create-vidra-app 0.4.0 → 0.5.1

package/dist/cli.js

@@ -1,4320 +0,0 @@
-// src/commands/build.ts
-import path12 from "path";
-import fs11 from "fs-extra";
-import { execSync as execSync3 } from "child_process";
-
-// src/utils.ts
-var parseArgs = (argv) => {
-  const args = { _: [] };
-  for (let i = 2; i < argv.length; i++) {
-    const arg = argv[i];
-    if (arg.startsWith("--")) {
-      const [key, val] = arg.slice(2).split("=");
-      if (val !== void 0) {
-        args[key] = val;
-        continue;
-      }
-      const next = argv[i + 1];
-      if (next !== void 0 && !next.startsWith("--")) {
-        args[key] = next;
-        i++;
-      } else {
-        args[key] = true;
-      }
-    } else {
-      args._.push(arg);
-    }
-  }
-  return args;
-};
-
-// src/exec.ts
-import { execSync, spawn } from "child_process";
-
-// src/theme.ts
-import chalk from "chalk";
-var CLI_VERSION = "0.3.1";
-var STEP_LABEL_WIDTH = 16;
-var lime = chalk.hex("#c8f751");
-var value = chalk.hex("#e8e8ec");
-var dim = chalk.hex("#7a7a86");
-var amber = chalk.hex("#ffcf5c");
-var green = chalk.hex("#86d98f");
-var red = chalk.hex("#ff8585");
-var slate = chalk.hex("#a9b0bd");
-var uiColor = chalk.hex("#6fd3e0");
-var hostColor = chalk.hex("#a48ce8");
-var GLYPH_CHAR = {
-  done: "\u2713",
-  active: "\u25B8",
-  error: "\u2717",
-  manual: "?",
-  plan: "\u25C6",
-  skip: "\u2298"
-};
-var GLYPH_COLOR = {
-  done: green,
-  active: lime,
-  error: red,
-  manual: amber,
-  plan: slate,
-  skip: slate
-};
-var glyph = (name) => GLYPH_COLOR[name](GLYPH_CHAR[name]);
-var TAG_COLOR = {
-  ui: uiColor,
-  host: hostColor
-};
-var TAG_WIDTH = 6;
-var tag = (name) => TAG_COLOR[name](`[${name}]`.padEnd(TAG_WIDTH));
-var blankTag = () => " ".repeat(TAG_WIDTH);
-var wordmark = () => lime("vidra");
-var header = (sub, context) => {
-  const base = `  ${wordmark()} ${value(sub)}`;
-  return context ? `${base} ${dim(`\u2014 ${context}`)}` : base;
-};
-var kv = (label, val, width = 9) => `  ${dim(label.padEnd(width))} ${value(val)}`;
-var row = (opts) => {
-  const parts = [`  ${glyph(opts.glyph)}`];
-  if (opts.label !== void 0) {
-    const padded = opts.labelWidth ? opts.label.padEnd(opts.labelWidth) : opts.label;
-    parts.push(value(padded));
-  }
-  if (opts.detail) parts.push(opts.detail);
-  return parts.join(" ");
-};
-var taggedRow = (glyphName, tagName, text) => `  ${glyph(glyphName)} ${tagName ? tag(tagName) : blankTag()} ${text}`;
-var streamPrefix = (tagName) => `  ${dim("\xB7")} ${tag(tagName)}`;
-var footer = (content) => `  ${content}`;
-var fixLine = (cmd, label = "fix:") => `      ${amber(label)} ${lime(cmd)}`;
-var planBadge = (text = "PLAN ONLY \xB7 BEING BUILT") => amber(`[ ${text} ]`);
-
-// src/exec.ts
-var toText = (value3) => {
-  if (value3 == null) return "";
-  return Buffer.isBuffer(value3) ? value3.toString() : value3;
-};
-var formatProcessError = (error) => {
-  const err = error;
-  const combined = [toText(err.stderr), toText(err.stdout)].map((s) => s.trim()).filter((s) => s.length > 0).join("\n").trim();
-  return combined.length > 0 ? combined : err.message ?? String(error);
-};
-var formatBuildError = (error) => {
-  const raw = formatProcessError(error);
-  const lines = raw.split(/\r?\n/);
-  const errorLines = lines.filter(
-    (line) => /(:\s*error\b|\berror\s+[A-Z]{2,}\d+|Build FAILED|MSB\d{4}|NETSDK\d{4})/i.test(
-      line
-    )
-  );
-  const picked = errorLines.length > 0 ? errorLines : lines.filter((line) => line.trim().length > 0).slice(-30);
-  return picked.join("\n").trim();
-};
-
-// src/version.ts
-import fs from "fs-extra";
-import path from "path";
-var SEMVER = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z-.]+))?(?:\+[0-9A-Za-z-.]+)?$/;
-var VersionError = class extends Error {
-};
-var buildNumberFor = (major, minor, patch) => major * 1e4 + minor * 100 + patch;
-var SEGMENT_CEILING = 100;
-var parseAppVersion = (raw, source) => {
-  const match = SEMVER.exec(raw.trim());
-  if (!match) {
-    throw new VersionError(
-      `${source}: "${raw}" is not a valid version \u2014 expected semver like 1.2.3`
-    );
-  }
-  const [, major, minor, patch] = match.map((v) => v);
-  const [maj, min, pat] = [Number(major), Number(minor), Number(patch)];
-  const override = process.env.VIDRA_BUILD_NUMBER;
-  if (override !== void 0 && !/^\d+$/.test(override)) {
-    throw new VersionError(
-      `VIDRA_BUILD_NUMBER: "${override}" is not a positive integer`
-    );
-  }
-  if (override === void 0 && (min >= SEGMENT_CEILING || pat >= SEGMENT_CEILING)) {
-    throw new VersionError(
-      `${source}: "${raw}" \u2014 minor and patch must stay below ${SEGMENT_CEILING} so the build number keeps increasing; set VIDRA_BUILD_NUMBER to override`
-    );
-  }
-  return {
-    semver: raw.trim(),
-    display: `${maj}.${min}.${pat}`,
-    build: override !== void 0 ? Number(override) : buildNumberFor(maj, min, pat)
-  };
-};
-var resolveAppVersion = (projectRoot, csprojPath) => {
-  const pkgPath = path.join(projectRoot, "package.json");
-  if (fs.existsSync(pkgPath)) {
-    const pkg = fs.readJsonSync(pkgPath, { throws: false });
-    if (pkg?.version) {
-      return { ...parseAppVersion(pkg.version, "package.json"), source: "package.json" };
-    }
-  }
-  const csproj = fs.readFileSync(csprojPath, "utf-8");
-  const fromCsproj = csproj.match(
-    /<ApplicationDisplayVersion>([^<]+)<\/ApplicationDisplayVersion>/
-  )?.[1];
-  if (!fromCsproj) {
-    throw new VersionError(
-      `no version found \u2014 add a "version" to the app's package.json (npm version patch)`
-    );
-  }
-  return { ...parseAppVersion(fromCsproj, "csproj"), source: "csproj" };
-};
-var versionPublishArgs = (version) => [
-  `-p:ApplicationDisplayVersion=${version.display}`,
-  `-p:ApplicationVersion=${version.build}`
-];
-var resolveAppVersionOrDefault = (projectRoot, csprojPath, fallback = "0.1.0") => {
-  try {
-    return resolveAppVersion(projectRoot, csprojPath).semver;
-  } catch {
-    return fallback;
-  }
-};
-
-// src/update-config.ts
-import path2 from "path";
-import fs2 from "fs-extra";
-var UPDATE_CONFIG_FILE = "vidra-updates.json";
-var readUpdateConfig = (projectRoot) => {
-  const pkgPath = path2.join(projectRoot, "package.json");
-  if (!fs2.existsSync(pkgPath)) return null;
-  let pkg;
-  try {
-    pkg = fs2.readJsonSync(pkgPath);
-  } catch {
-    return null;
-  }
-  const updates = pkg?.vidra?.updates;
-  if (!updates || typeof updates !== "object") return null;
-  const raw = updates;
-  const config = {};
-  if (typeof raw.feedUrl === "string" && raw.feedUrl.trim().length > 0) {
-    config.feedUrl = raw.feedUrl.trim();
-  }
-  if (typeof raw.channel === "string" && raw.channel.trim().length > 0) {
-    config.channel = raw.channel.trim();
-  }
-  if (typeof raw.enabled === "boolean") {
-    config.enabled = raw.enabled;
-  }
-  const keys = [
-    ...typeof raw.publicKey === "string" ? [raw.publicKey] : [],
-    ...Array.isArray(raw.publicKeys) ? raw.publicKeys : []
-  ].filter((key) => typeof key === "string" && key.trim().length > 0);
-  if (keys.length > 0) {
-    config.publicKeys = keys.map((key) => key.trim());
-  }
-  const native = readNativeConfig(raw.native);
-  if (native) {
-    config.native = native;
-  }
-  return Object.keys(config).length > 0 ? config : null;
-};
-var readNativeConfig = (raw) => {
-  if (!raw || typeof raw !== "object") return null;
-  const source = raw;
-  const native = {};
-  const text = (key) => {
-    const value3 = source[key];
-    if (typeof value3 === "string" && value3.trim().length > 0) {
-      native[key] = value3.trim();
-    }
-  };
-  text("feedUrl");
-  text("channel");
-  text("packId");
-  if (typeof source.enabled === "boolean") native.enabled = source.enabled;
-  return Object.keys(native).length > 0 ? native : null;
-};
-var stampUpdateConfig = (hostDir, config) => {
-  const target = path2.join(hostDir, "Resources", "Raw", UPDATE_CONFIG_FILE);
-  if (!config) {
-    fs2.removeSync(target);
-    return null;
-  }
-  fs2.ensureDirSync(path2.dirname(target));
-  fs2.writeFileSync(target, `${JSON.stringify(config, null, 2)}
-`);
-  return target;
-};
-
-// src/native-update.ts
-import path6 from "path";
-import os2 from "os";
-import fs6 from "fs-extra";
-import { execFileSync as execFileSync4 } from "child_process";
-
-// src/velopack.ts
-import path3 from "path";
-import os from "os";
-import fs3 from "fs-extra";
-import { execFileSync } from "child_process";
-var ALREADY_RELEASED = /There is a release in channel .*? which is equal or greater to the current version/i;
-var packArgs = (options) => {
-  const args = [
-    "pack",
-    "--packId",
-    options.packId,
-    "--packVersion",
-    options.packVersion,
-    "--packDir",
-    options.packDir,
-    "--mainExe",
-    options.mainExe,
-    "--outputDir",
-    options.outputDir
-  ];
-  if (options.packTitle) args.push("--packTitle", options.packTitle);
-  if (options.channel) args.push("--channel", options.channel);
-  if (options.signAppIdentity) args.push("--signAppIdentity", options.signAppIdentity);
-  if (options.signEntitlements) args.push("--signEntitlements", options.signEntitlements);
-  if (options.keychain) args.push("--keychain", options.keychain);
-  if (options.signParams) args.push("--signParams", options.signParams);
-  return args;
-};
-var downloadArgs = (options) => {
-  const args = ["download", "http", "--url", options.feedUrl, "--outputDir", options.outputDir];
-  if (options.channel) args.push("--channel", options.channel);
-  return args;
-};
-var resolveVpk = () => {
-  const exe = process.platform === "win32" ? "vpk.exe" : "vpk";
-  const onPath = which(exe);
-  if (onPath) return onPath;
-  const home = process.env.DOTNET_CLI_HOME?.trim() || os.homedir();
-  const candidate = path3.join(home, ".dotnet", "tools", exe);
-  return fs3.existsSync(candidate) ? candidate : null;
-};
-var parseVpkVersion = (helpOutput) => helpOutput.match(/Velopack CLI\s+([\d][\w.+-]*)/i)?.[1] ?? null;
-var vpkVersion = (vpk) => {
-  try {
-    const output = execFileSync(vpk, ["--help"], {
-      encoding: "utf-8",
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    return parseVpkVersion(output ?? "");
-  } catch (error) {
-    return parseVpkVersion(combinedOutput(error));
-  }
-};
-var isVersionAlreadyReleased = (output) => ALREADY_RELEASED.test(output);
-var runVpk = (vpk, args, options = {}) => {
-  try {
-    const output = execFileSync(vpk, args, {
-      cwd: options.cwd,
-      encoding: "utf-8",
-      // Never `shell: true`. See the header.
-      stdio: options.verbose ? ["ignore", "inherit", "inherit"] : ["ignore", "pipe", "pipe"],
-      env: {
-        ...process.env,
-        // git-bash's argument mangling again: it rewrites anything starting
-        // with `/`, and Velopack's Windows signing arguments all do.
-        MSYS2_ARG_CONV_EXCL: "*"
-      }
-    });
-    return { ok: true, output: output ?? "", alreadyReleased: false };
-  } catch (error) {
-    const output = combinedOutput(error);
-    return { ok: false, output, alreadyReleased: isVersionAlreadyReleased(output) };
-  }
-};
-var findMacMainExe = (appBundle) => {
-  const macos = path3.join(appBundle, "Contents", "MacOS");
-  if (!fs3.existsSync(macos)) return null;
-  const declaredByPlist = readBundleExecutable(appBundle);
-  if (declaredByPlist && fs3.existsSync(path3.join(macos, declaredByPlist))) return declaredByPlist;
-  const declared = readMainExeFromSpec(appBundle);
-  if (declared && fs3.existsSync(path3.join(macos, declared))) return declared;
-  const candidates = fs3.readdirSync(macos, { withFileTypes: true }).filter((e) => e.isFile() && !e.name.startsWith(".") && e.name !== "UpdateMac" && e.name !== "sq.version").map((e) => e.name);
-  return candidates[0] ?? null;
-};
-var readBundleExecutable = (appBundle) => {
-  const plist = path3.join(appBundle, "Contents", "Info.plist");
-  if (!fs3.existsSync(plist)) return null;
-  const match = /<key>CFBundleExecutable<\/key>\s*<string>([^<]+)<\/string>/.exec(
-    fs3.readFileSync(plist, "utf-8")
-  );
-  return match?.[1].trim() || null;
-};
-var readMainExeFromSpec = (appBundle) => {
-  for (const dir of ["MacOS", "Resources"]) {
-    const file = path3.join(appBundle, "Contents", dir, "sq.version");
-    if (!fs3.existsSync(file)) continue;
-    const match = /<mainExe>([^<]+)<\/mainExe>/.exec(fs3.readFileSync(file, "utf-8"));
-    if (match) return match[1].trim();
-  }
-  return null;
-};
-var findVpkOutputs = (outputDir) => {
-  const files = fs3.existsSync(outputDir) ? fs3.readdirSync(outputDir) : [];
-  const find = (suffix) => {
-    const match = files.find((f) => f.toLowerCase().endsWith(suffix.toLowerCase()));
-    return match ? path3.join(outputDir, match) : null;
-  };
-  return {
-    portableZip: find("Portable.zip"),
-    setupExe: find("Setup.exe"),
-    setupPkg: find("Setup.pkg")
-  };
-};
-var combinedOutput = (error) => {
-  const err = error;
-  const text = (v) => v == null ? "" : Buffer.isBuffer(v) ? v.toString() : v;
-  const combined = [text(err.stdout), text(err.stderr)].map((s) => s.trim()).filter(Boolean).join("\n").trim();
-  return combined || err.message || String(error);
-};
-var which = (exe) => {
-  const probe = process.platform === "win32" ? "where" : "which";
-  try {
-    const output = execFileSync(probe, [exe], {
-      encoding: "utf-8",
-      stdio: ["ignore", "pipe", "ignore"]
-    });
-    const first = output.split(/\r?\n/).map((l) => l.trim()).find(Boolean);
-    return first ?? null;
-  } catch {
-    return null;
-  }
-};
-
-// src/signing.ts
-import path4 from "path";
-import fs4 from "fs-extra";
-import { execFileSync as execFileSync2, spawnSync } from "child_process";
-var DEVELOPER_ID_PREFIX = "Developer ID Application:";
-var APPLE_DEVELOPMENT_PREFIX = "Apple Development:";
-var signMacAppBundleIfPossible = (appBundle, options) => {
-  if (process.platform !== "darwin") return;
-  const purpose = options.purpose ?? "development";
-  const { identity, expiredSkipped } = selectMacIdentity(purpose);
-  warnAboutExpiredIdentities(expiredSkipped, options);
-  const signWith = identity ?? "-";
-  const label = path4.basename(appBundle);
-  const entitlements = options.entitlements && fs4.existsSync(options.entitlements) ? options.entitlements : null;
-  const hardened = purpose === "distribution" && entitlements !== null;
-  if (purpose === "distribution") {
-    warnAboutDistributionIdentity(identity, options);
-    if (!entitlements) {
-      options.warn(
-        row({
-          glyph: "manual",
-          label: "codesign",
-          labelWidth: STEP_LABEL_WIDTH,
-          detail: dim(
-            "no Entitlements.plist found \u2014 signing without the hardened runtime (cannot be notarized)"
-          )
-        })
-      );
-    }
-  }
-  try {
-    for (const nested of findNestedMachOPayloads(appBundle)) {
-      runCodesign(nested, signWith, { hardened, entitlements: null }, options);
-    }
-    runCodesign(appBundle, signWith, { hardened, entitlements }, options);
-    const detail = [
-      value(label),
-      dim(identity ? `with ${identity}` : "ad-hoc (-)"),
-      hardened ? dim("\xB7 hardened runtime") : ""
-    ].filter(Boolean).join(" ");
-    options.log(
-      row({
-        glyph: "done",
-        label: "codesign",
-        labelWidth: STEP_LABEL_WIDTH,
-        detail
-      })
-    );
-  } catch (error) {
-    options.warn(
-      row({
-        glyph: "manual",
-        label: "codesign",
-        labelWidth: STEP_LABEL_WIDTH,
-        detail: dim("could not sign the app bundle; it may fail to launch")
-      })
-    );
-    options.warn(
-      footer(
-        dim(
-          "install Xcode or the Command Line Tools (provides `codesign`), or set VIDRA_MACOS_CODESIGN_KEY."
-        )
-      )
-    );
-    options.warn(dim(formatExecError(error)));
-  }
-};
-var signMacDmgIfPossible = (dmgPath, options) => {
-  if (process.platform !== "darwin") return;
-  const purpose = options.purpose ?? "distribution";
-  const { identity, expiredSkipped } = selectMacIdentity(purpose);
-  warnAboutExpiredIdentities(expiredSkipped, options);
-  if (!identity) {
-    options.warn(
-      row({
-        glyph: "skip",
-        label: "codesign dmg",
-        labelWidth: STEP_LABEL_WIDTH,
-        detail: dim("no Developer ID identity \u2014 leaving the disk image unsigned")
-      })
-    );
-    return;
-  }
-  try {
-    execFileSync2("codesign", ["--force", "--timestamp", "--sign", identity, dmgPath], {
-      stdio: options.verbose ? "inherit" : "pipe"
-    });
-    options.log(
-      row({
-        glyph: "done",
-        label: "codesign dmg",
-        labelWidth: STEP_LABEL_WIDTH,
-        detail: `${value(path4.basename(dmgPath))} ${dim(`with ${identity}`)}`
-      })
-    );
-  } catch (error) {
-    options.warn(
-      row({
-        glyph: "manual",
-        label: "codesign dmg",
-        labelWidth: STEP_LABEL_WIDTH,
-        detail: dim("could not sign the disk image")
-      })
-    );
-    options.warn(dim(formatExecError(error)));
-  }
-};
-var verifyMacSignature = (target) => {
-  try {
-    const output = execFileSync2(
-      "codesign",
-      ["--verify", "--strict", "--verbose=2", target],
-      { stdio: ["ignore", "pipe", "pipe"], encoding: "utf8" }
-    );
-    return { ok: true, output: output ?? "" };
-  } catch (error) {
-    return { ok: false, output: formatExecError(error) };
-  }
-};
-var assessGatekeeper = (target) => {
-  const type = target.endsWith(".dmg") ? "open" : "execute";
-  const args = ["--assess", "--type", type, "--verbose=2"];
-  if (type === "open") args.push("--context", "context:primary-signature");
-  args.push(target);
-  try {
-    const output = execFileSync2("spctl", args, {
-      stdio: ["ignore", "pipe", "pipe"],
-      encoding: "utf8"
-    });
-    return { ok: true, output: output ?? "" };
-  } catch (error) {
-    return { ok: false, output: formatExecError(error) };
-  }
-};
-var REQUIRED_MAC_ENTITLEMENTS = [
-  "com.apple.security.cs.allow-jit",
-  "com.apple.security.cs.allow-unsigned-executable-memory",
-  "com.apple.security.cs.disable-library-validation"
-];
-var inspectMacHardening = (target) => {
-  const flags = runCodesignRead(["-d", "--verbose=2", target]);
-  const entitlementsXml = runCodesignRead(["-d", "--entitlements", "-", "--xml", target]) || runCodesignRead(["-d", "--entitlements", "-", target]);
-  const hardened = /CodeDirectory[^\n]*flags=[^\n]*runtime/.test(flags);
-  const entitlements = [...entitlementsXml.matchAll(/<key>([^<]+)<\/key>/g)].map(
-    (m) => m[1]
-  );
-  const missing = REQUIRED_MAC_ENTITLEMENTS.filter(
-    (key) => !entitlementsXml.includes(key)
-  );
-  return {
-    hardened,
-    entitlements,
-    missing,
-    ok: hardened && missing.length === 0,
-    output: `${flags}
-${entitlementsXml}`
-  };
-};
-var runCodesignRead = (args) => {
-  const result = spawnSync("codesign", args, { encoding: "utf8" });
-  return `${result.stdout ?? ""}${result.stderr ?? ""}`;
-};
-var selectMacIdentity = (purpose = "development") => {
-  const override = process.env.VIDRA_MACOS_CODESIGN_KEY?.trim();
-  if (override) return { identity: override, expiredSkipped: [] };
-  const all = listCodeSigningIdentities();
-  const expired = new Set(listExpiredCodeSigningIdentities(all));
-  const usable = all.filter((id) => !expired.has(id));
-  const pick = (list) => (purpose === "distribution" ? list.find((id) => id.startsWith(DEVELOPER_ID_PREFIX)) ?? list.find((id) => id.startsWith(APPLE_DEVELOPMENT_PREFIX)) : list.find((id) => id.startsWith(APPLE_DEVELOPMENT_PREFIX)) ?? list.find((id) => id.startsWith(DEVELOPER_ID_PREFIX))) ?? null;
-  return {
-    identity: pick(usable),
-    // Only worth mentioning an expired certificate if it would otherwise have
-    // been the one we chose.
-    expiredSkipped: pick([...expired]) ? [pick([...expired])] : []
-  };
-};
-var resolveMacCodeSigningIdentity = (purpose = "development") => selectMacIdentity(purpose).identity;
-var listCodeSigningIdentities = () => runFindIdentity(["find-identity", "-p", "codesigning"]);
-var listValidCodeSigningIdentities = () => runFindIdentity(["find-identity", "-v", "-p", "codesigning"]);
-var runFindIdentity = (args) => {
-  try {
-    const output = execFileSync2("security", args, {
-      stdio: ["ignore", "pipe", "pipe"],
-      encoding: "utf8"
-    });
-    return output.split(/\r?\n/).map((line) => line.match(/"([^"]+)"/)?.[1] ?? null).filter((v) => v !== null);
-  } catch {
-    return [];
-  }
-};
-var listExpiredCodeSigningIdentities = (identities = listCodeSigningIdentities()) => {
-  const chainValid = new Set(listValidCodeSigningIdentities());
-  return identities.filter((id) => {
-    if (chainValid.has(id)) return false;
-    const notAfter = certificateNotAfter(id);
-    return notAfter !== null && notAfter.getTime() < Date.now();
-  });
-};
-var certificateNotAfter = (identity) => {
-  const pem = spawnSync("security", ["find-certificate", "-c", identity, "-p"], {
-    encoding: "utf8"
-  });
-  if (pem.status !== 0 || !pem.stdout) return null;
-  const parsed = spawnSync("openssl", ["x509", "-noout", "-enddate"], {
-    input: pem.stdout,
-    encoding: "utf8"
-  });
-  const raw = parsed.stdout?.match(/notAfter=(.+)/)?.[1]?.trim();
-  if (!raw) return null;
-  const date = new Date(raw);
-  return Number.isNaN(date.getTime()) ? null : date;
-};
-var hasDeveloperIdIdentity = () => {
-  const all = listCodeSigningIdentities();
-  const expired = new Set(listExpiredCodeSigningIdentities(all));
-  return all.some((id) => id.startsWith(DEVELOPER_ID_PREFIX) && !expired.has(id));
-};
-var warnAboutExpiredIdentities = (expired, options) => {
-  for (const identity of expired) {
-    options.warn(
-      row({
-        glyph: "manual",
-        label: "codesign",
-        labelWidth: STEP_LABEL_WIDTH,
-        detail: dim(`skipping expired certificate: ${identity}`)
-      })
-    );
-  }
-};
-var warnAboutDistributionIdentity = (identity, options) => {
-  if (identity === null) {
-    options.warn(
-      row({
-        glyph: "manual",
-        label: "codesign",
-        labelWidth: STEP_LABEL_WIDTH,
-        detail: dim(
-          "no signing identity \u2014 the app will be ad-hoc signed and Gatekeeper will block it on other Macs"
-        )
-      })
-    );
-    return;
-  }
-  if (!identity.startsWith(DEVELOPER_ID_PREFIX) && !process.env.VIDRA_MACOS_CODESIGN_KEY) {
-    options.warn(
-      row({
-        glyph: "manual",
-        label: "codesign",
-        labelWidth: STEP_LABEL_WIDTH,
-        detail: dim(
-          `using ${identity} \u2014 development certificates cannot be notarized; a "Developer ID Application" certificate is required to distribute`
-        )
-      })
-    );
-  }
-};
-var runCodesign = (target, identity, opts, options) => {
-  const args = ["--force", "--timestamp", "--sign", identity];
-  if (opts.hardened) args.push("--options", "runtime");
-  if (opts.entitlements) args.push("--entitlements", opts.entitlements);
-  args.push(target);
-  execFileSync2("codesign", args, {
-    stdio: options.verbose ? "inherit" : "pipe"
-  });
-};
-var findNestedMachOPayloads = (appBundle) => {
-  const found = [];
-  const walk = (dir) => {
-    let entries;
-    try {
-      entries = fs4.readdirSync(dir, { withFileTypes: true });
-    } catch {
-      return;
-    }
-    for (const entry of entries) {
-      const full = path4.join(dir, entry.name);
-      if (entry.isDirectory()) {
-        if (entry.name.endsWith(".framework")) {
-          found.push(full);
-          continue;
-        }
-        walk(full);
-      } else if (entry.isFile() && /\.(dylib|so)$/.test(entry.name)) {
-        found.push(full);
-      }
-    }
-  };
-  walk(appBundle);
-  return found.sort((a, b) => b.split(path4.sep).length - a.split(path4.sep).length);
-};
-var formatExecError = (error) => {
-  const err = error;
-  const stderr = Buffer.isBuffer(err.stderr) ? err.stderr.toString() : err.stderr;
-  if (stderr) return stderr;
-  const stdout = Buffer.isBuffer(err.stdout) ? err.stdout.toString() : err.stdout;
-  if (stdout) return stdout;
-  return err.message ?? String(error);
-};
-
-// src/windows-signing.ts
-import path5 from "path";
-import fs5 from "fs-extra";
-import { execFileSync as execFileSync3 } from "child_process";
-var DEFAULT_TIMESTAMP_URL = "http://timestamp.digicert.com";
-var resolveWindowsSigningConfig = () => {
-  const thumbprint = process.env.VIDRA_WINDOWS_CERT_THUMBPRINT?.trim();
-  if (thumbprint) return { mode: "thumbprint", thumbprint };
-  const pfxPath = process.env.VIDRA_WINDOWS_CERT_PATH?.trim();
-  if (pfxPath) {
-    const password = process.env.VIDRA_WINDOWS_CERT_PASSWORD?.trim() ?? null;
-    return { mode: "pfx", pfxPath, password };
-  }
-  return null;
-};
-var timestampUrl = () => process.env.VIDRA_WINDOWS_TIMESTAMP_URL?.trim() || DEFAULT_TIMESTAMP_URL;
-var buildSignToolArgs = (config, targets) => {
-  const args = ["sign", "/fd", "SHA256", "/tr", timestampUrl(), "/td", "SHA256"];
-  if (config.mode === "pfx") {
-    args.push("/f", config.pfxPath);
-    if (config.password) args.push("/p", config.password);
-  } else {
-    args.push("/sha1", config.thumbprint);
-  }
-  return [...args, ...targets];
-};
-var signWindowsBinariesIfPossible = (targets, options) => {
-  if (process.platform !== "win32") return false;
-  if (targets.length === 0) return false;
-  const config = resolveWindowsSigningConfig();
-  if (!config) {
-    options.log(
-      row({
-        glyph: "skip",
-        label: "authenticode",
-        labelWidth: STEP_LABEL_WIDTH,
-        detail: dim(
-          "no certificate configured \u2014 shipping unsigned (SmartScreen will warn)"
-        )
-      })
-    );
-    return false;
-  }
-  const signtool = resolveSignTool();
-  if (!signtool) {
-    options.warn(
-      row({
-        glyph: "manual",
-        label: "authenticode",
-        labelWidth: STEP_LABEL_WIDTH,
-        detail: dim("signtool.exe not found \u2014 install the Windows SDK")
-      })
-    );
-    return false;
-  }
-  try {
-    execFileSync3(signtool, buildSignToolArgs(config, targets), {
-      stdio: options.verbose ? "inherit" : "pipe"
-    });
-    options.log(
-      row({
-        glyph: "done",
-        label: "authenticode",
-        labelWidth: STEP_LABEL_WIDTH,
-        detail: `${value(`${targets.length} file(s)`)} ${dim(`timestamped via ${timestampUrl()}`)}`
-      })
-    );
-    return true;
-  } catch (error) {
-    options.warn(
-      row({
-        glyph: "manual",
-        label: "authenticode",
-        labelWidth: STEP_LABEL_WIDTH,
-        detail: dim("signing failed; shipping unsigned")
-      })
-    );
-    options.warn(dim(formatExecError(error)));
-    return false;
-  }
-};
-var verifyWindowsSignature = (target) => {
-  const signtool = resolveSignTool();
-  if (!signtool) {
-    return { ok: false, untrustedRoot: false, output: "signtool.exe not found" };
-  }
-  try {
-    const output = execFileSync3(signtool, ["verify", "/pa", "/v", target], {
-      stdio: ["ignore", "pipe", "pipe"],
-      encoding: "utf8"
-    });
-    return { ok: true, untrustedRoot: false, output: output ?? "" };
-  } catch (error) {
-    const output = formatExecError(error);
-    const flat = output.replace(/\s+/g, " ");
-    const untrustedRoot = /0x800B0109/i.test(flat) || /terminated in a root certificate which is not trusted/i.test(flat);
-    return { ok: untrustedRoot, untrustedRoot, output };
-  }
-};
-var resolveSignTool = () => {
-  const override = process.env.VIDRA_SIGNTOOL_PATH?.trim();
-  if (override) return fs5.existsSync(override) ? override : null;
-  try {
-    execFileSync3("signtool", ["/?"], { stdio: "ignore" });
-    return "signtool";
-  } catch {
-  }
-  const roots = [
-    process.env["ProgramFiles(x86)"],
-    process.env.ProgramFiles
-  ].filter((r) => !!r);
-  for (const root of roots) {
-    const binDir = path5.join(root, "Windows Kits", "10", "bin");
-    if (!fs5.existsSync(binDir)) continue;
-    const versions = fs5.readdirSync(binDir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name).sort().reverse();
-    for (const version of versions) {
-      for (const arch of ["x64", "x86"]) {
-        const candidate = path5.join(binDir, version, arch, "signtool.exe");
-        if (fs5.existsSync(candidate)) return candidate;
-      }
-    }
-  }
-  return null;
-};
-var findPrimaryExecutable = (publishDir, projectName) => {
-  if (!fs5.existsSync(publishDir)) return null;
-  const exes = fs5.readdirSync(publishDir, { withFileTypes: true }).filter((e) => e.isFile() && e.name.toLowerCase().endsWith(".exe")).map((e) => e.name);
-  const preferred = exes.find((n) => n.toLowerCase() === `${projectName}.host.exe`.toLowerCase()) ?? exes.find((n) => n.toLowerCase().startsWith(projectName.toLowerCase()));
-  const chosen = preferred ?? exes[0];
-  return chosen ? path5.join(publishDir, chosen) : null;
-};
-
-// src/native-update.ts
-var RELEASE_DIR = path6.join("dist", "release");
-var entitlementsCopyName = (packId) => `${packId}.entitlements`;
-var NativeUpdateConfigError = class extends Error {
-};
-var resolveNativeUpdateSettings = (opts) => {
-  const config = opts.config ?? {};
-  if (config.enabled === false) {
-    throw new NativeUpdateConfigError(
-      "vidra.updates.native.enabled is false: remove --native-update, or set it to true"
-    );
-  }
-  const packId = config.packId ?? readApplicationId(opts.csprojPath) ?? opts.projectName;
-  const packTitle = readApplicationTitle(opts.csprojPath) ?? opts.projectName;
-  if (!config.feedUrl) {
-    return { packId, packTitle, packVersion: opts.version, feedUrl: null, channel: config.channel ?? null };
-  }
-  return {
-    packId,
-    packTitle,
-    packVersion: opts.version,
-    feedUrl: config.feedUrl,
-    channel: config.channel ?? null
-  };
-};
-var readApplicationId = (csprojPath) => readCsprojProperty(csprojPath, "ApplicationId");
-var readApplicationTitle = (csprojPath) => readCsprojProperty(csprojPath, "ApplicationTitle");
-var readCsprojProperty = (csprojPath, name) => {
-  if (!fs6.existsSync(csprojPath)) return null;
-  const xml = fs6.readFileSync(csprojPath, "utf-8");
-  return new RegExp(`<${name}>([^<]+)</${name}>`).exec(xml)?.[1]?.trim() || null;
-};
-var windowsSignParams = () => {
-  const config = resolveWindowsSigningConfig();
-  if (!config) return null;
-  const parts = ["/fd", "SHA256", "/tr", timestampUrl(), "/td", "SHA256"];
-  if (config.mode === "pfx") {
-    parts.push("/f", config.pfxPath);
-    if (config.password) parts.push("/p", config.password);
-  } else {
-    parts.push("/sha1", config.thumbprint);
-  }
-  return parts.join(" ");
-};
-var NativeUpdateError = class extends Error {
-  constructor(message, detail = "") {
-    super(message);
-    this.detail = detail;
-  }
-  detail;
-};
-var runNativeUpdate = (opts) => {
-  const vpk = resolveVpk();
-  if (!vpk) {
-    throw new NativeUpdateError(
-      "vpk is not installed",
-      "dotnet tool install -g vpk"
-    );
-  }
-  const releaseDir = path6.join(opts.projectRoot, RELEASE_DIR);
-  fs6.ensureDirSync(releaseDir);
-  const merged = mergeFromLiveFeed(vpk, opts.settings, releaseDir, opts.io);
-  const mainExe = opts.target === "macos" ? findMacMainExe(opts.packDir) : findWindowsMainExe(opts.packDir);
-  if (!mainExe) {
-    throw new NativeUpdateError(
-      `could not find the app executable inside ${opts.packDir}`
-    );
-  }
-  const args = packArgs({
-    packId: opts.settings.packId,
-    packVersion: opts.settings.packVersion,
-    packTitle: opts.settings.packTitle,
-    packDir: opts.packDir,
-    mainExe,
-    outputDir: releaseDir,
-    channel: opts.settings.channel,
-    ...opts.target === "macos" ? {
-      // Velopack has to own signing: it adds files to a sealed bundle
-      // *after* the build signed it, which breaks the seal. Handing it the
-      // same identity and entitlements puts the packed bundle back on the
-      // baseline's row: Developer ID authority, hardened runtime, all
-      // three JIT entitlements, strict and deep verification passing.
-      signAppIdentity: resolveMacCodeSigningIdentity("distribution"),
-      signEntitlements: opts.entitlements ? copyEntitlementsForVpk(opts.entitlements, opts.settings.packId) : null,
-      keychain: process.env.VIDRA_MACOS_KEYCHAIN?.trim() || null
-    } : { signParams: windowsSignParams() }
-  });
-  const result = runVpk(vpk, args, { cwd: opts.projectRoot, verbose: opts.io.verbose });
-  if (!result.ok) {
-    if (result.alreadyReleased) {
-      throw new NativeUpdateError(
-        `${opts.settings.packVersion} is already in the feed, nothing was written`,
-        "bump the version in package.json (npm version patch), or drop --native-update to rebuild the installer only"
-      );
-    }
-    throw new NativeUpdateError("vpk pack failed", result.output);
-  }
-  return { releaseDir, outputs: findVpkOutputs(releaseDir), merged };
-};
-var mergeFromLiveFeed = (vpk, settings, releaseDir, io) => {
-  if (!settings.feedUrl) return "no-feed";
-  const result = runVpk(
-    vpk,
-    downloadArgs({
-      feedUrl: settings.feedUrl,
-      outputDir: releaseDir,
-      channel: settings.channel
-    }),
-    { verbose: io.verbose }
-  );
-  if (result.ok) return "merged";
-  io.warn(lastLines(result.output, 4));
-  return "empty-feed";
-};
-var copyEntitlementsForVpk = (entitlements, packId) => {
-  const dir = fs6.mkdtempSync(path6.join(os2.tmpdir(), "vidra-vpk-"));
-  const target = path6.join(dir, entitlementsCopyName(packId));
-  fs6.copySync(entitlements, target);
-  return target;
-};
-var findWindowsMainExe = (publishDir) => {
-  const entries = fs6.readdirSync(publishDir, { withFileTypes: true }).filter((e) => e.isFile() && e.name.toLowerCase().endsWith(".exe")).map((e) => e.name);
-  return entries.find((e) => e.endsWith(".Host.exe")) ?? entries.find((e) => e !== "createdump.exe") ?? null;
-};
-var extractPackedApp = (portableZip) => {
-  const staging = fs6.mkdtempSync(path6.join(os2.tmpdir(), "vidra-packed-"));
-  execFileSync4("ditto", ["-x", "-k", portableZip, staging], { stdio: "pipe" });
-  const found = findAppBundle(staging);
-  if (!found) {
-    throw new NativeUpdateError(`no .app inside ${path6.basename(portableZip)}`);
-  }
-  return found;
-};
-var findAppBundle = (root, depth = 0) => {
-  if (depth > 2 || !fs6.existsSync(root)) return null;
-  for (const entry of fs6.readdirSync(root, { withFileTypes: true })) {
-    if (!entry.isDirectory()) continue;
-    const full = path6.join(root, entry.name);
-    if (entry.name.endsWith(".app")) return full;
-    const nested = findAppBundle(full, depth + 1);
-    if (nested) return nested;
-  }
-  return null;
-};
-var lastLines = (text, count) => text.trim().split(/\r?\n/).slice(-count).join("\n");
-
-// src/project.ts
-import path7 from "path";
-import fs7 from "fs-extra";
-var detectPlatform = () => {
-  switch (process.platform) {
-    case "darwin":
-      return "macos";
-    case "win32":
-      return "windows";
-    case "linux":
-      return "linux";
-    default:
-      return "macos";
-  }
-};
-var detectProject = (cwd) => {
-  const project = tryDetectProject(cwd);
-  if (project) return project;
-  console.error(
-    row({
-      glyph: "error",
-      detail: dim(
-        "Could not detect Vidra project. Run this command from your project root."
-      )
-    })
-  );
-  console.error(
-    footer(dim("expected: package.json, ui/, src/<Name>.Host/<Name>.Host.csproj"))
-  );
-  process.exit(1);
-};
-var tryDetectProject = (cwd) => {
-  let dir = cwd;
-  while (true) {
-    const uiDir = path7.join(dir, "ui");
-    const srcDir = path7.join(dir, "src");
-    const pkgJson = path7.join(dir, "package.json");
-    if (fs7.existsSync(pkgJson) && fs7.existsSync(uiDir) && fs7.existsSync(srcDir)) {
-      const csproj = findHostCsproj(srcDir);
-      if (csproj) {
-        const projectName = path7.basename(csproj.dir).replace(/\.Host$/, "");
-        const displayVersion = resolveAppVersionOrDefault(dir, csproj.path);
-        return {
-          root: dir,
-          hostDir: csproj.dir,
-          csprojPath: csproj.path,
-          projectName,
-          displayVersion,
-          uiDir
-        };
-      }
-    }
-    const parent = path7.dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  return null;
-};
-var findHostCsproj = (srcDir) => {
-  if (!fs7.existsSync(srcDir)) return null;
-  for (const entry of fs7.readdirSync(srcDir, { withFileTypes: true })) {
-    if (entry.isDirectory() && entry.name.endsWith(".Host")) {
-      const csprojPath = path7.join(
-        srcDir,
-        entry.name,
-        `${entry.name}.csproj`
-      );
-      if (fs7.existsSync(csprojPath)) {
-        return { dir: path7.join(srcDir, entry.name), path: csprojPath };
-      }
-    }
-  }
-  return null;
-};
-
-// src/targets/macos.ts
-import path8 from "path";
-import fs8 from "fs-extra";
-import { execSync as execSync2 } from "child_process";
-import os3 from "os";
-var macosTarget = {
-  name: "macos",
-  framework: "net10.0-maccatalyst",
-  extraPublishArgs: "-p:CreatePackage=false",
-  findBundle(publishDir, _projectName) {
-    if (!fs8.existsSync(publishDir)) return null;
-    for (const entry of fs8.readdirSync(publishDir, { withFileTypes: true })) {
-      if (entry.name.endsWith(".app") && entry.isDirectory()) {
-        return path8.join(publishDir, entry.name);
-      }
-    }
-    return null;
-  },
-  async package(appPath, outputDir, meta) {
-    const dmgName = `${meta.projectName}-${meta.displayVersion}-macos.dmg`;
-    const dmgPath = path8.join(outputDir, dmgName);
-    const volName = meta.projectName;
-    const staging = fs8.mkdtempSync(path8.join(os3.tmpdir(), "vidra-dmg-"));
-    try {
-      fs8.copySync(appPath, path8.join(staging, path8.basename(appPath)));
-      fs8.symlinkSync("/Applications", path8.join(staging, "Applications"));
-      if (fs8.existsSync(dmgPath)) {
-        fs8.removeSync(dmgPath);
-      }
-      execSync2(
-        `hdiutil create -volname "${volName}" -srcfolder "${staging}" -ov -format UDZO "${dmgPath}"`,
-        { stdio: "pipe" }
-      );
-    } finally {
-      fs8.removeSync(staging);
-    }
-    return dmgPath;
-  }
-};
-
-// src/notarize.ts
-import path9 from "path";
-import { execFileSync as execFileSync5 } from "child_process";
-var resolveNotaryCredentials = () => {
-  const profile = process.env.VIDRA_NOTARY_PROFILE?.trim();
-  if (profile) return { mode: "profile", profile };
-  const appleId = process.env.VIDRA_APPLE_ID?.trim();
-  const teamId = process.env.VIDRA_TEAM_ID?.trim();
-  const password = process.env.VIDRA_APP_PASSWORD?.trim();
-  if (appleId && teamId && password) {
-    return { mode: "apple-id", appleId, teamId, password };
-  }
-  return null;
-};
-var notaryCredentialArgs = (creds) => creds.mode === "profile" ? ["--keychain-profile", creds.profile] : [
-  "--apple-id",
-  creds.appleId,
-  "--team-id",
-  creds.teamId,
-  "--password",
-  creds.password
-];
-var notarizeAndStaple = (artifactPath, options) => {
-  if (process.platform !== "darwin") {
-    return { status: "skipped", reason: "not macOS" };
-  }
-  const creds = resolveNotaryCredentials();
-  if (!creds) {
-    return {
-      status: "skipped",
-      reason: "no notary credentials (set VIDRA_NOTARY_PROFILE, or VIDRA_APPLE_ID + VIDRA_TEAM_ID + VIDRA_APP_PASSWORD)"
-    };
-  }
-  const label = path9.basename(artifactPath);
-  let submitOutput;
-  try {
-    submitOutput = execFileSync5(
-      "xcrun",
-      ["notarytool", "submit", artifactPath, ...notaryCredentialArgs(creds), "--wait"],
-      { stdio: ["ignore", "pipe", "pipe"], encoding: "utf8" }
-    );
-  } catch (error) {
-    const output = formatExecError(error);
-    reportNotaryFailure(output, creds, options);
-    return { status: "failed", reason: output };
-  }
-  if (options.verbose) options.log(dim(submitOutput.trim()));
-  if (!/status:\s*Accepted/i.test(submitOutput)) {
-    reportNotaryFailure(submitOutput, creds, options);
-    return { status: "failed", reason: "notary service did not accept the submission" };
-  }
-  try {
-    execFileSync5("xcrun", ["stapler", "staple", artifactPath], {
-      stdio: options.verbose ? "inherit" : "pipe"
-    });
-  } catch (error) {
-    const output = formatExecError(error);
-    options.warn(
-      row({
-        glyph: "error",
-        label: "staple",
-        labelWidth: STEP_LABEL_WIDTH,
-        detail: dim("notarized, but the ticket could not be stapled")
-      })
-    );
-    options.warn(dim(output));
-    return { status: "failed", reason: output };
-  }
-  options.log(
-    row({
-      glyph: "done",
-      label: "notarize",
-      labelWidth: STEP_LABEL_WIDTH,
-      detail: `${value(label)} ${dim("accepted \xB7 ticket stapled")}`
-    })
-  );
-  return { status: "ok" };
-};
-var reportNotaryFailure = (output, creds, options) => {
-  options.warn(
-    row({
-      glyph: "error",
-      label: "notarize",
-      labelWidth: STEP_LABEL_WIDTH,
-      detail: dim("the notary service rejected this build")
-    })
-  );
-  options.warn(dim(output.trim()));
-  const submissionId = parseSubmissionId(output);
-  if (!submissionId) return;
-  try {
-    const log = execFileSync5(
-      "xcrun",
-      ["notarytool", "log", submissionId, ...notaryCredentialArgs(creds)],
-      { stdio: ["ignore", "pipe", "pipe"], encoding: "utf8" }
-    );
-    options.warn(footer(dim("notary log:")));
-    options.warn(dim(log.trim()));
-  } catch {
-    options.warn(
-      footer(
-        dim(`fetch the details with: xcrun notarytool log ${submissionId} ...`)
-      )
-    );
-  }
-};
-var parseSubmissionId = (output) => output.match(/\bid:\s*([0-9a-f-]{36})/i)?.[1] ?? null;
-
-// src/targets/windows.ts
-import path10 from "path";
-import os4 from "os";
-import fs9 from "fs-extra";
-import { execFileSync as execFileSync6 } from "child_process";
-var windowsTarget = {
-  name: "windows",
-  framework: "net10.0-windows10.0.19041.0",
-  // `RuntimeIdentifierOverride` (rather than `-r`/`RuntimeIdentifier`) is the
-  // MAUI-recommended way to set the Windows RID — it sidesteps WindowsAppSDK
-  // issue #3337, which otherwise pulls in the wrong packaging assets.
-  extraPublishArgs: "-p:WindowsPackageType=None -p:SelfContained=true -p:WindowsAppSDKSelfContained=true -p:RuntimeIdentifierOverride=win-x64",
-  findBundle(publishDir, _projectName) {
-    const preferred = path10.join(publishDir, "win-x64", "publish");
-    if (dirContainsExe(preferred)) return preferred;
-    return findDirWithExe(publishDir);
-  },
-  async package(publishOutputDir, outputDir, meta) {
-    const outName = `${meta.projectName}-${meta.displayVersion}-windows.zip`;
-    const outPath = path10.join(outputDir, outName);
-    if (fs9.existsSync(outPath)) fs9.removeSync(outPath);
-    const staging = fs9.mkdtempSync(path10.join(os4.tmpdir(), "vidra-zip-"));
-    const stagedApp = path10.join(staging, meta.projectName);
-    try {
-      fs9.copySync(publishOutputDir, stagedApp);
-      execFileSync6(
-        "powershell",
-        [
-          "-NoProfile",
-          "-NonInteractive",
-          "-Command",
-          `Compress-Archive -Path "${stagedApp}" -DestinationPath "${outPath}" -Force`
-        ],
-        { stdio: "pipe" }
-      );
-    } finally {
-      fs9.removeSync(staging);
-    }
-    return outPath;
-  }
-};
-var dirContainsExe = (dir) => fs9.existsSync(dir) && fs9.readdirSync(dir, { withFileTypes: true }).some((e) => e.isFile() && e.name.toLowerCase().endsWith(".exe"));
-var findDirWithExe = (root) => {
-  if (!fs9.existsSync(root)) return null;
-  let fallback = null;
-  const walk = (dir) => {
-    if (dirContainsExe(dir)) {
-      if (path10.basename(dir) === "publish") return dir;
-      fallback ??= dir;
-    }
-    for (const e of fs9.readdirSync(dir, { withFileTypes: true })) {
-      if (e.isDirectory()) {
-        const found = walk(path10.join(dir, e.name));
-        if (found) return found;
-      }
-    }
-    return null;
-  };
-  return walk(root) ?? fallback;
-};
-
-// src/doctor.ts
-import { execFileSync as execFileSync7 } from "child_process";
-import fs10 from "fs";
-import path11 from "path";
-import prompts from "prompts";
-var DOTNET = process.platform === "win32" ? "dotnet.exe" : "dotnet";
-var MAUI_DOCS = "https://learn.microsoft.com/dotnet/maui/get-started/installation";
-var INSTALL_NET_10_FIX = "Install the .NET 10 SDK \u2014 https://dotnet.microsoft.com/download";
-var bufToStr = (v) => v == null ? "" : Buffer.isBuffer(v) ? v.toString() : v;
-var run = (cmd, args) => {
-  try {
-    const stdout = execFileSync7(cmd, args, {
-      encoding: "utf-8",
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    return { found: true, ok: true, stdout: stdout ?? "", stderr: "" };
-  } catch (e) {
-    const err = e;
-    return {
-      found: err.code !== "ENOENT",
-      ok: false,
-      stdout: bufToStr(err.stdout),
-      stderr: bufToStr(err.stderr)
-    };
-  }
-};
-var splitLines = (text) => text.split(/\r?\n/);
-var matchesAny = (text, patterns) => patterns.some((pattern) => pattern.test(text));
-var NET_10_VERSION = /^10\./;
-var MAUI_WORKLOAD = /\bmaui\b/i;
-var COMMAND_LINE_TOOLS_PATH = /CommandLineTools/i;
-var hasNet10Sdk = (listSdksOutput) => splitLines(listSdksOutput).some((line) => NET_10_VERSION.test(line.trim()));
-var newestNet10Sdk = (listSdksOutput) => splitLines(listSdksOutput).map((line) => line.trim().split(/\s+/)[0]).filter((version) => NET_10_VERSION.test(version)).sort(
-  (a, b) => a.localeCompare(b, void 0, { numeric: true, sensitivity: "base" })
-).pop();
-var outputMentionsMaui = (workloadListOutput) => MAUI_WORKLOAD.test(workloadListOutput);
-var MISSING_WORKLOAD_SIGNATURES = [
-  /NETSDK1147/i,
-  /workloads?\s+must\s+be\s+installed/i,
-  /maui-maccatalyst/i,
-  /maui-windows/i,
-  /to\s+install\s+the\s+.*workload/i
-];
-var MISSING_XCODE_SIGNATURES = [
-  /valid\s+Xcode\s+installation\s+was\s+not\s+found/i,
-  /could\s+not\s+find\s+a\s+valid\s+Xcode\s+app\s+bundle/i,
-  /macios-missing-xcode/i
-];
-var OUTDATED_XCODE_SIGNATURES = [
-  /error\s+MT0180/i,
-  /requires\s+the\s+MacCatalyst\s+\S+\s+SDK\s+\(shipped\s+with\s+Xcode/i
-];
-var looksLikeMissingWorkload = (output) => matchesAny(output, MISSING_WORKLOAD_SIGNATURES);
-var looksLikeMissingXcode = (output) => matchesAny(output, MISSING_XCODE_SIGNATURES);
-var looksLikeXcodeTooOld = (output) => matchesAny(output, OUTDATED_XCODE_SIGNATURES);
-var checkDotnetSdk = () => {
-  const name = ".NET SDK";
-  const res = run(DOTNET, ["--list-sdks"]);
-  if (!res.found) {
-    return {
-      name,
-      status: "missing",
-      detail: "`dotnet` was not found on your PATH",
-      fix: INSTALL_NET_10_FIX
-    };
-  }
-  if (!res.ok && !res.stdout) {
-    return { name, status: "unknown", detail: "could not run `dotnet --list-sdks`" };
-  }
-  if (hasNet10Sdk(res.stdout)) {
-    const newest = newestNet10Sdk(res.stdout);
-    return { name, status: "ok", detail: newest ? `found ${newest}` : "found 10.x" };
-  }
-  return {
-    name,
-    status: "missing",
-    detail: "no 10.x SDK installed",
-    fix: INSTALL_NET_10_FIX
-  };
-};
-var checkMauiWorkload = (workloadList) => {
-  const name = ".NET MAUI workload";
-  if (!workloadList) {
-    return { name, status: "unknown", detail: "requires the .NET SDK first" };
-  }
-  if (!workloadList.found) {
-    return { name, status: "unknown", detail: "could not query workloads" };
-  }
-  if (outputMentionsMaui(workloadList.stdout)) {
-    return { name, status: "ok", detail: "installed" };
-  }
-  return {
-    name,
-    status: "missing",
-    detail: "not installed",
-    fix: "dotnet workload install maui"
-  };
-};
-var FIRST_FIXED_MACCATALYST_PACK = [26, 2, 10233];
-var MACCATALYST_PACK_DIR = /^Microsoft\.MacCatalyst\.Sdk\.net\d+\.\d+_\d+\.\d+$/;
-var compareVersions = (a, b) => {
-  for (let i = 0; i < Math.max(a.length, b.length); i++) {
-    const diff = (a[i] ?? 0) - (b[i] ?? 0);
-    if (diff !== 0) return diff;
-  }
-  return 0;
-};
-var versionSegments = (version) => {
-  const segments = version.split(".").map((s) => Number.parseInt(s, 10));
-  return segments.length && !segments.some(Number.isNaN) ? segments : null;
-};
-var newestPackVersion = (versions) => {
-  let best;
-  for (const raw of versions) {
-    const segments = versionSegments(raw);
-    if (!segments) continue;
-    if (!best || compareVersions(segments, best.segments) > 0) {
-      best = { raw, segments };
-    }
-  }
-  return best?.raw;
-};
-var macCatalystPackIsStale = (version) => {
-  const segments = versionSegments(version);
-  return segments ? compareVersions(segments, FIRST_FIXED_MACCATALYST_PACK) < 0 : false;
-};
-var dotnetPacksDir = () => {
-  if (process.env.DOTNET_ROOT) {
-    return path11.join(process.env.DOTNET_ROOT, "packs");
-  }
-  const res = run(DOTNET, ["--list-sdks"]);
-  if (!res.found) return void 0;
-  const sdkDir = res.stdout.trim().split("\n").pop()?.match(/\[(.+)\]\s*$/)?.[1];
-  return sdkDir ? path11.join(path11.dirname(sdkDir), "packs") : void 0;
-};
-var installedMacCatalystPackVersion = () => {
-  const packs = dotnetPacksDir();
-  if (!packs) return void 0;
-  try {
-    const versions = fs10.readdirSync(packs, { withFileTypes: true }).filter((e) => e.isDirectory() && MACCATALYST_PACK_DIR.test(e.name)).flatMap((e) => {
-      try {
-        return fs10.readdirSync(path11.join(packs, e.name), { withFileTypes: true }).filter((v) => v.isDirectory()).map((v) => v.name);
-      } catch {
-        return [];
-      }
-    });
-    return newestPackVersion(versions);
-  } catch {
-    return void 0;
-  }
-};
-var checkCSharpDevLoop = (workloadList) => {
-  const name = "C# dev loop";
-  if (!workloadList) {
-    return { name, status: "unknown", detail: "requires the .NET SDK first" };
-  }
-  if (process.platform !== "darwin") {
-    return {
-      name,
-      status: "ok",
-      detail: "dotnet watch applies C# edits to the running app"
-    };
-  }
-  const pack = installedMacCatalystPackVersion();
-  if (pack && macCatalystPackIsStale(pack)) {
-    return {
-      name,
-      status: "unknown",
-      detail: `Mac Catalyst pack ${pack} cannot launch the app under dotnet watch \u2014 vidra dev falls back to a classic launch (fixed in 26.2.10233+)`,
-      fix: "dotnet workload update"
-    };
-  }
-  const packNote = pack ? ` (Mac Catalyst pack ${pack})` : "";
-  return {
-    name,
-    status: "ok",
-    detail: `dotnet watch applies C# edits to the running app${packNote} \u2014 vidra dev rebuilds and relaunches if the agent drops mid-session`
-  };
-};
-var checkXcode = () => {
-  const name = "Xcode";
-  const res = run("xcode-select", ["-p"]);
-  if (!res.found || !res.ok) {
-    return {
-      name,
-      status: "missing",
-      detail: "not found",
-      fix: "Install Xcode from the App Store"
-    };
-  }
-  const devDir = res.stdout.trim();
-  if (COMMAND_LINE_TOOLS_PATH.test(devDir)) {
-    return {
-      name,
-      status: "missing",
-      detail: "only Command Line Tools detected (Mac Catalyst needs full Xcode)",
-      fix: "Install Xcode, then: sudo xcode-select -s /Applications/Xcode.app"
-    };
-  }
-  return { name, status: "ok", detail: devDir };
-};
-var isMauiWorkloadInstalled = () => outputMentionsMaui(run(DOTNET, ["workload", "list"]).stdout);
-var isInteractive = () => Boolean(process.stdin.isTTY && process.stdout.isTTY);
-var checkMacSigningIdentity = () => {
-  const all = listCodeSigningIdentities();
-  const expired = new Set(listExpiredCodeSigningIdentities(all));
-  const identities = all.filter((id) => !expired.has(id));
-  if (identities.some((id) => id.startsWith("Developer ID Application:"))) {
-    return {
-      name: "macOS signing (distribution)",
-      status: "ok",
-      detail: "Developer ID Application certificate found"
-    };
-  }
-  const expiredDeveloperId = [...expired].find(
-    (id) => id.startsWith("Developer ID Application:")
-  );
-  if (expiredDeveloperId) {
-    return {
-      name: "macOS signing (distribution)",
-      status: "unknown",
-      detail: `Developer ID certificate expired \u2014 ${expiredDeveloperId}`,
-      fix: "Renew it in the Apple Developer portal, then re-download and install it"
-    };
-  }
-  if (identities.some((id) => id.startsWith("Apple Development:"))) {
-    return {
-      name: "macOS signing (distribution)",
-      status: "unknown",
-      detail: "only a development certificate found \u2014 fine for `vidra dev`, cannot be notarized",
-      fix: "Create a Developer ID Application certificate (requires the Apple Developer Program)"
-    };
-  }
-  return {
-    name: "macOS signing (distribution)",
-    status: "unknown",
-    detail: "no code-signing identity \u2014 builds will be ad-hoc signed",
-    fix: "Create a Developer ID Application certificate, or set VIDRA_MACOS_CODESIGN_KEY"
-  };
-};
-var checkNotarization = () => {
-  const creds = resolveNotaryCredentials();
-  if (creds) {
-    return {
-      name: "macOS notarization",
-      status: "ok",
-      detail: creds.mode === "profile" ? `keychain profile "${creds.profile}"` : `Apple ID ${creds.appleId} (team ${creds.teamId})`
-    };
-  }
-  return {
-    name: "macOS notarization",
-    status: "unknown",
-    detail: "no credentials \u2014 `vidra build` will skip notarization",
-    fix: "xcrun notarytool store-credentials, then set VIDRA_NOTARY_PROFILE"
-  };
-};
-var checkWindowsSigning = () => {
-  const config = resolveWindowsSigningConfig();
-  if (config) {
-    return {
-      name: "Windows signing",
-      status: "ok",
-      detail: config.mode === "pfx" ? `certificate file ${config.pfxPath}` : `store certificate ${config.thumbprint}`
-    };
-  }
-  return {
-    name: "Windows signing",
-    status: "unknown",
-    detail: "no certificate \u2014 builds ship unsigned and SmartScreen will warn",
-    fix: "Set VIDRA_WINDOWS_CERT_PATH (+ VIDRA_WINDOWS_CERT_PASSWORD) or VIDRA_WINDOWS_CERT_THUMBPRINT"
-  };
-};
-var checkWebView2Runtime = () => {
-  const key = "HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}";
-  const result = run("reg", ["query", key, "/v", "pv"]);
-  const version = result.stdout.match(/pv\s+REG_SZ\s+([\d.]+)/)?.[1];
-  if (result.ok && version && version !== "0.0.0.0") {
-    return {
-      name: "WebView2 runtime",
-      status: "ok",
-      detail: `found ${version}`
-    };
-  }
-  return {
-    name: "WebView2 runtime",
-    status: "unknown",
-    detail: "not detected \u2014 Vidra apps need it to render on this machine",
-    fix: "https://developer.microsoft.com/microsoft-edge/webview2/"
-  };
-};
-var checkVelopack = (required) => {
-  const vpk = resolveVpk();
-  if (vpk) {
-    const version = vpkVersion(vpk);
-    return {
-      name: "Velopack (vpk)",
-      status: "ok",
-      detail: version ? `${version} at ${vpk}` : vpk
-    };
-  }
-  return {
-    name: "Velopack (vpk)",
-    status: required ? "missing" : "unknown",
-    detail: required ? "vidra.updates.native is configured but vpk is not installed, so `vidra build --native-update` cannot run" : "not installed, and only needed for `vidra build --native-update`",
-    fix: "dotnet tool install -g vpk"
-  };
-};
-var diagnoseUpdateConfiguration = (input) => {
-  const { config } = input;
-  const mauiProgram = input.mauiProgram === null ? null : stripComments(input.mauiProgram);
-  const usesUpdates = mauiProgram?.includes(".UseVidraUpdates(") ?? false;
-  const usesNative = mauiProgram?.includes(".UseVidraNativeUpdates(") ?? false;
-  const found = [];
-  if (config && !usesUpdates && mauiProgram !== null) {
-    found.push({
-      name: "OTA updates wired up",
-      status: "missing",
-      detail: "package.json configures vidra.updates, but MauiProgram never calls .UseVidraUpdates()",
-      fix: "add .UseVidraUpdates() after .UseVidra() in MauiProgram.cs"
-    });
-  }
-  if (!config && usesUpdates) {
-    found.push({
-      name: "OTA updates configured",
-      status: "missing",
-      detail: ".UseVidraUpdates() is called, but package.json has no vidra.updates block, nothing is ever checked",
-      fix: 'add "vidra": { "updates": { "feedUrl": "https://..." } } to package.json'
-    });
-  }
-  if (input.publishedUnsigned && (config?.publicKeys?.length ?? 0) > 0) {
-    found.push({
-      name: "Feed signature",
-      status: "missing",
-      detail: "publicKeys are configured, so signatures are mandatory, but the published bundles.json has no .sig beside it",
-      fix: "republish with `vidra bundle --sign <key.pem>`"
-    });
-  }
-  if (config?.native) {
-    if (!usesNative && mauiProgram !== null) {
-      found.push({
-        name: "Native updates wired up",
-        status: "missing",
-        detail: "vidra.updates.native is configured, but MauiProgram never calls .UseVidraNativeUpdates()",
-        fix: "add .UseVidraNativeUpdates() after .UseVidra(), and reference Vidra.Updates.Native"
-      });
-    }
-    if (!config.native.feedUrl) {
-      found.push({
-        name: "Native feed",
-        status: "missing",
-        detail: "vidra.updates.native has no feedUrl: releases can be packed, and no installed app will ever find them",
-        fix: 'set "vidra": { "updates": { "native": { "feedUrl": "https://.../" } } }'
-      });
-    }
-  }
-  return found;
-};
-var stripComments = (source) => source.replace(/\/\*[\s\S]*?\*\//g, "").replace(/\/\/[^\n]*/g, "");
-var inspectUpdateConfiguration = () => {
-  const project = tryDetectProject(process.cwd());
-  if (!project) return [];
-  const config = readUpdateConfig(project.root);
-  const mauiProgram = readIfPresent(path11.join(project.hostDir, "MauiProgram.cs"));
-  const live = mauiProgram === null ? "" : stripComments(mauiProgram);
-  if (!config && !live.includes("Updates(")) {
-    return [];
-  }
-  const bundles = path11.join(project.root, "dist", "bundles.json");
-  const publishedUnsigned = fs10.existsSync(bundles) && !fs10.existsSync(`${bundles}.sig`);
-  return [
-    ...config?.native || resolveVpk() ? [checkVelopack(!!config?.native)] : [],
-    ...diagnoseUpdateConfiguration({ config, mauiProgram, publishedUnsigned })
-  ];
-};
-var readIfPresent = (file) => {
-  try {
-    return fs10.readFileSync(file, "utf-8");
-  } catch {
-    return null;
-  }
-};
-var collectRequirements = (opts = {}) => {
-  const dotnet = checkDotnetSdk();
-  const workloadList = dotnet.status === "ok" ? run(DOTNET, ["workload", "list"]) : null;
-  const reqs = [
-    dotnet,
-    checkMauiWorkload(workloadList),
-    checkCSharpDevLoop(workloadList)
-  ];
-  if (opts.includeXcode ?? process.platform === "darwin") {
-    reqs.push(checkXcode());
-  }
-  if (process.platform === "darwin") {
-    reqs.push(checkMacSigningIdentity(), checkNotarization());
-  }
-  if (process.platform === "win32") {
-    reqs.push(checkWindowsSigning(), checkWebView2Runtime());
-  }
-  const updateIssues = inspectUpdateConfiguration();
-  if (updateIssues.length > 0) {
-    reqs.push(...updateIssues);
-  }
-  return reqs;
-};
-var STATUS_GLYPH = {
-  ok: "done",
-  missing: "error",
-  unknown: "manual"
-};
-var printRequirements = (reqs) => {
-  const labelWidth = Math.max(0, ...reqs.map((r) => r.name.length)) + 2;
-  for (const r of reqs) {
-    console.log(
-      row({
-        glyph: STATUS_GLYPH[r.status],
-        label: r.name,
-        labelWidth,
-        detail: r.detail ? dim(r.detail) : void 0
-      })
-    );
-    if (r.status !== "ok" && r.fix) {
-      console.log(fixLine(r.fix));
-    }
-  }
-};
-var runDoctor = async () => {
-  console.log();
-  console.log(`  ${lime("vidra")} ${value("doctor")}`);
-  console.log();
-  console.log(footer(dim("checking your environment\u2026")));
-  console.log();
-  const reqs = collectRequirements();
-  printRequirements(reqs);
-  console.log();
-  const missing = reqs.filter((r) => r.status === "missing");
-  if (missing.length === 0) {
-    console.log(
-      footer(
-        `${dim("all checks passed \u2014 you're ready to run")} ${lime(
-          "npm run dev"
-        )}${dim(".")}`
-      )
-    );
-    console.log();
-    return 0;
-  }
-  const n = missing.length;
-  console.log(
-    footer(
-      `${dim(
-        `${n} issue${n === 1 ? "" : "s"} found. apply the ${n === 1 ? "fix" : "fixes"} above, then re-run`
-      )} ${lime("npm run doctor")}${dim(".")}`
-    )
-  );
-  console.log();
-  return 1;
-};
-var installWorkload = (csprojPath) => {
-  const args = csprojPath ? ["workload", "restore", csprojPath] : ["workload", "install", "maui"];
-  console.log();
-  console.log(
-    row({
-      glyph: "active",
-      detail: `${dim("running")} ${value(`${DOTNET} ${args.join(" ")}`)}`
-    })
-  );
-  console.log(
-    footer(
-      dim("this can download several hundred MB and take a few minutes.")
-    )
-  );
-  console.log();
-  try {
-    execFileSync7(DOTNET, args, { stdio: "inherit" });
-    return true;
-  } catch {
-    console.error();
-    console.error(row({ glyph: "error", label: "workload install failed" }));
-    console.error(
-      footer(
-        dim(
-          "if this is a permissions error, your SDK is in a system location and needs elevation:"
-        )
-      )
-    );
-    console.error(fixLine("sudo dotnet workload install maui"));
-    console.error();
-    return false;
-  }
-};
-var ensureMauiWorkload = async (opts = {}) => {
-  const dotnet = checkDotnetSdk();
-  if (dotnet.status === "missing") {
-    console.log();
-    console.log(
-      row({
-        glyph: "error",
-        label: dotnet.name,
-        detail: dotnet.detail ? dim(dotnet.detail) : void 0
-      })
-    );
-    if (dotnet.fix) {
-      console.log(fixLine(dotnet.fix));
-    }
-    return false;
-  }
-  if (dotnet.status === "unknown") return true;
-  if (isMauiWorkloadInstalled()) return true;
-  console.log();
-  console.log(
-    row({
-      glyph: "error",
-      label: ".NET MAUI workload",
-      detail: dim("required but not installed")
-    })
-  );
-  const interactive = opts.interactive ?? isInteractive();
-  if (interactive) {
-    let install = false;
-    try {
-      const res = await prompts({
-        type: "confirm",
-        name: "install",
-        message: "Install the .NET MAUI workload now?",
-        initial: true
-      });
-      install = Boolean(res.install);
-    } catch {
-      install = false;
-    }
-    if (install) {
-      if (installWorkload(opts.csprojPath) && isMauiWorkloadInstalled()) {
-        console.log(
-          row({
-            glyph: "done",
-            label: ".NET MAUI workload",
-            detail: dim("installed")
-          })
-        );
-        return true;
-      }
-      return false;
-    }
-  }
-  console.log(fixLine("dotnet workload install maui", "run:"));
-  console.log(fixLine(MAUI_DOCS, "docs:"));
-  return false;
-};
-var printWorkloadHint = () => {
-  console.error();
-  console.error(
-    row({ glyph: "manual", label: "this looks like a missing .NET MAUI workload." })
-  );
-  console.error(fixLine("dotnet workload install maui"));
-  console.error(fixLine("vidra doctor", "check:"));
-  console.error();
-};
-var printXcodeTooOldHint = () => {
-  console.error();
-  console.error(
-    row({
-      glyph: "manual",
-      label: "your Xcode is older than the SDK this MAUI workload set expects."
-    })
-  );
-  console.error(
-    `      ${dim("\u2022")} ${dim("update Xcode (App Store), then")} ${lime("sudo xcodebuild -runFirstLaunch")}`
-  );
-  console.error(
-    `      ${dim("\u2022")} ${dim("or pin the workloads to your Xcode's era:")} ${lime("dotnet workload update --version <set>")}`
-  );
-  console.error(fixLine("vidra doctor", "check:"));
-  console.error();
-};
-var printXcodeHint = () => {
-  console.error();
-  console.error(
-    row({
-      glyph: "manual",
-      label: "Mac Catalyst needs the full Xcode app, not just the Command Line Tools."
-    })
-  );
-  console.error(`      ${dim("1.")} ${value("install Xcode from the App Store")}`);
-  console.error(
-    `      ${dim("2.")} ${lime(
-      "sudo xcode-select -s /Applications/Xcode.app/Contents/Developer"
-    )}`
-  );
-  console.error(`      ${dim("3.")} ${lime("sudo xcodebuild -runFirstLaunch")}`);
-  console.error(fixLine("vidra doctor", "check:"));
-  console.error();
-};
-
-// src/commands/build.ts
-var TARGETS = {
-  macos: macosTarget,
-  windows: windowsTarget
-};
-var packageLabel = (target) => target.name === "macos" ? "package DMG" : "package ZIP";
-var artifactName = (project, target) => `${project.projectName}-${project.displayVersion}-${target.name}.${target.name === "macos" ? "dmg" : "zip"}`;
-var buildCommand = async (argv) => {
-  const args = parseArgs(["_", "_", ...argv]);
-  const verbose = !!args["verbose"];
-  const plan = !!args["plan"] || !!args["dry-run"];
-  const nativeUpdate = !!args["native-update"];
-  const targetName = args["target"] || detectPlatform();
-  const target = TARGETS[targetName];
-  if (!target) {
-    const supported = Object.keys(TARGETS).join(", ");
-    console.error();
-    console.error(
-      row({
-        glyph: "error",
-        detail: dim(`unsupported target: ${targetName} \u2014 supported: ${supported}`)
-      })
-    );
-    process.exit(1);
-  }
-  const project = detectProject(process.cwd());
-  console.log();
-  console.log(
-    header("build", `${target.name} \xB7 Release${plan ? " \xB7 plan" : ""}`)
-  );
-  console.log(kv("project", project.projectName));
-  console.log(kv("target", target.framework));
-  console.log();
-  const updateConfig = readUpdateConfig(project.root);
-  let nativeSettings = null;
-  if (nativeUpdate) {
-    try {
-      nativeSettings = resolveNativeUpdateSettings({
-        config: updateConfig?.native,
-        csprojPath: project.csprojPath,
-        projectName: project.projectName,
-        version: project.displayVersion
-      });
-    } catch (error) {
-      if (!(error instanceof NativeUpdateConfigError)) throw error;
-      console.error();
-      console.error(row({ glyph: "error", label: "native update", labelWidth: STEP_LABEL_WIDTH, detail: dim(error.message) }));
-      console.error();
-      process.exit(1);
-    }
-  }
-  if (plan) {
-    printBuildPlan(project, target, nativeSettings);
-    console.log();
-    console.log(
-      footer(`${dim("nothing has run. re-run without")} ${lime("--plan")} ${dim("to apply.")}`)
-    );
-    console.log();
-    return;
-  }
-  if (!await ensureMauiWorkload({ csprojPath: project.csprojPath })) {
-    process.exit(1);
-  }
-  stepBuildUi(project, verbose);
-  stepCopyAssets(project);
-  stepStampUpdateConfig(project, updateConfig);
-  const publishDir = stepDotnetPublish(project, target, verbose);
-  const bundlePath = target.findBundle(publishDir, project.projectName);
-  if (!bundlePath) {
-    console.error(
-      row({
-        glyph: "error",
-        detail: dim(`could not find build artifact in ${publishDir}`)
-      })
-    );
-    process.exit(1);
-  }
-  const io = { verbose, log: console.log, warn: console.warn };
-  const entitlements = target.name === "macos" ? entitlementsPath(project) : null;
-  if (target.name === "macos") {
-    signMacAppBundleIfPossible(bundlePath, {
-      ...io,
-      purpose: "distribution",
-      entitlements
-    });
-    reportMacVerification(bundlePath, entitlements);
-  }
-  let signedWindowsExe = null;
-  if (target.name === "windows") {
-    signedWindowsExe = findPrimaryExecutable(bundlePath, project.projectName);
-    if (signedWindowsExe && signWindowsBinariesIfPossible([signedWindowsExe], io)) {
-      const verified = verifyWindowsSignature(signedWindowsExe);
-      console.log(
-        row({
-          glyph: verified.ok ? "done" : "manual",
-          label: "verify sig",
-          labelWidth: STEP_LABEL_WIDTH,
-          detail: verified.untrustedRoot ? dim("signature intact; chain not trusted (expected for a self-signed certificate)") : verified.ok ? dim("authenticode signature verified and trusted") : dim("signature did not verify \u2014 see signtool output")
-        })
-      );
-    }
-  }
-  const packed = nativeSettings ? stepNativeUpdate(project, target, bundlePath, entitlements, nativeSettings, io) : null;
-  const outputPath = packed && target.name === "windows" ? stepPublishVelopackWindowsArtifacts(project, target, packed) : await stepPackage(
-    project,
-    target,
-    packed ? extractPackedApp(packed.outputs.portableZip) : bundlePath
-  );
-  if (target.name === "macos") {
-    signMacDmgIfPossible(outputPath, io);
-    const notarized = notarizeAndStaple(outputPath, io);
-    if (notarized.status === "skipped") {
-      console.log(
-        row({
-          glyph: "skip",
-          label: "notarize",
-          labelWidth: STEP_LABEL_WIDTH,
-          detail: dim(notarized.reason)
-        })
-      );
-    } else if (notarized.status === "failed") {
-      process.exit(1);
-    }
-    reportGatekeeper(outputPath);
-  }
-  console.log();
-  console.log(
-    footer(
-      `${dim("done \u2014")} ${value(path12.relative(project.root, outputPath))}`
-    )
-  );
-  console.log();
-};
-var entitlementsPath = (project) => {
-  const candidate = path12.join(project.hostDir, "Entitlements.plist");
-  return fs11.existsSync(candidate) ? candidate : null;
-};
-var reportMacVerification = (bundlePath, entitlements) => {
-  const verified = verifyMacSignature(bundlePath);
-  console.log(
-    row({
-      glyph: verified.ok ? "done" : "error",
-      label: "verify sig",
-      labelWidth: STEP_LABEL_WIDTH,
-      detail: verified.ok ? dim("codesign --verify --strict passed") : dim("codesign --verify --strict FAILED")
-    })
-  );
-  if (!verified.ok) console.error(dim(verified.output));
-  if (!entitlements) return;
-  const hardening = inspectMacHardening(bundlePath);
-  console.log(
-    row({
-      glyph: hardening.ok ? "done" : "error",
-      label: "hardening",
-      labelWidth: STEP_LABEL_WIDTH,
-      detail: hardening.ok ? dim("hardened runtime + JIT entitlements embedded") : dim(
-        !hardening.hardened ? "hardened runtime NOT enabled \u2014 this cannot be notarized" : `missing entitlements: ${hardening.missing.join(", ")} \u2014 the app will be killed at launch`
-      )
-    })
-  );
-  if (!hardening.ok) console.error(dim(hardening.output.trim()));
-};
-var reportGatekeeper = (artifactPath) => {
-  const assessment = assessGatekeeper(artifactPath);
-  if (assessment.ok) {
-    console.log(
-      row({
-        glyph: "done",
-        label: "gatekeeper",
-        labelWidth: STEP_LABEL_WIDTH,
-        detail: dim("spctl accepted \u2014 this will open on other Macs")
-      })
-    );
-    return;
-  }
-  const missing = !hasDeveloperIdIdentity() ? "needs a Developer ID Application certificate" : !resolveNotaryCredentials() ? "needs notarization (set VIDRA_NOTARY_PROFILE or VIDRA_APPLE_ID/VIDRA_TEAM_ID/VIDRA_APP_PASSWORD)" : "see the spctl output above";
-  console.log(
-    row({
-      glyph: "manual",
-      label: "gatekeeper",
-      labelWidth: STEP_LABEL_WIDTH,
-      detail: dim(`spctl rejected \u2014 ${missing}`)
-    })
-  );
-};
-var printBuildPlan = (project, target, nativeSettings) => {
-  console.log(
-    row({
-      glyph: "done",
-      label: "build UI",
-      labelWidth: STEP_LABEL_WIDTH,
-      detail: `${dim("vite \u2192")} ${value("ui/dist")}`
-    })
-  );
-  console.log(
-    row({
-      glyph: "done",
-      label: "copy assets",
-      labelWidth: STEP_LABEL_WIDTH,
-      detail: `${dim("\u2192")} ${value("Resources/Raw/wwwroot")}`
-    })
-  );
-  console.log(
-    row({
-      glyph: "done",
-      label: "publish .NET",
-      labelWidth: STEP_LABEL_WIDTH,
-      detail: `${dim("Release \xB7")} ${value(target.framework)}`
-    })
-  );
-  if (nativeSettings) {
-    const vpk = resolveVpk();
-    console.log(
-      row({
-        glyph: vpk ? "done" : "error",
-        label: "vpk pack",
-        labelWidth: STEP_LABEL_WIDTH,
-        detail: vpk ? `${value(`${nativeSettings.packId} ${nativeSettings.packVersion}`)} ${dim(`\u2192 ${RELEASE_DIR}`)}` : dim("vpk is not installed \u2014 dotnet tool install -g vpk")
-      })
-    );
-    console.log(
-      row({
-        glyph: nativeSettings.feedUrl ? "active" : "manual",
-        label: "merge feed",
-        labelWidth: STEP_LABEL_WIDTH,
-        detail: nativeSettings.feedUrl ? `${dim("vpk download \u2190")} ${value(nativeSettings.feedUrl)}` : dim("no vidra.updates.native.feedUrl \u2014 the release is packed, and no app will find it")
-      })
-    );
-  }
-  if (target.name === "macos") {
-    const developerId = hasDeveloperIdIdentity();
-    console.log(
-      row({
-        glyph: "done",
-        label: "codesign .app",
-        labelWidth: STEP_LABEL_WIDTH,
-        detail: dim(
-          developerId ? "Developer ID Application \xB7 hardened runtime" : "no Developer ID found \u2014 will fall back to development/ad-hoc"
-        )
-      })
-    );
-    console.log(
-      row({
-        glyph: "active",
-        label: "package DMG",
-        labelWidth: STEP_LABEL_WIDTH,
-        detail: `${dim("hdiutil UDZO \u2192")} ${value(artifactName(project, target))}`
-      })
-    );
-    console.log(
-      row({
-        glyph: developerId ? "done" : "skip",
-        label: "codesign dmg",
-        labelWidth: STEP_LABEL_WIDTH,
-        detail: dim(
-          developerId ? "sign the disk image" : "skipped without a Developer ID"
-        )
-      })
-    );
-    const creds = resolveNotaryCredentials();
-    console.log(
-      row({
-        glyph: creds ? "active" : "plan",
-        label: "notarize",
-        labelWidth: STEP_LABEL_WIDTH,
-        detail: creds ? dim("notarytool submit --wait, then staple") : `${planBadge()} ${dim("no credentials configured")}`
-      })
-    );
-    console.log(
-      row({
-        glyph: "active",
-        label: "gatekeeper",
-        labelWidth: STEP_LABEL_WIDTH,
-        detail: dim("spctl --assess")
-      })
-    );
-  } else {
-    const winCert = resolveWindowsSigningConfig();
-    console.log(
-      row({
-        glyph: winCert ? "done" : "skip",
-        label: "authenticode",
-        labelWidth: STEP_LABEL_WIDTH,
-        detail: dim(
-          winCert ? `sign the .exe (${winCert.mode})` : "no certificate configured \u2014 will ship unsigned"
-        )
-      })
-    );
-    console.log(
-      row({
-        glyph: "active",
-        label: "package ZIP",
-        labelWidth: STEP_LABEL_WIDTH,
-        detail: nativeSettings ? `${dim("vpk's portable zip \u2192")} ${value(artifactName(project, target))}` : `${dim("self-contained \u2192")} ${value(artifactName(project, target))}`
-      })
-    );
-    if (nativeSettings) {
-      console.log(
-        row({
-          glyph: "active",
-          label: "installer",
-          labelWidth: STEP_LABEL_WIDTH,
-          detail: `${dim("\u2192")} ${value(`${project.projectName}-${project.displayVersion}-Setup.exe`)}`
-        })
-      );
-    }
-  }
-};
-var stepBuildUi = (project, verbose) => {
-  const start = Date.now();
-  try {
-    execSync3("npm run build", {
-      cwd: project.uiDir,
-      stdio: verbose ? "inherit" : "pipe"
-    });
-  } catch (e) {
-    console.error(
-      row({
-        glyph: "error",
-        label: "build UI",
-        labelWidth: STEP_LABEL_WIDTH,
-        detail: dim("vite build failed")
-      })
-    );
-    console.error(dim(formatBuildError(e)));
-    process.exit(1);
-  }
-  const elapsed = ((Date.now() - start) / 1e3).toFixed(1);
-  console.log(
-    row({
-      glyph: "done",
-      label: "build UI",
-      labelWidth: STEP_LABEL_WIDTH,
-      detail: `${dim("vite \u2192")} ${value("ui/dist")} ${dim(`(${elapsed}s)`)}`
-    })
-  );
-};
-var stepCopyAssets = (project) => {
-  const viteDist = path12.join(project.uiDir, "dist");
-  if (!fs11.existsSync(viteDist)) {
-    console.error(
-      row({
-        glyph: "error",
-        label: "copy assets",
-        labelWidth: STEP_LABEL_WIDTH,
-        detail: dim("ui/dist not found \u2014 vite build may have failed")
-      })
-    );
-    process.exit(1);
-  }
-  const wwwroot = path12.join(project.hostDir, "Resources", "Raw", "wwwroot");
-  fs11.removeSync(wwwroot);
-  fs11.copySync(viteDist, wwwroot);
-  const fileCount = countFiles(wwwroot);
-  console.log(
-    row({
-      glyph: "done",
-      label: "copy assets",
-      labelWidth: STEP_LABEL_WIDTH,
-      detail: `${dim("\u2192")} ${value("Resources/Raw/wwwroot")} ${dim(`(${fileCount} files)`)}`
-    })
-  );
-};
-var stepStampUpdateConfig = (project, config) => {
-  stampUpdateConfig(project.hostDir, config);
-  if (!config) {
-    return;
-  }
-  console.log(
-    row({
-      glyph: "done",
-      label: "stamp updates",
-      labelWidth: STEP_LABEL_WIDTH,
-      detail: `${dim("\u2192")} ${value(`Resources/Raw/${UPDATE_CONFIG_FILE}`)} ${dim(
-        config.enabled === false ? "(disabled)" : `(${config.feedUrl ?? "no feed"})`
-      )}`
-    })
-  );
-};
-var countFiles = (dir) => {
-  let count = 0;
-  for (const entry of fs11.readdirSync(dir, { withFileTypes: true })) {
-    if (entry.isDirectory()) {
-      count += countFiles(path12.join(dir, entry.name));
-    } else {
-      count++;
-    }
-  }
-  return count;
-};
-var stepDotnetPublish = (project, target, verbose) => {
-  const start = Date.now();
-  const extraArgs = target.extraPublishArgs ?? "-p:CreatePackage=false";
-  const version = resolveAppVersion(project.root, project.csprojPath);
-  const versionArgs = versionPublishArgs(version).join(" ");
-  try {
-    execSync3(
-      `dotnet publish "${project.csprojPath}" -c Release -f ${target.framework} ${extraArgs} ${versionArgs}`,
-      {
-        cwd: project.root,
-        stdio: verbose ? "inherit" : "pipe"
-      }
-    );
-  } catch (e) {
-    const output = formatBuildError(e);
-    console.error(
-      row({
-        glyph: "error",
-        label: "publish .NET",
-        labelWidth: STEP_LABEL_WIDTH,
-        detail: dim("dotnet publish failed")
-      })
-    );
-    console.error(dim(output));
-    if (looksLikeMissingWorkload(output)) printWorkloadHint();
-    else if (looksLikeMissingXcode(output)) printXcodeHint();
-    if (!verbose) {
-      console.error(footer(dim("re-run with --verbose for the full build log.")));
-    }
-    process.exit(1);
-  }
-  const elapsed = ((Date.now() - start) / 1e3).toFixed(1);
-  console.log(
-    row({
-      glyph: "done",
-      label: "publish .NET",
-      labelWidth: STEP_LABEL_WIDTH,
-      detail: `${dim("Release \xB7")} ${value(target.framework)} ${dim(`(${elapsed}s)`)}`
-    })
-  );
-  return path12.join(project.hostDir, "bin", "Release", target.framework);
-};
-var stepNativeUpdate = (project, target, packDir, entitlements, settings, io) => {
-  const start = Date.now();
-  let outcome;
-  try {
-    outcome = runNativeUpdate({
-      projectRoot: project.root,
-      settings,
-      packDir,
-      target: target.name,
-      entitlements,
-      io
-    });
-  } catch (error) {
-    if (!(error instanceof NativeUpdateError)) throw error;
-    console.error(
-      row({
-        glyph: "error",
-        label: "native update",
-        labelWidth: STEP_LABEL_WIDTH,
-        detail: dim(error.message)
-      })
-    );
-    if (error.detail) console.error(footer(dim(error.detail)));
-    process.exit(1);
-  }
-  if (outcome.merged === "no-feed") {
-    console.log(
-      row({
-        glyph: "manual",
-        label: "merge feed",
-        labelWidth: STEP_LABEL_WIDTH,
-        detail: dim("no vidra.updates.native.feedUrl: this release is packed but the app will never check for it")
-      })
-    );
-  } else if (outcome.merged === "empty-feed") {
-    console.log(
-      row({
-        glyph: "manual",
-        label: "merge feed",
-        labelWidth: STEP_LABEL_WIDTH,
-        detail: dim("nothing downloaded: first release, or the feed is unreachable (see the warning above)")
-      })
-    );
-  } else {
-    console.log(
-      row({
-        glyph: "done",
-        label: "merge feed",
-        labelWidth: STEP_LABEL_WIDTH,
-        detail: `${dim("vpk download \u2192")} ${value(RELEASE_DIR)}`
-      })
-    );
-  }
-  const elapsed = ((Date.now() - start) / 1e3).toFixed(1);
-  console.log(
-    row({
-      glyph: "done",
-      label: "vpk pack",
-      labelWidth: STEP_LABEL_WIDTH,
-      detail: `${value(`${settings.packId} ${settings.packVersion}`)} ${dim(
-        `\u2192 ${RELEASE_DIR} (${elapsed}s)`
-      )}`
-    })
-  );
-  if (!outcome.outputs.portableZip) {
-    console.error(
-      row({
-        glyph: "error",
-        label: "vpk pack",
-        labelWidth: STEP_LABEL_WIDTH,
-        detail: dim(`vpk wrote no portable archive to ${RELEASE_DIR}`)
-      })
-    );
-    process.exit(1);
-  }
-  return outcome;
-};
-var stepPublishVelopackWindowsArtifacts = (project, target, packed) => {
-  const outputDir = path12.join(project.root, "dist");
-  fs11.ensureDirSync(outputDir);
-  const zipPath = path12.join(outputDir, artifactName(project, target));
-  fs11.copySync(packed.outputs.portableZip, zipPath, { overwrite: true });
-  console.log(
-    row({
-      glyph: "done",
-      label: packageLabel(target),
-      labelWidth: STEP_LABEL_WIDTH,
-      detail: `${value(path12.basename(zipPath))} ${dim(
-        `(${(fs11.statSync(zipPath).size / (1024 * 1024)).toFixed(1)} MB, from vpk)`
-      )}`
-    })
-  );
-  if (packed.outputs.setupExe) {
-    const setupName = `${project.projectName}-${project.displayVersion}-Setup.exe`;
-    const setupPath = path12.join(outputDir, setupName);
-    fs11.copySync(packed.outputs.setupExe, setupPath, { overwrite: true });
-    console.log(
-      row({
-        glyph: "done",
-        label: "installer",
-        labelWidth: STEP_LABEL_WIDTH,
-        detail: `${value(setupName)} ${dim("the recommended download; updates apply in place")}`
-      })
-    );
-  }
-  return zipPath;
-};
-var stepPackage = async (project, target, bundlePath) => {
-  const outputDir = path12.join(project.root, "dist");
-  fs11.ensureDirSync(outputDir);
-  const start = Date.now();
-  let outputPath;
-  try {
-    outputPath = await target.package(bundlePath, outputDir, {
-      projectName: project.projectName,
-      displayVersion: project.displayVersion
-    });
-  } catch (e) {
-    console.error(
-      row({
-        glyph: "error",
-        label: packageLabel(target),
-        labelWidth: STEP_LABEL_WIDTH,
-        detail: dim("packaging failed")
-      })
-    );
-    console.error(dim(formatProcessError(e)));
-    process.exit(1);
-  }
-  const pkgTime = ((Date.now() - start) / 1e3).toFixed(1);
-  const sizeMB = (fs11.statSync(outputPath).size / (1024 * 1024)).toFixed(1);
-  console.log(
-    row({
-      glyph: "done",
-      label: packageLabel(target),
-      labelWidth: STEP_LABEL_WIDTH,
-      detail: `${value(path12.basename(outputPath))} ${dim(`(${sizeMB} MB, ${pkgTime}s)`)}`
-    })
-  );
-  return outputPath;
-};
-
-// src/commands/bundle.ts
-import path15 from "path";
-import crypto2 from "crypto";
-import fs14 from "fs-extra";
-import { execSync as execSync4 } from "child_process";
-
-// src/zip.ts
-import fs12 from "fs";
-import path13 from "path";
-import zlib from "zlib";
-var LOCAL_HEADER = 67324752;
-var CENTRAL_HEADER = 33639248;
-var END_OF_CENTRAL_DIRECTORY = 101010256;
-var DEFLATE = 8;
-var DOS_DATE = 33;
-var DOS_TIME = 0;
-var crcTable = (() => {
-  const table = new Uint32Array(256);
-  for (let i = 0; i < 256; i++) {
-    let c = i;
-    for (let bit = 0; bit < 8; bit++) {
-      c = c & 1 ? 3988292384 ^ c >>> 1 : c >>> 1;
-    }
-    table[i] = c >>> 0;
-  }
-  return table;
-})();
-var crc32 = (data) => {
-  let c = 4294967295;
-  for (const byte of data) {
-    c = crcTable[(c ^ byte) & 255] ^ c >>> 8;
-  }
-  return (c ^ 4294967295) >>> 0;
-};
-var createZip = (entries) => {
-  const sorted = [...entries].sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
-  const locals = [];
-  const centrals = [];
-  let offset = 0;
-  for (const entry of sorted) {
-    const name = Buffer.from(entry.name.replace(/\\/g, "/"), "utf8");
-    const deflated = zlib.deflateRawSync(entry.content, { level: 9 });
-    const checksum = crc32(entry.content);
-    const local = Buffer.alloc(30);
-    local.writeUInt32LE(LOCAL_HEADER, 0);
-    local.writeUInt16LE(20, 4);
-    local.writeUInt16LE(0, 6);
-    local.writeUInt16LE(DEFLATE, 8);
-    local.writeUInt16LE(DOS_TIME, 10);
-    local.writeUInt16LE(DOS_DATE, 12);
-    local.writeUInt32LE(checksum, 14);
-    local.writeUInt32LE(deflated.length, 18);
-    local.writeUInt32LE(entry.content.length, 22);
-    local.writeUInt16LE(name.length, 26);
-    local.writeUInt16LE(0, 28);
-    locals.push(local, name, deflated);
-    const central = Buffer.alloc(46);
-    central.writeUInt32LE(CENTRAL_HEADER, 0);
-    central.writeUInt16LE(20, 4);
-    central.writeUInt16LE(20, 6);
-    central.writeUInt16LE(0, 8);
-    central.writeUInt16LE(DEFLATE, 10);
-    central.writeUInt16LE(DOS_TIME, 12);
-    central.writeUInt16LE(DOS_DATE, 14);
-    central.writeUInt32LE(checksum, 16);
-    central.writeUInt32LE(deflated.length, 20);
-    central.writeUInt32LE(entry.content.length, 24);
-    central.writeUInt16LE(name.length, 28);
-    central.writeUInt16LE(0, 30);
-    central.writeUInt16LE(0, 32);
-    central.writeUInt16LE(0, 34);
-    central.writeUInt16LE(0, 36);
-    central.writeUInt32LE(33188 << 16 >>> 0, 38);
-    central.writeUInt32LE(offset, 42);
-    centrals.push(central, name);
-    offset += local.length + name.length + deflated.length;
-  }
-  const centralDirectory = Buffer.concat(centrals);
-  const end = Buffer.alloc(22);
-  end.writeUInt32LE(END_OF_CENTRAL_DIRECTORY, 0);
-  end.writeUInt16LE(0, 4);
-  end.writeUInt16LE(0, 6);
-  end.writeUInt16LE(sorted.length, 8);
-  end.writeUInt16LE(sorted.length, 10);
-  end.writeUInt32LE(centralDirectory.length, 12);
-  end.writeUInt32LE(offset, 16);
-  end.writeUInt16LE(0, 20);
-  return Buffer.concat([...locals, centralDirectory, end]);
-};
-var readDirectoryEntries = (root) => {
-  const entries = [];
-  const walk = (dir, prefix) => {
-    for (const item of fs12.readdirSync(dir, { withFileTypes: true }).sort(
-      (a, b) => a.name < b.name ? -1 : 1
-    )) {
-      const full = path13.join(dir, item.name);
-      const name = prefix ? `${prefix}/${item.name}` : item.name;
-      if (item.isDirectory()) {
-        walk(full, name);
-      } else if (item.isFile()) {
-        entries.push({ name, content: fs12.readFileSync(full) });
-      }
-    }
-  };
-  walk(root, "");
-  return entries;
-};
-
-// src/manifest-signing.ts
-import crypto from "crypto";
-import fs13 from "fs";
-import path14 from "path";
-var SIGNATURE_ALGORITHM = "ecdsa-p256-sha256";
-var SIGNATURE_FILE = "bundles.json.sig";
-var generateKeyPair = () => {
-  const { privateKey, publicKey } = crypto.generateKeyPairSync("ec", {
-    namedCurve: "prime256v1"
-  });
-  const spki = publicKey.export({ format: "der", type: "spki" });
-  return {
-    privateKeyPem: privateKey.export({ format: "pem", type: "pkcs8" }).toString(),
-    publicKey: spki.toString("base64"),
-    keyId: keyIdOf(spki)
-  };
-};
-var keyIdOf = (spki) => crypto.createHash("sha256").update(spki).digest("hex").slice(0, 8);
-var publicKeyFor = (privateKeyPem) => {
-  const privateKey = crypto.createPrivateKey(privateKeyPem);
-  const spki = crypto.createPublicKey(privateKey).export({
-    format: "der",
-    type: "spki"
-  });
-  return { publicKey: spki.toString("base64"), keyId: keyIdOf(spki) };
-};
-var signManifest = (manifestBytes, privateKeyPem) => {
-  const privateKey = crypto.createPrivateKey(privateKeyPem);
-  if (privateKey.asymmetricKeyType !== "ec") {
-    throw new Error(
-      `the signing key is ${privateKey.asymmetricKeyType ?? "of an unknown type"}; vidra signs with an ECDSA P-256 key \u2014 make one with \`vidra keygen\``
-    );
-  }
-  const curve = privateKey.asymmetricKeyDetails?.namedCurve;
-  if (curve && curve !== "prime256v1") {
-    throw new Error(`the signing key uses curve ${curve}; vidra signs with P-256 (prime256v1)`);
-  }
-  const signature = crypto.sign("sha256", manifestBytes, privateKey);
-  const { keyId } = publicKeyFor(privateKeyPem);
-  return {
-    algorithm: SIGNATURE_ALGORITHM,
-    keyId,
-    signature: signature.toString("base64")
-  };
-};
-var verifyManifest = (manifestBytes, document, publicKeyBase64) => {
-  if (document.algorithm !== SIGNATURE_ALGORITHM) return false;
-  try {
-    const publicKey = crypto.createPublicKey({
-      key: Buffer.from(publicKeyBase64, "base64"),
-      format: "der",
-      type: "spki"
-    });
-    return crypto.verify(
-      "sha256",
-      manifestBytes,
-      publicKey,
-      Buffer.from(document.signature, "base64")
-    );
-  } catch {
-    return false;
-  }
-};
-var resolveSigningKey = (keyPath) => {
-  if (keyPath) {
-    if (!fs13.existsSync(keyPath)) {
-      throw new Error(`no signing key at ${keyPath}`);
-    }
-    return fs13.readFileSync(keyPath, "utf8");
-  }
-  const fromEnvironment = process.env.VIDRA_UPDATE_SIGNING_KEY;
-  if (fromEnvironment && fromEnvironment.includes("PRIVATE KEY")) {
-    return fromEnvironment;
-  }
-  return null;
-};
-var writeSignature = (outDir, document) => {
-  const target = path14.join(outDir, SIGNATURE_FILE);
-  fs13.writeFileSync(target, `${JSON.stringify(document, null, 2)}
-`);
-  return target;
-};
-
-// src/commands/bundle.ts
-var SCHEMA = 1;
-var parseBundleOptions = (argv) => {
-  const args = parseArgs(["_", "_", ...argv]);
-  return {
-    out: typeof args.out === "string" ? args.out : "dist",
-    channel: typeof args.channel === "string" ? args.channel : void 0,
-    skipBuild: !!args["skip-build"],
-    sign: typeof args.sign === "string" ? args.sign : void 0,
-    mergeFrom: typeof args["merge-from"] === "string" ? args["merge-from"] : void 0
-  };
-};
-var bundleCommand = async (argv) => {
-  const options = parseBundleOptions(argv);
-  const project = detectProject(process.cwd());
-  const outDir = path15.resolve(project.root, options.out);
-  const channel = options.channel;
-  console.log(header("bundle", `${project.projectName} ${project.displayVersion}`));
-  if (!options.skipBuild) {
-    stepBuildUi2(project);
-  }
-  const dist = path15.join(project.uiDir, "dist");
-  if (!fs14.existsSync(path15.join(dist, "index.html"))) {
-    console.error(
-      row({
-        glyph: "error",
-        label: "read ui/dist",
-        labelWidth: STEP_LABEL_WIDTH,
-        detail: dim("no index.html \u2014 run the UI build first, or drop --skip-build")
-      })
-    );
-    process.exit(1);
-  }
-  const fingerprints = readFingerprints(project);
-  const entries = readDirectoryEntries(dist);
-  const archive = createZip(entries);
-  const sha256 = crypto2.createHash("sha256").update(archive).digest("hex");
-  const name = `bundle-${project.displayVersion}-${sha256.slice(0, 8)}.zip`;
-  fs14.ensureDirSync(outDir);
-  fs14.writeFileSync(path15.join(outDir, name), archive);
-  console.log(
-    row({
-      glyph: "done",
-      label: "pack bundle",
-      labelWidth: STEP_LABEL_WIDTH,
-      detail: `${value(name)} ${dim(`(${entries.length} files, ${formatBytes(archive.length)})`)}`
-    })
-  );
-  const entry = {
-    version: project.displayVersion,
-    url: name,
-    sha256,
-    size: archive.length,
-    coreFingerprint: fingerprints.core,
-    appFingerprint: fingerprints.app,
-    ...channel ? { channel } : {}
-  };
-  const manifestPath = path15.join(outDir, "bundles.json");
-  const base = await loadBaseManifest(options, outDir, signingKeyFor(options));
-  const manifest = mergeManifest(base, entry);
-  const manifestBytes = Buffer.from(`${JSON.stringify(manifest, null, 2)}
-`);
-  fs14.writeFileSync(manifestPath, manifestBytes);
-  console.log(
-    row({
-      glyph: "done",
-      label: "write feed",
-      labelWidth: STEP_LABEL_WIDTH,
-      detail: `${value("bundles.json")} ${dim(`(${manifest.bundles.length} entries)`)}`
-    })
-  );
-  stepSignManifest(project, outDir, manifestBytes, options.sign);
-  console.log(
-    row({
-      glyph: "plan",
-      label: "compatible",
-      labelWidth: STEP_LABEL_WIDTH,
-      detail: `${dim("core")} ${value(fingerprints.core.slice(0, 12))} ${dim("app")} ${value(fingerprints.app.slice(0, 12))}`
-    })
-  );
-  console.log(
-    footer(
-      dim(
-        `upload ${value(path15.relative(project.root, outDir) || "dist")}/ to your feed host \u2014 every file, and bundles.json last`
-      )
-    )
-  );
-};
-var loadBaseManifest = async (options, outDir, privateKeyPem) => {
-  if (!options.mergeFrom) {
-    return readManifest(path15.join(outDir, "bundles.json"));
-  }
-  let fetched;
-  try {
-    fetched = await fetchFeed(options.mergeFrom);
-  } catch (error) {
-    return fail("merge feed", `could not read ${options.mergeFrom}: ${error.message}`);
-  }
-  if (!fetched) {
-    console.log(
-      row({
-        glyph: "plan",
-        label: "merge feed",
-        labelWidth: STEP_LABEL_WIDTH,
-        detail: dim(`no index at ${options.mergeFrom} yet \u2014 publishing the first one`)
-      })
-    );
-    return { schema: SCHEMA, bundles: [] };
-  }
-  if (privateKeyPem) {
-    const { publicKey } = publicKeyFor(privateKeyPem);
-    const ok = fetched.signature !== null && verifyManifest(Buffer.from(fetched.manifest), safeParse(fetched.signature), publicKey);
-    if (!ok) {
-      fail(
-        "merge feed",
-        `the index at ${options.mergeFrom} is not signed by your key \u2014 refusing to merge and re-sign it, which would publish someone else's entries under your signature`
-      );
-    }
-  }
-  const base = parseManifest(fetched.manifest);
-  console.log(
-    row({
-      glyph: "done",
-      label: "merge feed",
-      labelWidth: STEP_LABEL_WIDTH,
-      detail: `${value(options.mergeFrom)} ${dim(`(${base.bundles.length} existing entries)`)}`
-    })
-  );
-  return base;
-};
-var fetchFeed = async (source) => {
-  if (/^https?:\/\//i.test(source)) {
-    const response = await fetch(source);
-    if (response.status === 404) return null;
-    if (!response.ok) throw new Error(`HTTP ${response.status}`);
-    const manifest = await response.text();
-    const signatureResponse = await fetch(`${source}.sig`);
-    return {
-      manifest,
-      signature: signatureResponse.ok ? await signatureResponse.text() : null
-    };
-  }
-  const manifestPath = fs14.existsSync(source) && fs14.statSync(source).isDirectory() ? path15.join(source, "bundles.json") : source;
-  if (!fs14.existsSync(manifestPath)) return null;
-  const signaturePath = `${manifestPath}.sig`;
-  return {
-    manifest: fs14.readFileSync(manifestPath, "utf8"),
-    signature: fs14.existsSync(signaturePath) ? fs14.readFileSync(signaturePath, "utf8") : null
-  };
-};
-var safeParse = (text) => {
-  try {
-    return JSON.parse(text);
-  } catch {
-    return { algorithm: "", keyId: "", signature: "" };
-  }
-};
-var signingKeyFor = (options) => {
-  try {
-    return resolveSigningKey(options.sign);
-  } catch {
-    return null;
-  }
-};
-var stepSignManifest = (project, outDir, manifestBytes, keyPath) => {
-  const configuredKeys = readUpdateConfig(project.root)?.publicKeys ?? [];
-  let privateKeyPem = null;
-  try {
-    privateKeyPem = resolveSigningKey(keyPath);
-  } catch (error) {
-    fail("sign feed", error.message);
-  }
-  if (!privateKeyPem) {
-    if (configuredKeys.length > 0) {
-      fail(
-        "sign feed",
-        "this app trusts a signing key, so an unsigned feed would be refused by every installed copy \u2014 pass --sign <key.pem> or set VIDRA_UPDATE_SIGNING_KEY"
-      );
-    }
-    fs14.removeSync(path15.join(outDir, "bundles.json.sig"));
-    console.log(
-      row({
-        glyph: "manual",
-        label: "sign feed",
-        labelWidth: STEP_LABEL_WIDTH,
-        detail: amber(
-          "unsigned \u2014 anyone who can write to your feed host can run code in your app"
-        )
-      })
-    );
-    return;
-  }
-  let document;
-  let publicKey;
-  try {
-    document = signManifest(manifestBytes, privateKeyPem);
-    publicKey = publicKeyFor(privateKeyPem).publicKey;
-  } catch (error) {
-    return fail("sign feed", error.message);
-  }
-  writeSignature(outDir, document);
-  if (configuredKeys.length > 0 && !configuredKeys.includes(publicKey)) {
-    fail(
-      "sign feed",
-      `signed with key ${document.keyId}, which is not among the ${configuredKeys.length} key(s) in package.json \u2014 installed apps would reject this feed`
-    );
-  }
-  console.log(
-    row({
-      glyph: "done",
-      label: "sign feed",
-      labelWidth: STEP_LABEL_WIDTH,
-      detail: `${value("bundles.json.sig")} ${dim(`(key ${document.keyId})`)}`
-    })
-  );
-};
-var stepBuildUi2 = (project) => {
-  try {
-    execSync4("npm run build", { cwd: project.uiDir, stdio: "pipe" });
-  } catch {
-    console.error(
-      row({
-        glyph: "error",
-        label: "build UI",
-        labelWidth: STEP_LABEL_WIDTH,
-        detail: dim("vite build failed")
-      })
-    );
-    process.exit(1);
-  }
-  console.log(
-    row({
-      glyph: "done",
-      label: "build UI",
-      labelWidth: STEP_LABEL_WIDTH,
-      detail: `${dim("vite \u2192")} ${value("ui/dist")}`
-    })
-  );
-};
-var readFingerprints = (project) => {
-  const appManifest = path15.join(project.uiDir, "src", "generated", "manifest.json");
-  const app = readFingerprintFile(appManifest);
-  if (!app) {
-    fail(
-      "read fingerprints",
-      `no app contract fingerprint in ${path15.relative(project.root, appManifest)} \u2014 build the host once to generate it`
-    );
-  }
-  const sdkManifest = path15.join(
-    project.uiDir,
-    "node_modules",
-    "@vidra-dev",
-    "sdk",
-    "dist",
-    "manifest.json"
-  );
-  const core = readFingerprintFile(sdkManifest);
-  if (!core) {
-    fail(
-      "read fingerprints",
-      "no core contract fingerprint from @vidra-dev/sdk \u2014 run npm install in ui/, and make sure the SDK is 0.4.0 or newer"
-    );
-  }
-  return { core, app };
-};
-var readFingerprintFile = (file) => {
-  if (!fs14.existsSync(file)) return null;
-  try {
-    const parsed = fs14.readJsonSync(file);
-    return typeof parsed.fingerprint === "string" && parsed.fingerprint.length > 0 ? parsed.fingerprint : null;
-  } catch {
-    return null;
-  }
-};
-var readManifest = (file) => {
-  if (!fs14.existsSync(file)) return { schema: SCHEMA, bundles: [] };
-  return parseManifest(fs14.readFileSync(file, "utf8"));
-};
-var parseManifest = (text) => {
-  try {
-    const parsed = JSON.parse(text);
-    if (parsed.schema !== SCHEMA || !Array.isArray(parsed.bundles)) {
-      return { schema: SCHEMA, bundles: [] };
-    }
-    return { schema: SCHEMA, bundles: parsed.bundles };
-  } catch {
-    return { schema: SCHEMA, bundles: [] };
-  }
-};
-var mergeManifest = (manifest, entry) => {
-  const supersedes = (existing) => existing.version === entry.version && (existing.channel ?? null) === (entry.channel ?? null) && existing.coreFingerprint === entry.coreFingerprint && existing.appFingerprint === entry.appFingerprint;
-  return {
-    schema: SCHEMA,
-    bundles: [...manifest.bundles.filter((e) => !supersedes(e)), entry]
-  };
-};
-var formatBytes = (bytes) => bytes < 1024 * 1024 ? `${(bytes / 1024).toFixed(1)} KB` : `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
-var fail = (label, detail) => {
-  console.error(row({ glyph: "error", label, labelWidth: STEP_LABEL_WIDTH, detail: dim(detail) }));
-  process.exit(1);
-};
-
-// src/commands/keygen.ts
-import fs15 from "fs";
-import path16 from "path";
-var keygenCommand = async (argv) => {
-  const args = parseArgs(["_", "_", ...argv]);
-  const out = path16.resolve(
-    typeof args.out === "string" ? args.out : "vidra-signing-key.pem"
-  );
-  const force = !!args.force;
-  console.log(header("keygen", "update signing key"));
-  if (fs15.existsSync(out) && !force) {
-    console.error(
-      row({
-        glyph: "error",
-        label: "write key",
-        labelWidth: STEP_LABEL_WIDTH,
-        detail: dim(
-          `${path16.basename(out)} already exists \u2014 apps trusting it could not install updates signed by a new key. Pass --force only if you mean to replace it.`
-        )
-      })
-    );
-    process.exit(1);
-  }
-  const { privateKeyPem, publicKey, keyId } = generateKeyPair();
-  fs15.writeFileSync(out, privateKeyPem, { mode: 384 });
-  try {
-    fs15.chmodSync(out, 384);
-  } catch {
-  }
-  console.log(
-    row({
-      glyph: "done",
-      label: "private key",
-      labelWidth: STEP_LABEL_WIDTH,
-      detail: `${value(path16.relative(process.cwd(), out) || out)} ${dim(`(key ${keyId})`)}`
-    })
-  );
-  const publicKeyPath = `${out}.pub`;
-  fs15.writeFileSync(publicKeyPath, `${publicKey}
-`);
-  console.log(
-    row({
-      glyph: "done",
-      label: "public key",
-      labelWidth: STEP_LABEL_WIDTH,
-      detail: `${value(path16.relative(process.cwd(), publicKeyPath) || publicKeyPath)} ${dim("\u2014 add it to your app's package.json:")}`
-    })
-  );
-  console.log();
-  console.log(
-    value(
-      JSON.stringify({ vidra: { updates: { publicKeys: [publicKey] } } }, null, 2).split("\n").map((line) => `    ${line}`).join("\n")
-    )
-  );
-  console.log();
-  console.log(
-    row({
-      glyph: "manual",
-      label: "keep it safe",
-      labelWidth: STEP_LABEL_WIDTH,
-      detail: amber(
-        "this key is the authority to run code in every installed copy of your app"
-      )
-    })
-  );
-  console.log(
-    footer(
-      dim(
-        `never commit it \xB7 back it up \xB7 in CI pass it as ${value("VIDRA_UPDATE_SIGNING_KEY")} and sign with ${value("vidra bundle --sign")}`
-      )
-    )
-  );
-};
-
-// src/commands/verify.ts
-import path18 from "path";
-import fs17 from "fs-extra";
-
-// src/artifacts.ts
-import path17 from "path";
-import os5 from "os";
-import fs16 from "fs-extra";
-import { execFileSync as execFileSync8 } from "child_process";
-var findAppBundle2 = (dir) => {
-  if (!fs16.existsSync(dir)) return null;
-  for (const entry of fs16.readdirSync(dir, { withFileTypes: true })) {
-    if (entry.name.endsWith(".app") && entry.isDirectory()) {
-      return path17.join(dir, entry.name);
-    }
-  }
-  return null;
-};
-var findWindowsExecutable = (dir, projectName) => {
-  if (!fs16.existsSync(dir)) return null;
-  const exes = fs16.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isFile() && e.name.toLowerCase().endsWith(".exe")).map((e) => e.name);
-  const wanted = projectName?.toLowerCase();
-  const preferred = wanted && exes.find((n) => n.toLowerCase() === `${wanted}.host.exe`) || wanted && exes.find((n) => n.toLowerCase().startsWith(wanted)) || exes.find((n) => n.toLowerCase().endsWith(".host.exe")) || exes.find((n) => n.toLowerCase() !== "createdump.exe");
-  return preferred ? path17.join(dir, preferred) : null;
-};
-var findWindowsExecutableRecursive = (root, projectName) => {
-  const direct = findWindowsExecutable(root, projectName);
-  if (direct) return direct;
-  if (!fs16.existsSync(root)) return null;
-  for (const entry of fs16.readdirSync(root, { withFileTypes: true })) {
-    if (!entry.isDirectory()) continue;
-    const found = findWindowsExecutableRecursive(path17.join(root, entry.name), projectName);
-    if (found) return found;
-  }
-  return null;
-};
-var extractArchive = (zipPath) => {
-  const dir = fs16.mkdtempSync(path17.join(os5.tmpdir(), "vidra-zip-"));
-  try {
-    if (process.platform === "win32") {
-      execFileSync8(
-        "powershell",
-        [
-          "-NoProfile",
-          "-Command",
-          `Expand-Archive -Path "${zipPath}" -DestinationPath "${dir}" -Force`
-        ],
-        { stdio: "pipe" }
-      );
-    } else {
-      execFileSync8("unzip", ["-q", "-o", zipPath, "-d", dir], { stdio: "pipe" });
-    }
-  } catch (error) {
-    fs16.removeSync(dir);
-    throw error;
-  }
-  return { dir, release: () => fs16.removeSync(dir) };
-};
-var mountDiskImage = (dmgPath) => {
-  const mountPoint = fs16.mkdtempSync(path17.join(os5.tmpdir(), "vidra-dmg-mount-"));
-  execFileSync8(
-    "hdiutil",
-    ["attach", dmgPath, "-mountpoint", mountPoint, "-nobrowse", "-quiet"],
-    { stdio: "pipe" }
-  );
-  return {
-    mountPoint,
-    release: () => {
-      try {
-        execFileSync8("hdiutil", ["detach", mountPoint, "-quiet"], { stdio: "pipe" });
-      } catch {
-      }
-      fs16.removeSync(mountPoint);
-    }
-  };
-};
-
-// src/commands/verify.ts
-var verifyCommand = async (argv) => {
-  const args = parseArgs(["_", "_", ...argv]);
-  const explicit = args._[0];
-  const artifact = explicit ?? discoverArtifact();
-  if (!artifact) {
-    console.error();
-    console.error(
-      row({
-        glyph: "error",
-        detail: dim("no artifact given and none found in dist/ \u2014 pass a path")
-      })
-    );
-    process.exit(1);
-  }
-  if (!fs17.existsSync(artifact)) {
-    console.error();
-    console.error(row({ glyph: "error", detail: dim(`not found: ${artifact}`) }));
-    process.exit(1);
-  }
-  console.log();
-  console.log(header("verify", path18.basename(artifact)));
-  console.log(kv("artifact", artifact));
-  console.log();
-  const failures = artifactKind(artifact) === "macos" ? verifyMacArtifact(artifact) : verifyWindowsArtifact(artifact);
-  console.log();
-  if (failures.length > 0) {
-    console.log(
-      footer(dim(`${failures.length} check(s) failed: ${failures.join(", ")}`))
-    );
-    console.log();
-    process.exit(1);
-  }
-  console.log(footer(dim("all checks passed")));
-  console.log();
-};
-var artifactKind = (artifact) => {
-  if (artifact.endsWith(".dmg") || artifact.endsWith(".app")) return "macos";
-  return "windows";
-};
-var verifyMacArtifact = (artifact) => {
-  const failures = [];
-  let appBundle = artifact;
-  let mounted = null;
-  if (artifact.endsWith(".dmg")) {
-    const dmgSig = verifyMacSignature(artifact);
-    report(dmgSig.ok, "dmg signature", dmgSig.ok ? "signed" : "not signed", dmgSig.output);
-    if (!dmgSig.ok) failures.push("dmg signature");
-    const image = mountDiskImage(artifact);
-    mounted = image;
-    const inner = findAppBundle2(image.mountPoint);
-    if (!inner) {
-      image.release();
-      report(false, "app bundle", "no .app inside the disk image");
-      return [...failures, "app bundle"];
-    }
-    appBundle = inner;
-  }
-  try {
-    const sig = verifyMacSignature(appBundle);
-    report(sig.ok, "signature", sig.ok ? "codesign --verify --strict passed" : "FAILED", sig.output);
-    if (!sig.ok) failures.push("signature");
-    const hardening = inspectMacHardening(appBundle);
-    report(
-      hardening.hardened,
-      "hardened runtime",
-      hardening.hardened ? "enabled" : "NOT enabled \u2014 cannot be notarized"
-    );
-    if (!hardening.hardened) failures.push("hardened runtime");
-    const entitlementsOk = hardening.missing.length === 0;
-    report(
-      entitlementsOk,
-      "entitlements",
-      entitlementsOk ? `${REQUIRED_MAC_ENTITLEMENTS.length} required present` : `missing: ${hardening.missing.join(", ")} \u2014 the .NET JIT will be killed at launch`
-    );
-    if (!entitlementsOk) failures.push("entitlements");
-    const assessment = assessGatekeeper(artifact);
-    console.log(
-      row({
-        glyph: assessment.ok ? "done" : "manual",
-        label: "gatekeeper",
-        labelWidth: STEP_LABEL_WIDTH,
-        detail: dim(
-          assessment.ok ? "spctl accepted \u2014 this opens on other Macs" : "spctl rejected \u2014 needs Developer ID + notarization (expected otherwise)"
-        )
-      })
-    );
-  } finally {
-    mounted?.release();
-  }
-  return failures;
-};
-var verifyWindowsArtifact = (artifact) => {
-  const failures = [];
-  let extracted = null;
-  let searchRoot = artifact;
-  if (artifact.endsWith(".zip")) {
-    try {
-      const archive = extractArchive(artifact);
-      extracted = archive;
-      searchRoot = archive.dir;
-    } catch (error) {
-      report(false, "archive", `could not open ${path18.basename(artifact)}`, String(error));
-      return ["archive"];
-    }
-  }
-  try {
-    const exe = artifact.endsWith(".exe") ? artifact : findWindowsExecutableRecursive(searchRoot);
-    if (!exe) {
-      report(false, "executable", `no .exe found under ${artifact}`);
-      return ["executable"];
-    }
-    console.log(kv("executable", path18.basename(exe)));
-    const sig = verifyWindowsSignature(exe);
-    report(
-      sig.ok,
-      "authenticode",
-      sig.untrustedRoot ? "signed and intact; chain not trusted (expected for a self-signed certificate)" : sig.ok ? "signature verified and trusted" : "not signed or not verifiable",
-      sig.output
-    );
-    if (!sig.ok) failures.push("authenticode");
-  } finally {
-    extracted?.release();
-  }
-  return failures;
-};
-var report = (ok, label, detail, output) => {
-  console.log(
-    row({
-      glyph: ok ? "done" : "error",
-      label,
-      labelWidth: STEP_LABEL_WIDTH,
-      detail: dim(detail)
-    })
-  );
-  if (!ok && output) console.error(dim(output.trim()));
-};
-var discoverArtifact = () => {
-  const project = detectProject(process.cwd());
-  const dist = path18.join(project.root, "dist");
-  if (!fs17.existsSync(dist)) return null;
-  const wanted = detectPlatform() === "windows" ? ".zip" : ".dmg";
-  const candidates = fs17.readdirSync(dist).filter((f) => f.endsWith(wanted)).map((f) => path18.join(dist, f)).sort((a, b) => fs17.statSync(b).mtimeMs - fs17.statSync(a).mtimeMs);
-  return candidates[0] ?? null;
-};
-
-// src/commands/dev.ts
-import path19 from "path";
-import fs18 from "fs-extra";
-import { execFileSync as execFileSync9, spawn as spawn2 } from "child_process";
-import { request } from "http";
-
-// src/dev-port.ts
-import { createServer } from "net";
-import prompts2 from "prompts";
-var MIN_PORT = 1;
-var MAX_PORT = 65535;
-var isValidPort = (port) => Number.isInteger(port) && port >= MIN_PORT && port <= MAX_PORT;
-var isPortAvailable = (port, hostname) => new Promise((resolve, reject) => {
-  const server = createServer();
-  server.unref();
-  server.once("error", (error) => {
-    if (error.code === "EADDRINUSE" || error.code === "EACCES") {
-      resolve(false);
-      return;
-    }
-    reject(error);
-  });
-  server.listen({ host: hostname, port, exclusive: true }, () => {
-    server.close((error) => {
-      if (error) {
-        reject(error);
-        return;
-      }
-      resolve(true);
-    });
-  });
-});
-var findNextAvailablePort = async (occupiedPort, hostname, probe = isPortAvailable) => {
-  for (let port = occupiedPort + 1; port <= MAX_PORT; port++) {
-    if (await probe(port, hostname)) return port;
-  }
-  throw new Error(`No available port found after ${occupiedPort}`);
-};
-var defaultPrompt = async (question) => {
-  const result = await prompts2(question, { onCancel: () => false });
-  return { port: result.port };
-};
-var selectDevServerUrl = async (configuredUrl, options = {}) => {
-  const url = new URL(configuredUrl);
-  const port = Number(url.port);
-  if (!isValidPort(port)) {
-    throw new Error(`Dev server URL must include a valid port: ${configuredUrl}`);
-  }
-  const probe = options.isPortAvailable ?? isPortAvailable;
-  if (await probe(port, url.hostname)) return configuredUrl;
-  const interactive = options.interactive ?? isInteractive();
-  if (!interactive) {
-    throw new Error(
-      `Port ${port} is already in use and no interactive terminal is available`
-    );
-  }
-  const suggestedPort = await findNextAvailablePort(port, url.hostname, probe);
-  const prompt = options.prompt ?? defaultPrompt;
-  const result = await prompt({
-    type: "number",
-    name: "port",
-    message: `Port ${port} is already in use. Choose another port:`,
-    initial: suggestedPort,
-    validate: async (value3) => {
-      if (!isValidPort(value3)) {
-        return `Enter a port between ${MIN_PORT} and ${MAX_PORT}`;
-      }
-      return await probe(value3, url.hostname) || `Port ${value3} is already in use`;
-    }
-  });
-  const selectedPort = result.port;
-  if (selectedPort === void 0) {
-    throw new Error("Port selection cancelled");
-  }
-  if (!isValidPort(selectedPort) || !await probe(selectedPort, url.hostname)) {
-    throw new Error(`Port ${selectedPort} is not available`);
-  }
-  url.port = String(selectedPort);
-  return url.toString();
-};
-
-// src/commands/dev.ts
-var POLL_INTERVAL_MS = 500;
-var POLL_TIMEOUT_MS = 3e4;
-var NPM_COMMAND = process.platform === "win32" ? "npm.cmd" : "npm";
-var DOTNET_COMMAND = process.platform === "win32" ? "dotnet.exe" : "dotnet";
-var WATCH_OUTPUT_TAIL_CHARS = 8192;
-var HOST_TERMINATION_TIMEOUT_MS = 5e3;
-var TARGETS2 = {
-  macos: {
-    name: "macos",
-    framework: "net10.0-maccatalyst"
-  },
-  windows: {
-    name: "windows",
-    framework: "net10.0-windows10.0.19041.0"
-  }
-};
-var devCommand = (argv) => startSession(argv, { vite: true, hotReloadDefault: true });
-var runCommand = (argv) => startSession(argv, { vite: false, hotReloadDefault: false });
-var startSession = async (argv, opts) => {
-  const args = parseArgs(["_", "_", ...argv]);
-  const targetName = args["target"] || detectPlatform();
-  const verbose = !!args["verbose"];
-  const hotReload = opts.hotReloadDefault && !args["no-hot-reload"];
-  let viteUrl = process.env.VIDRA_DEV_URL || "http://localhost:5173";
-  const target = TARGETS2[targetName];
-  if (!target) {
-    const supported = Object.keys(TARGETS2).join(", ");
-    console.error(
-      row({
-        glyph: "error",
-        detail: dim(`unsupported target: ${targetName} \u2014 supported: ${supported}`)
-      })
-    );
-    process.exit(1);
-  }
-  ensureTargetMatchesHostOs(target.name);
-  const project = detectProject(process.cwd());
-  if (!await ensureMauiWorkload({ csprojPath: project.csprojPath })) {
-    process.exit(1);
-  }
-  if (opts.vite) {
-    viteUrl = await selectDevServerUrl(viteUrl);
-  }
-  const session = new DevSession(project, target, viteUrl, verbose, {
-    vite: opts.vite,
-    hotReload
-  });
-  await session.run();
-};
-var watchStrategyFor = (_targetName) => "delta";
-var DELTA_CHANNEL_DEAD_WARNING = "further changes won't be applied to this process";
-var buildDotnetWatchArgs = (opts) => [
-  "watch",
-  "--project",
-  opts.csprojPath,
-  // Never prompt on rude edits (our stdio is piped, so a prompt would hang);
-  // paired with DOTNET_WATCH_RESTART_ON_RUDE_EDIT for older SDKs.
-  "--non-interactive",
-  ...opts.verbose ? ["--verbose"] : [],
-  opts.strategy === "rebuild" ? "build" : "run",
-  "-f",
-  opts.framework,
-  "-c",
-  opts.buildConfig,
-  ...opts.strategy === "delta" && opts.framework.includes("maccatalyst") ? ["--property:RunWithOpen=false"] : []
-];
-var dotnetWatchEnv = (devUrl) => ({
-  VIDRA_DEV_URL: devUrl,
-  DOTNET_WATCH_RESTART_ON_RUDE_EDIT: "1",
-  DOTNET_WATCH_SUPPRESS_EMOJIS: "1",
-  DOTNET_WATCH_SUPPRESS_LAUNCH_BROWSER: "1",
-  // The session reads the loop's state out of watch and MSBuild output
-  // ("Build succeeded.", "Waiting for a file to change"), so the child must
-  // speak the language those patterns are written in. Without this a localized
-  // SDK silently breaks the dev loop for everyone whose machine isn't English.
-  DOTNET_CLI_UI_LANGUAGE: "en"
-});
-var buildViteArgs = (devUrl) => [
-  "run",
-  "dev",
-  "--",
-  "--port",
-  new URL(devUrl).port,
-  "--strictPort"
-];
-var HOST_READY_SENTINEL = "[vidra] host ready";
-var classifyWatchLine = (line) => {
-  if (line.toLowerCase().includes(DELTA_CHANNEL_DEAD_WARNING)) {
-    return "deltaChannelDead";
-  }
-  if (/waiting for a file to change/i.test(line)) return "appWaiting";
-  if (/fix the error to continue/i.test(line)) return "buildBlocked";
-  if (line.includes(HOST_READY_SENTINEL)) return "appStarted";
-  if (/^\s*build succeeded\b/i.test(line)) return "buildSucceeded";
-  if (/^\s*build failed\b/i.test(line)) return "buildFailed";
-  if (/\bwatch\b/i.test(line) && /\b(?:started|launched)\b/i.test(line)) {
-    return "appStarted";
-  }
-  return null;
-};
-var watchReaction = (event, ctx) => {
-  if (event === "appStarted") {
-    return ctx.hostLaunched ? "none" : "markHostReady";
-  }
-  if (event === "deltaChannelDead") {
-    return ctx.strategy === "delta" ? "switchToRebuild" : "none";
-  }
-  if (ctx.strategy === "rebuild") {
-    if (event === "buildSucceeded") return "launchHost";
-    if (event === "buildFailed") return "reportBuildFailed";
-    if (event === "appWaiting" || event === "buildBlocked") {
-      return ctx.everBuilt || ctx.buildOutcome !== null ? "none" : "reportEarlyExit";
-    }
-    return "none";
-  }
-  if (event === "appWaiting" || event === "buildBlocked") {
-    if (ctx.hostLaunched) return "reportAppIdle";
-    return ctx.buildOutcome === "failed" ? "reportBuildFailed" : "reportEarlyExit";
-  }
-  return "none";
-};
-var DevSession = class {
-  constructor(project, target, viteUrl, verbose, options) {
-    this.project = project;
-    this.target = target;
-    this.viteUrl = viteUrl;
-    this.verbose = verbose;
-    this.vite = options.vite;
-    this.hotReload = options.hotReload;
-    this.strategy = watchStrategyFor(target.name);
-  }
-  project;
-  target;
-  viteUrl;
-  verbose;
-  children = [];
-  buildConfig = process.env.VIDRA_BUILD_CONFIG || "Debug";
-  vite;
-  hotReload;
-  // Not readonly: a session that watches its delta channel die moves itself to
-  // the rebuild loop (see WatchStrategy).
-  strategy;
-  shuttingDown = false;
-  // Watch-mode state: `watchChild` is the `dotnet watch` process (a process
-  // group leader on unix, so shutdown can signal it and the app it launched
-  // together); `watchReady` flips once the app has started at least once.
-  watchChild;
-  watchReady = false;
-  watchOutputTail = "";
-  buildOutcome = null;
-  everBuilt = false;
-  // `"rebuild"` state: the app process we own, and a guard so that overlapping
-  // build cycles (save twice in a row) can't spawn two hosts at once.
-  hostChild;
-  relaunching = false;
-  relaunchPending = false;
-  fellBackToClassic = false;
-  endSession = () => {
-  };
-  sessionDone = new Promise((resolve) => {
-    this.endSession = resolve;
-  });
-  /** How C# edits reach the app, in words the user can trust. */
-  get csharpLoopLabel() {
-    return this.strategy === "rebuild" ? "C# rebuild + relaunch" : "C# hot reload active";
-  }
-  /**
-   * The banner word for the loop as a whole. UI edits always hot reload; the
-   * banner only stops saying so when the C# half of the loop cannot.
-   */
-  get loopHeadline() {
-    return this.hotReload && this.strategy === "rebuild" ? "reload on save active" : "hot reload active";
-  }
-  /** The same, phrased for the footer's "watching …" line. */
-  get csharpLoopSuffix() {
-    return this.strategy === "rebuild" ? "C# rebuild + relaunch on save" : "hot reload on save";
-  }
-  async run() {
-    this.installSignalHandlers();
-    console.log();
-    console.log(header(this.vite ? "dev" : "run", this.target.name));
-    console.log(kv("project", this.project.projectName));
-    console.log(kv("target", this.target.framework));
-    console.log();
-    if (this.vite) {
-      this.startVite();
-      try {
-        await waitForServer(this.viteUrl, POLL_TIMEOUT_MS);
-      } catch (error) {
-        console.error(row({ glyph: "error", detail: dim(error.message) }));
-        this.shutdown(1);
-      }
-      console.log(
-        taggedRow("active", "ui", `${dim("vite ready \u2014")} ${value(this.viteUrl)}`)
-      );
-    } else {
-      console.log(
-        taggedRow(
-          "skip",
-          "ui",
-          `${dim("vite not started \u2014")} ${value("npm run dev:ui")}`
-        )
-      );
-    }
-    this.launchHost();
-    const hostDirLabel = `src/${path19.basename(this.project.hostDir)}`;
-    if (this.vite) {
-      console.log(
-        taggedRow(
-          "active",
-          null,
-          this.hotReload ? `${lime(this.loopHeadline)} ${dim(`\u2014 edit ui/src or ${hostDirLabel} and save`)}` : `${lime(this.loopHeadline)} ${dim("\u2014 edit ui/src and save")}`
-        )
-      );
-      console.log();
-      console.log(
-        footer(
-          this.hotReload ? `${dim("watching")} ${value("ui/")} ${dim("\xB7")} ${value(`${hostDirLabel}/`)} ${dim(
-            `\xB7 ${this.csharpLoopSuffix} \xB7 ctrl-c to stop`
-          )}` : `${dim("watching")} ${value("ui/")} ${dim(
-            "\xB7 hot reload on save \xB7 ctrl-c to stop"
-          )}`
-        )
-      );
-    } else {
-      console.log();
-      console.log(
-        footer(dim("host only \xB7 serve the UI separately \xB7 ctrl-c to stop"))
-      );
-    }
-    console.log();
-    await this.sessionDone;
-  }
-  installSignalHandlers() {
-    process.on("SIGINT", () => {
-      console.log("\n" + footer(dim("shutting down\u2026")));
-      this.shutdown(0);
-    });
-    process.on("SIGTERM", () => {
-      this.shutdown(0);
-    });
-  }
-  startVite() {
-    console.log(taggedRow("active", "ui", dim("starting dev server\u2026")));
-    const vite = spawn2(NPM_COMMAND, buildViteArgs(this.viteUrl), {
-      cwd: this.project.uiDir,
-      stdio: ["ignore", "pipe", "pipe"],
-      shell: process.platform === "win32"
-    });
-    return this.registerChild(vite, "ui", "Vite dev server");
-  }
-  launchHost() {
-    if (this.hotReload) {
-      return this.launchHostWithWatch();
-    }
-    return this.target.name === "macos" ? this.launchMacosHost() : this.launchWindowsHost();
-  }
-  // --- dotnet watch launch (C# hot reload) -----------------------------------
-  launchHostWithWatch() {
-    console.log(
-      taggedRow(
-        "active",
-        "host",
-        `${dim("dotnet watch \u2014 building")} ${value(this.target.framework)} ${dim("\u2026")}`
-      )
-    );
-    const watch = spawn2(
-      DOTNET_COMMAND,
-      buildDotnetWatchArgs({
-        csprojPath: this.project.csprojPath,
-        framework: this.target.framework,
-        buildConfig: this.buildConfig,
-        verbose: this.verbose,
-        strategy: this.strategy
-      }),
-      {
-        cwd: this.project.root,
-        stdio: ["ignore", "pipe", "pipe"],
-        env: { ...process.env, ...dotnetWatchEnv(this.viteUrl) },
-        // Unix: make dotnet watch its own process-group leader so shutdown can
-        // SIGTERM the group — taking down both watch and the app it launched.
-        // Windows cleanup goes through `taskkill /T` instead.
-        detached: process.platform !== "win32"
-      }
-    );
-    this.watchChild = watch;
-    this.children.push(watch);
-    const notSentinel = (line) => !line.includes(HOST_READY_SENTINEL);
-    prefixStream(watch.stdout, "host", notSentinel);
-    prefixStream(watch.stderr, "host", notSentinel);
-    scanStream(watch.stdout, (line) => this.onWatchLine(line));
-    scanStream(watch.stderr, (line) => this.onWatchLine(line));
-    watch.on("exit", (code, signal) => {
-      if (this.shuttingDown) return;
-      if (this.watchChild !== watch) return;
-      if (this.watchReady) {
-        const failed = code !== null && code !== 0 || signal !== null;
-        if (failed) {
-          console.error(
-            "\n" + row({
-              glyph: "error",
-              detail: dim(
-                `dotnet watch exited with ${signal ? `signal ${signal}` : `code ${code}`}`
-              )
-            })
-          );
-        }
-        this.shutdown(code ?? (signal ? 1 : 0));
-        return;
-      }
-      this.fallBackToClassicLaunch(code, signal);
-    });
-    watch.on("error", (error) => {
-      if (this.shuttingDown) return;
-      console.error(
-        "\n" + row({
-          glyph: "error",
-          detail: dim(`failed to start dotnet watch: ${error.message}`)
-        })
-      );
-      this.shutdown(1);
-    });
-    return watch;
-  }
-  onWatchLine(line) {
-    this.watchOutputTail = (this.watchOutputTail + line + "\n").slice(
-      -WATCH_OUTPUT_TAIL_CHARS
-    );
-    const event = classifyWatchLine(line);
-    if (event === "buildSucceeded" || event === "buildFailed") {
-      this.buildOutcome = event === "buildSucceeded" ? "succeeded" : "failed";
-      this.everBuilt = true;
-    }
-    if (this.shuttingDown) return;
-    const reaction = watchReaction(event, {
-      strategy: this.strategy,
-      hostLaunched: this.watchReady,
-      buildOutcome: this.buildOutcome,
-      everBuilt: this.everBuilt
-    });
-    if (event === "appWaiting" || event === "buildBlocked") {
-      this.buildOutcome = null;
-    }
-    switch (reaction) {
-      case "markHostReady":
-        this.announceHostLaunched(line.includes(HOST_READY_SENTINEL));
-        return;
-      case "launchHost":
-        void this.launchOrRelaunchHost();
-        return;
-      case "switchToRebuild":
-        void this.switchToRebuildLoop();
-        return;
-      case "reportAppIdle":
-        console.log(
-          taggedRow(
-            "manual",
-            "host",
-            dim("app not running \u2014 save a C# file to relaunch, or ctrl-c to stop")
-          )
-        );
-        return;
-      case "reportEarlyExit":
-        console.log(
-          taggedRow(
-            "manual",
-            "host",
-            dim(
-              "app exited before it was ready \u2014 save a C# file to relaunch, or ctrl-c to stop"
-            )
-          )
-        );
-        return;
-      case "reportBuildFailed":
-        if (!this.watchReady) {
-          if (looksLikeMissingWorkload(this.watchOutputTail)) printWorkloadHint();
-          else if (looksLikeXcodeTooOld(this.watchOutputTail)) printXcodeTooOldHint();
-          else if (looksLikeMissingXcode(this.watchOutputTail)) printXcodeHint();
-        }
-        console.log(
-          taggedRow(
-            "manual",
-            "host",
-            dim("build failed \u2014 fix the error and save to retry, or ctrl-c to stop")
-          )
-        );
-        return;
-      case "none":
-        return;
-    }
-  }
-  /**
-   * A host we spawned ourselves reached VidraPage. Reported per launch, not
-   * per session: under the "rebuild" loop each save produces a new one, and
-   * "the app is back up" is the thing the developer is waiting to see.
-   */
-  onHostReady() {
-    if (this.shuttingDown) return;
-    this.watchReady = true;
-    const loop = this.hotReload ? ` ${dim(`\xB7 ${this.csharpLoopSuffix}`)}` : "";
-    console.log(
-      taggedRow(
-        "done",
-        "host",
-        `${dim("host ready \u2014")} ${value(this.project.projectName)}${loop}`
-      )
-    );
-  }
-  /**
-   * The app the watcher launched is up. Says "host ready" when the app told us
-   * so itself (the VidraPage sentinel) and "launched" when all we have is the
-   * watcher's own start message, which only means a process was spawned. Both
-   * paths through the session — this one and {@link onHostReady} — report
-   * readiness in the same words, so "the app is up" is one thing to look for
-   * rather than two.
-   */
-  announceHostLaunched(sawSentinel) {
-    if (this.watchReady) return;
-    this.watchReady = true;
-    const loop = dim(`\xB7 ${this.csharpLoopSuffix}`);
-    console.log(
-      taggedRow(
-        "done",
-        "host",
-        sawSentinel ? `${dim("host ready \u2014")} ${value(this.project.projectName)} ${loop}` : `${dim("launched")} ${value(this.project.projectName)} ${dim(`\u2014 ${this.csharpLoopLabel}`)}`
-      )
-    );
-  }
-  /**
-   * "rebuild" strategy: a build just succeeded, so replace the running app with
-   * the one that was built. Serialized, because a burst of saves produces a
-   * burst of successful builds and two hosts must never run at once — the
-   * last request wins.
-   */
-  async launchOrRelaunchHost() {
-    if (this.shuttingDown) return;
-    if (this.relaunching) {
-      this.relaunchPending = true;
-      return;
-    }
-    this.relaunching = true;
-    try {
-      do {
-        this.relaunchPending = false;
-        const previous = this.hostChild;
-        if (previous) {
-          this.hostChild = void 0;
-          console.log(taggedRow("active", "host", dim("relaunching\u2026")));
-          killChild(previous);
-          await waitForExit(previous, HOST_TERMINATION_TIMEOUT_MS);
-        }
-        if (this.shuttingDown) return;
-        this.hostChild = this.spawnMacosHost({ fatal: false }) ?? void 0;
-        if (this.hostChild) this.watchReady = true;
-      } while (this.relaunchPending && !this.shuttingDown);
-    } finally {
-      this.relaunching = false;
-    }
-  }
-  /**
-   * The hot reload agent is gone and `dotnet watch` has stopped trying to reach
-   * it. Every later edit would be applied to nothing while the watcher keeps
-   * reporting success, so the session stops asking for deltas and drives the
-   * loop itself: the watcher is restarted as `dotnet watch build`, and each
-   * successful build relaunches the app.
-   *
-   * Restarting the watcher also takes the app down with it (it leads the
-   * process group), which is what makes the first rebuild land on a clean
-   * process instead of one whose agent has already given up.
-   */
-  async switchToRebuildLoop() {
-    if (this.shuttingDown || this.strategy !== "delta") return;
-    this.strategy = "rebuild";
-    console.log();
-    console.log(
-      taggedRow(
-        "manual",
-        "host",
-        dim(
-          "the hot reload agent dropped out \u2014 dotnet watch would keep reporting edits as applied"
-        )
-      )
-    );
-    console.log(
-      taggedRow(
-        "active",
-        "host",
-        dim("switching this session to rebuild + relaunch on save\u2026")
-      )
-    );
-    console.log(
-      footer(
-        dim(
-          "a known Mac Catalyst flake (dotnet/sdk#55488) \u2014 restarting vidra dev often gets deltas back"
-        )
-      )
-    );
-    console.log();
-    const previous = this.watchChild;
-    this.watchChild = void 0;
-    if (previous) {
-      killChild(previous, { processGroup: true });
-      await waitForExit(previous, HOST_TERMINATION_TIMEOUT_MS);
-    }
-    if (this.shuttingDown) return;
-    this.buildOutcome = null;
-    this.everBuilt = false;
-    this.launchHostWithWatch();
-  }
-  /**
-   * `dotnet watch` exited before the app ever started — an incomplete SDK or
-   * MAUI workload install, usually. Explain why, then launch the host the
-   * classic way (one build + direct spawn) so the dev session still works,
-   * minus anything that reacts to a C# edit.
-   */
-  fallBackToClassicLaunch(code, signal) {
-    console.log();
-    console.log(
-      taggedRow(
-        "manual",
-        "host",
-        `${dim("the C# watch loop is unavailable \u2014 dotnet watch exited with")} ${value(
-          signal ? `signal ${signal}` : `code ${code ?? "unknown"}`
-        )}`
-      )
-    );
-    this.fellBackToClassic = true;
-    if (looksLikeMissingWorkload(this.watchOutputTail)) {
-      printWorkloadHint();
-    } else if (looksLikeXcodeTooOld(this.watchOutputTail)) {
-      printXcodeTooOldHint();
-    } else if (looksLikeMissingXcode(this.watchOutputTail)) {
-      printXcodeHint();
-    } else {
-      console.log(
-        footer(
-          dim("nothing in the output explains it \u2014 an incomplete toolchain is the usual cause:")
-        )
-      );
-      console.log(fixLine("dotnet workload update"));
-      if (!this.verbose) {
-        console.log(footer(dim("re-run with --verbose for the full watch log.")));
-      }
-    }
-    console.log(
-      taggedRow(
-        "active",
-        "host",
-        dim("falling back to a classic launch (frontend hot reload still active)\u2026")
-      )
-    );
-    console.log();
-    if (this.target.name === "macos") {
-      this.launchMacosHost();
-    } else {
-      this.launchWindowsHost();
-    }
-  }
-  // --- classic launch (one build + direct spawn) ------------------------------
-  // Builds the MAUI host as a discrete step (a plain `dotnet build`, never
-  // MSBuild's `-t:Run`) so the per-OS launch paths can spawn the produced
-  // binary directly. `-t:Run` shells out in ways that break for both locally
-  // signed mac apps and unpackaged Windows apps (see the call sites).
-  buildHostSync() {
-    console.log(
-      taggedRow(
-        "active",
-        "host",
-        `${dim("building")} ${value(this.target.framework)} ${dim("\u2026")}`
-      )
-    );
-    try {
-      execFileSync9(
-        DOTNET_COMMAND,
-        [
-          "build",
-          "-c",
-          this.buildConfig,
-          "-f",
-          this.target.framework,
-          this.project.csprojPath
-        ],
-        {
-          cwd: this.project.root,
-          stdio: this.verbose ? "inherit" : "pipe"
-        }
-      );
-    } catch (error) {
-      const output = formatBuildError(error);
-      console.error(taggedRow("error", "host", dim("MAUI build failed")));
-      console.error(dim(output));
-      if (looksLikeMissingWorkload(output)) printWorkloadHint();
-      else if (looksLikeMissingXcode(output)) printXcodeHint();
-      if (!this.verbose) {
-        console.error(footer(dim("re-run with --verbose for the full build log.")));
-      }
-      process.exit(1);
-    }
-  }
-  launchMacosHost() {
-    this.buildHostSync();
-    const host = this.spawnMacosHost({ fatal: true });
-    if (!host) process.exit(1);
-    return host;
-  }
-  /**
-   * Locate the built `.app`, sign it if we can, and spawn its executable.
-   *
-   * Split out from {@link launchMacosHost} because the watch loop reaches this
-   * point with the build already done — and, unlike a one-shot launch, must
-   * survive a bad outcome: under `"rebuild"` the session stays alive so the
-   * next save can put things right, hence `fatal: false` returning null rather
-   * than exiting the process.
-   */
-  spawnMacosHost(opts) {
-    const outputDir = path19.join(
-      this.project.hostDir,
-      "bin",
-      this.buildConfig,
-      this.target.framework
-    );
-    const fail2 = (detail) => {
-      console.error(row({ glyph: "error", detail: dim(detail) }));
-      if (opts.fatal) process.exit(1);
-      return null;
-    };
-    const appBundle = findMacAppBundle(
-      this.project.hostDir,
-      this.target.framework,
-      this.buildConfig
-    );
-    if (!appBundle) return fail2(`could not find .app bundle in ${outputDir}`);
-    signMacAppBundleIfPossible(appBundle, {
-      verbose: this.verbose,
-      log: console.log,
-      warn: console.warn
-    });
-    const binary = findMacExecutable(appBundle);
-    if (!binary) {
-      return fail2(`could not find the app executable in ${appBundle}`);
-    }
-    console.log(
-      taggedRow("active", "host", `${dim("launching")} ${value(path19.basename(appBundle))}${dim("\u2026")}`)
-    );
-    const host = spawn2(binary, [], {
-      cwd: this.project.root,
-      stdio: ["ignore", "pipe", "pipe"],
-      env: { ...process.env, VIDRA_DEV_URL: this.viteUrl }
-    });
-    return this.registerChild(host, "host", path19.basename(binary));
-  }
-  // Build first, then spawn the produced .exe directly. A single
-  // `dotnet build -t:Run` on an unpackaged MAUI Windows app
-  // (`WindowsPackageType=None`) execs the binary before the WindowsAppSDK
-  // native assets are laid out beside it, so the app can't resolve its deps and
-  // dies with a bare `MSB3073 ... exited with code 3` (ERROR_PATH_NOT_FOUND —
-  // "The system cannot find the path specified"). Building as a discrete step
-  // and then launching the binary is the documented workaround.
-  // See dotnet/maui#13942 and dotnet/maui#5975.
-  launchWindowsHost() {
-    this.buildHostSync();
-    const exe = findWindowsExecutable2(
-      this.project.hostDir,
-      this.project.csprojPath,
-      this.target.framework,
-      this.buildConfig
-    );
-    if (!exe) {
-      console.error(
-        row({
-          glyph: "error",
-          detail: dim(
-            `could not find the host .exe under ${path19.join(this.project.hostDir, "bin", this.buildConfig, this.target.framework)}`
-          )
-        })
-      );
-      process.exit(1);
-    }
-    console.log(
-      taggedRow("active", "host", `${dim("launching")} ${value(path19.basename(exe))}${dim("\u2026")}`)
-    );
-    const host = spawn2(exe, [], {
-      cwd: path19.dirname(exe),
-      stdio: ["ignore", "pipe", "pipe"],
-      env: { ...process.env, VIDRA_DEV_URL: this.viteUrl }
-    });
-    return this.registerChild(host, "host", path19.basename(exe));
-  }
-  registerChild(child, tag2, label) {
-    this.children.push(child);
-    const include = tag2 === "host" ? (line) => !line.includes(HOST_READY_SENTINEL) : void 0;
-    prefixStream(child.stdout, tag2, include);
-    prefixStream(child.stderr, tag2, include);
-    if (tag2 === "host") {
-      const onLine = (line) => {
-        if (line.includes(HOST_READY_SENTINEL)) this.onHostReady();
-      };
-      scanStream(child.stdout, onLine);
-      scanStream(child.stderr, onLine);
-    }
-    child.on("exit", (code, signal) => {
-      this.forgetChild(child);
-      if (this.shuttingDown) return;
-      if (tag2 === "ui") {
-        const exitCode = code ?? 1;
-        console.error(
-          "\n" + row({ glyph: "error", detail: dim(`${label} exited with code ${exitCode}`) })
-        );
-        this.shutdown(exitCode);
-        return;
-      }
-      if (this.ownsHostProcess) {
-        if (child !== this.hostChild) return;
-        this.hostChild = void 0;
-        console.log(
-          taggedRow(
-            "manual",
-            "host",
-            dim("app not running \u2014 save a C# file to relaunch, or ctrl-c to stop")
-          )
-        );
-        return;
-      }
-      const failed = code !== null && code !== 0 || signal !== null;
-      if (failed) {
-        console.error(
-          "\n" + row({
-            glyph: "error",
-            detail: dim(
-              `${label} exited with ${signal ? `signal ${signal}` : `code ${code}`}`
-            )
-          })
-        );
-        if (tag2 === "host" && this.target.name === "macos") {
-          printMacLaunchHint();
-        }
-      }
-      this.shutdown(code ?? (signal ? 1 : 0));
-    });
-    child.on("error", (error) => {
-      if (this.shuttingDown) return;
-      console.error(
-        "\n" + row({ glyph: "error", detail: dim(`failed to start ${label}: ${error.message}`) })
-      );
-      if (tag2 === "host" && this.target.name === "macos") {
-        printMacLaunchHint();
-      }
-      this.shutdown(1);
-    });
-    return child;
-  }
-  /**
-   * True while the "rebuild" loop is driving the app rather than the watcher.
-   * Goes false once we fall back to a classic launch: there is no watcher left
-   * to relaunch anything, so a host exit ends the session as it always did.
-   */
-  get ownsHostProcess() {
-    return this.hotReload && this.strategy === "rebuild" && !this.fellBackToClassic;
-  }
-  /** Drop an exited child so a long session's relaunches don't accumulate. */
-  forgetChild(child) {
-    const index = this.children.indexOf(child);
-    if (index !== -1) this.children.splice(index, 1);
-  }
-  shutdown(exitCode) {
-    if (this.shuttingDown) return;
-    this.shuttingDown = true;
-    for (const child of [...this.children]) {
-      killChild(child, { processGroup: child === this.watchChild });
-    }
-    this.endSession();
-    process.exit(exitCode);
-  }
-};
-var ensureTargetMatchesHostOs = (targetName) => {
-  if (targetName === "macos" && process.platform !== "darwin") {
-    console.error(
-      row({ glyph: "error", detail: dim("the macOS target can only run on macOS") })
-    );
-    process.exit(1);
-  }
-  if (targetName === "windows" && process.platform !== "win32") {
-    console.error(
-      row({ glyph: "error", detail: dim("the Windows target can only run on Windows") })
-    );
-    process.exit(1);
-  }
-};
-var prefixStream = (stream, tag2, include = () => true) => {
-  if (!stream) return;
-  const prefix = streamPrefix(tag2);
-  stream.on("data", (chunk) => {
-    const lines = chunk.toString().split("\n");
-    for (const line of lines) {
-      if (line.length > 0 && include(line)) {
-        process.stdout.write(`${prefix} ${line}
-`);
-      }
-    }
-  });
-};
-var scanStream = (stream, onLine) => {
-  if (!stream) return;
-  let pending = "";
-  stream.on("data", (chunk) => {
-    pending += chunk.toString();
-    const lines = pending.split("\n");
-    pending = lines.pop() ?? "";
-    for (const line of lines) onLine(line);
-  });
-  stream.on("end", () => {
-    if (pending) onLine(pending);
-  });
-};
-var waitForServer = (url, timeoutMs) => {
-  const { hostname, port, pathname } = new URL(url);
-  const start = Date.now();
-  return new Promise((resolve, reject) => {
-    const poll = () => {
-      if (Date.now() - start > timeoutMs) {
-        reject(
-          new Error(`Timed out waiting for ${url} after ${timeoutMs}ms`)
-        );
-        return;
-      }
-      const req = request(
-        {
-          hostname,
-          port,
-          path: pathname,
-          method: "HEAD",
-          timeout: 1e3
-        },
-        () => resolve()
-      );
-      req.on("error", () => setTimeout(poll, POLL_INTERVAL_MS));
-      req.on("timeout", () => {
-        req.destroy();
-        setTimeout(poll, POLL_INTERVAL_MS);
-      });
-      req.end();
-    };
-    poll();
-  });
-};
-var findMacAppBundle = (hostDir, framework, buildConfig) => {
-  const outputDir = path19.join(hostDir, "bin", buildConfig, framework);
-  return findAppBundleRecursive(outputDir);
-};
-var findAppBundleRecursive = (dir) => {
-  if (!fs18.existsSync(dir)) return null;
-  for (const entry of fs18.readdirSync(dir, { withFileTypes: true })) {
-    const fullPath = path19.join(dir, entry.name);
-    if (entry.isDirectory() && entry.name.endsWith(".app")) {
-      return fullPath;
-    }
-    if (entry.isDirectory()) {
-      const nested = findAppBundleRecursive(fullPath);
-      if (nested) return nested;
-    }
-  }
-  return null;
-};
-var findMacExecutable = (appBundle) => {
-  const macOsDir = path19.join(appBundle, "Contents", "MacOS");
-  if (!fs18.existsSync(macOsDir)) return null;
-  for (const entry of fs18.readdirSync(macOsDir, { withFileTypes: true })) {
-    if (entry.isFile()) {
-      return path19.join(macOsDir, entry.name);
-    }
-  }
-  return null;
-};
-var findWindowsExecutable2 = (hostDir, csprojPath, framework, buildConfig) => {
-  const outputDir = path19.join(hostDir, "bin", buildConfig, framework);
-  if (!fs18.existsSync(outputDir)) return null;
-  const exeName = `${path19.basename(csprojPath, ".csproj")}.exe`.toLowerCase();
-  return findFileRecursive(outputDir, (name) => name.toLowerCase() === exeName) ?? findFileRecursive(
-    outputDir,
-    (name) => name.toLowerCase().endsWith(".host.exe")
-  ) ?? findFileRecursive(outputDir, (name) => name.toLowerCase().endsWith(".exe"));
-};
-var findFileRecursive = (dir, match) => {
-  if (!fs18.existsSync(dir)) return null;
-  const entries = fs18.readdirSync(dir, { withFileTypes: true });
-  for (const entry of entries) {
-    if (entry.isFile() && match(entry.name)) {
-      return path19.join(dir, entry.name);
-    }
-  }
-  for (const entry of entries) {
-    if (entry.isDirectory()) {
-      const found = findFileRecursive(path19.join(dir, entry.name), match);
-      if (found) return found;
-    }
-  }
-  return null;
-};
-var waitForExit = (child, timeoutMs) => new Promise((resolve) => {
-  if (child.exitCode !== null || child.signalCode !== null) {
-    resolve();
-    return;
-  }
-  const timer = setTimeout(() => {
-    child.kill("SIGKILL");
-    resolve();
-  }, timeoutMs);
-  child.once("exit", () => {
-    clearTimeout(timer);
-    resolve();
-  });
-});
-var killChild = (child, opts = {}) => {
-  if (!child.pid || child.exitCode !== null) return;
-  if (process.platform === "win32") {
-    try {
-      execFileSync9("taskkill", ["/PID", String(child.pid), "/T", "/F"], {
-        stdio: "ignore"
-      });
-    } catch {
-      child.kill();
-    }
-    return;
-  }
-  if (opts.processGroup) {
-    try {
-      process.kill(-child.pid, "SIGTERM");
-      return;
-    } catch {
-    }
-  }
-  child.kill("SIGTERM");
-};
-var printMacLaunchHint = () => {
-  console.error();
-  console.error(
-    row({ glyph: "manual", label: "the host built but the app couldn't launch." })
-  );
-  console.error(
-    footer(
-      dim(
-        "on macOS this is usually code signing / Gatekeeper for a locally built app:"
-      )
-    )
-  );
-  console.error(
-    `      ${dim("\u2022")} ${dim("install full Xcode, then run")} ${lime("vidra doctor")} ${dim("to verify")}`
-  );
-  console.error(
-    `      ${dim("\u2022")} ${dim("approve it once in Finder: right-click the")} ${value(".app")} ${dim("and choose")} ${value("Open")}`
-  );
-  console.error(
-    `      ${dim("\u2022")} ${dim("or provide a signing identity via")} ${value("VIDRA_MACOS_CODESIGN_KEY")}`
-  );
-  console.error();
-};
-
-// src/cli.ts
-var printHelp = () => {
-  const cmd = (name, desc) => `    ${value(name.padEnd(10))} ${dim(desc)}`;
-  const ex = (args, comment) => `    ${lime("vidra")} ${value(args.padEnd(22))} ${dim(`# ${comment}`)}`;
-  console.log(`
-  ${wordmark()} ${dim(`v${CLI_VERSION}`)}
-
-  ${dim("usage")}
-    ${lime("vidra")} ${dim("<command> [options]")}
-
-  ${dim("commands")}
-${cmd("dev", "start vite + the native host (UI + C# reload on save)")}
-${cmd("run", "launch the native host only")}
-${cmd("build", "build & package for distribution")}
-${cmd("bundle", "pack ui/dist as an OTA bundle + update its feed")}
-${cmd("keygen", "create the key that signs your update feed")}
-${cmd("verify", "check a built artifact is actually shippable")}
-${cmd("doctor", "check your environment")}
-${cmd("help", "show this message")}
-
-  ${dim("examples")}
-${ex("dev --target windows", "run the windows host")}
-${ex("dev --no-hot-reload", "skip dotnet watch, classic launch")}
-${ex("build --plan", "preview the build, run nothing")}
-${ex("build --target macos", "build & package a macOS DMG")}
-${ex("bundle", "pack an OTA bundle into dist/")}
-${ex("bundle --channel beta", "publish it on the beta channel")}
-${ex("bundle --sign key.pem", "publish a signed feed")}
-${ex("bundle --merge-from URL", "add to the feed you already publish")}
-${ex("keygen", "create an update signing key")}
-${ex("verify", "check the newest artifact in dist/")}
-${ex("doctor", "verify .NET SDK + MAUI workload")}
-`);
-};
-var main = async () => {
-  const args = process.argv.slice(2);
-  const command = args[0];
-  switch (command) {
-    case "dev":
-      await devCommand(args.slice(1));
-      break;
-    case "run":
-      await runCommand(args.slice(1));
-      break;
-    case "build":
-      await buildCommand(args.slice(1));
-      break;
-    case "bundle":
-      await bundleCommand(args.slice(1));
-      break;
-    case "keygen":
-      await keygenCommand(args.slice(1));
-      break;
-    case "verify":
-      await verifyCommand(args.slice(1));
-      break;
-    case "doctor":
-      process.exit(await runDoctor());
-      break;
-    case "help":
-    case "--help":
-    case "-h":
-    case void 0:
-      printHelp();
-      break;
-    case "--version":
-    case "-v":
-      console.log(CLI_VERSION);
-      break;
-    default:
-      console.error(row({ glyph: "error", detail: dim(`unknown command: ${command}`) }));
-      printHelp();
-      process.exit(1);
-  }
-};
-main().catch((e) => {
-  console.error(row({ glyph: "error", detail: dim(e.message) }));
-  process.exit(1);
-});