openmausbot 0.1.55

package/dist-server/pair-cli.js

@@ -0,0 +1,3671 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __commonJS = (cb, mod) => function __require() {
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/vendor/QRCode/QRMode.js
+var require_QRMode = __commonJS({
+  "node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/vendor/QRCode/QRMode.js"(exports, module) {
+    module.exports = {
+      MODE_NUMBER: 1 << 0,
+      MODE_ALPHA_NUM: 1 << 1,
+      MODE_8BIT_BYTE: 1 << 2,
+      MODE_KANJI: 1 << 3
+    };
+  }
+});
+
+// node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/vendor/QRCode/QR8bitByte.js
+var require_QR8bitByte = __commonJS({
+  "node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/vendor/QRCode/QR8bitByte.js"(exports, module) {
+    var QRMode = require_QRMode();
+    function QR8bitByte(data) {
+      this.mode = QRMode.MODE_8BIT_BYTE;
+      this.data = data;
+    }
+    QR8bitByte.prototype = {
+      getLength: function() {
+        return this.data.length;
+      },
+      write: function(buffer) {
+        for (var i = 0; i < this.data.length; i++) {
+          buffer.put(this.data.charCodeAt(i), 8);
+        }
+      }
+    };
+    module.exports = QR8bitByte;
+  }
+});
+
+// node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/vendor/QRCode/QRMath.js
+var require_QRMath = __commonJS({
+  "node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/vendor/QRCode/QRMath.js"(exports, module) {
+    var QRMath = {
+      glog: function(n) {
+        if (n < 1) {
+          throw new Error("glog(" + n + ")");
+        }
+        return QRMath.LOG_TABLE[n];
+      },
+      gexp: function(n) {
+        while (n < 0) {
+          n += 255;
+        }
+        while (n >= 256) {
+          n -= 255;
+        }
+        return QRMath.EXP_TABLE[n];
+      },
+      EXP_TABLE: new Array(256),
+      LOG_TABLE: new Array(256)
+    };
+    for (i = 0; i < 8; i++) {
+      QRMath.EXP_TABLE[i] = 1 << i;
+    }
+    var i;
+    for (i = 8; i < 256; i++) {
+      QRMath.EXP_TABLE[i] = QRMath.EXP_TABLE[i - 4] ^ QRMath.EXP_TABLE[i - 5] ^ QRMath.EXP_TABLE[i - 6] ^ QRMath.EXP_TABLE[i - 8];
+    }
+    var i;
+    for (i = 0; i < 255; i++) {
+      QRMath.LOG_TABLE[QRMath.EXP_TABLE[i]] = i;
+    }
+    var i;
+    module.exports = QRMath;
+  }
+});
+
+// node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/vendor/QRCode/QRPolynomial.js
+var require_QRPolynomial = __commonJS({
+  "node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/vendor/QRCode/QRPolynomial.js"(exports, module) {
+    var QRMath = require_QRMath();
+    function QRPolynomial(num, shift) {
+      if (num.length === void 0) {
+        throw new Error(num.length + "/" + shift);
+      }
+      var offset = 0;
+      while (offset < num.length && num[offset] === 0) {
+        offset++;
+      }
+      this.num = new Array(num.length - offset + shift);
+      for (var i = 0; i < num.length - offset; i++) {
+        this.num[i] = num[i + offset];
+      }
+    }
+    QRPolynomial.prototype = {
+      get: function(index) {
+        return this.num[index];
+      },
+      getLength: function() {
+        return this.num.length;
+      },
+      multiply: function(e) {
+        var num = new Array(this.getLength() + e.getLength() - 1);
+        for (var i = 0; i < this.getLength(); i++) {
+          for (var j = 0; j < e.getLength(); j++) {
+            num[i + j] ^= QRMath.gexp(QRMath.glog(this.get(i)) + QRMath.glog(e.get(j)));
+          }
+        }
+        return new QRPolynomial(num, 0);
+      },
+      mod: function(e) {
+        if (this.getLength() - e.getLength() < 0) {
+          return this;
+        }
+        var ratio = QRMath.glog(this.get(0)) - QRMath.glog(e.get(0));
+        var num = new Array(this.getLength());
+        for (var i = 0; i < this.getLength(); i++) {
+          num[i] = this.get(i);
+        }
+        for (var x = 0; x < e.getLength(); x++) {
+          num[x] ^= QRMath.gexp(QRMath.glog(e.get(x)) + ratio);
+        }
+        return new QRPolynomial(num, 0).mod(e);
+      }
+    };
+    module.exports = QRPolynomial;
+  }
+});
+
+// node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/vendor/QRCode/QRMaskPattern.js
+var require_QRMaskPattern = __commonJS({
+  "node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/vendor/QRCode/QRMaskPattern.js"(exports, module) {
+    module.exports = {
+      PATTERN000: 0,
+      PATTERN001: 1,
+      PATTERN010: 2,
+      PATTERN011: 3,
+      PATTERN100: 4,
+      PATTERN101: 5,
+      PATTERN110: 6,
+      PATTERN111: 7
+    };
+  }
+});
+
+// node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/vendor/QRCode/QRUtil.js
+var require_QRUtil = __commonJS({
+  "node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/vendor/QRCode/QRUtil.js"(exports, module) {
+    var QRMode = require_QRMode();
+    var QRPolynomial = require_QRPolynomial();
+    var QRMath = require_QRMath();
+    var QRMaskPattern = require_QRMaskPattern();
+    var QRUtil = {
+      PATTERN_POSITION_TABLE: [
+        [],
+        [6, 18],
+        [6, 22],
+        [6, 26],
+        [6, 30],
+        [6, 34],
+        [6, 22, 38],
+        [6, 24, 42],
+        [6, 26, 46],
+        [6, 28, 50],
+        [6, 30, 54],
+        [6, 32, 58],
+        [6, 34, 62],
+        [6, 26, 46, 66],
+        [6, 26, 48, 70],
+        [6, 26, 50, 74],
+        [6, 30, 54, 78],
+        [6, 30, 56, 82],
+        [6, 30, 58, 86],
+        [6, 34, 62, 90],
+        [6, 28, 50, 72, 94],
+        [6, 26, 50, 74, 98],
+        [6, 30, 54, 78, 102],
+        [6, 28, 54, 80, 106],
+        [6, 32, 58, 84, 110],
+        [6, 30, 58, 86, 114],
+        [6, 34, 62, 90, 118],
+        [6, 26, 50, 74, 98, 122],
+        [6, 30, 54, 78, 102, 126],
+        [6, 26, 52, 78, 104, 130],
+        [6, 30, 56, 82, 108, 134],
+        [6, 34, 60, 86, 112, 138],
+        [6, 30, 58, 86, 114, 142],
+        [6, 34, 62, 90, 118, 146],
+        [6, 30, 54, 78, 102, 126, 150],
+        [6, 24, 50, 76, 102, 128, 154],
+        [6, 28, 54, 80, 106, 132, 158],
+        [6, 32, 58, 84, 110, 136, 162],
+        [6, 26, 54, 82, 110, 138, 166],
+        [6, 30, 58, 86, 114, 142, 170]
+      ],
+      G15: 1 << 10 | 1 << 8 | 1 << 5 | 1 << 4 | 1 << 2 | 1 << 1 | 1 << 0,
+      G18: 1 << 12 | 1 << 11 | 1 << 10 | 1 << 9 | 1 << 8 | 1 << 5 | 1 << 2 | 1 << 0,
+      G15_MASK: 1 << 14 | 1 << 12 | 1 << 10 | 1 << 4 | 1 << 1,
+      getBCHTypeInfo: function(data) {
+        var d = data << 10;
+        while (QRUtil.getBCHDigit(d) - QRUtil.getBCHDigit(QRUtil.G15) >= 0) {
+          d ^= QRUtil.G15 << QRUtil.getBCHDigit(d) - QRUtil.getBCHDigit(QRUtil.G15);
+        }
+        return (data << 10 | d) ^ QRUtil.G15_MASK;
+      },
+      getBCHTypeNumber: function(data) {
+        var d = data << 12;
+        while (QRUtil.getBCHDigit(d) - QRUtil.getBCHDigit(QRUtil.G18) >= 0) {
+          d ^= QRUtil.G18 << QRUtil.getBCHDigit(d) - QRUtil.getBCHDigit(QRUtil.G18);
+        }
+        return data << 12 | d;
+      },
+      getBCHDigit: function(data) {
+        var digit = 0;
+        while (data !== 0) {
+          digit++;
+          data >>>= 1;
+        }
+        return digit;
+      },
+      getPatternPosition: function(typeNumber) {
+        return QRUtil.PATTERN_POSITION_TABLE[typeNumber - 1];
+      },
+      getMask: function(maskPattern, i, j) {
+        switch (maskPattern) {
+          case QRMaskPattern.PATTERN000:
+            return (i + j) % 2 === 0;
+          case QRMaskPattern.PATTERN001:
+            return i % 2 === 0;
+          case QRMaskPattern.PATTERN010:
+            return j % 3 === 0;
+          case QRMaskPattern.PATTERN011:
+            return (i + j) % 3 === 0;
+          case QRMaskPattern.PATTERN100:
+            return (Math.floor(i / 2) + Math.floor(j / 3)) % 2 === 0;
+          case QRMaskPattern.PATTERN101:
+            return i * j % 2 + i * j % 3 === 0;
+          case QRMaskPattern.PATTERN110:
+            return (i * j % 2 + i * j % 3) % 2 === 0;
+          case QRMaskPattern.PATTERN111:
+            return (i * j % 3 + (i + j) % 2) % 2 === 0;
+          default:
+            throw new Error("bad maskPattern:" + maskPattern);
+        }
+      },
+      getErrorCorrectPolynomial: function(errorCorrectLength) {
+        var a = new QRPolynomial([1], 0);
+        for (var i = 0; i < errorCorrectLength; i++) {
+          a = a.multiply(new QRPolynomial([1, QRMath.gexp(i)], 0));
+        }
+        return a;
+      },
+      getLengthInBits: function(mode, type) {
+        if (1 <= type && type < 10) {
+          switch (mode) {
+            case QRMode.MODE_NUMBER:
+              return 10;
+            case QRMode.MODE_ALPHA_NUM:
+              return 9;
+            case QRMode.MODE_8BIT_BYTE:
+              return 8;
+            case QRMode.MODE_KANJI:
+              return 8;
+            default:
+              throw new Error("mode:" + mode);
+          }
+        } else if (type < 27) {
+          switch (mode) {
+            case QRMode.MODE_NUMBER:
+              return 12;
+            case QRMode.MODE_ALPHA_NUM:
+              return 11;
+            case QRMode.MODE_8BIT_BYTE:
+              return 16;
+            case QRMode.MODE_KANJI:
+              return 10;
+            default:
+              throw new Error("mode:" + mode);
+          }
+        } else if (type < 41) {
+          switch (mode) {
+            case QRMode.MODE_NUMBER:
+              return 14;
+            case QRMode.MODE_ALPHA_NUM:
+              return 13;
+            case QRMode.MODE_8BIT_BYTE:
+              return 16;
+            case QRMode.MODE_KANJI:
+              return 12;
+            default:
+              throw new Error("mode:" + mode);
+          }
+        } else {
+          throw new Error("type:" + type);
+        }
+      },
+      getLostPoint: function(qrCode) {
+        var moduleCount = qrCode.getModuleCount();
+        var lostPoint = 0;
+        var row = 0;
+        var col = 0;
+        for (row = 0; row < moduleCount; row++) {
+          for (col = 0; col < moduleCount; col++) {
+            var sameCount = 0;
+            var dark = qrCode.isDark(row, col);
+            for (var r = -1; r <= 1; r++) {
+              if (row + r < 0 || moduleCount <= row + r) {
+                continue;
+              }
+              for (var c = -1; c <= 1; c++) {
+                if (col + c < 0 || moduleCount <= col + c) {
+                  continue;
+                }
+                if (r === 0 && c === 0) {
+                  continue;
+                }
+                if (dark === qrCode.isDark(row + r, col + c)) {
+                  sameCount++;
+                }
+              }
+            }
+            if (sameCount > 5) {
+              lostPoint += 3 + sameCount - 5;
+            }
+          }
+        }
+        for (row = 0; row < moduleCount - 1; row++) {
+          for (col = 0; col < moduleCount - 1; col++) {
+            var count = 0;
+            if (qrCode.isDark(row, col)) count++;
+            if (qrCode.isDark(row + 1, col)) count++;
+            if (qrCode.isDark(row, col + 1)) count++;
+            if (qrCode.isDark(row + 1, col + 1)) count++;
+            if (count === 0 || count === 4) {
+              lostPoint += 3;
+            }
+          }
+        }
+        for (row = 0; row < moduleCount; row++) {
+          for (col = 0; col < moduleCount - 6; col++) {
+            if (qrCode.isDark(row, col) && !qrCode.isDark(row, col + 1) && qrCode.isDark(row, col + 2) && qrCode.isDark(row, col + 3) && qrCode.isDark(row, col + 4) && !qrCode.isDark(row, col + 5) && qrCode.isDark(row, col + 6)) {
+              lostPoint += 40;
+            }
+          }
+        }
+        for (col = 0; col < moduleCount; col++) {
+          for (row = 0; row < moduleCount - 6; row++) {
+            if (qrCode.isDark(row, col) && !qrCode.isDark(row + 1, col) && qrCode.isDark(row + 2, col) && qrCode.isDark(row + 3, col) && qrCode.isDark(row + 4, col) && !qrCode.isDark(row + 5, col) && qrCode.isDark(row + 6, col)) {
+              lostPoint += 40;
+            }
+          }
+        }
+        var darkCount = 0;
+        for (col = 0; col < moduleCount; col++) {
+          for (row = 0; row < moduleCount; row++) {
+            if (qrCode.isDark(row, col)) {
+              darkCount++;
+            }
+          }
+        }
+        var ratio = Math.abs(100 * darkCount / moduleCount / moduleCount - 50) / 5;
+        lostPoint += ratio * 10;
+        return lostPoint;
+      }
+    };
+    module.exports = QRUtil;
+  }
+});
+
+// node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/vendor/QRCode/QRErrorCorrectLevel.js
+var require_QRErrorCorrectLevel = __commonJS({
+  "node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/vendor/QRCode/QRErrorCorrectLevel.js"(exports, module) {
+    module.exports = {
+      L: 1,
+      M: 0,
+      Q: 3,
+      H: 2
+    };
+  }
+});
+
+// node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/vendor/QRCode/QRRSBlock.js
+var require_QRRSBlock = __commonJS({
+  "node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/vendor/QRCode/QRRSBlock.js"(exports, module) {
+    var QRErrorCorrectLevel = require_QRErrorCorrectLevel();
+    function QRRSBlock(totalCount, dataCount) {
+      this.totalCount = totalCount;
+      this.dataCount = dataCount;
+    }
+    QRRSBlock.RS_BLOCK_TABLE = [
+      // L
+      // M
+      // Q
+      // H
+      // 1
+      [1, 26, 19],
+      [1, 26, 16],
+      [1, 26, 13],
+      [1, 26, 9],
+      // 2
+      [1, 44, 34],
+      [1, 44, 28],
+      [1, 44, 22],
+      [1, 44, 16],
+      // 3
+      [1, 70, 55],
+      [1, 70, 44],
+      [2, 35, 17],
+      [2, 35, 13],
+      // 4		
+      [1, 100, 80],
+      [2, 50, 32],
+      [2, 50, 24],
+      [4, 25, 9],
+      // 5
+      [1, 134, 108],
+      [2, 67, 43],
+      [2, 33, 15, 2, 34, 16],
+      [2, 33, 11, 2, 34, 12],
+      // 6
+      [2, 86, 68],
+      [4, 43, 27],
+      [4, 43, 19],
+      [4, 43, 15],
+      // 7		
+      [2, 98, 78],
+      [4, 49, 31],
+      [2, 32, 14, 4, 33, 15],
+      [4, 39, 13, 1, 40, 14],
+      // 8
+      [2, 121, 97],
+      [2, 60, 38, 2, 61, 39],
+      [4, 40, 18, 2, 41, 19],
+      [4, 40, 14, 2, 41, 15],
+      // 9
+      [2, 146, 116],
+      [3, 58, 36, 2, 59, 37],
+      [4, 36, 16, 4, 37, 17],
+      [4, 36, 12, 4, 37, 13],
+      // 10		
+      [2, 86, 68, 2, 87, 69],
+      [4, 69, 43, 1, 70, 44],
+      [6, 43, 19, 2, 44, 20],
+      [6, 43, 15, 2, 44, 16],
+      // 11
+      [4, 101, 81],
+      [1, 80, 50, 4, 81, 51],
+      [4, 50, 22, 4, 51, 23],
+      [3, 36, 12, 8, 37, 13],
+      // 12
+      [2, 116, 92, 2, 117, 93],
+      [6, 58, 36, 2, 59, 37],
+      [4, 46, 20, 6, 47, 21],
+      [7, 42, 14, 4, 43, 15],
+      // 13
+      [4, 133, 107],
+      [8, 59, 37, 1, 60, 38],
+      [8, 44, 20, 4, 45, 21],
+      [12, 33, 11, 4, 34, 12],
+      // 14
+      [3, 145, 115, 1, 146, 116],
+      [4, 64, 40, 5, 65, 41],
+      [11, 36, 16, 5, 37, 17],
+      [11, 36, 12, 5, 37, 13],
+      // 15
+      [5, 109, 87, 1, 110, 88],
+      [5, 65, 41, 5, 66, 42],
+      [5, 54, 24, 7, 55, 25],
+      [11, 36, 12],
+      // 16
+      [5, 122, 98, 1, 123, 99],
+      [7, 73, 45, 3, 74, 46],
+      [15, 43, 19, 2, 44, 20],
+      [3, 45, 15, 13, 46, 16],
+      // 17
+      [1, 135, 107, 5, 136, 108],
+      [10, 74, 46, 1, 75, 47],
+      [1, 50, 22, 15, 51, 23],
+      [2, 42, 14, 17, 43, 15],
+      // 18
+      [5, 150, 120, 1, 151, 121],
+      [9, 69, 43, 4, 70, 44],
+      [17, 50, 22, 1, 51, 23],
+      [2, 42, 14, 19, 43, 15],
+      // 19
+      [3, 141, 113, 4, 142, 114],
+      [3, 70, 44, 11, 71, 45],
+      [17, 47, 21, 4, 48, 22],
+      [9, 39, 13, 16, 40, 14],
+      // 20
+      [3, 135, 107, 5, 136, 108],
+      [3, 67, 41, 13, 68, 42],
+      [15, 54, 24, 5, 55, 25],
+      [15, 43, 15, 10, 44, 16],
+      // 21
+      [4, 144, 116, 4, 145, 117],
+      [17, 68, 42],
+      [17, 50, 22, 6, 51, 23],
+      [19, 46, 16, 6, 47, 17],
+      // 22
+      [2, 139, 111, 7, 140, 112],
+      [17, 74, 46],
+      [7, 54, 24, 16, 55, 25],
+      [34, 37, 13],
+      // 23
+      [4, 151, 121, 5, 152, 122],
+      [4, 75, 47, 14, 76, 48],
+      [11, 54, 24, 14, 55, 25],
+      [16, 45, 15, 14, 46, 16],
+      // 24
+      [6, 147, 117, 4, 148, 118],
+      [6, 73, 45, 14, 74, 46],
+      [11, 54, 24, 16, 55, 25],
+      [30, 46, 16, 2, 47, 17],
+      // 25
+      [8, 132, 106, 4, 133, 107],
+      [8, 75, 47, 13, 76, 48],
+      [7, 54, 24, 22, 55, 25],
+      [22, 45, 15, 13, 46, 16],
+      // 26
+      [10, 142, 114, 2, 143, 115],
+      [19, 74, 46, 4, 75, 47],
+      [28, 50, 22, 6, 51, 23],
+      [33, 46, 16, 4, 47, 17],
+      // 27
+      [8, 152, 122, 4, 153, 123],
+      [22, 73, 45, 3, 74, 46],
+      [8, 53, 23, 26, 54, 24],
+      [12, 45, 15, 28, 46, 16],
+      // 28
+      [3, 147, 117, 10, 148, 118],
+      [3, 73, 45, 23, 74, 46],
+      [4, 54, 24, 31, 55, 25],
+      [11, 45, 15, 31, 46, 16],
+      // 29
+      [7, 146, 116, 7, 147, 117],
+      [21, 73, 45, 7, 74, 46],
+      [1, 53, 23, 37, 54, 24],
+      [19, 45, 15, 26, 46, 16],
+      // 30
+      [5, 145, 115, 10, 146, 116],
+      [19, 75, 47, 10, 76, 48],
+      [15, 54, 24, 25, 55, 25],
+      [23, 45, 15, 25, 46, 16],
+      // 31
+      [13, 145, 115, 3, 146, 116],
+      [2, 74, 46, 29, 75, 47],
+      [42, 54, 24, 1, 55, 25],
+      [23, 45, 15, 28, 46, 16],
+      // 32
+      [17, 145, 115],
+      [10, 74, 46, 23, 75, 47],
+      [10, 54, 24, 35, 55, 25],
+      [19, 45, 15, 35, 46, 16],
+      // 33
+      [17, 145, 115, 1, 146, 116],
+      [14, 74, 46, 21, 75, 47],
+      [29, 54, 24, 19, 55, 25],
+      [11, 45, 15, 46, 46, 16],
+      // 34
+      [13, 145, 115, 6, 146, 116],
+      [14, 74, 46, 23, 75, 47],
+      [44, 54, 24, 7, 55, 25],
+      [59, 46, 16, 1, 47, 17],
+      // 35
+      [12, 151, 121, 7, 152, 122],
+      [12, 75, 47, 26, 76, 48],
+      [39, 54, 24, 14, 55, 25],
+      [22, 45, 15, 41, 46, 16],
+      // 36
+      [6, 151, 121, 14, 152, 122],
+      [6, 75, 47, 34, 76, 48],
+      [46, 54, 24, 10, 55, 25],
+      [2, 45, 15, 64, 46, 16],
+      // 37
+      [17, 152, 122, 4, 153, 123],
+      [29, 74, 46, 14, 75, 47],
+      [49, 54, 24, 10, 55, 25],
+      [24, 45, 15, 46, 46, 16],
+      // 38
+      [4, 152, 122, 18, 153, 123],
+      [13, 74, 46, 32, 75, 47],
+      [48, 54, 24, 14, 55, 25],
+      [42, 45, 15, 32, 46, 16],
+      // 39
+      [20, 147, 117, 4, 148, 118],
+      [40, 75, 47, 7, 76, 48],
+      [43, 54, 24, 22, 55, 25],
+      [10, 45, 15, 67, 46, 16],
+      // 40
+      [19, 148, 118, 6, 149, 119],
+      [18, 75, 47, 31, 76, 48],
+      [34, 54, 24, 34, 55, 25],
+      [20, 45, 15, 61, 46, 16]
+    ];
+    QRRSBlock.getRSBlocks = function(typeNumber, errorCorrectLevel) {
+      var rsBlock = QRRSBlock.getRsBlockTable(typeNumber, errorCorrectLevel);
+      if (rsBlock === void 0) {
+        throw new Error("bad rs block @ typeNumber:" + typeNumber + "/errorCorrectLevel:" + errorCorrectLevel);
+      }
+      var length = rsBlock.length / 3;
+      var list = [];
+      for (var i = 0; i < length; i++) {
+        var count = rsBlock[i * 3 + 0];
+        var totalCount = rsBlock[i * 3 + 1];
+        var dataCount = rsBlock[i * 3 + 2];
+        for (var j = 0; j < count; j++) {
+          list.push(new QRRSBlock(totalCount, dataCount));
+        }
+      }
+      return list;
+    };
+    QRRSBlock.getRsBlockTable = function(typeNumber, errorCorrectLevel) {
+      switch (errorCorrectLevel) {
+        case QRErrorCorrectLevel.L:
+          return QRRSBlock.RS_BLOCK_TABLE[(typeNumber - 1) * 4 + 0];
+        case QRErrorCorrectLevel.M:
+          return QRRSBlock.RS_BLOCK_TABLE[(typeNumber - 1) * 4 + 1];
+        case QRErrorCorrectLevel.Q:
+          return QRRSBlock.RS_BLOCK_TABLE[(typeNumber - 1) * 4 + 2];
+        case QRErrorCorrectLevel.H:
+          return QRRSBlock.RS_BLOCK_TABLE[(typeNumber - 1) * 4 + 3];
+        default:
+          return void 0;
+      }
+    };
+    module.exports = QRRSBlock;
+  }
+});
+
+// node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/vendor/QRCode/QRBitBuffer.js
+var require_QRBitBuffer = __commonJS({
+  "node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/vendor/QRCode/QRBitBuffer.js"(exports, module) {
+    function QRBitBuffer() {
+      this.buffer = [];
+      this.length = 0;
+    }
+    QRBitBuffer.prototype = {
+      get: function(index) {
+        var bufIndex = Math.floor(index / 8);
+        return (this.buffer[bufIndex] >>> 7 - index % 8 & 1) == 1;
+      },
+      put: function(num, length) {
+        for (var i = 0; i < length; i++) {
+          this.putBit((num >>> length - i - 1 & 1) == 1);
+        }
+      },
+      getLengthInBits: function() {
+        return this.length;
+      },
+      putBit: function(bit) {
+        var bufIndex = Math.floor(this.length / 8);
+        if (this.buffer.length <= bufIndex) {
+          this.buffer.push(0);
+        }
+        if (bit) {
+          this.buffer[bufIndex] |= 128 >>> this.length % 8;
+        }
+        this.length++;
+      }
+    };
+    module.exports = QRBitBuffer;
+  }
+});
+
+// node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/vendor/QRCode/index.js
+var require_QRCode = __commonJS({
+  "node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/vendor/QRCode/index.js"(exports, module) {
+    var QR8bitByte = require_QR8bitByte();
+    var QRUtil = require_QRUtil();
+    var QRPolynomial = require_QRPolynomial();
+    var QRRSBlock = require_QRRSBlock();
+    var QRBitBuffer = require_QRBitBuffer();
+    function QRCode(typeNumber, errorCorrectLevel) {
+      this.typeNumber = typeNumber;
+      this.errorCorrectLevel = errorCorrectLevel;
+      this.modules = null;
+      this.moduleCount = 0;
+      this.dataCache = null;
+      this.dataList = [];
+    }
+    QRCode.prototype = {
+      addData: function(data) {
+        var newData = new QR8bitByte(data);
+        this.dataList.push(newData);
+        this.dataCache = null;
+      },
+      isDark: function(row, col) {
+        if (row < 0 || this.moduleCount <= row || col < 0 || this.moduleCount <= col) {
+          throw new Error(row + "," + col);
+        }
+        return this.modules[row][col];
+      },
+      getModuleCount: function() {
+        return this.moduleCount;
+      },
+      make: function() {
+        if (this.typeNumber < 1) {
+          var typeNumber = 1;
+          for (typeNumber = 1; typeNumber < 40; typeNumber++) {
+            var rsBlocks = QRRSBlock.getRSBlocks(typeNumber, this.errorCorrectLevel);
+            var buffer = new QRBitBuffer();
+            var totalDataCount = 0;
+            for (var i = 0; i < rsBlocks.length; i++) {
+              totalDataCount += rsBlocks[i].dataCount;
+            }
+            for (var x = 0; x < this.dataList.length; x++) {
+              var data = this.dataList[x];
+              buffer.put(data.mode, 4);
+              buffer.put(data.getLength(), QRUtil.getLengthInBits(data.mode, typeNumber));
+              data.write(buffer);
+            }
+            if (buffer.getLengthInBits() <= totalDataCount * 8)
+              break;
+          }
+          this.typeNumber = typeNumber;
+        }
+        this.makeImpl(false, this.getBestMaskPattern());
+      },
+      makeImpl: function(test, maskPattern) {
+        this.moduleCount = this.typeNumber * 4 + 17;
+        this.modules = new Array(this.moduleCount);
+        for (var row = 0; row < this.moduleCount; row++) {
+          this.modules[row] = new Array(this.moduleCount);
+          for (var col = 0; col < this.moduleCount; col++) {
+            this.modules[row][col] = null;
+          }
+        }
+        this.setupPositionProbePattern(0, 0);
+        this.setupPositionProbePattern(this.moduleCount - 7, 0);
+        this.setupPositionProbePattern(0, this.moduleCount - 7);
+        this.setupPositionAdjustPattern();
+        this.setupTimingPattern();
+        this.setupTypeInfo(test, maskPattern);
+        if (this.typeNumber >= 7) {
+          this.setupTypeNumber(test);
+        }
+        if (this.dataCache === null) {
+          this.dataCache = QRCode.createData(this.typeNumber, this.errorCorrectLevel, this.dataList);
+        }
+        this.mapData(this.dataCache, maskPattern);
+      },
+      setupPositionProbePattern: function(row, col) {
+        for (var r = -1; r <= 7; r++) {
+          if (row + r <= -1 || this.moduleCount <= row + r) continue;
+          for (var c = -1; c <= 7; c++) {
+            if (col + c <= -1 || this.moduleCount <= col + c) continue;
+            if (0 <= r && r <= 6 && (c === 0 || c === 6) || 0 <= c && c <= 6 && (r === 0 || r === 6) || 2 <= r && r <= 4 && 2 <= c && c <= 4) {
+              this.modules[row + r][col + c] = true;
+            } else {
+              this.modules[row + r][col + c] = false;
+            }
+          }
+        }
+      },
+      getBestMaskPattern: function() {
+        var minLostPoint = 0;
+        var pattern = 0;
+        for (var i = 0; i < 8; i++) {
+          this.makeImpl(true, i);
+          var lostPoint = QRUtil.getLostPoint(this);
+          if (i === 0 || minLostPoint > lostPoint) {
+            minLostPoint = lostPoint;
+            pattern = i;
+          }
+        }
+        return pattern;
+      },
+      createMovieClip: function(target_mc, instance_name, depth) {
+        var qr_mc = target_mc.createEmptyMovieClip(instance_name, depth);
+        var cs = 1;
+        this.make();
+        for (var row = 0; row < this.modules.length; row++) {
+          var y = row * cs;
+          for (var col = 0; col < this.modules[row].length; col++) {
+            var x = col * cs;
+            var dark = this.modules[row][col];
+            if (dark) {
+              qr_mc.beginFill(0, 100);
+              qr_mc.moveTo(x, y);
+              qr_mc.lineTo(x + cs, y);
+              qr_mc.lineTo(x + cs, y + cs);
+              qr_mc.lineTo(x, y + cs);
+              qr_mc.endFill();
+            }
+          }
+        }
+        return qr_mc;
+      },
+      setupTimingPattern: function() {
+        for (var r = 8; r < this.moduleCount - 8; r++) {
+          if (this.modules[r][6] !== null) {
+            continue;
+          }
+          this.modules[r][6] = r % 2 === 0;
+        }
+        for (var c = 8; c < this.moduleCount - 8; c++) {
+          if (this.modules[6][c] !== null) {
+            continue;
+          }
+          this.modules[6][c] = c % 2 === 0;
+        }
+      },
+      setupPositionAdjustPattern: function() {
+        var pos = QRUtil.getPatternPosition(this.typeNumber);
+        for (var i = 0; i < pos.length; i++) {
+          for (var j = 0; j < pos.length; j++) {
+            var row = pos[i];
+            var col = pos[j];
+            if (this.modules[row][col] !== null) {
+              continue;
+            }
+            for (var r = -2; r <= 2; r++) {
+              for (var c = -2; c <= 2; c++) {
+                if (Math.abs(r) === 2 || Math.abs(c) === 2 || r === 0 && c === 0) {
+                  this.modules[row + r][col + c] = true;
+                } else {
+                  this.modules[row + r][col + c] = false;
+                }
+              }
+            }
+          }
+        }
+      },
+      setupTypeNumber: function(test) {
+        var bits = QRUtil.getBCHTypeNumber(this.typeNumber);
+        var mod;
+        for (var i = 0; i < 18; i++) {
+          mod = !test && (bits >> i & 1) === 1;
+          this.modules[Math.floor(i / 3)][i % 3 + this.moduleCount - 8 - 3] = mod;
+        }
+        for (var x = 0; x < 18; x++) {
+          mod = !test && (bits >> x & 1) === 1;
+          this.modules[x % 3 + this.moduleCount - 8 - 3][Math.floor(x / 3)] = mod;
+        }
+      },
+      setupTypeInfo: function(test, maskPattern) {
+        var data = this.errorCorrectLevel << 3 | maskPattern;
+        var bits = QRUtil.getBCHTypeInfo(data);
+        var mod;
+        for (var v = 0; v < 15; v++) {
+          mod = !test && (bits >> v & 1) === 1;
+          if (v < 6) {
+            this.modules[v][8] = mod;
+          } else if (v < 8) {
+            this.modules[v + 1][8] = mod;
+          } else {
+            this.modules[this.moduleCount - 15 + v][8] = mod;
+          }
+        }
+        for (var h = 0; h < 15; h++) {
+          mod = !test && (bits >> h & 1) === 1;
+          if (h < 8) {
+            this.modules[8][this.moduleCount - h - 1] = mod;
+          } else if (h < 9) {
+            this.modules[8][15 - h - 1 + 1] = mod;
+          } else {
+            this.modules[8][15 - h - 1] = mod;
+          }
+        }
+        this.modules[this.moduleCount - 8][8] = !test;
+      },
+      mapData: function(data, maskPattern) {
+        var inc = -1;
+        var row = this.moduleCount - 1;
+        var bitIndex = 7;
+        var byteIndex = 0;
+        for (var col = this.moduleCount - 1; col > 0; col -= 2) {
+          if (col === 6) col--;
+          while (true) {
+            for (var c = 0; c < 2; c++) {
+              if (this.modules[row][col - c] === null) {
+                var dark = false;
+                if (byteIndex < data.length) {
+                  dark = (data[byteIndex] >>> bitIndex & 1) === 1;
+                }
+                var mask = QRUtil.getMask(maskPattern, row, col - c);
+                if (mask) {
+                  dark = !dark;
+                }
+                this.modules[row][col - c] = dark;
+                bitIndex--;
+                if (bitIndex === -1) {
+                  byteIndex++;
+                  bitIndex = 7;
+                }
+              }
+            }
+            row += inc;
+            if (row < 0 || this.moduleCount <= row) {
+              row -= inc;
+              inc = -inc;
+              break;
+            }
+          }
+        }
+      }
+    };
+    QRCode.PAD0 = 236;
+    QRCode.PAD1 = 17;
+    QRCode.createData = function(typeNumber, errorCorrectLevel, dataList) {
+      var rsBlocks = QRRSBlock.getRSBlocks(typeNumber, errorCorrectLevel);
+      var buffer = new QRBitBuffer();
+      for (var i = 0; i < dataList.length; i++) {
+        var data = dataList[i];
+        buffer.put(data.mode, 4);
+        buffer.put(data.getLength(), QRUtil.getLengthInBits(data.mode, typeNumber));
+        data.write(buffer);
+      }
+      var totalDataCount = 0;
+      for (var x = 0; x < rsBlocks.length; x++) {
+        totalDataCount += rsBlocks[x].dataCount;
+      }
+      if (buffer.getLengthInBits() > totalDataCount * 8) {
+        throw new Error("code length overflow. (" + buffer.getLengthInBits() + ">" + totalDataCount * 8 + ")");
+      }
+      if (buffer.getLengthInBits() + 4 <= totalDataCount * 8) {
+        buffer.put(0, 4);
+      }
+      while (buffer.getLengthInBits() % 8 !== 0) {
+        buffer.putBit(false);
+      }
+      while (true) {
+        if (buffer.getLengthInBits() >= totalDataCount * 8) {
+          break;
+        }
+        buffer.put(QRCode.PAD0, 8);
+        if (buffer.getLengthInBits() >= totalDataCount * 8) {
+          break;
+        }
+        buffer.put(QRCode.PAD1, 8);
+      }
+      return QRCode.createBytes(buffer, rsBlocks);
+    };
+    QRCode.createBytes = function(buffer, rsBlocks) {
+      var offset = 0;
+      var maxDcCount = 0;
+      var maxEcCount = 0;
+      var dcdata = new Array(rsBlocks.length);
+      var ecdata = new Array(rsBlocks.length);
+      for (var r = 0; r < rsBlocks.length; r++) {
+        var dcCount = rsBlocks[r].dataCount;
+        var ecCount = rsBlocks[r].totalCount - dcCount;
+        maxDcCount = Math.max(maxDcCount, dcCount);
+        maxEcCount = Math.max(maxEcCount, ecCount);
+        dcdata[r] = new Array(dcCount);
+        for (var i = 0; i < dcdata[r].length; i++) {
+          dcdata[r][i] = 255 & buffer.buffer[i + offset];
+        }
+        offset += dcCount;
+        var rsPoly = QRUtil.getErrorCorrectPolynomial(ecCount);
+        var rawPoly = new QRPolynomial(dcdata[r], rsPoly.getLength() - 1);
+        var modPoly = rawPoly.mod(rsPoly);
+        ecdata[r] = new Array(rsPoly.getLength() - 1);
+        for (var x = 0; x < ecdata[r].length; x++) {
+          var modIndex = x + modPoly.getLength() - ecdata[r].length;
+          ecdata[r][x] = modIndex >= 0 ? modPoly.get(modIndex) : 0;
+        }
+      }
+      var totalCodeCount = 0;
+      for (var y = 0; y < rsBlocks.length; y++) {
+        totalCodeCount += rsBlocks[y].totalCount;
+      }
+      var data = new Array(totalCodeCount);
+      var index = 0;
+      for (var z = 0; z < maxDcCount; z++) {
+        for (var s = 0; s < rsBlocks.length; s++) {
+          if (z < dcdata[s].length) {
+            data[index++] = dcdata[s][z];
+          }
+        }
+      }
+      for (var xx = 0; xx < maxEcCount; xx++) {
+        for (var t = 0; t < rsBlocks.length; t++) {
+          if (xx < ecdata[t].length) {
+            data[index++] = ecdata[t][xx];
+          }
+        }
+      }
+      return data;
+    };
+    module.exports = QRCode;
+  }
+});
+
+// node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/lib/main.js
+var require_main = __commonJS({
+  "node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/lib/main.js"(exports, module) {
+    var QRCode = require_QRCode();
+    var QRErrorCorrectLevel = require_QRErrorCorrectLevel();
+    var black = "\x1B[40m  \x1B[0m";
+    var white = "\x1B[47m  \x1B[0m";
+    var toCell = function(isBlack) {
+      return isBlack ? black : white;
+    };
+    var repeat = function(color) {
+      return {
+        times: function(count) {
+          return new Array(count).join(color);
+        }
+      };
+    };
+    var fill = function(length, value) {
+      var arr = new Array(length);
+      for (var i = 0; i < length; i++) {
+        arr[i] = value;
+      }
+      return arr;
+    };
+    module.exports = {
+      error: QRErrorCorrectLevel.L,
+      generate: function(input, opts, cb) {
+        if (typeof opts === "function") {
+          cb = opts;
+          opts = {};
+        }
+        var qrcode2 = new QRCode(-1, this.error);
+        qrcode2.addData(input);
+        qrcode2.make();
+        var output = "";
+        if (opts && opts.small) {
+          var BLACK = true, WHITE = false;
+          var moduleCount = qrcode2.getModuleCount();
+          var moduleData = qrcode2.modules.slice();
+          var oddRow = moduleCount % 2 === 1;
+          if (oddRow) {
+            moduleData.push(fill(moduleCount, WHITE));
+          }
+          var platte = {
+            WHITE_ALL: "\u2588",
+            WHITE_BLACK: "\u2580",
+            BLACK_WHITE: "\u2584",
+            BLACK_ALL: " "
+          };
+          var borderTop = repeat(platte.BLACK_WHITE).times(moduleCount + 3);
+          var borderBottom = repeat(platte.WHITE_BLACK).times(moduleCount + 3);
+          output += borderTop + "\n";
+          for (var row = 0; row < moduleCount; row += 2) {
+            output += platte.WHITE_ALL;
+            for (var col = 0; col < moduleCount; col++) {
+              if (moduleData[row][col] === WHITE && moduleData[row + 1][col] === WHITE) {
+                output += platte.WHITE_ALL;
+              } else if (moduleData[row][col] === WHITE && moduleData[row + 1][col] === BLACK) {
+                output += platte.WHITE_BLACK;
+              } else if (moduleData[row][col] === BLACK && moduleData[row + 1][col] === WHITE) {
+                output += platte.BLACK_WHITE;
+              } else {
+                output += platte.BLACK_ALL;
+              }
+            }
+            output += platte.WHITE_ALL + "\n";
+          }
+          if (!oddRow) {
+            output += borderBottom;
+          }
+        } else {
+          var border = repeat(white).times(qrcode2.getModuleCount() + 3);
+          output += border + "\n";
+          qrcode2.modules.forEach(function(row2) {
+            output += white;
+            output += row2.map(toCell).join("");
+            output += white + "\n";
+          });
+          output += border;
+        }
+        if (cb) cb(output);
+        else console.log(output);
+      },
+      setErrorLevel: function(error) {
+        this.error = QRErrorCorrectLevel[error] || this.error;
+      }
+    };
+  }
+});
+
+// server/cli.ts
+var import_qrcode_terminal = __toESM(require_main(), 1);
+import { spawn as spawn4 } from "node:child_process";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import { dirname as dirname2, join as join3, resolve as resolve2 } from "node:path";
+import { createInterface } from "node:readline/promises";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
+
+// server/tailscale.ts
+import { execFile } from "node:child_process";
+
+// companion/src/listener.ts
+import { homedir, networkInterfaces } from "node:os";
+import { delimiter, join } from "node:path";
+function tailscaleCandidates(home = homedir()) {
+  return [
+    "/Applications/Tailscale.app/Contents/MacOS/Tailscale",
+    join(home, "Applications", "Tailscale.app", "Contents", "MacOS", "Tailscale"),
+    "/opt/homebrew/bin/tailscale",
+    "/usr/local/bin/tailscale",
+    "/usr/bin/tailscale",
+    "/run/current-system/sw/bin/tailscale",
+    "C:\\Program Files\\Tailscale\\tailscale.exe",
+    "C:\\Program Files (x86)\\Tailscale\\tailscale.exe",
+    "tailscale"
+  ];
+}
+var searchPath = () => [process.env.PATH ?? "", "/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin"].filter(Boolean).join(delimiter);
+
+// server/tailscale.ts
+function classifyTailscaleStderr(text) {
+  const t = text.toLowerCase();
+  if (/not logged in|logged out|needs login|please log in/.test(t)) return "not-logged-in";
+  if (/is tailscale running|tailscaled is not running|connection refused|failed to connect to local tailscaled/.test(t)) return "not-running";
+  if (/access denied|permission denied|operator|must be root|not permitted/.test(t)) return "needs-operator";
+  if (/https is not enabled|enable https|cert|tls certs/.test(t)) return "https-not-enabled";
+  if (/magicdns/.test(t)) return "no-magicdns";
+  return "unknown";
+}
+function explainTailscaleFailure(reason) {
+  switch (reason) {
+    case "not-installed":
+      return "Tailscale is not installed: https://tailscale.com/download";
+    case "not-logged-in":
+      return "Tailscale is installed but not signed in: run `tailscale up` (or sign in from the Tailscale app)";
+    case "not-running":
+      return "Tailscale is not running: start it, then try again";
+    case "no-magicdns":
+      return "this machine has no MagicDNS name: enable MagicDNS in the tailnet's DNS settings";
+    case "needs-operator":
+      return "Tailscale refused: on Linux run `sudo tailscale set --operator=$USER` once, then try again";
+    case "https-not-enabled":
+      return "HTTPS certificates are off for this tailnet: enable them in the admin console (DNS \u2192 HTTPS Certificates)";
+    default:
+      return "Tailscale reported an error; run `tailscale status` and `tailscale serve status` to see it";
+  }
+}
+function run(cli, args, timeoutMs) {
+  return new Promise((resolve3) => {
+    execFile(
+      cli,
+      args,
+      { timeout: timeoutMs, killSignal: "SIGKILL", maxBuffer: 16 * 1024 * 1024, env: { ...process.env, PATH: searchPath() } },
+      (error, stdout, stderr) => {
+        const code = error && "code" in error && typeof error.code === "number" ? error.code : error ? null : 0;
+        resolve3({ ok: !error, stdout: String(stdout ?? ""), stderr: String(stderr ?? ""), code });
+      }
+    );
+  });
+}
+function parseTailscaleStatus(cli, stdout) {
+  let parsed;
+  try {
+    parsed = JSON.parse(stdout);
+  } catch {
+    return null;
+  }
+  const self = Reflect.get(Object(parsed), "Self");
+  const dns = Reflect.get(Object(self), "DNSName");
+  const ips = Reflect.get(Object(self), "TailscaleIPs");
+  const state = Reflect.get(Object(parsed), "BackendState");
+  return {
+    cli,
+    dnsName: typeof dns === "string" && dns ? dns.replace(/\.$/, "") : null,
+    addresses: Array.isArray(ips) ? ips.filter((v) => typeof v === "string") : [],
+    backendState: typeof state === "string" ? state : "unknown"
+  };
+}
+async function tailscaleStatus() {
+  let sawCli = false;
+  for (const cli of tailscaleCandidates()) {
+    const result = await run(cli, ["status", "--json"], 5e3);
+    if (!result.ok && !result.stdout && result.code === null) continue;
+    sawCli = true;
+    const status = parseTailscaleStatus(cli, result.stdout);
+    if (status) {
+      if (status.backendState === "NeedsLogin") return { failure: "not-logged-in" };
+      if (status.backendState !== "Running") return { failure: "not-running" };
+      return { status };
+    }
+    if (result.stderr) return { failure: classifyTailscaleStderr(result.stderr) };
+  }
+  return { failure: sawCli ? "unknown" : "not-installed" };
+}
+async function tailscaleServe(status, localPort, httpsPort = 443) {
+  if (!status.dnsName) return { failure: "no-magicdns" };
+  const result = await run(status.cli, ["serve", "--bg", `--https=${httpsPort}`, `http://127.0.0.1:${localPort}`], 2e4);
+  if (!result.ok) return { failure: classifyTailscaleStderr(result.stderr || result.stdout) };
+  return { origin: httpsPort === 443 ? `https://${status.dnsName}` : `https://${status.dnsName}:${httpsPort}` };
+}
+async function tailscaleServeOff(status, httpsPort = 443) {
+  await run(status.cli, ["serve", `--https=${httpsPort}`, "off"], 1e4);
+}
+
+// server/tunnel.ts
+import { spawn as spawn3 } from "node:child_process";
+import { randomUUID as randomUUID4 } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readFileSync, statSync } from "node:fs";
+import { hostname } from "node:os";
+import { dirname, join as join2, resolve } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+
+// electron/control-plane-client.mjs
+var INSTALLATION_CREDENTIAL = /^omb_install_[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}$/;
+var INSTALLATION_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var CLIENT_INSTANCE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
+var REQUEST_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var stringValue = (value) => typeof value === "string" ? value : null;
+var isPlainRecord = (value) => {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+  try {
+    const constructor = value.constructor;
+    if (constructor === void 0 || typeof constructor !== "function") return true;
+    const prototype = constructor.prototype;
+    return typeof prototype === "object" && prototype !== null && Object.prototype.hasOwnProperty.call(prototype, "isPrototypeOf");
+  } catch {
+    return false;
+  }
+};
+var plainObject = (value) => {
+  if (!isPlainRecord(value)) return null;
+  const record = {};
+  try {
+    for (const key of Reflect.ownKeys(value)) {
+      if (!Object.prototype.propertyIsEnumerable.call(value, key)) continue;
+      if (typeof key !== "string") return null;
+      if (key === "__proto__") continue;
+      record[key] = value[key];
+    }
+  } catch {
+    return null;
+  }
+  return record;
+};
+var validClientInstance = (value) => {
+  const input = stringValue(value);
+  return input !== null && CLIENT_INSTANCE.test(input);
+};
+var boundedSecret = (value, maximum = 8192) => typeof value === "string" && value.length >= 20 && value.length <= maximum && /^\S+$/.test(value) ? value : null;
+var ControlPlaneError = class extends Error {
+  constructor(code, status = 0, requestId = "") {
+    super(code);
+    this.name = "ControlPlaneError";
+    this.code = code;
+    this.status = status;
+    this.requestId = REQUEST_ID.test(requestId) ? requestId : "";
+  }
+};
+function statusErrorCode(status) {
+  if (status === 400 || status === 422) return "invalid_request";
+  if (status === 401) return "unauthorized";
+  if (status === 403) return "forbidden";
+  if (status === 404) return "not_found";
+  if (status === 405) return "method_not_allowed";
+  if (status === 409) return "conflict";
+  if (status === 413) return "request_too_large";
+  if (status === 415) return "unsupported_media_type";
+  if (status === 429) return "rate_limited";
+  if (status >= 500) return "control_plane_unavailable";
+  return "request_failed";
+}
+function normalizeControlPlaneURL(value) {
+  const input = stringValue(value)?.trim() ?? "";
+  if (!input) return "";
+  let parsed;
+  try {
+    parsed = new URL(input);
+  } catch {
+    return "";
+  }
+  const loopback = ["localhost", "127.0.0.1", "[::1]"].includes(parsed.hostname);
+  if (parsed.protocol !== "https:" && !(parsed.protocol === "http:" && loopback) || parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash) {
+    return "";
+  }
+  return parsed.origin;
+}
+function normalizeAccountEmail(value) {
+  const input = stringValue(value);
+  const email = input !== null && input.length <= 254 ? input.trim().toLowerCase() : "";
+  if (email.length > 254 || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) return "";
+  return email;
+}
+function validatedUser(value) {
+  const user = plainObject(value);
+  const email = normalizeAccountEmail(user?.email);
+  const idInput = stringValue(user?.id);
+  const id = idInput !== null && idInput.length >= 1 && idInput.length <= 256 ? idInput : null;
+  if (!email || !id) return null;
+  return { id, email };
+}
+function validatedInstallation(value) {
+  const installation = plainObject(value);
+  const id = stringValue(installation?.id);
+  const clientInstanceId = stringValue(installation?.clientInstanceId);
+  if (id === null || !INSTALLATION_ID.test(id) || clientInstanceId === null || !validClientInstance(clientInstanceId)) {
+    return null;
+  }
+  return {
+    id,
+    clientInstanceId,
+    name: stringValue(installation.name) ?? "This computer",
+    platform: installation.platform,
+    appVersion: stringValue(installation.appVersion)
+  };
+}
+function validatedEndpoint(value) {
+  const endpoint = plainObject(value);
+  const endpointURL = stringValue(endpoint?.url);
+  if (endpointURL === null) return null;
+  let url;
+  try {
+    url = new URL(endpointURL);
+  } catch {
+    return null;
+  }
+  if (url.protocol !== "https:" || url.username || url.password || url.pathname !== "/" || url.search || url.hash) {
+    return null;
+  }
+  return { url: url.origin };
+}
+function createControlPlaneClient({
+  baseURL,
+  fetchImpl = globalThis.fetch,
+  timeoutSignal = (milliseconds) => AbortSignal.timeout(milliseconds),
+  timeoutMs = 15e3,
+  healthTimeoutMs = 3e3
+}) {
+  const origin = normalizeControlPlaneURL(baseURL);
+  if (!origin) throw new ControlPlaneError("control_plane_unavailable");
+  const request = async (path4, { method = "GET", token, body, allowEmpty = false, deadlineMs = timeoutMs } = {}) => {
+    const headers = new Headers({ accept: "application/json" });
+    if (token) headers.set("authorization", `Bearer ${token}`);
+    if (path4.startsWith("/api/auth/")) headers.set("origin", origin);
+    if (body !== void 0) {
+      headers.set("content-type", "application/json");
+    }
+    let response;
+    try {
+      const init = {
+        method,
+        headers,
+        redirect: "error",
+        signal: timeoutSignal(deadlineMs)
+      };
+      if (body !== void 0) init.body = JSON.stringify(body);
+      response = await fetchImpl(`${origin}${path4}`, init);
+    } catch {
+      throw new ControlPlaneError("network_unavailable");
+    }
+    let payload = null;
+    if (response.status !== 204) {
+      payload = await response.json().catch(() => null);
+    }
+    if (!response.ok) {
+      const rawCode = stringValue(plainObject(payload)?.error);
+      const code = rawCode !== null && /^[a-z0-9_]{1,64}$/.test(rawCode) ? rawCode : null;
+      throw new ControlPlaneError(
+        code ?? statusErrorCode(response.status),
+        response.status,
+        response.headers.get("x-request-id") ?? ""
+      );
+    }
+    if (!allowEmpty && !plainObject(payload)) {
+      throw new ControlPlaneError("invalid_response", response.status);
+    }
+    return { response, payload };
+  };
+  const accountInstallations = async (accountToken) => {
+    if (!boundedSecret(accountToken)) throw new ControlPlaneError("signed_out", 401);
+    const { payload } = await request("/v1/installations", { token: accountToken });
+    if (!Array.isArray(payload.installations)) {
+      throw new ControlPlaneError("invalid_response");
+    }
+    const installations = payload.installations.map(validatedInstallation);
+    if (installations.some((installation) => !installation)) {
+      throw new ControlPlaneError("invalid_response");
+    }
+    return installations;
+  };
+  return {
+    origin,
+    async health() {
+      const { payload } = await request("/healthz", {
+        deadlineMs: Math.min(timeoutMs, healthTimeoutMs)
+      });
+      if (payload.ok !== true || payload.service !== "openmausbot-control-plane") {
+        throw new ControlPlaneError("control_plane_unavailable");
+      }
+      return true;
+    },
+    async requestOTP(rawEmail) {
+      const email = normalizeAccountEmail(rawEmail);
+      if (!email) throw new ControlPlaneError("invalid_email");
+      await request("/api/auth/email-otp/send-verification-otp", {
+        method: "POST",
+        body: { email, type: "sign-in" }
+      });
+      return { email };
+    },
+    async verifyOTP(rawEmail, rawOTP) {
+      const email = normalizeAccountEmail(rawEmail);
+      const otpInput = stringValue(rawOTP);
+      const otp = otpInput !== null && otpInput.length <= 32 ? otpInput.replaceAll(/\s|-/g, "") : "";
+      if (!email) throw new ControlPlaneError("invalid_email");
+      if (!/^\d{8}$/.test(otp)) throw new ControlPlaneError("invalid_otp");
+      const { response, payload } = await request("/api/auth/sign-in/email-otp", {
+        method: "POST",
+        body: { email, otp, name: email.split("@", 1)[0] }
+      });
+      const accountToken = boundedSecret(response.headers.get("set-auth-token"));
+      const user = validatedUser(payload.user);
+      if (!accountToken || !user || user.email !== email) {
+        throw new ControlPlaneError("invalid_response", response.status);
+      }
+      return { accountToken, user };
+    },
+    async me(accountToken) {
+      if (!boundedSecret(accountToken)) throw new ControlPlaneError("signed_out", 401);
+      const { payload } = await request("/v1/me", { token: accountToken });
+      const user = validatedUser(payload.user);
+      if (!user) throw new ControlPlaneError("invalid_response");
+      return user;
+    },
+    async listInstallations(accountToken) {
+      return accountInstallations(accountToken);
+    },
+    async ensureInstallation({ accountToken, currentCredential, clientInstanceId, name, platform, appVersion }) {
+      if (!validClientInstance(clientInstanceId)) {
+        throw new ControlPlaneError("invalid_client_identity");
+      }
+      if (typeof currentCredential === "string" && INSTALLATION_CREDENTIAL.test(currentCredential)) {
+        try {
+          const { payload } = await request("/v1/installations/self", { token: currentCredential });
+          const installation2 = validatedInstallation(payload.installation);
+          if (installation2?.clientInstanceId === clientInstanceId) {
+            return {
+              installation: installation2,
+              credential: currentCredential,
+              credentialExpiresAt: Number.isSafeInteger(payload.credentialExpiresAt) ? payload.credentialExpiresAt : null
+            };
+          }
+        } catch (error) {
+          if (!(error instanceof ControlPlaneError) || error.status !== 401) throw error;
+        }
+      }
+      if (!boundedSecret(accountToken)) throw new ControlPlaneError("signed_out", 401);
+      const installations = await accountInstallations(accountToken);
+      const existing = installations.find((item) => item.clientInstanceId === clientInstanceId);
+      const result = existing ? await request(`/v1/installations/${encodeURIComponent(existing.id)}/credentials/rotate`, {
+        method: "POST",
+        token: accountToken
+      }) : await request("/v1/installations", {
+        method: "POST",
+        token: accountToken,
+        body: { clientInstanceId, name, platform, appVersion }
+      });
+      const installation = existing ?? validatedInstallation(result.payload.installation);
+      const credential = stringValue(result.payload.credential);
+      if (!installation || credential === null || !INSTALLATION_CREDENTIAL.test(credential)) {
+        throw new ControlPlaneError("invalid_response");
+      }
+      return {
+        installation,
+        credential,
+        credentialExpiresAt: Number.isSafeInteger(result.payload.credentialExpiresAt) ? result.payload.credentialExpiresAt : null
+      };
+    },
+    async ensureEndpoint(installationCredential) {
+      if (typeof installationCredential !== "string" || !INSTALLATION_CREDENTIAL.test(installationCredential)) {
+        throw new ControlPlaneError("signed_out", 401);
+      }
+      const { payload } = await request("/v1/installations/self/endpoint", {
+        method: "POST",
+        token: installationCredential
+      });
+      const endpoint = validatedEndpoint(payload.endpoint);
+      const connectorToken = boundedSecret(payload.connectorToken, 16384);
+      if (!endpoint || !connectorToken) throw new ControlPlaneError("invalid_response");
+      return { endpoint, connectorToken };
+    },
+    async deleteEndpoint(installationCredential) {
+      if (typeof installationCredential !== "string" || !INSTALLATION_CREDENTIAL.test(installationCredential)) {
+        throw new ControlPlaneError("signed_out", 401);
+      }
+      await request("/v1/installations/self/endpoint", {
+        method: "DELETE",
+        token: installationCredential,
+        allowEmpty: true
+      });
+    },
+    async revokeInstallation(accountToken, installationId) {
+      if (!boundedSecret(accountToken) || typeof installationId !== "string" || !INSTALLATION_ID.test(installationId)) {
+        throw new ControlPlaneError("signed_out", 401);
+      }
+      await request(`/v1/installations/${encodeURIComponent(installationId)}`, {
+        method: "DELETE",
+        token: accountToken,
+        allowEmpty: true
+      });
+    },
+    async signOut(accountToken) {
+      if (!boundedSecret(accountToken)) return;
+      await request("/api/auth/sign-out", {
+        method: "POST",
+        token: accountToken
+      });
+    }
+  };
+}
+
+// electron/managed-companion-tunnel.mjs
+import { spawn as spawn2 } from "node:child_process";
+import { randomUUID as randomUUID2 } from "node:crypto";
+import fs2 from "node:fs";
+import os2 from "node:os";
+import path3 from "node:path";
+
+// electron/companion-origin-gateway.mjs
+import fs from "node:fs";
+import http from "node:http";
+import os from "node:os";
+import path from "node:path";
+import { randomUUID } from "node:crypto";
+var MANAGED_COMPANION_ORIGIN_HOST = "127.0.0.1";
+var MANAGED_COMPANION_ORIGIN_PORT = 8812;
+var RUNTIME_PREFIX = "omb-companion-origin-";
+var SOCKET_NAME = "origin.sock";
+var currentUserId = () => {
+  if (process.getuid) return process.getuid();
+  const uid = os.userInfo().uid;
+  return Number.isSafeInteger(uid) && uid >= 0 ? uid : void 0;
+};
+function validCompanionOriginTarget(target, platform = process.platform) {
+  if (!Number.isSafeInteger(target?.pid) || target.pid <= 0) return false;
+  if (Object.prototype.toString.call(target?.socketPath) !== "[object String]") return false;
+  if (platform === "win32") {
+    return /^\\\\\.\\pipe\\openmausbot-companion-origin-[1-9][0-9]*-[0-9a-f-]{36}$/i.test(
+      target.socketPath
+    );
+  }
+  return path.isAbsolute(target.socketPath) && path.basename(target.socketPath) === SOCKET_NAME && path.basename(path.dirname(target.socketPath)).startsWith(RUNTIME_PREFIX);
+}
+function createCompanionOriginEndpoint({
+  platform = process.platform,
+  fileSystem = fs,
+  processId = process.pid,
+  identifier = randomUUID,
+  temporaryRoot,
+  currentUid = currentUserId()
+} = {}) {
+  if (platform === "win32") {
+    return Object.freeze({
+      pid: processId,
+      socketPath: `\\\\.\\pipe\\openmausbot-companion-origin-${processId}-${identifier()}`,
+      directory: null
+    });
+  }
+  const root = temporaryRoot ?? fileSystem.realpathSync("/tmp");
+  const directory = fileSystem.mkdtempSync(path.join(root, RUNTIME_PREFIX));
+  try {
+    fileSystem.chmodSync(directory, 448);
+    const stat = fileSystem.lstatSync(directory);
+    if (!stat.isDirectory() || stat.isSymbolicLink() || currentUid !== void 0 && stat.uid !== currentUid) {
+      throw new Error("The companion origin directory is unsafe");
+    }
+    const socketPath = path.join(directory, SOCKET_NAME);
+    if (Buffer.byteLength(socketPath) > 96) {
+      throw new Error("The companion origin socket path is too long");
+    }
+    return Object.freeze({ pid: processId, socketPath, directory });
+  } catch (error) {
+    try {
+      fileSystem.rmdirSync(directory);
+    } catch {
+    }
+    throw error;
+  }
+}
+function cleanupCompanionOriginEndpoint(endpoint, { platform = process.platform, fileSystem = fs, currentUid = currentUserId() } = {}) {
+  if (platform === "win32" || !endpoint?.directory) return;
+  const directory = endpoint.directory;
+  if (path.basename(directory).startsWith(RUNTIME_PREFIX) === false || path.dirname(endpoint.socketPath) !== directory || path.basename(endpoint.socketPath) !== SOCKET_NAME) {
+    return;
+  }
+  try {
+    const directoryStat = fileSystem.lstatSync(directory);
+    if (!directoryStat.isDirectory() || directoryStat.isSymbolicLink() || currentUid !== void 0 && directoryStat.uid !== currentUid) {
+      return;
+    }
+    try {
+      const socketStat = fileSystem.lstatSync(endpoint.socketPath);
+      if (socketStat.isSocket() && !socketStat.isSymbolicLink() && (currentUid === void 0 || socketStat.uid === currentUid)) {
+        fileSystem.unlinkSync(endpoint.socketPath);
+      }
+    } catch (error) {
+      if (error?.code !== "ENOENT") return;
+    }
+    fileSystem.rmdirSync(directory);
+  } catch {
+  }
+}
+function unavailable(response) {
+  if (response.headersSent) return response.destroy();
+  const body = JSON.stringify({ error: "companion origin unavailable" });
+  response.writeHead(503, {
+    "cache-control": "private, no-store",
+    "content-length": Buffer.byteLength(body),
+    "content-type": "application/json"
+  });
+  response.end(body);
+}
+var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
+  "connection",
+  "keep-alive",
+  "proxy-authenticate",
+  "proxy-authorization",
+  "proxy-connection",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade"
+]);
+function endToEndHeaders(headers = {}) {
+  const blocked = new Set(HOP_BY_HOP_HEADERS);
+  const connection = Array.isArray(headers.connection) ? headers.connection.join(",") : String(headers.connection ?? "");
+  for (const name of connection.split(",")) blocked.add(name.trim().toLowerCase());
+  return Object.fromEntries(
+    Object.entries(headers).filter(([name, value]) => value !== void 0 && !blocked.has(name.toLowerCase()))
+  );
+}
+function upgradeHeaders(headers = {}) {
+  if (String(headers.upgrade ?? "").toLowerCase() !== "websocket") return null;
+  return {
+    ...endToEndHeaders(headers),
+    connection: "Upgrade",
+    upgrade: "websocket"
+  };
+}
+function writeUpgrade(socket, response) {
+  const lines = [];
+  for (const name of [
+    "upgrade",
+    "connection",
+    "sec-websocket-accept",
+    "sec-websocket-protocol",
+    "sec-websocket-extensions"
+  ]) {
+    const value = response.headers[name];
+    if (typeof value === "string") lines.push(`${name}: ${value}`);
+  }
+  socket.write(
+    `HTTP/1.1 ${response.statusCode ?? 101} ${response.statusMessage ?? "Switching Protocols"}\r
+${lines.join("\r\n")}\r
+\r
+`
+  );
+}
+function destroySockets(sockets) {
+  for (const socket of sockets) socket.destroy();
+  sockets.clear();
+}
+function createCompanionOriginGateway({
+  target,
+  originHost = MANAGED_COMPANION_ORIGIN_HOST,
+  originPort = MANAGED_COMPANION_ORIGIN_PORT,
+  isTargetAlive = () => true,
+  createServer = http.createServer,
+  request = http.request,
+  upstreamTimeoutMs = 3e4
+} = {}) {
+  if (!validCompanionOriginTarget(target)) {
+    throw new Error("The companion origin target is invalid");
+  }
+  let accepting = true;
+  let listening = false;
+  let transition = Promise.resolve();
+  const upgradedSockets = /* @__PURE__ */ new Set();
+  const server = createServer((incoming, outgoing) => {
+    if (!accepting || !isTargetAlive(target)) return unavailable(outgoing);
+    const upstream = request(
+      {
+        headers: endToEndHeaders(incoming.headers),
+        method: incoming.method,
+        path: incoming.url,
+        socketPath: target.socketPath,
+        timeout: upstreamTimeoutMs
+      },
+      (response) => {
+        upstream.setTimeout(0);
+        if (!accepting || !isTargetAlive(target)) {
+          response.destroy();
+          return unavailable(outgoing);
+        }
+        outgoing.writeHead(response.statusCode ?? 502, endToEndHeaders(response.headers));
+        response.once("error", () => outgoing.destroy());
+        response.once("aborted", () => outgoing.destroy());
+        response.once("close", () => {
+          if (!response.complete) outgoing.destroy();
+        });
+        response.pipe(outgoing);
+      }
+    );
+    upstream.once("timeout", () => upstream.destroy(new Error("companion origin timed out")));
+    upstream.once("error", () => unavailable(outgoing));
+    incoming.once("aborted", () => upstream.destroy());
+    outgoing.once("close", () => upstream.destroy());
+    incoming.pipe(upstream);
+  });
+  server.on("upgrade", (incoming, socket, head) => {
+    if (!accepting || !isTargetAlive(target)) return socket.destroy();
+    const headers = upgradeHeaders(incoming.headers);
+    if (!headers || incoming.method !== "GET") return socket.destroy();
+    upgradedSockets.add(socket);
+    let remoteSocket = null;
+    const release = () => {
+      upgradedSockets.delete(socket);
+      if (remoteSocket) upgradedSockets.delete(remoteSocket);
+    };
+    socket.once("close", release);
+    const upstream = request({
+      headers,
+      method: "GET",
+      path: incoming.url,
+      socketPath: target.socketPath,
+      timeout: upstreamTimeoutMs
+    });
+    upstream.once("timeout", () => upstream.destroy(new Error("companion origin upgrade timed out")));
+    upstream.once("upgrade", (response, remote, remoteHead) => {
+      upstream.setTimeout(0);
+      remote.setTimeout(0);
+      if (!accepting || !isTargetAlive(target)) {
+        remote.destroy();
+        socket.destroy();
+        return;
+      }
+      writeUpgrade(socket, response);
+      remoteSocket = remote;
+      upgradedSockets.add(remote);
+      remote.once("close", release);
+      if (head.length) remote.write(head);
+      if (remoteHead.length) socket.write(remoteHead);
+      socket.pipe(remote).pipe(socket);
+    });
+    upstream.once("response", (response) => {
+      response.resume();
+      socket.destroy();
+    });
+    upstream.once("error", () => socket.destroy());
+    socket.once("close", () => upstream.destroy());
+    upstream.end();
+  });
+  server.on("clientError", (_error, socket) => socket.destroy());
+  const serialize = (work) => {
+    const next = transition.then(work, work);
+    transition = next.then(
+      () => {
+      },
+      () => {
+      }
+    );
+    return next;
+  };
+  return Object.freeze({
+    start() {
+      return serialize(async () => {
+        if (listening) return server.address();
+        await new Promise((resolve3, reject) => {
+          const onError = (error) => {
+            server.off("listening", onListening);
+            reject(error);
+          };
+          const onListening = () => {
+            server.off("error", onError);
+            resolve3();
+          };
+          server.once("error", onError);
+          server.once("listening", onListening);
+          server.listen({ exclusive: true, host: originHost, port: originPort });
+        });
+        listening = true;
+        return server.address();
+      });
+    },
+    invalidate() {
+      accepting = false;
+      server.closeAllConnections?.();
+      destroySockets(upgradedSockets);
+    },
+    close() {
+      return serialize(async () => {
+        accepting = false;
+        server.closeAllConnections?.();
+        destroySockets(upgradedSockets);
+        if (!listening) return;
+        await new Promise((resolve3) => server.close(() => resolve3()));
+        listening = false;
+      });
+    }
+  });
+}
+
+// electron/managed-companion-guardian.mjs
+import { spawn } from "node:child_process";
+import path2 from "node:path";
+import { fileURLToPath } from "node:url";
+var copyEnvironmentValue = (source, target, names) => {
+  const entries = Object.entries(source);
+  for (const name of names) {
+    const found = entries.find(([key]) => key.toLowerCase() === name.toLowerCase());
+    if (found) target[found[0]] = found[1];
+  }
+};
+function minimalCloudflaredEnvironment(environment = process.env, platform = process.platform) {
+  const minimal = {};
+  copyEnvironmentValue(environment, minimal, ["PATH"]);
+  if (platform === "win32") {
+    copyEnvironmentValue(environment, minimal, ["SystemRoot", "WINDIR", "TEMP", "TMP"]);
+  }
+  return minimal;
+}
+function minimalGuardianEnvironment(environment = process.env, platform = process.platform) {
+  return {
+    ...minimalCloudflaredEnvironment(environment, platform),
+    ELECTRON_RUN_AS_NODE: "1"
+  };
+}
+function processIsAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error?.code !== "ESRCH";
+  }
+}
+var delay = (milliseconds) => new Promise((resolve3) => {
+  const timer = setTimeout(resolve3, milliseconds);
+  timer.unref?.();
+});
+async function terminateConnector(child, graceMs = 250) {
+  if (!child || child.exitCode !== null || child.signalCode !== null) return;
+  let exited = false;
+  const exit = new Promise((resolve3) => {
+    const finish = () => {
+      if (exited) return;
+      exited = true;
+      resolve3();
+    };
+    child.once("exit", finish);
+    child.once("error", () => {
+      if (!Number.isSafeInteger(child.pid)) finish();
+    });
+  });
+  try {
+    child.kill("SIGTERM");
+  } catch {
+  }
+  await Promise.race([exit, delay(graceMs)]);
+  if (exited || child.exitCode !== null || child.signalCode !== null) return;
+  try {
+    child.kill("SIGKILL");
+  } catch {
+  }
+  await exit;
+}
+function ownerLoss(ownerInput, signalSource) {
+  return new Promise((resolve3) => {
+    let settled = false;
+    const finish = () => {
+      if (settled) return;
+      settled = true;
+      resolve3({ kind: "owner" });
+    };
+    ownerInput.once("end", finish);
+    ownerInput.once("close", finish);
+    ownerInput.once("error", finish);
+    signalSource.once("SIGINT", finish);
+    signalSource.once("SIGTERM", finish);
+    ownerInput.resume?.();
+  });
+}
+async function runManagedCompanionGuardian({
+  cloudflaredBinary,
+  tokenFile,
+  target,
+  originPort = MANAGED_COMPANION_ORIGIN_PORT,
+  environment = process.env,
+  platform = process.platform,
+  ownerInput = process.stdin,
+  signalSource = process,
+  spawnProcess = spawn,
+  isTargetAlive = ({ pid }) => processIsAlive(pid),
+  createGateway = createCompanionOriginGateway
+} = {}) {
+  if (!path2.isAbsolute(cloudflaredBinary ?? "") || !path2.isAbsolute(tokenFile ?? "")) {
+    throw new Error("The managed connector paths are invalid");
+  }
+  if (!validCompanionOriginTarget(target, platform)) {
+    throw new Error("The managed companion origin target is invalid");
+  }
+  if (!Number.isInteger(originPort) || originPort < 1 || originPort > 65535) {
+    throw new Error("The managed companion origin port is invalid");
+  }
+  const gateway = createGateway({
+    target,
+    originPort,
+    isTargetAlive
+  });
+  await gateway.start();
+  let connector;
+  try {
+    connector = spawnProcess(
+      cloudflaredBinary,
+      [
+        "tunnel",
+        "--no-autoupdate",
+        "--loglevel",
+        "info",
+        "--output",
+        "json",
+        "run",
+        "--token-file",
+        tokenFile
+      ],
+      {
+        env: minimalCloudflaredEnvironment(environment, platform),
+        shell: false,
+        windowsHide: true,
+        stdio: ["ignore", "ignore", "ignore"]
+      }
+    );
+  } catch (error) {
+    gateway.invalidate();
+    await gateway.close();
+    throw error;
+  }
+  const connectorExit = new Promise((resolve3) => {
+    connector.once("exit", (code) => resolve3({ kind: "connector", code: code ?? 1 }));
+    connector.once("error", () => {
+      if (!Number.isSafeInteger(connector.pid)) {
+        resolve3({ kind: "connector", code: 1 });
+      }
+    });
+  });
+  const outcome = await Promise.race([connectorExit, ownerLoss(ownerInput, signalSource)]);
+  gateway.invalidate();
+  if (outcome.kind === "owner") await terminateConnector(connector);
+  await gateway.close();
+  return outcome.kind === "connector" ? outcome.code : 0;
+}
+function guardianArguments(argv) {
+  if (argv.length !== 5) throw new Error("The managed companion guardian arguments are invalid");
+  const [cloudflaredBinary, tokenFile, socketPath, rawPid, rawPort] = argv;
+  const pid = Number(rawPid);
+  const originPort = Number(rawPort);
+  const target = { pid, socketPath };
+  if (!validCompanionOriginTarget(target)) {
+    throw new Error("The managed companion guardian target is invalid");
+  }
+  return { cloudflaredBinary, tokenFile, target, originPort };
+}
+var isDirectExecution = process.argv[1] && path2.resolve(process.argv[1]) === path2.resolve(fileURLToPath(import.meta.url));
+if (isDirectExecution) {
+  runManagedCompanionGuardian(guardianArguments(process.argv.slice(2))).then(
+    (code) => process.exit(code),
+    () => process.exit(1)
+  );
+}
+
+// electron/managed-companion-tunnel.mjs
+var MANAGED_COMPANION_ENDPOINT_FIELD = "managedCompanionEndpointUrl";
+var MANAGED_COMPANION_TOKEN_FIELD = "managedCompanionConnectorToken";
+var MANAGED_COMPANION_ORIGIN_VERSION_FIELD = "managedCompanionOriginVersion";
+var MANAGED_COMPANION_ORIGIN_VERSION = 2;
+var TOKEN_FILE_PATTERN = /^connector-([1-9][0-9]*)-([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\.token$/;
+var TOKEN_MIN_BYTES = 40;
+var TOKEN_MAX_BYTES = 16 * 1024;
+var isString = (value) => Object.prototype.toString.call(value) === "[object String]";
+function normalizeManagedCompanionEndpoint(value) {
+  if (!isString(value) || !value.trim()) return "";
+  let parsed;
+  try {
+    parsed = new URL(value.trim());
+  } catch {
+    return "";
+  }
+  if (parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.pathname !== "" && parsed.pathname !== "/" || parsed.search || parsed.hash) {
+    return "";
+  }
+  return parsed.origin;
+}
+function validConnectorToken(value) {
+  if (!isString(value)) return false;
+  const bytes = Buffer.byteLength(value);
+  return bytes >= TOKEN_MIN_BYTES && bytes <= TOKEN_MAX_BYTES && value.trim() === value && !/[\0\r\n\t ]/.test(value);
+}
+function normalizeManagedCompanionAccess(credentials) {
+  const endpoint = normalizeManagedCompanionEndpoint(
+    credentials?.[MANAGED_COMPANION_ENDPOINT_FIELD]
+  );
+  const token = credentials?.[MANAGED_COMPANION_TOKEN_FIELD];
+  if (!endpoint || !validConnectorToken(token)) return null;
+  return { endpoint, token };
+}
+function managedCompanionTunnelAccess(credentials) {
+  if (credentials?.[MANAGED_COMPANION_ORIGIN_VERSION_FIELD] !== MANAGED_COMPANION_ORIGIN_VERSION) {
+    return null;
+  }
+  return normalizeManagedCompanionAccess(credentials);
+}
+function withManagedCompanionTunnelAccess(credentials, provision) {
+  const endpoint = normalizeManagedCompanionEndpoint(provision?.endpoint?.url);
+  const token = provision?.connectorToken;
+  if (!endpoint || !validConnectorToken(token)) {
+    throw new Error("The companion service returned an invalid managed endpoint");
+  }
+  return {
+    ...credentials,
+    [MANAGED_COMPANION_ENDPOINT_FIELD]: endpoint,
+    [MANAGED_COMPANION_TOKEN_FIELD]: token,
+    [MANAGED_COMPANION_ORIGIN_VERSION_FIELD]: MANAGED_COMPANION_ORIGIN_VERSION
+  };
+}
+function withoutManagedCompanionTunnelAccess(credentials) {
+  const next = { ...credentials };
+  delete next[MANAGED_COMPANION_ENDPOINT_FIELD];
+  delete next[MANAGED_COMPANION_TOKEN_FIELD];
+  delete next[MANAGED_COMPANION_ORIGIN_VERSION_FIELD];
+  return next;
+}
+function resolveCloudflaredBinary({
+  isPackaged,
+  resourcesPath,
+  appPath,
+  platform = process.platform,
+  arch = process.arch,
+  environment = process.env,
+  exists = fs2.existsSync
+} = {}) {
+  const executable = platform === "win32" ? "cloudflared.exe" : "cloudflared";
+  const bundled = path3.join(String(resourcesPath ?? ""), "cloudflared", executable);
+  if (isPackaged) return exists(bundled) ? bundled : null;
+  const override = environment.OMB_CLOUDFLARED_PATH?.trim();
+  if (override) return path3.isAbsolute(override) && exists(override) ? override : null;
+  const staged = path3.join(
+    String(appPath ?? ""),
+    "dist-native",
+    "cloudflared",
+    `${platform}-${arch}`,
+    executable
+  );
+  if (exists(staged)) return staged;
+  const pathEntry = Object.entries(environment).find(([name]) => name.toLowerCase() === "path");
+  const pathValue = pathEntry?.[1];
+  if (!pathValue) return null;
+  const delimiter2 = platform === "win32" ? ";" : ":";
+  for (const directory of pathValue.split(delimiter2)) {
+    if (!directory || !path3.isAbsolute(directory)) continue;
+    const candidate = path3.join(directory, executable);
+    if (exists(candidate)) return candidate;
+  }
+  return null;
+}
+function ensurePrivateDirectory(directory, fileSystem, currentUid) {
+  fileSystem.mkdirSync(directory, { recursive: true, mode: 448 });
+  const stat = fileSystem.lstatSync(directory);
+  if (!stat.isDirectory() || stat.isSymbolicLink()) {
+    throw new Error("The managed companion runtime path is unsafe");
+  }
+  if (currentUid !== void 0 && stat.uid !== currentUid) {
+    throw new Error("The managed companion runtime path has an unexpected owner");
+  }
+  fileSystem.chmodSync(directory, 448);
+}
+function processIsAlive2(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error?.code !== "ESRCH";
+  }
+}
+var currentUserId2 = () => process.platform === "win32" ? void 0 : process.getuid?.() ?? os2.userInfo().uid;
+function cleanupStaleManagedCompanionTokens(runtimeRoot, {
+  fileSystem = fs2,
+  currentUid = currentUserId2(),
+  isProcessAlive = processIsAlive2
+} = {}) {
+  let entries;
+  try {
+    ensurePrivateDirectory(runtimeRoot, fileSystem, currentUid);
+    entries = fileSystem.readdirSync(runtimeRoot, { withFileTypes: true });
+  } catch {
+    return 0;
+  }
+  let removed = 0;
+  for (const entry of entries) {
+    const match = TOKEN_FILE_PATTERN.exec(entry.name);
+    if (!match || !entry.isFile() || entry.isSymbolicLink()) continue;
+    const ownerPid = Number(match[1]);
+    if (!Number.isSafeInteger(ownerPid) || isProcessAlive(ownerPid)) continue;
+    const file = path3.join(runtimeRoot, entry.name);
+    try {
+      const stat = fileSystem.lstatSync(file);
+      if (!stat.isFile() || stat.isSymbolicLink() || currentUid !== void 0 && stat.uid !== currentUid || process.platform !== "win32" && (stat.mode & 63) !== 0) {
+        continue;
+      }
+      fileSystem.unlinkSync(file);
+      removed += 1;
+    } catch {
+    }
+  }
+  return removed;
+}
+function writePrivateToken(runtimeRoot, token, { fileSystem, processId, identifier, currentUid }) {
+  ensurePrivateDirectory(runtimeRoot, fileSystem, currentUid);
+  const file = path3.join(runtimeRoot, `connector-${processId}-${identifier()}.token`);
+  let descriptor;
+  try {
+    descriptor = fileSystem.openSync(file, "wx", 384);
+    fileSystem.writeFileSync(descriptor, token, "utf8");
+    fileSystem.fsyncSync(descriptor);
+    fileSystem.closeSync(descriptor);
+    descriptor = void 0;
+    fileSystem.chmodSync(file, 384);
+    return file;
+  } catch (error) {
+    if (descriptor !== void 0) {
+      try {
+        fileSystem.closeSync(descriptor);
+      } catch {
+      }
+    }
+    try {
+      fileSystem.unlinkSync(file);
+    } catch {
+    }
+    throw error;
+  }
+}
+async function waitForExit(child, milliseconds) {
+  if (child.exitCode !== null || child.signalCode !== null) return;
+  await new Promise((resolve3) => {
+    let settled = false;
+    const finish = () => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve3();
+    };
+    child.once("exit", finish);
+    const timer = setTimeout(finish, milliseconds);
+    timer.unref?.();
+  });
+}
+async function terminateChild(child, graceMs) {
+  if (!child || child.exitCode !== null || child.signalCode !== null) return;
+  try {
+    child.stdin?.end();
+  } catch {
+  }
+  await waitForExit(child, graceMs);
+  if (child.exitCode !== null || child.signalCode !== null) return;
+  try {
+    child.kill("SIGTERM");
+  } catch {
+  }
+  await waitForExit(child, Math.min(graceMs, 500));
+}
+async function verifyHostedEndpoint(endpoint, { fetchImpl, timeoutSignal, timeoutMs, cancellationSignal }) {
+  const requestSignal = timeoutSignal(timeoutMs);
+  const response = await fetchImpl(`${endpoint}/api/health`, {
+    headers: { accept: "application/json" },
+    redirect: "error",
+    signal: cancellationSignal ? AbortSignal.any([requestSignal, cancellationSignal]) : requestSignal
+  });
+  if (!response.ok) return false;
+  const text = await response.text();
+  if (Buffer.byteLength(text) > 4096) return false;
+  try {
+    return JSON.parse(text)?.app === "openmausbot";
+  } catch {
+    return false;
+  }
+}
+function createManagedCompanionTunnel({
+  binaryPath,
+  guardianEntry: guardianEntry2,
+  runtimeExecutable = process.execPath,
+  originPort = MANAGED_COMPANION_ORIGIN_PORT,
+  runtimeRoot,
+  environment = process.env,
+  fileSystem = fs2,
+  spawnProcess = spawn2,
+  fetchImpl = globalThis.fetch,
+  timeoutSignal = (milliseconds) => AbortSignal.timeout(milliseconds),
+  identifier = randomUUID2,
+  processId = process.pid,
+  currentUid = currentUserId2(),
+  isProcessAlive = processIsAlive2,
+  verifyTimeoutMs = 15e3,
+  verifyRequestTimeoutMs = 2500,
+  verifyIntervalMs = 250,
+  stopGraceMs = 1500,
+  maxRetryMs = 3e4,
+  onChange = () => {
+  },
+  log = () => {
+  }
+} = {}) {
+  let desired = false;
+  let generation = 0;
+  let intentRevision = 0;
+  let child = null;
+  let tokenFile = null;
+  let activeAttempt = null;
+  let originTarget = null;
+  let access = null;
+  let retryAttempt = 0;
+  let retryTimer = null;
+  let state = Object.freeze({ status: "stopped", ready: false, configured: false });
+  let transition = Promise.resolve();
+  cleanupStaleManagedCompanionTokens(runtimeRoot, {
+    fileSystem,
+    currentUid,
+    isProcessAlive
+  });
+  const publish = (next) => {
+    const published = {
+      configured: Boolean(access),
+      ready: next.status === "ready",
+      ...next
+    };
+    if (access) published.endpoint = access.endpoint;
+    state = Object.freeze(published);
+    onChange(state);
+    return state;
+  };
+  const removeTokenFile = (file = tokenFile) => {
+    if (!file) return;
+    if (tokenFile === file) tokenFile = null;
+    try {
+      fileSystem.unlinkSync(file);
+    } catch (error) {
+      if (error?.code !== "ENOENT") log("managed companion connector token cleanup failed");
+    }
+  };
+  const serialize = (work) => {
+    const next = transition.then(work, work);
+    transition = next.then(
+      () => {
+      },
+      () => {
+      }
+    );
+    return next;
+  };
+  const scheduleRetry = (reason, ownedGeneration) => {
+    if (!desired || ownedGeneration !== generation || retryTimer) return;
+    const delay2 = Math.min(1e3 * 2 ** retryAttempt, maxRetryMs);
+    retryAttempt += 1;
+    publish({ status: "retrying", ready: false, error: reason, retryInMs: delay2 });
+    retryTimer = setTimeout(() => {
+      retryTimer = null;
+      if (!desired || ownedGeneration !== generation) return;
+      void serialize(() => attempt(ownedGeneration));
+    }, delay2);
+    retryTimer.unref?.();
+  };
+  const attempt = async (ownedGeneration) => {
+    if (!desired || ownedGeneration !== generation || !access) return state;
+    if (!binaryPath || !path3.isAbsolute(binaryPath) || !guardianEntry2 || !path3.isAbsolute(guardianEntry2) || !path3.isAbsolute(runtimeExecutable) || !validCompanionOriginTarget(originTarget)) {
+      publish({
+        status: "unavailable",
+        ready: false,
+        error: "The managed companion connector is missing from this build."
+      });
+      return state;
+    }
+    publish({ status: "starting", ready: false });
+    let attemptHandle = null;
+    let attemptTokenFile = null;
+    try {
+      tokenFile = writePrivateToken(runtimeRoot, access.token, {
+        fileSystem,
+        processId,
+        identifier,
+        currentUid
+      });
+      attemptTokenFile = tokenFile;
+      const spawned = spawnProcess(
+        runtimeExecutable,
+        [
+          guardianEntry2,
+          binaryPath,
+          tokenFile,
+          originTarget.socketPath,
+          String(originTarget.pid),
+          String(originPort)
+        ],
+        {
+          env: minimalGuardianEnvironment(environment),
+          shell: false,
+          windowsHide: true,
+          // This open pipe is the parent-death signal. The guardian owns both
+          // gateway and connector and tears them down on EOF.
+          stdio: ["pipe", "ignore", "ignore"]
+        }
+      );
+      child = spawned;
+      const cancellationController = new AbortController();
+      let resolveCancellation;
+      const cancellation = new Promise((resolve3) => {
+        resolveCancellation = resolve3;
+      });
+      let cancelled = false;
+      attemptHandle = {
+        generation: ownedGeneration,
+        cancel() {
+          if (cancelled) return;
+          cancelled = true;
+          cancellationController.abort();
+          resolveCancellation(false);
+        }
+      };
+      activeAttempt = attemptHandle;
+      let terminated = false;
+      let expectedStop = false;
+      let resolveExit;
+      const exit = new Promise((resolve3) => {
+        resolveExit = resolve3;
+      });
+      const onTerminated = () => {
+        if (terminated) return;
+        terminated = true;
+        resolveExit();
+        if (child === spawned) child = null;
+        removeTokenFile(attemptTokenFile);
+        if (!expectedStop && desired && ownedGeneration === generation) {
+          scheduleRetry("The secure connection stopped unexpectedly.", ownedGeneration);
+        }
+      };
+      spawned.once("exit", onTerminated);
+      spawned.once("error", onTerminated);
+      const deadline = Date.now() + verifyTimeoutMs;
+      while (desired && ownedGeneration === generation && child === spawned && !terminated) {
+        const verified = await Promise.race([
+          verifyHostedEndpoint(access.endpoint, {
+            fetchImpl,
+            timeoutSignal,
+            timeoutMs: verifyRequestTimeoutMs,
+            cancellationSignal: cancellationController.signal
+          }).catch(() => false),
+          exit.then(() => false),
+          cancellation
+        ]);
+        if (verified && child === spawned && desired && ownedGeneration === generation) {
+          removeTokenFile(attemptTokenFile);
+          retryAttempt = 0;
+          publish({ status: "ready", ready: true });
+          return state;
+        }
+        if (Date.now() >= deadline) break;
+        await Promise.race([
+          new Promise((resolve3) => {
+            const timer = setTimeout(resolve3, verifyIntervalMs);
+            timer.unref?.();
+          }),
+          exit,
+          cancellation
+        ]);
+      }
+      if (child === spawned) {
+        expectedStop = true;
+        child = null;
+        await terminateChild(spawned, stopGraceMs);
+      }
+      removeTokenFile(attemptTokenFile);
+      if (desired && ownedGeneration === generation) {
+        scheduleRetry("The secure connection could not be verified.", ownedGeneration);
+      }
+      return state;
+    } catch {
+      const spawned = child;
+      child = null;
+      removeTokenFile(attemptTokenFile);
+      if (spawned) await terminateChild(spawned, stopGraceMs);
+      if (desired && ownedGeneration === generation) {
+        scheduleRetry("The secure connection could not start.", ownedGeneration);
+      }
+      return state;
+    } finally {
+      if (activeAttempt === attemptHandle) activeAttempt = null;
+    }
+  };
+  return Object.freeze({
+    getStatus() {
+      return state;
+    },
+    start(rawAccess) {
+      const requestedRevision = ++intentRevision;
+      return serialize(async () => {
+        if (requestedRevision !== intentRevision) return state;
+        const normalized = normalizeManagedCompanionAccess({
+          [MANAGED_COMPANION_ENDPOINT_FIELD]: rawAccess?.endpoint,
+          [MANAGED_COMPANION_TOKEN_FIELD]: rawAccess?.token
+        });
+        const normalizedOriginTarget = validCompanionOriginTarget(rawAccess?.originTarget) ? Object.freeze({
+          pid: rawAccess.originTarget.pid,
+          socketPath: rawAccess.originTarget.socketPath
+        }) : null;
+        if (desired && normalized && access?.endpoint === normalized.endpoint && access?.token === normalized.token && originTarget?.pid === normalizedOriginTarget?.pid && originTarget?.socketPath === normalizedOriginTarget?.socketPath && child) {
+          return state;
+        }
+        generation += 1;
+        desired = Boolean(normalized);
+        access = normalized;
+        originTarget = normalizedOriginTarget;
+        retryAttempt = 0;
+        if (retryTimer) clearTimeout(retryTimer);
+        retryTimer = null;
+        const existing = child;
+        child = null;
+        if (existing) await terminateChild(existing, stopGraceMs);
+        removeTokenFile();
+        if (!access) {
+          return publish({
+            status: "unconfigured",
+            ready: false,
+            error: "Sign in to enable a secure connection from any network."
+          });
+        }
+        return attempt(generation);
+      });
+    },
+    stop() {
+      const requestedRevision = ++intentRevision;
+      desired = false;
+      generation += 1;
+      if (retryTimer) clearTimeout(retryTimer);
+      retryTimer = null;
+      activeAttempt?.cancel();
+      const existing = child;
+      child = null;
+      const existingTokenFile = tokenFile;
+      removeTokenFile(existingTokenFile);
+      const terminated = existing ? terminateChild(existing, stopGraceMs) : Promise.resolve();
+      return serialize(async () => {
+        await terminated;
+        if (requestedRevision !== intentRevision) return state;
+        return publish({ status: "stopped", ready: false });
+      });
+    },
+    shutdown() {
+      return this.stop();
+    }
+  });
+}
+
+// electron/companion-account-service.mjs
+var DEFAULT_COMPANION_CONTROL_PLANE_URL = "https://accounts.openmausbot.com";
+var COMPANION_CLIENT_INSTANCE_FIELD = "companionClientInstanceId";
+var COMPANION_ACCOUNT_TOKEN_FIELD = "companionAccountToken";
+var COMPANION_ACCOUNT_USER_ID_FIELD = "companionAccountUserId";
+var COMPANION_ACCOUNT_EMAIL_FIELD = "companionAccountEmail";
+var COMPANION_INSTALLATION_ID_FIELD = "companionInstallationId";
+var COMPANION_INSTALLATION_CREDENTIAL_FIELD = "companionInstallationCredential";
+var COMPANION_INSTALLATION_EXPIRY_FIELD = "companionInstallationCredentialExpiresAt";
+var COMPANION_ACCOUNT_CLEANUP_PENDING_FIELD = "companionAccountCleanupPending";
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var INSTALLATION_ID2 = UUID;
+var INSTALLATION_CREDENTIAL2 = /^omb_install_[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}$/;
+var DEFAULT_HEALTH_CACHE_MS = 3e4;
+var ownString = (document, field) => typeof document?.[field] === "string" ? document[field] : "";
+function resolveCompanionControlPlaneURL({
+  isPackaged,
+  environment = process.env
+} = {}) {
+  if (Object.hasOwn(environment, "OMB_CONTROL_PLANE_URL")) {
+    return normalizeControlPlaneURL(environment.OMB_CONTROL_PLANE_URL);
+  }
+  return isPackaged ? DEFAULT_COMPANION_CONTROL_PLANE_URL : "";
+}
+function companionAccountCleanupPending(credentials) {
+  return credentials?.[COMPANION_ACCOUNT_CLEANUP_PENDING_FIELD] === true;
+}
+function storedAccount(credentials) {
+  const email = normalizeAccountEmail(ownString(credentials, COMPANION_ACCOUNT_EMAIL_FIELD));
+  const userId = ownString(credentials, COMPANION_ACCOUNT_USER_ID_FIELD);
+  if (!email || !userId || userId.length > 256) return null;
+  return {
+    email,
+    userId,
+    accountToken: ownString(credentials, COMPANION_ACCOUNT_TOKEN_FIELD),
+    installationId: INSTALLATION_ID2.test(ownString(credentials, COMPANION_INSTALLATION_ID_FIELD)) ? credentials[COMPANION_INSTALLATION_ID_FIELD] : "",
+    installationCredential: INSTALLATION_CREDENTIAL2.test(
+      ownString(credentials, COMPANION_INSTALLATION_CREDENTIAL_FIELD)
+    ) ? credentials[COMPANION_INSTALLATION_CREDENTIAL_FIELD] : ""
+  };
+}
+function withoutCompanionAccount(credentials) {
+  const next = withoutManagedCompanionTunnelAccess(credentials);
+  for (const field of [
+    COMPANION_ACCOUNT_TOKEN_FIELD,
+    COMPANION_ACCOUNT_USER_ID_FIELD,
+    COMPANION_ACCOUNT_EMAIL_FIELD,
+    COMPANION_INSTALLATION_ID_FIELD,
+    COMPANION_INSTALLATION_CREDENTIAL_FIELD,
+    COMPANION_INSTALLATION_EXPIRY_FIELD,
+    COMPANION_ACCOUNT_CLEANUP_PENDING_FIELD
+  ]) {
+    delete next[field];
+  }
+  return next;
+}
+function withProvisionedAccount(credentials, { accountToken, user, installation, provision }) {
+  const withEndpoint = withManagedCompanionTunnelAccess(credentials, provision);
+  const next = {
+    ...withEndpoint,
+    [COMPANION_ACCOUNT_TOKEN_FIELD]: accountToken,
+    [COMPANION_ACCOUNT_USER_ID_FIELD]: user.id,
+    [COMPANION_ACCOUNT_EMAIL_FIELD]: user.email,
+    [COMPANION_INSTALLATION_ID_FIELD]: installation.installation.id,
+    [COMPANION_INSTALLATION_CREDENTIAL_FIELD]: installation.credential
+  };
+  if (Number.isSafeInteger(installation.credentialExpiresAt)) {
+    next[COMPANION_INSTALLATION_EXPIRY_FIELD] = installation.credentialExpiresAt;
+  } else {
+    delete next[COMPANION_INSTALLATION_EXPIRY_FIELD];
+  }
+  delete next[COMPANION_ACCOUNT_CLEANUP_PENDING_FIELD];
+  return next;
+}
+function withAuthenticatedAccount(credentials, { accountToken, user, clientInstanceId, preserveCleanupPending = false }) {
+  const next = {
+    ...credentials,
+    [COMPANION_ACCOUNT_TOKEN_FIELD]: accountToken,
+    [COMPANION_ACCOUNT_USER_ID_FIELD]: user.id,
+    [COMPANION_ACCOUNT_EMAIL_FIELD]: user.email
+  };
+  if (!UUID.test(ownString(next, COMPANION_CLIENT_INSTANCE_FIELD))) {
+    next[COMPANION_CLIENT_INSTANCE_FIELD] = clientInstanceId;
+  }
+  if (preserveCleanupPending) {
+    next[COMPANION_ACCOUNT_CLEANUP_PENDING_FIELD] = true;
+  } else {
+    delete next[COMPANION_ACCOUNT_CLEANUP_PENDING_FIELD];
+  }
+  return next;
+}
+var FRIENDLY_MESSAGES = Object.freeze({
+  invalid_email: "Enter a valid email address.",
+  invalid_request: "The secure connection request was not accepted. Check the details and try again.",
+  invalid_otp: "That code is not valid. Check the email and try again.",
+  otp_expired: "That code expired. Email yourself a new one.",
+  unauthorized: "Your sign-in expired. Email yourself a new code to reconnect.",
+  forbidden: "The secure connection request was not allowed. Try signing in again.",
+  signed_out: "Your sign-in expired. Email yourself a new code to reconnect.",
+  network_unavailable: "OpenMausBot could not reach its secure connection service. Check your internet and try again.",
+  rate_limited: "Too many attempts were made. Wait a little, then try again.",
+  credential_rotation_rate_limited: "This computer was reconnected too often. Wait a little, then try again.",
+  installation_limit_reached: "This account has reached its computer limit. Remove an old computer and try again.",
+  installation_exists: "This computer is already connected. Try again to recover it.",
+  endpoint_busy: "The secure connection is still being prepared. Try again in a moment.",
+  endpoint_unavailable: "The secure connection service could not finish setup. Local pairing still works; try again shortly.",
+  endpoint_cleanup_pending: "The secure connection is still being removed. Try signing out again shortly.",
+  control_plane_unavailable: "Secure access is not available right now. Local pairing still works.",
+  internal_error: "The secure connection service had a problem. Local pairing still works; try again.",
+  invalid_response: "The secure connection service returned an unexpected response. Try again.",
+  request_failed: "The secure connection request could not be completed. Local pairing still works; try again."
+});
+function friendlyCompanionAccountError(error) {
+  const code = error instanceof ControlPlaneError ? error.code : "";
+  const message2 = FRIENDLY_MESSAGES[code] ?? FRIENDLY_MESSAGES.request_failed;
+  const reference = error instanceof ControlPlaneError && error.requestId ? ` Reference: ${error.requestId}.` : "";
+  return `${message2}${reference}`;
+}
+function publicState({ available, status, email, endpoint, message: message2 }) {
+  const state = { available: Boolean(available), status };
+  const normalizedEmail = normalizeAccountEmail(email);
+  if (normalizedEmail) state.email = normalizedEmail;
+  const accessEndpoint = (() => {
+    if (typeof endpoint !== "string") return "";
+    try {
+      const parsed = new URL(endpoint);
+      return parsed.protocol === "https:" && parsed.pathname === "/" && !parsed.search && !parsed.hash ? parsed.origin : "";
+    } catch {
+      return "";
+    }
+  })();
+  if (accessEndpoint) state.endpoint = accessEndpoint;
+  const safeMessage = typeof message2 === "string" && message2.length >= 1 && message2.length <= 280 ? message2 : null;
+  if (safeMessage) state.message = safeMessage;
+  return Object.freeze(state);
+}
+function createCompanionAccountService({
+  client,
+  readCredentials,
+  updateCredentials,
+  identity,
+  newClientInstanceId,
+  activatePersistedEndpoint = async () => ({ status: "stopped", ready: false }),
+  stopManagedEndpoint = async () => {
+  },
+  managedConnectionState = () => ({ status: "stopped", ready: false }),
+  companionIsOn = () => false,
+  now = Date.now,
+  healthCacheMs = DEFAULT_HEALTH_CACHE_MS
+} = {}) {
+  const configured = Boolean(client);
+  let healthy = false;
+  let lastHealthCheck = null;
+  let healthProbe = null;
+  let phase = null;
+  let transition = Promise.resolve();
+  const serialize = (work) => {
+    const next = transition.then(work, work);
+    transition = next.then(
+      () => {
+      },
+      () => {
+      }
+    );
+    return next;
+  };
+  const credentials = () => readCredentials?.() ?? {};
+  const probeControlPlane = async ({ force = false } = {}) => {
+    if (!configured) return false;
+    const checkedAt = now();
+    if (!force && lastHealthCheck !== null && checkedAt - lastHealthCheck < Math.max(0, healthCacheMs)) {
+      return healthy;
+    }
+    if (healthProbe) return healthProbe;
+    healthProbe = (async () => {
+      try {
+        await client.health();
+        healthy = true;
+      } catch {
+        healthy = false;
+      }
+      lastHealthCheck = now();
+      return healthy;
+    })().finally(() => {
+      healthProbe = null;
+    });
+    return healthProbe;
+  };
+  const requireHealthyControlPlane = async () => {
+    if (!await probeControlPlane({ force: true })) {
+      throw new ControlPlaneError("control_plane_unavailable");
+    }
+  };
+  const settledState = () => {
+    if (!configured) {
+      return publicState({
+        available: false,
+        status: "signed-out",
+        message: FRIENDLY_MESSAGES.control_plane_unavailable
+      });
+    }
+    const document = credentials();
+    const account = storedAccount(document);
+    const persistedAccess = managedCompanionTunnelAccess(document);
+    const available = healthy || Boolean(account);
+    if (!healthy) {
+      return publicState({
+        available,
+        status: account ? "error" : "signed-out",
+        email: account?.email,
+        endpoint: persistedAccess?.endpoint,
+        message: FRIENDLY_MESSAGES.control_plane_unavailable
+      });
+    }
+    if (phase && ["connecting", "error"].includes(phase.status) && account && persistedAccess && !companionAccountCleanupPending(document) && managedConnectionState?.()?.ready === true) {
+      phase = null;
+    }
+    if (phase) return publicState({ available, ...phase });
+    if (!account) return publicState({ available, status: "signed-out" });
+    const access = persistedAccess;
+    if (!access) {
+      return publicState({
+        available,
+        status: "error",
+        email: account.email,
+        message: "This computer still needs a secure address. Try again; local pairing continues to work."
+      });
+    }
+    const connection = managedConnectionState?.() ?? {};
+    if (companionIsOn()) {
+      if (["starting", "retrying"].includes(connection.status)) {
+        return publicState({
+          available,
+          status: "connecting",
+          email: account.email,
+          endpoint: access.endpoint,
+          message: "The secure connection is starting. Local pairing remains available."
+        });
+      }
+      if (["unavailable", "error"].includes(connection.status)) {
+        return publicState({
+          available,
+          status: "error",
+          email: account.email,
+          endpoint: access.endpoint,
+          message: "The secure connection needs attention. Local pairing still works."
+        });
+      }
+    }
+    return publicState({
+      available,
+      status: "ready",
+      email: account.email,
+      endpoint: access.endpoint
+    });
+  };
+  const ensureClientIdentity = async () => {
+    const existing = ownString(credentials(), COMPANION_CLIENT_INSTANCE_FIELD);
+    if (UUID.test(existing)) return existing;
+    const candidate = newClientInstanceId?.();
+    if (!UUID.test(candidate ?? "")) throw new Error("A stable computer identity could not be created");
+    await updateCredentials((document) => {
+      if (UUID.test(ownString(document, COMPANION_CLIENT_INSTANCE_FIELD))) return document;
+      return { ...document, [COMPANION_CLIENT_INSTANCE_FIELD]: candidate };
+    });
+    return ownString(credentials(), COMPANION_CLIENT_INSTANCE_FIELD);
+  };
+  const markCleanupPending = async () => {
+    await updateCredentials((document) => ({
+      ...document,
+      [COMPANION_ACCOUNT_CLEANUP_PENDING_FIELD]: true
+    }));
+  };
+  const clearAfterCleanup = async () => {
+    await updateCredentials(withoutCompanionAccount);
+    await stopManagedEndpoint();
+    phase = null;
+  };
+  const cleanupCurrentAccount = async ({ markPending = true } = {}) => {
+    const document = credentials();
+    const account = storedAccount(document);
+    if (!account) {
+      await clearAfterCleanup();
+      return true;
+    }
+    if (markPending && !companionAccountCleanupPending(document)) await markCleanupPending();
+    await stopManagedEndpoint();
+    if (account.installationCredential) {
+      try {
+        await client.deleteEndpoint(account.installationCredential);
+      } catch {
+      }
+    }
+    if (!account.accountToken) {
+      throw new ControlPlaneError("signed_out", 401);
+    }
+    const clientInstanceId = ownString(document, COMPANION_CLIENT_INSTANCE_FIELD);
+    if (!UUID.test(clientInstanceId)) {
+      throw new ControlPlaneError("invalid_client_identity");
+    }
+    if (account.installationId) {
+      await client.revokeInstallation(account.accountToken, account.installationId).catch(() => {
+      });
+    }
+    const installations = await client.listInstallations(account.accountToken);
+    for (const installation of installations) {
+      if (installation.clientInstanceId !== clientInstanceId && installation.id !== account.installationId) {
+        continue;
+      }
+      try {
+        await client.revokeInstallation(account.accountToken, installation.id);
+      } catch (error) {
+        if (!(error instanceof ControlPlaneError) || error.status !== 404) throw error;
+      }
+    }
+    try {
+      await client.signOut(account.accountToken);
+    } catch {
+    }
+    await clearAfterCleanup();
+    return true;
+  };
+  const provision = async ({ accountToken, user }) => {
+    const clientInstanceId = await ensureClientIdentity();
+    const before = credentials();
+    const previous = storedAccount(before);
+    const installation = await client.ensureInstallation({
+      accountToken,
+      currentCredential: previous?.userId === user.id ? previous.installationCredential : "",
+      clientInstanceId,
+      name: identity.name,
+      platform: identity.platform,
+      appVersion: identity.appVersion
+    });
+    const endpoint = await client.ensureEndpoint(installation.credential);
+    try {
+      await updateCredentials(
+        (document) => withProvisionedAccount(document, {
+          accountToken,
+          user,
+          installation,
+          provision: endpoint
+        })
+      );
+    } catch (error) {
+      await client.deleteEndpoint(installation.credential).catch(() => {
+      });
+      await client.revokeInstallation(accountToken, installation.installation.id).catch(() => {
+      });
+      throw error;
+    }
+    const connection = await activatePersistedEndpoint();
+    phase = null;
+    if (companionIsOn() && connection && ["unavailable", "error"].includes(connection.status)) {
+      phase = {
+        status: "error",
+        email: user.email,
+        endpoint: endpoint.endpoint.url,
+        message: "The address is ready, but this app could not start its secure connection. Local pairing still works."
+      };
+    }
+    return settledState();
+  };
+  const failAction = (error, { email, expiredSessionIsSignedOut = false, signedOut = false } = {}) => {
+    const message2 = friendlyCompanionAccountError(error);
+    phase = {
+      status: signedOut || expiredSessionIsSignedOut && error instanceof ControlPlaneError && error.status === 401 ? "signed-out" : "error",
+      email,
+      message: message2
+    };
+    return message2;
+  };
+  const requestCode = (rawEmail) => serialize(async () => {
+    if (!configured) throw new Error(FRIENDLY_MESSAGES.control_plane_unavailable);
+    const email = normalizeAccountEmail(rawEmail);
+    let requested;
+    try {
+      await requireHealthyControlPlane();
+      requested = await client.requestOTP(email);
+    } catch (error) {
+      const message2 = failAction(error, { email, signedOut: true });
+      throw new Error(message2);
+    }
+    phase = {
+      status: "signed-out",
+      email: requested.email
+    };
+    return settledState();
+  });
+  const verifyCode = (rawEmail, rawCode) => serialize(async () => {
+    if (!configured) throw new Error(FRIENDLY_MESSAGES.control_plane_unavailable);
+    const email = normalizeAccountEmail(rawEmail);
+    phase = { status: "connecting", email };
+    let verified;
+    try {
+      await requireHealthyControlPlane();
+      verified = await client.verifyOTP(email, rawCode);
+    } catch (error) {
+      const message2 = failAction(error, { email, signedOut: true });
+      throw new Error(message2);
+    }
+    const previous = storedAccount(credentials());
+    const refreshingPendingCleanup = Boolean(
+      previous && previous.userId === verified.user.id && companionAccountCleanupPending(credentials())
+    );
+    let authenticatedPersisted = false;
+    try {
+      if (previous && previous.userId !== verified.user.id) {
+        await cleanupCurrentAccount();
+      }
+      const existingIdentity = ownString(credentials(), COMPANION_CLIENT_INSTANCE_FIELD);
+      const clientInstanceId = UUID.test(existingIdentity) ? existingIdentity : newClientInstanceId?.();
+      if (!UUID.test(clientInstanceId ?? "")) {
+        throw new Error("A stable computer identity could not be created");
+      }
+      await updateCredentials(
+        (document) => withAuthenticatedAccount(document, {
+          ...verified,
+          clientInstanceId,
+          preserveCleanupPending: refreshingPendingCleanup
+        })
+      );
+      authenticatedPersisted = true;
+      if (refreshingPendingCleanup) {
+        await cleanupCurrentAccount({ markPending: false });
+        return settledState();
+      }
+      return await provision(verified);
+    } catch (error) {
+      if (!authenticatedPersisted) await client.signOut(verified.accountToken).catch(() => {
+      });
+      failAction(error, {
+        email: authenticatedPersisted ? verified.user.email : previous?.email ?? email,
+        expiredSessionIsSignedOut: authenticatedPersisted
+      });
+      return settledState();
+    }
+  });
+  const retryWork = async () => {
+    if (!configured) return settledState();
+    const account = storedAccount(credentials());
+    if (!account) {
+      phase = null;
+      return settledState();
+    }
+    if (companionAccountCleanupPending(credentials())) {
+      phase = { status: "connecting", email: account.email };
+      try {
+        await requireHealthyControlPlane();
+        await cleanupCurrentAccount({ markPending: false });
+      } catch (error) {
+        failAction(error, { email: account.email, expiredSessionIsSignedOut: true });
+      }
+      return settledState();
+    }
+    phase = { status: "connecting", email: account.email };
+    try {
+      await requireHealthyControlPlane();
+      return await provision({
+        accountToken: account.accountToken,
+        user: { id: account.userId, email: account.email }
+      });
+    } catch (error) {
+      failAction(error, { email: account.email, expiredSessionIsSignedOut: true });
+      return settledState();
+    }
+  };
+  const retry = () => serialize(retryWork);
+  const signOut = () => serialize(async () => {
+    if (!storedAccount(credentials())) {
+      await clearAfterCleanup();
+      return settledState();
+    }
+    const email = storedAccount(credentials())?.email;
+    phase = { status: "connecting", email };
+    try {
+      await cleanupCurrentAccount();
+      healthy = true;
+      lastHealthCheck = now();
+      return settledState();
+    } catch (error) {
+      failAction(error, { email });
+      return settledState();
+    }
+  });
+  const restore = () => serialize(async () => {
+    if (!configured) return settledState();
+    if (!await probeControlPlane({ force: true })) return settledState();
+    if (companionAccountCleanupPending(credentials())) return retryWork();
+    await ensureClientIdentity();
+    const account = storedAccount(credentials());
+    if (account && !managedCompanionTunnelAccess(credentials())) return retryWork();
+    phase = null;
+    return settledState();
+  });
+  return Object.freeze({
+    state: async () => {
+      await probeControlPlane();
+      return settledState();
+    },
+    requestCode,
+    verifyCode,
+    retry,
+    signOut,
+    restore
+  });
+}
+
+// electron/secure-credential-state.mjs
+var isPlainRecord2 = (value) => {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+  try {
+    const constructor = value.constructor;
+    if (constructor === void 0 || typeof constructor !== "function") return true;
+    const prototype = constructor.prototype;
+    return typeof prototype === "object" && prototype !== null && Object.prototype.hasOwnProperty.call(prototype, "isPrototypeOf");
+  } catch {
+    return false;
+  }
+};
+var copy = (credentials) => {
+  if (!isPlainRecord2(credentials)) {
+    throw new TypeError("Secure credentials must be a plain record");
+  }
+  const document = {};
+  for (const key of Reflect.ownKeys(credentials)) {
+    if (!Object.prototype.propertyIsEnumerable.call(credentials, key)) continue;
+    if (typeof key !== "string") {
+      throw new TypeError("Secure credential keys must be strings");
+    }
+    if (key === "__proto__") continue;
+    document[key] = credentials[key];
+  }
+  return structuredClone(document);
+};
+function createSecureCredentialState(initialCredentials, persist, { writable = true } = {}) {
+  let current = copy(initialCredentials);
+  let transition = Promise.resolve();
+  const assertWritable = () => {
+    if (writable) return;
+    throw new Error("The credential store could not be read on this launch, so credentials cannot be saved");
+  };
+  const serialize = (work) => {
+    const next = transition.then(work, work);
+    transition = next.then(
+      () => {
+      },
+      () => {
+      }
+    );
+    return next;
+  };
+  return {
+    read() {
+      return copy(current);
+    },
+    update(derive, afterPersist) {
+      return serialize(async () => {
+        assertWritable();
+        const previous = copy(current);
+        const next = copy(await derive(copy(previous)));
+        await persist(copy(next));
+        try {
+          const result = await afterPersist?.(copy(next));
+          current = next;
+          return result ?? copy(next);
+        } catch (error) {
+          await persist(copy(previous));
+          current = previous;
+          throw error;
+        }
+      });
+    }
+  };
+}
+
+// server/atomic.ts
+import { randomUUID as randomUUID3 } from "node:crypto";
+import { closeSync, fsyncSync, openSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+function writeFileAtomic(path4, data, options = {}) {
+  const tmp = `${path4}.${process.pid}.${randomUUID3()}.tmp`;
+  let fd = null;
+  try {
+    fd = openSync(tmp, "w", options.mode);
+    writeFileSync(fd, data);
+    fsyncSync(fd);
+    closeSync(fd);
+    fd = null;
+    renameSync(tmp, path4);
+  } catch (e) {
+    if (fd !== null) {
+      try {
+        closeSync(fd);
+      } catch {
+      }
+    }
+    try {
+      unlinkSync(tmp);
+    } catch {
+    }
+    throw e;
+  }
+}
+
+// server/tunnel.ts
+var HERE = dirname(fileURLToPath2(import.meta.url));
+var TUNNEL_CREDENTIALS_FILE = "tunnel-account.json";
+var TUNNEL_RUNTIME_DIR = "tunnel-runtime";
+function plainDocument(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+  const document = {};
+  for (const [key, entry] of Object.entries(value)) document[key] = entry;
+  return document;
+}
+function openTunnelCredentials(dataDir) {
+  const file = join2(dataDir, TUNNEL_CREDENTIALS_FILE);
+  let initial = {};
+  let status = "empty";
+  if (existsSync(file)) {
+    try {
+      if (process.platform !== "win32" && (statSync(file).mode & 63) !== 0) chmodSync(file, 384);
+      const parsed = plainDocument(JSON.parse(readFileSync(file, "utf8")));
+      if (!parsed) throw new Error("not a JSON object");
+      initial = parsed;
+      status = "ok";
+    } catch {
+      status = "unavailable";
+    }
+  }
+  const persist = (next) => {
+    mkdirSync(dataDir, { recursive: true, mode: 448 });
+    writeFileAtomic(file, `${JSON.stringify(next, null, 2)}
+`, { mode: 384 });
+  };
+  const state = createSecureCredentialState(initial, persist, { writable: status !== "unavailable" });
+  return {
+    file,
+    status,
+    read: () => state.read(),
+    update: (derive, afterPersist) => state.update(derive, afterPersist)
+  };
+}
+function stringField(document, field) {
+  const value = document[field];
+  return typeof value === "string" && value ? value : null;
+}
+function describeTunnelAccount(document) {
+  return {
+    email: stringField(document, COMPANION_ACCOUNT_EMAIL_FIELD),
+    address: managedCompanionTunnelAccess(document)?.endpoint ?? null,
+    installationId: stringField(document, COMPANION_INSTALLATION_ID_FIELD)
+  };
+}
+function tunnelAccess(document) {
+  return managedCompanionTunnelAccess(document);
+}
+function platformName(platform = process.platform) {
+  return platform === "darwin" ? "darwin" : platform === "win32" ? "windows" : "linux";
+}
+function createTunnelAccount(options) {
+  const env = options.env ?? process.env;
+  const credentials = openTunnelCredentials(options.dataDir);
+  const controlPlane = resolveCompanionControlPlaneURL({ isPackaged: true, environment: env });
+  const client = controlPlane ? createControlPlaneClient({ baseURL: controlPlane, fetchImpl: options.fetchImpl }) : null;
+  const service = createCompanionAccountService({
+    client,
+    readCredentials: () => credentials.read(),
+    updateCredentials: (derive, afterPersist) => credentials.update(derive, afterPersist),
+    identity: { name: options.machineName ?? hostname(), platform: platformName(), appVersion: options.version },
+    newClientInstanceId: () => randomUUID4()
+  });
+  return { service, credentials, controlPlane };
+}
+function cloudflaredPath(dataDir, env = process.env) {
+  return resolveCloudflaredBinary({ isPackaged: false, appPath: dataDir, environment: env });
+}
+function prepareEntry(here = HERE) {
+  const bundled = join2(here, "prepare-cloudflared.js");
+  return existsSync(bundled) ? bundled : resolve(here, "..", "scripts", "prepare-cloudflared.mjs");
+}
+function guardianEntry(here = HERE) {
+  const bundled = join2(here, "tunnel-guardian.js");
+  if (existsSync(bundled)) return bundled;
+  const source = resolve(here, "..", "electron", "managed-companion-guardian.mjs");
+  return existsSync(source) ? source : null;
+}
+async function ensureCloudflared(options) {
+  const env = options.env ?? process.env;
+  const found = cloudflaredPath(options.dataDir, env);
+  if (found) return found;
+  options.log(`downloading cloudflared once (pinned version and digest, about 40 MB) into ${options.dataDir}`);
+  await new Promise((done, fail) => {
+    const child = spawn3(process.execPath, [prepareEntry(options.here), "--current", "--root", options.dataDir], {
+      env,
+      stdio: ["ignore", "inherit", "inherit"]
+    });
+    child.on("error", fail);
+    child.on("exit", (code) => code === 0 ? done() : fail(new Error(`the cloudflared download failed (exit ${code ?? "signal"})`)));
+  });
+  const staged = cloudflaredPath(options.dataDir, env);
+  if (!staged) throw new Error("cloudflared was downloaded but is not where it should be; remove the data dir's dist-native folder and try again");
+  return staged;
+}
+function createTunnelOrigin() {
+  return createCompanionOriginEndpoint({ processId: process.pid });
+}
+function cleanupTunnelOrigin(origin) {
+  cleanupCompanionOriginEndpoint(origin);
+}
+function startTunnel(options) {
+  const env = options.env ?? process.env;
+  const originPort = Number(env.OMB_TUNNEL_ORIGIN_PORT || MANAGED_COMPANION_ORIGIN_PORT);
+  let current = { status: "stopped", ready: false };
+  const tunnel = createManagedCompanionTunnel({
+    binaryPath: options.binaryPath,
+    guardianEntry: options.guardian,
+    runtimeRoot: join2(options.dataDir, TUNNEL_RUNTIME_DIR),
+    originPort,
+    environment: env,
+    fetchImpl: options.fetchImpl,
+    onChange: (state) => {
+      current = state;
+      options.onState?.(state);
+    }
+  });
+  const started = tunnel.start({ endpoint: options.access.endpoint, token: options.access.token, originTarget: options.originTarget });
+  return {
+    address: options.access.endpoint,
+    state: () => current,
+    started,
+    stop: async () => {
+      await tunnel.stop();
+    }
+  };
+}
+function describeTunnelState(state, address) {
+  switch (state.status) {
+    case "starting":
+      return "tunnel: connecting\u2026";
+    case "ready":
+      return `tunnel: live at ${address}`;
+    case "retrying":
+      return `tunnel: ${state.error ?? "not verified yet"} retrying in ${Math.max(1, Math.round((state.retryInMs ?? 0) / 1e3))}s`;
+    case "stopped":
+      return "tunnel: stopped";
+    default:
+      return `tunnel: ${state.error ?? state.status}`;
+  }
+}
+
+// server/cli.ts
+var HERE2 = dirname2(fileURLToPath3(import.meta.url));
+var COMMANDS = ["serve", "pair", "sessions", "status", "login", "logout", "help", "--help", "-h"];
+function parseArgs(argv, env = process.env) {
+  const [command = "help", ...rest] = argv;
+  if (!COMMANDS.includes(command)) {
+    return { error: `unknown command "${command}"` };
+  }
+  const options = {
+    command: command === "--help" || command === "-h" ? "help" : command,
+    port: Number(env.OMB_PORT || 8799),
+    dataDir: env.OMB_DATA_DIR || join3(homedir2(), ".openmausbot"),
+    tailscale: false,
+    tunnel: false,
+    client: false,
+    pair: true,
+    json: false
+  };
+  for (let i = 0; i < rest.length; i += 1) {
+    const arg = rest[i];
+    const value = () => {
+      const v = rest[i + 1];
+      if (v === void 0 || v.startsWith("--")) throw new Error(`${arg} needs a value`);
+      i += 1;
+      return v;
+    };
+    try {
+      if (arg === "--port") options.port = Number(value());
+      else if (arg === "--data-dir") options.dataDir = resolve2(value());
+      else if (arg === "--label") options.label = value();
+      else if (arg === "--public-url") options.publicUrl = value().replace(/\/+$/, "");
+      else if (arg === "--tailscale") options.tailscale = true;
+      else if (arg === "--tunnel") options.tunnel = true;
+      else if (arg === "--client") options.client = true;
+      else if (arg === "--no-pair") options.pair = false;
+      else if (arg === "--json") options.json = true;
+      else if (arg === "--email") options.email = value();
+      else if (options.command === "sessions" && arg === "revoke") options.revoke = value();
+      else return { error: `unknown argument "${arg}"` };
+    } catch (error) {
+      return { error: error instanceof Error ? error.message : String(error) };
+    }
+  }
+  if (!Number.isInteger(options.port) || options.port < 1 || options.port > 65535) return { error: "--port must be 1-65535" };
+  if (options.publicUrl && !/^https?:\/\//.test(options.publicUrl)) return { error: "--public-url must start with http:// or https://" };
+  if (options.tailscale && options.tunnel) return { error: "choose one of --tailscale (your tailnet) and --tunnel (a public address)" };
+  return options;
+}
+var USAGE = `openmausbot \u2014 run the server anywhere, pair devices to it
+
+  openmausbot serve [--port 8799] [--data-dir DIR] [--label NAME]
+                    [--public-url https://host] [--tailscale | --tunnel] [--no-pair]
+  openmausbot pair  [--label NAME] [--client] [--public-url https://host]
+  openmausbot sessions [revoke ID]
+  openmausbot status
+  openmausbot login [--email you@example.com]
+  openmausbot logout
+
+serve   starts the server and prints a pairing link + QR code
+pair    mints a pairing code against a running server (--client: chat only)
+sessions lists paired devices; "sessions revoke ID" signs one out
+status  what the server says about itself
+login   signs this machine in to an OpenMausBot account (an emailed code)
+        and reserves its public address for --tunnel
+logout  releases that address and signs out
+
+--tailscale  serve over your tailnet: Tailscale terminates HTTPS and the
+             link uses this machine's MagicDNS name (needs Tailscale signed in
+             and HTTPS certificates enabled for the tailnet)
+--tunnel     serve at a public https://\u2026.openmausbot.com address through a
+             Cloudflare tunnel: no domain, no proxy, no open port. Run
+             \`openmausbot login\` once on this machine first.
+`;
+function defaultIo() {
+  return {
+    log: (line) => console.log(line),
+    error: (line) => console.error(line),
+    ask: async (question) => {
+      const rl = createInterface({ input: process.stdin, output: process.stdout });
+      try {
+        return await rl.question(question);
+      } finally {
+        rl.close();
+      }
+    }
+  };
+}
+function serverVersion(here = HERE2) {
+  try {
+    const parsed = JSON.parse(readFileSync2(resolve2(here, "..", "package.json"), "utf8"));
+    const version = typeof parsed === "object" && parsed !== null ? Reflect.get(parsed, "version") : void 0;
+    return typeof version === "string" && version ? version : "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
+var message = (error) => error instanceof Error ? error.message : String(error);
+async function api(port, path4, init = {}) {
+  const res = await fetch(`http://127.0.0.1:${port}${path4}`, { method: init.method, body: init.body, headers: { "content-type": "application/json" } });
+  const body = await res.json().catch(() => ({}));
+  return { status: res.status, body };
+}
+async function serverUp(port) {
+  try {
+    const { status } = await api(port, "/api/health");
+    return status === 200;
+  } catch {
+    return false;
+  }
+}
+function pairingBlock(input) {
+  const lines = [`pairing code:  ${input.code}`, `expires:       ${new Date(input.expiresAt).toLocaleTimeString()} (single use)`];
+  if (input.url) {
+    lines.push(`open or scan:  ${input.url}`);
+    lines.push("");
+    lines.push(qrToString(input.url));
+  } else {
+    lines.push(`open:          /pair on the address you use for this server, and type the code`);
+    if (input.hint) lines.push(`               (${input.hint})`);
+  }
+  return lines.join("\n");
+}
+function qrToString(text) {
+  let out = "";
+  import_qrcode_terminal.default.generate(text, { small: true }, (rendered) => {
+    out = rendered;
+  });
+  return out;
+}
+async function mintPairing(port, options) {
+  const request = {};
+  if (options.label) request.label = options.label;
+  if (options.client) request.scopes = ["client"];
+  const { status, body } = await api(port, "/api/auth/pairing", { method: "POST", body: JSON.stringify(request) });
+  if (status !== 200) throw new Error(`server refused to mint a pairing code: ${typeof body?.error === "string" ? body.error : status}`);
+  const url = options.publicUrl ? `${options.publicUrl}/pair#code=${body.code}` : typeof body.url === "string" ? body.url : null;
+  return pairingBlock({ code: body.code, url, expiresAt: body.expiresAt, hint: typeof body.hint === "string" ? body.hint : null });
+}
+async function runPair(options) {
+  if (!await serverUp(options.port)) {
+    console.error(`no OpenMausBot server on http://127.0.0.1:${options.port}; start one with \`openmausbot serve\` or set OMB_PORT`);
+    return 1;
+  }
+  console.log(await mintPairing(options.port, { label: options.label, client: options.client, publicUrl: options.publicUrl }));
+  if (options.client) console.log("(client scope: chat and approvals only; cannot change settings or pair others)");
+  return 0;
+}
+async function runSessions(options) {
+  if (!await serverUp(options.port)) {
+    console.error(`no OpenMausBot server on http://127.0.0.1:${options.port}`);
+    return 1;
+  }
+  if (options.revoke) {
+    const { status, body: body2 } = await api(options.port, `/api/auth/sessions/${encodeURIComponent(options.revoke)}`, { method: "DELETE" });
+    if (status !== 200) {
+      console.error(`could not revoke: ${typeof body2?.error === "string" ? body2.error : status}`);
+      return 1;
+    }
+    console.log(`revoked ${options.revoke}: that device is signed out and its stream is closed`);
+    return 0;
+  }
+  const { body } = await api(options.port, "/api/auth/sessions");
+  const sessions = Array.isArray(body?.sessions) ? body.sessions : [];
+  if (options.json) {
+    console.log(JSON.stringify(sessions, null, 2));
+    return 0;
+  }
+  if (!sessions.length) {
+    console.log("no paired devices yet: run `openmausbot pair`");
+    return 0;
+  }
+  console.log(formatSessions(sessions));
+  return 0;
+}
+function formatSessions(sessions, now = Date.now()) {
+  const age = (ms) => {
+    const m = Math.max(0, Math.floor((now - ms) / 6e4));
+    return m < 1 ? "just now" : m < 60 ? `${m} min ago` : m < 1440 ? `${Math.round(m / 60)} h ago` : `${Math.round(m / 1440)} d ago`;
+  };
+  const rows = sessions.map((s) => [s.id, s.label || "(unnamed)", s.scopes.includes("admin") ? "admin" : "client", age(s.lastSeenAt), new Date(s.expiresAt).toISOString().slice(0, 10)]);
+  const head = ["id", "device", "scope", "last seen", "expires"];
+  const widths = head.map((h, i) => Math.max(h.length, ...rows.map((r) => r[i].length)));
+  const line = (r) => r.map((c, i) => c.padEnd(widths[i])).join("  ");
+  return [line(head), ...rows.map(line), "", "revoke one with: openmausbot sessions revoke <id>"].join("\n");
+}
+async function runStatus(options, io = defaultIo()) {
+  let code = 0;
+  try {
+    const res = await fetch(`http://127.0.0.1:${options.port}/.well-known/openmausbot/environment`);
+    const body = await res.json();
+    io.log(options.json ? JSON.stringify(body, null, 2) : `${body.label} \xB7 OpenMausBot ${body.version} on ${body.platform} \xB7 id ${body.environmentId}`);
+  } catch {
+    io.error(`no OpenMausBot server on http://127.0.0.1:${options.port}`);
+    code = 1;
+  }
+  if (!options.json) {
+    const account = describeTunnelAccount(createTunnelAccount({ dataDir: options.dataDir, version: serverVersion() }).credentials.read());
+    if (account.address) io.log(`public address: ${account.address} (signed in as ${account.email ?? "?"}; serve it with --tunnel)`);
+  }
+  return code;
+}
+async function runLogin(options, io = defaultIo()) {
+  const account = createTunnelAccount({ dataDir: options.dataDir, version: serverVersion() });
+  if (account.credentials.status === "unavailable") {
+    io.error(`${account.credentials.file} exists but could not be read; fix or remove it, then try again`);
+    return 1;
+  }
+  if (!account.controlPlane) {
+    io.error("OMB_CONTROL_PLANE_URL is set but is not an https address");
+    return 1;
+  }
+  const existing = describeTunnelAccount(account.credentials.read());
+  if (existing.address) io.log(`already signed in as ${existing.email ?? "?"} (${existing.address}); signing in again refreshes it`);
+  const email = (options.email ?? await io.ask("Email for your OpenMausBot account: ")).trim();
+  if (!email) {
+    io.error("an email address is needed: openmausbot login --email you@example.com");
+    return 1;
+  }
+  try {
+    await account.service.requestCode(email);
+  } catch (error) {
+    io.error(`could not send a sign-in code: ${message(error)}`);
+    return 1;
+  }
+  const code = (await io.ask(`Enter the 8-digit code we emailed to ${email}: `)).trim();
+  let state;
+  try {
+    state = await account.service.verifyCode(email, code);
+  } catch (error) {
+    io.error(`sign-in failed: ${message(error)}`);
+    return 1;
+  }
+  const signedIn = describeTunnelAccount(account.credentials.read());
+  if (!signedIn.address) {
+    io.error(`signed in, but no public address was issued${state.message ? `: ${state.message}` : ""}`);
+    return 1;
+  }
+  io.log(`Signed in as ${signedIn.email ?? email}.`);
+  io.log(`This machine's public address: ${signedIn.address}`);
+  io.log("Serve there with:  openmausbot serve --tunnel");
+  return 0;
+}
+async function runLogout(options, io = defaultIo()) {
+  const account = createTunnelAccount({ dataDir: options.dataDir, version: serverVersion() });
+  const before = describeTunnelAccount(account.credentials.read());
+  if (!before.email) {
+    io.log("this machine is not signed in");
+    return 0;
+  }
+  let state;
+  try {
+    state = await account.service.signOut();
+  } catch (error) {
+    io.error(`sign-out failed: ${message(error)}`);
+    return 1;
+  }
+  const after = describeTunnelAccount(account.credentials.read());
+  if (after.email) {
+    io.error(`still signed in${state.message ? `: ${state.message}` : ""}`);
+    return 1;
+  }
+  io.log(`Signed out ${before.email}${before.address ? `; ${before.address} is released` : ""}.`);
+  return 0;
+}
+function serverEntry(here = HERE2) {
+  const bundled = join3(here, "index.js");
+  const root = resolve2(here, "..");
+  if (existsSync2(bundled)) {
+    const staticDir2 = [join3(root, "dist"), join3(here, "..", "ui")].find((d) => existsSync2(join3(d, "index.html"))) ?? null;
+    const skillsDir = existsSync2(join3(root, "skills")) ? join3(root, "skills") : null;
+    return { command: process.execPath, args: [bundled], staticDir: staticDir2, skillsDir };
+  }
+  const source = join3(here, "index.ts");
+  const staticDir = existsSync2(join3(root, "dist", "index.html")) ? join3(root, "dist") : null;
+  return { command: process.execPath, args: ["--experimental-strip-types", source], staticDir, skillsDir: existsSync2(join3(root, "skills")) ? join3(root, "skills") : null };
+}
+async function planTunnel(options, log) {
+  const account = createTunnelAccount({ dataDir: options.dataDir, version: serverVersion() });
+  if (account.credentials.status === "unavailable") return { error: `${account.credentials.file} exists but could not be read; fix or remove it` };
+  if (!describeTunnelAccount(account.credentials.read()).email) {
+    return { error: "no account on this machine yet: run `openmausbot login` first, then `openmausbot serve --tunnel`" };
+  }
+  try {
+    const state = await account.service.retry();
+    if (state.message && !tunnelAccess(account.credentials.read())) log(`tunnel: ${state.message}`);
+  } catch (error) {
+    log(`tunnel: control plane not reachable right now (${message(error)}); using the saved address`);
+  }
+  const access = tunnelAccess(account.credentials.read());
+  if (!access) return { error: "this machine has no public address; run `openmausbot login` again" };
+  let binary;
+  try {
+    binary = await ensureCloudflared({ dataDir: options.dataDir, log });
+  } catch (error) {
+    return { error: `--tunnel: ${message(error)}` };
+  }
+  const guardian = guardianEntry();
+  if (!guardian) return { error: "--tunnel: the connector guardian is missing from this install" };
+  return { access, binary, guardian, origin: createTunnelOrigin() };
+}
+async function runServe(options, log = console.log) {
+  if (await serverUp(options.port)) {
+    console.error(`something already answers on http://127.0.0.1:${options.port}; use \`openmausbot pair\` against it, or --port for a second server`);
+    return 1;
+  }
+  let publicUrl = options.publicUrl;
+  let tailscale = null;
+  if (options.tailscale) {
+    const probe = await tailscaleStatus();
+    if ("failure" in probe) {
+      console.error(`--tailscale: ${explainTailscaleFailure(probe.failure)}`);
+      return 1;
+    }
+    tailscale = probe.status;
+  }
+  let plan = null;
+  if (options.tunnel) {
+    const planned = await planTunnel(options, log);
+    if ("error" in planned) {
+      console.error(planned.error);
+      return 1;
+    }
+    plan = planned;
+    if (publicUrl && publicUrl !== plan.access.endpoint) log(`note: --public-url is ignored with --tunnel; the address is ${plan.access.endpoint}`);
+    publicUrl = plan.access.endpoint;
+  }
+  const entry = serverEntry();
+  if (!entry.staticDir) log("note: no built UI found next to the server; the API runs but browsers get no page (build with `pnpm exec vite build`)");
+  const env = {
+    ...process.env,
+    OMB_DATA_DIR: options.dataDir,
+    OMB_PORT: String(options.port),
+    OMB_WEBHOOK_PORT: process.env.OMB_WEBHOOK_PORT || String(options.port + 1)
+  };
+  if (entry.staticDir) env.OMB_STATIC_DIR = entry.staticDir;
+  if (entry.skillsDir && !process.env.OMB_SKILLS_DIR) env.OMB_SKILLS_DIR = entry.skillsDir;
+  if (options.label && !process.env.OMB_ENVIRONMENT_LABEL) env.OMB_ENVIRONMENT_LABEL = options.label;
+  if (plan) env.OMB_TUNNEL_SOCKET = plan.origin.socketPath;
+  if (tailscale) {
+    const served = await tailscaleServe(tailscale, options.port);
+    if ("failure" in served) {
+      console.error(`--tailscale: ${explainTailscaleFailure(served.failure)}`);
+      return 1;
+    }
+    publicUrl = served.origin;
+    log(`tailscale: serving https://${tailscale.dnsName} \u2192 http://127.0.0.1:${options.port} (only your tailnet can reach it)`);
+  }
+  if (publicUrl) env.OMB_PUBLIC_URL = publicUrl;
+  const child = spawn4(entry.command, entry.args, { env, stdio: ["ignore", "inherit", "inherit"] });
+  let exited = null;
+  child.on("exit", (code) => {
+    exited = code ?? 1;
+  });
+  let tunnel = null;
+  let stopping = null;
+  const stop = () => {
+    stopping ??= (async () => {
+      if (tunnel) await tunnel.stop().catch(() => void 0);
+      if (tailscale) await tailscaleServeOff(tailscale).catch(() => void 0);
+      if (exited === null) child.kill("SIGTERM");
+      if (plan) cleanupTunnelOrigin(plan.origin);
+    })();
+    return stopping;
+  };
+  process.on("SIGINT", () => void stop());
+  process.on("SIGTERM", () => void stop());
+  const deadline = Date.now() + 6e4;
+  while (Date.now() < deadline && exited === null) {
+    if (await serverUp(options.port)) break;
+    await new Promise((r) => setTimeout(r, 250));
+  }
+  if (exited !== null) {
+    if (plan) cleanupTunnelOrigin(plan.origin);
+    return exited;
+  }
+  if (!await serverUp(options.port)) {
+    console.error("the server did not answer within a minute; see its output above");
+    await stop();
+    return 1;
+  }
+  if (plan && child.pid) {
+    tunnel = startTunnel({
+      dataDir: options.dataDir,
+      access: plan.access,
+      originTarget: { pid: child.pid, socketPath: plan.origin.socketPath },
+      binaryPath: plan.binary,
+      guardian: plan.guardian,
+      onState: (state) => log(describeTunnelState(state, plan.access.endpoint))
+    });
+    tunnel.started.catch((error) => log(`tunnel: ${message(error)}`));
+  }
+  log("");
+  log(`OpenMausBot is running on http://127.0.0.1:${options.port}${publicUrl ? `, reachable at ${publicUrl}` : ""}`);
+  log(`data: ${options.dataDir}`);
+  if (options.pair) {
+    log("");
+    log(await mintPairing(options.port, { label: options.label ? `${options.label} owner` : void 0, publicUrl: publicUrl ?? void 0 }));
+    log("");
+    log('another device later:  openmausbot pair --label "Kitchen iPad"');
+  }
+  log("stop with Ctrl+C");
+  return await new Promise((resolveExit) => {
+    child.on("exit", (code) => {
+      void stop().finally(() => resolveExit(code ?? 0));
+    });
+  });
+}
+async function main(argv = process.argv.slice(2)) {
+  const options = parseArgs(argv);
+  if ("error" in options) {
+    console.error(`${options.error}
+
+${USAGE}`);
+    return 2;
+  }
+  switch (options.command) {
+    case "serve":
+      return runServe(options);
+    case "pair":
+      return runPair(options);
+    case "sessions":
+      return runSessions(options);
+    case "status":
+      return runStatus(options);
+    case "login":
+      return runLogin(options);
+    case "logout":
+      return runLogout(options);
+    default:
+      console.log(USAGE);
+      return 0;
+  }
+}
+
+// server/pair-cli.ts
+main(["pair", ...process.argv.slice(2)]).then(
+  (code) => process.exit(code),
+  (error) => {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exit(1);
+  }
+);