deepspace 0.18.0 → 0.19.1

package/dist/cli.js

@@ -8,8 +8,8 @@ import {
   renderUsage
 } from "citty";
 import { sync as spawnSync8 } from "cross-spawn";
-import { readFileSync as readFileSync28, existsSync as existsSync25 } from "fs";
-import { dirname as dirname11, join as join25 } from "path";
+import { readFileSync as readFileSync28, existsSync as existsSync26 } from "fs";
+import { dirname as dirname12, join as join24 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 
 // src/cli/lib/spinner.ts
@@ -205,6 +205,13 @@ var InputError = class extends Error {
     this.code = code;
   }
 };
+var CliExit = class extends Error {
+  constructor(exitCode) {
+    super(`exit ${exitCode}`);
+    this.exitCode = exitCode;
+    this.name = "CliExit";
+  }
+};
 function errorCode(err) {
   if (err instanceof ApiError || err instanceof InputError) return err.code;
   if (err instanceof Error && err.name === "GitError") return err.code ?? "git_error";
@@ -230,12 +237,17 @@ function formatCliError(err) {
 ${hint}` : message;
 }
 function renderCliError(err) {
+  if (err instanceof CliExit) {
+    process.exitCode = err.exitCode;
+    return;
+  }
   stopActiveSpinner();
   const message = formatCliError(err);
   const slug = errorCode(err);
   if (process.argv.includes("--json")) {
     console.log(JSON.stringify({ ok: false, ...slug ? { code: slug } : {}, error: message }));
-    process.exit(1);
+    process.exitCode = 1;
+    return;
   }
   console.error(slug ? withSlug(message, slug) : message);
   if (process.env.DEBUG) {
@@ -244,7 +256,7 @@ function renderCliError(err) {
 API ${apiPath}${status3 ? ` (${status3})` : ""}`);
     if (err instanceof Error && err.stack) console.error("\n" + err.stack);
   }
-  process.exit(1);
+  process.exitCode = 1;
 }
 function wrapCommandErrors(cmd) {
   const run2 = cmd.run;
@@ -301,10 +313,9 @@ function withoutReservedKeys(payload) {
     )
   );
 }
-function exitWhenFlushed(code) {
-  if (process.stdout.writableLength === 0) process.exit(code);
-  process.stdout.write("", () => process.exit(code));
-  return void 0;
+function finishCommand(code) {
+  stopActiveSpinner();
+  process.exitCode = code;
 }
 function nameVariants(name) {
   return [
@@ -342,7 +353,7 @@ function defineDeepspaceCommand(def) {
     ...def.args ?? {},
     json: {
       type: "boolean",
-      description: "Emit a single-line JSON result for scripts/agents",
+      description: def.jsonDescription ?? "Emit a single-line JSON result for scripts/agents",
       default: false
     }
   };
@@ -398,9 +409,9 @@ function defineDeepspaceCommand(def) {
           else p3.log.error(line);
           if (refusal?.action) printAction(refusal.action);
         }
-        exitWhenFlushed(refusal?.actionRequired ? 2 : 1);
+        finishCommand(refusal?.actionRequired ? 2 : 1);
       }
-      if (succeeded) exitWhenFlushed(0);
+      if (succeeded) finishCommand(0);
     }
   });
 }
@@ -515,7 +526,7 @@ function effectivePlatformUrls(env = process.env) {
 var DASHBOARD_URL = DEEPSPACE_ENV === "production" ? "https://dashboard.deep.space" : DEEPSPACE_ENV === "staging" ? "https://dashboard.deepspacesites.com" : "http://127.0.0.1:9";
 
 // src/cli/auth.ts
-import { readFileSync as readFileSync2, writeFileSync, existsSync, mkdirSync } from "fs";
+import { readFileSync as readFileSync2, existsSync, mkdirSync } from "fs";
 import { join } from "path";
 import { homedir } from "os";
 
@@ -543,6 +554,16 @@ async function exchangeSession(authUrl, sessionToken) {
   return data.token ?? null;
 }
 
+// src/cli/lib/secure-file.ts
+import { chmodSync, writeFileSync } from "fs";
+function writeSecretFileSync(path, content) {
+  writeFileSync(path, content, { mode: 384 });
+  try {
+    chmodSync(path, 384);
+  } catch {
+  }
+}
+
 // src/cli/auth.ts
 var AUTH_URL = process.env.DEEPSPACE_AUTH_URL ?? PLATFORM_URLS.auth;
 var PROD_AUTH_URL = "https://auth.deep.space";
@@ -585,7 +606,7 @@ async function ensureToken() {
     );
   }
   mkdirSync(DIR, { recursive: true, mode: 448 });
-  writeFileSync(TOKEN_PATH, token, { mode: 384 });
+  writeSecretFileSync(TOKEN_PATH, token);
   return token;
 }
 function isTokenValid(jwt) {
@@ -603,7 +624,7 @@ registerAuthRefresh(async () => {
     const token = await exchangeSession(AUTH_URL, sessionToken);
     if (!token) return null;
     mkdirSync(DIR, { recursive: true, mode: 448 });
-    writeFileSync(TOKEN_PATH, token, { mode: 384 });
+    writeSecretFileSync(TOKEN_PATH, token);
     return token;
   } catch {
     return null;
@@ -611,19 +632,18 @@ registerAuthRefresh(async () => {
 });
 
 // src/cli/commands/login.ts
-import { writeFileSync as writeFileSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3 } from "fs";
-import { join as join2 } from "path";
-import { homedir as homedir2 } from "os";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync3 } from "fs";
+import { dirname as dirname2 } from "path";
 import { randomBytes, createHash } from "crypto";
 import * as p4 from "@clack/prompts";
 
 // src/cli/lib/open-browser.ts
-import { exec } from "child_process";
+import { spawn } from "child_process";
 function openBrowser(url) {
   const quoted = JSON.stringify(url);
   const cmd = process.platform === "darwin" ? `open ${quoted}` : process.platform === "win32" ? `start "" ${quoted}` : `xdg-open ${quoted}`;
-  exec(cmd, () => {
-  });
+  spawn(cmd, { shell: true, detached: true, stdio: "ignore", windowsHide: true }).on("error", () => {
+  }).unref();
 }
 
 // src/cli/commands/login.ts
@@ -716,9 +736,13 @@ var login_default = defineDeepspaceCommand({
     if (!json) s.start("Waiting for authentication...");
     const result = await pollForCompletion(sessionId, codeVerifier);
     if (!result) {
-      throw new Refusal("Login timed out. Run `deepspace auth login` to try again.", "login_timeout", {
-        action: cliAction("deepspace", "auth", "login")
-      });
+      throw new Refusal(
+        "Login timed out. Run `deepspace auth login` to try again.",
+        "login_timeout",
+        {
+          action: cliAction("deepspace", "auth", "login")
+        }
+      );
     }
     storeCredentials(result.sessionToken, result.jwt);
     await provisionProfile(result.jwt);
@@ -798,11 +822,10 @@ async function pollForCompletion(sessionId, codeVerifier) {
   return null;
 }
 function storeCredentials(sessionToken, jwt) {
-  const dir = join2(homedir2(), ".deepspace");
-  mkdirSync2(dir, { recursive: true, mode: 448 });
   const { sessionPath, tokenPath } = credentialPaths(AUTH_URL2);
-  writeFileSync2(sessionPath, sessionToken, { mode: 384 });
-  writeFileSync2(tokenPath, jwt, { mode: 384 });
+  mkdirSync2(dirname2(sessionPath), { recursive: true, mode: 448 });
+  writeSecretFileSync(sessionPath, sessionToken);
+  writeSecretFileSync(tokenPath, jwt);
 }
 async function provisionProfile(jwt) {
   try {
@@ -883,8 +906,8 @@ var logout_default = defineDeepspaceCommand({
 });
 
 // src/cli/lib/app-identity.ts
-import { existsSync as existsSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
-import { join as join3, resolve as resolve2 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "fs";
+import { join as join2, resolve as resolve2 } from "path";
 import { parse as parseToml } from "smol-toml";
 
 // src/server/utils/registry-client.ts
@@ -919,7 +942,7 @@ function mintAppId(now = Date.now()) {
   return `app_${mintUlid(now)}`;
 }
 function readWranglerIdentityConfig(cwd) {
-  const wranglerPath = join3(resolve2(cwd), "wrangler.toml");
+  const wranglerPath = join2(resolve2(cwd), "wrangler.toml");
   if (!existsSync3(wranglerPath)) return null;
   try {
     return parseToml(readFileSync5(wranglerPath, "utf-8"));
@@ -938,7 +961,7 @@ function readAppId(cwd = process.cwd(), wranglerEnv) {
   return typeof id === "string" && APP_ID_RE.test(id) ? id : null;
 }
 function writeAppId(cwd, appId, opts = {}) {
-  const wranglerPath = join3(resolve2(cwd), "wrangler.toml");
+  const wranglerPath = join2(resolve2(cwd), "wrangler.toml");
   if (!existsSync3(wranglerPath)) {
     throw new Error(`No wrangler.toml in ${resolve2(cwd)}`);
   }
@@ -971,19 +994,19 @@ ${header}
 ${line}
 `;
   }
-  writeFileSync3(wranglerPath, src);
+  writeFileSync2(wranglerPath, src);
 }
 
 // src/cli/commands/dev.ts
-import { resolve as resolve8, basename as basename2, join as join12 } from "path";
-import spawn from "cross-spawn";
+import { resolve as resolve8, basename as basename2, join as join11 } from "path";
+import spawn2 from "cross-spawn";
 
 // src/cli/lib/app-context.ts
 import { existsSync as existsSync4, readFileSync as readFileSync6, readdirSync } from "fs";
-import { dirname as dirname2, join as join4, resolve as resolve3 } from "path";
+import { dirname as dirname3, join as join3, resolve as resolve3 } from "path";
 import { parse as parseToml2 } from "smol-toml";
 function detectAppName(cwd = process.cwd()) {
-  const wranglerPath = join4(resolve3(cwd), "wrangler.toml");
+  const wranglerPath = join3(resolve3(cwd), "wrangler.toml");
   if (!existsSync4(wranglerPath)) return null;
   try {
     const config = parseToml2(readFileSync6(wranglerPath, "utf-8"));
@@ -998,15 +1021,15 @@ function detectAppName(cwd = process.cwd()) {
 function findAppDir(start = process.cwd()) {
   let dir = resolve3(start);
   for (; ; ) {
-    if (existsSync4(join4(dir, "wrangler.toml"))) return dir;
-    const parent = dirname2(dir);
+    if (existsSync4(join3(dir, "wrangler.toml"))) return dir;
+    const parent = dirname3(dir);
     if (parent === dir) return null;
     dir = parent;
   }
 }
 function findChildApps(dir) {
   try {
-    return readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && existsSync4(join4(dir, entry.name, "wrangler.toml"))).map((entry) => entry.name).sort();
+    return readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && existsSync4(join3(dir, entry.name, "wrangler.toml"))).map((entry) => entry.name).sort();
   } catch {
     return [];
   }
@@ -1017,16 +1040,16 @@ import {
   existsSync as existsSync5,
   readFileSync as readFileSync8,
   realpathSync as realpathSync2,
-  writeFileSync as writeFileSync4,
+  writeFileSync as writeFileSync3,
   mkdirSync as mkdirSync4,
   renameSync,
   unlinkSync
 } from "fs";
-import { join as join6, resolve as resolve5, dirname as dirname4, basename, isAbsolute as isAbsolute2, sep } from "path";
+import { join as join5, resolve as resolve5, dirname as dirname5, basename, isAbsolute as isAbsolute2, sep } from "path";
 
 // src/cli/lib/git/repository.ts
 import { appendFileSync, mkdirSync as mkdirSync3, readFileSync as readFileSync7 } from "fs";
-import { dirname as dirname3, join as join5, resolve as resolve4 } from "path";
+import { dirname as dirname4, join as join4, resolve as resolve4 } from "path";
 
 // src/cli/lib/git/process.ts
 import { sync as spawnSync } from "cross-spawn";
@@ -1230,7 +1253,7 @@ function listWorktrees(cwd) {
 }
 function ensureLocalExclude(cwd, pattern) {
   const commonDir = resolve4(cwd, gitLine(cwd, ["rev-parse", "--git-common-dir"]));
-  const excludePath = join5(commonDir, "info", "exclude");
+  const excludePath = join4(commonDir, "info", "exclude");
   let current = "";
   try {
     current = readFileSync7(excludePath, "utf-8");
@@ -1238,7 +1261,7 @@ function ensureLocalExclude(cwd, pattern) {
   }
   if (current.split("\n").some((line) => line.trim() === pattern)) return;
   try {
-    mkdirSync3(dirname3(excludePath), { recursive: true });
+    mkdirSync3(dirname4(excludePath), { recursive: true });
     appendFileSync(
       excludePath,
       `${current.endsWith("\n") || current === "" ? "" : "\n"}${pattern}
@@ -1250,9 +1273,9 @@ function ensureLocalExclude(cwd, pattern) {
 
 // src/cli/lib/launch-config.ts
 function writeLaunchFile(launchPath, config) {
-  mkdirSync4(dirname4(launchPath), { recursive: true });
+  mkdirSync4(dirname5(launchPath), { recursive: true });
   const tmpPath = `${launchPath}.${process.pid}.tmp`;
-  writeFileSync4(tmpPath, JSON.stringify(config, null, 2) + "\n");
+  writeFileSync3(tmpPath, JSON.stringify(config, null, 2) + "\n");
   try {
     renameSync(tmpPath, launchPath);
   } catch (err) {
@@ -1273,7 +1296,7 @@ function readLaunchFile(launchPath) {
   return parsed;
 }
 function writeLaunchConfigIfMissing(appDir, appName, port, opts = {}) {
-  const launchPath = join6(appDir, ".claude", "launch.json");
+  const launchPath = join5(appDir, ".claude", "launch.json");
   try {
     const config = readLaunchFile(launchPath);
     if (!config) return;
@@ -1314,7 +1337,7 @@ function writeLaunchConfigIfMissing(appDir, appName, port, opts = {}) {
 }
 function resolveAppLaunchPort(appDir) {
   try {
-    const config = readLaunchFile(join6(appDir, ".claude", "launch.json"));
+    const config = readLaunchFile(join5(appDir, ".claude", "launch.json"));
     if (!config) return null;
     const appName = detectAppName(appDir) ?? basename(appDir);
     const entry = config.configurations.find((c) => c?.name === appName) ?? (config.configurations.length === 1 ? config.configurations[0] : void 0);
@@ -1331,10 +1354,10 @@ function detectClaudeWorktree(appDir) {
       listWorktrees(appDir).map((worktree) => canonicalPath(worktree.path))
     );
     if (!registered.has(worktreeRoot)) return null;
-    const worktreesDir = dirname4(worktreeRoot);
-    const claudeDir = dirname4(worktreesDir);
+    const worktreesDir = dirname5(worktreeRoot);
+    const claudeDir = dirname5(worktreesDir);
     if (basename(worktreesDir) !== "worktrees" || basename(claudeDir) !== ".claude") return null;
-    const ownerRoot = canonicalPath(dirname4(claudeDir));
+    const ownerRoot = canonicalPath(dirname5(claudeDir));
     if (!registered.has(ownerRoot)) return null;
     return { mainRepoRoot: ownerRoot, worktreeName: basename(worktreeRoot) };
   } catch {
@@ -1368,12 +1391,12 @@ function deriveWorktreePort(worktreeKey) {
   return WORKTREE_PORT_MIN + hash % WORKTREE_PORT_RANGE;
 }
 function upsertWorktreeLaunchConfig(mainRepoRoot, worktreeName, appDir, opts) {
-  const launchPath = join6(mainRepoRoot, ".claude", "launch.json");
+  const launchPath = join5(mainRepoRoot, ".claude", "launch.json");
   const entryName = WORKTREE_ENTRY_PREFIX + worktreeName;
   try {
     const config = readLaunchFile(launchPath);
     if (!config) return null;
-    const worktreesRoot = join6(mainRepoRoot, ".claude", "worktrees") + sep;
+    const worktreesRoot = join5(mainRepoRoot, ".claude", "worktrees") + sep;
     config.configurations = config.configurations.filter((c) => {
       if (c?.name === entryName) return false;
       const isStaleWorktreeEntry = typeof c?.name === "string" && c.name.startsWith(WORKTREE_ENTRY_PREFIX) && typeof c.cwd === "string" && isAbsolute2(c.cwd) && c.cwd.startsWith(worktreesRoot) && !existsSync5(c.cwd);
@@ -1411,7 +1434,7 @@ function resolveWorktreePort(appDir) {
   const claude = detectClaudeWorktree(appDir);
   if (claude) {
     try {
-      const config = readLaunchFile(join6(claude.mainRepoRoot, ".claude", "launch.json"));
+      const config = readLaunchFile(join5(claude.mainRepoRoot, ".claude", "launch.json"));
       const entry = config?.configurations.find(
         (c) => c?.name === WORKTREE_ENTRY_PREFIX + claude.worktreeName
       );
@@ -1472,19 +1495,9 @@ async function fetchAppIdentityToken(deployUrl, callerJwt, appId) {
   return body.token;
 }
 
-// src/cli/lib/secure-file.ts
-import { chmodSync, writeFileSync as writeFileSync5 } from "fs";
-function writeSecretFileSync(path, content) {
-  writeFileSync5(path, content, { mode: 384 });
-  try {
-    chmodSync(path, 384);
-  } catch {
-  }
-}
-
 // src/cli/lib/wrangler-env.ts
-import { existsSync as existsSync6, readFileSync as readFileSync9, rmSync as rmSync2, writeFileSync as writeFileSync6 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync9, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
+import { join as join6 } from "path";
 import { parse as parseToml3, stringify as stringifyToml } from "smol-toml";
 
 // src/server/rooms/app-name.ts
@@ -1585,7 +1598,7 @@ function resolveAppNameForEnv(config, envName) {
   return resolveAppName(envBlock.name);
 }
 function devVarsPathFor(appDir) {
-  return join7(appDir, ".dev.vars");
+  return join6(appDir, ".dev.vars");
 }
 function prepareWranglerEnvConfig(appDir, envName) {
   if (!envName) return { cleanup() {
@@ -1594,11 +1607,11 @@ function prepareWranglerEnvConfig(appDir, envName) {
   const resolved = resolveAppNameForEnv(config, envName);
   if (!resolved.ok) throw new Error(resolved.reason);
   const flattened = flattenWranglerEnvConfig(config, envName);
-  const configPath = join7(
+  const configPath = join6(
     appDir,
     `.wrangler.deepspace.${safeGeneratedConfigSegment(envName)}.${process.pid}.${++generatedConfigSeq}.toml`
   );
-  writeFileSync6(
+  writeFileSync4(
     configPath,
     [
       "# Generated by DeepSpace for this CLI run.",
@@ -1660,7 +1673,7 @@ var WranglerConfigError = class extends Error {
   }
 };
 function readWranglerConfig(appDir) {
-  const path = join7(appDir, "wrangler.toml");
+  const path = join6(appDir, "wrangler.toml");
   const raw = readFileSync9(path, "utf-8");
   try {
     return parseToml3(raw);
@@ -1669,7 +1682,7 @@ function readWranglerConfig(appDir) {
   }
 }
 function hasWranglerConfig(appDir) {
-  return existsSync6(join7(appDir, "wrangler.toml"));
+  return existsSync6(join6(appDir, "wrangler.toml"));
 }
 
 // src/cli/lib/dev-vars.ts
@@ -1712,21 +1725,21 @@ async function writeDevVars(appDir, ownerId, callerJwt, wranglerEnv, opts = {})
 
 // src/cli/lib/install-status.ts
 import { existsSync as existsSync8, readFileSync as readFileSync11, realpathSync as realpathSync3 } from "fs";
-import { dirname as dirname5, join as join9, resolve as resolve6 } from "path";
+import { dirname as dirname6, join as join8, resolve as resolve6 } from "path";
 
 // src/cli/lib/package-manager.ts
 import { existsSync as existsSync7, readFileSync as readFileSync10 } from "fs";
-import { join as join8 } from "path";
+import { join as join7 } from "path";
 function detectPackageManager(appDir) {
   try {
-    const pkg2 = JSON.parse(readFileSync10(join8(appDir, "package.json"), "utf-8"));
+    const pkg2 = JSON.parse(readFileSync10(join7(appDir, "package.json"), "utf-8"));
     const name = typeof pkg2.packageManager === "string" ? pkg2.packageManager.split("@")[0] : "";
     if (name === "npm" || name === "pnpm" || name === "yarn" || name === "bun") return name;
   } catch {
   }
-  if (existsSync7(join8(appDir, "pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync7(join8(appDir, "yarn.lock"))) return "yarn";
-  if (existsSync7(join8(appDir, "bun.lock")) || existsSync7(join8(appDir, "bun.lockb"))) return "bun";
+  if (existsSync7(join7(appDir, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync7(join7(appDir, "yarn.lock"))) return "yarn";
+  if (existsSync7(join7(appDir, "bun.lock")) || existsSync7(join7(appDir, "bun.lockb"))) return "bun";
   return "npm";
 }
 function installCommand(appDir) {
@@ -1736,10 +1749,10 @@ function installCommand(appDir) {
 // src/cli/lib/install-status.ts
 function installState(appDir) {
   if (resolvesDeepspace(appDir)) return "ready";
-  const sentinelDir = join9(appDir, ".deepspace");
-  if (existsSync8(join9(sentinelDir, "install.err"))) return "failed";
-  if (existsSync8(join9(sentinelDir, "install.started"))) {
-    if (!existsSync8(join9(sentinelDir, "install.done")) && installWorkerAlive(sentinelDir)) {
+  const sentinelDir = join8(appDir, ".deepspace");
+  if (existsSync8(join8(sentinelDir, "install.err"))) return "failed";
+  if (existsSync8(join8(sentinelDir, "install.started"))) {
+    if (!existsSync8(join8(sentinelDir, "install.done")) && installWorkerAlive(sentinelDir)) {
       return "installing";
     }
     return "failed";
@@ -1751,11 +1764,11 @@ function tailHint(logPath, platform = process.platform) {
 }
 function ensureInstallReady(appDir) {
   if (resolvesDeepspace(appDir)) return;
-  const sentinelDir = join9(appDir, ".deepspace");
-  const errPath = join9(sentinelDir, "install.err");
-  const startedPath = join9(sentinelDir, "install.started");
-  const donePath = join9(sentinelDir, "install.done");
-  const logPath = join9(sentinelDir, "install.log");
+  const sentinelDir = join8(appDir, ".deepspace");
+  const errPath = join8(sentinelDir, "install.err");
+  const startedPath = join8(sentinelDir, "install.started");
+  const donePath = join8(sentinelDir, "install.done");
+  const logPath = join8(sentinelDir, "install.log");
   if (existsSync8(errPath)) {
     const detail = readFileSync11(errPath, "utf-8").trimEnd();
     const log29 = existsSync8(logPath) ? ` Full log: ${logPath}.` : "";
@@ -1796,9 +1809,9 @@ function resolvesDeepspace(fromDir) {
   } catch {
   }
   for (; ; ) {
-    if (existsSync8(join9(dir, "node_modules", "deepspace", "package.json"))) return true;
+    if (existsSync8(join8(dir, "node_modules", "deepspace", "package.json"))) return true;
     if (dir === checkoutRoot) return false;
-    const parent = dirname5(dir);
+    const parent = dirname6(dir);
     if (parent === dir) return false;
     dir = parent;
   }
@@ -1811,7 +1824,7 @@ function canonicalPath2(path) {
   }
 }
 function installWorkerAlive(sentinelDir) {
-  const pidPath = join9(sentinelDir, "install.pid");
+  const pidPath = join8(sentinelDir, "install.pid");
   if (!existsSync8(pidPath)) return false;
   const pid = Number(readFileSync11(pidPath, "utf-8").trim());
   if (!Number.isSafeInteger(pid) || pid <= 0) return false;
@@ -1864,7 +1877,7 @@ function preflightWindowsWorkerd(appDir) {
 
 // src/cli/lib/macos-junk.ts
 import { readdirSync as readdirSync2, rmSync as rmSync3 } from "fs";
-import { join as join10 } from "path";
+import { join as join9 } from "path";
 var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", ".wrangler", ".vite"]);
 function removeMacosJunk(dir) {
   let removed = 0;
@@ -1875,7 +1888,7 @@ function removeMacosJunk(dir) {
     return removed;
   }
   for (const entry of entries) {
-    const path = join10(dir, entry.name);
+    const path = join9(dir, entry.name);
     if (entry.isDirectory()) {
       if (!SKIP_DIRS.has(entry.name)) removed += removeMacosJunk(path);
       continue;
@@ -2373,7 +2386,7 @@ async function refreshSecretsCache(deployUrl, token, appId, wranglerEnv, selecte
 
 // src/cli/lib/schema-lint.ts
 import { existsSync as existsSync10 } from "fs";
-import { join as join11 } from "path";
+import { join as join10 } from "path";
 import { pathToFileURL } from "url";
 
 // src/server/schemas/registry.ts
@@ -2412,7 +2425,7 @@ function lintSchema(schema) {
   if (schema.ownerField) {
     const col = schema.columns.find((c) => c.name === schema.ownerField);
     const spoofableRoles = Object.entries(schema.permissions).filter(
-      ([role, permissions]) => role !== "owner" && role !== "admin" && permissions.create === true
+      ([role, permissions]) => role !== "owner" && role !== "admin" && permissions.create === true && permissions.update !== "unclaimed-or-own"
     ).map(([role]) => role);
     if (col && !col.userBound && spoofableRoles.length > 0) {
       warnings.push(
@@ -2432,12 +2445,12 @@ function lintSchema(schema) {
 
 // src/cli/lib/schema-lint.ts
 async function lintProjectSchemas(appDir) {
-  const schemasPath = join11(appDir, "src", "schemas.ts");
+  const schemasPath = join10(appDir, "src", "schemas.ts");
   if (!existsSync10(schemasPath)) return null;
   let schemas;
   try {
     const esbuild = await import("esbuild");
-    const outFile = join11(appDir, ".wrangler", "deploy", "schemas.lint.bundle.mjs");
+    const outFile = join10(appDir, ".wrangler", "deploy", "schemas.lint.bundle.mjs");
     await esbuild.build({
       entryPoints: [schemasPath],
       bundle: true,
@@ -2498,9 +2511,9 @@ function isPortListening(port, host, timeoutMs = 500) {
     socket.connect(port, target2);
   });
 }
-async function waitForPortListening(port, host, timeoutMs) {
+async function waitForPortListening(port, host, timeoutMs, signal) {
   const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
+  while (Date.now() < deadline && !signal?.aborted) {
     if (await isPortListening(port, host)) return true;
     await new Promise((resolve21) => setTimeout(resolve21, 250));
   }
@@ -2598,7 +2611,7 @@ var dev_default = defineDeepspaceCommand({
         );
       } else if (!args.json) {
         console.warn(
-          `Warning: could not update ${join12(worktree.mainRepoRoot, ".claude", "launch.json")} (malformed or unwritable) \u2014 the Claude preview tool may serve the main repo's code instead of this worktree.`
+          `Warning: could not update ${join11(worktree.mainRepoRoot, ".claude", "launch.json")} (malformed or unwritable) \u2014 the Claude preview tool may serve the main repo's code instead of this worktree.`
         );
       }
     }
@@ -2664,13 +2677,15 @@ Free it with \`${killCmd}\`, or start on another port: \`deepspace dev start --p
     }
     const url = `http://${host === DEFAULT_DEV_HOST ? "localhost" : host}:${port}`;
     say("Starting dev server...\n");
-    const vite = spawn("npx", ["vite", "--port", String(port), "--strictPort", "--host", host], {
+    const vite = spawn2("npx", ["vite", "--port", String(port), "--strictPort", "--host", host], {
       cwd: appDir,
       stdio: "inherit",
       env: wranglerViteEnv(process.env, wranglerConfig, { DEEPSPACE_PORT: String(port) })
     });
+    const readiness = new AbortController();
     if (args.json) {
-      void waitForPortListening(port, host, READINESS_TIMEOUT_MS).then((ready) => {
+      void waitForPortListening(port, host, READINESS_TIMEOUT_MS, readiness.signal).then((ready) => {
+        if (readiness.signal.aborted) return;
         console.log(
           JSON.stringify(
             ready ? { ok: true, ready: true, url, port, host, appDir } : {
@@ -2702,6 +2717,7 @@ Free it with \`${killCmd}\`, or start on another port: \`deepspace dev start --p
     });
     process.off("SIGINT", stop);
     process.off("SIGTERM", stop);
+    readiness.abort();
     if (!devExitSucceeded(code, stopping)) {
       throw new Refusal(`Dev server exited with code ${code}.`, "dev_server_failed", {
         extra: { port, appDir, exitCode: code }
@@ -2817,12 +2833,12 @@ var kill_default = defineDeepspaceCommand({
   }
 });
 function noTargetsMessage(opts) {
-  const { enumerated, swept, all, port } = opts;
+  const { enumerated, swept, all, port, platform = process.platform } = opts;
   const couldObserve = enumerated || all && swept;
   if (!couldObserve) {
     return {
       ok: false,
-      message: `Couldn't determine what's running on :${port}: no lsof/pgrep and /proc is unavailable, so nothing was inspected or killed. Install lsof (or procps for pgrep), or find and kill the process manually.`
+      message: platform === "win32" ? `Couldn't determine what's running on :${port}: the PowerShell port query could not be run, so nothing was inspected or killed. Either powershell.exe (or pwsh) is not on PATH, or Get-NetTCPConnection is unavailable on this Windows edition. Find the process manually with \`netstat -ano | findstr :${port}\`.` : `Couldn't determine what's running on :${port}: no lsof/pgrep and /proc is unavailable, so nothing was inspected or killed. Install lsof (or procps for pgrep), or find and kill the process manually.`
     };
   }
   return {
@@ -2917,7 +2933,7 @@ function sweepByName(names) {
   const all = /* @__PURE__ */ new Set();
   if (IS_WIN) {
     const orClauses = names.map((n) => `($_.Name -like '*${n}*') -or ($_.CommandLine -like '*${n}*')`).join(" -or ");
-    const script = `Get-CimInstance Win32_Process | Where-Object { ${orClauses} } | Select-Object -ExpandProperty ProcessId`;
+    const script = `Get-CimInstance Win32_Process | Where-Object { $_.ProcessId -ne $PID -and (${orClauses}) } | Select-Object -ExpandProperty ProcessId`;
     const r = runPowershellChecked(script);
     for (const pid of r.pids) if (pid !== process.pid) all.add(pid);
     return { pids: [...all], swept: r.ran };
@@ -2954,14 +2970,22 @@ function run(cmd) {
 function runPowershell(script) {
   return runPowershellChecked(script).pids;
 }
+var PS_SENTINEL = "__deepspace_ps_ok__";
+function withSentinel(script) {
+  return `$ErrorActionPreference='Stop'; try { ${script}; '${PS_SENTINEL}' } catch { }`;
+}
+function readPowershellPids(stdout) {
+  if (!stdout.includes(PS_SENTINEL)) return { pids: [], ran: false };
+  return { pids: parsePidLines(stdout.replace(PS_SENTINEL, "")), ran: true };
+}
 function runPowershellChecked(script) {
   const exe = pwshOrPowershell();
   try {
-    const r = spawnSync2(exe, ["-NoProfile", "-NonInteractive", "-Command", script], {
+    const r = spawnSync2(exe, ["-NoProfile", "-NonInteractive", "-Command", withSentinel(script)], {
       encoding: "utf-8"
     });
     if (r.error) return { pids: [], ran: false };
-    return { pids: r.status === 0 ? parsePidLines(r.stdout) : [], ran: r.status === 0 };
+    return readPowershellPids(r.stdout ?? "");
   } catch {
     return { pids: [], ran: false };
   }
@@ -3026,10 +3050,10 @@ function ensurePlaywright(appDir) {
 import { readFileSync as readFileSync14 } from "fs";
 
 // src/testing/accounts.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync13, writeFileSync as writeFileSync7 } from "fs";
-import { homedir as homedir3 } from "os";
-import { join as join13 } from "path";
-var TEST_ACCOUNTS_PATH = join13(homedir3(), ".deepspace", "test-accounts.json");
+import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync13, writeFileSync as writeFileSync5 } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join12 } from "path";
+var TEST_ACCOUNTS_PATH = join12(homedir2(), ".deepspace", "test-accounts.json");
 var PRODUCTION_AUTH_ORIGIN = "https://auth.deep.space";
 var STAGING_AUTH_ORIGIN = "https://auth.deepspacesites.com";
 function currentTestAccountScope(env = process.env) {
@@ -3045,7 +3069,7 @@ function normalizeTestAccountScope(value) {
 }
 function loadAllTestAccounts(scope = currentTestAccountScope()) {
   const store = readTestAccountStore();
-  return mergeTestAccounts(store.scopes[scope] ?? [], store.unscoped);
+  return store.scopes[scope] ?? [];
 }
 function reconcileTestAccountStore(remote, scope = currentTestAccountScope()) {
   const result = reconcileTestAccountScopes(readTestAccountStore(), remote, scope);
@@ -3054,24 +3078,20 @@ function reconcileTestAccountStore(remote, scope = currentTestAccountScope()) {
 }
 function reconcileTestAccountScopes(store, remote, scope) {
   const scoped = store.scopes[scope] ?? [];
-  const current = reconcileTestAccounts(scoped, remote);
-  const migrated = reconcileTestAccounts(store.unscoped, remote);
-  const accounts = mergeTestAccounts(current, migrated);
+  const accounts = reconcileTestAccounts(scoped, remote);
   return {
     accounts,
-    removed: Math.max(0, scoped.length - current.length),
+    removed: Math.max(0, scoped.length - accounts.length),
     store: {
       version: 2,
-      scopes: { ...store.scopes, [scope]: accounts },
-      unscoped: store.unscoped.filter((account) => !remote.some((item) => accountMatchesRemote(account, item)))
+      scopes: { ...store.scopes, [scope]: accounts }
     }
   };
 }
 function reconcileTestAccounts(local, remote) {
   const localById = new Map(local.filter((account) => account.id).map((account) => [account.id, account]));
-  const legacyByEmail = new Map(local.filter((account) => !account.id).map((account) => [account.email, account]));
   return remote.flatMap((account) => {
-    const stored = localById.get(account.id) ?? legacyByEmail.get(account.email);
+    const stored = localById.get(account.id);
     return stored ? [{ ...stored, ...account }] : [];
   });
 }
@@ -3082,10 +3102,7 @@ function upsertTestAccount(account, scope = currentTestAccountScope()) {
   );
   saveTestAccountStore({
     version: 2,
-    scopes: { ...store.scopes, [scope]: [...accounts, account] },
-    unscoped: store.unscoped.filter(
-      (stored) => stored.id !== account.id && stored.email !== account.email
-    )
+    scopes: { ...store.scopes, [scope]: [...accounts, account] }
   });
 }
 function removeTestAccounts(ids, emails = [], scope = currentTestAccountScope()) {
@@ -3095,45 +3112,35 @@ function removeTestAccounts(ids, emails = [], scope = currentTestAccountScope())
   const store = readTestAccountStore();
   saveTestAccountStore({
     version: 2,
-    scopes: { ...store.scopes, [scope]: (store.scopes[scope] ?? []).filter(keep) },
-    unscoped: store.unscoped.filter(keep)
+    scopes: { ...store.scopes, [scope]: (store.scopes[scope] ?? []).filter(keep) }
   });
 }
 function readTestAccountStore() {
-  if (!existsSync11(TEST_ACCOUNTS_PATH)) return { version: 2, scopes: {}, unscoped: [] };
+  if (!existsSync11(TEST_ACCOUNTS_PATH)) return { version: 2, scopes: {} };
   try {
     const raw = JSON.parse(readFileSync13(TEST_ACCOUNTS_PATH, "utf-8"));
-    if (Array.isArray(raw)) return { version: 2, scopes: {}, unscoped: validTestAccounts(raw) };
-    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
-      return { version: 2, scopes: {}, unscoped: [] };
+    if (Array.isArray(raw)) return { version: 2, scopes: {} };
+    if (!raw || typeof raw !== "object") {
+      return { version: 2, scopes: {} };
     }
     const candidate = raw;
     const scopes = candidate.scopes && typeof candidate.scopes === "object" && !Array.isArray(candidate.scopes) ? Object.fromEntries(Object.entries(candidate.scopes).map(([key, value]) => [key, validTestAccounts(value)])) : {};
-    return { version: 2, scopes, unscoped: validTestAccounts(candidate.unscoped) };
+    return { version: 2, scopes };
   } catch {
-    return { version: 2, scopes: {}, unscoped: [] };
+    return { version: 2, scopes: {} };
   }
 }
 function validTestAccounts(value) {
   if (!Array.isArray(value)) return [];
-  return value.filter((item) => Boolean(
-    item && typeof item === "object" && typeof item.email === "string" && typeof item.password === "string"
-  ));
-}
-function mergeTestAccounts(...groups) {
-  const accounts = /* @__PURE__ */ new Map();
-  for (const account of groups.flat()) {
-    const key = account.id ? `id:${account.id}` : `email:${account.email}`;
-    if (!accounts.has(key)) accounts.set(key, account);
-  }
-  return [...accounts.values()];
-}
-function accountMatchesRemote(local, remote) {
-  return local.id ? local.id === remote.id : local.email === remote.email;
+  return value.filter(
+    (item) => Boolean(
+      item && typeof item === "object" && typeof item.id === "string" && typeof item.email === "string" && typeof item.password === "string"
+    )
+  );
 }
 function saveTestAccountStore(store) {
-  mkdirSync5(join13(homedir3(), ".deepspace"), { recursive: true });
-  writeFileSync7(TEST_ACCOUNTS_PATH, JSON.stringify(store, null, 2), { mode: 384 });
+  mkdirSync5(join12(homedir2(), ".deepspace"), { recursive: true });
+  writeFileSync5(TEST_ACCOUNTS_PATH, JSON.stringify(store, null, 2), { mode: 384 });
 }
 
 // src/cli/lib/test-account-service.ts
@@ -3187,11 +3194,24 @@ async function syncTestAccountStore() {
 
 // src/cli/commands/test.ts
 var DEPLOY_URL2 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
+var PLAYWRIGHT_OUTPUT_DIR = ".deepspace/test-results";
+function playwrightTestArgs(testFiles) {
+  return [
+    "playwright",
+    "test",
+    "--config",
+    "tests/playwright.config.ts",
+    "--output",
+    PLAYWRIGHT_OUTPUT_DIR,
+    ...testFiles
+  ];
+}
 var test_default = defineDeepspaceCommand({
   meta: {
     name: "test",
     description: "Run tests for your DeepSpace app"
   },
+  jsonDescription: "Stream test output; emit the final JSON result on the last line",
   args: {
     suite: {
       type: "positional",
@@ -3324,15 +3344,14 @@ function runPlaywright(appDir, testFiles, port, wranglerEnv) {
     return 1;
   }
   try {
-    const result = spawnSync4(
-      "npx",
-      ["playwright", "test", "--config", "tests/playwright.config.ts", ...testFiles],
-      {
-        cwd: appDir,
-        stdio: "inherit",
-        env: wranglerViteEnv(process.env, wranglerConfig, { DEEPSPACE_PORT: String(port) })
-      }
-    );
+    const result = spawnSync4("npx", playwrightTestArgs(testFiles), {
+      cwd: appDir,
+      stdio: "inherit",
+      env: wranglerViteEnv(process.env, wranglerConfig, {
+        DEEPSPACE_PORT: String(port),
+        PLAYWRIGHT_HTML_OUTPUT_DIR: ".deepspace/playwright-report"
+      })
+    });
     return result.status ?? 1;
   } finally {
     wranglerConfig.cleanup();
@@ -3621,7 +3640,7 @@ var clear = defineDeepspaceCommand({
       return { data: { deleted: 0, requested: 0, failures: [] } };
     }
     if (!args.yes) {
-      if (args.json) {
+      if (!process.stdin.isTTY || args.json) {
         throw new Refusal(
           "Deleting test accounts needs confirmation. Pass --yes to confirm non-interactively.",
           "confirmation_required"
@@ -3851,14 +3870,14 @@ import * as p6 from "@clack/prompts";
 import { execSync as execSync2 } from "child_process";
 import { createHash as createHash2 } from "crypto";
 import { existsSync as existsSync14, readFileSync as readFileSync17, readdirSync as readdirSync4 } from "fs";
-import { dirname as dirname6, join as join16, resolve as resolve11 } from "path";
+import { dirname as dirname7, join as join15, resolve as resolve11 } from "path";
 
 // src/documentation/deploy.ts
 import { existsSync as existsSync12, readFileSync as readFileSync15 } from "fs";
-import { join as join14 } from "path";
+import { join as join13 } from "path";
 function readDocumentationDeployManifest(appDir, clientDir) {
-  if (!existsSync12(join14(appDir, "documentation.json"))) return void 0;
-  const manifestPath = join14(clientDir, "_documentation", "manifest.json");
+  if (!existsSync12(join13(appDir, "documentation.json"))) return void 0;
+  const manifestPath = join13(clientDir, "_documentation", "manifest.json");
   if (!existsSync12(manifestPath)) {
     throw new Error(
       "documentation.json exists but the build produced no documentation manifest. Ensure vite.config.ts includes deepSpaceDocumentation() from deepspace/documentation."
@@ -3879,12 +3898,13 @@ import {
   readFileSync as readFileSync16,
   writeSync
 } from "fs";
-import { join as join15 } from "path";
+import { join as join14 } from "path";
 
 // src/shared/protocol/app-migrations.ts
 var APP_MIGRATION_ID_RE = /^[a-z0-9][a-z0-9._-]{0,127}$/;
 var MAX_APP_MIGRATION_IDS = 256;
 var WORKER_OWNED_NOT_FOUND_MIGRATION_ID = "2026-08-worker-owned-not-found";
+var SECURE_ROOM_BOUNDARIES_MIGRATION_ID = "2026-08-secure-room-boundaries";
 function validateAppMigrationIds(value) {
   if (!Array.isArray(value)) {
     return { valid: false, reason: "app migrations must be a JSON string array" };
@@ -3918,13 +3938,19 @@ var SOURCE_MIGRATIONS = [
     description: "Let the worker answer misses, so deleted files 404 instead of serving HTML",
     transform: migrateWorkerOwnedNotFound,
     findBlockers: findWorkerOwnedNotFoundBlockers
+  },
+  {
+    id: SECURE_ROOM_BOUNDARIES_MIGRATION_ID,
+    description: "Secure room identity, job mutations, and production debug routes",
+    transform: migrateSecureRoomBoundaries,
+    findBlockers: findSecureRoomBoundaryBlockers
   }
 ];
 var APP_MIGRATION_DEFINITIONS = SOURCE_MIGRATIONS.map(
   ({ id, description }) => ({ id, description })
 );
 function readAppliedAppMigrations(appDir) {
-  const path = join15(appDir, APP_MIGRATIONS_MANIFEST);
+  const path = join14(appDir, APP_MIGRATIONS_MANIFEST);
   if (!existsSync13(path)) return [];
   const source = readRegularFile(path);
   let parsed;
@@ -3951,7 +3977,7 @@ function planAppMigrations(appDir) {
   const edits = [];
   for (const repoPath of tracked) {
     if (!isSourcePath(repoPath, appPrefix)) continue;
-    const absolutePath = join15(repo, repoPath);
+    const absolutePath = join14(repo, repoPath);
     let stat;
     try {
       stat = lstatSync(absolutePath);
@@ -3959,7 +3985,8 @@ function planAppMigrations(appDir) {
       continue;
     }
     if (!stat.isFile() || stat.isSymbolicLink()) continue;
-    const before = readRegularFile(absolutePath);
+    const checkout = readRegularFile(absolutePath);
+    const before = normalizeEol(checkout);
     let after = before;
     for (const migration of pendingMigrations) {
       const result = migration.transform(after, repoPath);
@@ -3977,7 +4004,9 @@ function planAppMigrations(appDir) {
       }
       blockers.push(...migration.findBlockers(after, repoPath));
     }
-    if (after !== before) edits.push({ path: repoPath, before, after });
+    if (after !== before) {
+      edits.push({ path: repoPath, before: checkout, after: restoreEol(after, checkout) });
+    }
   }
   const pending = pendingMigrations.map((migration) => {
     const planned = perMigration.get(migration.id);
@@ -3985,7 +4014,7 @@ function planAppMigrations(appDir) {
   });
   if (pending.length > 0 && blockers.length === 0) {
     const manifestPath = `${appPrefix}${APP_MIGRATIONS_MANIFEST}`;
-    const absoluteManifestPath = join15(repo, manifestPath);
+    const absoluteManifestPath = join14(repo, manifestPath);
     const before = existsSync13(absoluteManifestPath) ? readRegularFile(absoluteManifestPath) : null;
     const after = `${JSON.stringify([...appliedIds, ...pending.map(({ id }) => id)], null, 2)}
 `;
@@ -4001,13 +4030,19 @@ function planAppMigrations(appDir) {
 function applyAppMigrationPlan(appDir, plan) {
   const repo = repoToplevel(appDir);
   for (const edit of plan.edits) {
-    const absolutePath = join15(repo, edit.path);
+    const absolutePath = join14(repo, edit.path);
     const current = existsSync13(absolutePath) ? readRegularFile(absolutePath) : null;
     if (current !== edit.before) {
       throw new Error(`Migration input changed after planning: ${edit.path}`);
     }
   }
-  for (const edit of plan.edits) writeRegularFile(join15(repo, edit.path), edit.before, edit.after);
+  for (const edit of plan.edits) writeRegularFile(join14(repo, edit.path), edit.before, edit.after);
+}
+function normalizeEol(source) {
+  return source.replaceAll("\r\n", "\n");
+}
+function restoreEol(source, checkout) {
+  return checkout.includes("\r\n") ? source.replaceAll("\n", "\r\n") : source;
 }
 function readRegularFile(path) {
   const before = lstatSync(path);
@@ -4061,6 +4096,252 @@ function isSourcePath(repoPath, appPrefix) {
   if (repoPath.endsWith("wrangler.toml")) return true;
   return /\.(?:[cm]?[jt]sx?)$/.test(repoPath);
 }
+var LEGACY_AUTHENTICATED_ROOM_HELPER = `const IDENTITY_QUERY_PARAMS = ['userId', 'userName', 'userEmail', 'userImageUrl', 'role'] as const
+
+function authenticatedRoomUrl(
+  requestUrl: string,
+  auth: VerifyResult | null,
+  extraParams?: (auth: VerifyResult) => Record<string, string>,
+): URL {
+  const doUrl = new URL(requestUrl)
+  doUrl.searchParams.delete('token')
+  for (const key of IDENTITY_QUERY_PARAMS) {
+    doUrl.searchParams.delete(key)
+  }
+
+  if (!auth) return doUrl
+
+  doUrl.searchParams.set('userId', auth.userId)
+  if (auth.claims.name) doUrl.searchParams.set('userName', auth.claims.name)
+  if (auth.claims.email) doUrl.searchParams.set('userEmail', auth.claims.email)
+  if (auth.claims.image) doUrl.searchParams.set('userImageUrl', auth.claims.image)
+  if (extraParams) {
+    for (const [key, value] of Object.entries(extraParams(auth))) {
+      doUrl.searchParams.set(key, value)
+    }
+  }
+  return doUrl
+}`;
+var IDENTITY_ROUTE_REPLACEMENTS = [
+  [
+    `import { verifyJwt } from 'deepspace/worker'`,
+    `import { authenticatedRoomRequest, verifyJwt } from 'deepspace/worker'`,
+    1
+  ],
+  [LEGACY_AUTHENTICATED_ROOM_HELPER, "", 1],
+  [
+    `function wsRoute(
+  doNamespace: (env: Env) => DurableObjectNamespace,
+  extraParams?: (auth: VerifyResult) => Record<string, string>,
+) {`,
+    `function wsRoute(
+  doNamespace: (env: Env) => DurableObjectNamespace,
+  extraIdentity?: (auth: VerifyResult) => { role?: string },
+) {`,
+    1
+  ],
+  [
+    `    const doUrl = authenticatedRoomUrl(c.req.url, auth, extraParams)`,
+    `    const roomRequest = authenticatedRoomRequest(
+      c.req.raw,
+      auth,
+      auth ? extraIdentity?.(auth) : undefined,
+    )`,
+    1
+  ],
+  [
+    `    const doUrl = authenticatedRoomUrl(c.req.url, auth, () => ({ role }))`,
+    `    const roomRequest = authenticatedRoomRequest(c.req.raw, auth, { role })`,
+    1
+  ],
+  [
+    `    return stub.fetch(new Request(doUrl.toString(), c.req.raw))`,
+    `    return stub.fetch(roomRequest)`,
+    2
+  ]
+];
+function occurrences(source, pattern) {
+  return source.split(pattern).length - 1;
+}
+var SECURE_JOB_ROOM_CONSTRUCTOR = `  constructor(state: DurableObjectState, env: Env) {
+    super(state, env, {
+      authorizeWrite: async (user) => {
+        if (user.userId.startsWith('anon-')) return false
+        const role = await resolveAppRole(env, user.userId)
+        return role === 'member' || role === 'admin'
+      },
+    })
+  }`;
+var APP_JOB_ROOM_CLASS = `export class AppJobRoom extends JobRoom<Env> {`;
+var SECURE_APP_JOB_ROOM = `${APP_JOB_ROOM_CLASS}
+${SECURE_JOB_ROOM_CONSTRUCTOR}`;
+function hasSecureAppJobRoom(source) {
+  return occurrences(source, "class AppJobRoom") === 1 && source.includes(SECURE_APP_JOB_ROOM);
+}
+var WORKER_JOB_REPLACEMENTS = [
+  [
+    `import type { DOBindings, DOManifest, Job, JobContext } from 'deepspace/worker'`,
+    `import { resolveAppRole } from 'deepspace/worker'
+import type { DOBindings, DOManifest, Job, JobContext } from 'deepspace/worker'`
+  ],
+  [
+    `export class AppJobRoom extends JobRoom<Env> {
+  constructor(state: DurableObjectState, env: Env) {
+    super(state, env)
+  }`,
+    `export class AppJobRoom extends JobRoom<Env> {
+${SECURE_JOB_ROOM_CONSTRUCTOR}`
+  ]
+];
+var HTTP_ROLE_IMPORT = `import { resolveAppRole } from 'deepspace/worker'`;
+var HTTP_ROLE_IMPORT_PATTERN = /\bimport\s*\{[^}]*\bresolveAppRole\b[^}]*\}\s*from\s*(['"])deepspace\/worker\1/;
+var HTTP_ROLE_IMPORT_SEAM = `import type { AppContext, Env } from '../../worker.js'`;
+var DEBUG_ROUTE_SEAM = `  app.all('/api/debug/*', async (c) => {
+    if (c.env.ALLOW_DEBUG_ROUTES !== 'true') {
+      return c.notFound()
+    }
+    const stub = c.env.RECORD_ROOMS.get(`;
+var DOUBLE_QUOTED_DEBUG_ROUTE_SEAM = DEBUG_ROUTE_SEAM.replace(
+  "app.all('/api/debug/*'",
+  'app.all("/api/debug/*"'
+);
+var SECURE_DEBUG_ROUTE_SEAM = `  app.all('/api/debug/*', async (c) => {
+    if (c.env.ALLOW_DEBUG_ROUTES !== 'true') {
+      return c.notFound()
+    }
+    const auth = await resolveAuth(c.req.raw, c.env)
+    if (!auth) return c.json({ error: 'unauthorized' }, 401)
+    if ((await resolveAppRole(c.env, auth.userId)) !== 'admin') {
+      return c.json({ error: 'forbidden' }, 403)
+    }
+    const stub = c.env.RECORD_ROOMS.get(`;
+var DOUBLE_QUOTED_SECURE_DEBUG_ROUTE_SEAM = SECURE_DEBUG_ROUTE_SEAM.replace(
+  "app.all('/api/debug/*'",
+  'app.all("/api/debug/*"'
+);
+var DEBUG_ROUTE_REPLACEMENTS = [
+  [DEBUG_ROUTE_SEAM, SECURE_DEBUG_ROUTE_SEAM],
+  [DOUBLE_QUOTED_DEBUG_ROUTE_SEAM, DOUBLE_QUOTED_SECURE_DEBUG_ROUTE_SEAM]
+];
+var DEBUG_ROUTE_PATTERN = /\bapp\.all\(\s*(['"])\/api\/debug\/\*\1\s*,/;
+function debugRouteOccurrences(source) {
+  return source.match(new RegExp(DEBUG_ROUTE_PATTERN.source, "g"))?.length ?? 0;
+}
+function secureDebugRouteOccurrences(source) {
+  return DEBUG_ROUTE_REPLACEMENTS.reduce(
+    (count, [, secure]) => count + occurrences(source, secure),
+    0
+  );
+}
+function httpRoleImportOccurrences(source) {
+  return source.match(new RegExp(HTTP_ROLE_IMPORT_PATTERN.source, "g"))?.length ?? 0;
+}
+function hasSecureDebugRoute(source) {
+  return debugRouteOccurrences(source) === 1 && secureDebugRouteOccurrences(source) === 1 && httpRoleImportOccurrences(source) === 1;
+}
+function migrateSecureRoomBoundaries(source, file) {
+  if (file.endsWith("src/server/realtime-routes.ts")) {
+    return migrateRealtimeRoomBoundaries(source);
+  }
+  if (file.endsWith("worker.ts")) return migrateWorkerJobAuthorization(source);
+  if (file.endsWith("src/server/http-routes.ts")) return migrateDebugRouteAuthorization(source);
+  return { source, replacements: 0 };
+}
+function migrateRealtimeRoomBoundaries(source) {
+  let migrated = source;
+  let replacements = 0;
+  if (!migrated.includes("authenticatedRoomRequest(")) {
+    if (IDENTITY_ROUTE_REPLACEMENTS.some(
+      ([before, , expected]) => occurrences(migrated, before) !== expected
+    )) {
+      return { source, replacements: 0 };
+    }
+    for (const [before, after, expected] of IDENTITY_ROUTE_REPLACEMENTS) {
+      migrated = migrated.replaceAll(before, after);
+      replacements += expected;
+    }
+  }
+  return { source: migrated, replacements };
+}
+function migrateWorkerJobAuthorization(source) {
+  if (!source.includes("class AppJobRoom")) return { source, replacements: 0 };
+  if (hasSecureAppJobRoom(source)) return { source, replacements: 0 };
+  if (WORKER_JOB_REPLACEMENTS.some(([before]) => occurrences(source, before) !== 1)) {
+    return { source, replacements: 0 };
+  }
+  let migrated = source;
+  for (const [before, after] of WORKER_JOB_REPLACEMENTS) migrated = migrated.replace(before, after);
+  return { source: migrated, replacements: WORKER_JOB_REPLACEMENTS.length };
+}
+function migrateDebugRouteAuthorization(source) {
+  if (debugRouteOccurrences(source) === 0 || hasSecureDebugRoute(source)) {
+    return { source, replacements: 0 };
+  }
+  const matchingRoutes = DEBUG_ROUTE_REPLACEMENTS.filter(
+    ([before2]) => occurrences(source, before2) === 1
+  );
+  if (debugRouteOccurrences(source) !== 1 || matchingRoutes.length !== 1 || httpRoleImportOccurrences(source) !== 0 || occurrences(source, HTTP_ROLE_IMPORT_SEAM) !== 1) {
+    return { source, replacements: 0 };
+  }
+  const [before, after] = matchingRoutes[0];
+  return {
+    source: source.replace(HTTP_ROLE_IMPORT_SEAM, `${HTTP_ROLE_IMPORT_SEAM}
+${HTTP_ROLE_IMPORT}`).replace(before, after),
+    replacements: 2
+  };
+}
+function findSecureRoomBoundaryBlockers(source, file) {
+  if (file.endsWith("worker.ts") && source.includes("class AppJobRoom")) {
+    if (!hasSecureAppJobRoom(source)) {
+      return [
+        roomBoundaryBlocker(
+          file,
+          source,
+          "class AppJobRoom",
+          "Configure AppJobRoom with authorizeWrite using the current users.role."
+        )
+      ];
+    }
+    return [];
+  }
+  if (file.endsWith("src/server/http-routes.ts") && debugRouteOccurrences(source) > 0) {
+    if (!hasSecureDebugRoute(source)) {
+      const route = source.match(DEBUG_ROUTE_PATTERN)?.[0] ?? "/api/debug/*";
+      return [
+        roomBoundaryBlocker(
+          file,
+          source,
+          route,
+          "Require verified owner/admin access inside the enabled debug-route handler."
+        )
+      ];
+    }
+    return [];
+  }
+  if (!file.endsWith("src/server/realtime-routes.ts")) return [];
+  const lines = source.split("\n");
+  let index = lines.findIndex(
+    (line) => line.includes("authenticatedRoomUrl") || /searchParams\.(?:set|append)\(\s*['"](?:userId|userName|userEmail|userImageUrl|role)['"]/.test(
+      line
+    )
+  );
+  if (index < 0 && /\bauth\.(?:userId|claims)\b/.test(source)) {
+    index = lines.findIndex((line) => /searchParams\.(?:set|append)\s*\(/.test(line));
+  }
+  if (index < 0) return [];
+  return [
+    {
+      migrationId: SECURE_ROOM_BOUNDARIES_MIGRATION_ID,
+      file,
+      line: index + 1,
+      message: "This customized room proxy still places verified user identity in its internal URL. Replace that forwarding code with authenticatedRoomRequest() from deepspace/worker before the Durable Object fetch."
+    }
+  ];
+}
+function roomBoundaryBlocker(file, source, seam, message) {
+  const line = source.slice(0, source.indexOf(seam)).split("\n").length;
+  return { migrationId: SECURE_ROOM_BOUNDARIES_MIGRATION_ID, file, line, message };
+}
 function migrateWorkerOwnedNotFound(source, file) {
   let replacements = 0;
   if (file.endsWith("wrangler.toml")) {
@@ -4113,7 +4394,9 @@ function findWorkerOwnedNotFoundBlockers(source, file) {
   const blockers = [];
   const lines = source.split("\n");
   for (const [index, line] of lines.entries()) {
-    if (!/['"`]\/index\.html/.test(line)) continue;
+    if (!/(?:\burl\.pathname\s*=\s*|\bnew\s+URL\s*\(\s*)['"`]\/index\.html/.test(line)) {
+      continue;
+    }
     blockers.push({
       migrationId: WORKER_OWNED_NOT_FOUND_MIGRATION_ID,
       file,
@@ -4161,7 +4444,7 @@ async function buildDeployBundle(options) {
     preparedWranglerConfig?.cleanup();
   }
   spinner2.stop("Built");
-  const deployConfigPath = join16(appDir, ".wrangler", "deploy", "config.json");
+  const deployConfigPath = join15(appDir, ".wrangler", "deploy", "config.json");
   if (!existsSync14(deployConfigPath)) {
     output.die(
       "Build output config not found at .wrangler/deploy/config.json",
@@ -4169,7 +4452,7 @@ async function buildDeployBundle(options) {
     );
   }
   const deployConfig = JSON.parse(readFileSync17(deployConfigPath, "utf-8"));
-  const outputWranglerPath = resolve11(dirname6(deployConfigPath), deployConfig.configPath);
+  const outputWranglerPath = resolve11(dirname7(deployConfigPath), deployConfig.configPath);
   if (!existsSync14(outputWranglerPath)) {
     output.die(`Output wrangler.json not found at ${outputWranglerPath}`, "build_output_missing");
   }
@@ -4181,8 +4464,8 @@ async function buildDeployBundle(options) {
       "build_output_mismatch"
     );
   }
-  const workerDir = dirname6(outputWranglerPath);
-  const workerBundlePath = join16(workerDir, outputConfig.main);
+  const workerDir = dirname7(outputWranglerPath);
+  const workerBundlePath = join15(workerDir, outputConfig.main);
   const clientDir = outputConfig.assets?.directory ? resolve11(workerDir, outputConfig.assets.directory) : null;
   if (!existsSync14(workerBundlePath)) {
     output.die(`Worker bundle not found at ${workerBundlePath}`, "build_output_missing");
@@ -4274,7 +4557,7 @@ function collectAssets(dir) {
   const walk = (currentDir, prefix) => {
     for (const entry of readdirSync4(currentDir, { withFileTypes: true })) {
       if (isDeployAssetControlFile(entry.name)) continue;
-      const fullPath = join16(currentDir, entry.name);
+      const fullPath = join15(currentDir, entry.name);
       const relativePath = prefix ? `${prefix}/${entry.name}` : entry.name;
       if (entry.isDirectory()) {
         walk(fullPath, relativePath);
@@ -4298,7 +4581,7 @@ function readDeployAssetConfig(clientDir) {
     ["_headers", "_headers"],
     ["_redirects", "_redirects"]
   ]) {
-    const filePath = join16(clientDir, file);
+    const filePath = join15(clientDir, file);
     if (!existsSync14(filePath)) continue;
     const content = readFileSync17(filePath, "utf8");
     if (content.trim()) config[key] = content;
@@ -4315,17 +4598,17 @@ function errorMessage(error) {
 // src/cli/commands/deploy/commerce.ts
 import * as p7 from "@clack/prompts";
 import { existsSync as existsSync15 } from "fs";
-import { join as join17 } from "path";
+import { join as join16 } from "path";
 import { pathToFileURL as pathToFileURL2 } from "url";
 var API_URL2 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
 function errorMessage2(error) {
   return error instanceof Error ? error.message : String(error);
 }
 async function loadDeclaration(appDir, sourceFile, outputFile, exportName) {
-  const sourcePath = join17(appDir, "src", sourceFile);
+  const sourcePath = join16(appDir, "src", sourceFile);
   if (!existsSync15(sourcePath)) return void 0;
   const esbuild = await import("esbuild");
-  const outputPath = join17(appDir, ".wrangler", "deploy", outputFile);
+  const outputPath = join16(appDir, ".wrangler", "deploy", outputFile);
   await esbuild.build({
     entryPoints: [sourcePath],
     bundle: true,
@@ -4418,7 +4701,7 @@ Stripe will keep charging them until you cancel. Cancel at the end of their curr
   }
 }
 async function syncSubscriptionPlans(appDir, appName, token, nonInteractive) {
-  if (!existsSync15(join17(appDir, "src", "subscriptions.ts"))) return;
+  if (!existsSync15(join16(appDir, "src", "subscriptions.ts"))) return;
   let plans;
   try {
     plans = await loadDeclaration(
@@ -4455,7 +4738,7 @@ async function syncSubscriptionPlans(appDir, appName, token, nonInteractive) {
     spinner2.stop(`Synced ${plans.length} plan${plans.length === 1 ? "" : "s"} to Stripe`);
     if (body.connectMissing) {
       p7.log.warn(
-        "Stripe Connect not yet set up. Customers can subscribe and earnings will queue in your platform balance until you finish onboarding at /earnings on the dashboard. The first payout after you connect will sweep everything that accumulated in the meantime."
+        "Stripe Connect is not ready. Paid checkout will remain unavailable until the app owner finishes onboarding at /earnings on the dashboard."
       );
     }
     const changes = (body.planChanges ?? []).filter((change) => change.affectedSubscribers > 0);
@@ -4473,7 +4756,7 @@ async function syncSubscriptionPlans(appDir, appName, token, nonInteractive) {
   }
 }
 async function syncOneTimeProducts(appDir, appName, token) {
-  if (!existsSync15(join17(appDir, "src", "products.ts"))) return;
+  if (!existsSync15(join16(appDir, "src", "products.ts"))) return;
   let products;
   try {
     products = await loadDeclaration(
@@ -4568,7 +4851,7 @@ function createDeployOutput(json) {
         else console.error(withSlug(message, code));
         if (action) printAction(action);
       }
-      process.exit(opts.actionRequired ? 2 : 1);
+      throw new CliExit(opts.actionRequired ? 2 : 1);
     }
   };
 }
@@ -5096,7 +5379,16 @@ function selectGitHubRemote(cwd, options = {}) {
   return matching.find((remote) => remote.name === "origin") ?? (matching.length === 1 ? matching[0] : null);
 }
 function remotePublicRefs(cwd, remote) {
-  const output = runGit(cwd, ["ls-remote", "--refs", remote]).stdout.toString("utf-8");
+  let output;
+  try {
+    output = runGit(cwd, ["ls-remote", "--refs", remote]).stdout.toString("utf-8");
+  } catch (error) {
+    if (!isGitCredentialFailure(error)) throw error;
+    throw new GitError(
+      "Git could not authenticate the remote. In a container, forward an SSH agent or use an ephemeral Git credential helper, then retry. Do not put tokens in remote URLs.",
+      "github_credentials_required"
+    );
+  }
   return output.split("\n").map((line) => line.trim()).filter(Boolean).map((line) => {
     const [oid, name] = line.split(/\s+/, 2);
     return { oid, name };
@@ -5104,6 +5396,12 @@ function remotePublicRefs(cwd, remote) {
     (ref) => /^[0-9a-f]{40}$/.test(ref.oid) && (ref.name.startsWith("refs/heads/") || ref.name.startsWith("refs/tags/"))
   );
 }
+function isGitCredentialFailure(error) {
+  if (!(error instanceof Error)) return false;
+  return /authentication failed|could not read username|permission denied \(publickey\)|repository not found|terminal prompts disabled/i.test(
+    error.message
+  );
+}
 function remoteBranchOid(cwd, remote, branch) {
   return remotePublicRefs(cwd, remote).find((ref) => ref.name === `refs/heads/${branch}`)?.oid ?? null;
 }
@@ -5145,6 +5443,25 @@ function setAppSource(deployUrl, token, appId, input) {
 }
 
 // src/cli/commands/deploy/repository.ts
+function preflightDeployRepository(options) {
+  const { appDir, push, source } = options;
+  if (!push || source?.provider === "github") return null;
+  try {
+    assertSyncableRepo(appDir);
+    if (!source && listGitHubRemotes(appDir).length > 0) {
+      return {
+        code: "source_unclaimed",
+        error: "This app has a GitHub remote but no claimed source. Choose once with `deepspace app source github` (manual GitHub ownership) or `deepspace app source deepspace` (packaged DeepSpace source), then deploy again."
+      };
+    }
+    const branch = currentBranch(appDir);
+    if (!isWorkTreeClean(appDir)) return dirtyWorktreeRefusal(branch);
+    if (!branch) return detachedHeadRefusal();
+    return null;
+  } catch (error) {
+    return deployRepositoryFailure(error, appDir);
+  }
+}
 async function syncDeployRepository(options) {
   const { deployUrl, appDir, appId, token, push, ignoreStale, output, sourceState } = options;
   let commitOid = null;
@@ -5165,21 +5482,12 @@ async function syncDeployRepository(options) {
     return { commitOid, recoverable, deployKey, source, sourceRevision, baseReleaseId };
   }
   try {
-    assertSyncableRepo(appDir);
-    if (!source && listGitHubRemotes(appDir).length > 0) {
-      output.die(
-        "This app has a GitHub remote but no claimed source. Choose once with `deepspace app source github` (manual GitHub ownership) or `deepspace app source deepspace` (packaged DeepSpace source), then deploy again.",
-        "source_unclaimed"
-      );
-    }
+    const preflight = preflightDeployRepository({ appDir, push, source });
+    if (preflight) output.die(preflight.error, preflight.code);
     const sourceRemote = spaceRemoteName();
     ensureSpaceRemote(appDir, appId, sourceRemote);
     const branch = currentBranch(appDir);
     const workspaceBranchId = workspaceIdFromBranch(branch);
-    if (!isWorkTreeClean(appDir)) {
-      const refusal = dirtyWorktreeRefusal(branch);
-      output.die(refusal.error, refusal.code);
-    }
     if (!branch) {
       const refusal = detachedHeadRefusal();
       output.die(refusal.error, refusal.code);
@@ -5272,6 +5580,7 @@ async function syncDeployRepository(options) {
       sourceRevision = claimed.revision;
     }
   } catch (error) {
+    if (error instanceof CliExit) throw error;
     const failure = deployRepositoryFailure(error, appDir);
     output.die(failure.error, failure.code);
   }
@@ -5281,12 +5590,7 @@ function classifyRemoteState(appDir, token, branch, localTip, remote) {
   let remoteTip = null;
   const remoteRef = `refs/remotes/${remote}/${branch}`;
   try {
-    runGitRemote(appDir, token, [
-      "fetch",
-      "--quiet",
-      remote,
-      `+refs/heads/${branch}:${remoteRef}`
-    ]);
+    runGitRemote(appDir, token, ["fetch", "--quiet", remote, `+refs/heads/${branch}:${remoteRef}`]);
     remoteTip = resolveCommit(appDir, remoteRef);
     return {
       remoteTip,
@@ -5393,7 +5697,7 @@ async function deployBuiltBundle(options) {
         ...action ? { action } : {}
       });
     }
-    process.exit(actionRequired ? 2 : 1);
+    throw new CliExit(actionRequired ? 2 : 1);
   };
   const makeForm = () => {
     const form = new FormData();
@@ -5860,6 +6164,14 @@ var deploy_default = defineCommand3({
       output
     });
     const sourceState = await getAppSource(DEPLOY_URL3, token, appId);
+    const repositoryPreflight = preflightDeployRepository({
+      appDir,
+      push: args.push !== false,
+      source: sourceState.source
+    });
+    if (repositoryPreflight) {
+      output.die(repositoryPreflight.error, repositoryPreflight.code);
+    }
     const spinner2 = createSpinner();
     const bundle = await buildDeployBundle({
       appDir,
@@ -6296,6 +6608,7 @@ var apps_default = defineDeepspaceCommand({
 
 // src/cli/commands/logs.ts
 import { defineCommand as defineCommand4 } from "citty";
+import { setTimeout as delay } from "timers/promises";
 
 // src/shared/log-events.ts
 var LOG_LEVELS = ["debug", "log", "info", "warn", "error"];
@@ -6322,11 +6635,17 @@ function parseSince(input, now = Date.now()) {
   } else {
     ts = Date.parse(trimmed);
     if (Number.isNaN(ts)) {
-      throw new InputError(`Invalid --since "${input}" \u2014 use 30s, 15m, 2h, 7d, or an ISO timestamp.`, "invalid_since");
+      throw new InputError(
+        `Invalid --since "${input}" \u2014 use 30s, 15m, 2h, 7d, or an ISO timestamp.`,
+        "invalid_since"
+      );
     }
   }
   if (now - ts > RETENTION_MS) {
-    throw new InputError("Logs are retained for 7 days \u2014 --since can reach back at most 7d.", "since_out_of_range");
+    throw new InputError(
+      "Logs are retained for 7 days \u2014 --since can reach back at most 7d.",
+      "since_out_of_range"
+    );
   }
   return ts;
 }
@@ -6400,7 +6719,7 @@ function formatEvent(e, color, now = Date.now()) {
   const client = e.source === "client" ? paint("35", "CLIENT", color) + " " : "";
   return `${time} ${client}${tag} ${body}`;
 }
-var sleep3 = (ms) => new Promise((r) => setTimeout(r, ms));
+var sleep3 = (ms, signal) => delay(ms, void 0, { signal });
 var logs_default = defineCommand4({
   meta: {
     name: "logs",
@@ -6457,29 +6776,42 @@ var logs_default = defineCommand4({
     const token = await ensureToken();
     const appId = await resolveAppTarget(DEPLOY_URL6, token, args.app, { wranglerEnv: envArg });
     if (args.level && !LOG_LEVELS.includes(args.level)) {
-      throw new InputError(`Invalid --level "${args.level}". Use: ${LOG_LEVELS.join(", ")}`, "invalid_level");
+      throw new InputError(
+        `Invalid --level "${args.level}". Use: ${LOG_LEVELS.join(", ")}`,
+        "invalid_level"
+      );
     }
     let limit;
     if (args.limit !== void 0) {
       limit = Number(args.limit);
       if (!Number.isInteger(limit) || limit < 1 || limit > 500) {
-        throw new InputError("Invalid --limit \u2014 expected an integer between 1 and 500.", "invalid_limit");
+        throw new InputError(
+          "Invalid --limit \u2014 expected an integer between 1 and 500.",
+          "invalid_limit"
+        );
       }
     }
     const initialSince = args.since ? parseSince(args.since) : Date.now() - DEFAULT_WINDOW_MS;
     const windowLabel = args.since?.trim() || "15m";
     const MAX_LIMIT = 500;
     const followLimit = followInitialLimit(limit, MAX_LIMIT);
-    const fetchPage = async (since, pageLimit, token2) => {
+    const fetchPage = async (since, pageLimit, token2, signal) => {
       const params = new URLSearchParams({ since: String(since) });
       if (pageLimit !== void 0) params.set("limit", String(pageLimit));
       if (args.level) params.set("level", args.level);
       if (args.search) params.set("search", args.search);
-      return apiFetch(DEPLOY_URL6, token2, `/api/apps/${appId}/logs?${params}`);
+      return apiFetch(
+        DEPLOY_URL6,
+        token2,
+        `/api/apps/${appId}/logs?${params}`,
+        signal ? { signal } : void 0
+      );
     };
     const print = (events) => {
       for (const e of events) {
-        process.stdout.write(args.json ? JSON.stringify(e) + "\n" : formatEvent(e, stdoutColor()) + "\n");
+        process.stdout.write(
+          args.json ? JSON.stringify(e) + "\n" : formatEvent(e, stdoutColor()) + "\n"
+        );
       }
     };
     const first = await fetchPage(initialSince, args.follow ? followLimit : limit, token);
@@ -6487,19 +6819,30 @@ var logs_default = defineCommand4({
     if (!args.follow) {
       if (first.events.length === 0) {
         if (args.json) {
-          process.stdout.write(JSON.stringify({ type: "meta", count: 0, window: windowLabel }) + "\n");
+          process.stdout.write(
+            JSON.stringify({ type: "meta", count: 0, window: windowLabel }) + "\n"
+          );
         } else {
           console.log(
             `No logs in the last ${windowLabel} for ${appId}. New logs can take up to a minute to appear; retention is 7 days.`
           );
         }
       } else if (first.truncated) {
-        if (args.json) process.stdout.write(JSON.stringify({ type: "meta", truncated: true }) + "\n");
-        else console.error(`(showing the newest ${first.events.length} events \u2014 narrow with --since/--level/--search)`);
+        if (args.json)
+          process.stdout.write(JSON.stringify({ type: "meta", truncated: true }) + "\n");
+        else if (args.search)
+          console.error(
+            `(showing the newest ${first.events.length} matches \u2014 search scans at most the newest 500 level-filtered events per fetch; narrow with --since/--level or raise --limit)`
+          );
+        else
+          console.error(
+            `(showing the newest ${first.events.length} events \u2014 narrow with --since/--level)`
+          );
       }
       return;
     }
-    process.on("SIGINT", () => process.exit(0));
+    const tail = new AbortController();
+    process.once("SIGINT", () => tail.abort());
     if (!args.json) {
       console.error(`Tailing logs for ${appId} \u2014 Ctrl+C to stop.`);
     }
@@ -6515,35 +6858,56 @@ var logs_default = defineCommand4({
         process.stdout.write(JSON.stringify({ type: "meta", truncated: true }) + "\n");
       } else {
         console.error(
-          paint("33", `(more than ${followLimit} events in the initial ${windowLabel} window \u2014 some older events not shown; narrow with --since/--level/--search)`, stderrColor())
+          paint(
+            "33",
+            args.search ? `(search scanned only the newest ${MAX_LIMIT} level-filtered events in the initial ${windowLabel} window \u2014 older matches may be omitted; narrow with --since/--level)` : `(more than ${followLimit} events in the initial ${windowLabel} window \u2014 some older events not shown; narrow with --since/--level)`,
+            stderrColor()
+          )
         );
       }
     }
     for (; ; ) {
-      await sleep3(backoff || interval);
+      try {
+        await sleep3(backoff || interval, tail.signal);
+      } catch {
+        return;
+      }
       const freshToken = await ensureToken();
+      if (tail.signal.aborted) return;
       let page;
       try {
-        page = await fetchPage(nextPollSince(cursor, initialSince), followLimit, freshToken);
+        page = await fetchPage(
+          nextPollSince(cursor, initialSince),
+          followLimit,
+          freshToken,
+          tail.signal
+        );
       } catch (err) {
+        if (tail.signal.aborted) return;
         if (err instanceof ApiError && [401, 403, 404].includes(err.status)) throw err;
         backoff = Math.min(backoff ? backoff * 2 : MIN_POLL_MS, 3e4);
         const msg = err instanceof Error ? err.message : String(err);
-        console.error(paint("2", `(logs fetch failed: ${msg} \u2014 retrying in ${backoff / 1e3}s)`, stderrColor()));
+        console.error(
+          paint("2", `(logs fetch failed: ${msg} \u2014 retrying in ${backoff / 1e3}s)`, stderrColor())
+        );
         continue;
       }
       backoff = 0;
       interval = Math.max(page.pollIntervalMs || 0, MIN_POLL_MS);
       const fresh = seen.fresh(page.events);
       print(fresh);
-      const realDrop = fresh.length >= followLimit;
+      const realDrop = fresh.length >= followLimit || Boolean(args.search && page.truncated);
       if (realDrop && !warnedTruncated) {
         warnedTruncated = true;
         if (args.json) {
           process.stdout.write(JSON.stringify({ type: "meta", truncated: true }) + "\n");
         } else {
           console.error(
-            paint("33", `(burst exceeded ${followLimit} events/poll \u2014 some may be dropped; narrow with --level/--search)`, stderrColor())
+            paint(
+              "33",
+              args.search ? `(search scanned only the newest ${MAX_LIMIT} level-filtered events this poll \u2014 older matches may be omitted; narrow with --level)` : `(burst exceeded ${followLimit} events/poll \u2014 some may be dropped; narrow with --level)`,
+              stderrColor()
+            )
           );
         }
       } else if (!realDrop) {
@@ -6625,7 +6989,7 @@ var usage_default = defineDeepspaceCommand({
 
 // src/cli/commands/add.ts
 import { existsSync as existsSync18, readFileSync as readFileSync20, realpathSync as realpathSync4 } from "fs";
-import { dirname as dirname8, join as join19, resolve as resolve15 } from "path";
+import { dirname as dirname9, join as join18, resolve as resolve15 } from "path";
 import { pathToFileURL as pathToFileURL3 } from "url";
 
 // src/cli/commands/feature-installer.ts
@@ -6641,17 +7005,17 @@ import {
   readSync,
   readdirSync as readdirSync5,
   rmSync as rmSync4,
-  writeFileSync as writeFileSync8
+  writeFileSync as writeFileSync6
 } from "fs";
 import { spawnSync as spawnSync6 } from "child_process";
 import { tmpdir as tmpdir2 } from "os";
-import { dirname as dirname7, isAbsolute as isAbsolute4, join as join18, resolve as resolve14 } from "path";
+import { dirname as dirname8, isAbsolute as isAbsolute4, join as join17, resolve as resolve14 } from "path";
 import { fileURLToPath } from "url";
 var NAV_MARKER = "// \u2500\u2500 Features add nav items below this line \u2500\u2500";
 function featurePackageRoot(moduleUrl = import.meta.url) {
-  let dir = dirname7(fileURLToPath(moduleUrl));
+  let dir = dirname8(fileURLToPath(moduleUrl));
   for (; ; ) {
-    const packagePath = join18(dir, "package.json");
+    const packagePath = join17(dir, "package.json");
     if (existsSync17(packagePath)) {
       try {
         const pkg2 = JSON.parse(readFileSync19(packagePath, "utf-8"));
@@ -6659,16 +7023,16 @@ function featurePackageRoot(moduleUrl = import.meta.url) {
       } catch {
       }
     }
-    const parent = dirname7(dir);
+    const parent = dirname8(dir);
     if (parent === dir) throw new Error("Could not locate the deepspace package root");
     dir = parent;
   }
 }
 function hasFeatureCatalog(packageRoot = featurePackageRoot()) {
-  return existsSync17(join18(packageRoot, "features"));
+  return existsSync17(join17(packageRoot, "features"));
 }
 function readFeatureConfig(id, packageRoot = featurePackageRoot()) {
-  const configPath = join18(packageRoot, "features", id, "feature.json");
+  const configPath = join17(packageRoot, "features", id, "feature.json");
   if (!existsSync17(configPath)) return null;
   try {
     const config = JSON.parse(readFileSync19(configPath, "utf-8"));
@@ -6681,7 +7045,7 @@ function readFeatureConfig(id, packageRoot = featurePackageRoot()) {
   }
 }
 function listFeatureConfigs(packageRoot = featurePackageRoot()) {
-  const featuresDir = join18(packageRoot, "features");
+  const featuresDir = join17(packageRoot, "features");
   if (!existsSync17(featuresDir)) return [];
   return readdirSync5(featuresDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => readFeatureConfig(entry.name, packageRoot)).filter((config) => config !== null && !config.internal).sort((a, b) => a.id.localeCompare(b.id));
 }
@@ -6730,17 +7094,17 @@ function resolveFeatureDestPath(fileDest, route) {
   return route?.protected === false ? `${appPages}${rest}` : `${appPages}(protected)/${rest}`;
 }
 function copyFile(src, dest) {
-  mkdirSync6(dirname7(dest), { recursive: true });
+  mkdirSync6(dirname8(dest), { recursive: true });
   copyFileSync(src, dest);
 }
 function copyFileWithImportShift(src, dest, levels) {
-  mkdirSync6(dirname7(dest), { recursive: true });
+  mkdirSync6(dirname8(dest), { recursive: true });
   const prefix = "../".repeat(levels);
   const shifted = readFileSync19(src, "utf-8").replace(
     /(from\s+|import\s+|import\()(['"])(\.\.\/)/g,
     `$1$2${prefix}$3`
   );
-  writeFileSync8(dest, shifted);
+  writeFileSync6(dest, shifted);
 }
 function installFiles(packageRoot, config, targetDir, emit) {
   let copied = 0;
@@ -6749,9 +7113,9 @@ function installFiles(packageRoot, config, targetDir, emit) {
   const preexisting = [];
   const missing = [];
   for (const file of config.files) {
-    const srcPath = join18(packageRoot, "features", config.id, file.src);
+    const srcPath = join17(packageRoot, "features", config.id, file.src);
     const resolvedDest = resolveFeatureDestPath(file.dest, config.route);
-    const destPath = join18(targetDir, resolvedDest);
+    const destPath = join17(targetDir, resolvedDest);
     const existed = existsSync17(destPath);
     if (existed) preexisting.push(resolvedDest);
     if (!existsSync17(srcPath)) {
@@ -6791,7 +7155,7 @@ function unresolvedSchema(schema, reason, emit) {
 }
 function integrateSchema(config, targetDir, emit) {
   if (!config.schema) return [];
-  const schemasPath = join18(targetDir, "src", "schemas.ts");
+  const schemasPath = join17(targetDir, "src", "schemas.ts");
   if (!existsSync17(schemasPath)) {
     return [unresolvedSchema(config.schema, "src/schemas.ts was not found.", emit)];
   }
@@ -6826,7 +7190,7 @@ export const schemas`
     return [unresolvedSchema(config.schema, reason, emit)];
   }
   content = withEntry;
-  writeFileSync8(schemasPath, content);
+  writeFileSync6(schemasPath, content);
   emit(`   Schema integrated: ${exportName} -> schemas.ts`);
   return [];
 }
@@ -6848,7 +7212,7 @@ function unresolvedActions(actions, reason, emit) {
 }
 function integrateActions(config, targetDir, emit) {
   if (!config.actions?.length) return [];
-  const actionsPath = join18(targetDir, "src", "actions", "index.ts");
+  const actionsPath = join17(targetDir, "src", "actions", "index.ts");
   if (!existsSync17(actionsPath)) {
     return [unresolvedActions(config.actions, "src/actions/index.ts was not found.", emit)];
   }
@@ -6892,13 +7256,13 @@ ${registryEntry}`);
     integrated++;
     emit(`   Action integrated: ${action.registerAs} (${action.exportName})`);
   }
-  if (integrated > 0) writeFileSync8(actionsPath, content);
+  if (integrated > 0) writeFileSync6(actionsPath, content);
   return unresolved;
 }
 function integrateCode(config, targetDir, emit) {
   const unresolved = [];
   for (const insertion of config.code ?? []) {
-    const targetPath = join18(targetDir, insertion.file);
+    const targetPath = join17(targetDir, insertion.file);
     if (!existsSync17(targetPath)) {
       unresolved.push({
         area: "code",
@@ -6935,27 +7299,27 @@ ${content.slice(importIndex < 0 ? 0 : importIndex)}`;
     const prefix = insertion.placement === "before" ? "" : "\n";
     const suffix = insertion.placement === "before" ? "\n" : "";
     content = `${content.slice(0, insertAt)}${prefix}${insertion.insert}${suffix}${content.slice(insertAt)}`;
-    writeFileSync8(targetPath, content);
+    writeFileSync6(targetPath, content);
     emit(`   Integrated: ${insertion.file}`);
   }
   return unresolved;
 }
 function integrateIgnore(config, targetDir) {
   if (!config.ignore?.length) return;
-  const targetPath = join18(targetDir, ".gitignore");
+  const targetPath = join17(targetDir, ".gitignore");
   const current = existsSync17(targetPath) ? readFileSync19(targetPath, "utf-8") : "";
   const present = new Set(current.split(/\r?\n/).map((line) => line.trim()));
   const missing = config.ignore.filter((pattern) => !present.has(pattern));
   if (missing.length === 0) return;
   const separator = current === "" || current.endsWith("\n") ? "" : "\n";
-  writeFileSync8(targetPath, `${current}${separator}${missing.join("\n")}
+  writeFileSync6(targetPath, `${current}${separator}${missing.join("\n")}
 `);
 }
 function integrateWrangler(config, targetDir, emit) {
   const runWorkerFirst = config.wrangler?.runWorkerFirst === true;
   const rateLimits = config.wrangler?.rateLimits ?? [];
   if (!runWorkerFirst && rateLimits.length === 0) return [];
-  const targetPath = join18(targetDir, "wrangler.toml");
+  const targetPath = join17(targetDir, "wrangler.toml");
   const steps = [
     ...runWorkerFirst ? ["Set assets.run_worker_first = true in wrangler.toml."] : [],
     ...rateLimits.map((binding) => `Add the ${binding.name} rate-limit binding to wrangler.toml.`)
@@ -6985,7 +7349,7 @@ ${rateLimitBindingBlock(scope, binding)}
     }
   }
   if (changed) {
-    writeFileSync8(targetPath, source);
+    writeFileSync6(targetPath, source);
     emit("   Integrated: wrangler.toml");
   } else emit("   Integration already present: wrangler.toml");
   return [];
@@ -7039,7 +7403,7 @@ function rateLimitBindingBlock(scope, binding) {
 }
 function integrateCss(packageRoot, config, targetDir, emit) {
   if (!config.css?.length) return [];
-  const stylesPath = join18(targetDir, "src", "styles.css");
+  const stylesPath = join17(targetDir, "src", "styles.css");
   if (!existsSync17(stylesPath)) {
     emit("   Warning: Cannot integrate CSS \u2014 src/styles.css not found");
     return [
@@ -7056,7 +7420,7 @@ function integrateCss(packageRoot, config, targetDir, emit) {
   let integrated = 0;
   const unresolved = [];
   for (const cssFile of config.css) {
-    const srcPath = join18(packageRoot, "features", config.id, cssFile);
+    const srcPath = join17(packageRoot, "features", config.id, cssFile);
     if (!existsSync17(srcPath)) {
       emit(`   Warning: CSS source not found: ${cssFile}`, "stderr");
       unresolved.push({
@@ -7078,7 +7442,7 @@ ${css}`;
     integrated++;
     emit(`   CSS integrated: ${cssFile} -> styles.css`);
   }
-  if (integrated > 0) writeFileSync8(stylesPath, styles);
+  if (integrated > 0) writeFileSync6(stylesPath, styles);
   return unresolved;
 }
 function unresolvedRoute(route, config, reason, emit) {
@@ -7093,7 +7457,7 @@ function unresolvedRoute(route, config, reason, emit) {
 }
 function integrateRoute(config, targetDir, emit) {
   if (!config.route) return [];
-  const navPath = join18(targetDir, "src", "nav.ts");
+  const navPath = join17(targetDir, "src", "nav.ts");
   if (!existsSync17(navPath)) {
     return [unresolvedRoute(config.route, config, "src/nav.ts was not found.", emit)];
   }
@@ -7118,7 +7482,7 @@ function integrateRoute(config, targetDir, emit) {
   const entry = `  { path: '${routePath}', label: '${config.name}'${roles} },`;
   content = content.replace(NAV_MARKER, `${NAV_MARKER}
 ${entry}`);
-  writeFileSync8(navPath, content);
+  writeFileSync6(navPath, content);
   emit(`   Nav wired: ${routePath} (${config.name})`);
   emit("   Route: automatic (file-based routing via src/pages/)");
   return [];
@@ -7144,10 +7508,10 @@ function runPackageInstall(packageManager, targetDir, outputVisible) {
     const child = spawnSync6(packageManager, ["install"], { ...options, stdio: "inherit" });
     return { error: child.error, status: child.status };
   }
-  const captureDir = mkdtempSync(join18(tmpdir2(), "deepspace-add-install-"));
+  const captureDir = mkdtempSync(join17(tmpdir2(), "deepspace-add-install-"));
   let outputFd;
   try {
-    outputFd = openSync2(join18(captureDir, "output.log"), "w+");
+    outputFd = openSync2(join17(captureDir, "output.log"), "w+");
     const child = spawnSync6(packageManager, ["install"], {
       ...options,
       stdio: ["ignore", outputFd, outputFd]
@@ -7171,7 +7535,7 @@ function integrateDependencies(config, targetDir, runInstall, outputVisible, emi
   if (declarations.every(({ values }) => !values || Object.keys(values).length === 0)) {
     return { added: [], installRan: false, packageManager };
   }
-  const packagePath = join18(targetDir, "package.json");
+  const packagePath = join17(targetDir, "package.json");
   if (!existsSync17(packagePath)) {
     emit("   Could not patch package.json (file not found)");
     return { added: [], installRan: false, packageManager };
@@ -7202,7 +7566,7 @@ function integrateDependencies(config, targetDir, runInstall, outputVisible, emi
   if (added.length === 0) {
     emit("   Dependencies already present");
   } else {
-    writeFileSync8(packagePath, `${JSON.stringify(pkg2, null, 2)}
+    writeFileSync6(packagePath, `${JSON.stringify(pkg2, null, 2)}
 `, "utf-8");
     emit(`   Added to package.json: ${added.map(({ name }) => name).join(", ")}`);
     if (skipped.length) emit(`   Already present (kept your version): ${skipped.join(", ")}`);
@@ -7238,7 +7602,7 @@ ${child.diagnosticTail}` : "";
 }
 function dependencySnapshot(targetDir) {
   try {
-    const pkg2 = JSON.parse(readFileSync19(join18(targetDir, "package.json"), "utf-8"));
+    const pkg2 = JSON.parse(readFileSync19(join17(targetDir, "package.json"), "utf-8"));
     return {
       dependencies: pkg2.dependencies ?? {},
       devDependencies: pkg2.devDependencies ?? {}
@@ -7250,7 +7614,7 @@ function dependencySnapshot(targetDir) {
 function installedNavFeatures(packageRoot, targetDir) {
   return listFeatureConfigs(packageRoot).filter((feature) => feature.category === "nav" && feature.files.length > 0).filter((feature) => {
     const signature = resolveFeatureDestPath(feature.files[0].dest, feature.route);
-    return existsSync17(join18(targetDir, signature));
+    return existsSync17(join17(targetDir, signature));
   }).map((feature) => feature.id);
 }
 function warnNavConflicts(packageRoot, config, targetDir, emit) {
@@ -7483,8 +7847,8 @@ function renderFeatureInfo(config) {
   return lines.join("\n");
 }
 function isDeepSpaceApp(dir) {
-  if (existsSync18(join19(dir, "wrangler.toml"))) return true;
-  const packagePath = join19(dir, "package.json");
+  if (existsSync18(join18(dir, "wrangler.toml"))) return true;
+  const packagePath = join18(dir, "package.json");
   if (!existsSync18(packagePath)) return false;
   try {
     const pkg2 = JSON.parse(readFileSync20(packagePath, "utf-8"));
@@ -7496,9 +7860,9 @@ function isDeepSpaceApp(dir) {
 function installedPackageRoot(fromDir) {
   let dir = fromDir;
   for (; ; ) {
-    const candidate = join19(dir, "node_modules", "deepspace");
-    if (existsSync18(join19(candidate, "package.json"))) return candidate;
-    const parent = dirname8(dir);
+    const candidate = join18(dir, "node_modules", "deepspace");
+    if (existsSync18(join18(candidate, "package.json"))) return candidate;
+    const parent = dirname9(dir);
     if (parent === dir) return null;
     dir = parent;
   }
@@ -7514,8 +7878,8 @@ async function targetInstaller(appDir) {
   if (realpathSync4(installedRoot) === realpathSync4(featurePackageRoot())) {
     return { installFeature };
   }
-  const entry = join19(installedRoot, "dist", "feature-installer.js");
-  const catalog = join19(installedRoot, "features");
+  const entry = join18(installedRoot, "dist", "feature-installer.js");
+  const catalog = join18(installedRoot, "features");
   if (!existsSync18(entry) || !existsSync18(catalog)) {
     throw new Refusal(
       `The app's installed deepspace package does not contain the typed feature installer.
@@ -7690,13 +8054,12 @@ function fmtDate(iso) {
 }
 async function confirm4(message) {
   process.stdout.write(`${message} [y/N] `);
-  return new Promise((resolve21) => {
+  const answer = await new Promise((resolve21) => {
     process.stdin.setEncoding("utf-8");
-    process.stdin.once("data", (data) => {
-      const answer = data.toString().trim().toLowerCase();
-      resolve21(answer === "y" || answer === "yes");
-    });
+    process.stdin.once("data", (data) => resolve21(data.toString().trim().toLowerCase()));
   });
+  process.stdin.pause();
+  return answer === "y" || answer === "yes";
 }
 var cannotPrompt = (json) => json || !process.stdin.isTTY;
 var search = defineDeepspaceCommand({
@@ -9047,7 +9410,7 @@ var integrations_default = defineCommand9({
 // src/cli/commands/feedback.ts
 import * as p16 from "@clack/prompts";
 import { existsSync as existsSync20, readFileSync as readFileSync22 } from "fs";
-import { dirname as dirname9, join as join20 } from "path";
+import { dirname as dirname10, join as join19 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { release } from "os";
 var API_URL8 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
@@ -9068,10 +9431,10 @@ function normalizeType(raw) {
 }
 function readCliVersion() {
   try {
-    const here = dirname9(fileURLToPath2(import.meta.url));
+    const here = dirname10(fileURLToPath2(import.meta.url));
     const candidates = [
-      join20(here, "..", "package.json"),
-      join20(here, "..", "..", "..", "package.json")
+      join19(here, "..", "package.json"),
+      join19(here, "..", "..", "..", "package.json")
     ];
     for (const path of candidates) {
       if (!existsSync20(path)) continue;
@@ -9368,7 +9731,7 @@ function ok(json, data, human) {
 function warnIfDebugRoutesEnabled(secrets) {
   if (secrets.ALLOW_DEBUG_ROUTES !== "true") return false;
   console.warn(
-    "\n\u26A0  ALLOW_DEBUG_ROUTES=true exposes an UNAUTHENTICATED debug API on the deployed app \u2014\n   anyone who can reach /api/debug/* can read and mutate any record. Redeploy to apply;\n   `deepspace secrets delete ALLOW_DEBUG_ROUTES` (then redeploy) turns it back off."
+    "\n\u26A0  ALLOW_DEBUG_ROUTES=true enables the owner/admin debug API on the deployed app \u2014\n   those users can read and mutate any app record through /api/debug/*. Redeploy to apply;\n   `deepspace secrets delete ALLOW_DEBUG_ROUTES` (then redeploy) turns it back off."
   );
   return true;
 }
@@ -9472,7 +9835,7 @@ var get2 = defineCommand10({
       const { secrets } = await listSecrets(DEPLOY_URL11, t.token, t.appId, t.configName);
       const item = secrets.find((s) => s.key === key);
       if (!item)
-        fail(new InputError(`Secret "${key}" not found in ${t.configName}`, "secret_not_found"));
+        throw new InputError(`Secret "${key}" not found in ${t.configName}`, "secret_not_found");
       ok(
         args.json === true,
         {
@@ -9544,7 +9907,7 @@ var upload = defineCommand10({
       const content = args.file === "-" ? readFileSync23(0, "utf-8") : readFileSync23(args.file, "utf-8");
       const secrets = parseSecretsUpload(content);
       if (Object.keys(secrets).length === 0)
-        fail(new InputError("No secrets found in the input.", "empty_input"));
+        throw new InputError("No secrets found in the input.", "empty_input");
       await uploadSecrets(DEPLOY_URL11, t.token, t.appId, t.configName, secrets, args.replace);
       const uploaded = Object.keys(secrets);
       ok(
@@ -9575,11 +9938,9 @@ var download = defineCommand10({
       const t = await resolveTarget(args);
       const format = args.format;
       if (!["dotenv", "json", "shell"].includes(format)) {
-        fail(
-          new InputError(
-            `Unknown format "${args.format}" \u2014 use dotenv, json, or shell.`,
-            "invalid_format"
-          )
+        throw new InputError(
+          `Unknown format "${args.format}" \u2014 use dotenv, json, or shell.`,
+          "invalid_format"
         );
       }
       const { secrets } = await fetchSecretsValues(DEPLOY_URL11, t.token, t.appId, t.configName);
@@ -9597,11 +9958,9 @@ var pull = defineCommand10({
       const wranglerEnv = args.env?.trim() || void 0;
       const appDir = findAppDir();
       if (!appDir)
-        fail(
-          new InputError(
-            "Run from a DeepSpace app directory (one containing wrangler.toml).",
-            "not_in_app_repo"
-          )
+        throw new InputError(
+          "Run from a DeepSpace app directory (one containing wrangler.toml).",
+          "not_in_app_repo"
         );
       const t = await resolveTarget(args);
       const ownerId = decodeJwtPayload(t.token).sub;
@@ -9665,11 +10024,9 @@ var configsCreate = defineCommand10({
       const { configs: configs2 } = await listConfigs(DEPLOY_URL11, t.token, t.appId);
       if (configs2.some((c) => c.name === name)) {
         if (copyFrom) {
-          fail(
-            new InputError(
-              `Config "${name}" already exists \u2014 refusing to copy "${copyFrom}" over it. Delete it first, or pick a new name.`,
-              "config_exists"
-            )
+          throw new InputError(
+            `Config "${name}" already exists \u2014 refusing to copy "${copyFrom}" over it. Delete it first, or pick a new name.`,
+            "config_exists"
           );
         }
         ok(
@@ -10569,7 +10926,7 @@ var pull_default = defineDeepspaceCommand({
 // src/cli/commands/clone.ts
 import * as p20 from "@clack/prompts";
 import { existsSync as existsSync22, readdirSync as readdirSync6, rmSync as rmSync5 } from "fs";
-import { resolve as resolve17, basename as basename5, join as join21 } from "path";
+import { resolve as resolve17, basename as basename5, join as join20 } from "path";
 function cleanFailedCloneDir(dir) {
   let entries;
   try {
@@ -10579,7 +10936,7 @@ function cleanFailedCloneDir(dir) {
   }
   if (entries.length === 1 && entries[0] === ".git") {
     try {
-      rmSync5(join21(dir, ".git"), { recursive: true, force: true });
+      rmSync5(join20(dir, ".git"), { recursive: true, force: true });
       return [];
     } catch {
       return entries;
@@ -11064,8 +11421,16 @@ function printOverlaps(overlaps, json) {
 
 // src/cli/commands/workspace/local.ts
 import * as p24 from "@clack/prompts";
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync25, realpathSync as realpathSync6, renameSync as renameSync2, statSync as statSync3, writeFileSync as writeFileSync9 } from "fs";
-import { dirname as dirname10, isAbsolute as isAbsolute5, join as join22, relative as relative2, sep as sep2 } from "path";
+import {
+  existsSync as existsSync23,
+  mkdirSync as mkdirSync7,
+  readFileSync as readFileSync25,
+  realpathSync as realpathSync6,
+  renameSync as renameSync2,
+  statSync as statSync3,
+  writeFileSync as writeFileSync7
+} from "fs";
+import { dirname as dirname11, isAbsolute as isAbsolute5, join as join21, relative as relative2, sep as sep2 } from "path";
 var WORKSPACE_MARKER = "deepspace-workspace.json";
 function excludeWorktreeDir(appDir, dir) {
   try {
@@ -11086,7 +11451,7 @@ function worktreeMarkerPath(worktreeRoot) {
     const result = runGit(worktreeRoot, ["rev-parse", "--absolute-git-dir"], { allowFail: true });
     if (result.status !== 0) return null;
     const gitDir = result.stdout.toString("utf-8").trim();
-    return isAbsolute5(gitDir) ? join22(gitDir, WORKSPACE_MARKER) : null;
+    return isAbsolute5(gitDir) ? join21(gitDir, WORKSPACE_MARKER) : null;
   } catch {
     return null;
   }
@@ -11097,8 +11462,8 @@ function markManagedWorkspace(worktreeRoot, workspaceId) {
   const marker = { version: 1, workspaceId, mode: "managed-linked" };
   const tempPath = `${markerPath}.${process.pid}.tmp`;
   try {
-    mkdirSync7(dirname10(markerPath), { recursive: true });
-    writeFileSync9(tempPath, JSON.stringify(marker) + "\n");
+    mkdirSync7(dirname11(markerPath), { recursive: true });
+    writeFileSync7(tempPath, JSON.stringify(marker) + "\n");
     renameSync2(tempPath, markerPath);
     return true;
   } catch {
@@ -11131,11 +11496,16 @@ function isManagedWorkspaceWorktree(worktreeRoot, workspaceId) {
 function defaultWorkspaceRoot(appDir, workspaceId) {
   const primary = listWorktrees(appDir)[0];
   if (!primary) throw new Error("Git did not report a primary worktree");
-  return join22(primary.path, ".deepspace", "ws", workspaceId.slice(3).toLowerCase());
+  return join21(primary.path, ".deepspace", "ws", workspaceId.slice(3).toLowerCase());
 }
 function appDirInWorktree(appDir, worktreeRoot) {
   const appRelative = relative2(realpathSync6(repoToplevel(appDir)), realpathSync6(appDir));
-  return appRelative ? join22(worktreeRoot, appRelative) : worktreeRoot;
+  return appRelative ? join21(worktreeRoot, appRelative) : worktreeRoot;
+}
+function primaryAppDir(appDir) {
+  const primary = listWorktrees(appDir)[0];
+  if (!primary) throw new Error("Git did not report a primary worktree");
+  return appDirInWorktree(appDir, primary.path);
 }
 function materializeWorkspaceWorktree(appDir, worktreeRoot, branch, startPoint, workspaceId, options = {}) {
   const createdOid = resolveCommit(appDir, startPoint);
@@ -11165,7 +11535,7 @@ function rematerializeWorkspaceWorktree(appDir, worktreeRoot, branch, workspaceI
 function inOwnLinkedWorktree(appDir, id) {
   if (workspaceIdFromBranch(currentBranch(appDir)) !== id) return false;
   try {
-    return statSync3(join22(repoToplevel(appDir), ".git")).isFile();
+    return statSync3(join21(repoToplevel(appDir), ".git")).isFile();
   } catch {
     return false;
   }
@@ -11206,6 +11576,7 @@ function cleanupJson(outcome) {
     worktreeRetained: outcome.worktreeRetained,
     branchDeleted: outcome.branchDeleted,
     ...outcome.mainDir ? { mainDir: outcome.mainDir } : {},
+    ...outcome.leftoverDir ? { leftoverDir: outcome.leftoverDir } : {},
     ...outcome.error ? { error: outcome.error } : {}
   };
 }
@@ -11280,7 +11651,23 @@ function cleanupWorkspaceLocal(appDir, id, trunkBranch, options = {}) {
       }
       const remove2 = runGit(mainDir, ["worktree", "remove", linked.path], { allowFail: true });
       if (remove2.status !== 0) {
-        out.error = `git worktree remove ${linked.path} failed: ${remove2.stderr.toString("utf-8").trim() || "unknown git error"}`;
+        const reason = remove2.stderr.toString("utf-8").trim() || "unknown git error";
+        const registered = listWorktrees(mainDir);
+        const stillRegistered = registered.length === 0 || registered.some((worktree, index) => index > 0 && worktree.path === linked.path);
+        if (stillRegistered) {
+          out.error = `git worktree remove ${linked.path} failed: ${reason}`;
+          return out;
+        }
+        runGit(mainDir, ["worktree", "prune"], { allowFail: true });
+        out.worktreeDir = null;
+        const leftover = existsSync23(linked.path);
+        if (leftover) out.leftoverDir = linked.path;
+        else out.worktreeRemoved = linked.path;
+        deleteWsBranch(mainDir, branch, expectedBranchOid, out);
+        if (leftover) {
+          const branchProblem = out.error;
+          out.error = `git removed the worktree but could not delete its files (${reason})` + (branchProblem ? `. Also: ${branchProblem}` : "");
+        }
         return out;
       }
       out.worktreeRemoved = linked.path;
@@ -11302,12 +11689,20 @@ function cleanupWorkspaceLocal(appDir, id, trunkBranch, options = {}) {
 function cleanupRefusalMessage(outcome) {
   if (outcome.worktreeDir) {
     const dir = shQuote(outcome.worktreeDir);
-    return `Cleanup incomplete: ${outcome.error}. The worktree at ${dir} still holds uncommitted or untracked work \u2014 that's why the plain removal refused. Inspect it (\`git -C ${dir} status\`) and commit anything worth keeping to the workspace branch. Once it's clean, remove it from the main checkout: \`git worktree remove ${dir}\`.`;
+    if (outcome.error.includes("contains modified or untracked files")) {
+      return `Cleanup incomplete: ${outcome.error}. The worktree at ${dir} still holds uncommitted or untracked work \u2014 that's why the plain removal refused. Inspect it (\`git -C ${dir} status\`) and commit anything worth keeping to the workspace branch. Once it's clean, remove it from the main checkout: \`git worktree remove ${dir}\`.`;
+    }
+    return `Cleanup incomplete: ${outcome.error}. The worktree at ${dir} is still registered; git refused the plain removal for the reason above. Inspect it (\`git -C ${dir} status\`), resolve that, then remove it from the main checkout: \`git worktree remove ${dir}\`.`;
+  }
+  if (outcome.leftoverDir) {
+    return `Cleanup incomplete: ${outcome.error}. Close anything using that folder \u2014 a dev server, an editor, or a shell inside it \u2014 then delete: ${shQuote(outcome.leftoverDir)}`;
   }
   return `Cleanup incomplete: ${outcome.error}. Finish it from the main checkout once ${shQuote(outcome.branch)} is safe to delete.`;
 }
 function cleanupAction(outcome) {
-  return outcome.worktreeDir ? { cwd: outcome.worktreeDir, argv: ["git", "status"] } : { cwd: process.cwd(), argv: ["git", "branch", "--list", outcome.branch] };
+  if (outcome.worktreeDir) return { cwd: outcome.worktreeDir, argv: ["git", "status"] };
+  if (outcome.leftoverDir) return { cwd: process.cwd(), argv: ["git", "worktree", "list"] };
+  return { cwd: process.cwd(), argv: ["git", "branch", "--list", outcome.branch] };
 }
 function reportCleanupHuman(outcome) {
   if (outcome.error) {
@@ -11315,6 +11710,7 @@ function reportCleanupHuman(outcome) {
       cleanupRefusalMessage({
         error: outcome.error,
         worktreeDir: outcome.worktreeDir,
+        leftoverDir: outcome.leftoverDir,
         branch: outcome.branch
       })
     );
@@ -11562,7 +11958,7 @@ var newWorkspaceCommand = defineDeepspaceCommand({
 
 // src/cli/commands/workspace/attach.ts
 import * as p26 from "@clack/prompts";
-import { existsSync as existsSync23, readdirSync as readdirSync7, realpathSync as realpathSync7, rmSync as rmSync6 } from "fs";
+import { existsSync as existsSync24, readdirSync as readdirSync7, realpathSync as realpathSync7, rmSync as rmSync6 } from "fs";
 import { isAbsolute as isAbsolute7, resolve as resolve19 } from "path";
 function samePath(a, b) {
   const real = (p35) => {
@@ -11582,7 +11978,7 @@ function finishedWorkspaceMessage(id, view) {
   return `Workspace ${id} is ${workspace.status} \u2014 its ref is retained briefly (fetch ${workspace.ref} to inspect), but attach only works on active workspaces.`;
 }
 function cleanFailedFreshAttachDir(dir) {
-  if (!existsSync23(dir)) return [];
+  if (!existsSync24(dir)) return [];
   let entries;
   try {
     entries = readdirSync7(dir);
@@ -11664,7 +12060,7 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
       const localTip = resolveCommit(appDir, `refs/heads/${branch}`);
       if (localTip) {
         let existing = resolveWorkspaceWorktree(listWorktrees(appDir), id);
-        if (existing && !existsSync23(existing)) {
+        if (existing && !existsSync24(existing)) {
           runGit(appDir, ["worktree", "prune"], { allowFail: true });
           existing = null;
         }
@@ -11782,7 +12178,7 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
       process.cwd(),
       (typeof args.dir === "string" ? args.dir.trim() : "") || `ws-${id.slice(3).toLowerCase()}`
     );
-    if (existsSync23(dir)) {
+    if (existsSync24(dir)) {
       spinner2?.stop("Target exists.");
       throw new Refusal(`${dir} already exists \u2014 pass a different directory.`, "dir_exists");
     }
@@ -12120,12 +12516,12 @@ import * as p30 from "@clack/prompts";
 // src/cli/lib/validation.ts
 import { sync as spawnSync7 } from "cross-spawn";
 import { readFileSync as readFileSync26 } from "fs";
-import { join as join23 } from "path";
+import { join as join22 } from "path";
 var MAX_SUMMARY_CHARS = 4e3;
 var MAX_OUTPUT_BUFFER = 64 * 1024 * 1024;
 function configuredCommand(appDir) {
   try {
-    const pkg2 = JSON.parse(readFileSync26(join23(appDir, "package.json"), "utf-8"));
+    const pkg2 = JSON.parse(readFileSync26(join22(appDir, "package.json"), "utf-8"));
     if (pkg2.scripts?.validate) return `${detectPackageManager(appDir)} run --silent validate`;
   } catch {
   }
@@ -12163,6 +12559,11 @@ function conflictMarkerFiles(diffCheckOutput) {
   }
   return [...files];
 }
+function pullAfterLandAction(primaryDir, intoBranch, landedOid) {
+  if (currentBranch(primaryDir) !== intoBranch) return null;
+  if (resolveCommit(primaryDir, "HEAD") === landedOid) return null;
+  return { cwd: primaryDir, argv: ["deepspace", "pull"] };
+}
 function landResumeArgv(args) {
   const argv = ["deepspace", "workspace", "land"];
   const workspace = args.workspace?.trim();
@@ -12441,6 +12842,7 @@ var landWorkspaceCommand = defineDeepspaceCommand({
       );
     }
     spinner2?.stop(`Landed ${id} into ${intoBranch} at ${landedOid.slice(0, 10)}.`);
+    const primaryDir = primaryAppDir(appDir);
     const cleanup = keepWorktree ? null : cleanupWorkspaceLocal(appDir, id, intoBranch, { expectedBranchOid: landedOid });
     const inOwnWorktree = !cleanup && inOwnLinkedWorktree(appDir, id);
     const retainedWorktree = cleanup?.worktreeRetained ?? (keepWorktree || inOwnWorktree ? appDir : null);
@@ -12458,21 +12860,24 @@ var landWorkspaceCommand = defineDeepspaceCommand({
       p30.log.info(`Retained checkout: ${retainedWorktree}`);
     }
     if (cleanup?.error) {
-      const action = cleanupAction({
+      const action2 = cleanupAction({
         worktreeDir: cleanup.worktreeDir,
+        leftoverDir: cleanup.leftoverDir,
         branch: cleanup.branch
       });
       throw new Refusal(
         cleanupRefusalMessage({
           error: cleanup.error,
           worktreeDir: cleanup.worktreeDir,
+          leftoverDir: cleanup.leftoverDir,
           branch: cleanup.branch
         }),
         "cleanup_incomplete",
-        { actionRequired: true, action, extra: data }
+        { actionRequired: true, action: action2, extra: data }
       );
     }
-    return { data };
+    const action = pullAfterLandAction(primaryDir, intoBranch, landedOid);
+    return { data, ...action ? { action } : {} };
   }
 });
 
@@ -12630,12 +13035,14 @@ var dropWorkspaceCommand = defineDeepspaceCommand({
     if (cleanup?.error) {
       const action = cleanupAction({
         worktreeDir: cleanup.worktreeDir,
+        leftoverDir: cleanup.leftoverDir,
         branch: cleanup.branch
       });
       throw new Refusal(
         cleanupRefusalMessage({
           error: cleanup.error,
           worktreeDir: cleanup.worktreeDir,
+          leftoverDir: cleanup.leftoverDir,
           branch: cleanup.branch
         }),
         "cleanup_incomplete",
@@ -12912,7 +13319,7 @@ var source_default = defineDeepspaceCommand({
   args: {
     provider: {
       type: "positional",
-      description: "Source provider: github or deepspace (omit to show)",
+      description: "Source authority: deepspace is platform-hosted and commit-first; github deploys the local working tree without Git sync (omit to show)",
       required: false
     },
     app: {
@@ -13190,10 +13597,165 @@ function sameRefs(left, right) {
 
 // src/cli/commands/update.ts
 import * as p34 from "@clack/prompts";
-import { existsSync as existsSync24, readFileSync as readFileSync27, writeFileSync as writeFileSync10 } from "fs";
-import { join as join24, resolve as resolve20 } from "path";
+import { existsSync as existsSync25, readFileSync as readFileSync27, writeFileSync as writeFileSync8 } from "fs";
+import { join as join23, resolve as resolve20 } from "path";
+
+// package.json
+var package_default = {
+  name: "deepspace",
+  version: "0.19.1",
+  engines: {
+    node: ">=22.15.0 <23 || >=24 <25 || >=26 <27"
+  },
+  description: "DeepSpace SDK \u2014 build real-time collaborative apps on Cloudflare Workers",
+  type: "module",
+  sideEffects: false,
+  main: "./dist/index.js",
+  types: "./dist/index.d.ts",
+  bin: {
+    deepspace: "dist/cli.js"
+  },
+  exports: {
+    ".": {
+      types: "./dist/index.d.ts",
+      import: "./dist/index.js"
+    },
+    "./schema": {
+      types: "./dist/schema.d.ts",
+      import: "./dist/schema.js"
+    },
+    "./worker": {
+      types: "./dist/worker.d.ts",
+      import: "./dist/worker.js"
+    },
+    "./server": {
+      types: "./dist/server.d.ts",
+      import: "./dist/server.js"
+    },
+    "./testing": {
+      types: "./dist/testing.d.ts",
+      import: "./dist/testing.js"
+    },
+    "./documentation": {
+      types: "./dist/documentation.d.ts",
+      import: "./dist/documentation.js"
+    },
+    "./documentation/react": {
+      types: "./dist/documentation-react.d.ts",
+      import: "./dist/documentation-react.js"
+    }
+  },
+  files: [
+    "dist",
+    "features",
+    "CHANGELOG.md"
+  ],
+  scripts: {
+    build: "node ../../scripts/clean-artifacts.mjs dist --tsbuildinfo && tsup",
+    "type-check": "tsc --noEmit",
+    test: "vitest run",
+    "test:documentation-browser": "playwright test --config src/documentation/runtime/__browser__/playwright.config.ts",
+    clean: "node ../../scripts/clean-artifacts.mjs dist --tsbuildinfo",
+    prepublishOnly: "pnpm build"
+  },
+  dependencies: {
+    "@ai-sdk/anthropic": "2.0.91",
+    "@ai-sdk/openai": "2.0.116",
+    "@ai-sdk/openai-compatible": "1.0.46",
+    "@clack/prompts": "^1.2.0",
+    "@mdx-js/mdx": "^3.1.1",
+    acorn: "^8.16.0",
+    ai: "5.0.222",
+    "better-auth": "1.6.23",
+    citty: "^0.2.0",
+    "cross-spawn": "^7.0.6",
+    esbuild: "^0.27.0",
+    "highlight.js": "^11.11.1",
+    hono: "^4.6.0",
+    jose: "^6.1.0",
+    marked: "^18.0.7",
+    "mdast-util-gfm": "^3.1.0",
+    "mdast-util-to-markdown": "^2.1.2",
+    "rehype-highlight": "^7.0.2",
+    "remark-frontmatter": "^5.0.0",
+    "remark-gfm": "^4.0.1",
+    "sanitize-html": "^2.17.6",
+    "smol-toml": "^1.6.1",
+    yaml: "^2.9.0",
+    yjs: "^13.6.0",
+    zod: "^4.3.6"
+  },
+  peerDependencies: {
+    "@playwright/test": ">=1.40.0",
+    clsx: ">=2.0.0",
+    "lucide-react": ">=0.400.0",
+    react: "^18.0.0 || ^19.0.0",
+    "react-dom": "^18.0.0 || ^19.0.0",
+    "tailwind-merge": ">=2.0.0"
+  },
+  peerDependenciesMeta: {
+    "@playwright/test": {
+      optional: true
+    },
+    react: {
+      optional: true
+    },
+    "react-dom": {
+      optional: true
+    },
+    clsx: {
+      optional: true
+    },
+    "tailwind-merge": {
+      optional: true
+    },
+    "lucide-react": {
+      optional: true
+    }
+  },
+  devDependencies: {
+    "@cloudflare/workers-types": "^4.20241205.0",
+    "@playwright/test": "^1.59.1",
+    "@types/better-sqlite3": "^7.6.12",
+    "@types/cross-spawn": "^6.0.6",
+    "@types/react": "^19.0.0",
+    "@types/react-dom": "^19.0.0",
+    "@types/sanitize-html": "^2.16.1",
+    "better-sqlite3": "^12.0.0",
+    clsx: "^2.1.1",
+    "framer-motion": "^12.38.0",
+    jsdom: "^29.1.1",
+    "lucide-react": "^1.7.0",
+    "react-router-dom": "^7.1.0",
+    "tailwind-merge": "^3.5.0",
+    tsup: "^8.3.0",
+    typescript: "^5.7.0",
+    vitest: "^4.1.0"
+  },
+  keywords: [
+    "deepspace",
+    "cloudflare-workers",
+    "durable-objects",
+    "real-time",
+    "collaborative",
+    "sdk"
+  ],
+  license: "Apache-2.0",
+  homepage: "https://deep.space",
+  repository: {
+    type: "git",
+    url: "git+https://github.com/deepdotspace/deepspace.git",
+    directory: "packages/deepspace"
+  },
+  bugs: {
+    url: "https://github.com/deepdotspace/deepspace/issues"
+  }
+};
+
+// src/cli/commands/update.ts
 var REGISTRY = "https://registry.npmjs.org/deepspace/latest";
 var DOCS_URL = "https://documentation.deep.space/cli-reference/commands";
+var COMPATIBLE_AI_VERSION = package_default.dependencies.ai;
 var OLDEST_SUPPORTED_MINOR = 12;
 function parseVersion(raw) {
   const match = /^(\d+)\.(\d+)\.(\d+)/.exec(raw.trim().replace(/^[\^~]/, ""));
@@ -13205,25 +13767,29 @@ function gapIsTooWide(from, to) {
   return from.major === 0 && from.minor < OLDEST_SUPPORTED_MINOR;
 }
 function readAppSdkVersion(appDir) {
-  const installed = join24(appDir, "node_modules", "deepspace", "package.json");
-  if (existsSync24(installed)) {
+  const installed = join23(appDir, "node_modules", "deepspace", "package.json");
+  if (existsSync25(installed)) {
     const parsed2 = JSON.parse(readFileSync27(installed, "utf8"));
     if (typeof parsed2.version === "string") return parsed2.version;
   }
-  const manifest = join24(appDir, "package.json");
-  if (!existsSync24(manifest)) return null;
+  const manifest = join23(appDir, "package.json");
+  if (!existsSync25(manifest)) return null;
   const parsed = JSON.parse(readFileSync27(manifest, "utf8"));
   return parsed.dependencies?.deepspace ?? null;
 }
 function pinSdkVersion(appDir, version) {
-  const path = join24(appDir, "package.json");
+  const path = join23(appDir, "package.json");
   const source = readFileSync27(path, "utf8");
-  const updated = source.replace(
+  let updated = source.replace(
     /("deepspace"\s*:\s*")[^"]+(")/,
     (_match, head, tail) => `${head}^${version}${tail}`
   );
+  updated = updated.replace(
+    /("ai"\s*:\s*")[^"]+(")/,
+    (_match, head, tail) => `${head}${COMPATIBLE_AI_VERSION}${tail}`
+  );
   if (updated === source) return false;
-  writeFileSync10(path, updated);
+  writeFileSync8(path, updated);
   return true;
 }
 async function latestPublishedVersion() {
@@ -13362,9 +13928,9 @@ var update_default = defineDeepspaceCommand({
 });
 
 // src/cli/cli.ts
-var __dirname = dirname11(fileURLToPath3(import.meta.url));
-var pkg = JSON.parse(readFileSync28(join25(__dirname, "..", "package.json"), "utf-8"));
-if (process.platform === "linux" && !process.env.SSL_CERT_FILE && existsSync25("/etc/ssl/certs/ca-certificates.crt")) {
+var __dirname = dirname12(fileURLToPath3(import.meta.url));
+var pkg = JSON.parse(readFileSync28(join24(__dirname, "..", "package.json"), "utf-8"));
+if (process.platform === "linux" && !process.env.SSL_CERT_FILE && existsSync26("/etc/ssl/certs/ca-certificates.crt")) {
   process.env.SSL_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt";
 }
 var create2 = defineCommand14({