@join-pantheon/cli 0.19.0 → 0.20.0

package/dist/relay.js

@@ -1,6 +1,7 @@
 import { createServer } from "node:http";
 import { createHash, randomBytes, timingSafeEqual as timingSafeEqualBuf } from "node:crypto";
-import { rmSync } from "node:fs";
+import { rmSync, readdirSync, readFileSync, statSync, existsSync } from "node:fs";
+import { spawn } from "node:child_process";
 import { join } from "node:path";
 import { WebSocketServer } from "ws";
 import { badRemote, Inbound, isContinuationFor, LIMITS, newId, PROTOCOL_VERSION, SENDABLE, shouldDeferToHuman, } from "./protocol.js";
@@ -11,6 +12,7 @@ import { Accounts, normalizeUsername, validEmail, validUsername } from "./accoun
 import { emailSenderFromEnv } from "./email.js";
 import { Allowlist } from "./roster-file.js";
 import { StateStore } from "./store.js";
+import { activity, mergeActivity, feed, noteRefusal, refusalsSince, countActs, ESCALATIONS, MESSAGE_ACTS, ACT_TONE, DAY } from "./admin-stats.js";
 import { routeDecision } from "./profile.js";
 function workState(m, now = Date.now(), busyTtlMs = LIMITS.activityBusyTtlMs, pruneMs = LIMITS.activityPruneMs) {
     let known = false;
@@ -72,6 +74,38 @@ export function isTrustedSource(ip) {
 function fingerprint_(from, act, body, goal, ref) {
     return createHash("sha256").update([from, act, goal ?? "", ref ?? "", body].join("\u0000")).digest("hex").slice(0, 32);
 }
+const ADMIN_CSS = `<style>
+  :root{--bg:#0b0c0e;--card:#15171b;--line:#262a30;--fg:#e7e9ec;--dim:#9aa1a9;--accent:#5b9dff;--warn:#e8b45c;--bad:#ef8b80;--ok:#7bd39a}
+  @media(prefers-color-scheme:light){:root{--bg:#f6f7f9;--card:#fff;--line:#e6e8eb;--fg:#1a1c1f;--dim:#6b7280;--accent:#2563eb;--warn:#b45309;--bad:#b91c1c;--ok:#15803d}}
+  *{box-sizing:border-box}body{margin:0;background:var(--bg);color:var(--fg);font:14px/1.5 system-ui,-apple-system,sans-serif}
+  header{padding:20px 24px;border-bottom:1px solid var(--line);display:flex;align-items:baseline;gap:16px;flex-wrap:wrap}
+  h1{font-size:18px;margin:0}.dim{color:var(--dim)}
+  .stats{display:flex;gap:10px;flex-wrap:wrap;padding:16px 24px}
+  .stat{background:var(--card);border:1px solid var(--line);border-radius:10px;padding:10px 16px;min-width:110px}
+  .stat b{font-size:22px;display:block;font-variant-numeric:tabular-nums}.stat span{color:var(--dim);font-size:12px}
+  .stat.warn b{color:var(--warn)}
+  section{padding:8px 24px 28px}h2{font-size:14px;text-transform:uppercase;letter-spacing:.04em;color:var(--dim);margin:22px 0 8px;display:flex;align-items:center;gap:12px}
+  h2 input{margin-left:auto;font:13px system-ui;padding:5px 9px;border:1px solid var(--line);border-radius:7px;background:var(--card);color:var(--fg);width:220px}
+  .wrap{overflow-x:auto;border:1px solid var(--line);border-radius:10px;background:var(--card)}
+  table{border-collapse:collapse;width:100%;font-variant-numeric:tabular-nums}
+  th,td{text-align:left;padding:8px 12px;border-bottom:1px solid var(--line);white-space:nowrap;vertical-align:middle}
+  th{color:var(--dim);font-weight:600;font-size:12px}tr:last-child td{border-bottom:0}
+  code{font-family:ui-monospace,monospace;font-size:12px}a{color:var(--accent)}
+  .pill{font-size:11px;padding:1px 7px;border-radius:999px;border:1px solid var(--line)}.pill.bad{color:var(--bad);border-color:var(--bad)}.pill.ok{color:var(--ok);border-color:var(--ok)}
+  .inl{display:inline}.act{font:12px system-ui;padding:4px 9px;border-radius:6px;border:1px solid var(--line);background:transparent;color:var(--fg);cursor:pointer;margin-left:6px}
+  .act:hover{border-color:var(--accent)}.act.danger{color:var(--bad)}.act.danger:hover{border-color:var(--bad)}
+  .blockform{display:flex;gap:8px;align-items:center;margin:8px 0 0}.blockform input{font:13px ui-monospace,monospace;padding:6px 9px;border:1px solid var(--line);border-radius:7px;background:var(--card);color:var(--fg);width:280px}
+  .done{margin:0 24px;padding:10px 14px;border:1px solid var(--ok);color:var(--ok);border-radius:10px;background:var(--card)}
+  .note{color:var(--dim);font-size:12px;margin:6px 0 0}
+</style>`;
+const escHtml = (v) => String(v ?? "").replace(/[&<>"]/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;" }[c]));
+const fmtWhen = (t) => t ? new Date(t).toISOString().slice(0, 19).replace("T", " ") : "—";
+const fmtAgo = (t) => {
+    if (!t)
+        return "—";
+    const m = Math.round((Date.now() - t) / 60_000);
+    return m < 1 ? "just now" : m < 60 ? `${m}m ago` : m < 1440 ? `${Math.round(m / 60)}h ago` : `${Math.round(m / 1440)}d ago`;
+};
 export class Relay {
     opts;
     spaces = new Map();
@@ -94,6 +128,9 @@ export class Relay {
     adminHits = new Map();
     emailSends = [];
     adminToken;
+    adminAllow;
+    startedAt = Date.now();
+    deletedSpaces = new Map();
     backupTimer;
     constructor(opts = {}) {
         this.opts = opts;
@@ -104,6 +141,7 @@ export class Relay {
             ? process.env.PANTHEON_TRUST_LOCAL === "1"
             : !this.requireAccounts;
         this.adminToken = process.env.PANTHEON_ADMIN_TOKEN?.trim() || null;
+        this.adminAllow = (process.env.PANTHEON_ADMIN_ALLOW_IPS ?? "").split(",").map((x) => x.trim()).filter(Boolean);
         const wantStore = this.requireAccounts || this.adminToken !== null;
         this.accounts = opts.accounts ?? (wantStore ? new Accounts(join(this.dataDir, "accounts.db")) : null);
         this.email = opts.emailSender ?? emailSenderFromEnv(this.log);
@@ -275,10 +313,12 @@ export class Relay {
     onAuthHttp(req, res, url, ip) {
         if (url.pathname === "/")
             return this.landingPage(res);
-        if (url.pathname === "/admin" || url.pathname === "/admin/export" || url.pathname === "/admin/login" || url.pathname === "/admin/logout") {
+        if (url.pathname === "/admin" || url.pathname === "/admin/space" || url.pathname === "/admin/export" || url.pathname === "/admin/backup" || url.pathname === "/admin/action" || url.pathname === "/admin/login" || url.pathname === "/admin/logout") {
             const A0 = this.accounts;
             if (!A0 || !this.adminToken)
                 return this.json(res, 404, { error: "not found" });
+            if (!this.adminIpOk(ip))
+                return this.json(res, 404, { error: "not found" });
             const tokenOk = (t) => { const a = Buffer.from(t), b = Buffer.from(this.adminToken); return a.length === b.length && timingSafeEqualBuf(a, b); };
             const fromCookie = cookieVal(req, "pantheon_admin");
             const fromQuery = url.searchParams.get("token") ?? req.headers["authorization"]?.replace(/^Bearer\s+/i, "") ?? "";
@@ -290,8 +330,10 @@ export class Relay {
                 return this.readForm(req, (body) => {
                     if (!tokenOk(body.token ?? "")) {
                         this.noteAdminFail(ip);
+                        A0.audit({ event: "admin_login_failed", ip });
                         return this.adminLoginPage(res, true);
                     }
+                    A0.audit({ event: "admin_login", ip });
                     const secure = req.headers["x-forwarded-proto"] === "https" ? "; Secure" : "";
                     res.writeHead(302, { "set-cookie": `pantheon_admin=${encodeURIComponent(body.token)}; HttpOnly; SameSite=Strict; Path=/admin; Max-Age=43200${secure}`, location: "/admin" });
                     return void res.end();
@@ -305,11 +347,30 @@ export class Relay {
             if (url.pathname === "/admin/export") {
                 if (!authed)
                     return this.json(res, 403, { error: "sign in at /admin, or append ?token=…" });
+                A0.audit({ event: "admin_export", target: url.searchParams.get("table") ?? "audit", detail: url.searchParams.get("format") ?? "json", ip });
                 return this.adminExport(res, A0, url);
             }
+            if (url.pathname === "/admin/backup") {
+                if (!authed)
+                    return this.json(res, 403, { error: "sign in at /admin, or append ?token=…" });
+                A0.audit({ event: "admin_backup", ip });
+                return this.adminBackup(res, A0);
+            }
+            if (url.pathname === "/admin/action" && req.method === "POST") {
+                if (!authed)
+                    return this.json(res, 403, { error: "sign in at /admin" });
+                return this.readForm(req, (body) => this.adminAction(res, A0, body, ip));
+            }
+            if (url.pathname === "/admin/space") {
+                if (!authed)
+                    return this.adminLoginPage(res, false);
+                const name = url.searchParams.get("name") ?? "";
+                A0.audit({ event: "admin_space_view", space: name, detail: url.search.replace(/^\?/, "").replace(/(^|&)token=[^&]*/g, "$1token=…") || null, ip });
+                return this.adminSpace(res, url, name);
+            }
             if (!authed)
                 return this.adminLoginPage(res, false);
-            return this.adminDashboard(res, A0);
+            return this.adminDashboard(res, A0, url);
         }
         const A = this.accounts;
         if (!A)
@@ -327,6 +388,8 @@ export class Relay {
                     return this.json(res, 400, { error: "username must be 2–32 chars: letters, digits, . _ - (not at the ends)" });
                 const started = A.startVerification(b.email, "signup", { username: b.username, pubkey: b.pubkey, label: String(b.label ?? "a device").slice(0, 60) });
                 if (!started.ok) {
+                    if (started.reason === "blocked")
+                        return this.json(res, 403, { error: "this email cannot sign up on this relay", reason: "blocked" });
                     const msg = started.reason === "too_soon" ? "a code was just sent — check your email, or wait a minute to resend"
                         : started.reason === "username_taken" ? "that username is taken"
                             : started.reason === "email_taken" ? "that email already has an account — use `pantheon login` from this machine instead"
@@ -349,6 +412,8 @@ export class Relay {
                 if (!b || typeof b.email !== "string" || typeof b.pubkey !== "string")
                     return this.json(res, 400, { error: "email and pubkey are required" });
                 const started = A.startVerification(b.email, "login", { pubkey: b.pubkey, label: String(b.label ?? "a device").slice(0, 60) });
+                if (!started.ok && started.reason === "blocked")
+                    return this.json(res, 403, { error: "this email cannot sign in on this relay", reason: "blocked" });
                 if (!started.ok) {
                     const code = started.reason === "too_soon" ? 429 : 404;
                     const msg = started.reason === "too_soon" ? "a code was just sent — check your email, or wait a minute" : "no active account for that email — `pantheon signup` first";
@@ -566,65 +631,436 @@ button{width:100%;margin-top:12px;padding:10px;border:0;border-radius:8px;backgr
   ${wrong ? '<div class=err>That token is not right.</div>' : ''}
 </form>`);
     }
-    adminDashboard(res, A) {
+    adminIpOk(ip) {
+        if (!this.adminAllow.length)
+            return true;
+        const h = ip.replace(/^::ffff:/, "");
+        const toN = (x) => x.split(".").reduce((n, o) => ((n << 8) + Number(o)) >>> 0, 0);
+        if (!/^\d+\.\d+\.\d+\.\d+$/.test(h))
+            return false;
+        return this.adminAllow.some((rule) => {
+            const [net, bits] = rule.split("/");
+            if (!/^\d+\.\d+\.\d+\.\d+$/.test(net ?? ""))
+                return false;
+            if (bits === undefined)
+                return net === h;
+            const n = Number(bits);
+            if (!(n >= 0 && n <= 32))
+                return false;
+            const mask = n === 0 ? 0 : (~0 << (32 - n)) >>> 0;
+            return (toN(h) & mask) === (toN(net) & mask);
+        });
+    }
+    adminCsrf() {
+        return createHash("sha256").update("pantheon-admin-csrf " + (this.adminToken ?? "")).digest("hex").slice(0, 32);
+    }
+    spacesOverview() {
+        const now = Date.now();
+        const out = new Map();
+        const safeOf = (name) => name.replace(/[^a-z0-9._-]/gi, "_");
+        const size = (safe) => [".jsonl", ".state.json", ".members.json"].reduce((n, suf) => { try {
+            return n + statSync(join(this.dataDir, `${safe}${suf}`)).size;
+        }
+        catch {
+            return n;
+        } }, 0);
+        for (const sp of this.spaces.values()) {
+            const name = sp.name;
+            out.set(safeOf(name), {
+                name, live: true, id: sp.allow.peekId(),
+                members: sp.allow.all().filter((e) => e.admitted).length, online: [...sp.members.values()].filter((m) => m.sessions.size > 0).length,
+                acts: sp.ledger.head, goals: sp.goals.size, open_goals: [...sp.goals.values()].filter((g) => g.state !== "CLOSED").length, obligations: sp.obligations.size,
+                last: sp.lastTouch, bytes: size(safeOf(name)),
+                activity: activity(sp.ledger.all(), now, (r) => `${name}/${r.from}`), refusals: sp.store.refusals,
+            });
+        }
+        let files = [];
+        try {
+            files = readdirSync(this.dataDir);
+        }
+        catch { }
+        for (const f of files) {
+            if (!f.endsWith(".members.json"))
+                continue;
+            const safe = f.slice(0, -".members.json".length);
+            if (out.has(safe))
+                continue;
+            let members = 0, last = null, id = null;
+            try {
+                const al = new Allowlist(this.dataDir, safe);
+                members = al.all().filter((e) => e.admitted).length;
+                id = al.peekId();
+            }
+            catch { }
+            try {
+                last = statSync(join(this.dataDir, `${safe}.jsonl`)).mtimeMs;
+            }
+            catch {
+                try {
+                    last = statSync(join(this.dataDir, f)).mtimeMs;
+                }
+                catch { }
+            }
+            const records = this.sleepingRecords(safe);
+            const st = this.sleepingState(safe);
+            out.set(safe, {
+                name: safe, live: false, id, members, online: 0,
+                acts: records.length ? records[records.length - 1].seq : 0,
+                goals: st.goals.size, open_goals: [...st.goals.values()].filter((g) => g.state !== "CLOSED").length, obligations: 0,
+                last, bytes: size(safe),
+                activity: activity(records, now, (r) => `${safe}/${r.from}`), refusals: st.refusals,
+            });
+        }
+        return [...out.values()].sort((a, b) => (b.last ?? 0) - (a.last ?? 0));
+    }
+    sleepingCache = new Map();
+    sleepingRecords(safe) {
+        const file = join(this.dataDir, `${safe}.jsonl`);
+        let st;
+        try {
+            st = statSync(file);
+        }
+        catch {
+            return [];
+        }
+        const key = `${st.size}:${st.mtimeMs}`;
+        const hit = this.sleepingCache.get(safe);
+        if (hit && hit.key === key)
+            return hit.records;
+        const records = [];
+        for (const line of readFileSync(file, "utf8").split("\n")) {
+            if (!line.trim())
+                continue;
+            try {
+                records.push(JSON.parse(line));
+            }
+            catch { }
+        }
+        this.sleepingCache.set(safe, { key, records });
+        if (this.sleepingCache.size > 200)
+            this.sleepingCache.delete(this.sleepingCache.keys().next().value);
+        return records;
+    }
+    sleepingState(safe) {
+        const st = new StateStore(this.dataDir, safe);
+        const { goals } = st.load();
+        return { goals, refusals: st.refusals };
+    }
+    deleteSpace(name) {
+        const sp = this.spaces.get(name);
+        if (sp) {
+            sp.deleted = true;
+            for (const m of sp.members.values())
+                for (const s of m.sessions.values()) {
+                    try {
+                        s.ws.close(1008, "SPACE_DELETED");
+                    }
+                    catch { }
+                }
+            this.spaces.delete(name);
+        }
+        setTimeout(() => this.deleteSpaceFiles(name), 600).unref?.();
+        const safe = name.replace(/[^a-z0-9._-]/gi, "_");
+        const existed = !!sp || [".jsonl", ".state.json", ".members.json"].some((suf) => existsSync(join(this.dataDir, `${safe}${suf}`)));
+        this.deleteSpaceFiles(name);
+        this.deletedSpaces.set(name, Date.now());
+        if (this.deletedSpaces.size > 1000)
+            for (const [k, t] of this.deletedSpaces)
+                if (Date.now() - t > 3_600_000)
+                    this.deletedSpaces.delete(k);
+        return existed;
+    }
+    adminAction(res, A, body, ip) {
+        if (body.csrf !== this.adminCsrf())
+            return this.json(res, 403, { error: "stale form — reload the dashboard and try again" });
+        const act = body.action ?? "", id = (body.id ?? "").trim();
+        const done = (msg) => { res.writeHead(303, { location: `/admin?done=${encodeURIComponent(msg)}` }); res.end(); };
+        switch (act) {
+            case "suspend":
+            case "reinstate": {
+                const acct = A.accountById(id);
+                if (!acct)
+                    return this.json(res, 404, { error: "no such account" });
+                const live = A.sessionsFor(acct.id).filter((s) => !s.revoked_at);
+                A.setStatus(acct.id, act === "suspend" ? "suspended" : "active", ip);
+                if (act === "suspend")
+                    for (const s of live)
+                        this.dropSessionEverywhere(s.id);
+                this.log(`[admin] ${act} ${acct.username} from ${ip}`);
+                return done(`${acct.username} ${act === "suspend" ? "suspended and signed out everywhere" : "reinstated"}`);
+            }
+            case "revoke_session":
+            case "revoke_device": {
+                const hit = A.adminRevoke(act === "revoke_session" ? "session" : "device", id, ip);
+                for (const sid of hit.sessionIds)
+                    this.dropSessionEverywhere(sid);
+                if (hit.deviceId && hit.accountId)
+                    this.dropDeviceSockets(hit.accountId, hit.deviceId);
+                return done(hit.sessionIds.length || hit.deviceId ? `revoked ${act === "revoke_session" ? "session" : "device"} ${id}` : `nothing to revoke for ${id}`);
+            }
+            case "block": {
+                const pattern = id.toLowerCase().replace(/^@/, "");
+                if (!/^([a-z0-9.-]+\.[a-z]{2,}|[^@\s]+@[a-z0-9.-]+\.[a-z]{2,})$/.test(pattern))
+                    return this.json(res, 400, { error: "block takes an email (a@b.com) or a domain (b.com)" });
+                A.block(pattern, ip);
+                return done(`blocked ${pattern}`);
+            }
+            case "unblock": {
+                A.unblock(id.toLowerCase().replace(/^@/, ""), ip);
+                return done(`unblocked ${id}`);
+            }
+            case "delete_space": {
+                if (body.confirm !== id)
+                    return this.json(res, 400, { error: "type the space name to confirm" });
+                const existed = this.deleteSpace(id);
+                A.audit({ event: "admin_space_deleted", space: id, ip });
+                this.log(`[admin] deleted space "${id}" from ${ip}`);
+                return done(existed ? `space "${id}" deleted — its members were disconnected` : `no space "${id}"`);
+            }
+            default: return this.json(res, 400, { error: `unknown action "${act}"` });
+        }
+    }
+    adminDashboard(res, A, url) {
         const c = A.counts();
         const esc = (s) => String(s ?? "").replace(/[&<>"]/g, (m) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;" }[m]));
-        const when = (t) => new Date(t).toISOString().slice(0, 19).replace("T", " ");
+        const when = (t) => t ? new Date(t).toISOString().slice(0, 19).replace("T", " ") : "—";
+        const ago = (t) => { if (!t)
+            return "—"; const m = Math.round((Date.now() - t) / 60_000); return m < 1 ? "just now" : m < 60 ? `${m}m ago` : m < 1440 ? `${Math.round(m / 60)}h ago` : `${Math.round(m / 1440)}d ago`; };
+        const kb = (n) => n < 1024 ? `${n} B` : n < 1048576 ? `${(n / 1024).toFixed(1)} KB` : `${(n / 1048576).toFixed(1)} MB`;
         const accounts = A.allAccounts();
         const devices = A.allDevices();
         const sessions = A.allSessions(200);
         const audit = A.auditLog({ limit: 300 });
+        const blocks = A.allBlocks();
+        const verifs = A.recentVerifications(50);
+        const spaces = this.spacesOverview();
+        const act = mergeActivity(spaces.map((x) => x.activity));
+        const dayAgo = Date.now() - DAY;
+        const refused24 = spaces.reduce((n, x) => n + refusalsSince(x.refusals, dayAgo), 0);
+        const refusedAll = spaces.reduce((n, x) => n + (x.refusals?.total ?? 0), 0);
         const devByAcct = new Map();
         for (const d of devices)
             devByAcct.set(d.account_id, (devByAcct.get(d.account_id) ?? 0) + 1);
+        const emailCap = Number(process.env.PANTHEON_EMAIL_MAX_PER_HOUR) || 200;
+        const emailsHour = this.emailSends.filter((t) => Date.now() - t < 3_600_000).length;
+        let snapshots = [];
+        try {
+            snapshots = readdirSync(join(this.dataDir, "backups")).filter((f) => f.startsWith("accounts-") && f.endsWith(".db")).sort();
+        }
+        catch { }
+        const lastBackupPull = audit.find((e) => e.event === "admin_backup");
+        const upMin = Math.round((Date.now() - this.startedAt) / 60_000);
+        const csrf = this.adminCsrf();
+        const done = url?.searchParams.get("done");
         const rows = (arr) => arr.join("");
+        const form = (action, id, label, extra = "", cls = "") => `<form method=POST action="/admin/action" class=inl onsubmit="return confirmAct(this)"><input type=hidden name=csrf value="${csrf}"><input type=hidden name=action value="${action}"><input type=hidden name=id value="${esc(id)}">${extra}<button class="act ${cls}">${label}</button></form>`;
         const html = `<!doctype html><meta charset=utf-8><title>pantheon · admin</title>
 <meta name=viewport content="width=device-width,initial-scale=1">
-<style>
-  :root{--bg:#0b0c0e;--card:#15171b;--line:#262a30;--fg:#e7e9ec;--dim:#9aa1a9;--accent:#5b9dff}
-  @media(prefers-color-scheme:light){:root{--bg:#f6f7f9;--card:#fff;--line:#e6e8eb;--fg:#1a1c1f;--dim:#6b7280;--accent:#2563eb}}
-  *{box-sizing:border-box}body{margin:0;background:var(--bg);color:var(--fg);font:14px/1.5 system-ui,-apple-system,sans-serif}
-  header{padding:20px 24px;border-bottom:1px solid var(--line);display:flex;align-items:baseline;gap:16px;flex-wrap:wrap}
-  h1{font-size:18px;margin:0}.dim{color:var(--dim)}
-  .stats{display:flex;gap:10px;flex-wrap:wrap;padding:16px 24px}
-  .stat{background:var(--card);border:1px solid var(--line);border-radius:10px;padding:10px 16px;min-width:96px}
-  .stat b{font-size:22px;display:block}.stat span{color:var(--dim);font-size:12px}
-  section{padding:8px 24px 28px}h2{font-size:14px;text-transform:uppercase;letter-spacing:.04em;color:var(--dim);margin:22px 0 8px}
-  .wrap{overflow-x:auto;border:1px solid var(--line);border-radius:10px;background:var(--card)}
-  table{border-collapse:collapse;width:100%;font-variant-numeric:tabular-nums}
-  th,td{text-align:left;padding:8px 12px;border-bottom:1px solid var(--line);white-space:nowrap}
-  th{color:var(--dim);font-weight:600;font-size:12px}tr:last-child td{border-bottom:0}
-  code{font-family:ui-monospace,monospace;font-size:12px}a{color:var(--accent)}
-  .pill{font-size:11px;padding:1px 7px;border-radius:999px;border:1px solid var(--line)}
-</style>
+${ADMIN_CSS}
 <header>
   <h1>pantheon · admin</h1>
-  <span class=dim>${esc(this.opts.host ?? "relay")} · pkg ${VERSION}</span>
-  <span style="margin-left:auto"><a href="/admin/export?table=audit&format=csv">export audit CSV</a> · <a href="/admin/export?table=accounts&format=json">accounts JSON</a> · <a href="/admin/logout">sign out</a></span>
+  <span class=dim>${esc(this.opts.host ?? "relay")} · pkg ${VERSION} · up ${upMin < 60 ? upMin + "m" : Math.round(upMin / 60) + "h"}</span>
+  <span style="margin-left:auto"><a href="/admin/export?table=audit&format=csv">export audit CSV</a> · <a href="/admin/export?table=accounts&format=json">accounts JSON</a> · <a href="/admin/backup">download backup</a> · <a href="/admin/logout">sign out</a></span>
 </header>
+${done ? `<div class=done>${esc(done)}</div>` : ""}
 <div class=stats>
   <div class=stat><b>${c.accounts}</b><span>accounts</span></div>
   <div class=stat><b>${c.devices}</b><span>devices</span></div>
-  <div class=stat><b>${c.live_sessions}</b><span>live sessions</span></div>
-  <div class=stat><b>${c.sessions}</b><span>sessions total</span></div>
+  <div class=stat><b>${sessions.filter((s) => !s.revoked_at && Date.now() - s.last_seen <= 15 * 60_000).length}<span class=dim style="font-size:14px"> / ${c.live_sessions}</span></b><span>sessions active / open</span></div>
+  <div class=stat><b>${spaces.filter((s) => s.live).length}<span class=dim style="font-size:14px"> / ${spaces.length}</span></b><span>spaces live / total · cap ${this.limits.maxSpaces}</span></div>
+  <div class="stat ${emailsHour > emailCap * 0.8 ? "warn" : ""}"><b>${emailsHour}<span class=dim style="font-size:14px"> / ${emailCap}</span></b><span>emails this hour</span></div>
+  <div class=stat><b>${snapshots.length}</b><span>snapshots · latest ${snapshots.length ? esc(snapshots[snapshots.length - 1].replace(/^accounts-|\\.db$/g, "").replace(/T/, " ").slice(0, 16)) : "—"}</span></div>
+  <div class="stat ${!lastBackupPull || Date.now() - lastBackupPull.ts > 36 * 3_600_000 ? "warn" : ""}"><b>${lastBackupPull ? ago(lastBackupPull.ts) : "never"}</b><span>last off-host backup pull</span></div>
   <div class=stat><b>${c.audit}</b><span>audit events</span></div>
+  <div class=stat><b>${act.messages_24h}<span class=dim style="font-size:14px"> / ${act.messages}</span></b><span>messages today / retained</span></div>
+  <div class=stat><b>${act.senders_24h.length}<span class=dim style="font-size:14px"> · ${act.sessions_24h} sessions</span></b><span>delegates active today</span></div>
+  <div class="stat ${countActs(act.by_act_24h, ["OBJECT"]) ? "warn" : ""}"><b>${countActs(act.by_act_24h, ["OBJECT"])}<span class=dim style="font-size:14px"> / ${countActs(act.by_act, ["OBJECT"])}</span></b><span>objections today / retained</span></div>
+  <div class="stat ${countActs(act.by_act_24h, ESCALATIONS) ? "warn" : ""}"><b>${countActs(act.by_act_24h, ESCALATIONS)}<span class=dim style="font-size:14px"> / ${countActs(act.by_act, ESCALATIONS)}</span></b><span>escalations today / retained</span></div>
+  <div class=stat><b>${countActs(act.by_act_24h, ["DELIVERED"])}<span class=dim style="font-size:14px"> / ${countActs(act.by_act, ["DELIVERED"])}</span></b><span>deliveries today / retained</span></div>
+  <div class="stat ${refused24 ? "warn" : ""}"><b data-refused="${refusedAll}">${refused24}<span class=dim style="font-size:14px"> / ${refusedAll}</span></b><span>refused by the relay today / total</span></div>
+</div>
+<section>
+  <h2>Activity <span class=dim>(every space · today and retained history)</span></h2><div class=wrap><table id=t-activity>
+    <tr><th></th>${MESSAGE_ACTS.map((x) => `<th>${x}</th>`).join("")}<th>refused</th></tr>
+    <tr><td class=dim>today</td>${MESSAGE_ACTS.map((x) => `<td data-act="${x}" data-window="24h">${act.by_act_24h[x] ?? 0}</td>`).join("")}<td>${refused24}</td></tr>
+    <tr><td class=dim>retained</td>${MESSAGE_ACTS.map((x) => `<td data-act="${x}" data-window="all">${act.by_act[x] ?? 0}</td>`).join("")}<td>${refusedAll}</td></tr>
+  </table></div>
+  <p class=note>Messages are acts delegates sent; JOIN/LEAVE presence is not counted. Retained is what each space's ledger still holds — the most recent ${LIMITS.ledgerKeepRecent.toLocaleString()} acts plus everything in an open goal. Refused is what the relay handed back: wrong turn, missing reference, foreign repo, rate limit. Click a space for its conversation.</p>
+
+  <h2>Spaces <input placeholder="filter" data-filter="t-spaces"></h2><div class=wrap><table id=t-spaces>
+    <tr><th>space</th><th>state</th><th>members</th><th>online</th><th>acts</th><th>msgs today</th><th>delegates today</th><th>objections</th><th>refused</th><th>goals</th><th>owed</th><th>last activity</th><th>on disk</th><th></th></tr>
+    ${rows(spaces.map((s) => `<tr><td><a href="/admin/space?name=${encodeURIComponent(s.name)}" title="members, refusals and the conversation"><code>${esc(s.name)}</code></a></td><td><span class="pill ${s.live ? "ok" : ""}">${s.live ? "live" : "sleeping"}</span></td><td>${s.members}</td><td>${s.online}</td><td>${s.acts}</td><td>${s.activity.messages_24h}</td><td>${s.activity.senders_24h.length}</td><td>${s.activity.by_act_24h.OBJECT ?? 0}<span class=dim> / ${s.activity.by_act.OBJECT ?? 0}</span></td><td>${refusalsSince(s.refusals, dayAgo)}<span class=dim> / ${s.refusals?.total ?? 0}</span></td><td>${s.open_goals} open / ${s.goals}</td><td>${s.live ? s.obligations : "<span class=dim>—</span>"}</td><td class=dim title="${when(s.last)}">${ago(s.last)}</td><td class=dim>${kb(s.bytes)}</td><td>${form("delete_space", s.name, "delete", `<input type=hidden name=confirm value="">`, "danger")}</td></tr>`))}
+    ${spaces.length ? "" : "<tr><td colspan=14 class=dim>no spaces yet</td></tr>"}
+  </table></div>
+  <p class=note>Sleeping spaces are on disk but idle; they reload on the next connect. Delete is irreversible and disconnects every member of that space.</p>
+
+  <h2>Accounts <input placeholder="filter" data-filter="t-accounts"></h2><div class=wrap><table id=t-accounts>
+    <tr><th>username</th><th>email</th><th>status</th><th>devices</th><th>created</th><th></th></tr>
+    ${rows(accounts.map((a) => `<tr><td><code>${esc(a.username)}</code></td><td>${esc(a.email)}</td><td><span class="pill ${a.status === "suspended" ? "bad" : ""}">${esc(a.status)}</span></td><td>${devByAcct.get(a.id) ?? 0}</td><td class=dim>${when(a.created_at)}</td><td>${a.status === "suspended" ? form("reinstate", a.id, "reinstate") : form("suspend", a.id, "suspend", "", "danger")} ${form("block", a.email, "block email", "", "danger")}</td></tr>`))}
+    ${accounts.length ? "" : "<tr><td colspan=6 class=dim>no accounts yet</td></tr>"}
+  </table></div>
+  <p class=note>Suspending signs the account out everywhere and refuses its handshakes until reinstated. Its messages stay in the ledgers.</p>
+
+  <h2>Live sessions <input placeholder="filter" data-filter="t-sessions"></h2><div class=wrap><table id=t-sessions>
+    <tr><th>session</th><th>account</th><th>space</th><th>ip</th><th>started</th><th>last seen</th><th></th></tr>
+    ${rows(sessions.filter((s) => !s.revoked_at).map((s) => `<tr><td><code>${esc(s.id)}</code></td><td><code>${esc(accounts.find((a) => a.id === s.account_id)?.username ?? s.account_id)}</code></td><td>${esc(s.space) || "<span class=dim>—</span>"}</td><td class=dim>${esc(s.ip)}</td><td class=dim>${when(s.created_at)}</td><td class=dim>${ago(s.last_seen)}${Date.now() - s.last_seen > 15 * 60_000 ? ' <span class="pill" title="no heartbeat for 15+ minutes — usually a socket that died with a restart; pruned after 30 days">stale</span>' : ""}</td><td>${form("revoke_session", s.id, "sign out", "", "danger")} ${form("revoke_device", s.device_id, "remove device", "", "danger")}</td></tr>`))}
+    ${sessions.some((s) => !s.revoked_at) ? "" : "<tr><td colspan=7 class=dim>no live sessions</td></tr>"}
+  </table></div>
+
+  <h2>Blocked emails and domains</h2><div class=wrap><table id=t-blocks>
+    <tr><th>pattern</th><th>kind</th><th>since</th><th></th></tr>
+    ${rows(blocks.map((b) => `<tr><td><code>${esc(b.pattern)}</code></td><td>${esc(b.kind)}</td><td class=dim>${when(b.created_at)}</td><td>${form("unblock", b.pattern, "unblock")}</td></tr>`))}
+    ${blocks.length ? "" : "<tr><td colspan=4 class=dim>nothing blocked</td></tr>"}
+  </table></div>
+  <form method=POST action="/admin/action" class=blockform><input type=hidden name=csrf value="${csrf}"><input type=hidden name=action value=block><input name=id placeholder="someone@spam.example  or  spam.example" required><button class=act>block</button></form>
+  <p class=note>A blocked email or domain cannot sign up or sign in. Existing accounts are not touched; suspend those separately.</p>
+
+  <h2>Recent verification codes <span class=dim>(support: "I never got my code")</span></h2><div class=wrap><table id=t-verifs>
+    <tr><th>email</th><th>purpose</th><th>requested</th><th>expires</th><th>wrong tries</th><th>state</th></tr>
+    ${rows(verifs.map((v) => `<tr><td>${esc(v.email)}</td><td>${esc(v.purpose)}</td><td class=dim>${when(v.created_at)}</td><td class=dim>${when(v.expires_at)}</td><td>${v.attempts}</td><td><span class="pill ${v.expires_at < Date.now() ? "bad" : "ok"}">${v.expires_at < Date.now() ? "expired" : "pending"}</span></td></tr>`))}
+    ${verifs.length ? "" : "<tr><td colspan=6 class=dim>no pending codes</td></tr>"}
+  </table></div>
+  <p class=note>A row here means the relay generated a code and handed it to the email provider. No row means the request never reached the relay. Codes themselves are never stored.</p>
+
+  <h2>Audit log <span class=dim>(latest 300)</span> <input placeholder="filter" data-filter="t-audit"></h2><div class=wrap><table id=t-audit>
+    <tr><th>time</th><th>event</th><th>space</th><th>target</th><th>detail</th><th>ip</th></tr>
+    ${rows(audit.map((e) => `<tr><td class=dim>${when(e.ts)}</td><td>${e.event.startsWith("admin_") ? `<span class=pill>${esc(e.event)}</span>` : esc(e.event)}</td><td>${esc(e.space) || ""}</td><td><code>${esc(e.target) || ""}</code></td><td class=dim>${esc(e.detail) || ""}</td><td class=dim>${esc(e.ip) || ""}</td></tr>`))}
+  </table></div>
+</section>
+<script>
+  document.querySelectorAll("input[data-filter]").forEach(function (inp) {
+    inp.addEventListener("input", function () {
+      var q = inp.value.toLowerCase(), rowsEl = document.getElementById(inp.dataset.filter).querySelectorAll("tr");
+      for (var i = 1; i < rowsEl.length; i++) rowsEl[i].style.display = !q || rowsEl[i].textContent.toLowerCase().indexOf(q) > -1 ? "" : "none";
+    });
+  });
+  function confirmAct(f) {
+    var a = f.querySelector("[name=action]").value, id = f.querySelector("[name=id]").value;
+    if (a === "delete_space") { var typed = prompt("Delete space \\"" + id + "\\" and disconnect its members? Type the name to confirm."); if (typed !== id) return false; f.querySelector("[name=confirm]").value = typed; return true; }
+    if (a === "suspend" || a === "revoke_session" || a === "revoke_device" || a === "block") return confirm(a.replace("_", " ") + " " + id + "?");
+    return true;
+  }
+</script>`;
+        res.writeHead(200, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store", "referrer-policy": "no-referrer" });
+        res.end(html);
+    }
+    adminSpace(res, url, name) {
+        const safe = name.replace(/[^a-z0-9._-]/gi, "_");
+        const sp = this.spaces.get(name) ?? null;
+        const tomb = this.deletedSpaces.get(name);
+        const onDisk = [".jsonl", ".state.json", ".members.json"].some((suf) => existsSync(join(this.dataDir, `${safe}${suf}`)));
+        if (!name || (!sp && (!onDisk || (tomb && Date.now() - tomb < 3_600_000))))
+            return this.json(res, 404, { error: `no space "${name}" on this relay` });
+        const records = sp ? sp.ledger.all() : this.sleepingRecords(safe);
+        const state = sp ? { goals: sp.goals, refusals: sp.store.refusals } : this.sleepingState(safe);
+        const allow = sp ? sp.allow : new Allowlist(this.dataDir, safe);
+        const now = Date.now(), dayAgo = now - DAY;
+        const a = activity(records, now);
+        const esc = escHtml, when = fmtWhen, ago = fmtAgo;
+        const q = {
+            act: url.searchParams.get("act") ?? "", member: url.searchParams.get("member") ?? "", goal: url.searchParams.get("goal") ?? "",
+            q: url.searchParams.get("q") ?? "", presence: url.searchParams.get("presence") === "1", before: Number(url.searchParams.get("before")) || undefined,
+        };
+        const { rows: feedRows, next } = feed(records, { ...q, limit: 100 });
+        const filtered = !!(q.act || q.member || q.goal || q.q || q.presence);
+        const link = (extra) => {
+            const p = new URLSearchParams({ name });
+            for (const [k, v] of Object.entries({ act: q.act, member: q.member, goal: q.goal, q: q.q, presence: q.presence ? "1" : "", ...extra }))
+                if (v !== undefined && String(v) !== "")
+                    p.set(k, String(v));
+            return `/admin/space?${p.toString()}`;
+        };
+        const pill = (x) => `<span class="pill ${ACT_TONE[x]}">${x}</span>`;
+        const goalTitle = (id) => id ? `<a href="${link({ goal: id, before: undefined })}" title="${esc(id)}">${esc(state.goals.get(id)?.title ?? id)}</a>` : "<span class=dim>—</span>";
+        const metaLine = (r) => {
+            const bits = [];
+            if (r.summary)
+                bits.push(`summary: ${esc(r.summary)}`);
+            const meta = (r.meta ?? {});
+            for (const k of ["branch", "commit", "repo_origin", "decision_domains", "defers_to", "affects"])
+                if (meta[k] !== undefined)
+                    bits.push(`${k}: ${esc(typeof meta[k] === "string" ? meta[k] : JSON.stringify(meta[k]))}`);
+            if (r.ref)
+                bits.push(`re <code>${esc(r.ref)}</code>`);
+            return bits.length ? `<div class=note>${bits.join(" · ")}</div>` : "";
+        };
+        const said = (r) => r.body.length > 400
+            ? `<details><summary>${esc(r.body.slice(0, 400))}…</summary>${esc(r.body)}</details>`
+            : (esc(r.body) || "<span class=dim>(empty)</span>");
+        const rowsHtml = feedRows.map((r) => `<tr><td class=dim><span title="${when(r.ts)}">${ago(r.ts)}</span><div>#${r.seq}</div></td><td><a href="${link({ member: r.from, before: undefined })}"><code>${esc(r.from)}</code></a><div class=dim>${esc(sp?.members.get(r.from)?.agent ?? "")}${r.role ? ` · ${esc(r.role)}` : ""}</div></td><td>${pill(r.act)}</td><td>${r.to && r.to.length ? r.to.map((t) => `<code>${esc(t)}</code>`).join(", ") : "<span class=dim>everyone</span>"}</td><td>${goalTitle(r.goal)}</td><td class=body>${said(r)}${metaLine(r)}</td></tr>`).join("");
+        const entries = allow.all();
+        const memberRows = entries.map((e) => {
+            const m = sp?.members.get(e.member);
+            const online = m ? m.sessions.size : 0;
+            return `<tr><td><a href="${link({ member: e.member, before: undefined })}"><code>${esc(e.member)}</code></a></td><td>${e.admitted ? '<span class="pill ok">admitted</span>' : '<span class="pill">pending</span>'}</td><td>${e.may_wake ? "yes" : "no"}</td><td>${online ? `<span class="pill ok">${online} session${online === 1 ? "" : "s"}</span> ${esc(m.agent)}` : "<span class=dim>offline</span>"}</td><td class=dim>${m ? ago(m.last_seen) : when(e.first_seen)}</td></tr>`;
+        }).join("");
+        const repos = allow.repoList();
+        const refusals = state.refusals;
+        const refusalRows = [...refusals.recent].reverse().map((r) => `<tr><td class=dim>${when(r.ts)}</td><td><code>${esc(r.member)}</code></td><td>${esc(r.act)}</td><td><span class="pill bad">${esc(r.code)}</span></td></tr>`).join("");
+        const byCode = Object.entries(refusals.by_code).sort((x, y) => y[1] - x[1]).map(([c, n]) => `<code>${esc(c)}</code> ${n}`).join(" · ");
+        const open = [...state.goals.values()].filter((g) => g.state !== "CLOSED").length;
+        const options = MESSAGE_ACTS.map((x) => `<option value="${x}"${q.act === x ? " selected" : ""}>${x}</option>`).join("");
+        const html = `<!doctype html><meta charset=utf-8><title>pantheon · admin · ${esc(name)}</title>
+<meta name=viewport content="width=device-width,initial-scale=1">
+${ADMIN_CSS}
+<style>
+  .feed td{white-space:normal;vertical-align:top}.feed .body{min-width:320px;max-width:720px;overflow-wrap:anywhere}
+  .feed details summary{cursor:pointer;color:var(--accent)}.feed details[open] summary{display:none}
+  .pill.warn{color:var(--warn);border-color:var(--warn)}.pill.info{color:var(--accent);border-color:var(--accent)}.pill.dim{color:var(--dim)}
+  .filters{display:flex;gap:8px;flex-wrap:wrap;align-items:center;margin:8px 0 10px}
+  .filters input,.filters select{font:13px system-ui;padding:5px 9px;border:1px solid var(--line);border-radius:7px;background:var(--card);color:var(--fg)}
+  .crumbs a{color:var(--dim);text-decoration:none}.crumbs a:hover{color:var(--accent)}
+  td a{text-decoration:none}td a:hover{text-decoration:underline}
+</style>
+<header>
+  <h1><span class=crumbs><a href="/admin">admin</a> › </span>${esc(name)} <span class="pill ${sp ? "ok" : ""}">${sp ? "live" : "sleeping"}</span></h1>
+  <span class=dim>${esc(allow.peekId() ?? "no id yet")} · ${records.length} acts retained${a.first ? ` since ${when(a.first)}` : ""}</span>
+  <span style="margin-left:auto"><a href="/admin">← dashboard</a> · <a href="/admin/logout">sign out</a></span>
+</header>
+<div class=stats>
+  <div class=stat><b>${a.messages_24h}<span class=dim style="font-size:14px"> / ${a.messages}</span></b><span>messages today / retained</span></div>
+  <div class=stat><b>${a.senders_24h.length}<span class=dim style="font-size:14px"> · ${a.sessions_24h} sessions</span></b><span>delegates active today</span></div>
+  <div class="stat ${a.by_act_24h.OBJECT ? "warn" : ""}"><b>${a.by_act_24h.OBJECT ?? 0}<span class=dim style="font-size:14px"> / ${a.by_act.OBJECT ?? 0}</span></b><span>objections today / retained</span></div>
+  <div class="stat ${countActs(a.by_act_24h, ESCALATIONS) ? "warn" : ""}"><b>${countActs(a.by_act_24h, ESCALATIONS)}<span class=dim style="font-size:14px"> / ${countActs(a.by_act, ESCALATIONS)}</span></b><span>escalations today / retained</span></div>
+  <div class=stat><b>${a.by_act_24h.DELIVERED ?? 0}<span class=dim style="font-size:14px"> / ${a.by_act.DELIVERED ?? 0}</span></b><span>deliveries today / retained</span></div>
+  <div class="stat ${refusalsSince(refusals, dayAgo) ? "warn" : ""}"><b>${refusalsSince(refusals, dayAgo)}<span class=dim style="font-size:14px"> / ${refusals.total}</span></b><span>refused today / total</span></div>
+  <div class=stat><b>${open}<span class=dim style="font-size:14px"> / ${state.goals.size}</span></b><span>goals open / total</span></div>
+  ${sp ? `<div class=stat><b>${sp.obligations.size}</b><span>obligations owed</span></div>` : ""}
 </div>
 <section>
-  <h2>Accounts</h2><div class=wrap><table>
-    <tr><th>username</th><th>email</th><th>status</th><th>devices</th><th>created</th></tr>
-    ${rows(accounts.map((a) => `<tr><td><code>${esc(a.username)}</code></td><td>${esc(a.email)}</td><td><span class=pill>${esc(a.status)}</span></td><td>${devByAcct.get(a.id) ?? 0}</td><td class=dim>${when(a.created_at)}</td></tr>`))}
-    ${accounts.length ? "" : "<tr><td colspan=5 class=dim>no accounts yet</td></tr>"}
+  <h2>Members <span class=dim>(${entries.filter((e) => e.admitted).length} admitted)</span></h2><div class=wrap><table>
+    <tr><th>member</th><th>state</th><th>may wake</th><th>online</th><th>last seen</th></tr>
+    ${memberRows || "<tr><td colspan=5 class=dim>nobody yet</td></tr>"}
   </table></div>
+  ${repos.length ? `<h2>Repos this team works from</h2><div class=wrap><table><tr><th>origin</th><th>fingerprint</th><th>added by</th><th>when</th></tr>${repos.map((r) => `<tr><td>${esc(r.origin ?? "(no origin)")}</td><td><code>${esc(r.fingerprint)}</code></td><td><code>${esc(r.added_by)}</code></td><td class=dim>${when(r.at)}</td></tr>`).join("")}</table></div>` : ""}
 
-  <h2>Live sessions</h2><div class=wrap><table>
-    <tr><th>session</th><th>space</th><th>ip</th><th>started</th><th>last seen</th></tr>
-    ${rows(sessions.filter((s) => !s.revoked_at).map((s) => `<tr><td><code>${esc(s.id)}</code></td><td>${esc(s.space) || "<span class=dim>—</span>"}</td><td class=dim>${esc(s.ip)}</td><td class=dim>${when(s.created_at)}</td><td class=dim>${when(s.last_seen)}</td></tr>`))}
+  <h2>Acts <span class=dim>(today · retained)</span></h2><div class=wrap><table id=t-acts>
+    <tr><th></th>${MESSAGE_ACTS.map((x) => `<th>${x}</th>`).join("")}</tr>
+    <tr><td class=dim>today</td>${MESSAGE_ACTS.map((x) => `<td data-act="${x}" data-window="24h">${a.by_act_24h[x] ?? 0}</td>`).join("")}</tr>
+    <tr><td class=dim>retained</td>${MESSAGE_ACTS.map((x) => `<td data-act="${x}" data-window="all">${a.by_act[x] ?? 0}</td>`).join("")}</tr>
   </table></div>
 
-  <h2>Audit log <span class=dim>(latest 300)</span></h2><div class=wrap><table>
-    <tr><th>time</th><th>event</th><th>space</th><th>target</th><th>ip</th></tr>
-    ${rows(audit.map((e) => `<tr><td class=dim>${when(e.ts)}</td><td>${esc(e.event)}</td><td>${esc(e.space) || ""}</td><td><code>${esc(e.target) || ""}</code></td><td class=dim>${esc(e.ip) || ""}</td></tr>`))}
+  <h2>Refused by the relay <span class=dim>(latest ${refusals.recent.length} of ${refusals.total})</span></h2><div class=wrap><table>
+    <tr><th>when</th><th>member</th><th>request</th><th>reason</th></tr>
+    ${refusalRows || "<tr><td colspan=4 class=dim>nothing refused</td></tr>"}
   </table></div>
+  ${byCode ? `<p class=note>All time: ${byCode}</p>` : ""}
+
+  <h2>Conversation <span class=dim>(newest first${filtered ? ", filtered" : ""})</span></h2>
+  <form class=filters method=GET action="/admin/space"><input type=hidden name=name value="${esc(name)}">
+    <select name=act><option value="">every act</option>${options}</select>
+    <input name=member placeholder="member" value="${esc(q.member)}" size=12>
+    <input name=goal placeholder="goal id" value="${esc(q.goal)}" size=16>
+    <input name=q placeholder="search what was said" value="${esc(q.q)}" size=24>
+    <label class=dim><input type=checkbox name=presence value=1${q.presence ? " checked" : ""}> show JOIN/LEAVE</label>
+    <button class=act>filter</button>${filtered ? `<a href="/admin/space?name=${encodeURIComponent(name)}">clear</a>` : ""}
+  </form>
+  <div class=wrap><table class=feed>
+    <tr><th>when</th><th>from</th><th>act</th><th>to</th><th>goal</th><th>said</th></tr>
+    ${rowsHtml || `<tr><td colspan=6 class=dim>${filtered ? "nothing matches" : "no messages yet"}</td></tr>`}
+  </table></div>
+  ${next !== null ? `<p><a href="${link({ before: next })}">older ›</a></p>` : ""}
+  <p class=note>Retained history only: the relay keeps the most recent ${LIMITS.ledgerKeepRecent.toLocaleString()} acts of a space plus everything in an open goal. Bodies are shown as sent; nothing here is edited or summarised.</p>
 </section>`;
         res.writeHead(200, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store", "referrer-policy": "no-referrer" });
         res.end(html);
@@ -646,6 +1082,41 @@ button{width:100%;margin-top:12px;padding:10px;border:0;border-radius:8px;backgr
         res.writeHead(200, { "content-type": "text/csv", "content-disposition": `attachment; filename="${table}.csv"` });
         res.end(csv);
     }
+    adminBackup(res, A) {
+        try {
+            A.backup(join(this.dataDir, "backups"));
+        }
+        catch (e) {
+            this.log(`! backup snapshot before archive failed: ${e.message}`);
+        }
+        const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+        const tar = spawn("tar", ["czf", "-", "-C", this.dataDir, "."], { stdio: ["ignore", "pipe", "pipe"] });
+        let err = "";
+        tar.stderr.on("data", (c) => { err += String(c); });
+        tar.on("error", (e) => {
+            this.log(`! backup archive failed to start: ${e.message}`);
+            if (!res.headersSent)
+                this.json(res, 500, { error: `could not start tar: ${e.message}` });
+        });
+        tar.stdout.once("data", () => {
+            if (!res.headersSent) {
+                res.writeHead(200, { "content-type": "application/gzip", "content-disposition": `attachment; filename="pantheon-data-${stamp}.tgz"` });
+            }
+        });
+        tar.stdout.pipe(res);
+        tar.on("close", (code) => {
+            if (code !== 0) {
+                this.log(`! backup archive exited ${code}: ${err.trim()}`);
+                if (!res.headersSent)
+                    this.json(res, 500, { error: `tar exited ${code}` });
+            }
+            res.end();
+        });
+        res.on("close", () => { try {
+            tar.kill();
+        }
+        catch { } });
+    }
     landingPage(res) {
         res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
         res.end(`<!doctype html><meta charset=utf-8><title>pantheon</title>
@@ -667,6 +1138,7 @@ pantheon signup --email you@work.com --username you</code></pre>
         let me = null;
         let sessionId = "";
         let role = "interactive";
+        let lastMsg = "";
         let alive = true;
         const nonce = newNonce();
         ws.on("pong", () => { alive = true; });
@@ -674,6 +1146,10 @@ pantheon signup --email you@work.com --username you</code></pre>
         probe._alive = () => alive;
         probe._clear = () => { alive = false; };
         const fail = (code, message, cid) => {
+            if (cid && space && me && !space.deleted) {
+                noteRefusal(space.store.refusals, { ts: Date.now(), member: me.id, act: lastMsg || "?", code });
+                space.store.save(space.goals, space.obligations, space.profiles);
+            }
             this.send(ws, { t: "error", code, message, ...(cid ? { cid } : {}) });
         };
         const reject = (code, message) => {
@@ -712,6 +1188,7 @@ pantheon signup --email you@work.com --username you</code></pre>
                 return fail("BAD_MESSAGE", parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; "), cid);
             }
             const m = parsed.data;
+            lastMsg = m.t === "act" ? m.act : m.t;
             if (m.t === "ping")
                 return this.send(ws, { t: "pong" });
             if (m.t === "hello") {
@@ -731,6 +1208,10 @@ pantheon signup --email you@work.com --username you</code></pre>
                         return reject("NO_SUCH_SPACE", `no space "${m.space}" on this relay`);
                 }
                 else {
+                    const tomb = this.deletedSpaces.get(m.space);
+                    if (tomb && Date.now() - tomb < 3_600_000) {
+                        return reject("SPACE_DELETED", `the space "${m.space}" was removed by the relay operator. Start a new one with a different name, or contact them.`);
+                    }
                     if (!this.spaces.has(m.space)) {
                         const denied = this.mayCreateSpace(ip);
                         if (denied)
@@ -748,7 +1229,9 @@ pantheon signup --email you@work.com --username you</code></pre>
                     if (!auth.ok) {
                         const msg = auth.reason === "username_mismatch"
                             ? `this device is signed in as a different username than "${m.member}". Use your own username, or \`pantheon login\` on this machine.`
-                            : `sign in first: run \`pantheon signup\` (new) or \`pantheon login\` (existing account) on this machine, then try again.`;
+                            : auth.reason === "suspended"
+                                ? `this account has been suspended by the relay operator. Contact them to have it reinstated.`
+                                : `sign in first: run \`pantheon signup\` (new) or \`pantheon login\` (existing account) on this machine, then try again.`;
                         this.log(`[${sp.name}] ! REFUSED ${m.member}: ${auth.reason}`);
                         return reject("NOT_SIGNED_IN", msg);
                     }
@@ -782,6 +1265,18 @@ pantheon signup --email you@work.com --username you</code></pre>
                     catch { } }, 20);
                     return;
                 }
+                let newRepo = null;
+                if (m.repo) {
+                    if (sp.allow.hasRepo(m.repo)) { }
+                    else if (sp.allow.repoCount() === 0 || enrolled || verdict === "founder")
+                        newRepo = m.repo;
+                    else {
+                        const known = sp.allow.repoList().map((r) => r.origin ?? r.fingerprint).join(", ");
+                        this.log(`[${sp.name}] ! REFUSED ${m.member}: repo ${m.repo_origin ?? m.repo} not bound to this space`);
+                        return reject("REPO_MISMATCH", `this checkout (${m.repo_origin ?? "no origin"}) is not one of the repos "${sp.name}" works from (${known || "none yet"}). ` +
+                            `Open your agent in the team's repo, or if this repo really belongs to the team: pantheon repo add`);
+                    }
+                }
                 space = sp;
                 clearHelloTimer();
                 sessionId = acctSession ?? this.mintSession();
@@ -789,10 +1284,16 @@ pantheon signup --email you@work.com --username you</code></pre>
                 me = this.attach(sp, m.member, m.display ?? m.member, m.agent ?? "unknown", sessionId, m.role, ws, m.pkg);
                 const firstSession = me.sessions.size === 1;
                 sp.lastTouch = Date.now();
+                if (newRepo && sp.allow.addRepo(newRepo, m.repo_origin ?? null, me.id)) {
+                    this.log(`[${sp.name}] + repo ${m.repo_origin ?? newRepo} registered by ${me.id}`);
+                    this.commit(sp, { from: me.id, act: "NOTE", to: null, goal: null, ref: null, body: `repo registered with this space: ${m.repo_origin ?? newRepo}`, meta: { repo: newRepo, repo_origin: m.repo_origin ?? null } });
+                    this.broadcast(sp, { t: "repos", repos: sp.allow.repoList() });
+                }
                 this.send(ws, {
                     t: "welcome", member: me.id, session: sessionId, space: sp.name, seq: sp.ledger.head,
                     roster: this.roster(sp), goals: [...sp.goals.values()],
                     obligations: [...sp.obligations.values()], members: this.members(sp), profiles: [...sp.profiles.values()],
+                    space_id: sp.allow.spaceId(), repos: sp.allow.repoList(),
                     ...(enrolled ? { token: enrolled } : {}),
                 });
                 for (const r of sp.ledger.since(m.from_seq ?? sp.ledger.head)) {
@@ -869,6 +1370,19 @@ pantheon signup --email you@work.com --username you</code></pre>
                 this.send(ws, { t: "invite", url: token, expires_at: inv.expires_at });
                 return;
             }
+            if (m.t === "bind_repo") {
+                const self = space.allow.get(me.id);
+                if (!self?.admitted)
+                    return fail("NOT_ADMITTED", "only an admitted member can register a repo", m.cid);
+                const added = space.allow.addRepo(m.repo, m.origin ?? null, me.id);
+                if (added) {
+                    this.log(`[${space.name}] + repo ${m.origin ?? m.repo} registered by ${me.id}`);
+                    this.commit(space, { from: me.id, session: sessionId, role, act: "NOTE", to: null, goal: null, ref: null, body: `repo registered with this space: ${m.origin ?? m.repo}`, meta: { repo: m.repo, repo_origin: m.origin ?? null } });
+                    this.broadcast(space, { t: "repos", repos: space.allow.repoList() });
+                }
+                this.send(ws, { t: "ack", cid: m.cid, id: m.repo, seq: space.ledger.head });
+                return;
+            }
             if (m.t === "claim") {
                 if (m.obligation.startsWith("cont:")) {
                     const act = space.ledger.find(m.obligation.slice(5));
@@ -978,7 +1492,7 @@ pantheon signup --email you@work.com --username you</code></pre>
                         `\nCall pantheon_wait, then send again.`, m.cid);
                 }
             }
-            const err = this.validateAct(space, me, m.act, m.goal ?? null, m.ref ?? null, m.to ?? null, m.meta, m.defers_to, m.body.length, m.summary);
+            const err = this.validateAct(space, me, m.act, m.goal ?? null, m.ref ?? null, m.to ?? null, m.meta, m.defers_to, m.body.length, m.summary, m.repo);
             if (err)
                 return fail(err.code, err.message, m.cid);
             const rec = this.commit(space, {
@@ -1039,7 +1553,7 @@ pantheon signup --email you@work.com --username you</code></pre>
         }
         this.evictSpaces();
     }
-    validateAct(sp, me, act, goalId, ref, to, meta, deferTo, bodyLen = 0, summary) {
+    validateAct(sp, me, act, goalId, ref, to, meta, deferTo, bodyLen = 0, summary, repo) {
         if (!SENDABLE.includes(act))
             return { code: "RESERVED_ACT", message: `${act} is emitted by the relay, not by a delegate` };
         const now = Date.now();
@@ -1156,9 +1670,19 @@ pantheon signup --email you@work.com --username you</code></pre>
                 return { code: "ALREADY_RETRACTED", message: "a retraction cannot itself be retracted — send a new act saying what is true" };
             }
         }
+        if (repo && sp.allow.repoCount() > 0 && !sp.allow.hasRepo(repo)) {
+            return { code: "REPO_MISMATCH", message: `this act was composed in a repo that "${sp.name}" does not work from. Open your agent in the team's repo, or register this one: pantheon repo add` };
+        }
         if (act === "DELIVERED") {
             const branch = typeof meta?.["branch"] === "string" ? meta["branch"] : "";
             const commit = typeof meta?.["commit"] === "string" ? meta["commit"] : "";
+            if (sp.allow.repoCount() > 0) {
+                const r = typeof meta?.["repo"] === "string" ? meta["repo"] : repo ?? "";
+                if (!r)
+                    return { code: "REPO_REQUIRED", message: "DELIVERED must say which of the team's repos the commit is in (meta.repo). Send it from a session open in that repo — if this session already is, the checkout is not one the team knows yet: from it, run `pantheon use <team> --here`." };
+                if (!sp.allow.hasRepo(r))
+                    return { code: "REPO_MISMATCH", message: `the commit is in a repo "${sp.name}" does not work from; a peer could not fetch it. Register the repo first: pantheon repo add` };
+            }
             if (!branch || !commit) {
                 return {
                     code: "UNVERIFIABLE_DELIVERY",
@@ -1206,6 +1730,8 @@ pantheon signup --email you@work.com --username you</code></pre>
         return null;
     }
     commit(sp, partial) {
+        if (sp.deleted)
+            return { ...partial, id: newId("a"), seq: sp.ledger.head, ts: Date.now(), space: sp.name };
         const rec = sp.ledger.append({ ...partial, id: newId("a"), ts: Date.now(), space: sp.name });
         sp.lastTouch = rec.ts;
         const m = sp.members.get(rec.from);