@vincentt-xr/cli 0.21.0 → 0.23.0

package/dist/dx/enablement.js

@@ -1,16 +1,16 @@
 /**
  * Durable authorization for unattended `vincentt dx --send`.
  *
- * `--send` transmits only when the session is interactive, OR this MACHINE has been
- * enabled via `vincentt dx enable`, OR the creator's ACCOUNT carries the grant they
- * gave in the console. `enable` collects that consent in the browser by default and
- * at the terminal when there is one; either way a person answers, never the caller.
+ * `--send` transmits only when the session is interactive, OR the creator's ACCOUNT
+ * carries the grant, OR — only when the account cannot be read — this machine's cached
+ * copy of that grant is valid. `enable` records the account grant at the terminal or in
+ * the browser; either way a person answers, never the caller.
  *
- * The machine half is two fields in ~/.vincentt/config.json, set by `enable`, cleared
- * by `disable` and by `logout`. The account half is read from `/me` and cleared by
- * `disable` or in the console — NOT by `logout`, since signing out of one machine is
- * not a decision about the account. Neither has an expiry: both stay on until the
- * creator turns them off.
+ * The account grant is read from `/me` and cleared by `disable` or in the console, NOT by
+ * `logout`, since signing out of one machine is not a decision about the account. The
+ * machine copy is two fields in ~/.vincentt/config.json, written by `enable` only after
+ * the account grant succeeded, and cleared by `disable`, by `logout`, and by any `/me`
+ * answer that is not a grant. Neither has an expiry.
  *
  * Because there is no expiry, VISIBILITY is the entire mitigation, and the AGE is
  * the load-bearing half of it: `ENABLED` alone reads as configuration, while
@@ -55,9 +55,6 @@ export function readEnablement(cfg, now) {
         return DISABLED;
     if (now >= DX_UNATTENDED_SUNSET)
         return DISABLED;
-    // The local flag is by definition a grant made on THIS machine — `dx enable` is the
-    // only writer, whether it took the browser path or the terminal one. An account grant
-    // never lands in this file; it is read from /me and reported separately.
     return { enabled: true, at: dxSendEnabledAt, source: "machine" };
 }
 /**
@@ -71,10 +68,10 @@ export function readEnablement(cfg, now) {
  * stops being honored too, or "forgetting the sunset turns the feature off" would only be
  * true of the local half.
  */
-export function readAccountConsent(raw, now) {
+export function readAccountEnablement(raw, now) {
     if (typeof raw !== "object" || raw === null)
         return DISABLED;
-    const { dxReportsConsent, dxReportsConsentAt } = raw;
+    const { dxReportsConsent, dxReportsConsentAt, dxReportsConsentVia } = raw;
     if (dxReportsConsent !== true)
         return DISABLED;
     if (typeof dxReportsConsentAt !== "string")
@@ -83,7 +80,73 @@ export function readAccountConsent(raw, now) {
         return DISABLED;
     if (now >= DX_UNATTENDED_SUNSET)
         return DISABLED;
-    return { enabled: true, at: dxReportsConsentAt, source: "console" };
+    // An unknown via is dropped, not rejected: it only decides the suffix, never the grant.
+    return dxReportsConsentVia === "cli" || dxReportsConsentVia === "console"
+        ? {
+            enabled: true,
+            at: dxReportsConsentAt,
+            source: "account",
+            via: dxReportsConsentVia,
+        }
+        : { enabled: true, at: dxReportsConsentAt, source: "account" };
+}
+/**
+ * The account-first read shared by the send gate, `vincentt dx` and `vincentt version`
+ * (f7 Scenario 3, 3c). The account decides when it answers; a "not granted" answer clears
+ * this machine's copy so a revoke made elsewhere reaches it. Only when the account cannot
+ * be read does the local flag stand on its own.
+ */
+export async function resolveConsentView(deps) {
+    const signedIn = deps.auth !== undefined;
+    if (deps.auth !== undefined && deps.readAccount !== undefined) {
+        const { auth, readAccount } = deps;
+        const read = await boundedRead(Promise.resolve().then(() => readAccount(auth)), deps.timeoutMs);
+        if (read.kind === "granted") {
+            return {
+                shown: read.enablement,
+                local: await deps.local(),
+                checked: "account",
+                signedIn,
+            };
+        }
+        if (read.kind === "not_granted") {
+            // A failed clear still reports off: the account said no, so nothing may send, and
+            // the next account read clears again.
+            await deps.clearLocal().catch(() => undefined);
+            return { shown: DISABLED, local: DISABLED, checked: "account", signedIn };
+        }
+    }
+    const local = await deps.local();
+    return { shown: local, local, checked: "machine", signedIn };
+}
+async function boundedRead(read, timeoutMs) {
+    const unreadable = { kind: "unreadable" };
+    const guarded = read.catch(() => unreadable);
+    if (timeoutMs === undefined)
+        return guarded;
+    let timer;
+    const expired = new Promise((resolve) => {
+        timer = setTimeout(() => resolve(unreadable), timeoutMs);
+        timer.unref?.();
+    });
+    try {
+        return await Promise.race([guarded, expired]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+export function dxConsentJson(view) {
+    const { shown } = view;
+    if (shown.enabled && shown.at !== undefined) {
+        return {
+            state: "on",
+            checked: view.checked,
+            at: shown.at,
+            ...(shown.via !== undefined ? { via: shown.via } : {}),
+        };
+    }
+    return { state: view.signedIn ? "off" : "unknown", checked: view.checked };
 }
 /**
  * Read enablement from the real machine config.
@@ -116,8 +179,10 @@ export function grantedOn(at) {
 /**
  * The one visibility line, in the single pinned shape every human surface uses:
  *
+ *   Unattended send: ENABLED since 2026-04-01 (145 days) · granted from the CLI
  *   Unattended send: ENABLED since 2026-04-01 (145 days) · granted in the console
- *   Unattended send: ENABLED since 2026-04-01 (145 days) · granted on this machine
+ *   Unattended send: ENABLED since 2026-04-01 (145 days) · on your account
+ *   Unattended send: ENABLED since 2026-04-01 (145 days) · this machine (account not checked)
  *
  * Returns undefined when not enabled. Nothing is printed in that case, on
  * purpose: a line that prints unconditionally is a line readers learn to skip,
@@ -136,10 +201,17 @@ export function enablementLine(e, now) {
     if (!e.enabled || e.at === undefined)
         return undefined;
     const days = ageInDays(e.at, now);
-    const where = e.source === "console"
-        ? " · granted in the console"
-        : e.source === "machine"
-            ? " · granted on this machine"
-            : "";
+    const where = sourceSuffix(e);
     return `Unattended send: ENABLED since ${grantedOn(e.at)} (${days} ${days === 1 ? "day" : "days"})${where}`;
 }
+function sourceSuffix(e) {
+    if (e.source === "machine")
+        return " · this machine (account not checked)";
+    if (e.source !== "account")
+        return "";
+    if (e.via === "cli")
+        return " · granted from the CLI";
+    if (e.via === "console")
+        return " · granted in the console";
+    return " · on your account";
+}

package/dist/dx/journal.d.ts

@@ -12,6 +12,8 @@ export interface JournalEntry {
     err: string | null;
     /** Hash of the working tree, so runs group by project without recording where it is. */
     wt: string;
+    /** `editor` only: why it exited 1, one word from a closed set. Never a path or a value. */
+    reason?: string;
 }
 /**
  * Beside the machine config, so the journal shares the home the PAT already
@@ -38,6 +40,7 @@ export interface RecordInput {
     endedAt: number;
     exitCode: number;
     error?: unknown;
+    reason?: string;
 }
 export declare function buildEntry(input: RecordInput): JournalEntry;
 /**

package/dist/dx/journal.js

@@ -68,8 +68,10 @@ function trim(file) {
         return;
     fs.writeFileSync(file, lines.slice(-MAX_ENTRIES).join("\n") + "\n", "utf8");
 }
+/** Only a lowercase word survives as a reason, so no caller can route a value through it. */
+const REASON = /^[a-z_]{1,40}$/;
 export function buildEntry(input) {
-    return {
+    const entry = {
         ts: new Date(input.startedAt).toISOString(),
         v: input.cliVersion,
         verb: verbOf(input.argv),
@@ -79,6 +81,9 @@ export function buildEntry(input) {
         err: classify(input.error),
         wt: workingTreeId(input.cwd),
     };
+    if (input.reason !== undefined && REASON.test(input.reason))
+        entry.reason = input.reason;
+    return entry;
 }
 /**
  * Append one entry. Never throws: a journal that can break a publish is a

package/dist/dx/report.d.ts

@@ -1,25 +1,4 @@
-/**
- * `vincentt report "<what went wrong>"` — the creator's own words, sent.
- *
- * This exists because of a gap `dx --send` could not close. That command reports
- * DETECTED friction: it reads the journal, finds clusters of retries and errors,
- * and refuses when it finds none. But the friction a creator most wants to report
- * is routinely the kind the journal cannot see — a command that exits 0 and puts
- * the wrong thing on screen produces no error, no retry and no cluster. Asked to
- * carry a note about one, `--send` had nothing to attach it to and said "no
- * friction detected — nothing to send", which is the tool contradicting the
- * person using it.
- *
- * So the note stops being a rider on a finding and becomes the payload. An
- * observation carries no counts because there is nothing to count.
- *
- * The consent model is INHERITED, not relaxed. Sending is still gated on the
- * same three arms as `--send` (a terminal, a local `dx enable`, or an account
- * grant), the payload is still shown in full before it goes, and a note is still
- * shown under a warning that it is transmitted exactly as written. This verb
- * removes a refusal; it does not open a new door.
- */
-import type { Enablement } from "./enablement.js";
+import type { AccountRead, Enablement } from "./enablement.js";
 import type { JournalEntry } from "./journal.js";
 import { type BuiltWith } from "../platform/resolve.js";
 /** An observation as it goes on the wire. Mirrors the API's dxObservationRequest. */
@@ -114,7 +93,8 @@ export interface ReportDeps {
     accountConsent?: (auth: {
         apiUrl: string;
         pat: string;
-    }) => Promise<Enablement>;
+    }) => Promise<AccountRead>;
+    clearEnablement?: () => Promise<unknown>;
     /**
      * The version set. Injectable so a fixed set — or a REJECTING promise, the arm
      * proving a fault omits — can be driven with no filesystem. Defaults to the one
@@ -129,6 +109,6 @@ export interface ReportDeps {
  * Same order as `dx --send`, for the same reason — a creator who cannot see what
  * leaves their machine before it leaves has not agreed to anything:
  *
- *     bound-check → GATE (three arms) → auth → RESOLVE → build → SHOW → ask → post
+ *     bound-check → auth → GATE → RESOLVE → build → SHOW → ask → post
  */
 export declare function reportCommand(deps: ReportDeps, options: ReportOptions): Promise<number>;

package/dist/dx/report.js

@@ -1,3 +1,25 @@
+/**
+ * `vincentt report "<what went wrong>"` — the creator's own words, sent.
+ *
+ * This exists because of a gap `dx --send` could not close. That command reports
+ * DETECTED friction: it reads the journal, finds clusters of retries and errors,
+ * and refuses when it finds none. But the friction a creator most wants to report
+ * is routinely the kind the journal cannot see — a command that exits 0 and puts
+ * the wrong thing on screen produces no error, no retry and no cluster. Asked to
+ * carry a note about one, `--send` had nothing to attach it to and said "no
+ * friction detected — nothing to send", which is the tool contradicting the
+ * person using it.
+ *
+ * So the note stops being a rider on a finding and becomes the payload. An
+ * observation carries no counts because there is nothing to count.
+ *
+ * The consent model is INHERITED, not relaxed. Sending is gated by the same
+ * `gateSend` as `--send` (a terminal, the account grant, or, only when the
+ * account cannot be read, this machine's copy of it), the payload is still shown in full before it goes, and a note is still
+ * shown under a warning that it is transmitted exactly as written. This verb
+ * removes a refusal; it does not open a new door.
+ */
+import { gateSend, SEND_REFUSAL_LINES } from "./command.js";
 import { enablementLine } from "./enablement.js";
 import { DXSendError, platformTag } from "./send.js";
 import { resolveBuiltWith } from "../platform/resolve.js";
@@ -110,7 +132,7 @@ export function renderObservation(report) {
  * Same order as `dx --send`, for the same reason — a creator who cannot see what
  * leaves their machine before it leaves has not agreed to anything:
  *
- *     bound-check → GATE (three arms) → auth → RESOLVE → build → SHOW → ask → post
+ *     bound-check → auth → GATE → RESOLVE → build → SHOW → ask → post
  */
 export async function reportCommand(deps, options) {
     const note = options.note.trim();
@@ -128,28 +150,13 @@ export async function reportCommand(deps, options) {
         deps.print(`That note is longer than ${MAX_NOTE} characters. Please shorten it.`);
         return 1;
     }
-    // The gate, inherited from `dx --send` verbatim. An agent composing a note and
-    // confirming it with --yes on a machine nobody granted is the case this stops.
-    const localEnablement = deps.enablement?.() ?? { enabled: false };
-    const interactive = deps.interactive();
+    // The gate, shared with `dx --send`. An agent composing a note and confirming it
+    // with --yes on an account nobody granted is the case this stops.
     const auth = await deps.auth();
-    let accountEnablement = { enabled: false };
-    if (!interactive && !localEnablement.enabled && auth !== undefined) {
-        try {
-            accountEnablement = (await deps.accountConsent?.(auth)) ?? { enabled: false };
-        }
-        catch {
-            // Fail closed. An unreachable API never authorizes a send.
-            accountEnablement = { enabled: false };
-        }
-    }
-    const enablement = localEnablement.enabled
-        ? localEnablement
-        : accountEnablement;
-    if (!interactive && !enablement.enabled) {
-        deps.print("Sending a report needs consent that has not been given on this account.");
-        deps.print("`vincentt dx enable` opens the Vincentt console so you can allow it.");
-        deps.print("It takes one click, and it works from here.");
+    const gate = await gateSend(deps, auth);
+    if (gate.arm === "refused") {
+        for (const l of SEND_REFUSAL_LINES)
+            deps.print(l);
         return 1;
     }
     if (auth === undefined) {
@@ -179,9 +186,9 @@ export async function reportCommand(deps, options) {
     // omission an empty project yields, and neither can fail a report.
     const builtWith = await (deps.builtWith ?? (() => resolveBuiltWith(deps.cwd ?? process.cwd())))().catch(() => undefined);
     const report = buildObservationReport(note, deps.cliVersion(), context, builtWith);
-    const unattended = !interactive && enablement.enabled;
-    if (unattended) {
-        const line = enablementLine(enablement, deps.now());
+    const unattended = gate.arm === "unattended";
+    if (gate.arm === "unattended") {
+        const line = enablementLine(gate.enablement, deps.now());
         if (line !== undefined) {
             deps.print("");
             deps.print(`${line}. Not asking.`);

package/dist/dx/skeleton.js

@@ -39,6 +39,7 @@ const KNOWN_VERBS = new Set([
     "create",
     "domain",
     "dx",
+    "editor",
     "feedback",
     "init",
     "link",
@@ -82,10 +83,12 @@ const KNOWN_FLAGS = new Set([
     "--port",
     "--preview",
     "--restart",
+    "--selection",
     "--send",
     "--session",
     "--since",
     "--slug",
+    "--status",
     "--stop",
     "--template",
     "--tester",

package/dist/editor/app.d.ts

@@ -0,0 +1,61 @@
+export declare const EDITOR_BUNDLE_NAME = "Vincentt Editor.app";
+export declare const EDITOR_BUNDLE_ID = "studio.vincentt.editor";
+export declare const MIN_MACOS_MAJOR = 14;
+/** The Apple Team ID of the Developer ID that signs Vincentt Editor. */
+export declare const VINCENTT_TEAM_ID = "RB8P2M86YU";
+/**
+ * The designated requirement: Apple-anchored, a Developer ID leaf (1.2.840.113635.100.6.1.13)
+ * under the Developer ID intermediate (1.2.840.113635.100.6.2.6), the leaf's OU the Team ID,
+ * and the bundle identifier.
+ */
+export declare function designatedRequirement(teamId: string, identifier: string): string;
+export declare const EDITOR_REQUIREMENT: string;
+/** `/Applications`, then the user's own `~/Applications` (from the user database, not HOME). */
+export declare function defaultSearchRoots(): string[];
+export type Verdict = {
+    ok: true;
+} | {
+    ok: false;
+    detail: string;
+};
+export interface RunningCopy {
+    pid: number;
+    bundlePath: string;
+}
+/** The OS questions the launcher and the read flags ask. Tests replace any of them. */
+export interface MacSystem {
+    /** The macOS product version (`14.5`), or undefined when unreadable. */
+    osVersion(): Promise<string | undefined>;
+    /** `codesign --verify --deep --strict -R=<requirement> <app>`. */
+    verify(app: string, requirement: string): Promise<Verdict>;
+    /** Info.plist values of a bundle; read only after the bundle passed `verify`. */
+    bundleInfo(app: string): Promise<{
+        executable?: string;
+        version?: string;
+    }>;
+    /** Running apps registered with LaunchServices under this bundle identifier. */
+    runningCopies(bundleId: string): Promise<RunningCopy[]>;
+    /** `codesign --verify -R=<requirement> <pid>`: the running code of `pid`, as the kernel holds it. */
+    verifyPid(pid: number, requirement: string): Promise<Verdict>;
+    /** When `pid` started (epoch ms, whole seconds), or undefined when it cannot be read. */
+    startTime(pid: number): Promise<number | undefined>;
+    /** `/usr/bin/open -a <app> <folder>`; rejects when `open` fails. */
+    open(app: string, folder: string): Promise<void>;
+}
+/** codesign's last stderr line, without the leading `<path>: ` it names the bundle with. */
+export declare function codesignDetail(stderr: string, app: string): string;
+/** `lsappinfo find` output → its ASNs. */
+export declare function parseAsns(out: string): string[];
+/** `lsappinfo info -only pid -only bundlepath <asn>` output → the copy it names. */
+export declare function parseAppInfo(out: string): RunningCopy | undefined;
+/**
+ * `ps -o lstart=` run with LC_ALL=C and TZ=UTC0 (`Thu Oct 23 00:15:02 2026`, UTC) → epoch ms.
+ * Parsed as UTC, so the result does not depend on this process's time zone.
+ */
+export declare function parseLstart(out: string): number | undefined;
+/** `14.5` → 14, `13.6.1` → 13; undefined when it is not a version. */
+export declare function macosMajor(version: string | undefined): number | undefined;
+export declare function macSystem(): MacSystem;
+export declare function pidAlive(pid: number): boolean;
+/** Both paths with links resolved, compared; a path that cannot be resolved compares as given. */
+export declare function samePath(a: string, b: string): Promise<boolean>;

package/dist/editor/app.js

@@ -0,0 +1,180 @@
+// The installed Vincentt Editor app as the launcher sees it: where it may live, the designated
+// requirement it must meet, and the macOS probes that answer questions about it. Every probe
+// runs a system tool by absolute path; none reads the environment or the project.
+import { execFile } from "node:child_process";
+import { realpath } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { promisify } from "node:util";
+import { toolPath } from "./tools.js";
+const execFileP = promisify(execFile);
+export const EDITOR_BUNDLE_NAME = "Vincentt Editor.app";
+export const EDITOR_BUNDLE_ID = "studio.vincentt.editor";
+export const MIN_MACOS_MAJOR = 14;
+/** The Apple Team ID of the Developer ID that signs Vincentt Editor. */
+export const VINCENTT_TEAM_ID = "RB8P2M86YU";
+/**
+ * The designated requirement: Apple-anchored, a Developer ID leaf (1.2.840.113635.100.6.1.13)
+ * under the Developer ID intermediate (1.2.840.113635.100.6.2.6), the leaf's OU the Team ID,
+ * and the bundle identifier.
+ */
+export function designatedRequirement(teamId, identifier) {
+    return ("anchor apple generic" +
+        " and certificate leaf[field.1.2.840.113635.100.6.1.13] exists" +
+        " and certificate 1[field.1.2.840.113635.100.6.2.6] exists" +
+        ` and certificate leaf[subject.OU] = "${teamId}"` +
+        ` and identifier "${identifier}"`);
+}
+export const EDITOR_REQUIREMENT = designatedRequirement(VINCENTT_TEAM_ID, EDITOR_BUNDLE_ID);
+/** `/Applications`, then the user's own `~/Applications` (from the user database, not HOME). */
+export function defaultSearchRoots() {
+    return ["/Applications", path.join(os.userInfo().homedir, "Applications")];
+}
+const RUN = {
+    timeout: 30_000,
+    maxBuffer: 4 << 20,
+    env: { LC_ALL: "C", PATH: "/usr/bin:/bin" },
+};
+async function run(tool, args, env = RUN.env) {
+    const cmd = toolPath(tool);
+    if (cmd === undefined)
+        throw new Error(`${tool} is not where macOS keeps it`);
+    return (await execFileP(cmd, args, { ...RUN, env })).stdout;
+}
+/** codesign's last stderr line, without the leading `<path>: ` it names the bundle with. */
+export function codesignDetail(stderr, app) {
+    const lines = stderr
+        .split("\n")
+        .map((l) => l.trim())
+        .filter((l) => l !== "");
+    const last = lines[lines.length - 1] ?? "codesign refused the app";
+    return last.startsWith(`${app}: `) ? last.slice(app.length + 2) : last;
+}
+/** `lsappinfo find` output → its ASNs. */
+export function parseAsns(out) {
+    return [...out.matchAll(/ASN:0x[0-9a-f]+-0x[0-9a-f]+/gi)].map((m) => m[0]);
+}
+/** `lsappinfo info -only pid -only bundlepath <asn>` output → the copy it names. */
+export function parseAppInfo(out) {
+    const pid = /"pid"\s*=\s*(\d+)/.exec(out)?.[1];
+    const bundle = /"LSBundlePath"\s*=\s*"(.*)"\s*$/m.exec(out)?.[1];
+    if (pid === undefined || bundle === undefined || bundle === "")
+        return undefined;
+    return { pid: Number(pid), bundlePath: bundle };
+}
+const MONTHS = [
+    "Jan",
+    "Feb",
+    "Mar",
+    "Apr",
+    "May",
+    "Jun",
+    "Jul",
+    "Aug",
+    "Sep",
+    "Oct",
+    "Nov",
+    "Dec",
+];
+/**
+ * `ps -o lstart=` run with LC_ALL=C and TZ=UTC0 (`Thu Oct 23 00:15:02 2026`, UTC) → epoch ms.
+ * Parsed as UTC, so the result does not depend on this process's time zone.
+ */
+export function parseLstart(out) {
+    const m = /^\w{3}\s+(\w{3})\s+(\d{1,2})\s+(\d{2}):(\d{2}):(\d{2})\s+(\d{4})$/.exec(out.trim());
+    if (m === null)
+        return undefined;
+    const month = MONTHS.indexOf(m[1]);
+    if (month < 0)
+        return undefined;
+    const t = Date.UTC(Number(m[6]), month, Number(m[2]), Number(m[3]), Number(m[4]), Number(m[5]));
+    return Number.isFinite(t) ? t : undefined;
+}
+/** `14.5` → 14, `13.6.1` → 13; undefined when it is not a version. */
+export function macosMajor(version) {
+    const m = /^(\d+)(?:\.\d+)*$/.exec(version?.trim() ?? "");
+    return m ? Number(m[1]) : undefined;
+}
+/** `codesign <args>`: ok on exit 0, else its last stderr line (with `subject: ` removed). */
+async function codesignVerify(args, subject) {
+    const cmd = toolPath("codesign");
+    if (cmd === undefined)
+        return { ok: false, detail: "codesign is not where macOS keeps it" };
+    try {
+        await execFileP(cmd, args, RUN);
+        return { ok: true };
+    }
+    catch (err) {
+        const stderr = err.stderr;
+        return { ok: false, detail: codesignDetail(stderr ?? String(err), subject) };
+    }
+}
+export function macSystem() {
+    return {
+        osVersion: async () => {
+            const v = await run("sw_vers", ["-productVersion"]).catch(() => "");
+            return v.trim() || undefined;
+        },
+        verify: (app, requirement) => codesignVerify(["--verify", "--deep", "--strict", `-R=${requirement}`, app], app),
+        verifyPid: (pid, requirement) => Number.isInteger(pid) && pid > 0
+            ? codesignVerify(["--verify", `-R=${requirement}`, String(pid)], String(pid))
+            : Promise.resolve({ ok: false, detail: "not a process id" }),
+        bundleInfo: async (app) => {
+            const plist = path.join(app, "Contents", "Info.plist");
+            const read = async (key) => (await run("plutil", ["-extract", key, "raw", "-o", "-", plist]).catch(() => "")).trim() || undefined;
+            return {
+                executable: await read("CFBundleExecutable"),
+                version: await read("CFBundleShortVersionString"),
+            };
+        },
+        runningCopies: async (bundleId) => {
+            // Throws when the running copies cannot be listed: an unknown answer is not "none".
+            const found = await run("lsappinfo", ["find", `bundleID=${bundleId}`]);
+            const asns = parseAsns(found);
+            if (asns.length === 0 && found.trim() !== "")
+                throw new Error("lsappinfo find answered without an ASN");
+            const copies = [];
+            for (const asn of asns) {
+                const info = await run("lsappinfo", [
+                    "info",
+                    "-only",
+                    "pid",
+                    "-only",
+                    "bundlepath",
+                    asn,
+                ]);
+                const copy = parseAppInfo(info);
+                if (copy === undefined)
+                    throw new Error("lsappinfo info named no pid and bundle");
+                // LaunchServices can list an app for a moment after it exits.
+                if (pidAlive(copy.pid))
+                    copies.push(copy);
+            }
+            return copies;
+        },
+        startTime: async (pid) => parseLstart(await run("ps", ["-o", "lstart=", "-p", String(pid)], {
+            ...RUN.env,
+            TZ: "UTC0",
+        }).catch(() => "")),
+        open: async (app, folder) => {
+            await run("open", ["-a", app, folder]);
+        },
+    };
+}
+export function pidAlive(pid) {
+    if (!Number.isInteger(pid) || pid <= 0)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        return err.code === "EPERM";
+    }
+}
+/** Both paths with links resolved, compared; a path that cannot be resolved compares as given. */
+export async function samePath(a, b) {
+    const ra = await realpath(a).catch(() => path.resolve(a));
+    const rb = await realpath(b).catch(() => path.resolve(b));
+    return ra === rb;
+}

package/dist/editor/copy.d.ts

@@ -0,0 +1,22 @@
+export declare const DOWNLOAD_URL = "https://vincentt.studio/editor";
+export declare const NOTHING_OPENED = "Nothing was opened.";
+export declare const NOT_RUNNING = "\u2717 No editor is running for this folder.";
+/** `~/Downloads/Vincentt Editor.app` for a path under the home folder. */
+export declare function tildePath(p: string, home?: string): string;
+export declare function sent(name: string): string;
+export declare function notInstalled(): string[];
+/** `app` is the refused bundle; the copy names the folder it was found in. */
+export declare function badSignature(app: string): string[];
+/** The copy on disk passes, but the one running from the same place does not. */
+export declare function runningCopyNotSigned(): string[];
+export declare function notMacos(): string[];
+export declare function macosTooOld(version: string): string[];
+export declare function otherCopyRunning(bundlePath: string): string[];
+/** A flag the launcher had before it handed off to the app (`--port`, `--dev-url`). */
+export declare function removedFlag(flag: string): string[];
+export declare function unknownFlag(flag: string): string[];
+export declare function strayArgument(): string[];
+export declare function bothReads(): string[];
+export declare function openFailed(): string[];
+/** A local file written in a schema major this CLI does not know. */
+export declare function tooNew(schema: string): string[];