deepspace 0.17.0 → 0.19.0

package/dist/cli.js

@@ -1,9 +1,14 @@
 #!/usr/bin/env node
 
 // src/cli/cli.ts
-import { defineCommand as defineCommand14, runMain, runCommand, renderUsage } from "citty";
+import {
+  defineCommand as defineCommand14,
+  runMain,
+  runCommand,
+  renderUsage
+} from "citty";
 import { sync as spawnSync8 } from "cross-spawn";
-import { readFileSync as readFileSync30, existsSync as existsSync27 } from "fs";
+import { readFileSync as readFileSync28, existsSync as existsSync25 } from "fs";
 import { dirname as dirname11, join as join25 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 
@@ -260,6 +265,146 @@ function wrapCommandErrors(cmd) {
   return cmd;
 }
 
+// src/cli/lib/command.ts
+import { defineCommand, parseArgs } from "citty";
+import * as p3 from "@clack/prompts";
+var Refusal = class extends Error {
+  code;
+  action;
+  actionRequired;
+  extra;
+  constructor(message, code, opts = {}) {
+    super(message);
+    this.name = "Refusal";
+    this.code = code;
+    this.action = opts.action ? executableAction(opts.action) : void 0;
+    this.actionRequired = opts.actionRequired ?? false;
+    this.extra = opts.extra ?? {};
+  }
+};
+function apiErrorDetails(err) {
+  return err instanceof ApiError ? err.details : void 0;
+}
+function withoutReservedKeys(payload) {
+  return Object.fromEntries(
+    Object.entries(payload).filter(
+      ([key]) => ![
+        "ok",
+        "code",
+        "error",
+        "action",
+        "actionRequired",
+        "next",
+        "nextAction",
+        "resume"
+      ].includes(key)
+    )
+  );
+}
+function exitWhenFlushed(code) {
+  if (process.stdout.writableLength === 0) process.exit(code);
+  process.stdout.write("", () => process.exit(code));
+  return void 0;
+}
+function nameVariants(name) {
+  return [
+    name,
+    name.replace(/-([a-z])/g, (_, c) => c.toUpperCase()),
+    name.replace(/[A-Z]/g, (c) => `-${c.toLowerCase()}`)
+  ];
+}
+function unknownOptionNames(parsed, args) {
+  const known = /* @__PURE__ */ new Set(["_"]);
+  for (const [name, def] of Object.entries(args)) {
+    for (const variant of nameVariants(name)) known.add(variant);
+    const alias = def.alias;
+    for (const a of Array.isArray(alias) ? alias : alias ? [alias] : []) {
+      for (const variant of nameVariants(a)) known.add(variant);
+    }
+  }
+  return Object.keys(parsed).filter((key) => !known.has(key));
+}
+function unknownOptionNamesFromRaw(rawArgs2, args) {
+  const relaxedArgs = Object.fromEntries(
+    Object.entries(args).map(([name, definition]) => [
+      name,
+      definition.type === "enum" ? { ...definition, type: "string", required: false, options: void 0 } : { ...definition, required: false }
+    ])
+  );
+  return unknownOptionNames(parseArgs(rawArgs2, relaxedArgs), args);
+}
+function unknownOptionMessage(commandName, unknown, args) {
+  const valid = Object.entries(args).filter(([, definition]) => definition.type !== "positional").map(([name]) => name).sort().join(", ");
+  return `Unknown ${unknown.length === 1 ? "option" : "options"}: ${unknown.map((name) => `--${name}`).join(", ")}. \`${commandName}\` accepts: ${valid || "(none)"}.`;
+}
+function defineDeepspaceCommand(def) {
+  const declaredArgs = {
+    ...def.args ?? {},
+    json: {
+      type: "boolean",
+      description: def.jsonDescription ?? "Emit a single-line JSON result for scripts/agents",
+      default: false
+    }
+  };
+  return defineCommand({
+    meta: def.meta,
+    args: declaredArgs,
+    async run({ args }) {
+      const json = Boolean(args.json);
+      let succeeded = false;
+      try {
+        const unknown = unknownOptionNames(args, declaredArgs);
+        if (unknown.length > 0) {
+          throw new Refusal(
+            unknownOptionMessage(def.meta.name, unknown, declaredArgs),
+            "unknown_option"
+          );
+        }
+        const out = await def.run({
+          args
+        }) ?? {};
+        if (out.action) out.action = executableAction(out.action);
+        if (json) {
+          console.log(
+            JSON.stringify({
+              ok: true,
+              ...withoutReservedKeys(out.data ?? {}),
+              ...out.action ? { action: out.action } : {}
+            })
+          );
+        } else if (out.action) {
+          printAction(out.action);
+        }
+        succeeded = true;
+      } catch (err) {
+        stopActiveSpinner();
+        const refusal = err instanceof Refusal ? err : null;
+        const code = refusal?.code ?? errorCode(err);
+        const message = err instanceof Error ? err.message : String(err);
+        if (json) {
+          console.log(
+            JSON.stringify({
+              ok: false,
+              ...code ? { code } : {},
+              ...refusal?.actionRequired ? { actionRequired: true } : {},
+              error: message,
+              ...refusal?.action ? { action: refusal.action } : {},
+              ...withoutReservedKeys(refusal?.extra ?? apiErrorDetails(err) ?? {})
+            })
+          );
+        } else {
+          const line = code ? withSlug(message, code) : message;
+          if (refusal?.actionRequired) p3.log.warn(line);
+          else p3.log.error(line);
+          if (refusal?.action) printAction(refusal.action);
+        }
+        exitWhenFlushed(refusal?.actionRequired ? 2 : 1);
+      }
+      if (succeeded) exitWhenFlushed(0);
+    }
+  });
+}
+
 // src/cli/lib/command-suggestions.ts
 function splitTokenPath(token, table) {
   const parts = token.trim().split(/\s+/);
@@ -398,105 +543,6 @@ async function exchangeSession(authUrl, sessionToken) {
   return data.token ?? null;
 }
 
-// src/cli/lib/command.ts
-import { defineCommand } from "citty";
-import * as p3 from "@clack/prompts";
-var Refusal = class extends Error {
-  code;
-  action;
-  actionRequired;
-  extra;
-  constructor(message, code, opts = {}) {
-    super(message);
-    this.name = "Refusal";
-    this.code = code;
-    this.action = opts.action ? executableAction(opts.action) : void 0;
-    this.actionRequired = opts.actionRequired ?? false;
-    this.extra = opts.extra ?? {};
-  }
-};
-function apiErrorDetails(err) {
-  return err instanceof ApiError ? err.details : void 0;
-}
-function withoutReservedKeys(payload) {
-  return Object.fromEntries(
-    Object.entries(payload).filter(
-      ([key]) => ![
-        "ok",
-        "code",
-        "error",
-        "action",
-        "actionRequired",
-        "next",
-        "nextAction",
-        "resume"
-      ].includes(key)
-    )
-  );
-}
-function exitWhenFlushed(code) {
-  if (process.stdout.writableLength === 0) process.exit(code);
-  process.stdout.write("", () => process.exit(code));
-  return void 0;
-}
-function defineDeepspaceCommand(def) {
-  return defineCommand({
-    meta: def.meta,
-    args: {
-      ...def.args ?? {},
-      json: {
-        type: "boolean",
-        description: "Emit a single-line JSON result for scripts/agents",
-        default: false
-      }
-    },
-    async run({ args }) {
-      const json = Boolean(args.json);
-      let succeeded = false;
-      try {
-        const out = await def.run({ args }) ?? {};
-        if (out.action) out.action = executableAction(out.action);
-        if (json) {
-          console.log(
-            JSON.stringify({
-              ok: true,
-              ...withoutReservedKeys(out.data ?? {}),
-              ...out.action ? { action: out.action } : {}
-            })
-          );
-        } else if (out.action) {
-          printAction(out.action);
-        }
-        succeeded = true;
-      } catch (err) {
-        stopActiveSpinner();
-        const refusal = err instanceof Refusal ? err : null;
-        const code = refusal?.code ?? errorCode(err);
-        const message = err instanceof Error ? err.message : String(err);
-        if (json) {
-          console.log(
-            JSON.stringify({
-              ok: false,
-              ...code ? { code } : {},
-              ...refusal?.actionRequired ? { actionRequired: true } : {},
-              error: message,
-              ...refusal?.action ? { action: refusal.action } : {},
-              ...withoutReservedKeys(refusal?.extra ?? apiErrorDetails(err) ?? {})
-            })
-          );
-        } else {
-          const line = code ? withSlug(message, code) : message;
-          if (refusal?.actionRequired) p3.log.warn(line);
-          else p3.log.error(line);
-          if (refusal?.action) printAction(refusal.action);
-        }
-        exitWhenFlushed(refusal?.actionRequired ? 2 : 1);
-      }
-      if (succeeded) exitWhenFlushed(0);
-    }
-  });
-}
-
 // src/cli/auth.ts
 var AUTH_URL = process.env.DEEPSPACE_AUTH_URL ?? PLATFORM_URLS.auth;
 var PROD_AUTH_URL = "https://auth.deep.space";
@@ -1377,9 +1423,6 @@ function resolveWorktreePort(appDir) {
   return deriveWorktreePort(linked.worktreeRoot);
 }
 
-// src/cli/lib/dev-vars.ts
-import { existsSync as existsSync7, readFileSync as readFileSync10 } from "fs";
-
 // src/cli/lib/app-tokens.ts
 async function fetchPublicKey(authUrl) {
   const response = await fetch(`${authUrl}/api/auth/jwks`);
@@ -1429,1069 +1472,907 @@ async function fetchAppIdentityToken(deployUrl, callerJwt, appId) {
   return body.token;
 }
 
-// src/server/rooms/binding-manifest.ts
-var AUTO_PROVISION_SENTINEL = "auto";
-var VECTORIZE_METRICS = /* @__PURE__ */ new Set(["cosine", "euclidean", "dot-product"]);
-var ALLOWED_BINDING_TYPES = /* @__PURE__ */ new Set([
-  "vectorize",
-  "ai",
-  "r2_bucket",
-  "kv_namespace",
-  "d1",
-  "queue",
-  "browser_rendering",
-  "analytics_engine",
-  "hyperdrive",
-  "ratelimit"
-]);
-var RESERVED_BINDING_NAMES = /* @__PURE__ */ new Set([
-  "ASSETS",
-  "PLATFORM_WORKER",
-  "API_WORKER",
-  "DEEPSPACE_APP_ID",
-  "DEEPSPACE_RESOURCE_ID",
-  "DEEPSPACE_RELEASE_OPERATION_ID",
-  "APP_NAME",
-  "OWNER_USER_ID",
-  "AUTH_JWT_PUBLIC_KEY",
-  "AUTH_JWT_ISSUER",
-  "AUTH_WORKER_URL",
-  "APP_IDENTITY_TOKEN",
-  "APP_OWNER_JWT",
-  "USAGE_EVENTS"
-]);
-function validateBindingManifest(manifest) {
-  if (!Array.isArray(manifest)) {
-    return { valid: false, errors: [{ reason: "Manifest must be an array" }] };
-  }
-  const errors = [];
-  const seenNames = /* @__PURE__ */ new Set();
-  for (const entry of manifest) {
-    if (!entry || typeof entry !== "object") {
-      errors.push({
-        reason: `Entry must be an object (got ${entry === null ? "null" : typeof entry})`
-      });
-      continue;
-    }
-    const e = entry;
-    const type = e.type;
-    const name = e.name;
-    if (typeof type !== "string" || !ALLOWED_BINDING_TYPES.has(type)) {
-      errors.push({
-        reason: `Disallowed binding type: ${typeof type === "string" ? type : `(${typeof type})`}. Allowed: ${[...ALLOWED_BINDING_TYPES].sort().join(", ")}`
-      });
-      continue;
-    }
-    if (typeof name !== "string" || !name) {
-      errors.push({ reason: `Binding of type "${type}" missing 'name' (string)` });
-      continue;
-    }
-    if (RESERVED_BINDING_NAMES.has(name)) {
-      errors.push({ reason: `Binding name "${name}" is reserved by the SDK` });
-      continue;
-    }
-    if (seenNames.has(name)) {
-      errors.push({ reason: `Duplicate binding name "${name}"` });
-      continue;
-    }
-    seenNames.add(name);
-    const binding = entry;
-    const fieldErr = requiredFieldError(binding);
-    if (fieldErr) errors.push({ binding, reason: fieldErr });
-  }
-  if (errors.length) return { valid: false, errors };
-  return { valid: true, bindings: manifest };
-}
-function requiredFieldError(b) {
-  switch (b.type) {
-    case "vectorize": {
-      if (!b.index_name) return `vectorize binding "${b.name}" missing index_name (or "auto")`;
-      if (b.index_name === AUTO_PROVISION_SENTINEL) {
-        if (typeof b.dimensions !== "number" || b.dimensions <= 0) {
-          return `vectorize binding "${b.name}" with index_name="auto" requires "dimensions" (positive number)`;
-        }
-        if (!b.metric || !VECTORIZE_METRICS.has(b.metric)) {
-          return `vectorize binding "${b.name}" with index_name="auto" requires "metric" (one of: ${[...VECTORIZE_METRICS].join(", ")})`;
-        }
-      }
-      return null;
-    }
-    case "r2_bucket":
-      return b.bucket_name ? null : `r2_bucket binding "${b.name}" missing bucket_name (or "auto")`;
-    case "kv_namespace": {
-      if (!b.namespace_id)
-        return `kv_namespace binding "${b.name}" missing namespace_id (or "auto")`;
-      if (b.namespace_id === AUTO_PROVISION_SENTINEL && !b.title) {
-        return `kv_namespace binding "${b.name}" with namespace_id="auto" requires "title"`;
-      }
-      return null;
-    }
-    case "d1": {
-      if (!b.id) return `d1 binding "${b.name}" missing id (or "auto")`;
-      if (b.id === AUTO_PROVISION_SENTINEL && !b.database_name) {
-        return `d1 binding "${b.name}" with id="auto" requires "database_name"`;
-      }
-      return null;
-    }
-    case "queue":
-      return b.queue_name ? null : `queue binding "${b.name}" missing queue_name (or "auto")`;
-    case "hyperdrive":
-      if (!b.id) return `hyperdrive binding "${b.name}" missing id`;
-      if (b.id === AUTO_PROVISION_SENTINEL) {
-        return `hyperdrive binding "${b.name}": auto-provisioning not yet supported (provide a real id)`;
-      }
-      return null;
-    case "ratelimit":
-      if (!/^\d+$/u.test(b.namespace_id) || Number(b.namespace_id) <= 0) {
-        return `ratelimit binding "${b.name}" requires a positive integer namespace_id string`;
-      }
-      if (!Number.isInteger(b.simple?.limit) || b.simple.limit <= 0) {
-        return `ratelimit binding "${b.name}" requires simple.limit (positive integer)`;
-      }
-      if (b.simple.period !== 10 && b.simple.period !== 60) {
-        return `ratelimit binding "${b.name}" requires simple.period (10 or 60)`;
-      }
-      return null;
-    case "ai":
-    case "browser_rendering":
-    case "analytics_engine":
-      return null;
-    // no required fields beyond `name`
-    default: {
-      const _exhaustive = b;
-      void _exhaustive;
-      return null;
-    }
+// src/cli/lib/secure-file.ts
+import { chmodSync, writeFileSync as writeFileSync5 } from "fs";
+function writeSecretFileSync(path, content) {
+  writeFileSync5(path, content, { mode: 384 });
+  try {
+    chmodSync(path, 384);
+  } catch {
   }
 }
-function bindingManifestFromOutputConfig(outputConfig) {
-  const out = [];
-  const aiBinding = pluckString(outputConfig.ai, "binding");
-  if (aiBinding) out.push({ type: "ai", name: aiBinding });
-  for (const v of asObjectArray(outputConfig.vectorize)) {
-    const name = pluckString(v, "binding");
-    const index_name = pluckString(v, "index_name");
-    if (!name || !index_name) continue;
-    const dimensions = pluckNumber(v, "dimensions");
-    const metric = pluckString(v, "metric");
-    out.push({
-      type: "vectorize",
-      name,
-      index_name,
-      ...dimensions != null && { dimensions },
-      ...metric && (metric === "cosine" || metric === "euclidean" || metric === "dot-product") && { metric }
-    });
-  }
-  for (const r of asObjectArray(outputConfig.r2_buckets)) {
-    const name = pluckString(r, "binding");
-    const bucket_name = pluckString(r, "bucket_name");
-    if (name && bucket_name) out.push({ type: "r2_bucket", name, bucket_name });
-  }
-  for (const k of asObjectArray(outputConfig.kv_namespaces)) {
-    const name = pluckString(k, "binding");
-    const namespace_id = pluckString(k, "id");
-    if (!name || !namespace_id) continue;
-    const title = pluckString(k, "title");
-    out.push({
-      type: "kv_namespace",
-      name,
-      namespace_id,
-      ...title && { title }
-    });
-  }
-  for (const d of asObjectArray(outputConfig.d1_databases)) {
-    const name = pluckString(d, "binding");
-    const id = pluckString(d, "database_id");
-    if (!name || !id) continue;
-    const database_name = pluckString(d, "database_name");
-    out.push({
-      type: "d1",
-      name,
-      id,
-      ...database_name && { database_name }
-    });
+
+// src/cli/lib/wrangler-env.ts
+import { existsSync as existsSync6, readFileSync as readFileSync9, rmSync as rmSync2, writeFileSync as writeFileSync6 } from "fs";
+import { join as join7 } from "path";
+import { parse as parseToml3, stringify as stringifyToml } from "smol-toml";
+
+// src/server/rooms/app-name.ts
+var APP_NAME_RULES = {
+  /** ^[a-z0-9](-?[a-z0-9])+$ — RFC 1035 host label, no consecutive dashes. */
+  pattern: /^[a-z0-9](?:-?[a-z0-9])+$/,
+  minLength: 2,
+  maxLength: 63
+};
+function validateAppName(raw) {
+  if (typeof raw !== "string") {
+    return { valid: false, reason: "App name must be a string" };
   }
-  const queues = isObject(outputConfig.queues) ? outputConfig.queues : null;
-  for (const q of asObjectArray(queues?.producers)) {
-    const name = pluckString(q, "binding");
-    const queue_name = pluckString(q, "queue");
-    if (name && queue_name) out.push({ type: "queue", name, queue_name });
+  const name = raw.trim();
+  if (!name) {
+    return { valid: false, reason: "App name is required" };
   }
-  const browserBinding = pluckString(outputConfig.browser, "binding");
-  if (browserBinding) out.push({ type: "browser_rendering", name: browserBinding });
-  for (const a of asObjectArray(outputConfig.analytics_engine_datasets)) {
-    const name = pluckString(a, "binding");
-    const dataset = pluckString(a, "dataset");
-    if (name) out.push({ type: "analytics_engine", name, dataset: dataset ?? void 0 });
+  if (name.length < APP_NAME_RULES.minLength) {
+    return { valid: false, reason: `App name "${name}" is too short (min ${APP_NAME_RULES.minLength} chars)` };
   }
-  for (const h of asObjectArray(outputConfig.hyperdrive)) {
-    const name = pluckString(h, "binding");
-    const id = pluckString(h, "id");
-    if (name && id) out.push({ type: "hyperdrive", name, id });
+  if (name.length > APP_NAME_RULES.maxLength) {
+    return { valid: false, reason: `App name "${name}" is too long (max ${APP_NAME_RULES.maxLength} chars)` };
   }
-  for (const r of asObjectArray(outputConfig.ratelimits)) {
-    const name = pluckString(r, "name");
-    const namespace_id = pluckString(r, "namespace_id");
-    const simple = isObject(r.simple) ? r.simple : null;
-    const limit = pluckNumber(simple, "limit");
-    const period = pluckNumber(simple, "period");
-    if (!name || !namespace_id || limit === null || period !== 10 && period !== 60) continue;
-    out.push({ type: "ratelimit", name, namespace_id, simple: { limit, period } });
+  if (!APP_NAME_RULES.pattern.test(name)) {
+    return {
+      valid: false,
+      reason: `App name "${name}" is invalid. Use lowercase letters, digits, and single hyphens only (must start + end with alphanumeric). Examples: my-app, search-v2, unison-search.`
+    };
   }
-  return out;
-}
-function isObject(v) {
-  return v !== null && typeof v === "object" && !Array.isArray(v);
-}
-function pluckString(v, key) {
-  if (!isObject(v)) return null;
-  const val = v[key];
-  return typeof val === "string" && val.length > 0 ? val : null;
+  return { valid: true, name };
 }
-function pluckNumber(v, key) {
-  if (!isObject(v)) return null;
-  const val = v[key];
-  return typeof val === "number" && Number.isFinite(val) ? val : null;
+function resolveAppName(raw) {
+  const strict = validateAppName(raw);
+  if (strict.valid) return { ok: true, name: strict.name };
+  if (typeof raw !== "string") return { ok: false, reason: strict.reason };
+  const trimmed = raw.trim();
+  if (!trimmed) return { ok: false, reason: "App name is required" };
+  const sanitized = sanitizeAppName(trimmed);
+  const sanitizedStrict = validateAppName(sanitized);
+  if (!sanitizedStrict.valid) {
+    return {
+      ok: false,
+      reason: `App name "${trimmed}" can't be sanitized into a valid name (${sanitizedStrict.reason}). Pick something matching: lowercase letters, digits, single hyphens, ${APP_NAME_RULES.minLength}-${APP_NAME_RULES.maxLength} chars.`
+    };
+  }
+  return {
+    ok: true,
+    name: sanitized,
+    warning: `App name "${trimmed}" doesn't conform to deploy rules \u2014 using "${sanitized}" instead. Update wrangler.toml's \`name\` to silence this warning.`
+  };
 }
-function asObjectArray(v) {
-  if (!Array.isArray(v)) return [];
-  return v.filter(isObject);
+function sanitizeAppName(raw) {
+  return raw.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-{2,}/g, "-").replace(/^-+|-+$/g, "");
 }
 
-// src/cli/lib/secrets.ts
-var GENERATED_SECRETS_DIVIDER = "# --- DeepSpace secrets cache: generated by `npx deepspace secrets`; do not edit manually ---";
-var RESERVED_SECRET_NAMES = /* @__PURE__ */ new Set([
-  ...RESERVED_BINDING_NAMES,
-  "API_WORKER_URL",
-  "PLATFORM_WORKER_URL"
+// src/cli/lib/wrangler-env.ts
+var NON_INHERITABLE_ENV_KEYS = /* @__PURE__ */ new Set([
+  "define",
+  "vars",
+  "durable_objects",
+  "kv_namespaces",
+  "r2_buckets",
+  "ai_search_namespaces",
+  "ai_search",
+  "ratelimits",
+  "vectorize",
+  "services",
+  "queues",
+  "workflows",
+  "tail_consumers",
+  "secrets",
+  "secrets_store_secrets"
 ]);
-var SECRET_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
-var CONFIG_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
-var MAX_SECRET_VALUE_BYTES = 32 * 1024;
-function validateConfigName(configName) {
-  if (!CONFIG_NAME_RE.test(configName)) {
-    throw new Error(
-      `Invalid config "${configName}". Use letters, numbers, underscores, or hyphens; start with a letter or number.`
-    );
+var generatedConfigSeq = 0;
+function resolveAppNameForEnv(config, envName) {
+  if (!envName) {
+    return resolveAppName(config.name);
   }
-  return configName;
-}
-function validateSecretName(name) {
-  if (!SECRET_NAME_RE.test(name)) {
-    throw new Error(
-      `Invalid secret name "${name}". Use letters, numbers, and underscores; start with a letter or underscore.`
-    );
+  const envBlock = config.env?.[envName];
+  if (!envBlock) {
+    return {
+      ok: false,
+      reason: `wrangler.toml: no [env.${envName}] block found. Add one with a distinct \`name\` to deploy this environment.`
+    };
   }
-  if (RESERVED_SECRET_NAMES.has(name)) {
-    throw new Error(
-      `"${name}" is managed by the DeepSpace SDK and can't be set as an app secret \u2014 the platform injects it at deploy time.`
-    );
+  if (typeof envBlock.name !== "string" || envBlock.name.trim() === "") {
+    return {
+      ok: false,
+      reason: `wrangler.toml: [env.${envName}].name is missing. Set a distinct app name (e.g. "${typeof config.name === "string" ? config.name : "myapp"}-${envName}") so this environment doesn't overwrite the default.`
+    };
   }
-  return name;
-}
-function validateSecretValue(key, value) {
-  if (new TextEncoder().encode(value).byteLength > MAX_SECRET_VALUE_BYTES) {
-    throw new Error(`Secret "${key}" exceeds ${MAX_SECRET_VALUE_BYTES} bytes`);
+  if (envBlock.name === config.name) {
+    return {
+      ok: false,
+      reason: `wrangler.toml: [env.${envName}].name "${envBlock.name}" is the same as the top-level name. Pick a distinct name (e.g. "${config.name}-${envName}") so deploys don't collide.`
+    };
   }
+  return resolveAppName(envBlock.name);
 }
-function defaultConfigNameForEnv(wranglerEnv) {
-  return wranglerEnv ?? "prd";
+function devVarsPathFor(appDir) {
+  return join7(appDir, ".dev.vars");
 }
-async function secretsApi(deployUrl, token, path, init = {}) {
-  const res = await fetch(`${deployUrl}/api/secrets${path}`, {
-    ...init,
-    headers: {
-      Authorization: `Bearer ${token}`,
-      "Content-Type": "application/json",
-      ...init.headers ?? {}
+function prepareWranglerEnvConfig(appDir, envName) {
+  if (!envName) return { cleanup() {
+  } };
+  const config = readWranglerConfig(appDir);
+  const resolved = resolveAppNameForEnv(config, envName);
+  if (!resolved.ok) throw new Error(resolved.reason);
+  const flattened = flattenWranglerEnvConfig(config, envName);
+  const configPath = join7(
+    appDir,
+    `.wrangler.deepspace.${safeGeneratedConfigSegment(envName)}.${process.pid}.${++generatedConfigSeq}.toml`
+  );
+  writeFileSync6(
+    configPath,
+    [
+      "# Generated by DeepSpace for this CLI run.",
+      "# Do not edit; wrangler.toml remains the source of truth.",
+      stringifyToml(flattened)
+    ].join("\n").replace(/\s*$/u, "\n")
+  );
+  return {
+    configPath,
+    cleanup() {
+      rmSync2(configPath, { force: true });
     }
-  });
-  const body = await res.json().catch(() => ({}));
-  if (!res.ok) {
-    const err = new Error(body.error ?? `Secrets request failed (${res.status})`);
-    err.status = res.status;
-    err.apiPath = path;
-    throw err;
+  };
+}
+function wranglerViteEnv(baseEnv, prepared, extraEnv = {}) {
+  const env = { ...baseEnv, ...extraEnv };
+  if (prepared.configPath) {
+    delete env.CLOUDFLARE_ENV;
+    env.CLOUDFLARE_VITE_WRANGLER_CONFIG_PATH = prepared.configPath;
   }
-  return body;
+  return env;
 }
-function listSecrets(deployUrl, token, appId, configName) {
-  return secretsApi(deployUrl, token, `/${appId}/configs/${encodeURIComponent(configName)}`);
+function flattenWranglerEnvConfig(config, envName) {
+  const envRoot = asTomlRecord(config.env);
+  const envBlock = asTomlRecord(envRoot?.[envName]);
+  if (!envBlock) {
+    throw new Error(`wrangler.toml: no [env.${envName}] block found.`);
+  }
+  const flattened = {};
+  for (const [key, value] of Object.entries(config)) {
+    if (key === "env" || NON_INHERITABLE_ENV_KEYS.has(key)) continue;
+    flattened[key] = value;
+  }
+  for (const [key, value] of Object.entries(envBlock)) {
+    flattened[key] = value;
+  }
+  if (!("durable_objects" in envBlock) && config.durable_objects) {
+    flattened.durable_objects = config.durable_objects;
+  }
+  const envVars = asTomlRecord(envBlock.vars) ?? {};
+  if (!("APP_NAME" in envVars) && typeof envBlock.name === "string") {
+    flattened.vars = { ...envVars, APP_NAME: envBlock.name };
+  }
+  return flattened;
 }
-function fetchSecretsValues(deployUrl, token, appId, configName) {
-  return secretsApi(deployUrl, token, `/${appId}/configs/${encodeURIComponent(configName)}/values`);
+function asTomlRecord(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
-function getSecretPlain(deployUrl, token, appId, configName, key) {
-  return secretsApi(
-    deployUrl,
-    token,
-    `/${appId}/configs/${encodeURIComponent(configName)}/secrets/${encodeURIComponent(key)}?plain=true`
-  );
+function safeGeneratedConfigSegment(value) {
+  return value.replace(/[^A-Za-z0-9._-]/gu, "_");
 }
-function setSecret(deployUrl, token, appId, configName, key, value) {
-  return secretsApi(
-    deployUrl,
-    token,
-    `/${appId}/configs/${encodeURIComponent(configName)}/secrets/${encodeURIComponent(key)}`,
-    { method: "PUT", body: JSON.stringify({ value }) }
-  );
+var WranglerConfigError = class extends Error {
+  constructor(path, cause) {
+    const detail = cause instanceof Error ? cause.message : String(cause);
+    super(`wrangler.toml: malformed TOML at ${path}: ${detail}`);
+    this.path = path;
+    this.cause = cause;
+    this.name = "WranglerConfigError";
+  }
+};
+function readWranglerConfig(appDir) {
+  const path = join7(appDir, "wrangler.toml");
+  const raw = readFileSync9(path, "utf-8");
+  try {
+    return parseToml3(raw);
+  } catch (err) {
+    throw new WranglerConfigError(path, err);
+  }
 }
-function deleteSecret(deployUrl, token, appId, configName, key) {
-  return secretsApi(
-    deployUrl,
-    token,
-    `/${appId}/configs/${encodeURIComponent(configName)}/secrets/${encodeURIComponent(key)}`,
-    { method: "DELETE" }
-  );
+function hasWranglerConfig(appDir) {
+  return existsSync6(join7(appDir, "wrangler.toml"));
 }
-function uploadSecrets(deployUrl, token, appId, configName, secrets, replace) {
-  return secretsApi(
-    deployUrl,
-    token,
-    `/${appId}/configs/${encodeURIComponent(configName)}/secrets`,
-    { method: "PUT", body: JSON.stringify({ secrets, replace }) }
+
+// src/cli/lib/dev-vars.ts
+var HEADER = [
+  "# Generated by deepspace \u2014 do not edit; this file is rewritten on every",
+  "# dev, test, deploy, and secrets pull run. App values live in the secret store:",
+  "#   npx deepspace secrets set KEY=value"
+].join("\n");
+function requireAppIdFor(appDir, wranglerEnv) {
+  const id = readAppId(appDir, wranglerEnv);
+  if (id) return id;
+  throw new Error(
+    "wrangler.toml has no DEEPSPACE_APP_ID" + (wranglerEnv ? ` for [env.${wranglerEnv}]` : "") + ". Run `deepspace app init` (or `deepspace app init --env <name>`) and retry."
   );
 }
-function listConfigs(deployUrl, token, appId) {
-  return secretsApi(deployUrl, token, `/${appId}/configs`);
-}
-function createConfig(deployUrl, token, appId, configName, copyFrom) {
-  return secretsApi(deployUrl, token, `/${appId}/configs`, {
-    method: "POST",
-    body: JSON.stringify({ name: configName, ...copyFrom ? { copyFrom } : {} })
-  });
-}
-function deleteConfig(deployUrl, token, appId, configName) {
-  return secretsApi(deployUrl, token, `/${appId}/configs/${encodeURIComponent(configName)}`, {
-    method: "DELETE"
-  });
+async function writeDevVars(appDir, ownerId, callerJwt, wranglerEnv, opts = {}) {
+  const urls = PLATFORM_URLS;
+  const publicKey = await fetchPublicKey(urls.auth);
+  const appId = opts.appId ?? requireAppIdFor(appDir, wranglerEnv);
+  const appOwnerJwt = await mintAppOwnerJwt(urls.auth, callerJwt, appId);
+  const appIdentityToken = await fetchAppIdentityToken(urls.deploy, callerJwt, appId);
+  const sdkVars = [
+    `AUTH_JWT_PUBLIC_KEY="${publicKey}"`,
+    `AUTH_JWT_ISSUER=${urls.auth}/api/auth`,
+    `AUTH_WORKER_URL=${urls.auth}`,
+    `API_WORKER_URL=${urls.api}`,
+    `PLATFORM_WORKER_URL=${urls.platform}`,
+    `OWNER_USER_ID=${ownerId}`,
+    `APP_OWNER_JWT=${appOwnerJwt}`,
+    ...appIdentityToken ? [`APP_IDENTITY_TOKEN=${appIdentityToken}`] : [],
+    `ALLOW_DEBUG_ROUTES=true`
+  ].join("\n");
+  const devVarsPath = devVarsPathFor(appDir);
+  const cache = opts.generatedSecretsCache;
+  writeSecretFileSync(
+    devVarsPath,
+    [HEADER, "", sdkVars, ...cache ? ["", cache] : [], ""].join("\n")
+  );
 }
-async function pullAppSecretsCache(deployUrl, token, appId, configName) {
+
+// src/cli/lib/install-status.ts
+import { existsSync as existsSync8, readFileSync as readFileSync11, realpathSync as realpathSync3 } from "fs";
+import { dirname as dirname5, join as join9, resolve as resolve6 } from "path";
+
+// src/cli/lib/package-manager.ts
+import { existsSync as existsSync7, readFileSync as readFileSync10 } from "fs";
+import { join as join8 } from "path";
+function detectPackageManager(appDir) {
   try {
-    const { secrets } = await fetchSecretsValues(deployUrl, token, appId, configName);
-    if (secrets === null || typeof secrets !== "object" || Array.isArray(secrets)) {
-      throw new ApiError(
-        `The secrets service at ${deployUrl} returned an unexpected response shape \u2014 check DEEPSPACE_DEPLOY_URL (is this the service the app lives on?).`,
-        200,
-        "invalid_response",
-        `/${appId}/configs/${configName}/values`
-      );
-    }
-    return { appId, configName, values: secrets };
-  } catch (err) {
-    if (err?.status === 404) return null;
-    throw err;
+    const pkg2 = JSON.parse(readFileSync10(join8(appDir, "package.json"), "utf-8"));
+    const name = typeof pkg2.packageManager === "string" ? pkg2.packageManager.split("@")[0] : "";
+    if (name === "npm" || name === "pnpm" || name === "yarn" || name === "bun") return name;
+  } catch {
   }
+  if (existsSync7(join8(appDir, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync7(join8(appDir, "yarn.lock"))) return "yarn";
+  if (existsSync7(join8(appDir, "bun.lock")) || existsSync7(join8(appDir, "bun.lockb"))) return "bun";
+  return "npm";
 }
-function quoteDotenvValue(value) {
-  if (/^[A-Za-z0-9_./:@+-]*$/.test(value) && value !== "") return value;
-  const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r");
-  return `"${escaped}"`;
+function installCommand(appDir) {
+  return `${detectPackageManager(appDir)} install`;
 }
-function renderSecretsCache(secrets, source) {
-  const keys = Object.keys(secrets).sort();
-  const lines = [
-    GENERATED_SECRETS_DIVIDER,
-    `# app ${source.appId} \xB7 config ${source.configName}`,
-    "# Use `npx deepspace secrets` to change these values."
-  ];
-  for (const key of keys) {
-    validateSecretValue(key, secrets[key]);
-    lines.push(`${key}=${quoteDotenvValue(secrets[key])}`);
+
+// src/cli/lib/install-status.ts
+function installState(appDir) {
+  if (resolvesDeepspace(appDir)) return "ready";
+  const sentinelDir = join9(appDir, ".deepspace");
+  if (existsSync8(join9(sentinelDir, "install.err"))) return "failed";
+  if (existsSync8(join9(sentinelDir, "install.started"))) {
+    if (!existsSync8(join9(sentinelDir, "install.done")) && installWorkerAlive(sentinelDir)) {
+      return "installing";
+    }
+    return "failed";
   }
-  return lines.join("\n");
+  return "missing";
 }
-function stripGeneratedSecretsCache(content) {
-  const idx = content.indexOf(GENERATED_SECRETS_DIVIDER);
-  if (idx === -1) return content;
-  return content.slice(0, idx).trimEnd() + "\n";
+function tailHint(logPath, platform = process.platform) {
+  return platform === "win32" ? `Get-Content -Wait ${logPath}` : `tail -f ${logPath}`;
 }
-function parseSecretsUpload(content) {
-  const trimmed = content.trim();
-  if (!trimmed) return {};
-  if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
-    const parsed = JSON.parse(trimmed);
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-      throw new Error("JSON upload must be an object of KEY=value strings.");
-    }
-    const out2 = {};
-    for (const [key, value] of Object.entries(parsed)) {
-      validateSecretName(key);
-      if (typeof value !== "string") throw new Error(`Secret "${key}" must be a string`);
-      validateSecretValue(key, value);
-      out2[key] = value;
-    }
-    return out2;
+function ensureInstallReady(appDir) {
+  if (resolvesDeepspace(appDir)) return;
+  const sentinelDir = join9(appDir, ".deepspace");
+  const errPath = join9(sentinelDir, "install.err");
+  const startedPath = join9(sentinelDir, "install.started");
+  const donePath = join9(sentinelDir, "install.done");
+  const logPath = join9(sentinelDir, "install.log");
+  if (existsSync8(errPath)) {
+    const detail = readFileSync11(errPath, "utf-8").trimEnd();
+    const log29 = existsSync8(logPath) ? ` Full log: ${logPath}.` : "";
+    throw new Refusal(
+      `Dependency install failed: ${detail}.${log29} Run \`npm install\` (or \`bun install\`) manually, then retry.`,
+      "install_failed",
+      { action: { cwd: appDir, argv: [detectPackageManager(appDir), "install"] } }
+    );
   }
-  const out = {};
-  const lines = trimmed.split(/\r?\n/);
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i].trim();
-    if (!line || line.startsWith("#")) continue;
-    const eq = line.indexOf("=");
-    if (eq <= 0) continue;
-    const key = line.slice(0, eq).trim();
-    if (!SECRET_NAME_RE.test(key)) continue;
-    validateSecretName(key);
-    const raw = line.slice(eq + 1).trim();
-    const quote = raw[0] === '"' || raw[0] === "'" ? raw[0] : null;
-    let value;
-    if (!quote) {
-      value = raw;
-    } else if (endsWithUnescapedQuote(raw.slice(1), quote)) {
-      const inner = raw.slice(1, -1);
-      value = quote === '"' ? unescapeDotenv(inner) : inner;
-    } else {
-      const startLine = i + 1;
-      const parts = [raw.slice(1)];
-      let closed = false;
-      while (++i < lines.length) {
-        const cont = lines[i].trimEnd();
-        if (endsWithUnescapedQuote(cont, quote)) {
-          parts.push(cont.slice(0, -1));
-          closed = true;
-          break;
-        }
-        parts.push(lines[i]);
-      }
-      if (!closed) {
-        throw new Error(
-          `Unterminated quoted value for "${key}" (opens on line ${startLine}). Close the ${quote === '"' ? "double" : "single"} quote, or escape newlines as \\n on one line.`
-        );
-      }
-      value = parts.join("\n");
-      if (quote === '"') value = unescapeDotenv(value);
+  if (existsSync8(startedPath) && !existsSync8(donePath)) {
+    if (!installWorkerAlive(sentinelDir)) {
+      const log29 = existsSync8(logPath) ? ` See what happened: ${logPath}.` : "";
+      throw new Refusal(
+        `The dependency install is no longer running and never finished.${log29} Run \`npm install\` (or \`bun install\`) manually, then retry.`,
+        "install_failed",
+        { action: { cwd: appDir, argv: [detectPackageManager(appDir), "install"] } }
+      );
     }
-    validateSecretValue(key, value);
-    out[key] = value;
+    const tail = existsSync8(logPath) ? ` Tail progress: ${tailHint(logPath)}.` : "";
+    throw new Refusal(
+      `Dependencies are still installing.${tail} Retry once it finishes.`,
+      "install_in_progress"
+    );
   }
-  return out;
-}
-function endsWithUnescapedQuote(s, q) {
-  if (!s.endsWith(q)) return false;
-  if (q === "'") return true;
-  let backslashes = 0;
-  for (let j = s.length - 2; j >= 0 && s[j] === "\\"; j--) backslashes++;
-  return backslashes % 2 === 0;
-}
-function unescapeDotenv(v) {
-  let out = "";
-  for (let i = 0; i < v.length; i++) {
-    if (v[i] === "\\" && i + 1 < v.length) {
-      const c = v[++i];
-      out += c === "n" ? "\n" : c === "r" ? "\r" : c;
-    } else {
-      out += v[i];
+  throw new Refusal(
+    "Dependencies not installed. Run `npm install` (or `bun install`) first.",
+    "deps_missing",
+    {
+      action: { cwd: appDir, argv: [detectPackageManager(appDir), "install"] }
     }
-  }
-  return out;
-}
-function shellSingleQuote(value) {
-  return `'${value.replace(/'/g, "'\\''")}'`;
+  );
 }
-function formatSecretsDownload(secrets, format) {
-  const entries = Object.entries(secrets).sort(([a], [b]) => a.localeCompare(b));
-  if (format === "json") {
-    return JSON.stringify(Object.fromEntries(entries), null, 2) + "\n";
+function resolvesDeepspace(fromDir) {
+  let dir = canonicalPath2(fromDir);
+  let checkoutRoot = null;
+  try {
+    checkoutRoot = canonicalPath2(repoToplevel(dir));
+  } catch {
   }
-  if (format === "shell") {
-    return entries.map(([k, v]) => `export ${k}=${shellSingleQuote(v)}`).join("\n") + "\n";
+  for (; ; ) {
+    if (existsSync8(join9(dir, "node_modules", "deepspace", "package.json"))) return true;
+    if (dir === checkoutRoot) return false;
+    const parent = dirname5(dir);
+    if (parent === dir) return false;
+    dir = parent;
   }
-  return entries.map(([k, v]) => `${k}=${quoteDotenvValue(v)}`).join("\n") + "\n";
-}
-async function refreshSecretsCache(deployUrl, token, appId, wranglerEnv) {
-  const configName = defaultConfigNameForEnv(wranglerEnv);
-  const pulled = await pullAppSecretsCache(deployUrl, token, appId, configName);
-  if (!pulled) return null;
-  const count = Object.keys(pulled.values).length;
-  return {
-    pulled,
-    rendered: renderSecretsCache(pulled.values, pulled),
-    // An empty store is the common case and not worth a status line.
-    summary: count ? `Secrets: ${pulled.configName} (${count} secret${count === 1 ? "" : "s"})` : null
-  };
 }
-
-// src/cli/lib/secure-file.ts
-import { chmodSync, writeFileSync as writeFileSync5 } from "fs";
-function writeSecretFileSync(path, content) {
-  writeFileSync5(path, content, { mode: 384 });
+function canonicalPath2(path) {
   try {
-    chmodSync(path, 384);
+    return realpathSync3(path);
   } catch {
+    return resolve6(path);
   }
 }
-
-// src/cli/lib/wrangler-env.ts
-import { existsSync as existsSync6, readFileSync as readFileSync9, rmSync as rmSync2, writeFileSync as writeFileSync6 } from "fs";
-import { join as join7 } from "path";
-import { parse as parseToml3, stringify as stringifyToml } from "smol-toml";
-
-// src/server/rooms/app-name.ts
-var APP_NAME_RULES = {
-  /** ^[a-z0-9](-?[a-z0-9])+$ — RFC 1035 host label, no consecutive dashes. */
-  pattern: /^[a-z0-9](?:-?[a-z0-9])+$/,
-  minLength: 2,
-  maxLength: 63
-};
-function validateAppName(raw) {
-  if (typeof raw !== "string") {
-    return { valid: false, reason: "App name must be a string" };
-  }
-  const name = raw.trim();
-  if (!name) {
-    return { valid: false, reason: "App name is required" };
-  }
-  if (name.length < APP_NAME_RULES.minLength) {
-    return { valid: false, reason: `App name "${name}" is too short (min ${APP_NAME_RULES.minLength} chars)` };
-  }
-  if (name.length > APP_NAME_RULES.maxLength) {
-    return { valid: false, reason: `App name "${name}" is too long (max ${APP_NAME_RULES.maxLength} chars)` };
-  }
-  if (!APP_NAME_RULES.pattern.test(name)) {
-    return {
-      valid: false,
-      reason: `App name "${name}" is invalid. Use lowercase letters, digits, and single hyphens only (must start + end with alphanumeric). Examples: my-app, search-v2, unison-search.`
-    };
+function installWorkerAlive(sentinelDir) {
+  const pidPath = join9(sentinelDir, "install.pid");
+  if (!existsSync8(pidPath)) return false;
+  const pid = Number(readFileSync11(pidPath, "utf-8").trim());
+  if (!Number.isSafeInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err.code === "EPERM";
   }
-  return { valid: true, name };
 }
-function resolveAppName(raw) {
-  const strict = validateAppName(raw);
-  if (strict.valid) return { ok: true, name: strict.name };
-  if (typeof raw !== "string") return { ok: false, reason: strict.reason };
-  const trimmed = raw.trim();
-  if (!trimmed) return { ok: false, reason: "App name is required" };
-  const sanitized = sanitizeAppName(trimmed);
-  const sanitizedStrict = validateAppName(sanitized);
-  if (!sanitizedStrict.valid) {
-    return {
-      ok: false,
-      reason: `App name "${trimmed}" can't be sanitized into a valid name (${sanitizedStrict.reason}). Pick something matching: lowercase letters, digits, single hyphens, ${APP_NAME_RULES.minLength}-${APP_NAME_RULES.maxLength} chars.`
-    };
+
+// src/cli/lib/preflight.ts
+import { execFileSync } from "child_process";
+import { existsSync as existsSync9 } from "fs";
+import * as nodeModule from "module";
+import { resolve as resolve7 } from "path";
+function preflightNodeVersion(command, hasRegisterHooks = typeof nodeModule.registerHooks === "function", version = process.versions.node) {
+  const [major, minor] = version.split(".").map(Number);
+  const supportedLine = major === 22 && minor >= 15 || major === 24 || major === 26;
+  if (hasRegisterHooks && supportedLine) return;
+  throw new Refusal(
+    `deepspace ${command} requires a supported Node release: 22.15+, 24, or 26 (found v${version}). Install the current LTS from https://nodejs.org and re-run.`,
+    supportedLine ? "node_capability_missing" : "node_unsupported"
+  );
+}
+var DLL_NOT_FOUND = -1073741515;
+function preflightWindowsWorkerd(appDir) {
+  if (process.platform !== "win32") return;
+  const workerdExe = resolve7(
+    appDir,
+    "node_modules",
+    "@cloudflare",
+    "workerd-windows-64",
+    "bin",
+    "workerd.exe"
+  );
+  if (!existsSync9(workerdExe)) return;
+  try {
+    execFileSync(workerdExe, ["--help"], { stdio: "pipe", timeout: 1e4 });
+    return;
+  } catch (err) {
+    const status3 = err.status;
+    if (status3 !== DLL_NOT_FOUND) return;
+    throw new Refusal(
+      "workerd (Cloudflare Workers runtime) cannot start on this system: it needs the Microsoft Visual C++ Redistributable, which is not installed. Install it with `winget install Microsoft.VCRedist.2015+.x64` (or choco install -y vcredist140, or https://aka.ms/vs/17/release/vc_redist.x64.exe), then restart this terminal and re-run.",
+      "vcredist_missing"
+    );
   }
-  return {
-    ok: true,
-    name: sanitized,
-    warning: `App name "${trimmed}" doesn't conform to deploy rules \u2014 using "${sanitized}" instead. Update wrangler.toml's \`name\` to silence this warning.`
-  };
 }
-function sanitizeAppName(raw) {
-  return raw.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-{2,}/g, "-").replace(/^-+|-+$/g, "");
+
+// src/cli/lib/macos-junk.ts
+import { readdirSync as readdirSync2, rmSync as rmSync3 } from "fs";
+import { join as join10 } from "path";
+var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", ".wrangler", ".vite"]);
+function removeMacosJunk(dir) {
+  let removed = 0;
+  let entries;
+  try {
+    entries = readdirSync2(dir, { withFileTypes: true });
+  } catch {
+    return removed;
+  }
+  for (const entry of entries) {
+    const path = join10(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (!SKIP_DIRS.has(entry.name)) removed += removeMacosJunk(path);
+      continue;
+    }
+    if (entry.name === ".DS_Store" || entry.name.startsWith("._")) {
+      try {
+        rmSync3(path, { force: true });
+        removed++;
+      } catch {
+      }
+    }
+  }
+  return removed;
 }
 
-// src/cli/lib/wrangler-env.ts
-var NON_INHERITABLE_ENV_KEYS = /* @__PURE__ */ new Set([
-  "define",
-  "vars",
-  "durable_objects",
-  "kv_namespaces",
-  "r2_buckets",
-  "ai_search_namespaces",
-  "ai_search",
-  "ratelimits",
+// src/server/rooms/binding-manifest.ts
+var AUTO_PROVISION_SENTINEL = "auto";
+var VECTORIZE_METRICS = /* @__PURE__ */ new Set(["cosine", "euclidean", "dot-product"]);
+var ALLOWED_BINDING_TYPES = /* @__PURE__ */ new Set([
   "vectorize",
-  "services",
-  "queues",
-  "workflows",
-  "tail_consumers",
-  "secrets",
-  "secrets_store_secrets"
+  "ai",
+  "r2_bucket",
+  "kv_namespace",
+  "d1",
+  "queue",
+  "browser_rendering",
+  "analytics_engine",
+  "hyperdrive",
+  "ratelimit"
 ]);
-var generatedConfigSeq = 0;
-function resolveAppNameForEnv(config, envName) {
-  if (!envName) {
-    return resolveAppName(config.name);
-  }
-  const envBlock = config.env?.[envName];
-  if (!envBlock) {
-    return {
-      ok: false,
-      reason: `wrangler.toml: no [env.${envName}] block found. Add one with a distinct \`name\` to deploy this environment.`
-    };
-  }
-  if (typeof envBlock.name !== "string" || envBlock.name.trim() === "") {
-    return {
-      ok: false,
-      reason: `wrangler.toml: [env.${envName}].name is missing. Set a distinct app name (e.g. "${typeof config.name === "string" ? config.name : "myapp"}-${envName}") so this environment doesn't overwrite the default.`
-    };
+var RESERVED_BINDING_NAMES = /* @__PURE__ */ new Set([
+  "ASSETS",
+  "PLATFORM_WORKER",
+  "API_WORKER",
+  "DEEPSPACE_APP_ID",
+  "DEEPSPACE_RESOURCE_ID",
+  "DEEPSPACE_RELEASE_OPERATION_ID",
+  "APP_NAME",
+  "OWNER_USER_ID",
+  "AUTH_JWT_PUBLIC_KEY",
+  "AUTH_JWT_ISSUER",
+  "AUTH_WORKER_URL",
+  "APP_IDENTITY_TOKEN",
+  "APP_OWNER_JWT",
+  "USAGE_EVENTS"
+]);
+function validateBindingManifest(manifest) {
+  if (!Array.isArray(manifest)) {
+    return { valid: false, errors: [{ reason: "Manifest must be an array" }] };
   }
-  if (envBlock.name === config.name) {
-    return {
-      ok: false,
-      reason: `wrangler.toml: [env.${envName}].name "${envBlock.name}" is the same as the top-level name. Pick a distinct name (e.g. "${config.name}-${envName}") so deploys don't collide.`
-    };
+  const errors = [];
+  const seenNames = /* @__PURE__ */ new Set();
+  for (const entry of manifest) {
+    if (!entry || typeof entry !== "object") {
+      errors.push({
+        reason: `Entry must be an object (got ${entry === null ? "null" : typeof entry})`
+      });
+      continue;
+    }
+    const e = entry;
+    const type = e.type;
+    const name = e.name;
+    if (typeof type !== "string" || !ALLOWED_BINDING_TYPES.has(type)) {
+      errors.push({
+        reason: `Disallowed binding type: ${typeof type === "string" ? type : `(${typeof type})`}. Allowed: ${[...ALLOWED_BINDING_TYPES].sort().join(", ")}`
+      });
+      continue;
+    }
+    if (typeof name !== "string" || !name) {
+      errors.push({ reason: `Binding of type "${type}" missing 'name' (string)` });
+      continue;
+    }
+    if (RESERVED_BINDING_NAMES.has(name)) {
+      errors.push({ reason: `Binding name "${name}" is reserved by the SDK` });
+      continue;
+    }
+    if (seenNames.has(name)) {
+      errors.push({ reason: `Duplicate binding name "${name}"` });
+      continue;
+    }
+    seenNames.add(name);
+    const binding = entry;
+    const fieldErr = requiredFieldError(binding);
+    if (fieldErr) errors.push({ binding, reason: fieldErr });
   }
-  return resolveAppName(envBlock.name);
-}
-function devVarsPathFor(appDir, envName, opts = {}) {
-  if (opts.sharedDevVarsCache || !envName) return join7(appDir, ".dev.vars");
-  return join7(appDir, `.dev.vars.${envName}`);
-}
-function legacyEnvDevVarsPathFor(appDir, envName) {
-  return envName ? join7(appDir, `.dev.vars.${envName}`) : void 0;
-}
-function warnIfLegacyEnvDevVarsExists(appDir, envName, warn = console.warn) {
-  const legacyPath = legacyEnvDevVarsPathFor(appDir, envName);
-  if (!legacyPath || !existsSync6(legacyPath)) return;
-  warn(
-    `Warning: ${legacyPath} exists, but DeepSpace now uses ${devVarsPathFor(appDir, envName, { sharedDevVarsCache: true })} for every environment. This run will ignore ${legacyPath}; move any secrets you still need into .dev.vars, then remove the env-specific file when you're ready.`
-  );
+  if (errors.length) return { valid: false, errors };
+  return { valid: true, bindings: manifest };
 }
-function prepareWranglerEnvConfig(appDir, envName, opts = {}) {
-  if (!envName) return { cleanup() {
-  } };
-  if (!opts.sharedDevVarsCache) return { wranglerEnv: envName, cleanup() {
-  } };
-  warnIfLegacyEnvDevVarsExists(appDir, envName, opts.warn);
-  const config = readWranglerConfig(appDir);
-  const resolved = resolveAppNameForEnv(config, envName);
-  if (!resolved.ok) throw new Error(resolved.reason);
-  const flattened = flattenWranglerEnvConfig(config, envName);
-  const configPath = join7(
-    appDir,
-    `.wrangler.deepspace.${safeGeneratedConfigSegment(envName)}.${process.pid}.${++generatedConfigSeq}.toml`
-  );
-  writeFileSync6(
-    configPath,
-    [
-      "# Generated by DeepSpace for this CLI run.",
-      "# Do not edit; wrangler.toml remains the source of truth.",
-      stringifyToml(flattened)
-    ].join("\n").replace(/\s*$/u, "\n")
-  );
-  return {
-    configPath,
-    cleanup() {
-      rmSync2(configPath, { force: true });
+function requiredFieldError(b) {
+  switch (b.type) {
+    case "vectorize": {
+      if (!b.index_name) return `vectorize binding "${b.name}" missing index_name (or "auto")`;
+      if (b.index_name === AUTO_PROVISION_SENTINEL) {
+        if (typeof b.dimensions !== "number" || b.dimensions <= 0) {
+          return `vectorize binding "${b.name}" with index_name="auto" requires "dimensions" (positive number)`;
+        }
+        if (!b.metric || !VECTORIZE_METRICS.has(b.metric)) {
+          return `vectorize binding "${b.name}" with index_name="auto" requires "metric" (one of: ${[...VECTORIZE_METRICS].join(", ")})`;
+        }
+      }
+      return null;
+    }
+    case "r2_bucket":
+      return b.bucket_name ? null : `r2_bucket binding "${b.name}" missing bucket_name (or "auto")`;
+    case "kv_namespace": {
+      if (!b.namespace_id)
+        return `kv_namespace binding "${b.name}" missing namespace_id (or "auto")`;
+      if (b.namespace_id === AUTO_PROVISION_SENTINEL && !b.title) {
+        return `kv_namespace binding "${b.name}" with namespace_id="auto" requires "title"`;
+      }
+      return null;
+    }
+    case "d1": {
+      if (!b.id) return `d1 binding "${b.name}" missing id (or "auto")`;
+      if (b.id === AUTO_PROVISION_SENTINEL && !b.database_name) {
+        return `d1 binding "${b.name}" with id="auto" requires "database_name"`;
+      }
+      return null;
+    }
+    case "queue":
+      return b.queue_name ? null : `queue binding "${b.name}" missing queue_name (or "auto")`;
+    case "hyperdrive":
+      if (!b.id) return `hyperdrive binding "${b.name}" missing id`;
+      if (b.id === AUTO_PROVISION_SENTINEL) {
+        return `hyperdrive binding "${b.name}": auto-provisioning not yet supported (provide a real id)`;
+      }
+      return null;
+    case "ratelimit":
+      if (!/^\d+$/u.test(b.namespace_id) || Number(b.namespace_id) <= 0) {
+        return `ratelimit binding "${b.name}" requires a positive integer namespace_id string`;
+      }
+      if (!Number.isInteger(b.simple?.limit) || b.simple.limit <= 0) {
+        return `ratelimit binding "${b.name}" requires simple.limit (positive integer)`;
+      }
+      if (b.simple.period !== 10 && b.simple.period !== 60) {
+        return `ratelimit binding "${b.name}" requires simple.period (10 or 60)`;
+      }
+      return null;
+    case "ai":
+    case "browser_rendering":
+    case "analytics_engine":
+      return null;
+    // no required fields beyond `name`
+    default: {
+      const _exhaustive = b;
+      void _exhaustive;
+      return null;
     }
-  };
-}
-function wranglerViteEnv(baseEnv, prepared, extraEnv = {}) {
-  const env = { ...baseEnv, ...extraEnv };
-  if (prepared.configPath) {
-    delete env.CLOUDFLARE_ENV;
-    env.CLOUDFLARE_VITE_WRANGLER_CONFIG_PATH = prepared.configPath;
-  } else if (prepared.wranglerEnv) {
-    env.CLOUDFLARE_ENV = prepared.wranglerEnv;
   }
-  return env;
 }
-function flattenWranglerEnvConfig(config, envName) {
-  const envRoot = asTomlRecord(config.env);
-  const envBlock = asTomlRecord(envRoot?.[envName]);
-  if (!envBlock) {
-    throw new Error(`wrangler.toml: no [env.${envName}] block found.`);
+function bindingManifestFromOutputConfig(outputConfig) {
+  const out = [];
+  const aiBinding = pluckString(outputConfig.ai, "binding");
+  if (aiBinding) out.push({ type: "ai", name: aiBinding });
+  for (const v of asObjectArray(outputConfig.vectorize)) {
+    const name = pluckString(v, "binding");
+    const index_name = pluckString(v, "index_name");
+    if (!name || !index_name) continue;
+    const dimensions = pluckNumber(v, "dimensions");
+    const metric = pluckString(v, "metric");
+    out.push({
+      type: "vectorize",
+      name,
+      index_name,
+      ...dimensions != null && { dimensions },
+      ...metric && (metric === "cosine" || metric === "euclidean" || metric === "dot-product") && { metric }
+    });
   }
-  const flattened = {};
-  for (const [key, value] of Object.entries(config)) {
-    if (key === "env" || NON_INHERITABLE_ENV_KEYS.has(key)) continue;
-    flattened[key] = value;
+  for (const r of asObjectArray(outputConfig.r2_buckets)) {
+    const name = pluckString(r, "binding");
+    const bucket_name = pluckString(r, "bucket_name");
+    if (name && bucket_name) out.push({ type: "r2_bucket", name, bucket_name });
   }
-  for (const [key, value] of Object.entries(envBlock)) {
-    flattened[key] = value;
+  for (const k of asObjectArray(outputConfig.kv_namespaces)) {
+    const name = pluckString(k, "binding");
+    const namespace_id = pluckString(k, "id");
+    if (!name || !namespace_id) continue;
+    const title = pluckString(k, "title");
+    out.push({
+      type: "kv_namespace",
+      name,
+      namespace_id,
+      ...title && { title }
+    });
   }
-  if (!("durable_objects" in envBlock) && config.durable_objects) {
-    flattened.durable_objects = config.durable_objects;
+  for (const d of asObjectArray(outputConfig.d1_databases)) {
+    const name = pluckString(d, "binding");
+    const id = pluckString(d, "database_id");
+    if (!name || !id) continue;
+    const database_name = pluckString(d, "database_name");
+    out.push({
+      type: "d1",
+      name,
+      id,
+      ...database_name && { database_name }
+    });
   }
-  const envVars = asTomlRecord(envBlock.vars) ?? {};
-  if (!("APP_NAME" in envVars) && typeof envBlock.name === "string") {
-    flattened.vars = { ...envVars, APP_NAME: envBlock.name };
+  const queues = isObject(outputConfig.queues) ? outputConfig.queues : null;
+  for (const q of asObjectArray(queues?.producers)) {
+    const name = pluckString(q, "binding");
+    const queue_name = pluckString(q, "queue");
+    if (name && queue_name) out.push({ type: "queue", name, queue_name });
   }
-  return flattened;
+  const browserBinding = pluckString(outputConfig.browser, "binding");
+  if (browserBinding) out.push({ type: "browser_rendering", name: browserBinding });
+  for (const a of asObjectArray(outputConfig.analytics_engine_datasets)) {
+    const name = pluckString(a, "binding");
+    const dataset = pluckString(a, "dataset");
+    if (name) out.push({ type: "analytics_engine", name, dataset: dataset ?? void 0 });
+  }
+  for (const h of asObjectArray(outputConfig.hyperdrive)) {
+    const name = pluckString(h, "binding");
+    const id = pluckString(h, "id");
+    if (name && id) out.push({ type: "hyperdrive", name, id });
+  }
+  for (const r of asObjectArray(outputConfig.ratelimits)) {
+    const name = pluckString(r, "name");
+    const namespace_id = pluckString(r, "namespace_id");
+    const simple = isObject(r.simple) ? r.simple : null;
+    const limit = pluckNumber(simple, "limit");
+    const period = pluckNumber(simple, "period");
+    if (!name || !namespace_id || limit === null || period !== 10 && period !== 60) continue;
+    out.push({ type: "ratelimit", name, namespace_id, simple: { limit, period } });
+  }
+  return out;
 }
-function asTomlRecord(value) {
-  return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+function isObject(v) {
+  return v !== null && typeof v === "object" && !Array.isArray(v);
 }
-function safeGeneratedConfigSegment(value) {
-  return value.replace(/[^A-Za-z0-9._-]/gu, "_");
+function pluckString(v, key) {
+  if (!isObject(v)) return null;
+  const val = v[key];
+  return typeof val === "string" && val.length > 0 ? val : null;
 }
-var WranglerConfigError = class extends Error {
-  constructor(path, cause) {
-    const detail = cause instanceof Error ? cause.message : String(cause);
-    super(`wrangler.toml: malformed TOML at ${path}: ${detail}`);
-    this.path = path;
-    this.cause = cause;
-    this.name = "WranglerConfigError";
-  }
-};
-function readWranglerConfig(appDir) {
-  const path = join7(appDir, "wrangler.toml");
-  const raw = readFileSync9(path, "utf-8");
-  try {
-    return parseToml3(raw);
-  } catch (err) {
-    throw new WranglerConfigError(path, err);
-  }
+function pluckNumber(v, key) {
+  if (!isObject(v)) return null;
+  const val = v[key];
+  return typeof val === "number" && Number.isFinite(val) ? val : null;
 }
-function hasWranglerConfig(appDir) {
-  return existsSync6(join7(appDir, "wrangler.toml"));
+function asObjectArray(v) {
+  if (!Array.isArray(v)) return [];
+  return v.filter(isObject);
 }
 
-// src/cli/lib/dev-vars.ts
-var SDK_MANAGED_KEYS = /* @__PURE__ */ new Set([
-  "AUTH_JWT_PUBLIC_KEY",
-  "AUTH_JWT_ISSUER",
-  "AUTH_WORKER_URL",
+// src/cli/lib/secrets.ts
+var RESERVED_SECRET_NAMES = /* @__PURE__ */ new Set([
+  ...RESERVED_BINDING_NAMES,
   "API_WORKER_URL",
-  "PLATFORM_WORKER_URL",
-  "OWNER_USER_ID",
-  "APP_OWNER_JWT",
-  "APP_IDENTITY_TOKEN",
-  "ALLOW_DEBUG_ROUTES"
+  "PLATFORM_WORKER_URL"
 ]);
-var DEV_VARS_DIVIDER = "# --- not managed by the SDK; preserved across dev/test runs ---";
-function extractCustomDevVars(content) {
-  const lines = content.split("\n");
-  const out = [];
-  let belowDivider = false;
-  let i = 0;
-  while (i < lines.length) {
-    const line = lines[i];
-    if (line.trim() === DEV_VARS_DIVIDER.trim()) {
-      belowDivider = true;
-      i++;
-      continue;
-    }
-    const eq = line.indexOf("=");
-    const keyMatch = eq >= 0 ? line.slice(0, eq).match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*$/) : null;
-    if (!keyMatch) {
-      out.push(line);
-      i++;
-      continue;
-    }
-    const key = keyMatch[1];
-    const valueStart = line.slice(eq + 1);
-    const block = [line];
-    if (valueStart.startsWith('"') && !hasUnescapedQuote(valueStart.slice(1))) {
-      i++;
-      while (i < lines.length) {
-        block.push(lines[i]);
-        const closed = hasUnescapedQuote(lines[i]);
-        i++;
-        if (closed) break;
-      }
-    } else {
-      i++;
-    }
-    if (belowDivider || !SDK_MANAGED_KEYS.has(key)) out.push(...block);
+var SECRET_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var CONFIG_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+var MAX_SECRET_VALUE_BYTES = 32 * 1024;
+function validateConfigName(configName) {
+  if (!CONFIG_NAME_RE.test(configName)) {
+    throw new Error(
+      `Invalid config "${configName}". Use letters, numbers, underscores, or hyphens; start with a letter or number.`
+    );
   }
-  while (out.length && out[out.length - 1].trim() === "") out.pop();
-  return out.join("\n");
+  return configName;
 }
-function hasUnescapedQuote(value) {
-  let escaped = false;
-  for (const char of value) {
-    if (escaped) {
-      escaped = false;
-      continue;
-    }
-    if (char === "\\") {
-      escaped = true;
-      continue;
-    }
-    if (char === '"') return true;
+function validateSecretName(name) {
+  if (!SECRET_NAME_RE.test(name)) {
+    throw new Error(
+      `Invalid secret name "${name}". Use letters, numbers, and underscores; start with a letter or underscore.`
+    );
   }
-  return false;
+  if (RESERVED_SECRET_NAMES.has(name)) {
+    throw new Error(
+      `"${name}" is managed by the DeepSpace SDK and can't be set as an app secret \u2014 the platform injects it at deploy time.`
+    );
+  }
+  return name;
 }
-function parseDevVars(content) {
-  const result = {};
-  const lines = content.split("\n");
-  let i = 0;
-  while (i < lines.length) {
-    const line = lines[i];
-    const trimmed = line.trim();
-    if (!trimmed || trimmed.startsWith("#")) {
-      i++;
-      continue;
-    }
-    const eq = line.indexOf("=");
-    if (eq < 0) {
-      i++;
-      continue;
-    }
-    const keyMatch = line.slice(0, eq).match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*$/);
-    if (!keyMatch) {
-      i++;
-      continue;
-    }
-    const key = keyMatch[1];
-    let value = line.slice(eq + 1);
-    let closed = !value.startsWith('"') || hasUnescapedQuote(value.slice(1));
-    if (!closed) {
-      i++;
-      while (i < lines.length) {
-        value += "\n" + lines[i];
-        if (hasUnescapedQuote(lines[i])) {
-          closed = true;
-          i++;
-          break;
-        }
-        i++;
-      }
-    } else {
-      i++;
-    }
-    if (value.startsWith('"') && !closed) {
-      throw new Error(
-        `parseDevVars: unterminated quoted value for key "${key}" \u2014 check your .dev.vars file for a missing closing quote.`
-      );
-    }
-    if (value.startsWith('"') && value.endsWith('"') && value.length >= 2) {
-      value = unescapeQuotedDevVar(value.slice(1, -1));
-    }
-    result[key] = value;
+function validateSecretValue(key, value) {
+  if (new TextEncoder().encode(value).byteLength > MAX_SECRET_VALUE_BYTES) {
+    throw new Error(`Secret "${key}" exceeds ${MAX_SECRET_VALUE_BYTES} bytes`);
   }
-  return result;
 }
-function unescapeQuotedDevVar(value) {
-  let out = "";
-  for (let i = 0; i < value.length; i++) {
-    const char = value[i];
-    if (char !== "\\" || i === value.length - 1) {
-      out += char;
-      continue;
-    }
-    const next = value[i + 1];
-    if (next === "\\" || next === '"') {
-      out += next;
-      i++;
-      continue;
+function defaultConfigNameForEnv(wranglerEnv) {
+  return wranglerEnv ?? "prd";
+}
+async function secretsApi(deployUrl, token, path, init = {}) {
+  const res = await fetch(`${deployUrl}/api/secrets${path}`, {
+    ...init,
+    headers: {
+      Authorization: `Bearer ${token}`,
+      "Content-Type": "application/json",
+      ...init.headers ?? {}
     }
-    out += char;
+  });
+  const body = await res.json().catch(() => ({}));
+  if (!res.ok) {
+    const err = new Error(body.error ?? `Secrets request failed (${res.status})`);
+    err.status = res.status;
+    err.apiPath = path;
+    throw err;
   }
-  return out;
+  return body;
+}
+function listSecrets(deployUrl, token, appId, configName) {
+  return secretsApi(deployUrl, token, `/${appId}/configs/${encodeURIComponent(configName)}`);
+}
+function fetchSecretsValues(deployUrl, token, appId, configName) {
+  return secretsApi(deployUrl, token, `/${appId}/configs/${encodeURIComponent(configName)}/values`);
+}
+function getSecretPlain(deployUrl, token, appId, configName, key) {
+  return secretsApi(
+    deployUrl,
+    token,
+    `/${appId}/configs/${encodeURIComponent(configName)}/secrets/${encodeURIComponent(key)}?plain=true`
+  );
+}
+function setSecret(deployUrl, token, appId, configName, key, value) {
+  return secretsApi(
+    deployUrl,
+    token,
+    `/${appId}/configs/${encodeURIComponent(configName)}/secrets/${encodeURIComponent(key)}`,
+    { method: "PUT", body: JSON.stringify({ value }) }
+  );
+}
+function deleteSecret(deployUrl, token, appId, configName, key) {
+  return secretsApi(
+    deployUrl,
+    token,
+    `/${appId}/configs/${encodeURIComponent(configName)}/secrets/${encodeURIComponent(key)}`,
+    { method: "DELETE" }
+  );
 }
-function requireAppIdFor(appDir, wranglerEnv) {
-  const id = readAppId(appDir, wranglerEnv);
-  if (id) return id;
-  throw new Error(
-    "wrangler.toml has no DEEPSPACE_APP_ID" + (wranglerEnv ? ` for [env.${wranglerEnv}]` : "") + ". Run `deepspace app init` (or `deepspace app init --env <name>`) and retry."
+function uploadSecrets(deployUrl, token, appId, configName, secrets, replace) {
+  return secretsApi(
+    deployUrl,
+    token,
+    `/${appId}/configs/${encodeURIComponent(configName)}/secrets`,
+    { method: "PUT", body: JSON.stringify({ secrets, replace }) }
   );
 }
-async function writeDevVars(appDir, ownerId, callerJwt, wranglerEnv, opts = {}) {
-  const urls = PLATFORM_URLS;
-  const publicKey = await fetchPublicKey(urls.auth);
-  const appId = opts.appId ?? requireAppIdFor(appDir, wranglerEnv);
-  const appOwnerJwt = await mintAppOwnerJwt(urls.auth, callerJwt, appId);
-  const appIdentityToken = await fetchAppIdentityToken(urls.deploy, callerJwt, appId);
-  const sdkVars = [
-    `AUTH_JWT_PUBLIC_KEY="${publicKey}"`,
-    `AUTH_JWT_ISSUER=${urls.auth}/api/auth`,
-    `AUTH_WORKER_URL=${urls.auth}`,
-    `API_WORKER_URL=${urls.api}`,
-    `PLATFORM_WORKER_URL=${urls.platform}`,
-    `OWNER_USER_ID=${ownerId}`,
-    `APP_OWNER_JWT=${appOwnerJwt}`,
-    ...appIdentityToken ? [`APP_IDENTITY_TOKEN=${appIdentityToken}`] : [],
-    `ALLOW_DEBUG_ROUTES=true`
-  ].join("\n");
-  const useSharedDevVarsCache = opts.sharedDevVarsCache ?? opts.generatedSecretsCache !== void 0;
-  const devVarsPath = devVarsPathFor(appDir, wranglerEnv, {
-    sharedDevVarsCache: useSharedDevVarsCache
+function listConfigs(deployUrl, token, appId) {
+  return secretsApi(deployUrl, token, `/${appId}/configs`);
+}
+function createConfig(deployUrl, token, appId, configName, copyFrom) {
+  return secretsApi(deployUrl, token, `/${appId}/configs`, {
+    method: "POST",
+    body: JSON.stringify({ name: configName, ...copyFrom ? { copyFrom } : {} })
   });
-  const existing = existsSync7(devVarsPath) ? readFileSync10(devVarsPath, "utf-8") : "";
-  const custom = opts.generatedSecretsCache ?? extractCustomDevVars(stripGeneratedSecretsCache(existing).trimEnd());
-  let body;
-  if (!custom) {
-    body = `${sdkVars}
-`;
-  } else if (opts.generatedSecretsCache) {
-    body = `${sdkVars}
-
-${custom}
-`;
-  } else {
-    body = `${sdkVars}
-
-${DEV_VARS_DIVIDER}
-${custom}
-`;
-  }
-  writeSecretFileSync(devVarsPath, body);
 }
-
-// src/cli/lib/install-status.ts
-import { existsSync as existsSync9, readFileSync as readFileSync12, realpathSync as realpathSync3 } from "fs";
-import { dirname as dirname5, join as join9, resolve as resolve6 } from "path";
-
-// src/cli/lib/package-manager.ts
-import { existsSync as existsSync8, readFileSync as readFileSync11 } from "fs";
-import { join as join8 } from "path";
-function detectPackageManager(appDir) {
+function deleteConfig(deployUrl, token, appId, configName) {
+  return secretsApi(deployUrl, token, `/${appId}/configs/${encodeURIComponent(configName)}`, {
+    method: "DELETE"
+  });
+}
+async function pullAppSecretsCache(deployUrl, token, appId, configName) {
   try {
-    const pkg2 = JSON.parse(readFileSync11(join8(appDir, "package.json"), "utf-8"));
-    const name = typeof pkg2.packageManager === "string" ? pkg2.packageManager.split("@")[0] : "";
-    if (name === "npm" || name === "pnpm" || name === "yarn" || name === "bun") return name;
-  } catch {
+    const { secrets } = await fetchSecretsValues(deployUrl, token, appId, configName);
+    if (secrets === null || typeof secrets !== "object" || Array.isArray(secrets)) {
+      throw new ApiError(
+        `The secrets service at ${deployUrl} returned an unexpected response shape \u2014 check DEEPSPACE_DEPLOY_URL (is this the service the app lives on?).`,
+        200,
+        "invalid_response",
+        `/${appId}/configs/${configName}/values`
+      );
+    }
+    return { appId, configName, values: secrets };
+  } catch (err) {
+    if (err?.status === 404) return null;
+    throw err;
   }
-  if (existsSync8(join8(appDir, "pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync8(join8(appDir, "yarn.lock"))) return "yarn";
-  if (existsSync8(join8(appDir, "bun.lock")) || existsSync8(join8(appDir, "bun.lockb"))) return "bun";
-  return "npm";
 }
-function installCommand(appDir) {
-  return `${detectPackageManager(appDir)} install`;
+function quoteDotenvValue(value) {
+  if (/^[A-Za-z0-9_./:@+-]*$/.test(value) && value !== "") return value;
+  const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r");
+  return `"${escaped}"`;
 }
-
-// src/cli/lib/install-status.ts
-function installState(appDir) {
-  if (resolvesDeepspace(appDir)) return "ready";
-  const sentinelDir = join9(appDir, ".deepspace");
-  if (existsSync9(join9(sentinelDir, "install.err"))) return "failed";
-  if (existsSync9(join9(sentinelDir, "install.started"))) {
-    if (!existsSync9(join9(sentinelDir, "install.done")) && installWorkerAlive(sentinelDir)) {
-      return "installing";
-    }
-    return "failed";
+function renderSecretsCache(secrets, source) {
+  const keys = Object.keys(secrets).sort();
+  const lines = [`# App secrets \xB7 config ${source.configName} \xB7 app ${source.appId}`];
+  for (const key of keys) {
+    validateSecretValue(key, secrets[key]);
+    lines.push(`${key}=${quoteDotenvValue(secrets[key])}`);
   }
-  return "missing";
-}
-function tailHint(logPath, platform = process.platform) {
-  return platform === "win32" ? `Get-Content -Wait ${logPath}` : `tail -f ${logPath}`;
+  return lines.join("\n");
 }
-function ensureInstallReady(appDir) {
-  if (resolvesDeepspace(appDir)) return;
-  const sentinelDir = join9(appDir, ".deepspace");
-  const errPath = join9(sentinelDir, "install.err");
-  const startedPath = join9(sentinelDir, "install.started");
-  const donePath = join9(sentinelDir, "install.done");
-  const logPath = join9(sentinelDir, "install.log");
-  if (existsSync9(errPath)) {
-    const detail = readFileSync12(errPath, "utf-8").trimEnd();
-    const log29 = existsSync9(logPath) ? ` Full log: ${logPath}.` : "";
-    throw new Refusal(
-      `Dependency install failed: ${detail}.${log29} Run \`npm install\` (or \`bun install\`) manually, then retry.`,
-      "install_failed",
-      { action: { cwd: appDir, argv: [detectPackageManager(appDir), "install"] } }
-    );
+function parseSecretsUpload(content) {
+  const trimmed = content.trim();
+  if (!trimmed) return {};
+  if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
+    const parsed = JSON.parse(trimmed);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw new Error("JSON upload must be an object of KEY=value strings.");
+    }
+    const out2 = {};
+    for (const [key, value] of Object.entries(parsed)) {
+      validateSecretName(key);
+      if (typeof value !== "string") throw new Error(`Secret "${key}" must be a string`);
+      validateSecretValue(key, value);
+      out2[key] = value;
+    }
+    return out2;
   }
-  if (existsSync9(startedPath) && !existsSync9(donePath)) {
-    if (!installWorkerAlive(sentinelDir)) {
-      const log29 = existsSync9(logPath) ? ` See what happened: ${logPath}.` : "";
-      throw new Refusal(
-        `The dependency install is no longer running and never finished.${log29} Run \`npm install\` (or \`bun install\`) manually, then retry.`,
-        "install_failed",
-        { action: { cwd: appDir, argv: [detectPackageManager(appDir), "install"] } }
+  const out = {};
+  const lines = trimmed.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i].trim();
+    if (!line || line.startsWith("#")) continue;
+    const lineNumber = i + 1;
+    const eq = line.indexOf("=");
+    if (eq <= 0) {
+      throw new Error(`Invalid dotenv assignment on line ${lineNumber}: expected KEY=value.`);
+    }
+    const key = line.slice(0, eq).trim();
+    if (!SECRET_NAME_RE.test(key)) {
+      throw new Error(
+        `Invalid secret name on line ${lineNumber}: use letters, numbers, and underscores; start with a letter or underscore.`
       );
     }
-    const tail = existsSync9(logPath) ? ` Tail progress: ${tailHint(logPath)}.` : "";
-    throw new Refusal(
-      `Dependencies are still installing.${tail} Retry once it finishes.`,
-      "install_in_progress"
-    );
-  }
-  throw new Refusal(
-    "Dependencies not installed. Run `npm install` (or `bun install`) first.",
-    "deps_missing",
-    {
-      action: { cwd: appDir, argv: [detectPackageManager(appDir), "install"] }
+    validateSecretName(key);
+    const raw = line.slice(eq + 1).trim();
+    const quote = raw[0] === '"' || raw[0] === "'" ? raw[0] : null;
+    let value;
+    if (!quote) {
+      value = raw;
+    } else if (endsWithUnescapedQuote(raw.slice(1), quote)) {
+      const inner = raw.slice(1, -1);
+      value = quote === '"' ? unescapeDotenv(inner) : inner;
+    } else {
+      const startLine = i + 1;
+      const parts = [raw.slice(1)];
+      let closed = false;
+      while (++i < lines.length) {
+        const cont = lines[i].trimEnd();
+        if (endsWithUnescapedQuote(cont, quote)) {
+          parts.push(cont.slice(0, -1));
+          closed = true;
+          break;
+        }
+        parts.push(lines[i]);
+      }
+      if (!closed) {
+        throw new Error(
+          `Unterminated quoted value for "${key}" (opens on line ${startLine}). Close the ${quote === '"' ? "double" : "single"} quote, or escape newlines as \\n on one line.`
+        );
+      }
+      value = parts.join("\n");
+      if (quote === '"') value = unescapeDotenv(value);
     }
-  );
-}
-function resolvesDeepspace(fromDir) {
-  let dir = canonicalPath2(fromDir);
-  let checkoutRoot = null;
-  try {
-    checkoutRoot = canonicalPath2(repoToplevel(dir));
-  } catch {
-  }
-  for (; ; ) {
-    if (existsSync9(join9(dir, "node_modules", "deepspace", "package.json"))) return true;
-    if (dir === checkoutRoot) return false;
-    const parent = dirname5(dir);
-    if (parent === dir) return false;
-    dir = parent;
-  }
-}
-function canonicalPath2(path) {
-  try {
-    return realpathSync3(path);
-  } catch {
-    return resolve6(path);
-  }
-}
-function installWorkerAlive(sentinelDir) {
-  const pidPath = join9(sentinelDir, "install.pid");
-  if (!existsSync9(pidPath)) return false;
-  const pid = Number(readFileSync12(pidPath, "utf-8").trim());
-  if (!Number.isSafeInteger(pid) || pid <= 0) return false;
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (err) {
-    return err.code === "EPERM";
+    validateSecretValue(key, value);
+    out[key] = value;
   }
+  return out;
 }
-
-// src/cli/lib/preflight.ts
-import { execFileSync } from "child_process";
-import { existsSync as existsSync10 } from "fs";
-import * as nodeModule from "module";
-import { resolve as resolve7 } from "path";
-function preflightNodeVersion(command, hasRegisterHooks = typeof nodeModule.registerHooks === "function") {
-  if (hasRegisterHooks) return;
-  throw new Refusal(
-    `deepspace ${command} requires Node 22.15 or newer (found v${process.versions.node}). Install the current LTS from https://nodejs.org and re-run.`,
-    "node_too_old"
-  );
+function endsWithUnescapedQuote(s, q) {
+  if (!s.endsWith(q)) return false;
+  if (q === "'") return true;
+  let backslashes = 0;
+  for (let j = s.length - 2; j >= 0 && s[j] === "\\"; j--) backslashes++;
+  return backslashes % 2 === 0;
 }
-var DLL_NOT_FOUND = -1073741515;
-function preflightWindowsWorkerd(appDir) {
-  if (process.platform !== "win32") return;
-  const workerdExe = resolve7(
-    appDir,
-    "node_modules",
-    "@cloudflare",
-    "workerd-windows-64",
-    "bin",
-    "workerd.exe"
-  );
-  if (!existsSync10(workerdExe)) return;
-  try {
-    execFileSync(workerdExe, ["--help"], { stdio: "pipe", timeout: 1e4 });
-    return;
-  } catch (err) {
-    const status3 = err.status;
-    if (status3 !== DLL_NOT_FOUND) return;
-    throw new Refusal(
-      "workerd (Cloudflare Workers runtime) cannot start on this system: it needs the Microsoft Visual C++ Redistributable, which is not installed. Install it with `winget install Microsoft.VCRedist.2015+.x64` (or choco install -y vcredist140, or https://aka.ms/vs/17/release/vc_redist.x64.exe), then restart this terminal and re-run.",
-      "vcredist_missing"
-    );
+function unescapeDotenv(v) {
+  let out = "";
+  for (let i = 0; i < v.length; i++) {
+    if (v[i] === "\\" && i + 1 < v.length) {
+      const c = v[++i];
+      out += c === "n" ? "\n" : c === "r" ? "\r" : c;
+    } else {
+      out += v[i];
+    }
   }
+  return out;
 }
-
-// src/cli/lib/macos-junk.ts
-import { readdirSync as readdirSync2, rmSync as rmSync3 } from "fs";
-import { join as join10 } from "path";
-var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", ".wrangler", ".vite"]);
-function removeMacosJunk(dir) {
-  let removed = 0;
-  let entries;
-  try {
-    entries = readdirSync2(dir, { withFileTypes: true });
-  } catch {
-    return removed;
+function shellSingleQuote(value) {
+  return `'${value.replace(/'/g, "'\\''")}'`;
+}
+function formatSecretsDownload(secrets, format) {
+  const entries = Object.entries(secrets).sort(([a], [b]) => a.localeCompare(b));
+  if (format === "json") {
+    return JSON.stringify(Object.fromEntries(entries), null, 2) + "\n";
   }
-  for (const entry of entries) {
-    const path = join10(dir, entry.name);
-    if (entry.isDirectory()) {
-      if (!SKIP_DIRS.has(entry.name)) removed += removeMacosJunk(path);
-      continue;
-    }
-    if (entry.name === ".DS_Store" || entry.name.startsWith("._")) {
-      try {
-        rmSync3(path, { force: true });
-        removed++;
-      } catch {
-      }
-    }
+  if (format === "shell") {
+    return entries.map(([k, v]) => `export ${k}=${shellSingleQuote(v)}`).join("\n") + "\n";
   }
-  return removed;
+  return entries.map(([k, v]) => `${k}=${quoteDotenvValue(v)}`).join("\n") + "\n";
+}
+async function refreshSecretsCache(deployUrl, token, appId, wranglerEnv, selectedConfigName = defaultConfigNameForEnv(wranglerEnv)) {
+  const configName = selectedConfigName;
+  const pulled = await pullAppSecretsCache(deployUrl, token, appId, configName);
+  const values = pulled?.values ?? {};
+  const count = Object.keys(values).length;
+  return {
+    pulled,
+    rendered: renderSecretsCache(values, { appId, configName }),
+    // An empty store is the common case and not worth a status line.
+    summary: count ? `Secrets: ${configName} (${count} secret${count === 1 ? "" : "s"})` : null
+  };
 }
 
 // src/cli/lib/schema-lint.ts
-import { existsSync as existsSync11 } from "fs";
+import { existsSync as existsSync10 } from "fs";
 import { join as join11 } from "path";
 import { pathToFileURL } from "url";
 
@@ -2531,7 +2412,7 @@ function lintSchema(schema) {
   if (schema.ownerField) {
     const col = schema.columns.find((c) => c.name === schema.ownerField);
     const spoofableRoles = Object.entries(schema.permissions).filter(
-      ([role, permissions]) => role !== "owner" && role !== "admin" && permissions.create === true
+      ([role, permissions]) => role !== "owner" && role !== "admin" && permissions.create === true && permissions.update !== "unclaimed-or-own"
     ).map(([role]) => role);
     if (col && !col.userBound && spoofableRoles.length > 0) {
       warnings.push(
@@ -2552,7 +2433,7 @@ function lintSchema(schema) {
 // src/cli/lib/schema-lint.ts
 async function lintProjectSchemas(appDir) {
   const schemasPath = join11(appDir, "src", "schemas.ts");
-  if (!existsSync11(schemasPath)) return null;
+  if (!existsSync10(schemasPath)) return null;
   let schemas;
   try {
     const esbuild = await import("esbuild");
@@ -2756,10 +2637,8 @@ var dev_default = defineDeepspaceCommand({
     if (appIdForSecrets) {
       try {
         const refreshed = await refreshSecretsCache(DEPLOY_URL, token, appIdForSecrets, wranglerEnv);
-        if (refreshed) {
-          generatedSecretsCache = refreshed.rendered;
-          if (refreshed.summary) say(refreshed.summary);
-        }
+        generatedSecretsCache = refreshed.rendered;
+        if (refreshed.summary) say(refreshed.summary);
       } catch (err) {
         throw new Refusal(
           `Failed to refresh app secrets: ${err instanceof Error ? err.message : String(err)}`,
@@ -2767,16 +2646,10 @@ var dev_default = defineDeepspaceCommand({
         );
       }
     }
-    const sharedDevVarsCache = generatedSecretsCache !== void 0;
     await writeDevVars(appDir, payload.sub, token, wranglerEnv, {
-      generatedSecretsCache,
-      sharedDevVarsCache
+      generatedSecretsCache
     });
-    const wranglerConfig = prepareWranglerEnvConfig(
-      appDir,
-      wranglerEnv,
-      { sharedDevVarsCache }
-    );
+    const wranglerConfig = prepareWranglerEnvConfig(appDir, wranglerEnv);
     preflightWindowsWorkerd(appDir);
     if (await isPortListening(port, host)) {
       const killArgv = port === DEFAULT_PORT ? ["deepspace", "dev", "kill"] : ["deepspace", "dev", "kill", "--port", String(port)];
@@ -2791,15 +2664,11 @@ Free it with \`${killCmd}\`, or start on another port: \`deepspace dev start --p
     }
     const url = `http://${host === DEFAULT_DEV_HOST ? "localhost" : host}:${port}`;
     say("Starting dev server...\n");
-    const vite = spawn(
-      "npx",
-      ["vite", "--port", String(port), "--strictPort", "--host", host],
-      {
-        cwd: appDir,
-        stdio: "inherit",
-        env: wranglerViteEnv(process.env, wranglerConfig, { DEEPSPACE_PORT: String(port) })
-      }
-    );
+    const vite = spawn("npx", ["vite", "--port", String(port), "--strictPort", "--host", host], {
+      cwd: appDir,
+      stdio: "inherit",
+      env: wranglerViteEnv(process.env, wranglerConfig, { DEEPSPACE_PORT: String(port) })
+    });
     if (args.json) {
       void waitForPortListening(port, host, READINESS_TIMEOUT_MS).then((ready) => {
         console.log(
@@ -2844,7 +2713,7 @@ Free it with \`${killCmd}\`, or start on another port: \`deepspace dev start --p
 
 // src/cli/commands/kill.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { readFileSync as readFileSync13, readdirSync as readdirSync3, readlinkSync } from "fs";
+import { readFileSync as readFileSync12, readdirSync as readdirSync3, readlinkSync } from "fs";
 import { setTimeout as wait } from "timers/promises";
 var SIGTERM_GRACE_MS = 1500;
 var IS_WIN = process.platform === "win32";
@@ -2995,7 +2864,7 @@ function listenerPidsViaProc(port) {
     for (const f of ["/proc/net/tcp", "/proc/net/tcp6"]) {
       let data;
       try {
-        data = readFileSync13(f, "utf-8");
+        data = readFileSync12(f, "utf-8");
       } catch {
         continue;
       }
@@ -3154,10 +3023,10 @@ function ensurePlaywright(appDir) {
 }
 
 // src/cli/lib/test-account-service.ts
-import { readFileSync as readFileSync15 } from "fs";
+import { readFileSync as readFileSync14 } from "fs";
 
 // src/testing/accounts.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync5, readFileSync as readFileSync14, writeFileSync as writeFileSync7 } from "fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync13, writeFileSync as writeFileSync7 } from "fs";
 import { homedir as homedir3 } from "os";
 import { join as join13 } from "path";
 var TEST_ACCOUNTS_PATH = join13(homedir3(), ".deepspace", "test-accounts.json");
@@ -3176,7 +3045,7 @@ function normalizeTestAccountScope(value) {
 }
 function loadAllTestAccounts(scope = currentTestAccountScope()) {
   const store = readTestAccountStore();
-  return mergeTestAccounts(store.scopes[scope] ?? [], store.unscoped);
+  return store.scopes[scope] ?? [];
 }
 function reconcileTestAccountStore(remote, scope = currentTestAccountScope()) {
   const result = reconcileTestAccountScopes(readTestAccountStore(), remote, scope);
@@ -3185,24 +3054,20 @@ function reconcileTestAccountStore(remote, scope = currentTestAccountScope()) {
 }
 function reconcileTestAccountScopes(store, remote, scope) {
   const scoped = store.scopes[scope] ?? [];
-  const current = reconcileTestAccounts(scoped, remote);
-  const migrated = reconcileTestAccounts(store.unscoped, remote);
-  const accounts = mergeTestAccounts(current, migrated);
+  const accounts = reconcileTestAccounts(scoped, remote);
   return {
     accounts,
-    removed: Math.max(0, scoped.length - current.length),
+    removed: Math.max(0, scoped.length - accounts.length),
     store: {
       version: 2,
-      scopes: { ...store.scopes, [scope]: accounts },
-      unscoped: store.unscoped.filter((account) => !remote.some((item) => accountMatchesRemote(account, item)))
+      scopes: { ...store.scopes, [scope]: accounts }
     }
   };
 }
 function reconcileTestAccounts(local, remote) {
   const localById = new Map(local.filter((account) => account.id).map((account) => [account.id, account]));
-  const legacyByEmail = new Map(local.filter((account) => !account.id).map((account) => [account.email, account]));
   return remote.flatMap((account) => {
-    const stored = localById.get(account.id) ?? legacyByEmail.get(account.email);
+    const stored = localById.get(account.id);
     return stored ? [{ ...stored, ...account }] : [];
   });
 }
@@ -3213,10 +3078,7 @@ function upsertTestAccount(account, scope = currentTestAccountScope()) {
   );
   saveTestAccountStore({
     version: 2,
-    scopes: { ...store.scopes, [scope]: [...accounts, account] },
-    unscoped: store.unscoped.filter(
-      (stored) => stored.id !== account.id && stored.email !== account.email
-    )
+    scopes: { ...store.scopes, [scope]: [...accounts, account] }
   });
 }
 function removeTestAccounts(ids, emails = [], scope = currentTestAccountScope()) {
@@ -3226,41 +3088,31 @@ function removeTestAccounts(ids, emails = [], scope = currentTestAccountScope())
   const store = readTestAccountStore();
   saveTestAccountStore({
     version: 2,
-    scopes: { ...store.scopes, [scope]: (store.scopes[scope] ?? []).filter(keep) },
-    unscoped: store.unscoped.filter(keep)
+    scopes: { ...store.scopes, [scope]: (store.scopes[scope] ?? []).filter(keep) }
   });
 }
 function readTestAccountStore() {
-  if (!existsSync12(TEST_ACCOUNTS_PATH)) return { version: 2, scopes: {}, unscoped: [] };
+  if (!existsSync11(TEST_ACCOUNTS_PATH)) return { version: 2, scopes: {} };
   try {
-    const raw = JSON.parse(readFileSync14(TEST_ACCOUNTS_PATH, "utf-8"));
-    if (Array.isArray(raw)) return { version: 2, scopes: {}, unscoped: validTestAccounts(raw) };
-    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
-      return { version: 2, scopes: {}, unscoped: [] };
+    const raw = JSON.parse(readFileSync13(TEST_ACCOUNTS_PATH, "utf-8"));
+    if (Array.isArray(raw)) return { version: 2, scopes: {} };
+    if (!raw || typeof raw !== "object") {
+      return { version: 2, scopes: {} };
     }
     const candidate = raw;
     const scopes = candidate.scopes && typeof candidate.scopes === "object" && !Array.isArray(candidate.scopes) ? Object.fromEntries(Object.entries(candidate.scopes).map(([key, value]) => [key, validTestAccounts(value)])) : {};
-    return { version: 2, scopes, unscoped: validTestAccounts(candidate.unscoped) };
+    return { version: 2, scopes };
   } catch {
-    return { version: 2, scopes: {}, unscoped: [] };
+    return { version: 2, scopes: {} };
   }
 }
 function validTestAccounts(value) {
   if (!Array.isArray(value)) return [];
-  return value.filter((item) => Boolean(
-    item && typeof item === "object" && typeof item.email === "string" && typeof item.password === "string"
-  ));
-}
-function mergeTestAccounts(...groups) {
-  const accounts = /* @__PURE__ */ new Map();
-  for (const account of groups.flat()) {
-    const key = account.id ? `id:${account.id}` : `email:${account.email}`;
-    if (!accounts.has(key)) accounts.set(key, account);
-  }
-  return [...accounts.values()];
-}
-function accountMatchesRemote(local, remote) {
-  return local.id ? local.id === remote.id : local.email === remote.email;
+  return value.filter(
+    (item) => Boolean(
+      item && typeof item === "object" && typeof item.id === "string" && typeof item.email === "string" && typeof item.password === "string"
+    )
+  );
 }
 function saveTestAccountStore(store) {
   mkdirSync5(join13(homedir3(), ".deepspace"), { recursive: true });
@@ -3271,7 +3123,7 @@ function saveTestAccountStore(store) {
 var SESSION_COOKIE2 = "__Secure-better-auth.session_token";
 var AUTH_URL4 = process.env.DEEPSPACE_AUTH_URL ?? PLATFORM_URLS.auth;
 function sessionCookie() {
-  const token = readFileSync15(SESSION_PATH, "utf-8").trim();
+  const token = readFileSync14(SESSION_PATH, "utf-8").trim();
   return `${SESSION_COOKIE2}=${encodeURIComponent(token)}`;
 }
 async function fetchRemoteTestAccounts() {
@@ -3318,11 +3170,24 @@ async function syncTestAccountStore() {
 
 // src/cli/commands/test.ts
 var DEPLOY_URL2 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
+var PLAYWRIGHT_OUTPUT_DIR = ".deepspace/test-results";
+function playwrightTestArgs(testFiles) {
+  return [
+    "playwright",
+    "test",
+    "--config",
+    "tests/playwright.config.ts",
+    "--output",
+    PLAYWRIGHT_OUTPUT_DIR,
+    ...testFiles
+  ];
+}
 var test_default = defineDeepspaceCommand({
   meta: {
     name: "test",
     description: "Run tests for your DeepSpace app"
   },
+  jsonDescription: "Stream test output; emit the final JSON result on the last line",
   args: {
     suite: {
       type: "positional",
@@ -3375,10 +3240,8 @@ var test_default = defineDeepspaceCommand({
     if (appIdForSecrets) {
       try {
         const refreshed = await refreshSecretsCache(DEPLOY_URL2, token, appIdForSecrets, wranglerEnv);
-        if (refreshed) {
-          generatedSecretsCache = refreshed.rendered;
-          if (refreshed.summary) say(refreshed.summary);
-        }
+        generatedSecretsCache = refreshed.rendered;
+        if (refreshed.summary) say(refreshed.summary);
       } catch (err) {
         throw new Refusal(
           `Failed to refresh app secrets: ${err instanceof Error ? err.message : String(err)}`,
@@ -3386,17 +3249,17 @@ var test_default = defineDeepspaceCommand({
         );
       }
     }
-    const sharedDevVarsCache = generatedSecretsCache !== void 0;
     await writeDevVars(appDir, ownerId, token, wranglerEnv, {
-      generatedSecretsCache,
-      sharedDevVarsCache
+      generatedSecretsCache
     });
     if (suite !== "unit") {
       try {
         const { removed } = await syncTestAccountStore();
         if (removed > 0) say(`Removed ${removed} stale test account credential(s).`);
       } catch (error) {
-        say(`Warning: could not reconcile test accounts: ${error instanceof Error ? error.message : String(error)}`);
+        say(
+          `Warning: could not reconcile test accounts: ${error instanceof Error ? error.message : String(error)}`
+        );
       }
     }
     if (suite !== "unit") {
@@ -3406,46 +3269,32 @@ var test_default = defineDeepspaceCommand({
     let exitCode = 0;
     switch (suite) {
       case "smoke":
-        exitCode = runPlaywright(
-          appDir,
-          ["tests/smoke.spec.ts"],
-          port,
-          wranglerEnv,
-          sharedDevVarsCache
-        );
+        exitCode = runPlaywright(appDir, ["tests/smoke.spec.ts"], port, wranglerEnv);
         break;
       case "api":
-        exitCode = runPlaywright(
-          appDir,
-          ["tests/api.spec.ts"],
-          port,
-          wranglerEnv,
-          sharedDevVarsCache
-        );
+        exitCode = runPlaywright(appDir, ["tests/api.spec.ts"], port, wranglerEnv);
         break;
       case "e2e":
-        exitCode = runPlaywright(appDir, [], port, wranglerEnv, sharedDevVarsCache);
+        exitCode = runPlaywright(appDir, [], port, wranglerEnv);
         break;
       case "unit":
         exitCode = runVitest(appDir);
         break;
       case "all":
         exitCode = runVitest(appDir);
-        if (exitCode === 0)
-          exitCode = runPlaywright(appDir, [], port, wranglerEnv, sharedDevVarsCache);
+        if (exitCode === 0) exitCode = runPlaywright(appDir, [], port, wranglerEnv);
         break;
       case "default":
         exitCode = runPlaywright(
           appDir,
           ["tests/smoke.spec.ts", "tests/api.spec.ts"],
           port,
-          wranglerEnv,
-          sharedDevVarsCache
+          wranglerEnv
         );
         break;
       default:
         if (suite.endsWith(".spec.ts")) {
-          exitCode = runPlaywright(appDir, [suite], port, wranglerEnv, sharedDevVarsCache);
+          exitCode = runPlaywright(appDir, [suite], port, wranglerEnv);
         } else {
           throw new Refusal(
             `Unknown test suite: ${suite}
@@ -3462,24 +3311,23 @@ Available: smoke, api, e2e, unit, all`,
     return { data: { suite, port, appDir, wranglerEnv: wranglerEnv ?? null } };
   }
 });
-function runPlaywright(appDir, testFiles, port, wranglerEnv, sharedDevVarsCache = false) {
+function runPlaywright(appDir, testFiles, port, wranglerEnv) {
   let wranglerConfig;
   try {
-    wranglerConfig = prepareWranglerEnvConfig(appDir, wranglerEnv, { sharedDevVarsCache });
+    wranglerConfig = prepareWranglerEnvConfig(appDir, wranglerEnv);
   } catch (err) {
     console.error(err instanceof Error ? err.message : String(err));
     return 1;
   }
   try {
-    const result = spawnSync4(
-      "npx",
-      ["playwright", "test", "--config", "tests/playwright.config.ts", ...testFiles],
-      {
-        cwd: appDir,
-        stdio: "inherit",
-        env: wranglerViteEnv(process.env, wranglerConfig, { DEEPSPACE_PORT: String(port) })
-      }
-    );
+    const result = spawnSync4("npx", playwrightTestArgs(testFiles), {
+      cwd: appDir,
+      stdio: "inherit",
+      env: wranglerViteEnv(process.env, wranglerConfig, {
+        DEEPSPACE_PORT: String(port),
+        PLAYWRIGHT_HTML_OUTPUT_DIR: ".deepspace/playwright-report"
+      })
+    });
     return result.status ?? 1;
   } finally {
     wranglerConfig.cleanup();
@@ -3997,33 +3845,33 @@ function describeFilesFailure(status3, body) {
 import * as p6 from "@clack/prompts";
 import { execSync as execSync2 } from "child_process";
 import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync15, readFileSync as readFileSync18, readdirSync as readdirSync4 } from "fs";
+import { chmodSync as chmodSync2, existsSync as existsSync14, lstatSync as lstatSync2, readFileSync as readFileSync17, readdirSync as readdirSync4 } from "fs";
 import { dirname as dirname6, join as join16, resolve as resolve11 } from "path";
 
 // src/documentation/deploy.ts
-import { existsSync as existsSync13, readFileSync as readFileSync16 } from "fs";
+import { existsSync as existsSync12, readFileSync as readFileSync15 } from "fs";
 import { join as join14 } from "path";
 function readDocumentationDeployManifest(appDir, clientDir) {
-  if (!existsSync13(join14(appDir, "documentation.json"))) return void 0;
+  if (!existsSync12(join14(appDir, "documentation.json"))) return void 0;
   const manifestPath = join14(clientDir, "_documentation", "manifest.json");
-  if (!existsSync13(manifestPath)) {
+  if (!existsSync12(manifestPath)) {
     throw new Error(
       "documentation.json exists but the build produced no documentation manifest. Ensure vite.config.ts includes deepSpaceDocumentation() from deepspace/documentation."
     );
   }
-  return JSON.parse(readFileSync16(manifestPath, "utf8"));
+  return JSON.parse(readFileSync15(manifestPath, "utf8"));
 }
 
 // src/cli/commands/update/app-migrations.ts
 import {
   closeSync,
   constants,
-  existsSync as existsSync14,
+  existsSync as existsSync13,
   fstatSync,
   ftruncateSync,
   lstatSync,
   openSync,
-  readFileSync as readFileSync17,
+  readFileSync as readFileSync16,
   writeSync
 } from "fs";
 import { join as join15 } from "path";
@@ -4032,6 +3880,7 @@ import { join as join15 } from "path";
 var APP_MIGRATION_ID_RE = /^[a-z0-9][a-z0-9._-]{0,127}$/;
 var MAX_APP_MIGRATION_IDS = 256;
 var WORKER_OWNED_NOT_FOUND_MIGRATION_ID = "2026-08-worker-owned-not-found";
+var SECURE_ROOM_BOUNDARIES_MIGRATION_ID = "2026-08-secure-room-boundaries";
 function validateAppMigrationIds(value) {
   if (!Array.isArray(value)) {
     return { valid: false, reason: "app migrations must be a JSON string array" };
@@ -4065,6 +3914,12 @@ var SOURCE_MIGRATIONS = [
     description: "Let the worker answer misses, so deleted files 404 instead of serving HTML",
     transform: migrateWorkerOwnedNotFound,
     findBlockers: findWorkerOwnedNotFoundBlockers
+  },
+  {
+    id: SECURE_ROOM_BOUNDARIES_MIGRATION_ID,
+    description: "Secure room identity, job mutations, and production debug routes",
+    transform: migrateSecureRoomBoundaries,
+    findBlockers: findSecureRoomBoundaryBlockers
   }
 ];
 var APP_MIGRATION_DEFINITIONS = SOURCE_MIGRATIONS.map(
@@ -4072,7 +3927,7 @@ var APP_MIGRATION_DEFINITIONS = SOURCE_MIGRATIONS.map(
 );
 function readAppliedAppMigrations(appDir) {
   const path = join15(appDir, APP_MIGRATIONS_MANIFEST);
-  if (!existsSync14(path)) return [];
+  if (!existsSync13(path)) return [];
   const source = readRegularFile(path);
   let parsed;
   try {
@@ -4133,7 +3988,7 @@ function planAppMigrations(appDir) {
   if (pending.length > 0 && blockers.length === 0) {
     const manifestPath = `${appPrefix}${APP_MIGRATIONS_MANIFEST}`;
     const absoluteManifestPath = join15(repo, manifestPath);
-    const before = existsSync14(absoluteManifestPath) ? readRegularFile(absoluteManifestPath) : null;
+    const before = existsSync13(absoluteManifestPath) ? readRegularFile(absoluteManifestPath) : null;
     const after = `${JSON.stringify([...appliedIds, ...pending.map(({ id }) => id)], null, 2)}
 `;
     if (before !== after) edits.push({ path: manifestPath, before, after });
@@ -4149,7 +4004,7 @@ function applyAppMigrationPlan(appDir, plan) {
   const repo = repoToplevel(appDir);
   for (const edit of plan.edits) {
     const absolutePath = join15(repo, edit.path);
-    const current = existsSync14(absolutePath) ? readRegularFile(absolutePath) : null;
+    const current = existsSync13(absolutePath) ? readRegularFile(absolutePath) : null;
     if (current !== edit.before) {
       throw new Error(`Migration input changed after planning: ${edit.path}`);
     }
@@ -4168,7 +4023,7 @@ function readRegularFile(path) {
     if (!opened.isFile() || opened.dev !== after.dev || opened.ino !== after.ino) {
       throw new Error(`Migration input changed while opening: ${path}`);
     }
-    return readFileSync17(fd, "utf-8");
+    return readFileSync16(fd, "utf-8");
   } finally {
     closeSync(fd);
   }
@@ -4194,7 +4049,7 @@ function writeRegularFile(path, before, after) {
     if (!opened.isFile() || opened.dev !== currentPath.dev || opened.ino !== currentPath.ino) {
       throw new Error(`Migration input changed while opening: ${path}`);
     }
-    if (readFileSync17(fd, "utf-8") !== before) {
+    if (readFileSync16(fd, "utf-8") !== before) {
       throw new Error(`Migration input changed after planning: ${path}`);
     }
     ftruncateSync(fd, 0);
@@ -4208,6 +4063,248 @@ function isSourcePath(repoPath, appPrefix) {
   if (repoPath.endsWith("wrangler.toml")) return true;
   return /\.(?:[cm]?[jt]sx?)$/.test(repoPath);
 }
+var LEGACY_AUTHENTICATED_ROOM_HELPER = `const IDENTITY_QUERY_PARAMS = ['userId', 'userName', 'userEmail', 'userImageUrl', 'role'] as const
+
+function authenticatedRoomUrl(
+  requestUrl: string,
+  auth: VerifyResult | null,
+  extraParams?: (auth: VerifyResult) => Record<string, string>,
+): URL {
+  const doUrl = new URL(requestUrl)
+  doUrl.searchParams.delete('token')
+  for (const key of IDENTITY_QUERY_PARAMS) {
+    doUrl.searchParams.delete(key)
+  }
+
+  if (!auth) return doUrl
+
+  doUrl.searchParams.set('userId', auth.userId)
+  if (auth.claims.name) doUrl.searchParams.set('userName', auth.claims.name)
+  if (auth.claims.email) doUrl.searchParams.set('userEmail', auth.claims.email)
+  if (auth.claims.image) doUrl.searchParams.set('userImageUrl', auth.claims.image)
+  if (extraParams) {
+    for (const [key, value] of Object.entries(extraParams(auth))) {
+      doUrl.searchParams.set(key, value)
+    }
+  }
+  return doUrl
+}`;
+var IDENTITY_ROUTE_REPLACEMENTS = [
+  [
+    `import { verifyJwt } from 'deepspace/worker'`,
+    `import { authenticatedRoomRequest, verifyJwt } from 'deepspace/worker'`,
+    1
+  ],
+  [LEGACY_AUTHENTICATED_ROOM_HELPER, "", 1],
+  [
+    `function wsRoute(
+  doNamespace: (env: Env) => DurableObjectNamespace,
+  extraParams?: (auth: VerifyResult) => Record<string, string>,
+) {`,
+    `function wsRoute(
+  doNamespace: (env: Env) => DurableObjectNamespace,
+  extraIdentity?: (auth: VerifyResult) => { role?: string },
+) {`,
+    1
+  ],
+  [
+    `    const doUrl = authenticatedRoomUrl(c.req.url, auth, extraParams)`,
+    `    const roomRequest = authenticatedRoomRequest(
+      c.req.raw,
+      auth,
+      auth ? extraIdentity?.(auth) : undefined,
+    )`,
+    1
+  ],
+  [
+    `    const doUrl = authenticatedRoomUrl(c.req.url, auth, () => ({ role }))`,
+    `    const roomRequest = authenticatedRoomRequest(c.req.raw, auth, { role })`,
+    1
+  ],
+  [
+    `    return stub.fetch(new Request(doUrl.toString(), c.req.raw))`,
+    `    return stub.fetch(roomRequest)`,
+    2
+  ]
+];
+function occurrences(source, pattern) {
+  return source.split(pattern).length - 1;
+}
+var SECURE_JOB_ROOM_CONSTRUCTOR = `  constructor(state: DurableObjectState, env: Env) {
+    super(state, env, {
+      authorizeWrite: async (user) => {
+        if (user.userId.startsWith('anon-')) return false
+        const role = await resolveAppRole(env, user.userId)
+        return role === 'member' || role === 'admin'
+      },
+    })
+  }`;
+var APP_JOB_ROOM_CLASS = `export class AppJobRoom extends JobRoom<Env> {`;
+var SECURE_APP_JOB_ROOM = `${APP_JOB_ROOM_CLASS}
+${SECURE_JOB_ROOM_CONSTRUCTOR}`;
+function hasSecureAppJobRoom(source) {
+  return occurrences(source, "class AppJobRoom") === 1 && source.includes(SECURE_APP_JOB_ROOM);
+}
+var WORKER_JOB_REPLACEMENTS = [
+  [
+    `import type { DOBindings, DOManifest, Job, JobContext } from 'deepspace/worker'`,
+    `import { resolveAppRole } from 'deepspace/worker'
+import type { DOBindings, DOManifest, Job, JobContext } from 'deepspace/worker'`
+  ],
+  [
+    `export class AppJobRoom extends JobRoom<Env> {
+  constructor(state: DurableObjectState, env: Env) {
+    super(state, env)
+  }`,
+    `export class AppJobRoom extends JobRoom<Env> {
+${SECURE_JOB_ROOM_CONSTRUCTOR}`
+  ]
+];
+var HTTP_ROLE_IMPORT = `import { resolveAppRole } from 'deepspace/worker'`;
+var HTTP_ROLE_IMPORT_SEAM = `import type { AppContext, Env } from '../../worker.js'`;
+var DEBUG_ROUTE_SEAM = `  app.all('/api/debug/*', async (c) => {
+    if (c.env.ALLOW_DEBUG_ROUTES !== 'true') {
+      return c.notFound()
+    }
+    const stub = c.env.RECORD_ROOMS.get(`;
+var DOUBLE_QUOTED_DEBUG_ROUTE_SEAM = DEBUG_ROUTE_SEAM.replace(
+  "app.all('/api/debug/*'",
+  'app.all("/api/debug/*"'
+);
+var SECURE_DEBUG_ROUTE_SEAM = `  app.all('/api/debug/*', async (c) => {
+    if (c.env.ALLOW_DEBUG_ROUTES !== 'true') {
+      return c.notFound()
+    }
+    const auth = await resolveAuth(c.req.raw, c.env)
+    if (!auth) return c.json({ error: 'unauthorized' }, 401)
+    if ((await resolveAppRole(c.env, auth.userId)) !== 'admin') {
+      return c.json({ error: 'forbidden' }, 403)
+    }
+    const stub = c.env.RECORD_ROOMS.get(`;
+var DOUBLE_QUOTED_SECURE_DEBUG_ROUTE_SEAM = SECURE_DEBUG_ROUTE_SEAM.replace(
+  "app.all('/api/debug/*'",
+  'app.all("/api/debug/*"'
+);
+var DEBUG_ROUTE_REPLACEMENTS = [
+  [DEBUG_ROUTE_SEAM, SECURE_DEBUG_ROUTE_SEAM],
+  [DOUBLE_QUOTED_DEBUG_ROUTE_SEAM, DOUBLE_QUOTED_SECURE_DEBUG_ROUTE_SEAM]
+];
+var DEBUG_ROUTE_PATTERN = /\bapp\.all\(\s*(['"])\/api\/debug\/\*\1\s*,/;
+function debugRouteOccurrences(source) {
+  return source.match(new RegExp(DEBUG_ROUTE_PATTERN.source, "g"))?.length ?? 0;
+}
+function secureDebugRouteOccurrences(source) {
+  return DEBUG_ROUTE_REPLACEMENTS.reduce(
+    (count, [, secure]) => count + occurrences(source, secure),
+    0
+  );
+}
+function hasSecureDebugRoute(source) {
+  return debugRouteOccurrences(source) === 1 && secureDebugRouteOccurrences(source) === 1 && occurrences(source, HTTP_ROLE_IMPORT) === 1;
+}
+function migrateSecureRoomBoundaries(source, file) {
+  if (file.endsWith("src/server/realtime-routes.ts")) {
+    return migrateRealtimeRoomBoundaries(source);
+  }
+  if (file.endsWith("worker.ts")) return migrateWorkerJobAuthorization(source);
+  if (file.endsWith("src/server/http-routes.ts")) return migrateDebugRouteAuthorization(source);
+  return { source, replacements: 0 };
+}
+function migrateRealtimeRoomBoundaries(source) {
+  let migrated = source;
+  let replacements = 0;
+  if (!migrated.includes("authenticatedRoomRequest(")) {
+    if (IDENTITY_ROUTE_REPLACEMENTS.some(
+      ([before, , expected]) => occurrences(migrated, before) !== expected
+    )) {
+      return { source, replacements: 0 };
+    }
+    for (const [before, after, expected] of IDENTITY_ROUTE_REPLACEMENTS) {
+      migrated = migrated.replaceAll(before, after);
+      replacements += expected;
+    }
+  }
+  return { source: migrated, replacements };
+}
+function migrateWorkerJobAuthorization(source) {
+  if (!source.includes("class AppJobRoom")) return { source, replacements: 0 };
+  if (hasSecureAppJobRoom(source)) return { source, replacements: 0 };
+  if (WORKER_JOB_REPLACEMENTS.some(([before]) => occurrences(source, before) !== 1)) {
+    return { source, replacements: 0 };
+  }
+  let migrated = source;
+  for (const [before, after] of WORKER_JOB_REPLACEMENTS) migrated = migrated.replace(before, after);
+  return { source: migrated, replacements: WORKER_JOB_REPLACEMENTS.length };
+}
+function migrateDebugRouteAuthorization(source) {
+  if (debugRouteOccurrences(source) === 0 || hasSecureDebugRoute(source)) {
+    return { source, replacements: 0 };
+  }
+  const matchingRoutes = DEBUG_ROUTE_REPLACEMENTS.filter(
+    ([before2]) => occurrences(source, before2) === 1
+  );
+  if (debugRouteOccurrences(source) !== 1 || matchingRoutes.length !== 1 || occurrences(source, HTTP_ROLE_IMPORT) !== 0 || occurrences(source, HTTP_ROLE_IMPORT_SEAM) !== 1) {
+    return { source, replacements: 0 };
+  }
+  const [before, after] = matchingRoutes[0];
+  return {
+    source: source.replace(HTTP_ROLE_IMPORT_SEAM, `${HTTP_ROLE_IMPORT_SEAM}
+${HTTP_ROLE_IMPORT}`).replace(before, after),
+    replacements: 2
+  };
+}
+function findSecureRoomBoundaryBlockers(source, file) {
+  if (file.endsWith("worker.ts") && source.includes("class AppJobRoom")) {
+    if (!hasSecureAppJobRoom(source)) {
+      return [
+        roomBoundaryBlocker(
+          file,
+          source,
+          "class AppJobRoom",
+          "Configure AppJobRoom with authorizeWrite using the current users.role."
+        )
+      ];
+    }
+    return [];
+  }
+  if (file.endsWith("src/server/http-routes.ts") && debugRouteOccurrences(source) > 0) {
+    if (!hasSecureDebugRoute(source)) {
+      const route = source.match(DEBUG_ROUTE_PATTERN)?.[0] ?? "/api/debug/*";
+      return [
+        roomBoundaryBlocker(
+          file,
+          source,
+          route,
+          "Require verified owner/admin access inside the enabled debug-route handler."
+        )
+      ];
+    }
+    return [];
+  }
+  if (!file.endsWith("src/server/realtime-routes.ts")) return [];
+  const lines = source.split("\n");
+  let index = lines.findIndex(
+    (line) => line.includes("authenticatedRoomUrl") || /searchParams\.(?:set|append)\(\s*['"](?:userId|userName|userEmail|userImageUrl|role)['"]/.test(
+      line
+    )
+  );
+  if (index < 0 && /\bauth\.(?:userId|claims)\b/.test(source)) {
+    index = lines.findIndex((line) => /searchParams\.(?:set|append)\s*\(/.test(line));
+  }
+  if (index < 0) return [];
+  return [
+    {
+      migrationId: SECURE_ROOM_BOUNDARIES_MIGRATION_ID,
+      file,
+      line: index + 1,
+      message: "This customized room proxy still places verified user identity in its internal URL. Replace that forwarding code with authenticatedRoomRequest() from deepspace/worker before the Durable Object fetch."
+    }
+  ];
+}
+function roomBoundaryBlocker(file, source, seam, message) {
+  const line = source.slice(0, source.indexOf(seam)).split("\n").length;
+  return { migrationId: SECURE_ROOM_BOUNDARIES_MIGRATION_ID, file, line, message };
+}
 function migrateWorkerOwnedNotFound(source, file) {
   let replacements = 0;
   if (file.endsWith("wrangler.toml")) {
@@ -4273,12 +4370,22 @@ function findWorkerOwnedNotFoundBlockers(source, file) {
 
 // src/cli/commands/deploy/build.ts
 var RESERVED_RUN_WORKER_FIRST2 = new Set(RESERVED_RUN_WORKER_FIRST);
+function secureBuildDevVars(workerDir) {
+  const path = join16(workerDir, ".dev.vars");
+  if (!existsSync14(path)) return false;
+  const stat = lstatSync2(path);
+  if (!stat.isFile() || stat.isSymbolicLink()) {
+    throw new Error(`Refusing unsafe build secret path: ${path}`);
+  }
+  chmodSync2(path, 384);
+  return true;
+}
 function declaredCompatibilityDate(config) {
   const declared = config.compatibility_date;
   return typeof declared === "string" && /^\d{4}-\d{2}-\d{2}$/.test(declared) ? declared : null;
 }
 async function buildDeployBundle(options) {
-  const { appDir, appName, envName, sharedDevVarsCache, output, spinner: spinner2 } = options;
+  const { appDir, appName, envName, output, spinner: spinner2 } = options;
   const junk = removeMacosJunk(appDir);
   if (junk > 0) p6.log.info(`Removed ${junk} macOS metadata file(s) (._*, .DS_Store)`);
   const lintFindings = await lintProjectSchemas(appDir);
@@ -4288,9 +4395,7 @@ async function buildDeployBundle(options) {
   spinner2.start("Building...");
   let preparedWranglerConfig;
   try {
-    preparedWranglerConfig = prepareWranglerEnvConfig(appDir, envName, {
-      sharedDevVarsCache
-    });
+    preparedWranglerConfig = prepareWranglerEnvConfig(appDir, envName);
     const appDomain = DEEPSPACE_ENV === "staging" ? "spacestest.com" : "app.space";
     execSync2("npx vite build", {
       cwd: appDir,
@@ -4311,18 +4416,18 @@ async function buildDeployBundle(options) {
   }
   spinner2.stop("Built");
   const deployConfigPath = join16(appDir, ".wrangler", "deploy", "config.json");
-  if (!existsSync15(deployConfigPath)) {
+  if (!existsSync14(deployConfigPath)) {
     output.die(
       "Build output config not found at .wrangler/deploy/config.json",
       "build_output_missing"
     );
   }
-  const deployConfig = JSON.parse(readFileSync18(deployConfigPath, "utf-8"));
+  const deployConfig = JSON.parse(readFileSync17(deployConfigPath, "utf-8"));
   const outputWranglerPath = resolve11(dirname6(deployConfigPath), deployConfig.configPath);
-  if (!existsSync15(outputWranglerPath)) {
+  if (!existsSync14(outputWranglerPath)) {
     output.die(`Output wrangler.json not found at ${outputWranglerPath}`, "build_output_missing");
   }
-  const outputConfig = JSON.parse(readFileSync18(outputWranglerPath, "utf-8"));
+  const outputConfig = JSON.parse(readFileSync17(outputWranglerPath, "utf-8"));
   if (outputConfig.name && outputConfig.name !== appName) {
     const envHint = envName ? ` (--env ${envName})` : "";
     output.die(
@@ -4331,12 +4436,17 @@ async function buildDeployBundle(options) {
     );
   }
   const workerDir = dirname6(outputWranglerPath);
+  try {
+    secureBuildDevVars(workerDir);
+  } catch (error) {
+    output.die(errorMessage(error), "build_output_unsafe");
+  }
   const workerBundlePath = join16(workerDir, outputConfig.main);
   const clientDir = outputConfig.assets?.directory ? resolve11(workerDir, outputConfig.assets.directory) : null;
-  if (!existsSync15(workerBundlePath)) {
+  if (!existsSync14(workerBundlePath)) {
     output.die(`Worker bundle not found at ${workerBundlePath}`, "build_output_missing");
   }
-  if (!clientDir || !existsSync15(clientDir)) {
+  if (!clientDir || !existsSync14(clientDir)) {
     return output.die(`Client assets not found at ${clientDir}`, "build_output_missing");
   }
   try {
@@ -4349,7 +4459,7 @@ async function buildDeployBundle(options) {
   const assets = collectAssets(clientDir);
   const assetConfig = readDeployAssetConfig(clientDir);
   spinner2.stop(`Collected ${assets.length} assets`);
-  const workerJs = readFileSync18(workerBundlePath, "utf-8");
+  const workerJs = readFileSync17(workerBundlePath, "utf-8");
   const doBindings = outputConfig.durable_objects?.bindings;
   const sqliteClasses = new Set(
     outputConfig.migrations?.flatMap((migration) => migration.new_sqlite_classes ?? []) ?? []
@@ -4428,7 +4538,7 @@ function collectAssets(dir) {
       if (entry.isDirectory()) {
         walk(fullPath, relativePath);
       } else {
-        const bytes = readFileSync18(fullPath);
+        const bytes = readFileSync17(fullPath);
         assets.push({
           path: `/${relativePath}`,
           hash: createHash2("sha256").update(bytes).digest("hex"),
@@ -4443,10 +4553,13 @@ function collectAssets(dir) {
 }
 function readDeployAssetConfig(clientDir) {
   const config = {};
-  for (const [file, key] of [["_headers", "_headers"], ["_redirects", "_redirects"]]) {
+  for (const [file, key] of [
+    ["_headers", "_headers"],
+    ["_redirects", "_redirects"]
+  ]) {
     const filePath = join16(clientDir, file);
-    if (!existsSync15(filePath)) continue;
-    const content = readFileSync18(filePath, "utf8");
+    if (!existsSync14(filePath)) continue;
+    const content = readFileSync17(filePath, "utf8");
     if (content.trim()) config[key] = content;
   }
   return config;
@@ -4460,7 +4573,7 @@ function errorMessage(error) {
 
 // src/cli/commands/deploy/commerce.ts
 import * as p7 from "@clack/prompts";
-import { existsSync as existsSync16 } from "fs";
+import { existsSync as existsSync15 } from "fs";
 import { join as join17 } from "path";
 import { pathToFileURL as pathToFileURL2 } from "url";
 var API_URL2 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
@@ -4469,7 +4582,7 @@ function errorMessage2(error) {
 }
 async function loadDeclaration(appDir, sourceFile, outputFile, exportName) {
   const sourcePath = join17(appDir, "src", sourceFile);
-  if (!existsSync16(sourcePath)) return void 0;
+  if (!existsSync15(sourcePath)) return void 0;
   const esbuild = await import("esbuild");
   const outputPath = join17(appDir, ".wrangler", "deploy", outputFile);
   await esbuild.build({
@@ -4564,7 +4677,7 @@ Stripe will keep charging them until you cancel. Cancel at the end of their curr
   }
 }
 async function syncSubscriptionPlans(appDir, appName, token, nonInteractive) {
-  if (!existsSync16(join17(appDir, "src", "subscriptions.ts"))) return;
+  if (!existsSync15(join17(appDir, "src", "subscriptions.ts"))) return;
   let plans;
   try {
     plans = await loadDeclaration(
@@ -4601,7 +4714,7 @@ async function syncSubscriptionPlans(appDir, appName, token, nonInteractive) {
     spinner2.stop(`Synced ${plans.length} plan${plans.length === 1 ? "" : "s"} to Stripe`);
     if (body.connectMissing) {
       p7.log.warn(
-        "Stripe Connect not yet set up. Customers can subscribe and earnings will queue in your platform balance until you finish onboarding at /earnings on the dashboard. The first payout after you connect will sweep everything that accumulated in the meantime."
+        "Stripe Connect is not ready. Paid checkout will remain unavailable until the app owner finishes onboarding at /earnings on the dashboard."
       );
     }
     const changes = (body.planChanges ?? []).filter((change) => change.affectedSubscribers > 0);
@@ -4619,7 +4732,7 @@ async function syncSubscriptionPlans(appDir, appName, token, nonInteractive) {
   }
 }
 async function syncOneTimeProducts(appDir, appName, token) {
-  if (!existsSync16(join17(appDir, "src", "products.ts"))) return;
+  if (!existsSync15(join17(appDir, "src", "products.ts"))) return;
   let products;
   try {
     products = await loadDeclaration(
@@ -4721,7 +4834,7 @@ function createDeployOutput(json) {
 
 // src/cli/commands/deploy/request.ts
 import * as p10 from "@clack/prompts";
-import { readFileSync as readFileSync19 } from "fs";
+import { readFileSync as readFileSync18 } from "fs";
 
 // src/cli/commands/deploy/repository.ts
 import * as p9 from "@clack/prompts";
@@ -4912,7 +5025,7 @@ function repoApi(deployUrl, token, appId) {
 }
 
 // src/cli/lib/vc-remote.ts
-import { existsSync as existsSync17 } from "fs";
+import { existsSync as existsSync16 } from "fs";
 import { tmpdir } from "os";
 import { isAbsolute as isAbsolute3, relative, resolve as resolve12 } from "path";
 function spaceRemoteName(environment = DEEPSPACE_ENV) {
@@ -4967,7 +5080,7 @@ function helperEntryUsable(command) {
   const match = /^!(?:DEEPSPACE_ENV=(production|staging) )?'([^']*)' '([^']*)' git-credential$/.exec(command);
   const expectedEnvironment = DEEPSPACE_ENV === "production" ? void 0 : DEEPSPACE_ENV;
   if (!match || match[1] !== expectedEnvironment) return false;
-  return existsSync17(match[2]) && existsSync17(match[3]);
+  return existsSync16(match[2]) && existsSync16(match[3]);
 }
 function credentialHelperCommand(environment = DEEPSPACE_ENV) {
   const entry = process.argv[1];
@@ -5242,7 +5355,16 @@ function selectGitHubRemote(cwd, options = {}) {
   return matching.find((remote) => remote.name === "origin") ?? (matching.length === 1 ? matching[0] : null);
 }
 function remotePublicRefs(cwd, remote) {
-  const output = runGit(cwd, ["ls-remote", "--refs", remote]).stdout.toString("utf-8");
+  let output;
+  try {
+    output = runGit(cwd, ["ls-remote", "--refs", remote]).stdout.toString("utf-8");
+  } catch (error) {
+    if (!isGitCredentialFailure(error)) throw error;
+    throw new GitError(
+      "Git could not authenticate the remote. In a container, forward an SSH agent or use an ephemeral Git credential helper, then retry. Do not put tokens in remote URLs.",
+      "github_credentials_required"
+    );
+  }
   return output.split("\n").map((line) => line.trim()).filter(Boolean).map((line) => {
     const [oid, name] = line.split(/\s+/, 2);
     return { oid, name };
@@ -5250,6 +5372,12 @@ function remotePublicRefs(cwd, remote) {
     (ref) => /^[0-9a-f]{40}$/.test(ref.oid) && (ref.name.startsWith("refs/heads/") || ref.name.startsWith("refs/tags/"))
   );
 }
+function isGitCredentialFailure(error) {
+  if (!(error instanceof Error)) return false;
+  return /authentication failed|could not read username|permission denied \(publickey\)|repository not found|terminal prompts disabled/i.test(
+    error.message
+  );
+}
 function remoteBranchOid(cwd, remote, branch) {
   return remotePublicRefs(cwd, remote).find((ref) => ref.name === `refs/heads/${branch}`)?.oid ?? null;
 }
@@ -5291,6 +5419,25 @@ function setAppSource(deployUrl, token, appId, input) {
 }
 
 // src/cli/commands/deploy/repository.ts
+function preflightDeployRepository(options) {
+  const { appDir, push, source } = options;
+  if (!push || source?.provider === "github") return null;
+  try {
+    assertSyncableRepo(appDir);
+    if (!source && listGitHubRemotes(appDir).length > 0) {
+      return {
+        code: "source_unclaimed",
+        error: "This app has a GitHub remote but no claimed source. Choose once with `deepspace app source github` (manual GitHub ownership) or `deepspace app source deepspace` (packaged DeepSpace source), then deploy again."
+      };
+    }
+    const branch = currentBranch(appDir);
+    if (!isWorkTreeClean(appDir)) return dirtyWorktreeRefusal(branch);
+    if (!branch) return detachedHeadRefusal();
+    return null;
+  } catch (error) {
+    return deployRepositoryFailure(error, appDir);
+  }
+}
 async function syncDeployRepository(options) {
   const { deployUrl, appDir, appId, token, push, ignoreStale, output, sourceState } = options;
   let commitOid = null;
@@ -5311,21 +5458,12 @@ async function syncDeployRepository(options) {
     return { commitOid, recoverable, deployKey, source, sourceRevision, baseReleaseId };
   }
   try {
-    assertSyncableRepo(appDir);
-    if (!source && listGitHubRemotes(appDir).length > 0) {
-      output.die(
-        "This app has a GitHub remote but no claimed source. Choose once with `deepspace app source github` (manual GitHub ownership) or `deepspace app source deepspace` (packaged DeepSpace source), then deploy again.",
-        "source_unclaimed"
-      );
-    }
+    const preflight = preflightDeployRepository({ appDir, push, source });
+    if (preflight) output.die(preflight.error, preflight.code);
     const sourceRemote = spaceRemoteName();
     ensureSpaceRemote(appDir, appId, sourceRemote);
     const branch = currentBranch(appDir);
     const workspaceBranchId = workspaceIdFromBranch(branch);
-    if (!isWorkTreeClean(appDir)) {
-      const refusal = dirtyWorktreeRefusal(branch);
-      output.die(refusal.error, refusal.code);
-    }
     if (!branch) {
       const refusal = detachedHeadRefusal();
       output.die(refusal.error, refusal.code);
@@ -5427,12 +5565,7 @@ function classifyRemoteState(appDir, token, branch, localTip, remote) {
   let remoteTip = null;
   const remoteRef = `refs/remotes/${remote}/${branch}`;
   try {
-    runGitRemote(appDir, token, [
-      "fetch",
-      "--quiet",
-      remote,
-      `+refs/heads/${branch}:${remoteRef}`
-    ]);
+    runGitRemote(appDir, token, ["fetch", "--quiet", remote, `+refs/heads/${branch}:${remoteRef}`]);
     remoteTip = resolveCommit(appDir, remoteRef);
     return {
       remoteTip,
@@ -5554,7 +5687,7 @@ async function deployBuiltBundle(options) {
     if (bundle.customBindings.length) {
       form.append("bindingManifest", JSON.stringify(bundle.customBindings));
     }
-    if (secrets.names.length) form.append("userSecrets", JSON.stringify(secrets.values));
+    if (secrets.authoritative) form.append("userSecrets", JSON.stringify(secrets.values));
     if (bundle.extraRoutes === true || bundle.extraRoutes.length) {
       form.append("extraRunWorkerFirst", JSON.stringify(bundle.extraRoutes));
     }
@@ -5746,7 +5879,7 @@ async function uploadDeployAssets(options) {
           // against the plan before it touches storage, and a stream body
           // would be sent chunked with no length at all; a retry also needs a
           // body it can send again.
-          body: readFileSync19(asset.sourcePath)
+          body: readFileSync18(asset.sourcePath)
         })
       );
       if (!response.ok) {
@@ -5762,9 +5895,7 @@ async function uploadDeployAssets(options) {
     }
   };
   try {
-    await Promise.all(
-      Array.from({ length: Math.min(UPLOAD_CONCURRENCY, missing.length) }, worker)
-    );
+    await Promise.all(Array.from({ length: Math.min(UPLOAD_CONCURRENCY, missing.length) }, worker));
   } catch (error) {
     spinner2.stop("Deploy failed");
     if (error instanceof AssetUploadError) {
@@ -5833,35 +5964,17 @@ async function postWithRetry(url, makeInit, {
 
 // src/cli/commands/deploy/secrets.ts
 import * as p11 from "@clack/prompts";
-import { existsSync as existsSync18, readFileSync as readFileSync20 } from "fs";
-function classifyDevVarsSecrets(options) {
-  const store = new Set(options.storeSecretNames);
-  const strayKeys = options.handEditedDevVarKeys.filter((key) => !store.has(key));
-  if (strayKeys.length === 0) return { kind: "ok" };
-  if (options.storeSecretNames.length === 0 && !options.allowMissing) {
-    return { kind: "block", strayKeys };
-  }
-  return { kind: "warn", strayKeys };
-}
 async function loadDeploySecrets(options) {
   const { deployUrl, appDir, appId, envName, ownerId, token, output } = options;
   let linked = null;
-  let localOnlyDevVars = {};
   try {
     const refreshed = await refreshSecretsCache(deployUrl, token, appId, envName);
-    if (refreshed) {
-      linked = refreshed.pulled;
-      localOnlyDevVars = readCustomDevVars(
-        devVarsPathFor(appDir, envName, { sharedDevVarsCache: true }),
-        output
-      );
-      await writeDevVars(appDir, ownerId, token, envName, {
-        appId,
-        generatedSecretsCache: refreshed.rendered,
-        sharedDevVarsCache: true
-      });
-      if (refreshed.summary) p11.log.info(refreshed.summary);
-    }
+    linked = refreshed.pulled;
+    await writeDevVars(appDir, ownerId, token, envName, {
+      appId,
+      generatedSecretsCache: refreshed.rendered
+    });
+    if (refreshed.summary) p11.log.info(refreshed.summary);
   } catch (error) {
     if (error?.status === 403) {
       output.die(
@@ -5874,40 +5987,31 @@ async function loadDeploySecrets(options) {
       "secrets_refresh_failed"
     );
   }
-  return { linked, localOnlyDevVars };
-}
-function prepareDeploySecrets(options) {
-  const { appDir, envName, cache, allowMissing, customBindings, doManifest, output } = options;
-  const values = cache.linked ? { ...cache.linked.values } : {};
-  const devVarsPath = devVarsPathFor(appDir, envName, {
-    sharedDevVarsCache: cache.linked !== null
-  });
-  const handEditedDevVars = cache.linked ? cache.localOnlyDevVars : readCustomDevVars(devVarsPath, output);
-  const decision = classifyDevVarsSecrets({
-    storeSecretNames: Object.keys(values),
-    handEditedDevVarKeys: Object.keys(handEditedDevVars),
-    allowMissing
-  });
-  if (decision.kind === "block") {
-    const uploadArgv = [
-      "deepspace",
-      "secrets",
-      "upload",
-      ".dev.vars",
-      ...envName ? ["-e", envName] : []
-    ];
+  if (!linked) {
+    const configName = defaultConfigNameForEnv(envName);
     output.die(
-      `Refusing to deploy: the app store has no secrets, but .dev.vars has ${decision.strayKeys.join(", ")}. Deploying now would ship the app with no secrets \u2014 replacing any secrets a previous deploy set (they would be dropped from production). Upload them first, then redeploy. (Pass --allow-missing-secrets to deploy without them.)`,
-      "secrets_not_uploaded",
-      { action: { cwd: appDir, argv: uploadArgv } }
-    );
-  }
-  if (decision.kind === "warn") {
-    const stray = decision.strayKeys;
-    p11.log.warn(
-      `.dev.vars has ${stray.join(", ")} not in the app store \u2014 ${stray.length === 1 ? "it is" : "they are"} NOT deployed. \`.dev.vars\` is a local dev cache, not deploy config. Move ${stray.length === 1 ? "it" : "them"} into the store with \`deepspace secrets set KEY=value\` (or \`deepspace secrets upload .dev.vars\`), then redeploy.`
+      `Secrets config "${configName}" does not exist. Create it explicitly before deploying; this distinguishes an intentional empty config from an uninitialized app and protects live Worker secrets during the platform rollout.`,
+      "secrets_config_missing",
+      {
+        action: {
+          cwd: appDir,
+          argv: [
+            "deepspace",
+            "secrets",
+            "configs",
+            "create",
+            configName,
+            ...envName ? ["--env", envName] : []
+          ]
+        }
+      }
     );
   }
+  return { linked };
+}
+function prepareDeploySecrets(options) {
+  const { cache, customBindings, doManifest, output } = options;
+  const values = cache.linked ? { ...cache.linked.values } : {};
   const names = Object.keys(values);
   const declaredBindingNames = /* @__PURE__ */ new Set([
     ...customBindings.map((binding) => binding.name),
@@ -5928,17 +6032,7 @@ function prepareDeploySecrets(options) {
     }
   }
   if (names.length) p11.log.info(`App secrets: ${names.join(", ")}`);
-  return { values, names };
-}
-function readCustomDevVars(path, output) {
-  if (!existsSync18(path)) return {};
-  const section = extractCustomDevVars(stripGeneratedSecretsCache(readFileSync20(path, "utf-8")));
-  if (!section) return {};
-  try {
-    return parseDevVars(section);
-  } catch (error) {
-    output.die(`.dev.vars: ${errorMessage5(error)}`, "invalid_dev_vars");
-  }
+  return { values, names, authoritative: cache.linked !== null };
 }
 function errorMessage5(error) {
   return error instanceof Error ? error.message : String(error);
@@ -5977,11 +6071,6 @@ var deploy_default = defineCommand3({
       description: "Platform admins only: claim an app name still inside its 30-day release cooldown. The previous owner permanently loses their reserved reclaim. Non-admin accounts are refused.",
       default: false
     },
-    "allow-missing-secrets": {
-      type: "boolean",
-      description: "Deploy even though hand-edited .dev.vars secrets are absent from the store (they will NOT be deployed, and any a previous deploy set are dropped).",
-      default: false
-    },
     // Citty maps --no-push to the negation of an argument named `push`.
     push: {
       type: "boolean",
@@ -6050,12 +6139,19 @@ var deploy_default = defineCommand3({
       output
     });
     const sourceState = await getAppSource(DEPLOY_URL3, token, appId);
+    const repositoryPreflight = preflightDeployRepository({
+      appDir,
+      push: args.push !== false,
+      source: sourceState.source
+    });
+    if (repositoryPreflight) {
+      output.die(repositoryPreflight.error, repositoryPreflight.code);
+    }
     const spinner2 = createSpinner();
     const bundle = await buildDeployBundle({
       appDir,
       appName,
       envName,
-      sharedDevVarsCache: secretsCache.linked !== null,
       output,
       spinner: spinner2
     });
@@ -6075,10 +6171,7 @@ var deploy_default = defineCommand3({
       sourceState
     });
     const secrets = prepareDeploySecrets({
-      appDir,
-      envName,
       cache: secretsCache,
-      allowMissing: Boolean(args["allow-missing-secrets"]),
       customBindings: bundle.customBindings,
       doManifest: bundle.doManifest,
       output
@@ -6516,11 +6609,17 @@ function parseSince(input, now = Date.now()) {
   } else {
     ts = Date.parse(trimmed);
     if (Number.isNaN(ts)) {
-      throw new InputError(`Invalid --since "${input}" \u2014 use 30s, 15m, 2h, 7d, or an ISO timestamp.`, "invalid_since");
+      throw new InputError(
+        `Invalid --since "${input}" \u2014 use 30s, 15m, 2h, 7d, or an ISO timestamp.`,
+        "invalid_since"
+      );
     }
   }
   if (now - ts > RETENTION_MS) {
-    throw new InputError("Logs are retained for 7 days \u2014 --since can reach back at most 7d.", "since_out_of_range");
+    throw new InputError(
+      "Logs are retained for 7 days \u2014 --since can reach back at most 7d.",
+      "since_out_of_range"
+    );
   }
   return ts;
 }
@@ -6651,13 +6750,19 @@ var logs_default = defineCommand4({
     const token = await ensureToken();
     const appId = await resolveAppTarget(DEPLOY_URL6, token, args.app, { wranglerEnv: envArg });
     if (args.level && !LOG_LEVELS.includes(args.level)) {
-      throw new InputError(`Invalid --level "${args.level}". Use: ${LOG_LEVELS.join(", ")}`, "invalid_level");
+      throw new InputError(
+        `Invalid --level "${args.level}". Use: ${LOG_LEVELS.join(", ")}`,
+        "invalid_level"
+      );
     }
     let limit;
     if (args.limit !== void 0) {
       limit = Number(args.limit);
       if (!Number.isInteger(limit) || limit < 1 || limit > 500) {
-        throw new InputError("Invalid --limit \u2014 expected an integer between 1 and 500.", "invalid_limit");
+        throw new InputError(
+          "Invalid --limit \u2014 expected an integer between 1 and 500.",
+          "invalid_limit"
+        );
       }
     }
     const initialSince = args.since ? parseSince(args.since) : Date.now() - DEFAULT_WINDOW_MS;
@@ -6673,7 +6778,9 @@ var logs_default = defineCommand4({
     };
     const print = (events) => {
       for (const e of events) {
-        process.stdout.write(args.json ? JSON.stringify(e) + "\n" : formatEvent(e, stdoutColor()) + "\n");
+        process.stdout.write(
+          args.json ? JSON.stringify(e) + "\n" : formatEvent(e, stdoutColor()) + "\n"
+        );
       }
     };
     const first = await fetchPage(initialSince, args.follow ? followLimit : limit, token);
@@ -6681,15 +6788,25 @@ var logs_default = defineCommand4({
     if (!args.follow) {
       if (first.events.length === 0) {
         if (args.json) {
-          process.stdout.write(JSON.stringify({ type: "meta", count: 0, window: windowLabel }) + "\n");
+          process.stdout.write(
+            JSON.stringify({ type: "meta", count: 0, window: windowLabel }) + "\n"
+          );
         } else {
           console.log(
             `No logs in the last ${windowLabel} for ${appId}. New logs can take up to a minute to appear; retention is 7 days.`
           );
         }
       } else if (first.truncated) {
-        if (args.json) process.stdout.write(JSON.stringify({ type: "meta", truncated: true }) + "\n");
-        else console.error(`(showing the newest ${first.events.length} events \u2014 narrow with --since/--level/--search)`);
+        if (args.json)
+          process.stdout.write(JSON.stringify({ type: "meta", truncated: true }) + "\n");
+        else if (args.search)
+          console.error(
+            `(showing the newest ${first.events.length} matches \u2014 search scans at most the newest 500 level-filtered events per fetch; narrow with --since/--level or raise --limit)`
+          );
+        else
+          console.error(
+            `(showing the newest ${first.events.length} events \u2014 narrow with --since/--level)`
+          );
       }
       return;
     }
@@ -6709,7 +6826,11 @@ var logs_default = defineCommand4({
         process.stdout.write(JSON.stringify({ type: "meta", truncated: true }) + "\n");
       } else {
         console.error(
-          paint("33", `(more than ${followLimit} events in the initial ${windowLabel} window \u2014 some older events not shown; narrow with --since/--level/--search)`, stderrColor())
+          paint(
+            "33",
+            args.search ? `(search scanned only the newest ${MAX_LIMIT} level-filtered events in the initial ${windowLabel} window \u2014 older matches may be omitted; narrow with --since/--level)` : `(more than ${followLimit} events in the initial ${windowLabel} window \u2014 some older events not shown; narrow with --since/--level)`,
+            stderrColor()
+          )
         );
       }
     }
@@ -6723,21 +6844,27 @@ var logs_default = defineCommand4({
         if (err instanceof ApiError && [401, 403, 404].includes(err.status)) throw err;
         backoff = Math.min(backoff ? backoff * 2 : MIN_POLL_MS, 3e4);
         const msg = err instanceof Error ? err.message : String(err);
-        console.error(paint("2", `(logs fetch failed: ${msg} \u2014 retrying in ${backoff / 1e3}s)`, stderrColor()));
+        console.error(
+          paint("2", `(logs fetch failed: ${msg} \u2014 retrying in ${backoff / 1e3}s)`, stderrColor())
+        );
         continue;
       }
       backoff = 0;
       interval = Math.max(page.pollIntervalMs || 0, MIN_POLL_MS);
       const fresh = seen.fresh(page.events);
       print(fresh);
-      const realDrop = fresh.length >= followLimit;
+      const realDrop = fresh.length >= followLimit || Boolean(args.search && page.truncated);
       if (realDrop && !warnedTruncated) {
         warnedTruncated = true;
         if (args.json) {
           process.stdout.write(JSON.stringify({ type: "meta", truncated: true }) + "\n");
         } else {
           console.error(
-            paint("33", `(burst exceeded ${followLimit} events/poll \u2014 some may be dropped; narrow with --level/--search)`, stderrColor())
+            paint(
+              "33",
+              args.search ? `(search scanned only the newest ${MAX_LIMIT} level-filtered events this poll \u2014 older matches may be omitted; narrow with --level)` : `(burst exceeded ${followLimit} events/poll \u2014 some may be dropped; narrow with --level)`,
+              stderrColor()
+            )
           );
         }
       } else if (!realDrop) {
@@ -6818,7 +6945,7 @@ var usage_default = defineDeepspaceCommand({
 });
 
 // src/cli/commands/add.ts
-import { existsSync as existsSync20, readFileSync as readFileSync22, realpathSync as realpathSync4 } from "fs";
+import { existsSync as existsSync18, readFileSync as readFileSync20, realpathSync as realpathSync4 } from "fs";
 import { dirname as dirname8, join as join19, resolve as resolve15 } from "path";
 import { pathToFileURL as pathToFileURL3 } from "url";
 
@@ -6826,12 +6953,12 @@ import { pathToFileURL as pathToFileURL3 } from "url";
 import {
   closeSync as closeSync2,
   copyFileSync,
-  existsSync as existsSync19,
+  existsSync as existsSync17,
   fstatSync as fstatSync2,
   mkdirSync as mkdirSync6,
   mkdtempSync,
   openSync as openSync2,
-  readFileSync as readFileSync21,
+  readFileSync as readFileSync19,
   readSync,
   readdirSync as readdirSync5,
   rmSync as rmSync4,
@@ -6846,9 +6973,9 @@ function featurePackageRoot(moduleUrl = import.meta.url) {
   let dir = dirname7(fileURLToPath(moduleUrl));
   for (; ; ) {
     const packagePath = join18(dir, "package.json");
-    if (existsSync19(packagePath)) {
+    if (existsSync17(packagePath)) {
       try {
-        const pkg2 = JSON.parse(readFileSync21(packagePath, "utf-8"));
+        const pkg2 = JSON.parse(readFileSync19(packagePath, "utf-8"));
         if (pkg2.name === "deepspace") return dir;
       } catch {
       }
@@ -6859,13 +6986,13 @@ function featurePackageRoot(moduleUrl = import.meta.url) {
   }
 }
 function hasFeatureCatalog(packageRoot = featurePackageRoot()) {
-  return existsSync19(join18(packageRoot, "features"));
+  return existsSync17(join18(packageRoot, "features"));
 }
 function readFeatureConfig(id, packageRoot = featurePackageRoot()) {
   const configPath = join18(packageRoot, "features", id, "feature.json");
-  if (!existsSync19(configPath)) return null;
+  if (!existsSync17(configPath)) return null;
   try {
-    const config = JSON.parse(readFileSync21(configPath, "utf-8"));
+    const config = JSON.parse(readFileSync19(configPath, "utf-8"));
     if (typeof config.id !== "string" || typeof config.name !== "string" || !Array.isArray(config.files)) {
       return null;
     }
@@ -6876,7 +7003,7 @@ function readFeatureConfig(id, packageRoot = featurePackageRoot()) {
 }
 function listFeatureConfigs(packageRoot = featurePackageRoot()) {
   const featuresDir = join18(packageRoot, "features");
-  if (!existsSync19(featuresDir)) return [];
+  if (!existsSync17(featuresDir)) return [];
   return readdirSync5(featuresDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => readFeatureConfig(entry.name, packageRoot)).filter((config) => config !== null && !config.internal).sort((a, b) => a.id.localeCompare(b.id));
 }
 function featureCatalog(packageRoot = featurePackageRoot()) {
@@ -6930,7 +7057,7 @@ function copyFile(src, dest) {
 function copyFileWithImportShift(src, dest, levels) {
   mkdirSync6(dirname7(dest), { recursive: true });
   const prefix = "../".repeat(levels);
-  const shifted = readFileSync21(src, "utf-8").replace(
+  const shifted = readFileSync19(src, "utf-8").replace(
     /(from\s+|import\s+|import\()(['"])(\.\.\/)/g,
     `$1$2${prefix}$3`
   );
@@ -6946,9 +7073,9 @@ function installFiles(packageRoot, config, targetDir, emit) {
     const srcPath = join18(packageRoot, "features", config.id, file.src);
     const resolvedDest = resolveFeatureDestPath(file.dest, config.route);
     const destPath = join18(targetDir, resolvedDest);
-    const existed = existsSync19(destPath);
+    const existed = existsSync17(destPath);
     if (existed) preexisting.push(resolvedDest);
-    if (!existsSync19(srcPath)) {
+    if (!existsSync17(srcPath)) {
       emit(`   Warning: source not found: ${file.src}`, "stderr");
       if (!existed) missing.push(resolvedDest);
       continue;
@@ -6986,10 +7113,10 @@ function unresolvedSchema(schema, reason, emit) {
 function integrateSchema(config, targetDir, emit) {
   if (!config.schema) return [];
   const schemasPath = join18(targetDir, "src", "schemas.ts");
-  if (!existsSync19(schemasPath)) {
+  if (!existsSync17(schemasPath)) {
     return [unresolvedSchema(config.schema, "src/schemas.ts was not found.", emit)];
   }
-  let content = readFileSync21(schemasPath, "utf-8");
+  let content = readFileSync19(schemasPath, "utf-8");
   const { exportName, importPath, spreadOperator } = config.schema;
   const importPattern = new RegExp(`^import\\s+\\{[^}]*\\b${exportName}\\b`, "m");
   if (importPattern.test(content)) {
@@ -7043,10 +7170,10 @@ function unresolvedActions(actions, reason, emit) {
 function integrateActions(config, targetDir, emit) {
   if (!config.actions?.length) return [];
   const actionsPath = join18(targetDir, "src", "actions", "index.ts");
-  if (!existsSync19(actionsPath)) {
+  if (!existsSync17(actionsPath)) {
     return [unresolvedActions(config.actions, "src/actions/index.ts was not found.", emit)];
   }
-  let content = readFileSync21(actionsPath, "utf-8");
+  let content = readFileSync19(actionsPath, "utf-8");
   const registryPattern = /export const actions:\s*Record<string,\s*ActionHandler(?:<[^>]*>)?>\s*=\s*\{/;
   if (!registryPattern.test(content)) {
     const reason = "src/actions/index.ts has an unexpected structure.";
@@ -7093,7 +7220,7 @@ function integrateCode(config, targetDir, emit) {
   const unresolved = [];
   for (const insertion of config.code ?? []) {
     const targetPath = join18(targetDir, insertion.file);
-    if (!existsSync19(targetPath)) {
+    if (!existsSync17(targetPath)) {
       unresolved.push({
         area: "code",
         reason: `${insertion.file} was not found.`,
@@ -7101,7 +7228,7 @@ function integrateCode(config, targetDir, emit) {
       });
       continue;
     }
-    const original = readFileSync21(targetPath, "utf-8");
+    const original = readFileSync19(targetPath, "utf-8");
     if (original.includes(insertion.insert.trim())) {
       emit(`   Integration already present: ${insertion.file}`);
       continue;
@@ -7137,7 +7264,7 @@ ${content.slice(importIndex < 0 ? 0 : importIndex)}`;
 function integrateIgnore(config, targetDir) {
   if (!config.ignore?.length) return;
   const targetPath = join18(targetDir, ".gitignore");
-  const current = existsSync19(targetPath) ? readFileSync21(targetPath, "utf-8") : "";
+  const current = existsSync17(targetPath) ? readFileSync19(targetPath, "utf-8") : "";
   const present = new Set(current.split(/\r?\n/).map((line) => line.trim()));
   const missing = config.ignore.filter((pattern) => !present.has(pattern));
   if (missing.length === 0) return;
@@ -7154,10 +7281,10 @@ function integrateWrangler(config, targetDir, emit) {
     ...runWorkerFirst ? ["Set assets.run_worker_first = true in wrangler.toml."] : [],
     ...rateLimits.map((binding) => `Add the ${binding.name} rate-limit binding to wrangler.toml.`)
   ];
-  if (!existsSync19(targetPath)) {
+  if (!existsSync17(targetPath)) {
     return [{ area: "wrangler", reason: "wrangler.toml was not found.", steps }];
   }
-  let source = readFileSync21(targetPath, "utf-8");
+  let source = readFileSync19(targetPath, "utf-8");
   if (runWorkerFirst && !/^\[assets\]\s*$/m.test(source)) {
     return [{ area: "wrangler", reason: "wrangler.toml has no [assets] section.", steps }];
   }
@@ -7234,7 +7361,7 @@ function rateLimitBindingBlock(scope, binding) {
 function integrateCss(packageRoot, config, targetDir, emit) {
   if (!config.css?.length) return [];
   const stylesPath = join18(targetDir, "src", "styles.css");
-  if (!existsSync19(stylesPath)) {
+  if (!existsSync17(stylesPath)) {
     emit("   Warning: Cannot integrate CSS \u2014 src/styles.css not found");
     return [
       {
@@ -7246,12 +7373,12 @@ function integrateCss(packageRoot, config, targetDir, emit) {
       }
     ];
   }
-  let styles = readFileSync21(stylesPath, "utf-8");
+  let styles = readFileSync19(stylesPath, "utf-8");
   let integrated = 0;
   const unresolved = [];
   for (const cssFile of config.css) {
     const srcPath = join18(packageRoot, "features", config.id, cssFile);
-    if (!existsSync19(srcPath)) {
+    if (!existsSync17(srcPath)) {
       emit(`   Warning: CSS source not found: ${cssFile}`, "stderr");
       unresolved.push({
         area: "css",
@@ -7260,7 +7387,7 @@ function integrateCss(packageRoot, config, targetDir, emit) {
       });
       continue;
     }
-    const css = readFileSync21(srcPath, "utf-8");
+    const css = readFileSync19(srcPath, "utf-8");
     const fingerprint = css.match(/\.([\w-]+)\s*\{|@keyframes\s+([\w-]+)/);
     const marker = fingerprint?.[1] ?? fingerprint?.[2];
     if (marker && styles.includes(marker)) {
@@ -7288,10 +7415,10 @@ function unresolvedRoute(route, config, reason, emit) {
 function integrateRoute(config, targetDir, emit) {
   if (!config.route) return [];
   const navPath = join18(targetDir, "src", "nav.ts");
-  if (!existsSync19(navPath)) {
+  if (!existsSync17(navPath)) {
     return [unresolvedRoute(config.route, config, "src/nav.ts was not found.", emit)];
   }
-  let content = readFileSync21(navPath, "utf-8");
+  let content = readFileSync19(navPath, "utf-8");
   const routePath = config.route.path;
   if (content.includes(`'${routePath}'`)) {
     emit(`   Nav already present: ${routePath}`);
@@ -7366,13 +7493,13 @@ function integrateDependencies(config, targetDir, runInstall, outputVisible, emi
     return { added: [], installRan: false, packageManager };
   }
   const packagePath = join18(targetDir, "package.json");
-  if (!existsSync19(packagePath)) {
+  if (!existsSync17(packagePath)) {
     emit("   Could not patch package.json (file not found)");
     return { added: [], installRan: false, packageManager };
   }
   let pkg2;
   try {
-    pkg2 = JSON.parse(readFileSync21(packagePath, "utf-8"));
+    pkg2 = JSON.parse(readFileSync19(packagePath, "utf-8"));
   } catch (error) {
     emit(
       `   Could not patch package.json (parse error: ${error instanceof Error ? error.message : String(error)})`
@@ -7432,7 +7559,7 @@ ${child.diagnosticTail}` : "";
 }
 function dependencySnapshot(targetDir) {
   try {
-    const pkg2 = JSON.parse(readFileSync21(join18(targetDir, "package.json"), "utf-8"));
+    const pkg2 = JSON.parse(readFileSync19(join18(targetDir, "package.json"), "utf-8"));
     return {
       dependencies: pkg2.dependencies ?? {},
       devDependencies: pkg2.devDependencies ?? {}
@@ -7444,7 +7571,7 @@ function dependencySnapshot(targetDir) {
 function installedNavFeatures(packageRoot, targetDir) {
   return listFeatureConfigs(packageRoot).filter((feature) => feature.category === "nav" && feature.files.length > 0).filter((feature) => {
     const signature = resolveFeatureDestPath(feature.files[0].dest, feature.route);
-    return existsSync19(join18(targetDir, signature));
+    return existsSync17(join18(targetDir, signature));
   }).map((feature) => feature.id);
 }
 function warnNavConflicts(packageRoot, config, targetDir, emit) {
@@ -7677,11 +7804,11 @@ function renderFeatureInfo(config) {
   return lines.join("\n");
 }
 function isDeepSpaceApp(dir) {
-  if (existsSync20(join19(dir, "wrangler.toml"))) return true;
+  if (existsSync18(join19(dir, "wrangler.toml"))) return true;
   const packagePath = join19(dir, "package.json");
-  if (!existsSync20(packagePath)) return false;
+  if (!existsSync18(packagePath)) return false;
   try {
-    const pkg2 = JSON.parse(readFileSync22(packagePath, "utf-8"));
+    const pkg2 = JSON.parse(readFileSync20(packagePath, "utf-8"));
     return Boolean(pkg2.dependencies?.deepspace || pkg2.devDependencies?.deepspace);
   } catch {
     return false;
@@ -7691,7 +7818,7 @@ function installedPackageRoot(fromDir) {
   let dir = fromDir;
   for (; ; ) {
     const candidate = join19(dir, "node_modules", "deepspace");
-    if (existsSync20(join19(candidate, "package.json"))) return candidate;
+    if (existsSync18(join19(candidate, "package.json"))) return candidate;
     const parent = dirname8(dir);
     if (parent === dir) return null;
     dir = parent;
@@ -7710,7 +7837,7 @@ async function targetInstaller(appDir) {
   }
   const entry = join19(installedRoot, "dist", "feature-installer.js");
   const catalog = join19(installedRoot, "features");
-  if (!existsSync20(entry) || !existsSync20(catalog)) {
+  if (!existsSync18(entry) || !existsSync18(catalog)) {
     throw new Refusal(
       `The app's installed deepspace package does not contain the typed feature installer.
 Expected: ${entry}
@@ -7803,7 +7930,7 @@ var add_default = defineDeepspaceCommand({
       return { data: { features: featureCatalog(root) } };
     }
     const appDir = resolve15(args.dir ?? ".");
-    if (!existsSync20(appDir)) {
+    if (!existsSync18(appDir)) {
       throw new Refusal(
         `Target directory not found: ${appDir}
 Create a new app first: deepspace app create <name>`,
@@ -8179,7 +8306,7 @@ var domain_default = defineCommand5({
 // src/cli/commands/app-files.ts
 import { defineCommand as defineCommand6 } from "citty";
 import { basename as basename4, resolve as resolve16 } from "path";
-import { existsSync as existsSync21, statSync as statSync2 } from "fs";
+import { existsSync as existsSync19, statSync as statSync2 } from "fs";
 
 // src/cli/lib/app-files-api.ts
 import { createWriteStream, openAsBlob, statSync } from "fs";
@@ -8450,7 +8577,7 @@ var put = defineDeepspaceCommand({
   },
   async run({ args }) {
     const localPath = resolve16(String(args.file));
-    if (!existsSync21(localPath) || !statSync2(localPath).isFile()) {
+    if (!existsSync19(localPath) || !statSync2(localPath).isFile()) {
       throw new Refusal(`No such file: ${args.file}`, "file_not_found");
     }
     const key = requireKey(args.key ?? basename4(localPath));
@@ -8920,7 +9047,7 @@ var transfer_default = defineCommand8({
 import { defineCommand as defineCommand9 } from "citty";
 
 // src/cli/commands/_invoke-impl.ts
-import { readFileSync as readFileSync23 } from "fs";
+import { readFileSync as readFileSync21 } from "fs";
 import * as p15 from "@clack/prompts";
 var API_URL7 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
 var DEFAULT_TIMEOUT_MS = 12e4;
@@ -8961,7 +9088,7 @@ function resolveBody(opts) {
   if (opts.body != null) {
     raw = opts.body;
   } else if (opts.bodyFile != null) {
-    raw = opts.bodyFile === "-" ? readFileSync23(0, "utf-8") : readFileSync23(opts.bodyFile, "utf-8");
+    raw = opts.bodyFile === "-" ? readFileSync21(0, "utf-8") : readFileSync21(opts.bodyFile, "utf-8");
   } else {
     return "{}";
   }
@@ -9240,7 +9367,7 @@ var integrations_default = defineCommand9({
 
 // src/cli/commands/feedback.ts
 import * as p16 from "@clack/prompts";
-import { existsSync as existsSync22, readFileSync as readFileSync24 } from "fs";
+import { existsSync as existsSync20, readFileSync as readFileSync22 } from "fs";
 import { dirname as dirname9, join as join20 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { release } from "os";
@@ -9268,8 +9395,8 @@ function readCliVersion() {
       join20(here, "..", "..", "..", "package.json")
     ];
     for (const path of candidates) {
-      if (!existsSync22(path)) continue;
-      const pkg2 = JSON.parse(readFileSync24(path, "utf-8"));
+      if (!existsSync20(path)) continue;
+      const pkg2 = JSON.parse(readFileSync22(path, "utf-8"));
       if (pkg2.name === "deepspace" && pkg2.version) return pkg2.version;
     }
   } catch {
@@ -9465,7 +9592,7 @@ Context: deepspace ${payload.cliVersion} \xB7 ${payload.nodeVersion} \xB7 ${payl
 
 // src/cli/commands/secrets.ts
 import { defineCommand as defineCommand10 } from "citty";
-import { readFileSync as readFileSync25 } from "fs";
+import { readFileSync as readFileSync23 } from "fs";
 
 // src/cli/lib/citty-args.ts
 function dedupePositionals(bound, rest) {
@@ -9562,7 +9689,7 @@ function ok(json, data, human) {
 function warnIfDebugRoutesEnabled(secrets) {
   if (secrets.ALLOW_DEBUG_ROUTES !== "true") return false;
   console.warn(
-    "\n\u26A0  ALLOW_DEBUG_ROUTES=true exposes an UNAUTHENTICATED debug API on the deployed app \u2014\n   anyone who can reach /api/debug/* can read and mutate any record. Redeploy to apply;\n   `deepspace secrets delete ALLOW_DEBUG_ROUTES` (then redeploy) turns it back off."
+    "\n\u26A0  ALLOW_DEBUG_ROUTES=true enables the owner/admin debug API on the deployed app \u2014\n   those users can read and mutate any app record through /api/debug/*. Redeploy to apply;\n   `deepspace secrets delete ALLOW_DEBUG_ROUTES` (then redeploy) turns it back off."
   );
   return true;
 }
@@ -9735,7 +9862,7 @@ var upload = defineCommand10({
   async run({ args }) {
     try {
       const t = await resolveTarget(args);
-      const content = args.file === "-" ? readFileSync25(0, "utf-8") : readFileSync25(args.file, "utf-8");
+      const content = args.file === "-" ? readFileSync23(0, "utf-8") : readFileSync23(args.file, "utf-8");
       const secrets = parseSecretsUpload(content);
       if (Object.keys(secrets).length === 0)
         fail(new InputError("No secrets found in the input.", "empty_input"));
@@ -9799,27 +9926,24 @@ var pull = defineCommand10({
         );
       const t = await resolveTarget(args);
       const ownerId = decodeJwtPayload(t.token).sub;
-      const pulled = await pullAppSecretsCache(DEPLOY_URL11, t.token, t.appId, t.configName);
-      if (!pulled) {
-        ok(
-          args.json === true,
-          { appId: t.appId, config: t.configName, pulled: 0 },
-          () => console.log(
-            `No secrets in ${t.configName} yet \u2014 nothing to pull. Whoever has them adds them with \`deepspace secrets set KEY=value\` (or \`secrets upload <file>\`); if the app truly needs none, you're ready as-is.`
-          )
-        );
-        return;
-      }
+      const refreshed = await refreshSecretsCache(
+        DEPLOY_URL11,
+        t.token,
+        t.appId,
+        wranglerEnv,
+        t.configName
+      );
       await writeDevVars(appDir, ownerId, t.token, wranglerEnv, {
         appId: t.appId,
-        generatedSecretsCache: renderSecretsCache(pulled.values, pulled),
-        sharedDevVarsCache: true
+        generatedSecretsCache: refreshed.rendered
       });
-      const count = Object.keys(pulled.values).length;
+      const count = Object.keys(refreshed.pulled?.values ?? {}).length;
       ok(
         args.json === true,
         { appId: t.appId, config: t.configName, pulled: count },
-        () => console.log(`Pulled ${count} secrets (${t.configName}) into .dev.vars.`)
+        () => console.log(
+          refreshed.pulled ? `Pulled ${count} secrets (${t.configName}) into .dev.vars.` : `Config ${t.configName} does not exist yet; regenerated .dev.vars without app secrets.`
+        )
       );
     } catch (err) {
       fail(err);
@@ -9991,7 +10115,7 @@ var init_default = defineDeepspaceCommand({
 // src/cli/commands/status.ts
 import { defineCommand as defineCommand11 } from "citty";
 import * as p17 from "@clack/prompts";
-import { existsSync as existsSync23, readFileSync as readFileSync26 } from "fs";
+import { existsSync as existsSync21, readFileSync as readFileSync24 } from "fs";
 function timeAgo(iso) {
   const ms = Date.now() - Date.parse(iso);
   if (!Number.isFinite(ms) || ms < 0) return iso;
@@ -10076,7 +10200,7 @@ var status_default = defineCommand11({
       json.services = urls;
       if (urlOverrides.length > 0) json.urlOverrides = urlOverrides;
     }
-    facts.loggedIn = existsSync23(SESSION_PATH);
+    facts.loggedIn = existsSync21(SESSION_PATH);
     let userId = null;
     if (!facts.loggedIn) {
       lines.push(["Session", "not logged in"]);
@@ -10085,7 +10209,7 @@ var status_default = defineCommand11({
       let who = "logged in";
       try {
         const payload = decodeJwtPayload(
-          readFileSync26(TOKEN_PATH, "utf-8").trim()
+          readFileSync24(TOKEN_PATH, "utf-8").trim()
         );
         if (payload.email) who = payload.email;
         userId = payload.sub ?? null;
@@ -10634,12 +10758,7 @@ var pull_default = defineDeepspaceCommand({
     }
     spinner2?.message(`Fetching ${branch} from the cloud repo\u2026`);
     const trackingRef = spaceTrackingRef(branch);
-    runGitRemote(appDir, token, [
-      "fetch",
-      "--quiet",
-      SPACE_REMOTE,
-      `+${refName}:${trackingRef}`
-    ]);
+    runGitRemote(appDir, token, ["fetch", "--quiet", SPACE_REMOTE, `+${refName}:${trackingRef}`]);
     const remoteOid = resolveCommit(appDir, trackingRef);
     if (!remoteOid) {
       spinner2?.stop("Fetch failed.");
@@ -10677,6 +10796,8 @@ var pull_default = defineDeepspaceCommand({
           integration = "fast_forwarded";
         }
       }
+    } else if (isAncestor(appDir, remoteOid, localOid)) {
+      integration = "local_ahead";
     } else {
       integration = "fetched_only_diverged";
     }
@@ -10690,10 +10811,15 @@ var pull_default = defineDeepspaceCommand({
     let line;
     let codeForState;
     let recoveryAction;
+    let successAction;
     switch (integration) {
       case "up_to_date":
         line = `${branch} is already up to date.`;
         break;
+      case "local_ahead":
+        line = `${branch} already contains ${SPACE_REMOTE}/${branch} at ${remoteOid.slice(0, 10)} \u2014 nothing to pull. Local work is not on the cloud repo yet: run \`${pushCommand}\`.`;
+        successAction = targetedVcAction("push", appDir, appId, branch);
+        break;
       case "fast_forwarded":
         line = `Fast-forwarded ${branch} to ${remoteOid.slice(0, 10)}.`;
         break;
@@ -10742,7 +10868,8 @@ var pull_default = defineDeepspaceCommand({
     }
     const actionRequired = recoveryAction !== void 0;
     spinner2?.stop(codeForState ? `Fetched ${SPACE_REMOTE}/${branch}.` : line);
-    if (!args.json) p19.log.info(`App: ${appId} \xB7 ${SPACE_REMOTE}/${branch} at ${remoteOid.slice(0, 10)}`);
+    if (!args.json)
+      p19.log.info(`App: ${appId} \xB7 ${SPACE_REMOTE}/${branch} at ${remoteOid.slice(0, 10)}`);
     if (codeForState) {
       throw new Refusal(line, codeForState, {
         actionRequired,
@@ -10756,20 +10883,20 @@ var pull_default = defineDeepspaceCommand({
         }
       });
     }
-    return { data: { status: integration, appId, branch, remoteOid } };
+    return { data: { status: integration, appId, branch, remoteOid }, action: successAction };
   }
 });
 
 // src/cli/commands/clone.ts
 import * as p20 from "@clack/prompts";
-import { existsSync as existsSync24, readdirSync as readdirSync6, rmSync as rmSync5 } from "fs";
+import { existsSync as existsSync22, readdirSync as readdirSync6, rmSync as rmSync5 } from "fs";
 import { resolve as resolve17, basename as basename5, join as join21 } from "path";
 function cleanFailedCloneDir(dir) {
   let entries;
   try {
     entries = readdirSync6(dir);
   } catch {
-    return existsSync24(dir) ? ["<unreadable>"] : [];
+    return existsSync22(dir) ? ["<unreadable>"] : [];
   }
   if (entries.length === 1 && entries[0] === ".git") {
     try {
@@ -10782,7 +10909,7 @@ function cleanFailedCloneDir(dir) {
   return entries;
 }
 function validateCloneTarget(dir) {
-  if (!existsSync24(dir)) return false;
+  if (!existsSync22(dir)) return false;
   let entries;
   try {
     entries = readdirSync6(dir);
@@ -11258,7 +11385,7 @@ function printOverlaps(overlaps, json) {
 
 // src/cli/commands/workspace/local.ts
 import * as p24 from "@clack/prompts";
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync27, realpathSync as realpathSync6, renameSync as renameSync2, statSync as statSync3, writeFileSync as writeFileSync9 } from "fs";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync25, realpathSync as realpathSync6, renameSync as renameSync2, statSync as statSync3, writeFileSync as writeFileSync9 } from "fs";
 import { dirname as dirname10, isAbsolute as isAbsolute5, join as join22, relative as relative2, sep as sep2 } from "path";
 var WORKSPACE_MARKER = "deepspace-workspace.json";
 function excludeWorktreeDir(appDir, dir) {
@@ -11316,7 +11443,7 @@ function isManagedWorkspaceWorktree(worktreeRoot, workspaceId) {
   const markerPath = worktreeMarkerPath(worktreeRoot);
   if (!markerPath) return false;
   try {
-    const marker = JSON.parse(readFileSync27(markerPath, "utf-8"));
+    const marker = JSON.parse(readFileSync25(markerPath, "utf-8"));
     return marker.version === 1 && marker.workspaceId === workspaceId && marker.mode === "managed-linked";
   } catch {
     return false;
@@ -11331,6 +11458,11 @@ function appDirInWorktree(appDir, worktreeRoot) {
   const appRelative = relative2(realpathSync6(repoToplevel(appDir)), realpathSync6(appDir));
   return appRelative ? join22(worktreeRoot, appRelative) : worktreeRoot;
 }
+function primaryAppDir(appDir) {
+  const primary = listWorktrees(appDir)[0];
+  if (!primary) throw new Error("Git did not report a primary worktree");
+  return appDirInWorktree(appDir, primary.path);
+}
 function materializeWorkspaceWorktree(appDir, worktreeRoot, branch, startPoint, workspaceId, options = {}) {
   const createdOid = resolveCommit(appDir, startPoint);
   if (!createdOid) throw new Error(`Could not resolve workspace start point ${startPoint}`);
@@ -11756,7 +11888,7 @@ var newWorkspaceCommand = defineDeepspaceCommand({
 
 // src/cli/commands/workspace/attach.ts
 import * as p26 from "@clack/prompts";
-import { existsSync as existsSync25, readdirSync as readdirSync7, realpathSync as realpathSync7, rmSync as rmSync6 } from "fs";
+import { existsSync as existsSync23, readdirSync as readdirSync7, realpathSync as realpathSync7, rmSync as rmSync6 } from "fs";
 import { isAbsolute as isAbsolute7, resolve as resolve19 } from "path";
 function samePath(a, b) {
   const real = (p35) => {
@@ -11776,7 +11908,7 @@ function finishedWorkspaceMessage(id, view) {
   return `Workspace ${id} is ${workspace.status} \u2014 its ref is retained briefly (fetch ${workspace.ref} to inspect), but attach only works on active workspaces.`;
 }
 function cleanFailedFreshAttachDir(dir) {
-  if (!existsSync25(dir)) return [];
+  if (!existsSync23(dir)) return [];
   let entries;
   try {
     entries = readdirSync7(dir);
@@ -11858,7 +11990,7 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
       const localTip = resolveCommit(appDir, `refs/heads/${branch}`);
       if (localTip) {
         let existing = resolveWorkspaceWorktree(listWorktrees(appDir), id);
-        if (existing && !existsSync25(existing)) {
+        if (existing && !existsSync23(existing)) {
           runGit(appDir, ["worktree", "prune"], { allowFail: true });
           existing = null;
         }
@@ -11976,7 +12108,7 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
       process.cwd(),
       (typeof args.dir === "string" ? args.dir.trim() : "") || `ws-${id.slice(3).toLowerCase()}`
     );
-    if (existsSync25(dir)) {
+    if (existsSync23(dir)) {
       spinner2?.stop("Target exists.");
       throw new Refusal(`${dir} already exists \u2014 pass a different directory.`, "dir_exists");
     }
@@ -12313,13 +12445,13 @@ import * as p30 from "@clack/prompts";
 
 // src/cli/lib/validation.ts
 import { sync as spawnSync7 } from "cross-spawn";
-import { readFileSync as readFileSync28 } from "fs";
+import { readFileSync as readFileSync26 } from "fs";
 import { join as join23 } from "path";
 var MAX_SUMMARY_CHARS = 4e3;
 var MAX_OUTPUT_BUFFER = 64 * 1024 * 1024;
 function configuredCommand(appDir) {
   try {
-    const pkg2 = JSON.parse(readFileSync28(join23(appDir, "package.json"), "utf-8"));
+    const pkg2 = JSON.parse(readFileSync26(join23(appDir, "package.json"), "utf-8"));
     if (pkg2.scripts?.validate) return `${detectPackageManager(appDir)} run --silent validate`;
   } catch {
   }
@@ -12357,6 +12489,11 @@ function conflictMarkerFiles(diffCheckOutput) {
   }
   return [...files];
 }
+function pullAfterLandAction(primaryDir, intoBranch, landedOid) {
+  if (currentBranch(primaryDir) !== intoBranch) return null;
+  if (resolveCommit(primaryDir, "HEAD") === landedOid) return null;
+  return { cwd: primaryDir, argv: ["deepspace", "pull"] };
+}
 function landResumeArgv(args) {
   const argv = ["deepspace", "workspace", "land"];
   const workspace = args.workspace?.trim();
@@ -12635,6 +12772,7 @@ var landWorkspaceCommand = defineDeepspaceCommand({
       );
     }
     spinner2?.stop(`Landed ${id} into ${intoBranch} at ${landedOid.slice(0, 10)}.`);
+    const primaryDir = primaryAppDir(appDir);
     const cleanup = keepWorktree ? null : cleanupWorkspaceLocal(appDir, id, intoBranch, { expectedBranchOid: landedOid });
     const inOwnWorktree = !cleanup && inOwnLinkedWorktree(appDir, id);
     const retainedWorktree = cleanup?.worktreeRetained ?? (keepWorktree || inOwnWorktree ? appDir : null);
@@ -12652,7 +12790,7 @@ var landWorkspaceCommand = defineDeepspaceCommand({
       p30.log.info(`Retained checkout: ${retainedWorktree}`);
     }
     if (cleanup?.error) {
-      const action = cleanupAction({
+      const action2 = cleanupAction({
         worktreeDir: cleanup.worktreeDir,
         branch: cleanup.branch
       });
@@ -12663,10 +12801,11 @@ var landWorkspaceCommand = defineDeepspaceCommand({
           branch: cleanup.branch
         }),
         "cleanup_incomplete",
-        { actionRequired: true, action, extra: data }
+        { actionRequired: true, action: action2, extra: data }
       );
     }
-    return { data };
+    const action = pullAfterLandAction(primaryDir, intoBranch, landedOid);
+    return { data, ...action ? { action } : {} };
   }
 });
 
@@ -13106,7 +13245,7 @@ var source_default = defineDeepspaceCommand({
   args: {
     provider: {
       type: "positional",
-      description: "Source provider: github or deepspace (omit to show)",
+      description: "Source authority: deepspace is platform-hosted and commit-first; github deploys the local working tree without Git sync (omit to show)",
       required: false
     },
     app: {
@@ -13384,7 +13523,7 @@ function sameRefs(left, right) {
 
 // src/cli/commands/update.ts
 import * as p34 from "@clack/prompts";
-import { existsSync as existsSync26, readFileSync as readFileSync29, writeFileSync as writeFileSync10 } from "fs";
+import { existsSync as existsSync24, readFileSync as readFileSync27, writeFileSync as writeFileSync10 } from "fs";
 import { join as join24, resolve as resolve20 } from "path";
 var REGISTRY = "https://registry.npmjs.org/deepspace/latest";
 var DOCS_URL = "https://documentation.deep.space/cli-reference/commands";
@@ -13400,18 +13539,18 @@ function gapIsTooWide(from, to) {
 }
 function readAppSdkVersion(appDir) {
   const installed = join24(appDir, "node_modules", "deepspace", "package.json");
-  if (existsSync26(installed)) {
-    const parsed2 = JSON.parse(readFileSync29(installed, "utf8"));
+  if (existsSync24(installed)) {
+    const parsed2 = JSON.parse(readFileSync27(installed, "utf8"));
     if (typeof parsed2.version === "string") return parsed2.version;
   }
   const manifest = join24(appDir, "package.json");
-  if (!existsSync26(manifest)) return null;
-  const parsed = JSON.parse(readFileSync29(manifest, "utf8"));
+  if (!existsSync24(manifest)) return null;
+  const parsed = JSON.parse(readFileSync27(manifest, "utf8"));
   return parsed.dependencies?.deepspace ?? null;
 }
 function pinSdkVersion(appDir, version) {
   const path = join24(appDir, "package.json");
-  const source = readFileSync29(path, "utf8");
+  const source = readFileSync27(path, "utf8");
   const updated = source.replace(
     /("deepspace"\s*:\s*")[^"]+(")/,
     (_match, head, tail) => `${head}^${version}${tail}`
@@ -13557,8 +13696,8 @@ var update_default = defineDeepspaceCommand({
 
 // src/cli/cli.ts
 var __dirname = dirname11(fileURLToPath3(import.meta.url));
-var pkg = JSON.parse(readFileSync30(join25(__dirname, "..", "package.json"), "utf-8"));
-if (process.platform === "linux" && !process.env.SSL_CERT_FILE && existsSync27("/etc/ssl/certs/ca-certificates.crt")) {
+var pkg = JSON.parse(readFileSync28(join25(__dirname, "..", "package.json"), "utf-8"));
+if (process.platform === "linux" && !process.env.SSL_CERT_FILE && existsSync25("/etc/ssl/certs/ca-certificates.crt")) {
   process.env.SSL_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt";
 }
 var create2 = defineCommand14({
@@ -13689,6 +13828,46 @@ Run \`${unknown.helpPath.join(" ")} --help\` for the command list.`
   }
   process.exit(1);
 }
+function selectedLeaf(argv) {
+  let command = main;
+  let remaining = argv;
+  const path = [];
+  const commandPrefixArgs = [];
+  for (; ; ) {
+    const subCommands = command.subCommands;
+    if (!subCommands || Object.keys(subCommands).length === 0) {
+      return { command, rawArgs: [...commandPrefixArgs, ...remaining], path };
+    }
+    const index = remaining.findIndex((argument) => !argument.startsWith("-"));
+    if (index < 0) return { command, rawArgs: [...commandPrefixArgs, ...remaining], path };
+    const name = remaining[index];
+    const entry = Object.entries(subCommands).find(([key, child]) => {
+      if (key === name) return true;
+      const alias = child.meta?.alias;
+      return (Array.isArray(alias) ? alias : alias ? [alias] : []).includes(name);
+    });
+    if (!entry) return null;
+    commandPrefixArgs.push(...remaining.slice(0, index));
+    path.push(entry[0]);
+    command = entry[1];
+    remaining = remaining.slice(index + 1);
+  }
+}
+function assertKnownOptions(argv) {
+  const selected = selectedLeaf(argv);
+  if (!selected || selected.path.join(" ") === "app create") return;
+  const args = selected.command.args ?? {};
+  const unknown = unknownOptionNamesFromRaw(selected.rawArgs, args);
+  if (unknown.length === 0) return;
+  const commandName = selected.path.join(" ") || "deepspace";
+  const message = unknownOptionMessage(commandName, unknown, args);
+  if (argv.includes("--json")) {
+    console.log(JSON.stringify({ ok: false, code: "unknown_option", error: message }));
+  } else {
+    console.error(withSlug(message, "unknown_option"));
+  }
+  process.exit(1);
+}
 var rawArgs = process.argv.slice(2);
 var wantsHelp = rawArgs.some((arg) => arg === "--help" || arg === "-h");
 if (DEEPSPACE_ENV === "invalid") {
@@ -13700,6 +13879,9 @@ if (DEEPSPACE_ENV === "invalid") {
   }
   process.exit(1);
 }
+if (!wantsHelp && !(rawArgs.length === 1 && ["--version", "-v"].includes(rawArgs[0]))) {
+  assertKnownOptions(rawArgs);
+}
 if (rawArgs.includes("--json") && !wantsHelp) {
   const unknown = findUnknownCommand(rawArgs, commandTree());
   if (unknown) {