create-opentray 0.0.0 → 0.19.0

package/dist/bin-BT_kcLuP.mjs

@@ -0,0 +1,3823 @@
+import { createRequire } from "node:module";
+import { createHash, randomBytes } from "node:crypto";
+import { access, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
+import { homedir, tmpdir } from "node:os";
+import { delimiter, dirname, extname, isAbsolute, join, resolve, sep } from "node:path";
+import { execFile, spawn } from "node:child_process";
+import net from "node:net";
+import { fileURLToPath } from "node:url";
+import sharp from "sharp";
+import { resolveDefaultDarwinAppBundlePath, sanitizeAppBundleName } from "@opentray/packaging";
+import { generateOpenTrayAppIcon } from "@opentray/vite-plugin";
+import { constants } from "node:fs";
+import { createServer } from "node:http";
+//#region src/app-id.ts
+/** A token that looks like a command option, e.g. `--xx`, `-p`, or `--port=8080`. */
+const isOptionToken = (token) => token.startsWith("-") && token.length > 1;
+/**
+* Default appId derivation. `npx somecommand start --xx` keeps the pre-option
+* tokens `["npx", "somecommand", "start"]`, reverses them, and dot-joins:
+* `start.somecommand.npx`.
+*/
+const deriveDefaultAppId = (tokens) => {
+	const preOption = [];
+	for (const token of tokens) {
+		if (isOptionToken(token)) break;
+		preOption.push(token);
+	}
+	const segments = preOption.map((token) => token.split(/[/\\]/).pop() ?? token).filter((segment) => segment.length > 0).reverse();
+	if (segments.length === 0) return "app.opentray";
+	return segments.join(".");
+};
+/** Human display name from the appId derivation: `Somecommand Start`. */
+const deriveDefaultAppName = (tokens) => {
+	return deriveDefaultAppId(tokens).split(".").filter((segment) => segment.length > 0).map((segment) => segment.charAt(0).toUpperCase() + segment.slice(1)).join(" ");
+};
+/** Directory-safe project name from an appId (mirrors packaging normalizeAppId semantics). */
+const toProjectDirectoryName = (appId) => {
+	const normalized = appId.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+	return normalized.length > 0 ? normalized : "opentray-app";
+};
+/** True when the appId has the shape consumers expect for stable identity. */
+const isValidAppId = (appId) => {
+	const trimmed = appId.trim();
+	return trimmed.length > 0 && /^[a-z0-9]+(\.[a-z0-9-]+)+$/iu.test(trimmed);
+};
+//#endregion
+//#region src/command-run.ts
+const SHELL_METACHARS = /[<>&|;$`"'%]/u;
+/** True when the command line needs a shell (only Windows uses cmd /c). */
+const needsShell = (tokens) => tokens.some((token) => SHELL_METACHARS.test(token) && token.length > 1);
+let ptyProbe;
+/**
+* Feature-detect the optional native PTY dependency. A failed or missing
+* install must never break the wizard: callers fall back to pipe mode.
+* The probe result is cached so repeated commands do not re-require it.
+*/
+const loadPtyModule = (probe = defaultPtyProbe) => {
+	ptyProbe ??= probe().catch(() => void 0);
+	return ptyProbe;
+};
+const defaultPtyProbe = async () => {
+	if (process.versions.bun !== void 0) return;
+	const require = createRequire(import.meta.url);
+	for (const request of ["@lydell/node-pty", "node-pty"]) try {
+		const raw = require(request);
+		if (typeof raw.spawn === "function") return raw;
+	} catch {}
+};
+const DEFAULT_TERMINAL_SIZE = {
+	cols: 100,
+	rows: 30
+};
+/** The Bun global when running under Bun with the native Terminal API. */
+const bunTerminalRuntime = () => {
+	const runtime = globalThis.Bun;
+	if (typeof runtime !== "object" || runtime === null) return;
+	const candidate = runtime;
+	if (typeof candidate.Terminal !== "function" || typeof candidate.spawn !== "function") return;
+	return candidate;
+};
+/**
+* Native Bun PTY backend: `Bun.Terminal` + `Bun.spawn({ terminal })`. Under
+* Bun this replaces @lydell/node-pty entirely — the optional native module
+* loads but never delivers output under Bun, while the built-in Terminal is
+* first-class (verified Bun 1.3.14: output, stdin echo, resize, exit codes).
+*/
+const startBunTerminalRun = (options, bun) => {
+	const [command, ...args] = options.tokens;
+	if (command === void 0) return emptyRun(options, "command is empty");
+	const size = options.terminalSize ?? DEFAULT_TERMINAL_SIZE;
+	const ring = [];
+	const ringLimit = options.ringLimit ?? 200;
+	const decoder = new TextDecoder();
+	const append = (chunk) => {
+		ring.push(chunk);
+		if (ring.length > ringLimit) ring.splice(0, ring.length - ringLimit);
+	};
+	const terminal = new bun.Terminal({
+		cols: size.cols,
+		rows: size.rows,
+		name: "xterm-256color",
+		data: (_terminal, data) => {
+			const text = decoder.decode(data);
+			if (text.length === 0) return;
+			append(text);
+			options.onEvent({
+				type: "stdout",
+				chunk: text
+			});
+		}
+	});
+	const proc = bun.spawn([command, ...args], {
+		terminal,
+		cwd: options.cwd ?? globalThis.process.cwd(),
+		env: {
+			...globalThis.process.env,
+			...options.env,
+			TERM: "xterm-256color"
+		}
+	});
+	options.onEvent({ type: "pty-ready" });
+	const exited = proc.exited.then((code) => {
+		options.onEvent({
+			type: "exit",
+			code
+		});
+		return { code };
+	});
+	let killPromise;
+	return {
+		pid: proc.pid,
+		pty: true,
+		exited,
+		output: ring,
+		write(data) {
+			terminal.write(data);
+		},
+		resize({ cols, rows }) {
+			terminal.resize(cols, rows);
+		},
+		kill() {
+			killPromise ??= (async () => {
+				try {
+					proc.kill();
+				} catch {}
+				try {
+					terminal.close();
+				} catch {}
+				await exited.catch(() => void 0);
+			})();
+			return killPromise;
+		}
+	};
+};
+const startCommandRun = async (options) => {
+	if (options.pty !== false) {
+		const bun = bunTerminalRuntime();
+		if (bun !== void 0) try {
+			return startBunTerminalRun(options, bun);
+		} catch (error) {
+			options.onEvent({
+				type: "spawn-error",
+				message: `bun terminal spawn failed: ${error instanceof Error ? error.message : String(error)}`
+			});
+		}
+		else if (process.versions.bun !== void 0) options.onEvent({
+			type: "pty-unavailable",
+			message: "Bun 版本缺少 Bun.Terminal（需要 Bun ≥ 1.2.19），预览以非交互模式运行。"
+		});
+		else {
+			const ptyModule = await loadPtyModule();
+			if (ptyModule !== void 0) try {
+				return startPtyRun(options, ptyModule);
+			} catch (error) {
+				options.onEvent({
+					type: "spawn-error",
+					message: `pty spawn failed: ${error instanceof Error ? error.message : String(error)}`
+				});
+			}
+			else options.onEvent({
+				type: "pty-unavailable",
+				message: "node-pty 不可用，预览以非交互模式运行（无法向命令输入内容）。可安装 @lydell/node-pty 启用交互。"
+			});
+		}
+	}
+	return startPipeRun(options);
+};
+const startPtyRun = (options, ptyModule) => {
+	const [command, ...args] = options.tokens;
+	if (command === void 0) return emptyRun(options, "command is empty");
+	const size = options.terminalSize ?? DEFAULT_TERMINAL_SIZE;
+	const ring = [];
+	const ringLimit = options.ringLimit ?? 200;
+	const onEvent = options.onEvent;
+	const append = (chunk) => {
+		ring.push(chunk);
+		if (ring.length > ringLimit) ring.splice(0, ring.length - ringLimit);
+	};
+	const ptyProcess = ptyModule.spawn(command, args, {
+		name: "xterm-256color",
+		cols: size.cols,
+		rows: size.rows,
+		cwd: options.cwd ?? globalThis.process.cwd(),
+		env: {
+			...globalThis.process.env,
+			...options.env,
+			TERM: "xterm-256color"
+		}
+	});
+	onEvent({ type: "pty-ready" });
+	const exited = new Promise((resolve) => {
+		ptyProcess.onExit(({ exitCode }) => {
+			onEvent({
+				type: "exit",
+				code: exitCode
+			});
+			resolve({ code: exitCode });
+		});
+	});
+	ptyProcess.onData((data) => {
+		if (data.length === 0) return;
+		append(data);
+		onEvent({
+			type: "stdout",
+			chunk: data
+		});
+	});
+	let killPromise;
+	return {
+		pid: ptyProcess.pid,
+		pty: true,
+		exited,
+		output: ring,
+		write(data) {
+			ptyProcess.write(data);
+		},
+		resize({ cols, rows }) {
+			try {
+				ptyProcess.resize(cols, rows);
+			} catch {}
+		},
+		kill: () => {
+			killPromise ??= (async () => {
+				try {
+					ptyProcess.kill();
+				} catch {}
+			})();
+			return killPromise;
+		}
+	};
+};
+const startPipeRun = (options) => {
+	const [command, ...args] = options.tokens;
+	if (command === void 0) return emptyRun(options, "command is empty");
+	const ring = [];
+	const ringLimit = options.ringLimit ?? 200;
+	const onEvent = options.onEvent;
+	const append = (chunk) => {
+		ring.push(chunk);
+		if (ring.length > ringLimit) ring.splice(0, ring.length - ringLimit);
+	};
+	const useShell = process.platform === "win32" && needsShell(options.tokens);
+	let child;
+	try {
+		child = spawn(command, args, {
+			cwd: options.cwd,
+			env: options.env ?? process.env,
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			],
+			shell: useShell,
+			windowsHide: true,
+			detached: process.platform !== "win32"
+		});
+	} catch (error) {
+		return emptyRun(options, error instanceof Error ? error.message : String(error), {
+			code: null,
+			spawnError: error instanceof Error ? error.message : String(error)
+		});
+	}
+	const exited = new Promise((resolve) => {
+		child.once("error", (error) => {
+			onEvent({
+				type: "spawn-error",
+				message: error.message
+			});
+			resolve({
+				code: null,
+				spawnError: error.message
+			});
+		});
+		child.once("exit", (code) => {
+			onEvent({
+				type: "exit",
+				code
+			});
+			resolve({ code });
+		});
+	});
+	const pipe = (stream, type) => {
+		if (stream === null) return;
+		stream.on("data", (chunk) => {
+			const text = Buffer.from(chunk).toString("utf8");
+			append(text);
+			onEvent({
+				type,
+				chunk: text
+			});
+		});
+	};
+	pipe(child.stdout, "stdout");
+	pipe(child.stderr, "stderr");
+	let killPromise;
+	return {
+		pid: child.pid,
+		pty: false,
+		exited,
+		output: ring,
+		write() {},
+		resize() {},
+		kill: () => {
+			killPromise ??= killProcessTree(child);
+			return killPromise;
+		}
+	};
+};
+const emptyRun = (options, message, resolved) => {
+	options.onEvent({
+		type: "spawn-error",
+		message
+	});
+	return {
+		pid: void 0,
+		pty: false,
+		exited: Promise.resolve(resolved ?? {
+			code: null,
+			spawnError: message
+		}),
+		output: [],
+		write() {},
+		resize() {},
+		kill: async () => {}
+	};
+};
+/** Kill a command run and every descendant it spawned. */
+const killProcessTree = async (child) => {
+	const pid = child.pid;
+	if (pid === void 0) return;
+	try {
+		if (process.platform === "win32") await runExecFile("taskkill", [
+			"/PID",
+			String(pid),
+			"/T",
+			"/F"
+		]);
+		else {
+			try {
+				process.kill(-pid, "SIGTERM");
+			} catch {
+				child.kill("SIGTERM");
+			}
+			await waitForExit(child, 3e3).then((exited) => {
+				if (!exited) try {
+					process.kill(-pid, "SIGKILL");
+				} catch {
+					child.kill("SIGKILL");
+				}
+			});
+		}
+	} catch {}
+	if (child.exitCode === null && child.signalCode === null) child.kill("SIGKILL");
+};
+const waitForExit = (child, timeoutMs) => new Promise((resolve) => {
+	if (child.exitCode !== null || child.signalCode !== null) {
+		resolve(true);
+		return;
+	}
+	const timer = setTimeout(() => resolve(false), timeoutMs);
+	child.once("exit", () => {
+		clearTimeout(timer);
+		resolve(true);
+	});
+});
+const runExecFile = (command, args) => new Promise((resolve, reject) => {
+	execFile(command, [...args], {
+		timeout: 5e3,
+		windowsHide: true
+	}, (error) => {
+		if (error !== null) {
+			reject(error);
+			return;
+		}
+		resolve();
+	});
+});
+//#endregion
+//#region src/port-scan.ts
+/** Loopback service URL for a discovered port. */
+const serviceUrl = (port) => `http://127.0.0.1:${port}`;
+const LOOPBACK_NO_PROXY = "localhost,127.0.0.1,::1";
+/** Ensure loopback fetches bypass system proxies (same guard as source examples). */
+const ensureLoopbackNoProxy = (env = process.env) => {
+	const merged = [env.NO_PROXY ?? env.no_proxy ?? "", LOOPBACK_NO_PROXY].join(",").split(",").map((value) => value.trim()).filter(Boolean);
+	env.NO_PROXY = Array.from(new Set(merged)).join(",");
+	env.no_proxy = env.NO_PROXY;
+};
+const listListeningPorts = async (platform) => {
+	if (platform === "win32") return listWindowsListeningPorts();
+	return listLsofListeningPorts();
+};
+/** Listeners with ownership; used to attribute ports to the preview process tree. */
+const listListeningPortOwners = async (platform = process.platform) => {
+	if (platform === "win32") {
+		const stdout = await runCapture("netstat", [
+			"-ano",
+			"-p",
+			"tcp"
+		]).catch(() => "");
+		return parseNetstatPortOwners(stdout);
+	}
+	const stdout = await runCapture("lsof", [
+		"-nP",
+		"-iTCP",
+		"-sTCP:LISTEN",
+		"-F",
+		"pPn"
+	]).catch(() => "");
+	return parseLsofPortOwners(stdout);
+};
+const listLsofListeningPorts = async () => {
+	const stdout = await runCapture("lsof", [
+		"-nP",
+		"-iTCP",
+		"-sTCP:LISTEN",
+		"-F",
+		"Pn"
+	]).catch(() => "");
+	return parseLsofPorts(stdout);
+};
+/**
+* Parse `lsof -F pPn` output into port -> owning PIDs. The field stream is
+* `p<pid>`, `P<proto>`, `n<host:port>` per socket, so each address inherits
+* the most recent pid field.
+*/
+const parseLsofPortOwners = (stdout) => {
+	const owners = /* @__PURE__ */ new Map();
+	let currentPid;
+	for (const line of stdout.split("\n")) {
+		if (line.startsWith("p")) {
+			const pid = Number.parseInt(line.slice(1), 10);
+			currentPid = Number.isInteger(pid) ? pid : void 0;
+			continue;
+		}
+		if (!line.startsWith("n")) continue;
+		const hostPort = line.slice(1);
+		const index = hostPort.lastIndexOf(":");
+		if (index < 0) continue;
+		const port = Number.parseInt(hostPort.slice(index + 1), 10);
+		if (!Number.isInteger(port) || port <= 0 || currentPid === void 0) continue;
+		const pids = owners.get(port) ?? /* @__PURE__ */ new Set();
+		pids.add(currentPid);
+		owners.set(port, pids);
+	}
+	return owners;
+};
+/** Parse `netstat -ano -p tcp` into port -> owning PIDs (PID is the last column). */
+const parseNetstatPortOwners = (stdout) => {
+	const owners = /* @__PURE__ */ new Map();
+	for (const rawLine of stdout.split("\n")) {
+		const line = rawLine.trim();
+		if (!line.toLowerCase().includes("listening")) continue;
+		const columns = line.split(/\s+/);
+		const local = columns.find((column) => column.includes(":"));
+		const pid = Number.parseInt(columns[columns.length - 1] ?? "", 10);
+		if (local === void 0 || !Number.isInteger(pid)) continue;
+		const index = local.lastIndexOf(":");
+		const port = Number.parseInt(local.slice(index + 1), 10);
+		if (!Number.isInteger(port) || port <= 0) continue;
+		const pids = owners.get(port) ?? /* @__PURE__ */ new Set();
+		pids.add(pid);
+		owners.set(port, pids);
+	}
+	return owners;
+};
+const parseLsofPorts = (stdout) => {
+	const ports = /* @__PURE__ */ new Set();
+	for (const line of stdout.split("\n")) {
+		if (!line.startsWith("n")) continue;
+		const hostPort = line.slice(1);
+		const index = hostPort.lastIndexOf(":");
+		if (index < 0) continue;
+		const port = Number.parseInt(hostPort.slice(index + 1), 10);
+		if (Number.isInteger(port) && port > 0) ports.add(port);
+	}
+	return ports;
+};
+const listWindowsListeningPorts = async () => {
+	try {
+		const stdout = await runCapture("netstat", [
+			"-ano",
+			"-p",
+			"tcp"
+		]);
+		return parseNetstatPorts(stdout);
+	} catch {
+		const stdout = await runPowerShellTcpConnections();
+		return parsePowerShellPorts(stdout);
+	}
+};
+/** Parses `netstat -ano -p tcp` output; keeps LISTENING rows. */
+const parseNetstatPorts = (stdout) => {
+	const ports = /* @__PURE__ */ new Set();
+	for (const rawLine of stdout.split("\n")) {
+		const line = rawLine.trim();
+		if (!line.toLowerCase().includes("listening")) continue;
+		const local = line.split(/\s+/).find((column) => column.includes(":"));
+		if (local === void 0) continue;
+		const index = local.lastIndexOf(":");
+		const port = Number.parseInt(local.slice(index + 1), 10);
+		if (Number.isInteger(port) && port > 0) ports.add(port);
+	}
+	return ports;
+};
+const runPowerShellTcpConnections = async () => {
+	return await runCapture("powershell.exe", [
+		"-NoProfile",
+		"-NonInteractive",
+		"-ExecutionPolicy",
+		"Bypass",
+		"-Command",
+		"[Net.NetworkInformation.NetworkInformation]::GetActiveTcpConnections() | ForEach-Object { $_.LocalEndPoint.Port }"
+	]);
+};
+const parsePowerShellPorts = (stdout) => {
+	const ports = /* @__PURE__ */ new Set();
+	for (const line of stdout.split("\n")) {
+		const port = Number.parseInt(line.trim(), 10);
+		if (Number.isInteger(port) && port > 0) ports.add(port);
+	}
+	return ports;
+};
+/** TCP-connect probe used by the generated app and discovery verification. */
+const waitForTcpPort = async (port, timeoutMs, intervalMs = 150, host = "127.0.0.1") => {
+	const deadline = Date.now() + timeoutMs;
+	while (Date.now() < deadline) {
+		if (await tcpProbe(host, port)) return true;
+		await sleep(intervalMs);
+	}
+	return false;
+};
+const tcpProbe = (host, port, timeoutMs = 500) => new Promise((resolve) => {
+	const socket = new net.Socket();
+	const finish = (result) => {
+		socket.destroy();
+		resolve(result);
+	};
+	socket.setTimeout(timeoutMs);
+	socket.once("connect", () => finish(true));
+	socket.once("timeout", () => finish(false));
+	socket.once("error", () => finish(false));
+	socket.connect(port, host);
+});
+/** Verify a port answers with an HTTP response (any status counts). */
+const verifyHttpService = async (port, timeoutMs = 2e3) => {
+	ensureLoopbackNoProxy();
+	const controller = new AbortController();
+	const timer = setTimeout(() => controller.abort(), timeoutMs);
+	try {
+		return (await fetch(serviceUrl(port), {
+			signal: controller.signal,
+			redirect: "manual"
+		})).status > 0;
+	} catch {
+		return false;
+	} finally {
+		clearTimeout(timer);
+	}
+};
+/** Collect a PID and every descendant (BFS over `pgrep -P` on POSIX). */
+const collectProcessTreePids = async (rootPid, platform = process.platform, options = {}) => {
+	const capture = options.runCapture ?? runCapture;
+	const tree = /* @__PURE__ */ new Set([rootPid]);
+	if (platform === "win32") return tree;
+	const frontier = [rootPid];
+	while (frontier.length > 0) {
+		const pid = frontier.shift();
+		if (pid === void 0) break;
+		const stdout = await capture("pgrep", ["-P", String(pid)]).catch(() => "");
+		for (const line of stdout.split("\n")) {
+			const child = Number.parseInt(line.trim(), 10);
+			if (Number.isInteger(child) && child > 0 && !tree.has(child)) {
+				tree.add(child);
+				frontier.push(child);
+			}
+		}
+	}
+	return tree;
+};
+/**
+* Diff-based port discovery. Each poll re-enumerates listeners, keeps ports
+* absent from the baseline, and adds HTTP-verified ones in first-seen order.
+*/
+const createPortDiscovery = (options) => {
+	const platform = options.platform ?? process.platform;
+	const listListeners = options.listListeners ?? listListeningPorts;
+	const verifyHttp = options.verifyHttp ?? verifyHttpService;
+	const listOwners = options.listOwners ?? (() => listListeningPortOwners(platform));
+	const services = /* @__PURE__ */ new Map();
+	const verifying = /* @__PURE__ */ new Set();
+	const rejected = /* @__PURE__ */ new Set();
+	let stopped = false;
+	const poll = async () => {
+		if (stopped) return [];
+		let listeners;
+		try {
+			listeners = await listListeners(platform);
+		} catch {
+			return [];
+		}
+		let owners;
+		let ownerPids;
+		if (options.resolveOwnerPids !== void 0) {
+			const [ownerMap, pids] = await Promise.all([listOwners().catch(() => void 0), options.resolveOwnerPids().catch(() => void 0)]);
+			owners = ownerMap;
+			ownerPids = pids;
+		}
+		const added = [];
+		const pending = [];
+		for (const port of listeners) {
+			if (options.baseline.has(port) || services.has(port) || rejected.has(port)) continue;
+			if (verifying.has(port)) continue;
+			if (owners !== void 0 && ownerPids !== void 0) {
+				const portOwners = owners.get(port);
+				if (!(portOwners !== void 0 && [...portOwners].some((pid) => ownerPids.has(pid)))) continue;
+			}
+			verifying.add(port);
+			pending.push(verifyHttp(port).then((ok) => {
+				if (!ok) {
+					rejected.add(port);
+					return;
+				}
+				const service = {
+					port,
+					url: serviceUrl(port),
+					firstSeenAt: Date.now()
+				};
+				services.set(port, service);
+				added.push(service);
+			}).catch(() => {
+				rejected.add(port);
+			}).finally(() => {
+				verifying.delete(port);
+			}));
+		}
+		await Promise.all(pending);
+		return [...services.values()].sort((a, b) => a.firstSeenAt - b.firstSeenAt);
+	};
+	return {
+		services: () => [...services.values()].sort((a, b) => a.firstSeenAt - b.firstSeenAt),
+		poll,
+		stop() {
+			stopped = true;
+		}
+	};
+};
+const runCapture = async (command, args) => new Promise((resolve, reject) => {
+	execFile(command, [...args], {
+		encoding: "utf8",
+		timeout: 1e4,
+		windowsHide: true
+	}, (error, stdout) => {
+		if (error !== null) {
+			reject(error);
+			return;
+		}
+		resolve(stdout);
+	});
+});
+const sleep = (ms) => new Promise((resolve) => {
+	setTimeout(resolve, ms);
+});
+//#endregion
+//#region src/icon-compose.ts
+/**
+* App-icon composition (owner round-12): the user's foreground icon is
+* composited onto one of three BACKGROUNDS — black, white, or transparent —
+* and the background is auto-selected for contrast with the artwork's own
+* luminance. The foreground's ORIGINAL PIXELS are always preserved (never
+* recolored); macOS receives an 824px-content variant inside the 1024 canvas
+* (platform best practice), Windows/Linux take the full 1024.
+*
+* The bundled background PNGs carry the squircle alpha mask. That mask is the
+* owner's clipping law (invert → polarize → mask): it is applied to EVERY
+* composition — including the transparent background, whose square source
+* would otherwise render un-rounded on macOS.
+*/
+const moduleDirectory$1 = dirname(fileURLToPath(import.meta.url));
+const APP_ICON_CANVAS = 1024;
+const BACKGROUND_FILES = {
+	black: "create-openspec-template-iOS-Dark-1024@1x.png",
+	white: "create-openspec-template-iOS-Default-1024@1x.png"
+};
+const TRANSPARENT = {
+	r: 0,
+	g: 0,
+	b: 0,
+	alpha: 0
+};
+const backgroundCache = /* @__PURE__ */ new Map();
+const assetsDirectory = () => moduleDirectory$1.endsWith(`${sep}src`) ? join(moduleDirectory$1, "..", "assets") : join(moduleDirectory$1, "assets");
+const loadBackground = async (background) => {
+	const cached = backgroundCache.get(background);
+	if (cached !== void 0) return cached;
+	const bytes = await readFile(join(assetsDirectory(), BACKGROUND_FILES[background]));
+	backgroundCache.set(background, bytes);
+	return bytes;
+};
+/**
+* Full-resolution RGBA pixels of a source (no geometry-altering resize).
+* `.rotate()` applies EXIF orientation so phone-photo icons compose upright.
+* SVG density is raised so large-viewBox art rasterizes instead of hitting
+* the pixel limit wholesale.
+*/
+const foregroundRaw = async (sourcePath) => {
+	const { data, info } = await sharp(sourcePath, {
+		failOn: "none",
+		density: 72,
+		limitInputPixels: false
+	}).rotate().resize(512, 512, {
+		fit: "inside",
+		withoutEnlargement: false
+	}).ensureAlpha().raw().toBuffer({ resolveWithObject: true });
+	return {
+		data,
+		width: info.width,
+		height: info.height
+	};
+};
+/** Both analysis metrics from ONE decode (huge uploads must not double). */
+const foregroundStats = async (sourcePath) => {
+	const { data, width, height } = await foregroundRaw(sourcePath);
+	let weight = 0;
+	let sum = 0;
+	let opaque = 0;
+	for (let i = 0; i < data.length; i += 4) {
+		const a = (data[i + 3] ?? 0) / 255;
+		if (a > 0) {
+			const lum = (.299 * (data[i] ?? 0) + .587 * (data[i + 1] ?? 0) + .114 * (data[i + 2] ?? 0)) / 255;
+			weight += a;
+			sum += lum * a;
+		}
+		if ((data[i + 3] ?? 0) > 16) opaque += 1;
+	}
+	return {
+		luminance: weight < width * height * .02 ? void 0 : sum / weight,
+		coverage: opaque / (width * height)
+	};
+};
+/** Owner rule: pick the background for a foreground automatically. */
+const autoBackground = (options) => {
+	if (options.coverage >= .985) return "transparent";
+	return options.luminance !== void 0 && options.luminance > .5 ? "black" : "white";
+};
+let squircleMaskPromise;
+/**
+* The squircle clip mask (1024², single channel) extracted from the bundled
+* background's alpha: 255 inside the rounded tile, 0 outside.
+*/
+const squircleMask = () => {
+	squircleMaskPromise ??= (async () => {
+		const { data, info } = await sharp(await loadBackground("white"), { failOn: "none" }).ensureAlpha().extractChannel("alpha").raw().toBuffer({ resolveWithObject: true });
+		if (info.width !== 1024 || info.height !== 1024) throw new Error("squircle mask must be 1024×1024");
+		return data;
+	})();
+	return squircleMaskPromise;
+};
+/** Clip an RGBA buffer to the squircle via a dest-in alpha mask. */
+const clipToSquircle = async (bytes) => {
+	const mask = await squircleMask();
+	const overlay = Buffer.alloc(APP_ICON_CANVAS * APP_ICON_CANVAS * 4);
+	for (let i = 0; i < APP_ICON_CANVAS * APP_ICON_CANVAS; i += 1) {
+		const o = i * 4;
+		overlay[o] = 255;
+		overlay[o + 1] = 255;
+		overlay[o + 2] = 255;
+		overlay[o + 3] = mask[i] ?? 0;
+	}
+	return sharp(bytes).composite([{
+		input: overlay,
+		blend: "dest-in",
+		left: 0,
+		top: 0,
+		raw: {
+			width: APP_ICON_CANVAS,
+			height: APP_ICON_CANVAS,
+			channels: 4
+		}
+	}]).png({ compressionLevel: 9 }).toBuffer();
+};
+/**
+* Composite the app icon. The foreground's ORIGINAL pixels are preserved on
+* every background — the background choice provides the contrast, not a
+* recolor of the artwork (the round-12 defect that painted a white icon
+* black).
+*
+* Output: `app-composited.png` at CANVAS size (Windows/Linux form — the tile
+* fills the canvas), plus `app-composited-macos.png` where the ENTIRE tile
+* (background + art) is scaled to 824 and centered on the transparent 1024
+* canvas. Dock icons since Big Sur carry those margins instead of running
+* edge-to-edge; scaling only the art (the earlier defect) left the tile
+* filling all available space.
+*/
+const composeAppIcon = async (options) => {
+	const scale = options.scale ?? .8;
+	const outputDir = options.outputDir;
+	await mkdir(outputDir, { recursive: true });
+	const compositionDir = join(outputDir, compositionCacheKey({
+		foregroundPath: options.foregroundPath,
+		background: options.background,
+		scale
+	}));
+	await mkdir(compositionDir, { recursive: true });
+	const buildComposite = async () => {
+		const fgSize = Math.round(APP_ICON_CANVAS * scale);
+		const offset = Math.round((APP_ICON_CANVAS - fgSize) / 2);
+		const foreground = await sharp(options.foregroundPath, {
+			failOn: "none",
+			density: 72,
+			limitInputPixels: false
+		}).rotate().resize(fgSize, fgSize, {
+			fit: "contain",
+			background: TRANSPARENT
+		}).png().toBuffer();
+		const composed = await (options.background === "transparent" ? sharp({ create: {
+			width: APP_ICON_CANVAS,
+			height: APP_ICON_CANVAS,
+			channels: 4,
+			background: TRANSPARENT
+		} }) : sharp(await loadBackground(options.background))).composite([{
+			input: foreground,
+			top: offset,
+			left: offset
+		}]).png({ compressionLevel: 9 }).toBuffer();
+		return clipToSquircle(composed);
+	};
+	const writeVariant = async (bytes, suffix) => {
+		const path = join(compositionDir, `app-composited${suffix}.png`);
+		await writeFile(path, bytes);
+		return path;
+	};
+	const full = await buildComposite();
+	const macOSMargin = Math.round((APP_ICON_CANVAS - 824) / 2);
+	const macOSBytes = await sharp(full).resize(824, 824, { kernel: sharp.kernel.lanczos3 }).extend({
+		top: macOSMargin,
+		bottom: macOSMargin,
+		left: macOSMargin,
+		right: macOSMargin,
+		background: TRANSPARENT
+	}).png({ compressionLevel: 9 }).toBuffer();
+	return {
+		compositePath: await writeVariant(full, ""),
+		macOSPath: await writeVariant(macOSBytes, "-macos"),
+		background: options.background
+	};
+};
+/** Stable cache key for a composed icon (wizard-side preview reuse). */
+const compositionCacheKey = (options) => createHash("sha256").update(`${options.foregroundPath}|${options.background}|${options.scale}`).digest("hex").slice(0, 16);
+//#endregion
+//#region src/scrape.ts
+/** Extract `<title>` text from HTML. */
+const extractTitle = (html) => {
+	const match = /<title[^>]*>([\s\S]*?)<\/title>/iu.exec(html);
+	if (match === null || match[1] === void 0) return;
+	const trimmed = match[1].replace(/&amp;/gu, "&").replace(/&lt;/gu, "<").replace(/&gt;/gu, ">").replace(/&quot;/gu, "\"").replace(/&#39;/gu, "'").replace(/\s+/gu, " ").trim();
+	return trimmed.length > 0 ? trimmed : void 0;
+};
+/** Extract `<link rel=... href=...>` favicon candidates from HTML head. */
+const extractFaviconCandidates = (html) => {
+	const candidates = [];
+	const pattern = /<link\b[^>]*>/giu;
+	let match;
+	while ((match = pattern.exec(html)) !== null) {
+		const tag = match[0];
+		const rel = /rel\s*=\s*("([^"]*)"|'([^']*)')/iu.exec(tag);
+		const href = /href\s*=\s*("([^"]*)"|'([^']*)')/iu.exec(tag);
+		if (rel === null || href === null) continue;
+		const relValue = (rel[2] ?? rel[3] ?? "").trim().toLowerCase();
+		if (!relValue.includes("icon") || relValue.includes("mask")) continue;
+		const hrefValue = (href[2] ?? href[3] ?? "").trim();
+		if (hrefValue.length === 0) continue;
+		const sizesMatch = /sizes\s*=\s*("([^"]*)"|'([^']*)')/iu.exec(tag);
+		const sizesValue = sizesMatch?.[2] ?? sizesMatch?.[3];
+		candidates.push({
+			href: hrefValue,
+			rel: relValue,
+			...sizesValue === void 0 ? {} : { sizes: sizesValue }
+		});
+	}
+	return candidates;
+};
+/** Largest dimension of a `sizes` attribute value such as `32x32` or `any`. */
+const faviconCandidateSize = (candidate) => {
+	if (candidate.sizes === void 0) return 0;
+	const match = /(\d+)\s*x\s*(\d+)/iu.exec(candidate.sizes);
+	if (match === null || match[1] === void 0 || match[2] === void 0) return 0;
+	return Math.max(Number.parseInt(match[1], 10), Number.parseInt(match[2], 10));
+};
+/** Resolve a favicon href against the service origin. */
+const resolveFaviconUrl = (href, origin) => {
+	try {
+		return new URL(href, origin).href;
+	} catch {
+		return;
+	}
+};
+/** Order candidates: declared-size icons descending, then apple-touch-icon, then others. */
+const rankFaviconCandidates = (candidates) => {
+	const score = (candidate) => {
+		const declared = faviconCandidateSize(candidate);
+		if (declared > 0) return declared;
+		if (candidate.rel.includes("apple-touch-icon")) return 128;
+		return 1;
+	};
+	return [...candidates].sort((a, b) => score(b) - score(a));
+};
+const fetchWithTimeout = async (url, timeoutMs, accept) => {
+	ensureLoopbackNoProxy();
+	const controller = new AbortController();
+	const timer = setTimeout(() => controller.abort(), timeoutMs);
+	try {
+		return await fetch(url, {
+			signal: controller.signal,
+			redirect: "follow",
+			headers: { accept }
+		});
+	} catch {
+		return;
+	} finally {
+		clearTimeout(timer);
+	}
+};
+const defaultFetch = {
+	async page(url, timeoutMs = 5e3) {
+		const response = await fetchWithTimeout(url, timeoutMs, "text/html,application/xhtml+xml");
+		if (response === void 0) return {
+			ok: false,
+			status: 0,
+			body: "",
+			headers: {}
+		};
+		const body = await response.text();
+		const headers = {};
+		response.headers.forEach((value, key) => {
+			headers[key.toLowerCase()] = value;
+		});
+		return {
+			ok: response.ok,
+			status: response.status,
+			body,
+			headers
+		};
+	},
+	async bytes(url, timeoutMs = 5e3) {
+		const response = await fetchWithTimeout(url, timeoutMs, "image/*,*/*;q=0.8");
+		if (response === void 0) return {
+			ok: false,
+			status: 0,
+			bytes: Buffer.alloc(0),
+			contentType: ""
+		};
+		const buffer = Buffer.from(await response.arrayBuffer());
+		return {
+			ok: response.ok,
+			status: response.status,
+			bytes: buffer,
+			contentType: (response.headers.get("content-type") ?? "").toLowerCase()
+		};
+	}
+};
+/** Cap on downloaded candidates per scrape. */
+const MAX_ICON_DOWNLOADS = 8;
+/**
+* Scrape title and ALL icon candidates from a service port. Never throws:
+* failures return `ok: false` with whatever partial identity was found.
+*/
+const scrapeService = async (port, options = {}) => {
+	const fetchImpl = options.fetch ?? defaultFetch;
+	const origin = serviceUrl(port);
+	const page = await fetchImpl.page(origin);
+	if (!page.ok) return {
+		ok: false,
+		title: void 0,
+		iconPath: void 0,
+		icons: []
+	};
+	const title = extractTitle(page.body);
+	const orderedUrls = [...rankFaviconCandidates(extractFaviconCandidates(page.body)).map((candidate) => resolveFaviconUrl(candidate.href, origin)), `${origin}/favicon.ico`].filter((url) => url !== void 0).filter((url, index, all) => all.indexOf(url) === index).slice(0, MAX_ICON_DOWNLOADS);
+	const dir = await ensureTempIconDir(options.tempDir);
+	const collected = [];
+	for (const url of orderedUrls) {
+		if (collected.length >= MAX_ICON_DOWNLOADS) break;
+		const icon = await fetchImpl.bytes(url);
+		if (!icon.ok || icon.bytes.length < 64) continue;
+		const prepared = await prepareIconBytes(icon.bytes, icon.contentType);
+		if (prepared === void 0) continue;
+		const { bytes, format } = prepared;
+		const meta = await iconDimensions(bytes, format);
+		if (meta === void 0) continue;
+		const hash = await iconPerceptualHash(bytes);
+		if (hash !== void 0 && collected.some((c) => c.hash !== void 0 && hamming(hash, c.hash) <= 8)) continue;
+		const path = await writeIconTemp(bytes, dir);
+		collected.push({
+			url,
+			path,
+			...meta,
+			format,
+			hash
+		});
+	}
+	collected.sort((a, b) => b.width * a.height === a.width * b.height ? 0 : b.width * b.height - a.width * a.height);
+	const originals = collected.map((c, order) => ({
+		...c,
+		order
+	}));
+	const solids = [];
+	for (const original of originals) for (const variant of ["solid-black", "solid-white"]) {
+		const solid = await renderSolidSilhouette(original.path, variant === "solid-black" ? black : white);
+		if (solid === void 0) continue;
+		const hash = await iconPerceptualHash(solid);
+		if (hash !== void 0 && solids.some((s) => s.hash !== void 0 && hamming(hash, s.hash) <= 6)) continue;
+		const path = await writeIconTemp(solid, dir);
+		solids.push({
+			url: original.url,
+			path,
+			variant,
+			variantOf: original.order,
+			hash
+		});
+	}
+	const icons = [...originals.map((c) => ({
+		index: c.order,
+		url: c.url,
+		path: c.path,
+		width: c.width,
+		height: c.height,
+		format: c.format,
+		variant: "original"
+	})), ...solids.map((s, i) => ({
+		index: originals.length + i,
+		url: s.url,
+		path: s.path,
+		width: SOLID_SIZE,
+		height: SOLID_SIZE,
+		format: "png",
+		variant: s.variant,
+		variantOf: s.variantOf
+	}))];
+	return {
+		ok: true,
+		title,
+		iconPath: originals[0]?.path,
+		...originals[0] === void 0 ? {} : { iconUrl: originals[0].url },
+		icons
+	};
+};
+const black = {
+	r: 0,
+	g: 0,
+	b: 0
+};
+const white = {
+	r: 255,
+	g: 255,
+	b: 255
+};
+const SOLID_SIZE = 128;
+/**
+* Render a solid-color silhouette from an icon's alpha mask (RGB discarded,
+* alpha kept) — the shape language macOS tray templates want. Non-decodable
+* sources (e.g. corrupt bytes) return undefined instead of failing the scrape.
+*/
+const renderSolidSilhouette = async (sourcePath, color) => {
+	try {
+		const sharp = (await import("sharp")).default;
+		const { data, info } = await sharp(sourcePath, { failOn: "none" }).resize(SOLID_SIZE, SOLID_SIZE, {
+			fit: "contain",
+			background: {
+				r: 0,
+				g: 0,
+				b: 0,
+				alpha: 0
+			}
+		}).ensureAlpha().raw().toBuffer({ resolveWithObject: true });
+		if (info.channels !== 4) return;
+		const out = Buffer.alloc(data.length);
+		for (let i = 0; i < data.length; i += 4) {
+			out[i] = color.r;
+			out[i + 1] = color.g;
+			out[i + 2] = color.b;
+			out[i + 3] = data[i + 3] ?? 0;
+		}
+		return sharp(out, { raw: {
+			width: info.width,
+			height: info.height,
+			channels: 4
+		} }).png().toBuffer();
+	} catch {
+		return;
+	}
+};
+/** Recognizable raster image signatures (PNG/JPEG/GIF/ICO/BMP/WebP). */
+const hasRasterImageSignature = (bytes) => {
+	if (bytes.length < 16) return false;
+	if (bytes[0] === 137 && bytes[1] === 80 && bytes[2] === 78 && bytes[3] === 71 && bytes[4] === 13 && bytes[5] === 10 && bytes[6] === 26 && bytes[7] === 10 && bytes.subarray(12, 16).toString("latin1") === "IHDR") return true;
+	if (bytes[0] === 255 && bytes[1] === 216 && bytes[2] === 255) return true;
+	if (bytes.subarray(0, 4).toString("latin1") === "RIFF" && bytes.subarray(8, 12).toString("latin1") === "WEBP") return true;
+	if (bytes[0] === 0 && bytes[1] === 0 && bytes[2] === 1 && bytes[3] === 0) return true;
+	if (bytes.subarray(0, 6).toString("latin1").startsWith("GIF8")) return true;
+	if (bytes[0] === 66 && bytes[1] === 77) return true;
+	return false;
+};
+const ensureTempIconDir = async (tempDir) => {
+	if (tempDir !== void 0) return tempDir;
+	return mkdtemp(join(tmpdir(), "create-opentray-icon-"));
+};
+/**
+* Validate and normalize candidate bytes. Returns decodable image bytes plus a
+* format tag: raster signatures pass through, SVG text passes through, and ICO
+* containers are cracked open to their largest frame (PNG payload extracted
+* verbatim, BMP DIB rows converted to PNG) because sharp cannot read ICO.
+*/
+const prepareIconBytes = async (bytes, contentType) => {
+	if (looksLikeSvg(bytes, contentType)) return {
+		bytes: await densifySvg(bytes),
+		format: "svg"
+	};
+	if (isIcoContainer(bytes)) {
+		const extracted = await extractLargestIcoFrame(bytes);
+		if (extracted !== void 0) return {
+			bytes: extracted,
+			format: "png"
+		};
+		return;
+	}
+	if (hasRasterImageSignature(bytes)) {
+		const format = rasterFormatOf(bytes);
+		return format === void 0 ? void 0 : {
+			bytes,
+			format
+		};
+	}
+};
+/**
+* Rewrite an SVG so it rasterizes at high resolution. sharp (librsvg) pays
+* no attention to a density attribute; it renders at the declared
+* width/height. Scraped favicons declare small intrinsic sizes (often just
+* 16–50px), so the rasterized base bitmap is tiny and every later upscale
+* (icon catalog, tray, candidates) is blurry. Rewriting the root <svg>
+* width/height to a large target — viewBox untouched, so vector geometry
+* scales cleanly — gives every downstream consumer a crisp base.
+*/
+const SVG_RASTER_TARGET = 1024;
+const densifySvg = async (bytes) => {
+	const text = bytes.toString("utf8");
+	const svgOpen = text.indexOf("<svg");
+	if (svgOpen === -1) return bytes;
+	const tagEnd = text.indexOf(">", svgOpen);
+	if (tagEnd === -1) return bytes;
+	const openTag = text.slice(svgOpen, tagEnd + 1);
+	let next = openTag;
+	if (/\swidth=/u.test(next)) next = next.replace(/\swidth="[^"]*"/u, ` width="${SVG_RASTER_TARGET}"`);
+	else next = next.replace("<svg", `<svg width="${SVG_RASTER_TARGET}"`);
+	if (/\sheight=/u.test(next)) next = next.replace(/\sheight="[^"]*"/u, ` height="${SVG_RASTER_TARGET}"`);
+	else next = next.replace("<svg", `<svg height="${SVG_RASTER_TARGET}"`);
+	if (next === openTag) return bytes;
+	return Buffer.from(text.slice(0, svgOpen) + next + text.slice(tagEnd + 1), "utf8");
+};
+const looksLikeSvg = (bytes, contentType) => {
+	if (contentType.includes("image/svg")) return true;
+	const head = bytes.subarray(0, 512).toString("utf8").trimStart();
+	return head.startsWith("<?xml") || head.startsWith("<svg") || head.includes("<svg");
+};
+const rasterFormatOf = (bytes) => {
+	if (bytes[0] === 137 && bytes[1] === 80) return "png";
+	if (bytes[0] === 255 && bytes[1] === 216) return "jpeg";
+	if (bytes[0] === 71 && bytes[1] === 73) return "gif";
+	if (bytes.subarray(0, 4).toString("latin1") === "RIFF") return "webp";
+};
+const isIcoContainer = (bytes) => bytes.length >= 8 && bytes[0] === 0 && bytes[1] === 0 && bytes[2] === 1 && bytes[3] === 0;
+/** Crack an ICO open: pick the largest frame; PNG payloads return verbatim, DIB rows become PNG. */
+const extractLargestIcoFrame = async (ico) => {
+	const count = ico.readUInt16LE(4);
+	if (count === 0 || count > 64) return;
+	let best;
+	for (let i = 0; i < count; i += 1) {
+		const base = 6 + i * 16;
+		if (base + 16 > ico.length) break;
+		const rawWidth = ico[base] ?? 0;
+		const rawHeight = ico[base + 1] ?? 0;
+		const width = rawWidth === 0 ? 256 : rawWidth;
+		const height = rawHeight === 0 ? 256 : rawHeight;
+		const size = ico.readUInt32LE(base + 8);
+		const offset = ico.readUInt32LE(base + 12);
+		if (offset + size > ico.length) continue;
+		if (best === void 0 || width * height > best.width * best.height) best = {
+			offset,
+			size,
+			width,
+			height
+		};
+	}
+	if (best === void 0) return;
+	const frame = ico.subarray(best.offset, best.offset + best.size);
+	const b0 = frame[0];
+	const b1 = frame[1];
+	if (b0 === 137 && b1 === 80) return frame;
+	return dibToPng(frame, best.width, best.height);
+};
+/** Convert a bottom-up BGRA/BGR DIB (BITMAPINFOHEADER) frame to PNG bytes. */
+const dibToPng = async (dib, width, height) => {
+	if (dib.length < 40) return;
+	const declaredHeight = dib.readInt32LE(8);
+	const bitCount = dib.readUInt16LE(14);
+	const pixels = dib.subarray(40);
+	const rowBytes = Math.ceil(width * bitCount / 8);
+	const rows = Math.abs(declaredHeight) / 2;
+	if (rows === 0 || pixels.length < rowBytes * rows) return;
+	const channels = bitCount === 32 ? 4 : 3;
+	const rgba = Buffer.alloc(width * rows * channels);
+	for (let y = 0; y < rows; y += 1) {
+		const src = pixels.subarray(y * rowBytes, (y + 1) * rowBytes);
+		const flipped = rows - 1 - y;
+		for (let x = 0; x < width; x += 1) {
+			const srcIdx = x * channels;
+			const dstIdx = (flipped * width + x) * channels;
+			const b = src[srcIdx];
+			const g = src[srcIdx + 1];
+			const r = src[srcIdx + 2];
+			if (b === void 0 || g === void 0 || r === void 0) continue;
+			rgba[dstIdx] = r;
+			rgba[dstIdx + 1] = g;
+			rgba[dstIdx + 2] = b;
+			if (channels === 4) rgba[dstIdx + 3] = src[srcIdx + 3] ?? 255;
+		}
+	}
+	const { toPngBuffer } = await import("./icon-codec-BQ3cGV1n.mjs");
+	return toPngBuffer(rgba, width, rows, channels);
+};
+/** True pixel dimensions; SVG uses intrinsic attrs, else viewBox, else 512. */
+const iconDimensions = async (bytes, format) => {
+	if (format === "svg") return svgDimensions(bytes) ?? {
+		width: 512,
+		height: 512
+	};
+	try {
+		const sharp = (await import("sharp")).default;
+		const meta = await sharp(bytes, { failOn: "none" }).metadata();
+		if (meta.width !== void 0 && meta.height !== void 0 && meta.width > 0) return {
+			width: meta.width,
+			height: meta.height
+		};
+	} catch {}
+	if (format === "png" && bytes.length >= 24) {
+		const width = bytes.readUInt32BE(16);
+		const height = bytes.readUInt32BE(20);
+		if (width > 0) return {
+			width,
+			height
+		};
+	}
+};
+const svgDimensions = (bytes) => {
+	const head = bytes.subarray(0, 2048).toString("utf8");
+	const num = (value) => {
+		if (value === void 0) return void 0;
+		const parsed = Number.parseFloat(value);
+		return Number.isFinite(parsed) && parsed > 0 ? parsed : void 0;
+	};
+	const width = num(/<svg[^>]*\bwidth\s*=\s*["']([\d.]+)/iu.exec(head)?.[1]);
+	const height = num(/<svg[^>]*\bheight\s*=\s*["']([\d.]+)/iu.exec(head)?.[1]);
+	if (width !== void 0 && height !== void 0) return {
+		width,
+		height
+	};
+	const viewBox = /viewBox\s*=\s*["']\s*([\d.]+)[\s,]+([\d.]+)[\s,]+([\d.]+)[\s,]+([\d.]+)/iu.exec(head);
+	const vbWidthRaw = viewBox?.[3];
+	const vbHeightRaw = viewBox?.[4];
+	if (vbWidthRaw !== void 0 && vbHeightRaw !== void 0) {
+		const vbWidth = Number.parseFloat(vbWidthRaw);
+		const vbHeight = Number.parseFloat(vbHeightRaw);
+		if (Number.isFinite(vbWidth) && vbWidth > 0) return {
+			width: vbWidth,
+			height: Number.isFinite(vbHeight) ? vbHeight : vbWidth
+		};
+	}
+};
+/** 64-bit average hash over an 8x8 grayscale normalization (perceptual dedupe). */
+const iconPerceptualHash = async (bytes) => {
+	try {
+		const sharp = (await import("sharp")).default;
+		const { data } = await sharp(bytes, { failOn: "none" }).removeAlpha().flatten({ background: "#ffffff" }).resize(8, 8, { fit: "fill" }).grayscale().raw().toBuffer({ resolveWithObject: true });
+		if (data.length < 64) return;
+		let sum = 0;
+		for (const value of data.subarray(0, 64)) sum += value;
+		const mean = sum / 64;
+		let hash = "";
+		for (let i = 0; i < 64; i += 1) {
+			const value = data[i];
+			hash += value === void 0 ? "0" : value >= mean ? "1" : "0";
+		}
+		return hash;
+	} catch {
+		return;
+	}
+};
+const hamming = (a, b) => {
+	let distance = 0;
+	for (let i = 0; i < Math.min(a.length, b.length); i += 1) if (a[i] !== b[i]) distance += 1;
+	return distance;
+};
+const writeIconTemp = async (bytes, dir) => {
+	const path = join(dir ?? await mkdtemp(join(tmpdir(), "create-opentray-icon-")), `icon-${createHash("sha256").update(bytes).digest("hex").slice(0, 16)}.bin`);
+	await writeFile(path, bytes);
+	return path;
+};
+/**
+* First-letter glyph fallback source: a self-contained SVG that the icon
+* generator can rasterize when no favicon was usable.
+*/
+const createGlyphIconSvg = (appName, accent = "#0A84FF") => {
+	const escaped = (appName.trim().charAt(0) || "A").toUpperCase().replace(/&/gu, "&amp;").replace(/</gu, "&lt;").replace(/>/gu, "&gt;");
+	return [
+		`<svg xmlns="http://www.w3.org/2000/svg" width="512" height="512" viewBox="0 0 512 512">`,
+		`<rect width="512" height="512" rx="96" fill="${accent}"/>`,
+		`<text x="256" y="256" font-family="-apple-system, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif" font-size="280" font-weight="600" fill="#FFFFFF" text-anchor="middle" dominant-baseline="central">${escaped}</text>`,
+		`</svg>`
+	].join("");
+};
+/** Persist the glyph fallback SVG as a temp icon source. */
+const writeGlyphIconTemp = async (appName, tempDir) => {
+	const path = join(tempDir, "glyph.svg");
+	await writeFile(path, createGlyphIconSvg(appName), "utf8");
+	return path;
+};
+//#endregion
+//#region src/tokenize.ts
+/**
+* Shell-style tokenizer for the wizard command input. Supports single quotes,
+* double quotes, and backslash escapes outside quotes. It never executes
+* anything; it only produces the argv that will be spawned.
+*/
+const tokenizeCommandLine = (input) => {
+	const tokens = [];
+	let current = "";
+	let hasCurrent = false;
+	let index = 0;
+	while (index < input.length) {
+		const char = input[index];
+		if (char === void 0) break;
+		if (isWhitespace(char)) {
+			if (hasCurrent) {
+				tokens.push(current);
+				current = "";
+				hasCurrent = false;
+			}
+			index += 1;
+			continue;
+		}
+		if (char === "\"") {
+			const quoted = readQuoted(input, index, "\"");
+			if (quoted === void 0) return {
+				ok: false,
+				tokens: [],
+				error: "unbalanced double quote in command"
+			};
+			current += quoted.value;
+			hasCurrent = true;
+			index = quoted.nextIndex;
+			continue;
+		}
+		if (char === "'") {
+			const quoted = readQuoted(input, index, "'");
+			if (quoted === void 0) return {
+				ok: false,
+				tokens: [],
+				error: "unbalanced single quote in command"
+			};
+			current += quoted.value;
+			hasCurrent = true;
+			index = quoted.nextIndex;
+			continue;
+		}
+		if (char === "\\" && index + 1 < input.length) {
+			const next = input[index + 1];
+			if (next !== void 0) {
+				current += next;
+				hasCurrent = true;
+				index += 2;
+				continue;
+			}
+		}
+		current += char;
+		hasCurrent = true;
+		index += 1;
+	}
+	if (hasCurrent) tokens.push(current);
+	if (tokens.length === 0) return {
+		ok: false,
+		tokens: [],
+		error: "command is empty"
+	};
+	return {
+		ok: true,
+		tokens,
+		error: void 0
+	};
+};
+const readQuoted = (input, start, quote) => {
+	let value = "";
+	let index = start + 1;
+	while (index < input.length) {
+		const char = input[index];
+		if (char === void 0) break;
+		if (char === quote) return {
+			value,
+			nextIndex: index + 1
+		};
+		if (quote === "\"" && char === "\\" && index + 1 < input.length) {
+			const next = input[index + 1];
+			if (next !== void 0 && (next === "\"" || next === "\\")) {
+				value += next;
+				index += 2;
+				continue;
+			}
+		}
+		value += char;
+		index += 1;
+	}
+};
+const isWhitespace = (char) => char === " " || char === "	" || char === "\n" || char === "\r";
+//#endregion
+//#region src/entry-template.ts
+/** The generated app entry: supervises the command, owns tray + window. */
+const createEntrySource = (config) => `#!/usr/bin/env node
+// Generated by create-opentray. Supervises the recorded command and hosts it
+// in an OpenTray tray + appMode window. Quit lives in the tray menu.
+import { spawn, execFile, spawnSync } from "node:child_process";
+import { appendFile, mkdir, readFile } from "node:fs/promises";
+import http from "node:http";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { createTray } from "opentray";
+import { WebviewExt } from "@opentray/ext-webview";
+
+const PROJECT_DIR = dirname(fileURLToPath(import.meta.url));
+
+// App Launch Law: persist the ABSOLUTE JS runtime. Under a Bun-hosted
+// wizard, execPath is bun — resolve node's real path once at startup
+// instead of persisting a bare PATH lookup (launchd's PATH is minimal).
+const nodeRuntime = () => {
+  if (process.versions.bun === undefined) return process.execPath;
+  try {
+    const found = spawnSync("which", ["node"], { encoding: "utf8" }).stdout?.trim() ?? "";
+    if (found.length > 0) return found;
+  } catch { /* fall through */ }
+  return "node";
+};
+const READY_MARK_PREFIX = "opentray: ready";
+
+const config = ${JSON.stringify(config, null, 2)};
+
+const appLogPath = resolve(PROJECT_DIR, "app.log");
+await mkdir(dirname(appLogPath), { recursive: true });
+const logSink = appendFile.bind(undefined, appLogPath);
+
+const shellOptions = ${JSON.stringify(config.shell ?? null)};
+const hasShell = shellOptions !== null && (shellOptions.showTerminal || shellOptions.showAddressBar);
+const showTerminal = shellOptions !== null && shellOptions.showTerminal === true;
+const shellApi = hasShell ? await import("./app-shell-server.mjs") : null;
+
+// Configured env overlay (advanced command options); empty by default.
+const commandEnv = ${JSON.stringify(config.command.env ?? {})};
+
+let command;
+let commandExited = false;
+if (showTerminal) {
+  // Startup terminal (advanced option): run the command through a PTY and
+  // stream its bytes to the shell UI — the same tab experience the wizard has.
+  let ptyModule;
+  try {
+    ptyModule = await import("@lydell/node-pty");
+  } catch {
+    ptyModule = null;
+  }
+  const cwd = resolve(PROJECT_DIR, config.command.cwd);
+  if (ptyModule !== null) {
+    const pty = ptyModule.spawn(config.command.command, [...config.command.args], {
+      name: "xterm-256color",
+      cols: 100,
+      rows: 30,
+      cwd,
+      env: { ...process.env, ...commandEnv, TERM: "xterm-256color" },
+    });
+    shellApi?.registerPty(pty);
+    pty.onData((chunk) => {
+      void logSink(chunk, "utf8");
+      shellApi?.pushOutput(chunk);
+    });
+    const exited = new Promise((resolvePromise) => {
+      pty.onExit(({ exitCode }) => {
+        commandExited = true;
+        void logSink(\`[command exited \${exitCode}]\n\`, "utf8");
+        resolvePromise(exitCode);
+      });
+    });
+    command = { pid: pty.pid, exited, kill: async () => { try { pty.kill(); } catch {} await exited; } };
+  } else {
+    await logSink("[create-opentray] @lydell/node-pty unavailable; startup terminal degraded to pipes\\n", "utf8");
+  }
+}
+if (command === undefined) {
+  const child = spawn(config.command.command, [...config.command.args], {
+    cwd: resolve(PROJECT_DIR, config.command.cwd),
+    stdio: ["ignore", "pipe", "pipe"],
+    env: { ...process.env, ...commandEnv },
+    windowsHide: true,
+  });
+  child.stdout.setEncoding("utf8");
+  child.stderr.setEncoding("utf8");
+  child.stdout.on("data", (chunk) => { void logSink(chunk, "utf8"); shellApi?.pushOutput(chunk); });
+  child.stderr.on("data", (chunk) => { void logSink(chunk, "utf8"); shellApi?.pushOutput(chunk); });
+  child.once("exit", (code) => {
+    commandExited = true;
+    void logSink(\`[command exited \${code ?? "signal"}]\n\`, "utf8");
+  });
+  command = child;
+}
+
+const killCommand = async () => {
+  if (commandExited) return;
+  // command.kill is always a function here: the PTY wrapper (shell mode) or
+  // the ChildProcess (plain mode). The PTY wrapper tears down the session
+  // tree; plain spawns SIGTERM the direct child.
+  await command.kill();
+};
+
+let appIcon;
+try {
+  const manifest = JSON.parse(await readFile(resolve(PROJECT_DIR, "app-icon", "app-icon.json"), "utf8"));
+  // The manifest stores project-relative source paths; OpenTray validates file
+  // sources against the caller's cwd, so canonicalize them to absolute paths
+  // before dispatch (a reused broker cwd must never reinterpret App identity).
+  appIcon = manifest.appIcon.map((asset) => (
+    asset.source?.type === "file" && !asset.source.path.startsWith("/")
+      ? { ...asset, source: { ...asset.source, path: resolve(PROJECT_DIR, "app-icon", asset.source.path) } }
+      : asset
+  ));
+} catch {
+  appIcon = undefined;
+}
+
+const httpAnswers = (port) => new Promise((resolvePromise) => {
+  const request = http.get({ host: "127.0.0.1", port, path: "/", timeout: 1500 }, (response) => {
+    response.resume();
+    resolvePromise(response.statusCode !== undefined && response.statusCode > 0);
+  });
+  request.once("timeout", () => { request.destroy(); resolvePromise(false); });
+  request.once("error", () => resolvePromise(false));
+});
+
+const listProcessTreePids = async (rootPid) => {
+  if (process.platform === "win32") return [rootPid];
+  const pids = new Set([rootPid]);
+  const frontier = [rootPid];
+  while (frontier.length > 0) {
+    const pid = frontier.pop();
+    const children = await new Promise((resolvePromise) => {
+      execFile("pgrep", ["-P", String(pid)], (error, stdout) => {
+        resolvePromise(error ? [] : stdout.split("\\n").map((line) => Number(line)).filter((n) => Number.isInteger(n) && n > 0));
+      });
+    });
+    for (const child of children) {
+      if (!pids.has(child)) { pids.add(child); frontier.push(child); }
+    }
+  }
+  return [...pids];
+};
+
+const listOwnedListeningPorts = async (rootPid) => {
+  if (process.platform === "win32") return [];
+  const mine = new Set((await listProcessTreePids(rootPid)).map((pid) => String(pid)));
+  const output = await new Promise((resolvePromise) => {
+    execFile("lsof", ["-F", "pPn", "-nP", "-i", "TCP", "-sTCP:LISTEN"], (error, stdout) => {
+      resolvePromise(error ? "" : stdout);
+    });
+  });
+  const ports = new Set();
+  let currentPid = "";
+  for (const line of output.split("\\n")) {
+    if (line.length === 0) continue;
+    const tag = line[0];
+    const value = line.slice(1);
+    if (tag === "p") currentPid = value;
+    else if (tag === "n" && currentPid !== "" && mine.has(currentPid)) {
+      const port = Number(value.split(":").pop());
+      if (Number.isInteger(port) && port > 0) ports.add(port);
+    }
+  }
+  return [...ports];
+};
+
+// PORTS COME EXCLUSIVELY FROM SNIFFING (owner law): scan the command's
+// process tree for listening ports and HTTP-verify each candidate. The
+// recorded preview port is informational only and is never addressed
+// without verification; dynamic-port commands (listen(0)) therefore behave
+// identically to fixed-port ones.
+const sniffServicePort = async (timeoutMs) => {
+  const deadline = Date.now() + timeoutMs;
+  for (;;) {
+    const owned = await listOwnedListeningPorts(command.pid).catch(() => []);
+    for (const port of owned.filter((p) => p > 0)) {
+      if (await httpAnswers(port)) return port;
+    }
+    if (Date.now() > deadline) {
+      throw new Error("no HTTP service found among the command's listening ports within " + timeoutMs + "ms");
+    }
+    await new Promise((resolvePromise) => setTimeout(resolvePromise, 500));
+  }
+};
+
+// Shell mode: start the local shell server first so windows can open
+// immediately; the monitor below sniffs services continuously.
+const shellPort = hasShell ? await shellApi.listenShell() : null;
+
+// Plain mode needs one verified address before opening its single window;
+// shell mode defers entirely to the continuous monitor.
+const servicePort = hasShell
+  ? null
+  : await sniffServicePort(30_000).catch(async (error) => {
+      await logSink(\`[create-opentray] \${error.message}\\n\`, "utf8");
+      await killCommand();
+      throw error;
+    });
+
+const trayIcon = ${JSON.stringify(config.trayIcon ?? null)};
+const trayIconCandidates = trayIcon === null
+  ? {}
+  : trayIcon.template && process.platform === "darwin"
+    ? { "darwin-icon-only": { type: "file", path: resolve(PROJECT_DIR, trayIcon.path), isTemplate: true } }
+    : { "icon-only": { type: "file", path: resolve(PROJECT_DIR, trayIcon.path) } };
+
+const tray = await createTray({
+  id: config.appId,
+  tooltip: { title: config.appName, description: \`\${config.appName} (OpenTray)\` },
+  icon: Object.keys(trayIconCandidates).length > 0
+    ? trayIconCandidates
+    : { "text-only": "${config.appName.replace(/['"\\]/gu, "").slice(0, 2) || "A"}" },
+  menu: { items: [
+    { type: "item", id: 1, title: \`Show \${config.appName}\`, primaryEvent: true },
+    { type: "separator" },
+    { type: "item", id: 2, title: "Quit" },
+  ] },
+}, {
+  appId: config.appId,
+  appName: config.appName,
+  ...(appIcon === undefined ? {} : { appIcon }),
+  appLaunch: {
+    // The generated entry may embed a native PTY (@lydell/node-pty), which
+    // requires a Node host — cold launches must not inherit a Bun execPath.
+    command: nodeRuntime(),
+    args: [resolve(PROJECT_DIR, "main.mjs")],
+    cwd: PROJECT_DIR,
+  },
+});
+
+const baseTitle = config.appName;
+const showAddressBar = shellOptions !== null && shellOptions.showAddressBar === true;
+
+// Dedicated windows (round 9b): one terminal window when enabled, one window
+// per listened port — an address-bar wrapper page when enabled, the direct
+// service URL otherwise. No embedded tabs panel.
+// Each window gets its OWN extension mount (tray.extend per window): one
+// mount owns exactly one native webview slot, so dedicated windows never
+// collide on content.
+const serviceWindows = new Map();
+let terminalWindow = null;
+
+const ensureServiceWindow = async (port) => {
+  if (serviceWindows.has(port)) return;
+  const direct = \`http://127.0.0.1:\${port}\`;
+  const url = showAddressBar && shellPort !== null
+    ? \`http://127.0.0.1:\${shellPort}/browse.html?url=\${encodeURIComponent(direct)}\`
+    : direct;
+  const win = tray.extend(WebviewExt).createWebviewWindow({
+    url,
+    width: config.window.width,
+    height: config.window.height,
+    title: baseTitle,
+    style: { appMode: true, autoHide: false, keepOnTop: false },
+    ...(showAddressBar ? {} : { titleSync: { documentToWindow: true, windowToDocument: true } }),
+    ...(showAddressBar ? {} : { iconSync: { faviconToWindow: true, windowToFavicon: true } }),
+  });
+  serviceWindows.set(port, { win, detached: false });
+  await win.show().catch(() => {});
+};
+
+if (showTerminal && shellPort !== null) {
+  terminalWindow = tray.extend(WebviewExt).createWebviewWindow({
+    url: \`http://127.0.0.1:\${shellPort}/terminal.html\`,
+    width: 900,
+    height: 560,
+    title: \`\${baseTitle} — Terminal\`,
+    style: { appMode: true, autoHide: false, keepOnTop: false },
+  });
+  await terminalWindow.show().catch(() => {});
+}
+
+// Plain mode: the first verified port opens immediately through the SAME
+// per-port window machinery the monitor uses (no duplicate window object);
+// additional ports get their own windows as the monitor verifies them.
+if (!hasShell && servicePort !== null) {
+  await ensureServiceWindow(servicePort);
+}
+
+{
+  // Continuous owned-port monitor (BOTH modes): every HTTP-verified listening
+  // port gets its own window, and a port that stops listening marks THAT
+  // window's title (detached). Spec: one window per listened port, never
+  // gated on shell mode.
+  const seenPorts = new Set();
+  const verifiedPorts = new Set();
+  const monitor = setInterval(async () => {
+    try {
+      const owned = await listOwnedListeningPorts(command.pid).catch(() => []);
+      const listening = owned.filter((port) => port > 0);
+      // Spec: owned-listener scan PLUS HTTP verification before a port is
+      // ever addressed — the monitor never adopts a non-HTTP listener.
+      for (const port of listening) {
+        if (!verifiedPorts.has(port) && (await httpAnswers(port))) {
+          verifiedPorts.add(port);
+        }
+      }
+      for (const port of verifiedPorts) seenPorts.add(port);
+      const services = [...seenPorts].map((port) => ({
+        port,
+        detached: !listening.includes(port),
+      }));
+      shellApi?.setServices(services);
+      for (const service of services) {
+        if (!service.detached) await ensureServiceWindow(service.port);
+        const entry = serviceWindows.get(service.port);
+        if (entry !== undefined && Boolean(entry.detached) !== Boolean(service.detached)) {
+          entry.detached = Boolean(service.detached);
+          const title = service.detached ? \`\${baseTitle} (detached)\` : baseTitle;
+          await entry.win.setTitle(title).catch(() => {});
+        }
+      }
+    } catch {
+      /* monitor tick */
+    }
+  }, 1500);
+  const stopMonitor = () => clearInterval(monitor);
+  process.once("exit", stopMonitor);
+}
+
+const quit = async () => {
+  for (const { win } of serviceWindows.values()) {
+    try { await win.destroy(); } catch {}
+  }
+  serviceWindows.clear();
+  if (terminalWindow !== null) {
+    try { await terminalWindow.destroy(); } catch {}
+  }
+  await tray.destroy();
+  await killCommand();
+  process.exit(0);
+};
+
+tray.onMenuClick(({ itemId }) => {
+  if (itemId === 1) {
+    const target = terminalWindow !== null
+      ? terminalWindow
+      : serviceWindows.size > 0
+        ? [...serviceWindows.values()][0].win
+        : null;
+    if (target === null) return;
+    void target.isVisible().then(async (visible) => {
+      if (visible) { await target.close(); } else { await target.toVisible(); }
+    }).catch(() => {});
+    return;
+  }
+  if (itemId === 2) void quit();
+});
+
+process.on("SIGINT", () => void quit());
+process.on("SIGTERM", () => void quit());
+
+console.log(\`\${READY_MARK_PREFIX} \${JSON.stringify({ appId: config.appId, ...(servicePort === null ? {} : { port: servicePort }) })}\`);
+
+`;
+//#endregion
+//#region src/shell-server-template.ts
+/** The generated app's local shell host: static UI + PTY stream + port state. */
+const shellServerSource = (options) => `#!/usr/bin/env node
+// Generated by create-opentray. Local shell host: static UI + PTY stream + port state.
+import { createServer } from "node:http";
+import { readFile } from "node:fs/promises";
+import { extname, join, normalize, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+import { dirname } from "node:path";
+
+const PROJECT_DIR = dirname(fileURLToPath(import.meta.url));
+const SHELL_DIR = resolve(PROJECT_DIR, "app-shell");
+
+// --- state shared with the shell UI ---
+const state = {
+  command: ${JSON.stringify(options.commandDisplay)},
+  interactive: false, // main.mjs flips this when a PTY is attached
+  output: [],         // ring of PTY chunks
+  services: [],       // [{ port, detached }]
+  listeners: new Set(), // SSE response streams
+};
+const RING_LIMIT = 2000;
+
+const emit = (event) => {
+  const frame = \`data: \${JSON.stringify(event)}\n\n\`;
+  for (const res of state.listeners) {
+    try {
+      res.write(frame);
+    } catch {
+      /* dropped client */
+    }
+  }
+};
+
+const snapshot = () => ({
+  type: "state",
+  command: state.command,
+  interactive: state.interactive,
+  services: state.services,
+  output: state.output.slice(-400),
+});
+
+/** main.mjs registers the live PTY handle here. */
+export const registerPty = (pty) => {
+  state.pty = pty;
+  state.interactive = pty !== null && pty !== undefined;
+};
+
+/** main.mjs forwards PTY output chunks here. */
+export const pushOutput = (chunk) => {
+  state.output.push(chunk);
+  if (state.output.length > RING_LIMIT) {
+    state.output.splice(0, state.output.length - RING_LIMIT);
+  }
+  emit({ type: "log", chunk });
+};
+
+/** main.mjs reports the owned-port snapshot; detached flags drive title marks. */
+export const setServices = (services) => {
+  const changed =
+    services.length !== state.services.length ||
+    services.some(
+      (s, i) =>
+        state.services[i] === undefined ||
+        s.port !== state.services[i].port ||
+        Boolean(s.detached) !== Boolean(state.services[i].detached),
+    );
+  state.services = services;
+  if (changed) {
+    emit({ type: "services", services });
+  }
+};
+
+const CT = {
+  ".html": "text/html; charset=utf-8",
+  ".js": "text/javascript; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".svg": "image/svg+xml",
+  ".png": "image/png",
+  ".wasm": "application/wasm",
+  ".json": "application/json",
+};
+
+const server = createServer(async (req, res) => {
+  const url = new URL(req.url ?? "/", "http://127.0.0.1");
+  if (url.pathname === "/api/events") {
+    res.writeHead(200, {
+      "content-type": "text/event-stream",
+      "cache-control": "no-store",
+      connection: "keep-alive",
+    });
+    res.write(\`data: \${JSON.stringify(snapshot())}\n\n\`);
+    state.listeners.add(res);
+    req.on("close", () => {
+      state.listeners.delete(res);
+    });
+    return;
+  }
+  if (url.pathname === "/api/terminal-input" && req.method === "POST") {
+    let body = "";
+    for await (const chunk of req) {
+      body += chunk;
+    }
+    try {
+      const { data } = JSON.parse(body);
+      if (state.pty !== null && state.pty !== undefined && typeof data === "string") {
+        state.pty.write(data);
+      }
+    } catch {
+      /* malformed body */
+    }
+    res.writeHead(200, { "content-type": "application/json" }).end('{"ok":true}');
+    return;
+  }
+  // Static shell files with traversal containment; SPA fallback for routes.
+  const relative = normalize(url.pathname).replace(/\\/(\\.\\.\\/?)*/, "");
+  const target = resolve(
+    SHELL_DIR,
+    relative === "" || relative === "/" ? "index.html" : relative,
+  );
+  if (target !== SHELL_DIR && !target.startsWith(SHELL_DIR + sep)) {
+    res.writeHead(404).end();
+    return;
+  }
+  const bytes = await readFile(target).catch(() => undefined);
+  if (bytes === undefined) {
+    const index = await readFile(join(SHELL_DIR, "index.html")).catch(() => undefined);
+    if (index === undefined) {
+      res.writeHead(404).end();
+      return;
+    }
+    res
+      .writeHead(200, { "content-type": CT[".html"], "cache-control": "no-store" })
+      .end(index);
+    return;
+  }
+  res
+    .writeHead(200, {
+      "content-type": CT[extname(target).toLowerCase()] ?? "application/octet-stream",
+      "cache-control": "no-store",
+    })
+    .end(bytes);
+});
+
+/** Start listening on an ephemeral loopback port; resolves the port. */
+export const listenShell = () =>
+  new Promise((resolvePort) => {
+    server.listen(0, "127.0.0.1", () => {
+      resolvePort(server.address().port);
+    });
+  });
+`;
+//#endregion
+//#region src/scaffold.ts
+const writeScaffold = async (options) => {
+	const projectDir = resolve(options.targetDir);
+	await mkdir(join(projectDir, "app-icon"), { recursive: true });
+	const writtenFiles = [];
+	const write = async (relative, content) => {
+		const path = join(projectDir, relative);
+		await mkdir(join(path, ".."), { recursive: true });
+		await writeFile(path, content, "utf8");
+		writtenFiles.push(relative);
+	};
+	await write("package.json", createPackageJson(options));
+	await write("opentray.app.json", `${JSON.stringify(options.config, null, 2)}\n`);
+	await write("main.mjs", createEntrySource(options.config));
+	const shell = options.config.shell;
+	if (shell !== void 0 && (shell.showTerminal || shell.showAddressBar)) {
+		await write("app-shell-server.mjs", createShellServerSource(options.config));
+		if (options.shellAssetsDir !== void 0) {
+			const { cp } = await import("node:fs/promises");
+			await cp(options.shellAssetsDir, join(projectDir, "app-shell"), { recursive: true });
+			writtenFiles.push("app-shell/");
+		}
+	}
+	await write("README.md", createReadme(options));
+	await write(".gitignore", [
+		"node_modules/\n",
+		"app.log\n",
+		"dist/\n"
+	].join(""));
+	return {
+		projectDir,
+		entryPath: join(projectDir, "main.mjs"),
+		configPath: join(projectDir, "opentray.app.json"),
+		appIconDir: join(projectDir, "app-icon"),
+		writtenFiles
+	};
+};
+const createPackageJson = (options) => {
+	const shell = options.config.shell;
+	const dependencies = {
+		opentray: options.dependencyRange,
+		"@opentray/ext-webview": options.dependencyRange
+	};
+	if (shell !== void 0 && shell.showTerminal) dependencies["@lydell/node-pty"] = "^1.1.0";
+	return `${JSON.stringify({
+		name: toProjectDirectoryName(options.config.appId),
+		version: "0.1.0",
+		private: true,
+		type: "module",
+		description: `${options.config.appName} — OpenTray-hosted app generated by create-opentray`,
+		scripts: { start: "node main.mjs" },
+		dependencies
+	}, null, 2)}\n`;
+};
+const createReadme = (options) => `# ${options.config.appName}
+
+Generated by \`create-opentray\`. This app supervises the recorded start
+command, hosts it in an OpenTray tray + application window, and can be pinned
+to the taskbar (Windows) or Dock (macOS).
+
+## Run
+
+${options.skipInstall === true ? "Install dependencies first, then:" : ""}
+\`\`\`bash
+npm run start
+\`\`\`
+
+- Service: ${options.config.service.port > 0 ? `http://127.0.0.1:${options.config.service.port} (preview hint; re-sniffed at runtime)` : "sniffed at runtime from the command's owned listening ports"}
+- Command: \`${options.config.command.command} ${options.config.command.args.join(" ")}\`
+- Logs: \`app.log\`
+
+## Files
+
+- \`opentray.app.json\` — frozen identity and launch vector
+- \`app-icon/\` — generated platform icon catalog (ICNS/ICO/PNG)
+- \`main.mjs\` — app entry: supervises the command and owns the tray session
+`;
+/** Shell server entry source: static UI + PTY stream + port state (round 9). */
+const createShellServerSource = (config) => shellServerSource({ commandDisplay: `${config.command.command} ${config.command.args.join(" ")}`.trim() });
+//#endregion
+//#region src/materialize.ts
+const moduleDirectory = dirname(fileURLToPath(import.meta.url));
+/** Prebuilt shell UI: prefer the packaged copy (dist/shell), else the
+*  workspace build next to this package. */
+const resolveShellAssetsDir = async () => {
+	const candidates = [
+		join(moduleDirectory, "shell"),
+		join(moduleDirectory, "..", "dist", "shell"),
+		join(moduleDirectory, "..", "create-webui", "dist")
+	];
+	for (const candidate of candidates) if (await access(join(candidate, "index.html")).then(() => true, () => false)) return candidate;
+};
+const shellAssetsDir = await resolveShellAssetsDir();
+const errorMessage = (error) => error instanceof Error ? error.message : String(error);
+const READY_MARKER_PREFIX = "opentray: ready";
+/** True when the directory exists and contains anything beyond ignorable files. */
+const isDirectoryOccupied = async (dir) => {
+	let entries;
+	try {
+		entries = await readdir(dir);
+	} catch {
+		return false;
+	}
+	const ignorable = /* @__PURE__ */ new Set([".DS_Store", "Thumbs.db"]);
+	return entries.some((entry) => !ignorable.has(entry));
+};
+/** Detect package manager from lockfiles then npm_config_user_agent. */
+const detectPackageManager = (files, userAgent) => {
+	if (files.includes("pnpm-lock.yaml")) return "pnpm";
+	if (files.includes("bun.lockb") || files.includes("bun.lock")) return "bun";
+	if (files.includes("package-lock.json")) return "npm";
+	const agent = (userAgent ?? "").toLowerCase();
+	if (agent.includes("pnpm")) return "pnpm";
+	if (agent.includes("bun")) return "bun";
+	return "npm";
+};
+/** Expected stable Darwin bundle path for the generated project's identity. */
+const expectedDarwinBundlePath = (config) => resolveDefaultDarwinAppBundlePath({
+	homeDir: homedir(),
+	packageName: toProjectDirectoryName(config.appId),
+	appName: sanitizeAppBundleName(config.appName)
+});
+const materialize = async (input, context) => {
+	const step = (name, message) => context.log({
+		type: "step",
+		step: name,
+		message
+	});
+	const waitMs = context.waitMs ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+	const targetDir = resolve(input.targetDir);
+	step("scaffold", `checking target directory ${targetDir}`);
+	if (await isDirectoryOccupied(targetDir)) {
+		if (input.force !== true) throw new Error(`target directory is not empty: ${targetDir} (pass --force or choose another directory)`);
+		step("scaffold", "force: clearing existing target directory");
+		await rm(targetDir, {
+			recursive: true,
+			force: true
+		});
+	}
+	const appIconDir = join(targetDir, "app-icon");
+	await mkdir(appIconDir, { recursive: true });
+	const traySource = input.trayIconSourcePath ?? input.iconSourcePath;
+	let trayIconConfig;
+	if (traySource !== void 0) {
+		const trayPath = join(appIconDir, "tray-icon.png");
+		try {
+			await (await import("sharp")).default(traySource, { failOn: "none" }).resize(128, 128, {
+				fit: "contain",
+				background: {
+					r: 0,
+					g: 0,
+					b: 0,
+					alpha: 0
+				}
+			}).png().toFile(trayPath);
+			const template = input.trayIconIsSolid === true;
+			trayIconConfig = {
+				path: "app-icon/tray-icon.png",
+				template
+			};
+			context.log({
+				type: "log",
+				message: `tray icon: app-icon/tray-icon.png${template ? " (template)" : ""}`
+			});
+		} catch (error) {
+			context.log({
+				type: "log",
+				message: `tray icon unavailable (${errorMessage(error)}); falling back to text tray`
+			});
+		}
+	}
+	let composedIcon;
+	if (input.iconSourcePath !== void 0) try {
+		composedIcon = await composeAppIcon({
+			foregroundPath: input.iconSourcePath,
+			background: input.iconBackground ?? "transparent",
+			scale: input.iconScale ?? .8,
+			outputDir: join(targetDir, "app-icon")
+		});
+		context.log({
+			type: "log",
+			message: `composed app icon (${composedIcon.background} background, macOS 824 / windows 1024)`
+		});
+	} catch (error) {
+		context.log({
+			type: "log",
+			message: `icon composition unavailable (${errorMessage(error)}); using source directly`
+		});
+	}
+	step("scaffold", "writing project files");
+	const shell = input.shell;
+	const scaffold = await writeScaffold({
+		config: {
+			...input.config,
+			...shell === void 0 ? {} : { shell },
+			...trayIconConfig === void 0 ? {} : { trayIcon: trayIconConfig }
+		},
+		targetDir,
+		dependencyRange: input.dependencyRange,
+		skipInstall: input.skipInstall,
+		...shellAssetsDir === void 0 ? {} : { shellAssetsDir }
+	});
+	context.log({
+		type: "log",
+		message: `wrote ${scaffold.writtenFiles.join(", ")}`
+	});
+	step("icon", "generating platform icon catalog");
+	const iconSource = input.iconSourcePath ?? await writeGlyphIconTemp(input.config.appName, scaffold.appIconDir);
+	const generate = context.generateIcon ?? generateOpenTrayAppIcon;
+	const generateIntoScaffold = async (sourcePath) => generate({
+		sourcePath,
+		...composedIcon === void 0 ? {} : {
+			composed: true,
+			macosSourcePath: composedIcon.macOSPath
+		},
+		icnsOutputPath: join(scaffold.appIconDir, "app-icon.icns"),
+		icoOutputPath: join(scaffold.appIconDir, "app-icon.ico"),
+		linuxOutputDirectory: join(scaffold.appIconDir, "linux"),
+		manifestOutputPath: join(scaffold.appIconDir, "app-icon.json"),
+		outputPath: join(scaffold.appIconDir, "app-icon.png"),
+		cachePath: join(scaffold.appIconDir, ".cache.json")
+	});
+	const catalogSource = composedIcon !== void 0 && composedIcon.compositePath !== void 0 ? composedIcon.compositePath : input.iconSourcePath;
+	let iconMetadata;
+	try {
+		iconMetadata = await generateIntoScaffold(catalogSource !== void 0 ? catalogSource : iconSource);
+	} catch (error) {
+		context.log({
+			type: "log",
+			message: `icon source unusable (${errorMessage(error)}); falling back to glyph icon`
+		});
+		iconMetadata = await generateIntoScaffold(await writeGlyphIconTemp(input.config.appName, scaffold.appIconDir));
+	}
+	context.log({
+		type: "log",
+		message: `icon assets: icns + ico + ${iconMetadata.linuxPngOutputPaths.length} linux pngs`
+	});
+	if (!input.skipInstall) {
+		step("install", `installing dependencies with ${input.packageManager}`);
+		await (context.runInstall ?? runPackageManagerInstall)({
+			projectDir: scaffold.projectDir,
+			packageManager: input.packageManager,
+			log: (message) => context.log({
+				type: "log",
+				message
+			})
+		});
+	} else step("install", "skipping dependency install (--skip-install)");
+	if (input.skipInstall) {
+		step("launch", "skipping first launch (--skip-install)");
+		context.log({
+			type: "log",
+			message: "install dependencies and run `node main.mjs` to launch"
+		});
+		return {
+			scaffold,
+			projectDir: scaffold.projectDir,
+			bundlePath: void 0
+		};
+	}
+	step("launch", "first launch of the generated app");
+	const launched = await (context.firstLaunchEntry ?? firstLaunchEntry)(scaffold.projectDir);
+	context.log({
+		type: "log",
+		message: `app entry spawned (pid ${launched.pid})`
+	});
+	step("launch", "waiting for app ready marker");
+	await launched.ready;
+	context.log({
+		type: "log",
+		message: `${READY_MARKER_PREFIX} received`
+	});
+	const platform = context.platform ?? process.platform;
+	let bundlePath;
+	if (platform === "darwin") {
+		step("bundle", "verifying stable Darwin app bundle");
+		const expected = expectedDarwinBundlePath(input.config);
+		bundlePath = await waitForDirectory(expected, context.bundleTimeoutMs ?? 6e4, waitMs);
+		context.log({
+			type: "log",
+			message: `stable bundle: ${bundlePath}`
+		});
+	}
+	return {
+		scaffold,
+		projectDir: scaffold.projectDir,
+		bundlePath,
+		firstLaunch: launched
+	};
+};
+const runPackageManagerInstall = async (options) => {
+	const { cmd, args } = {
+		npm: {
+			cmd: "npm",
+			args: [
+				"install",
+				"--no-fund",
+				"--no-audit"
+			]
+		},
+		pnpm: {
+			cmd: "pnpm",
+			args: ["install"]
+		},
+		bun: {
+			cmd: "bun",
+			args: ["install"]
+		}
+	}[options.packageManager];
+	await new Promise((resolvePromise, rejectPromise) => {
+		const child = spawn(cmd, [...args], {
+			cwd: options.projectDir,
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			],
+			windowsHide: true
+		});
+		child.stdout?.setEncoding("utf8");
+		child.stderr?.setEncoding("utf8");
+		child.stdout?.on("data", (chunk) => {
+			for (const line of chunk.split("\n").filter(Boolean)) options.log(line);
+		});
+		child.stderr?.on("data", (chunk) => {
+			for (const line of chunk.split("\n").filter(Boolean)) options.log(line);
+		});
+		child.once("error", rejectPromise);
+		child.once("exit", (code) => {
+			if (code === 0) {
+				resolvePromise();
+				return;
+			}
+			rejectPromise(/* @__PURE__ */ new Error(`${cmd} ${args.join(" ")} exited with ${code ?? "signal"}`));
+		});
+	});
+};
+/**
+* Spawn the generated entry detached with piped stdout, resolving when the
+* entry prints its ready marker. The child is unref'd so the wizard can exit
+* without taking the generated app down.
+*/
+/**
+* The generated app may embed a native PTY (@lydell/node-pty), which requires
+* a Node host (Bun loads it but never delivers output). Always launch the
+* generated entry with Node: prefer the Node currently executing the wizard,
+* else resolve `node` from PATH.
+*/
+const nodeExecutable = () => process.versions.bun === void 0 && process.execPath.includes("node") ? process.execPath : "node";
+const firstLaunchEntry = async (projectDir) => {
+	const child = spawn(nodeExecutable(), [join(projectDir, "main.mjs")], {
+		cwd: projectDir,
+		stdio: [
+			"ignore",
+			"pipe",
+			"inherit"
+		],
+		detached: true,
+		windowsHide: true
+	});
+	const pid = child.pid;
+	if (pid === void 0) throw new Error(`failed to spawn generated app entry in ${projectDir}`);
+	child.unref();
+	let buffer = "";
+	return {
+		pid,
+		ready: new Promise((resolvePromise, rejectPromise) => {
+			const finish = (error) => {
+				child.stdout?.removeListener("data", onData);
+				if (error !== void 0) {
+					rejectPromise(error);
+					return;
+				}
+				resolvePromise();
+			};
+			const onData = (chunk) => {
+				buffer += chunk;
+				const newline = buffer.indexOf("\n");
+				if (newline < 0) return;
+				const line = buffer.slice(0, newline);
+				buffer = buffer.slice(newline + 1);
+				if (line.startsWith("opentray: ready")) finish(void 0);
+			};
+			child.stdout?.setEncoding("utf8");
+			child.stdout?.on("data", onData);
+			child.once("error", (error) => finish(error));
+			child.once("exit", (code) => {
+				finish(/* @__PURE__ */ new Error(`generated app entry exited early with ${code ?? "signal"}`));
+			});
+		})
+	};
+};
+const waitForDirectory = async (path, timeoutMs, waitMs) => {
+	const deadline = Date.now() + timeoutMs;
+	while (Date.now() < deadline) {
+		try {
+			if ((await stat(path)).isDirectory()) return path;
+		} catch {}
+		await waitMs(500);
+	}
+	throw new Error(`stable Darwin app bundle did not appear within ${timeoutMs}ms: ${path}`);
+};
+//#endregion
+//#region src/launch-vector.ts
+const isExecutable = async (path) => {
+	try {
+		await access(path, constants.X_OK);
+		return true;
+	} catch {
+		return false;
+	}
+};
+const readFirstLine = async (path) => {
+	try {
+		return (await readFile(path, "utf8")).split("\n", 1)[0];
+	} catch {
+		return;
+	}
+};
+/** Resolve a bare command name against PATH; returns undefined when absent. */
+const resolveOnPath = async (command, options) => {
+	if (isAbsolute(command) || command.includes("/") || command.includes("\\")) return;
+	const platform = options.platform ?? process.platform;
+	const pathEnv = options.pathEnv ?? (platform === "win32" ? `${process.env.PATH ?? ""}${delimiter}${process.cwd()}` : process.env.PATH ?? "");
+	const extensions = platform === "win32" ? [
+		"",
+		".cmd",
+		".exe",
+		".bat"
+	] : [""];
+	for (const dir of pathEnv.split(delimiter).filter(Boolean)) for (const ext of extensions) {
+		const candidate = resolve(dir, `${command}${ext}`);
+		if (options.accessFile ? await options.accessFile(candidate).then(() => true, () => false) : await isExecutable(candidate)) return candidate;
+	}
+};
+/** Read a `#!/usr/bin/env <interpreter>` shebang; undefined for other files. */
+const parseShebangInterpreter = (firstLine) => {
+	if (firstLine === void 0 || !firstLine.startsWith("#!")) return;
+	const [interpreter, ...interpreterArgs] = firstLine.slice(2).trim().split(/\s+/u).filter(Boolean);
+	if (interpreter === void 0) return;
+	return {
+		interpreter,
+		args: interpreterArgs
+	};
+};
+/**
+* Resolve the user's command tokens to a PATH-independent vector:
+* - absolute-ize bare executables through PATH lookup;
+* - resolve relative script paths against cwd;
+* - when the executable is an `env <interpreter>` shebang script, run the
+*   interpreter directly with the script as its first argument.
+* The persisted descriptor never includes an environment map.
+*/
+const resolveLaunchVector = async (options) => {
+	const [rawCommand, ...restArgs] = options.tokens;
+	if (rawCommand === void 0 || rawCommand.trim().length === 0) throw new Error("launch vector requires a command");
+	options.accessFile;
+	const firstLine = options.firstLine ?? readFirstLine;
+	let command = rawCommand;
+	if (!isAbsolute(command)) {
+		const onPath = await resolveOnPath(command, options);
+		if (onPath !== void 0) command = onPath;
+		else if (command.includes("/") || command.includes("\\")) command = resolve(options.cwd, command);
+	}
+	if ((options.platform ?? process.platform) === "win32" && /\.cmd$/iu.test(rawCommand)) return {
+		command: resolveSystemPath("cmd.exe"),
+		args: [
+			"/d",
+			"/s",
+			"/c",
+			rawCommand,
+			...restArgs
+		],
+		cwd: options.cwd
+	};
+	const shebang = parseShebangInterpreter(await firstLine(command).catch(() => void 0));
+	if (shebang !== void 0 && !command.endsWith(".exe")) {
+		let interpreter = shebang.interpreter;
+		if (interpreter === "/usr/bin/env" || interpreter === "env") {
+			const [envTarget, ...envArgs] = shebang.args;
+			if (envTarget !== void 0) return {
+				command: await resolveOnPath(envTarget, options) ?? envTarget,
+				args: [
+					...envArgs,
+					command,
+					...restArgs
+				],
+				cwd: options.cwd
+			};
+			interpreter = "/usr/bin/env";
+		}
+		return {
+			command: interpreter,
+			args: [
+				...shebang.args,
+				command,
+				...restArgs
+			],
+			cwd: options.cwd
+		};
+	}
+	return {
+		command,
+		args: restArgs,
+		cwd: options.cwd
+	};
+};
+const resolveSystemPath = (name) => {
+	if (isAbsolute(name)) return name;
+	return `${process.env.SystemRoot ?? "C:\\Windows"}\\System32\\${name}`;
+};
+//#endregion
+//#region src/open-app.ts
+const openMaterializedApp = async (input) => {
+	if ((input.platform ?? process.platform) === "darwin") {
+		if (input.bundlePath === void 0) return {
+			ok: false,
+			detail: "stable Darwin app bundle path is unknown"
+		};
+		const child = spawn("open", [input.bundlePath], {
+			stdio: "ignore",
+			windowsHide: true
+		});
+		const status = await new Promise((resolve) => {
+			child.once("error", () => resolve(null));
+			child.once("exit", (code) => resolve(code));
+		});
+		if (status === 0) return {
+			ok: true,
+			detail: `opened ${input.bundlePath}`
+		};
+		return {
+			ok: false,
+			detail: `open ${input.bundlePath} failed with ${status ?? "spawn error"}`
+		};
+	}
+	const child = spawn(process.execPath, [join(input.projectDir, "main.mjs")], {
+		cwd: input.projectDir,
+		stdio: "ignore",
+		detached: true,
+		windowsHide: true
+	});
+	child.once("error", () => {});
+	child.unref();
+	if (child.pid === void 0) return {
+		ok: false,
+		detail: `failed to spawn ${input.projectDir}/main.mjs`
+	};
+	return {
+		ok: true,
+		detail: `launched app entry (pid ${child.pid})`
+	};
+};
+/** Platform-truthful pinning hint; makes no Windows persistence claim. */
+const pinningHint = (platform = process.platform) => {
+	if (platform === "darwin") return "右键点击 Dock 中的应用图标，选择“选项 → 在程序坞中保留”，即可固定到 Dock。";
+	if (platform === "win32") return "右键点击任务栏中的应用图标，选择“固定到任务栏”即可固定。（OpenTray 尚未生成开始菜单快捷方式）";
+	return "可将应用窗口固定到任务栏/收藏夹；Linux 桌面快捷方式生成尚未提供。";
+};
+//#endregion
+//#region src/wizard.ts
+const DEFAULT_ICON_SCALE = .8;
+const DEFAULT_COMMAND_OPTIONS = {
+	cwd: "",
+	env: [],
+	argsMode: "string"
+};
+const createWizardSession = (options) => {
+	let state = "idle";
+	let services = [];
+	let selectedPort;
+	let run;
+	let discovery = createPortDiscovery({
+		baseline: /* @__PURE__ */ new Set(),
+		...options.listListeners === void 0 ? {} : { listListeners: () => options.listListeners() },
+		...options.verifyHttp === void 0 ? {} : { verifyHttp: options.verifyHttp }
+	});
+	let discoveryTimer;
+	let scrapeTimer;
+	let scraping = false;
+	let tempIconDir;
+	let currentIconPath;
+	let currentTrayIconPath;
+	let trayIconIsSolid = false;
+	let iconCandidates = [];
+	let iconPort;
+	let currentTokens = [];
+	let currentCommand = "";
+	let scrapedTitle;
+	let resolvedVector;
+	let frozenForm;
+	let resolvedServicePort;
+	let resolvedTargetDir;
+	let frozenIconPath;
+	let submitting = false;
+	let runAlive = false;
+	let commandOptions = { ...DEFAULT_COMMAND_OPTIONS };
+	let composeIconDir;
+	const iconCompositions = /* @__PURE__ */ new Map();
+	let iconBackground;
+	let iconScale;
+	const touched = {
+		appId: false,
+		appName: false,
+		iconPath: false,
+		iconBackground: false,
+		iconScale: false,
+		trayIconPath: false,
+		pm: false,
+		force: false,
+		showStartupTerminal: false,
+		showAddressBar: false
+	};
+	let form = {
+		appId: "",
+		appName: "",
+		iconPath: "",
+		iconBackground: "transparent",
+		iconScale: DEFAULT_ICON_SCALE,
+		trayIconPath: "",
+		force: options.force === true,
+		showStartupTerminal: false,
+		showAddressBar: false,
+		pm: options.packageManager ?? detectPackageManager([], process.env.npm_config_user_agent)
+	};
+	let result;
+	const emit = options.emit;
+	const setState = (next, reason) => {
+		state = next;
+		emit({
+			type: "state",
+			state: next,
+			...reason === void 0 ? {} : { reason }
+		});
+	};
+	const stopTimers = () => {
+		if (discoveryTimer !== void 0) {
+			clearInterval(discoveryTimer);
+			discoveryTimer = void 0;
+		}
+		if (scrapeTimer !== void 0) {
+			clearInterval(scrapeTimer);
+			scrapeTimer = void 0;
+		}
+	};
+	const publishServices = () => {
+		emit({
+			type: "services",
+			services: [...services],
+			selectedPort
+		});
+	};
+	/**
+	* Placeholder defaults: scrapes and derivations update the *suggestions*,
+	* never the user's values. Empty values mean "use the default".
+	*/
+	const currentDefaults = () => {
+		const effectiveAppId = form.appId.trim().length > 0 ? form.appId : deriveDefaultAppId(currentTokens);
+		return {
+			appId: deriveDefaultAppId(currentTokens),
+			appName: scrapedTitle ?? deriveDefaultAppName(currentTokens),
+			iconPath: currentIconPath ?? "",
+			targetDir: options.targetDir ?? join(homeDir, ".opentray", "create", toProjectDirectoryName(effectiveAppId))
+		};
+	};
+	const publishForm = () => {
+		emit({
+			type: "form",
+			values: form,
+			defaults: currentDefaults(),
+			targetDirExists
+		});
+	};
+	/** Track whether the resolved target directory is already occupied so the
+	*  UI can warn and offer the force toggle. */
+	let targetDirExists = false;
+	let targetDirProbe = 0;
+	const refreshTargetDirExists = () => {
+		const probe = ++targetDirProbe;
+		const target = currentDefaults().targetDir;
+		(async () => {
+			let occupied = false;
+			try {
+				occupied = (await stat(target)).isDirectory();
+			} catch {
+				occupied = false;
+			}
+			if (probe !== targetDirProbe) return;
+			if (occupied !== targetDirExists) {
+				targetDirExists = occupied;
+				publishForm();
+			}
+		})();
+	};
+	const scrapeOnce = async () => {
+		if (scraping || selectedPort === void 0 || state === "frozen" || state === "materializing") return;
+		scraping = true;
+		try {
+			const port = selectedPort;
+			const scraped = await (options.scrape ?? scrapeService)(port, tempIconDir === void 0 ? {} : { tempDir: tempIconDir });
+			if (selectedPort !== port) return;
+			const stateNow = state;
+			if (stateNow === "frozen" || stateNow === "materializing" || stateNow === "success") return;
+			iconCandidates = scraped.icons;
+			iconPort = port;
+			currentIconPath = scraped.icons[0]?.path;
+			if (scraped.title !== void 0) scrapedTitle = scraped.title;
+			emit({
+				type: "icons",
+				port,
+				icons: scraped.icons
+			});
+			emit({
+				type: "scrape",
+				port,
+				...scraped.title === void 0 ? {} : { title: scraped.title },
+				hasIcon: scraped.icons.length > 0
+			});
+			publishForm();
+		} finally {
+			scraping = false;
+		}
+	};
+	const startScrapePolling = () => {
+		if (scrapeTimer !== void 0) clearInterval(scrapeTimer);
+		scrapeOnce();
+		scrapeTimer = setInterval(() => {
+			scrapeOnce();
+		}, options.scrapeIntervalMs ?? 1500);
+	};
+	const selectDefaultService = () => {
+		if (selectedPort === void 0 && services.length > 0) selectedPort = services[0]?.port;
+		if (selectedPort !== void 0 && state === "running") {
+			setState("discovered");
+			startScrapePolling();
+		}
+	};
+	const startDiscoveryPolling = () => {
+		if (discoveryTimer !== void 0) clearInterval(discoveryTimer);
+		(async () => {
+			const found = await discovery.poll();
+			if (found.length > 0) {
+				const known = new Set(services.map((service) => service.port));
+				services = [...services, ...found.filter((s) => !known.has(s.port))];
+				selectDefaultService();
+				publishServices();
+			}
+		})();
+		discoveryTimer = setInterval(() => {
+			(async () => {
+				const found = await discovery.poll();
+				if (found.length > 0) {
+					const known = new Set(services.map((service) => service.port));
+					services = [...services, ...found.filter((s) => !known.has(s.port))];
+					selectDefaultService();
+					publishServices();
+				}
+			})();
+		}, options.pollIntervalMs ?? 1e3);
+	};
+	/** Default command cwd is the USER_HOME directory (owner round-10 law):
+	*  empty input means home, and relative paths resolve against home. */
+	const homeDir = options.homeDir ?? homedir();
+	const effectiveCwd = () => {
+		const custom = commandOptions.cwd.trim();
+		return custom.length > 0 ? resolve(homeDir, custom) : homeDir;
+	};
+	/** Build the env overlay from configured entries (empty keys skipped). */
+	const commandEnv = () => {
+		const env = {};
+		for (const entry of commandOptions.env) if (entry.key.trim().length > 0) env[entry.key.trim()] = entry.value;
+		return env;
+	};
+	const publishCommandOptions = () => {
+		emit({
+			type: "command-options",
+			options: commandOptions,
+			defaultCwd: homeDir
+		});
+	};
+	/** Stable dir for composed preview assets, created on demand. */
+	const ensureIconComposeDir = async () => {
+		if (composeIconDir === void 0) composeIconDir = await mkdtemp(join(tmpdir(), "create-opentray-compose-"));
+		return composeIconDir;
+	};
+	const session = {
+		get state() {
+			return state;
+		},
+		get services() {
+			return services;
+		},
+		get selectedPort() {
+			return selectedPort;
+		},
+		get runAlive() {
+			return runAlive;
+		},
+		get iconCandidates() {
+			return iconCandidates;
+		},
+		iconCandidate(port, index) {
+			if (iconPort !== port) return;
+			return iconCandidates.find((icon) => icon.index === index);
+		},
+		replaceIconCandidates(port, icons) {
+			iconPort = port;
+			iconCandidates = icons;
+		},
+		selectTrayIconCandidate(port, index) {
+			if (state === "frozen" || state === "materializing" || state === "success") return false;
+			const candidate = session.iconCandidate(port, index);
+			if (candidate === void 0) return false;
+			touched.trayIconPath = true;
+			currentTrayIconPath = candidate.path;
+			trayIconIsSolid = candidate.variant !== "original";
+			form = {
+				...form,
+				trayIconPath: candidate.path
+			};
+			publishForm();
+			return true;
+		},
+		selectIconCandidate(port, index) {
+			if (state === "frozen" || state === "materializing" || state === "success") return false;
+			const candidate = session.iconCandidate(port, index);
+			if (candidate === void 0) return false;
+			touched.iconPath = true;
+			currentIconPath = candidate.path;
+			if (!touched.trayIconPath) {
+				currentTrayIconPath = candidate.path;
+				trayIconIsSolid = candidate.variant !== "original";
+				form = {
+					...form,
+					iconPath: candidate.path,
+					trayIconPath: candidate.path
+				};
+			} else form = {
+				...form,
+				iconPath: candidate.path
+			};
+			publishForm();
+			return true;
+		},
+		get form() {
+			return form;
+		},
+		get result() {
+			return result;
+		},
+		async submitCommand(command) {
+			if (state !== "idle" && state !== "failed" && state !== "running" && state !== "discovered") throw new Error(`cannot submit a command while ${state}`);
+			if (submitting) throw new Error("a command submission is already in flight");
+			submitting = true;
+			const tokens = typeof command === "string" ? void 0 : command;
+			let tokenized;
+			if (tokens === void 0) {
+				tokenized = tokenizeCommandLine(command);
+				if (!tokenized.ok) {
+					submitting = false;
+					setState("failed", tokenized.error);
+					return;
+				}
+			} else if (tokens.length === 0 || tokens[0].trim().length === 0) {
+				submitting = false;
+				setState("failed", "数组模式至少需要程序元素（第一个参数）");
+				return;
+			}
+			await session.stop();
+			runAlive = false;
+			services = [];
+			selectedPort = void 0;
+			currentTokens = tokens ?? tokenized.tokens;
+			refreshTargetDirExists();
+			currentIconPath = void 0;
+			currentTrayIconPath = void 0;
+			trayIconIsSolid = false;
+			iconCandidates = [];
+			touched.appId = false;
+			touched.appName = false;
+			touched.pm = false;
+			touched.trayIconPath = false;
+			form = {
+				appId: "",
+				appName: "",
+				iconPath: "",
+				iconBackground: iconBackground ?? "transparent",
+				iconScale: iconScale ?? .8,
+				...touched.force ? { force: form.force } : { force: options.force === true },
+				...touched.trayIconPath ? { trayIconPath: form.trayIconPath } : { trayIconPath: "" },
+				...touched.showStartupTerminal ? { showStartupTerminal: form.showStartupTerminal } : { showStartupTerminal: false },
+				...touched.showAddressBar ? { showAddressBar: form.showAddressBar } : { showAddressBar: false },
+				pm: options.packageManager ?? detectPackageManager([], process.env.npm_config_user_agent)
+			};
+			currentCommand = typeof command === "string" ? command : command.join(" ");
+			scrapedTitle = void 0;
+			emit({
+				type: "command-display",
+				command: currentCommand
+			});
+			tempIconDir = await mkdtemp(join(tmpdir(), "create-opentray-"));
+			const baseline = await (options.listListeners ?? (() => listListeningPorts(process.platform)))().catch(() => /* @__PURE__ */ new Set());
+			setState("running");
+			publishForm();
+			const spawnRun = options.spawnRun ?? startCommandRun;
+			const envOverlay = commandEnv();
+			run = await spawnRun({
+				tokens: currentTokens,
+				cwd: effectiveCwd(),
+				...Object.keys(envOverlay).length === 0 ? {} : { env: envOverlay },
+				onEvent: (event) => {
+					if (event.type === "stdout" || event.type === "stderr") {
+						emit({
+							type: "log",
+							stream: event.type,
+							chunk: event.chunk ?? ""
+						});
+						return;
+					}
+					if (event.type === "pty-ready") {
+						emit({
+							type: "term-mode",
+							interactive: true
+						});
+						return;
+					}
+					if (event.type === "pty-unavailable") {
+						emit({
+							type: "term-mode",
+							interactive: false,
+							...event.message === void 0 ? {} : { message: event.message }
+						});
+						return;
+					}
+					if (event.type === "spawn-error") {
+						stopTimers();
+						setState("failed", event.message ?? "spawn failed");
+						return;
+					}
+					if (event.type === "exit") {
+						runAlive = false;
+						stopTimers();
+						emit({
+							type: "run-status",
+							running: false,
+							...event.code === void 0 ? {} : { code: event.code }
+						});
+						if (state === "running" && services.length === 0) setState("failed", `command exited with ${event.code ?? "signal"} before any service appeared`);
+					}
+				}
+			});
+			submitting = false;
+			run.exited.then(async ({ code, spawnError }) => {
+				if (state === "running" && services.length === 0 && spawnError !== void 0) {
+					stopTimers();
+					setState("failed", spawnError);
+				}
+			});
+			discovery = createPortDiscovery({
+				baseline,
+				...options.listListeners === void 0 ? {} : { listListeners: () => options.listListeners() },
+				...options.verifyHttp === void 0 ? {} : { verifyHttp: options.verifyHttp },
+				...options.listPortOwners === void 0 ? {} : { listOwners: options.listPortOwners },
+				...run.pid === void 0 ? {} : { resolveOwnerPids: () => collectProcessTreePids(run?.pid ?? 0, options.platform ?? process.platform) }
+			});
+			runAlive = true;
+			emit({
+				type: "run-status",
+				running: true
+			});
+			startDiscoveryPolling();
+		},
+		prime(command) {
+			if (state === "frozen" || state === "materializing" || state === "success") return;
+			if (typeof command !== "string") {
+				if (command.length === 0 || command[0].trim().length === 0) return;
+				currentTokens = command;
+				currentCommand = command.join(" ");
+				emit({
+					type: "command-display",
+					command: currentCommand
+				});
+				refreshTargetDirExists();
+				publishForm();
+				return;
+			}
+			const tokenized = tokenizeCommandLine(command);
+			if (!tokenized.ok) return;
+			currentTokens = tokenized.tokens;
+			currentCommand = command;
+			emit({
+				type: "command-display",
+				command
+			});
+			refreshTargetDirExists();
+			publishForm();
+		},
+		get commandOptions() {
+			return commandOptions;
+		},
+		updateCommandOptions(patch) {
+			if (state === "frozen" || state === "materializing" || state === "success") return;
+			commandOptions = {
+				...commandOptions,
+				...patch
+			};
+			publishCommandOptions();
+		},
+		async analyzeIconForeground(foregroundPath) {
+			const stats = await foregroundStats(foregroundPath).catch(() => ({
+				luminance: void 0,
+				coverage: 0
+			}));
+			return {
+				...stats,
+				suggested: autoBackground(stats)
+			};
+		},
+		async composeIcon(options) {
+			if (state === "frozen" || state === "materializing" || state === "success") throw new Error("cannot compose while frozen");
+			const background = options.background ?? iconBackground ?? "transparent";
+			const scale = options.scale ?? iconScale ?? .8;
+			const composed = await composeAppIcon({
+				foregroundPath: options.foregroundPath,
+				background,
+				scale,
+				outputDir: await ensureIconComposeDir()
+			});
+			const composition = {
+				key: compositionCacheKey({
+					foregroundPath: options.foregroundPath,
+					background,
+					scale
+				}),
+				...composed
+			};
+			iconCompositions.set(composition.key, composition);
+			return composition;
+		},
+		trackIconComposition(composition) {
+			iconCompositions.set(composition.key, composition);
+		},
+		iconSourceRoots() {
+			return [...tempIconDir !== void 0 ? [tempIconDir] : [], ...composeIconDir !== void 0 ? [composeIconDir] : []];
+		},
+		iconComposition(key) {
+			return iconCompositions.get(key);
+		},
+		async saveIconUpload(bytes) {
+			const path = join(tempIconDir ?? (tempIconDir = await mkdtemp(join(tmpdir(), "create-opentray-"))), `upload-${createHash("sha256").update(bytes).digest("hex").slice(0, 16)}.bin`);
+			await writeFile(path, bytes);
+			return path;
+		},
+		selectService(port) {
+			if (state !== "discovered" && state !== "running") return;
+			if (!services.some((service) => service.port === port)) return;
+			selectedPort = port;
+			currentIconPath = void 0;
+			publishServices();
+			if (state === "discovered") startScrapePolling();
+		},
+		updateForm(patch) {
+			if (state !== "idle" && state !== "running" && state !== "discovered" && state !== "failed") return;
+			if (patch.iconBackground !== void 0) iconBackground = patch.iconBackground;
+			if (patch.iconScale !== void 0) iconScale = patch.iconScale;
+			for (const key of Object.keys(patch)) if (patch[key] !== void 0 && patch[key] !== form[key]) {
+				touched[key] = true;
+				if (key === "trayIconPath") trayIconIsSolid = false;
+			}
+			form = {
+				...form,
+				...patch
+			};
+			publishForm();
+		},
+		/** Forward base64-encoded terminal keystroke bytes to the preview command. */
+		terminalInput(data) {
+			if (state !== "running" && state !== "discovered") return;
+			run?.write(data);
+		},
+		/** Forward terminal dimensions to the pseudo-terminal. */
+		terminalResize(size) {
+			if (state !== "running" && state !== "discovered") return;
+			run?.resize(size);
+		},
+		confirm() {
+			if (state !== "idle" && state !== "running" && state !== "discovered" && state !== "failed") throw new Error(`cannot confirm while ${state}`);
+			resolvedServicePort = selectedPort ?? 0;
+			resolvedTargetDir = currentDefaults().targetDir;
+			const defaults = currentDefaults();
+			let resolvedForm = {
+				...form,
+				appId: form.appId.trim().length > 0 ? form.appId : defaults.appId,
+				appName: form.appName.trim().length > 0 ? form.appName : defaults.appName
+			};
+			if (resolvedForm.iconPath.trim().length > 0) currentIconPath = resolvedForm.iconPath.trim();
+			frozenIconPath = currentIconPath;
+			const resolvedTrayIconPath = resolvedForm.trayIconPath.trim().length > 0 ? resolvedForm.trayIconPath.trim() : resolvedForm.iconPath.trim().length > 0 ? resolvedForm.iconPath.trim() : currentIconPath ?? "";
+			resolvedForm = {
+				...resolvedForm,
+				trayIconPath: resolvedTrayIconPath
+			};
+			currentTrayIconPath = resolvedTrayIconPath;
+			form = resolvedForm;
+			stopTimers();
+			frozenForm = { ...form };
+			setState("frozen");
+			publishForm();
+		},
+		async create() {
+			if (state !== "frozen") throw new Error(`cannot create while ${state}`);
+			const frozen = frozenForm ?? form;
+			if (currentTokens.length === 0) throw new Error("no command recorded");
+			setState("materializing");
+			if (run !== void 0) {
+				await run.kill();
+				run = void 0;
+			}
+			try {
+				resolvedVector = await (options.resolveVector ?? resolveLaunchVector)({
+					tokens: currentTokens,
+					cwd: effectiveCwd()
+				});
+				const envOverlay = commandEnv();
+				if (Object.keys(envOverlay).length > 0) resolvedVector = {
+					...resolvedVector,
+					env: envOverlay
+				};
+			} catch (error) {
+				setState("failed", error instanceof Error ? error.message : String(error));
+				return;
+			}
+			try {
+				result = await materialize({
+					config: {
+						schemaVersion: 1,
+						appId: frozen.appId,
+						appName: frozen.appName,
+						command: resolvedVector,
+						service: { port: resolvedServicePort ?? 0 },
+						window: {
+							width: 1200,
+							height: 800
+						}
+					},
+					targetDir: resolvedTargetDir ?? currentDefaults().targetDir,
+					dependencyRange: options.dependencyRange,
+					iconSourcePath: frozenIconPath ?? currentIconPath,
+					...frozen.iconBackground === void 0 ? {} : { iconBackground: frozen.iconBackground },
+					...frozen.iconScale === void 0 ? {} : { iconScale: frozen.iconScale },
+					...currentTrayIconPath === void 0 ? {} : { trayIconSourcePath: currentTrayIconPath },
+					...trayIconIsSolid ? { trayIconIsSolid: true } : {},
+					shell: {
+						showTerminal: frozen.showStartupTerminal,
+						showAddressBar: frozen.showAddressBar
+					},
+					packageManager: frozen.pm,
+					skipInstall: options.skipInstall,
+					force: frozen.force
+				}, {
+					log: (event) => {
+						if (event.type === "step") {
+							emit({
+								type: "materialize-step",
+								step: event.step,
+								message: event.message
+							});
+							return;
+						}
+						emit({
+							type: "materialize-log",
+							message: event.message
+						});
+					},
+					...options.platform === void 0 ? {} : { platform: options.platform },
+					...options.materializeContext ?? {}
+				});
+				setState("success");
+				emit({
+					type: "success",
+					projectDir: result.projectDir,
+					...result.bundlePath === void 0 ? {} : { bundlePath: result.bundlePath },
+					pinHint: pinningHint()
+				});
+			} catch (error) {
+				const message = error instanceof Error ? error.message : String(error);
+				const occupied = message.includes("target directory is not empty");
+				setState("failed", occupied ? `${message}；可在「高级选项」中开启 强制覆盖 后重试` : message);
+			}
+		},
+		async stop() {
+			stopTimers();
+			discovery.stop();
+			if (run !== void 0) {
+				await run.kill();
+				run = void 0;
+			}
+		}
+	};
+	publishCommandOptions();
+	return session;
+};
+//#endregion
+//#region src/server.ts
+const LOOPBACK_HOSTS = /* @__PURE__ */ new Set([
+	"127.0.0.1",
+	"localhost",
+	"[::1]",
+	"::1"
+]);
+const createWizardServer = async (createSession, options = {}) => {
+	const token = randomBytes(16).toString("hex");
+	const clients = /* @__PURE__ */ new Set();
+	const eventLog = [];
+	const emit = (event) => {
+		eventLog.push(event);
+		const frame = `data: ${JSON.stringify(event)}\n\n`;
+		for (const client of clients) client.write(frame);
+	};
+	const session = createSession(emit);
+	const indexHtml = await readWebUiIndex();
+	const server = createServer((request, response) => {
+		handle(request, response).catch((error) => {
+			respond(response, 500, "application/json", `${JSON.stringify({ error: error instanceof Error ? error.message : String(error) })}\n`);
+		});
+	});
+	const handle = async (request, response) => {
+		const url = new URL(request.url ?? "/", "http://127.0.0.1");
+		if (url.pathname === "/" || url.pathname === "/index.html") {
+			if (!isAuthorized(request, url, token)) {
+				respond(response, 401, "text/plain", "invalid wizard token\n");
+				return;
+			}
+			if (indexHtml === void 0) {
+				respond(response, 500, "text/plain", "wizard page is missing from this installation\n");
+				return;
+			}
+			respond(response, 200, "text/html; charset=utf-8", indexHtml);
+			return;
+		}
+		if (url.pathname === "/api/events") {
+			if (!isAuthorized(request, url, token)) {
+				respond(response, 401, "text/plain", "unauthorized\n");
+				return;
+			}
+			response.writeHead(200, {
+				"content-type": "text/event-stream",
+				"cache-control": "no-cache",
+				connection: "keep-alive"
+			});
+			response.write(": connected\n\n");
+			for (const event of eventLog) response.write(`data: ${JSON.stringify(event)}\n\n`);
+			clients.add(response);
+			request.once("close", () => {
+				clients.delete(response);
+			});
+			return;
+		}
+		if (url.pathname.startsWith("/assets/")) {
+			await handleAssetFile(url.pathname, response);
+			return;
+		}
+		if (url.pathname === "/ghostty-vt.wasm") {
+			await handleAssetFile("/ghostty-vt.wasm", response);
+			return;
+		}
+		if (url.pathname.startsWith("/vendor/")) {
+			await handleVendorAsset(url.pathname, response);
+			return;
+		}
+		const composedMatch = /^\/api\/icon-composed\/([a-f0-9]+)$/.exec(url.pathname);
+		if (composedMatch !== null) {
+			if (!isAuthorized(request, url, token)) {
+				respond(response, 401, "text/plain", "unauthorized\n");
+				return;
+			}
+			const key = composedMatch[1];
+			const composed = session.iconComposition(key);
+			if (composed === void 0) {
+				respond(response, 404, "text/plain", "not found\n");
+				return;
+			}
+			try {
+				const bytes = await readFile(composed.compositePath);
+				response.writeHead(200, {
+					"content-type": "image/png",
+					"cache-control": "no-store",
+					"content-length": bytes.byteLength
+				});
+				response.end(bytes);
+				return;
+			} catch {
+				respond(response, 404, "text/plain", "not found\n");
+				return;
+			}
+		}
+		const iconDataMatch = /^\/api\/icon-data\/(\d+)\/(\d+)$/.exec(url.pathname);
+		if (iconDataMatch !== null) {
+			if (!isAuthorized(request, url, token)) {
+				respond(response, 401, "text/plain", "unauthorized\n");
+				return;
+			}
+			const port = Number.parseInt(iconDataMatch[1], 10);
+			const index = Number.parseInt(iconDataMatch[2], 10);
+			const candidate = session.iconCandidate(port, index);
+			if (candidate === void 0) {
+				respond(response, 404, "text/plain", "not found\n");
+				return;
+			}
+			const bytes = await readFile(candidate.path).catch(() => void 0);
+			if (bytes === void 0) {
+				respond(response, 404, "text/plain", "not found\n");
+				return;
+			}
+			response.writeHead(200, {
+				"content-type": ICON_CONTENT_TYPES[candidate.format] ?? "application/octet-stream",
+				"content-length": bytes.length,
+				"cache-control": "no-store"
+			});
+			response.end(bytes);
+			return;
+		}
+		if (url.pathname.startsWith("/api/")) {
+			if (!isAuthorized(request, url, token)) {
+				respond(response, 401, "application/json", "{\"error\":\"unauthorized\"}\n");
+				return;
+			}
+			if (!isLoopbackHost(request)) {
+				respond(response, 403, "application/json", "{\"error\":\"forbidden host\"}\n");
+				return;
+			}
+			await handleApi(url.pathname, request, response, session);
+			return;
+		}
+		respond(response, 404, "text/plain", "not found\n");
+	};
+	await listen(server, options.port);
+	const address = server.address();
+	if (address === null || typeof address === "string") {
+		server.close();
+		throw new Error("wizard server did not bind a loopback port");
+	}
+	return {
+		url: `http://127.0.0.1:${address.port}/?token=${token}`,
+		port: address.port,
+		token,
+		session,
+		close: () => new Promise((resolve) => {
+			for (const client of clients) client.end();
+			clients.clear();
+			server.close(() => resolve());
+		})
+	};
+};
+/** Whitelisted static terminal-renderer assets; exact names only, no traversal. */
+const VENDOR_ASSETS = {
+	"/vendor/ghostty-web.js": {
+		contentType: "text/javascript; charset=utf-8",
+		candidates: () => [join(moduleDir(), "webui", "vendor", "ghostty-web.js"), ghosttyPackageFile("dist/ghostty-web.js")]
+	},
+	"/vendor/ghostty-vt.wasm": {
+		contentType: "application/wasm",
+		candidates: () => [
+			join(moduleDir(), "webui", "vendor", "ghostty-vt.wasm"),
+			ghosttyPackageFile("ghostty-vt.wasm"),
+			ghosttyPackageFile("dist/ghostty-vt.wasm")
+		]
+	}
+};
+const moduleDir = () => dirname(fileURLToPath(import.meta.url));
+/**
+* Resolve a file inside the installed ghostty-web package. Deep paths are
+* blocked by the package `exports` map, so resolve the exported main module
+* and walk from the package root instead.
+*/
+const ghosttyPackageFile = (relative) => {
+	try {
+		return join(dirname(dirname(createRequire(import.meta.url).resolve("ghostty-web"))), relative);
+	} catch {
+		return "";
+	}
+};
+const ICON_CONTENT_TYPES = {
+	png: "image/png",
+	svg: "image/svg+xml",
+	jpeg: "image/jpeg",
+	webp: "image/webp",
+	gif: "image/gif",
+	ico: "image/x-icon"
+};
+const ASSET_CONTENT_TYPES = {
+	".js": "text/javascript; charset=utf-8",
+	".css": "text/css; charset=utf-8",
+	".wasm": "application/wasm",
+	".html": "text/html; charset=utf-8",
+	".svg": "image/svg+xml",
+	".png": "image/png",
+	".json": "application/json"
+};
+/**
+* Serve one file from the built webui directory (dist/webui). Only simple
+* relative names are accepted: resolve first, then require the resolved path
+* to stay inside the webui root, so traversal cannot escape.
+*/
+const handleAssetFile = async (pathname, response) => {
+	const relative = pathname.replace(/^\/+/, "");
+	if (relative.length === 0 || relative.includes("\0")) {
+		respond(response, 404, "text/plain", "not found\n");
+		return;
+	}
+	const roots = [join(moduleDir(), "webui"), join(moduleDir(), "..", "..", "create-webui", "dist")];
+	for (const root of roots) {
+		const resolved = resolve(root, relative);
+		if (!(resolved === root || resolved.startsWith(`${root}${sep}`))) continue;
+		const bytes = await readFile(resolved).catch(() => void 0);
+		if (bytes === void 0) continue;
+		const extension = extname(resolved).toLowerCase();
+		response.writeHead(200, {
+			"content-type": ASSET_CONTENT_TYPES[extension] ?? "application/octet-stream",
+			"content-length": bytes.length,
+			"cache-control": "no-store"
+		});
+		response.end(bytes);
+		return;
+	}
+	respond(response, 404, "text/plain", "not found\n");
+};
+const handleVendorAsset = async (pathname, response) => {
+	const asset = VENDOR_ASSETS[pathname];
+	if (asset === void 0) {
+		respond(response, 404, "text/plain", "not found\n");
+		return;
+	}
+	for (const candidate of asset.candidates()) {
+		if (candidate.length === 0) continue;
+		const bytes = await readFile(candidate).catch(() => void 0);
+		if (bytes !== void 0) {
+			response.writeHead(200, {
+				"content-type": asset.contentType,
+				"content-length": bytes.length,
+				"cache-control": "no-store"
+			});
+			response.end(bytes);
+			return;
+		}
+	}
+	respond(response, 404, "text/plain", "terminal renderer asset is missing\n");
+};
+/** Containment: icon routes must only read sources the wizard itself
+*  produced (its temp dirs / saved uploads), never arbitrary paths. */
+const isWizardOwnedIconPath = (session, target) => {
+	for (const root of session.iconSourceRoots()) if (root.length > 0 && target.startsWith(root + sep)) return true;
+	return false;
+};
+const handleApi = async (pathname, request, response, session) => {
+	if (request.method !== "POST") {
+		respond(response, 405, "application/json", "{\"error\":\"method not allowed\"}\n");
+		return;
+	}
+	if (pathname === "/api/icon-upload") {
+		const chunks = [];
+		for await (const chunk of request) {
+			const piece = typeof chunk === "string" ? Buffer.from(chunk) : chunk;
+			chunks.push(piece);
+		}
+		const bytes = Buffer.concat(chunks);
+		if (bytes.length < 64) {
+			respond(response, 400, "application/json", "{\"error\":\"image bytes are required\"}\n");
+			return;
+		}
+		const path = await session.saveIconUpload(bytes);
+		respond(response, 200, "application/json", JSON.stringify({ path }) + "\n");
+		return;
+	}
+	const body = await readJsonBody(request);
+	switch (pathname) {
+		case "/api/command": {
+			if (Array.isArray(body.argv)) {
+				const argv = body.argv.filter((element) => typeof element === "string");
+				if (argv.length === 0 || (argv[0] ?? "").trim().length === 0) {
+					respond(response, 400, "application/json", "{\"error\":\"argv requires the program element\"}\n");
+					return;
+				}
+				await session.submitCommand(argv);
+				respond(response, 200, "application/json", "{\"ok\":true}\n");
+				return;
+			}
+			const command = typeof body.command === "string" ? body.command : "";
+			if (command.trim().length === 0) {
+				respond(response, 400, "application/json", "{\"error\":\"command is required\"}\n");
+				return;
+			}
+			await session.submitCommand(command);
+			respond(response, 200, "application/json", "{\"ok\":true}\n");
+			return;
+		}
+		case "/api/command-options": {
+			const patch = {};
+			if (typeof body.cwd === "string") patch.cwd = body.cwd;
+			if (body.argsMode === "string" || body.argsMode === "array") patch.argsMode = body.argsMode;
+			if (Array.isArray(body.env)) {
+				const entries = [];
+				for (const entry of body.env) if (typeof entry === "object" && entry !== null && typeof entry.key === "string" && typeof entry.value === "string") entries.push({
+					key: entry.key,
+					value: entry.value
+				});
+				patch.env = entries;
+			}
+			session.updateCommandOptions(patch);
+			respond(response, 200, "application/json", "{\"ok\":true}\n");
+			return;
+		}
+		case "/api/prime": {
+			const command = typeof body.command === "string" ? body.command : "";
+			if (command.trim().length === 0) {
+				respond(response, 400, "application/json", "{\"error\":\"command is required\"}\n");
+				return;
+			}
+			session.prime(command);
+			respond(response, 200, "application/json", "{\"ok\":true}\n");
+			return;
+		}
+		case "/api/select-service": {
+			const port = Number(body.port);
+			if (!Number.isInteger(port) || port <= 0) {
+				respond(response, 400, "application/json", "{\"error\":\"port is required\"}\n");
+				return;
+			}
+			session.selectService(port);
+			respond(response, 200, "application/json", "{\"ok\":true}\n");
+			return;
+		}
+		case "/api/form": {
+			const patch = {};
+			for (const key of [
+				"appId",
+				"appName",
+				"iconPath",
+				"trayIconPath"
+			]) {
+				const value = body[key];
+				if (typeof value === "string") patch[key] = value;
+			}
+			if (body.pm === "npm" || body.pm === "pnpm" || body.pm === "bun") patch.pm = body.pm;
+			if (body.iconBackground === "black" || body.iconBackground === "white" || body.iconBackground === "transparent") patch.iconBackground = body.iconBackground;
+			if (typeof body.iconScale === "number" && body.iconScale >= .5 && body.iconScale <= .95) patch.iconScale = body.iconScale;
+			for (const key of [
+				"showStartupTerminal",
+				"showAddressBar",
+				"force"
+			]) {
+				const value = body[key];
+				if (typeof value === "boolean") patch[key] = value;
+			}
+			session.updateForm(patch);
+			respond(response, 200, "application/json", "{\"ok\":true}\n");
+			return;
+		}
+		case "/api/confirm":
+			try {
+				session.confirm();
+				respond(response, 200, "application/json", "{\"ok\":true}\n");
+			} catch (error) {
+				respond(response, 409, "application/json", `${JSON.stringify({ error: error instanceof Error ? error.message : String(error) })}\n`);
+			}
+			return;
+		case "/api/create":
+			try {
+				await session.create();
+				respond(response, 200, "application/json", "{\"ok\":true}\n");
+			} catch (error) {
+				respond(response, 409, "application/json", `${JSON.stringify({ error: error instanceof Error ? error.message : String(error) })}\n`);
+			}
+			return;
+		case "/api/terminal-input": {
+			const data = typeof body.data === "string" ? body.data : void 0;
+			if (data === void 0) {
+				respond(response, 400, "application/json", "{\"error\":\"data is required\"}\n");
+				return;
+			}
+			session.terminalInput(data);
+			respond(response, 200, "application/json", "{\"ok\":true}\n");
+			return;
+		}
+		case "/api/icon-analyze": {
+			const path = typeof body.path === "string" ? body.path.trim() : "";
+			if (path.length === 0) {
+				respond(response, 400, "application/json", "{\"error\":\"path is required\"}\n");
+				return;
+			}
+			if (!isWizardOwnedIconPath(session, path)) {
+				respond(response, 403, "application/json", "{\"error\":\"path is not a wizard icon source\"}\n");
+				return;
+			}
+			try {
+				const analysis = await session.analyzeIconForeground(path);
+				respond(response, 200, "application/json", JSON.stringify(analysis) + "\n");
+			} catch (error) {
+				respond(response, 500, "application/json", JSON.stringify({ error: String(error) }) + "\n");
+			}
+			return;
+		}
+		case "/api/icon-compose": {
+			const foregroundPath = typeof body.foregroundPath === "string" ? body.foregroundPath.trim() : "";
+			if (foregroundPath.length === 0) {
+				respond(response, 400, "application/json", "{\"error\":\"foregroundPath is required\"}\n");
+				return;
+			}
+			if (!isWizardOwnedIconPath(session, foregroundPath)) {
+				respond(response, 403, "application/json", "{\"error\":\"foregroundPath is not a wizard icon source\"}\n");
+				return;
+			}
+			const background = body.background === "black" || body.background === "white" || body.background === "transparent" ? body.background : void 0;
+			const scale = typeof body.scale === "number" && body.scale >= .5 && body.scale <= .95 ? body.scale : void 0;
+			try {
+				const composed = await session.composeIcon({
+					foregroundPath,
+					...background === void 0 ? {} : { background },
+					...scale === void 0 ? {} : { scale }
+				});
+				respond(response, 200, "application/json", JSON.stringify(composed) + "\n");
+			} catch (error) {
+				respond(response, 500, "application/json", JSON.stringify({ error: String(error) }) + "\n");
+			}
+			return;
+		}
+		case "/api/tray-icon-select": {
+			const port = typeof body.port === "number" ? body.port : NaN;
+			const index = typeof body.index === "number" ? body.index : NaN;
+			if (!Number.isInteger(port) || !Number.isInteger(index)) {
+				respond(response, 400, "application/json", "{\"error\":\"port and index are required\"}\n");
+				return;
+			}
+			const ok = session.selectTrayIconCandidate(port, index);
+			respond(response, 200, "application/json", JSON.stringify({ ok }) + "\n");
+			return;
+		}
+		case "/api/icon-select": {
+			const port = typeof body.port === "number" ? body.port : NaN;
+			const index = typeof body.index === "number" ? body.index : NaN;
+			if (!Number.isInteger(port) || !Number.isInteger(index)) {
+				respond(response, 400, "application/json", "{\"error\":\"port and index are required\"}\n");
+				return;
+			}
+			const ok = session.selectIconCandidate(port, index);
+			respond(response, 200, "application/json", JSON.stringify({ ok }) + "\n");
+			return;
+		}
+		case "/api/icon-source": {
+			const path = typeof body.path === "string" ? body.path.trim() : "";
+			if (path.length === 0) {
+				respond(response, 400, "application/json", "{\"error\":\"path is required\"}\n");
+				return;
+			}
+			session.updateForm({ iconPath: path });
+			respond(response, 200, "application/json", "{\"ok\":true}\n");
+			return;
+		}
+		case "/api/terminal-resize": {
+			const cols = Number(body.cols);
+			const rows = Number(body.rows);
+			if (!Number.isInteger(cols) || !Number.isInteger(rows) || cols <= 0 || rows <= 0) {
+				respond(response, 400, "application/json", "{\"error\":\"cols and rows are required\"}\n");
+				return;
+			}
+			session.terminalResize({
+				cols,
+				rows
+			});
+			respond(response, 200, "application/json", "{\"ok\":true}\n");
+			return;
+		}
+		case "/api/stop":
+			await session.stop();
+			respond(response, 200, "application/json", "{\"ok\":true}\n");
+			return;
+		case "/api/open-app": {
+			const result = session.result;
+			if (result === void 0) {
+				respond(response, 409, "application/json", "{\"error\":\"no materialized app\"}\n");
+				return;
+			}
+			const opened = await openMaterializedApp({
+				projectDir: result.projectDir,
+				bundlePath: result.bundlePath
+			});
+			respond(response, opened.ok ? 200 : 500, "application/json", `${JSON.stringify({
+				ok: opened.ok,
+				detail: opened.detail
+			})}\n`);
+			return;
+		}
+		default: respond(response, 404, "application/json", "{\"error\":\"unknown endpoint\"}\n");
+	}
+};
+const listen = (server, port) => new Promise((resolve, reject) => {
+	server.once("error", reject);
+	server.listen(port ?? 0, "127.0.0.1", () => {
+		server.off("error", reject);
+		resolve();
+	});
+});
+const isAuthorized = (request, url, token) => {
+	if (request.headers.authorization === `Bearer ${token}`) return true;
+	return url.searchParams.get("token") === token;
+};
+const isLoopbackHost = (request) => {
+	const hostname = (request.headers.host ?? "").replace(/:\d+$/u, "").toLowerCase();
+	return LOOPBACK_HOSTS.has(hostname);
+};
+const readJsonBody = async (request) => {
+	const chunks = [];
+	let size = 0;
+	for await (const chunk of request) {
+		const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk));
+		size += buffer.length;
+		if (size > 1 << 20) throw new Error("request body too large");
+		chunks.push(buffer);
+	}
+	if (chunks.length === 0) return {};
+	const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+	if (typeof parsed !== "object" || parsed === null) return {};
+	return parsed;
+};
+const respond = (response, status, contentType, body) => {
+	response.writeHead(status, {
+		"content-type": contentType,
+		"content-length": Buffer.byteLength(body),
+		"cache-control": "no-store"
+	});
+	response.end(body);
+};
+/** Built package: dist/webui/index.html; source checkout falls back to the create-webui vite output. */
+const webUiIndexPaths = () => [join(moduleDir(), "webui", "index.html"), join(moduleDir(), "..", "..", "create-webui", "dist", "index.html")];
+const readWebUiIndex = async () => {
+	for (const candidate of webUiIndexPaths()) {
+		const html = await readFile(candidate, "utf8").catch(() => void 0);
+		if (html !== void 0) return html;
+	}
+};
+//#endregion
+//#region src/bin.ts
+const parseWizardCli = (argv) => {
+	const options = {
+		open: true,
+		skipInstall: false,
+		force: false
+	};
+	const positional = [];
+	for (let index = 0; index < argv.length; index += 1) {
+		const arg = argv[index];
+		if (arg === void 0) continue;
+		if (arg === "--no-open") options.open = false;
+		else if (arg === "--skip-install") options.skipInstall = true;
+		else if (arg === "--force") options.force = true;
+		else if (arg === "--port") {
+			const value = argv[index + 1];
+			const port = Number.parseInt(value ?? "", 10);
+			if (Number.isInteger(port) && port > 0 && port < 65536) {
+				options.port = port;
+				index += 1;
+			}
+		} else if (arg === "--pm") {
+			const value = argv[index + 1];
+			if (value === "npm" || value === "pnpm" || value === "bun") {
+				options.pm = value;
+				index += 1;
+			}
+		} else if (arg === "--help" || arg === "-h") {
+			options.open = false;
+			positional.length = 0;
+			break;
+		} else if (!arg.startsWith("--")) positional.push(arg);
+	}
+	const [target] = positional;
+	return {
+		open: options.open,
+		port: options.port,
+		pm: options.pm,
+		skipInstall: options.skipInstall,
+		force: options.force,
+		targetDir: target
+	};
+};
+const WIZARD_HELP = [
+	"create-opentray — turn a start command into an OpenTray-hosted desktop app",
+	"",
+	"Usage: create-opentray [targetDir] [options]",
+	"",
+	"Options:",
+	"  --no-open        do not open the default browser",
+	"  --port <n>       bind the wizard server to a specific loopback port",
+	"  --pm <name>      package manager for the generated app (npm | pnpm | bun)",
+	"  --skip-install   scaffold without installing dependencies",
+	"  --force          allow materializing into a non-empty directory",
+	"  -h, --help       show this help"
+].join("\n");
+const readDependencyRange = async () => {
+	const packageJsonUrl = new URL("../package.json", import.meta.url);
+	try {
+		const parsed = JSON.parse(await readFile(packageJsonUrl, "utf8"));
+		if (typeof parsed.version === "string" && /^\d/u.test(parsed.version)) return `^${parsed.version}`;
+	} catch {}
+	return "latest";
+};
+const openBrowser = async (url) => {
+	const platform = process.platform;
+	spawn(platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open", platform === "win32" ? [
+		"/c",
+		"start",
+		"",
+		url
+	] : platform === "darwin" ? [url] : [url], {
+		stdio: "ignore",
+		detached: true,
+		windowsHide: true
+	}).unref();
+};
+const main = async (argv) => {
+	const options = parseWizardCli(argv);
+	if (argv.includes("--help") || argv.includes("-h")) {
+		console.log(WIZARD_HELP);
+		return 0;
+	}
+	ensureLoopbackNoProxy();
+	const invocationDir = process.env.INIT_CWD || process.cwd();
+	const cwd = invocationDir;
+	const dependencyRange = await readDependencyRange();
+	const server = await createWizardServer((emit) => createWizardSession({
+		cwd,
+		skipInstall: options.skipInstall,
+		force: options.force,
+		...options.targetDir === void 0 ? {} : { targetDir: resolve(invocationDir, options.targetDir) },
+		...options.pm === void 0 ? {} : { packageManager: options.pm },
+		dependencyRange,
+		emit
+	}), options.port === void 0 ? {} : { port: options.port });
+	console.log(`create-opentray wizard: ${server.url}`);
+	console.log(`working directory: ${cwd}`);
+	if (options.open) await openBrowser(server.url);
+	const shutdown = () => {
+		(async () => {
+			await server.session.stop();
+			await server.close();
+			process.exit(0);
+		})();
+	};
+	process.once("SIGINT", shutdown);
+	process.once("SIGTERM", shutdown);
+	await new Promise(() => {});
+	return 0;
+};
+const isMainModule = () => {
+	const entryPath = process.argv[1];
+	if (entryPath === void 0) return false;
+	const modulePath = fileURLToPath(import.meta.url);
+	if (resolve(entryPath) === resolve(modulePath)) return true;
+	return resolve(entryPath) === resolve(modulePath.replace(/bin-[^/]*\.mjs$/u, "bin.mjs"));
+};
+if (isMainModule()) main(process.argv.slice(2)).then((code) => {
+	process.exitCode = code;
+});
+//#endregion
+export { verifyHttpService as A, resolveFaviconUrl as C, parseNetstatPorts as D, parseLsofPorts as E, toProjectDirectoryName as F, deriveDefaultAppId as M, deriveDefaultAppName as N, parsePowerShellPorts as O, isValidAppId as P, rankFaviconCandidates as S, createPortDiscovery as T, writeScaffold as _, isAuthorized as a, extractTitle as b, openMaterializedApp as c, resolveLaunchVector as d, resolveOnPath as f, materialize as g, isDirectoryOccupied as h, createWizardServer as i, waitForTcpPort as j, serviceUrl as k, pinningHint as l, expectedDarwinBundlePath as m, openBrowser as n, isLoopbackHost as o, detectPackageManager as p, parseWizardCli as r, createWizardSession as s, main as t, parseShebangInterpreter as u, tokenizeCommandLine as v, scrapeService as w, faviconCandidateSize as x, extractFaviconCandidates as y };
+
+//# sourceMappingURL=bin-BT_kcLuP.mjs.map