deepspace 0.23.0 → 0.23.2

package/dist/cli.js

@@ -8,8 +8,8 @@ import {
   renderUsage
 } from "citty";
 import { sync as spawnSync8 } from "cross-spawn";
-import { readFileSync as readFileSync28, existsSync as existsSync27 } from "fs";
-import { dirname as dirname12, join as join25 } from "path";
+import { readFileSync as readFileSync27, existsSync as existsSync28 } from "fs";
+import { dirname as dirname12, join as join28 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 
 // src/cli/lib/spinner.ts
@@ -215,6 +215,8 @@ var CliExit = class extends Error {
 function errorCode(err) {
   if (err instanceof ApiError || err instanceof InputError) return err.code;
   if (err instanceof Error && err.name === "GitError") return err.code ?? "git_error";
+  if (err instanceof Error && err.name === "WranglerConfigError")
+    return err.code ?? "invalid_config";
   return void 0;
 }
 var API_ERROR_HINTS = {
@@ -428,7 +430,7 @@ function splitTokenPath(token, table) {
   }
   return parts;
 }
-var DESTRUCTIVE_VERBS = /* @__PURE__ */ new Set(["rm", "delete", "remove", "drop", "clear", "undeploy", "kill"]);
+var DESTRUCTIVE_VERBS = /* @__PURE__ */ new Set(["rm", "delete", "remove", "drop", "clear", "undeploy", "kill", "logout"]);
 function editDistance(a, b) {
   const left = a.toLowerCase();
   const right = b.toLowerCase();
@@ -473,11 +475,12 @@ function findUnknownCommand(argv, rootCommands) {
       const split = splitTokenPath(token, table);
       const relativeSuggestion = split ?? closestCommandPath(token, table);
       if (!relativeSuggestion) return null;
+      const guessed = relativeSuggestion.at(-1) ?? "";
       return {
         attemptedPath: ["deepspace", ...accepted, token],
         helpPath: ["deepspace", ...accepted],
         suggestion: ["deepspace", ...accepted, ...relativeSuggestion],
-        executable: !DESTRUCTIVE_VERBS.has(relativeSuggestion.at(-1) ?? ""),
+        executable: split !== null && !DESTRUCTIVE_VERBS.has(guessed),
         ...split ? { quotedToken: true } : {}
       };
     }
@@ -834,7 +837,7 @@ async function provisionProfile(jwt) {
   }
 }
 function sleep(ms) {
-  return new Promise((resolve21) => setTimeout(resolve21, ms));
+  return new Promise((resolve22) => setTimeout(resolve22, ms));
 }
 function base64url(bytes) {
   return bytes.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
@@ -906,9 +909,66 @@ var logout_default = defineDeepspaceCommand({
 });
 
 // src/cli/lib/app-identity.ts
-import { existsSync as existsSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "fs";
-import { join as join2, resolve as resolve2 } from "path";
-import { parse as parseToml } from "smol-toml";
+import { existsSync as existsSync4, readFileSync as readFileSync6, writeFileSync as writeFileSync3 } from "fs";
+import { join as join3, resolve as resolve2 } from "path";
+
+// src/cli/lib/wrangler-env.ts
+import { existsSync as existsSync3, readFileSync as readFileSync5, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
+import { join as join2 } from "path";
+import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
+
+// src/server/rooms/app-name.ts
+var APP_NAME_RULES = {
+  /** ^[a-z0-9](-?[a-z0-9])+$ — RFC 1035 host label, no consecutive dashes. */
+  pattern: /^[a-z0-9](?:-?[a-z0-9])+$/,
+  minLength: 2,
+  maxLength: 63
+};
+function validateAppName(raw) {
+  if (typeof raw !== "string") {
+    return { valid: false, reason: "App name must be a string" };
+  }
+  const name = raw.trim();
+  if (!name) {
+    return { valid: false, reason: "App name is required" };
+  }
+  if (name.length < APP_NAME_RULES.minLength) {
+    return { valid: false, reason: `App name "${name}" is too short (min ${APP_NAME_RULES.minLength} chars)` };
+  }
+  if (name.length > APP_NAME_RULES.maxLength) {
+    return { valid: false, reason: `App name "${name}" is too long (max ${APP_NAME_RULES.maxLength} chars)` };
+  }
+  if (!APP_NAME_RULES.pattern.test(name)) {
+    return {
+      valid: false,
+      reason: `App name "${name}" is invalid. Use lowercase letters, digits, and single hyphens only (must start + end with alphanumeric). Examples: my-app, search-v2, unison-search.`
+    };
+  }
+  return { valid: true, name };
+}
+function resolveAppName(raw) {
+  const strict = validateAppName(raw);
+  if (strict.valid) return { ok: true, name: strict.name };
+  if (typeof raw !== "string") return { ok: false, reason: strict.reason };
+  const trimmed = raw.trim();
+  if (!trimmed) return { ok: false, reason: "App name is required" };
+  const sanitized = sanitizeAppName(trimmed);
+  const sanitizedStrict = validateAppName(sanitized);
+  if (!sanitizedStrict.valid) {
+    return {
+      ok: false,
+      reason: `App name "${trimmed}" can't be sanitized into a valid name (${sanitizedStrict.reason}). Pick something matching: lowercase letters, digits, single hyphens, ${APP_NAME_RULES.minLength}-${APP_NAME_RULES.maxLength} chars.`
+    };
+  }
+  return {
+    ok: true,
+    name: sanitized,
+    warning: `App name "${trimmed}" doesn't conform to deploy rules \u2014 using "${sanitized}" instead. Update wrangler.toml's \`name\` to silence this warning.`
+  };
+}
+function sanitizeAppName(raw) {
+  return raw.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-{2,}/g, "-").replace(/^-+|-+$/g, "");
+}
 
 // src/server/utils/registry-client.ts
 var APP_ID_RE = /^app_[0-9A-HJKMNP-TV-Z]{26}$/;
@@ -937,29 +997,198 @@ function mintUlid(now = Date.now()) {
   return `${ts}${rs}`.slice(0, 26);
 }
 
-// src/cli/lib/app-identity.ts
-function readWranglerIdentityConfig(cwd) {
-  const wranglerPath = join2(resolve2(cwd), "wrangler.toml");
-  if (!existsSync3(wranglerPath)) return null;
+// src/cli/lib/wrangler-env.ts
+var NON_INHERITABLE_ENV_KEYS = /* @__PURE__ */ new Set([
+  "define",
+  "vars",
+  "durable_objects",
+  "kv_namespaces",
+  "r2_buckets",
+  "ai_search_namespaces",
+  "ai_search",
+  "ratelimits",
+  "vectorize",
+  "services",
+  "queues",
+  "workflows",
+  "tail_consumers",
+  "secrets",
+  "secrets_store_secrets"
+]);
+var generatedConfigSeq = 0;
+function resolveAppNameForEnv(config, envName) {
+  if (!envName) {
+    return resolveAppName(config.name);
+  }
+  const envBlock = config.env?.[envName];
+  if (!envBlock) {
+    return {
+      ok: false,
+      code: "missing_env_block",
+      reason: `wrangler.toml: no [env.${envName}] block found. Add one with a distinct \`name\` to deploy this environment.`
+    };
+  }
+  if (typeof envBlock.name !== "string" || envBlock.name.trim() === "") {
+    return {
+      ok: false,
+      reason: `wrangler.toml: [env.${envName}].name is missing. Set a distinct app name (e.g. "${typeof config.name === "string" ? config.name : "myapp"}-${envName}") so this environment doesn't overwrite the default.`
+    };
+  }
+  if (envBlock.name === config.name) {
+    return {
+      ok: false,
+      reason: `wrangler.toml: [env.${envName}].name "${envBlock.name}" is the same as the top-level name. Pick a distinct name (e.g. "${config.name}-${envName}") so deploys don't collide.`
+    };
+  }
+  return resolveAppName(envBlock.name);
+}
+function devVarsPathFor(appDir) {
+  return join2(appDir, ".dev.vars");
+}
+function prepareWranglerEnvConfig(appDir, envName) {
+  if (!envName) return { cleanup() {
+  } };
+  const config = readWranglerConfig(appDir);
+  const resolved = resolveAppNameForEnv(config, envName);
+  if (!resolved.ok) throw new Error(resolved.reason);
+  const flattened = flattenWranglerEnvConfig(config, envName);
+  const configPath = join2(
+    appDir,
+    `.wrangler.deepspace.${safeGeneratedConfigSegment(envName)}.${process.pid}.${++generatedConfigSeq}.toml`
+  );
+  writeFileSync2(
+    configPath,
+    [
+      "# Generated by DeepSpace for this CLI run.",
+      "# Do not edit; wrangler.toml remains the source of truth.",
+      stringifyToml(flattened)
+    ].join("\n").replace(/\s*$/u, "\n")
+  );
+  return {
+    configPath,
+    cleanup() {
+      rmSync2(configPath, { force: true });
+    }
+  };
+}
+function wranglerViteEnv(baseEnv, prepared, extraEnv = {}) {
+  const env = { ...baseEnv, ...extraEnv };
+  if (prepared.configPath) {
+    delete env.CLOUDFLARE_ENV;
+    env.CLOUDFLARE_VITE_WRANGLER_CONFIG_PATH = prepared.configPath;
+  }
+  return env;
+}
+function flattenWranglerEnvConfig(config, envName) {
+  const envRoot = asTomlRecord(config.env);
+  const envBlock = asTomlRecord(envRoot?.[envName]);
+  if (!envBlock) {
+    throw new Error(`wrangler.toml: no [env.${envName}] block found.`);
+  }
+  const flattened = {};
+  for (const [key, value] of Object.entries(config)) {
+    if (key === "env" || NON_INHERITABLE_ENV_KEYS.has(key)) continue;
+    flattened[key] = value;
+  }
+  for (const [key, value] of Object.entries(envBlock)) {
+    flattened[key] = value;
+  }
+  if (!("durable_objects" in envBlock) && config.durable_objects) {
+    flattened.durable_objects = config.durable_objects;
+  }
+  const envVars = asTomlRecord(envBlock.vars) ?? {};
+  if (!("APP_NAME" in envVars) && typeof envBlock.name === "string") {
+    flattened.vars = { ...envVars, APP_NAME: envBlock.name };
+  }
+  return flattened;
+}
+function asTomlRecord(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function safeGeneratedConfigSegment(value) {
+  return value.replace(/[^A-Za-z0-9._-]/gu, "_");
+}
+var WranglerConfigError = class extends Error {
+  constructor(path, message, code = "invalid_config", cause) {
+    super(message);
+    this.path = path;
+    this.code = code;
+    this.cause = cause;
+    this.name = "WranglerConfigError";
+  }
+};
+function causeDetail(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function readWranglerConfigFile(path) {
+  let raw;
   try {
-    return parseToml(readFileSync5(wranglerPath, "utf-8"));
+    raw = readFileSync5(path, "utf-8");
   } catch (err) {
-    throw new InputError(
-      `Could not parse ${wranglerPath}: ${err instanceof Error ? err.message : String(err)}`,
-      "invalid_config"
+    const missing = err?.code === "ENOENT";
+    throw new WranglerConfigError(
+      path,
+      missing ? noWranglerConfigMessage(path) : `wrangler.toml: could not read ${path}: ${causeDetail(err)}`,
+      missing ? "not_in_app_repo" : "invalid_config",
+      err
     );
   }
+  let config;
+  try {
+    config = parseToml(raw);
+  } catch (err) {
+    throw new WranglerConfigError(
+      path,
+      `wrangler.toml: malformed TOML at ${path}: ${causeDetail(err)}`,
+      "invalid_config",
+      err
+    );
+  }
+  assertOneSectionPerAppId(config, path);
+  return config;
+}
+function readWranglerConfig(appDir) {
+  return readWranglerConfigFile(join2(appDir, "wrangler.toml"));
+}
+function readAppIdVar(config, envName) {
+  return (envName ? config.env?.[envName]?.vars : config.vars)?.DEEPSPACE_APP_ID;
+}
+function assertOneSectionPerAppId(config, path) {
+  const sections = /* @__PURE__ */ new Map();
+  const record = (section, value) => {
+    if (typeof value !== "string" || !APP_ID_RE.test(value)) return;
+    sections.set(value, [...sections.get(value) ?? [], section]);
+  };
+  record("[vars]", config.vars?.DEEPSPACE_APP_ID);
+  for (const envName of Object.keys(config.env ?? {})) {
+    record(`[env.${envName}.vars]`, config.env?.[envName]?.vars?.DEEPSPACE_APP_ID);
+  }
+  for (const [appId, where] of sections) {
+    if (where.length < 2) continue;
+    throw new WranglerConfigError(
+      path,
+      `wrangler.toml: ${where.join(" and ")} ${where.length === 2 ? "both" : "all"} set DEEPSPACE_APP_ID = "${appId}" in ${path}. One id under several sections points every environment's data, secrets, and billing at the same app while the deploys go to different places \u2014 each environment is its own app \u2014 run \`deepspace app init --env <name>\` to mint one for it.`,
+      "duplicate_app_id"
+    );
+  }
+}
+function noWranglerConfigMessage(where) {
+  return `No wrangler.toml at ${where}. Are you in a DeepSpace app directory? (Scaffold one with \`npm create deepspace\`, or cd into an existing app.)`;
+}
+function hasWranglerConfig(appDir) {
+  return existsSync3(join2(appDir, "wrangler.toml"));
 }
+
+// src/cli/lib/app-identity.ts
 function readAppId(cwd = process.cwd(), wranglerEnv) {
-  const cfg = readWranglerIdentityConfig(cwd);
-  if (!cfg) return null;
-  const vars = wranglerEnv ? cfg.env?.[wranglerEnv]?.vars : cfg.vars;
-  const id = vars?.DEEPSPACE_APP_ID;
+  const appDir = resolve2(cwd);
+  if (!hasWranglerConfig(appDir)) return null;
+  const id = readAppIdVar(readWranglerConfig(appDir), wranglerEnv);
   return typeof id === "string" && APP_ID_RE.test(id) ? id : null;
 }
 function writeAppId(cwd, appId, opts = {}) {
-  const wranglerPath = join2(resolve2(cwd), "wrangler.toml");
-  if (!existsSync3(wranglerPath)) {
+  const wranglerPath = join3(resolve2(cwd), "wrangler.toml");
+  if (!existsSync4(wranglerPath)) {
     throw new Error(`No wrangler.toml in ${resolve2(cwd)}`);
   }
   const existing = readAppId(cwd, opts.wranglerEnv);
@@ -969,7 +1198,7 @@ function writeAppId(cwd, appId, opts = {}) {
       `wrangler.toml already carries ${existing}. The app id is immutable \u2014 use --new-id only to fork this repo as a separate app.`
     );
   }
-  let src = readFileSync5(wranglerPath, "utf-8");
+  let src = readFileSync6(wranglerPath, "utf-8");
   const header = opts.wranglerEnv ? `[env.${opts.wranglerEnv}.vars]` : "[vars]";
   const line = `DEEPSPACE_APP_ID = "${appId}"`;
   const headerRe = new RegExp(`^\\${header.replace(/\./g, "\\.")}[ \\t]*$`, "m");
@@ -991,7 +1220,7 @@ ${header}
 ${line}
 `;
   }
-  writeFileSync2(wranglerPath, src);
+  writeFileSync3(wranglerPath, src);
 }
 
 // src/cli/commands/dev.ts
@@ -999,26 +1228,18 @@ import { resolve as resolve8, basename as basename2, join as join11 } from "path
 import spawn2 from "cross-spawn";
 
 // src/cli/lib/app-context.ts
-import { existsSync as existsSync4, readFileSync as readFileSync6, readdirSync } from "fs";
-import { dirname as dirname3, join as join3, resolve as resolve3 } from "path";
-import { parse as parseToml2 } from "smol-toml";
+import { existsSync as existsSync5, readdirSync } from "fs";
+import { dirname as dirname3, join as join4, resolve as resolve3 } from "path";
 function detectAppName(cwd = process.cwd()) {
-  const wranglerPath = join3(resolve3(cwd), "wrangler.toml");
-  if (!existsSync4(wranglerPath)) return null;
-  try {
-    const config = parseToml2(readFileSync6(wranglerPath, "utf-8"));
-    return typeof config.name === "string" && config.name.length > 0 ? config.name : null;
-  } catch (error) {
-    throw new InputError(
-      `Could not parse ${wranglerPath}: ${error instanceof Error ? error.message : String(error)}`,
-      "invalid_config"
-    );
-  }
+  const appDir = resolve3(cwd);
+  if (!existsSync5(join4(appDir, "wrangler.toml"))) return null;
+  const { name } = readWranglerConfig(appDir);
+  return typeof name === "string" && name.length > 0 ? name : null;
 }
 function findAppDir(start = process.cwd()) {
   let dir = resolve3(start);
   for (; ; ) {
-    if (existsSync4(join3(dir, "wrangler.toml"))) return dir;
+    if (existsSync5(join4(dir, "wrangler.toml"))) return dir;
     const parent = dirname3(dir);
     if (parent === dir) return null;
     dir = parent;
@@ -1026,7 +1247,7 @@ function findAppDir(start = process.cwd()) {
 }
 function findChildApps(dir) {
   try {
-    return readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && existsSync4(join3(dir, entry.name, "wrangler.toml"))).map((entry) => entry.name).sort();
+    return readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && existsSync5(join4(dir, entry.name, "wrangler.toml"))).map((entry) => entry.name).sort();
   } catch {
     return [];
   }
@@ -1034,19 +1255,19 @@ function findChildApps(dir) {
 
 // src/cli/lib/launch-config.ts
 import {
-  existsSync as existsSync5,
+  existsSync as existsSync6,
   readFileSync as readFileSync8,
   realpathSync as realpathSync2,
-  writeFileSync as writeFileSync3,
+  writeFileSync as writeFileSync4,
   mkdirSync as mkdirSync4,
   renameSync,
   unlinkSync
 } from "fs";
-import { join as join5, resolve as resolve5, dirname as dirname5, basename, isAbsolute as isAbsolute2, sep } from "path";
+import { join as join6, resolve as resolve5, dirname as dirname5, basename, isAbsolute as isAbsolute2, sep } from "path";
 
 // src/cli/lib/git/repository.ts
 import { appendFileSync, mkdirSync as mkdirSync3, readFileSync as readFileSync7 } from "fs";
-import { dirname as dirname4, join as join4, resolve as resolve4 } from "path";
+import { dirname as dirname4, join as join5, resolve as resolve4 } from "path";
 
 // src/cli/lib/git/process.ts
 import { sync as spawnSync } from "cross-spawn";
@@ -1250,7 +1471,7 @@ function listWorktrees(cwd) {
 }
 function ensureLocalExclude(cwd, pattern) {
   const commonDir = resolve4(cwd, gitLine(cwd, ["rev-parse", "--git-common-dir"]));
-  const excludePath = join4(commonDir, "info", "exclude");
+  const excludePath = join5(commonDir, "info", "exclude");
   let current = "";
   try {
     current = readFileSync7(excludePath, "utf-8");
@@ -1272,7 +1493,7 @@ function ensureLocalExclude(cwd, pattern) {
 function writeLaunchFile(launchPath, config) {
   mkdirSync4(dirname5(launchPath), { recursive: true });
   const tmpPath = `${launchPath}.${process.pid}.tmp`;
-  writeFileSync3(tmpPath, JSON.stringify(config, null, 2) + "\n");
+  writeFileSync4(tmpPath, JSON.stringify(config, null, 2) + "\n");
   try {
     renameSync(tmpPath, launchPath);
   } catch (err) {
@@ -1285,7 +1506,7 @@ function writeLaunchFile(launchPath, config) {
 }
 function readLaunchFile(launchPath) {
   const empty = { version: "0.0.1", configurations: [] };
-  if (!existsSync5(launchPath)) return empty;
+  if (!existsSync6(launchPath)) return empty;
   const raw = readFileSync8(launchPath, "utf-8").trim();
   if (!raw) return empty;
   const parsed = JSON.parse(raw);
@@ -1293,7 +1514,7 @@ function readLaunchFile(launchPath) {
   return parsed;
 }
 function writeLaunchConfigIfMissing(appDir, appName, port, opts = {}) {
-  const launchPath = join5(appDir, ".claude", "launch.json");
+  const launchPath = join6(appDir, ".claude", "launch.json");
   try {
     const config = readLaunchFile(launchPath);
     if (!config) return;
@@ -1334,7 +1555,7 @@ function writeLaunchConfigIfMissing(appDir, appName, port, opts = {}) {
 }
 function resolveAppLaunchPort(appDir) {
   try {
-    const config = readLaunchFile(join5(appDir, ".claude", "launch.json"));
+    const config = readLaunchFile(join6(appDir, ".claude", "launch.json"));
     if (!config) return null;
     const appName = detectAppName(appDir) ?? basename(appDir);
     const entry = config.configurations.find((c) => c?.name === appName) ?? (config.configurations.length === 1 ? config.configurations[0] : void 0);
@@ -1388,15 +1609,15 @@ function deriveWorktreePort(worktreeKey) {
   return WORKTREE_PORT_MIN + hash % WORKTREE_PORT_RANGE;
 }
 function upsertWorktreeLaunchConfig(mainRepoRoot, worktreeName, appDir, opts) {
-  const launchPath = join5(mainRepoRoot, ".claude", "launch.json");
+  const launchPath = join6(mainRepoRoot, ".claude", "launch.json");
   const entryName = WORKTREE_ENTRY_PREFIX + worktreeName;
   try {
     const config = readLaunchFile(launchPath);
     if (!config) return null;
-    const worktreesRoot = join5(mainRepoRoot, ".claude", "worktrees") + sep;
+    const worktreesRoot = join6(mainRepoRoot, ".claude", "worktrees") + sep;
     config.configurations = config.configurations.filter((c) => {
       if (c?.name === entryName) return false;
-      const isStaleWorktreeEntry = typeof c?.name === "string" && c.name.startsWith(WORKTREE_ENTRY_PREFIX) && typeof c.cwd === "string" && isAbsolute2(c.cwd) && c.cwd.startsWith(worktreesRoot) && !existsSync5(c.cwd);
+      const isStaleWorktreeEntry = typeof c?.name === "string" && c.name.startsWith(WORKTREE_ENTRY_PREFIX) && typeof c.cwd === "string" && isAbsolute2(c.cwd) && c.cwd.startsWith(worktreesRoot) && !existsSync6(c.cwd);
       return !isStaleWorktreeEntry;
     });
     let port = opts.port;
@@ -1431,7 +1652,7 @@ function resolveWorktreePort(appDir) {
   const claude = detectClaudeWorktree(appDir);
   if (claude) {
     try {
-      const config = readLaunchFile(join5(claude.mainRepoRoot, ".claude", "launch.json"));
+      const config = readLaunchFile(join6(claude.mainRepoRoot, ".claude", "launch.json"));
       const entry = config?.configurations.find(
         (c) => c?.name === WORKTREE_ENTRY_PREFIX + claude.worktreeName
       );
@@ -1478,209 +1699,18 @@ async function fetchAppIdentityToken(deployUrl, callerJwt, appId) {
     {
       method: "POST",
       headers: { Authorization: `Bearer ${callerJwt}` }
-    }
-  );
-  if (response.status === 404) return null;
-  if (!response.ok) {
-    const detail = await response.text().catch(() => "");
-    throw new Error(`Failed to fetch APP_IDENTITY_TOKEN (${response.status}): ${detail}`);
-  }
-  const body = await response.json();
-  if (!body.token) {
-    throw new Error(`Deploy worker returned no token: ${body.error ?? "unknown error"}`);
-  }
-  return body.token;
-}
-
-// src/cli/lib/wrangler-env.ts
-import { existsSync as existsSync6, readFileSync as readFileSync9, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
-import { join as join6 } from "path";
-import { parse as parseToml3, stringify as stringifyToml } from "smol-toml";
-
-// src/server/rooms/app-name.ts
-var APP_NAME_RULES = {
-  /** ^[a-z0-9](-?[a-z0-9])+$ — RFC 1035 host label, no consecutive dashes. */
-  pattern: /^[a-z0-9](?:-?[a-z0-9])+$/,
-  minLength: 2,
-  maxLength: 63
-};
-function validateAppName(raw) {
-  if (typeof raw !== "string") {
-    return { valid: false, reason: "App name must be a string" };
-  }
-  const name = raw.trim();
-  if (!name) {
-    return { valid: false, reason: "App name is required" };
-  }
-  if (name.length < APP_NAME_RULES.minLength) {
-    return { valid: false, reason: `App name "${name}" is too short (min ${APP_NAME_RULES.minLength} chars)` };
-  }
-  if (name.length > APP_NAME_RULES.maxLength) {
-    return { valid: false, reason: `App name "${name}" is too long (max ${APP_NAME_RULES.maxLength} chars)` };
-  }
-  if (!APP_NAME_RULES.pattern.test(name)) {
-    return {
-      valid: false,
-      reason: `App name "${name}" is invalid. Use lowercase letters, digits, and single hyphens only (must start + end with alphanumeric). Examples: my-app, search-v2, unison-search.`
-    };
-  }
-  return { valid: true, name };
-}
-function resolveAppName(raw) {
-  const strict = validateAppName(raw);
-  if (strict.valid) return { ok: true, name: strict.name };
-  if (typeof raw !== "string") return { ok: false, reason: strict.reason };
-  const trimmed = raw.trim();
-  if (!trimmed) return { ok: false, reason: "App name is required" };
-  const sanitized = sanitizeAppName(trimmed);
-  const sanitizedStrict = validateAppName(sanitized);
-  if (!sanitizedStrict.valid) {
-    return {
-      ok: false,
-      reason: `App name "${trimmed}" can't be sanitized into a valid name (${sanitizedStrict.reason}). Pick something matching: lowercase letters, digits, single hyphens, ${APP_NAME_RULES.minLength}-${APP_NAME_RULES.maxLength} chars.`
-    };
-  }
-  return {
-    ok: true,
-    name: sanitized,
-    warning: `App name "${trimmed}" doesn't conform to deploy rules \u2014 using "${sanitized}" instead. Update wrangler.toml's \`name\` to silence this warning.`
-  };
-}
-function sanitizeAppName(raw) {
-  return raw.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-{2,}/g, "-").replace(/^-+|-+$/g, "");
-}
-
-// src/cli/lib/wrangler-env.ts
-var NON_INHERITABLE_ENV_KEYS = /* @__PURE__ */ new Set([
-  "define",
-  "vars",
-  "durable_objects",
-  "kv_namespaces",
-  "r2_buckets",
-  "ai_search_namespaces",
-  "ai_search",
-  "ratelimits",
-  "vectorize",
-  "services",
-  "queues",
-  "workflows",
-  "tail_consumers",
-  "secrets",
-  "secrets_store_secrets"
-]);
-var generatedConfigSeq = 0;
-function resolveAppNameForEnv(config, envName) {
-  if (!envName) {
-    return resolveAppName(config.name);
-  }
-  const envBlock = config.env?.[envName];
-  if (!envBlock) {
-    return {
-      ok: false,
-      code: "missing_env_block",
-      reason: `wrangler.toml: no [env.${envName}] block found. Add one with a distinct \`name\` to deploy this environment.`
-    };
-  }
-  if (typeof envBlock.name !== "string" || envBlock.name.trim() === "") {
-    return {
-      ok: false,
-      reason: `wrangler.toml: [env.${envName}].name is missing. Set a distinct app name (e.g. "${typeof config.name === "string" ? config.name : "myapp"}-${envName}") so this environment doesn't overwrite the default.`
-    };
-  }
-  if (envBlock.name === config.name) {
-    return {
-      ok: false,
-      reason: `wrangler.toml: [env.${envName}].name "${envBlock.name}" is the same as the top-level name. Pick a distinct name (e.g. "${config.name}-${envName}") so deploys don't collide.`
-    };
-  }
-  return resolveAppName(envBlock.name);
-}
-function devVarsPathFor(appDir) {
-  return join6(appDir, ".dev.vars");
-}
-function prepareWranglerEnvConfig(appDir, envName) {
-  if (!envName) return { cleanup() {
-  } };
-  const config = readWranglerConfig(appDir);
-  const resolved = resolveAppNameForEnv(config, envName);
-  if (!resolved.ok) throw new Error(resolved.reason);
-  const flattened = flattenWranglerEnvConfig(config, envName);
-  const configPath = join6(
-    appDir,
-    `.wrangler.deepspace.${safeGeneratedConfigSegment(envName)}.${process.pid}.${++generatedConfigSeq}.toml`
-  );
-  writeFileSync4(
-    configPath,
-    [
-      "# Generated by DeepSpace for this CLI run.",
-      "# Do not edit; wrangler.toml remains the source of truth.",
-      stringifyToml(flattened)
-    ].join("\n").replace(/\s*$/u, "\n")
-  );
-  return {
-    configPath,
-    cleanup() {
-      rmSync2(configPath, { force: true });
-    }
-  };
-}
-function wranglerViteEnv(baseEnv, prepared, extraEnv = {}) {
-  const env = { ...baseEnv, ...extraEnv };
-  if (prepared.configPath) {
-    delete env.CLOUDFLARE_ENV;
-    env.CLOUDFLARE_VITE_WRANGLER_CONFIG_PATH = prepared.configPath;
-  }
-  return env;
-}
-function flattenWranglerEnvConfig(config, envName) {
-  const envRoot = asTomlRecord(config.env);
-  const envBlock = asTomlRecord(envRoot?.[envName]);
-  if (!envBlock) {
-    throw new Error(`wrangler.toml: no [env.${envName}] block found.`);
-  }
-  const flattened = {};
-  for (const [key, value] of Object.entries(config)) {
-    if (key === "env" || NON_INHERITABLE_ENV_KEYS.has(key)) continue;
-    flattened[key] = value;
-  }
-  for (const [key, value] of Object.entries(envBlock)) {
-    flattened[key] = value;
-  }
-  if (!("durable_objects" in envBlock) && config.durable_objects) {
-    flattened.durable_objects = config.durable_objects;
-  }
-  const envVars = asTomlRecord(envBlock.vars) ?? {};
-  if (!("APP_NAME" in envVars) && typeof envBlock.name === "string") {
-    flattened.vars = { ...envVars, APP_NAME: envBlock.name };
-  }
-  return flattened;
-}
-function asTomlRecord(value) {
-  return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
-}
-function safeGeneratedConfigSegment(value) {
-  return value.replace(/[^A-Za-z0-9._-]/gu, "_");
-}
-var WranglerConfigError = class extends Error {
-  constructor(path, cause) {
-    const detail = cause instanceof Error ? cause.message : String(cause);
-    super(`wrangler.toml: malformed TOML at ${path}: ${detail}`);
-    this.path = path;
-    this.cause = cause;
-    this.name = "WranglerConfigError";
+    }
+  );
+  if (response.status === 404) return null;
+  if (!response.ok) {
+    const detail = await response.text().catch(() => "");
+    throw new Error(`Failed to fetch APP_IDENTITY_TOKEN (${response.status}): ${detail}`);
   }
-};
-function readWranglerConfig(appDir) {
-  const path = join6(appDir, "wrangler.toml");
-  const raw = readFileSync9(path, "utf-8");
-  try {
-    return parseToml3(raw);
-  } catch (err) {
-    throw new WranglerConfigError(path, err);
+  const body = await response.json();
+  if (!body.token) {
+    throw new Error(`Deploy worker returned no token: ${body.error ?? "unknown error"}`);
   }
-}
-function hasWranglerConfig(appDir) {
-  return existsSync6(join6(appDir, "wrangler.toml"));
+  return body.token;
 }
 
 // src/cli/lib/dev-vars.ts
@@ -1722,15 +1752,15 @@ async function writeDevVars(appDir, ownerId, callerJwt, wranglerEnv, opts = {})
 }
 
 // src/cli/lib/install-status.ts
-import { existsSync as existsSync8, readFileSync as readFileSync11, realpathSync as realpathSync3 } from "fs";
+import { existsSync as existsSync8, readFileSync as readFileSync10, realpathSync as realpathSync3 } from "fs";
 import { dirname as dirname6, join as join8, resolve as resolve6 } from "path";
 
 // src/cli/lib/package-manager.ts
-import { existsSync as existsSync7, readFileSync as readFileSync10 } from "fs";
+import { existsSync as existsSync7, readFileSync as readFileSync9 } from "fs";
 import { join as join7 } from "path";
 function detectPackageManager(appDir) {
   try {
-    const pkg2 = JSON.parse(readFileSync10(join7(appDir, "package.json"), "utf-8"));
+    const pkg2 = JSON.parse(readFileSync9(join7(appDir, "package.json"), "utf-8"));
     const name = typeof pkg2.packageManager === "string" ? pkg2.packageManager.split("@")[0] : "";
     if (name === "npm" || name === "pnpm" || name === "yarn" || name === "bun") return name;
   } catch {
@@ -1768,7 +1798,7 @@ function ensureInstallReady(appDir) {
   const donePath = join8(sentinelDir, "install.done");
   const logPath = join8(sentinelDir, "install.log");
   if (existsSync8(errPath)) {
-    const detail = readFileSync11(errPath, "utf-8").trimEnd();
+    const detail = readFileSync10(errPath, "utf-8").trimEnd();
     const log29 = existsSync8(logPath) ? ` Full log: ${logPath}.` : "";
     throw new Refusal(
       `Dependency install failed: ${detail}.${log29} Run \`npm install\` (or \`bun install\`) manually, then retry.`,
@@ -1824,7 +1854,7 @@ function canonicalPath2(path) {
 function installWorkerAlive(sentinelDir) {
   const pidPath = join8(sentinelDir, "install.pid");
   if (!existsSync8(pidPath)) return false;
-  const pid = Number(readFileSync11(pidPath, "utf-8").trim());
+  const pid = Number(readFileSync10(pidPath, "utf-8").trim());
   if (!Number.isSafeInteger(pid) || pid <= 0) return false;
   try {
     process.kill(pid, 0);
@@ -2180,11 +2210,7 @@ async function secretsApi(deployUrl, token, path, init = {}) {
   });
   const body = await res.json().catch(() => ({}));
   if (!res.ok) {
-    const err = new Error(body.error ?? `Secrets request failed (${res.status})`);
-    err.status = res.status;
-    err.code = body.code;
-    err.apiPath = path;
-    throw err;
+    throw new ApiError(body.error ?? `Secrets request failed (${res.status})`, res.status, body.code, path);
   }
   return body;
 }
@@ -2447,6 +2473,23 @@ function lintSchema(schema) {
   }
   return warnings;
 }
+function lintSchemas(schemas) {
+  return [...schemas.flatMap((schema) => lintSchema(schema)), ...lintSchemaSet(schemas)];
+}
+function lintSchemaSet(schemas) {
+  const warnings = [];
+  if (!schemas.some((schema) => schema.name === "team_members")) {
+    for (const schema of schemas) {
+      const teamRoles = Object.entries(schema.permissions).filter(([, p35]) => [p35.read, p35.update, p35.delete].includes("team")).map(([role]) => role);
+      if (teamRoles.length > 0) {
+        warnings.push(
+          `[${schema.name}] role(s) ${teamRoles.join(", ")} use the 'team' permission level, but no 'team_members' collection is registered. 'team' resolves membership from team_members (teamId, userId, status), so without it those roles are denied everything \u2014 silently. Register a team_members schema or use another level.`
+        );
+      }
+    }
+  }
+  return warnings;
+}
 
 // src/cli/lib/schema-lint.ts
 async function lintProjectSchemas(appDir) {
@@ -2475,15 +2518,20 @@ async function lintProjectSchemas(appDir) {
     return null;
   }
   if (!Array.isArray(schemas)) return null;
-  const findings = [];
-  for (const schema of schemas) {
-    if (!schema || typeof schema !== "object") continue;
+  const wellFormed = schemas.filter((schema) => {
+    if (!schema || typeof schema !== "object") return false;
     try {
-      findings.push(...lintSchema(schema));
+      lintSchema(schema);
+      return true;
     } catch {
+      return false;
     }
+  });
+  try {
+    return lintSchemas(wellFormed);
+  } catch {
+    return null;
   }
-  return findings;
 }
 var MAX_PRINTED_FINDINGS = 5;
 function formatSchemaLintFindings(findings) {
@@ -2503,11 +2551,11 @@ import { createServer, Socket } from "net";
 var DEFAULT_PORT = 5173;
 function isPortListening(port, host, timeoutMs = 500) {
   const target2 = host === "0.0.0.0" || host === "::" ? "127.0.0.1" : host;
-  return new Promise((resolve21) => {
+  return new Promise((resolve22) => {
     const socket = new Socket();
     const done = (listening) => {
       socket.destroy();
-      resolve21(listening);
+      resolve22(listening);
     };
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => done(true));
@@ -2520,7 +2568,7 @@ async function waitForPortListening(port, host, timeoutMs, signal) {
   const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline && !signal?.aborted) {
     if (await isPortListening(port, host)) return true;
-    await new Promise((resolve21) => setTimeout(resolve21, 250));
+    await new Promise((resolve22) => setTimeout(resolve22, 250));
   }
   return false;
 }
@@ -2738,7 +2786,7 @@ Free it with \`${killCmd}\`, or start on another port: \`deepspace dev start --p
 
 // src/cli/commands/kill.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { readFileSync as readFileSync12, readdirSync as readdirSync3, readlinkSync } from "fs";
+import { readFileSync as readFileSync11, readdirSync as readdirSync3, readlinkSync } from "fs";
 import { setTimeout as wait } from "timers/promises";
 var SIGTERM_GRACE_MS = 1500;
 var IS_WIN = process.platform === "win32";
@@ -2889,7 +2937,7 @@ function listenerPidsViaProc(port) {
     for (const f of ["/proc/net/tcp", "/proc/net/tcp6"]) {
       let data;
       try {
-        data = readFileSync12(f, "utf-8");
+        data = readFileSync11(f, "utf-8");
       } catch {
         continue;
       }
@@ -3027,7 +3075,8 @@ function isAlive(pid) {
 }
 
 // src/cli/commands/test.ts
-import { resolve as resolve9 } from "path";
+import { readdirSync as readdirSync4 } from "fs";
+import { join as join13, relative, resolve as resolve9, sep as sep2 } from "path";
 import { sync as spawnSync4 } from "cross-spawn";
 
 // src/cli/lib/playwright.ts
@@ -3056,10 +3105,10 @@ function ensurePlaywright(appDir) {
 }
 
 // src/cli/lib/test-account-service.ts
-import { readFileSync as readFileSync14 } from "fs";
+import { readFileSync as readFileSync13 } from "fs";
 
 // src/testing/accounts.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync13 } from "fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync12 } from "fs";
 import { homedir as homedir2 } from "os";
 import { join as join12 } from "path";
 var TEST_ACCOUNTS_PATH = join12(homedir2(), ".deepspace", "test-accounts.json");
@@ -3129,7 +3178,7 @@ function removeTestAccounts(ids, emails = [], scope = currentTestAccountScope())
 function readTestAccountStore() {
   if (!existsSync11(TEST_ACCOUNTS_PATH)) return { version: 2, scopes: {} };
   try {
-    const raw = JSON.parse(readFileSync13(TEST_ACCOUNTS_PATH, "utf-8"));
+    const raw = JSON.parse(readFileSync12(TEST_ACCOUNTS_PATH, "utf-8"));
     if (Array.isArray(raw)) return { version: 2, scopes: {} };
     if (!raw || typeof raw !== "object") {
       return { version: 2, scopes: {} };
@@ -3160,7 +3209,7 @@ function saveTestAccountStore(store) {
 var SESSION_COOKIE2 = "__Secure-better-auth.session_token";
 var AUTH_URL4 = process.env.DEEPSPACE_AUTH_URL ?? PLATFORM_URLS.auth;
 function sessionCookie() {
-  const token = readFileSync14(SESSION_PATH, "utf-8").trim();
+  const token = readFileSync13(SESSION_PATH, "utf-8").trim();
   return `${SESSION_COOKIE2}=${encodeURIComponent(token)}`;
 }
 async function fetchRemoteTestAccounts() {
@@ -3208,6 +3257,7 @@ async function recoverRemoteTestAccount(id) {
     email: data.email,
     userId: data.userId,
     label: data.label ?? null,
+    name: typeof data.name === "string" ? data.name : null,
     createdAt: data.createdAt ?? Date.now(),
     password: data.password
   };
@@ -3231,6 +3281,28 @@ async function syncTestAccountStore() {
 // src/cli/commands/test.ts
 var DEPLOY_URL2 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 var PLAYWRIGHT_OUTPUT_DIR = ".deepspace/test-results";
+var DEFAULT_SUITE_SPECS = ["tests/smoke.spec.ts", "tests/api.spec.ts"];
+function specsSkippedByDefaultSuite(appDir) {
+  const found = [];
+  const walk = (dir) => {
+    let entries;
+    try {
+      entries = readdirSync4(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (entry.name === "node_modules" || entry.name.startsWith(".")) continue;
+      const full = join13(dir, entry.name);
+      if (entry.isDirectory()) walk(full);
+      else if (entry.name.endsWith(".spec.ts")) {
+        found.push(relative(appDir, full).split(sep2).join("/"));
+      }
+    }
+  };
+  walk(join13(appDir, "tests"));
+  return found.filter((spec) => !DEFAULT_SUITE_SPECS.includes(spec)).sort();
+}
 function playwrightTestArgs(testFiles, flags = {}) {
   return [
     "playwright",
@@ -3250,7 +3322,7 @@ var test_default = defineDeepspaceCommand({
     name: "test",
     description: "Run tests for your DeepSpace app"
   },
-  jsonDescription: "Stream test output; emit the final JSON result on the last line",
+  jsonDescription: "Stream test output on stderr; stdout is the single-line JSON result",
   args: {
     suite: {
       type: "positional",
@@ -3285,6 +3357,7 @@ var test_default = defineDeepspaceCommand({
     }
   },
   async run({ args }) {
+    suiteOutputToStderr = args.json === true;
     const say = (line) => {
       if (!args.json) console.log(line);
     };
@@ -3350,6 +3423,7 @@ var test_default = defineDeepspaceCommand({
       ensurePlaywright(appDir);
     }
     let exitCode = 0;
+    let skippedSpecs = [];
     switch (suite) {
       case "smoke":
         exitCode = runPlaywright(appDir, ["tests/smoke.spec.ts"], port, wranglerEnv, forwarded);
@@ -3371,13 +3445,13 @@ var test_default = defineDeepspaceCommand({
         if (exitCode === 0) exitCode = runPlaywright(appDir, [], port, wranglerEnv, forwarded);
         break;
       case "default":
-        exitCode = runPlaywright(
-          appDir,
-          ["tests/smoke.spec.ts", "tests/api.spec.ts"],
-          port,
-          wranglerEnv,
-          forwarded
-        );
+        skippedSpecs = specsSkippedByDefaultSuite(appDir);
+        exitCode = runPlaywright(appDir, [...DEFAULT_SUITE_SPECS], port, wranglerEnv, forwarded);
+        if (skippedSpecs.length > 0) {
+          say(
+            `skipped ${skippedSpecs.length} spec file(s) not in smoke+api (${skippedSpecs.join(", ")}) \u2014 run 'deepspace test run all'`
+          );
+        }
         break;
       default:
         if (suite.endsWith(".spec.ts")) {
@@ -3392,12 +3466,13 @@ Available: smoke, api, e2e, unit, all`,
     }
     if (exitCode !== 0) {
       throw new Refusal(`Test suite '${suite}' failed (exit ${exitCode}).`, "tests_failed", {
-        extra: { suite, port, exitCode }
+        extra: { suite, port, exitCode, skippedSpecs }
       });
     }
-    return { data: { suite, port, appDir, wranglerEnv: wranglerEnv ?? null } };
+    return { data: { suite, port, appDir, wranglerEnv: wranglerEnv ?? null, skippedSpecs } };
   }
 });
+var suiteOutputToStderr = false;
 function runSuite(appDir, argv, wranglerEnv, extraEnv = {}) {
   let wranglerConfig;
   try {
@@ -3409,7 +3484,9 @@ function runSuite(appDir, argv, wranglerEnv, extraEnv = {}) {
   try {
     const result = spawnSync4("npx", argv, {
       cwd: appDir,
-      stdio: "inherit",
+      // Under --json the child's stdout is routed to our stderr: the live
+      // suite output stays visible and stdout stays a single JSON line.
+      stdio: suiteOutputToStderr ? ["inherit", 2, 2] : "inherit",
       env: wranglerViteEnv(process.env, wranglerConfig, extraEnv)
     });
     return result.status ?? 1;
@@ -3829,7 +3906,7 @@ var recover = defineDeepspaceCommand({
     for (const target2 of targets) {
       try {
         const account = await recoverRemoteTestAccount(target2.id);
-        const name = localNames.get(account.email);
+        const name = account.name ?? localNames.get(account.email);
         upsertTestAccount({
           id: account.id,
           email: account.email,
@@ -3880,7 +3957,7 @@ var test_accounts_default = defineCommand2({
 // src/cli/commands/deploy.ts
 import * as p12 from "@clack/prompts";
 import { defineCommand as defineCommand3 } from "citty";
-import { resolve as resolve13 } from "path";
+import { join as join19, resolve as resolve14 } from "path";
 
 // src/cli/lib/edge-propagation.ts
 import { request as httpRequest } from "http";
@@ -3945,14 +4022,14 @@ async function servesRelease(probe, releaseStamp) {
 }
 function getOnFreshConnection(url, timeoutMs = 5e3) {
   const send = url.protocol === "http:" ? httpRequest : httpsRequest;
-  return new Promise((resolve21) => {
+  return new Promise((resolve22) => {
     const request2 = send(
       url,
       { method: "GET", agent: false, timeout: timeoutMs, headers: { "cache-control": "no-cache" } },
       (response) => {
         if (response.statusCode !== 200) {
           response.resume();
-          resolve21(null);
+          resolve22(null);
           return;
         }
         let body = "";
@@ -3960,20 +4037,20 @@ function getOnFreshConnection(url, timeoutMs = 5e3) {
         response.on("data", (chunk) => {
           if (body.length < 4096) body += chunk;
         });
-        response.on("end", () => resolve21(body));
-        response.on("error", () => resolve21(null));
+        response.on("end", () => resolve22(body));
+        response.on("error", () => resolve22(null));
       }
     );
     request2.on("timeout", () => {
       request2.destroy();
-      resolve21(null);
+      resolve22(null);
     });
-    request2.on("error", () => resolve21(null));
+    request2.on("error", () => resolve22(null));
     request2.end();
   });
 }
 function sleep2(ms) {
-  return new Promise((resolve21) => setTimeout(resolve21, ms));
+  return new Promise((resolve22) => setTimeout(resolve22, ms));
 }
 
 // src/shared/app-files.ts
@@ -4038,36 +4115,49 @@ function describeFilesFailure(status3, body) {
 import * as p6 from "@clack/prompts";
 import { execSync as execSync2 } from "child_process";
 import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync14, lstatSync as lstatSync2, readFileSync as readFileSync17, readdirSync as readdirSync4, unlinkSync as unlinkSync2 } from "fs";
-import { dirname as dirname7, join as join15, resolve as resolve11 } from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync16, readdirSync as readdirSync6 } from "fs";
+import { dirname as dirname7, join as join17, resolve as resolve12 } from "path";
+
+// src/build/plugin.ts
+import { existsSync as existsSync12, lstatSync, readdirSync as readdirSync5, unlinkSync as unlinkSync2 } from "fs";
+import { join as join14, resolve as resolve11 } from "path";
+function removeBuildDevVars(workerDir) {
+  const path = join14(workerDir, ".dev.vars");
+  if (!existsSync12(path)) return false;
+  if (!lstatSync(path).isFile()) {
+    throw new Error(`Refusing unsafe build secret path: ${path}`);
+  }
+  unlinkSync2(path);
+  return true;
+}
 
 // src/documentation/deploy.ts
-import { existsSync as existsSync12, readFileSync as readFileSync15 } from "fs";
-import { join as join13 } from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync14 } from "fs";
+import { join as join15 } from "path";
 function readDocumentationDeployManifest(appDir, clientDir) {
-  if (!existsSync12(join13(appDir, "documentation.json"))) return void 0;
-  const manifestPath = join13(clientDir, "_documentation", "manifest.json");
-  if (!existsSync12(manifestPath)) {
+  if (!existsSync13(join15(appDir, "documentation.json"))) return void 0;
+  const manifestPath = join15(clientDir, "_documentation", "manifest.json");
+  if (!existsSync13(manifestPath)) {
     throw new Error(
       "documentation.json exists but the build produced no documentation manifest. Ensure vite.config.ts includes deepSpaceDocumentation() from deepspace/documentation."
     );
   }
-  return JSON.parse(readFileSync15(manifestPath, "utf8"));
+  return JSON.parse(readFileSync14(manifestPath, "utf8"));
 }
 
 // src/cli/commands/update/app-migrations.ts
 import {
   closeSync,
   constants,
-  existsSync as existsSync13,
+  existsSync as existsSync14,
   fstatSync,
   ftruncateSync,
-  lstatSync,
+  lstatSync as lstatSync2,
   openSync,
-  readFileSync as readFileSync16,
+  readFileSync as readFileSync15,
   writeSync
 } from "fs";
-import { join as join14 } from "path";
+import { join as join16 } from "path";
 
 // src/shared/protocol/app-migrations.ts
 var APP_MIGRATION_ID_RE = /^[a-z0-9][a-z0-9._-]{0,127}$/;
@@ -4119,8 +4209,8 @@ var APP_MIGRATION_DEFINITIONS = SOURCE_MIGRATIONS.map(
   ({ id, description }) => ({ id, description })
 );
 function readAppliedAppMigrations(appDir) {
-  const path = join14(appDir, APP_MIGRATIONS_MANIFEST);
-  if (!existsSync13(path)) return [];
+  const path = join16(appDir, APP_MIGRATIONS_MANIFEST);
+  if (!existsSync14(path)) return [];
   const source = readRegularFile(path);
   let parsed;
   try {
@@ -4146,10 +4236,10 @@ function planAppMigrations(appDir) {
   const edits = [];
   for (const repoPath of tracked) {
     if (!isSourcePath(repoPath, appPrefix)) continue;
-    const absolutePath = join14(repo, repoPath);
+    const absolutePath = join16(repo, repoPath);
     let stat;
     try {
-      stat = lstatSync(absolutePath);
+      stat = lstatSync2(absolutePath);
     } catch {
       continue;
     }
@@ -4183,8 +4273,8 @@ function planAppMigrations(appDir) {
   });
   if (pending.length > 0 && blockers.length === 0) {
     const manifestPath = `${appPrefix}${APP_MIGRATIONS_MANIFEST}`;
-    const absoluteManifestPath = join14(repo, manifestPath);
-    const before = existsSync13(absoluteManifestPath) ? readRegularFile(absoluteManifestPath) : null;
+    const absoluteManifestPath = join16(repo, manifestPath);
+    const before = existsSync14(absoluteManifestPath) ? readRegularFile(absoluteManifestPath) : null;
     const after = `${JSON.stringify([...appliedIds, ...pending.map(({ id }) => id)], null, 2)}
 `;
     if (before !== after) edits.push({ path: manifestPath, before, after });
@@ -4199,13 +4289,13 @@ function planAppMigrations(appDir) {
 function applyAppMigrationPlan(appDir, plan) {
   const repo = repoToplevel(appDir);
   for (const edit of plan.edits) {
-    const absolutePath = join14(repo, edit.path);
-    const current = existsSync13(absolutePath) ? readRegularFile(absolutePath) : null;
+    const absolutePath = join16(repo, edit.path);
+    const current = existsSync14(absolutePath) ? readRegularFile(absolutePath) : null;
     if (current !== edit.before) {
       throw new Error(`Migration input changed after planning: ${edit.path}`);
     }
   }
-  for (const edit of plan.edits) writeRegularFile(join14(repo, edit.path), edit.before, edit.after);
+  for (const edit of plan.edits) writeRegularFile(join16(repo, edit.path), edit.before, edit.after);
 }
 function normalizeEol(source) {
   return source.replaceAll("\r\n", "\n");
@@ -4214,18 +4304,18 @@ function restoreEol(source, checkout) {
   return checkout.includes("\r\n") ? source.replaceAll("\n", "\r\n") : source;
 }
 function readRegularFile(path) {
-  const before = lstatSync(path);
+  const before = lstatSync2(path);
   if (!before.isFile() || before.isSymbolicLink()) {
     throw new Error(`Migration input must be a regular file, not a symlink: ${path}`);
   }
   const fd = openSync(path, constants.O_RDONLY);
   try {
     const opened = fstatSync(fd);
-    const after = lstatSync(path);
+    const after = lstatSync2(path);
     if (!opened.isFile() || opened.dev !== after.dev || opened.ino !== after.ino) {
       throw new Error(`Migration input changed while opening: ${path}`);
     }
-    return readFileSync16(fd, "utf-8");
+    return readFileSync15(fd, "utf-8");
   } finally {
     closeSync(fd);
   }
@@ -4240,18 +4330,18 @@ function writeRegularFile(path, before, after) {
     }
     return;
   }
-  const pathStat = lstatSync(path);
+  const pathStat = lstatSync2(path);
   if (!pathStat.isFile() || pathStat.isSymbolicLink()) {
     throw new Error(`Migration input must be a regular file, not a symlink: ${path}`);
   }
   const fd = openSync(path, constants.O_RDWR);
   try {
     const opened = fstatSync(fd);
-    const currentPath = lstatSync(path);
+    const currentPath = lstatSync2(path);
     if (!opened.isFile() || opened.dev !== currentPath.dev || opened.ino !== currentPath.ino) {
       throw new Error(`Migration input changed while opening: ${path}`);
     }
-    if (readFileSync16(fd, "utf-8") !== before) {
+    if (readFileSync15(fd, "utf-8") !== before) {
       throw new Error(`Migration input changed after planning: ${path}`);
     }
     ftruncateSync(fd, 0);
@@ -4578,16 +4668,6 @@ function findWorkerOwnedNotFoundBlockers(source, file) {
 
 // src/cli/commands/deploy/build.ts
 var RESERVED_RUN_WORKER_FIRST2 = new Set(RESERVED_RUN_WORKER_FIRST);
-function removeBuildDevVars(workerDir) {
-  const path = join15(workerDir, ".dev.vars");
-  if (!existsSync14(path)) return false;
-  const stat = lstatSync2(path);
-  if (!stat.isFile() || stat.isSymbolicLink()) {
-    throw new Error(`Refusing unsafe build secret path: ${path}`);
-  }
-  unlinkSync2(path);
-  return true;
-}
 function declaredCompatibilityDate(config) {
   const declared = config.compatibility_date;
   return typeof declared === "string" && /^\d{4}-\d{2}-\d{2}$/.test(declared) ? declared : null;
@@ -4624,19 +4704,19 @@ async function buildDeployBundle(options) {
     preparedWranglerConfig?.cleanup();
   }
   spinner2.stop(`Built (${Math.round((Date.now() - buildStarted) / 1e3)}s)`);
-  const deployConfigPath = join15(appDir, ".wrangler", "deploy", "config.json");
-  if (!existsSync14(deployConfigPath)) {
+  const deployConfigPath = join17(appDir, ".wrangler", "deploy", "config.json");
+  if (!existsSync15(deployConfigPath)) {
     output.die(
       "Build output config not found at .wrangler/deploy/config.json",
       "build_output_missing"
     );
   }
-  const deployConfig = JSON.parse(readFileSync17(deployConfigPath, "utf-8"));
-  const outputWranglerPath = resolve11(dirname7(deployConfigPath), deployConfig.configPath);
-  if (!existsSync14(outputWranglerPath)) {
+  const deployConfig = JSON.parse(readFileSync16(deployConfigPath, "utf-8"));
+  const outputWranglerPath = resolve12(dirname7(deployConfigPath), deployConfig.configPath);
+  if (!existsSync15(outputWranglerPath)) {
     output.die(`Output wrangler.json not found at ${outputWranglerPath}`, "build_output_missing");
   }
-  const outputConfig = JSON.parse(readFileSync17(outputWranglerPath, "utf-8"));
+  const outputConfig = JSON.parse(readFileSync16(outputWranglerPath, "utf-8"));
   if (outputConfig.name && outputConfig.name !== appName) {
     const envHint = envName ? ` (--env ${envName})` : "";
     output.die(
@@ -4650,12 +4730,12 @@ async function buildDeployBundle(options) {
   } catch (error) {
     output.die(errorMessage(error), "build_output_unsafe");
   }
-  const workerBundlePath = join15(workerDir, outputConfig.main);
-  const clientDir = outputConfig.assets?.directory ? resolve11(workerDir, outputConfig.assets.directory) : null;
-  if (!existsSync14(workerBundlePath)) {
+  const workerBundlePath = join17(workerDir, outputConfig.main);
+  const clientDir = outputConfig.assets?.directory ? resolve12(workerDir, outputConfig.assets.directory) : null;
+  if (!existsSync15(workerBundlePath)) {
     output.die(`Worker bundle not found at ${workerBundlePath}`, "build_output_missing");
   }
-  if (!clientDir || !existsSync14(clientDir)) {
+  if (!clientDir || !existsSync15(clientDir)) {
     return output.die(`Client assets not found at ${clientDir}`, "build_output_missing");
   }
   try {
@@ -4670,7 +4750,7 @@ async function buildDeployBundle(options) {
   spinner2.stop(`Collected ${assets.length} assets`);
   const appIdRefusal = clientAppIdRefusal(assets, appId, envName);
   if (appIdRefusal) output.die(appIdRefusal.message, appIdRefusal.code);
-  const workerJs = readFileSync17(workerBundlePath, "utf-8");
+  const workerJs = readFileSync16(workerBundlePath, "utf-8");
   const doBindings = outputConfig.durable_objects?.bindings;
   const sqliteClasses = new Set(
     outputConfig.migrations?.flatMap((migration) => migration.new_sqlite_classes ?? []) ?? []
@@ -4753,7 +4833,7 @@ function clientAppIdRefusal(assets, appId, envName) {
   let unsubstituted;
   for (const asset of assets) {
     if (!CLIENT_CODE_ASSET.test(asset.path)) continue;
-    const source = readFileSync17(asset.sourcePath, "utf-8");
+    const source = readFileSync16(asset.sourcePath, "utf-8");
     if (unsubstituted === void 0 && source.includes(APP_ID_DEFINE)) unsubstituted = asset.path;
     for (const found of source.matchAll(APP_ID_LITERAL)) {
       if (found[0] !== appId && !foreign.has(found[0])) foreign.set(found[0], asset.path);
@@ -4780,14 +4860,14 @@ var LARGE_MEDIA_HOME = "Large media belongs in your app files (`deepspace app fi
 function collectAssets(dir) {
   const assets = [];
   const walk = (currentDir, prefix) => {
-    for (const entry of readdirSync4(currentDir, { withFileTypes: true })) {
+    for (const entry of readdirSync6(currentDir, { withFileTypes: true })) {
       if (isDeployAssetControlFile(entry.name)) continue;
-      const fullPath = join15(currentDir, entry.name);
+      const fullPath = join17(currentDir, entry.name);
       const relativePath = prefix ? `${prefix}/${entry.name}` : entry.name;
       if (entry.isDirectory()) {
         walk(fullPath, relativePath);
       } else {
-        const bytes = readFileSync17(fullPath);
+        const bytes = readFileSync16(fullPath);
         assets.push({
           path: `/${relativePath}`,
           hash: createHash2("sha256").update(bytes).digest("hex"),
@@ -4806,9 +4886,9 @@ function readDeployAssetConfig(clientDir) {
     ["_headers", "_headers"],
     ["_redirects", "_redirects"]
   ]) {
-    const filePath = join15(clientDir, file);
-    if (!existsSync14(filePath)) continue;
-    const content = readFileSync17(filePath, "utf8");
+    const filePath = join17(clientDir, file);
+    if (!existsSync15(filePath)) continue;
+    const content = readFileSync16(filePath, "utf8");
     if (content.trim()) config[key] = content;
   }
   return config;
@@ -4822,8 +4902,8 @@ function errorMessage(error) {
 
 // src/cli/commands/deploy/commerce.ts
 import * as p7 from "@clack/prompts";
-import { existsSync as existsSync15 } from "fs";
-import { join as join16 } from "path";
+import { existsSync as existsSync16 } from "fs";
+import { join as join18 } from "path";
 import { pathToFileURL as pathToFileURL2 } from "url";
 
 // src/shared/api-error.ts
@@ -4875,10 +4955,10 @@ function errorMessage2(error) {
   return error instanceof Error ? error.message : String(error);
 }
 async function loadDeclaration(appDir, sourceFile, outputFile, exportName) {
-  const sourcePath = join16(appDir, "src", sourceFile);
-  if (!existsSync15(sourcePath)) return void 0;
+  const sourcePath = join18(appDir, "src", sourceFile);
+  if (!existsSync16(sourcePath)) return void 0;
   const esbuild = await import("esbuild");
-  const outputPath = join16(appDir, ".wrangler", "deploy", outputFile);
+  const outputPath = join18(appDir, ".wrangler", "deploy", outputFile);
   await esbuild.build({
     entryPoints: [sourcePath],
     bundle: true,
@@ -4971,7 +5051,7 @@ Stripe will keep charging them until you cancel. Cancel at the end of their curr
   }
 }
 async function syncSubscriptionPlans(appDir, appName, token, nonInteractive) {
-  if (!existsSync15(join16(appDir, "src", "subscriptions.ts"))) return;
+  if (!existsSync16(join18(appDir, "src", "subscriptions.ts"))) return;
   let plans;
   try {
     plans = await loadDeclaration(
@@ -5026,7 +5106,7 @@ async function syncSubscriptionPlans(appDir, appName, token, nonInteractive) {
   }
 }
 async function syncOneTimeProducts(appDir, appName, token) {
-  if (!existsSync15(join16(appDir, "src", "products.ts"))) return;
+  if (!existsSync16(join18(appDir, "src", "products.ts"))) return;
   let products;
   try {
     products = await loadDeclaration(
@@ -5128,7 +5208,7 @@ function createDeployOutput(json) {
 
 // src/cli/commands/deploy/request.ts
 import * as p10 from "@clack/prompts";
-import { readFileSync as readFileSync18 } from "fs";
+import { readFileSync as readFileSync17 } from "fs";
 
 // src/cli/commands/deploy/repository.ts
 import * as p9 from "@clack/prompts";
@@ -5319,9 +5399,9 @@ function repoApi(deployUrl, token, appId) {
 }
 
 // src/cli/lib/vc-remote.ts
-import { existsSync as existsSync16 } from "fs";
+import { existsSync as existsSync17 } from "fs";
 import { tmpdir } from "os";
-import { isAbsolute as isAbsolute3, relative, resolve as resolve12 } from "path";
+import { isAbsolute as isAbsolute3, relative as relative2, resolve as resolve13 } from "path";
 function spaceRemoteName(environment = DEEPSPACE_ENV) {
   if (environment === "staging") return "space-staging";
   if (environment === "production") return "space";
@@ -5367,14 +5447,14 @@ function entryIsTransient(cwd) {
   const entry = process.argv[1];
   if (!entry) return true;
   if (/[\\/]_npx[\\/]/.test(entry) || entry.startsWith(tmpdir())) return true;
-  const rel = relative(resolve12(cwd), resolve12(entry));
+  const rel = relative2(resolve13(cwd), resolve13(entry));
   return rel === "" || !rel.startsWith("..") && !isAbsolute3(rel);
 }
 function helperEntryUsable(command) {
   const match = /^!(?:DEEPSPACE_ENV=(production|staging) )?'([^']*)' '([^']*)' git-credential$/.exec(command);
   const expectedEnvironment = DEEPSPACE_ENV === "production" ? void 0 : DEEPSPACE_ENV;
   if (!match || match[1] !== expectedEnvironment) return false;
-  return existsSync16(match[2]) && existsSync16(match[3]);
+  return existsSync17(match[2]) && existsSync17(match[3]);
 }
 function credentialHelperCommand(environment = DEEPSPACE_ENV) {
   const entry = process.argv[1];
@@ -5509,12 +5589,6 @@ function classifyPushTransportFailure(error, cwd) {
       error: `A first push to this new app hit your plan's active-app quota. Use \`deepspace app list\` to choose an app to undeploy, or upgrade your plan, then retry.`
     };
   }
-  if (/(?:HTTP |error: )422\b/i.test(message)) {
-    return {
-      code: "source_managed_by_github",
-      error: "This app uses GitHub source. Manage commits with normal Git/GitHub; `deepspace deploy` ships the local working tree without changing Git."
-    };
-  }
   if (/(?:HTTP |error: )429\b/i.test(message)) {
     return {
       code: "rate_limited",
@@ -5524,6 +5598,12 @@ function classifyPushTransportFailure(error, cwd) {
   if (/(?:HTTP |error: )413\b/i.test(message)) {
     return { code: "push_too_large", error: pushTooLargeMessage(cwd) };
   }
+  if (/(?:HTTP |error: )422\b/i.test(message)) {
+    return {
+      code: "source_managed_by_github",
+      error: "This app's source is managed by GitHub, so pushes to the DeepSpace repo are refused. Push to the GitHub repository instead \u2014 `deepspace app status` names it."
+    };
+  }
   return null;
 }
 function pushToSpace(cwd, token, refspec, opts = {}) {
@@ -5895,7 +5975,7 @@ async function pushWithTransientRetry(push) {
       const message = errorMessage3(error);
       const transient = /(?:HTTP |error: )(?:429|503)\b/i.test(message);
       if (transient && attempt < backoffMs.length && Date.now() + backoffMs[attempt] < deadline) {
-        await new Promise((resolve21) => setTimeout(resolve21, backoffMs[attempt]));
+        await new Promise((resolve22) => setTimeout(resolve22, backoffMs[attempt]));
         continue;
       }
       throw error;
@@ -5924,6 +6004,12 @@ function detachedHeadRefusal() {
 }
 
 // src/cli/commands/deploy/request.ts
+function renameRefusalMessage(rename2) {
+  return `This deploy renames the app: ${rename2.fromHost} \u2192 ${rename2.toHost}. Confirmation needs an interactive terminal \u2014 re-run with --rename to approve the rename, or \`deepspace app init --new-id\` if you meant a separate app.`;
+}
+function renamePromptMessage(rename2) {
+  return `This deploy renames the app: ${rename2.fromHost} \u2192 ${rename2.toHost}. The URL changes and the old one stops serving right away; data, secrets, and collaborators travel with it \u2014 the display name in \`src/constants.ts\` (\`APP_NAME\`) does not, update it yourself. (Meant a separate app? Run \`deepspace app init --new-id\` instead.) Rename?`;
+}
 var CLOUDFLARE_DEPLOY_ERROR_HINT = "Deployment reached the DeepSpace deploy worker, but Cloudflare's deployment control-plane API failed. This is often caused by a Cloudflare Dashboard/API incident or Workers for Platforms entitlement outage. Already deployed apps should keep serving; wait for Cloudflare to recover and retry.";
 var DEPLOY_SERVICE_LIMIT_HINT = "The DeepSpace deploy service hit a resource limit processing this deploy (the deploy worker was terminated before it could answer). This is a DeepSpace-side failure, not a Cloudflare incident \u2014 your app was not changed. Retry; if it keeps happening, report the app id and asset count.";
 var REQUIRED_ASSET_TRANSPORT = "content-addressed-v1";
@@ -6043,16 +6129,11 @@ async function deployBuiltBundle(options) {
   let body = await response.json().catch(() => ({}));
   if (response.status === 409 && body.code === "rename_required" && !confirmRename) {
     spinner2.stop("Rename confirmation needed");
+    const rename2 = { fromHost: body.fromHost ?? "", toHost: body.toHost ?? "" };
     if (output.nonInteractive) {
-      await bail(
-        `This deploy renames the app: ${body.fromHost} \u2192 ${body.toHost}. Confirmation needs an interactive terminal \u2014 re-run with --rename to approve the rename, or \`deepspace app init --new-id\` if you meant a separate app.`,
-        null,
-        "rename_required"
-      );
+      await bail(renameRefusalMessage(rename2), null, "rename_required");
     }
-    const confirmed = await p10.confirm({
-      message: `This deploy renames the app: ${body.fromHost} \u2192 ${body.toHost}. The URL changes and the old one stops serving right away; data, secrets, and collaborators travel with it. (Meant a separate app? Run \`deepspace app init --new-id\` instead.) Rename?`
-    });
+    const confirmed = await p10.confirm({ message: renamePromptMessage(rename2) });
     if (p10.isCancel(confirmed) || !confirmed) await bail("Deploy cancelled.", null);
     confirmRename = true;
     spinner2.start(`Deploying ${appName}...`);
@@ -6179,7 +6260,7 @@ async function uploadDeployAssets(options) {
           // against the plan before it touches storage, and a stream body
           // would be sent chunked with no length at all; a retry also needs a
           // body it can send again.
-          body: readFileSync18(asset.sourcePath)
+          body: readFileSync17(asset.sourcePath)
         })
       );
       if (!response.ok) {
@@ -6260,7 +6341,7 @@ async function postWithRetry(url, makeInit, {
       lastError = error;
     }
     if (attempt < attempts) {
-      await new Promise((resolve21) => setTimeout(resolve21, Math.min(8e3, 500 * 2 ** (attempt - 1))));
+      await new Promise((resolve22) => setTimeout(resolve22, Math.min(8e3, 500 * 2 ** (attempt - 1))));
     }
   }
   if (lastResponse) return lastResponse;
@@ -6395,180 +6476,213 @@ var deploy_default = defineCommand3({
   },
   async run({ args }) {
     const output = createDeployOutput(args.json === true);
-    preflightNodeVersion("deploy");
-    const appDir = resolve13(args.dir ?? ".");
-    const selectorRefusal = blankSelectorRefusal(args);
-    if (selectorRefusal) output.die(selectorRefusal.error, selectorRefusal.code);
-    const envName = typeof args.env === "string" && args.env.trim() ? args.env.trim() : void 0;
-    if (!hasWranglerConfig(appDir)) {
-      output.die("No wrangler.toml found. Are you in a DeepSpace app directory?", "not_in_app_repo");
-    }
     try {
-      ensureInstallReady(appDir);
+      await runDeploy(args, output);
     } catch (error) {
-      const refusal = error;
-      output.die(refusal.message ?? String(error), refusal.code ?? "deps_missing", {
-        action: refusal.action
-      });
+      if (error instanceof CliExit) throw error;
+      output.die(formatCliError(error), errorCode(error) ?? "deploy_failed");
     }
-    p12.intro("Deploying DeepSpace app");
-    output.showIntro();
-    const wranglerConfig = readWranglerConfig(appDir);
-    const nameResult = resolveAppNameForEnv(wranglerConfig, envName);
-    if (!nameResult.ok) return output.die(nameResult.reason, nameResult.code ?? "invalid_app_name");
-    const declaredName = envName ? wranglerConfig.env?.[envName]?.name : wranglerConfig.name;
-    if (declaredName !== nameResult.name) {
-      const location = envName ? `[env.${envName}].name` : "`name`";
-      output.die(
-        `wrangler.toml: ${location} "${declaredName}" is not in canonical form. Update it to "${nameResult.name}" and re-run.`,
-        "invalid_app_name"
-      );
+  }
+});
+async function runDeploy(args, output) {
+  preflightNodeVersion("deploy");
+  const appDir = resolve14(args.dir ?? ".");
+  const selectorRefusal = blankSelectorRefusal(args);
+  if (selectorRefusal) output.die(selectorRefusal.error, selectorRefusal.code);
+  const envName = typeof args.env === "string" && args.env.trim() ? args.env.trim() : void 0;
+  if (!hasWranglerConfig(appDir)) {
+    output.die(noWranglerConfigMessage(join19(appDir, "wrangler.toml")), "not_in_app_repo");
+  }
+  try {
+    ensureInstallReady(appDir);
+  } catch (error) {
+    const refusal = error;
+    output.die(refusal.message ?? String(error), refusal.code ?? "deps_missing", {
+      action: refusal.action
+    });
+  }
+  p12.intro("Deploying DeepSpace app");
+  output.showIntro();
+  const wranglerConfig = readWranglerConfig(appDir);
+  const nameResult = resolveAppNameForEnv(wranglerConfig, envName);
+  if (!nameResult.ok) return output.die(nameResult.reason, nameResult.code ?? "invalid_app_name");
+  const declaredName = envName ? wranglerConfig.env?.[envName]?.name : wranglerConfig.name;
+  if (declaredName !== nameResult.name) {
+    const location = envName ? `[env.${envName}].name` : "`name`";
+    output.die(
+      `wrangler.toml: ${location} "${declaredName}" is not in canonical form. Update it to "${nameResult.name}" and re-run.`,
+      "invalid_app_name"
+    );
+  }
+  const appName = nameResult.name;
+  const appId = readAppId(appDir, envName);
+  p12.log.info(envName ? `App: ${appName}  (env: ${envName})` : `App: ${appName}`);
+  const { token, ownerId } = await authenticate(appDir, output);
+  if (!appId) {
+    return output.die(
+      `No app id in wrangler.toml${envName ? ` for [env.${envName}]` : ""}. Run \`deepspace app init${envName ? ` --env ${envName}` : ""}\` to register this app, then re-deploy.`,
+      "app_not_initialized",
+      {
+        action: {
+          cwd: appDir,
+          argv: ["deepspace", "app", "init", ...envName ? ["--env", envName] : []]
+        },
+        actionRequired: true
+      }
+    );
+  }
+  p12.log.info(`Id: ${appId}`);
+  const sourceState = await getAppSource(DEPLOY_URL3, token, appId);
+  if (!sourceState.registered) {
+    output.die(
+      `${appId} is not registered. If this repo's id came from an older SDK's scaffold, run \`deepspace app init --new-id\` to register it as a fresh app; a brand-new app dir registers with \`deepspace app init\`.`,
+      "app_not_registered"
+    );
+  }
+  const secretsCache = await loadDeploySecrets({
+    deployUrl: DEPLOY_URL3,
+    appDir,
+    appId,
+    envName,
+    ownerId,
+    token,
+    output
+  });
+  const ownerJwtRefusal = ownerJwtMissingRefusal(sourceState);
+  if (ownerJwtRefusal) output.die(ownerJwtRefusal.error, ownerJwtRefusal.code);
+  let confirmRename = args.rename === true;
+  const rename2 = pendingRename(sourceState.registeredHost, appName);
+  if (rename2 && !confirmRename) {
+    if (output.nonInteractive) {
+      output.die(renameRefusalMessage(rename2), "rename_required");
     }
-    const appName = nameResult.name;
-    const appId = readAppId(appDir, envName);
-    p12.log.info(envName ? `App: ${appName}  (env: ${envName})` : `App: ${appName}`);
-    const { token, ownerId } = await authenticate(appDir, output);
-    if (!appId) {
-      return output.die(
-        `No app id in wrangler.toml${envName ? ` for [env.${envName}]` : ""}. Run \`deepspace app init${envName ? ` --env ${envName}` : ""}\` to register this app, then re-deploy.`,
-        "app_not_initialized",
-        {
-          action: {
-            cwd: appDir,
-            argv: ["deepspace", "app", "init", ...envName ? ["--env", envName] : []]
-          },
-          actionRequired: true
-        }
+    const confirmed = await p12.confirm({ message: renamePromptMessage(rename2) });
+    if (p12.isCancel(confirmed) || !confirmed) output.die("Deploy cancelled.", "rename_declined");
+    confirmRename = true;
+  }
+  const repositoryPreflight = preflightDeployRepository({
+    appDir,
+    push: args.push !== false,
+    source: sourceState.source
+  });
+  if (repositoryPreflight) {
+    output.die(repositoryPreflight.error, repositoryPreflight.code);
+  }
+  const spinner2 = createSpinner();
+  const bundle = await buildDeployBundle({
+    appDir,
+    appName,
+    appId,
+    envName,
+    output,
+    spinner: spinner2
+  });
+  const oversized = oversizedAssetRefusal(bundle.assets);
+  if (oversized) {
+    spinner2.stop("Deploy failed");
+    output.die(oversized, "assets_too_large");
+  }
+  const repository = await syncDeployRepository({
+    deployUrl: DEPLOY_URL3,
+    appDir,
+    appId,
+    token,
+    push: args.push !== false,
+    ignoreStale: Boolean(args["ignore-stale"]),
+    output,
+    sourceState
+  });
+  const secrets = prepareDeploySecrets({
+    cache: secretsCache,
+    customBindings: bundle.customBindings,
+    doManifest: bundle.doManifest,
+    output
+  });
+  const body = await deployBuiltBundle({
+    deployUrl: DEPLOY_URL3,
+    appDir,
+    appId,
+    appName,
+    token,
+    rename: confirmRename,
+    claimReleased: args["claim-released"] === true,
+    ignoreStale: Boolean(args["ignore-stale"]),
+    bundle,
+    secrets,
+    repository,
+    output,
+    spinner: spinner2
+  });
+  let serving = "unverifiable";
+  const edgeWaitStarted = Date.now();
+  if (body.url) {
+    spinner2.message("Waiting for the edge to serve this release...");
+    serving = await waitForLiveRelease(body.url, body.releaseStamp, 9e4);
+    if (serving !== "confirmed") {
+      spinner2.stop(
+        serving === "unconfirmed" ? "Deployed \u2014 the edge is still rolling this release out" : "Deployed \u2014 serving could not be verified from here"
       );
-    }
-    p12.log.info(`Id: ${appId}`);
-    const secretsCache = await loadDeploySecrets({
-      deployUrl: DEPLOY_URL3,
-      appDir,
-      appId,
-      envName,
-      ownerId,
-      token,
-      output
-    });
-    const sourceState = await getAppSource(DEPLOY_URL3, token, appId);
-    if (!sourceState.registered) {
-      output.die(
-        `${appId} is not registered. If this repo's id came from an older SDK's scaffold, run \`deepspace app init --new-id\` to register it as a fresh app; a brand-new app dir registers with \`deepspace app init\`.`,
-        "app_not_registered"
+      p12.log.warn(
+        serving === "unconfirmed" ? "Some requests still get the previous release. Cloudflare rolls a version out per edge machine; it usually settles within a couple of minutes. Wait before asserting against it." : "This release carries no serving stamp (older platform, or a resumed deploy), so the CLI cannot tell which release the edge answers with."
       );
+      p12.log.info(`URL: ${body.url}`);
+      await syncCommerce(appDir, appId, token, output.nonInteractive);
+      if (output.json) {
+        return output.emitJson({
+          ok: true,
+          appId,
+          appName,
+          url: body.url,
+          releaseId: body.releaseId ?? null,
+          bundleRetained: body.bundleRetained ?? null,
+          serving,
+          recoverable: repository.recoverable,
+          ...staleBaseGuardFields(body)
+        });
+      }
+      p12.outro("Done");
+      return;
     }
-    const repositoryPreflight = preflightDeployRepository({
-      appDir,
-      push: args.push !== false,
-      source: sourceState.source
-    });
-    if (repositoryPreflight) {
-      output.die(repositoryPreflight.error, repositoryPreflight.code);
-    }
-    const spinner2 = createSpinner();
-    const bundle = await buildDeployBundle({
-      appDir,
-      appName,
-      appId,
-      envName,
-      output,
-      spinner: spinner2
-    });
-    const oversized = oversizedAssetRefusal(bundle.assets);
-    if (oversized) {
-      spinner2.stop("Deploy failed");
-      output.die(oversized, "assets_too_large");
-    }
-    const repository = await syncDeployRepository({
-      deployUrl: DEPLOY_URL3,
-      appDir,
-      appId,
-      token,
-      push: args.push !== false,
-      ignoreStale: Boolean(args["ignore-stale"]),
-      output,
-      sourceState
-    });
-    const secrets = prepareDeploySecrets({
-      cache: secretsCache,
-      customBindings: bundle.customBindings,
-      doManifest: bundle.doManifest,
-      output
-    });
-    const body = await deployBuiltBundle({
-      deployUrl: DEPLOY_URL3,
-      appDir,
+  }
+  spinner2.stop(
+    `Deployed! (edge confirmed in ${Math.round((Date.now() - edgeWaitStarted) / 1e3)}s)`
+  );
+  p12.log.success(`Live at: ${body.url}`);
+  await syncCommerce(appDir, appId, token, output.nonInteractive);
+  if (output.json) {
+    return output.emitJson({
+      ok: true,
       appId,
       appName,
-      token,
-      rename: args.rename === true,
-      claimReleased: args["claim-released"] === true,
-      ignoreStale: Boolean(args["ignore-stale"]),
-      bundle,
-      secrets,
-      repository,
-      output,
-      spinner: spinner2
+      url: body.url ?? null,
+      // Always present, so a caller branches on one field instead of
+      // inferring success from an absent one.
+      serving,
+      releaseId: body.releaseId ?? null,
+      bundleRetained: body.bundleRetained ?? null,
+      recoverable: repository.recoverable,
+      ...staleBaseGuardFields(body)
     });
-    let serving = "unverifiable";
-    const edgeWaitStarted = Date.now();
-    if (body.url) {
-      spinner2.message("Waiting for the edge to serve this release...");
-      serving = await waitForLiveRelease(body.url, body.releaseStamp, 9e4);
-      if (serving !== "confirmed") {
-        spinner2.stop(
-          serving === "unconfirmed" ? "Deployed \u2014 the edge is still rolling this release out" : "Deployed \u2014 serving could not be verified from here"
-        );
-        p12.log.warn(
-          serving === "unconfirmed" ? "Some requests still get the previous release. Cloudflare rolls a version out per edge machine; it usually settles within a couple of minutes. Wait before asserting against it." : "This release carries no serving stamp (older platform, or a resumed deploy), so the CLI cannot tell which release the edge answers with."
-        );
-        p12.log.info(`URL: ${body.url}`);
-        await syncCommerce(appDir, appId, token, output.nonInteractive);
-        if (output.json) {
-          return output.emitJson({
-            ok: true,
-            appId,
-            appName,
-            url: body.url,
-            releaseId: body.releaseId ?? null,
-            bundleRetained: body.bundleRetained ?? null,
-            serving,
-            recoverable: repository.recoverable,
-            ...staleBaseGuardFields(body)
-          });
-        }
-        p12.outro("Done");
-        return;
-      }
-    }
-    spinner2.stop(
-      `Deployed! (edge confirmed in ${Math.round((Date.now() - edgeWaitStarted) / 1e3)}s)`
-    );
-    p12.log.success(`Live at: ${body.url}`);
-    await syncCommerce(appDir, appId, token, output.nonInteractive);
-    if (output.json) {
-      return output.emitJson({
-        ok: true,
-        appId,
-        appName,
-        url: body.url ?? null,
-        // Always present, so a caller branches on one field instead of
-        // inferring success from an absent one.
-        serving,
-        releaseId: body.releaseId ?? null,
-        bundleRetained: body.bundleRetained ?? null,
-        recoverable: repository.recoverable,
-        ...staleBaseGuardFields(body)
-      });
-    }
-    p12.outro("Done");
   }
-});
+  p12.outro("Done");
+}
 async function syncCommerce(appDir, appId, token, nonInteractive) {
   await syncSubscriptionPlans(appDir, appId, token, nonInteractive);
   await syncOneTimeProducts(appDir, appId, token);
 }
+function ownerJwtMissingRefusal(state) {
+  if (state.onBehalf?.ownerJwtLive !== false) return null;
+  return {
+    code: "owner_jwt_missing",
+    error: "Cannot preserve the existing secrets: this app has no live deployment carrying an APP_OWNER_JWT. Ask the owner to redeploy."
+  };
+}
+function pendingRename(registeredHost, appName) {
+  if (!registeredHost) return null;
+  const [label, ...domain] = registeredHost.split(".");
+  if (label === appName) return null;
+  return { fromHost: registeredHost, toHost: [appName, ...domain].join(".") };
+}
 function blankSelectorRefusal(args) {
   if (args.env !== void 0 && !String(args.env).trim()) {
     return {
@@ -6629,15 +6743,18 @@ function requireAppIdArg(explicit) {
 function liveAppUrl(app2) {
   return app2.status === "active" && app2.deployedAt !== null ? app2.url : null;
 }
-async function listApps(deployUrl, token) {
-  const { apps } = await apiFetch(deployUrl, token, "/api/apps");
-  if (!Array.isArray(apps)) {
+async function listAppsPage(deployUrl, token) {
+  const body = await apiFetch(deployUrl, token, "/api/apps");
+  if (!Array.isArray(body.apps)) {
     throw new InputError(
       `The deploy service at ${deployUrl} returned an unexpected response shape for the app list \u2014 check DEEPSPACE_DEPLOY_URL (is this the service the app lives on?).`,
       "invalid_response"
     );
   }
-  return apps;
+  return { apps: body.apps, pendingTransfers: body.pendingTransfers ?? [] };
+}
+async function listApps(deployUrl, token) {
+  return (await listAppsPage(deployUrl, token)).apps;
 }
 function matchAppSelector(apps, selector) {
   const byId = apps.find((app2) => app2.appId === selector);
@@ -6759,6 +6876,11 @@ var undeploy_default = defineDeepspaceCommand({
       type: "string",
       description: "wrangler.toml [env.<name>] block whose deployed app to remove (e.g. --env staging). Ignored if a positional name is given.",
       required: false
+    },
+    yes: {
+      type: "boolean",
+      description: "Skip the interactive confirmation. (Scripts and --json callers are never prompted; the command itself is their consent.)",
+      default: false
     }
   },
   async run({ args }) {
@@ -6784,7 +6906,18 @@ var undeploy_default = defineDeepspaceCommand({
         "not_in_app_repo"
       );
     }
-    if (!args.json) p13.intro(`Undeploying ${appId}`);
+    if (!args.json && !args.yes && process.stdin.isTTY) {
+      p13.intro(`Undeploying ${appId}`);
+      const confirmed = await p13.confirm({
+        message: `Take ${appId} offline now? Its URL stops serving immediately; data, secrets, and the registration stay (the name is reserved for you for 30 days).`,
+        initialValue: false
+      });
+      if (p13.isCancel(confirmed) || !confirmed) {
+        throw new Refusal("Undeploy cancelled.", "undeploy_declined");
+      }
+    } else if (!args.json) {
+      p13.intro(`Undeploying ${appId}`);
+    }
     const s = args.json ? null : createSpinner();
     s?.start("Removing...");
     const res = await fetch(`${DEPLOY_URL4}/api/deploy/${appId}`, {
@@ -6879,17 +7012,17 @@ var apps_default = defineDeepspaceCommand({
   },
   async run({ args }) {
     const token = await ensureToken();
-    const apps = await listApps(DEPLOY_URL5, token);
+    const { apps, pendingTransfers } = await listAppsPage(DEPLOY_URL5, token);
     if (!args.json) {
-      if (!apps.length) {
+      if (!apps.length && !pendingTransfers.length) {
         console.log("No apps yet. Create one with `npx create-deepspace <name>` and `deepspace deploy`.");
-      } else {
+      } else if (apps.length) {
         const rows = [...apps].sort(
           (left, right) => Number(right.status !== "undeployed") - Number(left.status !== "undeployed")
         );
         const roleOf = (a) => a.role ?? "owner";
         const roleWidth = Math.max(4, ...rows.map((a) => roleOf(a).length));
-        const nameWidth = Math.max(4, ...rows.map((a) => (a.name ?? "\u2014").length));
+        const nameWidth = Math.max(4, ...rows.map((a) => nameCell(a).length));
         const statusWidth = Math.max(6, ...rows.map((a) => a.status.length));
         const idWidth = Math.max(6, ...rows.map((a) => a.appId.length));
         console.log(
@@ -6898,14 +7031,36 @@ var apps_default = defineDeepspaceCommand({
         for (const a of rows) {
           const url = liveAppUrl(a) ?? "(not deployed)";
           console.log(
-            `${(a.name ?? "\u2014").padEnd(nameWidth)}  ${a.status.padEnd(statusWidth)}  ${roleOf(a).padEnd(roleWidth)}  ${a.appId.padEnd(idWidth)}  ${url}`
+            `${nameCell(a).padEnd(nameWidth)}  ${a.status.padEnd(statusWidth)}  ${roleOf(a).padEnd(roleWidth)}  ${a.appId.padEnd(idWidth)}  ${url}`
           );
         }
+        const reserved = rows.filter((a) => a.reservedName && a.reservedUntil);
+        if (reserved.length) {
+          console.log("\nReserved names return to the open pool when they expire:");
+          for (const a of reserved) {
+            console.log(
+              `  ${a.reservedName} \u2014 held for you until ${a.reservedUntil}${a.name ? ` (${a.appId} now serves ${a.name})` : ""}`
+            );
+          }
+        }
+      }
+      if (pendingTransfers.length) {
+        console.log("\nTransfer offers waiting for you:");
+        for (const offer2 of pendingTransfers) {
+          console.log(`  ${offer2.appId} \u2014 expires ${offer2.expiresAt}`);
+        }
+        console.log(
+          "  Accept with `deepspace app transfer accept --app <APP ID>`; `deepspace app transfer status --app <APP ID>` names the offerer."
+        );
       }
     }
-    return { data: { apps } };
+    return { data: { apps, pendingTransfers } };
   }
 });
+function nameCell(app2) {
+  if (app2.name) return app2.name;
+  return app2.reservedName ? `${app2.reservedName} (reserved)` : "\u2014";
+}
 
 // src/cli/commands/logs.ts
 import { defineCommand as defineCommand4 } from "citty";
@@ -7289,37 +7444,37 @@ var usage_default = defineDeepspaceCommand({
 });
 
 // src/cli/commands/add.ts
-import { existsSync as existsSync18, readFileSync as readFileSync20, realpathSync as realpathSync4 } from "fs";
-import { dirname as dirname9, join as join18, resolve as resolve15 } from "path";
+import { existsSync as existsSync19, readFileSync as readFileSync19, realpathSync as realpathSync4 } from "fs";
+import { dirname as dirname9, join as join21, resolve as resolve16 } from "path";
 import { pathToFileURL as pathToFileURL3 } from "url";
 
 // src/cli/commands/feature-installer.ts
 import {
   closeSync as closeSync2,
   copyFileSync,
-  existsSync as existsSync17,
+  existsSync as existsSync18,
   fstatSync as fstatSync2,
   mkdirSync as mkdirSync6,
   mkdtempSync,
   openSync as openSync2,
-  readFileSync as readFileSync19,
+  readFileSync as readFileSync18,
   readSync,
-  readdirSync as readdirSync5,
+  readdirSync as readdirSync7,
   rmSync as rmSync4,
   writeFileSync as writeFileSync5
 } from "fs";
 import { spawnSync as spawnSync6 } from "child_process";
 import { tmpdir as tmpdir2 } from "os";
-import { dirname as dirname8, isAbsolute as isAbsolute4, join as join17, resolve as resolve14 } from "path";
+import { dirname as dirname8, isAbsolute as isAbsolute4, join as join20, resolve as resolve15 } from "path";
 import { fileURLToPath } from "url";
 var NAV_MARKER = "// \u2500\u2500 Features add nav items below this line \u2500\u2500";
 function featurePackageRoot(moduleUrl = import.meta.url) {
   let dir = dirname8(fileURLToPath(moduleUrl));
   for (; ; ) {
-    const packagePath = join17(dir, "package.json");
-    if (existsSync17(packagePath)) {
+    const packagePath = join20(dir, "package.json");
+    if (existsSync18(packagePath)) {
       try {
-        const pkg2 = JSON.parse(readFileSync19(packagePath, "utf-8"));
+        const pkg2 = JSON.parse(readFileSync18(packagePath, "utf-8"));
         if (pkg2.name === "deepspace") return dir;
       } catch {
       }
@@ -7330,13 +7485,13 @@ function featurePackageRoot(moduleUrl = import.meta.url) {
   }
 }
 function hasFeatureCatalog(packageRoot = featurePackageRoot()) {
-  return existsSync17(join17(packageRoot, "features"));
+  return existsSync18(join20(packageRoot, "features"));
 }
 function readFeatureConfig(id, packageRoot = featurePackageRoot()) {
-  const configPath = join17(packageRoot, "features", id, "feature.json");
-  if (!existsSync17(configPath)) return null;
+  const configPath = join20(packageRoot, "features", id, "feature.json");
+  if (!existsSync18(configPath)) return null;
   try {
-    const config = JSON.parse(readFileSync19(configPath, "utf-8"));
+    const config = JSON.parse(readFileSync18(configPath, "utf-8"));
     if (typeof config.id !== "string" || typeof config.name !== "string" || !Array.isArray(config.files)) {
       return null;
     }
@@ -7346,9 +7501,9 @@ function readFeatureConfig(id, packageRoot = featurePackageRoot()) {
   }
 }
 function listFeatureConfigs(packageRoot = featurePackageRoot()) {
-  const featuresDir = join17(packageRoot, "features");
-  if (!existsSync17(featuresDir)) return [];
-  return readdirSync5(featuresDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => readFeatureConfig(entry.name, packageRoot)).filter((config) => config !== null && !config.internal).sort((a, b) => a.id.localeCompare(b.id));
+  const featuresDir = join20(packageRoot, "features");
+  if (!existsSync18(featuresDir)) return [];
+  return readdirSync7(featuresDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => readFeatureConfig(entry.name, packageRoot)).filter((config) => config !== null && !config.internal).sort((a, b) => a.id.localeCompare(b.id));
 }
 function featureCatalog(packageRoot = featurePackageRoot()) {
   return listFeatureConfigs(packageRoot).map((config) => ({
@@ -7385,7 +7540,7 @@ function suggestFeature(featureId, packageRoot = featurePackageRoot()) {
   return closest !== null && closestDistance <= threshold ? closest : null;
 }
 function resolveTargetDir(raw) {
-  return isAbsolute4(raw) ? raw : resolve14(raw);
+  return isAbsolute4(raw) ? raw : resolve15(raw);
 }
 function resolveFeatureDestPath(fileDest, route) {
   const pages = "src/pages/";
@@ -7401,7 +7556,7 @@ function copyFile(src, dest) {
 function copyFileWithImportShift(src, dest, levels) {
   mkdirSync6(dirname8(dest), { recursive: true });
   const prefix = "../".repeat(levels);
-  const shifted = readFileSync19(src, "utf-8").replace(
+  const shifted = readFileSync18(src, "utf-8").replace(
     /(from\s+|import\s+|import\()(['"])(\.\.\/)/g,
     `$1$2${prefix}$3`
   );
@@ -7414,12 +7569,12 @@ function installFiles(packageRoot, config, targetDir, emit) {
   const preexisting = [];
   const missing = [];
   for (const file of config.files) {
-    const srcPath = join17(packageRoot, "features", config.id, file.src);
+    const srcPath = join20(packageRoot, "features", config.id, file.src);
     const resolvedDest = resolveFeatureDestPath(file.dest, config.route);
-    const destPath = join17(targetDir, resolvedDest);
-    const existed = existsSync17(destPath);
+    const destPath = join20(targetDir, resolvedDest);
+    const existed = existsSync18(destPath);
     if (existed) preexisting.push(resolvedDest);
-    if (!existsSync17(srcPath)) {
+    if (!existsSync18(srcPath)) {
       emit(`   Warning: source not found: ${file.src}`, "stderr");
       if (!existed) missing.push(resolvedDest);
       continue;
@@ -7456,11 +7611,11 @@ function unresolvedSchema(schema, reason, emit) {
 }
 function integrateSchema(config, targetDir, emit) {
   if (!config.schema) return [];
-  const schemasPath = join17(targetDir, "src", "schemas.ts");
-  if (!existsSync17(schemasPath)) {
+  const schemasPath = join20(targetDir, "src", "schemas.ts");
+  if (!existsSync18(schemasPath)) {
     return [unresolvedSchema(config.schema, "src/schemas.ts was not found.", emit)];
   }
-  let content = readFileSync19(schemasPath, "utf-8");
+  let content = readFileSync18(schemasPath, "utf-8");
   const { exportName, importPath, spreadOperator } = config.schema;
   const importPattern = new RegExp(`^import\\s+\\{[^}]*\\b${exportName}\\b`, "m");
   if (importPattern.test(content)) {
@@ -7513,11 +7668,11 @@ function unresolvedActions(actions, reason, emit) {
 }
 function integrateActions(config, targetDir, emit) {
   if (!config.actions?.length) return [];
-  const actionsPath = join17(targetDir, "src", "actions", "index.ts");
-  if (!existsSync17(actionsPath)) {
+  const actionsPath = join20(targetDir, "src", "actions", "index.ts");
+  if (!existsSync18(actionsPath)) {
     return [unresolvedActions(config.actions, "src/actions/index.ts was not found.", emit)];
   }
-  let content = readFileSync19(actionsPath, "utf-8");
+  let content = readFileSync18(actionsPath, "utf-8");
   const registryPattern = /export const actions:\s*Record<string,\s*ActionHandler(?:<[^>]*>)?>\s*=\s*\{/;
   if (!registryPattern.test(content)) {
     const reason = "src/actions/index.ts has an unexpected structure.";
@@ -7563,8 +7718,8 @@ ${registryEntry}`);
 function integrateCode(config, targetDir, emit) {
   const unresolved = [];
   for (const insertion of config.code ?? []) {
-    const targetPath = join17(targetDir, insertion.file);
-    if (!existsSync17(targetPath)) {
+    const targetPath = join20(targetDir, insertion.file);
+    if (!existsSync18(targetPath)) {
       unresolved.push({
         area: "code",
         reason: `${insertion.file} was not found.`,
@@ -7572,7 +7727,7 @@ function integrateCode(config, targetDir, emit) {
       });
       continue;
     }
-    const original = readFileSync19(targetPath, "utf-8");
+    const original = readFileSync18(targetPath, "utf-8");
     if (original.includes(insertion.insert.trim())) {
       emit(`   Integration already present: ${insertion.file}`);
       continue;
@@ -7609,8 +7764,8 @@ ${content.slice(
 }
 function integrateIgnore(config, targetDir) {
   if (!config.ignore?.length) return;
-  const targetPath = join17(targetDir, ".gitignore");
-  const current = existsSync17(targetPath) ? readFileSync19(targetPath, "utf-8") : "";
+  const targetPath = join20(targetDir, ".gitignore");
+  const current = existsSync18(targetPath) ? readFileSync18(targetPath, "utf-8") : "";
   const present = new Set(current.split(/\r?\n/).map((line) => line.trim()));
   const missing = config.ignore.filter((pattern) => !present.has(pattern));
   if (missing.length === 0) return;
@@ -7622,15 +7777,15 @@ function integrateWrangler(config, targetDir, emit) {
   const runWorkerFirst = config.wrangler?.runWorkerFirst === true;
   const rateLimits = config.wrangler?.rateLimits ?? [];
   if (!runWorkerFirst && rateLimits.length === 0) return [];
-  const targetPath = join17(targetDir, "wrangler.toml");
+  const targetPath = join20(targetDir, "wrangler.toml");
   const steps = [
     ...runWorkerFirst ? ["Set assets.run_worker_first = true in wrangler.toml."] : [],
     ...rateLimits.map((binding) => `Add the ${binding.name} rate-limit binding to wrangler.toml.`)
   ];
-  if (!existsSync17(targetPath)) {
+  if (!existsSync18(targetPath)) {
     return [{ area: "wrangler", reason: "wrangler.toml was not found.", steps }];
   }
-  let source = readFileSync19(targetPath, "utf-8");
+  let source = readFileSync18(targetPath, "utf-8");
   if (runWorkerFirst && !/^\[assets\]\s*$/m.test(source)) {
     return [{ area: "wrangler", reason: "wrangler.toml has no [assets] section.", steps }];
   }
@@ -7706,8 +7861,8 @@ function rateLimitBindingBlock(scope, binding) {
 }
 function integrateCss(packageRoot, config, targetDir, emit) {
   if (!config.css?.length) return [];
-  const stylesPath = join17(targetDir, "src", "styles.css");
-  if (!existsSync17(stylesPath)) {
+  const stylesPath = join20(targetDir, "src", "styles.css");
+  if (!existsSync18(stylesPath)) {
     emit("   Warning: Cannot integrate CSS \u2014 src/styles.css not found");
     return [
       {
@@ -7719,12 +7874,12 @@ function integrateCss(packageRoot, config, targetDir, emit) {
       }
     ];
   }
-  let styles = readFileSync19(stylesPath, "utf-8");
+  let styles = readFileSync18(stylesPath, "utf-8");
   let integrated = 0;
   const unresolved = [];
   for (const cssFile of config.css) {
-    const srcPath = join17(packageRoot, "features", config.id, cssFile);
-    if (!existsSync17(srcPath)) {
+    const srcPath = join20(packageRoot, "features", config.id, cssFile);
+    if (!existsSync18(srcPath)) {
       emit(`   Warning: CSS source not found: ${cssFile}`, "stderr");
       unresolved.push({
         area: "css",
@@ -7733,7 +7888,7 @@ function integrateCss(packageRoot, config, targetDir, emit) {
       });
       continue;
     }
-    const css = readFileSync19(srcPath, "utf-8");
+    const css = readFileSync18(srcPath, "utf-8");
     const fingerprint = css.match(/\.([\w-]+)\s*\{|@keyframes\s+([\w-]+)/);
     const marker = fingerprint?.[1] ?? fingerprint?.[2];
     if (marker && styles.includes(marker)) {
@@ -7767,11 +7922,11 @@ function routeRolesSuffix(route) {
 }
 function integrateRoute(config, targetDir, emit) {
   if (!config.route) return [];
-  const navPath = join17(targetDir, "src", "nav.ts");
-  if (!existsSync17(navPath)) {
+  const navPath = join20(targetDir, "src", "nav.ts");
+  if (!existsSync18(navPath)) {
     return [unresolvedRoute(config.route, config, "src/nav.ts was not found.", emit)];
   }
-  let content = readFileSync19(navPath, "utf-8");
+  let content = readFileSync18(navPath, "utf-8");
   const routePath = config.route.path;
   if (content.includes(`'${routePath}'`)) {
     emit(`   Nav already present: ${routePath}`);
@@ -7818,10 +7973,10 @@ function runPackageInstall(packageManager, targetDir, outputVisible) {
     const child = spawnSync6(packageManager, ["install"], { ...options, stdio: "inherit" });
     return { error: child.error, status: child.status };
   }
-  const captureDir = mkdtempSync(join17(tmpdir2(), "deepspace-add-install-"));
+  const captureDir = mkdtempSync(join20(tmpdir2(), "deepspace-add-install-"));
   let outputFd;
   try {
-    outputFd = openSync2(join17(captureDir, "output.log"), "w+");
+    outputFd = openSync2(join20(captureDir, "output.log"), "w+");
     const child = spawnSync6(packageManager, ["install"], {
       ...options,
       stdio: ["ignore", outputFd, outputFd]
@@ -7845,14 +8000,14 @@ function integrateDependencies(config, targetDir, runInstall, outputVisible, emi
   if (declarations.every(({ values }) => !values || Object.keys(values).length === 0)) {
     return { added: [], installRan: false, packageManager };
   }
-  const packagePath = join17(targetDir, "package.json");
-  if (!existsSync17(packagePath)) {
+  const packagePath = join20(targetDir, "package.json");
+  if (!existsSync18(packagePath)) {
     emit("   Could not patch package.json (file not found)");
     return { added: [], installRan: false, packageManager };
   }
   let pkg2;
   try {
-    pkg2 = JSON.parse(readFileSync19(packagePath, "utf-8"));
+    pkg2 = JSON.parse(readFileSync18(packagePath, "utf-8"));
   } catch (error) {
     emit(
       `   Could not patch package.json (parse error: ${error instanceof Error ? error.message : String(error)})`
@@ -7912,7 +8067,7 @@ ${child.diagnosticTail}` : "";
 }
 function dependencySnapshot(targetDir) {
   try {
-    const pkg2 = JSON.parse(readFileSync19(join17(targetDir, "package.json"), "utf-8"));
+    const pkg2 = JSON.parse(readFileSync18(join20(targetDir, "package.json"), "utf-8"));
     return {
       dependencies: pkg2.dependencies ?? {},
       devDependencies: pkg2.devDependencies ?? {}
@@ -7924,7 +8079,7 @@ function dependencySnapshot(targetDir) {
 function installedNavFeatures(packageRoot, targetDir) {
   return listFeatureConfigs(packageRoot).filter((feature) => feature.category === "nav" && feature.files.length > 0).filter((feature) => {
     const signature = resolveFeatureDestPath(feature.files[0].dest, feature.route);
-    return existsSync17(join17(targetDir, signature));
+    return existsSync18(join20(targetDir, signature));
   }).map((feature) => feature.id);
 }
 function warnNavConflicts(packageRoot, config, targetDir, emit) {
@@ -8157,11 +8312,11 @@ function renderFeatureInfo(config) {
   return lines.join("\n");
 }
 function isDeepSpaceApp(dir) {
-  if (existsSync18(join18(dir, "wrangler.toml"))) return true;
-  const packagePath = join18(dir, "package.json");
-  if (!existsSync18(packagePath)) return false;
+  if (existsSync19(join21(dir, "wrangler.toml"))) return true;
+  const packagePath = join21(dir, "package.json");
+  if (!existsSync19(packagePath)) return false;
   try {
-    const pkg2 = JSON.parse(readFileSync20(packagePath, "utf-8"));
+    const pkg2 = JSON.parse(readFileSync19(packagePath, "utf-8"));
     return Boolean(pkg2.dependencies?.deepspace || pkg2.devDependencies?.deepspace);
   } catch {
     return false;
@@ -8170,8 +8325,8 @@ function isDeepSpaceApp(dir) {
 function installedPackageRoot(fromDir) {
   let dir = fromDir;
   for (; ; ) {
-    const candidate = join18(dir, "node_modules", "deepspace");
-    if (existsSync18(join18(candidate, "package.json"))) return candidate;
+    const candidate = join21(dir, "node_modules", "deepspace");
+    if (existsSync19(join21(candidate, "package.json"))) return candidate;
     const parent = dirname9(dir);
     if (parent === dir) return null;
     dir = parent;
@@ -8188,9 +8343,9 @@ async function targetInstaller(appDir) {
   if (realpathSync4(installedRoot) === realpathSync4(featurePackageRoot())) {
     return { installFeature };
   }
-  const entry = join18(installedRoot, "dist", "feature-installer.js");
-  const catalog = join18(installedRoot, "features");
-  if (!existsSync18(entry) || !existsSync18(catalog)) {
+  const entry = join21(installedRoot, "dist", "feature-installer.js");
+  const catalog = join21(installedRoot, "features");
+  if (!existsSync19(entry) || !existsSync19(catalog)) {
     throw new Refusal(
       `The app's installed deepspace package does not contain the typed feature installer.
 Expected: ${entry}
@@ -8282,8 +8437,8 @@ var add_default = defineDeepspaceCommand({
       }
       return { data: { features: featureCatalog(root) } };
     }
-    const appDir = resolve15(args.dir ?? ".");
-    if (!existsSync18(appDir)) {
+    const appDir = resolve16(args.dir ?? ".");
+    if (!existsSync19(appDir)) {
       throw new Refusal(
         `Target directory not found: ${appDir}
 Create a new app first: deepspace app create <name>`,
@@ -8363,11 +8518,11 @@ function fmtDate(iso) {
   if (!iso) return "\u2014";
   return iso.slice(0, 10);
 }
-async function confirm4(message) {
+async function confirm6(message) {
   process.stdout.write(`${message} [y/N] `);
-  const answer = await new Promise((resolve21) => {
+  const answer = await new Promise((resolve22) => {
     process.stdin.setEncoding("utf-8");
-    process.stdin.once("data", (data) => resolve21(data.toString().trim().toLowerCase()));
+    process.stdin.once("data", (data) => resolve22(data.toString().trim().toLowerCase()));
   });
   process.stdin.pause();
   return answer === "y" || answer === "yes";
@@ -8442,7 +8597,7 @@ var buy = defineDeepspaceCommand({
           "confirmation_required"
         );
       }
-      const ok2 = await confirm4(
+      const ok2 = await confirm6(
         `Buy ${domain} for ${price}/yr (auto-renews; non-refundable), attach to ${appId}? Provisioning takes ${expectedTime}.`
       );
       if (!ok2) {
@@ -8612,7 +8767,7 @@ var detach = defineDeepspaceCommand({
           "confirmation_required"
         );
       }
-      const ok2 = await confirm4(
+      const ok2 = await confirm6(
         `Detach ${domain}? Routing will stop; the domain stays registered (auto-renew is unchanged).`
       );
       if (!ok2) {
@@ -8658,8 +8813,8 @@ var domain_default = defineCommand5({
 
 // src/cli/commands/app-files.ts
 import { defineCommand as defineCommand6 } from "citty";
-import { basename as basename4, resolve as resolve16 } from "path";
-import { existsSync as existsSync19, statSync as statSync2 } from "fs";
+import { basename as basename4, resolve as resolve17 } from "path";
+import { existsSync as existsSync20, statSync as statSync2 } from "fs";
 
 // src/cli/lib/app-files-api.ts
 import { createWriteStream, openAsBlob, statSync } from "fs";
@@ -8937,8 +9092,8 @@ var put = defineDeepspaceCommand({
     app: { type: "string", description: "App id or live name (defaults to ./wrangler.toml)" }
   },
   async run({ args }) {
-    const localPath = resolve16(String(args.file));
-    if (!existsSync19(localPath) || !statSync2(localPath).isFile()) {
+    const localPath = resolve17(String(args.file));
+    if (!existsSync20(localPath) || !statSync2(localPath).isFile()) {
       throw new Refusal(`No such file: ${args.file}`, "file_not_found");
     }
     const key = requireKey(args.key ?? basename4(localPath));
@@ -9038,7 +9193,7 @@ var get = defineDeepspaceCommand({
   },
   async run({ args }) {
     const key = requireKey(String(args.key));
-    const destination = resolve16(String(args.out ?? basename4(key)));
+    const destination = resolve17(String(args.out ?? basename4(key)));
     const { token, appId } = await target(args.app);
     const result = await downloadAppFile(PLATFORM_URL, token, appId, key, destination);
     if (!args.json) console.log(`\u2713 ${key} \u2192 ${destination} (${formatBytes(result.bytes)})`);
@@ -9118,7 +9273,10 @@ var list4 = defineDeepspaceCommand({
   }
 });
 var add = defineDeepspaceCommand({
-  meta: { name: "add", description: "Authorize someone to deploy your app" },
+  meta: {
+    name: "add",
+    description: "Authorize someone to deploy your app \u2014 a collaborator can also read and change every app secret (plaintext); they cannot undeploy or transfer"
+  },
   args: {
     email: {
       type: "positional",
@@ -9328,7 +9486,11 @@ var offer = defineDeepspaceCommand({
       if (replaced) console.log(`\u25B2 Replaced the pending offer to ${pendingTo}.`);
       console.log(
         `\u2713 Offered ${app2} to ${email} (expires ${expiresAt}).
-  They accept with: deepspace app transfer accept --app ${app2}`
+  They accept with: deepspace app transfer accept --app ${app2}
+  (it also shows in their \`deepspace app list\`)
+\u25B2 On acceptance you lose ALL access to ${app2} \u2014 you are not kept on as a
+  collaborator. Only the new owner can add you back. Collaborators you added
+  stay on the app for the new owner.`
       );
     }
     return {
@@ -9355,7 +9517,9 @@ var status2 = defineDeepspaceCommand({
       return { data: { app: app2, transfer: null } };
     }
     if (!args.json) {
-      console.log(`Pending: ${app2} \u2192 ${transfer.toEmailDisplay} (expires ${transfer.expiresAt}).`);
+      console.log(
+        `Pending: ${app2} \u2014 from ${transfer.fromEmailDisplay} to ${transfer.toEmailDisplay} (expires ${transfer.expiresAt}).`
+      );
     }
     return { data: { app: app2, transfer } };
   }
@@ -9375,15 +9539,32 @@ var accept2 = defineDeepspaceCommand({
       const msg = err instanceof Error ? err.message : String(err);
       throw new Refusal(msg, msg.startsWith("No app id") ? "not_in_app_repo" : "invalid_app");
     }
-    await apiFetch(DEPLOY_URL10, token, `/api/apps/${encodeURIComponent(app2)}/transfer/accept`, {
+    const { replayed, acceptedAt, inheritedCollaborators } = await apiFetch(DEPLOY_URL10, token, `/api/apps/${encodeURIComponent(app2)}/transfer/accept`, {
       method: "POST"
     });
     if (!args.json) {
       console.log(
-        `\u2713 You now own ${app2}. Run \`deepspace app init\` in a fresh clone (or set DEEPSPACE_APP_ID = "${app2}" in wrangler.toml) and deploy.`
+        replayed ? `\u2022 ${app2} is already yours${acceptedAt ? ` (since ${acceptedAt})` : ""} \u2014 no pending offer was accepted. Run \`deepspace app list\` to see any other offers.` : `\u2713 You now own ${app2}. Run \`deepspace app init\` in a fresh clone (or set DEEPSPACE_APP_ID = "${app2}" in wrangler.toml) and deploy.`
       );
+      if (!replayed && inheritedCollaborators === void 0) {
+        console.log(
+          `\u25B2 Could not list collaborators the previous owner may have left on the app \u2014 review with \`deepspace app collaborators list --app ${app2}\`.`
+        );
+      } else if (!replayed && inheritedCollaborators && inheritedCollaborators.length > 0) {
+        console.log(
+          `\u25B2 ${inheritedCollaborators.length} collaborator(s) added by the previous owner stay on the app with deploy and secrets access \u2014 review with \`deepspace app collaborators list --app ${app2}\`.`
+        );
+      }
     }
-    return { data: { app: app2, accepted: true } };
+    return {
+      data: {
+        app: app2,
+        accepted: !replayed,
+        replayed: replayed === true,
+        ...acceptedAt ? { acceptedAt } : {},
+        ...inheritedCollaborators === void 0 ? {} : { inheritedCollaborators }
+      }
+    };
   }
 });
 var cancel4 = defineDeepspaceCommand({
@@ -9408,7 +9589,7 @@ var transfer_default = defineCommand8({
 import { defineCommand as defineCommand9 } from "citty";
 
 // src/cli/commands/_invoke-impl.ts
-import { readFileSync as readFileSync21 } from "fs";
+import { readFileSync as readFileSync20 } from "fs";
 import * as p15 from "@clack/prompts";
 var API_URL7 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
 var DEFAULT_TIMEOUT_MS = 12e4;
@@ -9449,7 +9630,7 @@ function resolveBody(opts) {
   if (opts.body != null) {
     raw = opts.body;
   } else if (opts.bodyFile != null) {
-    raw = opts.bodyFile === "-" ? readFileSync21(0, "utf-8") : readFileSync21(opts.bodyFile, "utf-8");
+    raw = opts.bodyFile === "-" ? readFileSync20(0, "utf-8") : readFileSync20(opts.bodyFile, "utf-8");
   } else {
     return "{}";
   }
@@ -9743,8 +9924,8 @@ var integrations_default = defineCommand9({
 
 // src/cli/commands/feedback.ts
 import * as p16 from "@clack/prompts";
-import { existsSync as existsSync20, readFileSync as readFileSync22 } from "fs";
-import { dirname as dirname10, join as join19 } from "path";
+import { existsSync as existsSync21, readFileSync as readFileSync21 } from "fs";
+import { dirname as dirname10, join as join22 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { release } from "os";
 var API_URL8 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
@@ -9767,12 +9948,12 @@ function readCliVersion() {
   try {
     const here = dirname10(fileURLToPath2(import.meta.url));
     const candidates = [
-      join19(here, "..", "package.json"),
-      join19(here, "..", "..", "..", "package.json")
+      join22(here, "..", "package.json"),
+      join22(here, "..", "..", "..", "package.json")
     ];
     for (const path of candidates) {
-      if (!existsSync20(path)) continue;
-      const pkg2 = JSON.parse(readFileSync22(path, "utf-8"));
+      if (!existsSync21(path)) continue;
+      const pkg2 = JSON.parse(readFileSync21(path, "utf-8"));
       if (pkg2.name === "deepspace" && pkg2.version) return pkg2.version;
     }
   } catch {
@@ -9968,7 +10149,7 @@ Context: deepspace ${payload.cliVersion} \xB7 ${payload.nodeVersion} \xB7 ${payl
 
 // src/cli/commands/secrets.ts
 import { defineCommand as defineCommand10 } from "citty";
-import { readFileSync as readFileSync23 } from "fs";
+import { readFileSync as readFileSync22 } from "fs";
 
 // src/cli/lib/citty-args.ts
 function dedupePositionals(bound, rest) {
@@ -10070,6 +10251,7 @@ function warnIfDebugRoutesEnabled(secrets) {
   return true;
 }
 var APPLY_HINT = "Run `deepspace deploy` to apply \u2014 secrets take effect at deploy time.";
+var APPLIES_AT_DEPLOY = { appliesAtDeploy: true };
 var LOCAL_DEV_HINT = "Running `deepspace dev start`? Restart it to load the change locally.";
 var list6 = defineCommand10({
   meta: { name: "list", description: "List masked secrets in a config" },
@@ -10136,7 +10318,7 @@ var set = defineCommand10({
       const n = Object.keys(secrets).length;
       ok(
         args.json === true,
-        { appId: t.appId, config: t.configName, set: Object.keys(secrets) },
+        { appId: t.appId, config: t.configName, set: Object.keys(secrets), ...APPLIES_AT_DEPLOY },
         () => {
           console.log(`Set ${n} secret${n === 1 ? "" : "s"} in ${t.configName}.`);
           if (!warnIfDebugRoutesEnabled(secrets)) {
@@ -10209,7 +10391,7 @@ var del2 = defineCommand10({
         }
       }
       const note3 = absent > 0 ? ` (${absent} already absent)` : "";
-      ok(args.json === true, { appId: t.appId, config: t.configName, deleted, absent }, () => {
+      ok(args.json === true, { appId: t.appId, config: t.configName, deleted, absent, ...APPLIES_AT_DEPLOY }, () => {
         console.log(
           `Deleted ${deleted} secret${deleted === 1 ? "" : "s"} from ${t.configName}.${note3}`
         );
@@ -10238,7 +10420,7 @@ var upload = defineCommand10({
   async run({ args }) {
     try {
       const t = await resolveTarget(args);
-      const content = args.file === "-" ? readFileSync23(0, "utf-8") : readFileSync23(args.file, "utf-8");
+      const content = args.file === "-" ? readFileSync22(0, "utf-8") : readFileSync22(args.file, "utf-8");
       const secrets = parseSecretsUpload(content);
       if (Object.keys(secrets).length === 0)
         throw new InputError("No secrets found in the input.", "empty_input");
@@ -10246,7 +10428,7 @@ var upload = defineCommand10({
       const uploaded = Object.keys(secrets);
       ok(
         args.json === true,
-        { appId: t.appId, config: t.configName, uploaded, replaced: args.replace === true },
+        { appId: t.appId, config: t.configName, uploaded, replaced: args.replace === true, ...APPLIES_AT_DEPLOY },
         () => {
           console.log(`Uploaded ${uploaded.length} secrets to ${t.configName}.`);
           if (!warnIfDebugRoutesEnabled(secrets)) console.log(APPLY_HINT);
@@ -10421,12 +10603,19 @@ var secrets_default = defineCommand10({
 });
 
 // src/cli/commands/init.ts
-import { existsSync as existsSync21 } from "fs";
-import { join as join20 } from "path";
+import { existsSync as existsSync22 } from "fs";
+import { join as join23 } from "path";
 var DEPLOY_URL12 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
+function wranglerConfigUncommitted(appDir) {
+  if (!existsSync22(join23(appDir, ".git"))) return false;
+  const dryRun = runGit(appDir, ["commit", "--dry-run", "-m", "x", "--", "wrangler.toml"], {
+    allowFail: true
+  });
+  return dryRun.status === 0;
+}
 function commitScaffoldIfUnborn(appDir, token) {
   try {
-    if (!existsSync21(join20(appDir, ".git"))) return false;
+    if (!existsSync22(join23(appDir, ".git"))) return false;
     if (runGit(appDir, ["rev-parse", "--verify", "HEAD"], { allowFail: true }).status === 0) {
       return false;
     }
@@ -10503,13 +10692,13 @@ var init_default = defineDeepspaceCommand({
     writeAppId(appDir, appId, { wranglerEnv: envName, force: Boolean(args["new-id"]) });
     const committedScaffold = commitScaffoldIfUnborn(appDir, token);
     if (!args.json) {
+      const envSuffix = envName ? ` (env: ${envName})` : "";
+      const commitNote = committedScaffold ? " \u2014 initial scaffold commit created." : " \u2014 commit wrangler.toml.";
       if (existing) {
-        console.log(`Forked: ${existing} \u2192 ${appId}${envName ? ` (env: ${envName})` : ""}`);
+        console.log(`Forked: ${existing} \u2192 ${appId}${envSuffix}${commitNote}`);
         console.log("Registered as a NEW app under your account; the original is untouched.");
       } else {
-        console.log(
-          `Registered ${appId}${envName ? ` (env: ${envName})` : ""} to your account` + (committedScaffold ? " \u2014 initial scaffold commit created." : " \u2014 commit wrangler.toml.")
-        );
+        console.log(`Registered ${appId}${envSuffix} to your account${commitNote}`);
         console.log("The first deploy claims the `name` subdomain.");
       }
       console.log(`App dir: ${appDir}`);
@@ -10522,7 +10711,18 @@ var init_default = defineDeepspaceCommand({
         committedScaffold,
         appDir,
         env: envName ?? null
-      }
+      },
+      // The one follow-up when the id was written into an existing history:
+      // rendered as the `Next:` line and carried in `--json`, so a machine
+      // caller does not have to infer it from `committedScaffold: false`.
+      // Offered only when the file is actually uncommitted — `git commit` on
+      // a clean file fails, and an action must be executable as handed over.
+      ...!committedScaffold && wranglerConfigUncommitted(appDir) ? {
+        action: {
+          cwd: appDir,
+          argv: ["git", "commit", "-m", existing ? `Fork as ${appId}` : `Register ${appId}`, "--", "wrangler.toml"]
+        }
+      } : {}
     };
   }
 });
@@ -10530,7 +10730,7 @@ var init_default = defineDeepspaceCommand({
 // src/cli/commands/status.ts
 import { defineCommand as defineCommand11 } from "citty";
 import * as p17 from "@clack/prompts";
-import { existsSync as existsSync22, readFileSync as readFileSync24 } from "fs";
+import { existsSync as existsSync23, readFileSync as readFileSync23 } from "fs";
 function timeAgo(iso) {
   const ms = Date.now() - Date.parse(iso);
   if (!Number.isFinite(ms) || ms < 0) return iso;
@@ -10600,22 +10800,21 @@ var status_default = defineCommand11({
       "DEEPSPACE_API_URL",
       "DEEPSPACE_PLATFORM_URL"
     ].filter((k) => process.env[k]);
+    const urls = effectivePlatformUrls();
+    lines.push([
+      "Env",
+      [DEEPSPACE_ENV, ...urlOverrides.map((k) => `${k} set`)].join(" \xB7 ")
+    ]);
+    json.env = DEEPSPACE_ENV;
+    json.services = urls;
     if (DEEPSPACE_ENV !== "production" || urlOverrides.length > 0) {
-      const urls = effectivePlatformUrls();
-      const detail = [
-        DEEPSPACE_ENV !== "production" ? DEEPSPACE_ENV : null,
-        ...urlOverrides.map((k) => `${k} set`)
-      ].filter(Boolean).join(" \xB7 ");
-      lines.push(["Env", detail]);
       lines.push([
         "Services",
         `auth ${urls.auth} \xB7 api ${urls.api} \xB7 platform ${urls.platform} \xB7 deploy ${urls.deploy}`
       ]);
-      json.env = DEEPSPACE_ENV;
-      json.services = urls;
       if (urlOverrides.length > 0) json.urlOverrides = urlOverrides;
     }
-    facts.loggedIn = existsSync22(SESSION_PATH);
+    facts.loggedIn = existsSync23(SESSION_PATH);
     let userId = null;
     if (!facts.loggedIn) {
       lines.push(["Session", "not logged in"]);
@@ -10624,7 +10823,7 @@ var status_default = defineCommand11({
       let who = "logged in";
       try {
         const payload = decodeJwtPayload(
-          readFileSync24(TOKEN_PATH, "utf-8").trim()
+          readFileSync23(TOKEN_PATH, "utf-8").trim()
         );
         if (payload.email) who = payload.email;
         userId = payload.sub ?? null;
@@ -10868,11 +11067,7 @@ var push_default = defineDeepspaceCommand({
     const force = args.force === true;
     const appDir = findAppDir();
     try {
-      if (!appDir)
-        throw new Refusal(
-          "No wrangler.toml found \u2014 run from inside an app directory.",
-          "not_in_app_repo"
-        );
+      if (!appDir) throw new Refusal(noWranglerConfigMessage(process.cwd()), "not_in_app_repo");
       assertSyncableRepo(appDir);
       if (branchArg !== void 0) {
         const b = branchArg.trim();
@@ -10895,9 +11090,11 @@ var push_default = defineDeepspaceCommand({
             "unknown_branch"
           );
         }
+        const uninitialized = hasWranglerConfig(appDir) && readAppId(appDir) === null;
         throw new Refusal(
-          `Branch "${branch}" has no commits yet \u2014 commit first, then push.`,
-          "no_commits"
+          uninitialized ? `Branch "${branch}" has no commits yet, and wrangler.toml still holds the \`__APP_ID__\` placeholder \u2014 run \`deepspace app init\` first: it registers the app and makes the initial commit (committing first would put the unregistered placeholder in history).` : `Branch "${branch}" has no commits yet \u2014 commit first, then push.`,
+          "no_commits",
+          uninitialized ? { action: { cwd: appDir, argv: ["deepspace", "app", "init"] } } : {}
         );
       }
       const spinner2 = args.json ? null : createSpinner();
@@ -10961,6 +11158,13 @@ var push_default = defineDeepspaceCommand({
           "app_not_registered"
         );
       }
+      if (sourceState.source?.provider === "github") {
+        throw new Refusal(
+          `This app uses GitHub source (${sourceState.source.repository}). Manage commits with normal Git/GitHub; \`deepspace deploy\` ships the local working tree without changing Git.`,
+          "source_managed_by_github",
+          { extra: { appId, repository: sourceState.source.repository } }
+        );
+      }
       const pullRecoveryCwd = selectedBranchCheckout(appDir, branch) ?? appDir;
       ensureSpaceRemote(appDir, appId);
       if (force) {
@@ -11100,11 +11304,7 @@ var pull_default = defineDeepspaceCommand({
     const branchArg = args.branch === void 0 ? void 0 : String(args.branch);
     const appArg = typeof args.app === "string" ? args.app : void 0;
     const appDir = findAppDir();
-    if (!appDir)
-      throw new Refusal(
-        "No wrangler.toml found \u2014 run from inside an app directory.",
-        "not_in_app_repo"
-      );
+    if (!appDir) throw new Refusal(noWranglerConfigMessage(process.cwd()), "not_in_app_repo");
     if (branchArg !== void 0) {
       const b = branchArg.trim();
       if (!b) throw new Refusal("--branch was given an empty branch name.", "invalid_branch");
@@ -11132,9 +11332,9 @@ var pull_default = defineDeepspaceCommand({
     const token = await ensureToken();
     const deployUrl = deployBaseUrl();
     const appId = await resolveAppTarget(deployUrl, token, appArg);
-    ensureSpaceRemote(appDir, appId);
     spinner2?.message(`Checking the cloud ${branch} ref\u2026`);
     const remote = await repoApi(deployUrl, token, appId).getRefs();
+    ensureSpaceRemote(appDir, appId);
     if (!remote) {
       spinner2?.stop("No cloud repo yet.");
       const pushCommand2 = targetedVcCommand("push", appId, branch);
@@ -11322,18 +11522,18 @@ var pull_default = defineDeepspaceCommand({
 
 // src/cli/commands/clone.ts
 import * as p20 from "@clack/prompts";
-import { existsSync as existsSync23, readdirSync as readdirSync6, rmSync as rmSync5 } from "fs";
-import { resolve as resolve17, basename as basename5, join as join21 } from "path";
+import { existsSync as existsSync24, readdirSync as readdirSync8, rmSync as rmSync5 } from "fs";
+import { resolve as resolve18, basename as basename5, join as join24 } from "path";
 function cleanFailedCloneDir(dir) {
   let entries;
   try {
-    entries = readdirSync6(dir);
+    entries = readdirSync8(dir);
   } catch {
-    return existsSync23(dir) ? ["<unreadable>"] : [];
+    return existsSync24(dir) ? ["<unreadable>"] : [];
   }
   if (entries.length === 1 && entries[0] === ".git") {
     try {
-      rmSync5(join21(dir, ".git"), { recursive: true, force: true });
+      rmSync5(join24(dir, ".git"), { recursive: true, force: true });
       return [];
     } catch {
       return entries;
@@ -11342,10 +11542,10 @@ function cleanFailedCloneDir(dir) {
   return entries;
 }
 function validateCloneTarget(dir) {
-  if (!existsSync23(dir)) return false;
+  if (!existsSync24(dir)) return false;
   let entries;
   try {
-    entries = readdirSync6(dir);
+    entries = readdirSync8(dir);
   } catch (error) {
     if (error.code === "ENOTDIR") {
       throw new Refusal(`${dir} already exists and is not a directory.`, "dir_exists");
@@ -11377,7 +11577,7 @@ var clone_default = defineDeepspaceCommand({
   async run({ args }) {
     assertAppTargetResolvable(String(args.app));
     const selector = String(args.app).trim();
-    const dir = resolve17(String(args.dir ?? selector));
+    const dir = resolve18(String(args.dir ?? selector));
     const dirPreexisted = validateCloneTarget(dir);
     const spinner2 = args.json ? null : createSpinner();
     spinner2?.start(`Resolving ${selector}\u2026`);
@@ -11550,7 +11750,7 @@ function pickPreviousRelease(releases) {
 var rollback_default = defineDeepspaceCommand({
   meta: {
     name: "rollback",
-    description: "Re-deploy a prior release's exact bundle (no rebuild)"
+    description: "Re-deploy a prior release's exact bundle (no rebuild); the live secrets are kept, not the release's"
   },
   args: {
     release: {
@@ -11685,7 +11885,7 @@ import { defineCommand as defineCommand12 } from "citty";
 
 // src/cli/commands/workspace/new.ts
 import * as p25 from "@clack/prompts";
-import { isAbsolute as isAbsolute6, resolve as resolve18 } from "path";
+import { isAbsolute as isAbsolute6, resolve as resolve19 } from "path";
 
 // src/cli/commands/workspace/analysis.ts
 import * as p23 from "@clack/prompts";
@@ -11819,25 +12019,25 @@ function printOverlaps(overlaps, json) {
 // src/cli/commands/workspace/local.ts
 import * as p24 from "@clack/prompts";
 import {
-  existsSync as existsSync24,
+  existsSync as existsSync25,
   mkdirSync as mkdirSync7,
-  readFileSync as readFileSync25,
+  readFileSync as readFileSync24,
   realpathSync as realpathSync6,
   renameSync as renameSync2,
   statSync as statSync3,
   writeFileSync as writeFileSync6
 } from "fs";
-import { dirname as dirname11, isAbsolute as isAbsolute5, join as join22, relative as relative2, sep as sep2 } from "path";
+import { dirname as dirname11, isAbsolute as isAbsolute5, join as join25, relative as relative3, sep as sep3 } from "path";
 var WORKSPACE_MARKER = "deepspace-workspace.json";
 function excludeWorktreeDir(appDir, dir) {
   try {
     ensureLocalExclude(appDir, ".deepspace/");
     const realDir = realpathSync6(dir);
-    const rel = relative2(realpathSync6(repoToplevel(appDir)), realDir);
-    if (!rel || rel === ".." || rel.startsWith(`..${sep2}`) || isAbsolute5(rel)) return;
-    const pattern = rel.split(sep2).join("/");
+    const rel = relative3(realpathSync6(repoToplevel(appDir)), realDir);
+    if (!rel || rel === ".." || rel.startsWith(`..${sep3}`) || isAbsolute5(rel)) return;
+    const pattern = rel.split(sep3).join("/");
     if (pattern === ".deepspace" || pattern.startsWith(".deepspace/")) return;
-    const relApp = relative2(realpathSync6(appDir), realDir).split(sep2).join("/");
+    const relApp = relative3(realpathSync6(appDir), realDir).split(sep3).join("/");
     if (relApp === ".deepspace" || relApp.startsWith(".deepspace/")) return;
     ensureLocalExclude(appDir, `/${pattern}/`);
   } catch {
@@ -11848,7 +12048,7 @@ function worktreeMarkerPath(worktreeRoot) {
     const result = runGit(worktreeRoot, ["rev-parse", "--absolute-git-dir"], { allowFail: true });
     if (result.status !== 0) return null;
     const gitDir = result.stdout.toString("utf-8").trim();
-    return isAbsolute5(gitDir) ? join22(gitDir, WORKSPACE_MARKER) : null;
+    return isAbsolute5(gitDir) ? join25(gitDir, WORKSPACE_MARKER) : null;
   } catch {
     return null;
   }
@@ -11884,7 +12084,7 @@ function isManagedWorkspaceWorktree(worktreeRoot, workspaceId) {
   const markerPath = worktreeMarkerPath(worktreeRoot);
   if (!markerPath) return false;
   try {
-    const marker = JSON.parse(readFileSync25(markerPath, "utf-8"));
+    const marker = JSON.parse(readFileSync24(markerPath, "utf-8"));
     return marker.version === 1 && marker.workspaceId === workspaceId && marker.mode === "managed-linked";
   } catch {
     return false;
@@ -11893,11 +12093,11 @@ function isManagedWorkspaceWorktree(worktreeRoot, workspaceId) {
 function defaultWorkspaceRoot(appDir, workspaceId) {
   const primary = listWorktrees(appDir)[0];
   if (!primary) throw new Error("Git did not report a primary worktree");
-  return join22(primary.path, ".deepspace", "ws", workspaceId.slice(3).toLowerCase());
+  return join25(primary.path, ".deepspace", "ws", workspaceId.slice(3).toLowerCase());
 }
 function appDirInWorktree(appDir, worktreeRoot) {
-  const appRelative = relative2(realpathSync6(repoToplevel(appDir)), realpathSync6(appDir));
-  return appRelative ? join22(worktreeRoot, appRelative) : worktreeRoot;
+  const appRelative = relative3(realpathSync6(repoToplevel(appDir)), realpathSync6(appDir));
+  return appRelative ? join25(worktreeRoot, appRelative) : worktreeRoot;
 }
 function primaryAppDir(appDir) {
   const primary = listWorktrees(appDir)[0];
@@ -11932,7 +12132,7 @@ function rematerializeWorkspaceWorktree(appDir, worktreeRoot, branch, workspaceI
 function inOwnLinkedWorktree(appDir, id) {
   if (workspaceIdFromBranch(currentBranch(appDir)) !== id) return false;
   try {
-    return statSync3(join22(repoToplevel(appDir), ".git")).isFile();
+    return statSync3(join25(repoToplevel(appDir), ".git")).isFile();
   } catch {
     return false;
   }
@@ -12057,7 +12257,7 @@ function cleanupWorkspaceLocal(appDir, id, trunkBranch, options = {}) {
         }
         runGit(mainDir, ["worktree", "prune"], { allowFail: true });
         out.worktreeDir = null;
-        const leftover = existsSync24(linked.path);
+        const leftover = existsSync25(linked.path);
         if (leftover) out.leftoverDir = linked.path;
         else out.worktreeRemoved = linked.path;
         deleteWsBranch(mainDir, branch, expectedBranchOid, out);
@@ -12137,7 +12337,7 @@ async function resolveTarget2(appArg) {
   const appDir = findAppDir();
   if (!appDir) {
     throw new Refusal(
-      "No wrangler.toml found \u2014 run from inside an app directory (or use -a <app> for list, and for drop with an explicit ws_ id).",
+      `${noWranglerConfigMessage(process.cwd())} (Or use -a <app> for list, and for drop with an explicit ws_ id.)`,
       "not_in_app_repo"
     );
   }
@@ -12317,7 +12517,7 @@ var newWorkspaceCommand = defineDeepspaceCommand({
       idempotencyKey: mintIdempotencyKey()
     });
     const dirInput = typeof args.dir === "string" ? args.dir.trim() : "";
-    const worktreeRoot = dirInput ? isAbsolute6(dirInput) ? dirInput : resolve18(appDir, dirInput) : defaultWorkspaceRoot(appDir, id);
+    const worktreeRoot = dirInput ? isAbsolute6(dirInput) ? dirInput : resolve19(appDir, dirInput) : defaultWorkspaceRoot(appDir, id);
     const dir = appDirInWorktree(appDir, worktreeRoot);
     try {
       materializeWorkspaceWorktree(appDir, worktreeRoot, branch, baseOid, id);
@@ -12355,14 +12555,14 @@ var newWorkspaceCommand = defineDeepspaceCommand({
 
 // src/cli/commands/workspace/attach.ts
 import * as p26 from "@clack/prompts";
-import { existsSync as existsSync25, readdirSync as readdirSync7, realpathSync as realpathSync7, rmSync as rmSync6 } from "fs";
-import { isAbsolute as isAbsolute7, resolve as resolve19 } from "path";
+import { existsSync as existsSync26, readdirSync as readdirSync9, realpathSync as realpathSync7, rmSync as rmSync6 } from "fs";
+import { isAbsolute as isAbsolute7, resolve as resolve20 } from "path";
 function samePath(a, b) {
   const real = (p35) => {
     try {
       return realpathSync7(p35);
     } catch {
-      return resolve19(p35);
+      return resolve20(p35);
     }
   };
   return real(a) === real(b);
@@ -12375,10 +12575,10 @@ function finishedWorkspaceMessage(id, view) {
   return `Workspace ${id} is ${workspace.status} \u2014 its ref is retained briefly (fetch ${workspace.ref} to inspect), but attach only works on active workspaces.`;
 }
 function cleanFailedFreshAttachDir(dir) {
-  if (!existsSync25(dir)) return [];
+  if (!existsSync26(dir)) return [];
   let entries;
   try {
-    entries = readdirSync7(dir);
+    entries = readdirSync9(dir);
   } catch {
     return ["<unreadable>"];
   }
@@ -12452,12 +12652,12 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
         );
       }
       const requestedDir = typeof args.dir === "string" ? args.dir.trim() : "";
-      const worktreeRoot = requestedDir ? isAbsolute7(requestedDir) ? requestedDir : resolve19(appDir, requestedDir) : defaultWorkspaceRoot(appDir, id);
+      const worktreeRoot = requestedDir ? isAbsolute7(requestedDir) ? requestedDir : resolve20(appDir, requestedDir) : defaultWorkspaceRoot(appDir, id);
       const dir2 = appDirInWorktree(appDir, worktreeRoot);
       const localTip = resolveCommit(appDir, `refs/heads/${branch}`);
       if (localTip) {
         let existing = resolveWorkspaceWorktree(listWorktrees(appDir), id);
-        if (existing && !existsSync25(existing)) {
+        if (existing && !existsSync26(existing)) {
           runGit(appDir, ["worktree", "prune"], { allowFail: true });
           existing = null;
         }
@@ -12571,11 +12771,11 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
         extra: { status: view.workspace.status }
       });
     }
-    const dir = resolve19(
+    const dir = resolve20(
       process.cwd(),
       (typeof args.dir === "string" ? args.dir.trim() : "") || `ws-${id.slice(3).toLowerCase()}`
     );
-    if (existsSync25(dir)) {
+    if (existsSync26(dir)) {
       spinner2?.stop("Target exists.");
       throw new Refusal(`${dir} already exists \u2014 pass a different directory.`, "dir_exists");
     }
@@ -12912,13 +13112,13 @@ import * as p30 from "@clack/prompts";
 
 // src/cli/lib/validation.ts
 import { sync as spawnSync7 } from "cross-spawn";
-import { readFileSync as readFileSync26 } from "fs";
-import { join as join23 } from "path";
+import { readFileSync as readFileSync25 } from "fs";
+import { join as join26 } from "path";
 var MAX_SUMMARY_CHARS = 4e3;
 var MAX_OUTPUT_BUFFER = 64 * 1024 * 1024;
 function configuredCommand(appDir) {
   try {
-    const pkg2 = JSON.parse(readFileSync26(join23(appDir, "package.json"), "utf-8"));
+    const pkg2 = JSON.parse(readFileSync25(join26(appDir, "package.json"), "utf-8"));
     if (pkg2.scripts?.validate) return `${detectPackageManager(appDir)} run --silent validate`;
   } catch {
   }
@@ -13994,13 +14194,13 @@ function sameRefs(left, right) {
 
 // src/cli/commands/update.ts
 import * as p34 from "@clack/prompts";
-import { existsSync as existsSync26, readFileSync as readFileSync27, writeFileSync as writeFileSync7 } from "fs";
-import { join as join24, resolve as resolve20 } from "path";
+import { existsSync as existsSync27, readFileSync as readFileSync26, writeFileSync as writeFileSync7 } from "fs";
+import { join as join27, resolve as resolve21 } from "path";
 
 // package.json
 var package_default = {
   name: "deepspace",
-  version: "0.23.0",
+  version: "0.23.2",
   engines: {
     node: ">=22.15.0 <23 || >=24 <25 || >=26 <27"
   },
@@ -14175,24 +14375,25 @@ function gapIsTooWide(from, to) {
   return from.major === 0 && from.minor < OLDEST_SUPPORTED_MINOR;
 }
 function readAppSdkVersion(appDir) {
-  const installed = join24(appDir, "node_modules", "deepspace", "package.json");
-  if (existsSync26(installed)) {
-    const parsed2 = JSON.parse(readFileSync27(installed, "utf8"));
+  const installed = join27(appDir, "node_modules", "deepspace", "package.json");
+  if (existsSync27(installed)) {
+    const parsed2 = JSON.parse(readFileSync26(installed, "utf8"));
     if (typeof parsed2.version === "string") return parsed2.version;
   }
-  const manifest = join24(appDir, "package.json");
-  if (!existsSync26(manifest)) return null;
-  const parsed = JSON.parse(readFileSync27(manifest, "utf8"));
+  const manifest = join27(appDir, "package.json");
+  if (!existsSync27(manifest)) return null;
+  const parsed = JSON.parse(readFileSync26(manifest, "utf8"));
   return parsed.dependencies?.deepspace ?? null;
 }
 function pinSdkVersion(appDir, version) {
-  const path = join24(appDir, "package.json");
-  const source = readFileSync27(path, "utf8");
+  const path = join27(appDir, "package.json");
+  const source = readFileSync26(path, "utf8");
   const manifest = JSON.parse(source);
   const dependencies = manifest.dependencies;
   if (!dependencies || typeof dependencies !== "object" || Array.isArray(dependencies)) return false;
   let changed = false;
-  if (Object.prototype.hasOwnProperty.call(dependencies, "deepspace") && typeof dependencies.deepspace === "string" && dependencies.deepspace !== `^${version}`) {
+  const registrySpec = (spec) => !/^(file|link|workspace|git\+|github|https?):/.test(spec) && !spec.includes("/");
+  if (Object.prototype.hasOwnProperty.call(dependencies, "deepspace") && typeof dependencies.deepspace === "string" && registrySpec(dependencies.deepspace) && dependencies.deepspace !== `^${version}`) {
     dependencies.deepspace = `^${version}`;
     changed = true;
   }
@@ -14213,9 +14414,9 @@ function buildPreviewSecretsUpgradeInstruction(appDir) {
     "vite.config.mts",
     "vite.config.js",
     "vite.config.mjs"
-  ].find((candidate) => existsSync26(join24(appDir, candidate)));
+  ].find((candidate) => existsSync27(join27(appDir, candidate)));
   if (!configName) return null;
-  const source = readFileSync27(join24(appDir, configName), "utf8");
+  const source = readFileSync26(join27(appDir, configName), "utf8");
   if (source.includes("deepspace-remove-build-preview-secrets") || source.includes("deepspaceBuild(") || source.includes("'deepspace/build'") || source.includes('"deepspace/build"')) {
     return null;
   }
@@ -14223,9 +14424,9 @@ function buildPreviewSecretsUpgradeInstruction(appDir) {
 }
 function usersSchemaVisibilityUpgradeInstruction(appDir) {
   const schemaName = "src/schemas/users-schema.ts";
-  const path = join24(appDir, schemaName);
-  if (!existsSync26(path)) return null;
-  const source = readFileSync27(path, "utf8");
+  const path = join27(appDir, schemaName);
+  if (!existsSync27(path)) return null;
+  const source = readFileSync26(path, "utf8");
   if (!/\bmember\s*:\s*\{[^}]*\bread\s*:\s*true\b/s.test(source)) return null;
   return `${schemaName}: review the member user-row visibility change at ${USERS_SCHEMA_VISIBILITY_GUIDE}; app update left this app-owned schema unchanged.`;
 }
@@ -14285,12 +14486,9 @@ var update_default = defineDeepspaceCommand({
     }
   },
   async run({ args }) {
-    const appDir = resolve20(".");
+    const appDir = resolve21(".");
     if (!hasWranglerConfig(appDir)) {
-      throw new Refusal(
-        "No wrangler.toml found \u2014 run this from inside a DeepSpace app directory.",
-        "not_in_app_repo"
-      );
+      throw new Refusal(noWranglerConfigMessage(join27(appDir, "wrangler.toml")), "not_in_app_repo");
     }
     assertSyncableRepo(appDir);
     const currentRaw = readAppSdkVersion(appDir);
@@ -14376,8 +14574,8 @@ var update_default = defineDeepspaceCommand({
 
 // src/cli/cli.ts
 var __dirname = dirname12(fileURLToPath3(import.meta.url));
-var pkg = JSON.parse(readFileSync28(join25(__dirname, "..", "package.json"), "utf-8"));
-if (process.platform === "linux" && !process.env.SSL_CERT_FILE && existsSync27("/etc/ssl/certs/ca-certificates.crt")) {
+var pkg = JSON.parse(readFileSync27(join28(__dirname, "..", "package.json"), "utf-8"));
+if (process.platform === "linux" && !process.env.SSL_CERT_FILE && existsSync28("/etc/ssl/certs/ca-certificates.crt")) {
   process.env.SSL_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt";
 }
 var create2 = defineCommand14({