glass-connect 0.3.0 → 1.0.0

package/README.md

@@ -7,8 +7,22 @@ Project, or share the computer with an organization.
 npx glass-connect@latest
 ```
 
-Enter the one-time code in **Glass → Settings → Computers**. The command installs a per-user
-background service on macOS, Windows, and Linux, including a private copy of its Node runtime. Use
-`glass-connect status`, `stop`, `start`, or `uninstall` to manage it.
+The command opens a host-bound Glass pairing link. If the link is opened in a different Glass
+environment, that environment cannot approve the challenge. You can select the preview backend
+explicitly:
+
+```sh
+npx glass-connect@latest --environment preview
+```
+
+The command installs a per-user background service on macOS, Windows, and Linux, including a
+private copy of its Node runtime. Use `glass-connect update` to replace that service with the exact
+version you installed. Use `glass-connect status`, `stop`, `start`, or `uninstall` to manage it.
+
+For a pinned update, use the exact published version:
+
+```sh
+npx glass-connect@1.0.0 update
+```
 
 Glass Connect requires Node.js 24.13.1 or newer for installation.

package/dist/cli.js

@@ -53,32 +53,32 @@ var __toESM = (mod2, isNodeMode, target) => (target = mod2 != null ? __create(__
 var pipeArguments, Prototype, Class;
 var init_Pipeable = __esm({
   "../../node_modules/.pnpm/effect@4.0.0-rc.108/node_modules/effect/dist/Pipeable.js"() {
-    pipeArguments = (self, args3) => {
-      switch (args3.length) {
+    pipeArguments = (self, args4) => {
+      switch (args4.length) {
         case 0:
           return self;
         case 1:
-          return args3[0](self);
+          return args4[0](self);
         case 2:
-          return args3[1](args3[0](self));
+          return args4[1](args4[0](self));
         case 3:
-          return args3[2](args3[1](args3[0](self)));
+          return args4[2](args4[1](args4[0](self)));
         case 4:
-          return args3[3](args3[2](args3[1](args3[0](self))));
+          return args4[3](args4[2](args4[1](args4[0](self))));
         case 5:
-          return args3[4](args3[3](args3[2](args3[1](args3[0](self)))));
+          return args4[4](args4[3](args4[2](args4[1](args4[0](self)))));
         case 6:
-          return args3[5](args3[4](args3[3](args3[2](args3[1](args3[0](self))))));
+          return args4[5](args4[4](args4[3](args4[2](args4[1](args4[0](self))))));
         case 7:
-          return args3[6](args3[5](args3[4](args3[3](args3[2](args3[1](args3[0](self)))))));
+          return args4[6](args4[5](args4[4](args4[3](args4[2](args4[1](args4[0](self)))))));
         case 8:
-          return args3[7](args3[6](args3[5](args3[4](args3[3](args3[2](args3[1](args3[0](self))))))));
+          return args4[7](args4[6](args4[5](args4[4](args4[3](args4[2](args4[1](args4[0](self))))))));
         case 9:
-          return args3[8](args3[7](args3[6](args3[5](args3[4](args3[3](args3[2](args3[1](args3[0](self)))))))));
+          return args4[8](args4[7](args4[6](args4[5](args4[4](args4[3](args4[2](args4[1](args4[0](self)))))))));
         default: {
           let ret = self;
-          for (let i = 0, len = args3.length; i < len; i++) {
-            ret = args3[i](ret);
+          for (let i = 0, len = args4.length; i < len; i++) {
+            ret = args4[i](ret);
           }
           return ret;
         }
@@ -99,8 +99,8 @@ var init_Pipeable = __esm({
 });
 
 // ../../node_modules/.pnpm/effect@4.0.0-rc.108/node_modules/effect/dist/Function.js
-function pipe(a, ...args3) {
-  return pipeArguments(a, args3);
+function pipe(a, ...args4) {
+  return pipeArguments(a, args4);
 }
 function memoize(f2) {
   const cache = /* @__PURE__ */ new WeakMap();
@@ -160,9 +160,9 @@ var init_Function = __esm({
             if (arguments.length >= arity) {
               return body.apply(this, arguments);
             }
-            const args3 = arguments;
+            const args4 = arguments;
             return function(self) {
-              return body(self, ...args3);
+              return body(self, ...args4);
             };
           };
       }
@@ -1104,7 +1104,7 @@ var init_core = __esm({
       }
     };
     causeDie = (defect) => new CauseImpl([new Die(defect)]);
-    causeAnnotate = /* @__PURE__ */ dual((args3) => isCause(args3[0]), (self, annotations, options) => {
+    causeAnnotate = /* @__PURE__ */ dual((args4) => isCause(args4[0]), (self, annotations, options) => {
       if (annotations.mapUnsafe.size === 0) return self;
       return new CauseImpl(self.reasons.map((f2) => f2.annotate(annotations, options)));
     });
@@ -1215,14 +1215,14 @@ var init_core = __esm({
     Error2 = /* @__PURE__ */ (function() {
       const plainArgsSymbol = /* @__PURE__ */ Symbol.for("effect/Data/Error/plainArgs");
       return class Base extends YieldableError {
-        constructor(args3) {
-          super(args3?.message, args3?.cause ? {
-            cause: args3.cause
+        constructor(args4) {
+          super(args4?.message, args4?.cause ? {
+            cause: args4.cause
           } : void 0);
-          if (args3) {
-            assignProperties(this, args3);
+          if (args4) {
+            assignProperties(this, args4);
             Object.defineProperty(this, plainArgsSymbol, {
-              value: args3,
+              value: args4,
               enumerable: false
             });
           }
@@ -2282,7 +2282,7 @@ var init_stackTraceLimit = __esm({
 });
 
 // ../../node_modules/.pnpm/effect@4.0.0-rc.108/node_modules/effect/dist/internal/effect.js
-var Interrupt, causeInterrupt, findFail, findError, hasInterrupts, hasInterruptsOnly, causeCombine, causeMap, causePartition, causeSquash, causePrettyErrors, causePrettyError, causePrettyMessage, locationRegExp, cleanErrorStack, addStackAnnotations, interruptCauseStack, currentStackTrace, causePretty, renderPrettyError, renderErrorCause, FiberTypeId, fiberVariance, fiberIdStore, getCurrentFiber, FiberImpl, deferredInterruptCont, fiberMiddleware, fiberStackAnnotations, fiberAwait, fiberAwaitAll, fiberInterrupt, fiberInterruptAs, fiberInterruptAll, succeed3, failCause, fail3, sync, suspend, fromResult, yieldNowWith, yieldNow, succeedNone, failCauseSync, die, failSync, void_, try_, promise, tryPromise, withFiberId, callbackOptions, asyncFinalizer, callback, never, gen, fnUntraced, defineFunctionLength, fnUntracedEager, fromIteratorEagerUnsafe, fromIteratorUnsafe, as, asSome, andThen, tap, asVoid, raceAllFirst, raceFirst, flatMap2, OnSuccessProto, effectIsExit, flatMapEager, map3, mapEager, mapErrorEager, exitInterrupt, exitIsSuccess, exitIsFailure, exitFilterCause, exitVoid, exitMap, exitMapError, exitZipRight, exitAsVoidAll, serviceOption, updateContext, context, getContext, contextWith, provideContext, provideService, provideServiceImpl, forever, catchCause, OnFailureProto, catchCauseFilter, catch_, tapCause, tapCauseFilter, tapError, catchIf, catchTag, mapError2, orDie, ignore, result, matchCauseEffect, OnSuccessAndFailureProto, matchEffect, match4, matchEager, exit, exitPrimitive, timeoutOrElse, timeout, ScopeTypeId, ScopeCloseableTypeId, scopeTag, scopeClose, scopeCloseUnsafe, scopeCloseFinalizers, scopeForkUnsafe, scopeAddFinalizerExit, scopeAddFinalizer, scopeAddFinalizerUnsafe, scopeRemoveFinalizerUnsafe, scopeMakeUnsafe, constScopeEmpty, scope, provideScope, scoped, scopedWith, acquireRelease, addFinalizer, onExitPrimitive, onExit, ensuring, onExitFilter, onError, interrupt, uninterruptible, setInterruptible, setInterruptibleTrue, setInterruptibleFalse, setFiberInterruptible, interruptible, uninterruptibleMask, all, whileLoop, forEach, forEachSequential, iterateEagerImpl, iterateEager, forEachConcurrent, forkUnsafe, forkDetach, forkIn, forkScoped, runForkWith, fiberRunIn, runFork, runPromiseExitWith, runPromiseWith, runSyncExitWith, runSyncExit, succeedTrue, succeedFalse, Latch, makeLatchUnsafe, ClockRef, MAX_TIMER_MILLIS, ClockImpl, nanosPerMilli, monotonicNowNanos, wallTimeNanos, clockWith, sleep, TimeoutErrorTypeId, TimeoutError, IllegalArgumentErrorTypeId, IllegalArgumentError, ExceededCapacityErrorTypeId, ExceededCapacityError, AsyncFiberErrorTypeId, AsyncFiberError, UnknownErrorTypeId, UnknownError, ConsoleRef, logLevelToOrder, LogLevelOrder, isLogLevelGreaterThan, CurrentLoggers, LogToStderr, LoggerTypeId, LoggerProto, loggerMake, formatLabel, formatLogSpan, logWithLevel, colors, logLevelColors, defaultDateFormat, defaultLogger, tracerLogger;
+var Interrupt, causeInterrupt, findFail, findError, hasInterrupts, hasInterruptsOnly, causeCombine, causeMap, causePartition, causeSquash, causePrettyErrors, causePrettyError, causePrettyMessage, locationRegExp, cleanErrorStack, addStackAnnotations, interruptCauseStack, currentStackTrace, causePretty, renderPrettyError, renderErrorCause, FiberTypeId, fiberVariance, fiberIdStore, getCurrentFiber, FiberImpl, deferredInterruptCont, fiberMiddleware, fiberStackAnnotations, fiberAwait, fiberAwaitAll, fiberInterrupt, fiberInterruptAs, fiberInterruptAll, succeed3, failCause, fail3, sync, suspend, fromResult, yieldNowWith, yieldNow, succeedNone, failCauseSync, die, failSync, void_, try_, tryPromise, withFiberId, callbackOptions, asyncFinalizer, callback, never, gen, fnUntraced, defineFunctionLength, fnUntracedEager, fromIteratorEagerUnsafe, fromIteratorUnsafe, as, asSome, andThen, tap, asVoid, raceAllFirst, raceFirst, flatMap2, OnSuccessProto, effectIsExit, flatMapEager, map3, mapEager, mapErrorEager, exitInterrupt, exitIsSuccess, exitIsFailure, exitFilterCause, exitVoid, exitMap, exitMapError, exitZipRight, exitAsVoidAll, serviceOption, updateContext, context, getContext, contextWith, provideContext, provideService, provideServiceImpl, forever, catchCause, OnFailureProto, catchCauseFilter, catch_, tapCause, tapCauseFilter, tapError, catchIf, catchTag, mapError2, orDie, ignore, result, matchCauseEffect, OnSuccessAndFailureProto, matchEffect, match4, matchEager, exit, exitPrimitive, timeoutOrElse, timeout, ScopeTypeId, ScopeCloseableTypeId, scopeTag, scopeClose, scopeCloseUnsafe, scopeCloseFinalizers, scopeForkUnsafe, scopeAddFinalizerExit, scopeAddFinalizer, scopeAddFinalizerUnsafe, scopeRemoveFinalizerUnsafe, scopeMakeUnsafe, constScopeEmpty, scope, provideScope, scoped, scopedWith, acquireRelease, addFinalizer, onExitPrimitive, onExit, ensuring, onExitFilter, onError, interrupt, uninterruptible, setInterruptible, setInterruptibleTrue, setInterruptibleFalse, setFiberInterruptible, interruptible, uninterruptibleMask, all, whileLoop, forEach, forEachSequential, iterateEagerImpl, iterateEager, forEachConcurrent, forkUnsafe, forkDetach, forkIn, forkScoped, runForkWith, fiberRunIn, runFork, runPromiseExitWith, runPromiseWith, runSyncExitWith, runSyncExit, succeedTrue, succeedFalse, Latch, makeLatchUnsafe, ClockRef, MAX_TIMER_MILLIS, ClockImpl, nanosPerMilli, monotonicNowNanos, wallTimeNanos, clockWith, sleep, currentTimeMillis, TimeoutErrorTypeId, TimeoutError, IllegalArgumentErrorTypeId, IllegalArgumentError, ExceededCapacityErrorTypeId, ExceededCapacityError, AsyncFiberErrorTypeId, AsyncFiberError, UnknownErrorTypeId, UnknownError, ConsoleRef, logLevelToOrder, LogLevelOrder, isLogLevelGreaterThan, CurrentLoggers, LogToStderr, LoggerTypeId, LoggerProto, loggerMake, formatLabel, formatLogSpan, logWithLevel, colors, logLevelColors, defaultDateFormat, defaultLogger, tracerLogger;
 var init_effect = __esm({
   "../../node_modules/.pnpm/effect@4.0.0-rc.108/node_modules/effect/dist/internal/effect.js"() {
     init_Array();
@@ -2790,7 +2790,7 @@ ${prefix3}}`;
       return sync(() => cancel?.());
     });
     fiberInterrupt = (self) => withFiber((fiber2) => fiberInterruptAs(self, fiber2.id));
-    fiberInterruptAs = /* @__PURE__ */ dual((args3) => hasProperty(args3[0], FiberTypeId), (self, fiberId2, annotations) => withFiber((parent) => {
+    fiberInterruptAs = /* @__PURE__ */ dual((args4) => hasProperty(args4[0], FiberTypeId), (self, fiberId2, annotations) => withFiber((parent) => {
       let ann = fiberStackAnnotations(parent);
       ann = ann && annotations ? merge(ann, annotations) : ann ?? annotations;
       self.interruptUnsafe(fiberId2, ann);
@@ -2856,9 +2856,6 @@ ${prefix3}}`;
         }
       });
     };
-    promise = (evaluate2) => callbackOptions(function(resume, signal) {
-      internalCall(() => evaluate2(signal)).then((a) => resume(succeed3(a)), (e) => resume(die(e)));
-    }, evaluate2.length !== 0);
     tryPromise = (options) => {
       const f2 = typeof options === "function" ? options : options.try;
       const catcher = typeof options === "function" ? (cause) => new UnknownError(cause, "An error occurred in Effect.tryPromise") : options.catch;
@@ -2925,7 +2922,7 @@ ${prefix3}}`;
     });
     callback = (register) => callbackOptions(register, register.length >= 2);
     never = /* @__PURE__ */ callback(constVoid);
-    gen = (...args3) => suspend(() => fromIteratorUnsafe(args3.length === 1 ? args3[0]() : args3[1].call(args3[0].self)));
+    gen = (...args4) => suspend(() => fromIteratorUnsafe(args4.length === 1 ? args4[0]() : args4[1].call(args4[0].self)));
     fnUntraced = (body, ...pipeables) => {
       const fn2 = pipeables.length === 0 ? function() {
         return suspend(() => fromIteratorUnsafe(body.apply(this, arguments)));
@@ -3039,7 +3036,7 @@ ${prefix3}}`;
       }
       return fiberInterruptAll(fibers);
     }));
-    raceFirst = /* @__PURE__ */ dual((args3) => isEffect(args3[1]), (self, that, options) => raceAllFirst([self, that], options));
+    raceFirst = /* @__PURE__ */ dual((args4) => isEffect(args4[1]), (self, that, options) => raceAllFirst([self, that], options));
     flatMap2 = /* @__PURE__ */ dual(2, (self, f2) => {
       const onSuccess = Object.create(OnSuccessProto);
       onSuccess[args] = self;
@@ -3114,7 +3111,7 @@ ${prefix3}}`;
       if (prev === implementation) return s3;
       return add(s3, service3, implementation);
     });
-    forever = /* @__PURE__ */ dual((args3) => isEffect(args3[0]), (self, options) => whileLoop({
+    forever = /* @__PURE__ */ dual((args4) => isEffect(args4[0]), (self, options) => whileLoop({
       while: constTrue,
       body: constant(options?.disableYield ? self : flatMap2(self, (_2) => yieldNow)),
       step: constVoid
@@ -3146,7 +3143,7 @@ ${prefix3}}`;
       return andThen(internalCall(() => f2(result2.success, cause)), failCause(cause));
     }));
     tapError = /* @__PURE__ */ dual(2, (self, f2) => tapCauseFilter(self, findError, (e) => f2(e)));
-    catchIf = /* @__PURE__ */ dual((args3) => isEffect(args3[0]), (self, predicate, f2, orElse) => catchCause(self, (cause) => {
+    catchIf = /* @__PURE__ */ dual((args4) => isEffect(args4[0]), (self, predicate, f2, orElse) => catchCause(self, (cause) => {
       const error = findError(cause);
       if (isFailure2(error)) return failCause(error.failure);
       if (!predicate(error.success)) {
@@ -3154,13 +3151,13 @@ ${prefix3}}`;
       }
       return internalCall(() => f2(error.success));
     }));
-    catchTag = /* @__PURE__ */ dual((args3) => isEffect(args3[0]), (self, k2, f2, orElse) => {
+    catchTag = /* @__PURE__ */ dual((args4) => isEffect(args4[0]), (self, k2, f2, orElse) => {
       const pred = Array.isArray(k2) ? (e) => hasProperty(e, "_tag") && k2.includes(e._tag) : isTagged(k2);
       return catchIf(self, pred, f2, orElse);
     });
     mapError2 = /* @__PURE__ */ dual(2, (self, f2) => catch_(self, (error) => failSync(() => f2(error))));
     orDie = (self) => catch_(self, die);
-    ignore = /* @__PURE__ */ dual((args3) => isEffect(args3[0]), (self, options) => {
+    ignore = /* @__PURE__ */ dual((args4) => isEffect(args4[0]), (self, options) => {
       if (!options?.log) {
         return matchEffect(self, {
           onFailure: (_2) => void_,
@@ -3436,7 +3433,7 @@ ${prefix3}}`;
         return exitVoid;
       }
     });
-    forEach = /* @__PURE__ */ dual((args3) => typeof args3[1] === "function", (iterable, f2, options) => suspend(() => {
+    forEach = /* @__PURE__ */ dual((args4) => typeof args4[1] === "function", (iterable, f2, options) => suspend(() => {
       const concurrencyOption = options?.concurrency ?? 1;
       const concurrency = concurrencyOption === "unbounded" ? Number.POSITIVE_INFINITY : Math.max(1, concurrencyOption);
       if (concurrency === 1) {
@@ -3644,8 +3641,8 @@ ${prefix3}}`;
       }
       return child;
     };
-    forkDetach = /* @__PURE__ */ dual((args3) => isEffect(args3[0]), (self, options) => withFiber((fiber2) => succeed3(forkUnsafe(fiber2, self, options?.startImmediately, true, options?.uninterruptible))));
-    forkIn = /* @__PURE__ */ dual((args3) => isEffect(args3[0]), (self, scope3, options) => withFiber((parent) => {
+    forkDetach = /* @__PURE__ */ dual((args4) => isEffect(args4[0]), (self, options) => withFiber((fiber2) => succeed3(forkUnsafe(fiber2, self, options?.startImmediately, true, options?.uninterruptible))));
+    forkIn = /* @__PURE__ */ dual((args4) => isEffect(args4[0]), (self, scope3, options) => withFiber((parent) => {
       const fiber2 = forkUnsafe(parent, self, options?.startImmediately, true, options?.uninterruptible);
       if (!fiber2._exit) {
         if (scope3.state._tag !== "Closed") {
@@ -3659,7 +3656,7 @@ ${prefix3}}`;
       }
       return succeed3(fiber2);
     }));
-    forkScoped = /* @__PURE__ */ dual((args3) => isEffect(args3[0]), (self, options) => flatMap2(scope, (scope3) => forkIn(self, scope3, options)));
+    forkScoped = /* @__PURE__ */ dual((args4) => isEffect(args4[0]), (self, options) => flatMap2(scope, (scope3) => forkIn(self, scope3, options)));
     runForkWith = (context3) => (effect2, options) => {
       const fiber2 = new FiberImpl(options?.scheduler ? add(context3, Scheduler, options.scheduler) : context3, options?.uninterruptible !== true);
       fiber2.evaluate(effect2);
@@ -3873,6 +3870,7 @@ ${prefix3}}`;
     })();
     clockWith = (f2) => withFiber((fiber2) => f2(fiber2.getRef(ClockRef)));
     sleep = (duration) => clockWith((clock) => clock.sleep(fromInputUnsafe(duration)));
+    currentTimeMillis = /* @__PURE__ */ clockWith((clock) => clock.currentTimeMillis);
     TimeoutErrorTypeId = "~effect/Cause/TimeoutError";
     TimeoutError = class extends (/* @__PURE__ */ TaggedError("TimeoutError")) {
       [TimeoutErrorTypeId] = TimeoutErrorTypeId;
@@ -4318,6 +4316,15 @@ var init_Layer = __esm({
   }
 });
 
+// ../../node_modules/.pnpm/effect@4.0.0-rc.108/node_modules/effect/dist/Clock.js
+var currentTimeMillis2;
+var init_Clock = __esm({
+  "../../node_modules/.pnpm/effect@4.0.0-rc.108/node_modules/effect/dist/Clock.js"() {
+    init_effect();
+    currentTimeMillis2 = currentTimeMillis;
+  }
+});
+
 // ../../node_modules/.pnpm/effect@4.0.0-rc.108/node_modules/effect/dist/Pull.js
 var catchDone, isDoneCause, isDoneFailure, filterDone, filterDoneLeftover, doneExitFromCause, matchEffect2;
 var init_Pull = __esm({
@@ -4475,7 +4482,7 @@ var init_layer = __esm({
     init_core();
     init_effect();
     provideLayer = (self, layer13, options) => scopedWith((scope3) => flatMap2(options?.local ? buildWithMemoMap(layer13, makeMemoMapUnsafe(), scope3) : buildWithScope(layer13, scope3), (context3) => provideContext(self, context3)));
-    provide2 = /* @__PURE__ */ dual((args3) => isEffect(args3[0]), (self, source, options) => isContext(source) ? provideContext(self, source) : provideLayer(self, Array.isArray(source) ? mergeAll2(...source) : source, options));
+    provide2 = /* @__PURE__ */ dual((args4) => isEffect(args4[0]), (self, source, options) => isContext(source) ? provideContext(self, source) : provideLayer(self, Array.isArray(source) ? mergeAll2(...source) : source, options));
   }
 });
 
@@ -4548,7 +4555,7 @@ var init_schedule = __esm({
 });
 
 // ../../node_modules/.pnpm/effect@4.0.0-rc.108/node_modules/effect/dist/Effect.js
-var isEffect2, all2, forEach2, whileLoop2, promise2, tryPromise2, succeed6, succeedNone2, suspend2, sync2, void_3, callback2, gen2, fail6, failCause3, failCauseSync2, die2, try_2, withFiber2, fromResult2, flatMap3, andThen2, tap2, exit2, map5, as2, asVoid2, catch_2, catchTag2, catchCause2, mapError3, orDie2, tapError2, tapCause2, retry2, ignore2, timeout2, timeoutOrElse2, sleep2, raceFirst2, matchEffect3, context2, provide3, provideContext2, serviceOption2, scope2, scoped2, scopedWith2, acquireRelease2, addFinalizer3, ensuring2, onError2, onExit2, interrupt2, uninterruptible2, uninterruptibleMask2, forever3, repeat2, forkIn2, forkScoped2, forkDetach2, runFork2, runForkWith2, runPromiseWith2, runSyncExit2, fnUntraced2, clockWith2, logError, effectify, mapEager2, mapErrorEager2, flatMapEager2, fnUntracedEager2;
+var isEffect2, all2, forEach2, whileLoop2, tryPromise2, succeed6, succeedNone2, suspend2, sync2, void_3, callback2, gen2, fail6, failCause3, failCauseSync2, die2, try_2, withFiber2, fromResult2, flatMap3, andThen2, tap2, exit2, map5, as2, asVoid2, catch_2, catchTag2, catchCause2, mapError3, orDie2, tapError2, tapCause2, retry2, ignore2, timeout2, timeoutOrElse2, sleep2, raceFirst2, matchEffect3, context2, provide3, provideContext2, serviceOption2, scope2, scoped2, scopedWith2, acquireRelease2, addFinalizer3, ensuring2, onError2, onExit2, interrupt2, uninterruptible2, uninterruptibleMask2, forever3, repeat2, forkIn2, forkScoped2, forkDetach2, runFork2, runForkWith2, runPromiseWith2, runSyncExit2, fnUntraced2, clockWith2, logError, effectify, mapEager2, mapErrorEager2, flatMapEager2, fnUntracedEager2;
 var init_Effect = __esm({
   "../../node_modules/.pnpm/effect@4.0.0-rc.108/node_modules/effect/dist/Effect.js"() {
     init_core();
@@ -4559,7 +4566,6 @@ var init_Effect = __esm({
     all2 = all;
     forEach2 = forEach;
     whileLoop2 = whileLoop;
-    promise2 = promise;
     tryPromise2 = tryPromise;
     succeed6 = succeed3;
     succeedNone2 = succeedNone;
@@ -4623,17 +4629,17 @@ var init_Effect = __esm({
     fnUntraced2 = fnUntraced;
     clockWith2 = clockWith;
     logError = /* @__PURE__ */ logWithLevel("Error");
-    effectify = (fn2, onError4, onSyncError) => (...args3) => callback2((resume) => {
+    effectify = (fn2, onError4, onSyncError) => (...args4) => callback2((resume) => {
       try {
-        fn2(...args3, (err, result2) => {
+        fn2(...args4, (err, result2) => {
           if (err) {
-            resume(fail6(onError4 ? onError4(err, args3) : err));
+            resume(fail6(onError4 ? onError4(err, args4) : err));
           } else {
             resume(succeed6(result2));
           }
         });
       } catch (err) {
-        resume(onSyncError ? fail6(onSyncError(err, args3)) : die2(err));
+        resume(onSyncError ? fail6(onSyncError(err, args4)) : die2(err));
       }
     });
     mapEager2 = mapEager;
@@ -4777,7 +4783,7 @@ var init_parser = __esm({
     missingExit = /* @__PURE__ */ succeed7(missing);
     sameExit = /* @__PURE__ */ succeed7(missing);
     toOption = (value) => value === missing ? none2() : some2(value);
-    fromOptionExit = (option3) => option3._tag === "None" ? missingExit : succeed7(option3.value);
+    fromOptionExit = (option4) => option4._tag === "None" ? missingExit : succeed7(option4.value);
   }
 });
 
@@ -7519,8 +7525,8 @@ function getClassSchemaFactory(from, identifier3, annotations) {
       }),
       toCodec: ([from2]) => new Link(from2.ast, transformation),
       toArbitrary: ([from2]) => () => ({
-        arbitrary: from2.arbitrary.map((args3) => new self(args3)),
-        terminal: from2.terminal?.map((args3) => new self(args3))
+        arbitrary: from2.arbitrary.map((args4) => new self(args4)),
+        terminal: from2.terminal?.map((args4) => new self(args4))
       }),
       toFormatter: ([from2]) => (t) => `${self.identifier}(${from2(t)})`,
       [SENTINELS_ANNOTATION_KEY]: collectSentinels(from.ast),
@@ -7965,7 +7971,7 @@ var init_connect = __esm({
     });
     ConnectPresence = Struct({
       connectedAt: NullOr(IsoDateTime),
-      environmentId: String4.check(isMinLength(1), isMaxLength(128)),
+      environmentId: ExecutionEnvironmentId,
       lastSeenAt: NullOr(IsoDateTime),
       nodeVersion: NullOr(String4.check(isMinLength(1), isMaxLength(64))),
       protocolVersion: NullOr(Int.check(isGreaterThanOrEqualTo2(1))),
@@ -7974,7 +7980,10 @@ var init_connect = __esm({
     ConnectCompatibility = Struct({
       maximumProtocolVersion: Int.check(isGreaterThanOrEqualTo2(1)),
       minimumNodeVersion: String4.check(isMinLength(5), isMaxLength(64)),
-      minimumProtocolVersion: Int.check(isGreaterThanOrEqualTo2(1))
+      minimumProtocolVersion: Int.check(isGreaterThanOrEqualTo2(1)),
+      recommendedNodeVersion: optional2(
+        String4.check(isMinLength(5), isMaxLength(64))
+      )
     }).check(
       makeFilter2(
         (value) => value.maximumProtocolVersion >= value.minimumProtocolVersion || "Maximum protocol version must not precede the minimum"
@@ -8627,7 +8636,7 @@ var init_Channel = __esm({
       }
       return isReadonlyArrayNonEmpty(passes) ? succeed6(passes) : flatMap3(pull, loop);
     }))));
-    merge2 = /* @__PURE__ */ dual((args3) => isChannel(args3[0]) && isChannel(args3[1]), (left, right, options) => fromTransformBracket(fnUntraced2(function* (upstream, _scope, forkedScope) {
+    merge2 = /* @__PURE__ */ dual((args4) => isChannel(args4[0]) && isChannel(args4[1]), (left, right, options) => fromTransformBracket(fnUntraced2(function* (upstream, _scope, forkedScope) {
       const strategy = options?.haltStrategy ?? "both";
       const queue = yield* bounded(0);
       yield* addFinalizer2(forkedScope, shutdown(queue));
@@ -8990,10 +8999,10 @@ var init_Stream = __esm({
       let i = 0;
       return fromChannel3(map7(self.channel, map2((o) => f2(o, i++))));
     }));
-    merge3 = /* @__PURE__ */ dual((args3) => isStream(args3[0]) && isStream(args3[1]), (self, that, options) => fromChannel3(merge2(toChannel2(self), toChannel2(that), options)));
+    merge3 = /* @__PURE__ */ dual((args4) => isStream(args4[0]) && isStream(args4[1]), (self, that, options) => fromChannel3(merge2(toChannel2(self), toChannel2(that), options)));
     filter6 = /* @__PURE__ */ dual(2, (self, predicate) => fromChannel3(filterArray(toChannel2(self), predicate)));
     take3 = /* @__PURE__ */ dual(2, (self, n) => n < 1 ? empty5 : takeUntil(self, (_2, i) => i === n - 1));
-    takeUntil = /* @__PURE__ */ dual((args3) => isStream(args3[0]), (self, predicate, options) => transformPull2(self, (pull, _scope) => sync2(() => {
+    takeUntil = /* @__PURE__ */ dual((args4) => isStream(args4[0]), (self, predicate, options) => transformPull2(self, (pull, _scope) => sync2(() => {
       let i = 0;
       let done4 = false;
       const pump = flatMap3(suspend2(() => done4 ? done2() : pull), (chunk) => {
@@ -9027,7 +9036,7 @@ var init_Stream = __esm({
       });
       return suspend2(() => done4 ? done4 : pull);
     })));
-    decodeText = /* @__PURE__ */ dual((args3) => isStream(args3[0]), (self, options) => suspend4(() => {
+    decodeText = /* @__PURE__ */ dual((args4) => isStream(args4[0]), (self, options) => suspend4(() => {
       const decoder2 = new TextDecoder(options?.encoding);
       return map8(self, (chunk) => decoder2.decode(chunk, {
         stream: true
@@ -9703,10 +9712,10 @@ var init_ChildProcess = __esm({
     isCommand = (u2) => hasProperty(u2, TypeId23);
     isStandardCommand = (command2) => command2._tag === "StandardCommand";
     isPipedCommand = (command2) => command2._tag === "PipedCommand";
-    makeStandardCommand = (command2, args3, options) => Object.assign(Object.create(Proto2), {
+    makeStandardCommand = (command2, args4, options) => Object.assign(Object.create(Proto2), {
       _tag: "StandardCommand",
       command: command2,
-      args: args3,
+      args: args4,
       options
     });
     makePipedCommand = (left, right, options = {}) => Object.assign(Object.create(Proto2), {
@@ -9715,46 +9724,46 @@ var init_ChildProcess = __esm({
       right,
       options
     });
-    make16 = function make17(...args3) {
-      if (isTemplateString(args3[0])) {
-        const [templates, ...expressions] = args3;
+    make16 = function make17(...args4) {
+      if (isTemplateString(args4[0])) {
+        const [templates, ...expressions] = args4;
         const tokens = parseTemplates(templates, expressions);
         return makeStandardCommand(tokens[0] ?? "", tokens.slice(1), {});
       }
-      if (typeof args3[0] === "object" && !Array.isArray(args3[0]) && !isTemplateString(args3[0])) {
-        const options2 = args3[0];
+      if (typeof args4[0] === "object" && !Array.isArray(args4[0]) && !isTemplateString(args4[0])) {
+        const options2 = args4[0];
         return function(templates, ...expressions) {
           const tokens = parseTemplates(templates, expressions);
           return makeStandardCommand(tokens[0] ?? "", tokens.slice(1), options2);
         };
       }
-      if (typeof args3[0] === "string" && !Array.isArray(args3[1])) {
-        const [command3, options2 = {}] = args3;
+      if (typeof args4[0] === "string" && !Array.isArray(args4[1])) {
+        const [command3, options2 = {}] = args4;
         return makeStandardCommand(command3, [], options2);
       }
-      const [command2, cmdArgs = [], options = {}] = args3;
+      const [command2, cmdArgs = [], options = {}] = args4;
       return makeStandardCommand(command2, cmdArgs, options);
     };
-    pipeTo2 = /* @__PURE__ */ dual((args3) => isCommand(args3[0]) && isCommand(args3[1]), (self, that, options) => makePipedCommand(self, that, options ?? {}));
-    prefix = function prefix2(...args3) {
-      if (isCommand(args3[0]) && args3.length > 1) {
-        const [self, ...rest] = args3;
+    pipeTo2 = /* @__PURE__ */ dual((args4) => isCommand(args4[0]) && isCommand(args4[1]), (self, that, options) => makePipedCommand(self, that, options ?? {}));
+    prefix = function prefix2(...args4) {
+      if (isCommand(args4[0]) && args4.length > 1) {
+        const [self, ...rest] = args4;
         const prefixSpec2 = parsePrefixArgs(rest);
         return applyPrefix(self, prefixSpec2);
       }
-      const prefixSpec = parsePrefixArgs(args3);
+      const prefixSpec = parsePrefixArgs(args4);
       return (self) => applyPrefix(self, prefixSpec);
     };
-    parsePrefixArgs = (args3) => {
-      if (isTemplateString(args3[0])) {
-        const [templates, ...expressions] = args3;
+    parsePrefixArgs = (args4) => {
+      if (isTemplateString(args4[0])) {
+        const [templates, ...expressions] = args4;
         const tokens = parseTemplates(templates, expressions);
         return {
           command: tokens[0] ?? "",
           args: tokens.slice(1)
         };
       }
-      const [command2, cmdArgs = []] = args3;
+      const [command2, cmdArgs = []] = args4;
       return {
         command: command2,
         args: cmdArgs
@@ -10151,24 +10160,24 @@ var init_NodeChildProcessSpawner = __esm({
         };
       };
       const resolveOutputOption = (options, streamName) => {
-        const option3 = options[streamName];
-        if (isUndefined(option3)) {
+        const option4 = options[streamName];
+        if (isUndefined(option4)) {
           return {
             stream: "pipe"
           };
         }
-        if (typeof option3 === "string") {
+        if (typeof option4 === "string") {
           return {
-            stream: option3
+            stream: option4
           };
         }
-        if (isSink(option3)) {
+        if (isSink(option4)) {
           return {
-            stream: option3
+            stream: option4
           };
         }
         return {
-          stream: option3.stream
+          stream: option4.stream
         };
       };
       const resolveAdditionalFds = (options) => {
@@ -10311,8 +10320,8 @@ var init_NodeChildProcessSpawner = __esm({
         handle.on("error", (error) => {
           resume(fail6(toPlatformError("spawn", error, command2)));
         });
-        handle.on("exit", (...args3) => {
-          doneUnsafe(deferred, succeed4(args3));
+        handle.on("exit", (...args4) => {
+          doneUnsafe(deferred, succeed4(args4));
         });
         handle.on("spawn", () => {
           resume(succeed6([handle, deferred]));
@@ -11460,7 +11469,7 @@ var init_Runtime = __esm({
       if (hasInterruptsOnly2(exit3.cause)) return onExit4(130);
       return onExit4(getErrorExitCode(squash(exit3.cause)));
     };
-    makeRunMain = (f2) => dual((args3) => isEffect2(args3[0]), (effect2, options) => {
+    makeRunMain = (f2) => dual((args4) => isEffect2(args4[0]), (effect2, options) => {
       const fiber2 = options?.disableErrorReporting === true ? runFork2(effect2) : runFork2(tapCause2(effect2, (cause) => {
         if (hasInterruptsOnly2(cause)) return void_3;
         const isReported = getErrorReported(squash(cause));
@@ -11549,7 +11558,7 @@ var init_process = __esm({
 });
 
 // ../../packages/contracts/src/connect-tunnel.ts
-var Base64Url, base64Url, Hostname, KeyVersion, ManagedTunnelConfiguration, releaseBase, cloudflaredReleaseManifest, proofFields, TunnelEnvironmentProof, LocalOrigin, TunnelConfigurationRequest, TunnelReleaseRequest, ValidateClientTicketRequest, PublishNodePresenceRequest, ValidateClientTicketResponse, TunnelNodeWelcome, TunnelHealthResponse, tunnelHealthSigningPayload, tunnelClientProofPayload, tunnelWelcomeSigningPayload, decodeTunnelConfigurationRequest, decodeValidateClientTicketRequest, decodeTunnelReleaseRequest, decodePublishNodePresenceRequest, decodeManagedTunnelConfiguration, decodeValidateClientTicketResponse, decodeTunnelNodeWelcome, decodeTunnelHealthResponse;
+var Base64Url, base64Url, Hostname, KeyVersion, ManagedTunnelConfiguration, releaseBase, cloudflaredReleaseManifest, proofFields, CreateNodeProofChallengeRequest, TunnelEnvironmentProof, LocalOrigin, TunnelConfigurationRequest, TunnelReleaseRequest, ValidateClientTicketRequest, PublishNodePresenceRequest, ValidateClientTicketResponse, TunnelNodeWelcome, TunnelHealthResponse, tunnelHealthSigningPayload, tunnelClientProofPayload, tunnelWelcomeSigningPayload, decodeTunnelConfigurationRequest, decodeCreateNodeProofChallengeRequest, decodeValidateClientTicketRequest, decodeTunnelReleaseRequest, decodePublishNodePresenceRequest, decodeManagedTunnelConfiguration, decodeValidateClientTicketResponse, decodeTunnelNodeWelcome, decodeTunnelHealthResponse;
 var init_connect_tunnel = __esm({
   "../../packages/contracts/src/connect-tunnel.ts"() {
     "use strict";
@@ -11625,6 +11634,9 @@ var init_connect_tunnel = __esm({
       proofChallengeId: EnvironmentChallengeId,
       signature: base64Url(86)
     };
+    CreateNodeProofChallengeRequest = Struct({
+      environmentId: ExecutionEnvironmentId
+    });
     TunnelEnvironmentProof = Struct(proofFields);
     LocalOrigin = String4.check(
       makeFilter2((value) => {
@@ -11709,6 +11721,9 @@ var init_connect_tunnel = __esm({
       String(welcome.protocolVersion)
     ].join("\n");
     decodeTunnelConfigurationRequest = decodeUnknownExact(TunnelConfigurationRequest);
+    decodeCreateNodeProofChallengeRequest = decodeUnknownExact(
+      CreateNodeProofChallengeRequest
+    );
     decodeValidateClientTicketRequest = decodeUnknownExact(ValidateClientTicketRequest);
     decodeTunnelReleaseRequest = decodeUnknownExact(TunnelReleaseRequest);
     decodePublishNodePresenceRequest = decodeUnknownExact(PublishNodePresenceRequest);
@@ -14955,7 +14970,7 @@ var init_environments = __esm({
     init_ids();
     init_schema2();
     environmentCredentialScope = "glass-connect";
-    environmentPairingApprovalPath = "/#glass-connect-pair";
+    environmentPairingApprovalPath = "/pair";
     maxEnvironmentDisplayNameLength = 120;
     EnvironmentPlatform = Literals(["linux", "macos", "windows"]);
     Base64Url2 = String4.check(isPattern2(/^[A-Za-z0-9_-]+$/u));
@@ -15061,18 +15076,20 @@ var init_environments = __esm({
 });
 
 // src/identity.ts
-import { createPrivateKey, generateKeyPairSync, sign } from "node:crypto";
+import { createPrivateKey, generateKeyPairSync, randomUUID, sign } from "node:crypto";
 import { chmod as chmod4, mkdir as mkdir3, open as open3, readFile as readFile4, rename as rename4 } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname as dirname2, join as join3 } from "node:path";
-var EnvironmentRequestError, IdentityError, StoredNodeIdentitySchema, decodeStoredNodeIdentity, isRecord, defaultIdentityPath, createNodeIdentity, loadNodeIdentity, saveNodeIdentity, signChallenge, signPrivateKey, request, beginPairing, finishPairing, refreshCredential;
+var EnvironmentRequestError, IdentityError, PairingPendingError, StoredNodeIdentitySchema, decodeStoredNodeIdentity, isRecord, defaultIdentityPath, createNodeIdentity, loadNodeIdentity, saveNodeIdentity, signChallenge, signPrivateKey, request, beginPairing, finishPairing, refreshCredential;
 var init_identity = __esm({
   "src/identity.ts"() {
     "use strict";
     init_environments();
     init_schema2();
+    init_Clock();
     init_Duration();
     init_Effect();
+    init_Schedule();
     init_Schema();
     EnvironmentRequestError = class extends TaggedError3()(
       "EnvironmentRequestError",
@@ -15084,6 +15101,10 @@ var init_identity = __esm({
       operation: Literals(["create", "decode", "load", "request", "save", "sign"])
     }) {
     };
+    PairingPendingError = class extends TaggedError3()("PairingPendingError", {
+      reason: Literal2("approval-pending")
+    }) {
+    };
     StoredNodeIdentitySchema = Struct({
       apiOrigin: String4,
       credential: NullOr(EnvironmentCredential),
@@ -15149,7 +15170,7 @@ var init_identity = __esm({
     saveNodeIdentity = (identity2, path = defaultIdentityPath()) => tryPromise2({
       try: async () => {
         await mkdir3(dirname2(path), { recursive: true, mode: 448 });
-        const temporary = `${path}.${process.pid}.${crypto.randomUUID()}.tmp`;
+        const temporary = `${path}.${process.pid}.${randomUUID()}.tmp`;
         const file = await open3(temporary, "wx", 384);
         try {
           await file.writeFile(`${JSON.stringify(identity2, null, 2)}
@@ -15222,7 +15243,8 @@ var init_identity = __esm({
     );
     finishPairing = (identity2, pairing) => {
       const poll2 = gen2(function* () {
-        if (Date.parse(pairing.expiresAt) <= Date.now()) {
+        const now = yield* currentTimeMillis2;
+        if (Date.parse(pairing.expiresAt) <= now) {
           return yield* new IdentityError({ cause: "pairing-expired", operation: "request" });
         }
         const status = yield* request(
@@ -15235,7 +15257,7 @@ var init_identity = __esm({
           decodeEnvironmentPairingStatus
         );
         if (status.status === "approved") {
-          const environment = yield* request(
+          const environment2 = yield* request(
             identity2,
             "/v1/environment-pairings/complete",
             {
@@ -15245,11 +15267,18 @@ var init_identity = __esm({
             },
             decodeExecutionEnvironment
           );
-          return { ...identity2, environment };
+          return { ...identity2, environment: environment2 };
         }
-        yield* sleep2(seconds(2));
-        return yield* suspend2(() => poll2);
-      });
+        return yield* new PairingPendingError({ reason: "approval-pending" });
+      }).pipe(
+        retry2({
+          schedule: spaced(seconds(2)),
+          while: (error) => error instanceof PairingPendingError
+        }),
+        mapError3(
+          (error) => error instanceof PairingPendingError ? new IdentityError({ cause: error, operation: "request" }) : error
+        )
+      );
       return poll2;
     };
     refreshCredential = (identity2) => gen2(function* () {
@@ -15259,7 +15288,8 @@ var init_identity = __esm({
           operation: "request"
         });
       }
-      if (identity2.credential !== null && Date.parse(identity2.credential.expiresAt) > Date.now() + 3e4) {
+      const now = yield* currentTimeMillis2;
+      if (identity2.credential !== null && Date.parse(identity2.credential.expiresAt) > now + 3e4) {
         return identity2;
       }
       const challenge = yield* request(
@@ -15283,7 +15313,7 @@ var init_identity = __esm({
 });
 
 // src/service-lifecycle.ts
-import { createHash as createHash3, randomUUID } from "node:crypto";
+import { createHash as createHash3, randomUUID as randomUUID2 } from "node:crypto";
 import {
   chmod as chmod5,
   copyFile as copyFile3,
@@ -15334,10 +15364,10 @@ var init_service_lifecycle = __esm({
     };
     serviceName = "com.glass.connect";
     windowsTaskName = "Glass Connect";
-    run3 = (command2, args3, allowFailure = false) => gen2(function* () {
+    run3 = (command2, args4, allowFailure = false) => gen2(function* () {
       const [stderr, code] = yield* scoped2(
         gen2(function* () {
-          const child = yield* ChildProcess_exports.make(command2, args3, {
+          const child = yield* ChildProcess_exports.make(command2, args4, {
             stdin: "ignore",
             stdout: "ignore"
           });
@@ -15367,10 +15397,10 @@ var init_service_lifecycle = __esm({
       }
       return code;
     });
-    runOutput = (command2, args3) => gen2(function* () {
+    runOutput = (command2, args4) => gen2(function* () {
       const [stdout, code] = yield* scoped2(
         gen2(function* () {
-          const child = yield* ChildProcess_exports.make(command2, args3, {
+          const child = yield* ChildProcess_exports.make(command2, args4, {
             stdin: "ignore",
             stdout: "pipe"
           });
@@ -15514,15 +15544,8 @@ set "GLASS_CONNECT_READY_PATH=${batchValue(paths.ready)}"\r
     serviceStatus = (value = process.platform) => gen2(function* () {
       const platform2 = yield* platformOf(value);
       if (platform2 === "win32") {
-        const result2 = yield* runOutput("schtasks.exe", [
-          "/Query",
-          "/TN",
-          windowsTaskName,
-          "/FO",
-          "LIST",
-          "/V"
-        ]);
-        return result2.code === 0 && /Status:\s+Running/i.test(result2.stdout) ? "running" : "stopped";
+        const result2 = yield* runOutput("schtasks.exe", ["/Query", "/TN", windowsTaskName, "/XML"]);
+        return result2.code === 0 && /<State>\s*Running\s*<\/State>/i.test(result2.stdout) ? "running" : "stopped";
       }
       const code = platform2 === "darwin" ? yield* run3(
         "launchctl",
@@ -15567,10 +15590,29 @@ set "GLASS_CONNECT_READY_PATH=${batchValue(paths.ready)}"\r
       );
     };
     publishCurrentRelease = (paths, releaseRoot, platform2) => tryLifecycle("install", async () => {
-      const stagedLink = `${paths.currentRoot}.${process.pid}.${randomUUID()}.new`;
+      const stagedLink = `${paths.currentRoot}.${process.pid}.${randomUUID2()}.new`;
       await symlink3(releaseRoot, stagedLink, platform2 === "win32" ? "junction" : "dir");
-      if (platform2 === "win32") await rm3(paths.currentRoot, { force: true });
-      await rename5(stagedLink, paths.currentRoot);
+      if (platform2 !== "win32") {
+        await rename5(stagedLink, paths.currentRoot);
+        return;
+      }
+      const previousLink = `${paths.currentRoot}.${process.pid}.${randomUUID2()}.old`;
+      let previousMoved = false;
+      try {
+        await rename5(paths.currentRoot, previousLink);
+        previousMoved = true;
+      } catch (cause) {
+        const code = cause instanceof Error && "code" in cause ? cause.code : void 0;
+        if (code !== "ENOENT") throw cause;
+      }
+      try {
+        await rename5(stagedLink, paths.currentRoot);
+      } catch (cause) {
+        if (previousMoved) await rename5(previousLink, paths.currentRoot).catch(() => void 0);
+        await rm3(stagedLink, { force: true }).catch(() => void 0);
+        throw cause;
+      }
+      if (previousMoved) await rm3(previousLink, { force: true });
     });
     activeRelease = (paths) => tryLifecycle("install", async () => {
       const root = await readlink2(paths.currentRoot).catch(() => null);
@@ -15627,7 +15669,7 @@ set "GLASS_CONNECT_READY_PATH=${batchValue(paths.ready)}"\r
         })
       );
       const paths = servicePaths(input.identityPath, `${input.version}-${digest3}`);
-      const stagedConfig = `${path}.${process.pid}.${randomUUID()}.new`;
+      const stagedConfig = `${path}.${process.pid}.${randomUUID2()}.new`;
       yield* tryLifecycle("install", async () => {
         await writeFile4(
           stagedConfig,
@@ -15689,6 +15731,40 @@ set "GLASS_CONNECT_READY_PATH=${batchValue(paths.ready)}"\r
   }
 });
 
+// src/pairing-url.ts
+var toOrigin, buildEnvironmentPairingUrl;
+var init_pairing_url = __esm({
+  "src/pairing-url.ts"() {
+    "use strict";
+    init_environments();
+    toOrigin = (value, label) => {
+      let url;
+      try {
+        url = new URL(value);
+      } catch (cause) {
+        throw new Error(`${label} must be an absolute HTTP(S) origin.`, { cause });
+      }
+      const local = url.protocol === "http:" && ["127.0.0.1", "localhost"].includes(url.hostname);
+      if (url.protocol !== "https:" && !local || url.username !== "" || url.password !== "" || url.pathname !== "" && url.pathname !== "/" || url.search !== "" || url.hash !== "") {
+        throw new Error(`${label} must be an absolute HTTP(S) origin.`);
+      }
+      return url;
+    };
+    buildEnvironmentPairingUrl = ({
+      cloudOrigin,
+      pairingToken,
+      productOrigin: productOrigin2
+    }) => {
+      const cloud = toOrigin(cloudOrigin, "Glass Cloud origin");
+      const product = toOrigin(productOrigin2, "Glass product origin");
+      const url = new URL(environmentPairingApprovalPath, product);
+      url.search = `?host=${cloud.origin}`;
+      url.hash = `token=${encodeURIComponent(pairingToken)}`;
+      return url.toString();
+    };
+  }
+});
+
 // src/tunnel-control.ts
 var IdentityStoreError, TunnelControlError, TunnelControlTransportError, TunnelControlProtocolError, responseMessage, decodeResponse, createTunnelControl;
 var init_tunnel_control = __esm({
@@ -15826,10 +15902,10 @@ var init_tunnel_control = __esm({
 
 // ../../node_modules/.pnpm/@noble+hashes@1.8.0/node_modules/@noble/hashes/esm/cryptoNode.js
 import * as nc from "node:crypto";
-var crypto2;
+var crypto;
 var init_cryptoNode = __esm({
   "../../node_modules/.pnpm/@noble+hashes@1.8.0/node_modules/@noble/hashes/esm/cryptoNode.js"() {
-    crypto2 = nc && typeof nc === "object" && "webcrypto" in nc ? nc.webcrypto : nc && typeof nc === "object" && "randomBytes" in nc ? nc : void 0;
+    crypto = nc && typeof nc === "object" && "webcrypto" in nc ? nc.webcrypto : nc && typeof nc === "object" && "randomBytes" in nc ? nc : void 0;
   }
 });
 
@@ -15888,11 +15964,11 @@ function createHasher(hashCons) {
   return hashC;
 }
 function randomBytes3(bytesLength = 32) {
-  if (crypto2 && typeof crypto2.getRandomValues === "function") {
-    return crypto2.getRandomValues(new Uint8Array(bytesLength));
+  if (crypto && typeof crypto.getRandomValues === "function") {
+    return crypto.getRandomValues(new Uint8Array(bytesLength));
   }
-  if (crypto2 && typeof crypto2.randomBytes === "function") {
-    return Uint8Array.from(crypto2.randomBytes(bytesLength));
+  if (crypto && typeof crypto.randomBytes === "function") {
+    return Uint8Array.from(crypto.randomBytes(bytesLength));
   }
   throw new Error("crypto.getRandomValues must be defined");
 }
@@ -16417,11 +16493,11 @@ function validateObject(object, validators, optValidators = {}) {
 }
 function memoized(fn2) {
   const map9 = /* @__PURE__ */ new WeakMap();
-  return (arg, ...args3) => {
+  return (arg, ...args4) => {
     const val = map9.get(arg);
     if (val !== void 0)
       return val;
-    const computed = fn2(arg, ...args3);
+    const computed = fn2(arg, ...args4);
     map9.set(arg, computed);
     return computed;
   };
@@ -21221,6 +21297,7 @@ var init_tunnel_origin = __esm({
     init_webapi();
     init_ids();
     init_wrapper();
+    init_Clock();
     init_Effect();
     init_Option();
     init_Semaphore();
@@ -21239,7 +21316,11 @@ var init_tunnel_origin = __esm({
       const sockets = /* @__PURE__ */ new Set();
       const authenticationPermits = makeUnsafe5(maxPendingAuthentications);
       const authenticate = (ticket) => authenticationPermits.withPermitsIfAvailable(1)(
-        all2([options.control.validateTicket(ticket), options.getAuthority()])
+        all2([
+          options.control.validateTicket(ticket),
+          options.getAuthority(),
+          currentTimeMillis2
+        ])
       );
       const server = createServer2((request2, response) => {
         void (async () => {
@@ -21263,17 +21344,17 @@ var init_tunnel_origin = __esm({
               response.end();
               return;
             }
-            const [validation, authority] = authenticated.value;
-            const environment = authority.identity.environment;
-            if (environment === null || environment.revokedAt !== null || validation.environmentId !== environment.id || validation.keyVersion !== environment.keyVersion || validation.clientNonce !== nonce || validation.hostname !== authority.hostname || Date.parse(validation.expiresAt) <= Date.now() || !ed25519.verify(
+            const [validation, authority, currentTimeMillis3] = authenticated.value;
+            const environment2 = authority.identity.environment;
+            if (environment2 === null || environment2.revokedAt !== null || validation.environmentId !== environment2.id || validation.keyVersion !== environment2.keyVersion || validation.clientNonce !== nonce || validation.hostname !== authority.hostname || Date.parse(validation.expiresAt) <= currentTimeMillis3 || !ed25519.verify(
               base64url_exports.decode(clientProof),
               new TextEncoder().encode(tunnelClientProofPayload(ticket, nonce)),
               base64url_exports.decode(validation.clientPublicKey)
             ))
               throw new TunnelOriginError({ reason: "authority" });
             const unsigned = {
-              checkedAt: parseIsoDateTime((/* @__PURE__ */ new Date()).toISOString()),
-              environmentId: environment.id,
+              checkedAt: parseIsoDateTime(new Date(currentTimeMillis3).toISOString()),
+              environmentId: environment2.id,
               hostname: authority.hostname,
               nodeVersion: options.nodeVersion,
               nonce,
@@ -21320,6 +21401,7 @@ var init_tunnel_origin = __esm({
           }
           let validation;
           let authority;
+          let currentTimeMillis3;
           try {
             const authenticated = await runPromise3(
               authenticate(values[1].slice("glass-ticket.".length))
@@ -21330,15 +21412,15 @@ var init_tunnel_origin = __esm({
               );
               return;
             }
-            [validation, authority] = authenticated.value;
+            [validation, authority, currentTimeMillis3] = authenticated.value;
           } catch {
             socket.end("HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n");
             return;
           }
-          const environment = authority.identity.environment;
+          const environment2 = authority.identity.environment;
           const rawTicket = values[1].slice("glass-ticket.".length);
           const clientProof = values[2].slice("glass-proof.".length);
-          if (environment === null || environment.revokedAt !== null || validation.environmentId !== environment.id || validation.keyVersion !== environment.keyVersion || validation.hostname !== authority.hostname || Date.parse(validation.expiresAt) <= Date.now() || !/^[A-Za-z0-9_-]{86}$/u.test(clientProof) || !ed25519.verify(
+          if (environment2 === null || environment2.revokedAt !== null || validation.environmentId !== environment2.id || validation.keyVersion !== environment2.keyVersion || validation.hostname !== authority.hostname || Date.parse(validation.expiresAt) <= currentTimeMillis3 || !/^[A-Za-z0-9_-]{86}$/u.test(clientProof) || !ed25519.verify(
             base64url_exports.decode(clientProof),
             new TextEncoder().encode(tunnelClientProofPayload(rawTicket, validation.clientNonce)),
             base64url_exports.decode(validation.clientPublicKey)
@@ -21407,12 +21489,11 @@ __export(main_exports, {
 import { writeFile as writeFile5 } from "node:fs/promises";
 import { hostname, platform } from "node:os";
 import { dirname as dirname4, join as join5 } from "node:path";
-var executionNodeVersion, ExecutionNodeError, executionDescriptor, args2, command, option2, identityPath, pairComputer, requireCompatibleCloud, runChild, program;
+var executionNodeVersion, ExecutionNodeError, ReadyFileError, executionDescriptor, args2, command, option2, identityPath, pairComputer, requireCompatibleCloud, runChild, program;
 var init_main = __esm({
   "src/main.ts"() {
     "use strict";
     init_connect();
-    init_connect();
     init_NodeServices();
     init_NodeRuntime2();
     init_Duration();
@@ -21424,13 +21505,19 @@ var init_main = __esm({
     init_cloudflared();
     init_identity();
     init_service_lifecycle();
+    init_pairing_url();
     init_tunnel_control();
     init_tunnel_origin();
-    executionNodeVersion = "0.3.0";
+    executionNodeVersion = "1.0.0";
     ExecutionNodeError = class extends TaggedError3()("ExecutionNodeError", {
       message: String4
     }) {
     };
+    ReadyFileError = class extends TaggedError3()("ReadyFileError", {
+      cause: Defect(),
+      path: String4
+    }) {
+    };
     executionDescriptor = () => ({
       kind: "execution-node",
       nodeVersion: executionNodeVersion,
@@ -21449,10 +21536,17 @@ var init_main = __esm({
       const nodePlatform = platform() === "darwin" ? "macos" : platform() === "win32" ? "windows" : "linux";
       const pairing = yield* beginPairing(identity2, option2("--name") ?? hostname(), nodePlatform);
       yield* saveNodeIdentity(identity2, identityPath);
+      const pairingOrigin = process.env.GLASS_CONNECT_PAIRING_ORIGIN ?? identity2.apiOrigin;
       process.stdout.write(
         `Connect this computer to Glass.
 One-time code: ${pairing.pairingCode}
-Open Glass: ${new URL(pairing.approvalPath, identity2.apiOrigin)}
+Open Glass: ${buildEnvironmentPairingUrl(
+          {
+            cloudOrigin: identity2.apiOrigin,
+            pairingToken: pairing.pairingCode,
+            productOrigin: pairingOrigin
+          }
+        )}
 Waiting for approval\u2026
 `
       );
@@ -21479,11 +21573,17 @@ Waiting for approval\u2026
       const versionParts = (value) => value.split(".").map((part) => Number(part));
       const currentParts = versionParts(executionNodeVersion);
       const minimumParts = versionParts(decoded.minimumNodeVersion);
+      const recommendedNodeVersion = decoded.recommendedNodeVersion ?? decoded.minimumNodeVersion;
       const nodeTooOld = [0, 1, 2].some((index) => {
         const current = currentParts[index] ?? 0;
         const minimum = minimumParts[index] ?? 0;
         return current < minimum && currentParts.slice(0, index).every((part, prior) => part === minimumParts[prior]);
       });
+      if (executionNodeVersion !== recommendedNodeVersion)
+        process.stderr.write(
+          `Glass Connect ${executionNodeVersion} is running. Recommended version is ${recommendedNodeVersion}; update with npx glass-connect@${recommendedNodeVersion} update.
+`
+        );
       if (glassConnectProtocolVersion < decoded.minimumProtocolVersion || glassConnectProtocolVersion > decoded.maximumProtocolVersion || nodeTooOld)
         return yield* new TunnelControlError({
           status: 426,
@@ -21505,11 +21605,11 @@ Waiting for approval\u2026
     });
     program = gen2(function* () {
       if (command === "start" || command === "install") {
-        const configuredOrigin = process.env.GLASS_CLOUD_ORIGIN;
+        const configuredOrigin2 = process.env.GLASS_CLOUD_ORIGIN;
         let identity2 = yield* loadNodeIdentity(identityPath);
-        if (identity2 !== null && configuredOrigin !== void 0 && new URL(identity2.apiOrigin).origin !== new URL(configuredOrigin).origin)
+        if (identity2 !== null && configuredOrigin2 !== void 0 && new URL(identity2.apiOrigin).origin !== new URL(configuredOrigin2).origin)
           return yield* new ExecutionNodeError({
-            message: `This Glass Connect identity belongs to ${identity2.apiOrigin}. Use stage-specific state for ${configuredOrigin}.`
+            message: `This Glass Connect identity belongs to ${identity2.apiOrigin}. Use stage-specific state for ${configuredOrigin2}.`
           });
         if (identity2 !== null && identity2.environment !== null) {
           const storedIdentity = identity2;
@@ -21528,7 +21628,7 @@ Waiting for approval\u2026
             )
           );
         } else {
-          const origin = configuredOrigin ?? identity2?.apiOrigin;
+          const origin = configuredOrigin2 ?? identity2?.apiOrigin;
           if (origin === void 0)
             return yield* new ExecutionNodeError({
               message: "Glass Connect has no configured Glass Cloud origin."
@@ -21554,7 +21654,7 @@ Waiting for approval\u2026
         }
       } else if (command === "help") {
         process.stdout.write(
-          "Usage: glass-connect [start|install] [--name NAME] | stop | status | uninstall | descriptor\n"
+          "Usage: glass-connect [start|install] [--name NAME] [--environment preview|production] [--cloud-origin URL] [--pairing-origin URL] [--identity-path PATH] | update | stop | status | uninstall | descriptor\n"
         );
       } else if (command === "descriptor") {
         process.stdout.write(`${JSON.stringify(executionDescriptor())}
@@ -21570,6 +21670,25 @@ Waiting for approval\u2026
         process.stdout.write(
           "Glass Connect background service was removed. The paired computer identity was preserved.\n"
         );
+      } else if (command === "update") {
+        const identity2 = yield* loadNodeIdentity(identityPath);
+        if (identity2 === null || identity2.environment === null)
+          return yield* new ExecutionNodeError({
+            message: "No connected computer exists. Start Glass Connect first."
+          });
+        const entryPath = process.argv[1];
+        if (entryPath === void 0)
+          return yield* new ExecutionNodeError({
+            message: "Glass Connect cannot locate its installed entry point."
+          });
+        yield* installService({
+          cloudOrigin: identity2.apiOrigin,
+          entryPath,
+          identityPath,
+          version: executionNodeVersion
+        });
+        process.stdout.write(`Glass Connect ${executionNodeVersion} is installed and running.
+`);
       } else if (command === "connect") {
         let identity2 = yield* loadNodeIdentity(identityPath);
         if (identity2 === null || identity2.environment === null)
@@ -21647,13 +21766,14 @@ Waiting for approval\u2026
             yield* control.publishPresence(executionNodeVersion, "connected");
             const readyPath = process.env.GLASS_CONNECT_READY_PATH;
             if (readyPath !== void 0) {
-              yield* promise2(
-                () => writeFile5(readyPath, `${executionNodeVersion}
+              yield* tryPromise2({
+                try: () => writeFile5(readyPath, `${executionNodeVersion}
 `, {
                   encoding: "utf8",
                   mode: 384
-                })
-              );
+                }),
+                catch: (cause) => new ReadyFileError({ cause, path: readyPath })
+              });
             }
             if (heartbeat !== null) yield* interrupt3(heartbeat);
             heartbeat = yield* forkDetach2(
@@ -21680,7 +21800,7 @@ Waiting for approval\u2026
           process.once(signal, () => runFork3(shutdown2));
       } else {
         return yield* new ExecutionNodeError({
-          message: "Usage: glass-connect [start|install] [--name NAME] | stop | status | uninstall | descriptor"
+          message: "Usage: glass-connect [start|install] [--name NAME] [--environment preview|production] [--cloud-origin URL] [--pairing-origin URL] [--identity-path PATH] | update | stop | status | uninstall | descriptor"
         });
       }
     });
@@ -21692,19 +21812,32 @@ Waiting for approval\u2026
 var glass_cloud_default = {
   origins: {
     production: "https://glasscloud-api-prod-lcuxsmngpdigrgum.naaiyyyy.workers.dev",
-    staging: "https://glasscloud-api-staging-rmhiqpuua7m4g6a3.naaiyyyy.workers.dev"
+    preview: "https://glasscloud-api-staging-rmhiqpuua7m4g6a3.naaiyyyy.workers.dev"
   },
   services: {
-    stagingTunnelControl: "glasscloud-tunnelcontrol-staging-uyzu7wweagwmmwd2"
+    previewTunnelControl: "glasscloud-tunnelcontrol-staging-uyzu7wweagwmmwd2"
   }
 };
 
 // npm/cli.ts
 import { homedir as homedir3 } from "node:os";
 import { join as join6 } from "node:path";
-var productionStateRoot = join6(homedir3(), ".glass", "production");
-process.env.GLASS_CLOUD_ORIGIN ??= glass_cloud_default.origins.production;
-process.env.GLASS_NODE_IDENTITY_PATH ??= join6(productionStateRoot, "execution-node.json");
+var args3 = process.argv.slice(2);
+var option3 = (name) => {
+  const index = args3.indexOf(name);
+  return index < 0 ? void 0 : args3[index + 1];
+};
+var requestedEnvironment = option3("--environment");
+if (requestedEnvironment !== void 0 && !["preview", "production"].includes(requestedEnvironment)) {
+  throw new Error("--environment must be preview or production.");
+}
+var environment = requestedEnvironment === "preview" ? "preview" : "production";
+var configuredOrigin = option3("--cloud-origin") ?? (requestedEnvironment === void 0 ? process.env.GLASS_CLOUD_ORIGIN : environment === "preview" ? glass_cloud_default.origins.preview : glass_cloud_default.origins.production) ?? (environment === "preview" ? glass_cloud_default.origins.preview : glass_cloud_default.origins.production);
+var productOrigin = option3("--pairing-origin") ?? process.env.GLASS_CONNECT_PAIRING_ORIGIN ?? configuredOrigin;
+var stateRoot = join6(homedir3(), ".glass", environment);
+process.env.GLASS_CLOUD_ORIGIN = configuredOrigin;
+process.env.GLASS_CONNECT_PAIRING_ORIGIN = productOrigin;
+process.env.GLASS_NODE_IDENTITY_PATH = option3("--identity-path") ?? (requestedEnvironment === void 0 && process.env.GLASS_NODE_IDENTITY_PATH !== void 0 ? process.env.GLASS_NODE_IDENTITY_PATH : join6(stateRoot, "execution-node.json"));
 process.env.GLASS_CONNECT_BUNDLED = "1";
 await Promise.resolve().then(() => (init_main(), main_exports));
 /*! Bundled license information:

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "glass-connect",
-  "version": "0.3.0",
+  "version": "1.0.0",
   "description": "Publish a computer to Glass with one command.",
   "license": "UNLICENSED",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/naaiyy/Glass.git",
+    "url": "git+https://github.com/Glass-HQ/Glass-cloud.git",
     "directory": "apps/execution-node/npm"
   },
   "bin": {