deepspace 0.24.0 → 0.24.1

package/dist/cli.js

@@ -8,7 +8,7 @@ import {
   renderUsage
 } from "citty";
 import { sync as spawnSync8 } from "cross-spawn";
-import { readFileSync as readFileSync28, existsSync as existsSync29 } from "fs";
+import { readFileSync as readFileSync27, existsSync as existsSync29 } from "fs";
 import { dirname as dirname13, join as join29 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 
@@ -133,6 +133,41 @@ function printAction(action) {
   p2.log.message(`Next: ${prefix}${command}`);
 }
 
+// src/cli/lib/fetch-retry.ts
+async function retryTransient(run2, {
+  delaysMs,
+  shouldRetryError = () => true,
+  shouldRetryResult = () => false
+}) {
+  for (let attempt = 0; ; attempt++) {
+    try {
+      const result = await run2();
+      if (!shouldRetryResult(result) || attempt >= delaysMs.length) return result;
+    } catch (error) {
+      if (!shouldRetryError(error) || attempt >= delaysMs.length) throw error;
+    }
+    await new Promise((resolve23) => setTimeout(resolve23, delaysMs[attempt]));
+  }
+}
+async function fetchWithTransientRetry(url, makeInit, {
+  attempts = 4,
+  retryServerErrors = true,
+  timeoutMs = 6e4
+} = {}) {
+  return retryTransient(
+    async () => {
+      return await fetch(url, { ...makeInit(), signal: AbortSignal.timeout(timeoutMs) });
+    },
+    {
+      delaysMs: Array.from(
+        { length: Math.max(0, attempts - 1) },
+        (_, attempt) => Math.min(8e3, 500 * 2 ** attempt)
+      ),
+      shouldRetryResult: (response) => retryServerErrors && (response.status >= 500 || response.status === 408 || response.status === 429)
+    }
+  );
+}
+
 // src/cli/lib/api.ts
 var ApiError = class extends Error {
   constructor(message, status3, code, apiPath, details) {
@@ -159,11 +194,6 @@ async function apiFetch(baseUrl, token, path, init, isRetry = false) {
         ...init?.headers ?? {}
       }
     });
-    if (res.status === 401 && !isRetry && refreshAuthToken) {
-      const fresh = await refreshAuthToken();
-      if (fresh && fresh !== token) return apiFetch(baseUrl, fresh, path, init, true);
-    }
-    text2 = await res.text();
   } catch (err) {
     throw new ApiError(
       `Could not reach the deploy service at ${baseUrl}: ${err instanceof Error ? err.message : String(err)}. Check your connection (and DEEPSPACE_DEPLOY_URL), then retry.`,
@@ -172,6 +202,20 @@ async function apiFetch(baseUrl, token, path, init, isRetry = false) {
       path
     );
   }
+  if (res.status === 401 && !isRetry && refreshAuthToken) {
+    const fresh = await refreshAuthToken();
+    if (fresh && fresh !== token) return apiFetch(baseUrl, fresh, path, init, true);
+  }
+  try {
+    text2 = await res.text();
+  } catch (err) {
+    throw new ApiError(
+      `Could not read the deploy service response at ${baseUrl}: ${err instanceof Error ? err.message : String(err)}. Check your connection (and DEEPSPACE_DEPLOY_URL), then retry.`,
+      0,
+      "network_error",
+      path
+    );
+  }
   if (!res.ok) {
     let msg = text2;
     let code;
@@ -217,6 +261,27 @@ async function apiFetch(baseUrl, token, path, init, isRetry = false) {
   }
   return parsed;
 }
+async function apiFetchWithTransientRetry(baseUrl, token, path, init) {
+  return retryTransient(
+    async () => await apiFetch(baseUrl, token, path, {
+      ...init,
+      signal: AbortSignal.timeout(15e3)
+    }),
+    {
+      delaysMs: [250, 750, 1500],
+      // A 401 refresh owns its own bounded auth-service retry loop. Only retry
+      // failures produced by this deploy-service request, never multiply an
+      // exhausted /api/auth/token exchange by replaying the rejected bearer.
+      shouldRetryError: (error) => isTransientFailure(error) && error.apiPath === path
+    }
+  );
+}
+function apiFetchReadWithRetry(baseUrl, token, path) {
+  return apiFetchWithTransientRetry(baseUrl, token, path);
+}
+function isTransientFailure(error) {
+  return error instanceof ApiError && (error.status === 0 || error.status === 408 || error.status === 429 || error.status >= 500);
+}
 
 // src/cli/lib/cli-errors.ts
 var InputError = class extends Error {
@@ -567,16 +632,57 @@ function decodeJwtPayload(token) {
 // src/cli/session.ts
 var SESSION_COOKIE = "__Secure-better-auth.session_token";
 async function exchangeSession(authUrl, sessionToken) {
-  const res = await fetch(`${authUrl}/api/auth/token`, {
-    method: "POST",
-    headers: {
-      Cookie: `${SESSION_COOKIE}=${encodeURIComponent(sessionToken)}`,
-      Origin: authUrl
-    }
-  });
-  if (!res.ok) return null;
-  const data = await res.json();
-  return data.token ?? null;
+  const path = "/api/auth/token";
+  let res;
+  try {
+    res = await fetchWithTransientRetry(
+      `${authUrl}${path}`,
+      () => ({
+        method: "POST",
+        headers: {
+          Cookie: `${SESSION_COOKIE}=${encodeURIComponent(sessionToken)}`,
+          Origin: authUrl
+        }
+      }),
+      { timeoutMs: 15e3 }
+    );
+  } catch (error) {
+    throw new ApiError(
+      `Could not reach the auth service at ${authUrl}: ${error instanceof Error ? error.message : String(error)}. Check your connection, then retry.`,
+      0,
+      "network_error",
+      path
+    );
+  }
+  if (res.status === 401) return null;
+  if (!res.ok) {
+    throw new ApiError(
+      `The auth service could not refresh the CLI token (HTTP ${res.status}). Retry without logging in again.`,
+      res.status,
+      res.status === 429 ? "rate_limited" : "auth_service_unavailable",
+      path
+    );
+  }
+  let data;
+  try {
+    data = await res.json();
+  } catch {
+    throw new ApiError(
+      "The auth service returned a malformed token response.",
+      res.status,
+      "invalid_response",
+      path
+    );
+  }
+  if (!data.token) {
+    throw new ApiError(
+      "The auth service returned no token for a valid session.",
+      res.status,
+      "invalid_response",
+      path
+    );
+  }
+  return data.token;
 }
 
 // src/cli/lib/secure-file.ts
@@ -609,19 +715,18 @@ function credentialPaths(authUrl = AUTH_URL) {
   return { sessionPath: join(DIR, `session${suffix}`), tokenPath: join(DIR, `token${suffix}`) };
 }
 var { sessionPath: SESSION_PATH, tokenPath: TOKEN_PATH } = credentialPaths();
-async function ensureToken() {
+async function ensureToken(options = {}) {
+  const minimumValidityMs = options.minimumValidityMs ?? 3e4;
   if (existsSync(TOKEN_PATH)) {
     const existing = readFileSync2(TOKEN_PATH, "utf-8").trim();
-    if (isTokenValid(existing)) {
+    if (isTokenValid(existing, minimumValidityMs)) {
       return existing;
     }
   }
   if (!existsSync(SESSION_PATH)) throw notAuthenticated("Not logged in");
-  const sessionToken = readFileSync2(SESSION_PATH, "utf-8").trim();
-  const token = await exchangeSession(AUTH_URL, sessionToken);
-  if (!token) throw notAuthenticated("The stored session is no longer valid (expired or unreadable)");
-  mkdirSync(DIR, { recursive: true, mode: 448 });
-  writeSecretFileSync(TOKEN_PATH, token);
+  const token = await exchangeStoredSession();
+  if (!token)
+    throw notAuthenticated("The stored session is no longer valid (expired or unreadable)");
   return token;
 }
 function notAuthenticated(state) {
@@ -638,30 +743,30 @@ function notAuthenticated(state) {
     { action: cliAction("deepspace", "auth", "login") }
   );
 }
-function isTokenValid(jwt) {
+function isTokenValid(jwt, minimumValidityMs) {
   try {
     const payload = decodeJwtPayload(jwt);
-    return typeof payload.exp === "number" && payload.exp * 1e3 > Date.now() + 3e4;
+    return typeof payload.exp === "number" && payload.exp * 1e3 > Date.now() + minimumValidityMs;
   } catch {
     return false;
   }
 }
-registerAuthRefresh(async () => {
-  try {
-    if (!existsSync(SESSION_PATH)) return null;
-    const sessionToken = readFileSync2(SESSION_PATH, "utf-8").trim();
-    const token = await exchangeSession(AUTH_URL, sessionToken);
-    if (!token) return null;
-    mkdirSync(DIR, { recursive: true, mode: 448 });
-    writeSecretFileSync(TOKEN_PATH, token);
-    return token;
-  } catch {
-    return null;
-  }
-});
+async function refreshTokenFromSession() {
+  return await exchangeStoredSession();
+}
+async function exchangeStoredSession() {
+  if (!existsSync(SESSION_PATH)) return null;
+  const sessionToken = readFileSync2(SESSION_PATH, "utf-8").trim();
+  const token = await exchangeSession(AUTH_URL, sessionToken);
+  if (!token) return null;
+  mkdirSync(DIR, { recursive: true, mode: 448 });
+  writeSecretFileSync(TOKEN_PATH, token);
+  return token;
+}
+registerAuthRefresh(refreshTokenFromSession);
 
 // src/cli/commands/login.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync3 } from "fs";
+import { mkdirSync as mkdirSync2 } from "fs";
 import { dirname as dirname2 } from "path";
 import { randomBytes, createHash } from "crypto";
 import * as p4 from "@clack/prompts";
@@ -675,6 +780,25 @@ function openBrowser(url) {
   }).unref();
 }
 
+// src/cli/lib/stdio.ts
+var MAX_STDIN_BYTES = 1024 * 1024;
+async function readStreamText(stream, maxBytes) {
+  const chunks = [];
+  let total = 0;
+  for await (const chunk of stream) {
+    const bytes = typeof chunk === "string" ? Buffer.from(chunk, "utf-8") : Buffer.from(chunk);
+    total += bytes.byteLength;
+    if (maxBytes !== void 0 && total > maxBytes) {
+      throw new InputError(
+        `Input on stdin exceeds ${Math.floor(maxBytes / 1024)} KiB \u2014 refusing to buffer more.`,
+        "input_too_large"
+      );
+    }
+    chunks.push(bytes);
+  }
+  return Buffer.concat(chunks).toString("utf-8");
+}
+
 // src/cli/commands/login.ts
 var AUTH_URL2 = process.env.DEEPSPACE_AUTH_URL ?? PLATFORM_URLS.auth;
 var API_URL = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
@@ -708,7 +832,7 @@ var login_default = defineDeepspaceCommand({
       passwordArg: args.password,
       envEmail: interactive ? void 0 : process.env.DEEPSPACE_EMAIL,
       envPassword: interactive ? void 0 : process.env.DEEPSPACE_PASSWORD,
-      passwordStdin: args["password-stdin"] ? readPasswordFromStdin() : void 0
+      passwordStdin: args["password-stdin"] ? await readPasswordFromStdin() : void 0
     });
     const passwordIntent = Boolean(args["password-stdin"]) || args.password !== void 0 || password !== void 0;
     const decision = loginModeDecision({ email, password, passwordIntent });
@@ -735,27 +859,7 @@ var login_default = defineDeepspaceCommand({
     if (!json) s.start("Creating login session...");
     const codeVerifier = base64url(randomBytes(32));
     const codeChallenge = base64url(createHash("sha256").update(codeVerifier).digest());
-    const sessionRes = await fetch(`${AUTH_URL2}/api/auth/cli/session`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ code_challenge: codeChallenge })
-    });
-    if (!sessionRes.ok) {
-      throw new Refusal(
-        `Could not create login session (${sessionRes.status})`,
-        "login_session_failed",
-        { action: cliAction("deepspace", "auth", "login") }
-      );
-    }
-    const sessionData = await sessionRes.json();
-    if (!sessionData.sessionId || !sessionData.loginUrl) {
-      throw new Refusal(
-        "Could not create login session \u2014 the auth server returned no session id or login url.",
-        "login_session_failed",
-        { action: cliAction("deepspace", "auth", "login") }
-      );
-    }
-    const { sessionId, loginUrl } = sessionData;
+    const { sessionId, loginUrl } = await createCliLoginSession(codeChallenge);
     if (!json) {
       s.stop("Opening browser...");
       p4.log.info(`If the browser doesn't open, visit:
@@ -816,14 +920,50 @@ function loginModeDecision(opts) {
     message: "Non-interactive login needs a non-empty password: --password-stdin, $DEEPSPACE_PASSWORD, or --password."
   };
 }
-function readPasswordFromStdin() {
+async function readPasswordFromStdin() {
   if (process.stdin.isTTY) {
     throw new Refusal(
       '--password-stdin expects the password piped on stdin, e.g. `printf %s "$PW" | deepspace auth login --email you@x.com --password-stdin`.',
       "password_stdin_needs_pipe"
     );
   }
-  return readFileSync3(0, "utf-8").replace(/\r?\n$/, "");
+  return (await readStreamText(process.stdin, MAX_STDIN_BYTES)).replace(/\r?\n$/, "");
+}
+async function createCliLoginSession(codeChallenge) {
+  let sessionRes;
+  try {
+    sessionRes = await fetchWithTransientRetry(
+      `${AUTH_URL2}/api/auth/cli/session`,
+      () => ({
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ code_challenge: codeChallenge })
+      }),
+      { timeoutMs: 15e3 }
+    );
+  } catch (error) {
+    throw new Refusal(
+      `Could not reach the auth service to create a login session: ${error instanceof Error ? error.message : String(error)}`,
+      "login_session_unreachable",
+      { action: cliAction("deepspace", "auth", "login") }
+    );
+  }
+  if (!sessionRes.ok) {
+    throw new Refusal(
+      `Could not create login session (${sessionRes.status})`,
+      "login_session_failed",
+      { action: cliAction("deepspace", "auth", "login") }
+    );
+  }
+  const sessionData = await sessionRes.json().catch(() => ({}));
+  if (!sessionData.sessionId || !sessionData.loginUrl) {
+    throw new Refusal(
+      "Could not create login session \u2014 the auth server returned no session id or login url.",
+      "login_session_failed",
+      { action: cliAction("deepspace", "auth", "login") }
+    );
+  }
+  return { sessionId: sessionData.sessionId, loginUrl: sessionData.loginUrl };
 }
 async function pollForCompletion(sessionId, codeVerifier) {
   const maxAttempts = 120;
@@ -879,7 +1019,7 @@ async function doEmailLogin(email, password) {
     const body = await res.json().catch(() => ({}));
     throw new Refusal(
       body.message ?? `Authentication failed (${res.status})`,
-      res.status === 401 ? "invalid_credentials" : "login_failed"
+      res.status === 401 ? "invalid_credentials" : res.status === 429 ? "rate_limited" : "login_failed"
     );
   }
   const setCookie = res.headers.get("set-cookie") ?? "";
@@ -890,7 +1030,10 @@ async function doEmailLogin(email, password) {
   const sessionToken = decodeURIComponent(cookieMatch[1]);
   const jwt = await exchangeSession(AUTH_URL2, sessionToken);
   if (!jwt) {
-    throw new Refusal("Signed in, but the auth service issued no token for the session.", "login_failed");
+    throw new Refusal(
+      "Signed in, but the auth service issued no token for the session.",
+      "login_failed"
+    );
   }
   storeCredentials(sessionToken, jwt);
   await provisionProfile(jwt);
@@ -903,7 +1046,7 @@ async function doEmailLogin(email, password) {
 }
 
 // src/cli/commands/logout.ts
-import { existsSync as existsSync2, readFileSync as readFileSync4, rmSync } from "fs";
+import { existsSync as existsSync2, readFileSync as readFileSync3, rmSync } from "fs";
 var AUTH_URL3 = process.env.DEEPSPACE_AUTH_URL ?? PLATFORM_URLS.auth;
 var { sessionPath: SESSION_PATH2, tokenPath: TOKEN_PATH2 } = credentialPaths(AUTH_URL3);
 var logout_default = defineDeepspaceCommand({
@@ -912,7 +1055,7 @@ var logout_default = defineDeepspaceCommand({
     description: "Sign out and remove cached credentials"
   },
   async run({ args }) {
-    const sessionToken = existsSync2(SESSION_PATH2) ? readFileSync4(SESSION_PATH2, "utf-8").trim() : null;
+    const sessionToken = existsSync2(SESSION_PATH2) ? readFileSync3(SESSION_PATH2, "utf-8").trim() : null;
     if (sessionToken) {
       try {
         await fetch(`${AUTH_URL3}/api/auth/sign-out`, {
@@ -938,11 +1081,11 @@ var logout_default = defineDeepspaceCommand({
 });
 
 // src/cli/lib/app-identity.ts
-import { existsSync as existsSync4, readFileSync as readFileSync6, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
 import { join as join3, resolve as resolve2 } from "path";
 
 // src/cli/lib/wrangler-env.ts
-import { existsSync as existsSync3, readFileSync as readFileSync5, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync4, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
 import { join as join2 } from "path";
 import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
 
@@ -1152,7 +1295,7 @@ function causeDetail(err) {
 function readWranglerConfigFile(path) {
   let raw;
   try {
-    raw = readFileSync5(path, "utf-8");
+    raw = readFileSync4(path, "utf-8");
   } catch (err) {
     const missing = err?.code === "ENOENT";
     throw new WranglerConfigError(
@@ -1237,7 +1380,7 @@ function writeAppId(cwd, appId, opts = {}) {
       );
     }
   }
-  let src = readFileSync6(wranglerPath, "utf-8");
+  let src = readFileSync5(wranglerPath, "utf-8");
   const header = opts.wranglerEnv ? `[env.${opts.wranglerEnv}.vars]` : "[vars]";
   const line = `DEEPSPACE_APP_ID = "${appId}"`;
   const headerRe = new RegExp(`^\\${header.replace(/\./g, "\\.")}[ \\t]*$`, "m");
@@ -1295,7 +1438,7 @@ function findChildApps(dir) {
 // src/cli/lib/launch-config.ts
 import {
   existsSync as existsSync7,
-  readFileSync as readFileSync8,
+  readFileSync as readFileSync7,
   realpathSync as realpathSync2,
   writeFileSync as writeFileSync4,
   mkdirSync as mkdirSync4,
@@ -1305,7 +1448,7 @@ import {
 import { join as join6, resolve as resolve5, dirname as dirname5, basename, isAbsolute as isAbsolute2, sep } from "path";
 
 // src/cli/lib/git/repository.ts
-import { appendFileSync, existsSync as existsSync6, mkdirSync as mkdirSync3, readFileSync as readFileSync7 } from "fs";
+import { appendFileSync, existsSync as existsSync6, mkdirSync as mkdirSync3, readFileSync as readFileSync6 } from "fs";
 import { dirname as dirname4, join as join5, resolve as resolve4 } from "path";
 
 // src/cli/lib/git/process.ts
@@ -1529,7 +1672,7 @@ function ensureLocalExclude(cwd, pattern) {
   const excludePath = join5(commonDir, "info", "exclude");
   let current = "";
   try {
-    current = readFileSync7(excludePath, "utf-8");
+    current = readFileSync6(excludePath, "utf-8");
   } catch {
   }
   if (current.split("\n").some((line) => line.trim() === pattern)) return;
@@ -1562,7 +1705,7 @@ function writeLaunchFile(launchPath, config) {
 function readLaunchFile(launchPath) {
   const empty = { version: "0.0.1", configurations: [] };
   if (!existsSync7(launchPath)) return empty;
-  const raw = readFileSync8(launchPath, "utf-8").trim();
+  const raw = readFileSync7(launchPath, "utf-8").trim();
   if (!raw) return empty;
   const parsed = JSON.parse(raw);
   if (!parsed || typeof parsed !== "object" || !Array.isArray(parsed.configurations)) return null;
@@ -1732,7 +1875,7 @@ function githubSourceRefusal(appId, repository) {
 }
 async function getAppSource(deployUrl, token, appId) {
   try {
-    const state = await apiFetch(
+    const state = await apiFetchReadWithRetry(
       deployUrl,
       token,
       `/api/apps/${encodeURIComponent(appId)}/source`
@@ -1890,7 +2033,7 @@ function liveAppUrl(app2) {
   return app2.status === "active" && app2.deployedAt !== null ? app2.url : null;
 }
 async function listAppsPage(deployUrl, token) {
-  const body = await apiFetch(deployUrl, token, "/api/apps");
+  const body = await apiFetchReadWithRetry(deployUrl, token, "/api/apps");
   if (!Array.isArray(body.apps)) {
     throw new InputError(
       `The deploy service at ${deployUrl} returned an unexpected response shape for the app list \u2014 check DEEPSPACE_DEPLOY_URL (is this the service the app lives on?).`,
@@ -2098,15 +2241,15 @@ async function writeDevVars(appDir, ownerId, callerJwt, wranglerEnv, opts = {})
 }
 
 // src/cli/lib/install-status.ts
-import { existsSync as existsSync9, readFileSync as readFileSync10, realpathSync as realpathSync3 } from "fs";
+import { existsSync as existsSync9, readFileSync as readFileSync9, realpathSync as realpathSync3 } from "fs";
 import { dirname as dirname6, join as join8, resolve as resolve6 } from "path";
 
 // src/cli/lib/package-manager.ts
-import { existsSync as existsSync8, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync8, readFileSync as readFileSync8 } from "fs";
 import { join as join7 } from "path";
 function detectPackageManager(appDir) {
   try {
-    const pkg2 = JSON.parse(readFileSync9(join7(appDir, "package.json"), "utf-8"));
+    const pkg2 = JSON.parse(readFileSync8(join7(appDir, "package.json"), "utf-8"));
     const name = typeof pkg2.packageManager === "string" ? pkg2.packageManager.split("@")[0] : "";
     if (name === "npm" || name === "pnpm" || name === "yarn" || name === "bun") return name;
   } catch {
@@ -2144,7 +2287,7 @@ function ensureInstallReady(appDir) {
   const donePath = join8(sentinelDir, "install.done");
   const logPath = join8(sentinelDir, "install.log");
   if (existsSync9(errPath)) {
-    const detail = readFileSync10(errPath, "utf-8").trimEnd();
+    const detail = readFileSync9(errPath, "utf-8").trimEnd();
     const log29 = existsSync9(logPath) ? ` Full log: ${logPath}.` : "";
     throw new Refusal(
       `Dependency install failed: ${detail}.${log29} Run \`npm install\` (or \`bun install\`) manually, then retry.`,
@@ -2200,7 +2343,7 @@ function canonicalPath2(path) {
 function installWorkerAlive(sentinelDir) {
   const pidPath = join8(sentinelDir, "install.pid");
   if (!existsSync9(pidPath)) return false;
-  return processAlive(Number(readFileSync10(pidPath, "utf-8").trim()));
+  return processAlive(Number(readFileSync9(pidPath, "utf-8").trim()));
 }
 function processAlive(pid) {
   if (!Number.isSafeInteger(pid) || pid <= 0) return false;
@@ -2281,9 +2424,12 @@ function removeMacosJunk(dir) {
 }
 
 // src/server/rooms/binding-manifest.ts
+var MAX_ENV_VAR_BYTES = 5 * 1024;
 var AUTO_PROVISION_SENTINEL = "auto";
 var VECTORIZE_METRICS = /* @__PURE__ */ new Set(["cosine", "euclidean", "dot-product"]);
 var ALLOWED_BINDING_TYPES = /* @__PURE__ */ new Set([
+  "plain_text",
+  "json",
   "vectorize",
   "ai",
   "r2_bucket",
@@ -2361,6 +2507,17 @@ function validateBindingManifest(manifest) {
 }
 function requiredFieldError(b) {
   switch (b.type) {
+    case "plain_text":
+      if (typeof b.text !== "string") {
+        return `plain_text binding "${b.name}" missing text (string)`;
+      }
+      return envVarSizeError(b.name, b.text);
+    case "json": {
+      if (!isBindingJsonValue(b.json)) {
+        return `json binding "${b.name}" must contain a JSON-serializable value`;
+      }
+      return envVarSizeError(b.name, JSON.stringify(b.json));
+    }
     case "ai_search":
       if (b.instance_name !== AUTO_PROVISION_SENTINEL) {
         return `ai_search binding "${b.name}" must set instance_name = "auto"; managed instances cannot be selected directly`;
@@ -2435,6 +2592,18 @@ function bindingManifestFromOutputConfig(outputConfig) {
     );
   }
   const out = [];
+  const vars = isObject(outputConfig.vars) ? outputConfig.vars : null;
+  for (const [name, value] of Object.entries(vars ?? {})) {
+    if (name === "DEEPSPACE_APP_ID" || name === "APP_NAME") continue;
+    if (typeof value === "string") {
+      out.push({ type: "plain_text", name, text: value });
+      continue;
+    }
+    if (!isBindingJsonValue(value)) {
+      throw new Error(`Wrangler var "${name}" is not a JSON-serializable value`);
+    }
+    out.push({ type: "json", name, json: value });
+  }
   const aiBinding = pluckString(outputConfig.ai, "binding");
   if (aiBinding) out.push({ type: "ai", name: aiBinding });
   for (const v of asObjectArray(outputConfig.vectorize)) {
@@ -2517,6 +2686,25 @@ function bindingManifestFromOutputConfig(outputConfig) {
 function isObject(v) {
   return v !== null && typeof v === "object" && !Array.isArray(v);
 }
+function isBindingJsonValue(value, ancestors = /* @__PURE__ */ new Set()) {
+  if (value === null || typeof value === "string" || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value)) {
+    return true;
+  }
+  if (typeof value !== "object") return false;
+  if (ancestors.has(value)) return false;
+  if (!Array.isArray(value)) {
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null) return false;
+  }
+  ancestors.add(value);
+  const valid = Array.isArray(value) ? value.every((entry) => isBindingJsonValue(entry, ancestors)) : Object.values(value).every((entry) => isBindingJsonValue(entry, ancestors));
+  ancestors.delete(value);
+  return valid;
+}
+function envVarSizeError(name, serializedValue) {
+  const size = new TextEncoder().encode(serializedValue).byteLength;
+  return size <= MAX_ENV_VAR_BYTES ? null : `Environment variable binding "${name}" is ${size} bytes; maximum is ${MAX_ENV_VAR_BYTES}`;
+}
 function pluckString(v, key) {
   if (!isObject(v)) return null;
   const val = v[key];
@@ -2573,21 +2761,31 @@ function defaultConfigNameForEnv(wranglerEnv) {
 function secretsApi(deployUrl, token, path, init) {
   return apiFetch(deployUrl, token, `/api/secrets${path}`, init);
 }
+function readSecretsApi(deployUrl, token, path) {
+  return apiFetchReadWithRetry(deployUrl, token, `/api/secrets${path}`);
+}
+function retryingSecretsApi(deployUrl, token, path, init) {
+  return apiFetchWithTransientRetry(deployUrl, token, `/api/secrets${path}`, init);
+}
 function listSecrets(deployUrl, token, appId, configName) {
-  return secretsApi(deployUrl, token, `/${appId}/configs/${encodeURIComponent(configName)}`);
+  return readSecretsApi(deployUrl, token, `/${appId}/configs/${encodeURIComponent(configName)}`);
 }
 function fetchSecretsValues(deployUrl, token, appId, configName) {
-  return secretsApi(deployUrl, token, `/${appId}/configs/${encodeURIComponent(configName)}/values`);
+  return readSecretsApi(
+    deployUrl,
+    token,
+    `/${appId}/configs/${encodeURIComponent(configName)}/values`
+  );
 }
 function getSecretPlain(deployUrl, token, appId, configName, key) {
-  return secretsApi(
+  return readSecretsApi(
     deployUrl,
     token,
     `/${appId}/configs/${encodeURIComponent(configName)}/secrets/${encodeURIComponent(key)}?plain=true`
   );
 }
 function setSecret(deployUrl, token, appId, configName, key, value) {
-  return secretsApi(
+  return retryingSecretsApi(
     deployUrl,
     token,
     `/${appId}/configs/${encodeURIComponent(configName)}/secrets/${encodeURIComponent(key)}`,
@@ -2595,7 +2793,7 @@ function setSecret(deployUrl, token, appId, configName, key, value) {
   );
 }
 function deleteSecret(deployUrl, token, appId, configName, key) {
-  return secretsApi(
+  return retryingSecretsApi(
     deployUrl,
     token,
     `/${appId}/configs/${encodeURIComponent(configName)}/secrets/${encodeURIComponent(key)}`,
@@ -2603,7 +2801,7 @@ function deleteSecret(deployUrl, token, appId, configName, key) {
   );
 }
 function uploadSecrets(deployUrl, token, appId, configName, secrets, replace) {
-  return secretsApi(
+  return retryingSecretsApi(
     deployUrl,
     token,
     `/${appId}/configs/${encodeURIComponent(configName)}/secrets`,
@@ -2611,7 +2809,7 @@ function uploadSecrets(deployUrl, token, appId, configName, secrets, replace) {
   );
 }
 function listConfigs(deployUrl, token, appId) {
-  return secretsApi(deployUrl, token, `/${appId}/configs`);
+  return readSecretsApi(deployUrl, token, `/${appId}/configs`);
 }
 function createConfig(deployUrl, token, appId, configName, copyFrom) {
   return secretsApi(deployUrl, token, `/${appId}/configs`, {
@@ -3146,7 +3344,7 @@ Free it with \`${killCmd}\`, or start on another port: \`deepspace dev start --p
 
 // src/cli/commands/kill.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { readFileSync as readFileSync11, readdirSync as readdirSync3, readlinkSync } from "fs";
+import { readFileSync as readFileSync10, readdirSync as readdirSync3, readlinkSync } from "fs";
 import { setTimeout as wait } from "timers/promises";
 var SIGTERM_GRACE_MS = 1500;
 var IS_WIN = process.platform === "win32";
@@ -3297,7 +3495,7 @@ function listenerPidsViaProc(port) {
     for (const f of ["/proc/net/tcp", "/proc/net/tcp6"]) {
       let data;
       try {
-        data = readFileSync11(f, "utf-8");
+        data = readFileSync10(f, "utf-8");
       } catch {
         continue;
       }
@@ -3477,10 +3675,10 @@ function ensurePlaywright(appDir) {
 }
 
 // src/cli/lib/test-account-service.ts
-import { readFileSync as readFileSync13 } from "fs";
+import { readFileSync as readFileSync12 } from "fs";
 
 // src/testing/accounts.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync5, readFileSync as readFileSync12 } from "fs";
+import { existsSync as existsSync12, mkdirSync as mkdirSync5, readFileSync as readFileSync11 } from "fs";
 import { homedir as homedir2 } from "os";
 import { join as join12 } from "path";
 var TEST_ACCOUNTS_PATH = join12(homedir2(), ".deepspace", "test-accounts.json");
@@ -3550,7 +3748,7 @@ function removeTestAccounts(ids, emails = [], scope = currentTestAccountScope())
 function readTestAccountStore() {
   if (!existsSync12(TEST_ACCOUNTS_PATH)) return { version: 2, scopes: {} };
   try {
-    const raw = JSON.parse(readFileSync12(TEST_ACCOUNTS_PATH, "utf-8"));
+    const raw = JSON.parse(readFileSync11(TEST_ACCOUNTS_PATH, "utf-8"));
     if (Array.isArray(raw)) return { version: 2, scopes: {} };
     if (!raw || typeof raw !== "object") {
       return { version: 2, scopes: {} };
@@ -3581,7 +3779,7 @@ function saveTestAccountStore(store) {
 var SESSION_COOKIE2 = "__Secure-better-auth.session_token";
 var AUTH_URL4 = process.env.DEEPSPACE_AUTH_URL ?? PLATFORM_URLS.auth;
 function sessionCookie() {
-  const token = readFileSync13(SESSION_PATH, "utf-8").trim();
+  const token = readFileSync12(SESSION_PATH, "utf-8").trim();
   return `${SESSION_COOKIE2}=${encodeURIComponent(token)}`;
 }
 async function fetchRemoteTestAccounts() {
@@ -4516,8 +4714,8 @@ function describeFilesFailure(status3, body) {
 import * as p6 from "@clack/prompts";
 import { execSync as execSync2 } from "child_process";
 import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync16, readFileSync as readFileSync16, readdirSync as readdirSync6 } from "fs";
-import { dirname as dirname7, join as join17, resolve as resolve13 } from "path";
+import { existsSync as existsSync16, readFileSync as readFileSync15, readdirSync as readdirSync6 } from "fs";
+import { dirname as dirname7, isAbsolute as isAbsolute3, join as join17, relative as relative2, resolve as resolve13, sep as sep3 } from "path";
 
 // src/build/app-id.ts
 import { resolve as resolve11 } from "path";
@@ -4547,7 +4745,7 @@ function removeBuildDevVars(workerDir) {
 }
 
 // src/documentation/deploy.ts
-import { existsSync as existsSync14, readFileSync as readFileSync14 } from "fs";
+import { existsSync as existsSync14, readFileSync as readFileSync13 } from "fs";
 import { join as join15 } from "path";
 function readDocumentationDeployManifest(appDir, clientDir) {
   if (!existsSync14(join15(appDir, "documentation.json"))) return void 0;
@@ -4557,11 +4755,11 @@ function readDocumentationDeployManifest(appDir, clientDir) {
       "documentation.json exists but the build produced no documentation manifest. Ensure vite.config.ts includes deepSpaceDocumentation() from deepspace/documentation."
     );
   }
-  return JSON.parse(readFileSync14(manifestPath, "utf8"));
+  return JSON.parse(readFileSync13(manifestPath, "utf8"));
 }
 
 // src/cli/commands/update/app-migrations.ts
-import { existsSync as existsSync15, readFileSync as readFileSync15 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync14 } from "fs";
 import { join as join16 } from "path";
 
 // src/shared/protocol/app-migrations.ts
@@ -4640,7 +4838,7 @@ function readAppliedAppMigrations(appDir) {
   if (!existsSync15(path)) return [];
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync15(path, "utf8"));
+    parsed = JSON.parse(readFileSync14(path, "utf8"));
   } catch {
     throw new Refusal(
       `${APP_MIGRATIONS_MANIFEST} must contain valid JSON`,
@@ -4706,12 +4904,12 @@ async function buildDeployBundle(options) {
       "build_output_missing"
     );
   }
-  const deployConfig = JSON.parse(readFileSync16(deployConfigPath, "utf-8"));
+  const deployConfig = JSON.parse(readFileSync15(deployConfigPath, "utf-8"));
   const outputWranglerPath = resolve13(dirname7(deployConfigPath), deployConfig.configPath);
   if (!existsSync16(outputWranglerPath)) {
     output.die(`Output wrangler.json not found at ${outputWranglerPath}`, "build_output_missing");
   }
-  const outputConfig = JSON.parse(readFileSync16(outputWranglerPath, "utf-8"));
+  const outputConfig = JSON.parse(readFileSync15(outputWranglerPath, "utf-8"));
   if (outputConfig.name && outputConfig.name !== appName) {
     const envHint = envName ? ` (--env ${envName})` : "";
     output.die(
@@ -4745,7 +4943,13 @@ async function buildDeployBundle(options) {
   spinner2.stop(`Collected ${assets.length} assets`);
   const appIdRefusal = clientAppIdRefusal(assets, appId, envName);
   if (appIdRefusal) output.die(appIdRefusal.message, appIdRefusal.code);
-  const workerJs = readFileSync16(workerBundlePath, "utf-8");
+  const worker = (() => {
+    try {
+      return collectWorkerBundle(workerDir, workerBundlePath, clientDir);
+    } catch (error) {
+      return output.die(errorMessage(error), "build_output_invalid");
+    }
+  })();
   const doBindings = outputConfig.durable_objects?.bindings;
   const sqliteClasses = new Set(
     outputConfig.migrations?.flatMap((migration) => migration.new_sqlite_classes ?? []) ?? []
@@ -4780,7 +4984,7 @@ async function buildDeployBundle(options) {
   return {
     assets,
     assetConfig,
-    workerJs,
+    worker,
     appMigrations,
     doManifest,
     customBindings,
@@ -4790,6 +4994,43 @@ async function buildDeployBundle(options) {
     notFoundHandling: typeof outputConfig.assets?.not_found_handling === "string" ? outputConfig.assets.not_found_handling : null
   };
 }
+var WORKER_ES_MODULE = /\.(?:js|mjs)$/i;
+function collectWorkerBundle(workerDir, mainPath, clientDir) {
+  const root = resolve13(workerDir);
+  const mainAbsolute = resolve13(mainPath);
+  const excludedClient = clientDir ? resolve13(clientDir) : null;
+  const main2 = moduleName(root, mainAbsolute);
+  const modules = [];
+  const walk = (directory) => {
+    for (const entry of readdirSync6(directory, { withFileTypes: true }).sort(
+      (a, b) => a.name.localeCompare(b.name)
+    )) {
+      const fullPath = join17(directory, entry.name);
+      if (excludedClient && isWithin(excludedClient, fullPath)) continue;
+      if (entry.isDirectory()) {
+        walk(fullPath);
+      } else if (entry.isFile() && WORKER_ES_MODULE.test(entry.name)) {
+        modules.push({ name: moduleName(root, fullPath), content: readFileSync15(fullPath, "utf-8") });
+      }
+    }
+  };
+  walk(root);
+  const mainIndex = modules.findIndex((module) => module.name === main2);
+  if (mainIndex < 0) throw new Error(`Worker main module not found in generated output: ${main2}`);
+  const [mainModule] = modules.splice(mainIndex, 1);
+  return { main: main2, modules: [mainModule, ...modules] };
+}
+function moduleName(root, path) {
+  const name = relative2(root, path);
+  if (!name || isAbsolute3(name) || name === ".." || name.startsWith(`..${sep3}`)) {
+    throw new Error(`Worker module is outside the generated output directory: ${path}`);
+  }
+  return name.split(sep3).join("/");
+}
+function isWithin(root, path) {
+  const name = relative2(root, path);
+  return name === "" || !isAbsolute3(name) && name !== ".." && !name.startsWith(`..${sep3}`);
+}
 function extractRunWorkerFirst(config) {
   const raw = Array.isArray(config.assets?.run_worker_first) ? config.assets.run_worker_first : [];
   const routes = [];
@@ -4821,7 +5062,7 @@ function clientAppIdRefusal(assets, appId, envName) {
   let unsubstituted;
   for (const asset of assets) {
     if (!CLIENT_CODE_ASSET.test(asset.path)) continue;
-    const source = readFileSync16(asset.sourcePath, "utf-8");
+    const source = readFileSync15(asset.sourcePath, "utf-8");
     if (unsubstituted === void 0 && source.includes(APP_ID_DEFINE)) unsubstituted = asset.path;
     for (const found of source.matchAll(APP_ID_LITERAL)) {
       if (found[0] !== appId && !foreign.has(found[0])) foreign.set(found[0], asset.path);
@@ -4855,7 +5096,7 @@ function collectAssets(dir) {
       if (entry.isDirectory()) {
         walk(fullPath, relativePath);
       } else {
-        const bytes = readFileSync16(fullPath);
+        const bytes = readFileSync15(fullPath);
         assets.push({
           path: `/${relativePath}`,
           hash: createHash2("sha256").update(bytes).digest("hex"),
@@ -4876,7 +5117,7 @@ function readDeployAssetConfig(clientDir) {
   ]) {
     const filePath = join17(clientDir, file);
     if (!existsSync16(filePath)) continue;
-    const content = readFileSync16(filePath, "utf8");
+    const content = readFileSync15(filePath, "utf8");
     if (content.trim()) config[key] = content;
   }
   return config;
@@ -5201,7 +5442,7 @@ function createDeployOutput(json) {
 
 // src/cli/commands/deploy/request.ts
 import * as p10 from "@clack/prompts";
-import { readFileSync as readFileSync17 } from "fs";
+import { readFileSync as readFileSync16 } from "fs";
 
 // src/cli/commands/deploy/repository.ts
 import * as p9 from "@clack/prompts";
@@ -5293,7 +5534,7 @@ function committedSecretRefusal(cwd, commitOid, options) {
 // src/cli/lib/vc-remote.ts
 import { existsSync as existsSync18 } from "fs";
 import { tmpdir } from "os";
-import { isAbsolute as isAbsolute3, relative as relative2, resolve as resolve14 } from "path";
+import { isAbsolute as isAbsolute4, relative as relative3, resolve as resolve14 } from "path";
 function spaceRemoteName(environment = DEEPSPACE_ENV) {
   if (environment === "staging") return "space-staging";
   if (environment === "production") return "space";
@@ -5339,8 +5580,8 @@ function entryIsTransient(cwd) {
   const entry = process.argv[1];
   if (!entry) return true;
   if (/[\\/]_npx[\\/]/.test(entry) || entry.startsWith(tmpdir())) return true;
-  const rel = relative2(resolve14(cwd), resolve14(entry));
-  return rel === "" || !rel.startsWith("..") && !isAbsolute3(rel);
+  const rel = relative3(resolve14(cwd), resolve14(entry));
+  return rel === "" || !rel.startsWith("..") && !isAbsolute4(rel);
 }
 function helperEntryUsable(command) {
   const match = /^!(?:DEEPSPACE_ENV=(production|staging) )?'([^']*)' '([^']*)' git-credential$/.exec(command);
@@ -5891,6 +6132,7 @@ function detachedHeadRefusal() {
 }
 
 // src/cli/commands/deploy/request.ts
+var postWithRetry = fetchWithTransientRetry;
 var STALE_DISPLAY_NAME_LOCATIONS = [
   "src/constants.ts:APP_NAME",
   "wrangler.toml:[vars].APP_NAME"
@@ -5905,7 +6147,36 @@ function renamePromptMessage(rename2) {
 var CLOUDFLARE_DEPLOY_ERROR_HINT = "Deployment reached the DeepSpace deploy worker, but Cloudflare's deployment control-plane API failed. This is often caused by a Cloudflare Dashboard/API incident or Workers for Platforms entitlement outage. Already deployed apps should keep serving; wait for Cloudflare to recover and retry.";
 var DEPLOY_SERVICE_LIMIT_HINT = "The DeepSpace deploy service hit a resource limit processing this deploy (the deploy worker was terminated before it could answer). This is a DeepSpace-side failure, not a Cloudflare incident \u2014 your app was not changed. Retry; if it keeps happening, report the app id and asset count.";
 var REQUIRED_ASSET_TRANSPORT = "content-addressed-v1";
+var REQUIRED_WORKER_MODULE_TRANSPORT = "multipart-v1";
 var UPLOAD_CONCURRENCY = 16;
+var ASSET_UPLOAD_ATTEMPT_TIMEOUT_MS = 15e4;
+var ASSET_UPLOAD_ATTEMPTS = 2;
+function createDeployAuthSession(initialToken, refreshToken) {
+  let currentToken = initialToken;
+  let refreshInFlight = null;
+  const recover2 = async (rejectedToken) => {
+    if (currentToken !== rejectedToken) return currentToken;
+    if (!refreshToken) return null;
+    if (!refreshInFlight) {
+      refreshInFlight = refreshToken().then((freshToken) => {
+        if (freshToken && freshToken !== currentToken) currentToken = freshToken;
+        return freshToken;
+      }).finally(() => {
+        refreshInFlight = null;
+      });
+    }
+    return await refreshInFlight;
+  };
+  return {
+    async request(run2) {
+      const rejectedToken = currentToken;
+      const response = await run2(rejectedToken);
+      if (response.status !== 401) return response;
+      const freshToken = await recover2(rejectedToken);
+      return freshToken && freshToken !== rejectedToken ? await run2(freshToken) : response;
+    }
+  };
+}
 async function deployBuiltBundle(options) {
   const {
     deployUrl,
@@ -5913,6 +6184,7 @@ async function deployBuiltBundle(options) {
     appId,
     appName,
     token,
+    refreshToken,
     claimReleased,
     ignoreStale,
     bundle,
@@ -5921,14 +6193,18 @@ async function deployBuiltBundle(options) {
     output,
     spinner: spinner2
   } = options;
+  const auth2 = createDeployAuthSession(token, refreshToken);
   spinner2.start(`Deploying ${appName}...`);
   if (bundle.extraRoutes === true) {
     p10.log.info("Worker-first routing: all requests");
   } else if (bundle.extraRoutes.length) {
     p10.log.info(`Custom worker-first routes: ${bundle.extraRoutes.join(", ")}`);
   }
-  await requireAssetTransport(deployUrl, spinner2, output);
-  await uploadDeployAssets({ deployUrl, appId, token, assets: bundle.assets, output, spinner: spinner2 });
+  await requireDeployCapabilities(deployUrl, bundle.worker.modules.length > 1, spinner2, output);
+  await uploadDeployAssetsWithAuth(
+    { deployUrl, appId, assets: bundle.assets, output, spinner: spinner2 },
+    auth2
+  );
   spinner2.message(`Deploying ${appName}...`);
   let confirmRename = options.rename;
   const bail = async (message, stopLabel = "Deploy failed", code, actionRequired = false, rawAction) => {
@@ -5949,11 +6225,27 @@ async function deployBuiltBundle(options) {
   };
   const makeForm = () => {
     const form = new FormData();
+    const main2 = bundle.worker.modules.find((module) => module.name === bundle.worker.main);
+    if (!main2) return output.die("Built Worker bundle has no main module.", "build_output_invalid");
     form.append(
       "worker",
-      new Blob([bundle.workerJs], { type: "application/javascript" }),
-      "worker.js"
-    );
+      new Blob([main2.content], { type: "application/javascript+module" }),
+      main2.name
+    );
+    form.append("workerMain", bundle.worker.main);
+    const additionalModules = bundle.worker.modules.filter(
+      (module) => module.name !== bundle.worker.main
+    );
+    if (additionalModules.length) {
+      form.append("workerModules", JSON.stringify(additionalModules.map((module) => module.name)));
+      for (const module of additionalModules) {
+        form.append(
+          "workerModule",
+          new Blob([module.content], { type: "application/javascript+module" }),
+          module.name
+        );
+      }
+    }
     form.append("assetManifest", JSON.stringify(assetManifest(bundle.assets)));
     form.append("appMigrations", JSON.stringify(bundle.appMigrations));
     if (bundle.doManifest) form.append("doManifest", JSON.stringify(bundle.doManifest));
@@ -5997,14 +6289,16 @@ async function deployBuiltBundle(options) {
   let commitStarted = Date.now();
   const postCommit = async () => {
     commitStarted = Date.now();
-    return postWithRetry(
-      `${deployUrl}/api/deploy/${appId}`,
-      () => ({
-        method: "POST",
-        headers: { Authorization: `Bearer ${token}` },
-        body: makeForm()
-      }),
-      { retryServerErrors: false, attempts: 2, timeoutMs: 24e4 }
+    return auth2.request(
+      (bearer) => postWithRetry(
+        `${deployUrl}/api/deploy/${appId}`,
+        () => ({
+          method: "POST",
+          headers: { Authorization: `Bearer ${bearer}` },
+          body: makeForm()
+        }),
+        { retryServerErrors: false, attempts: 2, timeoutMs: 24e4 }
+      )
     );
   };
   let response;
@@ -6012,9 +6306,9 @@ async function deployBuiltBundle(options) {
     response = await postCommit();
   } catch (error) {
     await bail(
-      `Deploy request failed: ${errorMessage4(error)}`,
+      error instanceof ApiError ? errorMessage4(error) : `Deploy request failed: ${errorMessage4(error)}`,
       "Deploy failed",
-      "deploy_request_failed"
+      error instanceof ApiError ? error.code : "deploy_request_failed"
     );
     throw error;
   }
@@ -6075,13 +6369,15 @@ async function deployBuiltBundle(options) {
 function assetManifest(assets) {
   return assets.map((asset) => ({ path: asset.path, hash: asset.hash, size: asset.size }));
 }
-async function requireAssetTransport(deployUrl, spinner2, output) {
-  let advertised;
+async function requireDeployCapabilities(deployUrl, needsWorkerModules, spinner2, output) {
+  let capabilities;
   try {
-    const response = await fetch(`${deployUrl}/api/health`);
+    const response = await postWithRetry(`${deployUrl}/api/health`, () => ({}), {
+      timeoutMs: 15e3
+    });
     if (!response.ok) throw new Error(`HTTP ${response.status}`);
     const body = await response.json();
-    advertised = body.capabilities?.assetTransport;
+    capabilities = body.capabilities;
   } catch (error) {
     spinner2.stop("Deploy failed");
     output.die(
@@ -6089,30 +6385,42 @@ async function requireAssetTransport(deployUrl, spinner2, output) {
       "deploy_service_unreachable"
     );
   }
-  if (advertised !== REQUIRED_ASSET_TRANSPORT) {
+  if (capabilities?.assetTransport !== REQUIRED_ASSET_TRANSPORT) {
     spinner2.stop("Deploy failed");
     output.die(
-      `The DeepSpace deploy service at ${deployUrl} does not support this CLI's asset transport (needs "${REQUIRED_ASSET_TRANSPORT}", found ${advertised === void 0 ? "none" : `"${String(advertised)}"`}). Wait for the platform to finish updating, or pin an older deepspace CLI.`,
+      `The DeepSpace deploy service at ${deployUrl} does not support this CLI's asset transport (needs "${REQUIRED_ASSET_TRANSPORT}", found ${capabilities?.assetTransport === void 0 ? "none" : `"${String(capabilities.assetTransport)}"`}). Wait for the platform to finish updating, or pin an older deepspace CLI.`,
       "asset_transport_unsupported"
     );
   }
+  if (needsWorkerModules && capabilities?.workerModules !== REQUIRED_WORKER_MODULE_TRANSPORT) {
+    spinner2.stop("Deploy failed");
+    output.die(
+      `This build contains multiple Worker modules, but the DeepSpace deploy service at ${deployUrl} does not support their transport (needs "${REQUIRED_WORKER_MODULE_TRANSPORT}", found ${capabilities?.workerModules === void 0 ? "none" : `"${String(capabilities.workerModules)}"`}). Wait for the platform to finish updating before retrying this deploy.`,
+      "worker_module_transport_unsupported"
+    );
+  }
 }
-async function uploadDeployAssets(options) {
-  const { deployUrl, appId, token, assets, spinner: spinner2 } = options;
+async function uploadDeployAssetsWithAuth(options, auth2) {
+  const { deployUrl, appId, assets, spinner: spinner2 } = options;
   const output = options.output;
   const byHash = new Map(assets.map((asset) => [asset.hash, asset]));
   spinner2.message("Checking which assets are already uploaded...");
   let planResponse;
   try {
-    planResponse = await postWithRetry(`${deployUrl}/api/deploy/${appId}/asset-plan`, () => ({
-      method: "POST",
-      headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
-      body: JSON.stringify({
-        assets: [...byHash.values()].map((asset) => ({ hash: asset.hash, size: asset.size }))
-      })
-    }));
+    planResponse = await auth2.request(
+      (bearer) => postWithRetry(`${deployUrl}/api/deploy/${appId}/asset-plan`, () => ({
+        method: "POST",
+        headers: { Authorization: `Bearer ${bearer}`, "Content-Type": "application/json" },
+        body: JSON.stringify({
+          assets: [...byHash.values()].map((asset) => ({ hash: asset.hash, size: asset.size }))
+        })
+      }))
+    );
   } catch (error) {
     spinner2.stop("Deploy failed");
+    if (error instanceof ApiError) {
+      output.die(errorMessage4(error), error.code ?? "upload_failed");
+    }
     output.die(`Asset plan failed (network): ${errorMessage4(error)}`, "upload_failed");
   }
   const planBody = await planResponse.json().catch(() => ({}));
@@ -6148,20 +6456,23 @@ async function uploadDeployAssets(options) {
   const next = () => missing.pop();
   const worker = async () => {
     for (let asset = next(); asset; asset = next()) {
-      const response = await postWithRetry(
-        `${deployUrl}/api/deploy/${appId}/assets/${asset.hash}`,
-        () => ({
-          method: "PUT",
-          headers: {
-            Authorization: `Bearer ${token}`,
-            "Content-Type": "application/octet-stream"
-          },
-          // Read whole, per attempt. The platform matches Content-Length
-          // against the plan before it touches storage, and a stream body
-          // would be sent chunked with no length at all; a retry also needs a
-          // body it can send again.
-          body: readFileSync17(asset.sourcePath)
-        })
+      const response = await auth2.request(
+        (bearer) => postWithRetry(
+          `${deployUrl}/api/deploy/${appId}/assets/${asset.hash}`,
+          () => ({
+            method: "PUT",
+            headers: {
+              Authorization: `Bearer ${bearer}`,
+              "Content-Type": "application/octet-stream"
+            },
+            // Read whole, per attempt. The platform matches Content-Length
+            // against the plan before it touches storage, and a stream body
+            // would be sent chunked with no length at all; a retry also needs a
+            // body it can send again.
+            body: readFileSync16(asset.sourcePath)
+          }),
+          { attempts: ASSET_UPLOAD_ATTEMPTS, timeoutMs: ASSET_UPLOAD_ATTEMPT_TIMEOUT_MS }
+        )
       );
       if (!response.ok) {
         const body = await response.json().catch(() => ({}));
@@ -6178,14 +6489,15 @@ async function uploadDeployAssets(options) {
   const uploadStarted = Date.now();
   try {
     await Promise.all(Array.from({ length: Math.min(UPLOAD_CONCURRENCY, missing.length) }, worker));
-    p10.log.info(
-      `Uploaded ${total} file(s) in ${Math.round((Date.now() - uploadStarted) / 1e3)}s`
-    );
+    p10.log.info(`Uploaded ${total} file(s) in ${Math.round((Date.now() - uploadStarted) / 1e3)}s`);
   } catch (error) {
     spinner2.stop("Deploy failed");
     if (error instanceof AssetUploadError) {
       output.die(formatDeployWorkerError(error.status, error.message, error.code), error.code);
     }
+    if (error instanceof ApiError) {
+      output.die(errorMessage4(error), error.code ?? "upload_failed");
+    }
     output.die(`Asset upload failed (network): ${errorMessage4(error)}`, "upload_failed");
   }
 }
@@ -6224,29 +6536,6 @@ Underlying error: ${detail}`;
 function errorMessage4(error) {
   return error instanceof Error ? error.message : String(error);
 }
-async function postWithRetry(url, makeInit, {
-  attempts = 4,
-  retryServerErrors = true,
-  timeoutMs = 6e4
-} = {}) {
-  let lastResponse;
-  let lastError;
-  for (let attempt = 1; attempt <= attempts; attempt++) {
-    try {
-      const response = await fetch(url, { ...makeInit(), signal: AbortSignal.timeout(timeoutMs) });
-      const transient = retryServerErrors && (response.status >= 500 || response.status === 408 || response.status === 429);
-      if (!transient) return response;
-      lastResponse = response;
-    } catch (error) {
-      lastError = error;
-    }
-    if (attempt < attempts) {
-      await new Promise((resolve23) => setTimeout(resolve23, Math.min(8e3, 500 * 2 ** (attempt - 1))));
-    }
-  }
-  if (lastResponse) return lastResponse;
-  throw lastError instanceof Error ? lastError : new Error(String(lastError));
-}
 
 // src/cli/commands/deploy/secrets.ts
 import * as p11 from "@clack/prompts";
@@ -6326,7 +6615,7 @@ function errorMessage5(error) {
 
 // src/cli/commands/deploy/lock.ts
 import { randomUUID as randomUUID2 } from "crypto";
-import { mkdirSync as mkdirSync6, readFileSync as readFileSync18, rmSync as rmSync4, writeFileSync as writeFileSync5 } from "fs";
+import { mkdirSync as mkdirSync6, readFileSync as readFileSync17, rmSync as rmSync4, writeFileSync as writeFileSync5 } from "fs";
 import { dirname as dirname8, join as join19 } from "path";
 function deployLockPath(appDir) {
   return join19(appDir, ".deepspace", "deploy.lock");
@@ -6361,7 +6650,7 @@ function acquireDeployLock(appDir) {
 }
 function readLock(path) {
   try {
-    const parsed = JSON.parse(readFileSync18(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync17(path, "utf-8"));
     return typeof parsed.pid === "number" && typeof parsed.startedAt === "string" && typeof parsed.token === "string" ? { pid: parsed.pid, startedAt: parsed.startedAt, token: parsed.token } : null;
   } catch {
     return null;
@@ -6370,6 +6659,8 @@ function readLock(path) {
 
 // src/cli/commands/deploy.ts
 var DEPLOY_URL3 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
+var DEPLOY_TOKEN_MIN_VALIDITY_MS = 10 * 60 * 1e3;
+var POST_DEPLOY_TOKEN_MIN_VALIDITY_MS = 2 * 60 * 1e3;
 var deploy_default = defineCommand3({
   meta: {
     name: "deploy",
@@ -6544,11 +6835,12 @@ async function runLockedDeploy(args, output, appDir, envName) {
     spinner2.stop("Deploy failed");
     output.die(oversized, "assets_too_large");
   }
+  const { token: deployToken } = await authenticate(appDir, output, DEPLOY_TOKEN_MIN_VALIDITY_MS);
   const repository = await syncDeployRepository({
     deployUrl: DEPLOY_URL3,
     appDir,
     appId,
-    token,
+    token: deployToken,
     push: args.push !== false,
     ignoreStale: Boolean(args["ignore-stale"]),
     output,
@@ -6565,7 +6857,8 @@ async function runLockedDeploy(args, output, appDir, envName) {
     appDir,
     appId,
     appName,
-    token,
+    token: deployToken,
+    refreshToken: refreshTokenFromSession,
     rename: confirmRename,
     claimReleased: args["claim-released"] === true,
     ignoreStale: Boolean(args["ignore-stale"]),
@@ -6597,7 +6890,7 @@ async function runLockedDeploy(args, output, appDir, envName) {
         serving === "unconfirmed" ? "Some requests still get the previous release. Cloudflare rolls a version out per edge machine; it usually settles within a couple of minutes. Wait before asserting against it." : "This release carries no serving stamp (older platform, or a resumed deploy), so the CLI cannot tell which release the edge answers with."
       );
       p12.log.info(`URL: ${body.url}`);
-      await syncCommerce(appDir, appId, token, output.nonInteractive);
+      await syncPostDeployCommerce(appDir, appId, output.nonInteractive);
       if (output.json) {
         return output.emitJson({
           ok: true,
@@ -6621,7 +6914,7 @@ async function runLockedDeploy(args, output, appDir, envName) {
     `Deployed! (edge confirmed in ${Math.round((Date.now() - edgeWaitStarted) / 1e3)}s)`
   );
   p12.log.success(`Live at: ${body.url}`);
-  await syncCommerce(appDir, appId, token, output.nonInteractive);
+  await syncPostDeployCommerce(appDir, appId, output.nonInteractive);
   if (output.json) {
     return output.emitJson({
       ok: true,
@@ -6645,6 +6938,14 @@ async function syncCommerce(appDir, appId, token, nonInteractive) {
   await syncSubscriptionPlans(appDir, appId, token, nonInteractive);
   await syncOneTimeProducts(appDir, appId, token);
 }
+async function syncPostDeployCommerce(appDir, appId, nonInteractive) {
+  try {
+    const token = await ensureToken({ minimumValidityMs: POST_DEPLOY_TOKEN_MIN_VALIDITY_MS });
+    await syncCommerce(appDir, appId, token, nonInteractive);
+  } catch (error) {
+    p12.log.warn(`Deployed successfully, but commerce sync was skipped: ${errorMessage6(error)}`);
+  }
+}
 function ownerJwtMissingRefusal(state) {
   if (state.onBehalf?.ownerJwtLive !== false) return null;
   return {
@@ -6691,11 +6992,12 @@ function forbiddenDeployMessage(appId, token) {
   const grant = email ? `run \`deepspace app collaborators add ${email}\`` : "add your email as a collaborator";
   return `${appId} belongs to another account \u2014 you are signed in as ${who}, who is neither its owner nor a collaborator. Ask the owner to ${grant} (collaborators can deploy), or log in as the owner; to publish this code as your OWN app instead, run \`deepspace app init --new-id\`.`;
 }
-async function authenticate(appDir, output) {
+async function authenticate(appDir, output, minimumValidityMs) {
   try {
-    const token = await ensureToken();
+    const token = await ensureToken({ minimumValidityMs });
     return { token, ownerId: decodeJwtPayload(token).sub };
   } catch (error) {
+    if (errorCode(error) !== "not_authenticated") throw error;
     output.die(errorMessage6(error), "not_authenticated", {
       action: { cwd: appDir, argv: ["deepspace", "auth", "login"] }
     });
@@ -7105,7 +7407,12 @@ var logs_default = defineCommand4({
       throw new Refusal(
         `${appId} has never been deployed, so it has no logs. Deploy it first (\`deepspace deploy\`), then read its logs.`,
         "app_not_deployed",
-        appDir ? { action: { cwd: appDir, argv: ["deepspace", "deploy", ...envArg ? ["--env", envArg] : []] } } : {}
+        appDir ? {
+          action: {
+            cwd: appDir,
+            argv: ["deepspace", "deploy", ...envArg ? ["--env", envArg] : []]
+          }
+        } : {}
       );
     }
     const MAX_LIMIT = 500;
@@ -7115,12 +7422,8 @@ var logs_default = defineCommand4({
       if (pageLimit !== void 0) params.set("limit", String(pageLimit));
       if (args.level) params.set("level", args.level);
       if (args.search) params.set("search", args.search);
-      return apiFetch(
-        DEPLOY_URL6,
-        token2,
-        `/api/apps/${appId}/logs?${params}`,
-        signal ? { signal } : void 0
-      );
+      const path = `/api/apps/${appId}/logs?${params}`;
+      return signal ? apiFetch(DEPLOY_URL6, token2, path, { signal }) : apiFetchReadWithRetry(DEPLOY_URL6, token2, path);
     };
     const print = (events) => {
       for (const e of events) {
@@ -7303,7 +7606,7 @@ var usage_default = defineDeepspaceCommand({
 });
 
 // src/cli/commands/add.ts
-import { existsSync as existsSync20, readFileSync as readFileSync20, realpathSync as realpathSync4 } from "fs";
+import { existsSync as existsSync20, readFileSync as readFileSync19, realpathSync as realpathSync4 } from "fs";
 import { dirname as dirname10, join as join22, resolve as resolve17 } from "path";
 import { pathToFileURL as pathToFileURL3 } from "url";
 
@@ -7316,7 +7619,7 @@ import {
   mkdirSync as mkdirSync7,
   mkdtempSync,
   openSync,
-  readFileSync as readFileSync19,
+  readFileSync as readFileSync18,
   readSync,
   readdirSync as readdirSync7,
   rmSync as rmSync5,
@@ -7324,7 +7627,7 @@ import {
 } from "fs";
 import { spawnSync as spawnSync6 } from "child_process";
 import { tmpdir as tmpdir2 } from "os";
-import { dirname as dirname9, isAbsolute as isAbsolute4, join as join21, resolve as resolve16 } from "path";
+import { dirname as dirname9, isAbsolute as isAbsolute5, join as join21, resolve as resolve16 } from "path";
 import { fileURLToPath } from "url";
 var NAV_MARKER = "// \u2500\u2500 Features add nav items below this line \u2500\u2500";
 function featurePackageRoot(moduleUrl = import.meta.url) {
@@ -7333,7 +7636,7 @@ function featurePackageRoot(moduleUrl = import.meta.url) {
     const packagePath = join21(dir, "package.json");
     if (existsSync19(packagePath)) {
       try {
-        const pkg2 = JSON.parse(readFileSync19(packagePath, "utf-8"));
+        const pkg2 = JSON.parse(readFileSync18(packagePath, "utf-8"));
         if (pkg2.name === "deepspace") return dir;
       } catch {
       }
@@ -7350,7 +7653,7 @@ function readFeatureConfig(id, packageRoot = featurePackageRoot()) {
   const configPath = join21(packageRoot, "features", id, "feature.json");
   if (!existsSync19(configPath)) return null;
   try {
-    const config = JSON.parse(readFileSync19(configPath, "utf-8"));
+    const config = JSON.parse(readFileSync18(configPath, "utf-8"));
     if (typeof config.id !== "string" || typeof config.name !== "string" || !Array.isArray(config.files)) {
       return null;
     }
@@ -7399,7 +7702,7 @@ function suggestFeature(featureId, packageRoot = featurePackageRoot()) {
   return closest !== null && closestDistance <= threshold ? closest : null;
 }
 function resolveTargetDir(raw) {
-  return isAbsolute4(raw) ? raw : resolve16(raw);
+  return isAbsolute5(raw) ? raw : resolve16(raw);
 }
 function resolveFeatureDestPath(fileDest, route) {
   const pages = "src/pages/";
@@ -7415,7 +7718,7 @@ function copyFile(src, dest) {
 function copyFileWithImportShift(src, dest, levels) {
   mkdirSync7(dirname9(dest), { recursive: true });
   const prefix = "../".repeat(levels);
-  const shifted = readFileSync19(src, "utf-8").replace(
+  const shifted = readFileSync18(src, "utf-8").replace(
     /(from\s+|import\s+|import\()(['"])(\.\.\/)/g,
     `$1$2${prefix}$3`
   );
@@ -7474,7 +7777,7 @@ function integrateSchema(config, targetDir, emit) {
   if (!existsSync19(schemasPath)) {
     return [unresolvedSchema(config.schema, "src/schemas.ts was not found.", emit)];
   }
-  let content = readFileSync19(schemasPath, "utf-8");
+  let content = readFileSync18(schemasPath, "utf-8");
   const { exportName, importPath, spreadOperator } = config.schema;
   const importPattern = new RegExp(`^import\\s+\\{[^}]*\\b${exportName}\\b`, "m");
   if (importPattern.test(content)) {
@@ -7531,7 +7834,7 @@ function integrateActions(config, targetDir, emit) {
   if (!existsSync19(actionsPath)) {
     return [unresolvedActions(config.actions, "src/actions/index.ts was not found.", emit)];
   }
-  let content = readFileSync19(actionsPath, "utf-8");
+  let content = readFileSync18(actionsPath, "utf-8");
   const registryPattern = /export const actions:\s*Record<string,\s*ActionHandler(?:<[^>]*>)?>\s*=\s*\{/;
   if (!registryPattern.test(content)) {
     const reason = "src/actions/index.ts has an unexpected structure.";
@@ -7586,7 +7889,7 @@ function integrateCode(config, targetDir, emit) {
       });
       continue;
     }
-    const original = readFileSync19(targetPath, "utf-8");
+    const original = readFileSync18(targetPath, "utf-8");
     if (original.includes(insertion.insert.trim())) {
       emit(`   Integration already present: ${insertion.file}`);
       continue;
@@ -7624,7 +7927,7 @@ ${content.slice(
 function integrateIgnore(config, targetDir) {
   if (!config.ignore?.length) return;
   const targetPath = join21(targetDir, ".gitignore");
-  const current = existsSync19(targetPath) ? readFileSync19(targetPath, "utf-8") : "";
+  const current = existsSync19(targetPath) ? readFileSync18(targetPath, "utf-8") : "";
   const present = new Set(current.split(/\r?\n/).map((line) => line.trim()));
   const missing = config.ignore.filter((pattern) => !present.has(pattern));
   if (missing.length === 0) return;
@@ -7644,7 +7947,7 @@ function integrateWrangler(config, targetDir, emit) {
   if (!existsSync19(targetPath)) {
     return [{ area: "wrangler", reason: "wrangler.toml was not found.", steps }];
   }
-  let source = readFileSync19(targetPath, "utf-8");
+  let source = readFileSync18(targetPath, "utf-8");
   if (runWorkerFirst && !/^\[assets\]\s*$/m.test(source)) {
     return [{ area: "wrangler", reason: "wrangler.toml has no [assets] section.", steps }];
   }
@@ -7733,7 +8036,7 @@ function integrateCss(packageRoot, config, targetDir, emit) {
       }
     ];
   }
-  let styles = readFileSync19(stylesPath, "utf-8");
+  let styles = readFileSync18(stylesPath, "utf-8");
   let integrated = 0;
   const unresolved = [];
   for (const cssFile of config.css) {
@@ -7747,7 +8050,7 @@ function integrateCss(packageRoot, config, targetDir, emit) {
       });
       continue;
     }
-    const css = readFileSync19(srcPath, "utf-8");
+    const css = readFileSync18(srcPath, "utf-8");
     const fingerprint = css.match(/\.([\w-]+)\s*\{|@keyframes\s+([\w-]+)/);
     const marker = fingerprint?.[1] ?? fingerprint?.[2];
     if (marker && styles.includes(marker)) {
@@ -7785,7 +8088,7 @@ function integrateRoute(config, targetDir, emit) {
   if (!existsSync19(navPath)) {
     return [unresolvedRoute(config.route, config, "src/nav.ts was not found.", emit)];
   }
-  let content = readFileSync19(navPath, "utf-8");
+  let content = readFileSync18(navPath, "utf-8");
   const routePath = config.route.path;
   if (content.includes(`'${routePath}'`)) {
     emit(`   Nav already present: ${routePath}`);
@@ -7866,7 +8169,7 @@ function integrateDependencies(config, targetDir, runInstall, outputVisible, emi
   }
   let pkg2;
   try {
-    pkg2 = JSON.parse(readFileSync19(packagePath, "utf-8"));
+    pkg2 = JSON.parse(readFileSync18(packagePath, "utf-8"));
   } catch (error) {
     emit(
       `   Could not patch package.json (parse error: ${error instanceof Error ? error.message : String(error)})`
@@ -7926,7 +8229,7 @@ ${child.diagnosticTail}` : "";
 }
 function dependencySnapshot(targetDir) {
   try {
-    const pkg2 = JSON.parse(readFileSync19(join21(targetDir, "package.json"), "utf-8"));
+    const pkg2 = JSON.parse(readFileSync18(join21(targetDir, "package.json"), "utf-8"));
     return {
       dependencies: pkg2.dependencies ?? {},
       devDependencies: pkg2.devDependencies ?? {}
@@ -8175,7 +8478,7 @@ function isDeepSpaceApp(dir) {
   const packagePath = join22(dir, "package.json");
   if (!existsSync20(packagePath)) return false;
   try {
-    const pkg2 = JSON.parse(readFileSync20(packagePath, "utf-8"));
+    const pkg2 = JSON.parse(readFileSync19(packagePath, "utf-8"));
     return Boolean(pkg2.dependencies?.deepspace || pkg2.devDependencies?.deepspace);
   } catch {
     return false;
@@ -9455,7 +9758,7 @@ var transfer_default = defineCommand8({
 import { defineCommand as defineCommand9 } from "citty";
 
 // src/cli/commands/_invoke-impl.ts
-import { readFileSync as readFileSync21 } from "fs";
+import { readFileSync as readFileSync20 } from "fs";
 import * as p15 from "@clack/prompts";
 var API_URL7 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
 var DEFAULT_TIMEOUT_MS = 12e4;
@@ -9488,7 +9791,7 @@ function parseTimeout(raw) {
   }
   return timeout;
 }
-function resolveBody(opts) {
+async function resolveBody(opts) {
   if (opts.body != null && opts.bodyFile != null) {
     throw new Refusal("Pass either --body or --body-file, not both.", "conflicting_body_args");
   }
@@ -9496,7 +9799,19 @@ function resolveBody(opts) {
   if (opts.body != null) {
     raw = opts.body;
   } else if (opts.bodyFile != null) {
-    raw = opts.bodyFile === "-" ? readFileSync21(0, "utf-8") : readFileSync21(opts.bodyFile, "utf-8");
+    if (opts.bodyFile === "-" && process.stdin.isTTY) {
+      throw new Refusal(
+        'Reading the body from stdin ("-"), but stdin is a terminal \u2014 pipe JSON in, or pass --body / a file path.',
+        "no_stdin"
+      );
+    }
+    raw = opts.bodyFile === "-" ? await readStreamText(process.stdin) : readFileSync20(opts.bodyFile, "utf-8");
+    if (opts.bodyFile === "-" && raw.trim() === "") {
+      throw new Refusal(
+        "Nothing arrived on stdin \u2014 check the command feeding this one, or pass --body / a file path.",
+        "empty_input"
+      );
+    }
   } else {
     return "{}";
   }
@@ -9642,7 +9957,7 @@ async function runInfo(args) {
 }
 async function runInvoke(args) {
   const { integration, endpoint } = parseTarget(args.target);
-  const body = resolveBody({ body: args.body, bodyFile: args.bodyFile });
+  const body = await resolveBody({ body: args.body, bodyFile: args.bodyFile });
   const timeoutMs = args.timeout ?? DEFAULT_TIMEOUT_MS;
   if (!args.yes) {
     const info2 = requireEndpoint(await fetchCatalog({ summary: true }), integration, endpoint);
@@ -9822,7 +10137,7 @@ var integrations_default = defineCommand9({
 
 // src/cli/commands/feedback.ts
 import * as p16 from "@clack/prompts";
-import { existsSync as existsSync22, readFileSync as readFileSync22 } from "fs";
+import { existsSync as existsSync22, readFileSync as readFileSync21 } from "fs";
 import { dirname as dirname11, join as join23 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { release } from "os";
@@ -9851,7 +10166,7 @@ function readCliVersion() {
     ];
     for (const path of candidates) {
       if (!existsSync22(path)) continue;
-      const pkg2 = JSON.parse(readFileSync22(path, "utf-8"));
+      const pkg2 = JSON.parse(readFileSync21(path, "utf-8"));
       if (pkg2.name === "deepspace" && pkg2.version) return pkg2.version;
     }
   } catch {
@@ -10047,7 +10362,7 @@ Context: deepspace ${payload.cliVersion} \xB7 ${payload.nodeVersion} \xB7 ${payl
 
 // src/cli/commands/secrets.ts
 import { defineCommand as defineCommand10 } from "citty";
-import { readFileSync as readFileSync23 } from "fs";
+import { readFileSync as readFileSync22 } from "fs";
 
 // src/cli/lib/citty-args.ts
 function dedupePositionals(bound, rest) {
@@ -10261,20 +10576,25 @@ var del2 = defineCommand10({
       for (const key of keys) {
         const name = validateSecretName(key);
         try {
-          await deleteSecret(DEPLOY_URL11, t.token, t.appId, t.configName, name);
-          deleted++;
+          const result = await deleteSecret(DEPLOY_URL11, t.token, t.appId, t.configName, name);
+          if (result.deleted === false) absent++;
+          else deleted++;
         } catch (err) {
           if (err?.status === 404) absent++;
           else throw err;
         }
       }
       const note3 = absent > 0 ? ` (${absent} already absent)` : "";
-      ok(args.json === true, { appId: t.appId, config: t.configName, deleted, absent, ...APPLIES_AT_DEPLOY }, () => {
-        console.log(
-          `Deleted ${deleted} secret${deleted === 1 ? "" : "s"} from ${t.configName}.${note3}`
-        );
-        if (deleted > 0) console.log(APPLY_HINT);
-      });
+      ok(
+        args.json === true,
+        { appId: t.appId, config: t.configName, deleted, absent, ...APPLIES_AT_DEPLOY },
+        () => {
+          console.log(
+            `Deleted ${deleted} secret${deleted === 1 ? "" : "s"} from ${t.configName}.${note3}`
+          );
+          if (deleted > 0) console.log(APPLY_HINT);
+        }
+      );
     } catch (err) {
       fail(err);
     }
@@ -10298,14 +10618,20 @@ var upload = defineCommand10({
   async run({ args }) {
     try {
       const t = await resolveTarget(args);
-      const secrets = parseSecretsUpload(readUploadSource(args.file));
+      const secrets = parseSecretsUpload(await readUploadSource(args.file));
       if (Object.keys(secrets).length === 0)
         throw new InputError("No secrets found in the input.", "empty_input");
       await uploadSecrets(DEPLOY_URL11, t.token, t.appId, t.configName, secrets, args.replace);
       const uploaded = Object.keys(secrets);
       ok(
         args.json === true,
-        { appId: t.appId, config: t.configName, uploaded, replaced: args.replace === true, ...APPLIES_AT_DEPLOY },
+        {
+          appId: t.appId,
+          config: t.configName,
+          uploaded,
+          replaced: args.replace === true,
+          ...APPLIES_AT_DEPLOY
+        },
         () => {
           console.log(`Uploaded ${uploaded.length} secrets to ${t.configName}.`);
           if (!warnIfDebugRoutesEnabled(secrets)) console.log(APPLY_HINT);
@@ -10316,10 +10642,18 @@ var upload = defineCommand10({
     }
   }
 });
-function readUploadSource(file) {
-  if (file === "-") return readFileSync23(0, "utf-8");
+async function readUploadSource(file) {
+  if (file === "-") {
+    if (process.stdin.isTTY) {
+      throw new InputError(
+        'Reading secrets from stdin ("-"), but stdin is a terminal \u2014 pipe dotenv or JSON input, or pass a file path.',
+        "no_stdin"
+      );
+    }
+    return readStreamText(process.stdin, MAX_STDIN_BYTES);
+  }
   try {
-    return readFileSync23(file, "utf-8");
+    return readFileSync22(file, "utf-8");
   } catch (err) {
     if (err.code !== "ENOENT") throw err;
     throw new InputError(
@@ -10656,7 +10990,7 @@ var init_default = defineDeepspaceCommand({
 // src/cli/commands/status.ts
 import { defineCommand as defineCommand11 } from "citty";
 import * as p17 from "@clack/prompts";
-import { existsSync as existsSync24, readFileSync as readFileSync24 } from "fs";
+import { existsSync as existsSync24, readFileSync as readFileSync23 } from "fs";
 function timeAgo(iso) {
   const ms = Date.now() - Date.parse(iso);
   if (!Number.isFinite(ms) || ms < 0) return iso;
@@ -10757,7 +11091,7 @@ var status_default = defineCommand11({
       let who = "logged in";
       try {
         const payload = decodeJwtPayload(
-          readFileSync24(TOKEN_PATH, "utf-8").trim()
+          readFileSync23(TOKEN_PATH, "utf-8").trim()
         );
         if (payload.email) who = payload.email;
         userId = payload.sub ?? null;
@@ -11827,7 +12161,7 @@ import { defineCommand as defineCommand12 } from "citty";
 
 // src/cli/commands/workspace/new.ts
 import * as p25 from "@clack/prompts";
-import { isAbsolute as isAbsolute6, resolve as resolve20 } from "path";
+import { isAbsolute as isAbsolute7, resolve as resolve20 } from "path";
 
 // src/cli/commands/workspace/analysis.ts
 import * as p23 from "@clack/prompts";
@@ -11963,23 +12297,23 @@ import * as p24 from "@clack/prompts";
 import {
   existsSync as existsSync26,
   mkdirSync as mkdirSync8,
-  readFileSync as readFileSync25,
+  readFileSync as readFileSync24,
   realpathSync as realpathSync6,
   renameSync as renameSync2,
   statSync as statSync3,
   writeFileSync as writeFileSync7
 } from "fs";
-import { dirname as dirname12, isAbsolute as isAbsolute5, join as join26, relative as relative3, sep as sep3 } from "path";
+import { dirname as dirname12, isAbsolute as isAbsolute6, join as join26, relative as relative4, sep as sep4 } from "path";
 var WORKSPACE_MARKER = "deepspace-workspace.json";
 function excludeWorktreeDir(appDir, dir) {
   try {
     ensureLocalExclude(appDir, ".deepspace/");
     const realDir = realpathSync6(dir);
-    const rel = relative3(realpathSync6(repoToplevel(appDir)), realDir);
-    if (!rel || rel === ".." || rel.startsWith(`..${sep3}`) || isAbsolute5(rel)) return;
-    const pattern = rel.split(sep3).join("/");
+    const rel = relative4(realpathSync6(repoToplevel(appDir)), realDir);
+    if (!rel || rel === ".." || rel.startsWith(`..${sep4}`) || isAbsolute6(rel)) return;
+    const pattern = rel.split(sep4).join("/");
     if (pattern === ".deepspace" || pattern.startsWith(".deepspace/")) return;
-    const relApp = relative3(realpathSync6(appDir), realDir).split(sep3).join("/");
+    const relApp = relative4(realpathSync6(appDir), realDir).split(sep4).join("/");
     if (relApp === ".deepspace" || relApp.startsWith(".deepspace/")) return;
     ensureLocalExclude(appDir, `/${pattern}/`);
   } catch {
@@ -11990,7 +12324,7 @@ function worktreeMarkerPath(worktreeRoot) {
     const result = runGit(worktreeRoot, ["rev-parse", "--absolute-git-dir"], { allowFail: true });
     if (result.status !== 0) return null;
     const gitDir = result.stdout.toString("utf-8").trim();
-    return isAbsolute5(gitDir) ? join26(gitDir, WORKSPACE_MARKER) : null;
+    return isAbsolute6(gitDir) ? join26(gitDir, WORKSPACE_MARKER) : null;
   } catch {
     return null;
   }
@@ -12026,7 +12360,7 @@ function isManagedWorkspaceWorktree(worktreeRoot, workspaceId) {
   const markerPath = worktreeMarkerPath(worktreeRoot);
   if (!markerPath) return false;
   try {
-    const marker = JSON.parse(readFileSync25(markerPath, "utf-8"));
+    const marker = JSON.parse(readFileSync24(markerPath, "utf-8"));
     return marker.version === 1 && marker.workspaceId === workspaceId && marker.mode === "managed-linked";
   } catch {
     return false;
@@ -12038,7 +12372,7 @@ function defaultWorkspaceRoot(appDir, workspaceId) {
   return join26(primary.path, ".deepspace", "ws", workspaceId.slice(3).toLowerCase());
 }
 function appDirInWorktree(appDir, worktreeRoot) {
-  const appRelative = relative3(realpathSync6(repoToplevel(appDir)), realpathSync6(appDir));
+  const appRelative = relative4(realpathSync6(repoToplevel(appDir)), realpathSync6(appDir));
   return appRelative ? join26(worktreeRoot, appRelative) : worktreeRoot;
 }
 function primaryAppDir(appDir) {
@@ -12459,7 +12793,7 @@ var newWorkspaceCommand = defineDeepspaceCommand({
       idempotencyKey: mintIdempotencyKey()
     });
     const dirInput = typeof args.dir === "string" ? args.dir.trim() : "";
-    const worktreeRoot = dirInput ? isAbsolute6(dirInput) ? dirInput : resolve20(appDir, dirInput) : defaultWorkspaceRoot(appDir, id);
+    const worktreeRoot = dirInput ? isAbsolute7(dirInput) ? dirInput : resolve20(appDir, dirInput) : defaultWorkspaceRoot(appDir, id);
     const dir = appDirInWorktree(appDir, worktreeRoot);
     try {
       materializeWorkspaceWorktree(appDir, worktreeRoot, branch, baseOid, id);
@@ -12498,7 +12832,7 @@ var newWorkspaceCommand = defineDeepspaceCommand({
 // src/cli/commands/workspace/attach.ts
 import * as p26 from "@clack/prompts";
 import { existsSync as existsSync27, readdirSync as readdirSync9, realpathSync as realpathSync7, rmSync as rmSync7 } from "fs";
-import { isAbsolute as isAbsolute7, resolve as resolve21 } from "path";
+import { isAbsolute as isAbsolute8, resolve as resolve21 } from "path";
 function samePath(a, b) {
   const real = (p35) => {
     try {
@@ -12594,7 +12928,7 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
         );
       }
       const requestedDir = typeof args.dir === "string" ? args.dir.trim() : "";
-      const worktreeRoot = requestedDir ? isAbsolute7(requestedDir) ? requestedDir : resolve21(appDir, requestedDir) : defaultWorkspaceRoot(appDir, id);
+      const worktreeRoot = requestedDir ? isAbsolute8(requestedDir) ? requestedDir : resolve21(appDir, requestedDir) : defaultWorkspaceRoot(appDir, id);
       const dir2 = appDirInWorktree(appDir, worktreeRoot);
       const localTip = resolveCommit(appDir, `refs/heads/${branch}`);
       if (localTip) {
@@ -13054,13 +13388,13 @@ import * as p30 from "@clack/prompts";
 
 // src/cli/lib/validation.ts
 import { sync as spawnSync7 } from "cross-spawn";
-import { readFileSync as readFileSync26 } from "fs";
+import { readFileSync as readFileSync25 } from "fs";
 import { join as join27 } from "path";
 var MAX_SUMMARY_CHARS = 4e3;
 var MAX_OUTPUT_BUFFER = 64 * 1024 * 1024;
 function configuredCommand(appDir) {
   try {
-    const pkg2 = JSON.parse(readFileSync26(join27(appDir, "package.json"), "utf-8"));
+    const pkg2 = JSON.parse(readFileSync25(join27(appDir, "package.json"), "utf-8"));
     if (pkg2.scripts?.validate) return `${detectPackageManager(appDir)} run --silent validate`;
   } catch {
   }
@@ -14149,13 +14483,13 @@ function sameRefs(left, right) {
 
 // src/cli/commands/update.ts
 import * as p34 from "@clack/prompts";
-import { existsSync as existsSync28, readFileSync as readFileSync27 } from "fs";
+import { existsSync as existsSync28, readFileSync as readFileSync26 } from "fs";
 import { join as join28, resolve as resolve22 } from "path";
 
 // package.json
 var package_default = {
   name: "deepspace",
-  version: "0.24.0",
+  version: "0.24.1",
   engines: {
     node: ">=22.15.0 <23 || >=24 <25 || >=26 <27"
   },
@@ -14337,7 +14671,7 @@ function readManifest(appDir) {
     throw new Refusal("This app has no package.json \u2014 nothing to update.", "not_in_app_repo");
   }
   try {
-    return JSON.parse(readFileSync27(path, "utf8"));
+    return JSON.parse(readFileSync26(path, "utf8"));
   } catch {
     throw new Refusal("package.json must contain valid JSON.", "invalid_package_manifest");
   }
@@ -14373,7 +14707,7 @@ function usersSchemaVisibilityUpgradeInstruction(appDir) {
   const schemaName = "src/schemas/users-schema.ts";
   const path = join28(appDir, schemaName);
   if (!existsSync28(path)) return null;
-  const source = readFileSync27(path, "utf8");
+  const source = readFileSync26(path, "utf8");
   if (!/\bmember\s*:\s*\{[^}]*\bread\s*:\s*true\b/s.test(source)) return null;
   return `${schemaName}: review member user-row visibility at ${USERS_SCHEMA_VISIBILITY_GUIDE}; leave the app-owned schema unchanged until you choose its policy.`;
 }
@@ -14469,7 +14803,7 @@ var update_default = defineDeepspaceCommand({
 
 // src/cli/cli.ts
 var __dirname = dirname13(fileURLToPath3(import.meta.url));
-var pkg = JSON.parse(readFileSync28(join29(__dirname, "..", "package.json"), "utf-8"));
+var pkg = JSON.parse(readFileSync27(join29(__dirname, "..", "package.json"), "utf-8"));
 if (process.platform === "linux" && !process.env.SSL_CERT_FILE && existsSync29("/etc/ssl/certs/ca-certificates.crt")) {
   process.env.SSL_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt";
 }