deepspace 0.19.0 → 0.19.2

package/dist/cli.js

@@ -8,8 +8,8 @@ import {
   renderUsage
 } from "citty";
 import { sync as spawnSync8 } from "cross-spawn";
-import { readFileSync as readFileSync28, existsSync as existsSync25 } from "fs";
-import { dirname as dirname11, join as join25 } from "path";
+import { readFileSync as readFileSync28, existsSync as existsSync26 } from "fs";
+import { dirname as dirname12, join as join24 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 
 // src/cli/lib/spinner.ts
@@ -205,6 +205,13 @@ var InputError = class extends Error {
     this.code = code;
   }
 };
+var CliExit = class extends Error {
+  constructor(exitCode) {
+    super(`exit ${exitCode}`);
+    this.exitCode = exitCode;
+    this.name = "CliExit";
+  }
+};
 function errorCode(err) {
   if (err instanceof ApiError || err instanceof InputError) return err.code;
   if (err instanceof Error && err.name === "GitError") return err.code ?? "git_error";
@@ -230,12 +237,17 @@ function formatCliError(err) {
 ${hint}` : message;
 }
 function renderCliError(err) {
+  if (err instanceof CliExit) {
+    process.exitCode = err.exitCode;
+    return;
+  }
   stopActiveSpinner();
   const message = formatCliError(err);
   const slug = errorCode(err);
   if (process.argv.includes("--json")) {
     console.log(JSON.stringify({ ok: false, ...slug ? { code: slug } : {}, error: message }));
-    process.exit(1);
+    process.exitCode = 1;
+    return;
   }
   console.error(slug ? withSlug(message, slug) : message);
   if (process.env.DEBUG) {
@@ -244,7 +256,7 @@ function renderCliError(err) {
 API ${apiPath}${status3 ? ` (${status3})` : ""}`);
     if (err instanceof Error && err.stack) console.error("\n" + err.stack);
   }
-  process.exit(1);
+  process.exitCode = 1;
 }
 function wrapCommandErrors(cmd) {
   const run2 = cmd.run;
@@ -301,10 +313,9 @@ function withoutReservedKeys(payload) {
     )
   );
 }
-function exitWhenFlushed(code) {
-  if (process.stdout.writableLength === 0) process.exit(code);
-  process.stdout.write("", () => process.exit(code));
-  return void 0;
+function finishCommand(code) {
+  stopActiveSpinner();
+  process.exitCode = code;
 }
 function nameVariants(name) {
   return [
@@ -398,9 +409,9 @@ function defineDeepspaceCommand(def) {
           else p3.log.error(line);
           if (refusal?.action) printAction(refusal.action);
         }
-        exitWhenFlushed(refusal?.actionRequired ? 2 : 1);
+        finishCommand(refusal?.actionRequired ? 2 : 1);
       }
-      if (succeeded) exitWhenFlushed(0);
+      if (succeeded) finishCommand(0);
     }
   });
 }
@@ -515,7 +526,7 @@ function effectivePlatformUrls(env = process.env) {
 var DASHBOARD_URL = DEEPSPACE_ENV === "production" ? "https://dashboard.deep.space" : DEEPSPACE_ENV === "staging" ? "https://dashboard.deepspacesites.com" : "http://127.0.0.1:9";
 
 // src/cli/auth.ts
-import { readFileSync as readFileSync2, writeFileSync, existsSync, mkdirSync } from "fs";
+import { readFileSync as readFileSync2, existsSync, mkdirSync } from "fs";
 import { join } from "path";
 import { homedir } from "os";
 
@@ -543,6 +554,16 @@ async function exchangeSession(authUrl, sessionToken) {
   return data.token ?? null;
 }
 
+// src/cli/lib/secure-file.ts
+import { chmodSync, writeFileSync } from "fs";
+function writeSecretFileSync(path, content) {
+  writeFileSync(path, content, { mode: 384 });
+  try {
+    chmodSync(path, 384);
+  } catch {
+  }
+}
+
 // src/cli/auth.ts
 var AUTH_URL = process.env.DEEPSPACE_AUTH_URL ?? PLATFORM_URLS.auth;
 var PROD_AUTH_URL = "https://auth.deep.space";
@@ -585,7 +606,7 @@ async function ensureToken() {
     );
   }
   mkdirSync(DIR, { recursive: true, mode: 448 });
-  writeFileSync(TOKEN_PATH, token, { mode: 384 });
+  writeSecretFileSync(TOKEN_PATH, token);
   return token;
 }
 function isTokenValid(jwt) {
@@ -603,7 +624,7 @@ registerAuthRefresh(async () => {
     const token = await exchangeSession(AUTH_URL, sessionToken);
     if (!token) return null;
     mkdirSync(DIR, { recursive: true, mode: 448 });
-    writeFileSync(TOKEN_PATH, token, { mode: 384 });
+    writeSecretFileSync(TOKEN_PATH, token);
     return token;
   } catch {
     return null;
@@ -611,19 +632,18 @@ registerAuthRefresh(async () => {
 });
 
 // src/cli/commands/login.ts
-import { writeFileSync as writeFileSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3 } from "fs";
-import { join as join2 } from "path";
-import { homedir as homedir2 } from "os";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync3 } from "fs";
+import { dirname as dirname2 } from "path";
 import { randomBytes, createHash } from "crypto";
 import * as p4 from "@clack/prompts";
 
 // src/cli/lib/open-browser.ts
-import { exec } from "child_process";
+import { spawn } from "child_process";
 function openBrowser(url) {
   const quoted = JSON.stringify(url);
   const cmd = process.platform === "darwin" ? `open ${quoted}` : process.platform === "win32" ? `start "" ${quoted}` : `xdg-open ${quoted}`;
-  exec(cmd, () => {
-  });
+  spawn(cmd, { shell: true, detached: true, stdio: "ignore", windowsHide: true }).on("error", () => {
+  }).unref();
 }
 
 // src/cli/commands/login.ts
@@ -716,9 +736,13 @@ var login_default = defineDeepspaceCommand({
     if (!json) s.start("Waiting for authentication...");
     const result = await pollForCompletion(sessionId, codeVerifier);
     if (!result) {
-      throw new Refusal("Login timed out. Run `deepspace auth login` to try again.", "login_timeout", {
-        action: cliAction("deepspace", "auth", "login")
-      });
+      throw new Refusal(
+        "Login timed out. Run `deepspace auth login` to try again.",
+        "login_timeout",
+        {
+          action: cliAction("deepspace", "auth", "login")
+        }
+      );
     }
     storeCredentials(result.sessionToken, result.jwt);
     await provisionProfile(result.jwt);
@@ -798,11 +822,10 @@ async function pollForCompletion(sessionId, codeVerifier) {
   return null;
 }
 function storeCredentials(sessionToken, jwt) {
-  const dir = join2(homedir2(), ".deepspace");
-  mkdirSync2(dir, { recursive: true, mode: 448 });
   const { sessionPath, tokenPath } = credentialPaths(AUTH_URL2);
-  writeFileSync2(sessionPath, sessionToken, { mode: 384 });
-  writeFileSync2(tokenPath, jwt, { mode: 384 });
+  mkdirSync2(dirname2(sessionPath), { recursive: true, mode: 448 });
+  writeSecretFileSync(sessionPath, sessionToken);
+  writeSecretFileSync(tokenPath, jwt);
 }
 async function provisionProfile(jwt) {
   try {
@@ -883,8 +906,8 @@ var logout_default = defineDeepspaceCommand({
 });
 
 // src/cli/lib/app-identity.ts
-import { existsSync as existsSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
-import { join as join3, resolve as resolve2 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "fs";
+import { join as join2, resolve as resolve2 } from "path";
 import { parse as parseToml } from "smol-toml";
 
 // src/server/utils/registry-client.ts
@@ -919,7 +942,7 @@ function mintAppId(now = Date.now()) {
   return `app_${mintUlid(now)}`;
 }
 function readWranglerIdentityConfig(cwd) {
-  const wranglerPath = join3(resolve2(cwd), "wrangler.toml");
+  const wranglerPath = join2(resolve2(cwd), "wrangler.toml");
   if (!existsSync3(wranglerPath)) return null;
   try {
     return parseToml(readFileSync5(wranglerPath, "utf-8"));
@@ -938,7 +961,7 @@ function readAppId(cwd = process.cwd(), wranglerEnv) {
   return typeof id === "string" && APP_ID_RE.test(id) ? id : null;
 }
 function writeAppId(cwd, appId, opts = {}) {
-  const wranglerPath = join3(resolve2(cwd), "wrangler.toml");
+  const wranglerPath = join2(resolve2(cwd), "wrangler.toml");
   if (!existsSync3(wranglerPath)) {
     throw new Error(`No wrangler.toml in ${resolve2(cwd)}`);
   }
@@ -971,19 +994,19 @@ ${header}
 ${line}
 `;
   }
-  writeFileSync3(wranglerPath, src);
+  writeFileSync2(wranglerPath, src);
 }
 
 // src/cli/commands/dev.ts
-import { resolve as resolve8, basename as basename2, join as join12 } from "path";
-import spawn from "cross-spawn";
+import { resolve as resolve8, basename as basename2, join as join11 } from "path";
+import spawn2 from "cross-spawn";
 
 // src/cli/lib/app-context.ts
 import { existsSync as existsSync4, readFileSync as readFileSync6, readdirSync } from "fs";
-import { dirname as dirname2, join as join4, resolve as resolve3 } from "path";
+import { dirname as dirname3, join as join3, resolve as resolve3 } from "path";
 import { parse as parseToml2 } from "smol-toml";
 function detectAppName(cwd = process.cwd()) {
-  const wranglerPath = join4(resolve3(cwd), "wrangler.toml");
+  const wranglerPath = join3(resolve3(cwd), "wrangler.toml");
   if (!existsSync4(wranglerPath)) return null;
   try {
     const config = parseToml2(readFileSync6(wranglerPath, "utf-8"));
@@ -998,15 +1021,15 @@ function detectAppName(cwd = process.cwd()) {
 function findAppDir(start = process.cwd()) {
   let dir = resolve3(start);
   for (; ; ) {
-    if (existsSync4(join4(dir, "wrangler.toml"))) return dir;
-    const parent = dirname2(dir);
+    if (existsSync4(join3(dir, "wrangler.toml"))) return dir;
+    const parent = dirname3(dir);
     if (parent === dir) return null;
     dir = parent;
   }
 }
 function findChildApps(dir) {
   try {
-    return readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && existsSync4(join4(dir, entry.name, "wrangler.toml"))).map((entry) => entry.name).sort();
+    return readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && existsSync4(join3(dir, entry.name, "wrangler.toml"))).map((entry) => entry.name).sort();
   } catch {
     return [];
   }
@@ -1017,16 +1040,16 @@ import {
   existsSync as existsSync5,
   readFileSync as readFileSync8,
   realpathSync as realpathSync2,
-  writeFileSync as writeFileSync4,
+  writeFileSync as writeFileSync3,
   mkdirSync as mkdirSync4,
   renameSync,
   unlinkSync
 } from "fs";
-import { join as join6, resolve as resolve5, dirname as dirname4, basename, isAbsolute as isAbsolute2, sep } from "path";
+import { join as join5, resolve as resolve5, dirname as dirname5, basename, isAbsolute as isAbsolute2, sep } from "path";
 
 // src/cli/lib/git/repository.ts
 import { appendFileSync, mkdirSync as mkdirSync3, readFileSync as readFileSync7 } from "fs";
-import { dirname as dirname3, join as join5, resolve as resolve4 } from "path";
+import { dirname as dirname4, join as join4, resolve as resolve4 } from "path";
 
 // src/cli/lib/git/process.ts
 import { sync as spawnSync } from "cross-spawn";
@@ -1230,7 +1253,7 @@ function listWorktrees(cwd) {
 }
 function ensureLocalExclude(cwd, pattern) {
   const commonDir = resolve4(cwd, gitLine(cwd, ["rev-parse", "--git-common-dir"]));
-  const excludePath = join5(commonDir, "info", "exclude");
+  const excludePath = join4(commonDir, "info", "exclude");
   let current = "";
   try {
     current = readFileSync7(excludePath, "utf-8");
@@ -1238,7 +1261,7 @@ function ensureLocalExclude(cwd, pattern) {
   }
   if (current.split("\n").some((line) => line.trim() === pattern)) return;
   try {
-    mkdirSync3(dirname3(excludePath), { recursive: true });
+    mkdirSync3(dirname4(excludePath), { recursive: true });
     appendFileSync(
       excludePath,
       `${current.endsWith("\n") || current === "" ? "" : "\n"}${pattern}
@@ -1250,9 +1273,9 @@ function ensureLocalExclude(cwd, pattern) {
 
 // src/cli/lib/launch-config.ts
 function writeLaunchFile(launchPath, config) {
-  mkdirSync4(dirname4(launchPath), { recursive: true });
+  mkdirSync4(dirname5(launchPath), { recursive: true });
   const tmpPath = `${launchPath}.${process.pid}.tmp`;
-  writeFileSync4(tmpPath, JSON.stringify(config, null, 2) + "\n");
+  writeFileSync3(tmpPath, JSON.stringify(config, null, 2) + "\n");
   try {
     renameSync(tmpPath, launchPath);
   } catch (err) {
@@ -1273,7 +1296,7 @@ function readLaunchFile(launchPath) {
   return parsed;
 }
 function writeLaunchConfigIfMissing(appDir, appName, port, opts = {}) {
-  const launchPath = join6(appDir, ".claude", "launch.json");
+  const launchPath = join5(appDir, ".claude", "launch.json");
   try {
     const config = readLaunchFile(launchPath);
     if (!config) return;
@@ -1314,7 +1337,7 @@ function writeLaunchConfigIfMissing(appDir, appName, port, opts = {}) {
 }
 function resolveAppLaunchPort(appDir) {
   try {
-    const config = readLaunchFile(join6(appDir, ".claude", "launch.json"));
+    const config = readLaunchFile(join5(appDir, ".claude", "launch.json"));
     if (!config) return null;
     const appName = detectAppName(appDir) ?? basename(appDir);
     const entry = config.configurations.find((c) => c?.name === appName) ?? (config.configurations.length === 1 ? config.configurations[0] : void 0);
@@ -1331,10 +1354,10 @@ function detectClaudeWorktree(appDir) {
       listWorktrees(appDir).map((worktree) => canonicalPath(worktree.path))
     );
     if (!registered.has(worktreeRoot)) return null;
-    const worktreesDir = dirname4(worktreeRoot);
-    const claudeDir = dirname4(worktreesDir);
+    const worktreesDir = dirname5(worktreeRoot);
+    const claudeDir = dirname5(worktreesDir);
     if (basename(worktreesDir) !== "worktrees" || basename(claudeDir) !== ".claude") return null;
-    const ownerRoot = canonicalPath(dirname4(claudeDir));
+    const ownerRoot = canonicalPath(dirname5(claudeDir));
     if (!registered.has(ownerRoot)) return null;
     return { mainRepoRoot: ownerRoot, worktreeName: basename(worktreeRoot) };
   } catch {
@@ -1368,12 +1391,12 @@ function deriveWorktreePort(worktreeKey) {
   return WORKTREE_PORT_MIN + hash % WORKTREE_PORT_RANGE;
 }
 function upsertWorktreeLaunchConfig(mainRepoRoot, worktreeName, appDir, opts) {
-  const launchPath = join6(mainRepoRoot, ".claude", "launch.json");
+  const launchPath = join5(mainRepoRoot, ".claude", "launch.json");
   const entryName = WORKTREE_ENTRY_PREFIX + worktreeName;
   try {
     const config = readLaunchFile(launchPath);
     if (!config) return null;
-    const worktreesRoot = join6(mainRepoRoot, ".claude", "worktrees") + sep;
+    const worktreesRoot = join5(mainRepoRoot, ".claude", "worktrees") + sep;
     config.configurations = config.configurations.filter((c) => {
       if (c?.name === entryName) return false;
       const isStaleWorktreeEntry = typeof c?.name === "string" && c.name.startsWith(WORKTREE_ENTRY_PREFIX) && typeof c.cwd === "string" && isAbsolute2(c.cwd) && c.cwd.startsWith(worktreesRoot) && !existsSync5(c.cwd);
@@ -1411,7 +1434,7 @@ function resolveWorktreePort(appDir) {
   const claude = detectClaudeWorktree(appDir);
   if (claude) {
     try {
-      const config = readLaunchFile(join6(claude.mainRepoRoot, ".claude", "launch.json"));
+      const config = readLaunchFile(join5(claude.mainRepoRoot, ".claude", "launch.json"));
       const entry = config?.configurations.find(
         (c) => c?.name === WORKTREE_ENTRY_PREFIX + claude.worktreeName
       );
@@ -1472,19 +1495,9 @@ async function fetchAppIdentityToken(deployUrl, callerJwt, appId) {
   return body.token;
 }
 
-// src/cli/lib/secure-file.ts
-import { chmodSync, writeFileSync as writeFileSync5 } from "fs";
-function writeSecretFileSync(path, content) {
-  writeFileSync5(path, content, { mode: 384 });
-  try {
-    chmodSync(path, 384);
-  } catch {
-  }
-}
-
 // src/cli/lib/wrangler-env.ts
-import { existsSync as existsSync6, readFileSync as readFileSync9, rmSync as rmSync2, writeFileSync as writeFileSync6 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync9, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
+import { join as join6 } from "path";
 import { parse as parseToml3, stringify as stringifyToml } from "smol-toml";
 
 // src/server/rooms/app-name.ts
@@ -1585,7 +1598,7 @@ function resolveAppNameForEnv(config, envName) {
   return resolveAppName(envBlock.name);
 }
 function devVarsPathFor(appDir) {
-  return join7(appDir, ".dev.vars");
+  return join6(appDir, ".dev.vars");
 }
 function prepareWranglerEnvConfig(appDir, envName) {
   if (!envName) return { cleanup() {
@@ -1594,11 +1607,11 @@ function prepareWranglerEnvConfig(appDir, envName) {
   const resolved = resolveAppNameForEnv(config, envName);
   if (!resolved.ok) throw new Error(resolved.reason);
   const flattened = flattenWranglerEnvConfig(config, envName);
-  const configPath = join7(
+  const configPath = join6(
     appDir,
     `.wrangler.deepspace.${safeGeneratedConfigSegment(envName)}.${process.pid}.${++generatedConfigSeq}.toml`
   );
-  writeFileSync6(
+  writeFileSync4(
     configPath,
     [
       "# Generated by DeepSpace for this CLI run.",
@@ -1660,7 +1673,7 @@ var WranglerConfigError = class extends Error {
   }
 };
 function readWranglerConfig(appDir) {
-  const path = join7(appDir, "wrangler.toml");
+  const path = join6(appDir, "wrangler.toml");
   const raw = readFileSync9(path, "utf-8");
   try {
     return parseToml3(raw);
@@ -1669,7 +1682,7 @@ function readWranglerConfig(appDir) {
   }
 }
 function hasWranglerConfig(appDir) {
-  return existsSync6(join7(appDir, "wrangler.toml"));
+  return existsSync6(join6(appDir, "wrangler.toml"));
 }
 
 // src/cli/lib/dev-vars.ts
@@ -1712,21 +1725,21 @@ async function writeDevVars(appDir, ownerId, callerJwt, wranglerEnv, opts = {})
 
 // src/cli/lib/install-status.ts
 import { existsSync as existsSync8, readFileSync as readFileSync11, realpathSync as realpathSync3 } from "fs";
-import { dirname as dirname5, join as join9, resolve as resolve6 } from "path";
+import { dirname as dirname6, join as join8, resolve as resolve6 } from "path";
 
 // src/cli/lib/package-manager.ts
 import { existsSync as existsSync7, readFileSync as readFileSync10 } from "fs";
-import { join as join8 } from "path";
+import { join as join7 } from "path";
 function detectPackageManager(appDir) {
   try {
-    const pkg2 = JSON.parse(readFileSync10(join8(appDir, "package.json"), "utf-8"));
+    const pkg2 = JSON.parse(readFileSync10(join7(appDir, "package.json"), "utf-8"));
     const name = typeof pkg2.packageManager === "string" ? pkg2.packageManager.split("@")[0] : "";
     if (name === "npm" || name === "pnpm" || name === "yarn" || name === "bun") return name;
   } catch {
   }
-  if (existsSync7(join8(appDir, "pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync7(join8(appDir, "yarn.lock"))) return "yarn";
-  if (existsSync7(join8(appDir, "bun.lock")) || existsSync7(join8(appDir, "bun.lockb"))) return "bun";
+  if (existsSync7(join7(appDir, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync7(join7(appDir, "yarn.lock"))) return "yarn";
+  if (existsSync7(join7(appDir, "bun.lock")) || existsSync7(join7(appDir, "bun.lockb"))) return "bun";
   return "npm";
 }
 function installCommand(appDir) {
@@ -1736,10 +1749,10 @@ function installCommand(appDir) {
 // src/cli/lib/install-status.ts
 function installState(appDir) {
   if (resolvesDeepspace(appDir)) return "ready";
-  const sentinelDir = join9(appDir, ".deepspace");
-  if (existsSync8(join9(sentinelDir, "install.err"))) return "failed";
-  if (existsSync8(join9(sentinelDir, "install.started"))) {
-    if (!existsSync8(join9(sentinelDir, "install.done")) && installWorkerAlive(sentinelDir)) {
+  const sentinelDir = join8(appDir, ".deepspace");
+  if (existsSync8(join8(sentinelDir, "install.err"))) return "failed";
+  if (existsSync8(join8(sentinelDir, "install.started"))) {
+    if (!existsSync8(join8(sentinelDir, "install.done")) && installWorkerAlive(sentinelDir)) {
       return "installing";
     }
     return "failed";
@@ -1751,11 +1764,11 @@ function tailHint(logPath, platform = process.platform) {
 }
 function ensureInstallReady(appDir) {
   if (resolvesDeepspace(appDir)) return;
-  const sentinelDir = join9(appDir, ".deepspace");
-  const errPath = join9(sentinelDir, "install.err");
-  const startedPath = join9(sentinelDir, "install.started");
-  const donePath = join9(sentinelDir, "install.done");
-  const logPath = join9(sentinelDir, "install.log");
+  const sentinelDir = join8(appDir, ".deepspace");
+  const errPath = join8(sentinelDir, "install.err");
+  const startedPath = join8(sentinelDir, "install.started");
+  const donePath = join8(sentinelDir, "install.done");
+  const logPath = join8(sentinelDir, "install.log");
   if (existsSync8(errPath)) {
     const detail = readFileSync11(errPath, "utf-8").trimEnd();
     const log29 = existsSync8(logPath) ? ` Full log: ${logPath}.` : "";
@@ -1796,9 +1809,9 @@ function resolvesDeepspace(fromDir) {
   } catch {
   }
   for (; ; ) {
-    if (existsSync8(join9(dir, "node_modules", "deepspace", "package.json"))) return true;
+    if (existsSync8(join8(dir, "node_modules", "deepspace", "package.json"))) return true;
     if (dir === checkoutRoot) return false;
-    const parent = dirname5(dir);
+    const parent = dirname6(dir);
     if (parent === dir) return false;
     dir = parent;
   }
@@ -1811,7 +1824,7 @@ function canonicalPath2(path) {
   }
 }
 function installWorkerAlive(sentinelDir) {
-  const pidPath = join9(sentinelDir, "install.pid");
+  const pidPath = join8(sentinelDir, "install.pid");
   if (!existsSync8(pidPath)) return false;
   const pid = Number(readFileSync11(pidPath, "utf-8").trim());
   if (!Number.isSafeInteger(pid) || pid <= 0) return false;
@@ -1864,7 +1877,7 @@ function preflightWindowsWorkerd(appDir) {
 
 // src/cli/lib/macos-junk.ts
 import { readdirSync as readdirSync2, rmSync as rmSync3 } from "fs";
-import { join as join10 } from "path";
+import { join as join9 } from "path";
 var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", ".wrangler", ".vite"]);
 function removeMacosJunk(dir) {
   let removed = 0;
@@ -1875,7 +1888,7 @@ function removeMacosJunk(dir) {
     return removed;
   }
   for (const entry of entries) {
-    const path = join10(dir, entry.name);
+    const path = join9(dir, entry.name);
     if (entry.isDirectory()) {
       if (!SKIP_DIRS.has(entry.name)) removed += removeMacosJunk(path);
       continue;
@@ -2373,7 +2386,7 @@ async function refreshSecretsCache(deployUrl, token, appId, wranglerEnv, selecte
 
 // src/cli/lib/schema-lint.ts
 import { existsSync as existsSync10 } from "fs";
-import { join as join11 } from "path";
+import { join as join10 } from "path";
 import { pathToFileURL } from "url";
 
 // src/server/schemas/registry.ts
@@ -2432,12 +2445,12 @@ function lintSchema(schema) {
 
 // src/cli/lib/schema-lint.ts
 async function lintProjectSchemas(appDir) {
-  const schemasPath = join11(appDir, "src", "schemas.ts");
+  const schemasPath = join10(appDir, "src", "schemas.ts");
   if (!existsSync10(schemasPath)) return null;
   let schemas;
   try {
     const esbuild = await import("esbuild");
-    const outFile = join11(appDir, ".wrangler", "deploy", "schemas.lint.bundle.mjs");
+    const outFile = join10(appDir, ".wrangler", "deploy", "schemas.lint.bundle.mjs");
     await esbuild.build({
       entryPoints: [schemasPath],
       bundle: true,
@@ -2498,9 +2511,9 @@ function isPortListening(port, host, timeoutMs = 500) {
     socket.connect(port, target2);
   });
 }
-async function waitForPortListening(port, host, timeoutMs) {
+async function waitForPortListening(port, host, timeoutMs, signal) {
   const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
+  while (Date.now() < deadline && !signal?.aborted) {
     if (await isPortListening(port, host)) return true;
     await new Promise((resolve21) => setTimeout(resolve21, 250));
   }
@@ -2598,7 +2611,7 @@ var dev_default = defineDeepspaceCommand({
         );
       } else if (!args.json) {
         console.warn(
-          `Warning: could not update ${join12(worktree.mainRepoRoot, ".claude", "launch.json")} (malformed or unwritable) \u2014 the Claude preview tool may serve the main repo's code instead of this worktree.`
+          `Warning: could not update ${join11(worktree.mainRepoRoot, ".claude", "launch.json")} (malformed or unwritable) \u2014 the Claude preview tool may serve the main repo's code instead of this worktree.`
         );
       }
     }
@@ -2664,13 +2677,15 @@ Free it with \`${killCmd}\`, or start on another port: \`deepspace dev start --p
     }
     const url = `http://${host === DEFAULT_DEV_HOST ? "localhost" : host}:${port}`;
     say("Starting dev server...\n");
-    const vite = spawn("npx", ["vite", "--port", String(port), "--strictPort", "--host", host], {
+    const vite = spawn2("npx", ["vite", "--port", String(port), "--strictPort", "--host", host], {
       cwd: appDir,
       stdio: "inherit",
       env: wranglerViteEnv(process.env, wranglerConfig, { DEEPSPACE_PORT: String(port) })
     });
+    const readiness = new AbortController();
     if (args.json) {
-      void waitForPortListening(port, host, READINESS_TIMEOUT_MS).then((ready) => {
+      void waitForPortListening(port, host, READINESS_TIMEOUT_MS, readiness.signal).then((ready) => {
+        if (readiness.signal.aborted) return;
         console.log(
           JSON.stringify(
             ready ? { ok: true, ready: true, url, port, host, appDir } : {
@@ -2702,6 +2717,7 @@ Free it with \`${killCmd}\`, or start on another port: \`deepspace dev start --p
     });
     process.off("SIGINT", stop);
     process.off("SIGTERM", stop);
+    readiness.abort();
     if (!devExitSucceeded(code, stopping)) {
       throw new Refusal(`Dev server exited with code ${code}.`, "dev_server_failed", {
         extra: { port, appDir, exitCode: code }
@@ -2817,12 +2833,12 @@ var kill_default = defineDeepspaceCommand({
   }
 });
 function noTargetsMessage(opts) {
-  const { enumerated, swept, all, port } = opts;
+  const { enumerated, swept, all, port, platform = process.platform } = opts;
   const couldObserve = enumerated || all && swept;
   if (!couldObserve) {
     return {
       ok: false,
-      message: `Couldn't determine what's running on :${port}: no lsof/pgrep and /proc is unavailable, so nothing was inspected or killed. Install lsof (or procps for pgrep), or find and kill the process manually.`
+      message: platform === "win32" ? `Couldn't determine what's running on :${port}: the PowerShell port query could not be run, so nothing was inspected or killed. Either powershell.exe (or pwsh) is not on PATH, or Get-NetTCPConnection is unavailable on this Windows edition. Find the process manually with \`netstat -ano | findstr :${port}\`.` : `Couldn't determine what's running on :${port}: no lsof/pgrep and /proc is unavailable, so nothing was inspected or killed. Install lsof (or procps for pgrep), or find and kill the process manually.`
     };
   }
   return {
@@ -2917,7 +2933,7 @@ function sweepByName(names) {
   const all = /* @__PURE__ */ new Set();
   if (IS_WIN) {
     const orClauses = names.map((n) => `($_.Name -like '*${n}*') -or ($_.CommandLine -like '*${n}*')`).join(" -or ");
-    const script = `Get-CimInstance Win32_Process | Where-Object { ${orClauses} } | Select-Object -ExpandProperty ProcessId`;
+    const script = `Get-CimInstance Win32_Process | Where-Object { $_.ProcessId -ne $PID -and (${orClauses}) } | Select-Object -ExpandProperty ProcessId`;
     const r = runPowershellChecked(script);
     for (const pid of r.pids) if (pid !== process.pid) all.add(pid);
     return { pids: [...all], swept: r.ran };
@@ -2954,14 +2970,22 @@ function run(cmd) {
 function runPowershell(script) {
   return runPowershellChecked(script).pids;
 }
+var PS_SENTINEL = "__deepspace_ps_ok__";
+function withSentinel(script) {
+  return `$ErrorActionPreference='Stop'; try { ${script}; '${PS_SENTINEL}' } catch { }`;
+}
+function readPowershellPids(stdout) {
+  if (!stdout.includes(PS_SENTINEL)) return { pids: [], ran: false };
+  return { pids: parsePidLines(stdout.replace(PS_SENTINEL, "")), ran: true };
+}
 function runPowershellChecked(script) {
   const exe = pwshOrPowershell();
   try {
-    const r = spawnSync2(exe, ["-NoProfile", "-NonInteractive", "-Command", script], {
+    const r = spawnSync2(exe, ["-NoProfile", "-NonInteractive", "-Command", withSentinel(script)], {
       encoding: "utf-8"
     });
     if (r.error) return { pids: [], ran: false };
-    return { pids: r.status === 0 ? parsePidLines(r.stdout) : [], ran: r.status === 0 };
+    return readPowershellPids(r.stdout ?? "");
   } catch {
     return { pids: [], ran: false };
   }
@@ -3026,10 +3050,10 @@ function ensurePlaywright(appDir) {
 import { readFileSync as readFileSync14 } from "fs";
 
 // src/testing/accounts.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync13, writeFileSync as writeFileSync7 } from "fs";
-import { homedir as homedir3 } from "os";
-import { join as join13 } from "path";
-var TEST_ACCOUNTS_PATH = join13(homedir3(), ".deepspace", "test-accounts.json");
+import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync13, writeFileSync as writeFileSync5 } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join12 } from "path";
+var TEST_ACCOUNTS_PATH = join12(homedir2(), ".deepspace", "test-accounts.json");
 var PRODUCTION_AUTH_ORIGIN = "https://auth.deep.space";
 var STAGING_AUTH_ORIGIN = "https://auth.deepspacesites.com";
 function currentTestAccountScope(env = process.env) {
@@ -3115,8 +3139,8 @@ function validTestAccounts(value) {
   );
 }
 function saveTestAccountStore(store) {
-  mkdirSync5(join13(homedir3(), ".deepspace"), { recursive: true });
-  writeFileSync7(TEST_ACCOUNTS_PATH, JSON.stringify(store, null, 2), { mode: 384 });
+  mkdirSync5(join12(homedir2(), ".deepspace"), { recursive: true });
+  writeFileSync5(TEST_ACCOUNTS_PATH, JSON.stringify(store, null, 2), { mode: 384 });
 }
 
 // src/cli/lib/test-account-service.ts
@@ -3616,7 +3640,7 @@ var clear = defineDeepspaceCommand({
       return { data: { deleted: 0, requested: 0, failures: [] } };
     }
     if (!args.yes) {
-      if (args.json) {
+      if (!process.stdin.isTTY || args.json) {
         throw new Refusal(
           "Deleting test accounts needs confirmation. Pass --yes to confirm non-interactively.",
           "confirmation_required"
@@ -3845,15 +3869,15 @@ function describeFilesFailure(status3, body) {
 import * as p6 from "@clack/prompts";
 import { execSync as execSync2 } from "child_process";
 import { createHash as createHash2 } from "crypto";
-import { chmodSync as chmodSync2, existsSync as existsSync14, lstatSync as lstatSync2, readFileSync as readFileSync17, readdirSync as readdirSync4 } from "fs";
-import { dirname as dirname6, join as join16, resolve as resolve11 } from "path";
+import { existsSync as existsSync14, lstatSync as lstatSync2, readFileSync as readFileSync17, readdirSync as readdirSync4, unlinkSync as unlinkSync2 } from "fs";
+import { dirname as dirname7, join as join15, resolve as resolve11 } from "path";
 
 // src/documentation/deploy.ts
 import { existsSync as existsSync12, readFileSync as readFileSync15 } from "fs";
-import { join as join14 } from "path";
+import { join as join13 } from "path";
 function readDocumentationDeployManifest(appDir, clientDir) {
-  if (!existsSync12(join14(appDir, "documentation.json"))) return void 0;
-  const manifestPath = join14(clientDir, "_documentation", "manifest.json");
+  if (!existsSync12(join13(appDir, "documentation.json"))) return void 0;
+  const manifestPath = join13(clientDir, "_documentation", "manifest.json");
   if (!existsSync12(manifestPath)) {
     throw new Error(
       "documentation.json exists but the build produced no documentation manifest. Ensure vite.config.ts includes deepSpaceDocumentation() from deepspace/documentation."
@@ -3874,7 +3898,7 @@ import {
   readFileSync as readFileSync16,
   writeSync
 } from "fs";
-import { join as join15 } from "path";
+import { join as join14 } from "path";
 
 // src/shared/protocol/app-migrations.ts
 var APP_MIGRATION_ID_RE = /^[a-z0-9][a-z0-9._-]{0,127}$/;
@@ -3926,7 +3950,7 @@ var APP_MIGRATION_DEFINITIONS = SOURCE_MIGRATIONS.map(
   ({ id, description }) => ({ id, description })
 );
 function readAppliedAppMigrations(appDir) {
-  const path = join15(appDir, APP_MIGRATIONS_MANIFEST);
+  const path = join14(appDir, APP_MIGRATIONS_MANIFEST);
   if (!existsSync13(path)) return [];
   const source = readRegularFile(path);
   let parsed;
@@ -3953,7 +3977,7 @@ function planAppMigrations(appDir) {
   const edits = [];
   for (const repoPath of tracked) {
     if (!isSourcePath(repoPath, appPrefix)) continue;
-    const absolutePath = join15(repo, repoPath);
+    const absolutePath = join14(repo, repoPath);
     let stat;
     try {
       stat = lstatSync(absolutePath);
@@ -3961,7 +3985,8 @@ function planAppMigrations(appDir) {
       continue;
     }
     if (!stat.isFile() || stat.isSymbolicLink()) continue;
-    const before = readRegularFile(absolutePath);
+    const checkout = readRegularFile(absolutePath);
+    const before = normalizeEol(checkout);
     let after = before;
     for (const migration of pendingMigrations) {
       const result = migration.transform(after, repoPath);
@@ -3979,7 +4004,9 @@ function planAppMigrations(appDir) {
       }
       blockers.push(...migration.findBlockers(after, repoPath));
     }
-    if (after !== before) edits.push({ path: repoPath, before, after });
+    if (after !== before) {
+      edits.push({ path: repoPath, before: checkout, after: restoreEol(after, checkout) });
+    }
   }
   const pending = pendingMigrations.map((migration) => {
     const planned = perMigration.get(migration.id);
@@ -3987,7 +4014,7 @@ function planAppMigrations(appDir) {
   });
   if (pending.length > 0 && blockers.length === 0) {
     const manifestPath = `${appPrefix}${APP_MIGRATIONS_MANIFEST}`;
-    const absoluteManifestPath = join15(repo, manifestPath);
+    const absoluteManifestPath = join14(repo, manifestPath);
     const before = existsSync13(absoluteManifestPath) ? readRegularFile(absoluteManifestPath) : null;
     const after = `${JSON.stringify([...appliedIds, ...pending.map(({ id }) => id)], null, 2)}
 `;
@@ -4003,13 +4030,19 @@ function planAppMigrations(appDir) {
 function applyAppMigrationPlan(appDir, plan) {
   const repo = repoToplevel(appDir);
   for (const edit of plan.edits) {
-    const absolutePath = join15(repo, edit.path);
+    const absolutePath = join14(repo, edit.path);
     const current = existsSync13(absolutePath) ? readRegularFile(absolutePath) : null;
     if (current !== edit.before) {
       throw new Error(`Migration input changed after planning: ${edit.path}`);
     }
   }
-  for (const edit of plan.edits) writeRegularFile(join15(repo, edit.path), edit.before, edit.after);
+  for (const edit of plan.edits) writeRegularFile(join14(repo, edit.path), edit.before, edit.after);
+}
+function normalizeEol(source) {
+  return source.replaceAll("\r\n", "\n");
+}
+function restoreEol(source, checkout) {
+  return checkout.includes("\r\n") ? source.replaceAll("\n", "\r\n") : source;
 }
 function readRegularFile(path) {
   const before = lstatSync(path);
@@ -4161,6 +4194,7 @@ ${SECURE_JOB_ROOM_CONSTRUCTOR}`
   ]
 ];
 var HTTP_ROLE_IMPORT = `import { resolveAppRole } from 'deepspace/worker'`;
+var HTTP_ROLE_IMPORT_PATTERN = /\bimport\s*\{[^}]*\bresolveAppRole\b[^}]*\}\s*from\s*(['"])deepspace\/worker\1/;
 var HTTP_ROLE_IMPORT_SEAM = `import type { AppContext, Env } from '../../worker.js'`;
 var DEBUG_ROUTE_SEAM = `  app.all('/api/debug/*', async (c) => {
     if (c.env.ALLOW_DEBUG_ROUTES !== 'true') {
@@ -4199,8 +4233,11 @@ function secureDebugRouteOccurrences(source) {
     0
   );
 }
+function httpRoleImportOccurrences(source) {
+  return source.match(new RegExp(HTTP_ROLE_IMPORT_PATTERN.source, "g"))?.length ?? 0;
+}
 function hasSecureDebugRoute(source) {
-  return debugRouteOccurrences(source) === 1 && secureDebugRouteOccurrences(source) === 1 && occurrences(source, HTTP_ROLE_IMPORT) === 1;
+  return debugRouteOccurrences(source) === 1 && secureDebugRouteOccurrences(source) === 1 && httpRoleImportOccurrences(source) === 1;
 }
 function migrateSecureRoomBoundaries(source, file) {
   if (file.endsWith("src/server/realtime-routes.ts")) {
@@ -4243,7 +4280,7 @@ function migrateDebugRouteAuthorization(source) {
   const matchingRoutes = DEBUG_ROUTE_REPLACEMENTS.filter(
     ([before2]) => occurrences(source, before2) === 1
   );
-  if (debugRouteOccurrences(source) !== 1 || matchingRoutes.length !== 1 || occurrences(source, HTTP_ROLE_IMPORT) !== 0 || occurrences(source, HTTP_ROLE_IMPORT_SEAM) !== 1) {
+  if (debugRouteOccurrences(source) !== 1 || matchingRoutes.length !== 1 || httpRoleImportOccurrences(source) !== 0 || occurrences(source, HTTP_ROLE_IMPORT_SEAM) !== 1) {
     return { source, replacements: 0 };
   }
   const [before, after] = matchingRoutes[0];
@@ -4357,7 +4394,9 @@ function findWorkerOwnedNotFoundBlockers(source, file) {
   const blockers = [];
   const lines = source.split("\n");
   for (const [index, line] of lines.entries()) {
-    if (!/['"`]\/index\.html/.test(line)) continue;
+    if (!/(?:\burl\.pathname\s*=\s*|\bnew\s+URL\s*\(\s*)['"`]\/index\.html/.test(line)) {
+      continue;
+    }
     blockers.push({
       migrationId: WORKER_OWNED_NOT_FOUND_MIGRATION_ID,
       file,
@@ -4370,14 +4409,14 @@ function findWorkerOwnedNotFoundBlockers(source, file) {
 
 // src/cli/commands/deploy/build.ts
 var RESERVED_RUN_WORKER_FIRST2 = new Set(RESERVED_RUN_WORKER_FIRST);
-function secureBuildDevVars(workerDir) {
-  const path = join16(workerDir, ".dev.vars");
+function removeBuildDevVars(workerDir) {
+  const path = join15(workerDir, ".dev.vars");
   if (!existsSync14(path)) return false;
   const stat = lstatSync2(path);
   if (!stat.isFile() || stat.isSymbolicLink()) {
     throw new Error(`Refusing unsafe build secret path: ${path}`);
   }
-  chmodSync2(path, 384);
+  unlinkSync2(path);
   return true;
 }
 function declaredCompatibilityDate(config) {
@@ -4415,7 +4454,7 @@ async function buildDeployBundle(options) {
     preparedWranglerConfig?.cleanup();
   }
   spinner2.stop("Built");
-  const deployConfigPath = join16(appDir, ".wrangler", "deploy", "config.json");
+  const deployConfigPath = join15(appDir, ".wrangler", "deploy", "config.json");
   if (!existsSync14(deployConfigPath)) {
     output.die(
       "Build output config not found at .wrangler/deploy/config.json",
@@ -4423,7 +4462,7 @@ async function buildDeployBundle(options) {
     );
   }
   const deployConfig = JSON.parse(readFileSync17(deployConfigPath, "utf-8"));
-  const outputWranglerPath = resolve11(dirname6(deployConfigPath), deployConfig.configPath);
+  const outputWranglerPath = resolve11(dirname7(deployConfigPath), deployConfig.configPath);
   if (!existsSync14(outputWranglerPath)) {
     output.die(`Output wrangler.json not found at ${outputWranglerPath}`, "build_output_missing");
   }
@@ -4435,13 +4474,13 @@ async function buildDeployBundle(options) {
       "build_output_mismatch"
     );
   }
-  const workerDir = dirname6(outputWranglerPath);
+  const workerDir = dirname7(outputWranglerPath);
   try {
-    secureBuildDevVars(workerDir);
+    removeBuildDevVars(workerDir);
   } catch (error) {
     output.die(errorMessage(error), "build_output_unsafe");
   }
-  const workerBundlePath = join16(workerDir, outputConfig.main);
+  const workerBundlePath = join15(workerDir, outputConfig.main);
   const clientDir = outputConfig.assets?.directory ? resolve11(workerDir, outputConfig.assets.directory) : null;
   if (!existsSync14(workerBundlePath)) {
     output.die(`Worker bundle not found at ${workerBundlePath}`, "build_output_missing");
@@ -4533,7 +4572,7 @@ function collectAssets(dir) {
   const walk = (currentDir, prefix) => {
     for (const entry of readdirSync4(currentDir, { withFileTypes: true })) {
       if (isDeployAssetControlFile(entry.name)) continue;
-      const fullPath = join16(currentDir, entry.name);
+      const fullPath = join15(currentDir, entry.name);
       const relativePath = prefix ? `${prefix}/${entry.name}` : entry.name;
       if (entry.isDirectory()) {
         walk(fullPath, relativePath);
@@ -4557,7 +4596,7 @@ function readDeployAssetConfig(clientDir) {
     ["_headers", "_headers"],
     ["_redirects", "_redirects"]
   ]) {
-    const filePath = join16(clientDir, file);
+    const filePath = join15(clientDir, file);
     if (!existsSync14(filePath)) continue;
     const content = readFileSync17(filePath, "utf8");
     if (content.trim()) config[key] = content;
@@ -4574,17 +4613,17 @@ function errorMessage(error) {
 // src/cli/commands/deploy/commerce.ts
 import * as p7 from "@clack/prompts";
 import { existsSync as existsSync15 } from "fs";
-import { join as join17 } from "path";
+import { join as join16 } from "path";
 import { pathToFileURL as pathToFileURL2 } from "url";
 var API_URL2 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
 function errorMessage2(error) {
   return error instanceof Error ? error.message : String(error);
 }
 async function loadDeclaration(appDir, sourceFile, outputFile, exportName) {
-  const sourcePath = join17(appDir, "src", sourceFile);
+  const sourcePath = join16(appDir, "src", sourceFile);
   if (!existsSync15(sourcePath)) return void 0;
   const esbuild = await import("esbuild");
-  const outputPath = join17(appDir, ".wrangler", "deploy", outputFile);
+  const outputPath = join16(appDir, ".wrangler", "deploy", outputFile);
   await esbuild.build({
     entryPoints: [sourcePath],
     bundle: true,
@@ -4677,7 +4716,7 @@ Stripe will keep charging them until you cancel. Cancel at the end of their curr
   }
 }
 async function syncSubscriptionPlans(appDir, appName, token, nonInteractive) {
-  if (!existsSync15(join17(appDir, "src", "subscriptions.ts"))) return;
+  if (!existsSync15(join16(appDir, "src", "subscriptions.ts"))) return;
   let plans;
   try {
     plans = await loadDeclaration(
@@ -4732,7 +4771,7 @@ async function syncSubscriptionPlans(appDir, appName, token, nonInteractive) {
   }
 }
 async function syncOneTimeProducts(appDir, appName, token) {
-  if (!existsSync15(join17(appDir, "src", "products.ts"))) return;
+  if (!existsSync15(join16(appDir, "src", "products.ts"))) return;
   let products;
   try {
     products = await loadDeclaration(
@@ -4827,7 +4866,7 @@ function createDeployOutput(json) {
         else console.error(withSlug(message, code));
         if (action) printAction(action);
       }
-      process.exit(opts.actionRequired ? 2 : 1);
+      throw new CliExit(opts.actionRequired ? 2 : 1);
     }
   };
 }
@@ -5556,6 +5595,7 @@ async function syncDeployRepository(options) {
       sourceRevision = claimed.revision;
     }
   } catch (error) {
+    if (error instanceof CliExit) throw error;
     const failure = deployRepositoryFailure(error, appDir);
     output.die(failure.error, failure.code);
   }
@@ -5672,7 +5712,7 @@ async function deployBuiltBundle(options) {
         ...action ? { action } : {}
       });
     }
-    process.exit(actionRequired ? 2 : 1);
+    throw new CliExit(actionRequired ? 2 : 1);
   };
   const makeForm = () => {
     const form = new FormData();
@@ -6583,6 +6623,7 @@ var apps_default = defineDeepspaceCommand({
 
 // src/cli/commands/logs.ts
 import { defineCommand as defineCommand4 } from "citty";
+import { setTimeout as delay } from "timers/promises";
 
 // src/shared/log-events.ts
 var LOG_LEVELS = ["debug", "log", "info", "warn", "error"];
@@ -6693,7 +6734,7 @@ function formatEvent(e, color, now = Date.now()) {
   const client = e.source === "client" ? paint("35", "CLIENT", color) + " " : "";
   return `${time} ${client}${tag} ${body}`;
 }
-var sleep3 = (ms) => new Promise((r) => setTimeout(r, ms));
+var sleep3 = (ms, signal) => delay(ms, void 0, { signal });
 var logs_default = defineCommand4({
   meta: {
     name: "logs",
@@ -6769,12 +6810,17 @@ var logs_default = defineCommand4({
     const windowLabel = args.since?.trim() || "15m";
     const MAX_LIMIT = 500;
     const followLimit = followInitialLimit(limit, MAX_LIMIT);
-    const fetchPage = async (since, pageLimit, token2) => {
+    const fetchPage = async (since, pageLimit, token2, signal) => {
       const params = new URLSearchParams({ since: String(since) });
       if (pageLimit !== void 0) params.set("limit", String(pageLimit));
       if (args.level) params.set("level", args.level);
       if (args.search) params.set("search", args.search);
-      return apiFetch(DEPLOY_URL6, token2, `/api/apps/${appId}/logs?${params}`);
+      return apiFetch(
+        DEPLOY_URL6,
+        token2,
+        `/api/apps/${appId}/logs?${params}`,
+        signal ? { signal } : void 0
+      );
     };
     const print = (events) => {
       for (const e of events) {
@@ -6810,7 +6856,8 @@ var logs_default = defineCommand4({
       }
       return;
     }
-    process.on("SIGINT", () => process.exit(0));
+    const tail = new AbortController();
+    process.once("SIGINT", () => tail.abort());
     if (!args.json) {
       console.error(`Tailing logs for ${appId} \u2014 Ctrl+C to stop.`);
     }
@@ -6835,12 +6882,23 @@ var logs_default = defineCommand4({
       }
     }
     for (; ; ) {
-      await sleep3(backoff || interval);
+      try {
+        await sleep3(backoff || interval, tail.signal);
+      } catch {
+        return;
+      }
       const freshToken = await ensureToken();
+      if (tail.signal.aborted) return;
       let page;
       try {
-        page = await fetchPage(nextPollSince(cursor, initialSince), followLimit, freshToken);
+        page = await fetchPage(
+          nextPollSince(cursor, initialSince),
+          followLimit,
+          freshToken,
+          tail.signal
+        );
       } catch (err) {
+        if (tail.signal.aborted) return;
         if (err instanceof ApiError && [401, 403, 404].includes(err.status)) throw err;
         backoff = Math.min(backoff ? backoff * 2 : MIN_POLL_MS, 3e4);
         const msg = err instanceof Error ? err.message : String(err);
@@ -6946,7 +7004,7 @@ var usage_default = defineDeepspaceCommand({
 
 // src/cli/commands/add.ts
 import { existsSync as existsSync18, readFileSync as readFileSync20, realpathSync as realpathSync4 } from "fs";
-import { dirname as dirname8, join as join19, resolve as resolve15 } from "path";
+import { dirname as dirname9, join as join18, resolve as resolve15 } from "path";
 import { pathToFileURL as pathToFileURL3 } from "url";
 
 // src/cli/commands/feature-installer.ts
@@ -6962,17 +7020,17 @@ import {
   readSync,
   readdirSync as readdirSync5,
   rmSync as rmSync4,
-  writeFileSync as writeFileSync8
+  writeFileSync as writeFileSync6
 } from "fs";
 import { spawnSync as spawnSync6 } from "child_process";
 import { tmpdir as tmpdir2 } from "os";
-import { dirname as dirname7, isAbsolute as isAbsolute4, join as join18, resolve as resolve14 } from "path";
+import { dirname as dirname8, isAbsolute as isAbsolute4, join as join17, resolve as resolve14 } from "path";
 import { fileURLToPath } from "url";
 var NAV_MARKER = "// \u2500\u2500 Features add nav items below this line \u2500\u2500";
 function featurePackageRoot(moduleUrl = import.meta.url) {
-  let dir = dirname7(fileURLToPath(moduleUrl));
+  let dir = dirname8(fileURLToPath(moduleUrl));
   for (; ; ) {
-    const packagePath = join18(dir, "package.json");
+    const packagePath = join17(dir, "package.json");
     if (existsSync17(packagePath)) {
       try {
         const pkg2 = JSON.parse(readFileSync19(packagePath, "utf-8"));
@@ -6980,16 +7038,16 @@ function featurePackageRoot(moduleUrl = import.meta.url) {
       } catch {
       }
     }
-    const parent = dirname7(dir);
+    const parent = dirname8(dir);
     if (parent === dir) throw new Error("Could not locate the deepspace package root");
     dir = parent;
   }
 }
 function hasFeatureCatalog(packageRoot = featurePackageRoot()) {
-  return existsSync17(join18(packageRoot, "features"));
+  return existsSync17(join17(packageRoot, "features"));
 }
 function readFeatureConfig(id, packageRoot = featurePackageRoot()) {
-  const configPath = join18(packageRoot, "features", id, "feature.json");
+  const configPath = join17(packageRoot, "features", id, "feature.json");
   if (!existsSync17(configPath)) return null;
   try {
     const config = JSON.parse(readFileSync19(configPath, "utf-8"));
@@ -7002,7 +7060,7 @@ function readFeatureConfig(id, packageRoot = featurePackageRoot()) {
   }
 }
 function listFeatureConfigs(packageRoot = featurePackageRoot()) {
-  const featuresDir = join18(packageRoot, "features");
+  const featuresDir = join17(packageRoot, "features");
   if (!existsSync17(featuresDir)) return [];
   return readdirSync5(featuresDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => readFeatureConfig(entry.name, packageRoot)).filter((config) => config !== null && !config.internal).sort((a, b) => a.id.localeCompare(b.id));
 }
@@ -7051,17 +7109,17 @@ function resolveFeatureDestPath(fileDest, route) {
   return route?.protected === false ? `${appPages}${rest}` : `${appPages}(protected)/${rest}`;
 }
 function copyFile(src, dest) {
-  mkdirSync6(dirname7(dest), { recursive: true });
+  mkdirSync6(dirname8(dest), { recursive: true });
   copyFileSync(src, dest);
 }
 function copyFileWithImportShift(src, dest, levels) {
-  mkdirSync6(dirname7(dest), { recursive: true });
+  mkdirSync6(dirname8(dest), { recursive: true });
   const prefix = "../".repeat(levels);
   const shifted = readFileSync19(src, "utf-8").replace(
     /(from\s+|import\s+|import\()(['"])(\.\.\/)/g,
     `$1$2${prefix}$3`
   );
-  writeFileSync8(dest, shifted);
+  writeFileSync6(dest, shifted);
 }
 function installFiles(packageRoot, config, targetDir, emit) {
   let copied = 0;
@@ -7070,9 +7128,9 @@ function installFiles(packageRoot, config, targetDir, emit) {
   const preexisting = [];
   const missing = [];
   for (const file of config.files) {
-    const srcPath = join18(packageRoot, "features", config.id, file.src);
+    const srcPath = join17(packageRoot, "features", config.id, file.src);
     const resolvedDest = resolveFeatureDestPath(file.dest, config.route);
-    const destPath = join18(targetDir, resolvedDest);
+    const destPath = join17(targetDir, resolvedDest);
     const existed = existsSync17(destPath);
     if (existed) preexisting.push(resolvedDest);
     if (!existsSync17(srcPath)) {
@@ -7112,7 +7170,7 @@ function unresolvedSchema(schema, reason, emit) {
 }
 function integrateSchema(config, targetDir, emit) {
   if (!config.schema) return [];
-  const schemasPath = join18(targetDir, "src", "schemas.ts");
+  const schemasPath = join17(targetDir, "src", "schemas.ts");
   if (!existsSync17(schemasPath)) {
     return [unresolvedSchema(config.schema, "src/schemas.ts was not found.", emit)];
   }
@@ -7147,7 +7205,7 @@ export const schemas`
     return [unresolvedSchema(config.schema, reason, emit)];
   }
   content = withEntry;
-  writeFileSync8(schemasPath, content);
+  writeFileSync6(schemasPath, content);
   emit(`   Schema integrated: ${exportName} -> schemas.ts`);
   return [];
 }
@@ -7169,7 +7227,7 @@ function unresolvedActions(actions, reason, emit) {
 }
 function integrateActions(config, targetDir, emit) {
   if (!config.actions?.length) return [];
-  const actionsPath = join18(targetDir, "src", "actions", "index.ts");
+  const actionsPath = join17(targetDir, "src", "actions", "index.ts");
   if (!existsSync17(actionsPath)) {
     return [unresolvedActions(config.actions, "src/actions/index.ts was not found.", emit)];
   }
@@ -7213,13 +7271,13 @@ ${registryEntry}`);
     integrated++;
     emit(`   Action integrated: ${action.registerAs} (${action.exportName})`);
   }
-  if (integrated > 0) writeFileSync8(actionsPath, content);
+  if (integrated > 0) writeFileSync6(actionsPath, content);
   return unresolved;
 }
 function integrateCode(config, targetDir, emit) {
   const unresolved = [];
   for (const insertion of config.code ?? []) {
-    const targetPath = join18(targetDir, insertion.file);
+    const targetPath = join17(targetDir, insertion.file);
     if (!existsSync17(targetPath)) {
       unresolved.push({
         area: "code",
@@ -7249,34 +7307,36 @@ function integrateCode(config, targetDir, emit) {
     if (insertion.import && !content.includes(insertion.import)) {
       const importIndex = content.search(/^import\s/m);
       content = `${content.slice(0, importIndex < 0 ? 0 : importIndex)}${insertion.import}
-${content.slice(importIndex < 0 ? 0 : importIndex)}`;
+${content.slice(
+        importIndex < 0 ? 0 : importIndex
+      )}`;
     }
     const currentMarkerIndex = content.indexOf(insertion.marker);
     const insertAt = insertion.placement === "before" ? currentMarkerIndex : currentMarkerIndex + insertion.marker.length;
     const prefix = insertion.placement === "before" ? "" : "\n";
     const suffix = insertion.placement === "before" ? "\n" : "";
     content = `${content.slice(0, insertAt)}${prefix}${insertion.insert}${suffix}${content.slice(insertAt)}`;
-    writeFileSync8(targetPath, content);
+    writeFileSync6(targetPath, content);
     emit(`   Integrated: ${insertion.file}`);
   }
   return unresolved;
 }
 function integrateIgnore(config, targetDir) {
   if (!config.ignore?.length) return;
-  const targetPath = join18(targetDir, ".gitignore");
+  const targetPath = join17(targetDir, ".gitignore");
   const current = existsSync17(targetPath) ? readFileSync19(targetPath, "utf-8") : "";
   const present = new Set(current.split(/\r?\n/).map((line) => line.trim()));
   const missing = config.ignore.filter((pattern) => !present.has(pattern));
   if (missing.length === 0) return;
   const separator = current === "" || current.endsWith("\n") ? "" : "\n";
-  writeFileSync8(targetPath, `${current}${separator}${missing.join("\n")}
+  writeFileSync6(targetPath, `${current}${separator}${missing.join("\n")}
 `);
 }
 function integrateWrangler(config, targetDir, emit) {
   const runWorkerFirst = config.wrangler?.runWorkerFirst === true;
   const rateLimits = config.wrangler?.rateLimits ?? [];
   if (!runWorkerFirst && rateLimits.length === 0) return [];
-  const targetPath = join18(targetDir, "wrangler.toml");
+  const targetPath = join17(targetDir, "wrangler.toml");
   const steps = [
     ...runWorkerFirst ? ["Set assets.run_worker_first = true in wrangler.toml."] : [],
     ...rateLimits.map((binding) => `Add the ${binding.name} rate-limit binding to wrangler.toml.`)
@@ -7306,7 +7366,7 @@ ${rateLimitBindingBlock(scope, binding)}
     }
   }
   if (changed) {
-    writeFileSync8(targetPath, source);
+    writeFileSync6(targetPath, source);
     emit("   Integrated: wrangler.toml");
   } else emit("   Integration already present: wrangler.toml");
   return [];
@@ -7360,7 +7420,7 @@ function rateLimitBindingBlock(scope, binding) {
 }
 function integrateCss(packageRoot, config, targetDir, emit) {
   if (!config.css?.length) return [];
-  const stylesPath = join18(targetDir, "src", "styles.css");
+  const stylesPath = join17(targetDir, "src", "styles.css");
   if (!existsSync17(stylesPath)) {
     emit("   Warning: Cannot integrate CSS \u2014 src/styles.css not found");
     return [
@@ -7377,7 +7437,7 @@ function integrateCss(packageRoot, config, targetDir, emit) {
   let integrated = 0;
   const unresolved = [];
   for (const cssFile of config.css) {
-    const srcPath = join18(packageRoot, "features", config.id, cssFile);
+    const srcPath = join17(packageRoot, "features", config.id, cssFile);
     if (!existsSync17(srcPath)) {
       emit(`   Warning: CSS source not found: ${cssFile}`, "stderr");
       unresolved.push({
@@ -7399,22 +7459,29 @@ ${css}`;
     integrated++;
     emit(`   CSS integrated: ${cssFile} -> styles.css`);
   }
-  if (integrated > 0) writeFileSync8(stylesPath, styles);
+  if (integrated > 0) writeFileSync6(stylesPath, styles);
   return unresolved;
 }
 function unresolvedRoute(route, config, reason, emit) {
+  const roles = routeRolesSuffix(route);
   emit("");
   emit("   Add manually to src/nav.ts:");
-  emit(`     { path: '${route.path}', label: '${config.name}' },`);
+  emit(`     { path: '${route.path}', label: '${config.name}'${roles} },`);
   return {
     area: "nav",
     reason,
-    steps: [`Add { path: '${route.path}', label: '${config.name}' } to the exported nav array.`]
+    steps: [
+      `Add { path: '${route.path}', label: '${config.name}'${roles} } to the exported nav array.`
+    ]
   };
 }
+function routeRolesSuffix(route) {
+  const roles = route.roles?.length ? route.roles : route.protected === false ? [] : ["member"];
+  return roles.length ? `, roles: [${roles.map((role) => `'${role}' as Role`).join(", ")}]` : "";
+}
 function integrateRoute(config, targetDir, emit) {
   if (!config.route) return [];
-  const navPath = join18(targetDir, "src", "nav.ts");
+  const navPath = join17(targetDir, "src", "nav.ts");
   if (!existsSync17(navPath)) {
     return [unresolvedRoute(config.route, config, "src/nav.ts was not found.", emit)];
   }
@@ -7435,11 +7502,11 @@ function integrateRoute(config, targetDir, emit) {
       )
     ];
   }
-  const roles = config.route.protected === false ? "" : ", roles: ['member' as Role]";
+  const roles = routeRolesSuffix(config.route);
   const entry = `  { path: '${routePath}', label: '${config.name}'${roles} },`;
   content = content.replace(NAV_MARKER, `${NAV_MARKER}
 ${entry}`);
-  writeFileSync8(navPath, content);
+  writeFileSync6(navPath, content);
   emit(`   Nav wired: ${routePath} (${config.name})`);
   emit("   Route: automatic (file-based routing via src/pages/)");
   return [];
@@ -7465,10 +7532,10 @@ function runPackageInstall(packageManager, targetDir, outputVisible) {
     const child = spawnSync6(packageManager, ["install"], { ...options, stdio: "inherit" });
     return { error: child.error, status: child.status };
   }
-  const captureDir = mkdtempSync(join18(tmpdir2(), "deepspace-add-install-"));
+  const captureDir = mkdtempSync(join17(tmpdir2(), "deepspace-add-install-"));
   let outputFd;
   try {
-    outputFd = openSync2(join18(captureDir, "output.log"), "w+");
+    outputFd = openSync2(join17(captureDir, "output.log"), "w+");
     const child = spawnSync6(packageManager, ["install"], {
       ...options,
       stdio: ["ignore", outputFd, outputFd]
@@ -7492,7 +7559,7 @@ function integrateDependencies(config, targetDir, runInstall, outputVisible, emi
   if (declarations.every(({ values }) => !values || Object.keys(values).length === 0)) {
     return { added: [], installRan: false, packageManager };
   }
-  const packagePath = join18(targetDir, "package.json");
+  const packagePath = join17(targetDir, "package.json");
   if (!existsSync17(packagePath)) {
     emit("   Could not patch package.json (file not found)");
     return { added: [], installRan: false, packageManager };
@@ -7523,7 +7590,7 @@ function integrateDependencies(config, targetDir, runInstall, outputVisible, emi
   if (added.length === 0) {
     emit("   Dependencies already present");
   } else {
-    writeFileSync8(packagePath, `${JSON.stringify(pkg2, null, 2)}
+    writeFileSync6(packagePath, `${JSON.stringify(pkg2, null, 2)}
 `, "utf-8");
     emit(`   Added to package.json: ${added.map(({ name }) => name).join(", ")}`);
     if (skipped.length) emit(`   Already present (kept your version): ${skipped.join(", ")}`);
@@ -7559,7 +7626,7 @@ ${child.diagnosticTail}` : "";
 }
 function dependencySnapshot(targetDir) {
   try {
-    const pkg2 = JSON.parse(readFileSync19(join18(targetDir, "package.json"), "utf-8"));
+    const pkg2 = JSON.parse(readFileSync19(join17(targetDir, "package.json"), "utf-8"));
     return {
       dependencies: pkg2.dependencies ?? {},
       devDependencies: pkg2.devDependencies ?? {}
@@ -7571,7 +7638,7 @@ function dependencySnapshot(targetDir) {
 function installedNavFeatures(packageRoot, targetDir) {
   return listFeatureConfigs(packageRoot).filter((feature) => feature.category === "nav" && feature.files.length > 0).filter((feature) => {
     const signature = resolveFeatureDestPath(feature.files[0].dest, feature.route);
-    return existsSync17(join18(targetDir, signature));
+    return existsSync17(join17(targetDir, signature));
   }).map((feature) => feature.id);
 }
 function warnNavConflicts(packageRoot, config, targetDir, emit) {
@@ -7631,7 +7698,7 @@ function installFeature(options) {
   );
   if (config.instructions?.length) {
     emit("");
-    emit("--- Manual wiring needed ---");
+    emit("--- Next steps ---");
     emit("");
     config.instructions.forEach((instruction, index) => {
       emit(`${index + 1}. ${instruction}`);
@@ -7804,8 +7871,8 @@ function renderFeatureInfo(config) {
   return lines.join("\n");
 }
 function isDeepSpaceApp(dir) {
-  if (existsSync18(join19(dir, "wrangler.toml"))) return true;
-  const packagePath = join19(dir, "package.json");
+  if (existsSync18(join18(dir, "wrangler.toml"))) return true;
+  const packagePath = join18(dir, "package.json");
   if (!existsSync18(packagePath)) return false;
   try {
     const pkg2 = JSON.parse(readFileSync20(packagePath, "utf-8"));
@@ -7817,9 +7884,9 @@ function isDeepSpaceApp(dir) {
 function installedPackageRoot(fromDir) {
   let dir = fromDir;
   for (; ; ) {
-    const candidate = join19(dir, "node_modules", "deepspace");
-    if (existsSync18(join19(candidate, "package.json"))) return candidate;
-    const parent = dirname8(dir);
+    const candidate = join18(dir, "node_modules", "deepspace");
+    if (existsSync18(join18(candidate, "package.json"))) return candidate;
+    const parent = dirname9(dir);
     if (parent === dir) return null;
     dir = parent;
   }
@@ -7835,8 +7902,8 @@ async function targetInstaller(appDir) {
   if (realpathSync4(installedRoot) === realpathSync4(featurePackageRoot())) {
     return { installFeature };
   }
-  const entry = join19(installedRoot, "dist", "feature-installer.js");
-  const catalog = join19(installedRoot, "features");
+  const entry = join18(installedRoot, "dist", "feature-installer.js");
+  const catalog = join18(installedRoot, "features");
   if (!existsSync18(entry) || !existsSync18(catalog)) {
     throw new Refusal(
       `The app's installed deepspace package does not contain the typed feature installer.
@@ -7974,6 +8041,7 @@ Create one with: deepspace app create <name>`,
     }
     if (!outcome.ok) {
       throw new Refusal(outcome.error, outcome.code, {
+        actionRequired: outcome.code === "manual_integration_required",
         ..."data" in outcome ? { extra: outcome.data } : {}
       });
     }
@@ -8011,13 +8079,12 @@ function fmtDate(iso) {
 }
 async function confirm4(message) {
   process.stdout.write(`${message} [y/N] `);
-  return new Promise((resolve21) => {
+  const answer = await new Promise((resolve21) => {
     process.stdin.setEncoding("utf-8");
-    process.stdin.once("data", (data) => {
-      const answer = data.toString().trim().toLowerCase();
-      resolve21(answer === "y" || answer === "yes");
-    });
+    process.stdin.once("data", (data) => resolve21(data.toString().trim().toLowerCase()));
   });
+  process.stdin.pause();
+  return answer === "y" || answer === "yes";
 }
 var cannotPrompt = (json) => json || !process.stdin.isTTY;
 var search = defineDeepspaceCommand({
@@ -9368,7 +9435,7 @@ var integrations_default = defineCommand9({
 // src/cli/commands/feedback.ts
 import * as p16 from "@clack/prompts";
 import { existsSync as existsSync20, readFileSync as readFileSync22 } from "fs";
-import { dirname as dirname9, join as join20 } from "path";
+import { dirname as dirname10, join as join19 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { release } from "os";
 var API_URL8 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
@@ -9389,10 +9456,10 @@ function normalizeType(raw) {
 }
 function readCliVersion() {
   try {
-    const here = dirname9(fileURLToPath2(import.meta.url));
+    const here = dirname10(fileURLToPath2(import.meta.url));
     const candidates = [
-      join20(here, "..", "package.json"),
-      join20(here, "..", "..", "..", "package.json")
+      join19(here, "..", "package.json"),
+      join19(here, "..", "..", "..", "package.json")
     ];
     for (const path of candidates) {
       if (!existsSync20(path)) continue;
@@ -9793,7 +9860,7 @@ var get2 = defineCommand10({
       const { secrets } = await listSecrets(DEPLOY_URL11, t.token, t.appId, t.configName);
       const item = secrets.find((s) => s.key === key);
       if (!item)
-        fail(new InputError(`Secret "${key}" not found in ${t.configName}`, "secret_not_found"));
+        throw new InputError(`Secret "${key}" not found in ${t.configName}`, "secret_not_found");
       ok(
         args.json === true,
         {
@@ -9865,7 +9932,7 @@ var upload = defineCommand10({
       const content = args.file === "-" ? readFileSync23(0, "utf-8") : readFileSync23(args.file, "utf-8");
       const secrets = parseSecretsUpload(content);
       if (Object.keys(secrets).length === 0)
-        fail(new InputError("No secrets found in the input.", "empty_input"));
+        throw new InputError("No secrets found in the input.", "empty_input");
       await uploadSecrets(DEPLOY_URL11, t.token, t.appId, t.configName, secrets, args.replace);
       const uploaded = Object.keys(secrets);
       ok(
@@ -9896,11 +9963,9 @@ var download = defineCommand10({
       const t = await resolveTarget(args);
       const format = args.format;
       if (!["dotenv", "json", "shell"].includes(format)) {
-        fail(
-          new InputError(
-            `Unknown format "${args.format}" \u2014 use dotenv, json, or shell.`,
-            "invalid_format"
-          )
+        throw new InputError(
+          `Unknown format "${args.format}" \u2014 use dotenv, json, or shell.`,
+          "invalid_format"
         );
       }
       const { secrets } = await fetchSecretsValues(DEPLOY_URL11, t.token, t.appId, t.configName);
@@ -9918,11 +9983,9 @@ var pull = defineCommand10({
       const wranglerEnv = args.env?.trim() || void 0;
       const appDir = findAppDir();
       if (!appDir)
-        fail(
-          new InputError(
-            "Run from a DeepSpace app directory (one containing wrangler.toml).",
-            "not_in_app_repo"
-          )
+        throw new InputError(
+          "Run from a DeepSpace app directory (one containing wrangler.toml).",
+          "not_in_app_repo"
         );
       const t = await resolveTarget(args);
       const ownerId = decodeJwtPayload(t.token).sub;
@@ -9986,11 +10049,9 @@ var configsCreate = defineCommand10({
       const { configs: configs2 } = await listConfigs(DEPLOY_URL11, t.token, t.appId);
       if (configs2.some((c) => c.name === name)) {
         if (copyFrom) {
-          fail(
-            new InputError(
-              `Config "${name}" already exists \u2014 refusing to copy "${copyFrom}" over it. Delete it first, or pick a new name.`,
-              "config_exists"
-            )
+          throw new InputError(
+            `Config "${name}" already exists \u2014 refusing to copy "${copyFrom}" over it. Delete it first, or pick a new name.`,
+            "config_exists"
           );
         }
         ok(
@@ -10890,7 +10951,7 @@ var pull_default = defineDeepspaceCommand({
 // src/cli/commands/clone.ts
 import * as p20 from "@clack/prompts";
 import { existsSync as existsSync22, readdirSync as readdirSync6, rmSync as rmSync5 } from "fs";
-import { resolve as resolve17, basename as basename5, join as join21 } from "path";
+import { resolve as resolve17, basename as basename5, join as join20 } from "path";
 function cleanFailedCloneDir(dir) {
   let entries;
   try {
@@ -10900,7 +10961,7 @@ function cleanFailedCloneDir(dir) {
   }
   if (entries.length === 1 && entries[0] === ".git") {
     try {
-      rmSync5(join21(dir, ".git"), { recursive: true, force: true });
+      rmSync5(join20(dir, ".git"), { recursive: true, force: true });
       return [];
     } catch {
       return entries;
@@ -11385,8 +11446,16 @@ function printOverlaps(overlaps, json) {
 
 // src/cli/commands/workspace/local.ts
 import * as p24 from "@clack/prompts";
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync25, realpathSync as realpathSync6, renameSync as renameSync2, statSync as statSync3, writeFileSync as writeFileSync9 } from "fs";
-import { dirname as dirname10, isAbsolute as isAbsolute5, join as join22, relative as relative2, sep as sep2 } from "path";
+import {
+  existsSync as existsSync23,
+  mkdirSync as mkdirSync7,
+  readFileSync as readFileSync25,
+  realpathSync as realpathSync6,
+  renameSync as renameSync2,
+  statSync as statSync3,
+  writeFileSync as writeFileSync7
+} from "fs";
+import { dirname as dirname11, isAbsolute as isAbsolute5, join as join21, relative as relative2, sep as sep2 } from "path";
 var WORKSPACE_MARKER = "deepspace-workspace.json";
 function excludeWorktreeDir(appDir, dir) {
   try {
@@ -11407,7 +11476,7 @@ function worktreeMarkerPath(worktreeRoot) {
     const result = runGit(worktreeRoot, ["rev-parse", "--absolute-git-dir"], { allowFail: true });
     if (result.status !== 0) return null;
     const gitDir = result.stdout.toString("utf-8").trim();
-    return isAbsolute5(gitDir) ? join22(gitDir, WORKSPACE_MARKER) : null;
+    return isAbsolute5(gitDir) ? join21(gitDir, WORKSPACE_MARKER) : null;
   } catch {
     return null;
   }
@@ -11418,8 +11487,8 @@ function markManagedWorkspace(worktreeRoot, workspaceId) {
   const marker = { version: 1, workspaceId, mode: "managed-linked" };
   const tempPath = `${markerPath}.${process.pid}.tmp`;
   try {
-    mkdirSync7(dirname10(markerPath), { recursive: true });
-    writeFileSync9(tempPath, JSON.stringify(marker) + "\n");
+    mkdirSync7(dirname11(markerPath), { recursive: true });
+    writeFileSync7(tempPath, JSON.stringify(marker) + "\n");
     renameSync2(tempPath, markerPath);
     return true;
   } catch {
@@ -11452,11 +11521,11 @@ function isManagedWorkspaceWorktree(worktreeRoot, workspaceId) {
 function defaultWorkspaceRoot(appDir, workspaceId) {
   const primary = listWorktrees(appDir)[0];
   if (!primary) throw new Error("Git did not report a primary worktree");
-  return join22(primary.path, ".deepspace", "ws", workspaceId.slice(3).toLowerCase());
+  return join21(primary.path, ".deepspace", "ws", workspaceId.slice(3).toLowerCase());
 }
 function appDirInWorktree(appDir, worktreeRoot) {
   const appRelative = relative2(realpathSync6(repoToplevel(appDir)), realpathSync6(appDir));
-  return appRelative ? join22(worktreeRoot, appRelative) : worktreeRoot;
+  return appRelative ? join21(worktreeRoot, appRelative) : worktreeRoot;
 }
 function primaryAppDir(appDir) {
   const primary = listWorktrees(appDir)[0];
@@ -11491,7 +11560,7 @@ function rematerializeWorkspaceWorktree(appDir, worktreeRoot, branch, workspaceI
 function inOwnLinkedWorktree(appDir, id) {
   if (workspaceIdFromBranch(currentBranch(appDir)) !== id) return false;
   try {
-    return statSync3(join22(repoToplevel(appDir), ".git")).isFile();
+    return statSync3(join21(repoToplevel(appDir), ".git")).isFile();
   } catch {
     return false;
   }
@@ -11532,6 +11601,7 @@ function cleanupJson(outcome) {
     worktreeRetained: outcome.worktreeRetained,
     branchDeleted: outcome.branchDeleted,
     ...outcome.mainDir ? { mainDir: outcome.mainDir } : {},
+    ...outcome.leftoverDir ? { leftoverDir: outcome.leftoverDir } : {},
     ...outcome.error ? { error: outcome.error } : {}
   };
 }
@@ -11606,7 +11676,23 @@ function cleanupWorkspaceLocal(appDir, id, trunkBranch, options = {}) {
       }
       const remove2 = runGit(mainDir, ["worktree", "remove", linked.path], { allowFail: true });
       if (remove2.status !== 0) {
-        out.error = `git worktree remove ${linked.path} failed: ${remove2.stderr.toString("utf-8").trim() || "unknown git error"}`;
+        const reason = remove2.stderr.toString("utf-8").trim() || "unknown git error";
+        const registered = listWorktrees(mainDir);
+        const stillRegistered = registered.length === 0 || registered.some((worktree, index) => index > 0 && worktree.path === linked.path);
+        if (stillRegistered) {
+          out.error = `git worktree remove ${linked.path} failed: ${reason}`;
+          return out;
+        }
+        runGit(mainDir, ["worktree", "prune"], { allowFail: true });
+        out.worktreeDir = null;
+        const leftover = existsSync23(linked.path);
+        if (leftover) out.leftoverDir = linked.path;
+        else out.worktreeRemoved = linked.path;
+        deleteWsBranch(mainDir, branch, expectedBranchOid, out);
+        if (leftover) {
+          const branchProblem = out.error;
+          out.error = `git removed the worktree but could not delete its files (${reason})` + (branchProblem ? `. Also: ${branchProblem}` : "");
+        }
         return out;
       }
       out.worktreeRemoved = linked.path;
@@ -11628,12 +11714,20 @@ function cleanupWorkspaceLocal(appDir, id, trunkBranch, options = {}) {
 function cleanupRefusalMessage(outcome) {
   if (outcome.worktreeDir) {
     const dir = shQuote(outcome.worktreeDir);
-    return `Cleanup incomplete: ${outcome.error}. The worktree at ${dir} still holds uncommitted or untracked work \u2014 that's why the plain removal refused. Inspect it (\`git -C ${dir} status\`) and commit anything worth keeping to the workspace branch. Once it's clean, remove it from the main checkout: \`git worktree remove ${dir}\`.`;
+    if (outcome.error.includes("contains modified or untracked files")) {
+      return `Cleanup incomplete: ${outcome.error}. The worktree at ${dir} still holds uncommitted or untracked work \u2014 that's why the plain removal refused. Inspect it (\`git -C ${dir} status\`) and commit anything worth keeping to the workspace branch. Once it's clean, remove it from the main checkout: \`git worktree remove ${dir}\`.`;
+    }
+    return `Cleanup incomplete: ${outcome.error}. The worktree at ${dir} is still registered; git refused the plain removal for the reason above. Inspect it (\`git -C ${dir} status\`), resolve that, then remove it from the main checkout: \`git worktree remove ${dir}\`.`;
+  }
+  if (outcome.leftoverDir) {
+    return `Cleanup incomplete: ${outcome.error}. Close anything using that folder \u2014 a dev server, an editor, or a shell inside it \u2014 then delete: ${shQuote(outcome.leftoverDir)}`;
   }
   return `Cleanup incomplete: ${outcome.error}. Finish it from the main checkout once ${shQuote(outcome.branch)} is safe to delete.`;
 }
 function cleanupAction(outcome) {
-  return outcome.worktreeDir ? { cwd: outcome.worktreeDir, argv: ["git", "status"] } : { cwd: process.cwd(), argv: ["git", "branch", "--list", outcome.branch] };
+  if (outcome.worktreeDir) return { cwd: outcome.worktreeDir, argv: ["git", "status"] };
+  if (outcome.leftoverDir) return { cwd: process.cwd(), argv: ["git", "worktree", "list"] };
+  return { cwd: process.cwd(), argv: ["git", "branch", "--list", outcome.branch] };
 }
 function reportCleanupHuman(outcome) {
   if (outcome.error) {
@@ -11641,6 +11735,7 @@ function reportCleanupHuman(outcome) {
       cleanupRefusalMessage({
         error: outcome.error,
         worktreeDir: outcome.worktreeDir,
+        leftoverDir: outcome.leftoverDir,
         branch: outcome.branch
       })
     );
@@ -11888,7 +11983,7 @@ var newWorkspaceCommand = defineDeepspaceCommand({
 
 // src/cli/commands/workspace/attach.ts
 import * as p26 from "@clack/prompts";
-import { existsSync as existsSync23, readdirSync as readdirSync7, realpathSync as realpathSync7, rmSync as rmSync6 } from "fs";
+import { existsSync as existsSync24, readdirSync as readdirSync7, realpathSync as realpathSync7, rmSync as rmSync6 } from "fs";
 import { isAbsolute as isAbsolute7, resolve as resolve19 } from "path";
 function samePath(a, b) {
   const real = (p35) => {
@@ -11908,7 +12003,7 @@ function finishedWorkspaceMessage(id, view) {
   return `Workspace ${id} is ${workspace.status} \u2014 its ref is retained briefly (fetch ${workspace.ref} to inspect), but attach only works on active workspaces.`;
 }
 function cleanFailedFreshAttachDir(dir) {
-  if (!existsSync23(dir)) return [];
+  if (!existsSync24(dir)) return [];
   let entries;
   try {
     entries = readdirSync7(dir);
@@ -11990,7 +12085,7 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
       const localTip = resolveCommit(appDir, `refs/heads/${branch}`);
       if (localTip) {
         let existing = resolveWorkspaceWorktree(listWorktrees(appDir), id);
-        if (existing && !existsSync23(existing)) {
+        if (existing && !existsSync24(existing)) {
           runGit(appDir, ["worktree", "prune"], { allowFail: true });
           existing = null;
         }
@@ -12108,7 +12203,7 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
       process.cwd(),
       (typeof args.dir === "string" ? args.dir.trim() : "") || `ws-${id.slice(3).toLowerCase()}`
     );
-    if (existsSync23(dir)) {
+    if (existsSync24(dir)) {
       spinner2?.stop("Target exists.");
       throw new Refusal(`${dir} already exists \u2014 pass a different directory.`, "dir_exists");
     }
@@ -12446,12 +12541,12 @@ import * as p30 from "@clack/prompts";
 // src/cli/lib/validation.ts
 import { sync as spawnSync7 } from "cross-spawn";
 import { readFileSync as readFileSync26 } from "fs";
-import { join as join23 } from "path";
+import { join as join22 } from "path";
 var MAX_SUMMARY_CHARS = 4e3;
 var MAX_OUTPUT_BUFFER = 64 * 1024 * 1024;
 function configuredCommand(appDir) {
   try {
-    const pkg2 = JSON.parse(readFileSync26(join23(appDir, "package.json"), "utf-8"));
+    const pkg2 = JSON.parse(readFileSync26(join22(appDir, "package.json"), "utf-8"));
     if (pkg2.scripts?.validate) return `${detectPackageManager(appDir)} run --silent validate`;
   } catch {
   }
@@ -12792,12 +12887,14 @@ var landWorkspaceCommand = defineDeepspaceCommand({
     if (cleanup?.error) {
       const action2 = cleanupAction({
         worktreeDir: cleanup.worktreeDir,
+        leftoverDir: cleanup.leftoverDir,
         branch: cleanup.branch
       });
       throw new Refusal(
         cleanupRefusalMessage({
           error: cleanup.error,
           worktreeDir: cleanup.worktreeDir,
+          leftoverDir: cleanup.leftoverDir,
           branch: cleanup.branch
         }),
         "cleanup_incomplete",
@@ -12963,12 +13060,14 @@ var dropWorkspaceCommand = defineDeepspaceCommand({
     if (cleanup?.error) {
       const action = cleanupAction({
         worktreeDir: cleanup.worktreeDir,
+        leftoverDir: cleanup.leftoverDir,
         branch: cleanup.branch
       });
       throw new Refusal(
         cleanupRefusalMessage({
           error: cleanup.error,
           worktreeDir: cleanup.worktreeDir,
+          leftoverDir: cleanup.leftoverDir,
           branch: cleanup.branch
         }),
         "cleanup_incomplete",
@@ -13523,10 +13622,167 @@ function sameRefs(left, right) {
 
 // src/cli/commands/update.ts
 import * as p34 from "@clack/prompts";
-import { existsSync as existsSync24, readFileSync as readFileSync27, writeFileSync as writeFileSync10 } from "fs";
-import { join as join24, resolve as resolve20 } from "path";
+import { existsSync as existsSync25, readFileSync as readFileSync27, writeFileSync as writeFileSync8 } from "fs";
+import { join as join23, resolve as resolve20 } from "path";
+
+// package.json
+var package_default = {
+  name: "deepspace",
+  version: "0.19.2",
+  engines: {
+    node: ">=22.15.0 <23 || >=24 <25 || >=26 <27"
+  },
+  description: "DeepSpace SDK \u2014 build real-time collaborative apps on Cloudflare Workers",
+  type: "module",
+  sideEffects: false,
+  main: "./dist/index.js",
+  types: "./dist/index.d.ts",
+  bin: {
+    deepspace: "dist/cli.js"
+  },
+  exports: {
+    ".": {
+      types: "./dist/index.d.ts",
+      import: "./dist/index.js"
+    },
+    "./schema": {
+      types: "./dist/schema.d.ts",
+      import: "./dist/schema.js"
+    },
+    "./worker": {
+      types: "./dist/worker.d.ts",
+      import: "./dist/worker.js"
+    },
+    "./server": {
+      types: "./dist/server.d.ts",
+      import: "./dist/server.js"
+    },
+    "./testing": {
+      types: "./dist/testing.d.ts",
+      import: "./dist/testing.js"
+    },
+    "./documentation": {
+      types: "./dist/documentation.d.ts",
+      import: "./dist/documentation.js"
+    },
+    "./documentation/react": {
+      types: "./dist/documentation-react.d.ts",
+      import: "./dist/documentation-react.js"
+    }
+  },
+  files: [
+    "dist",
+    "features",
+    "CHANGELOG.md"
+  ],
+  scripts: {
+    build: "node ../../scripts/clean-artifacts.mjs dist --tsbuildinfo && tsup",
+    "type-check": "tsc --noEmit",
+    test: "vitest run",
+    "test:documentation-browser": "playwright test --config src/documentation/runtime/__browser__/playwright.config.ts",
+    clean: "node ../../scripts/clean-artifacts.mjs dist --tsbuildinfo",
+    prepublishOnly: "pnpm build"
+  },
+  dependencies: {
+    "@ai-sdk/anthropic": "2.0.91",
+    "@ai-sdk/openai": "2.0.116",
+    "@ai-sdk/openai-compatible": "1.0.46",
+    "@clack/prompts": "^1.2.0",
+    "@mdx-js/mdx": "^3.1.1",
+    acorn: "^8.16.0",
+    ai: "5.0.222",
+    "better-auth": "1.6.23",
+    citty: "^0.2.0",
+    "cross-spawn": "^7.0.6",
+    esbuild: "^0.27.0",
+    "highlight.js": "^11.11.1",
+    hono: "^4.6.0",
+    jose: "^6.1.0",
+    marked: "^18.0.7",
+    "mdast-util-gfm": "^3.1.0",
+    "mdast-util-to-markdown": "^2.1.2",
+    "rehype-highlight": "^7.0.2",
+    "remark-frontmatter": "^5.0.0",
+    "remark-gfm": "^4.0.1",
+    "sanitize-html": "^2.17.6",
+    "smol-toml": "^1.6.1",
+    yaml: "^2.9.0",
+    yjs: "^13.6.0",
+    zod: "^4.3.6"
+  },
+  peerDependencies: {
+    "@playwright/test": ">=1.40.0",
+    clsx: ">=2.0.0",
+    "lucide-react": ">=0.400.0",
+    react: "^18.0.0 || ^19.0.0",
+    "react-dom": "^18.0.0 || ^19.0.0",
+    "tailwind-merge": ">=2.0.0"
+  },
+  peerDependenciesMeta: {
+    "@playwright/test": {
+      optional: true
+    },
+    react: {
+      optional: true
+    },
+    "react-dom": {
+      optional: true
+    },
+    clsx: {
+      optional: true
+    },
+    "tailwind-merge": {
+      optional: true
+    },
+    "lucide-react": {
+      optional: true
+    }
+  },
+  devDependencies: {
+    "@cloudflare/workers-types": "^4.20241205.0",
+    "@playwright/test": "^1.59.1",
+    "@types/better-sqlite3": "^7.6.12",
+    "@types/cross-spawn": "^6.0.6",
+    "@types/react": "^19.0.0",
+    "@types/react-dom": "^19.0.0",
+    "@types/sanitize-html": "^2.16.1",
+    "better-sqlite3": "^12.0.0",
+    clsx: "^2.1.1",
+    "framer-motion": "^12.38.0",
+    jsdom: "^29.1.1",
+    "lucide-react": "^1.7.0",
+    "react-router-dom": "^7.1.0",
+    "tailwind-merge": "^3.5.0",
+    tsup: "^8.3.0",
+    typescript: "^5.7.0",
+    vitest: "^4.1.0"
+  },
+  keywords: [
+    "deepspace",
+    "cloudflare-workers",
+    "durable-objects",
+    "real-time",
+    "collaborative",
+    "sdk"
+  ],
+  license: "Apache-2.0",
+  homepage: "https://deep.space",
+  repository: {
+    type: "git",
+    url: "git+https://github.com/deepdotspace/deepspace.git",
+    directory: "packages/deepspace"
+  },
+  bugs: {
+    url: "https://github.com/deepdotspace/deepspace/issues"
+  }
+};
+
+// src/cli/commands/update.ts
 var REGISTRY = "https://registry.npmjs.org/deepspace/latest";
 var DOCS_URL = "https://documentation.deep.space/cli-reference/commands";
+var BUILD_PREVIEW_SECRETS_GUIDE = "https://github.com/deepdotspace/deepspace-sdk/blob/main/docs/migrations/build-preview-secrets.md";
+var USERS_SCHEMA_VISIBILITY_GUIDE = "https://github.com/deepdotspace/deepspace-sdk/blob/main/docs/migrations/users-schema-member-visibility.md";
+var COMPATIBLE_AI_VERSION = package_default.dependencies.ai;
 var OLDEST_SUPPORTED_MINOR = 12;
 function parseVersion(raw) {
   const match = /^(\d+)\.(\d+)\.(\d+)/.exec(raw.trim().replace(/^[\^~]/, ""));
@@ -13538,27 +13794,58 @@ function gapIsTooWide(from, to) {
   return from.major === 0 && from.minor < OLDEST_SUPPORTED_MINOR;
 }
 function readAppSdkVersion(appDir) {
-  const installed = join24(appDir, "node_modules", "deepspace", "package.json");
-  if (existsSync24(installed)) {
+  const installed = join23(appDir, "node_modules", "deepspace", "package.json");
+  if (existsSync25(installed)) {
     const parsed2 = JSON.parse(readFileSync27(installed, "utf8"));
     if (typeof parsed2.version === "string") return parsed2.version;
   }
-  const manifest = join24(appDir, "package.json");
-  if (!existsSync24(manifest)) return null;
+  const manifest = join23(appDir, "package.json");
+  if (!existsSync25(manifest)) return null;
   const parsed = JSON.parse(readFileSync27(manifest, "utf8"));
   return parsed.dependencies?.deepspace ?? null;
 }
 function pinSdkVersion(appDir, version) {
-  const path = join24(appDir, "package.json");
+  const path = join23(appDir, "package.json");
   const source = readFileSync27(path, "utf8");
-  const updated = source.replace(
-    /("deepspace"\s*:\s*")[^"]+(")/,
-    (_match, head, tail) => `${head}^${version}${tail}`
-  );
-  if (updated === source) return false;
-  writeFileSync10(path, updated);
+  const manifest = JSON.parse(source);
+  const dependencies = manifest.dependencies;
+  if (!dependencies || typeof dependencies !== "object" || Array.isArray(dependencies)) return false;
+  let changed = false;
+  if (Object.prototype.hasOwnProperty.call(dependencies, "deepspace") && typeof dependencies.deepspace === "string" && dependencies.deepspace !== `^${version}`) {
+    dependencies.deepspace = `^${version}`;
+    changed = true;
+  }
+  if (Object.prototype.hasOwnProperty.call(dependencies, "ai") && typeof dependencies.ai === "string" && dependencies.ai !== COMPATIBLE_AI_VERSION) {
+    dependencies.ai = COMPATIBLE_AI_VERSION;
+    changed = true;
+  }
+  if (!changed) return false;
+  const eol = source.includes("\r\n") ? "\r\n" : "\n";
+  const indent = source.match(/\r?\n([\t ]+)"/)?.[1] ?? "  ";
+  const finalEol = source.endsWith("\n") ? eol : "";
+  writeFileSync8(path, JSON.stringify(manifest, null, indent).replaceAll("\n", eol) + finalEol);
   return true;
 }
+function buildPreviewSecretsUpgradeInstruction(appDir) {
+  const configName = [
+    "vite.config.ts",
+    "vite.config.mts",
+    "vite.config.js",
+    "vite.config.mjs"
+  ].find((candidate) => existsSync25(join23(appDir, candidate)));
+  if (!configName) return null;
+  const source = readFileSync27(join23(appDir, configName), "utf8");
+  if (source.includes("deepspace-remove-build-preview-secrets")) return null;
+  return `${configName}: add the build-preview secret cleanup from ${BUILD_PREVIEW_SECRETS_GUIDE}; app update left this app-owned file unchanged.`;
+}
+function usersSchemaVisibilityUpgradeInstruction(appDir) {
+  const schemaName = "src/schemas/users-schema.ts";
+  const path = join23(appDir, schemaName);
+  if (!existsSync25(path)) return null;
+  const source = readFileSync27(path, "utf8");
+  if (!/\bmember\s*:\s*\{[^}]*\bread\s*:\s*true\b/s.test(source)) return null;
+  return `${schemaName}: review the member user-row visibility change at ${USERS_SCHEMA_VISIBILITY_GUIDE}; app update left this app-owned schema unchanged.`;
+}
 async function latestPublishedVersion() {
   const response = await fetch(REGISTRY, { signal: AbortSignal.timeout(15e3) }).catch(
     (error) => {
@@ -13648,27 +13935,36 @@ var update_default = defineDeepspaceCommand({
     }
     const dryRun = args["dry-run"] === true;
     const plan = planAppMigrations(appDir);
+    const previewSecretsInstruction = buildPreviewSecretsUpgradeInstruction(appDir);
+    const usersSchemaInstruction = usersSchemaVisibilityUpgradeInstruction(appDir);
+    const manualInstructions = [previewSecretsInstruction, usersSchemaInstruction].filter(
+      (instruction) => instruction !== null
+    );
     const pinned = dryRun ? false : pinSdkVersion(appDir, targetRaw);
     if (!dryRun && plan.edits.length) applyAppMigrationPlan(appDir, plan);
     if (!args.json) {
       p34.log.info(`deepspace ${currentRaw} \u2192 ${targetRaw}`);
       if (pinned) p34.log.success("package.json now asks for the current SDK");
+      for (const instruction of manualInstructions) p34.log.warn(instruction);
       if (!plan.pending.length && !plan.blockers.length) {
-        p34.log.success("No source changes required.");
+        p34.log.success("No automatic source changes required.");
       }
       reportPlan(plan, !dryRun);
     }
-    if (plan.blockers.length) {
+    if (plan.blockers.length || manualInstructions.length) {
+      const remaining = plan.blockers.length + manualInstructions.length;
       throw new Refusal(
-        `${plan.blockers.length} change(s) need a human or agent edit; each is listed above with its file, line, and the change required.`,
+        `${remaining} change(s) need a human or agent edit; follow the returned manual instructions and blockers.`,
         "manual_changes_required",
         {
+          ...pinned ? { action: cliAction("npm", "install") } : {},
           actionRequired: true,
           extra: {
             currentVersion: currentRaw,
             targetVersion: targetRaw,
             applied: plan.pending.map((migration) => migration.id),
-            blockers: plan.blockers
+            blockers: plan.blockers,
+            manualInstructions
           }
         }
       );
@@ -13679,6 +13975,7 @@ var update_default = defineDeepspaceCommand({
         targetVersion: targetRaw,
         pinned,
         dryRun,
+        manualInstructions,
         applied: plan.pending.map((migration) => ({
           id: migration.id,
           description: migration.description,
@@ -13695,9 +13992,9 @@ var update_default = defineDeepspaceCommand({
 });
 
 // src/cli/cli.ts
-var __dirname = dirname11(fileURLToPath3(import.meta.url));
-var pkg = JSON.parse(readFileSync28(join25(__dirname, "..", "package.json"), "utf-8"));
-if (process.platform === "linux" && !process.env.SSL_CERT_FILE && existsSync25("/etc/ssl/certs/ca-certificates.crt")) {
+var __dirname = dirname12(fileURLToPath3(import.meta.url));
+var pkg = JSON.parse(readFileSync28(join24(__dirname, "..", "package.json"), "utf-8"));
+if (process.platform === "linux" && !process.env.SSL_CERT_FILE && existsSync26("/etc/ssl/certs/ca-certificates.crt")) {
   process.env.SSL_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt";
 }
 var create2 = defineCommand14({