percher 1.2.0 → 1.3.0

package/dist/bin/percher.js

@@ -4850,7 +4850,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@percher/client",
-    version: "1.2.0",
+    version: "1.3.0",
     description: "Official TypeScript SDK for Percher: deploy apps, manage env vars, stream logs, and automate hosting workflows.",
     keywords: [
       "percher",
@@ -4891,7 +4891,7 @@ var init_package = __esm(() => {
       typecheck: "tsc --noEmit"
     },
     dependencies: {
-      "@percher/toml": "^1.0.3"
+      "@percher/toml": "^1.0.4"
     },
     devDependencies: {
       "bun-types": "^1.1.0",
@@ -5663,6 +5663,58 @@ class BillingResource {
   }
 }
 
+// ../client/dist/resources/data-records.js
+function dataPathSegment(kind, value) {
+  const re = kind === "collection" ? COLLECTION_RE : RECORD_ID_RE;
+  if (!re.test(value))
+    throw new TypeError(`invalid data ${kind}`);
+  return encodeURIComponent(value);
+}
+function outcomeUnknown(cause, observed) {
+  const answered = cause instanceof PercherApiError;
+  return new PercherApiError(OUTCOME_UNKNOWN_MESSAGE, {
+    status: answered ? cause.status : 0,
+    code: "DATA_WRITE_OUTCOME_UNKNOWN",
+    requestId: answered ? cause.requestId : undefined,
+    cause,
+    extra: { observed }
+  });
+}
+function isRecordReply(reply) {
+  return typeof reply === "object" && reply !== null && !Array.isArray(reply) && typeof reply.id === "string" && reply.id.length > 0;
+}
+function isDeleteReply(reply) {
+  return reply === undefined || typeof reply === "object" && reply !== null && !Array.isArray(reply);
+}
+async function writeOnce(run, usable) {
+  let reply;
+  try {
+    reply = await run();
+  } catch (err) {
+    if (err instanceof SunsetError)
+      throw err;
+    if (err instanceof PercherApiError) {
+      if (err.code === "DATA_WRITE_OUTCOME_UNKNOWN")
+        throw err;
+      if (err.status >= 400 && err.status < 500)
+        throw err;
+      if (err.status >= 500 && WRITE_NOT_SENT.has(err.code))
+        throw err;
+    }
+    throw outcomeUnknown(err, err instanceof PercherApiError ? "error_response" : "no_usable_response");
+  }
+  if (!usable(reply))
+    throw outcomeUnknown(undefined, "unusable_reply");
+  return reply;
+}
+var COLLECTION_RE, RECORD_ID_RE, WRITE_NOT_SENT, OUTCOME_UNKNOWN_MESSAGE = "No usable answer arrived for this write, so it may or may not have been saved.";
+var init_data_records = __esm(() => {
+  init_errors();
+  COLLECTION_RE = /^[A-Za-z][A-Za-z0-9_]{0,63}$/;
+  RECORD_ID_RE = /^[A-Za-z0-9_-]{1,64}$/;
+  WRITE_NOT_SENT = new Set(["PB_NOT_RUNNING", "PB_AUTH_FAILED", "PB_VERSION_UNSUPPORTED"]);
+});
+
 // ../client/dist/resources/data.js
 class DataResource {
   http;
@@ -5699,7 +5751,37 @@ class DataResource {
   removeOAuthProvider(appRef, provider) {
     return this.http.delete(`/apps/${encodeURIComponent(appRef)}/data/oauth/${encodeURIComponent(provider)}`);
   }
+  getSchema(appRef) {
+    return this.http.get(`/apps/${encodeURIComponent(appRef)}/data/schema`);
+  }
+  queryRecords(appRef, collection, query = {}) {
+    return this.http.post(`${this.records(appRef, collection)}/query`, query);
+  }
+  getRecord(appRef, collection, id) {
+    return this.http.get(this.record(appRef, collection, id));
+  }
+  createRecord(appRef, collection, input) {
+    const path = this.records(appRef, collection);
+    return writeOnce(() => this.http.post(path, input), isRecordReply);
+  }
+  updateRecord(appRef, collection, id, input) {
+    const path = this.record(appRef, collection, id);
+    return writeOnce(() => this.http.patch(path, input), isRecordReply);
+  }
+  async deleteRecord(appRef, collection, id) {
+    const path = this.record(appRef, collection, id);
+    await writeOnce(() => this.http.deleteJson(path), isDeleteReply);
+  }
+  records(appRef, collection) {
+    return `/apps/${encodeURIComponent(appRef)}/data/collections/${dataPathSegment("collection", collection)}/records`;
+  }
+  record(appRef, collection, id) {
+    return `${this.records(appRef, collection)}/${dataPathSegment("id", id)}`;
+  }
 }
+var init_data = __esm(() => {
+  init_data_records();
+});
 
 // ../client/dist/resources/env.js
 function scopeQuery(opts) {
@@ -6163,6 +6245,7 @@ var init_client = __esm(() => {
   init_http();
   init_apps();
   init_auth();
+  init_data();
   init_logs();
 });
 
@@ -6341,6 +6424,7 @@ var init_dist = __esm(() => {
   init_errors();
   init_apps();
   init_auth();
+  init_data();
   init_logs();
   init_telemetry_consent();
 });
@@ -6789,19 +6873,19 @@ var require_tslib = __commonJS((exports, module) => {
         }
       return t;
     };
-    __decorate = function(decorators, target, key, desc) {
-      var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    __decorate = function(decorators, target2, key, desc) {
+      var c = arguments.length, r = c < 3 ? target2 : desc === null ? desc = Object.getOwnPropertyDescriptor(target2, key) : desc, d;
       if (typeof Reflect === "object" && typeof Reflect.decorate === "function")
-        r = Reflect.decorate(decorators, target, key, desc);
+        r = Reflect.decorate(decorators, target2, key, desc);
       else
         for (var i = decorators.length - 1;i >= 0; i--)
           if (d = decorators[i])
-            r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-      return c > 3 && r && Object.defineProperty(target, key, r), r;
+            r = (c < 3 ? d(r) : c > 3 ? d(target2, key, r) : d(target2, key)) || r;
+      return c > 3 && r && Object.defineProperty(target2, key, r), r;
     };
     __param = function(paramIndex, decorator) {
-      return function(target, key) {
-        decorator(target, key, paramIndex);
+      return function(target2, key) {
+        decorator(target2, key, paramIndex);
       };
     };
     __esDecorate = function(ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
@@ -6811,8 +6895,8 @@ var require_tslib = __commonJS((exports, module) => {
         return f;
       }
       var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
-      var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
-      var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+      var target2 = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+      var descriptor = descriptorIn || (target2 ? Object.getOwnPropertyDescriptor(target2, contextIn.name) : {});
       var _, done = false;
       for (var i = decorators.length - 1;i >= 0; i--) {
         var context = {};
@@ -6844,8 +6928,8 @@ var require_tslib = __commonJS((exports, module) => {
             descriptor[key] = _;
         }
       }
-      if (target)
-        Object.defineProperty(target, contextIn.name, descriptor);
+      if (target2)
+        Object.defineProperty(target2, contextIn.name, descriptor);
       done = true;
     };
     __runInitializers = function(thisArg, initializers, value) {
@@ -9022,13 +9106,13 @@ var require_path_visitor = __commonJS((exports, module) => {
       isFunction.assert(Visitor.visit);
       return new Visitor;
     };
-    function extend2(target, source) {
+    function extend2(target2, source) {
       for (var property in source) {
         if (hasOwn.call(source, property)) {
-          target[property] = source[property];
+          target2[property] = source[property];
         }
       }
-      return target;
+      return target2;
     }
     PathVisitor.visit = function visit(node, methods) {
       return PathVisitor.fromMethodsObject(methods).visit(node);
@@ -12603,27 +12687,27 @@ var require_esprima2 = __commonJS((exports, module) => {
           };
           CommentHandler2.prototype.findLeadingComments = function(metadata) {
             var leadingComments = [];
-            var target;
+            var target2;
             while (this.stack.length > 0) {
               var entry = this.stack[this.stack.length - 1];
               if (entry && entry.start >= metadata.start.offset) {
-                target = entry.node;
+                target2 = entry.node;
                 this.stack.pop();
               } else {
                 break;
               }
             }
-            if (target) {
-              var count = target.leadingComments ? target.leadingComments.length : 0;
+            if (target2) {
+              var count = target2.leadingComments ? target2.leadingComments.length : 0;
               for (var i = count - 1;i >= 0; --i) {
-                var comment = target.leadingComments[i];
+                var comment = target2.leadingComments[i];
                 if (comment.range[1] <= metadata.start.offset) {
                   leadingComments.unshift(comment);
-                  target.leadingComments.splice(i, 1);
+                  target2.leadingComments.splice(i, 1);
                 }
               }
-              if (target.leadingComments && target.leadingComments.length === 0) {
-                delete target.leadingComments;
+              if (target2.leadingComments && target2.leadingComments.length === 0) {
+                delete target2.leadingComments;
               }
               return leadingComments;
             }
@@ -13109,9 +13193,9 @@ var require_esprima2 = __commonJS((exports, module) => {
             if (this.match("}")) {
               this.tolerateError("JSX attributes must only be assigned a non-empty expression");
             }
-            var expression = this.parseAssignmentExpression();
+            var expression2 = this.parseAssignmentExpression();
             this.reenterJSX();
-            return this.finalize(node, new JSXNode.JSXExpressionContainer(expression));
+            return this.finalize(node, new JSXNode.JSXExpressionContainer(expression2));
           };
           JSXParser2.prototype.parseJSXAttributeValue = function() {
             return this.matchJSX("{") ? this.parseJSXExpressionAttribute() : this.matchJSX("<") ? this.parseJSXElement() : this.parseJSXStringLiteralAttribute();
@@ -13184,16 +13268,16 @@ var require_esprima2 = __commonJS((exports, module) => {
           JSXParser2.prototype.parseJSXExpressionContainer = function() {
             var node = this.createJSXNode();
             this.expectJSX("{");
-            var expression;
+            var expression2;
             if (this.matchJSX("}")) {
-              expression = this.parseJSXEmptyExpression();
+              expression2 = this.parseJSXEmptyExpression();
               this.expectJSX("}");
             } else {
               this.finishJSX();
-              expression = this.parseAssignmentExpression();
+              expression2 = this.parseAssignmentExpression();
               this.reenterJSX();
             }
-            return this.finalize(node, new JSXNode.JSXExpressionContainer(expression));
+            return this.finalize(node, new JSXNode.JSXExpressionContainer(expression2));
           };
           JSXParser2.prototype.parseJSXChildren = function() {
             var children = [];
@@ -13339,9 +13423,9 @@ var require_esprima2 = __commonJS((exports, module) => {
         }();
         exports2.JSXEmptyExpression = JSXEmptyExpression;
         var JSXExpressionContainer = function() {
-          function JSXExpressionContainer2(expression) {
+          function JSXExpressionContainer2(expression2) {
             this.type = jsx_syntax_1.JSXSyntax.JSXExpressionContainer;
-            this.expression = expression;
+            this.expression = expression2;
           }
           return JSXExpressionContainer2;
         }();
@@ -13445,13 +13529,13 @@ var require_esprima2 = __commonJS((exports, module) => {
         }();
         exports2.ArrayPattern = ArrayPattern;
         var ArrowFunctionExpression = function() {
-          function ArrowFunctionExpression2(params, body, expression) {
+          function ArrowFunctionExpression2(params, body, expression2) {
             this.type = syntax_1.Syntax.ArrowFunctionExpression;
             this.id = null;
             this.params = params;
             this.body = body;
             this.generator = false;
-            this.expression = expression;
+            this.expression = expression2;
             this.async = false;
           }
           return ArrowFunctionExpression2;
@@ -13477,13 +13561,13 @@ var require_esprima2 = __commonJS((exports, module) => {
         }();
         exports2.AssignmentPattern = AssignmentPattern;
         var AsyncArrowFunctionExpression = function() {
-          function AsyncArrowFunctionExpression2(params, body, expression) {
+          function AsyncArrowFunctionExpression2(params, body, expression2) {
             this.type = syntax_1.Syntax.ArrowFunctionExpression;
             this.id = null;
             this.params = params;
             this.body = body;
             this.generator = false;
-            this.expression = expression;
+            this.expression = expression2;
             this.async = true;
           }
           return AsyncArrowFunctionExpression2;
@@ -13632,9 +13716,9 @@ var require_esprima2 = __commonJS((exports, module) => {
         }();
         exports2.DebuggerStatement = DebuggerStatement;
         var Directive = function() {
-          function Directive2(expression, directive) {
+          function Directive2(expression2, directive) {
             this.type = syntax_1.Syntax.ExpressionStatement;
-            this.expression = expression;
+            this.expression = expression2;
             this.directive = directive;
           }
           return Directive2;
@@ -13692,9 +13776,9 @@ var require_esprima2 = __commonJS((exports, module) => {
         }();
         exports2.ExportSpecifier = ExportSpecifier;
         var ExpressionStatement = function() {
-          function ExpressionStatement2(expression) {
+          function ExpressionStatement2(expression2) {
             this.type = syntax_1.Syntax.ExpressionStatement;
-            this.expression = expression;
+            this.expression = expression2;
           }
           return ExpressionStatement2;
         }();
@@ -15428,14 +15512,14 @@ var require_esprima2 = __commonJS((exports, module) => {
                   } else {
                     body = this.isolateCoverGrammar(this.parseAssignmentExpression);
                   }
-                  var expression = body.type !== syntax_1.Syntax.BlockStatement;
+                  var expression2 = body.type !== syntax_1.Syntax.BlockStatement;
                   if (this.context.strict && list.firstRestricted) {
                     this.throwUnexpectedToken(list.firstRestricted, list.message);
                   }
                   if (this.context.strict && list.stricted) {
                     this.tolerateUnexpectedToken(list.stricted, list.message);
                   }
-                  expr = isAsync ? this.finalize(node, new Node.AsyncArrowFunctionExpression(list.params, body, expression)) : this.finalize(node, new Node.ArrowFunctionExpression(list.params, body, expression));
+                  expr = isAsync ? this.finalize(node, new Node.AsyncArrowFunctionExpression(list.params, body, expression2)) : this.finalize(node, new Node.ArrowFunctionExpression(list.params, body, expression2));
                   this.context.strict = previousStrict;
                   this.context.allowStrictDirective = previousAllowStrictDirective;
                   this.context.allowYield = previousAllowYield;
@@ -19985,7 +20069,7 @@ var require_fast_path = __commonJS((exports) => {
     }
     return s[0];
   };
-  FPp.call = function call(callback) {
+  FPp.call = function call2(callback) {
     var s = this.stack;
     var origLen = s.length;
     var value = s[origLen - 1];
@@ -22228,8 +22312,8 @@ while`);
         return (0, lines_1.concat)([path.call(print, "left"), ".", path.call(print, "right")]);
       case "TSAsExpression":
       case "TSSatisfiesExpression": {
-        var expression = path.call(print, "expression");
-        parts.push(expression, n.type === "TSSatisfiesExpression" ? " satisfies " : " as ", path.call(print, "typeAnnotation"));
+        var expression2 = path.call(print, "expression");
+        parts.push(expression2, n.type === "TSSatisfiesExpression" ? " satisfies " : " as ", path.call(print, "typeAnnotation"));
         return (0, lines_1.concat)(parts);
       }
       case "TSTypeCastExpression":
@@ -23864,9 +23948,9 @@ var require_lib = __commonJS((exports) => {
     UnsupportedDefaultExport: "Only expressions, functions or classes are allowed as the `default` export.",
     UnsupportedImport: "`import` can only be used in `import()` or `import.meta`.",
     UnsupportedMetaProperty: ({
-      target,
+      target: target2,
       onlyValidPropertyName
-    }) => `The only valid meta property for ${target} is ${target}.${onlyValidPropertyName}.`,
+    }) => `The only valid meta property for ${target2} is ${target2}.${onlyValidPropertyName}.`,
     UnsupportedParameterDecorator: "Decorators cannot be used to decorate parameters.",
     UnsupportedPropertyDecorator: "Decorators cannot be used to decorate object literal properties.",
     UnsupportedSuper: "'super' can only be used with function calls (i.e. super()) or in property accesses (i.e. super.prop or super[prop]).",
@@ -24154,15 +24238,15 @@ var require_lib = __commonJS((exports) => {
       return this.finishNodeAt(chain, "ChainExpression", endLoc);
     }
     directiveToStmt(directive) {
-      const expression = directive.value;
+      const expression2 = directive.value;
       delete directive.value;
-      this.castNodeTo(expression, "Literal");
-      expression.raw = expression.extra.raw;
-      expression.value = expression.extra.expressionValue;
+      this.castNodeTo(expression2, "Literal");
+      expression2.raw = expression2.extra.raw;
+      expression2.value = expression2.extra.expressionValue;
       const stmt = this.castNodeTo(directive, "ExpressionStatement");
-      stmt.expression = expression;
-      stmt.directive = expression.extra.rawValue;
-      delete expression.extra;
+      stmt.expression = expression2;
+      stmt.directive = expression2.extra.rawValue;
+      delete expression2.extra;
       return stmt;
     }
     fillOptionalPropertiesForTSESLint(node) {}
@@ -27113,14 +27197,14 @@ var require_lib = __commonJS((exports) => {
         this.resetEndLocation(decl.id);
       }
     }
-    parseAsyncArrowFromCallExpression(node, call) {
+    parseAsyncArrowFromCallExpression(node, call2) {
       if (this.match(14)) {
         const oldNoAnonFunctionType = this.state.noAnonFunctionType;
         this.state.noAnonFunctionType = true;
         node.returnType = this.flowParseTypeAnnotation();
         this.state.noAnonFunctionType = oldNoAnonFunctionType;
       }
-      return super.parseAsyncArrowFromCallExpression(node, call);
+      return super.parseAsyncArrowFromCallExpression(node, call2);
     }
     shouldParseAsyncArrow() {
       return this.match(14) || super.shouldParseAsyncArrow();
@@ -28274,8 +28358,8 @@ var require_lib = __commonJS((exports) => {
       if (this.match(8)) {
         node.expression = this.jsxParseEmptyExpression();
       } else {
-        const expression = this.parseExpression();
-        node.expression = expression;
+        const expression2 = this.parseExpression();
+        node.expression = expression2;
       }
       this.setContext(previousContext);
       this.state.canStartJSXElement = true;
@@ -31211,53 +31295,53 @@ var require_lib = __commonJS((exports) => {
       }
       return false;
     }
-    isOptionalMemberExpression(expression) {
-      return expression.type === "OptionalMemberExpression";
+    isOptionalMemberExpression(expression2) {
+      return expression2.type === "OptionalMemberExpression";
     }
-    checkLVal(expression, ancestor, binding = 64, checkClashes = false, strictModeChanged = false, hasParenthesizedAncestor = false, disallowCallExpression = false) {
+    checkLVal(expression2, ancestor, binding = 64, checkClashes = false, strictModeChanged = false, hasParenthesizedAncestor = false, disallowCallExpression = false) {
       var _expression$extra;
-      const type = expression.type;
-      if (this.isObjectMethod(expression))
+      const type = expression2.type;
+      if (this.isObjectMethod(expression2))
         return;
-      const isOptionalMemberExpression = this.isOptionalMemberExpression(expression);
+      const isOptionalMemberExpression = this.isOptionalMemberExpression(expression2);
       if (isOptionalMemberExpression || type === "MemberExpression") {
         if (isOptionalMemberExpression) {
-          this.expectPlugin("optionalChainingAssign", expression.loc.start);
+          this.expectPlugin("optionalChainingAssign", expression2.loc.start);
           if (ancestor.type !== "AssignmentExpression") {
-            this.raise(Errors.InvalidLhsOptionalChaining, expression, {
+            this.raise(Errors.InvalidLhsOptionalChaining, expression2, {
               ancestor
             });
           }
         }
         if (binding !== 64) {
-          this.raise(Errors.InvalidPropertyBindingPattern, expression);
+          this.raise(Errors.InvalidPropertyBindingPattern, expression2);
         }
         return;
       }
       if (type === "Identifier") {
-        this.checkIdentifier(expression, binding, strictModeChanged);
+        this.checkIdentifier(expression2, binding, strictModeChanged);
         const {
           name
-        } = expression;
+        } = expression2;
         if (checkClashes) {
           if (checkClashes.has(name)) {
-            this.raise(Errors.ParamDupe, expression);
+            this.raise(Errors.ParamDupe, expression2);
           } else {
             checkClashes.add(name);
           }
         }
         return;
       } else if (type === "VoidPattern" && ancestor.type === "CatchClause") {
-        this.raise(Errors.VoidPatternCatchClauseParam, expression);
+        this.raise(Errors.VoidPatternCatchClauseParam, expression2);
       }
-      const unwrappedExpression = unwrapParenthesizedExpression(expression);
+      const unwrappedExpression = unwrapParenthesizedExpression(expression2);
       disallowCallExpression || (disallowCallExpression = unwrappedExpression.type === "CallExpression" && (unwrappedExpression.callee.type === "Import" || unwrappedExpression.callee.type === "Super"));
-      const validity = this.isValidLVal(type, disallowCallExpression, !(hasParenthesizedAncestor || (_expression$extra = expression.extra) != null && _expression$extra.parenthesized) && ancestor.type === "AssignmentExpression", binding);
+      const validity = this.isValidLVal(type, disallowCallExpression, !(hasParenthesizedAncestor || (_expression$extra = expression2.extra) != null && _expression$extra.parenthesized) && ancestor.type === "AssignmentExpression", binding);
       if (validity === true)
         return;
       if (validity === false) {
         const ParseErrorClass = binding === 64 ? Errors.InvalidLhs : Errors.InvalidLhsBinding;
-        this.raise(ParseErrorClass, expression, {
+        this.raise(ParseErrorClass, expression2, {
           ancestor
         });
         return;
@@ -31272,7 +31356,7 @@ var require_lib = __commonJS((exports) => {
       const nextAncestor = type === "ArrayPattern" || type === "ObjectPattern" ? {
         type
       } : ancestor;
-      const val = expression[key];
+      const val = expression2[key];
       if (Array.isArray(val)) {
         for (const child of val) {
           if (child) {
@@ -33530,11 +33614,11 @@ var require_lib = __commonJS((exports) => {
         this.resetEndLocation(decl.id);
       }
     }
-    parseAsyncArrowFromCallExpression(node, call) {
+    parseAsyncArrowFromCallExpression(node, call2) {
       if (this.match(14)) {
         node.returnType = this.tsParseTypeAnnotation();
       }
-      return super.parseAsyncArrowFromCallExpression(node, call);
+      return super.parseAsyncArrowFromCallExpression(node, call2);
     }
     parseMaybeAssign(refExpressionErrors, afterLeftParse) {
       var _jsx, _jsx2, _typeCast, _jsx3, _typeCast2;
@@ -33725,9 +33809,9 @@ var require_lib = __commonJS((exports) => {
       if (this.match(47) || this.match(51)) {
         const typeArguments = this.tsParseTypeArgumentsInExpression();
         if (this.match(10)) {
-          const call = super.parseMaybeDecoratorArguments(expr, startLoc);
-          call.typeParameters = typeArguments;
-          return call;
+          const call2 = super.parseMaybeDecoratorArguments(expr, startLoc);
+          call2.typeParameters = typeArguments;
+          return call2;
         }
         this.unexpected(null, 10);
       }
@@ -34117,31 +34201,31 @@ var require_lib = __commonJS((exports) => {
       return this.chStartsBindingIdentifier(nextCh, next) || nextCh === 34 || nextCh === 39;
     }
   };
-  function isPossiblyLiteralEnum(expression) {
-    if (expression.type !== "MemberExpression")
+  function isPossiblyLiteralEnum(expression2) {
+    if (expression2.type !== "MemberExpression")
       return false;
     const {
       computed,
       property
-    } = expression;
+    } = expression2;
     if (computed && property.type !== "StringLiteral" && (property.type !== "TemplateLiteral" || property.expressions.length > 0)) {
       return false;
     }
-    return isUncomputedMemberExpressionChain(expression.object);
+    return isUncomputedMemberExpressionChain(expression2.object);
   }
-  function isValidAmbientConstInitializer(expression, estree2) {
+  function isValidAmbientConstInitializer(expression2, estree2) {
     var _expression$extra;
     const {
       type
-    } = expression;
-    if ((_expression$extra = expression.extra) != null && _expression$extra.parenthesized) {
+    } = expression2;
+    if ((_expression$extra = expression2.extra) != null && _expression$extra.parenthesized) {
       return false;
     }
     if (estree2) {
       if (type === "Literal") {
         const {
           value
-        } = expression;
+        } = expression2;
         if (typeof value === "string" || typeof value === "boolean") {
           return true;
         }
@@ -34151,42 +34235,42 @@ var require_lib = __commonJS((exports) => {
         return true;
       }
     }
-    if (isNumber(expression, estree2) || isNegativeNumber(expression, estree2)) {
+    if (isNumber(expression2, estree2) || isNegativeNumber(expression2, estree2)) {
       return true;
     }
-    if (type === "TemplateLiteral" && expression.expressions.length === 0) {
+    if (type === "TemplateLiteral" && expression2.expressions.length === 0) {
       return true;
     }
-    if (isPossiblyLiteralEnum(expression)) {
+    if (isPossiblyLiteralEnum(expression2)) {
       return true;
     }
     return false;
   }
-  function isNumber(expression, estree2) {
+  function isNumber(expression2, estree2) {
     if (estree2) {
-      return expression.type === "Literal" && (typeof expression.value === "number" || ("bigint" in expression));
+      return expression2.type === "Literal" && (typeof expression2.value === "number" || ("bigint" in expression2));
     }
-    return expression.type === "NumericLiteral" || expression.type === "BigIntLiteral";
+    return expression2.type === "NumericLiteral" || expression2.type === "BigIntLiteral";
   }
-  function isNegativeNumber(expression, estree2) {
-    if (expression.type === "UnaryExpression") {
+  function isNegativeNumber(expression2, estree2) {
+    if (expression2.type === "UnaryExpression") {
       const {
         operator,
         argument
-      } = expression;
+      } = expression2;
       if (operator === "-" && isNumber(argument, estree2)) {
         return true;
       }
     }
     return false;
   }
-  function isUncomputedMemberExpressionChain(expression) {
-    if (expression.type === "Identifier")
+  function isUncomputedMemberExpressionChain(expression2) {
+    if (expression2.type === "Identifier")
       return true;
-    if (expression.type !== "MemberExpression" || expression.computed) {
+    if (expression2.type !== "MemberExpression" || expression2.computed) {
       return false;
     }
-    return isUncomputedMemberExpressionChain(expression.object);
+    return isUncomputedMemberExpressionChain(expression2.object);
   }
   var PlaceholderErrors = ParseErrorEnum`placeholders`({
     ClassNameIsRequired: "A class name is required.",
@@ -35048,16 +35132,16 @@ var require_lib = __commonJS((exports) => {
     shouldParseAsyncArrow() {
       return this.match(19) && !this.canInsertSemicolon();
     }
-    parseAsyncArrowFromCallExpression(node, call) {
+    parseAsyncArrowFromCallExpression(node, call2) {
       var _call$extra;
-      this.resetPreviousNodeTrailingComments(call);
+      this.resetPreviousNodeTrailingComments(call2);
       this.expect(19);
-      this.parseArrowExpression(node, call.arguments, true, (_call$extra = call.extra) == null ? undefined : _call$extra.trailingCommaLoc);
-      if (call.innerComments) {
-        setInnerComments(node, call.innerComments);
+      this.parseArrowExpression(node, call2.arguments, true, (_call$extra = call2.extra) == null ? undefined : _call$extra.trailingCommaLoc);
+      if (call2.innerComments) {
+        setInnerComments(node, call2.innerComments);
       }
-      if (call.callee.trailingComments) {
-        setInnerComments(node, call.callee.trailingComments);
+      if (call2.callee.trailingComments) {
+        setInnerComments(node, call2.callee.trailingComments);
       }
       return node;
     }
@@ -35485,15 +35569,15 @@ var require_lib = __commonJS((exports) => {
       }
       return this.wrapParenthesis(startLoc, val);
     }
-    wrapParenthesis(startLoc, expression) {
+    wrapParenthesis(startLoc, expression2) {
       if (!(this.optionFlags & 1024)) {
-        this.addExtra(expression, "parenthesized", true);
-        this.addExtra(expression, "parenStart", startLoc.index);
-        this.takeSurroundingComments(expression, startLoc.index, this.state.lastTokEndLoc.index);
-        return expression;
+        this.addExtra(expression2, "parenthesized", true);
+        this.addExtra(expression2, "parenStart", startLoc.index);
+        this.takeSurroundingComments(expression2, startLoc.index, this.state.lastTokEndLoc.index);
+        return expression2;
       }
       const parenExpression = this.startNodeAt(startLoc);
-      parenExpression.expression = expression;
+      parenExpression.expression = expression2;
       return this.finishNode(parenExpression, "ParenthesizedExpression");
     }
     shouldParseArrow(params) {
@@ -36141,10 +36225,10 @@ var require_lib = __commonJS((exports) => {
         return this.finishNode(bodyNode, "PipelineTopicExpression");
       }
     }
-    isSimpleReference(expression) {
-      switch (expression.type) {
+    isSimpleReference(expression2) {
+      switch (expression2.type) {
         case "MemberExpression":
-          return !expression.computed && this.isSimpleReference(expression.object);
+          return !expression2.computed && this.isSimpleReference(expression2.object);
         case "Identifier":
           return true;
         default:
@@ -86915,17 +86999,17 @@ var require_template = __commonJS((exports, module) => {
     function statement() {
       return statements.apply(null, arguments)[0];
     }
-    function expression(template) {
+    function expression2(template) {
       template = Array.from(template);
       if (template.length > 0) {
         template[0] = "(" + template[0];
         template[template.length - 1] += ")";
       }
-      const expression2 = statement.apply(null, [template].concat(Array.from(arguments).slice(1))).expression;
-      if (expression2.extra) {
-        expression2.extra.parenthesized = false;
+      const expression3 = statement.apply(null, [template].concat(Array.from(arguments).slice(1))).expression;
+      if (expression3.extra) {
+        expression3.extra.parenthesized = false;
       }
-      return expression2;
+      return expression3;
     }
     function asyncExpression(template) {
       template = Array.from(template);
@@ -86933,13 +87017,13 @@ var require_template = __commonJS((exports, module) => {
         template[0] = "async () => (" + template[0];
         template[template.length - 1] += ")";
       }
-      const expression2 = statement.apply(null, [template].concat(Array.from(arguments).slice(1))).expression.body;
-      if (expression2.extra) {
-        expression2.extra.parenthesized = false;
+      const expression3 = statement.apply(null, [template].concat(Array.from(arguments).slice(1))).expression.body;
+      if (expression3.extra) {
+        expression3.extra.parenthesized = false;
       }
-      return expression2;
+      return expression3;
     }
-    return { statements, statement, expression, asyncExpression };
+    return { statements, statement, expression: expression2, asyncExpression };
   };
 });
 
@@ -92736,6 +92820,152 @@ function iconColourHex(token) {
     return BRAND.green;
   return ICON_COLOURS[token] ?? BRAND.green;
 }
+// ../shared/dist/data-records.js
+var DATA_COLLECTION_RE = /^[A-Za-z][A-Za-z0-9_]{0,63}$/;
+var DATA_RECORD_ID_RE = /^[A-Za-z0-9_-]{1,64}$/;
+var DATA_LIMITS = {
+  bodyBytes: 262144,
+  responseBytes: 1048576,
+  maxPage: 1000,
+  maxPerPage: 100,
+  expressionChars: 1024,
+  filterMaxDepth: 16,
+  filterMaxComparisons: 64,
+  accessMaxApps: 50,
+  schemaPerPage: 200,
+  schemaMaxPages: 10,
+  sortMaxItems: 8,
+  actAsTokenSeconds: 900,
+  actAsCacheMaxSeconds: 600,
+  identityCandidatesPerPage: 20
+};
+var DATA_IDENTITY_KINDS = ["user", "visitor", "superuser"];
+var DATA_ACTING_AS = [...DATA_IDENTITY_KINDS, "unset"];
+var DATA_RECORD_ERROR_STATUS = {
+  PB_VERSION_UNSUPPORTED: 503,
+  PB_RECORD_NOT_FOUND: 404,
+  PB_VALIDATION: 400,
+  PB_CONFLICT: 409,
+  PB_CONFLICT_UNSUPPORTED: 400,
+  DATA_COLLECTION_FORBIDDEN: 403,
+  DATA_FIELD_UNSUPPORTED: 400,
+  DATA_RATE_LIMITED: 429,
+  DATA_RESPONSE_TOO_LARGE: 413,
+  OAUTH_DATA_ACCESS_REQUIRED: 403,
+  DATA_TOOLS_NOT_ENABLED: 403,
+  PB_AUTH_FAILED: 503,
+  PB_NOT_RUNNING: 503,
+  PB_BRIDGE_UNAVAILABLE: 502,
+  NOT_POCKETBASE: 400,
+  DATA_QUERY_INVALID: 400,
+  DATA_SCHEMA_TOO_LARGE: 413,
+  DATA_QUERY_TIMEOUT: 504,
+  DATA_WRITE_OUTCOME_UNKNOWN: 502,
+  PB_RULE_DENIED: 403,
+  DATA_ACT_AS_REQUIRED: 403,
+  DATA_ACT_AS_UNAVAILABLE: 403
+};
+
+// ../shared/dist/data-filter.js
+class ExpressionError extends Error {
+  reason;
+  at;
+  constructor(reason, at) {
+    super(reason);
+    this.reason = reason;
+    this.at = at;
+  }
+}
+var RESERVED = new Set(["true", "false", "null"]);
+class SchemaIndex {
+  visible = new Set;
+  hidden = new Set;
+  lowered = new Set;
+  constructor(fields) {
+    for (const f of fields) {
+      (f.hidden ? this.hidden : this.visible).add(f.name);
+      this.lowered.add(f.name.toLowerCase());
+    }
+  }
+  checkField(name, at) {
+    if (RESERVED.has(name.toLowerCase()))
+      throw new ExpressionError("reserved_word", at);
+    if (this.visible.has(name))
+      return;
+    throw new ExpressionError(this.hidden.has(name) ? "hidden_field" : "unknown_field", at);
+  }
+  checkKeywordLiteral(word, at) {
+    if (this.lowered.has(word))
+      throw new ExpressionError("shadowed_literal", at);
+  }
+}
+// ../shared/dist/disposable-email-domains.js
+var DISPOSABLE_DOMAINS = new Set([
+  "mailinator.com",
+  "mailinator.net",
+  "mailinator2.com",
+  "binkmail.com",
+  "bobmail.info",
+  "chammy.info",
+  "devnullmail.com",
+  "letthemeatspam.com",
+  "mailnesia.com",
+  "mailtothis.com",
+  "notmailinator.com",
+  "reallymymail.com",
+  "safetymail.info",
+  "thisisnotmyrealemail.com",
+  "tradermail.info",
+  "veryrealemail.com",
+  "zippymail.info",
+  "guerrillamail.com",
+  "guerrillamail.net",
+  "guerrillamail.org",
+  "guerrillamail.biz",
+  "guerrillamail.de",
+  "guerrillamailblock.com",
+  "sharklasers.com",
+  "grr.la",
+  "spam4.me",
+  "10minutemail.com",
+  "10minutemail.net",
+  "20minutemail.com",
+  "30minutemail.com",
+  "tempmail.com",
+  "temp-mail.org",
+  "temp-mail.io",
+  "tempmailaddress.com",
+  "tempmailo.com",
+  "tempinbox.com",
+  "throwawaymail.com",
+  "yopmail.com",
+  "yopmail.fr",
+  "yopmail.net",
+  "maildrop.cc",
+  "trashmail.com",
+  "trashmail.de",
+  "trashmail.net",
+  "trash-mail.com",
+  "dispostable.com",
+  "fakeinbox.com",
+  "getnada.com",
+  "mintemail.com",
+  "mohmal.com",
+  "moakt.cc",
+  "formtests.info",
+  "mailcatch.com",
+  "mailnull.com",
+  "spambog.com",
+  "spambox.us",
+  "spamgourmet.com",
+  "emailondeck.com",
+  "fakemailgenerator.com",
+  "jetable.org",
+  "mytrashmail.com",
+  "owlpic.com",
+  "rcpt.at",
+  "trbvm.com"
+]);
 // ../shared/dist/legal.js
 var LEGAL_DOCUMENT_VERSIONS = {
   terms: "1.0.3",
@@ -92759,6 +92989,12 @@ var UPLOAD_SESSION_TTL_MS = 6 * 60 * 60 * 1000;
 var UPLOAD_SESSION_MAX_LIFETIME_MS = 24 * 60 * 60 * 1000;
 // ../shared/dist/logs.js
 var MAX_LOG_SEARCH_LENGTH = 256;
+// ../shared/dist/oauth-scopes.js
+var DATA_ACCESS_SUFFIX = "records in your apps' databases, including data your app's users entered. Every record the assistant reads is sent to it and may be processed by its provider under the provider's terms. Revoke in Settings → Connections; copies already sent are not recalled.";
+var DATA_ACCESS_MODE_LABELS = {
+  readwrite: `Read, create, change and delete ${DATA_ACCESS_SUFFIX}`,
+  read: `Read ${DATA_ACCESS_SUFFIX}`
+};
 // ../shared/dist/platform-env.js
 var PERCHER_INJECTED_ENV_KEYS = new Set([
   "NODE_ENV",
@@ -92784,6 +93020,23 @@ var PROXY_LOWERCASE_ALIASES = new Set([
 // ../shared/dist/runtime.js
 var DEFAULT_NODE_VERSION_MAJOR = "24";
 var DEFAULT_NODE_VERSION_LABEL = `${DEFAULT_NODE_VERSION_MAJOR} LTS`;
+// ../shared/dist/signup-day.js
+var stockholmDate = new Intl.DateTimeFormat("sv-SE", {
+  timeZone: "Europe/Stockholm",
+  year: "numeric",
+  month: "2-digit",
+  day: "2-digit"
+});
+var stockholmClock = new Intl.DateTimeFormat("en-GB", {
+  timeZone: "Europe/Stockholm",
+  year: "numeric",
+  month: "2-digit",
+  day: "2-digit",
+  hour: "2-digit",
+  minute: "2-digit",
+  second: "2-digit",
+  hourCycle: "h23"
+});
 // ../shared/dist/switches.js
 var ONE = ["1"];
 var TRUE = ["true"];
@@ -107210,7 +107463,7 @@ var LEGACY_AUDIT_REQUIRED_CONJUNCTS = [
   "volumes_attributed",
   "scans_complete",
   "runtime_evidence_complete",
-  "clabbe_attestation_complete",
+  "security_attestation_complete",
   "launch_gate_ready"
 ];
 function legacyAuditIsGreen(result) {
@@ -108056,7 +108309,7 @@ import { join as join9, resolve as resolve5 } from "node:path";
 // ../core/dist/templates.js
 import { existsSync as existsSync5, mkdirSync as mkdirSync6, readdirSync, readFileSync as readFileSync6, statSync, writeFileSync as writeFileSync6 } from "node:fs";
 import { basename as basename2, join as join8, normalize, relative as relative2, resolve as resolve4 } from "node:path";
-var __dirname = "D:\\dev\\Percher-codex-clone\\packages\\core\\dist";
+var __dirname = "C:\\dev\\Percher-npm-final-release-20261018\\packages\\core\\dist";
 var TEMPLATES_DIR = resolve4(import.meta.dirname ?? __dirname, "../templates");
 var PLACEHOLDER = "__APP_NAME__";
 function listTemplates() {
@@ -108437,115 +108690,11 @@ async function dataOauth(ctx, input = { provider: "google" }) {
     redirectUri: status.redirectUri
   };
 }
-// ../core/dist/commands/delete.js
-var deleteInputSchema = exports_external.object({
-  app: exports_external.string().optional().describe("App name to delete (defaults to percher.toml app name)"),
-  confirm: exports_external.boolean().describe("Must be true to confirm deletion. This is a destructive operation that permanently removes the app, its container, database, domains, env vars, and deploy history.")
-});
-async function deleteApp(ctx, input) {
-  const name = input.app ?? readPercherTomlAppName(ctx.cwd);
-  if (!name) {
-    throw new PercherCoreError("No app specified and no percher.toml found", {
-      code: "env.no-app",
-      hint: "Pass an app name or run from a directory with percher.toml."
-    });
-  }
-  if (!input.confirm) {
-    throw new PercherCoreError(`Deletion requires explicit confirmation. Set confirm: true to delete "${name}" permanently.`, {
-      code: "delete.confirmation-required",
-      hint: `This will permanently delete the app "${name}" and all its data. Pass confirm: true to proceed.`
-    });
-  }
-  await ctx.client.apps.delete(name);
-}
-// ../core/dist/commands/deploy-repo.js
+// ../core/dist/commands/data-records.js
 init_dist();
 
-// ../core/dist/poll-deployment.js
+// ../core/dist/data-recovery.js
 init_dist();
-class DeployPollLostContactError extends PercherCoreError {
-  deploymentId;
-  constructor(message, deploymentId, appName, options) {
-    super(message, {
-      code: "push.lost-contact",
-      hint: `The deploy may already be live. Check with: percher deploys ${appName}`,
-      cause: options?.cause
-    });
-    this.deploymentId = deploymentId;
-    this.name = "DeployPollLostContactError";
-  }
-}
-function isTransientPollError(err) {
-  if (isTransientNetworkError(err))
-    return true;
-  if (err instanceof PercherApiError)
-    return err.status === 429 || err.status === 502 || err.status === 503 || err.status === 504;
-  return err instanceof TypeError && /terminated/i.test(err.message);
-}
-async function pollDeployment(opts) {
-  const terminal = opts.terminal ?? ["live", "failed"];
-  const intervalMs = opts.intervalMs ?? 2000;
-  const timeoutMs = opts.timeoutMs ?? TIMEOUTS.clientPublishPoll;
-  const maxRetries = opts.maxRetries ?? Number.POSITIVE_INFINITY;
-  const retryBudgetMs = opts.retryBudgetMs ?? 5 * 60000;
-  let deployment = opts.initial;
-  const startedAt = Date.now();
-  const seenEventIds = new Set;
-  if (opts.onEvent) {
-    await drainNewEvents(opts, deployment.id, seenEventIds);
-  }
-  while (!terminal.includes(deployment.status)) {
-    if (Date.now() - startedAt > timeoutMs) {
-      opts.onTimeout(deployment);
-    }
-    opts.onTick?.(deployment);
-    await new Promise((r) => setTimeout(r, intervalMs));
-    let attempt = 0;
-    let streakStartedAt = 0;
-    let polled = false;
-    while (!polled) {
-      try {
-        deployment = await opts.ctx.client.apps.getDeployment(opts.appId, deployment.id);
-        polled = true;
-      } catch (err) {
-        attempt++;
-        if (!isTransientPollError(err))
-          throw err;
-        if (attempt === 1) {
-          streakStartedAt = Date.now();
-          opts.ctx.status(err instanceof PercherApiError && err.status === 429 ? "Percher asked this client to slow down; retrying while the deploy continues..." : "Lost contact with Percher; retrying while the deploy continues...");
-        }
-        if (Date.now() - startedAt > timeoutMs)
-          opts.onTimeout(deployment);
-        if (attempt >= maxRetries || Date.now() - streakStartedAt >= retryBudgetMs) {
-          const msg = err.message ?? String(err);
-          throw new DeployPollLostContactError(`${msg}
-
-The deploy may already be live — contact with Percher was lost mid-poll. Check with: percher deploys ${opts.appName}`, deployment.id, opts.appName, { cause: err });
-        }
-        const backoff = (opts.backoffMs ?? ((n) => Math.min(1000 * 2 ** (n - 1), 15000)))(attempt);
-        await new Promise((r) => setTimeout(r, backoff));
-      }
-    }
-    if (opts.onEvent) {
-      await drainNewEvents(opts, deployment.id, seenEventIds);
-    }
-  }
-  return deployment;
-}
-async function drainNewEvents(opts, deployId, seenEventIds) {
-  if (!opts.onEvent)
-    return;
-  try {
-    const { events } = await opts.ctx.client.apps.getDeployEvents(opts.appId, deployId);
-    for (const event of events) {
-      if (seenEventIds.has(event.id))
-        continue;
-      seenEventIds.add(event.id);
-      opts.onEvent(event);
-    }
-  } catch {}
-}
 
 // ../core/dist/structured-error-codes.js
 var MAPPINGS = {
@@ -109084,6 +109233,277 @@ function recoveryFromErrorClass(errorClass, failure) {
   }
 }
 
+// ../core/dist/data-recovery.js
+var WRITES = new Set(["create", "update", "delete"]);
+function isDataRecordErrorCode(code) {
+  return typeof code === "string" && Object.hasOwn(DATA_RECORD_ERROR_STATUS, code);
+}
+
+class DataRecordError extends PercherApiError {
+  target;
+  constructor(err, target) {
+    super(err.message, {
+      status: err.status,
+      code: err.code,
+      requestId: err.requestId,
+      extra: err.extra,
+      cause: err
+    });
+    this.name = "DataRecordError";
+    this.target = target;
+  }
+}
+
+// ../core/dist/commands/data-records.js
+var appArg = exports_external.string().min(1).optional().describe("App name or id. Defaults to the app in ./percher.toml.");
+var collectionArg = exports_external.string().regex(DATA_COLLECTION_RE, "a collection name: a letter, then letters, digits or _ (max 64)").describe("Collection name, exactly as percher_data_schema lists it (case-sensitive).");
+var recordIdArg = exports_external.string().regex(DATA_RECORD_ID_RE, "a record id: letters, digits, _ or - (max 64)").describe("Record id.");
+var expression = (what) => exports_external.string().max(DATA_LIMITS.expressionChars).optional().describe(what);
+var recordData = exports_external.record(exports_external.string(), exports_external.unknown()).describe("Field values keyed by field name (see percher_data_schema). File fields, hidden fields and unknown fields are refused.");
+var dataSchemaInputSchema = exports_external.object({ app: appArg });
+var dataQueryInputSchema = exports_external.object({
+  app: appArg,
+  collection: collectionArg,
+  filter: expression("PocketBase-style filter over the collection's own fields, e.g. status = 'open' && priority >= 2. Operators = != > >= < <= ~ !~ and their ?-prefixed any-of forms; && || and parentheses. No @-variables, dotted paths, functions or backslashes."),
+  sort: expression("Comma-separated fields, - for descending, e.g. -created,title (max 8)."),
+  page: exports_external.number().int().min(1).max(DATA_LIMITS.maxPage).optional(),
+  perPage: exports_external.number().int().min(1).max(DATA_LIMITS.maxPerPage).optional(),
+  fields: expression("Comma-separated field names to return (default: every non-hidden field).")
+});
+var dataGetInputSchema = exports_external.object({
+  app: appArg,
+  collection: collectionArg,
+  id: recordIdArg
+});
+var dataCreateInputSchema = exports_external.object({
+  app: appArg,
+  collection: collectionArg,
+  data: recordData,
+  id: recordIdArg.optional().describe("Optional id for the new record. With one, a create whose outcome is unknown can be checked with percher_data_get instead of searched for.")
+});
+var dataUpdateInputSchema = exports_external.object({
+  app: appArg,
+  collection: collectionArg,
+  id: recordIdArg,
+  data: recordData,
+  ifUpdated: exports_external.string().min(1).max(64).optional().describe("The record's `updated` value as last read. The update is refused if it changed since. A best-effort timestamp check, not a lock: timestamp collisions and the app's own concurrent writes can defeat it.")
+});
+var dataDeleteInputSchema = exports_external.object({
+  app: appArg,
+  collection: collectionArg,
+  id: recordIdArg
+});
+function resolveApp(ctx, app) {
+  const name = app ?? readPercherTomlAppName(ctx.cwd);
+  if (!name) {
+    throw new PercherCoreError("No app specified and no percher.toml found", {
+      code: "data.no-app",
+      hint: "Pass an app name or run from a directory with percher.toml."
+    });
+  }
+  return name;
+}
+async function call(target, run) {
+  try {
+    return await run();
+  } catch (err) {
+    if (err instanceof PercherApiError && isDataRecordErrorCode(err.code)) {
+      throw new DataRecordError(err, target);
+    }
+    throw err;
+  }
+}
+function target(op, app, collection, id) {
+  return {
+    op,
+    app,
+    ...collection !== undefined ? { collection } : {},
+    ...id !== undefined ? { id } : {}
+  };
+}
+var SCHEMA_MAX_COLLECTIONS = DATA_LIMITS.schemaPerPage * DATA_LIMITS.schemaMaxPages;
+function omittedByRulesNote(omitted) {
+  if (typeof omitted !== "number" || !Number.isSafeInteger(omitted) || omitted < 1 || omitted > SCHEMA_MAX_COLLECTIONS) {
+    return;
+  }
+  const subject = omitted === 1 ? "1 collection in this app is" : `${omitted} collections in this app are`;
+  return `${subject} reachable only with full access, which the app's own server code may use. The owner can choose full access for this app in Settings → Connections.`;
+}
+async function dataSchema2(ctx, input) {
+  const app = resolveApp(ctx, input.app);
+  const schema = await call(target("schema", app), () => ctx.client.data.getSchema(app));
+  const { note: _fromApi, ...rest } = schema;
+  const note = omittedByRulesNote(rest.omittedByRules);
+  return note === undefined ? rest : { ...rest, note };
+}
+async function dataQuery(ctx, input) {
+  const { app: rawApp, collection, ...query } = input;
+  const app = resolveApp(ctx, rawApp);
+  return call(target("query", app, collection), () => ctx.client.data.queryRecords(app, collection, query));
+}
+async function dataGet(ctx, input) {
+  const app = resolveApp(ctx, input.app);
+  return call(target("get", app, input.collection, input.id), () => ctx.client.data.getRecord(app, input.collection, input.id));
+}
+async function dataCreate(ctx, input) {
+  const app = resolveApp(ctx, input.app);
+  const body = {
+    data: input.data,
+    ...input.id !== undefined ? { id: input.id } : {}
+  };
+  return call(target("create", app, input.collection, input.id), () => ctx.client.data.createRecord(app, input.collection, body));
+}
+async function dataUpdate(ctx, input) {
+  const app = resolveApp(ctx, input.app);
+  const body = {
+    data: input.data,
+    ...input.ifUpdated !== undefined ? { ifUpdated: input.ifUpdated } : {}
+  };
+  return call(target("update", app, input.collection, input.id), () => ctx.client.data.updateRecord(app, input.collection, input.id, body));
+}
+async function dataDelete(ctx, input) {
+  const app = resolveApp(ctx, input.app);
+  await call(target("delete", app, input.collection, input.id), () => ctx.client.data.deleteRecord(app, input.collection, input.id));
+  return { deleted: true, collection: input.collection, id: input.id };
+}
+// ../core/dist/commands/delete.js
+var deleteInputSchema = exports_external.object({
+  app: exports_external.string().optional().describe("App name to delete (defaults to percher.toml app name)"),
+  confirm: exports_external.boolean().describe("Must be true to confirm deletion. This is a destructive operation that permanently removes the app, its container, database, domains, env vars, and deploy history.")
+});
+async function deleteApp(ctx, input) {
+  const name = input.app ?? readPercherTomlAppName(ctx.cwd);
+  if (!name) {
+    throw new PercherCoreError("No app specified and no percher.toml found", {
+      code: "env.no-app",
+      hint: "Pass an app name or run from a directory with percher.toml."
+    });
+  }
+  if (!input.confirm) {
+    throw new PercherCoreError(`Deletion requires explicit confirmation. Set confirm: true to delete "${name}" permanently.`, {
+      code: "delete.confirmation-required",
+      hint: `This will permanently delete the app "${name}" and all its data. Pass confirm: true to proceed.`
+    });
+  }
+  await ctx.client.apps.delete(name);
+}
+// ../core/dist/commands/deploy-repo.js
+init_dist();
+
+// ../core/dist/deployment-replaced.js
+var summary = "This deployment is no longer active. Inspect the app's current state before deploying again.";
+function recovery(app, deployId) {
+  return recoveryDoctor({ app, deployId, mode: "deploy", reasonCode: "replaced_by_newer" });
+}
+function throwIfDeploymentReplaced(app, deployment) {
+  if (deployment.status !== "replaced")
+    return;
+  throw new PercherCoreError(summary, {
+    code: "push.deploy-replaced",
+    hint: `Run \`percher doctor --app ${app}\` to inspect the current state.`,
+    recovery: { ...recovery(app, deployment.id) }
+  });
+}
+function replacedDeploymentResult(app, deployment) {
+  return {
+    status: "replaced",
+    app,
+    deployment,
+    summary,
+    recovery: recovery(app.name, deployment.id),
+    fileCount: 0,
+    bytes: 0,
+    configPath: "",
+    bundle: { fileCount: 0, bytes: 0 }
+  };
+}
+
+// ../core/dist/poll-deployment.js
+init_dist();
+class DeployPollLostContactError extends PercherCoreError {
+  deploymentId;
+  constructor(message, deploymentId, appName, options) {
+    super(message, {
+      code: "push.lost-contact",
+      hint: `The deploy may already be live. Check with: percher deploys ${appName}`,
+      cause: options?.cause
+    });
+    this.deploymentId = deploymentId;
+    this.name = "DeployPollLostContactError";
+  }
+}
+function isTransientPollError(err) {
+  if (isTransientNetworkError(err))
+    return true;
+  if (err instanceof PercherApiError)
+    return err.status === 429 || err.status === 502 || err.status === 503 || err.status === 504;
+  return err instanceof TypeError && /terminated/i.test(err.message);
+}
+async function pollDeployment(opts) {
+  const terminal = opts.terminal ?? ["live", "failed", "replaced"];
+  const intervalMs = opts.intervalMs ?? 2000;
+  const timeoutMs = opts.timeoutMs ?? TIMEOUTS.clientPublishPoll;
+  const maxRetries = opts.maxRetries ?? Number.POSITIVE_INFINITY;
+  const retryBudgetMs = opts.retryBudgetMs ?? 5 * 60000;
+  let deployment = opts.initial;
+  const startedAt = Date.now();
+  const seenEventIds = new Set;
+  if (opts.onEvent) {
+    await drainNewEvents(opts, deployment.id, seenEventIds);
+  }
+  while (!terminal.includes(deployment.status)) {
+    if (Date.now() - startedAt > timeoutMs) {
+      opts.onTimeout(deployment);
+    }
+    opts.onTick?.(deployment);
+    await new Promise((r) => setTimeout(r, intervalMs));
+    let attempt = 0;
+    let streakStartedAt = 0;
+    let polled = false;
+    while (!polled) {
+      try {
+        deployment = await opts.ctx.client.apps.getDeployment(opts.appId, deployment.id);
+        polled = true;
+      } catch (err) {
+        attempt++;
+        if (!isTransientPollError(err))
+          throw err;
+        if (attempt === 1) {
+          streakStartedAt = Date.now();
+          opts.ctx.status(err instanceof PercherApiError && err.status === 429 ? "Percher asked this client to slow down; retrying while the deploy continues..." : "Lost contact with Percher; retrying while the deploy continues...");
+        }
+        if (Date.now() - startedAt > timeoutMs)
+          opts.onTimeout(deployment);
+        if (attempt >= maxRetries || Date.now() - streakStartedAt >= retryBudgetMs) {
+          const msg = err.message ?? String(err);
+          throw new DeployPollLostContactError(`${msg}
+
+The deploy may already be live — contact with Percher was lost mid-poll. Check with: percher deploys ${opts.appName}`, deployment.id, opts.appName, { cause: err });
+        }
+        const backoff = (opts.backoffMs ?? ((n) => Math.min(1000 * 2 ** (n - 1), 15000)))(attempt);
+        await new Promise((r) => setTimeout(r, backoff));
+      }
+    }
+    if (opts.onEvent) {
+      await drainNewEvents(opts, deployment.id, seenEventIds);
+    }
+  }
+  return deployment;
+}
+async function drainNewEvents(opts, deployId, seenEventIds) {
+  if (!opts.onEvent)
+    return;
+  try {
+    const { events } = await opts.ctx.client.apps.getDeployEvents(opts.appId, deployId);
+    for (const event of events) {
+      if (seenEventIds.has(event.id))
+        continue;
+      seenEventIds.add(event.id);
+      opts.onEvent(event);
+    }
+  } catch {}
+}
+
 // ../core/dist/commands/publish-failure.js
 init_dist();
 import { join as join10 } from "node:path";
@@ -109559,7 +109979,7 @@ async function classifyDeploymentFailure(opts) {
     error48.suggestion = `${error48.suggestion}
 To return to the last version that ran cleanly: \`bunx percher rollback --last-good\`.`;
   }
-  const recovery = error48.errorClass ? recoveryFromErrorClass(error48.errorClass, {
+  const recovery2 = error48.errorClass ? recoveryFromErrorClass(error48.errorClass, {
     missingEnvVars: error48.missingEnvVars,
     deployId: deployment.id,
     appName: app.name,
@@ -109573,13 +109993,13 @@ To return to the last version that ran cleanly: \`bunx percher rollback --last-g
   });
   return {
     error: error48,
-    recovery,
+    recovery: recovery2,
     summary: `${error48.title} (${app.name}, deploy ${deployment.id}).`
   };
 }
 async function buildFailureResult(opts) {
   const { ctx, app, deployment, tarball, input } = opts;
-  const { error: error48, recovery, summary } = await classifyDeploymentFailure({
+  const { error: error48, recovery: recovery2, summary: summary2 } = await classifyDeploymentFailure({
     ctx,
     app,
     deployment,
@@ -109592,8 +110012,8 @@ async function buildFailureResult(opts) {
     fileCount: tarball.fileCount,
     bytes: tarball.bytes,
     error: error48,
-    recovery,
-    summary,
+    recovery: recovery2,
+    summary: summary2,
     configPath: tomlPathFor(ctx.cwd),
     bundle: { fileCount: tarball.fileCount, bytes: tarball.bytes }
   };
@@ -110169,7 +110589,7 @@ async function waitForDeploy(ctx, input, opts) {
       }
     }
     if (deployment.status === "failed") {
-      const { error: error48, recovery, summary } = await classifyDeploymentFailure({
+      const { error: error48, recovery: recovery2, summary: summary2 } = await classifyDeploymentFailure({
         ctx,
         app,
         deployment,
@@ -110182,8 +110602,8 @@ async function waitForDeploy(ctx, input, opts) {
         elapsedSeconds: Math.round((Date.now() - startedAt) / 1000),
         totalElapsedSeconds: secondsSinceCreated(deployment),
         error: error48,
-        recovery,
-        summary
+        recovery: recovery2,
+        summary: summary2
       };
     }
     if (deployment.isCheck && deployment.checkPassed) {
@@ -110404,7 +110824,7 @@ async function doctor(ctx, input = {}) {
         tomlProblems = tomlErrorToRecoveryProblems(err);
       }
       if (err instanceof PercherTomlError && err.issues && err.issues.length > 0) {
-        const summary = err.issues.slice(0, 3).map((i) => {
+        const summary2 = err.issues.slice(0, 3).map((i) => {
           const where = i.path.length > 0 ? `[${i.path.join(".")}]` : "(root)";
           return `${where} ${i.message}`;
         }).join("; ");
@@ -110412,7 +110832,7 @@ async function doctor(ctx, input = {}) {
         checks3.push({
           name: "percher.toml",
           status: "fail",
-          message: `${summary}${more}`
+          message: `${summary2}${more}`
         });
       } else {
         checks3.push({
@@ -110899,7 +111319,7 @@ var VERDICT_RULES = [
       const reasonCode = vctx.lastDeployStatus === "queued" ? "deploy_queued" : vctx.lastDeployStatus === "building" ? "deploy_building" : vctx.lastDeployStatus === "deploying" ? "deploy_deploying" : "deploy_queued";
       const what = inTransitionalApp ? `App ${vctx.appName ?? ""} is provisioning` : `Last deploy is ${vctx.lastDeployStatus}`;
       const waiting = inTransitionalApp ? "This app is still provisioning" : reasonCode === "deploy_building" ? "The last deploy is still building" : reasonCode === "deploy_deploying" ? "The last deploy is being rolled out" : "The last deploy is still queued";
-      const recovery = vctx.lastDeployId && vctx.appName ? recoveryWait({
+      const recovery2 = vctx.lastDeployId && vctx.appName ? recoveryWait({
         app: vctx.appName,
         deployId: vctx.lastDeployId,
         reasonCode
@@ -110915,7 +111335,7 @@ var VERDICT_RULES = [
           reasonCode,
           phase: "deploy"
         },
-        recovery,
+        recovery: recovery2,
         summary: vctx.lastDeployId ? `${what.trim()} — wait for deploy ${vctx.lastDeployId}.` : `${what.trim()} — wait a moment and re-run.`
       };
     }
@@ -111183,7 +111603,7 @@ var domainRemoveInputSchema = exports_external.object({
   app: exports_external.string().optional(),
   domain: exports_external.string().min(1, "Domain is required")
 });
-function resolveApp(ctx, app) {
+function resolveApp2(ctx, app) {
   const name = app ?? readPercherTomlAppName(ctx.cwd);
   if (!name) {
     throw new PercherCoreError("No app specified and no percher.toml found", {
@@ -111194,19 +111614,19 @@ function resolveApp(ctx, app) {
   return name;
 }
 async function domainAdd(ctx, input) {
-  const appRef2 = resolveApp(ctx, input.app);
+  const appRef2 = resolveApp2(ctx, input.app);
   return ctx.client.apps.addDomain(appRef2, input.domain);
 }
 async function domainVerify(ctx, input) {
-  const appRef2 = resolveApp(ctx, input.app);
+  const appRef2 = resolveApp2(ctx, input.app);
   return ctx.client.apps.verifyDomain(appRef2, input.domain);
 }
 async function domainList(ctx, input = {}) {
-  const appRef2 = resolveApp(ctx, input.app);
+  const appRef2 = resolveApp2(ctx, input.app);
   return ctx.client.apps.listDomains(appRef2);
 }
 async function domainRemove(ctx, input) {
-  const appRef2 = resolveApp(ctx, input.app);
+  const appRef2 = resolveApp2(ctx, input.app);
   await ctx.client.apps.removeDomain(appRef2, input.domain);
 }
 // ../core/dist/commands/env.js
@@ -111554,7 +111974,7 @@ var githubConnectInputSchema = exports_external.object({
   branch: exports_external.string().optional().describe("Branch to deploy and track (default: main)"),
   autoPreviews: exports_external.boolean().optional().describe("Opt-in: push to a non-tracked branch creates a preview deploy at <app>--p-<branch-slug>.percher.run. Default false.")
 });
-function resolveApp2(ctx, app) {
+function resolveApp3(ctx, app) {
   const name = app ?? readPercherTomlAppName(ctx.cwd);
   if (!name) {
     throw new PercherCoreError("No app specified and no percher.toml found", {
@@ -111565,7 +111985,7 @@ function resolveApp2(ctx, app) {
   return name;
 }
 async function githubConnect(ctx, input) {
-  const appRef2 = resolveApp2(ctx, input.app);
+  const appRef2 = resolveApp3(ctx, input.app);
   const branch = input.branch ?? "main";
   let deployment;
   let created;
@@ -111645,7 +112065,7 @@ var githubSetupWebhookInputSchema = exports_external.object({
   app: exports_external.string().optional().describe("App name (overrides percher.toml)")
 });
 async function githubSetupWebhook(ctx, input) {
-  const appRef2 = resolveApp2(ctx, input.app);
+  const appRef2 = resolveApp3(ctx, input.app);
   const webhook = await ctx.client.apps.setupWebhook(appRef2);
   const repoBase = webhook.instructions.repo.replace(/\.git$/, "");
   return {
@@ -112360,12 +112780,12 @@ ${serialize(extras)}`;
       }
     ];
     for (const { name, content } of targets) {
-      const target = join16(ctx.cwd, name);
-      if (existsSync11(target)) {
+      const target2 = join16(ctx.cwd, name);
+      if (existsSync11(target2)) {
         result.warnings.push(`${name} already exists — left untouched. The imported config expects a multi-stage static build; merge by hand if needed.`);
         continue;
       }
-      writeFileSync8(target, content, "utf-8");
+      writeFileSync8(target2, content, "utf-8");
       scaffoldedFiles.push(name);
     }
   }
@@ -112610,7 +113030,24 @@ function configFromDetection(name, detected, dataMode) {
 }
 
 // ../core/dist/validation/blocked-names.js
+var SENSITIVE_BRANDS = new Set([
+  "paypal",
+  "bankid",
+  "swish",
+  "swedbank",
+  "handelsbanken",
+  "nordea",
+  "seb",
+  "danskebank",
+  "mitid",
+  "nemid",
+  "mobilepay",
+  "vipps",
+  "klarna",
+  "skatteverket"
+]);
 var BLOCKED_APP_NAMES = new Set([
+  ...SENSITIVE_BRANDS,
   "api",
   "app",
   "admin",
@@ -112669,6 +113106,8 @@ var BLOCKED_APP_NAMES = new Set([
 function isBlockedName(name) {
   if (BLOCKED_APP_NAMES.has(name))
     return true;
+  if (name.split("-").some((part) => SENSITIVE_BRANDS.has(part)))
+    return true;
   const prefixes = [
     "login-",
     "signin-",
@@ -112706,6 +113145,8 @@ function adjustReservedName(name) {
   let adjusted = `app-${name}`;
   if (adjusted.length > 40)
     adjusted = adjusted.slice(0, 40).replace(/-+$/g, "");
+  if (isBlockedName(adjusted))
+    return `app-${crypto.randomUUID().slice(0, 8)}`;
   return adjusted;
 }
 function detectInteractive() {
@@ -112782,10 +113223,10 @@ async function init(ctx, input = {}) {
       }
     ];
     for (const { name: name2, content } of targets) {
-      const target = join18(ctx.cwd, name2);
-      if (existsSync13(target) && !input.force)
+      const target2 = join18(ctx.cwd, name2);
+      if (existsSync13(target2) && !input.force)
         continue;
-      writeFileSync9(target, content, "utf8");
+      writeFileSync9(target2, content, "utf8");
       scaffoldedFiles.push(name2);
     }
   }
@@ -113319,7 +113760,7 @@ async function inspectSupabase(ctx, input) {
   const storageBuckets = normalizeBuckets(schemaBlob.storageBuckets);
   const authUsersCount = toFiniteNumber(schemaBlob.authUsersCount);
   const warnings = collectWarnings(tables, storageBuckets, authUsersCount);
-  const summary = renderSummary({
+  const summary2 = renderSummary({
     projectRef: input.projectRef,
     tables,
     authUsersCount,
@@ -113334,7 +113775,7 @@ async function inspectSupabase(ctx, input) {
     storageBuckets,
     warnings,
     recovery: recoveryNone(),
-    summary
+    summary: summary2
   };
 }
 function failure(args) {
@@ -114345,12 +114786,12 @@ function isSupabaseFromTerminal(path, supabaseNames) {
   let fromCall = null;
   let cursor = path.node;
   while (cursor.type === "CallExpression") {
-    const call = cursor;
-    if (call.callee.type !== "MemberExpression")
+    const call2 = cursor;
+    if (call2.callee.type !== "MemberExpression")
       break;
-    const callee = call.callee;
+    const callee = call2.callee;
     if (callee.property.type === "Identifier" && callee.property.name === "from") {
-      fromCall = call;
+      fromCall = call2;
       break;
     }
     cursor = callee.object;
@@ -114405,15 +114846,15 @@ function decomposeFromChain(outer) {
   const reversedSteps = [];
   let node = outer;
   while (node.type === "CallExpression") {
-    const call = node;
-    if (call.callee.type !== "MemberExpression")
+    const call2 = node;
+    if (call2.callee.type !== "MemberExpression")
       break;
-    const callee = call.callee;
+    const callee = call2.callee;
     const method = callee.property.type === "Identifier" ? callee.property.name : null;
     if (method === null)
       return null;
     if (method === "from") {
-      const arg = call.arguments[0];
+      const arg = call2.arguments[0];
       if (!arg || arg.type !== "Literal" && arg.type !== "StringLiteral")
         return null;
       const table = arg.value;
@@ -114421,7 +114862,7 @@ function decomposeFromChain(outer) {
         return null;
       return { table, steps: reversedSteps.reverse() };
     }
-    reversedSteps.push({ method, args: call.arguments });
+    reversedSteps.push({ method, args: call2.arguments });
     node = callee.object;
   }
   return null;
@@ -114846,14 +115287,14 @@ function readChainSteps(outer) {
   let cursor = outer;
   while (true) {
     if (cursor.type === "CallExpression") {
-      const call = cursor;
-      if (call.callee.type !== "MemberExpression")
+      const call2 = cursor;
+      if (call2.callee.type !== "MemberExpression")
         break;
-      const callee = call.callee;
+      const callee = call2.callee;
       if (callee.property.type === "Identifier") {
         reversed.push({
           method: callee.property.name,
-          call
+          call: call2
         });
       }
       cursor = callee.object;
@@ -114874,8 +115315,8 @@ function readChainSteps(outer) {
   }
   return reversed.reverse();
 }
-function readFirstStringArg(call) {
-  const a = call.arguments[0];
+function readFirstStringArg(call2) {
+  const a = call2.arguments[0];
   if (!a)
     return null;
   if (a.type === "Literal" || a.type === "StringLiteral") {
@@ -115620,11 +116061,11 @@ async function migrationStatus(ctx, input) {
   const warning = analysis.checks.filter((c) => c.status === "warn");
   const buildFailed = build?.ran === true && !build.passed;
   const allGreen = failing.length === 0 && warning.length === 0 && !buildFailed;
-  const recovery = allGreen ? recoveryNone() : recoveryAsk({
+  const recovery2 = allGreen ? recoveryNone() : recoveryAsk({
     prompt: buildPrompt(analysis.state, failing, warning, build),
     reasonCode: "unknown"
   });
-  const summary = `${STATE_SUMMARY[analysis.state]}${build ? ` Build: ${build.ran ? build.passed ? "passed" : "FAILED" : "skipped"}.` : ""}`;
+  const summary2 = `${STATE_SUMMARY[analysis.state]}${build ? ` Build: ${build.ran ? build.passed ? "passed" : "FAILED" : "skipped"}.` : ""}`;
   return {
     status: "ok",
     rootDir: rootAbs,
@@ -115632,8 +116073,8 @@ async function migrationStatus(ctx, input) {
     migrationComplete: analysis.migrationComplete,
     checks: analysis.checks,
     ...build ? { build } : {},
-    recovery,
-    summary,
+    recovery: recovery2,
+    summary: summary2,
     checklist
   };
 }
@@ -115886,7 +116327,7 @@ async function rewriteSupabaseClient(ctx, input) {
   for (const flag of flags) {
     flagsByPattern[flag.pattern] = (flagsByPattern[flag.pattern] ?? 0) + 1;
   }
-  const recovery = reportNeeded ? recoveryAsk({
+  const recovery2 = reportNeeded ? recoveryAsk({
     prompt: buildPrompt2(flags, walk2.skipped.length, hadRewrites, clientModuleWritten),
     reasonCode: "unknown"
   }) : recoveryNone();
@@ -115904,7 +116345,7 @@ async function rewriteSupabaseClient(ctx, input) {
     envFilesChanged: walk2.summary.envFilesChanged,
     clientModule: clientModuleWritten,
     skipped: walk2.skipped,
-    recovery,
+    recovery: recovery2,
     summary: renderSummary2({
       mode,
       changed: changed.length,
@@ -116146,13 +116587,13 @@ function topologicalSort(collections) {
     for (const field of c.schema) {
       if (field.type !== "relation")
         continue;
-      const target = field.options.collectionName;
-      if (target === c.name)
+      const target2 = field.options.collectionName;
+      if (target2 === c.name)
         continue;
-      if (!byName.has(target))
+      if (!byName.has(target2))
         continue;
-      dependsOn.get(c.name)?.add(target);
-      dependents.get(target)?.add(c.name);
+      dependsOn.get(c.name)?.add(target2);
+      dependents.get(target2)?.add(c.name);
     }
   }
   const inputOrder = collections.map((c) => c.name);
@@ -116393,7 +116834,7 @@ function renderRowTransform(collection) {
   }
   for (const rel of relations) {
     const fieldName = rel.name;
-    const target = rel.options.collectionName;
+    const target2 = rel.options.collectionName;
     const isAuthUsersRef = rel.source.flag === "auth_users_reference";
     if (isAuthUsersRef) {
       parts.push(`  if (rest[${JSON.stringify(fieldName)}] != null) {`);
@@ -116403,9 +116844,9 @@ function renderRowTransform(collection) {
       continue;
     }
     parts.push(`  if (rest[${JSON.stringify(fieldName)}] != null) {`);
-    parts.push(`    const mapped = lookupId(${JSON.stringify(target)}, rest[${JSON.stringify(fieldName)}]);`);
+    parts.push(`    const mapped = lookupId(${JSON.stringify(target2)}, rest[${JSON.stringify(fieldName)}]);`);
     parts.push("    if (mapped === undefined) {");
-    parts.push(`      throw new Error(\`[${collection.name}.${fieldName}] no PB id for source value '\${rest[${JSON.stringify(fieldName)}]}' in ${target} map — was ${target} migrated first?\`);`);
+    parts.push(`      throw new Error(\`[${collection.name}.${fieldName}] no PB id for source value '\${rest[${JSON.stringify(fieldName)}]}' in ${target2} map — was ${target2} migrated first?\`);`);
     parts.push("    }");
     parts.push(`    rest[${JSON.stringify(fieldName)}] = mapped;`);
     parts.push("  }");
@@ -116608,7 +117049,7 @@ async function migrateSupabaseSchema(ctx, input) {
       }
     };
   }
-  const summary = renderSummary3({
+  const summary2 = renderSummary3({
     projectRef: input.projectRef,
     outputDirRel,
     inspection,
@@ -116621,7 +117062,7 @@ async function migrateSupabaseSchema(ctx, input) {
     filesWritten,
     preview,
     recovery: recoveryNone(),
-    summary
+    summary: summary2
   };
 }
 function resolveOutputDir(cwd, requested) {
@@ -116721,8 +117162,8 @@ function renderMigrationNotes(preview) {
         lines.push("| Field | Type | Required | Postgres source | Flag |");
         lines.push("|---|---|---|---|---|");
         for (const field of collection.schema) {
-          const target = field.type === "relation" ? `relation → \`${field.options.collectionName}\`` : field.type;
-          lines.push(`| \`${field.name}\` | ${target} | ${field.required ? "yes" : "no"} | \`${field.source.postgresType}\` | ${field.source.flag ? `\`${field.source.flag}\`` : "—"} |`);
+          const target2 = field.type === "relation" ? `relation → \`${field.options.collectionName}\`` : field.type;
+          lines.push(`| \`${field.name}\` | ${target2} | ${field.required ? "yes" : "no"} | \`${field.source.postgresType}\` | ${field.source.flag ? `\`${field.source.flag}\`` : "—"} |`);
         }
         lines.push("");
       }
@@ -116830,7 +117271,7 @@ var previewBranchSetInputSchema = exports_external.object({
 var previewBranchInputSchema = exports_external.object({
   app: exports_external.string().optional()
 });
-function resolveApp3(ctx, app) {
+function resolveApp4(ctx, app) {
   const name = app ?? readPercherTomlAppName(ctx.cwd);
   if (!name) {
     throw new PercherCoreError("No app specified and no percher.toml found", {
@@ -116841,11 +117282,11 @@ function resolveApp3(ctx, app) {
   return name;
 }
 async function previewBranchSet(ctx, input) {
-  const appRef2 = resolveApp3(ctx, input.app);
+  const appRef2 = resolveApp4(ctx, input.app);
   return ctx.client.apps.setPreviewBranch(appRef2, input.branch);
 }
 async function previewBranchUnset(ctx, input = {}) {
-  const appRef2 = resolveApp3(ctx, input.app);
+  const appRef2 = resolveApp4(ctx, input.app);
   return ctx.client.apps.unsetPreviewBranch(appRef2);
 }
 var setPreviewBranchToolInputSchema = exports_external.object({
@@ -116853,7 +117294,7 @@ var setPreviewBranchToolInputSchema = exports_external.object({
   branch: exports_external.string().nullable().describe("Branch to pin as the preview address; pass null to clear it.")
 });
 async function previewBranchShow(ctx, input = {}) {
-  const appRef2 = resolveApp3(ctx, input.app);
+  const appRef2 = resolveApp4(ctx, input.app);
   const app = await ctx.client.apps.get(appRef2);
   return {
     previewBranch: app.previewBranch ?? null,
@@ -116862,7 +117303,7 @@ async function previewBranchShow(ctx, input = {}) {
   };
 }
 async function previewList(ctx, input = {}) {
-  const appRef2 = resolveApp3(ctx, input.app);
+  const appRef2 = resolveApp4(ctx, input.app);
   const app = await ctx.client.apps.get(appRef2);
   return { app: app.name, previews: app.previews ?? [] };
 }
@@ -118401,7 +118842,6 @@ async function finalizeDeploy(opts) {
       intervalMs: 2000,
       timeoutMs,
       appName: app.name,
-      terminal: ["live", "failed", "replaced"],
       onTick: (d) => {
         const elapsedMs = Date.now() - buildStart;
         if (d.status !== lastStatus) {
@@ -118458,8 +118898,8 @@ async function finalizeDeploy(opts) {
   const buildMs = Date.now() - buildStart;
   if (deployment.isCheck && deployment.checkPassed) {
     const totalSeconds2 = (Date.now() - t0) / 1000;
-    const summary = `${app.name} check passed (${Math.round(totalSeconds2)}s) — would build and boot. The live app was not changed.`;
-    ctx.status(summary);
+    const summary2 = `${app.name} check passed (${Math.round(totalSeconds2)}s) — would build and boot. The live app was not changed.`;
+    ctx.status(summary2);
     return {
       status: "check_passed",
       app,
@@ -118476,7 +118916,7 @@ async function finalizeDeploy(opts) {
       missingBuildEnvKeys: missingBuildEnvKeys.length > 0 ? missingBuildEnvKeys : undefined,
       traceId: deployment.id,
       recovery: RECOVERY_NONE,
-      summary,
+      summary: summary2,
       configPath: tomlPathFor2(ctx.cwd),
       bundle: { fileCount: tarball.fileCount, bytes: tarball.bytes }
     };
@@ -118644,6 +119084,7 @@ async function handleUnauthorized(ctx, config2, tarball, input) {
 async function handleAnonymousPublish(ctx, config2, input, tarball) {
   const anonClient = new PercherClient({
     apiUrl: ctx.client.apiUrl,
+    token: null,
     sessionId: ctx.client.sessionId
   });
   let created;
@@ -118656,7 +119097,8 @@ async function handleAnonymousPublish(ctx, config2, input, tarball) {
     created = await anonClient.anon.createAnonApp({
       name: config2.app.name,
       powChallengeId: ch.challengeId,
-      powSolution: solution
+      powSolution: solution,
+      ...ctx.syntheticFixture ? { testFixturePermit: ctx.syntheticFixture.permit } : {}
     });
   } catch (err) {
     const httpStatus = err.status;
@@ -118697,13 +119139,15 @@ async function handleAnonymousPublish(ctx, config2, input, tarball) {
       bundle: { fileCount: tarball.fileCount, bytes: tarball.bytes }
     };
   }
-  if (!hasPersistedToken())
-    saveConfig({ token: created.token });
-  setAnonClaim({
-    app: created.app.name,
-    claimToken: created.claimToken,
-    expiresAt: created.expiresAt
-  });
+  if (!ctx.syntheticFixture) {
+    if (!hasPersistedToken())
+      saveConfig({ token: created.token });
+    setAnonClaim({
+      app: created.app.name,
+      claimToken: created.claimToken,
+      expiresAt: created.expiresAt
+    });
+  }
   const newClient = new PercherClient({
     apiUrl: ctx.client.apiUrl,
     token: created.token,
@@ -118711,6 +119155,10 @@ async function handleAnonymousPublish(ctx, config2, input, tarball) {
   });
   ctx.client = newClient;
   ctx.setClient?.(newClient);
+  if (ctx.syntheticFixture) {
+    ctx.syntheticFixture.appId = created.app.id;
+    ctx.syntheticFixture.created(created.app);
+  }
   config2.app.name = created.app.name;
   const t0 = Date.now();
   const freshTarball = await createTarball({ cwd: ctx.cwd, config: config2 });
@@ -118756,14 +119204,22 @@ async function loadOrGenerate(ctx, preParsed) {
 async function ensureApp2(ctx, config2) {
   try {
     const app = await ctx.client.apps.get(config2.app.name);
+    if (ctx.syntheticFixture && app.id !== ctx.syntheticFixture.appId) {
+      throw new Error("Disposable fixture publishing requires a new app.");
+    }
     return { app, firstDeploy: false };
   } catch (err) {
     if (err.code === "APP_NOT_FOUND") {
       const app = await ctx.client.apps.create({
         name: config2.app.name,
         runtime: config2.app.runtime,
-        framework: config2.app.framework
+        framework: config2.app.framework,
+        ...ctx.syntheticFixture ? { testFixturePermit: ctx.syntheticFixture.permit } : {}
       });
+      if (ctx.syntheticFixture) {
+        ctx.syntheticFixture.appId = app.id;
+        ctx.syntheticFixture.created(app);
+      }
       return { app, firstDeploy: true };
     }
     throw err;
@@ -119074,12 +119530,13 @@ async function push(ctx, input = {}, internals = {}) {
       });
     }
   });
+  throwIfDeploymentReplaced(app.name, deployment);
   if (deployment.status === "failed") {
     const errorDetail = deployment.errorMessage ? `
 ${deployment.errorMessage}` : "";
     const fromCode = classifyByErrorCode(deployment.errorCode, deployment.errorMessage ?? "");
     const classified = fromCode ?? classifyError(deployment.errorMessage ?? "", "");
-    const recovery = classified ? recoveryFromErrorClass(classified.errorClass, {
+    const recovery2 = classified ? recoveryFromErrorClass(classified.errorClass, {
       missingEnvVars: classified.missingEnvVars,
       deployId: deployment.id,
       appName: app.name,
@@ -119093,7 +119550,7 @@ ${deployment.errorMessage}` : "";
     throw new PercherCoreError(`Deployment failed (deploy ${deployment.id})${errorDetail}`, {
       code: "push.deploy-failed",
       hint: `Run \`percher deploys inspect ${deployment.id}\` to see the full build log and error. ${deployment.errorMessage ? "Fix the issue above and re-run." : "Look for the failing step in the build log."}`,
-      recovery
+      recovery: recovery2
     });
   }
   const totalSec = ((Date.now() - startedAt) / 1000).toFixed(0);
@@ -119101,7 +119558,7 @@ ${deployment.errorMessage}` : "";
   ctx.status(displayUrl ? `Preview at ${displayUrl} (${totalSec}s)` : `Live at ${deployment.url ?? app.url} (${totalSec}s)`);
   const finalUrl = displayUrl ?? deployment.url ?? app.url;
   const fwSuffix = config2.app.framework ? ` (${config2.app.framework}, ${totalSec}s)` : ` (${totalSec}s)`;
-  const summary = `${app.name} ${displayUrl ? "preview deployed" : "deployed"}${fwSuffix} → ${finalUrl}`;
+  const summary2 = `${app.name} ${displayUrl ? "preview deployed" : "deployed"}${fwSuffix} → ${finalUrl}`;
   return {
     app,
     deployment,
@@ -119109,7 +119566,7 @@ ${deployment.errorMessage}` : "";
     bytes: tarball.bytes,
     fileCount: tarball.fileCount,
     recovery: RECOVERY_NONE,
-    summary,
+    summary: summary2,
     configPath: join26(ctx.cwd, "percher.toml"),
     bundle: { fileCount: tarball.fileCount, bytes: tarball.bytes }
   };
@@ -119381,9 +119838,11 @@ async function redeploy(ctx, input = {}) {
     });
   }
   const totalSeconds = (Date.now() - t0) / 1000;
+  if (deployment.status === "replaced")
+    return replacedDeploymentResult(app, deployment);
   const url2 = deployment.previewUrl ?? deployment.url ?? app.url;
   if (deployment.status === "failed") {
-    const { error: error48, recovery, summary } = await classifyDeploymentFailure({
+    const { error: error48, recovery: recovery2, summary: summary2 } = await classifyDeploymentFailure({
       ctx,
       app,
       deployment
@@ -119395,8 +119854,8 @@ async function redeploy(ctx, input = {}) {
       fileCount: 0,
       bytes: 0,
       error: error48,
-      recovery,
-      summary,
+      recovery: recovery2,
+      summary: summary2,
       configPath: "",
       bundle: { fileCount: 0, bytes: 0 }
     };
@@ -119794,19 +120253,19 @@ function versionAge(iso, now = Date.now()) {
     return `${d}d ago`;
   return `${Math.floor(d / 30)}mo ago`;
 }
-function rollbackTargetMarker(target, isLive) {
-  if (isLive || !target)
+function rollbackTargetMarker(target2, isLive) {
+  if (isLive || !target2)
     return "";
-  if (target.mode === "rebuild")
+  if (target2.mode === "rebuild")
     return "  [rebuild required]";
-  if (target.mode === "none")
+  if (target2.mode === "none")
     return "  [not a rollback target]";
   return "";
 }
-function rollbackTargetDetail(target, isLive) {
-  if (isLive || !target || target.mode === "in-window")
+function rollbackTargetDetail(target2, isLive) {
+  if (isLive || !target2 || target2.mode === "in-window")
     return [];
-  const explanation = target.explanation?.trim();
+  const explanation = target2.explanation?.trim();
   return explanation ? [`      ${explanation}`] : [];
 }
 async function writeLine(ctx, line) {
@@ -119841,14 +120300,15 @@ async function resolveCommitSha(ctx, name, input) {
   const pick2 = versions2.slice(0, BARE_PICK_LIMIT);
   if (!ctx.stdinIsInteractive) {
     const appFlag = ` --app ${name}`;
-    const lines = pick2.flatMap((v, i) => {
+    const lines = pick2.flatMap((v) => {
+      const isLive = v.rollbackTarget?.reason === "ALREADY_LIVE";
       const note = v.message.split(`
 `)[0]?.trim() || "Published";
-      const marker = rollbackTargetMarker(v.rollbackTarget, i === 0);
-      const detail = rollbackTargetDetail(v.rollbackTarget, i === 0);
+      const marker = isLive ? "  (live now)" : rollbackTargetMarker(v.rollbackTarget, false);
+      const detail = rollbackTargetDetail(v.rollbackTarget, isLive);
       const git = v.remoteSha ? ` git ${v.remoteSha.slice(0, 7)}` : "";
       const suffix = `  # ${note}${git} (${versionAge(v.timestamp)})${marker}`;
-      if (v.rollbackTarget?.mode === "none" && i !== 0) {
+      if (v.rollbackTarget?.mode === "none") {
         return [`  ${v.sha}${suffix}`, ...detail];
       }
       const rebuildFlag = v.rollbackTarget?.mode === "rebuild" ? " --rebuild" : "";
@@ -119866,10 +120326,11 @@ ${lines.join(`
     const note = v.message.split(`
 `)[0]?.trim() || "Published";
     const git = v.remoteSha ? `  git ${v.remoteSha.slice(0, 7)}` : "";
-    const live = i === 0 ? "  (live now)" : "";
-    const marker = rollbackTargetMarker(v.rollbackTarget, i === 0);
+    const isLive = v.rollbackTarget?.reason === "ALREADY_LIVE";
+    const live = isLive ? "  (live now)" : "";
+    const marker = rollbackTargetMarker(v.rollbackTarget, isLive);
     await writeLine(ctx, `  ${i + 1}. ${v.sha.slice(0, 10)}  ${versionAge(v.timestamp)}  ${note}${git}${live}${marker}`);
-    for (const detail of rollbackTargetDetail(v.rollbackTarget, i === 0)) {
+    for (const detail of rollbackTargetDetail(v.rollbackTarget, isLive)) {
       await writeLine(ctx, detail);
     }
   }
@@ -119922,6 +120383,7 @@ async function rollback(ctx, input, internals = {}) {
       });
     }
   });
+  throwIfDeploymentReplaced(name, deployment);
   if (deployment.status === "failed") {
     throw new PercherCoreError("Rollback failed", {
       code: "push.deploy-failed",
@@ -119932,7 +120394,7 @@ async function rollback(ctx, input, internals = {}) {
 }
 // ../core/dist/commands/sharing.js
 var ShareRoleSchema = exports_external.enum(["viewer", "admin"]);
-function resolveApp4(ctx, app) {
+function resolveApp5(ctx, app) {
   const name = app ?? readPercherTomlAppName(ctx.cwd);
   if (!name) {
     throw new PercherCoreError("No app specified and no percher.toml found", {
@@ -119960,19 +120422,19 @@ var shareRevokeInputSchema = exports_external.object({
   shareId: exports_external.string().min(1, "shareId is required")
 });
 async function shareList(ctx, input = {}) {
-  const appRef2 = resolveApp4(ctx, input.app);
+  const appRef2 = resolveApp5(ctx, input.app);
   return ctx.client.sharing.list(appRef2);
 }
 async function shareInvite(ctx, input) {
-  const appRef2 = resolveApp4(ctx, input.app);
+  const appRef2 = resolveApp5(ctx, input.app);
   return ctx.client.sharing.create(appRef2, { email: input.email, role: input.role });
 }
 async function shareSetRole(ctx, input) {
-  const appRef2 = resolveApp4(ctx, input.app);
+  const appRef2 = resolveApp5(ctx, input.app);
   return ctx.client.sharing.setRole(appRef2, input.shareId, input.role);
 }
 async function shareRevoke(ctx, input) {
-  const appRef2 = resolveApp4(ctx, input.app);
+  const appRef2 = resolveApp5(ctx, input.app);
   await ctx.client.sharing.revoke(appRef2, input.shareId);
 }
 var invitesListInputSchema = exports_external.object({});
@@ -120080,7 +120542,7 @@ async function tokenRevoke(ctx, input) {
   await ctx.client.account.revokeToken(input.id);
 }
 // ../core/dist/commands/transfers.js
-function resolveApp5(ctx, app) {
+function resolveApp6(ctx, app) {
   const name = app ?? readPercherTomlAppName(ctx.cwd);
   if (!name) {
     throw new PercherCoreError("No app specified and no percher.toml found", {
@@ -120102,15 +120564,15 @@ var transferListForAppInputSchema = exports_external.object({
   app: exports_external.string().optional()
 });
 async function transferInitiate(ctx, input) {
-  const appRef2 = resolveApp5(ctx, input.app);
+  const appRef2 = resolveApp6(ctx, input.app);
   return ctx.client.transfers.initiate(appRef2, { email: input.email });
 }
 async function transferCancel(ctx, input) {
-  const appRef2 = resolveApp5(ctx, input.app);
+  const appRef2 = resolveApp6(ctx, input.app);
   await ctx.client.transfers.cancel(appRef2, input.transferId);
 }
 async function transferListForApp(ctx, input = {}) {
-  const appRef2 = resolveApp5(ctx, input.app);
+  const appRef2 = resolveApp6(ctx, input.app);
   return ctx.client.transfers.listForApp(appRef2);
 }
 var transfersIncomingInputSchema = exports_external.object({});
@@ -120958,8 +121420,8 @@ function registerAdminCommands(cli, ctx) {
         if (topology?.topologyReady !== true) {
           await writeLine2(ctx, `${import_picocolors3.default.red("✗")} tenant topology audit is red or unavailable — no launch all-clear.`);
           for (const finding of topology?.findings ?? []) {
-            const target = finding.network ?? finding.containerId ?? finding.appId ?? "fleet";
-            await writeLine2(ctx, `  ${import_picocolors3.default.red("✗")} ${finding.code} [${target}] — ${finding.detail}`);
+            const target2 = finding.network ?? finding.containerId ?? finding.appId ?? "fleet";
+            await writeLine2(ctx, `  ${import_picocolors3.default.red("✗")} ${finding.code} [${target2}] — ${finding.detail}`);
           }
         }
         if (options.app || options.appId) {
@@ -120973,8 +121435,8 @@ function registerAdminCommands(cli, ctx) {
           await writeLine2(ctx, `${import_picocolors3.default.yellow("!")} drift: ${missing} missing route(s), ${hostDrift} missing host(s), ${extra} extra route(s)`);
           for (const d of drift) {
             const label = d.kind === "missing_route" ? import_picocolors3.default.red("MISSING") : d.kind === "missing_host" ? import_picocolors3.default.yellow("HOST_DRIFT") : import_picocolors3.default.dim("EXTRA");
-            const target = d.appName ? `[${d.appName}] ` : "";
-            await writeLine2(ctx, `  ${label} ${target}${d.routeId} (${d.routeType}) — ${d.hosts.join(", ")}`);
+            const target2 = d.appName ? `[${d.appName}] ` : "";
+            await writeLine2(ctx, `  ${label} ${target2}${d.routeId} (${d.routeType}) — ${d.hosts.join(", ")}`);
           }
         }
         await writeLine2(ctx, import_picocolors3.default.dim(`Repair: percher admin reconcile-routes${options.app ? ` --app ${options.app}` : ""}`));
@@ -121050,8 +121512,8 @@ async function printList(ctx, title, rows) {
 
 // src/commands/apps.ts
 var import_picocolors5 = __toESM(require_picocolors(), 1);
-function assertNever2(status2, summary) {
-  throw new Error(`Unhandled publish status: ${JSON.stringify(status2)}${summary ? ` (${summary})` : ""}`);
+function assertNever2(status2, summary2) {
+  throw new Error(`Unhandled publish status: ${JSON.stringify(status2)}${summary2 ? ` (${summary2})` : ""}`);
 }
 async function handlePublishResult(ctx, result, options = {}) {
   switch (result.status) {
@@ -121290,6 +121752,10 @@ function registerAppsCommands(cli, ctx) {
       deployId,
       noCache: options.cache === false
     });
+    if (result.status === "replaced") {
+      await handlePublishResult(ctx, result);
+      throw new SilentExitError;
+    }
     if (result.status === "needs_login") {
       await writeLine2(ctx, `${import_picocolors5.default.red("✗")} Not logged in. Run: percher login`);
       throw new SilentExitError;
@@ -121607,6 +122073,154 @@ function registerAuthCommands(cli, ctx) {
 
 // src/commands/data.ts
 var import_picocolors7 = __toESM(require_picocolors(), 1);
+
+// src/commands/data-records.ts
+var DATA_RECORD_SUBCOMMANDS = new Set([
+  "schema",
+  "query",
+  "get",
+  "create",
+  "update",
+  "delete"
+]);
+
+class DataArgumentError extends PercherCoreError {
+  constructor(message) {
+    super(message, { code: "data.missing-argument" });
+  }
+}
+function cacKey(name) {
+  return name.replaceAll(/([a-z])-([a-z])/g, (_, a, b) => a + b.toUpperCase());
+}
+function textOption(argv, options, key, flag) {
+  const parsed = options[key];
+  if (parsed === undefined)
+    return;
+  if (typeof parsed === "string")
+    return parsed;
+  if (typeof parsed !== "number") {
+    throw new DataArgumentError(`${flag} needs exactly one value`);
+  }
+  const end = argv.includes("--") ? argv.indexOf("--") : argv.length;
+  let raw;
+  for (let i = 0;i < end; i++) {
+    const m = /^--([^=]+)(?:=(.*))?$/s.exec(argv[i] ?? "");
+    if (!m || cacKey(m[1] ?? "") !== key)
+      continue;
+    raw = m[2] ?? argv[i + 1];
+  }
+  if (raw === undefined || Number(raw) !== parsed) {
+    throw new DataArgumentError(`${flag} could not be read as typed`);
+  }
+  return raw;
+}
+function intOption(options, key, flag) {
+  const parsed = options[key];
+  if (parsed === undefined)
+    return;
+  if (typeof parsed === "number")
+    return parsed;
+  if (typeof parsed === "string")
+    return Number(parsed);
+  throw new DataArgumentError(`${flag} needs exactly one value`);
+}
+function recordPositionals(rest, options) {
+  const after = Array.isArray(options["--"]) ? options["--"] : [];
+  const all = [...rest, ...after];
+  if (!all.every((v) => typeof v === "string")) {
+    throw new DataArgumentError("Could not read the collection or record id as typed; put boolean flags after them");
+  }
+  return all;
+}
+function recordData2(value) {
+  let parsed;
+  try {
+    parsed = JSON.parse(value ?? "");
+  } catch {
+    parsed = undefined;
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new PercherCoreError("--data must be a JSON object of field values", {
+      code: "data.invalid-json",
+      hint: `Example: --data '{"title":"Buy milk","done":false}'`
+    });
+  }
+  return parsed;
+}
+function missing(usage) {
+  throw new PercherCoreError(`Missing arguments. Usage: percher ${usage}`, {
+    code: "data.missing-argument"
+  });
+}
+async function runDataRecordCommand(ctx, argv, sub, rest, options) {
+  const [collection, id] = recordPositionals(rest, options);
+  const text = (key, flag) => textOption(argv, options, key, flag);
+  const app = text("app", "--app");
+  let result;
+  switch (sub) {
+    case "schema":
+      result = await dataSchema2(ctx, dataSchemaInputSchema.parse({ app }));
+      break;
+    case "query":
+      if (!collection)
+        missing("data query <collection> [--filter …] [--app <name>]");
+      result = await dataQuery(ctx, dataQueryInputSchema.parse({
+        app,
+        collection,
+        filter: text("filter", "--filter"),
+        sort: text("sort", "--sort"),
+        page: intOption(options, "page", "--page"),
+        perPage: intOption(options, "perPage", "--per-page"),
+        fields: text("fields", "--fields")
+      }));
+      break;
+    case "get":
+      if (!collection || !id)
+        missing("data get <collection> <id> [--app <name>]");
+      result = await dataGet(ctx, dataGetInputSchema.parse({ app, collection, id }));
+      break;
+    case "create":
+      if (!collection)
+        missing("data create <collection> --data '<json>' [--id <id>]");
+      result = await dataCreate(ctx, dataCreateInputSchema.parse({
+        app,
+        collection,
+        data: recordData2(text("data", "--data")),
+        id: text("id", "--id")
+      }));
+      break;
+    case "update":
+      if (!collection || !id)
+        missing("data update <collection> <id> --data '<json>'");
+      result = await dataUpdate(ctx, dataUpdateInputSchema.parse({
+        app,
+        collection,
+        id,
+        data: recordData2(text("data", "--data")),
+        ifUpdated: text("ifUpdated", "--if-updated")
+      }));
+      break;
+    case "delete":
+      if (!collection || !id)
+        missing("data delete <collection> <id> [--app <name>]");
+      result = await dataDelete(ctx, dataDeleteInputSchema.parse({ app, collection, id }));
+      break;
+    default:
+      return;
+  }
+  await writeLine2(ctx, JSON.stringify(result, null, 2));
+}
+function registerDataRecordHelp(cli) {
+  const none = async () => {};
+  cli.command("data schema", "List the collections and fields the data tools can use").action(none);
+  cli.command("data query <collection>", "Query records (--filter, --sort, --page, --per-page, --fields)").action(none);
+  cli.command("data get <collection> <id>", "Get one record").action(none);
+  cli.command("data create <collection>", "Create a record from --data '<json>' (optional --id)").action(none);
+  cli.command("data update <collection> <id>", "Change fields from --data '<json>' (optional --if-updated)").action(none);
+  cli.command("data delete <collection> <id>", "Delete one record").action(none);
+}
+
+// src/commands/data.ts
 var DATA_VALUE_FLAGS = new Set([
   "--out",
   "--app",
@@ -121615,7 +122229,11 @@ var DATA_VALUE_FLAGS = new Set([
   "--client-secret"
 ]);
 function registerDataCommands(cli, ctx, argv) {
-  cli.command("data [app] [...rest]", "Show app data status and collections").option("--json", "Output as JSON").option("--reveal", "(reset-superuser only) also print the plaintext password once").option("--out <path>", "(export only) Output file (default: ./<app>-pb-<timestamp>.tar.gz)").option("--provider <name>", "(oauth only) OAuth provider (default: google)").option("--app <name>", "(export, oauth) target app (default: read percher.toml)").option("--client-id <id>", "(oauth only) OAuth client id").option("--client-secret <secret>", "(oauth only) OAuth client secret (a command-line value lands in shell history)").option("--remove", "(oauth only) remove the provider instead of setting it").action(async (app, _rest, options) => {
+  cli.command("data [app] [...rest]", "Show app data status and collections").option("--json", "Output as JSON").option("--reveal", "(reset-superuser only) also print the plaintext password once").option("--out <path>", "(export only) Output file (default: ./<app>-pb-<timestamp>.tar.gz)").option("--provider <name>", "(oauth only) OAuth provider (default: google)").option("--app <name>", "Target app (default: read percher.toml); names an app called like a subcommand, e.g. `data --app get`").option("--client-id <id>", "(oauth only) OAuth client id").option("--client-secret <secret>", "(oauth only) OAuth client secret (a command-line value lands in shell history)").option("--remove", "(oauth only) remove the provider instead of setting it").option("--filter <expr>", "(query only) filter over the collection's fields").option("--sort <fields>", "(query only) comma-separated fields, - for descending (write --sort=-field)").option("--page <n>", "(query only) page number").option("--per-page <n>", "(query only) records per page (max 100)").option("--fields <fields>", "(query only) comma-separated fields to return").option("--data <json>", "(create, update) field values as a JSON object").option("--id <id>", "(create only) id for the new record").option("--if-updated <timestamp>", "(update only) refuse if the record changed since").action(async (app, _rest, options) => {
+    if (app !== undefined && DATA_RECORD_SUBCOMMANDS.has(app)) {
+      await runDataRecordCommand(ctx, argv, app, _rest, options);
+      return;
+    }
     if (app === "reset-superuser") {
       const idx = argv.indexOf("reset-superuser");
       const realApp = idx >= 0 ? firstNonFlagAfter(argv, idx) : undefined;
@@ -121666,7 +122284,7 @@ function registerDataCommands(cli, ctx, argv) {
       }
       return;
     }
-    const result = await data(ctx, { app, json: options.json });
+    const result = await data(ctx, { app: app ?? options.app, json: options.json });
     if (options.json) {
       await writeLine2(ctx, JSON.stringify(result, null, 2));
     } else {
@@ -121691,6 +122309,7 @@ function registerDataCommands(cli, ctx, argv) {
       }
     }
   });
+  registerDataRecordHelp(cli);
   cli.command("data reset-superuser [app]", "Reset PocketBase superuser and inject new credentials").option("--reveal", "Also print the plaintext password once (default: hidden)").action(async (app, options) => {
     const result = await resetSuperuser(ctx, { app, reveal: options.reveal });
     await printSuperuserResetResult(ctx, result);
@@ -121877,10 +122496,10 @@ function registerDeploysCommands(cli, ctx, argv) {
       const label = v.channel ? channelLabels[v.channel] ?? v.channel : null;
       const git = v.remoteSha ? `  · git ${v.remoteSha.slice(0, 7)}` : "";
       const suffix = `${label ? `  · via ${label}` : ""}${git}`;
-      const target = v.rollbackTarget;
-      const marker = target && target.mode !== "in-window" ? target.mode === "rebuild" ? "[rebuild required]" : "[not a rollback target]" : null;
-      if (marker && target)
-        reasons.set(marker, target.explanation);
+      const target2 = v.rollbackTarget;
+      const marker = target2 && target2.mode !== "in-window" ? target2.mode === "rebuild" ? "[rebuild required]" : "[not a rollback target]" : null;
+      if (marker && target2)
+        reasons.set(marker, target2.explanation);
       await writeLine2(ctx, `${v.sha}  ${v.timestamp}  ${message}${noteLabel ? `  · ${noteLabel}` : ""}${suffix}${marker ? `  ${marker}` : ""}`);
     }
     for (const [marker, explanation] of reasons) {
@@ -121895,8 +122514,8 @@ ${marker} ${explanation}`);
       head,
       patch: options.patch
     });
-    const { summary, files } = result;
-    await writeLine2(ctx, `${summary.filesChanged} file${summary.filesChanged === 1 ? "" : "s"} changed · ${import_picocolors8.default.green(`+${summary.additions}`)} ${import_picocolors8.default.red(`−${summary.deletions}`)}  (${result.base.slice(0, 10)} → ${result.head.slice(0, 10)})`);
+    const { summary: summary2, files } = result;
+    await writeLine2(ctx, `${summary2.filesChanged} file${summary2.filesChanged === 1 ? "" : "s"} changed · ${import_picocolors8.default.green(`+${summary2.additions}`)} ${import_picocolors8.default.red(`−${summary2.deletions}`)}  (${result.base.slice(0, 10)} → ${result.head.slice(0, 10)})`);
     for (const f of files) {
       const stat3 = f.binary ? import_picocolors8.default.dim("binary") : `${import_picocolors8.default.green(`+${f.additions}`)} ${import_picocolors8.default.red(`−${f.deletions}`)}`;
       await writeLine2(ctx, `  ${f.status}  ${f.path}  ${stat3}${f.truncated ? import_picocolors8.default.dim(" (truncated)") : ""}`);
@@ -122597,7 +123216,7 @@ import { createInterface } from "node:readline";
 // package.json
 var package_default2 = {
   name: "percher",
-  version: "1.2.0",
+  version: "1.3.0",
   description: "CLI for the Percher hosting platform — publish apps with one command",
   type: "module",
   bin: {
@@ -122625,9 +123244,9 @@ var package_default2 = {
     typecheck: "tsc --noEmit"
   },
   dependencies: {
-    "@percher/client": "^1.2.0",
-    "@percher/core": "^1.2.0",
-    "@percher/toml": "^1.0.3",
+    "@percher/client": "^1.3.0",
+    "@percher/core": "^1.3.0",
+    "@percher/toml": "^1.0.4",
     cac: "^7.0.0",
     picocolors: "^1.1.1"
   },