pushary 1.8.0

package/dist/chunk-M5JDZ45W.js

@@ -0,0 +1,943 @@
+import {
+  generateKeypair,
+  openSealedKey,
+  publicKeyFingerprint
+} from "./chunk-3EGEA4KH.js";
+import {
+  humanIsTty,
+  writeHuman
+} from "./chunk-QCGNGEGE.js";
+import {
+  clipToRow,
+  terminalColumns,
+  useColor
+} from "./chunk-U4TMAANR.js";
+import {
+  callMcpTool
+} from "./chunk-M5ICYGHT.js";
+import {
+  reportedInstallSource
+} from "./chunk-DB3ONZB4.js";
+import {
+  NPX_LATEST_COMMAND
+} from "./chunk-E4FJTUH4.js";
+import {
+  PAIR_TTL_SECONDS,
+  isAnswerSource
+} from "./chunk-NQTHFF4W.js";
+
+// src/reach.ts
+var reachVerdict = (channels) => {
+  const { yours, site } = channels;
+  if (yours === null || site === null) {
+    return channels.phoneReachable || channels.webActive > 0 ? { kind: "yours" } : { kind: "nobody" };
+  }
+  if (yours.phoneReachable) return { kind: "yours" };
+  const solo = site.otherMembers === 0;
+  if (solo) {
+    return site.phoneReachable || site.webActive > 0 ? { kind: "yours" } : { kind: "nobody" };
+  }
+  if (site.appDevices === 0 && site.webActive === 0) return { kind: "nobody" };
+  if (site.webActive > 0 && !yours.webAttributable) {
+    return { kind: "unattributable", otherMembers: site.otherMembers };
+  }
+  return { kind: "others", otherMembers: site.otherMembers };
+};
+var reachesYou = (channels) => reachVerdict(channels).kind === "yours";
+var plural = (count, one, many = `${one}s`) => `${count} ${count === 1 ? one : many}`;
+var describeReach = (channels) => {
+  const verdict = reachVerdict(channels);
+  if (verdict.kind === "nobody") return "nothing can receive an approval";
+  const parts = [];
+  const own = channels.yours;
+  if (verdict.kind === "yours" && own !== null && own.appDevices > 0) {
+    const platforms = own.appPlatforms.length > 0 ? ` (${own.appPlatforms.join(", ")})` : "";
+    parts.push(`${plural(own.appDevices, "app device")}${platforms}`);
+  } else if (channels.appDevices > 0) {
+    const platforms = channels.appPlatforms.length > 0 ? ` (${channels.appPlatforms.join(", ")})` : "";
+    parts.push(`${plural(channels.appDevices, "app device")}${platforms}`);
+  }
+  if (channels.webPhone > 0) parts.push(`${plural(channels.webPhone, "browser")} on a phone`);
+  if (channels.webDesktop > 0) parts.push(`${plural(channels.webDesktop, "browser")} on a desktop`);
+  const summary = parts.length > 0 ? parts.join(", ") : "a device";
+  if (verdict.kind === "others") return `${summary}, none of them yours`;
+  if (verdict.kind === "unattributable") return `${summary}, and no way to tell whose`;
+  return summary;
+};
+var describeAppRepair = (verdict) => {
+  switch (verdict.kind) {
+    case "yours":
+      return null;
+    case "nobody":
+      return [
+        "Open the Pushary app, sign in, and allow notifications.",
+        "If this terminal was never paired with your phone, run: npx @pushary/agent-hooks@latest setup --connect app"
+      ];
+    case "others":
+      return [
+        `Reachable devices belong to other members of this workspace (${verdict.otherMembers}).`,
+        "Sign in on the Pushary app with your own account so approvals can reach you."
+      ];
+    case "unattributable":
+      return [
+        "Something is reachable here, but not identifiably yours.",
+        "Sign in on the Pushary app so your approvals are routed to your device."
+      ];
+  }
+};
+var describeJustPairedRepair = (verdict) => {
+  if (verdict.kind === "nobody") {
+    return [
+      "The app asks for the notification permission after it grants the pairing.",
+      "Open the Pushary app and allow notifications. That is the whole remaining step."
+    ];
+  }
+  return describeAppRepair(verdict) ?? [];
+};
+
+// src/setup/verify.ts
+var plural2 = (count, one) => `${count} ${one}${count === 1 ? "" : "s"}`;
+var describeRecipients = (push, channels) => {
+  const parts = [];
+  if (push.app > 0) {
+    const platforms = channels.yours?.appPlatforms ?? channels.appPlatforms;
+    const suffix = platforms.length > 0 ? ` (${platforms.join(", ")})` : "";
+    parts.push(`${plural2(push.app, "app device")}${suffix}`);
+  }
+  if (push.web > 0) parts.push(plural2(push.web, "browser"));
+  return parts.length > 0 ? parts.join(" and ") : plural2(push.total, "device");
+};
+var classifyDelivery = (channels, push) => {
+  if (push.total <= 0) return { kind: "no-recipients" };
+  const verdict = reachVerdict(channels);
+  if (verdict.kind === "yours" && (push.app > 0 || channels.yours === null || channels.site?.otherMembers === 0)) {
+    return { kind: "delivered", recipients: push.total, deviceLabel: describeRecipients(push, channels) };
+  }
+  if (verdict.kind === "unattributable") {
+    return { kind: "unattributable", recipients: push.total, otherMembers: verdict.otherMembers };
+  }
+  if (verdict.kind === "others") {
+    return { kind: "others-only", recipients: push.total, otherMembers: verdict.otherMembers };
+  }
+  if (verdict.kind === "yours") {
+    const otherMembers = channels.site?.otherMembers ?? 0;
+    return { kind: "unattributable", recipients: push.total, otherMembers };
+  }
+  return { kind: "delivered", recipients: push.total, deviceLabel: describeRecipients(push, channels) };
+};
+var sendTestNotification = async (apiKey) => {
+  const result = await callMcpTool(apiKey, "send_notification", {
+    title: "Pushary is connected",
+    body: "This setup notification reached you. Agent hooks still need a real-agent check.",
+    agentName: "Pushary setup"
+  }, { timeoutMs: 2e4 });
+  const toCount = (value) => typeof value === "number" && Number.isFinite(value) ? value : 0;
+  const app = toCount(result.delivery?.mobile?.recipients);
+  const web = toCount(result.delivery?.web?.recipients);
+  return { app, web, total: typeof result.sent === "number" ? result.sent : app + web };
+};
+var verifyDelivery = async (apiKey, channels, deps = {}) => {
+  const send = deps.send ?? sendTestNotification;
+  try {
+    return classifyDelivery(channels, await send(apiKey));
+  } catch (err) {
+    return { kind: "error", detail: err instanceof Error ? err.message : "send failed" };
+  }
+};
+var describeVerifyOutcome = (outcome) => {
+  switch (outcome.kind) {
+    case "delivered":
+      return { ok: true, message: `Delivered to ${outcome.deviceLabel}. Push works.`, next: [] };
+    case "no-recipients":
+      return {
+        ok: false,
+        message: "Nothing to deliver to. Agents are configured; approvals will fall back to the terminal.",
+        next: [
+          "Run pushary connect to add your phone.",
+          "Then pushary doctor --roundtrip to test a synthetic question and answer."
+        ]
+      };
+    case "others-only":
+      return {
+        ok: false,
+        message: `Delivered to ${plural2(outcome.recipients, "device")} on this site, none of them yours.`,
+        next: [
+          `Approvals for your agent would wake one of your ${plural2(outcome.otherMembers, "teammate")}.`,
+          "Run pushary connect to add your own phone."
+        ]
+      };
+    case "unattributable":
+      return {
+        ok: false,
+        message: `Delivered to ${plural2(outcome.recipients, "device")} on this site, and no way to tell whose.`,
+        next: [
+          "Browser subscriptions carry no owner, and this site has other members.",
+          "Install the Pushary app with pushary connect, or run pushary doctor --roundtrip to prove it reaches you."
+        ]
+      };
+    case "error":
+      return {
+        ok: false,
+        message: `Could not send the test notification (${outcome.detail}).`,
+        next: ["Agents are configured. Run pushary doctor once the connection is back."]
+      };
+  }
+};
+var ROUND_TRIP_QUESTION = "Pushary delivery test. Tap Yes or No to test returning an answer. This does not test your agent hooks.";
+var ROUND_TRIP_TIMEOUT_MS = 55e3;
+var defaultAsk = (apiKey, agentName) => (
+  // wait:false so the poll is ours: the blocking form returns on the SITE's
+  // policy timeout, which a user may have set to seconds, and a setup check
+  // reporting "unanswered" after three seconds would be a lie about the product.
+  callMcpTool(apiKey, "ask_user", {
+    question: ROUND_TRIP_QUESTION,
+    type: "confirm",
+    agentName,
+    wait: false
+  }, { timeoutMs: 15e3 })
+);
+var defaultWait = (apiKey, correlationId) => callMcpTool(apiKey, "wait_for_answer", {
+  correlationId,
+  timeoutMs: ROUND_TRIP_TIMEOUT_MS
+}, { timeoutMs: ROUND_TRIP_TIMEOUT_MS + 5e3 });
+var defaultCancel = async (apiKey, correlationId) => {
+  await callMcpTool(apiKey, "cancel_question", { correlationId }, { timeoutMs: 1e4 }).catch(() => {
+  });
+};
+var answeredRoundTrip = (answer, correlationId, latencyMs) => {
+  if (answer.value !== "yes" && answer.value !== "no") {
+    return { kind: "error", detail: "the server reported an answer without a valid Yes or No value" };
+  }
+  return {
+    kind: "answered",
+    value: answer.value,
+    latencyMs,
+    correlationId,
+    ...isAnswerSource(answer.answerSource) ? { answerSource: answer.answerSource } : {}
+  };
+};
+var verifyRoundTrip = async (apiKey, agentName = "Pushary setup", deps = {}) => {
+  const ask = deps.ask ?? defaultAsk;
+  const wait = deps.wait ?? defaultWait;
+  const cancel = deps.cancel ?? defaultCancel;
+  const now = deps.now ?? Date.now;
+  const started = now();
+  let asked;
+  try {
+    asked = await ask(apiKey, agentName);
+  } catch (err) {
+    return { kind: "error", detail: err instanceof Error ? err.message : "ask failed" };
+  }
+  let shutdown;
+  const stop = (code) => {
+    if (shutdown) return;
+    shutdown = (async () => {
+      let timer;
+      try {
+        await Promise.race([
+          cancel(apiKey, asked.correlationId).catch(() => {
+          }),
+          new Promise((resolve) => {
+            timer = setTimeout(resolve, 4e3);
+          })
+        ]);
+      } finally {
+        clearTimeout(timer);
+        process.stderr.write("Delivery test interrupted. Cleanup was attempted; an unresolved question expires automatically.\n");
+        process.exit(code);
+      }
+    })();
+  };
+  const onInterrupt = () => stop(130);
+  const onTerminate = () => stop(143);
+  if (asked.correlationId) {
+    process.on("SIGINT", onInterrupt);
+    process.on("SIGTERM", onTerminate);
+  }
+  let answerObserved = false;
+  try {
+    if (asked.noDevices || asked.warning) return { kind: "no-recipients" };
+    if (asked.mode === "notify_only" || asked.status === "notified") return { kind: "notify-only" };
+    if (!asked.correlationId) return { kind: "error", detail: "no correlationId returned" };
+    const answer = asked.answered === true ? asked : await wait(apiKey, asked.correlationId);
+    if (answer.answered === true) {
+      const outcome = answeredRoundTrip(answer, asked.correlationId, now() - started);
+      answerObserved = outcome.kind === "answered";
+      return outcome;
+    }
+    return { kind: "unanswered" };
+  } catch (err) {
+    return { kind: "error", detail: err instanceof Error ? err.message : "wait failed" };
+  } finally {
+    if (shutdown) await shutdown;
+    process.off("SIGINT", onInterrupt);
+    process.off("SIGTERM", onTerminate);
+    if (!answerObserved && asked.correlationId) await cancel(apiKey, asked.correlationId).catch(() => {
+    });
+  }
+};
+var describeAnswerSource = (source) => {
+  switch (source) {
+    case "mobile_app":
+    case "mobile_background":
+      return "A phone answered this synthetic test.";
+    case "mac_app":
+      return "A Mac answered this synthetic test.";
+    case "sandbox":
+      return "This was a simulated sandbox answer.";
+    default:
+      return source ? `Answer source: ${source}. This was a synthetic test.` : "The answering surface was not reported. This was a synthetic test.";
+  }
+};
+var describeRoundTripOutcome = (outcome) => {
+  switch (outcome.kind) {
+    case "answered":
+      return {
+        ok: true,
+        message: `Answered "${outcome.value}" in ${(outcome.latencyMs / 1e3).toFixed(1)}s. ${describeAnswerSource(outcome.answerSource)}`,
+        next: []
+      };
+    case "unanswered":
+      return {
+        ok: false,
+        message: "The question was sent and nothing came back.",
+        next: [
+          "A push that arrives and cannot be answered is the most common way this breaks, so this is worth resolving now.",
+          "Check the notification actually opened something you could tap, then run pushary doctor --roundtrip."
+        ]
+      };
+    case "notify-only":
+      return {
+        ok: true,
+        message: "Sent. This site is in notify-only mode, so questions never wait for an answer.",
+        next: ["Switch with pushary mode push_first if you want approvals to hold for your phone."]
+      };
+    case "no-recipients":
+      return {
+        ok: false,
+        message: "Nothing to ask. No phone or browser is connected to this site.",
+        next: [
+          "Run pushary connect to add your phone.",
+          "Or pushary connect --app if you already have the Pushary app."
+        ]
+      };
+    case "error":
+      return {
+        ok: false,
+        message: `Could not complete the round trip (${outcome.detail}).`,
+        next: ["Agents are configured. Run pushary doctor --roundtrip once the connection is back."]
+      };
+  }
+};
+var describeRoundTrip = (outcome) => {
+  const report = describeRoundTripOutcome(outcome);
+  return { ...report, next: [...report.next, "Agent hook activation remains unverified. Restart your agent and check one real approval."] };
+};
+var roundTripEvidence = (outcome) => ({
+  kind: outcome?.kind ?? "skipped",
+  ...outcome?.kind === "answered" ? {
+    correlationId: outcome.correlationId ?? null,
+    answerSource: outcome.answerSource ?? null,
+    value: outcome.value,
+    latencyMs: outcome.latencyMs
+  } : {},
+  hookActivation: "unverified"
+});
+
+// src/onboarding.ts
+import qrcodeTerminal from "qrcode-terminal";
+var paint = (open) => (s) => useColor() ? `${open}${s}\x1B[0m` : s;
+var dim = paint("\x1B[2m");
+var bold = paint("\x1B[1m");
+var green = paint("\x1B[32m");
+var cyan = paint("\x1B[36m");
+var yellow = paint("\x1B[33m");
+var check = green("\u2713");
+var apiBase = () => process.env.PUSHARY_API_URL?.trim() || process.env.PUSHARY_BASE_URL?.trim() || "https://pushary.com";
+var EXIT_ABORTED = 130;
+var CONNECT_POLL_INTERVAL_MS = 2500;
+var CONNECT_TIMEOUT_MS = 18e4;
+var EMPTY_CHANNELS = {
+  appDevices: 0,
+  appPlatforms: [],
+  webActive: 0,
+  webPhone: 0,
+  webDesktop: 0,
+  phoneReachable: false,
+  precise: true,
+  yours: null,
+  site: null
+};
+var authHeaders = (apiKey) => ({
+  "Content-Type": "application/json",
+  Authorization: `Bearer ${apiKey}`
+});
+var getJson = async (url, apiKey) => {
+  try {
+    const res = await fetch(url, { headers: authHeaders(apiKey), signal: AbortSignal.timeout(1e4) });
+    const body = await res.json().catch(() => null);
+    if (!res.ok) return { kind: "http", status: res.status, body };
+    if (!body) return { kind: "http", status: res.status, body: null };
+    return { kind: "ok", body };
+  } catch (err) {
+    return { kind: "network", detail: err instanceof Error ? err.message : "network error" };
+  }
+};
+var fetchSite = async (apiKey) => {
+  const result = await getJson(`${apiBase()}/api/v1/server/site`, apiKey);
+  if (result.kind !== "ok") return null;
+  const data = result.body;
+  if (typeof data.slug !== "string" || typeof data.subscribeUrl !== "string") return null;
+  return { slug: data.slug, name: typeof data.name === "string" ? data.name : data.slug, subscribeUrl: data.subscribeUrl };
+};
+var num = (value) => typeof value === "number" && Number.isFinite(value) ? value : 0;
+var strings = (value) => Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+var record = (value) => typeof value === "object" && value !== null ? value : {};
+var parseOwnerCounts = (value) => {
+  if (typeof value !== "object" || value === null) return null;
+  const raw = value;
+  const app = record(raw.app);
+  return {
+    appDevices: num(app.devices),
+    appPlatforms: strings(app.platforms),
+    phoneReachable: raw.phoneReachable === true,
+    webAttributable: raw.webAttributable === true
+  };
+};
+var parseSiteCounts = (value) => {
+  if (typeof value !== "object" || value === null) return null;
+  const raw = value;
+  const app = record(raw.app);
+  const web = record(raw.web);
+  return {
+    appDevices: num(app.devices),
+    appPlatforms: strings(app.platforms),
+    webActive: num(web.active),
+    webPhone: num(web.phone),
+    webDesktop: num(web.desktop),
+    phoneReachable: raw.phoneReachable === true,
+    otherMembers: num(raw.otherMembers)
+  };
+};
+var parseChannels = (data) => {
+  const app = record(data.app);
+  const web = record(data.web);
+  return {
+    appDevices: num(app.devices),
+    appPlatforms: strings(app.platforms),
+    webActive: num(web.active),
+    webPhone: num(web.phone),
+    webDesktop: num(web.desktop),
+    phoneReachable: data.phoneReachable === true,
+    precise: true,
+    yours: parseOwnerCounts(data.yours),
+    site: parseSiteCounts(data.site)
+  };
+};
+var SUBSCRIPTION_REQUIRED = "subscription_required";
+var fetchChannels = async (apiKey) => {
+  const result = await getJson(`${apiBase()}/api/v1/server/channels`, apiKey);
+  if (result.kind === "ok") return { kind: "ok", status: parseChannels(result.body) };
+  if (result.kind === "network") return { kind: "unreachable", detail: result.detail };
+  if (result.status === 401) return { kind: "unauthorized" };
+  if (result.status === 403) {
+    return result.body?.code === SUBSCRIPTION_REQUIRED ? { kind: "locked" } : { kind: "unreachable", detail: "HTTP 403" };
+  }
+  if (result.status !== 404) return { kind: "unreachable", detail: `HTTP ${result.status}` };
+  const legacy = await getJson(`${apiBase()}/api/v1/server/subscribers/count`, apiKey);
+  if (legacy.kind === "network") return { kind: "unreachable", detail: legacy.detail };
+  if (legacy.kind === "http") {
+    if (legacy.status === 401) return { kind: "unauthorized" };
+    return { kind: "unreachable", detail: `HTTP ${legacy.status}` };
+  }
+  const active = num(legacy.body.active);
+  return {
+    kind: "ok",
+    status: { ...EMPTY_CHANNELS, webActive: active, phoneReachable: active > 0, precise: false }
+  };
+};
+var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+var SPINNER_HEARTBEAT_MS = 3e4;
+var SPINNER_FRAME_MS = 200;
+var writeStatusLine = (text) => {
+  writeHuman(humanIsTty() ? `\r  ${text}\x1B[K
+` : `  ${text}
+`);
+};
+var startSpinner = (getLabel) => {
+  if (!humanIsTty()) {
+    writeHuman(`  ${getLabel()}
+`);
+    const interval2 = setInterval(() => {
+      writeHuman(`  ${getLabel()}
+`);
+    }, SPINNER_HEARTBEAT_MS);
+    interval2.unref?.();
+    return (finalGlyph, finalLabel) => {
+      clearInterval(interval2);
+      writeStatusLine(`${finalGlyph} ${finalLabel}`);
+    };
+  }
+  const frames = ["   ", ".  ", ".. ", "..."];
+  let i = 0;
+  const interval = setInterval(() => {
+    const line = `${dim(frames[i++ % frames.length])} ${getLabel()}`;
+    writeHuman(`\r  ${clipToRow(line, terminalColumns())}\x1B[K`);
+  }, SPINNER_FRAME_MS);
+  return (finalGlyph, finalLabel) => {
+    clearInterval(interval);
+    writeStatusLine(`${finalGlyph} ${finalLabel}`);
+  };
+};
+var printQr = (url) => new Promise((resolve, reject) => {
+  try {
+    qrcodeTerminal.generate(url, { small: true }, (qr) => {
+      writeHuman("\n" + qr.split("\n").map((line) => "    " + line).join("\n") + "\n");
+      resolve();
+    });
+  } catch (err) {
+    reject(err);
+  }
+});
+var phoneFailure = (detail, repair) => ({
+  reachesYou: false,
+  outcome: null,
+  detail,
+  ...repair ? { repair } : {}
+});
+var waitForDevice = async (apiKey, baseline) => {
+  const deadline = Date.now() + CONNECT_TIMEOUT_MS;
+  let consecutiveFailures = 0;
+  let warned = false;
+  const stop = startSpinner(() => {
+    const left = Math.max(0, Math.ceil((deadline - Date.now()) / 1e3));
+    return `Waiting for your phone ${dim(`(${left}s)`)}`;
+  });
+  try {
+    while (Date.now() < deadline) {
+      const probe = await fetchChannels(apiKey);
+      if (probe.kind === "unauthorized") {
+        stop(yellow("!"), "The server stopped accepting this key");
+        return { kind: "unauthorized" };
+      }
+      if (probe.kind === "locked") {
+        stop(yellow("!"), "This workspace has no active plan");
+        return { kind: "locked" };
+      }
+      if (probe.kind === "unreachable") {
+        consecutiveFailures += 1;
+        if (consecutiveFailures >= 3 && !warned) {
+          warned = true;
+          writeStatusLine(`${yellow("!")} Still trying. pushary.com is not answering ${dim(`(${probe.detail})`)}`);
+        }
+        await sleep(CONNECT_POLL_INTERVAL_MS);
+        continue;
+      }
+      consecutiveFailures = 0;
+      const channels = probe.status;
+      if (reachesYou(channels) || channels.webActive > baseline.webActive) {
+        stop(check, "Phone connected");
+        return { kind: "connected", channels };
+      }
+      await sleep(CONNECT_POLL_INTERVAL_MS);
+    }
+    stop(yellow("!"), "Didn't detect a connection yet");
+    console.log(`  ${dim("Signed in on the app already? Open it and allow notifications.")}`);
+    console.log(`  ${dim("Signing in alone does not connect the phone. Then run")} ${cyan("pushary doctor")}${dim(".")}`);
+    return { kind: "timeout" };
+  } catch (err) {
+    stop(yellow("!"), `Couldn't check connection ${dim(`(${err instanceof Error ? err.message : "network error"})`)}`);
+    return { kind: "timeout" };
+  }
+};
+var sendAndConfirm = async (apiKey, channels) => {
+  const stopSend = startSpinner(() => "Sending a test notification");
+  const outcome = await verifyDelivery(apiKey, channels);
+  const report = describeVerifyOutcome(outcome);
+  stopSend(report.ok ? check : yellow("!"), report.message);
+  for (const line of report.next) console.log(`  ${dim(line)}`);
+  return { reachesYou: report.ok, outcome, detail: null };
+};
+var printCapabilityDelta = () => {
+  console.log(`  ${dim("Two ways to get approvals on your phone:")}`);
+  console.log();
+  console.log(`  ${bold("Pushary app")} ${dim("(iOS / Android)")}  ${cyan("pushary setup --connect app")}`);
+  console.log(`  ${dim("\u2022 Answers from the lock screen, and while the app is closed")}`);
+  console.log(`  ${dim("\u2022 Can start and steer agents remotely")}`);
+  console.log();
+  console.log(`  ${bold("Browser")} ${dim("(add to home screen)")}  ${dim("scan below")}`);
+  console.log(`  ${dim("\u2022 Works without installing an app")}`);
+  console.log(`  ${dim("\u2022 Answers require opening the page")}`);
+  console.log(`  ${dim("\u2022 iOS needs the page added to the home screen first")}`);
+};
+var printSiteOnlyWarning = (channels) => {
+  const others = channels.site?.otherMembers ?? 0;
+  console.log(`  ${yellow("!")} This site has ${channels.appDevices + channels.webActive} device(s), ${describeReach(channels)}.`);
+  console.log(`  ${dim(`Approvals for your agent would wake one of your ${others === 1 ? "teammate" : `${others} teammates`}.`)}`);
+  console.log(`  ${dim("Connect your own phone:")}`);
+};
+var connectDevice = async (apiKey, options = {}) => {
+  const probe = await fetchChannels(apiKey);
+  if (probe.kind !== "ok") return describeProbeFailure(probe);
+  const channels = probe.status;
+  if (reachesYou(channels)) {
+    console.log(`  ${check} ${describeExistingConnection(channels)}`);
+    return sendAndConfirm(apiKey, channels);
+  }
+  const site = await fetchSite(apiKey);
+  if (!site) {
+    console.log(`  ${yellow("!")} Couldn't load your subscribe link. Connect your phone later at ${cyan("pushary.com/download")}.`);
+    return phoneFailure("no_subscribe_link");
+  }
+  console.log();
+  if (channels.site !== null && channels.site.otherMembers > 0 && channels.phoneReachable) {
+    printSiteOnlyWarning(channels);
+  } else {
+    console.log(`  ${bold("Connect your phone")}`);
+    if (channels.webDesktop > 0) {
+      console.log(`  ${dim("A browser on this computer is subscribed, but no phone is connected yet.")}`);
+    }
+  }
+  console.log();
+  if (options.showCapabilities) printCapabilityDelta();
+  console.log();
+  console.log(`  ${dim("Scan this with your phone camera:")}`);
+  await printQr(site.subscribeUrl);
+  console.log(`  ${dim("or open")} ${cyan(site.subscribeUrl)}`);
+  console.log();
+  const waited = await waitForDevice(apiKey, channels);
+  if (waited.kind === "unauthorized") return phoneFailure("unauthorized");
+  if (waited.kind === "locked") return phoneFailure("locked");
+  if (waited.kind === "timeout") {
+    console.log(`  ${dim("No rush, open")} ${cyan(site.subscribeUrl)} ${dim("on your phone whenever you're ready.")}`);
+    return phoneFailure("timeout");
+  }
+  return sendAndConfirm(apiKey, waited.channels);
+};
+var describeProbeFailure = (probe) => {
+  if (probe.kind === "unauthorized") {
+    console.log(`  ${yellow("!")} The server rejected this key when checking for devices.`);
+    return phoneFailure("unauthorized");
+  }
+  if (probe.kind === "locked") {
+    console.log(`  ${yellow("!")} No approval can be delivered until the plan is active.`);
+    return phoneFailure("locked");
+  }
+  if (probe.kind === "unreachable") {
+    console.log(`  ${yellow("!")} Couldn't check your devices ${dim(`(${probe.detail})`)}`);
+    console.log(`  ${dim("Agents are configured. Run")} ${cyan("pushary doctor")} ${dim("when the connection is back.")}`);
+    return phoneFailure(probe.detail);
+  }
+  return phoneFailure("unknown");
+};
+var describeExistingConnection = (channels) => {
+  if (!channels.precise) return "A device is already connected";
+  const own = channels.yours;
+  if (own !== null && own.appDevices > 0) {
+    const platforms = own.appPlatforms.length > 0 ? ` ${dim(`(${own.appPlatforms.join(", ")})`)}` : "";
+    return `Pushary app connected${platforms}`;
+  }
+  if (channels.appDevices > 0) {
+    const platforms = channels.appPlatforms.length > 0 ? ` ${dim(`(${channels.appPlatforms.join(", ")})`)}` : "";
+    return `Pushary app connected${platforms}`;
+  }
+  return "Phone already connected";
+};
+var APP_REGISTER_TIMEOUT_MS = 45e3;
+var appRegisterTimeoutMs = () => {
+  const raw = Number(process.env.PUSHARY_APP_REGISTER_TIMEOUT_MS);
+  return Number.isFinite(raw) && raw >= 0 ? raw : APP_REGISTER_TIMEOUT_MS;
+};
+var ownedApp = (status) => status.yours?.appDevices ?? status.appDevices;
+var waitForAppRegistration = async (apiKey) => {
+  const deadline = Date.now() + appRegisterTimeoutMs();
+  if (Date.now() >= deadline) return { kind: "timeout" };
+  const stop = startSpinner(() => {
+    const left = Math.max(0, Math.ceil((deadline - Date.now()) / 1e3));
+    return `Waiting for your phone to register for notifications ${dim(`(${left}s)`)}`;
+  });
+  try {
+    while (Date.now() < deadline) {
+      await sleep(CONNECT_POLL_INTERVAL_MS);
+      const probe = await fetchChannels(apiKey);
+      if (probe.kind === "unauthorized") {
+        stop(yellow("!"), "The server stopped accepting this key");
+        return { kind: "unauthorized" };
+      }
+      if (probe.kind === "locked") {
+        stop(yellow("!"), "This workspace has no active plan");
+        return { kind: "locked" };
+      }
+      if (probe.kind !== "ok") continue;
+      if (!probe.status.precise || ownedApp(probe.status) > 0) {
+        stop(check, "Phone registered for notifications");
+        return { kind: "connected", channels: probe.status };
+      }
+    }
+  } catch {
+  }
+  stop(yellow("!"), "This phone has not registered for notifications yet");
+  return { kind: "timeout" };
+};
+var confirmAppConnection = async (apiKey) => {
+  const probe = await fetchChannels(apiKey);
+  if (probe.kind !== "ok") return describeProbeFailure(probe);
+  let channels = probe.status;
+  if (channels.precise && ownedApp(channels) === 0) {
+    const settled = await waitForAppRegistration(apiKey);
+    if (settled.kind === "unauthorized") return describeProbeFailure({ kind: "unauthorized" });
+    if (settled.kind === "locked") return describeProbeFailure({ kind: "locked" });
+    if (settled.kind === "connected") channels = settled.channels;
+  }
+  if (channels.precise && ownedApp(channels) === 0) {
+    const repair = describeJustPairedRepair(reachVerdict(channels));
+    console.log(`  ${yellow("!")} Paired, but this phone has not registered for notifications yet.`);
+    for (const line of repair) console.log(`  ${dim(line)}`);
+    console.log(`  ${dim("Then run")} ${cyan("pushary doctor")}${dim(".")}`);
+    return phoneFailure("app_not_registered", repair);
+  }
+  return sendAndConfirm(apiKey, channels);
+};
+var planAppConnect = (channels) => channels.precise && ownedApp(channels) === 0 ? { kind: "unpaired", repair: describeAppRepair(reachVerdict(channels)) ?? [] } : { kind: "send" };
+var connectExistingApp = async (apiKey) => {
+  const probe = await fetchChannels(apiKey);
+  if (probe.kind !== "ok") return describeProbeFailure(probe);
+  const plan = planAppConnect(probe.status);
+  if (plan.kind === "send") {
+    console.log(`  ${check} ${describeExistingConnection(probe.status)}`);
+    return sendAndConfirm(apiKey, probe.status);
+  }
+  console.log(`  ${yellow("!")} No Pushary app of yours is connected to this site, and nothing was paired just now.`);
+  for (const line of plan.repair) console.log(`  ${dim(line)}`);
+  console.log(`  ${dim("No app yet? Get it at")} ${cyan("https://pushary.com/download")}`);
+  return phoneFailure("app_not_paired", plan.repair);
+};
+var printConnectInstructions = async (apiKey) => {
+  const probe = await fetchChannels(apiKey);
+  if (probe.kind !== "ok") return describeProbeFailure(probe);
+  const channels = probe.status;
+  if (reachesYou(channels)) {
+    console.log(`  ${check} ${describeExistingConnection(channels)}`);
+    return sendAndConfirm(apiKey, channels);
+  }
+  if (channels.site !== null && channels.site.otherMembers > 0 && channels.phoneReachable) {
+    printSiteOnlyWarning(channels);
+  }
+  const site = await fetchSite(apiKey);
+  const target = site?.subscribeUrl ?? "https://pushary.com/download";
+  console.log(`  ${dim("Connect your phone for push notifications at")} ${cyan(target)}`);
+  console.log(`  ${dim("or get the Pushary app at")} ${cyan("https://pushary.com/download")}`);
+  return phoneFailure("no_device");
+};
+var PAIR_POLL_INTERVAL_MS = 2e3;
+var PAIR_STOP_BEFORE_EXPIRY_MS = 1e4;
+var PAIR_TIMEOUT_MS = PAIR_TTL_SECONDS * 1e3 - PAIR_STOP_BEFORE_EXPIRY_MS;
+var PAIR_HINT_AFTER_MS = 45e3;
+var PAIR_BROWSER_FALLBACK_AFTER_MS = 6e4;
+var BROWSER_CONNECT_COMMAND = `${NPX_LATEST_COMMAND} setup --connect browser`;
+var PAIR_BROWSER_FALLBACK_LINE = `Still waiting? Sign in with a browser instead: Ctrl-C, then ${BROWSER_CONNECT_COMMAND}`;
+var SYSTEM_PAIR_CLOCK = { now: () => Date.now(), sleep };
+var startPairing = async (cliPublicKey) => {
+  try {
+    const res = await fetch(`${apiBase()}/api/mobile/pair/start`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      // The only moment this fact can be carried across the handshake. This
+      // terminal knows which front door it came through and has no session; the
+      // phone that authorizes has the session and mints the key but never saw
+      // this terminal. Sending it here is what lets the minted key name its
+      // origin. An older server ignores the extra field.
+      body: JSON.stringify({ cliPublicKey, installSource: reportedInstallSource() }),
+      signal: AbortSignal.timeout(1e4)
+    });
+    if (!res.ok) return null;
+    const data = await res.json().catch(() => null);
+    if (!data || typeof data.pairId !== "string") return null;
+    return { pairId: data.pairId, code: typeof data.code === "string" ? data.code : null };
+  } catch {
+    return null;
+  }
+};
+var describePairFailure = (reason) => {
+  switch (reason) {
+    case "no_site":
+      return "Couldn't set up your workspace. Try again, or finish setup at pushary.com/dashboard";
+    case "blocked":
+      return "Finish setting up in the Pushary app, then run setup again";
+    case "authorize_failed":
+      return "The app could not authorize this terminal. Re-run setup to try again";
+    case "payment_required":
+      return "Your Pushary workspace has no active subscription. Subscribe in the Pushary app or at pushary.com, then run setup again";
+    default:
+      return "Pairing failed. Re-run setup to try again";
+  }
+};
+var cancelPairing = async (pairId) => {
+  try {
+    await fetch(`${apiBase()}/api/mobile/pair/start`, {
+      method: "DELETE",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ pairId }),
+      signal: AbortSignal.timeout(5e3)
+    });
+  } catch {
+  }
+};
+var PAIR_MAX_CONSECUTIVE_FAILURES = 8;
+var claimPairing = async (pairId) => {
+  try {
+    const res = await fetch(`${apiBase()}/api/mobile/pair/claim?id=${encodeURIComponent(pairId)}`, {
+      signal: AbortSignal.timeout(1e4)
+    });
+    if (!res.ok) return null;
+    return await res.json().catch(() => null);
+  } catch {
+    return null;
+  }
+};
+var ackPairing = async (pairId) => {
+  try {
+    await fetch(`${apiBase()}/api/mobile/pair/ack`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ pairId }),
+      signal: AbortSignal.timeout(5e3)
+    });
+  } catch {
+  }
+};
+var pairFailed = (reason) => ({ kind: "failed", reason });
+var pairingEscapeApplies = (outcome) => outcome.reason === "timeout" || outcome.reason === "expired" || outcome.reason === "cancelled";
+var buildPairLinks = (pairId, publicKeyB64, baseUrl = apiBase(), code = null) => {
+  const id = encodeURIComponent(pairId);
+  const pk = encodeURIComponent(publicKeyB64);
+  const origin = baseUrl.replace(/\/+$/, "");
+  const longLink = `${origin}/pair?id=${id}&pk=${pk}`;
+  return {
+    // Never shortened. Both scanners have to read this one: the phone camera,
+    // which opens it, and the app's own scanner, which parses id and pk straight
+    // off it and cannot resolve a code. 22 rows of QR instead of 16 is the price
+    // of the in-app scan button working at all.
+    qrLink: longLink,
+    // 33 characters against 114, for the person reading it off the screen.
+    universalLink: code ? `${origin}/pair/${encodeURIComponent(code)}` : longLink,
+    // Never shortened: the scheme reaches an installed app with no server round
+    // trip, which is the path that has to survive the short code failing.
+    deepLink: `pushary://pair?pk=${pk}&id=${id}`
+  };
+};
+var connectViaAppPairing = async (options = {}) => {
+  const clock = options.clock ?? SYSTEM_PAIR_CLOCK;
+  const keypair = generateKeypair();
+  const requestedAt = clock.now();
+  const started = await startPairing(keypair.publicKeyB64);
+  if (!started) {
+    console.log(`  ${yellow("!")} Couldn't start pairing. Check your connection and try again.`);
+    return pairFailed("unreachable");
+  }
+  const { pairId, code } = started;
+  const { qrLink, universalLink, deepLink } = buildPairLinks(pairId, keypair.publicKeyB64, apiBase(), code);
+  console.log();
+  console.log(`  ${bold("Connect your Pushary app")}`);
+  console.log(`  ${dim("Scan this with your phone camera:")}`);
+  await printQr(qrLink);
+  console.log(`  ${dim("No camera handy? Open this on the phone instead:")}`);
+  console.log(`  ${cyan(universalLink)}`);
+  console.log(`  ${dim("Confirm the app shows fingerprint")} ${cyan(publicKeyFingerprint(keypair.publicKeyB64))}`);
+  console.log(`  ${dim("Already have the app and it opened a browser? Use")} ${cyan(deepLink)}`);
+  console.log();
+  const startedAt = clock.now();
+  const deadline = requestedAt + PAIR_TIMEOUT_MS;
+  let hintShown = false;
+  let browserFallbackShown = false;
+  const stop = startSpinner(() => {
+    const left = Math.max(0, Math.ceil((deadline - clock.now()) / 6e4));
+    if (clock.now() - startedAt < PAIR_HINT_AFTER_MS) {
+      return "Waiting for the app to authorize";
+    }
+    if (!hintShown) {
+      hintShown = true;
+      writeStatusLine(
+        `${dim("No app yet? Install it, sign in with this account, then scan. Ctrl-C to stop.")}`
+      );
+    }
+    return `Waiting for the app ${dim(`(${left}m left)`)}`;
+  });
+  let cancelled = false;
+  const onInterrupt = () => {
+    cancelled = true;
+    stop(yellow("!"), "Cancelled");
+    const flushed = options.onCancelled?.();
+    void Promise.allSettled([Promise.resolve(flushed), cancelPairing(pairId)]).finally(() => process.exit(EXIT_ABORTED));
+  };
+  process.once("SIGINT", onInterrupt);
+  let consecutiveFailures = 0;
+  try {
+    while (clock.now() < deadline) {
+      if (cancelled) return pairFailed("cancelled");
+      if (!browserFallbackShown && clock.now() - startedAt >= PAIR_BROWSER_FALLBACK_AFTER_MS) {
+        browserFallbackShown = true;
+        writeStatusLine(dim(PAIR_BROWSER_FALLBACK_LINE));
+      }
+      const claim = await claimPairing(pairId);
+      if (claim === null) {
+        consecutiveFailures += 1;
+        if (consecutiveFailures >= PAIR_MAX_CONSECUTIVE_FAILURES) {
+          stop(yellow("!"), "Can't reach pushary.com to finish pairing. Check your connection, then re-run setup.");
+          await cancelPairing(pairId);
+          return pairFailed("unreachable");
+        }
+        await clock.sleep(PAIR_POLL_INTERVAL_MS);
+        continue;
+      }
+      consecutiveFailures = 0;
+      if (claim?.status === "authorized") {
+        let apiKey;
+        try {
+          apiKey = openSealedKey(claim.sealed, keypair);
+        } catch {
+          stop(yellow("!"), "Pairing failed to decrypt \u2014 re-run setup to try again");
+          await cancelPairing(pairId);
+          return pairFailed("decrypt");
+        }
+        await ackPairing(pairId);
+        stop(check, "App connected");
+        return { kind: "paired", apiKey, handle: claim.siteSlug };
+      }
+      if (claim?.status === "expired") {
+        stop(yellow("!"), "Pairing expired \u2014 re-run setup to try again");
+        return pairFailed("expired");
+      }
+      if (claim?.status === "failed") {
+        stop(yellow("!"), describePairFailure(claim.reason));
+        return pairFailed("rejected");
+      }
+      await clock.sleep(PAIR_POLL_INTERVAL_MS);
+    }
+    stop(yellow("!"), "Timed out waiting for the app");
+    await cancelPairing(pairId);
+    return pairFailed("timeout");
+  } catch (err) {
+    stop(yellow("!"), `Pairing error ${dim(`(${err instanceof Error ? err.message : "network"})`)}`);
+    await cancelPairing(pairId);
+    return pairFailed("unreachable");
+  } finally {
+    process.off("SIGINT", onInterrupt);
+  }
+};
+
+export {
+  reachVerdict,
+  describeReach,
+  verifyRoundTrip,
+  describeRoundTrip,
+  roundTripEvidence,
+  fetchChannels,
+  connectDevice,
+  confirmAppConnection,
+  connectExistingApp,
+  printConnectInstructions,
+  BROWSER_CONNECT_COMMAND,
+  pairingEscapeApplies,
+  connectViaAppPairing
+};