deepspace 0.30.2 → 0.31.1

package/dist/cli.js

@@ -726,6 +726,12 @@ function effectivePlatformUrls(env = process.env) {
     deploy: env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy
   };
 }
+var {
+  auth: AUTH_URL,
+  api: API_URL,
+  platform: PLATFORM_URL,
+  deploy: DEPLOY_URL
+} = effectivePlatformUrls();
 var DASHBOARD_URL = DEEPSPACE_ENV === "production" ? "https://dashboard.deep.space" : DEEPSPACE_ENV === "staging" ? "https://dashboard.deepspacesites.com" : "http://127.0.0.1:9";
 
 // src/cli/auth.ts
@@ -824,7 +830,6 @@ function writeSecretFileSync(path, content) {
 }
 
 // src/cli/auth.ts
-var AUTH_URL = process.env.DEEPSPACE_AUTH_URL ?? PLATFORM_URLS.auth;
 var PROD_AUTH_URL = PLANE_AUTH_URLS.production;
 var DIR = join(homedir(), ".deepspace");
 function credentialSuffix(authUrl) {
@@ -843,18 +848,44 @@ function credentialPaths(authUrl = AUTH_URL) {
   return { sessionPath: join(DIR, `session${suffix}`), tokenPath: join(DIR, `token${suffix}`) };
 }
 var { sessionPath: SESSION_PATH, tokenPath: TOKEN_PATH } = credentialPaths();
+function errnoCode(error) {
+  const code = error?.code;
+  return typeof code === "string" && code.length > 0 ? code : void 0;
+}
+function readCredential(path) {
+  try {
+    return readFileSync2(path, "utf-8").trim();
+  } catch (error) {
+    const code = errnoCode(error);
+    if (code === "ENOENT") return null;
+    throw new Refusal(
+      `Could not read the DeepSpace CLI credential at ${path}${code ? ` (${code})` : ""}. Fix the file or directory permissions, then retry.`,
+      "credential_unreadable"
+    );
+  }
+}
+function writeCachedToken(token) {
+  try {
+    mkdirSync(DIR, { recursive: true, mode: 448 });
+    writeSecretFileSync(TOKEN_PATH, token);
+  } catch (error) {
+    const code = errnoCode(error);
+    throw new Refusal(
+      `Could not save the refreshed DeepSpace CLI token at ${TOKEN_PATH}${code ? ` (${code})` : ""}. Make ${DIR} writable and check available disk space, then retry.`,
+      "credential_unwritable"
+    );
+  }
+}
 async function ensureToken(options = {}) {
   const minimumValidityMs = options.minimumValidityMs ?? 3e4;
-  if (existsSync(TOKEN_PATH)) {
-    const existing = readFileSync2(TOKEN_PATH, "utf-8").trim();
-    if (isTokenValid(existing, minimumValidityMs)) {
-      return existing;
-    }
-  }
-  if (!existsSync(SESSION_PATH)) throw notAuthenticated("Not logged in");
-  const token = await exchangeStoredSession();
-  if (!token)
-    throw notAuthenticated("The stored session is no longer valid (expired or unreadable)");
+  const existing = readCredential(TOKEN_PATH);
+  if (existing !== null && isTokenValid(existing, minimumValidityMs)) {
+    return existing;
+  }
+  const sessionToken = readCredential(SESSION_PATH);
+  if (sessionToken === null) throw notAuthenticated("Not logged in");
+  const token = await exchangeAndCacheSession(sessionToken);
+  if (!token) throw notAuthenticated("The stored session is invalid");
   return token;
 }
 function loginAction() {
@@ -887,20 +918,21 @@ async function refreshTokenFromSession() {
   return await exchangeStoredSession();
 }
 async function mintAgentToken(target2) {
-  if (!existsSync(SESSION_PATH)) throw notAuthenticated("Not logged in");
-  const sessionToken = readFileSync2(SESSION_PATH, "utf-8").trim();
+  const sessionToken = readCredential(SESSION_PATH);
+  if (sessionToken === null) throw notAuthenticated("Not logged in");
   const token = await exchangeAgentSession(AUTH_URL, sessionToken, target2);
-  if (!token)
-    throw notAuthenticated("The stored session is no longer valid (expired or unreadable)");
+  if (!token) throw notAuthenticated("The stored session is invalid");
   return token;
 }
 async function exchangeStoredSession() {
-  if (!existsSync(SESSION_PATH)) return null;
-  const sessionToken = readFileSync2(SESSION_PATH, "utf-8").trim();
+  const sessionToken = readCredential(SESSION_PATH);
+  if (sessionToken === null) return null;
+  return await exchangeAndCacheSession(sessionToken);
+}
+async function exchangeAndCacheSession(sessionToken) {
   const token = await exchangeSession(AUTH_URL, sessionToken);
   if (!token) return null;
-  mkdirSync(DIR, { recursive: true, mode: 448 });
-  writeSecretFileSync(TOKEN_PATH, token);
+  writeCachedToken(token);
   return token;
 }
 registerAuthRefresh(refreshTokenFromSession);
@@ -940,8 +972,6 @@ async function readStreamText(stream, maxBytes) {
 }
 
 // src/cli/commands/login.ts
-var AUTH_URL2 = process.env.DEEPSPACE_AUTH_URL ?? PLATFORM_URLS.auth;
-var API_URL = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
 var login_default = defineDeepspaceCommand({
   meta: {
     name: "login",
@@ -1073,7 +1103,7 @@ async function createCliLoginSession(codeChallenge) {
   let sessionRes;
   try {
     sessionRes = await fetchWithTransientRetry(
-      `${AUTH_URL2}/api/auth/cli/session`,
+      `${AUTH_URL}/api/auth/cli/session`,
       () => ({
         method: "POST",
         headers: { "Content-Type": "application/json" },
@@ -1111,7 +1141,7 @@ async function pollForCompletion(sessionId, codeVerifier) {
   for (let i = 0; i < maxAttempts; i++) {
     await sleep(interval);
     try {
-      const res = await fetch(`${AUTH_URL2}/api/auth/cli/status/${sessionId}`, {
+      const res = await fetch(`${AUTH_URL}/api/auth/cli/status/${sessionId}`, {
         headers: { "x-code-verifier": codeVerifier }
       });
       if (res.status === 410 || res.status === 404) return null;
@@ -1131,7 +1161,7 @@ async function pollForCompletion(sessionId, codeVerifier) {
   return null;
 }
 function storeCredentials(sessionToken, jwt) {
-  const { sessionPath, tokenPath } = credentialPaths(AUTH_URL2);
+  const { sessionPath, tokenPath } = credentialPaths(AUTH_URL);
   mkdirSync2(dirname2(sessionPath), { recursive: true, mode: 448 });
   writeSecretFileSync(sessionPath, sessionToken);
   writeSecretFileSync(tokenPath, jwt);
@@ -1149,9 +1179,9 @@ function base64url(bytes) {
   return bytes.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 async function doEmailLogin(email, password) {
-  const res = await fetch(`${AUTH_URL2}/api/auth/sign-in/email`, {
+  const res = await fetch(`${AUTH_URL}/api/auth/sign-in/email`, {
     method: "POST",
-    headers: { "Content-Type": "application/json", Origin: AUTH_URL2 },
+    headers: { "Content-Type": "application/json", Origin: AUTH_URL },
     body: JSON.stringify({ email, password }),
     redirect: "manual"
   });
@@ -1168,7 +1198,7 @@ async function doEmailLogin(email, password) {
     throw new Refusal("The auth service returned no session cookie.", "login_failed");
   }
   const sessionToken = decodeURIComponent(cookieMatch[1]);
-  const jwt = await exchangeSession(AUTH_URL2, sessionToken);
+  const jwt = await exchangeSession(AUTH_URL, sessionToken);
   if (!jwt) {
     throw new Refusal(
       "Signed in, but the auth service issued no token for the session.",
@@ -1187,8 +1217,7 @@ async function doEmailLogin(email, password) {
 
 // src/cli/commands/logout.ts
 import { existsSync as existsSync2, readFileSync as readFileSync3, rmSync } from "fs";
-var AUTH_URL3 = process.env.DEEPSPACE_AUTH_URL ?? PLATFORM_URLS.auth;
-var { sessionPath: SESSION_PATH2, tokenPath: TOKEN_PATH2 } = credentialPaths(AUTH_URL3);
+var { sessionPath: SESSION_PATH2, tokenPath: TOKEN_PATH2 } = credentialPaths(AUTH_URL);
 var logout_default = defineDeepspaceCommand({
   meta: {
     name: "logout",
@@ -1198,11 +1227,11 @@ var logout_default = defineDeepspaceCommand({
     const sessionToken = existsSync2(SESSION_PATH2) ? readFileSync3(SESSION_PATH2, "utf-8").trim() : null;
     if (sessionToken) {
       try {
-        await fetch(`${AUTH_URL3}/api/auth/sign-out`, {
+        await fetch(`${AUTH_URL}/api/auth/sign-out`, {
           method: "POST",
           headers: {
             Cookie: `${SESSION_COOKIE}=${encodeURIComponent(sessionToken)}`,
-            Origin: AUTH_URL3
+            Origin: AUTH_URL
           }
         });
       } catch {
@@ -1815,7 +1844,6 @@ function appIdFromRepoUrl(url) {
 
 // src/cli/lib/app-registration.ts
 import { parse as parseToml2 } from "smol-toml";
-var DEPLOY_URL = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 async function mintAppIdentity(appDir, token, opts = {}) {
   const { appId } = await apiFetch(DEPLOY_URL, token, "/api/apps/mint", {
     method: "POST"
@@ -3926,7 +3954,6 @@ function resolvePort(arg) {
 // src/cli/commands/dev.ts
 var DEFAULT_DEV_HOST = "0.0.0.0";
 var READINESS_TIMEOUT_MS = 12e4;
-var DEPLOY_URL2 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 function noAppDirRefusal(start) {
   const children = findChildApps(start);
   const lines = [`No wrangler.toml found at or above ${start}.`];
@@ -4017,20 +4044,13 @@ var dev_default = defineDeepspaceCommand({
       updatePort: explicitPort
     });
     ensureInstallReady(appDir);
-    let token;
-    try {
-      token = await ensureToken();
-    } catch (err) {
-      throw new Refusal(err instanceof Error ? err.message : String(err), "not_authenticated", {
-        action: loginAction()
-      });
-    }
+    const token = await ensureToken();
     let payload;
     try {
       payload = decodeJwtPayload(token);
     } catch {
       throw new Refusal(
-        "Malformed session token. Run `npx deepspace auth login`.",
+        "Malformed session token. Run `deepspace auth login` again.",
         "not_authenticated",
         { action: loginAction() }
       );
@@ -4047,7 +4067,7 @@ var dev_default = defineDeepspaceCommand({
     const appIdForSecrets = await registerForLocalRun(appDir, token, wranglerEnv);
     if (appIdForSecrets) {
       try {
-        const refreshed = await refreshSecretsCache(DEPLOY_URL2, token, appIdForSecrets, wranglerEnv);
+        const refreshed = await refreshSecretsCache(DEPLOY_URL, token, appIdForSecrets, wranglerEnv);
         generatedSecretsCache = refreshed.rendered;
         if (refreshed.summary) say(refreshed.summary);
       } catch (err) {
@@ -4561,14 +4581,13 @@ var TestAccountServiceError = class extends Error {
 function serviceError(data, fallback) {
   return new TestAccountServiceError(data.error ?? fallback, data.code);
 }
-var AUTH_URL4 = process.env.DEEPSPACE_AUTH_URL ?? PLATFORM_URLS.auth;
 function sessionCookie() {
   const token = readFileSync12(SESSION_PATH, "utf-8").trim();
   return `${SESSION_COOKIE}=${encodeURIComponent(token)}`;
 }
 async function fetchRemoteTestAccounts() {
-  const response = await fetch(`${AUTH_URL4}/api/auth/test-accounts`, {
-    headers: { Cookie: sessionCookie(), Origin: AUTH_URL4 }
+  const response = await fetch(`${AUTH_URL}/api/auth/test-accounts`, {
+    headers: { Cookie: sessionCookie(), Origin: AUTH_URL }
   });
   const data = await response.json().catch(() => ({}));
   if (!response.ok || !data.accounts) {
@@ -4577,12 +4596,12 @@ async function fetchRemoteTestAccounts() {
   return data.accounts;
 }
 async function createRemoteTestAccount(input) {
-  const response = await fetch(`${AUTH_URL4}/api/auth/test-accounts`, {
+  const response = await fetch(`${AUTH_URL}/api/auth/test-accounts`, {
     method: "POST",
     headers: {
       "Content-Type": "application/json",
       Cookie: sessionCookie(),
-      Origin: AUTH_URL4
+      Origin: AUTH_URL
     },
     body: JSON.stringify(input)
   });
@@ -4593,9 +4612,9 @@ async function createRemoteTestAccount(input) {
   return { ...data, label: data.label ?? null };
 }
 async function recoverRemoteTestAccount(id) {
-  const response = await fetch(`${AUTH_URL4}/api/auth/test-accounts/${id}/credential`, {
+  const response = await fetch(`${AUTH_URL}/api/auth/test-accounts/${id}/credential`, {
     method: "POST",
-    headers: { Cookie: sessionCookie(), Origin: AUTH_URL4 }
+    headers: { Cookie: sessionCookie(), Origin: AUTH_URL }
   });
   const data = await response.json().catch(() => ({}));
   if (response.status === 404) {
@@ -4619,9 +4638,9 @@ async function recoverRemoteTestAccount(id) {
   };
 }
 async function deleteRemoteTestAccount(id) {
-  const response = await fetch(`${AUTH_URL4}/api/auth/test-accounts/${id}`, {
+  const response = await fetch(`${AUTH_URL}/api/auth/test-accounts/${id}`, {
     method: "DELETE",
-    headers: { Cookie: sessionCookie(), Origin: AUTH_URL4 }
+    headers: { Cookie: sessionCookie(), Origin: AUTH_URL }
   });
   if (!response.ok) {
     const data = await response.json().catch(() => ({}));
@@ -4630,12 +4649,11 @@ async function deleteRemoteTestAccount(id) {
 }
 async function syncTestAccountStore() {
   const accounts = await fetchRemoteTestAccounts();
-  const { removed } = reconcileTestAccountStore(accounts, normalizeTestAccountScope(AUTH_URL4));
+  const { removed } = reconcileTestAccountStore(accounts, normalizeTestAccountScope(AUTH_URL));
   return { accounts, removed };
 }
 
 // src/cli/commands/test.ts
-var DEPLOY_URL3 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 var PLAYWRIGHT_OUTPUT_DIR = ".deepspace/test-results";
 var DEFAULT_SUITE_SPECS = ["tests/smoke.spec.ts", "tests/api.spec.ts"];
 function specsSkippedByDefaultSuite(appDir) {
@@ -4763,15 +4781,13 @@ var test_default = defineDeepspaceCommand({
     });
     ensureInstallReady(appDir);
     if (suite !== "unit") await ensurePortFree(port, "0.0.0.0");
-    let token;
+    const token = await ensureToken();
     let ownerId;
     try {
-      token = await ensureToken();
-      const payload = decodeJwtPayload(token);
-      ownerId = payload.sub;
-    } catch (err) {
+      ownerId = decodeJwtPayload(token).sub;
+    } catch {
       throw new Refusal(
-        err instanceof Error ? err.message : "Not logged in. Run `deepspace auth login` first.",
+        "Malformed session token. Run `deepspace auth login` again.",
         "not_authenticated",
         { action: loginAction() }
       );
@@ -4780,7 +4796,7 @@ var test_default = defineDeepspaceCommand({
     const appIdForSecrets = await registerForLocalRun(appDir, token, wranglerEnv);
     if (appIdForSecrets) {
       try {
-        const refreshed = await refreshSecretsCache(DEPLOY_URL3, token, appIdForSecrets, wranglerEnv);
+        const refreshed = await refreshSecretsCache(DEPLOY_URL, token, appIdForSecrets, wranglerEnv);
         generatedSecretsCache = refreshed.rendered;
         if (refreshed.summary) say(refreshed.summary);
       } catch (err) {
@@ -5732,6 +5748,7 @@ var SECURE_ROOM_BOUNDARIES_MIGRATION_ID = "2026-08-secure-room-boundaries";
 var ACTION_TOOLS_DELETE_WHERE_MIGRATION_ID = "2026-08-action-tools-delete-where";
 var BUILD_INJECTED_APP_ID_MIGRATION_ID = "2026-08-build-injected-app-id";
 var ACTION_ROUTES_BEARER_GUARD_MIGRATION_ID = "2026-08-action-routes-bearer-guard";
+var FILES_SESSION_COOKIE_READS_MIGRATION_ID = "2026-09-files-session-cookie-reads";
 function validateAppMigrationIds(value) {
   if (!Array.isArray(value)) {
     return { valid: false, reason: "app migrations must be a JSON string array" };
@@ -5789,6 +5806,12 @@ var APP_MIGRATION_GUIDANCE = [
     description: "Refuse action calls without a bearer token and document their trust boundary",
     files: ["src/server/action-routes.ts, when the app has server actions"],
     guidance: "After resolveAuth, read `const authHeader = c.req.header('Authorization') ?? ''`, accept only its `Bearer ` token, and return 401 when absent. Document that X-App-Action bypasses per-record RBAC, so each action must authorize record ownership itself. If the app has no server action route, record this migration as not applicable."
+  },
+  {
+    id: FILES_SESSION_COOKIE_READS_MIGRATION_ID,
+    description: "Let private file URLs render in <img>/<audio>/<video> for the signed-in user",
+    files: ["the app-owned HTTP route file that proxies /api/files/*"],
+    guidance: "In the /api/files/* proxy only, replace `const auth = await resolveAuth(c.req.raw, c.env)` with `const auth = (await resolveAuth(c.req.raw, c.env)) ?? (await resolveSessionReadAuth(c.req.raw, c.env))`, importing resolveSessionReadAuth from 'deepspace/worker'. It identifies same-origin GET/HEAD by the app-origin session cookie and returns null for everything else. Do not add it to resolveAuth, which also gates writes. In the same route, skip the JSON URL rewrite for HEAD: change `if (contentType.includes('application/json'))` to `if (contentType.includes('application/json') && c.req.method !== 'HEAD')`, because a HEAD answer carries the content-type but no body and parsing it would turn every failed media probe into a 500."
   }
 ];
 var APP_MIGRATION_DEFINITIONS = APP_MIGRATION_GUIDANCE.map(({ id, description }) => ({
@@ -6143,7 +6166,6 @@ function normalizeApiError(status3, body) {
 }
 
 // src/cli/commands/deploy/commerce.ts
-var API_URL2 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
 function errorMessage2(error) {
   return error instanceof Error ? error.message : String(error);
 }
@@ -6204,7 +6226,7 @@ Stripe will keep charging them until you cancel. Cancel at the end of their curr
     let stopped = false;
     try {
       while (iteration < maxIterations) {
-        const response = await fetch(`${API_URL2}/api/subscriptions/admin-cancel`, {
+        const response = await fetch(`${API_URL}/api/subscriptions/admin-cancel`, {
           method: "POST",
           headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
           body: JSON.stringify({
@@ -6265,7 +6287,7 @@ async function syncSubscriptionPlans(appDir, appName, token, nonInteractive) {
   const spinner2 = createSpinner();
   spinner2.start("Syncing subscription plans...");
   try {
-    const response = await fetch(`${API_URL2}/api/subscriptions/sync`, {
+    const response = await fetch(`${API_URL}/api/subscriptions/sync`, {
       method: "POST",
       headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
       body: JSON.stringify({ appId: appName, plans })
@@ -6319,7 +6341,7 @@ async function syncOneTimeProducts(appDir, appName, token) {
   const spinner2 = products.length ? createSpinner() : null;
   spinner2?.start("Syncing one-time products...");
   try {
-    const response = await fetch(`${API_URL2}/api/charges/products/sync`, {
+    const response = await fetch(`${API_URL}/api/charges/products/sync`, {
       method: "POST",
       headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
       body: JSON.stringify({ appId: appName, products })
@@ -7276,20 +7298,8 @@ async function deployBuiltBundle(options) {
   spinner2.message(`Deploying ${appName}...`);
   let confirmRename = options.rename;
   const bail = async (message, stopLabel = "Deploy failed", code, actionRequired = false, rawAction) => {
-    const action = rawAction ? executableAction(rawAction) : void 0;
     if (stopLabel !== null) spinner2.stop(stopLabel);
-    p11.cancel(code ? withSlug(message, code) : message);
-    if (action) printAction(action);
-    if (output.json) {
-      output.emitJson({
-        ok: false,
-        ...actionRequired ? { actionRequired: true } : {},
-        error: message,
-        ...code ? { code } : {},
-        ...action ? { action } : {}
-      });
-    }
-    throw new CliExit(actionRequired ? 2 : 1);
+    return output.die(message, code, { actionRequired, action: rawAction });
   };
   const makeForm = () => {
     const form = new FormData();
@@ -7379,7 +7389,7 @@ async function deployBuiltBundle(options) {
     await bail(
       error instanceof ApiError ? errorMessage5(error) : `Deploy request failed: ${errorMessage5(error)}`,
       "Deploy failed",
-      error instanceof ApiError ? error.code : "deploy_request_failed"
+      (error instanceof ApiError ? error.code : void 0) ?? "deploy_request_failed"
     );
     throw error;
   }
@@ -7392,7 +7402,8 @@ async function deployBuiltBundle(options) {
       await bail(renameRefusalMessage(rename2), null, "rename_required");
     }
     const confirmed = await p11.confirm({ message: renamePromptMessage(rename2) });
-    if (p11.isCancel(confirmed) || !confirmed) await bail("Deploy cancelled.", null);
+    if (p11.isCancel(confirmed) || !confirmed)
+      await bail("Deploy cancelled.", null, "rename_declined");
     confirmRename = true;
     renamedFrom = rename2.fromHost;
     spinner2.start(`Deploying ${appName}...`);
@@ -7725,7 +7736,6 @@ function readLock(path) {
 }
 
 // src/cli/commands/deploy.ts
-var DEPLOY_URL4 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 var DEPLOY_TOKEN_MIN_VALIDITY_MS = 10 * 60 * 1e3;
 var POST_DEPLOY_TOKEN_MIN_VALIDITY_MS = 2 * 60 * 1e3;
 var deploy_default = defineCommand3({
@@ -7847,7 +7857,7 @@ async function runLockedDeploy(args, output, appDir, envName) {
   }
   commitScaffoldIfUnborn(appDir, token);
   p12.log.info(`Id: ${appId}`);
-  const sourceState = await getAppSource(DEPLOY_URL4, token, appId).catch((error) => {
+  const sourceState = await getAppSource(DEPLOY_URL, token, appId).catch((error) => {
     if (errorCode(error) === "forbidden") {
       output.die(forbiddenDeployMessage(appId, token), "forbidden");
     }
@@ -7859,9 +7869,9 @@ async function runLockedDeploy(args, output, appDir, envName) {
       "app_not_registered"
     );
   }
-  await requireDeployCapabilities(DEPLOY_URL4, null, output);
+  await requireDeployCapabilities(DEPLOY_URL, null, output);
   const { configName: secretsConfig } = await loadDeploySecrets({
-    deployUrl: DEPLOY_URL4,
+    deployUrl: DEPLOY_URL,
     appDir,
     appId,
     envName,
@@ -7910,7 +7920,7 @@ async function runLockedDeploy(args, output, appDir, envName) {
   }
   const { token: deployToken } = await authenticate(appDir, output, DEPLOY_TOKEN_MIN_VALIDITY_MS);
   const repository = await syncDeployRepository({
-    deployUrl: DEPLOY_URL4,
+    deployUrl: DEPLOY_URL,
     appDir,
     appId,
     token: deployToken,
@@ -7920,7 +7930,7 @@ async function runLockedDeploy(args, output, appDir, envName) {
     sourceState
   });
   const body = await deployBuiltBundle({
-    deployUrl: DEPLOY_URL4,
+    deployUrl: DEPLOY_URL,
     appDir,
     appId,
     appName,
@@ -8108,7 +8118,6 @@ async function authenticate(appDir, output, minimumValidityMs) {
 
 // src/cli/commands/undeploy.ts
 import * as p13 from "@clack/prompts";
-var DEPLOY_URL5 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 var undeploy_default = defineDeepspaceCommand({
   meta: {
     name: "undeploy",
@@ -8134,19 +8143,12 @@ var undeploy_default = defineDeepspaceCommand({
   },
   async run({ args }) {
     const envName = typeof args.env === "string" && args.env.trim() ? args.env.trim() : void 0;
-    let token;
-    try {
-      token = await ensureToken();
-    } catch (err) {
-      throw new Refusal(err instanceof Error ? err.message : String(err), "not_authenticated", {
-        action: loginAction()
-      });
-    }
+    const token = await ensureToken();
     let appId;
     let label;
     const positional = typeof args.name === "string" && args.name.trim() ? args.name.trim() : void 0;
     if (positional) {
-      appId = await resolveAppSelector(DEPLOY_URL5, token, positional);
+      appId = await resolveAppSelector(DEPLOY_URL, token, positional);
       label = positional;
     } else if (hasWranglerConfig(process.cwd())) {
       appId = readAppId(process.cwd(), envName) ?? void 0;
@@ -8161,7 +8163,7 @@ var undeploy_default = defineDeepspaceCommand({
     }
     const target2 = label && label !== appId ? `${label} (${appId})` : appId;
     try {
-      const mine = await listApps(DEPLOY_URL5, token);
+      const mine = await listApps(DEPLOY_URL, token);
       const entry = mine.find((app2) => app2.appId === appId);
       if (entry?.role === "collaborator") {
         throw new Refusal(
@@ -8185,7 +8187,7 @@ var undeploy_default = defineDeepspaceCommand({
     if (!args.json) p13.intro(`Undeploying ${target2}`);
     const s = args.json ? null : createSpinner();
     s?.start("Removing...");
-    const res = await fetch(`${DEPLOY_URL5}/api/deploy/${appId}`, {
+    const res = await fetch(`${DEPLOY_URL}/api/deploy/${appId}`, {
       method: "DELETE",
       headers: { Authorization: `Bearer ${token}` }
     });
@@ -8228,19 +8230,10 @@ var undeploy_default = defineDeepspaceCommand({
 });
 
 // src/cli/commands/whoami.ts
-var isNetworkError = (err) => err instanceof TypeError || err instanceof Error && /fetch failed|ENOTFOUND|ECONNREFUSED|ETIMEDOUT|EAI_AGAIN|getaddrinfo|network/i.test(err.message);
 var whoami_default = defineDeepspaceCommand({
   meta: { name: "whoami", description: "Show the currently logged-in user" },
   async run({ args }) {
-    let jwt;
-    try {
-      jwt = await ensureToken();
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : "Not logged in. Run `deepspace auth login` first.";
-      throw isNetworkError(err) ? new Refusal(msg, "network_error") : new Refusal(msg, "not_authenticated", {
-        action: loginAction()
-      });
-    }
+    const jwt = await ensureToken();
     let payload;
     try {
       payload = decodeJwtPayload(jwt);
@@ -8280,7 +8273,6 @@ var whoami_default = defineDeepspaceCommand({
 });
 
 // src/cli/commands/apps.ts
-var DEPLOY_URL6 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 var apps_default = defineDeepspaceCommand({
   meta: {
     name: "apps",
@@ -8288,7 +8280,7 @@ var apps_default = defineDeepspaceCommand({
   },
   async run({ args }) {
     const token = await ensureToken();
-    const { apps, pendingTransfers } = await listAppsPage(DEPLOY_URL6, token);
+    const { apps, pendingTransfers } = await listAppsPage(DEPLOY_URL, token);
     if (!args.json) {
       if (!apps.length && !pendingTransfers.length) {
         console.log("No apps yet. Create one with `npx create-deepspace <name>` and `deepspace deploy`.");
@@ -8359,7 +8351,6 @@ function logEventText(e) {
 var MAX_LOG_TEXT_LENGTH = 8 * 1024;
 
 // src/cli/commands/logs.ts
-var DEPLOY_URL7 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 var RETENTION_MS = 7 * 24 * 60 * 60 * 1e3;
 var DEFAULT_WINDOW_MS = 15 * 60 * 1e3;
 var MIN_POLL_MS = 2500;
@@ -8520,7 +8511,7 @@ var logs_default = defineCommand4({
     const envArg = args.env;
     assertAppTargetResolvable(args.app, { wranglerEnv: envArg });
     const token = await ensureToken();
-    const appId = await resolveAppTarget(DEPLOY_URL7, token, args.app, { wranglerEnv: envArg });
+    const appId = await resolveAppTarget(DEPLOY_URL, token, args.app, { wranglerEnv: envArg });
     if (args.level && !LOG_LEVELS.includes(args.level)) {
       throw new InputError(
         `Invalid --level "${args.level}". Use: ${LOG_LEVELS.join(", ")}`,
@@ -8539,7 +8530,7 @@ var logs_default = defineCommand4({
     }
     const initialSince = args.since ? parseSince(args.since) : Date.now() - DEFAULT_WINDOW_MS;
     const windowLabel = args.since?.trim() || "15m";
-    const registryRow = (await listApps(DEPLOY_URL7, token)).find((app2) => app2.appId === appId);
+    const registryRow = (await listApps(DEPLOY_URL, token)).find((app2) => app2.appId === appId);
     if (registryRow && registryRow.deployedAt === null) {
       const appDir = args.app === void 0 ? findAppDir() : null;
       throw new Refusal(
@@ -8561,7 +8552,7 @@ var logs_default = defineCommand4({
       if (args.level) params.set("level", args.level);
       if (args.search) params.set("search", args.search);
       const path = `/api/apps/${appId}/logs?${params}`;
-      return signal ? apiFetch(DEPLOY_URL7, token2, path, { signal }) : apiFetchReadWithRetry(DEPLOY_URL7, token2, path);
+      return signal ? apiFetch(DEPLOY_URL, token2, path, { signal }) : apiFetchReadWithRetry(DEPLOY_URL, token2, path);
     };
     const print = (events) => {
       for (const e of events) {
@@ -8684,7 +8675,6 @@ var logs_default = defineCommand4({
 });
 
 // src/cli/commands/usage.ts
-var API_URL3 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
 function formatCredits(value) {
   if (value > 0 && value < 1) return "<1";
   if (value < 10) return value.toFixed(1).replace(/\.0$/, "");
@@ -8750,7 +8740,7 @@ var usage_default = defineDeepspaceCommand({
   },
   async run({ args }) {
     const token = await ensureToken();
-    const summary = await apiFetch(API_URL3, token, "/api/usage/summary");
+    const summary = await apiFetch(API_URL, token, "/api/usage/summary");
     if (!args.json) console.log(renderSummary(summary));
     return { data: { scope: "account", ...summary } };
   }
@@ -9750,9 +9740,7 @@ Create one with: deepspace app create <name>`,
 
 // src/cli/commands/domain.ts
 import { defineCommand as defineCommand5 } from "citty";
-var API_URL4 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
-var DEPLOY_URL8 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
-var api = (token, path, init) => apiFetch(API_URL4, token, path, init);
+var api = (token, path, init) => apiFetch(API_URL, token, path, init);
 function scrubInternal(value) {
   if (Array.isArray(value)) return value.map(scrubInternal);
   if (value && typeof value === "object") {
@@ -9822,7 +9810,7 @@ var buy = defineDeepspaceCommand({
   async run({ args }) {
     const domain = String(args.domain);
     const token = await ensureToken();
-    const appId = await resolveAppTarget(DEPLOY_URL8, token, args.app);
+    const appId = await resolveAppTarget(DEPLOY_URL, token, args.app);
     const priceCheck = await api(token, "/api/domains/check", {
       method: "POST",
       body: JSON.stringify({ domains: [domain] })
@@ -9967,7 +9955,7 @@ var attach = defineDeepspaceCommand({
     const domain = String(args.domain);
     const token = await ensureToken();
     const targetAppId = await resolveAppTarget(
-      DEPLOY_URL8,
+      DEPLOY_URL,
       token,
       args.app
     );
@@ -10274,11 +10262,9 @@ async function downloadAppFile(baseUrl, token, appId, key, destination) {
 }
 
 // src/cli/commands/app-files.ts
-var DEPLOY_URL9 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
-var PLATFORM_URL = process.env.DEEPSPACE_PLATFORM_URL ?? PLATFORM_URLS.platform;
 async function target(app2) {
   const token = await ensureToken();
-  const appId = await resolveAppTarget(DEPLOY_URL9, token, app2);
+  const appId = await resolveAppTarget(DEPLOY_URL, token, app2);
   return { token, appId };
 }
 var MAX_LIST_LIMIT = 1e3;
@@ -10464,12 +10450,10 @@ function isTestAccountEmail(email) {
 }
 
 // src/cli/commands/collaborators.ts
-var API_URL5 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
-var DEPLOY_URL10 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 var COLLABORATOR_GRANTS = ["deploy", "secrets:read", "secrets:write"];
 var COLLABORATOR_GRANT_SENTENCE = `grants ${COLLABORATOR_GRANTS.join(", ")} \u2014 they can deploy the app AND read and change every app secret in plaintext; they cannot undeploy or transfer it`;
 function api2(token, path, init) {
-  return apiFetch(API_URL5, token, path, init);
+  return apiFetch(API_URL, token, path, init);
 }
 var list4 = defineDeepspaceCommand({
   meta: { name: "list", description: "List collaborators on your app" },
@@ -10478,7 +10462,7 @@ var list4 = defineDeepspaceCommand({
   },
   async run({ args }) {
     const token = await ensureToken();
-    const app2 = await resolveAppTarget(DEPLOY_URL10, token, args.app);
+    const app2 = await resolveAppTarget(DEPLOY_URL, token, args.app);
     const { owner, collaborators, pending = [] } = await api2(token, `/api/app-collaborators/${encodeURIComponent(app2)}`);
     if (!args.json && owner) console.log(`OWNER: ${owner.emailDisplay}`);
     if (!collaborators.length && !pending.length) {
@@ -10522,7 +10506,7 @@ var add = defineDeepspaceCommand({
   async run({ args }) {
     const email = String(args.email);
     const token = await ensureToken();
-    const app2 = await resolveAppTarget(DEPLOY_URL10, token, args.app);
+    const app2 = await resolveAppTarget(DEPLOY_URL, token, args.app);
     if (isTestAccountEmail(email)) {
       throw new Refusal(
         "Test accounts (@deepspace.test) cannot be added as collaborators. Use a real DeepSpace account.",
@@ -10569,7 +10553,7 @@ var remove = defineDeepspaceCommand({
   async run({ args }) {
     const email = String(args.email);
     const token = await ensureToken();
-    const app2 = await resolveAppTarget(DEPLOY_URL10, token, args.app);
+    const app2 = await resolveAppTarget(DEPLOY_URL, token, args.app);
     const { collaborators } = await api2(
       token,
       `/api/app-collaborators/${encodeURIComponent(app2)}`
@@ -10590,7 +10574,7 @@ var remove = defineDeepspaceCommand({
     return { data: { removed: found } };
   }
 });
-var cancel3 = defineDeepspaceCommand({
+var cancel2 = defineDeepspaceCommand({
   meta: { name: "cancel", description: "Cancel a pending (un-accepted) email invite" },
   args: {
     email: { type: "positional", description: "Invited email", required: true },
@@ -10599,7 +10583,7 @@ var cancel3 = defineDeepspaceCommand({
   async run({ args }) {
     const email = String(args.email);
     const token = await ensureToken();
-    const app2 = await resolveAppTarget(DEPLOY_URL10, token, args.app);
+    const app2 = await resolveAppTarget(DEPLOY_URL, token, args.app);
     const { pending = [] } = await api2(
       token,
       `/api/app-collaborators/${encodeURIComponent(app2)}`
@@ -10672,14 +10656,12 @@ var accept = defineDeepspaceCommand({
 });
 var collaborators_default = defineCommand7({
   meta: { name: "collaborators", description: "Manage who can deploy your app" },
-  subCommands: { list: list4, add, remove, cancel: cancel3, invites, accept }
+  subCommands: { list: list4, add, remove, cancel: cancel2, invites, accept }
 });
 
 // src/cli/commands/transfer.ts
 import { defineCommand as defineCommand8 } from "citty";
 import * as p14 from "@clack/prompts";
-var API_URL6 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
-var DEPLOY_URL11 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 var offer = defineDeepspaceCommand({
   meta: { name: "offer", description: "Offer this app to another DeepSpace user" },
   args: {
@@ -10693,9 +10675,9 @@ var offer = defineDeepspaceCommand({
   async run({ args }) {
     const email = String(args.email);
     const token = await ensureToken();
-    const app2 = await resolveAppTarget(DEPLOY_URL11, token, args.app);
+    const app2 = await resolveAppTarget(DEPLOY_URL, token, args.app);
     const pending = await apiFetch(
-      API_URL6,
+      API_URL,
       token,
       `/api/app-transfers/${encodeURIComponent(app2)}`
     );
@@ -10715,7 +10697,7 @@ var offer = defineDeepspaceCommand({
       }
     }
     const { expiresAt } = await apiFetch(
-      API_URL6,
+      API_URL,
       token,
       `/api/app-transfers/${encodeURIComponent(app2)}`,
       { method: "POST", body: JSON.stringify({ email }) }
@@ -10753,8 +10735,8 @@ var status2 = defineDeepspaceCommand({
   },
   async run({ args }) {
     const token = await ensureToken();
-    const app2 = await resolveAppTarget(DEPLOY_URL11, token, args.app);
-    const { transfer } = await apiFetch(API_URL6, token, `/api/app-transfers/${encodeURIComponent(app2)}`);
+    const app2 = await resolveAppTarget(DEPLOY_URL, token, args.app);
+    const { transfer } = await apiFetch(API_URL, token, `/api/app-transfers/${encodeURIComponent(app2)}`);
     if (!transfer) {
       if (!args.json) console.log(`No pending transfer for ${app2}.`);
       return { data: { app: app2, transfer: null } };
@@ -10782,7 +10764,7 @@ var accept2 = defineDeepspaceCommand({
       const msg = err instanceof Error ? err.message : String(err);
       throw new Refusal(msg, msg.startsWith("No app id") ? "not_in_app_repo" : "invalid_app");
     }
-    const { replayed, acceptedAt, inheritedCollaborators } = await apiFetch(DEPLOY_URL11, token, `/api/apps/${encodeURIComponent(app2)}/transfer/accept`, {
+    const { replayed, acceptedAt, inheritedCollaborators } = await apiFetch(DEPLOY_URL, token, `/api/apps/${encodeURIComponent(app2)}/transfer/accept`, {
       method: "POST"
     });
     if (!args.json) {
@@ -10810,31 +10792,28 @@ var accept2 = defineDeepspaceCommand({
     };
   }
 });
-var cancel4 = defineDeepspaceCommand({
+var cancel3 = defineDeepspaceCommand({
   meta: { name: "cancel", description: "Cancel/decline the pending offer (either party)" },
   args: {
     app: { type: "string", alias: "a", description: "App id or name (defaults to ./wrangler.toml)" }
   },
   async run({ args }) {
     const token = await ensureToken();
-    const app2 = await resolveAppTarget(DEPLOY_URL11, token, args.app);
-    await apiFetch(API_URL6, token, `/api/app-transfers/${encodeURIComponent(app2)}`, { method: "DELETE" });
+    const app2 = await resolveAppTarget(DEPLOY_URL, token, args.app);
+    await apiFetch(API_URL, token, `/api/app-transfers/${encodeURIComponent(app2)}`, { method: "DELETE" });
     if (!args.json) console.log(`\u2713 Transfer offer for ${app2} cancelled.`);
     return { data: { app: app2, cancelled: true } };
   }
 });
 var transfer_default = defineCommand8({
   meta: { name: "transfer", description: "Transfer app ownership to another user" },
-  subCommands: { offer, status: status2, accept: accept2, cancel: cancel4 }
+  subCommands: { offer, status: status2, accept: accept2, cancel: cancel3 }
 });
 
 // src/cli/commands/integrations.ts
 import { defineCommand as defineCommand9 } from "citty";
-
-// src/cli/commands/_invoke-impl.ts
 import { readFileSync as readFileSync21 } from "fs";
 import * as p15 from "@clack/prompts";
-var API_URL7 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
 var DEFAULT_TIMEOUT_MS = 12e4;
 function parseTarget(target2) {
   if (!target2 || typeof target2 !== "string") {
@@ -10899,7 +10878,7 @@ async function resolveBody(opts) {
 }
 async function fetchCatalog(opts = {}) {
   try {
-    return await fetchIntegrationCatalog(API_URL7, { summary: opts.summary });
+    return await fetchIntegrationCatalog(API_URL, { summary: opts.summary });
   } catch (err) {
     if (err instanceof ApiError) throw new Refusal(err.message, err.code ?? "catalog_unavailable");
     throw err;
@@ -11060,21 +11039,13 @@ async function runInvoke(args) {
       }
     }
   }
-  let jwt;
-  try {
-    jwt = await ensureToken();
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    throw new Refusal(msg, "not_authenticated", {
-      action: loginAction()
-    });
-  }
+  const jwt = await ensureToken();
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
   const startedAt = Date.now();
   let res;
   try {
-    res = await fetch(`${API_URL7}/api/integrations/${integration}/${endpoint}`, {
+    res = await fetch(`${API_URL}/api/integrations/${integration}/${endpoint}`, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
@@ -11126,8 +11097,6 @@ async function runInvoke(args) {
     extra: rest
   });
 }
-
-// src/cli/commands/integrations.ts
 var list5 = defineDeepspaceCommand({
   meta: {
     name: "list",
@@ -11628,7 +11597,6 @@ import { existsSync as existsSync25, readFileSync as readFileSync22 } from "fs";
 import { dirname as dirname11, join as join24 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { release } from "os";
-var API_URL8 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
 var TYPES = ["bug", "feature", "other"];
 var TYPE_LABELS = {
   bug: "Bug report",
@@ -11638,7 +11606,7 @@ var TYPE_LABELS = {
 var MAX_TITLE_LEN = 200;
 var MAX_BODY_LEN = 1e4;
 var MAX_CONTEXT_LEN = 200;
-var api3 = (token, path, init) => apiFetch(API_URL8, token, path, init);
+var api3 = (token, path, init) => apiFetch(API_URL, token, path, init);
 function normalizeType(raw) {
   const value = (raw ?? "bug").toLowerCase();
   if (TYPES.includes(value)) return value;
@@ -11821,16 +11789,7 @@ Context: deepspace ${payload.cliVersion} \xB7 ${payload.nodeVersion} \xB7 ${payl
         return { data: { submitted: false, cancelled: true } };
       }
     }
-    let token;
-    try {
-      token = await ensureToken();
-    } catch (err) {
-      throw new Refusal(
-        err.message ?? "Not signed in. Run `deepspace auth login`.",
-        "not_authenticated",
-        { action: loginAction() }
-      );
-    }
+    const token = await ensureToken();
     const result = await api3(token, "/api/feedback", {
       method: "POST",
       body: JSON.stringify(payload)
@@ -11882,7 +11841,6 @@ function parseCursorArg(raw) {
 }
 
 // src/cli/commands/secrets.ts
-var DEPLOY_URL12 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 var COMMON_ARGS = {
   app: {
     type: "string",
@@ -11914,7 +11872,7 @@ async function resolveTarget(args, opts = {}) {
   const { wranglerEnv } = parseWranglerEnvArg(args.env);
   const configName = validateConfigName(args.config?.trim() || defaultConfigNameForEnv(wranglerEnv));
   const token = await ensureToken();
-  const appId = await resolveAppTarget(DEPLOY_URL12, token, args.app, { wranglerEnv, register });
+  const appId = await resolveAppTarget(DEPLOY_URL, token, args.app, { wranglerEnv, register });
   return { appId, configName, token };
 }
 function ok(json, data, human) {
@@ -11943,7 +11901,7 @@ var list6 = defineCommand11({
   },
   async run({ args }) {
     const t = await resolveTarget(args);
-    const { secrets } = await listSecrets(DEPLOY_URL12, t.token, t.appId, t.configName);
+    const { secrets } = await listSecrets(DEPLOY_URL, t.token, t.appId, t.configName);
     if (args.json) {
       console.log(JSON.stringify({ ok: true, appId: t.appId, config: t.configName, secrets }));
       return;
@@ -12023,9 +11981,9 @@ var set = defineCommand11({
     }
     if (Object.keys(secrets).length === 1) {
       const [[k, v]] = Object.entries(secrets);
-      await setSecret(DEPLOY_URL12, t.token, t.appId, t.configName, k, v);
+      await setSecret(DEPLOY_URL, t.token, t.appId, t.configName, k, v);
     } else {
-      await uploadSecrets(DEPLOY_URL12, t.token, t.appId, t.configName, secrets, false);
+      await uploadSecrets(DEPLOY_URL, t.token, t.appId, t.configName, secrets, false);
     }
     const n = Object.keys(secrets).length;
     ok(
@@ -12058,11 +12016,11 @@ var get2 = defineCommand11({
     const t = await resolveTarget(args);
     const key = validateSecretName(args.key);
     if (args.plain) {
-      const { value } = await getSecretPlain(DEPLOY_URL12, t.token, t.appId, t.configName, key);
+      const { value } = await getSecretPlain(DEPLOY_URL, t.token, t.appId, t.configName, key);
       process.stdout.write(process.stdout.isTTY ? value + "\n" : value);
       return;
     }
-    const { secrets } = await listSecrets(DEPLOY_URL12, t.token, t.appId, t.configName);
+    const { secrets } = await listSecrets(DEPLOY_URL, t.token, t.appId, t.configName);
     const item = secrets.find((s) => s.key === key);
     if (!item)
       throw new InputError(`Secret "${key}" not found in ${t.configName}`, "secret_not_found");
@@ -12093,7 +12051,7 @@ var del2 = defineCommand11({
     for (const key of keys) {
       const name = validateSecretName(key);
       try {
-        const result = await deleteSecret(DEPLOY_URL12, t.token, t.appId, t.configName, name);
+        const result = await deleteSecret(DEPLOY_URL, t.token, t.appId, t.configName, name);
         if (result.deleted === false) absent++;
         else deleted++;
       } catch (err) {
@@ -12135,7 +12093,7 @@ var upload = defineCommand11({
     const secrets = parseSecretsUpload(await readUploadSource(String(args.file)));
     if (Object.keys(secrets).length === 0)
       throw new InputError("No secrets found in the input.", "empty_input");
-    await uploadSecrets(DEPLOY_URL12, t.token, t.appId, t.configName, secrets, args.replace);
+    await uploadSecrets(DEPLOY_URL, t.token, t.appId, t.configName, secrets, args.replace);
     const uploaded = Object.keys(secrets);
     ok(
       args.json === true,
@@ -12210,7 +12168,7 @@ var download = defineCommand11({
         "invalid_format"
       );
     }
-    const { secrets } = await fetchSecretsValues(DEPLOY_URL12, t.token, t.appId, t.configName);
+    const { secrets } = await fetchSecretsValues(DEPLOY_URL, t.token, t.appId, t.configName);
     process.stdout.write(formatSecretsDownload(secrets, format));
   }
 });
@@ -12219,7 +12177,7 @@ var configsList = defineCommand11({
   args: { ...COMMON_ARGS },
   async run({ args }) {
     const t = await resolveTarget(args);
-    const { configs: configs2 } = await listConfigs(DEPLOY_URL12, t.token, t.appId);
+    const { configs: configs2 } = await listConfigs(DEPLOY_URL, t.token, t.appId);
     ok(args.json === true, { appId: t.appId, configs: configs2 }, () => {
       if (configs2.length === 0) {
         console.log("No configs yet \u2014 the first `secrets set` creates one.");
@@ -12242,7 +12200,7 @@ var configsCreate = defineCommand11({
     const t = await resolveTarget(args, { register: true });
     const name = validateConfigName(args.name);
     const copyFrom = args["copy-from"] || void 0;
-    const { configs: configs2 } = await listConfigs(DEPLOY_URL12, t.token, t.appId);
+    const { configs: configs2 } = await listConfigs(DEPLOY_URL, t.token, t.appId);
     if (configs2.some((c) => c.name === name)) {
       if (copyFrom) {
         throw new InputError(
@@ -12257,7 +12215,7 @@ var configsCreate = defineCommand11({
       );
       return;
     }
-    await createConfig(DEPLOY_URL12, t.token, t.appId, name, copyFrom);
+    await createConfig(DEPLOY_URL, t.token, t.appId, name, copyFrom);
     ok(
       args.json === true,
       { appId: t.appId, config: name, created: true, ...copyFrom ? { copyFrom } : {} },
@@ -12286,7 +12244,7 @@ var configsDelete = defineCommand11({
       json: args.json === true,
       message: `Deleting config ${name} removes every secret in it permanently.`,
       prompt: async () => {
-        const { secrets } = await listSecrets(DEPLOY_URL12, t.token, t.appId, name);
+        const { secrets } = await listSecrets(DEPLOY_URL, t.token, t.appId, name);
         count = secrets.length;
         const detail = count === 0 ? `Config ${name} is empty.` : `Config ${name} holds ${count} secret${count === 1 ? "" : "s"}: ${secrets.map((secret) => secret.key).slice(0, 8).join(", ")}${count > 8 ? `, \u2026` : ""}.`;
         return `${detail} Deleting it removes ${count === 1 ? "that secret" : "them all"} permanently.`;
@@ -12296,11 +12254,11 @@ var configsDelete = defineCommand11({
     });
     if (count === null) {
       try {
-        count = (await listSecrets(DEPLOY_URL12, t.token, t.appId, name)).secrets.length;
+        count = (await listSecrets(DEPLOY_URL, t.token, t.appId, name)).secrets.length;
       } catch {
       }
     }
-    await deleteConfig(DEPLOY_URL12, t.token, t.appId, name);
+    await deleteConfig(DEPLOY_URL, t.token, t.appId, name);
     ok(
       args.json === true,
       { appId: t.appId, config: name, deleted: true, secretsDeleted: count },
@@ -12328,7 +12286,6 @@ var secrets_default = defineCommand11({
 });
 
 // src/cli/commands/init.ts
-var DEPLOY_URL13 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 var init_default = defineDeepspaceCommand({
   meta: {
     name: "init",
@@ -12369,7 +12326,7 @@ var init_default = defineDeepspaceCommand({
       const token2 = await ensureToken();
       let state;
       try {
-        state = await getAppSource(DEPLOY_URL13, token2, existing);
+        state = await getAppSource(DEPLOY_URL, token2, existing);
       } catch (error) {
         if (error instanceof ApiError && error.code === "forbidden") {
           throw new Refusal(
@@ -13554,7 +13511,6 @@ var clone_default = defineDeepspaceCommand({
 import * as p21 from "@clack/prompts";
 
 // src/cli/lib/actor-labels.ts
-var API_URL9 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
 async function actorLabels(token, appId) {
   const labels = /* @__PURE__ */ new Map();
   try {
@@ -13563,7 +13519,7 @@ async function actorLabels(token, appId) {
   } catch {
   }
   try {
-    const { collaborators } = await apiFetch(API_URL9, token, `/api/app-collaborators/${encodeURIComponent(appId)}`);
+    const { collaborators } = await apiFetch(API_URL, token, `/api/app-collaborators/${encodeURIComponent(appId)}`);
     for (const c of collaborators) {
       if (!labels.has(c.userId)) labels.set(c.userId, c.emailDisplay);
     }
@@ -13573,7 +13529,6 @@ async function actorLabels(token, appId) {
 }
 
 // src/cli/commands/releases.ts
-var DEPLOY_URL14 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 var releases_default = defineDeepspaceCommand({
   meta: {
     name: "releases",
@@ -13608,8 +13563,8 @@ var releases_default = defineDeepspaceCommand({
     const spinner2 = args.json ? null : createSpinner();
     spinner2?.start("Loading release history\u2026");
     const token = await ensureToken();
-    const appId = await resolveAppTarget(DEPLOY_URL14, token, appArg, { wranglerEnv: envArg });
-    const { releases } = await repoApi(DEPLOY_URL14, token, appId).listReleases(limit);
+    const appId = await resolveAppTarget(DEPLOY_URL, token, appArg, { wranglerEnv: envArg });
+    const { releases } = await repoApi(DEPLOY_URL, token, appId).listReleases(limit);
     spinner2?.stop(`Loaded ${releases.length} ${releases.length === 1 ? "release" : "releases"}.`);
     if (!args.json) {
       if (releases.length === 0) {
@@ -13644,7 +13599,6 @@ Retry in a moment, or re-run with --allow-do-deletion to accept the risk.`,
     "do_guard_unavailable"
   );
 }
-var DEPLOY_URL15 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 function pickPreviousRelease(releases) {
   if (releases.length === 0) {
     return { error: "No releases recorded yet \u2014 nothing to roll back to.", code: "no_releases" };
@@ -13712,8 +13666,8 @@ var rollback_default = defineDeepspaceCommand({
     const spinner2 = args.json ? null : createSpinner();
     spinner2?.start("Preparing rollback\u2026");
     const token = await ensureToken();
-    const appId = await resolveAppTarget(DEPLOY_URL15, token, appArg, { wranglerEnv: envArg });
-    const api4 = repoApi(DEPLOY_URL15, token, appId);
+    const appId = await resolveAppTarget(DEPLOY_URL, token, appArg, { wranglerEnv: envArg });
+    const api4 = repoApi(DEPLOY_URL, token, appId);
     let releaseId = args.release ? String(args.release).trim() : "";
     if (!releaseId) {
       const { releases } = await api4.listReleases(2);
@@ -13732,7 +13686,7 @@ var rollback_default = defineDeepspaceCommand({
     spinner2?.start(`Rolling back to ${releaseId}\u2026`);
     let result;
     try {
-      result = await apiFetch(DEPLOY_URL15, token, `/api/deploy/${appId}/rollback`, {
+      result = await apiFetch(DEPLOY_URL, token, `/api/deploy/${appId}/rollback`, {
         method: "POST",
         body: JSON.stringify({
           releaseId,
@@ -15991,7 +15945,7 @@ import { join as join28, resolve as resolve22 } from "path";
 // package.json
 var package_default = {
   name: "deepspace",
-  version: "0.30.2",
+  version: "0.31.1",
   engines: {
     node: ">=22.15.0 <23 || >=24 <25 || >=26 <27"
   },