@pixelzx/genesis 2026.5.3-2 → 2026.5.3-3

package/dist/probe-VShtyoQP.js

@@ -0,0 +1,45 @@
+import { i as formatErrorMessage } from "./errors-Jbvi20TW.js";
+import "./error-runtime-BtntgIxu.js";
+import { n as signalRpcRequest, t as signalCheck } from "./client-BeAVbxBQ.js";
+//#region extensions/signal/src/probe.ts
+function parseSignalVersion(value) {
+	if (typeof value === "string" && value.trim()) return value.trim();
+	if (typeof value === "object" && value !== null) {
+		const version = value.version;
+		if (typeof version === "string" && version.trim()) return version.trim();
+	}
+	return null;
+}
+async function probeSignal(baseUrl, timeoutMs) {
+	const started = Date.now();
+	const result = {
+		ok: false,
+		status: null,
+		error: null,
+		elapsedMs: 0,
+		version: null
+	};
+	const check = await signalCheck(baseUrl, timeoutMs);
+	if (!check.ok) return {
+		...result,
+		status: check.status ?? null,
+		error: check.error ?? "unreachable",
+		elapsedMs: Date.now() - started
+	};
+	try {
+		result.version = parseSignalVersion(await signalRpcRequest("version", void 0, {
+			baseUrl,
+			timeoutMs
+		}));
+	} catch (err) {
+		result.error = formatErrorMessage(err);
+	}
+	return {
+		...result,
+		ok: true,
+		status: check.status ?? null,
+		elapsedMs: Date.now() - started
+	};
+}
+//#endregion
+export { probeSignal as t };

package/dist/program-B1Zbl29n.js

@@ -0,0 +1,111 @@
+import { M as getVerboseFlag, P as hasHelpOrVersion, w as setVerbose } from "./logger-QwLssHIf.js";
+import { n as defaultRuntime } from "./runtime-CQ7eH0le.js";
+import { n as resolveCliName } from "./cli-name-Cpoe1Ahu.js";
+import { n as VERSION } from "./version-BoqlEm3e.js";
+import "./globals-C5IxqXPj.js";
+import { n as resolveCliChannelOptions } from "./channel-options-3qoMshDB.js";
+import { n as setProgramContext } from "./program-context-BviaNtC6.js";
+import { t as isCommandJsonOutputMode } from "./json-mode-DJIBXO2N.js";
+import { t as forceFreePort } from "./ports-DJEE29Z6.js";
+import { n as resolvePluginInstallPreactionRequest, t as resolvePluginInstallInvalidConfigPolicy } from "./plugin-install-config-policy-B995E0nf.js";
+import { t as registerProgramCommands } from "./command-registry-BI5Ce-0X.js";
+import { t as configureProgramHelp } from "./help-C1ieNI0X.js";
+import { i as shouldBypassConfigGuardForCommandPath, n as ensureCliExecutionBootstrap, r as resolveCliExecutionStartupContext, t as applyCliExecutionStartupPresentation } from "./command-execution-startup-Dzs0UAoU.js";
+import process$1 from "node:process";
+import { Command } from "commander";
+//#region src/cli/program/context.ts
+function createProgramContext() {
+	let cachedChannelOptions;
+	const getChannelOptions = () => {
+		if (cachedChannelOptions === void 0) cachedChannelOptions = resolveCliChannelOptions();
+		return cachedChannelOptions;
+	};
+	return {
+		programVersion: VERSION,
+		get channelOptions() {
+			return getChannelOptions();
+		},
+		get messageChannelOptions() {
+			return getChannelOptions().join("|");
+		},
+		get agentChannelOptions() {
+			return ["last", ...getChannelOptions()].join("|");
+		}
+	};
+}
+//#endregion
+//#region src/cli/program/preaction.ts
+function setProcessTitleForCommand(actionCommand) {
+	let current = actionCommand;
+	while (current.parent && current.parent.parent) current = current.parent;
+	const name = current.name();
+	const cliName = resolveCliName();
+	if (!name || name === cliName) return;
+	process.title = `${cliName}-${name}`;
+}
+function shouldAllowInvalidConfigForAction(actionCommand, commandPath) {
+	return resolvePluginInstallInvalidConfigPolicy(resolvePluginInstallPreactionRequest({
+		actionCommand,
+		commandPath,
+		argv: process.argv
+	})) === "allow-bundled-recovery";
+}
+function getRootCommand(command) {
+	let current = command;
+	while (current.parent) current = current.parent;
+	return current;
+}
+function getCliLogLevel(actionCommand) {
+	const root = getRootCommand(actionCommand);
+	if (typeof root.getOptionValueSource !== "function") return;
+	if (root.getOptionValueSource("logLevel") !== "cli") return;
+	const logLevel = root.opts().logLevel;
+	return typeof logLevel === "string" ? logLevel : void 0;
+}
+function registerPreActionHooks(program, programVersion) {
+	program.hook("preAction", async (_thisCommand, actionCommand) => {
+		setProcessTitleForCommand(actionCommand);
+		const argv = process.argv;
+		if (hasHelpOrVersion(argv)) return;
+		const { commandPath, startupPolicy } = resolveCliExecutionStartupContext({
+			argv,
+			jsonOutputMode: isCommandJsonOutputMode(actionCommand, argv),
+			env: process.env
+		});
+		await applyCliExecutionStartupPresentation({
+			startupPolicy,
+			version: programVersion
+		});
+		const verbose = getVerboseFlag(argv, { includeDebug: true });
+		setVerbose(verbose);
+		const cliLogLevel = getCliLogLevel(actionCommand);
+		if (cliLogLevel) process.env.GENESIS_LOG_LEVEL = cliLogLevel;
+		if (!verbose) process.env.NODE_NO_WARNINGS ??= "1";
+		if (shouldBypassConfigGuardForCommandPath(commandPath)) return;
+		await ensureCliExecutionBootstrap({
+			runtime: defaultRuntime,
+			commandPath,
+			startupPolicy,
+			allowInvalid: shouldAllowInvalidConfigForAction(actionCommand, commandPath)
+		});
+	});
+}
+//#endregion
+//#region src/cli/program/build-program.ts
+function buildProgram() {
+	const program = new Command();
+	program.enablePositionalOptions();
+	program.exitOverride((err) => {
+		process$1.exitCode = typeof err.exitCode === "number" ? err.exitCode : 1;
+		throw err;
+	});
+	const ctx = createProgramContext();
+	const argv = process$1.argv;
+	setProgramContext(program, ctx);
+	configureProgramHelp(program, ctx);
+	registerPreActionHooks(program, ctx.programVersion);
+	registerProgramCommands(program, ctx, argv);
+	return program;
+}
+//#endregion
+export { buildProgram, forceFreePort };

package/dist/prompt-select-styled-BFiy7KFb.js

@@ -0,0 +1,20 @@
+import { n as stylePromptMessage, t as stylePromptHint } from "./prompt-style-sjYmJy2m.js";
+import { select } from "@clack/prompts";
+//#region src/commands/doctor.ts
+async function doctorCommand(runtime, options) {
+	await (await import("./doctor-health-sIYTca3Z.js")).doctorCommand(runtime, options);
+}
+//#endregion
+//#region src/terminal/prompt-select-styled.ts
+function selectStyled(params) {
+	return select({
+		...params,
+		message: stylePromptMessage(params.message),
+		options: params.options.map((opt) => opt.hint === void 0 ? opt : {
+			...opt,
+			hint: stylePromptHint(opt.hint)
+		})
+	});
+}
+//#endregion
+export { doctorCommand as n, selectStyled as t };

package/dist/provider-dispatcher-C_R0buEs.js

@@ -0,0 +1,22 @@
+import { n as dispatchInboundMessageWithBufferedDispatcher, r as dispatchInboundMessageWithDispatcher } from "./dispatch-CswKkiWZ.js";
+//#region src/auto-reply/reply/provider-dispatcher.ts
+const dispatchReplyWithBufferedBlockDispatcher = async (params) => {
+	return await dispatchInboundMessageWithBufferedDispatcher({
+		ctx: params.ctx,
+		cfg: params.cfg,
+		dispatcherOptions: params.dispatcherOptions,
+		replyResolver: params.replyResolver,
+		replyOptions: params.replyOptions
+	});
+};
+const dispatchReplyWithDispatcher = async (params) => {
+	return await dispatchInboundMessageWithDispatcher({
+		ctx: params.ctx,
+		cfg: params.cfg,
+		dispatcherOptions: params.dispatcherOptions,
+		replyResolver: params.replyResolver,
+		replyOptions: params.replyOptions
+	});
+};
+//#endregion
+export { dispatchReplyWithDispatcher as n, dispatchReplyWithBufferedBlockDispatcher as t };

package/dist/provider-dispatcher-DMjvnMg1.js

@@ -0,0 +1,2 @@
+import { n as dispatchReplyWithDispatcher, t as dispatchReplyWithBufferedBlockDispatcher } from "./provider-dispatcher-C_R0buEs.js";
+export { dispatchReplyWithBufferedBlockDispatcher, dispatchReplyWithDispatcher };

package/dist/qr-cli-CIMpiVqT.js

@@ -0,0 +1,2 @@
+import { t as registerQrCli } from "./qr-cli-Chl8J_dU.js";
+export { registerQrCli };

package/dist/qr-cli-Chl8J_dU.js

@@ -0,0 +1,349 @@
+import { a as normalizeLowercaseStringOrEmpty, c as normalizeOptionalString } from "./string-coerce-C1IzJjqi.js";
+import { n as defaultRuntime } from "./runtime-CQ7eH0le.js";
+import { t as formatDocsLink } from "./links-DmsJCU7L.js";
+import { r as theme } from "./theme-BrRleVfL.js";
+import { u as resolveGatewayPort } from "./paths-DmR9mjUX.js";
+import { o as hasConfiguredSecretInput, p as resolveSecretInputRef, u as normalizeSecretInputString } from "./types.secrets-ews2W8BF.js";
+import { n as assertExplicitGatewayAuthModeWhenBothConfigured } from "./auth-mode-policy-BM9E_-zc.js";
+import { a as trimToUndefined } from "./credential-planner-Bf6MFQ6Y.js";
+import "./credentials-C7JHJpIV.js";
+import { r as runCommandWithTimeout } from "./exec-CKo0c2Rj.js";
+import { r as resolveRequiredConfiguredSecretRefInputString } from "./resolve-configured-secret-input-string-BuPM5vvV.js";
+import { i as pickMatchingExternalInterfaceAddress, o as safeNetworkInterfaces } from "./tailnet-XeQJXdvi.js";
+import { a as isCarrierGradeNatIpv4Address, c as isIpv6Address, f as isRfc1918Ipv4Address, m as parseCanonicalIpAddress, s as isIpv4Address } from "./ip-BMYro-gI.js";
+import { a as isLoopbackHost, c as isSecureWebSocketUrl } from "./net-AycWGi8-.js";
+import { a as loadConfig } from "./io-CRPT2IUI.js";
+import "./config-DcheqK7J.js";
+import { t as resolveCommandSecretRefsViaGateway } from "./command-secret-gateway-RYlrkM8e.js";
+import { a as getQrRemoteCommandSecretTargetIds } from "./command-secret-targets-DE11qVp8.js";
+import { n as resolveGatewayBindUrl, t as resolveTailnetHostWithRunner } from "./tailscale-status-Ca9OERuf.js";
+import { t as renderQrTerminal } from "./qr-terminal-ghtJU78W.js";
+import { n as materializeGatewayAuthSecretRefs } from "./auth-config-utils-rHFHe1Jh.js";
+import { t as PAIRING_SETUP_BOOTSTRAP_PROFILE } from "./device-bootstrap-profile-G_w2eTHB.js";
+import { i as issueDeviceBootstrapToken } from "./device-bootstrap-BsUMdzjq.js";
+import os from "node:os";
+//#region src/pairing/setup-code.ts
+function describeSecureMobilePairingFix(source) {
+	return "Tailscale and public mobile pairing require a secure gateway URL (wss://) or Tailscale Serve/Funnel." + (source ? ` Resolved source: ${source}.` : "") + " Fix: use a private LAN IP address, prefer gateway.tailscale.mode=serve, or set gateway.remote.url / plugins.entries.device-pair.config.publicUrl to a wss:// URL. ws:// is only valid for localhost, private LAN IP addresses, or the Android emulator.";
+}
+function isPrivateLanIpHost(host) {
+	if (isRfc1918Ipv4Address(host)) return true;
+	const parsed = parseCanonicalIpAddress(host);
+	if (!parsed) return false;
+	if (isIpv4Address(parsed)) {
+		const normalized = parsed.toString();
+		return normalized.startsWith("169.254.") && !isCarrierGradeNatIpv4Address(normalized);
+	}
+	if (!isIpv6Address(parsed)) return false;
+	const normalized = normalizeLowercaseStringOrEmpty(parsed.toString());
+	return normalized.startsWith("fe80:") || normalized.startsWith("fc") || normalized.startsWith("fd");
+}
+function isMobilePairingCleartextAllowedHost(host) {
+	return isLoopbackHost(host) || host === "10.0.2.2" || isPrivateLanIpHost(host);
+}
+function validateMobilePairingUrl(url, source) {
+	if (isSecureWebSocketUrl(url)) return null;
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		return "Resolved mobile pairing URL is invalid.";
+	}
+	if ((parsed.protocol === "https:" ? "wss:" : parsed.protocol === "http:" ? "ws:" : parsed.protocol) !== "ws:" || isMobilePairingCleartextAllowedHost(parsed.hostname)) return null;
+	return describeSecureMobilePairingFix(source);
+}
+function normalizeUrl(raw, schemeFallback) {
+	const trimmed = raw.trim();
+	if (!trimmed) return null;
+	try {
+		const parsed = new URL(trimmed);
+		const scheme = parsed.protocol.replace(":", "");
+		if (!scheme) return null;
+		const resolvedScheme = scheme === "http" ? "ws" : scheme === "https" ? "wss" : scheme;
+		if (resolvedScheme !== "ws" && resolvedScheme !== "wss") return null;
+		const host = parsed.hostname;
+		if (!host) return null;
+		return `${resolvedScheme}://${host}${parsed.port ? `:${parsed.port}` : ""}`;
+	} catch {}
+	const withoutPath = trimmed.split("/")[0] ?? "";
+	if (!withoutPath) return null;
+	return `${schemeFallback}://${withoutPath}`;
+}
+function resolveScheme(cfg, opts) {
+	if (opts?.forceSecure) return "wss";
+	return cfg.gateway?.tls?.enabled === true ? "wss" : "ws";
+}
+function isPrivateIPv4(address) {
+	return isRfc1918Ipv4Address(address);
+}
+function isTailnetIPv4(address) {
+	return isCarrierGradeNatIpv4Address(address);
+}
+function pickIPv4Matching(networkInterfaces, matches) {
+	return pickMatchingExternalInterfaceAddress(safeNetworkInterfaces(networkInterfaces), {
+		family: "IPv4",
+		matches
+	}) ?? null;
+}
+function pickLanIPv4(networkInterfaces) {
+	return pickIPv4Matching(networkInterfaces, isPrivateIPv4);
+}
+function pickTailnetIPv4(networkInterfaces) {
+	return pickIPv4Matching(networkInterfaces, isTailnetIPv4);
+}
+function resolvePairingSetupAuthLabel(cfg, env) {
+	const mode = cfg.gateway?.auth?.mode;
+	const defaults = cfg.secrets?.defaults;
+	const tokenRef = resolveSecretInputRef({
+		value: cfg.gateway?.auth?.token,
+		defaults
+	}).ref;
+	const passwordRef = resolveSecretInputRef({
+		value: cfg.gateway?.auth?.password,
+		defaults
+	}).ref;
+	const envToken = normalizeOptionalString(env.GENESIS_GATEWAY_TOKEN);
+	const envPassword = normalizeOptionalString(env.GENESIS_GATEWAY_PASSWORD);
+	const token = envToken || (tokenRef ? void 0 : normalizeSecretInputString(cfg.gateway?.auth?.token));
+	const password = envPassword || (passwordRef ? void 0 : normalizeSecretInputString(cfg.gateway?.auth?.password));
+	if (mode === "password") {
+		if (!password) return { error: "Gateway auth is set to password, but no password is configured." };
+		return { label: "password" };
+	}
+	if (mode === "token") {
+		if (!token) return { error: "Gateway auth is set to token, but no token is configured." };
+		return { label: "token" };
+	}
+	if (token) return { label: "token" };
+	if (password) return { label: "password" };
+	return { error: "Gateway auth is not configured (no token or password)." };
+}
+async function resolveGatewayUrl(cfg, opts) {
+	const scheme = resolveScheme(cfg, { forceSecure: opts.forceSecure });
+	const port = resolveGatewayPort(cfg, opts.env);
+	if (typeof opts.publicUrl === "string" && opts.publicUrl.trim()) {
+		const url = normalizeUrl(opts.publicUrl, scheme);
+		if (url) return {
+			url,
+			source: "plugins.entries.device-pair.config.publicUrl"
+		};
+		return { error: "Configured publicUrl is invalid." };
+	}
+	const remoteUrlRaw = cfg.gateway?.remote?.url;
+	const remoteUrl = typeof remoteUrlRaw === "string" && remoteUrlRaw.trim() ? normalizeUrl(remoteUrlRaw, scheme) : null;
+	if (opts.preferRemoteUrl && remoteUrl) return {
+		url: remoteUrl,
+		source: "gateway.remote.url"
+	};
+	const tailscaleMode = cfg.gateway?.tailscale?.mode ?? "off";
+	if (tailscaleMode === "serve" || tailscaleMode === "funnel") {
+		const host = await resolveTailnetHostWithRunner(opts.runCommandWithTimeout);
+		if (!host) return { error: "Tailscale Serve is enabled, but MagicDNS could not be resolved." };
+		return {
+			url: `wss://${host}`,
+			source: `gateway.tailscale.mode=${tailscaleMode}`
+		};
+	}
+	if (remoteUrl) return {
+		url: remoteUrl,
+		source: "gateway.remote.url"
+	};
+	const bindResult = resolveGatewayBindUrl({
+		bind: cfg.gateway?.bind,
+		customBindHost: cfg.gateway?.customBindHost,
+		scheme,
+		port,
+		pickTailnetHost: () => pickTailnetIPv4(opts.networkInterfaces),
+		pickLanHost: () => pickLanIPv4(opts.networkInterfaces)
+	});
+	if (bindResult) return bindResult;
+	return { error: "Gateway is only bound to loopback. Set gateway.bind=lan, enable tailscale serve, or configure plugins.entries.device-pair.config.publicUrl." };
+}
+function encodePairingSetupCode(payload) {
+	const json = JSON.stringify(payload);
+	return Buffer.from(json, "utf8").toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+async function resolvePairingSetupFromConfig(cfg, options = {}) {
+	assertExplicitGatewayAuthModeWhenBothConfigured(cfg);
+	const env = options.env ?? process.env;
+	const cfgForAuth = await materializeGatewayAuthSecretRefs({
+		cfg,
+		env,
+		mode: cfg.gateway?.auth?.mode,
+		hasTokenCandidate: Boolean(normalizeOptionalString(env.GENESIS_GATEWAY_TOKEN)),
+		hasPasswordCandidate: Boolean(normalizeOptionalString(env.GENESIS_GATEWAY_PASSWORD))
+	});
+	const authLabel = resolvePairingSetupAuthLabel(cfgForAuth, env);
+	if (authLabel.error) return {
+		ok: false,
+		error: authLabel.error
+	};
+	const urlResult = await resolveGatewayUrl(cfgForAuth, {
+		env,
+		publicUrl: options.publicUrl,
+		preferRemoteUrl: options.preferRemoteUrl,
+		forceSecure: options.forceSecure,
+		runCommandWithTimeout: options.runCommandWithTimeout,
+		networkInterfaces: options.networkInterfaces ?? os.networkInterfaces
+	});
+	if (!urlResult.url) return {
+		ok: false,
+		error: urlResult.error ?? "Gateway URL unavailable."
+	};
+	const mobilePairingUrlError = validateMobilePairingUrl(urlResult.url, urlResult.source);
+	if (mobilePairingUrlError) return {
+		ok: false,
+		error: mobilePairingUrlError
+	};
+	if (!authLabel.label) return {
+		ok: false,
+		error: "Gateway auth is not configured (no token or password)."
+	};
+	return {
+		ok: true,
+		payload: {
+			url: urlResult.url,
+			bootstrapToken: (await issueDeviceBootstrapToken({
+				baseDir: options.pairingBaseDir,
+				profile: PAIRING_SETUP_BOOTSTRAP_PROFILE
+			})).token
+		},
+		authLabel: authLabel.label,
+		urlSource: urlResult.source ?? "unknown"
+	};
+}
+//#endregion
+//#region src/cli/qr-cli.ts
+function renderQrAscii(data) {
+	return renderQrTerminal(data, { small: true });
+}
+function readDevicePairPublicUrlFromConfig(cfg) {
+	const value = cfg.plugins?.entries?.["device-pair"]?.config?.["publicUrl"];
+	if (typeof value !== "string") return;
+	const trimmed = value.trim();
+	return trimmed.length > 0 ? trimmed : void 0;
+}
+function shouldResolveLocalGatewayPasswordSecret(cfg, env) {
+	if (trimToUndefined(env.GENESIS_GATEWAY_PASSWORD)) return false;
+	const authMode = cfg.gateway?.auth?.mode;
+	if (authMode === "password") return true;
+	if (authMode === "token" || authMode === "none" || authMode === "trusted-proxy") return false;
+	const envToken = trimToUndefined(env.GENESIS_GATEWAY_TOKEN);
+	const configTokenConfigured = hasConfiguredSecretInput(cfg.gateway?.auth?.token, cfg.secrets?.defaults);
+	return !envToken && !configTokenConfigured;
+}
+async function resolveLocalGatewayPasswordSecretIfNeeded(cfg) {
+	const resolvedPassword = await resolveRequiredConfiguredSecretRefInputString({
+		config: cfg,
+		env: process.env,
+		value: cfg.gateway?.auth?.password,
+		path: "gateway.auth.password"
+	});
+	if (!resolvedPassword) return;
+	if (!cfg.gateway?.auth) return;
+	cfg.gateway.auth.password = resolvedPassword;
+}
+function emitQrSecretResolveDiagnostics(diagnostics, opts) {
+	if (diagnostics.length === 0) return;
+	const toStderr = opts.json === true || opts.setupCodeOnly === true;
+	for (const entry of diagnostics) {
+		const message = theme.warn(`[secrets] ${entry}`);
+		if (toStderr) defaultRuntime.error(message);
+		else defaultRuntime.log(message);
+	}
+}
+function registerQrCli(program) {
+	program.command("qr").description("Generate a mobile pairing QR code and setup code").addHelpText("after", () => `\n${theme.muted("Docs:")} ${formatDocsLink("/cli/qr", "docs.genesis.ai/cli/qr")}\n`).option("--remote", "Use gateway.remote.url and gateway.remote token/password (ignores device-pair publicUrl)", false).option("--url <url>", "Override gateway URL used in the setup payload").option("--public-url <url>", "Override gateway public URL used in the setup payload").option("--token <token>", "Override gateway token for setup payload").option("--password <password>", "Override gateway password for setup payload").option("--setup-code-only", "Print only the setup code", false).option("--no-ascii", "Skip ASCII QR rendering").option("--json", "Output JSON", false).action(async (opts) => {
+		try {
+			if (opts.token && opts.password) throw new Error("Use either --token or --password, not both.");
+			const token = trimToUndefined(opts.token) ?? "";
+			const password = trimToUndefined(opts.password) ?? "";
+			const wantsRemote = opts.remote === true;
+			const loadedRaw = loadConfig();
+			if (wantsRemote && !opts.url && !opts.publicUrl) {
+				const tailscaleMode = loadedRaw.gateway?.tailscale?.mode ?? "off";
+				const remoteUrl = loadedRaw.gateway?.remote?.url;
+				if (!Boolean(trimToUndefined(remoteUrl)) && !(tailscaleMode === "serve" || tailscaleMode === "funnel")) throw new Error("qr --remote requires gateway.remote.url (or gateway.tailscale.mode=serve/funnel).");
+			}
+			let loaded = loadedRaw;
+			let remoteDiagnostics = [];
+			if (wantsRemote && !token && !password) {
+				const resolvedRemote = await resolveCommandSecretRefsViaGateway({
+					config: loadedRaw,
+					commandName: "qr --remote",
+					targetIds: getQrRemoteCommandSecretTargetIds()
+				});
+				loaded = resolvedRemote.resolvedConfig;
+				remoteDiagnostics = resolvedRemote.diagnostics;
+			}
+			const cfg = {
+				...loaded,
+				gateway: {
+					...loaded.gateway,
+					auth: { ...loaded.gateway?.auth }
+				}
+			};
+			emitQrSecretResolveDiagnostics(remoteDiagnostics, opts);
+			if (token) {
+				cfg.gateway.auth.mode = "token";
+				cfg.gateway.auth.token = token;
+				cfg.gateway.auth.password = void 0;
+			}
+			if (password) {
+				cfg.gateway.auth.mode = "password";
+				cfg.gateway.auth.password = password;
+				cfg.gateway.auth.token = void 0;
+			}
+			if (wantsRemote && !token && !password) {
+				const remoteToken = trimToUndefined(cfg.gateway?.remote?.token) ?? "";
+				const remotePassword = trimToUndefined(cfg.gateway?.remote?.password) ?? "";
+				if (remoteToken) {
+					cfg.gateway.auth.mode = "token";
+					cfg.gateway.auth.token = remoteToken;
+					cfg.gateway.auth.password = void 0;
+				} else if (remotePassword) {
+					cfg.gateway.auth.mode = "password";
+					cfg.gateway.auth.password = remotePassword;
+					cfg.gateway.auth.token = void 0;
+				}
+			}
+			if (!wantsRemote && !password && !token && shouldResolveLocalGatewayPasswordSecret(cfg, process.env)) await resolveLocalGatewayPasswordSecretIfNeeded(cfg);
+			const resolved = await resolvePairingSetupFromConfig(cfg, {
+				publicUrl: (typeof opts.url === "string" && opts.url.trim() ? opts.url.trim() : typeof opts.publicUrl === "string" && opts.publicUrl.trim() ? opts.publicUrl.trim() : void 0) ?? (wantsRemote ? void 0 : readDevicePairPublicUrlFromConfig(cfg)),
+				preferRemoteUrl: wantsRemote,
+				runCommandWithTimeout: async (argv, runOpts) => await runCommandWithTimeout(argv, { timeoutMs: runOpts.timeoutMs })
+			});
+			if (!resolved.ok) throw new Error(resolved.error);
+			const setupCode = encodePairingSetupCode(resolved.payload);
+			if (opts.setupCodeOnly) {
+				defaultRuntime.log(setupCode);
+				return;
+			}
+			if (opts.json) {
+				defaultRuntime.writeJson({
+					setupCode,
+					gatewayUrl: resolved.payload.url,
+					auth: resolved.authLabel,
+					urlSource: resolved.urlSource
+				});
+				return;
+			}
+			const lines = [
+				theme.heading("Pairing QR"),
+				"Scan this with the Genesis mobile app (Onboarding -> Scan QR).",
+				""
+			];
+			if (opts.ascii !== false) {
+				const qrAscii = await renderQrAscii(setupCode);
+				lines.push(qrAscii.trimEnd(), "");
+			}
+			lines.push(`${theme.muted("Setup code:")} ${setupCode}`, `${theme.muted("Gateway:")} ${resolved.payload.url}`, `${theme.muted("Auth:")} ${resolved.authLabel}`, `${theme.muted("Source:")} ${resolved.urlSource}`, "", "Approve after scan with:", `  ${theme.command("genesis devices list")}`, `  ${theme.command("genesis devices approve <requestId>")}`);
+			defaultRuntime.log(lines.join("\n"));
+		} catch (err) {
+			defaultRuntime.error(String(err));
+			defaultRuntime.exit(1);
+		}
+	});
+}
+//#endregion
+export { registerQrCli as t };

package/dist/reaction-runtime-api-BNJMHeSk.js

@@ -0,0 +1,116 @@
+import { a as normalizeLowercaseStringOrEmpty } from "./string-coerce-C1IzJjqi.js";
+import "./text-runtime-BGtvBT2C.js";
+import { t as requireRuntimeConfig } from "./config-runtime-xvJgSEiT.js";
+import { i as resolveSignalAccount } from "./accounts-B9DSBt2S.js";
+import { n as signalRpcRequest } from "./client-BeAVbxBQ.js";
+import { t as resolveSignalRpcContext } from "./rpc-context-Dxv9Uv60.js";
+//#region extensions/signal/src/send-reactions.ts
+/**
+* Signal reactions via signal-cli JSON-RPC API
+*/
+function normalizeSignalId(raw) {
+	const trimmed = raw.trim();
+	if (!trimmed) return "";
+	return trimmed.replace(/^signal:/i, "").trim();
+}
+function normalizeSignalUuid(raw) {
+	const trimmed = normalizeSignalId(raw);
+	if (!trimmed) return "";
+	if (normalizeLowercaseStringOrEmpty(trimmed).startsWith("uuid:")) return trimmed.slice(5).trim();
+	return trimmed;
+}
+function resolveTargetAuthorParams(params) {
+	const candidates = [
+		params.targetAuthor,
+		params.targetAuthorUuid,
+		params.fallback
+	];
+	for (const candidate of candidates) {
+		const raw = candidate?.trim();
+		if (!raw) continue;
+		const normalized = normalizeSignalUuid(raw);
+		if (normalized) return { targetAuthor: normalized };
+	}
+	return {};
+}
+async function sendReactionSignalCore(params) {
+	const accountInfo = resolveSignalAccount({
+		cfg: requireRuntimeConfig(params.opts.cfg, "Signal reactions"),
+		accountId: params.opts.accountId
+	});
+	const { baseUrl, account } = resolveSignalRpcContext(params.opts, accountInfo);
+	const normalizedRecipient = normalizeSignalUuid(params.recipient);
+	const groupId = params.opts.groupId?.trim();
+	if (!normalizedRecipient && !groupId) throw new Error(params.errors.missingRecipient);
+	if (!Number.isFinite(params.targetTimestamp) || params.targetTimestamp <= 0) throw new Error(params.errors.invalidTargetTimestamp);
+	const normalizedEmoji = params.emoji?.trim();
+	if (!normalizedEmoji) throw new Error(params.errors.missingEmoji);
+	const targetAuthorParams = resolveTargetAuthorParams({
+		targetAuthor: params.opts.targetAuthor,
+		targetAuthorUuid: params.opts.targetAuthorUuid,
+		fallback: normalizedRecipient
+	});
+	if (groupId && !targetAuthorParams.targetAuthor) throw new Error(params.errors.missingTargetAuthor);
+	const requestParams = {
+		emoji: normalizedEmoji,
+		targetTimestamp: params.targetTimestamp,
+		...params.remove ? { remove: true } : {},
+		...targetAuthorParams
+	};
+	if (normalizedRecipient) requestParams.recipients = [normalizedRecipient];
+	if (groupId) requestParams.groupIds = [groupId];
+	if (account) requestParams.account = account;
+	return {
+		ok: true,
+		timestamp: (await signalRpcRequest("sendReaction", requestParams, {
+			baseUrl,
+			timeoutMs: params.opts.timeoutMs
+		}))?.timestamp
+	};
+}
+/**
+* Send a Signal reaction to a message
+* @param recipient - UUID or E.164 phone number of the message author
+* @param targetTimestamp - Message ID (timestamp) to react to
+* @param emoji - Emoji to react with
+* @param opts - Optional account/connection overrides
+*/
+async function sendReactionSignal(recipient, targetTimestamp, emoji, opts) {
+	return await sendReactionSignalCore({
+		recipient,
+		targetTimestamp,
+		emoji,
+		remove: false,
+		opts,
+		errors: {
+			missingRecipient: "Recipient or groupId is required for Signal reaction",
+			invalidTargetTimestamp: "Valid targetTimestamp is required for Signal reaction",
+			missingEmoji: "Emoji is required for Signal reaction",
+			missingTargetAuthor: "targetAuthor is required for group reactions"
+		}
+	});
+}
+/**
+* Remove a Signal reaction from a message
+* @param recipient - UUID or E.164 phone number of the message author
+* @param targetTimestamp - Message ID (timestamp) to remove reaction from
+* @param emoji - Emoji to remove
+* @param opts - Optional account/connection overrides
+*/
+async function removeReactionSignal(recipient, targetTimestamp, emoji, opts) {
+	return await sendReactionSignalCore({
+		recipient,
+		targetTimestamp,
+		emoji,
+		remove: true,
+		opts,
+		errors: {
+			missingRecipient: "Recipient or groupId is required for Signal reaction removal",
+			invalidTargetTimestamp: "Valid targetTimestamp is required for Signal reaction removal",
+			missingEmoji: "Emoji is required for Signal reaction removal",
+			missingTargetAuthor: "targetAuthor is required for group reaction removal"
+		}
+	});
+}
+//#endregion
+export { sendReactionSignal as n, removeReactionSignal as t };