sayren 0.4.0 → 0.6.0

package/dist/index.mjs

@@ -2,11 +2,13 @@
 import { spawn, spawnSync } from "node:child_process";
 import { stdin, stdout } from "node:process";
 import { createInterface } from "node:readline/promises";
-import { ApiError, ApprovalPendingError, STOREFRONT_BUILD_TERMINAL_STATUSES, STOREFRONT_SOURCE_BLOB_BATCH_MAX, createStoreClient, normalizeStorefrontPath } from "@sayren/store-sdk";
+import { APP_DEPLOY_KEY_PATTERN, APP_README_MAX_BYTES, APP_SECRET_PATTERNS, APP_SERVER_BUNDLE_MAX_GZIP_BYTES, APP_UI_MAX_BYTES, APP_UI_MAX_FILES, ApiError, ApprovalPendingError, STOREFRONT_BUILD_TERMINAL_STATUSES, STOREFRONT_SOURCE_BLOB_BATCH_MAX, appIconProblem, appManifestProblems, appManifestSchema, createStoreClient, normalizeStorefrontPath } from "@sayren/store-sdk";
 import { chmodSync, closeSync, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
-import { dirname, join, relative, resolve, sep } from "node:path";
-import { createHash, randomBytes } from "node:crypto";
 import { createServer } from "node:http";
+import { dirname, extname, join, relative, resolve, sep } from "node:path";
+import { pathToFileURL } from "node:url";
+import { gzipSync } from "node:zlib";
+import { createHash, randomBytes } from "node:crypto";
 
 //#region ../i18n/src/paraglide/runtime.js
 /** @type {any} */
@@ -592,185 +594,1063 @@ function defineCustomClientStrategy(strategy$1, handler) {
 * }} MessageMarkupTag
 */
 /**
-* Type-level schema for all markup tags in a message.
-*
-* @typedef {Record<string, MessageMarkupTag>} MessageMarkupSchema
+* Type-level schema for all markup tags in a message.
+*
+* @typedef {Record<string, MessageMarkupTag>} MessageMarkupSchema
+*/
+/**
+* Type-only metadata attached to compiled message functions.
+*
+* @template Inputs
+* @template Options
+* @template {MessageMarkupSchema} [Markup = MessageMarkupSchema]
+* @typedef {{
+*   readonly __paraglide?: {
+*     inputs: Inputs;
+*     options: Options;
+*     markup: Markup;
+*   };
+* }} MessageMetadata
+*/
+/**
+* A compiled, framework-neutral message part.
+*
+* @typedef {{
+*   type: "text";
+*   value: string;
+* } | {
+*   type: "markup-start";
+*   name: string;
+*   options: MessageMarkupOptions;
+*   attributes: MessageMarkupAttributes;
+* } | {
+*   type: "markup-end";
+*   name: string;
+*   options: MessageMarkupOptions;
+*   attributes: MessageMarkupAttributes;
+* } | {
+*   type: "markup-standalone";
+*   name: string;
+*   options: MessageMarkupOptions;
+*   attributes: MessageMarkupAttributes;
+* }} MessagePart
+*/
+/**
+* A message function is a message for a specific locale.
+*
+* @example
+*   m.hello({ name: 'world' })
+*
+* @typedef {(inputs?: Record<string, never>) => LocalizedString} MessageFunction
+*/
+/**
+* A message bundle function that selects the message to be returned.
+*
+* Uses `getLocale()` under the hood to determine the locale with an option.
+*
+* @template {string} T
+*
+* @example
+*   *   m.hello({ name: 'world' }, { locale: "en" })
+*
+* @typedef {(params: Record<string, never>, options: { locale: T }) => LocalizedString} MessageBundleFunction
+*/
+
+//#endregion
+//#region ../i18n/src/locale.ts
+/**
+* 로케일 판정(이슈 #73) — 1순위 쿼리 `?lang=`, 2순위 `Accept-Language`(브라우저는 `navigator.languages`), 마지막 `ko`.
+* 순서는 컴파일 옵션(`scripts/compile.mjs`의 strategy)이 정하고, 여기서는 Paraglide에 없는 쿼리 판정만 등록한다.
+* api는 같은 순서를 `@nestjs/i18n` 리졸버(Query → AcceptLanguage)로 맞춘다.
+*/
+const LOCALE_QUERY_PARAM = "lang";
+/** `?lang=ko-KR` → `ko`. 지원하지 않는 값·없으면 undefined(다음 판정으로 넘어간다) */
+function localeFromSearch(search) {
+	const value = new URLSearchParams(search).get(LOCALE_QUERY_PARAM);
+	if (!value) return void 0;
+	return toLocale(value) ?? toLocale(value.split("-")[0]);
+}
+defineCustomServerStrategy("custom-query", { getLocale: (request) => request ? localeFromSearch(new URL(request.url).search) : void 0 });
+/** 브라우저의 현재 주소 쿼리 — DOM 타입에 기대지 않는다(DOM lib 없는 소비자, 예: mcp-gateway도 이 소스를 타입 검사한다) */
+function currentSearch() {
+	return globalThis.location?.search;
+}
+defineCustomClientStrategy("custom-query", {
+	getLocale: () => {
+		const search = currentSearch();
+		return search === void 0 ? void 0 : localeFromSearch(search);
+	},
+	setLocale: () => {}
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_access_token_expired.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{}} Cli_Access_Token_ExpiredInputs */
+const ko_cli_access_token_expired = () => {
+	return `액세스 토큰이 만료됐습니다. 새 토큰을 만들거나 npx sayren login으로 다시 로그인하십시오`;
+};
+/**
+
+* @param {Cli_Access_Token_ExpiredInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const cli_access_token_expired = ((inputs = {}, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_access_token_expired(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_account_mcp_written.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{ file: NonNullable<unknown>, mcpFile: NonNullable<unknown> }} Cli_Account_Mcp_WrittenInputs */
+const ko_cli_account_mcp_written = (i) => {
+	return `${i?.file} 작성 — 원격 MCP 주소와 상점. ${i?.mcpFile}에는 토큰을 쓰지 않았습니다 — MCP 클라이언트가 연결할 때 Sayren 계정으로 로그인합니다`;
+};
+/**
+
+* @param {Cli_Account_Mcp_WrittenInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const cli_account_mcp_written = ((inputs, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_account_mcp_written(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_accounts_origin_unknown.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{ origin: NonNullable<unknown> }} Cli_Accounts_Origin_UnknownInputs */
+const ko_cli_accounts_origin_unknown = (i) => {
+	return `이 api 주소(${i?.origin})의 계정 서버를 모릅니다. --accounts-origin 또는 SAYREN_ACCOUNTS_ORIGIN으로 주십시오`;
+};
+/**
+
+* @param {Cli_Accounts_Origin_UnknownInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const cli_accounts_origin_unknown = ((inputs, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_accounts_origin_unknown(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_accounts_unreachable.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{}} Cli_Accounts_UnreachableInputs */
+const ko_cli_accounts_unreachable = () => {
+	return `계정 서버에 연결하지 못했습니다. 네트워크를 확인하십시오`;
+};
+/**
+
+* @param {Cli_Accounts_UnreachableInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const cli_accounts_unreachable = ((inputs = {}, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_accounts_unreachable(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_app_bridge_missing.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{}} Cli_App_Bridge_MissingInputs */
+const ko_cli_app_bridge_missing = () => {
+	return `앱 폴더에 @sayren/app이 설치돼 있지 않습니다(ui/_sayren/ui.js를 만들 수 없습니다). npm install을 먼저 하십시오`;
+};
+/**
+
+* @param {Cli_App_Bridge_MissingInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const cli_app_bridge_missing = ((inputs = {}, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_bridge_missing(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_app_build_failed.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{ stage: NonNullable<unknown>, code: NonNullable<unknown>, tail: NonNullable<unknown> }} Cli_App_Build_FailedInputs */
+const ko_cli_app_build_failed = (i) => {
+	return `빌드 실패: ${i?.stage} (${i?.code})
+${i?.tail}`;
+};
+/**
+
+* @param {Cli_App_Build_FailedInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const cli_app_build_failed = ((inputs, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_build_failed(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_app_bundle_failed.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{ tail: NonNullable<unknown> }} Cli_App_Bundle_FailedInputs */
+const ko_cli_app_bundle_failed = (i) => {
+	return `서버 번들을 만들지 못했습니다:
+${i?.tail}`;
+};
+/**
+
+* @param {Cli_App_Bundle_FailedInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const cli_app_bundle_failed = ((inputs, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_bundle_failed(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_app_bundle_too_large.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{ size: NonNullable<unknown> }} Cli_App_Bundle_Too_LargeInputs */
+const ko_cli_app_bundle_too_large = (i) => {
+	return `서버 번들이 ${i?.size}(gzip)입니다. 상한은 3MB입니다 (ARTIFACT_TOO_LARGE)`;
+};
+/**
+
+* @param {Cli_App_Bundle_Too_LargeInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const cli_app_bundle_too_large = ((inputs, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_bundle_too_large(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_app_default_export_missing.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{}} Cli_App_Default_Export_MissingInputs */
+const ko_cli_app_default_export_missing = () => {
+	return `src/server.ts가 defineApp(...)을 기본 내보내기(export default)해야 합니다`;
+};
+/**
+
+* @param {Cli_App_Default_Export_MissingInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const cli_app_default_export_missing = ((inputs = {}, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_default_export_missing(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_app_deploy_done.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{ number: NonNullable<unknown> }} Cli_App_Deploy_DoneInputs */
+const ko_cli_app_deploy_done = (i) => {
+	return `버전 ${i?.number}을 만들었습니다. 적용하려면: npx sayren app release ${i?.number}`;
+};
+/**
+
+* @param {Cli_App_Deploy_DoneInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const cli_app_deploy_done = ((inputs, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_deploy_done(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_app_dev_error.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{ message: NonNullable<unknown> }} Cli_App_Dev_ErrorInputs */
+const ko_cli_app_dev_error = (i) => {
+	return `로컬 실행 오류: ${i?.message}`;
+};
+/**
+
+* @param {Cli_App_Dev_ErrorInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const cli_app_dev_error = ((inputs, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_dev_error(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_app_dev_listening.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{ port: NonNullable<unknown>, store: NonNullable<unknown>, events: NonNullable<unknown> }} Cli_App_Dev_ListeningInputs */
+const ko_cli_app_dev_listening = (i) => {
+	return `앱 로컬 실행 중 http://localhost:${i?.port} — 상점 ${i?.store} · 이벤트 ${i?.events}
+  이벤트: npx sayren app trigger ORDER.PAID --order <orderId>
+  HTTP: http://localhost:${i?.port}/_http/<경로>
+  설정·비밀 값: .env의 SAYREN_APP_SETTING_*·SAYREN_APP_SECRET_*
+종료는 Ctrl-C`;
+};
+/**
+
+* @param {Cli_App_Dev_ListeningInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const cli_app_dev_listening = ((inputs, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_dev_listening(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_app_dev_store_created.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{ name: NonNullable<unknown>, storeId: NonNullable<unknown> }} Cli_App_Dev_Store_CreatedInputs */
+const ko_cli_app_dev_store_created = (i) => {
+	return `개발 상점을 만들었습니다: ${i?.name} (${i?.storeId})`;
+};
+/**
+
+* @param {Cli_App_Dev_Store_CreatedInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const cli_app_dev_store_created = ((inputs, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_dev_store_created(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_app_dev_store_empty.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{}} Cli_App_Dev_Store_EmptyInputs */
+const ko_cli_app_dev_store_empty = () => {
+	return `개발 상점이 없습니다. npx sayren app dev-store create <이름>`;
+};
+/**
+
+* @param {Cli_App_Dev_Store_EmptyInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const cli_app_dev_store_empty = ((inputs = {}, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_dev_store_empty(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_app_dev_store_name_required.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{}} Cli_App_Dev_Store_Name_RequiredInputs */
+const ko_cli_app_dev_store_name_required = () => {
+	return `개발 상점 이름이 필요합니다(2~50자)`;
+};
+/**
+
+* @param {Cli_App_Dev_Store_Name_RequiredInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const cli_app_dev_store_name_required = ((inputs = {}, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_dev_store_name_required(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_app_dir_exists.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{ dir: NonNullable<unknown> }} Cli_App_Dir_ExistsInputs */
+const ko_cli_app_dir_exists = (i) => {
+	return `${i?.dir}에 이미 sayren.app.json이 있습니다`;
+};
+/**
+
+* @param {Cli_App_Dir_ExistsInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const cli_app_dir_exists = ((inputs, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_dir_exists(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_app_entry_missing.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{ entry: NonNullable<unknown> }} Cli_App_Entry_MissingInputs */
+const ko_cli_app_entry_missing = (i) => {
+	return `서버 진입 파일(${i?.entry})이 없습니다`;
+};
+/**
+
+* @param {Cli_App_Entry_MissingInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const cli_app_entry_missing = ((inputs, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_entry_missing(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_app_handle_invalid.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{}} Cli_App_Handle_InvalidInputs */
+const ko_cli_app_handle_invalid = () => {
+	return `handle은 소문자·숫자·하이픈 3~40자입니다. 예: npx sayren app init order-mail`;
+};
+/**
+
+* @param {Cli_App_Handle_InvalidInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const cli_app_handle_invalid = ((inputs = {}, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_handle_invalid(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_app_handle_mismatch.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{ manifest: NonNullable<unknown>, registered: NonNullable<unknown> }} Cli_App_Handle_MismatchInputs */
+const ko_cli_app_handle_mismatch = (i) => {
+	return `매니페스트 handle(${i?.manifest})이 등록된 앱(${i?.registered})과 다릅니다`;
+};
+/**
+
+* @param {Cli_App_Handle_MismatchInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const cli_app_handle_mismatch = ((inputs, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_handle_mismatch(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_app_handler_missing.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{ events: NonNullable<unknown> }} Cli_App_Handler_MissingInputs */
+const ko_cli_app_handler_missing = (i) => {
+	return `매니페스트 events에 있지만 이벤트 함수가 없습니다: ${i?.events} (HANDLER_MISSING)`;
+};
+/**
+
+* @param {Cli_App_Handler_MissingInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const cli_app_handler_missing = ((inputs, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_handler_missing(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_app_handler_unlisted.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{ events: NonNullable<unknown> }} Cli_App_Handler_UnlistedInputs */
+const ko_cli_app_handler_unlisted = (i) => {
+	return `이벤트 함수는 있지만 매니페스트 events에 없어 호출되지 않습니다: ${i?.events}`;
+};
+/**
+
+* @param {Cli_App_Handler_UnlistedInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const cli_app_handler_unlisted = ((inputs, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_handler_unlisted(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_app_icon_invalid.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{ path: NonNullable<unknown>, problem: NonNullable<unknown> }} Cli_App_Icon_InvalidInputs */
+const ko_cli_app_icon_invalid = (i) => {
+	return `아이콘을 쓸 수 없습니다(${i?.path}): ${i?.problem}`;
+};
+/**
+
+* @param {Cli_App_Icon_InvalidInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const cli_app_icon_invalid = ((inputs, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_icon_invalid(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_app_icon_missing.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{ path: NonNullable<unknown> }} Cli_App_Icon_MissingInputs */
+const ko_cli_app_icon_missing = (i) => {
+	return `매니페스트 icon의 파일이 없습니다: ${i?.path}`;
+};
+/**
+
+* @param {Cli_App_Icon_MissingInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const cli_app_icon_missing = ((inputs, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_icon_missing(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_app_init_done.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{ dir: NonNullable<unknown>, handle: NonNullable<unknown>, appId: NonNullable<unknown> }} Cli_App_Init_DoneInputs */
+const ko_cli_app_init_done = (i) => {
+	return `앱을 만들었습니다: ${i?.dir} (${i?.handle}, ${i?.appId})
+
+  cd ${i?.dir}
+  npm install
+  npx sayren app dev --store <storeId>
+  npx sayren app deploy -m "첫 버전"`;
+};
+/**
+
+* @param {Cli_App_Init_DoneInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const cli_app_init_done = ((inputs, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_init_done(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_app_key_invalid.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{}} Cli_App_Key_InvalidInputs */
+const ko_cli_app_key_invalid = () => {
+	return `앱 배포 키 형식이 아닙니다(sak_…). developer.sayren.app에서 발행한 키를 쓰십시오`;
+};
+/**
+
+* @param {Cli_App_Key_InvalidInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const cli_app_key_invalid = ((inputs = {}, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_key_invalid(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_app_listing_none.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{}} Cli_App_Listing_NoneInputs */
+const ko_cli_app_listing_none = () => {
+	return `없음`;
+};
+/**
+
+* @param {Cli_App_Listing_NoneInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const cli_app_listing_none = ((inputs = {}, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_listing_none(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_app_logs_empty.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{}} Cli_App_Logs_EmptyInputs */
+const ko_cli_app_logs_empty = () => {
+	return `실행 기록이 없습니다`;
+};
+/**
+
+* @param {Cli_App_Logs_EmptyInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const cli_app_logs_empty = ((inputs = {}, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_logs_empty(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_app_manifest_invalid.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{ problems: NonNullable<unknown> }} Cli_App_Manifest_InvalidInputs */
+const ko_cli_app_manifest_invalid = (i) => {
+	return `매니페스트가 올바르지 않습니다:
+${i?.problems}`;
+};
+/**
+
+* @param {Cli_App_Manifest_InvalidInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const cli_app_manifest_invalid = ((inputs, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_manifest_invalid(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_app_manifest_missing.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{ file: NonNullable<unknown> }} Cli_App_Manifest_MissingInputs */
+const ko_cli_app_manifest_missing = (i) => {
+	return `${i?.file}이 없습니다. 앱 폴더에서 실행하거나 --dir을 주십시오`;
+};
+/**
+
+* @param {Cli_App_Manifest_MissingInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const cli_app_manifest_missing = ((inputs, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_manifest_missing(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_app_not_registered.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{ file: NonNullable<unknown> }} Cli_App_Not_RegisteredInputs */
+const ko_cli_app_not_registered = (i) => {
+	return `등록된 앱이 아닙니다(${i?.file}은 있지만 .sayren/app.json이 없습니다). npx sayren app init <handle>로 만든 폴더에서 실행하십시오`;
+};
+/**
+
+* @param {Cli_App_Not_RegisteredInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const cli_app_not_registered = ((inputs, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_not_registered(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_app_port_invalid.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{ value: NonNullable<unknown> }} Cli_App_Port_InvalidInputs */
+const ko_cli_app_port_invalid = (i) => {
+	return `--port가 올바르지 않습니다: ${i?.value}`;
+};
+/**
+
+* @param {Cli_App_Port_InvalidInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const cli_app_port_invalid = ((inputs, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_port_invalid(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_app_readme_missing.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{ path: NonNullable<unknown> }} Cli_App_Readme_MissingInputs */
+const ko_cli_app_readme_missing = (i) => {
+	return `매니페스트 readme의 파일이 없습니다: ${i?.path}`;
+};
+/**
+
+* @param {Cli_App_Readme_MissingInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const cli_app_readme_missing = ((inputs, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_readme_missing(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_app_readme_too_large.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{ limit: NonNullable<unknown>, path: NonNullable<unknown> }} Cli_App_Readme_Too_LargeInputs */
+const ko_cli_app_readme_too_large = (i) => {
+	return `README가 ${i?.limit}KB를 넘습니다: ${i?.path}`;
+};
+/**
+
+* @param {Cli_App_Readme_Too_LargeInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const cli_app_readme_too_large = ((inputs, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_readme_too_large(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_app_release_done.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{ number: NonNullable<unknown>, applied: NonNullable<unknown>, pending: NonNullable<unknown> }} Cli_App_Release_DoneInputs */
+const ko_cli_app_release_done = (i) => {
+	return `버전 ${i?.number}이 현재 버전입니다 — 곧바로 적용 ${i?.applied}, 재동의 대기 ${i?.pending}`;
+};
+/**
+
+* @param {Cli_App_Release_DoneInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const cli_app_release_done = ((inputs, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_release_done(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_app_secret_deleted.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{ name: NonNullable<unknown> }} Cli_App_Secret_DeletedInputs */
+const ko_cli_app_secret_deleted = (i) => {
+	return `비밀 값 ${i?.name}을 지웠습니다`;
+};
+/**
+
+* @param {Cli_App_Secret_DeletedInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const cli_app_secret_deleted = ((inputs, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_secret_deleted(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_app_secret_empty.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{}} Cli_App_Secret_EmptyInputs */
+const ko_cli_app_secret_empty = () => {
+	return `비밀 값이 없습니다`;
+};
+/**
+
+* @param {Cli_App_Secret_EmptyInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const cli_app_secret_empty = ((inputs = {}, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_secret_empty(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_app_secret_in_source.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{}} Cli_App_Secret_In_SourceInputs */
+const ko_cli_app_secret_in_source = () => {
+	return `번들에 액세스 토큰·PG 키·개인 키·앱 배포 키 모양의 값이 들어 있습니다. 비밀 값은 npx sayren app secret put <이름>으로 넣으십시오 (SECRET_IN_SOURCE)`;
+};
+/**
+
+* @param {Cli_App_Secret_In_SourceInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const cli_app_secret_in_source = ((inputs = {}, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_secret_in_source(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_app_secret_name_required.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{}} Cli_App_Secret_Name_RequiredInputs */
+const ko_cli_app_secret_name_required = () => {
+	return `비밀 값 이름이 필요합니다. 예: npx sayren app secret put RESEND_API_KEY`;
+};
+/**
+
+* @param {Cli_App_Secret_Name_RequiredInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const cli_app_secret_name_required = ((inputs = {}, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_secret_name_required(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_app_secret_saved.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{ name: NonNullable<unknown> }} Cli_App_Secret_SavedInputs */
+const ko_cli_app_secret_saved = (i) => {
+	return `비밀 값 ${i?.name}을 저장했습니다`;
+};
+/**
+
+* @param {Cli_App_Secret_SavedInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const cli_app_secret_saved = ((inputs, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_secret_saved(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_app_secret_value_required.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{ name: NonNullable<unknown> }} Cli_App_Secret_Value_RequiredInputs */
+const ko_cli_app_secret_value_required = (i) => {
+	return `값을 표준 입력으로 주십시오. 예: printf '%s' "$VALUE" | npx sayren app secret put ${i?.name}`;
+};
+/**
+
+* @param {Cli_App_Secret_Value_RequiredInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const cli_app_secret_value_required = ((inputs, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_secret_value_required(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_app_since_invalid.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{ value: NonNullable<unknown> }} Cli_App_Since_InvalidInputs */
+const ko_cli_app_since_invalid = (i) => {
+	return `--since 형식이 아닙니다: ${i?.value} (예: 30m, 1h, 2d)`;
+};
+/**
+
+* @param {Cli_App_Since_InvalidInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const cli_app_since_invalid = ((inputs, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_since_invalid(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_app_state_invalid.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{ file: NonNullable<unknown> }} Cli_App_State_InvalidInputs */
+const ko_cli_app_state_invalid = (i) => {
+	return `${i?.file}을 읽을 수 없습니다. 파일을 지우고 npx sayren app init을 다시 실행하십시오`;
+};
+/**
+
+* @param {Cli_App_State_InvalidInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const cli_app_state_invalid = ((inputs, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_state_invalid(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_app_status.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{ name: NonNullable<unknown>, handle: NonNullable<unknown>, appId: NonNullable<unknown>, status: NonNullable<unknown>, current: NonNullable<unknown>, active: NonNullable<unknown>, pending: NonNullable<unknown> }} Cli_App_StatusInputs */
+const ko_cli_app_status = (i) => {
+	return `${i?.name} (${i?.handle}, ${i?.appId})
+상태 ${i?.status} · 현재 버전 ${i?.current} · 설치 ${i?.active} · 재동의 대기 ${i?.pending}
+최근 버전:`;
+};
+/**
+
+* @param {Cli_App_StatusInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
 */
+const cli_app_status = ((inputs, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_status(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_app_subcommand_unknown.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{ command: NonNullable<unknown> }} Cli_App_Subcommand_UnknownInputs */
+const ko_cli_app_subcommand_unknown = (i) => {
+	return `알 수 없는 앱 명령: ${i?.command}
+
+사용법: npx sayren app <init|dev|trigger|verify|deploy|release|status|logs|secret|dev-store>`;
+};
 /**
-* Type-only metadata attached to compiled message functions.
-*
-* @template Inputs
-* @template Options
-* @template {MessageMarkupSchema} [Markup = MessageMarkupSchema]
-* @typedef {{
-*   readonly __paraglide?: {
-*     inputs: Inputs;
-*     options: Options;
-*     markup: Markup;
-*   };
-* }} MessageMetadata
+
+* @param {Cli_App_Subcommand_UnknownInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
 */
+const cli_app_subcommand_unknown = ((inputs, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_subcommand_unknown(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_app_trigger_data_invalid.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{}} Cli_App_Trigger_Data_InvalidInputs */
+const ko_cli_app_trigger_data_invalid = () => {
+	return `--data가 JSON이 아닙니다`;
+};
 /**
-* A compiled, framework-neutral message part.
-*
-* @typedef {{
-*   type: "text";
-*   value: string;
-* } | {
-*   type: "markup-start";
-*   name: string;
-*   options: MessageMarkupOptions;
-*   attributes: MessageMarkupAttributes;
-* } | {
-*   type: "markup-end";
-*   name: string;
-*   options: MessageMarkupOptions;
-*   attributes: MessageMarkupAttributes;
-* } | {
-*   type: "markup-standalone";
-*   name: string;
-*   options: MessageMarkupOptions;
-*   attributes: MessageMarkupAttributes;
-* }} MessagePart
+
+* @param {Cli_App_Trigger_Data_InvalidInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
 */
+const cli_app_trigger_data_invalid = ((inputs = {}, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_trigger_data_invalid(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_app_trigger_failed.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{ status: NonNullable<unknown> }} Cli_App_Trigger_FailedInputs */
+const ko_cli_app_trigger_failed = (i) => {
+	return `로컬 실행에 보내지 못했습니다(HTTP ${i?.status}). npx sayren app dev가 떠 있는지 확인하십시오`;
+};
 /**
-* A message function is a message for a specific locale.
-*
-* @example
-*   m.hello({ name: 'world' })
-*
-* @typedef {(inputs?: Record<string, never>) => LocalizedString} MessageFunction
+
+* @param {Cli_App_Trigger_FailedInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
 */
+const cli_app_trigger_failed = ((inputs, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_trigger_failed(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/cli_app_trigger_type_required.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{}} Cli_App_Trigger_Type_RequiredInputs */
+const ko_cli_app_trigger_type_required = () => {
+	return `이벤트 종류가 필요합니다. 예: npx sayren app trigger ORDER.PAID --order ord_…`;
+};
 /**
-* A message bundle function that selects the message to be returned.
-*
-* Uses `getLocale()` under the hood to determine the locale with an option.
-*
-* @template {string} T
-*
-* @example
-*   *   m.hello({ name: 'world' }, { locale: "en" })
-*
-* @typedef {(params: Record<string, never>, options: { locale: T }) => LocalizedString} MessageBundleFunction
+
+* @param {Cli_App_Trigger_Type_RequiredInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
 */
+const cli_app_trigger_type_required = ((inputs = {}, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_trigger_type_required(inputs);
+});
 
 //#endregion
-//#region ../i18n/src/locale.ts
+//#region ../i18n/src/paraglide/messages/cli_app_ui_index_missing.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{ dir: NonNullable<unknown> }} Cli_App_Ui_Index_MissingInputs */
+const ko_cli_app_ui_index_missing = (i) => {
+	return `매니페스트에 ui.adminPage가 있지만 ${i?.dir}/index.html이 없습니다`;
+};
 /**
-* 로케일 판정(이슈 #73) — 1순위 쿼리 `?lang=`, 2순위 `Accept-Language`(브라우저는 `navigator.languages`), 마지막 `ko`.
-* 순서는 컴파일 옵션(`scripts/compile.mjs`의 strategy)이 정하고, 여기서는 Paraglide에 없는 쿼리 판정만 등록한다.
-* api는 같은 순서를 `@nestjs/i18n` 리졸버(Query → AcceptLanguage)로 맞춘다.
+
+* @param {Cli_App_Ui_Index_MissingInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
 */
-const LOCALE_QUERY_PARAM = "lang";
-/** `?lang=ko-KR` → `ko`. 지원하지 않는 값·없으면 undefined(다음 판정으로 넘어간다) */
-function localeFromSearch(search) {
-	const value = new URLSearchParams(search).get(LOCALE_QUERY_PARAM);
-	if (!value) return void 0;
-	return toLocale(value) ?? toLocale(value.split("-")[0]);
-}
-defineCustomServerStrategy("custom-query", { getLocale: (request) => request ? localeFromSearch(new URL(request.url).search) : void 0 });
-/** 브라우저의 현재 주소 쿼리 — DOM 타입에 기대지 않는다(DOM lib 없는 소비자, 예: mcp-gateway도 이 소스를 타입 검사한다) */
-function currentSearch() {
-	return globalThis.location?.search;
-}
-defineCustomClientStrategy("custom-query", {
-	getLocale: () => {
-		const search = currentSearch();
-		return search === void 0 ? void 0 : localeFromSearch(search);
-	},
-	setLocale: () => {}
+const cli_app_ui_index_missing = ((inputs, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_ui_index_missing(inputs);
 });
 
 //#endregion
-//#region ../i18n/src/lazy-messages.ts
+//#region ../i18n/src/paraglide/messages/cli_app_ui_too_large.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{ limit: NonNullable<unknown> }} Cli_App_Ui_Too_LargeInputs */
+const ko_cli_app_ui_too_large = (i) => {
+	return `앱 화면 파일이 상한(${i?.limit})을 넘습니다 (ARTIFACT_TOO_LARGE)`;
+};
 /**
-* 라벨 표 — 값을 읽을 때마다 메시지 함수를 불러 그 순간의 로케일 문구를 돌려준다(이슈 #73).
-* 모듈을 읽을 때 문구를 만들면 서버 렌더링에서 요청 로케일이 아니라 기동 시점 로케일로 굳는다.
-* 타입은 `Record<K, string>`이라 호출부(`LABEL[key]`, `Object.entries(LABEL)`)를 바꾸지 않는다.
-*
-* ```ts
-* export const ROLE_LABEL = lazyMessages<StoreRole>({ OWNER: m.store_shell_role_owner, ... });
-* ```
+
+* @param {Cli_App_Ui_Too_LargeInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
 */
-function lazyMessages(table) {
-	const labels = {};
-	for (const key of Object.keys(table)) Object.defineProperty(labels, key, {
-		enumerable: true,
-		get: () => table[key]()
-	});
-	return Object.freeze(labels);
-}
+const cli_app_ui_too_large = ((inputs, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_cli_app_ui_too_large(inputs);
+});
 
 //#endregion
-//#region ../i18n/src/paraglide/messages/cli_access_token_expired.js
+//#region ../i18n/src/paraglide/messages/cli_app_uploading.js
 /** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
-/** @typedef {{}} Cli_Access_Token_ExpiredInputs */
-const ko_cli_access_token_expired = () => {
-	return `액세스 토큰이 만료됐습니다. 새 토큰을 만들거나 npx sayren login으로 다시 로그인하십시오`;
+/** @typedef {{ size: NonNullable<unknown>, ui: NonNullable<unknown> }} Cli_App_UploadingInputs */
+const ko_cli_app_uploading = (i) => {
+	return `올리는 중 — 서버 번들 ${i?.size}(gzip), 화면 파일 ${i?.ui}개`;
 };
 /**
 
-* @param {Cli_Access_Token_ExpiredInputs} inputs
+* @param {Cli_App_UploadingInputs} inputs
 * @param {{ locale?: "ko" }} options
 * @returns {LocalizedString}
 */
-const cli_access_token_expired = ((inputs = {}, options = {}) => {
+const cli_app_uploading = ((inputs, options = {}) => {
 	experimentalStaticLocale ?? options.locale ?? getLocale();
-	return ko_cli_access_token_expired(inputs);
+	return ko_cli_app_uploading(inputs);
 });
 
 //#endregion
-//#region ../i18n/src/paraglide/messages/cli_account_mcp_written.js
+//#region ../i18n/src/paraglide/messages/cli_app_verify_ok.js
 /** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
-/** @typedef {{ file: NonNullable<unknown>, mcpFile: NonNullable<unknown> }} Cli_Account_Mcp_WrittenInputs */
-const ko_cli_account_mcp_written = (i) => {
-	return `${i?.file} 작성 — 원격 MCP 주소와 상점. ${i?.mcpFile}에는 토큰을 쓰지 않았습니다 — MCP 클라이언트가 연결할 때 Sayren 계정으로 로그인합니다`;
+/** @typedef {{ events: NonNullable<unknown>, http: NonNullable<unknown>, size: NonNullable<unknown>, ui: NonNullable<unknown>, icon: NonNullable<unknown>, readme: NonNullable<unknown> }} Cli_App_Verify_OkInputs */
+const ko_cli_app_verify_ok = (i) => {
+	return `검사 통과 — 이벤트 ${i?.events} · HTTP ${i?.http} · 서버 번들 ${i?.size}(gzip) · 화면 파일 ${i?.ui}개 · 아이콘 ${i?.icon} · README ${i?.readme}`;
 };
 /**
 
-* @param {Cli_Account_Mcp_WrittenInputs} inputs
+* @param {Cli_App_Verify_OkInputs} inputs
 * @param {{ locale?: "ko" }} options
 * @returns {LocalizedString}
 */
-const cli_account_mcp_written = ((inputs, options = {}) => {
+const cli_app_verify_ok = ((inputs, options = {}) => {
 	experimentalStaticLocale ?? options.locale ?? getLocale();
-	return ko_cli_account_mcp_written(inputs);
+	return ko_cli_app_verify_ok(inputs);
 });
 
 //#endregion
-//#region ../i18n/src/paraglide/messages/cli_accounts_origin_unknown.js
+//#region ../i18n/src/paraglide/messages/cli_app_version_number_required.js
 /** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
-/** @typedef {{ origin: NonNullable<unknown> }} Cli_Accounts_Origin_UnknownInputs */
-const ko_cli_accounts_origin_unknown = (i) => {
-	return `이 api 주소(${i?.origin})의 계정 서버를 모릅니다. --accounts-origin 또는 SAYREN_ACCOUNTS_ORIGIN으로 주십시오`;
+/** @typedef {{}} Cli_App_Version_Number_RequiredInputs */
+const ko_cli_app_version_number_required = () => {
+	return `버전 번호가 필요합니다. 예: npx sayren app release 1`;
 };
 /**
 
-* @param {Cli_Accounts_Origin_UnknownInputs} inputs
+* @param {Cli_App_Version_Number_RequiredInputs} inputs
 * @param {{ locale?: "ko" }} options
 * @returns {LocalizedString}
 */
-const cli_accounts_origin_unknown = ((inputs, options = {}) => {
+const cli_app_version_number_required = ((inputs = {}, options = {}) => {
 	experimentalStaticLocale ?? options.locale ?? getLocale();
-	return ko_cli_accounts_origin_unknown(inputs);
+	return ko_cli_app_version_number_required(inputs);
 });
 
 //#endregion
-//#region ../i18n/src/paraglide/messages/cli_accounts_unreachable.js
+//#region ../i18n/src/paraglide/messages/cli_app_warning.js
 /** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
-/** @typedef {{}} Cli_Accounts_UnreachableInputs */
-const ko_cli_accounts_unreachable = () => {
-	return `계정 서버에 연결하지 못했습니다. 네트워크를 확인하십시오`;
+/** @typedef {{ message: NonNullable<unknown> }} Cli_App_WarningInputs */
+const ko_cli_app_warning = (i) => {
+	return `경고: ${i?.message}`;
 };
 /**
 
-* @param {Cli_Accounts_UnreachableInputs} inputs
+* @param {Cli_App_WarningInputs} inputs
 * @param {{ locale?: "ko" }} options
 * @returns {LocalizedString}
 */
-const cli_accounts_unreachable = ((inputs = {}, options = {}) => {
+const cli_app_warning = ((inputs, options = {}) => {
 	experimentalStaticLocale ?? options.locale ?? getLocale();
-	return ko_cli_accounts_unreachable(inputs);
+	return ko_cli_app_warning(inputs);
 });
 
 //#endregion
@@ -4332,6 +5212,7 @@ const ko_cli_usage = (i) => {
   npx sayren deploy [--no-publish] [--skip-build] [--message <메모>] [--force [--yes]]
   npx sayren status
   npx sayren verify
+  npx sayren app <명령>                 # 서드파티 앱(init·dev·trigger·verify·deploy·release·status·logs·secret·dev-store)
 
 명령:
   login    Sayren 계정으로 로그인합니다. 로그인 토큰은 사용자 설정 폴더(~/.config/sayren/credentials.json)에 둡니다
@@ -4342,6 +5223,7 @@ const ko_cli_usage = (i) => {
   deploy   로컬 검사 → 로컬 빌드 → 작업 트리 올리기 → 빌드 → 발행. 원격이 pull 이후 바뀌었으면 덮어쓰지 않습니다
   status   사이트·발행 버전·최근 빌드·편집 환경
   verify   로컬 규칙·경로·크기 검사(서버 빌드와 같은 규칙)
+  app      서드파티 앱 — init <handle>로 만들고 dev로 로컬 실행, deploy로 버전을 올리고 release로 적용합니다. 자세히: https://docs.sayren.app/guides/apps-getting-started
 
 토큰은 Sayren 계정 토큰만 받고 --token → SAYREN_TOKEN 환경 변수 → 로그인(credentials.json) 순서로 읽습니다.
 계정 토큰은 계정에 발급됩니다 — 상점은 --store → SAYREN_STORE_ID → 폴더 설정 순서로 고릅니다(하나면 자동).
@@ -4364,6 +5246,14 @@ const ko_cli_usage = (i) => {
   --api-origin <주소>  api 주소(기본 https://api.sayren.app, SAYREN_API_ORIGIN). https만, localhost만 http
   --accounts-origin <주소>  계정 서버 주소(기본: api 주소에 맞춘 값, SAYREN_ACCOUNTS_ORIGIN)
   --token <토큰>       토큰을 직접 줍니다. 셸 기록·프로세스 목록에 남으니 login·SAYREN_TOKEN을 권합니다
+  --key <키>           app: 앱 배포 키(developer.sayren.app에서 발행, SAYREN_APP_KEY). CI에서 deploy·release·status·logs·secret에 씁니다
+  -m, --message <메모> app deploy: 버전 메모
+  --name <이름>        app init: 앱 이름(기본: handle)
+  --port <포트>        app dev·trigger: 로컬 포트(기본 4020)
+  --since <기간>       app logs: 최근 기간만(30m·1h·2d)
+  --tail               app logs: 새 기록을 계속 봅니다
+  --data <json>        app trigger: 이벤트 데이터
+  --order <orderId>    app trigger: 주문 id를 데이터에 넣습니다
   --lang <로케일>      메시지 언어(기본: SAYREN_LANG → 시스템 로케일 → ko)
 
 종료 코드: 0 성공 · 1 실패 · 3 승인 대기(에이전트 토큰)`;
@@ -5437,7 +6327,7 @@ const mcp_rule_checkout_availability_title = ((inputs = {}, options = {}) => {
 /** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
 /** @typedef {{}} Mcp_Rule_Checkout_Availability_WhyInputs */
 const ko_mcp_rule_checkout_availability_why = () => {
-	return `결제 수단이 없거나 공개한 쇼핑몰의 실결제가 아직 열리지 않은 상점은 결제 요청이 409 \`PAYMENT_NOT_CONFIGURED\`다. 버튼을 그대로 두면 구매자가 담고 주문서까지 가서야 결제가 안 된다는 것을 안다`;
+	return `결제수단이 없거나 공개한 쇼핑몰의 실결제가 아직 열리지 않은 상점은 결제 요청이 409 \`PAYMENT_NOT_CONFIGURED\`다. 버튼을 그대로 두면 구매자가 담고 주문서까지 가서야 결제가 안 된다는 것을 안다`;
 };
 /**
 
@@ -6314,6 +7204,82 @@ const mcp_rule_payment_return_route_why = ((inputs = {}, options = {}) => {
 	return ko_mcp_rule_payment_return_route_why(inputs);
 });
 
+//#endregion
+//#region ../i18n/src/paraglide/messages/mcp_rule_product_link_example.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{}} Mcp_Rule_Product_Link_ExampleInputs */
+const ko_mcp_rule_product_link_example = () => {
+	return `import { productPathParam } from "../lib/product-path";
+
+<Link to="/products/$productId" params={{ productId: productPathParam(product) }}>
+  {product.name}
+</Link>`;
+};
+/**
+
+* @param {Mcp_Rule_Product_Link_ExampleInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const mcp_rule_product_link_example = ((inputs = {}, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_mcp_rule_product_link_example(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/mcp_rule_product_link_fix.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{}} Mcp_Rule_Product_Link_FixInputs */
+const ko_mcp_rule_product_link_fix = () => {
+	return `링크의 경로 값을 \`productPathParam(product)\`(\`src/lib/product-path.ts\`)로 만든다. 상품번호가 있으면 번호, 없는 옛 응답이면 상품 id다. 장바구니 담기·주문서 같은 서버 요청에는 계속 \`productId\`를 보낸다`;
+};
+/**
+
+* @param {Mcp_Rule_Product_Link_FixInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const mcp_rule_product_link_fix = ((inputs = {}, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_mcp_rule_product_link_fix(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/mcp_rule_product_link_title.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{}} Mcp_Rule_Product_Link_TitleInputs */
+const ko_mcp_rule_product_link_title = () => {
+	return `상품 링크는 상품번호 주소로 그린다(\`/products/{productNo}\`)`;
+};
+/**
+
+* @param {Mcp_Rule_Product_Link_TitleInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const mcp_rule_product_link_title = ((inputs = {}, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_mcp_rule_product_link_title(inputs);
+});
+
+//#endregion
+//#region ../i18n/src/paraglide/messages/mcp_rule_product_link_why.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{}} Mcp_Rule_Product_Link_WhyInputs */
+const ko_mcp_rule_product_link_why = () => {
+	return `상품 주소는 상점 안에서 유일한 숫자 상품번호다. 상품 id(\`prod_…\`) 주소도 열리지만 상세 화면이 상품번호 주소로 301 이동시키므로 링크마다 왕복이 한 번 더 생기고 공유·검색 주소가 둘로 갈린다`;
+};
+/**
+
+* @param {Mcp_Rule_Product_Link_WhyInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const mcp_rule_product_link_why = ((inputs = {}, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_mcp_rule_product_link_why(inputs);
+});
+
 //#endregion
 //#region ../i18n/src/paraglide/messages/mcp_rule_server_only_env_example.js
 /** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
@@ -7063,6 +8029,24 @@ const mcp_verify_payment_return_route = ((inputs = {}, options = {}) => {
 	return ko_mcp_verify_payment_return_route(inputs);
 });
 
+//#endregion
+//#region ../i18n/src/paraglide/messages/mcp_verify_product_link.js
+/** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
+/** @typedef {{}} Mcp_Verify_Product_LinkInputs */
+const ko_mcp_verify_product_link = () => {
+	return `상품 링크의 경로 값이 상품 id다 — \`productPathParam(product)\`로 상품번호 주소를 쓴다`;
+};
+/**
+
+* @param {Mcp_Verify_Product_LinkInputs} inputs
+* @param {{ locale?: "ko" }} options
+* @returns {LocalizedString}
+*/
+const mcp_verify_product_link = ((inputs = {}, options = {}) => {
+	experimentalStaticLocale ?? options.locale ?? getLocale();
+	return ko_mcp_verify_product_link(inputs);
+});
+
 //#endregion
 //#region ../i18n/src/paraglide/messages/mcp_verify_server_only_env.js
 /** @typedef {import('../runtime.js').LocalizedString} LocalizedString */
@@ -7153,6 +8137,26 @@ const mcp_verify_whole_project = ((inputs = {}, options = {}) => {
 	return ko_mcp_verify_whole_project(inputs);
 });
 
+//#endregion
+//#region ../i18n/src/lazy-messages.ts
+/**
+* 라벨 표 — 값을 읽을 때마다 메시지 함수를 불러 그 순간의 로케일 문구를 돌려준다(이슈 #73).
+* 모듈을 읽을 때 문구를 만들면 서버 렌더링에서 요청 로케일이 아니라 기동 시점 로케일로 굳는다.
+* 타입은 `Record<K, string>`이라 호출부(`LABEL[key]`, `Object.entries(LABEL)`)를 바꾸지 않는다.
+*
+* ```ts
+* export const ROLE_LABEL = lazyMessages<StoreRole>({ OWNER: m.store_shell_role_owner, ... });
+* ```
+*/
+function lazyMessages(table) {
+	const labels = {};
+	for (const key of Object.keys(table)) Object.defineProperty(labels, key, {
+		enumerable: true,
+		get: () => table[key]()
+	});
+	return Object.freeze(labels);
+}
+
 //#endregion
 //#region ../i18n/src/process-locale.ts
 /**
@@ -7202,47 +8206,6 @@ function takeLangFlag(argv) {
 	};
 }
 
-//#endregion
-//#region package.json
-var version = "0.4.0";
-
-//#endregion
-//#region src/client.ts
-/**
-* 관리 API 클라이언트 — `@sayren/store-sdk`(계약의 원천)를 쓴다. User-Agent `sayren-cli/{버전}`은 api가 버전의 만든 경로
-* (`createdVia: CLI`)를 적는 표시다(권한과 무관하다. 에이전트용 액세스 토큰이면 행위자는 여전히 에이전트이고 발행은 승인 대기다).
-* 토큰은 헤더에만 싣고 화면·로그에 찍지 않는다.
-*/
-const CLI_VERSION = version;
-const CLI_USER_AGENT = `sayren-cli/${CLI_VERSION}`;
-/**
-* 계정 토큰(#71)을 Bearer로, 고른 상점(`auth.storeId`)을 `X-Store-Id`로 싣는다. 401이면 `refresh`(자격 증명 파일의 refresh 회전)를
-* 한 번 부른 뒤 다시 보낸다. 토큰·상점은 함수로 읽어 갱신·선택된 값을 따라간다.
-*/
-function clientOf(auth, fetchImpl = fetch, refresh) {
-	return createStoreClient({
-		baseUrl: `${auth.apiOrigin}/v1`,
-		accessToken: () => auth.token,
-		storeId: () => auth.storeId ?? null,
-		...refresh ? { refresh } : {},
-		fetch: (input, init$1) => {
-			const headers = new Headers(init$1?.headers);
-			headers.set("user-agent", CLI_USER_AGENT);
-			return fetchImpl(input, {
-				...init$1,
-				headers
-			});
-		}
-	});
-}
-/** 오류 코드 — `ApiError`가 아니면 null */
-function codeOf(error) {
-	return error instanceof ApiError ? error.code : null;
-}
-function detailsOf(error) {
-	return error instanceof ApiError ? error.details ?? {} : {};
-}
-
 //#endregion
 //#region ../mcp/src/account-token.ts
 /**
@@ -8212,6 +9175,855 @@ async function selectStore(auth, client, io, candidates, folderStore = null) {
 	return auth.storeId;
 }
 
+//#endregion
+//#region package.json
+var version = "0.6.0";
+
+//#endregion
+//#region src/client.ts
+/**
+* 관리 API 클라이언트 — `@sayren/store-sdk`(계약의 원천)를 쓴다. User-Agent `sayren-cli/{버전}`은 api가 버전의 만든 경로
+* (`createdVia: CLI`)를 적는 표시다(권한과 무관하다. 에이전트용 액세스 토큰이면 행위자는 여전히 에이전트이고 발행은 승인 대기다).
+* 토큰은 헤더에만 싣고 화면·로그에 찍지 않는다.
+*/
+const CLI_VERSION = version;
+const CLI_USER_AGENT = `sayren-cli/${CLI_VERSION}`;
+/**
+* 계정 토큰(#71)을 Bearer로, 고른 상점(`auth.storeId`)을 `X-Store-Id`로 싣는다. 401이면 `refresh`(자격 증명 파일의 refresh 회전)를
+* 한 번 부른 뒤 다시 보낸다. 토큰·상점은 함수로 읽어 갱신·선택된 값을 따라간다.
+*/
+function clientOf(auth, fetchImpl = fetch, refresh) {
+	return createStoreClient({
+		baseUrl: `${auth.apiOrigin}/v1`,
+		accessToken: () => auth.token,
+		storeId: () => auth.storeId ?? null,
+		...refresh ? { refresh } : {},
+		fetch: (input, init$1) => {
+			const headers = new Headers(init$1?.headers);
+			headers.set("user-agent", CLI_USER_AGENT);
+			return fetchImpl(input, {
+				...init$1,
+				headers
+			});
+		}
+	});
+}
+/** 오류 코드 — `ApiError`가 아니면 null */
+function codeOf(error) {
+	return error instanceof ApiError ? error.code : null;
+}
+function detailsOf(error) {
+	return error instanceof ApiError ? error.details ?? {} : {};
+}
+
+//#endregion
+//#region src/app-commands.ts
+/**
+* `sayren app …`(이슈 #22, 매뉴얼 「앱 만들기」) — 앱 폴더(`sayren.app.json`)에서 돈다. 서버는 코드를 빌드하지 않는다(A1):
+* CLI가 esbuild로 서버 번들 한 파일을 만들어 올리고 api가 `DEPENDENCIES`·`VERIFY`·`BUNDLE`·`UPLOAD`를 돈다. 앱 화면(`ui/`)은
+* 정적 파일 그대로 올린다.
+*
+* 인증은 둘이다. 앱 배포 키(`--key`·`SAYREN_APP_KEY`, developer.sayren.app에서 발행, `sak_…`)는 그 앱의 경로에만 쓰이고(CI 용도),
+* 그 밖에는 `sayren login`의 계정 토큰이다. 앱 등록(`init`)·개발 상점은 계정 토큰만 된다.
+*/
+const APP_MANIFEST_FILE = "sayren.app.json";
+const APP_STATE_FILE = `${STATE_DIR}/app.json`;
+const APP_DEV_PORT = 4020;
+const SERVER_ENTRY_CANDIDATES = [
+	"src/server.ts",
+	"src/server.js",
+	"src/server.mjs"
+];
+const UI_DIR = "ui";
+const SETTING_ENV_PREFIX = "SAYREN_APP_SETTING_";
+const SECRET_ENV_PREFIX = "SAYREN_APP_SECRET_";
+/** `dev`의 개발 설치 토큰을 만료 몇 초 전에 다시 받는가 */
+const DEV_TOKEN_REFRESH_MARGIN_MS = 6e4;
+function readAppState(dir) {
+	const path = join(dir, APP_STATE_FILE);
+	if (!existsSync(path)) return null;
+	try {
+		const parsed = JSON.parse(readFileSync(path, "utf8"));
+		if (typeof parsed.appId === "string" && typeof parsed.handle === "string" && typeof parsed.apiOrigin === "string") return {
+			appId: parsed.appId,
+			handle: parsed.handle,
+			apiOrigin: parsed.apiOrigin
+		};
+	} catch {}
+	throw new CliError(cli_app_state_invalid({ file: APP_STATE_FILE }));
+}
+function writeAppState(dir, state) {
+	mkdirSync(join(dir, STATE_DIR), { recursive: true });
+	writeFileSync(join(dir, APP_STATE_FILE), `${JSON.stringify(state, null, 2)}\n`, { mode: 384 });
+}
+/** 매니페스트 원문(JSON)과 검증 결과 — 문제가 있으면 CliError */
+function loadManifest(dir) {
+	const path = join(dir, APP_MANIFEST_FILE);
+	if (!existsSync(path)) throw new CliError(cli_app_manifest_missing({ file: APP_MANIFEST_FILE }));
+	let raw;
+	try {
+		raw = JSON.parse(readFileSync(path, "utf8"));
+	} catch (error) {
+		throw new CliError(cli_app_manifest_invalid({ problems: `- ${error instanceof Error ? error.message : String(error)}` }));
+	}
+	const parsed = appManifestSchema.safeParse(raw);
+	if (!parsed.success) throw new CliError(cli_app_manifest_invalid({ problems: parsed.error.issues.map((issue) => `- ${issue.path.join(".") || "(root)"}: ${issue.message}`).join("\n") }));
+	const problems = appManifestProblems(parsed.data);
+	if (problems.length) throw new CliError(cli_app_manifest_invalid({ problems: problems.map((p) => `- ${p.path}: ${p.message} (${p.code})`).join("\n") }));
+	return {
+		raw,
+		manifest: parsed.data
+	};
+}
+function appDir(flags, io) {
+	return resolve(io.cwd, flags.dir ?? ".");
+}
+function requireState(dir) {
+	const state = readAppState(dir);
+	if (!state) throw new CliError(cli_app_not_registered({ file: APP_MANIFEST_FILE }));
+	return state;
+}
+/** 배포 키(`--key` → `SAYREN_APP_KEY`)가 있으면 그것, 없으면 계정 토큰(`resolveAuth`) */
+async function developerAuth(flags, dir, io, options = {}) {
+	const state = readAppState(dir);
+	const key = flags.key?.trim() || io.env.SAYREN_APP_KEY?.trim();
+	if (key && !options.accountOnly) {
+		if (!APP_DEPLOY_KEY_PATTERN.test(key)) throw new CliError(cli_app_key_invalid());
+		const { apiOrigin } = resolveApiOrigin({ apiOrigin: flags.apiOrigin ?? state?.apiOrigin }, dir, null, io.env);
+		return {
+			apiOrigin,
+			bearer: key,
+			kind: "key"
+		};
+	}
+	const auth = resolveAuth({
+		...flags,
+		apiOrigin: flags.apiOrigin ?? state?.apiOrigin
+	}, dir, null, io.env, credentialTokenReader(io.env));
+	const refresh = await readyAuth(auth, io);
+	return {
+		apiOrigin: auth.apiOrigin,
+		get bearer() {
+			return auth.token;
+		},
+		kind: "account",
+		...refresh ? { refresh } : {}
+	};
+}
+async function devApi(auth, io, method, path, body, retried = false) {
+	const res = await io.fetch(`${auth.apiOrigin}/platform/v1/developer${path}`, {
+		method,
+		headers: {
+			authorization: `Bearer ${auth.bearer}`,
+			"user-agent": CLI_USER_AGENT,
+			...body === void 0 ? {} : { "content-type": "application/json" }
+		},
+		...body === void 0 ? {} : { body: JSON.stringify(body) }
+	});
+	if (res.status === 204) return void 0;
+	const text = await res.text();
+	let json = {};
+	try {
+		json = text ? JSON.parse(text) : {};
+	} catch {
+		throw new ApiError(res.status, "INVALID_RESPONSE", text.slice(0, 200));
+	}
+	if (res.ok && json.meta?.isSuccess !== false) return json.data;
+	if (res.status === 401 && auth.refresh && !retried && await auth.refresh()) return devApi(auth, io, method, path, body, true);
+	throw new ApiError(res.status, json.error?.code ?? json.meta?.code ?? "ERROR", json.error?.message ?? json.meta?.message ?? `HTTP ${res.status}`, void 0, json, json.error?.details);
+}
+function serverEntryOf(dir) {
+	const found = SERVER_ENTRY_CANDIDATES.find((candidate) => existsSync(join(dir, candidate)));
+	if (!found) throw new CliError(cli_app_entry_missing({ entry: SERVER_ENTRY_CANDIDATES[0] }));
+	return join(dir, found);
+}
+/** esbuild로 서버 번들을 만든다. 앱 의존성은 앱 폴더의 `node_modules`에서 푼다(설치돼 있어야 한다) */
+async function bundleServer(dir) {
+	const entry = serverEntryOf(dir);
+	const esbuild = await import("esbuild");
+	try {
+		const file = (await esbuild.build({
+			entryPoints: [entry],
+			bundle: true,
+			write: false,
+			format: "esm",
+			platform: "browser",
+			target: "es2022",
+			conditions: [
+				"workerd",
+				"worker",
+				"browser"
+			],
+			mainFields: [
+				"browser",
+				"module",
+				"main"
+			],
+			absWorkingDir: dir,
+			logLevel: "silent",
+			legalComments: "none",
+			define: { "process.env.NODE_ENV": "\"production\"" }
+		})).outputFiles?.[0];
+		if (!file) throw new CliError(cli_app_bundle_failed({ tail: "(빈 산출물)" }));
+		return file.text;
+	} catch (error) {
+		if (error instanceof CliError) throw error;
+		const tail = error && typeof error === "object" && "errors" in error ? (error.errors ?? []).map((e) => e.location ? `${e.location.file}:${e.location.line}: ${e.text}` : e.text).join("\n") : error instanceof Error ? error.message : String(error);
+		throw new CliError(cli_app_bundle_failed({ tail }));
+	}
+}
+/** 번들을 불러 `defineApp` 메타데이터를 읽는다 — `HANDLER_MISSING`·기본 내보내기 검사. `dev`도 이 모듈을 실행한다 */
+async function loadBundle(dir, server) {
+	const out = join(dir, STATE_DIR, "build");
+	mkdirSync(out, { recursive: true });
+	const file = join(out, `server.${Date.now().toString(36)}.mjs`);
+	writeFileSync(file, server);
+	let mod;
+	try {
+		mod = await import(pathToFileURL(file).href);
+	} catch (error) {
+		throw new CliError(cli_app_bundle_failed({ tail: error instanceof Error ? error.message : String(error) }));
+	}
+	const app = mod.default;
+	const meta = app?.__sayrenApp;
+	if (!app || typeof app.fetch !== "function" || !meta) throw new CliError(cli_app_default_export_missing());
+	return {
+		app,
+		meta: {
+			events: [...meta.events],
+			http: [...meta.http]
+		}
+	};
+}
+function collectListing(dir, manifest) {
+	let icon = null;
+	if (manifest.icon) {
+		const file = join(dir, manifest.icon);
+		if (!existsSync(file)) throw new CliError(cli_app_icon_missing({ path: manifest.icon }));
+		const bytes = readFileSync(file);
+		const contentType = /\.svg$/i.test(manifest.icon) ? "image/svg+xml" : "image/png";
+		const problem = appIconProblem(bytes, contentType);
+		if (problem) throw new CliError(cli_app_icon_invalid({
+			path: manifest.icon,
+			problem
+		}));
+		icon = {
+			path: manifest.icon,
+			contentType,
+			bytes
+		};
+	}
+	const readmePath = manifest.readme ?? "README.md";
+	let readme = null;
+	if (existsSync(join(dir, readmePath))) {
+		const text = readFileSync(join(dir, readmePath), "utf8");
+		if (Buffer.byteLength(text, "utf8") > APP_README_MAX_BYTES) throw new CliError(cli_app_readme_too_large({
+			path: readmePath,
+			limit: String(APP_README_MAX_BYTES / 1024)
+		}));
+		readme = {
+			path: readmePath,
+			text
+		};
+	} else if (manifest.readme) throw new CliError(cli_app_readme_missing({ path: manifest.readme }));
+	return {
+		icon,
+		readme
+	};
+}
+/** 로컬 검사 — 매니페스트, 번들, 이벤트 함수 존재, 비밀 값 형식, 크기. 서버 `VERIFY`·`BUNDLE`과 같은 규칙 */
+async function verifyApp(dir) {
+	const { raw, manifest } = loadManifest(dir);
+	const server = await bundleServer(dir);
+	if (APP_SECRET_PATTERNS.find((pattern) => pattern.test(server))) throw new CliError(cli_app_secret_in_source());
+	const gzipBytes = gzipSync(server).byteLength;
+	if (gzipBytes > APP_SERVER_BUNDLE_MAX_GZIP_BYTES) throw new CliError(cli_app_bundle_too_large({ size: formatMb(gzipBytes) }));
+	const { app, meta } = await loadBundle(dir, server);
+	const missing = manifest.events.filter((event) => !meta.events.includes(event));
+	if (missing.length) throw new CliError(cli_app_handler_missing({ events: missing.join(", ") }));
+	const warnings = [];
+	const listed = manifest.events;
+	const extra = meta.events.filter((event) => !listed.includes(event));
+	if (extra.length) warnings.push(cli_app_handler_unlisted({ events: extra.join(", ") }));
+	const ui = manifest.ui?.adminPage ? collectUi(dir) : [];
+	if (manifest.ui?.adminPage && !ui.some((file) => file.path === "index.html")) throw new CliError(cli_app_ui_index_missing({ dir: UI_DIR }));
+	const listing = collectListing(dir, manifest);
+	return {
+		manifest,
+		raw,
+		bundle: {
+			server,
+			gzipBytes,
+			meta
+		},
+		app,
+		ui,
+		listing,
+		warnings
+	};
+}
+function collectUi(dir) {
+	const root = join(dir, UI_DIR);
+	if (!existsSync(root)) throw new CliError(cli_app_ui_index_missing({ dir: UI_DIR }));
+	const files = [];
+	const walk = (current) => {
+		for (const name of readdirSync(current)) {
+			if (name.startsWith(".") || name === "node_modules" || name === "_sayren") continue;
+			const full = join(current, name);
+			if (statSync(full).isDirectory()) walk(full);
+			else files.push({
+				path: relative(root, full).split(sep).join("/"),
+				bytes: readFileSync(full)
+			});
+		}
+	};
+	walk(root);
+	const bridge = join(dir, "node_modules/@sayren/app/dist/ui.mjs");
+	if (!existsSync(bridge)) throw new CliError(cli_app_bridge_missing());
+	files.push({
+		path: "_sayren/ui.js",
+		bytes: readFileSync(bridge)
+	});
+	if (files.length > APP_UI_MAX_FILES) throw new CliError(cli_app_ui_too_large({ limit: `${APP_UI_MAX_FILES} files` }));
+	if (files.reduce((sum, file) => sum + file.bytes.byteLength, 0) > APP_UI_MAX_BYTES) throw new CliError(cli_app_ui_too_large({ limit: formatMb(APP_UI_MAX_BYTES) }));
+	return files;
+}
+function formatMb(bytes) {
+	return `${(bytes / 1024 / 1024).toFixed(1)}MB`;
+}
+const HANDLE_RE = /^[a-z0-9][a-z0-9-]{1,38}[a-z0-9]$/;
+function initFiles(handle, name) {
+	const manifest = {
+		handle,
+		name,
+		description: "",
+		scopes: ["order:r"],
+		network: { hosts: [] },
+		events: ["ORDER.PAID"],
+		settings: {}
+	};
+	return {
+		[APP_MANIFEST_FILE]: `${JSON.stringify(manifest, null, 2)}\n`,
+		"package.json": `${JSON.stringify({
+			name: handle,
+			private: true,
+			type: "module",
+			scripts: {
+				dev: "sayren app dev",
+				verify: "sayren app verify",
+				deploy: "sayren app deploy"
+			},
+			dependencies: { "@sayren/app": `^${CLI_VERSION}` },
+			devDependencies: {
+				sayren: `^${CLI_VERSION}`,
+				typescript: "^5.9.0"
+			}
+		}, null, 2)}\n`,
+		"tsconfig.json": `${JSON.stringify({
+			compilerOptions: {
+				target: "ES2022",
+				module: "ESNext",
+				moduleResolution: "bundler",
+				strict: true,
+				noEmit: true,
+				lib: ["ES2022", "DOM"],
+				skipLibCheck: true
+			},
+			include: ["src"]
+		}, null, 2)}\n`,
+		"src/server.ts": `import { defineApp } from "@sayren/app";
+
+export default defineApp({
+  events: {
+    "ORDER.PAID": async (event, ctx) => {
+      const { orderId } = event.data as { orderId: string };
+      const order = await ctx.api.orders.get(orderId);
+      ctx.log.info("결제된 주문", order.orderNo, order.totalAmount);
+    },
+  },
+});
+`,
+		".gitignore": "node_modules/\ndist/\n.env\n.sayren/\n",
+		"README.md": `# ${name}\n\n이 앱이 하는 일을 한두 문장으로 씁니다.\n\n## 설정\n\n설치한 뒤 채울 설정을 설명합니다.\n`,
+		".env.example": `# 로컬 실행(sayren app dev)의 설정·비밀 값\n# ${SETTING_ENV_PREFIX}<설정 키>=값\n# ${SECRET_ENV_PREFIX}<비밀 값 이름>=값\n`
+	};
+}
+async function appInit(handle, flags, io) {
+	if (!handle || !HANDLE_RE.test(handle)) throw new CliError(cli_app_handle_invalid());
+	const dir = resolve(io.cwd, flags.dir ?? handle);
+	if (existsSync(join(dir, APP_MANIFEST_FILE))) throw new CliError(cli_app_dir_exists({ dir: relative(io.cwd, dir) || "." }));
+	const name = flags.name?.trim() || handle;
+	const auth = await developerAuth(flags, dir, io, { accountOnly: true });
+	const app = await devApi(auth, io, "POST", "/apps", {
+		handle,
+		name
+	});
+	mkdirSync(join(dir, "src"), { recursive: true });
+	for (const [path, content] of Object.entries(initFiles(handle, name))) {
+		const full = join(dir, path);
+		mkdirSync(join(full, ".."), { recursive: true });
+		if (!existsSync(full)) writeFileSync(full, content);
+	}
+	writeAppState(dir, {
+		appId: app.appId,
+		handle: app.handle,
+		apiOrigin: auth.apiOrigin
+	});
+	io.out(cli_app_init_done({
+		dir: relative(io.cwd, dir) || ".",
+		appId: app.appId,
+		handle
+	}));
+	return 0;
+}
+async function appVerify(flags, io) {
+	const outcome = await verifyApp(appDir(flags, io));
+	for (const warning of outcome.warnings) io.err(cli_app_warning({ message: warning }));
+	io.out(cli_app_verify_ok({
+		events: outcome.bundle.meta.events.join(", ") || "-",
+		http: outcome.bundle.meta.http.join(", ") || "-",
+		size: formatMb(outcome.bundle.gzipBytes),
+		ui: String(outcome.ui.length),
+		icon: outcome.listing.icon?.path ?? cli_app_listing_none(),
+		readme: outcome.listing.readme?.path ?? cli_app_listing_none()
+	}));
+	return 0;
+}
+function printBuild(version$1, io) {
+	for (const stage of version$1.build?.stages ?? []) io.out(`  ${stage.ok ? "✓" : "✗"} ${stage.stage} ${stage.durationMs}ms`);
+}
+async function appDeploy(flags, io) {
+	const dir = appDir(flags, io);
+	const state = requireState(dir);
+	const outcome = await verifyApp(dir);
+	if (outcome.manifest.handle !== state.handle) throw new CliError(cli_app_handle_mismatch({
+		manifest: outcome.manifest.handle,
+		registered: state.handle
+	}));
+	for (const warning of outcome.warnings) io.err(cli_app_warning({ message: warning }));
+	const auth = await developerAuth(flags, dir, io);
+	const packageJson = existsSync(join(dir, "package.json")) ? readFileSync(join(dir, "package.json"), "utf8") : "{}";
+	const lockfile = existsSync(join(dir, "pnpm-lock.yaml")) ? readFileSync(join(dir, "pnpm-lock.yaml"), "utf8") : null;
+	io.out(cli_app_uploading({
+		size: formatMb(outcome.bundle.gzipBytes),
+		ui: String(outcome.ui.length)
+	}));
+	const version$1 = await devApi(auth, io, "PUT", `/apps/${state.appId}/versions`, {
+		manifest: outcome.raw,
+		packageJson,
+		lockfile,
+		server: Buffer.from(outcome.bundle.server, "utf8").toString("base64"),
+		ui: outcome.ui.map((file) => ({
+			path: file.path,
+			content: file.bytes.toString("base64")
+		})),
+		listing: {
+			icon: outcome.listing.icon ? {
+				contentType: outcome.listing.icon.contentType,
+				content: outcome.listing.icon.bytes.toString("base64")
+			} : null,
+			readme: outcome.listing.readme?.text ?? null
+		},
+		...flags.message ? { message: flags.message } : {}
+	});
+	printBuild(version$1, io);
+	if (version$1.status !== "READY") {
+		io.err(cli_app_build_failed({
+			stage: version$1.build?.failureStage ?? "-",
+			code: version$1.build?.errorCode ?? "-",
+			tail: version$1.build?.logTail ?? ""
+		}));
+		return 1;
+	}
+	io.out(cli_app_deploy_done({ number: String(version$1.number) }));
+	return 0;
+}
+async function appRelease(numberRaw, flags, io) {
+	const number = Number(numberRaw);
+	if (!Number.isInteger(number) || number < 1) throw new CliError(cli_app_version_number_required());
+	const dir = appDir(flags, io);
+	const state = requireState(dir);
+	const result = await devApi(await developerAuth(flags, dir, io), io, "POST", `/apps/${state.appId}/versions/${number}/release`);
+	io.out(cli_app_release_done({
+		number: String(result.version.number),
+		applied: String(result.applied),
+		pending: String(result.pendingReconsent)
+	}));
+	return 0;
+}
+async function appStatus(flags, io) {
+	const dir = appDir(flags, io);
+	const state = requireState(dir);
+	const auth = await developerAuth(flags, dir, io);
+	const [app, versions] = await Promise.all([devApi(auth, io, "GET", `/apps/${state.appId}`), devApi(auth, io, "GET", `/apps/${state.appId}/versions`)]);
+	io.out(cli_app_status({
+		handle: app.handle,
+		name: app.name,
+		appId: app.appId,
+		status: app.status,
+		current: app.currentVersionNumber === null ? "-" : String(app.currentVersionNumber),
+		active: String(app.installations.active),
+		pending: String(app.installations.pendingReconsent)
+	}));
+	for (const version$1 of versions.slice(0, 5)) io.out(`  v${version$1.number} ${version$1.status}${version$1.current ? " *" : ""} ${version$1.createdAt}${version$1.message ? ` — ${version$1.message}` : ""}${version$1.build?.errorCode ? ` (${version$1.build.errorCode})` : ""}`);
+	return 0;
+}
+const SINCE_RE = /^(\d+)([smhd])$/;
+function sinceMs(value) {
+	if (!value) return null;
+	const match = SINCE_RE.exec(value.trim());
+	if (!match) throw new CliError(cli_app_since_invalid({ value }));
+	const unit = {
+		s: 1e3,
+		m: 6e4,
+		h: 36e5,
+		d: 864e5
+	}[match[2]];
+	return Number(match[1]) * unit;
+}
+function invocationLine(row) {
+	const head = `${row.createdAt} ${row.outcome.padEnd(14)} ${row.kind}${row.eventType ? ` ${row.eventType}` : ""} ${row.storeName ?? row.storeId} v${row.versionNumber ?? "-"} ${row.durationMs}ms`;
+	const lines = row.logs.map((line) => `    [${line.level}] ${line.message}`);
+	if (row.errorMessage) lines.push(`    ! ${row.errorMessage.split("\n")[0]}`);
+	return [head, ...lines].join("\n");
+}
+async function appLogs(flags, io) {
+	const dir = appDir(flags, io);
+	const state = requireState(dir);
+	const auth = await developerAuth(flags, dir, io);
+	const since = sinceMs(flags.since);
+	const seen = /* @__PURE__ */ new Set();
+	const query = new URLSearchParams({ limit: "50" });
+	if (flags.store) query.set("storeId", flags.store);
+	const fetchOnce = async () => {
+		const rows = await devApi(auth, io, "GET", `/apps/${state.appId}/invocations?${query}`);
+		const now = io.now?.() ?? Date.now();
+		const fresh = rows.filter((row) => !seen.has(row.invocationId)).filter((row) => since === null || now - Date.parse(row.createdAt) <= since).reverse();
+		for (const row of fresh) {
+			seen.add(row.invocationId);
+			io.out(invocationLine(row));
+		}
+		return fresh.length;
+	};
+	const count = await fetchOnce();
+	if (!flags.tail) {
+		if (count === 0) io.out(cli_app_logs_empty());
+		return 0;
+	}
+	while (!io.signal?.aborted) {
+		await io.sleep(io.pollMs);
+		await fetchOnce();
+	}
+	return 0;
+}
+async function appSecret(action, name, flags, io) {
+	const dir = appDir(flags, io);
+	const state = requireState(dir);
+	const auth = await developerAuth(flags, dir, io);
+	const base = `/apps/${state.appId}/secrets`;
+	if (action === "list") {
+		const list = await devApi(auth, io, "GET", base);
+		if (list.length === 0) io.out(cli_app_secret_empty());
+		for (const item of list) io.out(`  ${item.name}  ${item.updatedAt}`);
+		return 0;
+	}
+	if (!name) throw new CliError(cli_app_secret_name_required());
+	if (action === "put") {
+		const value = (await (io.readStdin ?? readStdin)()).replace(/\r?\n$/, "");
+		if (!value) throw new CliError(cli_app_secret_value_required({ name }));
+		await devApi(auth, io, "PUT", `${base}/${encodeURIComponent(name)}`, { value });
+		io.out(cli_app_secret_saved({ name }));
+		return 0;
+	}
+	if (action === "delete") {
+		await devApi(auth, io, "DELETE", `${base}/${encodeURIComponent(name)}`);
+		io.out(cli_app_secret_deleted({ name }));
+		return 0;
+	}
+	throw new CliError(cli_app_subcommand_unknown({ command: `secret ${action ?? ""}`.trim() }));
+}
+function readStdin() {
+	return new Promise((resolve$1, reject) => {
+		let data = "";
+		process.stdin.setEncoding("utf8");
+		process.stdin.on("data", (chunk) => {
+			data += chunk;
+		});
+		process.stdin.once("end", () => resolve$1(data));
+		process.stdin.once("error", reject);
+	});
+}
+async function appDevStore(action, name, flags, io) {
+	const auth = await developerAuth(flags, appDir(flags, io), io, { accountOnly: true });
+	if (action === "list") {
+		const list = await devApi(auth, io, "GET", "/dev-stores");
+		if (list.length === 0) io.out(cli_app_dev_store_empty());
+		for (const store of list) io.out(`  ${store.storeId}  ${store.storeCode}  ${store.name}  ${store.status}`);
+		return 0;
+	}
+	if (action === "create") {
+		if (!name?.trim()) throw new CliError(cli_app_dev_store_name_required());
+		const store = await devApi(auth, io, "POST", "/dev-stores", { name: name.trim() });
+		io.out(cli_app_dev_store_created({
+			storeId: store.storeId,
+			name: store.name
+		}));
+		return 0;
+	}
+	throw new CliError(cli_app_subcommand_unknown({ command: `dev-store ${action ?? ""}`.trim() }));
+}
+/** `.env`의 `SAYREN_APP_SETTING_*`·`SAYREN_APP_SECRET_*` — 설정은 매니페스트 타입으로 바꾼다 */
+function localSettingsOf(manifest, env) {
+	const settings = {};
+	const secrets = {};
+	for (const [key, field] of Object.entries(manifest.settings ?? {})) {
+		const raw = env.get(`${SETTING_ENV_PREFIX}${key}`);
+		if (raw === void 0) {
+			if (field.default !== void 0) settings[key] = field.default;
+			continue;
+		}
+		settings[key] = field.type === "number" ? Number(raw) : field.type === "boolean" ? raw === "true" || raw === "1" : raw;
+	}
+	for (const [key, value] of env) if (key.startsWith(SECRET_ENV_PREFIX)) secrets[key.slice(18)] = value;
+	return {
+		settings,
+		secrets
+	};
+}
+let devSeq = 0;
+function devEnvelope(input) {
+	devSeq += 1;
+	return {
+		v: 1,
+		invocationId: `inv_dev_${Date.now().toString(36)}_${devSeq}`,
+		kind: input.kind,
+		installation: {
+			installationId: input.token?.installationId ?? "inst_dev",
+			appId: input.appId,
+			versionNumber: 0,
+			storeId: input.token?.storeId ?? "store_dev",
+			storeName: "(dev)",
+			apiBaseUrl: input.apiBaseUrl
+		},
+		token: input.token?.token ?? null,
+		settings: input.settings,
+		secrets: input.secrets,
+		...input.kind === "http" ? { user: {
+			userId: "user_dev",
+			role: "OWNER"
+		} } : {},
+		...input.event ? { event: {
+			id: `evt_dev_${devSeq}`,
+			type: input.event.type,
+			createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+			storeId: input.token?.storeId ?? "store_dev",
+			sequence: devSeq,
+			data: input.event.data
+		} } : {},
+		...input.request ? { request: input.request } : {}
+	};
+}
+async function invokeLocal(app, envelope) {
+	const res = await app.fetch(new Request("https://app.local/_invoke", {
+		method: "POST",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify(envelope)
+	}));
+	if (!res.ok) throw new CliError(cli_app_bundle_failed({ tail: await res.text() }));
+	return await res.json();
+}
+function printResult(label, result, io) {
+	io.out(`${label} ${result.outcome} ${result.durationMs}ms`);
+	for (const line of result.logs) io.out(`  [${line.level}] ${line.message}`);
+	if (result.errorMessage) io.err(`  ! ${result.errorMessage}`);
+}
+const MIME = {
+	".html": "text/html; charset=utf-8",
+	".js": "text/javascript; charset=utf-8",
+	".mjs": "text/javascript; charset=utf-8",
+	".css": "text/css; charset=utf-8",
+	".json": "application/json",
+	".svg": "image/svg+xml",
+	".png": "image/png",
+	".jpg": "image/jpeg",
+	".ico": "image/x-icon"
+};
+function readBody(req) {
+	return new Promise((resolve$1, reject) => {
+		const chunks = [];
+		req.on("data", (chunk) => chunks.push(chunk));
+		req.once("end", () => resolve$1(Buffer.concat(chunks).toString("utf8")));
+		req.once("error", reject);
+	});
+}
+/**
+* 로컬 실행(매뉴얼 「2. 로컬에서 실행하기」) — 번들을 이 프로세스에서 불러 `/_trigger`(이벤트)·`/_http/*`(HTTP 핸들러)·`/`(앱 화면)를 받는다.
+* 설치 토큰은 `POST …/dev-token`(1시간)으로 받고 만료 전에 다시 받는다. `--store`가 없으면 토큰 없이 돈다(`ctx.api`는 401).
+*/
+async function appDev(flags, io) {
+	const dir = appDir(flags, io);
+	const state = requireState(dir);
+	const { manifest } = loadManifest(dir);
+	const { app } = await loadBundle(dir, await bundleServer(dir));
+	const port = Number(flags.port ?? io.env.SAYREN_APP_PORT ?? APP_DEV_PORT);
+	if (!Number.isInteger(port) || port < 1 || port > 65535) throw new CliError(cli_app_port_invalid({ value: String(flags.port) }));
+	const storeId = flags.store?.trim() || io.env.SAYREN_STORE_ID?.trim() || null;
+	const auth = storeId ? await developerAuth(flags, dir, io) : null;
+	let token = null;
+	const ensureToken = async () => {
+		if (!auth || !storeId) return null;
+		const now = io.now?.() ?? Date.now();
+		if (token && Date.parse(token.expiresAt) - now > DEV_TOKEN_REFRESH_MARGIN_MS) return token;
+		token = await devApi(auth, io, "POST", `/apps/${state.appId}/dev-token`, { storeId });
+		return token;
+	};
+	await ensureToken();
+	const local = () => localSettingsOf(manifest, readEnvFile(dir));
+	const apiBaseUrl = `${state.apiOrigin}/v1`;
+	const uiRoot = join(dir, UI_DIR);
+	const handle = async (req, res) => {
+		const url = new URL(req.url ?? "/", `http://localhost:${port}`);
+		try {
+			if (req.method === "POST" && url.pathname === "/_trigger") {
+				const body = JSON.parse(await readBody(req) || "{}");
+				if (!body.type) {
+					res.writeHead(400, { "content-type": "application/json" });
+					res.end(JSON.stringify({ error: "TYPE_REQUIRED" }));
+					return;
+				}
+				const { settings, secrets } = local();
+				const result = await invokeLocal(app, devEnvelope({
+					kind: "event",
+					token: await ensureToken(),
+					apiBaseUrl,
+					appId: state.appId,
+					settings,
+					secrets,
+					event: {
+						type: body.type,
+						data: body.data ?? {}
+					}
+				}));
+				printResult(`[event] ${body.type}`, result, io);
+				res.writeHead(200, { "content-type": "application/json" });
+				res.end(JSON.stringify(result));
+				return;
+			}
+			if (url.pathname.startsWith("/_http/")) {
+				const headers = {};
+				for (const [key, value] of Object.entries(req.headers)) if (typeof value === "string" && key !== "host") headers[key] = value;
+				const method = (req.method ?? "GET").toUpperCase();
+				const { settings, secrets } = local();
+				const result = await invokeLocal(app, devEnvelope({
+					kind: "http",
+					token: await ensureToken(),
+					apiBaseUrl,
+					appId: state.appId,
+					settings,
+					secrets,
+					request: {
+						method,
+						path: `${url.pathname.slice(6)}${url.search}`,
+						headers,
+						body: method === "GET" ? null : await readBody(req)
+					}
+				}));
+				printResult(`[http] ${method} ${url.pathname}`, result, io);
+				if (!result.response) {
+					res.writeHead(500, { "content-type": "application/json" });
+					res.end(JSON.stringify({
+						error: result.outcome,
+						message: result.errorMessage
+					}));
+					return;
+				}
+				res.writeHead(result.response.status, result.response.headers);
+				res.end(result.response.body ?? "");
+				return;
+			}
+			const file = resolve(uiRoot, url.pathname === "/" ? "index.html" : url.pathname.slice(1));
+			if (file.startsWith(uiRoot) && existsSync(file) && statSync(file).isFile()) {
+				res.writeHead(200, { "content-type": MIME[extname(file)] ?? "application/octet-stream" });
+				res.end(readFileSync(file));
+				return;
+			}
+			res.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
+			res.end("not found");
+		} catch (error) {
+			io.err(cli_app_dev_error({ message: error instanceof Error ? error.message : String(error) }));
+			if (!res.headersSent) res.writeHead(500, { "content-type": "application/json" });
+			res.end(JSON.stringify({ error: "DEV_ERROR" }));
+		}
+	};
+	const serverHandle = createServer((req, res) => {
+		handle(req, res);
+	});
+	await new Promise((resolveListen, reject) => {
+		serverHandle.once("error", reject);
+		serverHandle.listen(port, "127.0.0.1", () => resolveListen());
+	});
+	io.out(cli_app_dev_listening({
+		port: String(port),
+		store: storeId ?? "-",
+		events: manifest.events.join(", ") || "-"
+	}));
+	await new Promise((resolveClose) => {
+		const stop = () => {
+			serverHandle.close();
+			resolveClose();
+		};
+		if (io.signal) if (io.signal.aborted) stop();
+		else io.signal.addEventListener("abort", stop, { once: true });
+		else {
+			process.once("SIGINT", stop);
+			process.once("SIGTERM", stop);
+		}
+	});
+	return 0;
+}
+async function appTrigger(type, flags, io) {
+	if (!type) throw new CliError(cli_app_trigger_type_required());
+	let data = {};
+	if (flags.data) try {
+		data = JSON.parse(flags.data);
+	} catch {
+		throw new CliError(cli_app_trigger_data_invalid());
+	}
+	if (flags.order) data = {
+		...data,
+		orderId: flags.order
+	};
+	const port = Number(flags.port ?? io.env.SAYREN_APP_PORT ?? APP_DEV_PORT);
+	const res = await io.fetch(`http://127.0.0.1:${port}/_trigger`, {
+		method: "POST",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify({
+			type,
+			data
+		})
+	});
+	if (!res.ok) throw new CliError(cli_app_trigger_failed({ status: String(res.status) }));
+	const result = await res.json();
+	printResult(`[event] ${type}`, result, io);
+	return result.outcome === "OK" ? 0 : 1;
+}
+async function appMain(positional, flags, io) {
+	const [sub, ...rest] = positional;
+	switch (sub) {
+		case "init": return appInit(rest[0], flags, io);
+		case "verify": return appVerify(flags, io);
+		case "deploy": return appDeploy(flags, io);
+		case "release": return appRelease(rest[0], flags, io);
+		case "status": return appStatus(flags, io);
+		case "logs": return appLogs(flags, io);
+		case "secret": return appSecret(rest[0], rest[1], flags, io);
+		case "dev-store": return appDevStore(rest[0], rest.slice(1).join(" ") || void 0, flags, io);
+		case "dev": return appDev(flags, io);
+		case "trigger": return appTrigger(rest[0], flags, io);
+		default: throw new CliError(cli_app_subcommand_unknown({ command: sub ?? "" }));
+	}
+}
+
 //#endregion
 //#region ../mcp/src/rules.ts
 /** 규칙의 심각도 — 없으면 `error` */
@@ -8427,6 +10239,16 @@ const RULES = [
 		templateFile: "src/lib/ordering.ts",
 		severity: "warning"
 	}),
+	defineRule({
+		id: "product-link",
+		title: mcp_rule_product_link_title,
+		why: mcp_rule_product_link_why,
+		fix: mcp_rule_product_link_fix,
+		example: mcp_rule_product_link_example,
+		doc: "/guides/order-numbers",
+		templateFile: "src/lib/product-path.ts",
+		severity: "warning"
+	}),
 	defineRule({
 		id: "server-only-import",
 		title: mcp_rule_server_only_import_title,
@@ -8522,6 +10344,8 @@ function verifySources(files, options = {}) {
 			inFile("custom-input-private", file, mcp_verify_custom_input_private({ where: where() }), pattern);
 			break;
 		}
+		const productIdLink = /params=\{\{\s*productId:\s*[\w.?]+\.productId\s*\}\}/;
+		if (/\/products\/\$productId/.test(file.content) && productIdLink.test(file.content)) inFile("product-link", file, mcp_verify_product_link(), productIdLink);
 		const analyticsFactory = /createAnalytics\(/;
 		if (isServer$1 && analyticsFactory.test(file.content)) inFile("analytics-start", file, mcp_verify_analytics_start_server_file(), analyticsFactory);
 		if (isServer$1 && /createStorefrontClient\(/.test(file.content) && !/analyticsIdsFromCookie|visitorId/.test(file.content)) inFile("analytics-ids", file, mcp_verify_analytics_ids(), /createStorefrontClient\(/);
@@ -10075,7 +11899,13 @@ const VALUE_FLAGS = new Set([
 	"api-origin",
 	"store",
 	"accounts-origin",
-	"template"
+	"template",
+	"key",
+	"name",
+	"port",
+	"since",
+	"data",
+	"order"
 ]);
 const BOOL_FLAGS = new Set([
 	"force",
@@ -10085,7 +11915,8 @@ const BOOL_FLAGS = new Set([
 	"help",
 	"version",
 	"device",
-	"paste"
+	"paste",
+	"tail"
 ]);
 function parseArgs(argv) {
 	const out = {
@@ -10097,7 +11928,11 @@ function parseArgs(argv) {
 		const arg = argv[i];
 		if (arg === "-h") out.flags.help = true;
 		else if (arg === "-v") out.flags.version = true;
-		else if (arg.startsWith("--")) {
+		else if (arg === "-m") {
+			const value = argv[++i];
+			if (value === void 0 || value.startsWith("--")) throw new CliError(cli_flag_value_required({ name: "message" }));
+			out.flags.message = value;
+		} else if (arg.startsWith("--")) {
 			const body = arg.slice(2);
 			const eq = body.indexOf("=");
 			const name = eq < 0 ? body : body.slice(0, eq);
@@ -10142,6 +11977,21 @@ async function main(argv, io) {
 		accountsOrigin: str(parsed.flags["accounts-origin"])
 	};
 	switch (parsed.command) {
+		case "app": return appMain(parsed.positional, {
+			token: str(parsed.flags.token),
+			key: str(parsed.flags.key),
+			apiOrigin: str(parsed.flags["api-origin"]),
+			dir: str(parsed.flags.dir),
+			store: str(parsed.flags.store),
+			message: str(parsed.flags.message),
+			name: str(parsed.flags.name),
+			port: str(parsed.flags.port),
+			since: str(parsed.flags.since),
+			tail: parsed.flags.tail === true,
+			data: str(parsed.flags.data),
+			order: str(parsed.flags.order),
+			yes: parsed.flags.yes === true
+		}, io);
 		case "init": return init({
 			...common,
 			template: str(parsed.flags.template),