deepspace 0.18.0 → 0.19.0

package/dist/cli.js

@@ -342,7 +342,7 @@ function defineDeepspaceCommand(def) {
     ...def.args ?? {},
     json: {
       type: "boolean",
-      description: "Emit a single-line JSON result for scripts/agents",
+      description: def.jsonDescription ?? "Emit a single-line JSON result for scripts/agents",
       default: false
     }
   };
@@ -2412,7 +2412,7 @@ function lintSchema(schema) {
   if (schema.ownerField) {
     const col = schema.columns.find((c) => c.name === schema.ownerField);
     const spoofableRoles = Object.entries(schema.permissions).filter(
-      ([role, permissions]) => role !== "owner" && role !== "admin" && permissions.create === true
+      ([role, permissions]) => role !== "owner" && role !== "admin" && permissions.create === true && permissions.update !== "unclaimed-or-own"
     ).map(([role]) => role);
     if (col && !col.userBound && spoofableRoles.length > 0) {
       warnings.push(
@@ -3045,7 +3045,7 @@ function normalizeTestAccountScope(value) {
 }
 function loadAllTestAccounts(scope = currentTestAccountScope()) {
   const store = readTestAccountStore();
-  return mergeTestAccounts(store.scopes[scope] ?? [], store.unscoped);
+  return store.scopes[scope] ?? [];
 }
 function reconcileTestAccountStore(remote, scope = currentTestAccountScope()) {
   const result = reconcileTestAccountScopes(readTestAccountStore(), remote, scope);
@@ -3054,24 +3054,20 @@ function reconcileTestAccountStore(remote, scope = currentTestAccountScope()) {
 }
 function reconcileTestAccountScopes(store, remote, scope) {
   const scoped = store.scopes[scope] ?? [];
-  const current = reconcileTestAccounts(scoped, remote);
-  const migrated = reconcileTestAccounts(store.unscoped, remote);
-  const accounts = mergeTestAccounts(current, migrated);
+  const accounts = reconcileTestAccounts(scoped, remote);
   return {
     accounts,
-    removed: Math.max(0, scoped.length - current.length),
+    removed: Math.max(0, scoped.length - accounts.length),
     store: {
       version: 2,
-      scopes: { ...store.scopes, [scope]: accounts },
-      unscoped: store.unscoped.filter((account) => !remote.some((item) => accountMatchesRemote(account, item)))
+      scopes: { ...store.scopes, [scope]: accounts }
     }
   };
 }
 function reconcileTestAccounts(local, remote) {
   const localById = new Map(local.filter((account) => account.id).map((account) => [account.id, account]));
-  const legacyByEmail = new Map(local.filter((account) => !account.id).map((account) => [account.email, account]));
   return remote.flatMap((account) => {
-    const stored = localById.get(account.id) ?? legacyByEmail.get(account.email);
+    const stored = localById.get(account.id);
     return stored ? [{ ...stored, ...account }] : [];
   });
 }
@@ -3082,10 +3078,7 @@ function upsertTestAccount(account, scope = currentTestAccountScope()) {
   );
   saveTestAccountStore({
     version: 2,
-    scopes: { ...store.scopes, [scope]: [...accounts, account] },
-    unscoped: store.unscoped.filter(
-      (stored) => stored.id !== account.id && stored.email !== account.email
-    )
+    scopes: { ...store.scopes, [scope]: [...accounts, account] }
   });
 }
 function removeTestAccounts(ids, emails = [], scope = currentTestAccountScope()) {
@@ -3095,41 +3088,31 @@ function removeTestAccounts(ids, emails = [], scope = currentTestAccountScope())
   const store = readTestAccountStore();
   saveTestAccountStore({
     version: 2,
-    scopes: { ...store.scopes, [scope]: (store.scopes[scope] ?? []).filter(keep) },
-    unscoped: store.unscoped.filter(keep)
+    scopes: { ...store.scopes, [scope]: (store.scopes[scope] ?? []).filter(keep) }
   });
 }
 function readTestAccountStore() {
-  if (!existsSync11(TEST_ACCOUNTS_PATH)) return { version: 2, scopes: {}, unscoped: [] };
+  if (!existsSync11(TEST_ACCOUNTS_PATH)) return { version: 2, scopes: {} };
   try {
     const raw = JSON.parse(readFileSync13(TEST_ACCOUNTS_PATH, "utf-8"));
-    if (Array.isArray(raw)) return { version: 2, scopes: {}, unscoped: validTestAccounts(raw) };
-    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
-      return { version: 2, scopes: {}, unscoped: [] };
+    if (Array.isArray(raw)) return { version: 2, scopes: {} };
+    if (!raw || typeof raw !== "object") {
+      return { version: 2, scopes: {} };
     }
     const candidate = raw;
     const scopes = candidate.scopes && typeof candidate.scopes === "object" && !Array.isArray(candidate.scopes) ? Object.fromEntries(Object.entries(candidate.scopes).map(([key, value]) => [key, validTestAccounts(value)])) : {};
-    return { version: 2, scopes, unscoped: validTestAccounts(candidate.unscoped) };
+    return { version: 2, scopes };
   } catch {
-    return { version: 2, scopes: {}, unscoped: [] };
+    return { version: 2, scopes: {} };
   }
 }
 function validTestAccounts(value) {
   if (!Array.isArray(value)) return [];
-  return value.filter((item) => Boolean(
-    item && typeof item === "object" && typeof item.email === "string" && typeof item.password === "string"
-  ));
-}
-function mergeTestAccounts(...groups) {
-  const accounts = /* @__PURE__ */ new Map();
-  for (const account of groups.flat()) {
-    const key = account.id ? `id:${account.id}` : `email:${account.email}`;
-    if (!accounts.has(key)) accounts.set(key, account);
-  }
-  return [...accounts.values()];
-}
-function accountMatchesRemote(local, remote) {
-  return local.id ? local.id === remote.id : local.email === remote.email;
+  return value.filter(
+    (item) => Boolean(
+      item && typeof item === "object" && typeof item.id === "string" && typeof item.email === "string" && typeof item.password === "string"
+    )
+  );
 }
 function saveTestAccountStore(store) {
   mkdirSync5(join13(homedir3(), ".deepspace"), { recursive: true });
@@ -3187,11 +3170,24 @@ async function syncTestAccountStore() {
 
 // src/cli/commands/test.ts
 var DEPLOY_URL2 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
+var PLAYWRIGHT_OUTPUT_DIR = ".deepspace/test-results";
+function playwrightTestArgs(testFiles) {
+  return [
+    "playwright",
+    "test",
+    "--config",
+    "tests/playwright.config.ts",
+    "--output",
+    PLAYWRIGHT_OUTPUT_DIR,
+    ...testFiles
+  ];
+}
 var test_default = defineDeepspaceCommand({
   meta: {
     name: "test",
     description: "Run tests for your DeepSpace app"
   },
+  jsonDescription: "Stream test output; emit the final JSON result on the last line",
   args: {
     suite: {
       type: "positional",
@@ -3324,15 +3320,14 @@ function runPlaywright(appDir, testFiles, port, wranglerEnv) {
     return 1;
   }
   try {
-    const result = spawnSync4(
-      "npx",
-      ["playwright", "test", "--config", "tests/playwright.config.ts", ...testFiles],
-      {
-        cwd: appDir,
-        stdio: "inherit",
-        env: wranglerViteEnv(process.env, wranglerConfig, { DEEPSPACE_PORT: String(port) })
-      }
-    );
+    const result = spawnSync4("npx", playwrightTestArgs(testFiles), {
+      cwd: appDir,
+      stdio: "inherit",
+      env: wranglerViteEnv(process.env, wranglerConfig, {
+        DEEPSPACE_PORT: String(port),
+        PLAYWRIGHT_HTML_OUTPUT_DIR: ".deepspace/playwright-report"
+      })
+    });
     return result.status ?? 1;
   } finally {
     wranglerConfig.cleanup();
@@ -3850,7 +3845,7 @@ function describeFilesFailure(status3, body) {
 import * as p6 from "@clack/prompts";
 import { execSync as execSync2 } from "child_process";
 import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync14, readFileSync as readFileSync17, readdirSync as readdirSync4 } from "fs";
+import { chmodSync as chmodSync2, existsSync as existsSync14, lstatSync as lstatSync2, readFileSync as readFileSync17, readdirSync as readdirSync4 } from "fs";
 import { dirname as dirname6, join as join16, resolve as resolve11 } from "path";
 
 // src/documentation/deploy.ts
@@ -3885,6 +3880,7 @@ import { join as join15 } from "path";
 var APP_MIGRATION_ID_RE = /^[a-z0-9][a-z0-9._-]{0,127}$/;
 var MAX_APP_MIGRATION_IDS = 256;
 var WORKER_OWNED_NOT_FOUND_MIGRATION_ID = "2026-08-worker-owned-not-found";
+var SECURE_ROOM_BOUNDARIES_MIGRATION_ID = "2026-08-secure-room-boundaries";
 function validateAppMigrationIds(value) {
   if (!Array.isArray(value)) {
     return { valid: false, reason: "app migrations must be a JSON string array" };
@@ -3918,6 +3914,12 @@ var SOURCE_MIGRATIONS = [
     description: "Let the worker answer misses, so deleted files 404 instead of serving HTML",
     transform: migrateWorkerOwnedNotFound,
     findBlockers: findWorkerOwnedNotFoundBlockers
+  },
+  {
+    id: SECURE_ROOM_BOUNDARIES_MIGRATION_ID,
+    description: "Secure room identity, job mutations, and production debug routes",
+    transform: migrateSecureRoomBoundaries,
+    findBlockers: findSecureRoomBoundaryBlockers
   }
 ];
 var APP_MIGRATION_DEFINITIONS = SOURCE_MIGRATIONS.map(
@@ -4061,6 +4063,248 @@ function isSourcePath(repoPath, appPrefix) {
   if (repoPath.endsWith("wrangler.toml")) return true;
   return /\.(?:[cm]?[jt]sx?)$/.test(repoPath);
 }
+var LEGACY_AUTHENTICATED_ROOM_HELPER = `const IDENTITY_QUERY_PARAMS = ['userId', 'userName', 'userEmail', 'userImageUrl', 'role'] as const
+
+function authenticatedRoomUrl(
+  requestUrl: string,
+  auth: VerifyResult | null,
+  extraParams?: (auth: VerifyResult) => Record<string, string>,
+): URL {
+  const doUrl = new URL(requestUrl)
+  doUrl.searchParams.delete('token')
+  for (const key of IDENTITY_QUERY_PARAMS) {
+    doUrl.searchParams.delete(key)
+  }
+
+  if (!auth) return doUrl
+
+  doUrl.searchParams.set('userId', auth.userId)
+  if (auth.claims.name) doUrl.searchParams.set('userName', auth.claims.name)
+  if (auth.claims.email) doUrl.searchParams.set('userEmail', auth.claims.email)
+  if (auth.claims.image) doUrl.searchParams.set('userImageUrl', auth.claims.image)
+  if (extraParams) {
+    for (const [key, value] of Object.entries(extraParams(auth))) {
+      doUrl.searchParams.set(key, value)
+    }
+  }
+  return doUrl
+}`;
+var IDENTITY_ROUTE_REPLACEMENTS = [
+  [
+    `import { verifyJwt } from 'deepspace/worker'`,
+    `import { authenticatedRoomRequest, verifyJwt } from 'deepspace/worker'`,
+    1
+  ],
+  [LEGACY_AUTHENTICATED_ROOM_HELPER, "", 1],
+  [
+    `function wsRoute(
+  doNamespace: (env: Env) => DurableObjectNamespace,
+  extraParams?: (auth: VerifyResult) => Record<string, string>,
+) {`,
+    `function wsRoute(
+  doNamespace: (env: Env) => DurableObjectNamespace,
+  extraIdentity?: (auth: VerifyResult) => { role?: string },
+) {`,
+    1
+  ],
+  [
+    `    const doUrl = authenticatedRoomUrl(c.req.url, auth, extraParams)`,
+    `    const roomRequest = authenticatedRoomRequest(
+      c.req.raw,
+      auth,
+      auth ? extraIdentity?.(auth) : undefined,
+    )`,
+    1
+  ],
+  [
+    `    const doUrl = authenticatedRoomUrl(c.req.url, auth, () => ({ role }))`,
+    `    const roomRequest = authenticatedRoomRequest(c.req.raw, auth, { role })`,
+    1
+  ],
+  [
+    `    return stub.fetch(new Request(doUrl.toString(), c.req.raw))`,
+    `    return stub.fetch(roomRequest)`,
+    2
+  ]
+];
+function occurrences(source, pattern) {
+  return source.split(pattern).length - 1;
+}
+var SECURE_JOB_ROOM_CONSTRUCTOR = `  constructor(state: DurableObjectState, env: Env) {
+    super(state, env, {
+      authorizeWrite: async (user) => {
+        if (user.userId.startsWith('anon-')) return false
+        const role = await resolveAppRole(env, user.userId)
+        return role === 'member' || role === 'admin'
+      },
+    })
+  }`;
+var APP_JOB_ROOM_CLASS = `export class AppJobRoom extends JobRoom<Env> {`;
+var SECURE_APP_JOB_ROOM = `${APP_JOB_ROOM_CLASS}
+${SECURE_JOB_ROOM_CONSTRUCTOR}`;
+function hasSecureAppJobRoom(source) {
+  return occurrences(source, "class AppJobRoom") === 1 && source.includes(SECURE_APP_JOB_ROOM);
+}
+var WORKER_JOB_REPLACEMENTS = [
+  [
+    `import type { DOBindings, DOManifest, Job, JobContext } from 'deepspace/worker'`,
+    `import { resolveAppRole } from 'deepspace/worker'
+import type { DOBindings, DOManifest, Job, JobContext } from 'deepspace/worker'`
+  ],
+  [
+    `export class AppJobRoom extends JobRoom<Env> {
+  constructor(state: DurableObjectState, env: Env) {
+    super(state, env)
+  }`,
+    `export class AppJobRoom extends JobRoom<Env> {
+${SECURE_JOB_ROOM_CONSTRUCTOR}`
+  ]
+];
+var HTTP_ROLE_IMPORT = `import { resolveAppRole } from 'deepspace/worker'`;
+var HTTP_ROLE_IMPORT_SEAM = `import type { AppContext, Env } from '../../worker.js'`;
+var DEBUG_ROUTE_SEAM = `  app.all('/api/debug/*', async (c) => {
+    if (c.env.ALLOW_DEBUG_ROUTES !== 'true') {
+      return c.notFound()
+    }
+    const stub = c.env.RECORD_ROOMS.get(`;
+var DOUBLE_QUOTED_DEBUG_ROUTE_SEAM = DEBUG_ROUTE_SEAM.replace(
+  "app.all('/api/debug/*'",
+  'app.all("/api/debug/*"'
+);
+var SECURE_DEBUG_ROUTE_SEAM = `  app.all('/api/debug/*', async (c) => {
+    if (c.env.ALLOW_DEBUG_ROUTES !== 'true') {
+      return c.notFound()
+    }
+    const auth = await resolveAuth(c.req.raw, c.env)
+    if (!auth) return c.json({ error: 'unauthorized' }, 401)
+    if ((await resolveAppRole(c.env, auth.userId)) !== 'admin') {
+      return c.json({ error: 'forbidden' }, 403)
+    }
+    const stub = c.env.RECORD_ROOMS.get(`;
+var DOUBLE_QUOTED_SECURE_DEBUG_ROUTE_SEAM = SECURE_DEBUG_ROUTE_SEAM.replace(
+  "app.all('/api/debug/*'",
+  'app.all("/api/debug/*"'
+);
+var DEBUG_ROUTE_REPLACEMENTS = [
+  [DEBUG_ROUTE_SEAM, SECURE_DEBUG_ROUTE_SEAM],
+  [DOUBLE_QUOTED_DEBUG_ROUTE_SEAM, DOUBLE_QUOTED_SECURE_DEBUG_ROUTE_SEAM]
+];
+var DEBUG_ROUTE_PATTERN = /\bapp\.all\(\s*(['"])\/api\/debug\/\*\1\s*,/;
+function debugRouteOccurrences(source) {
+  return source.match(new RegExp(DEBUG_ROUTE_PATTERN.source, "g"))?.length ?? 0;
+}
+function secureDebugRouteOccurrences(source) {
+  return DEBUG_ROUTE_REPLACEMENTS.reduce(
+    (count, [, secure]) => count + occurrences(source, secure),
+    0
+  );
+}
+function hasSecureDebugRoute(source) {
+  return debugRouteOccurrences(source) === 1 && secureDebugRouteOccurrences(source) === 1 && occurrences(source, HTTP_ROLE_IMPORT) === 1;
+}
+function migrateSecureRoomBoundaries(source, file) {
+  if (file.endsWith("src/server/realtime-routes.ts")) {
+    return migrateRealtimeRoomBoundaries(source);
+  }
+  if (file.endsWith("worker.ts")) return migrateWorkerJobAuthorization(source);
+  if (file.endsWith("src/server/http-routes.ts")) return migrateDebugRouteAuthorization(source);
+  return { source, replacements: 0 };
+}
+function migrateRealtimeRoomBoundaries(source) {
+  let migrated = source;
+  let replacements = 0;
+  if (!migrated.includes("authenticatedRoomRequest(")) {
+    if (IDENTITY_ROUTE_REPLACEMENTS.some(
+      ([before, , expected]) => occurrences(migrated, before) !== expected
+    )) {
+      return { source, replacements: 0 };
+    }
+    for (const [before, after, expected] of IDENTITY_ROUTE_REPLACEMENTS) {
+      migrated = migrated.replaceAll(before, after);
+      replacements += expected;
+    }
+  }
+  return { source: migrated, replacements };
+}
+function migrateWorkerJobAuthorization(source) {
+  if (!source.includes("class AppJobRoom")) return { source, replacements: 0 };
+  if (hasSecureAppJobRoom(source)) return { source, replacements: 0 };
+  if (WORKER_JOB_REPLACEMENTS.some(([before]) => occurrences(source, before) !== 1)) {
+    return { source, replacements: 0 };
+  }
+  let migrated = source;
+  for (const [before, after] of WORKER_JOB_REPLACEMENTS) migrated = migrated.replace(before, after);
+  return { source: migrated, replacements: WORKER_JOB_REPLACEMENTS.length };
+}
+function migrateDebugRouteAuthorization(source) {
+  if (debugRouteOccurrences(source) === 0 || hasSecureDebugRoute(source)) {
+    return { source, replacements: 0 };
+  }
+  const matchingRoutes = DEBUG_ROUTE_REPLACEMENTS.filter(
+    ([before2]) => occurrences(source, before2) === 1
+  );
+  if (debugRouteOccurrences(source) !== 1 || matchingRoutes.length !== 1 || occurrences(source, HTTP_ROLE_IMPORT) !== 0 || occurrences(source, HTTP_ROLE_IMPORT_SEAM) !== 1) {
+    return { source, replacements: 0 };
+  }
+  const [before, after] = matchingRoutes[0];
+  return {
+    source: source.replace(HTTP_ROLE_IMPORT_SEAM, `${HTTP_ROLE_IMPORT_SEAM}
+${HTTP_ROLE_IMPORT}`).replace(before, after),
+    replacements: 2
+  };
+}
+function findSecureRoomBoundaryBlockers(source, file) {
+  if (file.endsWith("worker.ts") && source.includes("class AppJobRoom")) {
+    if (!hasSecureAppJobRoom(source)) {
+      return [
+        roomBoundaryBlocker(
+          file,
+          source,
+          "class AppJobRoom",
+          "Configure AppJobRoom with authorizeWrite using the current users.role."
+        )
+      ];
+    }
+    return [];
+  }
+  if (file.endsWith("src/server/http-routes.ts") && debugRouteOccurrences(source) > 0) {
+    if (!hasSecureDebugRoute(source)) {
+      const route = source.match(DEBUG_ROUTE_PATTERN)?.[0] ?? "/api/debug/*";
+      return [
+        roomBoundaryBlocker(
+          file,
+          source,
+          route,
+          "Require verified owner/admin access inside the enabled debug-route handler."
+        )
+      ];
+    }
+    return [];
+  }
+  if (!file.endsWith("src/server/realtime-routes.ts")) return [];
+  const lines = source.split("\n");
+  let index = lines.findIndex(
+    (line) => line.includes("authenticatedRoomUrl") || /searchParams\.(?:set|append)\(\s*['"](?:userId|userName|userEmail|userImageUrl|role)['"]/.test(
+      line
+    )
+  );
+  if (index < 0 && /\bauth\.(?:userId|claims)\b/.test(source)) {
+    index = lines.findIndex((line) => /searchParams\.(?:set|append)\s*\(/.test(line));
+  }
+  if (index < 0) return [];
+  return [
+    {
+      migrationId: SECURE_ROOM_BOUNDARIES_MIGRATION_ID,
+      file,
+      line: index + 1,
+      message: "This customized room proxy still places verified user identity in its internal URL. Replace that forwarding code with authenticatedRoomRequest() from deepspace/worker before the Durable Object fetch."
+    }
+  ];
+}
+function roomBoundaryBlocker(file, source, seam, message) {
+  const line = source.slice(0, source.indexOf(seam)).split("\n").length;
+  return { migrationId: SECURE_ROOM_BOUNDARIES_MIGRATION_ID, file, line, message };
+}
 function migrateWorkerOwnedNotFound(source, file) {
   let replacements = 0;
   if (file.endsWith("wrangler.toml")) {
@@ -4126,6 +4370,16 @@ function findWorkerOwnedNotFoundBlockers(source, file) {
 
 // src/cli/commands/deploy/build.ts
 var RESERVED_RUN_WORKER_FIRST2 = new Set(RESERVED_RUN_WORKER_FIRST);
+function secureBuildDevVars(workerDir) {
+  const path = join16(workerDir, ".dev.vars");
+  if (!existsSync14(path)) return false;
+  const stat = lstatSync2(path);
+  if (!stat.isFile() || stat.isSymbolicLink()) {
+    throw new Error(`Refusing unsafe build secret path: ${path}`);
+  }
+  chmodSync2(path, 384);
+  return true;
+}
 function declaredCompatibilityDate(config) {
   const declared = config.compatibility_date;
   return typeof declared === "string" && /^\d{4}-\d{2}-\d{2}$/.test(declared) ? declared : null;
@@ -4182,6 +4436,11 @@ async function buildDeployBundle(options) {
     );
   }
   const workerDir = dirname6(outputWranglerPath);
+  try {
+    secureBuildDevVars(workerDir);
+  } catch (error) {
+    output.die(errorMessage(error), "build_output_unsafe");
+  }
   const workerBundlePath = join16(workerDir, outputConfig.main);
   const clientDir = outputConfig.assets?.directory ? resolve11(workerDir, outputConfig.assets.directory) : null;
   if (!existsSync14(workerBundlePath)) {
@@ -4455,7 +4714,7 @@ async function syncSubscriptionPlans(appDir, appName, token, nonInteractive) {
     spinner2.stop(`Synced ${plans.length} plan${plans.length === 1 ? "" : "s"} to Stripe`);
     if (body.connectMissing) {
       p7.log.warn(
-        "Stripe Connect not yet set up. Customers can subscribe and earnings will queue in your platform balance until you finish onboarding at /earnings on the dashboard. The first payout after you connect will sweep everything that accumulated in the meantime."
+        "Stripe Connect is not ready. Paid checkout will remain unavailable until the app owner finishes onboarding at /earnings on the dashboard."
       );
     }
     const changes = (body.planChanges ?? []).filter((change) => change.affectedSubscribers > 0);
@@ -5096,7 +5355,16 @@ function selectGitHubRemote(cwd, options = {}) {
   return matching.find((remote) => remote.name === "origin") ?? (matching.length === 1 ? matching[0] : null);
 }
 function remotePublicRefs(cwd, remote) {
-  const output = runGit(cwd, ["ls-remote", "--refs", remote]).stdout.toString("utf-8");
+  let output;
+  try {
+    output = runGit(cwd, ["ls-remote", "--refs", remote]).stdout.toString("utf-8");
+  } catch (error) {
+    if (!isGitCredentialFailure(error)) throw error;
+    throw new GitError(
+      "Git could not authenticate the remote. In a container, forward an SSH agent or use an ephemeral Git credential helper, then retry. Do not put tokens in remote URLs.",
+      "github_credentials_required"
+    );
+  }
   return output.split("\n").map((line) => line.trim()).filter(Boolean).map((line) => {
     const [oid, name] = line.split(/\s+/, 2);
     return { oid, name };
@@ -5104,6 +5372,12 @@ function remotePublicRefs(cwd, remote) {
     (ref) => /^[0-9a-f]{40}$/.test(ref.oid) && (ref.name.startsWith("refs/heads/") || ref.name.startsWith("refs/tags/"))
   );
 }
+function isGitCredentialFailure(error) {
+  if (!(error instanceof Error)) return false;
+  return /authentication failed|could not read username|permission denied \(publickey\)|repository not found|terminal prompts disabled/i.test(
+    error.message
+  );
+}
 function remoteBranchOid(cwd, remote, branch) {
   return remotePublicRefs(cwd, remote).find((ref) => ref.name === `refs/heads/${branch}`)?.oid ?? null;
 }
@@ -5145,6 +5419,25 @@ function setAppSource(deployUrl, token, appId, input) {
 }
 
 // src/cli/commands/deploy/repository.ts
+function preflightDeployRepository(options) {
+  const { appDir, push, source } = options;
+  if (!push || source?.provider === "github") return null;
+  try {
+    assertSyncableRepo(appDir);
+    if (!source && listGitHubRemotes(appDir).length > 0) {
+      return {
+        code: "source_unclaimed",
+        error: "This app has a GitHub remote but no claimed source. Choose once with `deepspace app source github` (manual GitHub ownership) or `deepspace app source deepspace` (packaged DeepSpace source), then deploy again."
+      };
+    }
+    const branch = currentBranch(appDir);
+    if (!isWorkTreeClean(appDir)) return dirtyWorktreeRefusal(branch);
+    if (!branch) return detachedHeadRefusal();
+    return null;
+  } catch (error) {
+    return deployRepositoryFailure(error, appDir);
+  }
+}
 async function syncDeployRepository(options) {
   const { deployUrl, appDir, appId, token, push, ignoreStale, output, sourceState } = options;
   let commitOid = null;
@@ -5165,21 +5458,12 @@ async function syncDeployRepository(options) {
     return { commitOid, recoverable, deployKey, source, sourceRevision, baseReleaseId };
   }
   try {
-    assertSyncableRepo(appDir);
-    if (!source && listGitHubRemotes(appDir).length > 0) {
-      output.die(
-        "This app has a GitHub remote but no claimed source. Choose once with `deepspace app source github` (manual GitHub ownership) or `deepspace app source deepspace` (packaged DeepSpace source), then deploy again.",
-        "source_unclaimed"
-      );
-    }
+    const preflight = preflightDeployRepository({ appDir, push, source });
+    if (preflight) output.die(preflight.error, preflight.code);
     const sourceRemote = spaceRemoteName();
     ensureSpaceRemote(appDir, appId, sourceRemote);
     const branch = currentBranch(appDir);
     const workspaceBranchId = workspaceIdFromBranch(branch);
-    if (!isWorkTreeClean(appDir)) {
-      const refusal = dirtyWorktreeRefusal(branch);
-      output.die(refusal.error, refusal.code);
-    }
     if (!branch) {
       const refusal = detachedHeadRefusal();
       output.die(refusal.error, refusal.code);
@@ -5281,12 +5565,7 @@ function classifyRemoteState(appDir, token, branch, localTip, remote) {
   let remoteTip = null;
   const remoteRef = `refs/remotes/${remote}/${branch}`;
   try {
-    runGitRemote(appDir, token, [
-      "fetch",
-      "--quiet",
-      remote,
-      `+refs/heads/${branch}:${remoteRef}`
-    ]);
+    runGitRemote(appDir, token, ["fetch", "--quiet", remote, `+refs/heads/${branch}:${remoteRef}`]);
     remoteTip = resolveCommit(appDir, remoteRef);
     return {
       remoteTip,
@@ -5860,6 +6139,14 @@ var deploy_default = defineCommand3({
       output
     });
     const sourceState = await getAppSource(DEPLOY_URL3, token, appId);
+    const repositoryPreflight = preflightDeployRepository({
+      appDir,
+      push: args.push !== false,
+      source: sourceState.source
+    });
+    if (repositoryPreflight) {
+      output.die(repositoryPreflight.error, repositoryPreflight.code);
+    }
     const spinner2 = createSpinner();
     const bundle = await buildDeployBundle({
       appDir,
@@ -6322,11 +6609,17 @@ function parseSince(input, now = Date.now()) {
   } else {
     ts = Date.parse(trimmed);
     if (Number.isNaN(ts)) {
-      throw new InputError(`Invalid --since "${input}" \u2014 use 30s, 15m, 2h, 7d, or an ISO timestamp.`, "invalid_since");
+      throw new InputError(
+        `Invalid --since "${input}" \u2014 use 30s, 15m, 2h, 7d, or an ISO timestamp.`,
+        "invalid_since"
+      );
     }
   }
   if (now - ts > RETENTION_MS) {
-    throw new InputError("Logs are retained for 7 days \u2014 --since can reach back at most 7d.", "since_out_of_range");
+    throw new InputError(
+      "Logs are retained for 7 days \u2014 --since can reach back at most 7d.",
+      "since_out_of_range"
+    );
   }
   return ts;
 }
@@ -6457,13 +6750,19 @@ var logs_default = defineCommand4({
     const token = await ensureToken();
     const appId = await resolveAppTarget(DEPLOY_URL6, token, args.app, { wranglerEnv: envArg });
     if (args.level && !LOG_LEVELS.includes(args.level)) {
-      throw new InputError(`Invalid --level "${args.level}". Use: ${LOG_LEVELS.join(", ")}`, "invalid_level");
+      throw new InputError(
+        `Invalid --level "${args.level}". Use: ${LOG_LEVELS.join(", ")}`,
+        "invalid_level"
+      );
     }
     let limit;
     if (args.limit !== void 0) {
       limit = Number(args.limit);
       if (!Number.isInteger(limit) || limit < 1 || limit > 500) {
-        throw new InputError("Invalid --limit \u2014 expected an integer between 1 and 500.", "invalid_limit");
+        throw new InputError(
+          "Invalid --limit \u2014 expected an integer between 1 and 500.",
+          "invalid_limit"
+        );
       }
     }
     const initialSince = args.since ? parseSince(args.since) : Date.now() - DEFAULT_WINDOW_MS;
@@ -6479,7 +6778,9 @@ var logs_default = defineCommand4({
     };
     const print = (events) => {
       for (const e of events) {
-        process.stdout.write(args.json ? JSON.stringify(e) + "\n" : formatEvent(e, stdoutColor()) + "\n");
+        process.stdout.write(
+          args.json ? JSON.stringify(e) + "\n" : formatEvent(e, stdoutColor()) + "\n"
+        );
       }
     };
     const first = await fetchPage(initialSince, args.follow ? followLimit : limit, token);
@@ -6487,15 +6788,25 @@ var logs_default = defineCommand4({
     if (!args.follow) {
       if (first.events.length === 0) {
         if (args.json) {
-          process.stdout.write(JSON.stringify({ type: "meta", count: 0, window: windowLabel }) + "\n");
+          process.stdout.write(
+            JSON.stringify({ type: "meta", count: 0, window: windowLabel }) + "\n"
+          );
         } else {
           console.log(
             `No logs in the last ${windowLabel} for ${appId}. New logs can take up to a minute to appear; retention is 7 days.`
           );
         }
       } else if (first.truncated) {
-        if (args.json) process.stdout.write(JSON.stringify({ type: "meta", truncated: true }) + "\n");
-        else console.error(`(showing the newest ${first.events.length} events \u2014 narrow with --since/--level/--search)`);
+        if (args.json)
+          process.stdout.write(JSON.stringify({ type: "meta", truncated: true }) + "\n");
+        else if (args.search)
+          console.error(
+            `(showing the newest ${first.events.length} matches \u2014 search scans at most the newest 500 level-filtered events per fetch; narrow with --since/--level or raise --limit)`
+          );
+        else
+          console.error(
+            `(showing the newest ${first.events.length} events \u2014 narrow with --since/--level)`
+          );
       }
       return;
     }
@@ -6515,7 +6826,11 @@ var logs_default = defineCommand4({
         process.stdout.write(JSON.stringify({ type: "meta", truncated: true }) + "\n");
       } else {
         console.error(
-          paint("33", `(more than ${followLimit} events in the initial ${windowLabel} window \u2014 some older events not shown; narrow with --since/--level/--search)`, stderrColor())
+          paint(
+            "33",
+            args.search ? `(search scanned only the newest ${MAX_LIMIT} level-filtered events in the initial ${windowLabel} window \u2014 older matches may be omitted; narrow with --since/--level)` : `(more than ${followLimit} events in the initial ${windowLabel} window \u2014 some older events not shown; narrow with --since/--level)`,
+            stderrColor()
+          )
         );
       }
     }
@@ -6529,21 +6844,27 @@ var logs_default = defineCommand4({
         if (err instanceof ApiError && [401, 403, 404].includes(err.status)) throw err;
         backoff = Math.min(backoff ? backoff * 2 : MIN_POLL_MS, 3e4);
         const msg = err instanceof Error ? err.message : String(err);
-        console.error(paint("2", `(logs fetch failed: ${msg} \u2014 retrying in ${backoff / 1e3}s)`, stderrColor()));
+        console.error(
+          paint("2", `(logs fetch failed: ${msg} \u2014 retrying in ${backoff / 1e3}s)`, stderrColor())
+        );
         continue;
       }
       backoff = 0;
       interval = Math.max(page.pollIntervalMs || 0, MIN_POLL_MS);
       const fresh = seen.fresh(page.events);
       print(fresh);
-      const realDrop = fresh.length >= followLimit;
+      const realDrop = fresh.length >= followLimit || Boolean(args.search && page.truncated);
       if (realDrop && !warnedTruncated) {
         warnedTruncated = true;
         if (args.json) {
           process.stdout.write(JSON.stringify({ type: "meta", truncated: true }) + "\n");
         } else {
           console.error(
-            paint("33", `(burst exceeded ${followLimit} events/poll \u2014 some may be dropped; narrow with --level/--search)`, stderrColor())
+            paint(
+              "33",
+              args.search ? `(search scanned only the newest ${MAX_LIMIT} level-filtered events this poll \u2014 older matches may be omitted; narrow with --level)` : `(burst exceeded ${followLimit} events/poll \u2014 some may be dropped; narrow with --level)`,
+              stderrColor()
+            )
           );
         }
       } else if (!realDrop) {
@@ -9368,7 +9689,7 @@ function ok(json, data, human) {
 function warnIfDebugRoutesEnabled(secrets) {
   if (secrets.ALLOW_DEBUG_ROUTES !== "true") return false;
   console.warn(
-    "\n\u26A0  ALLOW_DEBUG_ROUTES=true exposes an UNAUTHENTICATED debug API on the deployed app \u2014\n   anyone who can reach /api/debug/* can read and mutate any record. Redeploy to apply;\n   `deepspace secrets delete ALLOW_DEBUG_ROUTES` (then redeploy) turns it back off."
+    "\n\u26A0  ALLOW_DEBUG_ROUTES=true enables the owner/admin debug API on the deployed app \u2014\n   those users can read and mutate any app record through /api/debug/*. Redeploy to apply;\n   `deepspace secrets delete ALLOW_DEBUG_ROUTES` (then redeploy) turns it back off."
   );
   return true;
 }
@@ -11137,6 +11458,11 @@ function appDirInWorktree(appDir, worktreeRoot) {
   const appRelative = relative2(realpathSync6(repoToplevel(appDir)), realpathSync6(appDir));
   return appRelative ? join22(worktreeRoot, appRelative) : worktreeRoot;
 }
+function primaryAppDir(appDir) {
+  const primary = listWorktrees(appDir)[0];
+  if (!primary) throw new Error("Git did not report a primary worktree");
+  return appDirInWorktree(appDir, primary.path);
+}
 function materializeWorkspaceWorktree(appDir, worktreeRoot, branch, startPoint, workspaceId, options = {}) {
   const createdOid = resolveCommit(appDir, startPoint);
   if (!createdOid) throw new Error(`Could not resolve workspace start point ${startPoint}`);
@@ -12163,6 +12489,11 @@ function conflictMarkerFiles(diffCheckOutput) {
   }
   return [...files];
 }
+function pullAfterLandAction(primaryDir, intoBranch, landedOid) {
+  if (currentBranch(primaryDir) !== intoBranch) return null;
+  if (resolveCommit(primaryDir, "HEAD") === landedOid) return null;
+  return { cwd: primaryDir, argv: ["deepspace", "pull"] };
+}
 function landResumeArgv(args) {
   const argv = ["deepspace", "workspace", "land"];
   const workspace = args.workspace?.trim();
@@ -12441,6 +12772,7 @@ var landWorkspaceCommand = defineDeepspaceCommand({
       );
     }
     spinner2?.stop(`Landed ${id} into ${intoBranch} at ${landedOid.slice(0, 10)}.`);
+    const primaryDir = primaryAppDir(appDir);
     const cleanup = keepWorktree ? null : cleanupWorkspaceLocal(appDir, id, intoBranch, { expectedBranchOid: landedOid });
     const inOwnWorktree = !cleanup && inOwnLinkedWorktree(appDir, id);
     const retainedWorktree = cleanup?.worktreeRetained ?? (keepWorktree || inOwnWorktree ? appDir : null);
@@ -12458,7 +12790,7 @@ var landWorkspaceCommand = defineDeepspaceCommand({
       p30.log.info(`Retained checkout: ${retainedWorktree}`);
     }
     if (cleanup?.error) {
-      const action = cleanupAction({
+      const action2 = cleanupAction({
         worktreeDir: cleanup.worktreeDir,
         branch: cleanup.branch
       });
@@ -12469,10 +12801,11 @@ var landWorkspaceCommand = defineDeepspaceCommand({
           branch: cleanup.branch
         }),
         "cleanup_incomplete",
-        { actionRequired: true, action, extra: data }
+        { actionRequired: true, action: action2, extra: data }
       );
     }
-    return { data };
+    const action = pullAfterLandAction(primaryDir, intoBranch, landedOid);
+    return { data, ...action ? { action } : {} };
   }
 });
 
@@ -12912,7 +13245,7 @@ var source_default = defineDeepspaceCommand({
   args: {
     provider: {
       type: "positional",
-      description: "Source provider: github or deepspace (omit to show)",
+      description: "Source authority: deepspace is platform-hosted and commit-first; github deploys the local working tree without Git sync (omit to show)",
       required: false
     },
     app: {