deepspace 0.5.0 → 0.5.2

package/dist/cli.js

@@ -1,16 +1,58 @@
 #!/usr/bin/env node
 
 // src/cli/cli.ts
-import { defineCommand as defineCommand20, runMain } from "citty";
+import { defineCommand as defineCommand22, runMain } from "citty";
 import { execSync as execSync4 } from "child_process";
-import { readFileSync as readFileSync14, existsSync as existsSync15 } from "fs";
+import { readFileSync as readFileSync14, existsSync as existsSync14 } from "fs";
 import { dirname as dirname4, join as join16 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
+// src/cli/lib/cli-errors.ts
+var API_ERROR_HINTS = {
+  not_app_owner: "Only the app owner can do this.",
+  app_not_found: "App not found. Check the app name (wrangler.toml `name`) and that it has been deployed.",
+  not_app_owner_or_collaborator: "You must be the app owner or a collaborator to do this.",
+  test_account_cannot_be_collaborator: "Test accounts cannot be added as collaborators. Use a real DeepSpace account.",
+  user_not_found: "No DeepSpace user with that email. New users must sign in and use DeepSpace once (e.g. run `deepspace whoami`) before they can be referenced by email."
+};
+function formatCliError(err) {
+  const message = err instanceof Error ? err.message : String(err);
+  const code = err?.code;
+  const slug = typeof code === "string" ? code : /^API \S+ \(\d+\): ([a-z0-9_]+)$/.exec(message)?.[1];
+  const hint = slug ? API_ERROR_HINTS[slug] : void 0;
+  return hint && !message.includes(hint) ? `${message}
+${hint}` : message;
+}
+function renderCliError(err) {
+  console.error(formatCliError(err));
+  if (process.env.DEBUG && err instanceof Error && err.stack) {
+    console.error("\n" + err.stack);
+  }
+  process.exit(1);
+}
+function wrapCommandErrors(cmd) {
+  const run2 = cmd.run;
+  if (run2) {
+    cmd.run = (async (ctx) => {
+      try {
+        await run2(ctx);
+      } catch (err) {
+        renderCliError(err);
+      }
+    });
+  }
+  if (cmd.subCommands && typeof cmd.subCommands === "object") {
+    for (const sub of Object.values(cmd.subCommands)) {
+      if (sub && typeof sub === "object") wrapCommandErrors(sub);
+    }
+  }
+  return cmd;
+}
+
 // src/cli/commands/login.ts
 import { defineCommand } from "citty";
-import { writeFileSync as writeFileSync4, mkdirSync } from "fs";
-import { join as join2 } from "path";
+import { writeFileSync as writeFileSync5, mkdirSync } from "fs";
+import { join as join3 } from "path";
 import { homedir } from "os";
 import { randomBytes, createHash } from "crypto";
 import * as p2 from "@clack/prompts";
@@ -33,12 +75,288 @@ function createSpinner() {
 }
 
 // src/cli/env.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
+
+// src/cli/lib/secrets.ts
+var GENERATED_SECRETS_DIVIDER = "# --- DeepSpace secrets cache: generated by `npx deepspace secrets`; do not edit manually ---";
+var SECRET_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var CONFIG_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+var MAX_SECRET_VALUE_BYTES = 32 * 1024;
+function validateConfigName(configName) {
+  if (!CONFIG_NAME_RE.test(configName)) {
+    throw new Error(
+      `Invalid config "${configName}". Use letters, numbers, underscores, or hyphens; start with a letter or number.`
+    );
+  }
+  return configName;
+}
+function validateSecretName(name) {
+  if (!SECRET_NAME_RE.test(name)) {
+    throw new Error(
+      `Invalid secret name "${name}". Use letters, numbers, and underscores; start with a letter or underscore.`
+    );
+  }
+  return name;
+}
+function validateSecretValue(key, value) {
+  if (new TextEncoder().encode(value).byteLength > MAX_SECRET_VALUE_BYTES) {
+    throw new Error(`Secret "${key}" exceeds ${MAX_SECRET_VALUE_BYTES} bytes`);
+  }
+}
+function defaultConfigNameForEnv(wranglerEnv) {
+  return wranglerEnv ?? "prd";
+}
+async function secretsApi(deployUrl, token, path, init = {}) {
+  const res = await fetch(`${deployUrl}/api/secrets${path}`, {
+    ...init,
+    headers: {
+      Authorization: `Bearer ${token}`,
+      "Content-Type": "application/json",
+      ...init.headers ?? {}
+    }
+  });
+  const body = await res.json().catch(() => ({}));
+  if (!res.ok) {
+    throw new Error(`Secrets API ${path} (${res.status}): ${body.error ?? "request failed"}`);
+  }
+  return body;
+}
+function listSecrets(deployUrl, token, appId, configName) {
+  return secretsApi(deployUrl, token, `/${appId}/configs/${encodeURIComponent(configName)}`);
+}
+function fetchSecretsValues(deployUrl, token, appId, configName) {
+  return secretsApi(deployUrl, token, `/${appId}/configs/${encodeURIComponent(configName)}/values`);
+}
+function getSecretPlain(deployUrl, token, appId, configName, key) {
+  return secretsApi(
+    deployUrl,
+    token,
+    `/${appId}/configs/${encodeURIComponent(configName)}/secrets/${encodeURIComponent(key)}?plain=true`
+  );
+}
+function setSecret(deployUrl, token, appId, configName, key, value) {
+  return secretsApi(
+    deployUrl,
+    token,
+    `/${appId}/configs/${encodeURIComponent(configName)}/secrets/${encodeURIComponent(key)}`,
+    { method: "PUT", body: JSON.stringify({ value }) }
+  );
+}
+function deleteSecret(deployUrl, token, appId, configName, key) {
+  return secretsApi(
+    deployUrl,
+    token,
+    `/${appId}/configs/${encodeURIComponent(configName)}/secrets/${encodeURIComponent(key)}`,
+    { method: "DELETE" }
+  );
+}
+function uploadSecrets(deployUrl, token, appId, configName, secrets, replace) {
+  return secretsApi(
+    deployUrl,
+    token,
+    `/${appId}/configs/${encodeURIComponent(configName)}/secrets`,
+    { method: "PUT", body: JSON.stringify({ secrets, replace }) }
+  );
+}
+function listConfigs(deployUrl, token, appId) {
+  return secretsApi(deployUrl, token, `/${appId}/configs`);
+}
+function createConfig(deployUrl, token, appId, configName, copyFrom) {
+  return secretsApi(deployUrl, token, `/${appId}/configs`, {
+    method: "POST",
+    body: JSON.stringify({ name: configName, ...copyFrom ? { copyFrom } : {} })
+  });
+}
+function deleteConfig(deployUrl, token, appId, configName) {
+  return secretsApi(deployUrl, token, `/${appId}/configs/${encodeURIComponent(configName)}`, {
+    method: "DELETE"
+  });
+}
+async function pullAppSecretsCache(deployUrl, token, appId, configName) {
+  try {
+    const { secrets } = await fetchSecretsValues(deployUrl, token, appId, configName);
+    return { appId, configName, values: secrets };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (msg.includes("(404)")) return null;
+    throw err;
+  }
+}
+function quoteDotenvValue(value) {
+  if (/^[A-Za-z0-9_./:@+-]*$/.test(value) && value !== "") return value;
+  const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r");
+  return `"${escaped}"`;
+}
+function renderSecretsCache(secrets, source) {
+  const keys = Object.keys(secrets).sort();
+  const lines = [
+    GENERATED_SECRETS_DIVIDER,
+    `# app ${source.appId} \xB7 config ${source.configName}`,
+    "# Use `npx deepspace secrets` to change these values."
+  ];
+  for (const key of keys) {
+    validateSecretValue(key, secrets[key]);
+    lines.push(`${key}=${quoteDotenvValue(secrets[key])}`);
+  }
+  return lines.join("\n");
+}
+function stripGeneratedSecretsCache(content) {
+  const idx = content.indexOf(GENERATED_SECRETS_DIVIDER);
+  if (idx === -1) return content;
+  return content.slice(0, idx).trimEnd() + "\n";
+}
+function parseSecretsUpload(content) {
+  const trimmed = content.trim();
+  if (!trimmed) return {};
+  if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
+    const parsed = JSON.parse(trimmed);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw new Error("JSON upload must be an object of KEY=value strings.");
+    }
+    const out2 = {};
+    for (const [key, value] of Object.entries(parsed)) {
+      validateSecretName(key);
+      if (typeof value !== "string") throw new Error(`Secret "${key}" must be a string`);
+      validateSecretValue(key, value);
+      out2[key] = value;
+    }
+    return out2;
+  }
+  const out = {};
+  for (const rawLine of trimmed.split("\n")) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#")) continue;
+    const eq = line.indexOf("=");
+    if (eq <= 0) continue;
+    const key = line.slice(0, eq).trim();
+    if (!SECRET_NAME_RE.test(key)) continue;
+    let value = line.slice(eq + 1).trim();
+    if (value.startsWith('"') && value.endsWith('"') && value.length >= 2) {
+      value = unescapeDotenv(value.slice(1, -1));
+    }
+    validateSecretValue(key, value);
+    out[key] = value;
+  }
+  return out;
+}
+function unescapeDotenv(v) {
+  let out = "";
+  for (let i = 0; i < v.length; i++) {
+    if (v[i] === "\\" && i + 1 < v.length) {
+      const c = v[++i];
+      out += c === "n" ? "\n" : c === "r" ? "\r" : c;
+    } else {
+      out += v[i];
+    }
+  }
+  return out;
+}
+function formatSecretsDownload(secrets, format) {
+  const entries = Object.entries(secrets).sort(([a], [b]) => a.localeCompare(b));
+  if (format === "json") {
+    return JSON.stringify(Object.fromEntries(entries), null, 2) + "\n";
+  }
+  if (format === "shell") {
+    return entries.map(([k, v]) => `export ${k}=${quoteDotenvValue(v)}`).join("\n") + "\n";
+  }
+  return entries.map(([k, v]) => `${k}=${quoteDotenvValue(v)}`).join("\n") + "\n";
+}
+async function refreshSecretsCache(deployUrl, token, appId, wranglerEnv) {
+  const configName = defaultConfigNameForEnv(wranglerEnv);
+  const pulled = await pullAppSecretsCache(deployUrl, token, appId, configName);
+  if (!pulled) return null;
+  const count = Object.keys(pulled.values).length;
+  return {
+    pulled,
+    rendered: renderSecretsCache(pulled.values, pulled),
+    summary: `Secrets: ${pulled.configName} (${count} secret${count === 1 ? "" : "s"})`
+  };
+}
+
+// src/cli/lib/app-identity.ts
+import { existsSync, readFileSync, writeFileSync } from "fs";
+import { join, resolve } from "path";
+import { parse as parseToml } from "smol-toml";
+var APP_ID_RE = /^app_[0-9A-HJKMNP-TV-Z]{26}$/;
+var CROCKFORD = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+function mintAppId(now = Date.now()) {
+  let ts = "";
+  let t = now;
+  for (let i = 0; i < 10; i++) {
+    ts = CROCKFORD[t % 32] + ts;
+    t = Math.floor(t / 32);
+  }
+  const rand = new Uint8Array(10);
+  crypto.getRandomValues(rand);
+  let rs = "";
+  let acc = 0;
+  let bits = 0;
+  for (const byte of rand) {
+    acc = acc << 8 | byte;
+    bits += 8;
+    while (bits >= 5) {
+      bits -= 5;
+      rs += CROCKFORD[acc >> bits & 31];
+    }
+  }
+  return `app_${ts}${rs}`.slice(0, 30);
+}
+function readAppId(cwd = process.cwd(), wranglerEnv) {
+  const wranglerPath = join(resolve(cwd), "wrangler.toml");
+  if (!existsSync(wranglerPath)) return null;
+  let cfg;
+  try {
+    cfg = parseToml(readFileSync(wranglerPath, "utf-8"));
+  } catch (err) {
+    throw new Error(
+      `Could not parse ${wranglerPath}: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  const vars = wranglerEnv ? cfg.env?.[wranglerEnv]?.vars : cfg.vars;
+  const id = vars?.DEEPSPACE_APP_ID;
+  return typeof id === "string" && APP_ID_RE.test(id) ? id : null;
+}
+function writeAppId(cwd, appId, opts = {}) {
+  const wranglerPath = join(resolve(cwd), "wrangler.toml");
+  if (!existsSync(wranglerPath)) {
+    throw new Error(`No wrangler.toml in ${resolve(cwd)}`);
+  }
+  const existing = readAppId(cwd, opts.wranglerEnv);
+  if (existing && !opts.force) {
+    if (existing === appId) return;
+    throw new Error(
+      `wrangler.toml already carries ${existing}. The app id is immutable \u2014 use --new-id only to fork this repo as a separate app.`
+    );
+  }
+  let src = readFileSync(wranglerPath, "utf-8");
+  const header = opts.wranglerEnv ? `[env.${opts.wranglerEnv}.vars]` : "[vars]";
+  const line = `DEEPSPACE_APP_ID = "${appId}"`;
+  const headerRe = new RegExp(`^\\${header.replace(/\./g, "\\.")}[ \\t]*$`, "m");
+  const idLineRe = /^DEEPSPACE_APP_ID\s*=.*$/m;
+  const match = headerRe.exec(src);
+  if (match) {
+    const blockStart = match.index + match[0].length;
+    const rest = src.slice(blockStart);
+    const nextSection = rest.search(/^\s*\[/m);
+    const blockEnd = nextSection === -1 ? src.length : blockStart + nextSection;
+    const block = src.slice(blockStart, blockEnd);
+    const newBlock = idLineRe.test(block) ? block.replace(idLineRe, line) : `
+${line}${block}`;
+    src = src.slice(0, blockStart) + newBlock + src.slice(blockEnd);
+  } else {
+    src = src.trimEnd() + `
+
+${header}
+${line}
+`;
+  }
+  writeFileSync(wranglerPath, src);
+}
 
 // src/cli/lib/secure-file.ts
-import { chmodSync, writeFileSync } from "fs";
+import { chmodSync, writeFileSync as writeFileSync2 } from "fs";
 function writeSecretFileSync(path, content) {
-  writeFileSync(path, content, { mode: 384 });
+  writeFileSync2(path, content, { mode: 384 });
   try {
     chmodSync(path, 384);
   } catch {
@@ -46,9 +364,9 @@ function writeSecretFileSync(path, content) {
 }
 
 // src/cli/lib/wrangler-env.ts
-import { existsSync, readFileSync, rmSync, writeFileSync as writeFileSync2 } from "fs";
-import { join } from "path";
-import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
+import { existsSync as existsSync2, readFileSync as readFileSync2, rmSync, writeFileSync as writeFileSync3 } from "fs";
+import { join as join2 } from "path";
+import { parse as parseToml2, stringify as stringifyToml } from "smol-toml";
 
 // src/server/rooms/app-name.ts
 var APP_NAME_RULES = {
@@ -146,35 +464,35 @@ function resolveAppNameForEnv(config, envName) {
   }
   return resolveAppName(envBlock.name);
 }
-function devVarsPathFor(appDir2, envName, opts = {}) {
-  if (opts.sharedDevVarsCache || !envName) return join(appDir2, ".dev.vars");
-  return join(appDir2, `.dev.vars.${envName}`);
+function devVarsPathFor(appDir, envName, opts = {}) {
+  if (opts.sharedDevVarsCache || !envName) return join2(appDir, ".dev.vars");
+  return join2(appDir, `.dev.vars.${envName}`);
 }
-function legacyEnvDevVarsPathFor(appDir2, envName) {
-  return envName ? join(appDir2, `.dev.vars.${envName}`) : void 0;
+function legacyEnvDevVarsPathFor(appDir, envName) {
+  return envName ? join2(appDir, `.dev.vars.${envName}`) : void 0;
 }
-function warnIfLegacyEnvDevVarsExists(appDir2, envName, warn = console.warn) {
-  const legacyPath = legacyEnvDevVarsPathFor(appDir2, envName);
-  if (!legacyPath || !existsSync(legacyPath)) return;
+function warnIfLegacyEnvDevVarsExists(appDir, envName, warn = console.warn) {
+  const legacyPath = legacyEnvDevVarsPathFor(appDir, envName);
+  if (!legacyPath || !existsSync2(legacyPath)) return;
   warn(
-    `Warning: ${legacyPath} exists, but DeepSpace now uses ${devVarsPathFor(appDir2, envName, { sharedDevVarsCache: true })} for every environment. This run will ignore ${legacyPath}; move any secrets you still need into .dev.vars, then remove the env-specific file when you're ready.`
+    `Warning: ${legacyPath} exists, but DeepSpace now uses ${devVarsPathFor(appDir, envName, { sharedDevVarsCache: true })} for every environment. This run will ignore ${legacyPath}; move any secrets you still need into .dev.vars, then remove the env-specific file when you're ready.`
   );
 }
-function prepareWranglerEnvConfig(appDir2, envName, opts = {}) {
+function prepareWranglerEnvConfig(appDir, envName, opts = {}) {
   if (!envName) return { cleanup() {
   } };
   if (!opts.sharedDevVarsCache) return { wranglerEnv: envName, cleanup() {
   } };
-  warnIfLegacyEnvDevVarsExists(appDir2, envName, opts.warn);
-  const config = readWranglerConfig(appDir2);
+  warnIfLegacyEnvDevVarsExists(appDir, envName, opts.warn);
+  const config = readWranglerConfig(appDir);
   const resolved = resolveAppNameForEnv(config, envName);
   if (!resolved.ok) throw new Error(resolved.reason);
   const flattened = flattenWranglerEnvConfig(config, envName);
-  const configPath = join(
-    appDir2,
+  const configPath = join2(
+    appDir,
     `.wrangler.deepspace.${safeGeneratedConfigSegment(envName)}.${process.pid}.${++generatedConfigSeq}.toml`
   );
-  writeFileSync2(
+  writeFileSync3(
     configPath,
     [
       "# Generated by DeepSpace for this CLI run.",
@@ -230,17 +548,17 @@ var WranglerConfigError = class extends Error {
     this.name = "WranglerConfigError";
   }
 };
-function readWranglerConfig(appDir2) {
-  const path = join(appDir2, "wrangler.toml");
-  const raw = readFileSync(path, "utf-8");
+function readWranglerConfig(appDir) {
+  const path = join2(appDir, "wrangler.toml");
+  const raw = readFileSync2(path, "utf-8");
   try {
-    return parseToml(raw);
+    return parseToml2(raw);
   } catch (err) {
     throw new WranglerConfigError(path, err);
   }
 }
-function hasWranglerConfig(appDir2) {
-  return existsSync(join(appDir2, "wrangler.toml"));
+function hasWranglerConfig(appDir) {
+  return existsSync2(join2(appDir, "wrangler.toml"));
 }
 
 // src/cli/env.ts
@@ -262,21 +580,12 @@ async function fetchPublicKey(authUrl) {
   }
   return data.publicKey;
 }
-function readAppName(appDir2, wranglerEnv2) {
-  if (!hasWranglerConfig(appDir2)) {
-    throw new Error("No wrangler.toml found. Are you in a DeepSpace app directory?");
-  }
-  const config = readWranglerConfig(appDir2);
-  const resolved = resolveAppNameForEnv(config, wranglerEnv2);
-  if (!resolved.ok) throw new Error(resolved.reason);
-  const rawName = wranglerEnv2 ? config.env?.[wranglerEnv2]?.name : config.name;
-  if (rawName !== resolved.name) {
-    const where = wranglerEnv2 ? `[env.${wranglerEnv2}].name` : "`name`";
-    throw new Error(
-      `wrangler.toml: ${where} "${rawName}" is not in canonical form. Update it to "${resolved.name}" and re-run.`
-    );
-  }
-  return resolved.name;
+function requireAppIdFor(appDir, wranglerEnv) {
+  const id = readAppId(appDir, wranglerEnv);
+  if (id) return id;
+  throw new Error(
+    "wrangler.toml has no DEEPSPACE_APP_ID" + (wranglerEnv ? ` for [env.${wranglerEnv}]` : "") + ". Run `deepspace init` (or `deepspace init --env <name>`) and retry."
+  );
 }
 async function mintAppOwnerJwt(authUrl, callerJwt, appName) {
   const res = await fetch(`${authUrl}/api/auth/mint-app-token`, {
@@ -285,7 +594,7 @@ async function mintAppOwnerJwt(authUrl, callerJwt, appName) {
       "Content-Type": "application/json",
       Authorization: `Bearer ${callerJwt}`
     },
-    body: JSON.stringify({ appName })
+    body: JSON.stringify({ appId: appName })
   });
   if (!res.ok) {
     const err = await res.text().catch(() => "");
@@ -299,6 +608,7 @@ async function mintAppOwnerJwt(authUrl, callerJwt, appName) {
 }
 async function fetchAppIdentityToken(deployUrl, callerJwt, appName) {
   const res = await fetch(`${deployUrl}/api/apps/${encodeURIComponent(appName)}/identity-token`, {
+    // appName carries the appId
     method: "POST",
     headers: { Authorization: `Bearer ${callerJwt}` }
   });
@@ -327,7 +637,6 @@ var SDK_MANAGED_KEYS = /* @__PURE__ */ new Set([
   "ALLOW_DEBUG_ROUTES"
 ]);
 var DEV_VARS_DIVIDER = "# --- not managed by the SDK; preserved across dev/test runs ---";
-var GENERATED_SECRETS_DIVIDER = "# --- DeepSpace secrets cache: generated by `npx deepspace secrets`; do not edit manually ---";
 function extractCustomDevVars(content) {
   const lines = content.split("\n");
   const out = [];
@@ -368,11 +677,6 @@ function extractCustomDevVars(content) {
   while (out.length && out[out.length - 1].trim() === "") out.pop();
   return out.join("\n");
 }
-function stripGeneratedSecretsCache(content) {
-  const idx = content.indexOf(GENERATED_SECRETS_DIVIDER);
-  if (idx < 0) return content;
-  return content.slice(0, idx).replace(/\s+$/u, "");
-}
 function removeDevVarsKeys(content, keys) {
   const lines = content.split("\n");
   const out = [];
@@ -488,12 +792,12 @@ function unescapeQuotedDevVar(value) {
   }
   return out;
 }
-async function writeDevVars(appDir2, ownerId, callerJwt, wranglerEnv2, opts = {}) {
+async function writeDevVars(appDir, ownerId, callerJwt, wranglerEnv, opts = {}) {
   const urls = PLATFORM_URLS;
   const publicKey = await fetchPublicKey(urls.auth);
-  const appName = readAppName(appDir2, wranglerEnv2);
-  const appOwnerJwt = await mintAppOwnerJwt(urls.auth, callerJwt, appName);
-  const appIdentityToken = await fetchAppIdentityToken(urls.deploy, callerJwt, appName);
+  const appId = opts.appId ?? requireAppIdFor(appDir, wranglerEnv);
+  const appOwnerJwt = await mintAppOwnerJwt(urls.auth, callerJwt, appId);
+  const appIdentityToken = await fetchAppIdentityToken(urls.deploy, callerJwt, appId);
   const sdkVars = [
     `AUTH_JWT_PUBLIC_KEY="${publicKey}"`,
     `AUTH_JWT_ISSUER=${urls.auth}/api/auth`,
@@ -508,20 +812,27 @@ async function writeDevVars(appDir2, ownerId, callerJwt, wranglerEnv2, opts = {}
     `ALLOW_DEBUG_ROUTES=true`
   ].join("\n");
   const useSharedDevVarsCache = opts.sharedDevVarsCache ?? opts.generatedSecretsCache !== void 0;
-  const devVarsPath = devVarsPathFor(appDir2, wranglerEnv2, {
+  const devVarsPath = devVarsPathFor(appDir, wranglerEnv, {
     sharedDevVarsCache: useSharedDevVarsCache
   });
-  const existing = existsSync2(devVarsPath) ? readFileSync2(devVarsPath, "utf-8") : "";
-  const custom = opts.generatedSecretsCache ?? extractCustomDevVars(stripGeneratedSecretsCache(existing));
-  const body = custom ? opts.generatedSecretsCache ? `${sdkVars}
+  const existing = existsSync3(devVarsPath) ? readFileSync3(devVarsPath, "utf-8") : "";
+  const custom = opts.generatedSecretsCache ?? extractCustomDevVars(stripGeneratedSecretsCache(existing).trimEnd());
+  let body;
+  if (!custom) {
+    body = `${sdkVars}
+`;
+  } else if (opts.generatedSecretsCache) {
+    body = `${sdkVars}
 
 ${custom}
-` : `${sdkVars}
+`;
+  } else {
+    body = `${sdkVars}
 
 ${DEV_VARS_DIVIDER}
 ${custom}
-` : `${sdkVars}
 `;
+  }
   writeSecretFileSync(devVarsPath, body);
 }
 
@@ -647,13 +958,13 @@ async function pollForCompletion(sessionId, codeVerifier) {
   return null;
 }
 function storeCredentials(sessionToken, jwt) {
-  const dir = join2(homedir(), ".deepspace");
+  const dir = join3(homedir(), ".deepspace");
   mkdirSync(dir, { recursive: true, mode: 448 });
-  writeFileSync4(join2(dir, "session"), sessionToken, { mode: 384 });
-  writeFileSync4(join2(dir, "token"), jwt, { mode: 384 });
+  writeFileSync5(join3(dir, "session"), sessionToken, { mode: 384 });
+  writeFileSync5(join3(dir, "token"), jwt, { mode: 384 });
 }
 function sleep(ms) {
-  return new Promise((resolve11) => setTimeout(resolve11, ms));
+  return new Promise((resolve10) => setTimeout(resolve10, ms));
 }
 function base64url(bytes) {
   return bytes.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
@@ -684,20 +995,20 @@ async function doEmailLogin(email, password) {
 
 // src/cli/commands/logout.ts
 import { defineCommand as defineCommand2 } from "citty";
-import { existsSync as existsSync3, readFileSync as readFileSync3, rmSync as rmSync2 } from "fs";
-import { join as join3 } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync4, rmSync as rmSync2 } from "fs";
+import { join as join4 } from "path";
 import { homedir as homedir2 } from "os";
 var AUTH_URL2 = process.env.DEEPSPACE_AUTH_URL ?? PLATFORM_URLS.auth;
-var DIR = join3(homedir2(), ".deepspace");
-var SESSION_PATH = join3(DIR, "session");
-var TOKEN_PATH = join3(DIR, "token");
+var DIR = join4(homedir2(), ".deepspace");
+var SESSION_PATH = join4(DIR, "session");
+var TOKEN_PATH = join4(DIR, "token");
 var logout_default = defineCommand2({
   meta: {
     name: "logout",
     description: "Sign out and remove cached credentials"
   },
   async run() {
-    const sessionToken = existsSync3(SESSION_PATH) ? readFileSync3(SESSION_PATH, "utf-8").trim() : null;
+    const sessionToken = existsSync4(SESSION_PATH) ? readFileSync4(SESSION_PATH, "utf-8").trim() : null;
     if (sessionToken) {
       try {
         await fetch(`${AUTH_URL2}/api/auth/sign-out`, {
@@ -712,7 +1023,7 @@ var logout_default = defineCommand2({
     }
     let removed = 0;
     for (const path of [SESSION_PATH, TOKEN_PATH]) {
-      if (existsSync3(path)) {
+      if (existsSync4(path)) {
         rmSync2(path);
         removed++;
       }
@@ -727,12 +1038,12 @@ var logout_default = defineCommand2({
 
 // src/cli/commands/dev.ts
 import { defineCommand as defineCommand3 } from "citty";
-import { resolve as resolve4, basename, join as join8 } from "path";
+import { resolve as resolve4, basename, join as join9 } from "path";
 import spawn from "cross-spawn";
 
 // src/cli/auth.ts
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync5, existsSync as existsSync4, mkdirSync as mkdirSync2 } from "fs";
-import { join as join4 } from "path";
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync6, existsSync as existsSync5, mkdirSync as mkdirSync2 } from "fs";
+import { join as join5 } from "path";
 import { homedir as homedir3 } from "os";
 
 // src/cli/jwt.ts
@@ -746,26 +1057,26 @@ function decodeJwtPayload(token) {
 
 // src/cli/auth.ts
 var AUTH_URL3 = process.env.DEEPSPACE_AUTH_URL ?? PLATFORM_URLS.auth;
-var DIR2 = join4(homedir3(), ".deepspace");
-var SESSION_PATH2 = join4(DIR2, "session");
-var TOKEN_PATH2 = join4(DIR2, "token");
+var DIR2 = join5(homedir3(), ".deepspace");
+var SESSION_PATH2 = join5(DIR2, "session");
+var TOKEN_PATH2 = join5(DIR2, "token");
 async function ensureToken() {
-  if (existsSync4(TOKEN_PATH2)) {
-    const existing = readFileSync4(TOKEN_PATH2, "utf-8").trim();
+  if (existsSync5(TOKEN_PATH2)) {
+    const existing = readFileSync5(TOKEN_PATH2, "utf-8").trim();
     if (isTokenValid(existing)) {
       return existing;
     }
   }
-  if (!existsSync4(SESSION_PATH2)) {
+  if (!existsSync5(SESSION_PATH2)) {
     throw new Error("Not logged in. Run `deepspace login` first.");
   }
-  const sessionToken = readFileSync4(SESSION_PATH2, "utf-8").trim();
+  const sessionToken = readFileSync5(SESSION_PATH2, "utf-8").trim();
   const token = await exchangeSession(AUTH_URL3, sessionToken);
   if (!token) {
     throw new Error("Session expired. Run `deepspace login` to re-authenticate.");
   }
   mkdirSync2(DIR2, { recursive: true, mode: 448 });
-  writeFileSync5(TOKEN_PATH2, token, { mode: 384 });
+  writeFileSync6(TOKEN_PATH2, token, { mode: 384 });
   return token;
 }
 function isTokenValid(jwt) {
@@ -779,24 +1090,26 @@ function isTokenValid(jwt) {
 
 // src/cli/lib/app-context.ts
 import {
-  existsSync as existsSync5,
-  readFileSync as readFileSync5,
+  existsSync as existsSync6,
+  readFileSync as readFileSync6,
   readdirSync,
-  writeFileSync as writeFileSync6,
+  writeFileSync as writeFileSync7,
   mkdirSync as mkdirSync3,
   renameSync,
   unlinkSync
 } from "fs";
-import { join as join5, resolve, dirname, isAbsolute, sep } from "path";
-import { parse as parseToml2 } from "smol-toml";
+import { join as join6, resolve as resolve2, dirname, isAbsolute, sep } from "path";
+import { parse as parseToml3 } from "smol-toml";
 function detectAppName(cwd = process.cwd()) {
-  const wranglerPath = join5(resolve(cwd), "wrangler.toml");
-  if (!existsSync5(wranglerPath)) return null;
+  const wranglerPath = join6(resolve2(cwd), "wrangler.toml");
+  if (!existsSync6(wranglerPath)) return null;
   try {
-    const cfg = parseToml2(readFileSync5(wranglerPath, "utf-8"));
+    const cfg = parseToml3(readFileSync6(wranglerPath, "utf-8"));
     return typeof cfg.name === "string" && cfg.name.length > 0 ? cfg.name : null;
-  } catch {
-    return null;
+  } catch (err) {
+    throw new Error(
+      `Could not parse ${wranglerPath}: ${err instanceof Error ? err.message : String(err)}`
+    );
   }
 }
 function requireAppName(explicit, cwd) {
@@ -808,9 +1121,9 @@ function requireAppName(explicit, cwd) {
   );
 }
 function findAppDir(start = process.cwd()) {
-  let dir = resolve(start);
+  let dir = resolve2(start);
   for (; ; ) {
-    if (existsSync5(join5(dir, "wrangler.toml"))) return dir;
+    if (existsSync6(join6(dir, "wrangler.toml"))) return dir;
     const parent = dirname(dir);
     if (parent === dir) return null;
     dir = parent;
@@ -818,7 +1131,7 @@ function findAppDir(start = process.cwd()) {
 }
 function findChildApps(dir) {
   try {
-    return readdirSync(dir, { withFileTypes: true }).filter((e) => e.isDirectory() && existsSync5(join5(dir, e.name, "wrangler.toml"))).map((e) => e.name).sort();
+    return readdirSync(dir, { withFileTypes: true }).filter((e) => e.isDirectory() && existsSync6(join6(dir, e.name, "wrangler.toml"))).map((e) => e.name).sort();
   } catch {
     return [];
   }
@@ -826,7 +1139,7 @@ function findChildApps(dir) {
 function writeLaunchFile(launchPath, config) {
   mkdirSync3(dirname(launchPath), { recursive: true });
   const tmpPath = `${launchPath}.${process.pid}.tmp`;
-  writeFileSync6(tmpPath, JSON.stringify(config, null, 2) + "\n");
+  writeFileSync7(tmpPath, JSON.stringify(config, null, 2) + "\n");
   try {
     renameSync(tmpPath, launchPath);
   } catch (err) {
@@ -839,15 +1152,15 @@ function writeLaunchFile(launchPath, config) {
 }
 function readLaunchFile(launchPath) {
   const empty = { version: "0.0.1", configurations: [] };
-  if (!existsSync5(launchPath)) return empty;
-  const raw = readFileSync5(launchPath, "utf-8").trim();
+  if (!existsSync6(launchPath)) return empty;
+  const raw = readFileSync6(launchPath, "utf-8").trim();
   if (!raw) return empty;
   const parsed = JSON.parse(raw);
   if (!parsed || typeof parsed !== "object" || !Array.isArray(parsed.configurations)) return null;
   return parsed;
 }
-function writeLaunchConfigIfMissing(appDir2, appName, port) {
-  const launchPath = join5(appDir2, ".claude", "launch.json");
+function writeLaunchConfigIfMissing(appDir, appName, port) {
+  const launchPath = join6(appDir, ".claude", "launch.json");
   try {
     const config = readLaunchFile(launchPath);
     if (!config) return;
@@ -862,8 +1175,8 @@ function writeLaunchConfigIfMissing(appDir2, appName, port) {
   } catch {
   }
 }
-function detectClaudeWorktree(appDir2) {
-  const segments = resolve(appDir2).split(sep);
+function detectClaudeWorktree(appDir) {
+  const segments = resolve2(appDir).split(sep);
   for (let i = segments.length - 3; i >= 1; i--) {
     if (segments[i] === ".claude" && segments[i + 1] === "worktrees" && segments[i + 2]) {
       return {
@@ -882,16 +1195,16 @@ function deriveWorktreePort(worktreeName) {
   for (const ch of worktreeName) hash = hash * 31 + ch.charCodeAt(0) >>> 0;
   return WORKTREE_PORT_MIN + hash % WORKTREE_PORT_RANGE;
 }
-function upsertWorktreeLaunchConfig(mainRepoRoot, worktreeName, appDir2, opts) {
-  const launchPath = join5(mainRepoRoot, ".claude", "launch.json");
+function upsertWorktreeLaunchConfig(mainRepoRoot, worktreeName, appDir, opts) {
+  const launchPath = join6(mainRepoRoot, ".claude", "launch.json");
   const entryName = WORKTREE_ENTRY_PREFIX + worktreeName;
   try {
     const config = readLaunchFile(launchPath);
     if (!config) return null;
-    const worktreesRoot = join5(mainRepoRoot, ".claude", "worktrees") + sep;
+    const worktreesRoot = join6(mainRepoRoot, ".claude", "worktrees") + sep;
     config.configurations = config.configurations.filter((c) => {
       if (c?.name === entryName) return false;
-      const isStaleWorktreeEntry = typeof c?.name === "string" && c.name.startsWith(WORKTREE_ENTRY_PREFIX) && typeof c.cwd === "string" && isAbsolute(c.cwd) && c.cwd.startsWith(worktreesRoot) && !existsSync5(c.cwd);
+      const isStaleWorktreeEntry = typeof c?.name === "string" && c.name.startsWith(WORKTREE_ENTRY_PREFIX) && typeof c.cwd === "string" && isAbsolute(c.cwd) && c.cwd.startsWith(worktreesRoot) && !existsSync6(c.cwd);
       return !isStaleWorktreeEntry;
     });
     let port = opts.port;
@@ -912,7 +1225,7 @@ function upsertWorktreeLaunchConfig(mainRepoRoot, worktreeName, appDir2, opts) {
       // the Claude Code desktop launch.json reference alongside `port`) and
       // verified end-to-end: with it set, the preview server builds from the
       // worktree instead of the session's main repo.
-      cwd: resolve(appDir2)
+      cwd: resolve2(appDir)
     });
     writeLaunchFile(launchPath, config);
     return { entryName, port };
@@ -920,11 +1233,11 @@ function upsertWorktreeLaunchConfig(mainRepoRoot, worktreeName, appDir2, opts) {
     return null;
   }
 }
-function resolveWorktreePort(appDir2) {
-  const worktree = detectClaudeWorktree(appDir2);
+function resolveWorktreePort(appDir) {
+  const worktree = detectClaudeWorktree(appDir);
   if (!worktree) return null;
   try {
-    const config = readLaunchFile(join5(worktree.mainRepoRoot, ".claude", "launch.json"));
+    const config = readLaunchFile(join6(worktree.mainRepoRoot, ".claude", "launch.json"));
     const entry = config?.configurations.find(
       (c) => c?.name === WORKTREE_ENTRY_PREFIX + worktree.worktreeName
     );
@@ -934,28 +1247,44 @@ function resolveWorktreePort(appDir2) {
   }
   return deriveWorktreePort(worktree.worktreeName);
 }
+function requireAppIdArg(explicit) {
+  if (explicit) {
+    if (!APP_ID_RE.test(explicit)) {
+      throw new Error(`"${explicit}" is not an app id (app_\u2026). Pass --app <appId>.`);
+    }
+    return explicit;
+  }
+  const appDir = findAppDir();
+  const id = appDir ? readAppId(appDir) : null;
+  if (!id) {
+    throw new Error(
+      "No app id. Run from an app directory whose wrangler.toml carries DEEPSPACE_APP_ID, or pass --app <appId>."
+    );
+  }
+  return id;
+}
 
 // src/cli/lib/install-status.ts
-import { existsSync as existsSync6, readFileSync as readFileSync6 } from "fs";
-import { join as join6 } from "path";
-function ensureInstallReady(appDir2) {
-  if (existsSync6(join6(appDir2, "node_modules", "deepspace", "package.json"))) return;
-  const sentinelDir = join6(appDir2, ".deepspace");
-  const errPath = join6(sentinelDir, "install.err");
-  const startedPath = join6(sentinelDir, "install.started");
-  const donePath = join6(sentinelDir, "install.done");
-  const logPath = join6(sentinelDir, "install.log");
-  if (existsSync6(errPath)) {
+import { existsSync as existsSync7, readFileSync as readFileSync7 } from "fs";
+import { join as join7 } from "path";
+function ensureInstallReady(appDir) {
+  if (existsSync7(join7(appDir, "node_modules", "deepspace", "package.json"))) return;
+  const sentinelDir = join7(appDir, ".deepspace");
+  const errPath = join7(sentinelDir, "install.err");
+  const startedPath = join7(sentinelDir, "install.started");
+  const donePath = join7(sentinelDir, "install.done");
+  const logPath = join7(sentinelDir, "install.log");
+  if (existsSync7(errPath)) {
     console.error("Background install failed:");
-    console.error(readFileSync6(errPath, "utf-8").trimEnd());
-    if (existsSync6(logPath)) console.error(`
+    console.error(readFileSync7(errPath, "utf-8").trimEnd());
+    if (existsSync7(logPath)) console.error(`
 Full log: ${logPath}`);
     console.error("\nRun `npm install` (or `bun install`) manually, then retry.");
     process.exit(1);
   }
-  if (existsSync6(startedPath) && !existsSync6(donePath)) {
+  if (existsSync7(startedPath) && !existsSync7(donePath)) {
     console.error("Dependencies are still installing in the background.");
-    if (existsSync6(logPath)) console.error(`Tail progress: tail -f ${logPath}`);
+    if (existsSync7(logPath)) console.error(`Tail progress: tail -f ${logPath}`);
     console.error("Retry once it finishes.");
     process.exit(1);
   }
@@ -965,26 +1294,35 @@ Full log: ${logPath}`);
 
 // src/cli/lib/preflight.ts
 import { execFileSync } from "child_process";
-import { existsSync as existsSync7 } from "fs";
-import { resolve as resolve2 } from "path";
+import { existsSync as existsSync8 } from "fs";
+import * as nodeModule from "module";
+import { resolve as resolve3 } from "path";
+function preflightNodeVersion(command, hasRegisterHooks = typeof nodeModule.registerHooks === "function") {
+  if (hasRegisterHooks) return;
+  console.error(
+    `deepspace ${command} requires Node 22.15 or newer (found v${process.versions.node}).`
+  );
+  console.error("Install the current LTS from https://nodejs.org and re-run.");
+  process.exit(1);
+}
 var DLL_NOT_FOUND = -1073741515;
-function preflightWindowsWorkerd(appDir2) {
+function preflightWindowsWorkerd(appDir) {
   if (process.platform !== "win32") return;
-  const workerdExe = resolve2(
-    appDir2,
+  const workerdExe = resolve3(
+    appDir,
     "node_modules",
     "@cloudflare",
     "workerd-windows-64",
     "bin",
     "workerd.exe"
   );
-  if (!existsSync7(workerdExe)) return;
+  if (!existsSync8(workerdExe)) return;
   try {
     execFileSync(workerdExe, ["--help"], { stdio: "pipe", timeout: 1e4 });
     return;
   } catch (err) {
-    const status2 = err.status;
-    if (status2 !== DLL_NOT_FOUND) return;
+    const status3 = err.status;
+    if (status3 !== DLL_NOT_FOUND) return;
     console.error("");
     console.error("  workerd (Cloudflare Workers runtime) cannot start on this system.");
     console.error("  It needs the Microsoft Visual C++ Redistributable, which is not installed.");
@@ -1000,728 +1338,33 @@ function preflightWindowsWorkerd(appDir2) {
   }
 }
 
-// src/cli/lib/secrets.ts
-import { existsSync as existsSync8, readFileSync as readFileSync7, writeFileSync as writeFileSync7 } from "fs";
-import { join as join7, resolve as resolve3 } from "path";
-
-// src/server/rooms/binding-manifest.ts
-var AUTO_PROVISION_SENTINEL = "auto";
-var VECTORIZE_METRICS = /* @__PURE__ */ new Set(["cosine", "euclidean", "dot-product"]);
-var ALLOWED_BINDING_TYPES = /* @__PURE__ */ new Set([
-  "vectorize",
-  "ai",
-  "r2_bucket",
-  "kv_namespace",
-  "d1",
-  "queue",
-  "browser_rendering",
-  "analytics_engine",
-  "hyperdrive"
-]);
-var RESERVED_BINDING_NAMES = /* @__PURE__ */ new Set([
-  "ASSETS",
-  "PLATFORM_WORKER",
-  "API_WORKER",
-  "APP_NAME",
-  "OWNER_USER_ID",
-  "AUTH_JWT_PUBLIC_KEY",
-  "AUTH_JWT_ISSUER",
-  "AUTH_WORKER_URL",
-  "APP_IDENTITY_TOKEN",
-  "APP_OWNER_JWT",
-  "USAGE_EVENTS"
-]);
-function validateBindingManifest(manifest) {
-  if (!Array.isArray(manifest)) {
-    return { valid: false, errors: [{ reason: "Manifest must be an array" }] };
+// src/cli/lib/macos-junk.ts
+import { readdirSync as readdirSync2, rmSync as rmSync3 } from "fs";
+import { join as join8 } from "path";
+var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", ".wrangler", ".vite"]);
+function removeMacosJunk(dir) {
+  let removed = 0;
+  let entries;
+  try {
+    entries = readdirSync2(dir, { withFileTypes: true });
+  } catch {
+    return removed;
   }
-  const errors = [];
-  const seenNames = /* @__PURE__ */ new Set();
-  for (const entry of manifest) {
-    if (!entry || typeof entry !== "object") {
-      errors.push({ reason: `Entry must be an object (got ${entry === null ? "null" : typeof entry})` });
-      continue;
-    }
-    const e = entry;
-    const type = e.type;
-    const name = e.name;
-    if (typeof type !== "string" || !ALLOWED_BINDING_TYPES.has(type)) {
-      errors.push({
-        reason: `Disallowed binding type: ${typeof type === "string" ? type : `(${typeof type})`}. Allowed: ${[...ALLOWED_BINDING_TYPES].sort().join(", ")}`
-      });
-      continue;
-    }
-    if (typeof name !== "string" || !name) {
-      errors.push({ reason: `Binding of type "${type}" missing 'name' (string)` });
-      continue;
-    }
-    if (RESERVED_BINDING_NAMES.has(name)) {
-      errors.push({ reason: `Binding name "${name}" is reserved by the SDK` });
+  for (const entry of entries) {
+    const path = join8(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (!SKIP_DIRS.has(entry.name)) removed += removeMacosJunk(path);
       continue;
     }
-    if (seenNames.has(name)) {
-      errors.push({ reason: `Duplicate binding name "${name}"` });
-      continue;
+    if (entry.name === ".DS_Store" || entry.name.startsWith("._")) {
+      try {
+        rmSync3(path, { force: true });
+        removed++;
+      } catch {
+      }
     }
-    seenNames.add(name);
-    const binding = entry;
-    const fieldErr = requiredFieldError(binding);
-    if (fieldErr) errors.push({ binding, reason: fieldErr });
   }
-  if (errors.length) return { valid: false, errors };
-  return { valid: true, bindings: manifest };
-}
-function requiredFieldError(b) {
-  switch (b.type) {
-    case "vectorize": {
-      if (!b.index_name) return `vectorize binding "${b.name}" missing index_name (or "auto")`;
-      if (b.index_name === AUTO_PROVISION_SENTINEL) {
-        if (typeof b.dimensions !== "number" || b.dimensions <= 0) {
-          return `vectorize binding "${b.name}" with index_name="auto" requires "dimensions" (positive number)`;
-        }
-        if (!b.metric || !VECTORIZE_METRICS.has(b.metric)) {
-          return `vectorize binding "${b.name}" with index_name="auto" requires "metric" (one of: ${[...VECTORIZE_METRICS].join(", ")})`;
-        }
-      }
-      return null;
-    }
-    case "r2_bucket":
-      return b.bucket_name ? null : `r2_bucket binding "${b.name}" missing bucket_name (or "auto")`;
-    case "kv_namespace": {
-      if (!b.namespace_id) return `kv_namespace binding "${b.name}" missing namespace_id (or "auto")`;
-      if (b.namespace_id === AUTO_PROVISION_SENTINEL && !b.title) {
-        return `kv_namespace binding "${b.name}" with namespace_id="auto" requires "title"`;
-      }
-      return null;
-    }
-    case "d1": {
-      if (!b.id) return `d1 binding "${b.name}" missing id (or "auto")`;
-      if (b.id === AUTO_PROVISION_SENTINEL && !b.database_name) {
-        return `d1 binding "${b.name}" with id="auto" requires "database_name"`;
-      }
-      return null;
-    }
-    case "queue":
-      return b.queue_name ? null : `queue binding "${b.name}" missing queue_name (or "auto")`;
-    case "hyperdrive":
-      if (!b.id) return `hyperdrive binding "${b.name}" missing id`;
-      if (b.id === AUTO_PROVISION_SENTINEL) {
-        return `hyperdrive binding "${b.name}": auto-provisioning not yet supported (provide a real id)`;
-      }
-      return null;
-    case "ai":
-    case "browser_rendering":
-    case "analytics_engine":
-      return null;
-    // no required fields beyond `name`
-    default: {
-      const _exhaustive = b;
-      void _exhaustive;
-      return null;
-    }
-  }
-}
-function bindingManifestFromOutputConfig(outputConfig) {
-  const out = [];
-  const aiBinding = pluckString(outputConfig.ai, "binding");
-  if (aiBinding) out.push({ type: "ai", name: aiBinding });
-  for (const v of asObjectArray(outputConfig.vectorize)) {
-    const name = pluckString(v, "binding");
-    const index_name = pluckString(v, "index_name");
-    if (!name || !index_name) continue;
-    const dimensions = pluckNumber(v, "dimensions");
-    const metric = pluckString(v, "metric");
-    out.push({
-      type: "vectorize",
-      name,
-      index_name,
-      ...dimensions != null && { dimensions },
-      ...metric && (metric === "cosine" || metric === "euclidean" || metric === "dot-product") && { metric }
-    });
-  }
-  for (const r of asObjectArray(outputConfig.r2_buckets)) {
-    const name = pluckString(r, "binding");
-    const bucket_name = pluckString(r, "bucket_name");
-    if (name && bucket_name) out.push({ type: "r2_bucket", name, bucket_name });
-  }
-  for (const k of asObjectArray(outputConfig.kv_namespaces)) {
-    const name = pluckString(k, "binding");
-    const namespace_id = pluckString(k, "id");
-    if (!name || !namespace_id) continue;
-    const title = pluckString(k, "title");
-    out.push({
-      type: "kv_namespace",
-      name,
-      namespace_id,
-      ...title && { title }
-    });
-  }
-  for (const d of asObjectArray(outputConfig.d1_databases)) {
-    const name = pluckString(d, "binding");
-    const id = pluckString(d, "database_id");
-    if (!name || !id) continue;
-    const database_name = pluckString(d, "database_name");
-    out.push({
-      type: "d1",
-      name,
-      id,
-      ...database_name && { database_name }
-    });
-  }
-  const queues = isObject(outputConfig.queues) ? outputConfig.queues : null;
-  for (const q of asObjectArray(queues?.producers)) {
-    const name = pluckString(q, "binding");
-    const queue_name = pluckString(q, "queue");
-    if (name && queue_name) out.push({ type: "queue", name, queue_name });
-  }
-  const browserBinding = pluckString(outputConfig.browser, "binding");
-  if (browserBinding) out.push({ type: "browser_rendering", name: browserBinding });
-  for (const a of asObjectArray(outputConfig.analytics_engine_datasets)) {
-    const name = pluckString(a, "binding");
-    const dataset = pluckString(a, "dataset");
-    if (name) out.push({ type: "analytics_engine", name, dataset: dataset ?? void 0 });
-  }
-  for (const h of asObjectArray(outputConfig.hyperdrive)) {
-    const name = pluckString(h, "binding");
-    const id = pluckString(h, "id");
-    if (name && id) out.push({ type: "hyperdrive", name, id });
-  }
-  return out;
-}
-function isObject(v) {
-  return v !== null && typeof v === "object" && !Array.isArray(v);
-}
-function pluckString(v, key) {
-  if (!isObject(v)) return null;
-  const val = v[key];
-  return typeof val === "string" && val.length > 0 ? val : null;
-}
-function pluckNumber(v, key) {
-  if (!isObject(v)) return null;
-  const val = v[key];
-  return typeof val === "number" && Number.isFinite(val) ? val : null;
-}
-function asObjectArray(v) {
-  if (!Array.isArray(v)) return [];
-  return v.filter(isObject);
-}
-
-// src/cli/lib/secrets.ts
-var DEEPSPACE_SECRETS_PROJECT_VAR = "DEEPSPACE_SECRETS_PROJECT";
-var DEEPSPACE_SECRETS_CONFIG_VAR = "DEEPSPACE_SECRETS_CONFIG";
-var GENERATED_SECRETS_DIVIDER2 = "# --- DeepSpace secrets cache: generated by `npx deepspace secrets`; do not edit manually ---";
-var REQUIRED_SECRETS_BEGIN = "# --- DeepSpace detected secrets (names only; values live in `npx deepspace secrets`) ---";
-var REQUIRED_SECRETS_END = "# --- end DeepSpace detected secrets ---";
-var SECRET_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
-var PROJECT_NAME_RE = /^[a-z0-9][a-z0-9-]{0,62}$/;
-var CONFIG_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
-var MAX_SECRET_VALUE_BYTES = 32 * 1024;
-function validateProjectName(projectName) {
-  const trimmed = projectName.trim();
-  if (!PROJECT_NAME_RE.test(trimmed)) {
-    throw new Error(
-      `Invalid secrets project "${projectName}". Use lowercase letters, numbers, and hyphens; start with a letter or number.`
-    );
-  }
-  return trimmed;
-}
-function validateConfigName(configName) {
-  const trimmed = configName.trim();
-  if (!CONFIG_NAME_RE.test(trimmed)) {
-    throw new Error(
-      `Invalid secrets config "${configName}". Use letters, numbers, underscores, or hyphens; start with a letter or number.`
-    );
-  }
-  return trimmed;
-}
-function validateSecretName(name) {
-  const trimmed = name.trim();
-  if (!SECRET_NAME_RE.test(trimmed)) {
-    throw new Error(
-      `Invalid secret name "${name}". Secret names must use letters, numbers, and underscores, and may not start with a number.`
-    );
-  }
-  if (RESERVED_BINDING_NAMES.has(trimmed)) {
-    throw new Error(`"${trimmed}" is reserved by DeepSpace and cannot be used as an app secret.`);
-  }
-  return trimmed;
-}
-function validateSecretValue(key, value) {
-  const bytes = new TextEncoder().encode(value).byteLength;
-  if (bytes > MAX_SECRET_VALUE_BYTES) {
-    throw new Error(`Secret "${key}" exceeds ${MAX_SECRET_VALUE_BYTES} bytes.`);
-  }
-}
-function defaultConfigNameForEnv(wranglerEnv2) {
-  return wranglerEnv2 ? validateConfigName(wranglerEnv2) : "prd";
-}
-function readTopLevelAppName(appDir2) {
-  const cfg = readWranglerConfig(appDir2);
-  const resolved = resolveAppNameForEnv(cfg, void 0);
-  if (!resolved.ok) throw new Error(resolved.reason);
-  if (cfg.name !== resolved.name) {
-    throw new Error(
-      `wrangler.toml: \`name\` "${cfg.name}" is not in canonical form. Update it to "${resolved.name}" and re-run.`
-    );
-  }
-  return resolved.name;
-}
-function resolveSecretsAppName(appDir2, wranglerEnv2) {
-  const cfg = readWranglerConfig(appDir2);
-  const resolved = resolveAppNameForEnv(cfg, wranglerEnv2);
-  if (!resolved.ok) throw new Error(resolved.reason);
-  return resolved.name;
-}
-function stringVar(value) {
-  return typeof value === "string" && value.trim() ? value.trim() : void 0;
-}
-function resolveSecretsLink(appDir2, wranglerEnv2) {
-  const cfg = readWranglerConfig(appDir2);
-  const defaultProjectName = readTopLevelAppName(appDir2);
-  const defaultConfigName = defaultConfigNameForEnv(wranglerEnv2);
-  const topVars = cfg.vars ?? {};
-  const envVars = wranglerEnv2 ? cfg.env?.[wranglerEnv2]?.vars ?? {} : {};
-  const projectName = stringVar(envVars[DEEPSPACE_SECRETS_PROJECT_VAR]) ?? stringVar(topVars[DEEPSPACE_SECRETS_PROJECT_VAR]);
-  if (!projectName) {
-    return { linked: false, defaultProjectName, defaultConfigName, wranglerEnv: wranglerEnv2 };
-  }
-  const configName = stringVar(envVars[DEEPSPACE_SECRETS_CONFIG_VAR]) ?? (wranglerEnv2 ? defaultConfigName : stringVar(topVars[DEEPSPACE_SECRETS_CONFIG_VAR]) ?? "prd");
-  return {
-    linked: true,
-    projectName: validateProjectName(projectName),
-    configName: validateConfigName(configName),
-    wranglerEnv: wranglerEnv2
-  };
-}
-function resolveSecretsTarget(appDir2, opts) {
-  const link = resolveSecretsLink(appDir2, opts.wranglerEnv);
-  const projectName = validateProjectName(
-    opts.project ?? (link.linked ? link.projectName : link.defaultProjectName)
-  );
-  const configName = validateConfigName(
-    opts.config ?? (link.linked ? link.configName : link.defaultConfigName)
-  );
-  return { projectName, configName, wranglerEnv: opts.wranglerEnv };
-}
-function renderSecretsCache(secrets, source) {
-  const keys = Object.keys(secrets).sort();
-  const lines = [
-    GENERATED_SECRETS_DIVIDER2,
-    `# Source: project=${source.projectName} config=${source.configName}`,
-    `# Pulled: ${source.pulledAt ?? (/* @__PURE__ */ new Date()).toISOString()}`,
-    "# Use `npx deepspace secrets` to change these values."
-  ];
-  for (const key of keys) {
-    validateSecretName(key);
-    validateSecretValue(key, secrets[key]);
-    lines.push(`${key}=${quoteDotenvValue(secrets[key])}`);
-  }
-  return lines.join("\n");
-}
-function stripGeneratedSecretsCache2(content) {
-  const idx = content.indexOf(GENERATED_SECRETS_DIVIDER2);
-  if (idx < 0) return content.replace(/\s+$/u, "");
-  return content.slice(0, idx).replace(/\s+$/u, "");
-}
-function formatSecretsDownload(secrets, format) {
-  const entries = Object.entries(secrets).sort(([a], [b]) => a.localeCompare(b));
-  switch (format) {
-    case "json":
-    case "dotnet-json":
-      return JSON.stringify(Object.fromEntries(entries), null, 2) + "\n";
-    case "env":
-      return entries.map(([key, value]) => `${key}=${quoteDotenvValue(value)}`).join("\n") + "\n";
-    case "env-no-quotes":
-    case "docker":
-      return entries.map(([key, value]) => `${key}=${value}`).join("\n") + "\n";
-    case "yaml":
-      return entries.map(([key, value]) => `${key}: ${JSON.stringify(value)}`).join("\n") + "\n";
-  }
-}
-function writeSecretsCacheFile(appDir2, secrets, source) {
-  const devVarsPath = secretsCacheFilePath(appDir2);
-  const existing = existsSync8(devVarsPath) ? readFileSync7(devVarsPath, "utf-8") : "";
-  const head = stripGeneratedSecretsCache2(existing);
-  const rendered = renderSecretsCache(secrets, source);
-  writeSecretFileSync(devVarsPath, head ? `${head}
-
-${rendered}
-` : `${rendered}
-`);
-}
-function clearSecretsCacheFile(appDir2) {
-  const devVarsPath = secretsCacheFilePath(appDir2);
-  if (!existsSync8(devVarsPath)) return;
-  const existing = readFileSync7(devVarsPath, "utf-8");
-  const next = stripGeneratedSecretsCache2(existing);
-  writeSecretFileSync(devVarsPath, next ? `${next}
-` : "");
-}
-function secretsTargetMatchesLink(appDir2, target) {
-  const link = resolveSecretsLink(appDir2, target.wranglerEnv);
-  return link.linked && link.projectName === target.projectName && link.configName === target.configName;
-}
-function appScopedSecretsApiOptions(appDir2, target) {
-  const link = resolveSecretsLink(appDir2, target.wranglerEnv);
-  if (!link.linked || link.projectName !== target.projectName) return {};
-  return { appName: resolveSecretsAppName(appDir2, target.wranglerEnv) };
-}
-function secretsCacheFilePath(appDir2) {
-  return join7(appDir2, ".dev.vars");
-}
-async function pullLinkedSecretsCache(deployUrl, token, appDir2, wranglerEnv2) {
-  const link = resolveSecretsLink(appDir2, wranglerEnv2);
-  if (!link.linked) return null;
-  const values = await fetchSecretsValues(deployUrl, token, link.projectName, link.configName, {
-    appName: resolveSecretsAppName(appDir2, wranglerEnv2)
-  });
-  return {
-    linked: true,
-    projectName: link.projectName,
-    configName: link.configName,
-    wranglerEnv: wranglerEnv2,
-    values
-  };
-}
-async function fetchSecretsValues(deployUrl, token, projectName, configName, options = {}) {
-  const body = await secretsApi(
-    deployUrl,
-    token,
-    `/api/secrets/${encodeURIComponent(projectName)}/configs/${encodeURIComponent(configName)}/values`,
-    {},
-    options
-  );
-  return body.secrets;
-}
-async function listSecrets(deployUrl, token, projectName, configName, options = {}) {
-  return secretsApi(
-    deployUrl,
-    token,
-    `/api/secrets/${encodeURIComponent(projectName)}/configs/${encodeURIComponent(configName)}`,
-    {},
-    options
-  );
-}
-async function getSecretPlain(deployUrl, token, projectName, configName, key, options = {}) {
-  const body = await secretsApi(
-    deployUrl,
-    token,
-    `/api/secrets/${encodeURIComponent(projectName)}/configs/${encodeURIComponent(configName)}/secrets/${encodeURIComponent(key)}?plain=true`,
-    {},
-    options
-  );
-  return body.value;
-}
-async function deleteSecret(deployUrl, token, projectName, configName, key, options = {}) {
-  await secretsApi(
-    deployUrl,
-    token,
-    `/api/secrets/${encodeURIComponent(projectName)}/configs/${encodeURIComponent(configName)}/secrets/${encodeURIComponent(key)}`,
-    { method: "DELETE" },
-    options
-  );
-}
-async function uploadSecrets(deployUrl, token, projectName, configName, secrets, replace, options = {}) {
-  await secretsApi(
-    deployUrl,
-    token,
-    `/api/secrets/${encodeURIComponent(projectName)}/configs/${encodeURIComponent(configName)}/secrets`,
-    {
-      method: "PUT",
-      body: JSON.stringify({ secrets, replace })
-    },
-    options
-  );
-}
-async function listConfigs(deployUrl, token, projectName, options = {}) {
-  const body = await secretsApi(
-    deployUrl,
-    token,
-    `/api/secrets/${encodeURIComponent(projectName)}/configs`,
-    {},
-    options
-  );
-  return body.configs;
-}
-async function createConfig(deployUrl, token, projectName, configName, copyFromConfigName, options = {}) {
-  return secretsApi(
-    deployUrl,
-    token,
-    `/api/secrets/${encodeURIComponent(projectName)}/configs`,
-    {
-      method: "POST",
-      body: JSON.stringify({
-        name: configName,
-        ...copyFromConfigName ? { copyFrom: copyFromConfigName } : {}
-      })
-    },
-    options
-  );
-}
-async function deleteConfig(deployUrl, token, projectName, configName, options = {}) {
-  await secretsApi(
-    deployUrl,
-    token,
-    `/api/secrets/${encodeURIComponent(projectName)}/configs/${encodeURIComponent(configName)}`,
-    { method: "DELETE" },
-    options
-  );
-}
-async function setServerSecretsLink(deployUrl, token, appName, projectName) {
-  await secretsApi(deployUrl, token, `/api/secrets-links/${encodeURIComponent(appName)}`, {
-    method: "PUT",
-    body: JSON.stringify({ projectName })
-  });
-}
-async function clearServerSecretsLink(deployUrl, token, appName) {
-  await secretsApi(deployUrl, token, `/api/secrets-links/${encodeURIComponent(appName)}`, {
-    method: "DELETE"
-  });
-}
-function parseSecretsUpload(content) {
-  const trimmed = content.trim();
-  if (!trimmed) return {};
-  if (trimmed.startsWith("{")) {
-    const parsed2 = JSON.parse(trimmed);
-    if (!parsed2 || typeof parsed2 !== "object" || Array.isArray(parsed2)) {
-      throw new Error("JSON upload must be an object of KEY=value strings.");
-    }
-    const out2 = {};
-    for (const [key, value] of Object.entries(parsed2)) {
-      const name = validateSecretName(key);
-      if (typeof value !== "string") {
-        throw new Error(`Secret "${name}" must be a string.`);
-      }
-      validateSecretValue(name, value);
-      out2[name] = value;
-    }
-    return out2;
-  }
-  const parsed = parseDevVars(content);
-  const out = {};
-  for (const [key, value] of Object.entries(parsed)) {
-    const name = validateSecretName(key);
-    validateSecretValue(name, value);
-    out[name] = value;
-  }
-  return out;
-}
-function writeWranglerSecretsLink(appDir2, target, opts = {}) {
-  const path = join7(resolve3(appDir2), "wrangler.toml");
-  const raw = readFileSync7(path, "utf-8");
-  const table = target.wranglerEnv ? `env.${target.wranglerEnv}.vars` : "vars";
-  const vars = {
-    [DEEPSPACE_SECRETS_CONFIG_VAR]: target.configName
-  };
-  if (!target.wranglerEnv || opts.projectOverride) {
-    vars[DEEPSPACE_SECRETS_PROJECT_VAR] = target.projectName;
-  } else {
-    const link = resolveSecretsLink(appDir2, void 0);
-    if (!link.linked) {
-      vars[DEEPSPACE_SECRETS_PROJECT_VAR] = target.projectName;
-    }
-  }
-  writeFileSync7(path, setTomlVars(raw, table, vars));
-}
-function removeWranglerSecretsLink(appDir2, wranglerEnv2) {
-  removeWranglerSecretsLinkKeys(appDir2, wranglerEnv2, ["project", "config"]);
-}
-function removeWranglerSecretsLinkKeys(appDir2, wranglerEnv2, keys) {
-  const path = join7(resolve3(appDir2), "wrangler.toml");
-  const raw = readFileSync7(path, "utf-8");
-  const table = wranglerEnv2 ? `env.${wranglerEnv2}.vars` : "vars";
-  const vars = {};
-  if (keys.includes("project")) vars[DEEPSPACE_SECRETS_PROJECT_VAR] = void 0;
-  if (keys.includes("config")) vars[DEEPSPACE_SECRETS_CONFIG_VAR] = void 0;
-  if (Object.keys(vars).length === 0) return;
-  writeFileSync7(path, setTomlVars(raw, table, vars));
-}
-function updateWranglerRequiredSecrets(appDir2, secretNames, opts = {}) {
-  const path = join7(resolve3(appDir2), "wrangler.toml");
-  const raw = readFileSync7(path, "utf-8");
-  const existing = readRequiredSecretNamesFromToml(raw);
-  const incoming = normalizeRequiredSecretNames(secretNames);
-  const next = opts.replace ? incoming : normalizeRequiredSecretNames([...existing, ...incoming]);
-  writeFileSync7(
-    path,
-    setRequiredSecretNamesInToml(raw, next, existing.length > 0 || hasRequiredSecretsBlock(raw))
-  );
-  return next;
-}
-function removeWranglerRequiredSecrets(appDir2, secretNames) {
-  const path = join7(resolve3(appDir2), "wrangler.toml");
-  const raw = readFileSync7(path, "utf-8");
-  const remove2 = new Set(normalizeRequiredSecretNames(secretNames));
-  const next = readRequiredSecretNamesFromToml(raw).filter((key) => !remove2.has(key));
-  writeFileSync7(path, setRequiredSecretNamesInToml(raw, next, hasRequiredSecretsBlock(raw)));
-  return next;
-}
-function quoteDotenvValue(value) {
-  if (value === "") return '""';
-  if (/^[^\s"'#=]+$/u.test(value)) return value;
-  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
-}
-var SecretsApiError = class extends Error {
-  status;
-  detail;
-  constructor(path, status2, detail) {
-    super(`Secrets API ${path} (${status2}): ${detail}`);
-    this.name = "SecretsApiError";
-    this.status = status2;
-    this.detail = detail;
-  }
-};
-async function secretsApi(deployUrl, token, path, init = {}, options = {}) {
-  const scopedPath = withSecretsApiOptions(path, options);
-  let res = await fetch(`${deployUrl}${scopedPath}`, {
-    ...init,
-    headers: {
-      Authorization: `Bearer ${token}`,
-      "Content-Type": "application/json",
-      ...init.headers ?? {}
-    }
-  });
-  let text2 = await res.text();
-  const parsedError = parseSecretsApiError(text2);
-  if (!res.ok && res.status === 404 && parsedError === "app_not_found" && options.appName) {
-    res = await fetch(`${deployUrl}${path}`, {
-      ...init,
-      headers: {
-        Authorization: `Bearer ${token}`,
-        "Content-Type": "application/json",
-        ...init.headers ?? {}
-      }
-    });
-    text2 = await res.text();
-  }
-  if (!res.ok) {
-    let detail = text2;
-    try {
-      detail = JSON.parse(text2).error ?? text2;
-    } catch {
-    }
-    throw new SecretsApiError(path, res.status, detail);
-  }
-  if (!text2) return void 0;
-  return JSON.parse(text2);
-}
-function withSecretsApiOptions(path, options) {
-  if (!options.appName) return path;
-  const sep2 = path.includes("?") ? "&" : "?";
-  return `${path}${sep2}appName=${encodeURIComponent(options.appName)}`;
-}
-function parseSecretsApiError(text2) {
-  try {
-    const parsed = JSON.parse(text2);
-    return typeof parsed.error === "string" ? parsed.error : null;
-  } catch {
-    return null;
-  }
-}
-function setTomlVars(raw, table, vars) {
-  const lines = raw.replace(/\r\n/g, "\n").split("\n");
-  const header = `[${table}]`;
-  const headerRe = new RegExp(`^\\s*\\[${escapeRegExp(table)}\\]\\s*(?:#.*)?$`);
-  let start = lines.findIndex((line) => headerRe.test(line));
-  if (start < 0) {
-    const additions = Object.entries(vars).filter(([, value]) => value !== void 0).map(([key, value]) => `${key} = ${JSON.stringify(value)}`);
-    const prefix = raw.trimEnd();
-    return `${prefix}${prefix ? "\n\n" : ""}${header}
-${additions.join("\n")}
-`;
-  }
-  let end = start + 1;
-  while (end < lines.length && !/^\s*\[\[?[^\]]+\]\]?\s*(?:#.*)?$/u.test(lines[end])) end++;
-  const tableLines = lines.slice(start + 1, end);
-  const seen = /* @__PURE__ */ new Set();
-  const nextTableLines = [];
-  for (const line of tableLines) {
-    const key = Object.keys(vars).find(
-      (name) => new RegExp(`^\\s*${escapeRegExp(name)}\\s*=`).test(line)
-    );
-    if (!key) {
-      nextTableLines.push(line);
-      continue;
-    }
-    seen.add(key);
-    const value = vars[key];
-    if (value !== void 0) nextTableLines.push(`${key} = ${JSON.stringify(value)}`);
-  }
-  for (const [key, value] of Object.entries(vars)) {
-    if (!seen.has(key) && value !== void 0) {
-      nextTableLines.push(`${key} = ${JSON.stringify(value)}`);
-    }
-  }
-  lines.splice(start + 1, end - start - 1, ...nextTableLines);
-  return lines.join("\n").replace(/\s*$/u, "\n");
-}
-function readRequiredSecretNamesFromToml(raw) {
-  const block = findRequiredSecretsBlock(raw);
-  if (!block) return [];
-  const names = [];
-  for (const line of block.lines.slice(block.start + 1, block.end)) {
-    const match = /^\s*#\s+([A-Za-z_][A-Za-z0-9_]*)\s*$/u.exec(line);
-    if (match) names.push(validateSecretName(match[1]));
-  }
-  return normalizeRequiredSecretNames(names);
-}
-function setRequiredSecretNamesInToml(raw, names, keepEmptyBlock) {
-  const normalized = raw.replace(/\r\n/g, "\n").replace(/\s*$/u, "\n");
-  const block = findRequiredSecretsBlock(normalized);
-  if (names.length === 0 && !block && !keepEmptyBlock) return normalized;
-  const rendered = renderRequiredSecretsBlock(names);
-  if (block) {
-    const lines2 = [...block.lines];
-    lines2.splice(block.start, block.end - block.start + 1, ...rendered);
-    return lines2.join("\n").replace(/\s*$/u, "\n");
-  }
-  const lines = normalized.split("\n");
-  if (lines[lines.length - 1] === "") lines.pop();
-  const insertAt = requiredSecretsInsertIndex(lines);
-  const insertion = insertAt < lines.length ? [...rendered, ""] : lines.length > 0 ? ["", ...rendered] : rendered;
-  lines.splice(insertAt, 0, ...insertion);
-  return lines.join("\n").replace(/\s*$/u, "\n");
-}
-function renderRequiredSecretsBlock(names) {
-  return [
-    REQUIRED_SECRETS_BEGIN,
-    ...names.length > 0 ? names.map((name) => `#   ${name}`) : ["#   (none declared)"],
-    REQUIRED_SECRETS_END
-  ];
-}
-function normalizeRequiredSecretNames(secretNames) {
-  return Array.from(new Set(Array.from(secretNames, (name) => validateSecretName(name)))).sort(
-    (a, b) => a.localeCompare(b)
-  );
-}
-function hasRequiredSecretsBlock(raw) {
-  return findRequiredSecretsBlock(raw) !== null;
-}
-function findRequiredSecretsBlock(raw) {
-  const lines = raw.replace(/\r\n/g, "\n").split("\n");
-  const start = lines.findIndex((line) => requiredSecretsBeginRe().test(line));
-  if (start < 0) return null;
-  const end = lines.findIndex((line, index) => index > start && requiredSecretsEndRe().test(line));
-  return { lines, start, end: end < 0 ? start : end };
-}
-function requiredSecretsInsertIndex(lines) {
-  const varsHeader = /^\s*\[vars\]\s*(?:#.*)?$/u;
-  const tableHeader = /^\s*\[\[?[^\]]+\]\]?\s*(?:#.*)?$/u;
-  const varsStart = lines.findIndex((line) => varsHeader.test(line));
-  if (varsStart < 0) return lines.length;
-  let end = varsStart + 1;
-  while (end < lines.length && !tableHeader.test(lines[end])) end++;
-  while (end > varsStart + 1 && lines[end - 1].trim() === "") end--;
-  return end;
-}
-function requiredSecretsBeginRe() {
-  return /^# --- DeepSpace (?:detected|required) secrets\b.*---$/u;
-}
-function requiredSecretsEndRe() {
-  return /^# --- end DeepSpace (?:detected|required) secrets ---$/u;
-}
-function escapeRegExp(value) {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return removed;
 }
 
 // src/cli/lib/port.ts
@@ -1762,10 +1405,11 @@ var dev_default = defineCommand3({
     }
   },
   async run({ args }) {
-    const wranglerEnv2 = typeof args.env === "string" && args.env.trim() ? args.env.trim() : void 0;
+    preflightNodeVersion("dev");
+    const wranglerEnv = typeof args.env === "string" && args.env.trim() ? args.env.trim() : void 0;
     const start = resolve4(args.dir ?? ".");
-    const appDir2 = findAppDir(start);
-    if (!appDir2) {
+    const appDir = findAppDir(start);
+    if (!appDir) {
       console.error(`No wrangler.toml found at or above ${start}.`);
       const children = findChildApps(start);
       if (children.length > 0) {
@@ -1776,18 +1420,20 @@ var dev_default = defineCommand3({
       }
       process.exit(1);
     }
-    const worktree = detectClaudeWorktree(appDir2);
+    const junk = removeMacosJunk(appDir);
+    if (junk > 0) console.log(`Removed ${junk} macOS metadata file(s) (._*, .DS_Store)`);
+    const worktree = detectClaudeWorktree(appDir);
     const explicitPort = Boolean(args.port);
     let port = worktree && !explicitPort ? deriveWorktreePort(worktree.worktreeName) : resolvePort(args.port);
     if (worktree) {
       const upserted = upsertWorktreeLaunchConfig(
         worktree.mainRepoRoot,
         worktree.worktreeName,
-        appDir2,
+        appDir,
         {
           port,
           probePort: !explicitPort,
-          extraArgs: [...wranglerEnv2 ? ["--env", wranglerEnv2] : []]
+          extraArgs: [...wranglerEnv ? ["--env", wranglerEnv] : []]
         }
       );
       if (upserted) {
@@ -1797,7 +1443,7 @@ var dev_default = defineCommand3({
         );
       } else {
         console.warn(
-          `Warning: could not update ${join8(worktree.mainRepoRoot, ".claude", "launch.json")} (malformed or unwritable) \u2014 the Claude preview tool may serve the main repo's code instead of this worktree.`
+          `Warning: could not update ${join9(worktree.mainRepoRoot, ".claude", "launch.json")} (malformed or unwritable) \u2014 the Claude preview tool may serve the main repo's code instead of this worktree.`
         );
       }
       if (!explicitPort && process.env.DEEPSPACE_PORT) {
@@ -1806,8 +1452,8 @@ var dev_default = defineCommand3({
         );
       }
     }
-    writeLaunchConfigIfMissing(appDir2, detectAppName(appDir2) ?? basename(appDir2), port);
-    ensureInstallReady(appDir2);
+    writeLaunchConfigIfMissing(appDir, detectAppName(appDir) ?? basename(appDir), port);
+    ensureInstallReady(appDir);
     let token;
     try {
       token = await ensureToken();
@@ -1823,39 +1469,40 @@ var dev_default = defineCommand3({
       process.exit(1);
     }
     console.log(`Logged in as ${payload.name ?? payload.email}`);
-    if (wranglerEnv2) console.log(`Wrangler env: ${wranglerEnv2}`);
+    if (wranglerEnv) console.log(`Wrangler env: ${wranglerEnv}`);
     console.log(`Port: ${port}`);
     let generatedSecretsCache;
-    try {
-      const linkedSecrets = await pullLinkedSecretsCache(DEPLOY_URL, token, appDir2, wranglerEnv2);
-      if (linkedSecrets) {
-        generatedSecretsCache = renderSecretsCache(linkedSecrets.values, linkedSecrets);
-        console.log(
-          `Secrets: ${linkedSecrets.projectName}/${linkedSecrets.configName} (${Object.keys(linkedSecrets.values).length})`
+    const appIdForSecrets = readAppId(appDir, wranglerEnv);
+    if (appIdForSecrets) {
+      try {
+        const refreshed = await refreshSecretsCache(DEPLOY_URL, token, appIdForSecrets, wranglerEnv);
+        if (refreshed) {
+          generatedSecretsCache = refreshed.rendered;
+          console.log(refreshed.summary);
+        }
+      } catch (err) {
+        console.error(
+          `Failed to refresh app secrets: ${err instanceof Error ? err.message : String(err)}`
         );
+        process.exit(1);
       }
-    } catch (err) {
-      console.error(
-        `Failed to refresh linked secrets: ${err instanceof Error ? err.message : String(err)}`
-      );
-      process.exit(1);
     }
     const sharedDevVarsCache = generatedSecretsCache !== void 0;
-    await writeDevVars(appDir2, payload.sub, token, wranglerEnv2, {
+    await writeDevVars(appDir, payload.sub, token, wranglerEnv, {
       generatedSecretsCache,
       sharedDevVarsCache
     });
     let wranglerConfig;
     try {
-      wranglerConfig = prepareWranglerEnvConfig(appDir2, wranglerEnv2, { sharedDevVarsCache });
+      wranglerConfig = prepareWranglerEnvConfig(appDir, wranglerEnv, { sharedDevVarsCache });
     } catch (err) {
       console.error(err instanceof Error ? err.message : String(err));
       process.exit(1);
     }
-    preflightWindowsWorkerd(appDir2);
+    preflightWindowsWorkerd(appDir);
     console.log("Starting dev server...\n");
     const vite = spawn("npx", ["vite", "--port", String(port), "--strictPort", "--host"], {
-      cwd: appDir2,
+      cwd: appDir,
       stdio: "inherit",
       env: wranglerViteEnv(process.env, wranglerConfig, { DEEPSPACE_PORT: String(port) })
     });
@@ -2028,18 +1675,18 @@ import { sync as spawnSync3 } from "cross-spawn";
 // src/cli/lib/playwright.ts
 import { execSync } from "child_process";
 import { sync as spawnSync2 } from "cross-spawn";
-function ensurePlaywright(appDir2) {
+function ensurePlaywright(appDir) {
   try {
-    execSync("npx playwright --version", { cwd: appDir2, stdio: "pipe" });
+    execSync("npx playwright --version", { cwd: appDir, stdio: "pipe" });
   } catch {
     console.log("Installing Playwright...");
-    execSync("npm install -D @playwright/test", { cwd: appDir2, stdio: "pipe" });
+    execSync("npm install -D @playwright/test", { cwd: appDir, stdio: "pipe" });
   }
   const isLinux = process.platform === "linux";
   const isRoot = isLinux && typeof process.getuid === "function" && process.getuid() === 0;
   const args = isRoot ? ["install", "--with-deps", "chromium"] : ["install", "chromium"];
   const result = spawnSync2("npx", ["playwright", ...args], {
-    cwd: appDir2,
+    cwd: appDir,
     stdio: "inherit"
   });
   if (result.status !== 0) {
@@ -2074,11 +1721,12 @@ var test_default = defineCommand5({
     }
   },
   async run({ args }) {
+    preflightNodeVersion("test");
     const suite = args.suite ?? "default";
-    const wranglerEnv2 = typeof args.env === "string" && args.env.trim() ? args.env.trim() : void 0;
+    const wranglerEnv = typeof args.env === "string" && args.env.trim() ? args.env.trim() : void 0;
     const start = resolve5(".");
-    const appDir2 = findAppDir(start);
-    if (!appDir2) {
+    const appDir = findAppDir(start);
+    if (!appDir) {
       console.error(`No wrangler.toml found at or above ${start}.`);
       const children = findChildApps(start);
       if (children.length > 0) {
@@ -2089,14 +1737,14 @@ var test_default = defineCommand5({
       }
       process.exit(1);
     }
-    const worktreePort = args.port ? null : resolveWorktreePort(appDir2);
+    const worktreePort = args.port ? null : resolveWorktreePort(appDir);
     const port = worktreePort ?? resolvePort(args.port);
     if (worktreePort && process.env.DEEPSPACE_PORT) {
       console.log(
         `Ignoring DEEPSPACE_PORT=${process.env.DEEPSPACE_PORT} inside a worktree \u2014 targeting per-worktree port ${port}. Pass --port to override.`
       );
     }
-    ensureInstallReady(appDir2);
+    ensureInstallReady(appDir);
     let token;
     let ownerId;
     try {
@@ -2108,72 +1756,73 @@ var test_default = defineCommand5({
       process.exit(1);
     }
     let generatedSecretsCache;
-    try {
-      const linkedSecrets = await pullLinkedSecretsCache(DEPLOY_URL2, token, appDir2, wranglerEnv2);
-      if (linkedSecrets) {
-        generatedSecretsCache = renderSecretsCache(linkedSecrets.values, linkedSecrets);
-        console.log(
-          `Secrets: ${linkedSecrets.projectName}/${linkedSecrets.configName} (${Object.keys(linkedSecrets.values).length})`
+    const appIdForSecrets = readAppId(appDir, wranglerEnv);
+    if (appIdForSecrets) {
+      try {
+        const refreshed = await refreshSecretsCache(DEPLOY_URL2, token, appIdForSecrets, wranglerEnv);
+        if (refreshed) {
+          generatedSecretsCache = refreshed.rendered;
+          console.log(refreshed.summary);
+        }
+      } catch (err) {
+        console.error(
+          `Failed to refresh app secrets: ${err instanceof Error ? err.message : String(err)}`
         );
+        process.exit(1);
       }
-    } catch (err) {
-      console.error(
-        `Failed to refresh linked secrets: ${err instanceof Error ? err.message : String(err)}`
-      );
-      process.exit(1);
     }
     const sharedDevVarsCache = generatedSecretsCache !== void 0;
-    await writeDevVars(appDir2, ownerId, token, wranglerEnv2, {
+    await writeDevVars(appDir, ownerId, token, wranglerEnv, {
       generatedSecretsCache,
       sharedDevVarsCache
     });
     if (suite !== "unit") {
-      preflightWindowsWorkerd(appDir2);
-      ensurePlaywright(appDir2);
+      preflightWindowsWorkerd(appDir);
+      ensurePlaywright(appDir);
     }
     let exitCode = 0;
     switch (suite) {
       case "smoke":
         exitCode = runPlaywright(
-          appDir2,
+          appDir,
           ["tests/smoke.spec.ts"],
           port,
-          wranglerEnv2,
+          wranglerEnv,
           sharedDevVarsCache
         );
         break;
       case "api":
         exitCode = runPlaywright(
-          appDir2,
+          appDir,
           ["tests/api.spec.ts"],
           port,
-          wranglerEnv2,
+          wranglerEnv,
           sharedDevVarsCache
         );
         break;
       case "e2e":
-        exitCode = runPlaywright(appDir2, [], port, wranglerEnv2, sharedDevVarsCache);
+        exitCode = runPlaywright(appDir, [], port, wranglerEnv, sharedDevVarsCache);
         break;
       case "unit":
-        exitCode = runVitest(appDir2);
+        exitCode = runVitest(appDir);
         break;
       case "all":
-        exitCode = runVitest(appDir2);
+        exitCode = runVitest(appDir);
         if (exitCode === 0)
-          exitCode = runPlaywright(appDir2, [], port, wranglerEnv2, sharedDevVarsCache);
+          exitCode = runPlaywright(appDir, [], port, wranglerEnv, sharedDevVarsCache);
         break;
       case "default":
         exitCode = runPlaywright(
-          appDir2,
+          appDir,
           ["tests/smoke.spec.ts", "tests/api.spec.ts"],
           port,
-          wranglerEnv2,
+          wranglerEnv,
           sharedDevVarsCache
         );
         break;
       default:
         if (suite.endsWith(".spec.ts")) {
-          exitCode = runPlaywright(appDir2, [suite], port, wranglerEnv2, sharedDevVarsCache);
+          exitCode = runPlaywright(appDir, [suite], port, wranglerEnv, sharedDevVarsCache);
         } else {
           console.error(`Unknown test suite: ${suite}`);
           console.error("Available: smoke, api, e2e, unit, all");
@@ -2183,10 +1832,10 @@ var test_default = defineCommand5({
     process.exit(exitCode);
   }
 });
-function runPlaywright(appDir2, testFiles, port, wranglerEnv2, sharedDevVarsCache = false) {
+function runPlaywright(appDir, testFiles, port, wranglerEnv, sharedDevVarsCache = false) {
   let wranglerConfig;
   try {
-    wranglerConfig = prepareWranglerEnvConfig(appDir2, wranglerEnv2, { sharedDevVarsCache });
+    wranglerConfig = prepareWranglerEnvConfig(appDir, wranglerEnv, { sharedDevVarsCache });
   } catch (err) {
     console.error(err instanceof Error ? err.message : String(err));
     return 1;
@@ -2196,7 +1845,7 @@ function runPlaywright(appDir2, testFiles, port, wranglerEnv2, sharedDevVarsCach
       "npx",
       ["playwright", "test", "--config", "tests/playwright.config.ts", ...testFiles],
       {
-        cwd: appDir2,
+        cwd: appDir,
         stdio: "inherit",
         env: wranglerViteEnv(process.env, wranglerConfig, { DEEPSPACE_PORT: String(port) })
       }
@@ -2206,9 +1855,9 @@ function runPlaywright(appDir2, testFiles, port, wranglerEnv2, sharedDevVarsCach
     wranglerConfig.cleanup();
   }
 }
-function runVitest(appDir2) {
+function runVitest(appDir) {
   const result = spawnSync3("npx", ["vitest", "run", "--passWithNoTests"], {
-    cwd: appDir2,
+    cwd: appDir,
     stdio: "inherit"
   });
   return result.status ?? 1;
@@ -2246,15 +1895,15 @@ var screenshot_default = defineCommand6({
     }
   },
   run({ args }) {
-    const appDir2 = resolve6(".");
-    ensurePlaywright(appDir2);
+    const appDir = resolve6(".");
+    ensurePlaywright(appDir);
     const playwrightArgs = ["playwright", "screenshot", args.url, args.output];
     if (args["full-page"]) playwrightArgs.push("--full-page");
     if (args["wait-for-timeout"]) {
       playwrightArgs.push("--wait-for-timeout", String(args["wait-for-timeout"]));
     }
     const result = spawnSync4("npx", playwrightArgs, {
-      cwd: appDir2,
+      cwd: appDir,
       stdio: "inherit"
     });
     process.exit(result.status ?? 1);
@@ -2265,12 +1914,12 @@ var screenshot_default = defineCommand6({
 import { defineCommand as defineCommand7 } from "citty";
 import * as p3 from "@clack/prompts";
 import { readFileSync as readFileSync8, writeFileSync as writeFileSync8, existsSync as existsSync9, mkdirSync as mkdirSync4 } from "fs";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 import { homedir as homedir4 } from "os";
 var SESSION_COOKIE2 = "__Secure-better-auth.session_token";
 var AUTH_URL4 = process.env.DEEPSPACE_AUTH_URL ?? PLATFORM_URLS.auth;
-var DIR3 = join9(homedir4(), ".deepspace");
-var ACCOUNTS_PATH = join9(DIR3, "test-accounts.json");
+var DIR3 = join10(homedir4(), ".deepspace");
+var ACCOUNTS_PATH = join10(DIR3, "test-accounts.json");
 function loadAccounts() {
   if (!existsSync9(ACCOUNTS_PATH)) return [];
   try {
@@ -2551,13 +2200,217 @@ var test_accounts_default = defineCommand7({
 });
 
 // src/cli/commands/deploy.ts
-import { defineCommand as defineCommand8 } from "citty";
-import { execSync as execSync2 } from "child_process";
-import { randomUUID } from "crypto";
-import { readFileSync as readFileSync9, readdirSync as readdirSync2, existsSync as existsSync10 } from "fs";
-import { join as join10, resolve as resolve7, dirname as dirname2 } from "path";
-import { pathToFileURL } from "url";
-import * as p4 from "@clack/prompts";
+import { defineCommand as defineCommand8 } from "citty";
+import { execSync as execSync2 } from "child_process";
+import { randomUUID } from "crypto";
+import { readFileSync as readFileSync9, readdirSync as readdirSync3, existsSync as existsSync10, writeFileSync as writeFileSync9 } from "fs";
+import { join as join11, resolve as resolve7, dirname as dirname2 } from "path";
+import { pathToFileURL } from "url";
+import * as p4 from "@clack/prompts";
+
+// src/server/rooms/binding-manifest.ts
+var AUTO_PROVISION_SENTINEL = "auto";
+var VECTORIZE_METRICS = /* @__PURE__ */ new Set(["cosine", "euclidean", "dot-product"]);
+var ALLOWED_BINDING_TYPES = /* @__PURE__ */ new Set([
+  "vectorize",
+  "ai",
+  "r2_bucket",
+  "kv_namespace",
+  "d1",
+  "queue",
+  "browser_rendering",
+  "analytics_engine",
+  "hyperdrive"
+]);
+var RESERVED_BINDING_NAMES = /* @__PURE__ */ new Set([
+  "ASSETS",
+  "PLATFORM_WORKER",
+  "API_WORKER",
+  "APP_NAME",
+  "OWNER_USER_ID",
+  "AUTH_JWT_PUBLIC_KEY",
+  "AUTH_JWT_ISSUER",
+  "AUTH_WORKER_URL",
+  "APP_IDENTITY_TOKEN",
+  "APP_OWNER_JWT",
+  "USAGE_EVENTS"
+]);
+function validateBindingManifest(manifest) {
+  if (!Array.isArray(manifest)) {
+    return { valid: false, errors: [{ reason: "Manifest must be an array" }] };
+  }
+  const errors = [];
+  const seenNames = /* @__PURE__ */ new Set();
+  for (const entry of manifest) {
+    if (!entry || typeof entry !== "object") {
+      errors.push({ reason: `Entry must be an object (got ${entry === null ? "null" : typeof entry})` });
+      continue;
+    }
+    const e = entry;
+    const type = e.type;
+    const name = e.name;
+    if (typeof type !== "string" || !ALLOWED_BINDING_TYPES.has(type)) {
+      errors.push({
+        reason: `Disallowed binding type: ${typeof type === "string" ? type : `(${typeof type})`}. Allowed: ${[...ALLOWED_BINDING_TYPES].sort().join(", ")}`
+      });
+      continue;
+    }
+    if (typeof name !== "string" || !name) {
+      errors.push({ reason: `Binding of type "${type}" missing 'name' (string)` });
+      continue;
+    }
+    if (RESERVED_BINDING_NAMES.has(name)) {
+      errors.push({ reason: `Binding name "${name}" is reserved by the SDK` });
+      continue;
+    }
+    if (seenNames.has(name)) {
+      errors.push({ reason: `Duplicate binding name "${name}"` });
+      continue;
+    }
+    seenNames.add(name);
+    const binding = entry;
+    const fieldErr = requiredFieldError(binding);
+    if (fieldErr) errors.push({ binding, reason: fieldErr });
+  }
+  if (errors.length) return { valid: false, errors };
+  return { valid: true, bindings: manifest };
+}
+function requiredFieldError(b) {
+  switch (b.type) {
+    case "vectorize": {
+      if (!b.index_name) return `vectorize binding "${b.name}" missing index_name (or "auto")`;
+      if (b.index_name === AUTO_PROVISION_SENTINEL) {
+        if (typeof b.dimensions !== "number" || b.dimensions <= 0) {
+          return `vectorize binding "${b.name}" with index_name="auto" requires "dimensions" (positive number)`;
+        }
+        if (!b.metric || !VECTORIZE_METRICS.has(b.metric)) {
+          return `vectorize binding "${b.name}" with index_name="auto" requires "metric" (one of: ${[...VECTORIZE_METRICS].join(", ")})`;
+        }
+      }
+      return null;
+    }
+    case "r2_bucket":
+      return b.bucket_name ? null : `r2_bucket binding "${b.name}" missing bucket_name (or "auto")`;
+    case "kv_namespace": {
+      if (!b.namespace_id) return `kv_namespace binding "${b.name}" missing namespace_id (or "auto")`;
+      if (b.namespace_id === AUTO_PROVISION_SENTINEL && !b.title) {
+        return `kv_namespace binding "${b.name}" with namespace_id="auto" requires "title"`;
+      }
+      return null;
+    }
+    case "d1": {
+      if (!b.id) return `d1 binding "${b.name}" missing id (or "auto")`;
+      if (b.id === AUTO_PROVISION_SENTINEL && !b.database_name) {
+        return `d1 binding "${b.name}" with id="auto" requires "database_name"`;
+      }
+      return null;
+    }
+    case "queue":
+      return b.queue_name ? null : `queue binding "${b.name}" missing queue_name (or "auto")`;
+    case "hyperdrive":
+      if (!b.id) return `hyperdrive binding "${b.name}" missing id`;
+      if (b.id === AUTO_PROVISION_SENTINEL) {
+        return `hyperdrive binding "${b.name}": auto-provisioning not yet supported (provide a real id)`;
+      }
+      return null;
+    case "ai":
+    case "browser_rendering":
+    case "analytics_engine":
+      return null;
+    // no required fields beyond `name`
+    default: {
+      const _exhaustive = b;
+      void _exhaustive;
+      return null;
+    }
+  }
+}
+function bindingManifestFromOutputConfig(outputConfig) {
+  const out = [];
+  const aiBinding = pluckString(outputConfig.ai, "binding");
+  if (aiBinding) out.push({ type: "ai", name: aiBinding });
+  for (const v of asObjectArray(outputConfig.vectorize)) {
+    const name = pluckString(v, "binding");
+    const index_name = pluckString(v, "index_name");
+    if (!name || !index_name) continue;
+    const dimensions = pluckNumber(v, "dimensions");
+    const metric = pluckString(v, "metric");
+    out.push({
+      type: "vectorize",
+      name,
+      index_name,
+      ...dimensions != null && { dimensions },
+      ...metric && (metric === "cosine" || metric === "euclidean" || metric === "dot-product") && { metric }
+    });
+  }
+  for (const r of asObjectArray(outputConfig.r2_buckets)) {
+    const name = pluckString(r, "binding");
+    const bucket_name = pluckString(r, "bucket_name");
+    if (name && bucket_name) out.push({ type: "r2_bucket", name, bucket_name });
+  }
+  for (const k of asObjectArray(outputConfig.kv_namespaces)) {
+    const name = pluckString(k, "binding");
+    const namespace_id = pluckString(k, "id");
+    if (!name || !namespace_id) continue;
+    const title = pluckString(k, "title");
+    out.push({
+      type: "kv_namespace",
+      name,
+      namespace_id,
+      ...title && { title }
+    });
+  }
+  for (const d of asObjectArray(outputConfig.d1_databases)) {
+    const name = pluckString(d, "binding");
+    const id = pluckString(d, "database_id");
+    if (!name || !id) continue;
+    const database_name = pluckString(d, "database_name");
+    out.push({
+      type: "d1",
+      name,
+      id,
+      ...database_name && { database_name }
+    });
+  }
+  const queues = isObject(outputConfig.queues) ? outputConfig.queues : null;
+  for (const q of asObjectArray(queues?.producers)) {
+    const name = pluckString(q, "binding");
+    const queue_name = pluckString(q, "queue");
+    if (name && queue_name) out.push({ type: "queue", name, queue_name });
+  }
+  const browserBinding = pluckString(outputConfig.browser, "binding");
+  if (browserBinding) out.push({ type: "browser_rendering", name: browserBinding });
+  for (const a of asObjectArray(outputConfig.analytics_engine_datasets)) {
+    const name = pluckString(a, "binding");
+    const dataset = pluckString(a, "dataset");
+    if (name) out.push({ type: "analytics_engine", name, dataset: dataset ?? void 0 });
+  }
+  for (const h of asObjectArray(outputConfig.hyperdrive)) {
+    const name = pluckString(h, "binding");
+    const id = pluckString(h, "id");
+    if (name && id) out.push({ type: "hyperdrive", name, id });
+  }
+  return out;
+}
+function isObject(v) {
+  return v !== null && typeof v === "object" && !Array.isArray(v);
+}
+function pluckString(v, key) {
+  if (!isObject(v)) return null;
+  const val = v[key];
+  return typeof val === "string" && val.length > 0 ? val : null;
+}
+function pluckNumber(v, key) {
+  if (!isObject(v)) return null;
+  const val = v[key];
+  return typeof val === "number" && Number.isFinite(val) ? val : null;
+}
+function asObjectArray(v) {
+  if (!Array.isArray(v)) return [];
+  return v.filter(isObject);
+}
+
+// src/cli/commands/deploy.ts
 var DEPLOY_URL3 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 var API_URL = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
 var CLOUDFLARE_DEPLOY_ERROR_HINT = "Deployment reached the DeepSpace deploy worker, but Cloudflare's deployment control-plane API failed. This is often caused by a Cloudflare Dashboard/API incident or Workers for Platforms entitlement outage. Already deployed apps should keep serving; wait for Cloudflare to recover and retry.";
@@ -2587,8 +2440,8 @@ function extractRunWorkerFirst(cfg) {
 function errMessage(err) {
   return err instanceof Error ? err.message : String(err);
 }
-function isLikelyCloudflareDeployFailure(status2, error) {
-  if (status2 >= 500) return true;
+function isLikelyCloudflareDeployFailure(status3, error) {
+  if (status3 >= 500) return true;
   if (!error) return false;
   return [
     "Upload session failed",
@@ -2598,9 +2451,9 @@ function isLikelyCloudflareDeployFailure(status2, error) {
     "Internal Server Error"
   ].some((needle) => error.includes(needle));
 }
-function formatDeployWorkerError(status2, error) {
-  const detail = error ?? `Deployment error (${status2})`;
-  if (!isLikelyCloudflareDeployFailure(status2, error)) return detail;
+function formatDeployWorkerError(status3, error) {
+  const detail = error ?? `Deployment error (${status3})`;
+  if (!isLikelyCloudflareDeployFailure(status3, error)) return detail;
   return `${CLOUDFLARE_DEPLOY_ERROR_HINT}
 
 Underlying error: ${detail}`;
@@ -2652,10 +2505,10 @@ async function postWithRetry(url, makeInit, {
   if (lastRes) return lastRes;
   throw lastErr instanceof Error ? lastErr : new Error(String(lastErr));
 }
-async function abortStagedUpload(appName, uploadId, totalGroups, token) {
+async function abortStagedUpload(appId, uploadId, totalGroups, token) {
   try {
     await fetch(
-      `${DEPLOY_URL3}/api/deploy/${appName}/assets?uploadId=${uploadId}&totalGroups=${totalGroups}`,
+      `${DEPLOY_URL3}/api/deploy/${appId}/assets?uploadId=${uploadId}&totalGroups=${totalGroups}`,
       { method: "DELETE", headers: { Authorization: `Bearer ${token}` } }
     );
   } catch {
@@ -2676,18 +2529,24 @@ var deploy_default = defineCommand8({
       type: "string",
       description: "wrangler.toml [env.<name>] block to deploy (e.g. --env staging). Omit to deploy the top-level config.",
       required: false
+    },
+    rename: {
+      type: "boolean",
+      description: "Confirm that a changed wrangler `name` renames this app (its URL moves; data, secrets, and collaborators travel). Without this flag an interactive prompt asks.",
+      default: false
     }
   },
   async run({ args }) {
-    const appDir2 = resolve7(args.dir ?? ".");
+    preflightNodeVersion("deploy");
+    const appDir = resolve7(args.dir ?? ".");
     const envName = typeof args.env === "string" && args.env.trim() ? args.env.trim() : void 0;
-    if (!hasWranglerConfig(appDir2)) {
+    if (!hasWranglerConfig(appDir)) {
       console.error("No wrangler.toml found. Are you in a DeepSpace app directory?");
       process.exit(1);
     }
-    ensureInstallReady(appDir2);
+    ensureInstallReady(appDir);
     p4.intro("Deploying DeepSpace app");
-    const wranglerConfig = readWranglerConfig(appDir2);
+    const wranglerConfig = readWranglerConfig(appDir);
     const nameRes = resolveAppNameForEnv(wranglerConfig, envName);
     if (!nameRes.ok) {
       p4.cancel(nameRes.reason);
@@ -2702,7 +2561,14 @@ var deploy_default = defineCommand8({
       process.exit(1);
     }
     const appName = nameRes.name;
+    let appId = readAppId(appDir, envName);
+    if (!appId) {
+      appId = mintAppId();
+      writeAppId(appDir, appId, { wranglerEnv: envName });
+      p4.log.info(`Minted app id ${appId} \u2014 commit wrangler.toml.`);
+    }
     p4.log.info(envName ? `App: ${appName}  (env: ${envName})` : `App: ${appName}`);
+    p4.log.info(`Id: ${appId}`);
     let token;
     let ownerId;
     try {
@@ -2712,39 +2578,33 @@ var deploy_default = defineCommand8({
       p4.cancel(errMessage(err));
       process.exit(1);
     }
-    const localSecretsLink = resolveSecretsLink(appDir2, envName);
-    if (localSecretsLink.linked) {
-      try {
-        await setServerSecretsLink(DEPLOY_URL3, token, appName, localSecretsLink.projectName);
-      } catch {
-      }
-    }
     let linkedSecrets = null;
     try {
-      linkedSecrets = await pullLinkedSecretsCache(DEPLOY_URL3, token, appDir2, envName);
-      if (linkedSecrets) {
-        const rendered = renderSecretsCache(linkedSecrets.values, linkedSecrets);
-        await writeDevVars(appDir2, ownerId, token, envName, {
-          generatedSecretsCache: rendered,
+      const refreshed = await refreshSecretsCache(DEPLOY_URL3, token, appId, envName);
+      if (refreshed) {
+        linkedSecrets = refreshed.pulled;
+        await writeDevVars(appDir, ownerId, token, envName, {
+          appId,
+          generatedSecretsCache: refreshed.rendered,
           sharedDevVarsCache: true
         });
-        p4.log.info(
-          `Secrets cache: ${linkedSecrets.projectName}/${linkedSecrets.configName} (${Object.keys(linkedSecrets.values).length} secret${Object.keys(linkedSecrets.values).length === 1 ? "" : "s"})`
-        );
+        p4.log.info(refreshed.summary);
       }
     } catch (err) {
-      p4.cancel(`Failed to refresh linked secrets before deploy: ${errMessage(err)}`);
+      p4.cancel(`Failed to refresh app secrets before deploy: ${errMessage(err)}`);
       process.exit(1);
     }
+    const junk = removeMacosJunk(appDir);
+    if (junk > 0) p4.log.info(`Removed ${junk} macOS metadata file(s) (._*, .DS_Store)`);
     const s = createSpinner();
     s.start("Building...");
     let preparedWranglerConfig;
     try {
-      preparedWranglerConfig = prepareWranglerEnvConfig(appDir2, envName, {
-        sharedDevVarsCache: localSecretsLink.linked
+      preparedWranglerConfig = prepareWranglerEnvConfig(appDir, envName, {
+        sharedDevVarsCache: linkedSecrets !== null
       });
       execSync2("npx vite build", {
-        cwd: appDir2,
+        cwd: appDir,
         stdio: "pipe",
         env: wranglerViteEnv(process.env, preparedWranglerConfig)
       });
@@ -2758,7 +2618,7 @@ var deploy_default = defineCommand8({
       preparedWranglerConfig?.cleanup();
     }
     s.stop("Built");
-    const deployConfigPath = join10(appDir2, ".wrangler", "deploy", "config.json");
+    const deployConfigPath = join11(appDir, ".wrangler", "deploy", "config.json");
     if (!existsSync10(deployConfigPath)) {
       p4.cancel("Build output config not found at .wrangler/deploy/config.json");
       process.exit(1);
@@ -2778,7 +2638,7 @@ var deploy_default = defineCommand8({
       process.exit(1);
     }
     const workerDir = dirname2(outputWranglerPath);
-    const workerBundlePath = join10(workerDir, outputConfig.main);
+    const workerBundlePath = join11(workerDir, outputConfig.main);
     const clientDir = outputConfig.assets?.directory ? resolve7(workerDir, outputConfig.assets.directory) : null;
     if (!existsSync10(workerBundlePath)) {
       p4.cancel(`Worker bundle not found at ${workerBundlePath}`);
@@ -2820,15 +2680,13 @@ var deploy_default = defineCommand8({
         `Custom bindings: ${customBindings.map((b) => `${b.name} (${b.type})`).join(", ")}`
       );
     }
-    const devVarsPath = devVarsPathFor(appDir2, envName, {
-      sharedDevVarsCache: localSecretsLink.linked
+    const devVarsPath = devVarsPathFor(appDir, envName, {
+      sharedDevVarsCache: linkedSecrets !== null
     });
     let userSecrets = {};
     if (existsSync10(devVarsPath)) {
       const rawDevVars = readFileSync9(devVarsPath, "utf-8");
-      const customSection = extractCustomDevVars(
-        linkedSecrets ? rawDevVars : stripGeneratedSecretsCache2(rawDevVars)
-      );
+      const customSection = extractCustomDevVars(rawDevVars);
       if (customSection) {
         try {
           userSecrets = parseDevVars(customSection);
@@ -2859,10 +2717,8 @@ var deploy_default = defineCommand8({
     }
     if (userSecretNames.length) {
       p4.log.info(`App secrets (from .dev.vars): ${userSecretNames.join(", ")}`);
-      if (!localSecretsLink.linked) {
-        p4.log.info(
-          "Legacy pass-through; move these to managed secrets with `npx deepspace secrets setup`."
-        );
+      if (!linkedSecrets) {
+        p4.log.info("Not in the app store yet \u2014 migrating after this deploy.");
       }
     }
     s.start(`Deploying to ${appName}.app.space...`);
@@ -2884,7 +2740,7 @@ var deploy_default = defineCommand8({
           const groupJson = JSON.stringify(assetGroups[i]);
           s.message(`Uploading assets \u2014 group ${i + 1}/${totalGroups}...`);
           const groupRes = await postWithRetry(
-            `${DEPLOY_URL3}/api/deploy/${appName}/assets?uploadId=${uploadId}&groupIndex=${i}&totalGroups=${totalGroups}`,
+            `${DEPLOY_URL3}/api/deploy/${appId}/assets?uploadId=${uploadId}&groupIndex=${i}&totalGroups=${totalGroups}`,
             () => ({
               method: "POST",
               headers: {
@@ -2896,7 +2752,7 @@ var deploy_default = defineCommand8({
           );
           if (!groupRes.ok) {
             const errBody = await groupRes.json().catch(() => ({}));
-            await abortStagedUpload(appName, uploadId, totalGroups, token);
+            await abortStagedUpload(appId, uploadId, totalGroups, token);
             s.stop("Deploy failed");
             p4.cancel(
               `Asset upload failed on group ${i + 1}/${totalGroups}: ${errBody.error ?? `HTTP ${groupRes.status}`}`
@@ -2905,13 +2761,21 @@ var deploy_default = defineCommand8({
           }
         }
       } catch (err) {
-        await abortStagedUpload(appName, uploadId, totalGroups, token);
+        await abortStagedUpload(appId, uploadId, totalGroups, token);
         s.stop("Deploy failed");
         p4.cancel(`Asset upload failed (network): ${errMessage(err)}`);
         process.exit(1);
       }
       s.message(`Deploying to ${appName}.app.space...`);
     }
+    const commitUrl = `${DEPLOY_URL3}/api/deploy/${appId}`;
+    let confirmRename = args.rename === true;
+    const bailDeploy = async (message, stopLabel = "Deploy failed") => {
+      if (uploadId) await abortStagedUpload(appId, uploadId, totalGroups, token);
+      if (stopLabel !== null) s.stop(stopLabel);
+      p4.cancel(message);
+      process.exit(1);
+    };
     const makeForm = () => {
       const form = new FormData();
       form.append("worker", new Blob([workerJs], { type: "application/javascript" }), "worker.js");
@@ -2933,38 +2797,45 @@ var deploy_default = defineCommand8({
       if (extraRoutes.length) {
         form.append("extraRunWorkerFirst", JSON.stringify(extraRoutes));
       }
-      if (localSecretsLink.linked) {
-        form.append("secretsProjectName", localSecretsLink.projectName);
-      }
+      form.append("name", appName);
+      if (confirmRename) form.append("confirmRename", "true");
       return form;
     };
-    const commitUrl = `${DEPLOY_URL3}/api/deploy/${appName}`;
+    const postCommit = async () => postWithRetry(
+      commitUrl,
+      () => ({
+        method: "POST",
+        headers: { Authorization: `Bearer ${token}` },
+        body: makeForm()
+      }),
+      // Commit runs a real deploy — don't retry its 5xx (could double-deploy);
+      // only a thrown fetch (dropped connection) is retried, and the staged
+      // groups survive on the worker until this request succeeds.
+      { retryServerErrors: false }
+    );
     let res;
     try {
-      res = await postWithRetry(
-        commitUrl,
-        () => ({
-          method: "POST",
-          headers: { Authorization: `Bearer ${token}` },
-          body: makeForm()
-        }),
-        // Commit runs a real deploy — don't retry its 5xx (could double-deploy);
-        // only a thrown fetch (dropped connection) is retried, and the staged
-        // groups survive on the worker until this request succeeds.
-        { retryServerErrors: false }
-      );
+      res = await postCommit();
     } catch (err) {
-      if (uploadId) await abortStagedUpload(appName, uploadId, totalGroups, token);
-      s.stop("Deploy failed");
-      p4.cancel(`Deploy request failed: ${errMessage(err)}`);
-      process.exit(1);
+      await bailDeploy(`Deploy request failed: ${errMessage(err)}`);
+      throw err;
+    }
+    let body = await res.json().catch(() => ({}));
+    if (res.status === 409 && body.code === "rename_required" && !confirmRename) {
+      s.stop("Rename confirmation needed");
+      const yes = await p4.confirm({
+        message: `This deploy renames the app: ${body.fromHost} \u2192 ${body.toHost}. The URL changes and the old one stops serving right away; data, secrets, and collaborators travel with it. (Meant a separate app? Run \`deepspace init --new-id\` instead.) Rename?`
+      });
+      if (p4.isCancel(yes) || !yes) {
+        await bailDeploy("Deploy cancelled.", null);
+      }
+      confirmRename = true;
+      s.start(`Deploying to ${appName}.app.space...`);
+      res = await postCommit();
+      body = await res.json().catch(() => ({}));
     }
-    const body = await res.json().catch(() => ({}));
     if (!res.ok || !body.success) {
-      if (uploadId) await abortStagedUpload(appName, uploadId, totalGroups, token);
-      s.stop("Deploy failed");
-      p4.cancel(formatDeployWorkerError(res.status, body.error));
-      process.exit(1);
+      await bailDeploy(formatDeployWorkerError(res.status, body.error));
     }
     if (body.onBehalfOfOwner) {
       p4.log.warn(`Deployed on behalf of owner ${body.onBehalfOfOwner}`);
@@ -2978,27 +2849,67 @@ var deploy_default = defineCommand8({
           "First requests may briefly hit the assets transitional page; retry in a minute."
         );
         p4.log.success(`Live at: ${body.url}`);
-        await syncSubscriptionPlans(appDir2, appName, token);
-        await syncOneTimeProducts(appDir2, appName, token);
+        await migrateLegacyDevVarsSecrets({
+          deployUrl: DEPLOY_URL3,
+          token,
+          appId,
+          envName,
+          devVarsPath,
+          userSecrets,
+          userSecretNames,
+          hadStore: linkedSecrets !== null
+        });
+        await syncSubscriptionPlans(appDir, appId, token);
+        await syncOneTimeProducts(appDir, appId, token);
         p4.outro("Done");
         return;
       }
     }
     s.stop("Deployed!");
     p4.log.success(`Live at: ${body.url}`);
-    await syncSubscriptionPlans(appDir2, appName, token);
-    await syncOneTimeProducts(appDir2, appName, token);
+    await migrateLegacyDevVarsSecrets({
+      deployUrl: DEPLOY_URL3,
+      token,
+      appId,
+      envName,
+      devVarsPath,
+      userSecrets,
+      userSecretNames,
+      hadStore: linkedSecrets !== null
+    });
+    await syncSubscriptionPlans(appDir, appId, token);
+    await syncOneTimeProducts(appDir, appId, token);
     p4.outro("Done");
   }
 });
-async function syncSubscriptionPlans(appDir2, appName, token) {
-  const subsPath = join10(appDir2, "src", "subscriptions.ts");
+async function migrateLegacyDevVarsSecrets(opts) {
+  const { deployUrl, token, appId, envName, devVarsPath, userSecrets, userSecretNames, hadStore } = opts;
+  if (hadStore || userSecretNames.length === 0) return;
+  const configName = defaultConfigNameForEnv(envName);
+  try {
+    await uploadSecrets(deployUrl, token, appId, configName, userSecrets, false);
+    if (existsSync10(devVarsPath)) {
+      const cleaned = removeDevVarsKeys(readFileSync9(devVarsPath, "utf-8"), new Set(userSecretNames));
+      writeFileSync9(devVarsPath, cleaned.endsWith("\n") ? cleaned : `${cleaned}
+`);
+    }
+    p4.log.success(
+      `Migrated ${userSecretNames.length} secret${userSecretNames.length === 1 ? "" : "s"} from .dev.vars into the app store (config ${configName}) \u2014 now managed by \`deepspace secrets\`.`
+    );
+  } catch (err) {
+    p4.log.warn(
+      `Couldn't migrate .dev.vars secrets into the app store (${errMessage(err)}); they deployed as bindings for now and the next deploy will retry.`
+    );
+  }
+}
+async function syncSubscriptionPlans(appDir, appName, token) {
+  const subsPath = join11(appDir, "src", "subscriptions.ts");
   if (!existsSync10(subsPath)) return;
   let plans;
   try {
     const esbuild = await import("esbuild");
-    const outDir = join10(appDir2, ".wrangler", "deploy");
-    const outFile = join10(outDir, "subscriptions.bundle.mjs");
+    const outDir = join11(appDir, ".wrangler", "deploy");
+    const outFile = join11(outDir, "subscriptions.bundle.mjs");
     await esbuild.build({
       entryPoints: [subsPath],
       bundle: true,
@@ -3030,7 +2941,7 @@ async function syncSubscriptionPlans(appDir2, appName, token) {
         Authorization: `Bearer ${token}`,
         "Content-Type": "application/json"
       },
-      body: JSON.stringify({ appName, plans })
+      body: JSON.stringify({ appId: appName, plans })
     });
   } catch (err) {
     s.stop("Plan sync skipped");
@@ -3139,14 +3050,14 @@ current billing period? (Skip to leave them grandfathered.)`
     }
   }
 }
-async function syncOneTimeProducts(appDir2, appName, token) {
-  const productsPath = join10(appDir2, "src", "products.ts");
+async function syncOneTimeProducts(appDir, appName, token) {
+  const productsPath = join11(appDir, "src", "products.ts");
   if (!existsSync10(productsPath)) return;
   let products;
   try {
     const esbuild = await import("esbuild");
-    const outDir = join10(appDir2, ".wrangler", "deploy");
-    const outFile = join10(outDir, "products.bundle.mjs");
+    const outDir = join11(appDir, ".wrangler", "deploy");
+    const outFile = join11(outDir, "products.bundle.mjs");
     await esbuild.build({
       entryPoints: [productsPath],
       bundle: true,
@@ -3178,7 +3089,7 @@ async function syncOneTimeProducts(appDir2, appName, token) {
         Authorization: `Bearer ${token}`,
         "Content-Type": "application/json"
       },
-      body: JSON.stringify({ appName, products })
+      body: JSON.stringify({ appId: appName, products })
     });
   } catch (err) {
     s?.stop("Product sync skipped");
@@ -3219,9 +3130,9 @@ async function waitForAssetsReady(url, timeoutMs) {
 function collectAssets(dir) {
   const assets = [];
   function walk(d, prefix) {
-    for (const entry of readdirSync2(d, { withFileTypes: true })) {
+    for (const entry of readdirSync3(d, { withFileTypes: true })) {
       if (entry.name === ".assetsignore") continue;
-      const full = join10(d, entry.name);
+      const full = join11(d, entry.name);
       const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
       if (entry.isDirectory()) {
         walk(full, rel);
@@ -3249,7 +3160,7 @@ var undeploy_default = defineCommand9({
   args: {
     name: {
       type: "positional",
-      description: "App name to undeploy (reads from wrangler.toml if omitted)",
+      description: "App id to undeploy (reads DEEPSPACE_APP_ID from wrangler.toml if omitted)",
       required: false
     },
     env: {
@@ -3259,21 +3170,17 @@ var undeploy_default = defineCommand9({
     }
   },
   async run({ args }) {
-    let appName = args.name;
     const envName = typeof args.env === "string" && args.env.trim() ? args.env.trim() : void 0;
-    if (!appName) {
-      if (hasWranglerConfig(process.cwd())) {
-        const config = readWranglerConfig(process.cwd());
-        const nameRes = resolveAppNameForEnv(config, envName);
-        if (!nameRes.ok) {
-          p5.cancel(nameRes.reason);
-          process.exit(1);
-        }
-        appName = nameRes.name;
-      }
+    let appId = args.name;
+    if (appId && !APP_ID_RE.test(appId)) {
+      p5.cancel(`"${appId}" is not an app id (app_\u2026). Undeploy targets the id \u2014 run from the app directory, or find it in wrangler.toml.`);
+      process.exit(1);
     }
-    if (!appName) {
-      p5.cancel("Provide an app name or run from a DeepSpace app directory.");
+    if (!appId && hasWranglerConfig(process.cwd())) {
+      appId = readAppId(process.cwd(), envName) ?? void 0;
+    }
+    if (!appId) {
+      p5.cancel("Provide an app id or run from a DeepSpace app directory with a DEEPSPACE_APP_ID.");
       process.exit(1);
     }
     let token;
@@ -3283,10 +3190,10 @@ var undeploy_default = defineCommand9({
       p5.cancel(err instanceof Error ? err.message : String(err));
       process.exit(1);
     }
-    p5.intro(`Undeploying ${appName}`);
+    p5.intro(`Undeploying ${appId}`);
     const s = createSpinner();
     s.start("Removing...");
-    const res = await fetch(`${DEPLOY_URL4}/api/deploy/${appName}`, {
+    const res = await fetch(`${DEPLOY_URL4}/api/deploy/${appId}`, {
       method: "DELETE",
       headers: { Authorization: `Bearer ${token}` }
     });
@@ -3297,7 +3204,10 @@ var undeploy_default = defineCommand9({
       process.exit(1);
     }
     s.stop("Removed");
-    p5.outro(`${appName}.app.space has been taken down`);
+    const hosts = body.releasedHosts ?? [];
+    p5.outro(
+      hosts.length ? `${hosts.join(", ")} taken down. The app keeps its id \u2014 redeploy to bring it back.` : `App ${appId} taken down.`
+    );
   }
 });
 
@@ -3360,12 +3270,12 @@ var whoami_default = defineCommand10({
 // src/cli/commands/add.ts
 import { defineCommand as defineCommand11 } from "citty";
 import { existsSync as existsSync11 } from "fs";
-import { resolve as resolve8, join as join11 } from "path";
+import { resolve as resolve8, join as join12 } from "path";
 import { execSync as execSync3 } from "child_process";
 function findScript(from) {
-  const inNodeModules = join11(from, "node_modules", "deepspace", "scripts", "add-feature.cjs");
+  const inNodeModules = join12(from, "node_modules", "deepspace", "scripts", "add-feature.cjs");
   if (existsSync11(inNodeModules)) return inNodeModules;
-  const inDotDeepspace = join11(from, ".deepspace", "scripts", "add-feature.cjs");
+  const inDotDeepspace = join12(from, ".deepspace", "scripts", "add-feature.cjs");
   if (existsSync11(inDotDeepspace)) return inDotDeepspace;
   return null;
 }
@@ -3398,14 +3308,14 @@ var add_default = defineCommand11({
     }
   },
   run({ args }) {
-    const appDir2 = resolve8(args.dir ?? ".");
-    ensureInstallReady(appDir2);
-    const script = findScript(appDir2);
+    const appDir = resolve8(args.dir ?? ".");
+    ensureInstallReady(appDir);
+    const script = findScript(appDir);
     if (!script) {
       console.error("Could not find the deepspace feature installer.");
       console.error("Looked in:");
-      console.error(`  ${join11(appDir2, "node_modules", "deepspace", "scripts", "add-feature.cjs")}`);
-      console.error(`  ${join11(appDir2, ".deepspace", "scripts", "add-feature.cjs")}`);
+      console.error(`  ${join12(appDir, "node_modules", "deepspace", "scripts", "add-feature.cjs")}`);
+      console.error(`  ${join12(appDir, ".deepspace", "scripts", "add-feature.cjs")}`);
       console.error("Are you in a DeepSpace app directory? Try `npm install` first.");
       process.exit(1);
     }
@@ -3415,13 +3325,13 @@ var add_default = defineCommand11({
     } else if (args.info) {
       passArgs.push("--info", args.info);
     } else if (args.feature) {
-      passArgs.push(args.feature, appDir2);
+      passArgs.push(args.feature, appDir);
     } else {
       passArgs.push("--help");
     }
     execSync3(`node ${JSON.stringify(script)} ${passArgs.map((a) => JSON.stringify(a)).join(" ")}`, {
       stdio: "inherit",
-      cwd: appDir2
+      cwd: appDir
     });
   }
 });
@@ -3430,26 +3340,26 @@ var add_default = defineCommand11({
 import { defineCommand as defineCommand12 } from "citty";
 import spawn2 from "cross-spawn";
 import { mkdirSync as mkdirSync5 } from "fs";
-import { join as join12 } from "path";
+import { join as join13 } from "path";
 import { homedir as homedir5 } from "os";
 var SKILL_REPO = "deepdotspace/deepspace-skill";
 function runSkillsAdd(extraArgs) {
-  return new Promise((resolve11) => {
+  return new Promise((resolve10) => {
     const child = spawn2(
       "npx",
       ["-y", "skills@latest", "add", SKILL_REPO, ...extraArgs],
       { stdio: "inherit" }
     );
-    child.on("close", (code) => resolve11(code ?? 1));
+    child.on("close", (code) => resolve10(code ?? 1));
     child.on("error", (err) => {
       console.error(`Failed to invoke npx: ${err.message}`);
       console.error("Is Node.js installed and on PATH?");
-      resolve11(1);
+      resolve10(1);
     });
   });
 }
 function precreateClaudeDir(baseDir) {
-  mkdirSync5(join12(baseDir, ".claude"), { recursive: true });
+  mkdirSync5(join13(baseDir, ".claude"), { recursive: true });
 }
 var add = defineCommand12({
   meta: {
@@ -3507,6 +3417,13 @@ var skills_default = defineCommand12({
 import { defineCommand as defineCommand13 } from "citty";
 
 // src/cli/lib/api.ts
+var ApiError = class extends Error {
+  constructor(message, status3, code) {
+    super(message);
+    this.status = status3;
+    this.code = code;
+  }
+};
 async function apiFetch(baseUrl, token, path, init) {
   const res = await fetch(`${baseUrl}${path}`, {
     ...init,
@@ -3519,13 +3436,16 @@ async function apiFetch(baseUrl, token, path, init) {
   const text2 = await res.text();
   if (!res.ok) {
     let msg = text2;
+    let code;
     try {
-      msg = JSON.parse(text2).error ?? text2;
+      const body = JSON.parse(text2);
+      msg = body.error ?? text2;
+      code = body.code;
     } catch {
     }
-    throw new Error(`API ${path} (${res.status}): ${msg}`);
+    throw new ApiError(`API ${path} (${res.status}): ${msg}`, res.status, code);
   }
-  return JSON.parse(text2);
+  return text2 ? JSON.parse(text2) : {};
 }
 
 // src/cli/commands/domain.ts
@@ -3556,11 +3476,11 @@ async function confirm3(message) {
     throw new Error(`${message} \u2014 pass --yes to confirm non-interactively`);
   }
   process.stdout.write(`${message} [y/N] `);
-  return new Promise((resolve11) => {
+  return new Promise((resolve10) => {
     process.stdin.setEncoding("utf-8");
     process.stdin.once("data", (data) => {
       const answer = data.toString().trim().toLowerCase();
-      resolve11(answer === "y" || answer === "yes");
+      resolve10(answer === "y" || answer === "yes");
     });
   });
 }
@@ -3637,7 +3557,7 @@ var buy = defineCommand13({
     }
     const checkout = await api(token, "/api/domains/checkout", {
       method: "POST",
-      body: JSON.stringify({ domain: args.domain, appName })
+      body: JSON.stringify({ domain: args.domain, appId: appName })
     });
     if (args.json) {
       process.stdout.write(
@@ -3781,7 +3701,7 @@ var attach = defineCommand13({
       `/api/domains/${found.id}/reattach`,
       {
         method: "POST",
-        body: JSON.stringify({ appName: targetApp })
+        body: JSON.stringify({ appId: targetApp })
       }
     );
     if (args.json) {
@@ -3856,36 +3776,27 @@ var domain_default = defineCommand13({
 
 // src/cli/commands/collaborators.ts
 import { defineCommand as defineCommand14 } from "citty";
+
+// src/server/auth/testAccounts.ts
+var TEST_ACCOUNT_EMAIL_SUFFIX = "@deepspace.test";
+function isTestAccountEmail(email) {
+  return !!email && email.trim().toLowerCase().endsWith(TEST_ACCOUNT_EMAIL_SUFFIX);
+}
+
+// src/cli/commands/collaborators.ts
 var API_URL3 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
-async function api2(token, path, init) {
-  const res = await fetch(`${API_URL3}${path}`, {
-    ...init,
-    headers: {
-      Authorization: `Bearer ${token}`,
-      "Content-Type": "application/json",
-      ...init?.headers ?? {}
-    }
-  });
-  const text2 = await res.text();
-  if (!res.ok) {
-    let msg = text2;
-    try {
-      msg = JSON.parse(text2).error ?? text2;
-    } catch {
-    }
-    throw new Error(`API ${path} (${res.status}): ${msg}`);
-  }
-  return text2 ? JSON.parse(text2) : {};
+function api2(token, path, init) {
+  return apiFetch(API_URL3, token, path, init);
 }
 var list3 = defineCommand14({
   meta: { name: "list", description: "List collaborators on your app" },
   args: {
-    app: { type: "string", description: "App name (defaults to ./wrangler.toml)" },
+    app: { type: "string", alias: "a", description: "App id (defaults to ./wrangler.toml)" },
     json: { type: "boolean", description: "Emit JSON" }
   },
   async run({ args }) {
     const token = await ensureToken();
-    const app = requireAppName(args.app);
+    const app = requireAppIdArg(args.app);
     const { collaborators } = await api2(
       token,
       `/api/app-collaborators/${encodeURIComponent(app)}`
@@ -3911,12 +3822,18 @@ var add2 = defineCommand14({
       description: "Collaborator email (must already be a DeepSpace user)",
       required: true
     },
-    app: { type: "string", description: "App name (defaults to ./wrangler.toml)" },
+    app: { type: "string", alias: "a", description: "App id (defaults to ./wrangler.toml)" },
     json: { type: "boolean", description: "Emit JSON" }
   },
   async run({ args }) {
     const token = await ensureToken();
-    const app = requireAppName(args.app);
+    const app = requireAppIdArg(args.app);
+    if (isTestAccountEmail(args.email)) {
+      console.error(
+        "Test accounts (@deepspace.test) cannot be added as collaborators. Use a real DeepSpace account."
+      );
+      process.exit(1);
+    }
     const { collaborator } = await api2(
       token,
       `/api/app-collaborators/${encodeURIComponent(app)}`,
@@ -3933,12 +3850,12 @@ var remove = defineCommand14({
   meta: { name: "remove", description: "Remove a collaborator from your app" },
   args: {
     email: { type: "positional", description: "Collaborator email", required: true },
-    app: { type: "string", description: "App name (defaults to ./wrangler.toml)" },
+    app: { type: "string", alias: "a", description: "App id (defaults to ./wrangler.toml)" },
     json: { type: "boolean", description: "Emit JSON" }
   },
   async run({ args }) {
     const token = await ensureToken();
-    const app = requireAppName(args.app);
+    const app = requireAppIdArg(args.app);
     const { collaborators } = await api2(
       token,
       `/api/app-collaborators/${encodeURIComponent(app)}`
@@ -3966,12 +3883,86 @@ var collaborators_default = defineCommand14({
   subCommands: { list: list3, add: add2, remove }
 });
 
-// src/cli/commands/integrations.ts
+// src/cli/commands/transfer.ts
 import { defineCommand as defineCommand15 } from "citty";
+var API_URL4 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
+var DEPLOY_URL5 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
+var offer = defineCommand15({
+  meta: { name: "offer", description: "Offer this app to another DeepSpace user" },
+  args: {
+    email: { type: "positional", description: "Recipient email", required: true },
+    app: { type: "string", alias: "a", description: "App id (defaults to ./wrangler.toml)" }
+  },
+  async run({ args }) {
+    const token = await ensureToken();
+    const app = requireAppIdArg(args.app);
+    const { expiresAt } = await apiFetch(
+      API_URL4,
+      token,
+      `/api/app-transfers/${encodeURIComponent(app)}`,
+      { method: "POST", body: JSON.stringify({ email: args.email }) }
+    );
+    console.log(
+      `\u2713 Offered ${app} to ${args.email} (expires ${expiresAt}).
+  They accept with: deepspace transfer accept --app ${app}`
+    );
+  }
+});
+var status2 = defineCommand15({
+  meta: { name: "status", description: "Show the pending transfer offer, if any" },
+  args: {
+    app: { type: "string", alias: "a", description: "App id (defaults to ./wrangler.toml)" }
+  },
+  async run({ args }) {
+    const token = await ensureToken();
+    const app = requireAppIdArg(args.app);
+    const { transfer } = await apiFetch(API_URL4, token, `/api/app-transfers/${encodeURIComponent(app)}`);
+    if (!transfer) {
+      console.log(`No pending transfer for ${app}.`);
+      return;
+    }
+    console.log(`Pending: ${app} \u2192 ${transfer.toEmailDisplay} (expires ${transfer.expiresAt}).`);
+  }
+});
+var accept = defineCommand15({
+  meta: { name: "accept", description: "Accept a transfer offered to you" },
+  args: {
+    app: { type: "string", alias: "a", description: "App id of the offered app", required: true }
+  },
+  async run({ args }) {
+    const token = await ensureToken();
+    const app = requireAppIdArg(args.app);
+    await apiFetch(DEPLOY_URL5, token, `/api/apps/${encodeURIComponent(app)}/transfer/accept`, {
+      method: "POST"
+    });
+    console.log(
+      `\u2713 You now own ${app}. Run \`deepspace init\` in a fresh clone (or set DEEPSPACE_APP_ID = "${app}" in wrangler.toml) and deploy.`
+    );
+  }
+});
+var cancel4 = defineCommand15({
+  meta: { name: "cancel", description: "Cancel/decline the pending offer (either party)" },
+  args: {
+    app: { type: "string", alias: "a", description: "App id (defaults to ./wrangler.toml)" }
+  },
+  async run({ args }) {
+    const token = await ensureToken();
+    const app = requireAppIdArg(args.app);
+    await apiFetch(API_URL4, token, `/api/app-transfers/${encodeURIComponent(app)}`, { method: "DELETE" });
+    console.log(`\u2713 Transfer offer for ${app} cancelled.`);
+  }
+});
+var transfer_default = defineCommand15({
+  meta: { name: "transfer", description: "Transfer app ownership to another user" },
+  subCommands: { offer, status: status2, accept, cancel: cancel4 }
+});
+
+// src/cli/commands/integrations.ts
+import { defineCommand as defineCommand16 } from "citty";
 
 // src/cli/commands/_invoke-impl.ts
 import { readFileSync as readFileSync10 } from "fs";
-var API_URL4 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
+var API_URL5 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
 var DEFAULT_TIMEOUT_MS = 12e4;
 function parseTarget(target) {
   if (!target || typeof target !== "string") {
@@ -4013,7 +4004,7 @@ function flushAndExit(code) {
   });
 }
 async function fetchCatalog(opts = {}) {
-  const url = opts.summary ? `${API_URL4}/api/integrations?summary=1` : `${API_URL4}/api/integrations`;
+  const url = opts.summary ? `${API_URL5}/api/integrations?summary=1` : `${API_URL5}/api/integrations`;
   const res = await fetch(url);
   if (!res.ok) {
     throw new Error(`Failed to fetch integration catalog (${res.status})`);
@@ -4101,7 +4092,7 @@ async function runInvoke(args) {
   const startedAt = Date.now();
   let res;
   try {
-    res = await fetch(`${API_URL4}/api/integrations/${integration}/${endpoint}`, {
+    res = await fetch(`${API_URL5}/api/integrations/${integration}/${endpoint}`, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
@@ -4152,7 +4143,7 @@ async function runInvoke(args) {
 }
 
 // src/cli/commands/integrations.ts
-var list4 = defineCommand15({
+var list4 = defineCommand16({
   meta: {
     name: "list",
     description: "List all available integrations"
@@ -4173,7 +4164,7 @@ var list4 = defineCommand15({
     }
   }
 });
-var info = defineCommand15({
+var info = defineCommand16({
   meta: {
     name: "info",
     description: "Print schema + example body for an integration endpoint"
@@ -4199,7 +4190,7 @@ var info = defineCommand15({
     }
   }
 });
-var invoke = defineCommand15({
+var invoke = defineCommand16({
   meta: {
     name: "invoke",
     description: "Invoke a platform integration as the logged-in user"
@@ -4252,7 +4243,7 @@ var invoke = defineCommand15({
     }
   }
 });
-var integrations_default = defineCommand15({
+var integrations_default = defineCommand16({
   meta: {
     name: "integrations",
     description: "List, inspect, and invoke platform integrations"
@@ -4265,8 +4256,8 @@ var integrations_default = defineCommand15({
 });
 
 // src/cli/commands/invoke.ts
-import { defineCommand as defineCommand16 } from "citty";
-var invoke_default = defineCommand16({
+import { defineCommand as defineCommand17 } from "citty";
+var invoke_default = defineCommand17({
   meta: {
     name: "invoke",
     description: "Invoke a platform integration as the logged-in user"
@@ -4339,13 +4330,13 @@ var invoke_default = defineCommand16({
 });
 
 // src/cli/commands/library.ts
-import { defineCommand as defineCommand17 } from "citty";
+import { defineCommand as defineCommand18 } from "citty";
 import { existsSync as existsSync12, readFileSync as readFileSync11 } from "fs";
-import { join as join13, resolve as resolve9 } from "path";
-import { parse as parseToml3 } from "smol-toml";
+import { join as join14, resolve as resolve9 } from "path";
+import { parse as parseToml4 } from "smol-toml";
 import * as p6 from "@clack/prompts";
 var DEFAULT_LIBRARY_APP = "deepdotspace-site";
-var publish = defineCommand17({
+var publish = defineCommand18({
   meta: {
     name: "publish",
     description: "Publish the current app to the DeepSpace library"
@@ -4418,12 +4409,12 @@ var publish = defineCommand17({
     intro6("Publishing to the DeepSpace library");
     let appName = typeof args.app === "string" && args.app.trim() ? args.app.trim() : void 0;
     if (!appName) {
-      const appDir2 = resolve9(typeof args.dir === "string" && args.dir ? args.dir : ".");
-      const wranglerPath = join13(appDir2, "wrangler.toml");
+      const appDir = resolve9(typeof args.dir === "string" && args.dir ? args.dir : ".");
+      const wranglerPath = join14(appDir, "wrangler.toml");
       if (!existsSync12(wranglerPath)) {
         return die("No --app provided and no wrangler.toml found. Either pass --app <name> or run from your app's directory.");
       }
-      const cfg = parseToml3(readFileSync11(wranglerPath, "utf-8"));
+      const cfg = parseToml4(readFileSync11(wranglerPath, "utf-8"));
       const nameRes = resolveAppName(cfg.name);
       if (!nameRes.ok) return die(`wrangler.toml: ${nameRes.reason}`);
       appName = nameRes.name;
@@ -4484,7 +4475,7 @@ var publish = defineCommand17({
     p6.outro("Done");
   }
 });
-var unpublish = defineCommand17({
+var unpublish = defineCommand18({
   meta: {
     name: "unpublish",
     description: "Remove a library entry (owner or admin only)"
@@ -4543,7 +4534,7 @@ var unpublish = defineCommand17({
     p6.outro("Done");
   }
 });
-var library_default = defineCommand17({
+var library_default = defineCommand18({
   meta: {
     name: "library",
     description: "Manage your DeepSpace library entries"
@@ -4555,13 +4546,13 @@ var library_default = defineCommand17({
 });
 
 // src/cli/commands/feedback.ts
-import { defineCommand as defineCommand18 } from "citty";
+import { defineCommand as defineCommand19 } from "citty";
 import * as p7 from "@clack/prompts";
 import { existsSync as existsSync13, readFileSync as readFileSync12 } from "fs";
-import { dirname as dirname3, join as join14 } from "path";
+import { dirname as dirname3, join as join15 } from "path";
 import { fileURLToPath } from "url";
 import { release } from "os";
-var API_URL5 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
+var API_URL6 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
 var TYPES = ["bug", "feature", "other"];
 var TYPE_LABELS = {
   bug: "Bug report",
@@ -4571,7 +4562,7 @@ var TYPE_LABELS = {
 var MAX_TITLE_LEN = 200;
 var MAX_BODY_LEN = 1e4;
 var MAX_CONTEXT_LEN = 200;
-var api3 = (token, path, init) => apiFetch(API_URL5, token, path, init);
+var api3 = (token, path, init) => apiFetch(API_URL6, token, path, init);
 function normalizeType(raw) {
   const value = (raw ?? "bug").toLowerCase();
   if (TYPES.includes(value)) return value;
@@ -4581,8 +4572,8 @@ function readCliVersion() {
   try {
     const here = dirname3(fileURLToPath(import.meta.url));
     const candidates = [
-      join14(here, "..", "package.json"),
-      join14(here, "..", "..", "..", "package.json")
+      join15(here, "..", "package.json"),
+      join15(here, "..", "..", "..", "package.json")
     ];
     for (const path of candidates) {
       if (!existsSync13(path)) continue;
@@ -4633,7 +4624,7 @@ function buildFeedbackPayload(input) {
     ...input.context
   };
 }
-var feedback_default = defineCommand18({
+var feedback_default = defineCommand19({
   meta: {
     name: "feedback",
     description: "Submit a bug report, feature request, or feedback to DeepSpace"
@@ -4669,7 +4660,7 @@ var feedback_default = defineCommand18({
   },
   async run({ args }) {
     const interactive = process.stdin.isTTY && !args.json;
-    const fail = (message) => {
+    const fail2 = (message) => {
       if (args.json) {
         process.stdout.write(JSON.stringify({ ok: false, error: message }) + "\n");
       } else {
@@ -4681,12 +4672,12 @@ var feedback_default = defineCommand18({
     try {
       type = normalizeType(args.type ? String(args.type) : void 0);
     } catch (err) {
-      return fail(err.message);
+      return fail2(err.message);
     }
     let title = args.title ? String(args.title) : "";
     let body = args.message ? String(args.message) : "";
     if ((!title || !body) && !interactive) {
-      return fail(
+      return fail2(
         'Provide a title and --message to submit non-interactively, e.g. `deepspace feedback "Title" --message "Details"`.'
       );
     }
@@ -4748,7 +4739,7 @@ var feedback_default = defineCommand18({
         context: collectContext()
       });
     } catch (err) {
-      return fail(err.message);
+      return fail2(err.message);
     }
     if (interactive && !args.yes) {
       p7.note(
@@ -4761,1011 +4752,395 @@ Context: deepspace ${payload.cliVersion} \xB7 ${payload.nodeVersion} \xB7 ${payl
         "Review"
       );
       const ok = await p7.confirm({ message: "Send this to the DeepSpace team?" });
-      if (p7.isCancel(ok) || !ok) {
-        p7.cancel("Not sent.");
-        process.exit(0);
-      }
-    }
-    let token;
-    try {
-      token = await ensureToken();
-    } catch (err) {
-      return fail(err.message ?? "Not signed in. Run `deepspace login`.");
-    }
-    let result;
-    try {
-      result = await api3(token, "/api/feedback", {
-        method: "POST",
-        body: JSON.stringify(payload)
-      });
-    } catch (err) {
-      return fail(err.message);
-    }
-    if (args.json) {
-      process.stdout.write(JSON.stringify({ ok: true, report: result.report }) + "\n");
-      return;
-    }
-    if (interactive) {
-      p7.outro(`Thanks! Submitted as ${result.report.id}.`);
-    } else {
-      console.log(`Submitted feedback ${result.report.id} (${result.report.type}).`);
-    }
-    console.log(`Track triage status at ${DASHBOARD_URL}.`);
-  }
-});
-
-// src/cli/commands/secrets.ts
-import { defineCommand as defineCommand19 } from "citty";
-import { existsSync as existsSync14, readFileSync as readFileSync13, rmSync as rmSync3 } from "fs";
-import { join as join15, resolve as resolve10 } from "path";
-var DEPLOY_URL5 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
-function appDir(args) {
-  const dir = typeof args.dir === "string" && args.dir ? args.dir : typeof args.scope === "string" && args.scope ? args.scope : ".";
-  return resolve10(dir);
-}
-function wranglerEnv(args) {
-  return typeof args.env === "string" && args.env.trim() ? args.env.trim() : void 0;
-}
-function targetFromArgs(args) {
-  const dir = appDir(args);
-  const target = resolveSecretsTarget(dir, {
-    project: typeof args.project === "string" && args.project ? args.project : void 0,
-    config: typeof args.config === "string" && args.config ? args.config : void 0,
-    wranglerEnv: wranglerEnv(args)
-  });
-  return { appDir: dir, target };
-}
-function scopedArgs() {
-  return {
-    dir: { type: "string", description: "App directory (default: current directory)", required: false },
-    scope: { type: "string", description: "Directory scope; Doppler-compatible alias for --dir", required: false },
-    env: { type: "string", alias: "e", description: "Advanced: wrangler.toml [env.<name>] cache/link slot", required: false },
-    json: { type: "boolean", description: "Emit JSON", default: false }
-  };
-}
-function commonArgs() {
-  return {
-    ...scopedArgs(),
-    project: { type: "string", alias: "p", description: "Secrets project (default: linked project or wrangler name; does not link)", required: false },
-    config: { type: "string", alias: "c", description: "Secrets config (Doppler-compatible; default: linked config or prd)", required: false }
-  };
-}
-function setupArgs() {
-  return {
-    ...scopedArgs(),
-    project: { type: "string", alias: "p", description: "Secrets project to link (default: linked project or wrangler name)", required: false },
-    config: { type: "string", alias: "c", description: "Secrets config to link (default: linked config or prd)", required: false },
-    "no-interactive": { type: "boolean", description: "Accepted for Doppler CLI compatibility; DeepSpace setup never prompts", default: false },
-    "no-save-token": { type: "boolean", description: "Accepted for Doppler CLI compatibility; DeepSpace does not save a token here", default: false }
-  };
-}
-async function refreshCache(token, dir, target) {
-  const values = await fetchSecretsValues(
-    DEPLOY_URL5,
-    token,
-    target.projectName,
-    target.configName,
-    appScopedSecretsApiOptions(dir, target)
-  );
-  writeSecretsCacheFile(dir, values, target);
-  return Object.keys(values).length;
-}
-async function refreshCacheIfLinked(token, dir, target) {
-  if (!secretsTargetMatchesLink(dir, target)) return null;
-  return refreshCache(token, dir, target);
-}
-function writeLinkForTarget(dir, target, projectOverride) {
-  writeWranglerSecretsLink(dir, target, { projectOverride });
-}
-function redeployReminder(target) {
-  const envFlag = target.wranglerEnv ? ` --env ${target.wranglerEnv}` : "";
-  console.log(`Redeploy for production to receive these secrets: npx deepspace deploy${envFlag}`);
-}
-function unlinkedTargetNotice(target) {
-  const envFlag = target.wranglerEnv ? ` --env ${target.wranglerEnv}` : "";
-  console.log(
-    `Not linked for dev/test/deploy; run npx deepspace secrets setup --project ${target.projectName} --config ${target.configName}${envFlag}.`
-  );
-}
-function cacheJson(count) {
-  return { linked: count !== null, cachedSecrets: count };
-}
-function updateRequiredSecretsIfTopLevelLinked(dir, target, keys, opts = {}) {
-  if (target.wranglerEnv || !secretsTargetMatchesLink(dir, target)) return null;
-  return updateWranglerRequiredSecrets(dir, keys, opts);
-}
-function removeRequiredSecretsIfTopLevelLinked(dir, target, keys) {
-  if (target.wranglerEnv || !secretsTargetMatchesLink(dir, target)) return null;
-  return removeWranglerRequiredSecrets(dir, keys);
-}
-function requiredSecretsJson(keys) {
-  return keys ? { requiredSecrets: keys } : {};
-}
-function requiredSecretsNotice(keys) {
-  if (!keys) return;
-  console.log(`Updated wrangler.toml detected-secret advisory (${keys.length} name${keys.length === 1 ? "" : "s"}).`);
-}
-async function ensureLinkedRemoteTarget(dir, target) {
-  let token;
-  try {
-    token = await ensureToken();
-  } catch (err) {
-    return {
-      status: "unchecked",
-      message: err instanceof Error ? err.message : String(err)
-    };
-  }
-  try {
-    const configs2 = await listConfigs(
-      DEPLOY_URL5,
-      token,
-      target.projectName,
-      appScopedSecretsApiOptions(dir, target)
-    );
-    if (configs2.some((config) => config.name === target.configName)) {
-      return { status: "ok" };
-    }
-  } catch (err) {
-    if (!(err instanceof SecretsApiError && err.status === 404)) {
-      return {
-        status: "unchecked",
-        message: err instanceof Error ? err.message : String(err)
-      };
-    }
-  }
-  try {
-    await createConfig(
-      DEPLOY_URL5,
-      token,
-      target.projectName,
-      target.configName,
-      void 0,
-      appScopedSecretsApiOptions(dir, target)
-    );
-    return { status: "created" };
-  } catch (err) {
-    return {
-      status: "unchecked",
-      message: `Remote config ${target.projectName}/${target.configName} was not found and could not be created: ${err instanceof Error ? err.message : String(err)}`
-    };
-  }
-}
-async function bestEffortSetServerSecretsLink(dir, target) {
-  try {
-    const token = await ensureToken();
-    await setServerSecretsLink(
-      DEPLOY_URL5,
-      token,
-      resolveSecretsAppName(dir, target.wranglerEnv),
-      target.projectName
-    );
-  } catch {
-  }
-}
-async function bestEffortClearServerSecretsLink(dir, targetEnv) {
-  try {
-    const token = await ensureToken();
-    await clearServerSecretsLink(DEPLOY_URL5, token, resolveSecretsAppName(dir, targetEnv));
-  } catch {
-  }
-}
-async function importLegacyDevVarsSecrets(dir, target, remoteCheck) {
-  if (remoteCheck.status === "unchecked") return null;
-  const legacyPath = target.wranglerEnv ? join15(dir, `.dev.vars.${target.wranglerEnv}`) : join15(dir, ".dev.vars");
-  if (!existsSync14(legacyPath)) return null;
-  try {
-    const custom = extractCustomDevVars(
-      stripGeneratedSecretsCache2(readFileSync13(legacyPath, "utf-8"))
-    );
-    if (!custom.trim()) return null;
-    const parsed = parseDevVars(custom);
-    const secrets = {};
-    const skipped = [];
-    for (const [key, value] of Object.entries(parsed)) {
-      try {
-        validateSecretName(key);
-        validateSecretValue(key, value);
-        secrets[key] = value;
-      } catch {
-        skipped.push(key);
-      }
-    }
-    const keys = Object.keys(secrets).sort();
-    if (keys.length === 0) return null;
-    const token = await ensureToken();
-    if (remoteCheck.status === "ok") {
-      const existing = await listSecrets(
-        DEPLOY_URL5,
-        token,
-        target.projectName,
-        target.configName,
-        appScopedSecretsApiOptions(dir, target)
-      );
-      if (existing.secrets.length > 0) {
-        return { status: "config-not-empty", existingCount: existing.secrets.length, keys };
-      }
-    }
-    await uploadSecrets(
-      DEPLOY_URL5,
-      token,
-      target.projectName,
-      target.configName,
-      secrets,
-      false,
-      appScopedSecretsApiOptions(dir, target)
-    );
-    let cleanedLegacyFile = false;
-    try {
-      const cleaned = removeDevVarsKeys(
-        stripGeneratedSecretsCache2(readFileSync13(legacyPath, "utf-8")),
-        new Set(keys)
-      );
-      if (target.wranglerEnv && !extractCustomDevVars(cleaned).trim()) {
-        rmSync3(legacyPath, { force: true });
-      } else {
-        writeSecretFileSync(legacyPath, cleaned ? `${cleaned}
-` : "");
+      if (p7.isCancel(ok) || !ok) {
+        p7.cancel("Not sent.");
+        process.exit(0);
       }
-      cleanedLegacyFile = true;
-    } catch {
     }
-    await refreshCacheIfLinked(token, dir, target);
-    const requiredSecrets = updateRequiredSecretsIfTopLevelLinked(dir, target, keys);
-    return { status: "imported", keys, skipped: skipped.sort(), requiredSecrets, cleanedLegacyFile };
-  } catch (err) {
-    return { status: "error", message: err instanceof Error ? err.message : String(err) };
-  }
-}
-function printLegacySecretsImport(result, target) {
-  if (!result) return;
-  const configRef = `${target.projectName}/${target.configName}`;
-  if (result.status === "imported") {
-    console.log(
-      `Imported ${result.keys.length} legacy secret${result.keys.length === 1 ? "" : "s"} from .dev.vars into ${configRef}: ${result.keys.join(", ")}`
-    );
-    if (result.cleanedLegacyFile) {
-      console.log("Removed the migrated lines from the local file; the remote store owns them now.");
+    let token;
+    try {
+      token = await ensureToken();
+    } catch (err) {
+      return fail2(err.message ?? "Not signed in. Run `deepspace login`.");
     }
-    if (result.skipped.length > 0) {
-      console.log(`Skipped SDK-managed/invalid keys (left in place): ${result.skipped.join(", ")}`);
+    let result;
+    try {
+      result = await api3(token, "/api/feedback", {
+        method: "POST",
+        body: JSON.stringify(payload)
+      });
+    } catch (err) {
+      return fail2(err.message);
     }
-    requiredSecretsNotice(result.requiredSecrets);
-    return;
-  }
-  if (result.status === "config-not-empty") {
-    console.log(
-      `Found ${result.keys.length} legacy secret${result.keys.length === 1 ? "" : "s"} in .dev.vars, but ${configRef} already has ${result.existingCount} \u2014 not imported. Merge manually with npx deepspace secrets upload.`
-    );
-    return;
-  }
-  console.warn(`Warning: legacy .dev.vars secrets were not imported: ${result.message}`);
-}
-function printLinkRemoteWarning(check) {
-  if (check.status !== "unchecked") return;
-  console.warn(`Warning: Linked locally, but the remote config was not checked: ${check.message}`);
-}
-function positionals(args, firstName) {
-  const raw = Array.isArray(args._) ? args._ : [];
-  if (raw.length > 0) return raw.map(String);
-  const first = args[firstName];
-  return typeof first === "string" && first ? [first] : [];
-}
-function rawPositionals(rawArgs, argsDef) {
-  const camel = (name) => name.replace(/-([a-z0-9])/g, (_, ch) => ch.toUpperCase());
-  const stringFlags = /* @__PURE__ */ new Set();
-  const booleanFlags = /* @__PURE__ */ new Set();
-  for (const [name, def] of Object.entries(argsDef)) {
-    if (def.type === "positional") continue;
-    const flags = def.type === "boolean" ? booleanFlags : stringFlags;
-    flags.add(name);
-    flags.add(camel(name));
-    for (const alias of Array.isArray(def.alias) ? def.alias : def.alias ? [def.alias] : []) {
-      flags.add(alias);
-      flags.add(camel(alias));
+    if (args.json) {
+      process.stdout.write(JSON.stringify({ ok: true, report: result.report }) + "\n");
+      return;
     }
-  }
-  const out = [];
-  for (let i = 0; i < rawArgs.length; i++) {
-    const token = rawArgs[i];
-    if (token === "--") {
-      out.push(...rawArgs.slice(i + 1));
-      break;
-    }
-    if (token.length > 1 && token.startsWith("-")) {
-      const body = token.startsWith("--") ? token.slice(2) : token.slice(1);
-      const eq = body.indexOf("=");
-      const name = eq === -1 ? body : body.slice(0, eq);
-      if (booleanFlags.has(name) || name.startsWith("no-") && booleanFlags.has(name.slice(3))) {
-        continue;
-      }
-      if (stringFlags.has(name)) {
-        if (eq === -1) i++;
-        continue;
-      }
+    if (interactive) {
+      p7.outro(`Thanks! Submitted as ${result.report.id}.`);
+    } else {
+      console.log(`Submitted feedback ${result.report.id} (${result.report.type}).`);
     }
-    out.push(token);
-  }
-  return out;
-}
-function hasRawFlag(rawArgs, name) {
-  if (!Array.isArray(rawArgs)) return false;
-  for (const token of rawArgs) {
-    if (token === "--") return false;
-    if (token === `--${name}`) return true;
+    console.log(`Track triage status at ${DASHBOARD_URL}.`);
   }
-  return false;
-}
-function downloadFormat(value) {
-  const raw = typeof value === "string" && value ? value : "json";
-  if (raw === "json" || raw === "dotnet-json" || raw === "env" || raw === "yaml" || raw === "docker" || raw === "env-no-quotes") {
-    return raw;
-  }
-  throw new Error("Unsupported format. Use one of: json, dotnet-json, env, yaml, docker, env-no-quotes.");
-}
-function resolveSecretsSetupArgs(args) {
-  const dir = appDir(args);
-  const project = typeof args.project === "string" && args.project ? args.project : void 0;
-  const config = typeof args.config === "string" && args.config ? args.config : void 0;
-  const target = resolveSecretsTarget(dir, {
-    project,
-    config,
-    wranglerEnv: wranglerEnv(args)
-  });
-  return {
-    appDir: dir,
-    target,
-    projectOverride: !!project && !!target.wranglerEnv
-  };
-}
-function resolveConfigureUnsetArgs(args) {
-  const names = positionals(args, "name");
-  if (names.length === 0) {
-    throw new Error("At least one setting is required. Use `npx deepspace secrets configure unset project config`.");
+});
+
+// src/cli/commands/secrets.ts
+import { defineCommand as defineCommand20 } from "citty";
+import { readFileSync as readFileSync13 } from "fs";
+var DEPLOY_URL6 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
+var COMMON_ARGS = {
+  app: {
+    type: "string",
+    alias: "a",
+    description: "App id (default: DEEPSPACE_APP_ID from the nearest wrangler.toml)",
+    required: false
+  },
+  config: {
+    type: "string",
+    alias: "c",
+    description: 'Config name (default: the --env name, or "prd")',
+    required: false
+  },
+  env: {
+    type: "string",
+    alias: "e",
+    description: "wrangler.toml [env.<name>] slot \u2014 selects that env\u2019s app id and config",
+    required: false
   }
-  const unset = [];
-  for (const name of names) {
-    if (name !== "project" && name !== "config") {
-      throw new Error(`Unsupported configure unset option "${name}". Use project and/or config.`);
+};
+async function resolveTarget(args) {
+  const wranglerEnv = args.env?.trim() || void 0;
+  let appId = args.app?.trim();
+  if (appId && !APP_ID_RE.test(appId)) {
+    throw new Error(`Invalid app id "${appId}" \u2014 expected app_<26 chars>.`);
+  }
+  if (!appId) {
+    const appDir = findAppDir();
+    appId = appDir && readAppId(appDir, wranglerEnv) || void 0;
+    if (!appId) {
+      throw new Error(
+        "No app id. Run from an app directory whose wrangler.toml carries DEEPSPACE_APP_ID (`deepspace init` mints one), or pass --app <appId>."
+      );
     }
-    if (!unset.includes(name)) unset.push(name);
   }
-  return {
-    appDir: appDir(args),
-    unset,
-    wranglerEnv: wranglerEnv(args)
-  };
+  const configName = validateConfigName(args.config?.trim() || defaultConfigNameForEnv(wranglerEnv));
+  const token = await ensureToken();
+  return { appId, configName, token };
+}
+function fail(err) {
+  console.error(err instanceof Error ? err.message : String(err));
+  process.exit(1);
 }
-var list5 = defineCommand19({
+var list5 = defineCommand20({
   meta: { name: "list", description: "List masked secrets in a config" },
   args: {
-    ...commonArgs(),
-    "only-names": { type: "boolean", description: "Only print secret names; omit values and metadata", default: false },
-    raw: { type: "boolean", description: "Accepted for Doppler CLI compatibility; DeepSpace has no variable interpolation", default: false },
-    type: { type: "boolean", description: "Accepted for Doppler CLI compatibility", default: false },
-    visibility: { type: "boolean", description: "Accepted for Doppler CLI compatibility", default: false }
+    ...COMMON_ARGS,
+    "only-names": {
+      type: "boolean",
+      description: "Only print secret names; omit values and metadata",
+      default: false
+    },
+    json: { type: "boolean", description: "Machine-readable output", default: false }
   },
   async run({ args }) {
     try {
-      const token = await ensureToken();
-      const { appDir: dir, target } = targetFromArgs(args);
-      const result = await listSecrets(
-        DEPLOY_URL5,
-        token,
-        target.projectName,
-        target.configName,
-        appScopedSecretsApiOptions(dir, target)
-      );
+      const t = await resolveTarget(args);
+      const { secrets } = await listSecrets(DEPLOY_URL6, t.token, t.appId, t.configName);
       if (args.json) {
-        process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+        console.log(JSON.stringify({ appId: t.appId, config: t.configName, secrets }, null, 2));
         return;
       }
-      if (result.secrets.length === 0) {
-        console.log(`No secrets in ${target.projectName}/${target.configName}.`);
+      if (secrets.length === 0) {
+        console.log(`No secrets in ${t.configName}.`);
         return;
       }
-      if (args.onlyNames) {
-        for (const item of result.secrets) console.log(item.key);
-        return;
-      }
-      for (const item of result.secrets) {
-        console.log(`${item.key.padEnd(32)} ${item.masked}  v${item.version}  ${item.updatedAt}`);
+      for (const s of secrets) {
+        console.log(args["only-names"] ? s.key : `${s.key}  (v${s.version}, ${s.valueBytes}B, ${s.updatedAt})`);
       }
     } catch (err) {
-      console.error(err instanceof Error ? err.message : String(err));
-      process.exit(1);
+      fail(err);
     }
   }
 });
-var SET_ARGS = {
-  ...commonArgs(),
-  secret: { type: "positional", description: "KEY=value or KEY value", required: true },
-  "no-interactive": { type: "boolean", description: "Accepted for Doppler CLI compatibility", default: false },
-  raw: { type: "boolean", description: "Accepted for Doppler CLI compatibility; DeepSpace has no variable interpolation", default: false },
-  type: { type: "string", description: "Accepted for Doppler CLI compatibility", required: false },
-  visibility: { type: "string", description: "Accepted for Doppler CLI compatibility", required: false }
-};
-var set = defineCommand19({
-  meta: { name: "set", description: "Set remote secrets from KEY=value or KEY value" },
-  args: SET_ARGS,
-  async run({ args, rawArgs }) {
+var set = defineCommand20({
+  meta: { name: "set", description: "Set secrets from KEY=value pairs" },
+  args: {
+    ...COMMON_ARGS,
+    secret: { type: "positional", description: "KEY=value (repeatable)", required: true }
+  },
+  async run({ args }) {
     try {
-      const token = await ensureToken();
-      const { appDir: dir, target } = targetFromArgs(args);
-      const inputs = Array.isArray(rawArgs) ? rawPositionals(rawArgs, SET_ARGS) : positionals(args, "secret");
-      const secrets = parseSetInputs(inputs);
-      await uploadSecrets(
-        DEPLOY_URL5,
-        token,
-        target.projectName,
-        target.configName,
-        secrets,
-        false,
-        appScopedSecretsApiOptions(dir, target)
+      const t = await resolveTarget(args);
+      const pairs = [args.secret, ...args._ ?? []].filter(
+        (v) => typeof v === "string" && v.length > 0
       );
-      const count = await refreshCacheIfLinked(token, dir, target);
-      const keys = Object.keys(secrets).sort();
-      const requiredSecrets = updateRequiredSecretsIfTopLevelLinked(dir, target, keys);
-      if (args.json) {
-        process.stdout.write(JSON.stringify({ ok: true, keys, target, ...cacheJson(count), ...requiredSecretsJson(requiredSecrets) }) + "\n");
-        return;
+      const secrets = {};
+      for (const pair of pairs) {
+        const eq = pair.indexOf("=");
+        if (eq <= 0) throw new Error(`Expected KEY=value, got "${pair}"`);
+        const key = validateSecretName(pair.slice(0, eq));
+        const value = pair.slice(eq + 1);
+        validateSecretValue(key, value);
+        secrets[key] = value;
       }
-      console.log(`Set ${keys.length} secret${keys.length === 1 ? "" : "s"} in ${target.projectName}/${target.configName}.`);
-      requiredSecretsNotice(requiredSecrets);
-      if (count === null) {
-        unlinkedTargetNotice(target);
+      if (Object.keys(secrets).length === 1) {
+        const [[k, v]] = Object.entries(secrets);
+        await setSecret(DEPLOY_URL6, t.token, t.appId, t.configName, k, v);
       } else {
-        console.log(`Refreshed ${count} cached secret${count === 1 ? "" : "s"}.`);
-        redeployReminder(target);
+        await uploadSecrets(DEPLOY_URL6, t.token, t.appId, t.configName, secrets, false);
       }
+      console.log(`Set ${Object.keys(secrets).length} secret${Object.keys(secrets).length === 1 ? "" : "s"} in ${t.configName}.`);
     } catch (err) {
-      console.error(err instanceof Error ? err.message : String(err));
-      process.exit(1);
+      fail(err);
     }
   }
 });
-var get = defineCommand19({
-  meta: { name: "get", description: "Get one or more secrets; pass --plain to print values" },
+var get = defineCommand20({
+  meta: { name: "get", description: "Get a secret; pass --plain to print the value" },
   args: {
-    ...commonArgs(),
-    key: { type: "positional", description: "Secret key", required: true },
-    plain: { type: "boolean", description: "Print plaintext value", default: false },
-    "no-exit-on-missing-secret": { type: "boolean", description: "Do not exit when a requested secret is missing", default: false },
-    raw: { type: "boolean", description: "Accepted for Doppler CLI compatibility; DeepSpace has no variable interpolation", default: false },
-    copy: { type: "boolean", description: "Accepted for Doppler CLI compatibility; clipboard copy is not implemented", default: false },
-    type: { type: "boolean", description: "Accepted for Doppler CLI compatibility", default: false },
-    visibility: { type: "boolean", description: "Accepted for Doppler CLI compatibility", default: false }
+    ...COMMON_ARGS,
+    key: { type: "positional", description: "Secret name", required: true },
+    plain: { type: "boolean", description: "Print the plaintext value", default: false }
   },
   async run({ args }) {
     try {
-      const token = await ensureToken();
-      const { appDir: dir, target } = targetFromArgs(args);
-      const keys = positionals(args, "key").map((key) => validateSecretName(key));
+      const t = await resolveTarget(args);
+      const key = validateSecretName(args.key);
       if (args.plain) {
-        const values = {};
-        const missing2 = [];
-        for (const key of keys) {
-          try {
-            values[key] = await getSecretPlain(
-              DEPLOY_URL5,
-              token,
-              target.projectName,
-              target.configName,
-              key,
-              appScopedSecretsApiOptions(dir, target)
-            );
-          } catch (err) {
-            if (!args.noExitOnMissingSecret) throw err;
-            missing2.push(key);
-          }
-        }
-        if (args.json) {
-          process.stdout.write(JSON.stringify({ secrets: values, missing: missing2 }, null, 2) + "\n");
-          return;
-        }
-        for (const key of keys) if (Object.prototype.hasOwnProperty.call(values, key)) process.stdout.write(values[key] + "\n");
-        return;
-      }
-      const result = await listSecrets(
-        DEPLOY_URL5,
-        token,
-        target.projectName,
-        target.configName,
-        appScopedSecretsApiOptions(dir, target)
-      );
-      const found = result.secrets.filter((item) => keys.includes(item.key));
-      const foundKeys = new Set(found.map((item) => item.key));
-      const missing = keys.filter((key) => !foundKeys.has(key));
-      if (missing.length > 0 && !args.noExitOnMissingSecret) {
-        throw new Error(`Secret "${missing[0]}" not found in ${target.projectName}/${target.configName}.`);
-      }
-      if (args.json) {
-        process.stdout.write(JSON.stringify({ secrets: found, missing }, null, 2) + "\n");
+        const { value } = await getSecretPlain(DEPLOY_URL6, t.token, t.appId, t.configName, key);
+        process.stdout.write(value + "\n");
         return;
       }
-      for (const item of found) process.stdout.write(`${item.key} ${item.masked} v${item.version}
-`);
+      const { secrets } = await listSecrets(DEPLOY_URL6, t.token, t.appId, t.configName);
+      const item = secrets.find((s) => s.key === key);
+      if (!item) fail(new Error(`Secret "${key}" not found in ${t.configName}`));
+      console.log(`${item.key}  (v${item.version}, ${item.valueBytes}B, ${item.updatedAt})`);
     } catch (err) {
-      console.error(err instanceof Error ? err.message : String(err));
-      process.exit(1);
+      fail(err);
     }
   }
 });
-var del2 = defineCommand19({
-  meta: { name: "delete", description: "Delete one or more remote secrets" },
+var del2 = defineCommand20({
+  meta: { name: "delete", description: "Delete one or more secrets" },
   args: {
-    ...commonArgs(),
-    key: { type: "positional", description: "Secret key", required: true },
-    yes: { type: "boolean", alias: "y", description: "Proceed without confirmation; accepted for Doppler CLI compatibility", default: false },
-    raw: { type: "boolean", description: "Accepted for Doppler CLI compatibility; DeepSpace has no variable interpolation", default: false }
+    ...COMMON_ARGS,
+    key: { type: "positional", description: "Secret name (repeatable)", required: true }
   },
   async run({ args }) {
     try {
-      const token = await ensureToken();
-      const { appDir: dir, target } = targetFromArgs(args);
-      const keys = positionals(args, "key").map((key) => validateSecretName(key));
-      for (const key of keys) {
-        await deleteSecret(
-          DEPLOY_URL5,
-          token,
-          target.projectName,
-          target.configName,
-          key,
-          appScopedSecretsApiOptions(dir, target)
-        );
-      }
-      const count = await refreshCacheIfLinked(token, dir, target);
-      const requiredSecrets = removeRequiredSecretsIfTopLevelLinked(dir, target, keys);
-      if (args.json) {
-        process.stdout.write(JSON.stringify({ ok: true, deleted: keys, target, ...cacheJson(count), ...requiredSecretsJson(requiredSecrets) }) + "\n");
-        return;
-      }
-      console.log(`Deleted ${keys.length} secret${keys.length === 1 ? "" : "s"} from ${target.projectName}/${target.configName}.`);
-      requiredSecretsNotice(requiredSecrets);
-      if (count === null) {
-        unlinkedTargetNotice(target);
-      } else {
-        console.log(`Refreshed ${count} cached secret${count === 1 ? "" : "s"}.`);
-        redeployReminder(target);
-      }
-    } catch (err) {
-      console.error(err instanceof Error ? err.message : String(err));
-      process.exit(1);
-    }
-  }
-});
-var pull = defineCommand19({
-  meta: { name: "pull", description: "Refresh .dev.vars* only when the selected config is linked" },
-  args: commonArgs(),
-  async run({ args }) {
-    try {
-      const token = await ensureToken();
-      const { appDir: dir, target } = targetFromArgs(args);
-      const values = await fetchSecretsValues(
-        DEPLOY_URL5,
-        token,
-        target.projectName,
-        target.configName,
-        appScopedSecretsApiOptions(dir, target)
+      const t = await resolveTarget(args);
+      const keys = [args.key, ...args._ ?? []].filter(
+        (v) => typeof v === "string" && v.length > 0
       );
-      const count = Object.keys(values).length;
-      const linked = secretsTargetMatchesLink(dir, target);
-      if (linked) writeSecretsCacheFile(dir, values, target);
-      if (args.json) {
-        process.stdout.write(JSON.stringify({ ok: true, target, linked, cachedSecrets: linked ? count : null }) + "\n");
-        return;
+      for (const key of keys) {
+        await deleteSecret(DEPLOY_URL6, t.token, t.appId, t.configName, validateSecretName(key));
       }
-      console.log(`${linked ? "Pulled" : "Read"} ${count} secret${count === 1 ? "" : "s"} from ${target.projectName}/${target.configName}.`);
-      if (!linked) unlinkedTargetNotice(target);
+      console.log(`Deleted ${keys.length} secret${keys.length === 1 ? "" : "s"} from ${t.configName}.`);
     } catch (err) {
-      console.error(err instanceof Error ? err.message : String(err));
-      process.exit(1);
+      fail(err);
     }
   }
 });
-var download = defineCommand19({
-  meta: { name: "download", description: "Download a config's secrets in a Doppler-compatible format" },
+var upload = defineCommand20({
+  meta: { name: "upload", description: "Upload secrets from a dotenv or JSON file" },
   args: {
-    ...commonArgs(),
-    file: { type: "positional", description: "Output filepath; omit when using --no-file", required: false },
-    format: { type: "string", description: "Output format: json, dotnet-json, env, yaml, docker, env-no-quotes", required: false },
-    "no-file": { type: "boolean", description: "Print secrets to stdout instead of writing a file", default: false },
-    raw: { type: "boolean", description: "Accepted for Doppler CLI compatibility; DeepSpace has no variable interpolation", default: false },
-    "no-cache": { type: "boolean", description: "Accepted for Doppler CLI compatibility; DeepSpace does not use a download fallback cache", default: false },
-    "no-fallback": { type: "boolean", description: "Accepted for Doppler CLI compatibility; DeepSpace does not use fallback files", default: false },
-    offline: { type: "boolean", description: "Accepted for Doppler CLI compatibility; offline fallback files are not supported", default: false }
-  },
-  async run({ args, rawArgs }) {
-    try {
-      const token = await ensureToken();
-      const { appDir: dir, target } = targetFromArgs(args);
-      const values = await fetchSecretsValues(
-        DEPLOY_URL5,
-        token,
-        target.projectName,
-        target.configName,
-        appScopedSecretsApiOptions(dir, target)
-      );
-      const output = formatSecretsDownload(values, downloadFormat(args.format));
-      const file = typeof args.file === "string" && args.file ? args.file : void 0;
-      const noFile = Boolean(args.noFile) || hasRawFlag(rawArgs, "no-file");
-      if (noFile || !file) {
-        if (!noFile && !file) {
-          throw new Error("Provide an output filepath or pass --no-file to print to stdout.");
-        }
-        process.stdout.write(output);
-        return;
-      }
-      writeSecretFileSync(resolve10(file), output);
-      if (args.json) {
-        process.stdout.write(JSON.stringify({ ok: true, path: resolve10(file), target, secretCount: Object.keys(values).length }) + "\n");
-        return;
-      }
-      console.log(`Downloaded ${Object.keys(values).length} secret${Object.keys(values).length === 1 ? "" : "s"} to ${file}.`);
-    } catch (err) {
-      console.error(err instanceof Error ? err.message : String(err));
-      process.exit(1);
+    ...COMMON_ARGS,
+    file: { type: "positional", description: "Path to a dotenv or JSON file (- for stdin)", required: true },
+    replace: {
+      type: "boolean",
+      description: "Replace the whole config (delete keys missing from the file)",
+      default: false
     }
-  }
-});
-var upload = defineCommand19({
-  meta: { name: "upload", description: "Upload remote secrets from a dotenv or JSON file" },
-  args: {
-    ...commonArgs(),
-    file: { type: "positional", description: "Path to dotenv/JSON file", required: true },
-    replace: { type: "boolean", description: "Delete secrets absent from the upload", default: false },
-    raw: { type: "boolean", description: "Accepted for Doppler CLI compatibility; DeepSpace has no variable interpolation", default: false }
   },
   async run({ args }) {
     try {
-      const token = await ensureToken();
-      const { appDir: dir, target } = targetFromArgs(args);
-      const file = String(args.file);
-      const content = readExistingFile(file);
+      const t = await resolveTarget(args);
+      const content = args.file === "-" ? readFileSync13(0, "utf-8") : readFileSync13(args.file, "utf-8");
       const secrets = parseSecretsUpload(content);
-      await uploadSecrets(
-        DEPLOY_URL5,
-        token,
-        target.projectName,
-        target.configName,
-        secrets,
-        !!args.replace,
-        appScopedSecretsApiOptions(dir, target)
-      );
-      const count = await refreshCacheIfLinked(token, dir, target);
-      const requiredSecrets = updateRequiredSecretsIfTopLevelLinked(dir, target, Object.keys(secrets), {
-        replace: !!args.replace
-      });
-      if (args.json) {
-        process.stdout.write(JSON.stringify({ ok: true, uploaded: Object.keys(secrets), target, ...cacheJson(count), ...requiredSecretsJson(requiredSecrets) }) + "\n");
-        return;
-      }
-      console.log(`Uploaded ${Object.keys(secrets).length} secret${Object.keys(secrets).length === 1 ? "" : "s"} to ${target.projectName}/${target.configName}.`);
-      requiredSecretsNotice(requiredSecrets);
-      if (count === null) {
-        unlinkedTargetNotice(target);
-      } else {
-        console.log(`Refreshed ${count} cached secret${count === 1 ? "" : "s"}.`);
-        redeployReminder(target);
-      }
-    } catch (err) {
-      console.error(err instanceof Error ? err.message : String(err));
-      process.exit(1);
-    }
-  }
-});
-var configsList = defineCommand19({
-  meta: { name: "list", description: "List configs in a secrets project" },
-  args: commonArgs(),
-  async run({ args }) {
-    try {
-      const token = await ensureToken();
-      const { appDir: dir, target } = targetFromArgs(args);
-      const configs2 = await listConfigs(
-        DEPLOY_URL5,
-        token,
-        target.projectName,
-        appScopedSecretsApiOptions(dir, target)
-      );
-      if (args.json) {
-        process.stdout.write(JSON.stringify({ projectName: target.projectName, configs: configs2 }, null, 2) + "\n");
-        return;
-      }
-      if (configs2.length === 0) {
-        console.log(`No configs in ${target.projectName}.`);
-        return;
-      }
-      for (const cfg of configs2) {
-        console.log(`${cfg.name.padEnd(24)} ${cfg.secretCount ?? 0} secret${cfg.secretCount === 1 ? "" : "s"}  ${cfg.updatedAt}`);
-      }
+      if (Object.keys(secrets).length === 0) fail(new Error("No secrets found in the input."));
+      await uploadSecrets(DEPLOY_URL6, t.token, t.appId, t.configName, secrets, args.replace);
+      console.log(`Uploaded ${Object.keys(secrets).length} secrets to ${t.configName}.`);
     } catch (err) {
-      console.error(err instanceof Error ? err.message : String(err));
-      process.exit(1);
+      fail(err);
     }
   }
 });
-var configsCreate = defineCommand19({
-  meta: { name: "create", description: "Create a remote config without linking it" },
+var download = defineCommand20({
+  meta: { name: "download", description: "Download a config\u2019s secrets (dotenv/json/shell)" },
   args: {
-    ...commonArgs(),
-    configName: { type: "positional", description: "Config name", required: false },
-    name: { type: "string", description: "Config name; Doppler-compatible --name flag", required: false }
+    ...COMMON_ARGS,
+    format: {
+      type: "string",
+      description: "dotenv (default) | json | shell",
+      default: "dotenv"
+    }
   },
   async run({ args }) {
     try {
-      if (args.copyFrom !== void 0 || args["copy-from"] !== void 0) {
-        throw new Error("Unsupported flag: --copy-from. Use `npx deepspace secrets configs clone <source-config> --name <new-config>`.");
-      }
-      const token = await ensureToken();
-      const dir = appDir(args);
-      const projectName = validateProjectName(args.project || resolveSecretsTarget(dir, { wranglerEnv: wranglerEnv(args) }).projectName);
-      const rawName = typeof args.config === "string" && args.config ? args.config : typeof args.configName === "string" && args.configName ? args.configName : args.name;
-      if (typeof rawName !== "string" || !rawName) throw new Error("Config name required");
-      const configName = validateConfigName(rawName);
-      const target = { projectName, configName, wranglerEnv: wranglerEnv(args) };
-      const result = await createConfig(
-        DEPLOY_URL5,
-        token,
-        projectName,
-        configName,
-        void 0,
-        appScopedSecretsApiOptions(dir, target)
-      );
-      const count = await refreshCacheIfLinked(token, dir, target);
-      if (args.json) {
-        process.stdout.write(JSON.stringify({ ...result, target, ...cacheJson(count) }) + "\n");
-        return;
-      }
-      if (result.created) {
-        console.log(`Created ${projectName}/${configName}.`);
-      } else {
-        console.log(`Config ${projectName}/${configName} already exists.`);
-      }
-      if (count === null) {
-        unlinkedTargetNotice(target);
-      } else {
-        console.log(`Refreshed ${count} cached secret${count === 1 ? "" : "s"}.`);
+      const t = await resolveTarget(args);
+      const format = args.format;
+      if (!["dotenv", "json", "shell"].includes(format)) {
+        fail(new Error(`Unknown format "${args.format}" \u2014 use dotenv, json, or shell.`));
       }
+      const { secrets } = await fetchSecretsValues(DEPLOY_URL6, t.token, t.appId, t.configName);
+      process.stdout.write(formatSecretsDownload(secrets, format));
     } catch (err) {
-      console.error(err instanceof Error ? err.message : String(err));
-      process.exit(1);
+      fail(err);
     }
   }
 });
-function resolveConfigCloneArgs(args) {
-  const dir = appDir(args);
-  const baseTarget = resolveSecretsTarget(dir, {
-    project: typeof args.project === "string" && args.project ? args.project : void 0,
-    wranglerEnv: wranglerEnv(args)
-  });
-  const sources = positionals(args, "sourceConfig");
-  if (sources.length > 1) throw new Error("Only one source config can be provided.");
-  const sourceConfigName = validateConfigName(
-    sources[0] ?? (typeof args.config === "string" && args.config ? args.config : baseTarget.configName)
-  );
-  if (typeof args.name !== "string" || !args.name) {
-    throw new Error("Destination config name required; pass --name <new-config>.");
-  }
-  const target = {
-    projectName: baseTarget.projectName,
-    configName: validateConfigName(args.name),
-    wranglerEnv: baseTarget.wranglerEnv
-  };
-  return { appDir: dir, sourceConfigName, target };
-}
-var configsClone = defineCommand19({
-  meta: { name: "clone", description: "Create a remote config by copying another config server-side" },
-  args: {
-    ...commonArgs(),
-    sourceConfig: { type: "positional", description: "Source config name (default: --config or linked/default config)", required: false },
-    name: { type: "string", description: "Destination config name", required: true }
-  },
+var pull = defineCommand20({
+  meta: { name: "pull", description: "Refresh the .dev.vars cache from the app store" },
+  args: { ...COMMON_ARGS },
   async run({ args }) {
     try {
-      const token = await ensureToken();
-      const { appDir: dir, sourceConfigName, target } = resolveConfigCloneArgs(args);
-      const result = await createConfig(
-        DEPLOY_URL5,
-        token,
-        target.projectName,
-        target.configName,
-        sourceConfigName,
-        appScopedSecretsApiOptions(dir, target)
-      );
-      const count = await refreshCacheIfLinked(token, dir, target);
-      if (args.json) {
-        process.stdout.write(JSON.stringify({ ...result, target, sourceConfigName, ...cacheJson(count) }) + "\n");
+      const wranglerEnv = args.env?.trim() || void 0;
+      const appDir = findAppDir();
+      if (!appDir) fail(new Error("Run from a DeepSpace app directory (one containing wrangler.toml)."));
+      const t = await resolveTarget(args);
+      const ownerId = decodeJwtPayload(t.token).sub;
+      const pulled = await pullAppSecretsCache(DEPLOY_URL6, t.token, t.appId, t.configName);
+      if (!pulled) {
+        console.log(`No secrets in ${t.configName} yet \u2014 nothing to pull.`);
         return;
       }
-      if (result.created) {
-        const copiedSecrets = result.copiedSecrets ?? 0;
-        console.log(
-          `Created ${target.projectName}/${target.configName} from ${sourceConfigName} (${copiedSecrets} secret${copiedSecrets === 1 ? "" : "s"}).`
-        );
-      } else {
-        console.log(`Config ${target.projectName}/${target.configName} already exists.`);
-      }
-      if (count === null) {
-        unlinkedTargetNotice(target);
-      } else {
-        console.log(`Refreshed ${count} cached secret${count === 1 ? "" : "s"}.`);
-      }
+      await writeDevVars(appDir, ownerId, t.token, wranglerEnv, {
+        appId: t.appId,
+        generatedSecretsCache: renderSecretsCache(pulled.values, pulled),
+        sharedDevVarsCache: true
+      });
+      console.log(
+        `Pulled ${Object.keys(pulled.values).length} secrets (${t.configName}) into .dev.vars.`
+      );
     } catch (err) {
-      console.error(err instanceof Error ? err.message : String(err));
-      process.exit(1);
+      fail(err);
     }
   }
 });
-var configsDelete = defineCommand19({
-  meta: { name: "delete", description: "Delete a config and all of its secrets" },
-  args: {
-    ...commonArgs(),
-    name: { type: "positional", description: "Config name", required: false }
-  },
+var configsList = defineCommand20({
+  meta: { name: "list", description: "List the app\u2019s configs" },
+  args: { ...COMMON_ARGS },
   async run({ args }) {
     try {
-      const token = await ensureToken();
-      const dir = appDir(args);
-      const { target } = targetFromArgs(args);
-      const rawName = typeof args.name === "string" && args.name ? args.name : args.config;
-      if (typeof rawName !== "string" || !rawName) throw new Error("Config name required");
-      const configName = validateConfigName(rawName);
-      const link = resolveSecretsLink(dir, target.wranglerEnv);
-      const deletingLinked = link.linked && link.projectName === target.projectName && link.configName === configName;
-      await deleteConfig(
-        DEPLOY_URL5,
-        token,
-        target.projectName,
-        configName,
-        appScopedSecretsApiOptions(dir, target)
-      );
-      if (deletingLinked) {
-        removeWranglerSecretsLink(dir, target.wranglerEnv);
-        clearSecretsCacheFile(dir);
-      }
-      if (args.json) {
-        process.stdout.write(JSON.stringify({
-          ok: true,
-          deleted: configName,
-          projectName: target.projectName,
-          unlinked: deletingLinked,
-          cachedSecrets: deletingLinked ? 0 : null
-        }) + "\n");
+      const t = await resolveTarget(args);
+      const { configs: configs2 } = await listConfigs(DEPLOY_URL6, t.token, t.appId);
+      if (configs2.length === 0) {
+        console.log("No configs yet \u2014 the first `secrets set` creates one.");
         return;
       }
-      console.log(`Deleted ${target.projectName}/${configName}.`);
-      if (deletingLinked) {
-        console.log("Deleted config was linked; removed the local link and cleared generated cache.");
-        redeployReminder({ ...target, configName });
+      for (const cfg of configs2) {
+        console.log(`${cfg.name}  (${cfg.secretCount ?? 0} secrets, updated ${cfg.updatedAt})`);
       }
     } catch (err) {
-      console.error(err instanceof Error ? err.message : String(err));
-      process.exit(1);
+      fail(err);
     }
   }
 });
-var setup = defineCommand19({
-  meta: { name: "setup", description: "Link this app/env to a secrets project config" },
-  args: setupArgs(),
+var configsCreate = defineCommand20({
+  meta: { name: "create", description: "Create a config (optionally copying another)" },
+  args: {
+    ...COMMON_ARGS,
+    name: { type: "positional", description: "Config name", required: true },
+    "copy-from": { type: "string", description: "Copy secrets from this config", required: false }
+  },
   async run({ args }) {
     try {
-      const { appDir: dir, target, projectOverride } = resolveSecretsSetupArgs(args);
-      writeLinkForTarget(dir, target, projectOverride);
-      await bestEffortSetServerSecretsLink(dir, target);
-      const remoteCheck = await ensureLinkedRemoteTarget(dir, target);
-      const migration = await importLegacyDevVarsSecrets(dir, target, remoteCheck);
-      if (args.json) {
-        process.stdout.write(
-          JSON.stringify({ ok: true, target, remoteCheck, ...migration && { migration } }) + "\n"
-        );
-        return;
-      }
-      console.log(`Linked ${target.wranglerEnv ? `[env.${target.wranglerEnv}]` : "top-level app"} to ${target.projectName}/${target.configName}.`);
-      if (remoteCheck.status === "created") {
-        console.log(`Created remote config ${target.projectName}/${target.configName}.`);
-      }
-      printLegacySecretsImport(migration, target);
-      printLinkRemoteWarning(remoteCheck);
+      const t = await resolveTarget(args);
+      const name = validateConfigName(args.name);
+      await createConfig(DEPLOY_URL6, t.token, t.appId, name, args["copy-from"] || void 0);
+      console.log(`Created ${name}.`);
     } catch (err) {
-      console.error(err instanceof Error ? err.message : String(err));
-      process.exit(1);
+      fail(err);
     }
   }
 });
-var configureUnset = defineCommand19({
-  meta: { name: "unset", description: "Unset linked secrets project/config settings" },
+var configsDelete = defineCommand20({
+  meta: { name: "delete", description: "Delete a config and all of its secrets" },
   args: {
-    ...scopedArgs(),
-    name: { type: "positional", description: "Setting names to unset: project and/or config", required: false }
+    ...COMMON_ARGS,
+    name: { type: "positional", description: "Config name", required: true }
   },
   async run({ args }) {
     try {
-      const { appDir: dir, unset, wranglerEnv: targetEnv } = resolveConfigureUnsetArgs(args);
-      removeWranglerSecretsLinkKeys(dir, targetEnv, unset);
-      clearSecretsCacheFile(dir);
-      if (unset.includes("project")) {
-        await bestEffortClearServerSecretsLink(dir, targetEnv);
-      }
-      if (args.json) {
-        process.stdout.write(JSON.stringify({ ok: true, unset, env: targetEnv ?? null, cachedSecrets: 0 }) + "\n");
-        return;
-      }
-      console.log(`Unset ${unset.join(", ")} for ${targetEnv ? `[env.${targetEnv}]` : "top-level app"} secrets config.`);
-      console.log("Cleared generated secrets cache for that target.");
+      const t = await resolveTarget(args);
+      const name = validateConfigName(args.name);
+      await deleteConfig(DEPLOY_URL6, t.token, t.appId, name);
+      console.log(`Deleted ${name}.`);
     } catch (err) {
-      console.error(err instanceof Error ? err.message : String(err));
-      process.exit(1);
+      fail(err);
     }
   }
 });
-var configure = defineCommand19({
-  meta: { name: "configure", description: "Manage local secrets CLI configuration" },
-  subCommands: {
-    unset: configureUnset
-  }
-});
-var configs = defineCommand19({
-  meta: { name: "configs", description: "Manage remote secrets configs" },
-  subCommands: {
-    list: configsList,
-    create: configsCreate,
-    clone: configsClone,
-    delete: configsDelete
-  }
+var configs = defineCommand20({
+  meta: { name: "configs", description: "Manage the app\u2019s secrets configs" },
+  subCommands: { list: configsList, create: configsCreate, delete: configsDelete }
 });
-var secrets_default = defineCommand19({
-  meta: { name: "secrets", description: "Manage remote DeepSpace app secrets" },
+var secrets_default = defineCommand20({
+  meta: { name: "secrets", description: "Manage the app\u2019s secrets store" },
   subCommands: {
     list: list5,
     set,
     get,
     delete: del2,
-    pull,
-    download,
     upload,
-    setup,
-    configure,
+    download,
+    pull,
     configs
   }
 });
-function parseSetInputs(inputs) {
-  if (inputs.length === 0) throw new Error("At least one secret is required");
-  const out = {};
-  if (inputs.every((input) => input.includes("="))) {
-    for (const raw of inputs) {
-      const eq = raw.indexOf("=");
-      const key = validateSecretName(raw.slice(0, eq));
-      const value = raw.slice(eq + 1);
-      validateSecretValue(key, value);
-      out[key] = value;
+
+// src/cli/commands/init.ts
+import { defineCommand as defineCommand21 } from "citty";
+var init_default = defineCommand21({
+  meta: {
+    name: "init",
+    description: "Mint this app\u2019s immutable DEEPSPACE_APP_ID into wrangler.toml"
+  },
+  args: {
+    "new-id": {
+      type: "boolean",
+      description: "Replace the existing id \u2014 forks this repo as a SEPARATE app (new data, new secrets, new registration). The original app keeps running.",
+      default: false
+    },
+    env: {
+      type: "string",
+      alias: "e",
+      description: "wrangler.toml [env.<name>] block to stamp (each env is its own app)",
+      required: false
+    }
+  },
+  async run({ args }) {
+    const appDir = findAppDir();
+    if (!appDir) {
+      console.error("Run from a DeepSpace app directory (one containing wrangler.toml).");
+      process.exit(1);
+    }
+    const envName = args.env || void 0;
+    const existing = readAppId(appDir, envName);
+    if (existing && !args["new-id"]) {
+      console.log(`Already initialized: ${existing}${envName ? ` (env: ${envName})` : ""}`);
+      return;
+    }
+    const appId = mintAppId();
+    writeAppId(appDir, appId, { wranglerEnv: envName, force: args["new-id"] });
+    if (existing) {
+      console.log(`Forked: ${existing} \u2192 ${appId}${envName ? ` (env: ${envName})` : ""}`);
+      console.log("The next deploy registers this as a NEW app; the original is untouched.");
+    } else {
+      console.log(`Minted ${appId}${envName ? ` (env: ${envName})` : ""} \u2014 commit wrangler.toml.`);
+      console.log("The first deploy registers it and claims the `name` subdomain.");
     }
-    return out;
-  }
-  if (inputs.length === 1) {
-    const raw = inputs[0];
-    throw new Error(`Secret value required for "${raw}". Use KEY=value or KEY value.`);
-  }
-  if (inputs.length === 2 && !inputs[0].includes("=")) {
-    const key = validateSecretName(inputs[0]);
-    const value = inputs[1];
-    validateSecretValue(key, value);
-    out[key] = value;
-    return out;
   }
-  throw new Error("Use KEY=value for multiple secrets, or KEY value for one secret.");
-}
-function readExistingFile(path) {
-  const full = resolve10(path);
-  if (!existsSync14(full)) throw new Error(`File not found: ${path}`);
-  return readFileSync13(full, "utf-8");
-}
+});
 
 // src/cli/cli.ts
 var __dirname = dirname4(fileURLToPath2(import.meta.url));
 var pkg = JSON.parse(readFileSync14(join16(__dirname, "..", "package.json"), "utf-8"));
-if (process.platform === "linux" && !process.env.SSL_CERT_FILE && existsSync15("/etc/ssl/certs/ca-certificates.crt")) {
+if (process.platform === "linux" && !process.env.SSL_CERT_FILE && existsSync14("/etc/ssl/certs/ca-certificates.crt")) {
   process.env.SSL_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt";
 }
-var create2 = defineCommand20({
+var create2 = defineCommand22({
   meta: {
     name: "create",
     description: "Create a new DeepSpace app"
@@ -5784,13 +5159,14 @@ var create2 = defineCommand20({
     execSync4(`npm create deepspace@latest${name}`, { stdio: "inherit" });
   }
 });
-var main = defineCommand20({
+var main = defineCommand22({
   meta: {
     name: "deepspace",
     version: pkg.version,
     description: "DeepSpace SDK CLI"
   },
   subCommands: {
+    init: init_default,
     create: create2,
     login: login_default,
     logout: logout_default,
@@ -5808,6 +5184,7 @@ var main = defineCommand20({
     undeploy: undeploy_default,
     domain: domain_default,
     collaborators: collaborators_default,
+    transfer: transfer_default,
     library: library_default,
     feedback: feedback_default,
     secrets: secrets_default
@@ -5817,5 +5194,5 @@ var main = defineCommand20({
   // command. Citty's default behavior when no subcommand matches is to print
   // help, which is what we want for `deepspace` with no args.
 });
-runMain(main);
+runMain(wrapCommandErrors(main));
 //# sourceMappingURL=cli.js.map