deepspace 0.3.8 → 0.3.9

package/dist/cli.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 
 // src/cli/cli.ts
-import { defineCommand as defineCommand16, runMain } from "citty";
+import { defineCommand as defineCommand17, runMain } from "citty";
 import { execSync as execSync5 } from "child_process";
-import { readFileSync as readFileSync9, existsSync as existsSync11 } from "fs";
-import { dirname as dirname2, join as join12 } from "path";
+import { readFileSync as readFileSync10, existsSync as existsSync13 } from "fs";
+import { dirname as dirname2, join as join13 } from "path";
 import { fileURLToPath } from "url";
 
 // src/cli/commands/login.ts
@@ -37,20 +37,72 @@ function createSpinner() {
 import { existsSync, readFileSync, writeFileSync } from "fs";
 import { join } from "path";
 import { parse as parseToml } from "smol-toml";
-var ENVS = {
-  dev: {
-    auth: "https://deepspace-auth.eudaimonicincorporated.workers.dev",
-    api: "https://deepspace-api.eudaimonicincorporated.workers.dev",
-    platform: "https://deepspace-platform-worker.eudaimonicincorporated.workers.dev",
-    deploy: "https://deepspace-deploy.eudaimonicincorporated.workers.dev"
-  },
-  prod: {
-    auth: "https://deepspace-auth.eudaimonicincorporated.workers.dev",
-    api: "https://deepspace-api.eudaimonicincorporated.workers.dev",
-    platform: "https://deepspace-platform-worker.eudaimonicincorporated.workers.dev",
-    deploy: "https://deepspace-deploy.eudaimonicincorporated.workers.dev"
+
+// src/server/rooms/app-name.ts
+var APP_NAME_RULES = {
+  /** ^[a-z0-9](-?[a-z0-9])+$ — RFC 1035 host label, no consecutive dashes. */
+  pattern: /^[a-z0-9](?:-?[a-z0-9])+$/,
+  minLength: 2,
+  maxLength: 63
+};
+function validateAppName(raw) {
+  if (typeof raw !== "string") {
+    return { valid: false, reason: "App name must be a string" };
+  }
+  const name = raw.trim();
+  if (!name) {
+    return { valid: false, reason: "App name is required" };
   }
+  if (name.length < APP_NAME_RULES.minLength) {
+    return { valid: false, reason: `App name "${name}" is too short (min ${APP_NAME_RULES.minLength} chars)` };
+  }
+  if (name.length > APP_NAME_RULES.maxLength) {
+    return { valid: false, reason: `App name "${name}" is too long (max ${APP_NAME_RULES.maxLength} chars)` };
+  }
+  if (!APP_NAME_RULES.pattern.test(name)) {
+    return {
+      valid: false,
+      reason: `App name "${name}" is invalid. Use lowercase letters, digits, and single hyphens only (must start + end with alphanumeric). Examples: my-app, search-v2, unison-search.`
+    };
+  }
+  return { valid: true, name };
+}
+function resolveAppName(raw) {
+  const strict = validateAppName(raw);
+  if (strict.valid) return { ok: true, name: strict.name };
+  if (typeof raw !== "string") return { ok: false, reason: strict.reason };
+  const trimmed = raw.trim();
+  if (!trimmed) return { ok: false, reason: "App name is required" };
+  const sanitized = sanitizeAppName(trimmed);
+  const sanitizedStrict = validateAppName(sanitized);
+  if (!sanitizedStrict.valid) {
+    return {
+      ok: false,
+      reason: `App name "${trimmed}" can't be sanitized into a valid name (${sanitizedStrict.reason}). Pick something matching: lowercase letters, digits, single hyphens, ${APP_NAME_RULES.minLength}-${APP_NAME_RULES.maxLength} chars.`
+    };
+  }
+  return {
+    ok: true,
+    name: sanitized,
+    warning: `App name "${trimmed}" doesn't conform to deploy rules \u2014 using "${sanitized}" instead. Update wrangler.toml's \`name\` to silence this warning.`
+  };
+}
+function sanitizeAppName(raw) {
+  return raw.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-{2,}/g, "-").replace(/^-+|-+$/g, "");
+}
+
+// src/cli/env.ts
+var ENV_URLS = {
+  auth: "https://deepspace-auth.eudaimonicincorporated.workers.dev",
+  api: "https://deepspace-api.eudaimonicincorporated.workers.dev",
+  platform: "https://deepspace-platform-worker.eudaimonicincorporated.workers.dev",
+  deploy: "https://deepspace-deploy.eudaimonicincorporated.workers.dev"
 };
+var ENVS = {
+  dev: ENV_URLS,
+  prod: ENV_URLS
+};
+var DASHBOARD_URL = "https://dashboard.deep.space";
 async function fetchPublicKey(authUrl) {
   const res = await fetch(`${authUrl}/api/auth/jwks`);
   if (!res.ok) {
@@ -68,10 +120,16 @@ function readAppName(appDir) {
     throw new Error("No wrangler.toml found. Are you in a DeepSpace app directory?");
   }
   const parsed = parseToml(readFileSync(wranglerPath, "utf-8"));
-  if (!parsed.name) {
-    throw new Error("wrangler.toml has no `name` field");
+  const resolved = resolveAppName(parsed.name);
+  if (!resolved.ok) {
+    throw new Error(`wrangler.toml: ${resolved.reason}`);
+  }
+  if (parsed.name !== resolved.name) {
+    throw new Error(
+      `wrangler.toml: name "${parsed.name}" is not in canonical form. Update \`name\` to "${resolved.name}" and re-run.`
+    );
   }
-  return parsed.name;
+  return resolved.name;
 }
 async function mintAppOwnerJwt(authUrl, callerJwt, appName) {
   const res = await fetch(`${authUrl}/api/auth/mint-app-token`, {
@@ -92,6 +150,27 @@ async function mintAppOwnerJwt(authUrl, callerJwt, appName) {
   }
   return body.token;
 }
+async function fetchAppIdentityToken(deployUrl, callerJwt, appName) {
+  const res = await fetch(
+    `${deployUrl}/api/apps/${encodeURIComponent(appName)}/identity-token`,
+    {
+      method: "POST",
+      headers: { Authorization: `Bearer ${callerJwt}` }
+    }
+  );
+  if (res.status === 404) {
+    return null;
+  }
+  if (!res.ok) {
+    const err = await res.text().catch(() => "");
+    throw new Error(`Failed to fetch APP_IDENTITY_TOKEN (${res.status}): ${err}`);
+  }
+  const body = await res.json();
+  if (!body.token) {
+    throw new Error(`Deploy worker returned no token: ${body.error ?? "unknown error"}`);
+  }
+  return body.token;
+}
 var SDK_MANAGED_KEYS = /* @__PURE__ */ new Set([
   "AUTH_JWT_PUBLIC_KEY",
   "AUTH_JWT_ISSUER",
@@ -100,6 +179,7 @@ var SDK_MANAGED_KEYS = /* @__PURE__ */ new Set([
   "PLATFORM_WORKER_URL",
   "OWNER_USER_ID",
   "APP_OWNER_JWT",
+  "APP_IDENTITY_TOKEN",
   "INTERNAL_STORAGE_HMAC_SECRET",
   "ALLOW_DEBUG_ROUTES"
 ]);
@@ -212,6 +292,7 @@ async function writeDevVars(appDir, env, ownerId, callerJwt) {
   const publicKey = await fetchPublicKey(urls.auth);
   const appName = readAppName(appDir);
   const appOwnerJwt = await mintAppOwnerJwt(urls.auth, callerJwt, appName);
+  const appIdentityToken = await fetchAppIdentityToken(urls.deploy, callerJwt, appName);
   const sdkVars = [
     `AUTH_JWT_PUBLIC_KEY="${publicKey}"`,
     `AUTH_JWT_ISSUER=${urls.auth}/api/auth`,
@@ -220,6 +301,7 @@ async function writeDevVars(appDir, env, ownerId, callerJwt) {
     `PLATFORM_WORKER_URL=${urls.platform}`,
     `OWNER_USER_ID=${ownerId}`,
     `APP_OWNER_JWT=${appOwnerJwt}`,
+    ...appIdentityToken ? [`APP_IDENTITY_TOKEN=${appIdentityToken}`] : [],
     `INTERNAL_STORAGE_HMAC_SECRET=dev-${Date.now()}`,
     // Open /api/debug/* (proxied to RecordRoom) for dev + tests only.
     // Production secrets never set this, so deployed apps 404 the route.
@@ -307,7 +389,15 @@ var login_default = defineCommand({
     }
     storeCredentials(result.sessionToken, result.jwt);
     s.stop("Authenticated");
-    p2.outro(`Logged in as ${result.name ?? result.email}`);
+    p2.log.success(`Logged in as ${result.name ?? result.email}`);
+    p2.note(
+      `Manage your account, deployed apps, billing, and subscription
+plans on the web dashboard:
+
+  ${DASHBOARD_URL}`,
+      "Dashboard"
+    );
+    p2.outro("Done");
   }
 });
 async function pollForCompletion(sessionId) {
@@ -345,7 +435,7 @@ function openBrowser(url) {
   });
 }
 function sleep(ms) {
-  return new Promise((resolve7) => setTimeout(resolve7, ms));
+  return new Promise((resolve9) => setTimeout(resolve9, ms));
 }
 async function doEmailLogin(email, password) {
   const res = await fetch(`${AUTH_URL}/api/auth/sign-in/email`, {
@@ -416,14 +506,25 @@ var logout_default = defineCommand2({
 
 // src/cli/commands/dev.ts
 import { defineCommand as defineCommand3 } from "citty";
-import { existsSync as existsSync4 } from "fs";
-import { join as join5, resolve } from "path";
-import { spawn } from "child_process";
+import { existsSync as existsSync5 } from "fs";
+import { join as join5, resolve as resolve2 } from "path";
+import spawn from "cross-spawn";
 
 // src/cli/auth.ts
 import { readFileSync as readFileSync3, writeFileSync as writeFileSync3, existsSync as existsSync3, mkdirSync as mkdirSync2 } from "fs";
 import { join as join4 } from "path";
 import { homedir as homedir3 } from "os";
+
+// src/cli/jwt.ts
+function decodeJwtPayload(token2) {
+  const payloadSegment = token2.split(".")[1];
+  if (!payloadSegment) {
+    throw new Error("JWT payload is missing");
+  }
+  return JSON.parse(Buffer.from(payloadSegment, "base64url").toString("utf8"));
+}
+
+// src/cli/auth.ts
 var AUTH_URL3 = process.env.DEEPSPACE_AUTH_URL ?? ENVS.prod.auth;
 var DIR2 = join4(homedir3(), ".deepspace");
 var SESSION_PATH2 = join4(DIR2, "session");
@@ -449,13 +550,50 @@ async function ensureToken() {
 }
 function isTokenValid(jwt) {
   try {
-    const payload = JSON.parse(atob(jwt.split(".")[1]));
-    return payload.exp * 1e3 > Date.now() + 3e4;
+    const payload = decodeJwtPayload(jwt);
+    return typeof payload.exp === "number" && payload.exp * 1e3 > Date.now() + 3e4;
   } catch {
     return false;
   }
 }
 
+// src/cli/lib/preflight.ts
+import { execFileSync } from "child_process";
+import { existsSync as existsSync4 } from "fs";
+import { resolve } from "path";
+var DLL_NOT_FOUND = -1073741515;
+function preflightWindowsWorkerd(appDir) {
+  if (process.platform !== "win32") return;
+  const workerdExe = resolve(
+    appDir,
+    "node_modules",
+    "@cloudflare",
+    "workerd-windows-64",
+    "bin",
+    "workerd.exe"
+  );
+  if (!existsSync4(workerdExe)) return;
+  try {
+    execFileSync(workerdExe, ["--help"], { stdio: "pipe", timeout: 1e4 });
+    return;
+  } catch (err) {
+    const status2 = err.status;
+    if (status2 !== DLL_NOT_FOUND) return;
+    console.error("");
+    console.error("  workerd (Cloudflare Workers runtime) cannot start on this system.");
+    console.error("  It needs the Microsoft Visual C++ Redistributable, which is not installed.");
+    console.error("");
+    console.error("  Install it with any of:");
+    console.error("    winget install Microsoft.VCRedist.2015+.x64");
+    console.error("    choco install -y vcredist140");
+    console.error("    https://aka.ms/vs/17/release/vc_redist.x64.exe");
+    console.error("");
+    console.error("  Then restart this terminal and re-run the command.");
+    console.error("");
+    process.exit(1);
+  }
+}
+
 // src/cli/commands/dev.ts
 var DEFAULT_PORT = 5173;
 var dev_default = defineCommand3({
@@ -481,10 +619,10 @@ var dev_default = defineCommand3({
     }
   },
   async run({ args }) {
-    const appDir = resolve(args.dir ?? ".");
+    const appDir = resolve2(args.dir ?? ".");
     const env = args.prod ? "prod" : "dev";
     const port = resolvePort(args.port);
-    if (!existsSync4(join5(appDir, "wrangler.toml"))) {
+    if (!existsSync5(join5(appDir, "wrangler.toml"))) {
       console.error("No wrangler.toml found. Are you in a DeepSpace app directory?");
       process.exit(1);
     }
@@ -497,7 +635,7 @@ var dev_default = defineCommand3({
     }
     let payload;
     try {
-      payload = JSON.parse(atob(token2.split(".")[1]));
+      payload = decodeJwtPayload(token2);
     } catch {
       console.error("Malformed session token. Run `npx deepspace login`.");
       process.exit(1);
@@ -506,6 +644,7 @@ var dev_default = defineCommand3({
     console.log(`Environment: ${env}`);
     console.log(`Port: ${port}`);
     await writeDevVars(appDir, env, payload.sub, token2);
+    preflightWindowsWorkerd(appDir);
     console.log("Starting dev server...\n");
     const vite = spawn(
       "npx",
@@ -513,7 +652,6 @@ var dev_default = defineCommand3({
       {
         cwd: appDir,
         stdio: "inherit",
-        shell: process.platform === "win32",
         env: { ...process.env, DEEPSPACE_PORT: String(port) }
       }
     );
@@ -696,12 +834,13 @@ function isAlive(pid) {
 
 // src/cli/commands/test.ts
 import { defineCommand as defineCommand5 } from "citty";
-import { existsSync as existsSync5 } from "fs";
-import { join as join6, resolve as resolve2 } from "path";
-import { spawnSync as spawnSync3 } from "child_process";
+import { existsSync as existsSync6 } from "fs";
+import { join as join6, resolve as resolve3 } from "path";
+import { sync as spawnSync3 } from "cross-spawn";
 
 // src/cli/lib/playwright.ts
-import { execSync, spawnSync as spawnSync2 } from "child_process";
+import { execSync } from "child_process";
+import { sync as spawnSync2 } from "cross-spawn";
 function ensurePlaywright(appDir) {
   try {
     execSync("npx playwright --version", { cwd: appDir, stdio: "pipe" });
@@ -714,8 +853,7 @@ function ensurePlaywright(appDir) {
   const args = isRoot ? ["install", "--with-deps", "chromium"] : ["install", "chromium"];
   const result = spawnSync2("npx", ["playwright", ...args], {
     cwd: appDir,
-    stdio: "inherit",
-    shell: process.platform === "win32"
+    stdio: "inherit"
   });
   if (result.status !== 0) {
     console.error("\nPlaywright install failed. On Linux, system libs may be missing. Try:");
@@ -744,10 +882,10 @@ var test_default = defineCommand5({
     }
   },
   async run({ args }) {
-    const appDir = resolve2(".");
+    const appDir = resolve3(".");
     const suite = args.suite ?? "default";
     const port = resolvePort3(args.port);
-    if (!existsSync5(join6(appDir, "wrangler.toml"))) {
+    if (!existsSync6(join6(appDir, "wrangler.toml"))) {
       console.error("No wrangler.toml found. Are you in a DeepSpace app directory?");
       process.exit(1);
     }
@@ -755,7 +893,7 @@ var test_default = defineCommand5({
     let ownerId;
     try {
       token2 = await ensureToken();
-      const payload = JSON.parse(atob(token2.split(".")[1]));
+      const payload = decodeJwtPayload(token2);
       ownerId = payload.sub;
     } catch (err) {
       console.error("`deepspace test` requires you to be logged in. Run `deepspace login` first.");
@@ -763,6 +901,7 @@ var test_default = defineCommand5({
     }
     await writeDevVars(appDir, "dev", ownerId, token2);
     if (suite !== "unit") {
+      preflightWindowsWorkerd(appDir);
       ensurePlaywright(appDir);
     }
     let exitCode = 0;
@@ -808,7 +947,6 @@ function runPlaywright(appDir, testFiles, port) {
   ], {
     cwd: appDir,
     stdio: "inherit",
-    shell: process.platform === "win32",
     env: { ...process.env, DEEPSPACE_PORT: String(port) }
   });
   return result.status ?? 1;
@@ -816,8 +954,7 @@ function runPlaywright(appDir, testFiles, port) {
 function runVitest(appDir) {
   const result = spawnSync3("npx", ["vitest", "run", "--passWithNoTests"], {
     cwd: appDir,
-    stdio: "inherit",
-    shell: process.platform === "win32"
+    stdio: "inherit"
   });
   return result.status ?? 1;
 }
@@ -834,8 +971,8 @@ function resolvePort3(arg) {
 
 // src/cli/commands/screenshot.ts
 import { defineCommand as defineCommand6 } from "citty";
-import { spawnSync as spawnSync4 } from "child_process";
-import { resolve as resolve3 } from "path";
+import { sync as spawnSync4 } from "cross-spawn";
+import { resolve as resolve4 } from "path";
 var screenshot_default = defineCommand6({
   meta: {
     name: "screenshot",
@@ -864,7 +1001,7 @@ var screenshot_default = defineCommand6({
     }
   },
   run({ args }) {
-    const appDir = resolve3(".");
+    const appDir = resolve4(".");
     ensurePlaywright(appDir);
     const playwrightArgs = ["playwright", "screenshot", args.url, args.output];
     if (args["full-page"]) playwrightArgs.push("--full-page");
@@ -873,8 +1010,7 @@ var screenshot_default = defineCommand6({
     }
     const result = spawnSync4("npx", playwrightArgs, {
       cwd: appDir,
-      stdio: "inherit",
-      shell: process.platform === "win32"
+      stdio: "inherit"
     });
     process.exit(result.status ?? 1);
   }
@@ -883,7 +1019,7 @@ var screenshot_default = defineCommand6({
 // src/cli/commands/test-accounts.ts
 import { defineCommand as defineCommand7 } from "citty";
 import * as p3 from "@clack/prompts";
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync4, existsSync as existsSync6, mkdirSync as mkdirSync3 } from "fs";
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync4, existsSync as existsSync7, mkdirSync as mkdirSync3 } from "fs";
 import { join as join7 } from "path";
 import { homedir as homedir4 } from "os";
 var SESSION_COOKIE2 = "__Secure-better-auth.session_token";
@@ -891,7 +1027,7 @@ var AUTH_URL4 = process.env.DEEPSPACE_AUTH_URL ?? ENVS.prod.auth;
 var DIR3 = join7(homedir4(), ".deepspace");
 var ACCOUNTS_PATH = join7(DIR3, "test-accounts.json");
 function loadAccounts() {
-  if (!existsSync6(ACCOUNTS_PATH)) return [];
+  if (!existsSync7(ACCOUNTS_PATH)) return [];
   try {
     return JSON.parse(readFileSync4(ACCOUNTS_PATH, "utf-8"));
   } catch {
@@ -1170,9 +1306,10 @@ var test_accounts_default = defineCommand7({
 // src/cli/commands/deploy.ts
 import { defineCommand as defineCommand8 } from "citty";
 import { execSync as execSync2 } from "child_process";
-import { readFileSync as readFileSync5, readdirSync, existsSync as existsSync7 } from "fs";
+import { readFileSync as readFileSync5, readdirSync, existsSync as existsSync8 } from "fs";
 import { parse as parseToml2 } from "smol-toml";
-import { join as join8, resolve as resolve4, dirname } from "path";
+import { join as join8, resolve as resolve5, dirname } from "path";
+import { pathToFileURL } from "url";
 import * as p4 from "@clack/prompts";
 
 // src/server/rooms/binding-manifest.ts
@@ -1378,61 +1515,32 @@ function asObjectArray(v) {
   return v.filter(isObject);
 }
 
-// src/server/rooms/app-name.ts
-var APP_NAME_RULES = {
-  /** ^[a-z0-9](-?[a-z0-9])+$ — RFC 1035 host label, no consecutive dashes. */
-  pattern: /^[a-z0-9](?:-?[a-z0-9])+$/,
-  minLength: 2,
-  maxLength: 63
-};
-function validateAppName(raw) {
-  if (typeof raw !== "string") {
-    return { valid: false, reason: "App name must be a string" };
-  }
-  const name = raw.trim();
-  if (!name) {
-    return { valid: false, reason: "App name is required" };
-  }
-  if (name.length < APP_NAME_RULES.minLength) {
-    return { valid: false, reason: `App name "${name}" is too short (min ${APP_NAME_RULES.minLength} chars)` };
-  }
-  if (name.length > APP_NAME_RULES.maxLength) {
-    return { valid: false, reason: `App name "${name}" is too long (max ${APP_NAME_RULES.maxLength} chars)` };
-  }
-  if (!APP_NAME_RULES.pattern.test(name)) {
-    return {
-      valid: false,
-      reason: `App name "${name}" is invalid. Use lowercase letters, digits, and single hyphens only (must start + end with alphanumeric). Examples: my-app, search-v2, unison-search.`
-    };
-  }
-  return { valid: true, name };
-}
-function resolveAppName(raw) {
-  const strict = validateAppName(raw);
-  if (strict.valid) return { ok: true, name: strict.name };
-  if (typeof raw !== "string") return { ok: false, reason: strict.reason };
-  const trimmed = raw.trim();
-  if (!trimmed) return { ok: false, reason: "App name is required" };
-  const sanitized = sanitizeAppName(trimmed);
-  const sanitizedStrict = validateAppName(sanitized);
-  if (!sanitizedStrict.valid) {
-    return {
-      ok: false,
-      reason: `App name "${trimmed}" can't be sanitized into a valid name (${sanitizedStrict.reason}). Pick something matching: lowercase letters, digits, single hyphens, ${APP_NAME_RULES.minLength}-${APP_NAME_RULES.maxLength} chars.`
-    };
-  }
-  return {
-    ok: true,
-    name: sanitized,
-    warning: `App name "${trimmed}" doesn't conform to deploy rules \u2014 using "${sanitized}" instead. Update wrangler.toml's \`name\` to silence this warning.`
-  };
-}
-function sanitizeAppName(raw) {
-  return raw.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-{2,}/g, "-").replace(/^-+|-+$/g, "");
-}
-
 // src/cli/commands/deploy.ts
 var DEPLOY_URL = process.env.DEEPSPACE_DEPLOY_URL ?? ENVS.prod.deploy;
+var API_URL = process.env.DEEPSPACE_API_URL ?? ENVS.prod.api;
+var RESERVED_RUN_WORKER_FIRST = /* @__PURE__ */ new Set([
+  "/api/*",
+  "/ws/*",
+  "/internal/*",
+  "/v1/*",
+  "/_deepspace/*"
+]);
+function extractRunWorkerFirst(cfg) {
+  const raw = cfg.assets?.run_worker_first;
+  if (!Array.isArray(raw)) return [];
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const entry of raw) {
+    if (typeof entry !== "string") continue;
+    const trimmed = entry.trim();
+    if (!trimmed.startsWith("/")) continue;
+    if (RESERVED_RUN_WORKER_FIRST.has(trimmed)) continue;
+    if (seen.has(trimmed)) continue;
+    seen.add(trimmed);
+    out.push(trimmed);
+  }
+  return out;
+}
 var deploy_default = defineCommand8({
   meta: {
     name: "deploy",
@@ -1446,10 +1554,10 @@ var deploy_default = defineCommand8({
     }
   },
   async run({ args }) {
-    const appDir = resolve4(args.dir ?? ".");
+    const appDir = resolve5(args.dir ?? ".");
     p4.intro("Deploying DeepSpace app");
     const wranglerPath = join8(appDir, "wrangler.toml");
-    if (!existsSync7(wranglerPath)) {
+    if (!existsSync8(wranglerPath)) {
       p4.cancel("No wrangler.toml found. Are you in a DeepSpace app directory?");
       process.exit(1);
     }
@@ -1459,7 +1567,12 @@ var deploy_default = defineCommand8({
       p4.cancel(`wrangler.toml: ${nameRes.reason}`);
       process.exit(1);
     }
-    if (nameRes.warning) p4.log.warn(nameRes.warning);
+    if (wranglerConfig.name !== nameRes.name) {
+      p4.cancel(
+        `wrangler.toml: name "${wranglerConfig.name}" is not in canonical form. Update \`name\` to "${nameRes.name}" and re-run.`
+      );
+      process.exit(1);
+    }
     const appName = nameRes.name;
     p4.log.info(`App: ${appName}`);
     let token2;
@@ -1480,25 +1593,25 @@ var deploy_default = defineCommand8({
     }
     s.stop("Built");
     const deployConfigPath = join8(appDir, ".wrangler", "deploy", "config.json");
-    if (!existsSync7(deployConfigPath)) {
+    if (!existsSync8(deployConfigPath)) {
       p4.cancel("Build output config not found at .wrangler/deploy/config.json");
       process.exit(1);
     }
     const deployConfig = JSON.parse(readFileSync5(deployConfigPath, "utf-8"));
-    const outputWranglerPath = resolve4(dirname(deployConfigPath), deployConfig.configPath);
-    if (!existsSync7(outputWranglerPath)) {
+    const outputWranglerPath = resolve5(dirname(deployConfigPath), deployConfig.configPath);
+    if (!existsSync8(outputWranglerPath)) {
       p4.cancel(`Output wrangler.json not found at ${outputWranglerPath}`);
       process.exit(1);
     }
     const outputConfig = JSON.parse(readFileSync5(outputWranglerPath, "utf-8"));
     const workerDir = dirname(outputWranglerPath);
     const workerBundlePath = join8(workerDir, outputConfig.main);
-    const clientDir = outputConfig.assets?.directory ? resolve4(workerDir, outputConfig.assets.directory) : null;
-    if (!existsSync7(workerBundlePath)) {
+    const clientDir = outputConfig.assets?.directory ? resolve5(workerDir, outputConfig.assets.directory) : null;
+    if (!existsSync8(workerBundlePath)) {
       p4.cancel(`Worker bundle not found at ${workerBundlePath}`);
       process.exit(1);
     }
-    if (!clientDir || !existsSync7(clientDir)) {
+    if (!clientDir || !existsSync8(clientDir)) {
       p4.cancel(`Client assets not found at ${clientDir}`);
       process.exit(1);
     }
@@ -1534,7 +1647,7 @@ var deploy_default = defineCommand8({
     }
     const devVarsPath = join8(appDir, ".dev.vars");
     let userSecrets = {};
-    if (existsSync7(devVarsPath)) {
+    if (existsSync8(devVarsPath)) {
       const customSection = extractCustomDevVars(readFileSync5(devVarsPath, "utf-8"));
       if (customSection) {
         try {
@@ -1580,6 +1693,11 @@ var deploy_default = defineCommand8({
     if (userSecretNames.length) {
       form.append("userSecrets", JSON.stringify(userSecrets));
     }
+    const extraRoutes = extractRunWorkerFirst(wranglerConfig);
+    if (extraRoutes.length) {
+      form.append("extraRunWorkerFirst", JSON.stringify(extraRoutes));
+      p4.log.info(`Custom worker-first routes: ${extraRoutes.join(", ")}`);
+    }
     const res = await fetch(`${DEPLOY_URL}/api/deploy/${appName}`, {
       method: "POST",
       headers: { Authorization: `Bearer ${token2}` },
@@ -1598,15 +1716,228 @@ var deploy_default = defineCommand8({
         s.stop("Deployed (edge propagation still in progress after 90s)");
         p4.log.warn("First requests may briefly hit the assets transitional page; retry in a minute.");
         p4.log.success(`Live at: ${body.url}`);
+        await syncSubscriptionPlans(appDir, appName, token2);
+        await syncOneTimeProducts(appDir, appName, token2);
         p4.outro("Done");
         return;
       }
     }
     s.stop("Deployed!");
     p4.log.success(`Live at: ${body.url}`);
+    await syncSubscriptionPlans(appDir, appName, token2);
+    await syncOneTimeProducts(appDir, appName, token2);
     p4.outro("Done");
   }
 });
+async function syncSubscriptionPlans(appDir, appName, token2) {
+  const subsPath = join8(appDir, "src", "subscriptions.ts");
+  if (!existsSync8(subsPath)) return;
+  const s = createSpinner();
+  s.start("Syncing subscription plans...");
+  let plans;
+  try {
+    const esbuild = await import("esbuild");
+    const outDir = join8(appDir, ".wrangler", "deploy");
+    const outFile = join8(outDir, "subscriptions.bundle.mjs");
+    await esbuild.build({
+      entryPoints: [subsPath],
+      bundle: true,
+      format: "esm",
+      platform: "node",
+      target: "node18",
+      outfile: outFile,
+      logLevel: "silent",
+      write: true
+    });
+    const mod = await import(`${pathToFileURL(outFile).href}?t=${Date.now()}`);
+    plans = mod.subscriptionPlans;
+  } catch (err) {
+    s.stop("Plan sync skipped");
+    p4.log.warn(`Could not load src/subscriptions.ts: ${err.message}`);
+    return;
+  }
+  if (!Array.isArray(plans)) {
+    s.stop("Plan sync skipped");
+    p4.log.warn(
+      "src/subscriptions.ts must `export const subscriptionPlans = [...] as const`"
+    );
+    return;
+  }
+  let res;
+  try {
+    res = await fetch(`${API_URL}/api/subscriptions/sync`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${token2}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({ appName, plans })
+    });
+  } catch (err) {
+    s.stop("Plan sync skipped");
+    p4.log.warn(`Plan sync request failed (network): ${err.message ?? err}`);
+    return;
+  }
+  const body = await res.json().catch(() => ({}));
+  if (res.ok && body.ok) {
+    s.stop(`Synced ${plans.length} plan${plans.length === 1 ? "" : "s"} to Stripe`);
+    if (body.connectMissing) {
+      p4.log.warn(
+        "Stripe Connect not yet set up. Customers can subscribe and earnings will queue in your platform balance until you finish onboarding at /earnings on the dashboard. The first payout after you connect will sweep everything that accumulated in the meantime."
+      );
+    }
+    const changes = (body.planChanges ?? []).filter((c) => c.affectedSubscribers > 0);
+    if (changes.length > 0) {
+      await promptAndCancelChangedPlans(appName, token2, changes);
+    }
+    return;
+  }
+  s.stop("Plan sync skipped");
+  p4.log.warn(
+    `Plan sync failed: ${body.error ?? `HTTP ${res.status}`}${body.hint ? ` \u2014 ${body.hint}` : ""}`
+  );
+}
+function formatCents(c) {
+  return c === 0 ? "free" : `$${(c / 100).toFixed(2)}`;
+}
+function summaryLine(c) {
+  const n = c.affectedSubscribers;
+  const suffix = `${n} subscriber${n === 1 ? "" : "s"}`;
+  if (c.reason === "removed") {
+    return `  \u2022 ${c.slug} \u2014 removed (${suffix} still on it)`;
+  }
+  const diffs = (c.intervals ?? []).map((i) => `${i.interval}: ${formatCents(i.oldCents)} \u2192 ${formatCents(i.newCents)}`).join("; ");
+  return `  \u2022 ${c.slug} \u2014 repriced (${diffs}; ${suffix} grandfathered on old price)`;
+}
+async function promptAndCancelChangedPlans(appName, token2, changes) {
+  const summary = changes.map(summaryLine).join("\n");
+  p4.log.warn(
+    `Plan change${changes.length === 1 ? "" : "s"} from this deploy left subscribers stranded:
+${summary}
+
+Stripe will keep charging them until you cancel. Cancel at the end of their
+current billing period? (Skip to leave them grandfathered.)`
+  );
+  const choice = await p4.confirm({
+    message: `Cancel ${changes.length === 1 ? "these subscribers" : "all of them"} at period end?`,
+    initialValue: false
+  });
+  if (p4.isCancel(choice) || !choice) {
+    p4.log.info("Skipped \u2014 existing subscribers stay on their current plan/price.");
+    return;
+  }
+  const MAX_ITERATIONS = 100;
+  for (const c of changes) {
+    const s = createSpinner();
+    s.start(`Canceling ${c.affectedSubscribers} subscriber${c.affectedSubscribers === 1 ? "" : "s"} on ${c.slug}...`);
+    let totalCanceled = 0;
+    let totalFailed = 0;
+    let iteration = 0;
+    let lastError = null;
+    let stopped = false;
+    try {
+      while (iteration < MAX_ITERATIONS) {
+        const res = await fetch(`${API_URL}/api/subscriptions/admin-cancel`, {
+          method: "POST",
+          headers: {
+            Authorization: `Bearer ${token2}`,
+            "Content-Type": "application/json"
+          },
+          body: JSON.stringify({
+            appName,
+            planSlug: c.slug,
+            atPeriodEnd: true,
+            reason: `plan ${c.reason} via deploy`
+          })
+        });
+        const body = await res.json().catch(() => ({}));
+        if (!res.ok || !body.success) {
+          lastError = body.error ?? `HTTP ${res.status}`;
+          s.stop(`Cancel failed for ${c.slug}: ${lastError}`);
+          stopped = true;
+          break;
+        }
+        const batchCanceled = body.canceled ?? 0;
+        totalCanceled += batchCanceled;
+        totalFailed += body.failures?.length ?? 0;
+        if (!body.hasMore) break;
+        if (batchCanceled === 0) {
+          lastError = "no progress (all rows failed this batch)";
+          break;
+        }
+        iteration++;
+      }
+      if (!stopped) {
+        const tail = totalFailed > 0 ? `; ${totalFailed} failed (see Stripe)` : "";
+        const cap = iteration >= MAX_ITERATIONS ? ` (batch cap reached \u2014 re-run deploy to finish remaining)` : "";
+        const errSuffix = lastError ? ` \u2014 ${lastError}` : "";
+        s.stop(`Canceled ${totalCanceled} on ${c.slug}${tail}${cap}${errSuffix}`);
+      }
+    } catch (err) {
+      s.stop(`Cancel failed for ${c.slug}: ${err.message}`);
+    }
+  }
+}
+async function syncOneTimeProducts(appDir, appName, token2) {
+  const productsPath = join8(appDir, "src", "products.ts");
+  if (!existsSync8(productsPath)) return;
+  const s = createSpinner();
+  s.start("Syncing one-time products...");
+  let products;
+  try {
+    const esbuild = await import("esbuild");
+    const outDir = join8(appDir, ".wrangler", "deploy");
+    const outFile = join8(outDir, "products.bundle.mjs");
+    await esbuild.build({
+      entryPoints: [productsPath],
+      bundle: true,
+      format: "esm",
+      platform: "node",
+      target: "node18",
+      outfile: outFile,
+      logLevel: "silent",
+      write: true
+    });
+    const mod = await import(`${pathToFileURL(outFile).href}?t=${Date.now()}`);
+    products = mod.oneTimeProducts;
+  } catch (err) {
+    s.stop("Product sync skipped");
+    p4.log.warn(`Could not load src/products.ts: ${err.message}`);
+    return;
+  }
+  if (!Array.isArray(products)) {
+    s.stop("Product sync skipped");
+    p4.log.warn(
+      "src/products.ts must `export const oneTimeProducts = [...] as const`"
+    );
+    return;
+  }
+  let res;
+  try {
+    res = await fetch(`${API_URL}/api/charges/products/sync`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${token2}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({ appName, products })
+    });
+  } catch (err) {
+    s.stop("Product sync skipped");
+    p4.log.warn(`Product sync request failed (network): ${err.message ?? err}`);
+    return;
+  }
+  const body = await res.json().catch(() => ({}));
+  if (res.ok && body.ok) {
+    const n = body.count ?? products.length;
+    s.stop(`Synced ${n} one-time product${n === 1 ? "" : "s"}`);
+    return;
+  }
+  s.stop("Product sync skipped");
+  p4.log.warn(
+    `Product sync failed: ${body.error ?? `HTTP ${res.status}`}${body.details ? ` \u2014 ${JSON.stringify(body.details)}` : ""}`
+  );
+}
 async function waitForAssetsReady(url, timeoutMs) {
   const deadline = Date.now() + timeoutMs;
   let attempt = 0;
@@ -1648,7 +1979,7 @@ function collectAssets(dir) {
 
 // src/cli/commands/undeploy.ts
 import { defineCommand as defineCommand9 } from "citty";
-import { readFileSync as readFileSync6, existsSync as existsSync8 } from "fs";
+import { readFileSync as readFileSync6, existsSync as existsSync9 } from "fs";
 import { join as join9 } from "path";
 import { parse as parseToml3 } from "smol-toml";
 import * as p5 from "@clack/prompts";
@@ -1669,7 +2000,7 @@ var undeploy_default = defineCommand9({
     let appName = args.name;
     if (!appName) {
       const wranglerPath = join9(process.cwd(), "wrangler.toml");
-      if (existsSync8(wranglerPath)) {
+      if (existsSync9(wranglerPath)) {
         const config = parseToml3(readFileSync6(wranglerPath, "utf-8"));
         if (config.name) appName = config.name;
       }
@@ -1727,7 +2058,7 @@ var whoami_default = defineCommand10({
     }
     let payload;
     try {
-      payload = JSON.parse(atob(jwt.split(".")[1]));
+      payload = decodeJwtPayload(jwt);
     } catch {
       console.error("Malformed session token. Run `deepspace login` again.");
       process.exit(1);
@@ -1750,6 +2081,7 @@ var whoami_default = defineCommand10({
     console.log(`UserID:     ${payload.sub ?? "(none)"}`);
     console.log(`Type:       ${accountType}`);
     if (payload.iss) console.log(`Issuer:     ${payload.iss}`);
+    console.log(`Dashboard:  ${DASHBOARD_URL}`);
     if (isTestAccount) {
       console.log("");
       console.log("Note: this is a test account, not a real OAuth developer.");
@@ -1760,12 +2092,12 @@ var whoami_default = defineCommand10({
 
 // src/cli/commands/add.ts
 import { defineCommand as defineCommand11 } from "citty";
-import { existsSync as existsSync9 } from "fs";
-import { resolve as resolve5, join as join10 } from "path";
+import { existsSync as existsSync10 } from "fs";
+import { resolve as resolve6, join as join10 } from "path";
 import { execSync as execSync3 } from "child_process";
 function findScript(from) {
   const candidate = join10(from, ".deepspace", "scripts", "add-feature.cjs");
-  if (existsSync9(candidate)) return candidate;
+  if (existsSync10(candidate)) return candidate;
   return null;
 }
 var add_default = defineCommand11({
@@ -1797,7 +2129,7 @@ var add_default = defineCommand11({
     }
   },
   run({ args }) {
-    const appDir = resolve5(args.dir ?? ".");
+    const appDir = resolve6(args.dir ?? ".");
     const script = findScript(appDir);
     if (!script) {
       console.error("No .deepspace/scripts/add-feature.cjs found.");
@@ -1826,12 +2158,12 @@ import { defineCommand as defineCommand12 } from "citty";
 import { execSync as execSync4 } from "child_process";
 
 // src/cli/lib/app-context.ts
-import { existsSync as existsSync10, readFileSync as readFileSync7 } from "fs";
-import { join as join11, resolve as resolve6 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync7 } from "fs";
+import { join as join11, resolve as resolve7 } from "path";
 import { parse as parseToml4 } from "smol-toml";
 function detectAppName(cwd = process.cwd()) {
-  const wranglerPath = join11(resolve6(cwd), "wrangler.toml");
-  if (!existsSync10(wranglerPath)) return null;
+  const wranglerPath = join11(resolve7(cwd), "wrangler.toml");
+  if (!existsSync11(wranglerPath)) return null;
   try {
     const cfg = parseToml4(readFileSync7(wranglerPath, "utf-8"));
     return typeof cfg.name === "string" && cfg.name.length > 0 ? cfg.name : null;
@@ -1849,9 +2181,9 @@ function requireAppName(explicit, cwd) {
 }
 
 // src/cli/commands/domain.ts
-var API_URL = process.env.DEEPSPACE_API_URL ?? ENVS.prod.api;
+var API_URL2 = process.env.DEEPSPACE_API_URL ?? ENVS.prod.api;
 async function api(token2, path, init) {
-  const res = await fetch(`${API_URL}${path}`, {
+  const res = await fetch(`${API_URL2}${path}`, {
     ...init,
     headers: {
       Authorization: `Bearer ${token2}`,
@@ -1890,16 +2222,16 @@ function fmtDate(iso) {
   if (!iso) return "\u2014";
   return iso.slice(0, 10);
 }
-async function confirm2(message) {
+async function confirm3(message) {
   if (!process.stdin.isTTY) {
     throw new Error(`${message} \u2014 pass --yes to confirm non-interactively`);
   }
   process.stdout.write(`${message} [y/N] `);
-  return new Promise((resolve7) => {
+  return new Promise((resolve9) => {
     process.stdin.setEncoding("utf-8");
     process.stdin.once("data", (data) => {
       const answer = data.toString().trim().toLowerCase();
-      resolve7(answer === "y" || answer === "yes");
+      resolve9(answer === "y" || answer === "yes");
     });
   });
 }
@@ -1958,7 +2290,7 @@ var buy = defineCommand12({
     const price = fmtCents(result.chargedCents);
     const expectedTime = result.registrar === "cloudflare" ? "~60-90 seconds" : "15-60 minutes (registry NS propagation)";
     if (!args.yes) {
-      const ok = await confirm2(
+      const ok = await confirm3(
         `Buy ${args.domain} for ${price}/yr (auto-renews; non-refundable), attach to ${appName}? Provisioning takes ${expectedTime}.`
       );
       if (!ok) {
@@ -2123,7 +2455,7 @@ var detach = defineCommand12({
       process.exit(1);
     }
     if (!args.yes) {
-      const ok = await confirm2(
+      const ok = await confirm3(
         `Detach ${args.domain}? Routing will stop; the domain stays registered (auto-renew is unchanged).`
       );
       if (!ok) {
@@ -2179,7 +2511,7 @@ import { defineCommand as defineCommand13 } from "citty";
 
 // src/cli/commands/_invoke-impl.ts
 import { readFileSync as readFileSync8 } from "fs";
-var API_URL2 = process.env.DEEPSPACE_API_URL ?? ENVS.prod.api;
+var API_URL3 = process.env.DEEPSPACE_API_URL ?? ENVS.prod.api;
 var DEFAULT_TIMEOUT_MS = 12e4;
 function parseTarget(target) {
   if (!target || typeof target !== "string") {
@@ -2217,7 +2549,7 @@ function flushAndExit(code) {
   });
 }
 async function fetchCatalog() {
-  const res = await fetch(`${API_URL2}/api/integrations`);
+  const res = await fetch(`${API_URL3}/api/integrations`);
   if (!res.ok) {
     throw new Error(`Failed to fetch integration catalog (${res.status})`);
   }
@@ -2298,7 +2630,7 @@ async function runInvoke(args) {
   const startedAt = Date.now();
   let res;
   try {
-    res = await fetch(`${API_URL2}/api/integrations/${integration}/${endpoint}`, {
+    res = await fetch(`${API_URL3}/api/integrations/${integration}/${endpoint}`, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
@@ -2537,11 +2869,11 @@ var invoke_default = defineCommand14({
 
 // src/cli/commands/managed-repos.ts
 import { defineCommand as defineCommand15 } from "citty";
-var API_URL3 = process.env.DEEPSPACE_API_URL ?? ENVS.prod.api;
+var API_URL4 = process.env.DEEPSPACE_API_URL ?? ENVS.prod.api;
 var SIMPLE_APP_ID = /^[a-z0-9][a-z0-9_.:-]{0,119}$/i;
 var SIMPLE_APP_NAME = /^[a-z0-9][a-z0-9_-]{0,119}$/i;
 async function api2(token2, path, init) {
-  const res = await fetch(`${API_URL3}${path}`, {
+  const res = await fetch(`${API_URL4}${path}`, {
     ...init,
     headers: {
       Authorization: `Bearer ${token2}`,
@@ -2582,16 +2914,16 @@ function printRepo(repo) {
   console.log(`  URL:      ${repo.htmlUrl}`);
   console.log(`  Clone:    ${repo.cloneUrl}`);
 }
-async function confirm3(message) {
+async function confirm4(message) {
   if (!process.stdin.isTTY) {
     throw new Error(`${message} \u2014 pass --yes to confirm non-interactively`);
   }
   process.stdout.write(`${message} [y/N] `);
-  return new Promise((resolve7) => {
+  return new Promise((resolve9) => {
     process.stdin.setEncoding("utf-8");
     process.stdin.once("data", (data) => {
       const answer = data.toString().trim().toLowerCase();
-      resolve7(answer === "y" || answer === "yes");
+      resolve9(answer === "y" || answer === "yes");
     });
   });
 }
@@ -2737,7 +3069,7 @@ var remove = defineCommand15({
   async run({ args }) {
     if (!args.yes) {
       try {
-        const ok = await confirm3(
+        const ok = await confirm4(
           "Delete this DeepSpace-managed GitHub repo? This removes the GitHub repository and counts against your daily delete quota."
         );
         if (!ok) {
@@ -2778,13 +3110,229 @@ var managed_repos_default = defineCommand15({
   }
 });
 
+// src/cli/commands/library.ts
+import { defineCommand as defineCommand16 } from "citty";
+import { existsSync as existsSync12, readFileSync as readFileSync9 } from "fs";
+import { join as join12, resolve as resolve8 } from "path";
+import { parse as parseToml5 } from "smol-toml";
+import * as p6 from "@clack/prompts";
+var DEFAULT_LIBRARY_APP = "deepdotspace-site";
+var publish = defineCommand16({
+  meta: {
+    name: "publish",
+    description: "Publish the current app to the DeepSpace library"
+  },
+  args: {
+    dir: {
+      type: "string",
+      description: "App directory (default: current directory)",
+      required: false
+    },
+    app: {
+      type: "string",
+      description: "App name (default: read from wrangler.toml)",
+      required: false
+    },
+    name: {
+      type: "string",
+      description: "Display name (default: app name)",
+      required: false
+    },
+    description: {
+      type: "string",
+      description: "Short description",
+      required: false
+    },
+    category: {
+      type: "string",
+      description: "Category (e.g. Productivity, Finance, AI). Default: General",
+      required: false
+    },
+    tags: {
+      type: "string",
+      description: "Comma-separated tags",
+      required: false
+    },
+    visibility: {
+      type: "string",
+      description: "'public' (default), 'unlisted', or 'private'",
+      required: false
+    },
+    screenshot: {
+      type: "string",
+      description: "Override the auto-captured preview with a public PNG URL",
+      required: false
+    },
+    "library-app": {
+      type: "string",
+      description: `Target library app subdomain (default: ${DEFAULT_LIBRARY_APP})`,
+      required: false
+    },
+    json: {
+      type: "boolean",
+      description: "Print only the JSON response (machine-readable)",
+      default: false
+    }
+  },
+  async run({ args }) {
+    const json = !!args.json;
+    const intro5 = (s) => {
+      if (!json) p6.intro(s);
+    };
+    const info2 = (s) => {
+      if (!json) p6.log.info(s);
+    };
+    const die = (msg) => {
+      if (json) console.error(JSON.stringify({ ok: false, error: msg }));
+      else p6.cancel(msg);
+      process.exit(1);
+    };
+    intro5("Publishing to the DeepSpace library");
+    let appName = typeof args.app === "string" && args.app.trim() ? args.app.trim() : void 0;
+    if (!appName) {
+      const appDir = resolve8(typeof args.dir === "string" && args.dir ? args.dir : ".");
+      const wranglerPath = join12(appDir, "wrangler.toml");
+      if (!existsSync12(wranglerPath)) {
+        return die("No --app provided and no wrangler.toml found. Either pass --app <name> or run from your app's directory.");
+      }
+      const cfg = parseToml5(readFileSync9(wranglerPath, "utf-8"));
+      const nameRes = resolveAppName(cfg.name);
+      if (!nameRes.ok) return die(`wrangler.toml: ${nameRes.reason}`);
+      appName = nameRes.name;
+    }
+    info2(`App: ${appName}`);
+    const visibility = args.visibility ?? "public";
+    if (!["public", "private", "unlisted"].includes(visibility)) {
+      return die("--visibility must be 'public', 'unlisted', or 'private'.");
+    }
+    const tags = typeof args.tags === "string" && args.tags ? args.tags.split(",").map((t) => t.trim()).filter(Boolean) : void 0;
+    const libraryApp = typeof args["library-app"] === "string" && args["library-app"] ? args["library-app"] : DEFAULT_LIBRARY_APP;
+    const libraryHost = process.env.DEEPSPACE_LIBRARY_HOST ?? `https://${libraryApp}.app.space`;
+    let token2;
+    try {
+      token2 = await ensureToken();
+    } catch (err) {
+      return die(err instanceof Error ? err.message : String(err));
+    }
+    const payload = {
+      appName,
+      ...args.name ? { name: args.name } : {},
+      ...args.description ? { description: args.description } : {},
+      ...args.category ? { category: args.category } : {},
+      ...tags ? { tags } : {},
+      visibility,
+      ...args.screenshot ? { screenshotUrl: args.screenshot } : {}
+    };
+    const url = `${libraryHost}/api/actions/library.publish`;
+    let res;
+    try {
+      res = await fetch(url, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Bearer ${token2}`
+        },
+        body: JSON.stringify(payload)
+      });
+    } catch (err) {
+      return die(`Network error reaching ${url}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const body = await res.text();
+    let parsed;
+    try {
+      parsed = JSON.parse(body);
+    } catch {
+      return die(`Server returned non-JSON (${res.status}): ${body.slice(0, 400)}`);
+    }
+    if (json) {
+      console.log(JSON.stringify(parsed));
+      process.exit(parsed.success ? 0 : 1);
+    }
+    if (!parsed.success) {
+      return die(parsed.error ?? `Publish failed (HTTP ${res.status}).`);
+    }
+    p6.log.success(`Published ${appName} as ${parsed.data?.templateHandle} (v${parsed.data?.version})`);
+    if (parsed.data?.url) p6.log.message(parsed.data.url);
+    p6.outro("Done");
+  }
+});
+var unpublish = defineCommand16({
+  meta: {
+    name: "unpublish",
+    description: "Remove a library entry (owner or admin only)"
+  },
+  args: {
+    handle: {
+      type: "positional",
+      description: "templateHandle to remove (usually your app name)",
+      required: true
+    },
+    "library-app": {
+      type: "string",
+      description: `Target library app subdomain (default: ${DEFAULT_LIBRARY_APP})`,
+      required: false
+    },
+    json: {
+      type: "boolean",
+      description: "Print only the JSON response",
+      default: false
+    }
+  },
+  async run({ args }) {
+    const json = !!args.json;
+    const die = (msg) => {
+      if (json) console.error(JSON.stringify({ ok: false, error: msg }));
+      else p6.cancel(msg);
+      process.exit(1);
+    };
+    if (!json) p6.intro("Unpublishing library entry");
+    let token2;
+    try {
+      token2 = await ensureToken();
+    } catch (err) {
+      return die(err instanceof Error ? err.message : String(err));
+    }
+    const libraryApp = typeof args["library-app"] === "string" && args["library-app"] ? args["library-app"] : DEFAULT_LIBRARY_APP;
+    const libraryHost = process.env.DEEPSPACE_LIBRARY_HOST ?? `https://${libraryApp}.app.space`;
+    const res = await fetch(`${libraryHost}/api/actions/library.unpublish`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Authorization: `Bearer ${token2}` },
+      body: JSON.stringify({ templateHandle: String(args.handle) })
+    });
+    const body = await res.text();
+    let parsed;
+    try {
+      parsed = JSON.parse(body);
+    } catch {
+      return die(`Server returned non-JSON (${res.status}): ${body.slice(0, 400)}`);
+    }
+    if (json) {
+      console.log(JSON.stringify(parsed));
+      process.exit(parsed.success ? 0 : 1);
+    }
+    if (!parsed.success) return die(parsed.error ?? `HTTP ${res.status}`);
+    p6.log.success(`Unpublished ${parsed.data?.templateHandle}`);
+    p6.outro("Done");
+  }
+});
+var library_default = defineCommand16({
+  meta: {
+    name: "library",
+    description: "Manage your DeepSpace library entries"
+  },
+  subCommands: {
+    publish,
+    unpublish
+  }
+});
+
 // src/cli/cli.ts
 var __dirname = dirname2(fileURLToPath(import.meta.url));
-var pkg = JSON.parse(readFileSync9(join12(__dirname, "..", "package.json"), "utf-8"));
-if (process.platform === "linux" && !process.env.SSL_CERT_FILE && existsSync11("/etc/ssl/certs/ca-certificates.crt")) {
+var pkg = JSON.parse(readFileSync10(join13(__dirname, "..", "package.json"), "utf-8"));
+if (process.platform === "linux" && !process.env.SSL_CERT_FILE && existsSync13("/etc/ssl/certs/ca-certificates.crt")) {
   process.env.SSL_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt";
 }
-var create3 = defineCommand16({
+var create3 = defineCommand17({
   meta: {
     name: "create",
     description: "Create a new DeepSpace app"
@@ -2803,7 +3351,7 @@ var create3 = defineCommand16({
     execSync5(`npm create deepspace@latest${name}`, { stdio: "inherit" });
   }
 });
-var main = defineCommand16({
+var main = defineCommand17({
   meta: {
     name: "deepspace",
     version: pkg.version,
@@ -2825,7 +3373,8 @@ var main = defineCommand16({
     invoke: invoke_default,
     deploy: deploy_default,
     undeploy: undeploy_default,
-    domain: domain_default
+    domain: domain_default,
+    library: library_default
   }
   // No `run()` here — citty cascades parent run() AFTER subcommand finishes,
   // which corrupts agent-friendly output (`--json`) and prints noise on every