deepspace 0.4.3 → 0.4.4

package/dist/cli.js

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 
 // src/cli/cli.ts
-import { defineCommand as defineCommand19, runMain } from "citty";
+import { defineCommand as defineCommand21, runMain } from "citty";
 import { execSync as execSync5 } from "child_process";
-import { readFileSync as readFileSync11, existsSync as existsSync12 } from "fs";
-import { dirname as dirname3, join as join14 } from "path";
-import { fileURLToPath } from "url";
+import { readFileSync as readFileSync13, existsSync as existsSync14 } from "fs";
+import { dirname as dirname4, join as join16 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/cli/commands/login.ts
 import { defineCommand } from "citty";
@@ -122,9 +122,6 @@ function resolveAppNameForEnv(config, envName) {
   }
   return resolveAppName(envBlock.name);
 }
-function devVarsPathFor(appDir, envName) {
-  return envName ? join(appDir, `.dev.vars.${envName}`) : join(appDir, ".dev.vars");
-}
 var WranglerConfigError = class extends Error {
   constructor(path, cause) {
     const detail = cause instanceof Error ? cause.message : String(cause);
@@ -235,8 +232,22 @@ var SDK_MANAGED_KEYS = /* @__PURE__ */ new Set([
   "OWNER_USER_ID",
   "APP_OWNER_JWT",
   "APP_IDENTITY_TOKEN",
+  "APP_SECRETS_KEY",
+  "APP_SECRETS_LOCAL_FALLBACK",
   "ALLOW_DEBUG_ROUTES"
 ]);
+var MANAGED_ENV_HEADER = "# Managed by `deepspace secrets` and regenerated by `deepspace dev`/`deepspace test`.";
+var MANAGED_ENV_SYNCED_HEADER = "# DeepSpace synced secrets - mirrored with the deployed app secrets store.";
+var MANAGED_ENV_DEV_ONLY_HEADER = "# DeepSpace dev-only secrets - used by `deepspace dev`; never synced unless pushed.";
+function localEnvPath(appDir) {
+  return join2(appDir, ".env");
+}
+function legacyDevVarsPath(appDir, wranglerEnv) {
+  return join2(appDir, wranglerEnv ? `.dev.vars.${wranglerEnv}` : ".dev.vars");
+}
+function hasLegacyDevVars(appDir, wranglerEnv) {
+  return existsSync2(legacyDevVarsPath(appDir, wranglerEnv));
+}
 var DEV_VARS_DIVIDER = "# --- not managed by the SDK; preserved across dev/test runs ---";
 function extractCustomDevVars(content) {
   const lines = content.split("\n");
@@ -343,6 +354,189 @@ function parseDevVars(content) {
   }
   return result;
 }
+function parseDevVarsStrict(content, file = ".env") {
+  const result = {};
+  const lines = content.split("\n");
+  let i = 0;
+  while (i < lines.length) {
+    const line = lines[i];
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) {
+      i++;
+      continue;
+    }
+    const eq = line.indexOf("=");
+    if (eq < 0) {
+      throw new Error(`${file}: invalid dotenv syntax on line ${i + 1}. Expected KEY=value.`);
+    }
+    const keyMatch = line.slice(0, eq).match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*$/);
+    if (!keyMatch) {
+      throw new Error(`${file}: invalid variable name on line ${i + 1}.`);
+    }
+    const key = keyMatch[1];
+    let value = line.slice(eq + 1);
+    let closed = !value.startsWith('"') || hasUnescapedQuote(value.slice(1));
+    if (!closed) {
+      i++;
+      while (i < lines.length) {
+        value += "\n" + lines[i];
+        if (hasUnescapedQuote(lines[i])) {
+          closed = true;
+          i++;
+          break;
+        }
+        i++;
+      }
+    } else {
+      i++;
+    }
+    if (value.startsWith('"') && !closed) {
+      throw new Error(`${file}: unterminated quoted value for key "${key}".`);
+    }
+    if (value.startsWith('"') && value.endsWith('"') && value.length >= 2) {
+      value = value.slice(1, -1).replace(/\\"/g, '"').replace(/\\\\/g, "\\");
+    }
+    result[key] = value;
+  }
+  return result;
+}
+function quoteEnvValue(value) {
+  return /^[A-Za-z0-9_./:@-]*$/.test(value) && !value.includes("\n") ? value : `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
+function stripSdkManaged(vars) {
+  const out = {};
+  for (const [name, value] of Object.entries(vars)) {
+    if (!SDK_MANAGED_KEYS.has(name)) out[name] = value;
+  }
+  return out;
+}
+function sortRecord(input) {
+  const out = {};
+  for (const key of Object.keys(input).sort()) out[key] = input[key];
+  return out;
+}
+function readManagedEnvSections(appDir) {
+  const path = localEnvPath(appDir);
+  if (!existsSync2(path)) return { sdk: {}, synced: {}, devOnly: {} };
+  return parseManagedEnvSections(readFileSync2(path, "utf-8"));
+}
+function parseManagedEnvSections(content) {
+  const sections = { sdk: {}, synced: {}, devOnly: {} };
+  const legacyAppLines = [];
+  let target = "sdk";
+  const lines = content.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (line.trim() === MANAGED_ENV_SYNCED_HEADER.trim()) {
+      target = "synced";
+      continue;
+    }
+    if (line.trim() === MANAGED_ENV_DEV_ONLY_HEADER.trim()) {
+      target = "devOnly";
+      continue;
+    }
+    if (line.trim().startsWith("#")) continue;
+    const name = assignmentName(line);
+    if (!name) {
+      if (line.trim()) legacyAppLines.push(line);
+      continue;
+    }
+    const block = [line];
+    const eq = line.indexOf("=");
+    const valStart = eq >= 0 ? line.slice(eq + 1) : "";
+    if (valStart.startsWith('"') && !hasUnescapedQuote(valStart.slice(1))) {
+      i++;
+      while (i < lines.length) {
+        block.push(lines[i]);
+        const closed = hasUnescapedQuote(lines[i]);
+        if (closed) break;
+        i++;
+      }
+    }
+    if (target === "sdk" && !SDK_MANAGED_KEYS.has(name)) {
+      legacyAppLines.push(...block);
+      continue;
+    }
+    const parsed = parseDevVarsStrict(block.join("\n"), ".env");
+    Object.assign(sections[target], parsed);
+  }
+  if (legacyAppLines.length) {
+    Object.assign(sections.synced, stripSdkManaged(parseDevVarsStrict(legacyAppLines.join("\n"), ".env")));
+  }
+  return sections;
+}
+function assignmentName(line) {
+  const eq = line.indexOf("=");
+  if (eq < 0) return null;
+  const match = line.slice(0, eq).match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*$/);
+  return match?.[1] ?? null;
+}
+function readManagedAppEnv(appDir) {
+  const sections = readManagedEnvSections(appDir);
+  return { ...sections.synced, ...sections.devOnly };
+}
+function readManagedSyncedEnv(appDir) {
+  return { ...readManagedEnvSections(appDir).synced };
+}
+function readManagedDevOnlyEnv(appDir) {
+  return { ...readManagedEnvSections(appDir).devOnly };
+}
+function writeManagedEnvSections(appDir, sections) {
+  ensureLocalEnvIgnored(appDir);
+  const lines = [
+    MANAGED_ENV_HEADER,
+    "# Do not commit this file. Edit secrets with `deepspace secrets`, not by hand."
+  ];
+  for (const [name, value] of Object.entries(sortRecord(sections.sdk))) {
+    lines.push(`${name}=${quoteEnvValue(value)}`);
+  }
+  lines.push("", MANAGED_ENV_SYNCED_HEADER);
+  for (const [name, value] of Object.entries(sortRecord(sections.synced))) {
+    lines.push(`${name}=${quoteEnvValue(value)}`);
+  }
+  lines.push("", MANAGED_ENV_DEV_ONLY_HEADER);
+  for (const [name, value] of Object.entries(sortRecord(sections.devOnly))) {
+    lines.push(`${name}=${quoteEnvValue(value)}`);
+  }
+  writeFileSync(localEnvPath(appDir), lines.join("\n") + "\n", { mode: 384 });
+}
+function ensureLocalEnvIgnored(appDir) {
+  const path = join2(appDir, ".gitignore");
+  const existing = existsSync2(path) ? readFileSync2(path, "utf-8") : "";
+  const lines = new Set(existing.split("\n").map((line) => line.trim()));
+  const additions = [".env", ".dev.vars"].filter((entry) => !lines.has(entry));
+  if (!additions.length) return;
+  const prefix = existing && !existing.endsWith("\n") ? existing + "\n" : existing;
+  writeFileSync(path, `${prefix}${additions.join("\n")}
+`);
+}
+function patchManagedSyncedEnv(appDir, set2 = {}, removeNames = []) {
+  const sections = readManagedEnvSections(appDir);
+  for (const [name, value] of Object.entries(set2)) sections.synced[name] = value;
+  for (const name of removeNames) delete sections.synced[name];
+  writeManagedEnvSections(appDir, sections);
+}
+function patchManagedDevOnlyEnv(appDir, set2 = {}, removeNames = []) {
+  const sections = readManagedEnvSections(appDir);
+  for (const [name, value] of Object.entries(set2)) sections.devOnly[name] = value;
+  for (const name of removeNames) delete sections.devOnly[name];
+  writeManagedEnvSections(appDir, sections);
+}
+function replaceManagedSyncedEnv(appDir, syncedVars) {
+  const sections = readManagedEnvSections(appDir);
+  sections.synced = stripSdkManaged(syncedVars);
+  writeManagedEnvSections(appDir, sections);
+}
+function moveManagedDevOnlyToSynced(appDir, names) {
+  const sections = readManagedEnvSections(appDir);
+  for (const name of names) {
+    if (name in sections.devOnly) {
+      sections.synced[name] = sections.devOnly[name];
+      delete sections.devOnly[name];
+    }
+  }
+  writeManagedEnvSections(appDir, sections);
+}
 async function writeDevVars(appDir, env, ownerId, callerJwt, wranglerEnv) {
   const urls = ENVS[env];
   const publicKey = await fetchPublicKey(urls.auth);
@@ -358,11 +552,18 @@ async function writeDevVars(appDir, env, ownerId, callerJwt, wranglerEnv) {
     `OWNER_USER_ID=${ownerId}`,
     `APP_OWNER_JWT=${appOwnerJwt}`,
     ...appIdentityToken ? [`APP_IDENTITY_TOKEN=${appIdentityToken}`] : [],
+    `APP_SECRETS_LOCAL_FALLBACK=true`,
     // Open /api/debug/* (proxied to RecordRoom) for dev + tests only.
     // Production secrets never set this, so deployed apps 404 the route.
     `ALLOW_DEBUG_ROUTES=true`
   ].join("\n");
-  const devVarsPath = join2(appDir, wranglerEnv ? `.dev.vars.${wranglerEnv}` : ".dev.vars");
+  const sdkEnv = parseDevVarsStrict(sdkVars, "SDK env");
+  if (!hasLegacyDevVars(appDir, wranglerEnv)) {
+    const sections = readManagedEnvSections(appDir);
+    writeManagedEnvSections(appDir, { ...sections, sdk: sdkEnv });
+    return;
+  }
+  const devVarsPath = legacyDevVarsPath(appDir, wranglerEnv);
   const existing = existsSync2(devVarsPath) ? readFileSync2(devVarsPath, "utf-8") : "";
   const custom = extractCustomDevVars(existing);
   const body = custom ? `${sdkVars}
@@ -571,7 +772,7 @@ var logout_default = defineCommand2({
 });
 
 // src/cli/commands/dev.ts
-import { defineCommand as defineCommand3 } from "citty";
+import { defineCommand as defineCommand4 } from "citty";
 import { resolve as resolve3, basename } from "path";
 import spawn from "cross-spawn";
 
@@ -746,9 +947,525 @@ function preflightWindowsWorkerd(appDir) {
   }
 }
 
+// src/cli/commands/secrets.ts
+import { existsSync as existsSync8, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "fs";
+import { join as join8 } from "path";
+import { defineCommand as defineCommand3 } from "citty";
+var SECRET_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var ERROR_SNIPPET_CHARS = 500;
+var COLLABORATOR_ROUTES_404 = "Platform API does not expose app-collaborator routes; deploy/update api-worker before using collaborator commands.";
+var COLLABORATOR_SCHEMA_NOT_MIGRATED = "Platform API is missing app-collaborator database tables. Run api-worker /_migrate with x-migration-secret, then retry collaborator commands.";
+function parseAssignment(value) {
+  const eq = value.indexOf("=");
+  if (eq <= 0) throw new Error("Use KEY=value.");
+  const name = value.slice(0, eq);
+  if (!SECRET_NAME_RE.test(name)) throw new Error(`Invalid secret name "${name}".`);
+  if (SDK_MANAGED_KEYS.has(name)) throw new Error(`${name} is managed by DeepSpace and cannot be set as an app secret.`);
+  return [name, value.slice(eq + 1)];
+}
+function devTargetPath() {
+  return join8(process.cwd(), ".dev.vars");
+}
+function readDevTarget() {
+  if (!hasLegacyDevVars(process.cwd())) {
+    return readManagedAppEnv(process.cwd());
+  }
+  const path = devTargetPath();
+  if (!existsSync8(path)) return {};
+  return stripSdkManaged(parseDevVars(splitDevTarget(readFileSync7(path, "utf-8")).custom));
+}
+function readSyncedTarget() {
+  if (hasLegacyDevVars(process.cwd())) return readDevTarget();
+  return readManagedSyncedEnv(process.cwd());
+}
+function readDevOnlyTarget() {
+  if (hasLegacyDevVars(process.cwd())) return readDevTarget();
+  return readManagedDevOnlyEnv(process.cwd());
+}
+function writeLocalPatch(set2 = {}, removeNames = []) {
+  for (const name of [...Object.keys(set2), ...removeNames]) {
+    if (SDK_MANAGED_KEYS.has(name)) {
+      throw new Error(`${name} is managed by DeepSpace and cannot be set as an app secret.`);
+    }
+  }
+  if (hasLegacyDevVars(process.cwd())) writeDevTargetPatch(set2, removeNames);
+  else {
+    patchManagedDevOnlyEnv(process.cwd(), set2, removeNames);
+  }
+}
+function quote(value) {
+  return quoteEnvValue(value);
+}
+function splitLocal(raw) {
+  const idx = raw.indexOf(DEV_VARS_DIVIDER);
+  if (idx < 0) return { top: "", custom: raw };
+  const after = raw.slice(idx + DEV_VARS_DIVIDER.length);
+  return {
+    top: raw.slice(0, idx).trimEnd(),
+    custom: after.startsWith("\n") ? after.slice(1) : after
+  };
+}
+function splitDevTarget(raw) {
+  const idx = raw.indexOf(DEV_VARS_DIVIDER);
+  if (idx >= 0) return splitLocal(raw);
+  const lines = raw.split("\n");
+  const top = [];
+  const custom = [];
+  let target = top;
+  let i = 0;
+  while (i < lines.length) {
+    const line = lines[i];
+    const name = assignmentName2(line);
+    const eq = line.indexOf("=");
+    const valStart = eq >= 0 ? line.slice(eq + 1) : "";
+    const block = [line];
+    i++;
+    if (name && valStart.startsWith('"') && !hasUnescapedQuote2(valStart.slice(1))) {
+      while (i < lines.length) {
+        block.push(lines[i]);
+        const closed = hasUnescapedQuote2(lines[i]);
+        i++;
+        if (closed) break;
+      }
+    }
+    if (name && !SDK_MANAGED_KEYS.has(name)) target = custom;
+    target.push(...block);
+  }
+  while (top.length && top[top.length - 1] === "") top.pop();
+  while (custom.length && custom[custom.length - 1] === "") custom.pop();
+  return { top: top.join("\n"), custom: custom.join("\n") };
+}
+function assignmentName2(line) {
+  const eq = line.indexOf("=");
+  if (eq < 0) return null;
+  const match = line.slice(0, eq).match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*$/);
+  return match?.[1] ?? null;
+}
+function hasUnescapedQuote2(s) {
+  let escaped = false;
+  for (const ch of s) {
+    if (escaped) {
+      escaped = false;
+      continue;
+    }
+    if (ch === "\\") {
+      escaped = true;
+      continue;
+    }
+    if (ch === '"') return true;
+  }
+  return false;
+}
+function rewriteCustomSection(custom, set2, remove2) {
+  const lines = custom.split("\n");
+  const out = [];
+  const pending = new Set(Object.keys(set2));
+  let i = 0;
+  while (i < lines.length) {
+    const line = lines[i];
+    const name = assignmentName2(line);
+    const eq = line.indexOf("=");
+    const valStart = eq >= 0 ? line.slice(eq + 1) : "";
+    const block = [line];
+    i++;
+    if (name && valStart.startsWith('"') && !hasUnescapedQuote2(valStart.slice(1))) {
+      while (i < lines.length) {
+        block.push(lines[i]);
+        const closed = hasUnescapedQuote2(lines[i]);
+        i++;
+        if (closed) break;
+      }
+    }
+    if (name && (remove2.has(name) || pending.has(name))) {
+      if (pending.has(name)) {
+        out.push(`${name}=${quote(set2[name])}`);
+        pending.delete(name);
+      }
+      continue;
+    }
+    out.push(...block);
+  }
+  while (out.length && out[out.length - 1] === "") out.pop();
+  for (const name of Array.from(pending).sort()) {
+    out.push(`${name}=${quote(set2[name])}`);
+  }
+  return out.join("\n");
+}
+function writeDevTargetPatch(set2 = {}, removeNames = []) {
+  const path = devTargetPath();
+  const existing = existsSync8(path) ? readFileSync7(path, "utf-8") : "";
+  const { top, custom: existingCustom } = splitDevTarget(existing);
+  const custom = rewriteCustomSection(existingCustom, set2, new Set(removeNames));
+  const body = top ? `${top}
+
+${DEV_VARS_DIVIDER}
+${custom}${custom ? "\n" : ""}` : `${DEV_VARS_DIVIDER}
+${custom}${custom ? "\n" : ""}`;
+  writeFileSync5(path, body);
+}
+async function remoteDeployState(appName, token2) {
+  const res = await fetch(`${process.env.DEEPSPACE_DEPLOY_URL ?? "https://deploy-worker.deep.space"}/api/deploy/${encodeURIComponent(appName)}`, {
+    headers: { Authorization: `Bearer ${token2}` }
+  });
+  const text2 = await res.text().catch(() => "");
+  let body = {};
+  if (text2) {
+    try {
+      body = JSON.parse(text2);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      throw new Error(`Could not determine deploy status for ${appName}: invalid JSON response (${message}).`);
+    }
+  }
+  if (!res.ok) {
+    const detail = body.error ?? (text2 || "unknown error");
+    throw new Error(`Could not determine deploy status for ${appName} (${res.status}): ${detail}`);
+  }
+  if (body.deployed === true) return "deployed";
+  if (body.deployed === false) return "not-deployed";
+  throw new Error(`Could not determine deploy status for ${appName}: response missing "deployed".`);
+}
+async function remoteAvailable(appName, token2) {
+  return await remoteDeployState(appName, token2) === "deployed";
+}
+async function mintScopedSecretsToken(appName, token2) {
+  const body = await collaboratorFetch(appName, token2, "/secrets-token", { method: "POST" });
+  if (!body.token) throw new Error("Platform API did not return an app-secret access token.");
+  return body.token;
+}
+async function remoteFetch(appName, token2, path = "", init = {}) {
+  const scopedToken = await mintScopedSecretsToken(appName, token2);
+  const res = await fetch(`https://${appName}.app.space/_deepspace/secrets${path}`, {
+    ...init,
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${scopedToken}`,
+      ...init.headers ?? {}
+    }
+  });
+  const contentType = res.headers.get("content-type") ?? "unknown";
+  const text2 = await res.text().catch(() => "");
+  let body = null;
+  let parseError = null;
+  if (text2 && contentType.toLowerCase().includes("json")) {
+    try {
+      body = JSON.parse(text2);
+    } catch (err) {
+      parseError = err instanceof Error ? err.message : String(err);
+    }
+  }
+  if (!res.ok) {
+    if (body?.error) throw new Error(body.error);
+    const snippet = text2 ? ` Body: ${text2.slice(0, ERROR_SNIPPET_CHARS)}` : " Body: <empty>";
+    const parseDetail2 = parseError ? ` JSON parse failed: ${parseError}.` : "";
+    throw new Error(`Remote secrets request failed (${res.status}; content-type: ${contentType}).${parseDetail2}${snippet}`);
+  }
+  if (body) return body;
+  if (!text2) return {};
+  const parseDetail = parseError ? ` JSON parse failed: ${parseError}.` : "";
+  throw new Error(`Remote secrets response was not JSON (${res.status}; content-type: ${contentType}).${parseDetail} Body: ${text2.slice(0, ERROR_SNIPPET_CHARS)}`);
+}
+function apiUrl() {
+  return process.env.DEEPSPACE_API_URL ?? ENVS.prod.api;
+}
+async function collaboratorFetch(appName, token2, path, init = {}) {
+  const url = `${apiUrl()}/api/app-collaborators/${encodeURIComponent(appName)}${path}`;
+  const res = await fetch(url, {
+    ...init,
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${token2}`,
+      ...init.headers ?? {}
+    }
+  });
+  const text2 = await res.text().catch(() => "");
+  let body = {};
+  if (text2) {
+    try {
+      body = JSON.parse(text2);
+    } catch {
+      if (res.status === 404) throw new Error(COLLABORATOR_ROUTES_404);
+      if (!res.ok) throw new Error(`Collaborator request failed (${res.status}): ${text2.slice(0, ERROR_SNIPPET_CHARS)}`);
+      throw new Error(`Collaborator response was not JSON (${res.status}): ${text2.slice(0, ERROR_SNIPPET_CHARS)}`);
+    }
+  }
+  if (!res.ok) {
+    if (res.status === 404 && (!body.error || body.error === "Not found" || body.error === "not_found")) {
+      throw new Error(COLLABORATOR_ROUTES_404);
+    }
+    if (body.error === "platform_schema_not_migrated") {
+      const diagnostic = body;
+      const action = typeof diagnostic.action === "string" ? ` ${diagnostic.action}` : "";
+      throw new Error(`${COLLABORATOR_SCHEMA_NOT_MIGRATED}${action}`);
+    }
+    throw new Error(body.error ?? `Collaborator request failed (${res.status})`);
+  }
+  return body;
+}
+async function requireRemoteSecretsAvailable(appName, token2) {
+  const state = await remoteDeployState(appName, token2);
+  if (state === "deployed") return;
+  throw new Error(
+    "Remote secrets are available after the first deploy. Deploy this app first, then run `deepspace secrets push`; `deepspace secrets set --dev` writes dev-only secrets for `deepspace dev` without touching remote."
+  );
+}
+function diffMaps(local, remote) {
+  const localOnly = [];
+  const remoteOnly = [];
+  const changed = [];
+  const matching = [];
+  for (const [name, value] of Object.entries(local)) {
+    if (!(name in remote)) localOnly.push(name);
+    else if (remote[name] !== value) changed.push(name);
+    else matching.push(name);
+  }
+  for (const name of Object.keys(remote)) {
+    if (!(name in local)) remoteOnly.push(name);
+  }
+  return { localOnly, remoteOnly, changed, matching };
+}
+function diffNames(local, remote) {
+  const localSet = new Set(local);
+  const remoteSet = new Set(remote);
+  return {
+    localOnly: local.filter((name) => !remoteSet.has(name)).sort(),
+    remoteOnly: remote.filter((name) => !localSet.has(name)).sort()
+  };
+}
+function statusLine(d, remote) {
+  if (!remote) return "Secrets: remote unavailable until first deploy; dev-only .env section updated.";
+  if (!d || !d.localOnly.length && !d.remoteOnly.length && !d.changed.length) {
+    return "Secrets: synced .env section matches remote.";
+  }
+  return `Secrets: ${d.localOnly.length} local-only, ${d.remoteOnly.length} remote-only, ${d.changed.length} changed. Run \`deepspace secrets diff\`.`;
+}
+function nameStatusLine(d) {
+  if (!d.localOnly.length && !d.remoteOnly.length) {
+    return "Secrets: synced .env section has the same names as remote.";
+  }
+  return `Secrets: ${d.localOnly.length} local-only, ${d.remoteOnly.length} remote-only. Run \`deepspace secrets diff\` to compare values.`;
+}
+async function compare(appName, token2) {
+  if (!await remoteAvailable(appName, token2)) return null;
+  const local = readSyncedTarget();
+  const remote = await remoteFetch(appName, token2, "/pull");
+  return diffMaps(local, remote.secrets ?? {});
+}
+var set = defineCommand3({
+  meta: { name: "set", description: "Set an app secret" },
+  args: {
+    assignment: { type: "positional", required: true, description: "KEY=value" },
+    dev: {
+      type: "boolean",
+      default: false,
+      description: "Write only to the dev-only .env section used by `deepspace dev`; never sync to the deployed app"
+    }
+  },
+  async run({ args }) {
+    const [name, value] = parseAssignment(String(args.assignment));
+    const token2 = await ensureToken();
+    const appName = requireAppName(void 0);
+    if (args.dev) {
+      writeLocalPatch({ [name]: value });
+      console.log("Secrets: updated dev-only .env section for `deepspace dev`; remote was not changed.");
+      return;
+    }
+    const state = await remoteDeployState(appName, token2);
+    if (state === "not-deployed") {
+      writeLocalPatch({ [name]: value });
+      console.log("Secrets: app is not deployed; wrote to dev-only .env section. Run `deepspace secrets push` after deploy.");
+      return;
+    }
+    await remoteFetch(appName, token2, "", { method: "PATCH", body: JSON.stringify({ set: { [name]: value } }) });
+    if (hasLegacyDevVars(process.cwd())) writeDevTargetPatch({ [name]: value });
+    else patchManagedSyncedEnv(process.cwd(), { [name]: value });
+    console.log("Secrets: updated remote and synced .env section.");
+  }
+});
+var unset = defineCommand3({
+  meta: { name: "unset", description: "Remove an app secret" },
+  args: {
+    name: { type: "positional", required: true, description: "Secret name" },
+    dev: {
+      type: "boolean",
+      default: false,
+      description: "Remove only from the dev-only .env section used by `deepspace dev`; never sync to the deployed app"
+    }
+  },
+  async run({ args }) {
+    const name = String(args.name);
+    if (!SECRET_NAME_RE.test(name)) throw new Error(`Invalid secret name "${name}".`);
+    const token2 = await ensureToken();
+    const appName = requireAppName(void 0);
+    if (args.dev) {
+      writeLocalPatch({}, [name]);
+      console.log("Secrets: removed from dev-only .env section; remote was not changed.");
+      return;
+    }
+    const state = await remoteDeployState(appName, token2);
+    if (state === "not-deployed") {
+      writeLocalPatch({}, [name]);
+      console.log("Secrets: app is not deployed; removed from dev-only .env section if present.");
+      return;
+    }
+    await remoteFetch(appName, token2, "", { method: "PATCH", body: JSON.stringify({ delete: [name] }) });
+    if (hasLegacyDevVars(process.cwd())) writeDevTargetPatch({}, [name]);
+    else patchManagedSyncedEnv(process.cwd(), {}, [name]);
+    console.log("Secrets: removed from remote and synced .env section.");
+  }
+});
+var list = defineCommand3({
+  meta: { name: "list", description: "List app secret names and metadata" },
+  async run() {
+    const token2 = await ensureToken();
+    const appName = requireAppName(void 0);
+    await requireRemoteSecretsAvailable(appName, token2);
+    const body = await remoteFetch(appName, token2);
+    for (const item of body.secrets ?? []) console.log(`${item.name}	version=${item.version}	updated=${item.updatedAt}`);
+    const d = diffNames(Object.keys(readSyncedTarget()), (body.secrets ?? []).map((item) => item.name));
+    console.log(nameStatusLine(d));
+  }
+});
+var pull = defineCommand3({
+  meta: { name: "pull", description: "Pull remote app secrets into the synced .env section" },
+  async run() {
+    const token2 = await ensureToken();
+    const appName = requireAppName(void 0);
+    await requireRemoteSecretsAvailable(appName, token2);
+    const body = await remoteFetch(appName, token2, "/pull");
+    const remoteSecrets = body.secrets ?? {};
+    if (hasLegacyDevVars(process.cwd())) {
+      writeDevTargetPatch(remoteSecrets);
+    } else {
+      replaceManagedSyncedEnv(process.cwd(), remoteSecrets);
+    }
+    const count = Object.keys(remoteSecrets).length;
+    console.log(`Secrets: pulled ${count} remote secret${count === 1 ? "" : "s"} into synced .env section.`);
+  }
+});
+var push = defineCommand3({
+  meta: { name: "push", description: "Push dev-only .env secrets to remote and move them to synced" },
+  async run() {
+    const token2 = await ensureToken();
+    const appName = requireAppName(void 0);
+    const local = readDevOnlyTarget();
+    await requireRemoteSecretsAvailable(appName, token2);
+    const names = Object.keys(local);
+    if (!names.length) {
+      console.log("Secrets: no dev-only .env secrets to push.");
+      return;
+    }
+    await remoteFetch(appName, token2, "", { method: "PATCH", body: JSON.stringify({ set: local }) });
+    if (hasLegacyDevVars(process.cwd())) {
+      console.log(`Secrets: pushed ${names.length} dev-only secret${names.length === 1 ? "" : "s"} to remote.`);
+    } else {
+      moveManagedDevOnlyToSynced(process.cwd(), names);
+      console.log(`Secrets: pushed ${names.length} dev-only secret${names.length === 1 ? "" : "s"} to remote and moved ${names.length === 1 ? "it" : "them"} to synced .env section.`);
+    }
+  }
+});
+var diff = defineCommand3({
+  meta: { name: "diff", description: "Compare synced .env section with remote app secrets" },
+  async run() {
+    const token2 = await ensureToken();
+    const appName = requireAppName(void 0);
+    await requireRemoteSecretsAvailable(appName, token2);
+    const d = await compare(appName, token2);
+    for (const name of d?.localOnly ?? []) console.log(`local-only	${name}`);
+    for (const name of d?.remoteOnly ?? []) console.log(`remote-only	${name}`);
+    for (const name of d?.changed ?? []) console.log(`changed	${name}`);
+    console.log(statusLine(d, true));
+  }
+});
+var collaboratorsList = defineCommand3({
+  meta: { name: "list", description: "List app secret collaborators" },
+  async run() {
+    const token2 = await ensureToken();
+    const appName = requireAppName(void 0);
+    const body = await collaboratorFetch(appName, token2, "/collaborators");
+    for (const item of body.collaborators ?? []) {
+      console.log(`${item.emailDisplay}	${item.userId}	created=${new Date(item.createdAt).toISOString()}`);
+    }
+    if (!body.collaborators?.length) console.log("No secrets collaborators.");
+  }
+});
+var collaboratorsAdd = defineCommand3({
+  meta: { name: "add", description: "Add an existing DeepSpace user as a secrets collaborator" },
+  args: {
+    email: { type: "positional", required: true, description: "Collaborator email" }
+  },
+  async run({ args }) {
+    const token2 = await ensureToken();
+    const appName = requireAppName(void 0);
+    const body = await collaboratorFetch(appName, token2, "/collaborators", {
+      method: "POST",
+      body: JSON.stringify({ email: String(args.email) })
+    });
+    console.log(`Added ${body.collaborator.emailDisplay} (${body.collaborator.userId}) as a secrets collaborator.`);
+  }
+});
+var collaboratorsRemove = defineCommand3({
+  meta: { name: "remove", description: "Remove a secrets collaborator" },
+  args: {
+    target: { type: "positional", required: true, description: "Collaborator email or user id" }
+  },
+  async run({ args }) {
+    const token2 = await ensureToken();
+    const appName = requireAppName(void 0);
+    const target = String(args.target);
+    let userId = target;
+    if (target.includes("@")) {
+      const body = await collaboratorFetch(appName, token2, "/collaborators");
+      const normalized = target.trim().toLowerCase();
+      const match = body.collaborators.find((item) => item.emailNormalized === normalized);
+      if (!match) throw new Error(`No collaborator found for ${target}.`);
+      userId = match.userId;
+    }
+    await collaboratorFetch(appName, token2, `/collaborators/${encodeURIComponent(userId)}`, { method: "DELETE" });
+    console.log(`Removed secrets collaborator ${target}.`);
+  }
+});
+var invitesList = defineCommand3({
+  meta: { name: "list", description: "List app secret collaborator invites" },
+  async run() {
+    const token2 = await ensureToken();
+    const appName = requireAppName(void 0);
+    const body = await collaboratorFetch(appName, token2, "/invites");
+    for (const invite of body.invites ?? []) {
+      const status2 = invite.revokedAt ? "revoked" : invite.acceptedAt ? "accepted" : new Date(invite.expiresAt).getTime() <= Date.now() ? "expired" : "pending";
+      console.log(`${invite.id}	${invite.emailDisplay}	status=${status2}	expires=${new Date(invite.expiresAt).toISOString()}`);
+    }
+    if (!body.invites?.length) console.log("No secrets collaborator invites.");
+  }
+});
+var invitesRevoke = defineCommand3({
+  meta: { name: "revoke", description: "Revoke a pending app secret collaborator invite" },
+  args: {
+    inviteId: { type: "positional", required: true, description: "Invite id" }
+  },
+  async run({ args }) {
+    const token2 = await ensureToken();
+    const appName = requireAppName(void 0);
+    await collaboratorFetch(appName, token2, `/invites/${encodeURIComponent(String(args.inviteId))}`, { method: "DELETE" });
+    console.log(`Revoked secrets collaborator invite ${String(args.inviteId)}.`);
+  }
+});
+var invites = defineCommand3({
+  meta: { name: "invites", description: "Manage app secret collaborator invites" },
+  subCommands: { list: invitesList, revoke: invitesRevoke }
+});
+var collaborators = defineCommand3({
+  meta: { name: "collaborators", description: "Manage app secret collaborators" },
+  subCommands: { list: collaboratorsList, add: collaboratorsAdd, remove: collaboratorsRemove, invites }
+});
+var secrets_default = defineCommand3({
+  meta: { name: "secrets", description: "Manage app-owned DeepSpace secrets" },
+  subCommands: { set, unset, list, pull, push, diff, collaborators }
+});
+
 // src/cli/commands/dev.ts
 var DEFAULT_PORT = 5173;
-var dev_default = defineCommand3({
+var dev_default = defineCommand4({
   meta: {
     name: "dev",
     description: "Start local development server"
@@ -766,13 +1483,18 @@ var dev_default = defineCommand3({
     },
     env: {
       type: "string",
-      description: "wrangler.toml [env.<name>] block to run (e.g. --env staging). Reads .dev.vars.<name> and applies the env's overrides at build time.",
+      description: "wrangler.toml [env.<name>] block to run (e.g. --env staging). Legacy apps read .dev.vars.<name>; new apps use managed .env.",
       required: false
     },
     port: {
       type: "string",
       description: `Port to bind (default ${DEFAULT_PORT}, or $DEEPSPACE_PORT)`,
       required: false
+    },
+    "no-pull-env": {
+      type: "boolean",
+      description: "Skip pulling remote app secrets into the synced .env section on startup",
+      default: false
     }
   },
   async run({ args }) {
@@ -813,6 +1535,21 @@ var dev_default = defineCommand3({
     if (wranglerEnv) console.log(`Wrangler env: ${wranglerEnv}`);
     console.log(`Port: ${port}`);
     await writeDevVars(appDir, env, payload.sub, token2, wranglerEnv);
+    if (env === "dev" && !args["no-pull-env"] && !hasLegacyDevVars(appDir, wranglerEnv)) {
+      const appName = resolveCurrentAppName(appDir, wranglerEnv);
+      if (appName) {
+        try {
+          if (await remoteAvailable(appName, token2)) {
+            const body = await remoteFetch(appName, token2, "/pull");
+            replaceManagedSyncedEnv(appDir, body.secrets ?? {});
+            console.log("Secrets: pulled remote app secrets into synced .env section.");
+          }
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          console.warn(`Secrets: remote app secrets pull skipped (${message}).`);
+        }
+      }
+    }
     preflightWindowsWorkerd(appDir);
     console.log("Starting dev server...\n");
     const vite = spawn(
@@ -822,9 +1559,10 @@ var dev_default = defineCommand3({
         cwd: appDir,
         stdio: "inherit",
         // CLOUDFLARE_ENV is what the Cloudflare Vite plugin keys off — it
-        // applies `[env.<name>]` overrides and loads `.dev.vars.<name>`
-        // instead of `.dev.vars`. Set only when --env was passed so the
-        // default invocation behaves exactly as before.
+        // applies `[env.<name>]` overrides. Legacy .dev.vars apps use
+        // `.dev.vars.<name>` instead of `.dev.vars`; new apps use managed .env.
+        // Set only when --env was passed so the default invocation behaves
+        // exactly as before.
         env: {
           ...process.env,
           DEEPSPACE_PORT: String(port),
@@ -847,15 +1585,23 @@ function resolvePort(arg) {
   }
   return n;
 }
+function resolveCurrentAppName(appDir, wranglerEnv) {
+  try {
+    const resolved = resolveAppNameForEnv(readWranglerConfig(appDir), wranglerEnv);
+    return resolved.ok ? resolved.name : null;
+  } catch {
+    return null;
+  }
+}
 
 // src/cli/commands/kill.ts
-import { defineCommand as defineCommand4 } from "citty";
+import { defineCommand as defineCommand5 } from "citty";
 import { spawnSync } from "child_process";
 import { setTimeout as wait } from "timers/promises";
 var DEFAULT_PORT2 = 5173;
 var SIGTERM_GRACE_MS = 1500;
 var IS_WIN = process.platform === "win32";
-var kill_default = defineCommand4({
+var kill_default = defineCommand5({
   meta: {
     name: "kill",
     description: "Kill the local dev server and any orphaned workerd processes"
@@ -1010,7 +1756,7 @@ function isAlive(pid) {
 }
 
 // src/cli/commands/test.ts
-import { defineCommand as defineCommand5 } from "citty";
+import { defineCommand as defineCommand6 } from "citty";
 import { resolve as resolve4 } from "path";
 import { sync as spawnSync3 } from "cross-spawn";
 
@@ -1040,7 +1786,7 @@ function ensurePlaywright(appDir) {
 
 // src/cli/commands/test.ts
 var DEFAULT_PORT3 = 5173;
-var test_default = defineCommand5({
+var test_default = defineCommand6({
   meta: {
     name: "test",
     description: "Run tests for your DeepSpace app"
@@ -1155,10 +1901,10 @@ function resolvePort3(arg) {
 }
 
 // src/cli/commands/screenshot.ts
-import { defineCommand as defineCommand6 } from "citty";
+import { defineCommand as defineCommand7 } from "citty";
 import { sync as spawnSync4 } from "cross-spawn";
 import { resolve as resolve5 } from "path";
-var screenshot_default = defineCommand6({
+var screenshot_default = defineCommand7({
   meta: {
     name: "screenshot",
     description: "Take a Playwright screenshot, installing Chromium on demand"
@@ -1202,29 +1948,29 @@ var screenshot_default = defineCommand6({
 });
 
 // src/cli/commands/test-accounts.ts
-import { defineCommand as defineCommand7 } from "citty";
+import { defineCommand as defineCommand8 } from "citty";
 import * as p3 from "@clack/prompts";
-import { readFileSync as readFileSync7, writeFileSync as writeFileSync5, existsSync as existsSync8, mkdirSync as mkdirSync4 } from "fs";
-import { join as join8 } from "path";
+import { readFileSync as readFileSync8, writeFileSync as writeFileSync6, existsSync as existsSync9, mkdirSync as mkdirSync4 } from "fs";
+import { join as join9 } from "path";
 import { homedir as homedir4 } from "os";
 var SESSION_COOKIE2 = "__Secure-better-auth.session_token";
 var AUTH_URL4 = process.env.DEEPSPACE_AUTH_URL ?? ENVS.prod.auth;
-var DIR3 = join8(homedir4(), ".deepspace");
-var ACCOUNTS_PATH = join8(DIR3, "test-accounts.json");
+var DIR3 = join9(homedir4(), ".deepspace");
+var ACCOUNTS_PATH = join9(DIR3, "test-accounts.json");
 function loadAccounts() {
-  if (!existsSync8(ACCOUNTS_PATH)) return [];
+  if (!existsSync9(ACCOUNTS_PATH)) return [];
   try {
-    return JSON.parse(readFileSync7(ACCOUNTS_PATH, "utf-8"));
+    return JSON.parse(readFileSync8(ACCOUNTS_PATH, "utf-8"));
   } catch {
     return [];
   }
 }
 function saveAccounts(accounts) {
   mkdirSync4(DIR3, { recursive: true });
-  writeFileSync5(ACCOUNTS_PATH, JSON.stringify(accounts, null, 2), { mode: 384 });
+  writeFileSync6(ACCOUNTS_PATH, JSON.stringify(accounts, null, 2), { mode: 384 });
 }
 function sessionCookie() {
-  const token2 = readFileSync7(SESSION_PATH2, "utf-8").trim();
+  const token2 = readFileSync8(SESSION_PATH2, "utf-8").trim();
   return `${SESSION_COOKIE2}=${encodeURIComponent(token2)}`;
 }
 async function fetchRemoteAccounts() {
@@ -1247,7 +1993,7 @@ async function deleteRemote(id) {
     throw new Error(data.error ?? `DELETE returned ${res.status}`);
   }
 }
-var create = defineCommand7({
+var create = defineCommand8({
   meta: {
     name: "create",
     description: "Create a test account"
@@ -1317,7 +2063,7 @@ var create = defineCommand7({
 Saved to ${ACCOUNTS_PATH}`);
   }
 });
-var list = defineCommand7({
+var list2 = defineCommand8({
   meta: {
     name: "list",
     description: "List your test accounts"
@@ -1352,7 +2098,7 @@ var list = defineCommand7({
     }
   }
 });
-var del = defineCommand7({
+var del = defineCommand8({
   meta: {
     name: "delete",
     description: "Delete a test account by --email or --id"
@@ -1409,7 +2155,7 @@ var del = defineCommand7({
     console.log(`Test account deleted${targetEmail ? `: ${targetEmail}` : `: ${targetId}`}`);
   }
 });
-var clear = defineCommand7({
+var clear = defineCommand8({
   meta: {
     name: "clear",
     description: "Delete all your test accounts (or those matching --label)"
@@ -1475,25 +2221,25 @@ Failed:`);
     }
   }
 });
-var test_accounts_default = defineCommand7({
+var test_accounts_default = defineCommand8({
   meta: {
     name: "test-accounts",
     description: "Manage test accounts for development"
   },
   subCommands: {
     create,
-    list,
+    list: list2,
     delete: del,
     clear
   }
 });
 
 // src/cli/commands/deploy.ts
-import { defineCommand as defineCommand8 } from "citty";
+import { defineCommand as defineCommand9 } from "citty";
 import { execSync as execSync2 } from "child_process";
 import { randomUUID } from "crypto";
-import { readFileSync as readFileSync8, readdirSync as readdirSync2, existsSync as existsSync9 } from "fs";
-import { join as join9, resolve as resolve6, dirname as dirname2 } from "path";
+import { readFileSync as readFileSync9, readdirSync as readdirSync2, existsSync as existsSync10 } from "fs";
+import { join as join10, resolve as resolve6, dirname as dirname2 } from "path";
 import { pathToFileURL } from "url";
 import * as p4 from "@clack/prompts";
 
@@ -1522,6 +2268,7 @@ var RESERVED_BINDING_NAMES = /* @__PURE__ */ new Set([
   "AUTH_WORKER_URL",
   "APP_IDENTITY_TOKEN",
   "APP_OWNER_JWT",
+  "APP_SECRETS_KEY",
   "USAGE_EVENTS"
 ]);
 function validateBindingManifest(manifest) {
@@ -1702,6 +2449,7 @@ function asObjectArray(v) {
 // src/cli/commands/deploy.ts
 var DEPLOY_URL = process.env.DEEPSPACE_DEPLOY_URL ?? ENVS.prod.deploy;
 var API_URL = process.env.DEEPSPACE_API_URL ?? ENVS.prod.api;
+var SECRET_NAME_RE2 = /^[A-Za-z_][A-Za-z0-9_]*$/;
 var CLOUDFLARE_DEPLOY_ERROR_HINT = "Deployment reached the DeepSpace deploy worker, but Cloudflare's deployment control-plane API failed. This is often caused by a Cloudflare Dashboard/API incident or Workers for Platforms entitlement outage. Already deployed apps should keep serving; wait for Cloudflare to recover and retry.";
 var RESERVED_RUN_WORKER_FIRST = /* @__PURE__ */ new Set([
   "/api/*",
@@ -1744,6 +2492,14 @@ function formatDeployWorkerError(status2, error) {
 
 Underlying error: ${detail}`;
 }
+function legacyDevVarsAppSecretsRoomWarning(userSecrets, doManifest) {
+  if (!Object.keys(userSecrets).length) return null;
+  const hasAppSecretsRoom = (doManifest ?? []).some(
+    (binding) => binding.binding === "SECRETS_ROOMS" || binding.className === "AppSecretsRoom"
+  );
+  if (!hasAppSecretsRoom) return null;
+  return "Legacy .dev.vars secrets are still being deployed as direct Worker bindings even though AppSecretsRoom is configured. Move these values with `deepspace secrets set` to manage them through the app secrets store.";
+}
 var MAX_GROUP_BYTES = 40 * 1024 * 1024;
 var GROUP_BYTES = (() => {
   const raw = Number(process.env.DEEPSPACE_DEPLOY_GROUP_BYTES);
@@ -1797,7 +2553,7 @@ async function abortStagedUpload(appName, uploadId, totalGroups, token2) {
   } catch {
   }
 }
-var deploy_default = defineCommand8({
+var deploy_default = defineCommand9({
   meta: {
     name: "deploy",
     description: "Build and deploy your DeepSpace app"
@@ -1861,18 +2617,18 @@ var deploy_default = defineCommand8({
       process.exit(1);
     }
     s.stop("Built");
-    const deployConfigPath = join9(appDir, ".wrangler", "deploy", "config.json");
-    if (!existsSync9(deployConfigPath)) {
+    const deployConfigPath = join10(appDir, ".wrangler", "deploy", "config.json");
+    if (!existsSync10(deployConfigPath)) {
       p4.cancel("Build output config not found at .wrangler/deploy/config.json");
       process.exit(1);
     }
-    const deployConfig = JSON.parse(readFileSync8(deployConfigPath, "utf-8"));
+    const deployConfig = JSON.parse(readFileSync9(deployConfigPath, "utf-8"));
     const outputWranglerPath = resolve6(dirname2(deployConfigPath), deployConfig.configPath);
-    if (!existsSync9(outputWranglerPath)) {
+    if (!existsSync10(outputWranglerPath)) {
       p4.cancel(`Output wrangler.json not found at ${outputWranglerPath}`);
       process.exit(1);
     }
-    const outputConfig = JSON.parse(readFileSync8(outputWranglerPath, "utf-8"));
+    const outputConfig = JSON.parse(readFileSync9(outputWranglerPath, "utf-8"));
     if (outputConfig.name && outputConfig.name !== appName) {
       const envHint = envName ? ` (--env ${envName})` : "";
       p4.cancel(
@@ -1881,20 +2637,20 @@ var deploy_default = defineCommand8({
       process.exit(1);
     }
     const workerDir = dirname2(outputWranglerPath);
-    const workerBundlePath = join9(workerDir, outputConfig.main);
+    const workerBundlePath = join10(workerDir, outputConfig.main);
     const clientDir = outputConfig.assets?.directory ? resolve6(workerDir, outputConfig.assets.directory) : null;
-    if (!existsSync9(workerBundlePath)) {
+    if (!existsSync10(workerBundlePath)) {
       p4.cancel(`Worker bundle not found at ${workerBundlePath}`);
       process.exit(1);
     }
-    if (!clientDir || !existsSync9(clientDir)) {
+    if (!clientDir || !existsSync10(clientDir)) {
       p4.cancel(`Client assets not found at ${clientDir}`);
       process.exit(1);
     }
     s.start("Collecting assets...");
     const assets = collectAssets(clientDir);
     s.stop(`Collected ${assets.length} assets`);
-    const workerJs = readFileSync8(workerBundlePath, "utf-8");
+    const workerJs = readFileSync9(workerBundlePath, "utf-8");
     const doBindings = outputConfig.durable_objects?.bindings;
     const sqliteClasses = new Set(
       outputConfig.migrations?.flatMap((m) => m.new_sqlite_classes ?? []) ?? []
@@ -1921,40 +2677,20 @@ var deploy_default = defineCommand8({
         `Custom bindings: ${customBindings.map((b) => `${b.name} (${b.type})`).join(", ")}`
       );
     }
-    const devVarsPath = devVarsPathFor(appDir, envName);
     let userSecrets = {};
-    if (existsSync9(devVarsPath)) {
-      const customSection = extractCustomDevVars(readFileSync8(devVarsPath, "utf-8"));
-      if (customSection) {
-        try {
-          userSecrets = parseDevVars(customSection);
-        } catch (err) {
-          p4.cancel(`.dev.vars: ${err.message}`);
-          process.exit(1);
-        }
-      }
-    }
-    const userSecretNames = Object.keys(userSecrets);
-    const declaredBindingNames = /* @__PURE__ */ new Set([
-      ...customBindings.map((b) => b.name),
-      ...(doManifest ?? []).map((d) => d.binding)
-    ]);
-    for (const name of userSecretNames) {
-      if (RESERVED_BINDING_NAMES.has(name)) {
-        p4.cancel(
-          `.dev.vars: "${name}" is a reserved binding name and cannot be used as an app secret.`
-        );
-        process.exit(1);
-      }
-      if (declaredBindingNames.has(name)) {
-        p4.cancel(
-          `.dev.vars: "${name}" collides with a binding declared in wrangler.toml \u2014 rename one or the other.`
-        );
+    if (hasLegacyDevVars(appDir, envName)) {
+      try {
+        userSecrets = readLegacyUserSecrets(appDir, envName, customBindings, doManifest);
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        p4.cancel(message);
         process.exit(1);
       }
     }
-    if (userSecretNames.length) {
-      p4.log.info(`App secrets (from .dev.vars): ${userSecretNames.join(", ")}`);
+    if (Object.keys(userSecrets).length) {
+      p4.log.info(`Legacy .dev.vars secrets: ${Object.keys(userSecrets).sort().join(", ")}`);
+      const warning = legacyDevVarsAppSecretsRoomWarning(userSecrets, doManifest);
+      if (warning) p4.log.warn(warning);
     }
     s.start(`Deploying to ${appName}.app.space...`);
     const extraRoutes = extractRunWorkerFirst(wranglerConfig);
@@ -2018,12 +2754,12 @@ var deploy_default = defineCommand8({
       if (customBindings.length) {
         form.append("bindingManifest", JSON.stringify(customBindings));
       }
-      if (userSecretNames.length) {
-        form.append("userSecrets", JSON.stringify(userSecrets));
-      }
       if (extraRoutes.length) {
         form.append("extraRunWorkerFirst", JSON.stringify(extraRoutes));
       }
+      if (Object.keys(userSecrets).length) {
+        form.append("userSecrets", JSON.stringify(userSecrets));
+      }
       return form;
     };
     let res;
@@ -2060,6 +2796,7 @@ var deploy_default = defineCommand8({
         s.stop("Deployed (edge propagation still in progress after 90s)");
         p4.log.warn("First requests may briefly hit the assets transitional page; retry in a minute.");
         p4.log.success(`Live at: ${body.url}`);
+        p4.log.info("Secrets: local dev-only values are not pushed automatically. Run `deepspace secrets push` when you want to sync them.");
         await syncSubscriptionPlans(appDir, appName, token2);
         await syncOneTimeProducts(appDir, appName, token2);
         p4.outro("Done");
@@ -2068,21 +2805,43 @@ var deploy_default = defineCommand8({
     }
     s.stop("Deployed!");
     p4.log.success(`Live at: ${body.url}`);
+    p4.log.info("Secrets: local dev-only values are not pushed automatically. Run `deepspace secrets push` when you want to sync them.");
     await syncSubscriptionPlans(appDir, appName, token2);
     await syncOneTimeProducts(appDir, appName, token2);
     p4.outro("Done");
   }
 });
+function readLegacyUserSecrets(appDir, wranglerEnv, customBindings, doManifest) {
+  const path = join10(appDir, wranglerEnv ? `.dev.vars.${wranglerEnv}` : ".dev.vars");
+  if (!existsSync10(path)) return {};
+  const vars = parseDevVars(extractCustomDevVars(readFileSync9(path, "utf-8")));
+  const reserved = /* @__PURE__ */ new Set([
+    ...SDK_MANAGED_KEYS,
+    ...customBindings.map((b) => b.name),
+    ...(doManifest ?? []).flatMap((b) => [b.binding, b.className])
+  ]);
+  const out = {};
+  for (const [name, value] of Object.entries(vars)) {
+    if (!SECRET_NAME_RE2.test(name)) {
+      throw new Error(`.dev.vars: invalid secret name "${name}".`);
+    }
+    if (reserved.has(name)) {
+      throw new Error(`.dev.vars: "${name}" is reserved and cannot be deployed as a user secret.`);
+    }
+    out[name] = value;
+  }
+  return out;
+}
 async function syncSubscriptionPlans(appDir, appName, token2) {
-  const subsPath = join9(appDir, "src", "subscriptions.ts");
-  if (!existsSync9(subsPath)) return;
+  const subsPath = join10(appDir, "src", "subscriptions.ts");
+  if (!existsSync10(subsPath)) return;
   const s = createSpinner();
   s.start("Syncing subscription plans...");
   let plans;
   try {
     const esbuild = await import("esbuild");
-    const outDir = join9(appDir, ".wrangler", "deploy");
-    const outFile = join9(outDir, "subscriptions.bundle.mjs");
+    const outDir = join10(appDir, ".wrangler", "deploy");
+    const outFile = join10(outDir, "subscriptions.bundle.mjs");
     await esbuild.build({
       entryPoints: [subsPath],
       bundle: true,
@@ -2223,15 +2982,15 @@ current billing period? (Skip to leave them grandfathered.)`
   }
 }
 async function syncOneTimeProducts(appDir, appName, token2) {
-  const productsPath = join9(appDir, "src", "products.ts");
-  if (!existsSync9(productsPath)) return;
+  const productsPath = join10(appDir, "src", "products.ts");
+  if (!existsSync10(productsPath)) return;
   const s = createSpinner();
   s.start("Syncing one-time products...");
   let products;
   try {
     const esbuild = await import("esbuild");
-    const outDir = join9(appDir, ".wrangler", "deploy");
-    const outFile = join9(outDir, "products.bundle.mjs");
+    const outDir = join10(appDir, ".wrangler", "deploy");
+    const outFile = join10(outDir, "products.bundle.mjs");
     await esbuild.build({
       entryPoints: [productsPath],
       bundle: true,
@@ -2305,14 +3064,14 @@ function collectAssets(dir) {
   function walk(d, prefix) {
     for (const entry of readdirSync2(d, { withFileTypes: true })) {
       if (entry.name === ".assetsignore") continue;
-      const full = join9(d, entry.name);
+      const full = join10(d, entry.name);
       const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
       if (entry.isDirectory()) {
         walk(full, rel);
       } else {
         assets.push({
           path: "/" + rel,
-          contentBase64: readFileSync8(full).toString("base64")
+          contentBase64: readFileSync9(full).toString("base64")
         });
       }
     }
@@ -2322,10 +3081,10 @@ function collectAssets(dir) {
 }
 
 // src/cli/commands/undeploy.ts
-import { defineCommand as defineCommand9 } from "citty";
+import { defineCommand as defineCommand10 } from "citty";
 import * as p5 from "@clack/prompts";
 var DEPLOY_URL2 = process.env.DEEPSPACE_DEPLOY_URL ?? ENVS.prod.deploy;
-var undeploy_default = defineCommand9({
+var undeploy_default = defineCommand10({
   meta: {
     name: "undeploy",
     description: "Remove a deployed DeepSpace app"
@@ -2386,8 +3145,8 @@ var undeploy_default = defineCommand9({
 });
 
 // src/cli/commands/whoami.ts
-import { defineCommand as defineCommand10 } from "citty";
-var whoami_default = defineCommand10({
+import { defineCommand as defineCommand11 } from "citty";
+var whoami_default = defineCommand11({
   meta: {
     name: "whoami",
     description: "Show the currently logged-in user"
@@ -2442,18 +3201,18 @@ var whoami_default = defineCommand10({
 });
 
 // src/cli/commands/add.ts
-import { defineCommand as defineCommand11 } from "citty";
-import { existsSync as existsSync10 } from "fs";
-import { resolve as resolve7, join as join10 } from "path";
+import { defineCommand as defineCommand12 } from "citty";
+import { existsSync as existsSync11 } from "fs";
+import { resolve as resolve7, join as join11 } from "path";
 import { execSync as execSync3 } from "child_process";
 function findScript(from) {
-  const inNodeModules = join10(from, "node_modules", "deepspace", "scripts", "add-feature.cjs");
-  if (existsSync10(inNodeModules)) return inNodeModules;
-  const inDotDeepspace = join10(from, ".deepspace", "scripts", "add-feature.cjs");
-  if (existsSync10(inDotDeepspace)) return inDotDeepspace;
+  const inNodeModules = join11(from, "node_modules", "deepspace", "scripts", "add-feature.cjs");
+  if (existsSync11(inNodeModules)) return inNodeModules;
+  const inDotDeepspace = join11(from, ".deepspace", "scripts", "add-feature.cjs");
+  if (existsSync11(inDotDeepspace)) return inDotDeepspace;
   return null;
 }
-var add_default = defineCommand11({
+var add_default = defineCommand12({
   meta: {
     name: "add",
     description: "Add a feature to your DeepSpace app"
@@ -2488,8 +3247,8 @@ var add_default = defineCommand11({
     if (!script) {
       console.error("Could not find the deepspace feature installer.");
       console.error("Looked in:");
-      console.error(`  ${join10(appDir, "node_modules", "deepspace", "scripts", "add-feature.cjs")}`);
-      console.error(`  ${join10(appDir, ".deepspace", "scripts", "add-feature.cjs")}`);
+      console.error(`  ${join11(appDir, "node_modules", "deepspace", "scripts", "add-feature.cjs")}`);
+      console.error(`  ${join11(appDir, ".deepspace", "scripts", "add-feature.cjs")}`);
       console.error("Are you in a DeepSpace app directory? Try `npm install` first.");
       process.exit(1);
     }
@@ -2511,10 +3270,10 @@ var add_default = defineCommand11({
 });
 
 // src/cli/commands/skills.ts
-import { defineCommand as defineCommand12 } from "citty";
+import { defineCommand as defineCommand13 } from "citty";
 import spawn2 from "cross-spawn";
 import { mkdirSync as mkdirSync5 } from "fs";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 import { homedir as homedir5 } from "os";
 var SKILL_REPO = "deepdotspace/deepspace-skill";
 function runSkillsAdd(extraArgs) {
@@ -2533,9 +3292,9 @@ function runSkillsAdd(extraArgs) {
   });
 }
 function precreateClaudeDir(baseDir) {
-  mkdirSync5(join11(baseDir, ".claude"), { recursive: true });
+  mkdirSync5(join12(baseDir, ".claude"), { recursive: true });
 }
-var add = defineCommand12({
+var add = defineCommand13({
   meta: {
     name: "add",
     description: "Install the DeepSpace skill for your coding agent"
@@ -2577,7 +3336,7 @@ var add = defineCommand12({
     if (code !== 0) process.exit(code);
   }
 });
-var skills_default = defineCommand12({
+var skills_default = defineCommand13({
   meta: {
     name: "skills",
     description: "Manage the DeepSpace agent skill (Claude Code, Codex, OpenCode, Cursor, ...)"
@@ -2588,7 +3347,7 @@ var skills_default = defineCommand12({
 });
 
 // src/cli/commands/domain.ts
-import { defineCommand as defineCommand13 } from "citty";
+import { defineCommand as defineCommand14 } from "citty";
 import { execSync as execSync4 } from "child_process";
 var API_URL2 = process.env.DEEPSPACE_API_URL ?? ENVS.prod.api;
 async function api(token2, path, init) {
@@ -2600,16 +3359,16 @@ async function api(token2, path, init) {
       ...init?.headers ?? {}
     }
   });
-  const text = await res.text();
+  const text2 = await res.text();
   if (!res.ok) {
-    let msg = text;
+    let msg = text2;
     try {
-      msg = JSON.parse(text).error ?? text;
+      msg = JSON.parse(text2).error ?? text2;
     } catch {
     }
     throw new Error(`API ${path} (${res.status}): ${msg}`);
   }
-  return JSON.parse(text);
+  return JSON.parse(text2);
 }
 function scrubInternal(value) {
   if (Array.isArray(value)) return value.map(scrubInternal);
@@ -2644,7 +3403,7 @@ async function confirm3(message) {
     });
   });
 }
-var search = defineCommand13({
+var search = defineCommand14({
   meta: { name: "search", description: "Search for available domains" },
   args: {
     query: { type: "positional", description: "Domain or keyword", required: true },
@@ -2674,7 +3433,7 @@ var search = defineCommand13({
     }
   }
 });
-var buy = defineCommand13({
+var buy = defineCommand14({
   meta: { name: "buy", description: "Buy a domain and attach it to an app" },
   args: {
     domain: { type: "positional", description: "Domain to buy", required: true },
@@ -2763,7 +3522,7 @@ var buy = defineCommand13({
     process.exit(1);
   }
 });
-var list2 = defineCommand13({
+var list3 = defineCommand14({
   meta: { name: "list", description: "List your domains" },
   args: {
     json: { type: "boolean", description: "Emit JSON" }
@@ -2787,7 +3546,7 @@ var list2 = defineCommand13({
     }
   }
 });
-var status = defineCommand13({
+var status = defineCommand14({
   meta: { name: "status", description: "Show details for one domain" },
   args: {
     domain: { type: "positional", description: "Domain", required: true },
@@ -2815,7 +3574,7 @@ var status = defineCommand13({
     console.log(`Charged:       ${fmtCents(found.chargedCents)}/yr`);
   }
 });
-var attach = defineCommand13({
+var attach = defineCommand14({
   meta: { name: "attach", description: "Re-point a domain at a different app" },
   args: {
     domain: { type: "positional", description: "Domain to re-point", required: true },
@@ -2846,7 +3605,7 @@ var attach = defineCommand13({
     console.log(`\u2713 ${args.domain} now points at ${targetApp}`);
   }
 });
-var detach = defineCommand13({
+var detach = defineCommand14({
   meta: {
     name: "detach",
     description: "Stop routing the domain (keeps the registration; auto-renew unchanged)"
@@ -2876,7 +3635,7 @@ var detach = defineCommand13({
     console.log(`\u2713 ${args.domain} detached. Use \`deepspace domain attach\` to re-route, or \`renew --auto off\` to stop auto-renewal.`);
   }
 });
-var renew = defineCommand13({
+var renew = defineCommand14({
   meta: { name: "renew", description: "Toggle auto-renewal at the registrar" },
   args: {
     domain: { type: "positional", description: "Domain", required: true },
@@ -2910,16 +3669,16 @@ function openBrowser2(url) {
   } catch {
   }
 }
-var domain_default = defineCommand13({
+var domain_default = defineCommand14({
   meta: { name: "domain", description: "Buy and manage custom domains" },
-  subCommands: { search, buy, list: list2, status, attach, detach, renew }
+  subCommands: { search, buy, list: list3, status, attach, detach, renew }
 });
 
 // src/cli/commands/integrations.ts
-import { defineCommand as defineCommand14 } from "citty";
+import { defineCommand as defineCommand15 } from "citty";
 
 // src/cli/commands/_invoke-impl.ts
-import { readFileSync as readFileSync9 } from "fs";
+import { readFileSync as readFileSync10 } from "fs";
 var API_URL3 = process.env.DEEPSPACE_API_URL ?? ENVS.prod.api;
 var DEFAULT_TIMEOUT_MS = 12e4;
 function parseTarget(target) {
@@ -2940,7 +3699,7 @@ function resolveBody(opts) {
   if (opts.body != null) {
     raw = opts.body;
   } else if (opts.bodyFile != null) {
-    raw = opts.bodyFile === "-" ? readFileSync9(0, "utf-8") : readFileSync9(opts.bodyFile, "utf-8");
+    raw = opts.bodyFile === "-" ? readFileSync10(0, "utf-8") : readFileSync10(opts.bodyFile, "utf-8");
   } else {
     return "{}";
   }
@@ -3091,7 +3850,7 @@ async function runInvoke(args) {
 }
 
 // src/cli/commands/integrations.ts
-var list3 = defineCommand14({
+var list4 = defineCommand15({
   meta: {
     name: "list",
     description: "List all available integrations"
@@ -3112,7 +3871,7 @@ var list3 = defineCommand14({
     }
   }
 });
-var info = defineCommand14({
+var info = defineCommand15({
   meta: {
     name: "info",
     description: "Print schema + example body for an integration endpoint"
@@ -3138,7 +3897,7 @@ var info = defineCommand14({
     }
   }
 });
-var invoke = defineCommand14({
+var invoke = defineCommand15({
   meta: {
     name: "invoke",
     description: "Invoke a platform integration as the logged-in user"
@@ -3191,21 +3950,21 @@ var invoke = defineCommand14({
     }
   }
 });
-var integrations_default = defineCommand14({
+var integrations_default = defineCommand15({
   meta: {
     name: "integrations",
     description: "List, inspect, and invoke platform integrations"
   },
   subCommands: {
-    list: list3,
+    list: list4,
     info,
     invoke
   }
 });
 
 // src/cli/commands/invoke.ts
-import { defineCommand as defineCommand15 } from "citty";
-var invoke_default = defineCommand15({
+import { defineCommand as defineCommand16 } from "citty";
+var invoke_default = defineCommand16({
   meta: {
     name: "invoke",
     description: "Invoke a platform integration as the logged-in user"
@@ -3278,7 +4037,7 @@ var invoke_default = defineCommand15({
 });
 
 // src/cli/commands/managed-repos.ts
-import { defineCommand as defineCommand16 } from "citty";
+import { defineCommand as defineCommand17 } from "citty";
 var API_URL4 = process.env.DEEPSPACE_API_URL ?? ENVS.prod.api;
 var SIMPLE_APP_ID = /^[a-z0-9][a-z0-9_.:-]{0,119}$/i;
 var SIMPLE_APP_NAME = /^[a-z0-9][a-z0-9_-]{0,119}$/i;
@@ -3291,16 +4050,16 @@ async function api2(token2, path, init) {
       ...init?.headers ?? {}
     }
   });
-  const text = await res.text();
+  const text2 = await res.text();
   if (!res.ok) {
-    let msg = text;
+    let msg = text2;
     try {
-      msg = JSON.parse(text).error ?? text;
+      msg = JSON.parse(text2).error ?? text2;
     } catch {
     }
     throw new Error(`API ${path} (${res.status}): ${msg}`);
   }
-  return JSON.parse(text);
+  return JSON.parse(text2);
 }
 function defaultAppId(appName) {
   return `cli-${slugId(appName)}`;
@@ -3337,7 +4096,7 @@ async function confirm4(message) {
     });
   });
 }
-var list4 = defineCommand16({
+var list5 = defineCommand17({
   meta: {
     name: "list",
     description: "List your DeepSpace-managed repos and quota"
@@ -3367,7 +4126,7 @@ var list4 = defineCommand16({
     }
   }
 });
-var create2 = defineCommand16({
+var create2 = defineCommand17({
   meta: {
     name: "create",
     description: "Create a private DeepSpace-managed GitHub repo"
@@ -3419,7 +4178,7 @@ var create2 = defineCommand16({
     printRepo(result.repo);
   }
 });
-var token = defineCommand16({
+var token = defineCommand17({
   meta: {
     name: "token",
     description: "Mint a short-lived GitHub token for a DeepSpace-managed repo"
@@ -3454,7 +4213,7 @@ var token = defineCommand16({
     console.log(`Clone:     git clone https://x-access-token:${encodeURIComponent(result.token.token)}@github.com/${result.repo.fullName}.git`);
   }
 });
-var remove = defineCommand16({
+var remove = defineCommand17({
   meta: {
     name: "delete",
     description: "Delete a DeepSpace-managed GitHub repo"
@@ -3507,13 +4266,13 @@ var remove = defineCommand16({
     );
   }
 });
-var managed_repos_default = defineCommand16({
+var managed_repos_default = defineCommand17({
   meta: {
     name: "managed-repos",
     description: "Create and manage DeepSpace-owned GitHub repos"
   },
   subCommands: {
-    list: list4,
+    list: list5,
     create: create2,
     token,
     delete: remove
@@ -3521,13 +4280,13 @@ var managed_repos_default = defineCommand16({
 });
 
 // src/cli/commands/library.ts
-import { defineCommand as defineCommand17 } from "citty";
-import { existsSync as existsSync11, readFileSync as readFileSync10 } from "fs";
-import { join as join12, resolve as resolve8 } from "path";
+import { defineCommand as defineCommand18 } from "citty";
+import { existsSync as existsSync12, readFileSync as readFileSync11 } from "fs";
+import { join as join13, resolve as resolve8 } from "path";
 import { parse as parseToml3 } from "smol-toml";
 import * as p6 from "@clack/prompts";
 var DEFAULT_LIBRARY_APP = "deepdotspace-site";
-var publish = defineCommand17({
+var publish = defineCommand18({
   meta: {
     name: "publish",
     description: "Publish the current app to the DeepSpace library"
@@ -3586,7 +4345,7 @@ var publish = defineCommand17({
   },
   async run({ args }) {
     const json = !!args.json;
-    const intro5 = (s) => {
+    const intro6 = (s) => {
       if (!json) p6.intro(s);
     };
     const info2 = (s) => {
@@ -3597,15 +4356,15 @@ var publish = defineCommand17({
       else p6.cancel(msg);
       process.exit(1);
     };
-    intro5("Publishing to the DeepSpace library");
+    intro6("Publishing to the DeepSpace library");
     let appName = typeof args.app === "string" && args.app.trim() ? args.app.trim() : void 0;
     if (!appName) {
       const appDir = resolve8(typeof args.dir === "string" && args.dir ? args.dir : ".");
-      const wranglerPath = join12(appDir, "wrangler.toml");
-      if (!existsSync11(wranglerPath)) {
+      const wranglerPath = join13(appDir, "wrangler.toml");
+      if (!existsSync12(wranglerPath)) {
         return die("No --app provided and no wrangler.toml found. Either pass --app <name> or run from your app's directory.");
       }
-      const cfg = parseToml3(readFileSync10(wranglerPath, "utf-8"));
+      const cfg = parseToml3(readFileSync11(wranglerPath, "utf-8"));
       const nameRes = resolveAppName(cfg.name);
       if (!nameRes.ok) return die(`wrangler.toml: ${nameRes.reason}`);
       appName = nameRes.name;
@@ -3666,7 +4425,7 @@ var publish = defineCommand17({
     p6.outro("Done");
   }
 });
-var unpublish = defineCommand17({
+var unpublish = defineCommand18({
   meta: {
     name: "unpublish",
     description: "Remove a library entry (owner or admin only)"
@@ -3725,7 +4484,7 @@ var unpublish = defineCommand17({
     p6.outro("Done");
   }
 });
-var library_default = defineCommand17({
+var library_default = defineCommand18({
   meta: {
     name: "library",
     description: "Manage your DeepSpace library entries"
@@ -3737,12 +4496,12 @@ var library_default = defineCommand17({
 });
 
 // src/cli/commands/admin.ts
-import { defineCommand as defineCommand18 } from "citty";
-import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync6 } from "fs";
+import { defineCommand as defineCommand19 } from "citty";
+import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync7 } from "fs";
 import { homedir as homedir6 } from "os";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 var AUTH_URL5 = process.env.DEEPSPACE_AUTH_URL ?? ENVS.prod.auth;
-var impersonate = defineCommand18({
+var impersonate = defineCommand19({
   meta: {
     name: "impersonate",
     description: "Store a short-lived CLI token for another user"
@@ -3790,15 +4549,15 @@ var impersonate = defineCommand18({
       console.error(`Failed: ${data.error ?? `HTTP ${res.status}`}`);
       process.exit(1);
     }
-    const dir = join13(homedir6(), ".deepspace");
+    const dir = join14(homedir6(), ".deepspace");
     mkdirSync6(dir, { recursive: true });
-    writeFileSync6(TOKEN_PATH2, data.token, { mode: 384 });
+    writeFileSync7(TOKEN_PATH2, data.token, { mode: 384 });
     console.log(`Impersonating ${data.user.name ?? data.user.email ?? data.user.id}`);
     console.log(`Email:  ${data.user.email ?? "(none)"}`);
     console.log(`UserID: ${data.user.id}`);
   }
 });
-var admin_default = defineCommand18({
+var admin_default = defineCommand19({
   meta: {
     name: "admin",
     description: "Maintainer-only admin commands"
@@ -3808,13 +4567,276 @@ var admin_default = defineCommand18({
   }
 });
 
+// src/cli/commands/feedback.ts
+import { defineCommand as defineCommand20 } from "citty";
+import * as p7 from "@clack/prompts";
+import { existsSync as existsSync13, readFileSync as readFileSync12 } from "fs";
+import { dirname as dirname3, join as join15 } from "path";
+import { fileURLToPath } from "url";
+import { release } from "os";
+var API_URL5 = process.env.DEEPSPACE_API_URL ?? ENVS.prod.api;
+var TYPES = ["bug", "feature", "other"];
+var TYPE_LABELS = {
+  bug: "Bug report",
+  feature: "Feature request",
+  other: "Other feedback"
+};
+var MAX_TITLE_LEN = 200;
+var MAX_BODY_LEN = 1e4;
+var MAX_CONTEXT_LEN = 200;
+async function api3(token2, path, init) {
+  const res = await fetch(`${API_URL5}${path}`, {
+    ...init,
+    headers: {
+      Authorization: `Bearer ${token2}`,
+      "Content-Type": "application/json",
+      ...init?.headers ?? {}
+    }
+  });
+  const text2 = await res.text();
+  if (!res.ok) {
+    let msg = text2;
+    try {
+      msg = JSON.parse(text2).error ?? text2;
+    } catch {
+    }
+    throw new Error(`API ${path} (${res.status}): ${msg}`);
+  }
+  return JSON.parse(text2);
+}
+function normalizeType(raw) {
+  const value = (raw ?? "bug").toLowerCase();
+  if (TYPES.includes(value)) return value;
+  throw new Error(`Invalid --type "${raw}". Use one of: ${TYPES.join(", ")}.`);
+}
+function readCliVersion() {
+  try {
+    const here = dirname3(fileURLToPath(import.meta.url));
+    const candidates = [
+      join15(here, "..", "package.json"),
+      join15(here, "..", "..", "..", "package.json")
+    ];
+    for (const path of candidates) {
+      if (!existsSync13(path)) continue;
+      const pkg2 = JSON.parse(readFileSync12(path, "utf-8"));
+      if (pkg2.name === "deepspace" && pkg2.version) return pkg2.version;
+    }
+  } catch {
+  }
+  return "unknown";
+}
+function detectAppName2() {
+  try {
+    const cwd = process.cwd();
+    if (!hasWranglerConfig(cwd)) return void 0;
+    const config = readWranglerConfig(cwd);
+    return typeof config.name === "string" ? config.name : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function clampContext(value) {
+  return value.length > MAX_CONTEXT_LEN ? value.slice(0, MAX_CONTEXT_LEN) : value;
+}
+function collectContext() {
+  const appName = detectAppName2();
+  return {
+    cliVersion: clampContext(readCliVersion()),
+    nodeVersion: clampContext(process.version),
+    platform: clampContext(`${process.platform} ${release()}`),
+    ...appName ? { appName: clampContext(appName) } : {}
+  };
+}
+function buildFeedbackPayload(input) {
+  const title = input.title.trim();
+  const body = input.body.trim();
+  if (!title) throw new Error("A title is required.");
+  if (!body) throw new Error("A message/description is required.");
+  if (title.length > MAX_TITLE_LEN) {
+    throw new Error(
+      `Title must be ${MAX_TITLE_LEN} characters or fewer (got ${title.length}).`
+    );
+  }
+  if (body.length > MAX_BODY_LEN) {
+    throw new Error(
+      `Description must be ${MAX_BODY_LEN} characters or fewer (got ${body.length}).`
+    );
+  }
+  return {
+    type: normalizeType(input.type),
+    title,
+    body,
+    ...input.context
+  };
+}
+var feedback_default = defineCommand20({
+  meta: {
+    name: "feedback",
+    description: "Submit a bug report, feature request, or feedback to DeepSpace"
+  },
+  args: {
+    title: {
+      type: "positional",
+      description: "Short summary (prompted if omitted in a terminal)",
+      required: false
+    },
+    type: {
+      type: "string",
+      alias: "t",
+      description: `Report type: ${TYPES.join(" | ")} (default: bug)`,
+      required: false
+    },
+    message: {
+      type: "string",
+      alias: "m",
+      description: "Details / description (prompted if omitted in a terminal)",
+      required: false
+    },
+    yes: {
+      type: "boolean",
+      description: "Skip the confirmation prompt",
+      default: false
+    },
+    json: {
+      type: "boolean",
+      description: "Emit JSON instead of human output",
+      default: false
+    }
+  },
+  async run({ args }) {
+    const interactive = process.stdin.isTTY && !args.json;
+    const fail = (message) => {
+      if (args.json) {
+        process.stdout.write(JSON.stringify({ ok: false, error: message }) + "\n");
+      } else {
+        console.error(message);
+      }
+      process.exit(1);
+    };
+    let type;
+    try {
+      type = normalizeType(args.type ? String(args.type) : void 0);
+    } catch (err) {
+      return fail(err.message);
+    }
+    let title = args.title ? String(args.title) : "";
+    let body = args.message ? String(args.message) : "";
+    if ((!title || !body) && !interactive) {
+      return fail(
+        'Provide a title and --message to submit non-interactively, e.g. `deepspace feedback "Title" --message "Details"`.'
+      );
+    }
+    if (interactive && (!args.type || !title || !body)) {
+      p7.intro("DeepSpace Feedback");
+      if (!args.type) {
+        const picked = await p7.select({
+          message: "What kind of feedback is this?",
+          options: TYPES.map((t) => ({ value: t, label: TYPE_LABELS[t] })),
+          initialValue: type
+        });
+        if (p7.isCancel(picked)) {
+          p7.cancel("Cancelled.");
+          process.exit(0);
+        }
+        type = picked;
+      }
+      if (!title) {
+        const t = await p7.text({
+          message: "Title",
+          placeholder: "Short summary of the issue",
+          validate: (v) => {
+            if (!v?.trim()) return "Title is required";
+            if (v.length > MAX_TITLE_LEN)
+              return `Title must be ${MAX_TITLE_LEN} characters or fewer`;
+            return void 0;
+          }
+        });
+        if (p7.isCancel(t)) {
+          p7.cancel("Cancelled.");
+          process.exit(0);
+        }
+        title = String(t);
+      }
+      if (!body) {
+        const m = await p7.text({
+          message: "Details",
+          placeholder: "What happened? Steps to reproduce, what you expected\u2026",
+          validate: (v) => {
+            if (!v?.trim()) return "A description is required";
+            if (v.length > MAX_BODY_LEN)
+              return `Description must be ${MAX_BODY_LEN} characters or fewer`;
+            return void 0;
+          }
+        });
+        if (p7.isCancel(m)) {
+          p7.cancel("Cancelled.");
+          process.exit(0);
+        }
+        body = String(m);
+      }
+    }
+    let payload;
+    try {
+      payload = buildFeedbackPayload({
+        type,
+        title,
+        body,
+        context: collectContext()
+      });
+    } catch (err) {
+      return fail(err.message);
+    }
+    if (interactive && !args.yes) {
+      p7.note(
+        `${TYPE_LABELS[payload.type]}
+${payload.title}
+
+${payload.body}
+
+Context: deepspace ${payload.cliVersion} \xB7 ${payload.nodeVersion} \xB7 ${payload.platform}` + (payload.appName ? ` \xB7 app ${payload.appName}` : ""),
+        "Review"
+      );
+      const ok = await p7.confirm({ message: "Send this to the DeepSpace team?" });
+      if (p7.isCancel(ok) || !ok) {
+        p7.cancel("Not sent.");
+        process.exit(0);
+      }
+    }
+    let token2;
+    try {
+      token2 = await ensureToken();
+    } catch (err) {
+      return fail(err.message ?? "Not signed in. Run `deepspace login`.");
+    }
+    let result;
+    try {
+      result = await api3(token2, "/api/feedback", {
+        method: "POST",
+        body: JSON.stringify(payload)
+      });
+    } catch (err) {
+      return fail(err.message);
+    }
+    if (args.json) {
+      process.stdout.write(JSON.stringify({ ok: true, report: result.report }) + "\n");
+      return;
+    }
+    if (interactive) {
+      p7.outro(`Thanks! Submitted as ${result.report.id}.`);
+    } else {
+      console.log(`Submitted feedback ${result.report.id} (${result.report.type}).`);
+    }
+    console.log(`Track triage status at ${DASHBOARD_URL}.`);
+  }
+});
+
 // src/cli/cli.ts
-var __dirname = dirname3(fileURLToPath(import.meta.url));
-var pkg = JSON.parse(readFileSync11(join14(__dirname, "..", "package.json"), "utf-8"));
-if (process.platform === "linux" && !process.env.SSL_CERT_FILE && existsSync12("/etc/ssl/certs/ca-certificates.crt")) {
+var __dirname = dirname4(fileURLToPath2(import.meta.url));
+var pkg = JSON.parse(readFileSync13(join16(__dirname, "..", "package.json"), "utf-8"));
+if (process.platform === "linux" && !process.env.SSL_CERT_FILE && existsSync14("/etc/ssl/certs/ca-certificates.crt")) {
   process.env.SSL_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt";
 }
-var create3 = defineCommand19({
+var create3 = defineCommand21({
   meta: {
     name: "create",
     description: "Create a new DeepSpace app"
@@ -3833,7 +4855,7 @@ var create3 = defineCommand19({
     execSync5(`npm create deepspace@latest${name}`, { stdio: "inherit" });
   }
 });
-var main = defineCommand19({
+var main = defineCommand21({
   meta: {
     name: "deepspace",
     version: pkg.version,
@@ -3858,7 +4880,9 @@ var main = defineCommand19({
     undeploy: undeploy_default,
     domain: domain_default,
     library: library_default,
-    admin: admin_default
+    admin: admin_default,
+    feedback: feedback_default,
+    secrets: secrets_default
   }
   // No `run()` here — citty cascades parent run() AFTER subcommand finishes,
   // which corrupts agent-friendly output (`--json`) and prints noise on every