@sealant/mend 0.24.2 → 0.26.0

package/dist/main.js

@@ -40,7 +40,7 @@ var bridgeUrlOf = (serverUrl, token, host) => {
 var retryDelayMs = (attempt2) => Math.min(3e4, 1e3 * 2 ** Math.min(Math.max(attempt2 - 1, 0), 5));
 var SSH_AGENTC_REQUEST_IDENTITIES = 11;
 var SSH_AGENTC_SIGN_REQUEST = 13;
-var askLocalAgent = (agentSock, payload) => new Promise((resolve5, reject) => {
+var askLocalAgent = (agentSock, payload) => new Promise((resolve4, reject) => {
   const connection = net.connect(agentSock, () => {
     connection.write(payload);
   });
@@ -54,12 +54,12 @@ var askLocalAgent = (agentSock, payload) => new Promise((resolve5, reject) => {
     if (pending.length >= 4 && pending.length >= 4 + pending.readUInt32BE(0)) {
       clearTimeout(timer);
       connection.end();
-      resolve5(pending.subarray(0, 4 + pending.readUInt32BE(0)));
+      resolve4(pending.subarray(0, 4 + pending.readUInt32BE(0)));
     }
   });
-  connection.on("error", (error2) => {
+  connection.on("error", (error) => {
     clearTimeout(timer);
-    reject(error2);
+    reject(error);
   });
 });
 var sleep = (ms, signal) => delay(ms, void 0, { signal }).then(
@@ -74,12 +74,12 @@ var shareAgent = async (options) => {
     const ws = new WebSocket(url);
     const onAbort = () => ws.close();
     signal.addEventListener("abort", onAbort, { once: true });
-    const closed = new Promise((resolve5) => {
-      ws.addEventListener("close", () => resolve5(), { once: true });
+    const closed = new Promise((resolve4) => {
+      ws.addEventListener("close", () => resolve4(), { once: true });
     });
-    const opened = await new Promise((resolve5) => {
-      ws.addEventListener("open", () => resolve5(true), { once: true });
-      ws.addEventListener("error", () => resolve5(false), { once: true });
+    const opened = await new Promise((resolve4) => {
+      ws.addEventListener("open", () => resolve4(true), { once: true });
+      ws.addEventListener("error", () => resolve4(false), { once: true });
     });
     if (opened) {
       attempt2 = 0;
@@ -112,8 +112,8 @@ var shareAgent = async (options) => {
             if (type === SSH_AGENTC_SIGN_REQUEST) {
               onEvent({ kind: "signed", context, seconds: (Date.now() - started) / 1e3 });
             }
-          } catch (error2) {
-            const message = error2 instanceof Error ? error2.message : String(error2);
+          } catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
             if (ws.readyState === WebSocket.OPEN) {
               ws.send(JSON.stringify({ t: "err", id, message }));
             }
@@ -171,13 +171,13 @@ var parsePngfHex = (output) => {
   return Buffer.from(match[1], "hex");
 };
 var MAX_BYTES = 32 * 1024 * 1024;
-var run = (command, args) => new Promise((resolve5) => {
+var run = (command, args) => new Promise((resolve4) => {
   execFile(
     command,
     [...args],
     { encoding: "buffer", maxBuffer: MAX_BYTES, timeout: 3e3 },
-    (error2, stdout) => {
-      resolve5(error2 === null ? stdout : null);
+    (error, stdout) => {
+      resolve4(error === null ? stdout : null);
     }
   );
 });
@@ -1037,7 +1037,7 @@ var COMMANDS = [
     section: "this machine",
     summary: "install or repair the local Mend server",
     synopsis: [
-      "[--context <name>] [--version <version|latest>] [--bind <ip>] [--url <origin>] [--origin <origin>...] [--port <n>] [--ssh-port <n>] [--registry-port <n>] [--docker-socket <path>] [--assets-dir <dir>] [--offline]"
+      "[--context <name>] [--version <version|latest>] [--bind <ip>] [--url <origin>] [--origin <origin>...] [--port <n>] [--ssh-port <n>] [--docker-socket <path>] [--assets-dir <dir>] [--offline]"
     ],
     description: [
       "Checks a local Unix-socket Docker context and the Compose plugin, downloads the compose and Postgres initialization assets for one Mend release, preserves existing data and secrets, and starts the server. Re-running repairs the same pinned version. A changed --version is refused; use mend server upgrade. Updating this CLI never updates an existing server pin.",
@@ -1061,18 +1061,17 @@ var COMMANDS = [
         text: "additional exact browser origin; repeat for more than one"
       },
       { flag: "--port <n>", text: "external web port. Default: 3105" },
-      { flag: "--ssh-port <n>", text: "external workspace SSH port. Default: 2222" },
       {
-        flag: "--registry-port <n>",
-        text: "loopback registry port. Default: 5000; all three ports must differ"
+        flag: "--ssh-port <n>",
+        text: "external workspace SSH port. Default: 2222; must differ from --port"
       },
       {
         flag: "--assets-dir <dir>",
-        text: "copy compose.v1.yaml and postgres-init.sh from a release directory; fresh setup requires --version"
+        text: "copy compose.v2.yaml and postgres-init.sh from a release directory; fresh setup requires --version"
       },
       {
         flag: "--offline",
-        text: "use retained or supplied assets and preloaded images only; no GitHub requests or release-image pulls; exact image label, health version and a loopback registry roundtrip required"
+        text: "use retained or supplied assets and preloaded images only; no GitHub requests or release-image pulls; exact image label and health version required"
       },
       { flag: "--docker-socket <path>", text: "daemon-side socket mount override for diagnostics" }
     ],
@@ -1083,7 +1082,7 @@ var COMMANDS = [
         text: "explicit tailnet exposure"
       },
       {
-        command: "mend server setup --version 0.23.0 --assets-dir ./release-assets --offline --registry-port 5501",
+        command: "mend server setup --version 0.25.0 --assets-dir ./release-assets --offline",
         text: "install from local release assets and preloaded images"
       }
     ],
@@ -1105,14 +1104,9 @@ var COMMANDS = [
     summary: "start the selected server generation",
     synopsis: ["[--offline]"],
     description: [
-      "Reuses the saved context, generation, credentials and exact pin. Uses preloaded release images, with no release-image pulls or asset downloads, even without --offline. Exact image label, health version and a loopback registry roundtrip are required."
-    ],
-    options: [
-      {
-        flag: "--offline",
-        text: "use local release images and assets; still probe the loopback registry"
-      }
+      "Reuses the saved context, generation, credentials and exact pin. Uses preloaded release images, with no release-image pulls or asset downloads, even without --offline. Exact image label and health version are required."
     ],
+    options: [{ flag: "--offline", text: "use local release images and assets" }],
     see: ["server status", "server upgrade"]
   },
   {
@@ -1131,14 +1125,9 @@ var COMMANDS = [
     summary: "restart Mend using the same generation and pin",
     synopsis: ["[--offline]"],
     description: [
-      "Checks preloaded images before stopping Mend, then starts the saved generation and verifies exact-version health and a loopback registry roundtrip. Postgres stays running. Connections are interrupted; workspace containers and data remain, but active work may need reconnection."
-    ],
-    options: [
-      {
-        flag: "--offline",
-        text: "use local release images and assets; still probe the loopback registry"
-      }
+      "Checks preloaded images before stopping Mend, then starts the saved generation and verifies exact-version health. Postgres stays running. Connections are interrupted; workspace containers and data remain, but active work may need reconnection."
     ],
+    options: [{ flag: "--offline", text: "use local release images and assets" }],
     see: ["server status", "server logs"]
   },
   {
@@ -1169,11 +1158,11 @@ var COMMANDS = [
       },
       {
         flag: "--assets-dir <dir>",
-        text: "copy target compose.v1.yaml and postgres-init.sh from local release assets"
+        text: "copy target compose.v2.yaml and postgres-init.sh from local release assets"
       },
       {
         flag: "--offline",
-        text: "no GitHub requests or release-image pulls; target assets and exact-version images must be local; still probe the loopback registry"
+        text: "no GitHub requests or release-image pulls; target assets and exact-version images must be local"
       }
     ],
     examples: [
@@ -1224,6 +1213,30 @@ var COMMANDS = [
     description: ["Other terminals and devices keep their own tokens."],
     see: ["login"]
   },
+  {
+    name: "uninstall",
+    section: "this machine",
+    summary: "remove the server, this machine's Mend files, or both",
+    synopsis: ["[--all | --server | --home] [--yes]"],
+    description: [
+      "Asks which scope to remove when none is given, prints exactly what will go, and requires the word delete before the server is touched. The server scope removes the local Compose installation: its containers, every volume it owns (repositories, worktrees, the database), its release image, and the private configuration with its generations and backups. The home scope revokes this terminal's device token, then removes cli.json, the workspace SSH key, and the managed block in ~/.ssh/config.",
+      "Nothing else under the configuration directory is touched; a host-run store or keys root is listed and left in place. Workspace containers carry no label Mend can filter on, so they are named with the command that removes them, never removed."
+    ],
+    options: [
+      { flag: "--all", text: "the server and this machine's Mend files" },
+      { flag: "--server", text: "only the local server installation" },
+      { flag: "--home", text: "only this machine's sign-in, ssh key and config block" },
+      { flag: "--yes", text: "skip the confirmation; required without a terminal" }
+    ],
+    examples: [
+      { command: "mend uninstall", text: "choose a scope, then confirm" },
+      {
+        command: "mend uninstall --home --yes",
+        text: "forget this machine's sign-in without asking"
+      }
+    ],
+    see: ["server stop", "logout"]
+  },
   {
     name: "completions",
     section: "this machine",
@@ -1677,7 +1690,7 @@ var retryAfterSecondsOf = (json) => {
   }
   return 5;
 };
-var sleep2 = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
+var sleep2 = (ms) => new Promise((resolve4) => setTimeout(resolve4, ms));
 var resolveServerUrl = async (args, deps) => {
   const given = takeFlagValue2(args, "--url") ?? deps.configuredUrl;
   if (given !== null) {
@@ -1750,7 +1763,7 @@ import { randomBytes } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import * as net2 from "node:net";
 import * as os3 from "node:os";
-import * as path6 from "node:path";
+import * as path5 from "node:path";
 
 // src/server-docker-volumes.ts
 import { createHash } from "node:crypto";
@@ -1955,223 +1968,10 @@ var ownership = async (runtime, input, mode) => {
 var claimServerDockerVolumes = (runtime, input) => ownership(runtime, input, "claim");
 var verifyServerDockerVolumes = (runtime, input) => ownership(runtime, input, "verify");
 
-// src/server-registry-probe.ts
-import { Buffer as Buffer2 } from "node:buffer";
-import * as fs3 from "node:fs/promises";
-import * as path3 from "node:path";
-var ServerRegistryProbeError = class extends Error {
-  /** Stable error discriminator. */
-  _tag = "ServerRegistryProbeError";
-  /** Failed roundtrip operation, independent of the host operating system. */
-  stage;
-  /** Bounded, credential-scrubbed failure detail. */
-  diagnostic;
-  /** Explain the failed Engine operation without recommending a wider registry binding. */
-  constructor(stage, diagnostic) {
-    super(
-      `Docker registry probe failed (${stage}): ${diagnostic}. The selected Docker Engine must import, push and pull through 127.0.0.1 at the configured registry port. Check bundle health, Docker context and Engine loopback registry support, then retry. Do not widen the registry binding.`
-    );
-    this.stage = stage;
-    this.diagnostic = diagnostic;
-  }
-};
-var PROBE_LABEL = "dev.sealant.mend.registry-probe";
-var COMMAND_TIMEOUT_MS = 6e4;
-var CLEANUP_TIMEOUT_MS = 15e3;
-var error = (stage, diagnostic) => ({ _tag: "error", error: new ServerRegistryProbeError(stage, diagnostic) });
-var safeDiagnostic = (text) => text.replace(/([a-z][a-z0-9+.-]*:\/\/)[^\s/@]+@/gi, "$1[redacted]@").replace(
-  /((?:password|passwd|token|secret|authorization|credential)[\w-]*\s*[=:]\s*)[^\s,;]+/gi,
-  "$1[redacted]"
-).replace(/Bearer\s+\S+/gi, "Bearer [redacted]").split("").map(
-  (character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127 ? " " : character
-).join("").slice(0, 2048);
-var docker2 = async (runtime, context, stage, args) => {
-  try {
-    const output = await runtime.run("docker", ["--context", context, ...args], {
-      timeoutMs: stage === "cleanup" ? CLEANUP_TIMEOUT_MS : COMMAND_TIMEOUT_MS
-    });
-    if (output.status !== 0 || output.error !== void 0)
-      return error(
-        stage,
-        safeDiagnostic(
-          output.error ?? (output.stderr.trim() || `exit ${output.status ?? "unknown"}`)
-        )
-      );
-    return { _tag: "ok", value: output.stdout };
-  } catch {
-    return error(
-      stage,
-      "Process runner rejected; check Docker access and command timeout handling"
-    );
-  }
-};
-var tinyRootfs = (nonce) => {
-  const body = Buffer2.from(`Mend registry connectivity probe ${nonce}
-`);
-  const header = Buffer2.alloc(512);
-  const field = (value, offset, length) => header.write(value, offset, length, "ascii");
-  field("mend-registry-probe", 0, 100);
-  field("0000600\0", 100, 8);
-  field("0000000\0", 108, 8);
-  field("0000000\0", 116, 8);
-  field(`${body.length.toString(8).padStart(11, "0")}\0`, 124, 12);
-  field("00000000000\0", 136, 12);
-  field("        ", 148, 8);
-  field("0", 156, 1);
-  field("ustar\0", 257, 6);
-  field("00", 263, 2);
-  const checksum = header.reduce((sum, byte) => sum + byte, 0);
-  field(`${checksum.toString(8).padStart(6, "0")}\0 `, 148, 8);
-  return Buffer2.concat([header, body, Buffer2.alloc(512 - body.length), Buffer2.alloc(1024)]);
-};
-var imageExists = async (runtime, input, reference, stage) => {
-  const listed = await docker2(runtime, input.dockerContext, stage, [
-    "image",
-    "ls",
-    "--all",
-    "--filter",
-    `reference=${reference}`,
-    "--format",
-    "{{json .ID}}"
-  ]);
-  if (listed._tag === "error") return listed;
-  try {
-    const lines = listed.value.trim().split("\n").filter(Boolean);
-    for (const line of lines) {
-      const id = JSON.parse(line);
-      if (typeof id !== "string" || !/^(?:sha256:)?[a-f0-9]{12,64}$/.test(id))
-        return error(stage, "Docker returned an inconclusive image listing");
-    }
-    return { _tag: "ok", value: lines.length > 0 };
-  } catch {
-    return error(stage, "Docker returned an invalid image listing");
-  }
-};
-var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var ownedImage = async (runtime, input, reference, stage) => {
-  const inspected = await docker2(runtime, input.dockerContext, stage, [
-    "image",
-    "inspect",
-    reference,
-    "--format",
-    "{{json .}}"
-  ]);
-  if (inspected._tag === "error") return inspected;
-  try {
-    const image = JSON.parse(inspected.value);
-    if (!isRecord(image) || typeof image.Id !== "string" || !/^sha256:[a-f0-9]{64}$/.test(image.Id) || !isRecord(image.Config) || !isRecord(image.Config.Labels) || image.Config.Labels[PROBE_LABEL] !== input.nonce)
-      return error(stage, "Image ownership or ID could not be verified; the image was retained");
-    return { _tag: "ok", value: image.Id };
-  } catch {
-    return error(stage, "Docker returned an invalid image inspection; the image was retained");
-  }
-};
-var removeOwnedTag = async (runtime, input, reference, stage) => {
-  const exists = await imageExists(runtime, input, reference, stage);
-  if (exists._tag === "error") return exists;
-  if (!exists.value) return { _tag: "ok", value: void 0 };
-  const owned = await ownedImage(runtime, input, reference, stage);
-  if (owned._tag === "error") return owned;
-  const removed = await docker2(runtime, input.dockerContext, stage, ["image", "rm", reference]);
-  return removed._tag === "error" ? removed : { _tag: "ok", value: void 0 };
-};
-var roundtrip = async (runtime, input, reference, tarPath) => {
-  const imported = await docker2(runtime, input.dockerContext, "import", [
-    "image",
-    "import",
-    "--change",
-    `LABEL ${PROBE_LABEL}=${input.nonce}`,
-    tarPath,
-    reference
-  ]);
-  if (imported._tag === "error") return imported;
-  const original = await ownedImage(runtime, input, reference, "inspect");
-  if (original._tag === "error") return original;
-  const pushed = await docker2(runtime, input.dockerContext, "push", ["image", "push", reference]);
-  if (pushed._tag === "error") return pushed;
-  const removed = await removeOwnedTag(runtime, input, reference, "remove-local");
-  if (removed._tag === "error") return removed;
-  const absent = await imageExists(runtime, input, reference, "remove-local");
-  if (absent._tag === "error") return absent;
-  if (absent.value)
-    return error("remove-local", "Probe tag remained local; refusing to claim a pull roundtrip");
-  const pulled = await docker2(runtime, input.dockerContext, "pull", ["image", "pull", reference]);
-  if (pulled._tag === "error") return pulled;
-  const observed = await ownedImage(runtime, input, reference, "inspect");
-  if (observed._tag === "error") return observed;
-  return observed.value === original.value ? observed : error("inspect", "Pulled image ID differs from the imported image ID");
-};
-var parseProbeReference = (input) => {
-  if (!input.dockerContext.trim() || !Number.isInteger(input.registryPort) || input.registryPort < 1 || input.registryPort > 65535 || !/^[a-f0-9]{32,64}$/.test(input.nonce) || !path3.isAbsolute(input.temporaryDirectory))
-    return error(
-      "input",
-      "Expected an explicit context, TCP port, fresh 16 to 32 byte hex nonce and absolute temporary directory"
-    );
-  return {
-    _tag: "ok",
-    value: `127.0.0.1:${input.registryPort}/mend-registry-probe/${input.nonce}:probe`
-  };
-};
-var probeServerRegistry = async (runtime, input) => {
-  const cleanupWarnings = [];
-  const parsed = parseProbeReference(input);
-  if (parsed._tag === "error") return { ...parsed, cleanupWarnings };
-  const reference = parsed.value;
-  const exists = await imageExists(runtime, input, reference, "collision-check");
-  if (exists._tag === "error") return { ...exists, cleanupWarnings };
-  if (exists.value)
-    return {
-      ...error(
-        "collision-check",
-        "Probe reference already exists; supply a fresh nonce. Existing image retained"
-      ),
-      cleanupWarnings
-    };
-  let directory;
-  try {
-    directory = await fs3.mkdtemp(path3.join(input.temporaryDirectory, "mend-registry-probe-"));
-  } catch {
-    return {
-      ...error("temporary-files", "Could not create private probe directory"),
-      cleanupWarnings
-    };
-  }
-  let result;
-  let importAttempted = false;
-  try {
-    const tarPath = path3.join(directory, "rootfs.tar");
-    await fs3.writeFile(tarPath, tinyRootfs(input.nonce), { mode: 384, flag: "wx" });
-    importAttempted = true;
-    result = await roundtrip(runtime, input, reference, tarPath);
-  } catch {
-    result = error("temporary-files", "Could not write the private probe archive");
-  } finally {
-    if (importAttempted) {
-      const cleanup = await removeOwnedTag(runtime, input, reference, "cleanup");
-      if (cleanup._tag === "error") cleanupWarnings.push(cleanup.error);
-    }
-    try {
-      await fs3.rm(directory, { recursive: true, force: true });
-    } catch {
-      cleanupWarnings.push(
-        new ServerRegistryProbeError(
-          "cleanup",
-          `Could not remove private probe directory ${directory}`
-        )
-      );
-    }
-  }
-  return result._tag === "error" ? { ...result, cleanupWarnings } : {
-    _tag: "ok",
-    value: { reference, imageId: result.value },
-    cleanupWarnings
-  };
-};
-
 // src/server-runtime.ts
 import { spawn as spawn2 } from "node:child_process";
-import * as fs4 from "node:fs";
-import * as path4 from "node:path";
+import * as fs3 from "node:fs";
+import * as path3 from "node:path";
 var serverProcessDeadlines = {
   ordinary: 3e4,
   pull: 10 * 6e4,
@@ -2214,10 +2014,10 @@ var runServerProcess = (command, args, parentEnvironment, options = {}) => {
   ]) {
     if (parentEnvironment[key] !== void 0) env[key] = parentEnvironment[key];
   }
-  return new Promise((resolve5) => {
+  return new Promise((resolve4) => {
     let fd;
     try {
-      if (options.stdoutFile !== void 0) fd = fs4.openSync(options.stdoutFile, "wx", 384);
+      if (options.stdoutFile !== void 0) fd = fs3.openSync(options.stdoutFile, "wx", 384);
       const child = spawn2(command, [...args], {
         env,
         detached: process.platform !== "win32",
@@ -2262,23 +2062,23 @@ var runServerProcess = (command, args, parentEnvironment, options = {}) => {
         failure2 ??= `Process timed out after ${timeoutMs}ms`;
         terminate();
       }, timeoutMs);
-      child.once("error", (error2) => {
-        failure2 ??= error2.message;
+      child.once("error", (error) => {
+        failure2 ??= error.message;
       });
       child.once("close", (status) => {
         globalThis.clearTimeout(timer);
         try {
-          if (fd !== void 0) fs4.fsyncSync(fd);
+          if (fd !== void 0) fs3.fsyncSync(fd);
         } catch {
           failure2 ??= "Could not durably write process output.";
         } finally {
           try {
-            if (fd !== void 0) fs4.closeSync(fd);
+            if (fd !== void 0) fs3.closeSync(fd);
           } catch {
             failure2 ??= "Could not close process output file.";
           }
         }
-        resolve5({
+        resolve4({
           status: failure2 === void 0 ? status : null,
           stdout,
           stderr,
@@ -2287,10 +2087,10 @@ var runServerProcess = (command, args, parentEnvironment, options = {}) => {
       });
     } catch (cause) {
       try {
-        if (fd !== void 0) fs4.closeSync(fd);
+        if (fd !== void 0) fs3.closeSync(fd);
       } catch {
       }
-      resolve5({
+      resolve4({
         status: null,
         stdout: "",
         stderr: "",
@@ -2308,17 +2108,17 @@ var serverComposeArgs = (installation, command) => [
   "--project-directory",
   installation.directory,
   "--env-file",
-  path4.join(installation.directory, "server.env"),
+  path3.join(installation.directory, "server.env"),
   "-f",
-  path4.join(installation.directory, "compose.yaml"),
+  path3.join(installation.directory, "compose.yaml"),
   ...command
 ];
 
 // src/server-store.ts
 import { randomUUID } from "node:crypto";
-import * as fs5 from "node:fs";
+import * as fs4 from "node:fs";
 import * as os2 from "node:os";
-import * as path5 from "node:path";
+import * as path4 from "node:path";
 var ServerStoreError = class extends Error {
   _tag = "ServerStoreError";
 };
@@ -2339,28 +2139,28 @@ var attempt = (operation) => {
 var hasCode = (cause, code) => cause instanceof Error && "code" in cause && cause.code === code;
 var readOptional = (file) => {
   try {
-    return fs5.readFileSync(file, "utf8");
+    return fs4.readFileSync(file, "utf8");
   } catch (cause) {
     if (hasCode(cause, "ENOENT")) return null;
     throw cause;
   }
 };
 var syncDirectory = (directory) => {
-  const fd = fs5.openSync(directory, "r");
+  const fd = fs4.openSync(directory, "r");
   try {
-    fs5.fsyncSync(fd);
+    fs4.fsyncSync(fd);
   } finally {
-    fs5.closeSync(fd);
+    fs4.closeSync(fd);
   }
 };
 var writeDurable = (file, content, mode = 384) => {
-  const fd = fs5.openSync(file, "wx", mode);
+  const fd = fs4.openSync(file, "wx", mode);
   try {
-    fs5.writeFileSync(fd, content, "utf8");
-    fs5.fchmodSync(fd, mode);
-    fs5.fsyncSync(fd);
+    fs4.writeFileSync(fd, content, "utf8");
+    fs4.fchmodSync(fd, mode);
+    fs4.fsyncSync(fd);
   } finally {
-    fs5.closeSync(fd);
+    fs4.closeSync(fd);
   }
 };
 var fileKeys = ["identity", "config", "env", "compose", "postgresInit"];
@@ -2380,7 +2180,7 @@ var parseLockOwner = (raw) => {
 };
 var describeOwner = (lockDir) => {
   try {
-    const raw = JSON.parse(fs5.readFileSync(path5.join(lockDir, "owner.json"), "utf8"));
+    const raw = JSON.parse(fs4.readFileSync(path4.join(lockDir, "owner.json"), "utf8"));
     const owner = parseLockOwner(raw);
     if (owner === null) return "owner metadata is invalid";
     const label = `PID ${owner.pid} on ${owner.hostname}`;
@@ -2400,28 +2200,28 @@ var lockGuidance = (lockDir) => new ServerStoreError(
 );
 var acquireLock = (configDir, create) => {
   if (create) {
-    fs5.mkdirSync(configDir, { recursive: true, mode: 448 });
-    fs5.chmodSync(configDir, 448);
-  } else if (!fs5.existsSync(configDir)) {
+    fs4.mkdirSync(configDir, { recursive: true, mode: 448 });
+    fs4.chmodSync(configDir, 448);
+  } else if (!fs4.existsSync(configDir)) {
     throw new ServerStoreError(
       "No Mend server is configured. Run mend server setup explicitly to install one."
     );
   }
-  const lockDir = path5.join(configDir, "server.lock");
+  const lockDir = path4.join(configDir, "server.lock");
   try {
-    fs5.mkdirSync(lockDir, { mode: 448 });
+    fs4.mkdirSync(lockDir, { mode: 448 });
   } catch (cause) {
     if (hasCode(cause, "EEXIST")) throw lockGuidance(lockDir);
     throw cause;
   }
-  const owned = fs5.statSync(lockDir);
-  const ownerFile = path5.join(lockDir, "owner.json");
+  const owned = fs4.statSync(lockDir);
+  const ownerFile = path4.join(lockDir, "owner.json");
   const owner = `${JSON.stringify({ pid: process.pid, hostname: os2.hostname(), token: randomUUID() })}
 `;
   let open = true;
   const assertOwned = () => {
-    const current = fs5.statSync(lockDir);
-    if (!open || current.dev !== owned.dev || current.ino !== owned.ino || fs5.readFileSync(ownerFile, "utf8") !== owner) {
+    const current = fs4.statSync(lockDir);
+    if (!open || current.dev !== owned.dev || current.ino !== owned.ino || fs4.readFileSync(ownerFile, "utf8") !== owner) {
       throw new ServerStoreError(
         "Server lock ownership was lost. Stop and check for another server command before retrying."
       );
@@ -2437,8 +2237,8 @@ var acquireLock = (configDir, create) => {
     release: () => {
       const result = attempt(() => {
         assertOwned();
-        fs5.unlinkSync(ownerFile);
-        fs5.rmdirSync(lockDir);
+        fs4.unlinkSync(ownerFile);
+        fs4.rmdirSync(lockDir);
       });
       open = false;
       return result;
@@ -2447,7 +2247,7 @@ var acquireLock = (configDir, create) => {
 };
 var readIdentity = (paths) => {
   const identity = readOptional(paths.identity);
-  if (identity === null && (fs5.existsSync(paths.active) || fs5.existsSync(paths.generations) && fs5.readdirSync(paths.generations).length > 0)) {
+  if (identity === null && (fs4.existsSync(paths.active) || fs4.existsSync(paths.generations) && fs4.readdirSync(paths.generations).length > 0)) {
     throw new ServerStoreError(
       "Server identity.env is missing. Restore it from a retained generation or backup; refusing to generate replacement credentials."
     );
@@ -2457,7 +2257,7 @@ var readIdentity = (paths) => {
 var readActive = (paths) => {
   let target;
   try {
-    target = fs5.readlinkSync(paths.active);
+    target = fs4.readlinkSync(paths.active);
   } catch (cause) {
     if (hasCode(cause, "ENOENT")) return null;
     throw cause;
@@ -2467,13 +2267,13 @@ var readActive = (paths) => {
       "Server active pointer is invalid. Restore the symlink to a retained generation before retrying."
     );
   }
-  const directory = path5.join(paths.configDir, target);
+  const directory = path4.join(paths.configDir, target);
   const files = {
-    identity: fs5.readFileSync(path5.join(directory, fileNames.identity), "utf8"),
-    config: fs5.readFileSync(path5.join(directory, fileNames.config), "utf8"),
-    env: fs5.readFileSync(path5.join(directory, fileNames.env), "utf8"),
-    compose: fs5.readFileSync(path5.join(directory, fileNames.compose), "utf8"),
-    postgresInit: fs5.readFileSync(path5.join(directory, fileNames.postgresInit), "utf8")
+    identity: fs4.readFileSync(path4.join(directory, fileNames.identity), "utf8"),
+    config: fs4.readFileSync(path4.join(directory, fileNames.config), "utf8"),
+    env: fs4.readFileSync(path4.join(directory, fileNames.env), "utf8"),
+    compose: fs4.readFileSync(path4.join(directory, fileNames.compose), "utf8"),
+    postgresInit: fs4.readFileSync(path4.join(directory, fileNames.postgresInit), "utf8")
   };
   if (readIdentity(paths) !== files.identity) {
     throw new ServerStoreError(
@@ -2483,20 +2283,20 @@ var readActive = (paths) => {
   return { directory, files };
 };
 var publishIdentity = (paths, identity) => {
-  const temporary = path5.join(paths.configDir, `.identity-${randomUUID()}`);
+  const temporary = path4.join(paths.configDir, `.identity-${randomUUID()}`);
   writeDurable(temporary, identity);
-  fs5.linkSync(temporary, paths.identity);
+  fs4.linkSync(temporary, paths.identity);
   syncDirectory(paths.configDir);
-  fs5.unlinkSync(temporary);
+  fs4.unlinkSync(temporary);
 };
 var prepareGeneration = (paths, files) => {
-  fs5.mkdirSync(paths.generations, { recursive: true, mode: 448 });
+  fs4.mkdirSync(paths.generations, { recursive: true, mode: 448 });
   const generationName = `gen-${randomUUID()}`;
-  const directory = path5.join(paths.generations, generationName);
-  fs5.mkdirSync(directory, { mode: 448 });
+  const directory = path4.join(paths.generations, generationName);
+  fs4.mkdirSync(directory, { mode: 448 });
   for (const key of fileKeys) {
     writeDurable(
-      path5.join(directory, fileNames[key]),
+      path4.join(directory, fileNames[key]),
       files[key],
       key === "postgresInit" ? 493 : 384
     );
@@ -2507,18 +2307,18 @@ var prepareGeneration = (paths, files) => {
   return { directory, files };
 };
 var activateGeneration = (paths, generation) => {
-  const relative3 = path5.relative(paths.configDir, generation.directory);
-  if (!/^generations\/gen-[0-9a-f-]{36}$/.test(relative3) || readIdentity(paths) !== fs5.readFileSync(path5.join(generation.directory, "identity.env"), "utf8")) {
+  const relative3 = path4.relative(paths.configDir, generation.directory);
+  if (!/^generations\/gen-[0-9a-f-]{36}$/.test(relative3) || readIdentity(paths) !== fs4.readFileSync(path4.join(generation.directory, "identity.env"), "utf8")) {
     throw new ServerStoreError("Cannot activate a generation outside this installation identity.");
   }
   for (const key of fileKeys) {
-    if (fs5.readFileSync(path5.join(generation.directory, fileNames[key]), "utf8") !== generation.files[key]) {
+    if (fs4.readFileSync(path4.join(generation.directory, fileNames[key]), "utf8") !== generation.files[key]) {
       throw new ServerStoreError("Cannot activate an incomplete or changed server generation.");
     }
   }
-  const pointer = path5.join(paths.configDir, `.active-${randomUUID()}`);
-  fs5.symlinkSync(relative3, pointer);
-  fs5.renameSync(pointer, paths.active);
+  const pointer = path4.join(paths.configDir, `.active-${randomUUID()}`);
+  fs4.symlinkSync(relative3, pointer);
+  fs4.renameSync(pointer, paths.active);
   syncDirectory(paths.configDir);
 };
 var prepareFiles = (paths, files) => {
@@ -2527,7 +2327,7 @@ var prepareFiles = (paths, files) => {
     throw new ServerStoreError("Server identity already exists; refusing to replace credentials.");
   }
   const active = readActive(paths);
-  if (active !== null && fileKeys.every((key) => files[key] === active.files[key]) && (fs5.statSync(path5.join(active.directory, fileNames.postgresInit)).mode & 4095) === 493)
+  if (active !== null && fileKeys.every((key) => files[key] === active.files[key]) && (fs4.statSync(path4.join(active.directory, fileNames.postgresInit)).mode & 4095) === 493)
     return active;
   if (identity === null) publishIdentity(paths, files.identity);
   return prepareGeneration(paths, files);
@@ -2540,9 +2340,9 @@ var commitGeneration = (paths, files) => {
 var createStore = (configDir, lock) => {
   const paths = {
     configDir,
-    identity: path5.join(configDir, "identity.env"),
-    generations: path5.join(configDir, "generations"),
-    active: path5.join(configDir, "active")
+    identity: path4.join(configDir, "identity.env"),
+    generations: path4.join(configDir, "generations"),
+    active: path4.join(configDir, "active")
   };
   const whileOwned = (operation) => attempt(() => {
     lock.assertOwned();
@@ -2555,13 +2355,13 @@ var createStore = (configDir, lock) => {
     prepare: (files) => whileOwned(() => prepareFiles(paths, files)),
     activate: (generation) => whileOwned(() => activateGeneration(paths, generation)),
     createBackup: (previous, target) => whileOwned(() => {
-      const backups = path5.join(configDir, "backups");
-      fs5.mkdirSync(backups, { recursive: true, mode: 448 });
-      fs5.chmodSync(backups, 448);
-      const directory = path5.join(backups, `upgrade-${randomUUID()}`);
-      fs5.mkdirSync(directory, { mode: 448 });
+      const backups = path4.join(configDir, "backups");
+      fs4.mkdirSync(backups, { recursive: true, mode: 448 });
+      fs4.chmodSync(backups, 448);
+      const directory = path4.join(backups, `upgrade-${randomUUID()}`);
+      fs4.mkdirSync(directory, { mode: 448 });
       writeDurable(
-        path5.join(directory, "recovery.json"),
+        path4.join(directory, "recovery.json"),
         `${JSON.stringify(
           {
             previousGeneration: previous.directory,
@@ -2577,21 +2377,21 @@ var createStore = (configDir, lock) => {
       syncDirectory(directory);
       syncDirectory(backups);
       syncDirectory(configDir);
-      const partialFile = path5.join(directory, "database.sql.partial");
+      const partialFile = path4.join(directory, "database.sql.partial");
       return {
         directory,
         partialFile,
         complete: () => whileOwned(() => {
-          if (fs5.statSync(partialFile).size === 0)
+          if (fs4.statSync(partialFile).size === 0)
             throw new ServerStoreError("Database backup is empty; refusing target startup.");
-          const fd = fs5.openSync(partialFile, "r");
+          const fd = fs4.openSync(partialFile, "r");
           try {
-            fs5.fchmodSync(fd, 384);
-            fs5.fsyncSync(fd);
+            fs4.fchmodSync(fd, 384);
+            fs4.fsyncSync(fd);
           } finally {
-            fs5.closeSync(fd);
+            fs4.closeSync(fd);
           }
-          fs5.renameSync(partialFile, path5.join(directory, "database.sql"));
+          fs4.renameSync(partialFile, path4.join(directory, "database.sql"));
           syncDirectory(directory);
         })
       };
@@ -2600,7 +2400,7 @@ var createStore = (configDir, lock) => {
 };
 var refuseFlatLayout = (configDir) => {
   if (["server.json", "server.env", "compose.yaml", "postgres-init.sh"].some(
-    (name) => fs5.existsSync(path5.join(configDir, name))
+    (name) => fs4.existsSync(path4.join(configDir, name))
   )) {
     throw new ServerStoreError(
       "Unreleased flat server configuration found. Preserve its credentials and volumes; migrate it to the generation layout before retrying. Setup will not replace this identity."
@@ -2608,7 +2408,7 @@ var refuseFlatLayout = (configDir) => {
   }
 };
 var withServerStore = async (directory, operation, options = {}) => {
-  const configDir = path5.resolve(directory);
+  const configDir = path4.resolve(directory);
   let lock;
   let result;
   try {
@@ -2625,9 +2425,9 @@ var withServerStore = async (directory, operation, options = {}) => {
 };
 
 // src/version.ts
-import * as fs6 from "node:fs";
+import * as fs5 from "node:fs";
 var cliVersion = () => {
-  const raw = fs6.readFileSync(new URL("../package.json", import.meta.url), "utf8");
+  const raw = fs5.readFileSync(new URL("../package.json", import.meta.url), "utf8");
   const parsed = JSON.parse(raw);
   if (typeof parsed === "object" && parsed !== null && "version" in parsed) {
     const version = parsed.version;
@@ -2661,12 +2461,13 @@ var versionLines = (cli, server) => {
 
 // src/server-setup.ts
 var CONFIG_SCHEMA_VERSION = 1;
-var ASSET_CONTRACT = "mend-docker-v1";
+var ASSET_CONTRACT = "mend-docker-v2";
+var LEGACY_ASSET_CONTRACTS = /* @__PURE__ */ new Set(["mend-docker-v1"]);
 var MINIMUM_DOCKER_API = "1.45";
 var DEFAULT_APP_PORT = 3105;
 var DEFAULT_SSH_PORT = 2222;
 var DEFAULT_BIND = "127.0.0.1";
-var COMPOSE_ASSET = "compose.v1.yaml";
+var COMPOSE_ASSET = "compose.v2.yaml";
 var POSTGRES_INIT_ASSET = "postgres-init.sh";
 var RELEASE_BASE = "https://github.com/sealant-sh/Mend/releases/download";
 var LATEST_RELEASE_URL = "https://api.github.com/repos/sealant-sh/Mend/releases/latest";
@@ -2726,7 +2527,6 @@ var SETUP_FLAGS = /* @__PURE__ */ new Set([
   "--port",
   "--ssh-port",
   "--docker-socket",
-  "--registry-port",
   "--assets-dir",
   "--offline"
 ]);
@@ -2755,7 +2555,6 @@ var parseSetupOptions = (args) => {
   const version = flagValue2("--version");
   const appPort = flagValue2("--port");
   const sshPort = flagValue2("--ssh-port");
-  const registryPort = flagValue2("--registry-port");
   const origins = values.get("--origin");
   return {
     context: flagValue2("--context"),
@@ -2766,7 +2565,6 @@ var parseSetupOptions = (args) => {
     appPort: appPort === void 0 ? void 0 : parsePort(appPort, "--port"),
     sshPort: sshPort === void 0 ? void 0 : parsePort(sshPort, "--ssh-port"),
     dockerSocket: flagValue2("--docker-socket"),
-    registryPort: registryPort === void 0 ? void 0 : parsePort(registryPort, "--registry-port"),
     assetsDir: flagValue2("--assets-dir"),
     offline: values.has("--offline")
   };
@@ -2813,9 +2611,8 @@ var checkExposurePair = (bind, appUrl, requireExplicitUrl) => {
 var validateExposure = (existing, options) => {
   const appPort = options.appPort ?? existing?.appPort ?? DEFAULT_APP_PORT;
   const sshPort = options.sshPort ?? existing?.sshPort ?? DEFAULT_SSH_PORT;
-  const registryPort = options.registryPort ?? existing?.registryPort ?? 5e3;
-  if ((/* @__PURE__ */ new Set([appPort, sshPort, registryPort])).size !== 3) {
-    throw setupError("--port, --ssh-port and --registry-port must use different ports.");
+  if (appPort === sshPort) {
+    throw setupError("--port and --ssh-port must use different ports.");
   }
   const bind = options.bind ?? existing?.bind ?? DEFAULT_BIND;
   if (net2.isIP(bind) === 0) {
@@ -2830,7 +2627,7 @@ var validateExposure = (existing, options) => {
   const allowedOrigins = [
     ...new Set((requestedOrigins ?? inheritedOrigins).filter((origin) => origin !== appUrl))
   ];
-  return { bind, appUrl, allowedOrigins, appPort, sshPort, registryPort };
+  return { bind, appUrl, allowedOrigins, appPort, sshPort };
 };
 var parseServerConfig = (raw) => {
   let decoded;
@@ -2871,16 +2668,17 @@ var parseServerConfig = (raw) => {
     ),
     appPort: requiredInteger(fields, "appPort"),
     sshPort: requiredInteger(fields, "sshPort"),
-    registryPort: fields.has("registryPort") ? requiredInteger(fields, "registryPort") : 5e3
+    ...fields.has("registryPort") ? { registryPort: requiredInteger(fields, "registryPort") } : {}
   };
-  if (config.schemaVersion !== CONFIG_SCHEMA_VERSION || config.assetContract !== ASSET_CONTRACT) {
+  if (config.schemaVersion !== CONFIG_SCHEMA_VERSION || config.assetContract !== ASSET_CONTRACT && !LEGACY_ASSET_CONTRACTS.has(config.assetContract)) {
     throw setupError(
       `Server config uses unsupported contract ${config.schemaVersion}/${config.assetContract}. Upgrade the CLI before setup.`
     );
   }
   parsePort(String(config.appPort), "Server config appPort");
   parsePort(String(config.sshPort), "Server config sshPort");
-  parsePort(String(config.registryPort), "Server config registryPort");
+  if (config.registryPort !== void 0)
+    parsePort(String(config.registryPort), "Server config registryPort");
   validateExposure(null, {
     context: void 0,
     version: void 0,
@@ -2890,7 +2688,6 @@ var parseServerConfig = (raw) => {
     appPort: config.appPort,
     sshPort: config.sshPort,
     dockerSocket: void 0,
-    registryPort: config.registryPort,
     assetsDir: void 0,
     offline: false
   });
@@ -2919,7 +2716,7 @@ var parseSecrets = (raw) => {
     postgresAdminPassword: envValue(fields, "MEND_POSTGRES_ADMIN_PASSWORD"),
     mendDatabasePassword: envValue(fields, "MEND_DB_PASSWORD"),
     sealantDatabasePassword: envValue(fields, "SEALANT_DB_PASSWORD"),
-    queuePassword: envValue(fields, "MEND_RABBITMQ_PASSWORD"),
+    ...fields.has("MEND_RABBITMQ_PASSWORD") ? { queuePassword: envValue(fields, "MEND_RABBITMQ_PASSWORD") } : {},
     betterAuthSecret: envValue(fields, "BETTER_AUTH_SECRET"),
     sealantCredentialsKey: envValue(fields, "SEALANT_CREDENTIALS_KEY"),
     sealantServiceKey: envValue(fields, "SEALANT_SERVICE_KEY"),
@@ -2932,7 +2729,7 @@ var parseSecrets = (raw) => {
     ["MEND_POSTGRES_ADMIN_PASSWORD", secrets.postgresAdminPassword],
     ["MEND_DB_PASSWORD", secrets.mendDatabasePassword],
     ["SEALANT_DB_PASSWORD", secrets.sealantDatabasePassword],
-    ["MEND_RABBITMQ_PASSWORD", secrets.queuePassword],
+    ...secrets.queuePassword === void 0 ? [] : [["MEND_RABBITMQ_PASSWORD", secrets.queuePassword]],
     ["WORKSPACE_SSH_GATEWAY_TOKEN", secrets.workspaceSshGatewayToken]
   ];
   for (const [name, value] of hexSecrets) {
@@ -2957,7 +2754,6 @@ var createSecrets = (runtime) => {
     postgresAdminPassword: hex(0),
     mendDatabasePassword: hex(32),
     sealantDatabasePassword: hex(64),
-    queuePassword: hex(96),
     betterAuthSecret: hex(128),
     sealantCredentialsKey: bytes.subarray(160, 192).toString("base64"),
     sealantServiceKey: `slt_svc_${hex(192)}`,
@@ -3132,8 +2928,6 @@ var validateComposeAsset = (body) => {
     "mend-control:",
     "mend-config:",
     "mend-ssh:",
-    "mend-rabbitmq:",
-    "mend-registry:",
     "mend-postgres:",
     "/var/lib/mend/store",
     "/run/sealant/sockets"
@@ -3161,7 +2955,7 @@ var renderIdentity = (secrets) => [
   `MEND_POSTGRES_ADMIN_PASSWORD=${secrets.postgresAdminPassword}`,
   `MEND_DB_PASSWORD=${secrets.mendDatabasePassword}`,
   `SEALANT_DB_PASSWORD=${secrets.sealantDatabasePassword}`,
-  `MEND_RABBITMQ_PASSWORD=${secrets.queuePassword}`,
+  ...secrets.queuePassword === void 0 ? [] : [`MEND_RABBITMQ_PASSWORD=${secrets.queuePassword}`],
   `BETTER_AUTH_SECRET=${secrets.betterAuthSecret}`,
   `SEALANT_CREDENTIALS_KEY=${secrets.sealantCredentialsKey}`,
   `SEALANT_SERVICE_KEY=${secrets.sealantServiceKey}`,
@@ -3180,7 +2974,7 @@ var renderSecrets = (secrets, config) => {
     `MEND_BIND_HOST=${composeBind}`,
     `MEND_PORT=${config.appPort}`,
     `MEND_SSH_PORT=${config.sshPort}`,
-    `MEND_REGISTRY_PORT=${config.registryPort}`,
+    ...config.registryPort === void 0 ? [] : [`MEND_REGISTRY_PORT=${config.registryPort}`],
     `SEALANT_SSH_HOST=${sshHost}`,
     "MEND_STORE_VOLUME_NAME=mend-store",
     "MEND_CONTROL_VOLUME_NAME=mend-control",
@@ -3262,7 +3056,7 @@ var resolveServerVersion = async (runtime, options, existing) => {
   return version;
 };
 var parseDockerSocketPath = (socket) => {
-  if (!path6.isAbsolute(socket) || /[\r\n$'"#:\\]/.test(socket)) {
+  if (!path5.isAbsolute(socket) || /[\r\n$'"#:\\]/.test(socket)) {
     throw setupError(
       "--docker-socket must be an absolute path without line breaks or Compose interpolation characters."
     );
@@ -3288,8 +3082,8 @@ var resolveAssets = async (runtime, serverVersion, existing, store, options) =>
   if (options.assetsDir !== void 0) {
     try {
       const [compose2, postgresInit2] = await Promise.all([
-        readFile(path6.join(options.assetsDir, COMPOSE_ASSET), "utf8"),
-        readFile(path6.join(options.assetsDir, POSTGRES_INIT_ASSET), "utf8")
+        readFile(path5.join(options.assetsDir, COMPOSE_ASSET), "utf8"),
+        readFile(path5.join(options.assetsDir, POSTGRES_INIT_ASSET), "utf8")
       ]);
       validateComposeAsset(compose2);
       validatePostgresAsset(postgresInit2);
@@ -3297,7 +3091,7 @@ var resolveAssets = async (runtime, serverVersion, existing, store, options) =>
     } catch (cause) {
       if (cause instanceof ServerSetupError) throw cause;
       throw setupError(
-        "Could not read release assets from --assets-dir. Supply compose.v1.yaml and postgres-init.sh."
+        "Could not read release assets from --assets-dir. Supply compose.v2.yaml and postgres-init.sh."
       );
     }
   }
@@ -3408,6 +3202,11 @@ var setupServer = async (args, runtime, store) => {
       `Setup retains Mend ${existing.config.serverVersion}. Use mend server upgrade --version ${options.version} to change the server pin.`
     );
   }
+  if (existing !== null && existing.config.assetContract !== ASSET_CONTRACT) {
+    throw setupError(
+      `Mend ${existing.config.serverVersion} was installed under the ${existing.config.assetContract} bundle contract. Use mend server upgrade --version latest to move it to ${ASSET_CONTRACT}; setup cannot repair it in place.`
+    );
+  }
   const selectedContext = await selectDockerContext(
     runtime,
     options.context ?? existing?.config.dockerContext
@@ -3440,7 +3239,6 @@ var setupServer = async (args, runtime, store) => {
   storeValue(store.activate(generation));
   await startCompose(runtime, config, generation);
   await probeHealth(runtime, config.appUrl, config.serverVersion);
-  await verifyRegistry(runtime, config);
   runtime.writeLine(`Mend ${config.serverVersion} is reachable at ${config.appUrl}`);
   runtime.writeLine(
     `Open ${config.appUrl}, create the first account, then run: mend login --url ${config.appUrl}`
@@ -3504,16 +3302,6 @@ var composeCommand = async (runtime, installation, args) => {
 var interruptionNotice = (runtime) => runtime.writeLine(
   "Connections will be interrupted. Workspace containers and data are retained, but active work can lose connectivity and may need reconnection. Mend does not stop workspace containers."
 );
-var verifyRegistry = async (runtime, config) => {
-  const registry = await probeServerRegistry(runtime, {
-    dockerContext: config.dockerContext,
-    registryPort: config.registryPort,
-    nonce: runtime.randomBytes(24).toString("hex"),
-    temporaryDirectory: path6.resolve(runtime.configDir)
-  });
-  for (const warning of registry.cleanupWarnings) runtime.writeLine(`Warning: ${warning.message}`);
-  if (registry._tag === "error") throw setupError(registry.error.message);
-};
 var startInstallation = async (runtime, installation) => {
   startingNotice(runtime, installation.config.serverVersion);
   await composeCommand(runtime, installation, [
@@ -3525,7 +3313,6 @@ var startInstallation = async (runtime, installation) => {
     "--no-build"
   ]);
   await probeHealth(runtime, installation.config.appUrl, installation.config.serverVersion);
-  await verifyRegistry(runtime, installation.config);
   runtime.writeLine(
     `Mend ${installation.config.serverVersion} is reachable at ${installation.config.appUrl}`
   );
@@ -3562,7 +3349,12 @@ var upgradeServer = async (args, runtime, store, existing) => {
   const previous = storeValue(store.readActive());
   if (previous === null) throw setupError("The active server generation is missing.");
   const assets = await resolveAssets(runtime, version, existing, store, options);
-  const config = { ...existing.config, serverVersion: version };
+  const { registryPort: _legacyRegistryPort, ...carried } = existing.config;
+  const config = {
+    ...carried,
+    assetContract: ASSET_CONTRACT,
+    serverVersion: version
+  };
   const secrets = parseSecrets(previous.files.identity);
   const files = {
     identity: previous.files.identity,
@@ -3734,9 +3526,9 @@ var manageServer = async (command, args, runtime, store) => {
 var nodeServerRuntime = () => {
   const environment = { ...process.env };
   const home = os3.homedir();
-  const configHome = environment["XDG_CONFIG_HOME"] ?? path6.join(home, ".config");
+  const configHome = environment["XDG_CONFIG_HOME"] ?? path5.join(home, ".config");
   return {
-    configDir: path6.join(configHome, "mend"),
+    configDir: path5.join(configHome, "mend"),
     platform: process.platform,
     cliVersion: cliVersion(),
     run: (command, args, options) => runServerProcess(command, args, environment, options),
@@ -3753,7 +3545,7 @@ var nodeServerRuntime = () => {
       }
     },
     randomBytes,
-    sleep: (milliseconds) => new Promise((resolve5) => setTimeout(resolve5, milliseconds)),
+    sleep: (milliseconds) => new Promise((resolve4) => setTimeout(resolve4, milliseconds)),
     writeLine: (line) => process.stdout.write(`${line}
 `)
   };
@@ -3962,8 +3754,8 @@ var renderMendToml = (proposals) => {
 };
 
 // src/skills.ts
-import * as fs7 from "node:fs";
-import * as path7 from "node:path";
+import * as fs6 from "node:fs";
+import * as path6 from "node:path";
 var DEFAULT_SKILLS_DIR = ".agents/skills";
 var MAX_SKILL_FILES = 64;
 var MAX_SKILL_FILE_BYTES = 512 * 1024;
@@ -3986,12 +3778,12 @@ var readFrontmatterDescription = (contents) => {
 var walkFiles = (root) => {
   const found = [];
   const visit = (dir) => {
-    for (const entry of fs7.readdirSync(dir, { withFileTypes: true })) {
+    for (const entry of fs6.readdirSync(dir, { withFileTypes: true })) {
       if (IGNORED_DIRS.has(entry.name)) continue;
-      const absolute = path7.join(dir, entry.name);
+      const absolute = path6.join(dir, entry.name);
       let stat;
       try {
-        stat = fs7.statSync(absolute);
+        stat = fs6.statSync(absolute);
       } catch {
         continue;
       }
@@ -4005,7 +3797,7 @@ var walkFiles = (root) => {
 var scanSkillLibrary = (root) => {
   let entries;
   try {
-    entries = fs7.readdirSync(root, { withFileTypes: true });
+    entries = fs6.readdirSync(root, { withFileTypes: true });
   } catch {
     return { error: `${root} is not a readable directory` };
   }
@@ -4013,23 +3805,23 @@ var scanSkillLibrary = (root) => {
   const notes = [];
   for (const entry of entries.toSorted((a, b) => a.name.localeCompare(b.name))) {
     if (entry.name.startsWith(".")) continue;
-    const skillDir = path7.join(root, entry.name);
+    const skillDir = path6.join(root, entry.name);
     let stat;
     try {
-      stat = fs7.statSync(skillDir);
+      stat = fs6.statSync(skillDir);
     } catch {
       continue;
     }
     if (!stat.isDirectory()) continue;
-    if (!fs7.existsSync(path7.join(skillDir, "SKILL.md"))) {
+    if (!fs6.existsSync(path6.join(skillDir, "SKILL.md"))) {
       notes.push({ skill: entry.name, message: "no SKILL.md \u2014 skipped" });
       continue;
     }
     const files = [];
     let bytes = 0;
     for (const absolute of walkFiles(skillDir)) {
-      const relative3 = path7.relative(skillDir, absolute).split(path7.sep).join("/");
-      const buffer = fs7.readFileSync(absolute);
+      const relative3 = path6.relative(skillDir, absolute).split(path6.sep).join("/");
+      const buffer = fs6.readFileSync(absolute);
       if (buffer.byteLength > MAX_SKILL_FILE_BYTES) {
         notes.push({ skill: entry.name, message: `${relative3} is over 512KB \u2014 skipped` });
         continue;
@@ -4065,15 +3857,15 @@ var scanSkillLibrary = (root) => {
 
 // src/ssh-setup.ts
 import * as os5 from "node:os";
-import * as path9 from "node:path";
+import * as path8 from "node:path";
 
 // ../../packages/workspace-ssh/src/index.ts
 import { spawnSync } from "node:child_process";
 import { createHash as createHash2 } from "node:crypto";
-import * as fs8 from "node:fs";
+import * as fs7 from "node:fs";
 import { isIP as isIP2 } from "node:net";
 import * as os4 from "node:os";
-import * as path8 from "node:path";
+import * as path7 from "node:path";
 var LEGACY_BLOCK_BEGIN = "# >>> mend workspace ssh (managed by `mend ssh setup`) >>>";
 var LEGACY_BLOCK_END = "# <<< mend workspace ssh <<<";
 var WorkspaceSshError = class extends Error {
@@ -4089,7 +3881,7 @@ var WorkspaceSshError = class extends Error {
   }
 };
 var success = (value) => ({ ok: true, value });
-var failure = (error2) => ({ ok: false, error: error2 });
+var failure = (error) => ({ ok: false, error });
 var stripIpv6Brackets = (hostname6) => hostname6.startsWith("[") && hostname6.endsWith("]") ? hostname6.slice(1, -1) : hostname6;
 var hashIdentity = (identity) => createHash2("sha256").update(identity).digest("hex").slice(0, 24);
 var aliasLabel = (hostname6) => {
@@ -4160,8 +3952,8 @@ var blockBegin = (alias) => `# >>> mend workspace ssh ${alias} (managed) >>>`;
 var blockEnd = (alias) => `# <<< mend workspace ssh ${alias} <<<`;
 var hasControls = (value) => /[\p{Cc}\p{Zl}\p{Zp}]/u.test(value);
 var parseIdentityPath = (value) => {
-  const resolved = path8.resolve(
-    value.startsWith("~/") ? path8.join(os4.homedir(), value.slice(2)) : value
+  const resolved = path7.resolve(
+    value.startsWith("~/") ? path7.join(os4.homedir(), value.slice(2)) : value
   );
   if (value === "" || hasControls(value) || hasControls(resolved) || value.includes("${") || resolved.includes("${")) {
     return failure(
@@ -4241,6 +4033,26 @@ var removeManagedBlock = (config, beginMarker, endMarker) => {
   }
   return success(`${config.slice(0, begin)}${after}`);
 };
+var stripManagedWorkspaceSshBlocks = (existing) => {
+  let config = existing;
+  let removed = 0;
+  const aliases = [
+    ...config.matchAll(/^# >>> mend workspace ssh (mend-ws-[a-z0-9-]+) \(managed\) >>>$/gm)
+  ].map((match) => match[1]).filter((alias) => alias !== void 0);
+  for (const alias of new Set(aliases)) {
+    const stripped = removeManagedBlock(config, blockBegin(alias), blockEnd(alias));
+    if (!stripped.ok) return stripped;
+    config = stripped.value;
+    removed += 1;
+  }
+  if (config.includes(LEGACY_BLOCK_BEGIN)) {
+    const stripped = removeManagedBlock(config, LEGACY_BLOCK_BEGIN, LEGACY_BLOCK_END);
+    if (!stripped.ok) return stripped;
+    config = stripped.value;
+    removed += 1;
+  }
+  return success({ config, removed });
+};
 var containsExactHost = (config, alias) => config.split("\n").some((line) => {
   const match = /^\s*Host\s+(.+?)\s*$/i.exec(line);
   return match?.[1]?.split(/\s+/).includes(alias) === true;
@@ -4297,10 +4109,10 @@ var agentKeys = () => {
 };
 var readText = (file) => {
   try {
-    return success(fs8.readFileSync(file, "utf8"));
+    return success(fs7.readFileSync(file, "utf8"));
   } catch (cause) {
-    const error2 = cause instanceof Error && "code" in cause ? cause.code : void 0;
-    return error2 === "ENOENT" ? success("") : failure(new WorkspaceSshError("key", `Could not read ${file}.`, cause));
+    const error = cause instanceof Error && "code" in cause ? cause.code : void 0;
+    return error === "ENOENT" ? success("") : failure(new WorkspaceSshError("key", `Could not read ${file}.`, cause));
   }
 };
 var configuredWorkspaceSshIdentityFile = (config, target) => {
@@ -4355,19 +4167,19 @@ var readRequiredKey = (keyPath, source) => {
 var readOptionalKey = (keyPath) => {
   const parsed = parseIdentityPath(keyPath);
   if (!parsed.ok) return parsed;
-  if (!fs8.existsSync(parsed.value) && !fs8.existsSync(publicKeyPath(parsed.value)))
+  if (!fs7.existsSync(parsed.value) && !fs7.existsSync(publicKeyPath(parsed.value)))
     return success(null);
   return readRequiredKey(parsed.value, "existing");
 };
 var pinAgentKey = (configHome, publicKey) => {
-  const identityFile = path8.resolve(
+  const identityFile = path7.resolve(
     configHome,
     "ssh",
     `agent-${hashIdentity(publicKeyIdentity(publicKey))}.pub`
   );
   try {
-    fs8.mkdirSync(path8.dirname(identityFile), { recursive: true, mode: 448 });
-    fs8.writeFileSync(identityFile, `${publicKey}
+    fs7.mkdirSync(path7.dirname(identityFile), { recursive: true, mode: 448 });
+    fs7.writeFileSync(identityFile, `${publicKey}
 `, { mode: 384 });
     return success({ publicKey, identityFile, source: "agent" });
   } catch (cause) {
@@ -4378,10 +4190,10 @@ var pinAgentKey = (configHome, publicKey) => {
 };
 var generateDedicatedKey = (privatePath) => {
   try {
-    fs8.mkdirSync(path8.dirname(privatePath), { recursive: true, mode: 448 });
+    fs7.mkdirSync(path7.dirname(privatePath), { recursive: true, mode: 448 });
   } catch (cause) {
     return failure(
-      new WorkspaceSshError("key", `Could not create ${path8.dirname(privatePath)}.`, cause)
+      new WorkspaceSshError("key", `Could not create ${path7.dirname(privatePath)}.`, cause)
     );
   }
   const generated = spawnSync(
@@ -4410,7 +4222,7 @@ var generateDedicatedKey = (privatePath) => {
   return fresh;
 };
 var dedicatedKey = (configHome, create) => {
-  const privatePath = path8.join(configHome, "ssh", "id_ed25519");
+  const privatePath = path7.join(configHome, "ssh", "id_ed25519");
   const existing = readOptionalKey(privatePath);
   if (existing.ok === false) return failure(existing.error);
   if (existing.value !== null || !create) return existing;
@@ -4458,10 +4270,10 @@ var writeWorkspaceSshConfig = (configFile, target, identityFile) => {
   const reconciled = reconcileWorkspaceSshConfig(before.value, target, identityFile);
   if (reconciled.ok === false) return failure(reconciled.error);
   try {
-    fs8.mkdirSync(path8.dirname(configFile), { recursive: true, mode: 448 });
-    fs8.chmodSync(path8.dirname(configFile), 448);
-    fs8.writeFileSync(configFile, reconciled.value, { mode: 384 });
-    fs8.chmodSync(configFile, 384);
+    fs7.mkdirSync(path7.dirname(configFile), { recursive: true, mode: 448 });
+    fs7.chmodSync(path7.dirname(configFile), 448);
+    fs7.writeFileSync(configFile, reconciled.value, { mode: 384 });
+    fs7.chmodSync(configFile, 384);
     return success(void 0);
   } catch (cause) {
     return failure(new WorkspaceSshError("config", `Could not write ${configFile}.`, cause));
@@ -4474,7 +4286,7 @@ var dim3 = ansi("2");
 var green3 = ansi("32");
 var warn = ansi("33");
 var say3 = (line) => console.log(line);
-var sshConfigPath = () => path9.join(os5.homedir(), ".ssh", "config");
+var sshConfigPath = () => path8.join(os5.homedir(), ".ssh", "config");
 var flagValue = (args, flag) => {
   const index = args.indexOf(flag);
   return index === -1 || args[index + 1] === void 0 ? null : String(args[index + 1]);
@@ -4585,6 +4397,299 @@ var sshCommand = async (args, api2, cliHome, serverUrl) => {
   }
 };
 
+// src/uninstall.ts
+import * as fs8 from "node:fs";
+import * as path9 from "node:path";
+var UNINSTALL_USAGE = "usage: mend uninstall [--all | --server | --home] [--yes]";
+var parseUninstallArgs = (args) => {
+  let scope = null;
+  let yes = false;
+  for (const arg of args) {
+    if (arg === "--yes" || arg === "-y") {
+      yes = true;
+      continue;
+    }
+    const next = arg === "--all" ? "all" : arg === "--server" ? "server" : arg === "--home" ? "home" : null;
+    if (next === null) return { error: `${UNINSTALL_USAGE} \xB7 "${arg}" is not an option` };
+    if (scope !== null && scope !== next) {
+      return { error: `${UNINSTALL_USAGE} \xB7 pick one scope` };
+    }
+    scope = next;
+  }
+  return { scope, yes };
+};
+var SERVER_FILES = ["identity.env", "active", "generations", "backups"];
+var countEntries = (directory) => {
+  try {
+    return fs8.readdirSync(directory).length;
+  } catch {
+    return 0;
+  }
+};
+var exists = (file) => {
+  try {
+    fs8.lstatSync(file);
+    return true;
+  } catch {
+    return false;
+  }
+};
+var managedBlockCount = (sshConfigFile) => {
+  let config;
+  try {
+    config = fs8.readFileSync(sshConfigFile, "utf8");
+  } catch {
+    return 0;
+  }
+  const stripped = stripManagedWorkspaceSshBlocks(config);
+  return stripped.ok ? stripped.value.removed : 0;
+};
+var describeUninstall = async (runtime, scope) => {
+  let server = null;
+  if (scope !== "home") {
+    const configDir = runtime.server.configDir;
+    const read = await withServerStore(
+      configDir,
+      async (store) => {
+        const installation = readServerInstallation(store);
+        if (installation._tag === "error") throw installation.error;
+        return installation.value;
+      },
+      { create: false }
+    );
+    if (read._tag === "error") {
+      if (!read.error.message.startsWith("No Mend server is configured")) throw read.error;
+      server = "none";
+    } else if (read.value === null) {
+      server = exists(path9.join(configDir, "identity.env")) ? {
+        version: "(no active generation)",
+        appUrl: "",
+        dockerContext: "",
+        generations: countEntries(path9.join(configDir, "generations")),
+        backups: countEntries(path9.join(configDir, "backups"))
+      } : "none";
+    } else {
+      server = {
+        version: read.value.config.serverVersion,
+        appUrl: read.value.config.appUrl,
+        dockerContext: read.value.config.dockerContext,
+        generations: countEntries(path9.join(configDir, "generations")),
+        backups: countEntries(path9.join(configDir, "backups"))
+      };
+    }
+  }
+  let home = null;
+  if (scope !== "server") {
+    const cliConfig = path9.join(runtime.cliHome, "cli.json");
+    const sshDirectory = path9.join(runtime.cliHome, "ssh");
+    home = {
+      cliConfig: exists(cliConfig) ? cliConfig : null,
+      sshDirectory: exists(sshDirectory) ? sshDirectory : null,
+      managedSshBlocks: managedBlockCount(runtime.sshConfigFile),
+      signedIn: runtime.signedIn
+    };
+  }
+  return { scope, server, home };
+};
+var plural = (count, noun) => `${count} ${noun}${count === 1 ? "" : "s"}`;
+var planLines = (plan, configDir) => {
+  const lines = [];
+  if (plan.server === "none") {
+    lines.push(`server   none installed under ${configDir}`);
+  } else if (plan.server !== null) {
+    const { version, appUrl, dockerContext, generations, backups } = plan.server;
+    lines.push(
+      `server   Mend ${version}${appUrl === "" ? "" : ` at ${appUrl}`}${dockerContext === "" ? "" : ` \xB7 docker context ${dockerContext}`}`
+    );
+    if (dockerContext !== "") {
+      lines.push(
+        `         containers mend, postgres \xB7 volumes ${[MEND_DOCKER_NAMESPACE.store, MEND_DOCKER_NAMESPACE.control, "mend-config", "mend-ssh", "mend-postgres"].join(", ")} \xB7 image ghcr.io/sealant-sh/mend:${version}`
+      );
+    }
+    lines.push(
+      `         ${configDir}: identity.env, active, ${plural(generations, "generation")}, ${plural(backups, "backup")}`
+    );
+  }
+  if (plan.home !== null) {
+    const parts = [];
+    if (plan.home.cliConfig !== null) {
+      parts.push(
+        plan.home.signedIn === null ? plan.home.cliConfig : `${plan.home.cliConfig} (signed in to ${plan.home.signedIn.url})`
+      );
+    }
+    if (plan.home.sshDirectory !== null) parts.push(plan.home.sshDirectory);
+    if (plan.home.managedSshBlocks > 0) {
+      parts.push(`${plural(plan.home.managedSshBlocks, "managed block")} in ~/.ssh/config`);
+    }
+    lines.push(parts.length === 0 ? "home     nothing of Mend's here" : `home     ${parts[0]}`);
+    for (const part of parts.slice(1)) lines.push(`         ${part}`);
+  }
+  return lines;
+};
+var planDeletesData = (plan) => plan.server !== null && plan.server !== "none";
+var dockerArgs = (context, ...rest) => [
+  "--context",
+  context,
+  ...rest
+];
+var removeServer = async (runtime, failures, leftovers) => {
+  const { server } = runtime;
+  const configDir = server.configDir;
+  const result = await withServerStore(
+    configDir,
+    async (store) => {
+      const read = readServerInstallation(store);
+      if (read._tag === "error") throw read.error;
+      const installation = read.value;
+      if (installation !== null) {
+        const context = installation.config.dockerContext;
+        const down = await server.run(
+          "docker",
+          serverComposeArgs({ directory: installation.directory, dockerContext: context }, [
+            "down",
+            "--volumes",
+            "--remove-orphans",
+            "--timeout",
+            "30"
+          ]),
+          { timeoutMs: serverProcessDeadlines.stop }
+        );
+        if (down.status !== 0) {
+          throw new Error(
+            `docker compose down failed: ${(down.error ?? down.stderr.trim()) || "no output"}. Containers and files are retained; fix Docker and run mend uninstall again.`
+          );
+        }
+        server.writeLine("removed containers mend, postgres and the Compose-owned volumes");
+        const identity = store.readIdentity();
+        if (identity._tag === "error") throw identity.error;
+        const owned = identity.value === null ? null : await verifyServerDockerVolumes(server, {
+          dockerContext: context,
+          identityBytes: Buffer.from(identity.value)
+        });
+        if (owned !== null && owned._tag === "ok") {
+          const removed = await server.run(
+            "docker",
+            dockerArgs(
+              context,
+              "volume",
+              "rm",
+              MEND_DOCKER_NAMESPACE.store,
+              MEND_DOCKER_NAMESPACE.control
+            )
+          );
+          if (removed.status === 0) {
+            server.writeLine(
+              `removed volumes ${MEND_DOCKER_NAMESPACE.store}, ${MEND_DOCKER_NAMESPACE.control}`
+            );
+          } else {
+            failures.push(
+              `could not remove volumes ${MEND_DOCKER_NAMESPACE.store}, ${MEND_DOCKER_NAMESPACE.control}: ${(removed.error ?? removed.stderr.trim()) || "no output"}`
+            );
+          }
+        } else if (owned !== null && owned.error.reason === "missing") {
+          server.writeLine(
+            `volumes ${MEND_DOCKER_NAMESPACE.store}, ${MEND_DOCKER_NAMESPACE.control} were already gone`
+          );
+        } else {
+          leftovers.push(
+            `volumes ${MEND_DOCKER_NAMESPACE.store}, ${MEND_DOCKER_NAMESPACE.control}: ownership could not be confirmed for this installation, so they stay (docker --context ${context} volume ls)`
+          );
+        }
+        const image = `ghcr.io/sealant-sh/mend:${installation.config.serverVersion}`;
+        const untagged = await server.run("docker", dockerArgs(context, "image", "rm", image));
+        if (untagged.status === 0) server.writeLine(`removed image ${image}`);
+        else leftovers.push(`image ${image}: not removed (${untagged.stderr.trim() || "absent"})`);
+        const workspaces = await server.run(
+          "docker",
+          dockerArgs(
+            context,
+            "container",
+            "ls",
+            "--all",
+            "--filter",
+            "name=^sealant-",
+            "--format",
+            "{{.Names}}"
+          )
+        );
+        const names = workspaces.stdout.split(/\s+/).filter((name) => name !== "");
+        if (workspaces.status === 0 && names.length > 0) {
+          leftovers.push(
+            `${plural(names.length, "workspace container")} left on docker context ${context} (${names.slice(0, 3).join(", ")}${names.length > 3 ? ", \u2026" : ""}): docker --context ${context} rm -f ${names.join(" ")}`
+          );
+        }
+      }
+      for (const name of SERVER_FILES) {
+        fs8.rmSync(path9.join(configDir, name), { recursive: true, force: true });
+      }
+      server.writeLine(`removed ${configDir}/{identity.env, active, generations, backups}`);
+    },
+    { create: false }
+  );
+  if (result._tag === "error") failures.push(result.error.message);
+};
+var removeHome = async (runtime, plan, failures, leftovers) => {
+  const { server } = runtime;
+  if (plan.cliConfig !== null) {
+    fs8.rmSync(plan.cliConfig, { force: true });
+    server.writeLine(`removed ${plan.cliConfig}`);
+  }
+  if (plan.sshDirectory !== null) {
+    fs8.rmSync(plan.sshDirectory, { recursive: true, force: true });
+    server.writeLine(`removed ${plan.sshDirectory}`);
+  }
+  if (plan.managedSshBlocks > 0) {
+    try {
+      const before = fs8.readFileSync(runtime.sshConfigFile, "utf8");
+      const stripped = stripManagedWorkspaceSshBlocks(before);
+      if (!stripped.ok) throw stripped.error;
+      if (stripped.value.removed > 0) {
+        fs8.writeFileSync(runtime.sshConfigFile, stripped.value.config, { mode: 384 });
+        server.writeLine(
+          `removed ${plural(stripped.value.removed, "managed block")} from ${runtime.sshConfigFile}`
+        );
+      }
+    } catch (cause) {
+      failures.push(
+        `${runtime.sshConfigFile}: ${cause instanceof Error ? cause.message : String(cause)}`
+      );
+    }
+  }
+  let remaining = [];
+  try {
+    remaining = fs8.readdirSync(runtime.cliHome);
+  } catch {
+    return;
+  }
+  if (remaining.length === 0) {
+    fs8.rmdirSync(runtime.cliHome);
+    server.writeLine(`removed ${runtime.cliHome}`);
+  } else {
+    leftovers.push(
+      `${runtime.cliHome} kept: ${remaining.join(", ")} ${remaining.length === 1 ? "is" : "are"} not this CLI's (a host-run server's store or keys, or another tool's files)`
+    );
+  }
+};
+var executeUninstall = async (runtime, plan) => {
+  const failures = [];
+  const leftovers = [];
+  if (plan.home?.signedIn !== null && plan.home?.signedIn?.deviceId != null) {
+    const failure2 = await runtime.revokeDevice();
+    if (failure2 === null) {
+      runtime.server.writeLine(`revoked this terminal's device on ${plan.home.signedIn.url}`);
+    } else {
+      leftovers.push(
+        `device token on ${plan.home.signedIn.url}: ${failure2} (end it under Settings \u2192 Devices)`
+      );
+    }
+  }
+  if (plan.server !== null && plan.server !== "none") {
+    await removeServer(runtime, failures, leftovers);
+  }
+  if (plan.home !== null) await removeHome(runtime, plan.home, failures, leftovers);
+  return { failures, leftovers };
+};
+
 // src/main.ts
 var mendCliHome = () => {
   const xdg = process.env["XDG_CONFIG_HOME"];
@@ -4700,8 +4805,8 @@ var request = async (config, method, route, body) => {
 var api = async (config, method, route, body) => {
   try {
     return await request(config, method, route, body);
-  } catch (error2) {
-    return fail4(error2 instanceof Error ? error2.message : String(error2));
+  } catch (error) {
+    return fail4(error instanceof Error ? error.message : String(error));
   }
 };
 var boundApi = (config) => (method, route, body) => api(config, method, route, body);
@@ -4927,8 +5032,8 @@ var attachTty = async (config, sessionId, harness, from, processId, options) =>
   const ws = new WebSocket(url);
   ws.binaryType = "arraybuffer";
   try {
-    await new Promise((resolve5, reject) => {
-      ws.addEventListener("open", () => resolve5(), { once: true });
+    await new Promise((resolve4, reject) => {
+      ws.addEventListener("open", () => resolve4(), { once: true });
       ws.addEventListener("error", () => reject(new Error("could not connect")), { once: true });
     });
   } catch {
@@ -4936,8 +5041,8 @@ var attachTty = async (config, sessionId, harness, from, processId, options) =>
   }
   const stopHerdrHint = hintHerdrAttachment(harness);
   let finishAttachment;
-  const finished = new Promise((resolve5) => {
-    finishAttachment = resolve5;
+  const finished = new Promise((resolve4) => {
+    finishAttachment = resolve4;
   });
   const onClose = () => finishAttachment?.();
   if (ws.readyState === WebSocket.CLOSED) finishAttachment?.();
@@ -5555,7 +5660,7 @@ var serviceLogs = async (config, args) => {
     cursor = page.nextFrom;
     const ended = page.status === "exited" || page.status === "failed";
     if (ended && !advanced) break;
-    if (!advanced) await new Promise((resolve5) => setTimeout(resolve5, 250));
+    if (!advanced) await new Promise((resolve4) => setTimeout(resolve4, 250));
   }
   say4("");
   say4(dim4(`stream ended \xB7 next sequence ${cursor}`));
@@ -5670,16 +5775,16 @@ var tunnelServices = async (config, services, portOverride) => {
       socket.on("close", () => ws.close());
       socket.on("error", () => ws.close());
     });
-    await new Promise((resolve5, reject) => {
-      server.once("error", (error2) => {
+    await new Promise((resolve4, reject) => {
+      server.once("error", (error) => {
         reject(
           new Error(
-            error2.code === "EADDRINUSE" ? `127.0.0.1:${port} is already in use here \u2014 pick one with: mend service connect ${service.label} --port <n>` : error2.message
+            error.code === "EADDRINUSE" ? `127.0.0.1:${port} is already in use here \u2014 pick one with: mend service connect ${service.label} --port <n>` : error.message
           )
         );
       });
-      server.listen(port, "127.0.0.1", () => resolve5());
-    }).catch((error2) => fail4(error2.message));
+      server.listen(port, "127.0.0.1", () => resolve4());
+    }).catch((error) => fail4(error.message));
     say4(
       `${green4("\u25CF")} ${service.label ?? service.id.slice(0, 8)} \u2192 127.0.0.1:${port} ${dim4(`(tunnel to ${config.url})`)}`
     );
@@ -5853,6 +5958,80 @@ var logout = async (config) => {
   saveCliConfig({ ...config, token: null, deviceId: null });
   say4(`${green4("\u2713")} signed out \xB7 ${dim4(`token removed from ${CONFIG_PATH}`)}`);
 };
+var UNINSTALL_CHOICES = [
+  { scope: "all", text: "everything \xB7 the server on this machine and this machine's Mend files" },
+  { scope: "server", text: "the server only \xB7 containers, volumes, configuration, backups" },
+  {
+    scope: "home",
+    text: "this machine's files only \xB7 sign-in, workspace ssh key, ~/.ssh/config block"
+  }
+];
+var askUninstallScope = async () => {
+  if (process.stdin.isTTY !== true || process.stdout.isTTY !== true) {
+    return fail4(`${UNINSTALL_USAGE} \xB7 no terminal to ask on`);
+  }
+  say4("what should go?");
+  UNINSTALL_CHOICES.forEach((choice, index) => say4(`  ${index + 1}. ${choice.text}`));
+  const readline = await import("node:readline/promises");
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  const answer = (await rl.question("  1, 2 or 3: ")).trim();
+  rl.close();
+  const chosen = UNINSTALL_CHOICES[Number(answer) - 1];
+  if (chosen === void 0) return fail4(`"${answer}" is not one of the choices`);
+  return chosen.scope;
+};
+var confirmUninstall = async (word) => {
+  if (process.stdin.isTTY !== true) return fail4("non-interactive \u2014 pass --yes to remove");
+  const readline = await import("node:readline/promises");
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  const answer = (await rl.question(word === "y" ? "remove? [y/N] " : `type ${word} to remove: `)).trim().toLowerCase();
+  rl.close();
+  return answer === word;
+};
+var uninstallCommand = async (config, args) => {
+  const parsed = parseUninstallArgs(args);
+  if ("error" in parsed) return fail4(parsed.error);
+  const scope = parsed.scope ?? await askUninstallScope();
+  const server = nodeServerRuntime();
+  const runtime = {
+    server,
+    cliHome: mendCliHome(),
+    sshConfigFile: path10.join(os6.homedir(), ".ssh", "config"),
+    signedIn: config.token === null || !fs9.existsSync(CONFIG_PATH) ? null : { url: config.url, deviceId: config.deviceId },
+    revokeDevice: async () => {
+      if (config.deviceId === null) return "no device id saved";
+      try {
+        await request(config, "DELETE", `/me/devices/${config.deviceId}`);
+        return null;
+      } catch (error) {
+        return error instanceof Error ? error.message : String(error);
+      }
+    }
+  };
+  const plan = await describeUninstall(runtime, scope);
+  say4(dim4(`mend uninstall \xB7 ${scope === "all" ? "everything" : scope}`));
+  for (const line of planLines(plan, server.configDir)) say4(`  ${line}`);
+  const nothing = (plan.server === null || plan.server === "none") && (plan.home === null || plan.home.cliConfig === null && plan.home.sshDirectory === null && plan.home.managedSshBlocks === 0);
+  if (nothing) {
+    say4(dim4("nothing to remove"));
+    return;
+  }
+  if (planDeletesData(plan)) {
+    say4("repositories, worktrees, the database and its backups are deleted with the server");
+  }
+  if (!parsed.yes && !await confirmUninstall(planDeletesData(plan) ? "delete" : "y")) {
+    say4(dim4("nothing removed"));
+    return;
+  }
+  const outcome = await executeUninstall(runtime, plan);
+  for (const line of outcome.leftovers) say4(dim4(`  kept \xB7 ${line}`));
+  if (outcome.failures.length > 0) {
+    return fail4(outcome.failures.join("\n"));
+  }
+  say4(
+    `${green4("\u2713")} ${scope === "all" ? "Mend is gone from this machine" : scope === "server" ? "the server is gone from this machine" : "this machine no longer holds Mend files"}`
+  );
+};
 var printGitKey = (key) => {
   if (key.publicKey === null) return;
   say4(key.publicKey);
@@ -6308,6 +6487,7 @@ _mend() {
     'shell:open a shell in a live session workspace'
     'service:reachable ports \u2014 add, list, stop'
     'server:local server setup, lifecycle and upgrades'
+    'uninstall:remove the server, local Mend files, or both'
     'keys:the machine Mend deploy key \u2014 init, show, share'
     'skills:skill libraries \u2014 list, push'
     'accounts:your connected accounts on the platform'
@@ -6328,7 +6508,7 @@ _mend() {
         compadd setup status start stop restart logs upgrade
       else
         case $words[3] in
-          setup) compadd -- --version --assets-dir --offline --context --port --ssh-port --registry-port --bind --url --origin --docker-socket ;;
+          setup) compadd -- --version --assets-dir --offline --context --port --ssh-port --bind --url --origin --docker-socket ;;
           upgrade) compadd -- --version --assets-dir --offline ;;
           start|restart) compadd -- --offline ;;
           logs) compadd -- --tail ;;
@@ -6347,7 +6527,7 @@ _mend "$@"
 var BASH_COMPLETIONS = `_mend() {
   local cur=\${COMP_WORDS[COMP_CWORD]}
   if [ "$COMP_CWORD" -eq 1 ]; then
-    COMPREPLY=( $(compgen -W "adopt codex claude opencode run attach stop shell service server keys skills pair doctor continue resume rejoin refresh projects sessions status ui help" -- "$cur") )
+    COMPREPLY=( $(compgen -W "adopt codex claude opencode run attach stop shell service server uninstall keys skills pair doctor continue resume rejoin refresh projects sessions status ui help" -- "$cur") )
     return
   fi
   case \${COMP_WORDS[1]} in
@@ -6357,7 +6537,7 @@ var BASH_COMPLETIONS = `_mend() {
         options="setup status start stop restart logs upgrade"
       else
         case \${COMP_WORDS[2]} in
-          setup) options="--version --assets-dir --offline --context --port --ssh-port --registry-port --bind --url --origin --docker-socket" ;;
+          setup) options="--version --assets-dir --offline --context --port --ssh-port --bind --url --origin --docker-socket" ;;
           upgrade) options="--version --assets-dir --offline" ;;
           start|restart) options="--offline" ;;
           logs) options="--tail" ;;
@@ -6539,10 +6719,10 @@ var resumeForRejoin = async (config, sessionId, label) => {
       request(config, "POST", `/sessions/${sessionId}/resume`, { harness: null })
     );
     return true;
-  } catch (error2) {
+  } catch (error) {
     const refreshed = await api(config, "GET", `/sessions/${sessionId}`);
     if (agentIsLive(refreshed.session, refreshed.currentAgent)) return false;
-    return fail4(error2 instanceof Error ? error2.message : String(error2));
+    return fail4(error instanceof Error ? error.message : String(error));
   }
 };
 var rejoinCommand = async (config, args) => {
@@ -6992,6 +7172,8 @@ var main = async () => {
       return login(config, rest);
     case "logout":
       return logout(config);
+    case "uninstall":
+      return uninstallCommand(config, rest);
     case "keys":
       return keysCommand(config, rest);
     case "dotfiles":