deepspace 0.27.0 → 0.27.1

package/dist/cli.js

@@ -1946,6 +1946,15 @@ async function warnIfPhantomApp(deployUrl, token, appId, explicit) {
 }
 
 // src/cli/lib/app-tokens.ts
+async function refusalDetail(response) {
+  const text2 = await response.text().catch(() => "");
+  try {
+    const body = JSON.parse(text2);
+    return { detail: body.error ?? text2, code: body.code };
+  } catch {
+    return { detail: text2 };
+  }
+}
 async function fetchPublicKey(authUrl) {
   const response = await fetch(`${authUrl}/api/auth/jwks`);
   if (!response.ok) {
@@ -1965,8 +1974,13 @@ async function mintAppOwnerJwt(authUrl, callerJwt, appId) {
     body: JSON.stringify({ appId })
   });
   if (!response.ok) {
-    const detail = await response.text().catch(() => "");
-    throw new Error(`Failed to mint APP_OWNER_JWT (${response.status}): ${detail}`);
+    const { detail, code } = await refusalDetail(response);
+    throw new ApiError(
+      `Failed to mint APP_OWNER_JWT (${response.status}): ${detail}`,
+      response.status,
+      code,
+      "/api/auth/mint-app-token"
+    );
   }
   const body = await response.json();
   if (!body.token) {
@@ -1982,10 +1996,37 @@ async function fetchAppIdentityToken(deployUrl, callerJwt, appId) {
       headers: { Authorization: `Bearer ${callerJwt}` }
     }
   );
-  if (response.status === 404) return null;
+  if (response.status === 404) {
+    const { detail, code } = await refusalDetail(response);
+    if (code === "app_not_found") {
+      throw new ApiError(
+        // No executable command in this prose: this lib cannot know the
+        // wrangler env, and a bare `app init` under --env would target the
+        // TOP-LEVEL [vars] slot. dev/test/deploy attach the env-aware
+        // remedy as a structured action; surfaces without an action channel
+        // (secrets pull among them) fall back to the
+        // app_not_found hint (check the id / `deepspace app list`).
+        `App ${appId} is not registered on this platform \u2014 DEEPSPACE_APP_ID may belong to a different environment (a staging id does not exist on prod, and vice versa), or the app was never initialized here.`,
+        404,
+        code,
+        `/api/apps/${appId}/identity-token`
+      );
+    }
+    throw new ApiError(
+      `Failed to fetch APP_IDENTITY_TOKEN (404): ${detail || "no such route"} \u2014 is DEEPSPACE_DEPLOY_URL pointing at the right deploy service?`,
+      404,
+      code,
+      `/api/apps/${appId}/identity-token`
+    );
+  }
   if (!response.ok) {
-    const detail = await response.text().catch(() => "");
-    throw new Error(`Failed to fetch APP_IDENTITY_TOKEN (${response.status}): ${detail}`);
+    const { detail, code } = await refusalDetail(response);
+    throw new ApiError(
+      `Failed to fetch APP_IDENTITY_TOKEN (${response.status}): ${detail}`,
+      response.status,
+      code,
+      `/api/apps/${appId}/identity-token`
+    );
   }
   const body = await response.json();
   if (!body.token) {
@@ -2006,11 +2047,29 @@ function requireAppIdFor(appDir, wranglerEnv) {
   throw appTargetMissingError(appDir, wranglerEnv);
 }
 async function writeDevVars(appDir, ownerId, callerJwt, wranglerEnv, opts = {}) {
-  const urls = PLATFORM_URLS;
+  const urls = effectivePlatformUrls();
   const publicKey = await fetchPublicKey(urls.auth);
   const appId = opts.appId ?? requireAppIdFor(appDir, wranglerEnv);
-  const appOwnerJwt = await mintAppOwnerJwt(urls.auth, callerJwt, appId);
-  const appIdentityToken = await fetchAppIdentityToken(urls.deploy, callerJwt, appId);
+  let appOwnerJwt;
+  let appIdentityToken;
+  try {
+    appOwnerJwt = await mintAppOwnerJwt(urls.auth, callerJwt, appId);
+    appIdentityToken = await fetchAppIdentityToken(urls.deploy, callerJwt, appId);
+  } catch (err) {
+    if (err instanceof ApiError && err.code === "app_not_found") {
+      throw new Refusal(err.message, "app_not_found", {
+        actionRequired: true,
+        action: {
+          cwd: appDir,
+          // Env-scoped like every upstream step: a bare `app init` reads and
+          // writes the TOP-LEVEL [vars] slot — under --env it would either
+          // no-op on the prod id or mint a new app into the wrong scope.
+          argv: ["deepspace", "app", "init", ...wranglerEnv ? ["--env", wranglerEnv] : []]
+        }
+      });
+    }
+    throw err;
+  }
   const sdkVars = [
     `AUTH_JWT_PUBLIC_KEY="${publicKey}"`,
     `AUTH_JWT_ISSUER=${urls.auth}/api/auth`,
@@ -2019,7 +2078,7 @@ async function writeDevVars(appDir, ownerId, callerJwt, wranglerEnv, opts = {})
     `PLATFORM_WORKER_URL=${urls.platform}`,
     `OWNER_USER_ID=${ownerId}`,
     `APP_OWNER_JWT=${appOwnerJwt}`,
-    ...appIdentityToken ? [`APP_IDENTITY_TOKEN=${appIdentityToken}`] : [],
+    `APP_IDENTITY_TOKEN=${appIdentityToken}`,
     `ALLOW_DEBUG_ROUTES=true`
   ].join("\n");
   const devVarsPath = devVarsPathFor(appDir);
@@ -3238,22 +3297,24 @@ var dev_default = defineDeepspaceCommand({
     );
     const readiness = new AbortController();
     if (args.json) {
-      void waitForPortListening(port, host, READINESS_TIMEOUT_MS, readiness.signal).then((ready) => {
-        if (readiness.signal.aborted) return;
-        console.log(
-          JSON.stringify(
-            ready ? { ok: true, ready: true, url, port, host, appDir } : {
-              ok: false,
-              code: "dev_server_not_ready",
-              error: `The dev server did not answer on ${url} within ${READINESS_TIMEOUT_MS / 1e3}s.`,
-              url,
-              port,
-              host,
-              appDir
-            }
-          )
-        );
-      });
+      void waitForPortListening(port, host, READINESS_TIMEOUT_MS, readiness.signal).then(
+        (ready) => {
+          if (readiness.signal.aborted) return;
+          console.log(
+            JSON.stringify(
+              ready ? { ok: true, ready: true, url, port, host, appDir } : {
+                ok: false,
+                code: "dev_server_not_ready",
+                error: `The dev server did not answer on ${url} within ${READINESS_TIMEOUT_MS / 1e3}s.`,
+                url,
+                port,
+                host,
+                appDir
+              }
+            )
+          );
+        }
+      );
     }
     let stopping = false;
     const stop = () => {
@@ -5446,7 +5507,7 @@ function createDeployOutput(json) {
 }
 
 // src/cli/commands/deploy/request.ts
-import * as p7 from "@clack/prompts";
+import * as p8 from "@clack/prompts";
 import { readFileSync as readFileSync15 } from "fs";
 
 // src/cli/commands/deploy/repository.ts
@@ -6157,6 +6218,80 @@ function detachedHeadRefusal() {
   };
 }
 
+// src/cli/commands/deploy/secrets.ts
+import * as p7 from "@clack/prompts";
+function secretsConfigCreateAction(appDir, configName, envName) {
+  return {
+    cwd: appDir,
+    argv: [
+      "deepspace",
+      "secrets",
+      "configs",
+      "create",
+      configName,
+      ...envName ? ["--env", envName] : []
+    ]
+  };
+}
+async function loadDeploySecrets(options) {
+  const { deployUrl, appDir, appId, envName, ownerId, token, output } = options;
+  const configName = defaultConfigNameForEnv(envName);
+  let exists = false;
+  let refreshed;
+  try {
+    refreshed = await refreshSecretsCache(deployUrl, token, appId, envName, configName);
+    exists = refreshed.pulled !== null;
+    if (refreshed.summary) p7.log.info(refreshed.summary);
+    const names = Object.keys(refreshed.pulled?.values ?? {}).sort();
+    if (names.length) p7.log.info(`App secrets: ${names.join(", ")}`);
+    else if (exists) {
+      p7.log.warn(
+        "App secrets: none \u2014 this deploy ships no user secrets and removes any live on the app"
+      );
+    }
+  } catch (error) {
+    if (error?.status === 403) {
+      output.die(
+        "You're not authorized to deploy this app \u2014 you must be its owner or a current collaborator. If you were a collaborator, your access may have been revoked.",
+        "not_authorized"
+      );
+    }
+    output.die(
+      `Failed to refresh app secrets before deploy: ${errorMessage4(error)}`,
+      "secrets_refresh_failed"
+    );
+  }
+  try {
+    await writeDevVars(appDir, ownerId, token, envName, {
+      appId,
+      generatedSecretsCache: refreshed.rendered
+    });
+  } catch (error) {
+    if (error instanceof Refusal && error.code === "app_not_found") {
+      output.die(`Could not write .dev.vars before deploy: ${error.message}`, error.code, {
+        actionRequired: true,
+        action: error.action
+      });
+    }
+    const code = error instanceof ApiError && error.code ? error.code : "dev_vars_failed";
+    output.die(`Could not write .dev.vars before deploy: ${errorMessage4(error)}`, code);
+  }
+  if (!exists) {
+    output.die(
+      `Secrets config "${configName}" does not exist. Create it explicitly before deploying; this distinguishes an intentional empty config from an uninitialized app and protects live Worker secrets from a deleted config.`,
+      "secrets_config_missing",
+      {
+        actionRequired: true,
+        action: secretsConfigCreateAction(appDir, configName, envName)
+      }
+    );
+  }
+  return { configName };
+}
+function errorMessage4(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
 // src/cli/commands/deploy/request.ts
 var postWithRetry = fetchWithTransientRetry;
 var STALE_DISPLAY_NAME_LOCATIONS = [
@@ -6173,6 +6308,7 @@ function renamePromptMessage(rename2) {
 var CLOUDFLARE_DEPLOY_ERROR_HINT = "Deployment reached the DeepSpace deploy worker, but Cloudflare's deployment control-plane API failed. This is often caused by a Cloudflare Dashboard/API incident or Workers for Platforms entitlement outage. Already deployed apps should keep serving; wait for Cloudflare to recover and retry.";
 var DEPLOY_SERVICE_LIMIT_HINT = "The DeepSpace deploy service hit a resource limit processing this deploy (the deploy worker was terminated before it could answer). This is a DeepSpace-side failure, not a Cloudflare incident \u2014 your app was not changed. Retry; if it keeps happening, report the app id and asset count.";
 var REQUIRED_ASSET_TRANSPORT = "content-addressed-v1";
+var REQUIRED_SECRETS_SOURCE = "store-read-v1";
 var REQUIRED_WORKER_MODULE_TRANSPORT = "multipart-v1";
 var UPLOAD_CONCURRENCY = 16;
 var ASSET_UPLOAD_ATTEMPT_TIMEOUT_MS = 15e4;
@@ -6214,7 +6350,8 @@ async function deployBuiltBundle(options) {
     claimReleased,
     ignoreStale,
     bundle,
-    secrets,
+    secretsConfig,
+    envName,
     repository,
     output,
     spinner
@@ -6222,11 +6359,11 @@ async function deployBuiltBundle(options) {
   const auth2 = createDeployAuthSession(token, refreshToken);
   spinner.start(`Deploying ${appName}...`);
   if (bundle.extraRoutes === true) {
-    p7.log.info("Worker-first routing: all requests");
+    p8.log.info("Worker-first routing: all requests");
   } else if (bundle.extraRoutes.length) {
-    p7.log.info(`Custom worker-first routes: ${bundle.extraRoutes.join(", ")}`);
+    p8.log.info(`Custom worker-first routes: ${bundle.extraRoutes.join(", ")}`);
   }
-  await requireDeployCapabilities(deployUrl, bundle.worker.modules.length > 1, spinner, output);
+  await requireWorkerModulesCapability(deployUrl, bundle.worker.modules.length > 1, spinner, output);
   await uploadDeployAssetsWithAuth(
     { deployUrl, appId, assets: bundle.assets, output, spinner },
     auth2
@@ -6236,7 +6373,7 @@ async function deployBuiltBundle(options) {
   const bail = async (message, stopLabel = "Deploy failed", code, actionRequired = false, rawAction) => {
     const action = rawAction ? executableAction(rawAction) : void 0;
     if (stopLabel !== null) spinner.stop(stopLabel);
-    p7.cancel(code ? withSlug(message, code) : message);
+    p8.cancel(code ? withSlug(message, code) : message);
     if (action) printAction(action);
     if (output.json) {
       output.emitJson({
@@ -6278,7 +6415,7 @@ async function deployBuiltBundle(options) {
     if (bundle.customBindings.length) {
       form.append("bindingManifest", JSON.stringify(bundle.customBindings));
     }
-    if (secrets.authoritative) form.append("userSecrets", JSON.stringify(secrets.values));
+    form.append("secretsConfig", secretsConfig);
     if (bundle.extraRoutes === true || bundle.extraRoutes.length) {
       form.append("extraRunWorkerFirst", JSON.stringify(bundle.extraRoutes));
     }
@@ -6335,7 +6472,7 @@ async function deployBuiltBundle(options) {
     response = await postCommit();
   } catch (error) {
     await bail(
-      error instanceof ApiError ? errorMessage4(error) : `Deploy request failed: ${errorMessage4(error)}`,
+      error instanceof ApiError ? errorMessage5(error) : `Deploy request failed: ${errorMessage5(error)}`,
       "Deploy failed",
       error instanceof ApiError ? error.code : "deploy_request_failed"
     );
@@ -6349,8 +6486,8 @@ async function deployBuiltBundle(options) {
     if (output.nonInteractive) {
       await bail(renameRefusalMessage(rename2), null, "rename_required");
     }
-    const confirmed = await p7.confirm({ message: renamePromptMessage(rename2) });
-    if (p7.isCancel(confirmed) || !confirmed) await bail("Deploy cancelled.", null);
+    const confirmed = await p8.confirm({ message: renamePromptMessage(rename2) });
+    if (p8.isCancel(confirmed) || !confirmed) await bail("Deploy cancelled.", null);
     confirmRename = true;
     renamedFrom = rename2.fromHost;
     spinner.start(`Deploying ${appName}...`);
@@ -6366,6 +6503,15 @@ async function deployBuiltBundle(options) {
       { cwd: appDir, argv: ["deepspace", "pull"] }
     );
   }
+  if (response.status === 409 && body.code === "secrets_config_missing") {
+    await bail(
+      `Secrets config "${secretsConfig}" does not exist on the platform (it was deleted after the pre-deploy check). Create it explicitly before deploying` + (envName ? ` (run the action below \u2014 plain \`configs create\` targets the top-level app)` : "") + ".",
+      "Deploy failed",
+      "secrets_config_missing",
+      true,
+      secretsConfigCreateAction(appDir, secretsConfig, envName)
+    );
+  }
   if (response.status === 409 && body.code === "release_in_progress") {
     await bail(
       `${body.error ?? "Another deploy of this app is already in progress"}. It is committing now \u2014 this run built and uploaded fine but did not release. Wait a moment and run the same deploy again; if it keeps refusing for more than a couple of minutes, check \`deepspace releases\`.`,
@@ -6382,14 +6528,14 @@ async function deployBuiltBundle(options) {
       body.code ?? "deploy_failed"
     );
   }
-  p7.log.info(`Platform commit: ${Math.round((Date.now() - commitStarted) / 1e3)}s`);
+  p8.log.info(`Platform commit: ${Math.round((Date.now() - commitStarted) / 1e3)}s`);
   if (body.staleBaseGuard === "skipped") {
-    p7.log.warn(
+    p8.log.warn(
       "The stale-base guard was skipped (repo store unavailable) \u2014 this deploy was NOT checked against the live release. Verify you're not clobbering newer work."
     );
   }
   if (body.bundleRetained === false) {
-    p7.log.warn(
+    p8.log.warn(
       "This deploy is live, but its rollback bundle was not retained because the app storage quota is full."
     );
   }
@@ -6398,33 +6544,62 @@ async function deployBuiltBundle(options) {
 function assetManifest(assets) {
   return assets.map((asset) => ({ path: asset.path, hash: asset.hash, size: asset.size }));
 }
-async function requireDeployCapabilities(deployUrl, needsWorkerModules, spinner, output) {
-  let capabilities;
+async function probeDeployCapabilities(deployUrl, spinner, output) {
+  let capabilities = {};
   try {
     const response = await postWithRetry(`${deployUrl}/api/health`, () => ({}), {
-      timeoutMs: 15e3
+      attempts: 2,
+      timeoutMs: 1e4
     });
     if (!response.ok) throw new Error(`HTTP ${response.status}`);
     const body = await response.json();
-    capabilities = body.capabilities;
+    capabilities = body.capabilities ?? {};
   } catch (error) {
-    spinner.stop("Deploy failed");
+    spinner?.stop("Deploy failed");
     output.die(
-      `Could not reach the DeepSpace deploy service at ${deployUrl} to check its capabilities: ${errorMessage4(error)}`,
+      `Could not reach the DeepSpace deploy service at ${deployUrl} to check its capabilities: ${errorMessage5(error)}`,
       "deploy_service_unreachable"
     );
   }
-  if (capabilities?.assetTransport !== REQUIRED_ASSET_TRANSPORT) {
-    spinner.stop("Deploy failed");
-    output.die(
-      `The DeepSpace deploy service at ${deployUrl} does not support this CLI's asset transport (needs "${REQUIRED_ASSET_TRANSPORT}", found ${capabilities?.assetTransport === void 0 ? "none" : `"${String(capabilities.assetTransport)}"`}). Wait for the platform to finish updating, or pin an older deepspace CLI.`,
-      "asset_transport_unsupported"
-    );
-  }
-  if (needsWorkerModules && capabilities?.workerModules !== REQUIRED_WORKER_MODULE_TRANSPORT) {
-    spinner.stop("Deploy failed");
+  return capabilities;
+}
+function requireCapability(deployUrl, spinner, output, name, advertised, required, code, pinHint = "") {
+  if (advertised === required) return;
+  spinner?.stop("Deploy failed");
+  output.die(
+    `The DeepSpace deploy service at ${deployUrl} does not support this CLI's ${name} (needs "${required}", found ${advertised === void 0 ? "none" : `"${String(advertised)}"`}). Wait for the platform to finish updating${pinHint}.`,
+    code
+  );
+}
+async function requireDeployCapabilities(deployUrl, spinner, output) {
+  const capabilities = await probeDeployCapabilities(deployUrl, spinner, output);
+  requireCapability(
+    deployUrl,
+    spinner,
+    output,
+    "asset transport",
+    capabilities.assetTransport,
+    REQUIRED_ASSET_TRANSPORT,
+    "asset_transport_unsupported"
+  );
+  requireCapability(
+    deployUrl,
+    spinner,
+    output,
+    "secrets source",
+    capabilities.secretsSource,
+    REQUIRED_SECRETS_SOURCE,
+    "secrets_source_unsupported",
+    ", or pin the last pre-cutover CLI (`npm i -g deepspace@0.23`)"
+  );
+}
+async function requireWorkerModulesCapability(deployUrl, needsWorkerModules, spinner, output) {
+  if (!needsWorkerModules) return;
+  const capabilities = await probeDeployCapabilities(deployUrl, spinner, output);
+  if (capabilities.workerModules !== REQUIRED_WORKER_MODULE_TRANSPORT) {
+    spinner?.stop("Deploy failed");
     output.die(
-      `This build contains multiple Worker modules, but the DeepSpace deploy service at ${deployUrl} does not support their transport (needs "${REQUIRED_WORKER_MODULE_TRANSPORT}", found ${capabilities?.workerModules === void 0 ? "none" : `"${String(capabilities.workerModules)}"`}). Wait for the platform to finish updating before retrying this deploy.`,
+      `This build contains multiple Worker modules, but the DeepSpace deploy service at ${deployUrl} does not support their transport (needs "${REQUIRED_WORKER_MODULE_TRANSPORT}", found ${capabilities.workerModules === void 0 ? "none" : `"${String(capabilities.workerModules)}"`}). Wait for the platform to finish updating before retrying this deploy.`,
       "worker_module_transport_unsupported"
     );
   }
@@ -6448,9 +6623,9 @@ async function uploadDeployAssetsWithAuth(options, auth2) {
   } catch (error) {
     spinner.stop("Deploy failed");
     if (error instanceof ApiError) {
-      output.die(errorMessage4(error), error.code ?? "upload_failed");
+      output.die(errorMessage5(error), error.code ?? "upload_failed");
     }
-    output.die(`Asset plan failed (network): ${errorMessage4(error)}`, "upload_failed");
+    output.die(`Asset plan failed (network): ${errorMessage5(error)}`, "upload_failed");
   }
   const planBody = await planResponse.json().catch(() => ({}));
   if (!planResponse.ok) {
@@ -6473,11 +6648,11 @@ async function uploadDeployAssetsWithAuth(options, auth2) {
     missing.push(asset);
   }
   if (missing.length === 0) {
-    p7.log.info(`Assets: ${byHash.size} file(s), all already uploaded`);
+    p8.log.info(`Assets: ${byHash.size} file(s), all already uploaded`);
     return;
   }
   const missingBytes = missing.reduce((total2, asset) => total2 + asset.size, 0);
-  p7.log.info(
+  p8.log.info(
     `Assets: ${byHash.size} file(s), uploading ${missing.length} (${Math.ceil(missingBytes / 1024)} KiB); the rest are already stored`
   );
   const total = missing.length;
@@ -6518,16 +6693,16 @@ async function uploadDeployAssetsWithAuth(options, auth2) {
   const uploadStarted = Date.now();
   try {
     await Promise.all(Array.from({ length: Math.min(UPLOAD_CONCURRENCY, missing.length) }, worker));
-    p7.log.info(`Uploaded ${total} file(s) in ${Math.round((Date.now() - uploadStarted) / 1e3)}s`);
+    p8.log.info(`Uploaded ${total} file(s) in ${Math.round((Date.now() - uploadStarted) / 1e3)}s`);
   } catch (error) {
     spinner.stop("Deploy failed");
     if (error instanceof AssetUploadError) {
       output.die(formatDeployWorkerError(error.status, error.message, error.code), error.code);
     }
     if (error instanceof ApiError) {
-      output.die(errorMessage4(error), error.code ?? "upload_failed");
+      output.die(errorMessage5(error), error.code ?? "upload_failed");
     }
-    output.die(`Asset upload failed (network): ${errorMessage4(error)}`, "upload_failed");
+    output.die(`Asset upload failed (network): ${errorMessage5(error)}`, "upload_failed");
   }
 }
 var AssetUploadError = class extends Error {
@@ -6543,7 +6718,9 @@ function isDeployServiceResourceLimit(status3, error) {
 }
 function formatDeployWorkerError(status3, error, code) {
   const detail = error ?? `Deployment error (${status3})`;
-  if (code === "cli_outdated") return detail;
+  if (code === "cli_outdated" || code === "secrets_read_failed" || code === "release_reconciliation_pending") {
+    return detail;
+  }
   if (isDeployServiceResourceLimit(status3, error)) {
     return `${DEPLOY_SERVICE_LIMIT_HINT}
 
@@ -6562,82 +6739,6 @@ Underlying error: ${detail}`;
 
 Underlying error: ${detail}`;
 }
-function errorMessage4(error) {
-  return error instanceof Error ? error.message : String(error);
-}
-
-// src/cli/commands/deploy/secrets.ts
-import * as p8 from "@clack/prompts";
-async function loadDeploySecrets(options) {
-  const { deployUrl, appDir, appId, envName, ownerId, token, output } = options;
-  let linked = null;
-  try {
-    const refreshed = await refreshSecretsCache(deployUrl, token, appId, envName);
-    linked = refreshed.pulled;
-    await writeDevVars(appDir, ownerId, token, envName, {
-      appId,
-      generatedSecretsCache: refreshed.rendered
-    });
-    if (refreshed.summary) p8.log.info(refreshed.summary);
-  } catch (error) {
-    if (error?.status === 403) {
-      output.die(
-        "You're not authorized to deploy this app \u2014 you must be its owner or a current collaborator. If you were a collaborator, your access may have been revoked.",
-        "not_authorized"
-      );
-    }
-    output.die(
-      `Failed to refresh app secrets before deploy: ${errorMessage5(error)}`,
-      "secrets_refresh_failed"
-    );
-  }
-  if (!linked) {
-    const configName = defaultConfigNameForEnv(envName);
-    output.die(
-      `Secrets config "${configName}" does not exist. Create it explicitly before deploying; this distinguishes an intentional empty config from an uninitialized app and protects live Worker secrets during the platform rollout.`,
-      "secrets_config_missing",
-      {
-        action: {
-          cwd: appDir,
-          argv: [
-            "deepspace",
-            "secrets",
-            "configs",
-            "create",
-            configName,
-            ...envName ? ["--env", envName] : []
-          ]
-        }
-      }
-    );
-  }
-  return { linked };
-}
-function prepareDeploySecrets(options) {
-  const { cache, customBindings, doManifest, output } = options;
-  const values = cache.linked ? { ...cache.linked.values } : {};
-  const names = Object.keys(values);
-  const declaredBindingNames = /* @__PURE__ */ new Set([
-    ...customBindings.map((binding) => binding.name),
-    ...(doManifest ?? []).map((binding) => binding.binding)
-  ]);
-  for (const name of names) {
-    if (RESERVED_BINDING_NAMES.has(name)) {
-      output.die(
-        `App secret "${name}" is a reserved binding name \u2014 rename or remove that secret before deploying.`,
-        "reserved_binding"
-      );
-    }
-    if (declaredBindingNames.has(name)) {
-      output.die(
-        `App secret "${name}" collides with a binding declared in wrangler.toml \u2014 rename one or the other.`,
-        "binding_collision"
-      );
-    }
-  }
-  if (names.length) p8.log.info(`App secrets: ${names.join(", ")}`);
-  return { values, names, authoritative: cache.linked !== null };
-}
 function errorMessage5(error) {
   return error instanceof Error ? error.message : String(error);
 }
@@ -6817,11 +6918,12 @@ async function runLockedDeploy(args, output, appDir, envName) {
   });
   if (!sourceState.registered) {
     output.die(
-      `${appId} is not registered. If this repo's id came from an older SDK's scaffold, run \`deepspace app init --new-id\` to register it as a fresh app; a brand-new app dir registers with \`deepspace app init\`.`,
+      `${appId} is not registered. If this repo's id came from an older SDK's scaffold, run \`deepspace app init --new-id${envName ? ` --env ${envName}` : ""}\` to register it as a fresh app; a brand-new app dir registers with \`deepspace app init${envName ? ` --env ${envName}` : ""}\`.`,
       "app_not_registered"
     );
   }
-  const secretsCache = await loadDeploySecrets({
+  await requireDeployCapabilities(DEPLOY_URL4, null, output);
+  const { configName: secretsConfig } = await loadDeploySecrets({
     deployUrl: DEPLOY_URL4,
     appDir,
     appId,
@@ -6833,7 +6935,9 @@ async function runLockedDeploy(args, output, appDir, envName) {
   const ownerJwtRefusal = ownerJwtMissingRefusal(sourceState);
   if (ownerJwtRefusal) output.die(ownerJwtRefusal.error, ownerJwtRefusal.code);
   if (sourceState.onBehalf) {
-    process.stderr.write("Deploying on behalf of the owner \u2014 this app belongs to another account.\n");
+    process.stderr.write(
+      "Deploying on behalf of the owner \u2014 this app belongs to another account.\n"
+    );
   }
   let confirmRename = args.rename === true;
   const rename2 = pendingRename(sourceState.registeredHost, appName);
@@ -6878,12 +6982,6 @@ async function runLockedDeploy(args, output, appDir, envName) {
     output,
     sourceState
   });
-  const secrets = prepareDeploySecrets({
-    cache: secretsCache,
-    customBindings: bundle.customBindings,
-    doManifest: bundle.doManifest,
-    output
-  });
   const body = await deployBuiltBundle({
     deployUrl: DEPLOY_URL4,
     appDir,
@@ -6895,7 +6993,8 @@ async function runLockedDeploy(args, output, appDir, envName) {
     claimReleased: args["claim-released"] === true,
     ignoreStale: Boolean(args["ignore-stale"]),
     bundle,
-    secrets,
+    secretsConfig,
+    envName,
     repository,
     output,
     spinner
@@ -7773,24 +7872,11 @@ function featureCatalog(packageRoot = featurePackageRoot()) {
     description: config.description ?? null
   }));
 }
-function editDistance2(a, b) {
-  const row = Array.from({ length: b.length + 1 }, (_, index) => index);
-  for (let i = 1; i <= a.length; i++) {
-    let previous = row[0];
-    row[0] = i;
-    for (let j = 1; j <= b.length; j++) {
-      const current = row[j];
-      row[j] = Math.min(row[j] + 1, row[j - 1] + 1, previous + (a[i - 1] === b[j - 1] ? 0 : 1));
-      previous = current;
-    }
-  }
-  return row[b.length];
-}
 function suggestFeature(featureId, packageRoot = featurePackageRoot()) {
   let closest = null;
   let closestDistance = Number.POSITIVE_INFINITY;
   for (const feature of listFeatureConfigs(packageRoot)) {
-    const distance = editDistance2(featureId, feature.id);
+    const distance = editDistance(featureId, feature.id);
     if (distance < closestDistance) {
       closest = feature.id;
       closestDistance = distance;
@@ -7839,7 +7925,7 @@ function installFiles(packageRoot, config, targetDir, emit) {
       if (!existed) missing.push(resolvedDest);
       continue;
     }
-    if (existed && !file.overwrite) {
+    if (existed) {
       emit(`   Exists (skipped): ${resolvedDest}`);
       skipped++;
       continue;
@@ -7848,8 +7934,8 @@ function installFiles(packageRoot, config, targetDir, emit) {
     const shiftLevels = resolvedDest.split("/").length - file.dest.split("/").length;
     if (wasRedirected) copyFileWithImportShift(srcPath, destPath, shiftLevels);
     else copyFile(srcPath, destPath);
-    emit(`   ${existed ? "Overwrote" : "Copied"}: ${resolvedDest}`);
-    if (!existed) created.push(resolvedDest);
+    emit(`   Copied: ${resolvedDest}`);
+    created.push(resolvedDest);
     copied++;
   }
   return { copied, skipped, files: { created, preexisting, missing } };
@@ -8119,50 +8205,6 @@ function rateLimitBindingBlock(scope, binding) {
     `simple = { limit = ${binding.limit}, period = ${binding.period} }`
   ].join("\n");
 }
-function integrateCss(packageRoot, config, targetDir, emit) {
-  if (!config.css?.length) return [];
-  const stylesPath = join22(targetDir, "src", "styles.css");
-  if (!existsSync21(stylesPath)) {
-    emit("   Warning: Cannot integrate CSS \u2014 src/styles.css not found");
-    return [
-      {
-        area: "css",
-        reason: "src/styles.css was not found.",
-        steps: config.css.map(
-          (cssFile) => `Append node_modules/deepspace/features/${config.id}/${cssFile} to src/styles.css.`
-        )
-      }
-    ];
-  }
-  let styles = readFileSync17(stylesPath, "utf-8");
-  let integrated = 0;
-  const unresolved = [];
-  for (const cssFile of config.css) {
-    const srcPath = join22(packageRoot, "features", config.id, cssFile);
-    if (!existsSync21(srcPath)) {
-      emit(`   Warning: CSS source not found: ${cssFile}`, "stderr");
-      unresolved.push({
-        area: "css",
-        reason: `Feature CSS source '${cssFile}' was not found in the installed package.`,
-        steps: ["Reinstall the current deepspace package, then retry this feature installation."]
-      });
-      continue;
-    }
-    const css = readFileSync17(srcPath, "utf-8");
-    const fingerprint = css.match(/\.([\w-]+)\s*\{|@keyframes\s+([\w-]+)/);
-    const marker = fingerprint?.[1] ?? fingerprint?.[2];
-    if (marker && styles.includes(marker)) {
-      emit(`   CSS already present: ${cssFile} (found .${marker})`);
-      continue;
-    }
-    styles += `
-${css}`;
-    integrated++;
-    emit(`   CSS integrated: ${cssFile} -> styles.css`);
-  }
-  if (integrated > 0) writeFileSync7(stylesPath, styles);
-  return unresolved;
-}
 function unresolvedRoute(route, config, reason, emit) {
   const roles = routeRolesSuffix(route);
   emit("");
@@ -8387,7 +8429,6 @@ function installFeature(options) {
     ...integrateActions(config, targetDir, emit),
     ...integrateWrangler(config, targetDir, emit),
     ...integrateCode(config, targetDir, emit),
-    ...integrateCss(packageRoot, config, targetDir, emit),
     ...integrateRoute(config, targetDir, emit)
   ];
   const dependencyResult = integrateDependencies(
@@ -10852,10 +10893,17 @@ var pull = defineCommand9({
       wranglerEnv,
       t.configName
     );
-    await writeDevVars(appDir, ownerId, t.token, wranglerEnv, {
-      appId: t.appId,
-      generatedSecretsCache: refreshed.rendered
-    });
+    try {
+      await writeDevVars(appDir, ownerId, t.token, wranglerEnv, {
+        appId: t.appId,
+        generatedSecretsCache: refreshed.rendered
+      });
+    } catch (err) {
+      if (args.app && err instanceof Refusal && err.code === "app_not_found") {
+        throw new Refusal(err.message, err.code);
+      }
+      throw err;
+    }
     const count = Object.keys(refreshed.pulled?.values ?? {}).length;
     ok(
       args.json === true,
@@ -11031,7 +11079,7 @@ var init_default = defineDeepspaceCommand({
       } catch (error) {
         if (error instanceof ApiError && error.code === "forbidden") {
           throw new Refusal(
-            `wrangler.toml carries ${existing}, which is registered to another user. Run \`deepspace app init --new-id\` to fork this repo as your own app (new data and secrets; the original is untouched).`,
+            `wrangler.toml carries ${existing}, which is registered to another user. Run \`deepspace app init --new-id${envName ? ` --env ${envName}` : ""}\` to fork this repo as your own app (new data and secrets; the original is untouched).`,
             "not_app_owner"
           );
         }
@@ -11039,7 +11087,7 @@ var init_default = defineDeepspaceCommand({
       }
       if (!state.registered) {
         throw new Refusal(
-          `wrangler.toml carries ${existing}, but that id was never registered \u2014 it was minted locally by an older SDK. Ids are server-minted at registration now, and an existing unregistered id cannot be claimed. Run \`deepspace app init --new-id\` to register this repo as a fresh app (new data and secrets; nothing to migrate \u2014 the old id never had server-side state).`,
+          `wrangler.toml carries ${existing}, but that id was never registered \u2014 it was minted locally by an older SDK. Ids are server-minted at registration now, and an existing unregistered id cannot be claimed. Run \`deepspace app init --new-id${envName ? ` --env ${envName}` : ""}\` to register this repo as a fresh app (new data and secrets; nothing to migrate \u2014 the old id never had server-side state).`,
           "app_not_registered",
           {
             action: cliAction(
@@ -11117,7 +11165,14 @@ var init_default = defineDeepspaceCommand({
       ...!committedScaffold && wranglerConfigUncommitted(appDir) ? {
         action: {
           cwd: appDir,
-          argv: ["git", "commit", "-m", existing ? `Fork as ${appId}` : `Register ${appId}`, "--", "wrangler.toml"]
+          argv: [
+            "git",
+            "commit",
+            "-m",
+            existing ? `Fork as ${appId}` : `Register ${appId}`,
+            "--",
+            "wrangler.toml"
+          ]
         }
       } : {}
     };
@@ -12254,9 +12309,11 @@ var releases_default = defineDeepspaceCommand({
 // src/cli/commands/rollback.ts
 import * as p20 from "@clack/prompts";
 var REL_ID_RE = /^rel_[0-9A-HJKMNP-TV-Z]{26}$/;
-function unavailableDoGuardRefusal(message) {
+function unavailableDoGuardRefusal(message, detail) {
+  const cause = typeof detail === "string" && detail !== "" ? `
+Cause: ${detail}` : "";
   return new Refusal(
-    `${message}
+    `${message}${cause}
 Retry in a moment, or re-run with --allow-do-deletion to accept the risk.`,
     "do_guard_unavailable"
   );
@@ -12352,7 +12409,7 @@ Re-run with --allow-do-deletion to accept the data loss.`,
         );
       }
       if (err instanceof ApiError && err.code === "do_guard_unavailable") {
-        throw unavailableDoGuardRefusal(err.message);
+        throw unavailableDoGuardRefusal(err.message, err.details?.detail);
       }
       throw err;
     }
@@ -12373,7 +12430,8 @@ Re-run with --allow-do-deletion to accept the data loss.`,
     const doClassGuard = result.doClassGuard === "unverified" ? "unverified" : void 0;
     if (!args.json) {
       if (result.url) {
-        if (serving === "unconfirmed") p20.log.warn(`URL: ${result.url} (accepted; serving not yet verified)`);
+        if (serving === "unconfirmed")
+          p20.log.warn(`URL: ${result.url} (accepted; serving not yet verified)`);
         else p20.log.success(`Live at: ${result.url}`);
       }
       if (result.bundleRetained === false) {
@@ -14627,7 +14685,7 @@ import { join as join28, resolve as resolve21 } from "path";
 // package.json
 var package_default = {
   name: "deepspace",
-  version: "0.27.0",
+  version: "0.27.1",
   engines: {
     node: ">=22.15.0 <23 || >=24 <25 || >=26 <27"
   },