percher 0.5.20 → 0.5.21

package/dist/bin/percher.js

@@ -2511,7 +2511,9 @@ class AppsResource {
   }
   async deploy(id, input) {
     const params = new URLSearchParams;
-    if (input.type === "preview")
+    if (input.check)
+      params.set("check", "1");
+    else if (input.type === "preview")
       params.set("type", "preview");
     if (input.note)
       params.set("note", input.note);
@@ -2536,7 +2538,9 @@ class AppsResource {
     params.set("runtime", input.runtime);
     if (input.framework)
       params.set("framework", input.framework);
-    if (input.type === "preview")
+    if (input.check)
+      params.set("check", "1");
+    else if (input.type === "preview")
       params.set("type", "preview");
     if (input.note)
       params.set("note", input.note);
@@ -2550,8 +2554,8 @@ class AppsResource {
   promotePreview(appRef, deployId) {
     return this.http.post(`/apps/${encodeURIComponent(appRef)}/deploys/${encodeURIComponent(deployId)}/promote`, {});
   }
-  rerunDeploy(appRef, deployId) {
-    return this.http.post(`/apps/${encodeURIComponent(appRef)}/deploys/${encodeURIComponent(deployId)}/rerun`, {});
+  rerunDeploy(appRef, deployId, opts) {
+    return this.http.post(`/apps/${encodeURIComponent(appRef)}/deploys/${encodeURIComponent(deployId)}/rerun`, opts?.noCache ? { noCache: true } : {});
   }
   deployLatestCommit(appRef, input) {
     return this.http.post(`/apps/${encodeURIComponent(appRef)}/deploys/from-latest-commit`, input ?? {});
@@ -2681,6 +2685,15 @@ class AppsResource {
       commitSha
     });
   }
+  async lastGoodVersion(appRef) {
+    try {
+      return await this.http.get(`/apps/${encodeURIComponent(appRef)}/rollback/last-good`);
+    } catch (err) {
+      if (err instanceof PercherApiError && err.status === 404)
+        return null;
+      throw err;
+    }
+  }
   getChanges(appRef, opts = {}) {
     const params = new URLSearchParams;
     if (opts.base)
@@ -2893,6 +2906,10 @@ class DataResource {
 }
 
 // ../client/dist/resources/env.js
+function scopeQuery(opts) {
+  return opts?.scope && opts.scope !== "all" ? `?scope=${opts.scope}` : "";
+}
+
 class EnvResource {
   http;
   constructor(http) {
@@ -2901,11 +2918,15 @@ class EnvResource {
   list(appId) {
     return this.http.get(`/apps/${encodeURIComponent(appId)}/env`);
   }
-  set(appId, values) {
-    return this.http.put(`/apps/${encodeURIComponent(appId)}/env`, values);
+  async listDetailed(appId) {
+    const res = await this.http.get(`/apps/${encodeURIComponent(appId)}/env?detail=1`);
+    return res.detailed;
   }
-  unset(appId, key) {
-    return this.http.delete(`/apps/${encodeURIComponent(appId)}/env/${encodeURIComponent(key)}`);
+  set(appId, values, opts) {
+    return this.http.put(`/apps/${encodeURIComponent(appId)}/env${scopeQuery(opts)}`, values);
+  }
+  unset(appId, key, opts) {
+    return this.http.delete(`/apps/${encodeURIComponent(appId)}/env/${encodeURIComponent(key)}${scopeQuery(opts)}`);
   }
 }
 
@@ -2949,6 +2970,24 @@ class ExportResource {
   }
 }
 
+// ../client/dist/resources/hooks.js
+class HooksResource {
+  http;
+  constructor(http) {
+    this.http = http;
+  }
+  create(appId, name) {
+    return this.http.post(`/apps/${encodeURIComponent(appId)}/hooks`, { name });
+  }
+  async list(appId) {
+    const res = await this.http.get(`/apps/${encodeURIComponent(appId)}/hooks`);
+    return res.hooks;
+  }
+  revoke(appId, hookId) {
+    return this.http.delete(`/apps/${encodeURIComponent(appId)}/hooks/${encodeURIComponent(hookId)}`);
+  }
+}
+
 // ../client/dist/sse.js
 async function* parseSseStream(stream, signal) {
   const reader = stream.getReader();
@@ -3213,6 +3252,7 @@ class PercherClient {
   env;
   envScan;
   export;
+  hooks;
   logs;
   auth;
   billing;
@@ -3243,6 +3283,7 @@ class PercherClient {
     this.env = new EnvResource(http);
     this.envScan = new EnvScanResource(http);
     this.export = new ExportResource(http);
+    this.hooks = new HooksResource(http);
     this.logs = new LogsResource(http);
     this.auth = new AuthResource(http);
     this.billing = new BillingResource(http);
@@ -105906,9 +105947,39 @@ var webSchema = exports_external.object({
   port: exports_external.number().int().min(1024).max(65535),
   health: exports_external.string().optional(),
   command: exports_external.string().min(1).max(1000).optional(),
+  visibility: exports_external.enum(["public", "password", "private"]).optional(),
   password: exports_external.boolean().optional(),
-  spa: exports_external.boolean().optional()
-}).strict();
+  spa: exports_external.boolean().optional(),
+  rate_limit: exports_external.object({
+    rps: exports_external.number().int().min(1).max(100),
+    burst: exports_external.number().int().min(1).max(1000)
+  }).strict().optional()
+}).strict().superRefine((web, ctx) => {
+  if (web.visibility === "public" && web.password === true) {
+    ctx.addIssue({
+      code: exports_external.ZodIssueCode.custom,
+      path: ["visibility"],
+      message: `password = true implies visibility "password" — don't set visibility = "public" alongside it`
+    });
+  }
+  if (web.rate_limit) {
+    const { rps, burst } = web.rate_limit;
+    if (burst < rps) {
+      ctx.addIssue({
+        code: exports_external.ZodIssueCode.custom,
+        path: ["rate_limit", "burst"],
+        message: `rate_limit.burst (${burst}) must be >= rate_limit.rps (${rps}) — a burst below the sustained rate is nonsense`
+      });
+    }
+    if (burst > rps * 10) {
+      ctx.addIssue({
+        code: exports_external.ZodIssueCode.custom,
+        path: ["rate_limit", "burst"],
+        message: `rate_limit.burst (${burst}) must be <= 10× rate_limit.rps (${rps * 10})`
+      });
+    }
+  }
+});
 var convexConfigSchema = exports_external.object({
   deployment_url: exports_external.string().url()
 }).strict();
@@ -108168,6 +108239,11 @@ async function buildFailureError(ctx, app, deployment, signal) {
 async function classifyDeploymentFailure(opts) {
   const { ctx, app, deployment, publishInput } = opts;
   const error48 = await buildFailureError(ctx, app, deployment, opts.signal);
+  const isLiveDeploy = deployment.type !== "preview";
+  if (isLiveDeploy && (app.status === "live" || app.status === "sleeping")) {
+    error48.suggestion = `${error48.suggestion}
+To return to the last version that ran cleanly: \`bunx percher rollback --last-good\`.`;
+  }
   const recovery = error48.errorClass ? recoveryFromErrorClass(error48.errorClass, {
     missingEnvVars: error48.missingEnvVars,
     deployId: deployment.id,
@@ -108275,7 +108351,7 @@ async function deploysInspect(ctx, input) {
       throw err;
     }
   }
-  return { deploy, buildLog };
+  return { deploy, buildLog, events: deploy.events ?? [] };
 }
 // ../core/dist/commands/dev.js
 import { existsSync as existsSync8 } from "node:fs";
@@ -108776,6 +108852,17 @@ async function waitForDeploy(ctx, input, opts) {
         summary
       };
     }
+    if (deployment.isCheck && deployment.checkPassed) {
+      return {
+        status: "check_passed",
+        app: { id: app.id, name: app.name, url: app.url },
+        deployment,
+        elapsedSeconds: Math.round((Date.now() - startedAt) / 1000),
+        totalElapsedSeconds: secondsSinceCreated(deployment),
+        recovery: RECOVERY_NONE,
+        summary: `${app.name} check ${deployment.id} passed — would build and boot. The live app was not changed.`
+      };
+    }
     if (deployment.status === "replaced") {
       return await buildReplacedResult({ ctx, app, deployment, startedAt, signal: opts?.signal });
     }
@@ -109676,13 +109763,16 @@ async function domainRemove(ctx, input) {
   await ctx.client.apps.removeDomain(appRef, input.domain);
 }
 // ../core/dist/commands/env.js
+var envScopeEnum = exports_external.enum(["all", "live", "preview"]);
 var envSetInputSchema = exports_external.object({
   app: exports_external.string().optional(),
-  values: exports_external.record(exports_external.string(), exports_external.string())
+  values: exports_external.record(exports_external.string(), exports_external.string()),
+  scope: envScopeEnum.optional().describe("Env scope: 'all' (default) applies to the live app and every preview; 'preview' applies only to preview deploys and overrides 'all' there; 'live' applies only to the live app and overrides 'all' there.")
 });
 var envUnsetInputSchema = exports_external.object({
   app: exports_external.string().optional(),
-  key: exports_external.string().min(1)
+  key: exports_external.string().min(1),
+  scope: envScopeEnum.optional().describe("Which scoped value to remove: 'all' (default), 'live', or 'preview'. Use 'preview' to drop a preview-only override without touching the value live deploys see.")
 });
 var envListInputSchema = exports_external.object({
   app: exports_external.string().optional()
@@ -109705,21 +109795,30 @@ function mask(value) {
 async function envSet(ctx, input) {
   const name = resolveAppName2(ctx, input.app);
   const app = await ctx.client.apps.get(name);
-  await ctx.client.env.set(app.id, input.values);
+  await ctx.client.env.set(app.id, input.values, { scope: input.scope });
 }
 async function envUnset(ctx, input) {
   const name = resolveAppName2(ctx, input.app);
   const app = await ctx.client.apps.get(name);
-  await ctx.client.env.unset(app.id, input.key);
+  await ctx.client.env.unset(app.id, input.key, { scope: input.scope });
 }
 async function envList(ctx, input = {}) {
   const name = resolveAppName2(ctx, input.app);
   const app = await ctx.client.apps.get(name);
-  const raw = await ctx.client.env.list(app.id);
-  const masked = {};
-  for (const [k, v] of Object.entries(raw))
-    masked[k] = mask(v);
-  return masked;
+  const [serverValues, rows] = await Promise.all([
+    ctx.client.env.list(app.id),
+    ctx.client.env.listDetailed(app.id)
+  ]);
+  const detailed = rows.map((r) => ({
+    key: r.key,
+    scope: r.scope,
+    maskedValue: mask(r.maskedValue)
+  }));
+  const values = {};
+  for (const [key, masked] of Object.entries(serverValues)) {
+    values[key] = mask(masked);
+  }
+  return { values, detailed };
 }
 // ../core/dist/commands/export.js
 import { randomUUID } from "node:crypto";
@@ -110104,6 +110203,46 @@ async function githubSetupWebhook(ctx, input) {
 `)
   };
 }
+// ../core/dist/commands/hooks.js
+var hookCreateInputSchema = exports_external.object({
+  app: exports_external.string().optional(),
+  name: exports_external.string().trim().min(1).max(64).describe("Label for the hook, 1-64 chars — name it after the caller, e.g. 'sanity-publish' or 'nightly-cron' (shown in the list).")
+});
+var hookListInputSchema = exports_external.object({
+  app: exports_external.string().optional()
+});
+var hookRevokeInputSchema = exports_external.object({
+  app: exports_external.string().optional(),
+  id: exports_external.string().min(1).describe("Hook id from `percher hook list`.")
+});
+function resolveAppName4(ctx, provided) {
+  const name = provided ?? readPercherTomlAppName(ctx.cwd);
+  if (!name) {
+    throw new PercherCoreError("No app specified and no percher.toml found", {
+      code: "hooks.no-app",
+      hint: "Pass --app <name> or run from a directory with percher.toml."
+    });
+  }
+  return name;
+}
+async function hookCreate(ctx, input) {
+  const name = resolveAppName4(ctx, input.app);
+  const app = await ctx.client.apps.get(name);
+  ctx.status("Creating deploy hook…");
+  return ctx.client.hooks.create(app.id, input.name);
+}
+async function hookList(ctx, input = {}) {
+  const name = resolveAppName4(ctx, input.app);
+  const app = await ctx.client.apps.get(name);
+  ctx.status("Loading deploy hooks…");
+  return ctx.client.hooks.list(app.id);
+}
+async function hookRevoke(ctx, input) {
+  const name = resolveAppName4(ctx, input.app);
+  const app = await ctx.client.apps.get(name);
+  ctx.status("Revoking deploy hook…");
+  await ctx.client.hooks.revoke(app.id, input.id);
+}
 // ../core/dist/commands/import-project.js
 import { existsSync as existsSync11, readFileSync as readFileSync8, writeFileSync as writeFileSync7 } from "node:fs";
 import { join as join15 } from "node:path";
@@ -115168,6 +115307,11 @@ async function previewBranchShow(ctx, input = {}) {
     status: app.previewStatus ?? "disabled"
   };
 }
+async function previewList(ctx, input = {}) {
+  const appRef = resolveApp3(ctx, input.app);
+  const app = await ctx.client.apps.get(appRef);
+  return { app: app.name, previews: app.previews ?? [] };
+}
 // ../core/dist/commands/publish.js
 init_dist();
 import { existsSync as existsSync15 } from "node:fs";
@@ -116090,6 +116234,7 @@ var publishInputSchema = exports_external.object({
   preview: exports_external.boolean().optional().describe("Deploy as preview (does not replace the live version)"),
   message: exports_external.string().optional().describe("Deploy note (visible in deploy history and version timeline)"),
   dryRun: exports_external.boolean().optional().describe("Show what would be deployed (file count, bytes, top files) without uploading or building. Useful for verifying the bundle before a real deploy."),
+  check: exports_external.boolean().optional().describe("Validation deploy: build → start → health, then tear the container down (no swap, no route). Proves the app builds and boots without touching the live version. Consumes the PREVIEW daily quota; the app is NOT changed. Beyond a manifest-only dry run — it actually builds and runs. On success: status='check_passed'."),
   noCache: exports_external.boolean().optional().describe("Skip the image-cache lookup and force a fresh build. Use this when you suspect the cached image doesn't reflect your latest source — the new build's resulting image still gets cached, so future deploys benefit."),
   waitForLive: exports_external.boolean().optional().describe("If true (default), publish blocks until the deploy is live or failed. If false, publish returns as soon as the deploy is queued and the agent can resume with percher_wait_for_deploy. Recommended for AI agents — gives back control quickly with a deployId so they can decide between waiting, asking the user, or working on something else."),
   anonymous: exports_external.boolean().optional().describe("Publish WITHOUT an account. Creates a throwaway anonymous app that expires in 72h unless claimed (percher_claim_app). The app runs with no outbound network, no database, and no env vars until claimed. Only honored when the caller has no token; ignored once signed in. Server-gated — fails with ANON_DEPLOYS_DISABLED if the instance hasn't enabled it.")
@@ -116422,7 +116567,7 @@ async function executeDeploy(opts) {
   const tarballBytes = new Uint8Array(await new Response(tarball.stream).arrayBuffer());
   let cacheReusedDeployment = null;
   const contentHash = tarball.contentHash;
-  if (!input.noCache && !input.preview) {
+  if (!input.noCache && !input.preview && !input.check) {
     try {
       const probe = await ctx.client.platform.cacheProbe({
         appId: app.id,
@@ -116445,6 +116590,7 @@ async function executeDeploy(opts) {
         call: (attempt) => ctx.client.apps.deploy(app.id, {
           tarball: tarballBytes,
           type: input.preview ? "preview" : undefined,
+          check: input.check,
           note: input.message,
           noCache: input.noCache,
           idempotencyKey,
@@ -116590,6 +116736,31 @@ async function finalizeDeploy(opts) {
     };
   }
   const buildMs = Date.now() - buildStart;
+  if (deployment.isCheck && deployment.checkPassed) {
+    const totalSeconds2 = (Date.now() - t0) / 1000;
+    const summary = `${app.name} check passed (${Math.round(totalSeconds2)}s) — would build and boot. The live app was not changed.`;
+    ctx.status(summary);
+    return {
+      status: "check_passed",
+      app,
+      deployment,
+      timing: {
+        totalSeconds: Math.round(totalSeconds2),
+        packageMs,
+        uploadMs,
+        buildMs
+      },
+      fileCount: tarball.fileCount,
+      bytes: tarball.bytes,
+      firstDeploy: firstDeploy || undefined,
+      missingBuildEnvKeys: missingBuildEnvKeys.length > 0 ? missingBuildEnvKeys : undefined,
+      traceId: deployment.id,
+      recovery: RECOVERY_NONE,
+      summary,
+      configPath: tomlPathFor2(ctx.cwd),
+      bundle: { fileCount: tarball.fileCount, bytes: tarball.bytes }
+    };
+  }
   if (deployment.status === "replaced") {
     return await buildReplacedResult2({
       ctx,
@@ -116624,6 +116795,16 @@ async function finalizeDeploy(opts) {
   }
   const cacheHit = deployment.cacheHit;
   const cacheStatus = deployment.cacheStatus;
+  const autoDeploys = resolveAutoDeploys(app);
+  const liveSummary = buildLiveSummary({
+    appName: app.name,
+    url: url2 ?? app.url,
+    totalSeconds: Math.round(totalSeconds),
+    framework: config2.app.framework,
+    preview: input.preview === true,
+    replacedPreview,
+    cacheHit: cacheHit === true
+  });
   return {
     status: "live",
     url: url2,
@@ -116646,19 +116827,30 @@ async function finalizeDeploy(opts) {
     missingBuildEnvKeys: missingBuildEnvKeys.length > 0 ? missingBuildEnvKeys : undefined,
     traceId: deployment.id,
     recovery: RECOVERY_NONE,
-    summary: buildLiveSummary({
-      appName: app.name,
-      url: url2 ?? app.url,
-      totalSeconds: Math.round(totalSeconds),
-      framework: config2.app.framework,
-      preview: input.preview === true,
-      replacedPreview,
-      cacheHit: cacheHit === true
-    }),
+    autoDeploys,
+    summary: autoDeploys ? `${liveSummary}
+This app auto-deploys from ${autoDeploys.repo}@${autoDeploys.branch} — pushing there is the canonical path.` : liveSummary,
     configPath: tomlPathFor2(ctx.cwd),
     bundle: { fileCount: tarball.fileCount, bytes: tarball.bytes }
   };
 }
+function resolveAutoDeploys(app) {
+  if (app.githubRepoUrl) {
+    return {
+      repo: app.githubRepoUrl,
+      branch: app.githubBranch ?? "main",
+      provider: "github"
+    };
+  }
+  if (app.forgejoRepoUrl) {
+    return {
+      repo: app.forgejoRepoUrl,
+      branch: app.forgejoBranch ?? "main",
+      provider: "forgejo"
+    };
+  }
+  return;
+}
 async function handleUnauthorized(ctx, config2, tarball, input) {
   if (input.anonymous) {
     return handleAnonymousPublish(ctx, config2, input, tarball);
@@ -116901,6 +117093,7 @@ var publishInlineInputSchema = exports_external.object({
     encoding: exports_external.enum(["utf8", "base64"]).optional().describe("Content encoding. Default 'utf8' (text). Use 'base64' for binary assets (images, fonts).")
   })).min(1).describe("Inline source files. Include a percher.toml ([app].name + runtime), or omit it and Percher auto-detects the runtime from the files (then `name` is required)."),
   preview: exports_external.boolean().optional().describe("Deploy as a preview (does not replace the live version)."),
+  check: exports_external.boolean().optional().describe("Validation deploy: build → start → health, then tear down (no swap, no route). Proves the app builds and boots without changing the live version. Consumes the preview quota. On success: status='check_passed'."),
   message: exports_external.string().optional().describe("Deploy note (visible in deploy history)."),
   noCache: exports_external.boolean().optional().describe("Skip the image cache and force a fresh build."),
   waitForLive: exports_external.boolean().optional().describe("If true (default), block until the deploy is live or failed. If false, return as soon as it is queued so the agent can resume with percher_wait_for_deploy.")
@@ -117222,7 +117415,8 @@ ${deployment.errorMessage}` : "";
 init_dist();
 var redeployInputSchema = exports_external.object({
   app: exports_external.string().optional().describe("App name. Defaults to the [app].name in the current directory's percher.toml."),
-  deployId: exports_external.string().optional().describe("Specific deploy id (e.g. dep_abc123). Defaults to the latest live deploy for the app.")
+  deployId: exports_external.string().optional().describe("Specific deploy id (e.g. dep_abc123). Defaults to the latest live deploy for the app."),
+  noCache: exports_external.boolean().optional().describe("Force a fresh build — skip the image cache. The stale-image escape hatch when a re-run keeps serving old bytes.")
 });
 async function redeploy(ctx, input = {}) {
   const t0 = Date.now();
@@ -117276,7 +117470,7 @@ async function redeploy(ctx, input = {}) {
   ctx.status(`Re-running ${sourceDeployId}...`);
   let initial;
   try {
-    initial = await ctx.client.apps.rerunDeploy(app.id, sourceDeployId);
+    initial = await ctx.client.apps.rerunDeploy(app.id, sourceDeployId, input.noCache ? { noCache: true } : undefined);
   } catch (err) {
     if (err instanceof PercherApiError) {
       switch (err.code) {
@@ -117875,8 +118069,90 @@ async function resume(ctx, input = {}) {
 // ../core/dist/commands/rollback.js
 var rollbackInputSchema = exports_external.object({
   app: exports_external.string().optional(),
-  commitSha: exports_external.string().min(1)
+  commitSha: exports_external.string().min(1).optional().describe("Version SHA to roll back to (from percher_versions / `percher versions`). Omit to pick from the most recent versions, or set toLastGood."),
+  toLastGood: exports_external.boolean().optional().describe("Resolves server-side to the most recent version that went live and didn't crash-loop.")
 });
+var BARE_PICK_LIMIT = 5;
+function versionAge(iso, now = Date.now()) {
+  const then = new Date(iso).getTime();
+  if (Number.isNaN(then))
+    return iso;
+  const s = Math.max(0, Math.floor((now - then) / 1000));
+  if (s < 60)
+    return "just now";
+  const m = Math.floor(s / 60);
+  if (m < 60)
+    return `${m}m ago`;
+  const h = Math.floor(m / 60);
+  if (h < 24)
+    return `${h}h ago`;
+  const d = Math.floor(h / 24);
+  if (d < 30)
+    return `${d}d ago`;
+  return `${Math.floor(d / 30)}mo ago`;
+}
+async function writeLine(ctx, line) {
+  const writer = ctx.stdout.getWriter();
+  try {
+    await writer.write(new TextEncoder().encode(`${line}
+`));
+  } finally {
+    writer.releaseLock();
+  }
+}
+async function resolveCommitSha(ctx, name, input) {
+  if (input.commitSha)
+    return input.commitSha;
+  if (input.toLastGood) {
+    const lastGood = await ctx.client.apps.lastGoodVersion(name);
+    if (!lastGood) {
+      throw new PercherCoreError("No previous known-good version — deploy history has none that reached live without crash-looping.", {
+        code: "rollback.no-last-good",
+        hint: "Run `bunx percher versions` and pick a version explicitly: `bunx percher rollback <sha>`."
+      });
+    }
+    return lastGood.commitSha;
+  }
+  const versions2 = await ctx.client.apps.listVersions(name);
+  if (versions2.length === 0) {
+    throw new PercherCoreError(`No versions to roll back to for "${name}"`, {
+      code: "rollback.no-versions",
+      hint: "Publish at least once before rolling back."
+    });
+  }
+  const pick2 = versions2.slice(0, BARE_PICK_LIMIT);
+  if (!ctx.stdinIsInteractive) {
+    const appFlag = ` --app ${name}`;
+    const lines = pick2.map((v) => {
+      const note = v.message.split(`
+`)[0]?.trim() || "Published";
+      return `  bunx percher rollback ${v.sha}${appFlag}  # ${note} (${versionAge(v.timestamp)})`;
+    });
+    throw new PercherCoreError(`Rollback needs a version. The ${pick2.length} most recent for "${name}":
+${lines.join(`
+`)}`, {
+      code: "rollback.sha-required",
+      hint: "Re-run with an explicit sha, or pass --last-good to pick the most recent known-good version."
+    });
+  }
+  await writeLine(ctx, `Recent versions of ${name}:`);
+  for (const [i, v] of pick2.entries()) {
+    const note = v.message.split(`
+`)[0]?.trim() || "Published";
+    const live = i === 0 ? "  (live now)" : "";
+    await writeLine(ctx, `  ${i + 1}. ${v.sha.slice(0, 10)}  ${versionAge(v.timestamp)}  ${note}${live}`);
+  }
+  const answer = await ctx.prompt(`Roll back to which version? [1-${pick2.length}]`, {});
+  const n = Number.parseInt(answer.trim(), 10);
+  const chosen = Number.isInteger(n) && n >= 1 && n <= pick2.length ? pick2[n - 1] : undefined;
+  if (!chosen) {
+    throw new PercherCoreError(`"${answer.trim()}" is not a number between 1 and ${pick2.length}`, {
+      code: "rollback.sha-required",
+      hint: "Re-run `percher rollback` and pick a listed number, or pass the sha directly."
+    });
+  }
+  return chosen.sha;
+}
 async function rollback(ctx, input, internals = {}) {
   const name = input.app ?? readPercherTomlAppName(ctx.cwd);
   if (!name) {
@@ -117885,7 +118161,9 @@ async function rollback(ctx, input, internals = {}) {
       hint: "Pass --app <name> or run from a directory with percher.toml."
     });
   }
-  let deployment = await ctx.client.apps.rollback(name, input.commitSha);
+  const commitSha = await resolveCommitSha(ctx, name, input);
+  ctx.status(`Rolling back to ${commitSha.slice(0, 10)}...`);
+  let deployment = await ctx.client.apps.rollback(name, commitSha);
   const pollInterval = internals.pollIntervalMs ?? 2000;
   const timeoutMs = internals.timeoutMs ?? TIMEOUTS.clientPublishPoll;
   const startedAt = Date.now();
@@ -117906,7 +118184,7 @@ async function rollback(ctx, input, internals = {}) {
       hint: "Run `percher logs` to see what went wrong."
     });
   }
-  return deployment;
+  return { ...deployment, rolledBackTo: commitSha };
 }
 // ../core/dist/commands/sharing.js
 var ShareRoleSchema = exports_external.enum(["viewer", "admin"]);
@@ -118314,7 +118592,7 @@ class SilentExitError {
     this.exitCode = exitCode;
   }
 }
-async function writeLine(ctx, line) {
+async function writeLine2(ctx, line) {
   const writer = ctx.stdout.getWriter();
   try {
     await writer.write(new TextEncoder().encode(`${line}
@@ -118379,56 +118657,115 @@ function firstNonFlagAfter(argv, from, valueFlags = new Set) {
   }
   return;
 }
+function foldStageTimeline(events) {
+  const order = [];
+  const info = new Map;
+  for (const e of events) {
+    if (e.subStage !== null)
+      continue;
+    let row = info.get(e.stage);
+    if (!row) {
+      row = { status: "running", durationMs: null };
+      info.set(e.stage, row);
+      order.push(e.stage);
+    }
+    const t = Date.parse(e.at);
+    if (e.status === "started") {
+      if (!Number.isNaN(t))
+        row.startedAt = t;
+    } else if (e.status === "ok" || e.status === "failed") {
+      row.status = e.status;
+      if (e.durationMs !== null)
+        row.durationMs = e.durationMs;
+      else if (!Number.isNaN(t))
+        row.endedAt = t;
+    }
+  }
+  return order.map((stage) => {
+    const r = info.get(stage);
+    let durationMs = r.durationMs;
+    if (durationMs === null && r.startedAt !== undefined && r.endedAt !== undefined) {
+      durationMs = Math.max(0, r.endedAt - r.startedAt);
+    }
+    return { stage, durationMs, status: r.status };
+  });
+}
+function formatStageDuration(ms) {
+  if (ms === null || !Number.isFinite(ms) || ms < 0)
+    return "—";
+  if (ms < 1000)
+    return `${Math.round(ms)}ms`;
+  if (ms < 60000)
+    return `${(ms / 1000).toFixed(1)}s`;
+  return `${(ms / 60000).toFixed(1)}m`;
+}
+async function writeStageTimeline(ctx, events) {
+  if (events.length === 0)
+    return;
+  const rows = foldStageTimeline(events);
+  if (rows.length === 0)
+    return;
+  const stageW = Math.max(...rows.map((r) => r.stage.length));
+  const durW = Math.max(...rows.map((r) => formatStageDuration(r.durationMs).length));
+  await writeLine2(ctx, "");
+  await writeLine2(ctx, import_picocolors.default.bold("Stages:"));
+  for (const r of rows) {
+    const dur = formatStageDuration(r.durationMs).padStart(durW);
+    const mark = r.status === "failed" ? import_picocolors.default.red("← failed") : r.status === "ok" ? import_picocolors.default.dim("ok") : import_picocolors.default.yellow("…");
+    await writeLine2(ctx, `  ${r.stage.padEnd(stageW)}  ${dur}  ${mark}`);
+  }
+}
 async function printSuperuserResetResult(ctx, result) {
-  await writeLine(ctx, `${import_picocolors.default.green("✓")} ${result.message}`);
+  await writeLine2(ctx, `${import_picocolors.default.green("✓")} ${result.message}`);
   if (result.password) {
-    await writeLine(ctx, "");
-    await writeLine(ctx, `  ${import_picocolors.default.bold("Email:")}    ${result.email}`);
-    await writeLine(ctx, `  ${import_picocolors.default.bold("Password:")} ${result.password}`);
-    await writeLine(ctx, "");
-    await writeLine(ctx, import_picocolors.default.yellow("  ⚠  This password is shown only once. Save it now if you need it."));
+    await writeLine2(ctx, "");
+    await writeLine2(ctx, `  ${import_picocolors.default.bold("Email:")}    ${result.email}`);
+    await writeLine2(ctx, `  ${import_picocolors.default.bold("Password:")} ${result.password}`);
+    await writeLine2(ctx, "");
+    await writeLine2(ctx, import_picocolors.default.yellow("  ⚠  This password is shown only once. Save it now if you need it."));
   }
 }
 async function runDeploysInspect(ctx, input) {
   const result = await deploysInspect(ctx, input);
-  const { deploy, buildLog } = result;
-  await writeLine(ctx, `${import_picocolors.default.bold("Deploy:")}    ${deploy.id}`);
-  await writeLine(ctx, `${import_picocolors.default.bold("Status:")}    ${formatStatus(deploy.status)}`);
+  const { deploy, buildLog, events } = result;
+  await writeLine2(ctx, `${import_picocolors.default.bold("Deploy:")}    ${deploy.id}`);
+  await writeLine2(ctx, `${import_picocolors.default.bold("Status:")}    ${formatStatus(deploy.status)}`);
   if (deploy.type) {
-    await writeLine(ctx, `${import_picocolors.default.bold("Type:")}      ${deploy.type}`);
+    await writeLine2(ctx, `${import_picocolors.default.bold("Type:")}      ${deploy.type}`);
   }
-  await writeLine(ctx, `${import_picocolors.default.bold("Created:")}   ${formatDeployTimestamp(deploy.createdAt)}`);
+  await writeLine2(ctx, `${import_picocolors.default.bold("Created:")}   ${formatDeployTimestamp(deploy.createdAt)}`);
   if (typeof deploy.imageSizeBytes === "number") {
-    await writeLine(ctx, `${import_picocolors.default.bold("Image:")}     ${formatBytes(deploy.imageSizeBytes)}`);
+    await writeLine2(ctx, `${import_picocolors.default.bold("Image:")}     ${formatBytes(deploy.imageSizeBytes)}`);
   }
   if (deploy.url) {
-    await writeLine(ctx, `${import_picocolors.default.bold("URL:")}       ${deploy.url}`);
+    await writeLine2(ctx, `${import_picocolors.default.bold("URL:")}       ${deploy.url}`);
   }
   if (deploy.previewUrl) {
-    await writeLine(ctx, `${import_picocolors.default.bold("Preview:")}   ${deploy.previewUrl}`);
+    await writeLine2(ctx, `${import_picocolors.default.bold("Preview:")}   ${deploy.previewUrl}`);
   }
   if (deploy.errorMessage) {
-    await writeLine(ctx, "");
-    await writeLine(ctx, import_picocolors.default.bold(import_picocolors.default.red("Error:")));
+    await writeLine2(ctx, "");
+    await writeLine2(ctx, import_picocolors.default.bold(import_picocolors.default.red("Error:")));
     for (const line of deploy.errorMessage.split(`
 `)) {
-      await writeLine(ctx, `  ${line}`);
+      await writeLine2(ctx, `  ${line}`);
     }
   }
   if (buildLog) {
-    await writeLine(ctx, "");
+    await writeLine2(ctx, "");
     const lines = buildLog.split(`
 `);
     const tail = lines.slice(-200);
     const header = lines.length > tail.length ? `${import_picocolors.default.bold("Build log")} ${import_picocolors.default.dim(`(last 200 of ${lines.length} lines)`)}` : import_picocolors.default.bold("Build log");
-    await writeLine(ctx, header);
+    await writeLine2(ctx, header);
     for (const line of tail) {
-      await writeLine(ctx, `  ${line}`);
+      await writeLine2(ctx, `  ${line}`);
     }
   } else if (deploy.status === "failed" || deploy.status === "live") {
-    await writeLine(ctx, "");
-    await writeLine(ctx, import_picocolors.default.dim("(no build log available for this deploy)"));
+    await writeLine2(ctx, "");
+    await writeLine2(ctx, import_picocolors.default.dim("(no build log available for this deploy)"));
   }
+  await writeStageTimeline(ctx, events);
 }
 
 // src/commands/account.ts
@@ -118446,7 +118783,7 @@ function registerAccountCommands(cli, ctx) {
   cli.command("account [action] [...rest]", "Account management: export (GDPR data portability) | preview-delete (inspect deletion blockers) | delete (GDPR erasure)").option("--out <file>", "(export only) Output file path").option("--include-app-data", "(export only) Also download per-app PocketBase tarballs (creates a directory)").option("--confirm <email>", "(delete only) Your email — must match the signed-in account").option("--yes", "(delete only) Skip the interactive confirmation prompt").action(async (action, _rest, options) => {
     if (action === "export") {
       if (!ctx.client.token) {
-        await writeLine(ctx, `${import_picocolors2.default.red("✗")} Not logged in. Run: percher login`);
+        await writeLine2(ctx, `${import_picocolors2.default.red("✗")} Not logged in. Run: percher login`);
         throw new SilentExitError;
       }
       const result = await accountExport(ctx, {
@@ -118454,69 +118791,69 @@ function registerAccountCommands(cli, ctx) {
         includeAppData: options.includeAppData
       });
       const kb = (result.bytes / 1024).toFixed(1);
-      await writeLine(ctx, `${import_picocolors2.default.green("✓")} Exported ${kb} KB → ${result.path}`);
+      await writeLine2(ctx, `${import_picocolors2.default.green("✓")} Exported ${kb} KB → ${result.path}`);
       if (result.appTarballs && result.appTarballs.length > 0) {
         for (const t of result.appTarballs) {
           const mb = (t.bytes / 1024 / 1024).toFixed(1);
-          await writeLine(ctx, `  ${import_picocolors2.default.green("✓")} ${t.app}: ${mb} MB → ${t.path}`);
+          await writeLine2(ctx, `  ${import_picocolors2.default.green("✓")} ${t.app}: ${mb} MB → ${t.path}`);
         }
       }
       if (result.appTarballsFailed && result.appTarballsFailed.length > 0) {
         for (const f of result.appTarballsFailed) {
-          await writeLine(ctx, `  ${import_picocolors2.default.yellow("⚠")} ${f.app}: ${f.error} (skipped)`);
+          await writeLine2(ctx, `  ${import_picocolors2.default.yellow("⚠")} ${f.app}: ${f.error} (skipped)`);
         }
-        await writeLine(ctx, import_picocolors2.default.yellow(`Export is partial — ${result.appTarballsFailed.length} app(s) could not be downloaded. Re-run after the rate-limit window to get the rest.`));
+        await writeLine2(ctx, import_picocolors2.default.yellow(`Export is partial — ${result.appTarballsFailed.length} app(s) could not be downloaded. Re-run after the rate-limit window to get the rest.`));
       }
-      await writeLine(ctx, import_picocolors2.default.dim("Note: encrypted env-var values are not included (only the keys + metadata). Build logs are excluded too — request via `percher logs` if needed."));
+      await writeLine2(ctx, import_picocolors2.default.dim("Note: encrypted env-var values are not included (only the keys + metadata). Build logs are excluded too — request via `percher logs` if needed."));
       return;
     }
     if (action === "preview-delete") {
       if (!ctx.client.token) {
-        await writeLine(ctx, `${import_picocolors2.default.red("✗")} Not logged in. Run: percher login`);
+        await writeLine2(ctx, `${import_picocolors2.default.red("✗")} Not logged in. Run: percher login`);
         throw new SilentExitError;
       }
       const preview = await accountDeletionPreview(ctx, {});
       if (preview.canDelete) {
-        await writeLine(ctx, `${import_picocolors2.default.green("✓")} No blockers — your account is ready to delete. Run: percher account delete --confirm <your-email>`);
+        await writeLine2(ctx, `${import_picocolors2.default.green("✓")} No blockers — your account is ready to delete. Run: percher account delete --confirm <your-email>`);
         return;
       }
-      await writeLine(ctx, `${import_picocolors2.default.yellow("!")} Account deletion is blocked by ${preview.blockers.length} ${preview.blockers.length === 1 ? "category" : "categories"} (${preview.ownedAppCount} owned ${preview.ownedAppCount === 1 ? "app" : "apps"}):`);
+      await writeLine2(ctx, `${import_picocolors2.default.yellow("!")} Account deletion is blocked by ${preview.blockers.length} ${preview.blockers.length === 1 ? "category" : "categories"} (${preview.ownedAppCount} owned ${preview.ownedAppCount === 1 ? "app" : "apps"}):`);
       for (const blocker of preview.blockers) {
         const action2 = BLOCKER_ACTIONS[blocker.kind] ?? "Clear via the dashboard or API.";
-        await writeLine(ctx, "");
-        await writeLine(ctx, `  ${import_picocolors2.default.bold(blocker.kind)} (${blocker.count})`);
-        await writeLine(ctx, `    → ${action2}`);
+        await writeLine2(ctx, "");
+        await writeLine2(ctx, `  ${import_picocolors2.default.bold(blocker.kind)} (${blocker.count})`);
+        await writeLine2(ctx, `    → ${action2}`);
         const previewDetails = blocker.details.slice(0, 5);
         for (const detail of previewDetails) {
           const ref = detail.ref ? ` (${detail.ref})` : "";
           const name = detail.appName ?? detail.appId ?? "—";
-          await writeLine(ctx, `      · ${name}${ref}`);
+          await writeLine2(ctx, `      · ${name}${ref}`);
         }
         if (blocker.details.length > previewDetails.length) {
-          await writeLine(ctx, import_picocolors2.default.dim(`      … ${blocker.details.length - previewDetails.length} more`));
+          await writeLine2(ctx, import_picocolors2.default.dim(`      … ${blocker.details.length - previewDetails.length} more`));
         }
       }
-      await writeLine(ctx, import_picocolors2.default.dim("\nResolve each category above, then re-run `percher account preview-delete` to confirm. Once canDelete=true, run `percher account delete --confirm <your-email>`."));
+      await writeLine2(ctx, import_picocolors2.default.dim("\nResolve each category above, then re-run `percher account preview-delete` to confirm. Once canDelete=true, run `percher account delete --confirm <your-email>`."));
       throw new SilentExitError(2);
     }
     if (action === "delete") {
       if (!ctx.client.token) {
-        await writeLine(ctx, `${import_picocolors2.default.red("✗")} Not logged in. Run: percher login`);
+        await writeLine2(ctx, `${import_picocolors2.default.red("✗")} Not logged in. Run: percher login`);
         throw new SilentExitError;
       }
       if (!options.confirm) {
-        await writeLine(ctx, `${import_picocolors2.default.red("✗")} Pass --confirm <your-email> to proceed. Account deletion is fail-closed — owned apps, accepted collaborators, pending invites, open PR previews, pending transfers, in-flight deploys, and active restores must all be cleared first.`);
+        await writeLine2(ctx, `${import_picocolors2.default.red("✗")} Pass --confirm <your-email> to proceed. Account deletion is fail-closed — owned apps, accepted collaborators, pending invites, open PR previews, pending transfers, in-flight deploys, and active restores must all be cleared first.`);
         throw new SilentExitError;
       }
       if (!options.yes) {
         const answer = await ctx.prompt(`${import_picocolors2.default.red("!")} This will request deletion of your account. The server will reject the request if any apps, collaborators, pending invites, PR previews, pending transfers, in-flight deploys, or active restores remain — clear those first. On a clean account the request is accepted asynchronously and finalization completes within seconds; your API tokens are revoked immediately. Type "delete my account" to confirm:`);
         if (answer.trim().toLowerCase() !== "delete my account") {
-          await writeLine(ctx, "Cancelled.");
+          await writeLine2(ctx, "Cancelled.");
           return;
         }
       }
       const accepted = await accountDelete(ctx, { confirm: options.confirm });
-      await writeLine(ctx, `${import_picocolors2.default.green("✓")} Account deletion started. Finalization runs asynchronously (job ${import_picocolors2.default.dim(accepted.finalizeJobId)}); usually completes within a few seconds. Your API tokens have already been revoked.`);
+      await writeLine2(ctx, `${import_picocolors2.default.green("✓")} Account deletion started. Finalization runs asynchronously (job ${import_picocolors2.default.dim(accepted.finalizeJobId)}); usually completes within a few seconds. Your API tokens have already been revoked.`);
       return;
     }
     throw new Error(`Unknown account action "${action ?? ""}". Use: export | preview-delete | delete.`);
@@ -118527,82 +118864,82 @@ function registerAccountCommands(cli, ctx) {
   cli.command("mcp", "Print the MCP server config for AI assistants (Claude Code, Cursor, Windsurf)").option("--json", "Output JSON only (paste-ready)").action(async (options) => {
     const result = mcp(ctx, {});
     if (options.json) {
-      await writeLine(ctx, JSON.stringify(result.config, null, 2));
+      await writeLine2(ctx, JSON.stringify(result.config, null, 2));
       return;
     }
-    await writeLine(ctx, import_picocolors2.default.bold("Percher MCP server"));
-    await writeLine(ctx, "");
-    await writeLine(ctx, import_picocolors2.default.bold("Local (npx) — full tool set, reads your project files:"));
-    await writeLine(ctx, JSON.stringify(result.config, null, 2));
-    await writeLine(ctx, "");
-    await writeLine(ctx, import_picocolors2.default.bold("Hosted connector — add this URL, OAuth login in the browser (no token):"));
-    await writeLine(ctx, `  ${result.hosted.url}`);
-    await writeLine(ctx, "");
-    await writeLine(ctx, import_picocolors2.default.bold("Where to paste:"));
+    await writeLine2(ctx, import_picocolors2.default.bold("Percher MCP server"));
+    await writeLine2(ctx, "");
+    await writeLine2(ctx, import_picocolors2.default.bold("Local (npx) — full tool set, reads your project files:"));
+    await writeLine2(ctx, JSON.stringify(result.config, null, 2));
+    await writeLine2(ctx, "");
+    await writeLine2(ctx, import_picocolors2.default.bold("Hosted connector — add this URL, OAuth login in the browser (no token):"));
+    await writeLine2(ctx, `  ${result.hosted.url}`);
+    await writeLine2(ctx, "");
+    await writeLine2(ctx, import_picocolors2.default.bold("Where to paste:"));
     for (const loc of result.installLocations) {
-      await writeLine(ctx, `  ${loc.client.padEnd(28)} ${import_picocolors2.default.dim(loc.path)}`);
+      await writeLine2(ctx, `  ${loc.client.padEnd(28)} ${import_picocolors2.default.dim(loc.path)}`);
       if (loc.note) {
-        await writeLine(ctx, `  ${"".padEnd(28)} ${import_picocolors2.default.dim(loc.note)}`);
+        await writeLine2(ctx, `  ${"".padEnd(28)} ${import_picocolors2.default.dim(loc.note)}`);
       }
     }
-    await writeLine(ctx, "");
+    await writeLine2(ctx, "");
     for (const note of result.notes) {
-      await writeLine(ctx, import_picocolors2.default.dim(note));
+      await writeLine2(ctx, import_picocolors2.default.dim(note));
     }
-    await writeLine(ctx, "");
-    await writeLine(ctx, import_picocolors2.default.dim("Once installed, your assistant gets percher_publish + 28 other tools."));
+    await writeLine2(ctx, "");
+    await writeLine2(ctx, import_picocolors2.default.dim("Once installed, your assistant gets percher_publish + 28 other tools."));
   });
   cli.command("ai-files <action>", "Manage AI-assistant rules files (install | update | status | remove)").option("--force", "Overwrite or remove user-modified / foreign files").option("--json", "Output JSON").action(async (action, options) => {
     if (action === "install") {
       const r = await aiFilesInstall(ctx, { force: options.force });
       if (options.json) {
-        await writeLine(ctx, JSON.stringify(r, null, 2));
+        await writeLine2(ctx, JSON.stringify(r, null, 2));
         return;
       }
       for (const i of r.installed) {
-        await writeLine(ctx, `${import_picocolors2.default.green("✓")} installed ${i.path} (v${i.templateVersion})`);
+        await writeLine2(ctx, `${import_picocolors2.default.green("✓")} installed ${i.path} (v${i.templateVersion})`);
       }
       for (const s of r.skipped) {
         const why = s.reason === "already-installed" ? "already installed" : s.reason === "modified" ? "user-modified — use --force to overwrite" : "foreign file — use --force to overwrite";
-        await writeLine(ctx, `${import_picocolors2.default.yellow("!")} skipped ${s.path}: ${why}`);
+        await writeLine2(ctx, `${import_picocolors2.default.yellow("!")} skipped ${s.path}: ${why}`);
       }
     } else if (action === "update") {
       const r = await aiFilesUpdate(ctx, { force: options.force });
       if (options.json) {
-        await writeLine(ctx, JSON.stringify(r, null, 2));
+        await writeLine2(ctx, JSON.stringify(r, null, 2));
         return;
       }
       for (const u of r.updated) {
         const tag = u.reason === "reinstalled" ? "reinstalled" : `${u.from ?? "new"} → ${u.to}`;
-        await writeLine(ctx, `${import_picocolors2.default.green("✓")} updated ${u.path} (${tag})`);
+        await writeLine2(ctx, `${import_picocolors2.default.green("✓")} updated ${u.path} (${tag})`);
       }
       for (const s of r.skipped) {
         const why = s.reason === "up-to-date" ? "up to date" : s.reason === "modified" ? "user-modified — use --force to overwrite" : s.reason === "foreign" ? "foreign file" : "no manifest entry";
-        await writeLine(ctx, `${import_picocolors2.default.dim(`· ${s.path}: ${why}`)}`);
+        await writeLine2(ctx, `${import_picocolors2.default.dim(`· ${s.path}: ${why}`)}`);
       }
     } else if (action === "status") {
       const r = await aiFilesStatus(ctx, {});
       if (options.json) {
-        await writeLine(ctx, JSON.stringify(r, null, 2));
+        await writeLine2(ctx, JSON.stringify(r, null, 2));
         return;
       }
-      await writeLine(ctx, import_picocolors2.default.bold("AI files"));
+      await writeLine2(ctx, import_picocolors2.default.bold("AI files"));
       for (const f of r.files) {
         const icon = f.status === "managed" ? import_picocolors2.default.green("✓") : f.status === "modified" ? import_picocolors2.default.yellow("!") : f.status === "missing" ? import_picocolors2.default.dim("·") : import_picocolors2.default.red("✗");
         const versionTag = f.installedVersion && f.installedVersion !== f.latestVersion ? import_picocolors2.default.yellow(` (v${f.installedVersion} → v${f.latestVersion})`) : f.installedVersion ? import_picocolors2.default.dim(` (v${f.installedVersion})`) : import_picocolors2.default.dim(` (latest v${f.latestVersion})`);
-        await writeLine(ctx, `  ${icon} ${f.path.padEnd(40)} ${f.status}${versionTag}`);
+        await writeLine2(ctx, `  ${icon} ${f.path.padEnd(40)} ${f.status}${versionTag}`);
       }
     } else if (action === "remove") {
       const r = await aiFilesRemove(ctx, { force: options.force });
       if (options.json) {
-        await writeLine(ctx, JSON.stringify(r, null, 2));
+        await writeLine2(ctx, JSON.stringify(r, null, 2));
         return;
       }
       for (const x of r.removed) {
-        await writeLine(ctx, `${import_picocolors2.default.green("✓")} removed ${x.path}`);
+        await writeLine2(ctx, `${import_picocolors2.default.green("✓")} removed ${x.path}`);
       }
       for (const s of r.skipped) {
-        await writeLine(ctx, `${import_picocolors2.default.yellow("!")} skipped ${s.path}: ${s.reason}${s.reason === "modified" ? " — use --force to delete" : ""}`);
+        await writeLine2(ctx, `${import_picocolors2.default.yellow("!")} skipped ${s.path}: ${s.reason}${s.reason === "modified" ? " — use --force to delete" : ""}`);
       }
     } else {
       throw new Error(`Unknown ai-files action "${action}". Use install | update | status | remove.`);
@@ -118613,7 +118950,7 @@ function registerAccountCommands(cli, ctx) {
       from: options.from
     });
     if (result.configGenerated) {
-      await writeLine(ctx, `${import_picocolors2.default.green("✓")} Imported from ${result.provider} — percher.toml generated`);
+      await writeLine2(ctx, `${import_picocolors2.default.green("✓")} Imported from ${result.provider} — percher.toml generated`);
     }
     const mappedParts = [];
     if (result.mapped.redirects > 0) {
@@ -118623,25 +118960,25 @@ function registerAccountCommands(cli, ctx) {
       mappedParts.push(`headers for ${result.mapped.headerPaths} path${result.mapped.headerPaths === 1 ? "" : "s"}`);
     }
     if (mappedParts.length > 0) {
-      await writeLine(ctx, `${import_picocolors2.default.green("✓")} Mapped ${mappedParts.join(" and ")} into percher.toml`);
+      await writeLine2(ctx, `${import_picocolors2.default.green("✓")} Mapped ${mappedParts.join(" and ")} into percher.toml`);
     }
     for (const file2 of result.scaffoldedFiles) {
-      await writeLine(ctx, `${import_picocolors2.default.green("✓")} wrote ${file2}`);
+      await writeLine2(ctx, `${import_picocolors2.default.green("✓")} wrote ${file2}`);
     }
     for (const w of result.warnings) {
-      await writeLine(ctx, `${import_picocolors2.default.yellow("!")} ${w}`);
+      await writeLine2(ctx, `${import_picocolors2.default.yellow("!")} ${w}`);
     }
     if (result.envVars.length > 0) {
-      await writeLine(ctx, "");
-      await writeLine(ctx, "Set these env vars before publishing:");
+      await writeLine2(ctx, "");
+      await writeLine2(ctx, "Set these env vars before publishing:");
       for (const v of result.envVars) {
-        await writeLine(ctx, `  bunx percher env set ${v}=your-value`);
+        await writeLine2(ctx, `  bunx percher env set ${v}=your-value`);
       }
     }
     if (result.configGenerated) {
-      await writeLine(ctx, "");
-      await writeLine(ctx, "Next: review percher.toml, then run:");
-      await writeLine(ctx, "  bunx percher publish");
+      await writeLine2(ctx, "");
+      await writeLine2(ctx, "Next: review percher.toml, then run:");
+      await writeLine2(ctx, "  bunx percher publish");
     }
   });
   cli.command("domains <action> [domain]", "Manage custom domains (add | verify | list | remove)").option("--app <name>", "App name (overrides percher.toml)").action(async (action, domain2, options) => {
@@ -118649,52 +118986,52 @@ function registerAccountCommands(cli, ctx) {
       if (!domain2)
         throw new Error("Domain is required. Usage: percher domains add <domain>");
       const result = await domainAdd(ctx, { app: options.app, domain: domain2 });
-      await writeLine(ctx, `${import_picocolors2.default.green("✓")} Domain ${result.domain} added.`);
-      await writeLine(ctx, "");
-      await writeLine(ctx, `Add these DNS records ${result.dnsInstructions.kind === "apex" ? "(this is a root/apex domain — most providers reject CNAME on apex per RFC 1034, use A-record)" : "(this is a subdomain — CNAME works everywhere)"}:`);
-      await writeLine(ctx, `  TXT    ${result.dnsInstructions.txt.name}    ${result.dnsInstructions.txt.value}`);
+      await writeLine2(ctx, `${import_picocolors2.default.green("✓")} Domain ${result.domain} added.`);
+      await writeLine2(ctx, "");
+      await writeLine2(ctx, `Add these DNS records ${result.dnsInstructions.kind === "apex" ? "(this is a root/apex domain — most providers reject CNAME on apex per RFC 1034, use A-record)" : "(this is a subdomain — CNAME works everywhere)"}:`);
+      await writeLine2(ctx, `  TXT    ${result.dnsInstructions.txt.name}    ${result.dnsInstructions.txt.value}`);
       const primary = result.dnsInstructions.primary;
       if (primary.type === "A") {
-        await writeLine(ctx, `  A      ${primary.name}    ${primary.values.join(", ")}`);
+        await writeLine2(ctx, `  A      ${primary.name}    ${primary.values.join(", ")}`);
       } else {
-        await writeLine(ctx, `  CNAME  ${primary.name}    ${primary.value}`);
+        await writeLine2(ctx, `  CNAME  ${primary.name}    ${primary.value}`);
       }
       if (result.dnsInstructions.alternative) {
         const alt = result.dnsInstructions.alternative;
-        await writeLine(ctx, "");
-        await writeLine(ctx, "  Alternative (only for Cloudflare/Route53 with CNAME-flattening):");
+        await writeLine2(ctx, "");
+        await writeLine2(ctx, "  Alternative (only for Cloudflare/Route53 with CNAME-flattening):");
         if (alt.type === "A") {
-          await writeLine(ctx, `  A      ${alt.name}    ${alt.values.join(", ")}`);
+          await writeLine2(ctx, `  A      ${alt.name}    ${alt.values.join(", ")}`);
         } else {
-          await writeLine(ctx, `  CNAME  ${alt.name}    ${alt.value}`);
+          await writeLine2(ctx, `  CNAME  ${alt.name}    ${alt.value}`);
         }
       }
-      await writeLine(ctx, "");
-      await writeLine(ctx, "Then run:");
-      await writeLine(ctx, `  percher domains verify ${result.domain}${options.app ? ` --app ${options.app}` : ""}`);
+      await writeLine2(ctx, "");
+      await writeLine2(ctx, "Then run:");
+      await writeLine2(ctx, `  percher domains verify ${result.domain}${options.app ? ` --app ${options.app}` : ""}`);
     } else if (action === "verify") {
       if (!domain2)
         throw new Error("Domain is required. Usage: percher domains verify <domain>");
       const result = await domainVerify(ctx, { app: options.app, domain: domain2 });
       if (result.status === "verified") {
-        await writeLine(ctx, `${import_picocolors2.default.green("✓")} Domain verified. ${result.domain} is now live.`);
+        await writeLine2(ctx, `${import_picocolors2.default.green("✓")} Domain verified. ${result.domain} is now live.`);
       } else {
-        await writeLine(ctx, `${import_picocolors2.default.yellow("!")} ${result.domain}: ${result.failureReason}`);
+        await writeLine2(ctx, `${import_picocolors2.default.yellow("!")} ${result.domain}: ${result.failureReason}`);
       }
     } else if (action === "list") {
       const list = await domainList(ctx, { app: options.app });
       if (list.length === 0) {
-        await writeLine(ctx, "No custom domains.");
+        await writeLine2(ctx, "No custom domains.");
       } else {
         for (const d of list) {
-          await writeLine(ctx, `${d.domain.padEnd(40)} ${d.status}`);
+          await writeLine2(ctx, `${d.domain.padEnd(40)} ${d.status}`);
         }
       }
     } else if (action === "remove") {
       if (!domain2)
         throw new Error("Domain is required. Usage: percher domains remove <domain>");
       await domainRemove(ctx, { app: options.app, domain: domain2 });
-      await writeLine(ctx, `${import_picocolors2.default.green("✓")} Domain removed.`);
+      await writeLine2(ctx, `${import_picocolors2.default.green("✓")} Domain removed.`);
     } else {
       throw new Error(`Unknown domains action "${action}". Use add | verify | list | remove.`);
     }
@@ -118707,7 +119044,7 @@ function registerAdminCommands(cli, ctx) {
   cli.command("admin [action] [...rest]", "Operator commands (admin only): reconcile-routes").option("--app <name>", "(reconcile-routes) Limit to a single app by name").option("--app-id <id>", "(reconcile-routes) Limit to a single app by id").option("--dry-run", "(reconcile-routes) Read-only diff — no Caddy mutations, returns missing/extra/host drift").option("--json", "(reconcile-routes) Output JSON instead of formatted text").action(async (action, _rest, options) => {
     if (action === "reconcile-routes") {
       if (!ctx.client.token) {
-        await writeLine(ctx, `${import_picocolors3.default.red("✗")} Not logged in. Run: percher login`);
+        await writeLine2(ctx, `${import_picocolors3.default.red("✗")} Not logged in. Run: percher login`);
         throw new SilentExitError;
       }
       const result = await adminReconcileRoutes(ctx, {
@@ -118716,7 +119053,7 @@ function registerAdminCommands(cli, ctx) {
         dryRun: Boolean(options.dryRun)
       });
       if (options.json) {
-        await writeLine(ctx, JSON.stringify(result, null, 2));
+        await writeLine2(ctx, JSON.stringify(result, null, 2));
         return;
       }
       if (options.dryRun) {
@@ -118725,25 +119062,25 @@ function registerAdminCommands(cli, ctx) {
         const extra = result.extraRoute ?? 0;
         const drift = result.dryRunDrift ?? [];
         if (missing === 0 && hostDrift === 0 && extra === 0) {
-          await writeLine(ctx, `${import_picocolors3.default.green("✓")} No drift — Caddy matches expected routes.`);
+          await writeLine2(ctx, `${import_picocolors3.default.green("✓")} No drift — Caddy matches expected routes.`);
           return;
         }
-        await writeLine(ctx, `${import_picocolors3.default.yellow("!")} drift: ${missing} missing route(s), ${hostDrift} missing host(s), ${extra} extra route(s)`);
+        await writeLine2(ctx, `${import_picocolors3.default.yellow("!")} drift: ${missing} missing route(s), ${hostDrift} missing host(s), ${extra} extra route(s)`);
         for (const d of drift) {
           const label = d.kind === "missing_route" ? import_picocolors3.default.red("MISSING") : d.kind === "missing_host" ? import_picocolors3.default.yellow("HOST_DRIFT") : import_picocolors3.default.dim("EXTRA");
           const target = d.appName ? `[${d.appName}] ` : "";
-          await writeLine(ctx, `  ${label} ${target}${d.routeId} (${d.routeType}) — ${d.hosts.join(", ")}`);
+          await writeLine2(ctx, `  ${label} ${target}${d.routeId} (${d.routeType}) — ${d.hosts.join(", ")}`);
         }
-        await writeLine(ctx, import_picocolors3.default.dim(`Repair: percher admin reconcile-routes${options.app ? ` --app ${options.app}` : ""}`));
+        await writeLine2(ctx, import_picocolors3.default.dim(`Repair: percher admin reconcile-routes${options.app ? ` --app ${options.app}` : ""}`));
         return;
       }
       if (result.errors === 0) {
-        await writeLine(ctx, `${import_picocolors3.default.green("✓")} reconciled ${result.reconciled}, recovered ${result.recovered}, stale ${result.stale}, errors 0`);
+        await writeLine2(ctx, `${import_picocolors3.default.green("✓")} reconciled ${result.reconciled}, recovered ${result.recovered}, stale ${result.stale}, errors 0`);
         return;
       }
-      await writeLine(ctx, `${import_picocolors3.default.yellow("!")} reconciled ${result.reconciled}, errors ${result.errors} (app=${result.appRouteErrors} pb=${result.pbRouteErrors} sleeping=${result.sleepingRouteErrors})`);
+      await writeLine2(ctx, `${import_picocolors3.default.yellow("!")} reconciled ${result.reconciled}, errors ${result.errors} (app=${result.appRouteErrors} pb=${result.pbRouteErrors} sleeping=${result.sleepingRouteErrors})`);
       for (const e of result.perAppErrors) {
-        await writeLine(ctx, `  ${import_picocolors3.default.red("✗")} [${e.appName}] ${e.routeId} (${e.routeType}) — ${e.errorCode}: ${e.cause}`);
+        await writeLine2(ctx, `  ${import_picocolors3.default.red("✗")} [${e.appName}] ${e.routeId} (${e.routeType}) — ${e.errorCode}: ${e.cause}`);
       }
       throw new SilentExitError(1);
     }
@@ -118760,156 +119097,162 @@ function assertNever2(status2, summary) {
 async function handlePublishResult(ctx, result, options = {}) {
   switch (result.status) {
     case "dry_run": {
-      await writeLine(ctx, `Dry run: ${result.fileCount} files, ${(result.bytes / 1024).toFixed(1)} KB`);
+      await writeLine2(ctx, `Dry run: ${result.fileCount} files, ${(result.bytes / 1024).toFixed(1)} KB`);
+      return;
+    }
+    case "check_passed": {
+      const timing = result.timing ? ` (${result.timing.totalSeconds}s)` : "";
+      await writeLine2(ctx, `${import_picocolors4.default.green("✓")} Check passed${timing} — would build and boot`);
+      await writeLine2(ctx, import_picocolors4.default.dim("  The live app was not changed. Run `percher publish` to ship."));
       return;
     }
     case "needs_login": {
       if (result.loginUrl) {
-        await writeLine(ctx, `${import_picocolors4.default.yellow("!")} Not logged in. Authorize here:`);
-        await writeLine(ctx, `  ${result.loginUrl}`);
+        await writeLine2(ctx, `${import_picocolors4.default.yellow("!")} Not logged in. Authorize here:`);
+        await writeLine2(ctx, `  ${result.loginUrl}`);
       } else {
-        await writeLine(ctx, `${import_picocolors4.default.red("✗")} Not logged in. Run: percher login`);
+        await writeLine2(ctx, `${import_picocolors4.default.red("✗")} Not logged in. Run: percher login`);
       }
       throw new SilentExitError;
     }
     case "auth_pending": {
       if (result.loginUrl) {
-        await writeLine(ctx, `${import_picocolors4.default.yellow("!")} Not logged in. Authorize here:`);
-        await writeLine(ctx, `  ${result.loginUrl}`);
+        await writeLine2(ctx, `${import_picocolors4.default.yellow("!")} Not logged in. Authorize here:`);
+        await writeLine2(ctx, `  ${result.loginUrl}`);
       } else {
-        await writeLine(ctx, `${import_picocolors4.default.red("✗")} Not logged in. Run: percher login`);
+        await writeLine2(ctx, `${import_picocolors4.default.red("✗")} Not logged in. Run: percher login`);
       }
       throw new SilentExitError;
     }
     case "queued": {
-      await writeLine(ctx, `${import_picocolors4.default.yellow("!")} ${result.summary}`);
+      await writeLine2(ctx, `${import_picocolors4.default.yellow("!")} ${result.summary}`);
       const deployId = result.deployment?.id;
       const appName = result.app?.name;
       if (deployId && appName) {
-        await writeLine(ctx, import_picocolors4.default.dim(`  Next: percher wait-for-deploy ${deployId} --app ${appName}`));
+        await writeLine2(ctx, import_picocolors4.default.dim(`  Next: percher wait-for-deploy ${deployId} --app ${appName}`));
       } else if (deployId) {
-        await writeLine(ctx, import_picocolors4.default.dim(`  Next: percher wait-for-deploy ${deployId}`));
+        await writeLine2(ctx, import_picocolors4.default.dim(`  Next: percher wait-for-deploy ${deployId}`));
       }
       return;
     }
     case "already_in_progress": {
-      await writeLine(ctx, `${import_picocolors4.default.yellow("!")} ${result.summary}`);
+      await writeLine2(ctx, `${import_picocolors4.default.yellow("!")} ${result.summary}`);
       if (result.recovery.nextAction === "wait_deploy") {
         const args = result.recovery.args;
         if (args.app && args.deployId) {
-          await writeLine(ctx, import_picocolors4.default.dim(`  Next: percher wait-for-deploy ${args.deployId} --app ${args.app}`));
+          await writeLine2(ctx, import_picocolors4.default.dim(`  Next: percher wait-for-deploy ${args.deployId} --app ${args.app}`));
         }
       }
       return;
     }
     case "replaced": {
-      await writeLine(ctx, `${import_picocolors4.default.yellow("!")} ${result.summary}`);
+      await writeLine2(ctx, `${import_picocolors4.default.yellow("!")} ${result.summary}`);
       if (result.url) {
-        await writeLine(ctx, import_picocolors4.default.dim(`  Live URL: ${result.url}`));
+        await writeLine2(ctx, import_picocolors4.default.dim(`  Live URL: ${result.url}`));
       }
       if (result.recovery.nextAction === "wait_deploy") {
         const args = result.recovery.args;
         if (args.app && args.deployId) {
-          await writeLine(ctx, import_picocolors4.default.dim(`  Next: percher deploys inspect ${args.deployId} --app ${args.app}`));
+          await writeLine2(ctx, import_picocolors4.default.dim(`  Next: percher deploys inspect ${args.deployId} --app ${args.app}`));
         }
       } else if (result.recovery.nextAction === "ask_user" || result.recovery.nextAction === "run_doctor") {
         const appName = result.app?.name;
         if (appName) {
-          await writeLine(ctx, import_picocolors4.default.dim(`  Next: percher doctor --app ${appName}`));
+          await writeLine2(ctx, import_picocolors4.default.dim(`  Next: percher doctor --app ${appName}`));
         } else {
-          await writeLine(ctx, import_picocolors4.default.dim("  Next: percher doctor"));
+          await writeLine2(ctx, import_picocolors4.default.dim("  Next: percher doctor"));
         }
       }
       return;
     }
     case "failed": {
-      await writeLine(ctx, `${import_picocolors4.default.red("✗")} ${result.error?.title ?? "Deployment failed"}`);
+      await writeLine2(ctx, `${import_picocolors4.default.red("✗")} ${result.error?.title ?? "Deployment failed"}`);
       if (result.error?.explanation) {
-        await writeLine(ctx, `  ${result.error.explanation}`);
+        await writeLine2(ctx, `  ${result.error.explanation}`);
       }
       if (result.error?.rawErrorMessage) {
-        await writeLine(ctx, `  ${import_picocolors4.default.dim(`Details: ${result.error.rawErrorMessage}`)}`);
+        await writeLine2(ctx, `  ${import_picocolors4.default.dim(`Details: ${result.error.rawErrorMessage}`)}`);
       }
       if (result.error?.suggestion) {
-        await writeLine(ctx, `  ${import_picocolors4.default.dim(result.error.suggestion)}`);
+        await writeLine2(ctx, `  ${import_picocolors4.default.dim(result.error.suggestion)}`);
       }
       if (result.error?.missingEnvVars && result.error.missingEnvVars.length > 0) {
-        await writeLine(ctx, "");
-        await writeLine(ctx, import_picocolors4.default.bold("Missing env vars:"));
+        await writeLine2(ctx, "");
+        await writeLine2(ctx, import_picocolors4.default.bold("Missing env vars:"));
         for (const k of result.error.missingEnvVars) {
-          await writeLine(ctx, `  ${k}`);
+          await writeLine2(ctx, `  ${k}`);
         }
-        await writeLine(ctx, import_picocolors4.default.dim(`  Set with: percher env set ${result.error.missingEnvVars[0]}=...`));
+        await writeLine2(ctx, import_picocolors4.default.dim(`  Set with: percher env set ${result.error.missingEnvVars[0]}=...`));
       }
       if (result.error?.relevantFiles && result.error.relevantFiles.length > 0) {
-        await writeLine(ctx, "");
-        await writeLine(ctx, import_picocolors4.default.bold("Check these files:"));
+        await writeLine2(ctx, "");
+        await writeLine2(ctx, import_picocolors4.default.bold("Check these files:"));
         for (const f of result.error.relevantFiles) {
-          await writeLine(ctx, `  ${f}`);
+          await writeLine2(ctx, `  ${f}`);
         }
       }
       if (result.error?.buildLogTail) {
-        await writeLine(ctx, "");
+        await writeLine2(ctx, "");
         const lines = result.error.buildLogTail.split(`
 `);
-        await writeLine(ctx, `${import_picocolors4.default.bold("Build log")} ${import_picocolors4.default.dim(`(last ${lines.length} lines)`)}`);
+        await writeLine2(ctx, `${import_picocolors4.default.bold("Build log")} ${import_picocolors4.default.dim(`(last ${lines.length} lines)`)}`);
         for (const line of lines) {
-          await writeLine(ctx, `  ${line}`);
+          await writeLine2(ctx, `  ${line}`);
         }
         if (result.app?.id && result.deployment?.id) {
-          await writeLine(ctx, "");
-          await writeLine(ctx, import_picocolors4.default.dim(`Full log: percher deploys inspect ${result.deployment.id} --app ${result.app.name}`));
+          await writeLine2(ctx, "");
+          await writeLine2(ctx, import_picocolors4.default.dim(`Full log: percher deploys inspect ${result.deployment.id} --app ${result.app.name}`));
         }
       }
       throw new SilentExitError;
     }
     case "live": {
       const timing = result.timing ? ` (${result.timing.totalSeconds}s)` : "";
-      await writeLine(ctx, `${import_picocolors4.default.green("✓")} Published to ${result.url}${timing}`);
+      await writeLine2(ctx, `${import_picocolors4.default.green("✓")} Published to ${result.url}${timing}`);
       if (result.traceId) {
-        await writeLine(ctx, import_picocolors4.default.dim(`  Trace: ${result.traceId}`));
+        await writeLine2(ctx, import_picocolors4.default.dim(`  Trace: ${result.traceId}`));
       }
       if (result.cacheReused) {
-        await writeLine(ctx, import_picocolors4.default.dim("  Build cache: reused — identical bundle, redeployed without re-upload (--no-cache to force a fresh build)"));
+        await writeLine2(ctx, import_picocolors4.default.dim("  Build cache: reused — identical bundle, redeployed without re-upload (--no-cache to force a fresh build)"));
       } else {
         const status2 = result.cacheStatus ?? (result.cacheHit === true ? "image_reused" : result.cacheHit === false ? "fresh" : null);
         if (status2 === "image_reused") {
-          await writeLine(ctx, import_picocolors4.default.dim("  Build cache: hit (reused image — re-run with --no-cache if your changes aren't reflected)"));
+          await writeLine2(ctx, import_picocolors4.default.dim("  Build cache: hit (reused image — re-run with --no-cache if your changes aren't reflected)"));
         } else if (status2 === "layer_hit") {
-          await writeLine(ctx, import_picocolors4.default.dim("  Build cache: layer hit (Docker reused unchanged layers — full nixpacks/build skipped)"));
+          await writeLine2(ctx, import_picocolors4.default.dim("  Build cache: layer hit (Docker reused unchanged layers — full nixpacks/build skipped)"));
         } else if (status2 === "fresh") {
-          await writeLine(ctx, import_picocolors4.default.dim("  Build cache: miss (fresh build)"));
+          await writeLine2(ctx, import_picocolors4.default.dim("  Build cache: miss (fresh build)"));
         }
       }
       if (typeof result.deployment?.imageSizeBytes === "number") {
-        await writeLine(ctx, import_picocolors4.default.dim(`  Image size: ${formatBytes(result.deployment.imageSizeBytes)}`));
+        await writeLine2(ctx, import_picocolors4.default.dim(`  Image size: ${formatBytes(result.deployment.imageSizeBytes)}`));
       }
       if (result.replacedPreview) {
-        await writeLine(ctx, import_picocolors4.default.dim("  (replaced previous preview — free plan keeps 1 preview slot per app)"));
+        await writeLine2(ctx, import_picocolors4.default.dim("  (replaced previous preview — free plan keeps 1 preview slot per app)"));
       }
       if (options.preview && result.url) {
         try {
           const qr = await qrToTerminal(result.url);
-          await writeLine(ctx, "");
-          await writeLine(ctx, import_picocolors4.default.dim("Scan to preview on mobile:"));
-          await writeLine(ctx, qr);
+          await writeLine2(ctx, "");
+          await writeLine2(ctx, import_picocolors4.default.dim("Scan to preview on mobile:"));
+          await writeLine2(ctx, qr);
         } catch {}
       }
       if (result.anonymous && result.claim) {
-        await writeLine(ctx, "");
-        await writeLine(ctx, import_picocolors4.default.bold("Anonymous app — claim it to keep it:"));
-        await writeLine(ctx, `  Expires:     ${new Date(result.claim.expiresAt).toLocaleString()}`);
-        await writeLine(ctx, `  Claim token: ${result.claim.claimToken}`);
-        await writeLine(ctx, `  ${import_picocolors4.default.cyan("percher claim")}   claim into your account (lifts the limits on next deploy)`);
+        await writeLine2(ctx, "");
+        await writeLine2(ctx, import_picocolors4.default.bold("Anonymous app — claim it to keep it:"));
+        await writeLine2(ctx, `  Expires:     ${new Date(result.claim.expiresAt).toLocaleString()}`);
+        await writeLine2(ctx, `  Claim token: ${result.claim.claimToken}`);
+        await writeLine2(ctx, `  ${import_picocolors4.default.cyan("percher claim")}   claim into your account (lifts the limits on next deploy)`);
         for (const w of result.warnings ?? []) {
-          await writeLine(ctx, import_picocolors4.default.dim(`  ${w}`));
+          await writeLine2(ctx, import_picocolors4.default.dim(`  ${w}`));
         }
       } else if (result.firstDeploy) {
-        await writeLine(ctx, "");
-        await writeLine(ctx, import_picocolors4.default.bold("First deploy — next steps:"));
-        await writeLine(ctx, `  ${import_picocolors4.default.cyan("percher dev")}          watch for changes and re-deploy`);
-        await writeLine(ctx, `  ${import_picocolors4.default.cyan("percher env set KEY")}  add environment variables`);
-        await writeLine(ctx, `  ${import_picocolors4.default.cyan("percher logs")}         stream live logs`);
+        await writeLine2(ctx, "");
+        await writeLine2(ctx, import_picocolors4.default.bold("First deploy — next steps:"));
+        await writeLine2(ctx, `  ${import_picocolors4.default.cyan("percher dev")}          watch for changes and re-deploy`);
+        await writeLine2(ctx, `  ${import_picocolors4.default.cyan("percher env set KEY")}  add environment variables`);
+        await writeLine2(ctx, `  ${import_picocolors4.default.cyan("percher logs")}         stream live logs`);
       }
       return;
     }
@@ -118924,9 +119267,9 @@ function registerAppsCommands(cli, ctx) {
       name: options.name,
       interactive: true
     });
-    await writeLine(ctx, `${import_picocolors4.default.green("✓")} wrote ${result.path}`);
+    await writeLine2(ctx, `${import_picocolors4.default.green("✓")} wrote ${result.path}`);
     for (const file2 of result.scaffoldedFiles) {
-      await writeLine(ctx, `${import_picocolors4.default.green("✓")} wrote ${file2}`);
+      await writeLine2(ctx, `${import_picocolors4.default.green("✓")} wrote ${file2}`);
     }
   });
   cli.command("appstore-kit", "Write app-store starter files (PWA manifest, TWA/Capacitor, asset links)").option("--name <name>", "App name (defaults to percher.toml / directory)").option("--url <url>", "App URL (defaults to https://<name>.percher.run)").option("--package <pkg>", "Android package name for assetlinks.json").option("--fingerprint <sha256>", "Signing-cert SHA-256 for assetlinks.json").option("--team-id <id>", "Apple Team ID for apple-app-site-association").option("--bundle-id <id>", "Apple bundle ID for apple-app-site-association").option("--out <dir>", "Output directory (defaults to the current directory)").option("--force", "Overwrite files that already exist").action(async (options) => {
@@ -118941,32 +119284,32 @@ function registerAppsCommands(cli, ctx) {
       force: options.force
     });
     for (const file2 of result.written) {
-      await writeLine(ctx, `${import_picocolors4.default.green("✓")} wrote ${file2}`);
+      await writeLine2(ctx, `${import_picocolors4.default.green("✓")} wrote ${file2}`);
     }
     for (const file2 of result.skipped) {
-      await writeLine(ctx, `${import_picocolors4.default.dim("•")} skipped ${file2} (exists — pass --force to overwrite)`);
-    }
-    await writeLine(ctx, "");
-    await writeLine(ctx, `${import_picocolors4.default.bold("Make it an installable PWA:")} link the manifest from your HTML`);
-    await writeLine(ctx, `  <link rel="manifest" href="/manifest.json">`);
-    await writeLine(ctx, "and register the service worker from your app entry:");
-    await writeLine(ctx, result.swRegistration);
-    await writeLine(ctx, "");
-    await writeLine(ctx, `${import_picocolors4.default.bold("Wrap for Google Play (TWA):")}`);
-    await writeLine(ctx, result.bubblewrapCommand);
-    await writeLine(ctx, "");
-    await writeLine(ctx, `The two ${import_picocolors4.default.dim(".well-known")} files are trust assertions for your origin — add real values`);
-    await writeLine(ctx, `after you sign the apps, then serve them yourself or let Percher serve them from the`);
-    await writeLine(ctx, "App store kit at https://percher.app. Full guide: /docs/app-stores");
+      await writeLine2(ctx, `${import_picocolors4.default.dim("•")} skipped ${file2} (exists — pass --force to overwrite)`);
+    }
+    await writeLine2(ctx, "");
+    await writeLine2(ctx, `${import_picocolors4.default.bold("Make it an installable PWA:")} link the manifest from your HTML`);
+    await writeLine2(ctx, `  <link rel="manifest" href="/manifest.json">`);
+    await writeLine2(ctx, "and register the service worker from your app entry:");
+    await writeLine2(ctx, result.swRegistration);
+    await writeLine2(ctx, "");
+    await writeLine2(ctx, `${import_picocolors4.default.bold("Wrap for Google Play (TWA):")}`);
+    await writeLine2(ctx, result.bubblewrapCommand);
+    await writeLine2(ctx, "");
+    await writeLine2(ctx, `The two ${import_picocolors4.default.dim(".well-known")} files are trust assertions for your origin — add real values`);
+    await writeLine2(ctx, `after you sign the apps, then serve them yourself or let Percher serve them from the`);
+    await writeLine2(ctx, "App store kit at https://percher.app. Full guide: /docs/app-stores");
   });
-  cli.command("publish", "Publish this project to Percher (recommended deploy command)").option("--force", "Skip size warnings").option("--preview", "Deploy as preview (does not replace the live version)").option("-m, --message <msg>", "Deploy note (visible in deploy history)").option("--dry-run", "Show what would be deployed (file count, bytes) without uploading").option("--no-cache", "Skip image-cache lookup and force a fresh build (use when you suspect cached image is stale)").option("--anonymous", "Publish without an account — a 72h sandbox you can claim later (where enabled)").action(async (options) => {
+  cli.command("publish", "Publish this project to Percher (recommended deploy command)").option("--force", "Skip size warnings").option("--preview", "Deploy as preview (does not replace the live version)").option("-m, --message <msg>", "Deploy note (visible in deploy history)").option("--dry-run", "Show what would be deployed (file count, bytes) without uploading").option("--check", "Validation deploy: build → start → health, then tear down (no swap, no route). The live app is not changed. Consumes the preview quota.").option("--no-cache", "Skip image-cache lookup and force a fresh build (use when you suspect cached image is stale)").option("--anonymous", "Publish without an account — a 72h sandbox you can claim later (where enabled)").action(async (options) => {
     const { detectCiBranchMessage: detectCiBranchMessage2 } = await Promise.resolve().then(() => exports_ci_env);
     let messageOverride = options.message;
     if (options.preview && !options.message) {
       const ci = detectCiBranchMessage2(process.env);
       if (ci) {
         messageOverride = ci.message;
-        await writeLine(ctx, import_picocolors4.default.dim(`Auto-detected ${ci.source} branch — using deploy note "${ci.message}"`));
+        await writeLine2(ctx, import_picocolors4.default.dim(`Auto-detected ${ci.source} branch — using deploy note "${ci.message}"`));
       }
     }
     const result = await publish(ctx, {
@@ -118974,52 +119317,54 @@ function registerAppsCommands(cli, ctx) {
       preview: options.preview,
       message: messageOverride,
       dryRun: options.dryRun,
+      check: options.check,
       noCache: options.cache === false,
       anonymous: options.anonymous
     });
     await handlePublishResult(ctx, result, { preview: options.preview });
   });
-  cli.command("redeploy [deployId]", "Re-run an existing deploy without re-uploading source").option("--app <name>", "App name (defaults to percher.toml app.name)").action(async (deployId, options) => {
+  cli.command("redeploy [deployId]", "Re-run an existing deploy without re-uploading source").option("--app <name>", "App name (defaults to percher.toml app.name)").option("--no-cache", "Force a fresh build of that deploy's source (skip the image cache — the stale-image escape hatch)").action(async (deployId, options) => {
     const result = await redeploy(ctx, {
       app: options.app,
-      deployId
+      deployId,
+      noCache: options.cache === false
     });
     if (result.status === "needs_login") {
-      await writeLine(ctx, `${import_picocolors4.default.red("✗")} Not logged in. Run: percher login`);
+      await writeLine2(ctx, `${import_picocolors4.default.red("✗")} Not logged in. Run: percher login`);
       throw new SilentExitError;
     }
     if (result.status === "failed") {
-      await writeLine(ctx, `${import_picocolors4.default.red("✗")} ${result.error?.title ?? "Redeploy failed"}`);
+      await writeLine2(ctx, `${import_picocolors4.default.red("✗")} ${result.error?.title ?? "Redeploy failed"}`);
       if (result.error?.explanation) {
-        await writeLine(ctx, `  ${result.error.explanation}`);
+        await writeLine2(ctx, `  ${result.error.explanation}`);
       }
       if (result.error?.suggestion) {
-        await writeLine(ctx, `  ${import_picocolors4.default.dim(result.error.suggestion)}`);
+        await writeLine2(ctx, `  ${import_picocolors4.default.dim(result.error.suggestion)}`);
       }
       if (result.error?.problems && result.error.problems.length > 0) {
-        await writeLine(ctx, "");
-        await writeLine(ctx, import_picocolors4.default.bold("Build problems:"));
+        await writeLine2(ctx, "");
+        await writeLine2(ctx, import_picocolors4.default.bold("Build problems:"));
         for (const p of result.error.problems) {
           const loc = p.file ? ` ${import_picocolors4.default.dim(`${p.file}${p.line ? `:${p.line}` : ""}${p.column ? `:${p.column}` : ""}`)}` : "";
-          await writeLine(ctx, `  ${import_picocolors4.default.red(p.code)}${loc} ${p.message}`);
+          await writeLine2(ctx, `  ${import_picocolors4.default.red(p.code)}${loc} ${p.message}`);
           if (p.hint)
-            await writeLine(ctx, `    ${import_picocolors4.default.dim(`→ ${p.hint}`)}`);
+            await writeLine2(ctx, `    ${import_picocolors4.default.dim(`→ ${p.hint}`)}`);
         }
       }
       throw new SilentExitError;
     }
     const timing = result.timing ? ` (${result.timing.totalSeconds.toFixed(0)}s)` : "";
-    await writeLine(ctx, `${import_picocolors4.default.green("✓")} Redeployed to ${result.url}${timing}`);
+    await writeLine2(ctx, `${import_picocolors4.default.green("✓")} Redeployed to ${result.url}${timing}`);
   });
   cli.command("wait-for-deploy <deployId>", "Wait for an in-flight deploy to finish").option("--app <name>", "App name (defaults to percher.toml app.name)").option("--timeout <seconds>", "Max seconds to wait (default: 600)").action(async (deployId, options) => {
     const appName = options.app ?? readPercherTomlAppName(ctx.cwd);
     if (!appName) {
-      await writeLine(ctx, `${import_picocolors4.default.red("✗")} No app specified — pass --app <name> or run from a directory with percher.toml.`);
+      await writeLine2(ctx, `${import_picocolors4.default.red("✗")} No app specified — pass --app <name> or run from a directory with percher.toml.`);
       throw new SilentExitError(1);
     }
     const timeoutSec = Number.parseInt(options.timeout ?? "600", 10);
     if (!Number.isFinite(timeoutSec) || timeoutSec <= 0) {
-      await writeLine(ctx, `${import_picocolors4.default.red("✗")} --timeout must be a positive number of seconds.`);
+      await writeLine2(ctx, `${import_picocolors4.default.red("✗")} --timeout must be a positive number of seconds.`);
       throw new SilentExitError(1);
     }
     const deadline = Date.now() + timeoutSec * 1000;
@@ -119027,7 +119372,7 @@ function registerAppsCommands(cli, ctx) {
     for (;; ) {
       const remainingMs = deadline - Date.now();
       if (remainingMs <= 0) {
-        await writeLine(ctx, `${import_picocolors4.default.yellow("!")} Still running after the timeout — re-run: percher wait-for-deploy ${deployId} --app ${appName}`);
+        await writeLine2(ctx, `${import_picocolors4.default.yellow("!")} Still running after the timeout — re-run: percher wait-for-deploy ${deployId} --app ${appName}`);
         throw new SilentExitError(1);
       }
       let raceTimer;
@@ -119049,22 +119394,22 @@ function registerAppsCommands(cli, ctx) {
       }
       if (result === null) {
         callController.abort();
-        await writeLine(ctx, `${import_picocolors4.default.yellow("!")} Still running after the timeout — re-run: percher wait-for-deploy ${deployId} --app ${appName}`);
+        await writeLine2(ctx, `${import_picocolors4.default.yellow("!")} Still running after the timeout — re-run: percher wait-for-deploy ${deployId} --app ${appName}`);
         throw new SilentExitError(1);
       }
       if (result.deployment.status !== lastStatus) {
         lastStatus = result.deployment.status;
-        await writeLine(ctx, import_picocolors4.default.dim(`${lastStatus}...`));
+        await writeLine2(ctx, import_picocolors4.default.dim(`${lastStatus}...`));
       }
       if (result.status === "live") {
-        await writeLine(ctx, `${import_picocolors4.default.green("✓")} ${result.summary}`);
+        await writeLine2(ctx, `${import_picocolors4.default.green("✓")} ${result.summary}`);
         return;
       }
       if (result.status === "failed" || result.status === "replaced") {
         const mark = result.status === "failed" ? import_picocolors4.default.red("✗") : import_picocolors4.default.yellow("!");
-        await writeLine(ctx, `${mark} ${result.summary}`);
+        await writeLine2(ctx, `${mark} ${result.summary}`);
         if (result.error?.suggestion) {
-          await writeLine(ctx, `  ${import_picocolors4.default.dim(result.error.suggestion)}`);
+          await writeLine2(ctx, `  ${import_picocolors4.default.dim(result.error.suggestion)}`);
         }
         if (result.status === "failed")
           throw new SilentExitError(1);
@@ -119080,49 +119425,49 @@ function registerAppsCommands(cli, ctx) {
       noCache: options.cache === false
     });
     if (result.dryRun) {
-      await writeLine(ctx, `Dry run: ${result.fileCount} files, ${(result.bytes / 1024).toFixed(1)} KB`);
+      await writeLine2(ctx, `Dry run: ${result.fileCount} files, ${(result.bytes / 1024).toFixed(1)} KB`);
     } else {
       const url2 = result.deployment?.previewUrl ?? result.deployment?.url ?? result.app.url;
       const label = result.deployment?.previewUrl ? "preview live at" : "deployed to";
-      await writeLine(ctx, `${import_picocolors4.default.green("✓")} ${label} ${url2}`);
+      await writeLine2(ctx, `${import_picocolors4.default.green("✓")} ${label} ${url2}`);
       const status2 = result.deployment?.cacheStatus ?? (result.deployment?.cacheHit === true ? "image_reused" : result.deployment?.cacheHit === false ? "fresh" : null);
       if (status2 === "image_reused") {
-        await writeLine(ctx, import_picocolors4.default.dim("  Build cache: hit (reused image — re-run with --no-cache if your changes aren't reflected)"));
+        await writeLine2(ctx, import_picocolors4.default.dim("  Build cache: hit (reused image — re-run with --no-cache if your changes aren't reflected)"));
       } else if (status2 === "layer_hit") {
-        await writeLine(ctx, import_picocolors4.default.dim("  Build cache: layer hit (Docker reused unchanged layers — full nixpacks/build skipped)"));
+        await writeLine2(ctx, import_picocolors4.default.dim("  Build cache: layer hit (Docker reused unchanged layers — full nixpacks/build skipped)"));
       } else if (status2 === "fresh") {
-        await writeLine(ctx, import_picocolors4.default.dim("  Build cache: miss (fresh build)"));
+        await writeLine2(ctx, import_picocolors4.default.dim("  Build cache: miss (fresh build)"));
       }
       if (typeof result.deployment?.imageSizeBytes === "number") {
-        await writeLine(ctx, import_picocolors4.default.dim(`  Image size: ${formatBytes(result.deployment.imageSizeBytes)}`));
+        await writeLine2(ctx, import_picocolors4.default.dim(`  Image size: ${formatBytes(result.deployment.imageSizeBytes)}`));
       }
     }
   });
   cli.command("rename <name> [app]", "Rename an app (changes its subdomain)").action(async (name, app) => {
     const result = await rename2(ctx, { app, name });
-    await writeLine(ctx, `${import_picocolors4.default.green("✓")} Renamed to ${result.name} — now live at ${result.url}`);
-    await writeLine(ctx, `  Previous name: ${result.previousName} (reserved for 60 days)`);
+    await writeLine2(ctx, `${import_picocolors4.default.green("✓")} Renamed to ${result.name} — now live at ${result.url}`);
+    await writeLine2(ctx, `  Previous name: ${result.previousName} (reserved for 60 days)`);
     if (result.tomlUpdated) {
-      await writeLine(ctx, `  percher.toml updated: name = "${result.name}"`);
+      await writeLine2(ctx, `  percher.toml updated: name = "${result.name}"`);
     } else {
-      await writeLine(ctx, `  ${import_picocolors4.default.yellow("!")} Update percher.toml before the next publish: name = "${result.name}"`);
+      await writeLine2(ctx, `  ${import_picocolors4.default.yellow("!")} Update percher.toml before the next publish: name = "${result.name}"`);
     }
-    await writeLine(ctx, `  ${import_picocolors4.default.dim(`Next rename available in ${result.cooldownDays} days`)}`);
+    await writeLine2(ctx, `  ${import_picocolors4.default.dim(`Next rename available in ${result.cooldownDays} days`)}`);
   });
   cli.command("open [app]", "Open the app URL in your browser").action(async (app) => {
     const url2 = await open(ctx, { app });
-    await writeLine(ctx, url2);
+    await writeLine2(ctx, url2);
   });
   cli.command("dashboard [tab]", "Open the dashboard for this app (optionally on a specific tab)").option("--app <name>", "App name (overrides percher.toml)").action(async (tab, options) => {
     const url2 = await dashboard(ctx, { app: options.app, tab });
-    await writeLine(ctx, url2);
+    await writeLine2(ctx, url2);
   });
   cli.command("create [name]", "Create a new app from a template").option("--template <template>", "Template to use (node, python, static, nextjs, hono, express)").option("--force", "Overwrite existing files in target directory").option("--list-templates", "List available templates").action(async (name, options) => {
     if (options.listTemplates) {
       const templates = listTemplates();
-      await writeLine(ctx, import_picocolors4.default.bold("Available templates:"));
+      await writeLine2(ctx, import_picocolors4.default.bold("Available templates:"));
       for (const t of templates) {
-        await writeLine(ctx, `  ${t}`);
+        await writeLine2(ctx, `  ${t}`);
       }
       return;
     }
@@ -119131,7 +119476,7 @@ function registerAppsCommands(cli, ctx) {
     }
     if (!options.template) {
       const templates = listTemplates();
-      await writeLine(ctx, `${import_picocolors4.default.red("✗")} --template is required. Available: ${templates.join(", ")}`);
+      await writeLine2(ctx, `${import_picocolors4.default.red("✗")} --template is required. Available: ${templates.join(", ")}`);
       return;
     }
     const result = await create(ctx, {
@@ -119139,41 +119484,41 @@ function registerAppsCommands(cli, ctx) {
       template: options.template,
       force: options.force
     });
-    await writeLine(ctx, `${import_picocolors4.default.green("✓")} created ${result.name} from ${result.template}`);
+    await writeLine2(ctx, `${import_picocolors4.default.green("✓")} created ${result.name} from ${result.template}`);
     for (const f of result.files) {
-      await writeLine(ctx, `  ${import_picocolors4.default.dim(f)}`);
+      await writeLine2(ctx, `  ${import_picocolors4.default.dim(f)}`);
     }
-    await writeLine(ctx, "");
-    await writeLine(ctx, "Next steps:");
-    await writeLine(ctx, `  cd ${result.name}`);
-    await writeLine(ctx, "  bunx percher publish");
+    await writeLine2(ctx, "");
+    await writeLine2(ctx, "Next steps:");
+    await writeLine2(ctx, `  cd ${result.name}`);
+    await writeLine2(ctx, "  bunx percher publish");
   });
   cli.command("delete [app]", "Delete an app permanently").option("--yes", "Skip confirmation prompt").action(async (app, options) => {
     const name = app ?? readPercherTomlAppName(ctx.cwd);
     if (!name) {
-      await writeLine(ctx, `${import_picocolors4.default.red("✗")} No app specified and no percher.toml found.`);
+      await writeLine2(ctx, `${import_picocolors4.default.red("✗")} No app specified and no percher.toml found.`);
       throw new SilentExitError;
     }
     if (!options.yes) {
       const answer = await ctx.prompt(`${import_picocolors4.default.red("!")} This will permanently delete ${import_picocolors4.default.bold(name)} and all its data. Type the app name to confirm:`);
       if (answer.trim() !== name) {
-        await writeLine(ctx, "Cancelled.");
+        await writeLine2(ctx, "Cancelled.");
         return;
       }
     }
     await deleteApp(ctx, { app: name, confirm: true });
-    await writeLine(ctx, `${import_picocolors4.default.green("✓")} Deleted ${name}`);
+    await writeLine2(ctx, `${import_picocolors4.default.green("✓")} Deleted ${name}`);
   });
   cli.command("resume [app]", "Resume an app suspended for inactivity").action(async (app) => {
     const result = await resume(ctx, { app });
-    await writeLine(ctx, `${import_picocolors4.default.green("✓")} ${result.message}`);
+    await writeLine2(ctx, `${import_picocolors4.default.green("✓")} ${result.message}`);
   });
   cli.command("claim", "Claim an anonymous app into your account").option("--app <name>", "App name (defaults to the persisted anon state or percher.toml)").option("--claim-token <token>", "Claim token from the anonymous publish").action(async (options) => {
     const result = await claim(ctx, { app: options.app, claimToken: options.claimToken });
     if (result.status === "claimed") {
-      await writeLine(ctx, `${import_picocolors4.default.green("✓")} ${result.summary}`);
+      await writeLine2(ctx, `${import_picocolors4.default.green("✓")} ${result.summary}`);
     } else {
-      await writeLine(ctx, `${import_picocolors4.default.yellow("!")} ${result.summary}`);
+      await writeLine2(ctx, `${import_picocolors4.default.yellow("!")} ${result.summary}`);
     }
   });
   cli.command("inspect-link [app]", "Create a public read-only inspect link (or --revoke it)").option("--app <name>", "App name (defaults to percher.toml)").option("--revoke", "Revoke the app's inspect link instead of creating one").action(async (app, options) => {
@@ -119181,49 +119526,49 @@ function registerAppsCommands(cli, ctx) {
       app: app ?? options.app,
       revoke: options.revoke
     });
-    await writeLine(ctx, `${import_picocolors4.default.green("✓")} ${result.summary}`);
+    await writeLine2(ctx, `${import_picocolors4.default.green("✓")} ${result.summary}`);
   });
   cli.command("cache <action> [app]", "Manage the app's build cache (reset)").action(async (action, app) => {
     if (action !== "reset") {
       throw new Error(`Unknown cache action "${action}". Use: percher cache reset [app]`);
     }
     const result = await cacheReset(ctx, { app });
-    await writeLine(ctx, `${import_picocolors4.default.green("✓")} ${result.message}`);
+    await writeLine2(ctx, `${import_picocolors4.default.green("✓")} ${result.message}`);
   });
   cli.command("cache reset [app]", "Reset the app's build cache (next deploy runs cold)").action(async (app) => {
     const result = await cacheReset(ctx, { app });
-    await writeLine(ctx, `${import_picocolors4.default.green("✓")} ${result.message}`);
+    await writeLine2(ctx, `${import_picocolors4.default.green("✓")} ${result.message}`);
   });
   cli.command("doctor [app]", "Check app health and connectivity").option("--json", "Output as JSON").action(async (app, options) => {
     const result = await doctor(ctx, { app, json: options.json });
     if (options.json) {
-      await writeLine(ctx, JSON.stringify(result, null, 2));
+      await writeLine2(ctx, JSON.stringify(result, null, 2));
     } else {
-      await writeLine(ctx, `${import_picocolors4.default.bold("Percher Doctor")}`);
-      await writeLine(ctx, "──────────────");
-      await writeLine(ctx, "");
+      await writeLine2(ctx, `${import_picocolors4.default.bold("Percher Doctor")}`);
+      await writeLine2(ctx, "──────────────");
+      await writeLine2(ctx, "");
       for (const check2 of result.checks) {
         const icon = check2.status === "pass" ? import_picocolors4.default.green("✓") : check2.status === "fail" ? import_picocolors4.default.red("✗") : check2.status === "warn" ? import_picocolors4.default.yellow("!") : import_picocolors4.default.dim("—");
-        await writeLine(ctx, `${icon} ${import_picocolors4.default.bold(check2.name.padEnd(20))} ${check2.message}`);
+        await writeLine2(ctx, `${icon} ${import_picocolors4.default.bold(check2.name.padEnd(20))} ${check2.message}`);
       }
-      await writeLine(ctx, "");
+      await writeLine2(ctx, "");
       const counter = `${result.passed}/${result.total} checks passed`;
       const counterColor = result.status === "ok" ? import_picocolors4.default.green : result.status === "in_progress" ? import_picocolors4.default.yellow : import_picocolors4.default.red;
-      await writeLine(ctx, counterColor(counter));
-      await writeLine(ctx, result.summary);
+      await writeLine2(ctx, counterColor(counter));
+      await writeLine2(ctx, result.summary);
       if (result.suspectDeploy) {
         const s = result.suspectDeploy;
         const head = (s.commitSha ?? s.deployId).slice(0, 10);
-        await writeLine(ctx, "");
-        await writeLine(ctx, import_picocolors4.default.bold(`Likely broken by a deploy (${s.confidence} confidence):`));
-        await writeLine(ctx, `  Suspect:      ${head}`);
+        await writeLine2(ctx, "");
+        await writeLine2(ctx, import_picocolors4.default.bold(`Likely broken by a deploy (${s.confidence} confidence):`));
+        await writeLine2(ctx, `  Suspect:      ${head}`);
         if (s.lastHealthyCommitSha) {
           const base = s.lastHealthyCommitSha.slice(0, 10);
-          await writeLine(ctx, `  Last working: ${base}`);
-          await writeLine(ctx, import_picocolors4.default.dim(`  See what changed: percher diff ${base} ${head}${app ? ` --app ${app}` : ""}`));
+          await writeLine2(ctx, `  Last working: ${base}`);
+          await writeLine2(ctx, import_picocolors4.default.dim(`  See what changed: percher diff ${base} ${head}${app ? ` --app ${app}` : ""}`));
         }
         for (const e of s.evidence)
-          await writeLine(ctx, import_picocolors4.default.dim(`  · ${e}`));
+          await writeLine2(ctx, import_picocolors4.default.dim(`  · ${e}`));
       }
     }
     if (result.status === "blocked" || result.status === "needs_action") {
@@ -119235,15 +119580,15 @@ function registerAppsCommands(cli, ctx) {
     const onSignal = () => controller.abort();
     process.on("SIGINT", onSignal);
     process.on("SIGTERM", onSignal);
-    await writeLine(ctx, import_picocolors4.default.bold("Percher Dev"));
-    await writeLine(ctx, "───────────");
-    await writeLine(ctx, "");
+    await writeLine2(ctx, import_picocolors4.default.bold("Percher Dev"));
+    await writeLine2(ctx, "───────────");
+    await writeLine2(ctx, "");
     try {
       await dev(ctx, { app }, {
         signal: controller.signal,
         async writeLine(line) {
           const timestamp = new Date().toLocaleTimeString("sv-SE", { hour12: false });
-          await writeLine(ctx, `${import_picocolors4.default.dim(`[${timestamp}]`)} ${line}`);
+          await writeLine2(ctx, `${import_picocolors4.default.dim(`[${timestamp}]`)} ${line}`);
         },
         async onFilesChanged(_files) {
           if (options.confirm) {
@@ -119257,8 +119602,8 @@ function registerAppsCommands(cli, ctx) {
       process.removeListener("SIGINT", onSignal);
       process.removeListener("SIGTERM", onSignal);
     }
-    await writeLine(ctx, "");
-    await writeLine(ctx, import_picocolors4.default.dim("Dev session ended."));
+    await writeLine2(ctx, "");
+    await writeLine2(ctx, import_picocolors4.default.dim("Dev session ended."));
   });
 }
 
@@ -119270,11 +119615,11 @@ function registerAuthCommands(cli, ctx) {
   });
   cli.command("whoami", "Show the signed-in user").action(async () => {
     if (!ctx.client.token) {
-      await writeLine(ctx, `${import_picocolors5.default.red("✗")} Not logged in. Run: percher login`);
+      await writeLine2(ctx, `${import_picocolors5.default.red("✗")} Not logged in. Run: percher login`);
       throw new SilentExitError;
     }
     const me = await whoami(ctx);
-    await writeLine(ctx, `Signed in as ${me.email} (${me.userId})`);
+    await writeLine2(ctx, `Signed in as ${me.email} (${me.userId})`);
   });
 }
 
@@ -119297,9 +119642,9 @@ function registerDataCommands(cli, ctx, argv) {
       const out = outIdx >= 0 ? argv[outIdx + 1] : undefined;
       const result2 = await dataExport(ctx, { app: realApp, out });
       const mb = (result2.bytes / 1024 / 1024).toFixed(1);
-      await writeLine(ctx, `${import_picocolors6.default.green("✓")} Exported ${result2.app}`);
-      await writeLine(ctx, `  Path: ${result2.path}`);
-      await writeLine(ctx, `  Size: ${mb} MB`);
+      await writeLine2(ctx, `${import_picocolors6.default.green("✓")} Exported ${result2.app}`);
+      await writeLine2(ctx, `  Path: ${result2.path}`);
+      await writeLine2(ctx, `  Size: ${mb} MB`);
       return;
     }
     if (app === "oauth") {
@@ -119313,48 +119658,48 @@ function registerDataCommands(cli, ctx, argv) {
         remove: options.remove
       });
       if (result2.action === "removed") {
-        await writeLine(ctx, `${import_picocolors6.default.green("✓")} Removed ${result2.provider} sign-in.`);
+        await writeLine2(ctx, `${import_picocolors6.default.green("✓")} Removed ${result2.provider} sign-in.`);
       } else if (result2.action === "set") {
-        await writeLine(ctx, `${import_picocolors6.default.green("✓")} ${result2.provider} sign-in enabled.`);
-        await writeLine(ctx, "");
-        await writeLine(ctx, import_picocolors6.default.bold("One more step — add this redirect URI in the provider console:"));
-        await writeLine(ctx, `  ${result2.redirectUri}`);
+        await writeLine2(ctx, `${import_picocolors6.default.green("✓")} ${result2.provider} sign-in enabled.`);
+        await writeLine2(ctx, "");
+        await writeLine2(ctx, import_picocolors6.default.bold("One more step — add this redirect URI in the provider console:"));
+        await writeLine2(ctx, `  ${result2.redirectUri}`);
       } else {
         if (!result2.providers?.length) {
-          await writeLine(ctx, import_picocolors6.default.dim("No OAuth providers configured."));
+          await writeLine2(ctx, import_picocolors6.default.dim("No OAuth providers configured."));
         } else {
-          await writeLine(ctx, import_picocolors6.default.bold("Configured providers"));
+          await writeLine2(ctx, import_picocolors6.default.bold("Configured providers"));
           for (const p of result2.providers) {
-            await writeLine(ctx, `  ${p.provider.padEnd(12)} ${import_picocolors6.default.dim(p.clientId)}`);
+            await writeLine2(ctx, `  ${p.provider.padEnd(12)} ${import_picocolors6.default.dim(p.clientId)}`);
           }
         }
-        await writeLine(ctx, "");
-        await writeLine(ctx, `Redirect URI: ${result2.redirectUri}`);
+        await writeLine2(ctx, "");
+        await writeLine2(ctx, `Redirect URI: ${result2.redirectUri}`);
       }
       return;
     }
     const result = await data(ctx, { app, json: options.json });
     if (options.json) {
-      await writeLine(ctx, JSON.stringify(result, null, 2));
+      await writeLine2(ctx, JSON.stringify(result, null, 2));
     } else {
       const version2 = result.version ? `  Version: ${result.version}` : "";
-      await writeLine(ctx, `${import_picocolors6.default.bold("Data")}  Mode: ${result.mode}  Status: ${result.status}${version2}`);
-      await writeLine(ctx, "");
+      await writeLine2(ctx, `${import_picocolors6.default.bold("Data")}  Mode: ${result.mode}  Status: ${result.status}${version2}`);
+      await writeLine2(ctx, "");
       if (result.collections.length > 0) {
-        await writeLine(ctx, import_picocolors6.default.bold("Collections"));
+        await writeLine2(ctx, import_picocolors6.default.bold("Collections"));
         for (const col of result.collections) {
-          await writeLine(ctx, `  ${col.name.padEnd(20)} ${import_picocolors6.default.dim(col.type)}`);
+          await writeLine2(ctx, `  ${col.name.padEnd(20)} ${import_picocolors6.default.dim(col.type)}`);
         }
-        await writeLine(ctx, "");
+        await writeLine2(ctx, "");
       }
-      await writeLine(ctx, `Collections: ${result.stats.collections}  Records: ${result.stats.totalRecords}`);
+      await writeLine2(ctx, `Collections: ${result.stats.collections}  Records: ${result.stats.totalRecords}`);
       if (result.adminUrl) {
-        await writeLine(ctx, "");
-        await writeLine(ctx, `Admin: ${result.adminUrl}`);
+        await writeLine2(ctx, "");
+        await writeLine2(ctx, `Admin: ${result.adminUrl}`);
       }
       if (result.warning) {
-        await writeLine(ctx, "");
-        await writeLine(ctx, import_picocolors6.default.yellow(`⚠  ${result.warning}`));
+        await writeLine2(ctx, "");
+        await writeLine2(ctx, import_picocolors6.default.yellow(`⚠  ${result.warning}`));
       }
     }
   });
@@ -119367,19 +119712,19 @@ function registerDataCommands(cli, ctx, argv) {
   cli.command("backups [app]", "List available backups for an app").action(async (app) => {
     const { backups, skipped } = await listBackups(ctx, { app });
     if (backups.length === 0) {
-      await writeLine(ctx, `${import_picocolors6.default.dim("No backups found.")}`);
+      await writeLine2(ctx, `${import_picocolors6.default.dim("No backups found.")}`);
       if (skipped.length > 0) {
-        await writeLine(ctx, import_picocolors6.default.yellow(`(${skipped.length} sidecar(s) skipped — see ops logs)`));
+        await writeLine2(ctx, import_picocolors6.default.yellow(`(${skipped.length} sidecar(s) skipped — see ops logs)`));
       }
       return;
     }
     for (const b of backups) {
       const components = b.apps[0]?.components.join(", ") ?? "—";
       const size = b.tarball_size_bytes < 1024 * 1024 ? `${Math.round(b.tarball_size_bytes / 1024)} KB` : `${(b.tarball_size_bytes / (1024 * 1024)).toFixed(1)} MB`;
-      await writeLine(ctx, `${import_picocolors6.default.green("●")} ${import_picocolors6.default.bold(b.backup_id)}  ${import_picocolors6.default.dim(size.padStart(10))}  ${import_picocolors6.default.dim(`[${components}]`)}`);
+      await writeLine2(ctx, `${import_picocolors6.default.green("●")} ${import_picocolors6.default.bold(b.backup_id)}  ${import_picocolors6.default.dim(size.padStart(10))}  ${import_picocolors6.default.dim(`[${components}]`)}`);
     }
     if (skipped.length > 0) {
-      await writeLine(ctx, import_picocolors6.default.yellow(`
+      await writeLine2(ctx, import_picocolors6.default.yellow(`
 ${skipped.length} sidecar(s) skipped — older backups predating the manifest schema.`));
     }
   });
@@ -119392,14 +119737,14 @@ ${skipped.length} sidecar(s) skipped — older backups predating the manifest sc
       dryRun: options.dryRun ?? false
     });
     if ("kind" in result) {
-      await writeLine(ctx, `${import_picocolors6.default.cyan("dry-run")} would restore ${import_picocolors6.default.bold(result.app)} from ${import_picocolors6.default.bold(result.resolvedBackup.backup_id)}`);
-      await writeLine(ctx, `        components: ${import_picocolors6.default.dim(result.components.join(", "))}`);
-      await writeLine(ctx, `        sha: ${import_picocolors6.default.dim(`${result.resolvedBackup.tarball_sha256.slice(0, 16)}…`)}`);
-      await writeLine(ctx, import_picocolors6.default.dim(`
+      await writeLine2(ctx, `${import_picocolors6.default.cyan("dry-run")} would restore ${import_picocolors6.default.bold(result.app)} from ${import_picocolors6.default.bold(result.resolvedBackup.backup_id)}`);
+      await writeLine2(ctx, `        components: ${import_picocolors6.default.dim(result.components.join(", "))}`);
+      await writeLine2(ctx, `        sha: ${import_picocolors6.default.dim(`${result.resolvedBackup.tarball_sha256.slice(0, 16)}…`)}`);
+      await writeLine2(ctx, import_picocolors6.default.dim(`
 Run without --dry-run to actually restore. Expect 30–120s of downtime.`));
       return;
     }
-    await writeLine(ctx, `${import_picocolors6.default.green("✓")} restored from ${result.sourceBackupId} (job ${result.id.slice(0, 12)})`);
+    await writeLine2(ctx, `${import_picocolors6.default.green("✓")} restored from ${result.sourceBackupId} (job ${result.id.slice(0, 12)})`);
   });
 }
 
@@ -119420,10 +119765,10 @@ function registerDeploysCommands(cli, ctx, argv) {
     const limit = options.limit ? Number.parseInt(options.limit, 10) : undefined;
     const list = await deploysList(ctx, { app, limit });
     if (list.length === 0) {
-      await writeLine(ctx, import_picocolors7.default.dim("No deploys yet."));
+      await writeLine2(ctx, import_picocolors7.default.dim("No deploys yet."));
       return;
     }
-    await writeLine(ctx, `${import_picocolors7.default.bold("ID".padEnd(22))}  ${import_picocolors7.default.bold("STATUS".padEnd(10))}  ${import_picocolors7.default.bold("CREATED".padEnd(20))}  ${import_picocolors7.default.bold("ERROR")}`);
+    await writeLine2(ctx, `${import_picocolors7.default.bold("ID".padEnd(22))}  ${import_picocolors7.default.bold("STATUS".padEnd(10))}  ${import_picocolors7.default.bold("CREATED".padEnd(20))}  ${import_picocolors7.default.bold("ERROR")}`);
     for (const d of list) {
       const id = d.id.padEnd(22);
       const status2 = d.status.padEnd(10);
@@ -119431,15 +119776,19 @@ function registerDeploysCommands(cli, ctx, argv) {
       const err = d.errorMessage ? d.errorMessage.split(`
 `)[0]?.slice(0, 60) ?? "—" : import_picocolors7.default.dim("—");
       const colored = d.status === "live" ? import_picocolors7.default.green(status2) : d.status === "failed" ? import_picocolors7.default.red(status2) : import_picocolors7.default.yellow(status2);
-      await writeLine(ctx, `${import_picocolors7.default.dim(id)}  ${colored}  ${import_picocolors7.default.dim(created)}  ${err}`);
+      await writeLine2(ctx, `${import_picocolors7.default.dim(id)}  ${colored}  ${import_picocolors7.default.dim(created)}  ${err}`);
     }
   });
   cli.command("deploys inspect [id]", "Inspect a deploy: status, error, build log").option("--app <name>", "App name (defaults to percher.toml in cwd)").option("--latest-failed", "Resolve to the most recent failed deploy").action(async (id, options) => {
     await runDeploysInspect(ctx, { id, app: options.app, latestFailed: options.latestFailed });
   });
-  cli.command("rollback <sha> [app]", "Roll back to a previous version").action(async (sha, app) => {
-    const result = await rollback(ctx, { app, commitSha: sha });
-    await writeLine(ctx, `${import_picocolors7.default.green("✓")} rolled back to ${sha.slice(0, 10)} (status: ${result.status})`);
+  cli.command("rollback [sha] [app]", "Roll back to a previous version (bare: pick from the 5 most recent)").option("--last-good", "Roll back to the most recent version that went live without crash-looping").option("--app <name>", "App name (defaults to percher.toml in cwd)").action(async (sha, app, options) => {
+    const result = await rollback(ctx, {
+      app: options.app ?? app,
+      commitSha: sha,
+      toLastGood: Boolean(options.lastGood)
+    });
+    await writeLine2(ctx, `${import_picocolors7.default.green("✓")} rolled back to ${result.rolledBackTo.slice(0, 10)} (status: ${result.status})`);
   });
   cli.command("reproduce <deployId>", "Download a deploy's source and reproduce the build locally").option("--app <name>", "App name (defaults to percher.toml app.name)").action(async (deployId, options) => {
     const result = await reproduce(ctx, {
@@ -119447,27 +119796,27 @@ function registerDeploysCommands(cli, ctx, argv) {
       deployId
     });
     if (result.status === "needs_login") {
-      await writeLine(ctx, `${import_picocolors7.default.red("✗")} Not logged in. Run: percher login`);
+      await writeLine2(ctx, `${import_picocolors7.default.red("✗")} Not logged in. Run: percher login`);
       throw new SilentExitError;
     }
     if (result.status === "failed") {
-      await writeLine(ctx, `${import_picocolors7.default.red("✗")} ${result.error?.title ?? "Reproduce failed"}`);
+      await writeLine2(ctx, `${import_picocolors7.default.red("✗")} ${result.error?.title ?? "Reproduce failed"}`);
       if (result.error?.explanation) {
-        await writeLine(ctx, `  ${result.error.explanation}`);
+        await writeLine2(ctx, `  ${result.error.explanation}`);
       }
       if (result.error?.suggestion) {
-        await writeLine(ctx, `  ${import_picocolors7.default.dim(result.error.suggestion)}`);
+        await writeLine2(ctx, `  ${import_picocolors7.default.dim(result.error.suggestion)}`);
       }
       throw new SilentExitError;
     }
-    await writeLine(ctx, `${import_picocolors7.default.green("✓")} ${result.summary}`);
+    await writeLine2(ctx, `${import_picocolors7.default.green("✓")} ${result.summary}`);
     if (result.currentAppEnvKeys && result.currentAppEnvKeys.length > 0) {
-      await writeLine(ctx, "");
-      await writeLine(ctx, import_picocolors7.default.bold("Current app env keys:"));
+      await writeLine2(ctx, "");
+      await writeLine2(ctx, import_picocolors7.default.bold("Current app env keys:"));
       for (const k of result.currentAppEnvKeys) {
-        await writeLine(ctx, `  ${k}`);
+        await writeLine2(ctx, `  ${k}`);
       }
-      await writeLine(ctx, import_picocolors7.default.dim("  (values not exfiltrated — set them locally before building. Note: this is the CURRENT app env, not a deploy-time snapshot.)"));
+      await writeLine2(ctx, import_picocolors7.default.dim("  (values not exfiltrated — set them locally before building. Note: this is the CURRENT app env, not a deploy-time snapshot.)"));
     }
   });
   cli.command("logs [app]", "Stream application logs").option("--tail <n>", "Return the last N lines and exit", { type: [Number] }).option("--no-follow", "Don't stream new lines").option("--build [deployId]", "Show the BUILD log instead of runtime logs (defaults to latest failed deploy)").action(async (app, options) => {
@@ -119479,30 +119828,30 @@ function registerDeploysCommands(cli, ctx, argv) {
         latestFailed: deployId ? undefined : true
       });
       const { deploy, buildLog } = result;
-      await writeLine(ctx, `${import_picocolors7.default.bold("Deploy:")}    ${deploy.id}`);
-      await writeLine(ctx, `${import_picocolors7.default.bold("Status:")}    ${formatStatus(deploy.status)}`);
-      await writeLine(ctx, `${import_picocolors7.default.bold("Created:")}   ${formatDeployTimestamp(deploy.createdAt)}`);
+      await writeLine2(ctx, `${import_picocolors7.default.bold("Deploy:")}    ${deploy.id}`);
+      await writeLine2(ctx, `${import_picocolors7.default.bold("Status:")}    ${formatStatus(deploy.status)}`);
+      await writeLine2(ctx, `${import_picocolors7.default.bold("Created:")}   ${formatDeployTimestamp(deploy.createdAt)}`);
       if (deploy.errorMessage) {
-        await writeLine(ctx, "");
-        await writeLine(ctx, import_picocolors7.default.bold(import_picocolors7.default.red("Error:")));
+        await writeLine2(ctx, "");
+        await writeLine2(ctx, import_picocolors7.default.bold(import_picocolors7.default.red("Error:")));
         for (const line of deploy.errorMessage.split(`
 `)) {
-          await writeLine(ctx, `  ${line}`);
+          await writeLine2(ctx, `  ${line}`);
         }
       }
       if (buildLog) {
-        await writeLine(ctx, "");
+        await writeLine2(ctx, "");
         const lines = buildLog.split(`
 `);
         const tailN = options.tail ? Number(options.tail) : 200;
         const tail = lines.slice(-tailN);
         const header = lines.length > tail.length ? `${import_picocolors7.default.bold("Build log")} ${import_picocolors7.default.dim(`(last ${tail.length} of ${lines.length} lines)`)}` : import_picocolors7.default.bold("Build log");
-        await writeLine(ctx, header);
+        await writeLine2(ctx, header);
         for (const line of tail) {
-          await writeLine(ctx, `  ${line}`);
+          await writeLine2(ctx, `  ${line}`);
         }
       } else {
-        await writeLine(ctx, import_picocolors7.default.dim("(no build log available for this deploy)"));
+        await writeLine2(ctx, import_picocolors7.default.dim("(no build log available for this deploy)"));
       }
       return;
     }
@@ -119526,7 +119875,7 @@ function registerDeploysCommands(cli, ctx, argv) {
       };
       const label = v.channel ? channelLabels[v.channel] ?? v.channel : null;
       const suffix = label ? `  · via ${label}` : "";
-      await writeLine(ctx, `${v.sha}  ${v.timestamp}  ${message}${suffix}`);
+      await writeLine2(ctx, `${v.sha}  ${v.timestamp}  ${message}${suffix}`);
     }
   });
   cli.command("diff [base] [head]", "Show what changed between two deploy versions").option("--app <name>", "App name (overrides percher.toml)").option("--patch", "Include the unified diff per file (owner-only)").action(async (base, head, options) => {
@@ -119537,23 +119886,27 @@ function registerDeploysCommands(cli, ctx, argv) {
       patch: options.patch
     });
     const { summary, files } = result;
-    await writeLine(ctx, `${summary.filesChanged} file${summary.filesChanged === 1 ? "" : "s"} changed · ${import_picocolors7.default.green(`+${summary.additions}`)} ${import_picocolors7.default.red(`−${summary.deletions}`)}  (${result.base.slice(0, 10)} → ${result.head.slice(0, 10)})`);
+    await writeLine2(ctx, `${summary.filesChanged} file${summary.filesChanged === 1 ? "" : "s"} changed · ${import_picocolors7.default.green(`+${summary.additions}`)} ${import_picocolors7.default.red(`−${summary.deletions}`)}  (${result.base.slice(0, 10)} → ${result.head.slice(0, 10)})`);
     for (const f of files) {
       const stat2 = f.binary ? import_picocolors7.default.dim("binary") : `${import_picocolors7.default.green(`+${f.additions}`)} ${import_picocolors7.default.red(`−${f.deletions}`)}`;
-      await writeLine(ctx, `  ${f.status}  ${f.path}  ${stat2}${f.truncated ? import_picocolors7.default.dim(" (truncated)") : ""}`);
+      await writeLine2(ctx, `  ${f.status}  ${f.path}  ${stat2}${f.truncated ? import_picocolors7.default.dim(" (truncated)") : ""}`);
       if (options.patch && f.patch) {
-        await writeLine(ctx, f.patch.replace(/\n$/, ""));
+        await writeLine2(ctx, f.patch.replace(/\n$/, ""));
       }
     }
     if (result.truncated) {
-      await writeLine(ctx, import_picocolors7.default.dim("… some patches omitted (response size limit)"));
+      await writeLine2(ctx, import_picocolors7.default.dim("… some patches omitted (response size limit)"));
     }
   });
-  cli.command("preview <action> [arg] [arg2]", "Preview deploys: promote <id> | discard <id> | branch set <branch> | branch unset | branch show").option("--app <name>", "App name (overrides percher.toml)").action(async (action, arg, arg2, options) => {
+  cli.command("preview <action> [arg] [arg2]", "Preview deploys: list | promote <id> | discard <id> | branch set <branch> | branch unset | branch show").option("--app <name>", "App name (overrides percher.toml)").action(async (action, arg, arg2, options) => {
     if (action === "branch") {
       await runPreviewBranch(arg, arg2, options.app);
       return;
     }
+    if (action === "list") {
+      await runPreviewList(options.app);
+      return;
+    }
     const appRef = options.app ?? readPercherTomlAppName(ctx.cwd);
     if (!appRef) {
       throw new Error("App name required. Use --app or run from a project directory.");
@@ -119562,43 +119915,59 @@ function registerDeploysCommands(cli, ctx, argv) {
       if (!arg)
         throw new Error("Deploy ID required. Usage: percher preview promote <id>");
       const result = await ctx.client.apps.promotePreview(appRef, arg);
-      await writeLine(ctx, `${import_picocolors7.default.green("✓")} Preview promoted to live. Status: ${result.status}`);
+      await writeLine2(ctx, `${import_picocolors7.default.green("✓")} Preview promoted to live. Status: ${result.status}`);
     } else if (action === "discard") {
       if (!arg)
         throw new Error("Deploy ID required. Usage: percher preview discard <id>");
       await ctx.client.apps.discardPreview(appRef, arg);
-      await writeLine(ctx, `${import_picocolors7.default.green("✓")} Preview discarded.`);
+      await writeLine2(ctx, `${import_picocolors7.default.green("✓")} Preview discarded.`);
     } else {
-      throw new Error(`Unknown preview action "${action}". Use promote | discard | branch.`);
+      throw new Error(`Unknown preview action "${action}". Use list | promote | discard | branch.`);
     }
   });
+  async function runPreviewList(app) {
+    const { app: appName, previews } = await previewList(ctx, { app });
+    await writeLine2(ctx, `Preview surfaces for ${import_picocolors7.default.bold(appName)}:`);
+    if (previews.length === 0) {
+      await writeLine2(ctx, import_picocolors7.default.dim("  (no preview surfaces reported by the server)"));
+      return;
+    }
+    for (const p of previews) {
+      const label = p.kind.padEnd(14);
+      const statusColour = p.status === "ready" || p.status === "enabled" || p.status === "available" || p.status === "active" ? import_picocolors7.default.green(p.status) : p.status === "error" ? import_picocolors7.default.red(p.status) : import_picocolors7.default.dim(p.status);
+      await writeLine2(ctx, `  ${import_picocolors7.default.bold(label)} ${statusColour}`);
+      if (p.url)
+        await writeLine2(ctx, `    url: ${p.url}`);
+      await writeLine2(ctx, import_picocolors7.default.dim(`    how: ${p.howTriggered}`));
+    }
+  }
   async function runPreviewBranch(sub, branch, app) {
     if (sub === "set") {
       if (!branch)
         throw new Error("Branch required. Usage: percher preview branch set <branch>");
       const r = await previewBranchSet(ctx, { app, branch });
-      await writeLine(ctx, `${import_picocolors7.default.green("✓")} Preview branch set to "${branch}".`);
+      await writeLine2(ctx, `${import_picocolors7.default.green("✓")} Preview branch set to "${branch}".`);
       if (r.previewUrl)
-        await writeLine(ctx, `  Your preview address: ${import_picocolors7.default.bold(r.previewUrl)}`);
-      await writeLine(ctx, r.status === "error" ? import_picocolors7.default.yellow("  ⚠  The initial deploy failed — push to the branch to retry.") : import_picocolors7.default.dim("  Building now — live within ~90s."));
+        await writeLine2(ctx, `  Your preview address: ${import_picocolors7.default.bold(r.previewUrl)}`);
+      await writeLine2(ctx, r.status === "error" ? import_picocolors7.default.yellow("  ⚠  The initial deploy failed — push to the branch to retry.") : import_picocolors7.default.dim("  Building now — live within ~90s."));
       return;
     }
     if (sub === "unset") {
       await previewBranchUnset(ctx, { app });
-      await writeLine(ctx, `${import_picocolors7.default.green("✓")} Preview branch cleared.`);
+      await writeLine2(ctx, `${import_picocolors7.default.green("✓")} Preview branch cleared.`);
       return;
     }
     if (sub === "show" || sub === undefined) {
       const s = await previewBranchShow(ctx, { app });
       if (!s.previewBranch) {
-        await writeLine(ctx, "No preview branch set.");
-        await writeLine(ctx, import_picocolors7.default.dim("  Set one: percher preview branch set <branch>"));
+        await writeLine2(ctx, "No preview branch set.");
+        await writeLine2(ctx, import_picocolors7.default.dim("  Set one: percher preview branch set <branch>"));
         return;
       }
-      await writeLine(ctx, `Preview branch: ${import_picocolors7.default.bold(s.previewBranch)}`);
+      await writeLine2(ctx, `Preview branch: ${import_picocolors7.default.bold(s.previewBranch)}`);
       if (s.previewUrl)
-        await writeLine(ctx, `  Address: ${s.previewUrl}`);
-      await writeLine(ctx, `  Status:  ${s.status}`);
+        await writeLine2(ctx, `  Address: ${s.previewUrl}`);
+      await writeLine2(ctx, `  Status:  ${s.status}`);
       return;
     }
     throw new Error(`Unknown preview branch action "${sub}". Use set <branch> | unset | show.`);
@@ -119607,8 +119976,25 @@ function registerDeploysCommands(cli, ctx, argv) {
 
 // src/commands/env.ts
 var import_picocolors8 = __toESM(require_picocolors(), 1);
+var ENV_SCOPES = ["all", "live", "preview"];
+function isEnvScope(value) {
+  return ENV_SCOPES.includes(value);
+}
 function registerEnvCommands(cli, ctx) {
-  cli.command("env <action> [...args]", "Manage env vars (set KEY=VALUE | set KEY --from-stdin | set KEY --from-file <path> | set --from-env-file <path> | set KEY (prompts) | unset KEY | list)").option("--app <name>", "App name (overrides percher.toml)").option("--from-stdin", "(set) Read value for the single KEY from stdin").option("--from-file <path>", "(set) Read value for the single KEY from file").option("--from-env-file <path>", "(set) Set every KEY=VALUE line from a .env-format file").action(async (action, args, options) => {
+  cli.command("env <action> [...args]", "Manage env vars (set KEY=VALUE | set KEY --from-stdin | set KEY --from-file <path> | set --from-env-file <path> | set KEY (prompts) | unset KEY | list). set/unset take --scope all|live|preview").option("--app <name>", "App name (overrides percher.toml)").option("--from-stdin", "(set) Read value for the single KEY from stdin").option("--from-file <path>", "(set) Read value for the single KEY from file").option("--from-env-file <path>", "(set) Set every KEY=VALUE line from a .env-format file").option("--scope <scope>", "(set/unset) all (default) applies everywhere; live/preview apply only to that deploy type and override all").action(async (action, args, options) => {
+    let scope;
+    if (options.scope !== undefined) {
+      const raw = String(options.scope);
+      if (!isEnvScope(raw)) {
+        await writeLine2(ctx, `${import_picocolors8.default.red("✗")} Invalid --scope "${raw}". Use all, live, or preview.`);
+        throw new SilentExitError;
+      }
+      if (action === "list") {
+        await writeLine2(ctx, `${import_picocolors8.default.red("✗")} --scope is not supported with "list" — env list already shows every scope ([live]/[preview] annotations).`);
+        throw new SilentExitError;
+      }
+      scope = raw;
+    }
     if (action === "set") {
       const { resolveEnvSetInputs: resolveEnvSetInputs2, EnvSetInputError: EnvSetInputError2 } = await Promise.resolve().then(() => (init_env_set_input(), exports_env_set_input));
       const { promptHidden: promptHidden2 } = await Promise.resolve().then(() => (init_prompt_hidden(), exports_prompt_hidden));
@@ -119628,11 +120014,12 @@ function registerEnvCommands(cli, ctx) {
           readFile: async (p) => readFile5(p, "utf8"),
           promptHidden: promptHidden2
         });
-        await envSet(ctx, { app: options.app, values });
-        await writeLine(ctx, `${import_picocolors8.default.green("✓")} env vars updated (${Object.keys(values).length})`);
+        await envSet(ctx, { app: options.app, values, scope });
+        const scopeNote = scope && scope !== "all" ? ` [${scope}]` : "";
+        await writeLine2(ctx, `${import_picocolors8.default.green("✓")} env vars updated (${Object.keys(values).length})${scopeNote}`);
       } catch (err) {
         if (err instanceof EnvSetInputError2) {
-          await writeLine(ctx, `${import_picocolors8.default.red("✗")} ${err.message}`);
+          await writeLine2(ctx, `${import_picocolors8.default.red("✗")} ${err.message}`);
           throw new SilentExitError;
         }
         throw err;
@@ -119641,12 +120028,14 @@ function registerEnvCommands(cli, ctx) {
       const key = args[0];
       if (!key)
         throw new Error("Expected key to unset");
-      await envUnset(ctx, { app: options.app, key });
-      await writeLine(ctx, `${import_picocolors8.default.green("✓")} unset ${key}`);
+      await envUnset(ctx, { app: options.app, key, scope });
+      const scopeNote = scope && scope !== "all" ? ` [${scope}]` : "";
+      await writeLine2(ctx, `${import_picocolors8.default.green("✓")} unset ${key}${scopeNote}`);
     } else if (action === "list") {
       const env = await envList(ctx, { app: options.app });
-      for (const [k, v] of Object.entries(env)) {
-        await writeLine(ctx, `${k}=${v}`);
+      for (const row of env.detailed) {
+        const suffix = row.scope === "all" ? "" : ` [${row.scope}]`;
+        await writeLine2(ctx, `${row.key}=${row.maskedValue}${suffix}`);
       }
     } else {
       throw new Error(`Unknown env action "${action}". Use set | unset | list.`);
@@ -119655,7 +120044,7 @@ function registerEnvCommands(cli, ctx) {
   cli.command("generate", "Generate .env.example and TypeScript types from percher.toml").action(async () => {
     const result = await generate(ctx);
     for (const f of result.files) {
-      await writeLine(ctx, `${import_picocolors8.default.green("✓")} ${f}`);
+      await writeLine2(ctx, `${import_picocolors8.default.green("✓")} ${f}`);
     }
   });
 }
@@ -119666,8 +120055,8 @@ function registerExportCommands(cli, ctx) {
   cli.command("export [app]", "Download an export bundle for an app (no secrets)").option("--out <path>", "Where to write the file (defaults to ./{name}-{date}.tar.gz)").option("--git", "Export the whole deploy history as a git bundle (.bundle) — re-clone with `git clone`").action(async (app, options) => {
     if (options.git) {
       const result2 = await exportGitBundle(ctx, { app, out: options.out });
-      await writeLine(ctx, `${import_picocolors9.default.green("✓")} exported ${result2.appName} deploy history → ${result2.outPath} (${(result2.bytes / 1024).toFixed(1)} KB)`);
-      await writeLine(ctx, import_picocolors9.default.dim(`Re-clone it anywhere with: git clone ${result2.outPath}`));
+      await writeLine2(ctx, `${import_picocolors9.default.green("✓")} exported ${result2.appName} deploy history → ${result2.outPath} (${(result2.bytes / 1024).toFixed(1)} KB)`);
+      await writeLine2(ctx, import_picocolors9.default.dim(`Re-clone it anywhere with: git clone ${result2.outPath}`));
       return;
     }
     const result = await exportApp(ctx, {
@@ -119675,27 +120064,27 @@ function registerExportCommands(cli, ctx) {
       out: options.out,
       deliveryKind: "cli"
     });
-    await writeLine(ctx, `${import_picocolors9.default.green("✓")} exported ${result.appName} → ${result.outPath} (${(result.bytes / 1024).toFixed(1)} KB)`);
-    await writeLine(ctx, import_picocolors9.default.dim("Env values are not included. To export encrypted env values, use the dashboard's Settings → Export and confirm your password."));
+    await writeLine2(ctx, `${import_picocolors9.default.green("✓")} exported ${result.appName} → ${result.outPath} (${(result.bytes / 1024).toFixed(1)} KB)`);
+    await writeLine2(ctx, import_picocolors9.default.dim("Env values are not included. To export encrypted env values, use the dashboard's Settings → Export and confirm your password."));
   });
 }
 
 // src/commands/github.ts
 var import_picocolors10 = __toESM(require_picocolors(), 1);
 async function printWebhookInstructions(ctx, instructions, branch) {
-  await writeLine(ctx, import_picocolors10.default.bold("Add this webhook in GitHub to enable auto-deploy on push:"));
-  await writeLine(ctx, `  URL:   ${instructions.settingsUrl}`);
-  await writeLine(ctx, "");
-  await writeLine(ctx, "  Field            Value");
-  await writeLine(ctx, "  ─────────────────────────────────────────────────");
-  await writeLine(ctx, `  Payload URL      ${instructions.payloadUrl}`);
-  await writeLine(ctx, "  Content type     application/json");
-  await writeLine(ctx, `  Secret           ${instructions.secret}`);
-  await writeLine(ctx, "  Which events?    Just the push event");
-  await writeLine(ctx, "");
-  await writeLine(ctx, import_picocolors10.default.yellow("  ⚠  Treat this secret like a password — save it now, it won't be shown again."));
-  await writeLine(ctx, "");
-  await writeLine(ctx, import_picocolors10.default.dim(`After adding the webhook, every push to ${branch} will auto-deploy.`));
+  await writeLine2(ctx, import_picocolors10.default.bold("Add this webhook in GitHub to enable auto-deploy on push:"));
+  await writeLine2(ctx, `  URL:   ${instructions.settingsUrl}`);
+  await writeLine2(ctx, "");
+  await writeLine2(ctx, "  Field            Value");
+  await writeLine2(ctx, "  ─────────────────────────────────────────────────");
+  await writeLine2(ctx, `  Payload URL      ${instructions.payloadUrl}`);
+  await writeLine2(ctx, "  Content type     application/json");
+  await writeLine2(ctx, `  Secret           ${instructions.secret}`);
+  await writeLine2(ctx, "  Which events?    Just the push event");
+  await writeLine2(ctx, "");
+  await writeLine2(ctx, import_picocolors10.default.yellow("  ⚠  Treat this secret like a password — save it now, it won't be shown again."));
+  await writeLine2(ctx, "");
+  await writeLine2(ctx, import_picocolors10.default.dim(`After adding the webhook, every push to ${branch} will auto-deploy.`));
 }
 function registerGithubCommands(cli, ctx) {
   cli.command("github [action] [repoUrl] [...rest]", "GitHub integration: connect | setup-webhook").option("--app <name>", "App name (overrides percher.toml)").option("--branch <branch>", "(connect only) Branch to track (default: main)").action(async (action, repoUrl, _rest, options) => {
@@ -119708,25 +120097,25 @@ function registerGithubCommands(cli, ctx) {
         repoUrl,
         branch: options.branch
       });
-      await writeLine(ctx, `${import_picocolors10.default.green("✓")} Connected to ${result.repoUrl} (branch: ${result.branch})`);
-      await writeLine(ctx, `${import_picocolors10.default.green("✓")} Deploy started: ${result.deployId}`);
-      await writeLine(ctx, "");
+      await writeLine2(ctx, `${import_picocolors10.default.green("✓")} Connected to ${result.repoUrl} (branch: ${result.branch})`);
+      await writeLine2(ctx, `${import_picocolors10.default.green("✓")} Deploy started: ${result.deployId}`);
+      await writeLine2(ctx, "");
       if (result.webhookSetupFailed) {
-        await writeLine(ctx, import_picocolors10.default.yellow(`⚠  Webhook setup failed: ${result.webhookSetupError ?? "unknown error"}`));
-        await writeLine(ctx, import_picocolors10.default.yellow("   Auto-deploy will NOT work until you re-run webhook setup:"));
-        await writeLine(ctx, `   ${import_picocolors10.default.bold(`percher github setup-webhook${options.app ? ` --app ${options.app}` : ""}`)}`);
+        await writeLine2(ctx, import_picocolors10.default.yellow(`⚠  Webhook setup failed: ${result.webhookSetupError ?? "unknown error"}`));
+        await writeLine2(ctx, import_picocolors10.default.yellow("   Auto-deploy will NOT work until you re-run webhook setup:"));
+        await writeLine2(ctx, `   ${import_picocolors10.default.bold(`percher github setup-webhook${options.app ? ` --app ${options.app}` : ""}`)}`);
         return;
       }
       if (result.webhookInstructions) {
         await printWebhookInstructions(ctx, result.webhookInstructions, result.branch);
       }
-      await writeLine(ctx, import_picocolors10.default.dim(`Track the initial deploy: percher deploys inspect ${result.deployId}`));
+      await writeLine2(ctx, import_picocolors10.default.dim(`Track the initial deploy: percher deploys inspect ${result.deployId}`));
       return;
     }
     if (action === "setup-webhook") {
       const result = await githubSetupWebhook(ctx, { app: options.app });
-      await writeLine(ctx, `${import_picocolors10.default.green("✓")} Webhook regenerated for ${result.app}`);
-      await writeLine(ctx, "");
+      await writeLine2(ctx, `${import_picocolors10.default.green("✓")} Webhook regenerated for ${result.app}`);
+      await writeLine2(ctx, "");
       await printWebhookInstructions(ctx, result.webhookInstructions, result.branch);
       return;
     }
@@ -119736,8 +120125,64 @@ function registerGithubCommands(cli, ctx) {
   cli.command("github setup-webhook", "Regenerate the GitHub webhook secret for an app (use after a failed `github connect`)").option("--app <name>", "App name (overrides percher.toml)").action(async () => {});
 }
 
-// src/commands/migrate.ts
+// src/commands/hooks.ts
 var import_picocolors11 = __toESM(require_picocolors(), 1);
+function whenLabel(iso) {
+  return iso ? new Date(iso).toISOString().slice(0, 10) : "never";
+}
+function registerHooksCommands(cli, ctx) {
+  cli.command("hook [action] [arg]", "Manage deploy hooks: create | list | revoke").option("--app <name>", "App name (default: read from percher.toml)").action(async (action, arg, options) => {
+    if (!ctx.client.token) {
+      await writeLine2(ctx, `${import_picocolors11.default.red("✗")} Not logged in. Run: percher login`);
+      throw new SilentExitError;
+    }
+    if (action === "create") {
+      if (!arg) {
+        await writeLine2(ctx, `${import_picocolors11.default.red("✗")} A name is required. Usage: percher hook create <name> [--app <name>]`);
+        throw new SilentExitError;
+      }
+      const created = await hookCreate(ctx, { name: arg, app: options.app });
+      await writeLine2(ctx, `${import_picocolors11.default.green("✓")} Deploy hook created: ${import_picocolors11.default.bold(created.name)}`);
+      await writeLine2(ctx, "");
+      await writeLine2(ctx, `  ${import_picocolors11.default.bold(created.hookUrl)}`);
+      await writeLine2(ctx, import_picocolors11.default.yellow("  ↑ Shown once — store it in your CMS/CI secret store now. It can't be retrieved again."));
+      await writeLine2(ctx, import_picocolors11.default.yellow("  The URL is a secret: anyone holding it can trigger builds (6/min)."));
+      await writeLine2(ctx, "");
+      await writeLine2(ctx, import_picocolors11.default.dim("  Trigger a rebuild with:"));
+      await writeLine2(ctx, import_picocolors11.default.dim(`    curl -X POST ${created.hookUrl}`));
+      return;
+    }
+    if (action === "list") {
+      const hooks = await hookList(ctx, { app: options.app });
+      if (hooks.length === 0) {
+        await writeLine2(ctx, import_picocolors11.default.dim("No deploy hooks. Create one with: percher hook create <name>"));
+        return;
+      }
+      for (const h of hooks) {
+        await writeLine2(ctx, `${import_picocolors11.default.bold(h.id)}  ${h.name.padEnd(20)} ${import_picocolors11.default.dim(`created ${whenLabel(h.createdAt)}`)}  ${import_picocolors11.default.dim(`last used ${whenLabel(h.lastUsedAt)}`)}`);
+      }
+      await writeLine2(ctx, "");
+      await writeLine2(ctx, import_picocolors11.default.dim("Revoke one with: percher hook revoke <id>"));
+      return;
+    }
+    if (action === "revoke") {
+      if (!arg) {
+        await writeLine2(ctx, `${import_picocolors11.default.red("✗")} A hook id is required. Usage: percher hook revoke <id> (list ids with \`percher hook list\`).`);
+        throw new SilentExitError;
+      }
+      await hookRevoke(ctx, { id: arg, app: options.app });
+      await writeLine2(ctx, `${import_picocolors11.default.green("✓")} Deploy hook revoked.`);
+      return;
+    }
+    throw new Error(`Unknown hook action "${action ?? ""}". Use: create | list | revoke.`);
+  });
+  cli.command("hook create <name>", "Create a deploy hook (the URL is shown once)").option("--app <name>", "App name (default: read from percher.toml)").action(async () => {});
+  cli.command("hook list", "List deploy hooks with created + last-used dates").option("--app <name>", "App name (default: read from percher.toml)").action(async () => {});
+  cli.command("hook revoke <id>", "Revoke a deploy hook by id").option("--app <name>", "App name (default: read from percher.toml)").action(async () => {});
+}
+
+// src/commands/migrate.ts
+var import_picocolors12 = __toESM(require_picocolors(), 1);
 function registerMigrateCommands(cli, ctx) {
   cli.command("migrate-from-supabase", "Migrate a Supabase project to PocketBase: schema + data-import script, optionally rewrite SDK calls").option("--project <ref>", "Supabase project reference (the 20-char id from the project URL)").option("--token <token>", "Supabase personal access token (sbp_...). Read from SUPABASE_ACCESS_TOKEN if omitted.").option("--inspect-only", "Only print the schema that would migrate — read-only, no file writes").option("--output-dir <dir>", "Where to write the preview files (default: ./migration-preview/)").option("--rewrite-client", "Also convert your Supabase SDK calls to PocketBase across the project").option("--apply", "With --rewrite-client: overwrite files in place (originals backed up first). Default: preview only.").option("--root <dir>", "Project root to rewrite with --rewrite-client (default: current directory)").option("--no-scaffold-client", "With --rewrite-client: don't generate a PocketBase client module / insert pb imports (default: scaffold one)").option("--status", "Show a migration scoreboard for the local project — what's still on Supabase vs PocketBase. Local scan, no Supabase token needed.").option("--build", "With --status: also run the project build as a final gate").option("--pb-identifier <name>", "With --status: the PocketBase client identifier to check for (default: pb). Match what the rewrite used.").option("--json", "Output the structured result as JSON").action(async (options) => {
     if (options.status) {
@@ -119747,7 +120192,7 @@ function registerMigrateCommands(cli, ctx) {
         pbIdentifier: options.pbIdentifier
       });
       if (options.json) {
-        await writeLine(ctx, JSON.stringify(result2, null, 2));
+        await writeLine2(ctx, JSON.stringify(result2, null, 2));
         if (result2.status === "failed")
           throw new SilentExitError(1);
         return;
@@ -119760,21 +120205,21 @@ function registerMigrateCommands(cli, ctx) {
     const projectRef = options.project;
     const token = options.token ?? ctx.env.SUPABASE_ACCESS_TOKEN;
     if (options.apply && !options.rewriteClient) {
-      await writeLine(ctx, `${import_picocolors11.default.red("✗")} --apply only applies to the client rewrite. Pass --rewrite-client --apply together.`);
+      await writeLine2(ctx, `${import_picocolors12.default.red("✗")} --apply only applies to the client rewrite. Pass --rewrite-client --apply together.`);
       throw new SilentExitError(1);
     }
     if (!projectRef) {
-      await writeLine(ctx, `${import_picocolors11.default.red("✗")} Missing --project. Pass your Supabase project ref (e.g. --project abcdefghijklmnopqrst).`);
+      await writeLine2(ctx, `${import_picocolors12.default.red("✗")} Missing --project. Pass your Supabase project ref (e.g. --project abcdefghijklmnopqrst).`);
       throw new SilentExitError(1);
     }
     if (!token) {
-      await writeLine(ctx, `${import_picocolors11.default.red("✗")} Missing --token. Pass --token sbp_... or set SUPABASE_ACCESS_TOKEN. Generate one at https://supabase.com/dashboard/account/tokens`);
+      await writeLine2(ctx, `${import_picocolors12.default.red("✗")} Missing --token. Pass --token sbp_... or set SUPABASE_ACCESS_TOKEN. Generate one at https://supabase.com/dashboard/account/tokens`);
       throw new SilentExitError(1);
     }
     if (options.inspectOnly) {
       const result2 = await inspectSupabase(ctx, { projectRef, token });
       if (options.json) {
-        await writeLine(ctx, JSON.stringify(result2, null, 2));
+        await writeLine2(ctx, JSON.stringify(result2, null, 2));
         if (result2.status === "failed")
           throw new SilentExitError(1);
         return;
@@ -119798,7 +120243,7 @@ function registerMigrateCommands(cli, ctx) {
       });
     }
     if (options.json) {
-      await writeLine(ctx, JSON.stringify(rewrite ? { schema: result, rewrite } : result, null, 2));
+      await writeLine2(ctx, JSON.stringify(rewrite ? { schema: result, rewrite } : result, null, 2));
       if (result.status === "failed" || rewrite?.status === "failed") {
         throw new SilentExitError(1);
       }
@@ -119817,183 +120262,183 @@ function registerMigrateCommands(cli, ctx) {
 async function renderInspectHuman(ctx, result) {
   if (result.status === "failed") {
     const err = result.error;
-    await writeLine(ctx, `${import_picocolors11.default.red("✗")} ${err?.title ?? "Inspection failed"}`);
+    await writeLine2(ctx, `${import_picocolors12.default.red("✗")} ${err?.title ?? "Inspection failed"}`);
     if (err?.explanation)
-      await writeLine(ctx, `  ${err.explanation}`);
+      await writeLine2(ctx, `  ${err.explanation}`);
     if (err?.suggestion)
-      await writeLine(ctx, import_picocolors11.default.dim(`  ${err.suggestion}`));
+      await writeLine2(ctx, import_picocolors12.default.dim(`  ${err.suggestion}`));
     return;
   }
-  await writeLine(ctx, `${import_picocolors11.default.green("✓")} ${result.summary}`);
-  await writeLine(ctx, "");
-  await writeLine(ctx, import_picocolors11.default.bold("Tables"));
+  await writeLine2(ctx, `${import_picocolors12.default.green("✓")} ${result.summary}`);
+  await writeLine2(ctx, "");
+  await writeLine2(ctx, import_picocolors12.default.bold("Tables"));
   if (result.tables.length === 0) {
-    await writeLine(ctx, import_picocolors11.default.dim("  (none in user schemas)"));
+    await writeLine2(ctx, import_picocolors12.default.dim("  (none in user schemas)"));
   }
   for (const table of result.tables) {
     const pkCount = table.columns.filter((c) => c.isPrimaryKey).length;
     const fkCount = table.columns.filter((c) => c.foreignKey !== null).length;
     const policyCount = table.rlsPolicies.length;
     const rowEstimate = table.estimatedRowCount.toLocaleString();
-    await writeLine(ctx, `  ${import_picocolors11.default.cyan(`${table.schema}.${table.name}`)}  ${import_picocolors11.default.dim(`cols=${table.columns.length} pk=${pkCount} fk=${fkCount} rls=${policyCount} rows≈${rowEstimate}`)}`);
+    await writeLine2(ctx, `  ${import_picocolors12.default.cyan(`${table.schema}.${table.name}`)}  ${import_picocolors12.default.dim(`cols=${table.columns.length} pk=${pkCount} fk=${fkCount} rls=${policyCount} rows≈${rowEstimate}`)}`);
   }
   if (result.storageBuckets.length > 0) {
-    await writeLine(ctx, "");
-    await writeLine(ctx, import_picocolors11.default.bold("Storage buckets"));
+    await writeLine2(ctx, "");
+    await writeLine2(ctx, import_picocolors12.default.bold("Storage buckets"));
     for (const bucket of result.storageBuckets) {
       const visibility = bucket.public ? "public" : "private";
-      await writeLine(ctx, `  ${import_picocolors11.default.cyan(bucket.name)} ${import_picocolors11.default.dim(`(${visibility})`)}`);
+      await writeLine2(ctx, `  ${import_picocolors12.default.cyan(bucket.name)} ${import_picocolors12.default.dim(`(${visibility})`)}`);
     }
   }
   if (result.authUsersCount !== null) {
-    await writeLine(ctx, "");
-    await writeLine(ctx, `${import_picocolors11.default.bold("Auth users")}: ${result.authUsersCount}`);
+    await writeLine2(ctx, "");
+    await writeLine2(ctx, `${import_picocolors12.default.bold("Auth users")}: ${result.authUsersCount}`);
   }
   if (result.warnings.length > 0) {
-    await writeLine(ctx, "");
-    await writeLine(ctx, import_picocolors11.default.bold(`Warnings (${result.warnings.length})`));
+    await writeLine2(ctx, "");
+    await writeLine2(ctx, import_picocolors12.default.bold(`Warnings (${result.warnings.length})`));
     for (const warning of result.warnings) {
-      await writeLine(ctx, `  ${import_picocolors11.default.yellow("⚠")} ${warning}`);
+      await writeLine2(ctx, `  ${import_picocolors12.default.yellow("⚠")} ${warning}`);
     }
   }
-  await writeLine(ctx, "");
-  await writeLine(ctx, import_picocolors11.default.dim("--inspect-only is read-only. Drop the flag to also write the PocketBase schema preview + pb_migrate.js data-import script to ./migration-preview/."));
+  await writeLine2(ctx, "");
+  await writeLine2(ctx, import_picocolors12.default.dim("--inspect-only is read-only. Drop the flag to also write the PocketBase schema preview + pb_migrate.js data-import script to ./migration-preview/."));
 }
 async function renderSchemaHuman(ctx, result, opts) {
   if (result.status === "failed") {
     const err = result.error;
-    await writeLine(ctx, `${import_picocolors11.default.red("✗")} ${err?.title ?? "Migration preview failed"}`);
+    await writeLine2(ctx, `${import_picocolors12.default.red("✗")} ${err?.title ?? "Migration preview failed"}`);
     if (err?.explanation)
-      await writeLine(ctx, `  ${err.explanation}`);
+      await writeLine2(ctx, `  ${err.explanation}`);
     if (err?.suggestion)
-      await writeLine(ctx, import_picocolors11.default.dim(`  ${err.suggestion}`));
+      await writeLine2(ctx, import_picocolors12.default.dim(`  ${err.suggestion}`));
     return;
   }
-  await writeLine(ctx, `${import_picocolors11.default.green("✓")} ${result.summary}`);
-  await writeLine(ctx, "");
-  await writeLine(ctx, import_picocolors11.default.bold("Files written"));
+  await writeLine2(ctx, `${import_picocolors12.default.green("✓")} ${result.summary}`);
+  await writeLine2(ctx, "");
+  await writeLine2(ctx, import_picocolors12.default.bold("Files written"));
   for (const path of result.filesWritten) {
-    await writeLine(ctx, `  ${import_picocolors11.default.cyan(path)}`);
+    await writeLine2(ctx, `  ${import_picocolors12.default.cyan(path)}`);
   }
   const preview = result.preview;
   if (!preview)
     return;
   if (preview.collections.length > 0) {
-    await writeLine(ctx, "");
-    await writeLine(ctx, import_picocolors11.default.bold("Collections"));
+    await writeLine2(ctx, "");
+    await writeLine2(ctx, import_picocolors12.default.bold("Collections"));
     for (const collection of preview.collections) {
       const fields = collection.schema.length;
       const relations = collection.schema.filter((f) => f.type === "relation").length;
-      await writeLine(ctx, `  ${import_picocolors11.default.cyan(collection.name)} ${import_picocolors11.default.dim(`← ${collection.sourceTable}  fields=${fields} relations=${relations}`)}`);
+      await writeLine2(ctx, `  ${import_picocolors12.default.cyan(collection.name)} ${import_picocolors12.default.dim(`← ${collection.sourceTable}  fields=${fields} relations=${relations}`)}`);
     }
   }
   if (preview.warnings.length > 0) {
-    await writeLine(ctx, "");
-    await writeLine(ctx, import_picocolors11.default.bold(`Warnings (${preview.warnings.length})`));
+    await writeLine2(ctx, "");
+    await writeLine2(ctx, import_picocolors12.default.bold(`Warnings (${preview.warnings.length})`));
     for (const warning of preview.warnings.slice(0, 10)) {
-      await writeLine(ctx, `  ${import_picocolors11.default.yellow("⚠")} ${warning}`);
+      await writeLine2(ctx, `  ${import_picocolors12.default.yellow("⚠")} ${warning}`);
     }
     if (preview.warnings.length > 10) {
-      await writeLine(ctx, import_picocolors11.default.dim(`  …and ${preview.warnings.length - 10} more — see MIGRATION_NOTES.md`));
+      await writeLine2(ctx, import_picocolors12.default.dim(`  …and ${preview.warnings.length - 10} more — see MIGRATION_NOTES.md`));
     }
   }
-  await writeLine(ctx, "");
-  await writeLine(ctx, import_picocolors11.default.dim("Preview only — nothing has touched your PocketBase yet. ./migration-preview/ includes pb_migrate.js, the data-import script: review MIGRATION_NOTES.md, then run it against your app's PocketBase to copy your rows over."));
+  await writeLine2(ctx, "");
+  await writeLine2(ctx, import_picocolors12.default.dim("Preview only — nothing has touched your PocketBase yet. ./migration-preview/ includes pb_migrate.js, the data-import script: review MIGRATION_NOTES.md, then run it against your app's PocketBase to copy your rows over."));
   if (!opts.clientRewriteRequested) {
-    await writeLine(ctx, import_picocolors11.default.dim("Add --rewrite-client to also convert your Supabase SDK calls to PocketBase (preview first; --apply writes in place)."));
+    await writeLine2(ctx, import_picocolors12.default.dim("Add --rewrite-client to also convert your Supabase SDK calls to PocketBase (preview first; --apply writes in place)."));
   }
 }
 async function renderRewriteHuman(ctx, result) {
-  await writeLine(ctx, "");
+  await writeLine2(ctx, "");
   if (result.status === "failed") {
     const err = result.error;
-    await writeLine(ctx, `${import_picocolors11.default.red("✗")} ${err?.title ?? "Client rewrite failed"}`);
+    await writeLine2(ctx, `${import_picocolors12.default.red("✗")} ${err?.title ?? "Client rewrite failed"}`);
     if (err?.explanation)
-      await writeLine(ctx, `  ${err.explanation}`);
+      await writeLine2(ctx, `  ${err.explanation}`);
     if (err?.suggestion)
-      await writeLine(ctx, import_picocolors11.default.dim(`  ${err.suggestion}`));
+      await writeLine2(ctx, import_picocolors12.default.dim(`  ${err.suggestion}`));
     return;
   }
-  await writeLine(ctx, `${import_picocolors11.default.green("✓")} ${result.summary}`);
+  await writeLine2(ctx, `${import_picocolors12.default.green("✓")} ${result.summary}`);
   if (result.filesWritten.length > 0) {
-    await writeLine(ctx, "");
-    await writeLine(ctx, import_picocolors11.default.bold("Files written"));
+    await writeLine2(ctx, "");
+    await writeLine2(ctx, import_picocolors12.default.bold("Files written"));
     for (const path of result.filesWritten.slice(0, 20)) {
-      await writeLine(ctx, `  ${import_picocolors11.default.cyan(path)}`);
+      await writeLine2(ctx, `  ${import_picocolors12.default.cyan(path)}`);
     }
     if (result.filesWritten.length > 20) {
-      await writeLine(ctx, import_picocolors11.default.dim(`  …and ${result.filesWritten.length - 20} more`));
+      await writeLine2(ctx, import_picocolors12.default.dim(`  …and ${result.filesWritten.length - 20} more`));
     }
   }
   if (result.flags.length > 0) {
-    await writeLine(ctx, "");
-    await writeLine(ctx, import_picocolors11.default.bold("Needs review (see migration-preview/REWRITE_NOTES.md)"));
+    await writeLine2(ctx, "");
+    await writeLine2(ctx, import_picocolors12.default.bold("Needs review (see migration-preview/REWRITE_NOTES.md)"));
     for (const flag of result.flags.slice(0, 15)) {
       const loc = flag.line !== undefined ? `:${flag.line}` : "";
       const tag = flag.kind === "manual_review" ? "rewritten, verify semantics" : "left untouched";
-      await writeLine(ctx, `  ${import_picocolors11.default.yellow("⚠")} ${import_picocolors11.default.cyan(`${flag.file}${loc}`)} ${flag.pattern} ${import_picocolors11.default.dim(`(${tag}) — ${flag.note}`)}`);
+      await writeLine2(ctx, `  ${import_picocolors12.default.yellow("⚠")} ${import_picocolors12.default.cyan(`${flag.file}${loc}`)} ${flag.pattern} ${import_picocolors12.default.dim(`(${tag}) — ${flag.note}`)}`);
     }
     if (result.flags.length > 15) {
-      await writeLine(ctx, import_picocolors11.default.dim(`  …and ${result.flags.length - 15} more — see REWRITE_NOTES.md`));
+      await writeLine2(ctx, import_picocolors12.default.dim(`  …and ${result.flags.length - 15} more — see REWRITE_NOTES.md`));
     }
   }
   if (result.skipped.length > 0) {
-    await writeLine(ctx, import_picocolors11.default.dim(`
+    await writeLine2(ctx, import_picocolors12.default.dim(`
 ${result.skipped.length} file(s) couldn't be parsed and were skipped — listed in REWRITE_NOTES.md.`));
   }
-  await writeLine(ctx, "");
+  await writeLine2(ctx, "");
   if (result.mode === "apply") {
-    await writeLine(ctx, import_picocolors11.default.dim(result.changedCount > 0 ? "Files rewritten in place. Originals are in ./migration-preview/backup/ — diff against them (or git) before committing." : "No files were rewritten — the work left is the manual review above."));
+    await writeLine2(ctx, import_picocolors12.default.dim(result.changedCount > 0 ? "Files rewritten in place. Originals are in ./migration-preview/backup/ — diff against them (or git) before committing." : "No files were rewritten — the work left is the manual review above."));
   } else {
-    await writeLine(ctx, import_picocolors11.default.dim(result.changedCount > 0 ? "Preview only — diff ./migration-preview/rewritten/ against your project, then re-run with --rewrite-client --apply to write in place." : "Preview only — no files needed automatic rewriting; work through the manual review above."));
+    await writeLine2(ctx, import_picocolors12.default.dim(result.changedCount > 0 ? "Preview only — diff ./migration-preview/rewritten/ against your project, then re-run with --rewrite-client --apply to write in place." : "Preview only — no files needed automatic rewriting; work through the manual review above."));
   }
 }
 async function renderStatusHuman(ctx, result) {
   if (result.status === "failed") {
     const err = result.error;
-    await writeLine(ctx, `${import_picocolors11.default.red("✗")} ${err?.title ?? "Migration status scan failed"}`);
+    await writeLine2(ctx, `${import_picocolors12.default.red("✗")} ${err?.title ?? "Migration status scan failed"}`);
     if (err?.explanation)
-      await writeLine(ctx, `  ${err.explanation}`);
+      await writeLine2(ctx, `  ${err.explanation}`);
     if (err?.suggestion)
-      await writeLine(ctx, import_picocolors11.default.dim(`  ${err.suggestion}`));
+      await writeLine2(ctx, import_picocolors12.default.dim(`  ${err.suggestion}`));
     return;
   }
-  await writeLine(ctx, import_picocolors11.default.bold("Migration status"));
-  await writeLine(ctx, "");
+  await writeLine2(ctx, import_picocolors12.default.bold("Migration status"));
+  await writeLine2(ctx, "");
   for (const check2 of result.checks) {
-    const mark = check2.status === "pass" ? import_picocolors11.default.green("✓") : check2.status === "fail" ? import_picocolors11.default.red("✗") : check2.status === "warn" ? import_picocolors11.default.yellow("⚠") : import_picocolors11.default.dim("•");
-    const count = check2.count > 0 ? import_picocolors11.default.dim(` (${check2.count})`) : "";
-    await writeLine(ctx, `  ${mark} ${check2.label}${count} ${import_picocolors11.default.dim(`— ${check2.detail}`)}`);
+    const mark = check2.status === "pass" ? import_picocolors12.default.green("✓") : check2.status === "fail" ? import_picocolors12.default.red("✗") : check2.status === "warn" ? import_picocolors12.default.yellow("⚠") : import_picocolors12.default.dim("•");
+    const count = check2.count > 0 ? import_picocolors12.default.dim(` (${check2.count})`) : "";
+    await writeLine2(ctx, `  ${mark} ${check2.label}${count} ${import_picocolors12.default.dim(`— ${check2.detail}`)}`);
     for (const file2 of (check2.files ?? []).slice(0, 10)) {
-      await writeLine(ctx, import_picocolors11.default.dim(`      - ${file2}`));
+      await writeLine2(ctx, import_picocolors12.default.dim(`      - ${file2}`));
     }
     if ((check2.files?.length ?? 0) > 10) {
-      await writeLine(ctx, import_picocolors11.default.dim(`      …and ${(check2.files?.length ?? 0) - 10} more`));
+      await writeLine2(ctx, import_picocolors12.default.dim(`      …and ${(check2.files?.length ?? 0) - 10} more`));
     }
   }
   if (result.build) {
-    await writeLine(ctx, "");
-    const mark = !result.build.ran ? import_picocolors11.default.dim("•") : result.build.passed ? import_picocolors11.default.green("✓") : import_picocolors11.default.red("✗");
-    await writeLine(ctx, `  ${mark} Build ${import_picocolors11.default.dim(`— ${result.build.detail}`)}`);
+    await writeLine2(ctx, "");
+    const mark = !result.build.ran ? import_picocolors12.default.dim("•") : result.build.passed ? import_picocolors12.default.green("✓") : import_picocolors12.default.red("✗");
+    await writeLine2(ctx, `  ${mark} Build ${import_picocolors12.default.dim(`— ${result.build.detail}`)}`);
   }
-  await writeLine(ctx, "");
-  await writeLine(ctx, import_picocolors11.default.dim(result.summary));
+  await writeLine2(ctx, "");
+  await writeLine2(ctx, import_picocolors12.default.dim(result.summary));
 }
 
 // src/commands/sharing.ts
-var import_picocolors12 = __toESM(require_picocolors(), 1);
+var import_picocolors13 = __toESM(require_picocolors(), 1);
 function registerSharingCommands(cli, ctx) {
   cli.command("share [action] [arg] [valueOrRole]", "Per-app collaborator invites: list | invite <email> | role <shareId> <role> | revoke <shareId>").option("--app <name>", "App name (overrides percher.toml)").option("--role <role>", "(invite only) viewer | admin — viewer is read-only, admin can deploy + change config").action(async (action, arg, valueOrRole, options) => {
     if (action === "list" || action === undefined) {
       const rows = await shareList(ctx, { app: options.app });
       if (rows.length === 0) {
-        await writeLine(ctx, import_picocolors12.default.dim("No collaborators."));
+        await writeLine2(ctx, import_picocolors13.default.dim("No collaborators."));
         return;
       }
       for (const r of rows) {
-        const state = r.accepted ? import_picocolors12.default.green("accepted") : import_picocolors12.default.yellow("pending");
-        const roleStr = r.role === "admin" ? import_picocolors12.default.cyan("admin") : import_picocolors12.default.dim("viewer");
-        await writeLine(ctx, `${r.id}  ${roleStr.padEnd(15)}  ${state.padEnd(15)}  ${r.email}`);
+        const state = r.accepted ? import_picocolors13.default.green("accepted") : import_picocolors13.default.yellow("pending");
+        const roleStr = r.role === "admin" ? import_picocolors13.default.cyan("admin") : import_picocolors13.default.dim("viewer");
+        await writeLine2(ctx, `${r.id}  ${roleStr.padEnd(15)}  ${state.padEnd(15)}  ${r.email}`);
       }
       return;
     }
@@ -120010,8 +120455,8 @@ function registerSharingCommands(cli, ctx) {
         email: arg,
         role: roleRaw
       });
-      await writeLine(ctx, `${import_picocolors12.default.green("✓")} Invited ${created.email} as ${created.role} (id ${created.id})`);
-      await writeLine(ctx, import_picocolors12.default.dim(`Pending until accepted — invite expires ${new Date(created.expiresAt).toLocaleDateString()}.`));
+      await writeLine2(ctx, `${import_picocolors13.default.green("✓")} Invited ${created.email} as ${created.role} (id ${created.id})`);
+      await writeLine2(ctx, import_picocolors13.default.dim(`Pending until accepted — invite expires ${new Date(created.expiresAt).toLocaleDateString()}.`));
       return;
     }
     if (action === "role") {
@@ -120026,7 +120471,7 @@ function registerSharingCommands(cli, ctx) {
         shareId: arg,
         role: valueOrRole
       });
-      await writeLine(ctx, `${import_picocolors12.default.green("✓")} ${updated.email} is now ${import_picocolors12.default.cyan(updated.role)}`);
+      await writeLine2(ctx, `${import_picocolors13.default.green("✓")} ${updated.email} is now ${import_picocolors13.default.cyan(updated.role)}`);
       return;
     }
     if (action === "revoke") {
@@ -120034,7 +120479,7 @@ function registerSharingCommands(cli, ctx) {
         throw new Error("Usage: percher share revoke <shareId> [--app <name>]");
       }
       await shareRevoke(ctx, { app: options.app, shareId: arg });
-      await writeLine(ctx, `${import_picocolors12.default.green("✓")} Revoked share ${arg}`);
+      await writeLine2(ctx, `${import_picocolors13.default.green("✓")} Revoked share ${arg}`);
       return;
     }
     throw new Error(`Unknown share action "${action}". Use list | invite <email> | role <shareId> <role> | revoke <shareId>.`);
@@ -120047,12 +120492,12 @@ function registerSharingCommands(cli, ctx) {
     if (action === undefined || action === "list") {
       const pending = await invitesList(ctx, {});
       if (pending.length === 0) {
-        await writeLine(ctx, import_picocolors12.default.dim("No pending invites."));
+        await writeLine2(ctx, import_picocolors13.default.dim("No pending invites."));
         return;
       }
       for (const inv of pending) {
-        const roleStr = inv.role === "admin" ? import_picocolors12.default.cyan("admin") : import_picocolors12.default.dim("viewer");
-        await writeLine(ctx, `${inv.id}  ${roleStr.padEnd(15)}  ${inv.appName.padEnd(24)}  from ${inv.invitedBy}`);
+        const roleStr = inv.role === "admin" ? import_picocolors13.default.cyan("admin") : import_picocolors13.default.dim("viewer");
+        await writeLine2(ctx, `${inv.id}  ${roleStr.padEnd(15)}  ${inv.appName.padEnd(24)}  from ${inv.invitedBy}`);
       }
       return;
     }
@@ -120062,10 +120507,10 @@ function registerSharingCommands(cli, ctx) {
       }
       const accepted = await invitesAccept(ctx, { shareId });
       if (accepted.alreadyAccepted) {
-        await writeLine(ctx, import_picocolors12.default.dim(`Invite ${shareId} was already accepted.`));
+        await writeLine2(ctx, import_picocolors13.default.dim(`Invite ${shareId} was already accepted.`));
         return;
       }
-      await writeLine(ctx, `${import_picocolors12.default.green("✓")} Accepted — you now have ${import_picocolors12.default.cyan(accepted.role)} access to the shared app.`);
+      await writeLine2(ctx, `${import_picocolors13.default.green("✓")} Accepted — you now have ${import_picocolors13.default.cyan(accepted.role)} access to the shared app.`);
       return;
     }
     if (action === "decline") {
@@ -120073,7 +120518,7 @@ function registerSharingCommands(cli, ctx) {
         throw new Error("Usage: percher invites decline <shareId>");
       }
       await invitesDecline(ctx, { shareId });
-      await writeLine(ctx, `${import_picocolors12.default.green("✓")} Declined invite ${shareId}.`);
+      await writeLine2(ctx, `${import_picocolors13.default.green("✓")} Declined invite ${shareId}.`);
       return;
     }
     throw new Error(`Unknown invites action "${action}". Use list | accept <shareId> | decline <shareId>.`);
@@ -120084,12 +120529,12 @@ function registerSharingCommands(cli, ctx) {
 }
 
 // src/commands/status.ts
-var import_picocolors13 = __toESM(require_picocolors(), 1);
+var import_picocolors14 = __toESM(require_picocolors(), 1);
 function registerStatusCommands(cli, ctx) {
   cli.command("status", "Show Percher platform status (API + worker health)").option("--json", "Output JSON instead of formatted text").action(async (options) => {
     const result = await status(ctx, { json: Boolean(options.json) });
     if (options.json) {
-      await writeLine(ctx, JSON.stringify(result, null, 2));
+      await writeLine2(ctx, JSON.stringify(result, null, 2));
       if (result.verdict === "unreachable")
         throw new SilentExitError(1);
       return;
@@ -120100,34 +120545,34 @@ function registerStatusCommands(cli, ctx) {
   });
 }
 async function renderHumanStatus(ctx, result) {
-  const symbol2 = result.verdict === "operational" ? import_picocolors13.default.green("✓") : result.verdict === "worker-degraded" ? import_picocolors13.default.yellow("⚠") : import_picocolors13.default.red("✗");
-  await writeLine(ctx, `${symbol2} ${result.summary}`);
+  const symbol2 = result.verdict === "operational" ? import_picocolors14.default.green("✓") : result.verdict === "worker-degraded" ? import_picocolors14.default.yellow("⚠") : import_picocolors14.default.red("✗");
+  await writeLine2(ctx, `${symbol2} ${result.summary}`);
   if (!result.health)
     return;
   const worker = result.health.worker;
   if (!worker) {
-    await writeLine(ctx, import_picocolors13.default.dim("  worker: not configured (local Docker socket)"));
+    await writeLine2(ctx, import_picocolors14.default.dim("  worker: not configured (local Docker socket)"));
     return;
   }
   if (worker.health) {
     const ok = worker.health.ok;
-    const symbol3 = ok ? import_picocolors13.default.green("✓") : import_picocolors13.default.red("✗");
+    const symbol3 = ok ? import_picocolors14.default.green("✓") : import_picocolors14.default.red("✗");
     const lastOk = worker.health.lastOkAt ?? "never";
-    await writeLine(ctx, `  ${symbol3} worker health: ${ok ? "ok" : `failing (${worker.health.consecutiveErrs} consecutive)`}  last-ok=${import_picocolors13.default.dim(lastOk)}`);
+    await writeLine2(ctx, `  ${symbol3} worker health: ${ok ? "ok" : `failing (${worker.health.consecutiveErrs} consecutive)`}  last-ok=${import_picocolors14.default.dim(lastOk)}`);
   }
   if (worker.circuitBreaker) {
     const breaker = worker.circuitBreaker;
-    const symbol3 = breaker.open ? import_picocolors13.default.red("✗") : import_picocolors13.default.green("✓");
+    const symbol3 = breaker.open ? import_picocolors14.default.red("✗") : import_picocolors14.default.green("✓");
     const state = breaker.open ? "open (deploys fail fast)" : "closed";
-    await writeLine(ctx, `  ${symbol3} circuit breaker: ${state}  ${breaker.failuresInWindow}/${breaker.threshold} failures in last ${Math.round(breaker.windowMs / 1000)}s`);
+    await writeLine2(ctx, `  ${symbol3} circuit breaker: ${state}  ${breaker.failuresInWindow}/${breaker.threshold} failures in last ${Math.round(breaker.windowMs / 1000)}s`);
   }
   if (result.health.version) {
-    await writeLine(ctx, import_picocolors13.default.dim(`  api version: ${result.health.version}`));
+    await writeLine2(ctx, import_picocolors14.default.dim(`  api version: ${result.health.version}`));
   }
 }
 
 // src/commands/token.ts
-var import_picocolors14 = __toESM(require_picocolors(), 1);
+var import_picocolors15 = __toESM(require_picocolors(), 1);
 var VALID_SCOPES = ["deploy", "env", "read", "full"];
 function scopeLabel(scopes, appName) {
   const s = scopes && scopes.length > 0 ? scopes.join("+") : "full";
@@ -120136,22 +120581,22 @@ function scopeLabel(scopes, appName) {
 function registerTokenCommands(cli, ctx) {
   cli.command("token [action] [arg]", "Manage API tokens: create | list | revoke").option("--scope <scope>", "(create) deploy | env | read | full (default: full)").option("--app <name>", "(create) bind the token to a single app").option("--ttl-days <n>", "(create) token lifetime in days").action(async (action, arg, options) => {
     if (!ctx.client.token) {
-      await writeLine(ctx, `${import_picocolors14.default.red("✗")} Not logged in. Run: percher login`);
+      await writeLine2(ctx, `${import_picocolors15.default.red("✗")} Not logged in. Run: percher login`);
       throw new SilentExitError;
     }
     if (action === "create") {
       if (!arg) {
-        await writeLine(ctx, `${import_picocolors14.default.red("✗")} A name is required. Usage: percher token create <name> [--scope deploy] [--app <name>]`);
+        await writeLine2(ctx, `${import_picocolors15.default.red("✗")} A name is required. Usage: percher token create <name> [--scope deploy] [--app <name>]`);
         throw new SilentExitError;
       }
       const scope = options.scope ?? "full";
       if (!VALID_SCOPES.includes(scope)) {
-        await writeLine(ctx, `${import_picocolors14.default.red("✗")} Invalid --scope "${options.scope}". Use one of: ${VALID_SCOPES.join(", ")}.`);
+        await writeLine2(ctx, `${import_picocolors15.default.red("✗")} Invalid --scope "${options.scope}". Use one of: ${VALID_SCOPES.join(", ")}.`);
         throw new SilentExitError;
       }
       const ttlDays = options.ttlDays !== undefined ? Number(options.ttlDays) : undefined;
       if (ttlDays !== undefined && (!Number.isInteger(ttlDays) || ttlDays <= 0)) {
-        await writeLine(ctx, `${import_picocolors14.default.red("✗")} --ttl-days must be a positive whole number.`);
+        await writeLine2(ctx, `${import_picocolors15.default.red("✗")} --ttl-days must be a positive whole number.`);
         throw new SilentExitError;
       }
       const created = await tokenCreate(ctx, {
@@ -120160,36 +120605,36 @@ function registerTokenCommands(cli, ctx) {
         app: options.app,
         ttlDays
       });
-      await writeLine(ctx, `${import_picocolors14.default.green("✓")} Token created: ${import_picocolors14.default.bold(created.name)}  ${import_picocolors14.default.dim(`(${scopeLabel(created.scopes, created.appName)})`)}`);
-      await writeLine(ctx, "");
-      await writeLine(ctx, `  ${import_picocolors14.default.bold(created.token)}`);
-      await writeLine(ctx, import_picocolors14.default.yellow("  ↑ Store this now — the secret is shown only once and can't be retrieved."));
-      await writeLine(ctx, "");
-      await writeLine(ctx, import_picocolors14.default.dim("  Use it in CI / an agent:"));
-      await writeLine(ctx, import_picocolors14.default.dim(`    PERCHER_TOKEN=${created.token} bunx percher publish`));
+      await writeLine2(ctx, `${import_picocolors15.default.green("✓")} Token created: ${import_picocolors15.default.bold(created.name)}  ${import_picocolors15.default.dim(`(${scopeLabel(created.scopes, created.appName)})`)}`);
+      await writeLine2(ctx, "");
+      await writeLine2(ctx, `  ${import_picocolors15.default.bold(created.token)}`);
+      await writeLine2(ctx, import_picocolors15.default.yellow("  ↑ Store this now — the secret is shown only once and can't be retrieved."));
+      await writeLine2(ctx, "");
+      await writeLine2(ctx, import_picocolors15.default.dim("  Use it in CI / an agent:"));
+      await writeLine2(ctx, import_picocolors15.default.dim(`    PERCHER_TOKEN=${created.token} bunx percher publish`));
       return;
     }
     if (action === "list") {
       const tokens = await tokenList(ctx);
       if (tokens.length === 0) {
-        await writeLine(ctx, import_picocolors14.default.dim("No API tokens."));
+        await writeLine2(ctx, import_picocolors15.default.dim("No API tokens."));
         return;
       }
       for (const t of tokens) {
         const expires = t.expiresAt ? `expires ${new Date(t.expiresAt).toISOString().slice(0, 10)}` : "no expiry";
-        await writeLine(ctx, `${import_picocolors14.default.bold(t.id)}  ${t.name.padEnd(20)} ${import_picocolors14.default.dim(scopeLabel(t.scopes, t.appName))}  ${import_picocolors14.default.dim(expires)}`);
+        await writeLine2(ctx, `${import_picocolors15.default.bold(t.id)}  ${t.name.padEnd(20)} ${import_picocolors15.default.dim(scopeLabel(t.scopes, t.appName))}  ${import_picocolors15.default.dim(expires)}`);
       }
-      await writeLine(ctx, "");
-      await writeLine(ctx, import_picocolors14.default.dim("Revoke one with: percher token revoke <id>"));
+      await writeLine2(ctx, "");
+      await writeLine2(ctx, import_picocolors15.default.dim("Revoke one with: percher token revoke <id>"));
       return;
     }
     if (action === "revoke") {
       if (!arg) {
-        await writeLine(ctx, `${import_picocolors14.default.red("✗")} A token id is required. Usage: percher token revoke <id> (list ids with \`percher token list\`).`);
+        await writeLine2(ctx, `${import_picocolors15.default.red("✗")} A token id is required. Usage: percher token revoke <id> (list ids with \`percher token list\`).`);
         throw new SilentExitError;
       }
       await tokenRevoke(ctx, { id: arg });
-      await writeLine(ctx, `${import_picocolors14.default.green("✓")} Token revoked.`);
+      await writeLine2(ctx, `${import_picocolors15.default.green("✓")} Token revoked.`);
       return;
     }
     throw new Error(`Unknown token action "${action ?? ""}". Use: create | list | revoke.`);
@@ -120200,18 +120645,18 @@ function registerTokenCommands(cli, ctx) {
 }
 
 // src/commands/transfers.ts
-var import_picocolors15 = __toESM(require_picocolors(), 1);
+var import_picocolors16 = __toESM(require_picocolors(), 1);
 function registerTransfersCommands(cli, ctx) {
   cli.command("transfer [emailOrTransferId]", "Transfer ownership of an app: `transfer <email>` initiates; `transfer --cancel <id>` cancels; `transfer --list` shows history").option("--app <name>", "App name (overrides percher.toml)").option("--cancel", "Cancel a pending transfer by id (positional arg is the transferId)").option("--list", "List the transfer history for this app").action(async (emailOrTransferId, options) => {
     if (options.list) {
       const rows = await transferListForApp(ctx, { app: options.app });
       if (rows.length === 0) {
-        await writeLine(ctx, import_picocolors15.default.dim("No transfers for this app."));
+        await writeLine2(ctx, import_picocolors16.default.dim("No transfers for this app."));
         return;
       }
       for (const r of rows) {
-        const status2 = r.status === "pending" ? import_picocolors15.default.yellow("pending") : r.status === "accepted" ? import_picocolors15.default.green("accepted") : import_picocolors15.default.dim(r.status);
-        await writeLine(ctx, `${r.id}  ${status2.padEnd(20)}  → ${r.toEmail}  (${r.createdAt})`);
+        const status2 = r.status === "pending" ? import_picocolors16.default.yellow("pending") : r.status === "accepted" ? import_picocolors16.default.green("accepted") : import_picocolors16.default.dim(r.status);
+        await writeLine2(ctx, `${r.id}  ${status2.padEnd(20)}  → ${r.toEmail}  (${r.createdAt})`);
       }
       return;
     }
@@ -120223,7 +120668,7 @@ function registerTransfersCommands(cli, ctx) {
         app: options.app,
         transferId: emailOrTransferId
       });
-      await writeLine(ctx, `${import_picocolors15.default.green("✓")} Cancelled transfer ${emailOrTransferId}`);
+      await writeLine2(ctx, `${import_picocolors16.default.green("✓")} Cancelled transfer ${emailOrTransferId}`);
       return;
     }
     if (!emailOrTransferId) {
@@ -120233,21 +120678,21 @@ function registerTransfersCommands(cli, ctx) {
       app: options.app,
       email: emailOrTransferId
     });
-    await writeLine(ctx, `${import_picocolors15.default.green("✓")} Transfer initiated to ${initiated.toEmail} (id ${initiated.id})`);
-    await writeLine(ctx, import_picocolors15.default.dim(`Expires ${new Date(initiated.expiresAt).toLocaleDateString()}. The recipient must accept via 'percher transfers accept ${initiated.id}'.`));
+    await writeLine2(ctx, `${import_picocolors16.default.green("✓")} Transfer initiated to ${initiated.toEmail} (id ${initiated.id})`);
+    await writeLine2(ctx, import_picocolors16.default.dim(`Expires ${new Date(initiated.expiresAt).toLocaleDateString()}. The recipient must accept via 'percher transfers accept ${initiated.id}'.`));
     if (initiated.notes) {
-      await writeLine(ctx, import_picocolors15.default.yellow(`  ⚠  ${initiated.notes}`));
+      await writeLine2(ctx, import_picocolors16.default.yellow(`  ⚠  ${initiated.notes}`));
     }
   });
   cli.command("transfers [action] [transferId]", "Incoming ownership transfers: list (default) | accept <transferId> | decline <transferId>").action(async (action, transferId) => {
     if (action === undefined || action === "list") {
       const rows = await transfersIncoming(ctx, {});
       if (rows.length === 0) {
-        await writeLine(ctx, import_picocolors15.default.dim("No pending incoming transfers."));
+        await writeLine2(ctx, import_picocolors16.default.dim("No pending incoming transfers."));
         return;
       }
       for (const r of rows) {
-        await writeLine(ctx, `${r.id}  ${r.appName.padEnd(24)}  from ${r.fromEmail}  (expires ${new Date(r.expiresAt).toLocaleDateString()})`);
+        await writeLine2(ctx, `${r.id}  ${r.appName.padEnd(24)}  from ${r.fromEmail}  (expires ${new Date(r.expiresAt).toLocaleDateString()})`);
       }
       return;
     }
@@ -120256,7 +120701,7 @@ function registerTransfersCommands(cli, ctx) {
         throw new Error("Usage: percher transfers accept <transferId>");
       }
       const accepted = await transfersAccept(ctx, { transferId });
-      await writeLine(ctx, `${import_picocolors15.default.green("✓")} You now own ${import_picocolors15.default.cyan(accepted.appName)}. Run 'percher open --app ${accepted.appName}' to see it.`);
+      await writeLine2(ctx, `${import_picocolors16.default.green("✓")} You now own ${import_picocolors16.default.cyan(accepted.appName)}. Run 'percher open --app ${accepted.appName}' to see it.`);
       return;
     }
     if (action === "decline") {
@@ -120264,7 +120709,7 @@ function registerTransfersCommands(cli, ctx) {
         throw new Error("Usage: percher transfers decline <transferId>");
       }
       await transfersDecline(ctx, { transferId });
-      await writeLine(ctx, `${import_picocolors15.default.green("✓")} Declined transfer ${transferId}.`);
+      await writeLine2(ctx, `${import_picocolors16.default.green("✓")} Declined transfer ${transferId}.`);
       return;
     }
     throw new Error(`Unknown transfers action "${action}". Use list | accept <id> | decline <id>.`);
@@ -120328,6 +120773,7 @@ async function createCliContext() {
     prompt,
     openUrl,
     interactiveLogin: true,
+    stdinIsInteractive: process.stdin.isTTY === true && process.stdout.isTTY === true,
     status(message) {
       process.stderr.write(encoder.encode(`${message}
 `));
@@ -120337,52 +120783,52 @@ async function createCliContext() {
 
 // src/output.ts
 init_dist();
-var import_picocolors16 = __toESM(require_picocolors(), 1);
+var import_picocolors17 = __toESM(require_picocolors(), 1);
 async function renderError(stderr, error48) {
   const writer = stderr.getWriter();
   const encoder = new TextEncoder;
   const lines = [];
   if (error48 instanceof PercherTomlError) {
-    lines.push(`${import_picocolors16.default.red(`error (${error48.code}):`)} ${error48.message}`);
+    lines.push(`${import_picocolors17.default.red(`error (${error48.code}):`)} ${error48.message}`);
     if (error48.tomlLine !== undefined) {
-      lines.push(import_picocolors16.default.dim(`  at percher.toml line ${error48.tomlLine}`));
+      lines.push(import_picocolors17.default.dim(`  at percher.toml line ${error48.tomlLine}`));
     }
     for (const issue2 of error48.issues ?? []) {
-      lines.push(`${import_picocolors16.default.dim("  · ") + import_picocolors16.default.yellow(issue2.path.join("."))}: ${issue2.message}`);
+      lines.push(`${import_picocolors17.default.dim("  · ") + import_picocolors17.default.yellow(issue2.path.join("."))}: ${issue2.message}`);
     }
   } else if (error48 instanceof SunsetError) {
     if (error48.gateCode === "platform_delete_gated") {
-      lines.push(`${import_picocolors16.default.yellow("Percher is shutting down — deletes are paused.")}`);
+      lines.push(`${import_picocolors17.default.yellow("Percher is shutting down — deletes are paused.")}`);
       lines.push(error48.message);
-      lines.push(import_picocolors16.default.dim(`  To delete and permanently forfeit your export window, confirm with your password in the dashboard: ${error48.dashboardUrl}`));
-      lines.push(import_picocolors16.default.dim("  The CLI cannot perform this delete during sunset — it must go through the dashboard."));
+      lines.push(import_picocolors17.default.dim(`  To delete and permanently forfeit your export window, confirm with your password in the dashboard: ${error48.dashboardUrl}`));
+      lines.push(import_picocolors17.default.dim("  The CLI cannot perform this delete during sunset — it must go through the dashboard."));
     } else {
-      lines.push(`${import_picocolors16.default.yellow("Percher is in read-only mode ahead of shutdown.")}`);
+      lines.push(`${import_picocolors17.default.yellow("Percher is in read-only mode ahead of shutdown.")}`);
       lines.push(error48.message);
-      lines.push(import_picocolors16.default.dim(`  Your apps keep running. Export them any time from the dashboard: ${error48.dashboardUrl}`));
+      lines.push(import_picocolors17.default.dim(`  Your apps keep running. Export them any time from the dashboard: ${error48.dashboardUrl}`));
     }
-    lines.push(import_picocolors16.default.dim(`  Final data deletion: ${error48.finalDeletionDate}`));
+    lines.push(import_picocolors17.default.dim(`  Final data deletion: ${error48.finalDeletionDate}`));
   } else if (error48 instanceof PercherApiError) {
     if (error48.status === 502 || error48.status === 503) {
-      lines.push(`${import_picocolors16.default.red("error:")} Percher API is temporarily unavailable (HTTP ${error48.status}). Try again in a few seconds.`);
+      lines.push(`${import_picocolors17.default.red("error:")} Percher API is temporarily unavailable (HTTP ${error48.status}). Try again in a few seconds.`);
     } else {
-      lines.push(`${import_picocolors16.default.red("error:")} ${error48.message}`);
-      lines.push(import_picocolors16.default.dim(`  ${error48.code} (HTTP ${error48.status})`));
+      lines.push(`${import_picocolors17.default.red("error:")} ${error48.message}`);
+      lines.push(import_picocolors17.default.dim(`  ${error48.code} (HTTP ${error48.status})`));
     }
     if (error48.requestId)
-      lines.push(import_picocolors16.default.dim(`  request: ${error48.requestId}`));
+      lines.push(import_picocolors17.default.dim(`  request: ${error48.requestId}`));
   } else if (error48 instanceof PercherCoreError) {
-    lines.push(`${import_picocolors16.default.red(`error (${error48.code}):`)} ${error48.message}`);
+    lines.push(`${import_picocolors17.default.red(`error (${error48.code}):`)} ${error48.message}`);
     if (error48.hint)
-      lines.push(import_picocolors16.default.dim(`  ${error48.hint}`));
+      lines.push(import_picocolors17.default.dim(`  ${error48.hint}`));
   } else if (error48 instanceof Error) {
-    lines.push(`${import_picocolors16.default.red("unexpected error:")} ${error48.message}`);
+    lines.push(`${import_picocolors17.default.red("unexpected error:")} ${error48.message}`);
     if (error48.stack)
-      lines.push(import_picocolors16.default.dim(error48.stack.split(`
+      lines.push(import_picocolors17.default.dim(error48.stack.split(`
 `).slice(1, 4).join(`
 `)));
   } else {
-    lines.push(`${import_picocolors16.default.red("unexpected error:")} ${String(error48)}`);
+    lines.push(`${import_picocolors17.default.red("unexpected error:")} ${String(error48)}`);
   }
   try {
     await writer.write(encoder.encode(`${lines.join(`
@@ -120395,7 +120841,7 @@ async function renderError(stderr, error48) {
 // package.json
 var package_default = {
   name: "percher",
-  version: "0.5.20",
+  version: "0.5.21",
   description: "CLI for the Percher hosting platform — publish apps with one command",
   type: "module",
   bin: {
@@ -120422,9 +120868,9 @@ var package_default = {
     typecheck: "tsc --noEmit"
   },
   dependencies: {
-    "@percher/client": "^0.2.19",
-    "@percher/core": "^0.4.23",
-    "@percher/toml": "^0.1.8",
+    "@percher/client": "^0.2.20",
+    "@percher/core": "^0.4.24",
+    "@percher/toml": "^0.1.9",
     cac: "^7.0.0",
     picocolors: "^1.1.1"
   },
@@ -120495,7 +120941,7 @@ async function showTelemetryNotice() {
 }
 
 // src/version-check.ts
-var import_picocolors17 = __toESM(require_picocolors(), 1);
+var import_picocolors18 = __toESM(require_picocolors(), 1);
 async function checkForUpdates() {
   try {
     const res = await fetch("https://registry.npmjs.org/percher/latest", {
@@ -120506,9 +120952,9 @@ async function checkForUpdates() {
     const data2 = await res.json();
     const latest = data2.version;
     if (latest && latest !== VERSION) {
-      console.error(import_picocolors17.default.yellow(`
+      console.error(import_picocolors18.default.yellow(`
 Update available: ${VERSION} → ${latest}`));
-      console.error(import_picocolors17.default.dim(`Run: bunx percher@latest
+      console.error(import_picocolors18.default.dim(`Run: bunx percher@latest
 `));
     }
   } catch {}
@@ -120526,6 +120972,7 @@ async function run(argv, ctxOverride) {
   registerAuthCommands(cli, ctx);
   registerAccountCommands(cli, ctx);
   registerGithubCommands(cli, ctx);
+  registerHooksCommands(cli, ctx);
   registerMigrateCommands(cli, ctx);
   registerSharingCommands(cli, ctx);
   registerStatusCommands(cli, ctx);