deepspace 0.25.0 → 0.26.1

package/dist/cli.js

@@ -7,7 +7,7 @@ import {
   runCommand,
   renderUsage
 } from "citty";
-import { sync as spawnSync8 } from "cross-spawn";
+import { sync as spawnSync9 } from "cross-spawn";
 import { readFileSync as readFileSync27, existsSync as existsSync30 } from "fs";
 import { dirname as dirname13, join as join29 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
@@ -46,8 +46,12 @@ function displayLines(value) {
 
 // src/cli/lib/spinner.ts
 var activeSpinner = null;
+var plainProgress = false;
+function setPlainProgress(enabled) {
+  plainProgress = enabled;
+}
 function createSpinner() {
-  const impl = process.stdout.isTTY ? p.spinner() : {
+  const impl = !plainProgress && process.stdout.isTTY ? p.spinner() : {
     start: (msg) => {
       if (msg) console.log(msg);
     },
@@ -366,7 +370,9 @@ function errorCode(err) {
   return void 0;
 }
 var API_ERROR_HINTS = {
-  not_app_owner: "Only the app owner can do this.",
+  // Starts where the server sentence ("Only the app owner can do this.")
+  // stops, so the two read as one message instead of a stutter.
+  not_app_owner: "Collaborators can deploy and manage secrets, but ownership verbs (collaborators, transfer, undeploy) stay with the owner. Ask them to run it, have them transfer the app (`deepspace app transfer offer`), or fork your checkout as your own app (`deepspace app init --new-id`).",
   app_not_found: "App not found on the service this command asked. Check the app id \u2014 the DEEPSPACE_APP_ID value in wrangler.toml, usually `app_\u2026` (a legacy app's id is its name); list your apps with `deepspace app list`. If you are overriding DEEPSPACE_DEPLOY_URL (staging), note that account/collaborator commands go to the PLATFORM API \u2014 an app registered only on a staging deploy service is unknown there. (`domain` commands take the deployed app *name* instead.)",
   not_app_owner_or_collaborator: "You must be the app owner or a collaborator to do this.",
   test_account_cannot_be_collaborator: "Test accounts cannot be added as collaborators. Use a real DeepSpace account.",
@@ -591,13 +597,16 @@ function findUnknownCommand(argv, rootCommands) {
       const exactAll = commandPaths(table).filter((path) => path.at(-1) === token);
       const exactHit = exactAll.length === 1 ? exactAll[0] : null;
       const split = splitTokenPath(token, table);
-      const relativeSuggestion = exactHit ?? split ?? closestCommandPath(token, table);
-      if (!relativeSuggestion) return null;
-      const guessed = relativeSuggestion.at(-1) ?? "";
+      const rootExactAll = exactHit || split ? [] : commandPaths(rootCommands).filter((path) => path.at(-1) === token);
+      const rootExact = rootExactAll.length === 1 ? rootExactAll[0] : null;
+      const relativeSuggestion = exactHit ?? split ?? (rootExact ? null : closestCommandPath(token, table));
+      const suggestionPath = relativeSuggestion ? [...accepted, ...relativeSuggestion] : rootExact;
+      if (!suggestionPath) return null;
+      const guessed = suggestionPath.at(-1) ?? "";
       return {
         attemptedPath: ["deepspace", ...accepted, token],
         helpPath: ["deepspace", ...accepted],
-        suggestion: ["deepspace", ...accepted, ...relativeSuggestion],
+        suggestion: ["deepspace", ...suggestionPath],
         executable: split !== null && !DESTRUCTIVE_VERBS.has(guessed),
         // POSITIONALS ONLY. The remainder exists so the corrected verb keeps
         // the arguments it needs; carrying flags too meant `auth logn --email
@@ -1120,6 +1129,10 @@ var logout_default = defineDeepspaceCommand({
   }
 });
 
+// src/cli/lib/app-registration.ts
+import { existsSync as existsSync7, mkdirSync as mkdirSync3, rmSync as rmSync3, statSync } from "fs";
+import { join as join4 } from "path";
+
 // src/cli/lib/app-identity.ts
 import { existsSync as existsSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
 import { join as join3, resolve as resolve2 } from "path";
@@ -1459,55 +1472,9 @@ ${line}
   writeFileSync3(wranglerPath, src);
 }
 
-// src/cli/commands/dev.ts
-import { resolve as resolve8, basename as basename2, join as join11 } from "path";
-import spawn2 from "cross-spawn";
-
-// src/cli/lib/app-context.ts
-import { existsSync as existsSync5, readdirSync } from "fs";
-import { dirname as dirname3, join as join4, resolve as resolve3 } from "path";
-function detectAppName(cwd = process.cwd()) {
-  const appDir = resolve3(cwd);
-  if (!existsSync5(join4(appDir, "wrangler.toml"))) return null;
-  const { name } = readWranglerConfig(appDir);
-  return typeof name === "string" && name.length > 0 ? name : null;
-}
-function findAppDir(start = process.cwd()) {
-  let dir = resolve3(start);
-  for (; ; ) {
-    if (existsSync5(join4(dir, "wrangler.toml"))) return dir;
-    const parent = dirname3(dir);
-    if (parent === dir) return null;
-    dir = parent;
-  }
-}
-function findChildApps(dir) {
-  try {
-    return readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && existsSync5(join4(dir, entry.name, "wrangler.toml"))).map((entry) => entry.name).sort();
-  } catch {
-    return [];
-  }
-}
-
-// src/cli/lib/launch-config.ts
-import {
-  existsSync as existsSync8,
-  readFileSync as readFileSync7,
-  realpathSync as realpathSync2,
-  writeFileSync as writeFileSync4,
-  mkdirSync as mkdirSync4,
-  renameSync,
-  unlinkSync
-} from "fs";
-import { join as join6, resolve as resolve5, dirname as dirname5, basename, isAbsolute as isAbsolute2, sep } from "path";
-
-// src/cli/lib/git/repository.ts
-import { appendFileSync, existsSync as existsSync7, mkdirSync as mkdirSync3, readFileSync as readFileSync6 } from "fs";
-import { dirname as dirname4, join as join5, resolve as resolve4 } from "path";
-
 // src/cli/lib/git/process.ts
 import { sync as spawnSync } from "cross-spawn";
-import { existsSync as existsSync6 } from "fs";
+import { existsSync as existsSync5 } from "fs";
 var MAX_GIT_BUFFER = 512 * 1024 * 1024;
 var GIT_TIMEOUT_MS = 3e5;
 var GitError = class extends Error {
@@ -1545,7 +1512,7 @@ function runGit(cwd, args, opts = {}) {
   if (result.error) {
     const code = result.error.code;
     if (code === "ENOENT" || code === "ENOTDIR") {
-      if (code === "ENOTDIR" || !existsSync6(cwd)) {
+      if (code === "ENOTDIR" || !existsSync5(cwd)) {
         throw new GitError(
           `The directory this command runs in is not there: ${cwd}. If it was a workspace worktree, prune it (\`git worktree prune\`) and re-attach.`,
           "worktree_missing"
@@ -1594,7 +1561,323 @@ function gitMeetsFloor(version) {
   return major > 2 || major === 2 && minor >= 29;
 }
 
+// src/cli/lib/vc-remote.ts
+import { existsSync as existsSync6 } from "fs";
+import { tmpdir } from "os";
+import { isAbsolute as isAbsolute2, relative, resolve as resolve3 } from "path";
+function spaceRemoteName(environment = DEEPSPACE_ENV) {
+  if (environment === "staging") return "space-staging";
+  if (environment === "production") return "space";
+  return "space-invalid";
+}
+var SPACE_REMOTE = spaceRemoteName();
+function spaceTrackingRef(branch, remote = SPACE_REMOTE) {
+  return `refs/remotes/${remote}/${branch}`;
+}
+function spacePrivateRef(path, environment = DEEPSPACE_ENV) {
+  const root = environment === "production" ? "refs/deepspace" : `refs/deepspace/${environment}`;
+  return `${root}/${path}`;
+}
+function deployBaseUrl() {
+  return process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
+}
+function repoUrl(appId, base = deployBaseUrl()) {
+  return `${base.replace(/\/+$/, "")}/api/repo/${encodeURIComponent(appId)}`;
+}
+function gitAuthEnv(token, base = deployBaseUrl()) {
+  const existing = Number(process.env.GIT_CONFIG_COUNT ?? "0");
+  const index = Number.isInteger(existing) && existing > 0 ? existing : 0;
+  return {
+    GIT_CONFIG_COUNT: String(index + 1),
+    [`GIT_CONFIG_KEY_${index}`]: `http.${base.replace(/\/+$/, "")}.extraHeader`,
+    [`GIT_CONFIG_VALUE_${index}`]: `Authorization: Bearer ${token}`
+  };
+}
+function runGitRemote(cwd, token, args, opts = {}) {
+  return runGit(cwd, args, { ...opts, env: { ...gitAuthEnv(token), ...opts.env ?? {} } });
+}
+function entryIsTransient(cwd) {
+  const entry = process.argv[1];
+  if (!entry) return true;
+  if (/[\\/]_npx[\\/]/.test(entry) || entry.startsWith(tmpdir())) return true;
+  const rel = relative(resolve3(cwd), resolve3(entry));
+  return rel === "" || !rel.startsWith("..") && !isAbsolute2(rel);
+}
+function helperEntryUsable(command) {
+  const match = /^!(?:DEEPSPACE_ENV=(production|staging) )?'([^']*)' '([^']*)' git-credential$/.exec(command);
+  const expectedEnvironment = DEEPSPACE_ENV === "production" ? void 0 : DEEPSPACE_ENV;
+  if (!match || match[1] !== expectedEnvironment) return false;
+  return existsSync6(match[2]) && existsSync6(match[3]);
+}
+function credentialHelperCommand(environment = DEEPSPACE_ENV) {
+  const entry = process.argv[1];
+  if (!entry) throw new Error("CLI entry path is unavailable");
+  const environmentPrefix = environment === "staging" ? "DEEPSPACE_ENV=staging " : "";
+  return `!${environmentPrefix}${shQuote(process.execPath)} ${shQuote(entry)} git-credential`;
+}
+function installCredentialHelper(cwd, url) {
+  try {
+    const origin = new URL(url);
+    const key = `credential.${origin.protocol}//${origin.host}.helper`;
+    const helper = credentialHelperCommand();
+    const wanted = ["", helper];
+    const transient = entryIsTransient(cwd);
+    const scope = transient ? "--worktree" : "--global";
+    if (transient) {
+      const enabled = runGit(cwd, ["config", "--local", "extensions.worktreeConfig", "true"], {
+        allowFail: true
+      });
+      if (enabled.status !== 0) return;
+      runGit(cwd, ["config", "--local", "--unset-all", key], { allowFail: true });
+    }
+    const current = runGit(cwd, ["config", scope, "--get-all", key], { allowFail: true });
+    if (current.status === 0) {
+      const existing = current.stdout.toString("utf-8").split("\n").filter((_, index, lines) => index < lines.length - 1);
+      if (existing.length === wanted.length && existing.every((value, i) => value === wanted[i])) {
+        return;
+      }
+      if (existing.length === wanted.length && existing[0] === "" && helperEntryUsable(existing[1])) {
+        return;
+      }
+      runGit(cwd, ["config", scope, "--unset-all", key], { allowFail: true });
+    }
+    runGit(cwd, ["config", scope, "--add", key, ""]);
+    runGit(cwd, ["config", scope, "--add", key, helper]);
+    if (scope === "--global" && !process.argv.includes("--json")) {
+      process.stderr.write(
+        `note: added a git credential helper for ${origin.host} to your global git config so plain \`git clone\`/\`git push\` to DeepSpace authenticate. Undo with: git config --global --unset-all ${key}
+`
+      );
+    }
+  } catch {
+  }
+}
+function ensureSpaceRemote(cwd, appId, remote = SPACE_REMOTE, token) {
+  const url = repoUrl(appId);
+  const current = runGit(cwd, ["remote", "get-url", remote], { allowFail: true });
+  const existing = current.status === 0 ? current.stdout.toString("utf-8").trim() : null;
+  if (appIdFromRepoUrl(existing ?? "") !== appId) {
+    const owned = declaredAppIds(cwd);
+    if (owned.size > 0 && !owned.has(appId)) {
+      throw new InputError(
+        `This checkout declares ${[...owned].join(", ")}, but this command targets ${appId}. Pointing its \`${remote}\` remote at another app would send every later plain \`git push ${remote}\` to the wrong repo. Work on ${appId} from its own checkout (\`deepspace clone ${appId}\` into a new directory), or fork THIS checkout into a brand-new app of your own with \`deepspace app init --new-id\`.`,
+        "app_checkout_mismatch"
+      );
+    }
+  }
+  if (token) ensureGitIdentity(cwd, token);
+  if (existing === null) {
+    runGit(cwd, ["remote", "add", remote, url]);
+  } else if (existing !== url) {
+    const priorApp = appIdFromRepoUrl(existing);
+    if (priorApp && priorApp !== appId && !process.argv.includes("--json")) {
+      process.stderr.write(
+        `warning: remote '${remote}' was pointed at app ${priorApp}; re-aiming it at ${appId}.
+`
+      );
+    }
+    runGit(cwd, ["remote", "set-url", remote, url]);
+  }
+  installCredentialHelper(cwd, url);
+  return url;
+}
+function removeSpaceRemote(cwd, remote = SPACE_REMOTE) {
+  const current = runGit(cwd, ["remote", "get-url", remote], { allowFail: true });
+  if (current.status !== 0) return false;
+  runGit(cwd, ["remote", "remove", remote]);
+  return true;
+}
+function ensureGitIdentity(cwd, token) {
+  try {
+    const configured = (key) => runGit(cwd, ["config", "--get", key], { allowFail: true }).stdout.toString("utf-8").trim() !== "";
+    const missingName = !configured("user.name");
+    const missingEmail = !configured("user.email");
+    if (!missingName && !missingEmail) return;
+    if (runGit(cwd, ["config", "--get", "--type=bool", "user.useConfigOnly"], { allowFail: true }).stdout.toString("utf-8").trim() === "true") {
+      return;
+    }
+    const payload = decodeJwtPayload(token);
+    if (!payload.email) return;
+    if (missingName) {
+      runGit(cwd, ["config", "--local", "user.name", payload.name || payload.email], {
+        allowFail: true
+      });
+    }
+    if (missingEmail) {
+      runGit(cwd, ["config", "--local", "user.email", payload.email], { allowFail: true });
+    }
+    const wrote = [...missingEmail ? ["user.email"] : [], ...missingName ? ["user.name"] : []];
+    const dir = /^[A-Za-z0-9_./:@-]+$/.test(cwd) ? cwd : shQuote(cwd);
+    const undo = wrote.map((key) => `git -C ${dir} config --local --unset ${key}`).join(" && ");
+    process.stderr.write(
+      `Git identity for this checkout set from your DeepSpace login (${payload.email}).
+  Undo with: ${undo}
+`
+    );
+  } catch {
+  }
+}
+function appIdFromRepoUrl(url) {
+  const match = /\/api\/repo\/([^/]+)\/?$/.exec(url);
+  return match ? decodeURIComponent(match[1]) : null;
+}
+
+// src/cli/lib/app-registration.ts
+var DEPLOY_URL = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
+async function mintAppIdentity(appDir, token, opts = {}) {
+  const { appId } = await apiFetch(DEPLOY_URL, token, "/api/apps/mint", {
+    method: "POST"
+  });
+  try {
+    writeAppId(appDir, appId, { wranglerEnv: opts.wranglerEnv, force: Boolean(opts.force) });
+  } catch (error) {
+    throw new Error(
+      `Registered ${appId}, but writing it to wrangler.toml failed: ${error instanceof Error ? error.message : String(error)} \u2014 add DEEPSPACE_APP_ID = "${appId}" ${opts.wranglerEnv ? `to [env.${opts.wranglerEnv}.vars] ` : ""}by hand.`
+    );
+  }
+  const committedScaffold = opts.commitScaffold === true && commitScaffoldIfUnborn(appDir, token);
+  return { appId, committedScaffold };
+}
+function canHealAppRegistration(appDir, wranglerEnv) {
+  if (!hasWranglerConfig(appDir)) return false;
+  try {
+    const cfg = readWranglerConfig(appDir);
+    if (wranglerEnv && cfg.env?.[wranglerEnv] === void 0) return false;
+    if (readAppIdVar(cfg, wranglerEnv) === void 0) return false;
+  } catch {
+    return false;
+  }
+  try {
+    const committed = runGit(appDir, ["show", "HEAD:./wrangler.toml"], { allowFail: true });
+    if (committed.status === 0 && committed.stdout.toString("utf-8").includes("__APP_ID__")) {
+      return false;
+    }
+  } catch {
+  }
+  return true;
+}
+async function ensureAppRegistered(appDir, token, wranglerEnv, opts = {}) {
+  const existing = readAppId(appDir, wranglerEnv);
+  if (existing) return { appId: existing, minted: false, committedScaffold: false };
+  if (!canHealAppRegistration(appDir, wranglerEnv)) return null;
+  const release2 = acquireMintLock(appDir);
+  if (!release2) {
+    const winner = await waitForMintedId(appDir, wranglerEnv);
+    if (winner) return { appId: winner, minted: false, committedScaffold: false };
+  }
+  try {
+    const raced = readAppId(appDir, wranglerEnv);
+    if (raced) return { appId: raced, minted: false, committedScaffold: false };
+    const { appId, committedScaffold } = await mintAppIdentity(appDir, token, {
+      wranglerEnv,
+      commitScaffold: opts.commitScaffold
+    });
+    process.stderr.write(
+      `Registered ${appId}${wranglerEnv ? ` (env: ${wranglerEnv})` : ""} on ${DEEPSPACE_ENV} to your account \u2014 apps register on first use` + (committedScaffold ? "; initial scaffold commit created" : "") + ".\n"
+    );
+    return { appId, minted: true, committedScaffold };
+  } finally {
+    release2?.();
+  }
+}
+function acquireMintLock(appDir) {
+  const lockDir = join4(appDir, ".deepspace", "register.lock");
+  mkdirSync3(join4(appDir, ".deepspace"), { recursive: true });
+  try {
+    mkdirSync3(lockDir);
+  } catch {
+    try {
+      const age = Date.now() - statSync(lockDir).mtimeMs;
+      if (age < 2 * 60 * 1e3) return null;
+      rmSync3(lockDir, { recursive: true, force: true });
+      mkdirSync3(lockDir);
+    } catch {
+      return null;
+    }
+  }
+  return () => rmSync3(lockDir, { recursive: true, force: true });
+}
+async function waitForMintedId(appDir, wranglerEnv) {
+  const deadline = Date.now() + 3e4;
+  while (Date.now() < deadline) {
+    const id = readAppId(appDir, wranglerEnv);
+    if (id) return id;
+    if (!existsSync7(join4(appDir, ".deepspace", "register.lock"))) {
+      return readAppId(appDir, wranglerEnv);
+    }
+    await new Promise((resolve23) => setTimeout(resolve23, 250));
+  }
+  return null;
+}
+function wranglerConfigUncommitted(appDir) {
+  if (!existsSync7(join4(appDir, ".git"))) return false;
+  const dryRun = runGit(appDir, ["commit", "--dry-run", "-m", "x", "--", "wrangler.toml"], {
+    allowFail: true
+  });
+  return dryRun.status === 0;
+}
+function commitScaffoldIfUnborn(appDir, token) {
+  try {
+    if (!existsSync7(join4(appDir, ".git"))) return false;
+    if (runGit(appDir, ["rev-parse", "--verify", "HEAD"], { allowFail: true }).status === 0) {
+      return false;
+    }
+    ensureGitIdentity(appDir, token);
+    if (runGit(appDir, ["add", "-A"], { allowFail: true }).status !== 0) return false;
+    const commit = runGit(appDir, ["commit", "-m", "Initial DeepSpace scaffold", "--no-verify"], {
+      allowFail: true
+    });
+    return commit.status === 0;
+  } catch {
+    return false;
+  }
+}
+
+// src/cli/commands/dev.ts
+import { resolve as resolve9, basename as basename2, join as join12 } from "path";
+import spawn2 from "cross-spawn";
+
+// src/cli/lib/app-context.ts
+import { existsSync as existsSync8, readdirSync } from "fs";
+import { dirname as dirname3, join as join5, resolve as resolve4 } from "path";
+function detectAppName(cwd = process.cwd()) {
+  const appDir = resolve4(cwd);
+  if (!existsSync8(join5(appDir, "wrangler.toml"))) return null;
+  const { name } = readWranglerConfig(appDir);
+  return typeof name === "string" && name.length > 0 ? name : null;
+}
+function findAppDir(start = process.cwd()) {
+  let dir = resolve4(start);
+  for (; ; ) {
+    if (existsSync8(join5(dir, "wrangler.toml"))) return dir;
+    const parent = dirname3(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+function findChildApps(dir) {
+  try {
+    return readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && existsSync8(join5(dir, entry.name, "wrangler.toml"))).map((entry) => entry.name).sort();
+  } catch {
+    return [];
+  }
+}
+
+// src/cli/lib/launch-config.ts
+import {
+  existsSync as existsSync10,
+  readFileSync as readFileSync7,
+  realpathSync as realpathSync2,
+  writeFileSync as writeFileSync4,
+  mkdirSync as mkdirSync5,
+  renameSync,
+  unlinkSync
+} from "fs";
+import { join as join7, resolve as resolve6, dirname as dirname5, basename, isAbsolute as isAbsolute3, sep } from "path";
+
 // src/cli/lib/git/repository.ts
+import { appendFileSync, existsSync as existsSync9, mkdirSync as mkdirSync4, readFileSync as readFileSync6 } from "fs";
+import { dirname as dirname4, join as join6, resolve as resolve5 } from "path";
 function isPlausibleBranchName(name) {
   if (!name || name === "HEAD" || name === "@") return false;
   if (name.startsWith("/") || name.startsWith("-") || name.startsWith(".")) return false;
@@ -1644,7 +1927,7 @@ function assertNoOperationInProgress(cwd) {
     ["REVERT_HEAD", "revert", "git revert --continue", "git revert --abort"],
     ["rebase-merge", "rebase", "git rebase --continue", "git rebase --abort"],
     ["rebase-apply", "rebase", "git rebase --continue", "git rebase --abort"]
-  ].find(([marker]) => existsSync7(join5(resolve4(cwd, gitDir), marker)));
+  ].find(([marker]) => existsSync9(join6(resolve5(cwd, gitDir), marker)));
   if (!inProgress) return;
   const [, kind, finish, abort] = inProgress;
   throw new InputError(
@@ -1658,13 +1941,13 @@ function repoToplevel(cwd) {
 function interruptedGitOperation(cwd) {
   const gitDir = runGit(cwd, ["rev-parse", "--git-path", "HEAD"], { allowFail: true });
   if (gitDir.status !== 0) return null;
-  const dir = dirname4(resolve4(cwd, gitDir.stdout.toString("utf-8").trim()));
-  if (existsSync7(join5(dir, "rebase-apply", "applying"))) return "am";
-  if (existsSync7(join5(dir, "rebase-merge")) || existsSync7(join5(dir, "rebase-apply"))) return "rebase";
-  if (existsSync7(join5(dir, "MERGE_HEAD"))) return "merge";
-  if (existsSync7(join5(dir, "CHERRY_PICK_HEAD"))) return "cherry-pick";
-  if (existsSync7(join5(dir, "REVERT_HEAD"))) return "revert";
-  if (existsSync7(join5(dir, "BISECT_LOG"))) return "bisect";
+  const dir = dirname4(resolve5(cwd, gitDir.stdout.toString("utf-8").trim()));
+  if (existsSync9(join6(dir, "rebase-apply", "applying"))) return "am";
+  if (existsSync9(join6(dir, "rebase-merge")) || existsSync9(join6(dir, "rebase-apply"))) return "rebase";
+  if (existsSync9(join6(dir, "MERGE_HEAD"))) return "merge";
+  if (existsSync9(join6(dir, "CHERRY_PICK_HEAD"))) return "cherry-pick";
+  if (existsSync9(join6(dir, "REVERT_HEAD"))) return "revert";
+  if (existsSync9(join6(dir, "BISECT_LOG"))) return "bisect";
   return null;
 }
 function currentBranch(cwd) {
@@ -1741,11 +2024,11 @@ function listWorktrees(cwd) {
       current.branch = ref.startsWith("refs/heads/") ? ref.slice("refs/heads/".length) : ref;
     }
   }
-  return worktrees.filter((worktree) => existsSync7(worktree.path));
+  return worktrees.filter((worktree) => existsSync9(worktree.path));
 }
 function ensureLocalExclude(cwd, pattern) {
-  const commonDir = resolve4(cwd, gitLine(cwd, ["rev-parse", "--git-common-dir"]));
-  const excludePath = join5(commonDir, "info", "exclude");
+  const commonDir = resolve5(cwd, gitLine(cwd, ["rev-parse", "--git-common-dir"]));
+  const excludePath = join6(commonDir, "info", "exclude");
   let current = "";
   try {
     current = readFileSync6(excludePath, "utf-8");
@@ -1753,7 +2036,7 @@ function ensureLocalExclude(cwd, pattern) {
   }
   if (current.split("\n").some((line) => line.trim() === pattern)) return;
   try {
-    mkdirSync3(dirname4(excludePath), { recursive: true });
+    mkdirSync4(dirname4(excludePath), { recursive: true });
     appendFileSync(
       excludePath,
       `${current.endsWith("\n") || current === "" ? "" : "\n"}${pattern}
@@ -1765,7 +2048,7 @@ function ensureLocalExclude(cwd, pattern) {
 
 // src/cli/lib/launch-config.ts
 function writeLaunchFile(launchPath, config) {
-  mkdirSync4(dirname5(launchPath), { recursive: true });
+  mkdirSync5(dirname5(launchPath), { recursive: true });
   const tmpPath = `${launchPath}.${process.pid}.tmp`;
   writeFileSync4(tmpPath, JSON.stringify(config, null, 2) + "\n");
   try {
@@ -1780,7 +2063,7 @@ function writeLaunchFile(launchPath, config) {
 }
 function readLaunchFile(launchPath) {
   const empty = { version: "0.0.1", configurations: [] };
-  if (!existsSync8(launchPath)) return empty;
+  if (!existsSync10(launchPath)) return empty;
   const raw = readFileSync7(launchPath, "utf-8").trim();
   if (!raw) return empty;
   const parsed = JSON.parse(raw);
@@ -1788,7 +2071,7 @@ function readLaunchFile(launchPath) {
   return parsed;
 }
 function writeLaunchConfigIfMissing(appDir, appName, port, opts = {}) {
-  const launchPath = join6(appDir, ".claude", "launch.json");
+  const launchPath = join7(appDir, ".claude", "launch.json");
   try {
     const config = readLaunchFile(launchPath);
     if (!config) return;
@@ -1829,7 +2112,7 @@ function writeLaunchConfigIfMissing(appDir, appName, port, opts = {}) {
 }
 function resolveAppLaunchPort(appDir) {
   try {
-    const config = readLaunchFile(join6(appDir, ".claude", "launch.json"));
+    const config = readLaunchFile(join7(appDir, ".claude", "launch.json"));
     if (!config) return null;
     const appName = detectAppName(appDir) ?? basename(appDir);
     const entry = config.configurations.find((c) => c?.name === appName) ?? (config.configurations.length === 1 ? config.configurations[0] : void 0);
@@ -1860,7 +2143,7 @@ function canonicalPath(path) {
   try {
     return realpathSync2(path);
   } catch {
-    return resolve5(path);
+    return resolve6(path);
   }
 }
 function detectLinkedWorktree(appDir) {
@@ -1883,21 +2166,21 @@ function deriveWorktreePort(worktreeKey) {
   return WORKTREE_PORT_MIN + hash % WORKTREE_PORT_RANGE;
 }
 function upsertWorktreeLaunchConfig(mainRepoRoot, worktreeName, appDir, opts) {
-  const launchPath = join6(mainRepoRoot, ".claude", "launch.json");
+  const launchPath = join7(mainRepoRoot, ".claude", "launch.json");
   const entryName = WORKTREE_ENTRY_PREFIX + worktreeName;
   try {
     const config = readLaunchFile(launchPath);
     if (!config) return null;
-    const worktreesRoot = join6(mainRepoRoot, ".claude", "worktrees") + sep;
+    const worktreesRoot = join7(mainRepoRoot, ".claude", "worktrees") + sep;
     config.configurations = config.configurations.filter((c) => {
       if (c?.name === entryName) return false;
-      const isStaleWorktreeEntry = typeof c?.name === "string" && c.name.startsWith(WORKTREE_ENTRY_PREFIX) && typeof c.cwd === "string" && isAbsolute2(c.cwd) && c.cwd.startsWith(worktreesRoot) && !existsSync8(c.cwd);
+      const isStaleWorktreeEntry = typeof c?.name === "string" && c.name.startsWith(WORKTREE_ENTRY_PREFIX) && typeof c.cwd === "string" && isAbsolute3(c.cwd) && c.cwd.startsWith(worktreesRoot) && !existsSync10(c.cwd);
       return !isStaleWorktreeEntry;
     });
     let port = opts.port;
     if (opts.probePort) {
       const taken = new Set(
-        config.configurations.map((c) => Number(c?.port)).filter((p36) => Number.isInteger(p36) && p36 > 0)
+        config.configurations.map((c) => Number(c?.port)).filter((p35) => Number.isInteger(p35) && p35 > 0)
       );
       for (let i = 0; i < WORKTREE_PORT_RANGE && taken.has(port); i++) {
         port = WORKTREE_PORT_MIN + (port - WORKTREE_PORT_MIN + 1) % WORKTREE_PORT_RANGE;
@@ -1912,7 +2195,7 @@ function upsertWorktreeLaunchConfig(mainRepoRoot, worktreeName, appDir, opts) {
       // the Claude Code desktop launch.json reference alongside `port`) and
       // verified end-to-end: with it set, the preview server builds from the
       // worktree instead of the session's main repo.
-      cwd: resolve5(appDir)
+      cwd: resolve6(appDir)
     });
     writeLaunchFile(launchPath, config);
     return { entryName, port };
@@ -1926,7 +2209,7 @@ function resolveWorktreePort(appDir) {
   const claude = detectClaudeWorktree(appDir);
   if (claude) {
     try {
-      const config = readLaunchFile(join6(claude.mainRepoRoot, ".claude", "launch.json"));
+      const config = readLaunchFile(join7(claude.mainRepoRoot, ".claude", "launch.json"));
       const entry = config?.configurations.find(
         (c) => c?.name === WORKTREE_ENTRY_PREFIX + claude.worktreeName
       );
@@ -1987,14 +2270,6 @@ async function getAppSource(deployUrl, token, appId) {
     throw error;
   }
 }
-function setAppSource(deployUrl, token, appId, input) {
-  return apiFetch(
-    deployUrl,
-    token,
-    `/api/apps/${encodeURIComponent(appId)}/source`,
-    { method: "POST", body: JSON.stringify(input) }
-  );
-}
 
 // src/cli/lib/repo-api.ts
 function isWorkspaceRef(ref) {
@@ -2002,10 +2277,15 @@ function isWorkspaceRef(ref) {
   return ref.startsWith(prefix) && isWorkspaceId(ref.slice(prefix.length));
 }
 function releaseSourceLabel(release2) {
-  if (release2.commitOid) return `commit ${release2.commitOid.slice(0, 10)}`;
-  if (release2.source?.provider === "github") return `GitHub \xB7 ${release2.source.repository}`;
-  if (release2.source?.provider === "deepspace") return "DeepSpace source, no commit recorded";
-  return "no source recorded";
+  const dirty = release2.sourceDirty === true ? " (dirty worktree)" : "";
+  if (release2.commitOid) return `commit ${release2.commitOid.slice(0, 10)}${dirty}`;
+  if (release2.source?.provider === "github") {
+    return `GitHub \xB7 ${release2.source.repository}${dirty ? ", dirty worktree" : ""}`;
+  }
+  if (release2.source?.provider === "deepspace") {
+    return `DeepSpace source, no commit recorded${dirty}`;
+  }
+  return `no source recorded${dirty}`;
 }
 function mintIdempotencyKey() {
   return randomUUID();
@@ -2186,6 +2466,11 @@ async function resolveAppTarget(deployUrl, token, explicit, options = {}) {
   if (app2 !== void 0) return resolveAppSelector(deployUrl, token, app2);
   const { wranglerEnv } = parseWranglerEnvArg(options.wranglerEnv);
   const appDir = findAppDir();
+  if (options.register === true) {
+    const ensured = appDir ? await ensureAppRegistered(appDir, token, wranglerEnv) : null;
+    if (!ensured) throw appTargetMissingError(appDir, wranglerEnv);
+    return ensured.appId;
+  }
   const id = appDir ? readAppId(appDir, wranglerEnv) : null;
   if (!id) throw appTargetMissingError(appDir, wranglerEnv);
   return id;
@@ -2255,7 +2540,9 @@ function assertAppTargetResolvable(appArg, options = {}) {
   }
   if (app2 !== void 0) return;
   const appDir = findAppDir();
-  if (!appDir || !readAppId(appDir, wranglerEnv)) throw appTargetMissingError(appDir, wranglerEnv);
+  if (appDir && readAppId(appDir, wranglerEnv)) return;
+  if (options.register === true && appDir && canHealAppRegistration(appDir, wranglerEnv)) return;
+  throw appTargetMissingError(appDir, wranglerEnv);
 }
 async function warnIfPhantomApp(deployUrl, token, appId, explicit) {
   if (!explicit || !STRICT_APP_ID_RE.test(explicit.trim())) return;
@@ -2357,22 +2644,34 @@ async function writeDevVars(appDir, ownerId, callerJwt, wranglerEnv, opts = {})
 }
 
 // src/cli/lib/install-status.ts
-import { existsSync as existsSync10, readFileSync as readFileSync9, realpathSync as realpathSync3 } from "fs";
-import { dirname as dirname6, join as join8, resolve as resolve6 } from "path";
+import {
+  appendFileSync as appendFileSync2,
+  closeSync,
+  existsSync as existsSync12,
+  mkdirSync as mkdirSync6,
+  openSync,
+  readFileSync as readFileSync9,
+  realpathSync as realpathSync3,
+  rmSync as rmSync4,
+  statSync as statSync2,
+  writeFileSync as writeFileSync5
+} from "fs";
+import { dirname as dirname6, join as join9, resolve as resolve7 } from "path";
+import { sync as spawnSync2 } from "cross-spawn";
 
 // src/cli/lib/package-manager.ts
-import { existsSync as existsSync9, readFileSync as readFileSync8 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync8 } from "fs";
+import { join as join8 } from "path";
 function detectPackageManager(appDir) {
   try {
-    const pkg2 = JSON.parse(readFileSync8(join7(appDir, "package.json"), "utf-8"));
+    const pkg2 = JSON.parse(readFileSync8(join8(appDir, "package.json"), "utf-8"));
     const name = typeof pkg2.packageManager === "string" ? pkg2.packageManager.split("@")[0] : "";
     if (name === "npm" || name === "pnpm" || name === "yarn" || name === "bun") return name;
   } catch {
   }
-  if (existsSync9(join7(appDir, "pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync9(join7(appDir, "yarn.lock"))) return "yarn";
-  if (existsSync9(join7(appDir, "bun.lock")) || existsSync9(join7(appDir, "bun.lockb"))) return "bun";
+  if (existsSync11(join8(appDir, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync11(join8(appDir, "yarn.lock"))) return "yarn";
+  if (existsSync11(join8(appDir, "bun.lock")) || existsSync11(join8(appDir, "bun.lockb"))) return "bun";
   return "npm";
 }
 function installCommand(appDir) {
@@ -2382,10 +2681,10 @@ function installCommand(appDir) {
 // src/cli/lib/install-status.ts
 function installState(appDir) {
   if (resolvesDeepspace(appDir)) return "ready";
-  const sentinelDir = join8(appDir, ".deepspace");
-  if (existsSync10(join8(sentinelDir, "install.err"))) return "failed";
-  if (existsSync10(join8(sentinelDir, "install.started"))) {
-    if (!existsSync10(join8(sentinelDir, "install.done")) && installWorkerAlive(sentinelDir)) {
+  const sentinelDir = join9(appDir, ".deepspace");
+  if (existsSync12(join9(sentinelDir, "install.err"))) return "failed";
+  if (existsSync12(join9(sentinelDir, "install.started"))) {
+    if (!existsSync12(join9(sentinelDir, "install.done")) && installWorkerAlive(sentinelDir)) {
       return "installing";
     }
     return "failed";
@@ -2397,42 +2696,108 @@ function tailHint(logPath, platform = process.platform) {
 }
 function ensureInstallReady(appDir) {
   if (resolvesDeepspace(appDir)) return;
-  const sentinelDir = join8(appDir, ".deepspace");
-  const errPath = join8(sentinelDir, "install.err");
-  const startedPath = join8(sentinelDir, "install.started");
-  const donePath = join8(sentinelDir, "install.done");
-  const logPath = join8(sentinelDir, "install.log");
-  if (existsSync10(errPath)) {
-    const detail = readFileSync9(errPath, "utf-8").trimEnd();
-    const log29 = existsSync10(logPath) ? ` Full log: ${logPath}.` : "";
+  const sentinelDir = join9(appDir, ".deepspace");
+  const startedPath = join9(sentinelDir, "install.started");
+  const donePath = join9(sentinelDir, "install.done");
+  const logPath = join9(sentinelDir, "install.log");
+  if (process.env.DEEPSPACE_NO_INSTALL) {
     throw new Refusal(
-      `Dependency install failed: ${detail}.${log29} Run \`npm install\` (or \`bun install\`) manually, then retry.`,
-      "install_failed",
+      "Dependencies not installed, and DEEPSPACE_NO_INSTALL is set \u2014 run the install yourself, then retry.",
+      "deps_missing",
       { action: { cwd: appDir, argv: [detectPackageManager(appDir), "install"] } }
     );
   }
-  if (existsSync10(startedPath) && !existsSync10(donePath)) {
-    if (!installWorkerAlive(sentinelDir)) {
-      const log29 = existsSync10(logPath) ? ` See what happened: ${logPath}.` : "";
-      throw new Refusal(
-        `The dependency install is no longer running and never finished.${log29} Run \`npm install\` (or \`bun install\`) manually, then retry.`,
-        "install_failed",
-        { action: { cwd: appDir, argv: [detectPackageManager(appDir), "install"] } }
-      );
-    }
-    const tail = existsSync10(logPath) ? ` Tail progress: ${tailHint(logPath)}.` : "";
+  if (existsSync12(startedPath) && !existsSync12(donePath) && installWorkerAlive(sentinelDir) && sentinelAgeMs(startedPath) < 30 * 60 * 1e3) {
+    const tail = existsSync12(logPath) ? ` Tail progress: ${tailHint(logPath)}.` : "";
     throw new Refusal(
-      `Dependencies are still installing.${tail} Retry once it finishes.`,
+      `Dependencies are still installing.${tail} Retry once it finishes (or remove ${sentinelDir}/install.started if no install is actually running).`,
       "install_in_progress"
     );
   }
-  throw new Refusal(
-    "Dependencies not installed. Run `npm install` (or `bun install`) first.",
-    "deps_missing",
-    {
-      action: { cwd: appDir, argv: [detectPackageManager(appDir), "install"] }
-    }
-  );
+  healMissingInstall(appDir);
+}
+function healMissingInstall(appDir) {
+  const manager = detectPackageManager(appDir);
+  const sentinelDir = join9(appDir, ".deepspace");
+  const logPath = join9(sentinelDir, "install.log");
+  const errPath = join9(sentinelDir, "install.err");
+  const previousFailure = existsSync12(errPath) ? readFileSync9(errPath, "utf-8").trimEnd() : null;
+  process.stderr.write(
+    `Installing dependencies (${manager} install) \u2014 first use installs them. ${previousFailure ? `Retrying after: ${previousFailure}. ` : ""}Watch: ${tailHint(logPath)}
+`
+  );
+  if (process.platform === "win32") {
+    for (const ext of [".cmd", ".bat", ".exe", ".com", ".ps1"]) {
+      if (existsSync12(join9(appDir, `${manager}${ext}`))) {
+        throw new Refusal(
+          `Refusing to install: ${appDir} contains ${manager}${ext}, which Windows would execute instead of the real ${manager}. Remove it, or run the install yourself from a shell you trust.`,
+          "install_failed"
+        );
+      }
+    }
+  }
+  mkdirSync6(sentinelDir, { recursive: true });
+  ensureSentinelsIgnored(appDir);
+  rmSync4(errPath, { force: true });
+  rmSync4(join9(sentinelDir, "install.done"), { force: true });
+  writeFileSync5(join9(sentinelDir, "install.started"), (/* @__PURE__ */ new Date()).toISOString());
+  writeFileSync5(join9(sentinelDir, "install.pid"), String(process.pid));
+  const logFd = openSync(logPath, "w");
+  let result;
+  try {
+    result = spawnSync2(manager, ["install"], {
+      cwd: appDir,
+      stdio: ["ignore", logFd, logFd],
+      // Bounded (repo rule: no task over 5 minutes): a hung registry must
+      // surface as a fast failure, never a stall. The log names the cure.
+      timeout: 5 * 60 * 1e3
+    });
+  } finally {
+    closeSync(logFd);
+  }
+  if (result.status === 0 && !result.error && resolvesDeepspace(appDir)) {
+    writeFileSync5(join9(sentinelDir, "install.done"), (/* @__PURE__ */ new Date()).toISOString());
+    return;
+  }
+  const detail = result.error ? result.error.code === "ETIMEDOUT" ? `${manager} install timed out after 5 minutes` : result.error.message : result.status === 0 ? `${manager} install completed but the \`deepspace\` package still does not resolve \u2014 is this directory the app (its package.json must depend on deepspace)?` : result.status === null ? `${manager} install was killed (${result.signal ?? "signal"})` : `${manager} install exited ${result.status}`;
+  writeFileSync5(errPath, detail);
+  let logTail = "";
+  try {
+    const log28 = readFileSync9(logPath, "utf-8");
+    const tail = log28.slice(-1500).trimEnd();
+    if (tail) logTail = `
+--- install log (tail) ---
+${tail}`;
+  } catch {
+  }
+  throw new Refusal(
+    `Dependency install failed: ${detail}. Full log: ${logPath}. It will be retried on the next command, or run \`${manager} install\` yourself.${logTail}`,
+    "install_failed",
+    { action: { cwd: appDir, argv: [manager, "install"] } }
+  );
+}
+function sentinelAgeMs(path) {
+  try {
+    return Date.now() - statSync2(path).mtimeMs;
+  } catch {
+    return Number.POSITIVE_INFINITY;
+  }
+}
+function ensureSentinelsIgnored(appDir) {
+  try {
+    const check = spawnSync2("git", ["-C", appDir, "check-ignore", "-q", ".deepspace"], {
+      stdio: "ignore"
+    });
+    if (check.status === 0 || check.error) return;
+    const excludePath = spawnSync2("git", ["-C", appDir, "rev-parse", "--git-path", "info/exclude"], {
+      encoding: "utf-8"
+    });
+    if (excludePath.status !== 0) return;
+    const target2 = resolve7(appDir, excludePath.stdout.trim());
+    mkdirSync6(dirname6(target2), { recursive: true });
+    appendFileSync2(target2, "\n# deepspace CLI state (added by first-use install)\n.deepspace/\n");
+  } catch {
+  }
 }
 function resolvesDeepspace(fromDir) {
   let dir = canonicalPath2(fromDir);
@@ -2442,7 +2807,7 @@ function resolvesDeepspace(fromDir) {
   } catch {
   }
   for (; ; ) {
-    if (existsSync10(join8(dir, "node_modules", "deepspace", "package.json"))) return true;
+    if (existsSync12(join9(dir, "node_modules", "deepspace", "package.json"))) return true;
     if (dir === checkoutRoot) return false;
     const parent = dirname6(dir);
     if (parent === dir) return false;
@@ -2453,13 +2818,15 @@ function canonicalPath2(path) {
   try {
     return realpathSync3(path);
   } catch {
-    return resolve6(path);
+    return resolve7(path);
   }
 }
 function installWorkerAlive(sentinelDir) {
-  const pidPath = join8(sentinelDir, "install.pid");
-  if (!existsSync10(pidPath)) return false;
-  return processAlive(Number(readFileSync9(pidPath, "utf-8").trim()));
+  const pidPath = join9(sentinelDir, "install.pid");
+  if (!existsSync12(pidPath)) return false;
+  const pid = Number(readFileSync9(pidPath, "utf-8").trim());
+  if (pid === process.pid) return false;
+  return processAlive(pid);
 }
 function processAlive(pid) {
   if (!Number.isSafeInteger(pid) || pid <= 0) return false;
@@ -2473,9 +2840,9 @@ function processAlive(pid) {
 
 // src/cli/lib/preflight.ts
 import { execFileSync } from "child_process";
-import { existsSync as existsSync11 } from "fs";
+import { existsSync as existsSync13 } from "fs";
 import * as nodeModule from "module";
-import { resolve as resolve7 } from "path";
+import { resolve as resolve8 } from "path";
 function preflightNodeVersion(command, hasRegisterHooks = typeof nodeModule.registerHooks === "function", version = process.versions.node) {
   const [major, minor] = version.split(".").map(Number);
   const supportedLine = major === 22 && minor >= 15 || major === 24 || major === 26;
@@ -2488,7 +2855,7 @@ function preflightNodeVersion(command, hasRegisterHooks = typeof nodeModule.regi
 var DLL_NOT_FOUND = -1073741515;
 function preflightWindowsWorkerd(appDir) {
   if (process.platform !== "win32") return;
-  const workerdExe = resolve7(
+  const workerdExe = resolve8(
     appDir,
     "node_modules",
     "@cloudflare",
@@ -2496,7 +2863,7 @@ function preflightWindowsWorkerd(appDir) {
     "bin",
     "workerd.exe"
   );
-  if (!existsSync11(workerdExe)) return;
+  if (!existsSync13(workerdExe)) return;
   try {
     execFileSync(workerdExe, ["--help"], { stdio: "pipe", timeout: 1e4 });
     return;
@@ -2511,8 +2878,8 @@ function preflightWindowsWorkerd(appDir) {
 }
 
 // src/cli/lib/macos-junk.ts
-import { readdirSync as readdirSync2, rmSync as rmSync3 } from "fs";
-import { join as join9 } from "path";
+import { readdirSync as readdirSync2, rmSync as rmSync5 } from "fs";
+import { join as join10 } from "path";
 var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", ".wrangler", ".vite"]);
 function removeMacosJunk(dir) {
   let removed = 0;
@@ -2523,14 +2890,14 @@ function removeMacosJunk(dir) {
     return removed;
   }
   for (const entry of entries) {
-    const path = join9(dir, entry.name);
+    const path = join10(dir, entry.name);
     if (entry.isDirectory()) {
       if (!SKIP_DIRS.has(entry.name)) removed += removeMacosJunk(path);
       continue;
     }
     if (entry.name === ".DS_Store" || entry.name.startsWith("._")) {
       try {
-        rmSync3(path, { force: true });
+        rmSync5(path, { force: true });
         removed++;
       } catch {
       }
@@ -3105,8 +3472,8 @@ async function refreshSecretsCache(deployUrl, token, appId, wranglerEnv, selecte
 }
 
 // src/cli/lib/schema-lint.ts
-import { existsSync as existsSync12 } from "fs";
-import { join as join10 } from "path";
+import { existsSync as existsSync14 } from "fs";
+import { join as join11 } from "path";
 import { pathToFileURL } from "url";
 
 // src/server/schemas/registry.ts
@@ -3139,7 +3506,7 @@ function lintSchema(schema) {
     const offendingRoles = Object.entries(schema.permissions).filter(([, perms]) => perms.read === true).map(([role]) => role);
     if (offendingRoles.length > 0) {
       const usesAware = Object.values(schema.permissions).some(
-        (p36) => typeof p36.read === "string" && VISIBILITY_AWARE.includes(p36.read)
+        (p35) => typeof p35.read === "string" && VISIBILITY_AWARE.includes(p35.read)
       );
       if (!usesAware) {
         warnings.push(
@@ -3175,7 +3542,7 @@ function lintSchemaSet(schemas) {
   const warnings = [];
   if (!schemas.some((schema) => schema.name === "team_members")) {
     for (const schema of schemas) {
-      const teamRoles = Object.entries(schema.permissions).filter(([, p36]) => [p36.read, p36.update, p36.delete].includes("team")).map(([role]) => role);
+      const teamRoles = Object.entries(schema.permissions).filter(([, p35]) => [p35.read, p35.update, p35.delete].includes("team")).map(([role]) => role);
       if (teamRoles.length > 0) {
         warnings.push(
           `[${schema.name}] role(s) ${teamRoles.join(", ")} use the 'team' permission level, but no 'team_members' collection is registered. 'team' resolves membership from team_members (teamId, userId, status), so without it those roles are denied everything \u2014 silently. Register a team_members schema or use another level.`
@@ -3188,12 +3555,12 @@ function lintSchemaSet(schemas) {
 
 // src/cli/lib/schema-lint.ts
 async function lintProjectSchemas(appDir) {
-  const schemasPath = join10(appDir, "src", "schemas.ts");
-  if (!existsSync12(schemasPath)) return null;
+  const schemasPath = join11(appDir, "src", "schemas.ts");
+  if (!existsSync14(schemasPath)) return null;
   let schemas;
   try {
     const esbuild = await import("esbuild");
-    const outFile = join10(appDir, ".wrangler", "deploy", "schemas.lint.bundle.mjs");
+    const outFile = join11(appDir, ".wrangler", "deploy", "schemas.lint.bundle.mjs");
     await esbuild.build({
       entryPoints: [schemasPath],
       bundle: true,
@@ -3242,8 +3609,33 @@ function formatSchemaLintFindings(findings) {
 }
 
 // src/cli/lib/port.ts
-import { createServer, Socket } from "net";
+import { Socket } from "net";
 var DEFAULT_PORT = 5173;
+async function ensurePortFree(port, host, waitMs = 15e3) {
+  if (!await isPortListening(port, host)) return;
+  if (!await isHttpResponding(port)) {
+    const deadline = Date.now() + waitMs;
+    while (Date.now() < deadline) {
+      await new Promise((resolve23) => setTimeout(resolve23, 500));
+      if (!await isPortListening(port, host)) return;
+    }
+  }
+  const killArgv = port === DEFAULT_PORT ? ["deepspace", "dev", "kill"] : ["deepspace", "dev", "kill", "--port", String(port)];
+  throw new Refusal(
+    `Port ${port} is already in use.
+Free it with \`${killArgv.join(" ")}\`, or use another port: \`--port <other>\`.`,
+    "port_in_use",
+    { extra: { port } }
+  );
+}
+async function isHttpResponding(port, timeoutMs = 2e3) {
+  try {
+    await fetch(`http://127.0.0.1:${port}/`, { signal: AbortSignal.timeout(timeoutMs) });
+    return true;
+  } catch {
+    return false;
+  }
+}
 function isPortListening(port, host, timeoutMs = 500) {
   const target2 = host === "0.0.0.0" || host === "::" ? "127.0.0.1" : host;
   return new Promise((resolve23) => {
@@ -3280,7 +3672,7 @@ function resolvePort(arg) {
 // src/cli/commands/dev.ts
 var DEFAULT_DEV_HOST = "0.0.0.0";
 var READINESS_TIMEOUT_MS = 12e4;
-var DEPLOY_URL = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
+var DEPLOY_URL2 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 function noAppDirRefusal(start) {
   const children = findChildApps(start);
   const lines = [`No wrangler.toml found at or above ${start}.`];
@@ -3330,7 +3722,7 @@ var dev_default = defineDeepspaceCommand({
     preflightNodeVersion("dev start");
     const wranglerEnv = typeof args.env === "string" && args.env.trim() ? args.env.trim() : void 0;
     const host = typeof args.host === "string" && args.host.trim() ? args.host.trim() : DEFAULT_DEV_HOST;
-    const start = resolve8(args.dir ?? ".");
+    const start = resolve9(args.dir ?? ".");
     const appDir = findAppDir(start);
     if (!appDir) {
       throw noAppDirRefusal(start);
@@ -3360,18 +3752,13 @@ var dev_default = defineDeepspaceCommand({
         );
       } else if (!args.json) {
         console.warn(
-          `Warning: could not update ${join11(worktree.mainRepoRoot, ".claude", "launch.json")} (malformed or unwritable) \u2014 the Claude preview tool may serve the main repo's code instead of this worktree.`
+          `Warning: could not update ${join12(worktree.mainRepoRoot, ".claude", "launch.json")} (malformed or unwritable) \u2014 the Claude preview tool may serve the main repo's code instead of this worktree.`
         );
       }
     }
     writeLaunchConfigIfMissing(appDir, detectAppName(appDir) ?? basename2(appDir), port, {
       updatePort: explicitPort
     });
-    ensureInstallReady(appDir);
-    const lintFindings = await lintProjectSchemas(appDir);
-    if (lintFindings && lintFindings.length > 0 && !args.json) {
-      for (const line of formatSchemaLintFindings(lintFindings)) console.warn(line);
-    }
     let token;
     try {
       token = await ensureToken();
@@ -3394,11 +3781,24 @@ var dev_default = defineDeepspaceCommand({
     if (wranglerEnv) say(`Wrangler env: ${wranglerEnv}`);
     say(`Port: ${port}`);
     if (host !== DEFAULT_DEV_HOST) say(`Host: ${host}`);
+    ensureInstallReady(appDir);
+    const lintFindings = await lintProjectSchemas(appDir);
+    if (lintFindings && lintFindings.length > 0 && !args.json) {
+      for (const line of formatSchemaLintFindings(lintFindings)) console.warn(line);
+    }
     let generatedSecretsCache;
-    const appIdForSecrets = readAppId(appDir, wranglerEnv);
+    let appIdForSecrets = null;
+    try {
+      appIdForSecrets = (await ensureAppRegistered(appDir, token, wranglerEnv))?.appId ?? null;
+    } catch (registrationError) {
+      process.stderr.write(
+        `warning: could not register the app (${registrationError instanceof Error ? registrationError.message.split("\n")[0] : String(registrationError)}) \u2014 continuing without app secrets.
+`
+      );
+    }
     if (appIdForSecrets) {
       try {
-        const refreshed = await refreshSecretsCache(DEPLOY_URL, token, appIdForSecrets, wranglerEnv);
+        const refreshed = await refreshSecretsCache(DEPLOY_URL2, token, appIdForSecrets, wranglerEnv);
         generatedSecretsCache = refreshed.rendered;
         if (refreshed.summary) say(refreshed.summary);
       } catch (err) {
@@ -3413,16 +3813,11 @@ var dev_default = defineDeepspaceCommand({
     });
     const wranglerConfig = prepareWranglerEnvConfig(appDir, wranglerEnv);
     preflightWindowsWorkerd(appDir);
-    if (await isPortListening(port, host)) {
-      const killArgv = port === DEFAULT_PORT ? ["deepspace", "dev", "kill"] : ["deepspace", "dev", "kill", "--port", String(port)];
-      const killCmd = killArgv.join(" ");
+    try {
+      await ensurePortFree(port, host);
+    } catch (err) {
       wranglerConfig.cleanup();
-      throw new Refusal(
-        `Port ${port} is already in use.
-Free it with \`${killCmd}\`, or start on another port: \`deepspace dev start --port <other>\`.`,
-        "port_in_use",
-        { extra: { port } }
-      );
+      throw err;
     }
     const url = `http://${host === DEFAULT_DEV_HOST ? "localhost" : host}:${port}`;
     say("Starting dev server...\n");
@@ -3481,7 +3876,7 @@ Free it with \`${killCmd}\`, or start on another port: \`deepspace dev start --p
 });
 
 // src/cli/commands/kill.ts
-import { spawnSync as spawnSync2 } from "child_process";
+import { spawnSync as spawnSync3 } from "child_process";
 import { readFileSync as readFileSync10, readdirSync as readdirSync3, readlinkSync } from "fs";
 import { setTimeout as wait } from "timers/promises";
 var SIGTERM_GRACE_MS = 1500;
@@ -3616,7 +4011,7 @@ function listenerPids(port) {
 }
 function runLsof(port) {
   try {
-    const r = spawnSync2("lsof", ["-nP", `-iTCP:${port}`, "-sTCP:LISTEN", "-t"], {
+    const r = spawnSync3("lsof", ["-nP", `-iTCP:${port}`, "-sTCP:LISTEN", "-t"], {
       encoding: "utf-8"
     });
     if (r.error) return { pids: [], ran: false };
@@ -3701,7 +4096,7 @@ function sweepByName(names) {
 }
 function runPgrep(pgrepArgs) {
   try {
-    const r = spawnSync2("pgrep", pgrepArgs, { encoding: "utf-8" });
+    const r = spawnSync3("pgrep", pgrepArgs, { encoding: "utf-8" });
     if (r.error) return { pids: [], ran: false };
     return {
       pids: r.status === 0 ? parsePidLines(r.stdout) : [],
@@ -3713,7 +4108,7 @@ function runPgrep(pgrepArgs) {
 }
 function run(cmd) {
   try {
-    const r = spawnSync2(cmd[0], cmd.slice(1), { encoding: "utf-8" });
+    const r = spawnSync3(cmd[0], cmd.slice(1), { encoding: "utf-8" });
     if (r.status !== 0) return [];
     return parsePidLines(r.stdout);
   } catch {
@@ -3734,7 +4129,7 @@ function readPowershellPids(stdout) {
 function runPowershellChecked(script) {
   const exe = pwshOrPowershell();
   try {
-    const r = spawnSync2(exe, ["-NoProfile", "-NonInteractive", "-Command", withSentinel(script)], {
+    const r = spawnSync3(exe, ["-NoProfile", "-NonInteractive", "-Command", withSentinel(script)], {
       encoding: "utf-8"
     });
     if (r.error) return { pids: [], ran: false };
@@ -3744,7 +4139,7 @@ function runPowershellChecked(script) {
   }
 }
 function pwshOrPowershell() {
-  const probe = spawnSync2("pwsh", ["-NoProfile", "-Command", "$PSVersionTable.PSVersion.Major"], {
+  const probe = spawnSync3("pwsh", ["-NoProfile", "-Command", "$PSVersionTable.PSVersion.Major"], {
     encoding: "utf-8"
   });
   if (probe.status === 0) return "pwsh";
@@ -3772,12 +4167,12 @@ function isAlive(pid) {
 
 // src/cli/commands/test.ts
 import { readdirSync as readdirSync4 } from "fs";
-import { join as join13, relative, resolve as resolve9, sep as sep2 } from "path";
-import { sync as spawnSync4 } from "cross-spawn";
+import { join as join14, relative as relative2, resolve as resolve10, sep as sep2 } from "path";
+import { sync as spawnSync5 } from "cross-spawn";
 
 // src/cli/lib/playwright.ts
 import { execSync } from "child_process";
-import { sync as spawnSync3 } from "cross-spawn";
+import { sync as spawnSync4 } from "cross-spawn";
 var childStdoutToStderr = false;
 function routeChildStdoutToStderr(enabled) {
   childStdoutToStderr = enabled;
@@ -3800,7 +4195,7 @@ function ensurePlaywright(appDir) {
       "Installing Chromium and its system libraries \u2014 this runs `apt-get` as root and can take several minutes on a cold machine."
     );
   }
-  const result = spawnSync3("npx", ["playwright", ...args], {
+  const result = spawnSync4("npx", ["playwright", ...args], {
     cwd: appDir,
     stdio: childStdio()
   });
@@ -3816,10 +4211,10 @@ function ensurePlaywright(appDir) {
 import { readFileSync as readFileSync12 } from "fs";
 
 // src/testing/accounts.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync5, readFileSync as readFileSync11 } from "fs";
+import { existsSync as existsSync15, mkdirSync as mkdirSync7, readFileSync as readFileSync11 } from "fs";
 import { homedir as homedir2 } from "os";
-import { join as join12 } from "path";
-var TEST_ACCOUNTS_PATH = join12(homedir2(), ".deepspace", "test-accounts.json");
+import { join as join13 } from "path";
+var TEST_ACCOUNTS_PATH = join13(homedir2(), ".deepspace", "test-accounts.json");
 var PRODUCTION_AUTH_ORIGIN = "https://auth.deep.space";
 var STAGING_AUTH_ORIGIN = "https://auth.deepspacesites.com";
 function currentTestAccountScope(env = process.env) {
@@ -3884,7 +4279,7 @@ function removeTestAccounts(ids, emails = [], scope = currentTestAccountScope())
   });
 }
 function readTestAccountStore() {
-  if (!existsSync13(TEST_ACCOUNTS_PATH)) return { version: 2, scopes: {} };
+  if (!existsSync15(TEST_ACCOUNTS_PATH)) return { version: 2, scopes: {} };
   try {
     const raw = JSON.parse(readFileSync11(TEST_ACCOUNTS_PATH, "utf-8"));
     if (Array.isArray(raw)) return { version: 2, scopes: {} };
@@ -3909,7 +4304,7 @@ function validTestAccounts(value) {
   );
 }
 function saveTestAccountStore(store) {
-  mkdirSync5(join12(homedir2(), ".deepspace"), { recursive: true });
+  mkdirSync7(join13(homedir2(), ".deepspace"), { recursive: true });
   writeSecretFileSync(TEST_ACCOUNTS_PATH, JSON.stringify(store, null, 2));
 }
 
@@ -3987,7 +4382,7 @@ async function syncTestAccountStore() {
 }
 
 // src/cli/commands/test.ts
-var DEPLOY_URL2 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
+var DEPLOY_URL3 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 var PLAYWRIGHT_OUTPUT_DIR = ".deepspace/test-results";
 var DEFAULT_SUITE_SPECS = ["tests/smoke.spec.ts", "tests/api.spec.ts"];
 function specsSkippedByDefaultSuite(appDir) {
@@ -4001,14 +4396,14 @@ function specsSkippedByDefaultSuite(appDir) {
     }
     for (const entry of entries) {
       if (entry.name === "node_modules" || entry.name.startsWith(".")) continue;
-      const full = join13(dir, entry.name);
+      const full = join14(dir, entry.name);
       if (entry.isDirectory()) walk(full);
       else if (entry.name.endsWith(".spec.ts")) {
-        found.push(relative(appDir, full).split(sep2).join("/"));
+        found.push(relative2(appDir, full).split(sep2).join("/"));
       }
     }
   };
-  walk(join13(appDir, "tests"));
+  walk(join14(appDir, "tests"));
   return found.filter((spec) => !DEFAULT_SUITE_SPECS.includes(spec)).sort();
 }
 function playwrightTestArgs(testFiles, flags = {}) {
@@ -4077,7 +4472,7 @@ var test_default = defineDeepspaceCommand({
       project: typeof args.project === "string" && args.project ? args.project : void 0,
       headed: Boolean(args.headed)
     };
-    const start = resolve9(".");
+    const start = resolve10(".");
     const appDir = findAppDir(start);
     if (!appDir) {
       throw noAppDirRefusal(start);
@@ -4085,7 +4480,7 @@ var test_default = defineDeepspaceCommand({
     const configuredPort = Boolean(args.port) || Boolean(process.env.DEEPSPACE_PORT);
     const worktreePort = configuredPort ? null : resolveWorktreePort(appDir);
     const port = worktreePort ?? resolvePort(args.port);
-    ensureInstallReady(appDir);
+    if (suite !== "unit") await ensurePortFree(port, "0.0.0.0");
     let token;
     let ownerId;
     try {
@@ -4099,11 +4494,20 @@ var test_default = defineDeepspaceCommand({
         { action: cliAction("deepspace", "auth", "login") }
       );
     }
+    ensureInstallReady(appDir);
     let generatedSecretsCache;
-    const appIdForSecrets = readAppId(appDir, wranglerEnv);
+    let appIdForSecrets = null;
+    try {
+      appIdForSecrets = (await ensureAppRegistered(appDir, token, wranglerEnv))?.appId ?? null;
+    } catch (registrationError) {
+      process.stderr.write(
+        `warning: could not register the app (${registrationError instanceof Error ? registrationError.message.split("\n")[0] : String(registrationError)}) \u2014 continuing without app secrets.
+`
+      );
+    }
     if (appIdForSecrets) {
       try {
-        const refreshed = await refreshSecretsCache(DEPLOY_URL2, token, appIdForSecrets, wranglerEnv);
+        const refreshed = await refreshSecretsCache(DEPLOY_URL3, token, appIdForSecrets, wranglerEnv);
         generatedSecretsCache = refreshed.rendered;
         if (refreshed.summary) say(refreshed.summary);
       } catch (err) {
@@ -4144,7 +4548,9 @@ var test_default = defineDeepspaceCommand({
         break;
       case "unit":
         if (forwarded.grep || forwarded.project || forwarded.headed) {
-          console.error("note: --grep/--project/--headed apply to Playwright suites and are ignored by `unit`");
+          console.error(
+            "note: --grep/--project/--headed apply to Playwright suites and are ignored by `unit`"
+          );
         }
         exitCode = runVitest(appDir, wranglerEnv);
         break;
@@ -4189,7 +4595,7 @@ function runSuite(appDir, argv, wranglerEnv, extraEnv = {}) {
     return 1;
   }
   try {
-    const result = spawnSync4("npx", argv, {
+    const result = spawnSync5("npx", argv, {
       cwd: appDir,
       // Under --json the child's stdout is routed to our stderr: the live
       // suite output stays visible and stdout stays a single JSON line.
@@ -4212,8 +4618,20 @@ function runVitest(appDir, wranglerEnv) {
 }
 
 // src/cli/commands/screenshot.ts
-import { sync as spawnSync5 } from "cross-spawn";
-import { resolve as resolve10 } from "path";
+import { sync as spawnSync6 } from "cross-spawn";
+import { resolve as resolve11 } from "path";
+var DEFAULT_SCREENSHOT_WAIT_MS = 1e3;
+function normalizeWaitTimeout(value) {
+  if (value === void 0) return DEFAULT_SCREENSHOT_WAIT_MS;
+  const text2 = String(value).trim();
+  if (!/^\d+$/.test(text2) || !Number.isSafeInteger(Number(text2))) {
+    throw new Refusal(
+      "Screenshot wait timeout must be a non-negative whole number of milliseconds.",
+      "invalid_wait_timeout"
+    );
+  }
+  return Number(text2);
+}
 function normalizeViewportSize(value) {
   if (value === void 0) return void 0;
   const match = /^(\d+)\s*[x,]\s*(\d+)$/i.exec(String(value).trim());
@@ -4255,25 +4673,32 @@ var screenshot_default = defineDeepspaceCommand({
     },
     "wait-for-timeout": {
       type: "string",
-      description: "Milliseconds to wait before capture",
+      description: `Milliseconds to settle before capture (default ${DEFAULT_SCREENSHOT_WAIT_MS}, 0 disables)`,
+      required: false
+    },
+    "wait-for-selector": {
+      type: "string",
+      description: "Visible selector to await before capture (off by default)",
       required: false
     }
   },
   async run({ args }) {
+    routeChildStdoutToStderr(args.json === true);
     const viewport = normalizeViewportSize(args.viewport);
-    const appDir = resolve10(".");
+    const waitForTimeout = normalizeWaitTimeout(args["wait-for-timeout"]);
+    const appDir = resolve11(".");
     ensurePlaywright(appDir);
     const url = String(args.url);
     const output = String(args.output);
     const playwrightArgs = ["playwright", "screenshot", url, output];
+    const waitForSelector = args["wait-for-selector"] === void 0 ? "" : String(args["wait-for-selector"]);
     if (args["full-page"]) playwrightArgs.push("--full-page");
     if (viewport) playwrightArgs.push("--viewport-size", viewport);
-    if (args["wait-for-timeout"] !== void 0) {
-      playwrightArgs.push("--wait-for-timeout", String(args["wait-for-timeout"]));
-    }
-    const result = spawnSync5("npx", playwrightArgs, {
+    if (waitForSelector) playwrightArgs.push("--wait-for-selector", waitForSelector);
+    if (waitForTimeout !== 0) playwrightArgs.push("--wait-for-timeout", String(waitForTimeout));
+    const result = spawnSync6("npx", playwrightArgs, {
       cwd: appDir,
-      stdio: "inherit"
+      stdio: childStdio()
     });
     if (result.status !== 0) {
       throw new Refusal(
@@ -4282,7 +4707,14 @@ var screenshot_default = defineDeepspaceCommand({
       );
     }
     return {
-      data: { url, output, fullPage: Boolean(args["full-page"]), viewport: viewport ?? null }
+      data: {
+        url,
+        output,
+        fullPage: Boolean(args["full-page"]),
+        viewport: viewport ?? null,
+        waitForSelector: waitForSelector || null,
+        waitForTimeout
+      }
     };
   }
 });
@@ -4303,8 +4735,13 @@ var create = defineDeepspaceCommand({
     },
     password: {
       type: "string",
-      description: "Password (min 8 characters)",
-      required: true
+      description: "Password (min 8 characters). Prefer --password-stdin \u2014 argv is visible in `ps` and shell history",
+      required: false
+    },
+    "password-stdin": {
+      type: "boolean",
+      description: "Read the password from stdin (one trailing newline stripped)",
+      default: false
     },
     name: {
       type: "string",
@@ -4320,7 +4757,26 @@ var create = defineDeepspaceCommand({
   async run({ args }) {
     await ensureToken();
     const email = args.email;
-    const password = args.password;
+    if (args["password-stdin"] && args.password !== void 0) {
+      throw new Refusal("Pass either --password or --password-stdin, not both.", "invalid_flags");
+    }
+    let password;
+    if (args["password-stdin"]) {
+      if (process.stdin.isTTY) {
+        throw new Refusal(
+          '--password-stdin expects the password piped on stdin, e.g. `printf %s "$PW" | deepspace test accounts create --email bot@deepspace.test --password-stdin`.',
+          "password_stdin_needs_pipe"
+        );
+      }
+      password = (await readStreamText(process.stdin, MAX_STDIN_BYTES)).replace(/\r?\n$/, "");
+    } else if (typeof args.password === "string") {
+      password = args.password;
+    } else {
+      throw new Refusal(
+        "A password is required: pipe it with --password-stdin (preferred), or pass --password.",
+        "missing_password"
+      );
+    }
     const name = args.name ?? email.split("@")[0];
     const label = args.label;
     let account;
@@ -4688,7 +5144,7 @@ var test_accounts_default = defineCommand2({
 // src/cli/commands/deploy.ts
 import * as p12 from "@clack/prompts";
 import { defineCommand as defineCommand3 } from "citty";
-import { join as join20, resolve as resolve15 } from "path";
+import { join as join21, resolve as resolve15 } from "path";
 
 // src/cli/lib/edge-propagation.ts
 import { request as httpRequest } from "http";
@@ -4852,11 +5308,11 @@ function describeFilesFailure(status3, body) {
 import * as p6 from "@clack/prompts";
 import { execSync as execSync2 } from "child_process";
 import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync17, readFileSync as readFileSync15, readdirSync as readdirSync6 } from "fs";
-import { dirname as dirname7, isAbsolute as isAbsolute3, join as join17, relative as relative2, resolve as resolve13, sep as sep3 } from "path";
+import { existsSync as existsSync19, readFileSync as readFileSync15, readdirSync as readdirSync6 } from "fs";
+import { dirname as dirname7, isAbsolute as isAbsolute4, join as join18, relative as relative3, resolve as resolve14, sep as sep3 } from "path";
 
 // src/build/app-id.ts
-import { resolve as resolve11 } from "path";
+import { resolve as resolve12 } from "path";
 var APP_ID_ADOPTION_EDITS = {
   "vite.config.ts": `import { deepspaceBuild } from 'deepspace/build' and add
     deepspaceBuild({ appDir: fileURLToPath(new URL('.', import.meta.url)) }) to plugins`,
@@ -4870,11 +5326,11 @@ var APP_ID_ADOPTION_STEPS = `Point the client at the build-injected id \u2014 th
 `).join("") + APP_ID_ADOPTION_TOGETHER;
 
 // src/build/plugin.ts
-import { existsSync as existsSync14, lstatSync, readdirSync as readdirSync5, unlinkSync as unlinkSync2 } from "fs";
-import { join as join14, resolve as resolve12 } from "path";
+import { existsSync as existsSync16, lstatSync, readdirSync as readdirSync5, unlinkSync as unlinkSync2 } from "fs";
+import { join as join15, resolve as resolve13 } from "path";
 function removeBuildDevVars(workerDir) {
-  const path = join14(workerDir, ".dev.vars");
-  if (!existsSync14(path)) return false;
+  const path = join15(workerDir, ".dev.vars");
+  if (!existsSync16(path)) return false;
   if (!lstatSync(path).isFile()) {
     throw new Error(`Refusing unsafe build secret path: ${path}`);
   }
@@ -4883,12 +5339,12 @@ function removeBuildDevVars(workerDir) {
 }
 
 // src/documentation/deploy.ts
-import { existsSync as existsSync15, readFileSync as readFileSync13 } from "fs";
-import { join as join15 } from "path";
+import { existsSync as existsSync17, readFileSync as readFileSync13 } from "fs";
+import { join as join16 } from "path";
 function readDocumentationDeployManifest(appDir, clientDir) {
-  if (!existsSync15(join15(appDir, "documentation.json"))) return void 0;
-  const manifestPath = join15(clientDir, "_documentation", "manifest.json");
-  if (!existsSync15(manifestPath)) {
+  if (!existsSync17(join16(appDir, "documentation.json"))) return void 0;
+  const manifestPath = join16(clientDir, "_documentation", "manifest.json");
+  if (!existsSync17(manifestPath)) {
     throw new Error(
       "documentation.json exists but the build produced no documentation manifest. Ensure vite.config.ts includes deepSpaceDocumentation() from deepspace/documentation."
     );
@@ -4897,8 +5353,8 @@ function readDocumentationDeployManifest(appDir, clientDir) {
 }
 
 // src/cli/commands/update/app-migrations.ts
-import { existsSync as existsSync16, readFileSync as readFileSync14 } from "fs";
-import { join as join16 } from "path";
+import { existsSync as existsSync18, readFileSync as readFileSync14 } from "fs";
+import { join as join17 } from "path";
 
 // src/shared/protocol/app-migrations.ts
 var APP_MIGRATION_ID_RE = /^[a-z0-9][a-z0-9._-]{0,127}$/;
@@ -4972,8 +5428,8 @@ var APP_MIGRATION_DEFINITIONS = APP_MIGRATION_GUIDANCE.map(({ id, description })
   description
 }));
 function readAppliedAppMigrations(appDir) {
-  const path = join16(appDir, APP_MIGRATIONS_MANIFEST);
-  if (!existsSync16(path)) return [];
+  const path = join17(appDir, APP_MIGRATIONS_MANIFEST);
+  if (!existsSync18(path)) return [];
   let parsed;
   try {
     parsed = JSON.parse(readFileSync14(path, "utf8"));
@@ -5035,16 +5491,16 @@ async function buildDeployBundle(options) {
     preparedWranglerConfig?.cleanup();
   }
   spinner2.stop(`Built (${Math.round((Date.now() - buildStarted) / 1e3)}s)`);
-  const deployConfigPath = join17(appDir, ".wrangler", "deploy", "config.json");
-  if (!existsSync17(deployConfigPath)) {
+  const deployConfigPath = join18(appDir, ".wrangler", "deploy", "config.json");
+  if (!existsSync19(deployConfigPath)) {
     output.die(
       "Build output config not found at .wrangler/deploy/config.json",
       "build_output_missing"
     );
   }
   const deployConfig = JSON.parse(readFileSync15(deployConfigPath, "utf-8"));
-  const outputWranglerPath = resolve13(dirname7(deployConfigPath), deployConfig.configPath);
-  if (!existsSync17(outputWranglerPath)) {
+  const outputWranglerPath = resolve14(dirname7(deployConfigPath), deployConfig.configPath);
+  if (!existsSync19(outputWranglerPath)) {
     output.die(`Output wrangler.json not found at ${outputWranglerPath}`, "build_output_missing");
   }
   const outputConfig = JSON.parse(readFileSync15(outputWranglerPath, "utf-8"));
@@ -5061,12 +5517,12 @@ async function buildDeployBundle(options) {
   } catch (error) {
     output.die(errorMessage(error), "build_output_unsafe");
   }
-  const workerBundlePath = join17(workerDir, outputConfig.main);
-  const clientDir = outputConfig.assets?.directory ? resolve13(workerDir, outputConfig.assets.directory) : null;
-  if (!existsSync17(workerBundlePath)) {
+  const workerBundlePath = join18(workerDir, outputConfig.main);
+  const clientDir = outputConfig.assets?.directory ? resolve14(workerDir, outputConfig.assets.directory) : null;
+  if (!existsSync19(workerBundlePath)) {
     output.die(`Worker bundle not found at ${workerBundlePath}`, "build_output_missing");
   }
-  if (!clientDir || !existsSync17(clientDir)) {
+  if (!clientDir || !existsSync19(clientDir)) {
     return output.die(`Client assets not found at ${clientDir}`, "build_output_missing");
   }
   try {
@@ -5134,16 +5590,16 @@ async function buildDeployBundle(options) {
 }
 var WORKER_ES_MODULE = /\.(?:js|mjs)$/i;
 function collectWorkerBundle(workerDir, mainPath, clientDir) {
-  const root = resolve13(workerDir);
-  const mainAbsolute = resolve13(mainPath);
-  const excludedClient = clientDir ? resolve13(clientDir) : null;
+  const root = resolve14(workerDir);
+  const mainAbsolute = resolve14(mainPath);
+  const excludedClient = clientDir ? resolve14(clientDir) : null;
   const main2 = moduleName(root, mainAbsolute);
   const modules = [];
   const walk = (directory) => {
     for (const entry of readdirSync6(directory, { withFileTypes: true }).sort(
       (a, b) => a.name.localeCompare(b.name)
     )) {
-      const fullPath = join17(directory, entry.name);
+      const fullPath = join18(directory, entry.name);
       if (excludedClient && isWithin(excludedClient, fullPath)) continue;
       if (entry.isDirectory()) {
         walk(fullPath);
@@ -5159,15 +5615,15 @@ function collectWorkerBundle(workerDir, mainPath, clientDir) {
   return { main: main2, modules: [mainModule, ...modules] };
 }
 function moduleName(root, path) {
-  const name = relative2(root, path);
-  if (!name || isAbsolute3(name) || name === ".." || name.startsWith(`..${sep3}`)) {
+  const name = relative3(root, path);
+  if (!name || isAbsolute4(name) || name === ".." || name.startsWith(`..${sep3}`)) {
     throw new Error(`Worker module is outside the generated output directory: ${path}`);
   }
   return name.split(sep3).join("/");
 }
 function isWithin(root, path) {
-  const name = relative2(root, path);
-  return name === "" || !isAbsolute3(name) && name !== ".." && !name.startsWith(`..${sep3}`);
+  const name = relative3(root, path);
+  return name === "" || !isAbsolute4(name) && name !== ".." && !name.startsWith(`..${sep3}`);
 }
 function extractRunWorkerFirst(config) {
   const raw = Array.isArray(config.assets?.run_worker_first) ? config.assets.run_worker_first : [];
@@ -5229,7 +5685,7 @@ function collectAssets(dir) {
   const walk = (currentDir, prefix) => {
     for (const entry of readdirSync6(currentDir, { withFileTypes: true })) {
       if (isDeployAssetControlFile(entry.name)) continue;
-      const fullPath = join17(currentDir, entry.name);
+      const fullPath = join18(currentDir, entry.name);
       const relativePath = prefix ? `${prefix}/${entry.name}` : entry.name;
       if (entry.isDirectory()) {
         walk(fullPath, relativePath);
@@ -5253,8 +5709,8 @@ function readDeployAssetConfig(clientDir) {
     ["_headers", "_headers"],
     ["_redirects", "_redirects"]
   ]) {
-    const filePath = join17(clientDir, file);
-    if (!existsSync17(filePath)) continue;
+    const filePath = join18(clientDir, file);
+    if (!existsSync19(filePath)) continue;
     const content = readFileSync15(filePath, "utf8");
     if (content.trim()) config[key] = content;
   }
@@ -5269,8 +5725,8 @@ function errorMessage(error) {
 
 // src/cli/commands/deploy/commerce.ts
 import * as p7 from "@clack/prompts";
-import { existsSync as existsSync18 } from "fs";
-import { join as join18 } from "path";
+import { existsSync as existsSync20 } from "fs";
+import { join as join19 } from "path";
 import { pathToFileURL as pathToFileURL2 } from "url";
 
 // src/shared/api-error.ts
@@ -5322,10 +5778,10 @@ function errorMessage2(error) {
   return error instanceof Error ? error.message : String(error);
 }
 async function loadDeclaration(appDir, sourceFile, outputFile, exportName) {
-  const sourcePath = join18(appDir, "src", sourceFile);
-  if (!existsSync18(sourcePath)) return void 0;
+  const sourcePath = join19(appDir, "src", sourceFile);
+  if (!existsSync20(sourcePath)) return void 0;
   const esbuild = await import("esbuild");
-  const outputPath = join18(appDir, ".wrangler", "deploy", outputFile);
+  const outputPath = join19(appDir, ".wrangler", "deploy", outputFile);
   await esbuild.build({
     entryPoints: [sourcePath],
     bundle: true,
@@ -5418,7 +5874,7 @@ Stripe will keep charging them until you cancel. Cancel at the end of their curr
   }
 }
 async function syncSubscriptionPlans(appDir, appName, token, nonInteractive) {
-  if (!existsSync18(join18(appDir, "src", "subscriptions.ts"))) return;
+  if (!existsSync20(join19(appDir, "src", "subscriptions.ts"))) return;
   let plans;
   try {
     plans = await loadDeclaration(
@@ -5473,7 +5929,7 @@ async function syncSubscriptionPlans(appDir, appName, token, nonInteractive) {
   }
 }
 async function syncOneTimeProducts(appDir, appName, token) {
-  if (!existsSync18(join18(appDir, "src", "products.ts"))) return;
+  if (!existsSync20(join19(appDir, "src", "products.ts"))) return;
   let products;
   try {
     products = await loadDeclaration(
@@ -5578,184 +6034,13 @@ function createDeployOutput(json) {
   };
 }
 
-// src/cli/commands/deploy/request.ts
-import * as p10 from "@clack/prompts";
-import { readFileSync as readFileSync16 } from "fs";
-
-// src/cli/commands/deploy/repository.ts
-import * as p9 from "@clack/prompts";
-
-// src/cli/lib/vc-remote.ts
-import { existsSync as existsSync19 } from "fs";
-import { tmpdir } from "os";
-import { isAbsolute as isAbsolute4, relative as relative3, resolve as resolve14 } from "path";
-function spaceRemoteName(environment = DEEPSPACE_ENV) {
-  if (environment === "staging") return "space-staging";
-  if (environment === "production") return "space";
-  return "space-invalid";
-}
-var SPACE_REMOTE = spaceRemoteName();
-function spaceTrackingRef(branch, remote = SPACE_REMOTE) {
-  return `refs/remotes/${remote}/${branch}`;
-}
-function spacePrivateRef(path, environment = DEEPSPACE_ENV) {
-  const root = environment === "production" ? "refs/deepspace" : `refs/deepspace/${environment}`;
-  return `${root}/${path}`;
-}
-function deployBaseUrl() {
-  return process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
-}
-function repoUrl(appId, base = deployBaseUrl()) {
-  return `${base.replace(/\/+$/, "")}/api/repo/${encodeURIComponent(appId)}`;
-}
-function gitAuthEnv(token, base = deployBaseUrl()) {
-  const existing = Number(process.env.GIT_CONFIG_COUNT ?? "0");
-  const index = Number.isInteger(existing) && existing > 0 ? existing : 0;
-  return {
-    GIT_CONFIG_COUNT: String(index + 1),
-    [`GIT_CONFIG_KEY_${index}`]: `http.${base.replace(/\/+$/, "")}.extraHeader`,
-    [`GIT_CONFIG_VALUE_${index}`]: `Authorization: Bearer ${token}`
-  };
-}
-function gitSourceImportEnv(token, revision, base = deployBaseUrl()) {
-  const env = gitAuthEnv(token, base);
-  const index = Number(env.GIT_CONFIG_COUNT);
-  return {
-    ...env,
-    GIT_CONFIG_COUNT: String(index + 1),
-    [`GIT_CONFIG_KEY_${index}`]: `http.${base.replace(/\/+$/, "")}.extraHeader`,
-    [`GIT_CONFIG_VALUE_${index}`]: `X-DeepSpace-Source-Revision: ${revision}`
-  };
-}
-function runGitRemote(cwd, token, args, opts = {}) {
-  return runGit(cwd, args, { ...opts, env: { ...gitAuthEnv(token), ...opts.env ?? {} } });
-}
-function entryIsTransient(cwd) {
-  const entry = process.argv[1];
-  if (!entry) return true;
-  if (/[\\/]_npx[\\/]/.test(entry) || entry.startsWith(tmpdir())) return true;
-  const rel = relative3(resolve14(cwd), resolve14(entry));
-  return rel === "" || !rel.startsWith("..") && !isAbsolute4(rel);
-}
-function helperEntryUsable(command) {
-  const match = /^!(?:DEEPSPACE_ENV=(production|staging) )?'([^']*)' '([^']*)' git-credential$/.exec(command);
-  const expectedEnvironment = DEEPSPACE_ENV === "production" ? void 0 : DEEPSPACE_ENV;
-  if (!match || match[1] !== expectedEnvironment) return false;
-  return existsSync19(match[2]) && existsSync19(match[3]);
-}
-function credentialHelperCommand(environment = DEEPSPACE_ENV) {
-  const entry = process.argv[1];
-  if (!entry) throw new Error("CLI entry path is unavailable");
-  const environmentPrefix = environment === "staging" ? "DEEPSPACE_ENV=staging " : "";
-  return `!${environmentPrefix}${shQuote(process.execPath)} ${shQuote(entry)} git-credential`;
-}
-function installCredentialHelper(cwd, url) {
-  try {
-    const origin = new URL(url);
-    const key = `credential.${origin.protocol}//${origin.host}.helper`;
-    const helper = credentialHelperCommand();
-    const wanted = ["", helper];
-    const transient = entryIsTransient(cwd);
-    const scope = transient ? "--worktree" : "--global";
-    if (transient) {
-      const enabled = runGit(cwd, ["config", "--local", "extensions.worktreeConfig", "true"], {
-        allowFail: true
-      });
-      if (enabled.status !== 0) return;
-      runGit(cwd, ["config", "--local", "--unset-all", key], { allowFail: true });
-    }
-    const current = runGit(cwd, ["config", scope, "--get-all", key], { allowFail: true });
-    if (current.status === 0) {
-      const existing = current.stdout.toString("utf-8").split("\n").filter((_, index, lines) => index < lines.length - 1);
-      if (existing.length === wanted.length && existing.every((value, i) => value === wanted[i])) {
-        return;
-      }
-      if (existing.length === wanted.length && existing[0] === "" && helperEntryUsable(existing[1])) {
-        return;
-      }
-      runGit(cwd, ["config", scope, "--unset-all", key], { allowFail: true });
-    }
-    runGit(cwd, ["config", scope, "--add", key, ""]);
-    runGit(cwd, ["config", scope, "--add", key, helper]);
-    if (scope === "--global" && !process.argv.includes("--json")) {
-      process.stderr.write(
-        `note: added a git credential helper for ${origin.host} to your global git config so plain \`git clone\`/\`git push\` to DeepSpace authenticate. Undo with: git config --global --unset-all ${key}
-`
-      );
-    }
-  } catch {
-  }
-}
-function ensureSpaceRemote(cwd, appId, remote = SPACE_REMOTE, token) {
-  const url = repoUrl(appId);
-  const current = runGit(cwd, ["remote", "get-url", remote], { allowFail: true });
-  const existing = current.status === 0 ? current.stdout.toString("utf-8").trim() : null;
-  if (appIdFromRepoUrl(existing ?? "") !== appId) {
-    const owned = declaredAppIds(cwd);
-    if (owned.size > 0 && !owned.has(appId)) {
-      throw new InputError(
-        `This checkout declares ${[...owned].join(", ")}, but this command targets ${appId}. Pointing its \`${remote}\` remote at another app would send every later plain \`git push ${remote}\` to the wrong repo. Work on ${appId} from its own checkout (\`deepspace clone ${appId}\` into a new directory), or fork THIS checkout into a brand-new app of your own with \`deepspace app init --new-id\`.`,
-        "app_checkout_mismatch"
-      );
-    }
-  }
-  if (token) ensureGitIdentity(cwd, token);
-  if (existing === null) {
-    runGit(cwd, ["remote", "add", remote, url]);
-  } else if (existing !== url) {
-    const priorApp = appIdFromRepoUrl(existing);
-    if (priorApp && priorApp !== appId && !process.argv.includes("--json")) {
-      process.stderr.write(
-        `warning: remote '${remote}' was pointed at app ${priorApp}; re-aiming it at ${appId}.
-`
-      );
-    }
-    runGit(cwd, ["remote", "set-url", remote, url]);
-  }
-  installCredentialHelper(cwd, url);
-  return url;
-}
-function removeSpaceRemote(cwd, remote = SPACE_REMOTE) {
-  const current = runGit(cwd, ["remote", "get-url", remote], { allowFail: true });
-  if (current.status !== 0) return false;
-  runGit(cwd, ["remote", "remove", remote]);
-  return true;
-}
-function ensureGitIdentity(cwd, token) {
-  try {
-    const configured = (key) => runGit(cwd, ["config", "--get", key], { allowFail: true }).stdout.toString("utf-8").trim() !== "";
-    const missingName = !configured("user.name");
-    const missingEmail = !configured("user.email");
-    if (!missingName && !missingEmail) return;
-    if (runGit(cwd, ["config", "--get", "--type=bool", "user.useConfigOnly"], { allowFail: true }).stdout.toString("utf-8").trim() === "true") {
-      return;
-    }
-    const payload = decodeJwtPayload(token);
-    if (!payload.email) return;
-    if (missingName) {
-      runGit(cwd, ["config", "--local", "user.name", payload.name || payload.email], {
-        allowFail: true
-      });
-    }
-    if (missingEmail) {
-      runGit(cwd, ["config", "--local", "user.email", payload.email], { allowFail: true });
-    }
-    const wrote = [...missingEmail ? ["user.email"] : [], ...missingName ? ["user.name"] : []];
-    const dir = /^[A-Za-z0-9_./:@-]+$/.test(cwd) ? cwd : shQuote(cwd);
-    const undo = wrote.map((key) => `git -C ${dir} config --local --unset ${key}`).join(" && ");
-    process.stderr.write(
-      `Git identity for this checkout set from your DeepSpace login (${payload.email}).
-  Undo with: ${undo}
-`
-    );
-  } catch {
-  }
-}
-function appIdFromRepoUrl(url) {
-  const match = /\/api\/repo\/([^/]+)\/?$/.exec(url);
-  return match ? decodeURIComponent(match[1]) : null;
-}
-
+// src/cli/commands/deploy/request.ts
+import * as p10 from "@clack/prompts";
+import { readFileSync as readFileSync16 } from "fs";
+
+// src/cli/commands/deploy/repository.ts
+import * as p9 from "@clack/prompts";
+
 // src/cli/lib/git/safety.ts
 var SECRET_FILE_RE = /(^|\/)(\.dev\.vars(\.[^/]*)?|\.env(\.[^/]*)?|\.npmrc|\.envrc|\.mcp\.json)$/i;
 var SECRET_TEMPLATE_RE = /\.(example|sample|template)$/i;
@@ -6196,41 +6481,6 @@ function selectGitHubRemote(cwd, options = {}) {
   const matching = repository ? remotes.filter((remote) => remote.repository === repository) : remotes;
   return matching.find((remote) => remote.name === "origin") ?? (matching.length === 1 ? matching[0] : null);
 }
-function remotePublicRefs(cwd, remote) {
-  let output;
-  try {
-    output = runGit(cwd, ["ls-remote", "--refs", remote]).stdout.toString("utf-8");
-  } catch (error) {
-    if (!isGitCredentialFailure(error)) throw error;
-    throw new GitError(
-      "Git could not authenticate the remote. In a container, forward an SSH agent or use an ephemeral Git credential helper, then retry. Do not put tokens in remote URLs.",
-      "github_credentials_required"
-    );
-  }
-  return output.split("\n").map((line) => line.trim()).filter(Boolean).map((line) => {
-    const [oid, name] = line.split(/\s+/, 2);
-    return { oid, name };
-  }).filter(
-    (ref) => /^[0-9a-f]{40}$/.test(ref.oid) && (ref.name.startsWith("refs/heads/") || ref.name.startsWith("refs/tags/"))
-  );
-}
-function isGitCredentialFailure(error) {
-  if (!(error instanceof Error)) return false;
-  return /authentication failed|could not read username|permission denied \(publickey\)|repository not found|terminal prompts disabled/i.test(
-    error.message
-  );
-}
-function localTransferRefs(cwd, prefix, target2) {
-  const output = runGit(cwd, [
-    "for-each-ref",
-    "--format=%(refname) %(objectname)",
-    prefix
-  ]).stdout.toString("utf-8");
-  return output.split("\n").map((line) => line.trim()).filter(Boolean).map((line) => {
-    const [name, oid] = line.split(/\s+/, 2);
-    return { name: `${target2}/${name.slice(`${prefix}/`.length)}`, oid };
-  }).filter((ref) => /^[0-9a-f]{40}$/.test(ref.oid));
-}
 
 // src/cli/commands/deploy/repository.ts
 function describeWorktree(appDir) {
@@ -6240,17 +6490,27 @@ function describeWorktree(appDir) {
     return { branch: null, dirty: null };
   }
 }
+function externalGitSource(appDir, source) {
+  if (source?.provider === "github") return true;
+  if (source !== null) return false;
+  try {
+    return listGitHubRemotes(appDir).length > 0;
+  } catch {
+    return false;
+  }
+}
+function observedGitHubRepository(appDir) {
+  try {
+    return selectGitHubRemote(appDir)?.repository ?? listGitHubRemotes(appDir)[0]?.repository ?? null;
+  } catch {
+    return null;
+  }
+}
 function preflightDeployRepository(options) {
   const { appDir, push, source } = options;
-  if (!push || source?.provider === "github") return null;
+  if (!push || externalGitSource(appDir, source)) return null;
   try {
     assertSyncableRepo(appDir);
-    if (!source && listGitHubRemotes(appDir).length > 0) {
-      return {
-        code: "source_unclaimed",
-        error: "This app has a GitHub remote but no claimed source. Choose once with `deepspace app source github` (manual GitHub ownership) or `deepspace app source deepspace` (packaged DeepSpace source), then deploy again."
-      };
-    }
     assertNoOperationInProgress(appDir);
     const branch = currentBranch(appDir);
     if (!isWorkTreeClean(appDir)) return dirtyWorktreeRefusal(branch, appDir);
@@ -6267,9 +6527,18 @@ async function syncDeployRepository(options) {
   const deployKey = mintIdempotencyKey();
   let source = sourceState.source;
   let sourceRevision = sourceState.revision;
-  const baseReleaseId = null;
   const worktree = describeWorktree(appDir);
-  if (source?.provider === "github") {
+  const external = externalGitSource(appDir, source);
+  if (external) {
+    if (sourceState.source?.provider === "github") {
+      try {
+        if (removeSpaceRemote(appDir)) {
+          p9.log.info(`Removed the stale \`space\` git remote \u2014 GitHub owns this app's source.`);
+        }
+      } catch {
+      }
+    }
+    const observedRepository = source === null ? observedGitHubRepository(appDir) : null;
     const where = `GitHub source: shipping the working tree of ${worktree.branch ?? "(detached HEAD)"}`;
     if (worktree.dirty) {
       p9.log.warn(
@@ -6278,7 +6547,7 @@ async function syncDeployRepository(options) {
     } else {
       p9.log.info(`${where} (clean). GitHub-source releases record no commit lineage.`);
     }
-    return { commitOid, recoverable, deployKey, source, sourceRevision, baseReleaseId, ...worktree };
+    return { commitOid, recoverable, deployKey, source, sourceRevision, observedRepository, ...worktree };
   }
   if (!push) {
     try {
@@ -6286,7 +6555,12 @@ async function syncDeployRepository(options) {
       commitOid = resolveCommit(appDir, "HEAD");
     } catch {
     }
-    return { commitOid, recoverable, deployKey, source, sourceRevision, baseReleaseId, ...worktree };
+    if (worktree.dirty) {
+      p9.log.warn(
+        `--no-push: shipping the working tree WITH uncommitted changes \u2014 the recorded commit ${commitOid ? commitOid.slice(0, 10) : ""} is not exactly what went live.`
+      );
+    }
+    return { commitOid, recoverable, deployKey, source, sourceRevision, observedRepository: null, ...worktree };
   }
   try {
     const preflight = preflightDeployRepository({ appDir, push, source });
@@ -6302,7 +6576,7 @@ async function syncDeployRepository(options) {
     }
     const tip = resolveCommit(appDir, `refs/heads/${branch}`);
     if (!tip) {
-      return { commitOid, recoverable, deployKey, source, sourceRevision, baseReleaseId, ...worktree };
+      return { commitOid, recoverable, deployKey, source, sourceRevision, observedRepository: null, ...worktree };
     }
     const secretFiles = workspaceBranchId ? [] : trackedSecretFiles(appDir, tip);
     if (workspaceBranchId) {
@@ -6331,6 +6605,11 @@ async function syncDeployRepository(options) {
         `Skipping cloud-repo push \u2014 the branch tracks secret file(s): ${secretFiles.join(", ")}. ` + secretRecoverySentence(secretFiles, "`deepspace push`") + ` Without the push this deploy carries no source lineage: if the live release has one, the server refuses it as stale (--ignore-stale replaces it anyway), and this release's source isn't recoverable until the push works.`
       );
     } else {
+      if (sourceState.source === null) {
+        process.stderr.write(
+          "This app's source is unclaimed \u2014 this deploy's push claims DeepSpace source for it, permanently.\n"
+        );
+      }
       const pushResult = await pushWithTransientRetry(
         () => pushToSpace(appDir, token, `refs/heads/${branch}:refs/heads/${branch}`, {
           remote: sourceRemote
@@ -6391,7 +6670,7 @@ async function syncDeployRepository(options) {
     const failure = deployRepositoryFailure(error, appDir);
     output.die(failure.error, failure.code);
   }
-  return { commitOid, recoverable, deployKey, source, sourceRevision, baseReleaseId, ...worktree };
+  return { commitOid, recoverable, deployKey, source, sourceRevision, observedRepository: null, ...worktree };
 }
 function classifyRemoteState(appDir, token, branch, localTip, remote) {
   let remoteTip = null;
@@ -6617,7 +6896,10 @@ async function deployBuiltBundle(options) {
         form.append("sourceRepository", repository.source.repository);
       }
     }
-    if (repository.baseReleaseId) form.append("baseReleaseId", repository.baseReleaseId);
+    if (repository.dirty !== null) form.append("sourceDirty", repository.dirty ? "true" : "false");
+    if (repository.observedRepository) {
+      form.append("observedRepository", repository.observedRepository);
+    }
     if (ignoreStale) form.append("ignoreStale", "true");
     form.append("deployKey", repository.deployKey);
     return form;
@@ -6951,21 +7233,21 @@ function errorMessage5(error) {
 
 // src/cli/commands/deploy/lock.ts
 import { randomUUID as randomUUID2 } from "crypto";
-import { mkdirSync as mkdirSync6, readFileSync as readFileSync17, rmSync as rmSync4, writeFileSync as writeFileSync5 } from "fs";
-import { dirname as dirname8, join as join19 } from "path";
+import { mkdirSync as mkdirSync8, readFileSync as readFileSync17, rmSync as rmSync6, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname8, join as join20 } from "path";
 function deployLockPath(appDir) {
-  return join19(appDir, ".deepspace", "deploy.lock");
+  return join20(appDir, ".deepspace", "deploy.lock");
 }
 function acquireDeployLock(appDir) {
   const path = deployLockPath(appDir);
-  mkdirSync6(dirname8(path), { recursive: true });
+  mkdirSync8(dirname8(path), { recursive: true });
   const record = {
     pid: process.pid,
     startedAt: (/* @__PURE__ */ new Date()).toISOString(),
     token: randomUUID2()
   };
   try {
-    writeFileSync5(path, JSON.stringify(record), { flag: "wx" });
+    writeFileSync6(path, JSON.stringify(record), { flag: "wx" });
   } catch (err) {
     if (err.code !== "EEXIST") throw err;
     const holder = readLock(path);
@@ -6981,7 +7263,7 @@ function acquireDeployLock(appDir) {
     );
   }
   return () => {
-    if (readLock(path)?.token === record.token) rmSync4(path, { force: true });
+    if (readLock(path)?.token === record.token) rmSync6(path, { force: true });
   };
 }
 function readLock(path) {
@@ -6994,7 +7276,7 @@ function readLock(path) {
 }
 
 // src/cli/commands/deploy.ts
-var DEPLOY_URL3 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
+var DEPLOY_URL4 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 var DEPLOY_TOKEN_MIN_VALIDITY_MS = 10 * 60 * 1e3;
 var POST_DEPLOY_TOKEN_MIN_VALIDITY_MS = 2 * 60 * 1e3;
 var deploy_default = defineCommand3({
@@ -7047,6 +7329,7 @@ var deploy_default = defineCommand3({
   },
   async run({ args }) {
     const output = createDeployOutput(args.json === true);
+    setPlainProgress(output.json);
     try {
       await runDeploy(args, output);
     } catch (error) {
@@ -7067,15 +7350,7 @@ async function runDeploy(args, output) {
   if (selectorRefusal) output.die(selectorRefusal.error, selectorRefusal.code);
   const envName = typeof args.env === "string" && args.env.trim() ? args.env.trim() : void 0;
   if (!hasWranglerConfig(appDir)) {
-    output.die(noWranglerConfigMessage(join20(appDir, "wrangler.toml")), "not_in_app_repo");
-  }
-  try {
-    ensureInstallReady(appDir);
-  } catch (error) {
-    const refusal = error;
-    output.die(refusal.message ?? String(error), refusal.code ?? "deps_missing", {
-      action: refusal.action
-    });
+    output.die(noWranglerConfigMessage(join21(appDir, "wrangler.toml")), "not_in_app_repo");
   }
   const releaseLock = acquireDeployLock(appDir);
   try {
@@ -7099,24 +7374,30 @@ async function runLockedDeploy(args, output, appDir, envName) {
     );
   }
   const appName = nameResult.name;
-  const appId = readAppId(appDir, envName);
+  let appId = readAppId(appDir, envName);
   p12.log.info(envName ? `App: ${appName}  (env: ${envName})` : `App: ${appName}`);
   const { token, ownerId } = await authenticate(appDir, output);
+  try {
+    ensureInstallReady(appDir);
+  } catch (error) {
+    const refusal = error;
+    return output.die(refusal.message ?? String(error), refusal.code ?? "install_failed", {
+      action: refusal.action
+    });
+  }
   if (!appId) {
-    return output.die(
-      `No app id in wrangler.toml${envName ? ` for [env.${envName}]` : ""}. Run \`deepspace app init${envName ? ` --env ${envName}` : ""}\` to register this app, then re-deploy.`,
-      "app_not_initialized",
-      {
-        action: {
-          cwd: appDir,
-          argv: ["deepspace", "app", "init", ...envName ? ["--env", envName] : []]
-        },
-        actionRequired: true
-      }
-    );
+    const ensured = await ensureAppRegistered(appDir, token, envName, { commitScaffold: true });
+    if (!ensured) {
+      return output.die(
+        envName ? `No app id for [env.${envName}] \u2014 declare the [env.${envName}] block with its own DEEPSPACE_APP_ID entry (the \`__APP_ID__\` placeholder is enough), or run \`deepspace app init --env ${envName}\`.` : "wrangler.toml declares no DEEPSPACE_APP_ID \u2014 this does not look like a DeepSpace app. Run `deepspace app init` to register it as one.",
+        envName ? "no_app_id_for_env" : "app_not_initialized"
+      );
+    }
+    appId = ensured.appId;
   }
+  commitScaffoldIfUnborn(appDir, token);
   p12.log.info(`Id: ${appId}`);
-  const sourceState = await getAppSource(DEPLOY_URL3, token, appId).catch((error) => {
+  const sourceState = await getAppSource(DEPLOY_URL4, token, appId).catch((error) => {
     if (errorCode(error) === "forbidden") {
       output.die(forbiddenDeployMessage(appId, token), "forbidden");
     }
@@ -7129,7 +7410,7 @@ async function runLockedDeploy(args, output, appDir, envName) {
     );
   }
   const secretsCache = await loadDeploySecrets({
-    deployUrl: DEPLOY_URL3,
+    deployUrl: DEPLOY_URL4,
     appDir,
     appId,
     envName,
@@ -7173,7 +7454,7 @@ async function runLockedDeploy(args, output, appDir, envName) {
   }
   const { token: deployToken } = await authenticate(appDir, output, DEPLOY_TOKEN_MIN_VALIDITY_MS);
   const repository = await syncDeployRepository({
-    deployUrl: DEPLOY_URL3,
+    deployUrl: DEPLOY_URL4,
     appDir,
     appId,
     token: deployToken,
@@ -7189,7 +7470,7 @@ async function runLockedDeploy(args, output, appDir, envName) {
     output
   });
   const body = await deployBuiltBundle({
-    deployUrl: DEPLOY_URL3,
+    deployUrl: DEPLOY_URL4,
     appDir,
     appId,
     appName,
@@ -7342,7 +7623,7 @@ async function authenticate(appDir, output, minimumValidityMs) {
 
 // src/cli/commands/undeploy.ts
 import * as p13 from "@clack/prompts";
-var DEPLOY_URL4 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
+var DEPLOY_URL5 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 var undeploy_default = defineDeepspaceCommand({
   meta: {
     name: "undeploy",
@@ -7361,7 +7642,8 @@ var undeploy_default = defineDeepspaceCommand({
     },
     yes: {
       type: "boolean",
-      description: "Skip the interactive confirmation. (Scripts and --json callers are never prompted; the command itself is their consent.)",
+      alias: "y",
+      description: "Skip the confirmation (required for --json / non-interactive)",
       default: false
     }
   },
@@ -7379,7 +7661,7 @@ var undeploy_default = defineDeepspaceCommand({
     let label;
     const positional = typeof args.name === "string" && args.name.trim() ? args.name.trim() : void 0;
     if (positional) {
-      appId = await resolveAppSelector(DEPLOY_URL4, token, positional);
+      appId = await resolveAppSelector(DEPLOY_URL5, token, positional);
       label = positional;
     } else if (hasWranglerConfig(process.cwd())) {
       appId = readAppId(process.cwd(), envName) ?? void 0;
@@ -7393,6 +7675,13 @@ var undeploy_default = defineDeepspaceCommand({
       );
     }
     const target2 = label && label !== appId ? `${label} (${appId})` : appId;
+    if (args.yes !== true && (args.json === true || !process.stdin.isTTY)) {
+      throw new Refusal(
+        `Undeploying ${target2} takes its URL offline immediately and destroys its live data \u2014 records, messages, canvas state, cron history \u2014 with the worker (secrets and the registration stay). Re-run with --yes to confirm.`,
+        "confirmation_required",
+        { extra: { appId } }
+      );
+    }
     if (!args.json && !args.yes && process.stdin.isTTY) {
       p13.intro(`Undeploying ${target2}`);
       const confirmed = await p13.confirm({
@@ -7407,7 +7696,7 @@ var undeploy_default = defineDeepspaceCommand({
     }
     const s = args.json ? null : createSpinner();
     s?.start("Removing...");
-    const res = await fetch(`${DEPLOY_URL4}/api/deploy/${appId}`, {
+    const res = await fetch(`${DEPLOY_URL5}/api/deploy/${appId}`, {
       method: "DELETE",
       headers: { Authorization: `Bearer ${token}` }
     });
@@ -7492,7 +7781,7 @@ var whoami_default = defineDeepspaceCommand({
 });
 
 // src/cli/commands/apps.ts
-var DEPLOY_URL5 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
+var DEPLOY_URL6 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 var apps_default = defineDeepspaceCommand({
   meta: {
     name: "apps",
@@ -7500,7 +7789,7 @@ var apps_default = defineDeepspaceCommand({
   },
   async run({ args }) {
     const token = await ensureToken();
-    const { apps, pendingTransfers } = await listAppsPage(DEPLOY_URL5, token);
+    const { apps, pendingTransfers } = await listAppsPage(DEPLOY_URL6, token);
     if (!args.json) {
       if (!apps.length && !pendingTransfers.length) {
         console.log("No apps yet. Create one with `npx create-deepspace <name>` and `deepspace deploy`.");
@@ -7558,7 +7847,7 @@ import { setTimeout as delay } from "timers/promises";
 var LOG_LEVELS = ["debug", "log", "info", "warn", "error"];
 
 // src/cli/commands/logs.ts
-var DEPLOY_URL6 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
+var DEPLOY_URL7 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 var RETENTION_MS = 7 * 24 * 60 * 60 * 1e3;
 var DEFAULT_WINDOW_MS = 15 * 60 * 1e3;
 var MIN_POLL_MS = 2500;
@@ -7719,7 +8008,7 @@ var logs_default = defineCommand4({
     const envArg = args.env;
     assertAppTargetResolvable(args.app, { wranglerEnv: envArg });
     const token = await ensureToken();
-    const appId = await resolveAppTarget(DEPLOY_URL6, token, args.app, { wranglerEnv: envArg });
+    const appId = await resolveAppTarget(DEPLOY_URL7, token, args.app, { wranglerEnv: envArg });
     if (args.level && !LOG_LEVELS.includes(args.level)) {
       throw new InputError(
         `Invalid --level "${args.level}". Use: ${LOG_LEVELS.join(", ")}`,
@@ -7738,7 +8027,7 @@ var logs_default = defineCommand4({
     }
     const initialSince = args.since ? parseSince(args.since) : Date.now() - DEFAULT_WINDOW_MS;
     const windowLabel = args.since?.trim() || "15m";
-    const registryRow = (await listApps(DEPLOY_URL6, token)).find((app2) => app2.appId === appId);
+    const registryRow = (await listApps(DEPLOY_URL7, token)).find((app2) => app2.appId === appId);
     if (registryRow && registryRow.deployedAt === null) {
       const appDir = args.app === void 0 ? findAppDir() : null;
       throw new Refusal(
@@ -7760,7 +8049,7 @@ var logs_default = defineCommand4({
       if (args.level) params.set("level", args.level);
       if (args.search) params.set("search", args.search);
       const path = `/api/apps/${appId}/logs?${params}`;
-      return signal ? apiFetch(DEPLOY_URL6, token2, path, { signal }) : apiFetchReadWithRetry(DEPLOY_URL6, token2, path);
+      return signal ? apiFetch(DEPLOY_URL7, token2, path, { signal }) : apiFetchReadWithRetry(DEPLOY_URL7, token2, path);
     };
     const print = (events) => {
       for (const e of events) {
@@ -7911,6 +8200,8 @@ function formatDate(iso) {
 function renderSummary(summary) {
   const { credits, usageByIntegration } = summary;
   const lines = [];
+  lines.push("Account usage (all apps)");
+  lines.push("");
   const renews = credits.subscription.renewsAt ? ` \xB7 renews ${formatDate(credits.subscription.renewsAt)}` : "";
   lines.push(`Plan:     ${credits.subscription.tier}${renews}`);
   lines.push(
@@ -7939,7 +8230,9 @@ function renderSummary(summary) {
     const nameWidth = Math.max(11, ...usageByIntegration.map((u) => u.name.length));
     lines.push(`${"INTEGRATION".padEnd(nameWidth)}  CALLS  COST`);
     for (const u of usageByIntegration) {
-      lines.push(`${u.name.padEnd(nameWidth)}  ${String(u.count).padEnd(5)}  ${formatUsd(u.totalCost)}`);
+      lines.push(
+        `${u.name.padEnd(nameWidth)}  ${String(u.count).padEnd(5)}  ${formatUsd(u.totalCost)}`
+      );
     }
   }
   lines.push("");
@@ -7949,46 +8242,46 @@ function renderSummary(summary) {
 var usage_default = defineDeepspaceCommand({
   meta: {
     name: "usage",
-    description: "Show credit balance, quota headroom, and per-integration spend"
+    description: "Show account-wide credits and integration spend (all apps)"
   },
   async run({ args }) {
     const token = await ensureToken();
     const summary = await apiFetch(API_URL3, token, "/api/usage/summary");
     if (!args.json) console.log(renderSummary(summary));
-    return { data: { ...summary } };
+    return { data: { scope: "account", ...summary } };
   }
 });
 
 // src/cli/commands/add.ts
-import { existsSync as existsSync21, readFileSync as readFileSync19, realpathSync as realpathSync4 } from "fs";
-import { dirname as dirname10, join as join22, resolve as resolve17 } from "path";
+import { existsSync as existsSync22, readFileSync as readFileSync19, realpathSync as realpathSync4 } from "fs";
+import { dirname as dirname10, join as join23, resolve as resolve17 } from "path";
 import { pathToFileURL as pathToFileURL3 } from "url";
 
 // src/cli/commands/feature-installer.ts
 import {
-  closeSync,
+  closeSync as closeSync2,
   copyFileSync,
-  existsSync as existsSync20,
+  existsSync as existsSync21,
   fstatSync,
-  mkdirSync as mkdirSync7,
+  mkdirSync as mkdirSync9,
   mkdtempSync,
-  openSync,
+  openSync as openSync2,
   readFileSync as readFileSync18,
   readSync,
   readdirSync as readdirSync7,
-  rmSync as rmSync5,
-  writeFileSync as writeFileSync6
+  rmSync as rmSync7,
+  writeFileSync as writeFileSync7
 } from "fs";
-import { spawnSync as spawnSync6 } from "child_process";
+import { spawnSync as spawnSync7 } from "child_process";
 import { tmpdir as tmpdir2 } from "os";
-import { dirname as dirname9, isAbsolute as isAbsolute5, join as join21, resolve as resolve16 } from "path";
+import { dirname as dirname9, isAbsolute as isAbsolute5, join as join22, resolve as resolve16 } from "path";
 import { fileURLToPath } from "url";
 var NAV_MARKER = "// \u2500\u2500 Features add nav items below this line \u2500\u2500";
 function featurePackageRoot(moduleUrl = import.meta.url) {
   let dir = dirname9(fileURLToPath(moduleUrl));
   for (; ; ) {
-    const packagePath = join21(dir, "package.json");
-    if (existsSync20(packagePath)) {
+    const packagePath = join22(dir, "package.json");
+    if (existsSync21(packagePath)) {
       try {
         const pkg2 = JSON.parse(readFileSync18(packagePath, "utf-8"));
         if (pkg2.name === "deepspace") return dir;
@@ -8001,11 +8294,11 @@ function featurePackageRoot(moduleUrl = import.meta.url) {
   }
 }
 function hasFeatureCatalog(packageRoot = featurePackageRoot()) {
-  return existsSync20(join21(packageRoot, "features"));
+  return existsSync21(join22(packageRoot, "features"));
 }
 function readFeatureConfig(id, packageRoot = featurePackageRoot()) {
-  const configPath = join21(packageRoot, "features", id, "feature.json");
-  if (!existsSync20(configPath)) return null;
+  const configPath = join22(packageRoot, "features", id, "feature.json");
+  if (!existsSync21(configPath)) return null;
   try {
     const config = JSON.parse(readFileSync18(configPath, "utf-8"));
     if (typeof config.id !== "string" || typeof config.name !== "string" || !Array.isArray(config.files)) {
@@ -8017,8 +8310,8 @@ function readFeatureConfig(id, packageRoot = featurePackageRoot()) {
   }
 }
 function listFeatureConfigs(packageRoot = featurePackageRoot()) {
-  const featuresDir = join21(packageRoot, "features");
-  if (!existsSync20(featuresDir)) return [];
+  const featuresDir = join22(packageRoot, "features");
+  if (!existsSync21(featuresDir)) return [];
   return readdirSync7(featuresDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => readFeatureConfig(entry.name, packageRoot)).filter((config) => config !== null && !config.internal).sort((a, b) => a.id.localeCompare(b.id));
 }
 function featureCatalog(packageRoot = featurePackageRoot()) {
@@ -8066,17 +8359,17 @@ function resolveFeatureDestPath(fileDest, route) {
   return route?.protected === false ? `${appPages}${rest}` : `${appPages}(protected)/${rest}`;
 }
 function copyFile(src, dest) {
-  mkdirSync7(dirname9(dest), { recursive: true });
+  mkdirSync9(dirname9(dest), { recursive: true });
   copyFileSync(src, dest);
 }
 function copyFileWithImportShift(src, dest, levels) {
-  mkdirSync7(dirname9(dest), { recursive: true });
+  mkdirSync9(dirname9(dest), { recursive: true });
   const prefix = "../".repeat(levels);
   const shifted = readFileSync18(src, "utf-8").replace(
     /(from\s+|import\s+|import\()(['"])(\.\.\/)/g,
     `$1$2${prefix}$3`
   );
-  writeFileSync6(dest, shifted);
+  writeFileSync7(dest, shifted);
 }
 function installFiles(packageRoot, config, targetDir, emit) {
   let copied = 0;
@@ -8085,12 +8378,12 @@ function installFiles(packageRoot, config, targetDir, emit) {
   const preexisting = [];
   const missing = [];
   for (const file of config.files) {
-    const srcPath = join21(packageRoot, "features", config.id, file.src);
+    const srcPath = join22(packageRoot, "features", config.id, file.src);
     const resolvedDest = resolveFeatureDestPath(file.dest, config.route);
-    const destPath = join21(targetDir, resolvedDest);
-    const existed = existsSync20(destPath);
+    const destPath = join22(targetDir, resolvedDest);
+    const existed = existsSync21(destPath);
     if (existed) preexisting.push(resolvedDest);
-    if (!existsSync20(srcPath)) {
+    if (!existsSync21(srcPath)) {
       emit(`   Warning: source not found: ${file.src}`, "stderr");
       if (!existed) missing.push(resolvedDest);
       continue;
@@ -8127,8 +8420,8 @@ function unresolvedSchema(schema, reason, emit) {
 }
 function integrateSchema(config, targetDir, emit) {
   if (!config.schema) return [];
-  const schemasPath = join21(targetDir, "src", "schemas.ts");
-  if (!existsSync20(schemasPath)) {
+  const schemasPath = join22(targetDir, "src", "schemas.ts");
+  if (!existsSync21(schemasPath)) {
     return [unresolvedSchema(config.schema, "src/schemas.ts was not found.", emit)];
   }
   let content = readFileSync18(schemasPath, "utf-8");
@@ -8162,7 +8455,7 @@ export const schemas`
     return [unresolvedSchema(config.schema, reason, emit)];
   }
   content = withEntry;
-  writeFileSync6(schemasPath, content);
+  writeFileSync7(schemasPath, content);
   emit(`   Schema integrated: ${exportName} -> schemas.ts`);
   return [];
 }
@@ -8184,8 +8477,8 @@ function unresolvedActions(actions, reason, emit) {
 }
 function integrateActions(config, targetDir, emit) {
   if (!config.actions?.length) return [];
-  const actionsPath = join21(targetDir, "src", "actions", "index.ts");
-  if (!existsSync20(actionsPath)) {
+  const actionsPath = join22(targetDir, "src", "actions", "index.ts");
+  if (!existsSync21(actionsPath)) {
     return [unresolvedActions(config.actions, "src/actions/index.ts was not found.", emit)];
   }
   let content = readFileSync18(actionsPath, "utf-8");
@@ -8228,14 +8521,14 @@ ${registryEntry}`);
     integrated++;
     emit(`   Action integrated: ${action.registerAs} (${action.exportName})`);
   }
-  if (integrated > 0) writeFileSync6(actionsPath, content);
+  if (integrated > 0) writeFileSync7(actionsPath, content);
   return unresolved;
 }
 function integrateCode(config, targetDir, emit) {
   const unresolved = [];
   for (const insertion of config.code ?? []) {
-    const targetPath = join21(targetDir, insertion.file);
-    if (!existsSync20(targetPath)) {
+    const targetPath = join22(targetDir, insertion.file);
+    if (!existsSync21(targetPath)) {
       unresolved.push({
         area: "code",
         reason: `${insertion.file} was not found.`,
@@ -8273,32 +8566,32 @@ ${content.slice(
     const prefix = insertion.placement === "before" ? "" : "\n";
     const suffix = insertion.placement === "before" ? "\n" : "";
     content = `${content.slice(0, insertAt)}${prefix}${insertion.insert}${suffix}${content.slice(insertAt)}`;
-    writeFileSync6(targetPath, content);
+    writeFileSync7(targetPath, content);
     emit(`   Integrated: ${insertion.file}`);
   }
   return unresolved;
 }
 function integrateIgnore(config, targetDir) {
   if (!config.ignore?.length) return;
-  const targetPath = join21(targetDir, ".gitignore");
-  const current = existsSync20(targetPath) ? readFileSync18(targetPath, "utf-8") : "";
+  const targetPath = join22(targetDir, ".gitignore");
+  const current = existsSync21(targetPath) ? readFileSync18(targetPath, "utf-8") : "";
   const present = new Set(current.split(/\r?\n/).map((line) => line.trim()));
   const missing = config.ignore.filter((pattern) => !present.has(pattern));
   if (missing.length === 0) return;
   const separator = current === "" || current.endsWith("\n") ? "" : "\n";
-  writeFileSync6(targetPath, `${current}${separator}${missing.join("\n")}
+  writeFileSync7(targetPath, `${current}${separator}${missing.join("\n")}
 `);
 }
 function integrateWrangler(config, targetDir, emit) {
   const runWorkerFirst = config.wrangler?.runWorkerFirst === true;
   const rateLimits = config.wrangler?.rateLimits ?? [];
   if (!runWorkerFirst && rateLimits.length === 0) return [];
-  const targetPath = join21(targetDir, "wrangler.toml");
+  const targetPath = join22(targetDir, "wrangler.toml");
   const steps = [
     ...runWorkerFirst ? ["Set assets.run_worker_first = true in wrangler.toml."] : [],
     ...rateLimits.map((binding) => `Add the ${binding.name} rate-limit binding to wrangler.toml.`)
   ];
-  if (!existsSync20(targetPath)) {
+  if (!existsSync21(targetPath)) {
     return [{ area: "wrangler", reason: "wrangler.toml was not found.", steps }];
   }
   let source = readFileSync18(targetPath, "utf-8");
@@ -8323,7 +8616,7 @@ ${rateLimitBindingBlock(scope, binding)}
     }
   }
   if (changed) {
-    writeFileSync6(targetPath, source);
+    writeFileSync7(targetPath, source);
     emit("   Integrated: wrangler.toml");
   } else emit("   Integration already present: wrangler.toml");
   return [];
@@ -8377,8 +8670,8 @@ function rateLimitBindingBlock(scope, binding) {
 }
 function integrateCss(packageRoot, config, targetDir, emit) {
   if (!config.css?.length) return [];
-  const stylesPath = join21(targetDir, "src", "styles.css");
-  if (!existsSync20(stylesPath)) {
+  const stylesPath = join22(targetDir, "src", "styles.css");
+  if (!existsSync21(stylesPath)) {
     emit("   Warning: Cannot integrate CSS \u2014 src/styles.css not found");
     return [
       {
@@ -8394,8 +8687,8 @@ function integrateCss(packageRoot, config, targetDir, emit) {
   let integrated = 0;
   const unresolved = [];
   for (const cssFile of config.css) {
-    const srcPath = join21(packageRoot, "features", config.id, cssFile);
-    if (!existsSync20(srcPath)) {
+    const srcPath = join22(packageRoot, "features", config.id, cssFile);
+    if (!existsSync21(srcPath)) {
       emit(`   Warning: CSS source not found: ${cssFile}`, "stderr");
       unresolved.push({
         area: "css",
@@ -8416,7 +8709,7 @@ ${css}`;
     integrated++;
     emit(`   CSS integrated: ${cssFile} -> styles.css`);
   }
-  if (integrated > 0) writeFileSync6(stylesPath, styles);
+  if (integrated > 0) writeFileSync7(stylesPath, styles);
   return unresolved;
 }
 function unresolvedRoute(route, config, reason, emit) {
@@ -8438,8 +8731,8 @@ function routeRolesSuffix(route) {
 }
 function integrateRoute(config, targetDir, emit) {
   if (!config.route) return [];
-  const navPath = join21(targetDir, "src", "nav.ts");
-  if (!existsSync20(navPath)) {
+  const navPath = join22(targetDir, "src", "nav.ts");
+  if (!existsSync21(navPath)) {
     return [unresolvedRoute(config.route, config, "src/nav.ts was not found.", emit)];
   }
   let content = readFileSync18(navPath, "utf-8");
@@ -8463,7 +8756,7 @@ function integrateRoute(config, targetDir, emit) {
   const entry = `  { path: '${routePath}', label: '${config.name}'${roles} },`;
   content = content.replace(NAV_MARKER, `${NAV_MARKER}
 ${entry}`);
-  writeFileSync6(navPath, content);
+  writeFileSync7(navPath, content);
   emit(`   Nav wired: ${routePath} (${config.name})`);
   emit("   Route: automatic (file-based routing via src/pages/)");
   return [];
@@ -8486,14 +8779,14 @@ function runPackageInstall(packageManager, targetDir, outputVisible) {
     shell: process.platform === "win32"
   };
   if (outputVisible) {
-    const child = spawnSync6(packageManager, ["install"], { ...options, stdio: "inherit" });
+    const child = spawnSync7(packageManager, ["install"], { ...options, stdio: "inherit" });
     return { error: child.error, status: child.status };
   }
-  const captureDir = mkdtempSync(join21(tmpdir2(), "deepspace-add-install-"));
+  const captureDir = mkdtempSync(join22(tmpdir2(), "deepspace-add-install-"));
   let outputFd;
   try {
-    outputFd = openSync(join21(captureDir, "output.log"), "w+");
-    const child = spawnSync6(packageManager, ["install"], {
+    outputFd = openSync2(join22(captureDir, "output.log"), "w+");
+    const child = spawnSync7(packageManager, ["install"], {
       ...options,
       stdio: ["ignore", outputFd, outputFd]
     });
@@ -8503,8 +8796,8 @@ function runPackageInstall(packageManager, targetDir, outputVisible) {
       diagnosticTail: readDiagnosticTail(outputFd)
     };
   } finally {
-    if (outputFd !== void 0) closeSync(outputFd);
-    rmSync5(captureDir, { recursive: true, force: true });
+    if (outputFd !== void 0) closeSync2(outputFd);
+    rmSync7(captureDir, { recursive: true, force: true });
   }
 }
 function integrateDependencies(config, targetDir, runInstall, outputVisible, emit) {
@@ -8516,8 +8809,8 @@ function integrateDependencies(config, targetDir, runInstall, outputVisible, emi
   if (declarations.every(({ values }) => !values || Object.keys(values).length === 0)) {
     return { added: [], installRan: false, packageManager };
   }
-  const packagePath = join21(targetDir, "package.json");
-  if (!existsSync20(packagePath)) {
+  const packagePath = join22(targetDir, "package.json");
+  if (!existsSync21(packagePath)) {
     emit("   Could not patch package.json (file not found)");
     return { added: [], installRan: false, packageManager };
   }
@@ -8547,7 +8840,7 @@ function integrateDependencies(config, targetDir, runInstall, outputVisible, emi
   if (added.length === 0) {
     emit("   Dependencies already present");
   } else {
-    writeFileSync6(packagePath, `${JSON.stringify(pkg2, null, 2)}
+    writeFileSync7(packagePath, `${JSON.stringify(pkg2, null, 2)}
 `, "utf-8");
     emit(`   Added to package.json: ${added.map(({ name }) => name).join(", ")}`);
     if (skipped.length) emit(`   Already present (kept your version): ${skipped.join(", ")}`);
@@ -8583,7 +8876,7 @@ ${child.diagnosticTail}` : "";
 }
 function dependencySnapshot(targetDir) {
   try {
-    const pkg2 = JSON.parse(readFileSync18(join21(targetDir, "package.json"), "utf-8"));
+    const pkg2 = JSON.parse(readFileSync18(join22(targetDir, "package.json"), "utf-8"));
     return {
       dependencies: pkg2.dependencies ?? {},
       devDependencies: pkg2.devDependencies ?? {}
@@ -8595,7 +8888,7 @@ function dependencySnapshot(targetDir) {
 function installedNavFeatures(packageRoot, targetDir) {
   return listFeatureConfigs(packageRoot).filter((feature) => feature.category === "nav" && feature.files.length > 0).filter((feature) => {
     const signature = resolveFeatureDestPath(feature.files[0].dest, feature.route);
-    return existsSync20(join21(targetDir, signature));
+    return existsSync21(join22(targetDir, signature));
   }).map((feature) => feature.id);
 }
 function warnNavConflicts(packageRoot, config, targetDir, emit) {
@@ -8828,9 +9121,9 @@ function renderFeatureInfo(config) {
   return lines.join("\n");
 }
 function isDeepSpaceApp(dir) {
-  if (existsSync21(join22(dir, "wrangler.toml"))) return true;
-  const packagePath = join22(dir, "package.json");
-  if (!existsSync21(packagePath)) return false;
+  if (existsSync22(join23(dir, "wrangler.toml"))) return true;
+  const packagePath = join23(dir, "package.json");
+  if (!existsSync22(packagePath)) return false;
   try {
     const pkg2 = JSON.parse(readFileSync19(packagePath, "utf-8"));
     return Boolean(pkg2.dependencies?.deepspace || pkg2.devDependencies?.deepspace);
@@ -8841,8 +9134,8 @@ function isDeepSpaceApp(dir) {
 function installedPackageRoot(fromDir) {
   let dir = fromDir;
   for (; ; ) {
-    const candidate = join22(dir, "node_modules", "deepspace");
-    if (existsSync21(join22(candidate, "package.json"))) return candidate;
+    const candidate = join23(dir, "node_modules", "deepspace");
+    if (existsSync22(join23(candidate, "package.json"))) return candidate;
     const parent = dirname10(dir);
     if (parent === dir) return null;
     dir = parent;
@@ -8859,9 +9152,9 @@ async function targetInstaller(appDir) {
   if (realpathSync4(installedRoot) === realpathSync4(featurePackageRoot())) {
     return { installFeature };
   }
-  const entry = join22(installedRoot, "dist", "feature-installer.js");
-  const catalog = join22(installedRoot, "features");
-  if (!existsSync21(entry) || !existsSync21(catalog)) {
+  const entry = join23(installedRoot, "dist", "feature-installer.js");
+  const catalog = join23(installedRoot, "features");
+  if (!existsSync22(entry) || !existsSync22(catalog)) {
     throw new Refusal(
       `The app's installed deepspace package does not contain the typed feature installer.
 Expected: ${entry}
@@ -8954,7 +9247,7 @@ var add_default = defineDeepspaceCommand({
       return { data: { features: featureCatalog(root) } };
     }
     const appDir = resolve17(args.dir ?? ".");
-    if (!existsSync21(appDir)) {
+    if (!existsSync22(appDir)) {
       throw new Refusal(
         `Target directory not found: ${appDir}
 Create a new app first: deepspace app create <name>`,
@@ -9012,7 +9305,7 @@ Create one with: deepspace app create <name>`,
 // src/cli/commands/domain.ts
 import { defineCommand as defineCommand5 } from "citty";
 var API_URL4 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
-var DEPLOY_URL7 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
+var DEPLOY_URL8 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 var api = (token, path, init) => apiFetch(API_URL4, token, path, init);
 function scrubInternal(value) {
   if (Array.isArray(value)) return value.map(scrubInternal);
@@ -9093,7 +9386,7 @@ var buy = defineDeepspaceCommand({
   async run({ args }) {
     const domain = String(args.domain);
     const token = await ensureToken();
-    const appId = await resolveAppTarget(DEPLOY_URL7, token, args.app);
+    const appId = await resolveAppTarget(DEPLOY_URL8, token, args.app);
     const priceCheck = await api(token, "/api/domains/check", {
       method: "POST",
       body: JSON.stringify({ domains: [domain] })
@@ -9246,7 +9539,7 @@ var attach = defineDeepspaceCommand({
     const domain = String(args.domain);
     const token = await ensureToken();
     const targetAppId = await resolveAppTarget(
-      DEPLOY_URL7,
+      DEPLOY_URL8,
       token,
       args.app
     );
@@ -9330,10 +9623,10 @@ var domain_default = defineCommand5({
 // src/cli/commands/app-files.ts
 import { defineCommand as defineCommand6 } from "citty";
 import { basename as basename4, resolve as resolve18 } from "path";
-import { existsSync as existsSync22, statSync as statSync2 } from "fs";
+import { existsSync as existsSync23, statSync as statSync4 } from "fs";
 
 // src/cli/lib/app-files-api.ts
-import { createWriteStream, openAsBlob, statSync } from "fs";
+import { createWriteStream, openAsBlob, statSync as statSync3 } from "fs";
 import { basename as basename3, extname } from "path";
 import { Readable } from "stream";
 import { pipeline } from "stream/promises";
@@ -9443,7 +9736,7 @@ Content-Type: ${contentType}\r
 }
 async function uploadAppFile(baseUrl, token, appId, localPath, key, onProgress) {
   const path = filesPath(appId, `/upload?key=${encodeKeyPath(key)}`);
-  const size = statSync(localPath).size;
+  const size = statSync3(localPath).size;
   if (size > MAX_APP_FILE_BYTES) {
     throw new ApiError(oversizeMessage(size), 0, "too_large", path);
   }
@@ -9561,11 +9854,11 @@ async function downloadAppFile(baseUrl, token, appId, key, destination) {
 }
 
 // src/cli/commands/app-files.ts
-var DEPLOY_URL8 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
+var DEPLOY_URL9 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 var PLATFORM_URL = process.env.DEEPSPACE_PLATFORM_URL ?? PLATFORM_URLS.platform;
 async function target(app2) {
   const token = await ensureToken();
-  const appId = await resolveAppTarget(DEPLOY_URL8, token, app2);
+  const appId = await resolveAppTarget(DEPLOY_URL9, token, app2);
   return { token, appId };
 }
 var MAX_LIST_LIMIT = 1e3;
@@ -9609,7 +9902,7 @@ var put = defineDeepspaceCommand({
   },
   async run({ args }) {
     const localPath = resolve18(String(args.file));
-    if (!existsSync22(localPath) || !statSync2(localPath).isFile()) {
+    if (!existsSync23(localPath) || !statSync4(localPath).isFile()) {
       throw new Refusal(`No such file: ${args.file}`, "file_not_found");
     }
     const key = requireKey(args.key ?? basename4(localPath));
@@ -9752,7 +10045,7 @@ function isTestAccountEmail(email) {
 
 // src/cli/commands/collaborators.ts
 var API_URL5 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
-var DEPLOY_URL9 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
+var DEPLOY_URL10 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 var COLLABORATOR_GRANTS = ["deploy", "secrets:read", "secrets:write"];
 var COLLABORATOR_GRANT_SENTENCE = `grants ${COLLABORATOR_GRANTS.join(", ")} \u2014 they can deploy the app AND read and change every app secret in plaintext; they cannot undeploy or transfer it`;
 function api2(token, path, init) {
@@ -9765,7 +10058,7 @@ var list4 = defineDeepspaceCommand({
   },
   async run({ args }) {
     const token = await ensureToken();
-    const app2 = await resolveAppTarget(DEPLOY_URL9, token, args.app);
+    const app2 = await resolveAppTarget(DEPLOY_URL10, token, args.app);
     const { collaborators, pending = [] } = await api2(token, `/api/app-collaborators/${encodeURIComponent(app2)}`);
     if (!collaborators.length && !pending.length) {
       if (!args.json) {
@@ -9782,8 +10075,8 @@ var list4 = defineDeepspaceCommand({
       }
       if (pending.length) {
         console.log(`PENDING INVITES ON ${app2}`);
-        for (const p36 of pending) {
-          console.log(`  ${p36.email} (expires ${new Date(p36.expiresAt).toLocaleDateString()})`);
+        for (const p35 of pending) {
+          console.log(`  ${p35.email} (expires ${new Date(p35.expiresAt).toLocaleDateString()})`);
         }
       }
     }
@@ -9806,7 +10099,7 @@ var add = defineDeepspaceCommand({
   async run({ args }) {
     const email = String(args.email);
     const token = await ensureToken();
-    const app2 = await resolveAppTarget(DEPLOY_URL9, token, args.app);
+    const app2 = await resolveAppTarget(DEPLOY_URL10, token, args.app);
     if (isTestAccountEmail(email)) {
       throw new Refusal(
         "Test accounts (@deepspace.test) cannot be added as collaborators. Use a real DeepSpace account.",
@@ -9853,7 +10146,7 @@ var remove = defineDeepspaceCommand({
   async run({ args }) {
     const email = String(args.email);
     const token = await ensureToken();
-    const app2 = await resolveAppTarget(DEPLOY_URL9, token, args.app);
+    const app2 = await resolveAppTarget(DEPLOY_URL10, token, args.app);
     const { collaborators } = await api2(
       token,
       `/api/app-collaborators/${encodeURIComponent(app2)}`
@@ -9883,13 +10176,13 @@ var cancel3 = defineDeepspaceCommand({
   async run({ args }) {
     const email = String(args.email);
     const token = await ensureToken();
-    const app2 = await resolveAppTarget(DEPLOY_URL9, token, args.app);
+    const app2 = await resolveAppTarget(DEPLOY_URL10, token, args.app);
     const { pending = [] } = await api2(
       token,
       `/api/app-collaborators/${encodeURIComponent(app2)}`
     );
     const target2 = email.trim().toLowerCase();
-    const found = pending.find((p36) => p36.email.toLowerCase() === target2);
+    const found = pending.find((p35) => p35.email.toLowerCase() === target2);
     if (!found) {
       throw new Refusal(`${email} has no pending invite on ${app2}`, "no_pending_invite", {
         action: cliAction("deepspace", "app", "collaborators", "list", "--app", app2)
@@ -9963,7 +10256,7 @@ var collaborators_default = defineCommand7({
 import { defineCommand as defineCommand8 } from "citty";
 import * as p14 from "@clack/prompts";
 var API_URL6 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
-var DEPLOY_URL10 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
+var DEPLOY_URL11 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 var offer = defineDeepspaceCommand({
   meta: { name: "offer", description: "Offer this app to another DeepSpace user" },
   args: {
@@ -9977,7 +10270,7 @@ var offer = defineDeepspaceCommand({
   async run({ args }) {
     const email = String(args.email);
     const token = await ensureToken();
-    const app2 = await resolveAppTarget(DEPLOY_URL10, token, args.app);
+    const app2 = await resolveAppTarget(DEPLOY_URL11, token, args.app);
     const pending = await apiFetch(
       API_URL6,
       token,
@@ -10033,7 +10326,7 @@ var status2 = defineDeepspaceCommand({
   },
   async run({ args }) {
     const token = await ensureToken();
-    const app2 = await resolveAppTarget(DEPLOY_URL10, token, args.app);
+    const app2 = await resolveAppTarget(DEPLOY_URL11, token, args.app);
     const { transfer } = await apiFetch(API_URL6, token, `/api/app-transfers/${encodeURIComponent(app2)}`);
     if (!transfer) {
       if (!args.json) console.log(`No pending transfer for ${app2}.`);
@@ -10062,7 +10355,7 @@ var accept2 = defineDeepspaceCommand({
       const msg = err instanceof Error ? err.message : String(err);
       throw new Refusal(msg, msg.startsWith("No app id") ? "not_in_app_repo" : "invalid_app");
     }
-    const { replayed, acceptedAt, inheritedCollaborators } = await apiFetch(DEPLOY_URL10, token, `/api/apps/${encodeURIComponent(app2)}/transfer/accept`, {
+    const { replayed, acceptedAt, inheritedCollaborators } = await apiFetch(DEPLOY_URL11, token, `/api/apps/${encodeURIComponent(app2)}/transfer/accept`, {
       method: "POST"
     });
     if (!args.json) {
@@ -10097,7 +10390,7 @@ var cancel4 = defineDeepspaceCommand({
   },
   async run({ args }) {
     const token = await ensureToken();
-    const app2 = await resolveAppTarget(DEPLOY_URL10, token, args.app);
+    const app2 = await resolveAppTarget(DEPLOY_URL11, token, args.app);
     await apiFetch(API_URL6, token, `/api/app-transfers/${encodeURIComponent(app2)}`, { method: "DELETE" });
     if (!args.json) console.log(`\u2713 Transfer offer for ${app2} cancelled.`);
     return { data: { app: app2, cancelled: true } };
@@ -10491,8 +10784,8 @@ var integrations_default = defineCommand9({
 
 // src/cli/commands/feedback.ts
 import * as p16 from "@clack/prompts";
-import { existsSync as existsSync23, readFileSync as readFileSync21 } from "fs";
-import { dirname as dirname11, join as join23 } from "path";
+import { existsSync as existsSync24, readFileSync as readFileSync21 } from "fs";
+import { dirname as dirname11, join as join24 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { release } from "os";
 var API_URL8 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
@@ -10515,11 +10808,11 @@ function readCliVersion() {
   try {
     const here = dirname11(fileURLToPath2(import.meta.url));
     const candidates = [
-      join23(here, "..", "package.json"),
-      join23(here, "..", "..", "..", "package.json")
+      join24(here, "..", "package.json"),
+      join24(here, "..", "..", "..", "package.json")
     ];
     for (const path of candidates) {
-      if (!existsSync23(path)) continue;
+      if (!existsSync24(path)) continue;
       const pkg2 = JSON.parse(readFileSync21(path, "utf-8"));
       if (pkg2.name === "deepspace" && pkg2.version) return pkg2.version;
     }
@@ -10750,7 +11043,7 @@ function parseCursorArg(raw) {
 }
 
 // src/cli/commands/secrets.ts
-var DEPLOY_URL11 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
+var DEPLOY_URL12 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 var COMMON_ARGS = {
   app: {
     type: "string",
@@ -10776,12 +11069,13 @@ var COMMON_ARGS = {
     default: false
   }
 };
-async function resolveTarget(args) {
-  assertAppTargetResolvable(args.app, { wranglerEnv: args.env });
+async function resolveTarget(args, opts = {}) {
+  const register = opts.register === true;
+  assertAppTargetResolvable(args.app, { wranglerEnv: args.env, register });
   const { wranglerEnv } = parseWranglerEnvArg(args.env);
   const configName = validateConfigName(args.config?.trim() || defaultConfigNameForEnv(wranglerEnv));
   const token = await ensureToken();
-  const appId = await resolveAppTarget(DEPLOY_URL11, token, args.app, { wranglerEnv });
+  const appId = await resolveAppTarget(DEPLOY_URL12, token, args.app, { wranglerEnv, register });
   return { appId, configName, token };
 }
 function ok(json, data, human) {
@@ -10810,7 +11104,7 @@ var list6 = defineCommand10({
   },
   async run({ args }) {
     const t = await resolveTarget(args);
-    const { secrets } = await listSecrets(DEPLOY_URL11, t.token, t.appId, t.configName);
+    const { secrets } = await listSecrets(DEPLOY_URL12, t.token, t.appId, t.configName);
     if (args.json) {
       console.log(JSON.stringify({ ok: true, appId: t.appId, config: t.configName, secrets }));
       return;
@@ -10831,7 +11125,7 @@ var set = defineCommand10({
     secret: { type: "positional", description: "KEY=value (repeatable)", required: true }
   },
   async run({ args }) {
-    const t = await resolveTarget(args);
+    const t = await resolveTarget(args, { register: true });
     const pairs = dedupePositionals(args.secret, args._);
     const secrets = {};
     const dupes = [];
@@ -10851,9 +11145,9 @@ var set = defineCommand10({
     }
     if (Object.keys(secrets).length === 1) {
       const [[k, v]] = Object.entries(secrets);
-      await setSecret(DEPLOY_URL11, t.token, t.appId, t.configName, k, v);
+      await setSecret(DEPLOY_URL12, t.token, t.appId, t.configName, k, v);
     } else {
-      await uploadSecrets(DEPLOY_URL11, t.token, t.appId, t.configName, secrets, false);
+      await uploadSecrets(DEPLOY_URL12, t.token, t.appId, t.configName, secrets, false);
     }
     const n = Object.keys(secrets).length;
     ok(
@@ -10886,11 +11180,11 @@ var get2 = defineCommand10({
     const t = await resolveTarget(args);
     const key = validateSecretName(args.key);
     if (args.plain) {
-      const { value } = await getSecretPlain(DEPLOY_URL11, t.token, t.appId, t.configName, key);
+      const { value } = await getSecretPlain(DEPLOY_URL12, t.token, t.appId, t.configName, key);
       process.stdout.write(process.stdout.isTTY ? value + "\n" : value);
       return;
     }
-    const { secrets } = await listSecrets(DEPLOY_URL11, t.token, t.appId, t.configName);
+    const { secrets } = await listSecrets(DEPLOY_URL12, t.token, t.appId, t.configName);
     const item = secrets.find((s) => s.key === key);
     if (!item)
       throw new InputError(`Secret "${key}" not found in ${t.configName}`, "secret_not_found");
@@ -10921,7 +11215,7 @@ var del2 = defineCommand10({
     for (const key of keys) {
       const name = validateSecretName(key);
       try {
-        const result = await deleteSecret(DEPLOY_URL11, t.token, t.appId, t.configName, name);
+        const result = await deleteSecret(DEPLOY_URL12, t.token, t.appId, t.configName, name);
         if (result.deleted === false) absent++;
         else deleted++;
       } catch (err) {
@@ -10959,11 +11253,11 @@ var upload = defineCommand10({
     }
   },
   async run({ args }) {
-    const t = await resolveTarget(args);
+    const t = await resolveTarget(args, { register: true });
     const secrets = parseSecretsUpload(await readUploadSource(String(args.file)));
     if (Object.keys(secrets).length === 0)
       throw new InputError("No secrets found in the input.", "empty_input");
-    await uploadSecrets(DEPLOY_URL11, t.token, t.appId, t.configName, secrets, args.replace);
+    await uploadSecrets(DEPLOY_URL12, t.token, t.appId, t.configName, secrets, args.replace);
     const uploaded = Object.keys(secrets);
     ok(
       args.json === true,
@@ -11038,7 +11332,7 @@ var download = defineCommand10({
         "invalid_format"
       );
     }
-    const { secrets } = await fetchSecretsValues(DEPLOY_URL11, t.token, t.appId, t.configName);
+    const { secrets } = await fetchSecretsValues(DEPLOY_URL12, t.token, t.appId, t.configName);
     process.stdout.write(formatSecretsDownload(secrets, format));
   }
 });
@@ -11053,10 +11347,10 @@ var pull = defineCommand10({
         "Run from a DeepSpace app directory (one containing wrangler.toml).",
         "not_in_app_repo"
       );
-    const t = await resolveTarget(args);
+    const t = await resolveTarget(args, { register: true });
     const ownerId = decodeJwtPayload(t.token).sub;
     const refreshed = await refreshSecretsCache(
-      DEPLOY_URL11,
+      DEPLOY_URL12,
       t.token,
       t.appId,
       wranglerEnv,
@@ -11081,7 +11375,7 @@ var configsList = defineCommand10({
   args: { ...COMMON_ARGS },
   async run({ args }) {
     const t = await resolveTarget(args);
-    const { configs: configs2 } = await listConfigs(DEPLOY_URL11, t.token, t.appId);
+    const { configs: configs2 } = await listConfigs(DEPLOY_URL12, t.token, t.appId);
     ok(args.json === true, { appId: t.appId, configs: configs2 }, () => {
       if (configs2.length === 0) {
         console.log("No configs yet \u2014 the first `secrets set` creates one.");
@@ -11101,10 +11395,10 @@ var configsCreate = defineCommand10({
     "copy-from": { type: "string", description: "Copy secrets from this config", required: false }
   },
   async run({ args }) {
-    const t = await resolveTarget(args);
+    const t = await resolveTarget(args, { register: true });
     const name = validateConfigName(args.name);
     const copyFrom = args["copy-from"] || void 0;
-    const { configs: configs2 } = await listConfigs(DEPLOY_URL11, t.token, t.appId);
+    const { configs: configs2 } = await listConfigs(DEPLOY_URL12, t.token, t.appId);
     if (configs2.some((c) => c.name === name)) {
       if (copyFrom) {
         throw new InputError(
@@ -11119,7 +11413,7 @@ var configsCreate = defineCommand10({
       );
       return;
     }
-    await createConfig(DEPLOY_URL11, t.token, t.appId, name, copyFrom);
+    await createConfig(DEPLOY_URL12, t.token, t.appId, name, copyFrom);
     ok(
       args.json === true,
       { appId: t.appId, config: name, created: true, ...copyFrom ? { copyFrom } : {} },
@@ -11151,7 +11445,7 @@ var configsDelete = defineCommand10({
     let secrets = [];
     let counted = true;
     try {
-      secrets = (await listSecrets(DEPLOY_URL11, t.token, t.appId, name)).secrets;
+      secrets = (await listSecrets(DEPLOY_URL12, t.token, t.appId, name)).secrets;
     } catch (error) {
       if (args.yes !== true) throw error;
       counted = false;
@@ -11167,7 +11461,7 @@ var configsDelete = defineCommand10({
         throw new InputError("Cancelled.", "confirmation_required");
       }
     }
-    await deleteConfig(DEPLOY_URL11, t.token, t.appId, name);
+    await deleteConfig(DEPLOY_URL12, t.token, t.appId, name);
     ok(
       args.json === true,
       { appId: t.appId, config: name, deleted: true, secretsDeleted: counted ? count : null },
@@ -11196,32 +11490,7 @@ var secrets_default = defineCommand10({
 });
 
 // src/cli/commands/init.ts
-import { existsSync as existsSync24 } from "fs";
-import { join as join24 } from "path";
-var DEPLOY_URL12 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
-function wranglerConfigUncommitted(appDir) {
-  if (!existsSync24(join24(appDir, ".git"))) return false;
-  const dryRun = runGit(appDir, ["commit", "--dry-run", "-m", "x", "--", "wrangler.toml"], {
-    allowFail: true
-  });
-  return dryRun.status === 0;
-}
-function commitScaffoldIfUnborn(appDir, token) {
-  try {
-    if (!existsSync24(join24(appDir, ".git"))) return false;
-    if (runGit(appDir, ["rev-parse", "--verify", "HEAD"], { allowFail: true }).status === 0) {
-      return false;
-    }
-    ensureGitIdentity(appDir, token);
-    if (runGit(appDir, ["add", "-A"], { allowFail: true }).status !== 0) return false;
-    const commit = runGit(appDir, ["commit", "-m", "Initial DeepSpace scaffold", "--no-verify"], {
-      allowFail: true
-    });
-    return commit.status === 0;
-  } catch {
-    return false;
-  }
-}
+var DEPLOY_URL13 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 var init_default = defineDeepspaceCommand({
   meta: {
     name: "init",
@@ -11262,7 +11531,7 @@ var init_default = defineDeepspaceCommand({
       const token2 = await ensureToken();
       let state;
       try {
-        state = await getAppSource(DEPLOY_URL12, token2, existing);
+        state = await getAppSource(DEPLOY_URL13, token2, existing);
       } catch (error) {
         if (error instanceof ApiError && error.code === "forbidden") {
           throw new Refusal(
@@ -11287,15 +11556,17 @@ var init_default = defineDeepspaceCommand({
           }
         );
       }
+      const healedScaffold = commitScaffoldIfUnborn(appDir, token2);
       if (!args.json) {
         console.log(
-          `Already initialized: ${existing}${envName ? ` (env: ${envName})` : ""} \u2014 registered on ${DEEPSPACE_ENV}`
+          `Already initialized: ${existing}${envName ? ` (env: ${envName})` : ""} \u2014 registered on ${DEEPSPACE_ENV}` + (healedScaffold ? " \u2014 initial scaffold commit created." : "")
         );
         console.log(`App dir: ${appDir}`);
       }
       return {
         data: {
           status: "already_initialized",
+          ...healedScaffold ? { committedScaffold: true } : {},
           appId: existing,
           appDir,
           env: DEEPSPACE_ENV,
@@ -11304,11 +11575,11 @@ var init_default = defineDeepspaceCommand({
       };
     }
     const token = await ensureToken();
-    const { appId } = await apiFetch(DEPLOY_URL12, token, "/api/apps/mint", {
-      method: "POST"
+    const { appId, committedScaffold } = await mintAppIdentity(appDir, token, {
+      wranglerEnv: envName,
+      force: Boolean(args["new-id"]),
+      commitScaffold: true
     });
-    writeAppId(appDir, appId, { wranglerEnv: envName, force: Boolean(args["new-id"]) });
-    const committedScaffold = commitScaffoldIfUnborn(appDir, token);
     if (!args.json) {
       const envSuffix = envName ? ` (env: ${envName})` : "";
       const commitNote = committedScaffold ? " \u2014 initial scaffold commit created." : " \u2014 commit wrangler.toml.";
@@ -11484,7 +11755,7 @@ var status_default = defineCommand11({
       const { appName, appId, appIdError } = resolveStatusApp(appDir, wranglerEnv);
       lines.push([
         "App",
-        `${appName}${wranglerEnv ? ` [env.${wranglerEnv}]` : ""}${appId ? ` (${appId})` : appIdError ? ` \u2014 ${appIdError}` : " \u2014 no DEEPSPACE_APP_ID; run `deepspace app init`"}`
+        `${appName}${wranglerEnv ? ` [env.${wranglerEnv}]` : ""}${appId ? ` (${appId})` : appIdError ? ` \u2014 ${appIdError}` : " \u2014 no DEEPSPACE_APP_ID yet; it registers on first use (deploy, secrets, dev\u2026)"}`
       ]);
       json.inApp = true;
       json.appName = appName;
@@ -11495,7 +11766,7 @@ var status_default = defineCommand11({
       const depsInstallCommand = installCommand(appDir);
       lines.push([
         "Deps",
-        deps === "ready" ? "installed" : deps === "installing" ? "dependency installation is still running" : `${deps} \u2014 run ${depsInstallCommand}`
+        deps === "ready" ? "installed" : deps === "installing" ? "dependency installation is still running" : deps === "missing" ? "missing \u2014 any command that needs them installs on first use" : `failed \u2014 retried automatically by the next dev/test/deploy (or run ${depsInstallCommand})`
       ]);
       json.deps = deps;
       let branch = null;
@@ -11573,7 +11844,10 @@ var status_default = defineCommand11({
               createdAt: rel.createdAt,
               byYou,
               source: rel.source,
-              sourceRevision: rel.sourceRevision
+              sourceRevision: rel.sourceRevision,
+              // The human line can say "dirty worktree"; the machine mirror
+              // must be able to say the same.
+              sourceDirty: rel.sourceDirty ?? null
             };
             if (!entry) {
               lines.push(["Live", `${release2} \xB7 serving state not visible from your account`]);
@@ -11604,8 +11878,13 @@ var status_default = defineCommand11({
             ]);
             json.source = { ...source, revision: sourceResult.value.revision };
           } else {
-            lines.push(["Source", "unclaimed \xB7 next normal deploy defaults to DeepSpace"]);
+            const github = externalGitSource(appDir, null);
+            lines.push([
+              "Source",
+              `unclaimed \xB7 ${github ? "next deploy infers GitHub from this checkout\u2019s remote" : "next deploy syncs to DeepSpace and claims it, permanently"}`
+            ]);
             json.source = null;
+            json.sourceInference = github ? "github" : "deepspace";
           }
           const [refsResult, wsResult, releaseResult, appsResult] = await Promise.all([
             githubSource ? Promise.resolve({ ok: true, value: null }) : observeRemote(api4.getRefs()),
@@ -11775,9 +12054,9 @@ var push_default = defineDeepspaceCommand({
       const spinner2 = args.json ? null : createSpinner();
       spinner2?.start(`Checking ${branch} before push\u2026`);
       const resolveTarget3 = async () => {
-        assertAppTargetResolvable(appArg);
+        assertAppTargetResolvable(appArg, { register: true });
         const token2 = await ensureToken();
-        const appId2 = await resolveAppTarget(deployBaseUrl(), token2, appArg);
+        const appId2 = await resolveAppTarget(deployBaseUrl(), token2, appArg, { register: true });
         await warnIfPhantomApp(deployBaseUrl(), token2, appId2, appArg?.trim() || void 0);
         return { token: token2, appId: appId2 };
       };
@@ -11850,6 +12129,12 @@ var push_default = defineDeepspaceCommand({
       if (sourceState.source?.provider === "github") {
         throw githubSourceRefusal(appId, sourceState.source.repository);
       }
+      if (sourceState.source === null) {
+        process.stderr.write(
+          `This app's source is unclaimed \u2014 this push claims DeepSpace source for it, permanently (a checkout that deploys from GitHub instead should not run \`deepspace push\`).
+`
+        );
+      }
       const pullRecoveryCwd = selectedBranchCheckout(appDir, branch) ?? appDir;
       ensureSpaceRemote(appDir, appId, void 0, token);
       if (force) {
@@ -11939,7 +12224,21 @@ var push_default = defineDeepspaceCommand({
           extra: { status: result.status, appId, branch, oid: tipOid }
         });
       }
-      return { data: { status: result.status, appId, branch, oid: tipOid } };
+      const uncommitted = appDir ? statusFiles(appDir) : [];
+      if (!args.json && uncommitted.length > 0) {
+        p19.log.warn(
+          `${uncommitted.length} uncommitted file${uncommitted.length === 1 ? "" : "s"} NOT pushed \u2014 push publishes committed history only. Commit and push again to publish them.`
+        );
+      }
+      return {
+        data: {
+          status: result.status,
+          appId,
+          branch,
+          oid: tipOid,
+          ...uncommitted.length > 0 ? { uncommitted } : {}
+        }
+      };
     } catch (err) {
       if (err instanceof Refusal) throw err;
       const transportFailure = classifyPushTransportFailure(err, appDir ?? void 0);
@@ -12236,7 +12535,7 @@ var pull_default = defineDeepspaceCommand({
 
 // src/cli/commands/clone.ts
 import * as p21 from "@clack/prompts";
-import { existsSync as existsSync26, readdirSync as readdirSync8, rmSync as rmSync6 } from "fs";
+import { existsSync as existsSync26, readdirSync as readdirSync8, rmSync as rmSync8 } from "fs";
 import { resolve as resolve19, basename as basename5, join as join25 } from "path";
 function cleanFailedCloneDir(dir) {
   let entries;
@@ -12247,7 +12546,7 @@ function cleanFailedCloneDir(dir) {
   }
   if (entries.length === 1 && entries[0] === ".git") {
     try {
-      rmSync6(join25(dir, ".git"), { recursive: true, force: true });
+      rmSync8(join25(dir, ".git"), { recursive: true, force: true });
       return [];
     } catch {
       return entries;
@@ -12378,7 +12677,7 @@ async function actorLabels(token, appId) {
 }
 
 // src/cli/commands/releases.ts
-var DEPLOY_URL13 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
+var DEPLOY_URL14 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 var releases_default = defineDeepspaceCommand({
   meta: {
     name: "releases",
@@ -12413,8 +12712,8 @@ var releases_default = defineDeepspaceCommand({
     const spinner2 = args.json ? null : createSpinner();
     spinner2?.start("Loading release history\u2026");
     const token = await ensureToken();
-    const appId = await resolveAppTarget(DEPLOY_URL13, token, appArg, { wranglerEnv: envArg });
-    const { releases } = await repoApi(DEPLOY_URL13, token, appId).listReleases(limit);
+    const appId = await resolveAppTarget(DEPLOY_URL14, token, appArg, { wranglerEnv: envArg });
+    const { releases } = await repoApi(DEPLOY_URL14, token, appId).listReleases(limit);
     spinner2?.stop(`Loaded ${releases.length} ${releases.length === 1 ? "release" : "releases"}.`);
     if (!args.json) {
       if (releases.length === 0) {
@@ -12422,7 +12721,7 @@ var releases_default = defineDeepspaceCommand({
       } else {
         const actors = await actorLabels(token, appId);
         for (const r of releases) {
-          const source = releaseSourceLabel(r);
+          const source = displayText(releaseSourceLabel(r));
           const rollback = r.rollbackAvailable ? "rollback available" : "rollback unavailable";
           console.log(
             `#${r.seq}  ${r.id}  ${r.kind.padEnd(8)}  ${r.createdAt}  ${actors.get(r.actor) ?? r.actor}  ${source}  ${rollback}`
@@ -12447,7 +12746,7 @@ Retry in a moment, or re-run with --allow-do-deletion to accept the risk.`,
     "do_guard_unavailable"
   );
 }
-var DEPLOY_URL14 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
+var DEPLOY_URL15 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 function pickPreviousRelease(releases) {
   if (releases.length === 0) {
     return { error: "No releases recorded yet \u2014 nothing to roll back to.", code: "no_releases" };
@@ -12509,8 +12808,8 @@ var rollback_default = defineDeepspaceCommand({
     const spinner2 = args.json ? null : createSpinner();
     spinner2?.start("Preparing rollback\u2026");
     const token = await ensureToken();
-    const appId = await resolveAppTarget(DEPLOY_URL14, token, appArg, { wranglerEnv: envArg });
-    const api4 = repoApi(DEPLOY_URL14, token, appId);
+    const appId = await resolveAppTarget(DEPLOY_URL15, token, appArg, { wranglerEnv: envArg });
+    const api4 = repoApi(DEPLOY_URL15, token, appId);
     let releaseId = args.release ? String(args.release).trim() : "";
     if (!releaseId) {
       const { releases } = await api4.listReleases(2);
@@ -12521,7 +12820,7 @@ var rollback_default = defineDeepspaceCommand({
     spinner2?.message(`Rolling back to ${releaseId}\u2026`);
     let result;
     try {
-      result = await apiFetch(DEPLOY_URL14, token, `/api/deploy/${appId}/rollback`, {
+      result = await apiFetch(DEPLOY_URL15, token, `/api/deploy/${appId}/rollback`, {
         method: "POST",
         body: JSON.stringify({
           releaseId,
@@ -12733,12 +13032,12 @@ function printOverlaps(overlaps, json) {
 import * as p25 from "@clack/prompts";
 import {
   existsSync as existsSync27,
-  mkdirSync as mkdirSync8,
+  mkdirSync as mkdirSync10,
   readFileSync as readFileSync24,
   realpathSync as realpathSync6,
   renameSync as renameSync2,
-  statSync as statSync3,
-  writeFileSync as writeFileSync7
+  statSync as statSync5,
+  writeFileSync as writeFileSync8
 } from "fs";
 import { dirname as dirname12, isAbsolute as isAbsolute6, join as join26, relative as relative4, sep as sep4 } from "path";
 var WORKSPACE_MARKER = "deepspace-workspace.json";
@@ -12772,8 +13071,8 @@ function markManagedWorkspace(worktreeRoot, workspaceId) {
   const marker = { version: 1, workspaceId, mode: "managed-linked" };
   const tempPath = `${markerPath}.${process.pid}.tmp`;
   try {
-    mkdirSync8(dirname12(markerPath), { recursive: true });
-    writeFileSync7(tempPath, JSON.stringify(marker) + "\n");
+    mkdirSync10(dirname12(markerPath), { recursive: true });
+    writeFileSync8(tempPath, JSON.stringify(marker) + "\n");
     renameSync2(tempPath, markerPath);
     return true;
   } catch {
@@ -12840,7 +13139,7 @@ function rematerializeWorkspaceWorktree(appDir, worktreeRoot, branch, workspaceI
 function inOwnLinkedWorktree(appDir, id) {
   if (workspaceIdFromBranch(currentBranch(appDir)) !== id) return false;
   try {
-    return statSync3(join26(repoToplevel(appDir), ".git")).isFile();
+    return statSync5(join26(repoToplevel(appDir), ".git")).isFile();
   } catch {
     return false;
   }
@@ -13286,14 +13585,14 @@ var newWorkspaceCommand = defineDeepspaceCommand({
 
 // src/cli/commands/workspace/attach.ts
 import * as p27 from "@clack/prompts";
-import { existsSync as existsSync28, readdirSync as readdirSync9, realpathSync as realpathSync7, rmSync as rmSync7 } from "fs";
+import { existsSync as existsSync28, readdirSync as readdirSync9, realpathSync as realpathSync7, rmSync as rmSync9 } from "fs";
 import { isAbsolute as isAbsolute8, resolve as resolve21 } from "path";
 function samePath(a, b) {
-  const real = (p36) => {
+  const real = (p35) => {
     try {
-      return realpathSync7(p36);
+      return realpathSync7(p35);
     } catch {
-      return resolve21(p36);
+      return resolve21(p35);
     }
   };
   return real(a) === real(b);
@@ -13317,7 +13616,7 @@ function cleanFailedFreshAttachDir(dir) {
     return entries;
   }
   try {
-    rmSync7(dir, { recursive: true, force: true });
+    rmSync9(dir, { recursive: true, force: true });
     return [];
   } catch {
     return entries.length > 0 ? entries : ["<cleanup-failed>"];
@@ -13851,7 +14150,7 @@ var workspaceStatusCommand = defineDeepspaceCommand({
 import * as p31 from "@clack/prompts";
 
 // src/cli/lib/validation.ts
-import { sync as spawnSync7 } from "cross-spawn";
+import { sync as spawnSync8 } from "cross-spawn";
 import { readFileSync as readFileSync25 } from "fs";
 import { join as join27 } from "path";
 var MAX_SUMMARY_CHARS = 4e3;
@@ -13869,7 +14168,7 @@ function resolveValidationCommand(appDir, explicit) {
 }
 function runValidationCommand(appDir, command) {
   const started = Date.now();
-  const res = spawnSync7(command, [], {
+  const res = spawnSync8(command, [], {
     cwd: appDir,
     shell: true,
     stdio: ["ignore", "pipe", "pipe"],
@@ -14537,7 +14836,8 @@ function formatEvent2(e, lands, actors) {
     case "release.rollback":
       detail = `#${Number(s.seq ?? 0)} ${releaseSourceLabel({
         commitOid: typeof s.commitOid === "string" ? s.commitOid : null,
-        source: s.sourceProvider === "github" && typeof s.sourceRepository === "string" ? { provider: "github", repository: s.sourceRepository } : s.sourceProvider === "deepspace" ? { provider: "deepspace" } : null
+        source: s.sourceProvider === "github" && typeof s.sourceRepository === "string" ? { provider: "github", repository: s.sourceRepository } : s.sourceProvider === "deepspace" ? { provider: "deepspace" } : null,
+        sourceDirty: typeof s.sourceDirty === "boolean" ? s.sourceDirty : null
       })}`;
       break;
     // Unknown kinds still print their kind + actor — never crash the feed.
@@ -14731,17 +15031,15 @@ var git_credential_default = defineCommand13({
 });
 
 // src/cli/commands/source.ts
-import * as p34 from "@clack/prompts";
-var TRANSFER_PREFIX = spacePrivateRef("source-transfer");
 var source_default = defineDeepspaceCommand({
   meta: {
     name: "source",
-    description: "Show or change the app\u2019s one authoritative Git repository"
+    description: "Show the app\u2019s source authority (inferred from use, never declared)"
   },
   args: {
     provider: {
       type: "positional",
-      description: "Source authority: deepspace is platform-hosted and commit-first; github deploys the local working tree without Git sync (omit to show)",
+      description: "No longer accepted \u2014 source is inferred, not declared",
       required: false
     },
     app: {
@@ -14749,71 +15047,41 @@ var source_default = defineDeepspaceCommand({
       alias: "a",
       description: "App id or subdomain name (default: current app)",
       required: false
-    },
-    remote: {
-      type: "string",
-      description: "GitHub remote name when it cannot be inferred (default: origin)",
-      required: false
     }
   },
   async run({ args }) {
-    const requested = typeof args.provider === "string" ? args.provider.trim().toLowerCase() : "";
-    if (requested && requested !== "github" && requested !== "deepspace") {
-      throw new Refusal("Source must be `github` or `deepspace`.", "invalid_source");
-    }
-    const token = await ensureToken();
-    const deployUrl = deployBaseUrl();
-    const appId = await resolveAppTarget(
-      deployUrl,
-      token,
-      typeof args.app === "string" ? args.app : void 0
-    );
-    const state = await getAppSource(deployUrl, token, appId);
-    if (!requested) {
-      reportSource(appId, state, args.json);
-      return { data: sourceData(state) };
-    }
-    const appDir = findAppDir();
-    if (!appDir) {
+    if (typeof args.provider === "string" && args.provider.trim()) {
       throw new Refusal(
-        "Changing source requires a local app checkout with wrangler.toml and Git history.",
-        "not_in_app_repo"
+        "Source is no longer declared. A checkout with a GitHub remote deploys as GitHub automatically, and an app becomes DeepSpace-source by publishing to it (`deepspace push`) \u2014 permanently. This command only reports.",
+        "source_inferred"
       );
     }
-    const remoteArg = typeof args.remote === "string" ? args.remote.trim() : void 0;
-    const result = requested === "github" ? await moveToGitHub({ appDir, appId, token, deployUrl, state, remoteArg }) : await moveToDeepSpace({ appDir, appId, token, deployUrl, state, remoteArg });
-    const reconciliation = reconcileSpaceRemote(appDir, appId, result.source);
-    const spaceRemote = reconciliation.spaceRemote;
-    if (!args.json) {
-      p34.log.success(
-        result.source.provider === "github" ? `Source: GitHub \xB7 ${result.source.repository} (revision ${result.revision})` : `Source: DeepSpace (revision ${result.revision})`
-      );
-      p34.log.info(
-        spaceRemote === "removed" ? `Removed the \`${SPACE_REMOTE}\` git remote \u2014 DeepSpace no longer owns this repo.` : spaceRemote === "absent" ? `No \`${SPACE_REMOTE}\` git remote to remove \u2014 source operations go through GitHub.` : spaceRemote === "present" ? `The \`${SPACE_REMOTE}\` git remote points at this app's cloud repo.` : `The local \`${SPACE_REMOTE}\` git remote still needs reconciliation.`
-      );
-      if (reconciliation.localReconciliation) {
-        p34.log.warn(reconciliation.localReconciliation.message);
+    const appArg = typeof args.app === "string" ? args.app : void 0;
+    if (appArg === void 0) {
+      const appDir = findAppDir();
+      if (appDir && !readAppId(appDir)) {
+        if (!args.json) {
+          console.log("App: not registered yet \u2014 it registers on first use (deploy, secrets, dev\u2026)");
+          console.log("Source: unclaimed \u2014 a checkout with a GitHub remote deploys as GitHub; the first `deepspace push` claims DeepSpace source permanently.");
+        }
+        return { data: { appId: null, source: null, revision: 0, registered: false } };
       }
     }
+    const token = await ensureToken();
+    const deployUrl = deployBaseUrl();
+    const appId = await resolveAppTarget(deployUrl, token, appArg);
+    const state = await getAppSource(deployUrl, token, appId);
+    reportSource(appId, state, args.json);
     return {
       data: {
-        appId,
-        source: result.source,
-        revision: result.revision,
-        spaceRemote,
-        ...reconciliation.localReconciliation ? { localReconciliation: reconciliation.localReconciliation } : {}
+        appId: state.appId,
+        source: state.source,
+        revision: state.revision,
+        registered: state.registered
       }
     };
   }
 });
-function sourceData(state) {
-  return {
-    appId: state.appId,
-    source: state.source,
-    revision: state.revision,
-    registered: state.registered
-  };
-}
 function reportSource(appId, state, json) {
   if (json) return;
   console.log(`App: ${appId}`);
@@ -14822,220 +15090,22 @@ function reportSource(appId, state, json) {
   } else if (state.source?.provider === "deepspace") {
     console.log("Source: DeepSpace");
   } else {
-    console.log("Source: unclaimed (the first normal deploy defaults to DeepSpace)");
-  }
-  console.log(`Revision: ${state.revision}`);
-}
-async function moveToGitHub(input) {
-  const { appDir, appId, token, deployUrl, state, remoteArg } = input;
-  const selected = requireGitHubRemote(appDir, remoteArg);
-  const target2 = { provider: "github", repository: selected.repository };
-  if (sameSource(state.source, target2)) return { source: target2, revision: state.revision };
-  if (state.source?.provider === "deepspace") {
-    assertSyncableRepo(appDir);
-    const api4 = repoApi(deployUrl, token, appId);
-    const { views } = await api4.listWorkspaces();
-    if (views.length > 0) {
-      throw new Refusal(
-        "Land or drop every active DeepSpace workspace before moving source to GitHub.",
-        "active_workspaces"
-      );
-    }
-    ensureSpaceRemote(appDir, appId);
-    runGitRemote(appDir, token, [
-      "fetch",
-      "--quiet",
-      "--prune",
-      SPACE_REMOTE,
-      `+refs/heads/*:${TRANSFER_PREFIX}/heads/*`,
-      `+refs/tags/*:${TRANSFER_PREFIX}/tags/*`
-    ]);
-    const { refs } = await api4.getRefs().then((value) => {
-      if (!value)
-        throw new Refusal("The DeepSpace source repository is unavailable.", "source_unavailable");
-      return value;
-    });
-    const wanted = refs.filter(isPublicRef).map(({ name, oid }) => ({ name, oid }));
-    const fetched = transferRefs(appDir);
-    if (!sameRefs(fetched, wanted)) {
-      throw new Refusal(
-        "DeepSpace branches or tags changed while they were being fetched. Retry the transfer from fresh refs.",
-        "source_changed"
-      );
-    }
-    const latest = await api4.latestRelease().then((value) => value.release);
-    requireReleaseReachable(appDir, latest, wanted);
-    const remote = new Map(
-      remotePublicRefs(appDir, selected.name).map((ref) => [ref.name, ref.oid])
-    );
-    const missing = wanted.filter((ref) => remote.get(ref.name) !== ref.oid);
-    if (missing.length > 0) {
-      const refspecs = missing.map((ref) => transferRefspec(ref.name));
-      throw new Refusal(
-        `GitHub ${selected.repository} is missing ${missing.length} authoritative branch/tag ref(s). Push them manually, then rerun this command.`,
-        "github_push_required",
-        {
-          actionRequired: true,
-          action: { cwd: appDir, argv: ["git", "push", "--atomic", selected.name, ...refspecs] },
-          extra: {
-            appId,
-            repository: selected.repository,
-            missing: missing.map((ref) => ref.name)
-          }
-        }
-      );
-    }
-    return setAppSource(deployUrl, token, appId, {
-      source: target2,
-      expectedRevision: state.revision,
-      refs: wanted,
-      ...releaseExpectation(latest)
-    });
-  }
-  remotePublicRefs(appDir, selected.name);
-  return setAppSource(deployUrl, token, appId, {
-    source: target2,
-    expectedRevision: state.revision
-  });
-}
-async function moveToDeepSpace(input) {
-  const { appDir, appId, token, deployUrl, state, remoteArg } = input;
-  const target2 = { provider: "deepspace" };
-  if (sameSource(state.source, target2)) return { source: target2, revision: state.revision };
-  assertSyncableRepo(appDir);
-  if (state.source?.provider !== "github") {
-    return setAppSource(deployUrl, token, appId, {
-      source: target2,
-      expectedRevision: state.revision
-    });
-  }
-  const selected = requireGitHubRemote(appDir, remoteArg, state.source.repository);
-  fetchGitHubTransferRefs(appDir, selected.name);
-  const refs = transferRefs(appDir);
-  if (refs.length === 0) {
-    throw new Refusal("GitHub has no branches or tags to import.", "source_empty");
-  }
-  const latest = await repoApi(deployUrl, token, appId).latestRelease().then((value) => value.release);
-  requireReleaseReachable(appDir, latest, refs);
-  const pushed = runGit(
-    appDir,
-    [
-      "push",
-      "--force",
-      "--atomic",
-      "--prune",
-      repoUrl(appId, deployUrl),
-      `${TRANSFER_PREFIX}/heads/*:refs/heads/*`,
-      `${TRANSFER_PREFIX}/tags/*:refs/tags/*`
-    ],
-    { allowFail: true, env: gitSourceImportEnv(token, state.revision, deployUrl) }
-  );
-  if (pushed.status !== 0) {
-    throw new Refusal(
-      `DeepSpace source import failed: ${pushed.stderr.toString("utf-8").trim() || "git push failed"}`,
-      "source_import_failed"
-    );
-  }
-  const latestGitHubRefs = remotePublicRefs(appDir, selected.name);
-  if (!sameRefs(latestGitHubRefs, refs)) {
-    throw new Refusal(
-      "GitHub branches or tags changed while they were being imported. Retry the transfer from fresh refs.",
-      "source_changed"
-    );
-  }
-  return setAppSource(deployUrl, token, appId, {
-    source: target2,
-    expectedRevision: state.revision,
-    refs,
-    ...releaseExpectation(latest)
-  });
-}
-function reconcileSpaceRemote(appDir, appId, source) {
-  try {
-    if (source.provider === "github") {
-      return { spaceRemote: removeSpaceRemote(appDir) ? "removed" : "absent" };
-    }
-    ensureSpaceRemote(appDir, appId);
-    return { spaceRemote: "present" };
-  } catch (error) {
-    const detail = error instanceof Error ? error.message : String(error);
-    return {
-      spaceRemote: "repair_required",
-      localReconciliation: {
-        required: true,
-        code: "git_remote_reconciliation_failed",
-        message: `Source authority is ${source.provider}, but the local \`${SPACE_REMOTE}\` remote could not be reconciled: ${detail}`
-      }
-    };
-  }
-}
-function requireGitHubRemote(appDir, remoteArg, repository) {
-  const selected = selectGitHubRemote(appDir, { name: remoteArg, repository });
-  if (selected) return selected;
-  throw new Refusal(
-    remoteArg ? `Remote "${remoteArg}" is not a GitHub repository${repository ? ` for ${repository}` : ""}.` : repository ? `No local GitHub remote points at ${repository}. Add one or pass --remote <name>.` : "No unambiguous GitHub remote was found. Add `origin` or pass --remote <name>.",
-    "github_remote_required"
-  );
-}
-function fetchGitHubTransferRefs(appDir, remote) {
-  runGit(appDir, [
-    "fetch",
-    "--quiet",
-    "--prune",
-    remote,
-    `+refs/heads/*:${TRANSFER_PREFIX}/heads/*`,
-    `+refs/tags/*:${TRANSFER_PREFIX}/tags/*`
-  ]);
-}
-function transferRefs(appDir) {
-  return localTransferRefs(appDir, `${TRANSFER_PREFIX}/heads`, "refs/heads").concat(
-    localTransferRefs(appDir, `${TRANSFER_PREFIX}/tags`, "refs/tags")
-  );
-}
-function transferRefspec(ref) {
-  if (ref.startsWith("refs/heads/")) {
-    return `${TRANSFER_PREFIX}/heads/${ref.slice("refs/heads/".length)}:${ref}`;
-  }
-  return `${TRANSFER_PREFIX}/tags/${ref.slice("refs/tags/".length)}:${ref}`;
-}
-function isPublicRef(ref) {
-  return ref.name.startsWith("refs/heads/") || ref.name.startsWith("refs/tags/");
-}
-function requireReleaseReachable(appDir, release2, refs) {
-  if (!release2?.commitOid) return;
-  const known = resolveCommit(appDir, release2.commitOid) !== null;
-  const reachable = known && refs.some((ref) => isAncestor(appDir, release2.commitOid, ref.oid));
-  if (!reachable) {
-    throw new Refusal(
-      `Live release #${release2.seq} (${release2.commitOid.slice(0, 10)}) is not reachable from a public branch or tag. Redeploy a public branch before changing source.`,
-      "release_not_public"
+    console.log(
+      "Source: unclaimed \u2014 a checkout with a GitHub remote deploys as GitHub; the first `deepspace push` claims DeepSpace source permanently."
     );
   }
-}
-function releaseExpectation(release2) {
-  return {
-    expectedReleaseId: release2?.id ?? null,
-    expectedReleaseCommitOid: release2?.commitOid ?? null
-  };
-}
-function sameSource(left, right) {
-  return left?.provider === right.provider && (left.provider !== "github" || right.provider === "github" && left.repository === right.repository);
-}
-function sameRefs(left, right) {
-  if (left.length !== right.length) return false;
-  const expected = new Map(right.map((ref) => [ref.name, ref.oid]));
-  return left.every((ref) => expected.get(ref.name) === ref.oid);
+  console.log(`Revision: ${state.revision}`);
 }
 
 // src/cli/commands/update.ts
-import * as p35 from "@clack/prompts";
+import * as p34 from "@clack/prompts";
 import { existsSync as existsSync29, readFileSync as readFileSync26 } from "fs";
 import { join as join28, resolve as resolve22 } from "path";
 
 // package.json
 var package_default = {
   name: "deepspace",
-  version: "0.25.0",
+  version: "0.26.1",
   engines: {
     node: ">=22.15.0 <23 || >=24 <25 || >=26 <27"
   },
@@ -15290,7 +15360,7 @@ var update_default = defineDeepspaceCommand({
     } : null;
     if (versionGuidance) {
       const steps2 = [versionGuidance.step];
-      if (!args.json) p35.log.warn(versionGuidance.step);
+      if (!args.json) p34.log.warn(versionGuidance.step);
       return {
         data: {
           ready: false,
@@ -15326,9 +15396,9 @@ var update_default = defineDeepspaceCommand({
     ];
     const status3 = unverifiedSdk ? "dependency_unverified" : steps.length === 0 ? "aligned" : "guidance_available";
     if (!args.json) {
-      p35.log.info(`App dependency: ${currentSpec}; guidance owner: deepspace CLI ${targetVersion}`);
-      for (const step of steps) p35.log.message(`\u2022 ${step}`);
-      if (steps.length === 0) p35.log.success("This app is already aligned with this CLI version.");
+      p34.log.info(`App dependency: ${currentSpec}; guidance owner: deepspace CLI ${targetVersion}`);
+      for (const step of steps) p34.log.message(`\u2022 ${step}`);
+      if (steps.length === 0) p34.log.success("This app is already aligned with this CLI version.");
     }
     const data = {
       ready: status3 === "aligned",
@@ -15394,7 +15464,7 @@ var create2 = defineCommand14({
     }
     const scaffolder = `create-deepspace@${pkg.version}`;
     console.log(`Running: npx ${scaffolder} ${rawArgs2.join(" ")}`.trimEnd() + "\n");
-    const res = spawnSync8("npx", ["-y", scaffolder, ...rawArgs2], { stdio: "inherit" });
+    const res = spawnSync9("npx", ["-y", scaffolder, ...rawArgs2], { stdio: "inherit" });
     if (res.error) {
       const err = res.error;
       console.error(