deepspace 0.22.0 → 0.23.0

package/dist/cli.js

@@ -993,18 +993,6 @@ ${line}
   }
   writeFileSync2(wranglerPath, src);
 }
-var APP_ID_PLACEHOLDER = "__APP_ID__";
-function stampAppIdInSources(cwd, appId, previousAppId) {
-  const constantsPath = join2(resolve2(cwd), "src", "constants.ts");
-  if (!existsSync3(constantsPath)) return false;
-  const needles = [APP_ID_PLACEHOLDER, ...previousAppId ? [previousAppId] : []];
-  const content = readFileSync5(constantsPath, "utf-8");
-  let next = content;
-  for (const needle of needles) next = next.replaceAll(needle, appId);
-  if (next === content) return false;
-  writeFileSync2(constantsPath, next);
-  return true;
-}
 
 // src/cli/commands/dev.ts
 import { resolve as resolve8, basename as basename2, join as join11 } from "path";
@@ -1589,6 +1577,7 @@ function resolveAppNameForEnv(config, envName) {
   if (!envBlock) {
     return {
       ok: false,
+      code: "missing_env_block",
       reason: `wrangler.toml: no [env.${envName}] block found. Add one with a distinct \`name\` to deploy this environment.`
     };
   }
@@ -2193,6 +2182,7 @@ async function secretsApi(deployUrl, token, path, init = {}) {
   if (!res.ok) {
     const err = new Error(body.error ?? `Secrets request failed (${res.status})`);
     err.status = res.status;
+    err.code = body.code;
     err.apiPath = path;
     throw err;
   }
@@ -2399,6 +2389,12 @@ import { join as join10 } from "path";
 import { pathToFileURL } from "url";
 
 // src/server/schemas/registry.ts
+var SYSTEM_ASSIGNED_COLUMNS = /* @__PURE__ */ new Set(["email", "name", "imageUrl", "role"]);
+var SYSTEM_MAINTAINED_COLUMNS = /* @__PURE__ */ new Set(["createdAt", "lastSeenAt"]);
+var SYSTEM_MANAGED_COLUMNS = /* @__PURE__ */ new Set([
+  ...SYSTEM_ASSIGNED_COLUMNS,
+  ...SYSTEM_MAINTAINED_COLUMNS
+]);
 var USERS_COLUMNS = [
   { name: "email", storage: "text", interpretation: "plain" },
   { name: "name", storage: "text", interpretation: "plain" },
@@ -3063,7 +3059,7 @@ function ensurePlaywright(appDir) {
 import { readFileSync as readFileSync14 } from "fs";
 
 // src/testing/accounts.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync13, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync13 } from "fs";
 import { homedir as homedir2 } from "os";
 import { join as join12 } from "path";
 var TEST_ACCOUNTS_PATH = join12(homedir2(), ".deepspace", "test-accounts.json");
@@ -3102,7 +3098,9 @@ function reconcileTestAccountScopes(store, remote, scope) {
   };
 }
 function reconcileTestAccounts(local, remote) {
-  const localById = new Map(local.filter((account) => account.id).map((account) => [account.id, account]));
+  const localById = new Map(
+    local.filter((account) => account.id).map((account) => [account.id, account])
+  );
   return remote.flatMap((account) => {
     const stored = localById.get(account.id);
     return stored ? [{ ...stored, ...account }] : [];
@@ -3137,7 +3135,9 @@ function readTestAccountStore() {
       return { version: 2, scopes: {} };
     }
     const candidate = raw;
-    const scopes = candidate.scopes && typeof candidate.scopes === "object" && !Array.isArray(candidate.scopes) ? Object.fromEntries(Object.entries(candidate.scopes).map(([key, value]) => [key, validTestAccounts(value)])) : {};
+    const scopes = candidate.scopes && typeof candidate.scopes === "object" && !Array.isArray(candidate.scopes) ? Object.fromEntries(
+      Object.entries(candidate.scopes).map(([key, value]) => [key, validTestAccounts(value)])
+    ) : {};
     return { version: 2, scopes };
   } catch {
     return { version: 2, scopes: {} };
@@ -3153,7 +3153,7 @@ function validTestAccounts(value) {
 }
 function saveTestAccountStore(store) {
   mkdirSync5(join12(homedir2(), ".deepspace"), { recursive: true });
-  writeFileSync5(TEST_ACCOUNTS_PATH, JSON.stringify(store, null, 2), { mode: 384 });
+  writeSecretFileSync(TEST_ACCOUNTS_PATH, JSON.stringify(store, null, 2));
 }
 
 // src/cli/lib/test-account-service.ts
@@ -3189,6 +3189,29 @@ async function createRemoteTestAccount(input) {
   }
   return { ...data, label: data.label ?? null };
 }
+async function recoverRemoteTestAccount(id) {
+  const response = await fetch(`${AUTH_URL4}/api/auth/test-accounts/${id}/credential`, {
+    method: "POST",
+    headers: { Cookie: sessionCookie(), Origin: AUTH_URL4 }
+  });
+  const data = await response.json().catch(() => ({}));
+  if (response.status === 404) {
+    throw new Error(
+      `No test account ${id} on this account. Run \`deepspace test accounts list\` for the current pool.`
+    );
+  }
+  if (!response.ok || typeof data.password !== "string" || typeof data.email !== "string" || typeof data.userId !== "string") {
+    throw new Error(data.error ?? "Failed to re-issue the test account credential");
+  }
+  return {
+    id,
+    email: data.email,
+    userId: data.userId,
+    label: data.label ?? null,
+    createdAt: data.createdAt ?? Date.now(),
+    password: data.password
+  };
+}
 async function deleteRemoteTestAccount(id) {
   const response = await fetch(`${AUTH_URL4}/api/auth/test-accounts/${id}`, {
     method: "DELETE",
@@ -3341,10 +3364,10 @@ var test_default = defineDeepspaceCommand({
         if (forwarded.grep || forwarded.project || forwarded.headed) {
           console.error("note: --grep/--project/--headed apply to Playwright suites and are ignored by `unit`");
         }
-        exitCode = runVitest(appDir);
+        exitCode = runVitest(appDir, wranglerEnv);
         break;
       case "all":
-        exitCode = runVitest(appDir);
+        exitCode = runVitest(appDir, wranglerEnv);
         if (exitCode === 0) exitCode = runPlaywright(appDir, [], port, wranglerEnv, forwarded);
         break;
       case "default":
@@ -3375,7 +3398,7 @@ Available: smoke, api, e2e, unit, all`,
     return { data: { suite, port, appDir, wranglerEnv: wranglerEnv ?? null } };
   }
 });
-function runPlaywright(appDir, testFiles, port, wranglerEnv, flags) {
+function runSuite(appDir, argv, wranglerEnv, extraEnv = {}) {
   let wranglerConfig;
   try {
     wranglerConfig = prepareWranglerEnvConfig(appDir, wranglerEnv);
@@ -3384,25 +3407,24 @@ function runPlaywright(appDir, testFiles, port, wranglerEnv, flags) {
     return 1;
   }
   try {
-    const result = spawnSync4("npx", playwrightTestArgs(testFiles, flags), {
+    const result = spawnSync4("npx", argv, {
       cwd: appDir,
       stdio: "inherit",
-      env: wranglerViteEnv(process.env, wranglerConfig, {
-        DEEPSPACE_PORT: String(port),
-        PLAYWRIGHT_HTML_OUTPUT_DIR: ".deepspace/playwright-report"
-      })
+      env: wranglerViteEnv(process.env, wranglerConfig, extraEnv)
     });
     return result.status ?? 1;
   } finally {
     wranglerConfig.cleanup();
   }
 }
-function runVitest(appDir) {
-  const result = spawnSync4("npx", ["vitest", "run", "--passWithNoTests"], {
-    cwd: appDir,
-    stdio: "inherit"
+function runPlaywright(appDir, testFiles, port, wranglerEnv, flags = {}) {
+  return runSuite(appDir, playwrightTestArgs(testFiles, flags), wranglerEnv, {
+    DEEPSPACE_PORT: String(port),
+    PLAYWRIGHT_HTML_OUTPUT_DIR: ".deepspace/playwright-report"
   });
-  return result.status ?? 1;
+}
+function runVitest(appDir, wranglerEnv) {
+  return runSuite(appDir, ["vitest", "run", "--passWithNoTests"], wranglerEnv);
 }
 
 // src/cli/commands/screenshot.ts
@@ -3740,6 +3762,107 @@ Failed:
     return { data: { deleted: ok2, requested: targets.length, failures: [] } };
   }
 });
+var recover = defineDeepspaceCommand({
+  meta: {
+    name: "recover",
+    description: "Re-issue the local credential for a test account you own"
+  },
+  args: {
+    email: {
+      type: "string",
+      description: "Email of the test account to recover",
+      required: false
+    },
+    id: {
+      type: "string",
+      description: "ID of the test account to recover",
+      required: false
+    },
+    all: {
+      type: "boolean",
+      description: "Recover every pool account missing a local credential",
+      required: false
+    }
+  },
+  async run({ args }) {
+    const selectors = [args.email, args.id, args.all].filter(Boolean).length;
+    if (selectors === 0) {
+      throw new Refusal("Provide --email <email>, --id <id>, or --all.", "missing_argument");
+    }
+    if (selectors > 1) {
+      throw new Refusal("Provide exactly one of --email, --id, or --all.", "conflicting_arguments");
+    }
+    await ensureToken();
+    let remote;
+    try {
+      remote = await fetchRemoteTestAccounts();
+    } catch (err) {
+      throw new Refusal(`Failed: ${err.message}`, "test_accounts_list_failed");
+    }
+    const localAccounts = loadAllTestAccounts();
+    const known = new Set(localAccounts.map((account) => account.id));
+    const localNames = new Map(
+      localAccounts.flatMap(
+        (account) => account.name ? [[account.email, account.name]] : []
+      )
+    );
+    let targets;
+    if (args.all) {
+      targets = remote.filter((account) => !known.has(account.id));
+      if (targets.length === 0) {
+        if (!args.json) console.log("Every pool account already has a local credential.");
+        return { data: { recovered: [], alreadyLocal: remote.length } };
+      }
+    } else {
+      const match = args.id ? remote.find((account) => account.id === args.id) : remote.find((account) => account.email === args.email);
+      if (!match) {
+        throw new Refusal(
+          `No test account ${args.id ? `with id ${args.id}` : `with email ${args.email}`} on this account.`,
+          "test_account_not_found",
+          { action: cliAction("deepspace", "test", "accounts", "list") }
+        );
+      }
+      targets = [match];
+    }
+    const recovered = [];
+    const failures = [];
+    for (const target2 of targets) {
+      try {
+        const account = await recoverRemoteTestAccount(target2.id);
+        const name = localNames.get(account.email);
+        upsertTestAccount({
+          id: account.id,
+          email: account.email,
+          password: account.password,
+          userId: account.userId,
+          label: account.label,
+          ...name ? { name } : {},
+          createdAt: account.createdAt
+        });
+        recovered.push({ id: account.id, email: account.email });
+      } catch (err) {
+        failures.push({ email: target2.email, error: err.message });
+      }
+    }
+    if (failures.length > 0) {
+      throw new Refusal(
+        `Recovered ${recovered.length}/${targets.length} test account(s).
+Failed:
+` + failures.map((failure) => `  ${failure.email}: ${failure.error}`).join("\n"),
+        "test_account_recover_failed",
+        { extra: { recovered, requested: targets.length, failures } }
+      );
+    }
+    if (!args.json) {
+      for (const account of recovered) console.log(`Recovered ${account.email}`);
+      console.log(
+        `
+Stored in ${TEST_ACCOUNTS_PATH}. The previous password (if any machine still holds one) no longer works \u2014 recover there too.`
+      );
+    }
+    return { data: { recovered, requested: targets.length, failures: [] } };
+  }
+});
 var test_accounts_default = defineCommand2({
   meta: {
     name: "test-accounts",
@@ -3749,7 +3872,8 @@ var test_accounts_default = defineCommand2({
     create,
     list,
     delete: del,
-    clear
+    clear,
+    recover
   }
 });
 
@@ -4469,7 +4593,7 @@ function declaredCompatibilityDate(config) {
   return typeof declared === "string" && /^\d{4}-\d{2}-\d{2}$/.test(declared) ? declared : null;
 }
 async function buildDeployBundle(options) {
-  const { appDir, appName, envName, output, spinner: spinner2 } = options;
+  const { appDir, appName, appId, envName, output, spinner: spinner2 } = options;
   const junk = removeMacosJunk(appDir);
   if (junk > 0) p6.log.info(`Removed ${junk} macOS metadata file(s) (._*, .DS_Store)`);
   const lintFindings = await lintProjectSchemas(appDir);
@@ -4544,6 +4668,8 @@ async function buildDeployBundle(options) {
   const assets = collectAssets(clientDir);
   const assetConfig = readDeployAssetConfig(clientDir);
   spinner2.stop(`Collected ${assets.length} assets`);
+  const appIdRefusal = clientAppIdRefusal(assets, appId, envName);
+  if (appIdRefusal) output.die(appIdRefusal.message, appIdRefusal.code);
   const workerJs = readFileSync17(workerBundlePath, "utf-8");
   const doBindings = outputConfig.durable_objects?.bindings;
   const sqliteClasses = new Set(
@@ -4612,6 +4738,44 @@ function oversizedAssetRefusal(assets) {
   if (!tooBig) return null;
   return `${tooBig.path} is ${formatBytes(tooBig.size)}; the per-file limit for deploy assets is ${formatBytes(MAX_DEPLOY_ASSET_FILE_BYTES)}. ${LARGE_MEDIA_HOME}`;
 }
+var CLIENT_CODE_ASSET = /\.(?:js|mjs|html)$/i;
+var APP_ID_LITERAL = /app_[0-9A-HJKMNP-TV-Z]{26}/g;
+var APP_ID_DEFINE = "__DEEPSPACE_APP_ID__";
+var APP_ID_ADOPTION_STEPS = `Point the client at the build-injected id \u2014 the SDK's \`deepspace/build\` supplies it:
+  \u2022 vite.config.ts: import { deepspaceBuild } from 'deepspace/build' and add
+    deepspaceBuild({ appDir: fileURLToPath(new URL('.', import.meta.url)) }) to plugins
+  \u2022 vitest.config.ts: import { appIdDefine } and set define: appIdDefine({ appDir })
+  \u2022 src/constants.ts: declare const __DEEPSPACE_APP_ID__: string; export it as APP_ID
+    (drop the frozen literal)
+Apply all three together: src/constants.ts on its own builds clean and then throws in the browser. A newly scaffolded app already has this.`;
+function clientAppIdRefusal(assets, appId, envName) {
+  const foreign = /* @__PURE__ */ new Map();
+  let unsubstituted;
+  for (const asset of assets) {
+    if (!CLIENT_CODE_ASSET.test(asset.path)) continue;
+    const source = readFileSync17(asset.sourcePath, "utf-8");
+    if (unsubstituted === void 0 && source.includes(APP_ID_DEFINE)) unsubstituted = asset.path;
+    for (const found of source.matchAll(APP_ID_LITERAL)) {
+      if (found[0] !== appId && !foreign.has(found[0])) foreign.set(found[0], asset.path);
+    }
+  }
+  if (unsubstituted !== void 0) {
+    return {
+      code: "app_id_define_unsubstituted",
+      message: `Built client assets still contain \`${APP_ID_DEFINE}\` (first in ${unsubstituted}) \u2014 nothing replaced it at build time. The browser evaluates that identifier and throws ReferenceError before the app renders, so this bundle is a blank page for every visitor. src/constants.ts was moved onto the build-time app id without the build config that supplies it.
+${APP_ID_ADOPTION_STEPS}`
+    };
+  }
+  if (foreign.size === 0) return null;
+  const target2 = envName ? `--env ${envName} (${appId})` : appId;
+  return {
+    code: "app_id_env_mismatch",
+    message: `Built client assets carry a different app id than the one being deployed. Deploying ${target2}, but the bundle contains:
+` + [...foreign].map(([id, path]) => `  \u2022 ${id} in ${path}`).join("\n") + `
+The browser keys its RecordRooms to the id in the bundle, so this would serve ${envName ? `${envName}'s` : "this app's"} worker against another app's data. The usual cause is an app scaffolded before the id was build-injected: src/constants.ts still holds \`export const APP_ID = 'app_\u2026'\` frozen at scaffold time.
+${APP_ID_ADOPTION_STEPS}`
+  };
+}
 var LARGE_MEDIA_HOME = "Large media belongs in your app files (`deepspace app files put`), not in the deploy bundle \u2014 move it out of `public/` and reference it at runtime.";
 function collectAssets(dir) {
   const assets = [];
@@ -6251,7 +6415,7 @@ var deploy_default = defineCommand3({
     output.showIntro();
     const wranglerConfig = readWranglerConfig(appDir);
     const nameResult = resolveAppNameForEnv(wranglerConfig, envName);
-    if (!nameResult.ok) return output.die(nameResult.reason, "invalid_app_name");
+    if (!nameResult.ok) return output.die(nameResult.reason, nameResult.code ?? "invalid_app_name");
     const declaredName = envName ? wranglerConfig.env?.[envName]?.name : wranglerConfig.name;
     if (declaredName !== nameResult.name) {
       const location = envName ? `[env.${envName}].name` : "`name`";
@@ -6267,7 +6431,14 @@ var deploy_default = defineCommand3({
     if (!appId) {
       return output.die(
         `No app id in wrangler.toml${envName ? ` for [env.${envName}]` : ""}. Run \`deepspace app init${envName ? ` --env ${envName}` : ""}\` to register this app, then re-deploy.`,
-        "app_not_initialized"
+        "app_not_initialized",
+        {
+          action: {
+            cwd: appDir,
+            argv: ["deepspace", "app", "init", ...envName ? ["--env", envName] : []]
+          },
+          actionRequired: true
+        }
       );
     }
     p12.log.info(`Id: ${appId}`);
@@ -6281,6 +6452,12 @@ var deploy_default = defineCommand3({
       output
     });
     const sourceState = await getAppSource(DEPLOY_URL3, token, appId);
+    if (!sourceState.registered) {
+      output.die(
+        `${appId} is not registered. If this repo's id came from an older SDK's scaffold, run \`deepspace app init --new-id\` to register it as a fresh app; a brand-new app dir registers with \`deepspace app init\`.`,
+        "app_not_registered"
+      );
+    }
     const repositoryPreflight = preflightDeployRepository({
       appDir,
       push: args.push !== false,
@@ -6293,6 +6470,7 @@ var deploy_default = defineCommand3({
     const bundle = await buildDeployBundle({
       appDir,
       appName,
+      appId,
       envName,
       output,
       spinner: spinner2
@@ -6556,7 +6734,7 @@ async function warnIfPhantomApp(deployUrl, token, appId, explicit) {
     const apps = await listApps(deployUrl, token);
     if (!apps.some((app2) => app2.appId === appId)) {
       process.stderr.write(
-        `warning: ${appId} is not among your apps. If it exists and you have access (collaborator/admin), the server will use it; if it doesn't exist, this will register it as a NEW app under your account \u2014 check the id if that's not what you meant (a subdomain name also works with -a).
+        `warning: ${appId} is not among your apps. If it exists and you have access (collaborator/admin), the server will use it; if it doesn't exist, the command will be refused (app_not_registered \u2014 ids are registered at \`deepspace app init\`). Check the id (a subdomain name also works with -a).
 `
       );
     }
@@ -7128,7 +7306,7 @@ import {
   readSync,
   readdirSync as readdirSync5,
   rmSync as rmSync4,
-  writeFileSync as writeFileSync6
+  writeFileSync as writeFileSync5
 } from "fs";
 import { spawnSync as spawnSync6 } from "child_process";
 import { tmpdir as tmpdir2 } from "os";
@@ -7227,7 +7405,7 @@ function copyFileWithImportShift(src, dest, levels) {
     /(from\s+|import\s+|import\()(['"])(\.\.\/)/g,
     `$1$2${prefix}$3`
   );
-  writeFileSync6(dest, shifted);
+  writeFileSync5(dest, shifted);
 }
 function installFiles(packageRoot, config, targetDir, emit) {
   let copied = 0;
@@ -7313,7 +7491,7 @@ export const schemas`
     return [unresolvedSchema(config.schema, reason, emit)];
   }
   content = withEntry;
-  writeFileSync6(schemasPath, content);
+  writeFileSync5(schemasPath, content);
   emit(`   Schema integrated: ${exportName} -> schemas.ts`);
   return [];
 }
@@ -7379,7 +7557,7 @@ ${registryEntry}`);
     integrated++;
     emit(`   Action integrated: ${action.registerAs} (${action.exportName})`);
   }
-  if (integrated > 0) writeFileSync6(actionsPath, content);
+  if (integrated > 0) writeFileSync5(actionsPath, content);
   return unresolved;
 }
 function integrateCode(config, targetDir, emit) {
@@ -7424,7 +7602,7 @@ ${content.slice(
     const prefix = insertion.placement === "before" ? "" : "\n";
     const suffix = insertion.placement === "before" ? "\n" : "";
     content = `${content.slice(0, insertAt)}${prefix}${insertion.insert}${suffix}${content.slice(insertAt)}`;
-    writeFileSync6(targetPath, content);
+    writeFileSync5(targetPath, content);
     emit(`   Integrated: ${insertion.file}`);
   }
   return unresolved;
@@ -7437,7 +7615,7 @@ function integrateIgnore(config, targetDir) {
   const missing = config.ignore.filter((pattern) => !present.has(pattern));
   if (missing.length === 0) return;
   const separator = current === "" || current.endsWith("\n") ? "" : "\n";
-  writeFileSync6(targetPath, `${current}${separator}${missing.join("\n")}
+  writeFileSync5(targetPath, `${current}${separator}${missing.join("\n")}
 `);
 }
 function integrateWrangler(config, targetDir, emit) {
@@ -7474,7 +7652,7 @@ ${rateLimitBindingBlock(scope, binding)}
     }
   }
   if (changed) {
-    writeFileSync6(targetPath, source);
+    writeFileSync5(targetPath, source);
     emit("   Integrated: wrangler.toml");
   } else emit("   Integration already present: wrangler.toml");
   return [];
@@ -7567,7 +7745,7 @@ ${css}`;
     integrated++;
     emit(`   CSS integrated: ${cssFile} -> styles.css`);
   }
-  if (integrated > 0) writeFileSync6(stylesPath, styles);
+  if (integrated > 0) writeFileSync5(stylesPath, styles);
   return unresolved;
 }
 function unresolvedRoute(route, config, reason, emit) {
@@ -7614,7 +7792,7 @@ function integrateRoute(config, targetDir, emit) {
   const entry = `  { path: '${routePath}', label: '${config.name}'${roles} },`;
   content = content.replace(NAV_MARKER, `${NAV_MARKER}
 ${entry}`);
-  writeFileSync6(navPath, content);
+  writeFileSync5(navPath, content);
   emit(`   Nav wired: ${routePath} (${config.name})`);
   emit("   Route: automatic (file-based routing via src/pages/)");
   return [];
@@ -7698,7 +7876,7 @@ function integrateDependencies(config, targetDir, runInstall, outputVisible, emi
   if (added.length === 0) {
     emit("   Dependencies already present");
   } else {
-    writeFileSync6(packagePath, `${JSON.stringify(pkg2, null, 2)}
+    writeFileSync5(packagePath, `${JSON.stringify(pkg2, null, 2)}
 `, "utf-8");
     emit(`   Added to package.json: ${added.map(({ name }) => name).join(", ")}`);
     if (skipped.length) emit(`   Already present (kept your version): ${skipped.join(", ")}`);
@@ -10291,6 +10469,25 @@ var init_default = defineDeepspaceCommand({
     const envName = args.env || void 0;
     const existing = readAppId(appDir, envName);
     if (existing && !args["new-id"]) {
+      const token2 = await ensureToken();
+      let state;
+      try {
+        state = await getAppSource(DEPLOY_URL12, token2, existing);
+      } catch (error) {
+        if (error instanceof ApiError && error.code === "forbidden") {
+          throw new Refusal(
+            `wrangler.toml carries ${existing}, which is registered to another user. Run \`deepspace app init --new-id\` to fork this repo as your own app (new data and secrets; the original is untouched).`,
+            "not_app_owner"
+          );
+        }
+        throw error;
+      }
+      if (!state.registered) {
+        throw new Refusal(
+          `wrangler.toml carries ${existing}, but that id was never registered \u2014 it was minted locally by an older SDK. Ids are server-minted at registration now, and an existing unregistered id cannot be claimed. Run \`deepspace app init --new-id\` to register this repo as a fresh app (new data and secrets; nothing to migrate \u2014 the old id never had server-side state).`,
+          "app_not_registered"
+        );
+      }
       if (!args.json) {
         console.log(`Already initialized: ${existing}${envName ? ` (env: ${envName})` : ""}`);
         console.log(`App dir: ${appDir}`);
@@ -10304,7 +10501,6 @@ var init_default = defineDeepspaceCommand({
       method: "POST"
     });
     writeAppId(appDir, appId, { wranglerEnv: envName, force: Boolean(args["new-id"]) });
-    if (!envName) stampAppIdInSources(appDir, appId, existing);
     const committedScaffold = commitScaffoldIfUnborn(appDir, token);
     if (!args.json) {
       if (existing) {
@@ -10747,6 +10943,24 @@ var push_default = defineDeepspaceCommand({
         );
       }
       const { token, appId } = await resolveTarget3();
+      let sourceState;
+      try {
+        sourceState = await getAppSource(deployBaseUrl(), token, appId);
+      } catch (error) {
+        if (error instanceof ApiError && error.code === "forbidden") {
+          throw new Refusal(
+            `${appId} is registered to another user. Run \`deepspace app init --new-id\` to fork this repo as your own app (new data and secrets; the original is untouched).`,
+            "not_app_owner"
+          );
+        }
+        throw error;
+      }
+      if (!sourceState.registered) {
+        throw new Refusal(
+          `${appId} is not registered. If this repo's id came from an older SDK's scaffold, run \`deepspace app init --new-id\` to register it as a fresh app; a brand-new app dir registers with \`deepspace app init\`.`,
+          "app_not_registered"
+        );
+      }
       const pullRecoveryCwd = selectedBranchCheckout(appDir, branch) ?? appDir;
       ensureSpaceRemote(appDir, appId);
       if (force) {
@@ -11611,7 +11825,7 @@ import {
   realpathSync as realpathSync6,
   renameSync as renameSync2,
   statSync as statSync3,
-  writeFileSync as writeFileSync7
+  writeFileSync as writeFileSync6
 } from "fs";
 import { dirname as dirname11, isAbsolute as isAbsolute5, join as join22, relative as relative2, sep as sep2 } from "path";
 var WORKSPACE_MARKER = "deepspace-workspace.json";
@@ -11646,7 +11860,7 @@ function markManagedWorkspace(worktreeRoot, workspaceId) {
   const tempPath = `${markerPath}.${process.pid}.tmp`;
   try {
     mkdirSync7(dirname11(markerPath), { recursive: true });
-    writeFileSync7(tempPath, JSON.stringify(marker) + "\n");
+    writeFileSync6(tempPath, JSON.stringify(marker) + "\n");
     renameSync2(tempPath, markerPath);
     return true;
   } catch {
@@ -13780,13 +13994,13 @@ function sameRefs(left, right) {
 
 // src/cli/commands/update.ts
 import * as p34 from "@clack/prompts";
-import { existsSync as existsSync26, readFileSync as readFileSync27, writeFileSync as writeFileSync8 } from "fs";
+import { existsSync as existsSync26, readFileSync as readFileSync27, writeFileSync as writeFileSync7 } from "fs";
 import { join as join24, resolve as resolve20 } from "path";
 
 // package.json
 var package_default = {
   name: "deepspace",
-  version: "0.22.0",
+  version: "0.23.0",
   engines: {
     node: ">=22.15.0 <23 || >=24 <25 || >=26 <27"
   },
@@ -13823,6 +14037,10 @@ var package_default = {
       types: "./dist/testing-mcp.d.ts",
       import: "./dist/testing-mcp.js"
     },
+    "./build": {
+      types: "./dist/build.d.ts",
+      import: "./dist/build.js"
+    },
     "./documentation": {
       types: "./dist/documentation.d.ts",
       import: "./dist/documentation.js"
@@ -13986,7 +14204,7 @@ function pinSdkVersion(appDir, version) {
   const eol = source.includes("\r\n") ? "\r\n" : "\n";
   const indent = source.match(/\r?\n([\t ]+)"/)?.[1] ?? "  ";
   const finalEol = source.endsWith("\n") ? eol : "";
-  writeFileSync8(path, JSON.stringify(manifest, null, indent).replaceAll("\n", eol) + finalEol);
+  writeFileSync7(path, JSON.stringify(manifest, null, indent).replaceAll("\n", eol) + finalEol);
   return true;
 }
 function buildPreviewSecretsUpgradeInstruction(appDir) {
@@ -13998,8 +14216,10 @@ function buildPreviewSecretsUpgradeInstruction(appDir) {
   ].find((candidate) => existsSync26(join24(appDir, candidate)));
   if (!configName) return null;
   const source = readFileSync27(join24(appDir, configName), "utf8");
-  if (source.includes("deepspace-remove-build-preview-secrets")) return null;
-  return `${configName}: add the build-preview secret cleanup from ${BUILD_PREVIEW_SECRETS_GUIDE}; app update left this app-owned file unchanged.`;
+  if (source.includes("deepspace-remove-build-preview-secrets") || source.includes("deepspaceBuild(") || source.includes("'deepspace/build'") || source.includes('"deepspace/build"')) {
+    return null;
+  }
+  return `${configName}: adopt the deepspaceBuild() plugin from deepspace/build (which owns this cleanup), or add the inline cleanup from ${BUILD_PREVIEW_SECRETS_GUIDE}; app update left this app-owned file unchanged.`;
 }
 function usersSchemaVisibilityUpgradeInstruction(appDir) {
   const schemaName = "src/schemas/users-schema.ts";