deepspace 0.5.3 → 0.5.5

package/dist/cli.js

@@ -3,7 +3,7 @@
 // src/cli/cli.ts
 import { defineCommand as defineCommand22, runMain } from "citty";
 import { execSync as execSync4 } from "child_process";
-import { readFileSync as readFileSync14, existsSync as existsSync14 } from "fs";
+import { readFileSync as readFileSync15, existsSync as existsSync14 } from "fs";
 import { dirname as dirname4, join as join16 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
@@ -77,8 +77,215 @@ function createSpinner() {
 // src/cli/env.ts
 import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
 
+// src/server/rooms/binding-manifest.ts
+var AUTO_PROVISION_SENTINEL = "auto";
+var VECTORIZE_METRICS = /* @__PURE__ */ new Set(["cosine", "euclidean", "dot-product"]);
+var ALLOWED_BINDING_TYPES = /* @__PURE__ */ new Set([
+  "vectorize",
+  "ai",
+  "r2_bucket",
+  "kv_namespace",
+  "d1",
+  "queue",
+  "browser_rendering",
+  "analytics_engine",
+  "hyperdrive"
+]);
+var RESERVED_BINDING_NAMES = /* @__PURE__ */ new Set([
+  "ASSETS",
+  "PLATFORM_WORKER",
+  "API_WORKER",
+  "APP_NAME",
+  "OWNER_USER_ID",
+  "AUTH_JWT_PUBLIC_KEY",
+  "AUTH_JWT_ISSUER",
+  "AUTH_WORKER_URL",
+  "APP_IDENTITY_TOKEN",
+  "APP_OWNER_JWT",
+  "USAGE_EVENTS"
+]);
+function validateBindingManifest(manifest) {
+  if (!Array.isArray(manifest)) {
+    return { valid: false, errors: [{ reason: "Manifest must be an array" }] };
+  }
+  const errors = [];
+  const seenNames = /* @__PURE__ */ new Set();
+  for (const entry of manifest) {
+    if (!entry || typeof entry !== "object") {
+      errors.push({ reason: `Entry must be an object (got ${entry === null ? "null" : typeof entry})` });
+      continue;
+    }
+    const e = entry;
+    const type = e.type;
+    const name = e.name;
+    if (typeof type !== "string" || !ALLOWED_BINDING_TYPES.has(type)) {
+      errors.push({
+        reason: `Disallowed binding type: ${typeof type === "string" ? type : `(${typeof type})`}. Allowed: ${[...ALLOWED_BINDING_TYPES].sort().join(", ")}`
+      });
+      continue;
+    }
+    if (typeof name !== "string" || !name) {
+      errors.push({ reason: `Binding of type "${type}" missing 'name' (string)` });
+      continue;
+    }
+    if (RESERVED_BINDING_NAMES.has(name)) {
+      errors.push({ reason: `Binding name "${name}" is reserved by the SDK` });
+      continue;
+    }
+    if (seenNames.has(name)) {
+      errors.push({ reason: `Duplicate binding name "${name}"` });
+      continue;
+    }
+    seenNames.add(name);
+    const binding = entry;
+    const fieldErr = requiredFieldError(binding);
+    if (fieldErr) errors.push({ binding, reason: fieldErr });
+  }
+  if (errors.length) return { valid: false, errors };
+  return { valid: true, bindings: manifest };
+}
+function requiredFieldError(b) {
+  switch (b.type) {
+    case "vectorize": {
+      if (!b.index_name) return `vectorize binding "${b.name}" missing index_name (or "auto")`;
+      if (b.index_name === AUTO_PROVISION_SENTINEL) {
+        if (typeof b.dimensions !== "number" || b.dimensions <= 0) {
+          return `vectorize binding "${b.name}" with index_name="auto" requires "dimensions" (positive number)`;
+        }
+        if (!b.metric || !VECTORIZE_METRICS.has(b.metric)) {
+          return `vectorize binding "${b.name}" with index_name="auto" requires "metric" (one of: ${[...VECTORIZE_METRICS].join(", ")})`;
+        }
+      }
+      return null;
+    }
+    case "r2_bucket":
+      return b.bucket_name ? null : `r2_bucket binding "${b.name}" missing bucket_name (or "auto")`;
+    case "kv_namespace": {
+      if (!b.namespace_id) return `kv_namespace binding "${b.name}" missing namespace_id (or "auto")`;
+      if (b.namespace_id === AUTO_PROVISION_SENTINEL && !b.title) {
+        return `kv_namespace binding "${b.name}" with namespace_id="auto" requires "title"`;
+      }
+      return null;
+    }
+    case "d1": {
+      if (!b.id) return `d1 binding "${b.name}" missing id (or "auto")`;
+      if (b.id === AUTO_PROVISION_SENTINEL && !b.database_name) {
+        return `d1 binding "${b.name}" with id="auto" requires "database_name"`;
+      }
+      return null;
+    }
+    case "queue":
+      return b.queue_name ? null : `queue binding "${b.name}" missing queue_name (or "auto")`;
+    case "hyperdrive":
+      if (!b.id) return `hyperdrive binding "${b.name}" missing id`;
+      if (b.id === AUTO_PROVISION_SENTINEL) {
+        return `hyperdrive binding "${b.name}": auto-provisioning not yet supported (provide a real id)`;
+      }
+      return null;
+    case "ai":
+    case "browser_rendering":
+    case "analytics_engine":
+      return null;
+    // no required fields beyond `name`
+    default: {
+      const _exhaustive = b;
+      void _exhaustive;
+      return null;
+    }
+  }
+}
+function bindingManifestFromOutputConfig(outputConfig) {
+  const out = [];
+  const aiBinding = pluckString(outputConfig.ai, "binding");
+  if (aiBinding) out.push({ type: "ai", name: aiBinding });
+  for (const v of asObjectArray(outputConfig.vectorize)) {
+    const name = pluckString(v, "binding");
+    const index_name = pluckString(v, "index_name");
+    if (!name || !index_name) continue;
+    const dimensions = pluckNumber(v, "dimensions");
+    const metric = pluckString(v, "metric");
+    out.push({
+      type: "vectorize",
+      name,
+      index_name,
+      ...dimensions != null && { dimensions },
+      ...metric && (metric === "cosine" || metric === "euclidean" || metric === "dot-product") && { metric }
+    });
+  }
+  for (const r of asObjectArray(outputConfig.r2_buckets)) {
+    const name = pluckString(r, "binding");
+    const bucket_name = pluckString(r, "bucket_name");
+    if (name && bucket_name) out.push({ type: "r2_bucket", name, bucket_name });
+  }
+  for (const k of asObjectArray(outputConfig.kv_namespaces)) {
+    const name = pluckString(k, "binding");
+    const namespace_id = pluckString(k, "id");
+    if (!name || !namespace_id) continue;
+    const title = pluckString(k, "title");
+    out.push({
+      type: "kv_namespace",
+      name,
+      namespace_id,
+      ...title && { title }
+    });
+  }
+  for (const d of asObjectArray(outputConfig.d1_databases)) {
+    const name = pluckString(d, "binding");
+    const id = pluckString(d, "database_id");
+    if (!name || !id) continue;
+    const database_name = pluckString(d, "database_name");
+    out.push({
+      type: "d1",
+      name,
+      id,
+      ...database_name && { database_name }
+    });
+  }
+  const queues = isObject(outputConfig.queues) ? outputConfig.queues : null;
+  for (const q of asObjectArray(queues?.producers)) {
+    const name = pluckString(q, "binding");
+    const queue_name = pluckString(q, "queue");
+    if (name && queue_name) out.push({ type: "queue", name, queue_name });
+  }
+  const browserBinding = pluckString(outputConfig.browser, "binding");
+  if (browserBinding) out.push({ type: "browser_rendering", name: browserBinding });
+  for (const a of asObjectArray(outputConfig.analytics_engine_datasets)) {
+    const name = pluckString(a, "binding");
+    const dataset = pluckString(a, "dataset");
+    if (name) out.push({ type: "analytics_engine", name, dataset: dataset ?? void 0 });
+  }
+  for (const h of asObjectArray(outputConfig.hyperdrive)) {
+    const name = pluckString(h, "binding");
+    const id = pluckString(h, "id");
+    if (name && id) out.push({ type: "hyperdrive", name, id });
+  }
+  return out;
+}
+function isObject(v) {
+  return v !== null && typeof v === "object" && !Array.isArray(v);
+}
+function pluckString(v, key) {
+  if (!isObject(v)) return null;
+  const val = v[key];
+  return typeof val === "string" && val.length > 0 ? val : null;
+}
+function pluckNumber(v, key) {
+  if (!isObject(v)) return null;
+  const val = v[key];
+  return typeof val === "number" && Number.isFinite(val) ? val : null;
+}
+function asObjectArray(v) {
+  if (!Array.isArray(v)) return [];
+  return v.filter(isObject);
+}
+
 // src/cli/lib/secrets.ts
 var GENERATED_SECRETS_DIVIDER = "# --- DeepSpace secrets cache: generated by `npx deepspace secrets`; do not edit manually ---";
+var RESERVED_SECRET_NAMES = /* @__PURE__ */ new Set([
+  ...RESERVED_BINDING_NAMES,
+  "API_WORKER_URL",
+  "PLATFORM_WORKER_URL"
+]);
 var SECRET_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
 var CONFIG_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
 var MAX_SECRET_VALUE_BYTES = 32 * 1024;
@@ -96,6 +303,11 @@ function validateSecretName(name) {
       `Invalid secret name "${name}". Use letters, numbers, and underscores; start with a letter or underscore.`
     );
   }
+  if (RESERVED_SECRET_NAMES.has(name)) {
+    throw new Error(
+      `"${name}" is managed by the DeepSpace SDK and can't be set as an app secret \u2014 the platform injects it at deploy time.`
+    );
+  }
   return name;
 }
 function validateSecretValue(key, value) {
@@ -117,7 +329,10 @@ async function secretsApi(deployUrl, token, path, init = {}) {
   });
   const body = await res.json().catch(() => ({}));
   if (!res.ok) {
-    throw new Error(`Secrets API ${path} (${res.status}): ${body.error ?? "request failed"}`);
+    const err = new Error(body.error ?? `Secrets request failed (${res.status})`);
+    err.status = res.status;
+    err.apiPath = path;
+    throw err;
   }
   return body;
 }
@@ -177,8 +392,7 @@ async function pullAppSecretsCache(deployUrl, token, appId, configName) {
     const { secrets } = await fetchSecretsValues(deployUrl, token, appId, configName);
     return { appId, configName, values: secrets };
   } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    if (msg.includes("(404)")) return null;
+    if (err?.status === 404) return null;
     throw err;
   }
 }
@@ -230,6 +444,7 @@ function parseSecretsUpload(content) {
     if (eq <= 0) continue;
     const key = line.slice(0, eq).trim();
     if (!SECRET_NAME_RE.test(key)) continue;
+    validateSecretName(key);
     let value = line.slice(eq + 1).trim();
     if (value.startsWith('"') && value.endsWith('"') && value.length >= 2) {
       value = unescapeDotenv(value.slice(1, -1));
@@ -251,13 +466,16 @@ function unescapeDotenv(v) {
   }
   return out;
 }
+function shellSingleQuote(value) {
+  return `'${value.replace(/'/g, "'\\''")}'`;
+}
 function formatSecretsDownload(secrets, format) {
   const entries = Object.entries(secrets).sort(([a], [b]) => a.localeCompare(b));
   if (format === "json") {
     return JSON.stringify(Object.fromEntries(entries), null, 2) + "\n";
   }
   if (format === "shell") {
-    return entries.map(([k, v]) => `export ${k}=${quoteDotenvValue(v)}`).join("\n") + "\n";
+    return entries.map(([k, v]) => `export ${k}=${shellSingleQuote(v)}`).join("\n") + "\n";
   }
   return entries.map(([k, v]) => `${k}=${quoteDotenvValue(v)}`).join("\n") + "\n";
 }
@@ -277,7 +495,7 @@ async function refreshSecretsCache(deployUrl, token, appId, wranglerEnv) {
 import { existsSync, readFileSync, writeFileSync } from "fs";
 import { join, resolve } from "path";
 import { parse as parseToml } from "smol-toml";
-var APP_ID_RE = /^app_[0-9A-HJKMNP-TV-Z]{26}$/;
+var APP_ID_RE = /^(app_[0-9A-HJKMNP-TV-Z]{26}|[a-z0-9][a-z0-9_-]{0,63})$/;
 var CROCKFORD = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
 function mintAppId(now = Date.now()) {
   let ts = "";
@@ -690,38 +908,6 @@ function extractCustomDevVars(content) {
   while (out.length && out[out.length - 1].trim() === "") out.pop();
   return out.join("\n");
 }
-function removeDevVarsKeys(content, keys) {
-  const lines = content.split("\n");
-  const out = [];
-  let i = 0;
-  while (i < lines.length) {
-    const line = lines[i];
-    const eq = line.indexOf("=");
-    const keyMatch = eq >= 0 ? line.slice(0, eq).match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*$/) : null;
-    if (!keyMatch) {
-      out.push(line);
-      i++;
-      continue;
-    }
-    const key = keyMatch[1];
-    const valStart = line.slice(eq + 1);
-    const block = [line];
-    if (valStart.startsWith('"') && !hasUnescapedQuote(valStart.slice(1))) {
-      i++;
-      while (i < lines.length) {
-        block.push(lines[i]);
-        const closed = hasUnescapedQuote(lines[i]);
-        i++;
-        if (closed) break;
-      }
-    } else {
-      i++;
-    }
-    if (!keys.has(key)) out.push(...block);
-  }
-  while (out.length && out[out.length - 1].trim() === "") out.pop();
-  return out.join("\n");
-}
 function hasUnescapedQuote(s) {
   let escaped = false;
   for (const ch of s) {
@@ -820,8 +1006,10 @@ async function writeDevVars(appDir, ownerId, callerJwt, wranglerEnv, opts = {})
     `OWNER_USER_ID=${ownerId}`,
     `APP_OWNER_JWT=${appOwnerJwt}`,
     ...appIdentityToken ? [`APP_IDENTITY_TOKEN=${appIdentityToken}`] : [],
-    // Open /api/debug/* (proxied to RecordRoom) for dev + tests only.
-    // Production secrets never set this, so deployed apps 404 the route.
+    // Open /api/debug/* (proxied to RecordRoom) locally. This is the SDK's
+    // dev-only auto-value; the deploy ships the remote store, not this
+    // `.dev.vars` section, so it never reaches prod. To enable it on a deployed
+    // env, `deepspace secrets set ALLOW_DEBUG_ROUTES=true`.
     `ALLOW_DEBUG_ROUTES=true`
   ].join("\n");
   const useSharedDevVarsCache = opts.sharedDevVarsCache ?? opts.generatedSecretsCache !== void 0;
@@ -1544,6 +1732,7 @@ var dev_default = defineCommand3({
 // src/cli/commands/kill.ts
 import { defineCommand as defineCommand4 } from "citty";
 import { spawnSync } from "child_process";
+import { readFileSync as readFileSync8, readdirSync as readdirSync3, readlinkSync } from "fs";
 import { setTimeout as wait } from "timers/promises";
 var SIGTERM_GRACE_MS = 1500;
 var IS_WIN = process.platform === "win32";
@@ -1614,7 +1803,55 @@ function listenerPids(port) {
       `Get-NetTCPConnection -LocalPort ${port} -State Listen -ErrorAction SilentlyContinue | Select-Object -ExpandProperty OwningProcess`
     );
   }
-  return run(["lsof", "-nP", `-iTCP:${port}`, "-sTCP:LISTEN", "-t"]);
+  const viaLsof = run(["lsof", "-nP", `-iTCP:${port}`, "-sTCP:LISTEN", "-t"]);
+  if (viaLsof.length) return viaLsof;
+  return listenerPidsViaProc(port);
+}
+function listenerPidsViaProc(port) {
+  try {
+    const hexPort = port.toString(16).toUpperCase().padStart(4, "0");
+    const inodes = /* @__PURE__ */ new Set();
+    for (const f of ["/proc/net/tcp", "/proc/net/tcp6"]) {
+      let data;
+      try {
+        data = readFileSync8(f, "utf-8");
+      } catch {
+        continue;
+      }
+      for (const line of data.split("\n").slice(1)) {
+        const cols = line.trim().split(/\s+/);
+        if (cols[3] !== "0A") continue;
+        if (cols[1]?.split(":")[1] === hexPort && cols[9]) inodes.add(cols[9]);
+      }
+    }
+    if (!inodes.size) return [];
+    const pids = /* @__PURE__ */ new Set();
+    for (const pidDir of readdirSync3("/proc")) {
+      if (!/^\d+$/.test(pidDir)) continue;
+      let fds;
+      try {
+        fds = readdirSync3(`/proc/${pidDir}/fd`);
+      } catch {
+        continue;
+      }
+      for (const fd of fds) {
+        let link;
+        try {
+          link = readlinkSync(`/proc/${pidDir}/fd/${fd}`);
+        } catch {
+          continue;
+        }
+        const m = link.match(/^socket:\[(\d+)\]$/);
+        if (m && inodes.has(m[1])) {
+          pids.add(Number(pidDir));
+          break;
+        }
+      }
+    }
+    return [...pids];
+  } catch {
+    return [];
+  }
 }
 function childPids(parentPid) {
   if (IS_WIN) {
@@ -1935,7 +2172,7 @@ var screenshot_default = defineCommand6({
 // src/cli/commands/test-accounts.ts
 import { defineCommand as defineCommand7 } from "citty";
 import * as p3 from "@clack/prompts";
-import { readFileSync as readFileSync8, writeFileSync as writeFileSync8, existsSync as existsSync9, mkdirSync as mkdirSync4 } from "fs";
+import { readFileSync as readFileSync9, writeFileSync as writeFileSync8, existsSync as existsSync9, mkdirSync as mkdirSync4 } from "fs";
 import { join as join10 } from "path";
 import { homedir as homedir4 } from "os";
 var SESSION_COOKIE2 = "__Secure-better-auth.session_token";
@@ -1945,7 +2182,7 @@ var ACCOUNTS_PATH = join10(DIR3, "test-accounts.json");
 function loadAccounts() {
   if (!existsSync9(ACCOUNTS_PATH)) return [];
   try {
-    return JSON.parse(readFileSync8(ACCOUNTS_PATH, "utf-8"));
+    return JSON.parse(readFileSync9(ACCOUNTS_PATH, "utf-8"));
   } catch {
     return [];
   }
@@ -1955,7 +2192,7 @@ function saveAccounts(accounts) {
   writeFileSync8(ACCOUNTS_PATH, JSON.stringify(accounts, null, 2), { mode: 384 });
 }
 function sessionCookie() {
-  const token = readFileSync8(SESSION_PATH2, "utf-8").trim();
+  const token = readFileSync9(SESSION_PATH2, "utf-8").trim();
   return `${SESSION_COOKIE2}=${encodeURIComponent(token)}`;
 }
 async function fetchRemoteAccounts() {
@@ -2225,214 +2462,10 @@ var test_accounts_default = defineCommand7({
 import { defineCommand as defineCommand8 } from "citty";
 import { execSync as execSync2 } from "child_process";
 import { randomUUID } from "crypto";
-import { readFileSync as readFileSync9, readdirSync as readdirSync3, existsSync as existsSync10, writeFileSync as writeFileSync9 } from "fs";
+import { readFileSync as readFileSync10, readdirSync as readdirSync4, existsSync as existsSync10 } from "fs";
 import { join as join11, resolve as resolve7, dirname as dirname2 } from "path";
 import { pathToFileURL } from "url";
 import * as p4 from "@clack/prompts";
-
-// src/server/rooms/binding-manifest.ts
-var AUTO_PROVISION_SENTINEL = "auto";
-var VECTORIZE_METRICS = /* @__PURE__ */ new Set(["cosine", "euclidean", "dot-product"]);
-var ALLOWED_BINDING_TYPES = /* @__PURE__ */ new Set([
-  "vectorize",
-  "ai",
-  "r2_bucket",
-  "kv_namespace",
-  "d1",
-  "queue",
-  "browser_rendering",
-  "analytics_engine",
-  "hyperdrive"
-]);
-var RESERVED_BINDING_NAMES = /* @__PURE__ */ new Set([
-  "ASSETS",
-  "PLATFORM_WORKER",
-  "API_WORKER",
-  "APP_NAME",
-  "OWNER_USER_ID",
-  "AUTH_JWT_PUBLIC_KEY",
-  "AUTH_JWT_ISSUER",
-  "AUTH_WORKER_URL",
-  "APP_IDENTITY_TOKEN",
-  "APP_OWNER_JWT",
-  "USAGE_EVENTS"
-]);
-function validateBindingManifest(manifest) {
-  if (!Array.isArray(manifest)) {
-    return { valid: false, errors: [{ reason: "Manifest must be an array" }] };
-  }
-  const errors = [];
-  const seenNames = /* @__PURE__ */ new Set();
-  for (const entry of manifest) {
-    if (!entry || typeof entry !== "object") {
-      errors.push({ reason: `Entry must be an object (got ${entry === null ? "null" : typeof entry})` });
-      continue;
-    }
-    const e = entry;
-    const type = e.type;
-    const name = e.name;
-    if (typeof type !== "string" || !ALLOWED_BINDING_TYPES.has(type)) {
-      errors.push({
-        reason: `Disallowed binding type: ${typeof type === "string" ? type : `(${typeof type})`}. Allowed: ${[...ALLOWED_BINDING_TYPES].sort().join(", ")}`
-      });
-      continue;
-    }
-    if (typeof name !== "string" || !name) {
-      errors.push({ reason: `Binding of type "${type}" missing 'name' (string)` });
-      continue;
-    }
-    if (RESERVED_BINDING_NAMES.has(name)) {
-      errors.push({ reason: `Binding name "${name}" is reserved by the SDK` });
-      continue;
-    }
-    if (seenNames.has(name)) {
-      errors.push({ reason: `Duplicate binding name "${name}"` });
-      continue;
-    }
-    seenNames.add(name);
-    const binding = entry;
-    const fieldErr = requiredFieldError(binding);
-    if (fieldErr) errors.push({ binding, reason: fieldErr });
-  }
-  if (errors.length) return { valid: false, errors };
-  return { valid: true, bindings: manifest };
-}
-function requiredFieldError(b) {
-  switch (b.type) {
-    case "vectorize": {
-      if (!b.index_name) return `vectorize binding "${b.name}" missing index_name (or "auto")`;
-      if (b.index_name === AUTO_PROVISION_SENTINEL) {
-        if (typeof b.dimensions !== "number" || b.dimensions <= 0) {
-          return `vectorize binding "${b.name}" with index_name="auto" requires "dimensions" (positive number)`;
-        }
-        if (!b.metric || !VECTORIZE_METRICS.has(b.metric)) {
-          return `vectorize binding "${b.name}" with index_name="auto" requires "metric" (one of: ${[...VECTORIZE_METRICS].join(", ")})`;
-        }
-      }
-      return null;
-    }
-    case "r2_bucket":
-      return b.bucket_name ? null : `r2_bucket binding "${b.name}" missing bucket_name (or "auto")`;
-    case "kv_namespace": {
-      if (!b.namespace_id) return `kv_namespace binding "${b.name}" missing namespace_id (or "auto")`;
-      if (b.namespace_id === AUTO_PROVISION_SENTINEL && !b.title) {
-        return `kv_namespace binding "${b.name}" with namespace_id="auto" requires "title"`;
-      }
-      return null;
-    }
-    case "d1": {
-      if (!b.id) return `d1 binding "${b.name}" missing id (or "auto")`;
-      if (b.id === AUTO_PROVISION_SENTINEL && !b.database_name) {
-        return `d1 binding "${b.name}" with id="auto" requires "database_name"`;
-      }
-      return null;
-    }
-    case "queue":
-      return b.queue_name ? null : `queue binding "${b.name}" missing queue_name (or "auto")`;
-    case "hyperdrive":
-      if (!b.id) return `hyperdrive binding "${b.name}" missing id`;
-      if (b.id === AUTO_PROVISION_SENTINEL) {
-        return `hyperdrive binding "${b.name}": auto-provisioning not yet supported (provide a real id)`;
-      }
-      return null;
-    case "ai":
-    case "browser_rendering":
-    case "analytics_engine":
-      return null;
-    // no required fields beyond `name`
-    default: {
-      const _exhaustive = b;
-      void _exhaustive;
-      return null;
-    }
-  }
-}
-function bindingManifestFromOutputConfig(outputConfig) {
-  const out = [];
-  const aiBinding = pluckString(outputConfig.ai, "binding");
-  if (aiBinding) out.push({ type: "ai", name: aiBinding });
-  for (const v of asObjectArray(outputConfig.vectorize)) {
-    const name = pluckString(v, "binding");
-    const index_name = pluckString(v, "index_name");
-    if (!name || !index_name) continue;
-    const dimensions = pluckNumber(v, "dimensions");
-    const metric = pluckString(v, "metric");
-    out.push({
-      type: "vectorize",
-      name,
-      index_name,
-      ...dimensions != null && { dimensions },
-      ...metric && (metric === "cosine" || metric === "euclidean" || metric === "dot-product") && { metric }
-    });
-  }
-  for (const r of asObjectArray(outputConfig.r2_buckets)) {
-    const name = pluckString(r, "binding");
-    const bucket_name = pluckString(r, "bucket_name");
-    if (name && bucket_name) out.push({ type: "r2_bucket", name, bucket_name });
-  }
-  for (const k of asObjectArray(outputConfig.kv_namespaces)) {
-    const name = pluckString(k, "binding");
-    const namespace_id = pluckString(k, "id");
-    if (!name || !namespace_id) continue;
-    const title = pluckString(k, "title");
-    out.push({
-      type: "kv_namespace",
-      name,
-      namespace_id,
-      ...title && { title }
-    });
-  }
-  for (const d of asObjectArray(outputConfig.d1_databases)) {
-    const name = pluckString(d, "binding");
-    const id = pluckString(d, "database_id");
-    if (!name || !id) continue;
-    const database_name = pluckString(d, "database_name");
-    out.push({
-      type: "d1",
-      name,
-      id,
-      ...database_name && { database_name }
-    });
-  }
-  const queues = isObject(outputConfig.queues) ? outputConfig.queues : null;
-  for (const q of asObjectArray(queues?.producers)) {
-    const name = pluckString(q, "binding");
-    const queue_name = pluckString(q, "queue");
-    if (name && queue_name) out.push({ type: "queue", name, queue_name });
-  }
-  const browserBinding = pluckString(outputConfig.browser, "binding");
-  if (browserBinding) out.push({ type: "browser_rendering", name: browserBinding });
-  for (const a of asObjectArray(outputConfig.analytics_engine_datasets)) {
-    const name = pluckString(a, "binding");
-    const dataset = pluckString(a, "dataset");
-    if (name) out.push({ type: "analytics_engine", name, dataset: dataset ?? void 0 });
-  }
-  for (const h of asObjectArray(outputConfig.hyperdrive)) {
-    const name = pluckString(h, "binding");
-    const id = pluckString(h, "id");
-    if (name && id) out.push({ type: "hyperdrive", name, id });
-  }
-  return out;
-}
-function isObject(v) {
-  return v !== null && typeof v === "object" && !Array.isArray(v);
-}
-function pluckString(v, key) {
-  if (!isObject(v)) return null;
-  const val = v[key];
-  return typeof val === "string" && val.length > 0 ? val : null;
-}
-function pluckNumber(v, key) {
-  if (!isObject(v)) return null;
-  const val = v[key];
-  return typeof val === "number" && Number.isFinite(val) ? val : null;
-}
-function asObjectArray(v) {
-  if (!Array.isArray(v)) return [];
-  return v.filter(isObject);
-}
-
-// src/cli/commands/deploy.ts
 var DEPLOY_URL3 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 var API_URL2 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
 var CLOUDFLARE_DEPLOY_ERROR_HINT = "Deployment reached the DeepSpace deploy worker, but Cloudflare's deployment control-plane API failed. This is often caused by a Cloudflare Dashboard/API incident or Workers for Platforms entitlement outage. Already deployed apps should keep serving; wait for Cloudflare to recover and retry.";
@@ -2603,11 +2636,26 @@ var deploy_default = defineCommand8({
       );
     }
     p4.log.info(`Id: ${appId}`);
+    const readCustomDevVarsAt = (path) => {
+      if (!existsSync10(path)) return {};
+      const section = extractCustomDevVars(stripGeneratedSecretsCache(readFileSync10(path, "utf-8")));
+      if (!section) return {};
+      try {
+        return parseDevVars(section);
+      } catch (err) {
+        p4.cancel(`.dev.vars: ${errMessage(err)}`);
+        process.exit(1);
+      }
+    };
     let linkedSecrets = null;
+    let localOnlyDevVars = {};
     try {
       const refreshed = await refreshSecretsCache(DEPLOY_URL3, token, appId, envName);
       if (refreshed) {
         linkedSecrets = refreshed.pulled;
+        localOnlyDevVars = readCustomDevVarsAt(
+          devVarsPathFor(appDir, envName, { sharedDevVarsCache: true })
+        );
         await writeDevVars(appDir, ownerId, token, envName, {
           appId,
           generatedSecretsCache: refreshed.rendered,
@@ -2616,7 +2664,14 @@ var deploy_default = defineCommand8({
         p4.log.info(refreshed.summary);
       }
     } catch (err) {
-      p4.cancel(`Failed to refresh app secrets before deploy: ${errMessage(err)}`);
+      const msg = errMessage(err);
+      if (err?.status === 403) {
+        p4.cancel(
+          "You're not authorized to deploy this app \u2014 you must be its owner or a current collaborator. If you were a collaborator, your access may have been revoked."
+        );
+      } else {
+        p4.cancel(`Failed to refresh app secrets before deploy: ${msg}`);
+      }
       process.exit(1);
     }
     const junk = removeMacosJunk(appDir);
@@ -2648,13 +2703,13 @@ var deploy_default = defineCommand8({
       p4.cancel("Build output config not found at .wrangler/deploy/config.json");
       process.exit(1);
     }
-    const deployConfig = JSON.parse(readFileSync9(deployConfigPath, "utf-8"));
+    const deployConfig = JSON.parse(readFileSync10(deployConfigPath, "utf-8"));
     const outputWranglerPath = resolve7(dirname2(deployConfigPath), deployConfig.configPath);
     if (!existsSync10(outputWranglerPath)) {
       p4.cancel(`Output wrangler.json not found at ${outputWranglerPath}`);
       process.exit(1);
     }
-    const outputConfig = JSON.parse(readFileSync9(outputWranglerPath, "utf-8"));
+    const outputConfig = JSON.parse(readFileSync10(outputWranglerPath, "utf-8"));
     if (outputConfig.name && outputConfig.name !== appName) {
       const envHint = envName ? ` (--env ${envName})` : "";
       p4.cancel(
@@ -2676,7 +2731,7 @@ var deploy_default = defineCommand8({
     s.start("Collecting assets...");
     const assets = collectAssets(clientDir);
     s.stop(`Collected ${assets.length} assets`);
-    const workerJs = readFileSync9(workerBundlePath, "utf-8");
+    const workerJs = readFileSync10(workerBundlePath, "utf-8");
     const doBindings = outputConfig.durable_objects?.bindings;
     const sqliteClasses = new Set(
       outputConfig.migrations?.flatMap(
@@ -2708,18 +2763,13 @@ var deploy_default = defineCommand8({
     const devVarsPath = devVarsPathFor(appDir, envName, {
       sharedDevVarsCache: linkedSecrets !== null
     });
-    let userSecrets = {};
-    if (existsSync10(devVarsPath)) {
-      const rawDevVars = readFileSync9(devVarsPath, "utf-8");
-      const customSection = extractCustomDevVars(rawDevVars);
-      if (customSection) {
-        try {
-          userSecrets = parseDevVars(customSection);
-        } catch (err) {
-          p4.cancel(`.dev.vars: ${errMessage(err)}`);
-          process.exit(1);
-        }
-      }
+    const userSecrets = linkedSecrets ? { ...linkedSecrets.values } : {};
+    const handEditedDevVars = linkedSecrets ? localOnlyDevVars : readCustomDevVarsAt(devVarsPath);
+    const strayDevVars = Object.keys(handEditedDevVars).filter((k) => !(k in userSecrets));
+    if (strayDevVars.length) {
+      p4.log.warn(
+        `.dev.vars has ${strayDevVars.join(", ")} not in the app store \u2014 ${strayDevVars.length === 1 ? "it is" : "they are"} NOT deployed. \`.dev.vars\` is a local dev cache, not deploy config. Move ${strayDevVars.length === 1 ? "it" : "them"} into the store with \`deepspace secrets set KEY=value\` (or \`deepspace secrets upload .dev.vars\`), then redeploy.`
+      );
     }
     const userSecretNames = Object.keys(userSecrets);
     const declaredBindingNames = /* @__PURE__ */ new Set([
@@ -2729,22 +2779,19 @@ var deploy_default = defineCommand8({
     for (const name of userSecretNames) {
       if (RESERVED_BINDING_NAMES.has(name)) {
         p4.cancel(
-          `.dev.vars: "${name}" is a reserved binding name and cannot be used as an app secret.`
+          `App secret "${name}" is a reserved binding name \u2014 remove it with \`deepspace secrets delete ${name}\`.`
         );
         process.exit(1);
       }
       if (declaredBindingNames.has(name)) {
         p4.cancel(
-          `.dev.vars: "${name}" collides with a binding declared in wrangler.toml \u2014 rename one or the other.`
+          `App secret "${name}" collides with a binding declared in wrangler.toml \u2014 rename one or the other.`
         );
         process.exit(1);
       }
     }
     if (userSecretNames.length) {
-      p4.log.info(`App secrets (from .dev.vars): ${userSecretNames.join(", ")}`);
-      if (!linkedSecrets) {
-        p4.log.info("Not in the app store yet \u2014 migrating after this deploy.");
-      }
+      p4.log.info(`App secrets: ${userSecretNames.join(", ")}`);
     }
     s.start(`Deploying to ${appName}.app.space...`);
     const extraRoutes = extractRunWorkerFirst(wranglerConfig);
@@ -2874,16 +2921,6 @@ var deploy_default = defineCommand8({
           "First requests may briefly hit the assets transitional page; retry in a minute."
         );
         p4.log.success(`Live at: ${body.url}`);
-        await migrateLegacyDevVarsSecrets({
-          deployUrl: DEPLOY_URL3,
-          token,
-          appId,
-          envName,
-          devVarsPath,
-          userSecrets,
-          userSecretNames,
-          hadStore: linkedSecrets !== null
-        });
         await syncSubscriptionPlans(appDir, appId, token);
         await syncOneTimeProducts(appDir, appId, token);
         p4.outro("Done");
@@ -2892,41 +2929,11 @@ var deploy_default = defineCommand8({
     }
     s.stop("Deployed!");
     p4.log.success(`Live at: ${body.url}`);
-    await migrateLegacyDevVarsSecrets({
-      deployUrl: DEPLOY_URL3,
-      token,
-      appId,
-      envName,
-      devVarsPath,
-      userSecrets,
-      userSecretNames,
-      hadStore: linkedSecrets !== null
-    });
     await syncSubscriptionPlans(appDir, appId, token);
     await syncOneTimeProducts(appDir, appId, token);
     p4.outro("Done");
   }
 });
-async function migrateLegacyDevVarsSecrets(opts) {
-  const { deployUrl, token, appId, envName, devVarsPath, userSecrets, userSecretNames, hadStore } = opts;
-  if (hadStore || userSecretNames.length === 0) return;
-  const configName = defaultConfigNameForEnv(envName);
-  try {
-    await uploadSecrets(deployUrl, token, appId, configName, userSecrets, false);
-    if (existsSync10(devVarsPath)) {
-      const cleaned = removeDevVarsKeys(readFileSync9(devVarsPath, "utf-8"), new Set(userSecretNames));
-      writeFileSync9(devVarsPath, cleaned.endsWith("\n") ? cleaned : `${cleaned}
-`);
-    }
-    p4.log.success(
-      `Migrated ${userSecretNames.length} secret${userSecretNames.length === 1 ? "" : "s"} from .dev.vars into the app store (config ${configName}) \u2014 now managed by \`deepspace secrets\`.`
-    );
-  } catch (err) {
-    p4.log.warn(
-      `Couldn't migrate .dev.vars secrets into the app store (${errMessage(err)}); they deployed as bindings for now and the next deploy will retry.`
-    );
-  }
-}
 async function syncSubscriptionPlans(appDir, appName, token) {
   const subsPath = join11(appDir, "src", "subscriptions.ts");
   if (!existsSync10(subsPath)) return;
@@ -3155,7 +3162,7 @@ async function waitForAssetsReady(url, timeoutMs) {
 function collectAssets(dir) {
   const assets = [];
   function walk(d, prefix) {
-    for (const entry of readdirSync3(d, { withFileTypes: true })) {
+    for (const entry of readdirSync4(d, { withFileTypes: true })) {
       if (entry.name === ".assetsignore") continue;
       const full = join11(d, entry.name);
       const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
@@ -3164,7 +3171,7 @@ function collectAssets(dir) {
       } else {
         assets.push({
           path: "/" + rel,
-          contentBase64: readFileSync9(full).toString("base64")
+          contentBase64: readFileSync10(full).toString("base64")
         });
       }
     }
@@ -3986,7 +3993,7 @@ var transfer_default = defineCommand15({
 import { defineCommand as defineCommand16 } from "citty";
 
 // src/cli/commands/_invoke-impl.ts
-import { readFileSync as readFileSync10 } from "fs";
+import { readFileSync as readFileSync11 } from "fs";
 var API_URL6 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
 var DEFAULT_TIMEOUT_MS = 12e4;
 function parseTarget(target) {
@@ -4011,7 +4018,7 @@ function resolveBody(opts) {
   if (opts.body != null) {
     raw = opts.body;
   } else if (opts.bodyFile != null) {
-    raw = opts.bodyFile === "-" ? readFileSync10(0, "utf-8") : readFileSync10(opts.bodyFile, "utf-8");
+    raw = opts.bodyFile === "-" ? readFileSync11(0, "utf-8") : readFileSync11(opts.bodyFile, "utf-8");
   } else {
     return "{}";
   }
@@ -4356,7 +4363,7 @@ var invoke_default = defineCommand17({
 
 // src/cli/commands/library.ts
 import { defineCommand as defineCommand18 } from "citty";
-import { existsSync as existsSync12, readFileSync as readFileSync11 } from "fs";
+import { existsSync as existsSync12, readFileSync as readFileSync12 } from "fs";
 import { join as join14, resolve as resolve9 } from "path";
 import { parse as parseToml4 } from "smol-toml";
 import * as p6 from "@clack/prompts";
@@ -4439,7 +4446,7 @@ var publish = defineCommand18({
       if (!existsSync12(wranglerPath)) {
         return die("No --app provided and no wrangler.toml found. Either pass --app <name> or run from your app's directory.");
       }
-      const cfg = parseToml4(readFileSync11(wranglerPath, "utf-8"));
+      const cfg = parseToml4(readFileSync12(wranglerPath, "utf-8"));
       const nameRes = resolveAppName(cfg.name);
       if (!nameRes.ok) return die(`wrangler.toml: ${nameRes.reason}`);
       appName = nameRes.name;
@@ -4573,7 +4580,7 @@ var library_default = defineCommand18({
 // src/cli/commands/feedback.ts
 import { defineCommand as defineCommand19 } from "citty";
 import * as p7 from "@clack/prompts";
-import { existsSync as existsSync13, readFileSync as readFileSync12 } from "fs";
+import { existsSync as existsSync13, readFileSync as readFileSync13 } from "fs";
 import { dirname as dirname3, join as join15 } from "path";
 import { fileURLToPath } from "url";
 import { release } from "os";
@@ -4602,7 +4609,7 @@ function readCliVersion() {
     ];
     for (const path of candidates) {
       if (!existsSync13(path)) continue;
-      const pkg2 = JSON.parse(readFileSync12(path, "utf-8"));
+      const pkg2 = JSON.parse(readFileSync13(path, "utf-8"));
       if (pkg2.name === "deepspace" && pkg2.version) return pkg2.version;
     }
   } catch {
@@ -4812,7 +4819,7 @@ Context: deepspace ${payload.cliVersion} \xB7 ${payload.nodeVersion} \xB7 ${payl
 
 // src/cli/commands/secrets.ts
 import { defineCommand as defineCommand20 } from "citty";
-import { readFileSync as readFileSync13 } from "fs";
+import { readFileSync as readFileSync14 } from "fs";
 var DEPLOY_URL6 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 var COMMON_ARGS = {
   app: {
@@ -4844,6 +4851,11 @@ async function resolveTarget(args) {
     const appDir = findAppDir();
     appId = appDir && readAppId(appDir, wranglerEnv) || void 0;
     if (!appId) {
+      if (wranglerEnv && appDir && readAppId(appDir, void 0)) {
+        throw new Error(
+          `No app id for env "${wranglerEnv}" \u2014 wrangler.toml has no [env.${wranglerEnv}] block with its own DEEPSPACE_APP_ID. To target the "${wranglerEnv}" config on this app, use \`-c ${wranglerEnv}\` instead of \`--env ${wranglerEnv}\`.`
+        );
+      }
       throw new Error(
         "No app id. Run from an app directory whose wrangler.toml carries DEEPSPACE_APP_ID (`deepspace init` mints one), or pass --app <appId>."
       );
@@ -4857,6 +4869,14 @@ function fail(err) {
   console.error(err instanceof Error ? err.message : String(err));
   process.exit(1);
 }
+function warnIfDebugRoutesEnabled(secrets) {
+  if (secrets.ALLOW_DEBUG_ROUTES !== "true") return false;
+  console.warn(
+    "\n\u26A0  ALLOW_DEBUG_ROUTES=true exposes an UNAUTHENTICATED debug API on the deployed app \u2014\n   anyone who can reach /api/debug/* can read and mutate any record. Redeploy to apply;\n   `deepspace secrets delete ALLOW_DEBUG_ROUTES` (then redeploy) turns it back off."
+  );
+  return true;
+}
+var APPLY_HINT = "Run `deepspace deploy` to apply \u2014 secrets take effect at deploy time.";
 var list5 = defineCommand20({
   meta: { name: "list", description: "List masked secrets in a config" },
   args: {
@@ -4881,7 +4901,7 @@ var list5 = defineCommand20({
         return;
       }
       for (const s of secrets) {
-        console.log(args["only-names"] ? s.key : `${s.key}  (v${s.version}, ${s.valueBytes}B, ${s.updatedAt})`);
+        console.log(args["only-names"] ? s.key : `${s.key}  (v${s.version}, ${s.updatedAt})`);
       }
     } catch (err) {
       fail(err);
@@ -4897,18 +4917,25 @@ var set = defineCommand20({
   async run({ args }) {
     try {
       const t = await resolveTarget(args);
-      const pairs = [args.secret, ...args._ ?? []].filter(
+      const pairs = [.../* @__PURE__ */ new Set([args.secret, ...args._ ?? []])].filter(
         (v) => typeof v === "string" && v.length > 0
       );
       const secrets = {};
+      const dupes = [];
       for (const pair of pairs) {
         const eq = pair.indexOf("=");
         if (eq <= 0) throw new Error(`Expected KEY=value, got "${pair}"`);
         const key = validateSecretName(pair.slice(0, eq));
         const value = pair.slice(eq + 1);
         validateSecretValue(key, value);
+        if (key in secrets && !dupes.includes(key)) dupes.push(key);
         secrets[key] = value;
       }
+      if (dupes.length) {
+        console.warn(
+          `Warning: ${dupes.join(", ")} given more than once \u2014 kept the last value for each.`
+        );
+      }
       if (Object.keys(secrets).length === 1) {
         const [[k, v]] = Object.entries(secrets);
         await setSecret(DEPLOY_URL6, t.token, t.appId, t.configName, k, v);
@@ -4916,6 +4943,7 @@ var set = defineCommand20({
         await uploadSecrets(DEPLOY_URL6, t.token, t.appId, t.configName, secrets, false);
       }
       console.log(`Set ${Object.keys(secrets).length} secret${Object.keys(secrets).length === 1 ? "" : "s"} in ${t.configName}.`);
+      if (!warnIfDebugRoutesEnabled(secrets)) console.log(APPLY_HINT);
     } catch (err) {
       fail(err);
     }
@@ -4934,13 +4962,13 @@ var get = defineCommand20({
       const key = validateSecretName(args.key);
       if (args.plain) {
         const { value } = await getSecretPlain(DEPLOY_URL6, t.token, t.appId, t.configName, key);
-        process.stdout.write(value + "\n");
+        process.stdout.write(process.stdout.isTTY ? value + "\n" : value);
         return;
       }
       const { secrets } = await listSecrets(DEPLOY_URL6, t.token, t.appId, t.configName);
       const item = secrets.find((s) => s.key === key);
       if (!item) fail(new Error(`Secret "${key}" not found in ${t.configName}`));
-      console.log(`${item.key}  (v${item.version}, ${item.valueBytes}B, ${item.updatedAt})`);
+      console.log(`${item.key}  (v${item.version}, ${item.updatedAt})`);
     } catch (err) {
       fail(err);
     }
@@ -4955,13 +4983,24 @@ var del2 = defineCommand20({
   async run({ args }) {
     try {
       const t = await resolveTarget(args);
-      const keys = [args.key, ...args._ ?? []].filter(
+      const keys = [.../* @__PURE__ */ new Set([args.key, ...args._ ?? []])].filter(
         (v) => typeof v === "string" && v.length > 0
       );
+      let deleted = 0;
+      let absent = 0;
       for (const key of keys) {
-        await deleteSecret(DEPLOY_URL6, t.token, t.appId, t.configName, validateSecretName(key));
+        const name = validateSecretName(key);
+        try {
+          await deleteSecret(DEPLOY_URL6, t.token, t.appId, t.configName, name);
+          deleted++;
+        } catch (err) {
+          if (err?.status === 404) absent++;
+          else throw err;
+        }
       }
-      console.log(`Deleted ${keys.length} secret${keys.length === 1 ? "" : "s"} from ${t.configName}.`);
+      const note3 = absent > 0 ? ` (${absent} already absent)` : "";
+      console.log(`Deleted ${deleted} secret${deleted === 1 ? "" : "s"} from ${t.configName}.${note3}`);
+      if (deleted > 0) console.log(APPLY_HINT);
     } catch (err) {
       fail(err);
     }
@@ -4981,11 +5020,12 @@ var upload = defineCommand20({
   async run({ args }) {
     try {
       const t = await resolveTarget(args);
-      const content = args.file === "-" ? readFileSync13(0, "utf-8") : readFileSync13(args.file, "utf-8");
+      const content = args.file === "-" ? readFileSync14(0, "utf-8") : readFileSync14(args.file, "utf-8");
       const secrets = parseSecretsUpload(content);
       if (Object.keys(secrets).length === 0) fail(new Error("No secrets found in the input."));
       await uploadSecrets(DEPLOY_URL6, t.token, t.appId, t.configName, secrets, args.replace);
       console.log(`Uploaded ${Object.keys(secrets).length} secrets to ${t.configName}.`);
+      if (!warnIfDebugRoutesEnabled(secrets)) console.log(APPLY_HINT);
     } catch (err) {
       fail(err);
     }
@@ -5073,7 +5113,20 @@ var configsCreate = defineCommand20({
     try {
       const t = await resolveTarget(args);
       const name = validateConfigName(args.name);
-      await createConfig(DEPLOY_URL6, t.token, t.appId, name, args["copy-from"] || void 0);
+      const copyFrom = args["copy-from"] || void 0;
+      const { configs: configs2 } = await listConfigs(DEPLOY_URL6, t.token, t.appId);
+      if (configs2.some((c) => c.name === name)) {
+        if (copyFrom) {
+          fail(
+            new Error(
+              `Config "${name}" already exists \u2014 refusing to copy "${copyFrom}" over it. Delete it first, or pick a new name.`
+            )
+          );
+        }
+        console.log(`Config ${name} already exists.`);
+        return;
+      }
+      await createConfig(DEPLOY_URL6, t.token, t.appId, name, copyFrom);
       console.log(`Created ${name}.`);
     } catch (err) {
       fail(err);
@@ -5138,7 +5191,9 @@ var init_default = defineCommand21({
   async run({ args }) {
     const appDir = findAppDir();
     if (!appDir) {
-      console.error("Run from a DeepSpace app directory (one containing wrangler.toml).");
+      console.error(
+        "No wrangler.toml here \u2014 `deepspace init` stamps an app id into an existing DeepSpace app. To create a new app, run `deepspace create <name>` (or `npm create deepspace@latest <name>`), then run this from inside it."
+      );
       process.exit(1);
     }
     const envName = args.env || void 0;
@@ -5161,7 +5216,7 @@ var init_default = defineCommand21({
 
 // src/cli/cli.ts
 var __dirname = dirname4(fileURLToPath2(import.meta.url));
-var pkg = JSON.parse(readFileSync14(join16(__dirname, "..", "package.json"), "utf-8"));
+var pkg = JSON.parse(readFileSync15(join16(__dirname, "..", "package.json"), "utf-8"));
 if (process.platform === "linux" && !process.env.SSL_CERT_FILE && existsSync14("/etc/ssl/certs/ca-certificates.crt")) {
   process.env.SSL_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt";
 }