deepspace 0.3.7 → 0.3.9

package/dist/cli.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 
 // src/cli/cli.ts
-import { defineCommand as defineCommand14, runMain } from "citty";
+import { defineCommand as defineCommand17, runMain } from "citty";
 import { execSync as execSync5 } from "child_process";
-import { readFileSync as readFileSync9, existsSync as existsSync11 } from "fs";
-import { dirname as dirname2, join as join12 } from "path";
+import { readFileSync as readFileSync10, existsSync as existsSync13 } from "fs";
+import { dirname as dirname2, join as join13 } from "path";
 import { fileURLToPath } from "url";
 
 // src/cli/commands/login.ts
@@ -37,20 +37,72 @@ function createSpinner() {
 import { existsSync, readFileSync, writeFileSync } from "fs";
 import { join } from "path";
 import { parse as parseToml } from "smol-toml";
-var ENVS = {
-  dev: {
-    auth: "https://deepspace-auth.eudaimonicincorporated.workers.dev",
-    api: "https://deepspace-api.eudaimonicincorporated.workers.dev",
-    platform: "https://deepspace-platform-worker.eudaimonicincorporated.workers.dev",
-    deploy: "https://deepspace-deploy.eudaimonicincorporated.workers.dev"
-  },
-  prod: {
-    auth: "https://deepspace-auth.eudaimonicincorporated.workers.dev",
-    api: "https://deepspace-api.eudaimonicincorporated.workers.dev",
-    platform: "https://deepspace-platform-worker.eudaimonicincorporated.workers.dev",
-    deploy: "https://deepspace-deploy.eudaimonicincorporated.workers.dev"
+
+// src/server/rooms/app-name.ts
+var APP_NAME_RULES = {
+  /** ^[a-z0-9](-?[a-z0-9])+$ — RFC 1035 host label, no consecutive dashes. */
+  pattern: /^[a-z0-9](?:-?[a-z0-9])+$/,
+  minLength: 2,
+  maxLength: 63
+};
+function validateAppName(raw) {
+  if (typeof raw !== "string") {
+    return { valid: false, reason: "App name must be a string" };
+  }
+  const name = raw.trim();
+  if (!name) {
+    return { valid: false, reason: "App name is required" };
+  }
+  if (name.length < APP_NAME_RULES.minLength) {
+    return { valid: false, reason: `App name "${name}" is too short (min ${APP_NAME_RULES.minLength} chars)` };
+  }
+  if (name.length > APP_NAME_RULES.maxLength) {
+    return { valid: false, reason: `App name "${name}" is too long (max ${APP_NAME_RULES.maxLength} chars)` };
+  }
+  if (!APP_NAME_RULES.pattern.test(name)) {
+    return {
+      valid: false,
+      reason: `App name "${name}" is invalid. Use lowercase letters, digits, and single hyphens only (must start + end with alphanumeric). Examples: my-app, search-v2, unison-search.`
+    };
+  }
+  return { valid: true, name };
+}
+function resolveAppName(raw) {
+  const strict = validateAppName(raw);
+  if (strict.valid) return { ok: true, name: strict.name };
+  if (typeof raw !== "string") return { ok: false, reason: strict.reason };
+  const trimmed = raw.trim();
+  if (!trimmed) return { ok: false, reason: "App name is required" };
+  const sanitized = sanitizeAppName(trimmed);
+  const sanitizedStrict = validateAppName(sanitized);
+  if (!sanitizedStrict.valid) {
+    return {
+      ok: false,
+      reason: `App name "${trimmed}" can't be sanitized into a valid name (${sanitizedStrict.reason}). Pick something matching: lowercase letters, digits, single hyphens, ${APP_NAME_RULES.minLength}-${APP_NAME_RULES.maxLength} chars.`
+    };
   }
+  return {
+    ok: true,
+    name: sanitized,
+    warning: `App name "${trimmed}" doesn't conform to deploy rules \u2014 using "${sanitized}" instead. Update wrangler.toml's \`name\` to silence this warning.`
+  };
+}
+function sanitizeAppName(raw) {
+  return raw.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-{2,}/g, "-").replace(/^-+|-+$/g, "");
+}
+
+// src/cli/env.ts
+var ENV_URLS = {
+  auth: "https://deepspace-auth.eudaimonicincorporated.workers.dev",
+  api: "https://deepspace-api.eudaimonicincorporated.workers.dev",
+  platform: "https://deepspace-platform-worker.eudaimonicincorporated.workers.dev",
+  deploy: "https://deepspace-deploy.eudaimonicincorporated.workers.dev"
 };
+var ENVS = {
+  dev: ENV_URLS,
+  prod: ENV_URLS
+};
+var DASHBOARD_URL = "https://dashboard.deep.space";
 async function fetchPublicKey(authUrl) {
   const res = await fetch(`${authUrl}/api/auth/jwks`);
   if (!res.ok) {
@@ -68,10 +120,16 @@ function readAppName(appDir) {
     throw new Error("No wrangler.toml found. Are you in a DeepSpace app directory?");
   }
   const parsed = parseToml(readFileSync(wranglerPath, "utf-8"));
-  if (!parsed.name) {
-    throw new Error("wrangler.toml has no `name` field");
+  const resolved = resolveAppName(parsed.name);
+  if (!resolved.ok) {
+    throw new Error(`wrangler.toml: ${resolved.reason}`);
+  }
+  if (parsed.name !== resolved.name) {
+    throw new Error(
+      `wrangler.toml: name "${parsed.name}" is not in canonical form. Update \`name\` to "${resolved.name}" and re-run.`
+    );
   }
-  return parsed.name;
+  return resolved.name;
 }
 async function mintAppOwnerJwt(authUrl, callerJwt, appName) {
   const res = await fetch(`${authUrl}/api/auth/mint-app-token`, {
@@ -92,6 +150,27 @@ async function mintAppOwnerJwt(authUrl, callerJwt, appName) {
   }
   return body.token;
 }
+async function fetchAppIdentityToken(deployUrl, callerJwt, appName) {
+  const res = await fetch(
+    `${deployUrl}/api/apps/${encodeURIComponent(appName)}/identity-token`,
+    {
+      method: "POST",
+      headers: { Authorization: `Bearer ${callerJwt}` }
+    }
+  );
+  if (res.status === 404) {
+    return null;
+  }
+  if (!res.ok) {
+    const err = await res.text().catch(() => "");
+    throw new Error(`Failed to fetch APP_IDENTITY_TOKEN (${res.status}): ${err}`);
+  }
+  const body = await res.json();
+  if (!body.token) {
+    throw new Error(`Deploy worker returned no token: ${body.error ?? "unknown error"}`);
+  }
+  return body.token;
+}
 var SDK_MANAGED_KEYS = /* @__PURE__ */ new Set([
   "AUTH_JWT_PUBLIC_KEY",
   "AUTH_JWT_ISSUER",
@@ -100,6 +179,7 @@ var SDK_MANAGED_KEYS = /* @__PURE__ */ new Set([
   "PLATFORM_WORKER_URL",
   "OWNER_USER_ID",
   "APP_OWNER_JWT",
+  "APP_IDENTITY_TOKEN",
   "INTERNAL_STORAGE_HMAC_SECRET",
   "ALLOW_DEBUG_ROUTES"
 ]);
@@ -212,6 +292,7 @@ async function writeDevVars(appDir, env, ownerId, callerJwt) {
   const publicKey = await fetchPublicKey(urls.auth);
   const appName = readAppName(appDir);
   const appOwnerJwt = await mintAppOwnerJwt(urls.auth, callerJwt, appName);
+  const appIdentityToken = await fetchAppIdentityToken(urls.deploy, callerJwt, appName);
   const sdkVars = [
     `AUTH_JWT_PUBLIC_KEY="${publicKey}"`,
     `AUTH_JWT_ISSUER=${urls.auth}/api/auth`,
@@ -220,6 +301,7 @@ async function writeDevVars(appDir, env, ownerId, callerJwt) {
     `PLATFORM_WORKER_URL=${urls.platform}`,
     `OWNER_USER_ID=${ownerId}`,
     `APP_OWNER_JWT=${appOwnerJwt}`,
+    ...appIdentityToken ? [`APP_IDENTITY_TOKEN=${appIdentityToken}`] : [],
     `INTERNAL_STORAGE_HMAC_SECRET=dev-${Date.now()}`,
     // Open /api/debug/* (proxied to RecordRoom) for dev + tests only.
     // Production secrets never set this, so deployed apps 404 the route.
@@ -307,7 +389,15 @@ var login_default = defineCommand({
     }
     storeCredentials(result.sessionToken, result.jwt);
     s.stop("Authenticated");
-    p2.outro(`Logged in as ${result.name ?? result.email}`);
+    p2.log.success(`Logged in as ${result.name ?? result.email}`);
+    p2.note(
+      `Manage your account, deployed apps, billing, and subscription
+plans on the web dashboard:
+
+  ${DASHBOARD_URL}`,
+      "Dashboard"
+    );
+    p2.outro("Done");
   }
 });
 async function pollForCompletion(sessionId) {
@@ -345,7 +435,7 @@ function openBrowser(url) {
   });
 }
 function sleep(ms) {
-  return new Promise((resolve6) => setTimeout(resolve6, ms));
+  return new Promise((resolve9) => setTimeout(resolve9, ms));
 }
 async function doEmailLogin(email, password) {
   const res = await fetch(`${AUTH_URL}/api/auth/sign-in/email`, {
@@ -416,14 +506,25 @@ var logout_default = defineCommand2({
 
 // src/cli/commands/dev.ts
 import { defineCommand as defineCommand3 } from "citty";
-import { existsSync as existsSync4 } from "fs";
-import { join as join5, resolve } from "path";
-import { spawn } from "child_process";
+import { existsSync as existsSync5 } from "fs";
+import { join as join5, resolve as resolve2 } from "path";
+import spawn from "cross-spawn";
 
 // src/cli/auth.ts
 import { readFileSync as readFileSync3, writeFileSync as writeFileSync3, existsSync as existsSync3, mkdirSync as mkdirSync2 } from "fs";
 import { join as join4 } from "path";
 import { homedir as homedir3 } from "os";
+
+// src/cli/jwt.ts
+function decodeJwtPayload(token2) {
+  const payloadSegment = token2.split(".")[1];
+  if (!payloadSegment) {
+    throw new Error("JWT payload is missing");
+  }
+  return JSON.parse(Buffer.from(payloadSegment, "base64url").toString("utf8"));
+}
+
+// src/cli/auth.ts
 var AUTH_URL3 = process.env.DEEPSPACE_AUTH_URL ?? ENVS.prod.auth;
 var DIR2 = join4(homedir3(), ".deepspace");
 var SESSION_PATH2 = join4(DIR2, "session");
@@ -439,23 +540,60 @@ async function ensureToken() {
       return existing;
     }
   }
-  const token = await exchangeSession(AUTH_URL3, sessionToken);
-  if (!token) {
+  const token2 = await exchangeSession(AUTH_URL3, sessionToken);
+  if (!token2) {
     throw new Error("Session expired. Run `deepspace login` to re-authenticate.");
   }
   mkdirSync2(DIR2, { recursive: true });
-  writeFileSync3(TOKEN_PATH2, token, { mode: 384 });
-  return token;
+  writeFileSync3(TOKEN_PATH2, token2, { mode: 384 });
+  return token2;
 }
 function isTokenValid(jwt) {
   try {
-    const payload = JSON.parse(atob(jwt.split(".")[1]));
-    return payload.exp * 1e3 > Date.now() + 3e4;
+    const payload = decodeJwtPayload(jwt);
+    return typeof payload.exp === "number" && payload.exp * 1e3 > Date.now() + 3e4;
   } catch {
     return false;
   }
 }
 
+// src/cli/lib/preflight.ts
+import { execFileSync } from "child_process";
+import { existsSync as existsSync4 } from "fs";
+import { resolve } from "path";
+var DLL_NOT_FOUND = -1073741515;
+function preflightWindowsWorkerd(appDir) {
+  if (process.platform !== "win32") return;
+  const workerdExe = resolve(
+    appDir,
+    "node_modules",
+    "@cloudflare",
+    "workerd-windows-64",
+    "bin",
+    "workerd.exe"
+  );
+  if (!existsSync4(workerdExe)) return;
+  try {
+    execFileSync(workerdExe, ["--help"], { stdio: "pipe", timeout: 1e4 });
+    return;
+  } catch (err) {
+    const status2 = err.status;
+    if (status2 !== DLL_NOT_FOUND) return;
+    console.error("");
+    console.error("  workerd (Cloudflare Workers runtime) cannot start on this system.");
+    console.error("  It needs the Microsoft Visual C++ Redistributable, which is not installed.");
+    console.error("");
+    console.error("  Install it with any of:");
+    console.error("    winget install Microsoft.VCRedist.2015+.x64");
+    console.error("    choco install -y vcredist140");
+    console.error("    https://aka.ms/vs/17/release/vc_redist.x64.exe");
+    console.error("");
+    console.error("  Then restart this terminal and re-run the command.");
+    console.error("");
+    process.exit(1);
+  }
+}
+
 // src/cli/commands/dev.ts
 var DEFAULT_PORT = 5173;
 var dev_default = defineCommand3({
@@ -481,23 +619,23 @@ var dev_default = defineCommand3({
     }
   },
   async run({ args }) {
-    const appDir = resolve(args.dir ?? ".");
+    const appDir = resolve2(args.dir ?? ".");
     const env = args.prod ? "prod" : "dev";
     const port = resolvePort(args.port);
-    if (!existsSync4(join5(appDir, "wrangler.toml"))) {
+    if (!existsSync5(join5(appDir, "wrangler.toml"))) {
       console.error("No wrangler.toml found. Are you in a DeepSpace app directory?");
       process.exit(1);
     }
-    let token;
+    let token2;
     try {
-      token = await ensureToken();
+      token2 = await ensureToken();
     } catch (err) {
       console.error(err.message);
       process.exit(1);
     }
     let payload;
     try {
-      payload = JSON.parse(atob(token.split(".")[1]));
+      payload = decodeJwtPayload(token2);
     } catch {
       console.error("Malformed session token. Run `npx deepspace login`.");
       process.exit(1);
@@ -505,7 +643,8 @@ var dev_default = defineCommand3({
     console.log(`Logged in as ${payload.name ?? payload.email}`);
     console.log(`Environment: ${env}`);
     console.log(`Port: ${port}`);
-    await writeDevVars(appDir, env, payload.sub, token);
+    await writeDevVars(appDir, env, payload.sub, token2);
+    preflightWindowsWorkerd(appDir);
     console.log("Starting dev server...\n");
     const vite = spawn(
       "npx",
@@ -513,7 +652,6 @@ var dev_default = defineCommand3({
       {
         cwd: appDir,
         stdio: "inherit",
-        shell: process.platform === "win32",
         env: { ...process.env, DEEPSPACE_PORT: String(port) }
       }
     );
@@ -696,9 +834,35 @@ function isAlive(pid) {
 
 // src/cli/commands/test.ts
 import { defineCommand as defineCommand5 } from "citty";
-import { existsSync as existsSync5 } from "fs";
-import { join as join6, resolve as resolve2 } from "path";
-import { execSync, spawnSync as spawnSync2 } from "child_process";
+import { existsSync as existsSync6 } from "fs";
+import { join as join6, resolve as resolve3 } from "path";
+import { sync as spawnSync3 } from "cross-spawn";
+
+// src/cli/lib/playwright.ts
+import { execSync } from "child_process";
+import { sync as spawnSync2 } from "cross-spawn";
+function ensurePlaywright(appDir) {
+  try {
+    execSync("npx playwright --version", { cwd: appDir, stdio: "pipe" });
+  } catch {
+    console.log("Installing Playwright...");
+    execSync("npm install -D @playwright/test", { cwd: appDir, stdio: "pipe" });
+  }
+  const isLinux = process.platform === "linux";
+  const isRoot = isLinux && typeof process.getuid === "function" && process.getuid() === 0;
+  const args = isRoot ? ["install", "--with-deps", "chromium"] : ["install", "chromium"];
+  const result = spawnSync2("npx", ["playwright", ...args], {
+    cwd: appDir,
+    stdio: "inherit"
+  });
+  if (result.status !== 0) {
+    console.error("\nPlaywright install failed. On Linux, system libs may be missing. Try:");
+    console.error("  sudo npx playwright install --with-deps chromium");
+    process.exit(1);
+  }
+}
+
+// src/cli/commands/test.ts
 var DEFAULT_PORT3 = 5173;
 var test_default = defineCommand5({
   meta: {
@@ -718,25 +882,26 @@ var test_default = defineCommand5({
     }
   },
   async run({ args }) {
-    const appDir = resolve2(".");
+    const appDir = resolve3(".");
     const suite = args.suite ?? "default";
     const port = resolvePort3(args.port);
-    if (!existsSync5(join6(appDir, "wrangler.toml"))) {
+    if (!existsSync6(join6(appDir, "wrangler.toml"))) {
       console.error("No wrangler.toml found. Are you in a DeepSpace app directory?");
       process.exit(1);
     }
-    let token;
+    let token2;
     let ownerId;
     try {
-      token = await ensureToken();
-      const payload = JSON.parse(atob(token.split(".")[1]));
+      token2 = await ensureToken();
+      const payload = decodeJwtPayload(token2);
       ownerId = payload.sub;
     } catch (err) {
       console.error("`deepspace test` requires you to be logged in. Run `deepspace login` first.");
       process.exit(1);
     }
-    await writeDevVars(appDir, "dev", ownerId, token);
+    await writeDevVars(appDir, "dev", ownerId, token2);
     if (suite !== "unit") {
+      preflightWindowsWorkerd(appDir);
       ensurePlaywright(appDir);
     }
     let exitCode = 0;
@@ -773,7 +938,7 @@ var test_default = defineCommand5({
   }
 });
 function runPlaywright(appDir, testFiles, port) {
-  const result = spawnSync2("npx", [
+  const result = spawnSync3("npx", [
     "playwright",
     "test",
     "--config",
@@ -782,36 +947,17 @@ function runPlaywright(appDir, testFiles, port) {
   ], {
     cwd: appDir,
     stdio: "inherit",
-    shell: process.platform === "win32",
     env: { ...process.env, DEEPSPACE_PORT: String(port) }
   });
   return result.status ?? 1;
 }
 function runVitest(appDir) {
-  const result = spawnSync2("npx", ["vitest", "run", "--passWithNoTests"], {
+  const result = spawnSync3("npx", ["vitest", "run", "--passWithNoTests"], {
     cwd: appDir,
-    stdio: "inherit",
-    shell: process.platform === "win32"
+    stdio: "inherit"
   });
   return result.status ?? 1;
 }
-function ensurePlaywright(appDir) {
-  try {
-    execSync("npx playwright --version", { cwd: appDir, stdio: "pipe" });
-  } catch {
-    console.log("Installing Playwright...");
-    execSync("npm install -D @playwright/test", { cwd: appDir, stdio: "pipe" });
-  }
-  const isLinux = process.platform === "linux";
-  const isRoot = isLinux && typeof process.getuid === "function" && process.getuid() === 0;
-  const args = isRoot ? ["install", "--with-deps", "chromium"] : ["install", "chromium"];
-  const result = spawnSync2("npx", ["playwright", ...args], { cwd: appDir, stdio: "inherit" });
-  if (result.status !== 0) {
-    console.error("\nPlaywright install failed. On Linux, system libs may be missing \u2014 try:");
-    console.error("  sudo npx playwright install --with-deps chromium");
-    process.exit(1);
-  }
-}
 function resolvePort3(arg) {
   const raw = arg ?? process.env.DEEPSPACE_PORT;
   if (!raw) return DEFAULT_PORT3;
@@ -823,10 +969,57 @@ function resolvePort3(arg) {
   return n;
 }
 
-// src/cli/commands/test-accounts.ts
+// src/cli/commands/screenshot.ts
 import { defineCommand as defineCommand6 } from "citty";
+import { sync as spawnSync4 } from "cross-spawn";
+import { resolve as resolve4 } from "path";
+var screenshot_default = defineCommand6({
+  meta: {
+    name: "screenshot",
+    description: "Take a Playwright screenshot, installing Chromium on demand"
+  },
+  args: {
+    url: {
+      type: "positional",
+      description: "URL to capture, for example http://localhost:5173/",
+      required: true
+    },
+    output: {
+      type: "positional",
+      description: "Output image path, for example screenshot.png",
+      required: true
+    },
+    "full-page": {
+      type: "boolean",
+      description: "Capture the full scrollable page",
+      required: false
+    },
+    "wait-for-timeout": {
+      type: "string",
+      description: "Milliseconds to wait before capture",
+      required: false
+    }
+  },
+  run({ args }) {
+    const appDir = resolve4(".");
+    ensurePlaywright(appDir);
+    const playwrightArgs = ["playwright", "screenshot", args.url, args.output];
+    if (args["full-page"]) playwrightArgs.push("--full-page");
+    if (args["wait-for-timeout"]) {
+      playwrightArgs.push("--wait-for-timeout", String(args["wait-for-timeout"]));
+    }
+    const result = spawnSync4("npx", playwrightArgs, {
+      cwd: appDir,
+      stdio: "inherit"
+    });
+    process.exit(result.status ?? 1);
+  }
+});
+
+// src/cli/commands/test-accounts.ts
+import { defineCommand as defineCommand7 } from "citty";
 import * as p3 from "@clack/prompts";
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync4, existsSync as existsSync6, mkdirSync as mkdirSync3 } from "fs";
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync4, existsSync as existsSync7, mkdirSync as mkdirSync3 } from "fs";
 import { join as join7 } from "path";
 import { homedir as homedir4 } from "os";
 var SESSION_COOKIE2 = "__Secure-better-auth.session_token";
@@ -834,7 +1027,7 @@ var AUTH_URL4 = process.env.DEEPSPACE_AUTH_URL ?? ENVS.prod.auth;
 var DIR3 = join7(homedir4(), ".deepspace");
 var ACCOUNTS_PATH = join7(DIR3, "test-accounts.json");
 function loadAccounts() {
-  if (!existsSync6(ACCOUNTS_PATH)) return [];
+  if (!existsSync7(ACCOUNTS_PATH)) return [];
   try {
     return JSON.parse(readFileSync4(ACCOUNTS_PATH, "utf-8"));
   } catch {
@@ -846,8 +1039,8 @@ function saveAccounts(accounts) {
   writeFileSync4(ACCOUNTS_PATH, JSON.stringify(accounts, null, 2), { mode: 384 });
 }
 function sessionCookie() {
-  const token = readFileSync4(SESSION_PATH2, "utf-8").trim();
-  return `${SESSION_COOKIE2}=${encodeURIComponent(token)}`;
+  const token2 = readFileSync4(SESSION_PATH2, "utf-8").trim();
+  return `${SESSION_COOKIE2}=${encodeURIComponent(token2)}`;
 }
 async function fetchRemoteAccounts() {
   const res = await fetch(`${AUTH_URL4}/api/auth/test-accounts`, {
@@ -869,7 +1062,7 @@ async function deleteRemote(id) {
     throw new Error(data.error ?? `DELETE returned ${res.status}`);
   }
 }
-var create = defineCommand6({
+var create = defineCommand7({
   meta: {
     name: "create",
     description: "Create a test account"
@@ -939,7 +1132,7 @@ var create = defineCommand6({
 Saved to ${ACCOUNTS_PATH}`);
   }
 });
-var list = defineCommand6({
+var list = defineCommand7({
   meta: {
     name: "list",
     description: "List your test accounts"
@@ -974,7 +1167,7 @@ var list = defineCommand6({
     }
   }
 });
-var del = defineCommand6({
+var del = defineCommand7({
   meta: {
     name: "delete",
     description: "Delete a test account by --email or --id"
@@ -1031,7 +1224,7 @@ var del = defineCommand6({
     console.log(`Test account deleted${targetEmail ? `: ${targetEmail}` : `: ${targetId}`}`);
   }
 });
-var clear = defineCommand6({
+var clear = defineCommand7({
   meta: {
     name: "clear",
     description: "Delete all your test accounts (or those matching --label)"
@@ -1097,7 +1290,7 @@ Failed:`);
     }
   }
 });
-var test_accounts_default = defineCommand6({
+var test_accounts_default = defineCommand7({
   meta: {
     name: "test-accounts",
     description: "Manage test accounts for development"
@@ -1111,11 +1304,12 @@ var test_accounts_default = defineCommand6({
 });
 
 // src/cli/commands/deploy.ts
-import { defineCommand as defineCommand7 } from "citty";
+import { defineCommand as defineCommand8 } from "citty";
 import { execSync as execSync2 } from "child_process";
-import { readFileSync as readFileSync5, readdirSync, existsSync as existsSync7 } from "fs";
+import { readFileSync as readFileSync5, readdirSync, existsSync as existsSync8 } from "fs";
 import { parse as parseToml2 } from "smol-toml";
-import { join as join8, resolve as resolve3, dirname } from "path";
+import { join as join8, resolve as resolve5, dirname } from "path";
+import { pathToFileURL } from "url";
 import * as p4 from "@clack/prompts";
 
 // src/server/rooms/binding-manifest.ts
@@ -1321,62 +1515,33 @@ function asObjectArray(v) {
   return v.filter(isObject);
 }
 
-// src/server/rooms/app-name.ts
-var APP_NAME_RULES = {
-  /** ^[a-z0-9](-?[a-z0-9])+$ — RFC 1035 host label, no consecutive dashes. */
-  pattern: /^[a-z0-9](?:-?[a-z0-9])+$/,
-  minLength: 2,
-  maxLength: 63
-};
-function validateAppName(raw) {
-  if (typeof raw !== "string") {
-    return { valid: false, reason: "App name must be a string" };
-  }
-  const name = raw.trim();
-  if (!name) {
-    return { valid: false, reason: "App name is required" };
-  }
-  if (name.length < APP_NAME_RULES.minLength) {
-    return { valid: false, reason: `App name "${name}" is too short (min ${APP_NAME_RULES.minLength} chars)` };
-  }
-  if (name.length > APP_NAME_RULES.maxLength) {
-    return { valid: false, reason: `App name "${name}" is too long (max ${APP_NAME_RULES.maxLength} chars)` };
-  }
-  if (!APP_NAME_RULES.pattern.test(name)) {
-    return {
-      valid: false,
-      reason: `App name "${name}" is invalid. Use lowercase letters, digits, and single hyphens only (must start + end with alphanumeric). Examples: my-app, search-v2, unison-search.`
-    };
-  }
-  return { valid: true, name };
-}
-function resolveAppName(raw) {
-  const strict = validateAppName(raw);
-  if (strict.valid) return { ok: true, name: strict.name };
-  if (typeof raw !== "string") return { ok: false, reason: strict.reason };
-  const trimmed = raw.trim();
-  if (!trimmed) return { ok: false, reason: "App name is required" };
-  const sanitized = sanitizeAppName(trimmed);
-  const sanitizedStrict = validateAppName(sanitized);
-  if (!sanitizedStrict.valid) {
-    return {
-      ok: false,
-      reason: `App name "${trimmed}" can't be sanitized into a valid name (${sanitizedStrict.reason}). Pick something matching: lowercase letters, digits, single hyphens, ${APP_NAME_RULES.minLength}-${APP_NAME_RULES.maxLength} chars.`
-    };
-  }
-  return {
-    ok: true,
-    name: sanitized,
-    warning: `App name "${trimmed}" doesn't conform to deploy rules \u2014 using "${sanitized}" instead. Update wrangler.toml's \`name\` to silence this warning.`
-  };
-}
-function sanitizeAppName(raw) {
-  return raw.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-{2,}/g, "-").replace(/^-+|-+$/g, "");
-}
-
 // src/cli/commands/deploy.ts
 var DEPLOY_URL = process.env.DEEPSPACE_DEPLOY_URL ?? ENVS.prod.deploy;
-var deploy_default = defineCommand7({
+var API_URL = process.env.DEEPSPACE_API_URL ?? ENVS.prod.api;
+var RESERVED_RUN_WORKER_FIRST = /* @__PURE__ */ new Set([
+  "/api/*",
+  "/ws/*",
+  "/internal/*",
+  "/v1/*",
+  "/_deepspace/*"
+]);
+function extractRunWorkerFirst(cfg) {
+  const raw = cfg.assets?.run_worker_first;
+  if (!Array.isArray(raw)) return [];
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const entry of raw) {
+    if (typeof entry !== "string") continue;
+    const trimmed = entry.trim();
+    if (!trimmed.startsWith("/")) continue;
+    if (RESERVED_RUN_WORKER_FIRST.has(trimmed)) continue;
+    if (seen.has(trimmed)) continue;
+    seen.add(trimmed);
+    out.push(trimmed);
+  }
+  return out;
+}
+var deploy_default = defineCommand8({
   meta: {
     name: "deploy",
     description: "Build and deploy your DeepSpace app"
@@ -1389,10 +1554,10 @@ var deploy_default = defineCommand7({
     }
   },
   async run({ args }) {
-    const appDir = resolve3(args.dir ?? ".");
+    const appDir = resolve5(args.dir ?? ".");
     p4.intro("Deploying DeepSpace app");
     const wranglerPath = join8(appDir, "wrangler.toml");
-    if (!existsSync7(wranglerPath)) {
+    if (!existsSync8(wranglerPath)) {
       p4.cancel("No wrangler.toml found. Are you in a DeepSpace app directory?");
       process.exit(1);
     }
@@ -1402,12 +1567,17 @@ var deploy_default = defineCommand7({
       p4.cancel(`wrangler.toml: ${nameRes.reason}`);
       process.exit(1);
     }
-    if (nameRes.warning) p4.log.warn(nameRes.warning);
+    if (wranglerConfig.name !== nameRes.name) {
+      p4.cancel(
+        `wrangler.toml: name "${wranglerConfig.name}" is not in canonical form. Update \`name\` to "${nameRes.name}" and re-run.`
+      );
+      process.exit(1);
+    }
     const appName = nameRes.name;
     p4.log.info(`App: ${appName}`);
-    let token;
+    let token2;
     try {
-      token = await ensureToken();
+      token2 = await ensureToken();
     } catch (err) {
       p4.cancel(err.message);
       process.exit(1);
@@ -1423,25 +1593,25 @@ var deploy_default = defineCommand7({
     }
     s.stop("Built");
     const deployConfigPath = join8(appDir, ".wrangler", "deploy", "config.json");
-    if (!existsSync7(deployConfigPath)) {
+    if (!existsSync8(deployConfigPath)) {
       p4.cancel("Build output config not found at .wrangler/deploy/config.json");
       process.exit(1);
     }
     const deployConfig = JSON.parse(readFileSync5(deployConfigPath, "utf-8"));
-    const outputWranglerPath = resolve3(dirname(deployConfigPath), deployConfig.configPath);
-    if (!existsSync7(outputWranglerPath)) {
+    const outputWranglerPath = resolve5(dirname(deployConfigPath), deployConfig.configPath);
+    if (!existsSync8(outputWranglerPath)) {
       p4.cancel(`Output wrangler.json not found at ${outputWranglerPath}`);
       process.exit(1);
     }
     const outputConfig = JSON.parse(readFileSync5(outputWranglerPath, "utf-8"));
     const workerDir = dirname(outputWranglerPath);
     const workerBundlePath = join8(workerDir, outputConfig.main);
-    const clientDir = outputConfig.assets?.directory ? resolve3(workerDir, outputConfig.assets.directory) : null;
-    if (!existsSync7(workerBundlePath)) {
+    const clientDir = outputConfig.assets?.directory ? resolve5(workerDir, outputConfig.assets.directory) : null;
+    if (!existsSync8(workerBundlePath)) {
       p4.cancel(`Worker bundle not found at ${workerBundlePath}`);
       process.exit(1);
     }
-    if (!clientDir || !existsSync7(clientDir)) {
+    if (!clientDir || !existsSync8(clientDir)) {
       p4.cancel(`Client assets not found at ${clientDir}`);
       process.exit(1);
     }
@@ -1477,7 +1647,7 @@ var deploy_default = defineCommand7({
     }
     const devVarsPath = join8(appDir, ".dev.vars");
     let userSecrets = {};
-    if (existsSync7(devVarsPath)) {
+    if (existsSync8(devVarsPath)) {
       const customSection = extractCustomDevVars(readFileSync5(devVarsPath, "utf-8"));
       if (customSection) {
         try {
@@ -1523,9 +1693,14 @@ var deploy_default = defineCommand7({
     if (userSecretNames.length) {
       form.append("userSecrets", JSON.stringify(userSecrets));
     }
+    const extraRoutes = extractRunWorkerFirst(wranglerConfig);
+    if (extraRoutes.length) {
+      form.append("extraRunWorkerFirst", JSON.stringify(extraRoutes));
+      p4.log.info(`Custom worker-first routes: ${extraRoutes.join(", ")}`);
+    }
     const res = await fetch(`${DEPLOY_URL}/api/deploy/${appName}`, {
       method: "POST",
-      headers: { Authorization: `Bearer ${token}` },
+      headers: { Authorization: `Bearer ${token2}` },
       body: form
     });
     const body = await res.json().catch(() => ({}));
@@ -1541,34 +1716,247 @@ var deploy_default = defineCommand7({
         s.stop("Deployed (edge propagation still in progress after 90s)");
         p4.log.warn("First requests may briefly hit the assets transitional page; retry in a minute.");
         p4.log.success(`Live at: ${body.url}`);
+        await syncSubscriptionPlans(appDir, appName, token2);
+        await syncOneTimeProducts(appDir, appName, token2);
         p4.outro("Done");
         return;
       }
     }
     s.stop("Deployed!");
     p4.log.success(`Live at: ${body.url}`);
+    await syncSubscriptionPlans(appDir, appName, token2);
+    await syncOneTimeProducts(appDir, appName, token2);
     p4.outro("Done");
   }
 });
-async function waitForAssetsReady(url, timeoutMs) {
-  const deadline = Date.now() + timeoutMs;
-  let attempt = 0;
-  while (Date.now() < deadline) {
-    attempt++;
-    try {
-      const res = await fetch(url, { redirect: "manual" });
-      const body = await res.text();
-      if (!body.includes("Assets have not yet deployed")) {
-        return true;
-      }
-    } catch {
+async function syncSubscriptionPlans(appDir, appName, token2) {
+  const subsPath = join8(appDir, "src", "subscriptions.ts");
+  if (!existsSync8(subsPath)) return;
+  const s = createSpinner();
+  s.start("Syncing subscription plans...");
+  let plans;
+  try {
+    const esbuild = await import("esbuild");
+    const outDir = join8(appDir, ".wrangler", "deploy");
+    const outFile = join8(outDir, "subscriptions.bundle.mjs");
+    await esbuild.build({
+      entryPoints: [subsPath],
+      bundle: true,
+      format: "esm",
+      platform: "node",
+      target: "node18",
+      outfile: outFile,
+      logLevel: "silent",
+      write: true
+    });
+    const mod = await import(`${pathToFileURL(outFile).href}?t=${Date.now()}`);
+    plans = mod.subscriptionPlans;
+  } catch (err) {
+    s.stop("Plan sync skipped");
+    p4.log.warn(`Could not load src/subscriptions.ts: ${err.message}`);
+    return;
+  }
+  if (!Array.isArray(plans)) {
+    s.stop("Plan sync skipped");
+    p4.log.warn(
+      "src/subscriptions.ts must `export const subscriptionPlans = [...] as const`"
+    );
+    return;
+  }
+  let res;
+  try {
+    res = await fetch(`${API_URL}/api/subscriptions/sync`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${token2}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({ appName, plans })
+    });
+  } catch (err) {
+    s.stop("Plan sync skipped");
+    p4.log.warn(`Plan sync request failed (network): ${err.message ?? err}`);
+    return;
+  }
+  const body = await res.json().catch(() => ({}));
+  if (res.ok && body.ok) {
+    s.stop(`Synced ${plans.length} plan${plans.length === 1 ? "" : "s"} to Stripe`);
+    if (body.connectMissing) {
+      p4.log.warn(
+        "Stripe Connect not yet set up. Customers can subscribe and earnings will queue in your platform balance until you finish onboarding at /earnings on the dashboard. The first payout after you connect will sweep everything that accumulated in the meantime."
+      );
     }
-    const wait2 = Math.min(8e3, 1e3 * 2 ** (attempt - 1));
-    await new Promise((r) => setTimeout(r, wait2));
+    const changes = (body.planChanges ?? []).filter((c) => c.affectedSubscribers > 0);
+    if (changes.length > 0) {
+      await promptAndCancelChangedPlans(appName, token2, changes);
+    }
+    return;
   }
-  return false;
+  s.stop("Plan sync skipped");
+  p4.log.warn(
+    `Plan sync failed: ${body.error ?? `HTTP ${res.status}`}${body.hint ? ` \u2014 ${body.hint}` : ""}`
+  );
 }
-function collectAssets(dir) {
+function formatCents(c) {
+  return c === 0 ? "free" : `$${(c / 100).toFixed(2)}`;
+}
+function summaryLine(c) {
+  const n = c.affectedSubscribers;
+  const suffix = `${n} subscriber${n === 1 ? "" : "s"}`;
+  if (c.reason === "removed") {
+    return `  \u2022 ${c.slug} \u2014 removed (${suffix} still on it)`;
+  }
+  const diffs = (c.intervals ?? []).map((i) => `${i.interval}: ${formatCents(i.oldCents)} \u2192 ${formatCents(i.newCents)}`).join("; ");
+  return `  \u2022 ${c.slug} \u2014 repriced (${diffs}; ${suffix} grandfathered on old price)`;
+}
+async function promptAndCancelChangedPlans(appName, token2, changes) {
+  const summary = changes.map(summaryLine).join("\n");
+  p4.log.warn(
+    `Plan change${changes.length === 1 ? "" : "s"} from this deploy left subscribers stranded:
+${summary}
+
+Stripe will keep charging them until you cancel. Cancel at the end of their
+current billing period? (Skip to leave them grandfathered.)`
+  );
+  const choice = await p4.confirm({
+    message: `Cancel ${changes.length === 1 ? "these subscribers" : "all of them"} at period end?`,
+    initialValue: false
+  });
+  if (p4.isCancel(choice) || !choice) {
+    p4.log.info("Skipped \u2014 existing subscribers stay on their current plan/price.");
+    return;
+  }
+  const MAX_ITERATIONS = 100;
+  for (const c of changes) {
+    const s = createSpinner();
+    s.start(`Canceling ${c.affectedSubscribers} subscriber${c.affectedSubscribers === 1 ? "" : "s"} on ${c.slug}...`);
+    let totalCanceled = 0;
+    let totalFailed = 0;
+    let iteration = 0;
+    let lastError = null;
+    let stopped = false;
+    try {
+      while (iteration < MAX_ITERATIONS) {
+        const res = await fetch(`${API_URL}/api/subscriptions/admin-cancel`, {
+          method: "POST",
+          headers: {
+            Authorization: `Bearer ${token2}`,
+            "Content-Type": "application/json"
+          },
+          body: JSON.stringify({
+            appName,
+            planSlug: c.slug,
+            atPeriodEnd: true,
+            reason: `plan ${c.reason} via deploy`
+          })
+        });
+        const body = await res.json().catch(() => ({}));
+        if (!res.ok || !body.success) {
+          lastError = body.error ?? `HTTP ${res.status}`;
+          s.stop(`Cancel failed for ${c.slug}: ${lastError}`);
+          stopped = true;
+          break;
+        }
+        const batchCanceled = body.canceled ?? 0;
+        totalCanceled += batchCanceled;
+        totalFailed += body.failures?.length ?? 0;
+        if (!body.hasMore) break;
+        if (batchCanceled === 0) {
+          lastError = "no progress (all rows failed this batch)";
+          break;
+        }
+        iteration++;
+      }
+      if (!stopped) {
+        const tail = totalFailed > 0 ? `; ${totalFailed} failed (see Stripe)` : "";
+        const cap = iteration >= MAX_ITERATIONS ? ` (batch cap reached \u2014 re-run deploy to finish remaining)` : "";
+        const errSuffix = lastError ? ` \u2014 ${lastError}` : "";
+        s.stop(`Canceled ${totalCanceled} on ${c.slug}${tail}${cap}${errSuffix}`);
+      }
+    } catch (err) {
+      s.stop(`Cancel failed for ${c.slug}: ${err.message}`);
+    }
+  }
+}
+async function syncOneTimeProducts(appDir, appName, token2) {
+  const productsPath = join8(appDir, "src", "products.ts");
+  if (!existsSync8(productsPath)) return;
+  const s = createSpinner();
+  s.start("Syncing one-time products...");
+  let products;
+  try {
+    const esbuild = await import("esbuild");
+    const outDir = join8(appDir, ".wrangler", "deploy");
+    const outFile = join8(outDir, "products.bundle.mjs");
+    await esbuild.build({
+      entryPoints: [productsPath],
+      bundle: true,
+      format: "esm",
+      platform: "node",
+      target: "node18",
+      outfile: outFile,
+      logLevel: "silent",
+      write: true
+    });
+    const mod = await import(`${pathToFileURL(outFile).href}?t=${Date.now()}`);
+    products = mod.oneTimeProducts;
+  } catch (err) {
+    s.stop("Product sync skipped");
+    p4.log.warn(`Could not load src/products.ts: ${err.message}`);
+    return;
+  }
+  if (!Array.isArray(products)) {
+    s.stop("Product sync skipped");
+    p4.log.warn(
+      "src/products.ts must `export const oneTimeProducts = [...] as const`"
+    );
+    return;
+  }
+  let res;
+  try {
+    res = await fetch(`${API_URL}/api/charges/products/sync`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${token2}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({ appName, products })
+    });
+  } catch (err) {
+    s.stop("Product sync skipped");
+    p4.log.warn(`Product sync request failed (network): ${err.message ?? err}`);
+    return;
+  }
+  const body = await res.json().catch(() => ({}));
+  if (res.ok && body.ok) {
+    const n = body.count ?? products.length;
+    s.stop(`Synced ${n} one-time product${n === 1 ? "" : "s"}`);
+    return;
+  }
+  s.stop("Product sync skipped");
+  p4.log.warn(
+    `Product sync failed: ${body.error ?? `HTTP ${res.status}`}${body.details ? ` \u2014 ${JSON.stringify(body.details)}` : ""}`
+  );
+}
+async function waitForAssetsReady(url, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  let attempt = 0;
+  while (Date.now() < deadline) {
+    attempt++;
+    try {
+      const res = await fetch(url, { redirect: "manual" });
+      const body = await res.text();
+      if (!body.includes("Assets have not yet deployed")) {
+        return true;
+      }
+    } catch {
+    }
+    const wait2 = Math.min(8e3, 1e3 * 2 ** (attempt - 1));
+    await new Promise((r) => setTimeout(r, wait2));
+  }
+  return false;
+}
+function collectAssets(dir) {
   const assets = [];
   function walk(d, prefix) {
     for (const entry of readdirSync(d, { withFileTypes: true })) {
@@ -1590,13 +1978,13 @@ function collectAssets(dir) {
 }
 
 // src/cli/commands/undeploy.ts
-import { defineCommand as defineCommand8 } from "citty";
-import { readFileSync as readFileSync6, existsSync as existsSync8 } from "fs";
+import { defineCommand as defineCommand9 } from "citty";
+import { readFileSync as readFileSync6, existsSync as existsSync9 } from "fs";
 import { join as join9 } from "path";
 import { parse as parseToml3 } from "smol-toml";
 import * as p5 from "@clack/prompts";
 var DEPLOY_URL2 = process.env.DEEPSPACE_DEPLOY_URL ?? ENVS.prod.deploy;
-var undeploy_default = defineCommand8({
+var undeploy_default = defineCommand9({
   meta: {
     name: "undeploy",
     description: "Remove a deployed DeepSpace app"
@@ -1612,7 +2000,7 @@ var undeploy_default = defineCommand8({
     let appName = args.name;
     if (!appName) {
       const wranglerPath = join9(process.cwd(), "wrangler.toml");
-      if (existsSync8(wranglerPath)) {
+      if (existsSync9(wranglerPath)) {
         const config = parseToml3(readFileSync6(wranglerPath, "utf-8"));
         if (config.name) appName = config.name;
       }
@@ -1621,9 +2009,9 @@ var undeploy_default = defineCommand8({
       p5.cancel("Provide an app name or run from a DeepSpace app directory.");
       process.exit(1);
     }
-    let token;
+    let token2;
     try {
-      token = await ensureToken();
+      token2 = await ensureToken();
     } catch (err) {
       p5.cancel(err.message);
       process.exit(1);
@@ -1633,7 +2021,7 @@ var undeploy_default = defineCommand8({
     s.start("Removing...");
     const res = await fetch(`${DEPLOY_URL2}/api/deploy/${appName}`, {
       method: "DELETE",
-      headers: { Authorization: `Bearer ${token}` }
+      headers: { Authorization: `Bearer ${token2}` }
     });
     const body = await res.json().catch(() => ({}));
     if (!res.ok || !body.success) {
@@ -1647,8 +2035,8 @@ var undeploy_default = defineCommand8({
 });
 
 // src/cli/commands/whoami.ts
-import { defineCommand as defineCommand9 } from "citty";
-var whoami_default = defineCommand9({
+import { defineCommand as defineCommand10 } from "citty";
+var whoami_default = defineCommand10({
   meta: {
     name: "whoami",
     description: "Show the currently logged-in user"
@@ -1670,7 +2058,7 @@ var whoami_default = defineCommand9({
     }
     let payload;
     try {
-      payload = JSON.parse(atob(jwt.split(".")[1]));
+      payload = decodeJwtPayload(jwt);
     } catch {
       console.error("Malformed session token. Run `deepspace login` again.");
       process.exit(1);
@@ -1693,6 +2081,7 @@ var whoami_default = defineCommand9({
     console.log(`UserID:     ${payload.sub ?? "(none)"}`);
     console.log(`Type:       ${accountType}`);
     if (payload.iss) console.log(`Issuer:     ${payload.iss}`);
+    console.log(`Dashboard:  ${DASHBOARD_URL}`);
     if (isTestAccount) {
       console.log("");
       console.log("Note: this is a test account, not a real OAuth developer.");
@@ -1702,16 +2091,16 @@ var whoami_default = defineCommand9({
 });
 
 // src/cli/commands/add.ts
-import { defineCommand as defineCommand10 } from "citty";
-import { existsSync as existsSync9 } from "fs";
-import { resolve as resolve4, join as join10 } from "path";
+import { defineCommand as defineCommand11 } from "citty";
+import { existsSync as existsSync10 } from "fs";
+import { resolve as resolve6, join as join10 } from "path";
 import { execSync as execSync3 } from "child_process";
 function findScript(from) {
   const candidate = join10(from, ".deepspace", "scripts", "add-feature.cjs");
-  if (existsSync9(candidate)) return candidate;
+  if (existsSync10(candidate)) return candidate;
   return null;
 }
-var add_default = defineCommand10({
+var add_default = defineCommand11({
   meta: {
     name: "add",
     description: "Add a feature to your DeepSpace app"
@@ -1740,7 +2129,7 @@ var add_default = defineCommand10({
     }
   },
   run({ args }) {
-    const appDir = resolve4(args.dir ?? ".");
+    const appDir = resolve6(args.dir ?? ".");
     const script = findScript(appDir);
     if (!script) {
       console.error("No .deepspace/scripts/add-feature.cjs found.");
@@ -1765,16 +2154,16 @@ var add_default = defineCommand10({
 });
 
 // src/cli/commands/domain.ts
-import { defineCommand as defineCommand11 } from "citty";
+import { defineCommand as defineCommand12 } from "citty";
 import { execSync as execSync4 } from "child_process";
 
 // src/cli/lib/app-context.ts
-import { existsSync as existsSync10, readFileSync as readFileSync7 } from "fs";
-import { join as join11, resolve as resolve5 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync7 } from "fs";
+import { join as join11, resolve as resolve7 } from "path";
 import { parse as parseToml4 } from "smol-toml";
 function detectAppName(cwd = process.cwd()) {
-  const wranglerPath = join11(resolve5(cwd), "wrangler.toml");
-  if (!existsSync10(wranglerPath)) return null;
+  const wranglerPath = join11(resolve7(cwd), "wrangler.toml");
+  if (!existsSync11(wranglerPath)) return null;
   try {
     const cfg = parseToml4(readFileSync7(wranglerPath, "utf-8"));
     return typeof cfg.name === "string" && cfg.name.length > 0 ? cfg.name : null;
@@ -1792,12 +2181,12 @@ function requireAppName(explicit, cwd) {
 }
 
 // src/cli/commands/domain.ts
-var API_URL = process.env.DEEPSPACE_API_URL ?? ENVS.prod.api;
-async function api(token, path, init) {
-  const res = await fetch(`${API_URL}${path}`, {
+var API_URL2 = process.env.DEEPSPACE_API_URL ?? ENVS.prod.api;
+async function api(token2, path, init) {
+  const res = await fetch(`${API_URL2}${path}`, {
     ...init,
     headers: {
-      Authorization: `Bearer ${token}`,
+      Authorization: `Bearer ${token2}`,
       "Content-Type": "application/json",
       ...init?.headers ?? {}
     }
@@ -1833,20 +2222,20 @@ function fmtDate(iso) {
   if (!iso) return "\u2014";
   return iso.slice(0, 10);
 }
-async function confirm2(message) {
+async function confirm3(message) {
   if (!process.stdin.isTTY) {
     throw new Error(`${message} \u2014 pass --yes to confirm non-interactively`);
   }
   process.stdout.write(`${message} [y/N] `);
-  return new Promise((resolve6) => {
+  return new Promise((resolve9) => {
     process.stdin.setEncoding("utf-8");
     process.stdin.once("data", (data) => {
       const answer = data.toString().trim().toLowerCase();
-      resolve6(answer === "y" || answer === "yes");
+      resolve9(answer === "y" || answer === "yes");
     });
   });
 }
-var search = defineCommand11({
+var search = defineCommand12({
   meta: { name: "search", description: "Search for available domains" },
   args: {
     query: { type: "positional", description: "Domain or keyword", required: true },
@@ -1854,10 +2243,10 @@ var search = defineCommand11({
     json: { type: "boolean", description: "Emit JSON instead of a table" }
   },
   async run({ args }) {
-    const token = await ensureToken();
+    const token2 = await ensureToken();
     const limit = parseInt(args.limit ?? "10", 10) || 10;
     const result = await api(
-      token,
+      token2,
       `/api/domains/search?q=${encodeURIComponent(args.query)}&limit=${limit}`
     );
     if (args.json) {
@@ -1876,7 +2265,7 @@ var search = defineCommand11({
     }
   }
 });
-var buy = defineCommand11({
+var buy = defineCommand12({
   meta: { name: "buy", description: "Buy a domain and attach it to an app" },
   args: {
     domain: { type: "positional", description: "Domain to buy", required: true },
@@ -1887,9 +2276,9 @@ var buy = defineCommand11({
     json: { type: "boolean", description: "Emit JSON to stdout", default: false }
   },
   async run({ args }) {
-    const token = await ensureToken();
+    const token2 = await ensureToken();
     const appName = requireAppName(args.app);
-    const priceCheck = await api(token, "/api/domains/check", {
+    const priceCheck = await api(token2, "/api/domains/check", {
       method: "POST",
       body: JSON.stringify({ domains: [args.domain] })
     });
@@ -1901,7 +2290,7 @@ var buy = defineCommand11({
     const price = fmtCents(result.chargedCents);
     const expectedTime = result.registrar === "cloudflare" ? "~60-90 seconds" : "15-60 minutes (registry NS propagation)";
     if (!args.yes) {
-      const ok = await confirm2(
+      const ok = await confirm3(
         `Buy ${args.domain} for ${price}/yr (auto-renews; non-refundable), attach to ${appName}? Provisioning takes ${expectedTime}.`
       );
       if (!ok) {
@@ -1910,7 +2299,7 @@ var buy = defineCommand11({
       }
     }
     const checkout = await api(
-      token,
+      token2,
       "/api/domains/checkout",
       {
         method: "POST",
@@ -1937,7 +2326,7 @@ var buy = defineCommand11({
       await new Promise((r) => setTimeout(r, 5e3));
       try {
         const detail = await api(
-          token,
+          token2,
           `/api/domains/${checkout.purchaseId}`
         );
         if (detail.domain.status !== lastStatus) {
@@ -1965,14 +2354,14 @@ var buy = defineCommand11({
     process.exit(1);
   }
 });
-var list2 = defineCommand11({
+var list2 = defineCommand12({
   meta: { name: "list", description: "List your domains" },
   args: {
     json: { type: "boolean", description: "Emit JSON" }
   },
   async run({ args }) {
-    const token = await ensureToken();
-    const result = await api(token, "/api/domains");
+    const token2 = await ensureToken();
+    const result = await api(token2, "/api/domains");
     if (args.json) {
       process.stdout.write(JSON.stringify(scrubInternal(result), null, 2) + "\n");
       return;
@@ -1989,15 +2378,15 @@ var list2 = defineCommand11({
     }
   }
 });
-var status = defineCommand11({
+var status = defineCommand12({
   meta: { name: "status", description: "Show details for one domain" },
   args: {
     domain: { type: "positional", description: "Domain", required: true },
     json: { type: "boolean" }
   },
   async run({ args }) {
-    const token = await ensureToken();
-    const all = await api(token, "/api/domains");
+    const token2 = await ensureToken();
+    const all = await api(token2, "/api/domains");
     const found = all.domains.find((d) => d.domain === args.domain);
     if (!found) {
       console.error(`No domain ${args.domain} in your account`);
@@ -2017,7 +2406,7 @@ var status = defineCommand11({
     console.log(`Charged:       ${fmtCents(found.chargedCents)}/yr`);
   }
 });
-var attach = defineCommand11({
+var attach = defineCommand12({
   meta: { name: "attach", description: "Re-point a domain at a different app" },
   args: {
     domain: { type: "positional", description: "Domain to re-point", required: true },
@@ -2025,16 +2414,16 @@ var attach = defineCommand11({
     json: { type: "boolean" }
   },
   async run({ args }) {
-    const token = await ensureToken();
+    const token2 = await ensureToken();
     const targetApp = requireAppName(args.app);
-    const all = await api(token, "/api/domains");
+    const all = await api(token2, "/api/domains");
     const found = all.domains.find((d) => d.domain === args.domain);
     if (!found) {
       console.error(`No domain ${args.domain} in your account`);
       process.exit(1);
     }
     const result = await api(
-      token,
+      token2,
       `/api/domains/${found.id}/reattach`,
       {
         method: "POST",
@@ -2048,7 +2437,7 @@ var attach = defineCommand11({
     console.log(`\u2713 ${args.domain} now points at ${targetApp}`);
   }
 });
-var detach = defineCommand11({
+var detach = defineCommand12({
   meta: {
     name: "detach",
     description: "Stop routing the domain (keeps the registration; auto-renew unchanged)"
@@ -2058,15 +2447,15 @@ var detach = defineCommand11({
     yes: { type: "boolean", description: "Skip the confirmation prompt" }
   },
   async run({ args }) {
-    const token = await ensureToken();
-    const all = await api(token, "/api/domains");
+    const token2 = await ensureToken();
+    const all = await api(token2, "/api/domains");
     const found = all.domains.find((d) => d.domain === args.domain);
     if (!found) {
       console.error(`No domain ${args.domain} in your account`);
       process.exit(1);
     }
     if (!args.yes) {
-      const ok = await confirm2(
+      const ok = await confirm3(
         `Detach ${args.domain}? Routing will stop; the domain stays registered (auto-renew is unchanged).`
       );
       if (!ok) {
@@ -2074,11 +2463,11 @@ var detach = defineCommand11({
         return;
       }
     }
-    await api(token, `/api/domains/${found.id}`, { method: "DELETE" });
+    await api(token2, `/api/domains/${found.id}`, { method: "DELETE" });
     console.log(`\u2713 ${args.domain} detached. Use \`deepspace domain attach\` to re-route, or \`renew --auto off\` to stop auto-renewal.`);
   }
 });
-var renew = defineCommand11({
+var renew = defineCommand12({
   meta: { name: "renew", description: "Toggle auto-renewal at the registrar" },
   args: {
     domain: { type: "positional", description: "Domain", required: true },
@@ -2089,15 +2478,15 @@ var renew = defineCommand11({
       console.error('--auto must be "on" or "off"');
       process.exit(1);
     }
-    const token = await ensureToken();
-    const all = await api(token, "/api/domains");
+    const token2 = await ensureToken();
+    const all = await api(token2, "/api/domains");
     const found = all.domains.find((d) => d.domain === args.domain);
     if (!found) {
       console.error(`No domain ${args.domain} in your account`);
       process.exit(1);
     }
     const enabled = args.auto === "on";
-    await api(token, `/api/domains/${found.id}/auto-renew`, {
+    await api(token2, `/api/domains/${found.id}/auto-renew`, {
       method: "POST",
       body: JSON.stringify({ autoRenew: enabled })
     });
@@ -2112,17 +2501,17 @@ function openBrowser2(url) {
   } catch {
   }
 }
-var domain_default = defineCommand11({
+var domain_default = defineCommand12({
   meta: { name: "domain", description: "Buy and manage custom domains" },
   subCommands: { search, buy, list: list2, status, attach, detach, renew }
 });
 
 // src/cli/commands/integrations.ts
-import { defineCommand as defineCommand12 } from "citty";
+import { defineCommand as defineCommand13 } from "citty";
 
 // src/cli/commands/_invoke-impl.ts
 import { readFileSync as readFileSync8 } from "fs";
-var API_URL2 = process.env.DEEPSPACE_API_URL ?? ENVS.prod.api;
+var API_URL3 = process.env.DEEPSPACE_API_URL ?? ENVS.prod.api;
 var DEFAULT_TIMEOUT_MS = 12e4;
 function parseTarget(target) {
   if (!target || typeof target !== "string") {
@@ -2160,7 +2549,7 @@ function flushAndExit(code) {
   });
 }
 async function fetchCatalog() {
-  const res = await fetch(`${API_URL2}/api/integrations`);
+  const res = await fetch(`${API_URL3}/api/integrations`);
   if (!res.ok) {
     throw new Error(`Failed to fetch integration catalog (${res.status})`);
   }
@@ -2241,7 +2630,7 @@ async function runInvoke(args) {
   const startedAt = Date.now();
   let res;
   try {
-    res = await fetch(`${API_URL2}/api/integrations/${integration}/${endpoint}`, {
+    res = await fetch(`${API_URL3}/api/integrations/${integration}/${endpoint}`, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
@@ -2292,7 +2681,7 @@ async function runInvoke(args) {
 }
 
 // src/cli/commands/integrations.ts
-var list3 = defineCommand12({
+var list3 = defineCommand13({
   meta: {
     name: "list",
     description: "List all available integrations"
@@ -2313,7 +2702,7 @@ var list3 = defineCommand12({
     }
   }
 });
-var info = defineCommand12({
+var info = defineCommand13({
   meta: {
     name: "info",
     description: "Print schema + example body for an integration endpoint"
@@ -2339,7 +2728,7 @@ var info = defineCommand12({
     }
   }
 });
-var invoke = defineCommand12({
+var invoke = defineCommand13({
   meta: {
     name: "invoke",
     description: "Invoke a platform integration as the logged-in user"
@@ -2392,7 +2781,7 @@ var invoke = defineCommand12({
     }
   }
 });
-var integrations_default = defineCommand12({
+var integrations_default = defineCommand13({
   meta: {
     name: "integrations",
     description: "List, inspect, and invoke platform integrations"
@@ -2405,8 +2794,8 @@ var integrations_default = defineCommand12({
 });
 
 // src/cli/commands/invoke.ts
-import { defineCommand as defineCommand13 } from "citty";
-var invoke_default = defineCommand13({
+import { defineCommand as defineCommand14 } from "citty";
+var invoke_default = defineCommand14({
   meta: {
     name: "invoke",
     description: "Invoke a platform integration as the logged-in user"
@@ -2478,13 +2867,472 @@ var invoke_default = defineCommand13({
   }
 });
 
+// src/cli/commands/managed-repos.ts
+import { defineCommand as defineCommand15 } from "citty";
+var API_URL4 = process.env.DEEPSPACE_API_URL ?? ENVS.prod.api;
+var SIMPLE_APP_ID = /^[a-z0-9][a-z0-9_.:-]{0,119}$/i;
+var SIMPLE_APP_NAME = /^[a-z0-9][a-z0-9_-]{0,119}$/i;
+async function api2(token2, path, init) {
+  const res = await fetch(`${API_URL4}${path}`, {
+    ...init,
+    headers: {
+      Authorization: `Bearer ${token2}`,
+      "Content-Type": "application/json",
+      ...init?.headers ?? {}
+    }
+  });
+  const text = await res.text();
+  if (!res.ok) {
+    let msg = text;
+    try {
+      msg = JSON.parse(text).error ?? text;
+    } catch {
+    }
+    throw new Error(`API ${path} (${res.status}): ${msg}`);
+  }
+  return JSON.parse(text);
+}
+function defaultAppId(appName) {
+  return `cli-${slugId(appName)}`;
+}
+function slugId(raw) {
+  return raw.toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "") || "app";
+}
+function assertSimple(value, pattern, label) {
+  if (!pattern.test(value)) {
+    throw new Error(`${label} must start with a letter or number and contain only simple identifier characters.`);
+  }
+}
+function printQuota(quota) {
+  console.log(`Repo quota: ${quota.activeCount} / ${quota.limit} active (${quota.remaining} remaining)`);
+}
+function printRepo(repo) {
+  console.log(`${repo.fullName}`);
+  console.log(`  ID:       ${repo.id}`);
+  console.log(`  App:      ${repo.appName}`);
+  console.log(`  App ID:   ${repo.appId}`);
+  console.log(`  URL:      ${repo.htmlUrl}`);
+  console.log(`  Clone:    ${repo.cloneUrl}`);
+}
+async function confirm4(message) {
+  if (!process.stdin.isTTY) {
+    throw new Error(`${message} \u2014 pass --yes to confirm non-interactively`);
+  }
+  process.stdout.write(`${message} [y/N] `);
+  return new Promise((resolve9) => {
+    process.stdin.setEncoding("utf-8");
+    process.stdin.once("data", (data) => {
+      const answer = data.toString().trim().toLowerCase();
+      resolve9(answer === "y" || answer === "yes");
+    });
+  });
+}
+var list4 = defineCommand15({
+  meta: {
+    name: "list",
+    description: "List your DeepSpace-managed repos and quota"
+  },
+  args: {
+    json: {
+      type: "boolean",
+      description: "Emit JSON instead of human output",
+      default: false
+    }
+  },
+  async run({ args }) {
+    const token2 = await ensureToken();
+    const result = await api2(token2, "/api/github/repos");
+    if (args.json) {
+      process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+      return;
+    }
+    printQuota(result.quota);
+    if (result.repos.length === 0) {
+      console.log("No DeepSpace-managed repos. Create one with `deepspace managed-repos create <app-name>`.");
+      return;
+    }
+    console.log("");
+    for (const repo of result.repos) {
+      printRepo(repo);
+    }
+  }
+});
+var create2 = defineCommand15({
+  meta: {
+    name: "create",
+    description: "Create a private DeepSpace-managed GitHub repo"
+  },
+  args: {
+    appName: {
+      type: "positional",
+      description: "Working app name for this repo",
+      required: true
+    },
+    appId: {
+      type: "string",
+      description: "Stable DeepSpace repo app id (defaults to cli-<app-name>)",
+      required: false
+    },
+    nameHint: {
+      type: "string",
+      description: "Repo-name hint (defaults to app name)",
+      required: false
+    },
+    json: {
+      type: "boolean",
+      description: "Emit JSON instead of human output",
+      default: false
+    }
+  },
+  async run({ args }) {
+    const appName = String(args.appName);
+    const appId = args.appId ? String(args.appId) : defaultAppId(appName);
+    const nameHint = args.nameHint ? String(args.nameHint) : void 0;
+    try {
+      assertSimple(appName, SIMPLE_APP_NAME, "appName");
+      assertSimple(appId, SIMPLE_APP_ID, "appId");
+      if (nameHint) assertSimple(nameHint, SIMPLE_APP_NAME, "nameHint");
+    } catch (err) {
+      console.error(err.message);
+      process.exit(1);
+    }
+    const token2 = await ensureToken();
+    const result = await api2(token2, "/api/github/repos", {
+      method: "POST",
+      body: JSON.stringify({ appName, appId, ...nameHint ? { nameHint } : {} })
+    });
+    if (args.json) {
+      process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+      return;
+    }
+    console.log(result.alreadyExists ? "Existing DeepSpace-managed repo:" : "Created DeepSpace-managed repo:");
+    printRepo(result.repo);
+  }
+});
+var token = defineCommand15({
+  meta: {
+    name: "token",
+    description: "Mint a short-lived GitHub token for a DeepSpace-managed repo"
+  },
+  args: {
+    repoId: {
+      type: "positional",
+      description: "Repo id from `deepspace managed-repos list`",
+      required: true
+    },
+    json: {
+      type: "boolean",
+      description: "Emit JSON instead of human output",
+      default: false
+    }
+  },
+  async run({ args }) {
+    const jwt = await ensureToken();
+    const result = await api2(
+      jwt,
+      `/api/github/repos/${encodeURIComponent(String(args.repoId))}/agent-token`,
+      { method: "POST" }
+    );
+    if (args.json) {
+      process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+      return;
+    }
+    console.log(`Repo:      ${result.repo.fullName}`);
+    console.log(`Expires:   ${result.token.expiresAt}`);
+    console.log(`Token:     ${result.token.token}`);
+    console.log("");
+    console.log(`Clone:     git clone https://x-access-token:${encodeURIComponent(result.token.token)}@github.com/${result.repo.fullName}.git`);
+  }
+});
+var remove = defineCommand15({
+  meta: {
+    name: "delete",
+    description: "Delete a DeepSpace-managed GitHub repo"
+  },
+  args: {
+    repoId: {
+      type: "positional",
+      description: "Repo id from `deepspace managed-repos list`",
+      required: true
+    },
+    yes: {
+      type: "boolean",
+      description: "Skip the confirmation prompt",
+      default: false
+    },
+    json: {
+      type: "boolean",
+      description: "Emit JSON instead of human output",
+      default: false
+    }
+  },
+  async run({ args }) {
+    if (!args.yes) {
+      try {
+        const ok = await confirm4(
+          "Delete this DeepSpace-managed GitHub repo? This removes the GitHub repository and counts against your daily delete quota."
+        );
+        if (!ok) {
+          console.log("Cancelled.");
+          return;
+        }
+      } catch (err) {
+        console.error(err.message);
+        process.exit(1);
+      }
+    }
+    const jwt = await ensureToken();
+    const result = await api2(
+      jwt,
+      `/api/github/repos/${encodeURIComponent(String(args.repoId))}`,
+      { method: "DELETE" }
+    );
+    if (args.json) {
+      process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+      return;
+    }
+    console.log(`Deleted ${result.repo.fullName}`);
+    console.log(
+      `Delete quota: ${result.deletionQuota.deletedCount} / ${result.deletionQuota.limit} used today (${result.deletionQuota.remaining} remaining)`
+    );
+  }
+});
+var managed_repos_default = defineCommand15({
+  meta: {
+    name: "managed-repos",
+    description: "Create and manage DeepSpace-owned GitHub repos"
+  },
+  subCommands: {
+    list: list4,
+    create: create2,
+    token,
+    delete: remove
+  }
+});
+
+// src/cli/commands/library.ts
+import { defineCommand as defineCommand16 } from "citty";
+import { existsSync as existsSync12, readFileSync as readFileSync9 } from "fs";
+import { join as join12, resolve as resolve8 } from "path";
+import { parse as parseToml5 } from "smol-toml";
+import * as p6 from "@clack/prompts";
+var DEFAULT_LIBRARY_APP = "deepdotspace-site";
+var publish = defineCommand16({
+  meta: {
+    name: "publish",
+    description: "Publish the current app to the DeepSpace library"
+  },
+  args: {
+    dir: {
+      type: "string",
+      description: "App directory (default: current directory)",
+      required: false
+    },
+    app: {
+      type: "string",
+      description: "App name (default: read from wrangler.toml)",
+      required: false
+    },
+    name: {
+      type: "string",
+      description: "Display name (default: app name)",
+      required: false
+    },
+    description: {
+      type: "string",
+      description: "Short description",
+      required: false
+    },
+    category: {
+      type: "string",
+      description: "Category (e.g. Productivity, Finance, AI). Default: General",
+      required: false
+    },
+    tags: {
+      type: "string",
+      description: "Comma-separated tags",
+      required: false
+    },
+    visibility: {
+      type: "string",
+      description: "'public' (default), 'unlisted', or 'private'",
+      required: false
+    },
+    screenshot: {
+      type: "string",
+      description: "Override the auto-captured preview with a public PNG URL",
+      required: false
+    },
+    "library-app": {
+      type: "string",
+      description: `Target library app subdomain (default: ${DEFAULT_LIBRARY_APP})`,
+      required: false
+    },
+    json: {
+      type: "boolean",
+      description: "Print only the JSON response (machine-readable)",
+      default: false
+    }
+  },
+  async run({ args }) {
+    const json = !!args.json;
+    const intro5 = (s) => {
+      if (!json) p6.intro(s);
+    };
+    const info2 = (s) => {
+      if (!json) p6.log.info(s);
+    };
+    const die = (msg) => {
+      if (json) console.error(JSON.stringify({ ok: false, error: msg }));
+      else p6.cancel(msg);
+      process.exit(1);
+    };
+    intro5("Publishing to the DeepSpace library");
+    let appName = typeof args.app === "string" && args.app.trim() ? args.app.trim() : void 0;
+    if (!appName) {
+      const appDir = resolve8(typeof args.dir === "string" && args.dir ? args.dir : ".");
+      const wranglerPath = join12(appDir, "wrangler.toml");
+      if (!existsSync12(wranglerPath)) {
+        return die("No --app provided and no wrangler.toml found. Either pass --app <name> or run from your app's directory.");
+      }
+      const cfg = parseToml5(readFileSync9(wranglerPath, "utf-8"));
+      const nameRes = resolveAppName(cfg.name);
+      if (!nameRes.ok) return die(`wrangler.toml: ${nameRes.reason}`);
+      appName = nameRes.name;
+    }
+    info2(`App: ${appName}`);
+    const visibility = args.visibility ?? "public";
+    if (!["public", "private", "unlisted"].includes(visibility)) {
+      return die("--visibility must be 'public', 'unlisted', or 'private'.");
+    }
+    const tags = typeof args.tags === "string" && args.tags ? args.tags.split(",").map((t) => t.trim()).filter(Boolean) : void 0;
+    const libraryApp = typeof args["library-app"] === "string" && args["library-app"] ? args["library-app"] : DEFAULT_LIBRARY_APP;
+    const libraryHost = process.env.DEEPSPACE_LIBRARY_HOST ?? `https://${libraryApp}.app.space`;
+    let token2;
+    try {
+      token2 = await ensureToken();
+    } catch (err) {
+      return die(err instanceof Error ? err.message : String(err));
+    }
+    const payload = {
+      appName,
+      ...args.name ? { name: args.name } : {},
+      ...args.description ? { description: args.description } : {},
+      ...args.category ? { category: args.category } : {},
+      ...tags ? { tags } : {},
+      visibility,
+      ...args.screenshot ? { screenshotUrl: args.screenshot } : {}
+    };
+    const url = `${libraryHost}/api/actions/library.publish`;
+    let res;
+    try {
+      res = await fetch(url, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Bearer ${token2}`
+        },
+        body: JSON.stringify(payload)
+      });
+    } catch (err) {
+      return die(`Network error reaching ${url}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const body = await res.text();
+    let parsed;
+    try {
+      parsed = JSON.parse(body);
+    } catch {
+      return die(`Server returned non-JSON (${res.status}): ${body.slice(0, 400)}`);
+    }
+    if (json) {
+      console.log(JSON.stringify(parsed));
+      process.exit(parsed.success ? 0 : 1);
+    }
+    if (!parsed.success) {
+      return die(parsed.error ?? `Publish failed (HTTP ${res.status}).`);
+    }
+    p6.log.success(`Published ${appName} as ${parsed.data?.templateHandle} (v${parsed.data?.version})`);
+    if (parsed.data?.url) p6.log.message(parsed.data.url);
+    p6.outro("Done");
+  }
+});
+var unpublish = defineCommand16({
+  meta: {
+    name: "unpublish",
+    description: "Remove a library entry (owner or admin only)"
+  },
+  args: {
+    handle: {
+      type: "positional",
+      description: "templateHandle to remove (usually your app name)",
+      required: true
+    },
+    "library-app": {
+      type: "string",
+      description: `Target library app subdomain (default: ${DEFAULT_LIBRARY_APP})`,
+      required: false
+    },
+    json: {
+      type: "boolean",
+      description: "Print only the JSON response",
+      default: false
+    }
+  },
+  async run({ args }) {
+    const json = !!args.json;
+    const die = (msg) => {
+      if (json) console.error(JSON.stringify({ ok: false, error: msg }));
+      else p6.cancel(msg);
+      process.exit(1);
+    };
+    if (!json) p6.intro("Unpublishing library entry");
+    let token2;
+    try {
+      token2 = await ensureToken();
+    } catch (err) {
+      return die(err instanceof Error ? err.message : String(err));
+    }
+    const libraryApp = typeof args["library-app"] === "string" && args["library-app"] ? args["library-app"] : DEFAULT_LIBRARY_APP;
+    const libraryHost = process.env.DEEPSPACE_LIBRARY_HOST ?? `https://${libraryApp}.app.space`;
+    const res = await fetch(`${libraryHost}/api/actions/library.unpublish`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Authorization: `Bearer ${token2}` },
+      body: JSON.stringify({ templateHandle: String(args.handle) })
+    });
+    const body = await res.text();
+    let parsed;
+    try {
+      parsed = JSON.parse(body);
+    } catch {
+      return die(`Server returned non-JSON (${res.status}): ${body.slice(0, 400)}`);
+    }
+    if (json) {
+      console.log(JSON.stringify(parsed));
+      process.exit(parsed.success ? 0 : 1);
+    }
+    if (!parsed.success) return die(parsed.error ?? `HTTP ${res.status}`);
+    p6.log.success(`Unpublished ${parsed.data?.templateHandle}`);
+    p6.outro("Done");
+  }
+});
+var library_default = defineCommand16({
+  meta: {
+    name: "library",
+    description: "Manage your DeepSpace library entries"
+  },
+  subCommands: {
+    publish,
+    unpublish
+  }
+});
+
 // src/cli/cli.ts
 var __dirname = dirname2(fileURLToPath(import.meta.url));
-var pkg = JSON.parse(readFileSync9(join12(__dirname, "..", "package.json"), "utf-8"));
-if (process.platform === "linux" && !process.env.SSL_CERT_FILE && existsSync11("/etc/ssl/certs/ca-certificates.crt")) {
+var pkg = JSON.parse(readFileSync10(join13(__dirname, "..", "package.json"), "utf-8"));
+if (process.platform === "linux" && !process.env.SSL_CERT_FILE && existsSync13("/etc/ssl/certs/ca-certificates.crt")) {
   process.env.SSL_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt";
 }
-var create2 = defineCommand14({
+var create3 = defineCommand17({
   meta: {
     name: "create",
     description: "Create a new DeepSpace app"
@@ -2503,27 +3351,30 @@ var create2 = defineCommand14({
     execSync5(`npm create deepspace@latest${name}`, { stdio: "inherit" });
   }
 });
-var main = defineCommand14({
+var main = defineCommand17({
   meta: {
     name: "deepspace",
     version: pkg.version,
     description: "DeepSpace SDK CLI"
   },
   subCommands: {
-    create: create2,
+    create: create3,
     login: login_default,
     logout: logout_default,
     whoami: whoami_default,
     dev: dev_default,
     kill: kill_default,
     test: test_default,
+    screenshot: screenshot_default,
     "test-accounts": test_accounts_default,
     add: add_default,
     integrations: integrations_default,
+    "managed-repos": managed_repos_default,
     invoke: invoke_default,
     deploy: deploy_default,
     undeploy: undeploy_default,
-    domain: domain_default
+    domain: domain_default,
+    library: library_default
   }
   // No `run()` here — citty cascades parent run() AFTER subcommand finishes,
   // which corrupts agent-friendly output (`--json`) and prints noise on every