorktree(appDir, worktreeRoot) {
-  const appRelative = relative2(realpathSync5(repoToplevel(appDir)), realpathSync5(appDir));
+  const appRelative = relative2(realpathSync6(repoToplevel(appDir)), realpathSync6(appDir));
   return appRelative ? join22(worktreeRoot, appRelative) : worktreeRoot;
 }
 function materializeWorkspaceWorktree(appDir, worktreeRoot, branch, startPoint, workspaceId, options = {}) {
@@ -11281,6 +11150,18 @@ function materializeWorkspaceWorktree(appDir, worktreeRoot, branch, startPoint,
   }
   excludeWorktreeDir(appDir, worktreeRoot);
 }
+function rematerializeWorkspaceWorktree(appDir, worktreeRoot, branch, workspaceId, options = {}) {
+  const added = runGit(appDir, ["worktree", "add", worktreeRoot, branch], { allowFail: true });
+  if (added.status !== 0) {
+    return added.stderr.toString("utf-8").trim() || "unknown git error";
+  }
+  if (!(options.markManaged ?? markManagedWorkspace)(worktreeRoot, workspaceId)) {
+    runGit(appDir, ["worktree", "remove", worktreeRoot], { allowFail: true });
+    return `could not record DeepSpace ownership for ${worktreeRoot}`;
+  }
+  excludeWorktreeDir(appDir, worktreeRoot);
+  return null;
+}
 function inOwnLinkedWorktree(appDir, id) {
   if (workspaceIdFromBranch(currentBranch(appDir)) !== id) return false;
   try {
@@ -11389,7 +11270,7 @@ function cleanupWorkspaceLocal(appDir, id, trunkBranch, options = {}) {
       }
       let inside = false;
       try {
-        inside = realpathSync5(repoToplevel(appDir)) === realpathSync5(linked.path);
+        inside = realpathSync6(repoToplevel(appDir)) === realpathSync6(linked.path);
       } catch {
         inside = false;
       }
@@ -11485,7 +11366,7 @@ function inferWorkspaceId(appDir, explicit) {
   const id = explicit?.trim() || workspaceIdFromBranch(currentBranch(appDir));
   if (!id) {
     throw new Refusal(
-      'Not inside a workspace worktree (the branch is not ws/<id>). Pass the workspace id, or create one with `deepspace workspace new -t "\u2026"`.',
+      'Not inside a workspace worktree (the branch is not ws/<id>). Select one with `-w ws_\u2026` (for `workspace drop`, pass the id as the argument), or create one with `deepspace workspace new -t "\u2026"`.',
       "not_in_workspace"
     );
   }
@@ -11494,17 +11375,28 @@ function inferWorkspaceId(appDir, explicit) {
   }
   return id;
 }
+function workspaceNotActiveRefusal(id, status3, dropAction) {
+  return new Refusal(
+    `Workspace ${id} is already ${status3}.` + (dropAction ? " This checkout is a leftover \u2014 `deepspace workspace drop` cleans it up." : ""),
+    "workspace_not_active",
+    {
+      ...dropAction ? { action: dropAction } : {},
+      extra: { workspaceId: id, status: status3 }
+    }
+  );
+}
 function assertSelectedWorkspaceCheckout(appDir, id, resumeArgv) {
   const branch = currentBranch(appDir);
   if (isSelectedWorkspaceCheckout(branch, id)) return;
   const worktree = resolveWorkspaceWorktree(listWorktrees(appDir), id);
-  const action = worktree ? { cwd: worktree, argv: resumeArgv } : { cwd: appDir, argv: ["deepspace", "workspace", "attach", id] };
+  const worktreeAppDir = worktree ? appDirInWorktree(appDir, worktree) : null;
+  const action = worktreeAppDir ? { cwd: worktreeAppDir, argv: resumeArgv } : { cwd: appDir, argv: ["deepspace", "workspace", "attach", id] };
   throw new Refusal(
-    `Workspace ${id} is not checked out here (current branch: ${branch ?? "detached"}). ` + (worktree ? `Run this command from its checkout at ${worktree}.` : "Attach it in this clone before mutating its published line."),
+    `Workspace ${id} is not checked out here (current branch: ${branch ?? "detached"}). ` + (worktreeAppDir ? `Run this command from its checkout at ${worktreeAppDir}.` : "Attach it in this clone before mutating its published line."),
     "workspace_checkout_mismatch",
     {
       action,
-      extra: worktree ? { workspaceDir: worktree } : void 0
+      extra: worktreeAppDir ? { workspaceDir: worktreeAppDir } : void 0
     }
   );
 }
@@ -11528,10 +11420,11 @@ function pushWorkspaceRef(appDir, token, ref, headOid) {
   if (push.status === "committed" || push.status === "up_to_date") return;
   if (push.status === "ref_conflict" || push.status === "non_fast_forward") {
     throw new Refusal(
-      `Another checkout advanced this workspace's line, so publishing yours is not a fast-forward \u2014 the push was refused rather than drop that work. Integrate its tip (\`git pull ${SPACE_REMOTE} ${ref}\`, or re-attach the workspace in a fresh dir), resolve any conflicts, then re-run the command. (Amended or rebased your own commits? Same refusal \u2014 merge your old tip back in.)`,
+      `Another checkout advanced this workspace's line, so publishing yours is not a fast-forward \u2014 the push was refused rather than drop that work. Integrate its tip (\`git pull --no-rebase ${SPACE_REMOTE} ${ref}\`, or re-attach the workspace in a fresh dir), resolve any conflicts, then re-run the command. (Amended or rebased your own commits? Same refusal \u2014 merge your old tip back in.)`,
       push.status,
       {
-        action: { cwd: appDir, argv: ["git", "pull", SPACE_REMOTE, ref] }
+        actionRequired: true,
+        action: { cwd: appDir, argv: ["git", "pull", "--no-rebase", SPACE_REMOTE, ref] }
       }
     );
   }
@@ -11587,6 +11480,7 @@ var newWorkspaceCommand = defineDeepspaceCommand({
     );
     spinner2?.message("Creating workspace\u2026");
     ensureSpaceRemote(appDir, appId);
+    ensureGitIdentity(appDir, token);
     let baseOid = null;
     const refs = await api4.getRefs();
     if (baseArg) {
@@ -11630,7 +11524,7 @@ var newWorkspaceCommand = defineDeepspaceCommand({
       idempotencyKey: mintIdempotencyKey()
     });
     const dirInput = typeof args.dir === "string" ? args.dir.trim() : "";
-    const worktreeRoot = dirInput ? isAbsolute6(dirInput) ? dirInput : resolve17(appDir, dirInput) : defaultWorkspaceRoot(appDir, id);
+    const worktreeRoot = dirInput ? isAbsolute6(dirInput) ? dirInput : resolve18(appDir, dirInput) : defaultWorkspaceRoot(appDir, id);
     const dir = appDirInWorktree(appDir, worktreeRoot);
     try {
       materializeWorkspaceWorktree(appDir, worktreeRoot, branch, baseOid, id);
@@ -11668,8 +11562,18 @@ var newWorkspaceCommand = defineDeepspaceCommand({
 
 // src/cli/commands/workspace/attach.ts
 import * as p26 from "@clack/prompts";
-import { existsSync as existsSync25, readdirSync as readdirSync7, rmSync as rmSync6 } from "fs";
-import { isAbsolute as isAbsolute7, resolve as resolve18 } from "path";
+import { existsSync as existsSync23, readdirSync as readdirSync7, realpathSync as realpathSync7, rmSync as rmSync6 } from "fs";
+import { isAbsolute as isAbsolute7, resolve as resolve19 } from "path";
+function samePath(a, b) {
+  const real = (p35) => {
+    try {
+      return realpathSync7(p35);
+    } catch {
+      return resolve19(p35);
+    }
+  };
+  return real(a) === real(b);
+}
 function finishedWorkspaceMessage(id, view) {
   const workspace = view.workspace;
   if (workspace.status === "landed") {
@@ -11678,7 +11582,7 @@ function finishedWorkspaceMessage(id, view) {
   return `Workspace ${id} is ${workspace.status} \u2014 its ref is retained briefly (fetch ${workspace.ref} to inspect), but attach only works on active workspaces.`;
 }
 function cleanFailedFreshAttachDir(dir) {
-  if (!existsSync25(dir)) return [];
+  if (!existsSync23(dir)) return [];
   let entries;
   try {
     entries = readdirSync7(dir);
@@ -11738,6 +11642,7 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
         });
       }
       ensureSpaceRemote(appDir, appId2);
+      ensureGitIdentity(appDir, token2);
       const localWorkspaceRef = spacePrivateRef(`workspaces/${id}`);
       runGitRemote(appDir, token2, [
         "fetch",
@@ -11754,11 +11659,87 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
         );
       }
       const requestedDir = typeof args.dir === "string" ? args.dir.trim() : "";
-      const worktreeRoot = requestedDir ? isAbsolute7(requestedDir) ? requestedDir : resolve18(appDir, requestedDir) : defaultWorkspaceRoot(appDir, id);
+      const worktreeRoot = requestedDir ? isAbsolute7(requestedDir) ? requestedDir : resolve19(appDir, requestedDir) : defaultWorkspaceRoot(appDir, id);
       const dir2 = appDirInWorktree(appDir, worktreeRoot);
-      if (resolveCommit(appDir, `refs/heads/${branch}`)) {
+      const localTip = resolveCommit(appDir, `refs/heads/${branch}`);
+      if (localTip) {
+        let existing = resolveWorkspaceWorktree(listWorktrees(appDir), id);
+        if (existing && !existsSync23(existing)) {
+          runGit(appDir, ["worktree", "prune"], { allowFail: true });
+          existing = null;
+        }
+        const relation = workspaceSyncRelation(appDir, localTip, tip2);
+        const inSync = relation === "in_sync";
+        const behindOrDiverged = relation === "behind" || relation === "diverged";
+        const syncAdvice = behindOrDiverged ? `integrate the published tip first (\`git pull --no-rebase ${SPACE_REMOTE} ${view2.workspace.ref}\`)` : `run \`deepspace workspace sync\` from it`;
+        const syncAction = (cwd) => behindOrDiverged ? { cwd, argv: ["git", "pull", "--no-rebase", SPACE_REMOTE, view2.workspace.ref] } : { cwd, argv: ["deepspace", "workspace", "sync"] };
+        if (existing && (!requestedDir || samePath(existing, worktreeRoot))) {
+          const existingDir = appDirInWorktree(appDir, existing);
+          spinner2?.stop(`Already attached: ${id}.`);
+          if (!args.json) {
+            p26.log.info(`Task: ${view2.workspace.task}`);
+            p26.log.info(`Work in: cd ${existingDir}`);
+            if (!inSync) {
+              p26.log.warn(
+                `The checkout is at ${localTip.slice(0, 10)} but the workspace's published tip is ${tip2.slice(0, 10)} \u2014 ${syncAdvice}.`
+              );
+            }
+          }
+          return {
+            data: {
+              workspaceId: id,
+              mode: "worktree",
+              dir: existingDir,
+              worktreeRoot: existing,
+              branch,
+              tipOid: localTip,
+              remoteTip: tip2,
+              syncRelation: relation,
+              task: view2.workspace.task,
+              alreadyAttached: true
+            },
+            ...inSync ? {} : { action: syncAction(existingDir) }
+          };
+        }
+        if (!existing) {
+          const failure = rematerializeWorkspaceWorktree(appDir, worktreeRoot, branch, id);
+          if (failure) {
+            spinner2?.stop("Branch exists.");
+            throw new Refusal(
+              `Branch ${branch} exists locally with no worktree, and re-materializing it failed: ${failure}. Inspect it (\`git log ${branch}\`) and check it out yourself.`,
+              "branch_exists"
+            );
+          }
+          spinner2?.stop(`Re-attached ${id}.`);
+          if (!args.json) {
+            p26.log.info(`Task: ${view2.workspace.task}`);
+            p26.log.info(`Work in: cd ${dir2}`);
+            if (!inSync) {
+              p26.log.warn(
+                `The re-materialized checkout is at ${localTip.slice(0, 10)} but the workspace's published tip is ${tip2.slice(0, 10)} \u2014 after installing, ${syncAdvice}.`
+              );
+            }
+          }
+          const action3 = { cwd: dir2, argv: [detectPackageManager(dir2), "install"] };
+          return {
+            data: {
+              workspaceId: id,
+              mode: "worktree",
+              dir: dir2,
+              worktreeRoot,
+              branch,
+              tipOid: localTip,
+              remoteTip: tip2,
+              syncRelation: relation,
+              task: view2.workspace.task,
+              rematerialized: true
+            },
+            action: action3
+          };
+        }
+        spinner2?.stop("Branch exists.");
         throw new Refusal(
-          `Branch ${branch} already exists locally (this workspace has a worktree here). Find it with \`git worktree list\` and continue there.`,
+          `Workspace ${id} is already checked out at ${existing} \u2014 continue there (or drop that worktree before attaching it elsewhere).`,
           "branch_exists"
         );
       }
@@ -11777,6 +11758,10 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
           worktreeRoot,
           branch,
           tipOid: tip2,
+          remoteTip: tip2,
+          // Freshly materialized at the published tip — trivially in sync;
+          // every attach outcome carries the same shape.
+          syncRelation: "in_sync",
           task: view2.workspace.task
         },
         action: action2
@@ -11793,11 +11778,11 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
         extra: { status: view.workspace.status }
       });
     }
-    const dir = resolve18(
+    const dir = resolve19(
       process.cwd(),
       (typeof args.dir === "string" ? args.dir.trim() : "") || `ws-${id.slice(3).toLowerCase()}`
     );
-    if (existsSync25(dir)) {
+    if (existsSync23(dir)) {
       spinner2?.stop("Target exists.");
       throw new Refusal(`${dir} already exists \u2014 pass a different directory.`, "dir_exists");
     }
@@ -11812,6 +11797,7 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
     try {
       runGit(process.cwd(), ["init", "--quiet", dir]);
       ensureSpaceRemote(dir, appId);
+      ensureGitIdentity(dir, token);
       const localWorkspaceRef = spacePrivateRef(`workspaces/${id}`);
       runGitRemote(dir, token, [
         "fetch",
@@ -11848,6 +11834,8 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
         dir,
         branch,
         tipOid: tip,
+        remoteTip: tip,
+        syncRelation: "in_sync",
         task: view.workspace.task
       },
       action
@@ -11880,7 +11868,19 @@ var syncWorkspaceCommand = defineDeepspaceCommand({
       typeof args.app === "string" ? args.app : void 0
     );
     const id = inferWorkspaceId(appDir, workspaceArg);
-    assertSelectedWorkspaceCheckout(appDir, id, ["deepspace", "workspace", "sync"]);
+    try {
+      assertSelectedWorkspaceCheckout(appDir, id, ["deepspace", "workspace", "sync"]);
+    } catch (mismatch) {
+      const current = await api4.getWorkspace(id).then((r) => r.view).catch(() => null);
+      if (current && current.workspace.status !== "active") {
+        spinner2?.stop("Workspace finished.");
+        throw workspaceNotActiveRefusal(id, current.workspace.status, {
+          cwd: appDir,
+          argv: ["deepspace", "workspace", "drop", id, "--app", appId]
+        });
+      }
+      throw mismatch;
+    }
     const headOid = resolveCommit(appDir, "HEAD");
     if (!headOid) {
       throw new Refusal("The workspace has no commits yet \u2014 commit first, then sync.", "no_commits");
@@ -11899,6 +11899,7 @@ var syncWorkspaceCommand = defineDeepspaceCommand({
       );
     }
     ensureSpaceRemote(appDir, appId);
+    ensureGitIdentity(appDir, token);
     pushWorkspaceRef(appDir, token, before.workspace.ref, headOid);
     try {
       fetchTrunk(appDir, token, refs?.head ?? null);
@@ -12039,6 +12040,7 @@ var workspaceStatusCommand = defineDeepspaceCommand({
     const aheadExact = headOid && baseLocal ? revListCount(appDir, workspace.baseOid, headOid) : null;
     const unsynced = headOid !== null && view.tipOid !== headOid;
     const dirty = workspaceDir ? statusFiles(workspaceDir) : [];
+    const relation = !unsynced ? "in_sync" : workspace.status !== "active" || !workspaceDir ? "unknown" : workspaceSyncRelation(workspaceDir, headOid, view.tipOid);
     const lines = await loadWorkspaceLines(appDir, token, api4, trunkOid);
     const myTip = headOid ?? resolveCommit(appDir, peerWorkspaceRef(id)) ?? view.tipOid;
     const line = myTip ? lineChangedPaths(appDir, workspace.baseOid, myTip, trunkOid) : null;
@@ -12058,6 +12060,10 @@ var workspaceStatusCommand = defineDeepspaceCommand({
       ...attached ? {
         headOid,
         unsynced,
+        // The human line distinguishes behind/diverged/ahead; the machine
+        // mirror must too, or a JSON caller can't tell a fast-forward from
+        // a real divergence.
+        syncRelation: relation,
         uncommitted: dirty,
         trunkOverlap
       } : {},
@@ -12073,10 +12079,29 @@ var workspaceStatusCommand = defineDeepspaceCommand({
           `Not checked out in this clone \u2014 showing the published state (local HEAD/uncommitted unavailable). Attach it with \`deepspace workspace attach ${id} <dir>\`.`
         );
       }
-      if (unsynced)
-        p29.log.warn(
-          `Local HEAD ${headOid?.slice(0, 10)} is not synced (server has ${view.tipOid?.slice(0, 10) ?? "nothing"}) \u2014 run \`deepspace workspace sync\`.`
-        );
+      if (unsynced) {
+        if (workspace.status === "landed") {
+          p29.log.info(
+            `Already landed${workspace.landedOid ? ` at ${workspace.landedOid.slice(0, 10)}` : ""} \u2014 this checkout is a leftover; \`deepspace workspace drop ${id}\` cleans it up.`
+          );
+        } else if (workspace.status === "dropped") {
+          p29.log.info(
+            `Already dropped \u2014 this checkout is a leftover; \`deepspace workspace drop ${id}\` cleans it up.`
+          );
+        } else if (relation === "behind") {
+          p29.log.warn(
+            `Local HEAD ${headOid?.slice(0, 10)} is BEHIND the published tip ${view.tipOid?.slice(0, 10)} (another checkout synced ahead) \u2014 fast-forward first (\`git pull --no-rebase ${SPACE_REMOTE} ${workspace.ref}\`).`
+          );
+        } else if (relation === "diverged") {
+          p29.log.warn(
+            `Local HEAD ${headOid?.slice(0, 10)} has DIVERGED from the published tip ${view.tipOid?.slice(0, 10)} \u2014 integrate it first (\`git pull --no-rebase ${SPACE_REMOTE} ${workspace.ref}\`), then \`deepspace workspace sync\`.`
+          );
+        } else {
+          p29.log.warn(
+            `Local HEAD ${headOid?.slice(0, 10)} is not synced (server has ${view.tipOid?.slice(0, 10) ?? "nothing"}) \u2014 run \`deepspace workspace sync\`.`
+          );
+        }
+      }
       if (dirty.length > 0) p29.log.warn(`${dirty.length} uncommitted file(s) in the worktree.`);
       if (trunkOverlap.length > 0) {
         p29.log.warn(
@@ -12094,13 +12119,13 @@ import * as p30 from "@clack/prompts";
 
 // src/cli/lib/validation.ts
 import { sync as spawnSync7 } from "cross-spawn";
-import { readFileSync as readFileSync27 } from "fs";
+import { readFileSync as readFileSync26 } from "fs";
 import { join as join23 } from "path";
 var MAX_SUMMARY_CHARS = 4e3;
 var MAX_OUTPUT_BUFFER = 64 * 1024 * 1024;
 function configuredCommand(appDir) {
   try {
-    const pkg2 = JSON.parse(readFileSync27(join23(appDir, "package.json"), "utf-8"));
+    const pkg2 = JSON.parse(readFileSync26(join23(appDir, "package.json"), "utf-8"));
     if (pkg2.scripts?.validate) return `${detectPackageManager(appDir)} run --silent validate`;
   } catch {
   }
@@ -12130,6 +12155,14 @@ ${res.stderr?.toString("utf-8") ?? ""}`.trim();
 function hasLeftoverConflictMarkers(diffCheckOutput) {
   return /leftover conflict marker/.test(diffCheckOutput);
 }
+function conflictMarkerFiles(diffCheckOutput) {
+  const files = /* @__PURE__ */ new Set();
+  for (const line of diffCheckOutput.split("\n")) {
+    const match = /^(.+?):\d+: leftover conflict marker/.exec(line);
+    if (match) files.add(match[1]);
+  }
+  return [...files];
+}
 function landResumeArgv(args) {
   const argv = ["deepspace", "workspace", "land"];
   const workspace = args.workspace?.trim();
@@ -12195,7 +12228,20 @@ var landWorkspaceCommand = defineDeepspaceCommand({
     });
     const recoveryAction = { cwd: appDir, argv: resumeArgv };
     const resumeNext = humanCommand(resumeArgv);
-    assertSelectedWorkspaceCheckout(appDir, id, resumeArgv);
+    const dropAction = {
+      cwd: appDir,
+      argv: ["deepspace", "workspace", "drop", id, "--app", appId]
+    };
+    try {
+      assertSelectedWorkspaceCheckout(appDir, id, resumeArgv);
+    } catch (mismatch) {
+      const current = await api4.getWorkspace(id).then((r) => r.view).catch(() => null);
+      if (current && current.workspace.status !== "active") {
+        spinner2?.stop("Workspace finished.");
+        throw workspaceNotActiveRefusal(id, current.workspace.status, dropAction);
+      }
+      throw mismatch;
+    }
     const headBefore = resolveCommit(appDir, "HEAD");
     if (!headBefore) {
       throw new Refusal("The workspace has no commits \u2014 nothing to land.", "no_commits");
@@ -12211,13 +12257,10 @@ var landWorkspaceCommand = defineDeepspaceCommand({
     const [{ view }, refs] = await Promise.all([api4.getWorkspace(id), api4.getRefs()]);
     if (view.workspace.status !== "active") {
       spinner2?.stop("Workspace finished.");
-      throw new Refusal(
-        `Workspace ${id} is already ${view.workspace.status}.`,
-        "workspace_not_active",
-        { extra: { status: view.workspace.status } }
-      );
+      throw workspaceNotActiveRefusal(id, view.workspace.status, dropAction);
     }
     ensureSpaceRemote(appDir, appId);
+    ensureGitIdentity(appDir, token);
     const isResumedMerge = resolveCommit(appDir, "HEAD^2") !== null && view.tipOid !== null && resolveCommit(appDir, "HEAD^") === view.tipOid;
     if (!isResumedMerge) {
       pushWorkspaceRef(appDir, token, view.workspace.ref, headBefore);
@@ -12264,6 +12307,7 @@ var landWorkspaceCommand = defineDeepspaceCommand({
           "merge_conflict",
           {
             actionRequired: true,
+            action: recoveryAction,
             extra: { workspaceId: id, conflict: true }
           }
         );
@@ -12273,14 +12317,17 @@ var landWorkspaceCommand = defineDeepspaceCommand({
       const markerCheck = runGit(appDir, ["diff", "--check", "HEAD^", "HEAD"], {
         allowFail: true
       });
-      if (hasLeftoverConflictMarkers(markerCheck.stdout.toString("utf-8"))) {
+      const markerOutput = markerCheck.stdout.toString("utf-8");
+      if (hasLeftoverConflictMarkers(markerOutput)) {
+        const files = conflictMarkerFiles(markerOutput);
         spinner2?.stop("Conflict markers in merge.");
         throw new Refusal(
-          `The merge commit still contains unresolved conflict markers (<<<<<<< / ======= / >>>>>>>). Fix the marked files, commit the correction, then re-run \`${resumeNext}\`. Nothing was pushed to ${intoBranch}.`,
+          `The merge commit still contains unresolved conflict markers (<<<<<<< / ======= / >>>>>>>)${files.length ? ` in ${files.join(", ")}` : ""}. Fix the marked files, commit the correction, then re-run \`${resumeNext}\`. Nothing was pushed to ${intoBranch}.`,
           "conflict_markers",
           {
             actionRequired: true,
-            extra: { workspaceId: id, conflict: true }
+            action: recoveryAction,
+            extra: { workspaceId: id, conflict: true, ...files.length ? { files } : {} }
           }
         );
       }
@@ -12314,6 +12361,7 @@ var landWorkspaceCommand = defineDeepspaceCommand({
           "validation_failed",
           {
             actionRequired: true,
+            action: recoveryAction,
             extra: { workspaceId: id, passed: false, outputTail }
           }
         );
@@ -12325,6 +12373,7 @@ var landWorkspaceCommand = defineDeepspaceCommand({
           "validation_mutated_tree",
           {
             actionRequired: true,
+            action: recoveryAction,
             extra: { workspaceId: id }
           }
         );
@@ -12360,7 +12409,37 @@ var landWorkspaceCommand = defineDeepspaceCommand({
         "push_rejected"
       );
     }
-    await api4.landWorkspace(id, { landedOid, intoRef });
+    try {
+      await api4.landWorkspace(id, { landedOid, intoRef });
+    } catch (err) {
+      const code = errorCode(err);
+      if (code === "workspace_not_active") {
+        const status3 = await api4.getWorkspace(id).then((r) => r.view.workspace.status).catch(() => null);
+        if (status3 && status3 !== "active") {
+          spinner2?.stop("Workspace finished.");
+          throw new Refusal(
+            `${intoBranch} took the land push (${landedOid.slice(0, 10)}), and the workspace is already ${status3} \u2014 a concurrent land or drop finished first, so there is nothing left to record. This checkout is a leftover; \`deepspace workspace drop ${id}\` cleans it up.`,
+            "workspace_not_active",
+            {
+              actionRequired: true,
+              action: dropAction,
+              extra: { workspaceId: id, into: intoBranch, landedOid, pushed: true, status: status3 }
+            }
+          );
+        }
+      }
+      spinner2?.stop("Landed; not recorded.");
+      const detail = err instanceof Error ? err.message : String(err);
+      throw new Refusal(
+        `The land push succeeded (${intoBranch} was at ${landedOid.slice(0, 10)}), but recording the land failed (${detail}). Resolve that, then re-run \`${resumeNext}\` \u2014 it re-checks the merge (a no-op when already pushed) and records it.`,
+        "land_unrecorded",
+        {
+          actionRequired: true,
+          action: recoveryAction,
+          extra: { workspaceId: id, into: intoBranch, landedOid, pushed: true }
+        }
+      );
+    }
     spinner2?.stop(`Landed ${id} into ${intoBranch} at ${landedOid.slice(0, 10)}.`);
     const cleanup = keepWorktree ? null : cleanupWorkspaceLocal(appDir, id, intoBranch, { expectedBranchOid: landedOid });
     const inOwnWorktree = !cleanup && inOwnLinkedWorktree(appDir, id);
@@ -12405,6 +12484,22 @@ function isWorkspaceTipPublished(appDir, localTip, publishedOids) {
   );
 }
 function workspaceUnsyncedRefusal(args) {
+  const dropKeepArgv = [
+    "deepspace",
+    "workspace",
+    "drop",
+    args.id,
+    "--app",
+    args.appId,
+    "--keep-worktree"
+  ];
+  if (args.status !== "active") {
+    return new Refusal(
+      `${args.id} is already ${args.status} on the server, and this checkout has committed work that was never published \u2014 nothing can publish it now. Keep it with \`${humanCommand(dropKeepArgv)}\` (retains the branch/worktree for manual disposal), or delete the branch yourself. Nothing was dropped.`,
+      "workspace_unsynced",
+      { extra: { workspaceId: args.id, status: args.status } }
+    );
+  }
   const syncArgv = ["deepspace", "workspace", "sync", "--app", args.appId, "--workspace", args.id];
   const dropArgv = ["deepspace", "workspace", "drop", args.id, "--app", args.appId];
   const publish = args.workspaceDir ? `Publish them first with \`${humanCommand(syncArgv)}\`, then re-run \`${humanCommand(dropArgv)}\`.` : `Recreate a worktree from the branch (\`git worktree add <dir> ${args.branch}\`), publish from there with \`${humanCommand(syncArgv)}\`, then re-run \`${humanCommand(dropArgv)}\`.`;
@@ -12412,11 +12507,25 @@ function workspaceUnsyncedRefusal(args) {
     `${args.id} has committed work that isn't published yet. ${publish} Alternatively, pass \`--keep-worktree\` to drop the cloud workspace while retaining the local branch/worktree for manual disposal. Nothing was dropped.`,
     "workspace_unsynced",
     {
+      // Exit 1 with an unblock action, deliberately: drop is destructive and
+      // refusing it is a hard stop, not the "your turn" hand-off exit 2 means.
       ...args.workspaceDir ? { action: { cwd: args.workspaceDir, argv: syncArgv } } : {},
-      extra: { workspaceId: args.id }
+      extra: { workspaceId: args.id, status: args.status }
     }
   );
 }
+async function dropRemoteTolerant(api4, id, statusBefore) {
+  try {
+    const view = (await api4.dropWorkspace(id)).view;
+    return { view, remoteDropped: statusBefore === "active" && view.workspace.status === "dropped" };
+  } catch (err) {
+    const code = errorCode(err);
+    if (code !== "workspace_not_active") throw err;
+    const current = await api4.getWorkspace(id).catch(() => null);
+    if (!current || current.view.workspace.status === "active") throw err;
+    return { view: current.view, remoteDropped: false };
+  }
+}
 var dropWorkspaceCommand = defineDeepspaceCommand({
   meta: { name: "drop", description: "Abandon a workspace (ref retained briefly, then GC)" },
   args: {
@@ -12441,32 +12550,47 @@ var dropWorkspaceCommand = defineDeepspaceCommand({
     spinner2?.start(`Preparing to drop ${explicitId ?? "workspace"}\u2026`);
     if (!findAppDir() && explicitId) {
       const { api: api5 } = await resolveApiOnly(appArg);
-      const { view: view2 } = await api5.dropWorkspace(explicitId);
+      const statusBefore = (await api5.getWorkspace(explicitId)).view.workspace.status;
+      const { view: view2, remoteDropped: remoteDropped2 } = await dropRemoteTolerant(api5, explicitId, statusBefore);
       spinner2?.stop();
       if (!args.json) {
         p31.log.success(
-          `Dropped ${explicitId}. Its ref sticks around briefly for undo, then is reaped.`
+          remoteDropped2 ? `Dropped ${explicitId}. Its ref sticks around briefly for undo, then is reaped.` : `Workspace ${explicitId} was already ${view2.workspace.status} on the server \u2014 nothing to drop remotely.`
         );
       }
-      return { data: { workspaceId: explicitId, status: view2.workspace.status } };
+      return { data: { workspaceId: explicitId, status: view2.workspace.status, remoteDropped: remoteDropped2 } };
     }
-    const { appDir, appId, api: api4 } = await resolveTarget2(appArg);
+    const { appDir, appId, token, api: api4 } = await resolveTarget2(appArg);
     const id = inferWorkspaceId(appDir, explicitId);
     const inspection = inspectWorkspaceCleanup(appDir, id);
     let approvedBranchOid;
+    const { view: before } = await api4.getWorkspace(id);
     if (!keepWorktree && inspection.willDeleteBranch && inspection.branchOid) {
-      const { view: before } = await api4.getWorkspace(id);
       const publishedOids = [
         before.tipOid,
         before.workspace.landedOid,
         before.workspace.baseOid
       ].filter((oid) => oid !== null);
-      if (!isWorkspaceTipPublished(appDir, inspection.branchOid, publishedOids)) {
+      let published = isWorkspaceTipPublished(appDir, inspection.branchOid, publishedOids);
+      if (!published && before.workspace.status !== "active") {
+        ensureSpaceRemote(appDir, appId);
+        const refs = await api4.getRefs();
+        const trunkRef = refs?.head?.startsWith("refs/heads/") ? refs.head : null;
+        if (trunkRef) {
+          runGitRemote(appDir, token, ["fetch", "--quiet", "--refmap=", SPACE_REMOTE, trunkRef], {
+            allowFail: true
+          });
+          const trunkTip = resolveCommit(appDir, "FETCH_HEAD");
+          published = trunkTip !== null && isWorkspaceTipPublished(appDir, inspection.branchOid, [trunkTip]);
+        }
+      }
+      if (!published) {
         throw workspaceUnsyncedRefusal({
           appId,
           id,
           branch: inspection.branch,
-          workspaceDir: inspection.checkout.dir
+          workspaceDir: inspection.checkout.dir,
+          status: before.workspace.status
         });
       }
       approvedBranchOid = inspection.branchOid;
@@ -12481,7 +12605,7 @@ var dropWorkspaceCommand = defineDeepspaceCommand({
         { extra: { workspaceId: id } }
       );
     }
-    const { view } = await api4.dropWorkspace(id);
+    const { view, remoteDropped } = await dropRemoteTolerant(api4, id, before.workspace.status);
     spinner2?.message(`Cleaning up ${id} locally\u2026`);
     const cleanup = keepWorktree ? null : cleanupWorkspaceLocal(appDir, id, null, {
       expectedBranchOid: approvedBranchOid,
@@ -12491,12 +12615,15 @@ var dropWorkspaceCommand = defineDeepspaceCommand({
     const data = {
       workspaceId: id,
       status: view.workspace.status,
+      remoteDropped,
       ...retainedWorktree ? { worktree: retainedWorktree } : {},
       ...cleanup ? { cleanup: cleanupJson(cleanup) } : {}
     };
     spinner2?.stop();
     if (!args.json) {
-      p31.log.success(`Dropped ${id}. Its ref sticks around briefly for undo, then is reaped.`);
+      p31.log.success(
+        remoteDropped ? `Dropped ${id}. Its ref sticks around briefly for undo, then is reaped.` : `Workspace ${id} was already ${view.workspace.status} on the server \u2014 nothing to drop remotely.`
+      );
       if (cleanup && !cleanup.error) reportCleanupHuman(cleanup);
       else if (retainedWorktree) p31.log.info(`Retained checkout: ${retainedWorktree}`);
     }
@@ -12565,7 +12692,7 @@ function formatEvent2(e, lands, actors) {
       detail = `"${String(s.task ?? "")}" from ${short(s.baseOid)}`;
       break;
     case "workspace.synced":
-      detail = `\u2192 ${short(s.headOid)} (${Number(s.files ?? 0)} files vs base)`;
+      detail = `\u2192 ${short(s.headOid)}`;
       break;
     case "workspace.landed":
       detail = `"${String(s.task ?? "")}" \u2192 ${short(s.landedOid)} on ${String(s.into ?? "trunk")}`;
@@ -13063,8 +13190,8 @@ function sameRefs(left, right) {
 
 // src/cli/commands/update.ts
 import * as p34 from "@clack/prompts";
-import { existsSync as existsSync26, readFileSync as readFileSync28, writeFileSync as writeFileSync10 } from "fs";
-import { join as join24, resolve as resolve19 } from "path";
+import { existsSync as existsSync24, readFileSync as readFileSync27, writeFileSync as writeFileSync10 } from "fs";
+import { join as join24, resolve as resolve20 } from "path";
 var REGISTRY = "https://registry.npmjs.org/deepspace/latest";
 var DOCS_URL = "https://documentation.deep.space/cli-reference/commands";
 var OLDEST_SUPPORTED_MINOR = 12;
@@ -13079,18 +13206,18 @@ function gapIsTooWide(from, to) {
 }
 function readAppSdkVersion(appDir) {
   const installed = join24(appDir, "node_modules", "deepspace", "package.json");
-  if (existsSync26(installed)) {
-    const parsed2 = JSON.parse(readFileSync28(installed, "utf8"));
+  if (existsSync24(installed)) {
+    const parsed2 = JSON.parse(readFileSync27(installed, "utf8"));
     if (typeof parsed2.version === "string") return parsed2.version;
   }
   const manifest = join24(appDir, "package.json");
-  if (!existsSync26(manifest)) return null;
-  const parsed = JSON.parse(readFileSync28(manifest, "utf8"));
+  if (!existsSync24(manifest)) return null;
+  const parsed = JSON.parse(readFileSync27(manifest, "utf8"));
   return parsed.dependencies?.deepspace ?? null;
 }
 function pinSdkVersion(appDir, version) {
   const path = join24(appDir, "package.json");
-  const source = readFileSync28(path, "utf8");
+  const source = readFileSync27(path, "utf8");
   const updated = source.replace(
     /("deepspace"\s*:\s*")[^"]+(")/,
     (_match, head, tail) => `${head}^${version}${tail}`
@@ -13155,7 +13282,7 @@ var update_default = defineDeepspaceCommand({
     }
   },
   async run({ args }) {
-    const appDir = resolve19(".");
+    const appDir = resolve20(".");
     if (!hasWranglerConfig(appDir)) {
       throw new Refusal(
         "No wrangler.toml found \u2014 run this from inside a DeepSpace app directory.",
@@ -13235,9 +13362,9 @@ var update_default = defineDeepspaceCommand({
 });
 
 // src/cli/cli.ts
-var __dirname = dirname10(fileURLToPath3(import.meta.url));
-var pkg = JSON.parse(readFileSync29(join25(__dirname, "..", "package.json"), "utf-8"));
-if (process.platform === "linux" && !process.env.SSL_CERT_FILE && existsSync27("/etc/ssl/certs/ca-certificates.crt")) {
+var __dirname = dirname11(fileURLToPath3(import.meta.url));
+var pkg = JSON.parse(readFileSync28(join25(__dirname, "..", "package.json"), "utf-8"));
+if (process.platform === "linux" && !process.env.SSL_CERT_FILE && existsSync25("/etc/ssl/certs/ca-certificates.crt")) {
   process.env.SSL_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt";
 }
 var create2 = defineCommand14({
@@ -13363,7 +13490,49 @@ function assertKnownCommandPath(argv) {
     `${unknownCommandMessage(unknown)}
 Run \`${unknown.helpPath.join(" ")} --help\` for the command list.`
   );
-  if (unknown.executable) printAction({ cwd: process.cwd(), argv: unknown.suggestion });
+  if (unknown.executable) {
+    printAction(executableAction({ cwd: process.cwd(), argv: unknown.suggestion }));
+  }
+  process.exit(1);
+}
+function selectedLeaf(argv) {
+  let command = main;
+  let remaining = argv;
+  const path = [];
+  const commandPrefixArgs = [];
+  for (; ; ) {
+    const subCommands = command.subCommands;
+    if (!subCommands || Object.keys(subCommands).length === 0) {
+      return { command, rawArgs: [...commandPrefixArgs, ...remaining], path };
+    }
+    const index = remaining.findIndex((argument) => !argument.startsWith("-"));
+    if (index < 0) return { command, rawArgs: [...commandPrefixArgs, ...remaining], path };
+    const name = remaining[index];
+    const entry = Object.entries(subCommands).find(([key, child]) => {
+      if (key === name) return true;
+      const alias = child.meta?.alias;
+      return (Array.isArray(alias) ? alias : alias ? [alias] : []).includes(name);
+    });
+    if (!entry) return null;
+    commandPrefixArgs.push(...remaining.slice(0, index));
+    path.push(entry[0]);
+    command = entry[1];
+    remaining = remaining.slice(index + 1);
+  }
+}
+function assertKnownOptions(argv) {
+  const selected = selectedLeaf(argv);
+  if (!selected || selected.path.join(" ") === "app create") return;
+  const args = selected.command.args ?? {};
+  const unknown = unknownOptionNamesFromRaw(selected.rawArgs, args);
+  if (unknown.length === 0) return;
+  const commandName = selected.path.join(" ") || "deepspace";
+  const message = unknownOptionMessage(commandName, unknown, args);
+  if (argv.includes("--json")) {
+    console.log(JSON.stringify({ ok: false, code: "unknown_option", error: message }));
+  } else {
+    console.error(withSlug(message, "unknown_option"));
+  }
   process.exit(1);
 }
 var rawArgs = process.argv.slice(2);
@@ -13377,6 +13546,9 @@ if (DEEPSPACE_ENV === "invalid") {
   }
   process.exit(1);
 }
+if (!wantsHelp && !(rawArgs.length === 1 && ["--version", "-v"].includes(rawArgs[0]))) {
+  assertKnownOptions(rawArgs);
+}
 if (rawArgs.includes("--json") && !wantsHelp) {
   const unknown = findUnknownCommand(rawArgs, commandTree());
   if (unknown) {
@@ -13385,7 +13557,7 @@ if (rawArgs.includes("--json") && !wantsHelp) {
         ok: false,
         code: "unknown_command",
         error: unknownCommandMessage(unknown),
-        ...unknown.executable ? { action: { cwd: process.cwd(), argv: unknown.suggestion } } : {}
+        ...unknown.executable ? { action: executableAction({ cwd: process.cwd(), argv: unknown.suggestion }) } : {}
       })
     );
     process.exit(1);