scenri 0.15.1 → 0.16.0

package/dist/serve.js

@@ -5,17 +5,18 @@ import { detectInstallKind } from './chunk-PAIAXRAC.js';
 export { detectInstallKind } from './chunk-PAIAXRAC.js';
 import { readMeta, repoSlug } from './chunk-Y3ZPBPLP.js';
 import { compareSemver, newestStaged } from './chunk-4MAFHYAD.js';
+import { powershellPath, PS_UTF8 } from './chunk-2IGINCPU.js';
 import { dirname, join, normalize } from 'path';
 import { fileURLToPath } from 'url';
 import fs, { existsSync, readFileSync, mkdirSync, createReadStream, rmSync, readdirSync, statSync, renameSync } from 'fs';
-import { homedir, networkInterfaces, tmpdir } from 'os';
-import { randomBytes, randomUUID, timingSafeEqual, createHash } from 'crypto';
+import { homedir, tmpdir, networkInterfaces } from 'os';
 import { copyFile, readFile, stat, readdir, mkdtemp, rm, access, rename, unlink, writeFile } from 'fs/promises';
-import { spawn } from 'child_process';
+import { spawn, execFile } from 'child_process';
 import sharp21 from 'sharp';
 import Fastify from 'fastify';
 import fastifyStatic from '@fastify/static';
 import fastifyMultipart from '@fastify/multipart';
+import { randomUUID, randomInt, timingSafeEqual, createHash } from 'crypto';
 import { Ajv2020 } from 'ajv/dist/2020.js';
 import addFormats from 'ajv-formats';
 import * as cheerio from 'cheerio';
@@ -23,6 +24,8 @@ import { lookup } from 'dns/promises';
 import { isIP } from 'net';
 import JSZip from 'jszip';
 import { parse } from 'node-html-parser';
+import { createServer } from 'http';
+import { createSocket } from 'dgram';
 import pixelmatch from 'pixelmatch';
 import { PNG } from 'pngjs';
 
@@ -904,7 +907,7 @@ function createRunner(opts = {}) {
     const env = buildChildEnv(parentEnv, ignoreEnvKeys());
     return exe.direct ? spawnImpl(exe.command, args, { stdio, env, ...platform !== "win32" ? { detached: true } : {} }) : spawnImpl([exe.command, ...args.map(winArg)].join(" "), [], { stdio, env, shell: true });
   };
-  async function run3(args, signal, io) {
+  async function run4(args, signal, io) {
     const exe = await resolution();
     const timeoutMs = io?.timeoutMs ?? defaultTimeoutMs;
     return new Promise((resolve, reject) => {
@@ -1195,7 +1198,7 @@ function createRunner(opts = {}) {
       let result;
       try {
         await withWorkDir(
-          (dir) => run3(execArgs(dir), void 0, {
+          (dir) => run4(execArgs(dir), void 0, {
             stdin: CONNECT_PROMPT,
             timeoutMs: connectTimeoutMs,
             label: "connect"
@@ -1236,7 +1239,7 @@ function createRunner(opts = {}) {
     connCache = null;
     cached = null;
   }
-  return { run: run3, withWorkDir, probe, invalidateProbe, connect, invalidateConnection, noteConnection };
+  return { run: run4, withWorkDir, probe, invalidateProbe, connect, invalidateConnection, noteConnection };
 }
 var PHOTO_VIEWS = [
   "portrait",
@@ -1513,7 +1516,7 @@ function createCodexSetup(opts = {}) {
   const runner = opts.runner ?? createRunner(opts);
   const installTimeoutMs = opts.installTimeoutMs ?? DEFAULT_INSTALL_TIMEOUT_MS;
   const ignoreEnvKeys = opts.ignoreEnvKeys ?? (() => []);
-  function run3(cmd, args, timeoutMs) {
+  function run4(cmd, args, timeoutMs) {
     return new Promise((resolve) => {
       let settled = false;
       let stderr = "";
@@ -1562,7 +1565,7 @@ function createCodexSetup(opts = {}) {
       };
     },
     async install() {
-      const res = await run3("npm", ["install", "-g", "@openai/codex"], installTimeoutMs);
+      const res = await run4("npm", ["install", "-g", "@openai/codex"], installTimeoutMs);
       if (res.code === 0) {
         runner.invalidateProbe();
         const avail = await runner.probe();
@@ -1596,7 +1599,7 @@ function createCodexSetup(opts = {}) {
       return { ok: false, fallbackCommand: INSTALL_COMMAND, docsUrl: INSTALL_DOCS_URL, detail };
     },
     async login() {
-      const res = await run3("codex", ["login"], installTimeoutMs);
+      const res = await run4("codex", ["login"], installTimeoutMs);
       runner.invalidateProbe();
       if (res.code === 0) return { ok: true };
       const detail = (res.spawnError ?? res.stderr).trim().slice(0, 400) || void 0;
@@ -1969,7 +1972,7 @@ function createDemoEngine(saveImage, opts = {}) {
     );
     return hexes.length ? hexes : ["#4B5563", "#9CA3AF"];
   };
-  const esc = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").slice(0, 90);
+  const esc2 = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").slice(0, 90);
   async function render(colors, label, w, h, seed) {
     const c0 = colors[seed % colors.length];
     const c1 = colors[(seed + 1) % colors.length] ?? "#111111";
@@ -1979,7 +1982,7 @@ function createDemoEngine(saveImage, opts = {}) {
       </linearGradient></defs>
       <rect width="100%" height="100%" fill="url(#g)"/>
       <circle cx="${w * (0.25 + 0.5 * (seed * 37 % 100) / 100)}" cy="${h * 0.38}" r="${Math.min(w, h) * 0.18}" fill="#ffffff" opacity="0.25"/>
-      <text x="24" y="${h - 48}" font-family="Helvetica, Arial" font-size="${Math.max(14, Math.round(w / 42))}" fill="#ffffff" opacity="0.92">${esc(label)}</text>
+      <text x="24" y="${h - 48}" font-family="Helvetica, Arial" font-size="${Math.max(14, Math.round(w / 42))}" fill="#ffffff" opacity="0.92">${esc2(label)}</text>
       <text x="24" y="${h - 22}" font-family="Helvetica, Arial" font-size="12" fill="#ffffff" opacity="0.6">Scenri demo engine</text>
     </svg>`;
     return sharp21(Buffer.from(svg)).png().toBuffer();
@@ -7555,18 +7558,18 @@ async function runJob(deps, jobId, brandId, url, signal, only) {
         patch3({ stage: "fetching_products", discovered, message: `Reading ${discovered.toLocaleString()} products` });
       }
     }
-    const run3 = beginWrite(deps, jobId, brandId, baseUrl, platform, tally2, discovered);
+    const run4 = beginWrite(deps, jobId, brandId, baseUrl, platform, tally2, discovered);
     const pictures = drainPictures(deps, jobId, brandId, tally2, signal, hostOf(baseUrl));
     let pictureErrors;
     let pictureReasons = {};
     const stats = { pages: 0, bytes: 0, refused: 0, reasons: {} };
     try {
-      if (bulk) for (const p of bulk) run3.write(p);
+      if (bulk) for (const p of bulk) run4.write(p);
       if (urls.length)
         await fetchProductPages(ctx, urls, {
           concurrency: IMPORT_CONCURRENCY,
           maxBytes: 15e5,
-          onEach: run3.write,
+          onEach: run4.write,
           stats,
           // A run that cannot finish still has to end. Generous enough for a
           // 2,200 page catalogue, which measures around sixteen minutes, and
@@ -7599,10 +7602,10 @@ async function runJob(deps, jobId, brandId, url, signal, only) {
         message: stoppedMessage(tally2.upserted),
         finished: true
       });
-      core.catalog.setSourceStatus(run3.sourceId, "partial", true);
+      core.catalog.setSourceStatus(run4.sourceId, "partial", true);
       return;
     }
-    run3.finish({
+    run4.finish({
       sweep,
       warnings,
       errors: pictureErrors,
@@ -7960,7 +7963,7 @@ async function edgeBarGeometry(buf) {
       mean[i] = m;
       sd[i] = Math.sqrt(v / cross);
     }
-    const run3 = (from, dir) => {
+    const run4 = (from, dir) => {
       let n = 0;
       for (let i = from; n < len * 0.2; i += dir, n++) {
         if (sd[i] >= 0.6 || Math.abs(mean[i] - mean[from]) >= 1) break;
@@ -7976,7 +7979,7 @@ async function edgeBarGeometry(buf) {
       const isd = probe.reduce((a, i) => a + sd[i], 0) / probe.length;
       return Math.abs(mean[from] - im) > 2 && isd < 5 ? n : 0;
     };
-    return { lo: run3(0, 1), hi: run3(len - 1, -1) };
+    return { lo: run4(0, 1), hi: run4(len - 1, -1) };
   };
   const cols = scan(W, H, (x, y) => data[y * W + x]);
   const rows = scan(H, W, (y, x) => data[y * W + x]);
@@ -8296,9 +8299,682 @@ function cancelSceneBuilds(brandId, sceneId) {
     if (b.brandId === brandId && b.sceneId === sceneId && !b.finished) cancelAssetBuild(b.id);
   }
 }
-var LOOPBACK = ["localhost", "127.0.0.1", "::1"];
+
+// src/network/codePage.ts
+var LOCKUP_PATHS = [
+  "M64 18.71V38.8L51.38 51.39V12.62H57.9C61.27 12.62 64 15.35 64 18.72V18.71Z",
+  "M12.62 12.62V51.39H6.1C2.73 51.39 0 48.66 0 45.29V25.2L12.62 12.61V12.62Z",
+  "M51.38 51.38L38.79 64H18.7C15.33 64 12.6 61.27 12.6 57.9V51.38H51.37H51.38Z",
+  "M12.62 12.62L25.2 0H45.29C48.66 0 51.39 2.73 51.39 6.1V12.62H12.62Z",
+  "M100.99 28.93L91.76 27.8C88.5 27.41 87.19 26.58 87.19 25.1C87.19 23.45 89.98 22.49 94.29 22.49C99.38 22.49 102.43 23.36 104.17 26.58L111.61 24.27C108.65 17.87 102.08 16 94.98 16C85.1 16 78.7 19.31 78.7 25.97C78.7 31.02 82.49 33.81 90.28 34.76L98.68 35.8C102.29 36.24 103.3 37.19 103.3 38.5C103.3 40.24 100.64 41.46 95.59 41.46C89.41 41.46 87.01 40.2 85.31 37.02L77.52 39.33C80.31 45.77 86.92 47.95 95.07 47.95C105.17 47.95 111.88 44.55 111.88 37.72C111.88 32.84 108.53 29.84 101 28.93H100.99Z",
+  "M132.73 22.66C137 22.66 140.87 24.01 142.7 28.54L150.49 26.67C148.79 20.66 142.3 16.05 132.6 16.05C121.41 16.05 113.44 22.23 113.44 31.98C113.44 41.73 121.41 48 132.6 48C142.31 48 148.8 43.3 150.49 37.29L142.7 35.42C140.87 39.95 137 41.3 132.73 41.3C126.94 41.3 122.24 38.38 122.24 32.42V31.55C122.24 25.59 126.94 22.67 132.73 22.67V22.66Z",
+  "M161.51 34.89H179.58V28.71H161.51V22.97H181.54V16.52H152.8V47.43H181.84V40.99H161.51V34.89Z",
+  "M208.71 33.85H208.67L193.86 16.52H184.94V47.43H193.04V27.49H193.08L210.15 47.43H216.81V16.52H208.71V33.85Z",
+  "M252.25 26.8C252.25 20.14 248.07 16.52 239.84 16.52H220.77V47.43H229.48V37.5H236.62L242.63 47.43H252.56L245.55 36.37C249.9 34.8 252.25 31.62 252.25 26.79V26.8ZM243.54 27.32C243.54 29.98 242.06 31.28 239.06 31.28H229.48V22.96H239.06C242.06 22.96 243.54 24.27 243.54 26.88V27.32Z",
+  "M263.79 16.52H255.08V47.43H263.79V16.52Z"
+];
+var CODE_PAGE_COPY = {
+  title: "Enter your code",
+  where: "Find it in Scenri on your computer, under Settings > Local access.",
+  label: "6-digit code",
+  open: "Open Scenri",
+  opening: "Opening\u2026",
+  foot: "Your code keeps Scenri private.",
+  wrong: "That code didn't work. Try again.",
+  locked: "Too many tries. Try again in a few minutes.",
+  short: "Enter all 6 digits.",
+  offline: "Can't reach Scenri. Check your Wi-Fi."
+};
+var esc = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+var symbolIcon = () => {
+  const svg = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64"><style>path{fill:#0a0a0a}@media(prefers-color-scheme:dark){path{fill:#f5f5f5}}</style>${LOCKUP_PATHS.slice(
+    0,
+    4
+  ).map((d) => `<path d="${d}"/>`).join("")}</svg>`;
+  return `data:image/svg+xml,${encodeURIComponent(svg)}`;
+};
+var STYLE = `
+:root {
+  color-scheme: light dark;
+  --page: #f6f6f6; --card: #ffffff; --ink: #0a0a0a; --on-ink: #ffffff; --soft: #666666; --faint: #767676;
+  --line: #e8e8e8; --field: #f4f4f4; --field-line: #e4e4e4; --ring: rgba(10, 10, 10, 0.08);
+  --off: #e6e6e6; --off-ink: #9a9a9a; --red: #d93025; --green: #188038;
+  --font: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
+}
+@media (prefers-color-scheme: dark) {
+  :root {
+    --page: #0d0d0d; --card: #141414; --ink: #f5f5f5; --on-ink: #0a0a0a; --soft: #9a9a9a; --faint: #858585;
+    --line: #262626; --field: #1a1a1a; --field-line: #2e2e2e; --ring: rgba(245, 245, 245, 0.1);
+    --off: #262626; --off-ink: #6e6e6e; --red: #ff6b62; --green: #4ade80;
+  }
+}
+* { box-sizing: border-box; }
+html { -webkit-text-size-adjust: 100%; text-size-adjust: 100%; }
+body {
+  margin: 0; background: var(--card); color: var(--ink);
+  font: 16px/1.45 var(--font); -webkit-font-smoothing: antialiased; -webkit-tap-highlight-color: transparent;
+}
+.shell {
+  min-height: 100vh; min-height: 100dvh; display: flex; flex-direction: column; align-items: center;
+  padding: max(44px, calc(env(safe-area-inset-top) + 28px)) max(24px, env(safe-area-inset-right))
+    max(28px, env(safe-area-inset-bottom)) max(24px, env(safe-area-inset-left));
+}
+.lockup { display: block; width: auto; height: 22px; margin: 0 0 40px; color: var(--ink); }
+.card { width: 100%; max-width: 380px; text-align: center; }
+h1 { margin: 0; font-size: 26px; line-height: 1.15; font-weight: 700; letter-spacing: -0.025em; }
+.where { margin: 10px auto 30px; max-width: 29ch; color: var(--soft); font-size: 15px; text-wrap: balance; }
+.vh {
+  position: absolute; width: 1px; height: 1px; margin: -1px; padding: 0; overflow: hidden;
+  clip: rect(0 0 0 0); white-space: nowrap; border: 0;
+}
+.otp { position: relative; }
+.slots {
+  display: grid; grid-template-columns: repeat(3, minmax(0, 1fr)) 12px repeat(3, minmax(0, 1fr));
+  gap: 8px; max-width: 344px; margin: 0 auto;
+}
+.slot {
+  position: relative; display: flex; align-items: center; justify-content: center; aspect-ratio: 4 / 5;
+  border: 1px solid var(--field-line); border-radius: 12px; background: var(--field);
+  font-size: 28px; font-weight: 600; line-height: 1; font-variant-numeric: tabular-nums; color: var(--ink);
+  transition: border-color 0.14s ease, box-shadow 0.14s ease, background-color 0.14s ease;
+}
+.slot[data-on] { border-color: var(--ink); box-shadow: 0 0 0 3px var(--ring); background: var(--card); }
+.slot[data-on]:empty::after {
+  content: ""; width: 2px; height: 28px; border-radius: 1px; background: var(--ink);
+  animation: blink 1.06s steps(1, end) infinite;
+}
+.sep { align-self: center; justify-self: center; width: 10px; height: 2px; border-radius: 1px; background: var(--field-line); }
+.otp[data-state="error"] .slot { border-color: var(--red); box-shadow: none; }
+.otp[data-state="error"] .slots { animation: shake 0.36s cubic-bezier(0.36, 0.07, 0.19, 0.97); }
+.otp[data-state="ok"] .slot { border-color: var(--green); }
+.otp[data-state="busy"] .slot { opacity: 0.55; }
+/* the real field, drawn by the boxes: transparent over them, so any box can be tapped */
+.js .otp input {
+  position: absolute; inset: 0; z-index: 1; width: 100%; height: 100%; margin: 0; padding: 0;
+  border: 0; outline: 0; background: transparent; color: transparent; -webkit-text-fill-color: transparent;
+  caret-color: transparent; font-size: 16px; text-indent: -9999px; cursor: text;
+  -webkit-appearance: none; appearance: none;
+}
+.js .otp input::selection { background: transparent; }
+.js .otp input:-webkit-autofill { transition: background-color 600000s 0s, color 600000s 0s; }
+/* without script: a plain field that still takes the code and submits */
+.nojs .slots { display: none; }
+.nojs .otp input {
+  display: block; width: 100%; max-width: 344px; height: 60px; margin: 0 auto; padding: 0 16px;
+  border: 1px solid var(--field-line); border-radius: 12px; background: var(--field); color: var(--ink);
+  font: 600 28px/1 var(--font); letter-spacing: 0.3em; text-align: center; font-variant-numeric: tabular-nums;
+}
+.msg { min-height: 20px; margin: 12px 0 16px; color: var(--red); font-size: 14px; line-height: 20px; }
+.go {
+  display: flex; align-items: center; justify-content: center; gap: 10px; width: 100%; max-width: 344px;
+  height: 52px; margin: 0 auto; border: 0; border-radius: 999px; background: var(--ink); color: var(--on-ink);
+  font: 600 16px/1 var(--font); letter-spacing: -0.01em; cursor: pointer; touch-action: manipulation;
+  transition: opacity 0.15s ease, transform 0.1s ease;
+}
+/* its own colours when it cannot be pressed yet, never a faded ink */
+.go:disabled { background: var(--off); color: var(--off-ink); cursor: default; }
+.otp[data-state="busy"] ~ .go:disabled, .otp[data-state="ok"] ~ .go:disabled { background: var(--ink); color: var(--on-ink); }
+.go:active:not(:disabled) { transform: scale(0.985); }
+.go:focus-visible { outline: 2px solid var(--ink); outline-offset: 3px; }
+.spin {
+  width: 16px; height: 16px; border: 2px solid currentColor; border-right-color: transparent; border-radius: 50%;
+  animation: spin 0.7s linear infinite;
+}
+/* one short line, centred with the page, the lock beside it; if large text
+   wraps it anyway, it wraps balanced and still centred */
+.foot {
+  max-width: 34ch; margin: 36px auto 0; color: var(--faint); font-size: 13px; line-height: 18px;
+  text-align: center; text-wrap: balance;
+}
+.foot svg { display: inline-block; width: 13px; height: 13px; margin-right: 6px; vertical-align: -2px; }
+@keyframes blink { 50% { opacity: 0; } }
+@keyframes spin { to { transform: rotate(360deg); } }
+@keyframes shake {
+  10%, 90% { transform: translateX(-1px); } 20%, 80% { transform: translateX(3px); }
+  30%, 50%, 70% { transform: translateX(-6px); } 40%, 60% { transform: translateX(6px); }
+}
+/* a phone with its keyboard up (Android resizes the page for it): everything moves up */
+@media (max-height: 560px) {
+  .shell { padding-top: max(20px, calc(env(safe-area-inset-top) + 12px)); }
+  .lockup { height: 18px; margin-bottom: 18px; }
+  h1 { font-size: 22px; }
+  .where { margin: 6px auto 18px; font-size: 14px; }
+  .foot { display: none; }
+}
+/* a tablet or a computer: the same content, on a card in the middle of the page */
+@media (min-width: 560px) and (min-height: 600px) {
+  body { background: var(--page); }
+  .shell { justify-content: center; padding-bottom: max(10vh, 28px); }
+  .lockup { margin-bottom: 32px; }
+  .card {
+    max-width: 420px; padding: 40px 36px 32px; border: 1px solid var(--line); border-radius: 20px;
+    background: var(--card); box-shadow: 0 1px 2px rgba(0, 0, 0, 0.04), 0 16px 40px -16px rgba(0, 0, 0, 0.14);
+  }
+  .foot { margin-top: 24px; }
+}
+@media (prefers-reduced-motion: reduce) {
+  .slot, .go { transition: none; }
+  .slot[data-on]:empty::after, .otp[data-state="error"] .slots { animation: none; }
+  .spin { animation-duration: 1.6s; }
+}
+@media (forced-colors: active) {
+  .slot { border-color: CanvasText; }
+  .slot[data-on] { outline: 2px solid Highlight; }
+}
+`;
+var SCRIPT = (copy) => `
+(function () {
+  var LEN = 6, COPY = ${JSON.stringify({ open: copy.open, opening: copy.opening, wrong: copy.wrong, locked: copy.locked, short: copy.short, offline: copy.offline })};
+  var form = document.getElementById('form'), input = document.getElementById('code');
+  var otp = document.getElementById('otp'), msg = document.getElementById('msg'), go = document.getElementById('go');
+  var slots = Array.prototype.slice.call(document.querySelectorAll('.slot'));
+  var busy = false;
+  input.maxLength = LEN;
+  function digits(s) { return String(s || '').replace(/\\D/g, '').slice(0, LEN); }
+  function fromPaste(s) { var m = /[?&]t=([^&#\\s]+)/.exec(s || ''); return digits(m ? m[1] : s); }
+  function toEnd() { var n = input.value.length; try { input.setSelectionRange(n, n); } catch (e) {} }
+  function paint() {
+    var v = input.value, on = document.activeElement === input && !busy;
+    for (var i = 0; i < LEN; i++) {
+      slots[i].textContent = v.charAt(i);
+      if (on && i === Math.min(v.length, LEN - 1)) slots[i].setAttribute('data-on', '');
+      else slots[i].removeAttribute('data-on');
+    }
+    go.disabled = busy || v.length !== LEN;
+  }
+  function state(s, text) {
+    otp.removeAttribute('data-state');
+    void otp.offsetWidth;
+    if (s) otp.setAttribute('data-state', s);
+    msg.textContent = text || '';
+    input.setAttribute('aria-invalid', s === 'error' ? 'true' : 'false');
+  }
+  function label(busyNow) {
+    go.textContent = busyNow ? COPY.opening : COPY.open;
+    if (!busyNow) return;
+    var s = document.createElement('span');
+    s.className = 'spin'; s.setAttribute('aria-hidden', 'true');
+    go.insertBefore(s, go.firstChild);
+  }
+  function fail(kind, clear) {
+    busy = false; label(false); state('error', COPY[kind]);
+    if (navigator.vibrate) navigator.vibrate(40);
+    if (clear) setTimeout(function () { input.value = ''; paint(); input.focus(); }, 420);
+    paint();
+  }
+  function submit() {
+    var code = digits(input.value);
+    if (busy) return;
+    if (code.length !== LEN) { state('error', COPY.short); input.focus(); return; }
+    busy = true; state('busy', ''); label(true); paint();
+    fetch('/api/phone?t=' + code, { headers: { accept: 'application/json' }, credentials: 'same-origin', cache: 'no-store' })
+      .then(function (res) {
+        if (res.ok) {
+          state('ok', '');
+          var u = new URL(location.href); u.searchParams.delete('t');
+          location.replace(u.pathname + u.search + u.hash);
+          return;
+        }
+        return res.json().catch(function () { return {}; }).then(function (b) {
+          fail(b && b.error === 'too many tries' ? 'locked' : 'wrong', true);
+        });
+      })
+      .catch(function () { fail('offline', false); });
+  }
+  input.addEventListener('input', function () {
+    var clean = digits(input.value);
+    if (clean !== input.value) input.value = clean;
+    if (otp.getAttribute('data-state') === 'error') state('', '');
+    toEnd(); paint();
+    if (clean.length === LEN) submit();
+  });
+  input.addEventListener('paste', function (e) {
+    var text = e.clipboardData ? e.clipboardData.getData('text') : '';
+    e.preventDefault();
+    input.value = fromPaste(text);
+    input.dispatchEvent(new Event('input', { bubbles: true }));
+  });
+  ['focus', 'blur', 'click', 'select', 'keyup'].forEach(function (t) {
+    input.addEventListener(t, function () { if (t !== 'blur') toEnd(); paint(); });
+  });
+  // a form will not submit itself while its button is disabled, so Enter is heard here
+  input.addEventListener('keydown', function (e) { if (e.key === 'Enter') { e.preventDefault(); submit(); } });
+  form.addEventListener('submit', function (e) { e.preventDefault(); submit(); });
+  window.addEventListener('pageshow', function (e) {
+    if (!e.persisted) return;
+    busy = false; input.value = ''; label(false); state('', ''); paint();
+  });
+  if (msg.textContent) state('error', msg.textContent);
+  paint();
+  input.focus();
+})();
+`;
+var LOCK = `<svg viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><rect x="3" y="7" width="10" height="7" rx="1.75"/><path d="M5.5 7V5.25a2.5 2.5 0 0 1 5 0V7"/></svg>`;
+function codePage(problem) {
+  const c = CODE_PAGE_COPY;
+  const note = problem ? c[problem] : "";
+  const slot = '<span class="slot"></span>';
+  return `<!doctype html>
+<html lang="en" class="nojs">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover, interactive-widget=resizes-content">
+<meta name="robots" content="noindex">
+<meta name="color-scheme" content="light dark">
+<meta name="theme-color" content="#ffffff" media="(prefers-color-scheme: light)">
+<meta name="theme-color" content="#0d0d0d" media="(prefers-color-scheme: dark)">
+<meta name="format-detection" content="telephone=no">
+<title>Scenri</title>
+<link rel="icon" href="${symbolIcon()}">
+<script>document.documentElement.className = 'js';</script>
+<style>${STYLE}</style>
+</head>
+<body>
+<main class="shell">
+<svg class="lockup" viewBox="0 0 263.79 64" fill="currentColor" role="img" aria-label="Scenri">${LOCKUP_PATHS.map((d) => `<path d="${d}"/>`).join("")}</svg>
+<section class="card" aria-labelledby="title">
+<h1 id="title">${esc(c.title)}</h1>
+<p class="where" id="where">${esc(c.where)}</p>
+<form id="form" method="get" action="" novalidate>
+<div class="otp" id="otp">
+<label class="vh" for="code">${esc(c.label)}</label>
+<input id="code" name="t" type="text" inputmode="numeric" pattern="[0-9]*" maxlength="7" autocomplete="one-time-code" enterkeyhint="go" autocapitalize="off" autocorrect="off" spellcheck="false" autofocus required aria-describedby="where msg" data-1p-ignore data-lpignore="true" data-bwignore data-form-type="other">
+<div class="slots" aria-hidden="true">${slot.repeat(3)}<span class="sep"></span>${slot.repeat(3)}</div>
+</div>
+<p class="msg" id="msg" role="alert">${esc(note)}</p>
+<button type="submit" class="go" id="go">${esc(c.open)}</button>
+</form>
+</section>
+<p class="foot">${LOCK}<span>${esc(c.foot)}</span></p>
+</main>
+<script>${SCRIPT(c)}</script>
+</body>
+</html>
+`;
+}
+
+// src/network/hosts.ts
+var LOOPBACK_NAMES = ["localhost", "127.0.0.1", "::1"];
+var isLoopbackName = (host) => LOOPBACK_NAMES.includes(host);
+var isWildcardHost = (host) => host === "0.0.0.0" || host === "::";
+var isLoopbackAddress = (addr) => !!addr && (addr === "::1" || addr.startsWith("127.") || addr.startsWith("::ffff:127."));
+function isIPv4Literal(host) {
+  const parts = host.split(".");
+  return !isWildcardHost(host) && parts.length === 4 && parts.every((p) => /^\d{1,3}$/.test(p) && Number(p) <= 255);
+}
+var VIRTUAL = /^(utun|tun|tap|ppp|ipsec|wg|zt|gif|stf|awdl|llw|anpi|bridge|docker|br-|veth|virbr|vmnet|vboxnet|lxc|lxd|cni|flannel|cali|tailscale)|virtual|vmware|hyper-v|vethernet|wsl|tailscale|zerotier|wireguard|openvpn|nordlynx|tap-windows|bluetooth|loopback/i;
+var PHYSICAL = /^(en\d|eth\d|wl|wlan|enp|eno|ens|wi-?fi|wlan|ethernet|wireless)/i;
+function octets(address) {
+  const parts = address.split(".");
+  if (parts.length !== 4) return null;
+  const nums = parts.map((p) => Number(p));
+  return nums.every((n, i) => /^\d{1,3}$/.test(parts[i]) && n >= 0 && n <= 255) ? nums : null;
+}
+function rangeRank(address) {
+  const o = octets(address);
+  if (!o) return null;
+  if (o[0] === 192 && o[1] === 168) return 0;
+  if (o[0] === 10) return 1;
+  if (o[0] === 172 && o[1] >= 16 && o[1] <= 31) return 2;
+  if (o[0] === 100 && o[1] >= 64 && o[1] <= 127) return 3;
+  return null;
+}
+var isIPv4 = (a) => a.family === "IPv4" || a.family === 4;
+function lanCandidates(ifaces, routeAddress = null) {
+  const found = [];
+  for (const [name, addrs] of Object.entries(ifaces)) {
+    if (VIRTUAL.test(name)) continue;
+    for (const a of addrs ?? []) {
+      if (!isIPv4(a) || a.internal) continue;
+      if (a.mac === "00:00:00:00:00:00" && !PHYSICAL.test(name)) continue;
+      const range = rangeRank(a.address);
+      if (range === null) continue;
+      found.push({ address: a.address, name, physical: PHYSICAL.test(name), range });
+    }
+  }
+  found.sort(
+    (a, b) => Number(b.address === routeAddress) - Number(a.address === routeAddress) || Number(b.physical) - Number(a.physical) || a.range - b.range || a.name.localeCompare(b.name) || a.address.localeCompare(b.address, void 0, { numeric: true })
+  );
+  return [...new Set(found.map((f) => f.address))];
+}
+function defaultRouteAddress() {
+  return new Promise((resolve) => {
+    let socket = null;
+    const done = (value) => {
+      try {
+        socket?.close();
+      } catch {
+      }
+      socket = null;
+      resolve(value);
+    };
+    try {
+      socket = createSocket("udp4");
+      socket.once("error", () => done(null));
+      socket.connect(9, "192.0.2.1", () => {
+        try {
+          done(socket?.address().address ?? null);
+        } catch {
+          done(null);
+        }
+      });
+      setTimeout(() => done(null), 500).unref();
+    } catch {
+      done(null);
+    }
+  });
+}
+async function phoneAddresses() {
+  let ifaces = {};
+  try {
+    ifaces = networkInterfaces();
+  } catch {
+    return [];
+  }
+  return lanCandidates(ifaces, await defaultRouteAddress());
+}
+function ownAddresses() {
+  const out = /* @__PURE__ */ new Set();
+  try {
+    for (const addrs of Object.values(networkInterfaces())) for (const a of addrs ?? []) out.add(a.address);
+  } catch {
+  }
+  return out;
+}
+var run = (cmd, args, opts) => new Promise((resolve, reject) => {
+  execFile(
+    cmd,
+    args,
+    { windowsHide: true, encoding: "utf8", timeout: opts?.timeout ?? 8e3 },
+    (err, stdout, stderr) => err ? reject(Object.assign(err, { stderr })) : resolve(stdout)
+  );
+});
+var SOCKETFILTERFW = "/usr/libexec/ApplicationFirewall/socketfilterfw";
+var PROMPT_MS = 18e4;
+async function macVerdict(nodePath, exec = run) {
+  const state = await exec(SOCKETFILTERFW, ["--getglobalstate"]);
+  if (/disabled|State = 0/i.test(state)) return "ok";
+  if (!/enabled|State = [12]/i.test(state)) return "unknown";
+  const all = await exec(SOCKETFILTERFW, ["--getblockall"]);
+  if (/block all state set to enabled|State = 2/i.test(all)) return "blocks-all";
+  const app = await exec(SOCKETFILTERFW, ["--getappblocked", nodePath]);
+  if (/is blocked/i.test(app)) return "blocked";
+  if (/is permitted/i.test(app)) return "ok";
+  return "unknown";
+}
+var ruleName = (port) => `Scenri-${port}`;
+var psQuote = (s) => `'${s.replace(/'/g, "''")}'`;
+function windowsScript(nodePath, port) {
+  return [
+    PS_UTF8,
+    "$ErrorActionPreference='SilentlyContinue';",
+    "$c=(Get-NetConnectionProfile | Where-Object { $_.IPv4Connectivity -ne 'Disconnected' } | Select-Object -First 1).NetworkCategory;",
+    `$n=if ($c -eq 'DomainAuthenticated') { 'Domain' } else { "$c" };`,
+    "$on=(Get-NetFirewallProfile -Name $n).Enabled;",
+    `$r=Get-NetFirewallApplicationFilter -Program ${psQuote(nodePath)} | Get-NetFirewallRule | Where-Object { $_.Enabled -eq 'True' -and $_.Direction -eq 'Inbound' };`,
+    "$b=@($r | Where-Object { $_.Action -eq 'Block' } | ForEach-Object { $_.Profile.ToString() }) -join ';';",
+    "$a=@($r | Where-Object { $_.Action -eq 'Allow' } | ForEach-Object { $_.Profile.ToString() }) -join ';';",
+    `$s=[bool](Get-NetFirewallRule -Name ${psQuote(ruleName(port))} | Where-Object { $_.Enabled -eq 'True' });`,
+    'Write-Output "$n|$on|$b|$a|$s"'
+  ].join(" ");
+}
+var covers = (profiles, profile) => profiles.split(";").filter(Boolean).some((p) => /\bAny\b/i.test(p) || p.split(",").some((x) => x.trim().toLowerCase() === profile.toLowerCase()));
+function parseWindows(out) {
+  const line = out.trim().split(/\r?\n/).pop() ?? "";
+  const [profile, on, block = "", allow = "", ours = ""] = line.split("|");
+  if (!profile || !["Public", "Private", "Domain"].includes(profile)) return "unknown";
+  if (/^false$/i.test(on ?? "")) return "ok";
+  if (covers(block, profile)) return "blocked";
+  if (/^true$/i.test(ours) || covers(allow, profile)) return "ok";
+  return "blocked";
+}
+function windowsAllowScript(nodePath, port) {
+  return [
+    "$ErrorActionPreference='Stop';",
+    "try {",
+    `Get-NetFirewallApplicationFilter -Program ${psQuote(nodePath)} -ErrorAction SilentlyContinue | Get-NetFirewallRule | Where-Object { $_.Direction -eq 'Inbound' -and $_.Action -eq 'Block' } | Remove-NetFirewallRule;`,
+    `Remove-NetFirewallRule -Name ${psQuote(ruleName(port))} -ErrorAction SilentlyContinue;`,
+    `New-NetFirewallRule -Name ${psQuote(ruleName(port))} -DisplayName 'Scenri (phones on this network)' -Direction Inbound -Action Allow -Protocol TCP -LocalPort ${port} -RemoteAddress LocalSubnet -Profile Any | Out-Null;`,
+    "exit 0",
+    "} catch { exit 1 }"
+  ].join(" ");
+}
+var encoded = (script) => Buffer.from(script, "utf16le").toString("base64");
+function windowsElevate(nodePath, port, env) {
+  const ps = powershellPath(env);
+  const inner = `'-NoProfile','-NonInteractive','-WindowStyle','Hidden','-EncodedCommand','${encoded(windowsAllowScript(nodePath, port))}'`;
+  return [
+    "-NoProfile",
+    "-NonInteractive",
+    "-Command",
+    `try { $p = Start-Process -FilePath ${psQuote(ps)} -Verb RunAs -Wait -PassThru -WindowStyle Hidden -ArgumentList ${inner}; exit $p.ExitCode } catch { exit 1223 }`
+  ];
+}
+var macAllowArgs = (nodePath) => [
+  "-e",
+  "on run argv",
+  "-e",
+  "set p to quoted form of item 1 of argv",
+  "-e",
+  `do shell script "${SOCKETFILTERFW} --add " & p & " && ${SOCKETFILTERFW} --unblockapp " & p with administrator privileges`,
+  "-e",
+  "end run",
+  nodePath
+];
+async function allowScenri(opts) {
+  const platform = opts.platform ?? process.platform;
+  const nodePath = opts.nodePath ?? process.execPath;
+  const exec = opts.exec ?? run;
+  const env = opts.env ?? process.env;
+  try {
+    if (platform === "darwin") {
+      await exec("/usr/bin/osascript", macAllowArgs(nodePath), { timeout: PROMPT_MS });
+      return "done";
+    }
+    if (platform === "win32") {
+      await exec(powershellPath(env), windowsElevate(nodePath, opts.port, env), { timeout: PROMPT_MS });
+      return "done";
+    }
+    return "unsupported";
+  } catch (err) {
+    const e = err;
+    const said = `${e.message ?? ""} ${e.stderr ?? ""}`;
+    if (e.code === 1223 || /\(-128\)|User cancel/i.test(said)) return "cancelled";
+    return "failed";
+  }
+}
+async function firewallVerdict(opts) {
+  const platform = opts.platform ?? process.platform;
+  const nodePath = opts.nodePath ?? process.execPath;
+  const exec = opts.exec ?? run;
+  try {
+    if (platform === "darwin") return await macVerdict(nodePath, exec);
+    if (platform === "win32") {
+      const out = await exec(powershellPath(opts.env ?? process.env), [
+        "-NoProfile",
+        "-NonInteractive",
+        "-Command",
+        windowsScript(nodePath, opts.port)
+      ]);
+      return parseWindows(out);
+    }
+  } catch {
+  }
+  return "unknown";
+}
+
+// src/network/phoneAccess.ts
+var CODE_ALPHABET = "0123456789";
+var CODE_LENGTH = 6;
+var CODE_SETTING = "access.code";
+var SYNC_MS = 3e4;
+function newCode() {
+  let out = "";
+  for (let i = 0; i < CODE_LENGTH; i++) out += CODE_ALPHABET[randomInt(CODE_ALPHABET.length)];
+  return out;
+}
+var normalizeCode = (s) => s.replace(/[\s-]/g, "").toUpperCase();
+var groupCode = (code) => `${code.slice(0, 3)} ${code.slice(3)}`;
+function deviceOf(ua) {
+  const s = ua ?? "";
+  if (/iPhone/i.test(s)) return "iPhone";
+  if (/iPad/i.test(s)) return "iPad";
+  if (/Android/i.test(s)) return /Mobile/i.test(s) ? "Android phone" : "Android tablet";
+  if (/Macintosh|Mac OS X/i.test(s)) return "Mac or iPad";
+  if (/Windows/i.test(s)) return "Windows computer";
+  if (/CrOS/i.test(s)) return "Chromebook";
+  if (/Linux/i.test(s)) return "computer";
+  return "device";
+}
+var FRESH_MS = 5e3;
+function listenWith(handler) {
+  return (address, port) => new Promise((resolve, reject) => {
+    const server = createServer(handler());
+    server.keepAliveTimeout = 72e3;
+    server.once("error", reject);
+    server.listen({ port, host: address, exclusive: true }, () => {
+      server.off("error", reject);
+      server.on("error", () => void 0);
+      resolve({
+        close: () => new Promise((done) => {
+          server.close(() => done());
+          server.closeAllConnections();
+        })
+      });
+    });
+  });
+}
+function createPhoneAccess(deps) {
+  const { store } = deps;
+  const bind = (deps.bind ?? "").trim();
+  const mode = !bind ? "listeners" : isLoopbackName(bind) ? "none" : isWildcardHost(bind) ? "wildcard" : "fixed";
+  const addresses = deps.addresses ?? phoneAddresses;
+  const own = deps.own ?? ownAddresses;
+  const now2 = deps.now ?? Date.now;
+  const listen = deps.listen ?? listenWith(deps.handler ?? (() => () => void 0));
+  const firewall = deps.firewall ?? ((p) => firewallVerdict({ port: p }));
+  const allowThrough = deps.allow ?? ((p) => allowScenri({ port: p }));
+  let code = store.getSetting(CODE_SETTING);
+  if (!code || !new RegExp(`^\\d{${CODE_LENGTH}}$`).test(normalizeCode(code))) {
+    code = newCode();
+    store.setSetting(CODE_SETTING, code);
+  }
+  let theCode = normalizeCode(code);
+  let port = null;
+  const open = /* @__PURE__ */ new Map();
+  let candidates = [];
+  let syncedAt = -Infinity;
+  let chain = Promise.resolve();
+  let timer = null;
+  let closed = false;
+  let lastVisit = null;
+  let verdict = null;
+  const syncOnce = async () => {
+    if (closed) return;
+    candidates = mode === "none" ? [] : mode === "fixed" ? [bind] : await addresses().catch(() => []);
+    syncedAt = now2();
+    if (mode !== "listeners" || port === null) return;
+    const want = new Set(candidates);
+    for (const [address, closer] of open) {
+      if (want.has(address)) continue;
+      open.delete(address);
+      await closer.close().catch(() => void 0);
+    }
+    for (const address of candidates) {
+      if (open.has(address) || closed) continue;
+      try {
+        open.set(address, await listen(address, port));
+      } catch {
+      }
+    }
+  };
+  const sync = () => {
+    chain = chain.then(syncOnce, syncOnce);
+    return chain;
+  };
+  const readFirewall = async () => {
+    if (port === null) return "unknown";
+    if (verdict && now2() - verdict.at < 2e4) return verdict.value;
+    const value = await firewall(port).catch(() => "unknown");
+    verdict = { at: now2(), value };
+    return value;
+  };
+  const reachable = () => mode === "listeners" ? candidates.filter((a) => open.has(a)) : candidates;
+  return {
+    get code() {
+      return theCode;
+    },
+    renew() {
+      theCode = newCode();
+      store.setSetting(CODE_SETTING, theCode);
+      return theCode;
+    },
+    async start(p) {
+      port = p;
+      await sync();
+      if (mode === "listeners" && !closed) {
+        timer = setInterval(() => void sync(), deps.syncMs ?? SYNC_MS);
+        timer.unref();
+      }
+    },
+    sync,
+    async close() {
+      closed = true;
+      if (timer) clearInterval(timer);
+      await chain.catch(() => void 0);
+      const all = [...open.values()];
+      open.clear();
+      await Promise.all(all.map((c) => c.close().catch(() => void 0)));
+    },
+    async status(thisComputer, fresh = false) {
+      if (fresh || now2() - syncedAt >= FRESH_MS) await sync();
+      const origins = port === null ? [] : reachable().map((a) => `http://${a.includes(":") ? `[${a}]` : a}:${port}`);
+      const address = origins[0] ?? null;
+      return {
+        reach: mode === "none" ? "this-computer" : "network",
+        thisComputer,
+        platform: deps.platform ?? process.platform,
+        address,
+        url: address ? `${address}/?t=${theCode}` : null,
+        code: theCode,
+        others: origins.slice(1),
+        problem: mode === "none" || port === null ? null : candidates.length === 0 ? "no-network" : origins.length === 0 ? "blocked" : null,
+        lastVisit
+      };
+    },
+    visit(remote, ua) {
+      const at = now2();
+      if (lastVisit && at - lastVisit.at < 1e3) return;
+      if (remote && own().has(remote.replace(/^::ffff:/, ""))) return;
+      lastVisit = { at, device: deviceOf(ua) };
+    },
+    firewall: readFirewall,
+    async allow() {
+      if (port === null) return { result: "unsupported", firewall: "unknown" };
+      const result = await allowThrough(port).catch(() => "failed");
+      verdict = null;
+      if (result === "done" && mode === "listeners") {
+        chain = chain.then(async () => {
+          const all = [...open.values()];
+          open.clear();
+          await Promise.all(all.map((c) => c.close().catch(() => void 0)));
+        });
+        await sync();
+      }
+      return { result, firewall: await readFirewall() };
+    }
+  };
+}
+
+// src/access.ts
 var ACCESS_COOKIE = "sc_access";
+var cookieName = (port) => port ? `${ACCESS_COOKIE}_${port}` : ACCESS_COOKIE;
 var LEGACY_ACCESS_COOKIE = "bt_access";
+var COOKIE_MAX_AGE_S = 400 * 24 * 60 * 60;
+var WRONG_LIMIT = 10;
+var WRONG_LIMIT_ALL = 100;
+var WRONG_WINDOW_MS = 10 * 6e4;
+var ADDRESSES_KEPT = 5e3;
 function hostnameOf(hostHeader) {
   if (!hostHeader) return null;
   const h = hostHeader.trim().toLowerCase();
@@ -8311,44 +8987,105 @@ function hostnameOf(hostHeader) {
   const colon = h.lastIndexOf(":");
   return colon === -1 ? h : h.slice(0, colon);
 }
-function tokenMatches(expected, supplied) {
-  if (!supplied) return false;
+function fromThisComputer(req) {
+  const host = hostnameOf(req.headers.host);
+  return !!host && isLoopbackName(host) && isLoopbackAddress(req.socket?.remoteAddress);
+}
+function codeMatches(expected, supplied) {
   const a = Buffer.from(expected);
-  const b = Buffer.from(supplied);
-  if (a.length !== b.length) return false;
-  return timingSafeEqual(a, b);
+  const b = Buffer.from(normalizeCode(supplied));
+  return a.length === b.length && timingSafeEqual(a, b);
 }
 function cookieValue(header, name) {
   for (const part of (header ?? "").split(";")) {
     const eq = part.indexOf("=");
     if (eq === -1) continue;
-    if (part.slice(0, eq).trim() === name) return decodeURIComponent(part.slice(eq + 1).trim());
+    if (part.slice(0, eq).trim() !== name) continue;
+    try {
+      return decodeURIComponent(part.slice(eq + 1).trim());
+    } catch {
+      return void 0;
+    }
   }
   return void 0;
 }
+function createLimiter(now2) {
+  const seen = /* @__PURE__ */ new Map();
+  let everyone = { since: now2(), wrong: /* @__PURE__ */ new Set() };
+  const live = (t) => now2() - t.since <= WRONG_WINDOW_MS;
+  const all = () => {
+    if (!live(everyone)) everyone = { since: now2(), wrong: /* @__PURE__ */ new Set() };
+    return everyone;
+  };
+  const entry = (ip) => {
+    const e = seen.get(ip);
+    if (e && live(e)) return e;
+    seen.delete(ip);
+    return null;
+  };
+  return {
+    locked: (ip) => all().wrong.size >= WRONG_LIMIT_ALL || (entry(ip)?.wrong.size ?? 0) >= WRONG_LIMIT,
+    wrong(ip, value) {
+      const v = normalizeCode(value);
+      all().wrong.add(v);
+      let e = entry(ip);
+      if (!e) {
+        e = { since: now2(), wrong: /* @__PURE__ */ new Set() };
+        seen.set(ip, e);
+      }
+      e.wrong.add(v);
+      if (seen.size > ADDRESSES_KEPT) {
+        for (const [k, t] of seen) if (!live(t)) seen.delete(k);
+        while (seen.size > ADDRESSES_KEPT) seen.delete(seen.keys().next().value);
+      }
+    }
+  };
+}
+function refuse(req, reply, problem) {
+  const accept = String(req.headers.accept ?? "");
+  const isPage = (req.method === "GET" || req.method === "HEAD") && (req.headers["sec-fetch-mode"] === "navigate" || accept.includes("text/html"));
+  if (isPage) {
+    return reply.status(403).header("content-type", "text/html; charset=utf-8").header("cache-control", "no-store").send(codePage(problem));
+  }
+  const error = problem === "locked" ? "too many tries" : problem === "wrong" ? "wrong code" : "access code required";
+  return reply.status(403).send({ error });
+}
 function registerAccessGuard(app, opts = {}) {
-  const allowed = /* @__PURE__ */ new Set([...LOOPBACK, ...(opts.allowedHosts ?? []).map((h) => h.trim().toLowerCase())]);
-  const { token } = opts;
+  const named = /* @__PURE__ */ new Set([...LOOPBACK_NAMES, ...(opts.allowedHosts ?? []).map((h) => h.trim().toLowerCase())]);
+  const limiter = createLimiter(opts.now ?? Date.now);
   app.addHook("onRequest", async (req, reply) => {
     const host = hostnameOf(req.headers.host);
-    if (!host || !allowed.has(host)) {
+    if (!host || !(named.has(host) || isIPv4Literal(host))) {
       return reply.status(403).send({ error: "forbidden host" });
     }
     if (req.headers["sec-fetch-site"] === "cross-site") {
       const isNavigation = req.headers["sec-fetch-mode"] === "navigate" && (req.method === "GET" || req.method === "HEAD");
       if (!isNavigation) return reply.status(403).send({ error: "cross-site request blocked" });
     }
-    if (!token) return;
+    const code = opts.code?.();
+    if (!code || fromThisComputer(req)) return;
+    const ip = req.socket?.remoteAddress ?? "";
     const q = req.query?.t;
-    const fromQuery = typeof q === "string" ? q : void 0;
+    const fromQuery = typeof q === "string" && q ? q : void 0;
     const header = req.headers["x-access-token"];
-    const supplied = fromQuery ?? (typeof header === "string" ? header : void 0) ?? cookieValue(req.headers.cookie, ACCESS_COOKIE) ?? cookieValue(req.headers.cookie, LEGACY_ACCESS_COOKIE);
-    if (!tokenMatches(token, supplied)) {
-      return reply.status(403).send({ error: "access token required" });
-    }
-    if (fromQuery) {
-      reply.header("set-cookie", `${ACCESS_COOKIE}=${encodeURIComponent(token)}; Path=/; HttpOnly; SameSite=Strict`);
+    const fromHeader = typeof header === "string" && header ? header : void 0;
+    const port = opts.port?.() ?? null;
+    const fromCookie = cookieValue(req.headers.cookie, cookieName(port)) ?? cookieValue(req.headers.cookie, ACCESS_COOKIE) ?? cookieValue(req.headers.cookie, LEGACY_ACCESS_COOKIE);
+    if (limiter.locked(ip)) return refuse(req, reply, "locked");
+    const supplied = [fromCookie, fromQuery, fromHeader].filter((v) => !!v);
+    if (supplied.some((v) => codeMatches(code, v))) {
+      if (fromQuery && codeMatches(code, fromQuery) && !(fromCookie && codeMatches(code, fromCookie))) {
+        reply.header(
+          "set-cookie",
+          `${cookieName(port)}=${encodeURIComponent(code)}; Path=/; Max-Age=${COOKIE_MAX_AGE_S}; HttpOnly; SameSite=Strict`
+        );
+      }
+      opts.onVisit?.(ip, req.headers["user-agent"]);
+      return;
     }
+    for (const v of supplied) limiter.wrong(ip, v);
+    if (supplied.length && limiter.locked(ip)) return refuse(req, reply, "locked");
+    return refuse(req, reply, fromQuery ? "wrong" : null);
   });
 }
 
@@ -9335,14 +10072,14 @@ async function seamResidual(image, plan, source) {
   const between = (a, b) => {
     const limit = horizontal ? W : H;
     if (a < 0 || b < 0 || a >= limit || b >= limit) return null;
-    const run3 = horizontal ? H : W;
+    const run4 = horizontal ? H : W;
     let sum = 0;
-    for (let i = 0; i < run3; i++) {
+    for (let i = 0; i < run4; i++) {
       const ia = (horizontal ? i * W + a : a * W + i) * ch;
       const ib = (horizontal ? i * W + b : b * W + i) * ch;
       sum += Math.abs(data[ia] - data[ib]) + Math.abs(data[ia + 1] - data[ib + 1]) + Math.abs(data[ia + 2] - data[ib + 2]);
     }
-    return sum / (run3 * 3);
+    return sum / (run4 * 3);
   };
   const near = horizontal ? plan.left : plan.top;
   const far = near + (horizontal ? source.width : source.height);
@@ -10344,13 +11081,13 @@ function beginRun(deps, id, view, chained) {
   });
 }
 function endRun(deps, id, view, aborted) {
-  const run3 = runs.get(id);
-  if (!run3 || run3.status !== "running") return;
+  const run4 = runs.get(id);
+  if (!run4 || run4.status !== "running") return;
   const rec = getPresenterDraft(deps.core, id);
   const error = view ? rec?.views[view].error : rec?.readError;
   const failed = !aborted && !!error && error !== "cancelled";
   runs.set(id, {
-    ...run3,
+    ...run4,
     view,
     finishedAt: (/* @__PURE__ */ new Date()).toISOString(),
     status: aborted ? "cancelled" : failed ? "failed" : "done",
@@ -11976,7 +12713,7 @@ function startSceneStudioJob(deps, input) {
   prune2(input.brandId);
   const ctrl = new AbortController();
   running4.set(job.id, ctrl);
-  const work = run(deps, job, { ...input, instruction, imageHashes: hashes, reading, ask }, ctrl.signal).finally(() => {
+  const work = run2(deps, job, { ...input, instruction, imageHashes: hashes, reading, ask }, ctrl.signal).finally(() => {
     running4.delete(job.id);
     tasks.delete(job.id);
   });
@@ -12017,7 +12754,7 @@ async function read(deps, job, input, signal) {
   if (!checked.ok) throw fail2(checked.error);
   return checked.reading;
 }
-async function run(deps, job, input, signal) {
+async function run2(deps, job, input, signal) {
   try {
     let reading = input.reading ?? null;
     if (input.kind !== "again") {
@@ -12280,7 +13017,7 @@ function createSceneExamples(deps) {
     if (gone && gone !== hashOf2(example.file)) deps.release([gone]);
     return wrote;
   };
-  async function run3(job, signal) {
+  async function run4(job, signal) {
     const engine = await deps.engine();
     if (!engine) throw new Error("Nothing can draw these right now. Connect Codex and try again.");
     const engineId = engine.capabilities().id;
@@ -12478,7 +13215,7 @@ function createSceneExamples(deps) {
     jobs2.set(k, job);
     const ctrl = new AbortController();
     controllers2.set(k, ctrl);
-    const task = run3(job, ctrl.signal).then(() => {
+    const task = run4(job, ctrl.signal).then(() => {
       job.status = ctrl.signal.aborted ? "cancelled" : job.failed.length && !job.done.length ? "failed" : "done";
       if (job.status === "failed") job.error = job.failed[0].error;
     }).catch((err) => {
@@ -12745,21 +13482,21 @@ function sceneWork(j) {
 }
 function presenterWork(core, brandId) {
   const out = [];
-  for (const run3 of presenterDraftRuns(brandId)) {
-    const rec = getPresenterDraft(core, run3.draftId);
+  for (const run4 of presenterDraftRuns(brandId)) {
+    const rec = getPresenterDraft(core, run4.draftId);
     if (!rec) continue;
     const wanted = rec.extras ? PRESENTER_VIEWS : CORE_VIEWS;
-    const view = run3.view;
+    const view = run4.view;
     out.push({
-      id: `presenter:${run3.draftId}:${run3.id}`,
+      id: `presenter:${run4.draftId}:${run4.id}`,
       kind: "presenter",
-      status: run3.status,
-      step: run3.status === "running" ? view ?? "reading" : view,
+      status: run4.status,
+      step: run4.status === "running" ? view ?? "reading" : view,
       name: rec.name,
       thumb: rec.views.portrait.hash ?? null,
-      startedAt: run3.startedAt,
-      finishedAt: run3.finishedAt,
-      error: run3.error,
+      startedAt: run4.startedAt,
+      finishedAt: run4.finishedAt,
+      error: run4.error,
       draftId: rec.id,
       presenterId: rec.presenterId ?? null,
       done: wanted.filter((v) => rec.views[v].status === "approved").length,
@@ -13196,6 +13933,25 @@ function registerImageRoutes(app, deps) {
 
 // src/release/notes.data.ts
 var RELEASES = [
+  {
+    version: "0.16.0",
+    date: "2026-09-24",
+    title: "Open Scenri on your phone or tablet, and Settings with one page for each thing.",
+    sections: [
+      {
+        heading: "Local access",
+        body: "Scenri now opens on a phone, tablet or another computer on the same Wi-Fi. Scan the QR code in Settings > Local access, or type the address and enter the six-digit code. The first start may ask whether Node can accept incoming connections; allow it, and if the firewall still stands in the way, Local access says so and, where it can, Allow Scenri fixes it through your computer's own prompt."
+      },
+      {
+        heading: "Security",
+        body: "Only devices with the code get in, and wrong guesses are slowed to a crawl. New code, on the computer running Scenri, signs every device out."
+      },
+      {
+        heading: "Settings",
+        body: "Providers, Appearance, Library, Local access, Updates and About each have their own page, and every delete sits under Danger zone. On a phone, a link to a Settings page opens that page."
+      }
+    ]
+  },
   {
     version: "0.15.1",
     date: "2026-09-23",
@@ -14158,13 +14914,16 @@ function isNewsworthy(entry) {
 // src/routes/updates.ts
 function registerUpdateRoutes(app, deps) {
   const { core, meta, updates, runtime } = deps;
-  app.get("/api/version", async () => ({
+  app.get("/api/version", async (req) => ({
     name: meta.name,
     version: meta.version,
     schema: SCHEMA_VERSION,
     installKind: runtime.installKind,
     supervised: runtime.supervised,
-    home: core.home
+    home: core.home,
+    // Settings hides what acts on this computer (its file manager, its
+    // desktop) from a phone that opened Scenri over the Wi-Fi
+    thisComputer: fromThisComputer(req)
   }));
   const ghSlug = repoSlug(meta.repository);
   const UNRELEASED = "0.0.0";
@@ -14356,7 +15115,8 @@ function registerSystemRoutes(app, deps) {
     const dbBytes = (await stat(dbPath).catch(() => null))?.size ?? 0;
     return { dir: core.home, dbPath, images: files, bytes: bytes + dbBytes };
   });
-  app.post("/api/system/reveal", async (_req, reply) => {
+  app.post("/api/system/reveal", async (req, reply) => {
+    if (!fromThisComputer(req)) return reply.status(403).send({ error: "Only on the computer running Scenri." });
     const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "explorer" : "xdg-open";
     try {
       spawn(cmd, [core.home], { detached: true, stdio: "ignore" }).unref();
@@ -14682,7 +15442,8 @@ function registerDesktopRoutes(app, deps) {
       installKind: runtime.installKind
     };
   });
-  app.post("/api/desktop/install", async (_req, reply) => {
+  app.post("/api/desktop/install", async (req, reply) => {
+    if (!fromThisComputer(req)) return reply.status(403).send({ error: "Only on the computer running Scenri." });
     if (runtime.installKind === "dev") {
       return reply.status(409).send({
         error: "Running from a source checkout; there is no installed build to put on a desktop.",
@@ -14716,6 +15477,32 @@ function registerDesktopRoutes(app, deps) {
   });
 }
 
+// src/routes/phone.ts
+function registerPhoneRoutes(app, deps) {
+  const { phone } = deps;
+  app.get(
+    "/api/phone",
+    async (req) => phone.status(fromThisComputer(req), req.query?.fresh === "1")
+  );
+  app.post("/api/phone/code", async (req, reply) => {
+    if (!fromThisComputer(req)) {
+      return reply.status(403).send({ error: "Change this on the computer running Scenri." });
+    }
+    phone.renew();
+    return reply.send(await phone.status(true));
+  });
+  app.get("/api/phone/help", async (req, reply) => {
+    if (!fromThisComputer(req)) return reply.send({ firewall: "unknown" });
+    return reply.send({ firewall: await phone.firewall() });
+  });
+  app.post("/api/phone/allow", async (req, reply) => {
+    if (!fromThisComputer(req)) {
+      return reply.status(403).send({ error: "Change this on the computer running Scenri." });
+    }
+    return reply.send(await phone.allow());
+  });
+}
+
 // src/server.ts
 function seedFor(sourceHash, width, height) {
   let h = 2166136261;
@@ -14730,7 +15517,22 @@ function buildServer(opts) {
   const { core, engines } = opts;
   const meta = readMeta();
   const app = Fastify({ logger: false });
-  registerAccessGuard(app, opts.access);
+  const phone = createPhoneAccess({ store: core.store, bind: opts.bind, handler: () => app.routing, ...opts.phone });
+  app.decorate("phone", phone);
+  app.addHook("onClose", async () => phone.close());
+  let port = null;
+  registerAccessGuard(app, {
+    ...opts.access,
+    code: () => phone.code,
+    port: () => {
+      if (port === null) {
+        const addr = app.server.address();
+        port = addr && typeof addr === "object" ? addr.port : null;
+      }
+      return port;
+    },
+    onVisit: (remote, ua) => phone.visit(remote, ua)
+  });
   const reserved = /* @__PURE__ */ new Map();
   const runningGenerations = /* @__PURE__ */ new Map();
   core.catalog.reconcileInterruptedJobs();
@@ -16302,6 +17104,7 @@ function buildServer(opts) {
     return drained;
   });
   registerSystemRoutes(app, { core, thumbs });
+  registerPhoneRoutes(app, { phone });
   registerGuideRoutes(app, { core, version: meta.version });
   registerDesktopRoutes(app, {
     core,
@@ -16330,24 +17133,26 @@ function withStoredAssets(sent, stored) {
   return out;
 }
 
+// src/banner.ts
+function localUrl(host, port, code) {
+  if (host === "::1") return `http://[::1]:${port}`;
+  if (isLoopbackName(host) || isWildcardHost(host)) return `http://127.0.0.1:${port}`;
+  return `http://${host.includes(":") ? `[${host}]` : host}:${port}/?t=${code}`;
+}
+function startLines(info) {
+  const lines = [`Scenri Studio \u2192 ${localUrl(info.host, info.port, info.phone?.code ?? "")}`];
+  if (info.phone?.address) lines.push(`on your phone \u2192 ${info.phone.address}  code ${groupCode(info.phone.code)}`);
+  lines.push(`data dir      \u2192 ${info.home}`, "Keep this window open while Scenri is running.");
+  if (!info.studioBuilt) lines.push("", "(studio UI not built, API only. Run: pnpm build)");
+  return lines;
+}
+
 // src/serve.ts
 var PORT = Number(process.env.SCENRI_PORT || 4747);
 var HOST = process.env.SCENRI_HOST || "127.0.0.1";
-var LOOPBACK2 = ["127.0.0.1", "localhost", "::1"];
-function lanAddresses() {
-  const out = [];
-  for (const addrs of Object.values(networkInterfaces())) {
-    for (const a of addrs ?? []) {
-      if (a.family === "IPv4" || a.family === 4) {
-        if (!a.internal) out.push(a.address);
-      }
-    }
-  }
-  return out;
-}
 async function serve() {
   try {
-    await run2();
+    await run3();
   } catch (err) {
     if (err instanceof SchemaTooNewError) {
       console.error(`
@@ -16358,7 +17163,7 @@ async function serve() {
     throw err;
   }
 }
-async function run2() {
+async function run3() {
   const core = createCore();
   const stubs = process.env.SCENRI_DEMO_ENGINE === "1" ? [createDemoEngine((b) => core.images.save(b), demoOptionsFromEnv(process.env))] : [];
   const engines = createEngineRegistry(core, stubs);
@@ -16373,16 +17178,15 @@ async function run2() {
   const studioDist = candidates.find((p) => existsSync(p));
   const supervised = process.env.SCENRI_SUPERVISED === "1";
   const installKind = detectInstallKind(fileURLToPath(import.meta.url), core.home);
-  const onlyThisMachine = LOOPBACK2.includes(HOST);
-  const token = onlyThisMachine ? void 0 : randomBytes(24).toString("base64url");
-  const reachableAt = onlyThisMachine ? [] : HOST === "0.0.0.0" || HOST === "::" ? lanAddresses() : [HOST];
+  const named = isLoopbackName(HOST) || isWildcardHost(HOST) || isIPv4Literal(HOST) ? [] : [HOST];
   const app = buildServer({
     core,
     engines,
     analyzer,
     sizeReader,
     studioDist,
-    access: { allowedHosts: reachableAt, token },
+    access: { allowedHosts: named },
+    bind: process.env.SCENRI_HOST,
     runtime: {
       installKind,
       supervised,
@@ -16451,32 +17255,26 @@ async function run2() {
   void repairPresenterCrops(core, (line) => console.log(line)).catch(() => void 0);
   app.updates.schedule();
   app.content.schedule();
-  const query = token ? `/?t=${token}` : "";
-  const localUrl = `http://127.0.0.1:${PORT}${query}`;
-  console.log(`
-  Scenri Studio \u2192 ${localUrl}`);
-  for (const ip of reachableAt) console.log(`  on your network \u2192 http://${ip}:${PORT}${query}`);
-  console.log(`  data dir        \u2192 ${core.home}`);
-  console.log("  Keep this window open while Scenri is running.\n");
-  if (!studioDist) console.log("  (studio UI not built, API only. Run: pnpm build)\n");
-  if (token) {
-    console.log("  Warning: the studio is reachable from your network.");
-    console.log("  Anyone who opens a link above can generate on your API keys and");
-    console.log("  delete your library. The token in the URL is the only thing gating");
-    console.log("  that, and it is new on every run.");
-    console.log("  For this machine only, unset SCENRI_HOST.\n");
-  }
+  const port = app.server.address()?.port ?? PORT;
+  await app.phone.start(port).catch(() => void 0);
+  const phone = await app.phone.status(true).catch(() => null);
+  const localUrl2 = localUrl(HOST, port, app.phone.code);
+  console.log("");
+  for (const line of startLines({ host: HOST, port, home: core.home, studioBuilt: !!studioDist, phone })) {
+    console.log(line ? `  ${line}` : "");
+  }
+  console.log("");
   if (process.env.SCENRI_NO_OPEN !== "1") {
     let told = false;
     const tellUrl = () => {
       if (told) return;
       told = true;
-      console.log(`  Open ${localUrl} in your browser.
+      console.log(`  Open ${localUrl2} in your browser.
 `);
     };
     try {
       const { default: open } = await import('open');
-      const child = await open(localUrl);
+      const child = await open(localUrl2);
       child.once("error", tellUrl);
       child.once("exit", (openExit) => {
         if (openExit !== null && openExit !== 0) tellUrl();