@opentig/cli 0.0.0-reserved.0 → 0.1.2

package/dist/chunks/cli-bEPXlEpH.mjs

@@ -0,0 +1,1407 @@
+import { spawn, execFile } from "node:child_process";
+import process$1 from "node:process";
+import { w as writeFileAtomically, r as redactSensitiveText, n as normalizeRuntimePlatform, a as applicationName, runOpenTigServer } from "../server.mjs";
+import os from "node:os";
+import path from "node:path";
+import { access, rm, mkdir, cp, rename, writeFile, chmod, readFile, appendFile, stat } from "node:fs/promises";
+import { fileURLToPath } from "node:url";
+import { randomBytes } from "node:crypto";
+var QrCodeDataType = /* @__PURE__ */ ((QrCodeDataType2) => {
+  QrCodeDataType2[QrCodeDataType2["Border"] = -1] = "Border";
+  QrCodeDataType2[QrCodeDataType2["Data"] = 0] = "Data";
+  QrCodeDataType2[QrCodeDataType2["Function"] = 1] = "Function";
+  QrCodeDataType2[QrCodeDataType2["Position"] = 2] = "Position";
+  QrCodeDataType2[QrCodeDataType2["Timing"] = 3] = "Timing";
+  QrCodeDataType2[QrCodeDataType2["Alignment"] = 4] = "Alignment";
+  return QrCodeDataType2;
+})(QrCodeDataType || {});
+const LOW = [0, 1];
+const MEDIUM = [1, 0];
+const QUARTILE = [2, 3];
+const HIGH = [3, 2];
+const EccMap = {
+  L: LOW,
+  M: MEDIUM,
+  Q: QUARTILE,
+  H: HIGH
+};
+const NUMERIC_REGEX = /^\d*$/;
+const ALPHANUMERIC_REGEX = /^[A-Z0-9 $%*+./:-]*$/;
+const ALPHANUMERIC_CHARSET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ $%*+-./:";
+const MIN_VERSION = 1;
+const MAX_VERSION = 40;
+const PENALTY_N1 = 3;
+const PENALTY_N2 = 3;
+const PENALTY_N3 = 40;
+const PENALTY_N4 = 10;
+const ECC_CODEWORDS_PER_BLOCK = [
+  // Version: (note that index 0 is for padding, and is set to an illegal value)
+  // 0,  1,  2,  3,  4,  5,  6,  7,  8,  9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40    Error correction level
+  [-1, 7, 10, 15, 20, 26, 18, 20, 24, 30, 18, 20, 24, 26, 30, 22, 24, 28, 30, 28, 28, 28, 28, 30, 30, 26, 28, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30],
+  // Low
+  [-1, 10, 16, 26, 18, 24, 16, 18, 22, 22, 26, 30, 22, 22, 24, 24, 28, 28, 26, 26, 26, 26, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28],
+  // Medium
+  [-1, 13, 22, 18, 26, 18, 24, 18, 22, 20, 24, 28, 26, 24, 20, 30, 24, 28, 28, 26, 30, 28, 30, 30, 30, 30, 28, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30],
+  // Quartile
+  [-1, 17, 28, 22, 16, 22, 28, 26, 26, 24, 28, 24, 28, 22, 24, 24, 30, 28, 28, 26, 28, 30, 24, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30]
+  // High
+];
+const NUM_ERROR_CORRECTION_BLOCKS = [
+  // Version: (note that index 0 is for padding, and is set to an illegal value)
+  // 0, 1, 2, 3, 4, 5, 6, 7, 8, 9,10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40    Error correction level
+  [-1, 1, 1, 1, 1, 1, 2, 2, 2, 2, 4, 4, 4, 4, 4, 6, 6, 6, 6, 7, 8, 8, 9, 9, 10, 12, 12, 12, 13, 14, 15, 16, 17, 18, 19, 19, 20, 21, 22, 24, 25],
+  // Low
+  [-1, 1, 1, 1, 2, 2, 4, 4, 4, 5, 5, 5, 8, 9, 9, 10, 10, 11, 13, 14, 16, 17, 17, 18, 20, 21, 23, 25, 26, 28, 29, 31, 33, 35, 37, 38, 40, 43, 45, 47, 49],
+  // Medium
+  [-1, 1, 1, 2, 2, 4, 4, 6, 6, 8, 8, 8, 10, 12, 16, 12, 17, 16, 18, 21, 20, 23, 23, 25, 27, 29, 34, 34, 35, 38, 40, 43, 45, 48, 51, 53, 56, 59, 62, 65, 68],
+  // Quartile
+  [-1, 1, 1, 2, 4, 4, 4, 5, 6, 8, 8, 11, 11, 16, 16, 18, 16, 19, 21, 25, 25, 25, 34, 30, 32, 35, 37, 40, 42, 45, 48, 51, 54, 57, 60, 63, 66, 70, 74, 77, 81]
+  // High
+];
+class QrCode {
+  /* -- Constructor (low level) and fields -- */
+  // Creates a new QR Code with the given version number,
+  // error correction level, data codeword bytes, and mask number.
+  // This is a low-level API that most users should not use directly.
+  // A mid-level API is the encodeSegments() function.
+  constructor(version2, ecc, dataCodewords, msk) {
+    this.version = version2;
+    this.ecc = ecc;
+    if (version2 < MIN_VERSION || version2 > MAX_VERSION)
+      throw new RangeError("Version value out of range");
+    if (msk < -1 || msk > 7)
+      throw new RangeError("Mask value out of range");
+    this.size = version2 * 4 + 17;
+    const row = Array.from({ length: this.size }).fill(false);
+    for (let i = 0; i < this.size; i++) {
+      this.modules.push(row.slice());
+      this.types.push(row.map(() => 0));
+    }
+    this.drawFunctionPatterns();
+    const allCodewords = this.addEccAndInterleave(dataCodewords);
+    this.drawCodewords(allCodewords);
+    if (msk === -1) {
+      let minPenalty = 1e9;
+      for (let i = 0; i < 8; i++) {
+        this.applyMask(i);
+        this.drawFormatBits(i);
+        const penalty = this.getPenaltyScore();
+        if (penalty < minPenalty) {
+          msk = i;
+          minPenalty = penalty;
+        }
+        this.applyMask(i);
+      }
+    }
+    this.mask = msk;
+    this.applyMask(msk);
+    this.drawFormatBits(msk);
+  }
+  /* -- Fields -- */
+  // The width and height of this QR Code, measured in modules, between
+  // 21 and 177 (inclusive). This is equal to version * 4 + 17.
+  size;
+  // The index of the mask pattern used in this QR Code, which is between 0 and 7 (inclusive).
+  // Even if a QR Code is created with automatic masking requested (mask = -1),
+  // the resulting object still has a mask value between 0 and 7.
+  mask;
+  // The modules of this QR Code (false = light, true = dark).
+  // Immutable after constructor finishes. Accessed through getModule().
+  modules = [];
+  types = [];
+  /* -- Accessor methods -- */
+  // Returns the color of the module (pixel) at the given coordinates, which is false
+  // for light or true for dark. The top left corner has the coordinates (x=0, y=0).
+  // If the given coordinates are out of bounds, then false (light) is returned.
+  getModule(x, y) {
+    return x >= 0 && x < this.size && y >= 0 && y < this.size && this.modules[y][x];
+  }
+  /* -- Private helper methods for constructor: Drawing function modules -- */
+  // Reads this object's version field, and draws and marks all function modules.
+  drawFunctionPatterns() {
+    for (let i = 0; i < this.size; i++) {
+      this.setFunctionModule(6, i, i % 2 === 0, QrCodeDataType.Timing);
+      this.setFunctionModule(i, 6, i % 2 === 0, QrCodeDataType.Timing);
+    }
+    this.drawFinderPattern(3, 3);
+    this.drawFinderPattern(this.size - 4, 3);
+    this.drawFinderPattern(3, this.size - 4);
+    const alignPatPos = this.getAlignmentPatternPositions();
+    const numAlign = alignPatPos.length;
+    for (let i = 0; i < numAlign; i++) {
+      for (let j = 0; j < numAlign; j++) {
+        if (!(i === 0 && j === 0 || i === 0 && j === numAlign - 1 || i === numAlign - 1 && j === 0))
+          this.drawAlignmentPattern(alignPatPos[i], alignPatPos[j]);
+      }
+    }
+    this.drawFormatBits(0);
+    this.drawVersion();
+  }
+  // Draws two copies of the format bits (with its own error correction code)
+  // based on the given mask and this object's error correction level field.
+  drawFormatBits(mask) {
+    const data = this.ecc[1] << 3 | mask;
+    let rem = data;
+    for (let i = 0; i < 10; i++)
+      rem = rem << 1 ^ (rem >>> 9) * 1335;
+    const bits = (data << 10 | rem) ^ 21522;
+    for (let i = 0; i <= 5; i++)
+      this.setFunctionModule(8, i, getBit(bits, i));
+    this.setFunctionModule(8, 7, getBit(bits, 6));
+    this.setFunctionModule(8, 8, getBit(bits, 7));
+    this.setFunctionModule(7, 8, getBit(bits, 8));
+    for (let i = 9; i < 15; i++)
+      this.setFunctionModule(14 - i, 8, getBit(bits, i));
+    for (let i = 0; i < 8; i++)
+      this.setFunctionModule(this.size - 1 - i, 8, getBit(bits, i));
+    for (let i = 8; i < 15; i++)
+      this.setFunctionModule(8, this.size - 15 + i, getBit(bits, i));
+    this.setFunctionModule(8, this.size - 8, true);
+  }
+  // Draws two copies of the version bits (with its own error correction code),
+  // based on this object's version field, iff 7 <= version <= 40.
+  drawVersion() {
+    if (this.version < 7)
+      return;
+    let rem = this.version;
+    for (let i = 0; i < 12; i++)
+      rem = rem << 1 ^ (rem >>> 11) * 7973;
+    const bits = this.version << 12 | rem;
+    for (let i = 0; i < 18; i++) {
+      const color = getBit(bits, i);
+      const a = this.size - 11 + i % 3;
+      const b = Math.floor(i / 3);
+      this.setFunctionModule(a, b, color);
+      this.setFunctionModule(b, a, color);
+    }
+  }
+  // Draws a 9*9 finder pattern including the border separator,
+  // with the center module at (x, y). Modules can be out of bounds.
+  drawFinderPattern(x, y) {
+    for (let dy = -4; dy <= 4; dy++) {
+      for (let dx = -4; dx <= 4; dx++) {
+        const dist = Math.max(Math.abs(dx), Math.abs(dy));
+        const xx = x + dx;
+        const yy = y + dy;
+        if (xx >= 0 && xx < this.size && yy >= 0 && yy < this.size)
+          this.setFunctionModule(xx, yy, dist !== 2 && dist !== 4, QrCodeDataType.Position);
+      }
+    }
+  }
+  // Draws a 5*5 alignment pattern, with the center module
+  // at (x, y). All modules must be in bounds.
+  drawAlignmentPattern(x, y) {
+    for (let dy = -2; dy <= 2; dy++) {
+      for (let dx = -2; dx <= 2; dx++) {
+        this.setFunctionModule(
+          x + dx,
+          y + dy,
+          Math.max(Math.abs(dx), Math.abs(dy)) !== 1,
+          QrCodeDataType.Alignment
+        );
+      }
+    }
+  }
+  // Sets the color of a module and marks it as a function module.
+  // Only used by the constructor. Coordinates must be in bounds.
+  setFunctionModule(x, y, isDark, type = QrCodeDataType.Function) {
+    this.modules[y][x] = isDark;
+    this.types[y][x] = type;
+  }
+  /* -- Private helper methods for constructor: Codewords and masking -- */
+  // Returns a new byte string representing the given data with the appropriate error correction
+  // codewords appended to it, based on this object's version and error correction level.
+  addEccAndInterleave(data) {
+    const ver = this.version;
+    const ecl = this.ecc;
+    if (data.length !== getNumDataCodewords(ver, ecl))
+      throw new RangeError("Invalid argument");
+    const numBlocks = NUM_ERROR_CORRECTION_BLOCKS[ecl[0]][ver];
+    const blockEccLen = ECC_CODEWORDS_PER_BLOCK[ecl[0]][ver];
+    const rawCodewords = Math.floor(getNumRawDataModules(ver) / 8);
+    const numShortBlocks = numBlocks - rawCodewords % numBlocks;
+    const shortBlockLen = Math.floor(rawCodewords / numBlocks);
+    const blocks = [];
+    const rsDiv = reedSolomonComputeDivisor(blockEccLen);
+    for (let i = 0, k = 0; i < numBlocks; i++) {
+      const dat = data.slice(k, k + shortBlockLen - blockEccLen + (i < numShortBlocks ? 0 : 1));
+      k += dat.length;
+      const ecc = reedSolomonComputeRemainder(dat, rsDiv);
+      if (i < numShortBlocks)
+        dat.push(0);
+      blocks.push(dat.concat(ecc));
+    }
+    const result = [];
+    for (let i = 0; i < blocks[0].length; i++) {
+      blocks.forEach((block, j) => {
+        if (i !== shortBlockLen - blockEccLen || j >= numShortBlocks)
+          result.push(block[i]);
+      });
+    }
+    return result;
+  }
+  // Draws the given sequence of 8-bit codewords (data and error correction) onto the entire
+  // data area of this QR Code. Function modules need to be marked off before this is called.
+  drawCodewords(data) {
+    if (data.length !== Math.floor(getNumRawDataModules(this.version) / 8))
+      throw new RangeError("Invalid argument");
+    let i = 0;
+    for (let right = this.size - 1; right >= 1; right -= 2) {
+      if (right === 6)
+        right = 5;
+      for (let vert = 0; vert < this.size; vert++) {
+        for (let j = 0; j < 2; j++) {
+          const x = right - j;
+          const upward = (right + 1 & 2) === 0;
+          const y = upward ? this.size - 1 - vert : vert;
+          if (!this.types[y][x] && i < data.length * 8) {
+            this.modules[y][x] = getBit(data[i >>> 3], 7 - (i & 7));
+            i++;
+          }
+        }
+      }
+    }
+  }
+  // XORs the codeword modules in this QR Code with the given mask pattern.
+  // The function modules must be marked and the codeword bits must be drawn
+  // before masking. Due to the arithmetic of XOR, calling applyMask() with
+  // the same mask value a second time will undo the mask. A final well-formed
+  // QR Code needs exactly one (not zero, two, etc.) mask applied.
+  applyMask(mask) {
+    if (mask < 0 || mask > 7)
+      throw new RangeError("Mask value out of range");
+    for (let y = 0; y < this.size; y++) {
+      for (let x = 0; x < this.size; x++) {
+        let invert;
+        switch (mask) {
+          case 0:
+            invert = (x + y) % 2 === 0;
+            break;
+          case 1:
+            invert = y % 2 === 0;
+            break;
+          case 2:
+            invert = x % 3 === 0;
+            break;
+          case 3:
+            invert = (x + y) % 3 === 0;
+            break;
+          case 4:
+            invert = (Math.floor(x / 3) + Math.floor(y / 2)) % 2 === 0;
+            break;
+          case 5:
+            invert = x * y % 2 + x * y % 3 === 0;
+            break;
+          case 6:
+            invert = (x * y % 2 + x * y % 3) % 2 === 0;
+            break;
+          case 7:
+            invert = ((x + y) % 2 + x * y % 3) % 2 === 0;
+            break;
+          default:
+            throw new Error("Unreachable");
+        }
+        if (!this.types[y][x] && invert)
+          this.modules[y][x] = !this.modules[y][x];
+      }
+    }
+  }
+  // Calculates and returns the penalty score based on state of this QR Code's current modules.
+  // This is used by the automatic mask choice algorithm to find the mask pattern that yields the lowest score.
+  getPenaltyScore() {
+    let result = 0;
+    for (let y = 0; y < this.size; y++) {
+      let runColor = false;
+      let runX = 0;
+      const runHistory = [0, 0, 0, 0, 0, 0, 0];
+      for (let x = 0; x < this.size; x++) {
+        if (this.modules[y][x] === runColor) {
+          runX++;
+          if (runX === 5)
+            result += PENALTY_N1;
+          else if (runX > 5)
+            result++;
+        } else {
+          this.finderPenaltyAddHistory(runX, runHistory);
+          if (!runColor)
+            result += this.finderPenaltyCountPatterns(runHistory) * PENALTY_N3;
+          runColor = this.modules[y][x];
+          runX = 1;
+        }
+      }
+      result += this.finderPenaltyTerminateAndCount(runColor, runX, runHistory) * PENALTY_N3;
+    }
+    for (let x = 0; x < this.size; x++) {
+      let runColor = false;
+      let runY = 0;
+      const runHistory = [0, 0, 0, 0, 0, 0, 0];
+      for (let y = 0; y < this.size; y++) {
+        if (this.modules[y][x] === runColor) {
+          runY++;
+          if (runY === 5)
+            result += PENALTY_N1;
+          else if (runY > 5)
+            result++;
+        } else {
+          this.finderPenaltyAddHistory(runY, runHistory);
+          if (!runColor)
+            result += this.finderPenaltyCountPatterns(runHistory) * PENALTY_N3;
+          runColor = this.modules[y][x];
+          runY = 1;
+        }
+      }
+      result += this.finderPenaltyTerminateAndCount(runColor, runY, runHistory) * PENALTY_N3;
+    }
+    for (let y = 0; y < this.size - 1; y++) {
+      for (let x = 0; x < this.size - 1; x++) {
+        const color = this.modules[y][x];
+        if (color === this.modules[y][x + 1] && color === this.modules[y + 1][x] && color === this.modules[y + 1][x + 1]) {
+          result += PENALTY_N2;
+        }
+      }
+    }
+    let dark = 0;
+    for (const row of this.modules)
+      dark = row.reduce((sum, color) => sum + (color ? 1 : 0), dark);
+    const total = this.size * this.size;
+    const k = Math.ceil(Math.abs(dark * 20 - total * 10) / total) - 1;
+    result += k * PENALTY_N4;
+    return result;
+  }
+  /* -- Private helper functions -- */
+  // Returns an ascending list of positions of alignment patterns for this version number.
+  // Each position is in the range [0,177), and are used on both the x and y axes.
+  // This could be implemented as lookup table of 40 variable-length lists of integers.
+  getAlignmentPatternPositions() {
+    if (this.version === 1) {
+      return [];
+    } else {
+      const numAlign = Math.floor(this.version / 7) + 2;
+      const step = this.version === 32 ? 26 : Math.ceil((this.version * 4 + 4) / (numAlign * 2 - 2)) * 2;
+      const result = [6];
+      for (let pos = this.size - 7; result.length < numAlign; pos -= step)
+        result.splice(1, 0, pos);
+      return result;
+    }
+  }
+  // Can only be called immediately after a light run is added, and
+  // returns either 0, 1, or 2. A helper function for getPenaltyScore().
+  finderPenaltyCountPatterns(runHistory) {
+    const n = runHistory[1];
+    const core = n > 0 && runHistory[2] === n && runHistory[3] === n * 3 && runHistory[4] === n && runHistory[5] === n;
+    return (core && runHistory[0] >= n * 4 && runHistory[6] >= n ? 1 : 0) + (core && runHistory[6] >= n * 4 && runHistory[0] >= n ? 1 : 0);
+  }
+  // Must be called at the end of a line (row or column) of modules. A helper function for getPenaltyScore().
+  finderPenaltyTerminateAndCount(currentRunColor, currentRunLength, runHistory) {
+    if (currentRunColor) {
+      this.finderPenaltyAddHistory(currentRunLength, runHistory);
+      currentRunLength = 0;
+    }
+    currentRunLength += this.size;
+    this.finderPenaltyAddHistory(currentRunLength, runHistory);
+    return this.finderPenaltyCountPatterns(runHistory);
+  }
+  // Pushes the given value to the front and drops the last value. A helper function for getPenaltyScore().
+  finderPenaltyAddHistory(currentRunLength, runHistory) {
+    if (runHistory[0] === 0)
+      currentRunLength += this.size;
+    runHistory.pop();
+    runHistory.unshift(currentRunLength);
+  }
+}
+function appendBits(val, len, bb) {
+  if (len < 0 || len > 31 || val >>> len !== 0)
+    throw new RangeError("Value out of range");
+  for (let i = len - 1; i >= 0; i--)
+    bb.push(val >>> i & 1);
+}
+function getBit(x, i) {
+  return (x >>> i & 1) !== 0;
+}
+class QrSegment {
+  // Creates a new QR Code segment with the given attributes and data.
+  // The character count (numChars) must agree with the mode and the bit buffer length,
+  // but the constraint isn't checked. The given bit buffer is cloned and stored.
+  constructor(mode, numChars, bitData) {
+    this.mode = mode;
+    this.numChars = numChars;
+    this.bitData = bitData;
+    if (numChars < 0)
+      throw new RangeError("Invalid argument");
+    this.bitData = bitData.slice();
+  }
+  /* -- Methods -- */
+  // Returns a new copy of the data bits of this segment.
+  getData() {
+    return this.bitData.slice();
+  }
+}
+const MODE_NUMERIC = [1, 10, 12, 14];
+const MODE_ALPHANUMERIC = [2, 9, 11, 13];
+const MODE_BYTE = [4, 8, 16, 16];
+function numCharCountBits(mode, ver) {
+  return mode[Math.floor((ver + 7) / 17) + 1];
+}
+function makeBytes(data) {
+  const bb = [];
+  for (const b of data)
+    appendBits(b, 8, bb);
+  return new QrSegment(MODE_BYTE, data.length, bb);
+}
+function makeNumeric(digits) {
+  if (!isNumeric(digits))
+    throw new RangeError("String contains non-numeric characters");
+  const bb = [];
+  for (let i = 0; i < digits.length; ) {
+    const n = Math.min(digits.length - i, 3);
+    appendBits(Number.parseInt(digits.substring(i, i + n), 10), n * 3 + 1, bb);
+    i += n;
+  }
+  return new QrSegment(MODE_NUMERIC, digits.length, bb);
+}
+function makeAlphanumeric(text) {
+  if (!isAlphanumeric(text))
+    throw new RangeError("String contains unencodable characters in alphanumeric mode");
+  const bb = [];
+  let i;
+  for (i = 0; i + 2 <= text.length; i += 2) {
+    let temp = ALPHANUMERIC_CHARSET.indexOf(text.charAt(i)) * 45;
+    temp += ALPHANUMERIC_CHARSET.indexOf(text.charAt(i + 1));
+    appendBits(temp, 11, bb);
+  }
+  if (i < text.length)
+    appendBits(ALPHANUMERIC_CHARSET.indexOf(text.charAt(i)), 6, bb);
+  return new QrSegment(MODE_ALPHANUMERIC, text.length, bb);
+}
+function makeSegments(text) {
+  if (text === "")
+    return [];
+  else if (isNumeric(text))
+    return [makeNumeric(text)];
+  else if (isAlphanumeric(text))
+    return [makeAlphanumeric(text)];
+  else
+    return [makeBytes(toUtf8ByteArray(text))];
+}
+function isNumeric(text) {
+  return NUMERIC_REGEX.test(text);
+}
+function isAlphanumeric(text) {
+  return ALPHANUMERIC_REGEX.test(text);
+}
+function getTotalBits(segs, version2) {
+  let result = 0;
+  for (const seg of segs) {
+    const ccbits = numCharCountBits(seg.mode, version2);
+    if (seg.numChars >= 1 << ccbits)
+      return Number.POSITIVE_INFINITY;
+    result += 4 + ccbits + seg.bitData.length;
+  }
+  return result;
+}
+function toUtf8ByteArray(str) {
+  str = encodeURI(str);
+  const result = [];
+  for (let i = 0; i < str.length; i++) {
+    if (str.charAt(i) !== "%") {
+      result.push(str.charCodeAt(i));
+    } else {
+      result.push(Number.parseInt(str.substring(i + 1, i + 3), 16));
+      i += 2;
+    }
+  }
+  return result;
+}
+function getNumRawDataModules(ver) {
+  if (ver < MIN_VERSION || ver > MAX_VERSION)
+    throw new RangeError("Version number out of range");
+  let result = (16 * ver + 128) * ver + 64;
+  if (ver >= 2) {
+    const numAlign = Math.floor(ver / 7) + 2;
+    result -= (25 * numAlign - 10) * numAlign - 55;
+    if (ver >= 7)
+      result -= 36;
+  }
+  return result;
+}
+function getNumDataCodewords(ver, ecl) {
+  return Math.floor(getNumRawDataModules(ver) / 8) - ECC_CODEWORDS_PER_BLOCK[ecl[0]][ver] * NUM_ERROR_CORRECTION_BLOCKS[ecl[0]][ver];
+}
+function reedSolomonComputeDivisor(degree) {
+  if (degree < 1 || degree > 255)
+    throw new RangeError("Degree out of range");
+  const result = [];
+  for (let i = 0; i < degree - 1; i++)
+    result.push(0);
+  result.push(1);
+  let root = 1;
+  for (let i = 0; i < degree; i++) {
+    for (let j = 0; j < result.length; j++) {
+      result[j] = reedSolomonMultiply(result[j], root);
+      if (j + 1 < result.length)
+        result[j] ^= result[j + 1];
+    }
+    root = reedSolomonMultiply(root, 2);
+  }
+  return result;
+}
+function reedSolomonComputeRemainder(data, divisor) {
+  const result = divisor.map((_) => 0);
+  for (const b of data) {
+    const factor = b ^ result.shift();
+    result.push(0);
+    divisor.forEach((coef, i) => result[i] ^= reedSolomonMultiply(coef, factor));
+  }
+  return result;
+}
+function reedSolomonMultiply(x, y) {
+  if (x >>> 8 !== 0 || y >>> 8 !== 0)
+    throw new RangeError("Byte out of range");
+  let z = 0;
+  for (let i = 7; i >= 0; i--) {
+    z = z << 1 ^ (z >>> 7) * 285;
+    z ^= (y >>> i & 1) * x;
+  }
+  return z;
+}
+function encodeSegments(segs, ecl, minVersion = 1, maxVersion = 40, mask = -1, boostEcl = true) {
+  if (!(MIN_VERSION <= minVersion && minVersion <= maxVersion && maxVersion <= MAX_VERSION) || mask < -1 || mask > 7) {
+    throw new RangeError("Invalid value");
+  }
+  let version2;
+  let dataUsedBits;
+  for (version2 = minVersion; ; version2++) {
+    const dataCapacityBits2 = getNumDataCodewords(version2, ecl) * 8;
+    const usedBits = getTotalBits(segs, version2);
+    if (usedBits <= dataCapacityBits2) {
+      dataUsedBits = usedBits;
+      break;
+    }
+    if (version2 >= maxVersion)
+      throw new RangeError("Data too long");
+  }
+  for (const newEcl of [MEDIUM, QUARTILE, HIGH]) {
+    if (boostEcl && dataUsedBits <= getNumDataCodewords(version2, newEcl) * 8)
+      ecl = newEcl;
+  }
+  const bb = [];
+  for (const seg of segs) {
+    appendBits(seg.mode[0], 4, bb);
+    appendBits(seg.numChars, numCharCountBits(seg.mode, version2), bb);
+    for (const b of seg.getData())
+      bb.push(b);
+  }
+  const dataCapacityBits = getNumDataCodewords(version2, ecl) * 8;
+  appendBits(0, Math.min(4, dataCapacityBits - bb.length), bb);
+  appendBits(0, (8 - bb.length % 8) % 8, bb);
+  for (let padByte = 236; bb.length < dataCapacityBits; padByte ^= 236 ^ 17)
+    appendBits(padByte, 8, bb);
+  const dataCodewords = Array.from({ length: Math.ceil(bb.length / 8) }, () => 0);
+  bb.forEach((b, i) => dataCodewords[i >>> 3] |= b << 7 - (i & 7));
+  return new QrCode(version2, ecl, dataCodewords, mask);
+}
+function encode(data, options) {
+  const {
+    ecc = "L",
+    boostEcc = false,
+    minVersion = 1,
+    maxVersion = 40,
+    maskPattern = -1,
+    border = 1
+  } = options || {};
+  const segment = typeof data === "string" ? makeSegments(data) : Array.isArray(data) ? [makeBytes(data)] : void 0;
+  if (!segment)
+    throw new Error(`uqr only supports encoding string and binary data, but got: ${typeof data}`);
+  const qr = encodeSegments(
+    segment,
+    EccMap[ecc],
+    minVersion,
+    maxVersion,
+    maskPattern,
+    boostEcc
+  );
+  const result = addBorder({
+    version: qr.version,
+    maskPattern: qr.mask,
+    size: qr.size,
+    data: qr.modules,
+    types: qr.types
+  }, border);
+  if (options?.invert)
+    result.data = result.data.map((row) => row.map((mod) => !mod));
+  options?.onEncoded?.(result);
+  return result;
+}
+function addBorder(input, border = 1) {
+  if (!border)
+    return input;
+  const { size } = input;
+  const newSize = size + border * 2;
+  input.size = newSize;
+  input.data.forEach((row) => {
+    for (let i = 0; i < border; i++) {
+      row.unshift(false);
+      row.push(false);
+    }
+  });
+  for (let i = 0; i < border; i++) {
+    input.data.unshift(Array.from({ length: newSize }, (_) => false));
+    input.data.push(Array.from({ length: newSize }, (_) => false));
+  }
+  const b = QrCodeDataType.Border;
+  input.types.forEach((row) => {
+    for (let i = 0; i < border; i++) {
+      row.unshift(b);
+      row.push(b);
+    }
+  });
+  for (let i = 0; i < border; i++) {
+    input.types.unshift(Array.from({ length: newSize }, (_) => b));
+    input.types.push(Array.from({ length: newSize }, (_) => b));
+  }
+  return input;
+}
+function getDataAt(data, x, y, defaults = false) {
+  if (x < 0 || y < 0 || x >= data.length || y >= data.length)
+    return defaults;
+  return data[y][x];
+}
+function renderUnicodeCompact(data, options = {}) {
+  const palette = {
+    WHITE_ALL: "█",
+    WHITE_BLACK: "▀",
+    BLACK_WHITE: "▄",
+    BLACK_ALL: " "
+  };
+  const result = encode(data, options);
+  const WHITE = false;
+  const BLACK = true;
+  const at = (x, y) => getDataAt(result.data, x, y, true);
+  const lines = [];
+  let line = "";
+  for (let row = 0; row < result.size; row += 2) {
+    for (let col = 0; col < result.size; col++) {
+      if (at(col, row) === WHITE && at(col, row + 1) === WHITE)
+        line += palette.WHITE_ALL;
+      else if (at(col, row) === WHITE && at(col, row + 1) === BLACK)
+        line += palette.WHITE_BLACK;
+      else if (at(col, row) === BLACK && at(col, row + 1) === WHITE)
+        line += palette.BLACK_WHITE;
+      else
+        line += palette.BLACK_ALL;
+    }
+    lines.push(line);
+    line = "";
+  }
+  return lines.join("\n");
+}
+function browserCommand(url, platform = process.platform) {
+  if (platform === "win32") return { executable: "rundll32.exe", args: ["url.dll,FileProtocolHandler", url] };
+  if (platform === "darwin") return { executable: "open", args: [url] };
+  return { executable: "xdg-open", args: [url] };
+}
+function openSystemBrowser(url, launch = spawn, platform = process.platform) {
+  const command = browserCommand(url, platform);
+  return new Promise((resolve, reject) => {
+    let child;
+    try {
+      child = launch(command.executable, command.args, {
+        detached: true,
+        shell: false,
+        stdio: "ignore",
+        windowsHide: true
+      });
+    } catch (error) {
+      reject(error);
+      return;
+    }
+    child.once("error", reject);
+    child.once("spawn", () => {
+      child.unref();
+      resolve();
+    });
+  });
+}
+const DEFAULT_SERVER_HOST = "127.0.0.1";
+const DEFAULT_SERVER_PORT = 6767;
+class CliUsageError extends Error {
+  exitCode = 2;
+  constructor(message) {
+    super(message);
+    this.name = "CliUsageError";
+  }
+}
+function parseCliArguments(args, environment = process.env, currentDirectory = process.cwd(), homeDirectory = os.homedir()) {
+  let command = "start";
+  let commandSelected = false;
+  let serviceAction = null;
+  let hostValue;
+  let portValue;
+  let homeValue;
+  let noBrowser = false;
+  let optionsEnded = false;
+  for (let index = 0; index < args.length; index += 1) {
+    const argument = args[index];
+    if (!optionsEnded && argument === "--") {
+      optionsEnded = true;
+      continue;
+    }
+    if (!optionsEnded && (argument === "--help" || argument === "-h")) return terminalConfig("help", homeDirectory);
+    if (!optionsEnded && (argument === "--version" || argument === "-v")) return terminalConfig("version", homeDirectory);
+    if (!optionsEnded && argument === "--no-browser") {
+      noBrowser = true;
+      continue;
+    }
+    if (!optionsEnded && argument.startsWith("--")) {
+      const [name, inline] = splitOption(argument);
+      const value = inline ?? args[++index];
+      if (value === void 0 || value.startsWith("--")) throw new CliUsageError(`Missing value for ${name}.`);
+      if (name === "--host") hostValue = value;
+      else if (name === "--port") portValue = value;
+      else if (name === "--home") homeValue = value;
+      else throw new CliUsageError(`Unknown option: ${name}.`);
+      continue;
+    }
+    if (!commandSelected && isCommand(argument)) {
+      if (argument === "help" || argument === "version") {
+        return terminalConfig(argument, homeDirectory);
+      }
+      command = argument;
+      commandSelected = true;
+      continue;
+    }
+    if (command === "service" && serviceAction === null && isServiceAction(argument)) {
+      serviceAction = argument;
+      continue;
+    }
+    throw new CliUsageError(`Unexpected argument: ${argument}. Add and select repositories from the OpenTig web UI.`);
+  }
+  if (command === "pair" && (hostValue !== void 0 || portValue !== void 0 || noBrowser)) {
+    throw new CliUsageError("The pair command only accepts --home.");
+  }
+  if (command === "service" && serviceAction === null) throw new CliUsageError("The service command requires install, status, or uninstall.");
+  if (command === "service" && serviceAction !== "install" && (hostValue !== void 0 || portValue !== void 0 || noBrowser)) {
+    throw new CliUsageError(`The service ${serviceAction} command only accepts --home.`);
+  }
+  if (command === "pair") {
+    return {
+      command,
+      serviceAction: null,
+      host: DEFAULT_SERVER_HOST,
+      port: DEFAULT_SERVER_PORT,
+      home: resolvePath(homeValue ?? environment.OPENTIG_HOME ?? path.join(homeDirectory, ".opentig"), currentDirectory, "home"),
+      openBrowser: false
+    };
+  }
+  const host = validateHost(hostValue ?? environment.OPENTIG_HOST ?? DEFAULT_SERVER_HOST);
+  const environmentPort = environment.OPENTIG_PORT;
+  const port = validatePort(portValue ?? environmentPort ?? String(DEFAULT_SERVER_PORT));
+  const home = resolvePath(homeValue ?? environment.OPENTIG_HOME ?? path.join(homeDirectory, ".opentig"), currentDirectory, "home");
+  return {
+    command,
+    serviceAction,
+    host,
+    port,
+    home,
+    openBrowser: command === "start" && !noBrowser
+  };
+}
+function cliHelp(version2) {
+  return `OpenTig ${version2}
+
+Usage:
+  opentig [options]
+  opentig start [options]
+  opentig serve [options]
+  opentig pair [--home <path>]
+  opentig service <install|status|uninstall> [options]
+  opentig help
+  opentig version
+
+Commands:
+  start       Start OpenTig and open the one-use pairing link (default)
+  serve       Start OpenTig without opening a browser; ideal for servers
+  pair        Print a fresh five-minute code/link for a running server
+  service     Explicitly manage startup at boot (Linux/systemd only)
+  help        Show this help
+  version     Show the OpenTig version
+
+Options:
+  --host <host>       Listener host (default: ${DEFAULT_SERVER_HOST}; env: OPENTIG_HOST)
+  --port <port>       Listener port (default: ${DEFAULT_SERVER_PORT}; env: OPENTIG_PORT)
+  --home <path>       Data directory (default: ~/.opentig; env: OPENTIG_HOME)
+  --no-browser        Do not open a browser in start mode
+  -h, --help          Show help
+  -v, --version       Show version
+
+Examples:
+  opentig start
+  opentig serve
+  opentig serve --host 127.0.0.1 --port 6767
+  opentig pair --home ~/.opentig
+  opentig service install --host 127.0.0.1 --port 6767
+  opentig service status
+
+Repositories:
+  Add, open, and switch server-side Git repositories from the web UI. The CLI
+  starts one OpenTig instance and is never scoped to a project directory.
+
+Pairing and remote access:
+  Every browser needs the printed five-minute, one-use code. Open the printed
+  link, or open https://your-domain.example/pair and paste the code there.
+  A same-machine HTTPS tunnel can point directly to http://127.0.0.1:6767;
+  no public URL needs to be registered in OpenTig. Use --host 0.0.0.0 only for
+  a trusted LAN/VPN; pairing is still required.
+
+Runtime behavior:
+  The configured port is never changed silently. If it is occupied, OpenTig
+  exits and asks you to stop that process or choose another --port. SIGINT and
+  SIGTERM shut the server down cleanly. npx and bunx never install a service;
+  service installation is an explicit Linux/systemd action.
+
+Requirements: Node.js 24 or later and Git. Plain bunx launches the Node shebang;
+running OpenTig with the Bun runtime itself is not supported.`;
+}
+function terminalConfig(command, home) {
+  return {
+    command,
+    serviceAction: null,
+    host: DEFAULT_SERVER_HOST,
+    port: DEFAULT_SERVER_PORT,
+    home: path.resolve(home, ".opentig"),
+    openBrowser: false
+  };
+}
+function splitOption(argument) {
+  const separator = argument.indexOf("=");
+  return separator < 0 ? [argument, void 0] : [argument.slice(0, separator), argument.slice(separator + 1)];
+}
+function isCommand(value) {
+  return value === "start" || value === "serve" || value === "pair" || value === "service" || value === "help" || value === "version";
+}
+function isServiceAction(value) {
+  return value === "install" || value === "status" || value === "uninstall";
+}
+function validateHost(value) {
+  const normalized = value.trim();
+  if (!normalized || normalized.length > 255 || /[\s/?#@\\]/.test(normalized)) throw new CliUsageError("Invalid host.");
+  return normalized;
+}
+function validatePort(value) {
+  if (!/^\d+$/.test(value)) throw new CliUsageError("Port must be an integer between 1 and 65535.");
+  const port = Number(value);
+  if (!Number.isSafeInteger(port) || port < 1 || port > 65535) throw new CliUsageError("Port must be an integer between 1 and 65535.");
+  return port;
+}
+function resolvePath(value, currentDirectory, label) {
+  if (!value || value.includes("\0")) throw new CliUsageError(`Invalid ${label}.`);
+  return path.resolve(currentDirectory, value);
+}
+const version = "0.1.2";
+const packageMetadata = {
+  version
+};
+const OPEN_TIG_APP_VERSION = packageMetadata.version;
+const UNIT_NAME = "opentig.service";
+async function manageCliService(config, io) {
+  if (process$1.platform !== "linux") {
+    throw new Error("Background service management currently supports Linux with systemd. On this platform, start OpenTig with your preferred service manager.");
+  }
+  const action = config.serviceAction;
+  if (!action) throw new Error("A service action is required.");
+  const unitPath = path.join(os.homedir(), ".config", "systemd", "user", UNIT_NAME);
+  if (action === "status") return serviceStatus(unitPath, io);
+  if (action === "uninstall") return uninstallService(config.home, unitPath, io);
+  return installService(config, unitPath, io);
+}
+async function installService(config, unitPath, io) {
+  const packageRoot = await findPackageRoot(fileURLToPath(import.meta.url));
+  await assertPackageBuild(packageRoot);
+  const serviceRoot = path.join(config.home, "service");
+  const target = path.join(serviceRoot, `app-${OPEN_TIG_APP_VERSION}`);
+  const temporary = path.join(serviceRoot, `.install-${process$1.pid}-${Date.now()}`);
+  await mkdir(serviceRoot, { recursive: true, mode: 448 });
+  await rm(temporary, { recursive: true, force: true });
+  try {
+    await mkdir(temporary, { recursive: true, mode: 448 });
+    await cp(path.join(packageRoot, "dist"), path.join(temporary, "dist"), { recursive: true, force: true });
+    for (const name of ["package.json", "README.md", "LICENSE", "THIRD_PARTY_NOTICES.md"]) {
+      await cp(path.join(packageRoot, name), path.join(temporary, name), { force: true });
+    }
+    await installProductionDependencies(temporary);
+    await rm(target, { recursive: true, force: true });
+    await rename(temporary, target);
+  } catch (error) {
+    await rm(temporary, { recursive: true, force: true });
+    throw error;
+  }
+  const unit = renderSystemdUnit({
+    nodeExecutable: process$1.execPath,
+    cliEntrypoint: path.join(target, "dist", "bin.mjs"),
+    host: config.host,
+    port: config.port,
+    home: config.home
+  });
+  await mkdir(path.dirname(unitPath), { recursive: true, mode: 448 });
+  const temporaryUnit = `${unitPath}.${process$1.pid}.tmp`;
+  await writeFile(temporaryUnit, unit, { encoding: "utf8", mode: 384 });
+  await rename(temporaryUnit, unitPath);
+  await chmod(unitPath, 384);
+  await runRequired("systemctl", ["--user", "daemon-reload"]);
+  await runRequired("systemctl", ["--user", "enable", "--now", UNIT_NAME]);
+  await runRequired("loginctl", ["enable-linger"]);
+  io.out(`OpenTig service installed and started on ${config.host}:${config.port}.`);
+  io.out(`Unit: ${unitPath}`);
+  io.out(`Pair another browser with: opentig pair --home ${config.home}`);
+  return 0;
+}
+async function serviceStatus(unitPath, io) {
+  try {
+    await access(unitPath);
+  } catch {
+    io.out("OpenTig service is not installed.");
+    return 1;
+  }
+  const enabled = await run("systemctl", ["--user", "is-enabled", UNIT_NAME]);
+  const active = await run("systemctl", ["--user", "is-active", UNIT_NAME]);
+  io.out(`OpenTig service: ${active.stdout.trim() || "unknown"} (${enabled.stdout.trim() || "unknown"}).`);
+  io.out(`Unit: ${unitPath}`);
+  return active.code === 0 ? 0 : 1;
+}
+async function uninstallService(home, unitPath, io) {
+  await run("systemctl", ["--user", "disable", "--now", UNIT_NAME]);
+  await rm(unitPath, { force: true });
+  await runRequired("systemctl", ["--user", "daemon-reload"]);
+  await rm(path.join(home, "service"), { recursive: true, force: true });
+  io.out("OpenTig service removed. Repository settings and paired sessions were kept.");
+  return 0;
+}
+function renderSystemdUnit(input) {
+  const args = [
+    input.nodeExecutable,
+    input.cliEntrypoint,
+    "serve",
+    "--host",
+    input.host,
+    "--port",
+    String(input.port),
+    "--home",
+    input.home
+  ];
+  return `[Unit]
+Description=OpenTig browser Git client
+After=network.target
+
+[Service]
+Type=simple
+WorkingDirectory=${systemdQuote(input.home)}
+ExecStart=${args.map(systemdQuote).join(" ")}
+Environment=NODE_ENV=production
+Restart=on-failure
+RestartSec=3
+KillSignal=SIGTERM
+TimeoutStopSec=10
+
+[Install]
+WantedBy=default.target
+`;
+}
+function systemdQuote(value) {
+  if (value.includes("\0") || value.includes("\r") || value.includes("\n")) throw new Error("Service paths and arguments cannot contain control characters.");
+  return `"${value.replaceAll("%", "%%").replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
+}
+async function assertPackageBuild(packageRoot) {
+  await Promise.all([
+    access(path.join(packageRoot, "dist", "bin.mjs")),
+    access(path.join(packageRoot, "dist", "client", "index.html")),
+    readFile(path.join(packageRoot, "package.json"), "utf8")
+  ]).catch(() => {
+    throw new Error("The OpenTig package is incomplete and cannot be installed as a service.");
+  });
+}
+async function findPackageRoot(modulePath) {
+  let directory = path.dirname(modulePath);
+  for (let depth = 0; depth < 4; depth += 1) {
+    try {
+      await Promise.all([
+        access(path.join(directory, "package.json")),
+        access(path.join(directory, "dist", "bin.mjs"))
+      ]);
+      return directory;
+    } catch {
+    }
+    const parent = path.dirname(directory);
+    if (parent === directory) break;
+    directory = parent;
+  }
+  throw new Error("Could not locate the installed OpenTig package.");
+}
+async function installProductionDependencies(directory) {
+  const npmCli = process$1.env.npm_execpath;
+  if (npmCli) {
+    await runRequired(process$1.execPath, [npmCli, "install", "--omit=dev", "--ignore-scripts", "--no-audit", "--no-fund"], directory);
+    return;
+  }
+  await runRequired("npm", ["install", "--omit=dev", "--ignore-scripts", "--no-audit", "--no-fund"], directory);
+}
+function runRequired(command, args, cwd) {
+  return run(command, args, cwd).then((result) => {
+    if (result.code !== 0) throw new Error(`${command} failed: ${result.stderr.trim() || result.stdout.trim() || `exit code ${result.code}`}`);
+  });
+}
+function run(command, args, cwd) {
+  return new Promise((resolve, reject) => {
+    execFile(command, args, { cwd, timeout: 12e4, windowsHide: true }, (error, stdout, stderr) => {
+      const code = typeof error?.code === "number" ? error.code : error ? 1 : 0;
+      if (error && error.code === "ENOENT") return reject(new Error(`${command} is required but was not found.`));
+      resolve({ code, stdout, stderr });
+    });
+  });
+}
+const RUNTIME_STATE_VERSION = 1;
+function resolveCliPaths(home) {
+  const resolved = path.resolve(home);
+  const serverData = path.join(resolved, "server");
+  const logs = path.join(resolved, "logs");
+  return {
+    home: resolved,
+    settings: path.join(resolved, "settings.json"),
+    aiLog: path.join(resolved, "ai-log.jsonl"),
+    problems: path.join(resolved, "problems.jsonl"),
+    serverData,
+    logs,
+    serverLog: path.join(logs, "server.log"),
+    runtimeState: path.join(resolved, "runtime.json"),
+    adminToken: path.join(serverData, "admin-token")
+  };
+}
+async function prepareCliHome(paths) {
+  await mkdir(paths.home, { recursive: true, mode: 448 });
+  await chmod(paths.home, 448);
+  await Promise.all([
+    mkdir(paths.serverData, { recursive: true, mode: 448 }),
+    mkdir(paths.logs, { recursive: true, mode: 448 })
+  ]);
+  await Promise.all([chmod(paths.serverData, 448), chmod(paths.logs, 448)]);
+}
+async function loadOrCreateAdminToken(filePath) {
+  try {
+    return await readAdminToken(filePath);
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+  const token = randomBytes(32).toString("base64url");
+  await writeFileAtomically(filePath, `${token}
+`, { directoryMode: 448 });
+  return token;
+}
+async function readAdminToken(filePath) {
+  const token = (await readFile(filePath, "utf8")).trim();
+  if (!isToken(token)) throw new Error("OpenTig local admin credential is corrupt.");
+  await chmod(filePath, 384);
+  return token;
+}
+async function writeRuntimeState(filePath, state) {
+  await writeFileAtomically(
+    filePath,
+    `${JSON.stringify({ version: RUNTIME_STATE_VERSION, ...state }, null, 2)}
+`,
+    { parseJson: true, directoryMode: 448 }
+  );
+}
+async function readRuntimeState(filePath) {
+  let value;
+  try {
+    value = JSON.parse(await readFile(filePath, "utf8"));
+  } catch (error) {
+    if (error.code === "ENOENT") throw new Error("No running OpenTig server was found for this home.");
+    throw new Error("OpenTig runtime state is unreadable.", { cause: error });
+  }
+  if (!isRuntimeState(value)) throw new Error("OpenTig runtime state is invalid.");
+  await chmod(filePath, 384);
+  return value;
+}
+async function clearRuntimeState(filePath, instanceId) {
+  try {
+    const state = await readRuntimeState(filePath);
+    if (state.instanceId === instanceId) await rm(filePath, { force: true });
+  } catch (error) {
+    if (!(error instanceof Error && error.message === "No running OpenTig server was found for this home.")) throw error;
+  }
+}
+function newInstanceId() {
+  return randomBytes(24).toString("base64url");
+}
+function isToken(value) {
+  return /^[A-Za-z0-9_-]{43}$/.test(value);
+}
+function isRuntimeState(value) {
+  const state = value;
+  return Boolean(state && state.version === RUNTIME_STATE_VERSION && Number.isSafeInteger(state.pid) && Number(state.pid) > 0 && typeof state.host === "string" && state.host.length > 0 && state.host.length <= 255 && Number.isSafeInteger(state.port) && Number(state.port) > 0 && Number(state.port) <= 65535 && Number.isSafeInteger(state.protocolVersion) && Number(state.protocolVersion) > 0 && typeof state.appVersion === "string" && state.appVersion.length > 0 && state.appVersion.length <= 128 && typeof state.instanceId === "string" && /^[A-Za-z0-9_-]{32}$/.test(state.instanceId) && typeof state.startedAt === "string" && !Number.isNaN(Date.parse(state.startedAt)));
+}
+const MAX_BYTES = 1024 * 1024;
+const BACKUPS = 3;
+class CliServerLog {
+  constructor(filePath) {
+    this.filePath = filePath;
+  }
+  filePath;
+  queue = Promise.resolve();
+  logger = (level, message) => {
+    const line = `${(/* @__PURE__ */ new Date()).toISOString()} [${level}] ${redactSensitiveText(message)}
+`;
+    this.queue = this.queue.then(async () => {
+      await mkdir(path.dirname(this.filePath), { recursive: true, mode: 448 });
+      if (await wouldExceed(this.filePath, Buffer.byteLength(line))) await this.rotate();
+      await appendFile(this.filePath, line, { encoding: "utf8", mode: 384 });
+    }).catch(() => void 0);
+  };
+  close() {
+    return this.queue;
+  }
+  async rotate() {
+    await rm(`${this.filePath}.${BACKUPS}`, { force: true });
+    for (let index = BACKUPS - 1; index >= 1; index -= 1) {
+      await moveIfPresent(`${this.filePath}.${index}`, `${this.filePath}.${index + 1}`);
+    }
+    await moveIfPresent(this.filePath, `${this.filePath}.1`);
+  }
+}
+async function wouldExceed(filePath, incomingBytes) {
+  try {
+    return (await stat(filePath)).size + incomingBytes > MAX_BYTES;
+  } catch (error) {
+    if (error.code === "ENOENT") return false;
+    throw error;
+  }
+}
+async function moveIfPresent(source, target) {
+  try {
+    await rename(source, target);
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+}
+const SHUTDOWN_TIMEOUT_MS = 8e3;
+const consoleIo = {
+  out: (value) => process$1.stdout.write(`${value}
+`),
+  error: (value) => process$1.stderr.write(`${value}
+`)
+};
+async function runCli(args, environment = process$1.env, io = consoleIo, profile = "production") {
+  try {
+    assertNodeVersion();
+    const config = parseCliArguments(args, environment);
+    if (config.command === "help") {
+      io.out(cliHelp(OPEN_TIG_APP_VERSION));
+      return 0;
+    }
+    if (config.command === "version") {
+      io.out(OPEN_TIG_APP_VERSION);
+      return 0;
+    }
+    if (config.command === "service") return await manageCliService(config, io);
+    if (config.command === "pair") return await pairRunningServer(config, io, profile);
+    return await startCliServer(config, io, profile);
+  } catch (error) {
+    const message = redactSensitiveText(error instanceof Error ? error.message : String(error));
+    io.error(`OpenTig: ${message}`);
+    if (error instanceof CliUsageError) io.error('Run "opentig --help" for usage.');
+    return error instanceof CliUsageError ? error.exitCode : 1;
+  }
+}
+async function startCliServer(config, io, profile) {
+  await assertGitAvailable();
+  const paths = resolveCliPaths(config.home);
+  await prepareCliHome(paths);
+  await refuseActiveRuntime(paths.runtimeState, profile);
+  const adminToken = await loadOrCreateAdminToken(paths.adminToken);
+  const instanceId = newInstanceId();
+  const log = new CliServerLog(paths.serverLog);
+  let server = null;
+  try {
+    server = await startOnConfiguredPort({
+      appVersion: OPEN_TIG_APP_VERSION,
+      profile,
+      auth: { consumeDesktopSecret: () => false },
+      settingsPath: paths.settings,
+      aiLogPath: paths.aiLog,
+      serverDataPath: paths.serverData,
+      platform: normalizeRuntimePlatform(process$1.platform),
+      host: config.host,
+      mode: "web-access",
+      logger: log.logger,
+      admin: { token: adminToken, instanceId }
+    }, config.port);
+    await writeRuntimeState(paths.runtimeState, {
+      pid: process$1.pid,
+      host: config.host,
+      port: server.port,
+      protocolVersion: server.protocolVersion,
+      appVersion: server.appVersion,
+      instanceId,
+      startedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    log.logger("info", `OpenTig CLI ready on ${publicOrigin(config.host, server.port)}.`);
+    const origin = publicOrigin(config.host, server.port);
+    const pairing = rewritePairingOrigin(server.createPairingLink(), origin);
+    io.out(`${applicationName(profile)} ${server.appVersion} is ready.`);
+    if (profile === "dev") io.out(`Dev data directory: ${paths.home}`);
+    io.out(`Connection URL: ${origin}`);
+    printPairing(pairing, io, config.command === "serve");
+    if (!isLoopbackHost(config.host)) {
+      io.error("WARNING: This listener grants owner-level access as your OS user. Use only a trusted LAN/VPN or an HTTPS/SSH tunnel; never expose it directly to the public Internet.");
+      if (config.host === "0.0.0.0" || config.host === "::") {
+        io.error("Replace the loopback host in the printed link with a trusted address of this machine for another device.");
+      }
+    }
+    if (config.openBrowser) {
+      await openSystemBrowser(pairing.url).catch(() => {
+        io.error("Could not open the system browser. Open the one-time pairing link shown above manually.");
+      });
+    }
+    return await waitForShutdown(server, async () => {
+      await clearRuntimeState(paths.runtimeState, instanceId);
+      await log.close();
+    }, io);
+  } catch (error) {
+    if (server) await server.close().catch(() => void 0);
+    await clearRuntimeState(paths.runtimeState, instanceId).catch(() => void 0);
+    await log.close();
+    throw error;
+  }
+}
+async function pairRunningServer(config, io, profile) {
+  const paths = resolveCliPaths(config.home);
+  const state = await readRuntimeState(paths.runtimeState);
+  if (!isProcessRunning(state.pid)) throw new Error("OpenTig runtime state is stale; its process is not running.");
+  const origin = publicOrigin(state.host, state.port);
+  const adminOrigin = localAdminOrigin(state);
+  const ready = await fetch(`${adminOrigin}/readyz`, { signal: AbortSignal.timeout(3e3) });
+  if (!ready.ok) throw new Error("The running OpenTig server is not ready.");
+  const identity = await ready.json();
+  if (identity.status !== "ready" || identity.protocolVersion !== state.protocolVersion || identity.appVersion !== state.appVersion || profile === "dev" && identity.profile !== "dev") {
+    throw new Error("OpenTig runtime state does not match the running server.");
+  }
+  const adminToken = await readAdminToken(paths.adminToken).catch(() => {
+    throw new Error("OpenTig local admin credential is missing or unreadable.");
+  });
+  const response = await fetch(`${adminOrigin}/api/admin/pair`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", "X-OpenTig-Admin": adminToken },
+    body: JSON.stringify({ instanceId: state.instanceId, publicOrigin: origin }),
+    signal: AbortSignal.timeout(3e3)
+  });
+  if (!response.ok) throw new Error("The running server refused the local pairing request.");
+  const pairing = validatePairing(await response.json(), origin);
+  printPairing(pairing, io, true);
+  return 0;
+}
+async function startOnConfiguredPort(baseConfig, port) {
+  try {
+    return await runOpenTigServer({ ...baseConfig, port });
+  } catch (error) {
+    if (isAddressInUse(error)) throw new Error(`Port ${port} is already in use. Stop that process or select another port with --port.`, { cause: error });
+    throw error;
+  }
+}
+function publicOrigin(host, port) {
+  const displayHost = host === "0.0.0.0" ? "127.0.0.1" : host === "::" ? "::1" : host;
+  return `http://${displayHost.includes(":") ? `[${displayHost}]` : displayHost}:${port}`;
+}
+async function refuseActiveRuntime(runtimeStatePath, profile) {
+  try {
+    const state = await readRuntimeState(runtimeStatePath);
+    if (isProcessRunning(state.pid)) throw new Error(`OpenTig is already running for this home (PID ${state.pid}). Use "${profile === "dev" ? "npm run pair:web:dev" : "opentig pair"}" to add a device.`);
+    await clearRuntimeState(runtimeStatePath, state.instanceId);
+  } catch (error) {
+    if (error instanceof Error && error.message === "No running OpenTig server was found for this home.") return;
+    throw error;
+  }
+}
+function waitForShutdown(server, afterClose, io) {
+  return new Promise((resolve) => {
+    let stopping = false;
+    const handle = (signal) => {
+      const exitCode = signal === "SIGINT" ? 130 : 143;
+      if (stopping) process$1.exit(exitCode);
+      stopping = true;
+      io.error(`Received ${signal}; shutting down OpenTig...`);
+      const timeout = setTimeout(() => process$1.exit(1), SHUTDOWN_TIMEOUT_MS);
+      void server.close().then(afterClose).then(() => {
+        clearTimeout(timeout);
+        process$1.off("SIGINT", onInterrupt);
+        process$1.off("SIGTERM", onTerminate);
+        resolve(exitCode);
+      }, () => {
+        clearTimeout(timeout);
+        resolve(1);
+      });
+    };
+    const onInterrupt = () => handle("SIGINT");
+    const onTerminate = () => handle("SIGTERM");
+    process$1.on("SIGINT", onInterrupt);
+    process$1.on("SIGTERM", onTerminate);
+  });
+}
+function printPairing(pairing, io, includeQr) {
+  const token = new URLSearchParams(new URL(pairing.url).hash.slice(1)).get("token");
+  io.out(`One-time pairing link (expires ${pairing.expiresAt}):`);
+  io.out(pairing.url);
+  if (token) {
+    io.out("Pairing code (paste at /pair on this OpenTig server):");
+    io.out(token);
+  }
+  if (includeQr) io.out(renderUnicodeCompact(pairing.url, { border: 2 }));
+}
+function rewritePairingOrigin(pairing, origin) {
+  const source = new URL(pairing.url);
+  const url = new URL("/pair", origin);
+  url.hash = source.hash;
+  return validatePairing({ url: url.href, expiresAt: pairing.expiresAt }, origin);
+}
+function validatePairing(value, origin) {
+  const pairing = value;
+  if (!pairing || typeof pairing.url !== "string" || typeof pairing.expiresAt !== "string") throw new Error("The server returned an invalid pairing link.");
+  const url = new URL(pairing.url);
+  const token = new URLSearchParams(url.hash.slice(1)).get("token");
+  const expiresAt = Date.parse(pairing.expiresAt);
+  if (url.origin !== origin || url.pathname !== "/pair" || url.search || !token || !/^[A-Za-z0-9_-]{43}$/.test(token) || expiresAt <= Date.now() || expiresAt > Date.now() + 15 * 60 * 1e3) {
+    throw new Error("The server returned an invalid pairing link.");
+  }
+  return { url: url.href, expiresAt: pairing.expiresAt };
+}
+function localAdminOrigin(state) {
+  return publicOrigin(state.host, state.port);
+}
+function isLoopbackHost(host) {
+  return host === "127.0.0.1" || host === "::1" || host.toLowerCase() === "localhost";
+}
+function isAddressInUse(error) {
+  return error instanceof Error && "code" in error && error.code === "EADDRINUSE";
+}
+function isProcessRunning(pid) {
+  try {
+    process$1.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+function assertNodeVersion() {
+  const major = Number(process$1.versions.node.split(".", 1)[0]);
+  if (!Number.isSafeInteger(major) || major < 24) throw new Error("Node.js 24 or later is required.");
+}
+function assertGitAvailable() {
+  return new Promise((resolve, reject) => {
+    execFile("git", ["--version"], { timeout: 1e4, windowsHide: true }, (error, stdout) => {
+      if (error || !stdout.trim().startsWith("git version ")) reject(new Error("Git is required and was not found on PATH."));
+      else resolve();
+    });
+  });
+}
+export {
+  CliUsageError as C,
+  runCli as r
+};