percher 1.1.0 → 1.3.0

package/dist/bin/percher.js

@@ -4751,7 +4751,7 @@ var init_build_env_prefixes = __esm(() => {
 });
 
 // ../client/dist/config.js
-import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync4, renameSync, writeFileSync as writeFileSync4 } from "node:fs";
+import { chmodSync, closeSync, existsSync as existsSync4, fchmodSync, mkdirSync as mkdirSync4, openSync, readFileSync as readFileSync4, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "node:fs";
 import { homedir } from "node:os";
 import { dirname as dirname4, join as join6 } from "node:path";
 function home() {
@@ -4800,12 +4800,32 @@ function readAnonClaims() {
 }
 function saveConfig(partial2) {
   const p = configPath();
-  mkdirSync4(dirname4(p), { recursive: true });
+  mkdirSync4(dirname4(p), { recursive: true, mode: 448 });
+  if (process.platform !== "win32") {
+    chmodSync(dirname4(p), 448);
+    if (existsSync4(p))
+      chmodSync(p, 384);
+  }
   const current = readFile2();
   const merged = { ...current, ...partial2 };
   const tmp = `${p}.tmp-${process.pid}-${Date.now()}`;
-  writeFileSync4(tmp, JSON.stringify(merged, null, 2), "utf8");
-  renameSync(tmp, p);
+  let fd;
+  let created = false;
+  try {
+    fd = openSync(tmp, "wx", 384);
+    created = true;
+    if (process.platform !== "win32")
+      fchmodSync(fd, 384);
+    writeFileSync4(fd, JSON.stringify(merged, null, 2), "utf8");
+    closeSync(fd);
+    fd = undefined;
+    renameSync(tmp, p);
+  } finally {
+    if (fd !== undefined)
+      closeSync(fd);
+    if (created)
+      rmSync2(tmp, { force: true });
+  }
 }
 function getAnonClaim(app) {
   return readAnonClaims()[app] ?? null;
@@ -4830,7 +4850,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@percher/client",
-    version: "1.1.0",
+    version: "1.3.0",
     description: "Official TypeScript SDK for Percher: deploy apps, manage env vars, stream logs, and automate hosting workflows.",
     keywords: [
       "percher",
@@ -4871,7 +4891,7 @@ var init_package = __esm(() => {
       typecheck: "tsc --noEmit"
     },
     dependencies: {
-      "@percher/toml": "^1.0.3"
+      "@percher/toml": "^1.0.4"
     },
     devDependencies: {
       "bun-types": "^1.1.0",
@@ -5384,10 +5404,11 @@ class AppsResource {
   deleteIconImage(appRef) {
     return this.http.deleteJson(`/apps/${encodeURIComponent(appRef)}/icon/image`);
   }
-  uploadPreviewImage(appRef, bytes, mime) {
+  uploadPreviewImage(appRef, bytes, mime, orientation) {
     const ab = new ArrayBuffer(bytes.byteLength);
     new Uint8Array(ab).set(bytes);
-    return this.http.postBinary(`/apps/${encodeURIComponent(appRef)}/preview/image`, new Blob([ab]), { "Content-Type": mime });
+    const query = orientation ? `?orientation=${orientation}` : "";
+    return this.http.postBinary(`/apps/${encodeURIComponent(appRef)}/preview/image${query}`, new Blob([ab]), { "Content-Type": mime });
   }
   deletePreviewImage(appRef) {
     return this.http.deleteJson(`/apps/${encodeURIComponent(appRef)}/preview/image`);
@@ -5642,6 +5663,58 @@ class BillingResource {
   }
 }
 
+// ../client/dist/resources/data-records.js
+function dataPathSegment(kind, value) {
+  const re = kind === "collection" ? COLLECTION_RE : RECORD_ID_RE;
+  if (!re.test(value))
+    throw new TypeError(`invalid data ${kind}`);
+  return encodeURIComponent(value);
+}
+function outcomeUnknown(cause, observed) {
+  const answered = cause instanceof PercherApiError;
+  return new PercherApiError(OUTCOME_UNKNOWN_MESSAGE, {
+    status: answered ? cause.status : 0,
+    code: "DATA_WRITE_OUTCOME_UNKNOWN",
+    requestId: answered ? cause.requestId : undefined,
+    cause,
+    extra: { observed }
+  });
+}
+function isRecordReply(reply) {
+  return typeof reply === "object" && reply !== null && !Array.isArray(reply) && typeof reply.id === "string" && reply.id.length > 0;
+}
+function isDeleteReply(reply) {
+  return reply === undefined || typeof reply === "object" && reply !== null && !Array.isArray(reply);
+}
+async function writeOnce(run, usable) {
+  let reply;
+  try {
+    reply = await run();
+  } catch (err) {
+    if (err instanceof SunsetError)
+      throw err;
+    if (err instanceof PercherApiError) {
+      if (err.code === "DATA_WRITE_OUTCOME_UNKNOWN")
+        throw err;
+      if (err.status >= 400 && err.status < 500)
+        throw err;
+      if (err.status >= 500 && WRITE_NOT_SENT.has(err.code))
+        throw err;
+    }
+    throw outcomeUnknown(err, err instanceof PercherApiError ? "error_response" : "no_usable_response");
+  }
+  if (!usable(reply))
+    throw outcomeUnknown(undefined, "unusable_reply");
+  return reply;
+}
+var COLLECTION_RE, RECORD_ID_RE, WRITE_NOT_SENT, OUTCOME_UNKNOWN_MESSAGE = "No usable answer arrived for this write, so it may or may not have been saved.";
+var init_data_records = __esm(() => {
+  init_errors();
+  COLLECTION_RE = /^[A-Za-z][A-Za-z0-9_]{0,63}$/;
+  RECORD_ID_RE = /^[A-Za-z0-9_-]{1,64}$/;
+  WRITE_NOT_SENT = new Set(["PB_NOT_RUNNING", "PB_AUTH_FAILED", "PB_VERSION_UNSUPPORTED"]);
+});
+
 // ../client/dist/resources/data.js
 class DataResource {
   http;
@@ -5678,7 +5751,37 @@ class DataResource {
   removeOAuthProvider(appRef, provider) {
     return this.http.delete(`/apps/${encodeURIComponent(appRef)}/data/oauth/${encodeURIComponent(provider)}`);
   }
+  getSchema(appRef) {
+    return this.http.get(`/apps/${encodeURIComponent(appRef)}/data/schema`);
+  }
+  queryRecords(appRef, collection, query = {}) {
+    return this.http.post(`${this.records(appRef, collection)}/query`, query);
+  }
+  getRecord(appRef, collection, id) {
+    return this.http.get(this.record(appRef, collection, id));
+  }
+  createRecord(appRef, collection, input) {
+    const path = this.records(appRef, collection);
+    return writeOnce(() => this.http.post(path, input), isRecordReply);
+  }
+  updateRecord(appRef, collection, id, input) {
+    const path = this.record(appRef, collection, id);
+    return writeOnce(() => this.http.patch(path, input), isRecordReply);
+  }
+  async deleteRecord(appRef, collection, id) {
+    const path = this.record(appRef, collection, id);
+    await writeOnce(() => this.http.deleteJson(path), isDeleteReply);
+  }
+  records(appRef, collection) {
+    return `/apps/${encodeURIComponent(appRef)}/data/collections/${dataPathSegment("collection", collection)}/records`;
+  }
+  record(appRef, collection, id) {
+    return `${this.records(appRef, collection)}/${dataPathSegment("id", id)}`;
+  }
 }
+var init_data = __esm(() => {
+  init_data_records();
+});
 
 // ../client/dist/resources/env.js
 function scopeQuery(opts) {
@@ -6142,6 +6245,7 @@ var init_client = __esm(() => {
   init_http();
   init_apps();
   init_auth();
+  init_data();
   init_logs();
 });
 
@@ -6262,6 +6366,55 @@ var init_env_file = __esm(() => {
   };
 });
 
+// ../client/dist/telemetry-consent.js
+import { chmodSync as chmodSync2, mkdirSync as mkdirSync5, readFileSync as readFileSync5, renameSync as renameSync2, rmSync as rmSync3, writeFileSync as writeFileSync5 } from "node:fs";
+import { dirname as dirname5, join as join7 } from "node:path";
+function consentPath() {
+  return join7(dirname5(configPath()), "telemetry.json");
+}
+function envOptOut() {
+  if (process.env.PERCHER_NO_TELEMETRY === "1" || process.env.PERCHER_NO_TELEMETRY === "true") {
+    return "PERCHER_NO_TELEMETRY";
+  }
+  if (process.env.DO_NOT_TRACK === "1")
+    return "DO_NOT_TRACK";
+  return null;
+}
+function readStored() {
+  try {
+    const parsed = JSON.parse(readFileSync5(consentPath(), "utf8"));
+    if (typeof parsed?.enabled === "boolean" && typeof parsed.decidedAt === "string" && typeof parsed.version === "string") {
+      return { enabled: parsed.enabled, decidedAt: parsed.decidedAt, version: parsed.version };
+    }
+  } catch {}
+  return null;
+}
+function telemetryState() {
+  const optOut = envOptOut();
+  const stored = readStored();
+  return { enabled: optOut === null && stored?.enabled === true, envOptOut: optOut, stored };
+}
+function saveTelemetryAnswer(enabled, version2) {
+  const p = consentPath();
+  mkdirSync5(dirname5(p), { recursive: true, mode: 448 });
+  if (process.platform !== "win32")
+    chmodSync2(dirname5(p), 448);
+  const answer = { enabled, decidedAt: new Date().toISOString(), version: version2 };
+  const tmp = `${p}.tmp-${process.pid}-${Date.now()}`;
+  try {
+    writeFileSync5(tmp, `${JSON.stringify(answer, null, 2)}
+`, { mode: 384, flag: "wx" });
+    if (process.platform !== "win32")
+      chmodSync2(tmp, 384);
+    renameSync2(tmp, p);
+  } finally {
+    rmSync3(tmp, { force: true });
+  }
+}
+var init_telemetry_consent = __esm(() => {
+  init_config();
+});
+
 // ../client/dist/index.js
 var init_dist = __esm(() => {
   init_build_env_prefixes();
@@ -6271,7 +6424,9 @@ var init_dist = __esm(() => {
   init_errors();
   init_apps();
   init_auth();
+  init_data();
   init_logs();
+  init_telemetry_consent();
 });
 
 // ../../node_modules/.bun/ignore@7.0.5/node_modules/ignore/index.js
@@ -6718,19 +6873,19 @@ var require_tslib = __commonJS((exports, module) => {
         }
       return t;
     };
-    __decorate = function(decorators, target, key, desc) {
-      var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    __decorate = function(decorators, target2, key, desc) {
+      var c = arguments.length, r = c < 3 ? target2 : desc === null ? desc = Object.getOwnPropertyDescriptor(target2, key) : desc, d;
       if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
-        r = Reflect.decorate(decorators, target, key, desc);
+        r = Reflect.decorate(decorators, target2, key, desc);
       else
         for (var i = decorators.length - 1;i >= 0; i--)
           if (d = decorators[i])
-            r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-      return c > 3 && r && Object.defineProperty(target, key, r), r;
+            r = (c < 3 ? d(r) : c > 3 ? d(target2, key, r) : d(target2, key)) || r;
+      return c > 3 && r && Object.defineProperty(target2, key, r), r;
     };
     __param = function(paramIndex, decorator) {
-      return function(target, key) {
-        decorator(target, key, paramIndex);
+      return function(target2, key) {
+        decorator(target2, key, paramIndex);
       };
     };
     __esDecorate = function(ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
@@ -6740,8 +6895,8 @@ var require_tslib = __commonJS((exports, module) => {
         return f;
       }
       var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
-      var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
-      var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+      var target2 = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+      var descriptor = descriptorIn || (target2 ? Object.getOwnPropertyDescriptor(target2, contextIn.name) : {});
       var _, done = false;
       for (var i = decorators.length - 1;i >= 0; i--) {
         var context = {};
@@ -6773,8 +6928,8 @@ var require_tslib = __commonJS((exports, module) => {
             descriptor[key] = _;
         }
       }
-      if (target)
-        Object.defineProperty(target, contextIn.name, descriptor);
+      if (target2)
+        Object.defineProperty(target2, contextIn.name, descriptor);
       done = true;
     };
     __runInitializers = function(thisArg, initializers, value) {
@@ -8951,13 +9106,13 @@ var require_path_visitor = __commonJS((exports, module) => {
       isFunction.assert(Visitor.visit);
       return new Visitor;
     };
-    function extend2(target, source) {
+    function extend2(target2, source) {
       for (var property in source) {
         if (hasOwn.call(source, property)) {
-          target[property] = source[property];
+          target2[property] = source[property];
         }
       }
-      return target;
+      return target2;
     }
     PathVisitor.visit = function visit(node, methods) {
       return PathVisitor.fromMethodsObject(methods).visit(node);
@@ -10582,7 +10737,7 @@ var require_util = __commonJS((exports) => {
     return path;
   }
   exports.normalize = normalize2;
-  function join18(aRoot, aPath) {
+  function join19(aRoot, aPath) {
     if (aRoot === "") {
       aRoot = ".";
     }
@@ -10614,7 +10769,7 @@ var require_util = __commonJS((exports) => {
     }
     return joined;
   }
-  exports.join = join18;
+  exports.join = join19;
   exports.isAbsolute = function(aPath) {
     return aPath.charAt(0) === "/" || urlRegexp.test(aPath);
   };
@@ -10787,7 +10942,7 @@ var require_util = __commonJS((exports) => {
           parsed.path = parsed.path.substring(0, index + 1);
         }
       }
-      sourceURL = join18(urlGenerate(parsed), sourceURL);
+      sourceURL = join19(urlGenerate(parsed), sourceURL);
     }
     return normalize2(sourceURL);
   }
@@ -12532,27 +12687,27 @@ var require_esprima2 = __commonJS((exports, module) => {
           };
           CommentHandler2.prototype.findLeadingComments = function(metadata) {
             var leadingComments = [];
-            var target;
+            var target2;
             while (this.stack.length > 0) {
               var entry = this.stack[this.stack.length - 1];
               if (entry && entry.start >= metadata.start.offset) {
-                target = entry.node;
+                target2 = entry.node;
                 this.stack.pop();
               } else {
                 break;
               }
             }
-            if (target) {
-              var count = target.leadingComments ? target.leadingComments.length : 0;
+            if (target2) {
+              var count = target2.leadingComments ? target2.leadingComments.length : 0;
               for (var i = count - 1;i >= 0; --i) {
-                var comment = target.leadingComments[i];
+                var comment = target2.leadingComments[i];
                 if (comment.range[1] <= metadata.start.offset) {
                   leadingComments.unshift(comment);
-                  target.leadingComments.splice(i, 1);
+                  target2.leadingComments.splice(i, 1);
                 }
               }
-              if (target.leadingComments && target.leadingComments.length === 0) {
-                delete target.leadingComments;
+              if (target2.leadingComments && target2.leadingComments.length === 0) {
+                delete target2.leadingComments;
               }
               return leadingComments;
             }
@@ -13038,9 +13193,9 @@ var require_esprima2 = __commonJS((exports, module) => {
             if (this.match("}")) {
               this.tolerateError("JSX attributes must only be assigned a non-empty expression");
             }
-            var expression = this.parseAssignmentExpression();
+            var expression2 = this.parseAssignmentExpression();
             this.reenterJSX();
-            return this.finalize(node, new JSXNode.JSXExpressionContainer(expression));
+            return this.finalize(node, new JSXNode.JSXExpressionContainer(expression2));
           };
           JSXParser2.prototype.parseJSXAttributeValue = function() {
             return this.matchJSX("{") ? this.parseJSXExpressionAttribute() : this.matchJSX("<") ? this.parseJSXElement() : this.parseJSXStringLiteralAttribute();
@@ -13113,16 +13268,16 @@ var require_esprima2 = __commonJS((exports, module) => {
           JSXParser2.prototype.parseJSXExpressionContainer = function() {
             var node = this.createJSXNode();
             this.expectJSX("{");
-            var expression;
+            var expression2;
             if (this.matchJSX("}")) {
-              expression = this.parseJSXEmptyExpression();
+              expression2 = this.parseJSXEmptyExpression();
               this.expectJSX("}");
             } else {
               this.finishJSX();
-              expression = this.parseAssignmentExpression();
+              expression2 = this.parseAssignmentExpression();
               this.reenterJSX();
             }
-            return this.finalize(node, new JSXNode.JSXExpressionContainer(expression));
+            return this.finalize(node, new JSXNode.JSXExpressionContainer(expression2));
           };
           JSXParser2.prototype.parseJSXChildren = function() {
             var children = [];
@@ -13268,9 +13423,9 @@ var require_esprima2 = __commonJS((exports, module) => {
         }();
         exports2.JSXEmptyExpression = JSXEmptyExpression;
         var JSXExpressionContainer = function() {
-          function JSXExpressionContainer2(expression) {
+          function JSXExpressionContainer2(expression2) {
             this.type = jsx_syntax_1.JSXSyntax.JSXExpressionContainer;
-            this.expression = expression;
+            this.expression = expression2;
           }
           return JSXExpressionContainer2;
         }();
@@ -13374,13 +13529,13 @@ var require_esprima2 = __commonJS((exports, module) => {
         }();
         exports2.ArrayPattern = ArrayPattern;
         var ArrowFunctionExpression = function() {
-          function ArrowFunctionExpression2(params, body, expression) {
+          function ArrowFunctionExpression2(params, body, expression2) {
             this.type = syntax_1.Syntax.ArrowFunctionExpression;
             this.id = null;
             this.params = params;
             this.body = body;
             this.generator = false;
-            this.expression = expression;
+            this.expression = expression2;
             this.async = false;
           }
           return ArrowFunctionExpression2;
@@ -13406,13 +13561,13 @@ var require_esprima2 = __commonJS((exports, module) => {
         }();
         exports2.AssignmentPattern = AssignmentPattern;
         var AsyncArrowFunctionExpression = function() {
-          function AsyncArrowFunctionExpression2(params, body, expression) {
+          function AsyncArrowFunctionExpression2(params, body, expression2) {
             this.type = syntax_1.Syntax.ArrowFunctionExpression;
             this.id = null;
             this.params = params;
             this.body = body;
             this.generator = false;
-            this.expression = expression;
+            this.expression = expression2;
             this.async = true;
           }
           return AsyncArrowFunctionExpression2;
@@ -13561,9 +13716,9 @@ var require_esprima2 = __commonJS((exports, module) => {
         }();
         exports2.DebuggerStatement = DebuggerStatement;
         var Directive = function() {
-          function Directive2(expression, directive) {
+          function Directive2(expression2, directive) {
             this.type = syntax_1.Syntax.ExpressionStatement;
-            this.expression = expression;
+            this.expression = expression2;
             this.directive = directive;
           }
           return Directive2;
@@ -13621,9 +13776,9 @@ var require_esprima2 = __commonJS((exports, module) => {
         }();
         exports2.ExportSpecifier = ExportSpecifier;
         var ExpressionStatement = function() {
-          function ExpressionStatement2(expression) {
+          function ExpressionStatement2(expression2) {
             this.type = syntax_1.Syntax.ExpressionStatement;
-            this.expression = expression;
+            this.expression = expression2;
           }
           return ExpressionStatement2;
         }();
@@ -15357,14 +15512,14 @@ var require_esprima2 = __commonJS((exports, module) => {
                   } else {
                     body = this.isolateCoverGrammar(this.parseAssignmentExpression);
                   }
-                  var expression = body.type !== syntax_1.Syntax.BlockStatement;
+                  var expression2 = body.type !== syntax_1.Syntax.BlockStatement;
                   if (this.context.strict && list.firstRestricted) {
                     this.throwUnexpectedToken(list.firstRestricted, list.message);
                   }
                   if (this.context.strict && list.stricted) {
                     this.tolerateUnexpectedToken(list.stricted, list.message);
                   }
-                  expr = isAsync ? this.finalize(node, new Node.AsyncArrowFunctionExpression(list.params, body, expression)) : this.finalize(node, new Node.ArrowFunctionExpression(list.params, body, expression));
+                  expr = isAsync ? this.finalize(node, new Node.AsyncArrowFunctionExpression(list.params, body, expression2)) : this.finalize(node, new Node.ArrowFunctionExpression(list.params, body, expression2));
                   this.context.strict = previousStrict;
                   this.context.allowStrictDirective = previousAllowStrictDirective;
                   this.context.allowYield = previousAllowYield;
@@ -19914,7 +20069,7 @@ var require_fast_path = __commonJS((exports) => {
     }
     return s[0];
   };
-  FPp.call = function call(callback) {
+  FPp.call = function call2(callback) {
     var s = this.stack;
     var origLen = s.length;
     var value = s[origLen - 1];
@@ -22157,8 +22312,8 @@ while`);
         return (0, lines_1.concat)([path.call(print, "left"), ".", path.call(print, "right")]);
       case "TSAsExpression":
       case "TSSatisfiesExpression": {
-        var expression = path.call(print, "expression");
-        parts.push(expression, n.type === "TSSatisfiesExpression" ? " satisfies " : " as ", path.call(print, "typeAnnotation"));
+        var expression2 = path.call(print, "expression");
+        parts.push(expression2, n.type === "TSSatisfiesExpression" ? " satisfies " : " as ", path.call(print, "typeAnnotation"));
         return (0, lines_1.concat)(parts);
       }
       case "TSTypeCastExpression":
@@ -23793,9 +23948,9 @@ var require_lib = __commonJS((exports) => {
     UnsupportedDefaultExport: "Only expressions, functions or classes are allowed as the `default` export.",
     UnsupportedImport: "`import` can only be used in `import()` or `import.meta`.",
     UnsupportedMetaProperty: ({
-      target,
+      target: target2,
       onlyValidPropertyName
-    }) => `The only valid meta property for ${target} is ${target}.${onlyValidPropertyName}.`,
+    }) => `The only valid meta property for ${target2} is ${target2}.${onlyValidPropertyName}.`,
     UnsupportedParameterDecorator: "Decorators cannot be used to decorate parameters.",
     UnsupportedPropertyDecorator: "Decorators cannot be used to decorate object literal properties.",
     UnsupportedSuper: "'super' can only be used with function calls (i.e. super()) or in property accesses (i.e. super.prop or super[prop]).",
@@ -24083,15 +24238,15 @@ var require_lib = __commonJS((exports) => {
       return this.finishNodeAt(chain, "ChainExpression", endLoc);
     }
     directiveToStmt(directive) {
-      const expression = directive.value;
+      const expression2 = directive.value;
       delete directive.value;
-      this.castNodeTo(expression, "Literal");
-      expression.raw = expression.extra.raw;
-      expression.value = expression.extra.expressionValue;
+      this.castNodeTo(expression2, "Literal");
+      expression2.raw = expression2.extra.raw;
+      expression2.value = expression2.extra.expressionValue;
       const stmt = this.castNodeTo(directive, "ExpressionStatement");
-      stmt.expression = expression;
-      stmt.directive = expression.extra.rawValue;
-      delete expression.extra;
+      stmt.expression = expression2;
+      stmt.directive = expression2.extra.rawValue;
+      delete expression2.extra;
       return stmt;
     }
     fillOptionalPropertiesForTSESLint(node) {}
@@ -27042,14 +27197,14 @@ var require_lib = __commonJS((exports) => {
         this.resetEndLocation(decl.id);
       }
     }
-    parseAsyncArrowFromCallExpression(node, call) {
+    parseAsyncArrowFromCallExpression(node, call2) {
       if (this.match(14)) {
         const oldNoAnonFunctionType = this.state.noAnonFunctionType;
         this.state.noAnonFunctionType = true;
         node.returnType = this.flowParseTypeAnnotation();
         this.state.noAnonFunctionType = oldNoAnonFunctionType;
       }
-      return super.parseAsyncArrowFromCallExpression(node, call);
+      return super.parseAsyncArrowFromCallExpression(node, call2);
     }
     shouldParseAsyncArrow() {
       return this.match(14) || super.shouldParseAsyncArrow();
@@ -28203,8 +28358,8 @@ var require_lib = __commonJS((exports) => {
       if (this.match(8)) {
         node.expression = this.jsxParseEmptyExpression();
       } else {
-        const expression = this.parseExpression();
-        node.expression = expression;
+        const expression2 = this.parseExpression();
+        node.expression = expression2;
       }
       this.setContext(previousContext);
       this.state.canStartJSXElement = true;
@@ -31140,53 +31295,53 @@ var require_lib = __commonJS((exports) => {
       }
       return false;
     }
-    isOptionalMemberExpression(expression) {
-      return expression.type === "OptionalMemberExpression";
+    isOptionalMemberExpression(expression2) {
+      return expression2.type === "OptionalMemberExpression";
     }
-    checkLVal(expression, ancestor, binding = 64, checkClashes = false, strictModeChanged = false, hasParenthesizedAncestor = false, disallowCallExpression = false) {
+    checkLVal(expression2, ancestor, binding = 64, checkClashes = false, strictModeChanged = false, hasParenthesizedAncestor = false, disallowCallExpression = false) {
       var _expression$extra;
-      const type = expression.type;
-      if (this.isObjectMethod(expression))
+      const type = expression2.type;
+      if (this.isObjectMethod(expression2))
         return;
-      const isOptionalMemberExpression = this.isOptionalMemberExpression(expression);
+      const isOptionalMemberExpression = this.isOptionalMemberExpression(expression2);
       if (isOptionalMemberExpression || type === "MemberExpression") {
         if (isOptionalMemberExpression) {
-          this.expectPlugin("optionalChainingAssign", expression.loc.start);
+          this.expectPlugin("optionalChainingAssign", expression2.loc.start);
           if (ancestor.type !== "AssignmentExpression") {
-            this.raise(Errors.InvalidLhsOptionalChaining, expression, {
+            this.raise(Errors.InvalidLhsOptionalChaining, expression2, {
               ancestor
             });
           }
         }
         if (binding !== 64) {
-          this.raise(Errors.InvalidPropertyBindingPattern, expression);
+          this.raise(Errors.InvalidPropertyBindingPattern, expression2);
         }
         return;
       }
       if (type === "Identifier") {
-        this.checkIdentifier(expression, binding, strictModeChanged);
+        this.checkIdentifier(expression2, binding, strictModeChanged);
         const {
           name
-        } = expression;
+        } = expression2;
         if (checkClashes) {
           if (checkClashes.has(name)) {
-            this.raise(Errors.ParamDupe, expression);
+            this.raise(Errors.ParamDupe, expression2);
           } else {
             checkClashes.add(name);
           }
         }
         return;
       } else if (type === "VoidPattern" && ancestor.type === "CatchClause") {
-        this.raise(Errors.VoidPatternCatchClauseParam, expression);
+        this.raise(Errors.VoidPatternCatchClauseParam, expression2);
       }
-      const unwrappedExpression = unwrapParenthesizedExpression(expression);
+      const unwrappedExpression = unwrapParenthesizedExpression(expression2);
       disallowCallExpression || (disallowCallExpression = unwrappedExpression.type === "CallExpression" && (unwrappedExpression.callee.type === "Import" || unwrappedExpression.callee.type === "Super"));
-      const validity = this.isValidLVal(type, disallowCallExpression, !(hasParenthesizedAncestor || (_expression$extra = expression.extra) != null && _expression$extra.parenthesized) && ancestor.type === "AssignmentExpression", binding);
+      const validity = this.isValidLVal(type, disallowCallExpression, !(hasParenthesizedAncestor || (_expression$extra = expression2.extra) != null && _expression$extra.parenthesized) && ancestor.type === "AssignmentExpression", binding);
       if (validity === true)
         return;
       if (validity === false) {
         const ParseErrorClass = binding === 64 ? Errors.InvalidLhs : Errors.InvalidLhsBinding;
-        this.raise(ParseErrorClass, expression, {
+        this.raise(ParseErrorClass, expression2, {
           ancestor
         });
         return;
@@ -31201,7 +31356,7 @@ var require_lib = __commonJS((exports) => {
       const nextAncestor = type === "ArrayPattern" || type === "ObjectPattern" ? {
         type
       } : ancestor;
-      const val = expression[key];
+      const val = expression2[key];
       if (Array.isArray(val)) {
         for (const child of val) {
           if (child) {
@@ -33459,11 +33614,11 @@ var require_lib = __commonJS((exports) => {
         this.resetEndLocation(decl.id);
       }
     }
-    parseAsyncArrowFromCallExpression(node, call) {
+    parseAsyncArrowFromCallExpression(node, call2) {
       if (this.match(14)) {
         node.returnType = this.tsParseTypeAnnotation();
       }
-      return super.parseAsyncArrowFromCallExpression(node, call);
+      return super.parseAsyncArrowFromCallExpression(node, call2);
     }
     parseMaybeAssign(refExpressionErrors, afterLeftParse) {
       var _jsx, _jsx2, _typeCast, _jsx3, _typeCast2;
@@ -33654,9 +33809,9 @@ var require_lib = __commonJS((exports) => {
       if (this.match(47) || this.match(51)) {
         const typeArguments = this.tsParseTypeArgumentsInExpression();
         if (this.match(10)) {
-          const call = super.parseMaybeDecoratorArguments(expr, startLoc);
-          call.typeParameters = typeArguments;
-          return call;
+          const call2 = super.parseMaybeDecoratorArguments(expr, startLoc);
+          call2.typeParameters = typeArguments;
+          return call2;
         }
         this.unexpected(null, 10);
       }
@@ -34046,31 +34201,31 @@ var require_lib = __commonJS((exports) => {
       return this.chStartsBindingIdentifier(nextCh, next) || nextCh === 34 || nextCh === 39;
     }
   };
-  function isPossiblyLiteralEnum(expression) {
-    if (expression.type !== "MemberExpression")
+  function isPossiblyLiteralEnum(expression2) {
+    if (expression2.type !== "MemberExpression")
       return false;
     const {
       computed,
       property
-    } = expression;
+    } = expression2;
     if (computed && property.type !== "StringLiteral" && (property.type !== "TemplateLiteral" || property.expressions.length > 0)) {
       return false;
     }
-    return isUncomputedMemberExpressionChain(expression.object);
+    return isUncomputedMemberExpressionChain(expression2.object);
   }
-  function isValidAmbientConstInitializer(expression, estree2) {
+  function isValidAmbientConstInitializer(expression2, estree2) {
     var _expression$extra;
     const {
       type
-    } = expression;
-    if ((_expression$extra = expression.extra) != null && _expression$extra.parenthesized) {
+    } = expression2;
+    if ((_expression$extra = expression2.extra) != null && _expression$extra.parenthesized) {
       return false;
     }
     if (estree2) {
       if (type === "Literal") {
         const {
           value
-        } = expression;
+        } = expression2;
         if (typeof value === "string" || typeof value === "boolean") {
           return true;
         }
@@ -34080,42 +34235,42 @@ var require_lib = __commonJS((exports) => {
         return true;
       }
     }
-    if (isNumber(expression, estree2) || isNegativeNumber(expression, estree2)) {
+    if (isNumber(expression2, estree2) || isNegativeNumber(expression2, estree2)) {
       return true;
     }
-    if (type === "TemplateLiteral" && expression.expressions.length === 0) {
+    if (type === "TemplateLiteral" && expression2.expressions.length === 0) {
       return true;
     }
-    if (isPossiblyLiteralEnum(expression)) {
+    if (isPossiblyLiteralEnum(expression2)) {
       return true;
     }
     return false;
   }
-  function isNumber(expression, estree2) {
+  function isNumber(expression2, estree2) {
     if (estree2) {
-      return expression.type === "Literal" && (typeof expression.value === "number" || ("bigint" in expression));
+      return expression2.type === "Literal" && (typeof expression2.value === "number" || ("bigint" in expression2));
     }
-    return expression.type === "NumericLiteral" || expression.type === "BigIntLiteral";
+    return expression2.type === "NumericLiteral" || expression2.type === "BigIntLiteral";
   }
-  function isNegativeNumber(expression, estree2) {
-    if (expression.type === "UnaryExpression") {
+  function isNegativeNumber(expression2, estree2) {
+    if (expression2.type === "UnaryExpression") {
       const {
         operator,
         argument
-      } = expression;
+      } = expression2;
       if (operator === "-" && isNumber(argument, estree2)) {
         return true;
       }
     }
     return false;
   }
-  function isUncomputedMemberExpressionChain(expression) {
-    if (expression.type === "Identifier")
+  function isUncomputedMemberExpressionChain(expression2) {
+    if (expression2.type === "Identifier")
       return true;
-    if (expression.type !== "MemberExpression" || expression.computed) {
+    if (expression2.type !== "MemberExpression" || expression2.computed) {
       return false;
     }
-    return isUncomputedMemberExpressionChain(expression.object);
+    return isUncomputedMemberExpressionChain(expression2.object);
   }
   var PlaceholderErrors = ParseErrorEnum`placeholders`({
     ClassNameIsRequired: "A class name is required.",
@@ -34977,16 +35132,16 @@ var require_lib = __commonJS((exports) => {
     shouldParseAsyncArrow() {
       return this.match(19) && !this.canInsertSemicolon();
     }
-    parseAsyncArrowFromCallExpression(node, call) {
+    parseAsyncArrowFromCallExpression(node, call2) {
       var _call$extra;
-      this.resetPreviousNodeTrailingComments(call);
+      this.resetPreviousNodeTrailingComments(call2);
       this.expect(19);
-      this.parseArrowExpression(node, call.arguments, true, (_call$extra = call.extra) == null ? undefined : _call$extra.trailingCommaLoc);
-      if (call.innerComments) {
-        setInnerComments(node, call.innerComments);
+      this.parseArrowExpression(node, call2.arguments, true, (_call$extra = call2.extra) == null ? undefined : _call$extra.trailingCommaLoc);
+      if (call2.innerComments) {
+        setInnerComments(node, call2.innerComments);
       }
-      if (call.callee.trailingComments) {
-        setInnerComments(node, call.callee.trailingComments);
+      if (call2.callee.trailingComments) {
+        setInnerComments(node, call2.callee.trailingComments);
       }
       return node;
     }
@@ -35414,15 +35569,15 @@ var require_lib = __commonJS((exports) => {
       }
       return this.wrapParenthesis(startLoc, val);
     }
-    wrapParenthesis(startLoc, expression) {
+    wrapParenthesis(startLoc, expression2) {
       if (!(this.optionFlags & 1024)) {
-        this.addExtra(expression, "parenthesized", true);
-        this.addExtra(expression, "parenStart", startLoc.index);
-        this.takeSurroundingComments(expression, startLoc.index, this.state.lastTokEndLoc.index);
-        return expression;
+        this.addExtra(expression2, "parenthesized", true);
+        this.addExtra(expression2, "parenStart", startLoc.index);
+        this.takeSurroundingComments(expression2, startLoc.index, this.state.lastTokEndLoc.index);
+        return expression2;
       }
       const parenExpression = this.startNodeAt(startLoc);
-      parenExpression.expression = expression;
+      parenExpression.expression = expression2;
       return this.finishNode(parenExpression, "ParenthesizedExpression");
     }
     shouldParseArrow(params) {
@@ -36070,10 +36225,10 @@ var require_lib = __commonJS((exports) => {
         return this.finishNode(bodyNode, "PipelineTopicExpression");
       }
     }
-    isSimpleReference(expression) {
-      switch (expression.type) {
+    isSimpleReference(expression2) {
+      switch (expression2.type) {
         case "MemberExpression":
-          return !expression.computed && this.isSimpleReference(expression.object);
+          return !expression2.computed && this.isSimpleReference(expression2.object);
         case "Identifier":
           return true;
         default:
@@ -86844,17 +86999,17 @@ var require_template = __commonJS((exports, module) => {
     function statement() {
       return statements.apply(null, arguments)[0];
     }
-    function expression(template) {
+    function expression2(template) {
       template = Array.from(template);
       if (template.length > 0) {
         template[0] = "(" + template[0];
         template[template.length - 1] += ")";
       }
-      const expression2 = statement.apply(null, [template].concat(Array.from(arguments).slice(1))).expression;
-      if (expression2.extra) {
-        expression2.extra.parenthesized = false;
+      const expression3 = statement.apply(null, [template].concat(Array.from(arguments).slice(1))).expression;
+      if (expression3.extra) {
+        expression3.extra.parenthesized = false;
       }
-      return expression2;
+      return expression3;
     }
     function asyncExpression(template) {
       template = Array.from(template);
@@ -86862,13 +87017,13 @@ var require_template = __commonJS((exports, module) => {
         template[0] = "async () => (" + template[0];
         template[template.length - 1] += ")";
       }
-      const expression2 = statement.apply(null, [template].concat(Array.from(arguments).slice(1))).expression.body;
-      if (expression2.extra) {
-        expression2.extra.parenthesized = false;
+      const expression3 = statement.apply(null, [template].concat(Array.from(arguments).slice(1))).expression.body;
+      if (expression3.extra) {
+        expression3.extra.parenthesized = false;
       }
-      return expression2;
+      return expression3;
     }
-    return { statements, statement, expression, asyncExpression };
+    return { statements, statement, expression: expression2, asyncExpression };
   };
 });
 
@@ -92665,15 +92820,161 @@ function iconColourHex(token) {
     return BRAND.green;
   return ICON_COLOURS[token] ?? BRAND.green;
 }
+// ../shared/dist/data-records.js
+var DATA_COLLECTION_RE = /^[A-Za-z][A-Za-z0-9_]{0,63}$/;
+var DATA_RECORD_ID_RE = /^[A-Za-z0-9_-]{1,64}$/;
+var DATA_LIMITS = {
+  bodyBytes: 262144,
+  responseBytes: 1048576,
+  maxPage: 1000,
+  maxPerPage: 100,
+  expressionChars: 1024,
+  filterMaxDepth: 16,
+  filterMaxComparisons: 64,
+  accessMaxApps: 50,
+  schemaPerPage: 200,
+  schemaMaxPages: 10,
+  sortMaxItems: 8,
+  actAsTokenSeconds: 900,
+  actAsCacheMaxSeconds: 600,
+  identityCandidatesPerPage: 20
+};
+var DATA_IDENTITY_KINDS = ["user", "visitor", "superuser"];
+var DATA_ACTING_AS = [...DATA_IDENTITY_KINDS, "unset"];
+var DATA_RECORD_ERROR_STATUS = {
+  PB_VERSION_UNSUPPORTED: 503,
+  PB_RECORD_NOT_FOUND: 404,
+  PB_VALIDATION: 400,
+  PB_CONFLICT: 409,
+  PB_CONFLICT_UNSUPPORTED: 400,
+  DATA_COLLECTION_FORBIDDEN: 403,
+  DATA_FIELD_UNSUPPORTED: 400,
+  DATA_RATE_LIMITED: 429,
+  DATA_RESPONSE_TOO_LARGE: 413,
+  OAUTH_DATA_ACCESS_REQUIRED: 403,
+  DATA_TOOLS_NOT_ENABLED: 403,
+  PB_AUTH_FAILED: 503,
+  PB_NOT_RUNNING: 503,
+  PB_BRIDGE_UNAVAILABLE: 502,
+  NOT_POCKETBASE: 400,
+  DATA_QUERY_INVALID: 400,
+  DATA_SCHEMA_TOO_LARGE: 413,
+  DATA_QUERY_TIMEOUT: 504,
+  DATA_WRITE_OUTCOME_UNKNOWN: 502,
+  PB_RULE_DENIED: 403,
+  DATA_ACT_AS_REQUIRED: 403,
+  DATA_ACT_AS_UNAVAILABLE: 403
+};
+
+// ../shared/dist/data-filter.js
+class ExpressionError extends Error {
+  reason;
+  at;
+  constructor(reason, at) {
+    super(reason);
+    this.reason = reason;
+    this.at = at;
+  }
+}
+var RESERVED = new Set(["true", "false", "null"]);
+class SchemaIndex {
+  visible = new Set;
+  hidden = new Set;
+  lowered = new Set;
+  constructor(fields) {
+    for (const f of fields) {
+      (f.hidden ? this.hidden : this.visible).add(f.name);
+      this.lowered.add(f.name.toLowerCase());
+    }
+  }
+  checkField(name, at) {
+    if (RESERVED.has(name.toLowerCase()))
+      throw new ExpressionError("reserved_word", at);
+    if (this.visible.has(name))
+      return;
+    throw new ExpressionError(this.hidden.has(name) ? "hidden_field" : "unknown_field", at);
+  }
+  checkKeywordLiteral(word, at) {
+    if (this.lowered.has(word))
+      throw new ExpressionError("shadowed_literal", at);
+  }
+}
+// ../shared/dist/disposable-email-domains.js
+var DISPOSABLE_DOMAINS = new Set([
+  "mailinator.com",
+  "mailinator.net",
+  "mailinator2.com",
+  "binkmail.com",
+  "bobmail.info",
+  "chammy.info",
+  "devnullmail.com",
+  "letthemeatspam.com",
+  "mailnesia.com",
+  "mailtothis.com",
+  "notmailinator.com",
+  "reallymymail.com",
+  "safetymail.info",
+  "thisisnotmyrealemail.com",
+  "tradermail.info",
+  "veryrealemail.com",
+  "zippymail.info",
+  "guerrillamail.com",
+  "guerrillamail.net",
+  "guerrillamail.org",
+  "guerrillamail.biz",
+  "guerrillamail.de",
+  "guerrillamailblock.com",
+  "sharklasers.com",
+  "grr.la",
+  "spam4.me",
+  "10minutemail.com",
+  "10minutemail.net",
+  "20minutemail.com",
+  "30minutemail.com",
+  "tempmail.com",
+  "temp-mail.org",
+  "temp-mail.io",
+  "tempmailaddress.com",
+  "tempmailo.com",
+  "tempinbox.com",
+  "throwawaymail.com",
+  "yopmail.com",
+  "yopmail.fr",
+  "yopmail.net",
+  "maildrop.cc",
+  "trashmail.com",
+  "trashmail.de",
+  "trashmail.net",
+  "trash-mail.com",
+  "dispostable.com",
+  "fakeinbox.com",
+  "getnada.com",
+  "mintemail.com",
+  "mohmal.com",
+  "moakt.cc",
+  "formtests.info",
+  "mailcatch.com",
+  "mailnull.com",
+  "spambog.com",
+  "spambox.us",
+  "spamgourmet.com",
+  "emailondeck.com",
+  "fakemailgenerator.com",
+  "jetable.org",
+  "mytrashmail.com",
+  "owlpic.com",
+  "rcpt.at",
+  "trbvm.com"
+]);
 // ../shared/dist/legal.js
 var LEGAL_DOCUMENT_VERSIONS = {
-  terms: "1.0.2",
+  terms: "1.0.3",
   aup: "1.0.1",
-  privacy: "1.0.2",
-  cookies: "1.0.3",
-  dpa: "1.0",
-  subprocessors: "1.0.2",
-  dataPortability: "1.0"
+  privacy: "1.0.4",
+  cookies: "1.0.4",
+  dpa: "1.1",
+  subprocessors: "1.2",
+  dataPortability: "1.0.4"
 };
 var CURRENT_TERMS_VERSION = LEGAL_DOCUMENT_VERSIONS.terms;
 // ../shared/dist/legal-changes.js
@@ -92688,6 +92989,12 @@ var UPLOAD_SESSION_TTL_MS = 6 * 60 * 60 * 1000;
 var UPLOAD_SESSION_MAX_LIFETIME_MS = 24 * 60 * 60 * 1000;
 // ../shared/dist/logs.js
 var MAX_LOG_SEARCH_LENGTH = 256;
+// ../shared/dist/oauth-scopes.js
+var DATA_ACCESS_SUFFIX = "records in your apps' databases, including data your app's users entered. Every record the assistant reads is sent to it and may be processed by its provider under the provider's terms. Revoke in Settings → Connections; copies already sent are not recalled.";
+var DATA_ACCESS_MODE_LABELS = {
+  readwrite: `Read, create, change and delete ${DATA_ACCESS_SUFFIX}`,
+  read: `Read ${DATA_ACCESS_SUFFIX}`
+};
 // ../shared/dist/platform-env.js
 var PERCHER_INJECTED_ENV_KEYS = new Set([
   "NODE_ENV",
@@ -92713,6 +93020,23 @@ var PROXY_LOWERCASE_ALIASES = new Set([
 // ../shared/dist/runtime.js
 var DEFAULT_NODE_VERSION_MAJOR = "24";
 var DEFAULT_NODE_VERSION_LABEL = `${DEFAULT_NODE_VERSION_MAJOR} LTS`;
+// ../shared/dist/signup-day.js
+var stockholmDate = new Intl.DateTimeFormat("sv-SE", {
+  timeZone: "Europe/Stockholm",
+  year: "numeric",
+  month: "2-digit",
+  day: "2-digit"
+});
+var stockholmClock = new Intl.DateTimeFormat("en-GB", {
+  timeZone: "Europe/Stockholm",
+  year: "numeric",
+  month: "2-digit",
+  day: "2-digit",
+  hour: "2-digit",
+  minute: "2-digit",
+  second: "2-digit",
+  hourCycle: "h23"
+});
 // ../shared/dist/switches.js
 var ONE = ["1"];
 var TRUE = ["true"];
@@ -92796,6 +93120,7 @@ var SWITCHES = [
   },
   bool("PERCHER_ALLOW_NO_CAPTCHA", ["dashboard"], "allow production without Turnstile", ONE),
   bool("PERCHER_ALLOW_UNVERIFIED_SIGNUP", ["dashboard"], "allow production without Resend", ONE),
+  bool("PERCHER_DASHBOARD_SECRET_BUILD", ["dashboard"], "allow an ephemeral BetterAuth key during `next build` only, never at runtime", ONE),
   bool("PERCHER_ALLOW_NO_ALERTING", ["api"], "boot without an alert channel", ONE),
   {
     kind: "presence",
@@ -106437,7 +106762,7 @@ var ENV_NAME_SHAPE = "UPPER_SNAKE_CASE, at most 256 characters";
 var buildSchema = exports_external.object({
   command: exports_external.string().optional(),
   output: exports_external.string().refine((v) => !v.startsWith("/"), "must be a relative path (no leading slash)").optional(),
-  pass_env: exports_external.array(exports_external.string().regex(ENV_NAME_RE2, `must be a valid env var name (${ENV_NAME_SHAPE})`).refine((name) => !name.startsWith("BUILDKIT_"), "BUILDKIT_* names are reserved by Percher and cannot be passed to the build")).max(50, "at most 50 build env vars can be exposed").optional()
+  pass_env: exports_external.array(exports_external.string().regex(ENV_NAME_RE2, `must be a valid env var name (${ENV_NAME_SHAPE})`).refine((name) => !name.startsWith("BUILDKIT_") && name !== "PERCHER_BUILD_SECRET_DIGEST", "BUILDKIT_* and PERCHER_BUILD_SECRET_DIGEST are reserved by Percher and cannot be passed to the build")).max(50, "at most 50 build env vars can be exposed").optional()
 }).strict();
 var webSchema = exports_external.object({
   port: exports_external.number().int().min(1024).max(65535),
@@ -107138,7 +107463,7 @@ var LEGACY_AUDIT_REQUIRED_CONJUNCTS = [
   "volumes_attributed",
   "scans_complete",
   "runtime_evidence_complete",
-  "clabbe_attestation_complete",
+  "security_attestation_complete",
   "launch_gate_ready"
 ];
 function legacyAuditIsGreen(result) {
@@ -107774,20 +108099,32 @@ function manifestStarter({ name, themeColorHex }) {
     theme_color: themeColorHex
   }, null, 2);
 }
-function serviceWorkerStarter() {
-  return `// sw.js — minimal offline shell. Drop in at your app root and serve from /sw.js.
-const CACHE = "app-shell-v1";
-const SHELL = ["/"];
+function serviceWorkerStarter(assets = []) {
+  if (assets.some((path) => !path.startsWith("/") || path.startsWith("//") || path.includes("\\"))) {
+    throw new Error("Offline assets must be same-origin absolute paths");
+  }
+  return `// sw.js — public offline shell. Serve from /sw.js.
+// Add public assets, e.g. ["/offline.html", "/app.js", "/app.css"]. Never add private pages or API data.
+// Include "/" only if the page is public and identical for signed-in and anonymous visitors.
+// Bump CACHE whenever the asset list or its content changes. Test an offline reload.
+const CACHE = "percher-public-shell-v1";
+const SHELL = ${JSON.stringify(assets)};
 
 self.addEventListener("install", (event) => {
-  event.waitUntil(caches.open(CACHE).then((cache) => cache.addAll(SHELL)));
+  event.waitUntil(caches.open(CACHE).then((cache) => Promise.all(SHELL.map(async (path) => {
+    const response = await fetch(path, { credentials: "omit", redirect: "error" });
+    if (!response.ok || /private|no-store/i.test(response.headers.get("cache-control") || "")) {
+      throw new Error("Offline asset is unavailable or private: " + path);
+    }
+    await cache.put(path, response);
+  }))));
   self.skipWaiting();
 });
 
 self.addEventListener("activate", (event) => {
   event.waitUntil(
     caches.keys().then((keys) =>
-      Promise.all(keys.filter((k) => k !== CACHE).map((k) => caches.delete(k))),
+      Promise.all(keys.filter((k) => k.startsWith("percher-public-shell-") && k !== CACHE).map((k) => caches.delete(k))),
     ),
   );
   self.clients.claim();
@@ -107795,8 +108132,10 @@ self.addEventListener("activate", (event) => {
 
 self.addEventListener("fetch", (event) => {
   if (event.request.method !== "GET") return;
+  const url = new URL(event.request.url);
+  if (url.origin !== self.location.origin || !SHELL.includes(url.pathname + url.search)) return;
   event.respondWith(
-    caches.match(event.request).then((cached) => cached || fetch(event.request)),
+    caches.open(CACHE).then((cache) => cache.match(event.request)).then((cached) => cached || fetch(event.request)),
   );
 });`;
 }
@@ -107965,17 +108304,17 @@ async function claim(ctx, input = {}) {
   };
 }
 // ../core/dist/commands/create.js
-import { join as join8, resolve as resolve5 } from "node:path";
+import { join as join9, resolve as resolve5 } from "node:path";
 
 // ../core/dist/templates.js
-import { existsSync as existsSync5, mkdirSync as mkdirSync5, readdirSync, readFileSync as readFileSync5, statSync, writeFileSync as writeFileSync5 } from "node:fs";
-import { basename as basename2, join as join7, normalize, relative as relative2, resolve as resolve4 } from "node:path";
-var __dirname = "C:\\dev\\Percher\\packages\\core\\dist";
+import { existsSync as existsSync5, mkdirSync as mkdirSync6, readdirSync, readFileSync as readFileSync6, statSync, writeFileSync as writeFileSync6 } from "node:fs";
+import { basename as basename2, join as join8, normalize, relative as relative2, resolve as resolve4 } from "node:path";
+var __dirname = "C:\\dev\\Percher-npm-final-release-20261018\\packages\\core\\dist";
 var TEMPLATES_DIR = resolve4(import.meta.dirname ?? __dirname, "../templates");
 var PLACEHOLDER = "__APP_NAME__";
 function listTemplates() {
   return readdirSync(TEMPLATES_DIR).filter((name) => {
-    const full = join7(TEMPLATES_DIR, name);
+    const full = join8(TEMPLATES_DIR, name);
     return statSync(full).isDirectory();
   });
 }
@@ -107992,13 +108331,13 @@ function scaffoldTemplate(input) {
       throw new Error(`Target directory "${absTarget}" is not empty. Use --force to overwrite.`);
     }
   }
-  const srcDir = join7(TEMPLATES_DIR, template);
+  const srcDir = join8(TEMPLATES_DIR, template);
   const files = [];
   function copyDir(src, dest) {
-    mkdirSync5(dest, { recursive: true });
+    mkdirSync6(dest, { recursive: true });
     for (const entry of readdirSync(src)) {
-      const srcPath = join7(src, entry);
-      const destPath = join7(dest, entry);
+      const srcPath = join8(src, entry);
+      const destPath = join8(dest, entry);
       const rel = relative2(absTarget, normalize(destPath));
       if (rel.startsWith("..") || resolve4(destPath) === resolve4(absTarget, "..", basename2(absTarget))) {
         throw new Error(`Template contains path traversal: ${entry}`);
@@ -108009,11 +108348,11 @@ function scaffoldTemplate(input) {
         if (existsSync5(destPath) && !force) {
           continue;
         }
-        let content = readFileSync5(srcPath, "utf-8");
+        let content = readFileSync6(srcPath, "utf-8");
         content = content.replaceAll(PLACEHOLDER, appName);
         content = content.replace(/\r\n/g, `
 `);
-        writeFileSync5(destPath, content, "utf-8");
+        writeFileSync6(destPath, content, "utf-8");
         files.push(relative2(absTarget, destPath).replace(/\\/g, "/"));
       }
     }
@@ -108046,7 +108385,7 @@ async function create(ctx, input) {
       });
     }
   } else {
-    targetDir = join8(ctx.cwd, input.name);
+    targetDir = join9(ctx.cwd, input.name);
   }
   try {
     const result = scaffoldTemplate({
@@ -108101,226 +108440,6 @@ async function dashboard(ctx, input = {}) {
   await ctx.openUrl(url2);
   return url2;
 }
-// ../core/dist/commands/data.js
-var dataInputSchema = exports_external.object({
-  app: exports_external.string().optional(),
-  json: exports_external.boolean().optional()
-});
-async function data(ctx, input = {}) {
-  const name = input.app ?? readPercherTomlAppName(ctx.cwd);
-  if (!name) {
-    throw new PercherCoreError("No app specified and no percher.toml found", {
-      code: "data.no-app",
-      hint: "Pass an app name or run from a directory with percher.toml."
-    });
-  }
-  const status = await ctx.client.data.getStatus(name);
-  const adminLink = await ctx.client.data.getAdminLink(name);
-  let collections = [];
-  let stats = { collections: 0, totalRecords: 0 };
-  let warning = null;
-  try {
-    const cols = await ctx.client.data.getCollections(name);
-    collections = cols.map((c) => ({ name: c.name, type: c.type }));
-    stats = await ctx.client.data.getStats(name);
-  } catch (err) {
-    const code = err.code;
-    if (code === "PB_AUTH_FAILED") {
-      warning = `Could not authenticate with PocketBase — collections + stats unavailable. Try \`percher data reset-superuser ${name}\` to rotate the credentials.`;
-    } else {
-      throw err;
-    }
-  }
-  return {
-    mode: status.mode,
-    status: status.status,
-    version: status.version ?? null,
-    collections,
-    stats,
-    adminUrl: adminLink.adminUrl ?? null,
-    warning
-  };
-}
-// ../core/dist/commands/data-export.js
-import { resolve as resolve6 } from "node:path";
-var dataExportInputSchema = exports_external.object({
-  app: exports_external.string().optional().describe("App name or id. Defaults to the app in percher.toml."),
-  out: exports_external.string().optional().describe("Output file path. Defaults to ./<app>-pb-<timestamp>.tar.gz in the current directory.")
-});
-async function dataExport(ctx, input) {
-  const appName = input.app ?? readPercherTomlAppName(ctx.cwd);
-  if (!appName) {
-    throw new PercherCoreError("No app specified and no percher.toml found", {
-      code: "data-export.no-app",
-      hint: "Pass an app name with --app <name> or run from a directory with percher.toml."
-    });
-  }
-  ctx.status?.(`Exporting ${appName} data...`);
-  const stamp = new Date().toISOString().replace(/[:.]/g, "-").slice(0, 19);
-  const fileName = input.out ?? `${appName}-pb-${stamp}.tar.gz`;
-  const path = resolve6(ctx.cwd, fileName);
-  const res = await ctx.client.apps.streamDataExport(appName);
-  const bytes = await writeGzipResponseToFileAtomic(res, path);
-  return {
-    app: appName,
-    path,
-    bytes,
-    exportedAt: new Date().toISOString()
-  };
-}
-// ../core/dist/commands/data-oauth.js
-var dataOauthInputSchema = exports_external.object({
-  app: exports_external.string().optional(),
-  provider: exports_external.string().default("google"),
-  clientId: exports_external.string().optional(),
-  clientSecret: exports_external.string().optional(),
-  remove: exports_external.boolean().optional(),
-  json: exports_external.boolean().optional()
-});
-async function dataOauth(ctx, input = { provider: "google" }) {
-  const name = input.app ?? readPercherTomlAppName(ctx.cwd);
-  if (!name) {
-    throw new PercherCoreError("No app specified and no percher.toml found", {
-      code: "data.no-app",
-      hint: "Pass an app name or run from a directory with percher.toml."
-    });
-  }
-  const provider = input.provider || "google";
-  if (input.remove) {
-    await ctx.client.data.removeOAuthProvider(name, provider);
-    return { action: "removed", provider };
-  }
-  if (input.clientId && input.clientSecret) {
-    const res = await ctx.client.data.setOAuthProvider(name, {
-      provider,
-      clientId: input.clientId,
-      clientSecret: input.clientSecret
-    });
-    return {
-      action: "set",
-      provider: res.provider,
-      redirectUri: res.redirectUri,
-      note: res.note
-    };
-  }
-  const status = await ctx.client.data.getOAuthStatus(name);
-  return {
-    action: "status",
-    provider,
-    providers: status.providers,
-    redirectUri: status.redirectUri
-  };
-}
-// ../core/dist/commands/delete.js
-var deleteInputSchema = exports_external.object({
-  app: exports_external.string().optional().describe("App name to delete (defaults to percher.toml app name)"),
-  confirm: exports_external.boolean().describe("Must be true to confirm deletion. This is a destructive operation that permanently removes the app, its container, database, domains, env vars, and deploy history.")
-});
-async function deleteApp(ctx, input) {
-  const name = input.app ?? readPercherTomlAppName(ctx.cwd);
-  if (!name) {
-    throw new PercherCoreError("No app specified and no percher.toml found", {
-      code: "env.no-app",
-      hint: "Pass an app name or run from a directory with percher.toml."
-    });
-  }
-  if (!input.confirm) {
-    throw new PercherCoreError(`Deletion requires explicit confirmation. Set confirm: true to delete "${name}" permanently.`, {
-      code: "delete.confirmation-required",
-      hint: `This will permanently delete the app "${name}" and all its data. Pass confirm: true to proceed.`
-    });
-  }
-  await ctx.client.apps.delete(name);
-}
-// ../core/dist/commands/deploy-repo.js
-init_dist();
-
-// ../core/dist/poll-deployment.js
-init_dist();
-class DeployPollLostContactError extends PercherCoreError {
-  deploymentId;
-  constructor(message, deploymentId, appName, options) {
-    super(message, {
-      code: "push.lost-contact",
-      hint: `The deploy may already be live. Check with: percher deploys ${appName}`,
-      cause: options?.cause
-    });
-    this.deploymentId = deploymentId;
-    this.name = "DeployPollLostContactError";
-  }
-}
-function isTransientPollError(err) {
-  if (isTransientNetworkError(err))
-    return true;
-  if (err instanceof PercherApiError)
-    return err.status === 502 || err.status === 503 || err.status === 504;
-  return err instanceof TypeError && /terminated/i.test(err.message);
-}
-async function pollDeployment(opts) {
-  const terminal = opts.terminal ?? ["live", "failed"];
-  const intervalMs = opts.intervalMs ?? 2000;
-  const timeoutMs = opts.timeoutMs ?? TIMEOUTS.clientPublishPoll;
-  const maxRetries = opts.maxRetries ?? Number.POSITIVE_INFINITY;
-  const retryBudgetMs = opts.retryBudgetMs ?? 5 * 60000;
-  let deployment = opts.initial;
-  const startedAt = Date.now();
-  const seenEventIds = new Set;
-  if (opts.onEvent) {
-    await drainNewEvents(opts, deployment.id, seenEventIds);
-  }
-  while (!terminal.includes(deployment.status)) {
-    if (Date.now() - startedAt > timeoutMs) {
-      opts.onTimeout(deployment);
-    }
-    opts.onTick?.(deployment);
-    await new Promise((r) => setTimeout(r, intervalMs));
-    let attempt = 0;
-    let streakStartedAt = 0;
-    let polled = false;
-    while (!polled) {
-      try {
-        deployment = await opts.ctx.client.apps.getDeployment(opts.appId, deployment.id);
-        polled = true;
-      } catch (err) {
-        attempt++;
-        if (!isTransientPollError(err))
-          throw err;
-        if (attempt === 1) {
-          streakStartedAt = Date.now();
-          opts.ctx.status("Lost contact with Percher; retrying while the deploy continues...");
-        }
-        if (Date.now() - startedAt > timeoutMs)
-          opts.onTimeout(deployment);
-        if (attempt >= maxRetries || Date.now() - streakStartedAt >= retryBudgetMs) {
-          const msg = err.message ?? String(err);
-          throw new DeployPollLostContactError(`${msg}
-
-The deploy may already be live — contact with Percher was lost mid-poll. Check with: percher deploys ${opts.appName}`, deployment.id, opts.appName, { cause: err });
-        }
-        const backoff = (opts.backoffMs ?? ((n) => Math.min(1000 * 2 ** (n - 1), 15000)))(attempt);
-        await new Promise((r) => setTimeout(r, backoff));
-      }
-    }
-    if (opts.onEvent) {
-      await drainNewEvents(opts, deployment.id, seenEventIds);
-    }
-  }
-  return deployment;
-}
-async function drainNewEvents(opts, deployId, seenEventIds) {
-  if (!opts.onEvent)
-    return;
-  try {
-    const { events } = await opts.ctx.client.apps.getDeployEvents(opts.appId, deployId);
-    for (const event of events) {
-      if (seenEventIds.has(event.id))
-        continue;
-      seenEventIds.add(event.id);
-      opts.onEvent(event);
-    }
-  } catch {}
-}
-
 // ../core/dist/untrusted.js
 import { relative as relative3 } from "node:path";
 function boundedSeconds(value, maxSeconds = 86400) {
@@ -108459,6 +108578,323 @@ function projectRelative(cwd, abs) {
   return isSafeRelativePath(rel) ? rel : null;
 }
 
+// ../core/dist/commands/data.js
+var dataInputSchema = exports_external.object({
+  app: exports_external.string().optional(),
+  json: exports_external.boolean().optional()
+});
+async function data(ctx, input = {}) {
+  const name = input.app ?? readPercherTomlAppName(ctx.cwd);
+  if (!name) {
+    throw new PercherCoreError("No app specified and no percher.toml found", {
+      code: "data.no-app",
+      hint: "Pass an app name or run from a directory with percher.toml."
+    });
+  }
+  const status = await ctx.client.data.getStatus(name);
+  const adminLink = await ctx.client.data.getAdminLink(name);
+  let collections = [];
+  let stats = { collections: 0, totalRecords: 0 };
+  let warning = null;
+  try {
+    const cols = await ctx.client.data.getCollections(name);
+    collections = cols.map((c) => ({ name: c.name, type: c.type }));
+    stats = await ctx.client.data.getStats(name);
+  } catch (err) {
+    const code = err.code;
+    if (code === "PB_AUTH_FAILED") {
+      const ref = appRef(name) ?? "<app>";
+      const verdict = err.extra?.verdict;
+      warning = verdict === "rejected" ? `Percher has no working PocketBase admin credentials for this app; collections and counts are unavailable. The app owner can issue new ones with \`percher data reset-superuser ${ref}\`.` : `PocketBase authentication failed; collections and counts are unavailable. Retry \`percher data ${ref}\`; if this continues, contact support.`;
+    } else {
+      throw err;
+    }
+  }
+  return {
+    mode: status.mode,
+    status: status.status,
+    version: status.version ?? null,
+    collections,
+    stats,
+    adminUrl: adminLink.adminUrl ?? null,
+    warning
+  };
+}
+// ../core/dist/commands/data-export.js
+import { resolve as resolve6 } from "node:path";
+var dataExportInputSchema = exports_external.object({
+  app: exports_external.string().optional().describe("App name or id. Defaults to the app in percher.toml."),
+  out: exports_external.string().optional().describe("Output file path. Defaults to ./<app>-pb-<timestamp>.tar.gz in the current directory.")
+});
+async function dataExport(ctx, input) {
+  const appName = input.app ?? readPercherTomlAppName(ctx.cwd);
+  if (!appName) {
+    throw new PercherCoreError("No app specified and no percher.toml found", {
+      code: "data-export.no-app",
+      hint: "Pass an app name with --app <name> or run from a directory with percher.toml."
+    });
+  }
+  ctx.status?.(`Exporting ${appName} data...`);
+  const stamp = new Date().toISOString().replace(/[:.]/g, "-").slice(0, 19);
+  const fileName = input.out ?? `${appName}-pb-${stamp}.tar.gz`;
+  const path = resolve6(ctx.cwd, fileName);
+  const res = await ctx.client.apps.streamDataExport(appName);
+  const bytes = await writeGzipResponseToFileAtomic(res, path);
+  return {
+    app: appName,
+    path,
+    bytes,
+    exportedAt: new Date().toISOString()
+  };
+}
+// ../core/dist/commands/data-oauth.js
+var dataOauthInputSchema = exports_external.object({
+  app: exports_external.string().optional(),
+  provider: exports_external.string().default("google"),
+  clientId: exports_external.string().optional(),
+  clientSecret: exports_external.string().optional(),
+  remove: exports_external.boolean().optional(),
+  json: exports_external.boolean().optional()
+});
+async function dataOauth(ctx, input = { provider: "google" }) {
+  const name = input.app ?? readPercherTomlAppName(ctx.cwd);
+  if (!name) {
+    throw new PercherCoreError("No app specified and no percher.toml found", {
+      code: "data.no-app",
+      hint: "Pass an app name or run from a directory with percher.toml."
+    });
+  }
+  const provider = input.provider || "google";
+  if (input.remove) {
+    await ctx.client.data.removeOAuthProvider(name, provider);
+    return { action: "removed", provider };
+  }
+  if (input.clientId && input.clientSecret) {
+    const res = await ctx.client.data.setOAuthProvider(name, {
+      provider,
+      clientId: input.clientId,
+      clientSecret: input.clientSecret
+    });
+    return {
+      action: "set",
+      provider: res.provider,
+      redirectUri: res.redirectUri,
+      note: res.note
+    };
+  }
+  const status = await ctx.client.data.getOAuthStatus(name);
+  return {
+    action: "status",
+    provider,
+    providers: status.providers,
+    redirectUri: status.redirectUri
+  };
+}
+// ../core/dist/commands/data-records.js
+init_dist();
+
+// ../core/dist/data-recovery.js
+init_dist();
+
+// ../core/dist/structured-error-codes.js
+var MAPPINGS = {
+  PB_PROVISION_FAILED: {
+    errorClass: "pb_provision_failed",
+    phase: "infra",
+    cause: "pb_provision_failed",
+    title: "Database admin setup failed",
+    explanation: () => "The platform could not set up the database admin account.",
+    suggestion: "Publishing again after the platform failure is resolved is safe."
+  },
+  BUILD_SECRET_KEY_UNAVAILABLE: {
+    errorClass: "build_secrets_unavailable",
+    phase: "infra",
+    cause: "build_secret_key_unavailable",
+    title: "Percher could not protect build secrets",
+    explanation: () => "Percher's key for build secrets is unavailable, so it refused the build rather than run it without them. This is a platform issue and does not count against your app.",
+    suggestion: "Contact support. Removing the non-public keys from [build] pass_env lets the build run without them."
+  },
+  BUILD_SECRETS_UNSUPPORTED_NIXPACKS: {
+    errorClass: "build_secrets_unavailable",
+    phase: "infra",
+    cause: "build_secrets_unsupported_nixpacks",
+    title: "This builder cannot mount build secrets",
+    explanation: () => "Percher is building this app with its fallback builder, which cannot keep build secrets out of the image, so it refused the build. It does not count against your app.",
+    suggestion: "Remove the non-public keys from [build] pass_env, or deploy again later."
+  },
+  SHARED_NETWORK_FORBIDDEN: {
+    errorClass: "infra_unavailable",
+    phase: "infra",
+    cause: "shared_network_forbidden",
+    title: "Percher refused unsafe network placement",
+    explanation: () => "This app is still on Percher's shared bridge. Percher refused to start another container there. This is a platform issue and does not count against your app.",
+    suggestion: "Contact support. A Percher operator must migrate the app to its own network before you retry."
+  },
+  PLATFORM_DISK_LOW: {
+    errorClass: "platform_at_capacity",
+    phase: "infra",
+    cause: "disk_headroom_exhausted",
+    title: "Platform storage is too low",
+    explanation: () => "Percher paused new deploys: the platform is nearly out of disk. Not your app — nothing to change. Deployed apps keep running; only new deploys are paused.",
+    suggestion: "The operator is alerted automatically. Run `percher publish` again in ~15 min; this failure does not count against your app. Still failing after an hour: https://percher.app/status"
+  },
+  PLATFORM_DISK_UNKNOWN: {
+    errorClass: "platform_at_capacity",
+    phase: "infra",
+    cause: "disk_state_unreadable",
+    title: "Platform storage state is unknown",
+    explanation: () => "Percher paused new deploys: it can't read how much disk is left, and won't assume there's room. Not your app. Deployed apps have not been stopped by this.",
+    suggestion: "Run `percher publish` again in ~5 min; this failure does not count against your app. Still failing after 15 min: https://percher.app/status"
+  },
+  PLAN_POOL_EXCEEDED: {
+    errorClass: "plan_pool_exceeded",
+    phase: "start",
+    cause: "plan_pool_exceeded",
+    title: "Plan resource pool is full",
+    explanation: (raw) => raw ? `${trimMessage(raw)} The platform is fine — the account is at its plan's limit.` : "This deploy would commit more RAM, vCPU or disk than your plan's pool allows across all your apps. The platform is fine — the account is at its limit.",
+    suggestion: "Reduce `[resources]` in this app's percher.toml, delete an app you no longer need, or upgrade at https://percher.app/account/billing. Retrying unchanged will fail the same way."
+  },
+  PLACEMENT_UNDETERMINED: {
+    errorClass: "infra_unavailable",
+    phase: "infra",
+    cause: "placement_undetermined",
+    title: "Percher could not place your app's container",
+    explanation: (raw) => raw ? `${trimMessage(raw)} This is a platform-side read of Percher's own container placement, not anything in your app.` : "Percher could not read which internal network this app's current containers are on, and refused to guess rather than risk splitting the app from its database across two networks.",
+    suggestion: "Nothing to change in your app. Retry in a minute; if it persists, the platform is having trouble reaching its container daemon and Percher's operators are alerted."
+  },
+  PLATFORM_MEMORY_LOW: {
+    errorClass: "platform_at_capacity",
+    phase: "infra",
+    cause: "box_admission_rejected",
+    title: "Platform is at capacity",
+    explanation: (raw) => raw ? `Percher couldn't fit this deploy on the box right now: ${trimMessage(raw)} Not your app — nothing to change. Deployed apps keep running.` : "Percher couldn't fit this deploy on the box right now — the admission gate refused to start the container. Not your app — nothing to change. Deployed apps keep running.",
+    suggestion: "Run `percher publish` again in a few minutes; capacity frees up as other deploys finish, and this failure does not count against your app. Still failing after an hour: https://percher.app/status"
+  },
+  PB_BRIDGE_UNAVAILABLE: {
+    errorClass: "infra_unavailable",
+    phase: "infra",
+    cause: "pb_bridge_unreachable",
+    title: "PocketBase is unreachable from the platform",
+    explanation: (raw) => raw ? `Percher could not reach your app's database through its internal bridge: ${trimMessage(raw)}. This is a platform-side issue — your data and your code are both fine.` : "Percher could not reach your app's database through its internal bridge. This is a platform-side issue — your data and your code are both fine.",
+    suggestion: "Wait a minute and run `percher publish` again; this failure does not count against your app. Your data was not touched — the platform could not read it, which is not the same as it being missing. Still failing after 15 min: https://percher.app/status"
+  },
+  PB_ROTATION_UNVERIFIED: {
+    errorClass: "infra_unavailable",
+    phase: "infra",
+    cause: "pb_rotation_unverified",
+    title: "PocketBase admin password was rotated but not confirmed",
+    explanation: (raw) => raw ? `${trimMessage(raw)} The rotation itself ran, so the previously stored admin password may now be stale. Your app data was not modified — only the admin credential changed.` : "Percher rotated your app's PocketBase admin password, then could not confirm the rotation. The previously stored admin password may now be stale. Your app data was not modified — only the admin credential changed.",
+    suggestion: "Run the superuser reset again (`percher data reset-superuser` or the dashboard's reset button) — the rotation is idempotent, and a successful re-run stores a fresh working credential. This failure does not count against your app."
+  },
+  PB_OPERATION_BUSY: {
+    errorClass: "pb_operation_busy",
+    phase: "start",
+    cause: "pb_backup_restore_busy",
+    title: "PocketBase is finishing another data operation",
+    explanation: (raw) => raw ? `${trimMessage(raw)} The operation is scoped to this app and must finish before Percher can create the deploy checkpoint.` : "PocketBase is already creating a backup or restoring data for this app, so Percher could not create the deploy checkpoint yet.",
+    suggestion: "Wait for the current backup, export or restore to finish, then publish again. If no operation is visible after a few minutes, contact support before retrying repeatedly."
+  },
+  CANARY_FAILED: {
+    errorClass: "runtime_crash",
+    phase: "start",
+    cause: "canary_failed",
+    title: "Your app went live, then failed its post-deploy check",
+    explanation: (raw) => raw ? `${trimMessage(raw)} The container started and passed its health check, so this is something that only shows up once the app is serving real requests.` : "Percher swapped your new version in, then its own public URL did not answer correctly. The container started and passed its health check, so this is something that only shows up once the app is serving real requests.",
+    suggestion: "Run `percher doctor` — it re-probes the container and the public route and will say which half is failing. The container log from the moment it was rolled back is in the build log below. Retrying unchanged will usually fail the same way."
+  },
+  APP_DATA_MOUNT_CONFLICT: {
+    errorClass: "app_data_mount_conflict",
+    phase: "start",
+    cause: "app_data_mount_conflict",
+    title: "Your image has a file where Percher mounts /app/data",
+    explanation: () => "The image built, but Docker could not start the container: every Percher app gets its persistent data volume mounted at /app/data, and this image has a file (or a link to one) at /app or /app/data, so that directory cannot be created.",
+    suggestion: "Install the binary somewhere else, such as /usr/local/bin/app, and point ENTRYPOINT/CMD at it. If the project has a file named `data` at its root, rename it. Retrying unchanged will fail the same way."
+  },
+  WORKER_UNAVAILABLE: {
+    errorClass: "infra_unavailable",
+    phase: "infra",
+    cause: "worker_fetch_failed",
+    title: "Build worker is unreachable",
+    explanation: (raw) => raw ? `The Percher build worker did not respond in time: ${trimMessage(raw)}. This is a platform-side issue, not your code.` : "The Percher build worker did not respond in time. This is a platform-side issue, not your code.",
+    suggestion: "Wait 30 seconds and run `percher publish` again. If retry #2 also fails, pause 5 minutes before the next attempt — back-to-back retries during a partial outage just waste your time. After 3 spaced-out retries, check status.percher.app or contact support. Your build never started."
+  },
+  WORKER_UNAVAILABLE_PERSISTENT: {
+    errorClass: "infra_unavailable",
+    phase: "infra",
+    cause: "worker_circuit_breaker_open",
+    title: "Build worker is in a crash loop",
+    explanation: () => "The Percher build worker has failed repeatedly in the last minute and the platform's circuit breaker has flipped open. Retrying immediately would just queue more failures.",
+    suggestion: "Wait 2-3 minutes for the platform to recover, then retry. If it persists past 5 minutes check status.percher.app or contact support — this is a platform incident, not your code."
+  },
+  BUILD_TIMEOUT: {
+    errorClass: "build_failed",
+    phase: "build",
+    cause: "build_timeout",
+    title: "Build timed out",
+    explanation: () => "The build ran longer than the 10-minute platform limit and was aborted.",
+    suggestion: "Common causes: a slow `postinstall` hook, very large dependency tree, or a Dockerfile that pulls a huge base image. Try `bun install` locally and check what's slow. If it's legitimately a heavy build, contact support to discuss raising the limit for your account."
+  },
+  BUILD_FAILED: {
+    errorClass: "build_failed",
+    phase: "build",
+    cause: "build_nonzero_exit",
+    title: "Build failed",
+    explanation: (raw) => raw ? `The build process returned a non-zero exit code: ${trimMessage(raw)}. Read the build log below for the exact error.` : "The build process returned a non-zero exit code. Read the build log below for the exact error.",
+    suggestion: "Run your build locally to reproduce: `bun install && bun run build`. The error in the build log usually points to a missing dependency, a TypeScript/syntax error, or a misconfigured framework setting."
+  },
+  WORKER_ERROR: {
+    errorClass: "infra_unavailable",
+    phase: "infra",
+    cause: "worker_internal_error",
+    title: "Platform error inside the build worker",
+    explanation: (raw) => raw ? `The build worker hit an internal error: ${trimMessage(raw)}. This is a Percher bug, not your code.` : "The build worker hit an internal error. This is a Percher bug, not your code.",
+    suggestion: "Retry once — transient platform errors usually clear within a minute. If it repeats, please report it: include the deploy ID and we'll investigate. Your account is not at fault."
+  },
+  WORKER_ENDPOINT_MISSING: {
+    errorClass: "infra_unavailable",
+    phase: "infra",
+    cause: "worker_endpoint_missing",
+    title: "Platform worker is mid-upgrade",
+    explanation: (raw) => raw ? `${trimMessage(raw)} The platform's worker process predates an endpoint this request needs — a rolling-deploy skew, not your code.` : "The platform's worker process predates an endpoint this request needs — a rolling-deploy skew, not your code.",
+    suggestion: "Retry in a few minutes; the operator finishes the platform deploy worker-first. This failure does not count against your app."
+  },
+  DEPLOY_STALLED: {
+    errorClass: "infra_unavailable",
+    phase: "infra",
+    cause: "deploy_stalled",
+    title: "Deploy stalled",
+    explanation: () => "The platform abandoned this deploy — likely because the API or build worker restarted mid-build. Your code is fine; the build never finished.",
+    suggestion: "Run `percher publish` again. The new deploy will start fresh. If you see this repeatedly across multiple publishes, check status.percher.app — it implies a recurring platform issue."
+  }
+};
+function classifyByErrorCode(code, rawMessage) {
+  if (!code)
+    return null;
+  const mapping = MAPPINGS[code];
+  if (!mapping)
+    return null;
+  return {
+    title: mapping.title,
+    explanation: mapping.explanation(rawMessage),
+    suggestion: mapping.suggestion,
+    errorClass: mapping.errorClass,
+    phase: mapping.phase,
+    cause: mapping.cause,
+    relevantFiles: [],
+    missingEnvVars: []
+  };
+}
+function trimMessage(raw) {
+  const firstLine = raw.split(`
+`)[0] ?? "";
+  return firstLine.length > 200 ? `${firstLine.slice(0, 200)}…` : firstLine;
+}
+var PB_PROVISION_FAILED_ASK = {
+  prompt: "The platform could not set up the database admin account. Publishing again after the platform failure is resolved is safe.",
+  reasonCode: "pb_provision_failed",
+  retryable: true
+};
+
 // ../core/dist/recovery.js
 function recoveryNone(opts = {}) {
   return {
@@ -108688,12 +109124,25 @@ function unprovenPlatformClaim(failure) {
 }
 function recoveryFromErrorClass(errorClass, failure) {
   switch (errorClass) {
+    case "build_secrets_unavailable":
+      return recoveryAsk({
+        prompt: "Percher cannot protect build secrets for this build. Should I remove the non-public keys from [build] pass_env and publish again, or wait and publish later?",
+        options: [
+          "remove non-public keys from [build] pass_env and publish again",
+          "wait and publish later"
+        ],
+        reasonCode: "build_secrets_unavailable"
+      });
     case "missing_env":
       return recoveryEnv({
         app: failure.appName,
         keys: failure.missingEnvVars ?? [],
         reasonCode: "missing_env"
       });
+    case "pb_provision_failed":
+      if (failure.classSource !== "code")
+        return unprovenPlatformClaim(failure);
+      return recoveryAsk(PB_PROVISION_FAILED_ASK);
     case "infra_unavailable":
       if (failure.classSource !== "code")
         return unprovenPlatformClaim(failure);
@@ -108784,9 +109233,280 @@ function recoveryFromErrorClass(errorClass, failure) {
   }
 }
 
+// ../core/dist/data-recovery.js
+var WRITES = new Set(["create", "update", "delete"]);
+function isDataRecordErrorCode(code) {
+  return typeof code === "string" && Object.hasOwn(DATA_RECORD_ERROR_STATUS, code);
+}
+
+class DataRecordError extends PercherApiError {
+  target;
+  constructor(err, target) {
+    super(err.message, {
+      status: err.status,
+      code: err.code,
+      requestId: err.requestId,
+      extra: err.extra,
+      cause: err
+    });
+    this.name = "DataRecordError";
+    this.target = target;
+  }
+}
+
+// ../core/dist/commands/data-records.js
+var appArg = exports_external.string().min(1).optional().describe("App name or id. Defaults to the app in ./percher.toml.");
+var collectionArg = exports_external.string().regex(DATA_COLLECTION_RE, "a collection name: a letter, then letters, digits or _ (max 64)").describe("Collection name, exactly as percher_data_schema lists it (case-sensitive).");
+var recordIdArg = exports_external.string().regex(DATA_RECORD_ID_RE, "a record id: letters, digits, _ or - (max 64)").describe("Record id.");
+var expression = (what) => exports_external.string().max(DATA_LIMITS.expressionChars).optional().describe(what);
+var recordData = exports_external.record(exports_external.string(), exports_external.unknown()).describe("Field values keyed by field name (see percher_data_schema). File fields, hidden fields and unknown fields are refused.");
+var dataSchemaInputSchema = exports_external.object({ app: appArg });
+var dataQueryInputSchema = exports_external.object({
+  app: appArg,
+  collection: collectionArg,
+  filter: expression("PocketBase-style filter over the collection's own fields, e.g. status = 'open' && priority >= 2. Operators = != > >= < <= ~ !~ and their ?-prefixed any-of forms; && || and parentheses. No @-variables, dotted paths, functions or backslashes."),
+  sort: expression("Comma-separated fields, - for descending, e.g. -created,title (max 8)."),
+  page: exports_external.number().int().min(1).max(DATA_LIMITS.maxPage).optional(),
+  perPage: exports_external.number().int().min(1).max(DATA_LIMITS.maxPerPage).optional(),
+  fields: expression("Comma-separated field names to return (default: every non-hidden field).")
+});
+var dataGetInputSchema = exports_external.object({
+  app: appArg,
+  collection: collectionArg,
+  id: recordIdArg
+});
+var dataCreateInputSchema = exports_external.object({
+  app: appArg,
+  collection: collectionArg,
+  data: recordData,
+  id: recordIdArg.optional().describe("Optional id for the new record. With one, a create whose outcome is unknown can be checked with percher_data_get instead of searched for.")
+});
+var dataUpdateInputSchema = exports_external.object({
+  app: appArg,
+  collection: collectionArg,
+  id: recordIdArg,
+  data: recordData,
+  ifUpdated: exports_external.string().min(1).max(64).optional().describe("The record's `updated` value as last read. The update is refused if it changed since. A best-effort timestamp check, not a lock: timestamp collisions and the app's own concurrent writes can defeat it.")
+});
+var dataDeleteInputSchema = exports_external.object({
+  app: appArg,
+  collection: collectionArg,
+  id: recordIdArg
+});
+function resolveApp(ctx, app) {
+  const name = app ?? readPercherTomlAppName(ctx.cwd);
+  if (!name) {
+    throw new PercherCoreError("No app specified and no percher.toml found", {
+      code: "data.no-app",
+      hint: "Pass an app name or run from a directory with percher.toml."
+    });
+  }
+  return name;
+}
+async function call(target, run) {
+  try {
+    return await run();
+  } catch (err) {
+    if (err instanceof PercherApiError && isDataRecordErrorCode(err.code)) {
+      throw new DataRecordError(err, target);
+    }
+    throw err;
+  }
+}
+function target(op, app, collection, id) {
+  return {
+    op,
+    app,
+    ...collection !== undefined ? { collection } : {},
+    ...id !== undefined ? { id } : {}
+  };
+}
+var SCHEMA_MAX_COLLECTIONS = DATA_LIMITS.schemaPerPage * DATA_LIMITS.schemaMaxPages;
+function omittedByRulesNote(omitted) {
+  if (typeof omitted !== "number" || !Number.isSafeInteger(omitted) || omitted < 1 || omitted > SCHEMA_MAX_COLLECTIONS) {
+    return;
+  }
+  const subject = omitted === 1 ? "1 collection in this app is" : `${omitted} collections in this app are`;
+  return `${subject} reachable only with full access, which the app's own server code may use. The owner can choose full access for this app in Settings → Connections.`;
+}
+async function dataSchema2(ctx, input) {
+  const app = resolveApp(ctx, input.app);
+  const schema = await call(target("schema", app), () => ctx.client.data.getSchema(app));
+  const { note: _fromApi, ...rest } = schema;
+  const note = omittedByRulesNote(rest.omittedByRules);
+  return note === undefined ? rest : { ...rest, note };
+}
+async function dataQuery(ctx, input) {
+  const { app: rawApp, collection, ...query } = input;
+  const app = resolveApp(ctx, rawApp);
+  return call(target("query", app, collection), () => ctx.client.data.queryRecords(app, collection, query));
+}
+async function dataGet(ctx, input) {
+  const app = resolveApp(ctx, input.app);
+  return call(target("get", app, input.collection, input.id), () => ctx.client.data.getRecord(app, input.collection, input.id));
+}
+async function dataCreate(ctx, input) {
+  const app = resolveApp(ctx, input.app);
+  const body = {
+    data: input.data,
+    ...input.id !== undefined ? { id: input.id } : {}
+  };
+  return call(target("create", app, input.collection, input.id), () => ctx.client.data.createRecord(app, input.collection, body));
+}
+async function dataUpdate(ctx, input) {
+  const app = resolveApp(ctx, input.app);
+  const body = {
+    data: input.data,
+    ...input.ifUpdated !== undefined ? { ifUpdated: input.ifUpdated } : {}
+  };
+  return call(target("update", app, input.collection, input.id), () => ctx.client.data.updateRecord(app, input.collection, input.id, body));
+}
+async function dataDelete(ctx, input) {
+  const app = resolveApp(ctx, input.app);
+  await call(target("delete", app, input.collection, input.id), () => ctx.client.data.deleteRecord(app, input.collection, input.id));
+  return { deleted: true, collection: input.collection, id: input.id };
+}
+// ../core/dist/commands/delete.js
+var deleteInputSchema = exports_external.object({
+  app: exports_external.string().optional().describe("App name to delete (defaults to percher.toml app name)"),
+  confirm: exports_external.boolean().describe("Must be true to confirm deletion. This is a destructive operation that permanently removes the app, its container, database, domains, env vars, and deploy history.")
+});
+async function deleteApp(ctx, input) {
+  const name = input.app ?? readPercherTomlAppName(ctx.cwd);
+  if (!name) {
+    throw new PercherCoreError("No app specified and no percher.toml found", {
+      code: "env.no-app",
+      hint: "Pass an app name or run from a directory with percher.toml."
+    });
+  }
+  if (!input.confirm) {
+    throw new PercherCoreError(`Deletion requires explicit confirmation. Set confirm: true to delete "${name}" permanently.`, {
+      code: "delete.confirmation-required",
+      hint: `This will permanently delete the app "${name}" and all its data. Pass confirm: true to proceed.`
+    });
+  }
+  await ctx.client.apps.delete(name);
+}
+// ../core/dist/commands/deploy-repo.js
+init_dist();
+
+// ../core/dist/deployment-replaced.js
+var summary = "This deployment is no longer active. Inspect the app's current state before deploying again.";
+function recovery(app, deployId) {
+  return recoveryDoctor({ app, deployId, mode: "deploy", reasonCode: "replaced_by_newer" });
+}
+function throwIfDeploymentReplaced(app, deployment) {
+  if (deployment.status !== "replaced")
+    return;
+  throw new PercherCoreError(summary, {
+    code: "push.deploy-replaced",
+    hint: `Run \`percher doctor --app ${app}\` to inspect the current state.`,
+    recovery: { ...recovery(app, deployment.id) }
+  });
+}
+function replacedDeploymentResult(app, deployment) {
+  return {
+    status: "replaced",
+    app,
+    deployment,
+    summary,
+    recovery: recovery(app.name, deployment.id),
+    fileCount: 0,
+    bytes: 0,
+    configPath: "",
+    bundle: { fileCount: 0, bytes: 0 }
+  };
+}
+
+// ../core/dist/poll-deployment.js
+init_dist();
+class DeployPollLostContactError extends PercherCoreError {
+  deploymentId;
+  constructor(message, deploymentId, appName, options) {
+    super(message, {
+      code: "push.lost-contact",
+      hint: `The deploy may already be live. Check with: percher deploys ${appName}`,
+      cause: options?.cause
+    });
+    this.deploymentId = deploymentId;
+    this.name = "DeployPollLostContactError";
+  }
+}
+function isTransientPollError(err) {
+  if (isTransientNetworkError(err))
+    return true;
+  if (err instanceof PercherApiError)
+    return err.status === 429 || err.status === 502 || err.status === 503 || err.status === 504;
+  return err instanceof TypeError && /terminated/i.test(err.message);
+}
+async function pollDeployment(opts) {
+  const terminal = opts.terminal ?? ["live", "failed", "replaced"];
+  const intervalMs = opts.intervalMs ?? 2000;
+  const timeoutMs = opts.timeoutMs ?? TIMEOUTS.clientPublishPoll;
+  const maxRetries = opts.maxRetries ?? Number.POSITIVE_INFINITY;
+  const retryBudgetMs = opts.retryBudgetMs ?? 5 * 60000;
+  let deployment = opts.initial;
+  const startedAt = Date.now();
+  const seenEventIds = new Set;
+  if (opts.onEvent) {
+    await drainNewEvents(opts, deployment.id, seenEventIds);
+  }
+  while (!terminal.includes(deployment.status)) {
+    if (Date.now() - startedAt > timeoutMs) {
+      opts.onTimeout(deployment);
+    }
+    opts.onTick?.(deployment);
+    await new Promise((r) => setTimeout(r, intervalMs));
+    let attempt = 0;
+    let streakStartedAt = 0;
+    let polled = false;
+    while (!polled) {
+      try {
+        deployment = await opts.ctx.client.apps.getDeployment(opts.appId, deployment.id);
+        polled = true;
+      } catch (err) {
+        attempt++;
+        if (!isTransientPollError(err))
+          throw err;
+        if (attempt === 1) {
+          streakStartedAt = Date.now();
+          opts.ctx.status(err instanceof PercherApiError && err.status === 429 ? "Percher asked this client to slow down; retrying while the deploy continues..." : "Lost contact with Percher; retrying while the deploy continues...");
+        }
+        if (Date.now() - startedAt > timeoutMs)
+          opts.onTimeout(deployment);
+        if (attempt >= maxRetries || Date.now() - streakStartedAt >= retryBudgetMs) {
+          const msg = err.message ?? String(err);
+          throw new DeployPollLostContactError(`${msg}
+
+The deploy may already be live — contact with Percher was lost mid-poll. Check with: percher deploys ${opts.appName}`, deployment.id, opts.appName, { cause: err });
+        }
+        const backoff = (opts.backoffMs ?? ((n) => Math.min(1000 * 2 ** (n - 1), 15000)))(attempt);
+        await new Promise((r) => setTimeout(r, backoff));
+      }
+    }
+    if (opts.onEvent) {
+      await drainNewEvents(opts, deployment.id, seenEventIds);
+    }
+  }
+  return deployment;
+}
+async function drainNewEvents(opts, deployId, seenEventIds) {
+  if (!opts.onEvent)
+    return;
+  try {
+    const { events } = await opts.ctx.client.apps.getDeployEvents(opts.appId, deployId);
+    for (const event of events) {
+      if (seenEventIds.has(event.id))
+        continue;
+      seenEventIds.add(event.id);
+      opts.onEvent(event);
+    }
+  } catch {}
+}
+
 // ../core/dist/commands/publish-failure.js
 init_dist();
-import { join as join9 } from "node:path";
+import { join as join10 } from "node:path";
 
 // ../core/dist/error-classifier.js
 function extractEnvVarsFromLog(combined) {
@@ -108804,6 +109524,19 @@ function extractModuleFromLog(combined) {
   return match?.[1];
 }
 var patterns = [
+  {
+    pattern: /PB_PROVISION_FAILED|the platform could not set up the database admin account/i,
+    result: {
+      title: "Database admin setup failed",
+      explanation: "The platform could not set up the database admin account.",
+      suggestion: "Publishing again after the platform failure is resolved is safe.",
+      errorClass: "pb_provision_failed",
+      phase: "infra",
+      cause: "pb_provision_failed",
+      relevantFiles: [],
+      missingEnvVars: []
+    }
+  },
   {
     pattern: /DEPLOY_STALLED:/,
     result: {
@@ -109172,171 +109905,9 @@ ${buildLog ?? ""}`;
   return null;
 }
 
-// ../core/dist/structured-error-codes.js
-var MAPPINGS = {
-  PLATFORM_DISK_LOW: {
-    errorClass: "platform_at_capacity",
-    phase: "infra",
-    cause: "disk_headroom_exhausted",
-    title: "Platform storage is too low",
-    explanation: () => "Percher paused new deploys: the platform is nearly out of disk. Not your app — nothing to change. Deployed apps keep running; only new deploys are paused.",
-    suggestion: "The operator is alerted automatically. Run `percher publish` again in ~15 min; this failure does not count against your app. Still failing after an hour: https://percher.app/status"
-  },
-  PLATFORM_DISK_UNKNOWN: {
-    errorClass: "platform_at_capacity",
-    phase: "infra",
-    cause: "disk_state_unreadable",
-    title: "Platform storage state is unknown",
-    explanation: () => "Percher paused new deploys: it can't read how much disk is left, and won't assume there's room. Not your app. Deployed apps have not been stopped by this.",
-    suggestion: "Run `percher publish` again in ~5 min; this failure does not count against your app. Still failing after 15 min: https://percher.app/status"
-  },
-  PLAN_POOL_EXCEEDED: {
-    errorClass: "plan_pool_exceeded",
-    phase: "start",
-    cause: "plan_pool_exceeded",
-    title: "Plan resource pool is full",
-    explanation: (raw) => raw ? `${trimMessage(raw)} The platform is fine — the account is at its plan's limit.` : "This deploy would commit more RAM, vCPU or disk than your plan's pool allows across all your apps. The platform is fine — the account is at its limit.",
-    suggestion: "Reduce `[resources]` in this app's percher.toml, delete an app you no longer need, or upgrade at https://percher.app/account/billing. Retrying unchanged will fail the same way."
-  },
-  PLACEMENT_UNDETERMINED: {
-    errorClass: "infra_unavailable",
-    phase: "infra",
-    cause: "placement_undetermined",
-    title: "Percher could not place your app's container",
-    explanation: (raw) => raw ? `${trimMessage(raw)} This is a platform-side read of Percher's own container placement, not anything in your app.` : "Percher could not read which internal network this app's current containers are on, and refused to guess rather than risk splitting the app from its database across two networks.",
-    suggestion: "Nothing to change in your app. Retry in a minute; if it persists, the platform is having trouble reaching its container daemon and Percher's operators are alerted."
-  },
-  PLATFORM_MEMORY_LOW: {
-    errorClass: "platform_at_capacity",
-    phase: "infra",
-    cause: "box_admission_rejected",
-    title: "Platform is at capacity",
-    explanation: (raw) => raw ? `Percher couldn't fit this deploy on the box right now: ${trimMessage(raw)} Not your app — nothing to change. Deployed apps keep running.` : "Percher couldn't fit this deploy on the box right now — the admission gate refused to start the container. Not your app — nothing to change. Deployed apps keep running.",
-    suggestion: "Run `percher publish` again in a few minutes; capacity frees up as other deploys finish, and this failure does not count against your app. Still failing after an hour: https://percher.app/status"
-  },
-  PB_BRIDGE_UNAVAILABLE: {
-    errorClass: "infra_unavailable",
-    phase: "infra",
-    cause: "pb_bridge_unreachable",
-    title: "PocketBase is unreachable from the platform",
-    explanation: (raw) => raw ? `Percher could not reach your app's database through its internal bridge: ${trimMessage(raw)}. This is a platform-side issue — your data and your code are both fine.` : "Percher could not reach your app's database through its internal bridge. This is a platform-side issue — your data and your code are both fine.",
-    suggestion: "Wait a minute and run `percher publish` again; this failure does not count against your app. Your data was not touched — the platform could not read it, which is not the same as it being missing. Still failing after 15 min: https://percher.app/status"
-  },
-  PB_ROTATION_UNVERIFIED: {
-    errorClass: "infra_unavailable",
-    phase: "infra",
-    cause: "pb_rotation_unverified",
-    title: "PocketBase admin password was rotated but not confirmed",
-    explanation: (raw) => raw ? `${trimMessage(raw)} The rotation itself ran, so the previously stored admin password may now be stale. Your app data was not modified — only the admin credential changed.` : "Percher rotated your app's PocketBase admin password, then could not confirm the rotation. The previously stored admin password may now be stale. Your app data was not modified — only the admin credential changed.",
-    suggestion: "Run the superuser reset again (`percher data reset-superuser` or the dashboard's reset button) — the rotation is idempotent, and a successful re-run stores a fresh working credential. This failure does not count against your app."
-  },
-  PB_OPERATION_BUSY: {
-    errorClass: "pb_operation_busy",
-    phase: "start",
-    cause: "pb_backup_restore_busy",
-    title: "PocketBase is finishing another data operation",
-    explanation: (raw) => raw ? `${trimMessage(raw)} The operation is scoped to this app and must finish before Percher can create the deploy checkpoint.` : "PocketBase is already creating a backup or restoring data for this app, so Percher could not create the deploy checkpoint yet.",
-    suggestion: "Wait for the current backup, export or restore to finish, then publish again. If no operation is visible after a few minutes, contact support before retrying repeatedly."
-  },
-  CANARY_FAILED: {
-    errorClass: "runtime_crash",
-    phase: "start",
-    cause: "canary_failed",
-    title: "Your app went live, then failed its post-deploy check",
-    explanation: (raw) => raw ? `${trimMessage(raw)} The container started and passed its health check, so this is something that only shows up once the app is serving real requests.` : "Percher swapped your new version in, then its own public URL did not answer correctly. The container started and passed its health check, so this is something that only shows up once the app is serving real requests.",
-    suggestion: "Run `percher doctor` — it re-probes the container and the public route and will say which half is failing. The container log from the moment it was rolled back is in the build log below. Retrying unchanged will usually fail the same way."
-  },
-  APP_DATA_MOUNT_CONFLICT: {
-    errorClass: "app_data_mount_conflict",
-    phase: "start",
-    cause: "app_data_mount_conflict",
-    title: "Your image has a file where Percher mounts /app/data",
-    explanation: () => "The image built, but Docker could not start the container: every Percher app gets its persistent data volume mounted at /app/data, and this image has a file (or a link to one) at /app or /app/data, so that directory cannot be created.",
-    suggestion: "Install the binary somewhere else, such as /usr/local/bin/app, and point ENTRYPOINT/CMD at it. If the project has a file named `data` at its root, rename it. Retrying unchanged will fail the same way."
-  },
-  WORKER_UNAVAILABLE: {
-    errorClass: "infra_unavailable",
-    phase: "infra",
-    cause: "worker_fetch_failed",
-    title: "Build worker is unreachable",
-    explanation: (raw) => raw ? `The Percher build worker did not respond in time: ${trimMessage(raw)}. This is a platform-side issue, not your code.` : "The Percher build worker did not respond in time. This is a platform-side issue, not your code.",
-    suggestion: "Wait 30 seconds and run `percher publish` again. If retry #2 also fails, pause 5 minutes before the next attempt — back-to-back retries during a partial outage just waste your time. After 3 spaced-out retries, check status.percher.app or contact support. Your build never started."
-  },
-  WORKER_UNAVAILABLE_PERSISTENT: {
-    errorClass: "infra_unavailable",
-    phase: "infra",
-    cause: "worker_circuit_breaker_open",
-    title: "Build worker is in a crash loop",
-    explanation: () => "The Percher build worker has failed repeatedly in the last minute and the platform's circuit breaker has flipped open. Retrying immediately would just queue more failures.",
-    suggestion: "Wait 2-3 minutes for the platform to recover, then retry. If it persists past 5 minutes check status.percher.app or contact support — this is a platform incident, not your code."
-  },
-  BUILD_TIMEOUT: {
-    errorClass: "build_failed",
-    phase: "build",
-    cause: "build_timeout",
-    title: "Build timed out",
-    explanation: () => "The build ran longer than the 10-minute platform limit and was aborted.",
-    suggestion: "Common causes: a slow `postinstall` hook, very large dependency tree, or a Dockerfile that pulls a huge base image. Try `bun install` locally and check what's slow. If it's legitimately a heavy build, contact support to discuss raising the limit for your account."
-  },
-  BUILD_FAILED: {
-    errorClass: "build_failed",
-    phase: "build",
-    cause: "build_nonzero_exit",
-    title: "Build failed",
-    explanation: (raw) => raw ? `The build process returned a non-zero exit code: ${trimMessage(raw)}. Read the build log below for the exact error.` : "The build process returned a non-zero exit code. Read the build log below for the exact error.",
-    suggestion: "Run your build locally to reproduce: `bun install && bun run build`. The error in the build log usually points to a missing dependency, a TypeScript/syntax error, or a misconfigured framework setting."
-  },
-  WORKER_ERROR: {
-    errorClass: "infra_unavailable",
-    phase: "infra",
-    cause: "worker_internal_error",
-    title: "Platform error inside the build worker",
-    explanation: (raw) => raw ? `The build worker hit an internal error: ${trimMessage(raw)}. This is a Percher bug, not your code.` : "The build worker hit an internal error. This is a Percher bug, not your code.",
-    suggestion: "Retry once — transient platform errors usually clear within a minute. If it repeats, please report it: include the deploy ID and we'll investigate. Your account is not at fault."
-  },
-  WORKER_ENDPOINT_MISSING: {
-    errorClass: "infra_unavailable",
-    phase: "infra",
-    cause: "worker_endpoint_missing",
-    title: "Platform worker is mid-upgrade",
-    explanation: (raw) => raw ? `${trimMessage(raw)} The platform's worker process predates an endpoint this request needs — a rolling-deploy skew, not your code.` : "The platform's worker process predates an endpoint this request needs — a rolling-deploy skew, not your code.",
-    suggestion: "Retry in a few minutes; the operator finishes the platform deploy worker-first. This failure does not count against your app."
-  },
-  DEPLOY_STALLED: {
-    errorClass: "infra_unavailable",
-    phase: "infra",
-    cause: "deploy_stalled",
-    title: "Deploy stalled",
-    explanation: () => "The platform abandoned this deploy — likely because the API or build worker restarted mid-build. Your code is fine; the build never finished.",
-    suggestion: "Run `percher publish` again. The new deploy will start fresh. If you see this repeatedly across multiple publishes, check status.percher.app — it implies a recurring platform issue."
-  }
-};
-function classifyByErrorCode(code, rawMessage) {
-  if (!code)
-    return null;
-  const mapping = MAPPINGS[code];
-  if (!mapping)
-    return null;
-  return {
-    title: mapping.title,
-    explanation: mapping.explanation(rawMessage),
-    suggestion: mapping.suggestion,
-    errorClass: mapping.errorClass,
-    phase: mapping.phase,
-    cause: mapping.cause,
-    relevantFiles: [],
-    missingEnvVars: []
-  };
-}
-function trimMessage(raw) {
-  const firstLine = raw.split(`
-`)[0] ?? "";
-  return firstLine.length > 200 ? `${firstLine.slice(0, 200)}…` : firstLine;
-}
-
 // ../core/dist/commands/publish-failure.js
 function tomlPathFor(cwd) {
-  return join9(cwd, "percher.toml");
+  return join10(cwd, "percher.toml");
 }
 async function buildFailureError(ctx, app, deployment, signal) {
   let buildLogTail;
@@ -109408,7 +109979,7 @@ async function classifyDeploymentFailure(opts) {
     error48.suggestion = `${error48.suggestion}
 To return to the last version that ran cleanly: \`bunx percher rollback --last-good\`.`;
   }
-  const recovery = error48.errorClass ? recoveryFromErrorClass(error48.errorClass, {
+  const recovery2 = error48.errorClass ? recoveryFromErrorClass(error48.errorClass, {
     missingEnvVars: error48.missingEnvVars,
     deployId: deployment.id,
     appName: app.name,
@@ -109422,13 +109993,13 @@ To return to the last version that ran cleanly: \`bunx percher rollback --last-g
   });
   return {
     error: error48,
-    recovery,
+    recovery: recovery2,
     summary: `${error48.title} (${app.name}, deploy ${deployment.id}).`
   };
 }
 async function buildFailureResult(opts) {
   const { ctx, app, deployment, tarball, input } = opts;
-  const { error: error48, recovery, summary } = await classifyDeploymentFailure({
+  const { error: error48, recovery: recovery2, summary: summary2 } = await classifyDeploymentFailure({
     ctx,
     app,
     deployment,
@@ -109441,8 +110012,8 @@ async function buildFailureResult(opts) {
     fileCount: tarball.fileCount,
     bytes: tarball.bytes,
     error: error48,
-    recovery,
-    summary,
+    recovery: recovery2,
+    summary: summary2,
     configPath: tomlPathFor(ctx.cwd),
     bundle: { fileCount: tarball.fileCount, bytes: tarball.bytes }
   };
@@ -109521,13 +110092,13 @@ async function deploysInspect(ctx, input) {
 }
 // ../core/dist/commands/dev.js
 import { existsSync as existsSync8 } from "node:fs";
-import { join as join12 } from "node:path";
+import { join as join13 } from "node:path";
 
 // ../core/dist/tarball.js
 var import_ignore = __toESM(require_ignore(), 1);
 import { createHash as createHash2 } from "node:crypto";
-import { existsSync as existsSync6, readdirSync as readdirSync2, readFileSync as readFileSync6, statSync as statSync2 } from "node:fs";
-import { join as join10, relative as relative4, sep as sep2 } from "node:path";
+import { existsSync as existsSync6, readdirSync as readdirSync2, readFileSync as readFileSync7, statSync as statSync2 } from "node:fs";
+import { join as join11, relative as relative4, sep as sep2 } from "node:path";
 import { Readable } from "node:stream";
 import { createGzip } from "node:zlib";
 function isFilesOptions(options) {
@@ -109551,7 +110122,7 @@ var ALWAYS_IGNORE_SECRETS = [".env", ".env.*"];
 function* walk(dir, baseDir, ig) {
   const entries = readdirSync2(dir);
   for (const name of entries) {
-    const full = join10(dir, name);
+    const full = join11(dir, name);
     const rel = relative4(baseDir, full).split(sep2).join("/");
     if (ig.ignores(rel))
       continue;
@@ -109640,20 +110211,20 @@ async function createTarball(options) {
   }
   const ig = import_ignore.default();
   ig.add(DEFAULT_IGNORE);
-  const gitignorePath = join10(options.cwd, ".gitignore");
+  const gitignorePath = join11(options.cwd, ".gitignore");
   if (existsSync6(gitignorePath)) {
-    ig.add(readFileSync6(gitignorePath, "utf8"));
+    ig.add(readFileSync7(gitignorePath, "utf8"));
   }
-  const percherignorePath = join10(options.cwd, ".percherignore");
+  const percherignorePath = join11(options.cwd, ".percherignore");
   if (existsSync6(percherignorePath)) {
-    ig.add(readFileSync6(percherignorePath, "utf8"));
+    ig.add(readFileSync7(percherignorePath, "utf8"));
   }
   if (options.extraIgnore)
     ig.add(options.extraIgnore);
   ig.add(ALWAYS_IGNORE_SECRETS);
   const fileBuffers = [];
   for (const rel of walk(options.cwd, options.cwd, ig)) {
-    const data2 = readFileSync6(join10(options.cwd, rel));
+    const data2 = readFileSync7(join11(options.cwd, rel));
     fileBuffers.push({ path: rel, size: data2.length, data: data2 });
   }
   return buildTarball(fileBuffers);
@@ -109675,8 +110246,8 @@ function createTarballFromFiles(files, _config) {
 
 // ../core/dist/watcher.js
 var import_ignore2 = __toESM(require_ignore(), 1);
-import { existsSync as existsSync7, readFileSync as readFileSync7, watch } from "node:fs";
-import { join as join11, sep as sep3 } from "node:path";
+import { existsSync as existsSync7, readFileSync as readFileSync8, watch } from "node:fs";
+import { join as join12, sep as sep3 } from "node:path";
 var DEFAULT_IGNORE2 = [
   "node_modules",
   ".git",
@@ -109696,9 +110267,9 @@ function createWatcher(options) {
   const debounceMs = options.debounceMs ?? 500;
   const ig = import_ignore2.default();
   ig.add(DEFAULT_IGNORE2);
-  const gitignorePath = join11(options.cwd, ".gitignore");
+  const gitignorePath = join12(options.cwd, ".gitignore");
   if (existsSync7(gitignorePath)) {
-    ig.add(readFileSync7(gitignorePath, "utf8"));
+    ig.add(readFileSync8(gitignorePath, "utf8"));
   }
   if (options.extraIgnore)
     ig.add(options.extraIgnore);
@@ -109736,7 +110307,7 @@ var devInputSchema = exports_external.object({
   app: exports_external.string().optional()
 });
 async function loadConfig2(ctx, appOverride) {
-  const tomlPath = join12(ctx.cwd, "percher.toml");
+  const tomlPath = join13(ctx.cwd, "percher.toml");
   if (!existsSync8(tomlPath)) {
     throw new PercherCoreError("No percher.toml found. Run: percher init", {
       code: "dev.no-app",
@@ -109932,7 +110503,7 @@ async function diff(ctx, input = {}) {
 }
 // ../core/dist/commands/doctor.js
 import { existsSync as existsSync9 } from "node:fs";
-import { join as join13 } from "node:path";
+import { join as join14 } from "node:path";
 
 // ../core/dist/toml-recovery.js
 function tomlErrorToRecoveryProblems(err) {
@@ -110018,7 +110589,7 @@ async function waitForDeploy(ctx, input, opts) {
       }
     }
     if (deployment.status === "failed") {
-      const { error: error48, recovery, summary } = await classifyDeploymentFailure({
+      const { error: error48, recovery: recovery2, summary: summary2 } = await classifyDeploymentFailure({
         ctx,
         app,
         deployment,
@@ -110031,8 +110602,8 @@ async function waitForDeploy(ctx, input, opts) {
         elapsedSeconds: Math.round((Date.now() - startedAt) / 1000),
         totalElapsedSeconds: secondsSinceCreated(deployment),
         error: error48,
-        recovery,
-        summary
+        recovery: recovery2,
+        summary: summary2
       };
     }
     if (deployment.isCheck && deployment.checkPassed) {
@@ -110233,7 +110804,7 @@ async function doctor(ctx, input = {}) {
     });
     return summarize(checks3, { appProvided: !!input.app });
   }
-  const tomlPath = join13(ctx.cwd, "percher.toml");
+  const tomlPath = join14(ctx.cwd, "percher.toml");
   const tomlExists = existsSync9(tomlPath);
   let tomlValid = false;
   let tomlProblems;
@@ -110253,7 +110824,7 @@ async function doctor(ctx, input = {}) {
         tomlProblems = tomlErrorToRecoveryProblems(err);
       }
       if (err instanceof PercherTomlError && err.issues && err.issues.length > 0) {
-        const summary = err.issues.slice(0, 3).map((i) => {
+        const summary2 = err.issues.slice(0, 3).map((i) => {
           const where = i.path.length > 0 ? `[${i.path.join(".")}]` : "(root)";
           return `${where} ${i.message}`;
         }).join("; ");
@@ -110261,7 +110832,7 @@ async function doctor(ctx, input = {}) {
         checks3.push({
           name: "percher.toml",
           status: "fail",
-          message: `${summary}${more}`
+          message: `${summary2}${more}`
         });
       } else {
         checks3.push({
@@ -110748,7 +111319,7 @@ var VERDICT_RULES = [
       const reasonCode = vctx.lastDeployStatus === "queued" ? "deploy_queued" : vctx.lastDeployStatus === "building" ? "deploy_building" : vctx.lastDeployStatus === "deploying" ? "deploy_deploying" : "deploy_queued";
       const what = inTransitionalApp ? `App ${vctx.appName ?? ""} is provisioning` : `Last deploy is ${vctx.lastDeployStatus}`;
       const waiting = inTransitionalApp ? "This app is still provisioning" : reasonCode === "deploy_building" ? "The last deploy is still building" : reasonCode === "deploy_deploying" ? "The last deploy is being rolled out" : "The last deploy is still queued";
-      const recovery = vctx.lastDeployId && vctx.appName ? recoveryWait({
+      const recovery2 = vctx.lastDeployId && vctx.appName ? recoveryWait({
         app: vctx.appName,
         deployId: vctx.lastDeployId,
         reasonCode
@@ -110764,7 +111335,7 @@ var VERDICT_RULES = [
           reasonCode,
           phase: "deploy"
         },
-        recovery,
+        recovery: recovery2,
         summary: vctx.lastDeployId ? `${what.trim()} — wait for deploy ${vctx.lastDeployId}.` : `${what.trim()} — wait a moment and re-run.`
       };
     }
@@ -111032,7 +111603,7 @@ var domainRemoveInputSchema = exports_external.object({
   app: exports_external.string().optional(),
   domain: exports_external.string().min(1, "Domain is required")
 });
-function resolveApp(ctx, app) {
+function resolveApp2(ctx, app) {
   const name = app ?? readPercherTomlAppName(ctx.cwd);
   if (!name) {
     throw new PercherCoreError("No app specified and no percher.toml found", {
@@ -111043,19 +111614,19 @@ function resolveApp(ctx, app) {
   return name;
 }
 async function domainAdd(ctx, input) {
-  const appRef2 = resolveApp(ctx, input.app);
+  const appRef2 = resolveApp2(ctx, input.app);
   return ctx.client.apps.addDomain(appRef2, input.domain);
 }
 async function domainVerify(ctx, input) {
-  const appRef2 = resolveApp(ctx, input.app);
+  const appRef2 = resolveApp2(ctx, input.app);
   return ctx.client.apps.verifyDomain(appRef2, input.domain);
 }
 async function domainList(ctx, input = {}) {
-  const appRef2 = resolveApp(ctx, input.app);
+  const appRef2 = resolveApp2(ctx, input.app);
   return ctx.client.apps.listDomains(appRef2);
 }
 async function domainRemove(ctx, input) {
-  const appRef2 = resolveApp(ctx, input.app);
+  const appRef2 = resolveApp2(ctx, input.app);
   await ctx.client.apps.removeDomain(appRef2, input.domain);
 }
 // ../core/dist/commands/env.js
@@ -111249,8 +111820,8 @@ var forgejoSetupWebhookInputSchema = exports_external.object({
   app: exports_external.string().optional().describe("App name (overrides percher.toml)")
 });
 // ../core/dist/commands/generate.js
-import { existsSync as existsSync10, mkdirSync as mkdirSync6, writeFileSync as writeFileSync6 } from "node:fs";
-import { join as join14 } from "node:path";
+import { existsSync as existsSync10, mkdirSync as mkdirSync7, writeFileSync as writeFileSync7 } from "node:fs";
+import { join as join15 } from "node:path";
 var generateInputSchema = exports_external.object({
   cwd: exports_external.string().optional()
 });
@@ -111336,7 +111907,7 @@ function generateTypeScript(config2) {
 }
 async function generate(ctx, input = {}) {
   const cwd = input.cwd ?? ctx.cwd;
-  const tomlPath = join14(cwd, "percher.toml");
+  const tomlPath = join15(cwd, "percher.toml");
   if (!existsSync10(tomlPath)) {
     throw new PercherCoreError("No percher.toml found", {
       code: "dev.no-app",
@@ -111346,14 +111917,14 @@ async function generate(ctx, input = {}) {
   const config2 = await parseFile(tomlPath);
   const files = [];
   const envExample = generateEnvExample(config2);
-  writeFileSync6(join14(cwd, ".env.example"), envExample);
+  writeFileSync7(join15(cwd, ".env.example"), envExample);
   files.push(".env.example");
   const tsTypes = generateTypeScript(config2);
-  writeFileSync6(join14(cwd, "percher.generated.d.ts"), tsTypes);
+  writeFileSync7(join15(cwd, "percher.generated.d.ts"), tsTypes);
   files.push("percher.generated.d.ts");
   const agentInstructions = generateAgentInstructions(config2);
-  mkdirSync6(join14(cwd, ".percher"), { recursive: true });
-  writeFileSync6(join14(cwd, ".percher", "agent-instructions.md"), agentInstructions);
+  mkdirSync7(join15(cwd, ".percher"), { recursive: true });
+  writeFileSync7(join15(cwd, ".percher", "agent-instructions.md"), agentInstructions);
   files.push(".percher/agent-instructions.md");
   return { files };
 }
@@ -111403,7 +111974,7 @@ var githubConnectInputSchema = exports_external.object({
   branch: exports_external.string().optional().describe("Branch to deploy and track (default: main)"),
   autoPreviews: exports_external.boolean().optional().describe("Opt-in: push to a non-tracked branch creates a preview deploy at <app>--p-<branch-slug>.percher.run. Default false.")
 });
-function resolveApp2(ctx, app) {
+function resolveApp3(ctx, app) {
   const name = app ?? readPercherTomlAppName(ctx.cwd);
   if (!name) {
     throw new PercherCoreError("No app specified and no percher.toml found", {
@@ -111414,7 +111985,7 @@ function resolveApp2(ctx, app) {
   return name;
 }
 async function githubConnect(ctx, input) {
-  const appRef2 = resolveApp2(ctx, input.app);
+  const appRef2 = resolveApp3(ctx, input.app);
   const branch = input.branch ?? "main";
   let deployment;
   let created;
@@ -111494,7 +112065,7 @@ var githubSetupWebhookInputSchema = exports_external.object({
   app: exports_external.string().optional().describe("App name (overrides percher.toml)")
 });
 async function githubSetupWebhook(ctx, input) {
-  const appRef2 = resolveApp2(ctx, input.app);
+  const appRef2 = resolveApp3(ctx, input.app);
   const webhook = await ctx.client.apps.setupWebhook(appRef2);
   const repoBase = webhook.instructions.repo.replace(/\.git$/, "");
   return {
@@ -111559,11 +112130,17 @@ async function hookRevoke(ctx, input) {
   await ctx.client.hooks.revoke(app.id, input.id);
 }
 // ../core/dist/commands/import-project.js
-import { existsSync as existsSync11, readFileSync as readFileSync8, writeFileSync as writeFileSync7 } from "node:fs";
-import { join as join15 } from "node:path";
+import { existsSync as existsSync11, readFileSync as readFileSync9, writeFileSync as writeFileSync8 } from "node:fs";
+import { join as join16 } from "node:path";
 
 // ../core/dist/static-docker.js
 var STATIC_DOCKER_PORT = 8080;
+var INIT_TEMPLATE_FRAMEWORKS = new Set([
+  "astro",
+  "preact",
+  "solid",
+  "vite"
+]);
 function renderStaticFrameworkDockerfile(input) {
   return `# Multi-stage build: a Bun stage compiles the static bundle, then a
 # minimal Caddy image serves it. This project uses runtime = "docker"
@@ -111581,7 +112158,7 @@ RUN bun install && bun run build
 # Build pinned Caddy source with refreshed security modules. The scratch
 # runtime carries no shell, package manager, or file capabilities and listens
 # on the unprivileged port :${STATIC_DOCKER_PORT}.
-FROM golang:1.26.7-alpine3.23@sha256:b17af760035fc2f338eed92d448a6c67f2d45438844fc6c60678fa5f99e44b57 AS caddy-source
+FROM golang:1.26.9-alpine3.23@sha256:6750308561953d451210ed1a8086d36c8c8bdcbf672d38d9d0d424b8a7a0216c AS caddy-source
 ADD --checksum=sha256:78e660d838e45c0b8c89338b325946238f153641aa9925df9ef2ad5e8eced31b \\
   https://github.com/caddyserver/caddy/commit/b2693fb63a30e6d7be0972c3645e9a2c0a500e93.patch /tmp/caddy-cel-go.patch
 RUN go mod download github.com/caddyserver/caddy/v2@v2.11.4 \\
@@ -111591,9 +112168,15 @@ WORKDIR /src
 RUN apk add --no-cache patch \\
  && patch -p1 < /tmp/caddy-cel-go.patch \\
  && go get github.com/go-chi/chi/v5@v5.3.0 github.com/google/cel-go@v0.29.2 \\
-      github.com/klauspost/compress@v1.18.7 go.opentelemetry.io/otel@v1.44.0 \\
-      golang.org/x/crypto@v0.55.0 golang.org/x/net@v0.58.0 \\
-      golang.org/x/text@v0.41.0 google.golang.org/grpc@v1.83.2 \\
+      github.com/klauspost/compress@v1.18.7 go.opentelemetry.io/otel@v1.45.0 \\
+      go.opentelemetry.io/otel/sdk/log@v0.21.0 \\
+      go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc@v0.21.0 \\
+      go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.21.0 \\
+      go.opentelemetry.io/otel/exporters/stdout/stdoutlog@v0.21.0 \\
+      go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.45.0 \\
+      go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.45.0 \\
+      golang.org/x/crypto@v0.57.0 golang.org/x/net@v0.60.0 \\
+      golang.org/x/text@v0.42.0 google.golang.org/grpc@v1.83.2 \\
  && go mod tidy \\
  && CGO_ENABLED=0 go build -trimpath -ldflags "-s -w" -o /out/caddy ./cmd/caddy \\
  && printf '%s\\n' \\
@@ -111631,6 +112214,15 @@ ${body}
 }
 `;
 }
+var TEMPLATE_GO_PINS = readGoPins(renderStaticFrameworkDockerfile({ outputDir: "dist" }));
+function readGoPins(dockerfile) {
+  const modules = {};
+  for (const m of dockerfile.matchAll(/([a-z0-9-]+(?:\.[a-z0-9-]+)+\/[^\s@\\]+)@v(\d[^\s\\]*)/g)) {
+    if (m[1] && m[2])
+      modules[m[1]] = m[2];
+  }
+  return { go: /^FROM golang:(\d+\.\d+\.\d+)/m.exec(dockerfile)?.[1] ?? null, modules };
+}
 
 // ../core/dist/commands/import-project.js
 var importInputSchema = exports_external.object({
@@ -111638,9 +112230,9 @@ var importInputSchema = exports_external.object({
   app: exports_external.string().optional().describe("App name to import into")
 });
 function detectProvider(cwd) {
-  if (existsSync11(join15(cwd, "vercel.json")))
+  if (existsSync11(join16(cwd, "vercel.json")))
     return "vercel";
-  if (existsSync11(join15(cwd, "netlify.toml")))
+  if (existsSync11(join16(cwd, "netlify.toml")))
     return "netlify";
   return null;
 }
@@ -111976,7 +112568,7 @@ function mapVercelFramework(framework) {
   return map2[framework ?? ""] ?? { runtime: "node" };
 }
 function parseVercelJson(cwd) {
-  const raw = readFileSync8(join15(cwd, "vercel.json"), "utf-8");
+  const raw = readFileSync9(join16(cwd, "vercel.json"), "utf-8");
   const config2 = JSON.parse(raw);
   const warnings = [];
   const envVars = [];
@@ -112032,12 +112624,12 @@ health = "/api/health"
   return { toml, warnings, envVars, staticBuild, redirects, headers };
 }
 function parseNetlifyToml(cwd) {
-  const raw = readFileSync8(join15(cwd, "netlify.toml"), "utf-8");
+  const raw = readFileSync9(join16(cwd, "netlify.toml"), "utf-8");
   const warnings = [];
   const envVars = [];
   const buildCommand = raw.match(/command\s*=\s*"([^"]+)"/)?.[1] ?? "bun run build";
   const publishDir = raw.match(/publish\s*=\s*"([^"]+)"/)?.[1] ?? "dist";
-  const hasPackageJson = existsSync11(join15(cwd, "package.json"));
+  const hasPackageJson = existsSync11(join16(cwd, "package.json"));
   const looksLikeStaticOutput = publishDir === "dist" || publishDir === "build" || publishDir === "public";
   let toml = `[app]
 name = "imported-app"
@@ -112085,23 +112677,23 @@ health = "/health"
     }
   }
   const sidecarPath = (name) => {
-    const root = join15(cwd, name);
+    const root = join16(cwd, name);
     if (existsSync11(root))
       return root;
-    const published = join15(cwd, publishDir, name);
+    const published = join16(cwd, publishDir, name);
     return existsSync11(published) ? published : null;
   };
   const redirectCollector = newRedirectCollector();
   const redirectsPath = sidecarPath("_redirects");
   if (redirectsPath) {
-    parseNetlifyRedirectsFile(readFileSync8(redirectsPath, "utf-8"), redirectCollector, warnings);
+    parseNetlifyRedirectsFile(readFileSync9(redirectsPath, "utf-8"), redirectCollector, warnings);
   }
   parseNetlifyTomlRedirects(raw, redirectCollector, warnings);
   const redirects = finishRedirects(redirectCollector, warnings, "netlify");
   const headerTable = {};
   const headersPath = sidecarPath("_headers");
   if (headersPath) {
-    parseNetlifyHeadersFile(readFileSync8(headersPath, "utf-8"), headerTable, warnings);
+    parseNetlifyHeadersFile(readFileSync9(headersPath, "utf-8"), headerTable, warnings);
   }
   const headers = finishHeaders(headerTable, warnings, "_headers");
   if (/^\s*\[\[headers\]\]/m.test(raw)) {
@@ -112170,11 +112762,11 @@ ${serialize(extras)}`;
       mapped.headerPaths = Object.keys(headers).length;
     }
   }
-  const tomlPath = join15(ctx.cwd, "percher.toml");
+  const tomlPath = join16(ctx.cwd, "percher.toml");
   if (existsSync11(tomlPath)) {
     result.warnings.unshift("percher.toml already exists — overwriting with imported config");
   }
-  writeFileSync7(tomlPath, toml);
+  writeFileSync8(tomlPath, toml);
   const scaffoldedFiles = [];
   if (result.staticBuild) {
     const targets = [
@@ -112188,12 +112780,12 @@ ${serialize(extras)}`;
       }
     ];
     for (const { name, content } of targets) {
-      const target = join15(ctx.cwd, name);
-      if (existsSync11(target)) {
+      const target2 = join16(ctx.cwd, name);
+      if (existsSync11(target2)) {
         result.warnings.push(`${name} already exists — left untouched. The imported config expects a multi-stage static build; merge by hand if needed.`);
         continue;
       }
-      writeFileSync7(target, content, "utf-8");
+      writeFileSync8(target2, content, "utf-8");
       scaffoldedFiles.push(name);
     }
   }
@@ -112215,12 +112807,12 @@ function parsesAsPercherToml(source) {
   }
 }
 // ../core/dist/commands/init.js
-import { existsSync as existsSync13, writeFileSync as writeFileSync8 } from "node:fs";
-import { basename as basename3, join as join17 } from "node:path";
+import { existsSync as existsSync13, writeFileSync as writeFileSync9 } from "node:fs";
+import { basename as basename3, join as join18 } from "node:path";
 
 // ../core/dist/detect.js
-import { existsSync as existsSync12, readFileSync as readFileSync9 } from "node:fs";
-import { join as join16 } from "node:path";
+import { existsSync as existsSync12, readFileSync as readFileSync10 } from "node:fs";
+import { join as join17 } from "node:path";
 function readPackageJson(src) {
   const raw = src.text("package.json");
   if (raw === null)
@@ -112392,10 +112984,10 @@ function detectFromSource(src) {
 }
 async function detectFramework(cwd) {
   const src = {
-    has: (...names) => names.some((n) => existsSync12(join16(cwd, n))),
+    has: (...names) => names.some((n) => existsSync12(join17(cwd, n))),
     text: (name) => {
       try {
-        return readFileSync9(join16(cwd, name), "utf8");
+        return readFileSync10(join17(cwd, name), "utf8");
       } catch {
         return null;
       }
@@ -112404,7 +112996,7 @@ async function detectFramework(cwd) {
   return detectFromSource(src);
 }
 function refineBunRuntime(detected, cwd) {
-  if (detected.runtime === "node" && (existsSync12(join16(cwd, "bun.lockb")) || existsSync12(join16(cwd, "bun.lock")))) {
+  if (detected.runtime === "node" && (existsSync12(join17(cwd, "bun.lockb")) || existsSync12(join17(cwd, "bun.lock")))) {
     return { ...detected, runtime: "bun" };
   }
   return detected;
@@ -112438,7 +113030,24 @@ function configFromDetection(name, detected, dataMode) {
 }
 
 // ../core/dist/validation/blocked-names.js
+var SENSITIVE_BRANDS = new Set([
+  "paypal",
+  "bankid",
+  "swish",
+  "swedbank",
+  "handelsbanken",
+  "nordea",
+  "seb",
+  "danskebank",
+  "mitid",
+  "nemid",
+  "mobilepay",
+  "vipps",
+  "klarna",
+  "skatteverket"
+]);
 var BLOCKED_APP_NAMES = new Set([
+  ...SENSITIVE_BRANDS,
   "api",
   "app",
   "admin",
@@ -112497,6 +113106,8 @@ var BLOCKED_APP_NAMES = new Set([
 function isBlockedName(name) {
   if (BLOCKED_APP_NAMES.has(name))
     return true;
+  if (name.split("-").some((part) => SENSITIVE_BRANDS.has(part)))
+    return true;
   const prefixes = [
     "login-",
     "signin-",
@@ -112534,6 +113145,8 @@ function adjustReservedName(name) {
   let adjusted = `app-${name}`;
   if (adjusted.length > 40)
     adjusted = adjusted.slice(0, 40).replace(/-+$/g, "");
+  if (isBlockedName(adjusted))
+    return `app-${crypto.randomUUID().slice(0, 8)}`;
   return adjusted;
 }
 function detectInteractive() {
@@ -112549,7 +113162,7 @@ function scanEnvVars(_cwd) {
   return {};
 }
 async function init(ctx, input = {}) {
-  const path = join17(ctx.cwd, "percher.toml");
+  const path = join18(ctx.cwd, "percher.toml");
   const exists = existsSync13(path);
   if (exists && !input.force) {
     throw new PercherCoreError("percher.toml already exists", {
@@ -112594,7 +113207,7 @@ async function init(ctx, input = {}) {
   if (Object.keys(envVars).length > 0) {
     config2.env = envVars;
   }
-  writeFileSync8(path, serialize(config2), "utf8");
+  writeFileSync9(path, serialize(config2), "utf8");
   const scaffoldedFiles = [];
   if (detected?.staticBuild) {
     const targets = [
@@ -112610,10 +113223,10 @@ async function init(ctx, input = {}) {
       }
     ];
     for (const { name: name2, content } of targets) {
-      const target = join17(ctx.cwd, name2);
-      if (existsSync13(target) && !input.force)
+      const target2 = join18(ctx.cwd, name2);
+      if (existsSync13(target2) && !input.force)
         continue;
-      writeFileSync8(target, content, "utf8");
+      writeFileSync9(target2, content, "utf8");
       scaffoldedFiles.push(name2);
     }
   }
@@ -113147,7 +113760,7 @@ async function inspectSupabase(ctx, input) {
   const storageBuckets = normalizeBuckets(schemaBlob.storageBuckets);
   const authUsersCount = toFiniteNumber(schemaBlob.authUsersCount);
   const warnings = collectWarnings(tables, storageBuckets, authUsersCount);
-  const summary = renderSummary({
+  const summary2 = renderSummary({
     projectRef: input.projectRef,
     tables,
     authUsersCount,
@@ -113162,7 +113775,7 @@ async function inspectSupabase(ctx, input) {
     storageBuckets,
     warnings,
     recovery: recoveryNone(),
-    summary
+    summary: summary2
   };
 }
 function failure(args) {
@@ -113690,7 +114303,7 @@ function collectWarnings2(collections, rlsPolicies, unsupported) {
 }
 // ../core/dist/commands/migrate-supabase-rewrite.js
 import { mkdir as mkdir3, writeFile as writeFile3 } from "node:fs/promises";
-import { dirname as dirname6, join as join20, relative as relative7, resolve as resolve9, sep as sep5 } from "node:path";
+import { dirname as dirname7, join as join21, relative as relative7, resolve as resolve9, sep as sep5 } from "node:path";
 
 // ../core/dist/commands/migrate-supabase-recipes.js
 var AUTH_RECIPES = {
@@ -113956,7 +114569,7 @@ function isSupabaseClientModule(source) {
 // ../core/dist/commands/migrate-supabase-status.js
 var import_cross_spawn = __toESM(require_cross_spawn(), 1);
 import { readFile as readFile4 } from "node:fs/promises";
-import { join as join19, relative as relative6, resolve as resolve8 } from "node:path";
+import { join as join20, relative as relative6, resolve as resolve8 } from "node:path";
 
 // ../core/dist/commands/migrate-supabase-sdk.js
 var import_jscodeshift2 = __toESM(require_core3(), 1);
@@ -114173,12 +114786,12 @@ function isSupabaseFromTerminal(path, supabaseNames) {
   let fromCall = null;
   let cursor = path.node;
   while (cursor.type === "CallExpression") {
-    const call = cursor;
-    if (call.callee.type !== "MemberExpression")
+    const call2 = cursor;
+    if (call2.callee.type !== "MemberExpression")
       break;
-    const callee = call.callee;
+    const callee = call2.callee;
     if (callee.property.type === "Identifier" && callee.property.name === "from") {
-      fromCall = call;
+      fromCall = call2;
       break;
     }
     cursor = callee.object;
@@ -114233,15 +114846,15 @@ function decomposeFromChain(outer) {
   const reversedSteps = [];
   let node = outer;
   while (node.type === "CallExpression") {
-    const call = node;
-    if (call.callee.type !== "MemberExpression")
+    const call2 = node;
+    if (call2.callee.type !== "MemberExpression")
       break;
-    const callee = call.callee;
+    const callee = call2.callee;
     const method = callee.property.type === "Identifier" ? callee.property.name : null;
     if (method === null)
       return null;
     if (method === "from") {
-      const arg = call.arguments[0];
+      const arg = call2.arguments[0];
       if (!arg || arg.type !== "Literal" && arg.type !== "StringLiteral")
         return null;
       const table = arg.value;
@@ -114249,7 +114862,7 @@ function decomposeFromChain(outer) {
         return null;
       return { table, steps: reversedSteps.reverse() };
     }
-    reversedSteps.push({ method, args: call.arguments });
+    reversedSteps.push({ method, args: call2.arguments });
     node = callee.object;
   }
   return null;
@@ -114674,14 +115287,14 @@ function readChainSteps(outer) {
   let cursor = outer;
   while (true) {
     if (cursor.type === "CallExpression") {
-      const call = cursor;
-      if (call.callee.type !== "MemberExpression")
+      const call2 = cursor;
+      if (call2.callee.type !== "MemberExpression")
         break;
-      const callee = call.callee;
+      const callee = call2.callee;
       if (callee.property.type === "Identifier") {
         reversed.push({
           method: callee.property.name,
-          call
+          call: call2
         });
       }
       cursor = callee.object;
@@ -114702,8 +115315,8 @@ function readChainSteps(outer) {
   }
   return reversed.reverse();
 }
-function readFirstStringArg(call) {
-  const a = call.arguments[0];
+function readFirstStringArg(call2) {
+  const a = call2.arguments[0];
   if (!a)
     return null;
   if (a.type === "Literal" || a.type === "StringLiteral") {
@@ -114893,7 +115506,7 @@ function applyRewrite(path, replacement, kind, pattern, note, flags, state) {
 // ../core/dist/commands/migrate-supabase-walker.js
 var import_ignore3 = __toESM(require_ignore(), 1);
 import { mkdir as mkdir2, readdir, readFile as readFile3, stat as stat2, writeFile as writeFile2 } from "node:fs/promises";
-import { dirname as dirname5, isAbsolute as isAbsolute3, join as join18, relative as relative5, resolve as resolve7, sep as sep4 } from "node:path";
+import { dirname as dirname6, isAbsolute as isAbsolute3, join as join19, relative as relative5, resolve as resolve7, sep as sep4 } from "node:path";
 var REWRITABLE_EXTENSIONS = new Set([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"]);
 var DEFAULT_EXCLUDES = [
   "node_modules",
@@ -115045,7 +115658,7 @@ async function* walkTree(dir, rootAbs, ig) {
     return;
   }
   for (const name of entries) {
-    const abs = join18(dir, name);
+    const abs = join19(dir, name);
     const rel = relative5(rootAbs, abs).split(sep4).join("/");
     if (rel.length > 0 && ig.ignores(rel))
       continue;
@@ -115207,7 +115820,7 @@ async function writeWalkResult(input) {
     if (rel.length === 0 || isParentTraversal || isAbsolute3(rel)) {
       throw new Error(`writeWalkResult refused path-traversing file "${file2.relativePath}" → "${abs}" (would escape targetDir "${targetAbs}").`);
     }
-    await mkdir2(dirname5(abs), { recursive: true });
+    await mkdir2(dirname6(abs), { recursive: true });
     await writeFile2(abs, file2.rewritten, "utf8");
     written.push(file2.relativePath);
   }
@@ -115448,11 +116061,11 @@ async function migrationStatus(ctx, input) {
   const warning = analysis.checks.filter((c) => c.status === "warn");
   const buildFailed = build?.ran === true && !build.passed;
   const allGreen = failing.length === 0 && warning.length === 0 && !buildFailed;
-  const recovery = allGreen ? recoveryNone() : recoveryAsk({
+  const recovery2 = allGreen ? recoveryNone() : recoveryAsk({
     prompt: buildPrompt(analysis.state, failing, warning, build),
     reasonCode: "unknown"
   });
-  const summary = `${STATE_SUMMARY[analysis.state]}${build ? ` Build: ${build.ran ? build.passed ? "passed" : "FAILED" : "skipped"}.` : ""}`;
+  const summary2 = `${STATE_SUMMARY[analysis.state]}${build ? ` Build: ${build.ran ? build.passed ? "passed" : "FAILED" : "skipped"}.` : ""}`;
   return {
     status: "ok",
     rootDir: rootAbs,
@@ -115460,8 +116073,8 @@ async function migrationStatus(ctx, input) {
     migrationComplete: analysis.migrationComplete,
     checks: analysis.checks,
     ...build ? { build } : {},
-    recovery,
-    summary,
+    recovery: recovery2,
+    summary: summary2,
     checklist
   };
 }
@@ -115482,7 +116095,7 @@ function buildPrompt(state, failing, warning, build) {
 async function readManualRlsCount(rootAbs) {
   for (const dir of ["migration-preview", "."]) {
     try {
-      const notes = await readFile4(join19(rootAbs, dir, "MIGRATION_NOTES.md"), "utf8");
+      const notes = await readFile4(join20(rootAbs, dir, "MIGRATION_NOTES.md"), "utf8");
       const m = notes.match(/\*\*RLS policies:\*\*\s*\d+\s*\((\d+)\s*need manual review\)/);
       if (m?.[1] !== undefined)
         return Number.parseInt(m[1], 10);
@@ -115494,7 +116107,7 @@ async function readManualRlsCount(rootAbs) {
 async function runProjectBuild(rootAbs) {
   let hasBuildScript = false;
   try {
-    const pkg = JSON.parse(await readFile4(join19(rootAbs, "package.json"), "utf8"));
+    const pkg = JSON.parse(await readFile4(join20(rootAbs, "package.json"), "utf8"));
     hasBuildScript = typeof pkg.scripts?.build === "string";
   } catch {
     return { ran: false, passed: false, detail: "No readable package.json — nothing to build." };
@@ -115526,7 +116139,7 @@ ${tail}` : ""}`
 async function detectPackageManager(rootAbs) {
   const has = async (name) => {
     try {
-      await readFile4(join19(rootAbs, name), "utf8");
+      await readFile4(join20(rootAbs, name), "utf8");
       return true;
     } catch {
       return false;
@@ -115656,8 +116269,8 @@ async function rewriteSupabaseClient(ctx, input) {
     flags.push(...scaffold.flags);
   }
   const reportNeeded = hadRewrites || flags.length > 0 || walk2.skipped.length > 0;
-  const backupDir = apply && changed.length > 0 ? join20(rootAbs, "migration-preview", "backup") : null;
-  const rewriteTarget = apply ? rootAbs : input.outputDir ? resolve9(ctx.cwd, input.outputDir) : join20(rootAbs, "migration-preview", "rewritten");
+  const backupDir = apply && changed.length > 0 ? join21(rootAbs, "migration-preview", "backup") : null;
+  const rewriteTarget = apply ? rootAbs : input.outputDir ? resolve9(ctx.cwd, input.outputDir) : join21(rootAbs, "migration-preview", "rewritten");
   const filesWritten = [];
   let clientModuleWritten = null;
   try {
@@ -115677,19 +116290,19 @@ async function rewriteSupabaseClient(ctx, input) {
         changedOnly: true
       });
       for (const rel of out.written) {
-        filesWritten.push(relative7(ctx.cwd, join20(rewriteTarget, rel)));
+        filesWritten.push(relative7(ctx.cwd, join21(rewriteTarget, rel)));
       }
       if (scaffold?.clientModule) {
-        const moduleAbs = join20(rewriteTarget, scaffold.clientModule.relativePath);
-        await mkdir3(dirname6(moduleAbs), { recursive: true });
+        const moduleAbs = join21(rewriteTarget, scaffold.clientModule.relativePath);
+        await mkdir3(dirname7(moduleAbs), { recursive: true });
         await writeFile3(moduleAbs, scaffold.clientModule.content, "utf8");
         clientModuleWritten = relative7(ctx.cwd, moduleAbs).split(sep5).join("/");
         filesWritten.push(clientModuleWritten);
       }
     }
     if (reportNeeded) {
-      const reportAbs = join20(rootAbs, "migration-preview", "REWRITE_NOTES.md");
-      await mkdir3(dirname6(reportAbs), { recursive: true });
+      const reportAbs = join21(rootAbs, "migration-preview", "REWRITE_NOTES.md");
+      await mkdir3(dirname7(reportAbs), { recursive: true });
       const analysis = analyzeMigration(walk2.files.map((f) => ({
         relativePath: f.relativePath,
         kind: f.kind,
@@ -115714,7 +116327,7 @@ async function rewriteSupabaseClient(ctx, input) {
   for (const flag of flags) {
     flagsByPattern[flag.pattern] = (flagsByPattern[flag.pattern] ?? 0) + 1;
   }
-  const recovery = reportNeeded ? recoveryAsk({
+  const recovery2 = reportNeeded ? recoveryAsk({
     prompt: buildPrompt2(flags, walk2.skipped.length, hadRewrites, clientModuleWritten),
     reasonCode: "unknown"
   }) : recoveryNone();
@@ -115732,7 +116345,7 @@ async function rewriteSupabaseClient(ctx, input) {
     envFilesChanged: walk2.summary.envFilesChanged,
     clientModule: clientModuleWritten,
     skipped: walk2.skipped,
-    recovery,
+    recovery: recovery2,
     summary: renderSummary2({
       mode,
       changed: changed.length,
@@ -115941,7 +116554,7 @@ function failure3(rootAbs, mode, err, suggestion) {
 }
 // ../core/dist/commands/migrate-supabase-schema.js
 import { mkdir as mkdir4, writeFile as writeFile4 } from "node:fs/promises";
-import { isAbsolute as isAbsolute4, join as join21, relative as relative8, resolve as resolve10 } from "node:path";
+import { isAbsolute as isAbsolute4, join as join22, relative as relative8, resolve as resolve10 } from "node:path";
 
 // ../core/dist/commands/migrate-supabase-scripts.js
 function generateDataImportScripts(preview) {
@@ -115974,13 +116587,13 @@ function topologicalSort(collections) {
     for (const field of c.schema) {
       if (field.type !== "relation")
         continue;
-      const target = field.options.collectionName;
-      if (target === c.name)
+      const target2 = field.options.collectionName;
+      if (target2 === c.name)
         continue;
-      if (!byName.has(target))
+      if (!byName.has(target2))
         continue;
-      dependsOn.get(c.name)?.add(target);
-      dependents.get(target)?.add(c.name);
+      dependsOn.get(c.name)?.add(target2);
+      dependents.get(target2)?.add(c.name);
     }
   }
   const inputOrder = collections.map((c) => c.name);
@@ -116221,7 +116834,7 @@ function renderRowTransform(collection) {
   }
   for (const rel of relations) {
     const fieldName = rel.name;
-    const target = rel.options.collectionName;
+    const target2 = rel.options.collectionName;
     const isAuthUsersRef = rel.source.flag === "auth_users_reference";
     if (isAuthUsersRef) {
       parts.push(`  if (rest[${JSON.stringify(fieldName)}] != null) {`);
@@ -116231,9 +116844,9 @@ function renderRowTransform(collection) {
       continue;
     }
     parts.push(`  if (rest[${JSON.stringify(fieldName)}] != null) {`);
-    parts.push(`    const mapped = lookupId(${JSON.stringify(target)}, rest[${JSON.stringify(fieldName)}]);`);
+    parts.push(`    const mapped = lookupId(${JSON.stringify(target2)}, rest[${JSON.stringify(fieldName)}]);`);
     parts.push("    if (mapped === undefined) {");
-    parts.push(`      throw new Error(\`[${collection.name}.${fieldName}] no PB id for source value '\${rest[${JSON.stringify(fieldName)}]}' in ${target} map — was ${target} migrated first?\`);`);
+    parts.push(`      throw new Error(\`[${collection.name}.${fieldName}] no PB id for source value '\${rest[${JSON.stringify(fieldName)}]}' in ${target2} map — was ${target2} migrated first?\`);`);
     parts.push("    }");
     parts.push(`    rest[${JSON.stringify(fieldName)}] = mapped;`);
     parts.push("  }");
@@ -116436,7 +117049,7 @@ async function migrateSupabaseSchema(ctx, input) {
       }
     };
   }
-  const summary = renderSummary3({
+  const summary2 = renderSummary3({
     projectRef: input.projectRef,
     outputDirRel,
     inspection,
@@ -116449,7 +117062,7 @@ async function migrateSupabaseSchema(ctx, input) {
     filesWritten,
     preview,
     recovery: recoveryNone(),
-    summary
+    summary: summary2
   };
 }
 function resolveOutputDir(cwd, requested) {
@@ -116461,10 +117074,10 @@ async function writePreviewFiles(ctx, outputDir, preview) {
   const schemaJson = renderSchemaJson(preview);
   const notesMd = renderMigrationNotes(preview);
   const scripts = generateDataImportScripts(preview);
-  const schemaPath = join21(outputDir, "pb_schema.json");
-  const notesPath = join21(outputDir, "MIGRATION_NOTES.md");
-  const migratePath = join21(outputDir, "pb_migrate.js");
-  const storagePath = join21(outputDir, "pb_migrate_storage.js");
+  const schemaPath = join22(outputDir, "pb_schema.json");
+  const notesPath = join22(outputDir, "MIGRATION_NOTES.md");
+  const migratePath = join22(outputDir, "pb_migrate.js");
+  const storagePath = join22(outputDir, "pb_migrate_storage.js");
   await writeFile4(schemaPath, schemaJson, "utf8");
   await writeFile4(notesPath, notesMd, "utf8");
   await writeFile4(migratePath, scripts.pbMigrate, "utf8");
@@ -116549,8 +117162,8 @@ function renderMigrationNotes(preview) {
         lines.push("| Field | Type | Required | Postgres source | Flag |");
         lines.push("|---|---|---|---|---|");
         for (const field of collection.schema) {
-          const target = field.type === "relation" ? `relation → \`${field.options.collectionName}\`` : field.type;
-          lines.push(`| \`${field.name}\` | ${target} | ${field.required ? "yes" : "no"} | \`${field.source.postgresType}\` | ${field.source.flag ? `\`${field.source.flag}\`` : "—"} |`);
+          const target2 = field.type === "relation" ? `relation → \`${field.options.collectionName}\`` : field.type;
+          lines.push(`| \`${field.name}\` | ${target2} | ${field.required ? "yes" : "no"} | \`${field.source.postgresType}\` | ${field.source.flag ? `\`${field.source.flag}\`` : "—"} |`);
         }
         lines.push("");
       }
@@ -116658,7 +117271,7 @@ var previewBranchSetInputSchema = exports_external.object({
 var previewBranchInputSchema = exports_external.object({
   app: exports_external.string().optional()
 });
-function resolveApp3(ctx, app) {
+function resolveApp4(ctx, app) {
   const name = app ?? readPercherTomlAppName(ctx.cwd);
   if (!name) {
     throw new PercherCoreError("No app specified and no percher.toml found", {
@@ -116669,11 +117282,11 @@ function resolveApp3(ctx, app) {
   return name;
 }
 async function previewBranchSet(ctx, input) {
-  const appRef2 = resolveApp3(ctx, input.app);
+  const appRef2 = resolveApp4(ctx, input.app);
   return ctx.client.apps.setPreviewBranch(appRef2, input.branch);
 }
 async function previewBranchUnset(ctx, input = {}) {
-  const appRef2 = resolveApp3(ctx, input.app);
+  const appRef2 = resolveApp4(ctx, input.app);
   return ctx.client.apps.unsetPreviewBranch(appRef2);
 }
 var setPreviewBranchToolInputSchema = exports_external.object({
@@ -116681,7 +117294,7 @@ var setPreviewBranchToolInputSchema = exports_external.object({
   branch: exports_external.string().nullable().describe("Branch to pin as the preview address; pass null to clear it.")
 });
 async function previewBranchShow(ctx, input = {}) {
-  const appRef2 = resolveApp3(ctx, input.app);
+  const appRef2 = resolveApp4(ctx, input.app);
   const app = await ctx.client.apps.get(appRef2);
   return {
     previewBranch: app.previewBranch ?? null,
@@ -116690,14 +117303,14 @@ async function previewBranchShow(ctx, input = {}) {
   };
 }
 async function previewList(ctx, input = {}) {
-  const appRef2 = resolveApp3(ctx, input.app);
+  const appRef2 = resolveApp4(ctx, input.app);
   const app = await ctx.client.apps.get(appRef2);
   return { app: app.name, previews: app.previews ?? [] };
 }
 // ../core/dist/commands/publish.js
 init_dist();
 import { existsSync as existsSync15 } from "node:fs";
-import { join as join24 } from "node:path";
+import { join as join25 } from "node:path";
 
 // ../shared/dist/pow.js
 import { createHash as createHash3 } from "node:crypto";
@@ -117101,8 +117714,8 @@ async function runDeployWithRetry(opts) {
 
 // ../core/dist/commands/env-scan.js
 init_dist();
-import { readdirSync as readdirSync3, readFileSync as readFileSync10, statSync as statSync3 } from "node:fs";
-import { join as join22 } from "node:path";
+import { readdirSync as readdirSync3, readFileSync as readFileSync11, statSync as statSync3 } from "node:fs";
+import { join as join23 } from "node:path";
 function platformInjectedClientEnvKeys(config2) {
   const data2 = config2.data;
   if (!data2)
@@ -117160,7 +117773,7 @@ function scanForMissingBuildEnvRefs(cwd, existingKeys) {
       continue;
     let content;
     try {
-      content = readFileSync10(join22(cwd, rel), "utf8");
+      content = readFileSync11(join23(cwd, rel), "utf8");
     } catch {
       continue;
     }
@@ -117192,7 +117805,7 @@ function* walkDir(dir, base) {
   for (const name of entries) {
     if (SKIP_DIRS.has(name))
       continue;
-    const full = join22(dir, name);
+    const full = join23(dir, name);
     let st;
     try {
       st = statSync3(full);
@@ -117209,6 +117822,47 @@ function* walkDir(dir, base) {
 
 // ../core/dist/commands/publish-api-error.js
 init_dist();
+
+// ../core/dist/commands/publish-rate-limit.js
+var RATE_LIMIT_CODES = new Set([
+  "DEPLOY_RATE_LIMIT",
+  "DEPLOY_RATE_LIMITED",
+  "RATE_LIMIT_EXCEEDED"
+]);
+function matchRateLimit(err) {
+  if (!RATE_LIMIT_CODES.has(err.code))
+    return null;
+  const wait = boundedSeconds(err.extra?.retryAfterSec);
+  return {
+    title: "Rate limit hit",
+    explanation: err.message,
+    suggestion: "Wait a few minutes and try again. If you need a higher cap, upgrade at https://percher.app/account/billing.",
+    recovery: recoveryAsk({
+      prompt: `Percher is rate-limiting deploys for this app${wait ? `; wait at least ${wait}s` : " — the window is up to an hour"}. This is a burst/hourly limit, not the daily deploy quota. Wait and retry, or upgrade the plan for a higher cap — which would you like?`,
+      options: ["wait and retry", "upgrade", "cancel"],
+      reasonCode: "quota_exceeded"
+    }),
+    summary: `Rate limit hit: ${err.message}`
+  };
+}
+function matchConnectionRateLimit(err) {
+  if (err.code !== "OAUTH_GRANT_RATE_LIMITED")
+    return null;
+  const wait = boundedSeconds(err.extra?.retryAfterSec) ?? 60;
+  return {
+    title: "Connection rate limit hit",
+    explanation: err.message,
+    suggestion: `Wait ${wait}s, then publish again. Nothing in the app needs to change.`,
+    recovery: recoveryAsk({
+      prompt: `Percher is limiting requests on this connection; wait at least ${wait}s, then publish again. Nothing in the app needs to change. Wait and retry, or cancel?`,
+      options: ["wait and retry", "cancel"],
+      reasonCode: "quota_exceeded"
+    }),
+    summary: `Connection rate limit hit. Retry in ${wait}s.`
+  };
+}
+
+// ../core/dist/commands/publish-api-error.js
 var DEPLOY_GATE_CODES = new Set([
   "RETRY_LIMIT_REACHED",
   "REQUIRED_ENV_MISSING",
@@ -117228,6 +117882,9 @@ function classifyPublishApiError(err, input) {
   const rateLimit = matchRateLimit(err);
   if (rateLimit)
     return buildResult(rateLimit, input);
+  const connectionLimit = matchConnectionRateLimit(err);
+  if (connectionLimit)
+    return buildResult(connectionLimit, input);
   const concurrent = matchConcurrentLimit(err);
   if (concurrent)
     return buildResult(concurrent, input);
@@ -117313,27 +117970,6 @@ function matchPlanLimit(err) {
     summary: `Plan limit reached: ${err.message}`
   };
 }
-var RATE_LIMIT_CODES = new Set([
-  "DEPLOY_RATE_LIMIT",
-  "DEPLOY_RATE_LIMITED",
-  "RATE_LIMIT_EXCEEDED"
-]);
-function matchRateLimit(err) {
-  if (!RATE_LIMIT_CODES.has(err.code))
-    return null;
-  const wait = boundedSeconds(err.extra?.retryAfterSec);
-  return {
-    title: "Rate limit hit",
-    explanation: err.message,
-    suggestion: "Wait a few minutes and try again. If you need a higher cap, upgrade at https://percher.app/account/billing.",
-    recovery: recoveryAsk({
-      prompt: `Percher is rate-limiting deploys for this app${wait ? `; wait at least ${wait}s` : " — the window is up to an hour"}. This is a burst/hourly limit, not the daily deploy quota. Wait and retry, or upgrade the plan for a higher cap — which would you like?`,
-      options: ["wait and retry", "upgrade", "cancel"],
-      reasonCode: "quota_exceeded"
-    }),
-    summary: `Rate limit hit: ${err.message}`
-  };
-}
 var PLATFORM_DISK_CODES2 = new Set(["PLATFORM_DISK_LOW", "PLATFORM_DISK_UNKNOWN"]);
 function matchPlatformDisk(err) {
   if (!PLATFORM_DISK_CODES2.has(err.code))
@@ -117691,22 +118327,22 @@ function inFlightPublishResult(p, why) {
 }
 
 // ../core/dist/commands/publish-node.js
-import { existsSync as existsSync14, readFileSync as readFileSync11 } from "node:fs";
-import { join as join23 } from "node:path";
+import { existsSync as existsSync14, readFileSync as readFileSync12 } from "node:fs";
+import { join as join24 } from "node:path";
 function resolveNodeVersion(cwd) {
-  const nvmrc = join23(cwd, ".nvmrc");
+  const nvmrc = join24(cwd, ".nvmrc");
   if (existsSync14(nvmrc)) {
     try {
-      const v = readFileSync11(nvmrc, "utf8").trim();
+      const v = readFileSync12(nvmrc, "utf8").trim();
       if (v)
         return { value: v, source: ".nvmrc" };
     } catch {}
   }
-  const pkgPath = join23(cwd, "package.json");
+  const pkgPath = join24(cwd, "package.json");
   if (!existsSync14(pkgPath))
     return null;
   try {
-    const pkg = JSON.parse(readFileSync11(pkgPath, "utf8"));
+    const pkg = JSON.parse(readFileSync12(pkgPath, "utf8"));
     const engines = pkg?.engines?.node;
     if (typeof engines === "string" && engines.length > 0) {
       return { value: engines, source: "engines.node" };
@@ -117714,6 +118350,34 @@ function resolveNodeVersion(cwd) {
   } catch {}
   return { value: DEFAULT_NODE_VERSION_LABEL, source: "default" };
 }
+function emitPreflight(ctx, config2, tarball) {
+  const lines = [];
+  const fw = config2.app.framework ?? (config2.app.runtime === "docker" ? "Dockerfile" : config2.app.runtime);
+  lines.push(`Detected: ${fw} (runtime=${config2.app.runtime})`);
+  if (config2.app.runtime === "bun") {
+    lines.push("Bun:      1.x (default)");
+  } else if (config2.app.runtime === "node") {
+    const node = resolveNodeVersion(tarball.cwd);
+    if (node) {
+      lines.push(`Node:     ${node.value} (${node.source})`);
+    }
+  }
+  if (config2.build?.command) {
+    lines.push(`Build:    ${config2.build.command}`);
+  }
+  if (config2.web?.health) {
+    lines.push(`Health:   ${config2.web.health}`);
+  }
+  if (config2.web?.port) {
+    lines.push(`Port:     ${config2.web.port}`);
+  }
+  const sizeKb = (tarball.bytes / 1024).toFixed(1);
+  lines.push(`Bundle:   ${tarball.fileCount} files, ${sizeKb} KB`);
+  lines.push(`Target:   ${config2.app.name}`);
+  for (const line of lines) {
+    ctx.status(line);
+  }
+}
 
 // ../core/dist/commands/publish.js
 var publishInputSchema = exports_external.object({
@@ -117729,7 +118393,7 @@ var publishInputSchema = exports_external.object({
 var SUSPICIOUS_BYTES = 50 * 1024 * 1024;
 var SUSPICIOUS_FILES = 1e4;
 function tomlPathFor2(cwd) {
-  return join24(cwd, "percher.toml");
+  return join25(cwd, "percher.toml");
 }
 async function buildReplacedResult2(opts) {
   const { ctx, app, deployment, tarball, cwd } = opts;
@@ -117885,7 +118549,7 @@ ${bullets}`,
       bundle: { fileCount: 0, bytes: 0 }
     };
   }
-  if (preParsedConfig && !input.dryRun && !existsSync15(join24(ctx.cwd, "percher.toml"))) {
+  if (preParsedConfig && !input.dryRun && !existsSync15(join25(ctx.cwd, "percher.toml"))) {
     return {
       status: "failed",
       fileCount: 0,
@@ -118178,7 +118842,6 @@ async function finalizeDeploy(opts) {
       intervalMs: 2000,
       timeoutMs,
       appName: app.name,
-      terminal: ["live", "failed", "replaced"],
       onTick: (d) => {
         const elapsedMs = Date.now() - buildStart;
         if (d.status !== lastStatus) {
@@ -118202,7 +118865,8 @@ async function finalizeDeploy(opts) {
       }
     });
   } catch (err) {
-    if (err instanceof DeployPollLostContactError)
+    const serverError = err instanceof PercherApiError && err.status >= 500 && err.status < 600;
+    if (err instanceof DeployPollLostContactError || serverError)
       return inFlightPublishResult(inFlight(), "lost_contact");
     if (!timedOut)
       throw err;
@@ -118234,8 +118898,8 @@ async function finalizeDeploy(opts) {
   const buildMs = Date.now() - buildStart;
   if (deployment.isCheck && deployment.checkPassed) {
     const totalSeconds2 = (Date.now() - t0) / 1000;
-    const summary = `${app.name} check passed (${Math.round(totalSeconds2)}s) — would build and boot. The live app was not changed.`;
-    ctx.status(summary);
+    const summary2 = `${app.name} check passed (${Math.round(totalSeconds2)}s) — would build and boot. The live app was not changed.`;
+    ctx.status(summary2);
     return {
       status: "check_passed",
       app,
@@ -118252,7 +118916,7 @@ async function finalizeDeploy(opts) {
       missingBuildEnvKeys: missingBuildEnvKeys.length > 0 ? missingBuildEnvKeys : undefined,
       traceId: deployment.id,
       recovery: RECOVERY_NONE,
-      summary,
+      summary: summary2,
       configPath: tomlPathFor2(ctx.cwd),
       bundle: { fileCount: tarball.fileCount, bytes: tarball.bytes }
     };
@@ -118420,6 +119084,7 @@ async function handleUnauthorized(ctx, config2, tarball, input) {
 async function handleAnonymousPublish(ctx, config2, input, tarball) {
   const anonClient = new PercherClient({
     apiUrl: ctx.client.apiUrl,
+    token: null,
     sessionId: ctx.client.sessionId
   });
   let created;
@@ -118432,7 +119097,8 @@ async function handleAnonymousPublish(ctx, config2, input, tarball) {
     created = await anonClient.anon.createAnonApp({
       name: config2.app.name,
       powChallengeId: ch.challengeId,
-      powSolution: solution
+      powSolution: solution,
+      ...ctx.syntheticFixture ? { testFixturePermit: ctx.syntheticFixture.permit } : {}
     });
   } catch (err) {
     const httpStatus = err.status;
@@ -118473,13 +119139,15 @@ async function handleAnonymousPublish(ctx, config2, input, tarball) {
       bundle: { fileCount: tarball.fileCount, bytes: tarball.bytes }
     };
   }
-  if (!hasPersistedToken())
-    saveConfig({ token: created.token });
-  setAnonClaim({
-    app: created.app.name,
-    claimToken: created.claimToken,
-    expiresAt: created.expiresAt
-  });
+  if (!ctx.syntheticFixture) {
+    if (!hasPersistedToken())
+      saveConfig({ token: created.token });
+    setAnonClaim({
+      app: created.app.name,
+      claimToken: created.claimToken,
+      expiresAt: created.expiresAt
+    });
+  }
   const newClient = new PercherClient({
     apiUrl: ctx.client.apiUrl,
     token: created.token,
@@ -118487,6 +119155,10 @@ async function handleAnonymousPublish(ctx, config2, input, tarball) {
   });
   ctx.client = newClient;
   ctx.setClient?.(newClient);
+  if (ctx.syntheticFixture) {
+    ctx.syntheticFixture.appId = created.app.id;
+    ctx.syntheticFixture.created(created.app);
+  }
   config2.app.name = created.app.name;
   const t0 = Date.now();
   const freshTarball = await createTarball({ cwd: ctx.cwd, config: config2 });
@@ -118521,7 +119193,7 @@ async function handleAnonymousPublish(ctx, config2, input, tarball) {
 async function loadOrGenerate(ctx, preParsed) {
   if (preParsed)
     return structuredClone(preParsed);
-  const tomlPath = join24(ctx.cwd, "percher.toml");
+  const tomlPath = join25(ctx.cwd, "percher.toml");
   if (!existsSync15(tomlPath)) {
     ctx.status("No percher.toml found — detecting framework...");
     const generated = await init(ctx);
@@ -118532,45 +119204,27 @@ async function loadOrGenerate(ctx, preParsed) {
 async function ensureApp2(ctx, config2) {
   try {
     const app = await ctx.client.apps.get(config2.app.name);
+    if (ctx.syntheticFixture && app.id !== ctx.syntheticFixture.appId) {
+      throw new Error("Disposable fixture publishing requires a new app.");
+    }
     return { app, firstDeploy: false };
   } catch (err) {
     if (err.code === "APP_NOT_FOUND") {
       const app = await ctx.client.apps.create({
         name: config2.app.name,
         runtime: config2.app.runtime,
-        framework: config2.app.framework
+        framework: config2.app.framework,
+        ...ctx.syntheticFixture ? { testFixturePermit: ctx.syntheticFixture.permit } : {}
       });
+      if (ctx.syntheticFixture) {
+        ctx.syntheticFixture.appId = app.id;
+        ctx.syntheticFixture.created(app);
+      }
       return { app, firstDeploy: true };
     }
     throw err;
   }
 }
-function emitPreflight(ctx, config2, tarball) {
-  const lines = [];
-  const fw = config2.app.framework ?? (config2.app.runtime === "docker" ? "Dockerfile" : config2.app.runtime);
-  lines.push(`Detected: ${fw} (runtime=${config2.app.runtime})`);
-  if (config2.app.runtime === "node" || config2.app.runtime === "bun") {
-    const node = resolveNodeVersion(tarball.cwd);
-    if (node) {
-      lines.push(`Node:     ${node.value} (${node.source})`);
-    }
-  }
-  if (config2.build?.command) {
-    lines.push(`Build:    ${config2.build.command}`);
-  }
-  if (config2.web?.health) {
-    lines.push(`Health:   ${config2.web.health}`);
-  }
-  if (config2.web?.port) {
-    lines.push(`Port:     ${config2.web.port}`);
-  }
-  const sizeKb = (tarball.bytes / 1024).toFixed(1);
-  lines.push(`Bundle:   ${tarball.fileCount} files, ${sizeKb} KB`);
-  lines.push(`Target:   ${config2.app.name}`);
-  for (const line of lines) {
-    ctx.status(line);
-  }
-}
 // ../core/dist/commands/publish-from-repo.js
 init_dist();
 var publishFromRepoInputSchema = exports_external.object({
@@ -118601,7 +119255,7 @@ var publishInlineInputSchema = exports_external.object({
 // ../core/dist/commands/push.js
 init_dist();
 import { existsSync as existsSync16 } from "node:fs";
-import { join as join25 } from "node:path";
+import { join as join26 } from "node:path";
 var pushInputSchema = exports_external.object({
   dryRun: exports_external.boolean().optional(),
   force: exports_external.boolean().optional(),
@@ -118612,7 +119266,7 @@ var SUSPICIOUS_BYTES2 = 50 * 1024 * 1024;
 var SUSPICIOUS_FILES2 = 1e4;
 var PLACEHOLDER_PREFIXES = ["add-your-", "your-key-here"];
 async function loadOrGenerate2(ctx) {
-  const tomlPath = join25(ctx.cwd, "percher.toml");
+  const tomlPath = join26(ctx.cwd, "percher.toml");
   if (!existsSync16(tomlPath)) {
     ctx.status("No percher.toml found — detecting framework...");
     const result = await init(ctx);
@@ -118724,7 +119378,7 @@ async function push(ctx, input = {}, internals = {}) {
       fileCount: tarball.fileCount,
       recovery: RECOVERY_NONE,
       summary: `Dry run for ${config2.app.name}: ${tarball.fileCount} files, ${(tarball.bytes / 1024).toFixed(1)} KB — no deploy performed.`,
-      configPath: join25(ctx.cwd, "percher.toml"),
+      configPath: join26(ctx.cwd, "percher.toml"),
       bundle: { fileCount: tarball.fileCount, bytes: tarball.bytes }
     };
   }
@@ -118876,12 +119530,13 @@ async function push(ctx, input = {}, internals = {}) {
       });
     }
   });
+  throwIfDeploymentReplaced(app.name, deployment);
   if (deployment.status === "failed") {
     const errorDetail = deployment.errorMessage ? `
 ${deployment.errorMessage}` : "";
     const fromCode = classifyByErrorCode(deployment.errorCode, deployment.errorMessage ?? "");
     const classified = fromCode ?? classifyError(deployment.errorMessage ?? "", "");
-    const recovery = classified ? recoveryFromErrorClass(classified.errorClass, {
+    const recovery2 = classified ? recoveryFromErrorClass(classified.errorClass, {
       missingEnvVars: classified.missingEnvVars,
       deployId: deployment.id,
       appName: app.name,
@@ -118895,7 +119550,7 @@ ${deployment.errorMessage}` : "";
     throw new PercherCoreError(`Deployment failed (deploy ${deployment.id})${errorDetail}`, {
       code: "push.deploy-failed",
       hint: `Run \`percher deploys inspect ${deployment.id}\` to see the full build log and error. ${deployment.errorMessage ? "Fix the issue above and re-run." : "Look for the failing step in the build log."}`,
-      recovery
+      recovery: recovery2
     });
   }
   const totalSec = ((Date.now() - startedAt) / 1000).toFixed(0);
@@ -118903,7 +119558,7 @@ ${deployment.errorMessage}` : "";
   ctx.status(displayUrl ? `Preview at ${displayUrl} (${totalSec}s)` : `Live at ${deployment.url ?? app.url} (${totalSec}s)`);
   const finalUrl = displayUrl ?? deployment.url ?? app.url;
   const fwSuffix = config2.app.framework ? ` (${config2.app.framework}, ${totalSec}s)` : ` (${totalSec}s)`;
-  const summary = `${app.name} ${displayUrl ? "preview deployed" : "deployed"}${fwSuffix} → ${finalUrl}`;
+  const summary2 = `${app.name} ${displayUrl ? "preview deployed" : "deployed"}${fwSuffix} → ${finalUrl}`;
   return {
     app,
     deployment,
@@ -118911,8 +119566,8 @@ ${deployment.errorMessage}` : "";
     bytes: tarball.bytes,
     fileCount: tarball.fileCount,
     recovery: RECOVERY_NONE,
-    summary,
-    configPath: join25(ctx.cwd, "percher.toml"),
+    summary: summary2,
+    configPath: join26(ctx.cwd, "percher.toml"),
     bundle: { fileCount: tarball.fileCount, bytes: tarball.bytes }
   };
 }
@@ -119183,9 +119838,11 @@ async function redeploy(ctx, input = {}) {
     });
   }
   const totalSeconds = (Date.now() - t0) / 1000;
+  if (deployment.status === "replaced")
+    return replacedDeploymentResult(app, deployment);
   const url2 = deployment.previewUrl ?? deployment.url ?? app.url;
   if (deployment.status === "failed") {
-    const { error: error48, recovery, summary } = await classifyDeploymentFailure({
+    const { error: error48, recovery: recovery2, summary: summary2 } = await classifyDeploymentFailure({
       ctx,
       app,
       deployment
@@ -119197,8 +119854,8 @@ async function redeploy(ctx, input = {}) {
       fileCount: 0,
       bytes: 0,
       error: error48,
-      recovery,
-      summary,
+      recovery: recovery2,
+      summary: summary2,
       configPath: "",
       bundle: { fileCount: 0, bytes: 0 }
     };
@@ -119241,8 +119898,8 @@ function failureResult(error48) {
   };
 }
 // ../core/dist/commands/rename.js
-import { existsSync as existsSync17, readFileSync as readFileSync12, writeFileSync as writeFileSync9 } from "node:fs";
-import { join as join26 } from "node:path";
+import { existsSync as existsSync17, readFileSync as readFileSync13, writeFileSync as writeFileSync10 } from "node:fs";
+import { join as join27 } from "node:path";
 var renameInputSchema = exports_external.object({
   app: exports_external.string().optional(),
   name: exports_external.string().min(3).max(40)
@@ -119262,17 +119919,17 @@ async function rename3(ctx, input) {
   };
 }
 function updateLocalTomlName(cwd, oldName, newName) {
-  const p = join26(cwd, "percher.toml");
+  const p = join27(cwd, "percher.toml");
   if (!existsSync17(p))
     return false;
   try {
-    const src = readFileSync12(p, "utf8");
+    const src = readFileSync13(p, "utf8");
     if (parse5(src).app.name !== oldName)
       return false;
     const next = src.replace(new RegExp(`(name\\s*=\\s*")${oldName}(")`), `$1${newName}$2`);
     if (next === src || parse5(next).app.name !== newName)
       return false;
-    writeFileSync9(p, next);
+    writeFileSync10(p, next);
     return true;
   } catch {
     return false;
@@ -119281,9 +119938,9 @@ function updateLocalTomlName(cwd, oldName, newName) {
 // ../core/dist/commands/reproduce.js
 init_dist();
 var import_cross_spawn3 = __toESM(require_cross_spawn(), 1);
-import { mkdtempSync, writeFileSync as writeFileSync10 } from "node:fs";
+import { mkdtempSync, writeFileSync as writeFileSync11 } from "node:fs";
 import { tmpdir } from "node:os";
-import { join as join27 } from "node:path";
+import { join as join28 } from "node:path";
 function runProcessExit(cmd, args, opts = {}) {
   return new Promise((resolve11, reject) => {
     const child = import_cross_spawn3.default(cmd, args, {
@@ -119377,9 +120034,9 @@ async function reproduce(ctx, input) {
     const envMap = await ctx.client.env.list(app.id);
     currentAppEnvKeys = Object.keys(envMap).sort();
   } catch {}
-  const tmpDir = mkdtempSync(join27(tmpdir(), `percher-reproduce-${input.deployId}-`));
-  const tarballPath = join27(tmpDir, "source.tar.gz");
-  writeFileSync10(tarballPath, bytes);
+  const tmpDir = mkdtempSync(join28(tmpdir(), `percher-reproduce-${input.deployId}-`));
+  const tarballPath = join28(tmpDir, "source.tar.gz");
+  writeFileSync11(tarballPath, bytes);
   let extracted = false;
   try {
     extracted = await runProcessExit("tar", ["-xzf", tarballPath, "-C", tmpDir]) === 0;
@@ -119596,19 +120253,19 @@ function versionAge(iso, now = Date.now()) {
     return `${d}d ago`;
   return `${Math.floor(d / 30)}mo ago`;
 }
-function rollbackTargetMarker(target, isLive) {
-  if (isLive || !target)
+function rollbackTargetMarker(target2, isLive) {
+  if (isLive || !target2)
     return "";
-  if (target.mode === "rebuild")
+  if (target2.mode === "rebuild")
     return "  [rebuild required]";
-  if (target.mode === "none")
+  if (target2.mode === "none")
     return "  [not a rollback target]";
   return "";
 }
-function rollbackTargetDetail(target, isLive) {
-  if (isLive || !target || target.mode === "in-window")
+function rollbackTargetDetail(target2, isLive) {
+  if (isLive || !target2 || target2.mode === "in-window")
     return [];
-  const explanation = target.explanation?.trim();
+  const explanation = target2.explanation?.trim();
   return explanation ? [`      ${explanation}`] : [];
 }
 async function writeLine(ctx, line) {
@@ -119643,14 +120300,15 @@ async function resolveCommitSha(ctx, name, input) {
   const pick2 = versions2.slice(0, BARE_PICK_LIMIT);
   if (!ctx.stdinIsInteractive) {
     const appFlag = ` --app ${name}`;
-    const lines = pick2.flatMap((v, i) => {
+    const lines = pick2.flatMap((v) => {
+      const isLive = v.rollbackTarget?.reason === "ALREADY_LIVE";
       const note = v.message.split(`
 `)[0]?.trim() || "Published";
-      const marker = rollbackTargetMarker(v.rollbackTarget, i === 0);
-      const detail = rollbackTargetDetail(v.rollbackTarget, i === 0);
+      const marker = isLive ? "  (live now)" : rollbackTargetMarker(v.rollbackTarget, false);
+      const detail = rollbackTargetDetail(v.rollbackTarget, isLive);
       const git = v.remoteSha ? ` git ${v.remoteSha.slice(0, 7)}` : "";
       const suffix = `  # ${note}${git} (${versionAge(v.timestamp)})${marker}`;
-      if (v.rollbackTarget?.mode === "none" && i !== 0) {
+      if (v.rollbackTarget?.mode === "none") {
         return [`  ${v.sha}${suffix}`, ...detail];
       }
       const rebuildFlag = v.rollbackTarget?.mode === "rebuild" ? " --rebuild" : "";
@@ -119668,10 +120326,11 @@ ${lines.join(`
     const note = v.message.split(`
 `)[0]?.trim() || "Published";
     const git = v.remoteSha ? `  git ${v.remoteSha.slice(0, 7)}` : "";
-    const live = i === 0 ? "  (live now)" : "";
-    const marker = rollbackTargetMarker(v.rollbackTarget, i === 0);
+    const isLive = v.rollbackTarget?.reason === "ALREADY_LIVE";
+    const live = isLive ? "  (live now)" : "";
+    const marker = rollbackTargetMarker(v.rollbackTarget, isLive);
     await writeLine(ctx, `  ${i + 1}. ${v.sha.slice(0, 10)}  ${versionAge(v.timestamp)}  ${note}${git}${live}${marker}`);
-    for (const detail of rollbackTargetDetail(v.rollbackTarget, i === 0)) {
+    for (const detail of rollbackTargetDetail(v.rollbackTarget, isLive)) {
       await writeLine(ctx, detail);
     }
   }
@@ -119724,6 +120383,7 @@ async function rollback(ctx, input, internals = {}) {
       });
     }
   });
+  throwIfDeploymentReplaced(name, deployment);
   if (deployment.status === "failed") {
     throw new PercherCoreError("Rollback failed", {
       code: "push.deploy-failed",
@@ -119734,7 +120394,7 @@ async function rollback(ctx, input, internals = {}) {
 }
 // ../core/dist/commands/sharing.js
 var ShareRoleSchema = exports_external.enum(["viewer", "admin"]);
-function resolveApp4(ctx, app) {
+function resolveApp5(ctx, app) {
   const name = app ?? readPercherTomlAppName(ctx.cwd);
   if (!name) {
     throw new PercherCoreError("No app specified and no percher.toml found", {
@@ -119762,19 +120422,19 @@ var shareRevokeInputSchema = exports_external.object({
   shareId: exports_external.string().min(1, "shareId is required")
 });
 async function shareList(ctx, input = {}) {
-  const appRef2 = resolveApp4(ctx, input.app);
+  const appRef2 = resolveApp5(ctx, input.app);
   return ctx.client.sharing.list(appRef2);
 }
 async function shareInvite(ctx, input) {
-  const appRef2 = resolveApp4(ctx, input.app);
+  const appRef2 = resolveApp5(ctx, input.app);
   return ctx.client.sharing.create(appRef2, { email: input.email, role: input.role });
 }
 async function shareSetRole(ctx, input) {
-  const appRef2 = resolveApp4(ctx, input.app);
+  const appRef2 = resolveApp5(ctx, input.app);
   return ctx.client.sharing.setRole(appRef2, input.shareId, input.role);
 }
 async function shareRevoke(ctx, input) {
-  const appRef2 = resolveApp4(ctx, input.app);
+  const appRef2 = resolveApp5(ctx, input.app);
   await ctx.client.sharing.revoke(appRef2, input.shareId);
 }
 var invitesListInputSchema = exports_external.object({});
@@ -119882,7 +120542,7 @@ async function tokenRevoke(ctx, input) {
   await ctx.client.account.revokeToken(input.id);
 }
 // ../core/dist/commands/transfers.js
-function resolveApp5(ctx, app) {
+function resolveApp6(ctx, app) {
   const name = app ?? readPercherTomlAppName(ctx.cwd);
   if (!name) {
     throw new PercherCoreError("No app specified and no percher.toml found", {
@@ -119904,15 +120564,15 @@ var transferListForAppInputSchema = exports_external.object({
   app: exports_external.string().optional()
 });
 async function transferInitiate(ctx, input) {
-  const appRef2 = resolveApp5(ctx, input.app);
+  const appRef2 = resolveApp6(ctx, input.app);
   return ctx.client.transfers.initiate(appRef2, { email: input.email });
 }
 async function transferCancel(ctx, input) {
-  const appRef2 = resolveApp5(ctx, input.app);
+  const appRef2 = resolveApp6(ctx, input.app);
   await ctx.client.transfers.cancel(appRef2, input.transferId);
 }
 async function transferListForApp(ctx, input = {}) {
-  const appRef2 = resolveApp5(ctx, input.app);
+  const appRef2 = resolveApp6(ctx, input.app);
   return ctx.client.transfers.listForApp(appRef2);
 }
 var transfersIncomingInputSchema = exports_external.object({});
@@ -119977,6 +120637,7 @@ var SOURCE_EXTS2 = new Set([
   ".py"
 ]);
 var DEFAULT_MAX_FILE_BYTES = 1024 * 1024;
+var IMPORT_META_CONSTANTS = new Set(["DEV", "PROD", "MODE", "BASE_URL", "SSR"]);
 // ../core/dist/plans.js
 var PB_INITIAL_FOOTPRINT_MB = 256;
 var EGRESS_GB_PER_MONTH = {
@@ -120183,6 +120844,15 @@ async function writeLine2(ctx, line) {
     writer.releaseLock();
   }
 }
+async function writeErrLine(ctx, line) {
+  const writer = ctx.stderr.getWriter();
+  try {
+    await writer.write(new TextEncoder().encode(`${line}
+`));
+  } finally {
+    writer.releaseLock();
+  }
+}
 async function writeUnknownCommand(ctx, name) {
   const writer = ctx.stderr.getWriter();
   try {
@@ -120750,8 +121420,8 @@ function registerAdminCommands(cli, ctx) {
         if (topology?.topologyReady !== true) {
           await writeLine2(ctx, `${import_picocolors3.default.red("✗")} tenant topology audit is red or unavailable — no launch all-clear.`);
           for (const finding of topology?.findings ?? []) {
-            const target = finding.network ?? finding.containerId ?? finding.appId ?? "fleet";
-            await writeLine2(ctx, `  ${import_picocolors3.default.red("✗")} ${finding.code} [${target}] — ${finding.detail}`);
+            const target2 = finding.network ?? finding.containerId ?? finding.appId ?? "fleet";
+            await writeLine2(ctx, `  ${import_picocolors3.default.red("✗")} ${finding.code} [${target2}] — ${finding.detail}`);
           }
         }
         if (options.app || options.appId) {
@@ -120765,8 +121435,8 @@ function registerAdminCommands(cli, ctx) {
           await writeLine2(ctx, `${import_picocolors3.default.yellow("!")} drift: ${missing} missing route(s), ${hostDrift} missing host(s), ${extra} extra route(s)`);
           for (const d of drift) {
             const label = d.kind === "missing_route" ? import_picocolors3.default.red("MISSING") : d.kind === "missing_host" ? import_picocolors3.default.yellow("HOST_DRIFT") : import_picocolors3.default.dim("EXTRA");
-            const target = d.appName ? `[${d.appName}] ` : "";
-            await writeLine2(ctx, `  ${label} ${target}${d.routeId} (${d.routeType}) — ${d.hosts.join(", ")}`);
+            const target2 = d.appName ? `[${d.appName}] ` : "";
+            await writeLine2(ctx, `  ${label} ${target2}${d.routeId} (${d.routeType}) — ${d.hosts.join(", ")}`);
           }
         }
         await writeLine2(ctx, import_picocolors3.default.dim(`Repair: percher admin reconcile-routes${options.app ? ` --app ${options.app}` : ""}`));
@@ -120842,8 +121512,8 @@ async function printList(ctx, title, rows) {
 
 // src/commands/apps.ts
 var import_picocolors5 = __toESM(require_picocolors(), 1);
-function assertNever2(status2, summary) {
-  throw new Error(`Unhandled publish status: ${JSON.stringify(status2)}${summary ? ` (${summary})` : ""}`);
+function assertNever2(status2, summary2) {
+  throw new Error(`Unhandled publish status: ${JSON.stringify(status2)}${summary2 ? ` (${summary2})` : ""}`);
 }
 async function handlePublishResult(ctx, result, options = {}) {
   switch (result.status) {
@@ -121082,6 +121752,10 @@ function registerAppsCommands(cli, ctx) {
       deployId,
       noCache: options.cache === false
     });
+    if (result.status === "replaced") {
+      await handlePublishResult(ctx, result);
+      throw new SilentExitError;
+    }
     if (result.status === "needs_login") {
       await writeLine2(ctx, `${import_picocolors5.default.red("✗")} Not logged in. Run: percher login`);
       throw new SilentExitError;
@@ -121399,6 +122073,154 @@ function registerAuthCommands(cli, ctx) {
 
 // src/commands/data.ts
 var import_picocolors7 = __toESM(require_picocolors(), 1);
+
+// src/commands/data-records.ts
+var DATA_RECORD_SUBCOMMANDS = new Set([
+  "schema",
+  "query",
+  "get",
+  "create",
+  "update",
+  "delete"
+]);
+
+class DataArgumentError extends PercherCoreError {
+  constructor(message) {
+    super(message, { code: "data.missing-argument" });
+  }
+}
+function cacKey(name) {
+  return name.replaceAll(/([a-z])-([a-z])/g, (_, a, b) => a + b.toUpperCase());
+}
+function textOption(argv, options, key, flag) {
+  const parsed = options[key];
+  if (parsed === undefined)
+    return;
+  if (typeof parsed === "string")
+    return parsed;
+  if (typeof parsed !== "number") {
+    throw new DataArgumentError(`${flag} needs exactly one value`);
+  }
+  const end = argv.includes("--") ? argv.indexOf("--") : argv.length;
+  let raw;
+  for (let i = 0;i < end; i++) {
+    const m = /^--([^=]+)(?:=(.*))?$/s.exec(argv[i] ?? "");
+    if (!m || cacKey(m[1] ?? "") !== key)
+      continue;
+    raw = m[2] ?? argv[i + 1];
+  }
+  if (raw === undefined || Number(raw) !== parsed) {
+    throw new DataArgumentError(`${flag} could not be read as typed`);
+  }
+  return raw;
+}
+function intOption(options, key, flag) {
+  const parsed = options[key];
+  if (parsed === undefined)
+    return;
+  if (typeof parsed === "number")
+    return parsed;
+  if (typeof parsed === "string")
+    return Number(parsed);
+  throw new DataArgumentError(`${flag} needs exactly one value`);
+}
+function recordPositionals(rest, options) {
+  const after = Array.isArray(options["--"]) ? options["--"] : [];
+  const all = [...rest, ...after];
+  if (!all.every((v) => typeof v === "string")) {
+    throw new DataArgumentError("Could not read the collection or record id as typed; put boolean flags after them");
+  }
+  return all;
+}
+function recordData2(value) {
+  let parsed;
+  try {
+    parsed = JSON.parse(value ?? "");
+  } catch {
+    parsed = undefined;
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new PercherCoreError("--data must be a JSON object of field values", {
+      code: "data.invalid-json",
+      hint: `Example: --data '{"title":"Buy milk","done":false}'`
+    });
+  }
+  return parsed;
+}
+function missing(usage) {
+  throw new PercherCoreError(`Missing arguments. Usage: percher ${usage}`, {
+    code: "data.missing-argument"
+  });
+}
+async function runDataRecordCommand(ctx, argv, sub, rest, options) {
+  const [collection, id] = recordPositionals(rest, options);
+  const text = (key, flag) => textOption(argv, options, key, flag);
+  const app = text("app", "--app");
+  let result;
+  switch (sub) {
+    case "schema":
+      result = await dataSchema2(ctx, dataSchemaInputSchema.parse({ app }));
+      break;
+    case "query":
+      if (!collection)
+        missing("data query <collection> [--filter …] [--app <name>]");
+      result = await dataQuery(ctx, dataQueryInputSchema.parse({
+        app,
+        collection,
+        filter: text("filter", "--filter"),
+        sort: text("sort", "--sort"),
+        page: intOption(options, "page", "--page"),
+        perPage: intOption(options, "perPage", "--per-page"),
+        fields: text("fields", "--fields")
+      }));
+      break;
+    case "get":
+      if (!collection || !id)
+        missing("data get <collection> <id> [--app <name>]");
+      result = await dataGet(ctx, dataGetInputSchema.parse({ app, collection, id }));
+      break;
+    case "create":
+      if (!collection)
+        missing("data create <collection> --data '<json>' [--id <id>]");
+      result = await dataCreate(ctx, dataCreateInputSchema.parse({
+        app,
+        collection,
+        data: recordData2(text("data", "--data")),
+        id: text("id", "--id")
+      }));
+      break;
+    case "update":
+      if (!collection || !id)
+        missing("data update <collection> <id> --data '<json>'");
+      result = await dataUpdate(ctx, dataUpdateInputSchema.parse({
+        app,
+        collection,
+        id,
+        data: recordData2(text("data", "--data")),
+        ifUpdated: text("ifUpdated", "--if-updated")
+      }));
+      break;
+    case "delete":
+      if (!collection || !id)
+        missing("data delete <collection> <id> [--app <name>]");
+      result = await dataDelete(ctx, dataDeleteInputSchema.parse({ app, collection, id }));
+      break;
+    default:
+      return;
+  }
+  await writeLine2(ctx, JSON.stringify(result, null, 2));
+}
+function registerDataRecordHelp(cli) {
+  const none = async () => {};
+  cli.command("data schema", "List the collections and fields the data tools can use").action(none);
+  cli.command("data query <collection>", "Query records (--filter, --sort, --page, --per-page, --fields)").action(none);
+  cli.command("data get <collection> <id>", "Get one record").action(none);
+  cli.command("data create <collection>", "Create a record from --data '<json>' (optional --id)").action(none);
+  cli.command("data update <collection> <id>", "Change fields from --data '<json>' (optional --if-updated)").action(none);
+  cli.command("data delete <collection> <id>", "Delete one record").action(none);
+}
+
+// src/commands/data.ts
 var DATA_VALUE_FLAGS = new Set([
   "--out",
   "--app",
@@ -121407,7 +122229,11 @@ var DATA_VALUE_FLAGS = new Set([
   "--client-secret"
 ]);
 function registerDataCommands(cli, ctx, argv) {
-  cli.command("data [app] [...rest]", "Show app data status and collections").option("--json", "Output as JSON").option("--reveal", "(reset-superuser only) also print the plaintext password once").option("--out <path>", "(export only) Output file (default: ./<app>-pb-<timestamp>.tar.gz)").option("--provider <name>", "(oauth only) OAuth provider (default: google)").option("--app <name>", "(export, oauth) target app (default: read percher.toml)").option("--client-id <id>", "(oauth only) OAuth client id").option("--client-secret <secret>", "(oauth only) OAuth client secret (a command-line value lands in shell history)").option("--remove", "(oauth only) remove the provider instead of setting it").action(async (app, _rest, options) => {
+  cli.command("data [app] [...rest]", "Show app data status and collections").option("--json", "Output as JSON").option("--reveal", "(reset-superuser only) also print the plaintext password once").option("--out <path>", "(export only) Output file (default: ./<app>-pb-<timestamp>.tar.gz)").option("--provider <name>", "(oauth only) OAuth provider (default: google)").option("--app <name>", "Target app (default: read percher.toml); names an app called like a subcommand, e.g. `data --app get`").option("--client-id <id>", "(oauth only) OAuth client id").option("--client-secret <secret>", "(oauth only) OAuth client secret (a command-line value lands in shell history)").option("--remove", "(oauth only) remove the provider instead of setting it").option("--filter <expr>", "(query only) filter over the collection's fields").option("--sort <fields>", "(query only) comma-separated fields, - for descending (write --sort=-field)").option("--page <n>", "(query only) page number").option("--per-page <n>", "(query only) records per page (max 100)").option("--fields <fields>", "(query only) comma-separated fields to return").option("--data <json>", "(create, update) field values as a JSON object").option("--id <id>", "(create only) id for the new record").option("--if-updated <timestamp>", "(update only) refuse if the record changed since").action(async (app, _rest, options) => {
+    if (app !== undefined && DATA_RECORD_SUBCOMMANDS.has(app)) {
+      await runDataRecordCommand(ctx, argv, app, _rest, options);
+      return;
+    }
     if (app === "reset-superuser") {
       const idx = argv.indexOf("reset-superuser");
       const realApp = idx >= 0 ? firstNonFlagAfter(argv, idx) : undefined;
@@ -121458,7 +122284,7 @@ function registerDataCommands(cli, ctx, argv) {
       }
       return;
     }
-    const result = await data(ctx, { app, json: options.json });
+    const result = await data(ctx, { app: app ?? options.app, json: options.json });
     if (options.json) {
       await writeLine2(ctx, JSON.stringify(result, null, 2));
     } else {
@@ -121483,6 +122309,7 @@ function registerDataCommands(cli, ctx, argv) {
       }
     }
   });
+  registerDataRecordHelp(cli);
   cli.command("data reset-superuser [app]", "Reset PocketBase superuser and inject new credentials").option("--reveal", "Also print the plaintext password once (default: hidden)").action(async (app, options) => {
     const result = await resetSuperuser(ctx, { app, reveal: options.reveal });
     await printSuperuserResetResult(ctx, result);
@@ -121578,6 +122405,7 @@ function registerDeploysCommands(cli, ctx, argv) {
       rebuild: Boolean(options.rebuild)
     });
     await writeLine2(ctx, `${import_picocolors8.default.green("✓")} rolled back to ${result.rolledBackTo.slice(0, 10)} (status: ${result.status})`);
+    await writeLine2(ctx, "Env vars are not rolled back; the current values stay.");
   });
   cli.command("reproduce <deployId>", "Download a deploy's source and reproduce the build locally").option("--app <name>", "App name (defaults to percher.toml app.name)").action(async (deployId, options) => {
     const result = await reproduce(ctx, {
@@ -121656,6 +122484,8 @@ function registerDeploysCommands(cli, ctx, argv) {
     for (const v of list) {
       const message = v.message.split(`
 `)[0]?.trim() ?? "";
+      const note = Array.from((v.note ?? "").replace(/[\p{Cc}\p{Cf}\p{Cs}\p{Zl}\p{Zp}]/gu, " ").replace(/\s+/g, " ").trim());
+      const noteLabel = note.length > 80 ? `${note.slice(0, 79).join("")}…` : note.join("");
       const channelLabels = {
         cli: "CLI",
         mcp: "MCP",
@@ -121666,11 +122496,11 @@ function registerDeploysCommands(cli, ctx, argv) {
       const label = v.channel ? channelLabels[v.channel] ?? v.channel : null;
       const git = v.remoteSha ? `  · git ${v.remoteSha.slice(0, 7)}` : "";
       const suffix = `${label ? `  · via ${label}` : ""}${git}`;
-      const target = v.rollbackTarget;
-      const marker = target && target.mode !== "in-window" ? target.mode === "rebuild" ? "[rebuild required]" : "[not a rollback target]" : null;
-      if (marker && target)
-        reasons.set(marker, target.explanation);
-      await writeLine2(ctx, `${v.sha}  ${v.timestamp}  ${message}${suffix}${marker ? `  ${marker}` : ""}`);
+      const target2 = v.rollbackTarget;
+      const marker = target2 && target2.mode !== "in-window" ? target2.mode === "rebuild" ? "[rebuild required]" : "[not a rollback target]" : null;
+      if (marker && target2)
+        reasons.set(marker, target2.explanation);
+      await writeLine2(ctx, `${v.sha}  ${v.timestamp}  ${message}${noteLabel ? `  · ${noteLabel}` : ""}${suffix}${marker ? `  ${marker}` : ""}`);
     }
     for (const [marker, explanation] of reasons) {
       await writeLine2(ctx, `
@@ -121684,8 +122514,8 @@ ${marker} ${explanation}`);
       head,
       patch: options.patch
     });
-    const { summary, files } = result;
-    await writeLine2(ctx, `${summary.filesChanged} file${summary.filesChanged === 1 ? "" : "s"} changed · ${import_picocolors8.default.green(`+${summary.additions}`)} ${import_picocolors8.default.red(`−${summary.deletions}`)}  (${result.base.slice(0, 10)} → ${result.head.slice(0, 10)})`);
+    const { summary: summary2, files } = result;
+    await writeLine2(ctx, `${summary2.filesChanged} file${summary2.filesChanged === 1 ? "" : "s"} changed · ${import_picocolors8.default.green(`+${summary2.additions}`)} ${import_picocolors8.default.red(`−${summary2.deletions}`)}  (${result.base.slice(0, 10)} → ${result.head.slice(0, 10)})`);
     for (const f of files) {
       const stat3 = f.binary ? import_picocolors8.default.dim("binary") : `${import_picocolors8.default.green(`+${f.additions}`)} ${import_picocolors8.default.red(`−${f.deletions}`)}`;
       await writeLine2(ctx, `  ${f.status}  ${f.path}  ${stat3}${f.truncated ? import_picocolors8.default.dim(" (truncated)") : ""}`);
@@ -122376,8 +123206,209 @@ async function renderHumanStatus(ctx, result) {
   }
 }
 
-// src/commands/token.ts
+// src/commands/telemetry.ts
+init_dist();
 var import_picocolors16 = __toESM(require_picocolors(), 1);
+
+// src/telemetry.ts
+init_dist();
+import { createInterface } from "node:readline";
+// package.json
+var package_default2 = {
+  name: "percher",
+  version: "1.3.0",
+  description: "CLI for the Percher hosting platform — publish apps with one command",
+  type: "module",
+  bin: {
+    percher: "./dist/bin/percher.js"
+  },
+  main: "./dist/src/index.js",
+  types: "./dist/src/index.d.ts",
+  exports: {
+    ".": {
+      types: "./dist/src/index.d.ts",
+      import: "./dist/src/index.js",
+      default: "./dist/src/index.js"
+    }
+  },
+  files: [
+    "dist",
+    "THIRD-PARTY-NOTICES.txt"
+  ],
+  publishConfig: {
+    access: "public"
+  },
+  scripts: {
+    build: `tsc -p tsconfig.json && tsc-alias -p tsconfig.json && bun build bin/percher.ts --outfile dist/bin/percher.js --target node --format esm --metafile=bundle-meta.json && node ../../scripts/bundle-notices.mjs . bundle-meta.json && node scripts/copy-templates.mjs && node -e "require('fs').chmodSync('dist/bin/percher.js',0o755)"`,
+    test: "bun test",
+    typecheck: "tsc --noEmit"
+  },
+  dependencies: {
+    "@percher/client": "^1.3.0",
+    "@percher/core": "^1.3.0",
+    "@percher/toml": "^1.0.4",
+    cac: "^7.0.0",
+    picocolors: "^1.1.1"
+  },
+  devDependencies: {
+    "bun-types": "^1.1.0",
+    "tsc-alias": "^1.8.17"
+  },
+  engines: {
+    bun: ">=1.0.0",
+    node: ">=22.0.0"
+  },
+  license: "FSL-1.1-MIT",
+  author: "Mattias Malmborg",
+  repository: {
+    type: "git",
+    url: "https://github.com/mattiasmalmborg/percher"
+  },
+  keywords: [
+    "hosting",
+    "deploy",
+    "cli",
+    "paas",
+    "bun",
+    "ai"
+  ]
+};
+
+// src/telemetry.ts
+var VERSION = package_default2.version;
+function trackEvent(command, result, errorType) {
+  if (!telemetryState().enabled)
+    return;
+  const body = JSON.stringify({
+    cliVersion: VERSION,
+    command,
+    result,
+    errorType,
+    os: `${process.platform}-${process.arch}`,
+    bunVersion: typeof Bun !== "undefined" ? Bun.version : undefined
+  });
+  fetch(`${resolveApiUrl()}/telemetry/cli`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body,
+    signal: AbortSignal.timeout(3000)
+  }).catch(() => {});
+}
+function lineAsker(input, output, onInterrupt = () => process.exit(130)) {
+  return (question, signal) => new Promise((resolve11) => {
+    const rl = createInterface({
+      input,
+      output,
+      terminal: input.isTTY === true
+    });
+    let settled = false;
+    const finish = (answer) => {
+      if (settled)
+        return;
+      settled = true;
+      signal.removeEventListener("abort", onAbort);
+      if (answer === null)
+        output.write(`
+`);
+      resolve11(answer);
+      rl.close();
+    };
+    const onAbort = () => finish(null);
+    signal.addEventListener("abort", onAbort, { once: true });
+    rl.on("line", (line) => finish(line));
+    rl.on("close", () => finish(null));
+    rl.on("SIGINT", () => {
+      finish(null);
+      onInterrupt();
+    });
+    rl.setPrompt(question);
+    rl.prompt();
+    if (signal.aborted)
+      finish(null);
+  });
+}
+var askOnStdin = lineAsker(process.stdin, process.stderr);
+var ANSWER_TIMEOUT_MS = 20000;
+var CI_VARS = ["CONTINUOUS_INTEGRATION", "BUILD_NUMBER", "TF_BUILD", "JENKINS_URL"];
+var AGENT_VARS = [
+  "CLAUDECODE",
+  "CURSOR_AGENT",
+  "CURSOR_TRACE_ID",
+  "CODEX_SANDBOX",
+  "CODEX_CI",
+  "GITHUB_ACTIONS"
+];
+function isUnattended(env) {
+  const ci = env.CI;
+  if (ci !== undefined && ci !== "" && ci !== "0" && ci !== "false")
+    return true;
+  return [...CI_VARS, ...AGENT_VARS].some((key) => Boolean(env[key]));
+}
+var realTimer = (fire, ms) => {
+  const handle = setTimeout(fire, ms);
+  return () => clearTimeout(handle);
+};
+async function askTelemetryConsentOnce(ctx, argv, command, question) {
+  if (command === "telemetry" || argv.includes("--json"))
+    return;
+  if (ctx.stdinIsInteractive !== true || !question.stderrIsTTY)
+    return;
+  if (isUnattended(ctx.env))
+    return;
+  const state = telemetryState();
+  if (state.envOptOut || state.stored)
+    return;
+  const timeout = new AbortController;
+  const cancel = (question.setTimer ?? realTimer)(() => timeout.abort(), ANSWER_TIMEOUT_MS);
+  let answer;
+  try {
+    answer = await question.ask("Send anonymous usage statistics to Percher? (y/N) ", timeout.signal);
+  } finally {
+    cancel();
+  }
+  if (answer === null)
+    return;
+  const enabled = /^y(es)?$/i.test(answer.trim());
+  try {
+    saveTelemetryAnswer(enabled, VERSION);
+  } catch {
+    await writeErrLine(ctx, "Could not save the answer; you will be asked again.");
+    return;
+  }
+  await writeErrLine(ctx, enabled ? "Usage statistics on. Turn off: percher telemetry off" : "Usage statistics off. Turn on: percher telemetry on");
+}
+function telemetryStatusLine(state = telemetryState()) {
+  const stored = state.stored ? `stored answer: ${state.stored.enabled ? "on" : "off"}` : null;
+  if (state.envOptOut) {
+    return `Telemetry: off (env opt-out: ${state.envOptOut}${stored ? `; ${stored}` : ""})`;
+  }
+  if (state.stored)
+    return `Telemetry: ${state.stored.enabled ? "on" : "off"} (stored answer)`;
+  return "Telemetry: off (undecided)";
+}
+
+// src/commands/telemetry.ts
+function registerTelemetryCommands(cli, ctx) {
+  cli.command("telemetry [action]", "Anonymous usage statistics: on | off | status").action(async (action) => {
+    if (action === "on" || action === "off") {
+      try {
+        saveTelemetryAnswer(action === "on", VERSION);
+      } catch {
+        await writeErrLine(ctx, `${import_picocolors16.default.red("✗")} Could not save the answer.`);
+        throw new SilentExitError;
+      }
+    } else if (action !== undefined && action !== "status") {
+      await writeErrLine(ctx, `${import_picocolors16.default.red("✗")} Usage: percher telemetry on|off|status`);
+      throw new SilentExitError;
+    }
+    const state = telemetryState();
+    const overridden = action === "on" && state.envOptOut !== null;
+    await writeLine2(ctx, `${telemetryStatusLine(state)}${overridden ? "; the environment variable still wins." : ""}`);
+  });
+}
+
+// src/commands/token.ts
+var import_picocolors17 = __toESM(require_picocolors(), 1);
 var VALID_SCOPES = ["deploy", "env", "read", "full"];
 function scopeLabel(scopes, appName) {
   const s = scopes && scopes.length > 0 ? scopes.join("+") : "full";
@@ -122386,22 +123417,22 @@ function scopeLabel(scopes, appName) {
 function registerTokenCommands(cli, ctx) {
   cli.command("token [action] [arg]", "Manage API tokens: create | list | revoke").option("--scope <scope>", "(create) deploy | env | read | full (default: full, account-wide unless --app)").option("--app <name>", "(create) bind the token to a single app").option("--ttl-days <n>", "(create) token lifetime in days (default 90, max 365)").action(async (action, arg, options) => {
     if (!ctx.client.token) {
-      await writeLine2(ctx, `${import_picocolors16.default.red("✗")} Not logged in. Run: percher login`);
+      await writeLine2(ctx, `${import_picocolors17.default.red("✗")} Not logged in. Run: percher login`);
       throw new SilentExitError;
     }
     if (action === "create") {
       if (!arg) {
-        await writeLine2(ctx, `${import_picocolors16.default.red("✗")} A name is required. Usage: percher token create <name> [--scope deploy] [--app <name>]`);
+        await writeLine2(ctx, `${import_picocolors17.default.red("✗")} A name is required. Usage: percher token create <name> [--scope deploy] [--app <name>]`);
         throw new SilentExitError;
       }
       const scope = options.scope ?? "full";
       if (!VALID_SCOPES.includes(scope)) {
-        await writeLine2(ctx, `${import_picocolors16.default.red("✗")} Invalid --scope "${options.scope}". Use one of: ${VALID_SCOPES.join(", ")}.`);
+        await writeLine2(ctx, `${import_picocolors17.default.red("✗")} Invalid --scope "${options.scope}". Use one of: ${VALID_SCOPES.join(", ")}.`);
         throw new SilentExitError;
       }
       const ttlDays = options.ttlDays !== undefined ? Number(options.ttlDays) : undefined;
       if (ttlDays !== undefined && (!Number.isInteger(ttlDays) || ttlDays <= 0)) {
-        await writeLine2(ctx, `${import_picocolors16.default.red("✗")} --ttl-days must be a positive whole number.`);
+        await writeLine2(ctx, `${import_picocolors17.default.red("✗")} --ttl-days must be a positive whole number.`);
         throw new SilentExitError;
       }
       const created = await tokenCreate(ctx, {
@@ -122410,36 +123441,36 @@ function registerTokenCommands(cli, ctx) {
         app: options.app,
         ttlDays
       });
-      await writeLine2(ctx, `${import_picocolors16.default.green("✓")} Token created: ${import_picocolors16.default.bold(created.name)}  ${import_picocolors16.default.dim(`(${scopeLabel(created.scopes, created.appName)})`)}`);
+      await writeLine2(ctx, `${import_picocolors17.default.green("✓")} Token created: ${import_picocolors17.default.bold(created.name)}  ${import_picocolors17.default.dim(`(${scopeLabel(created.scopes, created.appName)})`)}`);
       await writeLine2(ctx, "");
-      await writeLine2(ctx, `  ${import_picocolors16.default.bold(created.token)}`);
-      await writeLine2(ctx, import_picocolors16.default.yellow("  ↑ Store this now — the secret is shown only once and can't be retrieved."));
+      await writeLine2(ctx, `  ${import_picocolors17.default.bold(created.token)}`);
+      await writeLine2(ctx, import_picocolors17.default.yellow("  ↑ Store this now — the secret is shown only once and can't be retrieved."));
       await writeLine2(ctx, "");
-      await writeLine2(ctx, import_picocolors16.default.dim("  Use it in CI / an agent:"));
-      await writeLine2(ctx, import_picocolors16.default.dim(`    PERCHER_TOKEN=${created.token} bunx percher publish`));
+      await writeLine2(ctx, import_picocolors17.default.dim("  Use it in CI / an agent:"));
+      await writeLine2(ctx, import_picocolors17.default.dim(`    PERCHER_TOKEN=${created.token} bunx percher publish`));
       return;
     }
     if (action === "list") {
       const tokens = await tokenList(ctx);
       if (tokens.length === 0) {
-        await writeLine2(ctx, import_picocolors16.default.dim("No API tokens."));
+        await writeLine2(ctx, import_picocolors17.default.dim("No API tokens."));
         return;
       }
       for (const t of tokens) {
         const expires = t.expiresAt ? `expires ${new Date(t.expiresAt).toISOString().slice(0, 10)}` : "no expiry";
-        await writeLine2(ctx, `${import_picocolors16.default.bold(t.id)}  ${t.name.padEnd(20)} ${import_picocolors16.default.dim(scopeLabel(t.scopes, t.appName))}  ${import_picocolors16.default.dim(expires)}`);
+        await writeLine2(ctx, `${import_picocolors17.default.bold(t.id)}  ${t.name.padEnd(20)} ${import_picocolors17.default.dim(scopeLabel(t.scopes, t.appName))}  ${import_picocolors17.default.dim(expires)}`);
       }
       await writeLine2(ctx, "");
-      await writeLine2(ctx, import_picocolors16.default.dim("Revoke one with: percher token revoke <id>"));
+      await writeLine2(ctx, import_picocolors17.default.dim("Revoke one with: percher token revoke <id>"));
       return;
     }
     if (action === "revoke") {
       if (!arg) {
-        await writeLine2(ctx, `${import_picocolors16.default.red("✗")} A token id is required. Usage: percher token revoke <id> (list ids with \`percher token list\`).`);
+        await writeLine2(ctx, `${import_picocolors17.default.red("✗")} A token id is required. Usage: percher token revoke <id> (list ids with \`percher token list\`).`);
         throw new SilentExitError;
       }
       await tokenRevoke(ctx, { id: arg });
-      await writeLine2(ctx, `${import_picocolors16.default.green("✓")} Token revoked.`);
+      await writeLine2(ctx, `${import_picocolors17.default.green("✓")} Token revoked.`);
       return;
     }
     throw new Error(`Unknown token action "${action ?? ""}". Use: create | list | revoke.`);
@@ -122450,17 +123481,17 @@ function registerTokenCommands(cli, ctx) {
 }
 
 // src/commands/transfers.ts
-var import_picocolors17 = __toESM(require_picocolors(), 1);
+var import_picocolors18 = __toESM(require_picocolors(), 1);
 function registerTransfersCommands(cli, ctx) {
   cli.command("transfer [emailOrTransferId]", "Transfer ownership of an app: `transfer <email>` initiates; `transfer --cancel <id>` cancels; `transfer --list` shows history").option("--app <name>", "App name (overrides percher.toml)").option("--cancel", "Cancel a pending transfer by id (positional arg is the transferId)").option("--list", "List the transfer history for this app").action(async (emailOrTransferId, options) => {
     if (options.list) {
       const rows = await transferListForApp(ctx, { app: options.app });
       if (rows.length === 0) {
-        await writeLine2(ctx, import_picocolors17.default.dim("No transfers for this app."));
+        await writeLine2(ctx, import_picocolors18.default.dim("No transfers for this app."));
         return;
       }
       for (const r of rows) {
-        const status2 = r.status === "pending" ? import_picocolors17.default.yellow("pending") : r.status === "accepted" ? import_picocolors17.default.green("accepted") : import_picocolors17.default.dim(r.status);
+        const status2 = r.status === "pending" ? import_picocolors18.default.yellow("pending") : r.status === "accepted" ? import_picocolors18.default.green("accepted") : import_picocolors18.default.dim(r.status);
         await writeLine2(ctx, `${r.id}  ${status2.padEnd(20)}  → ${r.toEmail}  (${r.createdAt})`);
       }
       return;
@@ -122473,7 +123504,7 @@ function registerTransfersCommands(cli, ctx) {
         app: options.app,
         transferId: emailOrTransferId
       });
-      await writeLine2(ctx, `${import_picocolors17.default.green("✓")} Cancelled transfer ${emailOrTransferId}`);
+      await writeLine2(ctx, `${import_picocolors18.default.green("✓")} Cancelled transfer ${emailOrTransferId}`);
       return;
     }
     if (!emailOrTransferId) {
@@ -122483,17 +123514,17 @@ function registerTransfersCommands(cli, ctx) {
       app: options.app,
       email: emailOrTransferId
     });
-    await writeLine2(ctx, `${import_picocolors17.default.green("✓")} Transfer initiated to ${initiated.toEmail} (id ${initiated.id})`);
-    await writeLine2(ctx, import_picocolors17.default.dim(`Expires ${new Date(initiated.expiresAt).toLocaleDateString()}. The recipient must accept via 'percher transfers accept ${initiated.id}'.`));
+    await writeLine2(ctx, `${import_picocolors18.default.green("✓")} Transfer initiated to ${initiated.toEmail} (id ${initiated.id})`);
+    await writeLine2(ctx, import_picocolors18.default.dim(`Expires ${new Date(initiated.expiresAt).toLocaleDateString()}. The recipient must accept via 'percher transfers accept ${initiated.id}'.`));
     if (initiated.notes) {
-      await writeLine2(ctx, import_picocolors17.default.yellow(`  ⚠  ${initiated.notes}`));
+      await writeLine2(ctx, import_picocolors18.default.yellow(`  ⚠  ${initiated.notes}`));
     }
   });
   cli.command("transfers [action] [transferId]", "Incoming ownership transfers: list (default) | accept <transferId> | decline <transferId>").action(async (action, transferId) => {
     if (action === undefined || action === "list") {
       const rows = await transfersIncoming(ctx, {});
       if (rows.length === 0) {
-        await writeLine2(ctx, import_picocolors17.default.dim("No pending incoming transfers."));
+        await writeLine2(ctx, import_picocolors18.default.dim("No pending incoming transfers."));
         return;
       }
       for (const r of rows) {
@@ -122506,7 +123537,7 @@ function registerTransfersCommands(cli, ctx) {
         throw new Error("Usage: percher transfers accept <transferId>");
       }
       const accepted = await transfersAccept(ctx, { transferId });
-      await writeLine2(ctx, `${import_picocolors17.default.green("✓")} You now own ${import_picocolors17.default.cyan(accepted.appName)}. Run 'percher open ${accepted.appName}' to see it.`);
+      await writeLine2(ctx, `${import_picocolors18.default.green("✓")} You now own ${import_picocolors18.default.cyan(accepted.appName)}. Run 'percher open ${accepted.appName}' to see it.`);
       return;
     }
     if (action === "decline") {
@@ -122514,7 +123545,7 @@ function registerTransfersCommands(cli, ctx) {
         throw new Error("Usage: percher transfers decline <transferId>");
       }
       await transfersDecline(ctx, { transferId });
-      await writeLine2(ctx, `${import_picocolors17.default.green("✓")} Declined transfer ${transferId}.`);
+      await writeLine2(ctx, `${import_picocolors18.default.green("✓")} Declined transfer ${transferId}.`);
       return;
     }
     throw new Error(`Unknown transfers action "${action}". Use list | accept <id> | decline <id>.`);
@@ -122543,9 +123574,9 @@ async function openUrl(url2) {
 
 // src/prompt.ts
 import { stdin as input, stdout as output } from "node:process";
-import { createInterface } from "node:readline/promises";
+import { createInterface as createInterface2 } from "node:readline/promises";
 async function prompt(question, options) {
-  const rl = createInterface({ input, output });
+  const rl = createInterface2({ input, output });
   try {
     const suffix = options?.default ? ` [${options.default}]` : "";
     const answer = await rl.question(`${question}${suffix} `);
@@ -122555,111 +123586,6 @@ async function prompt(question, options) {
   }
 }
 
-// src/telemetry.ts
-init_dist();
-// package.json
-var package_default2 = {
-  name: "percher",
-  version: "1.1.0",
-  description: "CLI for the Percher hosting platform — publish apps with one command",
-  type: "module",
-  bin: {
-    percher: "./dist/bin/percher.js"
-  },
-  main: "./dist/src/index.js",
-  types: "./dist/src/index.d.ts",
-  exports: {
-    ".": {
-      types: "./dist/src/index.d.ts",
-      import: "./dist/src/index.js",
-      default: "./dist/src/index.js"
-    }
-  },
-  files: [
-    "dist",
-    "THIRD-PARTY-NOTICES.txt"
-  ],
-  publishConfig: {
-    access: "public"
-  },
-  scripts: {
-    build: `tsc -p tsconfig.json && tsc-alias -p tsconfig.json && bun build bin/percher.ts --outfile dist/bin/percher.js --target node --format esm --metafile=bundle-meta.json && node ../../scripts/bundle-notices.mjs . bundle-meta.json && node scripts/copy-templates.mjs && node -e "require('fs').chmodSync('dist/bin/percher.js',0o755)"`,
-    test: "bun test",
-    typecheck: "tsc --noEmit"
-  },
-  dependencies: {
-    "@percher/client": "^1.1.0",
-    "@percher/core": "^1.1.0",
-    "@percher/toml": "^1.0.3",
-    cac: "^7.0.0",
-    picocolors: "^1.1.1"
-  },
-  devDependencies: {
-    "bun-types": "^1.1.0",
-    "tsc-alias": "^1.8.17"
-  },
-  engines: {
-    bun: ">=1.0.0",
-    node: ">=22.0.0"
-  },
-  license: "FSL-1.1-MIT",
-  author: "Mattias Malmborg",
-  repository: {
-    type: "git",
-    url: "https://github.com/mattiasmalmborg/percher"
-  },
-  keywords: [
-    "hosting",
-    "deploy",
-    "cli",
-    "paas",
-    "bun",
-    "ai"
-  ]
-};
-
-// src/telemetry.ts
-var VERSION = package_default2.version;
-function isDisabled() {
-  return process.env.PERCHER_NO_TELEMETRY === "1" || process.env.PERCHER_NO_TELEMETRY === "true" || process.env.DO_NOT_TRACK === "1";
-}
-function trackEvent(command, result, errorType) {
-  if (isDisabled())
-    return;
-  const body = JSON.stringify({
-    cliVersion: VERSION,
-    command,
-    result,
-    errorType,
-    os: `${process.platform}-${process.arch}`,
-    bunVersion: typeof Bun !== "undefined" ? Bun.version : undefined
-  });
-  fetch(`${resolveApiUrl()}/telemetry/cli`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body,
-    signal: AbortSignal.timeout(3000)
-  }).catch(() => {});
-}
-async function showTelemetryNotice() {
-  if (isDisabled())
-    return;
-  const { homedir: homedir2 } = await import("node:os");
-  const { existsSync: existsSync18, mkdirSync: mkdirSync7, writeFileSync: writeFileSync11 } = await import("node:fs");
-  const { join: join28 } = await import("node:path");
-  const configDir = join28(homedir2(), ".percher");
-  const markerFile = join28(configDir, ".telemetry-notice-shown");
-  if (existsSync18(markerFile))
-    return;
-  console.error("Percher sends non-account-linked usage stats (CLI version, command, result, error type, OS, Bun version).");
-  console.error(`Disable with PERCHER_NO_TELEMETRY=1 or DO_NOT_TRACK=1
-`);
-  try {
-    mkdirSync7(configDir, { recursive: true });
-    writeFileSync11(markerFile, new Date().toISOString());
-  } catch {}
-}
-
 // src/context.ts
 async function createCliContext() {
   const client = new PercherClient({ clientVersion: `percher-cli/${VERSION}` });
@@ -122693,52 +123619,52 @@ async function createCliContext() {
 
 // src/output.ts
 init_dist();
-var import_picocolors18 = __toESM(require_picocolors(), 1);
+var import_picocolors19 = __toESM(require_picocolors(), 1);
 async function renderError(stderr, error48) {
   const writer = stderr.getWriter();
   const encoder = new TextEncoder;
   const lines = [];
   if (error48 instanceof PercherTomlError) {
-    lines.push(`${import_picocolors18.default.red(`error (${error48.code}):`)} ${error48.message}`);
+    lines.push(`${import_picocolors19.default.red(`error (${error48.code}):`)} ${error48.message}`);
     if (error48.tomlLine !== undefined) {
-      lines.push(import_picocolors18.default.dim(`  at percher.toml line ${error48.tomlLine}`));
+      lines.push(import_picocolors19.default.dim(`  at percher.toml line ${error48.tomlLine}`));
     }
     for (const issue2 of error48.issues ?? []) {
-      lines.push(`${import_picocolors18.default.dim("  · ") + import_picocolors18.default.yellow(issue2.path.join("."))}: ${issue2.message}`);
+      lines.push(`${import_picocolors19.default.dim("  · ") + import_picocolors19.default.yellow(issue2.path.join("."))}: ${issue2.message}`);
     }
   } else if (error48 instanceof SunsetError) {
     if (error48.gateCode === "platform_delete_gated") {
-      lines.push(`${import_picocolors18.default.yellow("Percher is shutting down — deletes are paused.")}`);
+      lines.push(`${import_picocolors19.default.yellow("Percher is shutting down — deletes are paused.")}`);
       lines.push(error48.message);
-      lines.push(import_picocolors18.default.dim(`  To delete and permanently forfeit your export window, confirm with your password in the dashboard: ${error48.dashboardUrl}`));
-      lines.push(import_picocolors18.default.dim("  The CLI cannot perform this delete during sunset — it must go through the dashboard."));
+      lines.push(import_picocolors19.default.dim(`  To delete and permanently forfeit your export window, confirm with your password in the dashboard: ${error48.dashboardUrl}`));
+      lines.push(import_picocolors19.default.dim("  The CLI cannot perform this delete during sunset — it must go through the dashboard."));
     } else {
-      lines.push(`${import_picocolors18.default.yellow("Percher is in read-only mode ahead of shutdown.")}`);
+      lines.push(`${import_picocolors19.default.yellow("Percher is in read-only mode ahead of shutdown.")}`);
       lines.push(error48.message);
-      lines.push(import_picocolors18.default.dim(`  Your apps keep running. Export them any time from the dashboard: ${error48.dashboardUrl}`));
+      lines.push(import_picocolors19.default.dim(`  Your apps keep running. Export them any time from the dashboard: ${error48.dashboardUrl}`));
     }
-    lines.push(import_picocolors18.default.dim(`  Final data deletion: ${error48.finalDeletionDate}`));
+    lines.push(import_picocolors19.default.dim(`  Final data deletion: ${error48.finalDeletionDate}`));
   } else if (error48 instanceof PercherApiError) {
     if (error48.status === 502 || error48.status === 503) {
-      lines.push(`${import_picocolors18.default.red("error:")} Percher API is temporarily unavailable (HTTP ${error48.status}). Try again in a few seconds.`);
+      lines.push(`${import_picocolors19.default.red("error:")} Percher API is temporarily unavailable (HTTP ${error48.status}). Try again in a few seconds.`);
     } else {
-      lines.push(`${import_picocolors18.default.red("error:")} ${error48.message}`);
-      lines.push(import_picocolors18.default.dim(`  ${error48.code} (HTTP ${error48.status})`));
+      lines.push(`${import_picocolors19.default.red("error:")} ${error48.message}`);
+      lines.push(import_picocolors19.default.dim(`  ${error48.code} (HTTP ${error48.status})`));
     }
     if (error48.requestId)
-      lines.push(import_picocolors18.default.dim(`  request: ${error48.requestId}`));
+      lines.push(import_picocolors19.default.dim(`  request: ${error48.requestId}`));
   } else if (error48 instanceof PercherCoreError) {
-    lines.push(`${import_picocolors18.default.red(`error (${error48.code}):`)} ${error48.message}`);
+    lines.push(`${import_picocolors19.default.red(`error (${error48.code}):`)} ${error48.message}`);
     if (error48.hint)
-      lines.push(import_picocolors18.default.dim(`  ${error48.hint}`));
+      lines.push(import_picocolors19.default.dim(`  ${error48.hint}`));
   } else if (error48 instanceof Error) {
-    lines.push(`${import_picocolors18.default.red("unexpected error:")} ${error48.message}`);
+    lines.push(`${import_picocolors19.default.red("unexpected error:")} ${error48.message}`);
     if (error48.stack)
-      lines.push(import_picocolors18.default.dim(error48.stack.split(`
+      lines.push(import_picocolors19.default.dim(error48.stack.split(`
 `).slice(1, 4).join(`
 `)));
   } else {
-    lines.push(`${import_picocolors18.default.red("unexpected error:")} ${String(error48)}`);
+    lines.push(`${import_picocolors19.default.red("unexpected error:")} ${String(error48)}`);
   }
   try {
     await writer.write(encoder.encode(`${lines.join(`
@@ -122750,7 +123676,7 @@ async function renderError(stderr, error48) {
 }
 
 // src/version-check.ts
-var import_picocolors19 = __toESM(require_picocolors(), 1);
+var import_picocolors20 = __toESM(require_picocolors(), 1);
 function isNewerStableVersion(latest, current) {
   const stable = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
   if (typeof latest !== "string" || latest.length > 64 || current.length > 64 || !stable.test(latest) || !stable.test(current))
@@ -122777,16 +123703,16 @@ async function checkForUpdates() {
     const data2 = await res.json();
     const latest = data2.version;
     if (isNewerStableVersion(latest, VERSION)) {
-      console.error(import_picocolors19.default.yellow(`
+      console.error(import_picocolors20.default.yellow(`
 Update available: ${VERSION} → ${latest}`));
-      console.error(import_picocolors19.default.dim(`Run: bunx percher@latest
+      console.error(import_picocolors20.default.dim(`Run: bunx percher@latest
 `));
     }
   } catch {}
 }
 
 // src/index.ts
-async function run(argv, ctxOverride) {
+async function run(argv, ctxOverride, options = {}) {
   const cli = cac("percher");
   const ctx = ctxOverride ?? await createCliContext();
   registerAppsCommands(cli, ctx);
@@ -122802,6 +123728,7 @@ async function run(argv, ctxOverride) {
   registerMigrateCommands(cli, ctx);
   registerSharingCommands(cli, ctx);
   registerStatusCommands(cli, ctx);
+  registerTelemetryCommands(cli, ctx);
   registerTokenCommands(cli, ctx);
   registerTransfersCommands(cli, ctx);
   registerAdminCommands(cli, ctx);
@@ -122809,10 +123736,14 @@ async function run(argv, ctxOverride) {
   cli.version(VERSION);
   const command = argv[0] ?? "help";
   try {
-    await showTelemetryNotice();
     cli.parse(["percher", "percher", ...argv], { run: false });
     const requested = argv[0];
     if (cli.matchedCommand) {
+      await askTelemetryConsentOnce(ctx, argv, cli.matchedCommand.name, {
+        ask: options.askTelemetry ?? askOnStdin,
+        stderrIsTTY: options.stderrIsTTY ?? process.stderr.isTTY === true,
+        setTimer: options.setTimer
+      });
       await cli.runMatchedCommand();
     } else if (requested === undefined || requested === "help") {
       cli.outputHelp();