deepspace 0.29.0 → 0.30.0

package/dist/cli.js

@@ -8,7 +8,7 @@ import {
   renderUsage
 } from "citty";
 import { sync as spawnSync9 } from "cross-spawn";
-import { readFileSync as readFileSync27, existsSync as existsSync31 } from "fs";
+import { readFileSync as readFileSync28, existsSync as existsSync31 } from "fs";
 import { dirname as dirname13, join as join29 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 
@@ -301,6 +301,49 @@ function apiFetchReadWithRetry(baseUrl, token, path) {
 function isTransientFailure(error) {
   return error instanceof ApiError && (error.status === 0 || error.status === 408 || error.status === 429 || error.status >= 500);
 }
+async function fetchIntegrationCatalog(baseUrl, opts = {}) {
+  const path = opts.summary ? "/api/integrations?summary=1" : "/api/integrations";
+  let res;
+  try {
+    res = await fetch(`${baseUrl}${path}`, { signal: AbortSignal.timeout(15e3) });
+  } catch (err) {
+    throw new ApiError(
+      `Could not fetch the integration catalog: ${err instanceof Error ? err.message : String(err)}`,
+      0,
+      "catalog_unavailable",
+      path
+    );
+  }
+  if (!res.ok) {
+    throw new ApiError(
+      `Failed to fetch integration catalog (${res.status})`,
+      res.status,
+      "catalog_unavailable",
+      path
+    );
+  }
+  let value;
+  try {
+    value = await res.json();
+  } catch {
+    throw new ApiError(
+      "The integration catalog returned invalid JSON.",
+      res.status,
+      "invalid_catalog",
+      path
+    );
+  }
+  const integrations = value?.integrations;
+  if (!integrations || typeof integrations !== "object" || Array.isArray(integrations)) {
+    throw new ApiError(
+      "The integration catalog returned an invalid shape.",
+      res.status,
+      "invalid_catalog",
+      path
+    );
+  }
+  return value;
+}
 
 // src/cli/lib/cli-errors.ts
 var InputError = class extends Error {
@@ -664,9 +707,13 @@ function appDomainForEnv(env) {
   return env === "production" ? "app.space" : env === "staging" ? "spacestest.com" : null;
 }
 var PLATFORM_URLS = DEEPSPACE_ENV === "production" ? PROD_URLS : DEEPSPACE_ENV === "staging" ? STAGING_URLS : INVALID_URLS;
+var PLANE_URLS = {
+  production: PROD_URLS,
+  staging: STAGING_URLS
+};
 var PLANE_AUTH_URLS = {
-  production: PROD_URLS.auth,
-  staging: STAGING_URLS.auth
+  production: PLANE_URLS.production.auth,
+  staging: PLANE_URLS.staging.auth
 };
 function effectivePlatformUrls(env = process.env) {
   return {
@@ -807,6 +854,10 @@ async function ensureToken(options = {}) {
     throw notAuthenticated("The stored session is no longer valid (expired or unreadable)");
   return token;
 }
+function loginAction() {
+  const canRunBare = Boolean(process.stdin.isTTY) && Boolean(process.stdout.isTTY) || Boolean(process.env.DEEPSPACE_EMAIL) && Boolean(process.env.DEEPSPACE_PASSWORD);
+  return canRunBare ? cliAction("deepspace", "auth", "login") : void 0;
+}
 function notAuthenticated(state) {
   const selected = process.env.DEEPSPACE_AUTH_URL !== void 0 ? `the auth service at ${AUTH_URL} (selected by DEEPSPACE_AUTH_URL)` : DEEPSPACE_ENV === "production" && process.env.DEEPSPACE_ENV === void 0 ? "production" : `${DEEPSPACE_ENV} (selected by DEEPSPACE_ENV=${process.env.DEEPSPACE_ENV})`;
   const elsewhere = Object.entries(PLANE_AUTH_URLS).filter(([, url]) => url !== AUTH_URL && existsSync(credentialPaths(url).sessionPath)).map(([plane]) => plane);
@@ -818,7 +869,7 @@ function notAuthenticated(state) {
   return new Refusal(
     `${state} on ${selected}.${other} Run \`deepspace auth login\` (headless: \`deepspace auth login --email you@example.com --password-stdin\`, or set DEEPSPACE_EMAIL and DEEPSPACE_PASSWORD).`,
     "not_authenticated",
-    { action: cliAction("deepspace", "auth", "login") }
+    { action: loginAction() }
   );
 }
 function isTokenValid(jwt, minimumValidityMs) {
@@ -959,7 +1010,7 @@ var login_default = defineDeepspaceCommand({
         "Login timed out. Run `deepspace auth login` to try again.",
         "login_timeout",
         {
-          action: cliAction("deepspace", "auth", "login")
+          action: loginAction()
         }
       );
     }
@@ -1031,14 +1082,14 @@ async function createCliLoginSession(codeChallenge) {
     throw new Refusal(
       `Could not reach the auth service to create a login session: ${error instanceof Error ? error.message : String(error)}`,
       "login_session_unreachable",
-      { action: cliAction("deepspace", "auth", "login") }
+      { action: loginAction() }
     );
   }
   if (!sessionRes.ok) {
     throw new Refusal(
       `Could not create login session (${sessionRes.status})`,
       "login_session_failed",
-      { action: cliAction("deepspace", "auth", "login") }
+      { action: loginAction() }
     );
   }
   const sessionData = await sessionRes.json().catch(() => ({}));
@@ -1046,7 +1097,7 @@ async function createCliLoginSession(codeChallenge) {
     throw new Refusal(
       "Could not create login session \u2014 the auth server returned no session id or login url.",
       "login_session_failed",
-      { action: cliAction("deepspace", "auth", "login") }
+      { action: loginAction() }
     );
   }
   return { sessionId: sessionData.sessionId, loginUrl: sessionData.loginUrl };
@@ -2724,7 +2775,7 @@ async function fetchAppIdentityToken(deployUrl, callerJwt, appId) {
         // wrangler env, and a bare `app init` under --env would target the
         // TOP-LEVEL [vars] slot. dev/test/deploy attach the env-aware
         // remedy as a structured action; surfaces without an action channel
-        // (secrets pull among them) fall back to the
+        // fall back to the
         // app_not_found hint (check the id / `deepspace app list`).
         `App ${appId} is not registered on this platform \u2014 DEEPSPACE_APP_ID may belong to a different environment (a staging id does not exist on prod, and vice versa), or the app was never initialized here.`,
         404,
@@ -2758,7 +2809,7 @@ async function fetchAppIdentityToken(deployUrl, callerJwt, appId) {
 // src/cli/lib/dev-vars.ts
 var HEADER = [
   "# Generated by deepspace \u2014 do not edit; this file is rewritten on every",
-  "# dev, test, deploy, and secrets pull run. App values live in the secret store:",
+  "# dev, test, and deploy run. App values live in the secret store:",
   "#   npx deepspace secrets set KEY=value"
 ].join("\n");
 function requireAppIdFor(appDir, wranglerEnv) {
@@ -3006,6 +3057,15 @@ function canonicalPath2(path) {
     return resolve7(path);
   }
 }
+function processAlive(pid) {
+  if (!Number.isSafeInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err.code === "EPERM";
+  }
+}
 
 // src/cli/lib/preflight.ts
 import { execFileSync } from "child_process";
@@ -3077,6 +3137,8 @@ function removeMacosJunk(dir) {
 
 // src/server/rooms/binding-manifest.ts
 var MAX_ENV_VAR_BYTES = 5 * 1024;
+var MAX_BINDING_NAME_LENGTH = 256;
+var SECRET_NAME_RE = new RegExp(`^[A-Za-z_][A-Za-z0-9_]{0,${MAX_BINDING_NAME_LENGTH - 1}}$`);
 var AUTO_PROVISION_SENTINEL = "auto";
 var VECTORIZE_METRICS = /* @__PURE__ */ new Set(["cosine", "euclidean", "dot-product"]);
 var ALLOWED_BINDING_TYPES = /* @__PURE__ */ new Set([
@@ -3137,6 +3199,12 @@ function validateBindingManifest(manifest) {
       errors.push({ reason: `Binding of type "${type}" missing 'name' (string)` });
       continue;
     }
+    if (name.length > MAX_BINDING_NAME_LENGTH) {
+      errors.push({
+        reason: `Binding name "${name.slice(0, 64)}\u2026" is ${name.length} characters; the limit is ${MAX_BINDING_NAME_LENGTH}`
+      });
+      continue;
+    }
     if (RESERVED_BINDING_NAMES.has(name)) {
       errors.push({ reason: `Binding name "${name}" is reserved by the SDK` });
       continue;
@@ -3378,7 +3446,6 @@ var RESERVED_SECRET_NAMES = /* @__PURE__ */ new Set([
   "API_WORKER_URL",
   "PLATFORM_WORKER_URL"
 ]);
-var SECRET_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
 var CONFIG_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
 var MAX_SECRET_VALUE_BYTES = 32 * 1024;
 function validateConfigName(configName) {
@@ -3391,6 +3458,12 @@ function validateConfigName(configName) {
   return configName;
 }
 function validateSecretName(name) {
+  if (name.length > MAX_BINDING_NAME_LENGTH) {
+    throw new InputError(
+      `Secret name "${name.slice(0, 64)}\u2026" is ${name.length} characters; the limit is ${MAX_BINDING_NAME_LENGTH}.`,
+      "invalid_secret_name"
+    );
+  }
   if (!SECRET_NAME_RE.test(name)) {
     throw new InputError(
       `Invalid secret name "${name}". Use letters, numbers, and underscores; start with a letter or underscore.`,
@@ -3946,7 +4019,7 @@ var dev_default = defineDeepspaceCommand({
       token = await ensureToken();
     } catch (err) {
       throw new Refusal(err instanceof Error ? err.message : String(err), "not_authenticated", {
-        action: cliAction("deepspace", "auth", "login")
+        action: loginAction()
       });
     }
     let payload;
@@ -3956,7 +4029,7 @@ var dev_default = defineDeepspaceCommand({
       throw new Refusal(
         "Malformed session token. Run `npx deepspace auth login`.",
         "not_authenticated",
-        { action: cliAction("deepspace", "auth", "login") }
+        { action: loginAction() }
       );
     }
     say(`Logged in as ${payload.name ?? payload.email}`);
@@ -4333,7 +4406,7 @@ function isAlive(pid) {
 }
 
 // src/cli/commands/test.ts
-import { existsSync as existsSync16, readdirSync as readdirSync5 } from "fs";
+import { existsSync as existsSync16, readFileSync as readFileSync13, readdirSync as readdirSync5, rmSync as rmSync6 } from "fs";
 import { join as join14, relative as relative2, resolve as resolve10, sep as sep2 } from "path";
 import { sync as spawnSync5 } from "cross-spawn";
 
@@ -4591,12 +4664,39 @@ function playwrightTestArgs(testFiles, flags = {}) {
     "tests/playwright.config.ts",
     "--output",
     PLAYWRIGHT_OUTPUT_DIR,
+    // The default list reporter stays for the live stream; the json reporter
+    // is what lets the CLI surface runtime skips and their authored reasons,
+    // which the list reporter swallows (AX C3, docs/audits/2026-09-01).
+    "--reporter=list,json",
     ...flags.grep ? ["--grep", flags.grep] : [],
     ...flags.project ? ["--project", flags.project] : [],
     ...flags.headed ? ["--headed"] : [],
     ...testFiles
   ];
 }
+function skippedTestsFromPlaywrightJson(raw) {
+  const skipped = [];
+  const walk = (suite) => {
+    for (const spec of suite.specs ?? []) {
+      for (const test of spec.tests ?? []) {
+        if (test.status !== "skipped") continue;
+        const note3 = test.annotations?.find((entry) => entry.type === "skip")?.description;
+        skipped.push({
+          spec: typeof spec.file === "string" ? spec.file : "",
+          title: typeof spec.title === "string" ? spec.title : "",
+          reason: typeof note3 === "string" && note3 ? note3 : null
+        });
+      }
+    }
+    for (const child of suite.suites ?? []) walk(child);
+  };
+  try {
+    walk(JSON.parse(raw));
+  } catch {
+    return [];
+  }
+  return skipped;
+}
 var test_default = defineDeepspaceCommand({
   meta: {
     name: "test",
@@ -4670,7 +4770,7 @@ var test_default = defineDeepspaceCommand({
       throw new Refusal(
         err instanceof Error ? err.message : "Not logged in. Run `deepspace auth login` first.",
         "not_authenticated",
-        { action: cliAction("deepspace", "auth", "login") }
+        { action: loginAction() }
       );
     }
     let generatedSecretsCache;
@@ -4706,15 +4806,21 @@ var test_default = defineDeepspaceCommand({
     }
     let exitCode = 0;
     let skippedSpecs = [];
+    let skippedTests = [];
+    const playwright = (testFiles) => {
+      const result = runPlaywright(appDir, testFiles, port, wranglerEnv, forwarded);
+      skippedTests = result.skippedTests;
+      return result.exitCode;
+    };
     switch (suite) {
       case "smoke":
-        exitCode = runPlaywright(appDir, ["tests/smoke.spec.ts"], port, wranglerEnv, forwarded);
+        exitCode = playwright(["tests/smoke.spec.ts"]);
         break;
       case "api":
-        exitCode = runPlaywright(appDir, ["tests/api.spec.ts"], port, wranglerEnv, forwarded);
+        exitCode = playwright(["tests/api.spec.ts"]);
         break;
       case "e2e":
-        exitCode = runPlaywright(appDir, [], port, wranglerEnv, forwarded);
+        exitCode = playwright([]);
         break;
       case "unit":
         if (forwarded.grep || forwarded.project || forwarded.headed) {
@@ -4728,12 +4834,12 @@ var test_default = defineDeepspaceCommand({
         exitCode = runVitest(appDir, wranglerEnv);
         if (exitCode === 0) {
           await ensurePortFree(port, "0.0.0.0");
-          exitCode = runPlaywright(appDir, [], port, wranglerEnv, forwarded);
+          exitCode = playwright([]);
         }
         break;
       case "default":
         skippedSpecs = specsSkippedByDefaultSuite(appDir);
-        exitCode = runPlaywright(appDir, [...DEFAULT_SUITE_SPECS], port, wranglerEnv, forwarded);
+        exitCode = playwright([...DEFAULT_SUITE_SPECS]);
         if (skippedSpecs.length > 0) {
           say(
             `skipped ${skippedSpecs.length} spec file(s) not in smoke+api (${skippedSpecs.join(", ")}) \u2014 run 'deepspace test run all'`
@@ -4749,7 +4855,7 @@ var test_default = defineDeepspaceCommand({
               "spec_not_found"
             );
           }
-          exitCode = runPlaywright(appDir, [suite], port, wranglerEnv, forwarded);
+          exitCode = playwright([suite]);
         } else {
           throw new Refusal(
             `Unknown test suite: ${suite}
@@ -4758,12 +4864,20 @@ Available: smoke, api, e2e, unit, all \u2014 or a path to one spec file (tests/<
           );
         }
     }
+    if (skippedTests.length > 0) {
+      const reasons = [...new Set(skippedTests.map((test) => test.reason).filter(Boolean))];
+      say(
+        `${skippedTests.length} test(s) were skipped at runtime` + (reasons.length > 0 ? ` \u2014 ${reasons.join(" | ")}` : "")
+      );
+    }
     if (exitCode !== 0) {
       throw new Refusal(`Test suite '${suite}' failed (exit ${exitCode}).`, "tests_failed", {
-        extra: { suite, port, exitCode, skippedSpecs }
+        extra: { suite, port, exitCode, skippedSpecs, skippedTests }
       });
     }
-    return { data: { suite, port, appDir, wranglerEnv: wranglerEnv ?? null, skippedSpecs } };
+    return {
+      data: { suite, port, appDir, wranglerEnv: wranglerEnv ?? null, skippedSpecs, skippedTests }
+    };
   }
 });
 function runSuite(appDir, argv, wranglerEnv, extraEnv = {}) {
@@ -4788,10 +4902,19 @@ function runSuite(appDir, argv, wranglerEnv, extraEnv = {}) {
   }
 }
 function runPlaywright(appDir, testFiles, port, wranglerEnv, flags = {}) {
-  return runSuite(appDir, playwrightTestArgs(testFiles, flags), wranglerEnv, {
+  const resultsPath = join14(appDir, ".deepspace", "playwright-results.json");
+  rmSync6(resultsPath, { force: true });
+  const exitCode = runSuite(appDir, playwrightTestArgs(testFiles, flags), wranglerEnv, {
     DEEPSPACE_PORT: String(port),
-    PLAYWRIGHT_HTML_OUTPUT_DIR: ".deepspace/playwright-report"
+    PLAYWRIGHT_HTML_OUTPUT_DIR: ".deepspace/playwright-report",
+    PLAYWRIGHT_JSON_OUTPUT_FILE: resultsPath
   });
+  let raw = "";
+  try {
+    raw = readFileSync13(resultsPath, "utf-8");
+  } catch {
+  }
+  return { exitCode, skippedTests: skippedTestsFromPlaywrightJson(raw) };
 }
 function runVitest(appDir, wranglerEnv) {
   return runSuite(appDir, ["vitest", "run", "--passWithNoTests"], wranglerEnv);
@@ -5405,14 +5528,30 @@ var CONSECUTIVE_MATCHES = 10;
 var MATCH_INTERVAL_MS = 250;
 async function waitForLiveRelease(url, releaseStamp, timeoutMs) {
   if (!releaseStamp) return "unverifiable";
+  return agreeingProbes(
+    timeoutMs,
+    async (attempt) => servesRelease(bustedUrl(RELEASE_STAMP_PATH, url, attempt), releaseStamp)
+  );
+}
+async function waitForHostReleased(url, timeoutMs) {
+  return agreeingProbes(timeoutMs, async (attempt) => {
+    const result = await getOnFreshConnection(bustedUrl("/", url, attempt));
+    return result !== null && result.statusCode === 404;
+  });
+}
+async function waitForDataPlane(url, appId, timeoutMs) {
+  return agreeingProbes(timeoutMs, async (attempt) => {
+    const result = await getOnFreshConnection(bustedUrl(`/ws/app:${appId}`, url, attempt));
+    return result !== null && result.statusCode < 500;
+  });
+}
+async function agreeingProbes(timeoutMs, probe) {
   const deadline = Date.now() + timeoutMs;
   let attempt = 0;
   let streak = 0;
   while (Date.now() < deadline) {
     attempt++;
-    const probe = new URL(RELEASE_STAMP_PATH, url);
-    probe.searchParams.set("probe", `${Date.now()}-${attempt}`);
-    if (await servesRelease(probe, releaseStamp)) {
+    if (await probe(attempt)) {
       streak++;
       if (streak >= CONSECUTIVE_MATCHES) return "confirmed";
       await sleep2(MATCH_INTERVAL_MS);
@@ -5423,11 +5562,16 @@ async function waitForLiveRelease(url, releaseStamp, timeoutMs) {
   }
   return "unconfirmed";
 }
+function bustedUrl(path, base, attempt) {
+  const probe = new URL(path, base);
+  probe.searchParams.set("probe", `${Date.now()}-${attempt}`);
+  return probe;
+}
 async function servesRelease(probe, releaseStamp) {
-  const body = await getOnFreshConnection(probe);
-  if (body === null) return false;
+  const result = await getOnFreshConnection(probe);
+  if (result === null || result.statusCode !== 200) return false;
   try {
-    return JSON.parse(body).release === releaseStamp;
+    return JSON.parse(result.body).release === releaseStamp;
   } catch {
     return false;
   }
@@ -5439,17 +5583,13 @@ function getOnFreshConnection(url, timeoutMs = 5e3) {
       url,
       { method: "GET", agent: false, timeout: timeoutMs, headers: { "cache-control": "no-cache" } },
       (response) => {
-        if (response.statusCode !== 200) {
-          response.resume();
-          resolve23(null);
-          return;
-        }
+        const statusCode = response.statusCode ?? 0;
         let body = "";
         response.setEncoding("utf8");
         response.on("data", (chunk) => {
           if (body.length < 4096) body += chunk;
         });
-        response.on("end", () => resolve23(body));
+        response.on("end", () => resolve23({ statusCode, body }));
         response.on("error", () => resolve23(null));
       }
     );
@@ -5533,7 +5673,7 @@ function describeFilesFailure(status3, body) {
 import * as p6 from "@clack/prompts";
 import { execSync as execSync2 } from "child_process";
 import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync20, readFileSync as readFileSync15, readdirSync as readdirSync7 } from "fs";
+import { existsSync as existsSync20, readFileSync as readFileSync16, readdirSync as readdirSync7 } from "fs";
 import { dirname as dirname7, isAbsolute as isAbsolute4, join as join18, relative as relative3, resolve as resolve14, sep as sep3 } from "path";
 
 // src/build/app-id.ts
@@ -5564,7 +5704,7 @@ function removeBuildDevVars(workerDir) {
 }
 
 // src/documentation/deploy.ts
-import { existsSync as existsSync18, readFileSync as readFileSync13 } from "fs";
+import { existsSync as existsSync18, readFileSync as readFileSync14 } from "fs";
 import { join as join16 } from "path";
 function readDocumentationDeployManifest(appDir, clientDir) {
   if (!existsSync18(join16(appDir, "documentation.json"))) return void 0;
@@ -5574,11 +5714,11 @@ function readDocumentationDeployManifest(appDir, clientDir) {
       "documentation.json exists but the build produced no documentation manifest. Ensure vite.config.ts includes deepSpaceDocumentation() from deepspace/documentation."
     );
   }
-  return JSON.parse(readFileSync13(manifestPath, "utf8"));
+  return JSON.parse(readFileSync14(manifestPath, "utf8"));
 }
 
 // src/cli/commands/update/app-migrations.ts
-import { existsSync as existsSync19, readFileSync as readFileSync14 } from "fs";
+import { existsSync as existsSync19, readFileSync as readFileSync15 } from "fs";
 import { join as join17 } from "path";
 
 // src/shared/protocol/app-migrations.ts
@@ -5657,7 +5797,7 @@ function readAppliedAppMigrations(appDir) {
   if (!existsSync19(path)) return [];
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync14(path, "utf8"));
+    parsed = JSON.parse(readFileSync15(path, "utf8"));
   } catch {
     throw new Refusal(
       `${APP_MIGRATIONS_MANIFEST} must contain valid JSON`,
@@ -5723,12 +5863,12 @@ async function buildDeployBundle(options) {
       "build_output_missing"
     );
   }
-  const deployConfig = JSON.parse(readFileSync15(deployConfigPath, "utf-8"));
+  const deployConfig = JSON.parse(readFileSync16(deployConfigPath, "utf-8"));
   const outputWranglerPath = resolve14(dirname7(deployConfigPath), deployConfig.configPath);
   if (!existsSync20(outputWranglerPath)) {
     output.die(`Output wrangler.json not found at ${outputWranglerPath}`, "build_output_missing");
   }
-  const outputConfig = JSON.parse(readFileSync15(outputWranglerPath, "utf-8"));
+  const outputConfig = JSON.parse(readFileSync16(outputWranglerPath, "utf-8"));
   if (outputConfig.name && outputConfig.name !== appName) {
     const envHint = envName ? ` (--env ${envName})` : "";
     output.die(
@@ -5829,7 +5969,7 @@ function collectWorkerBundle(workerDir, mainPath, clientDir) {
       if (entry.isDirectory()) {
         walk(fullPath);
       } else if (entry.isFile() && WORKER_ES_MODULE.test(entry.name)) {
-        modules.push({ name: moduleName(root, fullPath), content: readFileSync15(fullPath, "utf-8") });
+        modules.push({ name: moduleName(root, fullPath), content: readFileSync16(fullPath, "utf-8") });
       }
     }
   };
@@ -5883,7 +6023,7 @@ function clientAppIdRefusal(assets, appId, envName) {
   for (const asset of assets) {
     if (!CLIENT_CODE_ASSET.test(asset.path)) continue;
     if (DOCUMENTATION_OUTPUT.test(asset.path)) continue;
-    const source = readFileSync15(asset.sourcePath, "utf-8");
+    const source = readFileSync16(asset.sourcePath, "utf-8");
     if (unsubstituted === void 0 && source.includes(APP_ID_DEFINE)) unsubstituted = asset.path;
     for (const found of source.matchAll(APP_ID_LITERAL)) {
       if (found[0] !== appId && !foreign.has(found[0])) foreign.set(found[0], asset.path);
@@ -5917,7 +6057,7 @@ function collectAssets(dir) {
       if (entry.isDirectory()) {
         walk(fullPath, relativePath);
       } else {
-        const bytes = readFileSync15(fullPath);
+        const bytes = readFileSync16(fullPath);
         assets.push({
           path: `/${relativePath}`,
           hash: createHash2("sha256").update(bytes).digest("hex"),
@@ -5938,7 +6078,7 @@ function readDeployAssetConfig(clientDir) {
   ]) {
     const filePath = join18(clientDir, file);
     if (!existsSync20(filePath)) continue;
-    const content = readFileSync15(filePath, "utf8");
+    const content = readFileSync16(filePath, "utf8");
     if (content.trim()) config[key] = content;
   }
   return config;
@@ -6263,7 +6403,7 @@ function createDeployOutput(json) {
 
 // src/cli/commands/deploy/request.ts
 import * as p11 from "@clack/prompts";
-import { readFileSync as readFileSync16 } from "fs";
+import { readFileSync as readFileSync17 } from "fs";
 
 // src/cli/commands/deploy/repository.ts
 import * as p9 from "@clack/prompts";
@@ -7434,7 +7574,7 @@ async function uploadDeployAssetsWithAuth(options, auth2) {
             // against the plan before it touches storage, and a stream body
             // would be sent chunked with no length at all; a retry also needs a
             // body it can send again.
-            body: readFileSync16(asset.sourcePath)
+            body: readFileSync17(asset.sourcePath)
           }),
           { attempts: ASSET_UPLOAD_ATTEMPTS, timeoutMs: ASSET_UPLOAD_ATTEMPT_TIMEOUT_MS }
         )
@@ -7479,7 +7619,10 @@ function isDeployServiceResourceLimit(status3, error) {
 }
 function formatDeployWorkerError(status3, error, code) {
   const detail = error ?? `Deployment error (${status3})`;
-  if (code === "cli_outdated" || code === "secrets_read_failed" || code === "release_reconciliation_pending") {
+  if (code === "cli_outdated" || code === "secrets_read_failed" || code === "release_reconciliation_pending" || // Cloudflare deterministically rejected this upload; the sentence already
+  // names the input to fix, and incident boilerplate would prescribe an
+  // infinite wait-and-retry loop (AX S1, docs/audits/2026-09-01).
+  code === "worker_upload_rejected") {
     return detail;
   }
   if (isDeployServiceResourceLimit(status3, error)) {
@@ -7506,8 +7649,9 @@ function errorMessage5(error) {
 
 // src/cli/commands/deploy/lock.ts
 import { randomUUID as randomUUID2 } from "crypto";
-import { mkdirSync as mkdirSync8, readFileSync as readFileSync17, rmSync as rmSync6, writeFileSync as writeFileSync6 } from "fs";
+import { mkdirSync as mkdirSync8, readFileSync as readFileSync18, rmSync as rmSync7, statSync as statSync3, writeFileSync as writeFileSync6 } from "fs";
 import { dirname as dirname8, join as join20 } from "path";
+var DEPLOY_LOCK_MAX_AGE_MS = 10 * 6e4;
 function deployLockPath(appDir) {
   return join20(appDir, ".deepspace", "deploy.lock");
 }
@@ -7519,29 +7663,58 @@ function acquireDeployLock(appDir) {
     startedAt: (/* @__PURE__ */ new Date()).toISOString(),
     token: randomUUID2()
   };
-  try {
-    writeFileSync6(path, JSON.stringify(record), { flag: "wx" });
-  } catch (err) {
-    if (err.code !== "EEXIST") throw err;
-    const holder = readLock(path);
-    throw new Refusal(
-      (holder ? `Another deploy of this directory holds the deploy lock (pid ${holder.pid}, started ${holder.startedAt})` : `A deploy lock is present at ${path} but unreadable, so this run cannot tell whether a deploy is live`) + ` \u2014 two deploys of one checkout race on its build output. Judge liveness by the START TIME, not the pid: no deploy runs longer than a few minutes, so a lock older than ~10 minutes is a dead deploy (in containers the pid can read as alive \u2014 a reaped child leaves a zombie \`ps\` still reports). Then remove ${path} and retry.`,
-      "deploy_in_progress",
-      {
-        extra: {
-          lockPath: path,
-          ...holder ? { holder: { pid: holder.pid, startedAt: holder.startedAt } } : {}
+  const take = () => {
+    try {
+      writeFileSync6(path, JSON.stringify(record), { flag: "wx" });
+      return true;
+    } catch (err) {
+      if (err.code !== "EEXIST") throw err;
+      return false;
+    }
+  };
+  if (!take()) {
+    if (lockIsStale(path)) rmSync7(path, { force: true });
+    if (!take()) {
+      const holder = readLock(path);
+      throw new Refusal(
+        (holder ? `Another deploy of this directory holds the deploy lock (pid ${holder.pid}, started ${holder.startedAt})` : `A fresh deploy lock is present at ${path} but unreadable, so this run cannot tell whether a deploy is live`) + ` \u2014 two deploys of one checkout race on its build output. Dead and stale locks are reclaimed automatically, so this holder still looks live; wait for it to finish, or remove ${path} and retry only if you are certain no deploy is running.`,
+        "deploy_in_progress",
+        {
+          extra: {
+            lockPath: path,
+            ...holder ? { holder: { pid: holder.pid, startedAt: holder.startedAt } } : {}
+          }
         }
-      }
-    );
+      );
+    }
   }
-  return () => {
-    if (readLock(path)?.token === record.token) rmSync6(path, { force: true });
+  const onSignal = (signal) => {
+    release2();
+    process.stderr.write(`Deploy interrupted by ${signal}; released the deploy lock.
+`);
+    process.exit(signal === "SIGTERM" ? 143 : 130);
   };
+  process.once("SIGINT", onSignal);
+  process.once("SIGTERM", onSignal);
+  function release2() {
+    process.removeListener("SIGINT", onSignal);
+    process.removeListener("SIGTERM", onSignal);
+    if (readLock(path)?.token === record.token) rmSync7(path, { force: true });
+  }
+  return release2;
+}
+function lockIsStale(path) {
+  try {
+    if (Date.now() - statSync3(path).mtimeMs > DEPLOY_LOCK_MAX_AGE_MS) return true;
+  } catch {
+    return false;
+  }
+  const holder = readLock(path);
+  return holder !== null && !processAlive(holder.pid);
 }
 function readLock(path) {
   try {
-    const parsed = JSON.parse(readFileSync17(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync18(path, "utf-8"));
     return typeof parsed.pid === "number" && typeof parsed.startedAt === "string" && typeof parsed.token === "string" ? { pid: parsed.pid, startedAt: parsed.startedAt, token: parsed.token } : null;
   } catch {
     return null;
@@ -7776,11 +7949,20 @@ async function runLockedDeploy(args, output, appDir, envName) {
     );
   }
   let serving = "unverifiable";
+  let dataPlane = "unconfirmed";
   const edgeWaitStarted = Date.now();
   if (body.url) {
     spinner2.message("Waiting for the edge to serve this release...");
     serving = await waitForLiveRelease(body.url, body.releaseStamp, 9e4);
-    if (serving === "confirmed") await wakeWorker(body.url);
+    if (serving === "confirmed") {
+      dataPlane = await waitForDataPlane(body.url, appId, 3e4);
+      await wakeWorker(body.url);
+      if (dataPlane === "unconfirmed") {
+        p12.log.warn(
+          "The edge serves the new release, but its worker still answered 5xx on the data plane \u2014 Durable Object bindings can lag a redeploy briefly. First requests may fail; retry before asserting against the app."
+        );
+      }
+    }
     if (serving !== "confirmed") {
       spinner2.stop(
         serving === "unconfirmed" ? "Deployed \u2014 the edge is still rolling this release out" : "Deployed \u2014 serving could not be verified from here"
@@ -7799,6 +7981,7 @@ async function runLockedDeploy(args, output, appDir, envName) {
           releaseId: body.releaseId ?? null,
           bundleRetained: body.bundleRetained ?? null,
           serving,
+          dataPlane,
           recoverable: repository.recoverable,
           ...worktree,
           ...renameFields,
@@ -7810,7 +7993,7 @@ async function runLockedDeploy(args, output, appDir, envName) {
     }
   }
   spinner2.stop(
-    `Deployed! (edge confirmed in ${Math.round((Date.now() - edgeWaitStarted) / 1e3)}s)`
+    `Deployed! (edge${dataPlane === "confirmed" ? " + data plane" : ""} confirmed in ${Math.round((Date.now() - edgeWaitStarted) / 1e3)}s)`
   );
   p12.log.success(`Live at: ${body.url}`);
   await syncPostDeployCommerce(appDir, appId, output.nonInteractive);
@@ -7823,6 +8006,7 @@ async function runLockedDeploy(args, output, appDir, envName) {
       // Always present, so a caller branches on one field instead of
       // inferring success from an absent one.
       serving,
+      dataPlane,
       releaseId: body.releaseId ?? null,
       bundleRetained: body.bundleRetained ?? null,
       recoverable: repository.recoverable,
@@ -7952,7 +8136,7 @@ var undeploy_default = defineDeepspaceCommand({
       token = await ensureToken();
     } catch (err) {
       throw new Refusal(err instanceof Error ? err.message : String(err), "not_authenticated", {
-        action: cliAction("deepspace", "auth", "login")
+        action: loginAction()
       });
     }
     let appId;
@@ -8023,13 +8207,20 @@ var undeploy_default = defineDeepspaceCommand({
     }
     const hosts = body.releasedHosts ?? [];
     const alreadyUndeployed = hosts.length === 0;
-    s?.stop(alreadyUndeployed ? "Nothing to remove" : "Removed");
+    let released = null;
+    if (!alreadyUndeployed) {
+      s?.message("Waiting for the edge to release the host...");
+      released = await waitForHostReleased(`https://${hosts[0]}`, 9e4);
+    }
+    s?.stop(
+      alreadyUndeployed ? "Nothing to remove" : released === "confirmed" ? "Removed (edge confirmed the takedown)" : "Removed \u2014 the edge is still releasing the host"
+    );
     if (!args.json) {
       p13.outro(
-        alreadyUndeployed ? `${target2} was already offline \u2014 no URL was serving, so nothing changed. The app keeps its id; redeploy to bring it back.` : `${hosts.join(", ")} taken down. The app keeps its id \u2014 redeploy to bring it back.`
+        alreadyUndeployed ? `${target2} was already offline \u2014 no URL was serving, so nothing changed. The app keeps its id; redeploy to bring it back.` : `${hosts.join(", ")} taken down${released === "confirmed" ? "" : " (cached edges may answer 200 for a short while yet)"}. The app keeps its id \u2014 redeploy to bring it back.`
       );
     }
-    return { data: { appId, releasedHosts: hosts, alreadyUndeployed } };
+    return { data: { appId, releasedHosts: hosts, alreadyUndeployed, released } };
   }
 });
 
@@ -8044,7 +8235,7 @@ var whoami_default = defineDeepspaceCommand({
     } catch (err) {
       const msg = err instanceof Error ? err.message : "Not logged in. Run `deepspace auth login` first.";
       throw isNetworkError(err) ? new Refusal(msg, "network_error") : new Refusal(msg, "not_authenticated", {
-        action: cliAction("deepspace", "auth", "login")
+        action: loginAction()
       });
     }
     let payload;
@@ -8052,7 +8243,7 @@ var whoami_default = defineDeepspaceCommand({
       payload = decodeJwtPayload(jwt);
     } catch {
       throw new Refusal("Malformed session token. Run `deepspace auth login` again.", "not_authenticated", {
-        action: cliAction("deepspace", "auth", "login")
+        action: loginAction()
       });
     }
     const isTestAccount = !!payload.email?.endsWith("@deepspace.test");
@@ -8563,7 +8754,7 @@ var usage_default = defineDeepspaceCommand({
 });
 
 // src/cli/commands/add.ts
-import { existsSync as existsSync23, readFileSync as readFileSync19, realpathSync as realpathSync4 } from "fs";
+import { existsSync as existsSync23, readFileSync as readFileSync20, realpathSync as realpathSync4 } from "fs";
 import { dirname as dirname10, join as join23, resolve as resolve17 } from "path";
 import { pathToFileURL as pathToFileURL3 } from "url";
 
@@ -8576,10 +8767,10 @@ import {
   mkdirSync as mkdirSync9,
   mkdtempSync,
   openSync as openSync2,
-  readFileSync as readFileSync18,
+  readFileSync as readFileSync19,
   readSync,
   readdirSync as readdirSync8,
-  rmSync as rmSync7,
+  rmSync as rmSync8,
   writeFileSync as writeFileSync7
 } from "fs";
 import { spawnSync as spawnSync7 } from "child_process";
@@ -8593,7 +8784,7 @@ function featurePackageRoot(moduleUrl = import.meta.url) {
     const packagePath = join22(dir, "package.json");
     if (existsSync22(packagePath)) {
       try {
-        const pkg2 = JSON.parse(readFileSync18(packagePath, "utf-8"));
+        const pkg2 = JSON.parse(readFileSync19(packagePath, "utf-8"));
         if (pkg2.name === "deepspace") return dir;
       } catch {
       }
@@ -8610,7 +8801,7 @@ function readFeatureConfig(id, packageRoot = featurePackageRoot()) {
   const configPath = join22(packageRoot, "features", id, "feature.json");
   if (!existsSync22(configPath)) return null;
   try {
-    const config = JSON.parse(readFileSync18(configPath, "utf-8"));
+    const config = JSON.parse(readFileSync19(configPath, "utf-8"));
     if (typeof config.id !== "string" || typeof config.name !== "string" || !Array.isArray(config.files)) {
       return null;
     }
@@ -8662,7 +8853,7 @@ function copyFile(src, dest) {
 function copyFileWithImportShift(src, dest, levels) {
   mkdirSync9(dirname9(dest), { recursive: true });
   const prefix = "../".repeat(levels);
-  const shifted = readFileSync18(src, "utf-8").replace(
+  const shifted = readFileSync19(src, "utf-8").replace(
     /(from\s+|import\s+|import\()(['"])(\.\.\/)/g,
     `$1$2${prefix}$3`
   );
@@ -8721,7 +8912,7 @@ function integrateSchema(config, targetDir, emit) {
   if (!existsSync22(schemasPath)) {
     return [unresolvedSchema(config.schema, "src/schemas.ts was not found.", emit)];
   }
-  let content = readFileSync18(schemasPath, "utf-8");
+  let content = readFileSync19(schemasPath, "utf-8");
   const { exportName, importPath, spreadOperator } = config.schema;
   const importPattern = new RegExp(`^import\\s+\\{[^}]*\\b${exportName}\\b`, "m");
   if (importPattern.test(content)) {
@@ -8778,7 +8969,7 @@ function integrateActions(config, targetDir, emit) {
   if (!existsSync22(actionsPath)) {
     return [unresolvedActions(config.actions, "src/actions/index.ts was not found.", emit)];
   }
-  let content = readFileSync18(actionsPath, "utf-8");
+  let content = readFileSync19(actionsPath, "utf-8");
   const registryPattern = /export const actions:\s*Record<string,\s*ActionHandler(?:<[^>]*>)?>\s*=\s*\{/;
   if (!registryPattern.test(content)) {
     const reason = "src/actions/index.ts has an unexpected structure.";
@@ -8833,7 +9024,7 @@ function integrateCode(config, targetDir, emit) {
       });
       continue;
     }
-    const original = readFileSync18(targetPath, "utf-8");
+    const original = readFileSync19(targetPath, "utf-8");
     if (original.includes(insertion.insert.trim())) {
       emit(`   Integration already present: ${insertion.file}`);
       continue;
@@ -8871,7 +9062,7 @@ ${content.slice(
 function integrateIgnore(config, targetDir) {
   if (!config.ignore?.length) return;
   const targetPath = join22(targetDir, ".gitignore");
-  const current = existsSync22(targetPath) ? readFileSync18(targetPath, "utf-8") : "";
+  const current = existsSync22(targetPath) ? readFileSync19(targetPath, "utf-8") : "";
   const present = new Set(current.split(/\r?\n/).map((line) => line.trim()));
   const missing = config.ignore.filter((pattern) => !present.has(pattern));
   if (missing.length === 0) return;
@@ -8891,7 +9082,7 @@ function integrateWrangler(config, targetDir, emit) {
   if (!existsSync22(targetPath)) {
     return [{ area: "wrangler", reason: "wrangler.toml was not found.", steps }];
   }
-  let source = readFileSync18(targetPath, "utf-8");
+  let source = readFileSync19(targetPath, "utf-8");
   if (runWorkerFirst && !/^\[assets\]\s*$/m.test(source)) {
     return [{ area: "wrangler", reason: "wrangler.toml has no [assets] section.", steps }];
   }
@@ -8988,7 +9179,7 @@ function integrateRoute(config, targetDir, emit) {
   if (!existsSync22(navPath)) {
     return [unresolvedRoute(config.route, config, "src/nav.ts was not found.", emit)];
   }
-  let content = readFileSync18(navPath, "utf-8");
+  let content = readFileSync19(navPath, "utf-8");
   const routePath = config.route.path;
   if (content.includes(`'${routePath}'`)) {
     emit(`   Nav already present: ${routePath}`);
@@ -9050,7 +9241,7 @@ function runPackageInstall(packageManager, targetDir, outputVisible) {
     };
   } finally {
     if (outputFd !== void 0) closeSync2(outputFd);
-    rmSync7(captureDir, { recursive: true, force: true });
+    rmSync8(captureDir, { recursive: true, force: true });
   }
 }
 function integrateDependencies(config, targetDir, runInstall, outputVisible, emit) {
@@ -9069,7 +9260,7 @@ function integrateDependencies(config, targetDir, runInstall, outputVisible, emi
   }
   let pkg2;
   try {
-    pkg2 = JSON.parse(readFileSync18(packagePath, "utf-8"));
+    pkg2 = JSON.parse(readFileSync19(packagePath, "utf-8"));
   } catch (error) {
     emit(
       `   Could not patch package.json (parse error: ${error instanceof Error ? error.message : String(error)})`
@@ -9129,7 +9320,7 @@ ${child.diagnosticTail}` : "";
 }
 function dependencySnapshot(targetDir) {
   try {
-    const pkg2 = JSON.parse(readFileSync18(join22(targetDir, "package.json"), "utf-8"));
+    const pkg2 = JSON.parse(readFileSync19(join22(targetDir, "package.json"), "utf-8"));
     return {
       dependencies: pkg2.dependencies ?? {},
       devDependencies: pkg2.devDependencies ?? {}
@@ -9377,7 +9568,7 @@ function isDeepSpaceApp(dir) {
   const packagePath = join23(dir, "package.json");
   if (!existsSync23(packagePath)) return false;
   try {
-    const pkg2 = JSON.parse(readFileSync19(packagePath, "utf-8"));
+    const pkg2 = JSON.parse(readFileSync20(packagePath, "utf-8"));
     return Boolean(pkg2.dependencies?.deepspace || pkg2.devDependencies?.deepspace);
   } catch {
     return false;
@@ -9849,10 +10040,10 @@ var domain_default = defineCommand5({
 // src/cli/commands/app-files.ts
 import { defineCommand as defineCommand6 } from "citty";
 import { basename as basename4, resolve as resolve18 } from "path";
-import { existsSync as existsSync24, statSync as statSync4 } from "fs";
+import { existsSync as existsSync24, statSync as statSync5 } from "fs";
 
 // src/cli/lib/app-files-api.ts
-import { createWriteStream, openAsBlob, statSync as statSync3 } from "fs";
+import { createWriteStream, openAsBlob, statSync as statSync4 } from "fs";
 import { basename as basename3, extname } from "path";
 import { Readable } from "stream";
 import { pipeline } from "stream/promises";
@@ -9962,7 +10153,7 @@ Content-Type: ${contentType}\r
 }
 async function uploadAppFile(baseUrl, token, appId, localPath, key, onProgress) {
   const path = filesPath(appId, `/upload?key=${encodeKeyPath(key)}`);
-  const size = statSync3(localPath).size;
+  const size = statSync4(localPath).size;
   if (size > MAX_APP_FILE_BYTES) {
     throw new ApiError(oversizeMessage(size), 0, "too_large", path);
   }
@@ -10128,7 +10319,7 @@ var put = defineDeepspaceCommand({
   },
   async run({ args }) {
     const localPath = resolve18(String(args.file));
-    if (!existsSync24(localPath) || !statSync4(localPath).isFile()) {
+    if (!existsSync24(localPath) || !statSync5(localPath).isFile()) {
       throw new Refusal(`No such file: ${args.file}`, "file_not_found");
     }
     const key = requireKey(args.key ?? basename4(localPath));
@@ -10638,7 +10829,7 @@ var transfer_default = defineCommand8({
 import { defineCommand as defineCommand9 } from "citty";
 
 // src/cli/commands/_invoke-impl.ts
-import { readFileSync as readFileSync20 } from "fs";
+import { readFileSync as readFileSync21 } from "fs";
 import * as p15 from "@clack/prompts";
 var API_URL7 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
 var DEFAULT_TIMEOUT_MS = 12e4;
@@ -10685,7 +10876,7 @@ async function resolveBody(opts) {
         "no_stdin"
       );
     }
-    raw = opts.bodyFile === "-" ? await readStreamText(process.stdin) : readFileSync20(opts.bodyFile, "utf-8");
+    raw = opts.bodyFile === "-" ? await readStreamText(process.stdin) : readFileSync21(opts.bodyFile, "utf-8");
     if (opts.bodyFile === "-" && raw.trim() === "") {
       throw new Refusal(
         "Nothing arrived on stdin \u2014 check the command feeding this one, or pass --body / a file path.",
@@ -10704,12 +10895,12 @@ async function resolveBody(opts) {
   return raw;
 }
 async function fetchCatalog(opts = {}) {
-  const url = opts.summary ? `${API_URL7}/api/integrations?summary=1` : `${API_URL7}/api/integrations`;
-  const res = await fetch(url);
-  if (!res.ok) {
-    throw new Refusal(`Failed to fetch integration catalog (${res.status})`, "catalog_unavailable");
+  try {
+    return await fetchIntegrationCatalog(API_URL7, { summary: opts.summary });
+  } catch (err) {
+    if (err instanceof ApiError) throw new Refusal(err.message, err.code ?? "catalog_unavailable");
+    throw err;
   }
-  return await res.json();
 }
 function findEndpoint(catalog, integration, endpoint) {
   const endpoints = catalog.integrations[integration];
@@ -10793,9 +10984,13 @@ function requireEndpoint(catalog, integration, endpoint) {
   const available = catalog.integrations[integration];
   if (!available) {
     const names = Object.keys(catalog.integrations).sort().join(", ");
-    throw new Refusal(`Unknown integration '${integration}'. Available: ${names}`, "unknown_integration", {
-      action: cliAction("deepspace", "integrations", "list")
-    });
+    throw new Refusal(
+      `Unknown integration '${integration}'. Available: ${names}`,
+      "unknown_integration",
+      {
+        action: cliAction("deepspace", "integrations", "list")
+      }
+    );
   }
   const endpoints = available.map((e) => e.endpoint).join(", ");
   throw new Refusal(
@@ -10811,9 +11006,7 @@ async function runInfo(args) {
   if (!args.json) {
     console.log(`${integration}/${endpoint}`);
     if (info2.description) console.log(`  ${info2.description}`);
-    console.log(
-      `  billing: ${priceLabel(info2.billing)}`
-    );
+    console.log(`  billing: ${priceLabel(info2.billing)}`);
     if (info2.requiresOAuth) {
       console.log(
         "  Requires OAuth: without a connected account, a call succeeds with data { requiresOAuth: true, authUrl } \u2014 open the authUrl, then retry."
@@ -10870,7 +11063,7 @@ async function runInvoke(args) {
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     throw new Refusal(msg, "not_authenticated", {
-      action: cliAction("deepspace", "auth", "login")
+      action: loginAction()
     });
   }
   const controller = new AbortController();
@@ -10926,7 +11119,7 @@ async function runInvoke(args) {
   delete rest.message;
   delete rest.code;
   throw new Refusal(lines.join("\n"), code, {
-    ...res.status === 401 ? { action: cliAction("deepspace", "auth", "login") } : {},
+    ...res.status === 401 ? { action: loginAction() } : {},
     extra: rest
   });
 }
@@ -11332,7 +11525,7 @@ async function callAgent(target2, path, init, timeout) {
     throw new Refusal(
       "Authentication was rejected. Run `deepspace auth login` and try again.",
       "not_authenticated",
-      { action: cliAction("deepspace", "auth", "login") }
+      { action: loginAction() }
     );
   }
 }
@@ -11423,7 +11616,7 @@ var agent_default = defineCommand10({
 
 // src/cli/commands/feedback.ts
 import * as p16 from "@clack/prompts";
-import { existsSync as existsSync25, readFileSync as readFileSync21 } from "fs";
+import { existsSync as existsSync25, readFileSync as readFileSync22 } from "fs";
 import { dirname as dirname11, join as join24 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { release } from "os";
@@ -11452,7 +11645,7 @@ function readCliVersion() {
     ];
     for (const path of candidates) {
       if (!existsSync25(path)) continue;
-      const pkg2 = JSON.parse(readFileSync21(path, "utf-8"));
+      const pkg2 = JSON.parse(readFileSync22(path, "utf-8"));
       if (pkg2.name === "deepspace" && pkg2.version) return pkg2.version;
     }
   } catch {
@@ -11627,7 +11820,7 @@ Context: deepspace ${payload.cliVersion} \xB7 ${payload.nodeVersion} \xB7 ${payl
       throw new Refusal(
         err.message ?? "Not signed in. Run `deepspace auth login`.",
         "not_authenticated",
-        { action: cliAction("deepspace", "auth", "login") }
+        { action: loginAction() }
       );
     }
     const result = await api3(token, "/api/feedback", {
@@ -11648,7 +11841,7 @@ Context: deepspace ${payload.cliVersion} \xB7 ${payload.nodeVersion} \xB7 ${payl
 
 // src/cli/commands/secrets.ts
 import { defineCommand as defineCommand11 } from "citty";
-import { readFileSync as readFileSync22 } from "fs";
+import { readFileSync as readFileSync23 } from "fs";
 
 // src/cli/lib/citty-args.ts
 function dedupePositionals(bound, rest) {
@@ -11963,7 +12156,7 @@ async function readUploadSource(file) {
     return readStreamText(process.stdin, MAX_STDIN_BYTES);
   }
   try {
-    return readFileSync22(file, "utf-8");
+    return readFileSync23(file, "utf-8");
   } catch (err) {
     const errno = err.code;
     if (typeof errno !== "string" || errno.length === 0) throw err;
@@ -12013,47 +12206,6 @@ var download = defineCommand11({
     process.stdout.write(formatSecretsDownload(secrets, format));
   }
 });
-var pull = defineCommand11({
-  meta: { name: "pull", description: "Refresh the .dev.vars cache from the app store" },
-  args: { ...COMMON_ARGS },
-  async run({ args }) {
-    const wranglerEnv = args.env?.trim() || void 0;
-    const appDir = findAppDir();
-    if (!appDir)
-      throw new InputError(
-        "Run from a DeepSpace app directory (one containing wrangler.toml).",
-        "not_in_app_repo"
-      );
-    const t = await resolveTarget(args, { register: true });
-    const ownerId = decodeJwtPayload(t.token).sub;
-    const refreshed = await refreshSecretsCache(
-      DEPLOY_URL12,
-      t.token,
-      t.appId,
-      wranglerEnv,
-      t.configName
-    );
-    try {
-      await writeDevVars(appDir, ownerId, t.token, wranglerEnv, {
-        appId: t.appId,
-        generatedSecretsCache: refreshed.rendered
-      });
-    } catch (err) {
-      if (args.app && err instanceof Refusal && err.code === "app_not_found") {
-        throw new Refusal(err.message, err.code);
-      }
-      throw err;
-    }
-    const count = Object.keys(refreshed.pulled?.values ?? {}).length;
-    ok(
-      args.json === true,
-      { appId: t.appId, config: t.configName, pulled: count },
-      () => console.log(
-        refreshed.pulled ? `Pulled ${count} secrets (${t.configName}) into .dev.vars.` : `Config ${t.configName} does not exist yet; regenerated .dev.vars without app secrets.`
-      )
-    );
-  }
-});
 var configsList = defineCommand11({
   meta: { name: "list", description: "List the app\u2019s configs" },
   args: { ...COMMON_ARGS },
@@ -12163,7 +12315,6 @@ var secrets_default = defineCommand11({
     delete: del2,
     upload,
     download,
-    pull,
     configs
   }
 });
@@ -12320,7 +12471,7 @@ var init_default = defineDeepspaceCommand({
 // src/cli/commands/status.ts
 import { defineCommand as defineCommand12 } from "citty";
 import * as p17 from "@clack/prompts";
-import { existsSync as existsSync26, readFileSync as readFileSync23 } from "fs";
+import { existsSync as existsSync26, readFileSync as readFileSync24 } from "fs";
 function timeAgo(iso) {
   const ms = Date.now() - Date.parse(iso);
   if (!Number.isFinite(ms) || ms < 0) return iso;
@@ -12424,7 +12575,7 @@ var status_default = defineCommand12({
       let undecodableToken = false;
       try {
         const payload = decodeJwtPayload(
-          readFileSync23(TOKEN_PATH, "utf-8").trim()
+          readFileSync24(TOKEN_PATH, "utf-8").trim()
         );
         if (payload.email) who = payload.email;
         userId = payload.sub ?? null;
@@ -13272,7 +13423,7 @@ var pull_default = defineDeepspaceCommand({
 
 // src/cli/commands/clone.ts
 import * as p20 from "@clack/prompts";
-import { existsSync as existsSync27, readdirSync as readdirSync9, rmSync as rmSync8 } from "fs";
+import { existsSync as existsSync27, readdirSync as readdirSync9, rmSync as rmSync9 } from "fs";
 import { resolve as resolve19, basename as basename5, join as join25 } from "path";
 function cleanFailedCloneDir(dir) {
   let entries;
@@ -13283,7 +13434,7 @@ function cleanFailedCloneDir(dir) {
   }
   if (entries.length === 1 && entries[0] === ".git") {
     try {
-      rmSync8(join25(dir, ".git"), { recursive: true, force: true });
+      rmSync9(join25(dir, ".git"), { recursive: true, force: true });
       return [];
     } catch {
       return entries;
@@ -13385,7 +13536,7 @@ var clone_default = defineDeepspaceCommand({
       },
       // One runnable follow-up instead of the old five-line "Next steps" block:
       // nothing else in the clone works until the deps are installed. Secrets
-      // (`deepspace secrets pull`) and `dev` follow from there.
+      // and `dev` (which refreshes `.dev.vars` itself) follow from there.
       action: { cwd: dir, argv: [detectPackageManager(dir), "install"] }
     };
   }
@@ -13525,6 +13676,12 @@ var rollback_default = defineDeepspaceCommand({
       type: "boolean",
       description: "Proceed even though the target release declares fewer Durable Object classes than the current one \u2014 THEIR STORED DATA IS DELETED.",
       default: false
+    },
+    yes: {
+      type: "boolean",
+      alias: "y",
+      description: "Skip the confirmation (required for --json / non-interactive)",
+      default: false
     }
   },
   async run({ args }) {
@@ -13556,7 +13713,15 @@ var rollback_default = defineDeepspaceCommand({
       if ("error" in picked) throw new Refusal(picked.error, picked.code);
       releaseId = picked.releaseId;
     }
-    spinner2?.message(`Rolling back to ${releaseId}\u2026`);
+    spinner2?.stop(`Rollback target: ${releaseId}`);
+    await requireConsent({
+      yes: Boolean(args.yes),
+      json: Boolean(args.json),
+      message: `This re-deploys release ${releaseId} as the live release of ${appId} (live secrets are kept, not the release's).`,
+      prompt: `Roll ${appId} back to ${releaseId}?`,
+      extra: { appId, releaseId }
+    });
+    spinner2?.start(`Rolling back to ${releaseId}\u2026`);
     let result;
     try {
       result = await apiFetch(DEPLOY_URL15, token, `/api/deploy/${appId}/rollback`, {
@@ -13773,10 +13938,10 @@ import * as p24 from "@clack/prompts";
 import {
   existsSync as existsSync28,
   mkdirSync as mkdirSync10,
-  readFileSync as readFileSync24,
+  readFileSync as readFileSync25,
   realpathSync as realpathSync6,
   renameSync as renameSync2,
-  statSync as statSync5,
+  statSync as statSync6,
   writeFileSync as writeFileSync8
 } from "fs";
 import { dirname as dirname12, isAbsolute as isAbsolute6, join as join26, relative as relative4, sep as sep4 } from "path";
@@ -13836,7 +14001,7 @@ function isManagedWorkspaceWorktree(worktreeRoot, workspaceId) {
   const markerPath = worktreeMarkerPath(worktreeRoot);
   if (!markerPath) return false;
   try {
-    const marker = JSON.parse(readFileSync24(markerPath, "utf-8"));
+    const marker = JSON.parse(readFileSync25(markerPath, "utf-8"));
     return marker.version === 1 && marker.workspaceId === workspaceId && marker.mode === "managed-linked";
   } catch {
     return false;
@@ -13879,7 +14044,7 @@ function rematerializeWorkspaceWorktree(appDir, worktreeRoot, branch, workspaceI
 function inOwnLinkedWorktree(appDir, id) {
   if (workspaceIdFromBranch(currentBranch(appDir)) !== id) return false;
   try {
-    return statSync5(join26(repoToplevel(appDir), ".git")).isFile();
+    return statSync6(join26(repoToplevel(appDir), ".git")).isFile();
   } catch {
     return false;
   }
@@ -14325,7 +14490,7 @@ var newWorkspaceCommand = defineDeepspaceCommand({
 
 // src/cli/commands/workspace/attach.ts
 import * as p26 from "@clack/prompts";
-import { existsSync as existsSync29, readdirSync as readdirSync10, realpathSync as realpathSync7, rmSync as rmSync9 } from "fs";
+import { existsSync as existsSync29, readdirSync as readdirSync10, realpathSync as realpathSync7, rmSync as rmSync10 } from "fs";
 import { isAbsolute as isAbsolute8, resolve as resolve21 } from "path";
 function samePath(a, b) {
   const real = (p34) => {
@@ -14356,7 +14521,7 @@ function cleanFailedFreshAttachDir(dir) {
     return entries;
   }
   try {
-    rmSync9(dir, { recursive: true, force: true });
+    rmSync10(dir, { recursive: true, force: true });
     return [];
   } catch {
     return entries.length > 0 ? entries : ["<cleanup-failed>"];
@@ -14892,13 +15057,13 @@ import * as p30 from "@clack/prompts";
 
 // src/cli/lib/validation.ts
 import { sync as spawnSync8 } from "cross-spawn";
-import { readFileSync as readFileSync25 } from "fs";
+import { readFileSync as readFileSync26 } from "fs";
 import { join as join27 } from "path";
 var MAX_SUMMARY_CHARS = 4e3;
 var MAX_OUTPUT_BUFFER = 64 * 1024 * 1024;
 function configuredCommand(appDir) {
   try {
-    const pkg2 = JSON.parse(readFileSync25(join27(appDir, "package.json"), "utf-8"));
+    const pkg2 = JSON.parse(readFileSync26(join27(appDir, "package.json"), "utf-8"));
     if (pkg2.scripts?.validate) return `${detectPackageManager(appDir)} run --silent validate`;
   } catch {
   }
@@ -15850,13 +16015,13 @@ function reportSource(appId, state, json) {
 
 // src/cli/commands/update.ts
 import * as p33 from "@clack/prompts";
-import { existsSync as existsSync30, readFileSync as readFileSync26 } from "fs";
+import { existsSync as existsSync30, readFileSync as readFileSync27 } from "fs";
 import { join as join28, resolve as resolve22 } from "path";
 
 // package.json
 var package_default = {
   name: "deepspace",
-  version: "0.29.0",
+  version: "0.30.0",
   engines: {
     node: ">=22.15.0 <23 || >=24 <25 || >=26 <27"
   },
@@ -16038,7 +16203,7 @@ function readManifest(appDir) {
     throw new Refusal("This app has no package.json \u2014 nothing to update.", "not_in_app_repo");
   }
   try {
-    return JSON.parse(readFileSync26(path, "utf8"));
+    return JSON.parse(readFileSync27(path, "utf8"));
   } catch {
     throw new Refusal("package.json must contain valid JSON.", "invalid_package_manifest");
   }
@@ -16074,7 +16239,7 @@ function usersSchemaVisibilityUpgradeInstruction(appDir) {
   const schemaName = "src/schemas/users-schema.ts";
   const path = join28(appDir, schemaName);
   if (!existsSync30(path)) return null;
-  const source = readFileSync26(path, "utf8");
+  const source = readFileSync27(path, "utf8");
   if (!/\bmember\s*:\s*\{[^}]*\bread\s*:\s*true\b/s.test(source)) return null;
   return `${schemaName}: review member user-row visibility at ${USERS_SCHEMA_VISIBILITY_GUIDE}; leave the app-owned schema unchanged until you choose its policy.`;
 }
@@ -16174,7 +16339,7 @@ process.stdout.on("error", (error) => {
   throw error;
 });
 var __dirname = dirname13(fileURLToPath3(import.meta.url));
-var pkg = JSON.parse(readFileSync27(join29(__dirname, "..", "package.json"), "utf-8"));
+var pkg = JSON.parse(readFileSync28(join29(__dirname, "..", "package.json"), "utf-8"));
 if (process.platform === "linux" && !process.env.SSL_CERT_FILE && existsSync31("/etc/ssl/certs/ca-certificates.crt")) {
   process.env.SSL_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt";
 }