@sealant/mend 0.24.1 → 0.25.0

package/dist/main.js

@@ -21,11 +21,11 @@ import {
 
 // src/main.ts
 import { spawn as spawn3, spawnSync as spawnSync2 } from "node:child_process";
-import * as fs9 from "node:fs";
+import * as fs8 from "node:fs";
 import { createRequire } from "node:module";
 import * as net3 from "node:net";
 import * as os6 from "node:os";
-import * as path10 from "node:path";
+import * as path9 from "node:path";
 
 // src/agent-share.ts
 import * as net from "node:net";
@@ -40,7 +40,7 @@ var bridgeUrlOf = (serverUrl, token, host) => {
 var retryDelayMs = (attempt2) => Math.min(3e4, 1e3 * 2 ** Math.min(Math.max(attempt2 - 1, 0), 5));
 var SSH_AGENTC_REQUEST_IDENTITIES = 11;
 var SSH_AGENTC_SIGN_REQUEST = 13;
-var askLocalAgent = (agentSock, payload) => new Promise((resolve5, reject) => {
+var askLocalAgent = (agentSock, payload) => new Promise((resolve4, reject) => {
   const connection = net.connect(agentSock, () => {
     connection.write(payload);
   });
@@ -54,12 +54,12 @@ var askLocalAgent = (agentSock, payload) => new Promise((resolve5, reject) => {
     if (pending.length >= 4 && pending.length >= 4 + pending.readUInt32BE(0)) {
       clearTimeout(timer);
       connection.end();
-      resolve5(pending.subarray(0, 4 + pending.readUInt32BE(0)));
+      resolve4(pending.subarray(0, 4 + pending.readUInt32BE(0)));
     }
   });
-  connection.on("error", (error2) => {
+  connection.on("error", (error) => {
     clearTimeout(timer);
-    reject(error2);
+    reject(error);
   });
 });
 var sleep = (ms, signal) => delay(ms, void 0, { signal }).then(
@@ -74,12 +74,12 @@ var shareAgent = async (options) => {
     const ws = new WebSocket(url);
     const onAbort = () => ws.close();
     signal.addEventListener("abort", onAbort, { once: true });
-    const closed = new Promise((resolve5) => {
-      ws.addEventListener("close", () => resolve5(), { once: true });
+    const closed = new Promise((resolve4) => {
+      ws.addEventListener("close", () => resolve4(), { once: true });
     });
-    const opened = await new Promise((resolve5) => {
-      ws.addEventListener("open", () => resolve5(true), { once: true });
-      ws.addEventListener("error", () => resolve5(false), { once: true });
+    const opened = await new Promise((resolve4) => {
+      ws.addEventListener("open", () => resolve4(true), { once: true });
+      ws.addEventListener("error", () => resolve4(false), { once: true });
     });
     if (opened) {
       attempt2 = 0;
@@ -112,8 +112,8 @@ var shareAgent = async (options) => {
             if (type === SSH_AGENTC_SIGN_REQUEST) {
               onEvent({ kind: "signed", context, seconds: (Date.now() - started) / 1e3 });
             }
-          } catch (error2) {
-            const message = error2 instanceof Error ? error2.message : String(error2);
+          } catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
             if (ws.readyState === WebSocket.OPEN) {
               ws.send(JSON.stringify({ t: "err", id, message }));
             }
@@ -171,13 +171,13 @@ var parsePngfHex = (output) => {
   return Buffer.from(match[1], "hex");
 };
 var MAX_BYTES = 32 * 1024 * 1024;
-var run = (command, args) => new Promise((resolve5) => {
+var run = (command, args) => new Promise((resolve4) => {
   execFile(
     command,
     [...args],
     { encoding: "buffer", maxBuffer: MAX_BYTES, timeout: 3e3 },
-    (error2, stdout) => {
-      resolve5(error2 === null ? stdout : null);
+    (error, stdout) => {
+      resolve4(error === null ? stdout : null);
     }
   );
 });
@@ -1037,7 +1037,7 @@ var COMMANDS = [
     section: "this machine",
     summary: "install or repair the local Mend server",
     synopsis: [
-      "[--context <name>] [--version <version|latest>] [--bind <ip>] [--url <origin>] [--origin <origin>...] [--port <n>] [--ssh-port <n>] [--registry-port <n>] [--docker-socket <path>] [--assets-dir <dir>] [--offline]"
+      "[--context <name>] [--version <version|latest>] [--bind <ip>] [--url <origin>] [--origin <origin>...] [--port <n>] [--ssh-port <n>] [--docker-socket <path>] [--assets-dir <dir>] [--offline]"
     ],
     description: [
       "Checks a local Unix-socket Docker context and the Compose plugin, downloads the compose and Postgres initialization assets for one Mend release, preserves existing data and secrets, and starts the server. Re-running repairs the same pinned version. A changed --version is refused; use mend server upgrade. Updating this CLI never updates an existing server pin.",
@@ -1061,18 +1061,17 @@ var COMMANDS = [
         text: "additional exact browser origin; repeat for more than one"
       },
       { flag: "--port <n>", text: "external web port. Default: 3105" },
-      { flag: "--ssh-port <n>", text: "external workspace SSH port. Default: 2222" },
       {
-        flag: "--registry-port <n>",
-        text: "loopback registry port. Default: 5000; all three ports must differ"
+        flag: "--ssh-port <n>",
+        text: "external workspace SSH port. Default: 2222; must differ from --port"
       },
       {
         flag: "--assets-dir <dir>",
-        text: "copy compose.v1.yaml and postgres-init.sh from a release directory; fresh setup requires --version"
+        text: "copy compose.v2.yaml and postgres-init.sh from a release directory; fresh setup requires --version"
       },
       {
         flag: "--offline",
-        text: "use retained or supplied assets and preloaded images only; no GitHub requests or release-image pulls; exact image label, health version and a loopback registry roundtrip required"
+        text: "use retained or supplied assets and preloaded images only; no GitHub requests or release-image pulls; exact image label and health version required"
       },
       { flag: "--docker-socket <path>", text: "daemon-side socket mount override for diagnostics" }
     ],
@@ -1083,7 +1082,7 @@ var COMMANDS = [
         text: "explicit tailnet exposure"
       },
       {
-        command: "mend server setup --version 0.23.0 --assets-dir ./release-assets --offline --registry-port 5501",
+        command: "mend server setup --version 0.25.0 --assets-dir ./release-assets --offline",
         text: "install from local release assets and preloaded images"
       }
     ],
@@ -1105,14 +1104,9 @@ var COMMANDS = [
     summary: "start the selected server generation",
     synopsis: ["[--offline]"],
     description: [
-      "Reuses the saved context, generation, credentials and exact pin. Uses preloaded release images, with no release-image pulls or asset downloads, even without --offline. Exact image label, health version and a loopback registry roundtrip are required."
-    ],
-    options: [
-      {
-        flag: "--offline",
-        text: "use local release images and assets; still probe the loopback registry"
-      }
+      "Reuses the saved context, generation, credentials and exact pin. Uses preloaded release images, with no release-image pulls or asset downloads, even without --offline. Exact image label and health version are required."
     ],
+    options: [{ flag: "--offline", text: "use local release images and assets" }],
     see: ["server status", "server upgrade"]
   },
   {
@@ -1131,14 +1125,9 @@ var COMMANDS = [
     summary: "restart Mend using the same generation and pin",
     synopsis: ["[--offline]"],
     description: [
-      "Checks preloaded images before stopping Mend, then starts the saved generation and verifies exact-version health and a loopback registry roundtrip. Postgres stays running. Connections are interrupted; workspace containers and data remain, but active work may need reconnection."
-    ],
-    options: [
-      {
-        flag: "--offline",
-        text: "use local release images and assets; still probe the loopback registry"
-      }
+      "Checks preloaded images before stopping Mend, then starts the saved generation and verifies exact-version health. Postgres stays running. Connections are interrupted; workspace containers and data remain, but active work may need reconnection."
     ],
+    options: [{ flag: "--offline", text: "use local release images and assets" }],
     see: ["server status", "server logs"]
   },
   {
@@ -1169,11 +1158,11 @@ var COMMANDS = [
       },
       {
         flag: "--assets-dir <dir>",
-        text: "copy target compose.v1.yaml and postgres-init.sh from local release assets"
+        text: "copy target compose.v2.yaml and postgres-init.sh from local release assets"
       },
       {
         flag: "--offline",
-        text: "no GitHub requests or release-image pulls; target assets and exact-version images must be local; still probe the loopback registry"
+        text: "no GitHub requests or release-image pulls; target assets and exact-version images must be local"
       }
     ],
     examples: [
@@ -1677,7 +1666,7 @@ var retryAfterSecondsOf = (json) => {
   }
   return 5;
 };
-var sleep2 = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
+var sleep2 = (ms) => new Promise((resolve4) => setTimeout(resolve4, ms));
 var resolveServerUrl = async (args, deps) => {
   const given = takeFlagValue2(args, "--url") ?? deps.configuredUrl;
   if (given !== null) {
@@ -1750,7 +1739,7 @@ import { randomBytes } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import * as net2 from "node:net";
 import * as os3 from "node:os";
-import * as path6 from "node:path";
+import * as path5 from "node:path";
 
 // src/server-docker-volumes.ts
 import { createHash } from "node:crypto";
@@ -1955,223 +1944,10 @@ var ownership = async (runtime, input, mode) => {
 var claimServerDockerVolumes = (runtime, input) => ownership(runtime, input, "claim");
 var verifyServerDockerVolumes = (runtime, input) => ownership(runtime, input, "verify");
 
-// src/server-registry-probe.ts
-import { Buffer as Buffer2 } from "node:buffer";
-import * as fs3 from "node:fs/promises";
-import * as path3 from "node:path";
-var ServerRegistryProbeError = class extends Error {
-  /** Stable error discriminator. */
-  _tag = "ServerRegistryProbeError";
-  /** Failed roundtrip operation, independent of the host operating system. */
-  stage;
-  /** Bounded, credential-scrubbed failure detail. */
-  diagnostic;
-  /** Explain the failed Engine operation without recommending a wider registry binding. */
-  constructor(stage, diagnostic) {
-    super(
-      `Docker registry probe failed (${stage}): ${diagnostic}. The selected Docker Engine must import, push and pull through 127.0.0.1 at the configured registry port. Check bundle health, Docker context and Engine loopback registry support, then retry. Do not widen the registry binding.`
-    );
-    this.stage = stage;
-    this.diagnostic = diagnostic;
-  }
-};
-var PROBE_LABEL = "dev.sealant.mend.registry-probe";
-var COMMAND_TIMEOUT_MS = 6e4;
-var CLEANUP_TIMEOUT_MS = 15e3;
-var error = (stage, diagnostic) => ({ _tag: "error", error: new ServerRegistryProbeError(stage, diagnostic) });
-var safeDiagnostic = (text) => text.replace(/([a-z][a-z0-9+.-]*:\/\/)[^\s/@]+@/gi, "$1[redacted]@").replace(
-  /((?:password|passwd|token|secret|authorization|credential)[\w-]*\s*[=:]\s*)[^\s,;]+/gi,
-  "$1[redacted]"
-).replace(/Bearer\s+\S+/gi, "Bearer [redacted]").split("").map(
-  (character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127 ? " " : character
-).join("").slice(0, 2048);
-var docker2 = async (runtime, context, stage, args) => {
-  try {
-    const output = await runtime.run("docker", ["--context", context, ...args], {
-      timeoutMs: stage === "cleanup" ? CLEANUP_TIMEOUT_MS : COMMAND_TIMEOUT_MS
-    });
-    if (output.status !== 0 || output.error !== void 0)
-      return error(
-        stage,
-        safeDiagnostic(
-          output.error ?? (output.stderr.trim() || `exit ${output.status ?? "unknown"}`)
-        )
-      );
-    return { _tag: "ok", value: output.stdout };
-  } catch {
-    return error(
-      stage,
-      "Process runner rejected; check Docker access and command timeout handling"
-    );
-  }
-};
-var tinyRootfs = (nonce) => {
-  const body = Buffer2.from(`Mend registry connectivity probe ${nonce}
-`);
-  const header = Buffer2.alloc(512);
-  const field = (value, offset, length) => header.write(value, offset, length, "ascii");
-  field("mend-registry-probe", 0, 100);
-  field("0000600\0", 100, 8);
-  field("0000000\0", 108, 8);
-  field("0000000\0", 116, 8);
-  field(`${body.length.toString(8).padStart(11, "0")}\0`, 124, 12);
-  field("00000000000\0", 136, 12);
-  field("        ", 148, 8);
-  field("0", 156, 1);
-  field("ustar\0", 257, 6);
-  field("00", 263, 2);
-  const checksum = header.reduce((sum, byte) => sum + byte, 0);
-  field(`${checksum.toString(8).padStart(6, "0")}\0 `, 148, 8);
-  return Buffer2.concat([header, body, Buffer2.alloc(512 - body.length), Buffer2.alloc(1024)]);
-};
-var imageExists = async (runtime, input, reference, stage) => {
-  const listed = await docker2(runtime, input.dockerContext, stage, [
-    "image",
-    "ls",
-    "--all",
-    "--filter",
-    `reference=${reference}`,
-    "--format",
-    "{{json .ID}}"
-  ]);
-  if (listed._tag === "error") return listed;
-  try {
-    const lines = listed.value.trim().split("\n").filter(Boolean);
-    for (const line of lines) {
-      const id = JSON.parse(line);
-      if (typeof id !== "string" || !/^(?:sha256:)?[a-f0-9]{12,64}$/.test(id))
-        return error(stage, "Docker returned an inconclusive image listing");
-    }
-    return { _tag: "ok", value: lines.length > 0 };
-  } catch {
-    return error(stage, "Docker returned an invalid image listing");
-  }
-};
-var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var ownedImage = async (runtime, input, reference, stage) => {
-  const inspected = await docker2(runtime, input.dockerContext, stage, [
-    "image",
-    "inspect",
-    reference,
-    "--format",
-    "{{json .}}"
-  ]);
-  if (inspected._tag === "error") return inspected;
-  try {
-    const image = JSON.parse(inspected.value);
-    if (!isRecord(image) || typeof image.Id !== "string" || !/^sha256:[a-f0-9]{64}$/.test(image.Id) || !isRecord(image.Config) || !isRecord(image.Config.Labels) || image.Config.Labels[PROBE_LABEL] !== input.nonce)
-      return error(stage, "Image ownership or ID could not be verified; the image was retained");
-    return { _tag: "ok", value: image.Id };
-  } catch {
-    return error(stage, "Docker returned an invalid image inspection; the image was retained");
-  }
-};
-var removeOwnedTag = async (runtime, input, reference, stage) => {
-  const exists = await imageExists(runtime, input, reference, stage);
-  if (exists._tag === "error") return exists;
-  if (!exists.value) return { _tag: "ok", value: void 0 };
-  const owned = await ownedImage(runtime, input, reference, stage);
-  if (owned._tag === "error") return owned;
-  const removed = await docker2(runtime, input.dockerContext, stage, ["image", "rm", reference]);
-  return removed._tag === "error" ? removed : { _tag: "ok", value: void 0 };
-};
-var roundtrip = async (runtime, input, reference, tarPath) => {
-  const imported = await docker2(runtime, input.dockerContext, "import", [
-    "image",
-    "import",
-    "--change",
-    `LABEL ${PROBE_LABEL}=${input.nonce}`,
-    tarPath,
-    reference
-  ]);
-  if (imported._tag === "error") return imported;
-  const original = await ownedImage(runtime, input, reference, "inspect");
-  if (original._tag === "error") return original;
-  const pushed = await docker2(runtime, input.dockerContext, "push", ["image", "push", reference]);
-  if (pushed._tag === "error") return pushed;
-  const removed = await removeOwnedTag(runtime, input, reference, "remove-local");
-  if (removed._tag === "error") return removed;
-  const absent = await imageExists(runtime, input, reference, "remove-local");
-  if (absent._tag === "error") return absent;
-  if (absent.value)
-    return error("remove-local", "Probe tag remained local; refusing to claim a pull roundtrip");
-  const pulled = await docker2(runtime, input.dockerContext, "pull", ["image", "pull", reference]);
-  if (pulled._tag === "error") return pulled;
-  const observed = await ownedImage(runtime, input, reference, "inspect");
-  if (observed._tag === "error") return observed;
-  return observed.value === original.value ? observed : error("inspect", "Pulled image ID differs from the imported image ID");
-};
-var parseProbeReference = (input) => {
-  if (!input.dockerContext.trim() || !Number.isInteger(input.registryPort) || input.registryPort < 1 || input.registryPort > 65535 || !/^[a-f0-9]{32,64}$/.test(input.nonce) || !path3.isAbsolute(input.temporaryDirectory))
-    return error(
-      "input",
-      "Expected an explicit context, TCP port, fresh 16 to 32 byte hex nonce and absolute temporary directory"
-    );
-  return {
-    _tag: "ok",
-    value: `127.0.0.1:${input.registryPort}/mend-registry-probe/${input.nonce}:probe`
-  };
-};
-var probeServerRegistry = async (runtime, input) => {
-  const cleanupWarnings = [];
-  const parsed = parseProbeReference(input);
-  if (parsed._tag === "error") return { ...parsed, cleanupWarnings };
-  const reference = parsed.value;
-  const exists = await imageExists(runtime, input, reference, "collision-check");
-  if (exists._tag === "error") return { ...exists, cleanupWarnings };
-  if (exists.value)
-    return {
-      ...error(
-        "collision-check",
-        "Probe reference already exists; supply a fresh nonce. Existing image retained"
-      ),
-      cleanupWarnings
-    };
-  let directory;
-  try {
-    directory = await fs3.mkdtemp(path3.join(input.temporaryDirectory, "mend-registry-probe-"));
-  } catch {
-    return {
-      ...error("temporary-files", "Could not create private probe directory"),
-      cleanupWarnings
-    };
-  }
-  let result;
-  let importAttempted = false;
-  try {
-    const tarPath = path3.join(directory, "rootfs.tar");
-    await fs3.writeFile(tarPath, tinyRootfs(input.nonce), { mode: 384, flag: "wx" });
-    importAttempted = true;
-    result = await roundtrip(runtime, input, reference, tarPath);
-  } catch {
-    result = error("temporary-files", "Could not write the private probe archive");
-  } finally {
-    if (importAttempted) {
-      const cleanup = await removeOwnedTag(runtime, input, reference, "cleanup");
-      if (cleanup._tag === "error") cleanupWarnings.push(cleanup.error);
-    }
-    try {
-      await fs3.rm(directory, { recursive: true, force: true });
-    } catch {
-      cleanupWarnings.push(
-        new ServerRegistryProbeError(
-          "cleanup",
-          `Could not remove private probe directory ${directory}`
-        )
-      );
-    }
-  }
-  return result._tag === "error" ? { ...result, cleanupWarnings } : {
-    _tag: "ok",
-    value: { reference, imageId: result.value },
-    cleanupWarnings
-  };
-};
-
 // src/server-runtime.ts
 import { spawn as spawn2 } from "node:child_process";
-import * as fs4 from "node:fs";
-import * as path4 from "node:path";
+import * as fs3 from "node:fs";
+import * as path3 from "node:path";
 var serverProcessDeadlines = {
   ordinary: 3e4,
   pull: 10 * 6e4,
@@ -2214,10 +1990,10 @@ var runServerProcess = (command, args, parentEnvironment, options = {}) => {
   ]) {
     if (parentEnvironment[key] !== void 0) env[key] = parentEnvironment[key];
   }
-  return new Promise((resolve5) => {
+  return new Promise((resolve4) => {
     let fd;
     try {
-      if (options.stdoutFile !== void 0) fd = fs4.openSync(options.stdoutFile, "wx", 384);
+      if (options.stdoutFile !== void 0) fd = fs3.openSync(options.stdoutFile, "wx", 384);
       const child = spawn2(command, [...args], {
         env,
         detached: process.platform !== "win32",
@@ -2262,23 +2038,23 @@ var runServerProcess = (command, args, parentEnvironment, options = {}) => {
         failure2 ??= `Process timed out after ${timeoutMs}ms`;
         terminate();
       }, timeoutMs);
-      child.once("error", (error2) => {
-        failure2 ??= error2.message;
+      child.once("error", (error) => {
+        failure2 ??= error.message;
       });
       child.once("close", (status) => {
         globalThis.clearTimeout(timer);
         try {
-          if (fd !== void 0) fs4.fsyncSync(fd);
+          if (fd !== void 0) fs3.fsyncSync(fd);
         } catch {
           failure2 ??= "Could not durably write process output.";
         } finally {
           try {
-            if (fd !== void 0) fs4.closeSync(fd);
+            if (fd !== void 0) fs3.closeSync(fd);
           } catch {
             failure2 ??= "Could not close process output file.";
           }
         }
-        resolve5({
+        resolve4({
           status: failure2 === void 0 ? status : null,
           stdout,
           stderr,
@@ -2287,10 +2063,10 @@ var runServerProcess = (command, args, parentEnvironment, options = {}) => {
       });
     } catch (cause) {
       try {
-        if (fd !== void 0) fs4.closeSync(fd);
+        if (fd !== void 0) fs3.closeSync(fd);
       } catch {
       }
-      resolve5({
+      resolve4({
         status: null,
         stdout: "",
         stderr: "",
@@ -2308,17 +2084,17 @@ var serverComposeArgs = (installation, command) => [
   "--project-directory",
   installation.directory,
   "--env-file",
-  path4.join(installation.directory, "server.env"),
+  path3.join(installation.directory, "server.env"),
   "-f",
-  path4.join(installation.directory, "compose.yaml"),
+  path3.join(installation.directory, "compose.yaml"),
   ...command
 ];
 
 // src/server-store.ts
 import { randomUUID } from "node:crypto";
-import * as fs5 from "node:fs";
+import * as fs4 from "node:fs";
 import * as os2 from "node:os";
-import * as path5 from "node:path";
+import * as path4 from "node:path";
 var ServerStoreError = class extends Error {
   _tag = "ServerStoreError";
 };
@@ -2339,28 +2115,28 @@ var attempt = (operation) => {
 var hasCode = (cause, code) => cause instanceof Error && "code" in cause && cause.code === code;
 var readOptional = (file) => {
   try {
-    return fs5.readFileSync(file, "utf8");
+    return fs4.readFileSync(file, "utf8");
   } catch (cause) {
     if (hasCode(cause, "ENOENT")) return null;
     throw cause;
   }
 };
 var syncDirectory = (directory) => {
-  const fd = fs5.openSync(directory, "r");
+  const fd = fs4.openSync(directory, "r");
   try {
-    fs5.fsyncSync(fd);
+    fs4.fsyncSync(fd);
   } finally {
-    fs5.closeSync(fd);
+    fs4.closeSync(fd);
   }
 };
 var writeDurable = (file, content, mode = 384) => {
-  const fd = fs5.openSync(file, "wx", mode);
+  const fd = fs4.openSync(file, "wx", mode);
   try {
-    fs5.writeFileSync(fd, content, "utf8");
-    fs5.fchmodSync(fd, mode);
-    fs5.fsyncSync(fd);
+    fs4.writeFileSync(fd, content, "utf8");
+    fs4.fchmodSync(fd, mode);
+    fs4.fsyncSync(fd);
   } finally {
-    fs5.closeSync(fd);
+    fs4.closeSync(fd);
   }
 };
 var fileKeys = ["identity", "config", "env", "compose", "postgresInit"];
@@ -2380,7 +2156,7 @@ var parseLockOwner = (raw) => {
 };
 var describeOwner = (lockDir) => {
   try {
-    const raw = JSON.parse(fs5.readFileSync(path5.join(lockDir, "owner.json"), "utf8"));
+    const raw = JSON.parse(fs4.readFileSync(path4.join(lockDir, "owner.json"), "utf8"));
     const owner = parseLockOwner(raw);
     if (owner === null) return "owner metadata is invalid";
     const label = `PID ${owner.pid} on ${owner.hostname}`;
@@ -2400,28 +2176,28 @@ var lockGuidance = (lockDir) => new ServerStoreError(
 );
 var acquireLock = (configDir, create) => {
   if (create) {
-    fs5.mkdirSync(configDir, { recursive: true, mode: 448 });
-    fs5.chmodSync(configDir, 448);
-  } else if (!fs5.existsSync(configDir)) {
+    fs4.mkdirSync(configDir, { recursive: true, mode: 448 });
+    fs4.chmodSync(configDir, 448);
+  } else if (!fs4.existsSync(configDir)) {
     throw new ServerStoreError(
       "No Mend server is configured. Run mend server setup explicitly to install one."
     );
   }
-  const lockDir = path5.join(configDir, "server.lock");
+  const lockDir = path4.join(configDir, "server.lock");
   try {
-    fs5.mkdirSync(lockDir, { mode: 448 });
+    fs4.mkdirSync(lockDir, { mode: 448 });
   } catch (cause) {
     if (hasCode(cause, "EEXIST")) throw lockGuidance(lockDir);
     throw cause;
   }
-  const owned = fs5.statSync(lockDir);
-  const ownerFile = path5.join(lockDir, "owner.json");
+  const owned = fs4.statSync(lockDir);
+  const ownerFile = path4.join(lockDir, "owner.json");
   const owner = `${JSON.stringify({ pid: process.pid, hostname: os2.hostname(), token: randomUUID() })}
 `;
   let open = true;
   const assertOwned = () => {
-    const current = fs5.statSync(lockDir);
-    if (!open || current.dev !== owned.dev || current.ino !== owned.ino || fs5.readFileSync(ownerFile, "utf8") !== owner) {
+    const current = fs4.statSync(lockDir);
+    if (!open || current.dev !== owned.dev || current.ino !== owned.ino || fs4.readFileSync(ownerFile, "utf8") !== owner) {
       throw new ServerStoreError(
         "Server lock ownership was lost. Stop and check for another server command before retrying."
       );
@@ -2437,8 +2213,8 @@ var acquireLock = (configDir, create) => {
     release: () => {
       const result = attempt(() => {
         assertOwned();
-        fs5.unlinkSync(ownerFile);
-        fs5.rmdirSync(lockDir);
+        fs4.unlinkSync(ownerFile);
+        fs4.rmdirSync(lockDir);
       });
       open = false;
       return result;
@@ -2447,7 +2223,7 @@ var acquireLock = (configDir, create) => {
 };
 var readIdentity = (paths) => {
   const identity = readOptional(paths.identity);
-  if (identity === null && (fs5.existsSync(paths.active) || fs5.existsSync(paths.generations) && fs5.readdirSync(paths.generations).length > 0)) {
+  if (identity === null && (fs4.existsSync(paths.active) || fs4.existsSync(paths.generations) && fs4.readdirSync(paths.generations).length > 0)) {
     throw new ServerStoreError(
       "Server identity.env is missing. Restore it from a retained generation or backup; refusing to generate replacement credentials."
     );
@@ -2457,7 +2233,7 @@ var readIdentity = (paths) => {
 var readActive = (paths) => {
   let target;
   try {
-    target = fs5.readlinkSync(paths.active);
+    target = fs4.readlinkSync(paths.active);
   } catch (cause) {
     if (hasCode(cause, "ENOENT")) return null;
     throw cause;
@@ -2467,13 +2243,13 @@ var readActive = (paths) => {
       "Server active pointer is invalid. Restore the symlink to a retained generation before retrying."
     );
   }
-  const directory = path5.join(paths.configDir, target);
+  const directory = path4.join(paths.configDir, target);
   const files = {
-    identity: fs5.readFileSync(path5.join(directory, fileNames.identity), "utf8"),
-    config: fs5.readFileSync(path5.join(directory, fileNames.config), "utf8"),
-    env: fs5.readFileSync(path5.join(directory, fileNames.env), "utf8"),
-    compose: fs5.readFileSync(path5.join(directory, fileNames.compose), "utf8"),
-    postgresInit: fs5.readFileSync(path5.join(directory, fileNames.postgresInit), "utf8")
+    identity: fs4.readFileSync(path4.join(directory, fileNames.identity), "utf8"),
+    config: fs4.readFileSync(path4.join(directory, fileNames.config), "utf8"),
+    env: fs4.readFileSync(path4.join(directory, fileNames.env), "utf8"),
+    compose: fs4.readFileSync(path4.join(directory, fileNames.compose), "utf8"),
+    postgresInit: fs4.readFileSync(path4.join(directory, fileNames.postgresInit), "utf8")
   };
   if (readIdentity(paths) !== files.identity) {
     throw new ServerStoreError(
@@ -2483,20 +2259,20 @@ var readActive = (paths) => {
   return { directory, files };
 };
 var publishIdentity = (paths, identity) => {
-  const temporary = path5.join(paths.configDir, `.identity-${randomUUID()}`);
+  const temporary = path4.join(paths.configDir, `.identity-${randomUUID()}`);
   writeDurable(temporary, identity);
-  fs5.linkSync(temporary, paths.identity);
+  fs4.linkSync(temporary, paths.identity);
   syncDirectory(paths.configDir);
-  fs5.unlinkSync(temporary);
+  fs4.unlinkSync(temporary);
 };
 var prepareGeneration = (paths, files) => {
-  fs5.mkdirSync(paths.generations, { recursive: true, mode: 448 });
+  fs4.mkdirSync(paths.generations, { recursive: true, mode: 448 });
   const generationName = `gen-${randomUUID()}`;
-  const directory = path5.join(paths.generations, generationName);
-  fs5.mkdirSync(directory, { mode: 448 });
+  const directory = path4.join(paths.generations, generationName);
+  fs4.mkdirSync(directory, { mode: 448 });
   for (const key of fileKeys) {
     writeDurable(
-      path5.join(directory, fileNames[key]),
+      path4.join(directory, fileNames[key]),
       files[key],
       key === "postgresInit" ? 493 : 384
     );
@@ -2507,18 +2283,18 @@ var prepareGeneration = (paths, files) => {
   return { directory, files };
 };
 var activateGeneration = (paths, generation) => {
-  const relative3 = path5.relative(paths.configDir, generation.directory);
-  if (!/^generations\/gen-[0-9a-f-]{36}$/.test(relative3) || readIdentity(paths) !== fs5.readFileSync(path5.join(generation.directory, "identity.env"), "utf8")) {
+  const relative3 = path4.relative(paths.configDir, generation.directory);
+  if (!/^generations\/gen-[0-9a-f-]{36}$/.test(relative3) || readIdentity(paths) !== fs4.readFileSync(path4.join(generation.directory, "identity.env"), "utf8")) {
     throw new ServerStoreError("Cannot activate a generation outside this installation identity.");
   }
   for (const key of fileKeys) {
-    if (fs5.readFileSync(path5.join(generation.directory, fileNames[key]), "utf8") !== generation.files[key]) {
+    if (fs4.readFileSync(path4.join(generation.directory, fileNames[key]), "utf8") !== generation.files[key]) {
       throw new ServerStoreError("Cannot activate an incomplete or changed server generation.");
     }
   }
-  const pointer = path5.join(paths.configDir, `.active-${randomUUID()}`);
-  fs5.symlinkSync(relative3, pointer);
-  fs5.renameSync(pointer, paths.active);
+  const pointer = path4.join(paths.configDir, `.active-${randomUUID()}`);
+  fs4.symlinkSync(relative3, pointer);
+  fs4.renameSync(pointer, paths.active);
   syncDirectory(paths.configDir);
 };
 var prepareFiles = (paths, files) => {
@@ -2527,7 +2303,7 @@ var prepareFiles = (paths, files) => {
     throw new ServerStoreError("Server identity already exists; refusing to replace credentials.");
   }
   const active = readActive(paths);
-  if (active !== null && fileKeys.every((key) => files[key] === active.files[key]) && (fs5.statSync(path5.join(active.directory, fileNames.postgresInit)).mode & 4095) === 493)
+  if (active !== null && fileKeys.every((key) => files[key] === active.files[key]) && (fs4.statSync(path4.join(active.directory, fileNames.postgresInit)).mode & 4095) === 493)
     return active;
   if (identity === null) publishIdentity(paths, files.identity);
   return prepareGeneration(paths, files);
@@ -2540,9 +2316,9 @@ var commitGeneration = (paths, files) => {
 var createStore = (configDir, lock) => {
   const paths = {
     configDir,
-    identity: path5.join(configDir, "identity.env"),
-    generations: path5.join(configDir, "generations"),
-    active: path5.join(configDir, "active")
+    identity: path4.join(configDir, "identity.env"),
+    generations: path4.join(configDir, "generations"),
+    active: path4.join(configDir, "active")
   };
   const whileOwned = (operation) => attempt(() => {
     lock.assertOwned();
@@ -2555,13 +2331,13 @@ var createStore = (configDir, lock) => {
     prepare: (files) => whileOwned(() => prepareFiles(paths, files)),
     activate: (generation) => whileOwned(() => activateGeneration(paths, generation)),
     createBackup: (previous, target) => whileOwned(() => {
-      const backups = path5.join(configDir, "backups");
-      fs5.mkdirSync(backups, { recursive: true, mode: 448 });
-      fs5.chmodSync(backups, 448);
-      const directory = path5.join(backups, `upgrade-${randomUUID()}`);
-      fs5.mkdirSync(directory, { mode: 448 });
+      const backups = path4.join(configDir, "backups");
+      fs4.mkdirSync(backups, { recursive: true, mode: 448 });
+      fs4.chmodSync(backups, 448);
+      const directory = path4.join(backups, `upgrade-${randomUUID()}`);
+      fs4.mkdirSync(directory, { mode: 448 });
       writeDurable(
-        path5.join(directory, "recovery.json"),
+        path4.join(directory, "recovery.json"),
         `${JSON.stringify(
           {
             previousGeneration: previous.directory,
@@ -2577,21 +2353,21 @@ var createStore = (configDir, lock) => {
       syncDirectory(directory);
       syncDirectory(backups);
       syncDirectory(configDir);
-      const partialFile = path5.join(directory, "database.sql.partial");
+      const partialFile = path4.join(directory, "database.sql.partial");
       return {
         directory,
         partialFile,
         complete: () => whileOwned(() => {
-          if (fs5.statSync(partialFile).size === 0)
+          if (fs4.statSync(partialFile).size === 0)
             throw new ServerStoreError("Database backup is empty; refusing target startup.");
-          const fd = fs5.openSync(partialFile, "r");
+          const fd = fs4.openSync(partialFile, "r");
           try {
-            fs5.fchmodSync(fd, 384);
-            fs5.fsyncSync(fd);
+            fs4.fchmodSync(fd, 384);
+            fs4.fsyncSync(fd);
           } finally {
-            fs5.closeSync(fd);
+            fs4.closeSync(fd);
           }
-          fs5.renameSync(partialFile, path5.join(directory, "database.sql"));
+          fs4.renameSync(partialFile, path4.join(directory, "database.sql"));
           syncDirectory(directory);
         })
       };
@@ -2600,7 +2376,7 @@ var createStore = (configDir, lock) => {
 };
 var refuseFlatLayout = (configDir) => {
   if (["server.json", "server.env", "compose.yaml", "postgres-init.sh"].some(
-    (name) => fs5.existsSync(path5.join(configDir, name))
+    (name) => fs4.existsSync(path4.join(configDir, name))
   )) {
     throw new ServerStoreError(
       "Unreleased flat server configuration found. Preserve its credentials and volumes; migrate it to the generation layout before retrying. Setup will not replace this identity."
@@ -2608,7 +2384,7 @@ var refuseFlatLayout = (configDir) => {
   }
 };
 var withServerStore = async (directory, operation, options = {}) => {
-  const configDir = path5.resolve(directory);
+  const configDir = path4.resolve(directory);
   let lock;
   let result;
   try {
@@ -2625,9 +2401,9 @@ var withServerStore = async (directory, operation, options = {}) => {
 };
 
 // src/version.ts
-import * as fs6 from "node:fs";
+import * as fs5 from "node:fs";
 var cliVersion = () => {
-  const raw = fs6.readFileSync(new URL("../package.json", import.meta.url), "utf8");
+  const raw = fs5.readFileSync(new URL("../package.json", import.meta.url), "utf8");
   const parsed = JSON.parse(raw);
   if (typeof parsed === "object" && parsed !== null && "version" in parsed) {
     const version = parsed.version;
@@ -2661,12 +2437,13 @@ var versionLines = (cli, server) => {
 
 // src/server-setup.ts
 var CONFIG_SCHEMA_VERSION = 1;
-var ASSET_CONTRACT = "mend-docker-v1";
+var ASSET_CONTRACT = "mend-docker-v2";
+var LEGACY_ASSET_CONTRACTS = /* @__PURE__ */ new Set(["mend-docker-v1"]);
 var MINIMUM_DOCKER_API = "1.45";
 var DEFAULT_APP_PORT = 3105;
 var DEFAULT_SSH_PORT = 2222;
 var DEFAULT_BIND = "127.0.0.1";
-var COMPOSE_ASSET = "compose.v1.yaml";
+var COMPOSE_ASSET = "compose.v2.yaml";
 var POSTGRES_INIT_ASSET = "postgres-init.sh";
 var RELEASE_BASE = "https://github.com/sealant-sh/Mend/releases/download";
 var LATEST_RELEASE_URL = "https://api.github.com/repos/sealant-sh/Mend/releases/latest";
@@ -2726,7 +2503,6 @@ var SETUP_FLAGS = /* @__PURE__ */ new Set([
   "--port",
   "--ssh-port",
   "--docker-socket",
-  "--registry-port",
   "--assets-dir",
   "--offline"
 ]);
@@ -2755,7 +2531,6 @@ var parseSetupOptions = (args) => {
   const version = flagValue2("--version");
   const appPort = flagValue2("--port");
   const sshPort = flagValue2("--ssh-port");
-  const registryPort = flagValue2("--registry-port");
   const origins = values.get("--origin");
   return {
     context: flagValue2("--context"),
@@ -2766,7 +2541,6 @@ var parseSetupOptions = (args) => {
     appPort: appPort === void 0 ? void 0 : parsePort(appPort, "--port"),
     sshPort: sshPort === void 0 ? void 0 : parsePort(sshPort, "--ssh-port"),
     dockerSocket: flagValue2("--docker-socket"),
-    registryPort: registryPort === void 0 ? void 0 : parsePort(registryPort, "--registry-port"),
     assetsDir: flagValue2("--assets-dir"),
     offline: values.has("--offline")
   };
@@ -2813,9 +2587,8 @@ var checkExposurePair = (bind, appUrl, requireExplicitUrl) => {
 var validateExposure = (existing, options) => {
   const appPort = options.appPort ?? existing?.appPort ?? DEFAULT_APP_PORT;
   const sshPort = options.sshPort ?? existing?.sshPort ?? DEFAULT_SSH_PORT;
-  const registryPort = options.registryPort ?? existing?.registryPort ?? 5e3;
-  if ((/* @__PURE__ */ new Set([appPort, sshPort, registryPort])).size !== 3) {
-    throw setupError("--port, --ssh-port and --registry-port must use different ports.");
+  if (appPort === sshPort) {
+    throw setupError("--port and --ssh-port must use different ports.");
   }
   const bind = options.bind ?? existing?.bind ?? DEFAULT_BIND;
   if (net2.isIP(bind) === 0) {
@@ -2830,7 +2603,7 @@ var validateExposure = (existing, options) => {
   const allowedOrigins = [
     ...new Set((requestedOrigins ?? inheritedOrigins).filter((origin) => origin !== appUrl))
   ];
-  return { bind, appUrl, allowedOrigins, appPort, sshPort, registryPort };
+  return { bind, appUrl, allowedOrigins, appPort, sshPort };
 };
 var parseServerConfig = (raw) => {
   let decoded;
@@ -2871,16 +2644,17 @@ var parseServerConfig = (raw) => {
     ),
     appPort: requiredInteger(fields, "appPort"),
     sshPort: requiredInteger(fields, "sshPort"),
-    registryPort: fields.has("registryPort") ? requiredInteger(fields, "registryPort") : 5e3
+    ...fields.has("registryPort") ? { registryPort: requiredInteger(fields, "registryPort") } : {}
   };
-  if (config.schemaVersion !== CONFIG_SCHEMA_VERSION || config.assetContract !== ASSET_CONTRACT) {
+  if (config.schemaVersion !== CONFIG_SCHEMA_VERSION || config.assetContract !== ASSET_CONTRACT && !LEGACY_ASSET_CONTRACTS.has(config.assetContract)) {
     throw setupError(
       `Server config uses unsupported contract ${config.schemaVersion}/${config.assetContract}. Upgrade the CLI before setup.`
     );
   }
   parsePort(String(config.appPort), "Server config appPort");
   parsePort(String(config.sshPort), "Server config sshPort");
-  parsePort(String(config.registryPort), "Server config registryPort");
+  if (config.registryPort !== void 0)
+    parsePort(String(config.registryPort), "Server config registryPort");
   validateExposure(null, {
     context: void 0,
     version: void 0,
@@ -2890,7 +2664,6 @@ var parseServerConfig = (raw) => {
     appPort: config.appPort,
     sshPort: config.sshPort,
     dockerSocket: void 0,
-    registryPort: config.registryPort,
     assetsDir: void 0,
     offline: false
   });
@@ -2919,7 +2692,7 @@ var parseSecrets = (raw) => {
     postgresAdminPassword: envValue(fields, "MEND_POSTGRES_ADMIN_PASSWORD"),
     mendDatabasePassword: envValue(fields, "MEND_DB_PASSWORD"),
     sealantDatabasePassword: envValue(fields, "SEALANT_DB_PASSWORD"),
-    queuePassword: envValue(fields, "MEND_RABBITMQ_PASSWORD"),
+    ...fields.has("MEND_RABBITMQ_PASSWORD") ? { queuePassword: envValue(fields, "MEND_RABBITMQ_PASSWORD") } : {},
     betterAuthSecret: envValue(fields, "BETTER_AUTH_SECRET"),
     sealantCredentialsKey: envValue(fields, "SEALANT_CREDENTIALS_KEY"),
     sealantServiceKey: envValue(fields, "SEALANT_SERVICE_KEY"),
@@ -2932,7 +2705,7 @@ var parseSecrets = (raw) => {
     ["MEND_POSTGRES_ADMIN_PASSWORD", secrets.postgresAdminPassword],
     ["MEND_DB_PASSWORD", secrets.mendDatabasePassword],
     ["SEALANT_DB_PASSWORD", secrets.sealantDatabasePassword],
-    ["MEND_RABBITMQ_PASSWORD", secrets.queuePassword],
+    ...secrets.queuePassword === void 0 ? [] : [["MEND_RABBITMQ_PASSWORD", secrets.queuePassword]],
     ["WORKSPACE_SSH_GATEWAY_TOKEN", secrets.workspaceSshGatewayToken]
   ];
   for (const [name, value] of hexSecrets) {
@@ -2957,7 +2730,6 @@ var createSecrets = (runtime) => {
     postgresAdminPassword: hex(0),
     mendDatabasePassword: hex(32),
     sealantDatabasePassword: hex(64),
-    queuePassword: hex(96),
     betterAuthSecret: hex(128),
     sealantCredentialsKey: bytes.subarray(160, 192).toString("base64"),
     sealantServiceKey: `slt_svc_${hex(192)}`,
@@ -3132,8 +2904,6 @@ var validateComposeAsset = (body) => {
     "mend-control:",
     "mend-config:",
     "mend-ssh:",
-    "mend-rabbitmq:",
-    "mend-registry:",
     "mend-postgres:",
     "/var/lib/mend/store",
     "/run/sealant/sockets"
@@ -3161,7 +2931,7 @@ var renderIdentity = (secrets) => [
   `MEND_POSTGRES_ADMIN_PASSWORD=${secrets.postgresAdminPassword}`,
   `MEND_DB_PASSWORD=${secrets.mendDatabasePassword}`,
   `SEALANT_DB_PASSWORD=${secrets.sealantDatabasePassword}`,
-  `MEND_RABBITMQ_PASSWORD=${secrets.queuePassword}`,
+  ...secrets.queuePassword === void 0 ? [] : [`MEND_RABBITMQ_PASSWORD=${secrets.queuePassword}`],
   `BETTER_AUTH_SECRET=${secrets.betterAuthSecret}`,
   `SEALANT_CREDENTIALS_KEY=${secrets.sealantCredentialsKey}`,
   `SEALANT_SERVICE_KEY=${secrets.sealantServiceKey}`,
@@ -3180,7 +2950,7 @@ var renderSecrets = (secrets, config) => {
     `MEND_BIND_HOST=${composeBind}`,
     `MEND_PORT=${config.appPort}`,
     `MEND_SSH_PORT=${config.sshPort}`,
-    `MEND_REGISTRY_PORT=${config.registryPort}`,
+    ...config.registryPort === void 0 ? [] : [`MEND_REGISTRY_PORT=${config.registryPort}`],
     `SEALANT_SSH_HOST=${sshHost}`,
     "MEND_STORE_VOLUME_NAME=mend-store",
     "MEND_CONTROL_VOLUME_NAME=mend-control",
@@ -3262,7 +3032,7 @@ var resolveServerVersion = async (runtime, options, existing) => {
   return version;
 };
 var parseDockerSocketPath = (socket) => {
-  if (!path6.isAbsolute(socket) || /[\r\n$'"#:\\]/.test(socket)) {
+  if (!path5.isAbsolute(socket) || /[\r\n$'"#:\\]/.test(socket)) {
     throw setupError(
       "--docker-socket must be an absolute path without line breaks or Compose interpolation characters."
     );
@@ -3288,8 +3058,8 @@ var resolveAssets = async (runtime, serverVersion, existing, store, options) =>
   if (options.assetsDir !== void 0) {
     try {
       const [compose2, postgresInit2] = await Promise.all([
-        readFile(path6.join(options.assetsDir, COMPOSE_ASSET), "utf8"),
-        readFile(path6.join(options.assetsDir, POSTGRES_INIT_ASSET), "utf8")
+        readFile(path5.join(options.assetsDir, COMPOSE_ASSET), "utf8"),
+        readFile(path5.join(options.assetsDir, POSTGRES_INIT_ASSET), "utf8")
       ]);
       validateComposeAsset(compose2);
       validatePostgresAsset(postgresInit2);
@@ -3297,7 +3067,7 @@ var resolveAssets = async (runtime, serverVersion, existing, store, options) =>
     } catch (cause) {
       if (cause instanceof ServerSetupError) throw cause;
       throw setupError(
-        "Could not read release assets from --assets-dir. Supply compose.v1.yaml and postgres-init.sh."
+        "Could not read release assets from --assets-dir. Supply compose.v2.yaml and postgres-init.sh."
       );
     }
   }
@@ -3408,6 +3178,11 @@ var setupServer = async (args, runtime, store) => {
       `Setup retains Mend ${existing.config.serverVersion}. Use mend server upgrade --version ${options.version} to change the server pin.`
     );
   }
+  if (existing !== null && existing.config.assetContract !== ASSET_CONTRACT) {
+    throw setupError(
+      `Mend ${existing.config.serverVersion} was installed under the ${existing.config.assetContract} bundle contract. Use mend server upgrade --version latest to move it to ${ASSET_CONTRACT}; setup cannot repair it in place.`
+    );
+  }
   const selectedContext = await selectDockerContext(
     runtime,
     options.context ?? existing?.config.dockerContext
@@ -3440,7 +3215,6 @@ var setupServer = async (args, runtime, store) => {
   storeValue(store.activate(generation));
   await startCompose(runtime, config, generation);
   await probeHealth(runtime, config.appUrl, config.serverVersion);
-  await verifyRegistry(runtime, config);
   runtime.writeLine(`Mend ${config.serverVersion} is reachable at ${config.appUrl}`);
   runtime.writeLine(
     `Open ${config.appUrl}, create the first account, then run: mend login --url ${config.appUrl}`
@@ -3504,16 +3278,6 @@ var composeCommand = async (runtime, installation, args) => {
 var interruptionNotice = (runtime) => runtime.writeLine(
   "Connections will be interrupted. Workspace containers and data are retained, but active work can lose connectivity and may need reconnection. Mend does not stop workspace containers."
 );
-var verifyRegistry = async (runtime, config) => {
-  const registry = await probeServerRegistry(runtime, {
-    dockerContext: config.dockerContext,
-    registryPort: config.registryPort,
-    nonce: runtime.randomBytes(24).toString("hex"),
-    temporaryDirectory: path6.resolve(runtime.configDir)
-  });
-  for (const warning of registry.cleanupWarnings) runtime.writeLine(`Warning: ${warning.message}`);
-  if (registry._tag === "error") throw setupError(registry.error.message);
-};
 var startInstallation = async (runtime, installation) => {
   startingNotice(runtime, installation.config.serverVersion);
   await composeCommand(runtime, installation, [
@@ -3525,7 +3289,6 @@ var startInstallation = async (runtime, installation) => {
     "--no-build"
   ]);
   await probeHealth(runtime, installation.config.appUrl, installation.config.serverVersion);
-  await verifyRegistry(runtime, installation.config);
   runtime.writeLine(
     `Mend ${installation.config.serverVersion} is reachable at ${installation.config.appUrl}`
   );
@@ -3562,7 +3325,12 @@ var upgradeServer = async (args, runtime, store, existing) => {
   const previous = storeValue(store.readActive());
   if (previous === null) throw setupError("The active server generation is missing.");
   const assets = await resolveAssets(runtime, version, existing, store, options);
-  const config = { ...existing.config, serverVersion: version };
+  const { registryPort: _legacyRegistryPort, ...carried } = existing.config;
+  const config = {
+    ...carried,
+    assetContract: ASSET_CONTRACT,
+    serverVersion: version
+  };
   const secrets = parseSecrets(previous.files.identity);
   const files = {
     identity: previous.files.identity,
@@ -3734,9 +3502,9 @@ var manageServer = async (command, args, runtime, store) => {
 var nodeServerRuntime = () => {
   const environment = { ...process.env };
   const home = os3.homedir();
-  const configHome = environment["XDG_CONFIG_HOME"] ?? path6.join(home, ".config");
+  const configHome = environment["XDG_CONFIG_HOME"] ?? path5.join(home, ".config");
   return {
-    configDir: path6.join(configHome, "mend"),
+    configDir: path5.join(configHome, "mend"),
     platform: process.platform,
     cliVersion: cliVersion(),
     run: (command, args, options) => runServerProcess(command, args, environment, options),
@@ -3753,7 +3521,7 @@ var nodeServerRuntime = () => {
       }
     },
     randomBytes,
-    sleep: (milliseconds) => new Promise((resolve5) => setTimeout(resolve5, milliseconds)),
+    sleep: (milliseconds) => new Promise((resolve4) => setTimeout(resolve4, milliseconds)),
     writeLine: (line) => process.stdout.write(`${line}
 `)
   };
@@ -3962,8 +3730,8 @@ var renderMendToml = (proposals) => {
 };
 
 // src/skills.ts
-import * as fs7 from "node:fs";
-import * as path7 from "node:path";
+import * as fs6 from "node:fs";
+import * as path6 from "node:path";
 var DEFAULT_SKILLS_DIR = ".agents/skills";
 var MAX_SKILL_FILES = 64;
 var MAX_SKILL_FILE_BYTES = 512 * 1024;
@@ -3986,12 +3754,12 @@ var readFrontmatterDescription = (contents) => {
 var walkFiles = (root) => {
   const found = [];
   const visit = (dir) => {
-    for (const entry of fs7.readdirSync(dir, { withFileTypes: true })) {
+    for (const entry of fs6.readdirSync(dir, { withFileTypes: true })) {
       if (IGNORED_DIRS.has(entry.name)) continue;
-      const absolute = path7.join(dir, entry.name);
+      const absolute = path6.join(dir, entry.name);
       let stat;
       try {
-        stat = fs7.statSync(absolute);
+        stat = fs6.statSync(absolute);
       } catch {
         continue;
       }
@@ -4005,7 +3773,7 @@ var walkFiles = (root) => {
 var scanSkillLibrary = (root) => {
   let entries;
   try {
-    entries = fs7.readdirSync(root, { withFileTypes: true });
+    entries = fs6.readdirSync(root, { withFileTypes: true });
   } catch {
     return { error: `${root} is not a readable directory` };
   }
@@ -4013,23 +3781,23 @@ var scanSkillLibrary = (root) => {
   const notes = [];
   for (const entry of entries.toSorted((a, b) => a.name.localeCompare(b.name))) {
     if (entry.name.startsWith(".")) continue;
-    const skillDir = path7.join(root, entry.name);
+    const skillDir = path6.join(root, entry.name);
     let stat;
     try {
-      stat = fs7.statSync(skillDir);
+      stat = fs6.statSync(skillDir);
     } catch {
       continue;
     }
     if (!stat.isDirectory()) continue;
-    if (!fs7.existsSync(path7.join(skillDir, "SKILL.md"))) {
+    if (!fs6.existsSync(path6.join(skillDir, "SKILL.md"))) {
       notes.push({ skill: entry.name, message: "no SKILL.md \u2014 skipped" });
       continue;
     }
     const files = [];
     let bytes = 0;
     for (const absolute of walkFiles(skillDir)) {
-      const relative3 = path7.relative(skillDir, absolute).split(path7.sep).join("/");
-      const buffer = fs7.readFileSync(absolute);
+      const relative3 = path6.relative(skillDir, absolute).split(path6.sep).join("/");
+      const buffer = fs6.readFileSync(absolute);
       if (buffer.byteLength > MAX_SKILL_FILE_BYTES) {
         notes.push({ skill: entry.name, message: `${relative3} is over 512KB \u2014 skipped` });
         continue;
@@ -4065,15 +3833,15 @@ var scanSkillLibrary = (root) => {
 
 // src/ssh-setup.ts
 import * as os5 from "node:os";
-import * as path9 from "node:path";
+import * as path8 from "node:path";
 
 // ../../packages/workspace-ssh/src/index.ts
 import { spawnSync } from "node:child_process";
 import { createHash as createHash2 } from "node:crypto";
-import * as fs8 from "node:fs";
+import * as fs7 from "node:fs";
 import { isIP as isIP2 } from "node:net";
 import * as os4 from "node:os";
-import * as path8 from "node:path";
+import * as path7 from "node:path";
 var LEGACY_BLOCK_BEGIN = "# >>> mend workspace ssh (managed by `mend ssh setup`) >>>";
 var LEGACY_BLOCK_END = "# <<< mend workspace ssh <<<";
 var WorkspaceSshError = class extends Error {
@@ -4089,7 +3857,7 @@ var WorkspaceSshError = class extends Error {
   }
 };
 var success = (value) => ({ ok: true, value });
-var failure = (error2) => ({ ok: false, error: error2 });
+var failure = (error) => ({ ok: false, error });
 var stripIpv6Brackets = (hostname6) => hostname6.startsWith("[") && hostname6.endsWith("]") ? hostname6.slice(1, -1) : hostname6;
 var hashIdentity = (identity) => createHash2("sha256").update(identity).digest("hex").slice(0, 24);
 var aliasLabel = (hostname6) => {
@@ -4160,8 +3928,8 @@ var blockBegin = (alias) => `# >>> mend workspace ssh ${alias} (managed) >>>`;
 var blockEnd = (alias) => `# <<< mend workspace ssh ${alias} <<<`;
 var hasControls = (value) => /[\p{Cc}\p{Zl}\p{Zp}]/u.test(value);
 var parseIdentityPath = (value) => {
-  const resolved = path8.resolve(
-    value.startsWith("~/") ? path8.join(os4.homedir(), value.slice(2)) : value
+  const resolved = path7.resolve(
+    value.startsWith("~/") ? path7.join(os4.homedir(), value.slice(2)) : value
   );
   if (value === "" || hasControls(value) || hasControls(resolved) || value.includes("${") || resolved.includes("${")) {
     return failure(
@@ -4297,10 +4065,10 @@ var agentKeys = () => {
 };
 var readText = (file) => {
   try {
-    return success(fs8.readFileSync(file, "utf8"));
+    return success(fs7.readFileSync(file, "utf8"));
   } catch (cause) {
-    const error2 = cause instanceof Error && "code" in cause ? cause.code : void 0;
-    return error2 === "ENOENT" ? success("") : failure(new WorkspaceSshError("key", `Could not read ${file}.`, cause));
+    const error = cause instanceof Error && "code" in cause ? cause.code : void 0;
+    return error === "ENOENT" ? success("") : failure(new WorkspaceSshError("key", `Could not read ${file}.`, cause));
   }
 };
 var configuredWorkspaceSshIdentityFile = (config, target) => {
@@ -4355,19 +4123,19 @@ var readRequiredKey = (keyPath, source) => {
 var readOptionalKey = (keyPath) => {
   const parsed = parseIdentityPath(keyPath);
   if (!parsed.ok) return parsed;
-  if (!fs8.existsSync(parsed.value) && !fs8.existsSync(publicKeyPath(parsed.value)))
+  if (!fs7.existsSync(parsed.value) && !fs7.existsSync(publicKeyPath(parsed.value)))
     return success(null);
   return readRequiredKey(parsed.value, "existing");
 };
 var pinAgentKey = (configHome, publicKey) => {
-  const identityFile = path8.resolve(
+  const identityFile = path7.resolve(
     configHome,
     "ssh",
     `agent-${hashIdentity(publicKeyIdentity(publicKey))}.pub`
   );
   try {
-    fs8.mkdirSync(path8.dirname(identityFile), { recursive: true, mode: 448 });
-    fs8.writeFileSync(identityFile, `${publicKey}
+    fs7.mkdirSync(path7.dirname(identityFile), { recursive: true, mode: 448 });
+    fs7.writeFileSync(identityFile, `${publicKey}
 `, { mode: 384 });
     return success({ publicKey, identityFile, source: "agent" });
   } catch (cause) {
@@ -4378,10 +4146,10 @@ var pinAgentKey = (configHome, publicKey) => {
 };
 var generateDedicatedKey = (privatePath) => {
   try {
-    fs8.mkdirSync(path8.dirname(privatePath), { recursive: true, mode: 448 });
+    fs7.mkdirSync(path7.dirname(privatePath), { recursive: true, mode: 448 });
   } catch (cause) {
     return failure(
-      new WorkspaceSshError("key", `Could not create ${path8.dirname(privatePath)}.`, cause)
+      new WorkspaceSshError("key", `Could not create ${path7.dirname(privatePath)}.`, cause)
     );
   }
   const generated = spawnSync(
@@ -4410,7 +4178,7 @@ var generateDedicatedKey = (privatePath) => {
   return fresh;
 };
 var dedicatedKey = (configHome, create) => {
-  const privatePath = path8.join(configHome, "ssh", "id_ed25519");
+  const privatePath = path7.join(configHome, "ssh", "id_ed25519");
   const existing = readOptionalKey(privatePath);
   if (existing.ok === false) return failure(existing.error);
   if (existing.value !== null || !create) return existing;
@@ -4458,10 +4226,10 @@ var writeWorkspaceSshConfig = (configFile, target, identityFile) => {
   const reconciled = reconcileWorkspaceSshConfig(before.value, target, identityFile);
   if (reconciled.ok === false) return failure(reconciled.error);
   try {
-    fs8.mkdirSync(path8.dirname(configFile), { recursive: true, mode: 448 });
-    fs8.chmodSync(path8.dirname(configFile), 448);
-    fs8.writeFileSync(configFile, reconciled.value, { mode: 384 });
-    fs8.chmodSync(configFile, 384);
+    fs7.mkdirSync(path7.dirname(configFile), { recursive: true, mode: 448 });
+    fs7.chmodSync(path7.dirname(configFile), 448);
+    fs7.writeFileSync(configFile, reconciled.value, { mode: 384 });
+    fs7.chmodSync(configFile, 384);
     return success(void 0);
   } catch (cause) {
     return failure(new WorkspaceSshError("config", `Could not write ${configFile}.`, cause));
@@ -4474,7 +4242,7 @@ var dim3 = ansi("2");
 var green3 = ansi("32");
 var warn = ansi("33");
 var say3 = (line) => console.log(line);
-var sshConfigPath = () => path9.join(os5.homedir(), ".ssh", "config");
+var sshConfigPath = () => path8.join(os5.homedir(), ".ssh", "config");
 var flagValue = (args, flag) => {
   const index = args.indexOf(flag);
   return index === -1 || args[index + 1] === void 0 ? null : String(args[index + 1]);
@@ -4588,19 +4356,19 @@ var sshCommand = async (args, api2, cliHome, serverUrl) => {
 // src/main.ts
 var mendCliHome = () => {
   const xdg = process.env["XDG_CONFIG_HOME"];
-  const preferred = path10.join(
-    xdg === void 0 || xdg === "" ? path10.join(os6.homedir(), ".config") : xdg,
+  const preferred = path9.join(
+    xdg === void 0 || xdg === "" ? path9.join(os6.homedir(), ".config") : xdg,
     "mend"
   );
-  const legacy = path10.join(os6.homedir(), ".mend");
-  return !fs9.existsSync(preferred) && fs9.existsSync(legacy) ? legacy : preferred;
+  const legacy = path9.join(os6.homedir(), ".mend");
+  return !fs8.existsSync(preferred) && fs8.existsSync(legacy) ? legacy : preferred;
 };
-var CONFIG_PATH = path10.join(mendCliHome(), "cli.json");
+var CONFIG_PATH = path9.join(mendCliHome(), "cli.json");
 var loadConfig = () => {
   let fileConfig = {};
-  if (fs9.existsSync(CONFIG_PATH)) {
+  if (fs8.existsSync(CONFIG_PATH)) {
     try {
-      fileConfig = JSON.parse(fs9.readFileSync(CONFIG_PATH, "utf8"));
+      fileConfig = JSON.parse(fs8.readFileSync(CONFIG_PATH, "utf8"));
     } catch {
       fail4(`could not parse ${CONFIG_PATH}`);
     }
@@ -4700,8 +4468,8 @@ var request = async (config, method, route, body) => {
 var api = async (config, method, route, body) => {
   try {
     return await request(config, method, route, body);
-  } catch (error2) {
-    return fail4(error2 instanceof Error ? error2.message : String(error2));
+  } catch (error) {
+    return fail4(error instanceof Error ? error.message : String(error));
   }
 };
 var boundApi = (config) => (method, route, body) => api(config, method, route, body);
@@ -4737,7 +4505,7 @@ var adopt = async (config, args) => {
   }
   const sourceIssue = repositoryCloneUrlIssue(source);
   if (sourceIssue !== null) return fail4(sourceIssue);
-  const projectName = name ?? normalizeProjectName(path10.basename(source, ".git"));
+  const projectName = name ?? normalizeProjectName(path9.basename(source, ".git"));
   const auth = authFlagIndex !== -1 && args[authFlagIndex + 1] !== void 0 ? String(args[authFlagIndex + 1]) : null;
   if (auth !== null && auth !== "ambient" && auth !== "mend-key" && auth !== "bridge") {
     return fail4(`--auth takes "ambient", "mend-key", or "bridge", not "${auth}"`);
@@ -4782,7 +4550,7 @@ var findProject = async (config, explicit, adoptCwd = false) => {
   const sourceIssue = repositoryCloneUrlIssue(facts.originUrl);
   if (sourceIssue !== null) return fail4(sourceIssue);
   const adopted = await api(config, "POST", "/projects", {
-    name: normalizeProjectName(path10.basename(facts.repoRoot)),
+    name: normalizeProjectName(path9.basename(facts.repoRoot)),
     source: facts.originUrl
   });
   say4(`${green4("\u2713")} adopted \xB7 ${adopted.name} \xB7 ${dim4(adopted.storePath)}`);
@@ -4927,8 +4695,8 @@ var attachTty = async (config, sessionId, harness, from, processId, options) =>
   const ws = new WebSocket(url);
   ws.binaryType = "arraybuffer";
   try {
-    await new Promise((resolve5, reject) => {
-      ws.addEventListener("open", () => resolve5(), { once: true });
+    await new Promise((resolve4, reject) => {
+      ws.addEventListener("open", () => resolve4(), { once: true });
       ws.addEventListener("error", () => reject(new Error("could not connect")), { once: true });
     });
   } catch {
@@ -4936,8 +4704,8 @@ var attachTty = async (config, sessionId, harness, from, processId, options) =>
   }
   const stopHerdrHint = hintHerdrAttachment(harness);
   let finishAttachment;
-  const finished = new Promise((resolve5) => {
-    finishAttachment = resolve5;
+  const finished = new Promise((resolve4) => {
+    finishAttachment = resolve4;
   });
   const onClose = () => finishAttachment?.();
   if (ws.readyState === WebSocket.CLOSED) finishAttachment?.();
@@ -5555,7 +5323,7 @@ var serviceLogs = async (config, args) => {
     cursor = page.nextFrom;
     const ended = page.status === "exited" || page.status === "failed";
     if (ended && !advanced) break;
-    if (!advanced) await new Promise((resolve5) => setTimeout(resolve5, 250));
+    if (!advanced) await new Promise((resolve4) => setTimeout(resolve4, 250));
   }
   say4("");
   say4(dim4(`stream ended \xB7 next sequence ${cursor}`));
@@ -5573,13 +5341,13 @@ var serviceRestart = async (config, args) => {
 };
 var serviceInit = async (args) => {
   const root = gitTopLevel(process.cwd()) ?? process.cwd();
-  const target = path10.join(root, "mend.toml");
-  if (fs9.existsSync(target)) {
+  const target = path9.join(root, "mend.toml");
+  if (fs8.existsSync(target)) {
     return fail4(`${target} already exists \u2014 edit it directly (init never merges)`);
   }
-  const rootFiles = fs9.readdirSync(root);
+  const rootFiles = fs8.readdirSync(root);
   const proposals = [];
-  const readRoot = (name) => fs9.readFileSync(path10.join(root, name), "utf8");
+  const readRoot = (name) => fs8.readFileSync(path9.join(root, name), "utf8");
   if (rootFiles.includes("package.json")) {
     proposals.push(...proposeFromPackageJson(readRoot("package.json"), rootFiles));
   }
@@ -5589,13 +5357,13 @@ var serviceInit = async (args) => {
   );
   for (const glob of globs) {
     const parent = glob.replace(/\/?\*+$/, "");
-    const dirs = glob.endsWith("*") ? fs9.existsSync(path10.join(root, parent)) ? fs9.readdirSync(path10.join(root, parent)).map((dir) => path10.join(parent, dir)) : [] : [glob];
+    const dirs = glob.endsWith("*") ? fs8.existsSync(path9.join(root, parent)) ? fs8.readdirSync(path9.join(root, parent)).map((dir) => path9.join(parent, dir)) : [] : [glob];
     for (const dir of dirs) {
-      const manifest = path10.join(root, dir, "package.json");
-      if (!fs9.existsSync(manifest)) continue;
+      const manifest = path9.join(root, dir, "package.json");
+      if (!fs8.existsSync(manifest)) continue;
       for (const proposal of proposeFromWorkspacePackage(
-        path10.basename(dir),
-        fs9.readFileSync(manifest, "utf8"),
+        path9.basename(dir),
+        fs8.readFileSync(manifest, "utf8"),
         rootFiles
       )) {
         if (!proposals.some((existing) => existing.name === proposal.name)) {
@@ -5639,7 +5407,7 @@ var serviceInit = async (args) => {
       return;
     }
   }
-  fs9.writeFileSync(target, toml);
+  fs8.writeFileSync(target, toml);
   say4(`${green4("\u2713")} wrote ${target} \u2014 commit it, then: mend service run ${proposals[0]?.name}`);
 };
 var tunnelServices = async (config, services, portOverride) => {
@@ -5670,16 +5438,16 @@ var tunnelServices = async (config, services, portOverride) => {
       socket.on("close", () => ws.close());
       socket.on("error", () => ws.close());
     });
-    await new Promise((resolve5, reject) => {
-      server.once("error", (error2) => {
+    await new Promise((resolve4, reject) => {
+      server.once("error", (error) => {
         reject(
           new Error(
-            error2.code === "EADDRINUSE" ? `127.0.0.1:${port} is already in use here \u2014 pick one with: mend service connect ${service.label} --port <n>` : error2.message
+            error.code === "EADDRINUSE" ? `127.0.0.1:${port} is already in use here \u2014 pick one with: mend service connect ${service.label} --port <n>` : error.message
           )
         );
       });
-      server.listen(port, "127.0.0.1", () => resolve5());
-    }).catch((error2) => fail4(error2.message));
+      server.listen(port, "127.0.0.1", () => resolve4());
+    }).catch((error) => fail4(error.message));
     say4(
       `${green4("\u25CF")} ${service.label ?? service.id.slice(0, 8)} \u2192 127.0.0.1:${port} ${dim4(`(tunnel to ${config.url})`)}`
     );
@@ -5732,18 +5500,18 @@ var serviceCommand = async (config, args) => {
   }
 };
 var isProvider = (value) => value === "claude" || value === "codex" || value === "github";
-var readIfExists = (file) => fs9.existsSync(file) ? fs9.readFileSync(file, "utf8") : null;
+var readIfExists = (file) => fs8.existsSync(file) ? fs8.readFileSync(file, "utf8") : null;
 var localCredential = (provider) => {
   const home = os6.homedir();
   switch (provider) {
     case "codex":
       return readIfExists(
-        path10.join(process.env["CODEX_HOME"] ?? path10.join(home, ".codex"), "auth.json")
+        path9.join(process.env["CODEX_HOME"] ?? path9.join(home, ".codex"), "auth.json")
       );
     case "claude":
       return readIfExists(
-        path10.join(
-          process.env["CLAUDE_CONFIG_DIR"] ?? path10.join(home, ".claude"),
+        path9.join(
+          process.env["CLAUDE_CONFIG_DIR"] ?? path9.join(home, ".claude"),
           ".credentials.json"
         )
       );
@@ -5797,7 +5565,7 @@ var connectCommand = async (config, args) => {
   }
   let secret;
   if (flags.includes("--from-stdin")) {
-    secret = fs9.readFileSync(0, "utf8").trim();
+    secret = fs8.readFileSync(0, "utf8").trim();
     if (secret === "") return fail4("nothing on stdin");
   } else {
     secret = localCredential(provider);
@@ -5818,14 +5586,14 @@ var takeFlagValue3 = (args, flag) => {
   return at !== -1 && args[at + 1] !== void 0 ? String(args[at + 1]) : null;
 };
 var saveCliConfig = (next) => {
-  fs9.mkdirSync(path10.dirname(CONFIG_PATH), { recursive: true, mode: 448 });
-  fs9.writeFileSync(
+  fs8.mkdirSync(path9.dirname(CONFIG_PATH), { recursive: true, mode: 448 });
+  fs8.writeFileSync(
     CONFIG_PATH,
     `${JSON.stringify({ url: next.url, token: next.token, deviceId: next.deviceId }, null, 2)}
 `,
     { mode: 384 }
   );
-  fs9.chmodSync(CONFIG_PATH, 384);
+  fs8.chmodSync(CONFIG_PATH, 384);
 };
 var login = async (config, args) => {
   await loginCommand(args, {
@@ -5838,7 +5606,7 @@ var login = async (config, args) => {
   });
 };
 var logout = async (config) => {
-  if (!fs9.existsSync(CONFIG_PATH) && config.token === null) {
+  if (!fs8.existsSync(CONFIG_PATH) && config.token === null) {
     say4(dim4("nothing saved \u2014 already signed out"));
     return;
   }
@@ -6027,10 +5795,10 @@ var envLoad = async (config, args) => {
   const positional = args.filter(
     (arg, i) => !arg.startsWith("--") && args[i - 1] !== "--project" && !consumed.has(i)
   );
-  const file = path10.resolve(positional[0] ?? ".env");
+  const file = path9.resolve(positional[0] ?? ".env");
   let contents;
   try {
-    contents = fs9.readFileSync(file, "utf8");
+    contents = fs8.readFileSync(file, "utf8");
   } catch {
     return fail4(`cannot read ${file} \u2014 pass a path: mend env load path/to/.env`);
   }
@@ -6046,10 +5814,10 @@ var envLoad = async (config, args) => {
     { contents, allSecret, secretNames }
   );
   if (report.loaded.length === 0 && report.rejected.length === 0 && report.malformedLines.length === 0) {
-    say4(dim4(`${path10.basename(file)} has no variables`));
+    say4(dim4(`${path9.basename(file)} has no variables`));
     return;
   }
-  say4(`${green4("\u2713")} loaded ${path10.basename(file)} into ${project2.name}`);
+  say4(`${green4("\u2713")} loaded ${path9.basename(file)} into ${project2.name}`);
   for (const line of formatLoadReport(report, { dim: dim4, warn: amber })) say4(line);
   const plaintextUrls = report.loaded.filter(
     (entry) => entry.lane === "configuration" && /_(URL|URI|DSN)$/.test(entry.name)
@@ -6238,7 +6006,7 @@ var skillsList = async (config, args) => {
 };
 var skillsPush = async (config, args) => {
   const dirFlag = takeFlagValue3(args, "--dir");
-  const root = dirFlag === null ? path10.join(os6.homedir(), DEFAULT_SKILLS_DIR) : path10.resolve(dirFlag);
+  const root = dirFlag === null ? path9.join(os6.homedir(), DEFAULT_SKILLS_DIR) : path9.resolve(dirFlag);
   const scanned = scanSkillLibrary(root);
   if ("error" in scanned) return fail4(scanned.error);
   for (const note of scanned.notes) say4(dim4(`  ${note.skill}: ${note.message}`));
@@ -6328,7 +6096,7 @@ _mend() {
         compadd setup status start stop restart logs upgrade
       else
         case $words[3] in
-          setup) compadd -- --version --assets-dir --offline --context --port --ssh-port --registry-port --bind --url --origin --docker-socket ;;
+          setup) compadd -- --version --assets-dir --offline --context --port --ssh-port --bind --url --origin --docker-socket ;;
           upgrade) compadd -- --version --assets-dir --offline ;;
           start|restart) compadd -- --offline ;;
           logs) compadd -- --tail ;;
@@ -6357,7 +6125,7 @@ var BASH_COMPLETIONS = `_mend() {
         options="setup status start stop restart logs upgrade"
       else
         case \${COMP_WORDS[2]} in
-          setup) options="--version --assets-dir --offline --context --port --ssh-port --registry-port --bind --url --origin --docker-socket" ;;
+          setup) options="--version --assets-dir --offline --context --port --ssh-port --bind --url --origin --docker-socket" ;;
           upgrade) options="--version --assets-dir --offline" ;;
           start|restart) options="--offline" ;;
           logs) options="--tail" ;;
@@ -6539,10 +6307,10 @@ var resumeForRejoin = async (config, sessionId, label) => {
       request(config, "POST", `/sessions/${sessionId}/resume`, { harness: null })
     );
     return true;
-  } catch (error2) {
+  } catch (error) {
     const refreshed = await api(config, "GET", `/sessions/${sessionId}`);
     if (agentIsLive(refreshed.session, refreshed.currentAgent)) return false;
-    return fail4(error2 instanceof Error ? error2.message : String(error2));
+    return fail4(error instanceof Error ? error.message : String(error));
   }
 };
 var rejoinCommand = async (config, args) => {
@@ -6882,7 +6650,7 @@ var dashboard = async (config) => {
     );
     process.exit(rerun.status ?? 0);
   }
-  const { runDashboard } = await import("./dashboard-YEU7SDYB.js");
+  const { runDashboard } = await import("./dashboard-JIWYW3EM.js");
   const agentShare = await startShareIfBridge(config);
   try {
     await runDashboard({
@@ -6952,10 +6720,10 @@ var manCommand = (words) => {
   }
   const version = cliVersion();
   const page = doc === null ? renderManIndex(version) : renderManPage(doc, version);
-  const file = path10.join(os6.tmpdir(), `mend-man-${process.pid}-${manFileName(doc)}`);
-  fs9.writeFileSync(file, page);
+  const file = path9.join(os6.tmpdir(), `mend-man-${process.pid}-${manFileName(doc)}`);
+  fs8.writeFileSync(file, page);
   const result = spawnSync2("man", ["-l", file], { stdio: "inherit" });
-  fs9.rmSync(file, { force: true });
+  fs8.rmSync(file, { force: true });
   if (result.error !== void 0 || result.status !== 0) {
     say4(doc === null ? renderIndex() : renderCommand(doc));
   }