deepspace 0.5.4 → 0.5.6

package/dist/cli.js

@@ -2,15 +2,15 @@
 
 // src/cli/cli.ts
 import { defineCommand as defineCommand22, runMain } from "citty";
-import { execSync as execSync4 } from "child_process";
-import { readFileSync as readFileSync14, existsSync as existsSync14 } from "fs";
-import { dirname as dirname4, join as join16 } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
+import { spawnSync as spawnSync6 } from "child_process";
+import { readFileSync as readFileSync17, existsSync as existsSync14 } from "fs";
+import { dirname as dirname5, join as join15 } from "path";
+import { fileURLToPath as fileURLToPath3 } from "url";
 
 // src/cli/lib/cli-errors.ts
 var API_ERROR_HINTS = {
   not_app_owner: "Only the app owner can do this.",
-  app_not_found: "App not found. Check the app name (wrangler.toml `name`) and that it has been deployed.",
+  app_not_found: "App not found. Check the app id \u2014 the DEEPSPACE_APP_ID value in wrangler.toml, usually `app_\u2026` (a legacy app's id is its name). List your apps with `deepspace apps`. (`domain` commands take the deployed app *name* instead.)",
   not_app_owner_or_collaborator: "You must be the app owner or a collaborator to do this.",
   test_account_cannot_be_collaborator: "Test accounts cannot be added as collaborators. Use a real DeepSpace account.",
   user_not_found: "No DeepSpace user with that email. They need to log in to DeepSpace at least once (`deepspace login`, or sign in to any app) before they can be referenced by email."
@@ -25,8 +25,11 @@ ${hint}` : message;
 }
 function renderCliError(err) {
   console.error(formatCliError(err));
-  if (process.env.DEBUG && err instanceof Error && err.stack) {
-    console.error("\n" + err.stack);
+  if (process.env.DEBUG) {
+    const { apiPath, status: status3 } = err;
+    if (apiPath) console.error(`
+API ${apiPath}${status3 ? ` (${status3})` : ""}`);
+    if (err instanceof Error && err.stack) console.error("\n" + err.stack);
   }
   process.exit(1);
 }
@@ -51,7 +54,7 @@ function wrapCommandErrors(cmd) {
 
 // src/cli/commands/login.ts
 import { defineCommand } from "citty";
-import { writeFileSync as writeFileSync5, mkdirSync } from "fs";
+import { writeFileSync as writeFileSync5, mkdirSync, readFileSync as readFileSync4 } from "fs";
 import { join as join3 } from "path";
 import { homedir } from "os";
 import { randomBytes, createHash } from "crypto";
@@ -77,8 +80,215 @@ function createSpinner() {
 // src/cli/env.ts
 import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
 
+// src/server/rooms/binding-manifest.ts
+var AUTO_PROVISION_SENTINEL = "auto";
+var VECTORIZE_METRICS = /* @__PURE__ */ new Set(["cosine", "euclidean", "dot-product"]);
+var ALLOWED_BINDING_TYPES = /* @__PURE__ */ new Set([
+  "vectorize",
+  "ai",
+  "r2_bucket",
+  "kv_namespace",
+  "d1",
+  "queue",
+  "browser_rendering",
+  "analytics_engine",
+  "hyperdrive"
+]);
+var RESERVED_BINDING_NAMES = /* @__PURE__ */ new Set([
+  "ASSETS",
+  "PLATFORM_WORKER",
+  "API_WORKER",
+  "APP_NAME",
+  "OWNER_USER_ID",
+  "AUTH_JWT_PUBLIC_KEY",
+  "AUTH_JWT_ISSUER",
+  "AUTH_WORKER_URL",
+  "APP_IDENTITY_TOKEN",
+  "APP_OWNER_JWT",
+  "USAGE_EVENTS"
+]);
+function validateBindingManifest(manifest) {
+  if (!Array.isArray(manifest)) {
+    return { valid: false, errors: [{ reason: "Manifest must be an array" }] };
+  }
+  const errors = [];
+  const seenNames = /* @__PURE__ */ new Set();
+  for (const entry of manifest) {
+    if (!entry || typeof entry !== "object") {
+      errors.push({ reason: `Entry must be an object (got ${entry === null ? "null" : typeof entry})` });
+      continue;
+    }
+    const e = entry;
+    const type = e.type;
+    const name = e.name;
+    if (typeof type !== "string" || !ALLOWED_BINDING_TYPES.has(type)) {
+      errors.push({
+        reason: `Disallowed binding type: ${typeof type === "string" ? type : `(${typeof type})`}. Allowed: ${[...ALLOWED_BINDING_TYPES].sort().join(", ")}`
+      });
+      continue;
+    }
+    if (typeof name !== "string" || !name) {
+      errors.push({ reason: `Binding of type "${type}" missing 'name' (string)` });
+      continue;
+    }
+    if (RESERVED_BINDING_NAMES.has(name)) {
+      errors.push({ reason: `Binding name "${name}" is reserved by the SDK` });
+      continue;
+    }
+    if (seenNames.has(name)) {
+      errors.push({ reason: `Duplicate binding name "${name}"` });
+      continue;
+    }
+    seenNames.add(name);
+    const binding = entry;
+    const fieldErr = requiredFieldError(binding);
+    if (fieldErr) errors.push({ binding, reason: fieldErr });
+  }
+  if (errors.length) return { valid: false, errors };
+  return { valid: true, bindings: manifest };
+}
+function requiredFieldError(b) {
+  switch (b.type) {
+    case "vectorize": {
+      if (!b.index_name) return `vectorize binding "${b.name}" missing index_name (or "auto")`;
+      if (b.index_name === AUTO_PROVISION_SENTINEL) {
+        if (typeof b.dimensions !== "number" || b.dimensions <= 0) {
+          return `vectorize binding "${b.name}" with index_name="auto" requires "dimensions" (positive number)`;
+        }
+        if (!b.metric || !VECTORIZE_METRICS.has(b.metric)) {
+          return `vectorize binding "${b.name}" with index_name="auto" requires "metric" (one of: ${[...VECTORIZE_METRICS].join(", ")})`;
+        }
+      }
+      return null;
+    }
+    case "r2_bucket":
+      return b.bucket_name ? null : `r2_bucket binding "${b.name}" missing bucket_name (or "auto")`;
+    case "kv_namespace": {
+      if (!b.namespace_id) return `kv_namespace binding "${b.name}" missing namespace_id (or "auto")`;
+      if (b.namespace_id === AUTO_PROVISION_SENTINEL && !b.title) {
+        return `kv_namespace binding "${b.name}" with namespace_id="auto" requires "title"`;
+      }
+      return null;
+    }
+    case "d1": {
+      if (!b.id) return `d1 binding "${b.name}" missing id (or "auto")`;
+      if (b.id === AUTO_PROVISION_SENTINEL && !b.database_name) {
+        return `d1 binding "${b.name}" with id="auto" requires "database_name"`;
+      }
+      return null;
+    }
+    case "queue":
+      return b.queue_name ? null : `queue binding "${b.name}" missing queue_name (or "auto")`;
+    case "hyperdrive":
+      if (!b.id) return `hyperdrive binding "${b.name}" missing id`;
+      if (b.id === AUTO_PROVISION_SENTINEL) {
+        return `hyperdrive binding "${b.name}": auto-provisioning not yet supported (provide a real id)`;
+      }
+      return null;
+    case "ai":
+    case "browser_rendering":
+    case "analytics_engine":
+      return null;
+    // no required fields beyond `name`
+    default: {
+      const _exhaustive = b;
+      void _exhaustive;
+      return null;
+    }
+  }
+}
+function bindingManifestFromOutputConfig(outputConfig) {
+  const out = [];
+  const aiBinding = pluckString(outputConfig.ai, "binding");
+  if (aiBinding) out.push({ type: "ai", name: aiBinding });
+  for (const v of asObjectArray(outputConfig.vectorize)) {
+    const name = pluckString(v, "binding");
+    const index_name = pluckString(v, "index_name");
+    if (!name || !index_name) continue;
+    const dimensions = pluckNumber(v, "dimensions");
+    const metric = pluckString(v, "metric");
+    out.push({
+      type: "vectorize",
+      name,
+      index_name,
+      ...dimensions != null && { dimensions },
+      ...metric && (metric === "cosine" || metric === "euclidean" || metric === "dot-product") && { metric }
+    });
+  }
+  for (const r of asObjectArray(outputConfig.r2_buckets)) {
+    const name = pluckString(r, "binding");
+    const bucket_name = pluckString(r, "bucket_name");
+    if (name && bucket_name) out.push({ type: "r2_bucket", name, bucket_name });
+  }
+  for (const k of asObjectArray(outputConfig.kv_namespaces)) {
+    const name = pluckString(k, "binding");
+    const namespace_id = pluckString(k, "id");
+    if (!name || !namespace_id) continue;
+    const title = pluckString(k, "title");
+    out.push({
+      type: "kv_namespace",
+      name,
+      namespace_id,
+      ...title && { title }
+    });
+  }
+  for (const d of asObjectArray(outputConfig.d1_databases)) {
+    const name = pluckString(d, "binding");
+    const id = pluckString(d, "database_id");
+    if (!name || !id) continue;
+    const database_name = pluckString(d, "database_name");
+    out.push({
+      type: "d1",
+      name,
+      id,
+      ...database_name && { database_name }
+    });
+  }
+  const queues = isObject(outputConfig.queues) ? outputConfig.queues : null;
+  for (const q of asObjectArray(queues?.producers)) {
+    const name = pluckString(q, "binding");
+    const queue_name = pluckString(q, "queue");
+    if (name && queue_name) out.push({ type: "queue", name, queue_name });
+  }
+  const browserBinding = pluckString(outputConfig.browser, "binding");
+  if (browserBinding) out.push({ type: "browser_rendering", name: browserBinding });
+  for (const a of asObjectArray(outputConfig.analytics_engine_datasets)) {
+    const name = pluckString(a, "binding");
+    const dataset = pluckString(a, "dataset");
+    if (name) out.push({ type: "analytics_engine", name, dataset: dataset ?? void 0 });
+  }
+  for (const h of asObjectArray(outputConfig.hyperdrive)) {
+    const name = pluckString(h, "binding");
+    const id = pluckString(h, "id");
+    if (name && id) out.push({ type: "hyperdrive", name, id });
+  }
+  return out;
+}
+function isObject(v) {
+  return v !== null && typeof v === "object" && !Array.isArray(v);
+}
+function pluckString(v, key) {
+  if (!isObject(v)) return null;
+  const val = v[key];
+  return typeof val === "string" && val.length > 0 ? val : null;
+}
+function pluckNumber(v, key) {
+  if (!isObject(v)) return null;
+  const val = v[key];
+  return typeof val === "number" && Number.isFinite(val) ? val : null;
+}
+function asObjectArray(v) {
+  if (!Array.isArray(v)) return [];
+  return v.filter(isObject);
+}
+
 // src/cli/lib/secrets.ts
 var GENERATED_SECRETS_DIVIDER = "# --- DeepSpace secrets cache: generated by `npx deepspace secrets`; do not edit manually ---";
+var RESERVED_SECRET_NAMES = /* @__PURE__ */ new Set([
+  ...RESERVED_BINDING_NAMES,
+  "API_WORKER_URL",
+  "PLATFORM_WORKER_URL"
+]);
 var SECRET_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
 var CONFIG_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
 var MAX_SECRET_VALUE_BYTES = 32 * 1024;
@@ -96,6 +306,11 @@ function validateSecretName(name) {
       `Invalid secret name "${name}". Use letters, numbers, and underscores; start with a letter or underscore.`
     );
   }
+  if (RESERVED_SECRET_NAMES.has(name)) {
+    throw new Error(
+      `"${name}" is managed by the DeepSpace SDK and can't be set as an app secret \u2014 the platform injects it at deploy time.`
+    );
+  }
   return name;
 }
 function validateSecretValue(key, value) {
@@ -117,7 +332,10 @@ async function secretsApi(deployUrl, token, path, init = {}) {
   });
   const body = await res.json().catch(() => ({}));
   if (!res.ok) {
-    throw new Error(`Secrets API ${path} (${res.status}): ${body.error ?? "request failed"}`);
+    const err = new Error(body.error ?? `Secrets request failed (${res.status})`);
+    err.status = res.status;
+    err.apiPath = path;
+    throw err;
   }
   return body;
 }
@@ -177,8 +395,7 @@ async function pullAppSecretsCache(deployUrl, token, appId, configName) {
     const { secrets } = await fetchSecretsValues(deployUrl, token, appId, configName);
     return { appId, configName, values: secrets };
   } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    if (msg.includes("(404)")) return null;
+    if (err?.status === 404) return null;
     throw err;
   }
 }
@@ -223,22 +440,56 @@ function parseSecretsUpload(content) {
     return out2;
   }
   const out = {};
-  for (const rawLine of trimmed.split("\n")) {
-    const line = rawLine.trim();
+  const lines = trimmed.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i].trim();
     if (!line || line.startsWith("#")) continue;
     const eq = line.indexOf("=");
     if (eq <= 0) continue;
     const key = line.slice(0, eq).trim();
     if (!SECRET_NAME_RE.test(key)) continue;
-    let value = line.slice(eq + 1).trim();
-    if (value.startsWith('"') && value.endsWith('"') && value.length >= 2) {
-      value = unescapeDotenv(value.slice(1, -1));
+    validateSecretName(key);
+    const raw = line.slice(eq + 1).trim();
+    const quote = raw[0] === '"' || raw[0] === "'" ? raw[0] : null;
+    let value;
+    if (!quote) {
+      value = raw;
+    } else if (endsWithUnescapedQuote(raw.slice(1), quote)) {
+      const inner = raw.slice(1, -1);
+      value = quote === '"' ? unescapeDotenv(inner) : inner;
+    } else {
+      const startLine = i + 1;
+      const parts = [raw.slice(1)];
+      let closed = false;
+      while (++i < lines.length) {
+        const cont = lines[i].trimEnd();
+        if (endsWithUnescapedQuote(cont, quote)) {
+          parts.push(cont.slice(0, -1));
+          closed = true;
+          break;
+        }
+        parts.push(lines[i]);
+      }
+      if (!closed) {
+        throw new Error(
+          `Unterminated quoted value for "${key}" (opens on line ${startLine}). Close the ${quote === '"' ? "double" : "single"} quote, or escape newlines as \\n on one line.`
+        );
+      }
+      value = parts.join("\n");
+      if (quote === '"') value = unescapeDotenv(value);
     }
     validateSecretValue(key, value);
     out[key] = value;
   }
   return out;
 }
+function endsWithUnescapedQuote(s, q) {
+  if (!s.endsWith(q)) return false;
+  if (q === "'") return true;
+  let backslashes = 0;
+  for (let j = s.length - 2; j >= 0 && s[j] === "\\"; j--) backslashes++;
+  return backslashes % 2 === 0;
+}
 function unescapeDotenv(v) {
   let out = "";
   for (let i = 0; i < v.length; i++) {
@@ -251,13 +502,16 @@ function unescapeDotenv(v) {
   }
   return out;
 }
+function shellSingleQuote(value) {
+  return `'${value.replace(/'/g, "'\\''")}'`;
+}
 function formatSecretsDownload(secrets, format) {
   const entries = Object.entries(secrets).sort(([a], [b]) => a.localeCompare(b));
   if (format === "json") {
     return JSON.stringify(Object.fromEntries(entries), null, 2) + "\n";
   }
   if (format === "shell") {
-    return entries.map(([k, v]) => `export ${k}=${quoteDotenvValue(v)}`).join("\n") + "\n";
+    return entries.map(([k, v]) => `export ${k}=${shellSingleQuote(v)}`).join("\n") + "\n";
   }
   return entries.map(([k, v]) => `${k}=${quoteDotenvValue(v)}`).join("\n") + "\n";
 }
@@ -690,38 +944,6 @@ function extractCustomDevVars(content) {
   while (out.length && out[out.length - 1].trim() === "") out.pop();
   return out.join("\n");
 }
-function removeDevVarsKeys(content, keys) {
-  const lines = content.split("\n");
-  const out = [];
-  let i = 0;
-  while (i < lines.length) {
-    const line = lines[i];
-    const eq = line.indexOf("=");
-    const keyMatch = eq >= 0 ? line.slice(0, eq).match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*$/) : null;
-    if (!keyMatch) {
-      out.push(line);
-      i++;
-      continue;
-    }
-    const key = keyMatch[1];
-    const valStart = line.slice(eq + 1);
-    const block = [line];
-    if (valStart.startsWith('"') && !hasUnescapedQuote(valStart.slice(1))) {
-      i++;
-      while (i < lines.length) {
-        block.push(lines[i]);
-        const closed = hasUnescapedQuote(lines[i]);
-        i++;
-        if (closed) break;
-      }
-    } else {
-      i++;
-    }
-    if (!keys.has(key)) out.push(...block);
-  }
-  while (out.length && out[out.length - 1].trim() === "") out.pop();
-  return out.join("\n");
-}
 function hasUnescapedQuote(s) {
   let escaped = false;
   for (const ch of s) {
@@ -820,8 +1042,10 @@ async function writeDevVars(appDir, ownerId, callerJwt, wranglerEnv, opts = {})
     `OWNER_USER_ID=${ownerId}`,
     `APP_OWNER_JWT=${appOwnerJwt}`,
     ...appIdentityToken ? [`APP_IDENTITY_TOKEN=${appIdentityToken}`] : [],
-    // Open /api/debug/* (proxied to RecordRoom) for dev + tests only.
-    // Production secrets never set this, so deployed apps 404 the route.
+    // Open /api/debug/* (proxied to RecordRoom) locally. This is the SDK's
+    // dev-only auto-value; the deploy ships the remote store, not this
+    // `.dev.vars` section, so it never reaches prod. To enable it on a deployed
+    // env, `deepspace secrets set ALLOW_DEBUG_ROUTES=true`.
     `ALLOW_DEBUG_ROUTES=true`
   ].join("\n");
   const useSharedDevVarsCache = opts.sharedDevVarsCache ?? opts.generatedSecretsCache !== void 0;
@@ -884,19 +1108,38 @@ var login_default = defineCommand({
   args: {
     email: {
       type: "string",
-      description: "Email address (non-interactive mode)",
+      description: "Email address (non-interactive mode; or $DEEPSPACE_EMAIL)",
       required: false
     },
     password: {
       type: "string",
-      description: "Password (non-interactive mode)",
+      description: "Password (discouraged \u2014 visible in ps/history; prefer --password-stdin or $DEEPSPACE_PASSWORD)",
       required: false
+    },
+    "password-stdin": {
+      type: "boolean",
+      description: "Read the password from stdin instead of --password",
+      default: false
     }
   },
   async run({ args }) {
-    if (args.email && args.password) {
-      console.log(`Signing in as ${args.email}...`);
-      await doEmailLogin(args.email, args.password);
+    const interactive = Boolean(process.stdin.isTTY);
+    const { email, password } = resolveLoginCredentials({
+      emailArg: args.email,
+      passwordArg: args.password,
+      envEmail: interactive ? void 0 : process.env.DEEPSPACE_EMAIL,
+      envPassword: interactive ? void 0 : process.env.DEEPSPACE_PASSWORD,
+      passwordStdin: args["password-stdin"] ? readPasswordFromStdin() : void 0
+    });
+    const passwordIntent = Boolean(args["password-stdin"]) || args.password !== void 0 || password !== void 0;
+    const decision = loginModeDecision({ email, password, passwordIntent });
+    if (decision.mode === "error") {
+      console.error(decision.message);
+      process.exit(1);
+    }
+    if (decision.mode === "password") {
+      console.log(`Signing in as ${email}...`);
+      await doEmailLogin(email, password);
       console.log("Logged in");
       return;
     }
@@ -947,6 +1190,34 @@ plans on the web dashboard:
     p2.outro("Done");
   }
 });
+function resolveLoginCredentials(opts) {
+  const email = opts.emailArg || opts.envEmail || void 0;
+  const password = opts.passwordStdin !== void 0 ? opts.passwordStdin : opts.passwordArg || opts.envPassword || void 0;
+  return { email, password };
+}
+function loginModeDecision(opts) {
+  if (opts.email && opts.password) return { mode: "password" };
+  if (!opts.passwordIntent) return { mode: "oauth" };
+  if (!opts.email) {
+    return {
+      mode: "error",
+      message: "Non-interactive login needs an email: --email <you@example.com> (or $DEEPSPACE_EMAIL)."
+    };
+  }
+  return {
+    mode: "error",
+    message: "Non-interactive login needs a non-empty password: --password-stdin, $DEEPSPACE_PASSWORD, or --password."
+  };
+}
+function readPasswordFromStdin() {
+  if (process.stdin.isTTY) {
+    console.error(
+      '--password-stdin expects the password piped on stdin, e.g. `printf %s "$PW" | deepspace login --email you@x.com --password-stdin`.'
+    );
+    process.exit(1);
+  }
+  return readFileSync4(0, "utf-8").replace(/\r?\n$/, "");
+}
 async function pollForCompletion(sessionId, codeVerifier) {
   const maxAttempts = 120;
   const interval = 5e3;
@@ -1017,7 +1288,7 @@ async function doEmailLogin(email, password) {
 
 // src/cli/commands/logout.ts
 import { defineCommand as defineCommand2 } from "citty";
-import { existsSync as existsSync4, readFileSync as readFileSync4, rmSync as rmSync2 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync5, rmSync as rmSync2 } from "fs";
 import { join as join4 } from "path";
 import { homedir as homedir2 } from "os";
 var AUTH_URL2 = process.env.DEEPSPACE_AUTH_URL ?? PLATFORM_URLS.auth;
@@ -1030,7 +1301,7 @@ var logout_default = defineCommand2({
     description: "Sign out and remove cached credentials"
   },
   async run() {
-    const sessionToken = existsSync4(SESSION_PATH) ? readFileSync4(SESSION_PATH, "utf-8").trim() : null;
+    const sessionToken = existsSync4(SESSION_PATH) ? readFileSync5(SESSION_PATH, "utf-8").trim() : null;
     if (sessionToken) {
       try {
         await fetch(`${AUTH_URL2}/api/auth/sign-out`, {
@@ -1060,11 +1331,11 @@ var logout_default = defineCommand2({
 
 // src/cli/commands/dev.ts
 import { defineCommand as defineCommand3 } from "citty";
-import { resolve as resolve4, basename, join as join9 } from "path";
+import { resolve as resolve4, basename as basename2, join as join9 } from "path";
 import spawn from "cross-spawn";
 
 // src/cli/auth.ts
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync6, existsSync as existsSync5, mkdirSync as mkdirSync2 } from "fs";
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync6, existsSync as existsSync5, mkdirSync as mkdirSync2 } from "fs";
 import { join as join5 } from "path";
 import { homedir as homedir3 } from "os";
 
@@ -1084,7 +1355,7 @@ var SESSION_PATH2 = join5(DIR2, "session");
 var TOKEN_PATH2 = join5(DIR2, "token");
 async function ensureToken() {
   if (existsSync5(TOKEN_PATH2)) {
-    const existing = readFileSync5(TOKEN_PATH2, "utf-8").trim();
+    const existing = readFileSync6(TOKEN_PATH2, "utf-8").trim();
     if (isTokenValid(existing)) {
       return existing;
     }
@@ -1092,7 +1363,7 @@ async function ensureToken() {
   if (!existsSync5(SESSION_PATH2)) {
     throw new Error("Not logged in. Run `deepspace login` first.");
   }
-  const sessionToken = readFileSync5(SESSION_PATH2, "utf-8").trim();
+  const sessionToken = readFileSync6(SESSION_PATH2, "utf-8").trim();
   const token = await exchangeSession(AUTH_URL3, sessionToken);
   if (!token) {
     throw new Error("Session expired. Run `deepspace login` to re-authenticate.");
@@ -1113,20 +1384,56 @@ function isTokenValid(jwt) {
 // src/cli/lib/app-context.ts
 import {
   existsSync as existsSync6,
-  readFileSync as readFileSync6,
+  readFileSync as readFileSync7,
   readdirSync,
   writeFileSync as writeFileSync7,
   mkdirSync as mkdirSync3,
   renameSync,
   unlinkSync
 } from "fs";
-import { join as join6, resolve as resolve2, dirname, isAbsolute, sep } from "path";
+import { join as join6, resolve as resolve2, dirname, basename, isAbsolute, sep } from "path";
 import { parse as parseToml3 } from "smol-toml";
+
+// src/cli/lib/api.ts
+var ApiError = class extends Error {
+  constructor(message, status3, code, apiPath) {
+    super(message);
+    this.status = status3;
+    this.code = code;
+    this.apiPath = apiPath;
+  }
+};
+async function apiFetch(baseUrl, token, path, init) {
+  const res = await fetch(`${baseUrl}${path}`, {
+    ...init,
+    headers: {
+      Authorization: `Bearer ${token}`,
+      "Content-Type": "application/json",
+      ...init?.headers ?? {}
+    }
+  });
+  const text2 = await res.text();
+  if (!res.ok) {
+    let msg = text2;
+    let code;
+    try {
+      const body = JSON.parse(text2);
+      msg = body.error ?? text2;
+      code = body.code;
+    } catch {
+    }
+    throw new ApiError(msg || `Request failed (${res.status})`, res.status, code, path);
+  }
+  return text2 ? JSON.parse(text2) : {};
+}
+
+// src/cli/lib/app-context.ts
+var STRICT_APP_ID_RE = /^app_[0-9A-HJKMNP-TV-Z]{26}$/;
 function detectAppName(cwd = process.cwd()) {
   const wranglerPath = join6(resolve2(cwd), "wrangler.toml");
   if (!existsSync6(wranglerPath)) return null;
   try {
-    const cfg = parseToml3(readFileSync6(wranglerPath, "utf-8"));
+    const cfg = parseToml3(readFileSync7(wranglerPath, "utf-8"));
     return typeof cfg.name === "string" && cfg.name.length > 0 ? cfg.name : null;
   } catch (err) {
     throw new Error(
@@ -1175,18 +1482,42 @@ function writeLaunchFile(launchPath, config) {
 function readLaunchFile(launchPath) {
   const empty = { version: "0.0.1", configurations: [] };
   if (!existsSync6(launchPath)) return empty;
-  const raw = readFileSync6(launchPath, "utf-8").trim();
+  const raw = readFileSync7(launchPath, "utf-8").trim();
   if (!raw) return empty;
   const parsed = JSON.parse(raw);
   if (!parsed || typeof parsed !== "object" || !Array.isArray(parsed.configurations)) return null;
   return parsed;
 }
-function writeLaunchConfigIfMissing(appDir, appName, port) {
+function writeLaunchConfigIfMissing(appDir, appName, port, opts = {}) {
   const launchPath = join6(appDir, ".claude", "launch.json");
   try {
     const config = readLaunchFile(launchPath);
     if (!config) return;
-    if (config.configurations.some((c) => c?.name === appName)) return;
+    const existing = config.configurations.find((c) => c?.name === appName);
+    if (existing) {
+      if (!opts.updatePort) return;
+      let changed = false;
+      if (Number(existing.port) !== port) {
+        existing.port = port;
+        changed = true;
+      }
+      if (Array.isArray(existing.runtimeArgs)) {
+        const ra = existing.runtimeArgs.map(String);
+        const pi = ra.indexOf("--port");
+        if (pi >= 0 && pi + 1 < ra.length) {
+          if (ra[pi + 1] !== String(port)) {
+            ra[pi + 1] = String(port);
+            changed = true;
+          }
+        } else {
+          ra.push("--port", String(port));
+          changed = true;
+        }
+        if (changed) existing.runtimeArgs = ra;
+      }
+      if (changed) writeLaunchFile(launchPath, config);
+      return;
+    }
     config.configurations.push({
       name: appName,
       runtimeExecutable: "npx",
@@ -1197,6 +1528,18 @@ function writeLaunchConfigIfMissing(appDir, appName, port) {
   } catch {
   }
 }
+function resolveAppLaunchPort(appDir) {
+  try {
+    const config = readLaunchFile(join6(appDir, ".claude", "launch.json"));
+    if (!config) return null;
+    const appName = detectAppName(appDir) ?? basename(appDir);
+    const entry = config.configurations.find((c) => c?.name === appName) ?? (config.configurations.length === 1 ? config.configurations[0] : void 0);
+    const port = Number(entry?.port);
+    return Number.isInteger(port) && port > 0 ? port : null;
+  } catch {
+    return null;
+  }
+}
 function detectClaudeWorktree(appDir) {
   const segments = resolve2(appDir).split(sep);
   for (let i = segments.length - 3; i >= 1; i--) {
@@ -1232,7 +1575,7 @@ function upsertWorktreeLaunchConfig(mainRepoRoot, worktreeName, appDir, opts) {
     let port = opts.port;
     if (opts.probePort) {
       const taken = new Set(
-        config.configurations.map((c) => Number(c?.port)).filter((p8) => Number.isInteger(p8) && p8 > 0)
+        config.configurations.map((c) => Number(c?.port)).filter((p10) => Number.isInteger(p10) && p10 > 0)
       );
       for (let i = 0; i < WORKTREE_PORT_RANGE && taken.has(port); i++) {
         port = WORKTREE_PORT_MIN + (port - WORKTREE_PORT_MIN + 1) % WORKTREE_PORT_RANGE;
@@ -1285,9 +1628,36 @@ function requireAppIdArg(explicit) {
   }
   return id;
 }
+function matchAppSelector(apps, selector) {
+  const byId = apps.find((a) => a.appId === selector);
+  if (byId) return byId.appId;
+  const byName = apps.find((a) => a.name === selector);
+  if (byName) return byName.appId;
+  return STRICT_APP_ID_RE.test(selector) ? selector : null;
+}
+async function resolveAppSelector(deployUrl, token, selector) {
+  if (STRICT_APP_ID_RE.test(selector)) return selector;
+  const { apps } = await apiFetch(deployUrl, token, "/api/apps");
+  const id = matchAppSelector(apps, selector);
+  if (!id) {
+    throw new Error(`No app "${selector}" in your account. Run \`deepspace apps\` to list your apps.`);
+  }
+  return id;
+}
+async function resolveAppTarget(deployUrl, token, explicit) {
+  if (explicit) return resolveAppSelector(deployUrl, token, explicit);
+  const appDir = findAppDir();
+  const id = appDir ? readAppId(appDir) : null;
+  if (!id) {
+    throw new Error(
+      "No app id. Run from an app directory whose wrangler.toml carries DEEPSPACE_APP_ID, or pass --app <id or name>."
+    );
+  }
+  return id;
+}
 
 // src/cli/lib/install-status.ts
-import { existsSync as existsSync7, readFileSync as readFileSync7 } from "fs";
+import { existsSync as existsSync7, readFileSync as readFileSync8 } from "fs";
 import { join as join7 } from "path";
 function ensureInstallReady(appDir) {
   if (existsSync7(join7(appDir, "node_modules", "deepspace", "package.json"))) return;
@@ -1298,13 +1668,19 @@ function ensureInstallReady(appDir) {
   const logPath = join7(sentinelDir, "install.log");
   if (existsSync7(errPath)) {
     console.error("Background install failed:");
-    console.error(readFileSync7(errPath, "utf-8").trimEnd());
+    console.error(readFileSync8(errPath, "utf-8").trimEnd());
     if (existsSync7(logPath)) console.error(`
 Full log: ${logPath}`);
     console.error("\nRun `npm install` (or `bun install`) manually, then retry.");
     process.exit(1);
   }
   if (existsSync7(startedPath) && !existsSync7(donePath)) {
+    if (!installWorkerAlive(sentinelDir)) {
+      console.error("The background install is no longer running and never finished.");
+      if (existsSync7(logPath)) console.error(`See what happened: ${logPath}`);
+      console.error("Run `npm install` (or `bun install`) manually, then retry.");
+      process.exit(1);
+    }
     console.error("Dependencies are still installing in the background.");
     if (existsSync7(logPath)) console.error(`Tail progress: tail -f ${logPath}`);
     console.error("Retry once it finishes.");
@@ -1313,6 +1689,18 @@ Full log: ${logPath}`);
   console.error("Dependencies not installed. Run `npm install` (or `bun install`) first.");
   process.exit(1);
 }
+function installWorkerAlive(sentinelDir) {
+  const pidPath = join7(sentinelDir, "install.pid");
+  if (!existsSync7(pidPath)) return true;
+  const pid = Number.parseInt(readFileSync8(pidPath, "utf-8").trim(), 10);
+  if (!Number.isFinite(pid) || pid <= 0) return true;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err.code === "EPERM";
+  }
+}
 
 // src/cli/lib/preflight.ts
 import { execFileSync } from "child_process";
@@ -1390,7 +1778,16 @@ function removeMacosJunk(dir) {
 }
 
 // src/cli/lib/port.ts
+import { createServer } from "net";
 var DEFAULT_PORT = 5173;
+function checkPortAvailable(port, host = "0.0.0.0") {
+  return new Promise((resolve10) => {
+    const srv = createServer();
+    srv.once("error", () => resolve10(false));
+    srv.once("listening", () => srv.close(() => resolve10(true)));
+    srv.listen(port, host);
+  });
+}
 function resolvePort(arg) {
   const raw = arg ?? process.env.DEEPSPACE_PORT;
   if (!raw) return DEFAULT_PORT;
@@ -1417,6 +1814,7 @@ var dev_default = defineCommand3({
     },
     env: {
       type: "string",
+      alias: "e",
       description: "wrangler.toml [env.<name>] block to run (e.g. --env staging). Applies the env's overrides at build time.",
       required: false
     },
@@ -1474,7 +1872,9 @@ var dev_default = defineCommand3({
         );
       }
     }
-    writeLaunchConfigIfMissing(appDir, detectAppName(appDir) ?? basename(appDir), port);
+    writeLaunchConfigIfMissing(appDir, detectAppName(appDir) ?? basename2(appDir), port, {
+      updatePort: explicitPort
+    });
     ensureInstallReady(appDir);
     let token;
     try {
@@ -1522,6 +1922,12 @@ var dev_default = defineCommand3({
       process.exit(1);
     }
     preflightWindowsWorkerd(appDir);
+    if (!await checkPortAvailable(port)) {
+      console.error(`Port ${port} is already in use.`);
+      const killCmd = port === DEFAULT_PORT ? "deepspace kill" : `deepspace kill --port ${port}`;
+      console.error(`Free it with \`${killCmd}\`, or start on another port: \`deepspace dev --port <other>\`.`);
+      process.exit(1);
+    }
     console.log("Starting dev server...\n");
     const vite = spawn("npx", ["vite", "--port", String(port), "--strictPort", "--host"], {
       cwd: appDir,
@@ -1544,9 +1950,16 @@ var dev_default = defineCommand3({
 // src/cli/commands/kill.ts
 import { defineCommand as defineCommand4 } from "citty";
 import { spawnSync } from "child_process";
+import { readFileSync as readFileSync9, readdirSync as readdirSync3, readlinkSync } from "fs";
 import { setTimeout as wait } from "timers/promises";
 var SIGTERM_GRACE_MS = 1500;
 var IS_WIN = process.platform === "win32";
+function pickKillPort(opts) {
+  if (opts.explicit != null) return opts.explicit;
+  if (opts.worktree != null) return opts.worktree;
+  if (opts.env != null) return opts.env;
+  return opts.appLaunch ?? DEFAULT_PORT;
+}
 var kill_default = defineCommand4({
   meta: {
     name: "kill",
@@ -1565,21 +1978,38 @@ var kill_default = defineCommand4({
     }
   },
   async run({ args }) {
-    const port = (args.port ? null : resolveWorktreePort(process.cwd())) ?? resolvePort(args.port);
+    const cwd = process.cwd();
+    const port = pickKillPort({
+      explicit: args.port ? resolvePort(args.port) : null,
+      worktree: resolveWorktreePort(cwd),
+      // resolvePort() reads + validates $DEEPSPACE_PORT; only consult it when set.
+      env: process.env.DEEPSPACE_PORT ? resolvePort() : null,
+      appLaunch: resolveAppLaunchPort(findAppDir(cwd) ?? cwd)
+    });
     const targets = /* @__PURE__ */ new Set();
-    for (const pid of listenerPids(port)) targets.add(pid);
+    const listeners = enumerateListeners(port);
+    for (const pid of listeners.pids) targets.add(pid);
     for (const pid of [...targets]) {
       for (const child of childPids(pid)) targets.add(child);
     }
+    let swept = false;
     if (args.all) {
-      for (const pid of processPidsByName(["workerd", "wrangler", "vite"])) {
-        targets.add(pid);
-      }
+      const sweep = sweepByName(["workerd", "wrangler", "vite"]);
+      swept = sweep.swept;
+      for (const pid of sweep.pids) targets.add(pid);
     }
     if (targets.size === 0) {
-      console.log(
-        args.all ? `Nothing listening on :${port} and no stray workerd/wrangler/vite processes found.` : `Nothing listening on :${port}. (Pass --all to sweep stray workerd/wrangler.)`
-      );
+      const outcome = noTargetsMessage({
+        enumerated: listeners.enumerated,
+        swept,
+        all: args.all,
+        port
+      });
+      if (!outcome.ok) {
+        console.error(outcome.message);
+        process.exit(1);
+      }
+      console.log(outcome.message);
       return;
     }
     for (const pid of targets) {
@@ -1605,16 +2035,101 @@ var kill_default = defineCommand4({
       );
       process.exit(1);
     }
-    console.log(`Port ${port} is free.`);
+    if (args.all) {
+      console.log(`Killed ${targets.size} process(es) (workerd/wrangler/vite sweep). :${port} is free.`);
+    } else {
+      console.log(`Port ${port} is free.`);
+    }
   }
 });
-function listenerPids(port) {
+function noTargetsMessage(opts) {
+  const { enumerated, swept, all, port } = opts;
+  const couldObserve = enumerated || all && swept;
+  if (!couldObserve) {
+    return {
+      ok: false,
+      message: `Couldn't determine what's running on :${port}: no lsof/pgrep and /proc is unavailable, so nothing was inspected or killed. Install lsof (or procps for pgrep), or find and kill the process manually.`
+    };
+  }
+  return {
+    ok: true,
+    message: all ? `Nothing listening on :${port} and no stray workerd/wrangler/vite processes found.` : `Nothing listening on :${port}. (Pass --all to sweep stray workerd/wrangler.)`
+  };
+}
+function enumerateListeners(port) {
   if (IS_WIN) {
-    return runPowershell(
+    const r = runPowershellChecked(
       `Get-NetTCPConnection -LocalPort ${port} -State Listen -ErrorAction SilentlyContinue | Select-Object -ExpandProperty OwningProcess`
     );
+    return { pids: r.pids, enumerated: r.ran };
+  }
+  const lsof = runLsof(port);
+  if (lsof.ran) return { pids: lsof.pids, enumerated: true };
+  const proc = listenerPidsViaProc(port);
+  return { pids: proc.pids, enumerated: proc.available };
+}
+function listenerPids(port) {
+  return enumerateListeners(port).pids;
+}
+function runLsof(port) {
+  try {
+    const r = spawnSync("lsof", ["-nP", `-iTCP:${port}`, "-sTCP:LISTEN", "-t"], {
+      encoding: "utf-8"
+    });
+    if (r.error) return { pids: [], ran: false };
+    return { pids: r.status === 0 ? parsePidLines(r.stdout) : [], ran: true };
+  } catch {
+    return { pids: [], ran: false };
+  }
+}
+function listenerPidsViaProc(port) {
+  let available = false;
+  try {
+    const hexPort = port.toString(16).toUpperCase().padStart(4, "0");
+    const inodes = /* @__PURE__ */ new Set();
+    for (const f of ["/proc/net/tcp", "/proc/net/tcp6"]) {
+      let data;
+      try {
+        data = readFileSync9(f, "utf-8");
+      } catch {
+        continue;
+      }
+      available = true;
+      for (const line of data.split("\n").slice(1)) {
+        const cols = line.trim().split(/\s+/);
+        if (cols[3] !== "0A") continue;
+        if (cols[1]?.split(":")[1] === hexPort && cols[9]) inodes.add(cols[9]);
+      }
+    }
+    if (!available) return { pids: [], available: false };
+    if (!inodes.size) return { pids: [], available: true };
+    const pids = /* @__PURE__ */ new Set();
+    for (const pidDir of readdirSync3("/proc")) {
+      if (!/^\d+$/.test(pidDir)) continue;
+      let fds;
+      try {
+        fds = readdirSync3(`/proc/${pidDir}/fd`);
+      } catch {
+        continue;
+      }
+      for (const fd of fds) {
+        let link;
+        try {
+          link = readlinkSync(`/proc/${pidDir}/fd/${fd}`);
+        } catch {
+          continue;
+        }
+        const m = link.match(/^socket:\[(\d+)\]$/);
+        if (m && inodes.has(m[1])) {
+          pids.add(Number(pidDir));
+          break;
+        }
+      }
+    }
+    return { pids: [...pids], available: true };
+  } catch {
+    return { pids: [], available };
   }
-  return run(["lsof", "-nP", `-iTCP:${port}`, "-sTCP:LISTEN", "-t"]);
 }
 function childPids(parentPid) {
   if (IS_WIN) {
@@ -1624,22 +2139,31 @@ function childPids(parentPid) {
   }
   return run(["pgrep", "-P", String(parentPid)]);
 }
-function processPidsByName(names) {
+function sweepByName(names) {
   const all = /* @__PURE__ */ new Set();
   if (IS_WIN) {
     const orClauses = names.map((n) => `($_.Name -like '*${n}*') -or ($_.CommandLine -like '*${n}*')`).join(" -or ");
     const script = `Get-CimInstance Win32_Process | Where-Object { ${orClauses} } | Select-Object -ExpandProperty ProcessId`;
-    for (const pid of runPowershell(script)) {
-      if (pid !== process.pid) all.add(pid);
-    }
-    return [...all];
+    const r = runPowershellChecked(script);
+    for (const pid of r.pids) if (pid !== process.pid) all.add(pid);
+    return { pids: [...all], swept: r.ran };
   }
+  let swept = false;
   for (const name of names) {
-    for (const pid of run(["pgrep", "-f", name])) {
-      if (pid !== process.pid) all.add(pid);
-    }
+    const r = runPgrep(["-f", name]);
+    if (r.ran) swept = true;
+    for (const pid of r.pids) if (pid !== process.pid) all.add(pid);
+  }
+  return { pids: [...all], swept };
+}
+function runPgrep(pgrepArgs) {
+  try {
+    const r = spawnSync("pgrep", pgrepArgs, { encoding: "utf-8" });
+    if (r.error) return { pids: [], ran: false };
+    return { pids: r.status === 0 ? parsePidLines(r.stdout) : [], ran: r.status === 0 || r.status === 1 };
+  } catch {
+    return { pids: [], ran: false };
   }
-  return [...all];
 }
 function run(cmd) {
   try {
@@ -1651,15 +2175,18 @@ function run(cmd) {
   }
 }
 function runPowershell(script) {
+  return runPowershellChecked(script).pids;
+}
+function runPowershellChecked(script) {
   const exe = pwshOrPowershell();
   try {
     const r = spawnSync(exe, ["-NoProfile", "-NonInteractive", "-Command", script], {
       encoding: "utf-8"
     });
-    if (r.status !== 0) return [];
-    return parsePidLines(r.stdout);
+    if (r.error) return { pids: [], ran: false };
+    return { pids: r.status === 0 ? parsePidLines(r.stdout) : [], ran: r.status === 0 };
   } catch {
-    return [];
+    return { pids: [], ran: false };
   }
 }
 function pwshOrPowershell() {
@@ -1738,6 +2265,7 @@ var test_default = defineCommand5({
     },
     env: {
       type: "string",
+      alias: "e",
       description: "wrangler.toml [env.<name>] block to test (uses secrets config <name> by default).",
       required: false
     }
@@ -1773,8 +2301,8 @@ var test_default = defineCommand5({
       token = await ensureToken();
       const payload = decodeJwtPayload(token);
       ownerId = payload.sub;
-    } catch {
-      console.error("`deepspace test` requires you to be logged in. Run `deepspace login` first.");
+    } catch (err) {
+      console.error(err instanceof Error ? err.message : "Not logged in. Run `deepspace login` first.");
       process.exit(1);
     }
     let generatedSecretsCache;
@@ -1935,7 +2463,7 @@ var screenshot_default = defineCommand6({
 // src/cli/commands/test-accounts.ts
 import { defineCommand as defineCommand7 } from "citty";
 import * as p3 from "@clack/prompts";
-import { readFileSync as readFileSync8, writeFileSync as writeFileSync8, existsSync as existsSync9, mkdirSync as mkdirSync4 } from "fs";
+import { readFileSync as readFileSync10, writeFileSync as writeFileSync8, existsSync as existsSync9, mkdirSync as mkdirSync4 } from "fs";
 import { join as join10 } from "path";
 import { homedir as homedir4 } from "os";
 var SESSION_COOKIE2 = "__Secure-better-auth.session_token";
@@ -1945,7 +2473,7 @@ var ACCOUNTS_PATH = join10(DIR3, "test-accounts.json");
 function loadAccounts() {
   if (!existsSync9(ACCOUNTS_PATH)) return [];
   try {
-    return JSON.parse(readFileSync8(ACCOUNTS_PATH, "utf-8"));
+    return JSON.parse(readFileSync10(ACCOUNTS_PATH, "utf-8"));
   } catch {
     return [];
   }
@@ -1955,7 +2483,7 @@ function saveAccounts(accounts) {
   writeFileSync8(ACCOUNTS_PATH, JSON.stringify(accounts, null, 2), { mode: 384 });
 }
 function sessionCookie() {
-  const token = readFileSync8(SESSION_PATH2, "utf-8").trim();
+  const token = readFileSync10(SESSION_PATH2, "utf-8").trim();
   return `${SESSION_COOKIE2}=${encodeURIComponent(token)}`;
 }
 async function fetchRemoteAccounts() {
@@ -2225,214 +2753,10 @@ var test_accounts_default = defineCommand7({
 import { defineCommand as defineCommand8 } from "citty";
 import { execSync as execSync2 } from "child_process";
 import { randomUUID } from "crypto";
-import { readFileSync as readFileSync9, readdirSync as readdirSync3, existsSync as existsSync10, writeFileSync as writeFileSync9 } from "fs";
+import { readFileSync as readFileSync11, readdirSync as readdirSync4, existsSync as existsSync10 } from "fs";
 import { join as join11, resolve as resolve7, dirname as dirname2 } from "path";
 import { pathToFileURL } from "url";
 import * as p4 from "@clack/prompts";
-
-// src/server/rooms/binding-manifest.ts
-var AUTO_PROVISION_SENTINEL = "auto";
-var VECTORIZE_METRICS = /* @__PURE__ */ new Set(["cosine", "euclidean", "dot-product"]);
-var ALLOWED_BINDING_TYPES = /* @__PURE__ */ new Set([
-  "vectorize",
-  "ai",
-  "r2_bucket",
-  "kv_namespace",
-  "d1",
-  "queue",
-  "browser_rendering",
-  "analytics_engine",
-  "hyperdrive"
-]);
-var RESERVED_BINDING_NAMES = /* @__PURE__ */ new Set([
-  "ASSETS",
-  "PLATFORM_WORKER",
-  "API_WORKER",
-  "APP_NAME",
-  "OWNER_USER_ID",
-  "AUTH_JWT_PUBLIC_KEY",
-  "AUTH_JWT_ISSUER",
-  "AUTH_WORKER_URL",
-  "APP_IDENTITY_TOKEN",
-  "APP_OWNER_JWT",
-  "USAGE_EVENTS"
-]);
-function validateBindingManifest(manifest) {
-  if (!Array.isArray(manifest)) {
-    return { valid: false, errors: [{ reason: "Manifest must be an array" }] };
-  }
-  const errors = [];
-  const seenNames = /* @__PURE__ */ new Set();
-  for (const entry of manifest) {
-    if (!entry || typeof entry !== "object") {
-      errors.push({ reason: `Entry must be an object (got ${entry === null ? "null" : typeof entry})` });
-      continue;
-    }
-    const e = entry;
-    const type = e.type;
-    const name = e.name;
-    if (typeof type !== "string" || !ALLOWED_BINDING_TYPES.has(type)) {
-      errors.push({
-        reason: `Disallowed binding type: ${typeof type === "string" ? type : `(${typeof type})`}. Allowed: ${[...ALLOWED_BINDING_TYPES].sort().join(", ")}`
-      });
-      continue;
-    }
-    if (typeof name !== "string" || !name) {
-      errors.push({ reason: `Binding of type "${type}" missing 'name' (string)` });
-      continue;
-    }
-    if (RESERVED_BINDING_NAMES.has(name)) {
-      errors.push({ reason: `Binding name "${name}" is reserved by the SDK` });
-      continue;
-    }
-    if (seenNames.has(name)) {
-      errors.push({ reason: `Duplicate binding name "${name}"` });
-      continue;
-    }
-    seenNames.add(name);
-    const binding = entry;
-    const fieldErr = requiredFieldError(binding);
-    if (fieldErr) errors.push({ binding, reason: fieldErr });
-  }
-  if (errors.length) return { valid: false, errors };
-  return { valid: true, bindings: manifest };
-}
-function requiredFieldError(b) {
-  switch (b.type) {
-    case "vectorize": {
-      if (!b.index_name) return `vectorize binding "${b.name}" missing index_name (or "auto")`;
-      if (b.index_name === AUTO_PROVISION_SENTINEL) {
-        if (typeof b.dimensions !== "number" || b.dimensions <= 0) {
-          return `vectorize binding "${b.name}" with index_name="auto" requires "dimensions" (positive number)`;
-        }
-        if (!b.metric || !VECTORIZE_METRICS.has(b.metric)) {
-          return `vectorize binding "${b.name}" with index_name="auto" requires "metric" (one of: ${[...VECTORIZE_METRICS].join(", ")})`;
-        }
-      }
-      return null;
-    }
-    case "r2_bucket":
-      return b.bucket_name ? null : `r2_bucket binding "${b.name}" missing bucket_name (or "auto")`;
-    case "kv_namespace": {
-      if (!b.namespace_id) return `kv_namespace binding "${b.name}" missing namespace_id (or "auto")`;
-      if (b.namespace_id === AUTO_PROVISION_SENTINEL && !b.title) {
-        return `kv_namespace binding "${b.name}" with namespace_id="auto" requires "title"`;
-      }
-      return null;
-    }
-    case "d1": {
-      if (!b.id) return `d1 binding "${b.name}" missing id (or "auto")`;
-      if (b.id === AUTO_PROVISION_SENTINEL && !b.database_name) {
-        return `d1 binding "${b.name}" with id="auto" requires "database_name"`;
-      }
-      return null;
-    }
-    case "queue":
-      return b.queue_name ? null : `queue binding "${b.name}" missing queue_name (or "auto")`;
-    case "hyperdrive":
-      if (!b.id) return `hyperdrive binding "${b.name}" missing id`;
-      if (b.id === AUTO_PROVISION_SENTINEL) {
-        return `hyperdrive binding "${b.name}": auto-provisioning not yet supported (provide a real id)`;
-      }
-      return null;
-    case "ai":
-    case "browser_rendering":
-    case "analytics_engine":
-      return null;
-    // no required fields beyond `name`
-    default: {
-      const _exhaustive = b;
-      void _exhaustive;
-      return null;
-    }
-  }
-}
-function bindingManifestFromOutputConfig(outputConfig) {
-  const out = [];
-  const aiBinding = pluckString(outputConfig.ai, "binding");
-  if (aiBinding) out.push({ type: "ai", name: aiBinding });
-  for (const v of asObjectArray(outputConfig.vectorize)) {
-    const name = pluckString(v, "binding");
-    const index_name = pluckString(v, "index_name");
-    if (!name || !index_name) continue;
-    const dimensions = pluckNumber(v, "dimensions");
-    const metric = pluckString(v, "metric");
-    out.push({
-      type: "vectorize",
-      name,
-      index_name,
-      ...dimensions != null && { dimensions },
-      ...metric && (metric === "cosine" || metric === "euclidean" || metric === "dot-product") && { metric }
-    });
-  }
-  for (const r of asObjectArray(outputConfig.r2_buckets)) {
-    const name = pluckString(r, "binding");
-    const bucket_name = pluckString(r, "bucket_name");
-    if (name && bucket_name) out.push({ type: "r2_bucket", name, bucket_name });
-  }
-  for (const k of asObjectArray(outputConfig.kv_namespaces)) {
-    const name = pluckString(k, "binding");
-    const namespace_id = pluckString(k, "id");
-    if (!name || !namespace_id) continue;
-    const title = pluckString(k, "title");
-    out.push({
-      type: "kv_namespace",
-      name,
-      namespace_id,
-      ...title && { title }
-    });
-  }
-  for (const d of asObjectArray(outputConfig.d1_databases)) {
-    const name = pluckString(d, "binding");
-    const id = pluckString(d, "database_id");
-    if (!name || !id) continue;
-    const database_name = pluckString(d, "database_name");
-    out.push({
-      type: "d1",
-      name,
-      id,
-      ...database_name && { database_name }
-    });
-  }
-  const queues = isObject(outputConfig.queues) ? outputConfig.queues : null;
-  for (const q of asObjectArray(queues?.producers)) {
-    const name = pluckString(q, "binding");
-    const queue_name = pluckString(q, "queue");
-    if (name && queue_name) out.push({ type: "queue", name, queue_name });
-  }
-  const browserBinding = pluckString(outputConfig.browser, "binding");
-  if (browserBinding) out.push({ type: "browser_rendering", name: browserBinding });
-  for (const a of asObjectArray(outputConfig.analytics_engine_datasets)) {
-    const name = pluckString(a, "binding");
-    const dataset = pluckString(a, "dataset");
-    if (name) out.push({ type: "analytics_engine", name, dataset: dataset ?? void 0 });
-  }
-  for (const h of asObjectArray(outputConfig.hyperdrive)) {
-    const name = pluckString(h, "binding");
-    const id = pluckString(h, "id");
-    if (name && id) out.push({ type: "hyperdrive", name, id });
-  }
-  return out;
-}
-function isObject(v) {
-  return v !== null && typeof v === "object" && !Array.isArray(v);
-}
-function pluckString(v, key) {
-  if (!isObject(v)) return null;
-  const val = v[key];
-  return typeof val === "string" && val.length > 0 ? val : null;
-}
-function pluckNumber(v, key) {
-  if (!isObject(v)) return null;
-  const val = v[key];
-  return typeof val === "number" && Number.isFinite(val) ? val : null;
-}
-function asObjectArray(v) {
-  if (!Array.isArray(v)) return [];
-  return v.filter(isObject);
-}
-
-// src/cli/commands/deploy.ts
 var DEPLOY_URL3 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 var API_URL2 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
 var CLOUDFLARE_DEPLOY_ERROR_HINT = "Deployment reached the DeepSpace deploy worker, but Cloudflare's deployment control-plane API failed. This is often caused by a Cloudflare Dashboard/API incident or Workers for Platforms entitlement outage. Already deployed apps should keep serving; wait for Cloudflare to recover and retry.";
@@ -2486,6 +2810,13 @@ var GROUP_BYTES = (() => {
   const v = Number.isInteger(raw) && raw > 0 ? raw : 3 * 1024 * 1024;
   return Math.min(v, MAX_GROUP_BYTES);
 })();
+function classifyDevVarsSecrets(opts) {
+  const store = new Set(opts.storeSecretNames);
+  const strayKeys = opts.handEditedDevVarKeys.filter((k) => !store.has(k));
+  if (strayKeys.length === 0) return { kind: "ok" };
+  if (opts.storeSecretNames.length === 0 && !opts.allowMissing) return { kind: "block", strayKeys };
+  return { kind: "warn", strayKeys };
+}
 function packAssetGroups(assets, maxBytes) {
   const groups = [];
   let current = [];
@@ -2549,6 +2880,7 @@ var deploy_default = defineCommand8({
     },
     env: {
       type: "string",
+      alias: "e",
       description: "wrangler.toml [env.<name>] block to deploy (e.g. --env staging). Omit to deploy the top-level config.",
       required: false
     },
@@ -2556,6 +2888,11 @@ var deploy_default = defineCommand8({
       type: "boolean",
       description: "Confirm that a changed wrangler `name` renames this app (its URL moves; data, secrets, and collaborators travel). Without this flag an interactive prompt asks.",
       default: false
+    },
+    "allow-missing-secrets": {
+      type: "boolean",
+      description: "Deploy even though hand-edited .dev.vars secrets are absent from the store (they will NOT be deployed, and any a previous deploy set are dropped).",
+      default: false
     }
   },
   async run({ args }) {
@@ -2603,11 +2940,26 @@ var deploy_default = defineCommand8({
       );
     }
     p4.log.info(`Id: ${appId}`);
+    const readCustomDevVarsAt = (path) => {
+      if (!existsSync10(path)) return {};
+      const section = extractCustomDevVars(stripGeneratedSecretsCache(readFileSync11(path, "utf-8")));
+      if (!section) return {};
+      try {
+        return parseDevVars(section);
+      } catch (err) {
+        p4.cancel(`.dev.vars: ${errMessage(err)}`);
+        process.exit(1);
+      }
+    };
     let linkedSecrets = null;
+    let localOnlyDevVars = {};
     try {
       const refreshed = await refreshSecretsCache(DEPLOY_URL3, token, appId, envName);
       if (refreshed) {
         linkedSecrets = refreshed.pulled;
+        localOnlyDevVars = readCustomDevVarsAt(
+          devVarsPathFor(appDir, envName, { sharedDevVarsCache: true })
+        );
         await writeDevVars(appDir, ownerId, token, envName, {
           appId,
           generatedSecretsCache: refreshed.rendered,
@@ -2616,7 +2968,14 @@ var deploy_default = defineCommand8({
         p4.log.info(refreshed.summary);
       }
     } catch (err) {
-      p4.cancel(`Failed to refresh app secrets before deploy: ${errMessage(err)}`);
+      const msg = errMessage(err);
+      if (err?.status === 403) {
+        p4.cancel(
+          "You're not authorized to deploy this app \u2014 you must be its owner or a current collaborator. If you were a collaborator, your access may have been revoked."
+        );
+      } else {
+        p4.cancel(`Failed to refresh app secrets before deploy: ${msg}`);
+      }
       process.exit(1);
     }
     const junk = removeMacosJunk(appDir);
@@ -2648,13 +3007,13 @@ var deploy_default = defineCommand8({
       p4.cancel("Build output config not found at .wrangler/deploy/config.json");
       process.exit(1);
     }
-    const deployConfig = JSON.parse(readFileSync9(deployConfigPath, "utf-8"));
+    const deployConfig = JSON.parse(readFileSync11(deployConfigPath, "utf-8"));
     const outputWranglerPath = resolve7(dirname2(deployConfigPath), deployConfig.configPath);
     if (!existsSync10(outputWranglerPath)) {
       p4.cancel(`Output wrangler.json not found at ${outputWranglerPath}`);
       process.exit(1);
     }
-    const outputConfig = JSON.parse(readFileSync9(outputWranglerPath, "utf-8"));
+    const outputConfig = JSON.parse(readFileSync11(outputWranglerPath, "utf-8"));
     if (outputConfig.name && outputConfig.name !== appName) {
       const envHint = envName ? ` (--env ${envName})` : "";
       p4.cancel(
@@ -2676,7 +3035,7 @@ var deploy_default = defineCommand8({
     s.start("Collecting assets...");
     const assets = collectAssets(clientDir);
     s.stop(`Collected ${assets.length} assets`);
-    const workerJs = readFileSync9(workerBundlePath, "utf-8");
+    const workerJs = readFileSync11(workerBundlePath, "utf-8");
     const doBindings = outputConfig.durable_objects?.bindings;
     const sqliteClasses = new Set(
       outputConfig.migrations?.flatMap(
@@ -2708,18 +3067,30 @@ var deploy_default = defineCommand8({
     const devVarsPath = devVarsPathFor(appDir, envName, {
       sharedDevVarsCache: linkedSecrets !== null
     });
-    let userSecrets = {};
-    if (existsSync10(devVarsPath)) {
-      const rawDevVars = readFileSync9(devVarsPath, "utf-8");
-      const customSection = extractCustomDevVars(rawDevVars);
-      if (customSection) {
-        try {
-          userSecrets = parseDevVars(customSection);
-        } catch (err) {
-          p4.cancel(`.dev.vars: ${errMessage(err)}`);
-          process.exit(1);
-        }
-      }
+    const userSecrets = linkedSecrets ? { ...linkedSecrets.values } : {};
+    const handEditedDevVars = linkedSecrets ? localOnlyDevVars : readCustomDevVarsAt(devVarsPath);
+    const secretsDecision = classifyDevVarsSecrets({
+      storeSecretNames: Object.keys(userSecrets),
+      handEditedDevVarKeys: Object.keys(handEditedDevVars),
+      allowMissing: Boolean(args["allow-missing-secrets"])
+    });
+    if (secretsDecision.kind === "block") {
+      const uploadCmd = envName ? `deepspace secrets upload .dev.vars -e ${envName}` : "deepspace secrets upload .dev.vars";
+      const keys = secretsDecision.strayKeys.join(", ");
+      p4.cancel(
+        `Refusing to deploy: the app store has no secrets, but .dev.vars has ${keys}.
+Deploying now would ship the app with no secrets \u2014 replacing any a previous deploy set (they would be dropped from production).
+Upload them to the store first:
+  ${uploadCmd}
+then redeploy. (Pass --allow-missing-secrets to deploy without them.)`
+      );
+      process.exit(1);
+    }
+    if (secretsDecision.kind === "warn") {
+      const stray = secretsDecision.strayKeys;
+      p4.log.warn(
+        `.dev.vars has ${stray.join(", ")} not in the app store \u2014 ${stray.length === 1 ? "it is" : "they are"} NOT deployed. \`.dev.vars\` is a local dev cache, not deploy config. Move ${stray.length === 1 ? "it" : "them"} into the store with \`deepspace secrets set KEY=value\` (or \`deepspace secrets upload .dev.vars\`), then redeploy.`
+      );
     }
     const userSecretNames = Object.keys(userSecrets);
     const declaredBindingNames = /* @__PURE__ */ new Set([
@@ -2729,22 +3100,19 @@ var deploy_default = defineCommand8({
     for (const name of userSecretNames) {
       if (RESERVED_BINDING_NAMES.has(name)) {
         p4.cancel(
-          `.dev.vars: "${name}" is a reserved binding name and cannot be used as an app secret.`
+          `App secret "${name}" is a reserved binding name \u2014 remove it with \`deepspace secrets delete ${name}\`.`
         );
         process.exit(1);
       }
       if (declaredBindingNames.has(name)) {
         p4.cancel(
-          `.dev.vars: "${name}" collides with a binding declared in wrangler.toml \u2014 rename one or the other.`
+          `App secret "${name}" collides with a binding declared in wrangler.toml \u2014 rename one or the other.`
         );
         process.exit(1);
       }
     }
     if (userSecretNames.length) {
-      p4.log.info(`App secrets (from .dev.vars): ${userSecretNames.join(", ")}`);
-      if (!linkedSecrets) {
-        p4.log.info("Not in the app store yet \u2014 migrating after this deploy.");
-      }
+      p4.log.info(`App secrets: ${userSecretNames.join(", ")}`);
     }
     s.start(`Deploying to ${appName}.app.space...`);
     const extraRoutes = extractRunWorkerFirst(wranglerConfig);
@@ -2819,6 +3187,7 @@ var deploy_default = defineCommand8({
       if (userSecretNames.length) {
         form.append("userSecrets", JSON.stringify(userSecrets));
       }
+      form.append("secretsAuthoritative", "true");
       if (extraRoutes.length) {
         form.append("extraRunWorkerFirst", JSON.stringify(extraRoutes));
       }
@@ -2848,6 +3217,12 @@ var deploy_default = defineCommand8({
     let body = await res.json().catch(() => ({}));
     if (res.status === 409 && body.code === "rename_required" && !confirmRename) {
       s.stop("Rename confirmation needed");
+      if (!process.stdin.isTTY) {
+        await bailDeploy(
+          `This deploy renames the app: ${body.fromHost} \u2192 ${body.toHost}. Confirmation needs an interactive terminal \u2014 re-run with --rename to approve the rename, or \`deepspace init --new-id\` if you meant a separate app.`,
+          null
+        );
+      }
       const yes = await p4.confirm({
         message: `This deploy renames the app: ${body.fromHost} \u2192 ${body.toHost}. The URL changes and the old one stops serving right away; data, secrets, and collaborators travel with it. (Meant a separate app? Run \`deepspace init --new-id\` instead.) Rename?`
       });
@@ -2874,16 +3249,6 @@ var deploy_default = defineCommand8({
           "First requests may briefly hit the assets transitional page; retry in a minute."
         );
         p4.log.success(`Live at: ${body.url}`);
-        await migrateLegacyDevVarsSecrets({
-          deployUrl: DEPLOY_URL3,
-          token,
-          appId,
-          envName,
-          devVarsPath,
-          userSecrets,
-          userSecretNames,
-          hadStore: linkedSecrets !== null
-        });
         await syncSubscriptionPlans(appDir, appId, token);
         await syncOneTimeProducts(appDir, appId, token);
         p4.outro("Done");
@@ -2892,41 +3257,11 @@ var deploy_default = defineCommand8({
     }
     s.stop("Deployed!");
     p4.log.success(`Live at: ${body.url}`);
-    await migrateLegacyDevVarsSecrets({
-      deployUrl: DEPLOY_URL3,
-      token,
-      appId,
-      envName,
-      devVarsPath,
-      userSecrets,
-      userSecretNames,
-      hadStore: linkedSecrets !== null
-    });
     await syncSubscriptionPlans(appDir, appId, token);
     await syncOneTimeProducts(appDir, appId, token);
     p4.outro("Done");
   }
 });
-async function migrateLegacyDevVarsSecrets(opts) {
-  const { deployUrl, token, appId, envName, devVarsPath, userSecrets, userSecretNames, hadStore } = opts;
-  if (hadStore || userSecretNames.length === 0) return;
-  const configName = defaultConfigNameForEnv(envName);
-  try {
-    await uploadSecrets(deployUrl, token, appId, configName, userSecrets, false);
-    if (existsSync10(devVarsPath)) {
-      const cleaned = removeDevVarsKeys(readFileSync9(devVarsPath, "utf-8"), new Set(userSecretNames));
-      writeFileSync9(devVarsPath, cleaned.endsWith("\n") ? cleaned : `${cleaned}
-`);
-    }
-    p4.log.success(
-      `Migrated ${userSecretNames.length} secret${userSecretNames.length === 1 ? "" : "s"} from .dev.vars into the app store (config ${configName}) \u2014 now managed by \`deepspace secrets\`.`
-    );
-  } catch (err) {
-    p4.log.warn(
-      `Couldn't migrate .dev.vars secrets into the app store (${errMessage(err)}); they deployed as bindings for now and the next deploy will retry.`
-    );
-  }
-}
 async function syncSubscriptionPlans(appDir, appName, token) {
   const subsPath = join11(appDir, "src", "subscriptions.ts");
   if (!existsSync10(subsPath)) return;
@@ -3155,7 +3490,7 @@ async function waitForAssetsReady(url, timeoutMs) {
 function collectAssets(dir) {
   const assets = [];
   function walk(d, prefix) {
-    for (const entry of readdirSync3(d, { withFileTypes: true })) {
+    for (const entry of readdirSync4(d, { withFileTypes: true })) {
       if (entry.name === ".assetsignore") continue;
       const full = join11(d, entry.name);
       const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
@@ -3164,7 +3499,7 @@ function collectAssets(dir) {
       } else {
         assets.push({
           path: "/" + rel,
-          contentBase64: readFileSync9(full).toString("base64")
+          contentBase64: readFileSync11(full).toString("base64")
         });
       }
     }
@@ -3185,7 +3520,7 @@ var undeploy_default = defineCommand9({
   args: {
     name: {
       type: "positional",
-      description: "App id to undeploy (reads DEEPSPACE_APP_ID from wrangler.toml if omitted)",
+      description: "App id or subdomain name to undeploy (reads DEEPSPACE_APP_ID from wrangler.toml if omitted)",
       required: false
     },
     env: {
@@ -3196,18 +3531,6 @@ var undeploy_default = defineCommand9({
   },
   async run({ args }) {
     const envName = typeof args.env === "string" && args.env.trim() ? args.env.trim() : void 0;
-    let appId = args.name;
-    if (appId && !APP_ID_RE.test(appId)) {
-      p5.cancel(`"${appId}" is not an app id (app_\u2026). Undeploy targets the id \u2014 run from the app directory, or find it in wrangler.toml.`);
-      process.exit(1);
-    }
-    if (!appId && hasWranglerConfig(process.cwd())) {
-      appId = readAppId(process.cwd(), envName) ?? void 0;
-    }
-    if (!appId) {
-      p5.cancel("Provide an app id or run from a DeepSpace app directory with a DEEPSPACE_APP_ID.");
-      process.exit(1);
-    }
     let token;
     try {
       token = await ensureToken();
@@ -3215,6 +3538,22 @@ var undeploy_default = defineCommand9({
       p5.cancel(err instanceof Error ? err.message : String(err));
       process.exit(1);
     }
+    let appId;
+    const positional = typeof args.name === "string" && args.name.trim() ? args.name.trim() : void 0;
+    if (positional) {
+      try {
+        appId = await resolveAppSelector(DEPLOY_URL4, token, positional);
+      } catch (err) {
+        p5.cancel(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+      }
+    } else if (hasWranglerConfig(process.cwd())) {
+      appId = readAppId(process.cwd(), envName) ?? void 0;
+    }
+    if (!appId) {
+      p5.cancel("Provide an app id or subdomain name, or run from a DeepSpace app directory with a DEEPSPACE_APP_ID.");
+      process.exit(1);
+    }
     p5.intro(`Undeploying ${appId}`);
     const s = createSpinner();
     s.start("Removing...");
@@ -3251,24 +3590,28 @@ var whoami_default = defineCommand10({
     }
   },
   async run({ args }) {
+    const failLoggedOut = (msg) => {
+      if (args.json) console.log(JSON.stringify({ loggedIn: false, error: msg }));
+      else console.error(msg);
+      process.exit(1);
+    };
     let jwt;
     try {
       jwt = await ensureToken();
     } catch (err) {
-      console.error(err instanceof Error ? err.message : "Not signed in. Run `deepspace login`.");
-      process.exit(1);
+      failLoggedOut(err instanceof Error ? err.message : "Not logged in. Run `deepspace login` first.");
     }
     let payload;
     try {
       payload = decodeJwtPayload(jwt);
     } catch {
-      console.error("Malformed session token. Run `deepspace login` again.");
-      process.exit(1);
+      failLoggedOut("Malformed session token. Run `deepspace login` again.");
     }
     const isTestAccount = !!payload.email?.endsWith("@deepspace.test");
     const accountType = isTestAccount ? "test-account" : payload.email ? "developer" : "unknown";
     if (args.json) {
       console.log(JSON.stringify({
+        loggedIn: true,
         name: payload.name ?? null,
         email: payload.email ?? null,
         userId: payload.sub ?? null,
@@ -3292,11 +3635,48 @@ var whoami_default = defineCommand10({
   }
 });
 
-// src/cli/commands/add.ts
+// src/cli/commands/apps.ts
 import { defineCommand as defineCommand11 } from "citty";
-import { existsSync as existsSync11 } from "fs";
-import { resolve as resolve8, join as join12 } from "path";
-import { execSync as execSync3 } from "child_process";
+var DEPLOY_URL5 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
+var apps_default = defineCommand11({
+  meta: {
+    name: "apps",
+    description: "List your apps (deployed and registered)"
+  },
+  args: {
+    json: {
+      type: "boolean",
+      description: "Emit JSON instead of human output",
+      default: false
+    }
+  },
+  async run({ args }) {
+    const token = await ensureToken();
+    const { apps } = await apiFetch(DEPLOY_URL5, token, "/api/apps");
+    if (args.json) {
+      process.stdout.write(JSON.stringify(apps, null, 2) + "\n");
+      return;
+    }
+    if (!apps.length) {
+      console.log("No apps yet. Create one with `npx create-deepspace <name>` and `deepspace deploy`.");
+      return;
+    }
+    const nameWidth = Math.max(4, ...apps.map((a) => (a.name ?? "\u2014").length));
+    const idWidth = Math.max(6, ...apps.map((a) => a.appId.length));
+    console.log(`${"NAME".padEnd(nameWidth)}  ${"APP ID".padEnd(idWidth)}  URL`);
+    for (const a of apps) {
+      const url = a.url ?? "(not deployed)";
+      console.log(`${(a.name ?? "\u2014").padEnd(nameWidth)}  ${a.appId.padEnd(idWidth)}  ${url}`);
+    }
+  }
+});
+
+// src/cli/commands/add.ts
+import { defineCommand as defineCommand12 } from "citty";
+import { existsSync as existsSync11, readFileSync as readFileSync12 } from "fs";
+import { resolve as resolve8, join as join12, dirname as dirname3 } from "path";
+import { fileURLToPath } from "url";
+import { spawnSync as spawnSync5 } from "child_process";
 function findScript(from) {
   const inNodeModules = join12(from, "node_modules", "deepspace", "scripts", "add-feature.cjs");
   if (existsSync11(inNodeModules)) return inNodeModules;
@@ -3304,7 +3684,31 @@ function findScript(from) {
   if (existsSync11(inDotDeepspace)) return inDotDeepspace;
   return null;
 }
-var add_default = defineCommand11({
+function runningScript() {
+  const here = dirname3(fileURLToPath(import.meta.url));
+  const script = join12(here, "..", "scripts", "add-feature.cjs");
+  return existsSync11(script) ? script : null;
+}
+function isDeepSpaceApp(dir) {
+  if (existsSync11(join12(dir, "wrangler.toml"))) return true;
+  const pkgPath = join12(dir, "package.json");
+  if (!existsSync11(pkgPath)) return false;
+  try {
+    const pkg2 = JSON.parse(readFileSync12(pkgPath, "utf-8"));
+    return Boolean(pkg2.dependencies?.deepspace || pkg2.devDependencies?.deepspace);
+  } catch {
+    return false;
+  }
+}
+function runInstaller(script, passArgs, cwd) {
+  const res = spawnSync5(process.execPath, [script, ...passArgs], { stdio: "inherit", cwd });
+  if (res.error) {
+    console.error(`Could not run the feature installer: ${res.error.message}`);
+    process.exit(1);
+  }
+  process.exit(res.status ?? 1);
+}
+var add_default = defineCommand12({
   meta: {
     name: "add",
     description: "Add a feature to your DeepSpace app"
@@ -3321,6 +3725,11 @@ var add_default = defineCommand11({
       description: "Show details about a feature",
       required: false
     },
+    install: {
+      type: "boolean",
+      description: "Run your package manager after adding dependencies",
+      required: false
+    },
     feature: {
       type: "positional",
       description: "Feature to install",
@@ -3334,6 +3743,27 @@ var add_default = defineCommand11({
   },
   run({ args }) {
     const appDir = resolve8(args.dir ?? ".");
+    if (args.list || args.info || !args.feature) {
+      const script2 = runningScript();
+      if (!script2) {
+        console.error("Could not find the deepspace feature catalog.");
+        console.error("Reinstall deepspace (`npm i -g deepspace`) or run inside a DeepSpace app.");
+        process.exit(1);
+      }
+      const passArgs2 = args.list ? ["--list"] : args.info ? ["--info", String(args.info)] : ["--help"];
+      runInstaller(script2, passArgs2, process.cwd());
+    }
+    if (!existsSync11(appDir)) {
+      console.error(`Target directory not found: ${appDir}`);
+      console.error("Create a new app first: deepspace create <name>");
+      process.exit(1);
+    }
+    if (!isDeepSpaceApp(appDir)) {
+      console.error(`Not a DeepSpace app: ${appDir}`);
+      console.error('(no wrangler.toml and no "deepspace" dependency found)');
+      console.error("Create one with: deepspace create <name>");
+      process.exit(1);
+    }
     ensureInstallReady(appDir);
     const script = findScript(appDir);
     if (!script) {
@@ -3344,136 +3774,14 @@ var add_default = defineCommand11({
       console.error("Are you in a DeepSpace app directory? Try `npm install` first.");
       process.exit(1);
     }
-    const passArgs = [];
-    if (args.list) {
-      passArgs.push("--list");
-    } else if (args.info) {
-      passArgs.push("--info", args.info);
-    } else if (args.feature) {
-      passArgs.push(args.feature, appDir);
-    } else {
-      passArgs.push("--help");
-    }
-    execSync3(`node ${JSON.stringify(script)} ${passArgs.map((a) => JSON.stringify(a)).join(" ")}`, {
-      stdio: "inherit",
-      cwd: appDir
-    });
-  }
-});
-
-// src/cli/commands/skills.ts
-import { defineCommand as defineCommand12 } from "citty";
-import spawn2 from "cross-spawn";
-import { mkdirSync as mkdirSync5 } from "fs";
-import { join as join13 } from "path";
-import { homedir as homedir5 } from "os";
-var SKILL_REPO = "deepdotspace/deepspace-skill";
-function runSkillsAdd(extraArgs) {
-  return new Promise((resolve10) => {
-    const child = spawn2(
-      "npx",
-      ["-y", "skills@latest", "add", SKILL_REPO, ...extraArgs],
-      { stdio: "inherit" }
-    );
-    child.on("close", (code) => resolve10(code ?? 1));
-    child.on("error", (err) => {
-      console.error(`Failed to invoke npx: ${err.message}`);
-      console.error("Is Node.js installed and on PATH?");
-      resolve10(1);
-    });
-  });
-}
-function precreateClaudeDir(baseDir) {
-  mkdirSync5(join13(baseDir, ".claude"), { recursive: true });
-}
-var add = defineCommand12({
-  meta: {
-    name: "add",
-    description: "Install the DeepSpace skill for your coding agent"
-  },
-  args: {
-    global: {
-      type: "boolean",
-      alias: "g",
-      description: "Install globally (~/.agents/skills/) instead of into the current directory",
-      default: false
-    },
-    yes: {
-      type: "boolean",
-      alias: "y",
-      description: "Skip prompts (assume yes for any confirmation)",
-      default: false
-    },
-    agent: {
-      type: "string",
-      description: "Target a single agent (e.g. claude-code, codex, opencode). Default: install for all detected agents.",
-      required: false
-    }
-  },
-  async run({ args }) {
-    const extra = [];
-    if (args.global) extra.push("-g");
-    if (args.yes) extra.push("-y");
-    if (args.agent) extra.push("--agent", args.agent);
-    if (!args.agent || args.agent === "claude-code") {
-      const baseDir = args.global ? homedir5() : process.cwd();
-      try {
-        precreateClaudeDir(baseDir);
-      } catch (err) {
-        console.warn(`
-  Note: could not pre-create .claude/ for Claude Code: ${err instanceof Error ? err.message : String(err)}`);
-      }
-    }
-    const code = await runSkillsAdd(extra);
-    if (code !== 0) process.exit(code);
-  }
-});
-var skills_default = defineCommand12({
-  meta: {
-    name: "skills",
-    description: "Manage the DeepSpace agent skill (Claude Code, Codex, OpenCode, Cursor, ...)"
-  },
-  subCommands: {
-    add
+    const passArgs = [args.feature, appDir];
+    if (args.install) passArgs.push("--install");
+    runInstaller(script, passArgs, appDir);
   }
 });
 
 // src/cli/commands/domain.ts
 import { defineCommand as defineCommand13 } from "citty";
-
-// src/cli/lib/api.ts
-var ApiError = class extends Error {
-  constructor(message, status3, code) {
-    super(message);
-    this.status = status3;
-    this.code = code;
-  }
-};
-async function apiFetch(baseUrl, token, path, init) {
-  const res = await fetch(`${baseUrl}${path}`, {
-    ...init,
-    headers: {
-      Authorization: `Bearer ${token}`,
-      "Content-Type": "application/json",
-      ...init?.headers ?? {}
-    }
-  });
-  const text2 = await res.text();
-  if (!res.ok) {
-    let msg = text2;
-    let code;
-    try {
-      const body = JSON.parse(text2);
-      msg = body.error ?? text2;
-      code = body.code;
-    } catch {
-    }
-    throw new ApiError(`API ${path} (${res.status}): ${msg}`, res.status, code);
-  }
-  return text2 ? JSON.parse(text2) : {};
-}
-
-// src/cli/commands/domain.ts
 var API_URL3 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
 var api = (token, path, init) => apiFetch(API_URL3, token, path, init);
 function scrubInternal(value) {
@@ -3810,18 +4118,19 @@ function isTestAccountEmail(email) {
 
 // src/cli/commands/collaborators.ts
 var API_URL4 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
+var DEPLOY_URL6 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 function api2(token, path, init) {
   return apiFetch(API_URL4, token, path, init);
 }
 var list3 = defineCommand14({
   meta: { name: "list", description: "List collaborators on your app" },
   args: {
-    app: { type: "string", alias: "a", description: "App id (defaults to ./wrangler.toml)" },
+    app: { type: "string", alias: "a", description: "App id or name (defaults to ./wrangler.toml)" },
     json: { type: "boolean", description: "Emit JSON" }
   },
   async run({ args }) {
     const token = await ensureToken();
-    const app = requireAppIdArg(args.app);
+    const app = await resolveAppTarget(DEPLOY_URL6, token, args.app);
     const { collaborators } = await api2(
       token,
       `/api/app-collaborators/${encodeURIComponent(app)}`
@@ -3834,12 +4143,13 @@ var list3 = defineCommand14({
       console.log(`No collaborators on ${app}. Add one with \`deepspace collaborators add <email>\`.`);
       return;
     }
+    console.log(`COLLABORATORS ON ${app}`);
     for (const c of collaborators) {
-      console.log(`${c.emailDisplay.padEnd(32)} ${c.userId}`);
+      console.log(`  ${c.emailDisplay}`);
     }
   }
 });
-var add2 = defineCommand14({
+var add = defineCommand14({
   meta: { name: "add", description: "Authorize a DeepSpace user to deploy your app" },
   args: {
     email: {
@@ -3847,12 +4157,12 @@ var add2 = defineCommand14({
       description: "Collaborator email (must already be a DeepSpace user)",
       required: true
     },
-    app: { type: "string", alias: "a", description: "App id (defaults to ./wrangler.toml)" },
+    app: { type: "string", alias: "a", description: "App id or name (defaults to ./wrangler.toml)" },
     json: { type: "boolean", description: "Emit JSON" }
   },
   async run({ args }) {
     const token = await ensureToken();
-    const app = requireAppIdArg(args.app);
+    const app = await resolveAppTarget(DEPLOY_URL6, token, args.app);
     if (isTestAccountEmail(args.email)) {
       console.error(
         "Test accounts (@deepspace.test) cannot be added as collaborators. Use a real DeepSpace account."
@@ -3875,12 +4185,12 @@ var remove = defineCommand14({
   meta: { name: "remove", description: "Remove a collaborator from your app" },
   args: {
     email: { type: "positional", description: "Collaborator email", required: true },
-    app: { type: "string", alias: "a", description: "App id (defaults to ./wrangler.toml)" },
+    app: { type: "string", alias: "a", description: "App id or name (defaults to ./wrangler.toml)" },
     json: { type: "boolean", description: "Emit JSON" }
   },
   async run({ args }) {
     const token = await ensureToken();
-    const app = requireAppIdArg(args.app);
+    const app = await resolveAppTarget(DEPLOY_URL6, token, args.app);
     const { collaborators } = await api2(
       token,
       `/api/app-collaborators/${encodeURIComponent(app)}`
@@ -3905,28 +4215,57 @@ var remove = defineCommand14({
 });
 var collaborators_default = defineCommand14({
   meta: { name: "collaborators", description: "Manage who can deploy your app" },
-  subCommands: { list: list3, add: add2, remove }
+  subCommands: { list: list3, add, remove }
 });
 
 // src/cli/commands/transfer.ts
 import { defineCommand as defineCommand15 } from "citty";
+import * as p6 from "@clack/prompts";
 var API_URL5 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
-var DEPLOY_URL5 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
+var DEPLOY_URL7 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 var offer = defineCommand15({
   meta: { name: "offer", description: "Offer this app to another DeepSpace user" },
   args: {
     email: { type: "positional", description: "Recipient email", required: true },
-    app: { type: "string", alias: "a", description: "App id (defaults to ./wrangler.toml)" }
+    app: { type: "string", alias: "a", description: "App id or name (defaults to ./wrangler.toml)" },
+    replace: {
+      type: "boolean",
+      description: "Replace a pending offer to someone else without asking"
+    }
   },
   async run({ args }) {
     const token = await ensureToken();
-    const app = requireAppIdArg(args.app);
+    const app = await resolveAppTarget(DEPLOY_URL7, token, args.app);
+    const pending = await apiFetch(
+      API_URL5,
+      token,
+      `/api/app-transfers/${encodeURIComponent(app)}`
+    );
+    const pendingTo = pending.transfer?.toEmailDisplay;
+    if (pendingTo && pendingTo.toLowerCase() !== args.email.trim().toLowerCase() && !args.replace) {
+      if (!process.stdin.isTTY) {
+        console.error(
+          `A pending offer to ${pendingTo} already exists for ${app}. Re-run with --replace to replace it, or \`deepspace transfer cancel\` first.`
+        );
+        process.exit(1);
+      }
+      const yes = await p6.confirm({
+        message: `A pending offer to ${pendingTo} exists \u2014 replace it with ${args.email}?`
+      });
+      if (p6.isCancel(yes) || !yes) {
+        console.log(`Kept the pending offer to ${pendingTo}.`);
+        process.exit(1);
+      }
+    }
     const { expiresAt } = await apiFetch(
       API_URL5,
       token,
       `/api/app-transfers/${encodeURIComponent(app)}`,
       { method: "POST", body: JSON.stringify({ email: args.email }) }
     );
+    if (pendingTo && pendingTo.toLowerCase() !== args.email.trim().toLowerCase()) {
+      console.log(`\u25B2 Replaced the pending offer to ${pendingTo}.`);
+    }
     console.log(
       `\u2713 Offered ${app} to ${args.email} (expires ${expiresAt}).
   They accept with: deepspace transfer accept --app ${app}`
@@ -3936,11 +4275,11 @@ var offer = defineCommand15({
 var status2 = defineCommand15({
   meta: { name: "status", description: "Show the pending transfer offer, if any" },
   args: {
-    app: { type: "string", alias: "a", description: "App id (defaults to ./wrangler.toml)" }
+    app: { type: "string", alias: "a", description: "App id or name (defaults to ./wrangler.toml)" }
   },
   async run({ args }) {
     const token = await ensureToken();
-    const app = requireAppIdArg(args.app);
+    const app = await resolveAppTarget(DEPLOY_URL7, token, args.app);
     const { transfer } = await apiFetch(API_URL5, token, `/api/app-transfers/${encodeURIComponent(app)}`);
     if (!transfer) {
       console.log(`No pending transfer for ${app}.`);
@@ -3957,7 +4296,7 @@ var accept = defineCommand15({
   async run({ args }) {
     const token = await ensureToken();
     const app = requireAppIdArg(args.app);
-    await apiFetch(DEPLOY_URL5, token, `/api/apps/${encodeURIComponent(app)}/transfer/accept`, {
+    await apiFetch(DEPLOY_URL7, token, `/api/apps/${encodeURIComponent(app)}/transfer/accept`, {
       method: "POST"
     });
     console.log(
@@ -3968,11 +4307,11 @@ var accept = defineCommand15({
 var cancel4 = defineCommand15({
   meta: { name: "cancel", description: "Cancel/decline the pending offer (either party)" },
   args: {
-    app: { type: "string", alias: "a", description: "App id (defaults to ./wrangler.toml)" }
+    app: { type: "string", alias: "a", description: "App id or name (defaults to ./wrangler.toml)" }
   },
   async run({ args }) {
     const token = await ensureToken();
-    const app = requireAppIdArg(args.app);
+    const app = await resolveAppTarget(DEPLOY_URL7, token, args.app);
     await apiFetch(API_URL5, token, `/api/app-transfers/${encodeURIComponent(app)}`, { method: "DELETE" });
     console.log(`\u2713 Transfer offer for ${app} cancelled.`);
   }
@@ -3986,7 +4325,8 @@ var transfer_default = defineCommand15({
 import { defineCommand as defineCommand16 } from "citty";
 
 // src/cli/commands/_invoke-impl.ts
-import { readFileSync as readFileSync10 } from "fs";
+import { readFileSync as readFileSync13 } from "fs";
+import * as p7 from "@clack/prompts";
 var API_URL6 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
 var DEFAULT_TIMEOUT_MS = 12e4;
 function parseTarget(target) {
@@ -4011,7 +4351,7 @@ function resolveBody(opts) {
   if (opts.body != null) {
     raw = opts.body;
   } else if (opts.bodyFile != null) {
-    raw = opts.bodyFile === "-" ? readFileSync10(0, "utf-8") : readFileSync10(opts.bodyFile, "utf-8");
+    raw = opts.bodyFile === "-" ? readFileSync13(0, "utf-8") : readFileSync13(opts.bodyFile, "utf-8");
   } else {
     return "{}";
   }
@@ -4045,6 +4385,17 @@ function formatCurrency(value, currency) {
   if (currency === "USD") return `$${value}`;
   return `${value} ${currency}`;
 }
+function billingUnit(model) {
+  if (model === "per_token") return "per token";
+  if (model === "per_call") return "per call";
+  return model.startsWith("per_") ? model.replace(/^per_/, "per ").replace(/_/g, " ") : model;
+}
+function isInteractive(stdin, stdout) {
+  return Boolean(stdin.isTTY && stdout.isTTY);
+}
+function shouldConfirmCost(opts) {
+  return !opts.json && !opts.yes && opts.isTTY && opts.baseCost > 0;
+}
 async function runList(args) {
   const catalog = await fetchCatalog({ summary: true });
   if (args.json) {
@@ -4090,7 +4441,7 @@ async function runInfo(args) {
   }
   console.log(`${integration}/${endpoint}`);
   console.log(
-    `  billing: ${info2.billing.model}, ${formatCurrency(info2.billing.baseCost, info2.billing.currency)} per call`
+    `  billing: ${formatCurrency(info2.billing.baseCost, info2.billing.currency)} ${billingUnit(info2.billing.model)}`
   );
   console.log();
   console.log("Input schema:");
@@ -4105,6 +4456,31 @@ async function runInvoke(args) {
   const { integration, endpoint } = parseTarget(args.target);
   const body = resolveBody({ body: args.body, bodyFile: args.bodyFile });
   const timeoutMs = args.timeout ?? DEFAULT_TIMEOUT_MS;
+  const interactive = isInteractive(process.stdin, process.stdout);
+  if (!args.json && !args.yes && interactive) {
+    let info2 = null;
+    try {
+      info2 = findEndpoint(await fetchCatalog({ summary: true }), integration, endpoint);
+    } catch {
+      console.error("Note: could not verify the call cost; proceeding. Pass --yes to skip this check.");
+      info2 = null;
+    }
+    if (info2 && shouldConfirmCost({
+      json: !!args.json,
+      yes: !!args.yes,
+      isTTY: interactive,
+      baseCost: info2.billing.baseCost
+    })) {
+      const cost = formatCurrency(info2.billing.baseCost, info2.billing.currency);
+      const ok2 = await p7.confirm({
+        message: `${integration}/${endpoint} costs ${cost} ${billingUnit(info2.billing.model)}, billed to your account. Continue?`
+      });
+      if (p7.isCancel(ok2) || !ok2) {
+        p7.cancel("Cancelled \u2014 no call made.");
+        process.exit(0);
+      }
+    }
+  }
   let jwt;
   try {
     jwt = await ensureToken();
@@ -4247,6 +4623,12 @@ var invoke = defineCommand16({
       type: "string",
       description: "Request timeout in milliseconds (default: 120000)",
       required: false
+    },
+    yes: {
+      type: "boolean",
+      alias: "y",
+      description: "Skip the paid-call cost confirmation",
+      default: false
     }
   },
   async run({ args }) {
@@ -4260,7 +4642,8 @@ var invoke = defineCommand16({
         body: args.body,
         bodyFile: args["body-file"],
         json: args.json,
-        timeout
+        timeout,
+        yes: args.yes
       });
     } catch (err) {
       console.error(err instanceof Error ? err.message : String(err));
@@ -4324,6 +4707,12 @@ var invoke_default = defineCommand17({
       type: "string",
       description: "Request timeout in milliseconds (default: 120000)",
       required: false
+    },
+    yes: {
+      type: "boolean",
+      alias: "y",
+      description: "Skip the paid-call cost confirmation",
+      default: false
     }
   },
   async run({ args }) {
@@ -4345,7 +4734,8 @@ var invoke_default = defineCommand17({
         body: args.body,
         bodyFile: args["body-file"],
         json: args.json,
-        timeout
+        timeout,
+        yes: args.yes
       });
     } catch (err) {
       console.error(err instanceof Error ? err.message : String(err));
@@ -4356,10 +4746,10 @@ var invoke_default = defineCommand17({
 
 // src/cli/commands/library.ts
 import { defineCommand as defineCommand18 } from "citty";
-import { existsSync as existsSync12, readFileSync as readFileSync11 } from "fs";
-import { join as join14, resolve as resolve9 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync14 } from "fs";
+import { join as join13, resolve as resolve9 } from "path";
 import { parse as parseToml4 } from "smol-toml";
-import * as p6 from "@clack/prompts";
+import * as p8 from "@clack/prompts";
 var DEFAULT_LIBRARY_APP = "deepdotspace-site";
 var publish = defineCommand18({
   meta: {
@@ -4421,25 +4811,25 @@ var publish = defineCommand18({
   async run({ args }) {
     const json = !!args.json;
     const intro6 = (s) => {
-      if (!json) p6.intro(s);
+      if (!json) p8.intro(s);
     };
     const info2 = (s) => {
-      if (!json) p6.log.info(s);
+      if (!json) p8.log.info(s);
     };
     const die = (msg) => {
       if (json) console.error(JSON.stringify({ ok: false, error: msg }));
-      else p6.cancel(msg);
+      else p8.cancel(msg);
       process.exit(1);
     };
     intro6("Publishing to the DeepSpace library");
     let appName = typeof args.app === "string" && args.app.trim() ? args.app.trim() : void 0;
     if (!appName) {
       const appDir = resolve9(typeof args.dir === "string" && args.dir ? args.dir : ".");
-      const wranglerPath = join14(appDir, "wrangler.toml");
+      const wranglerPath = join13(appDir, "wrangler.toml");
       if (!existsSync12(wranglerPath)) {
         return die("No --app provided and no wrangler.toml found. Either pass --app <name> or run from your app's directory.");
       }
-      const cfg = parseToml4(readFileSync11(wranglerPath, "utf-8"));
+      const cfg = parseToml4(readFileSync14(wranglerPath, "utf-8"));
       const nameRes = resolveAppName(cfg.name);
       if (!nameRes.ok) return die(`wrangler.toml: ${nameRes.reason}`);
       appName = nameRes.name;
@@ -4495,9 +4885,9 @@ var publish = defineCommand18({
     if (!parsed.success) {
       return die(parsed.error ?? `Publish failed (HTTP ${res.status}).`);
     }
-    p6.log.success(`Published ${appName} as ${parsed.data?.templateHandle} (v${parsed.data?.version})`);
-    if (parsed.data?.url) p6.log.message(parsed.data.url);
-    p6.outro("Done");
+    p8.log.success(`Published ${appName} as ${parsed.data?.templateHandle} (v${parsed.data?.version})`);
+    if (parsed.data?.url) p8.log.message(parsed.data.url);
+    p8.outro("Done");
   }
 });
 var unpublish = defineCommand18({
@@ -4526,10 +4916,10 @@ var unpublish = defineCommand18({
     const json = !!args.json;
     const die = (msg) => {
       if (json) console.error(JSON.stringify({ ok: false, error: msg }));
-      else p6.cancel(msg);
+      else p8.cancel(msg);
       process.exit(1);
     };
-    if (!json) p6.intro("Unpublishing library entry");
+    if (!json) p8.intro("Unpublishing library entry");
     let token;
     try {
       token = await ensureToken();
@@ -4555,8 +4945,8 @@ var unpublish = defineCommand18({
       process.exit(parsed.success ? 0 : 1);
     }
     if (!parsed.success) return die(parsed.error ?? `HTTP ${res.status}`);
-    p6.log.success(`Unpublished ${parsed.data?.templateHandle}`);
-    p6.outro("Done");
+    p8.log.success(`Unpublished ${parsed.data?.templateHandle}`);
+    p8.outro("Done");
   }
 });
 var library_default = defineCommand18({
@@ -4572,10 +4962,10 @@ var library_default = defineCommand18({
 
 // src/cli/commands/feedback.ts
 import { defineCommand as defineCommand19 } from "citty";
-import * as p7 from "@clack/prompts";
-import { existsSync as existsSync13, readFileSync as readFileSync12 } from "fs";
-import { dirname as dirname3, join as join15 } from "path";
-import { fileURLToPath } from "url";
+import * as p9 from "@clack/prompts";
+import { existsSync as existsSync13, readFileSync as readFileSync15 } from "fs";
+import { dirname as dirname4, join as join14 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
 import { release } from "os";
 var API_URL7 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
 var TYPES = ["bug", "feature", "other"];
@@ -4595,14 +4985,14 @@ function normalizeType(raw) {
 }
 function readCliVersion() {
   try {
-    const here = dirname3(fileURLToPath(import.meta.url));
+    const here = dirname4(fileURLToPath2(import.meta.url));
     const candidates = [
-      join15(here, "..", "package.json"),
-      join15(here, "..", "..", "..", "package.json")
+      join14(here, "..", "package.json"),
+      join14(here, "..", "..", "..", "package.json")
     ];
     for (const path of candidates) {
       if (!existsSync13(path)) continue;
-      const pkg2 = JSON.parse(readFileSync12(path, "utf-8"));
+      const pkg2 = JSON.parse(readFileSync15(path, "utf-8"));
       if (pkg2.name === "deepspace" && pkg2.version) return pkg2.version;
     }
   } catch {
@@ -4707,21 +5097,21 @@ var feedback_default = defineCommand19({
       );
     }
     if (interactive && (!args.type || !title || !body)) {
-      p7.intro("DeepSpace Feedback");
+      p9.intro("DeepSpace Feedback");
       if (!args.type) {
-        const picked = await p7.select({
+        const picked = await p9.select({
           message: "What kind of feedback is this?",
           options: TYPES.map((t) => ({ value: t, label: TYPE_LABELS[t] })),
           initialValue: type
         });
-        if (p7.isCancel(picked)) {
-          p7.cancel("Cancelled.");
+        if (p9.isCancel(picked)) {
+          p9.cancel("Cancelled.");
           process.exit(0);
         }
         type = picked;
       }
       if (!title) {
-        const t = await p7.text({
+        const t = await p9.text({
           message: "Title",
           placeholder: "Short summary of the issue",
           validate: (v) => {
@@ -4731,14 +5121,14 @@ var feedback_default = defineCommand19({
             return void 0;
           }
         });
-        if (p7.isCancel(t)) {
-          p7.cancel("Cancelled.");
+        if (p9.isCancel(t)) {
+          p9.cancel("Cancelled.");
           process.exit(0);
         }
         title = String(t);
       }
       if (!body) {
-        const m = await p7.text({
+        const m = await p9.text({
           message: "Details",
           placeholder: "What happened? Steps to reproduce, what you expected\u2026",
           validate: (v) => {
@@ -4748,8 +5138,8 @@ var feedback_default = defineCommand19({
             return void 0;
           }
         });
-        if (p7.isCancel(m)) {
-          p7.cancel("Cancelled.");
+        if (p9.isCancel(m)) {
+          p9.cancel("Cancelled.");
           process.exit(0);
         }
         body = String(m);
@@ -4767,7 +5157,7 @@ var feedback_default = defineCommand19({
       return fail2(err.message);
     }
     if (interactive && !args.yes) {
-      p7.note(
+      p9.note(
         `${TYPE_LABELS[payload.type]}
 ${payload.title}
 
@@ -4776,9 +5166,9 @@ ${payload.body}
 Context: deepspace ${payload.cliVersion} \xB7 ${payload.nodeVersion} \xB7 ${payload.platform}` + (payload.appName ? ` \xB7 app ${payload.appName}` : ""),
         "Review"
       );
-      const ok = await p7.confirm({ message: "Send this to the DeepSpace team?" });
-      if (p7.isCancel(ok) || !ok) {
-        p7.cancel("Not sent.");
+      const ok = await p9.confirm({ message: "Send this to the DeepSpace team?" });
+      if (p9.isCancel(ok) || !ok) {
+        p9.cancel("Not sent.");
         process.exit(0);
       }
     }
@@ -4802,7 +5192,7 @@ Context: deepspace ${payload.cliVersion} \xB7 ${payload.nodeVersion} \xB7 ${payl
       return;
     }
     if (interactive) {
-      p7.outro(`Thanks! Submitted as ${result.report.id}.`);
+      p9.outro(`Thanks! Submitted as ${result.report.id}.`);
     } else {
       console.log(`Submitted feedback ${result.report.id} (${result.report.type}).`);
     }
@@ -4812,8 +5202,18 @@ Context: deepspace ${payload.cliVersion} \xB7 ${payload.nodeVersion} \xB7 ${payl
 
 // src/cli/commands/secrets.ts
 import { defineCommand as defineCommand20 } from "citty";
-import { readFileSync as readFileSync13 } from "fs";
-var DEPLOY_URL6 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
+import { readFileSync as readFileSync16 } from "fs";
+
+// src/cli/lib/citty-args.ts
+function dedupePositionals(bound, rest) {
+  const restArr = Array.isArray(rest) ? rest : [];
+  return [.../* @__PURE__ */ new Set([bound, ...restArr])].filter(
+    (v) => typeof v === "string" && v.length > 0
+  );
+}
+
+// src/cli/commands/secrets.ts
+var DEPLOY_URL8 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 var COMMON_ARGS = {
   app: {
     type: "string",
@@ -4844,6 +5244,11 @@ async function resolveTarget(args) {
     const appDir = findAppDir();
     appId = appDir && readAppId(appDir, wranglerEnv) || void 0;
     if (!appId) {
+      if (wranglerEnv && appDir && readAppId(appDir, void 0)) {
+        throw new Error(
+          `No app id for env "${wranglerEnv}" \u2014 wrangler.toml has no [env.${wranglerEnv}] block with its own DEEPSPACE_APP_ID. To target the "${wranglerEnv}" config on this app, use \`-c ${wranglerEnv}\` instead of \`--env ${wranglerEnv}\`.`
+        );
+      }
       throw new Error(
         "No app id. Run from an app directory whose wrangler.toml carries DEEPSPACE_APP_ID (`deepspace init` mints one), or pass --app <appId>."
       );
@@ -4857,6 +5262,15 @@ function fail(err) {
   console.error(err instanceof Error ? err.message : String(err));
   process.exit(1);
 }
+function warnIfDebugRoutesEnabled(secrets) {
+  if (secrets.ALLOW_DEBUG_ROUTES !== "true") return false;
+  console.warn(
+    "\n\u26A0  ALLOW_DEBUG_ROUTES=true exposes an UNAUTHENTICATED debug API on the deployed app \u2014\n   anyone who can reach /api/debug/* can read and mutate any record. Redeploy to apply;\n   `deepspace secrets delete ALLOW_DEBUG_ROUTES` (then redeploy) turns it back off."
+  );
+  return true;
+}
+var APPLY_HINT = "Run `deepspace deploy` to apply \u2014 secrets take effect at deploy time.";
+var LOCAL_DEV_HINT = "Running `deepspace dev`? Restart it to load the change locally.";
 var list5 = defineCommand20({
   meta: { name: "list", description: "List masked secrets in a config" },
   args: {
@@ -4871,7 +5285,7 @@ var list5 = defineCommand20({
   async run({ args }) {
     try {
       const t = await resolveTarget(args);
-      const { secrets } = await listSecrets(DEPLOY_URL6, t.token, t.appId, t.configName);
+      const { secrets } = await listSecrets(DEPLOY_URL8, t.token, t.appId, t.configName);
       if (args.json) {
         console.log(JSON.stringify({ appId: t.appId, config: t.configName, secrets }, null, 2));
         return;
@@ -4881,7 +5295,7 @@ var list5 = defineCommand20({
         return;
       }
       for (const s of secrets) {
-        console.log(args["only-names"] ? s.key : `${s.key}  (v${s.version}, ${s.valueBytes}B, ${s.updatedAt})`);
+        console.log(args["only-names"] ? s.key : `${s.key}  (v${s.version}, ${s.updatedAt})`);
       }
     } catch (err) {
       fail(err);
@@ -4897,25 +5311,34 @@ var set = defineCommand20({
   async run({ args }) {
     try {
       const t = await resolveTarget(args);
-      const pairs = [args.secret, ...args._ ?? []].filter(
-        (v) => typeof v === "string" && v.length > 0
-      );
+      const pairs = dedupePositionals(args.secret, args._);
       const secrets = {};
+      const dupes = [];
       for (const pair of pairs) {
         const eq = pair.indexOf("=");
         if (eq <= 0) throw new Error(`Expected KEY=value, got "${pair}"`);
         const key = validateSecretName(pair.slice(0, eq));
         const value = pair.slice(eq + 1);
         validateSecretValue(key, value);
+        if (key in secrets && !dupes.includes(key)) dupes.push(key);
         secrets[key] = value;
       }
+      if (dupes.length) {
+        console.warn(
+          `Warning: ${dupes.join(", ")} given more than once \u2014 kept the last value for each.`
+        );
+      }
       if (Object.keys(secrets).length === 1) {
         const [[k, v]] = Object.entries(secrets);
-        await setSecret(DEPLOY_URL6, t.token, t.appId, t.configName, k, v);
+        await setSecret(DEPLOY_URL8, t.token, t.appId, t.configName, k, v);
       } else {
-        await uploadSecrets(DEPLOY_URL6, t.token, t.appId, t.configName, secrets, false);
+        await uploadSecrets(DEPLOY_URL8, t.token, t.appId, t.configName, secrets, false);
       }
       console.log(`Set ${Object.keys(secrets).length} secret${Object.keys(secrets).length === 1 ? "" : "s"} in ${t.configName}.`);
+      if (!warnIfDebugRoutesEnabled(secrets)) {
+        console.log(APPLY_HINT);
+        console.log(LOCAL_DEV_HINT);
+      }
     } catch (err) {
       fail(err);
     }
@@ -4933,14 +5356,14 @@ var get = defineCommand20({
       const t = await resolveTarget(args);
       const key = validateSecretName(args.key);
       if (args.plain) {
-        const { value } = await getSecretPlain(DEPLOY_URL6, t.token, t.appId, t.configName, key);
-        process.stdout.write(value + "\n");
+        const { value } = await getSecretPlain(DEPLOY_URL8, t.token, t.appId, t.configName, key);
+        process.stdout.write(process.stdout.isTTY ? value + "\n" : value);
         return;
       }
-      const { secrets } = await listSecrets(DEPLOY_URL6, t.token, t.appId, t.configName);
+      const { secrets } = await listSecrets(DEPLOY_URL8, t.token, t.appId, t.configName);
       const item = secrets.find((s) => s.key === key);
       if (!item) fail(new Error(`Secret "${key}" not found in ${t.configName}`));
-      console.log(`${item.key}  (v${item.version}, ${item.valueBytes}B, ${item.updatedAt})`);
+      console.log(`${item.key}  (v${item.version}, ${item.updatedAt})`);
     } catch (err) {
       fail(err);
     }
@@ -4955,13 +5378,22 @@ var del2 = defineCommand20({
   async run({ args }) {
     try {
       const t = await resolveTarget(args);
-      const keys = [args.key, ...args._ ?? []].filter(
-        (v) => typeof v === "string" && v.length > 0
-      );
+      const keys = dedupePositionals(args.key, args._);
+      let deleted = 0;
+      let absent = 0;
       for (const key of keys) {
-        await deleteSecret(DEPLOY_URL6, t.token, t.appId, t.configName, validateSecretName(key));
+        const name = validateSecretName(key);
+        try {
+          await deleteSecret(DEPLOY_URL8, t.token, t.appId, t.configName, name);
+          deleted++;
+        } catch (err) {
+          if (err?.status === 404) absent++;
+          else throw err;
+        }
       }
-      console.log(`Deleted ${keys.length} secret${keys.length === 1 ? "" : "s"} from ${t.configName}.`);
+      const note3 = absent > 0 ? ` (${absent} already absent)` : "";
+      console.log(`Deleted ${deleted} secret${deleted === 1 ? "" : "s"} from ${t.configName}.${note3}`);
+      if (deleted > 0) console.log(APPLY_HINT);
     } catch (err) {
       fail(err);
     }
@@ -4981,11 +5413,12 @@ var upload = defineCommand20({
   async run({ args }) {
     try {
       const t = await resolveTarget(args);
-      const content = args.file === "-" ? readFileSync13(0, "utf-8") : readFileSync13(args.file, "utf-8");
+      const content = args.file === "-" ? readFileSync16(0, "utf-8") : readFileSync16(args.file, "utf-8");
       const secrets = parseSecretsUpload(content);
       if (Object.keys(secrets).length === 0) fail(new Error("No secrets found in the input."));
-      await uploadSecrets(DEPLOY_URL6, t.token, t.appId, t.configName, secrets, args.replace);
+      await uploadSecrets(DEPLOY_URL8, t.token, t.appId, t.configName, secrets, args.replace);
       console.log(`Uploaded ${Object.keys(secrets).length} secrets to ${t.configName}.`);
+      if (!warnIfDebugRoutesEnabled(secrets)) console.log(APPLY_HINT);
     } catch (err) {
       fail(err);
     }
@@ -5008,7 +5441,7 @@ var download = defineCommand20({
       if (!["dotenv", "json", "shell"].includes(format)) {
         fail(new Error(`Unknown format "${args.format}" \u2014 use dotenv, json, or shell.`));
       }
-      const { secrets } = await fetchSecretsValues(DEPLOY_URL6, t.token, t.appId, t.configName);
+      const { secrets } = await fetchSecretsValues(DEPLOY_URL8, t.token, t.appId, t.configName);
       process.stdout.write(formatSecretsDownload(secrets, format));
     } catch (err) {
       fail(err);
@@ -5025,7 +5458,7 @@ var pull = defineCommand20({
       if (!appDir) fail(new Error("Run from a DeepSpace app directory (one containing wrangler.toml)."));
       const t = await resolveTarget(args);
       const ownerId = decodeJwtPayload(t.token).sub;
-      const pulled = await pullAppSecretsCache(DEPLOY_URL6, t.token, t.appId, t.configName);
+      const pulled = await pullAppSecretsCache(DEPLOY_URL8, t.token, t.appId, t.configName);
       if (!pulled) {
         console.log(`No secrets in ${t.configName} yet \u2014 nothing to pull.`);
         return;
@@ -5049,7 +5482,7 @@ var configsList = defineCommand20({
   async run({ args }) {
     try {
       const t = await resolveTarget(args);
-      const { configs: configs2 } = await listConfigs(DEPLOY_URL6, t.token, t.appId);
+      const { configs: configs2 } = await listConfigs(DEPLOY_URL8, t.token, t.appId);
       if (configs2.length === 0) {
         console.log("No configs yet \u2014 the first `secrets set` creates one.");
         return;
@@ -5073,7 +5506,20 @@ var configsCreate = defineCommand20({
     try {
       const t = await resolveTarget(args);
       const name = validateConfigName(args.name);
-      await createConfig(DEPLOY_URL6, t.token, t.appId, name, args["copy-from"] || void 0);
+      const copyFrom = args["copy-from"] || void 0;
+      const { configs: configs2 } = await listConfigs(DEPLOY_URL8, t.token, t.appId);
+      if (configs2.some((c) => c.name === name)) {
+        if (copyFrom) {
+          fail(
+            new Error(
+              `Config "${name}" already exists \u2014 refusing to copy "${copyFrom}" over it. Delete it first, or pick a new name.`
+            )
+          );
+        }
+        console.log(`Config ${name} already exists.`);
+        return;
+      }
+      await createConfig(DEPLOY_URL8, t.token, t.appId, name, copyFrom);
       console.log(`Created ${name}.`);
     } catch (err) {
       fail(err);
@@ -5090,7 +5536,7 @@ var configsDelete = defineCommand20({
     try {
       const t = await resolveTarget(args);
       const name = validateConfigName(args.name);
-      await deleteConfig(DEPLOY_URL6, t.token, t.appId, name);
+      await deleteConfig(DEPLOY_URL8, t.token, t.appId, name);
       console.log(`Deleted ${name}.`);
     } catch (err) {
       fail(err);
@@ -5138,7 +5584,9 @@ var init_default = defineCommand21({
   async run({ args }) {
     const appDir = findAppDir();
     if (!appDir) {
-      console.error("Run from a DeepSpace app directory (one containing wrangler.toml).");
+      console.error(
+        "No wrangler.toml here \u2014 `deepspace init` stamps an app id into an existing DeepSpace app. To create a new app, run `deepspace create <name>` (or `npm create deepspace@latest <name>`), then run this from inside it."
+      );
       process.exit(1);
     }
     const envName = args.env || void 0;
@@ -5160,28 +5608,36 @@ var init_default = defineCommand21({
 });
 
 // src/cli/cli.ts
-var __dirname = dirname4(fileURLToPath2(import.meta.url));
-var pkg = JSON.parse(readFileSync14(join16(__dirname, "..", "package.json"), "utf-8"));
+var __dirname = dirname5(fileURLToPath3(import.meta.url));
+var pkg = JSON.parse(readFileSync17(join15(__dirname, "..", "package.json"), "utf-8"));
 if (process.platform === "linux" && !process.env.SSL_CERT_FILE && existsSync14("/etc/ssl/certs/ca-certificates.crt")) {
   process.env.SSL_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt";
 }
 var create2 = defineCommand22({
   meta: {
     name: "create",
-    description: "Create a new DeepSpace app"
+    description: "Create a new DeepSpace app (runs create-deepspace; all flags are forwarded)"
   },
   args: {
     name: {
       type: "positional",
       description: "App name",
       required: false
+    },
+    interactive: {
+      type: "boolean",
+      description: "Prompt for options instead of using defaults"
+    },
+    local: {
+      type: "string",
+      description: "Use a local SDK monorepo checkout instead of the published package"
     }
   },
-  run({ args }) {
-    const name = args.name ? ` ${args.name}` : "";
-    console.log(`Running: npm create deepspace${name}
-`);
-    execSync4(`npm create deepspace@latest${name}`, { stdio: "inherit" });
+  run({ rawArgs }) {
+    const scaffolder = `create-deepspace@${pkg.version}`;
+    console.log(`Running: npx ${scaffolder} ${rawArgs.join(" ")}`.trimEnd() + "\n");
+    const res = spawnSync6("npx", ["-y", scaffolder, ...rawArgs], { stdio: "inherit" });
+    process.exit(res.status ?? 1);
   }
 });
 var main = defineCommand22({
@@ -5196,13 +5652,13 @@ var main = defineCommand22({
     login: login_default,
     logout: logout_default,
     whoami: whoami_default,
+    apps: apps_default,
     dev: dev_default,
     kill: kill_default,
     test: test_default,
     screenshot: screenshot_default,
     "test-accounts": test_accounts_default,
     add: add_default,
-    skills: skills_default,
     integrations: integrations_default,
     invoke: invoke_default,
     deploy: deploy_default,