eraspace 0.2.0 → 0.4.0

package/bin.js

@@ -241,6 +241,34 @@ __export(Effect_exports, {
   zipWith: () => zipWith3
 });
 
+// node_modules/.pnpm/effect@4.0.5/node_modules/effect/dist/Context.js
+var Context_exports = {};
+__export(Context_exports, {
+  Reference: () => Reference,
+  Service: () => Service,
+  ServiceTypeId: () => ServiceTypeId,
+  add: () => add,
+  addOrOmit: () => addOrOmit,
+  addUnsafe: () => addUnsafe,
+  empty: () => empty,
+  get: () => get,
+  getOption: () => getOption,
+  getOrElse: () => getOrElse2,
+  getOrUndefined: () => getOrUndefined2,
+  getOrUndefinedUnsafe: () => getOrUndefinedUnsafe,
+  getUnsafe: () => getUnsafe,
+  hasSameCache: () => hasSameCache,
+  isContext: () => isContext,
+  isKey: () => isKey,
+  isReference: () => isReference,
+  make: () => make5,
+  makeUnsafe: () => makeUnsafe,
+  merge: () => merge,
+  mergeAll: () => mergeAll,
+  omit: () => omit,
+  pick: () => pick
+});
+
 // node_modules/.pnpm/effect@4.0.5/node_modules/effect/dist/Pipeable.js
 var pipeArguments = (self, args2) => {
   switch (args2.length) {
@@ -2273,6 +2301,7 @@ var Proto = {
 };
 var hasSameCache = (self, that) => self.cacheRoot === that.cacheRoot;
 var isContext = (u) => hasProperty(u, TypeId3);
+var isKey = (u) => hasProperty(u, ServiceTypeId);
 var isReference = (u) => !!u[ReferenceTypeId];
 var empty = () => emptyContext2;
 var emptyContext2 = /* @__PURE__ */ makeUnsafe(/* @__PURE__ */ new Map());
@@ -2293,6 +2322,12 @@ var addUnsafe = (self, key, service4) => {
     parent: impl.overlay
   }, impl.depth + 1);
 };
+var addOrOmit = /* @__PURE__ */ dual(3, (self, key, service4) => service4._tag === "None" ? omit(key)(self) : add(self, key, service4.value));
+var getOrElse2 = /* @__PURE__ */ dual(3, (self, key, orElse6) => {
+  const value4 = lookup(self, key.key);
+  if (value4 !== notFound) return value4;
+  return isReference(key) ? getDefaultValue(key) : orElse6();
+});
 var getOrUndefined2 = /* @__PURE__ */ dual(2, (self, key) => getOrUndefinedUnsafe(self, key.key));
 var getOrUndefinedUnsafe = (self, key) => {
   const value4 = lookup(self, key);
@@ -2342,6 +2377,26 @@ var mergeAll = (...ctxs) => {
   }
   return makeUnsafe(map18);
 };
+var pick = (...services) => (self) => {
+  if (services.length <= 1) {
+    const map18 = /* @__PURE__ */ new Map();
+    if (services.length === 1) {
+      const key = services[0].key;
+      const value4 = lookup(self, key);
+      if (value4 !== notFound) map18.set(key, value4);
+    }
+    return makeUnsafe(map18);
+  }
+  const keep = new Set(services.map((key) => key.key));
+  return withFlat(self, (map18) => map18.forEach((_, key) => {
+    if (!keep.has(key)) map18.delete(key);
+  }));
+};
+var omit = (...keys4) => (self) => withFlat(self, (map18) => {
+  for (let i = 0; i < keys4.length; i++) {
+    map18.delete(keys4[i].key);
+  }
+});
 var Reference = Service;
 
 // node_modules/.pnpm/effect@4.0.5/node_modules/effect/dist/Duration.js
@@ -2988,7 +3043,7 @@ var merge2 = /* @__PURE__ */ match3({
   onFailure: identity,
   onSuccess: identity
 });
-var getOrElse2 = /* @__PURE__ */ dual(2, (self, onFailure) => isFailure2(self) ? onFailure(self.failure) : self.success);
+var getOrElse3 = /* @__PURE__ */ dual(2, (self, onFailure) => isFailure2(self) ? onFailure(self.failure) : self.success);
 var getOrThrowWith2 = /* @__PURE__ */ dual(2, (self, onFailure) => {
   if (isSuccess2(self)) {
     return self.success;
@@ -16361,7 +16416,7 @@ function transformOptionalEffect(f) {
     transform: f
   });
 }
-function omit() {
+function omit2() {
   return transformOptional(() => none2());
 }
 function withDefault(defaultValue) {
@@ -18565,9 +18620,9 @@ function isPattern(regExp, annotations) {
   });
 }
 var bodyOwners = /* @__PURE__ */ new WeakMap();
-function copy2(ast, changes2) {
-  const out = Object.assign(Object.create(Object.getPrototypeOf(ast)), ast, changes2);
-  if (Reflect.ownKeys(changes2).every((key) => key === "context" || key === "encoding")) {
+function copy2(ast, changes3) {
+  const out = Object.assign(Object.create(Object.getPrototypeOf(ast)), ast, changes3);
+  if (Reflect.ownKeys(changes3).every((key) => key === "context" || key === "encoding")) {
     bodyOwners.set(out, getContextOwner(ast));
   }
   return out;
@@ -24947,10 +25002,10 @@ function toFormatter(ast, options3) {
 }
 
 // node_modules/.pnpm/effect@4.0.5/node_modules/effect/dist/Struct.js
-var pick = /* @__PURE__ */ dual(2, (self, keys4) => {
+var pick2 = /* @__PURE__ */ dual(2, (self, keys4) => {
   return buildStruct(self, (k, v) => hasPropertyKey(keys4, k) ? [k, v] : void 0);
 });
-var omit2 = /* @__PURE__ */ dual(2, (self, keys4) => {
+var omit3 = /* @__PURE__ */ dual(2, (self, keys4) => {
   return buildStruct(self, (k, v) => !hasPropertyKey(keys4, k) ? [k, v] : void 0);
 });
 var assign = /* @__PURE__ */ dual(2, (self, that) => {
@@ -25070,10 +25125,10 @@ var OptionalImpl = class {
     this.replaceResult = replaceResult;
   }
   replace(a, s) {
-    return getOrElse2(this.replaceResult(a, s), () => s);
+    return getOrElse3(this.replaceResult(a, s), () => s);
   }
   modify(f) {
-    return (s) => getOrElse2(flatMap2(this.getResult(s), (a) => this.replaceResult(f(a), s)), () => s);
+    return (s) => getOrElse3(flatMap2(this.getResult(s), (a) => this.replaceResult(f(a), s)), () => s);
   }
   compose(that) {
     return make36(compose3(this.node, that.node));
@@ -25121,14 +25176,14 @@ var OptionalImpl = class {
     })));
   }
   pick(keys4) {
-    return this.compose(makeLens(pick(keys4), (p, a) => ({
-      ...omit2(a, keys4),
+    return this.compose(makeLens(pick2(keys4), (p, a) => ({
+      ...omit3(a, keys4),
       ...p
     })));
   }
   omit(keys4) {
-    return this.compose(makeLens(omit2(keys4), (o, a) => ({
-      ...pick(a, keys4),
+    return this.compose(makeLens(omit3(keys4), (o, a) => ({
+      ...pick2(a, keys4),
       ...o
     })));
   }
@@ -25174,7 +25229,7 @@ var OptionalImpl = class {
     );
   }
   modifyAll(f) {
-    return (s) => getOrElse2(flatMap2(this.getResult(s), (as5) => this.replaceResult(as5.map(f), s)), () => s);
+    return (s) => getOrElse3(flatMap2(this.getResult(s), (as5) => this.replaceResult(as5.map(f), s)), () => s);
   }
 };
 var IsoImpl = class extends OptionalImpl {
@@ -25213,7 +25268,7 @@ var PrismImpl = class extends OptionalImpl {
     return this.set(a);
   }
   modify(f) {
-    return (s) => getOrElse2(map2(this.getResult(s), (a) => this.set(f(a))), () => s);
+    return (s) => getOrElse3(map2(this.getResult(s), (a) => this.set(f(a))), () => s);
   }
 };
 function make36(node) {
@@ -26001,7 +26056,7 @@ function toIssueEffect(self) {
   return catchCause3(self, (cause) => failCauseSync2(() => map6(cause, (error2) => error2.issue)));
 }
 function withDecodingDefaultKey(defaultValue, options3) {
-  const encode5 = options3?.encodingStrategy === "omit" ? omit() : passthrough2();
+  const encode5 = options3?.encodingStrategy === "omit" ? omit2() : passthrough2();
   return (self) => {
     return optionalKey2(toEncoded2(self)).pipe(decodeTo2(self, {
       decode: withDefault(toIssueEffect(defaultValue)),
@@ -26015,7 +26070,7 @@ function withDecodingDefaultTypeKey(defaultValue, options3) {
   };
 }
 function withDecodingDefault(defaultValue, options3) {
-  const encode5 = options3?.encodingStrategy === "omit" ? omit() : passthrough2();
+  const encode5 = options3?.encodingStrategy === "omit" ? omit2() : passthrough2();
   return (self) => {
     return optional2(toEncoded2(self)).pipe(decodeTo2(self, {
       decode: withDefault(toIssueEffect(defaultValue)),
@@ -32824,15 +32879,15 @@ var TomlParser = class {
   }
   parseDate(token) {
     const date = "\\d{4}-\\d{2}-\\d{2}";
-    const time3 = "\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?";
-    if (new RegExp(`^${date}[Tt]${time3}(?:[Zz]|[+-]\\d{2}:\\d{2})$`).test(token)) {
+    const time4 = "\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?";
+    if (new RegExp(`^${date}[Tt]${time4}(?:[Zz]|[+-]\\d{2}:\\d{2})$`).test(token)) {
       const value4 = new Date(token.replace("t", "T").replace("z", "Z"));
       if (Number.isNaN(value4.getTime())) {
         this.fail(`Invalid date-time '${token}'`);
       }
       return value4;
     }
-    if (new RegExp(`^${date}[Tt]${time3}$`).test(token) || new RegExp(`^${date}$`).test(token) || new RegExp(`^${time3}$`).test(token)) {
+    if (new RegExp(`^${date}[Tt]${time4}$`).test(token) || new RegExp(`^${date}$`).test(token) || new RegExp(`^${time4}$`).test(token)) {
       return token.replace("t", "T");
     }
     return void 0;
@@ -38939,7 +38994,7 @@ var runWith2 = (command2, config2) => {
 // cli/package.json
 var package_default = {
   name: "eraspace-cli",
-  version: "0.2.0",
+  version: "0.4.0",
   private: true,
   license: "MIT",
   type: "module",
@@ -39259,12 +39314,54 @@ function findSpecifier(source, spec) {
 }
 function formatLog(l) {
   const d = l.ts === void 0 ? /* @__PURE__ */ new Date() : new Date(typeof l.ts === "number" ? l.ts : Date.parse(l.ts));
-  const time3 = isNaN(d.getTime()) ? String(l.ts) : d.toISOString().slice(11, 23);
+  const time4 = isNaN(d.getTime()) ? String(l.ts) : d.toISOString().slice(11, 23);
   const level = (l.level ?? "info").toLowerCase();
   const color = level === "error" ? c.red : level === "warn" ? c.yellow : level === "debug" ? c.gray : c.blue;
   const fn3 = l.fn ? c.magenta(l.fn) + " " : "";
   const data = l.data === void 0 || l.data === null ? "" : " " + c.gray(JSON.stringify(l.data));
-  return `${c.gray(time3)} ${color(level.padEnd(5))} ${fn3}${l.msg ?? ""}${data}`;
+  return `${c.gray(time4)} ${color(level.padEnd(5))} ${fn3}${l.msg ?? ""}${data}`;
+}
+var SKIPPED = {
+  fetch: "uses fetch",
+  identity: "reads the caller's identity",
+  running: "was running",
+  recovering: "cache recovering",
+  "new index": "reads an index this deploy adds",
+  committed: "a commit changed it during the check",
+  budget: "out of time",
+  limit: "too many entries",
+  interrupted: "interrupted"
+};
+var call = (fn3, args2) => {
+  const text2 = Array.isArray(args2) ? args2.map((a) => JSON.stringify(a)).join(", ") : JSON.stringify(args2);
+  return `${fn3}(${text2 && text2.length > 80 ? `${text2.slice(0, 77)}...` : text2 ?? ""})`;
+};
+function formatShadow(report) {
+  if (report.note) return c.dim(`Live queries: none checked (${report.note})`);
+  const total = report.total ?? 0;
+  if (total === 0) return c.dim("Live queries: none cached, nothing to check");
+  const errors = report.errors ?? 0;
+  const changed = report.changed ?? 0;
+  const parts2 = [
+    `${report.unchanged ?? 0} unchanged`,
+    changed ? c.yellow(`${changed} change value`) : "0 change value",
+    errors ? c.red(`${errors} now throw`) : "0 now throw",
+    ...report.fixed ? [c.green(`${report.fixed} fixed`)] : [],
+    ...report.skipped ? [c.dim(`${report.skipped} skipped`)] : []
+  ];
+  const at = report.commitSeq ? ` at commit ${report.commitSeq}` : "";
+  const lines2 = [`Live queries: ${report.checked ?? 0} of ${total} checked against the new code${at}: ${parts2.join(", ")}`];
+  for (const e of report.entries ?? []) {
+    const what = call(e.fn, e.args);
+    if (e.outcome === "error") lines2.push(`  ${c.red("throws ")} ${what}: ${e.error ? `${e.error.name}: ${e.error.message}` : ""}`);
+    else if (e.outcome === "changed") lines2.push(`  ${c.yellow("changes")} ${what}${e.error ? `: ${e.error.name}: ${e.error.message}` : ""}`);
+    else if (e.outcome === "fixed") lines2.push(`  ${c.green("fixed  ")} ${what}`);
+    else lines2.push(c.dim(`  skipped ${what}: ${SKIPPED[e.reason ?? ""] ?? e.reason ?? ""}`));
+  }
+  const listed = report.entries?.length ?? 0;
+  const notable = errors + changed + (report.fixed ?? 0) + (report.skipped ?? 0);
+  if (notable > listed) lines2.push(c.dim(`  ... and ${notable - listed} more`));
+  return lines2.join("\n");
 }
 
 // cli/src/api.ts
@@ -39280,10 +39377,40 @@ var App = Schema_exports.Struct({
   expiresAt: Schema_exports.optional(Timestamp),
   publicInspection: Schema_exports.optional(Schema_exports.Boolean)
 });
+var Count = Schema_exports.optional(Schema_exports.Number);
+var ShadowReport = Schema_exports.Struct({
+  total: Count,
+  checked: Count,
+  unchanged: Count,
+  changed: Count,
+  errors: Count,
+  fixed: Count,
+  skipped: Count,
+  commitSeq: Count,
+  note: Schema_exports.optional(Schema_exports.String),
+  entries: Schema_exports.optional(
+    Schema_exports.Array(
+      Schema_exports.Struct({
+        fn: Schema_exports.String,
+        args: Schema_exports.optional(Schema_exports.Unknown),
+        outcome: Schema_exports.String,
+        reason: Schema_exports.optional(Schema_exports.String),
+        error: Schema_exports.optional(Schema_exports.Struct({ name: Schema_exports.String, message: Schema_exports.String }))
+      })
+    )
+  )
+});
 var Deployed = Schema_exports.Struct({
   ...App.fields,
   version: Schema_exports.optional(Schema_exports.Number),
-  claimToken: Schema_exports.optional(Schema_exports.String)
+  claimToken: Schema_exports.optional(Schema_exports.String),
+  shadow: Schema_exports.optional(ShadowReport),
+  /** For a rollback: the kept version whose files were deployed again. */
+  rolledBackTo: Schema_exports.optional(Schema_exports.Number)
+});
+var DeployHistory = Schema_exports.Struct({
+  version: Schema_exports.optional(Schema_exports.Number),
+  deploys: Schema_exports.optional(Schema_exports.Array(Schema_exports.Struct({ version: Schema_exports.Number, createdAt: Schema_exports.optional(Schema_exports.Number) })))
 });
 var AppList = Schema_exports.Struct({ apps: Schema_exports.Array(App) });
 var StateChange = Schema_exports.Struct({ state: Schema_exports.String });
@@ -39300,7 +39427,7 @@ var Token2 = Schema_exports.Struct({
   lastUsedAt: Schema_exports.optional(Timestamp)
 });
 var TokenList = Schema_exports.Struct({ tokens: Schema_exports.Array(Token2) });
-var CreatedToken = Schema_exports.Struct({ token: Schema_exports.String });
+var CreatedToken = Schema_exports.Struct({ token: Schema_exports.String, id: Schema_exports.String });
 var DeviceStart = Schema_exports.Struct({
   deviceCode: Schema_exports.String,
   userCode: Schema_exports.String,
@@ -39448,15 +39575,20 @@ var login = Effect_exports.fnUntraced(function* (config2, browser) {
   }
   return yield* fail12("The sign-in code expired. Run eraspace auth login again.");
 });
+var LogoutResult = Schema_exports.Struct({ ok: Schema_exports.Literal(true) });
 var logout = Effect_exports.fnUntraced(function* (config2) {
   const session = yield* sessionFor(config2.origin);
   if (!session) {
     yield* Console_exports.log(`Not signed in to ${config2.origin}.`);
     return;
   }
-  yield* request3(config2, "POST", "/_api/auth/logout", { bearer: Redacted_exports.make(session.token) }).pipe(Effect_exports.timeout("10 seconds"), Effect_exports.ignore);
+  const response = yield* api(config2, "POST", "/_api/auth/logout", { bearer: Redacted_exports.make(session.token), timeout: "10 seconds" });
+  if (response.status !== 401) {
+    if (response.status >= 400 || response.json.ok === false) return yield* Effect_exports.fail(yield* failure(response));
+    yield* decode5(LogoutResult, response.json, "sign-out");
+  }
   yield* removeSession(config2.origin);
-  yield* Console_exports.log(`Signed out of ${config2.origin}.`);
+  yield* Console_exports.log(response.status === 401 ? `Removed invalid session for ${config2.origin}.` : `Signed out of ${config2.origin}.`);
 });
 var okWhoami = ok(Whoami);
 var whoami = Effect_exports.fnUntraced(function* (config2) {
@@ -39491,6 +39623,7 @@ function scanImports(file2, source) {
   }
   return { imports: imports.sort((a, b) => (a.at ?? 0) - (b.at ?? 0)) };
 }
+var MAX_MODULE_BYTES = 256 * 1024;
 var EXTENSIONS = [".ts", ".mts", ".js", ".mjs", ".tsx"];
 function importCandidates(base) {
   const stem = /\.m?js$/.test(base) ? base.replace(/\.m?js$/, "") : void 0;
@@ -39526,6 +39659,10 @@ var collectServerFiles = Effect_exports.fnUntraced(function* (root) {
     const rel = toPosix(relative2(root, abs2));
     const source = yield* fs.readFileString(abs2);
     files[rel] = source;
+    const bytes2 = Buffer.byteLength(source, "utf8");
+    if (bytes2 > MAX_MODULE_BYTES) {
+      errors.push({ file: rel, line: 0, column: 0, message: `module is ${bytes2} bytes, over the server's ${MAX_MODULE_BYTES} byte (256 KiB) limit; split it into smaller modules` });
+    }
     const { imports, error: error2 } = scanImports(abs2, source);
     if (error2) {
       errors.push({ file: rel, ...lineCol(source, error2.at), message: error2.message });
@@ -39804,7 +39941,6 @@ var withoutEnv = Effect_exports.fnUntraced(function* (payload) {
   }
   return { ...payload, env: {} };
 });
-var okDeployed = ok(Deployed);
 var requestedName = (config2, opts) => opts.name !== void 0 ? { name: opts.name } : { name: config2.name ?? toAppName(basename(config2.root)), uniqueName: true };
 var createApp = Effect_exports.fnUntraced(function* (config2, payload, extra, opts, signedIn) {
   const naming = requestedName(config2, opts);
@@ -39831,29 +39967,37 @@ var createApp = Effect_exports.fnUntraced(function* (config2, payload, extra, op
   return { result: result4, name: naming.name };
 });
 var deploy = Effect_exports.fnUntraced(function* (config2, opts = {}) {
+  const t = yield* target(config2);
+  if (t.ref && opts.name !== void 0)
+    return yield* fail12(
+      t.claim ? `--name only names a new app, and this checkout already deploys to ${t.ref}. Name it when you claim it: eraspace claim --name ${opts.name}` : `--name only names a new app, and this checkout already deploys to ${t.ref}. Add the name with eraspace names add ${opts.name}`
+    );
   const build3 = yield* buildCapsule(config2.root);
   if (!build3.ok || !build3.payload)
     return yield* fail12(yield* formatErrors(build3.errors, config2.root));
   const deleteTables = yield* confirmedDeletes(opts.deleteTables);
   const extra = {
     ...opts.publicInspect ? { publicInspection: true } : {},
-    ...Object.keys(deleteTables).length ? { deleteTables } : {}
+    ...Object.keys(deleteTables).length ? { deleteTables } : {},
+    ...opts.shadow ? { shadow: true } : {},
+    ...opts.failOnQueryErrors ? { failOnQueryErrors: true } : {}
   };
   const signedIn = (yield* bearerFor(config2.origin)) !== void 0;
-  const t = yield* target(config2);
   let result4;
   if (t.ref) {
     const payload = t.claim ? yield* withoutEnv(build3.payload) : build3.payload;
-    result4 = yield* okDeployed(
-      config2,
-      "POST",
-      `/_api/apps/${enc(t.ref)}/deploy`,
-      {
-        body: { ...payload, ...extra },
-        claim: t.claim,
-        timeout: DEPLOY_TIMEOUT
-      }
-    );
+    const path = `/_api/apps/${enc(t.ref)}/deploy`;
+    const response = yield* api(config2, "POST", path, {
+      body: { ...payload, ...extra },
+      claim: t.claim,
+      timeout: DEPLOY_TIMEOUT
+    });
+    if (response.status >= 400 || response.json.ok === false) {
+      const refused = Schema_exports.decodeUnknownOption(ShadowReport)(response.json.shadow);
+      if (Option_exports.isSome(refused)) yield* Console_exports.log(formatShadow(refused.value));
+      return yield* Effect_exports.fail(yield* failure(response, config2.root));
+    }
+    result4 = yield* decode5(Deployed, response.json, `POST ${path}`);
     if (t.claim && result4.claimed)
       yield* removeLocalDeploy(config2.root, config2.origin);
   } else if (signedIn) {
@@ -39878,6 +40022,7 @@ var deploy = Effect_exports.fnUntraced(function* (config2, opts = {}) {
       expiresAt: Number.isFinite(expiresAt) ? expiresAt : null
     });
   }
+  if (result4.shadow) yield* Console_exports.log(formatShadow(result4.shadow));
   const label = result4.names?.[0] ?? result4.id;
   yield* Console_exports.log(
     `${label}${result4.version === void 0 ? "" : ` v${result4.version}`}: ${result4.url ?? config2.url}`
@@ -39900,6 +40045,40 @@ var deploy = Effect_exports.fnUntraced(function* (config2, opts = {}) {
   }
   return result4;
 });
+var time2 = (ms) => ms === void 0 ? "" : new Date(ms).toISOString();
+var deploys = Effect_exports.fnUntraced(function* (config2, explicit) {
+  const t = yield* requireTarget(config2, explicit);
+  const history = yield* ok(DeployHistory)(config2, "GET", `/_api/apps/${enc(t.ref)}`, { claim: t.claim });
+  const kept = history.deploys ?? [];
+  if (!kept.length) return yield* Console_exports.log(`${t.ref} has no deploys.`);
+  for (const d of kept) {
+    const serving = d.version === history.version ? `  ${c.green("serving")}` : "";
+    yield* Console_exports.log(`v${d.version}  ${c.dim(time2(d.createdAt))}${serving}`);
+  }
+  if (kept.length >= 50) yield* Console_exports.log(c.dim(`Showing the latest ${kept.length}; any older kept versions still roll back by number: eraspace rollback <version>`));
+});
+var rollback = Effect_exports.fnUntraced(function* (config2, version, opts = {}) {
+  const t = yield* requireTarget(config2);
+  const deleteTables = yield* confirmedDeletes(opts.deleteTables);
+  const body = {
+    ...version === void 0 ? {} : { version },
+    ...Object.keys(deleteTables).length ? { deleteTables } : {},
+    ...opts.shadow ? { shadow: true } : {},
+    ...opts.failOnQueryErrors ? { failOnQueryErrors: true } : {}
+  };
+  const path = `/_api/apps/${enc(t.ref)}/rollback`;
+  const response = yield* api(config2, "POST", path, { body, claim: t.claim, timeout: DEPLOY_TIMEOUT });
+  if (response.status >= 400 || response.json.ok === false) {
+    const refused = Schema_exports.decodeUnknownOption(ShadowReport)(response.json.shadow);
+    if (Option_exports.isSome(refused)) yield* Console_exports.log(formatShadow(refused.value));
+    return yield* Effect_exports.fail(yield* failure(response, config2.root));
+  }
+  const result4 = yield* decode5(Deployed, response.json, `POST ${path}`);
+  if (result4.shadow) yield* Console_exports.log(formatShadow(result4.shadow));
+  const label = result4.names?.[0] ?? result4.id;
+  yield* Console_exports.log(`${label} v${String(result4.version)}: rolled back to v${String(result4.rolledBackTo)}: ${result4.url ?? config2.url}`);
+  return result4;
+});
 var claimRequest = (config2, path, body, claim2) => api(config2, "POST", path, { body, claim: claim2 });
 var claim = Effect_exports.fnUntraced(function* (config2, name) {
   const local = yield* localDeploy(config2.root, config2.origin);
@@ -39947,10 +40126,14 @@ var IGNORED = /(^|[/\\])(node_modules|\.git|\.eraspace)([/\\]|$)/;
 var isWatched = (file2) => !IGNORED.test(file2) && WATCHED.test(file2);
 var dev = Effect_exports.fnUntraced(function* (config2, opts) {
   const fs = yield* FileSystem_exports.FileSystem;
+  let current = opts;
   const redeploy = Effect_exports.suspend(
     () => loadConfig({ dir: config2.root, app: config2.app, url: config2.url })
   ).pipe(
-    Effect_exports.flatMap((current) => deploy(current, opts)),
+    Effect_exports.flatMap((loaded) => deploy(loaded, current)),
+    Effect_exports.tap(() => Effect_exports.sync(() => {
+      current = { ...current, name: void 0 };
+    })),
     Effect_exports.catch((error2) => Console_exports.error(messageOf(error2)))
   );
   yield* redeploy;
@@ -39964,7 +40147,10 @@ var dev = Effect_exports.fnUntraced(function* (config2, opts) {
 });
 
 // cli/src/logs.ts
-var IDLE = Duration_exports.seconds(75);
+var LogTimeouts = Context_exports.Reference(
+  "eraspace/cli/LogTimeouts",
+  { defaultValue: () => ({ idle: Duration_exports.seconds(75), stalled: Duration_exports.seconds(30), errorBody: Duration_exports.seconds(10) }) }
+);
 var Printed = class {
   lines = [];
   limit;
@@ -40005,12 +40191,14 @@ var readOnce = Effect_exports.fnUntraced(function* (config2, path, claim2, follo
   const response = yield* request3(config2, "GET", path, { claim: claim2 }).pipe(
     Effect_exports.timeoutOrElse({ duration: "30 seconds", orElse: () => Effect_exports.fail(new Transient({ message: `The platform at ${config2.origin} did not answer within 30s.` })) })
   );
+  const timeouts = yield* LogTimeouts;
+  const errorText = response.text.pipe(Effect_exports.timeout(timeouts.errorBody), Effect_exports.orElseSucceed(() => ""));
   if (isGatewayError(response.status)) {
-    yield* response.text.pipe(Effect_exports.ignore);
+    yield* errorText;
     return yield* new Transient({ message: `The platform at ${config2.origin} is unavailable (HTTP ${response.status}).` });
   }
   if (response.status >= 400) {
-    const text2 = yield* response.text.pipe(Effect_exports.orElseSucceed(() => ""));
+    const text2 = yield* errorText;
     let json2 = { ok: false, error: text2.trim() || `HTTP ${response.status}` };
     try {
       json2 = JSON.parse(text2);
@@ -40018,12 +40206,15 @@ var readOnce = Effect_exports.fnUntraced(function* (config2, path, claim2, follo
     }
     return yield* Effect_exports.fail(yield* failure({ status: response.status, json: json2 }, config2.root));
   }
-  let lines2 = response.stream.pipe(
+  const lines2 = response.stream.pipe(
+    Stream_exports.mapError((error2) => new Transient({ message: `The log stream broke: ${describe(error2.cause ?? error2)}` })),
+    Stream_exports.timeoutOrElse({
+      duration: follow ? timeouts.idle : timeouts.stalled,
+      orElse: () => Stream_exports.fail(new Transient({ message: follow ? "The log stream went quiet." : `The platform at ${config2.origin} stopped sending logs.` }))
+    }),
     Stream_exports.decodeText(),
-    Stream_exports.splitLines,
-    Stream_exports.mapError((error2) => new Transient({ message: `The log stream broke: ${describe(error2.cause ?? error2)}` }))
+    Stream_exports.splitLines
   );
-  if (follow) lines2 = lines2.pipe(Stream_exports.timeoutOrElse({ duration: IDLE, orElse: () => Stream_exports.fail(new Transient({ message: "The log stream went quiet." })) }));
   const fresh2 = printed.connection();
   yield* lines2.pipe(
     Stream_exports.filter((line) => line.trim() !== ""),
@@ -40050,7 +40241,7 @@ var logs = Effect_exports.fnUntraced(function* (config2, explicit, follow, limit
 var okApp = ok(App);
 var okJson = ok(JsonObject2);
 var okState = ok(StateChange);
-var time2 = (value4) => {
+var time3 = (value4) => {
   if (value4 === null || value4 === void 0) return void 0;
   const date = new Date(typeof value4 === "number" ? value4 : Date.parse(value4));
   return Number.isNaN(date.getTime()) ? String(value4) : date.toISOString();
@@ -40090,12 +40281,74 @@ var lifecycle = Effect_exports.fnUntraced(function* (config2, action, explicit,
   const result4 = yield* okState(config2, "POST", `/_api/apps/${enc(t.ref)}/${action}`, { claim: t.claim });
   yield* Console_exports.log(`${t.ref}: ${result4.state}`);
 });
+var explain = Effect_exports.fnUntraced(function* (config2, fn3, inputs, json2) {
+  const args2 = yield* parseCallArgs(inputs);
+  const t = yield* requireTarget(config2);
+  const report = yield* okJson(config2, "POST", `/_api/apps/${enc(t.ref)}/explain`, { body: { fn: fn3, args: args2 }, claim: t.claim });
+  if (json2) return yield* Console_exports.log(JSON.stringify(report, null, 2));
+  const scans = report.scans ?? [];
+  yield* Console_exports.log(`${fn3}: read ${String(report.rowsRead)} row${report.rowsRead === 1 ? "" : "s"} in ${scans.length} scan${scans.length === 1 ? "" : "s"} and returned ${String(report.returned)}`);
+  for (const s of scans) yield* Console_exports.log(`  ${s.table} via ${s.index} (${s.mode}): read ${s.rowsRead}, kept ${s.kept} of ${s.rows}`);
+  const suggestions = report.suggestions ?? [];
+  if (!suggestions.length) yield* Console_exports.log(c.dim("No index suggestions."));
+  for (const s of suggestions) yield* Console_exports.log(`${c.yellow("suggest")} ${s.message}`);
+});
+var profile = Effect_exports.fnUntraced(function* (config2, explicit, seconds2, out) {
+  const t = yield* requireTarget(config2, explicit);
+  yield* Console_exports.error(c.dim(`Profiling ${t.ref} for ${seconds2}s...`));
+  const result4 = yield* okJson(config2, "POST", `/_api/apps/${enc(t.ref)}/profile`, { body: { seconds: seconds2 }, claim: t.claim, timeout: Duration_exports.seconds(seconds2 + 30) });
+  const file2 = out ?? `${t.ref}-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}.cpuprofile`;
+  const fs = yield* FileSystem_exports.FileSystem;
+  yield* fs.writeFileString(file2, JSON.stringify(result4));
+  const nodes = new Map((result4.nodes ?? []).map((n) => [n.id, n]));
+  const counts = /* @__PURE__ */ new Map();
+  let busy = 0;
+  for (const id2 of result4.samples ?? []) {
+    const f = nodes.get(id2)?.callFrame;
+    if (!f || f.functionName === "(idle)" || f.functionName === "(root)") continue;
+    busy++;
+    const at = f.url ? ` ${f.url}:${f.lineNumber + 1}` : "";
+    const name = `${f.functionName || "(anonymous)"}${at}`;
+    counts.set(name, (counts.get(name) ?? 0) + 1);
+  }
+  const samples = (result4.samples ?? []).length;
+  yield* Console_exports.log(`${t.ref}: busy in ${busy} of ${samples} samples. Open ${file2} in Chrome DevTools (Performance > Load profile).`);
+  for (const [name, n] of [...counts].sort((a, b) => b[1] - a[1]).slice(0, 10)) {
+    yield* Console_exports.log(`  ${(100 * n / Math.max(busy, 1)).toFixed(1).padStart(5)}%  ${name}`);
+  }
+});
+var changes2 = Effect_exports.fnUntraced(function* (config2, since, limit) {
+  const t = yield* requireTarget(config2);
+  const response = yield* request3(config2, "GET", `/_api/apps/${enc(t.ref)}/changes?since=${since}&limit=${limit}`, { claim: t.claim });
+  const text2 = yield* response.text.pipe(Effect_exports.orElseSucceed(() => ""));
+  if (response.status >= 400) {
+    let json2 = { ok: false, error: text2.trim() || `HTTP ${response.status}` };
+    try {
+      json2 = JSON.parse(text2);
+    } catch {
+    }
+    return yield* Effect_exports.fail(yield* failure({ status: response.status, json: json2 }));
+  }
+  const lines2 = text2.split("\n").filter(Boolean);
+  for (const line of lines2) yield* Console_exports.log(line);
+  const head5 = Number(response.headers["x-eraspace-commit-seq"] ?? 0);
+  const last = lines2.length ? JSON.parse(lines2.at(-1)).seq : since;
+  const more = response.headers["x-eraspace-more"] === "1";
+  yield* Console_exports.error(c.dim(more ? `Latest commit ${head5}; continue with --since ${last}` : `Up to date at commit ${head5}`));
+});
+var undo = Effect_exports.fnUntraced(function* (config2, to, yes) {
+  const t = yield* requireTarget(config2);
+  if (!yes) return yield* fail12(`eraspace undo ${to} puts every row of ${t.ref} changed after commit ${to} back as it was. Re-run with --yes.`);
+  const result4 = yield* okJson(config2, "POST", `/_api/apps/${enc(t.ref)}/undo`, { body: { toSeq: to }, claim: t.claim });
+  const undone = Number(result4.undone ?? 0);
+  yield* Console_exports.log(undone ? `${t.ref}: restored ${undone} row${undone === 1 ? "" : "s"} to commit ${to} as commit ${String(result4.commitSeq)}` : `${t.ref}: nothing changed after commit ${to}`);
+});
 var listTokens = Effect_exports.fnUntraced(function* (config2) {
   const { tokens } = yield* ok(TokenList)(config2, "GET", "/_api/tokens");
   if (!tokens.length) yield* Console_exports.log("No tokens.");
   for (const t of tokens) {
     const scope3 = t.scope === "personal" ? "personal (all your apps)" : `${t.app ?? "?"} (${t.access ?? "?"})`;
-    const used = time2(t.lastUsedAt);
+    const used = time3(t.lastUsedAt);
     yield* Console_exports.log(`${t.id}  ${t.name}  ${scope3}  ${c.dim(used ? `last used ${used}` : "never used")}`);
   }
 });
@@ -40106,9 +40359,10 @@ var revokeToken = Effect_exports.fnUntraced(function* (config2, id2) {
 var createToken = Effect_exports.fnUntraced(function* (config2, name, opts) {
   if (opts.personal && opts.read) return yield* fail12("--read only applies to app tokens; personal tokens have full access to your apps.");
   const spec = opts.personal ? { name, personal: true } : { name, app: (yield* requireTarget(config2)).ref, access: opts.read ? "read" : "deploy" };
-  const { token } = yield* ok(CreatedToken)(config2, "POST", "/_api/tokens", { body: spec });
+  const { token, id: id2 } = yield* ok(CreatedToken)(config2, "POST", "/_api/tokens", { body: spec });
   yield* Console_exports.log(token);
   yield* Console_exports.error(c.dim(`Shown once. Use it as ERASPACE_TOKEN with ERASPACE_TOKEN_API=${config2.origin}.`));
+  yield* Console_exports.error(c.dim(`Token id ${id2}; revoke it with eraspace token revoke ${id2}.`));
 });
 function parseCallArgs(inputs) {
   const args2 = [];
@@ -40122,7 +40376,7 @@ Pass each argument as JSON, for example eraspace call send '"general"' '{"text":
   }
   return Effect_exports.succeed(args2);
 }
-var call = Effect_exports.fnUntraced(function* (config2, fn3, inputs) {
+var call2 = Effect_exports.fnUntraced(function* (config2, fn3, inputs) {
   const args2 = yield* parseCallArgs(inputs);
   const t = yield* requireTarget(config2);
   const { status, text: text2 } = yield* Effect_exports.gen(function* () {
@@ -40145,132 +40399,74 @@ import { basename as basename2, join as join7, relative as relative3, resolve as
 var TEMPLATES = ["chat", "todo", "poll"];
 var agents = (cli) => `# eraspace capsule: agent instructions
 
-This directory is one eraspace app ("capsule"): a TypeScript server running in V8, a Preact client, a
-Postgres-backed database with live queries, and hosting, all through the \`eraspace\` CLI. Treat this directory as the
-whole app. Build the requested app by editing the starter files, deploy it, verify it, and report the URL.
-
-## Commands
-
-Run these from this directory. There is nothing to install: the CLI bundles the SDK, Preact and TypeScript.
-
-- \`${cli} typecheck\`: tsc over \`server/\`, \`client/\` and \`shared/\`. Deploy does not typecheck.
-- \`${cli} deploy\`: build the client, compile the server and print the app URL.
-- \`${cli} call <fn> '<json arg>'...\`: call a query, mutation or action, e.g. \`call add '"milk"'\`.
-- \`${cli} logs\`: handler logs, \`ctx.log\` and \`console.log\` output.
-- \`${cli} inspect\`: deployed functions, schema and metadata.
-- \`${cli} dev\`: redeploy on every save (long-running; keep it open).
-
-The platform URL comes from \`ERASPACE_URL\`, then \`eraspace.json\`, then \`${DEFAULT_URL}\`.
+This directory is an eraspace app ("capsule"): a TypeScript server in V8 and a Preact client over a database with
+live queries, hosted and driven by \`${cli}\`, which supplies TypeScript, Preact and \`eraspace/*\`, so there is
+nothing to install.
 
 ## Workflow
 
-1. Read \`server/index.ts\` and \`client/index.tsx\`, then replace them with the requested app.
-2. Run \`${cli} typecheck\` and fix every error.
-3. Run \`${cli} deploy\`. Fix any compile errors it prints (they include file:line:column).
-4. Exercise every query and mutation with \`${cli} call ...\`, including one invalid input. Check
-   \`${cli} logs\` for errors.
-5. Report the URL printed by deploy. Open it in two tabs to see live updates.
-
-## Files
-
-- \`server/index.ts\` default-exports \`capsule({...})\` from \`eraspace/server\`. Other server files go in \`server/\`.
-- \`client/index.tsx\` default-exports \`function App()\`. The CLI mounts it. Other client files go in \`client/\`.
-- \`shared/\` holds pure TypeScript used by both sides (no DOM, no env, no eraspace runtime imports).
-- \`client/styles.css\` plus Tailwind utility classes in JSX. Write complete class names.
-- \`.env.eraspace.server\` holds server secrets, read as \`ctx.env.KEY\`. Never import it from client code.
-- There is no package.json, tsconfig.json or node_modules, and none is needed. Do not add them.
-
-## Server API (\`eraspace/server\`)
-
-\`\`\`ts
-import { capsule, table, query, mutation, action, endpoint, string, number, boolean, id, array, object, any, json, text } from "eraspace/server";
-
-export default capsule({
-  schema: {
-    items: table({ title: string(), done: boolean().default(false), listId: id("lists"), tags: array(string()).optional() })
-      .index("by_list", ["listId"]),
-    lists: table({ name: string() }),
-  },
-  queries: {
-    items: query(async (ctx, listId: string) =>
-      ctx.db.items.withIndex("by_list", (q) => q.eq("listId", listId)).order("desc").take(100)),
-  },
-  mutations: {
-    add: mutation(async (ctx, listId: string, title: string) => {
-      const clean = title.trim();
-      if (!clean) throw new Error("Title is required.");   // the message reaches the client
-      return ctx.db.items.insert({ listId, title: clean });
-    }),
-  },
-  actions: {
-    summary: action(async (ctx) => {
-      const rows = await ctx.runQuery("items", "some-list");
-      return rows.length;
-    }),
-  },
-  endpoints: {
-    health: endpoint({ method: "GET", path: "/health", readOnly: true }, async (ctx, req) => json({ ok: true })),
-  },
-});
-\`\`\`
-
-- Field validators: \`string() number() boolean() id("table") userId() any() array(v) object({...})\`, each with
-  \`.optional()\` or \`.default(value)\`. Rows always have \`id\` (string) and \`createdAt\` (epoch ms).
-- \`ctx.db.<table>\`: \`insert(doc)\` returns the id, \`get(id)\` returns the row or null, \`update(id, partial)\`
-  (\`null\` removes a field), \`replace(id, doc)\`, \`delete(id)\`. Reads chain \`withIndex(name, q => q.eq(f, v).gt(...))\`,
-  \`order("asc" | "desc")\`, then \`collect()\`, \`take(n)\`, \`first()\`, \`unique()\`, \`count()\` or
-  \`paginate({ cursor, numItems })\`. Every table has an implicit \`by_creation\` index. Await every db call.
-- Queries and actions have a read-only db. Write in mutations or writable endpoints. Actions can call
-  \`ctx.runQuery\`, \`ctx.runMutation\` and global \`fetch\`.
-- Handler arguments are positional and not validated. Check them in the handler.
-- \`ctx.auth.userId\` is a per-connection guest id that changes on reload. It is not a login: never use it for
-  ownership or access control. Every app is public.
-- \`ctx.log.info(msg, data?)\` (also debug/warn/error) writes to \`eraspace logs\`.
-- Endpoints receive \`req\` with \`method, path, url, headers.get(), query.get(), json(), text()\` and return
-  \`json(value)\`, \`text(string)\`, \`empty()\`, \`redirect(url)\` or a plain value (sent as JSON).
-- Removing a populated table needs its row count confirmed: \`${cli} deploy --delete-table <table>=<rows>\` (the
-  refused deploy prints the exact flag). Deletion runs in background batches.
-- Changing a field's type or making it required fails the deploy while stored rows do not match; migrate them first.
-
-## Client API (\`eraspace/client\`)
-
-\`\`\`tsx
-import { createClient } from "eraspace/client";
-import { useState } from "preact/hooks";
-import type app from "../server/index";
-
-const client = createClient<typeof app>({ reloadOnDeploy: true });
-
-export default function App() {
-  const items = client.useQuery("items", "some-list");   // undefined while loading, then live
-  const add = client.useMutation("add");
-  const [title, setTitle] = useState("");
-  if (items === undefined) return <p>Loading\u2026</p>;
-  return <main class="p-6">
-    <form onSubmit={async (e) => { e.preventDefault(); await add("some-list", title); setTitle(""); }}>
-      <input value={title} onInput={(e) => setTitle(e.currentTarget.value)} />
-    </form>
-    <ul>{items.map((item) => <li key={item.id}>{item.title}</li>)}</ul>
-  </main>;
-}
-\`\`\`
-
-- Query, mutation and action names, arguments and results are typed from the server. Import the server with
-  \`import type\` only.
-- Optimistic updates: \`client.useMutation("vote", { optimistic(store, id) { store.update("results", [],
-  (rows) => rows.map((r) => (r.id === id ? { ...r, votes: r.votes + 1 } : r))) } })\`. The second argument of
-  \`store.update\` is the query's argument list.
-- \`useAction(name)\`, \`usePaginatedQuery(name, args, { initialNumItems })\`, \`client.query/mutation/action(...)\`.
-- Realtime rooms, not stored: \`const room = client.useRoom(name, meta)\` gives \`room.presence\`,
-  \`room.broadcast(event, payload)\` and \`room.on(event, cb)\` (call \`on\` inside \`useEffect\` and return its
-  cleanup). \`client.usePresence(name, meta)\` returns just the members.
-- Files: see "File uploads" below.
-- Pages: \`Router\`, \`Route\`, \`Link\`, \`useLocation\`, \`useNavigate\`, \`useParams\` from \`eraspace/client\`.
-- Client imports are limited to \`eraspace/client\`, \`preact\`, \`preact/hooks\`, \`@preact/signals\` and relative files.
+1. Read \`CODING_STANDARDS.md\`, \`server/index.ts\` and \`client/index.tsx\`.
+2. Write the requested app or change.
+3. Run \`${cli} typecheck\` until it prints "No type errors."
+4. Run \`${cli} deploy\` until it prints the app URL. Pass \`--delete-table\` only for rows the user agreed to lose.
+5. Run \`${cli} call <fn> '<json arg>'...\` on every query, mutation and action, and on an invalid input for each
+   mutation that takes arguments, until each returns what the code intends and each invalid input is refused with
+   its message; then \`${cli} logs\` shows no unexpected error.
+6. Once steps 3 to 5 pass after your last edit, report the URL. For an unclaimed app, also report the expiry deploy
+   printed and that \`${cli} auth login\` then \`${cli} claim\` keeps the app.
+`;
+var CODING_STANDARDS = `# eraspace capsule: coding standards
+
+Before using one of these features, read its section in \`FEATURES.md\`: file uploads, rooms and presence, routing,
+optimistic updates, pagination, scheduled mutations, HTTP endpoints, reload on deploy.
+
+## Security
+
+- Every caller is an anonymous guest and every app is public. \`ctx.auth.userId\` is a guest id that changes with
+  each connection, so it never grants ownership or access.
+- Keep secrets in \`.env.eraspace.server\` as \`KEY=value\` lines and read them in server code as \`ctx.env.KEY\`:
+  \`client/\` and \`shared/\` ship to the browser.
+
+## Server (\`eraspace/server\`)
+
+- Fields: \`string() number() boolean() id("table") userId() any() array(field) object({...})\`, each with
+  \`.optional()\` or \`.default(value)\`. Rows also have \`id\` and \`createdAt\` (epoch ms).
+- \`ctx.db.<table>\` has \`insert\`, \`get\`, \`update(id, partial)\` (\`null\` removes a field), \`replace\` and
+  \`delete\`. Reads chain \`withIndex\`, \`order("asc" | "desc")\`, then \`collect()\`, \`take(n)\`, \`first()\`,
+  \`unique()\`, \`count()\` or \`paginate(...)\`.
+- Declare an index with \`table({...}).index("by_list", ["listId"])\` and read it with
+  \`ctx.db.items.withIndex("by_list", (q) => q.eq("listId", id))\`, then \`.gt(...)\` or \`.lt(...)\` on the next
+  field. \`by_creation\` indexes every table by \`createdAt\`.
+- Validate every argument in the handler: arguments are positional, come from anyone and are not checked against
+  their TypeScript types.
+- A query is a live query: its cached result is reused until rows it read change, then rerun and pushed to
+  subscribers. Make it depend only on its arguments, its caller and the rows it reads: pass a time it needs as an
+  argument, rounded so it stays the same across renders, and draw random values in mutations.
+- Mutations run one at a time per app, so a read-then-write in one mutation never races another.
+- Actions call outbound \`fetch\`, \`ctx.runQuery\`, \`ctx.runMutation\` and \`ctx.runAction\`: fetch in an action
+  and save the result with \`ctx.runMutation\`.
+- Rows and results are JSON: keep times as epoch-ms numbers, as \`createdAt\` is.
+- Keep state in the database: module variables reset whenever the app unloads.
+- Handlers have CPU, wall-clock and heap limits: keep loops and reads bounded.
+- A \`.migrate\` upgrade is a pure function of the stored row.
+
+## Client (\`eraspace/client\`)
+
+- \`client.useQuery(name, ...args)\` subscribes to a live query: \`undefined\` while loading, then every new result,
+  so mutations need no refetch.
+- \`client.useAction(name)\` returns a function, as \`useMutation\` does. Outside components, call \`client.query\`,
+  \`client.mutation\` or \`client.action(name, ...args)\`.
+- Style with Tailwind utility classes, each written as a complete literal, and \`client/styles.css\`.
+
+## Shared code
+
+- Keep \`shared/\` to types, constants and pure functions, which both the browser and the server can run.
+`;
+var FEATURES = `# eraspace capsule: features
 
 ## File uploads
 
-Files go to the app's bucket, not the database. Save the returned \`FileRef\` in a row, then preview it.
+Files live in app storage, not the database: a row saves the \`FileRef\` an upload returns.
 
 \`\`\`tsx
 // server/index.ts: declare the file in the schema and copy its fields in the mutation (extra fields are refused).
@@ -40290,34 +40486,93 @@ const addPhoto = client.useMutation("addPhoto");
 - \`<FileUpload>\` is a drop zone and file picker with progress and error text. Props: \`accept\`, \`multiple\`,
   \`maxBytes\`, \`disabled\`, \`class\` (replaces its default style; \`data-dragging\` is set during a drag) and
   children for the label. \`onUpload(file)\` runs once per stored file; if it throws, the file is deleted again.
-- \`<FilePreview file={fileRef or key}>\` shows images, video and audio inline, plain text in a frame, and other
-  types (PDF, zip...) as a download card. \`caption={false}\` hides the name/size line; \`class\` replaces its style.
-  Pass the saved \`FileRef\`: a bare key costs a metadata request per preview.
-- Custom UI: \`const { upload, uploading, progress, error } = client.useUpload({ accept, maxBytes, onUpload })\`,
-  then \`upload(input.files)\`. Lower level: \`client.storage.upload(blob, { onProgress })\`, \`.url(key)\`,
-  \`.info(key)\` and \`.delete(key)\`.
+- \`<FilePreview file={fileRef}>\` shows images, video and audio inline, plain text in a frame, and other types as a
+  download card. Pass it the saved \`FileRef\`: a bare key costs a metadata request per preview. \`caption={false}\`
+  hides the name/size line; \`class\` replaces its style.
+- Custom UI: \`const { upload, uploading, progress, error, file } = client.useUpload({ accept, maxBytes, onUpload })\`,
+  then \`upload(input.files)\`; \`file\` is the Blob uploading now. Lower level: \`client.storage.upload(blob, { onProgress })\`,
+  \`.url(key)\`, \`.localUrl(key)\`, \`.info(key)\` and \`.delete(key)\`.
+- Up to 5 MiB per file and 100 MiB per app.
 - \`accept\` and \`maxBytes\` are checked in the browser only; the server stores any type up to its limit.
-- Up to 5 MiB per file and 100 MiB per app. Anyone with a key can read or delete that file; never upload secrets.
+- Anyone with a file's key can read that file, so upload only what may be public. The \`deleteToken\` that
+  \`client.storage.upload\` returns lets its holder delete the file: keep it out of rows.
+
+## Rooms and presence
+
+Rooms are realtime and never stored. \`const room = client.useRoom(name, meta)\` gives:
+
+- \`room.presence\`, the members with their \`meta\`, and \`room.self\`, this connection's id.
+- \`room.broadcast(event, payload)\` and \`room.on(event, (payload, from) => ...)\`. Call \`on\` inside \`useEffect\`
+  and return its cleanup.
+- \`room.state\`, shared by the members and set with \`room.setState(key, value)\`. It vanishes when the room
+  empties: save what must last with a mutation.
 
-## Server execution
+\`client.usePresence(name, meta)\` returns just the members.
 
-Server TypeScript is transformed with oxc and runs as ES modules in V8. JavaScript language features such as
-classes, closures, async/await, generators, getters, private fields, Proxy, Reflect and BigInt use V8 semantics.
-Values crossing the database or RPC boundary must be JSON-compatible.
+## Routing
 
-- Imports support relative deployed files and \`eraspace/server\`. npm packages, Node built-ins and dynamic
-  \`import()\` are unavailable. Apps need no installed server dependencies.
-- The host supplies \`fetch\`, \`URL\`, \`Headers\`, \`Request\`, \`Response\`, \`crypto.randomUUID\`,
-  \`TextEncoder\`, \`TextDecoder\`, timers and \`console\`.
-- Persist state in the database. Module state is not durable and resets when an app unloads or a worker restarts.
-- Await database calls. Mutations run through one writer per app and reply after their Postgres commit.
-- Handlers have CPU, wall-clock and heap limits. Keep loops and reads bounded.
-- Outbound fetch is available to claimed apps in actions and read-only endpoints. Private addresses are blocked.
+\`\`\`tsx
+import { Router, Route, Link, useParams, useNavigate } from "eraspace/client";
+
+<Router>
+  <Route path="/" component={Home} />
+  <Route path="/items/:id" component={Item} />   {/* Item reads useParams().id */}
+  <Route default component={NotFound} />
+</Router>
+\`\`\`
+
+Paths are app-relative: the app is served under \`/<app>/\`, and every path below it loads the app. Link with
+\`<Link to="/items/1">\` and navigate with \`useNavigate()("/items/1")\`, which add that base. \`useLocation()\`
+gives the current \`path\` and \`url\`.
+
+## Optimistic updates
 
-## Deploys without an account
+\`client.useMutation("vote", { optimistic(store, id) { store.update("results", [], (rows) => rows.map((r) =>
+(r.id === id ? { ...r, votes: r.votes + 1 } : r))) } })\`. The second argument of \`store.update\` is the query's
+argument list.
 
-A deploy without sign-in creates a temporary app and saves its claim token in \`.eraspace/\` (git-ignored). It has no
-server env or outbound fetch and expires after about a week. \`eraspace auth login\` then \`eraspace claim\` keeps it.
+## Pagination
+
+\`\`\`ts
+// server: the query takes PaginationOptions last and returns paginate(); cap numItems, which the client chooses.
+feed: query(async (ctx, listId: string, page: PaginationOptions) =>
+  ctx.db.items.withIndex("by_list", (q) => q.eq("listId", listId)).order("desc")
+    .paginate({ cursor: page.cursor, numItems: Math.min(page.numItems, 50) })),
+
+// client
+const { results, status, loadMore } = client.usePaginatedQuery("feed", ["some-list"], { initialNumItems: 20 });
+\`\`\`
+
+\`PaginationOptions\` comes from \`eraspace/server\`. \`status\` is \`"LoadingFirstPage"\`, \`"CanLoadMore"\`,
+\`"LoadingMore"\` or \`"Exhausted"\`; \`loadMore(n?)\` fetches the next page.
+
+## Scheduled mutations
+
+Mutations and writable endpoints run a mutation later with \`ctx.scheduler.runAfter(ms, "mutationName", ...args)\`,
+which returns a job id. The job commits with the mutation that schedules it, and its run commits at most once. For
+recurring work, the scheduled mutation schedules its next run.
+
+## HTTP endpoints
+
+\`\`\`ts
+import { endpoint, json } from "eraspace/server";
+
+endpoints: {
+  health: endpoint({ method: "GET", path: "/health", readOnly: true }, async (ctx, req) => json({ ok: true })),
+},
+\`\`\`
+
+- An endpoint is served at \`/<app>/<path>\`. \`readOnly: true\` gives it a read-only db; otherwise it writes like a
+  mutation.
+- \`req\` has \`method, path, url, headers.get(), query.get(), json(), text(), bytes(), formData()\`. Return
+  \`json(value)\`, \`text(string)\`, \`empty()\`, \`redirect(url)\` (each takes \`{ status, headers }\` last) or a
+  plain value (sent as JSON).
+- Endpoints are public: authenticate a webhook by checking its signature with \`crypto.subtle\`.
+
+## Reload on deploy
+
+Open tabs reload by themselves after each deploy. Pass \`createClient({ reloadOnDeploy: false })\` to keep the page
+and react to \`client.onDeployed(version => ...)\` instead.
 `;
 var GITIGNORE = [".eraspace/", ".env.eraspace.server"];
 var keepsOnInit = (name) => name.startsWith(".") || /^(README|LICENSE)(\.|$)/i.test(name);
@@ -40347,6 +40602,8 @@ var createCapsule = Effect_exports.fnUntraced(function* (directory, template, mo
     const files = {
       "eraspace.json": JSON.stringify({ name: app }, null, 2) + "\n",
       "AGENTS.md": agents(command2),
+      "CODING_STANDARDS.md": CODING_STANDARDS,
+      "FEATURES.md": FEATURES,
       "CLAUDE.md": "@AGENTS.md\n"
     };
     const gitignore = join7(destination, ".gitignore");
@@ -40446,7 +40703,7 @@ var config = Effect_exports.gen(function* () {
   return yield* loadConfig({ dir: value3(flags.dir), app: value3(flags.app), url: value3(flags.url) });
 });
 var deployFlags = {
-  name: optionalString("name", "Exact name for a new app, failing if it is taken (default: the eraspace.json or directory name, or a free variant of it)"),
+  name: optionalString("name", "Exact name for a new app, failing if it is taken (default: the eraspace.json or directory name, or a free variant of it). A redeploy refuses it; use eraspace names add"),
   publicInspect: Flag_exports.Boolean("public-inspect").pipe(Flag_exports.withDefault(false), Flag_exports.withDescription("Let anyone read this app's inspection data and logs"))
 };
 var deployOptions = (input) => ({ name: value3(input.name), publicInspect: input.publicInspect });
@@ -40456,6 +40713,16 @@ var deleteTableFlag = {
     Flag_exports.optional
   )
 };
+var shadowFlags = {
+  shadow: Flag_exports.Boolean("shadow").pipe(
+    Flag_exports.withDefault(false),
+    Flag_exports.withDescription("Before installing, rerun the app's live queries on the new code and report which results change or start throwing")
+  ),
+  failOnQueryErrors: Flag_exports.Boolean("fail-on-query-errors").pipe(
+    Flag_exports.withDefault(false),
+    Flag_exports.withDescription("Like --shadow, but refuse the deploy if a live query that returns a value now would throw")
+  )
+};
 var browserFlag = {
   browser: Flag_exports.Boolean("browser").pipe(Flag_exports.withDefault(true), Flag_exports.withDescription("Open the sign-in page in a browser; --no-browser only prints the URL"))
 };
@@ -40479,11 +40746,43 @@ var typecheckCommand = Command_exports.make("typecheck", {}, () => Effect_export
 );
 var deployCommand = Command_exports.make(
   "deploy",
-  { ...deployFlags, ...deleteTableFlag },
-  (input) => Effect_exports.flatMap(config, (c2) => deploy(c2, { ...deployOptions(input), deleteTables: value3(input.deleteTable) }))
+  { ...deployFlags, ...deleteTableFlag, ...shadowFlags },
+  (input) => Effect_exports.flatMap(
+    config,
+    (c2) => deploy(c2, { ...deployOptions(input), deleteTables: value3(input.deleteTable), shadow: input.shadow, failOnQueryErrors: input.failOnQueryErrors })
+  )
 ).pipe(
   Command_exports.withDescription("Build and deploy. Without a login this creates a temporary unclaimed app."),
-  Command_exports.withExamples([{ command: "eraspace deploy --delete-table drafts=12", description: "Deploy a schema without drafts, deleting its 12 rows" }])
+  Command_exports.withExamples([
+    { command: "eraspace deploy --delete-table drafts=12", description: "Deploy a schema without drafts, deleting its 12 rows" },
+    { command: "eraspace deploy --fail-on-query-errors", description: "Deploy only if no live query starts throwing on the new code" }
+  ])
+);
+var deploysCommand = Command_exports.make(
+  "deploys",
+  { app: optionalArg("app", "App name or id (default: this checkout's app)") },
+  ({ app }) => Effect_exports.flatMap(config, (c2) => deploys(c2, value3(app)))
+).pipe(Command_exports.withDescription("List the latest 50 kept versions you can roll back to, newest first"));
+var rollbackCommand = Command_exports.make(
+  "rollback",
+  {
+    version: Argument_exports.Int("version").pipe(
+      Argument_exports.withDescription("Version to roll back to (default: the newest kept version below the one serving)"),
+      Argument_exports.optional
+    ),
+    ...deleteTableFlag,
+    ...shadowFlags
+  },
+  (input) => Effect_exports.flatMap(
+    config,
+    (c2) => rollback(c2, value3(input.version), { deleteTables: value3(input.deleteTable), shadow: input.shadow, failOnQueryErrors: input.failOnQueryErrors })
+  )
+).pipe(
+  Command_exports.withDescription("Deploy an earlier version's server code, client files and server env again, as a new version"),
+  Command_exports.withExamples([
+    { command: "eraspace rollback", description: "Go back to the version before the one serving" },
+    { command: "eraspace rollback 3", description: "Serve version 3's code again" }
+  ])
 );
 var devCommand = Command_exports.make("dev", deployFlags, (input) => Effect_exports.flatMap(config, (c2) => dev(c2, deployOptions(input)))).pipe(
   Command_exports.withDescription("Deploy, then redeploy whenever server/, client/, shared/ or .env.eraspace.server change")
@@ -40491,14 +40790,38 @@ var devCommand = Command_exports.make("dev", deployFlags, (input) => Effect_expo
 var callCommand = Command_exports.make(
   "call",
   {
-    fn: Argument_exports.String("fn").pipe(Argument_exports.withDescription("Query or mutation name")),
+    fn: Argument_exports.String("fn").pipe(Argument_exports.withDescription("Query, mutation or action name")),
     args: Argument_exports.String("json").pipe(Argument_exports.withDescription("Arguments, each one a JSON value"), Argument_exports.variadic())
   },
-  ({ fn: fn3, args: args2 }) => Effect_exports.flatMap(config, (c2) => call(c2, fn3, args2))
+  ({ fn: fn3, args: args2 }) => Effect_exports.flatMap(config, (c2) => call2(c2, fn3, args2))
 ).pipe(
   Command_exports.withDescription("Call a handler with positional JSON arguments"),
   Command_exports.withExamples([{ command: `eraspace call messages '"general"'`, description: "Strings are JSON too, so quote them" }])
 );
+var profileCommand = Command_exports.make(
+  "profile",
+  {
+    app: optionalArg("app", "App name or id (default: this checkout's app)"),
+    seconds: Flag_exports.Int("seconds").pipe(Flag_exports.filter((n) => n >= 1 && n <= 60, (n) => `--seconds must be between 1 and 60, got ${n}`), Flag_exports.withDefault(10), Flag_exports.withDescription("How long to sample")),
+    out: optionalString("out", "Where to write the .cpuprofile (default: <app>-<time>.cpuprofile)")
+  },
+  ({ app, seconds: seconds2, out }) => Effect_exports.flatMap(config, (c2) => profile(c2, value3(app), seconds2, value3(out)))
+).pipe(
+  Command_exports.withDescription("Sample the app's server CPU time and write a .cpuprofile that opens in Chrome DevTools against the TypeScript sources"),
+  Command_exports.withExamples([{ command: "eraspace profile my-app --seconds 10", description: "Profile while you exercise the app" }])
+);
+var explainCommand = Command_exports.make(
+  "explain",
+  {
+    fn: Argument_exports.String("fn").pipe(Argument_exports.withDescription("Query name")),
+    args: Argument_exports.String("json").pipe(Argument_exports.withDescription("Arguments, each one a JSON value"), Argument_exports.variadic()),
+    json: Flag_exports.Boolean("json").pipe(Flag_exports.withDefault(false), Flag_exports.withDescription("Print the full report as JSON"))
+  },
+  ({ fn: fn3, args: args2, json: json2 }) => Effect_exports.flatMap(config, (c2) => explain(c2, fn3, args2, json2))
+).pipe(
+  Command_exports.withDescription("Run a query once and suggest indexes for rows it filters in JavaScript"),
+  Command_exports.withExamples([{ command: `eraspace explain todosByStatus '"done"'`, description: "Strings are JSON too, so quote them" }])
+);
 var logsCommand = Command_exports.make(
   "logs",
   {
@@ -40543,15 +40866,40 @@ var inspectionCommand = Command_exports.make(
   },
   ({ visibility, app }) => Effect_exports.flatMap(config, (c2) => inspection(c2, visibility, value3(app)))
 ).pipe(Command_exports.withDescription("Open or close inspection and logs to everyone"));
-var yesFlag = Flag_exports.Boolean("yes").pipe(Flag_exports.withAlias("y"), Flag_exports.withDefault(false), Flag_exports.withDescription("Confirm"));
-var lifecycleCommand = (action, description) => Command_exports.make(
-  action,
+var lifecycleApp = optionalArg("app", "App name or id (default: this checkout's app)");
+var lifecycleCommand = (action, description) => Command_exports.make(action, { app: lifecycleApp }, ({ app }) => Effect_exports.flatMap(config, (c2) => lifecycle(c2, action, value3(app), false))).pipe(
+  Command_exports.withDescription(description)
+);
+var changesCommand = Command_exports.make(
+  "changes",
   {
-    app: optionalArg("app", "App name or id (default: this checkout's app)"),
-    yes: yesFlag
+    since: Flag_exports.Int("since").pipe(Flag_exports.filter((n) => n >= 0, (n) => `--since must be a commit number, got ${n}`), Flag_exports.withDefault(0), Flag_exports.withDescription("Print changes committed after this commit")),
+    limit: Flag_exports.Int("limit").pipe(Flag_exports.filter((n) => n >= 1 && n <= 1e4, (n) => `--limit must be between 1 and 10000, got ${n}`), Flag_exports.withDefault(1e3), Flag_exports.withDescription("Rows to print at most (whole commits)"))
+  },
+  ({ since, limit }) => Effect_exports.flatMap(config, (c2) => changes2(c2, since, limit))
+).pipe(
+  Command_exports.withDescription("Print recent committed row changes as NDJSON (the change log keeps 24 hours by default)"),
+  Command_exports.withExamples([{ command: "eraspace changes --since 120 | jq .", description: "Changes committed after commit 120" }])
+);
+var undoCommand = Command_exports.make(
+  "undo",
+  {
+    to: Argument_exports.Int("commit").pipe(Argument_exports.withDescription("Commit number to restore rows to")),
+    yes: Flag_exports.Boolean("yes").pipe(Flag_exports.withAlias("y"), Flag_exports.withDefault(false), Flag_exports.withDescription("Confirm the undo"))
+  },
+  ({ to, yes }) => Effect_exports.flatMap(config, (c2) => undo(c2, to, yes))
+).pipe(
+  Command_exports.withDescription("Put every row changed after a commit back as it was; needs --yes. The undo is a commit too, so it can be undone"),
+  Command_exports.withExamples([{ command: "eraspace undo 120 --yes", description: "Revert everything committed after commit 120" }])
+);
+var terminateCommand = Command_exports.make(
+  "terminate",
+  {
+    app: lifecycleApp,
+    yes: Flag_exports.Boolean("yes").pipe(Flag_exports.withAlias("y"), Flag_exports.withDefault(false), Flag_exports.withDescription("Confirm that the app stops permanently"))
   },
-  ({ app, yes }) => Effect_exports.flatMap(config, (c2) => lifecycle(c2, action, value3(app), yes))
-).pipe(Command_exports.withDescription(description));
+  ({ app, yes }) => Effect_exports.flatMap(config, (c2) => lifecycle(c2, "terminate", value3(app), yes))
+).pipe(Command_exports.withDescription("Stop permanently (data kept, no more deploys); needs --yes"));
 var tokenCommand = Command_exports.make("token").pipe(
   Command_exports.withDescription("Create, list and revoke API tokens"),
   Command_exports.withSubcommands([
@@ -40583,8 +40931,12 @@ var command = eraspace.pipe(
     initCommand,
     typecheckCommand,
     deployCommand,
+    deploysCommand,
+    rollbackCommand,
     devCommand,
     callCommand,
+    explainCommand,
+    profileCommand,
     logsCommand,
     inspectCommand,
     authCommand,
@@ -40594,7 +40946,9 @@ var command = eraspace.pipe(
     inspectionCommand,
     lifecycleCommand("archive", "Stop serving and keep the data"),
     lifecycleCommand("restore", "Serve an archived app again"),
-    lifecycleCommand("terminate", "Stop permanently (data kept, no more deploys); needs --yes"),
+    terminateCommand,
+    changesCommand,
+    undoCommand,
     tokenCommand,
     ...hidden
   ])