deepspace 0.4.4 → 0.4.5

package/dist/cli.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 
 // src/cli/cli.ts
-import { defineCommand as defineCommand21, runMain } from "citty";
+import { defineCommand as defineCommand18, runMain } from "citty";
 import { execSync as execSync5 } from "child_process";
-import { readFileSync as readFileSync13, existsSync as existsSync14 } from "fs";
-import { dirname as dirname4, join as join16 } from "path";
+import { readFileSync as readFileSync12, existsSync as existsSync13 } from "fs";
+import { dirname as dirname4, join as join14 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/cli/commands/login.ts
@@ -122,6 +122,9 @@ function resolveAppNameForEnv(config, envName) {
   }
   return resolveAppName(envBlock.name);
 }
+function devVarsPathFor(appDir, envName) {
+  return envName ? join(appDir, `.dev.vars.${envName}`) : join(appDir, ".dev.vars");
+}
 var WranglerConfigError = class extends Error {
   constructor(path, cause) {
     const detail = cause instanceof Error ? cause.message : String(cause);
@@ -232,22 +235,8 @@ var SDK_MANAGED_KEYS = /* @__PURE__ */ new Set([
   "OWNER_USER_ID",
   "APP_OWNER_JWT",
   "APP_IDENTITY_TOKEN",
-  "APP_SECRETS_KEY",
-  "APP_SECRETS_LOCAL_FALLBACK",
   "ALLOW_DEBUG_ROUTES"
 ]);
-var MANAGED_ENV_HEADER = "# Managed by `deepspace secrets` and regenerated by `deepspace dev`/`deepspace test`.";
-var MANAGED_ENV_SYNCED_HEADER = "# DeepSpace synced secrets - mirrored with the deployed app secrets store.";
-var MANAGED_ENV_DEV_ONLY_HEADER = "# DeepSpace dev-only secrets - used by `deepspace dev`; never synced unless pushed.";
-function localEnvPath(appDir) {
-  return join2(appDir, ".env");
-}
-function legacyDevVarsPath(appDir, wranglerEnv) {
-  return join2(appDir, wranglerEnv ? `.dev.vars.${wranglerEnv}` : ".dev.vars");
-}
-function hasLegacyDevVars(appDir, wranglerEnv) {
-  return existsSync2(legacyDevVarsPath(appDir, wranglerEnv));
-}
 var DEV_VARS_DIVIDER = "# --- not managed by the SDK; preserved across dev/test runs ---";
 function extractCustomDevVars(content) {
   const lines = content.split("\n");
@@ -354,189 +343,6 @@ function parseDevVars(content) {
   }
   return result;
 }
-function parseDevVarsStrict(content, file = ".env") {
-  const result = {};
-  const lines = content.split("\n");
-  let i = 0;
-  while (i < lines.length) {
-    const line = lines[i];
-    const trimmed = line.trim();
-    if (!trimmed || trimmed.startsWith("#")) {
-      i++;
-      continue;
-    }
-    const eq = line.indexOf("=");
-    if (eq < 0) {
-      throw new Error(`${file}: invalid dotenv syntax on line ${i + 1}. Expected KEY=value.`);
-    }
-    const keyMatch = line.slice(0, eq).match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*$/);
-    if (!keyMatch) {
-      throw new Error(`${file}: invalid variable name on line ${i + 1}.`);
-    }
-    const key = keyMatch[1];
-    let value = line.slice(eq + 1);
-    let closed = !value.startsWith('"') || hasUnescapedQuote(value.slice(1));
-    if (!closed) {
-      i++;
-      while (i < lines.length) {
-        value += "\n" + lines[i];
-        if (hasUnescapedQuote(lines[i])) {
-          closed = true;
-          i++;
-          break;
-        }
-        i++;
-      }
-    } else {
-      i++;
-    }
-    if (value.startsWith('"') && !closed) {
-      throw new Error(`${file}: unterminated quoted value for key "${key}".`);
-    }
-    if (value.startsWith('"') && value.endsWith('"') && value.length >= 2) {
-      value = value.slice(1, -1).replace(/\\"/g, '"').replace(/\\\\/g, "\\");
-    }
-    result[key] = value;
-  }
-  return result;
-}
-function quoteEnvValue(value) {
-  return /^[A-Za-z0-9_./:@-]*$/.test(value) && !value.includes("\n") ? value : `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
-}
-function stripSdkManaged(vars) {
-  const out = {};
-  for (const [name, value] of Object.entries(vars)) {
-    if (!SDK_MANAGED_KEYS.has(name)) out[name] = value;
-  }
-  return out;
-}
-function sortRecord(input) {
-  const out = {};
-  for (const key of Object.keys(input).sort()) out[key] = input[key];
-  return out;
-}
-function readManagedEnvSections(appDir) {
-  const path = localEnvPath(appDir);
-  if (!existsSync2(path)) return { sdk: {}, synced: {}, devOnly: {} };
-  return parseManagedEnvSections(readFileSync2(path, "utf-8"));
-}
-function parseManagedEnvSections(content) {
-  const sections = { sdk: {}, synced: {}, devOnly: {} };
-  const legacyAppLines = [];
-  let target = "sdk";
-  const lines = content.split("\n");
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i];
-    if (line.trim() === MANAGED_ENV_SYNCED_HEADER.trim()) {
-      target = "synced";
-      continue;
-    }
-    if (line.trim() === MANAGED_ENV_DEV_ONLY_HEADER.trim()) {
-      target = "devOnly";
-      continue;
-    }
-    if (line.trim().startsWith("#")) continue;
-    const name = assignmentName(line);
-    if (!name) {
-      if (line.trim()) legacyAppLines.push(line);
-      continue;
-    }
-    const block = [line];
-    const eq = line.indexOf("=");
-    const valStart = eq >= 0 ? line.slice(eq + 1) : "";
-    if (valStart.startsWith('"') && !hasUnescapedQuote(valStart.slice(1))) {
-      i++;
-      while (i < lines.length) {
-        block.push(lines[i]);
-        const closed = hasUnescapedQuote(lines[i]);
-        if (closed) break;
-        i++;
-      }
-    }
-    if (target === "sdk" && !SDK_MANAGED_KEYS.has(name)) {
-      legacyAppLines.push(...block);
-      continue;
-    }
-    const parsed = parseDevVarsStrict(block.join("\n"), ".env");
-    Object.assign(sections[target], parsed);
-  }
-  if (legacyAppLines.length) {
-    Object.assign(sections.synced, stripSdkManaged(parseDevVarsStrict(legacyAppLines.join("\n"), ".env")));
-  }
-  return sections;
-}
-function assignmentName(line) {
-  const eq = line.indexOf("=");
-  if (eq < 0) return null;
-  const match = line.slice(0, eq).match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*$/);
-  return match?.[1] ?? null;
-}
-function readManagedAppEnv(appDir) {
-  const sections = readManagedEnvSections(appDir);
-  return { ...sections.synced, ...sections.devOnly };
-}
-function readManagedSyncedEnv(appDir) {
-  return { ...readManagedEnvSections(appDir).synced };
-}
-function readManagedDevOnlyEnv(appDir) {
-  return { ...readManagedEnvSections(appDir).devOnly };
-}
-function writeManagedEnvSections(appDir, sections) {
-  ensureLocalEnvIgnored(appDir);
-  const lines = [
-    MANAGED_ENV_HEADER,
-    "# Do not commit this file. Edit secrets with `deepspace secrets`, not by hand."
-  ];
-  for (const [name, value] of Object.entries(sortRecord(sections.sdk))) {
-    lines.push(`${name}=${quoteEnvValue(value)}`);
-  }
-  lines.push("", MANAGED_ENV_SYNCED_HEADER);
-  for (const [name, value] of Object.entries(sortRecord(sections.synced))) {
-    lines.push(`${name}=${quoteEnvValue(value)}`);
-  }
-  lines.push("", MANAGED_ENV_DEV_ONLY_HEADER);
-  for (const [name, value] of Object.entries(sortRecord(sections.devOnly))) {
-    lines.push(`${name}=${quoteEnvValue(value)}`);
-  }
-  writeFileSync(localEnvPath(appDir), lines.join("\n") + "\n", { mode: 384 });
-}
-function ensureLocalEnvIgnored(appDir) {
-  const path = join2(appDir, ".gitignore");
-  const existing = existsSync2(path) ? readFileSync2(path, "utf-8") : "";
-  const lines = new Set(existing.split("\n").map((line) => line.trim()));
-  const additions = [".env", ".dev.vars"].filter((entry) => !lines.has(entry));
-  if (!additions.length) return;
-  const prefix = existing && !existing.endsWith("\n") ? existing + "\n" : existing;
-  writeFileSync(path, `${prefix}${additions.join("\n")}
-`);
-}
-function patchManagedSyncedEnv(appDir, set2 = {}, removeNames = []) {
-  const sections = readManagedEnvSections(appDir);
-  for (const [name, value] of Object.entries(set2)) sections.synced[name] = value;
-  for (const name of removeNames) delete sections.synced[name];
-  writeManagedEnvSections(appDir, sections);
-}
-function patchManagedDevOnlyEnv(appDir, set2 = {}, removeNames = []) {
-  const sections = readManagedEnvSections(appDir);
-  for (const [name, value] of Object.entries(set2)) sections.devOnly[name] = value;
-  for (const name of removeNames) delete sections.devOnly[name];
-  writeManagedEnvSections(appDir, sections);
-}
-function replaceManagedSyncedEnv(appDir, syncedVars) {
-  const sections = readManagedEnvSections(appDir);
-  sections.synced = stripSdkManaged(syncedVars);
-  writeManagedEnvSections(appDir, sections);
-}
-function moveManagedDevOnlyToSynced(appDir, names) {
-  const sections = readManagedEnvSections(appDir);
-  for (const name of names) {
-    if (name in sections.devOnly) {
-      sections.synced[name] = sections.devOnly[name];
-      delete sections.devOnly[name];
-    }
-  }
-  writeManagedEnvSections(appDir, sections);
-}
 async function writeDevVars(appDir, env, ownerId, callerJwt, wranglerEnv) {
   const urls = ENVS[env];
   const publicKey = await fetchPublicKey(urls.auth);
@@ -552,18 +358,11 @@ async function writeDevVars(appDir, env, ownerId, callerJwt, wranglerEnv) {
     `OWNER_USER_ID=${ownerId}`,
     `APP_OWNER_JWT=${appOwnerJwt}`,
     ...appIdentityToken ? [`APP_IDENTITY_TOKEN=${appIdentityToken}`] : [],
-    `APP_SECRETS_LOCAL_FALLBACK=true`,
     // Open /api/debug/* (proxied to RecordRoom) for dev + tests only.
     // Production secrets never set this, so deployed apps 404 the route.
     `ALLOW_DEBUG_ROUTES=true`
   ].join("\n");
-  const sdkEnv = parseDevVarsStrict(sdkVars, "SDK env");
-  if (!hasLegacyDevVars(appDir, wranglerEnv)) {
-    const sections = readManagedEnvSections(appDir);
-    writeManagedEnvSections(appDir, { ...sections, sdk: sdkEnv });
-    return;
-  }
-  const devVarsPath = legacyDevVarsPath(appDir, wranglerEnv);
+  const devVarsPath = join2(appDir, wranglerEnv ? `.dev.vars.${wranglerEnv}` : ".dev.vars");
   const existing = existsSync2(devVarsPath) ? readFileSync2(devVarsPath, "utf-8") : "";
   const custom = extractCustomDevVars(existing);
   const body = custom ? `${sdkVars}
@@ -772,7 +571,7 @@ var logout_default = defineCommand2({
 });
 
 // src/cli/commands/dev.ts
-import { defineCommand as defineCommand4 } from "citty";
+import { defineCommand as defineCommand3 } from "citty";
 import { resolve as resolve3, basename } from "path";
 import spawn from "cross-spawn";
 
@@ -782,8 +581,8 @@ import { join as join5 } from "path";
 import { homedir as homedir3 } from "os";
 
 // src/cli/jwt.ts
-function decodeJwtPayload(token2) {
-  const payloadSegment = token2.split(".")[1];
+function decodeJwtPayload(token) {
+  const payloadSegment = token.split(".")[1];
   if (!payloadSegment) {
     throw new Error("JWT payload is missing");
   }
@@ -806,13 +605,13 @@ async function ensureToken() {
     throw new Error("Not logged in. Run `deepspace login` first.");
   }
   const sessionToken = readFileSync4(SESSION_PATH2, "utf-8").trim();
-  const token2 = await exchangeSession(AUTH_URL3, sessionToken);
-  if (!token2) {
+  const token = await exchangeSession(AUTH_URL3, sessionToken);
+  if (!token) {
     throw new Error("Session expired. Run `deepspace login` to re-authenticate.");
   }
   mkdirSync2(DIR2, { recursive: true, mode: 448 });
-  writeFileSync3(TOKEN_PATH2, token2, { mode: 384 });
-  return token2;
+  writeFileSync3(TOKEN_PATH2, token, { mode: 384 });
+  return token;
 }
 function isTokenValid(jwt) {
   try {
@@ -947,525 +746,9 @@ function preflightWindowsWorkerd(appDir) {
   }
 }
 
-// src/cli/commands/secrets.ts
-import { existsSync as existsSync8, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "fs";
-import { join as join8 } from "path";
-import { defineCommand as defineCommand3 } from "citty";
-var SECRET_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
-var ERROR_SNIPPET_CHARS = 500;
-var COLLABORATOR_ROUTES_404 = "Platform API does not expose app-collaborator routes; deploy/update api-worker before using collaborator commands.";
-var COLLABORATOR_SCHEMA_NOT_MIGRATED = "Platform API is missing app-collaborator database tables. Run api-worker /_migrate with x-migration-secret, then retry collaborator commands.";
-function parseAssignment(value) {
-  const eq = value.indexOf("=");
-  if (eq <= 0) throw new Error("Use KEY=value.");
-  const name = value.slice(0, eq);
-  if (!SECRET_NAME_RE.test(name)) throw new Error(`Invalid secret name "${name}".`);
-  if (SDK_MANAGED_KEYS.has(name)) throw new Error(`${name} is managed by DeepSpace and cannot be set as an app secret.`);
-  return [name, value.slice(eq + 1)];
-}
-function devTargetPath() {
-  return join8(process.cwd(), ".dev.vars");
-}
-function readDevTarget() {
-  if (!hasLegacyDevVars(process.cwd())) {
-    return readManagedAppEnv(process.cwd());
-  }
-  const path = devTargetPath();
-  if (!existsSync8(path)) return {};
-  return stripSdkManaged(parseDevVars(splitDevTarget(readFileSync7(path, "utf-8")).custom));
-}
-function readSyncedTarget() {
-  if (hasLegacyDevVars(process.cwd())) return readDevTarget();
-  return readManagedSyncedEnv(process.cwd());
-}
-function readDevOnlyTarget() {
-  if (hasLegacyDevVars(process.cwd())) return readDevTarget();
-  return readManagedDevOnlyEnv(process.cwd());
-}
-function writeLocalPatch(set2 = {}, removeNames = []) {
-  for (const name of [...Object.keys(set2), ...removeNames]) {
-    if (SDK_MANAGED_KEYS.has(name)) {
-      throw new Error(`${name} is managed by DeepSpace and cannot be set as an app secret.`);
-    }
-  }
-  if (hasLegacyDevVars(process.cwd())) writeDevTargetPatch(set2, removeNames);
-  else {
-    patchManagedDevOnlyEnv(process.cwd(), set2, removeNames);
-  }
-}
-function quote(value) {
-  return quoteEnvValue(value);
-}
-function splitLocal(raw) {
-  const idx = raw.indexOf(DEV_VARS_DIVIDER);
-  if (idx < 0) return { top: "", custom: raw };
-  const after = raw.slice(idx + DEV_VARS_DIVIDER.length);
-  return {
-    top: raw.slice(0, idx).trimEnd(),
-    custom: after.startsWith("\n") ? after.slice(1) : after
-  };
-}
-function splitDevTarget(raw) {
-  const idx = raw.indexOf(DEV_VARS_DIVIDER);
-  if (idx >= 0) return splitLocal(raw);
-  const lines = raw.split("\n");
-  const top = [];
-  const custom = [];
-  let target = top;
-  let i = 0;
-  while (i < lines.length) {
-    const line = lines[i];
-    const name = assignmentName2(line);
-    const eq = line.indexOf("=");
-    const valStart = eq >= 0 ? line.slice(eq + 1) : "";
-    const block = [line];
-    i++;
-    if (name && valStart.startsWith('"') && !hasUnescapedQuote2(valStart.slice(1))) {
-      while (i < lines.length) {
-        block.push(lines[i]);
-        const closed = hasUnescapedQuote2(lines[i]);
-        i++;
-        if (closed) break;
-      }
-    }
-    if (name && !SDK_MANAGED_KEYS.has(name)) target = custom;
-    target.push(...block);
-  }
-  while (top.length && top[top.length - 1] === "") top.pop();
-  while (custom.length && custom[custom.length - 1] === "") custom.pop();
-  return { top: top.join("\n"), custom: custom.join("\n") };
-}
-function assignmentName2(line) {
-  const eq = line.indexOf("=");
-  if (eq < 0) return null;
-  const match = line.slice(0, eq).match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*$/);
-  return match?.[1] ?? null;
-}
-function hasUnescapedQuote2(s) {
-  let escaped = false;
-  for (const ch of s) {
-    if (escaped) {
-      escaped = false;
-      continue;
-    }
-    if (ch === "\\") {
-      escaped = true;
-      continue;
-    }
-    if (ch === '"') return true;
-  }
-  return false;
-}
-function rewriteCustomSection(custom, set2, remove2) {
-  const lines = custom.split("\n");
-  const out = [];
-  const pending = new Set(Object.keys(set2));
-  let i = 0;
-  while (i < lines.length) {
-    const line = lines[i];
-    const name = assignmentName2(line);
-    const eq = line.indexOf("=");
-    const valStart = eq >= 0 ? line.slice(eq + 1) : "";
-    const block = [line];
-    i++;
-    if (name && valStart.startsWith('"') && !hasUnescapedQuote2(valStart.slice(1))) {
-      while (i < lines.length) {
-        block.push(lines[i]);
-        const closed = hasUnescapedQuote2(lines[i]);
-        i++;
-        if (closed) break;
-      }
-    }
-    if (name && (remove2.has(name) || pending.has(name))) {
-      if (pending.has(name)) {
-        out.push(`${name}=${quote(set2[name])}`);
-        pending.delete(name);
-      }
-      continue;
-    }
-    out.push(...block);
-  }
-  while (out.length && out[out.length - 1] === "") out.pop();
-  for (const name of Array.from(pending).sort()) {
-    out.push(`${name}=${quote(set2[name])}`);
-  }
-  return out.join("\n");
-}
-function writeDevTargetPatch(set2 = {}, removeNames = []) {
-  const path = devTargetPath();
-  const existing = existsSync8(path) ? readFileSync7(path, "utf-8") : "";
-  const { top, custom: existingCustom } = splitDevTarget(existing);
-  const custom = rewriteCustomSection(existingCustom, set2, new Set(removeNames));
-  const body = top ? `${top}
-
-${DEV_VARS_DIVIDER}
-${custom}${custom ? "\n" : ""}` : `${DEV_VARS_DIVIDER}
-${custom}${custom ? "\n" : ""}`;
-  writeFileSync5(path, body);
-}
-async function remoteDeployState(appName, token2) {
-  const res = await fetch(`${process.env.DEEPSPACE_DEPLOY_URL ?? "https://deploy-worker.deep.space"}/api/deploy/${encodeURIComponent(appName)}`, {
-    headers: { Authorization: `Bearer ${token2}` }
-  });
-  const text2 = await res.text().catch(() => "");
-  let body = {};
-  if (text2) {
-    try {
-      body = JSON.parse(text2);
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      throw new Error(`Could not determine deploy status for ${appName}: invalid JSON response (${message}).`);
-    }
-  }
-  if (!res.ok) {
-    const detail = body.error ?? (text2 || "unknown error");
-    throw new Error(`Could not determine deploy status for ${appName} (${res.status}): ${detail}`);
-  }
-  if (body.deployed === true) return "deployed";
-  if (body.deployed === false) return "not-deployed";
-  throw new Error(`Could not determine deploy status for ${appName}: response missing "deployed".`);
-}
-async function remoteAvailable(appName, token2) {
-  return await remoteDeployState(appName, token2) === "deployed";
-}
-async function mintScopedSecretsToken(appName, token2) {
-  const body = await collaboratorFetch(appName, token2, "/secrets-token", { method: "POST" });
-  if (!body.token) throw new Error("Platform API did not return an app-secret access token.");
-  return body.token;
-}
-async function remoteFetch(appName, token2, path = "", init = {}) {
-  const scopedToken = await mintScopedSecretsToken(appName, token2);
-  const res = await fetch(`https://${appName}.app.space/_deepspace/secrets${path}`, {
-    ...init,
-    headers: {
-      "Content-Type": "application/json",
-      Authorization: `Bearer ${scopedToken}`,
-      ...init.headers ?? {}
-    }
-  });
-  const contentType = res.headers.get("content-type") ?? "unknown";
-  const text2 = await res.text().catch(() => "");
-  let body = null;
-  let parseError = null;
-  if (text2 && contentType.toLowerCase().includes("json")) {
-    try {
-      body = JSON.parse(text2);
-    } catch (err) {
-      parseError = err instanceof Error ? err.message : String(err);
-    }
-  }
-  if (!res.ok) {
-    if (body?.error) throw new Error(body.error);
-    const snippet = text2 ? ` Body: ${text2.slice(0, ERROR_SNIPPET_CHARS)}` : " Body: <empty>";
-    const parseDetail2 = parseError ? ` JSON parse failed: ${parseError}.` : "";
-    throw new Error(`Remote secrets request failed (${res.status}; content-type: ${contentType}).${parseDetail2}${snippet}`);
-  }
-  if (body) return body;
-  if (!text2) return {};
-  const parseDetail = parseError ? ` JSON parse failed: ${parseError}.` : "";
-  throw new Error(`Remote secrets response was not JSON (${res.status}; content-type: ${contentType}).${parseDetail} Body: ${text2.slice(0, ERROR_SNIPPET_CHARS)}`);
-}
-function apiUrl() {
-  return process.env.DEEPSPACE_API_URL ?? ENVS.prod.api;
-}
-async function collaboratorFetch(appName, token2, path, init = {}) {
-  const url = `${apiUrl()}/api/app-collaborators/${encodeURIComponent(appName)}${path}`;
-  const res = await fetch(url, {
-    ...init,
-    headers: {
-      "Content-Type": "application/json",
-      Authorization: `Bearer ${token2}`,
-      ...init.headers ?? {}
-    }
-  });
-  const text2 = await res.text().catch(() => "");
-  let body = {};
-  if (text2) {
-    try {
-      body = JSON.parse(text2);
-    } catch {
-      if (res.status === 404) throw new Error(COLLABORATOR_ROUTES_404);
-      if (!res.ok) throw new Error(`Collaborator request failed (${res.status}): ${text2.slice(0, ERROR_SNIPPET_CHARS)}`);
-      throw new Error(`Collaborator response was not JSON (${res.status}): ${text2.slice(0, ERROR_SNIPPET_CHARS)}`);
-    }
-  }
-  if (!res.ok) {
-    if (res.status === 404 && (!body.error || body.error === "Not found" || body.error === "not_found")) {
-      throw new Error(COLLABORATOR_ROUTES_404);
-    }
-    if (body.error === "platform_schema_not_migrated") {
-      const diagnostic = body;
-      const action = typeof diagnostic.action === "string" ? ` ${diagnostic.action}` : "";
-      throw new Error(`${COLLABORATOR_SCHEMA_NOT_MIGRATED}${action}`);
-    }
-    throw new Error(body.error ?? `Collaborator request failed (${res.status})`);
-  }
-  return body;
-}
-async function requireRemoteSecretsAvailable(appName, token2) {
-  const state = await remoteDeployState(appName, token2);
-  if (state === "deployed") return;
-  throw new Error(
-    "Remote secrets are available after the first deploy. Deploy this app first, then run `deepspace secrets push`; `deepspace secrets set --dev` writes dev-only secrets for `deepspace dev` without touching remote."
-  );
-}
-function diffMaps(local, remote) {
-  const localOnly = [];
-  const remoteOnly = [];
-  const changed = [];
-  const matching = [];
-  for (const [name, value] of Object.entries(local)) {
-    if (!(name in remote)) localOnly.push(name);
-    else if (remote[name] !== value) changed.push(name);
-    else matching.push(name);
-  }
-  for (const name of Object.keys(remote)) {
-    if (!(name in local)) remoteOnly.push(name);
-  }
-  return { localOnly, remoteOnly, changed, matching };
-}
-function diffNames(local, remote) {
-  const localSet = new Set(local);
-  const remoteSet = new Set(remote);
-  return {
-    localOnly: local.filter((name) => !remoteSet.has(name)).sort(),
-    remoteOnly: remote.filter((name) => !localSet.has(name)).sort()
-  };
-}
-function statusLine(d, remote) {
-  if (!remote) return "Secrets: remote unavailable until first deploy; dev-only .env section updated.";
-  if (!d || !d.localOnly.length && !d.remoteOnly.length && !d.changed.length) {
-    return "Secrets: synced .env section matches remote.";
-  }
-  return `Secrets: ${d.localOnly.length} local-only, ${d.remoteOnly.length} remote-only, ${d.changed.length} changed. Run \`deepspace secrets diff\`.`;
-}
-function nameStatusLine(d) {
-  if (!d.localOnly.length && !d.remoteOnly.length) {
-    return "Secrets: synced .env section has the same names as remote.";
-  }
-  return `Secrets: ${d.localOnly.length} local-only, ${d.remoteOnly.length} remote-only. Run \`deepspace secrets diff\` to compare values.`;
-}
-async function compare(appName, token2) {
-  if (!await remoteAvailable(appName, token2)) return null;
-  const local = readSyncedTarget();
-  const remote = await remoteFetch(appName, token2, "/pull");
-  return diffMaps(local, remote.secrets ?? {});
-}
-var set = defineCommand3({
-  meta: { name: "set", description: "Set an app secret" },
-  args: {
-    assignment: { type: "positional", required: true, description: "KEY=value" },
-    dev: {
-      type: "boolean",
-      default: false,
-      description: "Write only to the dev-only .env section used by `deepspace dev`; never sync to the deployed app"
-    }
-  },
-  async run({ args }) {
-    const [name, value] = parseAssignment(String(args.assignment));
-    const token2 = await ensureToken();
-    const appName = requireAppName(void 0);
-    if (args.dev) {
-      writeLocalPatch({ [name]: value });
-      console.log("Secrets: updated dev-only .env section for `deepspace dev`; remote was not changed.");
-      return;
-    }
-    const state = await remoteDeployState(appName, token2);
-    if (state === "not-deployed") {
-      writeLocalPatch({ [name]: value });
-      console.log("Secrets: app is not deployed; wrote to dev-only .env section. Run `deepspace secrets push` after deploy.");
-      return;
-    }
-    await remoteFetch(appName, token2, "", { method: "PATCH", body: JSON.stringify({ set: { [name]: value } }) });
-    if (hasLegacyDevVars(process.cwd())) writeDevTargetPatch({ [name]: value });
-    else patchManagedSyncedEnv(process.cwd(), { [name]: value });
-    console.log("Secrets: updated remote and synced .env section.");
-  }
-});
-var unset = defineCommand3({
-  meta: { name: "unset", description: "Remove an app secret" },
-  args: {
-    name: { type: "positional", required: true, description: "Secret name" },
-    dev: {
-      type: "boolean",
-      default: false,
-      description: "Remove only from the dev-only .env section used by `deepspace dev`; never sync to the deployed app"
-    }
-  },
-  async run({ args }) {
-    const name = String(args.name);
-    if (!SECRET_NAME_RE.test(name)) throw new Error(`Invalid secret name "${name}".`);
-    const token2 = await ensureToken();
-    const appName = requireAppName(void 0);
-    if (args.dev) {
-      writeLocalPatch({}, [name]);
-      console.log("Secrets: removed from dev-only .env section; remote was not changed.");
-      return;
-    }
-    const state = await remoteDeployState(appName, token2);
-    if (state === "not-deployed") {
-      writeLocalPatch({}, [name]);
-      console.log("Secrets: app is not deployed; removed from dev-only .env section if present.");
-      return;
-    }
-    await remoteFetch(appName, token2, "", { method: "PATCH", body: JSON.stringify({ delete: [name] }) });
-    if (hasLegacyDevVars(process.cwd())) writeDevTargetPatch({}, [name]);
-    else patchManagedSyncedEnv(process.cwd(), {}, [name]);
-    console.log("Secrets: removed from remote and synced .env section.");
-  }
-});
-var list = defineCommand3({
-  meta: { name: "list", description: "List app secret names and metadata" },
-  async run() {
-    const token2 = await ensureToken();
-    const appName = requireAppName(void 0);
-    await requireRemoteSecretsAvailable(appName, token2);
-    const body = await remoteFetch(appName, token2);
-    for (const item of body.secrets ?? []) console.log(`${item.name}	version=${item.version}	updated=${item.updatedAt}`);
-    const d = diffNames(Object.keys(readSyncedTarget()), (body.secrets ?? []).map((item) => item.name));
-    console.log(nameStatusLine(d));
-  }
-});
-var pull = defineCommand3({
-  meta: { name: "pull", description: "Pull remote app secrets into the synced .env section" },
-  async run() {
-    const token2 = await ensureToken();
-    const appName = requireAppName(void 0);
-    await requireRemoteSecretsAvailable(appName, token2);
-    const body = await remoteFetch(appName, token2, "/pull");
-    const remoteSecrets = body.secrets ?? {};
-    if (hasLegacyDevVars(process.cwd())) {
-      writeDevTargetPatch(remoteSecrets);
-    } else {
-      replaceManagedSyncedEnv(process.cwd(), remoteSecrets);
-    }
-    const count = Object.keys(remoteSecrets).length;
-    console.log(`Secrets: pulled ${count} remote secret${count === 1 ? "" : "s"} into synced .env section.`);
-  }
-});
-var push = defineCommand3({
-  meta: { name: "push", description: "Push dev-only .env secrets to remote and move them to synced" },
-  async run() {
-    const token2 = await ensureToken();
-    const appName = requireAppName(void 0);
-    const local = readDevOnlyTarget();
-    await requireRemoteSecretsAvailable(appName, token2);
-    const names = Object.keys(local);
-    if (!names.length) {
-      console.log("Secrets: no dev-only .env secrets to push.");
-      return;
-    }
-    await remoteFetch(appName, token2, "", { method: "PATCH", body: JSON.stringify({ set: local }) });
-    if (hasLegacyDevVars(process.cwd())) {
-      console.log(`Secrets: pushed ${names.length} dev-only secret${names.length === 1 ? "" : "s"} to remote.`);
-    } else {
-      moveManagedDevOnlyToSynced(process.cwd(), names);
-      console.log(`Secrets: pushed ${names.length} dev-only secret${names.length === 1 ? "" : "s"} to remote and moved ${names.length === 1 ? "it" : "them"} to synced .env section.`);
-    }
-  }
-});
-var diff = defineCommand3({
-  meta: { name: "diff", description: "Compare synced .env section with remote app secrets" },
-  async run() {
-    const token2 = await ensureToken();
-    const appName = requireAppName(void 0);
-    await requireRemoteSecretsAvailable(appName, token2);
-    const d = await compare(appName, token2);
-    for (const name of d?.localOnly ?? []) console.log(`local-only	${name}`);
-    for (const name of d?.remoteOnly ?? []) console.log(`remote-only	${name}`);
-    for (const name of d?.changed ?? []) console.log(`changed	${name}`);
-    console.log(statusLine(d, true));
-  }
-});
-var collaboratorsList = defineCommand3({
-  meta: { name: "list", description: "List app secret collaborators" },
-  async run() {
-    const token2 = await ensureToken();
-    const appName = requireAppName(void 0);
-    const body = await collaboratorFetch(appName, token2, "/collaborators");
-    for (const item of body.collaborators ?? []) {
-      console.log(`${item.emailDisplay}	${item.userId}	created=${new Date(item.createdAt).toISOString()}`);
-    }
-    if (!body.collaborators?.length) console.log("No secrets collaborators.");
-  }
-});
-var collaboratorsAdd = defineCommand3({
-  meta: { name: "add", description: "Add an existing DeepSpace user as a secrets collaborator" },
-  args: {
-    email: { type: "positional", required: true, description: "Collaborator email" }
-  },
-  async run({ args }) {
-    const token2 = await ensureToken();
-    const appName = requireAppName(void 0);
-    const body = await collaboratorFetch(appName, token2, "/collaborators", {
-      method: "POST",
-      body: JSON.stringify({ email: String(args.email) })
-    });
-    console.log(`Added ${body.collaborator.emailDisplay} (${body.collaborator.userId}) as a secrets collaborator.`);
-  }
-});
-var collaboratorsRemove = defineCommand3({
-  meta: { name: "remove", description: "Remove a secrets collaborator" },
-  args: {
-    target: { type: "positional", required: true, description: "Collaborator email or user id" }
-  },
-  async run({ args }) {
-    const token2 = await ensureToken();
-    const appName = requireAppName(void 0);
-    const target = String(args.target);
-    let userId = target;
-    if (target.includes("@")) {
-      const body = await collaboratorFetch(appName, token2, "/collaborators");
-      const normalized = target.trim().toLowerCase();
-      const match = body.collaborators.find((item) => item.emailNormalized === normalized);
-      if (!match) throw new Error(`No collaborator found for ${target}.`);
-      userId = match.userId;
-    }
-    await collaboratorFetch(appName, token2, `/collaborators/${encodeURIComponent(userId)}`, { method: "DELETE" });
-    console.log(`Removed secrets collaborator ${target}.`);
-  }
-});
-var invitesList = defineCommand3({
-  meta: { name: "list", description: "List app secret collaborator invites" },
-  async run() {
-    const token2 = await ensureToken();
-    const appName = requireAppName(void 0);
-    const body = await collaboratorFetch(appName, token2, "/invites");
-    for (const invite of body.invites ?? []) {
-      const status2 = invite.revokedAt ? "revoked" : invite.acceptedAt ? "accepted" : new Date(invite.expiresAt).getTime() <= Date.now() ? "expired" : "pending";
-      console.log(`${invite.id}	${invite.emailDisplay}	status=${status2}	expires=${new Date(invite.expiresAt).toISOString()}`);
-    }
-    if (!body.invites?.length) console.log("No secrets collaborator invites.");
-  }
-});
-var invitesRevoke = defineCommand3({
-  meta: { name: "revoke", description: "Revoke a pending app secret collaborator invite" },
-  args: {
-    inviteId: { type: "positional", required: true, description: "Invite id" }
-  },
-  async run({ args }) {
-    const token2 = await ensureToken();
-    const appName = requireAppName(void 0);
-    await collaboratorFetch(appName, token2, `/invites/${encodeURIComponent(String(args.inviteId))}`, { method: "DELETE" });
-    console.log(`Revoked secrets collaborator invite ${String(args.inviteId)}.`);
-  }
-});
-var invites = defineCommand3({
-  meta: { name: "invites", description: "Manage app secret collaborator invites" },
-  subCommands: { list: invitesList, revoke: invitesRevoke }
-});
-var collaborators = defineCommand3({
-  meta: { name: "collaborators", description: "Manage app secret collaborators" },
-  subCommands: { list: collaboratorsList, add: collaboratorsAdd, remove: collaboratorsRemove, invites }
-});
-var secrets_default = defineCommand3({
-  meta: { name: "secrets", description: "Manage app-owned DeepSpace secrets" },
-  subCommands: { set, unset, list, pull, push, diff, collaborators }
-});
-
 // src/cli/commands/dev.ts
 var DEFAULT_PORT = 5173;
-var dev_default = defineCommand4({
+var dev_default = defineCommand3({
   meta: {
     name: "dev",
     description: "Start local development server"
@@ -1483,18 +766,13 @@ var dev_default = defineCommand4({
     },
     env: {
       type: "string",
-      description: "wrangler.toml [env.<name>] block to run (e.g. --env staging). Legacy apps read .dev.vars.<name>; new apps use managed .env.",
+      description: "wrangler.toml [env.<name>] block to run (e.g. --env staging). Reads .dev.vars.<name> and applies the env's overrides at build time.",
       required: false
     },
     port: {
       type: "string",
       description: `Port to bind (default ${DEFAULT_PORT}, or $DEEPSPACE_PORT)`,
       required: false
-    },
-    "no-pull-env": {
-      type: "boolean",
-      description: "Skip pulling remote app secrets into the synced .env section on startup",
-      default: false
     }
   },
   async run({ args }) {
@@ -1516,40 +794,25 @@ var dev_default = defineCommand4({
     }
     writeLaunchConfigIfMissing(appDir, detectAppName(appDir) ?? basename(appDir), port);
     ensureInstallReady(appDir);
-    let token2;
+    let token;
     try {
-      token2 = await ensureToken();
+      token = await ensureToken();
     } catch (err) {
       console.error(err.message);
       process.exit(1);
     }
     let payload;
     try {
-      payload = decodeJwtPayload(token2);
+      payload = decodeJwtPayload(token);
     } catch {
       console.error("Malformed session token. Run `npx deepspace login`.");
       process.exit(1);
     }
-    console.log(`Logged in as ${payload.name ?? payload.email}`);
-    console.log(`Platform: ${env}`);
-    if (wranglerEnv) console.log(`Wrangler env: ${wranglerEnv}`);
-    console.log(`Port: ${port}`);
-    await writeDevVars(appDir, env, payload.sub, token2, wranglerEnv);
-    if (env === "dev" && !args["no-pull-env"] && !hasLegacyDevVars(appDir, wranglerEnv)) {
-      const appName = resolveCurrentAppName(appDir, wranglerEnv);
-      if (appName) {
-        try {
-          if (await remoteAvailable(appName, token2)) {
-            const body = await remoteFetch(appName, token2, "/pull");
-            replaceManagedSyncedEnv(appDir, body.secrets ?? {});
-            console.log("Secrets: pulled remote app secrets into synced .env section.");
-          }
-        } catch (err) {
-          const message = err instanceof Error ? err.message : String(err);
-          console.warn(`Secrets: remote app secrets pull skipped (${message}).`);
-        }
-      }
-    }
+    console.log(`Logged in as ${payload.name ?? payload.email}`);
+    console.log(`Platform: ${env}`);
+    if (wranglerEnv) console.log(`Wrangler env: ${wranglerEnv}`);
+    console.log(`Port: ${port}`);
+    await writeDevVars(appDir, env, payload.sub, token, wranglerEnv);
     preflightWindowsWorkerd(appDir);
     console.log("Starting dev server...\n");
     const vite = spawn(
@@ -1559,10 +822,9 @@ var dev_default = defineCommand4({
         cwd: appDir,
         stdio: "inherit",
         // CLOUDFLARE_ENV is what the Cloudflare Vite plugin keys off — it
-        // applies `[env.<name>]` overrides. Legacy .dev.vars apps use
-        // `.dev.vars.<name>` instead of `.dev.vars`; new apps use managed .env.
-        // Set only when --env was passed so the default invocation behaves
-        // exactly as before.
+        // applies `[env.<name>]` overrides and loads `.dev.vars.<name>`
+        // instead of `.dev.vars`. Set only when --env was passed so the
+        // default invocation behaves exactly as before.
         env: {
           ...process.env,
           DEEPSPACE_PORT: String(port),
@@ -1585,23 +847,15 @@ function resolvePort(arg) {
   }
   return n;
 }
-function resolveCurrentAppName(appDir, wranglerEnv) {
-  try {
-    const resolved = resolveAppNameForEnv(readWranglerConfig(appDir), wranglerEnv);
-    return resolved.ok ? resolved.name : null;
-  } catch {
-    return null;
-  }
-}
 
 // src/cli/commands/kill.ts
-import { defineCommand as defineCommand5 } from "citty";
+import { defineCommand as defineCommand4 } from "citty";
 import { spawnSync } from "child_process";
 import { setTimeout as wait } from "timers/promises";
 var DEFAULT_PORT2 = 5173;
 var SIGTERM_GRACE_MS = 1500;
 var IS_WIN = process.platform === "win32";
-var kill_default = defineCommand5({
+var kill_default = defineCommand4({
   meta: {
     name: "kill",
     description: "Kill the local dev server and any orphaned workerd processes"
@@ -1756,7 +1010,7 @@ function isAlive(pid) {
 }
 
 // src/cli/commands/test.ts
-import { defineCommand as defineCommand6 } from "citty";
+import { defineCommand as defineCommand5 } from "citty";
 import { resolve as resolve4 } from "path";
 import { sync as spawnSync3 } from "cross-spawn";
 
@@ -1786,7 +1040,7 @@ function ensurePlaywright(appDir) {
 
 // src/cli/commands/test.ts
 var DEFAULT_PORT3 = 5173;
-var test_default = defineCommand6({
+var test_default = defineCommand5({
   meta: {
     name: "test",
     description: "Run tests for your DeepSpace app"
@@ -1820,17 +1074,17 @@ var test_default = defineCommand6({
       process.exit(1);
     }
     ensureInstallReady(appDir);
-    let token2;
+    let token;
     let ownerId;
     try {
-      token2 = await ensureToken();
-      const payload = decodeJwtPayload(token2);
+      token = await ensureToken();
+      const payload = decodeJwtPayload(token);
       ownerId = payload.sub;
     } catch (err) {
       console.error("`deepspace test` requires you to be logged in. Run `deepspace login` first.");
       process.exit(1);
     }
-    await writeDevVars(appDir, "dev", ownerId, token2);
+    await writeDevVars(appDir, "dev", ownerId, token);
     if (suite !== "unit") {
       preflightWindowsWorkerd(appDir);
       ensurePlaywright(appDir);
@@ -1901,10 +1155,10 @@ function resolvePort3(arg) {
 }
 
 // src/cli/commands/screenshot.ts
-import { defineCommand as defineCommand7 } from "citty";
+import { defineCommand as defineCommand6 } from "citty";
 import { sync as spawnSync4 } from "cross-spawn";
 import { resolve as resolve5 } from "path";
-var screenshot_default = defineCommand7({
+var screenshot_default = defineCommand6({
   meta: {
     name: "screenshot",
     description: "Take a Playwright screenshot, installing Chromium on demand"
@@ -1948,30 +1202,30 @@ var screenshot_default = defineCommand7({
 });
 
 // src/cli/commands/test-accounts.ts
-import { defineCommand as defineCommand8 } from "citty";
+import { defineCommand as defineCommand7 } from "citty";
 import * as p3 from "@clack/prompts";
-import { readFileSync as readFileSync8, writeFileSync as writeFileSync6, existsSync as existsSync9, mkdirSync as mkdirSync4 } from "fs";
-import { join as join9 } from "path";
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync5, existsSync as existsSync8, mkdirSync as mkdirSync4 } from "fs";
+import { join as join8 } from "path";
 import { homedir as homedir4 } from "os";
 var SESSION_COOKIE2 = "__Secure-better-auth.session_token";
 var AUTH_URL4 = process.env.DEEPSPACE_AUTH_URL ?? ENVS.prod.auth;
-var DIR3 = join9(homedir4(), ".deepspace");
-var ACCOUNTS_PATH = join9(DIR3, "test-accounts.json");
+var DIR3 = join8(homedir4(), ".deepspace");
+var ACCOUNTS_PATH = join8(DIR3, "test-accounts.json");
 function loadAccounts() {
-  if (!existsSync9(ACCOUNTS_PATH)) return [];
+  if (!existsSync8(ACCOUNTS_PATH)) return [];
   try {
-    return JSON.parse(readFileSync8(ACCOUNTS_PATH, "utf-8"));
+    return JSON.parse(readFileSync7(ACCOUNTS_PATH, "utf-8"));
   } catch {
     return [];
   }
 }
 function saveAccounts(accounts) {
   mkdirSync4(DIR3, { recursive: true });
-  writeFileSync6(ACCOUNTS_PATH, JSON.stringify(accounts, null, 2), { mode: 384 });
+  writeFileSync5(ACCOUNTS_PATH, JSON.stringify(accounts, null, 2), { mode: 384 });
 }
 function sessionCookie() {
-  const token2 = readFileSync8(SESSION_PATH2, "utf-8").trim();
-  return `${SESSION_COOKIE2}=${encodeURIComponent(token2)}`;
+  const token = readFileSync7(SESSION_PATH2, "utf-8").trim();
+  return `${SESSION_COOKIE2}=${encodeURIComponent(token)}`;
 }
 async function fetchRemoteAccounts() {
   const res = await fetch(`${AUTH_URL4}/api/auth/test-accounts`, {
@@ -1993,7 +1247,7 @@ async function deleteRemote(id) {
     throw new Error(data.error ?? `DELETE returned ${res.status}`);
   }
 }
-var create = defineCommand8({
+var create = defineCommand7({
   meta: {
     name: "create",
     description: "Create a test account"
@@ -2063,7 +1317,7 @@ var create = defineCommand8({
 Saved to ${ACCOUNTS_PATH}`);
   }
 });
-var list2 = defineCommand8({
+var list = defineCommand7({
   meta: {
     name: "list",
     description: "List your test accounts"
@@ -2098,7 +1352,7 @@ var list2 = defineCommand8({
     }
   }
 });
-var del = defineCommand8({
+var del = defineCommand7({
   meta: {
     name: "delete",
     description: "Delete a test account by --email or --id"
@@ -2155,7 +1409,7 @@ var del = defineCommand8({
     console.log(`Test account deleted${targetEmail ? `: ${targetEmail}` : `: ${targetId}`}`);
   }
 });
-var clear = defineCommand8({
+var clear = defineCommand7({
   meta: {
     name: "clear",
     description: "Delete all your test accounts (or those matching --label)"
@@ -2221,25 +1475,25 @@ Failed:`);
     }
   }
 });
-var test_accounts_default = defineCommand8({
+var test_accounts_default = defineCommand7({
   meta: {
     name: "test-accounts",
     description: "Manage test accounts for development"
   },
   subCommands: {
     create,
-    list: list2,
+    list,
     delete: del,
     clear
   }
 });
 
 // src/cli/commands/deploy.ts
-import { defineCommand as defineCommand9 } from "citty";
+import { defineCommand as defineCommand8 } from "citty";
 import { execSync as execSync2 } from "child_process";
 import { randomUUID } from "crypto";
-import { readFileSync as readFileSync9, readdirSync as readdirSync2, existsSync as existsSync10 } from "fs";
-import { join as join10, resolve as resolve6, dirname as dirname2 } from "path";
+import { readFileSync as readFileSync8, readdirSync as readdirSync2, existsSync as existsSync9 } from "fs";
+import { join as join9, resolve as resolve6, dirname as dirname2 } from "path";
 import { pathToFileURL } from "url";
 import * as p4 from "@clack/prompts";
 
@@ -2268,7 +1522,6 @@ var RESERVED_BINDING_NAMES = /* @__PURE__ */ new Set([
   "AUTH_WORKER_URL",
   "APP_IDENTITY_TOKEN",
   "APP_OWNER_JWT",
-  "APP_SECRETS_KEY",
   "USAGE_EVENTS"
 ]);
 function validateBindingManifest(manifest) {
@@ -2449,7 +1702,6 @@ function asObjectArray(v) {
 // src/cli/commands/deploy.ts
 var DEPLOY_URL = process.env.DEEPSPACE_DEPLOY_URL ?? ENVS.prod.deploy;
 var API_URL = process.env.DEEPSPACE_API_URL ?? ENVS.prod.api;
-var SECRET_NAME_RE2 = /^[A-Za-z_][A-Za-z0-9_]*$/;
 var CLOUDFLARE_DEPLOY_ERROR_HINT = "Deployment reached the DeepSpace deploy worker, but Cloudflare's deployment control-plane API failed. This is often caused by a Cloudflare Dashboard/API incident or Workers for Platforms entitlement outage. Already deployed apps should keep serving; wait for Cloudflare to recover and retry.";
 var RESERVED_RUN_WORKER_FIRST = /* @__PURE__ */ new Set([
   "/api/*",
@@ -2492,14 +1744,6 @@ function formatDeployWorkerError(status2, error) {
 
 Underlying error: ${detail}`;
 }
-function legacyDevVarsAppSecretsRoomWarning(userSecrets, doManifest) {
-  if (!Object.keys(userSecrets).length) return null;
-  const hasAppSecretsRoom = (doManifest ?? []).some(
-    (binding) => binding.binding === "SECRETS_ROOMS" || binding.className === "AppSecretsRoom"
-  );
-  if (!hasAppSecretsRoom) return null;
-  return "Legacy .dev.vars secrets are still being deployed as direct Worker bindings even though AppSecretsRoom is configured. Move these values with `deepspace secrets set` to manage them through the app secrets store.";
-}
 var MAX_GROUP_BYTES = 40 * 1024 * 1024;
 var GROUP_BYTES = (() => {
   const raw = Number(process.env.DEEPSPACE_DEPLOY_GROUP_BYTES);
@@ -2544,16 +1788,16 @@ async function postWithRetry(url, makeInit, { attempts = 4, retryServerErrors =
   if (lastRes) return lastRes;
   throw lastErr instanceof Error ? lastErr : new Error(String(lastErr));
 }
-async function abortStagedUpload(appName, uploadId, totalGroups, token2) {
+async function abortStagedUpload(appName, uploadId, totalGroups, token) {
   try {
     await fetch(
       `${DEPLOY_URL}/api/deploy/${appName}/assets?uploadId=${uploadId}&totalGroups=${totalGroups}`,
-      { method: "DELETE", headers: { Authorization: `Bearer ${token2}` } }
+      { method: "DELETE", headers: { Authorization: `Bearer ${token}` } }
     );
   } catch {
   }
 }
-var deploy_default = defineCommand9({
+var deploy_default = defineCommand8({
   meta: {
     name: "deploy",
     description: "Build and deploy your DeepSpace app"
@@ -2595,9 +1839,9 @@ var deploy_default = defineCommand9({
     }
     const appName = nameRes.name;
     p4.log.info(envName ? `App: ${appName}  (env: ${envName})` : `App: ${appName}`);
-    let token2;
+    let token;
     try {
-      token2 = await ensureToken();
+      token = await ensureToken();
     } catch (err) {
       p4.cancel(err.message);
       process.exit(1);
@@ -2617,18 +1861,18 @@ var deploy_default = defineCommand9({
       process.exit(1);
     }
     s.stop("Built");
-    const deployConfigPath = join10(appDir, ".wrangler", "deploy", "config.json");
-    if (!existsSync10(deployConfigPath)) {
+    const deployConfigPath = join9(appDir, ".wrangler", "deploy", "config.json");
+    if (!existsSync9(deployConfigPath)) {
       p4.cancel("Build output config not found at .wrangler/deploy/config.json");
       process.exit(1);
     }
-    const deployConfig = JSON.parse(readFileSync9(deployConfigPath, "utf-8"));
+    const deployConfig = JSON.parse(readFileSync8(deployConfigPath, "utf-8"));
     const outputWranglerPath = resolve6(dirname2(deployConfigPath), deployConfig.configPath);
-    if (!existsSync10(outputWranglerPath)) {
+    if (!existsSync9(outputWranglerPath)) {
       p4.cancel(`Output wrangler.json not found at ${outputWranglerPath}`);
       process.exit(1);
     }
-    const outputConfig = JSON.parse(readFileSync9(outputWranglerPath, "utf-8"));
+    const outputConfig = JSON.parse(readFileSync8(outputWranglerPath, "utf-8"));
     if (outputConfig.name && outputConfig.name !== appName) {
       const envHint = envName ? ` (--env ${envName})` : "";
       p4.cancel(
@@ -2637,20 +1881,20 @@ var deploy_default = defineCommand9({
       process.exit(1);
     }
     const workerDir = dirname2(outputWranglerPath);
-    const workerBundlePath = join10(workerDir, outputConfig.main);
+    const workerBundlePath = join9(workerDir, outputConfig.main);
     const clientDir = outputConfig.assets?.directory ? resolve6(workerDir, outputConfig.assets.directory) : null;
-    if (!existsSync10(workerBundlePath)) {
+    if (!existsSync9(workerBundlePath)) {
       p4.cancel(`Worker bundle not found at ${workerBundlePath}`);
       process.exit(1);
     }
-    if (!clientDir || !existsSync10(clientDir)) {
+    if (!clientDir || !existsSync9(clientDir)) {
       p4.cancel(`Client assets not found at ${clientDir}`);
       process.exit(1);
     }
     s.start("Collecting assets...");
     const assets = collectAssets(clientDir);
     s.stop(`Collected ${assets.length} assets`);
-    const workerJs = readFileSync9(workerBundlePath, "utf-8");
+    const workerJs = readFileSync8(workerBundlePath, "utf-8");
     const doBindings = outputConfig.durable_objects?.bindings;
     const sqliteClasses = new Set(
       outputConfig.migrations?.flatMap((m) => m.new_sqlite_classes ?? []) ?? []
@@ -2677,20 +1921,40 @@ var deploy_default = defineCommand9({
         `Custom bindings: ${customBindings.map((b) => `${b.name} (${b.type})`).join(", ")}`
       );
     }
+    const devVarsPath = devVarsPathFor(appDir, envName);
     let userSecrets = {};
-    if (hasLegacyDevVars(appDir, envName)) {
-      try {
-        userSecrets = readLegacyUserSecrets(appDir, envName, customBindings, doManifest);
-      } catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        p4.cancel(message);
+    if (existsSync9(devVarsPath)) {
+      const customSection = extractCustomDevVars(readFileSync8(devVarsPath, "utf-8"));
+      if (customSection) {
+        try {
+          userSecrets = parseDevVars(customSection);
+        } catch (err) {
+          p4.cancel(`.dev.vars: ${err.message}`);
+          process.exit(1);
+        }
+      }
+    }
+    const userSecretNames = Object.keys(userSecrets);
+    const declaredBindingNames = /* @__PURE__ */ new Set([
+      ...customBindings.map((b) => b.name),
+      ...(doManifest ?? []).map((d) => d.binding)
+    ]);
+    for (const name of userSecretNames) {
+      if (RESERVED_BINDING_NAMES.has(name)) {
+        p4.cancel(
+          `.dev.vars: "${name}" is a reserved binding name and cannot be used as an app secret.`
+        );
+        process.exit(1);
+      }
+      if (declaredBindingNames.has(name)) {
+        p4.cancel(
+          `.dev.vars: "${name}" collides with a binding declared in wrangler.toml \u2014 rename one or the other.`
+        );
         process.exit(1);
       }
     }
-    if (Object.keys(userSecrets).length) {
-      p4.log.info(`Legacy .dev.vars secrets: ${Object.keys(userSecrets).sort().join(", ")}`);
-      const warning = legacyDevVarsAppSecretsRoomWarning(userSecrets, doManifest);
-      if (warning) p4.log.warn(warning);
+    if (userSecretNames.length) {
+      p4.log.info(`App secrets (from .dev.vars): ${userSecretNames.join(", ")}`);
     }
     s.start(`Deploying to ${appName}.app.space...`);
     const extraRoutes = extractRunWorkerFirst(wranglerConfig);
@@ -2715,7 +1979,7 @@ var deploy_default = defineCommand9({
             () => ({
               method: "POST",
               headers: {
-                Authorization: `Bearer ${token2}`,
+                Authorization: `Bearer ${token}`,
                 "Content-Type": "application/json"
               },
               body: groupJson
@@ -2723,7 +1987,7 @@ var deploy_default = defineCommand9({
           );
           if (!groupRes.ok) {
             const errBody = await groupRes.json().catch(() => ({}));
-            await abortStagedUpload(appName, uploadId, totalGroups, token2);
+            await abortStagedUpload(appName, uploadId, totalGroups, token);
             s.stop("Deploy failed");
             p4.cancel(
               `Asset upload failed on group ${i + 1}/${totalGroups}: ${errBody.error ?? `HTTP ${groupRes.status}`}`
@@ -2732,7 +1996,7 @@ var deploy_default = defineCommand9({
           }
         }
       } catch (err) {
-        await abortStagedUpload(appName, uploadId, totalGroups, token2);
+        await abortStagedUpload(appName, uploadId, totalGroups, token);
         s.stop("Deploy failed");
         p4.cancel(`Asset upload failed (network): ${err?.message ?? err}`);
         process.exit(1);
@@ -2754,12 +2018,12 @@ var deploy_default = defineCommand9({
       if (customBindings.length) {
         form.append("bindingManifest", JSON.stringify(customBindings));
       }
+      if (userSecretNames.length) {
+        form.append("userSecrets", JSON.stringify(userSecrets));
+      }
       if (extraRoutes.length) {
         form.append("extraRunWorkerFirst", JSON.stringify(extraRoutes));
       }
-      if (Object.keys(userSecrets).length) {
-        form.append("userSecrets", JSON.stringify(userSecrets));
-      }
       return form;
     };
     let res;
@@ -2768,7 +2032,7 @@ var deploy_default = defineCommand9({
         `${DEPLOY_URL}/api/deploy/${appName}`,
         () => ({
           method: "POST",
-          headers: { Authorization: `Bearer ${token2}` },
+          headers: { Authorization: `Bearer ${token}` },
           body: makeForm()
         }),
         // Commit runs a real deploy — don't retry its 5xx (could double-deploy);
@@ -2777,14 +2041,14 @@ var deploy_default = defineCommand9({
         { retryServerErrors: false }
       );
     } catch (err) {
-      if (uploadId) await abortStagedUpload(appName, uploadId, totalGroups, token2);
+      if (uploadId) await abortStagedUpload(appName, uploadId, totalGroups, token);
       s.stop("Deploy failed");
       p4.cancel(`Deploy request failed: ${err?.message ?? err}`);
       process.exit(1);
     }
     const body = await res.json().catch(() => ({}));
     if (!res.ok || !body.success) {
-      if (uploadId) await abortStagedUpload(appName, uploadId, totalGroups, token2);
+      if (uploadId) await abortStagedUpload(appName, uploadId, totalGroups, token);
       s.stop("Deploy failed");
       p4.cancel(formatDeployWorkerError(res.status, body.error));
       process.exit(1);
@@ -2796,52 +2060,29 @@ var deploy_default = defineCommand9({
         s.stop("Deployed (edge propagation still in progress after 90s)");
         p4.log.warn("First requests may briefly hit the assets transitional page; retry in a minute.");
         p4.log.success(`Live at: ${body.url}`);
-        p4.log.info("Secrets: local dev-only values are not pushed automatically. Run `deepspace secrets push` when you want to sync them.");
-        await syncSubscriptionPlans(appDir, appName, token2);
-        await syncOneTimeProducts(appDir, appName, token2);
+        await syncSubscriptionPlans(appDir, appName, token);
+        await syncOneTimeProducts(appDir, appName, token);
         p4.outro("Done");
         return;
       }
     }
     s.stop("Deployed!");
     p4.log.success(`Live at: ${body.url}`);
-    p4.log.info("Secrets: local dev-only values are not pushed automatically. Run `deepspace secrets push` when you want to sync them.");
-    await syncSubscriptionPlans(appDir, appName, token2);
-    await syncOneTimeProducts(appDir, appName, token2);
+    await syncSubscriptionPlans(appDir, appName, token);
+    await syncOneTimeProducts(appDir, appName, token);
     p4.outro("Done");
   }
 });
-function readLegacyUserSecrets(appDir, wranglerEnv, customBindings, doManifest) {
-  const path = join10(appDir, wranglerEnv ? `.dev.vars.${wranglerEnv}` : ".dev.vars");
-  if (!existsSync10(path)) return {};
-  const vars = parseDevVars(extractCustomDevVars(readFileSync9(path, "utf-8")));
-  const reserved = /* @__PURE__ */ new Set([
-    ...SDK_MANAGED_KEYS,
-    ...customBindings.map((b) => b.name),
-    ...(doManifest ?? []).flatMap((b) => [b.binding, b.className])
-  ]);
-  const out = {};
-  for (const [name, value] of Object.entries(vars)) {
-    if (!SECRET_NAME_RE2.test(name)) {
-      throw new Error(`.dev.vars: invalid secret name "${name}".`);
-    }
-    if (reserved.has(name)) {
-      throw new Error(`.dev.vars: "${name}" is reserved and cannot be deployed as a user secret.`);
-    }
-    out[name] = value;
-  }
-  return out;
-}
-async function syncSubscriptionPlans(appDir, appName, token2) {
-  const subsPath = join10(appDir, "src", "subscriptions.ts");
-  if (!existsSync10(subsPath)) return;
+async function syncSubscriptionPlans(appDir, appName, token) {
+  const subsPath = join9(appDir, "src", "subscriptions.ts");
+  if (!existsSync9(subsPath)) return;
   const s = createSpinner();
   s.start("Syncing subscription plans...");
   let plans;
   try {
     const esbuild = await import("esbuild");
-    const outDir = join10(appDir, ".wrangler", "deploy");
-    const outFile = join10(outDir, "subscriptions.bundle.mjs");
+    const outDir = join9(appDir, ".wrangler", "deploy");
+    const outFile = join9(outDir, "subscriptions.bundle.mjs");
     await esbuild.build({
       entryPoints: [subsPath],
       bundle: true,
@@ -2871,7 +2112,7 @@ async function syncSubscriptionPlans(appDir, appName, token2) {
     res = await fetch(`${API_URL}/api/subscriptions/sync`, {
       method: "POST",
       headers: {
-        Authorization: `Bearer ${token2}`,
+        Authorization: `Bearer ${token}`,
         "Content-Type": "application/json"
       },
       body: JSON.stringify({ appName, plans })
@@ -2891,7 +2132,7 @@ async function syncSubscriptionPlans(appDir, appName, token2) {
     }
     const changes = (body.planChanges ?? []).filter((c) => c.affectedSubscribers > 0);
     if (changes.length > 0) {
-      await promptAndCancelChangedPlans(appName, token2, changes);
+      await promptAndCancelChangedPlans(appName, token, changes);
     }
     return;
   }
@@ -2912,7 +2153,7 @@ function summaryLine(c) {
   const diffs = (c.intervals ?? []).map((i) => `${i.interval}: ${formatCents(i.oldCents)} \u2192 ${formatCents(i.newCents)}`).join("; ");
   return `  \u2022 ${c.slug} \u2014 repriced (${diffs}; ${suffix} grandfathered on old price)`;
 }
-async function promptAndCancelChangedPlans(appName, token2, changes) {
+async function promptAndCancelChangedPlans(appName, token, changes) {
   const summary = changes.map(summaryLine).join("\n");
   p4.log.warn(
     `Plan change${changes.length === 1 ? "" : "s"} from this deploy left subscribers stranded:
@@ -2943,7 +2184,7 @@ current billing period? (Skip to leave them grandfathered.)`
         const res = await fetch(`${API_URL}/api/subscriptions/admin-cancel`, {
           method: "POST",
           headers: {
-            Authorization: `Bearer ${token2}`,
+            Authorization: `Bearer ${token}`,
             "Content-Type": "application/json"
           },
           body: JSON.stringify({
@@ -2981,16 +2222,16 @@ current billing period? (Skip to leave them grandfathered.)`
     }
   }
 }
-async function syncOneTimeProducts(appDir, appName, token2) {
-  const productsPath = join10(appDir, "src", "products.ts");
-  if (!existsSync10(productsPath)) return;
+async function syncOneTimeProducts(appDir, appName, token) {
+  const productsPath = join9(appDir, "src", "products.ts");
+  if (!existsSync9(productsPath)) return;
   const s = createSpinner();
   s.start("Syncing one-time products...");
   let products;
   try {
     const esbuild = await import("esbuild");
-    const outDir = join10(appDir, ".wrangler", "deploy");
-    const outFile = join10(outDir, "products.bundle.mjs");
+    const outDir = join9(appDir, ".wrangler", "deploy");
+    const outFile = join9(outDir, "products.bundle.mjs");
     await esbuild.build({
       entryPoints: [productsPath],
       bundle: true,
@@ -3020,7 +2261,7 @@ async function syncOneTimeProducts(appDir, appName, token2) {
     res = await fetch(`${API_URL}/api/charges/products/sync`, {
       method: "POST",
       headers: {
-        Authorization: `Bearer ${token2}`,
+        Authorization: `Bearer ${token}`,
         "Content-Type": "application/json"
       },
       body: JSON.stringify({ appName, products })
@@ -3064,14 +2305,14 @@ function collectAssets(dir) {
   function walk(d, prefix) {
     for (const entry of readdirSync2(d, { withFileTypes: true })) {
       if (entry.name === ".assetsignore") continue;
-      const full = join10(d, entry.name);
+      const full = join9(d, entry.name);
       const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
       if (entry.isDirectory()) {
         walk(full, rel);
       } else {
         assets.push({
           path: "/" + rel,
-          contentBase64: readFileSync9(full).toString("base64")
+          contentBase64: readFileSync8(full).toString("base64")
         });
       }
     }
@@ -3081,10 +2322,10 @@ function collectAssets(dir) {
 }
 
 // src/cli/commands/undeploy.ts
-import { defineCommand as defineCommand10 } from "citty";
+import { defineCommand as defineCommand9 } from "citty";
 import * as p5 from "@clack/prompts";
 var DEPLOY_URL2 = process.env.DEEPSPACE_DEPLOY_URL ?? ENVS.prod.deploy;
-var undeploy_default = defineCommand10({
+var undeploy_default = defineCommand9({
   meta: {
     name: "undeploy",
     description: "Remove a deployed DeepSpace app"
@@ -3119,9 +2360,9 @@ var undeploy_default = defineCommand10({
       p5.cancel("Provide an app name or run from a DeepSpace app directory.");
       process.exit(1);
     }
-    let token2;
+    let token;
     try {
-      token2 = await ensureToken();
+      token = await ensureToken();
     } catch (err) {
       p5.cancel(err.message);
       process.exit(1);
@@ -3131,7 +2372,7 @@ var undeploy_default = defineCommand10({
     s.start("Removing...");
     const res = await fetch(`${DEPLOY_URL2}/api/deploy/${appName}`, {
       method: "DELETE",
-      headers: { Authorization: `Bearer ${token2}` }
+      headers: { Authorization: `Bearer ${token}` }
     });
     const body = await res.json().catch(() => ({}));
     if (!res.ok || !body.success) {
@@ -3145,8 +2386,8 @@ var undeploy_default = defineCommand10({
 });
 
 // src/cli/commands/whoami.ts
-import { defineCommand as defineCommand11 } from "citty";
-var whoami_default = defineCommand11({
+import { defineCommand as defineCommand10 } from "citty";
+var whoami_default = defineCommand10({
   meta: {
     name: "whoami",
     description: "Show the currently logged-in user"
@@ -3201,18 +2442,18 @@ var whoami_default = defineCommand11({
 });
 
 // src/cli/commands/add.ts
-import { defineCommand as defineCommand12 } from "citty";
-import { existsSync as existsSync11 } from "fs";
-import { resolve as resolve7, join as join11 } from "path";
+import { defineCommand as defineCommand11 } from "citty";
+import { existsSync as existsSync10 } from "fs";
+import { resolve as resolve7, join as join10 } from "path";
 import { execSync as execSync3 } from "child_process";
 function findScript(from) {
-  const inNodeModules = join11(from, "node_modules", "deepspace", "scripts", "add-feature.cjs");
-  if (existsSync11(inNodeModules)) return inNodeModules;
-  const inDotDeepspace = join11(from, ".deepspace", "scripts", "add-feature.cjs");
-  if (existsSync11(inDotDeepspace)) return inDotDeepspace;
+  const inNodeModules = join10(from, "node_modules", "deepspace", "scripts", "add-feature.cjs");
+  if (existsSync10(inNodeModules)) return inNodeModules;
+  const inDotDeepspace = join10(from, ".deepspace", "scripts", "add-feature.cjs");
+  if (existsSync10(inDotDeepspace)) return inDotDeepspace;
   return null;
 }
-var add_default = defineCommand12({
+var add_default = defineCommand11({
   meta: {
     name: "add",
     description: "Add a feature to your DeepSpace app"
@@ -3247,8 +2488,8 @@ var add_default = defineCommand12({
     if (!script) {
       console.error("Could not find the deepspace feature installer.");
       console.error("Looked in:");
-      console.error(`  ${join11(appDir, "node_modules", "deepspace", "scripts", "add-feature.cjs")}`);
-      console.error(`  ${join11(appDir, ".deepspace", "scripts", "add-feature.cjs")}`);
+      console.error(`  ${join10(appDir, "node_modules", "deepspace", "scripts", "add-feature.cjs")}`);
+      console.error(`  ${join10(appDir, ".deepspace", "scripts", "add-feature.cjs")}`);
       console.error("Are you in a DeepSpace app directory? Try `npm install` first.");
       process.exit(1);
     }
@@ -3270,10 +2511,10 @@ var add_default = defineCommand12({
 });
 
 // src/cli/commands/skills.ts
-import { defineCommand as defineCommand13 } from "citty";
+import { defineCommand as defineCommand12 } from "citty";
 import spawn2 from "cross-spawn";
 import { mkdirSync as mkdirSync5 } from "fs";
-import { join as join12 } from "path";
+import { join as join11 } from "path";
 import { homedir as homedir5 } from "os";
 var SKILL_REPO = "deepdotspace/deepspace-skill";
 function runSkillsAdd(extraArgs) {
@@ -3292,9 +2533,9 @@ function runSkillsAdd(extraArgs) {
   });
 }
 function precreateClaudeDir(baseDir) {
-  mkdirSync5(join12(baseDir, ".claude"), { recursive: true });
+  mkdirSync5(join11(baseDir, ".claude"), { recursive: true });
 }
-var add = defineCommand13({
+var add = defineCommand12({
   meta: {
     name: "add",
     description: "Install the DeepSpace skill for your coding agent"
@@ -3336,7 +2577,7 @@ var add = defineCommand13({
     if (code !== 0) process.exit(code);
   }
 });
-var skills_default = defineCommand13({
+var skills_default = defineCommand12({
   meta: {
     name: "skills",
     description: "Manage the DeepSpace agent skill (Claude Code, Codex, OpenCode, Cursor, ...)"
@@ -3347,14 +2588,14 @@ var skills_default = defineCommand13({
 });
 
 // src/cli/commands/domain.ts
-import { defineCommand as defineCommand14 } from "citty";
+import { defineCommand as defineCommand13 } from "citty";
 import { execSync as execSync4 } from "child_process";
 var API_URL2 = process.env.DEEPSPACE_API_URL ?? ENVS.prod.api;
-async function api(token2, path, init) {
+async function api(token, path, init) {
   const res = await fetch(`${API_URL2}${path}`, {
     ...init,
     headers: {
-      Authorization: `Bearer ${token2}`,
+      Authorization: `Bearer ${token}`,
       "Content-Type": "application/json",
       ...init?.headers ?? {}
     }
@@ -3403,7 +2644,7 @@ async function confirm3(message) {
     });
   });
 }
-var search = defineCommand14({
+var search = defineCommand13({
   meta: { name: "search", description: "Search for available domains" },
   args: {
     query: { type: "positional", description: "Domain or keyword", required: true },
@@ -3411,10 +2652,10 @@ var search = defineCommand14({
     json: { type: "boolean", description: "Emit JSON instead of a table" }
   },
   async run({ args }) {
-    const token2 = await ensureToken();
+    const token = await ensureToken();
     const limit = parseInt(args.limit ?? "10", 10) || 10;
     const result = await api(
-      token2,
+      token,
       `/api/domains/search?q=${encodeURIComponent(args.query)}&limit=${limit}`
     );
     if (args.json) {
@@ -3433,7 +2674,7 @@ var search = defineCommand14({
     }
   }
 });
-var buy = defineCommand14({
+var buy = defineCommand13({
   meta: { name: "buy", description: "Buy a domain and attach it to an app" },
   args: {
     domain: { type: "positional", description: "Domain to buy", required: true },
@@ -3444,9 +2685,9 @@ var buy = defineCommand14({
     json: { type: "boolean", description: "Emit JSON to stdout", default: false }
   },
   async run({ args }) {
-    const token2 = await ensureToken();
+    const token = await ensureToken();
     const appName = requireAppName(args.app);
-    const priceCheck = await api(token2, "/api/domains/check", {
+    const priceCheck = await api(token, "/api/domains/check", {
       method: "POST",
       body: JSON.stringify({ domains: [args.domain] })
     });
@@ -3467,7 +2708,7 @@ var buy = defineCommand14({
       }
     }
     const checkout = await api(
-      token2,
+      token,
       "/api/domains/checkout",
       {
         method: "POST",
@@ -3494,7 +2735,7 @@ var buy = defineCommand14({
       await new Promise((r) => setTimeout(r, 5e3));
       try {
         const detail = await api(
-          token2,
+          token,
           `/api/domains/${checkout.purchaseId}`
         );
         if (detail.domain.status !== lastStatus) {
@@ -3522,14 +2763,14 @@ var buy = defineCommand14({
     process.exit(1);
   }
 });
-var list3 = defineCommand14({
+var list2 = defineCommand13({
   meta: { name: "list", description: "List your domains" },
   args: {
     json: { type: "boolean", description: "Emit JSON" }
   },
   async run({ args }) {
-    const token2 = await ensureToken();
-    const result = await api(token2, "/api/domains");
+    const token = await ensureToken();
+    const result = await api(token, "/api/domains");
     if (args.json) {
       process.stdout.write(JSON.stringify(scrubInternal(result), null, 2) + "\n");
       return;
@@ -3546,15 +2787,15 @@ var list3 = defineCommand14({
     }
   }
 });
-var status = defineCommand14({
+var status = defineCommand13({
   meta: { name: "status", description: "Show details for one domain" },
   args: {
     domain: { type: "positional", description: "Domain", required: true },
     json: { type: "boolean" }
   },
   async run({ args }) {
-    const token2 = await ensureToken();
-    const all = await api(token2, "/api/domains");
+    const token = await ensureToken();
+    const all = await api(token, "/api/domains");
     const found = all.domains.find((d) => d.domain === args.domain);
     if (!found) {
       console.error(`No domain ${args.domain} in your account`);
@@ -3574,7 +2815,7 @@ var status = defineCommand14({
     console.log(`Charged:       ${fmtCents(found.chargedCents)}/yr`);
   }
 });
-var attach = defineCommand14({
+var attach = defineCommand13({
   meta: { name: "attach", description: "Re-point a domain at a different app" },
   args: {
     domain: { type: "positional", description: "Domain to re-point", required: true },
@@ -3582,16 +2823,16 @@ var attach = defineCommand14({
     json: { type: "boolean" }
   },
   async run({ args }) {
-    const token2 = await ensureToken();
+    const token = await ensureToken();
     const targetApp = requireAppName(args.app);
-    const all = await api(token2, "/api/domains");
+    const all = await api(token, "/api/domains");
     const found = all.domains.find((d) => d.domain === args.domain);
     if (!found) {
       console.error(`No domain ${args.domain} in your account`);
       process.exit(1);
     }
     const result = await api(
-      token2,
+      token,
       `/api/domains/${found.id}/reattach`,
       {
         method: "POST",
@@ -3605,7 +2846,7 @@ var attach = defineCommand14({
     console.log(`\u2713 ${args.domain} now points at ${targetApp}`);
   }
 });
-var detach = defineCommand14({
+var detach = defineCommand13({
   meta: {
     name: "detach",
     description: "Stop routing the domain (keeps the registration; auto-renew unchanged)"
@@ -3615,8 +2856,8 @@ var detach = defineCommand14({
     yes: { type: "boolean", description: "Skip the confirmation prompt" }
   },
   async run({ args }) {
-    const token2 = await ensureToken();
-    const all = await api(token2, "/api/domains");
+    const token = await ensureToken();
+    const all = await api(token, "/api/domains");
     const found = all.domains.find((d) => d.domain === args.domain);
     if (!found) {
       console.error(`No domain ${args.domain} in your account`);
@@ -3631,11 +2872,11 @@ var detach = defineCommand14({
         return;
       }
     }
-    await api(token2, `/api/domains/${found.id}`, { method: "DELETE" });
+    await api(token, `/api/domains/${found.id}`, { method: "DELETE" });
     console.log(`\u2713 ${args.domain} detached. Use \`deepspace domain attach\` to re-route, or \`renew --auto off\` to stop auto-renewal.`);
   }
 });
-var renew = defineCommand14({
+var renew = defineCommand13({
   meta: { name: "renew", description: "Toggle auto-renewal at the registrar" },
   args: {
     domain: { type: "positional", description: "Domain", required: true },
@@ -3646,15 +2887,15 @@ var renew = defineCommand14({
       console.error('--auto must be "on" or "off"');
       process.exit(1);
     }
-    const token2 = await ensureToken();
-    const all = await api(token2, "/api/domains");
+    const token = await ensureToken();
+    const all = await api(token, "/api/domains");
     const found = all.domains.find((d) => d.domain === args.domain);
     if (!found) {
       console.error(`No domain ${args.domain} in your account`);
       process.exit(1);
     }
     const enabled = args.auto === "on";
-    await api(token2, `/api/domains/${found.id}/auto-renew`, {
+    await api(token, `/api/domains/${found.id}/auto-renew`, {
       method: "POST",
       body: JSON.stringify({ autoRenew: enabled })
     });
@@ -3669,16 +2910,16 @@ function openBrowser2(url) {
   } catch {
   }
 }
-var domain_default = defineCommand14({
+var domain_default = defineCommand13({
   meta: { name: "domain", description: "Buy and manage custom domains" },
-  subCommands: { search, buy, list: list3, status, attach, detach, renew }
+  subCommands: { search, buy, list: list2, status, attach, detach, renew }
 });
 
 // src/cli/commands/integrations.ts
-import { defineCommand as defineCommand15 } from "citty";
+import { defineCommand as defineCommand14 } from "citty";
 
 // src/cli/commands/_invoke-impl.ts
-import { readFileSync as readFileSync10 } from "fs";
+import { readFileSync as readFileSync9 } from "fs";
 var API_URL3 = process.env.DEEPSPACE_API_URL ?? ENVS.prod.api;
 var DEFAULT_TIMEOUT_MS = 12e4;
 function parseTarget(target) {
@@ -3699,7 +2940,7 @@ function resolveBody(opts) {
   if (opts.body != null) {
     raw = opts.body;
   } else if (opts.bodyFile != null) {
-    raw = opts.bodyFile === "-" ? readFileSync10(0, "utf-8") : readFileSync10(opts.bodyFile, "utf-8");
+    raw = opts.bodyFile === "-" ? readFileSync9(0, "utf-8") : readFileSync9(opts.bodyFile, "utf-8");
   } else {
     return "{}";
   }
@@ -3850,7 +3091,7 @@ async function runInvoke(args) {
 }
 
 // src/cli/commands/integrations.ts
-var list4 = defineCommand15({
+var list3 = defineCommand14({
   meta: {
     name: "list",
     description: "List all available integrations"
@@ -3871,7 +3112,7 @@ var list4 = defineCommand15({
     }
   }
 });
-var info = defineCommand15({
+var info = defineCommand14({
   meta: {
     name: "info",
     description: "Print schema + example body for an integration endpoint"
@@ -3897,7 +3138,7 @@ var info = defineCommand15({
     }
   }
 });
-var invoke = defineCommand15({
+var invoke = defineCommand14({
   meta: {
     name: "invoke",
     description: "Invoke a platform integration as the logged-in user"
@@ -3950,21 +3191,21 @@ var invoke = defineCommand15({
     }
   }
 });
-var integrations_default = defineCommand15({
+var integrations_default = defineCommand14({
   meta: {
     name: "integrations",
     description: "List, inspect, and invoke platform integrations"
   },
   subCommands: {
-    list: list4,
+    list: list3,
     info,
     invoke
   }
 });
 
 // src/cli/commands/invoke.ts
-import { defineCommand as defineCommand16 } from "citty";
-var invoke_default = defineCommand16({
+import { defineCommand as defineCommand15 } from "citty";
+var invoke_default = defineCommand15({
   meta: {
     name: "invoke",
     description: "Invoke a platform integration as the logged-in user"
@@ -4036,257 +3277,14 @@ var invoke_default = defineCommand16({
   }
 });
 
-// src/cli/commands/managed-repos.ts
-import { defineCommand as defineCommand17 } from "citty";
-var API_URL4 = process.env.DEEPSPACE_API_URL ?? ENVS.prod.api;
-var SIMPLE_APP_ID = /^[a-z0-9][a-z0-9_.:-]{0,119}$/i;
-var SIMPLE_APP_NAME = /^[a-z0-9][a-z0-9_-]{0,119}$/i;
-async function api2(token2, path, init) {
-  const res = await fetch(`${API_URL4}${path}`, {
-    ...init,
-    headers: {
-      Authorization: `Bearer ${token2}`,
-      "Content-Type": "application/json",
-      ...init?.headers ?? {}
-    }
-  });
-  const text2 = await res.text();
-  if (!res.ok) {
-    let msg = text2;
-    try {
-      msg = JSON.parse(text2).error ?? text2;
-    } catch {
-    }
-    throw new Error(`API ${path} (${res.status}): ${msg}`);
-  }
-  return JSON.parse(text2);
-}
-function defaultAppId(appName) {
-  return `cli-${slugId(appName)}`;
-}
-function slugId(raw) {
-  return raw.toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "") || "app";
-}
-function assertSimple(value, pattern, label) {
-  if (!pattern.test(value)) {
-    throw new Error(`${label} must start with a letter or number and contain only simple identifier characters.`);
-  }
-}
-function printQuota(quota) {
-  console.log(`Repo quota: ${quota.activeCount} / ${quota.limit} active (${quota.remaining} remaining)`);
-}
-function printRepo(repo) {
-  console.log(`${repo.fullName}`);
-  console.log(`  ID:       ${repo.id}`);
-  console.log(`  App:      ${repo.appName}`);
-  console.log(`  App ID:   ${repo.appId}`);
-  console.log(`  URL:      ${repo.htmlUrl}`);
-  console.log(`  Clone:    ${repo.cloneUrl}`);
-}
-async function confirm4(message) {
-  if (!process.stdin.isTTY) {
-    throw new Error(`${message} \u2014 pass --yes to confirm non-interactively`);
-  }
-  process.stdout.write(`${message} [y/N] `);
-  return new Promise((resolve9) => {
-    process.stdin.setEncoding("utf-8");
-    process.stdin.once("data", (data) => {
-      const answer = data.toString().trim().toLowerCase();
-      resolve9(answer === "y" || answer === "yes");
-    });
-  });
-}
-var list5 = defineCommand17({
-  meta: {
-    name: "list",
-    description: "List your DeepSpace-managed repos and quota"
-  },
-  args: {
-    json: {
-      type: "boolean",
-      description: "Emit JSON instead of human output",
-      default: false
-    }
-  },
-  async run({ args }) {
-    const token2 = await ensureToken();
-    const result = await api2(token2, "/api/github/repos");
-    if (args.json) {
-      process.stdout.write(JSON.stringify(result, null, 2) + "\n");
-      return;
-    }
-    printQuota(result.quota);
-    if (result.repos.length === 0) {
-      console.log("No DeepSpace-managed repos. Create one with `deepspace managed-repos create <app-name>`.");
-      return;
-    }
-    console.log("");
-    for (const repo of result.repos) {
-      printRepo(repo);
-    }
-  }
-});
-var create2 = defineCommand17({
-  meta: {
-    name: "create",
-    description: "Create a private DeepSpace-managed GitHub repo"
-  },
-  args: {
-    appName: {
-      type: "positional",
-      description: "Working app name for this repo",
-      required: true
-    },
-    appId: {
-      type: "string",
-      description: "Stable DeepSpace repo app id (defaults to cli-<app-name>)",
-      required: false
-    },
-    nameHint: {
-      type: "string",
-      description: "Repo-name hint (defaults to app name)",
-      required: false
-    },
-    json: {
-      type: "boolean",
-      description: "Emit JSON instead of human output",
-      default: false
-    }
-  },
-  async run({ args }) {
-    const appName = String(args.appName);
-    const appId = args.appId ? String(args.appId) : defaultAppId(appName);
-    const nameHint = args.nameHint ? String(args.nameHint) : void 0;
-    try {
-      assertSimple(appName, SIMPLE_APP_NAME, "appName");
-      assertSimple(appId, SIMPLE_APP_ID, "appId");
-      if (nameHint) assertSimple(nameHint, SIMPLE_APP_NAME, "nameHint");
-    } catch (err) {
-      console.error(err.message);
-      process.exit(1);
-    }
-    const token2 = await ensureToken();
-    const result = await api2(token2, "/api/github/repos", {
-      method: "POST",
-      body: JSON.stringify({ appName, appId, ...nameHint ? { nameHint } : {} })
-    });
-    if (args.json) {
-      process.stdout.write(JSON.stringify(result, null, 2) + "\n");
-      return;
-    }
-    console.log(result.alreadyExists ? "Existing DeepSpace-managed repo:" : "Created DeepSpace-managed repo:");
-    printRepo(result.repo);
-  }
-});
-var token = defineCommand17({
-  meta: {
-    name: "token",
-    description: "Mint a short-lived GitHub token for a DeepSpace-managed repo"
-  },
-  args: {
-    repoId: {
-      type: "positional",
-      description: "Repo id from `deepspace managed-repos list`",
-      required: true
-    },
-    json: {
-      type: "boolean",
-      description: "Emit JSON instead of human output",
-      default: false
-    }
-  },
-  async run({ args }) {
-    const jwt = await ensureToken();
-    const result = await api2(
-      jwt,
-      `/api/github/repos/${encodeURIComponent(String(args.repoId))}/agent-token`,
-      { method: "POST" }
-    );
-    if (args.json) {
-      process.stdout.write(JSON.stringify(result, null, 2) + "\n");
-      return;
-    }
-    console.log(`Repo:      ${result.repo.fullName}`);
-    console.log(`Expires:   ${result.token.expiresAt}`);
-    console.log(`Token:     ${result.token.token}`);
-    console.log("");
-    console.log(`Clone:     git clone https://x-access-token:${encodeURIComponent(result.token.token)}@github.com/${result.repo.fullName}.git`);
-  }
-});
-var remove = defineCommand17({
-  meta: {
-    name: "delete",
-    description: "Delete a DeepSpace-managed GitHub repo"
-  },
-  args: {
-    repoId: {
-      type: "positional",
-      description: "Repo id from `deepspace managed-repos list`",
-      required: true
-    },
-    yes: {
-      type: "boolean",
-      description: "Skip the confirmation prompt",
-      default: false
-    },
-    json: {
-      type: "boolean",
-      description: "Emit JSON instead of human output",
-      default: false
-    }
-  },
-  async run({ args }) {
-    if (!args.yes) {
-      try {
-        const ok = await confirm4(
-          "Delete this DeepSpace-managed GitHub repo? This removes the GitHub repository and counts against your daily delete quota."
-        );
-        if (!ok) {
-          console.log("Cancelled.");
-          return;
-        }
-      } catch (err) {
-        console.error(err.message);
-        process.exit(1);
-      }
-    }
-    const jwt = await ensureToken();
-    const result = await api2(
-      jwt,
-      `/api/github/repos/${encodeURIComponent(String(args.repoId))}`,
-      { method: "DELETE" }
-    );
-    if (args.json) {
-      process.stdout.write(JSON.stringify(result, null, 2) + "\n");
-      return;
-    }
-    console.log(`Deleted ${result.repo.fullName}`);
-    console.log(
-      `Delete quota: ${result.deletionQuota.deletedCount} / ${result.deletionQuota.limit} used today (${result.deletionQuota.remaining} remaining)`
-    );
-  }
-});
-var managed_repos_default = defineCommand17({
-  meta: {
-    name: "managed-repos",
-    description: "Create and manage DeepSpace-owned GitHub repos"
-  },
-  subCommands: {
-    list: list5,
-    create: create2,
-    token,
-    delete: remove
-  }
-});
-
 // src/cli/commands/library.ts
-import { defineCommand as defineCommand18 } from "citty";
-import { existsSync as existsSync12, readFileSync as readFileSync11 } from "fs";
-import { join as join13, resolve as resolve8 } from "path";
+import { defineCommand as defineCommand16 } from "citty";
+import { existsSync as existsSync11, readFileSync as readFileSync10 } from "fs";
+import { join as join12, resolve as resolve8 } from "path";
 import { parse as parseToml3 } from "smol-toml";
 import * as p6 from "@clack/prompts";
 var DEFAULT_LIBRARY_APP = "deepdotspace-site";
-var publish = defineCommand18({
+var publish = defineCommand16({
   meta: {
     name: "publish",
     description: "Publish the current app to the DeepSpace library"
@@ -4360,11 +3358,11 @@ var publish = defineCommand18({
     let appName = typeof args.app === "string" && args.app.trim() ? args.app.trim() : void 0;
     if (!appName) {
       const appDir = resolve8(typeof args.dir === "string" && args.dir ? args.dir : ".");
-      const wranglerPath = join13(appDir, "wrangler.toml");
-      if (!existsSync12(wranglerPath)) {
+      const wranglerPath = join12(appDir, "wrangler.toml");
+      if (!existsSync11(wranglerPath)) {
         return die("No --app provided and no wrangler.toml found. Either pass --app <name> or run from your app's directory.");
       }
-      const cfg = parseToml3(readFileSync11(wranglerPath, "utf-8"));
+      const cfg = parseToml3(readFileSync10(wranglerPath, "utf-8"));
       const nameRes = resolveAppName(cfg.name);
       if (!nameRes.ok) return die(`wrangler.toml: ${nameRes.reason}`);
       appName = nameRes.name;
@@ -4377,9 +3375,9 @@ var publish = defineCommand18({
     const tags = typeof args.tags === "string" && args.tags ? args.tags.split(",").map((t) => t.trim()).filter(Boolean) : void 0;
     const libraryApp = typeof args["library-app"] === "string" && args["library-app"] ? args["library-app"] : DEFAULT_LIBRARY_APP;
     const libraryHost = process.env.DEEPSPACE_LIBRARY_HOST ?? `https://${libraryApp}.app.space`;
-    let token2;
+    let token;
     try {
-      token2 = await ensureToken();
+      token = await ensureToken();
     } catch (err) {
       return die(err instanceof Error ? err.message : String(err));
     }
@@ -4399,7 +3397,7 @@ var publish = defineCommand18({
         method: "POST",
         headers: {
           "Content-Type": "application/json",
-          Authorization: `Bearer ${token2}`
+          Authorization: `Bearer ${token}`
         },
         body: JSON.stringify(payload)
       });
@@ -4425,7 +3423,7 @@ var publish = defineCommand18({
     p6.outro("Done");
   }
 });
-var unpublish = defineCommand18({
+var unpublish = defineCommand16({
   meta: {
     name: "unpublish",
     description: "Remove a library entry (owner or admin only)"
@@ -4455,9 +3453,9 @@ var unpublish = defineCommand18({
       process.exit(1);
     };
     if (!json) p6.intro("Unpublishing library entry");
-    let token2;
+    let token;
     try {
-      token2 = await ensureToken();
+      token = await ensureToken();
     } catch (err) {
       return die(err instanceof Error ? err.message : String(err));
     }
@@ -4465,7 +3463,7 @@ var unpublish = defineCommand18({
     const libraryHost = process.env.DEEPSPACE_LIBRARY_HOST ?? `https://${libraryApp}.app.space`;
     const res = await fetch(`${libraryHost}/api/actions/library.unpublish`, {
       method: "POST",
-      headers: { "Content-Type": "application/json", Authorization: `Bearer ${token2}` },
+      headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
       body: JSON.stringify({ templateHandle: String(args.handle) })
     });
     const body = await res.text();
@@ -4484,7 +3482,7 @@ var unpublish = defineCommand18({
     p6.outro("Done");
   }
 });
-var library_default = defineCommand18({
+var library_default = defineCommand16({
   meta: {
     name: "library",
     description: "Manage your DeepSpace library entries"
@@ -4495,86 +3493,14 @@ var library_default = defineCommand18({
   }
 });
 
-// src/cli/commands/admin.ts
-import { defineCommand as defineCommand19 } from "citty";
-import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync7 } from "fs";
-import { homedir as homedir6 } from "os";
-import { join as join14 } from "path";
-var AUTH_URL5 = process.env.DEEPSPACE_AUTH_URL ?? ENVS.prod.auth;
-var impersonate = defineCommand19({
-  meta: {
-    name: "impersonate",
-    description: "Store a short-lived CLI token for another user"
-  },
-  args: {
-    email: {
-      type: "string",
-      description: "Target user email",
-      required: false
-    },
-    userId: {
-      type: "string",
-      description: "Target user id",
-      required: false
-    },
-    secret: {
-      type: "string",
-      description: "Admin secret; defaults to DEEPSPACE_ADMIN_SECRET",
-      required: false
-    }
-  },
-  async run({ args }) {
-    const secret = args.secret ?? process.env.DEEPSPACE_ADMIN_SECRET;
-    if (!secret) {
-      console.error("Missing admin secret. Set DEEPSPACE_ADMIN_SECRET or pass --secret.");
-      process.exit(1);
-    }
-    if (!args.email && !args.userId) {
-      console.error("Pass --email or --userId.");
-      process.exit(1);
-    }
-    const res = await fetch(`${AUTH_URL5}/api/auth/admin/impersonate`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        Authorization: `Bearer ${secret}`
-      },
-      body: JSON.stringify({
-        email: args.email,
-        userId: args.userId
-      })
-    });
-    const data = await res.json().catch(() => ({}));
-    if (!res.ok || !data.token || !data.user) {
-      console.error(`Failed: ${data.error ?? `HTTP ${res.status}`}`);
-      process.exit(1);
-    }
-    const dir = join14(homedir6(), ".deepspace");
-    mkdirSync6(dir, { recursive: true });
-    writeFileSync7(TOKEN_PATH2, data.token, { mode: 384 });
-    console.log(`Impersonating ${data.user.name ?? data.user.email ?? data.user.id}`);
-    console.log(`Email:  ${data.user.email ?? "(none)"}`);
-    console.log(`UserID: ${data.user.id}`);
-  }
-});
-var admin_default = defineCommand19({
-  meta: {
-    name: "admin",
-    description: "Maintainer-only admin commands"
-  },
-  subCommands: {
-    impersonate
-  }
-});
-
 // src/cli/commands/feedback.ts
-import { defineCommand as defineCommand20 } from "citty";
+import { defineCommand as defineCommand17 } from "citty";
 import * as p7 from "@clack/prompts";
-import { existsSync as existsSync13, readFileSync as readFileSync12 } from "fs";
-import { dirname as dirname3, join as join15 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync11 } from "fs";
+import { dirname as dirname3, join as join13 } from "path";
 import { fileURLToPath } from "url";
 import { release } from "os";
-var API_URL5 = process.env.DEEPSPACE_API_URL ?? ENVS.prod.api;
+var API_URL4 = process.env.DEEPSPACE_API_URL ?? ENVS.prod.api;
 var TYPES = ["bug", "feature", "other"];
 var TYPE_LABELS = {
   bug: "Bug report",
@@ -4584,11 +3510,11 @@ var TYPE_LABELS = {
 var MAX_TITLE_LEN = 200;
 var MAX_BODY_LEN = 1e4;
 var MAX_CONTEXT_LEN = 200;
-async function api3(token2, path, init) {
-  const res = await fetch(`${API_URL5}${path}`, {
+async function api2(token, path, init) {
+  const res = await fetch(`${API_URL4}${path}`, {
     ...init,
     headers: {
-      Authorization: `Bearer ${token2}`,
+      Authorization: `Bearer ${token}`,
       "Content-Type": "application/json",
       ...init?.headers ?? {}
     }
@@ -4613,12 +3539,12 @@ function readCliVersion() {
   try {
     const here = dirname3(fileURLToPath(import.meta.url));
     const candidates = [
-      join15(here, "..", "package.json"),
-      join15(here, "..", "..", "..", "package.json")
+      join13(here, "..", "package.json"),
+      join13(here, "..", "..", "..", "package.json")
     ];
     for (const path of candidates) {
-      if (!existsSync13(path)) continue;
-      const pkg2 = JSON.parse(readFileSync12(path, "utf-8"));
+      if (!existsSync12(path)) continue;
+      const pkg2 = JSON.parse(readFileSync11(path, "utf-8"));
       if (pkg2.name === "deepspace" && pkg2.version) return pkg2.version;
     }
   } catch {
@@ -4669,7 +3595,7 @@ function buildFeedbackPayload(input) {
     ...input.context
   };
 }
-var feedback_default = defineCommand20({
+var feedback_default = defineCommand17({
   meta: {
     name: "feedback",
     description: "Submit a bug report, feature request, or feedback to DeepSpace"
@@ -4802,15 +3728,15 @@ Context: deepspace ${payload.cliVersion} \xB7 ${payload.nodeVersion} \xB7 ${payl
         process.exit(0);
       }
     }
-    let token2;
+    let token;
     try {
-      token2 = await ensureToken();
+      token = await ensureToken();
     } catch (err) {
       return fail(err.message ?? "Not signed in. Run `deepspace login`.");
     }
     let result;
     try {
-      result = await api3(token2, "/api/feedback", {
+      result = await api2(token, "/api/feedback", {
         method: "POST",
         body: JSON.stringify(payload)
       });
@@ -4832,11 +3758,11 @@ Context: deepspace ${payload.cliVersion} \xB7 ${payload.nodeVersion} \xB7 ${payl
 
 // src/cli/cli.ts
 var __dirname = dirname4(fileURLToPath2(import.meta.url));
-var pkg = JSON.parse(readFileSync13(join16(__dirname, "..", "package.json"), "utf-8"));
-if (process.platform === "linux" && !process.env.SSL_CERT_FILE && existsSync14("/etc/ssl/certs/ca-certificates.crt")) {
+var pkg = JSON.parse(readFileSync12(join14(__dirname, "..", "package.json"), "utf-8"));
+if (process.platform === "linux" && !process.env.SSL_CERT_FILE && existsSync13("/etc/ssl/certs/ca-certificates.crt")) {
   process.env.SSL_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt";
 }
-var create3 = defineCommand21({
+var create2 = defineCommand18({
   meta: {
     name: "create",
     description: "Create a new DeepSpace app"
@@ -4855,14 +3781,14 @@ var create3 = defineCommand21({
     execSync5(`npm create deepspace@latest${name}`, { stdio: "inherit" });
   }
 });
-var main = defineCommand21({
+var main = defineCommand18({
   meta: {
     name: "deepspace",
     version: pkg.version,
     description: "DeepSpace SDK CLI"
   },
   subCommands: {
-    create: create3,
+    create: create2,
     login: login_default,
     logout: logout_default,
     whoami: whoami_default,
@@ -4874,15 +3800,12 @@ var main = defineCommand21({
     add: add_default,
     skills: skills_default,
     integrations: integrations_default,
-    "managed-repos": managed_repos_default,
     invoke: invoke_default,
     deploy: deploy_default,
     undeploy: undeploy_default,
     domain: domain_default,
     library: library_default,
-    admin: admin_default,
-    feedback: feedback_default,
-    secrets: secrets_default
+    feedback: feedback_default
   }
   // No `run()` here — citty cascades parent run() AFTER subcommand finishes,
   // which corrupts agent-friendly output (`--json`) and prints noise on every