@kvbox/server 0.5.7 → 0.5.9

package/dist/kvbox-server.js

@@ -419,6 +419,12 @@ var CapacitySchema = z3.object({
   reservedVcpu: z3.number().int(),
   running: z3.number().int()
 });
+var RecoveryReportSchema = z3.object({
+  at: z3.string(),
+  booted: z3.array(z3.string()),
+  leftStopped: z3.array(z3.string()),
+  failed: z3.array(z3.object({ box: z3.string(), error: z3.string() }))
+});
 var HealthSchema = z3.object({
   ok: z3.literal(true),
   version: z3.string(),
@@ -442,7 +448,9 @@ var HealthSchema = z3.object({
     publicIp: z3.string(),
     /** The relay's WireGuard endpoint the tunnel dials. */
     endpoint: z3.string()
-  }).nullable().optional()
+  }).nullable().optional(),
+  /** Boxes brought back at the server's last start; null when there were none or it is still at it. Older servers omit it. */
+  recovery: RecoveryReportSchema.nullable().optional()
 });
 var MachineUsageSchema = z3.object({
   name: z3.string(),
@@ -863,250 +871,122 @@ async function requireKvm(device = KVM_DEVICE, groupFile = "/etc/group") {
   );
 }
 
-// src/core/network.ts
-import { randomInt } from "node:crypto";
-import { existsSync } from "node:fs";
-import { fileURLToPath } from "node:url";
-var TAP_PREFIX = "kv-";
-var PRIVILEGED_SCRIPT = "/usr/local/lib/kvbox/net-setup.sh";
-function tapName(box) {
-  return `${TAP_PREFIX}${box}`.slice(0, 15);
-}
-function netSetupScript() {
-  const override = process.env["KVBOX_NET_SETUP"];
-  if (override) return override;
-  if (existsSync(PRIVILEGED_SCRIPT)) return PRIVILEGED_SCRIPT;
-  for (const rel of ["../scripts/net-setup.sh", "../../scripts/net-setup.sh"]) {
-    const candidate = fileURLToPath(new URL(rel, import.meta.url));
-    if (existsSync(candidate)) return candidate;
-  }
-  throw new KvboxError("net-setup.sh not found next to kvbox-server");
-}
-function bridgeExists(bridge) {
-  return existsSync(`/sys/class/net/${bridge}`);
-}
-function netRun(cfg, args) {
-  return run([netSetupScript(), ...args], {
-    env: { ...process.env, KVBOX_BRIDGE: cfg.bridge, KVBOX_SUBNET: cfg.subnet, KVBOX_GATEWAY: cfg.gateway }
-  }).catch((err) => {
-    throw new KvboxError(
-      `${err.message}
-  (root is needed for host networking; install-server.sh sets up a sudoers rule for ${PRIVILEGED_SCRIPT})`
-    );
-  });
-}
-async function netSetup(cfg, args) {
-  await netRun(cfg, args);
-}
-async function ensureHostNetwork(cfg) {
-  if (bridgeExists(cfg.bridge)) return "present";
-  await netRun(cfg, ["up"]);
-  return "created";
-}
-async function createTap(box, cfg, opts = {}) {
-  const tap = tapName(box);
-  await netRun(cfg, ["tap", "add", tap, ...opts.detached ? ["detached"] : []]);
-  return tap;
-}
-async function attachTap(box, cfg) {
-  await netRun(cfg, ["tap", "attach", tapName(box)]);
-}
-async function deleteTap(box, cfg) {
-  await netRun(cfg, ["tap", "del", tapName(box)]);
-}
-var SSH_PORT_MIN = 2e4;
-var SSH_PORT_MAX = 6e4;
-function pickSshPort(taken) {
-  const span = SSH_PORT_MAX - SSH_PORT_MIN + 1;
-  for (let i = 0; i < 32; i++) {
-    const port = SSH_PORT_MIN + randomInt(span);
-    if (!taken.has(port)) return port;
-  }
-  const start = randomInt(span);
-  for (let i = 0; i < span; i++) {
-    const port = SSH_PORT_MIN + (start + i) % span;
-    if (!taken.has(port)) return port;
-  }
-  throw new KvboxError(`no free port left between ${SSH_PORT_MIN} and ${SSH_PORT_MAX} on this host`);
-}
-function parseListeningPorts(ssOutput) {
-  const ports = /* @__PURE__ */ new Set();
-  for (const line of ssOutput.split("\n")) {
-    const cols = line.trim().split(/\s+/);
-    const local = cols[3];
-    if (!local) continue;
-    const port = Number(local.slice(local.lastIndexOf(":") + 1));
-    if (Number.isInteger(port) && port > 0) ports.add(port);
-  }
-  return ports;
-}
-async function listeningPorts() {
-  try {
-    return parseListeningPorts((await run(["ss", "-ltnH"])).stdout);
-  } catch {
-    return /* @__PURE__ */ new Set();
-  }
-}
-var proxyArgs = (p) => [p.box, p.boxIp, String(p.hostPort), String(p.guestPort), p.proto ?? "tcp"];
-async function openProxy(proxy, cfg) {
-  await netRun(cfg, ["proxy", "add", ...proxyArgs(proxy)]);
-}
-async function closeProxy(proxy, cfg) {
-  await netRun(cfg, ["proxy", "rm", ...proxyArgs(proxy)]);
-}
-var ipToInt = (ip) => ip.split(".").reduce((acc, o) => (acc << 8) + Number(o), 0) >>> 0;
-var intToIp = (n) => [24, 16, 8, 0].map((s) => n >>> s & 255).join(".");
-function nextFreeIp(subnet, inUse) {
-  const [base, lenStr] = subnet.split("/");
-  const len = Number(lenStr);
-  if (!base || !Number.isInteger(len) || len < 8 || len > 30) throw new KvboxError(`bad subnet: ${subnet}`);
-  const mask = len === 0 ? 0 : ~0 << 32 - len >>> 0;
-  const network = (ipToInt(base) & mask) >>> 0;
-  const broadcast = (network | ~mask >>> 0) >>> 0;
-  const used = new Set(inUse.map(ipToInt));
-  for (let n = network + 2; n < broadcast; n++) {
-    if (!used.has(n)) return intToIp(n);
-  }
-  throw new KvboxError(`no free IP left in ${subnet}`);
-}
-function macFor(ip) {
-  const hex = ip.split(".").map((o) => Number(o).toString(16).padStart(2, "0").toUpperCase());
-  return ["06", "00", ...hex].join(":");
-}
-
-// src/core/relay.ts
-import { chmod as chmod3, mkdir as mkdir2, rm, writeFile as writeFile2 } from "node:fs/promises";
+// src/core/machines.ts
+import { spawn } from "node:child_process";
+import { closeSync as closeSync2, existsSync as existsSync2, openSync as openSync2, statSync } from "node:fs";
+import { link, mkdir as mkdir3, readFile as readFile5, realpath, rm, truncate, writeFile as writeFile3 } from "node:fs/promises";
+import { basename } from "node:path";
+import { setTimeout as sleep } from "node:timers/promises";
 
-// ../shared/src/relay.ts
-import { z as z4 } from "zod";
-var RELAY_TUNNEL_GATEWAY = "10.77.0.1";
-var IPV4_RE = /^(\d{1,3})(\.\d{1,3}){3}$/;
-var WG_KEY_RE = /^[A-Za-z0-9+/]{43}=$/;
-var RelayJoinSchema = z4.object({
-  v: z4.literal(1),
-  /** How the relay lists this host. */
-  name: z4.string().regex(/^[a-z0-9][a-z0-9-]{0,30}$/),
-  /** `<relay-primary-ip>:<port>`, the WireGuard endpoint the host dials. */
-  relay: z4.string().regex(/^(\d{1,3})(\.\d{1,3}){3}:\d{1,5}$/),
-  /** The relay's WireGuard public key. */
-  relayKey: z4.string().regex(WG_KEY_RE),
-  /** This host's address inside the tunnel. */
-  tunnelIp: z4.string().regex(IPV4_RE),
-  /** This host's WireGuard private key, generated on the relay, kept nowhere else. */
-  privateKey: z4.string().regex(WG_KEY_RE),
-  /** The extra public IPv4 the relay owns for this host; what the host advertises to the control plane. */
-  publicIp: z4.string().regex(IPV4_RE)
-});
-function decodeRelayJoin(text) {
+// src/core/agent.ts
+import { connect } from "node:net";
+var AGENT_PORT = 52;
+async function agentCall(udsPath, req, timeoutMs = 5e3) {
+  const reply = await new Promise((resolve, reject) => {
+    const sock = connect(udsPath);
+    let buf = "";
+    let handshaken = false;
+    const fail = (err) => {
+      sock.destroy();
+      reject(err);
+    };
+    sock.setTimeout(timeoutMs, () => fail(new KvboxError(`kvbox-agent did not answer within ${timeoutMs} ms`)));
+    sock.once("error", (err) => fail(new KvboxError(`kvbox-agent unreachable: ${err.message}`)));
+    sock.once("connect", () => sock.write(`CONNECT ${AGENT_PORT}
+`));
+    sock.on("data", (chunk) => {
+      buf += chunk.toString("utf8");
+      let nl;
+      while ((nl = buf.indexOf("\n")) !== -1) {
+        const line = buf.slice(0, nl);
+        buf = buf.slice(nl + 1);
+        if (!handshaken) {
+          if (!line.startsWith("OK ")) return fail(new KvboxError(`vsock connect refused: ${line}`));
+          handshaken = true;
+          sock.write(JSON.stringify(req) + "\n");
+        } else {
+          sock.end();
+          return resolve(line);
+        }
+      }
+    });
+    sock.once("close", () => {
+      if (!handshaken) fail(new KvboxError("vsock connection closed before the guest accepted"));
+      else fail(new KvboxError("kvbox-agent closed the connection without a reply"));
+    });
+  });
   let parsed;
   try {
-    parsed = JSON.parse(Buffer.from(text.trim(), "base64url").toString("utf8"));
+    parsed = JSON.parse(reply);
   } catch {
-    return null;
+    throw new KvboxError(`kvbox-agent sent something that is not JSON: ${reply}`);
   }
-  const res = RelayJoinSchema.safeParse(parsed);
-  return res.success ? res.data : null;
-}
-
-// src/core/relay.ts
-function relayConf(join2) {
-  return [
-    "# kvbox relay tunnel: made by `kvbox server relay`, installed by net-setup.sh. Do not edit.",
-    "[Interface]",
-    `PrivateKey = ${join2.privateKey}`,
-    `Address = ${join2.tunnelIp}/32`,
-    "",
-    "[Peer]",
-    `PublicKey = ${join2.relayKey}`,
-    `Endpoint = ${join2.relay}`,
-    // Only the relay's own tunnel address goes through the tunnel: the host keeps its normal internet
-    // route, and the relay SNATs forwarded connections so their replies come back this way.
-    `AllowedIPs = ${RELAY_TUNNEL_GATEWAY}/32`,
-    // The router forgets an idle outbound mapping; a packet every 25 s keeps the relay able to reach us.
-    "PersistentKeepalive = 25",
-    ""
-  ].join("\n");
+  if (!parsed.ok) throw new KvboxError(`kvbox-agent: ${parsed.error}`);
+  return parsed;
 }
-async function useRelay(joinString, p = paths()) {
-  const join2 = decodeRelayJoin(joinString);
-  if (!join2) throw new KvboxError("that is not a relay join string; copy the whole line `kvbox-relay add` printed on the relay");
-  const cfg = await loadConfig(p);
-  if (cfg.relay && cfg.relay.name !== join2.name) {
-    throw new KvboxError(`this host already goes through relay ${cfg.relay.name} (${cfg.relay.publicIp}); run kvbox server relay off first`);
-  }
-  if (cfg.relay && cfg.relay.publicIp !== join2.publicIp && cfg.controlPlane?.advertise === cfg.relay.publicIp) {
-    throw new KvboxError(
-      `${cfg.controlPlane.name} reaches this host at ${cfg.relay.publicIp}, not ${join2.publicIp}; run kvbox server leave first, then join again`
-    );
-  }
-  await mkdir2(p.relay, { recursive: true, mode: 448 });
-  await writeFile2(p.relayConf, relayConf(join2), { mode: 384 });
-  await chmod3(p.relayConf, 384);
-  await netSetup(cfg, ["relay", "up", p.relayConf, String(cfg.controlPlane?.port ?? DEFAULT_HTTPS_PORT)]);
-  const relay = { name: join2.name, publicIp: join2.publicIp, tunnelIp: join2.tunnelIp, endpoint: join2.relay };
-  await saveConfig({ ...cfg, relay }, p);
-  return relay;
+function setIdentity(udsPath, id, timeoutMs) {
+  return agentCall(udsPath, { op: "identity", ...id }, timeoutMs);
 }
-async function dropRelay(p = paths()) {
-  const cfg = await loadConfig(p);
-  const relay = cfg.relay;
-  if (!relay) throw new KvboxError("this host does not go through a relay");
-  if (cfg.controlPlane?.advertise === relay.publicIp) {
-    throw new KvboxError(`${cfg.controlPlane.name} reaches this host through the relay (${relay.publicIp}); run kvbox server leave first`);
-  }
-  await netSetup(cfg, ["relay", "down"]);
-  await rm(p.relayConf, { force: true });
-  const { relay: _gone, ...rest } = cfg;
-  await saveConfig(rest, p);
-  return relay;
+function setAuthorizedKeys(udsPath, lines, timeoutMs) {
+  return agentCall(udsPath, { op: "authorizedKeys", lines: [...lines] }, timeoutMs);
 }
+var isUnknownOp = (err) => /unknown op/.test(err.message ?? "");
 
-// src/listen.ts
-import { readFile as readFile6, rm as rm4, writeFile as writeFile5 } from "node:fs/promises";
-import { createServer as createHttpsServer } from "node:https";
-import { createAdaptorServer } from "@hono/node-server";
+// src/core/capacity.ts
+import { cpus, totalmem } from "node:os";
+
+// ../shared/src/capacity.ts
+var MEM_HEADROOM_MIB = 2048;
+var VCPU_OVERSUBSCRIPTION = 2;
 
 // src/core/state.ts
 import { randomBytes } from "node:crypto";
-import { mkdir as mkdir3, readFile as readFile4, readdir, writeFile as writeFile3 } from "node:fs/promises";
-import { z as z5 } from "zod";
-var MachineMetaSchema = z5.object({
+import { readFileSync } from "node:fs";
+import { mkdir as mkdir2, readFile as readFile4, readdir, writeFile as writeFile2 } from "node:fs/promises";
+import { z as z4 } from "zod";
+var MachineMetaSchema = z4.object({
   /** Host-unique, minted at `kvbox new` (fresh or restored) and kept for the box's life; the tap is `kv-<id>`. */
-  id: z5.string(),
-  name: z5.string(),
+  id: z4.string(),
+  name: z4.string(),
   /** Part of the box's identity: machines/<owner>/<name>. See refs.ts. */
-  owner: z5.string(),
-  ip: z5.string(),
-  mac: z5.string(),
-  pid: z5.number().int().nullable(),
+  owner: z4.string(),
+  ip: z4.string(),
+  mac: z4.string(),
+  pid: z4.number().int().nullable(),
   // null: stopped on purpose, disk kept
-  vcpu: z5.number().int(),
-  memMib: z5.number().int(),
-  createdAt: z5.string(),
-  source: z5.string(),
+  /**
+   * The host boot `pid` belongs to (/proc/sys/kernel/random/boot_id at launch, #29). After a reboot
+   * the number can name some other process; a pid from another boot is dead whatever `kill -0` says.
+   * Absent (boxes launched before #29): the pid alone decides.
+   */
+  bootId: z4.string().optional(),
+  vcpu: z4.number().int(),
+  memMib: z4.number().int(),
+  createdAt: z4.string(),
+  source: z4.string(),
   /** Base image version (assets/rootfs-<version>.ext4) the box's overlay stacks on. */
-  base: z5.string(),
+  base: z4.string(),
   /**
    * Snapshots taken since this VM started (boot or restore). Firecracker resets its dirty-page bitmap at
    * each one, so when this is > 0 the next diff is only standalone merged onto `mem.base`; if that file
    * is missing the lineage is broken and the next snapshot has to be a full dump. Absent: 0.
    */
-  memSnapshots: z5.number().int().optional(),
+  memSnapshots: z4.number().int().optional(),
   /** `kvbox pause`: Firecracker is alive but the VM is frozen (standby). Absent: not paused. */
-  paused: z5.boolean().optional(),
+  paused: z4.boolean().optional(),
   /**
    * authorized_keys lines the box gets on top of the host's own key, as the control plane sent them
    * at `new` (#49). kvbox-init rewrites authorized_keys from the kernel cmdline at every boot, so
    * `start` has to send the same lines again. Absent: host key only.
    */
-  sshKeys: z5.array(z5.string()).optional(),
+  sshKeys: z4.array(z4.string()).optional(),
   /**
    * The guest's authorized_keys may not match `sshKeys`: they changed while the box was not running,
    * or its agent could not take them (#55, #63). Cleared by a push through kvbox-agent or a boot.
    */
-  sshKeysStale: z5.boolean().optional(),
+  sshKeysStale: z4.boolean().optional(),
   /** Public port on the host DNATed to the box's SSH while it runs (#49); fixed for the box's life. Absent: none. */
-  sshPort: z5.number().int().optional()
+  sshPort: z4.number().int().optional()
 });
 function newBoxId(taken) {
   for (; ; ) {
@@ -1114,20 +994,20 @@ function newBoxId(taken) {
     if (!taken.has(id)) return id;
   }
 }
-var SnapshotMetaSchema = z5.object({
-  name: z5.string(),
-  owner: z5.string(),
+var SnapshotMetaSchema = z4.object({
+  name: z4.string(),
+  owner: z4.string(),
   /** The box it was taken from, as owner/name. */
-  source: z5.string(),
-  base: z5.string(),
-  vcpu: z5.number().int(),
-  memMib: z5.number().int(),
-  sizeBytes: z5.number().int(),
-  createdAt: z5.string()
+  source: z4.string(),
+  base: z4.string(),
+  vcpu: z4.number().int(),
+  memMib: z4.number().int(),
+  sizeBytes: z4.number().int(),
+  createdAt: z4.string()
 });
 async function ensureLayout(p = paths()) {
   for (const dir of [p.home, p.ssh, p.bin, p.assets, p.machines, p.snapshots]) {
-    await mkdir3(dir, { recursive: true, mode: 448 });
+    await mkdir2(dir, { recursive: true, mode: 448 });
   }
   return p;
 }
@@ -1148,8 +1028,8 @@ async function readMachineMeta(ref, p = paths()) {
 }
 async function writeMachineMeta(meta, p = paths()) {
   const m = p.machine(meta.owner, meta.name);
-  await mkdir3(m.dir, { recursive: true });
-  await writeFile3(m.meta, JSON.stringify(meta, null, 2) + "\n");
+  await mkdir2(m.dir, { recursive: true });
+  await writeFile2(m.meta, JSON.stringify(meta, null, 2) + "\n");
 }
 async function listMachineRefs(p = paths()) {
   return listRefs(p.machines);
@@ -1159,8 +1039,8 @@ async function readSnapshotMeta(ref, p = paths()) {
 }
 async function writeSnapshotMeta(meta, p = paths()) {
   const s = p.snapshot(meta.owner, meta.name);
-  await mkdir3(s.dir, { recursive: true });
-  await writeFile3(s.meta, JSON.stringify(meta, null, 2) + "\n");
+  await mkdir2(s.dir, { recursive: true });
+  await writeFile2(s.meta, JSON.stringify(meta, null, 2) + "\n");
 }
 async function listSnapshotRefs(p = paths()) {
   return listRefs(p.snapshots);
@@ -1183,131 +1063,29 @@ function pidAlive(pid) {
     return err.code === "EPERM";
   }
 }
-
-// src/app.ts
-import { Hono as Hono6 } from "hono";
-
-// ../shared/src/version.ts
-import { createRequire } from "node:module";
-function versionOf(srcFileUrl, injected) {
-  if (typeof injected === "string") return injected;
-  try {
-    const require2 = createRequire(srcFileUrl);
-    return require2("../package.json").version;
-  } catch {
-    return "0.0.0-dev";
-  }
-}
-
-// src/version.ts
-var VERSION = versionOf(import.meta.url, true ? "0.5.7" : void 0);
-
-// src/caller.ts
-import { createHash as createHash2, timingSafeEqual } from "node:crypto";
-var OWNER_HEADER = "x-kvbox-owner";
-function resolveCaller(opts = {}) {
-  const cp = opts.controlPlane;
-  if (!cp) {
-    return async (c, next) => {
-      const cfg = await loadConfig();
-      c.set("owner", cfg.owner);
-      c.set("listScope", cfg.owner);
-      await next();
-    };
-  }
-  const expected = digest(cp.secret);
-  return async (c, next) => {
-    const m = /^Bearer\s+(\S+)$/i.exec(c.req.header("authorization") ?? "");
-    if (!m || !timingSafeEqual(digest(m[1]), expected)) return c.json({ error: "not authorized" }, 401);
-    const user = c.req.header(OWNER_HEADER);
-    if (user === void 0) {
-      const path = c.req.path.replace(/\/$/, "");
-      const realmListing = c.req.method === "GET" && (path === "/machines" || path === "/snapshots");
-      if (!realmListing && /^\/(machines|snapshots)(\/|$)/.test(c.req.path)) {
-        return c.json({ error: "X-Kvbox-Owner header required" }, 400);
-      }
-      c.set("owner", "");
-      c.set("listScope", { realm: cp.name });
-    } else {
-      if (!LOCAL_OWNER_RE.test(user)) return c.json({ error: "X-Kvbox-Owner: letters, digits, '.', '_', '-'" }, 400);
-      const owner = `${user}@${cp.name}`;
-      c.set("owner", owner);
-      c.set("listScope", owner);
+var bootId;
+function currentBootId() {
+  if (bootId === void 0) {
+    try {
+      bootId = { id: readFileSync("/proc/sys/kernel/random/boot_id", "utf8").trim() };
+    } catch {
+      bootId = { id: void 0 };
     }
-    await next();
-  };
+  }
+  return bootId.id;
 }
-function digest(secret) {
-  return createHash2("sha256").update(secret).digest();
+function vmAlive(meta) {
+  if (meta.bootId !== void 0 && meta.bootId !== currentBootId()) return false;
+  return pidAlive(meta.pid);
 }
-
-// src/core/machines.ts
-import { spawn } from "node:child_process";
-import { closeSync as closeSync2, existsSync as existsSync2, openSync as openSync2, statSync } from "node:fs";
-import { link, mkdir as mkdir4, readFile as readFile5, realpath, rm as rm2, truncate, writeFile as writeFile4 } from "node:fs/promises";
-import { basename } from "node:path";
-import { setTimeout as sleep } from "node:timers/promises";
-
-// src/core/agent.ts
-import { connect } from "node:net";
-var AGENT_PORT = 52;
-async function agentCall(udsPath, req, timeoutMs = 5e3) {
-  const reply = await new Promise((resolve, reject) => {
-    const sock = connect(udsPath);
-    let buf = "";
-    let handshaken = false;
-    const fail = (err) => {
-      sock.destroy();
-      reject(err);
-    };
-    sock.setTimeout(timeoutMs, () => fail(new KvboxError(`kvbox-agent did not answer within ${timeoutMs} ms`)));
-    sock.once("error", (err) => fail(new KvboxError(`kvbox-agent unreachable: ${err.message}`)));
-    sock.once("connect", () => sock.write(`CONNECT ${AGENT_PORT}
-`));
-    sock.on("data", (chunk) => {
-      buf += chunk.toString("utf8");
-      let nl;
-      while ((nl = buf.indexOf("\n")) !== -1) {
-        const line = buf.slice(0, nl);
-        buf = buf.slice(nl + 1);
-        if (!handshaken) {
-          if (!line.startsWith("OK ")) return fail(new KvboxError(`vsock connect refused: ${line}`));
-          handshaken = true;
-          sock.write(JSON.stringify(req) + "\n");
-        } else {
-          sock.end();
-          return resolve(line);
-        }
-      }
-    });
-    sock.once("close", () => {
-      if (!handshaken) fail(new KvboxError("vsock connection closed before the guest accepted"));
-      else fail(new KvboxError("kvbox-agent closed the connection without a reply"));
-    });
-  });
-  let parsed;
+function hostBootTime() {
   try {
-    parsed = JSON.parse(reply);
+    const m = /^btime (\d+)$/m.exec(readFileSync("/proc/stat", "utf8"));
+    return m ? new Date(Number(m[1]) * 1e3) : null;
   } catch {
-    throw new KvboxError(`kvbox-agent sent something that is not JSON: ${reply}`);
+    return null;
   }
-  if (!parsed.ok) throw new KvboxError(`kvbox-agent: ${parsed.error}`);
-  return parsed;
-}
-function setIdentity(udsPath, id, timeoutMs) {
-  return agentCall(udsPath, { op: "identity", ...id }, timeoutMs);
-}
-function setAuthorizedKeys(udsPath, lines, timeoutMs) {
-  return agentCall(udsPath, { op: "authorizedKeys", lines: [...lines] }, timeoutMs);
 }
-var isUnknownOp = (err) => /unknown op/.test(err.message ?? "");
-
-// src/core/capacity.ts
-import { cpus, totalmem } from "node:os";
-
-// ../shared/src/capacity.ts
-var MEM_HEADROOM_MIB = 2048;
-var VCPU_OVERSUBSCRIPTION = 2;
 
 // src/core/capacity.ts
 function hostResources() {
@@ -1318,7 +1096,7 @@ async function runningReservations(p = paths()) {
   for (const ref of await listMachineRefs(p)) {
     try {
       const meta = await readMachineMeta(ref, p);
-      if (pidAlive(meta.pid)) out.push({ name: meta.name, vcpu: meta.vcpu, memMib: meta.memMib });
+      if (vmAlive(meta)) out.push({ name: meta.name, vcpu: meta.vcpu, memMib: meta.memMib });
     } catch {
     }
   }
@@ -1447,6 +1225,10 @@ function closeOpenRun(boxId, at, p = paths()) {
   insertRaw({ ...last, at, state: "stopped", by: "server" }, db);
   return true;
 }
+function closeRunCutByBoot(boxId, bootAt, now, p = paths()) {
+  const last = lastEvent(boxId, openDb(p));
+  return closeOpenRun(boxId, last !== void 0 && last.at < bootAt ? bootAt : now, p);
+}
 function usageEventsFor(boxId, since, p = paths()) {
   const rows = openDb(p).prepare("select * from usage_events where box_id = ? and at >= ? order by at, id").all(boxId, since);
   return rows.map(fromRaw);
@@ -1543,39 +1325,150 @@ var FirecrackerClient = class {
   resume() {
     return this.call("PATCH", "/vm", { state: "Resumed" });
   }
-  /**
-   * Full: all of guest memory, dense (seconds for a 4 GB box). Diff: only pages dirtied since the last
-   * snapshot (or since boot), written sparse; needs dirty page tracking and resets its bitmap.
-   */
-  snapshotCreate(snapshotPath, memFilePath, type = "Full") {
-    return this.call("PUT", "/snapshot/create", {
-      snapshot_type: type,
-      snapshot_path: snapshotPath,
-      mem_file_path: memFilePath
-    });
+  /**
+   * Full: all of guest memory, dense (seconds for a 4 GB box). Diff: only pages dirtied since the last
+   * snapshot (or since boot), written sparse; needs dirty page tracking and resets its bitmap.
+   */
+  snapshotCreate(snapshotPath, memFilePath, type = "Full") {
+    return this.call("PUT", "/snapshot/create", {
+      snapshot_type: type,
+      snapshot_path: snapshotPath,
+      mem_file_path: memFilePath
+    });
+  }
+  /**
+   * Restore a snapshot into this (fresh) process. The memory file is mapped privately: the guest's
+   * writes never reach the snapshot. The vmstate carries the source box's tap and vsock paths; the
+   * overrides point them at this box's. Drive paths are not overridable here: the vmstate names the overlay relative to the box dir (spawnFirecracker).
+   */
+  snapshotLoad(opts) {
+    return this.call("PUT", "/snapshot/load", {
+      snapshot_path: opts.snapshotPath,
+      mem_backend: { backend_type: "File", backend_path: opts.memFilePath },
+      network_overrides: [{ iface_id: opts.tap.ifaceId, host_dev_name: opts.tap.hostDevName }],
+      vsock_override: { uds_path: opts.vsockPath },
+      track_dirty_pages: opts.trackDirtyPages,
+      resume_vm: opts.resume
+    });
+  }
+  info() {
+    return this.call("GET", "/");
+  }
+  async close() {
+    await this.agent.close();
+  }
+};
+
+// src/core/network.ts
+import { randomInt } from "node:crypto";
+import { existsSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+var TAP_PREFIX = "kv-";
+var PRIVILEGED_SCRIPT = "/usr/local/lib/kvbox/net-setup.sh";
+function tapName(box) {
+  return `${TAP_PREFIX}${box}`.slice(0, 15);
+}
+function netSetupScript() {
+  const override = process.env["KVBOX_NET_SETUP"];
+  if (override) return override;
+  if (existsSync(PRIVILEGED_SCRIPT)) return PRIVILEGED_SCRIPT;
+  for (const rel of ["../scripts/net-setup.sh", "../../scripts/net-setup.sh"]) {
+    const candidate = fileURLToPath(new URL(rel, import.meta.url));
+    if (existsSync(candidate)) return candidate;
+  }
+  throw new KvboxError("net-setup.sh not found next to kvbox-server");
+}
+function bridgeExists(bridge) {
+  return existsSync(`/sys/class/net/${bridge}`);
+}
+function netRun(cfg, args) {
+  return run([netSetupScript(), ...args], {
+    env: { ...process.env, KVBOX_BRIDGE: cfg.bridge, KVBOX_SUBNET: cfg.subnet, KVBOX_GATEWAY: cfg.gateway }
+  }).catch((err) => {
+    throw new KvboxError(
+      `${err.message}
+  (root is needed for host networking; install-server.sh sets up a sudoers rule for ${PRIVILEGED_SCRIPT})`
+    );
+  });
+}
+async function netSetup(cfg, args) {
+  await netRun(cfg, args);
+}
+async function ensureHostNetwork(cfg) {
+  if (bridgeExists(cfg.bridge)) return "present";
+  await netRun(cfg, ["up"]);
+  return "created";
+}
+async function createTap(box, cfg, opts = {}) {
+  const tap = tapName(box);
+  await netRun(cfg, ["tap", "add", tap, ...opts.detached ? ["detached"] : []]);
+  return tap;
+}
+async function attachTap(box, cfg) {
+  await netRun(cfg, ["tap", "attach", tapName(box)]);
+}
+async function deleteTap(box, cfg) {
+  await netRun(cfg, ["tap", "del", tapName(box)]);
+}
+var SSH_PORT_MIN = 2e4;
+var SSH_PORT_MAX = 6e4;
+function pickSshPort(taken) {
+  const span = SSH_PORT_MAX - SSH_PORT_MIN + 1;
+  for (let i = 0; i < 32; i++) {
+    const port = SSH_PORT_MIN + randomInt(span);
+    if (!taken.has(port)) return port;
+  }
+  const start = randomInt(span);
+  for (let i = 0; i < span; i++) {
+    const port = SSH_PORT_MIN + (start + i) % span;
+    if (!taken.has(port)) return port;
   }
-  /**
-   * Restore a snapshot into this (fresh) process. The memory file is mapped privately: the guest's
-   * writes never reach the snapshot. The vmstate carries the source box's tap and vsock paths; the
-   * overrides point them at this box's. Drive paths are not overridable here: the vmstate names the overlay relative to the box dir (spawnFirecracker).
-   */
-  snapshotLoad(opts) {
-    return this.call("PUT", "/snapshot/load", {
-      snapshot_path: opts.snapshotPath,
-      mem_backend: { backend_type: "File", backend_path: opts.memFilePath },
-      network_overrides: [{ iface_id: opts.tap.ifaceId, host_dev_name: opts.tap.hostDevName }],
-      vsock_override: { uds_path: opts.vsockPath },
-      track_dirty_pages: opts.trackDirtyPages,
-      resume_vm: opts.resume
-    });
+  throw new KvboxError(`no free port left between ${SSH_PORT_MIN} and ${SSH_PORT_MAX} on this host`);
+}
+function parseListeningPorts(ssOutput) {
+  const ports = /* @__PURE__ */ new Set();
+  for (const line of ssOutput.split("\n")) {
+    const cols = line.trim().split(/\s+/);
+    const local = cols[3];
+    if (!local) continue;
+    const port = Number(local.slice(local.lastIndexOf(":") + 1));
+    if (Number.isInteger(port) && port > 0) ports.add(port);
   }
-  info() {
-    return this.call("GET", "/");
+  return ports;
+}
+async function listeningPorts() {
+  try {
+    return parseListeningPorts((await run(["ss", "-ltnH"])).stdout);
+  } catch {
+    return /* @__PURE__ */ new Set();
   }
-  async close() {
-    await this.agent.close();
+}
+var proxyArgs = (p) => [p.box, p.boxIp, String(p.hostPort), String(p.guestPort), p.proto ?? "tcp"];
+async function openProxy(proxy, cfg) {
+  await netRun(cfg, ["proxy", "add", ...proxyArgs(proxy)]);
+}
+async function closeProxy(proxy, cfg) {
+  await netRun(cfg, ["proxy", "rm", ...proxyArgs(proxy)]);
+}
+var ipToInt = (ip) => ip.split(".").reduce((acc, o) => (acc << 8) + Number(o), 0) >>> 0;
+var intToIp = (n) => [24, 16, 8, 0].map((s) => n >>> s & 255).join(".");
+function nextFreeIp(subnet, inUse) {
+  const [base, lenStr] = subnet.split("/");
+  const len = Number(lenStr);
+  if (!base || !Number.isInteger(len) || len < 8 || len > 30) throw new KvboxError(`bad subnet: ${subnet}`);
+  const mask = len === 0 ? 0 : ~0 << 32 - len >>> 0;
+  const network = (ipToInt(base) & mask) >>> 0;
+  const broadcast = (network | ~mask >>> 0) >>> 0;
+  const used = new Set(inUse.map(ipToInt));
+  for (let n = network + 2; n < broadcast; n++) {
+    if (!used.has(n)) return intToIp(n);
   }
-};
+  throw new KvboxError(`no free IP left in ${subnet}`);
+}
+function macFor(ip) {
+  const hex = ip.split(".").map((o) => Number(o).toString(16).padStart(2, "0").toUpperCase());
+  return ["06", "00", ...hex].join(":");
+}
 
 // src/core/machines.ts
 var NAME_RE = /^[a-z0-9][a-z0-9-]{0,11}$/;
@@ -1624,17 +1517,17 @@ function recordState(meta, state, by, p, at = (/* @__PURE__ */ new Date()).toISO
   }
 }
 function isHibernated(meta, p) {
-  return !pidAlive(meta.pid) && existsSync2(p.machine(meta.owner, meta.name).hibernateVmstate);
+  return !vmAlive(meta) && existsSync2(p.machine(meta.owner, meta.name).hibernateVmstate);
 }
 function statusOf(meta, p = paths()) {
-  if (pidAlive(meta.pid)) return meta.paused ? "standby" : "running";
+  if (vmAlive(meta)) return meta.paused ? "standby" : "running";
   return isHibernated(meta, p) ? "hibernated" : "stopped";
 }
 function stateMessage(ref, status) {
   return `box ${shown(ref)} is ${status === "standby" ? "in standby" : status}`;
 }
 function toMachine(meta, p = paths()) {
-  const alive = pidAlive(meta.pid);
+  const alive = vmAlive(meta);
   if (!alive && meta.pid !== null) {
     try {
       closeOpenRun(meta.id, (/* @__PURE__ */ new Date()).toISOString(), p);
@@ -1739,7 +1632,7 @@ async function assertOverlayCapable(baseFile, version) {
   if (!ok) throw new KvboxError(`base image ${version} is not a kvbox base image (no /sbin/overlay-init); rerun install-server.sh`);
 }
 async function createOverlay(file, gib) {
-  await writeFile4(file, "", { mode: 384 });
+  await writeFile3(file, "", { mode: 384 });
   await truncate(file, gib * 1024 ** 3);
   await run(["mkfs.ext4", "-q", "-F", "-m", "0", "-L", "kvbox-box", "-E", "lazy_itable_init=1,lazy_journal_init=1", file]);
 }
@@ -1760,8 +1653,8 @@ async function tailOf(file, lines = 5) {
 }
 async function spawnFirecracker(ref, cfg, p) {
   const m = p.machine(ref.owner, ref.name);
-  await rm2(m.sock, { force: true });
-  await rm2(m.vsock, { force: true });
+  await rm(m.sock, { force: true });
+  await rm(m.vsock, { force: true });
   const logFd = openSync2(m.log, "a");
   let child;
   try {
@@ -1871,7 +1764,7 @@ async function createMachine(req, owner, p = paths()) {
   const base = await currentBase(cfg, p);
   await assertOverlayCapable(base.file, base.version);
   await ensureHostNetwork(cfg);
-  await mkdir4(m.dir, { recursive: true, mode: 448 });
+  await mkdir3(m.dir, { recursive: true, mode: 448 });
   let tapCreated = false;
   let pid;
   try {
@@ -1881,7 +1774,7 @@ async function createMachine(req, owner, p = paths()) {
     const spec = { id, name, owner, ip, mac, vcpu: size.vcpu, memMib: size.memMib, base: base.version, sshKeys, sshPort };
     pid = await launch(spec, tap, cfg, keysB64, p);
     await openSshPort(spec, cfg);
-    const meta = { ...spec, pid, createdAt: (/* @__PURE__ */ new Date()).toISOString(), source: "base" };
+    const meta = { ...spec, pid, bootId: currentBootId(), createdAt: (/* @__PURE__ */ new Date()).toISOString(), source: "base" };
     await writeMachineMeta(meta, p);
     recordState(meta, "running", "new", p, meta.createdAt);
     return toMachine(meta, p);
@@ -1889,7 +1782,7 @@ async function createMachine(req, owner, p = paths()) {
     if (pid !== void 0) killQuietly(pid);
     await closeSshPort({ id, ip, sshPort }, cfg);
     if (tapCreated) await deleteTap(id, cfg).catch(() => void 0);
-    await rm2(m.dir, { recursive: true, force: true });
+    await rm(m.dir, { recursive: true, force: true });
     throw err;
   }
 }
@@ -1927,7 +1820,7 @@ async function restoreMachine(fromText, owner, req, cfg, p) {
   const m = p.machine(owner, name);
   const s = p.snapshot(from.owner, from.name);
   await ensureHostNetwork(cfg);
-  await mkdir4(m.dir, { recursive: true, mode: 448 });
+  await mkdir3(m.dir, { recursive: true, mode: 448 });
   let tapCreated = false;
   let pid;
   try {
@@ -1945,7 +1838,7 @@ async function restoreMachine(fromText, owner, req, cfg, p) {
     const stale = await pushAuthorizedKeys({ owner, name, sshKeys }, m.vsock, p);
     await attachTap(id, cfg);
     await openSshPort(spec, cfg);
-    const meta = { ...spec, pid, createdAt: (/* @__PURE__ */ new Date()).toISOString(), source: `snapshot:${refKey(from)}`, memSnapshots: 1, sshKeysStale: stale ? true : void 0 };
+    const meta = { ...spec, pid, bootId: currentBootId(), createdAt: (/* @__PURE__ */ new Date()).toISOString(), source: `snapshot:${refKey(from)}`, memSnapshots: 1, sshKeysStale: stale ? true : void 0 };
     await writeMachineMeta(meta, p);
     recordState(meta, "running", "new", p, meta.createdAt);
     return toMachine(meta, p);
@@ -1953,7 +1846,7 @@ async function restoreMachine(fromText, owner, req, cfg, p) {
     if (pid !== void 0) killQuietly(pid);
     await closeSshPort({ id, ip, sshPort }, cfg);
     if (tapCreated) await deleteTap(id, cfg).catch(() => void 0);
-    await rm2(m.dir, { recursive: true, force: true });
+    await rm(m.dir, { recursive: true, force: true });
     throw err;
   }
 }
@@ -1999,7 +1892,7 @@ async function resumeVm(sock) {
 }
 async function shutdown(meta, cfg, p, graceMs) {
   const pid = meta.pid;
-  if (pidAlive(pid)) {
+  if (vmAlive(meta)) {
     const fc = new FirecrackerClient(p.machine(meta.owner, meta.name).sock);
     try {
       if (meta.paused) await fc.resume();
@@ -2023,17 +1916,17 @@ async function cleanupProcess(meta, cfg, p) {
   await closeSshPort(meta, cfg);
   await deleteTap(meta.id, cfg);
   const m = p.machine(meta.owner, meta.name);
-  await rm2(m.sock, { force: true });
-  await rm2(m.vsock, { force: true });
+  await rm(m.sock, { force: true });
+  await rm(m.vsock, { force: true });
 }
 async function stopMachine(ref, p = paths()) {
   const meta = await readMeta(ref, p);
   const cfg = await loadConfig(p);
   const m = p.machine(ref.owner, ref.name);
-  if (!pidAlive(meta.pid) && !isHibernated(meta, p)) throw new KvboxError(`box ${shown(ref)} is already stopped`);
+  if (!vmAlive(meta) && !isHibernated(meta, p)) throw new KvboxError(`box ${shown(ref)} is already stopped`);
   await shutdown(meta, cfg, p, 1e4);
-  await rm2(m.hibernateDir, { recursive: true, force: true });
-  await rm2(m.memBase, { force: true });
+  await rm(m.hibernateDir, { recursive: true, force: true });
+  await rm(m.memBase, { force: true });
   const stopped = { ...meta, pid: null, memSnapshots: void 0, paused: void 0 };
   await writeMachineMeta(stopped, p);
   recordState(stopped, "stopped", "stop", p);
@@ -2042,7 +1935,7 @@ async function stopMachine(ref, p = paths()) {
 async function startMachine(ref, p = paths()) {
   const meta = await readMeta(ref, p);
   const cfg = await loadConfig(p);
-  if (pidAlive(meta.pid)) throw new KvboxError(`box ${shown(ref)} is already ${meta.paused ? "up, in standby (kvbox resume " + shown(ref) + ")" : "running"}`);
+  if (vmAlive(meta)) throw new KvboxError(`box ${shown(ref)} is already ${meta.paused ? "up, in standby (kvbox resume " + shown(ref) + ")" : "running"}`);
   if (isHibernated(meta, p)) {
     throw new KvboxError(`${stateMessage(ref, "hibernated")}: kvbox wake ${shown(ref)} continues where it left off; to boot fresh instead, kvbox stop ${shown(ref)} first (discards its memory)`);
   }
@@ -2054,7 +1947,7 @@ async function startMachine(ref, p = paths()) {
   try {
     pid = await launch(meta, tap, cfg, keysB64, p);
     await openSshPort(meta, cfg);
-    const started = { ...meta, pid, sshKeysStale: void 0 };
+    const started = { ...meta, pid, bootId: currentBootId(), sshKeysStale: void 0 };
     await writeMachineMeta(started, p);
     recordState(started, "running", "start", p);
     return toMachine(started, p);
@@ -2148,15 +2041,15 @@ async function hibernateMachine(ref, p = paths()) {
   if (status === "hibernated") throw new KvboxError(`${stateMessage(ref, status)} already`);
   if (status === "stopped") throw new KvboxError(`${stateMessage(ref, status)}; only a running box can be hibernated (there is no memory to keep)`);
   const m = p.machine(ref.owner, ref.name);
-  await rm2(m.hibernateDir, { recursive: true, force: true });
-  await mkdir4(m.hibernateDir, { recursive: true, mode: 448 });
+  await rm(m.hibernateDir, { recursive: true, force: true });
+  await mkdir3(m.hibernateDir, { recursive: true, mode: 448 });
   const fc = new FirecrackerClient(m.sock);
   try {
     try {
       await fc.pause();
       await fc.snapshotCreate(m.hibernateVmstate, m.hibernateMem, "Full");
     } catch (err) {
-      await rm2(m.hibernateDir, { recursive: true, force: true });
+      await rm(m.hibernateDir, { recursive: true, force: true });
       if (!meta.paused) await fc.resume().catch(() => void 0);
       throw err;
     }
@@ -2167,7 +2060,7 @@ async function hibernateMachine(ref, p = paths()) {
   await waitFor(() => !pidAlive(meta.pid), 5e3, 50);
   await cleanupProcess(meta, cfg, p);
   await run(["fallocate", "--dig-holes", m.hibernateMem]);
-  await rm2(m.memBase, { force: true });
+  await rm(m.memBase, { force: true });
   const hibernated = { ...meta, pid: null, memSnapshots: void 0, paused: void 0 };
   await writeMachineMeta(hibernated, p);
   recordState(hibernated, "hibernated", "hibernate", p);
@@ -2205,19 +2098,19 @@ async function wakeMachine(ref, p = paths()) {
     await deleteTap(meta.id, cfg).catch(() => void 0);
     throw err;
   }
-  await rm2(m.memBase, { force: true });
+  await rm(m.memBase, { force: true });
   await link(m.hibernateMem, m.memBase);
-  await rm2(m.hibernateDir, { recursive: true, force: true });
-  const running = { ...meta, pid, memSnapshots: 1, paused: void 0, sshKeysStale: stale ? true : void 0 };
+  await rm(m.hibernateDir, { recursive: true, force: true });
+  const running = { ...meta, pid, bootId: currentBootId(), memSnapshots: 1, paused: void 0, sshKeysStale: stale ? true : void 0 };
   await writeMachineMeta(running, p);
   recordState(running, "running", "wake", p);
   return toMachine(running, p);
 }
 async function applyAtNextBoot(meta, changes, by, cfg, p, whileStopped) {
-  const wasRunning = pidAlive(meta.pid);
+  const wasRunning = vmAlive(meta);
   if (wasRunning) {
     await shutdown(meta, cfg, p, 1e4);
-    await rm2(p.machine(meta.owner, meta.name).memBase, { force: true });
+    await rm(p.machine(meta.owner, meta.name).memBase, { force: true });
   }
   const updated = { ...meta, ...changes, pid: null, memSnapshots: void 0, paused: void 0 };
   await writeMachineMeta(updated, p);
@@ -2280,7 +2173,216 @@ async function destroyMachine(ref, p = paths()) {
   const cfg = await loadConfig(p);
   await shutdown(meta, cfg, p, 2e3);
   recordState(meta, "stopped", "rm", p);
-  await rm2(p.machine(ref.owner, ref.name).dir, { recursive: true, force: true });
+  await rm(p.machine(ref.owner, ref.name).dir, { recursive: true, force: true });
+}
+var RECOVERY_CONCURRENCY = 2;
+async function settleDeadBoxes(p = paths()) {
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const bootAt = hostBootTime()?.toISOString() ?? now;
+  const boot = [];
+  const leftStopped = [];
+  for (const meta of await readAllMeta(p)) {
+    if (!cutByReboot(meta) || vmAlive(meta)) continue;
+    try {
+      closeRunCutByBoot(meta.id, bootAt, now, p);
+    } catch (err) {
+      console.error(`warning: usage ledger: ${err.message}`);
+    }
+    await rm(p.machine(meta.owner, meta.name).memBase, { force: true });
+    if (meta.paused) {
+      await writeMachineMeta({ ...meta, pid: null, bootId: void 0, memSnapshots: void 0, paused: void 0 }, p);
+      leftStopped.push(refKey(meta));
+    } else {
+      await writeMachineMeta({ ...meta, memSnapshots: void 0 }, p);
+      boot.push({ owner: meta.owner, name: meta.name });
+    }
+  }
+  return { boot, leftStopped };
+}
+function cutByReboot(meta) {
+  return meta.pid !== null && meta.bootId !== currentBootId();
+}
+var recovery = null;
+var recoveryStopping = false;
+var recoveryRun = Promise.resolve();
+function lastRecovery() {
+  return recovery;
+}
+async function stopRecovery() {
+  recoveryStopping = true;
+  await recoveryRun;
+}
+async function bootRecovered(settled, p = paths()) {
+  const refs = settled.boot;
+  if (refs.length === 0 && settled.leftStopped.length === 0) return null;
+  const booted = [];
+  const failed = [];
+  const queue = [...refs];
+  const worker = async () => {
+    for (let ref = queue.shift(); ref !== void 0 && !recoveryStopping; ref = queue.shift()) {
+      try {
+        if (!cutByReboot(await readMeta(ref, p))) continue;
+        await startMachine(ref, p);
+        booted.push(refKey(ref));
+      } catch (err) {
+        failed.push({ box: refKey(ref), error: err.message });
+      }
+    }
+  };
+  const run2 = Promise.all(Array.from({ length: Math.min(RECOVERY_CONCURRENCY, refs.length) }, worker));
+  recoveryRun = run2;
+  await run2;
+  recovery = { at: (/* @__PURE__ */ new Date()).toISOString(), booted, leftStopped: [...settled.leftStopped], failed };
+  return recovery;
+}
+
+// src/core/relay.ts
+import { chmod as chmod3, mkdir as mkdir4, rm as rm2, writeFile as writeFile4 } from "node:fs/promises";
+
+// ../shared/src/relay.ts
+import { z as z5 } from "zod";
+var RELAY_TUNNEL_GATEWAY = "10.77.0.1";
+var IPV4_RE = /^(\d{1,3})(\.\d{1,3}){3}$/;
+var WG_KEY_RE = /^[A-Za-z0-9+/]{43}=$/;
+var RelayJoinSchema = z5.object({
+  v: z5.literal(1),
+  /** How the relay lists this host. */
+  name: z5.string().regex(/^[a-z0-9][a-z0-9-]{0,30}$/),
+  /** `<relay-primary-ip>:<port>`, the WireGuard endpoint the host dials. */
+  relay: z5.string().regex(/^(\d{1,3})(\.\d{1,3}){3}:\d{1,5}$/),
+  /** The relay's WireGuard public key. */
+  relayKey: z5.string().regex(WG_KEY_RE),
+  /** This host's address inside the tunnel. */
+  tunnelIp: z5.string().regex(IPV4_RE),
+  /** This host's WireGuard private key, generated on the relay, kept nowhere else. */
+  privateKey: z5.string().regex(WG_KEY_RE),
+  /** The extra public IPv4 the relay owns for this host; what the host advertises to the control plane. */
+  publicIp: z5.string().regex(IPV4_RE)
+});
+function decodeRelayJoin(text) {
+  let parsed;
+  try {
+    parsed = JSON.parse(Buffer.from(text.trim(), "base64url").toString("utf8"));
+  } catch {
+    return null;
+  }
+  const res = RelayJoinSchema.safeParse(parsed);
+  return res.success ? res.data : null;
+}
+
+// src/core/relay.ts
+function relayConf(join2) {
+  return [
+    "# kvbox relay tunnel: made by `kvbox server relay`, installed by net-setup.sh. Do not edit.",
+    "[Interface]",
+    `PrivateKey = ${join2.privateKey}`,
+    `Address = ${join2.tunnelIp}/32`,
+    "",
+    "[Peer]",
+    `PublicKey = ${join2.relayKey}`,
+    `Endpoint = ${join2.relay}`,
+    // Only the relay's own tunnel address goes through the tunnel: the host keeps its normal internet
+    // route, and the relay SNATs forwarded connections so their replies come back this way.
+    `AllowedIPs = ${RELAY_TUNNEL_GATEWAY}/32`,
+    // The router forgets an idle outbound mapping; a packet every 25 s keeps the relay able to reach us.
+    "PersistentKeepalive = 25",
+    ""
+  ].join("\n");
+}
+async function useRelay(joinString, p = paths()) {
+  const join2 = decodeRelayJoin(joinString);
+  if (!join2) throw new KvboxError("that is not a relay join string; copy the whole line `kvbox-relay add` printed on the relay");
+  const cfg = await loadConfig(p);
+  if (cfg.relay && cfg.relay.name !== join2.name) {
+    throw new KvboxError(`this host already goes through relay ${cfg.relay.name} (${cfg.relay.publicIp}); run kvbox server relay off first`);
+  }
+  if (cfg.relay && cfg.relay.publicIp !== join2.publicIp && cfg.controlPlane?.advertise === cfg.relay.publicIp) {
+    throw new KvboxError(
+      `${cfg.controlPlane.name} reaches this host at ${cfg.relay.publicIp}, not ${join2.publicIp}; run kvbox server leave first, then join again`
+    );
+  }
+  await mkdir4(p.relay, { recursive: true, mode: 448 });
+  await writeFile4(p.relayConf, relayConf(join2), { mode: 384 });
+  await chmod3(p.relayConf, 384);
+  await netSetup(cfg, ["relay", "up", p.relayConf, String(cfg.controlPlane?.port ?? DEFAULT_HTTPS_PORT)]);
+  const relay = { name: join2.name, publicIp: join2.publicIp, tunnelIp: join2.tunnelIp, endpoint: join2.relay };
+  await saveConfig({ ...cfg, relay }, p);
+  return relay;
+}
+async function dropRelay(p = paths()) {
+  const cfg = await loadConfig(p);
+  const relay = cfg.relay;
+  if (!relay) throw new KvboxError("this host does not go through a relay");
+  if (cfg.controlPlane?.advertise === relay.publicIp) {
+    throw new KvboxError(`${cfg.controlPlane.name} reaches this host through the relay (${relay.publicIp}); run kvbox server leave first`);
+  }
+  await netSetup(cfg, ["relay", "down"]);
+  await rm2(p.relayConf, { force: true });
+  const { relay: _gone, ...rest } = cfg;
+  await saveConfig(rest, p);
+  return relay;
+}
+
+// src/listen.ts
+import { readFile as readFile6, rm as rm4, writeFile as writeFile5 } from "node:fs/promises";
+import { createServer as createHttpsServer } from "node:https";
+import { createAdaptorServer } from "@hono/node-server";
+
+// src/app.ts
+import { Hono as Hono6 } from "hono";
+
+// ../shared/src/version.ts
+import { createRequire } from "node:module";
+function versionOf(srcFileUrl, injected) {
+  if (typeof injected === "string") return injected;
+  try {
+    const require2 = createRequire(srcFileUrl);
+    return require2("../package.json").version;
+  } catch {
+    return "0.0.0-dev";
+  }
+}
+
+// src/version.ts
+var VERSION = versionOf(import.meta.url, true ? "0.5.9" : void 0);
+
+// src/caller.ts
+import { createHash as createHash2, timingSafeEqual } from "node:crypto";
+var OWNER_HEADER = "x-kvbox-owner";
+function resolveCaller(opts = {}) {
+  const cp = opts.controlPlane;
+  if (!cp) {
+    return async (c, next) => {
+      const cfg = await loadConfig();
+      c.set("owner", cfg.owner);
+      c.set("listScope", cfg.owner);
+      await next();
+    };
+  }
+  const expected = digest(cp.secret);
+  return async (c, next) => {
+    const m = /^Bearer\s+(\S+)$/i.exec(c.req.header("authorization") ?? "");
+    if (!m || !timingSafeEqual(digest(m[1]), expected)) return c.json({ error: "not authorized" }, 401);
+    const user = c.req.header(OWNER_HEADER);
+    if (user === void 0) {
+      const path = c.req.path.replace(/\/$/, "");
+      const realmListing = c.req.method === "GET" && (path === "/machines" || path === "/snapshots");
+      if (!realmListing && /^\/(machines|snapshots)(\/|$)/.test(c.req.path)) {
+        return c.json({ error: "X-Kvbox-Owner header required" }, 400);
+      }
+      c.set("owner", "");
+      c.set("listScope", { realm: cp.name });
+    } else {
+      if (!LOCAL_OWNER_RE.test(user)) return c.json({ error: "X-Kvbox-Owner: letters, digits, '.', '_', '-'" }, 400);
+      const owner = `${user}@${cp.name}`;
+      c.set("owner", owner);
+      c.set("listScope", owner);
+    }
+    await next();
+  };
+}
+function digest(secret) {
+  return createHash2("sha256").update(secret).digest();
 }
 
 // src/routes/capacity.ts
@@ -2403,7 +2505,7 @@ async function saveSnapshot(req, owner, p = paths()) {
     throw new KvboxError(`invalid snapshot name "${req.name}": 1-64 chars, lowercase letters, digits, '.', '_' and '-', starting with a letter or digit`);
   }
   const box = await readBox(parseRef(req.box, owner), p);
-  if (!pidAlive(box.pid)) {
+  if (!vmAlive(box)) {
     if (existsSync3(p.machine(box.owner, box.name).hibernateVmstate)) {
       throw new KvboxError(`box ${req.box} is hibernated; a snapshot freezes a running box (kvbox wake ${req.box} first)`);
     }
@@ -2549,7 +2651,8 @@ function createApp(opts = {}) {
       base: await currentBaseVersion().catch(() => null),
       owner: cfg.owner,
       controlPlane: cp ? { name: cp.name, url: cp.url, hostUrl: `https://${cp.advertise}:${cp.port}` } : null,
-      relay: cfg.relay ? { name: cfg.relay.name, publicIp: cfg.relay.publicIp, endpoint: cfg.relay.endpoint } : null
+      relay: cfg.relay ? { name: cfg.relay.name, publicIp: cfg.relay.publicIp, endpoint: cfg.relay.endpoint } : null,
+      recovery: lastRecovery()
     });
   });
   app.route("/machines", machineRoutes());
@@ -2621,6 +2724,7 @@ async function listen(opts = {}) {
   const shutdown2 = async () => {
     server.close();
     httpsServer?.close();
+    await stopRecovery();
     await rm4(socketPath, { force: true });
     await rm4(p.serverPid, { force: true });
     process.exit(0);
@@ -2634,6 +2738,7 @@ async function listen(opts = {}) {
 var program = new Command("kvbox-server").description("kvbox host daemon: owns Firecracker and ~/.kvbox, serves the kvbox API").version(VERSION, "-v, --version").showHelpAfterError();
 program.command("start", { isDefault: true }).description("serve the API on the local Unix socket (foreground)").option("--socket <path>", "socket to listen on (default: $KVBOX_HOME/server.sock)").action(async (opts) => {
   await requireKvm();
+  const settled = await settleDeadBoxes(paths());
   const { socketPath, https } = await listen(opts.socket ? { socketPath: opts.socket } : {});
   console.log(`kvbox-server ${VERSION} listening on ${socketPath} (pid ${process.pid})`);
   if (https) {
@@ -2647,6 +2752,12 @@ program.command("start", { isDefault: true }).description("serve the API on the
   } catch (err) {
     console.error(`warning: host network not ready (${err.message}); run: kvbox-server net up`);
   }
+  const recovery2 = await bootRecovered(settled, paths());
+  if (recovery2) {
+    for (const box of recovery2.booted) console.log(`box ${box} was running when it went down; booted it again`);
+    for (const box of recovery2.leftStopped) console.log(`box ${box} was in standby when it went down; its memory is gone, left stopped`);
+    for (const f of recovery2.failed) console.error(`warning: box ${f.box} was running when it went down and did not come back: ${f.error}`);
+  }
 });
 program.command("join <control-plane-url>").description("register this host with a control plane (needs a one-time token minted there); it answers the control plane from its next start").requiredOption("--token <token>", "one-time join token from the control plane").option("--advertise <host-or-ip>", "address the control plane reaches this host at (default: this host's default-route address)").option("--name <name>", "how the control plane lists this host (default: hostname)").action(async (url, opts) => {
   const joined = await joinControlPlane({ url, ...opts }, paths());