pushary 1.9.23 → 1.9.24

package/dist/{chunk-HXZG5WHU.js → chunk-7JHYWFY6.js}

@@ -1,9 +1,9 @@
 import {
   CODEX_HOOK_STATUS
-} from "./chunk-RHIKMNWJ.js";
+} from "./chunk-LHFK5F3T.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-LEQRIJ4H.js";
+} from "./chunk-QDKNLNCA.js";
 
 // src/setup/codex-trust.ts
 var CODEX_TRUST_TELEMETRY = {

package/dist/{chunk-NHBPW6C4.js → chunk-7Z2DLAEE.js}

@@ -1,6 +1,6 @@
 import {
   pusharyDir
-} from "./chunk-QIODXPTP.js";
+} from "./chunk-NQICO3ES.js";
 import {
   readJsonSafe,
   writeFileAtomic
@@ -13,7 +13,7 @@ import {
   serializeDeclinedAgents,
   withDeclinedAgent,
   withoutDeclinedAgent
-} from "./chunk-OH647UT3.js";
+} from "./chunk-GM2IFDVF.js";
 
 // src/declined-agents-file.ts
 import { join } from "path";

package/dist/{chunk-FBV2KS3Z.js → chunk-CLVU24OZ.js}

@@ -6,12 +6,12 @@ import {
   permissionDeniedAction,
   releaseThrottle,
   reportEvent
-} from "./chunk-GYP6DLA4.js";
+} from "./chunk-KT5BH6GC.js";
 import {
   machineDecisionFor,
   shouldDeferToNativeMode,
   wireVerdictFor
-} from "./chunk-OH647UT3.js";
+} from "./chunk-GM2IFDVF.js";
 
 // src/machine-decision-audit.ts
 import { basename } from "path";

package/dist/{chunk-SLBO7PHS.js → chunk-CYGIJXAP.js}

@@ -4,10 +4,10 @@ import {
   keyPrefix,
   readConfigFileKey,
   readMacAppKeyPrefix
-} from "./chunk-AQ3TSQA2.js";
+} from "./chunk-U23XTMBF.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-LEQRIJ4H.js";
+} from "./chunk-QDKNLNCA.js";
 
 // src/key-signed-out.ts
 var VERDICT_BY_CHECK = {

package/dist/{chunk-M7DCI44L.js → chunk-E4B7TXVS.js}

@@ -1,6 +1,6 @@
 import {
   DEFAULT_SESSION
-} from "./chunk-GYP6DLA4.js";
+} from "./chunk-KT5BH6GC.js";
 
 // src/answer.ts
 var isDeferAnswer = (value) => value === "defer";

package/dist/{chunk-S2R2U5W5.js → chunk-EE357RIP.js}

@@ -2,25 +2,25 @@ import {
   SIGNED_OUT_ON_MAC_MESSAGE,
   describeSignedOutKey,
   readSignedOutDiagnosis
-} from "./chunk-SLBO7PHS.js";
+} from "./chunk-CYGIJXAP.js";
 import {
   createIo
 } from "./chunk-FO3MDD26.js";
 import {
   readKeySource
-} from "./chunk-AQ3TSQA2.js";
+} from "./chunk-U23XTMBF.js";
 import {
   absoluteUrl,
   checkApiKey,
   describeKeyCheck,
   keyCheckFromResponse
-} from "./chunk-Z4UDB7EC.js";
+} from "./chunk-H2RD5EMR.js";
 import {
   EXIT
 } from "./chunk-KZERVKTD.js";
 import {
   getBaseUrl
-} from "./chunk-OQPEHKH2.js";
+} from "./chunk-OY6NJWDD.js";
 
 // src/cli/report-key.ts
 var { dim, yellow } = createIo();

package/dist/{chunk-I46QTKYI.js → chunk-EKPAV33G.js}

@@ -4,7 +4,7 @@ import {
   forkFinishWithUpgradeLock,
   installWithUpgradeLock,
   releaseAutoUpdateLock
-} from "./chunk-JCEUDLGW.js";
+} from "./chunk-WYLA6J43.js";
 import {
   describeAutoUpdateCheck,
   globalInstallLocation,
@@ -14,7 +14,7 @@ import {
   readAutoUpdateState,
   updateAutoUpdateState,
   upgradeEntryFor
-} from "./chunk-USUI4P63.js";
+} from "./chunk-XQROISQB.js";
 import {
   EXIT
 } from "./chunk-KZERVKTD.js";
@@ -27,10 +27,10 @@ import {
   npmErrorMessage,
   readGlobalCliInstallAt,
   readGlobalPrefix
-} from "./chunk-QIODXPTP.js";
+} from "./chunk-NQICO3ES.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-LEQRIJ4H.js";
+} from "./chunk-QDKNLNCA.js";
 import {
   commandsPackage,
   globalUpgradeEntry,
@@ -39,7 +39,7 @@ import {
   isSameMajorVersion,
   ownPackageRoot,
   packageVersionAt
-} from "./chunk-OH647UT3.js";
+} from "./chunk-GM2IFDVF.js";
 
 // src/global-upgrade.ts
 import { existsSync } from "fs";

package/dist/{chunk-SWQLZQE3.js → chunk-G6GFNKF7.js}

@@ -1,20 +1,20 @@
 import {
   defersToNativeMode,
   reportMachineDenial
-} from "./chunk-FBV2KS3Z.js";
+} from "./chunk-CLVU24OZ.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "./chunk-GN6BJXC7.js";
+} from "./chunk-GBD6G4TA.js";
 import {
   announceSubscriptionRequired,
   isDeferAnswer,
   oncePerSession
-} from "./chunk-M7DCI44L.js";
+} from "./chunk-E4B7TXVS.js";
 import {
   activeHookSource,
   activeIdentity
-} from "./chunk-K2EYK5RL.js";
+} from "./chunk-LOERK6N3.js";
 import {
   DEFAULT_SESSION,
   UNNAMED_ACTION,
@@ -39,7 +39,7 @@ import {
   reportEvent,
   scopePathFor,
   settleQuestionsForToolUse
-} from "./chunk-GYP6DLA4.js";
+} from "./chunk-KT5BH6GC.js";
 import {
   askUser,
   cancelQuestion,
@@ -51,20 +51,20 @@ import {
   sendNotification,
   waitForQuestion,
   waitsForThePhone
-} from "./chunk-4GKQDFH6.js";
+} from "./chunk-ZVON5PCF.js";
 import {
   SubscriptionRequiredError
-} from "./chunk-E2LGKG75.js";
+} from "./chunk-RK7TDMQT.js";
 import {
   getMachineId
-} from "./chunk-EDN4F6GX.js";
+} from "./chunk-IS737HST.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-OQPEHKH2.js";
+} from "./chunk-OY6NJWDD.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-LEQRIJ4H.js";
+} from "./chunk-QDKNLNCA.js";
 import {
   AGENT_QUESTION_STRATEGY,
   DECISION_STOP_REASON,
@@ -104,8 +104,9 @@ import {
   parseAgentQuestionAnswers,
   parseAgentQuestions,
   questionHandedToTheTerminal,
-  resolveGate
-} from "./chunk-OH647UT3.js";
+  resolveGate,
+  timeoutActionWithoutLocalPrompt
+} from "./chunk-GM2IFDVF.js";
 
 // src/claude-permission-rules.ts
 import { readFileSync, statSync } from "fs";
@@ -345,7 +346,7 @@ var dispatchModeHandler = async (apiKey, input, toolPolicy, machineId, trainingC
   const runHandler = () => {
     switch (ownPrompt ? toolPolicy.mode : approvalModeWithoutLocalPrompt(toolPolicy.mode)) {
       case "push_only":
-        return handlePushOnly(apiKey, description, projectName, toolPolicy.timeoutSeconds, toolPolicy.timeoutAction, sessionId, machineId, input.tool_name, toolTarget, decision, signals);
+        return handlePushOnly(apiKey, description, projectName, toolPolicy.timeoutSeconds, ownPrompt ? toolPolicy.timeoutAction : timeoutActionWithoutLocalPrompt(toolPolicy), sessionId, machineId, input.tool_name, toolTarget, decision, signals);
       case "terminal_only":
         return Promise.resolve(handleTerminalOnly());
       case "push_first":

package/dist/{chunk-GN6BJXC7.js → chunk-GBD6G4TA.js}

@@ -1,6 +1,6 @@
 import {
   isSafeReadOnlyCommand
-} from "./chunk-OH647UT3.js";
+} from "./chunk-GM2IFDVF.js";
 
 // src/ledger.ts
 import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync } from "fs";

package/dist/{chunk-OH647UT3.js → chunk-GM2IFDVF.js}

@@ -913,6 +913,8 @@ var approvalModeWithoutLocalPrompt = (mode) => {
       return mode;
   }
 };
+var TIMEOUT_ACTION_THAT_REFUSES = "deny";
+var timeoutActionWithoutLocalPrompt = ({ mode, timeoutAction }) => mode !== "push_only" && timeoutAction === "approve" ? TIMEOUT_ACTION_THAT_REFUSES : timeoutAction;
 var MAX_AGENT_QUESTIONS = 4;
 var parseAgentQuestion = (raw) => {
   const q = raw;
@@ -1908,7 +1910,27 @@ var mcpToolNameNeedsAPerson = (toolName) => {
   const phrase = words.join(" ");
   return words.some(mcpToolWordNeedsAPerson) || classifyDecisionRisk(phrase, phrase) !== "standard";
 };
-var allowsSessionToolGrant = (toolName) => SESSION_TOOL_GRANT_TOOLS.has(toolName) || parseMcpToolName(toolName) !== void 0 && !isPusharyOwnTool(toolName.toLowerCase()) && !mcpToolNameNeedsAPerson(toolName);
+var MCP_TOOL_VERBS_THAT_ONLY_READ = /* @__PURE__ */ new Set([
+  "get",
+  "list",
+  "search",
+  "read",
+  "fetch",
+  "find",
+  "view",
+  "show",
+  "describe",
+  "lookup",
+  "retrieve",
+  "inspect",
+  "browse",
+  "count"
+]);
+var mcpToolLeadsWithAReadVerb = (toolName) => {
+  const tool = parseMcpToolName(toolName)?.tool;
+  return tool !== void 0 && MCP_TOOL_VERBS_THAT_ONLY_READ.has(wordsOfMcpToolName(tool)[0] ?? "");
+};
+var allowsSessionToolGrant = (toolName) => SESSION_TOOL_GRANT_TOOLS.has(toolName) || mcpToolLeadsWithAReadVerb(toolName) && !isPusharyOwnTool(toolName.toLowerCase()) && !mcpToolNameNeedsAPerson(toolName);
 var isSessionToolGrant = (policy) => Boolean(policy.sessionId) && allowsSessionToolGrant(policy.tool) && isAutoApprove(policy);
 var API_KEY_PREFIX_SHAPE = "pk_[a-f0-9]+";
 var API_KEY_PREFIX_PATTERN = new RegExp(`^${API_KEY_PREFIX_SHAPE}$`);
@@ -3200,6 +3222,7 @@ export {
   normalizeKeyScope,
   isApprovalMode,
   approvalModeWithoutLocalPrompt,
+  timeoutActionWithoutLocalPrompt,
   parseAgentQuestion,
   parseAgentQuestions,
   parseAgentQuestionAnswers,

package/dist/{chunk-6HT2TUZD.js → chunk-GXQVOKHJ.js}

@@ -1,9 +1,9 @@
 import {
   configFilePath
-} from "./chunk-OQPEHKH2.js";
+} from "./chunk-OY6NJWDD.js";
 import {
   normalizeInstallSource
-} from "./chunk-OH647UT3.js";
+} from "./chunk-GM2IFDVF.js";
 
 // src/install-source.ts
 import { readFileSync } from "fs";

package/dist/{chunk-Z4UDB7EC.js → chunk-H2RD5EMR.js}

@@ -1,6 +1,6 @@
 import {
   pusharyFetch
-} from "./chunk-XBETSM5T.js";
+} from "./chunk-2E6AWHV7.js";
 import {
   NetworkError
 } from "./chunk-7QLSKOSU.js";
@@ -9,11 +9,11 @@ import {
 } from "./chunk-KZERVKTD.js";
 import {
   getBaseUrl
-} from "./chunk-OQPEHKH2.js";
+} from "./chunk-OY6NJWDD.js";
 import {
   isValidApiKey,
   normalizeKeyScope
-} from "./chunk-OH647UT3.js";
+} from "./chunk-GM2IFDVF.js";
 
 // src/session.ts
 var samePusharyAccount = (left, right) => left.kind === "ok" && right.kind === "ok" && left.identity.workspaceId !== "" && left.identity.workspaceId === right.identity.workspaceId && left.identity.siteId === right.identity.siteId;

package/dist/{chunk-SSWK2WYX.js → chunk-HBR6ZZHN.js}

@@ -4,14 +4,14 @@ import {
 } from "./chunk-XHKBHWLX.js";
 import {
   readControlMode
-} from "./chunk-AQ3TSQA2.js";
+} from "./chunk-U23XTMBF.js";
 import {
   getMachineId
-} from "./chunk-EDN4F6GX.js";
+} from "./chunk-IS737HST.js";
 import {
   pusharyDir,
   resolveGlobalBinary
-} from "./chunk-QIODXPTP.js";
+} from "./chunk-NQICO3ES.js";
 import {
   readJsonSafe,
   writeFileAtomic,
@@ -20,7 +20,7 @@ import {
 } from "./chunk-AQFEP65J.js";
 import {
   getApiKey
-} from "./chunk-OQPEHKH2.js";
+} from "./chunk-OY6NJWDD.js";
 import {
   CLI_PACKAGE_NAMES,
   cmdShimTarget,
@@ -28,7 +28,7 @@ import {
   globalPackageFolder,
   globalRootFor,
   isRecord
-} from "./chunk-OH647UT3.js";
+} from "./chunk-GM2IFDVF.js";
 
 // src/daemon-lifecycle.ts
 import { dirname, join, win32 as win32Path } from "path";

package/dist/{chunk-2AUKCSLQ.js → chunk-HLXGEOX3.js}

@@ -1,17 +1,17 @@
 import {
   compatibleConfigFile,
   hasCompatibleHooks
-} from "./chunk-K2EYK5RL.js";
+} from "./chunk-LOERK6N3.js";
 import {
   pusharyHookExecutable
-} from "./chunk-A5U62Q6K.js";
+} from "./chunk-OSOCONIE.js";
 import {
   isProtectedByScope,
   registerHookEntry
-} from "./chunk-QIODXPTP.js";
+} from "./chunk-NQICO3ES.js";
 import {
   isRecord
-} from "./chunk-OH647UT3.js";
+} from "./chunk-GM2IFDVF.js";
 
 // src/cursor-config.ts
 var hookCommandOf = (entry) => {

package/dist/{chunk-ISAKLEKE.js → chunk-IO5ZDIHY.js}

@@ -1,6 +1,6 @@
 import {
   ensureCodexTrustsPusharyHooks
-} from "./chunk-RHIKMNWJ.js";
+} from "./chunk-LHFK5F3T.js";
 import {
   detectClaudeVersion
 } from "./chunk-RIVNNBEK.js";
@@ -12,12 +12,12 @@ import {
   openCodeHookArgv,
   openCodePluginDir,
   openCodeWired
-} from "./chunk-ZGYO6OQE.js";
+} from "./chunk-O3RRQTTV.js";
 import {
   addClaudeMcpServer,
   addPusharyHooks,
   addPusharyToolPermissions
-} from "./chunk-K2EYK5RL.js";
+} from "./chunk-LOERK6N3.js";
 import {
   claudeUnprovenHolds,
   claudeWired,
@@ -25,7 +25,7 @@ import {
   codexWired,
   geminiWired,
   planHooks
-} from "./chunk-A5U62Q6K.js";
+} from "./chunk-OSOCONIE.js";
 import {
   CLAUDE_HOOK_BINARY,
   CLAUDE_HOOK_EVENTS,
@@ -36,7 +36,7 @@ import {
   needsReregistration,
   registrationSignatures,
   supportedClaudeEvents
-} from "./chunk-7RGEJOQS.js";
+} from "./chunk-VFIZFKZY.js";
 import {
   formatVersion
 } from "./chunk-6ICPEJY5.js";
@@ -59,7 +59,7 @@ import {
   registrationHolderOf,
   resolveGlobalBinary,
   vscodePluginMcp
-} from "./chunk-QIODXPTP.js";
+} from "./chunk-NQICO3ES.js";
 import {
   readJsonSafe,
   writeFileAtomic,
@@ -67,7 +67,7 @@ import {
 } from "./chunk-AQFEP65J.js";
 import {
   isRecord
-} from "./chunk-OH647UT3.js";
+} from "./chunk-GM2IFDVF.js";
 
 // src/reapply.ts
 import { dirname, join } from "path";

package/dist/{chunk-EDN4F6GX.js → chunk-IS737HST.js}

@@ -1,6 +1,6 @@
 import {
   pusharyDir
-} from "./chunk-QIODXPTP.js";
+} from "./chunk-NQICO3ES.js";
 import {
   writeFileAtomic
 } from "./chunk-AQFEP65J.js";

package/dist/{chunk-M6R3SZZS.js → chunk-JDWOK6PE.js}

@@ -1,6 +1,6 @@
 import {
   readTranscriptPreference
-} from "./chunk-AQ3TSQA2.js";
+} from "./chunk-U23XTMBF.js";
 
 // src/transcript-setting.ts
 var transcriptEnvironmentPreference = () => {

package/dist/{chunk-GYP6DLA4.js → chunk-KT5BH6GC.js}

@@ -2,7 +2,7 @@ import {
   IDLE_PROMPT_NOTIFICATION,
   NOTIFICATION_PUSH_TYPES,
   POSTTOOLUSE_MIRROR_ONLY_TOOLS
-} from "./chunk-KJA6IGOZ.js";
+} from "./chunk-RFK2WN6S.js";
 import {
   cancelQuestion,
   clientErrorKindOf,
@@ -10,26 +10,26 @@ import {
   reportClientError,
   sendNotification,
   waitForAnswer
-} from "./chunk-4GKQDFH6.js";
+} from "./chunk-ZVON5PCF.js";
 import {
   withRetry
-} from "./chunk-E2LGKG75.js";
+} from "./chunk-RK7TDMQT.js";
 import {
   getMachineId
-} from "./chunk-EDN4F6GX.js";
+} from "./chunk-IS737HST.js";
 import {
   reportedInstallSource
-} from "./chunk-6HT2TUZD.js";
+} from "./chunk-GXQVOKHJ.js";
 import {
   canonicalJson
-} from "./chunk-QIODXPTP.js";
+} from "./chunk-NQICO3ES.js";
 import {
   writeFileAtomic
 } from "./chunk-AQFEP65J.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-OQPEHKH2.js";
+} from "./chunk-OY6NJWDD.js";
 import {
   ACTION_BODY_MAX,
   AGENT_LABELS_BY_TYPE,
@@ -60,7 +60,7 @@ import {
   resolvePolicy,
   toToolLookup,
   truncateLine
-} from "./chunk-OH647UT3.js";
+} from "./chunk-GM2IFDVF.js";
 
 // ../hook-mapping/src/describe.ts
 import { isAbsolute, relative, resolve } from "path";

package/dist/{chunk-7J2AX5T6.js → chunk-KX776UXN.js}

@@ -10,10 +10,10 @@ import {
   resolvePackageVersionFromBinary,
   resolvePathBinary,
   resolvePathBinaryAsync
-} from "./chunk-QIODXPTP.js";
+} from "./chunk-NQICO3ES.js";
 import {
   MANAGED_PROVIDERS
-} from "./chunk-OH647UT3.js";
+} from "./chunk-GM2IFDVF.js";
 
 // src/setup/codex-install.ts
 var NATIVE_BINARY_MIN_BYTES = 20 * 1024 * 1024;

package/dist/chunk-L5MCJNSI.js

@@ -0,0 +1,166 @@
+import {
+  APPROVAL_SETTINGS_PATH
+} from "./chunk-EE357RIP.js";
+import {
+  readMacAppAgentKey
+} from "./chunk-2JTJZ7VI.js";
+import {
+  findExportedKeyLines,
+  isAdoptedMacAppKey,
+  isCliCreatedKey,
+  keyPrefix,
+  readCliCreatedKeyPrefix,
+  readConfigFileKey,
+  readKeySource,
+  readMacAppKeyPrefix
+} from "./chunk-U23XTMBF.js";
+import {
+  absoluteUrl
+} from "./chunk-H2RD5EMR.js";
+import {
+  isValidApiKey
+} from "./chunk-GM2IFDVF.js";
+
+// src/key-revocation.ts
+var SELF_REVOKE_PATH = "/api/v1/server/keys/self/revoke";
+var DEVICE_KEY_PATH = "/api/agent/device-key";
+var FULL_ACCESS_ONLY_STATUS = 403;
+var REVOKE_TIMEOUT_MS = 1e4;
+var readRevokedCount = async (response) => {
+  try {
+    const body = await response.json();
+    const revoked = typeof body === "object" && body !== null && "revoked" in body ? body.revoked : void 0;
+    return typeof revoked === "number" && Number.isInteger(revoked) && revoked >= 0 ? revoked : null;
+  } catch {
+    return null;
+  }
+};
+var revokeAgentKey = async (apiKey, baseUrl, fetchImpl) => {
+  const response = await fetchImpl(`${baseUrl}${DEVICE_KEY_PATH}`, {
+    method: "DELETE",
+    headers: { Authorization: `Bearer ${apiKey}` },
+    signal: AbortSignal.timeout(REVOKE_TIMEOUT_MS)
+  });
+  if (!response.ok) return { kind: "refused", status: response.status };
+  const revoked = await readRevokedCount(response);
+  if (revoked === null) return { kind: "unconfirmed", status: response.status };
+  return revoked > 0 ? { kind: "revoked" } : { kind: "not_accepted" };
+};
+var revokeOwnKey = async (apiKey, baseUrl, fetchImpl = fetch) => {
+  try {
+    const response = await fetchImpl(`${baseUrl}${SELF_REVOKE_PATH}`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${apiKey}`, "Content-Type": "application/json" },
+      signal: AbortSignal.timeout(REVOKE_TIMEOUT_MS)
+    });
+    if (response.status === 401) return { kind: "not_accepted" };
+    if (response.status === FULL_ACCESS_ONLY_STATUS) return await revokeAgentKey(apiKey, baseUrl, fetchImpl);
+    if (!response.ok) return { kind: "refused", status: response.status };
+    return { kind: "revoked" };
+  } catch (err) {
+    return { kind: "unreachable", detail: err instanceof Error ? err.message : "network error" };
+  }
+};
+var REVOKE_DETAIL = {
+  revoked: "Revoked the key on pushary.com.",
+  not_accepted: "pushary.com had already stopped accepting the key.",
+  refused: "pushary.com refused to revoke the key",
+  unconfirmed: "pushary.com did not confirm the key was revoked",
+  unreachable: "Could not reach pushary.com to revoke the key"
+};
+var describeRevokeAttempt = (attempt) => {
+  if (attempt.kind === "refused" || attempt.kind === "unconfirmed") return `${REVOKE_DETAIL[attempt.kind]} (HTTP ${attempt.status}).`;
+  if (attempt.kind === "unreachable") return `${REVOKE_DETAIL.unreachable}: ${attempt.detail}`;
+  return REVOKE_DETAIL[attempt.kind];
+};
+var keyNoLongerAccepted = (attempt) => attempt.kind === "revoked" || attempt.kind === "not_accepted";
+var keyValidityOf = (check) => {
+  switch (check.kind) {
+    case "ok":
+    case "locked":
+      return "valid";
+    case "rejected":
+    case "malformed":
+      return "invalid";
+    case "unreachable":
+      return "unknown";
+  }
+};
+
+// src/cli/held-key-revocation.ts
+var readCliHeldKeys = (profiles) => {
+  const source = readKeySource();
+  return {
+    configKey: readConfigFileKey(),
+    profileKeys: findExportedKeyLines(profiles).map((line) => line.key),
+    envKey: source.kind === "env" ? source.key : null,
+    macAppKey: readMacAppAgentKey(),
+    macAppKeyPrefix: readMacAppKeyPrefix(),
+    cliCreatedKeyPrefix: readCliCreatedKeyPrefix()
+  };
+};
+var isMacAppCurrentOrAdoptedKey = (key, keys) => key === keys.macAppKey || isAdoptedMacAppKey(key, keys.macAppKeyPrefix);
+var revocationOfStoredKey = (key, keys) => {
+  if (isMacAppCurrentOrAdoptedKey(key, keys)) return { kind: "mac_app_key", keyPrefix: keyPrefix(key) };
+  if (!isCliCreatedKey(key, keys.cliCreatedKeyPrefix)) return { kind: "no_creation_record", keyPrefix: keyPrefix(key) };
+  return { kind: "revoke", key };
+};
+var validKeys = (keys) => [...new Set(keys)].filter((key) => key !== null && isValidApiKey(key));
+var environmentOnlyKey = (keys, stored) => validKeys([keys.envKey]).filter((key) => !stored.includes(key)).map((key) => ({ kind: "environment_only", keyPrefix: keyPrefix(key) }));
+var planCliKeyRevocations = (keys) => {
+  const stored = validKeys([keys.configKey, ...keys.profileKeys]);
+  return [...stored.map((key) => revocationOfStoredKey(key, keys)), ...environmentOnlyKey(keys, stored)];
+};
+var keysToRevoke = (revocations) => revocations.flatMap((revocation) => revocation.kind === "revoke" ? [revocation.key] : []);
+var sparedKeys = (revocations) => revocations.flatMap((revocation) => revocation.kind === "revoke" ? [] : [revocation]);
+var runRevocation = async (revocation, run) => {
+  if (revocation.kind !== "revoke") return revocation;
+  if (run.dryRun) return { kind: "would_revoke", keyPrefix: keyPrefix(revocation.key) };
+  return { kind: "attempted", keyPrefix: keyPrefix(revocation.key), attempt: await revokeOwnKey(revocation.key, run.baseUrl) };
+};
+var revokeCliKeys = async (revocations, run) => {
+  const outcomes = [];
+  for (const revocation of revocations) outcomes.push(await runRevocation(revocation, run));
+  return outcomes;
+};
+var SPARED_KEY_WHY = {
+  mac_app_key: "It is the Pushary Mac app's key, and the app may still be using it.",
+  no_creation_record: "This CLI has no record of creating it, so it may be in use by the Mac app or on another machine."
+};
+var localRemovalOf = (dryRun) => dryRun ? "would be removed here" : "removed here";
+var settingsUrlOf = (baseUrl) => absoluteUrl(baseUrl, APPROVAL_SETTINGS_PATH);
+var revokeYourselfHint = (reason, baseUrl) => reason === "no_creation_record" ? `Revoke it at ${settingsUrlOf(baseUrl)} if nothing else uses it.` : null;
+var describeCliKeyRevocation = (outcome, run) => {
+  const label = `API key ${outcome.keyPrefix}`;
+  switch (outcome.kind) {
+    case "would_revoke":
+      return { tone: "skipped", line: `${label} (would revoke it on pushary.com)`, next: null };
+    case "mac_app_key":
+    case "no_creation_record":
+      return {
+        tone: "skipped",
+        line: `${label}: ${localRemovalOf(run.dryRun)}, not revoked. ${SPARED_KEY_WHY[outcome.kind]}`,
+        next: revokeYourselfHint(outcome.kind, run.baseUrl)
+      };
+    case "environment_only":
+      return { tone: "skipped", line: `${label} in PUSHARY_API_KEY (left alone: Pushary did not write it)`, next: null };
+    case "attempted":
+      return keyNoLongerAccepted(outcome.attempt) ? { tone: "done", line: `${label}: ${describeRevokeAttempt(outcome.attempt)}`, next: null } : {
+        tone: "warning",
+        line: `${label}: ${describeRevokeAttempt(outcome.attempt)}`,
+        next: `It may still be valid. Revoke it at ${settingsUrlOf(run.baseUrl)}`
+      };
+  }
+};
+
+export {
+  revokeOwnKey,
+  keyNoLongerAccepted,
+  keyValidityOf,
+  readCliHeldKeys,
+  planCliKeyRevocations,
+  keysToRevoke,
+  sparedKeys,
+  revokeCliKeys,
+  describeCliKeyRevocation
+};