watcheroni 0.0.0-stage → 0.2.1

package/dist/watcheroni.mjs

@@ -0,0 +1,1838 @@
+#!/usr/bin/env node
+
+// src/main.ts
+import { spawn as spawn3 } from "node:child_process";
+import { parseArgs } from "node:util";
+
+// package.json
+var package_default = {
+  name: "watcheroni",
+  version: "0.2.1",
+  description: "Wait for, stream, or act on what happens to GitHub pull requests",
+  license: "MIT",
+  author: "paul cannon",
+  repository: {
+    type: "git",
+    url: "git+https://github.com/thepaul/watcheroni.git",
+    directory: "packages/cli"
+  },
+  homepage: "https://github.com/thepaul/watcheroni/tree/main/packages/cli#readme",
+  bugs: "https://github.com/thepaul/watcheroni/issues",
+  keywords: [
+    "github",
+    "pull-request",
+    "pr",
+    "ci",
+    "webhooks",
+    "notifications",
+    "cli",
+    "claude-code"
+  ],
+  type: "module",
+  bin: {
+    watcheroni: "dist/watcheroni.mjs"
+  },
+  files: [
+    "dist"
+  ],
+  engines: {
+    node: ">=22"
+  },
+  scripts: {
+    build: "esbuild src/main.ts --bundle --platform=node --format=esm --target=node22 --outfile=dist/watcheroni.mjs --banner:js='#!/usr/bin/env node'",
+    dev: "node src/main.ts",
+    typecheck: "tsc --noEmit",
+    test: "vitest run",
+    prepublishOnly: "npm run build"
+  },
+  devDependencies: {
+    "@types/node": "^24.19.2",
+    "@watcheroni/protocol": "*",
+    esbuild: "^0.28.2",
+    typescript: "^5.9.3",
+    vitest: "^4.1.12"
+  }
+};
+
+// src/config.ts
+import { readFileSync as readFileSync2 } from "node:fs";
+import { homedir } from "node:os";
+import { join as join2 } from "node:path";
+
+// src/github.ts
+import { execFileSync } from "node:child_process";
+var LoginNeeded = class extends Error {
+};
+var GitHubError = class extends Error {
+  status;
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+  }
+};
+var cached;
+function githubToken() {
+  if (cached) return cached;
+  const fromEnv = process.env.GH_TOKEN || process.env.GITHUB_TOKEN;
+  if (fromEnv) return cached = fromEnv;
+  try {
+    const out = execFileSync("gh", ["auth", "token"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    if (out) return cached = out;
+  } catch {
+  }
+  throw new LoginNeeded("No GitHub credentials: run `gh auth login`, or set GH_TOKEN or GITHUB_TOKEN.");
+}
+async function graphql(query, variables) {
+  const res = await fetch("https://api.github.com/graphql", {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${githubToken()}`,
+      "content-type": "application/json",
+      "user-agent": "watcheroni-cli"
+    },
+    body: JSON.stringify({ query, variables }),
+    signal: AbortSignal.timeout(3e4)
+  });
+  if (res.status === 401) throw new LoginNeeded("GitHub rejected the token: run `gh auth login`, or check GH_TOKEN.");
+  if (!res.ok) throw new GitHubError(`GitHub GraphQL: ${res.status} ${await res.text()}`, res.status);
+  const body = await res.json();
+  if (body.errors?.length) {
+    const notFound = body.errors.some((e) => e.type === "NOT_FOUND");
+    throw new GitHubError(body.errors.map((e) => e.message).join("; "), notFound ? 404 : 502);
+  }
+  return body.data;
+}
+
+// src/login.ts
+import { spawn } from "node:child_process";
+import { chmodSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { hostname } from "node:os";
+import { dirname, join } from "node:path";
+var DEFAULT_SERVER = "https://watcheroni.dev";
+var defaultDeps = {
+  fetch: (...args) => fetch(...args),
+  sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+  print: (line) => process.stderr.write(`${line}
+`),
+  now: () => Date.now(),
+  openUrl
+};
+function openUrl(url) {
+  if (!process.stderr.isTTY || process.env.SSH_CONNECTION || process.env.SSH_TTY || process.env.WATCHERONI_NO_BROWSER) return false;
+  const [cmd, ...args] = process.platform === "darwin" ? ["open", url] : process.platform === "win32" ? ["cmd", "/c", "start", "", url] : process.env.DISPLAY || process.env.WAYLAND_DISPLAY ? ["xdg-open", url] : [];
+  if (!cmd) return false;
+  try {
+    const child = spawn(cmd, args, { stdio: "ignore", detached: true });
+    child.on("error", () => {
+    });
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
+function serverUrl() {
+  return (serverSetting() || DEFAULT_SERVER).replace(/\/+$/, "");
+}
+function credentialsPath() {
+  if (process.env.WATCHERONI_CREDENTIALS) return process.env.WATCHERONI_CREDENTIALS;
+  return join(configDir(), "credentials.json");
+}
+function readCredentials(path = credentialsPath()) {
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    return { servers: parsed.servers ?? {} };
+  } catch {
+    return { servers: {} };
+  }
+}
+function writeCredentials(creds, path = credentialsPath()) {
+  mkdirSync(dirname(path), { recursive: true, mode: 448 });
+  const tmp = `${path}.${process.pid}.tmp`;
+  writeFileSync(tmp, JSON.stringify(creds, null, 2), { mode: 384 });
+  chmodSync(tmp, 384);
+  renameSync(tmp, path);
+}
+var LoginFailed = class extends Error {
+};
+async function login(server = serverUrl(), deps = defaultDeps) {
+  const { fetch: fetch2, print } = deps;
+  const metaRes = await fetch2(`${server}/v1/meta`);
+  if (!metaRes.ok) throw new LoginFailed(`${server}/v1/meta answered ${metaRes.status}`);
+  const meta = await metaRes.json();
+  if (!meta.github?.client_id) throw new LoginFailed(`${server} doesn't offer sign-in yet`);
+  const { client_id, web_url } = meta.github;
+  const token = await deviceFlow(web_url, client_id, deps);
+  const res = await fetch2(`${server}/v1/login`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ github_token: token.access_token, label: `watcheroni CLI on ${hostname()}` })
+  });
+  if (!res.ok) {
+    const problem = await res.json().catch(() => ({}));
+    throw new LoginFailed(`the server refused the login (${res.status}${problem.title ? `: ${problem.title}` : ""})`);
+  }
+  const body = await res.json();
+  const now = deps.now();
+  const entry = {
+    api_key: body.api_key,
+    key_id: body.key_id,
+    account: body.account,
+    github: {
+      access_token: token.access_token,
+      refresh_token: token.refresh_token ?? null,
+      expires_at: token.expires_in ? new Date(now + token.expires_in * 1e3).toISOString() : null,
+      refresh_token_expires_at: token.refresh_token_expires_in ? new Date(now + token.refresh_token_expires_in * 1e3).toISOString() : null
+    }
+  };
+  const creds = readCredentials();
+  creds.servers[server] = entry;
+  writeCredentials(creds);
+  print(`Signed in to ${server} as ${body.account.login}.`);
+  return entry;
+}
+async function logout(server = serverUrl(), deps = defaultDeps) {
+  const creds = readCredentials();
+  const entry = creds.servers[server];
+  if (!entry) {
+    deps.print(`Not signed in to ${server}.`);
+    return false;
+  }
+  try {
+    const res = await deps.fetch(`${server}/v1/keys/current`, {
+      method: "DELETE",
+      headers: { Authorization: `Bearer ${entry.api_key}` }
+    });
+    if (!res.ok && res.status !== 401) deps.print(`The server didn't revoke the key (${res.status}); forgetting it anyway.`);
+  } catch (e) {
+    deps.print(`Couldn't reach ${server} to revoke the key (${e.message}); forgetting it anyway.`);
+  }
+  delete creds.servers[server];
+  writeCredentials(creds);
+  deps.print(`Signed out of ${server}.`);
+  return true;
+}
+async function githubTokenFor(server, deps = defaultDeps) {
+  const github = readCredentials().servers[server]?.github;
+  if (!github?.access_token) return null;
+  const now = deps.now();
+  const expiresAt = github.expires_at ? Date.parse(github.expires_at) : Infinity;
+  if (expiresAt - now > TOKEN_MARGIN_MS) return github.access_token;
+  const refreshExpiresAt = github.refresh_token_expires_at ? Date.parse(github.refresh_token_expires_at) : Infinity;
+  if (!github.refresh_token || refreshExpiresAt <= now) return null;
+  let token;
+  try {
+    const res = await deps.fetch(`${server}/v1/github/refresh`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ refresh_token: github.refresh_token })
+    });
+    token = await res.json();
+  } catch {
+    return null;
+  }
+  if (typeof token.access_token !== "string") return null;
+  const creds = readCredentials();
+  const entry = creds.servers[server];
+  if (!entry) return token.access_token;
+  entry.github = {
+    access_token: token.access_token,
+    // GitHub rotates the refresh token on every use.
+    refresh_token: token.refresh_token ?? null,
+    expires_at: token.expires_in ? new Date(now + token.expires_in * 1e3).toISOString() : null,
+    refresh_token_expires_at: token.refresh_token_expires_in ? new Date(now + token.refresh_token_expires_in * 1e3).toISOString() : null
+  };
+  writeCredentials(creds);
+  return token.access_token;
+}
+var TOKEN_MARGIN_MS = 5 * 6e4;
+async function deviceFlow(webUrl, clientId, deps) {
+  const post = async (path, body) => {
+    const res = await deps.fetch(`${webUrl}${path}`, {
+      method: "POST",
+      headers: { Accept: "application/json", "content-type": "application/json" },
+      body: JSON.stringify(body)
+    });
+    if (!res.ok) throw new LoginFailed(`GitHub answered ${res.status} to ${path}`);
+    return res.json();
+  };
+  const code = await post("/login/device/code", { client_id: clientId });
+  if (typeof code.device_code !== "string") throw new LoginFailed(`GitHub didn't start the device flow: ${JSON.stringify(code)}`);
+  const uri = String(code.verification_uri);
+  deps.print(`Your one-time code: ${code.user_code}`);
+  deps.print(deps.openUrl(uri) ? `Opening ${uri} in your browser; enter the code there. (If it doesn't open, go there yourself.)` : `Open ${uri} and enter the code there.`);
+  deps.print("");
+  deps.print(`GitHub will ask whether watcheroni may "act on your behalf". That's its wording for`);
+  deps.print("every app sign-in. watcheroni can only read pull requests, reviews, checks, issues and");
+  deps.print("Actions runs, on repos it's installed on that you can see. It can't change anything,");
+  deps.print("and the server doesn't keep the token.");
+  deps.print("");
+  let interval = Number(code.interval ?? 5) * 1e3;
+  const deadline = deps.now() + Number(code.expires_in ?? 900) * 1e3;
+  while (deps.now() < deadline) {
+    await deps.sleep(interval);
+    const answer = await post("/login/oauth/access_token", {
+      client_id: clientId,
+      device_code: code.device_code,
+      grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+    });
+    if (typeof answer.access_token === "string") return answer;
+    switch (answer.error) {
+      case "authorization_pending":
+        continue;
+      case "slow_down":
+        interval = Number(answer.interval ?? interval / 1e3 + 5) * 1e3;
+        continue;
+      case "access_denied":
+        throw new LoginFailed("sign-in was cancelled on GitHub");
+      case "expired_token":
+        throw new LoginFailed("the code expired; run `watcheroni login` again");
+      default:
+        throw new LoginFailed(`GitHub: ${answer.error_description ?? answer.error ?? "unexpected answer"}`);
+    }
+  }
+  throw new LoginFailed("the code expired; run `watcheroni login` again");
+}
+
+// src/targets.ts
+import { execFileSync as execFileSync2 } from "node:child_process";
+var targetKey = (t) => `${t.owner}/${t.name}#${t.number}`;
+var repoKey = (t) => {
+  const kinds = [...new Set(t.kinds)].sort().join(",");
+  return `${t.owner}/${t.name} (${[kinds, t.base && `base ${t.base}`, t.author && `author ${t.author.toLowerCase()}`].filter(Boolean).join("; ")})`;
+};
+var isPr = (t) => "number" in t;
+var anyKey = (t) => isPr(t) ? targetKey(t) : repoKey(t);
+var UsageError = class extends Error {
+};
+function parseTarget(arg) {
+  const short = arg.match(/^([\w.-]+)\/([\w.-]+)#(\d+)$/);
+  const url = arg.match(/^https?:\/\/github\.com\/([\w.-]+)\/([\w.-]+)\/pull\/(\d+)(?:[/?#].*)?$/);
+  const m = short ?? url;
+  if (m) return { owner: m[1], name: m[2], number: Number(m[3]) };
+  const repo = arg.match(/^([\w.-]+)\/([\w.-]+)$/) ?? arg.match(/^https?:\/\/github\.com\/([\w.-]+)\/([\w.-]+?)\/?$/);
+  if (repo) return { owner: repo[1], name: repo[2] };
+  throw new UsageError(`${arg}: expected owner/repo#123, a pull request URL, or owner/repo`);
+}
+function remoteRepos(cwd = process.cwd()) {
+  let out;
+  try {
+    out = execFileSync2("git", ["remote", "-v"], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+  } catch {
+    return [];
+  }
+  const repos = /* @__PURE__ */ new Map();
+  for (const line of out.split("\n")) {
+    const m = line.match(/^(\S+)\s+(?:git@github\.com:|ssh:\/\/git@github\.com\/|https:\/\/github\.com\/)([\w.-]+)\/([\w.-]+?)(?:\.git)?\/?\s/);
+    if (m && !repos.has(`${m[2]}/${m[3]}`)) repos.set(`${m[2]}/${m[3]}`, { remote: m[1], owner: m[2], name: m[3] });
+  }
+  const rank = (r) => r === "upstream" ? 0 : r === "origin" ? 1 : 2;
+  return [...repos.values()].sort((a, b) => rank(a.remote) - rank(b.remote)).map(({ owner, name }) => ({ owner, name }));
+}
+async function currentBranchPr(cwd = process.cwd()) {
+  let branch = "";
+  try {
+    branch = execFileSync2("git", ["branch", "--show-current"], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+  } catch {
+  }
+  if (!branch) throw new UsageError("Not on a git branch; name a PR (owner/repo#123)");
+  const repos = remoteRepos(cwd);
+  if (!repos.length) throw new UsageError("No GitHub remote in this checkout; name a PR (owner/repo#123)");
+  for (const repo of repos) {
+    const data = await graphql(
+      `query($owner: String!, $name: String!, $branch: String!) {
+        repository(owner: $owner, name: $name) {
+          pullRequests(headRefName: $branch, states: OPEN, first: 1, orderBy: { field: CREATED_AT, direction: DESC }) { nodes { number } }
+        }
+      }`,
+      { ...repo, branch }
+    ).catch((e) => {
+      if (e instanceof LoginNeeded) throw e;
+      return null;
+    });
+    const number = data?.repository?.pullRequests.nodes[0]?.number;
+    if (number) return { ...repo, number };
+  }
+  throw new UsageError(`No open PR for branch ${branch} in ${repos.map((r) => `${r.owner}/${r.name}`).join(" or ")}`);
+}
+
+// src/config.ts
+function configDir() {
+  if (process.env.WATCHERONI_CONFIG_DIR) return process.env.WATCHERONI_CONFIG_DIR;
+  return join2(process.env.XDG_CONFIG_HOME || join2(homedir(), ".config"), "watcheroni");
+}
+function serverSetting() {
+  return process.env.WATCHERONI_SERVER ?? readJson(join2(configDir(), "config.json"))?.server;
+}
+function loadServer() {
+  const credentials = readCredentials();
+  const raw = serverSetting() ?? (credentials.servers[DEFAULT_SERVER] ? DEFAULT_SERVER : "");
+  if (!raw) return null;
+  let parsed;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    throw new UsageError(`${raw}: the server must be an http or https URL`);
+  }
+  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+    throw new UsageError(`${raw}: the server must be an http or https URL`);
+  }
+  const url = raw.replace(/\/+$/, "");
+  const apiKey = process.env.WATCHERONI_API_KEY || credentials.servers[url]?.api_key;
+  if (!apiKey) {
+    throw new LoginNeeded(`No API key for ${url}: run \`watcheroni login\`, or set WATCHERONI_API_KEY`);
+  }
+  return { url, apiKey };
+}
+function readJson(file) {
+  let text;
+  try {
+    text = readFileSync2(file, "utf8");
+  } catch {
+    return null;
+  }
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new UsageError(`${file} isn't valid JSON`);
+  }
+}
+
+// ../protocol/src/index.ts
+var INBOX_NAME = /^[A-Za-z0-9._-]{1,64}$/;
+function matchesKind(patterns, kind) {
+  if (!patterns.length || kind.startsWith("watch.")) return true;
+  return patterns.some((p) => p === "*" || p === kind || p.endsWith(".*") && kind.startsWith(p.slice(0, -1)));
+}
+var DEFAULT_TTL_SECONDS = 7 * 24 * 3600;
+var MAX_TTL_SECONDS = 30 * 24 * 3600;
+var PRIVATE_VERIFY_SECONDS = 7 * 24 * 3600;
+
+// src/diff.ts
+function initialMemory(s) {
+  const rollup = rollupOf(s);
+  return { rollup: rollup ? { head: s.head, result: rollup.result, data: JSON.stringify(rollup) } : null, conflict: s.mergeable === "CONFLICTING" };
+}
+var FAILED = /* @__PURE__ */ new Set(["failure", "timed_out", "action_required", "startup_failure"]);
+function diff(prev, next, memory) {
+  const events = [];
+  const full = next.repo.full_name;
+  const api = `https://api.github.com/repos/${full}`;
+  const emit = (kind, discriminator, data2, opts = {}) => {
+    const links = {};
+    if (opts.html) links.html = opts.html;
+    if (opts.api) links.api = opts.api;
+    events.push({
+      v: 1,
+      id: `local:${full}#${next.number}:${kind}:${discriminator}`,
+      sub: null,
+      kind,
+      at: opts.at ?? next.fetchedAt,
+      received_at: next.fetchedAt,
+      repo: next.repo,
+      pr: next.number,
+      actor: opts.actor ?? null,
+      data: data2,
+      links
+    });
+  };
+  const prLinks = { html: next.url, api: `${api}/pulls/${next.number}` };
+  if (next.head !== prev.head) emit("pr.pushed", next.head, { before: prev.head, after: next.head }, prLinks);
+  if (next.base !== prev.base) emit("pr.base_changed", `${next.base}:${next.fetchedAt}`, { from: prev.base, to: next.base }, prLinks);
+  if (prev.draft && !next.draft) emit("pr.ready_for_review", next.fetchedAt, {}, prLinks);
+  if (!prev.draft && next.draft) emit("pr.converted_to_draft", next.fetchedAt, {}, prLinks);
+  if (prev.state !== "OPEN" && next.state === "OPEN") emit("pr.reopened", next.fetchedAt, {}, prLinks);
+  for (const reviewer of next.requested) {
+    if (!prev.requested.includes(reviewer)) emit("pr.review_requested", `${reviewer}:${next.fetchedAt}`, { reviewer }, prLinks);
+  }
+  const prevReviews = new Map(prev.reviews.map((r) => [r.id, r]));
+  for (const r of next.reviews) {
+    const before = prevReviews.get(r.id);
+    const links = { actor: r.author, at: r.at, html: r.url, api: `${api}/pulls/${next.number}/reviews/${r.id}` };
+    if (!before && r.state !== "DISMISSED") {
+      emit("review.submitted", String(r.id), { review_id: r.id, state: r.state.toLowerCase(), has_body: !r.empty }, links);
+    } else if (before && before.state !== "DISMISSED" && r.state === "DISMISSED") {
+      emit("review.dismissed", String(r.id), { review_id: r.id }, { ...links, actor: null, at: null });
+    }
+  }
+  const prevComments = new Set(prev.reviewComments.map((c) => c.id));
+  for (const c of next.reviewComments) {
+    if (prevComments.has(c.id)) continue;
+    emit("review_comment.created", String(c.id), {
+      comment_id: c.id,
+      review_id: c.reviewId,
+      path: c.path,
+      line: c.line,
+      in_reply_to: c.inReplyTo
+    }, { actor: c.author, at: c.at, html: c.url, api: `${api}/pulls/comments/${c.id}` });
+  }
+  const prevThreads = new Map(prev.threads.map((t) => [t.id, t.resolved]));
+  for (const t of next.threads) {
+    const was = prevThreads.get(t.id);
+    if (was === void 0 || was === t.resolved) continue;
+    const kind = t.resolved ? "thread.resolved" : "thread.unresolved";
+    emit(kind, `${t.id}:${next.fetchedAt}`, {
+      thread_node_id: t.id,
+      path: t.path,
+      line: t.line,
+      comment_id: t.commentId
+    }, { html: next.url, api: t.commentId !== null ? `${api}/pulls/comments/${t.commentId}` : void 0 });
+  }
+  const prevIssueComments = new Set(prev.comments.map((c) => c.id));
+  for (const c of next.comments) {
+    if (prevIssueComments.has(c.id)) continue;
+    emit("comment.created", String(c.id), { comment_id: c.id }, { actor: c.author, at: c.at, html: c.url, api: `${api}/issues/comments/${c.id}` });
+  }
+  const prevChecks = new Map(next.head === prev.head ? prev.checks.map((c) => [c.key, c]) : []);
+  for (const c of next.checks) {
+    const before = prevChecks.get(c.key);
+    if (!isFailed(c) || before && isFailed(before) && before.conclusion === c.conclusion) continue;
+    const data2 = { head_sha: next.head, name: c.name, conclusion: c.conclusion };
+    if (c.checkRunId !== null) data2.check_run_id = c.checkRunId;
+    else data2.status_context = c.name;
+    if (c.workflowRunId !== null) data2.workflow_run_id = c.workflowRunId;
+    emit("check.failed", `${next.head}:${c.key}:${c.conclusion}`, data2, {
+      at: c.at,
+      html: c.url,
+      api: c.checkRunId !== null ? `${api}/check-runs/${c.checkRunId}` : void 0
+    });
+  }
+  for (const [runId, run2] of workflowRuns(next.checks)) {
+    const before = workflowRuns([...prevChecks.values()]).get(runId);
+    if (!run2.done || before?.done) continue;
+    emit("workflow.completed", String(runId), {
+      head_sha: next.head,
+      run_id: runId,
+      workflow: run2.workflow,
+      conclusion: run2.conclusion
+    }, { html: `https://github.com/${full}/actions/runs/${runId}`, api: `${api}/actions/runs/${runId}` });
+  }
+  let { rollup } = memory;
+  const now = rollupOf(next);
+  const data = now && JSON.stringify(now);
+  if (now && (rollup?.head !== next.head || rollup.result !== now.result || rollup.data !== void 0 && rollup.data !== data)) {
+    emit("checks.completed", `${next.head}:${now.result}:${next.fetchedAt}`, { head_sha: next.head, ...now }, prLinks);
+    rollup = { head: next.head, result: now.result, data };
+  }
+  let { conflict } = memory;
+  if (next.state === "OPEN" && next.mergeable === "CONFLICTING" && !conflict) {
+    emit("merge.conflict", `${next.head}:${next.baseSha}`, { head_sha: next.head, base_sha: next.baseSha }, prLinks);
+    conflict = true;
+  } else if (next.mergeable === "MERGEABLE" && conflict) {
+    emit("merge.clean", `${next.head}:${next.baseSha}`, { head_sha: next.head, base_sha: next.baseSha }, prLinks);
+    conflict = false;
+  }
+  if (prev.state === "OPEN" && next.state === "MERGED") {
+    emit("pr.merged", next.mergeSha ?? next.head, { merge_sha: next.mergeSha }, prLinks);
+    emit("watch.ended", "merged", { reason: "merged" }, prLinks);
+  } else if (prev.state === "OPEN" && next.state === "CLOSED") {
+    emit("pr.closed", next.fetchedAt, {}, prLinks);
+    emit("watch.ended", `closed:${next.fetchedAt}`, { reason: "closed" }, prLinks);
+  }
+  return { events, memory: { rollup, conflict } };
+}
+function isFailed(c) {
+  return c.done && c.conclusion !== null && FAILED.has(c.conclusion);
+}
+function rollupOf(s) {
+  if (!s.checks.length || s.checks.some((c) => !c.done)) return null;
+  const counts = { success: 0, failure: 0, cancelled: 0, skipped: 0, neutral: 0 };
+  const failed = [];
+  for (const c of s.checks) {
+    if (isFailed(c)) {
+      counts.failure++;
+      failed.push(c.name);
+    } else if (c.conclusion === "cancelled") counts.cancelled++;
+    else if (c.conclusion === "skipped" || c.conclusion === "stale") counts.skipped++;
+    else if (c.conclusion === "neutral") counts.neutral++;
+    else counts.success++;
+  }
+  const result = counts.failure ? "failure" : counts.cancelled ? "cancelled" : "success";
+  return { result, failed: failed.slice(0, 20), counts };
+}
+function workflowRuns(checks) {
+  const runs = /* @__PURE__ */ new Map();
+  for (const c of checks) {
+    if (c.workflowRunId === null) continue;
+    const run2 = runs.get(c.workflowRunId) ?? { workflow: c.workflow, done: true, conclusion: "success" };
+    run2.done &&= c.done;
+    if (isFailed(c)) run2.conclusion = "failure";
+    else if (c.conclusion === "cancelled" && run2.conclusion === "success") run2.conclusion = "cancelled";
+    runs.set(c.workflowRunId, run2);
+  }
+  return runs;
+}
+
+// src/snapshot.ts
+var QUERY = `
+query($owner: String!, $name: String!, $number: Int!) {
+  repository(owner: $owner, name: $name) {
+    databaseId
+    nameWithOwner
+    pullRequest(number: $number) {
+      number url state isDraft mergeable
+      headRefOid baseRefName baseRefOid
+      mergeCommit { oid }
+      reviewRequests(first: 50) { nodes { requestedReviewer { __typename ... on User { login } ... on Bot { login } ... on Team { slug } } } }
+      reviews(last: 100) { nodes { databaseId state body submittedAt url author { ...actor } } }
+      reviewThreads(last: 100) { nodes { id isResolved path line originalLine first: comments(first: 1) { nodes { databaseId } } comments(last: 100) { nodes {
+        databaseId path line originalLine createdAt url replyTo { databaseId } pullRequestReview { databaseId state } author { ...actor }
+      } } } }
+      comments(last: 100) { nodes { databaseId createdAt url author { ...actor } } }
+      commits(last: 1) { nodes { commit { oid statusCheckRollup { contexts(first: 100) { nodes {
+        __typename
+        ... on CheckRun { databaseId name status conclusion detailsUrl completedAt checkSuite { workflowRun { databaseId workflow { name } } } }
+        ... on StatusContext { context state targetUrl createdAt }
+      } } } } } }
+    }
+  }
+}
+fragment actor on Actor { __typename login ... on User { databaseId } ... on Bot { databaseId } }
+`;
+async function fetchSnapshot(target) {
+  const data = await graphql(QUERY, { owner: target.owner, name: target.name, number: target.number });
+  const repo = data.repository;
+  if (!repo?.pullRequest) throw new Error(`${target.owner}/${target.name}#${target.number}: no such pull request`);
+  return toSnapshot(repo.databaseId, repo.nameWithOwner, repo.pullRequest, (/* @__PURE__ */ new Date()).toISOString());
+}
+function toSnapshot(repoId, fullName, pr, fetchedAt) {
+  const commit = pr.commits.nodes[0]?.commit;
+  const contexts = commit?.oid === pr.headRefOid ? commit.statusCheckRollup?.contexts.nodes ?? [] : [];
+  return {
+    fetchedAt,
+    repo: { id: repoId, full_name: fullName },
+    number: pr.number,
+    url: pr.url,
+    state: pr.state,
+    draft: pr.isDraft,
+    mergeable: pr.mergeable,
+    head: pr.headRefOid,
+    base: pr.baseRefName,
+    baseSha: pr.baseRefOid,
+    mergeSha: pr.mergeCommit?.oid ?? null,
+    requested: pr.reviewRequests.nodes.flatMap(({ requestedReviewer: r }) => !r ? [] : r.__typename === "Team" ? [`team:${r.slug}`] : r.login ? [r.login] : []),
+    reviews: pr.reviews.nodes.filter((r) => r.state !== "PENDING").map((r) => ({
+      id: r.databaseId,
+      state: r.state,
+      empty: !r.body.trim(),
+      at: r.submittedAt,
+      url: r.url,
+      author: actor(r.author)
+    })),
+    reviewComments: pr.reviewThreads.nodes.flatMap((t) => t.comments.nodes).filter((c) => c.pullRequestReview?.state !== "PENDING").map((c) => ({
+      id: c.databaseId,
+      reviewId: c.pullRequestReview?.databaseId ?? null,
+      inReplyTo: c.replyTo?.databaseId ?? null,
+      path: c.path,
+      line: c.line ?? c.originalLine,
+      at: c.createdAt,
+      url: c.url,
+      author: actor(c.author)
+    })),
+    threads: pr.reviewThreads.nodes.map((t) => ({
+      id: t.id,
+      resolved: t.isResolved,
+      path: t.path,
+      line: t.line ?? t.originalLine,
+      commentId: t.first.nodes[0]?.databaseId ?? null
+    })),
+    comments: pr.comments.nodes.map((c) => ({ id: c.databaseId, at: c.createdAt, url: c.url, author: actor(c.author) })),
+    checks: contexts.map(toCheck)
+  };
+}
+function actor(a) {
+  return a ? { id: a.databaseId ?? 0, login: a.login, bot: a.__typename === "Bot" } : null;
+}
+function toCheck(c) {
+  if (c.__typename === "CheckRun") {
+    return {
+      key: `check_run:${c.databaseId}`,
+      name: c.name ?? "",
+      type: "check_run",
+      checkRunId: c.databaseId ?? null,
+      workflowRunId: c.checkSuite?.workflowRun?.databaseId ?? null,
+      workflow: c.checkSuite?.workflowRun?.workflow.name ?? null,
+      done: c.status === "COMPLETED",
+      conclusion: c.conclusion?.toLowerCase() ?? null,
+      url: c.detailsUrl ?? null,
+      at: c.completedAt ?? null
+    };
+  }
+  const state = c.state?.toLowerCase() ?? "pending";
+  const done = state !== "pending" && state !== "expected";
+  return {
+    key: `status:${c.context}`,
+    name: c.context ?? "",
+    type: "status",
+    checkRunId: null,
+    workflowRunId: null,
+    workflow: null,
+    done,
+    conclusion: done ? state === "success" ? "success" : "failure" : null,
+    url: c.targetUrl ?? null,
+    at: c.createdAt ?? null
+  };
+}
+
+// src/poll.ts
+async function pollOnce(inbox, log2, fetch2 = fetchSnapshot, all = true) {
+  const added = [];
+  for (const w of inbox.watched()) {
+    if (w.sub && !all) continue;
+    const key = `${w.target.owner}/${w.target.name}#${w.target.number}`;
+    let next;
+    try {
+      next = await fetch2(w.target);
+    } catch (e) {
+      if (e instanceof LoginNeeded) throw e;
+      if (e instanceof GitHubError && e.status === 404) {
+        log2(`${key}: no such pull request, or your GitHub login can't see it; no longer watching it`);
+        inbox.unwatch(key);
+        continue;
+      }
+      log2(`${key}: ${e.message}; trying again next time`);
+      continue;
+    }
+    if (!w.snapshot || !w.memory) {
+      inbox.update(key, next, initialMemory(next));
+      if (next.state !== "OPEN") {
+        const reason = next.state === "MERGED" ? "merged" : "closed";
+        added.push(...inbox.append([{
+          v: 1,
+          id: `local:${key}:watch.ended:${reason}`,
+          sub: null,
+          kind: "watch.ended",
+          at: next.fetchedAt,
+          received_at: next.fetchedAt,
+          repo: next.repo,
+          pr: next.number,
+          actor: null,
+          data: { reason },
+          links: { html: next.url }
+        }]));
+        inbox.unwatch(key);
+      } else {
+        inbox.save();
+      }
+      continue;
+    }
+    const { events, memory } = diff(w.snapshot, next, w.memory);
+    inbox.update(key, next, memory);
+    added.push(...inbox.append(events));
+    if (events.some((e) => e.kind === "watch.ended")) inbox.unwatch(key);
+  }
+  return added;
+}
+
+// src/feed.ts
+var Feed = class {
+  inbox;
+  server;
+  o;
+  hadTargets;
+  nextPoll = 0;
+  // Whether the server ended a repository-wide watch, for the footer.
+  repoEnded = false;
+  constructor(inbox, server, o) {
+    this.inbox = inbox;
+    this.server = server;
+    this.o = o;
+    this.hadTargets = inbox.watched().length + inbox.repoWatches().length > 0;
+  }
+  // Pending events that match, acknowledging the rest so they don't wait
+  // for ever.
+  wanted(kinds) {
+    this.check();
+    const items = [];
+    for (const source of this.server ? [this.server, this.inbox] : [this.inbox]) {
+      const pending = source.pending();
+      if (source === this.server) {
+        for (const e of pending) {
+          if (e.sub && e.kind.startsWith("watch.") && this.inbox.subscriptionEnded(e.sub, e.kind) === "repo") this.repoEnded = true;
+        }
+      }
+      const keep = pending.filter((e) => matchesKind(kinds, e.kind));
+      const skip = pending.filter((e) => !matchesKind(kinds, e.kind));
+      const firstKept = keep[0]?.seq ?? Infinity;
+      const skippable = skip.filter((e) => e.seq < firstKept).map((e) => e.seq);
+      if (skippable.length) source.ack(Math.max(...skippable));
+      if (!keep.length && skip.length) source.ack(Math.max(...skip.map((e) => e.seq)));
+      items.push(...keep.map((event) => ({ event, source })));
+    }
+    return items;
+  }
+  ack(items) {
+    const last = /* @__PURE__ */ new Map();
+    for (const { event, source } of items) last.set(source, Math.max(last.get(source) ?? 0, event.seq));
+    for (const [source, seq] of last) source.ack(seq);
+  }
+  // Polls GitHub for the targets watched from this machine. While the
+  // server is unreachable that includes those it was watching.
+  async poll() {
+    this.check();
+    await pollOnce(this.inbox, this.o.log, this.o.fetch, !this.server?.connected);
+    this.nextPoll = Date.now() + this.o.interval;
+  }
+  // Waits `ms`, collecting whatever arrives, then polls.
+  async settle(ms) {
+    await sleep(ms);
+    await this.poll();
+  }
+  // Waits up to `ms` for something new: returns early when the server
+  // sends events, and polls GitHub when a poll is due or the wait is over.
+  async more(ms) {
+    if (!this.server) {
+      await sleep(ms);
+      return this.poll();
+    }
+    const woke = await this.server.changed(Math.min(ms, Math.max(this.nextPoll - Date.now(), 0)));
+    this.check();
+    if (!woke || Date.now() >= this.nextPoll) await this.poll();
+  }
+  watching() {
+    return [...this.inbox.watched().map((w) => targetKey(w.target)), ...this.inbox.repoWatches().map((r) => repoKey(r.target))];
+  }
+  // Whether everything watched has ended. Without a server, that's when
+  // no PR is left. A server inbox may also be fed by subscriptions made
+  // elsewhere, which can't be listed yet, so it ends only when this
+  // command was watching PRs and they have all ended. A repository-wide
+  // watch has no end of its own, but only the server feeds it: without
+  // one it leaves nothing to wait for.
+  ended() {
+    if (this.inbox.watched().length || this.server && this.inbox.repoWatches().length) return false;
+    return this.server ? this.hadTargets : true;
+  }
+  check() {
+    if (this.server?.failure) throw this.server.failure;
+  }
+};
+var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+// src/format.ts
+var BODY = "--jq .body";
+function formatText(events, stillWatching, reading, repoEnded = false) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const e of events) {
+    const key = e.repo ? e.pr !== null ? `${e.repo.full_name}#${e.pr}` : e.repo.full_name : "other";
+    groups.set(key, [...groups.get(key) ?? [], e]);
+  }
+  const lines = [];
+  for (const [key, list] of groups) {
+    lines.push(`${key}: ${list.length} new event${list.length === 1 ? "" : "s"}`);
+    lines.push(...describeAll(list));
+    lines.push("");
+  }
+  lines.push(footer(stillWatching, reading, repoEnded));
+  return lines.join("\n");
+}
+function footer(stillWatching, reading, repoEnded = false) {
+  if (!stillWatching.length && reading) return `Still reading inbox ${reading}. Run \`watcheroni wait\` again to keep watching.`;
+  if (!stillWatching.length && repoEnded) return "Nothing is left to watch: the server's watch on the repository has ended.";
+  if (!stillWatching.length) return "Nothing is left to watch: every watched PR has been merged or closed.";
+  const what = stillWatching.length === 1 && stillWatching[0].includes("#") ? `${stillWatching[0]} is still open` : `Still watching ${stillWatching.join(", ")}`;
+  return `${what}. Run \`watcheroni wait\` again to keep watching.`;
+}
+function describeAll(events) {
+  const lines = [];
+  const byReview = /* @__PURE__ */ new Map();
+  for (const e of events) {
+    const reviewId = e.data.review_id;
+    if (e.kind === "review_comment.created" && typeof reviewId === "number") {
+      byReview.set(reviewId, [...byReview.get(reviewId) ?? [], e]);
+    }
+  }
+  const shownReviews = /* @__PURE__ */ new Set();
+  for (const e of events) {
+    const reviewId = typeof e.data.review_id === "number" ? e.data.review_id : null;
+    if (e.kind === "review_comment.created" && reviewId !== null && (byReview.get(reviewId)?.length ?? 0) > 1) {
+      if (shownReviews.has(reviewId)) continue;
+      shownReviews.add(reviewId);
+      const comments = byReview.get(reviewId);
+      const where = comments.map((c) => location(c.data) || "?");
+      lines.push(`- ${comments.length} review comments${by(e)} on ${where.join(", ")}`);
+      lines.push(`  gh api ${repoPath(e)}/pulls/${e.pr}/comments --paginate --jq '.[] | select(.pull_request_review_id == ${reviewId}) | "\\(.path)\\(.line // .original_line | if . then ":\\(.)" else "" end) \\(.body)"'`);
+      continue;
+    }
+    if (e.kind === "review.submitted" && reviewId !== null && e.data.state === "commented" && e.data.has_body === false) {
+      const comments = byReview.get(reviewId) ?? [];
+      if (comments.length && comments.every((c) => c.data.in_reply_to)) continue;
+    }
+    const [text, command] = describe(e);
+    lines.push(`- ${text}`);
+    if (command) lines.push(`  ${command}`);
+  }
+  return lines;
+}
+function describe(e) {
+  const d = e.data;
+  const repo = repoPath(e);
+  const short = (sha) => typeof sha === "string" ? sha.slice(0, 7) : "?";
+  switch (e.kind) {
+    case "review.submitted":
+      return [`review.submitted${by(e)}: ${d.state}`, `gh api ${repo}/pulls/${e.pr}/reviews/${d.review_id} --jq '.state, .body'`];
+    case "review.dismissed":
+      return [`review.dismissed: review ${d.review_id}`, null];
+    case "review_comment.created": {
+      const where = d.path ? ` on ${location(d)}` : "";
+      const reply = d.in_reply_to ? " (a reply)" : "";
+      return [`review_comment.created${by(e)}${where}${reply}`, `gh api ${repo}/pulls/comments/${d.comment_id} ${BODY}`];
+    }
+    case "comment.created":
+      return [`comment.created${by(e)}`, `gh api ${repo}/issues/comments/${d.comment_id} ${BODY}`];
+    case "thread.resolved":
+    case "thread.unresolved": {
+      const where = d.path ? ` on ${location(d)}` : "";
+      return [`${e.kind}${by(e)}${where}`, typeof d.comment_id === "number" ? `gh api ${repo}/pulls/comments/${d.comment_id} ${BODY}` : null];
+    }
+    case "check.failed": {
+      const command = typeof d.workflow_run_id === "number" ? `gh run view ${d.workflow_run_id} -R ${e.repo?.full_name} --log-failed` : typeof d.check_run_id === "number" ? `gh api ${repo}/check-runs/${d.check_run_id}` : e.links.html ?? null;
+      return [`check.failed: "${d.name}" (${d.conclusion}) on ${short(d.head_sha)}`, command];
+    }
+    case "checks.completed": {
+      const failed = Array.isArray(d.failed) && d.failed.length ? `; failed: ${d.failed.join(", ")}` : "";
+      return [`checks.completed on ${short(d.head_sha)}: ${d.result}${failed}`, failed ? `gh pr checks ${e.pr} -R ${e.repo?.full_name}` : null];
+    }
+    case "workflow.completed":
+      return [`workflow.completed: "${d.workflow}" ${d.conclusion}`, d.conclusion === "success" ? null : `gh run view ${d.run_id} -R ${e.repo?.full_name} --log-failed`];
+    case "merge.conflict":
+      return [`merge.conflict with the base branch (head ${short(d.head_sha)}, base ${short(d.base_sha)})`, null];
+    case "merge.clean":
+      return ["merge.clean: the conflict is gone", null];
+    case "pr.pushed":
+      return [`pr.pushed: ${short(d.before)} -> ${short(d.after)}`, null];
+    case "pr.base_changed":
+      return [`pr.base_changed: ${d.from} -> ${d.to}`, null];
+    case "pr.review_requested":
+      return [`pr.review_requested: ${d.reviewer}`, null];
+    case "pr.merged":
+      return [`pr.merged as ${short(d.merge_sha)}`, null];
+    case "watch.ended":
+      return [`watch.ended: the PR was ${d.reason}`, null];
+    // A repository-wide watch (no PR) isn't polled from here when it ends.
+    case "watch.expired":
+      return [e.pr === null ? "watch.expired: the server stopped watching after a week with nobody reading the inbox; name the repository again to keep watching" : "watch.expired: the server stopped watching after a week with nobody reading the inbox; watching it from this machine now", null];
+    case "watch.unverified":
+      return [d.reason === "access_denied" ? "watch.unverified: your GitHub login can no longer read this repo" : `watch.unverified: the server's access check lapsed; run \`watcheroni login\`, then name the ${e.pr === null ? "repository" : "PR"} again`, null];
+    case "watch.revoked":
+      return ["watch.revoked: the watcheroni App lost access to this repo", null];
+    case "inbox.gap":
+      return [`inbox.gap: events after ${d.missed_after} were dropped before they were read; check the watched PRs on GitHub`, null];
+    default:
+      return [`${e.kind}${by(e)}`, e.links.api ? `gh api ${e.links.api.replace("https://api.github.com/", "")}` : null];
+  }
+}
+function location(d) {
+  return d.path ? `${d.path}${d.line ? `:${d.line}` : ""}` : "";
+}
+function by(e) {
+  return e.actor ? ` by ${e.actor.login}` : "";
+}
+function repoPath(e) {
+  return `repos/${e.repo?.full_name ?? "?"}`;
+}
+
+// src/inbox.ts
+import { closeSync, mkdirSync as mkdirSync2, openSync, readFileSync as readFileSync3, renameSync as renameSync2, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import { join as join3 } from "node:path";
+var SEEN_KEPT = 2e3;
+var InboxBusy = class extends Error {
+};
+function stateDir() {
+  if (process.env.WATCHERONI_STATE_DIR) return process.env.WATCHERONI_STATE_DIR;
+  return join3(process.env.XDG_STATE_HOME || join3(homedir2(), ".local", "state"), "watcheroni");
+}
+var Inbox = class _Inbox {
+  name;
+  file;
+  lockFile;
+  state;
+  constructor(name, dir) {
+    this.name = name;
+    this.file = join3(dir, `${name}.json`);
+    this.lockFile = join3(dir, `${name}.lock`);
+    this.state = this.load();
+  }
+  // Opens the inbox, holding its lock until close() or process exit.
+  static open(name) {
+    if (!INBOX_NAME.test(name)) throw new UsageError(`${name}: inbox names are 1-64 letters, digits, '.', '_' or '-'`);
+    const dir = join3(stateDir(), "inboxes");
+    mkdirSync2(dir, { recursive: true });
+    lock(join3(dir, `${name}.lock`), name);
+    const inbox = new _Inbox(name, dir);
+    process.once("exit", () => inbox.close());
+    return inbox;
+  }
+  // Reads an inbox without locking it, for `ls`.
+  static peek(name) {
+    const inbox = new _Inbox(name, join3(stateDir(), "inboxes"));
+    return { watched: inbox.watched(), repos: inbox.repoWatches(), pending: inbox.state.events.length };
+  }
+  close() {
+    try {
+      unlinkSync(this.lockFile);
+    } catch {
+    }
+  }
+  watched() {
+    return Object.values(this.state.watched);
+  }
+  repoWatches() {
+    return Object.values(this.state.repos ?? {});
+  }
+  // Records (or updates) a repository-wide watch. False if it's new.
+  watchRepo(key, target, sub) {
+    const repos = this.state.repos ??= {};
+    const known = !!repos[key];
+    repos[key] = { target, addedAt: repos[key]?.addedAt ?? (/* @__PURE__ */ new Date()).toISOString(), sub };
+    this.save();
+    return known;
+  }
+  // Forgets every repository-wide watch on `owner/name`, returning them.
+  unwatchRepo(owner, name) {
+    const gone = Object.entries(this.state.repos ?? {}).filter(([, r]) => r.target.owner === owner && r.target.name === name);
+    for (const [key] of gone) delete this.state.repos[key];
+    if (gone.length) this.save();
+    return gone.map(([, r]) => r);
+  }
+  watch(key, target, sub = null) {
+    if (this.state.watched[key]) return false;
+    this.state.watched[key] = { target, addedAt: (/* @__PURE__ */ new Date()).toISOString(), snapshot: null, memory: null, ...sub ? { sub } : {} };
+    this.save();
+    return true;
+  }
+  unwatch(key) {
+    if (!this.state.watched[key]) return false;
+    delete this.state.watched[key];
+    this.save();
+    return true;
+  }
+  // Records the server's subscription, or that it declined (null).
+  setSubscription(key, sub) {
+    const w = this.state.watched[key];
+    if (!w) return;
+    if (sub) {
+      w.sub = sub;
+      delete w.subTriedAt;
+    } else {
+      w.subTriedAt = (/* @__PURE__ */ new Date()).toISOString();
+    }
+    this.save();
+  }
+  // The server ended a subscription with a `watch.*` event. A PR that
+  // merged, closed or expired is no longer watched; one whose watch was
+  // revoked (the App uninstalled, say) or not re-verified is polled from
+  // here instead. Returns "repo" when it was a repository-wide watch.
+  subscriptionEnded(sub, kind) {
+    const repo = Object.entries(this.state.repos ?? {}).find(([, r]) => r.sub === sub);
+    if (repo) {
+      delete this.state.repos[repo[0]];
+      this.save();
+      return "repo";
+    }
+    const entry = Object.entries(this.state.watched).find(([, w2]) => w2.sub === sub);
+    if (!entry) return null;
+    const [key, w] = entry;
+    if (kind === "watch.revoked" || kind === "watch.unverified" || kind === "watch.expired") delete w.sub;
+    else delete this.state.watched[key];
+    this.save();
+    return "pr";
+  }
+  update(key, snapshot, memory) {
+    const w = this.state.watched[key];
+    if (w) Object.assign(w, { snapshot, memory });
+  }
+  // Numbers and saves new events, dropping any seen before.
+  append(events) {
+    const added = [];
+    const seen = new Set(this.state.seen);
+    for (const e of events) {
+      if (seen.has(e.id)) continue;
+      seen.add(e.id);
+      this.state.seen.push(e.id);
+      const event = { ...e, seq: ++this.state.seq };
+      this.state.events.push(event);
+      added.push(event);
+    }
+    this.state.seen = this.state.seen.slice(-SEEN_KEPT);
+    this.save();
+    return added;
+  }
+  pending() {
+    return [...this.state.events];
+  }
+  ack(seq) {
+    this.state.events = this.state.events.filter((e) => e.seq > seq);
+    this.state.acked = Math.max(this.state.acked, seq);
+    this.save();
+  }
+  save() {
+    const tmp = `${this.file}.${process.pid}.tmp`;
+    writeFileSync2(tmp, JSON.stringify(this.state, null, 1));
+    renameSync2(tmp, this.file);
+  }
+  load() {
+    try {
+      return JSON.parse(readFileSync3(this.file, "utf8"));
+    } catch {
+      return { version: 1, seq: 0, acked: 0, events: [], seen: [], watched: {} };
+    }
+  }
+};
+function lock(file, name) {
+  for (let attempt = 0; attempt < 2; attempt++) {
+    try {
+      const fd = openSync(file, "wx");
+      writeFileSync2(fd, String(process.pid));
+      closeSync(fd);
+      return;
+    } catch (e) {
+      if (e.code !== "EEXIST") throw e;
+    }
+    const pid = Number(readFileSync3(file, "utf8"));
+    if (pid && alive(pid)) {
+      throw new InboxBusy(`Inbox ${name} is in use by process ${pid}, another wait, stream or exec; stop it, or use another inbox with --inbox`);
+    }
+    unlinkSync(file);
+  }
+  throw new InboxBusy(`Couldn't lock inbox ${name}`);
+}
+function alive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (e) {
+    return e.code === "EPERM";
+  }
+}
+
+// src/selfhost.ts
+import { spawn as spawn2 } from "node:child_process";
+import { existsSync } from "node:fs";
+import { dirname as dirname2, join as join4 } from "node:path";
+var SCRIPT = join4("packages", "server", "selfhost", "run.mjs");
+function findSelfhost(from) {
+  for (let dir = from; ; dir = dirname2(dir)) {
+    if (existsSync(join4(dir, SCRIPT))) return join4(dir, SCRIPT);
+    if (dirname2(dir) === dir) return null;
+  }
+}
+function selfhost(args, cwd = process.cwd()) {
+  const script = findSelfhost(cwd);
+  if (!script) {
+    throw new UsageError(
+      "selfhost runs from a clone of watcheroni, which has the server to deploy:\n  git clone https://github.com/thepaul/watcheroni && cd watcheroni && npm install\n  npm run selfhost"
+    );
+  }
+  return new Promise((resolve) => {
+    const child = spawn2(process.execPath, [script, ...args], { stdio: "inherit" });
+    child.on("error", () => resolve(1));
+    child.on("close", (code, signal) => resolve(code ?? (signal ? 128 : 1)));
+  });
+}
+
+// src/server.ts
+var Unreachable = class extends Error {
+};
+var ServerError = class extends Error {
+  status;
+  code;
+  // The whole problem document, for fields such as `install_url`.
+  problem;
+  constructor(message, status, code, problem = {}) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.problem = problem;
+  }
+};
+var GITHUB_TOKEN_CODES = /* @__PURE__ */ new Set(["github_token_required", "github_token_invalid"]);
+var SUBPROTOCOL = "watcheroni.v1";
+var WAIT_SECONDS = 300;
+var ServerClient = class {
+  url;
+  apiKey;
+  constructor(config) {
+    this.url = config.url;
+    this.apiKey = config.apiKey;
+  }
+  async request(method, path, o = {}) {
+    const timeout = AbortSignal.timeout(o.timeoutMs ?? 3e4);
+    let res;
+    try {
+      res = await fetch(this.url + path, {
+        method,
+        headers: {
+          Authorization: `Bearer ${this.apiKey}`,
+          "user-agent": `watcheroni-cli/${package_default.version}`,
+          ...o.body === void 0 ? {} : { "content-type": "application/json" },
+          ...o.headers
+        },
+        body: o.body === void 0 ? void 0 : JSON.stringify(o.body),
+        signal: o.signal ? AbortSignal.any([o.signal, timeout]) : timeout
+      });
+    } catch (e) {
+      if (o.signal?.aborted) throw e;
+      const cause = e.cause;
+      throw new Unreachable(`can't reach ${this.url}: ${cause?.message ?? e.message}`);
+    }
+    if (res.status === 204) return void 0;
+    if (res.ok) return await res.json();
+    const problem = await res.json().catch(() => ({}));
+    const code = problem.code ?? String(res.status);
+    if (res.status === 401 && !GITHUB_TOKEN_CODES.has(code)) {
+      throw new LoginNeeded(`${this.url} rejected the API key (${code}); check WATCHERONI_API_KEY`);
+    }
+    if (res.status >= 500 || res.status === 429) throw new Unreachable(`${this.url} answered ${res.status} (${code})`);
+    throw new ServerError(`${this.url}: ${method} ${path}: ${res.status} ${problem.detail ?? problem.title ?? code}`, res.status, code, problem);
+  }
+  ensureInbox(name) {
+    return this.request("PUT", `/v1/inboxes/${name}`);
+  }
+  events(name, after, wait, signal) {
+    const query = new URLSearchParams({ wait: String(wait) });
+    if (after !== null) query.set("after", String(after));
+    return this.request("GET", `/v1/inboxes/${name}/events?${query}`, { signal, timeoutMs: (wait + 30) * 1e3 });
+  }
+  ack(name, seq) {
+    return this.request("POST", `/v1/inboxes/${name}/ack`, { body: { seq } });
+  }
+  // Where and how to open the inbox's WebSocket. The API key goes in the
+  // handshake's Authorization header, which the protocol allows for
+  // clients that can set headers. If that ever has to change, this is
+  // where to get a one-use ticket from POST /v1/inboxes/{name}/ticket and
+  // connect to the URL it returns instead.
+  async socket(name) {
+    const url = new URL(`${this.url}/v1/inboxes/${name}/ws`);
+    url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+    return { url: url.href, headers: { Authorization: `Bearer ${this.apiKey}` } };
+  }
+};
+async function subscribe(client, inbox, target, o) {
+  const repo = `${target.owner}/${target.name}`;
+  const path = `/v1/inboxes/${inbox}/subscriptions`;
+  const body = isPr(target) ? { repo, pr: target.number } : { repo, kinds: target.kinds, ...target.base ? { base: target.base } : {}, ...target.author ? { author: target.author } : {} };
+  try {
+    try {
+      return (await client.request("POST", path, { body })).id;
+    } catch (e) {
+      if (!(e instanceof ServerError && e.code === "github_token_required")) throw e;
+      const token = await o.githubToken?.();
+      if (!token) {
+        o.log(`${repo} is private and there's no GitHub token for ${client.url} on this machine; run \`watcheroni login\` to have the server watch it`);
+        return null;
+      }
+      return (await client.request("POST", path, { body, headers: { "X-GitHub-Token": token } })).id;
+    }
+  } catch (e) {
+    if (e instanceof ServerError) {
+      if (e.code === "app_not_installed") {
+        const url = typeof e.problem.install_url === "string" ? `; it can be installed from ${e.problem.install_url}` : "";
+        o.log(`the watcheroni App isn't installed on ${repo}${url}`);
+      } else if (e.code === "github_token_invalid") {
+        o.log(`${client.url} didn't accept this machine's GitHub token for ${repo}; run \`watcheroni login\` again`);
+      } else {
+        o.log(`${client.url} won't watch ${anyKey(target)}: ${e.problem.detail ?? e.problem.title ?? e.code}`);
+      }
+      return null;
+    }
+    if (e instanceof Unreachable) {
+      o.log(`couldn't subscribe to ${anyKey(target)} (${e.message})`);
+      return null;
+    }
+    throw e;
+  }
+}
+var RENEW_BEFORE_MS = 2 * 24 * 36e5;
+var RENEW_EVERY_MS = 6 * 36e5;
+async function renewSubscriptions(client, inbox, o, now = Date.now()) {
+  let subs;
+  try {
+    subs = (await client.request("GET", `/v1/inboxes/${inbox}/subscriptions`)).subscriptions;
+  } catch (e) {
+    if (e instanceof ServerError || e instanceof Unreachable || e instanceof LoginNeeded) return;
+    throw e;
+  }
+  const due = subs.filter((s) => s.repo.private && s.verified_until && Date.parse(s.verified_until) - now < RENEW_BEFORE_MS);
+  if (!due.length) return;
+  const token = await o.githubToken?.();
+  if (!token) {
+    o.log(`the server needs a fresh GitHub token to keep watching ${due.map((s) => s.repo.full_name).join(", ")}; run \`watcheroni login\``);
+    return;
+  }
+  for (const s of due) {
+    try {
+      await client.request("POST", `/v1/inboxes/${inbox}/subscriptions/${s.id}/verify`, { headers: { "X-GitHub-Token": token } });
+    } catch (e) {
+      if (e instanceof ServerError) {
+        o.log(e.code === "repo_access_denied" ? `you can no longer read ${s.repo.full_name}, so the server has stopped watching it` : `couldn't renew the server's watch on ${s.repo.full_name}: ${e.problem.detail ?? e.problem.title ?? e.code}`);
+        continue;
+      }
+      if (e instanceof Unreachable || e instanceof LoginNeeded) return;
+      throw e;
+    }
+  }
+}
+var ServerReader = class {
+  client;
+  name;
+  // True while connected and reading.
+  connected = false;
+  // Set when reading has stopped for good; the next wait throws it.
+  failure = null;
+  pos = null;
+  queue = [];
+  seen = /* @__PURE__ */ new Set();
+  fresh = false;
+  waiters = /* @__PURE__ */ new Set();
+  ws = null;
+  mode = "ws";
+  stopped = false;
+  abort = new AbortController();
+  acks = /* @__PURE__ */ new Set();
+  firstOutcome = null;
+  o;
+  constructor(client, name, o) {
+    this.client = client;
+    this.name = name;
+    this.o = { backoff: [1e3, 6e4], pingMs: 3e4, connectTimeoutMs: 15e3, ...o };
+  }
+  // Starts reading. Resolves true once connected, or false if the first
+  // attempt failed (reading goes on retrying in the background). Throws
+  // if the server refused for good.
+  start() {
+    const first = new Promise((resolve) => this.firstOutcome = resolve);
+    void this.run();
+    return first.then((ok) => {
+      if (this.failure) throw this.failure;
+      return ok;
+    });
+  }
+  // Events received and not yet acknowledged, oldest first.
+  pending() {
+    this.fresh = false;
+    return [...this.queue];
+  }
+  // Waits up to `ms` for events that pending() hasn't returned yet, or for
+  // reading to fail. True if something happened.
+  changed(ms) {
+    if (this.fresh || this.failure) return Promise.resolve(true);
+    return new Promise((resolve) => {
+      const done = (woke) => {
+        clearTimeout(timer);
+        this.waiters.delete(wake);
+        resolve(woke);
+      };
+      const wake = () => done(true);
+      const timer = setTimeout(() => done(false), ms);
+      this.waiters.add(wake);
+    });
+  }
+  // Moves the server's acknowledged position, over the socket if there is
+  // one, else over HTTP.
+  ack(seq) {
+    this.queue = this.queue.filter((e) => e.seq > seq);
+    if (this.ws?.readyState === WebSocket.OPEN) {
+      this.ws.send(JSON.stringify({ type: "ack", seq }));
+      return;
+    }
+    const sent = this.client.ack(this.name, seq).then(
+      () => {
+      },
+      (e) => this.o.log(`couldn't acknowledge event ${seq} (${e.message}); it may be shown again`)
+    ).finally(() => this.acks.delete(sent));
+    this.acks.add(sent);
+  }
+  // Stops reading, after sending any acknowledgements still on their way.
+  async close() {
+    this.stopped = true;
+    this.abort.abort();
+    const ws = this.ws;
+    if (ws && ws.readyState !== WebSocket.CLOSED) {
+      await new Promise((resolve) => {
+        const timer = setTimeout(resolve, 2e3);
+        ws.addEventListener("close", () => {
+          clearTimeout(timer);
+          resolve();
+        });
+        ws.close(1e3, "done");
+      });
+    }
+    await Promise.all(this.acks);
+    this.wake();
+  }
+  async run() {
+    let delay = this.o.backoff[0];
+    while (!this.stopped) {
+      try {
+        if (this.mode === "ws") {
+          const { opened, code, reason } = await this.openSocket();
+          if (this.stopped) break;
+          if (!opened) {
+            await this.client.ensureInbox(this.name);
+            this.o.log(`couldn't open a WebSocket to ${this.client.url}; long-polling instead`);
+            this.mode = "longpoll";
+            continue;
+          }
+          if (code === 4001) throw new LoginNeeded(`${this.client.url} rejected the API key (${reason || "4001"}); check WATCHERONI_API_KEY`);
+          if (code === 4004) throw new ServerError(`inbox ${this.name} was deleted on ${this.client.url}`, 404, "not_found");
+          if (code === 4029) {
+            this.o.log(`${this.client.url} has too many connections for this account; long-polling instead`);
+            this.mode = "longpoll";
+            continue;
+          }
+          if (this.connected) delay = this.o.backoff[0];
+          this.connected = false;
+          throw new Unreachable(`lost the connection to ${this.client.url} (${code}${reason ? ` ${reason}` : ""})`);
+        } else {
+          const page = await this.client.events(this.name, this.pos, this.connected ? WAIT_SECONDS : 0, this.abort.signal);
+          this.markConnected();
+          if (this.pos === null) this.pos = page.acked;
+          this.add(page.events);
+          this.pos = Math.max(this.pos ?? 0, page.next);
+          delay = this.o.backoff[0];
+        }
+      } catch (e) {
+        if (this.stopped) break;
+        if (!(e instanceof Unreachable)) {
+          this.fail(e);
+          break;
+        }
+        this.connected = false;
+        this.settleFirst(false);
+        if (!this.outage) {
+          this.outage = true;
+          if (this.wasConnected) this.o.log(`${e.message}; reconnecting`);
+        }
+        const jittered = delay * (0.5 + Math.random() / 2);
+        await new Promise((r) => setTimeout(r, jittered));
+        delay = Math.min(delay * 2, this.o.backoff[1]);
+      }
+    }
+  }
+  wasConnected = false;
+  outage = false;
+  markConnected() {
+    if (this.outage) this.o.log(`${this.wasConnected ? "reconnected" : "connected"} to ${this.client.url}`);
+    this.outage = false;
+    this.connected = true;
+    this.wasConnected = true;
+    this.settleFirst(true);
+  }
+  settleFirst(connected) {
+    this.firstOutcome?.(connected);
+    this.firstOutcome = null;
+  }
+  fail(e) {
+    this.failure = e;
+    this.connected = false;
+    this.settleFirst(false);
+    this.wake();
+  }
+  // One WebSocket connection, from opening to closing.
+  async openSocket() {
+    const { url, headers } = await this.client.socket(this.name);
+    return new Promise((resolve) => {
+      const ws = new WebSocket(url, { protocols: [SUBPROTOCOL], headers });
+      let opened = false;
+      let heard = Date.now();
+      const connectTimer = setTimeout(() => ws.close(), this.o.connectTimeoutMs);
+      const pinger = setInterval(() => {
+        if (Date.now() - heard > 2.5 * this.o.pingMs) ws.close(4e3, "silent");
+        else if (ws.readyState === WebSocket.OPEN) ws.send("ping");
+      }, this.o.pingMs);
+      ws.addEventListener("open", () => {
+        opened = true;
+        clearTimeout(connectTimer);
+        ws.send(JSON.stringify(this.pos === null ? { type: "hello" } : { type: "hello", after: this.pos }));
+      });
+      ws.addEventListener("message", (m) => {
+        heard = Date.now();
+        if (m.data === "pong" || typeof m.data !== "string") return;
+        let msg;
+        try {
+          msg = JSON.parse(m.data);
+        } catch {
+          return;
+        }
+        if (msg.type === "ready") {
+          this.ws = ws;
+          if (this.pos === null) this.pos = msg.acked;
+          this.markConnected();
+        } else if (msg.type === "events") {
+          this.add(msg.events);
+        } else if (msg.type === "error") {
+          this.o.log(`${this.client.url}: ${msg.code}${msg.detail ? `: ${msg.detail}` : ""}`);
+        }
+      });
+      const onAbort = () => {
+        if (ws.readyState === WebSocket.CONNECTING) ws.close();
+      };
+      const finish = (code, reason) => {
+        clearTimeout(connectTimer);
+        clearInterval(pinger);
+        this.abort.signal.removeEventListener("abort", onAbort);
+        if (this.ws === ws) this.ws = null;
+        resolve({ opened, code, reason });
+      };
+      ws.addEventListener("close", (ev) => finish(ev.code, ev.reason));
+      ws.addEventListener("error", () => {
+        if (!opened) finish(1006, "");
+      });
+      this.abort.signal.addEventListener("abort", onAbort, { once: true });
+    });
+  }
+  // Keeps new events, dropping ones already seen (delivery is at least once).
+  add(events) {
+    let added = false;
+    for (const e of events) {
+      if (this.pos !== null && e.seq <= this.pos) continue;
+      this.pos = e.seq;
+      if (this.seen.has(e.id)) continue;
+      this.seen.add(e.id);
+      this.queue.push(e);
+      added = true;
+    }
+    if (this.seen.size > 2e3) this.seen = new Set([...this.seen].slice(-1e3));
+    if (added) {
+      this.fresh = true;
+      this.wake();
+    }
+  }
+  wake() {
+    for (const w of [...this.waiters]) w();
+  }
+};
+
+// src/main.ts
+var EXIT = { events: 0, error: 1, timeout: 2, ended: 3, login: 4 };
+var HELP = `watcheroni ${package_default.version}: wait for, stream, or act on what happens to GitHub pull requests
+
+Usage:
+  watcheroni wait   [target...] [--timeout 1h] [--settle 20s] [--format text|json]
+  watcheroni stream [target...]
+  watcheroni exec   [target...] [--on kinds] [--batch] -- command [args...]
+  watcheroni watch  [target...]
+  watcheroni unwatch <target...>
+  watcheroni ls
+  watcheroni login | logout   sign in to the server ($WATCHERONI_SERVER)
+  watcheroni selfhost [--help] run your own server (from a watcheroni clone)
+
+Targets are owner/repo#123 or a pull request URL. With none, the open PR
+for the current git branch. owner/repo watches the whole repository, with
+the server only, and needs --kinds.
+
+Options:
+  --inbox NAME      which inbox to use (default: $WATCHERONI_INBOX, or
+                    cc-$CLAUDE_CODE_SESSION_ID in Claude Code, or "default")
+  --kinds LIST      only these kinds, e.g. check.*,review.submitted
+  --base BRANCH     owner/repo targets: only PRs against this branch
+  --author LOGIN    owner/repo targets: only PRs opened by this GitHub user
+  --interval TIME   how often to poll GitHub (default 2m, at least 10s)
+
+wait exits 0 after printing events, 2 on timeout, 3 when every watched PR
+has ended (never while a whole repository is watched), 4 when GitHub
+credentials are missing, 1 on other errors.
+
+With a server ($WATCHERONI_SERVER and $WATCHERONI_API_KEY, or
+~/.config/watcheroni), wait, stream and exec read the inbox on the server.
+Without one, or when it can't be reached, they poll GitHub from this
+machine with your gh login (or GH_TOKEN). That token is never sent to the
+server.
+`;
+var log = (msg) => process.stderr.write(`watcheroni: ${msg}
+`);
+function parseDuration(s) {
+  const m = s.match(/^(\d+(?:\.\d+)?)(ms|s|m|h|d)?$/);
+  if (!m) throw new UsageError(`${s}: expected a duration like 30s, 2m or 1h`);
+  const unit = { ms: 1, s: 1e3, m: 6e4, h: 36e5, d: 864e5 }[m[2] ?? "s"];
+  return Number(m[1]) * unit;
+}
+async function main(argv) {
+  if (argv[0] === "selfhost") return selfhost(argv.slice(1));
+  const split = argv.indexOf("--");
+  const command = split === -1 ? [] : argv.slice(split + 1);
+  const { values: opts, positionals } = parseArgs({
+    args: split === -1 ? argv : argv.slice(0, split),
+    allowPositionals: true,
+    options: {
+      inbox: { type: "string" },
+      kinds: { type: "string" },
+      base: { type: "string" },
+      author: { type: "string" },
+      on: { type: "string" },
+      interval: { type: "string", default: "2m" },
+      timeout: { type: "string", default: "1h" },
+      settle: { type: "string", default: "20s" },
+      format: { type: "string", default: "text" },
+      batch: { type: "boolean", default: false },
+      help: { type: "boolean", short: "h", default: false },
+      version: { type: "boolean", short: "v", default: false }
+    }
+  });
+  const [verb, ...args] = positionals;
+  if (opts.version) {
+    process.stdout.write(`${package_default.version}
+`);
+    return 0;
+  }
+  if (opts.help || !verb || verb === "help") {
+    process.stdout.write(HELP);
+    return verb || opts.help ? 0 : EXIT.error;
+  }
+  const inboxName = opts.inbox ?? process.env.WATCHERONI_INBOX ?? (process.env.CLAUDE_CODE_SESSION_ID ? `cc-${process.env.CLAUDE_CODE_SESSION_ID}` : "default");
+  if (verb === "login") return await login(), 0;
+  if (verb === "logout") return await logout(), 0;
+  if (verb === "ls") {
+    const { watched, repos, pending } = Inbox.peek(inboxName);
+    if (!watched.length && !repos.length) process.stdout.write(`Inbox ${inboxName} is watching nothing.
+`);
+    for (const w of watched) process.stdout.write(`${targetKey(w.target)}  since ${w.addedAt}
+`);
+    for (const r of repos) process.stdout.write(`${repoKey(r.target)}  since ${r.addedAt}
+`);
+    if (pending) process.stdout.write(`${pending} event(s) not yet read.
+`);
+    return 0;
+  }
+  if (!["wait", "stream", "exec", "watch", "unwatch"].includes(verb)) {
+    throw new UsageError(`unknown command ${verb}; see watcheroni --help`);
+  }
+  const kinds = (opts.on ?? opts.kinds)?.split(",").map((k) => k.trim()).filter(Boolean) ?? [];
+  const interval = Math.max(parseDuration(opts.interval), 1e4);
+  if (verb === "exec" && !command.length) throw new UsageError("exec needs a command after --");
+  if (opts.format !== "text" && opts.format !== "json") throw new UsageError("--format is text or json");
+  const config = loadServer();
+  const parsed = args.map(parseTarget);
+  const targets = parsed.filter(isPr);
+  const repoTargets = parsed.filter((t) => !isPr(t)).map((t) => ({
+    ...t,
+    kinds,
+    ...opts.base ? { base: opts.base } : {},
+    ...opts.author ? { author: opts.author } : {}
+  }));
+  if ((opts.base || opts.author) && !repoTargets.length) throw new UsageError("--base and --author are for whole-repository targets (owner/repo)");
+  if (verb !== "unwatch") {
+    for (const t of repoTargets) {
+      const repo = `${t.owner}/${t.name}`;
+      if (!config) {
+        throw new UsageError(`${repo}: watching a whole repository needs the watcheroni server (see \`watcheroni login\`); from this machine it would mean polling every PR in it. Name a PR instead (${repo}#123)`);
+      }
+      if (!kinds.length) throw new UsageError(`${repo}: watching a whole repository needs --kinds, e.g. --kinds pr.opened`);
+    }
+  }
+  const inbox = Inbox.open(inboxName);
+  const client = config && new ServerClient(config);
+  if (verb === "unwatch") {
+    if (!parsed.length) throw new UsageError("unwatch needs a target");
+    for (const t of targets) {
+      if (!inbox.unwatch(targetKey(t))) log(`${targetKey(t)} wasn't being watched in inbox ${inboxName}`);
+    }
+    for (const t of repoTargets) {
+      const gone = inbox.unwatchRepo(t.owner, t.name);
+      if (!gone.length) log(`${t.owner}/${t.name} wasn't being watched as a whole in inbox ${inboxName}`);
+      if (!client) {
+        for (const r of gone) {
+          log(`stopped watching ${repoKey(r.target)} here, but with no server configured its subscription there wasn't ended; it ends after a week nobody reads inbox ${inboxName}`);
+        }
+        continue;
+      }
+      for (const r of gone) {
+        await client.request("DELETE", `/v1/inboxes/${inboxName}/subscriptions/${r.sub}`).catch((e) => {
+          if (!(e instanceof ServerError && e.status === 404)) log(`couldn't end the server's watch on ${repoKey(r.target)}: ${e.message}`);
+        });
+      }
+    }
+    return 0;
+  }
+  let reachable = false;
+  if (client) {
+    try {
+      await client.ensureInbox(inboxName);
+      reachable = true;
+    } catch (e) {
+      if (!(e instanceof Unreachable)) throw e;
+      if (repoTargets.length) throw new Unreachable(`${e.message}; a whole repository can only be watched by the server`);
+      log(`${e.message}; polling GitHub from this machine instead`);
+    }
+  }
+  for (const t of client && reachable ? repoTargets : []) {
+    const key = repoKey(t);
+    const known = inbox.repoWatches().find((r) => repoKey(r.target) === key);
+    if (known) continue;
+    const sub = await subscribe(client, inboxName, t, { log, githubToken: () => githubTokenFor(client.url) });
+    if (!sub) throw new ServerError(`can't watch ${key}: the server won't, and a whole repository can't be watched from this machine`, 0, "refused");
+    inbox.watchRepo(key, t, sub);
+    log(`watching ${key} in inbox ${inboxName}`);
+  }
+  if (!targets.length && !repoTargets.length) {
+    try {
+      targets.push(await currentBranchPr());
+    } catch (e) {
+      if (!(e instanceof UsageError || client && e instanceof LoginNeeded)) throw e;
+      if (!inbox.watched().length && !client) {
+        if (verb === "watch" || !inbox.pending().length) throw e;
+        log(`${e.message}; reading the events left in inbox ${inboxName}`);
+      }
+    }
+  }
+  for (const t of targets) {
+    const key = targetKey(t);
+    const known = inbox.watched().find((w) => targetKey(w.target) === key);
+    const tried = known?.subTriedAt ? Date.parse(known.subTriedAt) : 0;
+    const throttled = !args.length && Date.now() - tried < RESUBSCRIBE_MS;
+    if (known && (known.sub || !reachable || throttled)) continue;
+    const sub = client && reachable ? await subscribe(client, inboxName, t, { log, githubToken: () => githubTokenFor(client.url) }) : null;
+    if (known) {
+      inbox.setSubscription(key, sub);
+      continue;
+    }
+    inbox.watch(key, t, sub);
+    if (client && reachable && !sub) inbox.setSubscription(key, null);
+    log(`watching ${key} in inbox ${inboxName}${client && !sub ? ", polling GitHub from this machine" : ""}`);
+  }
+  const renew = () => client ? renewSubscriptions(client, inboxName, { log, githubToken: () => githubTokenFor(client.url) }) : Promise.resolve();
+  if (reachable) await renew();
+  const renewTimer = client ? setInterval(() => void renew().catch((e) => log(`renewing subscriptions: ${e.message}`)), RENEW_EVERY_MS) : null;
+  renewTimer?.unref();
+  if (verb === "watch") {
+    clearInterval(renewTimer ?? void 0);
+    await pollOnce(inbox, log, void 0, !reachable);
+    return 0;
+  }
+  let server = null;
+  if (client) {
+    server = new ServerReader(client, inboxName, { log });
+    const connected = await server.start();
+    if (!connected && reachable) log(`can't read inbox ${inboxName} on ${client.url}; polling GitHub from this machine meanwhile`);
+    if (!connected && verb === "wait" && !inbox.watched().length) {
+      await server.close();
+      throw new Unreachable(`can't reach ${client.url}, and inbox ${inboxName} watches no PR to poll from here instead`);
+    }
+  }
+  const feed = new Feed(inbox, server, { interval, log });
+  try {
+    switch (verb) {
+      case "wait":
+        return await waitCommand(feed, { kinds, interval, timeout: parseDuration(opts.timeout), settle: parseDuration(opts.settle), json: opts.format === "json", inbox: inboxName });
+      case "stream":
+        return await streamCommand(feed, { kinds, interval });
+      case "exec":
+        return await execCommand(feed, { kinds, interval, batch: opts.batch, settle: parseDuration(opts.settle), command });
+    }
+  } finally {
+    clearInterval(renewTimer ?? void 0);
+    await server?.close();
+  }
+  return EXIT.error;
+}
+var RESUBSCRIBE_MS = 60 * 6e4;
+async function waitCommand(feed, o) {
+  const deadline = Date.now() + o.timeout;
+  const reading = () => feed.ended() ? void 0 : o.inbox;
+  if (!feed.wanted(o.kinds).length) await feed.poll();
+  for (; ; ) {
+    let items = feed.wanted(o.kinds);
+    if (items.length) {
+      if (o.settle > 0 && !feed.ended()) {
+        await feed.settle(Math.min(o.settle, Math.max(deadline - Date.now(), 0)));
+        items = feed.wanted(o.kinds);
+      }
+      const events = items.map((i) => i.event);
+      const still = feed.watching();
+      process.stdout.write(o.json ? `${JSON.stringify({ events, watching: still })}
+` : `${formatText(events, still, reading(), feed.repoEnded)}
+`);
+      feed.ack(items);
+      return feed.ended() ? EXIT.ended : EXIT.events;
+    }
+    if (feed.ended()) {
+      process.stdout.write(o.json ? `${JSON.stringify({ events: [], watching: [] })}
+` : `${footer([], void 0, feed.repoEnded)}
+`);
+      return EXIT.ended;
+    }
+    const left = deadline - Date.now();
+    if (left <= 0) {
+      const still = feed.watching();
+      process.stdout.write(o.json ? `${JSON.stringify({ events: [], watching: still, timeout: true })}
+` : `No new events. ${footer(still, reading())}
+`);
+      return EXIT.timeout;
+    }
+    await feed.more(Math.min(o.interval, left));
+  }
+}
+async function streamCommand(feed, o) {
+  for (; ; ) {
+    for (const item of feed.wanted(o.kinds)) {
+      process.stdout.write(`${JSON.stringify(item.event)}
+`);
+      feed.ack([item]);
+    }
+    if (feed.ended()) return EXIT.ended;
+    await feed.more(o.interval);
+  }
+}
+async function execCommand(feed, o) {
+  await feed.poll();
+  for (; ; ) {
+    const items = feed.wanted(o.kinds);
+    if (items.length && o.batch) {
+      if (o.settle > 0) await feed.settle(o.settle);
+      const batch = feed.wanted(o.kinds);
+      const code = await run(o.command, JSON.stringify(batch.map((i) => i.event)), { WATCHERONI_COUNT: String(batch.length) });
+      if (code === 0) feed.ack(batch);
+      else log(`command exited ${code}; the ${batch.length} event(s) will be offered again`);
+    } else {
+      for (const item of items) {
+        const e = item.event;
+        const code = await run(o.command, JSON.stringify(e), {
+          WATCHERONI_KIND: e.kind,
+          WATCHERONI_REPO: e.repo?.full_name ?? "",
+          WATCHERONI_PR: e.pr === null ? "" : String(e.pr),
+          WATCHERONI_URL: e.links.html ?? "",
+          WATCHERONI_EVENT_ID: e.id
+        });
+        if (code !== 0) {
+          log(`command exited ${code} for ${e.kind} (${e.id}); it will be offered again`);
+          break;
+        }
+        feed.ack([item]);
+      }
+    }
+    if (feed.ended() && !feed.wanted(o.kinds).length) return EXIT.ended;
+    await feed.more(o.interval);
+  }
+}
+function run(command, stdin, env) {
+  return new Promise((resolve) => {
+    const child = spawn3(command[0], command.slice(1), { stdio: ["pipe", "inherit", "inherit"], env: { ...process.env, ...env } });
+    child.on("error", (e) => {
+      log(`couldn't run ${command[0]}: ${e.message}`);
+      resolve(127);
+    });
+    child.on("close", (code, signal) => resolve(code ?? (signal ? 128 : 1)));
+    child.stdin.on("error", () => {
+    });
+    child.stdin.end(stdin);
+  });
+}
+process.on("SIGINT", () => process.exit(130));
+process.on("SIGTERM", () => process.exit(143));
+delete process.env.WATCHERONI_WRAPPER;
+main(process.argv.slice(2)).then(
+  (code) => process.exit(code),
+  (e) => {
+    if (e instanceof LoginNeeded) {
+      log(e.message);
+      process.exit(EXIT.login);
+    }
+    if (e instanceof UsageError || e instanceof InboxBusy || e instanceof LoginFailed || e instanceof Unreachable || e instanceof ServerError) log(e.message);
+    else log(e instanceof Error ? e.stack ?? e.message : String(e));
+    process.exit(EXIT.error);
+  }
+);
+export {
+  parseDuration
+};