deepspace 0.22.1 → 0.23.1

package/dist/cli.js

@@ -8,8 +8,8 @@ import {
   renderUsage
 } from "citty";
 import { sync as spawnSync8 } from "cross-spawn";
-import { readFileSync as readFileSync28, existsSync as existsSync27 } from "fs";
-import { dirname as dirname12, join as join25 } from "path";
+import { readFileSync as readFileSync27, existsSync as existsSync28 } from "fs";
+import { dirname as dirname12, join as join28 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 
 // src/cli/lib/spinner.ts
@@ -215,6 +215,8 @@ var CliExit = class extends Error {
 function errorCode(err) {
   if (err instanceof ApiError || err instanceof InputError) return err.code;
   if (err instanceof Error && err.name === "GitError") return err.code ?? "git_error";
+  if (err instanceof Error && err.name === "WranglerConfigError")
+    return err.code ?? "invalid_config";
   return void 0;
 }
 var API_ERROR_HINTS = {
@@ -428,7 +430,7 @@ function splitTokenPath(token, table) {
   }
   return parts;
 }
-var DESTRUCTIVE_VERBS = /* @__PURE__ */ new Set(["rm", "delete", "remove", "drop", "clear", "undeploy", "kill"]);
+var DESTRUCTIVE_VERBS = /* @__PURE__ */ new Set(["rm", "delete", "remove", "drop", "clear", "undeploy", "kill", "logout"]);
 function editDistance(a, b) {
   const left = a.toLowerCase();
   const right = b.toLowerCase();
@@ -473,11 +475,12 @@ function findUnknownCommand(argv, rootCommands) {
       const split = splitTokenPath(token, table);
       const relativeSuggestion = split ?? closestCommandPath(token, table);
       if (!relativeSuggestion) return null;
+      const guessed = relativeSuggestion.at(-1) ?? "";
       return {
         attemptedPath: ["deepspace", ...accepted, token],
         helpPath: ["deepspace", ...accepted],
         suggestion: ["deepspace", ...accepted, ...relativeSuggestion],
-        executable: !DESTRUCTIVE_VERBS.has(relativeSuggestion.at(-1) ?? ""),
+        executable: split !== null && !DESTRUCTIVE_VERBS.has(guessed),
         ...split ? { quotedToken: true } : {}
       };
     }
@@ -834,7 +837,7 @@ async function provisionProfile(jwt) {
   }
 }
 function sleep(ms) {
-  return new Promise((resolve21) => setTimeout(resolve21, ms));
+  return new Promise((resolve22) => setTimeout(resolve22, ms));
 }
 function base64url(bytes) {
   return bytes.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
@@ -906,9 +909,66 @@ var logout_default = defineDeepspaceCommand({
 });
 
 // src/cli/lib/app-identity.ts
-import { existsSync as existsSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "fs";
-import { join as join2, resolve as resolve2 } from "path";
-import { parse as parseToml } from "smol-toml";
+import { existsSync as existsSync4, readFileSync as readFileSync6, writeFileSync as writeFileSync3 } from "fs";
+import { join as join3, resolve as resolve2 } from "path";
+
+// src/cli/lib/wrangler-env.ts
+import { existsSync as existsSync3, readFileSync as readFileSync5, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
+import { join as join2 } from "path";
+import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
+
+// src/server/rooms/app-name.ts
+var APP_NAME_RULES = {
+  /** ^[a-z0-9](-?[a-z0-9])+$ — RFC 1035 host label, no consecutive dashes. */
+  pattern: /^[a-z0-9](?:-?[a-z0-9])+$/,
+  minLength: 2,
+  maxLength: 63
+};
+function validateAppName(raw) {
+  if (typeof raw !== "string") {
+    return { valid: false, reason: "App name must be a string" };
+  }
+  const name = raw.trim();
+  if (!name) {
+    return { valid: false, reason: "App name is required" };
+  }
+  if (name.length < APP_NAME_RULES.minLength) {
+    return { valid: false, reason: `App name "${name}" is too short (min ${APP_NAME_RULES.minLength} chars)` };
+  }
+  if (name.length > APP_NAME_RULES.maxLength) {
+    return { valid: false, reason: `App name "${name}" is too long (max ${APP_NAME_RULES.maxLength} chars)` };
+  }
+  if (!APP_NAME_RULES.pattern.test(name)) {
+    return {
+      valid: false,
+      reason: `App name "${name}" is invalid. Use lowercase letters, digits, and single hyphens only (must start + end with alphanumeric). Examples: my-app, search-v2, unison-search.`
+    };
+  }
+  return { valid: true, name };
+}
+function resolveAppName(raw) {
+  const strict = validateAppName(raw);
+  if (strict.valid) return { ok: true, name: strict.name };
+  if (typeof raw !== "string") return { ok: false, reason: strict.reason };
+  const trimmed = raw.trim();
+  if (!trimmed) return { ok: false, reason: "App name is required" };
+  const sanitized = sanitizeAppName(trimmed);
+  const sanitizedStrict = validateAppName(sanitized);
+  if (!sanitizedStrict.valid) {
+    return {
+      ok: false,
+      reason: `App name "${trimmed}" can't be sanitized into a valid name (${sanitizedStrict.reason}). Pick something matching: lowercase letters, digits, single hyphens, ${APP_NAME_RULES.minLength}-${APP_NAME_RULES.maxLength} chars.`
+    };
+  }
+  return {
+    ok: true,
+    name: sanitized,
+    warning: `App name "${trimmed}" doesn't conform to deploy rules \u2014 using "${sanitized}" instead. Update wrangler.toml's \`name\` to silence this warning.`
+  };
+}
+function sanitizeAppName(raw) {
+  return raw.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-{2,}/g, "-").replace(/^-+|-+$/g, "");
+}
 
 // src/server/utils/registry-client.ts
 var APP_ID_RE = /^app_[0-9A-HJKMNP-TV-Z]{26}$/;
@@ -937,29 +997,198 @@ function mintUlid(now = Date.now()) {
   return `${ts}${rs}`.slice(0, 26);
 }
 
-// src/cli/lib/app-identity.ts
-function readWranglerIdentityConfig(cwd) {
-  const wranglerPath = join2(resolve2(cwd), "wrangler.toml");
-  if (!existsSync3(wranglerPath)) return null;
+// src/cli/lib/wrangler-env.ts
+var NON_INHERITABLE_ENV_KEYS = /* @__PURE__ */ new Set([
+  "define",
+  "vars",
+  "durable_objects",
+  "kv_namespaces",
+  "r2_buckets",
+  "ai_search_namespaces",
+  "ai_search",
+  "ratelimits",
+  "vectorize",
+  "services",
+  "queues",
+  "workflows",
+  "tail_consumers",
+  "secrets",
+  "secrets_store_secrets"
+]);
+var generatedConfigSeq = 0;
+function resolveAppNameForEnv(config, envName) {
+  if (!envName) {
+    return resolveAppName(config.name);
+  }
+  const envBlock = config.env?.[envName];
+  if (!envBlock) {
+    return {
+      ok: false,
+      code: "missing_env_block",
+      reason: `wrangler.toml: no [env.${envName}] block found. Add one with a distinct \`name\` to deploy this environment.`
+    };
+  }
+  if (typeof envBlock.name !== "string" || envBlock.name.trim() === "") {
+    return {
+      ok: false,
+      reason: `wrangler.toml: [env.${envName}].name is missing. Set a distinct app name (e.g. "${typeof config.name === "string" ? config.name : "myapp"}-${envName}") so this environment doesn't overwrite the default.`
+    };
+  }
+  if (envBlock.name === config.name) {
+    return {
+      ok: false,
+      reason: `wrangler.toml: [env.${envName}].name "${envBlock.name}" is the same as the top-level name. Pick a distinct name (e.g. "${config.name}-${envName}") so deploys don't collide.`
+    };
+  }
+  return resolveAppName(envBlock.name);
+}
+function devVarsPathFor(appDir) {
+  return join2(appDir, ".dev.vars");
+}
+function prepareWranglerEnvConfig(appDir, envName) {
+  if (!envName) return { cleanup() {
+  } };
+  const config = readWranglerConfig(appDir);
+  const resolved = resolveAppNameForEnv(config, envName);
+  if (!resolved.ok) throw new Error(resolved.reason);
+  const flattened = flattenWranglerEnvConfig(config, envName);
+  const configPath = join2(
+    appDir,
+    `.wrangler.deepspace.${safeGeneratedConfigSegment(envName)}.${process.pid}.${++generatedConfigSeq}.toml`
+  );
+  writeFileSync2(
+    configPath,
+    [
+      "# Generated by DeepSpace for this CLI run.",
+      "# Do not edit; wrangler.toml remains the source of truth.",
+      stringifyToml(flattened)
+    ].join("\n").replace(/\s*$/u, "\n")
+  );
+  return {
+    configPath,
+    cleanup() {
+      rmSync2(configPath, { force: true });
+    }
+  };
+}
+function wranglerViteEnv(baseEnv, prepared, extraEnv = {}) {
+  const env = { ...baseEnv, ...extraEnv };
+  if (prepared.configPath) {
+    delete env.CLOUDFLARE_ENV;
+    env.CLOUDFLARE_VITE_WRANGLER_CONFIG_PATH = prepared.configPath;
+  }
+  return env;
+}
+function flattenWranglerEnvConfig(config, envName) {
+  const envRoot = asTomlRecord(config.env);
+  const envBlock = asTomlRecord(envRoot?.[envName]);
+  if (!envBlock) {
+    throw new Error(`wrangler.toml: no [env.${envName}] block found.`);
+  }
+  const flattened = {};
+  for (const [key, value] of Object.entries(config)) {
+    if (key === "env" || NON_INHERITABLE_ENV_KEYS.has(key)) continue;
+    flattened[key] = value;
+  }
+  for (const [key, value] of Object.entries(envBlock)) {
+    flattened[key] = value;
+  }
+  if (!("durable_objects" in envBlock) && config.durable_objects) {
+    flattened.durable_objects = config.durable_objects;
+  }
+  const envVars = asTomlRecord(envBlock.vars) ?? {};
+  if (!("APP_NAME" in envVars) && typeof envBlock.name === "string") {
+    flattened.vars = { ...envVars, APP_NAME: envBlock.name };
+  }
+  return flattened;
+}
+function asTomlRecord(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function safeGeneratedConfigSegment(value) {
+  return value.replace(/[^A-Za-z0-9._-]/gu, "_");
+}
+var WranglerConfigError = class extends Error {
+  constructor(path, message, code = "invalid_config", cause) {
+    super(message);
+    this.path = path;
+    this.code = code;
+    this.cause = cause;
+    this.name = "WranglerConfigError";
+  }
+};
+function causeDetail(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function readWranglerConfigFile(path) {
+  let raw;
   try {
-    return parseToml(readFileSync5(wranglerPath, "utf-8"));
+    raw = readFileSync5(path, "utf-8");
   } catch (err) {
-    throw new InputError(
-      `Could not parse ${wranglerPath}: ${err instanceof Error ? err.message : String(err)}`,
-      "invalid_config"
+    const missing = err?.code === "ENOENT";
+    throw new WranglerConfigError(
+      path,
+      missing ? noWranglerConfigMessage(path) : `wrangler.toml: could not read ${path}: ${causeDetail(err)}`,
+      missing ? "not_in_app_repo" : "invalid_config",
+      err
+    );
+  }
+  let config;
+  try {
+    config = parseToml(raw);
+  } catch (err) {
+    throw new WranglerConfigError(
+      path,
+      `wrangler.toml: malformed TOML at ${path}: ${causeDetail(err)}`,
+      "invalid_config",
+      err
+    );
+  }
+  assertOneSectionPerAppId(config, path);
+  return config;
+}
+function readWranglerConfig(appDir) {
+  return readWranglerConfigFile(join2(appDir, "wrangler.toml"));
+}
+function readAppIdVar(config, envName) {
+  return (envName ? config.env?.[envName]?.vars : config.vars)?.DEEPSPACE_APP_ID;
+}
+function assertOneSectionPerAppId(config, path) {
+  const sections = /* @__PURE__ */ new Map();
+  const record = (section, value) => {
+    if (typeof value !== "string" || !APP_ID_RE.test(value)) return;
+    sections.set(value, [...sections.get(value) ?? [], section]);
+  };
+  record("[vars]", config.vars?.DEEPSPACE_APP_ID);
+  for (const envName of Object.keys(config.env ?? {})) {
+    record(`[env.${envName}.vars]`, config.env?.[envName]?.vars?.DEEPSPACE_APP_ID);
+  }
+  for (const [appId, where] of sections) {
+    if (where.length < 2) continue;
+    throw new WranglerConfigError(
+      path,
+      `wrangler.toml: ${where.join(" and ")} ${where.length === 2 ? "both" : "all"} set DEEPSPACE_APP_ID = "${appId}" in ${path}. One id under several sections points every environment's data, secrets, and billing at the same app while the deploys go to different places \u2014 each environment is its own app \u2014 run \`deepspace app init --env <name>\` to mint one for it.`,
+      "duplicate_app_id"
     );
   }
 }
+function noWranglerConfigMessage(where) {
+  return `No wrangler.toml at ${where}. Are you in a DeepSpace app directory? (Scaffold one with \`npm create deepspace\`, or cd into an existing app.)`;
+}
+function hasWranglerConfig(appDir) {
+  return existsSync3(join2(appDir, "wrangler.toml"));
+}
+
+// src/cli/lib/app-identity.ts
 function readAppId(cwd = process.cwd(), wranglerEnv) {
-  const cfg = readWranglerIdentityConfig(cwd);
-  if (!cfg) return null;
-  const vars = wranglerEnv ? cfg.env?.[wranglerEnv]?.vars : cfg.vars;
-  const id = vars?.DEEPSPACE_APP_ID;
+  const appDir = resolve2(cwd);
+  if (!hasWranglerConfig(appDir)) return null;
+  const id = readAppIdVar(readWranglerConfig(appDir), wranglerEnv);
   return typeof id === "string" && APP_ID_RE.test(id) ? id : null;
 }
 function writeAppId(cwd, appId, opts = {}) {
-  const wranglerPath = join2(resolve2(cwd), "wrangler.toml");
-  if (!existsSync3(wranglerPath)) {
+  const wranglerPath = join3(resolve2(cwd), "wrangler.toml");
+  if (!existsSync4(wranglerPath)) {
     throw new Error(`No wrangler.toml in ${resolve2(cwd)}`);
   }
   const existing = readAppId(cwd, opts.wranglerEnv);
@@ -969,7 +1198,7 @@ function writeAppId(cwd, appId, opts = {}) {
       `wrangler.toml already carries ${existing}. The app id is immutable \u2014 use --new-id only to fork this repo as a separate app.`
     );
   }
-  let src = readFileSync5(wranglerPath, "utf-8");
+  let src = readFileSync6(wranglerPath, "utf-8");
   const header = opts.wranglerEnv ? `[env.${opts.wranglerEnv}.vars]` : "[vars]";
   const line = `DEEPSPACE_APP_ID = "${appId}"`;
   const headerRe = new RegExp(`^\\${header.replace(/\./g, "\\.")}[ \\t]*$`, "m");
@@ -991,19 +1220,7 @@ ${header}
 ${line}
 `;
   }
-  writeFileSync2(wranglerPath, src);
-}
-var APP_ID_PLACEHOLDER = "__APP_ID__";
-function stampAppIdInSources(cwd, appId, previousAppId) {
-  const constantsPath = join2(resolve2(cwd), "src", "constants.ts");
-  if (!existsSync3(constantsPath)) return false;
-  const needles = [APP_ID_PLACEHOLDER, ...previousAppId ? [previousAppId] : []];
-  const content = readFileSync5(constantsPath, "utf-8");
-  let next = content;
-  for (const needle of needles) next = next.replaceAll(needle, appId);
-  if (next === content) return false;
-  writeFileSync2(constantsPath, next);
-  return true;
+  writeFileSync3(wranglerPath, src);
 }
 
 // src/cli/commands/dev.ts
@@ -1011,26 +1228,18 @@ import { resolve as resolve8, basename as basename2, join as join11 } from "path
 import spawn2 from "cross-spawn";
 
 // src/cli/lib/app-context.ts
-import { existsSync as existsSync4, readFileSync as readFileSync6, readdirSync } from "fs";
-import { dirname as dirname3, join as join3, resolve as resolve3 } from "path";
-import { parse as parseToml2 } from "smol-toml";
+import { existsSync as existsSync5, readdirSync } from "fs";
+import { dirname as dirname3, join as join4, resolve as resolve3 } from "path";
 function detectAppName(cwd = process.cwd()) {
-  const wranglerPath = join3(resolve3(cwd), "wrangler.toml");
-  if (!existsSync4(wranglerPath)) return null;
-  try {
-    const config = parseToml2(readFileSync6(wranglerPath, "utf-8"));
-    return typeof config.name === "string" && config.name.length > 0 ? config.name : null;
-  } catch (error) {
-    throw new InputError(
-      `Could not parse ${wranglerPath}: ${error instanceof Error ? error.message : String(error)}`,
-      "invalid_config"
-    );
-  }
+  const appDir = resolve3(cwd);
+  if (!existsSync5(join4(appDir, "wrangler.toml"))) return null;
+  const { name } = readWranglerConfig(appDir);
+  return typeof name === "string" && name.length > 0 ? name : null;
 }
 function findAppDir(start = process.cwd()) {
   let dir = resolve3(start);
   for (; ; ) {
-    if (existsSync4(join3(dir, "wrangler.toml"))) return dir;
+    if (existsSync5(join4(dir, "wrangler.toml"))) return dir;
     const parent = dirname3(dir);
     if (parent === dir) return null;
     dir = parent;
@@ -1038,7 +1247,7 @@ function findAppDir(start = process.cwd()) {
 }
 function findChildApps(dir) {
   try {
-    return readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && existsSync4(join3(dir, entry.name, "wrangler.toml"))).map((entry) => entry.name).sort();
+    return readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && existsSync5(join4(dir, entry.name, "wrangler.toml"))).map((entry) => entry.name).sort();
   } catch {
     return [];
   }
@@ -1046,19 +1255,19 @@ function findChildApps(dir) {
 
 // src/cli/lib/launch-config.ts
 import {
-  existsSync as existsSync5,
+  existsSync as existsSync6,
   readFileSync as readFileSync8,
   realpathSync as realpathSync2,
-  writeFileSync as writeFileSync3,
+  writeFileSync as writeFileSync4,
   mkdirSync as mkdirSync4,
   renameSync,
   unlinkSync
 } from "fs";
-import { join as join5, resolve as resolve5, dirname as dirname5, basename, isAbsolute as isAbsolute2, sep } from "path";
+import { join as join6, resolve as resolve5, dirname as dirname5, basename, isAbsolute as isAbsolute2, sep } from "path";
 
 // src/cli/lib/git/repository.ts
 import { appendFileSync, mkdirSync as mkdirSync3, readFileSync as readFileSync7 } from "fs";
-import { dirname as dirname4, join as join4, resolve as resolve4 } from "path";
+import { dirname as dirname4, join as join5, resolve as resolve4 } from "path";
 
 // src/cli/lib/git/process.ts
 import { sync as spawnSync } from "cross-spawn";
@@ -1262,7 +1471,7 @@ function listWorktrees(cwd) {
 }
 function ensureLocalExclude(cwd, pattern) {
   const commonDir = resolve4(cwd, gitLine(cwd, ["rev-parse", "--git-common-dir"]));
-  const excludePath = join4(commonDir, "info", "exclude");
+  const excludePath = join5(commonDir, "info", "exclude");
   let current = "";
   try {
     current = readFileSync7(excludePath, "utf-8");
@@ -1284,7 +1493,7 @@ function ensureLocalExclude(cwd, pattern) {
 function writeLaunchFile(launchPath, config) {
   mkdirSync4(dirname5(launchPath), { recursive: true });
   const tmpPath = `${launchPath}.${process.pid}.tmp`;
-  writeFileSync3(tmpPath, JSON.stringify(config, null, 2) + "\n");
+  writeFileSync4(tmpPath, JSON.stringify(config, null, 2) + "\n");
   try {
     renameSync(tmpPath, launchPath);
   } catch (err) {
@@ -1297,7 +1506,7 @@ function writeLaunchFile(launchPath, config) {
 }
 function readLaunchFile(launchPath) {
   const empty = { version: "0.0.1", configurations: [] };
-  if (!existsSync5(launchPath)) return empty;
+  if (!existsSync6(launchPath)) return empty;
   const raw = readFileSync8(launchPath, "utf-8").trim();
   if (!raw) return empty;
   const parsed = JSON.parse(raw);
@@ -1305,7 +1514,7 @@ function readLaunchFile(launchPath) {
   return parsed;
 }
 function writeLaunchConfigIfMissing(appDir, appName, port, opts = {}) {
-  const launchPath = join5(appDir, ".claude", "launch.json");
+  const launchPath = join6(appDir, ".claude", "launch.json");
   try {
     const config = readLaunchFile(launchPath);
     if (!config) return;
@@ -1346,7 +1555,7 @@ function writeLaunchConfigIfMissing(appDir, appName, port, opts = {}) {
 }
 function resolveAppLaunchPort(appDir) {
   try {
-    const config = readLaunchFile(join5(appDir, ".claude", "launch.json"));
+    const config = readLaunchFile(join6(appDir, ".claude", "launch.json"));
     if (!config) return null;
     const appName = detectAppName(appDir) ?? basename(appDir);
     const entry = config.configurations.find((c) => c?.name === appName) ?? (config.configurations.length === 1 ? config.configurations[0] : void 0);
@@ -1400,15 +1609,15 @@ function deriveWorktreePort(worktreeKey) {
   return WORKTREE_PORT_MIN + hash % WORKTREE_PORT_RANGE;
 }
 function upsertWorktreeLaunchConfig(mainRepoRoot, worktreeName, appDir, opts) {
-  const launchPath = join5(mainRepoRoot, ".claude", "launch.json");
+  const launchPath = join6(mainRepoRoot, ".claude", "launch.json");
   const entryName = WORKTREE_ENTRY_PREFIX + worktreeName;
   try {
     const config = readLaunchFile(launchPath);
     if (!config) return null;
-    const worktreesRoot = join5(mainRepoRoot, ".claude", "worktrees") + sep;
+    const worktreesRoot = join6(mainRepoRoot, ".claude", "worktrees") + sep;
     config.configurations = config.configurations.filter((c) => {
       if (c?.name === entryName) return false;
-      const isStaleWorktreeEntry = typeof c?.name === "string" && c.name.startsWith(WORKTREE_ENTRY_PREFIX) && typeof c.cwd === "string" && isAbsolute2(c.cwd) && c.cwd.startsWith(worktreesRoot) && !existsSync5(c.cwd);
+      const isStaleWorktreeEntry = typeof c?.name === "string" && c.name.startsWith(WORKTREE_ENTRY_PREFIX) && typeof c.cwd === "string" && isAbsolute2(c.cwd) && c.cwd.startsWith(worktreesRoot) && !existsSync6(c.cwd);
       return !isStaleWorktreeEntry;
     });
     let port = opts.port;
@@ -1443,7 +1652,7 @@ function resolveWorktreePort(appDir) {
   const claude = detectClaudeWorktree(appDir);
   if (claude) {
     try {
-      const config = readLaunchFile(join5(claude.mainRepoRoot, ".claude", "launch.json"));
+      const config = readLaunchFile(join6(claude.mainRepoRoot, ".claude", "launch.json"));
       const entry = config?.configurations.find(
         (c) => c?.name === WORKTREE_ENTRY_PREFIX + claude.worktreeName
       );
@@ -1467,231 +1676,41 @@ async function fetchPublicKey(authUrl) {
 }
 async function mintAppOwnerJwt(authUrl, callerJwt, appId) {
   const response = await fetch(`${authUrl}/api/auth/mint-app-token`, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-      Authorization: `Bearer ${callerJwt}`
-    },
-    body: JSON.stringify({ appId })
-  });
-  if (!response.ok) {
-    const detail = await response.text().catch(() => "");
-    throw new Error(`Failed to mint APP_OWNER_JWT (${response.status}): ${detail}`);
-  }
-  const body = await response.json();
-  if (!body.token) {
-    throw new Error(`Auth worker returned no token: ${body.error ?? "unknown error"}`);
-  }
-  return body.token;
-}
-async function fetchAppIdentityToken(deployUrl, callerJwt, appId) {
-  const response = await fetch(
-    `${deployUrl}/api/apps/${encodeURIComponent(appId)}/identity-token`,
-    {
-      method: "POST",
-      headers: { Authorization: `Bearer ${callerJwt}` }
-    }
-  );
-  if (response.status === 404) return null;
-  if (!response.ok) {
-    const detail = await response.text().catch(() => "");
-    throw new Error(`Failed to fetch APP_IDENTITY_TOKEN (${response.status}): ${detail}`);
-  }
-  const body = await response.json();
-  if (!body.token) {
-    throw new Error(`Deploy worker returned no token: ${body.error ?? "unknown error"}`);
-  }
-  return body.token;
-}
-
-// src/cli/lib/wrangler-env.ts
-import { existsSync as existsSync6, readFileSync as readFileSync9, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
-import { join as join6 } from "path";
-import { parse as parseToml3, stringify as stringifyToml } from "smol-toml";
-
-// src/server/rooms/app-name.ts
-var APP_NAME_RULES = {
-  /** ^[a-z0-9](-?[a-z0-9])+$ — RFC 1035 host label, no consecutive dashes. */
-  pattern: /^[a-z0-9](?:-?[a-z0-9])+$/,
-  minLength: 2,
-  maxLength: 63
-};
-function validateAppName(raw) {
-  if (typeof raw !== "string") {
-    return { valid: false, reason: "App name must be a string" };
-  }
-  const name = raw.trim();
-  if (!name) {
-    return { valid: false, reason: "App name is required" };
-  }
-  if (name.length < APP_NAME_RULES.minLength) {
-    return { valid: false, reason: `App name "${name}" is too short (min ${APP_NAME_RULES.minLength} chars)` };
-  }
-  if (name.length > APP_NAME_RULES.maxLength) {
-    return { valid: false, reason: `App name "${name}" is too long (max ${APP_NAME_RULES.maxLength} chars)` };
-  }
-  if (!APP_NAME_RULES.pattern.test(name)) {
-    return {
-      valid: false,
-      reason: `App name "${name}" is invalid. Use lowercase letters, digits, and single hyphens only (must start + end with alphanumeric). Examples: my-app, search-v2, unison-search.`
-    };
-  }
-  return { valid: true, name };
-}
-function resolveAppName(raw) {
-  const strict = validateAppName(raw);
-  if (strict.valid) return { ok: true, name: strict.name };
-  if (typeof raw !== "string") return { ok: false, reason: strict.reason };
-  const trimmed = raw.trim();
-  if (!trimmed) return { ok: false, reason: "App name is required" };
-  const sanitized = sanitizeAppName(trimmed);
-  const sanitizedStrict = validateAppName(sanitized);
-  if (!sanitizedStrict.valid) {
-    return {
-      ok: false,
-      reason: `App name "${trimmed}" can't be sanitized into a valid name (${sanitizedStrict.reason}). Pick something matching: lowercase letters, digits, single hyphens, ${APP_NAME_RULES.minLength}-${APP_NAME_RULES.maxLength} chars.`
-    };
-  }
-  return {
-    ok: true,
-    name: sanitized,
-    warning: `App name "${trimmed}" doesn't conform to deploy rules \u2014 using "${sanitized}" instead. Update wrangler.toml's \`name\` to silence this warning.`
-  };
-}
-function sanitizeAppName(raw) {
-  return raw.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-{2,}/g, "-").replace(/^-+|-+$/g, "");
-}
-
-// src/cli/lib/wrangler-env.ts
-var NON_INHERITABLE_ENV_KEYS = /* @__PURE__ */ new Set([
-  "define",
-  "vars",
-  "durable_objects",
-  "kv_namespaces",
-  "r2_buckets",
-  "ai_search_namespaces",
-  "ai_search",
-  "ratelimits",
-  "vectorize",
-  "services",
-  "queues",
-  "workflows",
-  "tail_consumers",
-  "secrets",
-  "secrets_store_secrets"
-]);
-var generatedConfigSeq = 0;
-function resolveAppNameForEnv(config, envName) {
-  if (!envName) {
-    return resolveAppName(config.name);
-  }
-  const envBlock = config.env?.[envName];
-  if (!envBlock) {
-    return {
-      ok: false,
-      reason: `wrangler.toml: no [env.${envName}] block found. Add one with a distinct \`name\` to deploy this environment.`
-    };
-  }
-  if (typeof envBlock.name !== "string" || envBlock.name.trim() === "") {
-    return {
-      ok: false,
-      reason: `wrangler.toml: [env.${envName}].name is missing. Set a distinct app name (e.g. "${typeof config.name === "string" ? config.name : "myapp"}-${envName}") so this environment doesn't overwrite the default.`
-    };
-  }
-  if (envBlock.name === config.name) {
-    return {
-      ok: false,
-      reason: `wrangler.toml: [env.${envName}].name "${envBlock.name}" is the same as the top-level name. Pick a distinct name (e.g. "${config.name}-${envName}") so deploys don't collide.`
-    };
-  }
-  return resolveAppName(envBlock.name);
-}
-function devVarsPathFor(appDir) {
-  return join6(appDir, ".dev.vars");
-}
-function prepareWranglerEnvConfig(appDir, envName) {
-  if (!envName) return { cleanup() {
-  } };
-  const config = readWranglerConfig(appDir);
-  const resolved = resolveAppNameForEnv(config, envName);
-  if (!resolved.ok) throw new Error(resolved.reason);
-  const flattened = flattenWranglerEnvConfig(config, envName);
-  const configPath = join6(
-    appDir,
-    `.wrangler.deepspace.${safeGeneratedConfigSegment(envName)}.${process.pid}.${++generatedConfigSeq}.toml`
-  );
-  writeFileSync4(
-    configPath,
-    [
-      "# Generated by DeepSpace for this CLI run.",
-      "# Do not edit; wrangler.toml remains the source of truth.",
-      stringifyToml(flattened)
-    ].join("\n").replace(/\s*$/u, "\n")
-  );
-  return {
-    configPath,
-    cleanup() {
-      rmSync2(configPath, { force: true });
-    }
-  };
-}
-function wranglerViteEnv(baseEnv, prepared, extraEnv = {}) {
-  const env = { ...baseEnv, ...extraEnv };
-  if (prepared.configPath) {
-    delete env.CLOUDFLARE_ENV;
-    env.CLOUDFLARE_VITE_WRANGLER_CONFIG_PATH = prepared.configPath;
-  }
-  return env;
-}
-function flattenWranglerEnvConfig(config, envName) {
-  const envRoot = asTomlRecord(config.env);
-  const envBlock = asTomlRecord(envRoot?.[envName]);
-  if (!envBlock) {
-    throw new Error(`wrangler.toml: no [env.${envName}] block found.`);
-  }
-  const flattened = {};
-  for (const [key, value] of Object.entries(config)) {
-    if (key === "env" || NON_INHERITABLE_ENV_KEYS.has(key)) continue;
-    flattened[key] = value;
-  }
-  for (const [key, value] of Object.entries(envBlock)) {
-    flattened[key] = value;
-  }
-  if (!("durable_objects" in envBlock) && config.durable_objects) {
-    flattened.durable_objects = config.durable_objects;
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${callerJwt}`
+    },
+    body: JSON.stringify({ appId })
+  });
+  if (!response.ok) {
+    const detail = await response.text().catch(() => "");
+    throw new Error(`Failed to mint APP_OWNER_JWT (${response.status}): ${detail}`);
   }
-  const envVars = asTomlRecord(envBlock.vars) ?? {};
-  if (!("APP_NAME" in envVars) && typeof envBlock.name === "string") {
-    flattened.vars = { ...envVars, APP_NAME: envBlock.name };
+  const body = await response.json();
+  if (!body.token) {
+    throw new Error(`Auth worker returned no token: ${body.error ?? "unknown error"}`);
   }
-  return flattened;
-}
-function asTomlRecord(value) {
-  return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
-}
-function safeGeneratedConfigSegment(value) {
-  return value.replace(/[^A-Za-z0-9._-]/gu, "_");
+  return body.token;
 }
-var WranglerConfigError = class extends Error {
-  constructor(path, cause) {
-    const detail = cause instanceof Error ? cause.message : String(cause);
-    super(`wrangler.toml: malformed TOML at ${path}: ${detail}`);
-    this.path = path;
-    this.cause = cause;
-    this.name = "WranglerConfigError";
+async function fetchAppIdentityToken(deployUrl, callerJwt, appId) {
+  const response = await fetch(
+    `${deployUrl}/api/apps/${encodeURIComponent(appId)}/identity-token`,
+    {
+      method: "POST",
+      headers: { Authorization: `Bearer ${callerJwt}` }
+    }
+  );
+  if (response.status === 404) return null;
+  if (!response.ok) {
+    const detail = await response.text().catch(() => "");
+    throw new Error(`Failed to fetch APP_IDENTITY_TOKEN (${response.status}): ${detail}`);
   }
-};
-function readWranglerConfig(appDir) {
-  const path = join6(appDir, "wrangler.toml");
-  const raw = readFileSync9(path, "utf-8");
-  try {
-    return parseToml3(raw);
-  } catch (err) {
-    throw new WranglerConfigError(path, err);
+  const body = await response.json();
+  if (!body.token) {
+    throw new Error(`Deploy worker returned no token: ${body.error ?? "unknown error"}`);
   }
-}
-function hasWranglerConfig(appDir) {
-  return existsSync6(join6(appDir, "wrangler.toml"));
+  return body.token;
 }
 
 // src/cli/lib/dev-vars.ts
@@ -1733,15 +1752,15 @@ async function writeDevVars(appDir, ownerId, callerJwt, wranglerEnv, opts = {})
 }
 
 // src/cli/lib/install-status.ts
-import { existsSync as existsSync8, readFileSync as readFileSync11, realpathSync as realpathSync3 } from "fs";
+import { existsSync as existsSync8, readFileSync as readFileSync10, realpathSync as realpathSync3 } from "fs";
 import { dirname as dirname6, join as join8, resolve as resolve6 } from "path";
 
 // src/cli/lib/package-manager.ts
-import { existsSync as existsSync7, readFileSync as readFileSync10 } from "fs";
+import { existsSync as existsSync7, readFileSync as readFileSync9 } from "fs";
 import { join as join7 } from "path";
 function detectPackageManager(appDir) {
   try {
-    const pkg2 = JSON.parse(readFileSync10(join7(appDir, "package.json"), "utf-8"));
+    const pkg2 = JSON.parse(readFileSync9(join7(appDir, "package.json"), "utf-8"));
     const name = typeof pkg2.packageManager === "string" ? pkg2.packageManager.split("@")[0] : "";
     if (name === "npm" || name === "pnpm" || name === "yarn" || name === "bun") return name;
   } catch {
@@ -1779,7 +1798,7 @@ function ensureInstallReady(appDir) {
   const donePath = join8(sentinelDir, "install.done");
   const logPath = join8(sentinelDir, "install.log");
   if (existsSync8(errPath)) {
-    const detail = readFileSync11(errPath, "utf-8").trimEnd();
+    const detail = readFileSync10(errPath, "utf-8").trimEnd();
     const log29 = existsSync8(logPath) ? ` Full log: ${logPath}.` : "";
     throw new Refusal(
       `Dependency install failed: ${detail}.${log29} Run \`npm install\` (or \`bun install\`) manually, then retry.`,
@@ -1835,7 +1854,7 @@ function canonicalPath2(path) {
 function installWorkerAlive(sentinelDir) {
   const pidPath = join8(sentinelDir, "install.pid");
   if (!existsSync8(pidPath)) return false;
-  const pid = Number(readFileSync11(pidPath, "utf-8").trim());
+  const pid = Number(readFileSync10(pidPath, "utf-8").trim());
   if (!Number.isSafeInteger(pid) || pid <= 0) return false;
   try {
     process.kill(pid, 0);
@@ -2191,11 +2210,7 @@ async function secretsApi(deployUrl, token, path, init = {}) {
   });
   const body = await res.json().catch(() => ({}));
   if (!res.ok) {
-    const err = new Error(body.error ?? `Secrets request failed (${res.status})`);
-    err.status = res.status;
-    err.code = body.code;
-    err.apiPath = path;
-    throw err;
+    throw new ApiError(body.error ?? `Secrets request failed (${res.status})`, res.status, body.code, path);
   }
   return body;
 }
@@ -2400,6 +2415,12 @@ import { join as join10 } from "path";
 import { pathToFileURL } from "url";
 
 // src/server/schemas/registry.ts
+var SYSTEM_ASSIGNED_COLUMNS = /* @__PURE__ */ new Set(["email", "name", "imageUrl", "role"]);
+var SYSTEM_MAINTAINED_COLUMNS = /* @__PURE__ */ new Set(["createdAt", "lastSeenAt"]);
+var SYSTEM_MANAGED_COLUMNS = /* @__PURE__ */ new Set([
+  ...SYSTEM_ASSIGNED_COLUMNS,
+  ...SYSTEM_MAINTAINED_COLUMNS
+]);
 var USERS_COLUMNS = [
   { name: "email", storage: "text", interpretation: "plain" },
   { name: "name", storage: "text", interpretation: "plain" },
@@ -2452,6 +2473,23 @@ function lintSchema(schema) {
   }
   return warnings;
 }
+function lintSchemas(schemas) {
+  return [...schemas.flatMap((schema) => lintSchema(schema)), ...lintSchemaSet(schemas)];
+}
+function lintSchemaSet(schemas) {
+  const warnings = [];
+  if (!schemas.some((schema) => schema.name === "team_members")) {
+    for (const schema of schemas) {
+      const teamRoles = Object.entries(schema.permissions).filter(([, p35]) => [p35.read, p35.update, p35.delete].includes("team")).map(([role]) => role);
+      if (teamRoles.length > 0) {
+        warnings.push(
+          `[${schema.name}] role(s) ${teamRoles.join(", ")} use the 'team' permission level, but no 'team_members' collection is registered. 'team' resolves membership from team_members (teamId, userId, status), so without it those roles are denied everything \u2014 silently. Register a team_members schema or use another level.`
+        );
+      }
+    }
+  }
+  return warnings;
+}
 
 // src/cli/lib/schema-lint.ts
 async function lintProjectSchemas(appDir) {
@@ -2480,15 +2518,20 @@ async function lintProjectSchemas(appDir) {
     return null;
   }
   if (!Array.isArray(schemas)) return null;
-  const findings = [];
-  for (const schema of schemas) {
-    if (!schema || typeof schema !== "object") continue;
+  const wellFormed = schemas.filter((schema) => {
+    if (!schema || typeof schema !== "object") return false;
     try {
-      findings.push(...lintSchema(schema));
+      lintSchema(schema);
+      return true;
     } catch {
+      return false;
     }
+  });
+  try {
+    return lintSchemas(wellFormed);
+  } catch {
+    return null;
   }
-  return findings;
 }
 var MAX_PRINTED_FINDINGS = 5;
 function formatSchemaLintFindings(findings) {
@@ -2508,11 +2551,11 @@ import { createServer, Socket } from "net";
 var DEFAULT_PORT = 5173;
 function isPortListening(port, host, timeoutMs = 500) {
   const target2 = host === "0.0.0.0" || host === "::" ? "127.0.0.1" : host;
-  return new Promise((resolve21) => {
+  return new Promise((resolve22) => {
     const socket = new Socket();
     const done = (listening) => {
       socket.destroy();
-      resolve21(listening);
+      resolve22(listening);
     };
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => done(true));
@@ -2525,7 +2568,7 @@ async function waitForPortListening(port, host, timeoutMs, signal) {
   const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline && !signal?.aborted) {
     if (await isPortListening(port, host)) return true;
-    await new Promise((resolve21) => setTimeout(resolve21, 250));
+    await new Promise((resolve22) => setTimeout(resolve22, 250));
   }
   return false;
 }
@@ -2743,7 +2786,7 @@ Free it with \`${killCmd}\`, or start on another port: \`deepspace dev start --p
 
 // src/cli/commands/kill.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { readFileSync as readFileSync12, readdirSync as readdirSync3, readlinkSync } from "fs";
+import { readFileSync as readFileSync11, readdirSync as readdirSync3, readlinkSync } from "fs";
 import { setTimeout as wait } from "timers/promises";
 var SIGTERM_GRACE_MS = 1500;
 var IS_WIN = process.platform === "win32";
@@ -2894,7 +2937,7 @@ function listenerPidsViaProc(port) {
     for (const f of ["/proc/net/tcp", "/proc/net/tcp6"]) {
       let data;
       try {
-        data = readFileSync12(f, "utf-8");
+        data = readFileSync11(f, "utf-8");
       } catch {
         continue;
       }
@@ -3032,7 +3075,8 @@ function isAlive(pid) {
 }
 
 // src/cli/commands/test.ts
-import { resolve as resolve9 } from "path";
+import { readdirSync as readdirSync4 } from "fs";
+import { join as join13, relative, resolve as resolve9, sep as sep2 } from "path";
 import { sync as spawnSync4 } from "cross-spawn";
 
 // src/cli/lib/playwright.ts
@@ -3061,10 +3105,10 @@ function ensurePlaywright(appDir) {
 }
 
 // src/cli/lib/test-account-service.ts
-import { readFileSync as readFileSync14 } from "fs";
+import { readFileSync as readFileSync13 } from "fs";
 
 // src/testing/accounts.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync13, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync12 } from "fs";
 import { homedir as homedir2 } from "os";
 import { join as join12 } from "path";
 var TEST_ACCOUNTS_PATH = join12(homedir2(), ".deepspace", "test-accounts.json");
@@ -3103,7 +3147,9 @@ function reconcileTestAccountScopes(store, remote, scope) {
   };
 }
 function reconcileTestAccounts(local, remote) {
-  const localById = new Map(local.filter((account) => account.id).map((account) => [account.id, account]));
+  const localById = new Map(
+    local.filter((account) => account.id).map((account) => [account.id, account])
+  );
   return remote.flatMap((account) => {
     const stored = localById.get(account.id);
     return stored ? [{ ...stored, ...account }] : [];
@@ -3132,13 +3178,15 @@ function removeTestAccounts(ids, emails = [], scope = currentTestAccountScope())
 function readTestAccountStore() {
   if (!existsSync11(TEST_ACCOUNTS_PATH)) return { version: 2, scopes: {} };
   try {
-    const raw = JSON.parse(readFileSync13(TEST_ACCOUNTS_PATH, "utf-8"));
+    const raw = JSON.parse(readFileSync12(TEST_ACCOUNTS_PATH, "utf-8"));
     if (Array.isArray(raw)) return { version: 2, scopes: {} };
     if (!raw || typeof raw !== "object") {
       return { version: 2, scopes: {} };
     }
     const candidate = raw;
-    const scopes = candidate.scopes && typeof candidate.scopes === "object" && !Array.isArray(candidate.scopes) ? Object.fromEntries(Object.entries(candidate.scopes).map(([key, value]) => [key, validTestAccounts(value)])) : {};
+    const scopes = candidate.scopes && typeof candidate.scopes === "object" && !Array.isArray(candidate.scopes) ? Object.fromEntries(
+      Object.entries(candidate.scopes).map(([key, value]) => [key, validTestAccounts(value)])
+    ) : {};
     return { version: 2, scopes };
   } catch {
     return { version: 2, scopes: {} };
@@ -3154,14 +3202,14 @@ function validTestAccounts(value) {
 }
 function saveTestAccountStore(store) {
   mkdirSync5(join12(homedir2(), ".deepspace"), { recursive: true });
-  writeFileSync5(TEST_ACCOUNTS_PATH, JSON.stringify(store, null, 2), { mode: 384 });
+  writeSecretFileSync(TEST_ACCOUNTS_PATH, JSON.stringify(store, null, 2));
 }
 
 // src/cli/lib/test-account-service.ts
 var SESSION_COOKIE2 = "__Secure-better-auth.session_token";
 var AUTH_URL4 = process.env.DEEPSPACE_AUTH_URL ?? PLATFORM_URLS.auth;
 function sessionCookie() {
-  const token = readFileSync14(SESSION_PATH, "utf-8").trim();
+  const token = readFileSync13(SESSION_PATH, "utf-8").trim();
   return `${SESSION_COOKIE2}=${encodeURIComponent(token)}`;
 }
 async function fetchRemoteTestAccounts() {
@@ -3190,6 +3238,30 @@ async function createRemoteTestAccount(input) {
   }
   return { ...data, label: data.label ?? null };
 }
+async function recoverRemoteTestAccount(id) {
+  const response = await fetch(`${AUTH_URL4}/api/auth/test-accounts/${id}/credential`, {
+    method: "POST",
+    headers: { Cookie: sessionCookie(), Origin: AUTH_URL4 }
+  });
+  const data = await response.json().catch(() => ({}));
+  if (response.status === 404) {
+    throw new Error(
+      `No test account ${id} on this account. Run \`deepspace test accounts list\` for the current pool.`
+    );
+  }
+  if (!response.ok || typeof data.password !== "string" || typeof data.email !== "string" || typeof data.userId !== "string") {
+    throw new Error(data.error ?? "Failed to re-issue the test account credential");
+  }
+  return {
+    id,
+    email: data.email,
+    userId: data.userId,
+    label: data.label ?? null,
+    name: typeof data.name === "string" ? data.name : null,
+    createdAt: data.createdAt ?? Date.now(),
+    password: data.password
+  };
+}
 async function deleteRemoteTestAccount(id) {
   const response = await fetch(`${AUTH_URL4}/api/auth/test-accounts/${id}`, {
     method: "DELETE",
@@ -3209,6 +3281,28 @@ async function syncTestAccountStore() {
 // src/cli/commands/test.ts
 var DEPLOY_URL2 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 var PLAYWRIGHT_OUTPUT_DIR = ".deepspace/test-results";
+var DEFAULT_SUITE_SPECS = ["tests/smoke.spec.ts", "tests/api.spec.ts"];
+function specsSkippedByDefaultSuite(appDir) {
+  const found = [];
+  const walk = (dir) => {
+    let entries;
+    try {
+      entries = readdirSync4(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (entry.name === "node_modules" || entry.name.startsWith(".")) continue;
+      const full = join13(dir, entry.name);
+      if (entry.isDirectory()) walk(full);
+      else if (entry.name.endsWith(".spec.ts")) {
+        found.push(relative(appDir, full).split(sep2).join("/"));
+      }
+    }
+  };
+  walk(join13(appDir, "tests"));
+  return found.filter((spec) => !DEFAULT_SUITE_SPECS.includes(spec)).sort();
+}
 function playwrightTestArgs(testFiles, flags = {}) {
   return [
     "playwright",
@@ -3328,6 +3422,7 @@ var test_default = defineDeepspaceCommand({
       ensurePlaywright(appDir);
     }
     let exitCode = 0;
+    let skippedSpecs = [];
     switch (suite) {
       case "smoke":
         exitCode = runPlaywright(appDir, ["tests/smoke.spec.ts"], port, wranglerEnv, forwarded);
@@ -3342,20 +3437,20 @@ var test_default = defineDeepspaceCommand({
         if (forwarded.grep || forwarded.project || forwarded.headed) {
           console.error("note: --grep/--project/--headed apply to Playwright suites and are ignored by `unit`");
         }
-        exitCode = runVitest(appDir);
+        exitCode = runVitest(appDir, wranglerEnv);
         break;
       case "all":
-        exitCode = runVitest(appDir);
+        exitCode = runVitest(appDir, wranglerEnv);
         if (exitCode === 0) exitCode = runPlaywright(appDir, [], port, wranglerEnv, forwarded);
         break;
       case "default":
-        exitCode = runPlaywright(
-          appDir,
-          ["tests/smoke.spec.ts", "tests/api.spec.ts"],
-          port,
-          wranglerEnv,
-          forwarded
-        );
+        skippedSpecs = specsSkippedByDefaultSuite(appDir);
+        exitCode = runPlaywright(appDir, [...DEFAULT_SUITE_SPECS], port, wranglerEnv, forwarded);
+        if (skippedSpecs.length > 0) {
+          say(
+            `skipped ${skippedSpecs.length} spec file(s) not in smoke+api (${skippedSpecs.join(", ")}) \u2014 run 'deepspace test run all'`
+          );
+        }
         break;
       default:
         if (suite.endsWith(".spec.ts")) {
@@ -3370,13 +3465,13 @@ Available: smoke, api, e2e, unit, all`,
     }
     if (exitCode !== 0) {
       throw new Refusal(`Test suite '${suite}' failed (exit ${exitCode}).`, "tests_failed", {
-        extra: { suite, port, exitCode }
+        extra: { suite, port, exitCode, skippedSpecs }
       });
     }
-    return { data: { suite, port, appDir, wranglerEnv: wranglerEnv ?? null } };
+    return { data: { suite, port, appDir, wranglerEnv: wranglerEnv ?? null, skippedSpecs } };
   }
 });
-function runPlaywright(appDir, testFiles, port, wranglerEnv, flags) {
+function runSuite(appDir, argv, wranglerEnv, extraEnv = {}) {
   let wranglerConfig;
   try {
     wranglerConfig = prepareWranglerEnvConfig(appDir, wranglerEnv);
@@ -3385,25 +3480,24 @@ function runPlaywright(appDir, testFiles, port, wranglerEnv, flags) {
     return 1;
   }
   try {
-    const result = spawnSync4("npx", playwrightTestArgs(testFiles, flags), {
+    const result = spawnSync4("npx", argv, {
       cwd: appDir,
       stdio: "inherit",
-      env: wranglerViteEnv(process.env, wranglerConfig, {
-        DEEPSPACE_PORT: String(port),
-        PLAYWRIGHT_HTML_OUTPUT_DIR: ".deepspace/playwright-report"
-      })
+      env: wranglerViteEnv(process.env, wranglerConfig, extraEnv)
     });
     return result.status ?? 1;
   } finally {
     wranglerConfig.cleanup();
   }
 }
-function runVitest(appDir) {
-  const result = spawnSync4("npx", ["vitest", "run", "--passWithNoTests"], {
-    cwd: appDir,
-    stdio: "inherit"
+function runPlaywright(appDir, testFiles, port, wranglerEnv, flags = {}) {
+  return runSuite(appDir, playwrightTestArgs(testFiles, flags), wranglerEnv, {
+    DEEPSPACE_PORT: String(port),
+    PLAYWRIGHT_HTML_OUTPUT_DIR: ".deepspace/playwright-report"
   });
-  return result.status ?? 1;
+}
+function runVitest(appDir, wranglerEnv) {
+  return runSuite(appDir, ["vitest", "run", "--passWithNoTests"], wranglerEnv);
 }
 
 // src/cli/commands/screenshot.ts
@@ -3741,6 +3835,107 @@ Failed:
     return { data: { deleted: ok2, requested: targets.length, failures: [] } };
   }
 });
+var recover = defineDeepspaceCommand({
+  meta: {
+    name: "recover",
+    description: "Re-issue the local credential for a test account you own"
+  },
+  args: {
+    email: {
+      type: "string",
+      description: "Email of the test account to recover",
+      required: false
+    },
+    id: {
+      type: "string",
+      description: "ID of the test account to recover",
+      required: false
+    },
+    all: {
+      type: "boolean",
+      description: "Recover every pool account missing a local credential",
+      required: false
+    }
+  },
+  async run({ args }) {
+    const selectors = [args.email, args.id, args.all].filter(Boolean).length;
+    if (selectors === 0) {
+      throw new Refusal("Provide --email <email>, --id <id>, or --all.", "missing_argument");
+    }
+    if (selectors > 1) {
+      throw new Refusal("Provide exactly one of --email, --id, or --all.", "conflicting_arguments");
+    }
+    await ensureToken();
+    let remote;
+    try {
+      remote = await fetchRemoteTestAccounts();
+    } catch (err) {
+      throw new Refusal(`Failed: ${err.message}`, "test_accounts_list_failed");
+    }
+    const localAccounts = loadAllTestAccounts();
+    const known = new Set(localAccounts.map((account) => account.id));
+    const localNames = new Map(
+      localAccounts.flatMap(
+        (account) => account.name ? [[account.email, account.name]] : []
+      )
+    );
+    let targets;
+    if (args.all) {
+      targets = remote.filter((account) => !known.has(account.id));
+      if (targets.length === 0) {
+        if (!args.json) console.log("Every pool account already has a local credential.");
+        return { data: { recovered: [], alreadyLocal: remote.length } };
+      }
+    } else {
+      const match = args.id ? remote.find((account) => account.id === args.id) : remote.find((account) => account.email === args.email);
+      if (!match) {
+        throw new Refusal(
+          `No test account ${args.id ? `with id ${args.id}` : `with email ${args.email}`} on this account.`,
+          "test_account_not_found",
+          { action: cliAction("deepspace", "test", "accounts", "list") }
+        );
+      }
+      targets = [match];
+    }
+    const recovered = [];
+    const failures = [];
+    for (const target2 of targets) {
+      try {
+        const account = await recoverRemoteTestAccount(target2.id);
+        const name = account.name ?? localNames.get(account.email);
+        upsertTestAccount({
+          id: account.id,
+          email: account.email,
+          password: account.password,
+          userId: account.userId,
+          label: account.label,
+          ...name ? { name } : {},
+          createdAt: account.createdAt
+        });
+        recovered.push({ id: account.id, email: account.email });
+      } catch (err) {
+        failures.push({ email: target2.email, error: err.message });
+      }
+    }
+    if (failures.length > 0) {
+      throw new Refusal(
+        `Recovered ${recovered.length}/${targets.length} test account(s).
+Failed:
+` + failures.map((failure) => `  ${failure.email}: ${failure.error}`).join("\n"),
+        "test_account_recover_failed",
+        { extra: { recovered, requested: targets.length, failures } }
+      );
+    }
+    if (!args.json) {
+      for (const account of recovered) console.log(`Recovered ${account.email}`);
+      console.log(
+        `
+Stored in ${TEST_ACCOUNTS_PATH}. The previous password (if any machine still holds one) no longer works \u2014 recover there too.`
+      );
+    }
+    return { data: { recovered, requested: targets.length, failures: [] } };
+  }
+});
 var test_accounts_default = defineCommand2({
   meta: {
     name: "test-accounts",
@@ -3750,14 +3945,15 @@ var test_accounts_default = defineCommand2({
     create,
     list,
     delete: del,
-    clear
+    clear,
+    recover
   }
 });
 
 // src/cli/commands/deploy.ts
 import * as p12 from "@clack/prompts";
 import { defineCommand as defineCommand3 } from "citty";
-import { resolve as resolve13 } from "path";
+import { join as join19, resolve as resolve14 } from "path";
 
 // src/cli/lib/edge-propagation.ts
 import { request as httpRequest } from "http";
@@ -3822,14 +4018,14 @@ async function servesRelease(probe, releaseStamp) {
 }
 function getOnFreshConnection(url, timeoutMs = 5e3) {
   const send = url.protocol === "http:" ? httpRequest : httpsRequest;
-  return new Promise((resolve21) => {
+  return new Promise((resolve22) => {
     const request2 = send(
       url,
       { method: "GET", agent: false, timeout: timeoutMs, headers: { "cache-control": "no-cache" } },
       (response) => {
         if (response.statusCode !== 200) {
           response.resume();
-          resolve21(null);
+          resolve22(null);
           return;
         }
         let body = "";
@@ -3837,20 +4033,20 @@ function getOnFreshConnection(url, timeoutMs = 5e3) {
         response.on("data", (chunk) => {
           if (body.length < 4096) body += chunk;
         });
-        response.on("end", () => resolve21(body));
-        response.on("error", () => resolve21(null));
+        response.on("end", () => resolve22(body));
+        response.on("error", () => resolve22(null));
       }
     );
     request2.on("timeout", () => {
       request2.destroy();
-      resolve21(null);
+      resolve22(null);
     });
-    request2.on("error", () => resolve21(null));
+    request2.on("error", () => resolve22(null));
     request2.end();
   });
 }
 function sleep2(ms) {
-  return new Promise((resolve21) => setTimeout(resolve21, ms));
+  return new Promise((resolve22) => setTimeout(resolve22, ms));
 }
 
 // src/shared/app-files.ts
@@ -3915,36 +4111,49 @@ function describeFilesFailure(status3, body) {
 import * as p6 from "@clack/prompts";
 import { execSync as execSync2 } from "child_process";
 import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync14, lstatSync as lstatSync2, readFileSync as readFileSync17, readdirSync as readdirSync4, unlinkSync as unlinkSync2 } from "fs";
-import { dirname as dirname7, join as join15, resolve as resolve11 } from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync16, readdirSync as readdirSync6 } from "fs";
+import { dirname as dirname7, join as join17, resolve as resolve12 } from "path";
+
+// src/build/plugin.ts
+import { existsSync as existsSync12, lstatSync, readdirSync as readdirSync5, unlinkSync as unlinkSync2 } from "fs";
+import { join as join14, resolve as resolve11 } from "path";
+function removeBuildDevVars(workerDir) {
+  const path = join14(workerDir, ".dev.vars");
+  if (!existsSync12(path)) return false;
+  if (!lstatSync(path).isFile()) {
+    throw new Error(`Refusing unsafe build secret path: ${path}`);
+  }
+  unlinkSync2(path);
+  return true;
+}
 
 // src/documentation/deploy.ts
-import { existsSync as existsSync12, readFileSync as readFileSync15 } from "fs";
-import { join as join13 } from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync14 } from "fs";
+import { join as join15 } from "path";
 function readDocumentationDeployManifest(appDir, clientDir) {
-  if (!existsSync12(join13(appDir, "documentation.json"))) return void 0;
-  const manifestPath = join13(clientDir, "_documentation", "manifest.json");
-  if (!existsSync12(manifestPath)) {
+  if (!existsSync13(join15(appDir, "documentation.json"))) return void 0;
+  const manifestPath = join15(clientDir, "_documentation", "manifest.json");
+  if (!existsSync13(manifestPath)) {
     throw new Error(
       "documentation.json exists but the build produced no documentation manifest. Ensure vite.config.ts includes deepSpaceDocumentation() from deepspace/documentation."
     );
   }
-  return JSON.parse(readFileSync15(manifestPath, "utf8"));
+  return JSON.parse(readFileSync14(manifestPath, "utf8"));
 }
 
 // src/cli/commands/update/app-migrations.ts
 import {
   closeSync,
   constants,
-  existsSync as existsSync13,
+  existsSync as existsSync14,
   fstatSync,
   ftruncateSync,
-  lstatSync,
+  lstatSync as lstatSync2,
   openSync,
-  readFileSync as readFileSync16,
+  readFileSync as readFileSync15,
   writeSync
 } from "fs";
-import { join as join14 } from "path";
+import { join as join16 } from "path";
 
 // src/shared/protocol/app-migrations.ts
 var APP_MIGRATION_ID_RE = /^[a-z0-9][a-z0-9._-]{0,127}$/;
@@ -3996,8 +4205,8 @@ var APP_MIGRATION_DEFINITIONS = SOURCE_MIGRATIONS.map(
   ({ id, description }) => ({ id, description })
 );
 function readAppliedAppMigrations(appDir) {
-  const path = join14(appDir, APP_MIGRATIONS_MANIFEST);
-  if (!existsSync13(path)) return [];
+  const path = join16(appDir, APP_MIGRATIONS_MANIFEST);
+  if (!existsSync14(path)) return [];
   const source = readRegularFile(path);
   let parsed;
   try {
@@ -4023,10 +4232,10 @@ function planAppMigrations(appDir) {
   const edits = [];
   for (const repoPath of tracked) {
     if (!isSourcePath(repoPath, appPrefix)) continue;
-    const absolutePath = join14(repo, repoPath);
+    const absolutePath = join16(repo, repoPath);
     let stat;
     try {
-      stat = lstatSync(absolutePath);
+      stat = lstatSync2(absolutePath);
     } catch {
       continue;
     }
@@ -4060,8 +4269,8 @@ function planAppMigrations(appDir) {
   });
   if (pending.length > 0 && blockers.length === 0) {
     const manifestPath = `${appPrefix}${APP_MIGRATIONS_MANIFEST}`;
-    const absoluteManifestPath = join14(repo, manifestPath);
-    const before = existsSync13(absoluteManifestPath) ? readRegularFile(absoluteManifestPath) : null;
+    const absoluteManifestPath = join16(repo, manifestPath);
+    const before = existsSync14(absoluteManifestPath) ? readRegularFile(absoluteManifestPath) : null;
     const after = `${JSON.stringify([...appliedIds, ...pending.map(({ id }) => id)], null, 2)}
 `;
     if (before !== after) edits.push({ path: manifestPath, before, after });
@@ -4076,13 +4285,13 @@ function planAppMigrations(appDir) {
 function applyAppMigrationPlan(appDir, plan) {
   const repo = repoToplevel(appDir);
   for (const edit of plan.edits) {
-    const absolutePath = join14(repo, edit.path);
-    const current = existsSync13(absolutePath) ? readRegularFile(absolutePath) : null;
+    const absolutePath = join16(repo, edit.path);
+    const current = existsSync14(absolutePath) ? readRegularFile(absolutePath) : null;
     if (current !== edit.before) {
       throw new Error(`Migration input changed after planning: ${edit.path}`);
     }
   }
-  for (const edit of plan.edits) writeRegularFile(join14(repo, edit.path), edit.before, edit.after);
+  for (const edit of plan.edits) writeRegularFile(join16(repo, edit.path), edit.before, edit.after);
 }
 function normalizeEol(source) {
   return source.replaceAll("\r\n", "\n");
@@ -4091,18 +4300,18 @@ function restoreEol(source, checkout) {
   return checkout.includes("\r\n") ? source.replaceAll("\n", "\r\n") : source;
 }
 function readRegularFile(path) {
-  const before = lstatSync(path);
+  const before = lstatSync2(path);
   if (!before.isFile() || before.isSymbolicLink()) {
     throw new Error(`Migration input must be a regular file, not a symlink: ${path}`);
   }
   const fd = openSync(path, constants.O_RDONLY);
   try {
     const opened = fstatSync(fd);
-    const after = lstatSync(path);
+    const after = lstatSync2(path);
     if (!opened.isFile() || opened.dev !== after.dev || opened.ino !== after.ino) {
       throw new Error(`Migration input changed while opening: ${path}`);
     }
-    return readFileSync16(fd, "utf-8");
+    return readFileSync15(fd, "utf-8");
   } finally {
     closeSync(fd);
   }
@@ -4117,18 +4326,18 @@ function writeRegularFile(path, before, after) {
     }
     return;
   }
-  const pathStat = lstatSync(path);
+  const pathStat = lstatSync2(path);
   if (!pathStat.isFile() || pathStat.isSymbolicLink()) {
     throw new Error(`Migration input must be a regular file, not a symlink: ${path}`);
   }
   const fd = openSync(path, constants.O_RDWR);
   try {
     const opened = fstatSync(fd);
-    const currentPath = lstatSync(path);
+    const currentPath = lstatSync2(path);
     if (!opened.isFile() || opened.dev !== currentPath.dev || opened.ino !== currentPath.ino) {
       throw new Error(`Migration input changed while opening: ${path}`);
     }
-    if (readFileSync16(fd, "utf-8") !== before) {
+    if (readFileSync15(fd, "utf-8") !== before) {
       throw new Error(`Migration input changed after planning: ${path}`);
     }
     ftruncateSync(fd, 0);
@@ -4455,22 +4664,12 @@ function findWorkerOwnedNotFoundBlockers(source, file) {
 
 // src/cli/commands/deploy/build.ts
 var RESERVED_RUN_WORKER_FIRST2 = new Set(RESERVED_RUN_WORKER_FIRST);
-function removeBuildDevVars(workerDir) {
-  const path = join15(workerDir, ".dev.vars");
-  if (!existsSync14(path)) return false;
-  const stat = lstatSync2(path);
-  if (!stat.isFile() || stat.isSymbolicLink()) {
-    throw new Error(`Refusing unsafe build secret path: ${path}`);
-  }
-  unlinkSync2(path);
-  return true;
-}
 function declaredCompatibilityDate(config) {
   const declared = config.compatibility_date;
   return typeof declared === "string" && /^\d{4}-\d{2}-\d{2}$/.test(declared) ? declared : null;
 }
 async function buildDeployBundle(options) {
-  const { appDir, appName, envName, output, spinner: spinner2 } = options;
+  const { appDir, appName, appId, envName, output, spinner: spinner2 } = options;
   const junk = removeMacosJunk(appDir);
   if (junk > 0) p6.log.info(`Removed ${junk} macOS metadata file(s) (._*, .DS_Store)`);
   const lintFindings = await lintProjectSchemas(appDir);
@@ -4501,19 +4700,19 @@ async function buildDeployBundle(options) {
     preparedWranglerConfig?.cleanup();
   }
   spinner2.stop(`Built (${Math.round((Date.now() - buildStarted) / 1e3)}s)`);
-  const deployConfigPath = join15(appDir, ".wrangler", "deploy", "config.json");
-  if (!existsSync14(deployConfigPath)) {
+  const deployConfigPath = join17(appDir, ".wrangler", "deploy", "config.json");
+  if (!existsSync15(deployConfigPath)) {
     output.die(
       "Build output config not found at .wrangler/deploy/config.json",
       "build_output_missing"
     );
   }
-  const deployConfig = JSON.parse(readFileSync17(deployConfigPath, "utf-8"));
-  const outputWranglerPath = resolve11(dirname7(deployConfigPath), deployConfig.configPath);
-  if (!existsSync14(outputWranglerPath)) {
+  const deployConfig = JSON.parse(readFileSync16(deployConfigPath, "utf-8"));
+  const outputWranglerPath = resolve12(dirname7(deployConfigPath), deployConfig.configPath);
+  if (!existsSync15(outputWranglerPath)) {
     output.die(`Output wrangler.json not found at ${outputWranglerPath}`, "build_output_missing");
   }
-  const outputConfig = JSON.parse(readFileSync17(outputWranglerPath, "utf-8"));
+  const outputConfig = JSON.parse(readFileSync16(outputWranglerPath, "utf-8"));
   if (outputConfig.name && outputConfig.name !== appName) {
     const envHint = envName ? ` (--env ${envName})` : "";
     output.die(
@@ -4527,12 +4726,12 @@ async function buildDeployBundle(options) {
   } catch (error) {
     output.die(errorMessage(error), "build_output_unsafe");
   }
-  const workerBundlePath = join15(workerDir, outputConfig.main);
-  const clientDir = outputConfig.assets?.directory ? resolve11(workerDir, outputConfig.assets.directory) : null;
-  if (!existsSync14(workerBundlePath)) {
+  const workerBundlePath = join17(workerDir, outputConfig.main);
+  const clientDir = outputConfig.assets?.directory ? resolve12(workerDir, outputConfig.assets.directory) : null;
+  if (!existsSync15(workerBundlePath)) {
     output.die(`Worker bundle not found at ${workerBundlePath}`, "build_output_missing");
   }
-  if (!clientDir || !existsSync14(clientDir)) {
+  if (!clientDir || !existsSync15(clientDir)) {
     return output.die(`Client assets not found at ${clientDir}`, "build_output_missing");
   }
   try {
@@ -4545,7 +4744,9 @@ async function buildDeployBundle(options) {
   const assets = collectAssets(clientDir);
   const assetConfig = readDeployAssetConfig(clientDir);
   spinner2.stop(`Collected ${assets.length} assets`);
-  const workerJs = readFileSync17(workerBundlePath, "utf-8");
+  const appIdRefusal = clientAppIdRefusal(assets, appId, envName);
+  if (appIdRefusal) output.die(appIdRefusal.message, appIdRefusal.code);
+  const workerJs = readFileSync16(workerBundlePath, "utf-8");
   const doBindings = outputConfig.durable_objects?.bindings;
   const sqliteClasses = new Set(
     outputConfig.migrations?.flatMap((migration) => migration.new_sqlite_classes ?? []) ?? []
@@ -4613,18 +4814,56 @@ function oversizedAssetRefusal(assets) {
   if (!tooBig) return null;
   return `${tooBig.path} is ${formatBytes(tooBig.size)}; the per-file limit for deploy assets is ${formatBytes(MAX_DEPLOY_ASSET_FILE_BYTES)}. ${LARGE_MEDIA_HOME}`;
 }
+var CLIENT_CODE_ASSET = /\.(?:js|mjs|html)$/i;
+var APP_ID_LITERAL = /app_[0-9A-HJKMNP-TV-Z]{26}/g;
+var APP_ID_DEFINE = "__DEEPSPACE_APP_ID__";
+var APP_ID_ADOPTION_STEPS = `Point the client at the build-injected id \u2014 the SDK's \`deepspace/build\` supplies it:
+  \u2022 vite.config.ts: import { deepspaceBuild } from 'deepspace/build' and add
+    deepspaceBuild({ appDir: fileURLToPath(new URL('.', import.meta.url)) }) to plugins
+  \u2022 vitest.config.ts: import { appIdDefine } and set define: appIdDefine({ appDir })
+  \u2022 src/constants.ts: declare const __DEEPSPACE_APP_ID__: string; export it as APP_ID
+    (drop the frozen literal)
+Apply all three together: src/constants.ts on its own builds clean and then throws in the browser. A newly scaffolded app already has this.`;
+function clientAppIdRefusal(assets, appId, envName) {
+  const foreign = /* @__PURE__ */ new Map();
+  let unsubstituted;
+  for (const asset of assets) {
+    if (!CLIENT_CODE_ASSET.test(asset.path)) continue;
+    const source = readFileSync16(asset.sourcePath, "utf-8");
+    if (unsubstituted === void 0 && source.includes(APP_ID_DEFINE)) unsubstituted = asset.path;
+    for (const found of source.matchAll(APP_ID_LITERAL)) {
+      if (found[0] !== appId && !foreign.has(found[0])) foreign.set(found[0], asset.path);
+    }
+  }
+  if (unsubstituted !== void 0) {
+    return {
+      code: "app_id_define_unsubstituted",
+      message: `Built client assets still contain \`${APP_ID_DEFINE}\` (first in ${unsubstituted}) \u2014 nothing replaced it at build time. The browser evaluates that identifier and throws ReferenceError before the app renders, so this bundle is a blank page for every visitor. src/constants.ts was moved onto the build-time app id without the build config that supplies it.
+${APP_ID_ADOPTION_STEPS}`
+    };
+  }
+  if (foreign.size === 0) return null;
+  const target2 = envName ? `--env ${envName} (${appId})` : appId;
+  return {
+    code: "app_id_env_mismatch",
+    message: `Built client assets carry a different app id than the one being deployed. Deploying ${target2}, but the bundle contains:
+` + [...foreign].map(([id, path]) => `  \u2022 ${id} in ${path}`).join("\n") + `
+The browser keys its RecordRooms to the id in the bundle, so this would serve ${envName ? `${envName}'s` : "this app's"} worker against another app's data. The usual cause is an app scaffolded before the id was build-injected: src/constants.ts still holds \`export const APP_ID = 'app_\u2026'\` frozen at scaffold time.
+${APP_ID_ADOPTION_STEPS}`
+  };
+}
 var LARGE_MEDIA_HOME = "Large media belongs in your app files (`deepspace app files put`), not in the deploy bundle \u2014 move it out of `public/` and reference it at runtime.";
 function collectAssets(dir) {
   const assets = [];
   const walk = (currentDir, prefix) => {
-    for (const entry of readdirSync4(currentDir, { withFileTypes: true })) {
+    for (const entry of readdirSync6(currentDir, { withFileTypes: true })) {
       if (isDeployAssetControlFile(entry.name)) continue;
-      const fullPath = join15(currentDir, entry.name);
+      const fullPath = join17(currentDir, entry.name);
       const relativePath = prefix ? `${prefix}/${entry.name}` : entry.name;
       if (entry.isDirectory()) {
         walk(fullPath, relativePath);
       } else {
-        const bytes = readFileSync17(fullPath);
+        const bytes = readFileSync16(fullPath);
         assets.push({
           path: `/${relativePath}`,
           hash: createHash2("sha256").update(bytes).digest("hex"),
@@ -4643,9 +4882,9 @@ function readDeployAssetConfig(clientDir) {
     ["_headers", "_headers"],
     ["_redirects", "_redirects"]
   ]) {
-    const filePath = join15(clientDir, file);
-    if (!existsSync14(filePath)) continue;
-    const content = readFileSync17(filePath, "utf8");
+    const filePath = join17(clientDir, file);
+    if (!existsSync15(filePath)) continue;
+    const content = readFileSync16(filePath, "utf8");
     if (content.trim()) config[key] = content;
   }
   return config;
@@ -4659,8 +4898,8 @@ function errorMessage(error) {
 
 // src/cli/commands/deploy/commerce.ts
 import * as p7 from "@clack/prompts";
-import { existsSync as existsSync15 } from "fs";
-import { join as join16 } from "path";
+import { existsSync as existsSync16 } from "fs";
+import { join as join18 } from "path";
 import { pathToFileURL as pathToFileURL2 } from "url";
 
 // src/shared/api-error.ts
@@ -4712,10 +4951,10 @@ function errorMessage2(error) {
   return error instanceof Error ? error.message : String(error);
 }
 async function loadDeclaration(appDir, sourceFile, outputFile, exportName) {
-  const sourcePath = join16(appDir, "src", sourceFile);
-  if (!existsSync15(sourcePath)) return void 0;
+  const sourcePath = join18(appDir, "src", sourceFile);
+  if (!existsSync16(sourcePath)) return void 0;
   const esbuild = await import("esbuild");
-  const outputPath = join16(appDir, ".wrangler", "deploy", outputFile);
+  const outputPath = join18(appDir, ".wrangler", "deploy", outputFile);
   await esbuild.build({
     entryPoints: [sourcePath],
     bundle: true,
@@ -4808,7 +5047,7 @@ Stripe will keep charging them until you cancel. Cancel at the end of their curr
   }
 }
 async function syncSubscriptionPlans(appDir, appName, token, nonInteractive) {
-  if (!existsSync15(join16(appDir, "src", "subscriptions.ts"))) return;
+  if (!existsSync16(join18(appDir, "src", "subscriptions.ts"))) return;
   let plans;
   try {
     plans = await loadDeclaration(
@@ -4863,7 +5102,7 @@ async function syncSubscriptionPlans(appDir, appName, token, nonInteractive) {
   }
 }
 async function syncOneTimeProducts(appDir, appName, token) {
-  if (!existsSync15(join16(appDir, "src", "products.ts"))) return;
+  if (!existsSync16(join18(appDir, "src", "products.ts"))) return;
   let products;
   try {
     products = await loadDeclaration(
@@ -4965,7 +5204,7 @@ function createDeployOutput(json) {
 
 // src/cli/commands/deploy/request.ts
 import * as p10 from "@clack/prompts";
-import { readFileSync as readFileSync18 } from "fs";
+import { readFileSync as readFileSync17 } from "fs";
 
 // src/cli/commands/deploy/repository.ts
 import * as p9 from "@clack/prompts";
@@ -5156,9 +5395,9 @@ function repoApi(deployUrl, token, appId) {
 }
 
 // src/cli/lib/vc-remote.ts
-import { existsSync as existsSync16 } from "fs";
+import { existsSync as existsSync17 } from "fs";
 import { tmpdir } from "os";
-import { isAbsolute as isAbsolute3, relative, resolve as resolve12 } from "path";
+import { isAbsolute as isAbsolute3, relative as relative2, resolve as resolve13 } from "path";
 function spaceRemoteName(environment = DEEPSPACE_ENV) {
   if (environment === "staging") return "space-staging";
   if (environment === "production") return "space";
@@ -5204,14 +5443,14 @@ function entryIsTransient(cwd) {
   const entry = process.argv[1];
   if (!entry) return true;
   if (/[\\/]_npx[\\/]/.test(entry) || entry.startsWith(tmpdir())) return true;
-  const rel = relative(resolve12(cwd), resolve12(entry));
+  const rel = relative2(resolve13(cwd), resolve13(entry));
   return rel === "" || !rel.startsWith("..") && !isAbsolute3(rel);
 }
 function helperEntryUsable(command) {
   const match = /^!(?:DEEPSPACE_ENV=(production|staging) )?'([^']*)' '([^']*)' git-credential$/.exec(command);
   const expectedEnvironment = DEEPSPACE_ENV === "production" ? void 0 : DEEPSPACE_ENV;
   if (!match || match[1] !== expectedEnvironment) return false;
-  return existsSync16(match[2]) && existsSync16(match[3]);
+  return existsSync17(match[2]) && existsSync17(match[3]);
 }
 function credentialHelperCommand(environment = DEEPSPACE_ENV) {
   const entry = process.argv[1];
@@ -5346,12 +5585,6 @@ function classifyPushTransportFailure(error, cwd) {
       error: `A first push to this new app hit your plan's active-app quota. Use \`deepspace app list\` to choose an app to undeploy, or upgrade your plan, then retry.`
     };
   }
-  if (/(?:HTTP |error: )422\b/i.test(message)) {
-    return {
-      code: "source_managed_by_github",
-      error: "This app uses GitHub source. Manage commits with normal Git/GitHub; `deepspace deploy` ships the local working tree without changing Git."
-    };
-  }
   if (/(?:HTTP |error: )429\b/i.test(message)) {
     return {
       code: "rate_limited",
@@ -5361,6 +5594,12 @@ function classifyPushTransportFailure(error, cwd) {
   if (/(?:HTTP |error: )413\b/i.test(message)) {
     return { code: "push_too_large", error: pushTooLargeMessage(cwd) };
   }
+  if (/(?:HTTP |error: )422\b/i.test(message)) {
+    return {
+      code: "source_managed_by_github",
+      error: "This app's source is managed by GitHub, so pushes to the DeepSpace repo are refused. Push to the GitHub repository instead \u2014 `deepspace app status` names it."
+    };
+  }
   return null;
 }
 function pushToSpace(cwd, token, refspec, opts = {}) {
@@ -5732,7 +5971,7 @@ async function pushWithTransientRetry(push) {
       const message = errorMessage3(error);
       const transient = /(?:HTTP |error: )(?:429|503)\b/i.test(message);
       if (transient && attempt < backoffMs.length && Date.now() + backoffMs[attempt] < deadline) {
-        await new Promise((resolve21) => setTimeout(resolve21, backoffMs[attempt]));
+        await new Promise((resolve22) => setTimeout(resolve22, backoffMs[attempt]));
         continue;
       }
       throw error;
@@ -6016,7 +6255,7 @@ async function uploadDeployAssets(options) {
           // against the plan before it touches storage, and a stream body
           // would be sent chunked with no length at all; a retry also needs a
           // body it can send again.
-          body: readFileSync18(asset.sourcePath)
+          body: readFileSync17(asset.sourcePath)
         })
       );
       if (!response.ok) {
@@ -6097,7 +6336,7 @@ async function postWithRetry(url, makeInit, {
       lastError = error;
     }
     if (attempt < attempts) {
-      await new Promise((resolve21) => setTimeout(resolve21, Math.min(8e3, 500 * 2 ** (attempt - 1))));
+      await new Promise((resolve22) => setTimeout(resolve22, Math.min(8e3, 500 * 2 ** (attempt - 1))));
     }
   }
   if (lastResponse) return lastResponse;
@@ -6233,12 +6472,12 @@ var deploy_default = defineCommand3({
   async run({ args }) {
     const output = createDeployOutput(args.json === true);
     preflightNodeVersion("deploy");
-    const appDir = resolve13(args.dir ?? ".");
+    const appDir = resolve14(args.dir ?? ".");
     const selectorRefusal = blankSelectorRefusal(args);
     if (selectorRefusal) output.die(selectorRefusal.error, selectorRefusal.code);
     const envName = typeof args.env === "string" && args.env.trim() ? args.env.trim() : void 0;
     if (!hasWranglerConfig(appDir)) {
-      output.die("No wrangler.toml found. Are you in a DeepSpace app directory?", "not_in_app_repo");
+      output.die(noWranglerConfigMessage(join19(appDir, "wrangler.toml")), "not_in_app_repo");
     }
     try {
       ensureInstallReady(appDir);
@@ -6252,7 +6491,7 @@ var deploy_default = defineCommand3({
     output.showIntro();
     const wranglerConfig = readWranglerConfig(appDir);
     const nameResult = resolveAppNameForEnv(wranglerConfig, envName);
-    if (!nameResult.ok) return output.die(nameResult.reason, "invalid_app_name");
+    if (!nameResult.ok) return output.die(nameResult.reason, nameResult.code ?? "invalid_app_name");
     const declaredName = envName ? wranglerConfig.env?.[envName]?.name : wranglerConfig.name;
     if (declaredName !== nameResult.name) {
       const location = envName ? `[env.${envName}].name` : "`name`";
@@ -6279,6 +6518,13 @@ var deploy_default = defineCommand3({
       );
     }
     p12.log.info(`Id: ${appId}`);
+    const sourceState = await getAppSource(DEPLOY_URL3, token, appId);
+    if (!sourceState.registered) {
+      output.die(
+        `${appId} is not registered. If this repo's id came from an older SDK's scaffold, run \`deepspace app init --new-id\` to register it as a fresh app; a brand-new app dir registers with \`deepspace app init\`.`,
+        "app_not_registered"
+      );
+    }
     const secretsCache = await loadDeploySecrets({
       deployUrl: DEPLOY_URL3,
       appDir,
@@ -6288,12 +6534,17 @@ var deploy_default = defineCommand3({
       token,
       output
     });
-    const sourceState = await getAppSource(DEPLOY_URL3, token, appId);
-    if (!sourceState.registered) {
-      output.die(
-        `${appId} is not registered. If this repo's id came from an older SDK's scaffold, run \`deepspace app init --new-id\` to register it as a fresh app; a brand-new app dir registers with \`deepspace app init\`.`,
-        "app_not_registered"
-      );
+    const ownerJwtRefusal = ownerJwtMissingRefusal(sourceState);
+    if (ownerJwtRefusal) output.die(ownerJwtRefusal.error, ownerJwtRefusal.code);
+    let confirmRename = args.rename === true;
+    const rename2 = pendingRename(sourceState.registeredHost, appName);
+    if (rename2 && !confirmRename) {
+      if (output.nonInteractive) {
+        output.die(renameRefusalMessage(rename2), "rename_required");
+      }
+      const confirmed = await p12.confirm({ message: renamePromptMessage(rename2) });
+      if (p12.isCancel(confirmed) || !confirmed) output.die("Deploy cancelled.", "rename_declined");
+      confirmRename = true;
     }
     const repositoryPreflight = preflightDeployRepository({
       appDir,
@@ -6307,6 +6558,7 @@ var deploy_default = defineCommand3({
     const bundle = await buildDeployBundle({
       appDir,
       appName,
+      appId,
       envName,
       output,
       spinner: spinner2
@@ -6338,7 +6590,7 @@ var deploy_default = defineCommand3({
       appId,
       appName,
       token,
-      rename: args.rename === true,
+      rename: confirmRename,
       claimReleased: args["claim-released"] === true,
       ignoreStale: Boolean(args["ignore-stale"]),
       bundle,
@@ -6405,6 +6657,25 @@ async function syncCommerce(appDir, appId, token, nonInteractive) {
   await syncSubscriptionPlans(appDir, appId, token, nonInteractive);
   await syncOneTimeProducts(appDir, appId, token);
 }
+function ownerJwtMissingRefusal(state) {
+  if (state.onBehalf?.ownerJwtLive !== false) return null;
+  return {
+    code: "owner_jwt_missing",
+    error: "Cannot preserve the existing secrets: this app has no live deployment carrying an APP_OWNER_JWT. Ask the owner to redeploy."
+  };
+}
+function pendingRename(registeredHost, appName) {
+  if (!registeredHost) return null;
+  const [label, ...domain] = registeredHost.split(".");
+  if (label === appName) return null;
+  return { fromHost: registeredHost, toHost: [appName, ...domain].join(".") };
+}
+function renameRefusalMessage(rename2) {
+  return `This deploy renames the app: ${rename2.fromHost} \u2192 ${rename2.toHost}. Confirmation needs an interactive terminal \u2014 re-run with --rename to approve the rename, or \`deepspace app init --new-id\` if you meant a separate app.`;
+}
+function renamePromptMessage(rename2) {
+  return `This deploy renames the app: ${rename2.fromHost} \u2192 ${rename2.toHost}. The URL changes and the old one stops serving right away; data, secrets, and collaborators travel with it. (Meant a separate app? Run \`deepspace app init --new-id\` instead.) Rename?`;
+}
 function blankSelectorRefusal(args) {
   if (args.env !== void 0 && !String(args.env).trim()) {
     return {
@@ -6465,15 +6736,18 @@ function requireAppIdArg(explicit) {
 function liveAppUrl(app2) {
   return app2.status === "active" && app2.deployedAt !== null ? app2.url : null;
 }
-async function listApps(deployUrl, token) {
-  const { apps } = await apiFetch(deployUrl, token, "/api/apps");
-  if (!Array.isArray(apps)) {
+async function listAppsPage(deployUrl, token) {
+  const body = await apiFetch(deployUrl, token, "/api/apps");
+  if (!Array.isArray(body.apps)) {
     throw new InputError(
       `The deploy service at ${deployUrl} returned an unexpected response shape for the app list \u2014 check DEEPSPACE_DEPLOY_URL (is this the service the app lives on?).`,
       "invalid_response"
     );
   }
-  return apps;
+  return { apps: body.apps, pendingTransfers: body.pendingTransfers ?? [] };
+}
+async function listApps(deployUrl, token) {
+  return (await listAppsPage(deployUrl, token)).apps;
 }
 function matchAppSelector(apps, selector) {
   const byId = apps.find((app2) => app2.appId === selector);
@@ -6715,17 +6989,17 @@ var apps_default = defineDeepspaceCommand({
   },
   async run({ args }) {
     const token = await ensureToken();
-    const apps = await listApps(DEPLOY_URL5, token);
+    const { apps, pendingTransfers } = await listAppsPage(DEPLOY_URL5, token);
     if (!args.json) {
-      if (!apps.length) {
+      if (!apps.length && !pendingTransfers.length) {
         console.log("No apps yet. Create one with `npx create-deepspace <name>` and `deepspace deploy`.");
-      } else {
+      } else if (apps.length) {
         const rows = [...apps].sort(
           (left, right) => Number(right.status !== "undeployed") - Number(left.status !== "undeployed")
         );
         const roleOf = (a) => a.role ?? "owner";
         const roleWidth = Math.max(4, ...rows.map((a) => roleOf(a).length));
-        const nameWidth = Math.max(4, ...rows.map((a) => (a.name ?? "\u2014").length));
+        const nameWidth = Math.max(4, ...rows.map((a) => nameCell(a).length));
         const statusWidth = Math.max(6, ...rows.map((a) => a.status.length));
         const idWidth = Math.max(6, ...rows.map((a) => a.appId.length));
         console.log(
@@ -6734,14 +7008,36 @@ var apps_default = defineDeepspaceCommand({
         for (const a of rows) {
           const url = liveAppUrl(a) ?? "(not deployed)";
           console.log(
-            `${(a.name ?? "\u2014").padEnd(nameWidth)}  ${a.status.padEnd(statusWidth)}  ${roleOf(a).padEnd(roleWidth)}  ${a.appId.padEnd(idWidth)}  ${url}`
+            `${nameCell(a).padEnd(nameWidth)}  ${a.status.padEnd(statusWidth)}  ${roleOf(a).padEnd(roleWidth)}  ${a.appId.padEnd(idWidth)}  ${url}`
           );
         }
+        const reserved = rows.filter((a) => a.reservedName && a.reservedUntil);
+        if (reserved.length) {
+          console.log("\nReserved names return to the open pool when they expire:");
+          for (const a of reserved) {
+            console.log(
+              `  ${a.reservedName} \u2014 held for you until ${a.reservedUntil}${a.name ? ` (${a.appId} now serves ${a.name})` : ""}`
+            );
+          }
+        }
+      }
+      if (pendingTransfers.length) {
+        console.log("\nTransfer offers waiting for you:");
+        for (const offer2 of pendingTransfers) {
+          console.log(`  ${offer2.appId} \u2014 expires ${offer2.expiresAt}`);
+        }
+        console.log(
+          "  Accept with `deepspace app transfer accept --app <APP ID>`; `deepspace app transfer status --app <APP ID>` names the offerer."
+        );
       }
     }
-    return { data: { apps } };
+    return { data: { apps, pendingTransfers } };
   }
 });
+function nameCell(app2) {
+  if (app2.name) return app2.name;
+  return app2.reservedName ? `${app2.reservedName} (reserved)` : "\u2014";
+}
 
 // src/cli/commands/logs.ts
 import { defineCommand as defineCommand4 } from "citty";
@@ -7125,37 +7421,37 @@ var usage_default = defineDeepspaceCommand({
 });
 
 // src/cli/commands/add.ts
-import { existsSync as existsSync18, readFileSync as readFileSync20, realpathSync as realpathSync4 } from "fs";
-import { dirname as dirname9, join as join18, resolve as resolve15 } from "path";
+import { existsSync as existsSync19, readFileSync as readFileSync19, realpathSync as realpathSync4 } from "fs";
+import { dirname as dirname9, join as join21, resolve as resolve16 } from "path";
 import { pathToFileURL as pathToFileURL3 } from "url";
 
 // src/cli/commands/feature-installer.ts
 import {
   closeSync as closeSync2,
   copyFileSync,
-  existsSync as existsSync17,
+  existsSync as existsSync18,
   fstatSync as fstatSync2,
   mkdirSync as mkdirSync6,
   mkdtempSync,
   openSync as openSync2,
-  readFileSync as readFileSync19,
+  readFileSync as readFileSync18,
   readSync,
-  readdirSync as readdirSync5,
+  readdirSync as readdirSync7,
   rmSync as rmSync4,
-  writeFileSync as writeFileSync6
+  writeFileSync as writeFileSync5
 } from "fs";
 import { spawnSync as spawnSync6 } from "child_process";
 import { tmpdir as tmpdir2 } from "os";
-import { dirname as dirname8, isAbsolute as isAbsolute4, join as join17, resolve as resolve14 } from "path";
+import { dirname as dirname8, isAbsolute as isAbsolute4, join as join20, resolve as resolve15 } from "path";
 import { fileURLToPath } from "url";
 var NAV_MARKER = "// \u2500\u2500 Features add nav items below this line \u2500\u2500";
 function featurePackageRoot(moduleUrl = import.meta.url) {
   let dir = dirname8(fileURLToPath(moduleUrl));
   for (; ; ) {
-    const packagePath = join17(dir, "package.json");
-    if (existsSync17(packagePath)) {
+    const packagePath = join20(dir, "package.json");
+    if (existsSync18(packagePath)) {
       try {
-        const pkg2 = JSON.parse(readFileSync19(packagePath, "utf-8"));
+        const pkg2 = JSON.parse(readFileSync18(packagePath, "utf-8"));
         if (pkg2.name === "deepspace") return dir;
       } catch {
       }
@@ -7166,13 +7462,13 @@ function featurePackageRoot(moduleUrl = import.meta.url) {
   }
 }
 function hasFeatureCatalog(packageRoot = featurePackageRoot()) {
-  return existsSync17(join17(packageRoot, "features"));
+  return existsSync18(join20(packageRoot, "features"));
 }
 function readFeatureConfig(id, packageRoot = featurePackageRoot()) {
-  const configPath = join17(packageRoot, "features", id, "feature.json");
-  if (!existsSync17(configPath)) return null;
+  const configPath = join20(packageRoot, "features", id, "feature.json");
+  if (!existsSync18(configPath)) return null;
   try {
-    const config = JSON.parse(readFileSync19(configPath, "utf-8"));
+    const config = JSON.parse(readFileSync18(configPath, "utf-8"));
     if (typeof config.id !== "string" || typeof config.name !== "string" || !Array.isArray(config.files)) {
       return null;
     }
@@ -7182,9 +7478,9 @@ function readFeatureConfig(id, packageRoot = featurePackageRoot()) {
   }
 }
 function listFeatureConfigs(packageRoot = featurePackageRoot()) {
-  const featuresDir = join17(packageRoot, "features");
-  if (!existsSync17(featuresDir)) return [];
-  return readdirSync5(featuresDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => readFeatureConfig(entry.name, packageRoot)).filter((config) => config !== null && !config.internal).sort((a, b) => a.id.localeCompare(b.id));
+  const featuresDir = join20(packageRoot, "features");
+  if (!existsSync18(featuresDir)) return [];
+  return readdirSync7(featuresDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => readFeatureConfig(entry.name, packageRoot)).filter((config) => config !== null && !config.internal).sort((a, b) => a.id.localeCompare(b.id));
 }
 function featureCatalog(packageRoot = featurePackageRoot()) {
   return listFeatureConfigs(packageRoot).map((config) => ({
@@ -7221,7 +7517,7 @@ function suggestFeature(featureId, packageRoot = featurePackageRoot()) {
   return closest !== null && closestDistance <= threshold ? closest : null;
 }
 function resolveTargetDir(raw) {
-  return isAbsolute4(raw) ? raw : resolve14(raw);
+  return isAbsolute4(raw) ? raw : resolve15(raw);
 }
 function resolveFeatureDestPath(fileDest, route) {
   const pages = "src/pages/";
@@ -7237,11 +7533,11 @@ function copyFile(src, dest) {
 function copyFileWithImportShift(src, dest, levels) {
   mkdirSync6(dirname8(dest), { recursive: true });
   const prefix = "../".repeat(levels);
-  const shifted = readFileSync19(src, "utf-8").replace(
+  const shifted = readFileSync18(src, "utf-8").replace(
     /(from\s+|import\s+|import\()(['"])(\.\.\/)/g,
     `$1$2${prefix}$3`
   );
-  writeFileSync6(dest, shifted);
+  writeFileSync5(dest, shifted);
 }
 function installFiles(packageRoot, config, targetDir, emit) {
   let copied = 0;
@@ -7250,12 +7546,12 @@ function installFiles(packageRoot, config, targetDir, emit) {
   const preexisting = [];
   const missing = [];
   for (const file of config.files) {
-    const srcPath = join17(packageRoot, "features", config.id, file.src);
+    const srcPath = join20(packageRoot, "features", config.id, file.src);
     const resolvedDest = resolveFeatureDestPath(file.dest, config.route);
-    const destPath = join17(targetDir, resolvedDest);
-    const existed = existsSync17(destPath);
+    const destPath = join20(targetDir, resolvedDest);
+    const existed = existsSync18(destPath);
     if (existed) preexisting.push(resolvedDest);
-    if (!existsSync17(srcPath)) {
+    if (!existsSync18(srcPath)) {
       emit(`   Warning: source not found: ${file.src}`, "stderr");
       if (!existed) missing.push(resolvedDest);
       continue;
@@ -7292,11 +7588,11 @@ function unresolvedSchema(schema, reason, emit) {
 }
 function integrateSchema(config, targetDir, emit) {
   if (!config.schema) return [];
-  const schemasPath = join17(targetDir, "src", "schemas.ts");
-  if (!existsSync17(schemasPath)) {
+  const schemasPath = join20(targetDir, "src", "schemas.ts");
+  if (!existsSync18(schemasPath)) {
     return [unresolvedSchema(config.schema, "src/schemas.ts was not found.", emit)];
   }
-  let content = readFileSync19(schemasPath, "utf-8");
+  let content = readFileSync18(schemasPath, "utf-8");
   const { exportName, importPath, spreadOperator } = config.schema;
   const importPattern = new RegExp(`^import\\s+\\{[^}]*\\b${exportName}\\b`, "m");
   if (importPattern.test(content)) {
@@ -7327,7 +7623,7 @@ export const schemas`
     return [unresolvedSchema(config.schema, reason, emit)];
   }
   content = withEntry;
-  writeFileSync6(schemasPath, content);
+  writeFileSync5(schemasPath, content);
   emit(`   Schema integrated: ${exportName} -> schemas.ts`);
   return [];
 }
@@ -7349,11 +7645,11 @@ function unresolvedActions(actions, reason, emit) {
 }
 function integrateActions(config, targetDir, emit) {
   if (!config.actions?.length) return [];
-  const actionsPath = join17(targetDir, "src", "actions", "index.ts");
-  if (!existsSync17(actionsPath)) {
+  const actionsPath = join20(targetDir, "src", "actions", "index.ts");
+  if (!existsSync18(actionsPath)) {
     return [unresolvedActions(config.actions, "src/actions/index.ts was not found.", emit)];
   }
-  let content = readFileSync19(actionsPath, "utf-8");
+  let content = readFileSync18(actionsPath, "utf-8");
   const registryPattern = /export const actions:\s*Record<string,\s*ActionHandler(?:<[^>]*>)?>\s*=\s*\{/;
   if (!registryPattern.test(content)) {
     const reason = "src/actions/index.ts has an unexpected structure.";
@@ -7393,14 +7689,14 @@ ${registryEntry}`);
     integrated++;
     emit(`   Action integrated: ${action.registerAs} (${action.exportName})`);
   }
-  if (integrated > 0) writeFileSync6(actionsPath, content);
+  if (integrated > 0) writeFileSync5(actionsPath, content);
   return unresolved;
 }
 function integrateCode(config, targetDir, emit) {
   const unresolved = [];
   for (const insertion of config.code ?? []) {
-    const targetPath = join17(targetDir, insertion.file);
-    if (!existsSync17(targetPath)) {
+    const targetPath = join20(targetDir, insertion.file);
+    if (!existsSync18(targetPath)) {
       unresolved.push({
         area: "code",
         reason: `${insertion.file} was not found.`,
@@ -7408,7 +7704,7 @@ function integrateCode(config, targetDir, emit) {
       });
       continue;
     }
-    const original = readFileSync19(targetPath, "utf-8");
+    const original = readFileSync18(targetPath, "utf-8");
     if (original.includes(insertion.insert.trim())) {
       emit(`   Integration already present: ${insertion.file}`);
       continue;
@@ -7438,35 +7734,35 @@ ${content.slice(
     const prefix = insertion.placement === "before" ? "" : "\n";
     const suffix = insertion.placement === "before" ? "\n" : "";
     content = `${content.slice(0, insertAt)}${prefix}${insertion.insert}${suffix}${content.slice(insertAt)}`;
-    writeFileSync6(targetPath, content);
+    writeFileSync5(targetPath, content);
     emit(`   Integrated: ${insertion.file}`);
   }
   return unresolved;
 }
 function integrateIgnore(config, targetDir) {
   if (!config.ignore?.length) return;
-  const targetPath = join17(targetDir, ".gitignore");
-  const current = existsSync17(targetPath) ? readFileSync19(targetPath, "utf-8") : "";
+  const targetPath = join20(targetDir, ".gitignore");
+  const current = existsSync18(targetPath) ? readFileSync18(targetPath, "utf-8") : "";
   const present = new Set(current.split(/\r?\n/).map((line) => line.trim()));
   const missing = config.ignore.filter((pattern) => !present.has(pattern));
   if (missing.length === 0) return;
   const separator = current === "" || current.endsWith("\n") ? "" : "\n";
-  writeFileSync6(targetPath, `${current}${separator}${missing.join("\n")}
+  writeFileSync5(targetPath, `${current}${separator}${missing.join("\n")}
 `);
 }
 function integrateWrangler(config, targetDir, emit) {
   const runWorkerFirst = config.wrangler?.runWorkerFirst === true;
   const rateLimits = config.wrangler?.rateLimits ?? [];
   if (!runWorkerFirst && rateLimits.length === 0) return [];
-  const targetPath = join17(targetDir, "wrangler.toml");
+  const targetPath = join20(targetDir, "wrangler.toml");
   const steps = [
     ...runWorkerFirst ? ["Set assets.run_worker_first = true in wrangler.toml."] : [],
     ...rateLimits.map((binding) => `Add the ${binding.name} rate-limit binding to wrangler.toml.`)
   ];
-  if (!existsSync17(targetPath)) {
+  if (!existsSync18(targetPath)) {
     return [{ area: "wrangler", reason: "wrangler.toml was not found.", steps }];
   }
-  let source = readFileSync19(targetPath, "utf-8");
+  let source = readFileSync18(targetPath, "utf-8");
   if (runWorkerFirst && !/^\[assets\]\s*$/m.test(source)) {
     return [{ area: "wrangler", reason: "wrangler.toml has no [assets] section.", steps }];
   }
@@ -7488,7 +7784,7 @@ ${rateLimitBindingBlock(scope, binding)}
     }
   }
   if (changed) {
-    writeFileSync6(targetPath, source);
+    writeFileSync5(targetPath, source);
     emit("   Integrated: wrangler.toml");
   } else emit("   Integration already present: wrangler.toml");
   return [];
@@ -7542,8 +7838,8 @@ function rateLimitBindingBlock(scope, binding) {
 }
 function integrateCss(packageRoot, config, targetDir, emit) {
   if (!config.css?.length) return [];
-  const stylesPath = join17(targetDir, "src", "styles.css");
-  if (!existsSync17(stylesPath)) {
+  const stylesPath = join20(targetDir, "src", "styles.css");
+  if (!existsSync18(stylesPath)) {
     emit("   Warning: Cannot integrate CSS \u2014 src/styles.css not found");
     return [
       {
@@ -7555,12 +7851,12 @@ function integrateCss(packageRoot, config, targetDir, emit) {
       }
     ];
   }
-  let styles = readFileSync19(stylesPath, "utf-8");
+  let styles = readFileSync18(stylesPath, "utf-8");
   let integrated = 0;
   const unresolved = [];
   for (const cssFile of config.css) {
-    const srcPath = join17(packageRoot, "features", config.id, cssFile);
-    if (!existsSync17(srcPath)) {
+    const srcPath = join20(packageRoot, "features", config.id, cssFile);
+    if (!existsSync18(srcPath)) {
       emit(`   Warning: CSS source not found: ${cssFile}`, "stderr");
       unresolved.push({
         area: "css",
@@ -7569,7 +7865,7 @@ function integrateCss(packageRoot, config, targetDir, emit) {
       });
       continue;
     }
-    const css = readFileSync19(srcPath, "utf-8");
+    const css = readFileSync18(srcPath, "utf-8");
     const fingerprint = css.match(/\.([\w-]+)\s*\{|@keyframes\s+([\w-]+)/);
     const marker = fingerprint?.[1] ?? fingerprint?.[2];
     if (marker && styles.includes(marker)) {
@@ -7581,7 +7877,7 @@ ${css}`;
     integrated++;
     emit(`   CSS integrated: ${cssFile} -> styles.css`);
   }
-  if (integrated > 0) writeFileSync6(stylesPath, styles);
+  if (integrated > 0) writeFileSync5(stylesPath, styles);
   return unresolved;
 }
 function unresolvedRoute(route, config, reason, emit) {
@@ -7603,11 +7899,11 @@ function routeRolesSuffix(route) {
 }
 function integrateRoute(config, targetDir, emit) {
   if (!config.route) return [];
-  const navPath = join17(targetDir, "src", "nav.ts");
-  if (!existsSync17(navPath)) {
+  const navPath = join20(targetDir, "src", "nav.ts");
+  if (!existsSync18(navPath)) {
     return [unresolvedRoute(config.route, config, "src/nav.ts was not found.", emit)];
   }
-  let content = readFileSync19(navPath, "utf-8");
+  let content = readFileSync18(navPath, "utf-8");
   const routePath = config.route.path;
   if (content.includes(`'${routePath}'`)) {
     emit(`   Nav already present: ${routePath}`);
@@ -7628,7 +7924,7 @@ function integrateRoute(config, targetDir, emit) {
   const entry = `  { path: '${routePath}', label: '${config.name}'${roles} },`;
   content = content.replace(NAV_MARKER, `${NAV_MARKER}
 ${entry}`);
-  writeFileSync6(navPath, content);
+  writeFileSync5(navPath, content);
   emit(`   Nav wired: ${routePath} (${config.name})`);
   emit("   Route: automatic (file-based routing via src/pages/)");
   return [];
@@ -7654,10 +7950,10 @@ function runPackageInstall(packageManager, targetDir, outputVisible) {
     const child = spawnSync6(packageManager, ["install"], { ...options, stdio: "inherit" });
     return { error: child.error, status: child.status };
   }
-  const captureDir = mkdtempSync(join17(tmpdir2(), "deepspace-add-install-"));
+  const captureDir = mkdtempSync(join20(tmpdir2(), "deepspace-add-install-"));
   let outputFd;
   try {
-    outputFd = openSync2(join17(captureDir, "output.log"), "w+");
+    outputFd = openSync2(join20(captureDir, "output.log"), "w+");
     const child = spawnSync6(packageManager, ["install"], {
       ...options,
       stdio: ["ignore", outputFd, outputFd]
@@ -7681,14 +7977,14 @@ function integrateDependencies(config, targetDir, runInstall, outputVisible, emi
   if (declarations.every(({ values }) => !values || Object.keys(values).length === 0)) {
     return { added: [], installRan: false, packageManager };
   }
-  const packagePath = join17(targetDir, "package.json");
-  if (!existsSync17(packagePath)) {
+  const packagePath = join20(targetDir, "package.json");
+  if (!existsSync18(packagePath)) {
     emit("   Could not patch package.json (file not found)");
     return { added: [], installRan: false, packageManager };
   }
   let pkg2;
   try {
-    pkg2 = JSON.parse(readFileSync19(packagePath, "utf-8"));
+    pkg2 = JSON.parse(readFileSync18(packagePath, "utf-8"));
   } catch (error) {
     emit(
       `   Could not patch package.json (parse error: ${error instanceof Error ? error.message : String(error)})`
@@ -7712,7 +8008,7 @@ function integrateDependencies(config, targetDir, runInstall, outputVisible, emi
   if (added.length === 0) {
     emit("   Dependencies already present");
   } else {
-    writeFileSync6(packagePath, `${JSON.stringify(pkg2, null, 2)}
+    writeFileSync5(packagePath, `${JSON.stringify(pkg2, null, 2)}
 `, "utf-8");
     emit(`   Added to package.json: ${added.map(({ name }) => name).join(", ")}`);
     if (skipped.length) emit(`   Already present (kept your version): ${skipped.join(", ")}`);
@@ -7748,7 +8044,7 @@ ${child.diagnosticTail}` : "";
 }
 function dependencySnapshot(targetDir) {
   try {
-    const pkg2 = JSON.parse(readFileSync19(join17(targetDir, "package.json"), "utf-8"));
+    const pkg2 = JSON.parse(readFileSync18(join20(targetDir, "package.json"), "utf-8"));
     return {
       dependencies: pkg2.dependencies ?? {},
       devDependencies: pkg2.devDependencies ?? {}
@@ -7760,7 +8056,7 @@ function dependencySnapshot(targetDir) {
 function installedNavFeatures(packageRoot, targetDir) {
   return listFeatureConfigs(packageRoot).filter((feature) => feature.category === "nav" && feature.files.length > 0).filter((feature) => {
     const signature = resolveFeatureDestPath(feature.files[0].dest, feature.route);
-    return existsSync17(join17(targetDir, signature));
+    return existsSync18(join20(targetDir, signature));
   }).map((feature) => feature.id);
 }
 function warnNavConflicts(packageRoot, config, targetDir, emit) {
@@ -7993,11 +8289,11 @@ function renderFeatureInfo(config) {
   return lines.join("\n");
 }
 function isDeepSpaceApp(dir) {
-  if (existsSync18(join18(dir, "wrangler.toml"))) return true;
-  const packagePath = join18(dir, "package.json");
-  if (!existsSync18(packagePath)) return false;
+  if (existsSync19(join21(dir, "wrangler.toml"))) return true;
+  const packagePath = join21(dir, "package.json");
+  if (!existsSync19(packagePath)) return false;
   try {
-    const pkg2 = JSON.parse(readFileSync20(packagePath, "utf-8"));
+    const pkg2 = JSON.parse(readFileSync19(packagePath, "utf-8"));
     return Boolean(pkg2.dependencies?.deepspace || pkg2.devDependencies?.deepspace);
   } catch {
     return false;
@@ -8006,8 +8302,8 @@ function isDeepSpaceApp(dir) {
 function installedPackageRoot(fromDir) {
   let dir = fromDir;
   for (; ; ) {
-    const candidate = join18(dir, "node_modules", "deepspace");
-    if (existsSync18(join18(candidate, "package.json"))) return candidate;
+    const candidate = join21(dir, "node_modules", "deepspace");
+    if (existsSync19(join21(candidate, "package.json"))) return candidate;
     const parent = dirname9(dir);
     if (parent === dir) return null;
     dir = parent;
@@ -8024,9 +8320,9 @@ async function targetInstaller(appDir) {
   if (realpathSync4(installedRoot) === realpathSync4(featurePackageRoot())) {
     return { installFeature };
   }
-  const entry = join18(installedRoot, "dist", "feature-installer.js");
-  const catalog = join18(installedRoot, "features");
-  if (!existsSync18(entry) || !existsSync18(catalog)) {
+  const entry = join21(installedRoot, "dist", "feature-installer.js");
+  const catalog = join21(installedRoot, "features");
+  if (!existsSync19(entry) || !existsSync19(catalog)) {
     throw new Refusal(
       `The app's installed deepspace package does not contain the typed feature installer.
 Expected: ${entry}
@@ -8118,8 +8414,8 @@ var add_default = defineDeepspaceCommand({
       }
       return { data: { features: featureCatalog(root) } };
     }
-    const appDir = resolve15(args.dir ?? ".");
-    if (!existsSync18(appDir)) {
+    const appDir = resolve16(args.dir ?? ".");
+    if (!existsSync19(appDir)) {
       throw new Refusal(
         `Target directory not found: ${appDir}
 Create a new app first: deepspace app create <name>`,
@@ -8199,11 +8495,11 @@ function fmtDate(iso) {
   if (!iso) return "\u2014";
   return iso.slice(0, 10);
 }
-async function confirm4(message) {
+async function confirm5(message) {
   process.stdout.write(`${message} [y/N] `);
-  const answer = await new Promise((resolve21) => {
+  const answer = await new Promise((resolve22) => {
     process.stdin.setEncoding("utf-8");
-    process.stdin.once("data", (data) => resolve21(data.toString().trim().toLowerCase()));
+    process.stdin.once("data", (data) => resolve22(data.toString().trim().toLowerCase()));
   });
   process.stdin.pause();
   return answer === "y" || answer === "yes";
@@ -8278,7 +8574,7 @@ var buy = defineDeepspaceCommand({
           "confirmation_required"
         );
       }
-      const ok2 = await confirm4(
+      const ok2 = await confirm5(
         `Buy ${domain} for ${price}/yr (auto-renews; non-refundable), attach to ${appId}? Provisioning takes ${expectedTime}.`
       );
       if (!ok2) {
@@ -8448,7 +8744,7 @@ var detach = defineDeepspaceCommand({
           "confirmation_required"
         );
       }
-      const ok2 = await confirm4(
+      const ok2 = await confirm5(
         `Detach ${domain}? Routing will stop; the domain stays registered (auto-renew is unchanged).`
       );
       if (!ok2) {
@@ -8494,8 +8790,8 @@ var domain_default = defineCommand5({
 
 // src/cli/commands/app-files.ts
 import { defineCommand as defineCommand6 } from "citty";
-import { basename as basename4, resolve as resolve16 } from "path";
-import { existsSync as existsSync19, statSync as statSync2 } from "fs";
+import { basename as basename4, resolve as resolve17 } from "path";
+import { existsSync as existsSync20, statSync as statSync2 } from "fs";
 
 // src/cli/lib/app-files-api.ts
 import { createWriteStream, openAsBlob, statSync } from "fs";
@@ -8773,8 +9069,8 @@ var put = defineDeepspaceCommand({
     app: { type: "string", description: "App id or live name (defaults to ./wrangler.toml)" }
   },
   async run({ args }) {
-    const localPath = resolve16(String(args.file));
-    if (!existsSync19(localPath) || !statSync2(localPath).isFile()) {
+    const localPath = resolve17(String(args.file));
+    if (!existsSync20(localPath) || !statSync2(localPath).isFile()) {
       throw new Refusal(`No such file: ${args.file}`, "file_not_found");
     }
     const key = requireKey(args.key ?? basename4(localPath));
@@ -8874,7 +9170,7 @@ var get = defineDeepspaceCommand({
   },
   async run({ args }) {
     const key = requireKey(String(args.key));
-    const destination = resolve16(String(args.out ?? basename4(key)));
+    const destination = resolve17(String(args.out ?? basename4(key)));
     const { token, appId } = await target(args.app);
     const result = await downloadAppFile(PLATFORM_URL, token, appId, key, destination);
     if (!args.json) console.log(`\u2713 ${key} \u2192 ${destination} (${formatBytes(result.bytes)})`);
@@ -8954,7 +9250,10 @@ var list4 = defineDeepspaceCommand({
   }
 });
 var add = defineDeepspaceCommand({
-  meta: { name: "add", description: "Authorize someone to deploy your app" },
+  meta: {
+    name: "add",
+    description: "Authorize someone to deploy your app \u2014 a collaborator can also read and change every app secret (plaintext); they cannot undeploy or transfer"
+  },
   args: {
     email: {
       type: "positional",
@@ -9164,7 +9463,11 @@ var offer = defineDeepspaceCommand({
       if (replaced) console.log(`\u25B2 Replaced the pending offer to ${pendingTo}.`);
       console.log(
         `\u2713 Offered ${app2} to ${email} (expires ${expiresAt}).
-  They accept with: deepspace app transfer accept --app ${app2}`
+  They accept with: deepspace app transfer accept --app ${app2}
+  (it also shows in their \`deepspace app list\`)
+\u25B2 On acceptance you lose ALL access to ${app2} \u2014 you are not kept on as a
+  collaborator. Only the new owner can add you back. Collaborators you added
+  stay on the app for the new owner.`
       );
     }
     return {
@@ -9191,7 +9494,9 @@ var status2 = defineDeepspaceCommand({
       return { data: { app: app2, transfer: null } };
     }
     if (!args.json) {
-      console.log(`Pending: ${app2} \u2192 ${transfer.toEmailDisplay} (expires ${transfer.expiresAt}).`);
+      console.log(
+        `Pending: ${app2} \u2014 from ${transfer.fromEmailDisplay} to ${transfer.toEmailDisplay} (expires ${transfer.expiresAt}).`
+      );
     }
     return { data: { app: app2, transfer } };
   }
@@ -9211,15 +9516,32 @@ var accept2 = defineDeepspaceCommand({
       const msg = err instanceof Error ? err.message : String(err);
       throw new Refusal(msg, msg.startsWith("No app id") ? "not_in_app_repo" : "invalid_app");
     }
-    await apiFetch(DEPLOY_URL10, token, `/api/apps/${encodeURIComponent(app2)}/transfer/accept`, {
+    const { replayed, acceptedAt, inheritedCollaborators } = await apiFetch(DEPLOY_URL10, token, `/api/apps/${encodeURIComponent(app2)}/transfer/accept`, {
       method: "POST"
     });
     if (!args.json) {
       console.log(
-        `\u2713 You now own ${app2}. Run \`deepspace app init\` in a fresh clone (or set DEEPSPACE_APP_ID = "${app2}" in wrangler.toml) and deploy.`
+        replayed ? `\u2022 ${app2} is already yours${acceptedAt ? ` (since ${acceptedAt})` : ""} \u2014 no pending offer was accepted. Run \`deepspace app list\` to see any other offers.` : `\u2713 You now own ${app2}. Run \`deepspace app init\` in a fresh clone (or set DEEPSPACE_APP_ID = "${app2}" in wrangler.toml) and deploy.`
       );
+      if (!replayed && inheritedCollaborators === void 0) {
+        console.log(
+          `\u25B2 Could not list collaborators the previous owner may have left on the app \u2014 review with \`deepspace app collaborators list --app ${app2}\`.`
+        );
+      } else if (!replayed && inheritedCollaborators && inheritedCollaborators.length > 0) {
+        console.log(
+          `\u25B2 ${inheritedCollaborators.length} collaborator(s) added by the previous owner stay on the app with deploy and secrets access \u2014 review with \`deepspace app collaborators list --app ${app2}\`.`
+        );
+      }
     }
-    return { data: { app: app2, accepted: true } };
+    return {
+      data: {
+        app: app2,
+        accepted: !replayed,
+        replayed: replayed === true,
+        ...acceptedAt ? { acceptedAt } : {},
+        ...inheritedCollaborators === void 0 ? {} : { inheritedCollaborators }
+      }
+    };
   }
 });
 var cancel4 = defineDeepspaceCommand({
@@ -9244,7 +9566,7 @@ var transfer_default = defineCommand8({
 import { defineCommand as defineCommand9 } from "citty";
 
 // src/cli/commands/_invoke-impl.ts
-import { readFileSync as readFileSync21 } from "fs";
+import { readFileSync as readFileSync20 } from "fs";
 import * as p15 from "@clack/prompts";
 var API_URL7 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
 var DEFAULT_TIMEOUT_MS = 12e4;
@@ -9285,7 +9607,7 @@ function resolveBody(opts) {
   if (opts.body != null) {
     raw = opts.body;
   } else if (opts.bodyFile != null) {
-    raw = opts.bodyFile === "-" ? readFileSync21(0, "utf-8") : readFileSync21(opts.bodyFile, "utf-8");
+    raw = opts.bodyFile === "-" ? readFileSync20(0, "utf-8") : readFileSync20(opts.bodyFile, "utf-8");
   } else {
     return "{}";
   }
@@ -9579,8 +9901,8 @@ var integrations_default = defineCommand9({
 
 // src/cli/commands/feedback.ts
 import * as p16 from "@clack/prompts";
-import { existsSync as existsSync20, readFileSync as readFileSync22 } from "fs";
-import { dirname as dirname10, join as join19 } from "path";
+import { existsSync as existsSync21, readFileSync as readFileSync21 } from "fs";
+import { dirname as dirname10, join as join22 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { release } from "os";
 var API_URL8 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
@@ -9603,12 +9925,12 @@ function readCliVersion() {
   try {
     const here = dirname10(fileURLToPath2(import.meta.url));
     const candidates = [
-      join19(here, "..", "package.json"),
-      join19(here, "..", "..", "..", "package.json")
+      join22(here, "..", "package.json"),
+      join22(here, "..", "..", "..", "package.json")
     ];
     for (const path of candidates) {
-      if (!existsSync20(path)) continue;
-      const pkg2 = JSON.parse(readFileSync22(path, "utf-8"));
+      if (!existsSync21(path)) continue;
+      const pkg2 = JSON.parse(readFileSync21(path, "utf-8"));
       if (pkg2.name === "deepspace" && pkg2.version) return pkg2.version;
     }
   } catch {
@@ -9804,7 +10126,7 @@ Context: deepspace ${payload.cliVersion} \xB7 ${payload.nodeVersion} \xB7 ${payl
 
 // src/cli/commands/secrets.ts
 import { defineCommand as defineCommand10 } from "citty";
-import { readFileSync as readFileSync23 } from "fs";
+import { readFileSync as readFileSync22 } from "fs";
 
 // src/cli/lib/citty-args.ts
 function dedupePositionals(bound, rest) {
@@ -9906,6 +10228,7 @@ function warnIfDebugRoutesEnabled(secrets) {
   return true;
 }
 var APPLY_HINT = "Run `deepspace deploy` to apply \u2014 secrets take effect at deploy time.";
+var APPLIES_AT_DEPLOY = { appliesAtDeploy: true };
 var LOCAL_DEV_HINT = "Running `deepspace dev start`? Restart it to load the change locally.";
 var list6 = defineCommand10({
   meta: { name: "list", description: "List masked secrets in a config" },
@@ -9972,7 +10295,7 @@ var set = defineCommand10({
       const n = Object.keys(secrets).length;
       ok(
         args.json === true,
-        { appId: t.appId, config: t.configName, set: Object.keys(secrets) },
+        { appId: t.appId, config: t.configName, set: Object.keys(secrets), ...APPLIES_AT_DEPLOY },
         () => {
           console.log(`Set ${n} secret${n === 1 ? "" : "s"} in ${t.configName}.`);
           if (!warnIfDebugRoutesEnabled(secrets)) {
@@ -10045,7 +10368,7 @@ var del2 = defineCommand10({
         }
       }
       const note3 = absent > 0 ? ` (${absent} already absent)` : "";
-      ok(args.json === true, { appId: t.appId, config: t.configName, deleted, absent }, () => {
+      ok(args.json === true, { appId: t.appId, config: t.configName, deleted, absent, ...APPLIES_AT_DEPLOY }, () => {
         console.log(
           `Deleted ${deleted} secret${deleted === 1 ? "" : "s"} from ${t.configName}.${note3}`
         );
@@ -10074,7 +10397,7 @@ var upload = defineCommand10({
   async run({ args }) {
     try {
       const t = await resolveTarget(args);
-      const content = args.file === "-" ? readFileSync23(0, "utf-8") : readFileSync23(args.file, "utf-8");
+      const content = args.file === "-" ? readFileSync22(0, "utf-8") : readFileSync22(args.file, "utf-8");
       const secrets = parseSecretsUpload(content);
       if (Object.keys(secrets).length === 0)
         throw new InputError("No secrets found in the input.", "empty_input");
@@ -10082,7 +10405,7 @@ var upload = defineCommand10({
       const uploaded = Object.keys(secrets);
       ok(
         args.json === true,
-        { appId: t.appId, config: t.configName, uploaded, replaced: args.replace === true },
+        { appId: t.appId, config: t.configName, uploaded, replaced: args.replace === true, ...APPLIES_AT_DEPLOY },
         () => {
           console.log(`Uploaded ${uploaded.length} secrets to ${t.configName}.`);
           if (!warnIfDebugRoutesEnabled(secrets)) console.log(APPLY_HINT);
@@ -10257,12 +10580,19 @@ var secrets_default = defineCommand10({
 });
 
 // src/cli/commands/init.ts
-import { existsSync as existsSync21 } from "fs";
-import { join as join20 } from "path";
+import { existsSync as existsSync22 } from "fs";
+import { join as join23 } from "path";
 var DEPLOY_URL12 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
+function wranglerConfigUncommitted(appDir) {
+  if (!existsSync22(join23(appDir, ".git"))) return false;
+  const dryRun = runGit(appDir, ["commit", "--dry-run", "-m", "x", "--", "wrangler.toml"], {
+    allowFail: true
+  });
+  return dryRun.status === 0;
+}
 function commitScaffoldIfUnborn(appDir, token) {
   try {
-    if (!existsSync21(join20(appDir, ".git"))) return false;
+    if (!existsSync22(join23(appDir, ".git"))) return false;
     if (runGit(appDir, ["rev-parse", "--verify", "HEAD"], { allowFail: true }).status === 0) {
       return false;
     }
@@ -10337,16 +10667,15 @@ var init_default = defineDeepspaceCommand({
       method: "POST"
     });
     writeAppId(appDir, appId, { wranglerEnv: envName, force: Boolean(args["new-id"]) });
-    if (!envName) stampAppIdInSources(appDir, appId, existing);
     const committedScaffold = commitScaffoldIfUnborn(appDir, token);
     if (!args.json) {
+      const envSuffix = envName ? ` (env: ${envName})` : "";
+      const commitNote = committedScaffold ? " \u2014 initial scaffold commit created." : " \u2014 commit wrangler.toml.";
       if (existing) {
-        console.log(`Forked: ${existing} \u2192 ${appId}${envName ? ` (env: ${envName})` : ""}`);
+        console.log(`Forked: ${existing} \u2192 ${appId}${envSuffix}${commitNote}`);
         console.log("Registered as a NEW app under your account; the original is untouched.");
       } else {
-        console.log(
-          `Registered ${appId}${envName ? ` (env: ${envName})` : ""} to your account` + (committedScaffold ? " \u2014 initial scaffold commit created." : " \u2014 commit wrangler.toml.")
-        );
+        console.log(`Registered ${appId}${envSuffix} to your account${commitNote}`);
         console.log("The first deploy claims the `name` subdomain.");
       }
       console.log(`App dir: ${appDir}`);
@@ -10359,7 +10688,18 @@ var init_default = defineDeepspaceCommand({
         committedScaffold,
         appDir,
         env: envName ?? null
-      }
+      },
+      // The one follow-up when the id was written into an existing history:
+      // rendered as the `Next:` line and carried in `--json`, so a machine
+      // caller does not have to infer it from `committedScaffold: false`.
+      // Offered only when the file is actually uncommitted — `git commit` on
+      // a clean file fails, and an action must be executable as handed over.
+      ...!committedScaffold && wranglerConfigUncommitted(appDir) ? {
+        action: {
+          cwd: appDir,
+          argv: ["git", "commit", "-m", existing ? `Fork as ${appId}` : `Register ${appId}`, "--", "wrangler.toml"]
+        }
+      } : {}
     };
   }
 });
@@ -10367,7 +10707,7 @@ var init_default = defineDeepspaceCommand({
 // src/cli/commands/status.ts
 import { defineCommand as defineCommand11 } from "citty";
 import * as p17 from "@clack/prompts";
-import { existsSync as existsSync22, readFileSync as readFileSync24 } from "fs";
+import { existsSync as existsSync23, readFileSync as readFileSync23 } from "fs";
 function timeAgo(iso) {
   const ms = Date.now() - Date.parse(iso);
   if (!Number.isFinite(ms) || ms < 0) return iso;
@@ -10452,7 +10792,7 @@ var status_default = defineCommand11({
       json.services = urls;
       if (urlOverrides.length > 0) json.urlOverrides = urlOverrides;
     }
-    facts.loggedIn = existsSync22(SESSION_PATH);
+    facts.loggedIn = existsSync23(SESSION_PATH);
     let userId = null;
     if (!facts.loggedIn) {
       lines.push(["Session", "not logged in"]);
@@ -10461,7 +10801,7 @@ var status_default = defineCommand11({
       let who = "logged in";
       try {
         const payload = decodeJwtPayload(
-          readFileSync24(TOKEN_PATH, "utf-8").trim()
+          readFileSync23(TOKEN_PATH, "utf-8").trim()
         );
         if (payload.email) who = payload.email;
         userId = payload.sub ?? null;
@@ -10705,11 +11045,7 @@ var push_default = defineDeepspaceCommand({
     const force = args.force === true;
     const appDir = findAppDir();
     try {
-      if (!appDir)
-        throw new Refusal(
-          "No wrangler.toml found \u2014 run from inside an app directory.",
-          "not_in_app_repo"
-        );
+      if (!appDir) throw new Refusal(noWranglerConfigMessage(process.cwd()), "not_in_app_repo");
       assertSyncableRepo(appDir);
       if (branchArg !== void 0) {
         const b = branchArg.trim();
@@ -10732,9 +11068,11 @@ var push_default = defineDeepspaceCommand({
             "unknown_branch"
           );
         }
+        const uninitialized = hasWranglerConfig(appDir) && readAppId(appDir) === null;
         throw new Refusal(
-          `Branch "${branch}" has no commits yet \u2014 commit first, then push.`,
-          "no_commits"
+          uninitialized ? `Branch "${branch}" has no commits yet, and wrangler.toml still holds the \`__APP_ID__\` placeholder \u2014 run \`deepspace app init\` first: it registers the app and makes the initial commit (committing first would put the unregistered placeholder in history).` : `Branch "${branch}" has no commits yet \u2014 commit first, then push.`,
+          "no_commits",
+          uninitialized ? { action: { cwd: appDir, argv: ["deepspace", "app", "init"] } } : {}
         );
       }
       const spinner2 = args.json ? null : createSpinner();
@@ -10798,6 +11136,13 @@ var push_default = defineDeepspaceCommand({
           "app_not_registered"
         );
       }
+      if (sourceState.source?.provider === "github") {
+        throw new Refusal(
+          `This app uses GitHub source (${sourceState.source.repository}). Manage commits with normal Git/GitHub; \`deepspace deploy\` ships the local working tree without changing Git.`,
+          "source_managed_by_github",
+          { extra: { appId, repository: sourceState.source.repository } }
+        );
+      }
       const pullRecoveryCwd = selectedBranchCheckout(appDir, branch) ?? appDir;
       ensureSpaceRemote(appDir, appId);
       if (force) {
@@ -10937,11 +11282,7 @@ var pull_default = defineDeepspaceCommand({
     const branchArg = args.branch === void 0 ? void 0 : String(args.branch);
     const appArg = typeof args.app === "string" ? args.app : void 0;
     const appDir = findAppDir();
-    if (!appDir)
-      throw new Refusal(
-        "No wrangler.toml found \u2014 run from inside an app directory.",
-        "not_in_app_repo"
-      );
+    if (!appDir) throw new Refusal(noWranglerConfigMessage(process.cwd()), "not_in_app_repo");
     if (branchArg !== void 0) {
       const b = branchArg.trim();
       if (!b) throw new Refusal("--branch was given an empty branch name.", "invalid_branch");
@@ -11159,18 +11500,18 @@ var pull_default = defineDeepspaceCommand({
 
 // src/cli/commands/clone.ts
 import * as p20 from "@clack/prompts";
-import { existsSync as existsSync23, readdirSync as readdirSync6, rmSync as rmSync5 } from "fs";
-import { resolve as resolve17, basename as basename5, join as join21 } from "path";
+import { existsSync as existsSync24, readdirSync as readdirSync8, rmSync as rmSync5 } from "fs";
+import { resolve as resolve18, basename as basename5, join as join24 } from "path";
 function cleanFailedCloneDir(dir) {
   let entries;
   try {
-    entries = readdirSync6(dir);
+    entries = readdirSync8(dir);
   } catch {
-    return existsSync23(dir) ? ["<unreadable>"] : [];
+    return existsSync24(dir) ? ["<unreadable>"] : [];
   }
   if (entries.length === 1 && entries[0] === ".git") {
     try {
-      rmSync5(join21(dir, ".git"), { recursive: true, force: true });
+      rmSync5(join24(dir, ".git"), { recursive: true, force: true });
       return [];
     } catch {
       return entries;
@@ -11179,10 +11520,10 @@ function cleanFailedCloneDir(dir) {
   return entries;
 }
 function validateCloneTarget(dir) {
-  if (!existsSync23(dir)) return false;
+  if (!existsSync24(dir)) return false;
   let entries;
   try {
-    entries = readdirSync6(dir);
+    entries = readdirSync8(dir);
   } catch (error) {
     if (error.code === "ENOTDIR") {
       throw new Refusal(`${dir} already exists and is not a directory.`, "dir_exists");
@@ -11214,7 +11555,7 @@ var clone_default = defineDeepspaceCommand({
   async run({ args }) {
     assertAppTargetResolvable(String(args.app));
     const selector = String(args.app).trim();
-    const dir = resolve17(String(args.dir ?? selector));
+    const dir = resolve18(String(args.dir ?? selector));
     const dirPreexisted = validateCloneTarget(dir);
     const spinner2 = args.json ? null : createSpinner();
     spinner2?.start(`Resolving ${selector}\u2026`);
@@ -11387,7 +11728,7 @@ function pickPreviousRelease(releases) {
 var rollback_default = defineDeepspaceCommand({
   meta: {
     name: "rollback",
-    description: "Re-deploy a prior release's exact bundle (no rebuild)"
+    description: "Re-deploy a prior release's exact bundle (no rebuild); the live secrets are kept, not the release's"
   },
   args: {
     release: {
@@ -11522,7 +11863,7 @@ import { defineCommand as defineCommand12 } from "citty";
 
 // src/cli/commands/workspace/new.ts
 import * as p25 from "@clack/prompts";
-import { isAbsolute as isAbsolute6, resolve as resolve18 } from "path";
+import { isAbsolute as isAbsolute6, resolve as resolve19 } from "path";
 
 // src/cli/commands/workspace/analysis.ts
 import * as p23 from "@clack/prompts";
@@ -11656,25 +11997,25 @@ function printOverlaps(overlaps, json) {
 // src/cli/commands/workspace/local.ts
 import * as p24 from "@clack/prompts";
 import {
-  existsSync as existsSync24,
+  existsSync as existsSync25,
   mkdirSync as mkdirSync7,
-  readFileSync as readFileSync25,
+  readFileSync as readFileSync24,
   realpathSync as realpathSync6,
   renameSync as renameSync2,
   statSync as statSync3,
-  writeFileSync as writeFileSync7
+  writeFileSync as writeFileSync6
 } from "fs";
-import { dirname as dirname11, isAbsolute as isAbsolute5, join as join22, relative as relative2, sep as sep2 } from "path";
+import { dirname as dirname11, isAbsolute as isAbsolute5, join as join25, relative as relative3, sep as sep3 } from "path";
 var WORKSPACE_MARKER = "deepspace-workspace.json";
 function excludeWorktreeDir(appDir, dir) {
   try {
     ensureLocalExclude(appDir, ".deepspace/");
     const realDir = realpathSync6(dir);
-    const rel = relative2(realpathSync6(repoToplevel(appDir)), realDir);
-    if (!rel || rel === ".." || rel.startsWith(`..${sep2}`) || isAbsolute5(rel)) return;
-    const pattern = rel.split(sep2).join("/");
+    const rel = relative3(realpathSync6(repoToplevel(appDir)), realDir);
+    if (!rel || rel === ".." || rel.startsWith(`..${sep3}`) || isAbsolute5(rel)) return;
+    const pattern = rel.split(sep3).join("/");
     if (pattern === ".deepspace" || pattern.startsWith(".deepspace/")) return;
-    const relApp = relative2(realpathSync6(appDir), realDir).split(sep2).join("/");
+    const relApp = relative3(realpathSync6(appDir), realDir).split(sep3).join("/");
     if (relApp === ".deepspace" || relApp.startsWith(".deepspace/")) return;
     ensureLocalExclude(appDir, `/${pattern}/`);
   } catch {
@@ -11685,7 +12026,7 @@ function worktreeMarkerPath(worktreeRoot) {
     const result = runGit(worktreeRoot, ["rev-parse", "--absolute-git-dir"], { allowFail: true });
     if (result.status !== 0) return null;
     const gitDir = result.stdout.toString("utf-8").trim();
-    return isAbsolute5(gitDir) ? join22(gitDir, WORKSPACE_MARKER) : null;
+    return isAbsolute5(gitDir) ? join25(gitDir, WORKSPACE_MARKER) : null;
   } catch {
     return null;
   }
@@ -11697,7 +12038,7 @@ function markManagedWorkspace(worktreeRoot, workspaceId) {
   const tempPath = `${markerPath}.${process.pid}.tmp`;
   try {
     mkdirSync7(dirname11(markerPath), { recursive: true });
-    writeFileSync7(tempPath, JSON.stringify(marker) + "\n");
+    writeFileSync6(tempPath, JSON.stringify(marker) + "\n");
     renameSync2(tempPath, markerPath);
     return true;
   } catch {
@@ -11721,7 +12062,7 @@ function isManagedWorkspaceWorktree(worktreeRoot, workspaceId) {
   const markerPath = worktreeMarkerPath(worktreeRoot);
   if (!markerPath) return false;
   try {
-    const marker = JSON.parse(readFileSync25(markerPath, "utf-8"));
+    const marker = JSON.parse(readFileSync24(markerPath, "utf-8"));
     return marker.version === 1 && marker.workspaceId === workspaceId && marker.mode === "managed-linked";
   } catch {
     return false;
@@ -11730,11 +12071,11 @@ function isManagedWorkspaceWorktree(worktreeRoot, workspaceId) {
 function defaultWorkspaceRoot(appDir, workspaceId) {
   const primary = listWorktrees(appDir)[0];
   if (!primary) throw new Error("Git did not report a primary worktree");
-  return join22(primary.path, ".deepspace", "ws", workspaceId.slice(3).toLowerCase());
+  return join25(primary.path, ".deepspace", "ws", workspaceId.slice(3).toLowerCase());
 }
 function appDirInWorktree(appDir, worktreeRoot) {
-  const appRelative = relative2(realpathSync6(repoToplevel(appDir)), realpathSync6(appDir));
-  return appRelative ? join22(worktreeRoot, appRelative) : worktreeRoot;
+  const appRelative = relative3(realpathSync6(repoToplevel(appDir)), realpathSync6(appDir));
+  return appRelative ? join25(worktreeRoot, appRelative) : worktreeRoot;
 }
 function primaryAppDir(appDir) {
   const primary = listWorktrees(appDir)[0];
@@ -11769,7 +12110,7 @@ function rematerializeWorkspaceWorktree(appDir, worktreeRoot, branch, workspaceI
 function inOwnLinkedWorktree(appDir, id) {
   if (workspaceIdFromBranch(currentBranch(appDir)) !== id) return false;
   try {
-    return statSync3(join22(repoToplevel(appDir), ".git")).isFile();
+    return statSync3(join25(repoToplevel(appDir), ".git")).isFile();
   } catch {
     return false;
   }
@@ -11894,7 +12235,7 @@ function cleanupWorkspaceLocal(appDir, id, trunkBranch, options = {}) {
         }
         runGit(mainDir, ["worktree", "prune"], { allowFail: true });
         out.worktreeDir = null;
-        const leftover = existsSync24(linked.path);
+        const leftover = existsSync25(linked.path);
         if (leftover) out.leftoverDir = linked.path;
         else out.worktreeRemoved = linked.path;
         deleteWsBranch(mainDir, branch, expectedBranchOid, out);
@@ -11974,7 +12315,7 @@ async function resolveTarget2(appArg) {
   const appDir = findAppDir();
   if (!appDir) {
     throw new Refusal(
-      "No wrangler.toml found \u2014 run from inside an app directory (or use -a <app> for list, and for drop with an explicit ws_ id).",
+      `${noWranglerConfigMessage(process.cwd())} (Or use -a <app> for list, and for drop with an explicit ws_ id.)`,
       "not_in_app_repo"
     );
   }
@@ -12154,7 +12495,7 @@ var newWorkspaceCommand = defineDeepspaceCommand({
       idempotencyKey: mintIdempotencyKey()
     });
     const dirInput = typeof args.dir === "string" ? args.dir.trim() : "";
-    const worktreeRoot = dirInput ? isAbsolute6(dirInput) ? dirInput : resolve18(appDir, dirInput) : defaultWorkspaceRoot(appDir, id);
+    const worktreeRoot = dirInput ? isAbsolute6(dirInput) ? dirInput : resolve19(appDir, dirInput) : defaultWorkspaceRoot(appDir, id);
     const dir = appDirInWorktree(appDir, worktreeRoot);
     try {
       materializeWorkspaceWorktree(appDir, worktreeRoot, branch, baseOid, id);
@@ -12192,14 +12533,14 @@ var newWorkspaceCommand = defineDeepspaceCommand({
 
 // src/cli/commands/workspace/attach.ts
 import * as p26 from "@clack/prompts";
-import { existsSync as existsSync25, readdirSync as readdirSync7, realpathSync as realpathSync7, rmSync as rmSync6 } from "fs";
-import { isAbsolute as isAbsolute7, resolve as resolve19 } from "path";
+import { existsSync as existsSync26, readdirSync as readdirSync9, realpathSync as realpathSync7, rmSync as rmSync6 } from "fs";
+import { isAbsolute as isAbsolute7, resolve as resolve20 } from "path";
 function samePath(a, b) {
   const real = (p35) => {
     try {
       return realpathSync7(p35);
     } catch {
-      return resolve19(p35);
+      return resolve20(p35);
     }
   };
   return real(a) === real(b);
@@ -12212,10 +12553,10 @@ function finishedWorkspaceMessage(id, view) {
   return `Workspace ${id} is ${workspace.status} \u2014 its ref is retained briefly (fetch ${workspace.ref} to inspect), but attach only works on active workspaces.`;
 }
 function cleanFailedFreshAttachDir(dir) {
-  if (!existsSync25(dir)) return [];
+  if (!existsSync26(dir)) return [];
   let entries;
   try {
-    entries = readdirSync7(dir);
+    entries = readdirSync9(dir);
   } catch {
     return ["<unreadable>"];
   }
@@ -12289,12 +12630,12 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
         );
       }
       const requestedDir = typeof args.dir === "string" ? args.dir.trim() : "";
-      const worktreeRoot = requestedDir ? isAbsolute7(requestedDir) ? requestedDir : resolve19(appDir, requestedDir) : defaultWorkspaceRoot(appDir, id);
+      const worktreeRoot = requestedDir ? isAbsolute7(requestedDir) ? requestedDir : resolve20(appDir, requestedDir) : defaultWorkspaceRoot(appDir, id);
       const dir2 = appDirInWorktree(appDir, worktreeRoot);
       const localTip = resolveCommit(appDir, `refs/heads/${branch}`);
       if (localTip) {
         let existing = resolveWorkspaceWorktree(listWorktrees(appDir), id);
-        if (existing && !existsSync25(existing)) {
+        if (existing && !existsSync26(existing)) {
           runGit(appDir, ["worktree", "prune"], { allowFail: true });
           existing = null;
         }
@@ -12408,11 +12749,11 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
         extra: { status: view.workspace.status }
       });
     }
-    const dir = resolve19(
+    const dir = resolve20(
       process.cwd(),
       (typeof args.dir === "string" ? args.dir.trim() : "") || `ws-${id.slice(3).toLowerCase()}`
     );
-    if (existsSync25(dir)) {
+    if (existsSync26(dir)) {
       spinner2?.stop("Target exists.");
       throw new Refusal(`${dir} already exists \u2014 pass a different directory.`, "dir_exists");
     }
@@ -12749,13 +13090,13 @@ import * as p30 from "@clack/prompts";
 
 // src/cli/lib/validation.ts
 import { sync as spawnSync7 } from "cross-spawn";
-import { readFileSync as readFileSync26 } from "fs";
-import { join as join23 } from "path";
+import { readFileSync as readFileSync25 } from "fs";
+import { join as join26 } from "path";
 var MAX_SUMMARY_CHARS = 4e3;
 var MAX_OUTPUT_BUFFER = 64 * 1024 * 1024;
 function configuredCommand(appDir) {
   try {
-    const pkg2 = JSON.parse(readFileSync26(join23(appDir, "package.json"), "utf-8"));
+    const pkg2 = JSON.parse(readFileSync25(join26(appDir, "package.json"), "utf-8"));
     if (pkg2.scripts?.validate) return `${detectPackageManager(appDir)} run --silent validate`;
   } catch {
   }
@@ -13831,13 +14172,13 @@ function sameRefs(left, right) {
 
 // src/cli/commands/update.ts
 import * as p34 from "@clack/prompts";
-import { existsSync as existsSync26, readFileSync as readFileSync27, writeFileSync as writeFileSync8 } from "fs";
-import { join as join24, resolve as resolve20 } from "path";
+import { existsSync as existsSync27, readFileSync as readFileSync26, writeFileSync as writeFileSync7 } from "fs";
+import { join as join27, resolve as resolve21 } from "path";
 
 // package.json
 var package_default = {
   name: "deepspace",
-  version: "0.22.1",
+  version: "0.23.1",
   engines: {
     node: ">=22.15.0 <23 || >=24 <25 || >=26 <27"
   },
@@ -13874,6 +14215,10 @@ var package_default = {
       types: "./dist/testing-mcp.d.ts",
       import: "./dist/testing-mcp.js"
     },
+    "./build": {
+      types: "./dist/build.d.ts",
+      import: "./dist/build.js"
+    },
     "./documentation": {
       types: "./dist/documentation.d.ts",
       import: "./dist/documentation.js"
@@ -14008,24 +14353,25 @@ function gapIsTooWide(from, to) {
   return from.major === 0 && from.minor < OLDEST_SUPPORTED_MINOR;
 }
 function readAppSdkVersion(appDir) {
-  const installed = join24(appDir, "node_modules", "deepspace", "package.json");
-  if (existsSync26(installed)) {
-    const parsed2 = JSON.parse(readFileSync27(installed, "utf8"));
+  const installed = join27(appDir, "node_modules", "deepspace", "package.json");
+  if (existsSync27(installed)) {
+    const parsed2 = JSON.parse(readFileSync26(installed, "utf8"));
     if (typeof parsed2.version === "string") return parsed2.version;
   }
-  const manifest = join24(appDir, "package.json");
-  if (!existsSync26(manifest)) return null;
-  const parsed = JSON.parse(readFileSync27(manifest, "utf8"));
+  const manifest = join27(appDir, "package.json");
+  if (!existsSync27(manifest)) return null;
+  const parsed = JSON.parse(readFileSync26(manifest, "utf8"));
   return parsed.dependencies?.deepspace ?? null;
 }
 function pinSdkVersion(appDir, version) {
-  const path = join24(appDir, "package.json");
-  const source = readFileSync27(path, "utf8");
+  const path = join27(appDir, "package.json");
+  const source = readFileSync26(path, "utf8");
   const manifest = JSON.parse(source);
   const dependencies = manifest.dependencies;
   if (!dependencies || typeof dependencies !== "object" || Array.isArray(dependencies)) return false;
   let changed = false;
-  if (Object.prototype.hasOwnProperty.call(dependencies, "deepspace") && typeof dependencies.deepspace === "string" && dependencies.deepspace !== `^${version}`) {
+  const registrySpec = (spec) => !/^(file|link|workspace|git\+|github|https?):/.test(spec) && !spec.includes("/");
+  if (Object.prototype.hasOwnProperty.call(dependencies, "deepspace") && typeof dependencies.deepspace === "string" && registrySpec(dependencies.deepspace) && dependencies.deepspace !== `^${version}`) {
     dependencies.deepspace = `^${version}`;
     changed = true;
   }
@@ -14037,7 +14383,7 @@ function pinSdkVersion(appDir, version) {
   const eol = source.includes("\r\n") ? "\r\n" : "\n";
   const indent = source.match(/\r?\n([\t ]+)"/)?.[1] ?? "  ";
   const finalEol = source.endsWith("\n") ? eol : "";
-  writeFileSync8(path, JSON.stringify(manifest, null, indent).replaceAll("\n", eol) + finalEol);
+  writeFileSync7(path, JSON.stringify(manifest, null, indent).replaceAll("\n", eol) + finalEol);
   return true;
 }
 function buildPreviewSecretsUpgradeInstruction(appDir) {
@@ -14046,17 +14392,19 @@ function buildPreviewSecretsUpgradeInstruction(appDir) {
     "vite.config.mts",
     "vite.config.js",
     "vite.config.mjs"
-  ].find((candidate) => existsSync26(join24(appDir, candidate)));
+  ].find((candidate) => existsSync27(join27(appDir, candidate)));
   if (!configName) return null;
-  const source = readFileSync27(join24(appDir, configName), "utf8");
-  if (source.includes("deepspace-remove-build-preview-secrets")) return null;
-  return `${configName}: add the build-preview secret cleanup from ${BUILD_PREVIEW_SECRETS_GUIDE}; app update left this app-owned file unchanged.`;
+  const source = readFileSync26(join27(appDir, configName), "utf8");
+  if (source.includes("deepspace-remove-build-preview-secrets") || source.includes("deepspaceBuild(") || source.includes("'deepspace/build'") || source.includes('"deepspace/build"')) {
+    return null;
+  }
+  return `${configName}: adopt the deepspaceBuild() plugin from deepspace/build (which owns this cleanup), or add the inline cleanup from ${BUILD_PREVIEW_SECRETS_GUIDE}; app update left this app-owned file unchanged.`;
 }
 function usersSchemaVisibilityUpgradeInstruction(appDir) {
   const schemaName = "src/schemas/users-schema.ts";
-  const path = join24(appDir, schemaName);
-  if (!existsSync26(path)) return null;
-  const source = readFileSync27(path, "utf8");
+  const path = join27(appDir, schemaName);
+  if (!existsSync27(path)) return null;
+  const source = readFileSync26(path, "utf8");
   if (!/\bmember\s*:\s*\{[^}]*\bread\s*:\s*true\b/s.test(source)) return null;
   return `${schemaName}: review the member user-row visibility change at ${USERS_SCHEMA_VISIBILITY_GUIDE}; app update left this app-owned schema unchanged.`;
 }
@@ -14116,12 +14464,9 @@ var update_default = defineDeepspaceCommand({
     }
   },
   async run({ args }) {
-    const appDir = resolve20(".");
+    const appDir = resolve21(".");
     if (!hasWranglerConfig(appDir)) {
-      throw new Refusal(
-        "No wrangler.toml found \u2014 run this from inside a DeepSpace app directory.",
-        "not_in_app_repo"
-      );
+      throw new Refusal(noWranglerConfigMessage(join27(appDir, "wrangler.toml")), "not_in_app_repo");
     }
     assertSyncableRepo(appDir);
     const currentRaw = readAppSdkVersion(appDir);
@@ -14207,8 +14552,8 @@ var update_default = defineDeepspaceCommand({
 
 // src/cli/cli.ts
 var __dirname = dirname12(fileURLToPath3(import.meta.url));
-var pkg = JSON.parse(readFileSync28(join25(__dirname, "..", "package.json"), "utf-8"));
-if (process.platform === "linux" && !process.env.SSL_CERT_FILE && existsSync27("/etc/ssl/certs/ca-certificates.crt")) {
+var pkg = JSON.parse(readFileSync27(join28(__dirname, "..", "package.json"), "utf-8"));
+if (process.platform === "linux" && !process.env.SSL_CERT_FILE && existsSync28("/etc/ssl/certs/ca-certificates.crt")) {
   process.env.SSL_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt";
 }
 var create2 = defineCommand14({