lecodes-cli 0.10.2 → 0.10.4

package/dist/index.js

@@ -2129,7 +2129,7 @@ var require_main = __commonJS((exports, module) => {
 // package.json
 var package_default = {
   name: "lecodes-cli",
-  version: "0.10.2",
+  version: "0.10.4",
   dependencies: {
     "@letary/chisel": "^0.6.0"
   },
@@ -2210,8 +2210,10 @@ var c = {
   yellow: (s) => paint("33", s),
   cyan: (s) => paint("36", s)
 };
-var log = (msg = "") => process.stdout.write(msg + `
+var log = (msg = "") => {
+  process.stdout.write(msg + `
 `);
+};
 var info = (msg) => log(msg);
 var success = (msg) => log(c.green("✓ ") + msg);
 var warn = (msg) => log(c.yellow("! ") + msg);
@@ -2523,6 +2525,12 @@ var sync = (apiUrl, token, uuid, payload) => apiRequest(apiUrl, `/projects/${uui
 var publishProject = (apiUrl, token, uuid) => apiRequest(apiUrl, `/projects/${uuid}/publish`, { token, body: {} });
 var enableDesignShare = (apiUrl, token, uuid) => apiRequest(apiUrl, `/projects/${uuid}/design/share`, { token, body: {} });
 var disableDesignShare = (apiUrl, token, uuid) => apiRequest(apiUrl, `/projects/${uuid}/design/share`, { token, method: "DELETE" });
+var sendPush = (apiUrl, token, uuid, payload) => apiRequest(apiUrl, `/projects/${uuid}/push/send`, { token, body: payload });
+var listPushDevices = (apiUrl, token, uuid, user) => apiRequest(apiUrl, `/projects/${uuid}/push/registrations${user ? `?user=${encodeURIComponent(user)}` : ""}`, { token });
+var forgetPushDevice = (apiUrl, token, uuid, address) => apiRequest(apiUrl, `/projects/${uuid}/push/registrations/${encodeURIComponent(address)}`, { token, method: "DELETE" });
+var listPushKeys = (apiUrl, token, uuid) => apiRequest(apiUrl, `/projects/${uuid}/push/keys`, { token });
+var createPushKey = (apiUrl, token, uuid, name) => apiRequest(apiUrl, `/projects/${uuid}/push/keys`, { token, body: { name } });
+var revokePushKey = (apiUrl, token, uuid, id) => apiRequest(apiUrl, `/projects/${uuid}/push/keys/${id}`, { token, method: "DELETE" });
 var downloadBlob = async (apiUrl, src) => {
   const resp = await fetch(`${apiUrl}${src}`);
   if (!resp.ok)
@@ -3047,6 +3055,7 @@ var pbxprojTemplate = ({ displayName, bundleId, teamId, version, buildNumber })
   const target = `
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
 				ASSETCATALOG_COMPILER_GLOBAL_ACCENT_COLOR_NAME = AccentColor;
+				CODE_SIGN_ENTITLEMENTS = "App/App.entitlements";
 				CODE_SIGN_STYLE = Automatic;
 				CURRENT_PROJECT_VERSION = ${buildNumber};
 				DEVELOPMENT_TEAM = "${pbxStr(teamId)}";
@@ -3154,6 +3163,7 @@ var pbxprojTemplate = ({ displayName, bundleId, teamId, version, buildNumber })
 		B73550792FEBAC100005B4CC /* Exceptions for "App" folder in "App" target */ = {
 			isa = PBXFileSystemSynchronizedBuildFileExceptionSet;
 			membershipExceptions = (
+				App.entitlements,
 				Info.plist,
 			);
 			target = B73550662FEBAC0F0005B4CC /* App */;
@@ -3433,14 +3443,30 @@ var APP_DELEGATE = `//
 //
 
 import UIKit
+import LeCodesRuntime
 
 @main
 class AppDelegate: UIResponder, UIApplicationDelegate {
 
     func application(_ application: UIApplication, didFinishLaunchingWithOptions launchOptions: [UIApplication.LaunchOptionsKey: Any]?) -> Bool {
+        // Plugin hook surface: installs the notification-center delegate (must be in
+        // place before the app finishes launching) and buffers launch-time events until
+        // a plugin that needs them registers. Inert if no installed plugin consumes it.
+        LeCodesAppHooks.install()
         return true
     }
 
+    // APNs token callbacks → the plugin hook surface (consumed by the push plugin).
+    func application(_ application: UIApplication,
+                     didRegisterForRemoteNotificationsWithDeviceToken deviceToken: Data) {
+        LeCodesAppHooks.remoteNotificationsToken(deviceToken)
+    }
+
+    func application(_ application: UIApplication,
+                     didFailToRegisterForRemoteNotificationsWithError error: Error) {
+        LeCodesAppHooks.remoteNotificationsError(error)
+    }
+
     // MARK: UISceneSession Lifecycle
 
     func application(_ application: UIApplication, configurationForConnecting connectingSceneSession: UISceneSession, options: UIScene.ConnectionOptions) -> UISceneConfiguration {
@@ -3454,6 +3480,7 @@ var SCENE_DELEGATE = `//
 //
 
 import UIKit
+import LeCodesRuntime
 
 class SceneDelegate: UIResponder, UIWindowSceneDelegate {
 
@@ -3466,6 +3493,13 @@ class SceneDelegate: UIResponder, UIWindowSceneDelegate {
     ) {
         guard let windowScene = (scene as? UIWindowScene) else { return }
 
+        // Cold-started by a notification tap: buffered by the hooks; a plugin that
+        // consumes it (push) drains the buffer when it registers — before the JS world
+        // boots, because makeKeyAndVisible() runs registerBundledPlugins via viewDidLoad.
+        if let response = connectionOptions.notificationResponse {
+            LeCodesAppHooks.coldStartNotification(response)
+        }
+
         let window = UIWindow(windowScene: windowScene)
         window.rootViewController = ViewController()
         self.window = window
@@ -3519,6 +3553,47 @@ class ViewController: LeCodesViewController {
     }
 }
 `;
+var plistValue = (value, indent) => {
+  if (typeof value === "string")
+    return `<string>${value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;")}</string>`;
+  if (typeof value === "boolean")
+    return value ? "<true/>" : "<false/>";
+  if (typeof value === "number")
+    return Number.isInteger(value) ? `<integer>${value}</integer>` : `<real>${value}</real>`;
+  if (Array.isArray(value)) {
+    if (value.length === 0)
+      return "<array/>";
+    return `<array>
+${value.map((v) => `${indent}	${plistValue(v, indent + "\t")}`).join(`
+`)}
+${indent}</array>`;
+  }
+  if (value && typeof value === "object") {
+    const entries = Object.entries(value);
+    if (entries.length === 0)
+      return "<dict/>";
+    return `<dict>
+${entries.map(([k, v]) => `${indent}	<key>${k}</key>
+${indent}	${plistValue(v, indent + "\t")}`).join(`
+`)}
+${indent}</dict>`;
+  }
+  return "<string></string>";
+};
+var entitlementsTemplate = (entries) => {
+  const keys = Object.keys(entries).sort();
+  const body = keys.length === 0 ? "" : keys.map((k) => `	<key>${k}</key>
+	${plistValue(entries[k], "\t")}`).join(`
+`) + `
+`;
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+${body}</dict>
+</plist>
+`;
+};
 var infoPlistTemplate = (pluginKeys, updateUrl) => {
   const xml = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
   const keys = Object.keys(pluginKeys).sort();
@@ -3684,12 +3759,17 @@ let package = Package(
 )
 `;
 };
-var runtimeSwiftTemplate = (plugins) => {
+var runtimeSwiftTemplate = (plugins, projectUuid) => {
   const imports = plugins.map((p) => `import ${p.module}
 `).join("");
-  const calls = plugins.length === 0 ? `
-` : plugins.map((p) => `    ${p.register}.register(in: engine)
+  const identity = !projectUuid ? "" : `    // World identity: this shell IS the project — the engine attributes the boot world so
+    // identity-gated services (push registration) see the app's uuid from its first
+    // synchronous statement. Baked from .lecodes/manifest.json by \`lecodes app sync\`.
+    engine.bootProjectUuid = "${projectUuid}"
+`;
+  const calls = plugins.map((p) => `    ${p.register}.register(in: engine)
 `).join("");
+  const body = identity + calls;
   return `//
 //  LeCodesRuntime.swift
 //  GENERATED by lecodes — regenerated by \`lecodes app sync\`; do not edit.
@@ -3701,7 +3781,8 @@ var runtimeSwiftTemplate = (plugins) => {
 @_exported import LeCodesSDK
 ${imports}
 public func registerBundledPlugins(in engine: LeCodesEngine) {
-${calls}}
+${body === "" ? `
+` : body}}
 `;
 };
 var IOS_README = `# ios/ — native Xcode shell
@@ -3754,6 +3835,7 @@ CLI-owned — regenerated on every sync, hand edits are overwritten:
   the app runs fully offline. Globs in app.json \`"resources": {"remote": [...]}\` opt heavy
   assets (videos, big models) back into streaming from the server instead.
 - \`App/Info.plist\` — template + the installed plugins' usage keys
+- \`App/App.entitlements\` — the capabilities the installed plugins declare (e.g. push)
 - \`LeCodesRuntime/\` — local Swift package: the LeCodesSDK dependency, vendored plugin
   sources (Sources/<Module>/), and the registerBundledPlugins entry point
 - the version values inside \`App.xcodeproj/project.pbxproj\` (from app.json)
@@ -3788,9 +3870,12 @@ buildNumber) — edit it there, then re-run \`lecodes app sync\`. Plugins are ma
 var SDK_REPO = "letary/lecodes-ios-sdk";
 var SDK_MIN_VERSION = "1.2.0";
 var SDK_VARIANTS = ["core", "2d", "3d", "full"];
+var SDK_IDENTITY_VERSION = "1.6.0";
 var FIRST_PARTY_PLUGINS = {
   camera: "letary/lecodes-plugins",
-  "qr-scanner": "letary/lecodes-plugins"
+  "qr-scanner": "letary/lecodes-plugins",
+  geolocation: "letary/lecodes-plugins",
+  push: "letary/lecodes-plugins"
 };
 var readJson = (path) => {
   if (!existsSync9(path))
@@ -3994,6 +4079,7 @@ ios/
   write("App/SceneDelegate.swift", SCENE_DELEGATE);
   write("App/ViewController.swift", VIEW_CONTROLLER);
   write("App/Info.plist", infoPlistTemplate({}));
+  write("App/App.entitlements", entitlementsTemplate({}));
   write("App/Base.lproj/LaunchScreen.storyboard", LAUNCH_STORYBOARD);
   write("App/Assets.xcassets/Contents.json", ASSETS_ROOT_JSON);
   write("App/Assets.xcassets/AccentColor.colorset/Contents.json", ACCENT_COLOR_JSON);
@@ -4096,6 +4182,7 @@ var appSync = async (_args) => {
   const pluginSpecs = Object.entries(config.plugins ?? {});
   const runtimePlugins = [];
   const infoValues = {};
+  const entitlementValues = {};
   const newLock = {};
   const sourcesDir = join11(iosDir, "LeCodesRuntime", "Sources");
   for (const [id, spec] of pluginSpecs) {
@@ -4112,11 +4199,14 @@ var appSync = async (_args) => {
     rmSync(dest, { recursive: true, force: true });
     cpSync(src, dest, { recursive: true });
     if (ios.minSdk && VERSION_RE.test(ios.minSdk) && cmpVersion(sdkVersion, ios.minSdk) < 0) {
-      warn(`Plugin "${id}" needs lecodes-ios-sdk ${ios.minSdk} but the shell links ${sdkVersion} — run \`lecodes app update\` (or set app.json ios.sdk).`);
+      throw new CliError(`Plugin "${id}" needs lecodes-ios-sdk ${ios.minSdk} but the shell links ${sdkVersion} — run \`lecodes app update\` (or set app.json ios.sdk).`);
     }
     for (const [key, value] of Object.entries(ios.infoPlist ?? {})) {
       (infoValues[key] ??= []).push(value);
     }
+    for (const [key, value] of Object.entries(ios.entitlements ?? {})) {
+      (entitlementValues[key] ??= []).push(value);
+    }
     runtimePlugins.push({ id, module, register });
     newLock[id] = plugin.lock;
     log(`${c.green("plugin")}    ${id}@${plugin.lock.version} (${plugin.lock.tag} → Sources/${module})`);
@@ -4186,9 +4276,21 @@ var appSync = async (_args) => {
   const streamed = resources.filter((r) => r.remote);
   if (streamed.length > 0)
     log(`${c.green("remote")}    ${streamed.length} resource(s) stay on the server (resources.remote): ${streamed.map((r) => r.path).join(", ")}`);
+  let shellUuid;
+  try {
+    shellUuid = readManifest(root).uuid;
+  } catch {}
+  if (shellUuid && cmpVersion(sdkVersion, SDK_IDENTITY_VERSION) < 0) {
+    if (runtimePlugins.some((p) => p.id === "push")) {
+      warn(`push needs the shell's world identity, which lecodes-ios-sdk ${SDK_IDENTITY_VERSION}+ carries — this shell links ${sdkVersion}, so Push.register() will reject "unavailable". Run \`lecodes app update\` when ${SDK_IDENTITY_VERSION} is out.`);
+    }
+    shellUuid = undefined;
+  }
+  if (shellUuid)
+    log(`${c.green("identity")}  project ${shellUuid} baked into the shell (world identity)`);
   writeFileSync7(join11(iosDir, "README.md"), IOS_README);
   writeFileSync7(join11(iosDir, "LeCodesRuntime", "Package.swift"), runtimePackageTemplate(sdkVersion, variant, runtimePlugins));
-  writeFileSync7(join11(sourcesDir, "LeCodesRuntime", "LeCodesRuntime.swift"), runtimeSwiftTemplate(runtimePlugins));
+  writeFileSync7(join11(sourcesDir, "LeCodesRuntime", "LeCodesRuntime.swift"), runtimeSwiftTemplate(runtimePlugins, shellUuid));
   const mergedKeys = {};
   for (const [key, values] of Object.entries(infoValues))
     mergedKeys[key] = [...new Set(values)].join(" ");
@@ -4199,7 +4301,43 @@ var appSync = async (_args) => {
   if (pluginSpecs.length > 0 || existsSync9(lockPath))
     writeJson(lockPath, { plugins: newLock });
   const pbxPath = join11(iosDir, "App.xcodeproj", "project.pbxproj");
-  const pbx = readFileSync10(pbxPath, "utf8").replace(/MARKETING_VERSION = [^;]+;/g, `MARKETING_VERSION = ${config.version ?? "1.0.0"};`).replace(/CURRENT_PROJECT_VERSION = [^;]+;/g, `CURRENT_PROJECT_VERSION = ${config.ios.buildNumber ?? 1};`);
+  let pbx = readFileSync10(pbxPath, "utf8").replace(/MARKETING_VERSION = [^;]+;/g, `MARKETING_VERSION = ${config.version ?? "1.0.0"};`).replace(/CURRENT_PROJECT_VERSION = [^;]+;/g, `CURRENT_PROJECT_VERSION = ${config.ios.buildNumber ?? 1};`);
+  const mergedEntitlements = {};
+  for (const [key, values] of Object.entries(entitlementValues)) {
+    if (values.every((v) => Array.isArray(v))) {
+      const seen = new Set;
+      mergedEntitlements[key] = values.flat().filter((v) => {
+        const s = JSON.stringify(v);
+        if (seen.has(s))
+          return false;
+        seen.add(s);
+        return true;
+      });
+    } else {
+      if (new Set(values.map((v) => JSON.stringify(v))).size > 1) {
+        warn(`entitlement ${key}: plugins declare conflicting values — keeping ${JSON.stringify(values[0])}`);
+      }
+      mergedEntitlements[key] = values[0];
+    }
+  }
+  const hasEntitlements = Object.keys(mergedEntitlements).length > 0;
+  if (pbx.includes("CODE_SIGN_ENTITLEMENTS") || hasEntitlements) {
+    writeFileSync7(join11(iosDir, "App", "App.entitlements"), entitlementsTemplate(mergedEntitlements));
+    if (hasEntitlements)
+      log(`${c.green("caps")}      App/App.entitlements: ${Object.keys(mergedEntitlements).sort().join(", ")}`);
+    if (!pbx.includes("CODE_SIGN_ENTITLEMENTS")) {
+      const patched = pbx.replace(/^(\s*)CODE_SIGN_STYLE = /gm, `$1CODE_SIGN_ENTITLEMENTS = "App/App.entitlements";
+$1CODE_SIGN_STYLE = `);
+      if (patched === pbx) {
+        warn(`couldn't wire App.entitlements into the pbxproj — add CODE_SIGN_ENTITLEMENTS = "App/App.entitlements" to the App target's build settings in Xcode.`);
+      } else {
+        pbx = patched.replace(/^(\s*)membershipExceptions = \(\n(\s*)Info\.plist,/m, `$1membershipExceptions = (
+$2App.entitlements,
+$2Info.plist,`);
+        log(`${c.green("updated")}   App.xcodeproj: CODE_SIGN_ENTITLEMENTS → App/App.entitlements`);
+      }
+    }
+  }
   writeFileSync7(pbxPath, pbx);
   log("");
   success(`Shell synced: app.js + ${runtimePlugins.length} plugin(s), SDK ${sdkVersion}, variant ${variant}, v${config.version ?? "1.0.0"} (${config.ios.buildNumber ?? 1}).`);
@@ -4426,6 +4564,15 @@ var appDoctor = async (_args) => {
   const wanted = Object.keys(config.plugins ?? {});
   const inSync = wanted.every((id) => lock[id]) && Object.keys(lock).every((id) => wanted.includes(id));
   check(wanted.length === 0 || inSync, "Plugins synced", "run `lecodes app sync`");
+  const pbxFile = join11(root, "ios", "App.xcodeproj", "project.pbxproj");
+  if (existsSync9(pbxFile) && readFileSync10(pbxFile, "utf8").includes("CODE_SIGN_ENTITLEMENTS")) {
+    check(existsSync9(join11(root, "ios", "App", "App.entitlements")), "App/App.entitlements present", "run `lecodes app sync`");
+  }
+  if (wanted.includes("push")) {
+    const runtimeSwift = join11(root, "ios", "LeCodesRuntime", "Sources", "LeCodesRuntime", "LeCodesRuntime.swift");
+    const baked = existsSync9(runtimeSwift) && readFileSync10(runtimeSwift, "utf8").includes("bootProjectUuid");
+    check(baked, "Push world identity baked", `without it Push.register() rejects "unavailable" — needs a pushed project (uuid), lecodes-ios-sdk ${SDK_IDENTITY_VERSION}+ and \`lecodes app sync\``, false);
+  }
   if (config.update) {
     const plist = readFileSync10(join11(root, "ios", "App", "Info.plist"), "utf8");
     check(plist.includes("<key>LeCodesUpdateURL</key>"), "OTA update URL in Info.plist", "run `lecodes app sync`", false);
@@ -7546,9 +7693,264 @@ var render = async (args) => {
   return done((cb) => process.stdout.write(text, cb));
 };
 
+// src/commands/pn.ts
+import { appendFileSync as appendFileSync2, existsSync as existsSync18, readFileSync as readFileSync19, writeFileSync as writeFileSync15 } from "node:fs";
+import { join as join19 } from "node:path";
+var ENV_VAR = "LECODES_PUSH_KEY";
+var context = () => {
+  const root = findProjectRoot(process.cwd());
+  const manifest = readManifest(root);
+  const config = loadConfig();
+  return { root, uuid: manifest.uuid, name: manifest.name, apiUrl: requireApiUrl(config), token: requireToken(config) };
+};
+var ago = (iso) => {
+  if (!iso)
+    return c.dim("never");
+  const ms = Date.now() - new Date(iso).getTime();
+  if (!Number.isFinite(ms))
+    return c.dim("—");
+  const mins = Math.round(ms / 60000);
+  if (mins < 1)
+    return "just now";
+  if (mins < 60)
+    return `${mins}m ago`;
+  const hours = Math.round(mins / 60);
+  if (hours < 24)
+    return `${hours}h ago`;
+  return `${Math.round(hours / 24)}d ago`;
+};
+var ANSI = /\x1b\[[0-9;]*m/g;
+var printed = (s) => s.replace(ANSI, "").length;
+var table = (rows) => {
+  const widths = rows[0].map((_, i) => Math.max(...rows.map((r) => printed(r[i] ?? ""))));
+  for (const row of rows) {
+    const cells = row.map((cell, i) => i === row.length - 1 ? cell : cell + " ".repeat(Math.max(0, widths[i] - printed(cell))));
+    log("  " + cells.join("  "));
+  }
+};
+var listFlag = (args, ...keys) => {
+  const raw = flagStr(args, ...keys);
+  if (!raw)
+    return [];
+  return [...new Set(raw.split(",").map((s) => s.trim()).filter(Boolean))];
+};
+var pnSend = async (args) => {
+  const ctx = context();
+  const title = flagStr(args, "title", "t") ?? args._[1];
+  if (!title)
+    throw new CliError('A title is required: lecodes pn send --title "Order shipped" --user u42');
+  const users = listFlag(args, "user", "users", "u");
+  const to = listFlag(args, "to", "address", "addresses");
+  if (users.length === 0 && to.length === 0) {
+    throw new CliError("Nothing to send to — pass --user <id> (from Push.register({ user })) or --to <pa_…>. `lecodes pn devices` lists both.");
+  }
+  const badgeRaw = flagStr(args, "badge");
+  const badge = badgeRaw === undefined ? undefined : Number(badgeRaw);
+  if (badge !== undefined && !Number.isInteger(badge))
+    throw new CliError(`--badge must be a whole number (got "${badgeRaw}")`);
+  const dataRaw = flagStr(args, "data");
+  let data;
+  if (dataRaw !== undefined) {
+    try {
+      data = JSON.parse(dataRaw);
+    } catch {
+      throw new CliError(`--data must be a JSON object, e.g. --data '{"orderId":42}'`);
+    }
+    if (!data || typeof data !== "object" || Array.isArray(data))
+      throw new CliError(`--data must be a JSON object, e.g. --data '{"orderId":42}'`);
+  }
+  const payload = {
+    title,
+    body: flagStr(args, "body", "b"),
+    url: flagStr(args, "url"),
+    users: users.length ? users : undefined,
+    to: to.length ? to : undefined,
+    data,
+    badge
+  };
+  const result = await sendPush(ctx.apiUrl, ctx.token, ctx.uuid, payload);
+  if (result.sent > 0)
+    success(`Sent to ${result.sent} device${result.sent === 1 ? "" : "s"}.`);
+  if (result.failed.length === 0) {
+    if (result.sent === 0) {
+      warn("Matched 0 devices — nobody with that user id has registered. Run `lecodes pn devices` to see who has.");
+    }
+    return;
+  }
+  warn(`${result.failed.length} failed:`);
+  for (const failure of result.failed)
+    log(`  ${c.dim(failure.address)}  ${c.red(failure.reason)}`);
+};
+var deviceLabel = (device) => {
+  const env = device.environment === "sandbox" ? c.yellow(" sandbox") : "";
+  return `${device.platform}${env}`;
+};
+var pnDevices = async (args) => {
+  const ctx = context();
+  const user = flagStr(args, "user", "u");
+  const forget = flagStr(args, "forget");
+  if (forget) {
+    if (!flagBool(args, "yes", "y")) {
+      warn(`Forgetting ${c.bold(forget)} — sends to this address stop immediately. The device gets a NEW address on its next Push.register().`);
+      if (!await confirm("Forget it?"))
+        return info("Cancelled.");
+    }
+    await forgetPushDevice(ctx.apiUrl, ctx.token, ctx.uuid, forget);
+    success(`Forgot ${c.bold(forget)}.`);
+    return;
+  }
+  const { devices, truncated } = await listPushDevices(ctx.apiUrl, ctx.token, ctx.uuid, user);
+  if (devices.length === 0) {
+    info(user ? `No devices registered for user ${c.bold(user)} in ${c.bold(ctx.name)}.` : `No devices registered in ${c.bold(ctx.name)} yet.`);
+    info(c.dim("A device appears here after the app calls Push.register(). Note that `lecodes dev`"));
+    info(c.dim("bundles are unattributed — register() rejects there; open a PUBLISHED project via QR."));
+    return;
+  }
+  info(`${devices.length} device${devices.length === 1 ? "" : "s"} in ${c.bold(ctx.name)}${user ? ` for user ${c.bold(user)}` : ""}:`);
+  table([
+    [c.dim("ADDRESS"), c.dim("PLATFORM"), c.dim("USER"), c.dim("HOST"), c.dim("LAST SEEN")],
+    ...devices.map((device) => [
+      device.disabledAt ? c.dim(device.address) : device.address,
+      deviceLabel(device),
+      device.user ?? c.dim("—"),
+      device.hostApp,
+      device.disabledAt ? c.red("disabled") : ago(device.lastSeenAt)
+    ])
+  ]);
+  if (devices.some((d) => d.disabledAt)) {
+    info(c.dim("Disabled = the provider reported a dead token; re-registering from the device revives it."));
+  }
+  if (truncated)
+    warn("Showing the 200 most recently seen — there are more.");
+};
+var pnKeysList = async (ctx) => {
+  const keys = await listPushKeys(ctx.apiUrl, ctx.token, ctx.uuid);
+  if (keys.length === 0) {
+    info(`No push keys in ${c.bold(ctx.name)}.`);
+    info(c.dim("You only need one to send from your OWN server — `lecodes pn send` uses your login."));
+    info(c.dim('Mint one with `lecodes pn keys new "prod server" --env`.'));
+    return;
+  }
+  info(`${keys.length} push key${keys.length === 1 ? "" : "s"} in ${c.bold(ctx.name)}:`);
+  table([
+    [c.dim("ID"), c.dim("NAME"), c.dim("KEY"), c.dim("LAST USED")],
+    ...keys.map((key) => [String(key.id), key.name, `${key.prefix}${c.dim("…")}`, ago(key.lastUsedAt)])
+  ]);
+};
+var writeEnv = (root, key) => {
+  const touched = [];
+  const envPath = join19(root, ".env");
+  const line = `${ENV_VAR}=${key}`;
+  const existing = existsSync18(envPath) ? readFileSync19(envPath, "utf8") : "";
+  if (new RegExp(`^${ENV_VAR}=`, "m").test(existing)) {
+    writeFileSync15(envPath, existing.replace(new RegExp(`^${ENV_VAR}=.*$`, "m"), line));
+  } else {
+    const separator = !existing || existing.endsWith(`
+`) ? "" : `
+`;
+    appendFileSync2(envPath, `${separator}${line}
+`);
+  }
+  touched.push(".env");
+  const ignorePath = join19(root, ".gitignore");
+  const ignore = existsSync18(ignorePath) ? readFileSync19(ignorePath, "utf8") : "";
+  if (!ignore.split(`
+`).some((l) => l.trim() === ".env")) {
+    const separator = !ignore || ignore.endsWith(`
+`) ? "" : `
+`;
+    appendFileSync2(ignorePath, `${separator}.env
+`);
+    touched.push(".gitignore");
+  }
+  return touched;
+};
+var pnKeysNew = async (ctx, args) => {
+  const name = args._[2] ?? flagStr(args, "name");
+  const created = await createPushKey(ctx.apiUrl, ctx.token, ctx.uuid, name);
+  success(`Created push key ${c.bold(created.name)} (id ${created.id}).`);
+  log();
+  log(`  ${c.bold(created.key)}`);
+  log();
+  if (flagBool(args, "env")) {
+    const touched = writeEnv(ctx.root, created.key);
+    success(`Wrote ${ENV_VAR} to ${touched.join(" + ")}.`);
+  } else {
+    warn("Copy it now — it is never shown again. Lose it and you mint a new one.");
+    info(c.dim(`  Tip: \`lecodes pn keys new --env\` writes it straight into .env as ${ENV_VAR}.`));
+  }
+  log();
+  info(c.dim("Send from your server with:"));
+  log(c.dim(`  curl -X POST ${ctx.apiUrl}/api/projects/${ctx.uuid}/push/send \\`));
+  log(c.dim(`    -H "Authorization: Bearer $${ENV_VAR}" -H "Content-Type: application/json" \\`));
+  log(c.dim(`    -d '{"title":"Order shipped","users":["u42"]}'`));
+};
+var pnKeysRevoke = async (ctx, args) => {
+  const raw = args._[2];
+  if (!raw)
+    throw new CliError("Which key? `lecodes pn keys` lists their ids, then `lecodes pn keys revoke <id>`.");
+  const id = Number(raw);
+  if (!Number.isInteger(id))
+    throw new CliError(`"${raw}" is not a key id — run \`lecodes pn keys\` to see them.`);
+  const keys = await listPushKeys(ctx.apiUrl, ctx.token, ctx.uuid);
+  const key = keys.find((k) => k.id === id);
+  if (!key)
+    throw new CliError(`No push key with id ${id} in ${ctx.name}.`);
+  if (!flagBool(args, "yes", "y")) {
+    warn(`Revoking ${c.bold(key.name)} (${key.prefix}…) — any server still using it stops sending immediately.`);
+    if (!await confirm("Revoke it?"))
+      return info("Cancelled.");
+  }
+  await revokePushKey(ctx.apiUrl, ctx.token, ctx.uuid, id);
+  success(`Revoked push key ${c.bold(key.name)}.`);
+};
+var pnKeys = async (args) => {
+  const ctx = context();
+  const sub = args._[1];
+  if (!sub || sub === "list")
+    return pnKeysList(ctx);
+  if (sub === "new" || sub === "create")
+    return pnKeysNew(ctx, args);
+  if (sub === "revoke" || sub === "delete" || sub === "rm")
+    return pnKeysRevoke(ctx, args);
+  throw new CliError(`Unknown keys command "${sub}" — use: lecodes pn keys [list | new [name] | revoke <id>]`);
+};
+var PN_HELP = `${c.bold("lecodes pn")} — push notifications for this project.
+
+${c.bold("Commands:")}
+  pn send --title <s>           Send a notification (uses your login — no key needed)
+                                  --body <s>      second line
+                                  --url <s>       deep link (also arrives as app.launchUrl)
+                                  --user <ids>    target Push.register({ user }) ids, comma-separated
+                                  --to <pa_…>     target addresses, comma-separated
+                                  --badge <n>     app icon badge
+                                  --data <json>   your JSON payload (≤ 2 KB)
+  pn devices                    List the devices that registered for this project
+                                  --user <id>     only that user's devices
+                                  --forget <pa_…> drop a dead registration (-y to skip confirm)
+  pn keys                       List this project's push keys
+  pn keys new [name]            Mint one for YOUR server (owner only; shown once)
+                                  --env           write it to .env as ${ENV_VAR} (+ gitignore)
+  pn keys revoke <id>           Revoke a key (-y to skip the confirmation)
+
+${c.dim("A push key is generated BY the server — you can't choose or recover one. It only sends")}
+${c.dim("for this project, which is why deploying it beats deploying a personal access token.")}`;
+var pn = async (args) => {
+  const sub = args._[0];
+  if (!sub || sub === "help")
+    return log(PN_HELP);
+  if (sub === "send")
+    return pnSend(args);
+  if (sub === "devices" || sub === "device")
+    return pnDevices(args);
+  if (sub === "keys" || sub === "key")
+    return pnKeys(args);
+  throw new CliError(`Unknown pn command "${sub}" — use: lecodes pn <send | devices | keys>. Run \`lecodes pn\` for the full list.`);
+};
+
 // src/commands/pull.ts
-import { existsSync as existsSync18, mkdirSync as mkdirSync14, rmSync as rmSync3, writeFileSync as writeFileSync15 } from "node:fs";
-import { dirname as dirname12, join as join19 } from "node:path";
+import { existsSync as existsSync19, mkdirSync as mkdirSync14, rmSync as rmSync3, writeFileSync as writeFileSync16 } from "node:fs";
+import { dirname as dirname12, join as join20 } from "node:path";
 var pull = async (args) => {
   const root = findProjectRoot(process.cwd());
   const manifest = readManifest(root);
@@ -7568,8 +7970,8 @@ var pull = async (args) => {
   const remotePaths = new Set([...buildPaths(project.assets).entries()].filter(([id]) => project.assets.find((a) => a.id === id)?.type !== "folder").map(([, path]) => path));
   for (const path of Object.keys(manifest.files)) {
     if (!remotePaths.has(path)) {
-      const abs = join19(root, ...path.replace(/^\//, "").split("/"));
-      if (existsSync18(abs))
+      const abs = join20(root, ...path.replace(/^\//, "").split("/"));
+      if (existsSync19(abs))
         rmSync3(abs);
     }
   }
@@ -7607,18 +8009,18 @@ var pullPaths = async (root, manifest, project, paths, apiUrl, token) => {
   const files = { ...manifest.files };
   for (const asset of targets) {
     const key = pathById.get(asset.id);
-    const abs = join19(root, ...key.replace(/^\//, "").split("/"));
+    const abs = join20(root, ...key.replace(/^\//, "").split("/"));
     mkdirSync14(dirname12(abs), { recursive: true });
     let sha;
     if (asset.type === "file") {
       if (!asset.file?.src)
         continue;
       const bytes = await downloadBlob(apiUrl, asset.file.src);
-      writeFileSync15(abs, bytes);
+      writeFileSync16(abs, bytes);
       sha = sha256(bytes);
     } else {
       const text = asset.text ?? "";
-      writeFileSync15(abs, text);
+      writeFileSync16(abs, text);
       sha = sha256(text);
     }
     files[key] = { id: asset.id, type: kindOf3(asset.type), sha };
@@ -7630,22 +8032,22 @@ var pullPaths = async (root, manifest, project, paths, apiUrl, token) => {
 };
 
 // src/commands/scene.ts
-import { existsSync as existsSync20, readFileSync as readFileSync20, readdirSync as readdirSync9, statSync as statSync5, writeFileSync as writeFileSync16 } from "node:fs";
-import { basename as basename12, dirname as dirname13, join as join21, resolve as resolve8 } from "node:path";
+import { existsSync as existsSync21, readFileSync as readFileSync21, readdirSync as readdirSync9, statSync as statSync5, writeFileSync as writeFileSync17 } from "node:fs";
+import { basename as basename12, dirname as dirname13, join as join22, resolve as resolve8 } from "node:path";
 
 // src/compile/sceneCompile.ts
-import { existsSync as existsSync19, readFileSync as readFileSync19 } from "node:fs";
-import { join as join20 } from "node:path";
+import { existsSync as existsSync20, readFileSync as readFileSync20 } from "node:fs";
+import { join as join21 } from "node:path";
 var TEXT_EXT = /\.(ts|js|json|svg|txt|md)$/i;
 var rel = (key) => key.replace(/^\//, "");
 var resolveHarness = (loadSceneHarness2) => {
-  const inRepo = join20(distRoot, "..", "projects", "src", "scene-editor");
+  const inRepo = join21(distRoot, "..", "projects", "src", "scene-editor");
   try {
-    return loadSceneHarness2(existsSync19(inRepo) ? inRepo : undefined);
+    return loadSceneHarness2(existsSync20(inRepo) ? inRepo : undefined);
   } catch {
-    const vendored = join20(distRoot, "runtime", "scene-harness.json");
-    if (existsSync19(vendored))
-      return JSON.parse(readFileSync19(vendored, "utf8"));
+    const vendored = join21(distRoot, "runtime", "scene-harness.json");
+    if (existsSync20(vendored))
+      return JSON.parse(readFileSync20(vendored, "utf8"));
     throw new CliError("scene-editor harness sources not found — reinstall the CLI or set LECODES_SCENE_HARNESS_DIR.");
   }
 };
@@ -7657,7 +8059,7 @@ var compileSceneEditor = async (opts) => {
   for (const file of scan.files) {
     const path = "./" + rel(file.path);
     if (TEXT_EXT.test(path)) {
-      entries.push({ path, type: "text", text: readFileSync19(file.absPath, "utf8") });
+      entries.push({ path, type: "text", text: readFileSync20(file.absPath, "utf8") });
     } else {
       entries.push({ path, type: "resource", fileSrc: "/project/" + rel(file.path) });
     }
@@ -7698,9 +8100,9 @@ var getContext2 = (args) => {
     const pathArg = args._[0];
     if (pathArg) {
       const abs = resolve8(process.cwd(), pathArg);
-      if (existsSync20(abs) && statSync5(abs).isDirectory())
+      if (existsSync21(abs) && statSync5(abs).isDirectory())
         root = abs;
-      else if (abs.endsWith(".scene.ts") && existsSync20(abs))
+      else if (abs.endsWith(".scene.ts") && existsSync21(abs))
         root = dirname13(abs);
       else
         throw new CliError(`No such folder or .scene.ts: ${pathArg}`);
@@ -7709,12 +8111,12 @@ var getContext2 = (args) => {
   return { root, manifest, name: manifest?.name ?? basename12(root) };
 };
 var writeMcpConfig2 = (root, port) => {
-  const path = join21(root, ".mcp.json");
+  const path = join22(root, ".mcp.json");
   const entry = { type: "http", url: `http://localhost:${port}/mcp` };
   let config = {};
-  if (existsSync20(path)) {
+  if (existsSync21(path)) {
     try {
-      config = JSON.parse(readFileSync20(path, "utf8"));
+      config = JSON.parse(readFileSync21(path, "utf8"));
     } catch {
       warnErr(".mcp.json exists but isn't valid JSON — left it untouched. Add the lecodes-scene server by hand.");
       return;
@@ -7727,7 +8129,7 @@ var writeMcpConfig2 = (root, port) => {
     return;
   }
   config.mcpServers["lecodes-scene"] = entry;
-  writeFileSync16(path, JSON.stringify(config, null, 2) + `
+  writeFileSync17(path, JSON.stringify(config, null, 2) + `
 `);
   note(`${existing ? "updated" : "created"}   .mcp.json (lecodes-scene MCP → ${entry.url})`);
 };
@@ -7736,7 +8138,7 @@ var countScenes = (dir) => {
   for (const name of readdirSync9(dir)) {
     if (name === "node_modules" || name.startsWith("."))
       continue;
-    const full = join21(dir, name);
+    const full = join22(dir, name);
     if (statSync5(full).isDirectory())
       n += countScenes(full);
     else if (name.endsWith(".scene.ts"))
@@ -7807,7 +8209,7 @@ var status = async (_args) => {
 };
 
 // src/commands/test.ts
-import { existsSync as existsSync21, readFileSync as readFileSync21, readdirSync as readdirSync10 } from "node:fs";
+import { existsSync as existsSync22, readFileSync as readFileSync22, readdirSync as readdirSync10 } from "node:fs";
 import { dirname as dirname14, resolve as resolve9 } from "node:path";
 var deriveDesignFlows = (meta, entryScreen) => {
   const edges = meta.edges ?? [];
@@ -7869,7 +8271,7 @@ var slug3 = (s) => s.replace(/[^a-zA-Z0-9-_]+/g, "-").replace(/^-+|-+$/g, "").sl
 var readFlowFile = (abs, displayName) => {
   let raw;
   try {
-    raw = JSON.parse(readFileSync21(abs, "utf8"));
+    raw = JSON.parse(readFileSync22(abs, "utf8"));
   } catch (e) {
     throw new CliError(`Can't read "${displayName}": ${e instanceof Error ? e.message : String(e)}`);
   }
@@ -7902,29 +8304,29 @@ var test = async (args) => {
   if (args._.length > 0) {
     for (const given of args._) {
       const candidates = [resolve9(given), resolve9(testsDir, given), resolve9(testsDir, `${given}.flow.json`)];
-      const abs = candidates.find((p) => existsSync21(p));
+      const abs = candidates.find((p) => existsSync22(p));
       if (!abs)
         throw new CliError(`No such test: "${given}" (looked in ${testsDir}).`);
       cases.push(readFlowFile(abs, given));
     }
-  } else if (existsSync21(testsDir)) {
+  } else if (existsSync22(testsDir)) {
     for (const f2 of readdirSync10(testsDir).filter((f3) => f3.endsWith(".flow.json")).sort()) {
       cases.push(readFlowFile(resolve9(testsDir, f2), f2));
     }
   }
   const fixturesFlag = flagStr(args, "fixtures");
   const defaultPack = resolve9(testsDir, "fixtures.json");
-  const flowFixtures = fixturesFlag !== undefined ? resolveFixtures(fixturesFlag, ".") : existsSync21(defaultPack) ? resolveFixtures("fixtures.json", testsDir) : undefined;
+  const flowFixtures = fixturesFlag !== undefined ? resolveFixtures(fixturesFlag, ".") : existsSync22(defaultPack) ? resolveFixtures("fixtures.json", testsDir) : undefined;
   const flowsOnly = flagBool(args, "flows");
   const wantFlows = !flagBool(args, "no-flows") && args._.length === 0;
   if (flowsOnly)
     cases.length = 0;
   let skipped = [];
   let entryScreen = null;
-  if ((wantFlows || flowsOnly) && existsSync21(designMetaPath)) {
+  if ((wantFlows || flowsOnly) && existsSync22(designMetaPath)) {
     let meta;
     try {
-      meta = JSON.parse(readFileSync21(designMetaPath, "utf8"));
+      meta = JSON.parse(readFileSync22(designMetaPath, "utf8"));
     } catch (e) {
       throw new CliError(`Can't read ${designMetaPath}: ${e instanceof Error ? e.message : String(e)}`);
     }
@@ -8101,15 +8503,15 @@ var types = async (args) => {
 };
 
 // src/index.ts
-import { existsSync as existsSync23, readFileSync as readFileSync23, realpathSync as realpathSync2 } from "node:fs";
+import { existsSync as existsSync24, readFileSync as readFileSync24, realpathSync as realpathSync2 } from "node:fs";
 import { createRequire as createRequire4 } from "node:module";
-import { delimiter as delimiter2, dirname as dirname16, join as join23 } from "node:path";
+import { delimiter as delimiter2, dirname as dirname16, join as join24 } from "node:path";
 
 // src/commands/install.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { appendFileSync as appendFileSync2, chmodSync, cpSync as cpSync2, existsSync as existsSync22, mkdirSync as mkdirSync15, readFileSync as readFileSync22, realpathSync, rmSync as rmSync4, symlinkSync } from "node:fs";
+import { appendFileSync as appendFileSync3, chmodSync, cpSync as cpSync2, existsSync as existsSync23, mkdirSync as mkdirSync15, readFileSync as readFileSync23, realpathSync, rmSync as rmSync4, symlinkSync } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { basename as basename13, delimiter, dirname as dirname15, join as join22, resolve as resolve11, sep as sep2 } from "node:path";
+import { basename as basename13, delimiter, dirname as dirname15, join as join23, resolve as resolve11, sep as sep2 } from "node:path";
 var isWin = process.platform === "win32";
 var HOME = homedir3();
 var safeRealpath = (p) => {
@@ -8135,10 +8537,10 @@ var install = async (args) => {
   const bundle = dirname15(process.execPath);
   const exeName = basename13(process.execPath);
   const chiselName = isWin ? "chisel.exe" : "chisel";
-  if (!existsSync22(join22(bundle, "runtime")) || !existsSync22(join22(bundle, chiselName))) {
+  if (!existsSync23(join23(bundle, "runtime")) || !existsSync23(join23(bundle, chiselName))) {
     throw new CliError("`lecodes install` only works from the packaged release build (the archive containing lecodes + " + "chisel + runtime/). You appear to be running from source or an npm install — install globally " + "with your package manager there instead.");
   }
-  const companions = [exeName, chiselName, "runtime", "README.txt"].filter((f2) => existsSync22(join22(bundle, f2)));
+  const companions = [exeName, chiselName, "runtime", "README.txt"].filter((f2) => existsSync23(join23(bundle, f2)));
   if (isWin)
     return installWindows(args, bundle, companions);
   return installUnix(args, bundle, companions);
@@ -8148,9 +8550,9 @@ var copyBundle = (bundle, target, companions) => {
   if (safeRealpath(target) === safeRealpath(bundle))
     return;
   for (const f2 of companions) {
-    const dest = join22(target, f2);
+    const dest = join23(target, f2);
     rmSync4(dest, { recursive: true, force: true });
-    cpSync2(join22(bundle, f2), dest, { recursive: true });
+    cpSync2(join23(bundle, f2), dest, { recursive: true });
   }
 };
 var permError = (e, dir, system) => {
@@ -8162,44 +8564,44 @@ var permError = (e, dir, system) => {
 };
 var installUnix = (args, bundle, companions) => {
   const system = flagBool(args, "system");
-  const libDir = resolve11(flagStr(args, "dir") ?? (system ? "/usr/local/lib/lecodes-cli" : join22(HOME, ".local", "lib", "lecodes-cli")));
-  const binDir = resolve11(flagStr(args, "bin") ?? (system ? "/usr/local/bin" : join22(HOME, ".local", "bin")));
-  const link2 = join22(binDir, "lecodes");
+  const libDir = resolve11(flagStr(args, "dir") ?? (system ? "/usr/local/lib/lecodes-cli" : join23(HOME, ".local", "lib", "lecodes-cli")));
+  const binDir = resolve11(flagStr(args, "bin") ?? (system ? "/usr/local/bin" : join23(HOME, ".local", "bin")));
+  const link2 = join23(binDir, "lecodes");
   try {
     copyBundle(bundle, libDir, companions);
-    chmodSync(join22(libDir, "lecodes"), 493);
-    chmodSync(join22(libDir, "chisel"), 493);
+    chmodSync(join23(libDir, "lecodes"), 493);
+    chmodSync(join23(libDir, "chisel"), 493);
   } catch (e) {
     throw permError(e, libDir, system);
   }
   try {
     mkdirSync15(binDir, { recursive: true });
     rmSync4(link2, { force: true });
-    symlinkSync(join22(libDir, "lecodes"), link2);
+    symlinkSync(join23(libDir, "lecodes"), link2);
   } catch (e) {
     throw permError(e, binDir, system);
   }
   success(`Installed to ${c.bold(libDir)}`);
-  log(`  ${c.dim(link2 + " → " + join22(libDir, "lecodes"))}`);
+  log(`  ${c.dim(link2 + " → " + join23(libDir, "lecodes"))}`);
   finishPathUnix(args, binDir);
 };
 var shellRc = () => {
   const shell = basename13(process.env.SHELL ?? "");
   if (shell === "zsh")
-    return { file: join22(HOME, ".zshrc"), name: "~/.zshrc" };
+    return { file: join23(HOME, ".zshrc"), name: "~/.zshrc" };
   if (shell === "bash")
-    return { file: join22(HOME, ".bashrc"), name: "~/.bashrc" };
-  return { file: join22(HOME, ".profile"), name: "~/.profile" };
+    return { file: join23(HOME, ".bashrc"), name: "~/.bashrc" };
+  return { file: join23(HOME, ".profile"), name: "~/.profile" };
 };
 var PATH_MARKER = "# Added by `lecodes install`";
 var appendPathToShellRc = (binDir) => {
   const { file, name } = shellRc();
   const line = `export PATH="${binDir}:$PATH"`;
   try {
-    const existing = existsSync22(file) ? readFileSync22(file, "utf8") : "";
+    const existing = existsSync23(file) ? readFileSync23(file, "utf8") : "";
     if (existing.includes(line))
       return name;
-    appendFileSync2(file, `${existing && !existing.endsWith(`
+    appendFileSync3(file, `${existing && !existing.endsWith(`
 `) ? `
 ` : ""}
 ${PATH_MARKER}
@@ -8234,7 +8636,7 @@ var finishPathUnix = (args, binDir) => {
   log(`  • or install system-wide (no PATH edit): ${c.bold("sudo lecodes install --system")}`);
 };
 var installWindows = (args, bundle, companions) => {
-  const target = resolve11(flagStr(args, "dir") ?? join22(process.env.LOCALAPPDATA ?? join22(HOME, "AppData", "Local"), "Programs", "lecodes-cli"));
+  const target = resolve11(flagStr(args, "dir") ?? join23(process.env.LOCALAPPDATA ?? join23(HOME, "AppData", "Local"), "Programs", "lecodes-cli"));
   try {
     copyBundle(bundle, target, companions);
   } catch (e) {
@@ -8273,7 +8675,7 @@ var addToUserPathWindows = (dir) => {
 var STANDALONE = (() => {
   const dir = dirname16(process.execPath);
   const chisel = process.platform === "win32" ? "chisel.exe" : "chisel";
-  return existsSync23(join23(dir, "runtime")) && existsSync23(join23(dir, chisel));
+  return existsSync24(join24(dir, "runtime")) && existsSync24(join24(dir, chisel));
 })();
 var INSTALLED = STANDALONE && (() => {
   const exe = process.platform === "win32" ? "lecodes.exe" : "lecodes";
@@ -8288,8 +8690,8 @@ var INSTALLED = STANDALONE && (() => {
     if (!d)
       return false;
     try {
-      const cand = join23(d, exe);
-      return existsSync23(cand) && realpathSync2(cand) === self;
+      const cand = join24(d, exe);
+      return existsSync24(cand) && realpathSync2(cand) === self;
     } catch {
       return false;
     }
@@ -8459,9 +8861,18 @@ ${c.bold("Commands:")}
   app upload ios                Upload the archive to App Store Connect (then bumps buildNumber)
                                   --key-path <p8> --key-id <id> --issuer-id <id>
                                                        ASC API key; stored in ~/.lecodes/asc.json
+  pn send --title <s>           Push notifications for this project ('lecodes pn' for the group).
+                                  Sends with your login — no push key needed to test.
+                                  --user <ids>    target Push.register({ user }) ids (comma-sep)
+                                  --to <pa_…>     target addresses (comma-separated)
+                                  --body/--url/--badge/--data   payload fields
+  pn devices                    Which devices registered (the 'why didn't it arrive?' command)
+                                  --user <id>     only that user's devices
+  pn keys [new|revoke]          Push keys for YOUR server: list, mint (owner only, shown once
+                                  — 'new --env' banks it in .env), revoke <id>
 
 Config lives in ~/.lecodes/config.json (override with LECODES_API / LECODES_TOKEN).`;
-var commands = { init: init2, login, create, clone, link, status, diff, pull, push, compile: compile2, preview: previewLegacy, render, test, types, design, scene, dev, app };
+var commands = { init: init2, login, create, clone, link, status, diff, pull, push, compile: compile2, preview: previewLegacy, render, test, types, design, scene, dev, app, pn };
 if (STANDALONE)
   commands.install = install;
 var readVersion = () => package_default.version ?? "unknown";
@@ -8475,9 +8886,9 @@ var peerVersion = (name, probe) => {
     const require2 = createRequire4(import.meta.url);
     let dir = dirname16(require2.resolve(probe));
     for (let depth = 0;depth < 16; depth++) {
-      const manifest = join23(dir, "package.json");
-      if (existsSync23(manifest)) {
-        const parsed = JSON.parse(readFileSync23(manifest, "utf8"));
+      const manifest = join24(dir, "package.json");
+      if (existsSync24(manifest)) {
+        const parsed = JSON.parse(readFileSync24(manifest, "utf8"));
         if (parsed.name === name)
           return parsed.version ?? "unknown";
       }