@sealant/mend 0.36.0-next.663 → 0.36.0-next.675

package/dist/main.js

@@ -40,6 +40,7 @@ import {
   landingFactsFromWire,
   launcherNameOf,
   matchProjectByCwd,
+  mayStillBeWorking,
   narrowCredential,
   noAnswerError,
   normalizeGitAuthor,
@@ -51,6 +52,7 @@ import {
   replaceConfirmLines,
   repositoryCloneUrlIssue,
   sameGrant,
+  serviceStartCorrelation,
   servicesHoldOf,
   sessionDisplayName,
   sessionWorkspaceLines,
@@ -68,10 +70,11 @@ import {
   workspaceRetirementLine,
   worktreeJoinLine,
   worktreeListsPeople
-} from "./chunk-VOP6USOZ.js";
+} from "./chunk-TP4A72RF.js";
 
 // src/main.ts
 import { spawn as spawn3, spawnSync as spawnSync6 } from "node:child_process";
+import * as crypto from "node:crypto";
 import * as fs20 from "node:fs";
 import { createRequire } from "node:module";
 import * as net5 from "node:net";
@@ -853,6 +856,421 @@ var EDGE_CADDYFILE = [
   "}"
 ].join("\n") + "\n";
 
+// src/server-mirrors.ts
+var NPM_MIRROR_IMAGE = "nginx:1.29-alpine";
+var DOCKER_MIRROR_IMAGE = "registry:3.1";
+var MIRRORS_COMPOSE_FILE = "compose.mirrors.yaml";
+var NPM_MIRROR_CONF_NAME = "npm-mirror.conf";
+var NPM_MIRROR_URL = "http://npm-mirror:4873/";
+var DOCKER_MIRROR_URL = "http://docker-mirror:5000";
+var DOCKER_MIRROR_CONTAINER = "mend-docker-mirror";
+var DEFAULT_NPM_MIRROR_MAX_SIZE = "10g";
+var DOCKER_MIRROR_TTL = "168h";
+var DEFAULT_DOCKER_MIRROR_MAX_SIZE = "20g";
+var MIRROR_MIN_FREE = "5g";
+var DOCKER_MIRROR_GUARD_NAME = "docker-mirror-guard.sh";
+var dockerMirrorLogin = (docker2) => docker2 !== null && "upstreamUser" in docker2 ? docker2.upstreamUser : void 0;
+var DEFAULT_MIRRORS = {
+  npm: { maxSize: DEFAULT_NPM_MIRROR_MAX_SIZE },
+  docker: { maxSize: DEFAULT_DOCKER_MIRROR_MAX_SIZE }
+};
+var parseMirrorSize = (value) => {
+  const match = /^([1-9]\d{0,5})([mMgG])$/.exec(value.trim());
+  if (match === null) return null;
+  const [, amount = "", unit = ""] = match;
+  const size = `${amount}${unit.toLowerCase()}`;
+  return mirrorSizeBytes(size) >= 1024 ** 3 ? size : null;
+};
+var mirrorSizeBytes = (size) => {
+  const amount = Number(size.slice(0, -1));
+  return size.endsWith("g") ? amount * 1024 ** 3 : amount * 1024 ** 2;
+};
+var CREDENTIAL = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,254}$/;
+var isDockerHubCredential = (value) => CREDENTIAL.test(value);
+var runsMirrors = (mirrors) => mirrors !== void 0 && (mirrors.npm !== null || mirrors.docker !== null);
+var mirrorsEnvLines = (mirrors, dockerHubToken) => {
+  const user = dockerMirrorLogin(mirrors?.docker ?? null);
+  return [
+    ...mirrors === void 0 || mirrors.npm === null ? [] : [`MEND_NPM_MIRROR_MAX_SIZE=${mirrors.npm.maxSize}`],
+    ...mirrors === void 0 || mirrors.docker === null ? [] : [`MEND_DOCKER_MIRROR_MAX_SIZE=${mirrors.docker.maxSize}`],
+    ...user === void 0 || dockerHubToken === void 0 ? [] : [`MEND_DOCKER_HUB_USERNAME=${user}`, `MEND_DOCKER_HUB_TOKEN=${dockerHubToken}`]
+  ];
+};
+var LOGGING = [
+  "    logging:",
+  "      driver: json-file",
+  "      options:",
+  '        max-size: "20m"',
+  '        max-file: "5"'
+];
+var HEALTH_TIMING = [
+  "      interval: 10s",
+  "      timeout: 5s",
+  "      retries: 3",
+  "      start_period: 10s"
+];
+var npmMirrorService = () => [
+  "  # Read-through cache of registry.npmjs.org (npm-mirror.conf). Size-capped, and it leaves",
+  `  # ${MIRROR_MIN_FREE} free on its disk; the least recently used tarballs go first. No credential sent.`,
+  "  npm-mirror:",
+  `    image: ${NPM_MIRROR_IMAGE}`,
+  "    hostname: npm-mirror",
+  "    restart: unless-stopped",
+  "    environment:",
+  '      NGINX_ENTRYPOINT_LOCAL_RESOLVERS: "1"',
+  '      NGINX_ENTRYPOINT_QUIET_LOGS: "1"',
+  "      NPM_MIRROR_MAX_SIZE: ${MEND_NPM_MIRROR_MAX_SIZE:?set MEND_NPM_MIRROR_MAX_SIZE in server.env}",
+  `      NPM_MIRROR_MIN_FREE: ${MIRROR_MIN_FREE}`,
+  "    volumes:",
+  `      - ./${NPM_MIRROR_CONF_NAME}:/etc/nginx/templates/default.conf.template:ro`,
+  "      - mend-npm-mirror:/var/cache/npm-mirror",
+  "    # Answered by nginx itself, so it says the mirror is up without asking the registry.",
+  "    healthcheck:",
+  '      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:4873/-/ping"]',
+  ...HEALTH_TIMING,
+  ...LOGGING
+];
+var dockerMirrorService = (mirrors) => [
+  "  # Pull-through cache of Docker Hub, run by its guard (docker-mirror-guard.sh): the cache stays",
+  `  # under its cap and leaves ${MIRROR_MIN_FREE} free on its disk. Layer data is deleted seven days after a`,
+  "  # fetch. The metrics listener stays on the container's loopback.",
+  "  docker-mirror:",
+  `    image: ${DOCKER_MIRROR_IMAGE}`,
+  `    container_name: ${DOCKER_MIRROR_CONTAINER}`,
+  "    hostname: docker-mirror",
+  "    restart: unless-stopped",
+  "    init: true",
+  `    entrypoint: ["/bin/sh", "/mend/${DOCKER_MIRROR_GUARD_NAME}"]`,
+  "    environment:",
+  "      DOCKER_MIRROR_MAX_SIZE:",
+  "        ${MEND_DOCKER_MIRROR_MAX_SIZE:?set MEND_DOCKER_MIRROR_MAX_SIZE in server.env}",
+  `      DOCKER_MIRROR_MIN_FREE: ${MIRROR_MIN_FREE}`,
+  "      REGISTRY_PROXY_REMOTEURL: https://registry-1.docker.io",
+  `      REGISTRY_PROXY_TTL: ${DOCKER_MIRROR_TTL}`,
+  "      REGISTRY_LOG_LEVEL: warn",
+  '      REGISTRY_LOG_ACCESSLOG_DISABLED: "true"',
+  "      REGISTRY_HTTP_DEBUG_ADDR: 127.0.0.1:5001",
+  '      REGISTRY_HTTP_DEBUG_PROMETHEUS_ENABLED: "true"',
+  ...dockerMirrorLogin(mirrors.docker) === void 0 ? [] : [
+    "      # A token the operator declared Public Repo Read-only: every session can pull what it reads.",
+    "      REGISTRY_PROXY_USERNAME: ${MEND_DOCKER_HUB_USERNAME:?set MEND_DOCKER_HUB_USERNAME in server.env}",
+    "      REGISTRY_PROXY_PASSWORD: ${MEND_DOCKER_HUB_TOKEN:?set MEND_DOCKER_HUB_TOKEN in server.env}"
+  ],
+  "    volumes:",
+  `      - ./${DOCKER_MIRROR_GUARD_NAME}:/mend/${DOCKER_MIRROR_GUARD_NAME}:ro`,
+  "      - mend-docker-mirror:/var/lib/registry",
+  "    # Healthy while its guard keeps working, which it records every pass. The registry inside may",
+  "    # be paused for want of disk, or not started because Docker Hub did not answer (it asks Hub as",
+  "    # it starts, and the guard tries again every pass): setup does not wait for it.",
+  "    healthcheck:",
+  `      test: ["CMD-SHELL", 'test -n "$$(find /tmp/mend-mirror-guard -mmin -2)"']`,
+  ...HEALTH_TIMING,
+  ...LOGGING
+];
+var renderMirrorsOverlay = (mirrors) => {
+  if (!runsMirrors(mirrors)) return void 0;
+  return [
+    "# Written by mend server setup: the package and image mirrors this install runs, on the Compose",
+    "# network only (no host port). Values come from server.env. Sessions install npm packages and",
+    "# pull Docker Hub images through them; a mirror that is down sends them to the registry itself.",
+    "services:",
+    "  mend:",
+    "    environment:",
+    ...mirrors.npm === null ? [] : [`      MEND_NPM_MIRROR_URL: ${NPM_MIRROR_URL}`],
+    ...mirrors.docker === null ? [] : [
+      `      SEALANT_DOCKER_REGISTRY_MIRRORS: ${DOCKER_MIRROR_URL}`,
+      `      SEALANT_DOCKER_REGISTRY_MIRROR_CONTAINER: ${DOCKER_MIRROR_CONTAINER}`
+    ],
+    "",
+    ...mirrors.npm === null ? [] : [...npmMirrorService(), ""],
+    ...mirrors.docker === null ? [] : [...dockerMirrorService(mirrors), ""],
+    "volumes:",
+    ...mirrors.npm === null ? [] : ["  mend-npm-mirror:"],
+    ...mirrors.docker === null ? [] : ["  mend-docker-mirror:"],
+    ""
+  ].join("\n");
+};
+var mirrorServices = (mirrors) => [
+  ...mirrors === void 0 || mirrors.npm === null ? [] : ["npm-mirror"],
+  ...mirrors === void 0 || mirrors.docker === null ? [] : ["docker-mirror"]
+];
+var mirrorImagesOf = (overlay) => [...overlay.matchAll(/^ {4}image:[ \t]*((?:nginx|registry):[^\s#]+)[ \t]*$/gm)].map((match) => match[1]).filter((image) => image !== void 0);
+var NPM_MIRROR_CONF = `# Mend's npm mirror: a read-through cache of the public npm registry (registry.npmjs.org) for the
+# workspaces on this host. nginx keeps what it fetched and serves it again. The package manager
+# checks every tarball against its lockfile's integrity hash, so the cache never decides what is
+# installed. Nothing is published through it, and no credential is sent upstream. When the
+# registry fails, a copy already held is served instead.
+proxy_cache_path /var/cache/npm-mirror levels=2:2 keys_zone=npm:64m
+                 max_size=\${NPM_MIRROR_MAX_SIZE} min_free=\${NPM_MIRROR_MIN_FREE}
+                 inactive=90d use_temp_path=off;
+
+# Abbreviated metadata (what installs ask for) and full metadata are different documents.
+map $http_accept $npm_document {
+    "~application/vnd\\.npm\\.install-v1\\+json" abbreviated;
+    default full;
+}
+
+# One JSON line per request: \`mend server status\` reads the cache field of the tarball lines.
+log_format npm_mirror escape=json
+    '{"time":"$time_iso8601","method":"$request_method","uri":"$uri","status":$status,'
+    '"cache":"$upstream_cache_status","bytes":$body_bytes_sent}';
+
+server {
+    listen 4873;
+    access_log /dev/stdout npm_mirror;
+    error_log /dev/stderr warn;
+    client_max_body_size 8m;
+
+    resolver \${NGINX_LOCAL_RESOLVERS} valid=60s ipv6=off;
+    resolver_timeout 5s;
+    set $npm_registry registry.npmjs.org;
+
+    proxy_http_version 1.1;
+    proxy_set_header Host registry.npmjs.org;
+    proxy_set_header Connection "";
+    # Never forward a credential: the mirror serves the public registry, the same to everyone.
+    proxy_set_header Authorization "";
+    proxy_set_header Cookie "";
+    # Uncompressed from upstream, so one cached copy serves every client; gzip below compresses it.
+    proxy_set_header Accept-Encoding "";
+    proxy_ssl_server_name on;
+    proxy_ssl_name registry.npmjs.org;
+    proxy_ssl_verify on;
+    proxy_ssl_verify_depth 4;
+    proxy_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
+    proxy_connect_timeout 10s;
+    proxy_read_timeout 60s;
+    proxy_ignore_headers Cache-Control Expires Set-Cookie Vary;
+    proxy_hide_header Set-Cookie;
+    proxy_cache_lock on;
+    proxy_cache_lock_timeout 120s;
+    proxy_cache_use_stale error timeout invalid_header updating http_500 http_502 http_503 http_504 http_429;
+    proxy_cache_background_update on;
+    add_header X-Mend-Mirror $upstream_cache_status always;
+
+    gzip on;
+    gzip_proxied any;
+    gzip_types application/json application/vnd.npm.install-v1+json;
+
+    # Answered here, so a client can tell the mirror is up without asking the registry.
+    location = /-/ping {
+        default_type application/json;
+        return 200 '{}';
+    }
+
+    # Tarballs never change once published: kept until the cache needs the room.
+    location ~ ^/(?:@[^/]+/)?[^/]+/-/[^/]+\\.tgz$ {
+        limit_except GET HEAD { deny all; }
+        proxy_cache npm;
+        proxy_cache_key $uri;
+        proxy_cache_valid 200 365d;
+        proxy_pass https://$npm_registry;
+    }
+
+    # Audit reports go to the registry as they are, never cached.
+    location /-/npm/v1/security/ {
+        limit_except POST { deny all; }
+        proxy_pass https://$npm_registry;
+    }
+
+    # Metadata: fresh for five minutes, then revalidated; served stale while the registry fails.
+    # The key is the whole request, query included: a search for one package never answers another.
+    location / {
+        limit_except GET HEAD { deny all; }
+        proxy_cache npm;
+        proxy_cache_key $request_uri|$npm_document;
+        proxy_cache_valid 200 5m;
+        proxy_cache_valid 404 1m;
+        proxy_cache_revalidate on;
+        proxy_pass https://$npm_registry;
+    }
+}
+`;
+var DOCKER_MIRROR_GUARD = `#!/bin/sh
+# Mend's Docker mirror guard (written by mend server setup): runs the registry, and keeps its cache
+# under a byte cap and the disk it lives on above a floor. Over the cap, the cache is cleared and
+# fills again from Docker Hub. Below the floor, the cache is cleared and the registry stays stopped
+# until there is room again; meanwhile session Docker daemons pull from Docker Hub directly. The
+# registry has no size cap of its own, and its seven-day expiry deletes layer data only.
+set -u
+root=/var/lib/registry
+state=/tmp/mend-mirror-guard
+size_mb() {
+  case "$1" in
+    *g) echo $((\${1%g} * 1024)) ;;
+    *m) echo "\${1%m}" ;;
+    *) echo "mend docker mirror guard: cannot read size $1" >&2 && exit 64 ;;
+  esac
+}
+cap=$(size_mb "\${DOCKER_MIRROR_MAX_SIZE:?}") || exit 64
+floor=$(size_mb "\${DOCKER_MIRROR_MIN_FREE:?}") || exit 64
+interval=\${DOCKER_MIRROR_GUARD_INTERVAL:-30}
+pid=
+stop_registry() {
+  if [ -n "$pid" ]; then
+    kill "$pid" 2>/dev/null
+    wait "$pid" 2>/dev/null
+  fi
+  pid=
+}
+clear_cache() { rm -rf "$root/docker" "$root/scheduler-state.json"; }
+cache_held() { [ -e "$root/docker" ] || [ -e "$root/scheduler-state.json" ]; }
+trap 'stop_registry; exit 0' TERM INT
+while :; do
+  free=$(df -Pm "$root" | awk 'NR == 2 { print $4 }')
+  if [ "$free" -lt "$floor" ]; then
+    # Below the floor: no registry, and no cache, whether the registry was running or this is a
+    # start with a cache left from before. Once the space is back, the next pass starts it again.
+    stop_registry
+    # What is left, looked at again after clearing: the log and the status say what this finds,
+    # not what was attempted.
+    if cache_held; then
+      clear_cache
+      if cache_held; then outcome="cache could not be cleared"; else outcome="cache cleared"; fi
+      echo "mend docker mirror guard: \${free} MiB free on its disk, below \${floor} MiB: \${outcome}, registry paused" >&2
+    fi
+    if cache_held; then held=kept; else held=none; fi
+    echo "paused \${free} \${floor} \${held}" >"$state"
+  else
+    used=$(du -sm "$root" | cut -f1)
+    if [ "$used" -gt "$cap" ]; then
+      stop_registry
+      clear_cache
+      if cache_held; then outcome="could not be cleared"; else outcome="cleared"; fi
+      echo "mend docker mirror guard: cache \${used} MiB, over its \${cap} MiB cap: \${outcome}" >&2
+    fi
+    if [ -z "$pid" ] || ! kill -0 "$pid" 2>/dev/null; then
+      registry serve /etc/distribution/config.yml &
+      pid=$!
+    fi
+    echo "running" >"$state"
+  fi
+  sleep "$interval" &
+  wait $!
+done
+`;
+var formatBytes = (bytes) => {
+  if (bytes < 1024) return `${bytes} B`;
+  const units = ["KiB", "MiB", "GiB", "TiB"];
+  let value = bytes / 1024;
+  let unit = 0;
+  while (value >= 1024 && unit < units.length - 1) {
+    value /= 1024;
+    unit += 1;
+  }
+  return `${value.toFixed(value < 10 ? 1 : 0)} ${units[unit]}`;
+};
+var percent = (part, whole) => whole === 0 ? "" : ` (${Math.round(part / whole * 100)}%)`;
+var mirrorDiskProbe = (directory) => `du -sk ${directory} | cut -f1; df -Pk ${directory} | awk 'NR == 2 { print $4 }'; cat /tmp/mend-mirror-guard 2>/dev/null || true`;
+var mirrorDiskOf = (stdout) => {
+  const [used, free, guard = ""] = stdout.trim().split("\n").map((line) => line.trim());
+  const usedKiB = Number(used);
+  const freeKiB = Number(free);
+  if (used === void 0 || free === void 0 || used === "" || free === "") return null;
+  if (!Number.isFinite(usedKiB) || !Number.isFinite(freeKiB)) return null;
+  const paused = /^paused (\d+) (\d+)(?: (none|kept))?$/.exec(guard);
+  return {
+    used: usedKiB * 1024,
+    free: freeKiB * 1024,
+    guard: paused?.[1] !== void 0 && paused[2] !== void 0 ? {
+      state: "paused",
+      freeMiB: Number(paused[1]),
+      floorMiB: Number(paused[2]),
+      cache: paused[3] === "none" || paused[3] === "kept" ? paused[3] : null
+    } : guard === "running" ? { state: "running" } : null
+  };
+};
+var FROM_CACHE = /* @__PURE__ */ new Set(["HIT", "STALE", "UPDATING", "REVALIDATED"]);
+var FROM_UPSTREAM = /* @__PURE__ */ new Set(["MISS", "EXPIRED", "BYPASS"]);
+var npmMirrorTraffic = (log) => {
+  let tarballs = 0;
+  let fromCache = 0;
+  let fromRegistry = 0;
+  for (const line of log.split("\n")) {
+    const start = line.indexOf("{");
+    if (start < 0) continue;
+    let fields;
+    try {
+      fields = JSON.parse(line.slice(start));
+    } catch {
+      continue;
+    }
+    if (typeof fields !== "object" || fields === null) continue;
+    const entry = new Map(Object.entries(fields));
+    const uri = entry.get("uri");
+    const cache = entry.get("cache");
+    if (typeof uri !== "string" || !uri.endsWith(".tgz") || typeof cache !== "string") continue;
+    tarballs += 1;
+    if (FROM_CACHE.has(cache)) fromCache += 1;
+    else if (FROM_UPSTREAM.has(cache)) fromRegistry += 1;
+  }
+  return { tarballs, fromCache, fromRegistry };
+};
+var dockerMirrorTraffic = (metrics) => {
+  const counter = (name, type2) => {
+    const match = new RegExp(`^registry_proxy_${name}_total\\{type="${type2}"\\} (\\d+)`, "m").exec(
+      metrics
+    );
+    return match?.[1] === void 0 ? null : Number(match[1]);
+  };
+  const values = [
+    counter("hits", "blob"),
+    counter("misses", "blob"),
+    counter("hits", "manifest"),
+    counter("misses", "manifest")
+  ];
+  const [blobHits, blobMisses, manifestHits, manifestMisses] = values;
+  if (blobHits === void 0 || blobHits === null || blobMisses === void 0 || blobMisses === null || manifestHits === void 0 || manifestHits === null || manifestMisses === void 0 || manifestMisses === null) {
+    return null;
+  }
+  return {
+    blobs: { hits: blobHits, misses: blobMisses },
+    manifests: { hits: manifestHits, misses: manifestMisses }
+  };
+};
+var diskWords = (disk, cap) => typeof disk === "string" ? `size not read: ${disk} \xB7 cap ${formatBytes(mirrorSizeBytes(cap))}` : `${formatBytes(disk.used)} cached of ${formatBytes(mirrorSizeBytes(cap))} \xB7 ${formatBytes(disk.free)} free on its disk`;
+var observedNpmMirrorLine = (mirrors, observed) => {
+  if (mirrors.npm === null)
+    return "npm mirror \xB7 off on this install \xB7 mend server setup --npm-mirror turns it on";
+  if (!observed.running)
+    return "npm mirror \xB7 container not running \xB7 sessions install from registry.npmjs.org directly";
+  const { traffic } = observed;
+  const seen = typeof traffic === "string" ? `traffic not read: ${traffic}` : traffic.tarballs === 0 ? "no tarball requests in its log for the last 24 h" : `last 24 h: ${traffic.tarballs} tarball requests \xB7 ${traffic.fromCache} served from the cache${percent(traffic.fromCache, traffic.tarballs)} \xB7 ${traffic.fromRegistry} fetched from registry.npmjs.org`;
+  return [
+    "npm mirror \xB7 running",
+    diskWords(observed.disk, mirrors.npm.maxSize),
+    seen,
+    "observed"
+  ].join(" \xB7 ");
+};
+var observedDockerMirrorLine = (mirrors, observed) => {
+  if (mirrors.docker === null)
+    return "docker mirror \xB7 off on this install \xB7 mend server setup --docker-mirror turns it on";
+  if (!observed.running)
+    return "docker mirror \xB7 container not running \xB7 session Docker daemons pull from Docker Hub directly";
+  const { disk, traffic } = observed;
+  if (typeof disk !== "string" && disk.guard?.state === "paused")
+    return [
+      "docker mirror \xB7 paused by its disk guard",
+      `${formatBytes(disk.guard.freeMiB * 1024 ** 2)} free on its disk, below ${formatBytes(disk.guard.floorMiB * 1024 ** 2)}`,
+      disk.guard.cache === "none" ? "no cache held" : disk.guard.cache === "kept" ? "its cache could not be cleared" : "the guard did not say whether its cache was cleared",
+      "session Docker daemons pull from Docker Hub directly until there is room",
+      "observed"
+    ].join(" \xB7 ");
+  const since = observed.startedAt === null ? "since it started" : `since ${observed.startedAt}`;
+  const seen = typeof traffic === "string" ? `traffic not read: ${traffic}` : `${since}: layers ${traffic.blobs.hits + traffic.blobs.misses} requested \xB7 ${traffic.blobs.hits} from the cache${percent(traffic.blobs.hits, traffic.blobs.hits + traffic.blobs.misses)} \xB7 manifests ${traffic.manifests.hits + traffic.manifests.misses} \xB7 ${traffic.manifests.hits} from the cache`;
+  const user = dockerMirrorLogin(mirrors.docker);
+  const login2 = user === void 0 ? "pulls from Docker Hub anonymously" : `pulls from Docker Hub as ${user}, with a token the operator declared Public Repo Read-only \xB7 every session can pull whatever that token can read`;
+  return [
+    "docker mirror \xB7 running",
+    diskWords(disk, mirrors.docker.maxSize),
+    "layers evicted 7 days after each fetch",
+    seen,
+    login2,
+    "observed"
+  ].join(" \xB7 ");
+};
+
 // src/server-edge.ts
 var EXPOSURES = ["loopback", "private", "public"];
 var TENANCIES = ["single", "multi"];
@@ -861,6 +1279,9 @@ var isTenancy = (value) => TENANCIES.some((tenancy) => tenancy === value);
 var EDGE_IMAGE = "caddy:2.10-alpine";
 var EDGE_COMPOSE_FILE = "compose.edge.yaml";
 var POSTURE_COMPOSE_FILE = "compose.posture.yaml";
+var DECLARABLE_ITEMS = ["core-private", "edge-tls", "workspace-ssh"];
+var isDeclarableItem = (value) => DECLARABLE_ITEMS.some((item) => item === value);
+var publishedAddress = (address, port) => `${net2.isIP(address) === 6 ? `[${address}]` : address}:${port}`;
 var parseEdgeHost = (value) => {
   const host = value.trim().toLowerCase().replace(/\.$/, "");
   const labels = host.split(".");
@@ -876,7 +1297,11 @@ var postureEnvironment = (posture) => {
     ...posture.exposure === void 0 ? [] : [["MEND_EXPOSURE", posture.exposure]],
     ...posture.tenancy === void 0 ? [] : [["MEND_TENANCY", posture.tenancy]],
     ...gate ? [["MEND_SOURCE_POLICY", "tenant"], ["MEND_CAPTURE_REQUIRE_SIZES", "true"]] : [],
-    ...posture.exposure === "public" ? [["MEND_URL_BEARERS", "refuse"]] : []
+    ...posture.exposure === "public" ? [["MEND_URL_BEARERS", "refuse"]] : [],
+    // The gate's workspace-ssh item reads where SSH is published apart from the web port; the
+    // container cannot see what its host publishes.
+    ...posture.sshBind === void 0 || posture.sshPort === void 0 ? [] : [["MEND_SSH_PUBLISHED", publishedAddress(posture.sshBind, posture.sshPort)]],
+    ...posture.declared === void 0 || posture.declared.length === 0 ? [] : [["MEND_EXPOSURE_DECLARED", posture.declared.join(",")]]
   ];
 };
 var postureEnvLines = (posture) => [
@@ -902,7 +1327,8 @@ var renderPostureOverlay = (posture) => {
 };
 var composeOverlays = (posture) => [
   ...posture.edgeHost === void 0 ? [] : [EDGE_COMPOSE_FILE],
-  ...renderPostureOverlay(posture) === void 0 ? [] : [POSTURE_COMPOSE_FILE]
+  ...renderPostureOverlay(posture) === void 0 ? [] : [POSTURE_COMPOSE_FILE],
+  ...runsMirrors(posture.mirrors) ? [MIRRORS_COMPOSE_FILE] : []
 ];
 var record = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? new Map(Object.entries(value)) : null;
 var healthPosture = (body) => {
@@ -927,7 +1353,11 @@ var healthPosture = (body) => {
 var declaredPostureLines = (posture) => [
   ...posture.edgeHost === void 0 ? [] : [`edge \xB7 ${posture.edgeHost} \xB7 ${EDGE_IMAGE} on 80 and 443 \xB7 Mend's own port on loopback`],
   `exposure \xB7 declared ${posture.exposure ?? "private"}${posture.exposure === void 0 ? " \xB7 the default, not set on this install" : ""}`,
-  `tenancy \xB7 declared ${posture.tenancy ?? "single"}${posture.tenancy === void 0 ? " \xB7 the default, not set on this install" : ""}`
+  `tenancy \xB7 declared ${posture.tenancy ?? "single"}${posture.tenancy === void 0 ? " \xB7 the default, not set on this install" : ""}`,
+  ...posture.sshBind === void 0 || posture.sshPort === void 0 ? [] : [
+    `workspace ssh \xB7 published on ${publishedAddress(posture.sshBind, posture.sshPort)} apart from the web port`
+  ],
+  ...posture.declared === void 0 || posture.declared.length === 0 ? [] : [`stated verified from outside \xB7 ${posture.declared.join(", ")}`]
 ];
 var observedEdgeLine = (host, observed) => [
   `edge \xB7 ${host}`,
@@ -1969,7 +2399,7 @@ var COMMANDS = [
       "The same worktree, record, and review as mend codex, with a command of your own in place of a harness. Everything after -- is the command.",
       "The command's output is printed as the record has it, and mend run exits with the command's exit code. It runs in a terminal, so stdout and stderr arrive together, on stdout. What Mend says itself goes to stderr, so out=$(mend run -- git log -1) holds the command's output and nothing else. Ctrl+C stops watching and puts the terminal back; the command keeps running, and mend logs and mend wait pick it up again. A signal exits 128 + its number: 130 for SIGINT (Ctrl+C), 129 for SIGHUP, 143 for SIGTERM. A second signal exits at once, and an exit waits at most 5 seconds for a reader that takes nothing, then says the output may be incomplete.",
       "Output this terminal could not be given in full (a read the server refused, a reader that went away) fails mend run with exit 1 even when the command succeeded, and the command's own code is said on stderr: a script never takes cut output for the whole of it.",
-      "The platform takes at most 64 words, none empty and none starting or ending with whitespace (a script that starts with a newline, for example). Such a command is refused before anything is created; trim the word and run it again.",
+      "The platform takes at most 64 words and 1 MiB, at most 131,071 bytes a word, a program with no leading or trailing whitespace, and no NUL byte. An argument may be empty, start with a newline or span lines. A command it would refuse is refused before anything is created.",
       "With --detach, mend run returns once the command runs. With --json, stdout carries one JSON object in place of the output: the session id, the process id, the worktree, the branch, and the process's status and exit code as last observed, which is how it ended without --detach (and with it, when the command ended first).",
       "Workspaces set PAGER=cat, so git log and friends print instead of waiting for a pager the image does not have. A project variable of the same name, or the pager in your own git config, wins."
     ],
@@ -1994,31 +2424,39 @@ var COMMANDS = [
     name: "logs",
     section: "sessions",
     summary: "print a session's recorded terminal output",
-    synopsis: ["[session] [--follow] [--from <sequence>] [--process <id>]"],
+    synopsis: [
+      "[session] [--follow] [--from <sequence>] [--process <id>]",
+      "[session] --service <name-or-id> [--follow] [--from <sequence>]"
+    ],
     description: [
       "Prints what the session's command (or agent) wrote to its terminal, as the record holds it, on stdout. Settled sessions count: the record outlives the process and the workspace. --follow keeps printing until the process ends. The record is printed as it is, nothing taken out: anyone who can read the project can read it, so what a command printed, a password included, reaches them too. A signal stops it and puts the terminal back, exiting 128 + its number: 130 for SIGINT (Ctrl+C), 129 for SIGHUP, 143 for SIGTERM.",
-      "<session> is the session id, a prefix of it, or the worktree's name. With none, the one live session is taken. --process reads another process of the session, a shell or a Service attempt, by a prefix of its id."
+      "<session> is the session id, a prefix of it, or the worktree's name. With none, the one live session is taken. --process reads another process of the session, a shell or a Service attempt, by a prefix of its id; a Service's id or name there reads the Service's current attempt.",
+      "--service reads a Service's current attempt, by the Service's id, its name or a prefix of its id, the ids mend service list prints. A full id names its Service before any name does. A name two Services carry is refused, with both ids listed; name one by its id, or name the session. A Service with no attempt (an adopted port, which Mend runs no process for) has nothing recorded, and mend logs says so and exits 1."
     ],
     options: [
       { flag: "--follow, -f", text: "keep printing until the process ends" },
       { flag: "--from <sequence>", text: "start at a record sequence. Default: 0" },
-      { flag: "--process <id>", text: "another process of the session, by a prefix of its id" }
+      { flag: "--process <id>", text: "another process of the session, by a prefix of its id" },
+      { flag: "--service <name-or-id>", text: "a Service's current attempt" }
+    ],
+    examples: [
+      { command: "mend logs 3f2a --follow", text: "" },
+      { command: "mend logs --service web --follow", text: "the Service web's output, live" }
     ],
-    examples: [{ command: "mend logs 3f2a --follow", text: "" }],
     see: ["run", "wait", "service logs"]
   },
   {
     name: "wait",
     section: "sessions",
     summary: "wait for a session's command to end",
-    synopsis: ["[session] [--timeout <seconds>] [--process <id>] [--json]"],
+    synopsis: ["[session] [--timeout <duration>] [--process <id>] [--json]"],
     description: [
       "Returns once the session's command (or agent) has ended, with its exit code: the code the platform reported, or 1 when it reported none. A command that already ended answers at once. While a launch or a resume is starting, the previous process's end does not count. --process waits for one process by its id, the processId mend run --json prints.",
-      "When --timeout passes first, mend wait exits 124, as timeout(1) does, and the command keeps running. Stopped by a signal, it exits 128 + its number (130 for Ctrl+C), and the command keeps running. The timeout covers everything: finding the session, every read and every retry. --json then prints the last state read, and nothing more is asked of the server.",
+      "A session that is still starting (its workspace building, its image pulling) is waited through: only its end counts. When --timeout passes first, mend wait exits 124, as timeout(1) does, and the command keeps running. A duration is seconds (90, 90s or .5), minutes (5m) or hours (1h); with none, mend wait waits as long as the command runs. Stopped by a signal, it exits 128 + its number (130 for Ctrl+C), and the command keeps running. The timeout covers everything: finding the session, every read and every retry. --json then prints the last state read, and nothing more is asked of the server.",
       "<session> is the session id, a prefix of it, or the worktree's name. With none, the one live session is taken."
     ],
     options: [
-      { flag: "--timeout <seconds>", text: "give up after this long; exit 124" },
+      { flag: "--timeout <duration>", text: "give up after this long (90, 90s, 5m, 1h); exit 124" },
       {
         flag: "--process <id>",
         text: "wait for this process of the session, by a prefix of its id"
@@ -2219,18 +2657,22 @@ var COMMANDS = [
     section: "services",
     summary: "start and supervise a server in the session's workspace",
     synopsis: [
-      "[session] --port <port> [--name <n>] [--udp] [--http|--https] [--wait] [--no-connect] -- <command...>",
-      "[session] <name> [--wait] [--no-connect]"
+      "[session] --port <port> [--name <n>] [--udp] [--http|--https] [--wait [--timeout <duration>]] [--no-connect] -- <command...>",
+      "[session] <name> [--wait [--timeout <duration>]] [--no-connect]"
     ],
     description: [
       "With --, the command after it is started in the workspace and supervised: its output is recorded, and mend service restart re-runs it. Without --, the name is a Service declared in the worktree's mend.toml. mend service <name> is the shorthand for that.",
-      "Mend waits up to a minute for the port to answer before it returns. --wait makes the exit status say how that ended: 0 once the port answered, 1 when it did not, and 124 when the server gave no answer within 90 seconds. The Service keeps running in every case. A waited start returns and opens no tunnel; mend service connect reaches the port. UDP has no probe, and a recipe that declares only a port is adopted with one probe, so --wait takes neither.",
+      "Mend waits up to a minute for the port to answer before it returns. --wait keeps waiting while the Service is still starting (its process runs and its port has not answered yet: building, installing, booting), however long that takes, up to --timeout (default 10 minutes). Mend probes a started Service's port every 20 seconds, so the wait ends at the first probe that answers. The wait judges the one process this start began, by an id the start sends and the server stamps on it, whatever another client starts, restarts or stops meanwhile. The exit status says how it ended: 0 the port answered for that process; 1 Mend refused the start or could not be asked; 2 the process ended before its port answered (the line says its status and exit code; a process its workspace took reads exited, no exit code reported); 3 the server no longer has the session, its workspace gone with it; 124 the Service was still starting when the timeout passed, and it keeps starting. A server older than this CLI stamps no id: a start whose answer an edge cut is then not followed (1), and a command that exits inside the minute reads as the refusal it answers with (1). A waited start returns and opens no tunnel; mend service connect reaches the port. UDP has no probe, and a recipe that declares only a port is adopted with one probe, so --wait takes neither.",
       "The port is tunnelled to this machine's loopback as soon as it listens, unless --no-connect."
     ],
     options: [
       {
         flag: "--wait",
-        text: "exit 1 when the port did not answer, 124 with no answer in 90 s; no tunnel"
+        text: "return once the port answers: 0; process ended 2, session gone 3; no tunnel"
+      },
+      {
+        flag: "--timeout <duration>",
+        text: "bound --wait (90, 90s, 5m, 1h); still starting then exits 124. Default: 10m"
       },
       { flag: "--port <port>", text: "the port the command listens on inside the workspace" },
       { flag: "--name <n>", text: "the service's name. Default: the command" },
@@ -2240,9 +2682,13 @@ var COMMANDS = [
     ],
     examples: [
       { command: "mend service run --port 3000 -- pnpm dev", text: "" },
-      { command: "mend service web", text: "the Service named web in mend.toml" }
+      { command: "mend service web", text: "the Service named web in mend.toml" },
+      {
+        command: "mend service run web --wait --timeout 15m",
+        text: "returns once web answers; 124 if it is still starting after 15 minutes"
+      }
     ],
-    see: ["service init", "service connect", "service logs"]
+    see: ["service init", "service connect", "service logs", "logs"]
   },
   {
     name: "service add",
@@ -2275,9 +2721,13 @@ var COMMANDS = [
     name: "service list",
     section: "services",
     summary: "every live service and its observed state",
-    synopsis: [],
-    description: ["Name, session, port, whether it listens, and where it is reachable from here."],
-    see: ["service run", "service connect"]
+    synopsis: ["[--json]"],
+    description: [
+      "Name, observed state, port, the Service's id and its current attempt's process id, and where it is reachable from here. The process id is what mend logs --process and mend wait --process take; mend logs --service takes the Service's name or id. An adopted port has no process.",
+      "With --json, stdout carries one JSON object: version 1, and services, each with id, name, sessionId, processId (null for an adopted port), status as last observed, workspacePort, protocol (tcp or udp), and hostPort, authority and browserUrl (null when not bound)."
+    ],
+    options: [{ flag: "--json", text: "print the Services as JSON" }],
+    see: ["service run", "service connect", "logs"]
   },
   {
     name: "service logs",
@@ -2710,7 +3160,7 @@ var COMMANDS = [
     summary: "how this instance is exposed, as declared and as observed",
     synopsis: [],
     description: [
-      "Operator only. States MEND_EXPOSURE as declared (loopback, private or public) and one line per item of the public exposure gate, with how it was established: observed (this server read it), carried (this build contains it, and the server cannot see it in effect), declared (you stated it and the server cannot check it), or open. MEND_EXPOSURE=public refuses to start while an item the server can observe is open. Items it cannot observe say what would verify them; once you have verified core-private or edge-tls from outside, name it in MEND_EXPOSURE_DECLARED. The report is what was observed; it is not a statement that the instance is fit to expose."
+      "Operator only. States MEND_EXPOSURE as declared (loopback, private or public) and one line per item of the public exposure gate, with how it was established: observed (this server read it), carried (this build contains it, and the server cannot see it in effect), declared (you stated it and the server cannot check it), or open. MEND_EXPOSURE=public refuses to start while an item that blocks a start is open: every item the server can observe, and workspace-ssh until you declare it. Items it cannot observe say what would verify them; once you have verified core-private, edge-tls or workspace-ssh (SSH published apart from the web port) from outside, name it in MEND_EXPOSURE_DECLARED, or with mend server setup --declare. The report is what was observed; it is not a statement that the instance is fit to expose."
     ],
     see: ["operator gate", "doctor"]
   },
@@ -2796,13 +3246,14 @@ var COMMANDS = [
     section: "this machine",
     summary: "install or repair the local Mend server",
     synopsis: [
-      "[--context <name>] [--version <version|latest>] [--bind <ip>] [--url <origin>] [--origin <origin>...] [--port <n>] [--ssh-port <n>] [--edge <host> | --no-edge] [--exposure <loopback|private|public>] [--tenancy <single|multi>] [--docker-socket <path>] [--assets-dir <dir>] [--offline]"
+      "[--context <name>] [--version <version|latest>] [--bind <ip>] [--ssh-bind <ip>] [--url <origin>] [--origin <origin>...] [--port <n>] [--ssh-port <n>] [--edge <host> | --no-edge] [--exposure <loopback|private|public>] [--tenancy <single|multi>] [--declare <item>...] [--npm-mirror | --no-npm-mirror] [--npm-mirror-max-size <size>] [--docker-mirror | --no-docker-mirror] [--docker-mirror-max-size <size>] [--docker-hub-username <name> --docker-hub-token-stdin --docker-hub-public-only | --no-docker-hub-login] [--docker-socket <path>] [--assets-dir <dir>] [--offline]"
     ],
     description: [
       "Checks a local Unix-socket Docker context and the Compose plugin, downloads the compose and Postgres initialization assets for one Mend release, preserves existing data and secrets, and starts the server. Re-running repairs the same pinned version. A changed --version is refused; use mend server upgrade. Updating this CLI never updates an existing server pin.",
       "The default listens only on localhost at http://localhost:3105. Non-local access requires both --bind and --url. Every extra browser origin must be named with --origin; setup never guesses from the request Host header or network interfaces.",
       "--edge <host> runs a TLS edge in front of Mend: Caddy on ports 80 and 443 of every interface, which obtains and renews a certificate for the host and proxies to Mend's web tier. Mend's own port stays on loopback and the browser origin is https://<host>. The edge's compose overlay and Caddyfile are written into the generation beside compose.yaml, so start, restart and upgrade run them every time. --no-edge takes it away again, and the edge's container with it. A fresh install cannot start with the edge: until the first account exists, registration is open to whoever reaches the origin first, so set up on localhost, create the account, then add the edge.",
       "--exposure declares how the instance is reached, and --tenancy whether one organization or many use it. Both are written into the generation and kept across reruns and upgrades. public needs the edge and an existing first account. With multi, or with public, the multi mode gate's settings follow: MEND_SOURCE_POLICY=tenant and MEND_CAPTURE_REQUIRE_SIZES=true, and public sets MEND_URL_BEARERS=refuse. The server still decides whether it starts, and mend server status shows what it reports.",
+      "Two mirrors run beside Mend unless turned off: an npm mirror (nginx caching npmjs.org, capped at 10g by default, least recently used out) and a Docker mirror (a pull-through cache of Docker Hub, capped at 20g by default: over the cap its cache is cleared). Both leave 5g free on their disk: below that, nginx evicts and the Docker mirror pauses, and sessions pull from Docker Hub directly. Neither publishes a host port. Sessions install npm packages and pull Docker Hub images through them; a project's own npm settings win, and a mirror that is down sends sessions upstream instead. Both are kept across reruns and upgrades, and an upgrade adds them to an install from before them. The Docker mirror pulls anonymously unless given a Docker Hub login: --docker-hub-username with the access token piped on standard input, kept in server.env only. The mirror has no login of its own, so every session that reaches it can pull whatever that token can read: setup takes a login only with --docker-hub-public-only, your statement that the token's access permission is Public Repo Read-only. Mend cannot check a token's scope.",
       "Docker Desktop on Linux and macOS, and OrbStack on macOS, expose client-side proxy sockets. Containers use the daemon-side /var/run/docker.sock. --docker-socket overrides detection and is retained on reruns.",
       "Setup holds an exclusive process lock through startup and health checks. A busy lock reports its owner and manual recovery steps. Never remove a live lock. Private configuration uses immutable generations and an atomic active pointer; failed attempts retain credentials and never delete Docker volumes."
     ],
@@ -2816,6 +3267,10 @@ var COMMANDS = [
         text: "exact Mend server version, or latest; omitted keeps the current pin"
       },
       { flag: "--bind <ip>", text: "published listen address. Default: 127.0.0.1" },
+      {
+        flag: "--ssh-bind <ip>",
+        text: "where workspace SSH is published, when not on --bind; with --edge, Remote-SSH from another machine needs it. Kept across reruns; the --bind address takes it away"
+      },
       { flag: "--url <origin>", text: "advertised browser URL, required with a non-loopback bind" },
       {
         flag: "--origin <origin>",
@@ -2839,6 +3294,39 @@ var COMMANDS = [
         flag: "--tenancy <v>",
         text: "declare single or multi; kept across reruns and upgrades. multi also sets the multi mode gate's variables"
       },
+      {
+        flag: "--declare <item>",
+        text: "state a gate item you verified from outside: core-private, edge-tls or workspace-ssh; repeat for more, none clears. Kept across reruns. public with --ssh-bind beyond loopback needs workspace-ssh"
+      },
+      {
+        flag: "--npm-mirror, --no-npm-mirror",
+        text: "run or stop the npm mirror; kept across reruns and upgrades. Default: on"
+      },
+      {
+        flag: "--npm-mirror-max-size <size>",
+        text: "the npm mirror's disk cap, such as 20g or 1536m, at least 1g. Default: 10g"
+      },
+      {
+        flag: "--docker-mirror, --no-docker-mirror",
+        text: "run or stop the Docker Hub mirror; kept across reruns and upgrades. Default: on"
+      },
+      {
+        flag: "--docker-mirror-max-size <size>",
+        text: "the Docker mirror's cap, such as 40g; over it the cache is cleared and fills again. Default: 20g"
+      },
+      {
+        flag: "--docker-hub-username <name>",
+        text: "the Docker mirror pulls as this Docker Hub account; needs --docker-hub-token-stdin"
+      },
+      {
+        flag: "--docker-hub-token-stdin",
+        text: "read that account's access token from standard input; kept in server.env, never in argv or a session"
+      },
+      {
+        flag: "--docker-hub-public-only",
+        text: "required with a login: you state the token is scoped Public Repo Read-only, since every session can pull what it can read"
+      },
+      { flag: "--no-docker-hub-login", text: "the Docker mirror pulls anonymously again" },
       {
         flag: "--assets-dir <dir>",
         text: "copy compose.v2.yaml and postgres-init.sh from a release directory; fresh setup requires --version"
@@ -2859,6 +3347,10 @@ var COMMANDS = [
         command: "mend server setup --version 0.25.0 --assets-dir ./release-assets --offline",
         text: "install from local release assets and preloaded images"
       },
+      {
+        command: "mend server setup --edge mend.example.com --ssh-bind 0.0.0.0 --exposure public --declare workspace-ssh",
+        text: "the TLS edge for the browser and the API, and workspace SSH for Remote-SSH from other machines"
+      },
       {
         command: "mend server setup --edge mend.example.com",
         text: "a TLS edge for mend.example.com; its DNS points at this machine and 80 and 443 reach it"
@@ -2866,6 +3358,10 @@ var COMMANDS = [
       {
         command: "mend server setup --exposure public --tenancy multi",
         text: "on an install with an edge and a first account: declare public, many organizations"
+      },
+      {
+        command: 'printf %s "$DOCKER_HUB_TOKEN" | mend server setup --docker-hub-username mendbot --docker-hub-token-stdin --docker-hub-public-only',
+        text: "the Docker mirror pulls from Docker Hub as mendbot, with a Public Repo Read-only token"
       }
     ],
     see: ["server", "server status", "login", "doctor", "operator exposure"]
@@ -2873,10 +3369,11 @@ var COMMANDS = [
   {
     name: "server status",
     section: "this machine",
-    summary: "show the pin, generation, containers, edge and posture",
+    summary: "show the pin, generation, containers, edge, mirrors and posture",
     synopsis: [""],
     description: [
       "Reads the existing installation without changing its files. A running Mend must answer health with the exact pinned version. A stopped server makes no health claim. Never installs a server implicitly.",
+      "Each mirror the install runs follows, as observed: whether its container runs, what its cache holds, and its traffic. For the npm mirror, the tarball requests in its log for the last 24 hours and how many the cache served; for the Docker mirror, layer and manifest requests since it started and how many the cache served.",
       "Then the posture, declared beside observed. Declared is what this install's configuration says: the edge host, MEND_EXPOSURE and MEND_TENANCY, a default named as one. Observed is what was seen: whether the edge's container runs and whether Caddy's data holds a certificate for the host, and what the running server reports in its health, the exposure it runs with and how many public exposure gate items are open, the tenancy and which multi mode gate items are open. When this machine is signed in to the install as the operator, every item of both gates follows with its detail, as mend operator gate and mend operator exposure print them. None of it is a verdict: the report says what was declared and what was observed."
     ],
     see: ["server logs", "server start", "operator gate", "operator exposure"]
@@ -2895,7 +3392,7 @@ var COMMANDS = [
   {
     name: "server stop",
     section: "this machine",
-    summary: "stop Mend, Postgres, Garage and the edge without deleting data",
+    summary: "stop the server's containers without deleting data",
     synopsis: [""],
     description: [
       "Stops only the installation's Compose services, the edge among them when one is set. Connections are interrupted. Workspace containers and volumes remain, but active work may lose connectivity and need reconnection. No volume deletion or Docker prune is performed."
@@ -3424,7 +3921,7 @@ var writeBundle = (files, outPath, now) => {
     entries: entries.map((entry) => ({ path: entry.path, bytes: entry.content.length }))
   };
 };
-var formatBytes = (bytes) => {
+var formatBytes2 = (bytes) => {
   if (bytes < 1024) return `${bytes} B`;
   if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} kB`;
   return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
@@ -3433,8 +3930,8 @@ var NOTICE = "Contains logs and configuration; secrets are redacted, but read it
 var bundleReport = (written) => {
   const width = Math.max(...written.entries.map((entry) => entry.path.length), 0);
   return [
-    `${written.path} \xB7 ${formatBytes(written.bytes)}`,
-    ...written.entries.map((entry) => `  ${entry.path.padEnd(width)}  ${formatBytes(entry.bytes)}`),
+    `${written.path} \xB7 ${formatBytes2(written.bytes)}`,
+    ...written.entries.map((entry) => `  ${entry.path.padEnd(width)}  ${formatBytes2(entry.bytes)}`),
     NOTICE
   ];
 };
@@ -4256,7 +4753,7 @@ var gitAuthorLine = (author) => `${author.name} <${author.email}> \xB7 ${author.
 
 // src/http-client.ts
 import { Agent, setGlobalDispatcher } from "undici";
-var cliDispatcher = (connect2) => new Agent({ allowH2: false, ...connect2 === void 0 ? {} : { connect: connect2 } });
+var cliDispatcher = (connect3) => new Agent({ allowH2: false, ...connect3 === void 0 ? {} : { connect: connect3 } });
 var useHttp1 = () => {
   setGlobalDispatcher(cliDispatcher());
 };
@@ -4579,7 +5076,7 @@ var fetchedLines = (fetched) => {
   lines.push(`${dim("  switch to it")} git switch ${fetched.branch}`);
   return lines;
 };
-var formatBytes2 = (bytes) => {
+var formatBytes3 = (bytes) => {
   if (bytes < 1024) return `${bytes} bytes`;
   const units = ["KiB", "MiB", "GiB"];
   let value = bytes / 1024;
@@ -4612,7 +5109,7 @@ var bundleRefusal = (downloaded) => {
   const size = numberField(body, "size");
   const limit = numberField(body, "limit");
   if (downloaded.status === 413 && size !== null && limit !== null) {
-    return `bundle not sent \xB7 ${formatBytes2(size)} (${size} bytes) \xB7 the server's limit is ${formatBytes2(limit)} (MEND_BUDGET_BUNDLE_BYTES) \xB7 nothing was fetched`;
+    return `bundle not sent \xB7 ${formatBytes3(size)} (${size} bytes) \xB7 the server's limit is ${formatBytes3(limit)} (MEND_BUDGET_BUNDLE_BYTES) \xB7 nothing was fetched`;
   }
   return stringField2(body, "message") ?? `the bundle request answered ${downloaded.status}`;
 };
@@ -5241,13 +5738,13 @@ var renderExposure = (report) => {
   const mark = (item) => marks[item.established];
   const open = report.items.filter((item) => item.established === "open");
   const blocking = open.filter((item) => item.blocksStart).length;
-  const unobservable = open.length - blocking;
+  const notBlocking = open.length - blocking;
   return [
     `exposure \xB7 declared ${report.declared} \xB7 ${EXPOSURE_WORDS[report.declared]}`,
     ...report.items.map(
       (item) => `${mark(item)} ${item.id.padEnd(width)}  ${item.established.padEnd(8)}  ${item.detail}${item.fix === null ? "" : dim4(` \xB7 ${item.fix}`)}`
     ),
-    open.length === 0 ? "nothing open \xB7 every item was observed here, is carried by this build, or was declared by the operator" : `${open.length} of ${report.items.length} items open \xB7 ${blocking} this build can observe${blocking === 0 ? "" : "; MEND_EXPOSURE=public refuses to start"} \xB7 ${unobservable} it cannot`
+    open.length === 0 ? "nothing open \xB7 every item was observed here, is carried by this build, or was declared by the operator" : `${open.length} of ${report.items.length} items open \xB7 ${blocking} refuse a public start${blocking === 0 ? "" : "; MEND_EXPOSURE=public refuses to start"} \xB7 ${notBlocking} do not`
   ];
 };
 var renderOrganizations = (rows) => {
@@ -5644,21 +6141,39 @@ var piProfileLines = (scan) => {
 
 // src/run-scripts.ts
 var RUN_ARGV_MAX = 64;
+var RUN_ARGV_MAX_WORD_BYTES = 128 * 1024 - 1;
+var RUN_ARGV_MAX_TOTAL_BYTES = 1024 * 1024;
 var whitespaceName = (character) => character === "\n" || character === "\r" ? "a newline" : character === "	" ? "a tab" : character === " " ? "a space" : "whitespace";
+var LONE_SURROGATE = /[\uD800-\uDFFF]/u;
+var utf8Bytes = (value) => Buffer.byteLength(value, "utf8");
 var runArgvIssue = (argv) => {
   if (argv.length > RUN_ARGV_MAX) {
     return `the command has ${argv.length} words and the platform takes at most ${RUN_ARGV_MAX} \xB7 put them in a script and run that`;
   }
+  const program = argv[0] ?? "";
+  if (program === "") return "the program is empty";
+  if (program.trim() !== program) {
+    const leading = program.trimStart() !== program;
+    const edge = leading ? program.charAt(0) : program.charAt(program.length - 1);
+    return `the program ${leading ? "starts" : "ends"} with ${whitespaceName(edge)} \xB7 trim it and run again`;
+  }
+  let total = 0;
   for (const [index, word] of argv.entries()) {
     const which = index === 0 ? "the program" : `argument ${index}`;
-    if (word === "") {
-      return `${which} is empty \xB7 the platform refuses empty arguments`;
+    if (word.includes("\0")) {
+      return `${which} contains a NUL byte, which no process argument can carry`;
+    }
+    if (LONE_SURROGATE.test(word)) {
+      return `${which} is not well-formed Unicode (a lone surrogate)`;
     }
-    if (word.trim() !== word) {
-      const leading = word.trimStart() !== word;
-      const edge = leading ? word.charAt(0) : word.charAt(word.length - 1);
-      return `${which} ${leading ? "starts" : "ends"} with ${whitespaceName(edge)} \xB7 the platform refuses arguments with leading or trailing whitespace \xB7 trim it and run again`;
+    const bytes = utf8Bytes(word);
+    if (bytes > RUN_ARGV_MAX_WORD_BYTES) {
+      return `${which} is ${bytes} bytes and the platform takes at most ${RUN_ARGV_MAX_WORD_BYTES} a word \xB7 put it in a script and run that`;
     }
+    total += bytes;
+  }
+  if (total > RUN_ARGV_MAX_TOTAL_BYTES) {
+    return `the command is ${total} bytes and the platform takes at most ${RUN_ARGV_MAX_TOTAL_BYTES} \xB7 put it in a script and run that`;
   }
   return null;
 };
@@ -5811,16 +6326,22 @@ var splitArgs = (args, valued, switches) => {
   return { values, on, session };
 };
 var parseLogsArgs = (args) => {
-  const split = splitArgs(args, ["--from", "--process"], ["--follow", "-f"]);
+  const split = splitArgs(args, ["--from", "--process", "--service"], ["--follow", "-f"]);
   if ("error" in split) return split;
   const from = split.values.get("--from") ?? "0";
   if (!/^(0|[1-9]\d*)$/u.test(from)) return { error: "--from takes a record sequence, e.g. 0" };
+  const process2 = split.values.get("--process") ?? null;
+  const service = split.values.get("--service") ?? null;
+  if (process2 !== null && service !== null) {
+    return { error: "--process and --service each name one process; pass one of them" };
+  }
   return {
     args: {
       session: split.session,
       follow: split.on.has("--follow") || split.on.has("-f"),
       from,
-      process: split.values.get("--process") ?? null
+      process: process2,
+      service
     }
   };
 };
@@ -5828,21 +6349,149 @@ var parseWaitArgs = (args) => {
   const split = splitArgs(args, ["--timeout", "--process"], ["--json"]);
   if ("error" in split) return split;
   const timeout = split.values.get("--timeout");
-  const seconds2 = timeout === void 0 ? null : Number(timeout);
-  if (seconds2 !== null && !(Number.isFinite(seconds2) && seconds2 > 0)) {
-    return { error: "--timeout takes a number of seconds above 0" };
-  }
+  const timeoutMs = timeout === void 0 ? null : parseDuration(timeout);
+  if (timeoutMs === null && timeout !== void 0) return { error: DURATION_ISSUE };
   return {
     args: {
       session: split.session,
       process: split.values.get("--process") ?? null,
-      timeoutMs: seconds2 === null ? null : Math.ceil(seconds2 * 1e3),
+      timeoutMs,
       json: split.on.has("--json")
     }
   };
 };
+var DURATION_UNIT_MS = { s: 1e3, m: 6e4, h: 36e5 };
+var parseDuration = (text) => {
+  const trimmed = text.trim();
+  const unit = DURATION_UNIT_MS[trimmed.slice(-1)];
+  const amount = unit === void 0 ? trimmed === "" ? Number.NaN : Number(trimmed) : /^(?:\d+\.?\d*|\.\d+)$/u.test(trimmed.slice(0, -1)) ? Number(trimmed.slice(0, -1)) : Number.NaN;
+  const ms = Math.ceil(amount * (unit ?? 1e3));
+  return Number.isFinite(ms) && ms > 0 ? ms : null;
+};
+var DURATION_ISSUE = "--timeout takes a duration above 0: 90 or 90s, 5m, 1h";
+var durationLine = (ms) => {
+  const seconds2 = Math.round(ms / 1e3);
+  if (seconds2 < 60) return `${seconds2} s`;
+  const minutes = Math.floor(seconds2 / 60);
+  const rest = seconds2 % 60;
+  if (minutes < 60) return rest === 0 ? `${minutes} min` : `${minutes} min ${rest} s`;
+  const hours = Math.floor(minutes / 60);
+  return minutes % 60 === 0 ? `${hours} h` : `${hours} h ${minutes % 60} min`;
+};
 var WAIT_TIMED_OUT = 124;
 var isSessionId = (word) => /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu.test(word);
+var SERVICE_PROCESS_ENDED = 2;
+var SERVICE_WORKSPACE_ENDED = 3;
+var begunBy = (view, attempt2, startId) => attempt2.launchCorrelationId === serviceStartCorrelation(view.service.id, startId);
+var findStartAttempt = (services, target) => {
+  for (const view of services) {
+    if (view.service.sessionId !== target.sessionId) continue;
+    const attempt2 = view.attempts.find(
+      (candidate) => target.attemptId !== null ? candidate.id === target.attemptId : begunBy(view, candidate, target.startId)
+    );
+    if (attempt2 !== void 0) return { view, attempt: attempt2 };
+  }
+  return void 0;
+};
+var STAMP_KIND = serviceStartCorrelation("", "").split(":")[0] ?? "service-start";
+var answeredAttemptId = (view, startId) => {
+  const own = view.attempts.find((attempt2) => begunBy(view, attempt2, startId));
+  if (own !== void 0) return own.id;
+  const stamps = view.attempts.some(
+    (attempt2) => attempt2.launchCorrelationId?.startsWith(`${STAMP_KIND}:`) === true
+  );
+  return stamps ? null : view.service.currentAttemptId;
+};
+var timeOf = (iso) => {
+  if (iso === void 0) return null;
+  const at = Date.parse(iso);
+  return Number.isFinite(at) ? at : null;
+};
+var answeredFor = (view, attempt2) => {
+  const observation = view.latestObservation;
+  if (view.service.currentAttemptId !== attempt2.id || view.currentForward === null) return false;
+  if (observation === null || observation.forwardId !== view.currentForward.id) return false;
+  if (observation.state !== "reachable") return false;
+  const began = timeOf(attempt2.createdAt);
+  const observed = timeOf(observation.lastObservedAt);
+  return began === null || observed === null || observed >= began;
+};
+var serviceStartStateOf = (read, target) => {
+  const found = findStartAttempt(read.services, target);
+  if (found !== void 0 && found.attempt.exitedAt !== null) {
+    return {
+      kind: "process-ended",
+      processId: found.attempt.id,
+      status: found.attempt.status,
+      exitCode: found.attempt.exitCode ?? null
+    };
+  }
+  if (read.sessionStatus === null) return { kind: "workspace-ended", sessionStatus: null };
+  if (found === void 0) return { kind: "starting", processId: target.attemptId };
+  return answeredFor(found.view, found.attempt) ? { kind: "answered", processId: found.attempt.id, view: found.view } : { kind: "starting", processId: found.attempt.id };
+};
+var waitForServiceStart = async (options) => {
+  const pollMs = options.pollMs ?? 2e3;
+  const discoverWithinMs = options.unreachableAfterMs ?? 6e4;
+  const since = options.now();
+  let target = options.target;
+  let last = null;
+  for (; ; ) {
+    const got = await readThrough(options.read, options, options.deadline);
+    if (!got.done) return { kind: "timeout", last };
+    const state = serviceStartStateOf(got.value, target);
+    if (state.kind !== "starting") return state;
+    last = state;
+    if (state.processId === null) {
+      if (options.now() - since >= discoverWithinMs) return { kind: "no-attempt" };
+    } else if (target.attemptId === null) {
+      target = { ...target, attemptId: state.processId };
+    }
+    options.onStarting?.(state);
+    const left = options.deadline === null ? pollMs : Math.min(pollMs, options.deadline - options.now());
+    if (left <= 0) return { kind: "timeout", last };
+    await options.sleep(left);
+  }
+};
+var readWithin = (read, clock2, deadline) => readThrough(read, clock2, deadline);
+var candidateLine = (view) => `${view.service.id} (session ${view.service.sessionId.slice(0, 8)})`;
+var pickServiceAttempt = (services, needle, sessionId) => {
+  const inScope = services.filter(
+    (view) => sessionId === null || view.service.sessionId === sessionId
+  );
+  const byId = inScope.filter((view) => view.service.id === needle);
+  const byName = inScope.filter((view) => view.service.name === needle);
+  const matches = byId.length > 0 ? byId : byName.length > 0 ? byName : inScope.filter((view) => view.service.id.startsWith(needle));
+  const [chosen] = matches;
+  if (chosen === void 0) {
+    return {
+      error: `no Service ${sessionId === null ? "" : "of this session "}is named "${needle}" or has an id starting with it`,
+      named: false
+    };
+  }
+  if (matches.length > 1) {
+    return {
+      error: `"${needle}" names ${matches.length} Services \xB7 name one by its id: ${matches.map(candidateLine).join(", ")}`,
+      named: true
+    };
+  }
+  const name = chosen.service.name;
+  const attemptId = chosen.service.currentAttemptId;
+  if (attemptId === null) {
+    return {
+      error: `Service ${name} has no attempt yet: Mend has run no process for it, so nothing is recorded (an adopted port has none; mend service run starts one)`,
+      named: true
+    };
+  }
+  const attempt2 = chosen.attempts.find((candidate) => candidate.id === attemptId);
+  if (attempt2 === void 0 || attempt2.sealantSessionId === null) {
+    return {
+      error: `Service ${name}'s attempt ${attemptId.slice(0, 8)} has not opened its terminal yet, so nothing is recorded \xB7 try again in a moment`,
+      named: true
+    };
+  }
+  return { service: chosen, processId: attemptId };
+};
 
 // src/secret-files.ts
 import * as path14 from "node:path";
@@ -6148,7 +6797,14 @@ var writeDurable = (file, content, mode = 384) => {
   }
 };
 var fileKeys = ["identity", "config", "env", "compose", "postgresInit"];
-var optionalFileKeys = ["posture", "edge", "caddyfile"];
+var optionalFileKeys = [
+  "posture",
+  "edge",
+  "caddyfile",
+  "mirrors",
+  "npmMirrorConf",
+  "dockerMirrorGuard"
+];
 var fileNames = {
   identity: "identity.env",
   config: "server.json",
@@ -6157,7 +6813,10 @@ var fileNames = {
   postgresInit: "postgres-init.sh",
   posture: "compose.posture.yaml",
   edge: "compose.edge.yaml",
-  caddyfile: "Caddyfile"
+  caddyfile: "Caddyfile",
+  mirrors: "compose.mirrors.yaml",
+  npmMirrorConf: "npm-mirror.conf",
+  dockerMirrorGuard: "docker-mirror-guard.sh"
 };
 var fileModes = {
   identity: 384,
@@ -6167,7 +6826,10 @@ var fileModes = {
   postgresInit: 493,
   posture: 384,
   edge: 384,
-  caddyfile: 420
+  caddyfile: 420,
+  mirrors: 384,
+  npmMirrorConf: 420,
+  dockerMirrorGuard: 420
 };
 var allFiles = (files) => [...fileKeys, ...optionalFileKeys].map((key) => [key, files[key]]);
 var parseLockOwner = (raw) => {
@@ -6271,6 +6933,9 @@ var readActive = (paths) => {
   const posture = optional("posture");
   const edge = optional("edge");
   const caddyfile = optional("caddyfile");
+  const mirrors = optional("mirrors");
+  const npmMirrorConf = optional("npmMirrorConf");
+  const dockerMirrorGuard = optional("dockerMirrorGuard");
   const files = {
     identity: fs14.readFileSync(path15.join(directory, fileNames.identity), "utf8"),
     config: fs14.readFileSync(path15.join(directory, fileNames.config), "utf8"),
@@ -6279,7 +6944,10 @@ var readActive = (paths) => {
     postgresInit: fs14.readFileSync(path15.join(directory, fileNames.postgresInit), "utf8"),
     ...posture === void 0 ? {} : { posture },
     ...edge === void 0 ? {} : { edge },
-    ...caddyfile === void 0 ? {} : { caddyfile }
+    ...caddyfile === void 0 ? {} : { caddyfile },
+    ...mirrors === void 0 ? {} : { mirrors },
+    ...npmMirrorConf === void 0 ? {} : { npmMirrorConf },
+    ...dockerMirrorGuard === void 0 ? {} : { dockerMirrorGuard }
   };
   if (readIdentity(paths) !== files.identity) {
     throw new ServerStoreError(
@@ -6817,6 +7485,7 @@ var SETUP_FLAGS = /* @__PURE__ */ new Set([
   "--context",
   "--version",
   "--bind",
+  "--ssh-bind",
   "--url",
   "--origin",
   "--port",
@@ -6827,7 +7496,29 @@ var SETUP_FLAGS = /* @__PURE__ */ new Set([
   "--edge",
   "--no-edge",
   "--exposure",
-  "--tenancy"
+  "--tenancy",
+  "--declare",
+  "--npm-mirror",
+  "--no-npm-mirror",
+  "--npm-mirror-max-size",
+  "--docker-mirror",
+  "--no-docker-mirror",
+  "--docker-mirror-max-size",
+  "--docker-hub-username",
+  "--docker-hub-token-stdin",
+  "--docker-hub-public-only",
+  "--no-docker-hub-login"
+]);
+var SWITCHES = /* @__PURE__ */ new Set([
+  "--offline",
+  "--no-edge",
+  "--npm-mirror",
+  "--no-npm-mirror",
+  "--docker-mirror",
+  "--no-docker-mirror",
+  "--docker-hub-token-stdin",
+  "--docker-hub-public-only",
+  "--no-docker-hub-login"
 ]);
 var parseExposure = (value) => {
   if (!isExposure(value))
@@ -6839,6 +7530,21 @@ var parseTenancy = (value) => {
     throw setupError(`--tenancy must be one of ${TENANCIES.join(", ")}, not "${value}".`);
   return value;
 };
+var parseDeclared = (values) => {
+  if (values.length === 1 && values[0] === "none") return [];
+  return [
+    ...new Set(
+      values.map((value) => {
+        if (!isDeclarableItem(value)) {
+          throw setupError(
+            `--declare takes ${DECLARABLE_ITEMS.join(", ")} or none, not "${value}". Every other gate item is observed by the server, never stated.`
+          );
+        }
+        return value;
+      })
+    )
+  ];
+};
 var parseEdge = (value) => {
   const host = parseEdgeHost(value);
   if (host === null) {
@@ -6855,7 +7561,7 @@ var parseSetupOptions = (args) => {
     if (flag === void 0) continue;
     if (!flag.startsWith("--")) throw setupError(`Unexpected server setup argument "${flag}".`);
     if (!SETUP_FLAGS.has(flag)) throw setupError(`Unknown server setup option "${flag}".`);
-    if (flag === "--offline" || flag === "--no-edge") {
+    if (SWITCHES.has(flag)) {
       if (values.has(flag)) throw setupError(`${flag} may be supplied only once.`);
       values.set(flag, ["true"]);
       continue;
@@ -6863,7 +7569,7 @@ var parseSetupOptions = (args) => {
     const [value, valueIndex] = nextFlagValue(args, index, flag);
     index = valueIndex;
     const previous = values.get(flag) ?? [];
-    if (flag !== "--origin" && previous.length > 0) {
+    if (flag !== "--origin" && flag !== "--declare" && previous.length > 0) {
       throw setupError(`${flag} may be supplied only once.`);
     }
     previous.push(value);
@@ -6877,12 +7583,59 @@ var parseSetupOptions = (args) => {
   const edge = flagValue3("--edge");
   const exposure = flagValue3("--exposure");
   const tenancy = flagValue3("--tenancy");
+  const declared = values.get("--declare");
   if (edge !== void 0 && values.has("--no-edge"))
     throw setupError("--edge and --no-edge contradict each other.");
+  const pair = (on, off) => {
+    if (values.has(on) && values.has(off))
+      throw setupError(`${on} and ${off} contradict each other.`);
+    return values.has(on) ? true : values.has(off) ? false : void 0;
+  };
+  const npmMirror = pair("--npm-mirror", "--no-npm-mirror");
+  const dockerMirror = pair("--docker-mirror", "--no-docker-mirror");
+  const maxSize = flagValue3("--npm-mirror-max-size");
+  const npmMirrorMaxSize = maxSize === void 0 ? void 0 : parseMirrorSize(maxSize);
+  if (npmMirrorMaxSize === null)
+    throw setupError(
+      `--npm-mirror-max-size must be a whole number of gibibytes or mebibytes, at least 1g, such as 20g or 1536m, not "${maxSize ?? ""}".`
+    );
+  if (npmMirrorMaxSize !== void 0 && npmMirror === false)
+    throw setupError("--npm-mirror-max-size and --no-npm-mirror contradict each other.");
+  const dockerMaxSize = flagValue3("--docker-mirror-max-size");
+  const dockerMirrorMaxSize = dockerMaxSize === void 0 ? void 0 : parseMirrorSize(dockerMaxSize);
+  if (dockerMirrorMaxSize === null)
+    throw setupError(
+      `--docker-mirror-max-size must be a whole number of gibibytes or mebibytes, at least 1g, such as 40g, not "${dockerMaxSize ?? ""}".`
+    );
+  if (dockerMirrorMaxSize !== void 0 && dockerMirror === false)
+    throw setupError("--docker-mirror-max-size and --no-docker-mirror contradict each other.");
+  const dockerHubUsername = flagValue3("--docker-hub-username");
+  const dockerHubTokenStdin = values.has("--docker-hub-token-stdin");
+  const noDockerHubLogin = values.has("--no-docker-hub-login");
+  if (dockerHubUsername === void 0 !== !dockerHubTokenStdin)
+    throw setupError(
+      "--docker-hub-username and --docker-hub-token-stdin go together: the user name, and the access token on standard input."
+    );
+  if (dockerHubUsername !== void 0 && !isDockerHubCredential(dockerHubUsername))
+    throw setupError(`--docker-hub-username "${dockerHubUsername}" is not a Docker Hub user name.`);
+  const dockerHubPublicOnly = values.has("--docker-hub-public-only");
+  if (dockerHubPublicOnly && dockerHubUsername === void 0)
+    throw setupError(
+      "--docker-hub-public-only goes with --docker-hub-username and --docker-hub-token-stdin: it states what the token you give can read."
+    );
+  if (dockerHubUsername !== void 0 && !dockerHubPublicOnly)
+    throw setupError(
+      `A Docker Hub login needs --docker-hub-public-only. The Docker mirror has no login of its own: every session that reaches it can pull whatever the token can read, private repositories included. Create a Docker Hub personal access token with the access permission "Public Repo Read-only", pipe it on standard input, and add --docker-hub-public-only to state that it is one. Mend cannot check a token's scope.`
+    );
+  if (dockerHubUsername !== void 0 && (noDockerHubLogin || dockerMirror === false))
+    throw setupError(
+      `--docker-hub-username and ${noDockerHubLogin ? "--no-docker-hub-login" : "--no-docker-mirror"} contradict each other.`
+    );
   return {
     context: flagValue3("--context"),
     version: version === void 0 ? void 0 : parseVersion(version),
     bind: flagValue3("--bind"),
+    sshBind: flagValue3("--ssh-bind"),
     url: flagValue3("--url"),
     origins: origins === void 0 ? void 0 : origins,
     appPort: appPort === void 0 ? void 0 : parsePort(appPort, "--port"),
@@ -6893,9 +7646,61 @@ var parseSetupOptions = (args) => {
     edge: edge === void 0 ? void 0 : parseEdge(edge),
     noEdge: values.has("--no-edge"),
     exposure: exposure === void 0 ? void 0 : parseExposure(exposure),
-    tenancy: tenancy === void 0 ? void 0 : parseTenancy(tenancy)
+    tenancy: tenancy === void 0 ? void 0 : parseTenancy(tenancy),
+    declared: declared === void 0 ? void 0 : parseDeclared(declared),
+    npmMirror,
+    npmMirrorMaxSize,
+    dockerMirror,
+    dockerMirrorMaxSize,
+    dockerHubUsername,
+    dockerHubTokenStdin,
+    noDockerHubLogin
+  };
+};
+var resolveMirrors = (saved, options) => {
+  const base = saved ?? DEFAULT_MIRRORS;
+  const npmOn = options.npmMirror ?? (options.npmMirrorMaxSize !== void 0 || base.npm !== null);
+  const dockerOn = options.dockerMirror ?? (options.dockerHubUsername !== void 0 || options.dockerMirrorMaxSize !== void 0 || base.docker !== null);
+  const upstreamUser = options.dockerHubUsername ?? (options.noDockerHubLogin ? void 0 : dockerMirrorLogin(base.docker));
+  const dockerMaxSize = options.dockerMirrorMaxSize ?? base.docker?.maxSize ?? DEFAULT_DOCKER_MIRROR_MAX_SIZE;
+  return {
+    npm: npmOn ? {
+      maxSize: options.npmMirrorMaxSize ?? base.npm?.maxSize ?? DEFAULT_NPM_MIRROR_MAX_SIZE
+    } : null,
+    docker: !dockerOn ? null : upstreamUser === void 0 ? { maxSize: dockerMaxSize } : { maxSize: dockerMaxSize, upstreamUser, upstreamPublicOnly: true }
   };
 };
+var parseMirrorsField = (value) => {
+  const fields = ownFields(value);
+  const corrupt = () => setupError(
+    "Server config is corrupt: mirrors must hold npm and docker, each an object or null."
+  );
+  if (fields === null || !fields.has("npm") || !fields.has("docker")) throw corrupt();
+  const npm = fields.get("npm");
+  const docker2 = fields.get("docker");
+  let parsedNpm = null;
+  if (npm !== null) {
+    const maxSize = ownFields(npm)?.get("maxSize");
+    if (typeof maxSize !== "string" || parseMirrorSize(maxSize) !== maxSize) throw corrupt();
+    parsedNpm = { maxSize };
+  }
+  let parsedDocker = null;
+  if (docker2 !== null) {
+    const dockerFields = ownFields(docker2);
+    if (dockerFields === null) throw corrupt();
+    const maxSize = dockerFields.get("maxSize");
+    if (typeof maxSize !== "string" || parseMirrorSize(maxSize) !== maxSize) throw corrupt();
+    const user = dockerFields.get("upstreamUser");
+    if (user !== void 0 && (typeof user !== "string" || !isDockerHubCredential(user)))
+      throw corrupt();
+    if (user !== void 0 && dockerFields.get("upstreamPublicOnly") !== true)
+      throw setupError(
+        "Server config is corrupt: the Docker mirror's login lacks upstreamPublicOnly. Run mend server setup with --docker-hub-public-only and a Public Repo Read-only token, or --no-docker-hub-login."
+      );
+    parsedDocker = user === void 0 ? { maxSize } : { maxSize, upstreamUser: user, upstreamPublicOnly: true };
+  }
+  return { npm: parsedNpm, docker: parsedDocker };
+};
 var parseUrl = (input, label) => {
   try {
     return new URL(input);
@@ -6927,9 +7732,13 @@ var resolveAppUrl = (existing, options, appPort, edgeHost) => {
     }
     return origin;
   }
-  const oldLocalUrl = existing === null ? null : `http://localhost:${existing.appPort}`;
-  const portChangedOnLocalhost = options.appPort !== void 0 && existing?.appUrl === oldLocalUrl;
-  const fallback = portChangedOnLocalhost || existing?.edgeHost !== void 0 ? `http://localhost:${appPort}` : existing?.appUrl ?? `http://localhost:${appPort}`;
+  if (existing?.edgeHost !== void 0) {
+    return parseHttpOrigin(options.url ?? `http://localhost:${appPort}`, "--url");
+  }
+  const saved = existing === null ? null : new URL(existing.appUrl);
+  const savedPointsAtOldPort = saved !== null && existing !== null && options.appPort !== void 0 && saved.protocol === "http:" && saved.port !== "" && Number(saved.port) === existing.appPort;
+  if (saved !== null && savedPointsAtOldPort) saved.port = String(appPort);
+  const fallback = saved === null ? `http://localhost:${appPort}` : saved.origin;
   return parseHttpOrigin(options.url ?? fallback, "--url");
 };
 var checkExposurePair = (bind, appUrl, requireExplicitUrl) => {
@@ -6944,7 +7753,7 @@ var checkExposurePair = (bind, appUrl, requireExplicitUrl) => {
     );
   }
 };
-var checkPosture = (bind, ports, edgeHost, exposure) => {
+var checkPosture = (bind, sshBind, ports, edgeHost, exposure, declared) => {
   if (edgeHost !== void 0 && [ports.appPort, ports.sshPort].some((p) => p === 80 || p === 443)) {
     throw setupError(
       "With an edge, --port and --ssh-port must not be 80 or 443: the edge publishes both on every interface."
@@ -6965,6 +7774,16 @@ var checkPosture = (bind, ports, edgeHost, exposure) => {
       "--exposure loopback contradicts a non-loopback --bind: the port is published beyond this machine."
     );
   }
+  if (exposure === "loopback" && !isLoopbackBind(sshBind)) {
+    throw setupError(
+      "--exposure loopback contradicts a non-loopback --ssh-bind: the SSH port is published beyond this machine."
+    );
+  }
+  if (exposure === "public" && !isLoopbackBind(sshBind) && !declared.includes("workspace-ssh")) {
+    throw setupError(
+      `--exposure public with workspace SSH published on ${publishedAddress(sshBind, ports.sshPort)} beside the edge needs a statement Mend cannot observe: who reaches that port. Check it from each network that should not reach it, then add --declare workspace-ssh; or publish SSH on loopback.`
+    );
+  }
   if (exposure === "public" && edgeHost === void 0) {
     throw setupError(
       "--exposure public needs the edge: add --edge <host>. Without it nothing sets MEND_TRUSTED_PROXIES or an https origin, and the server refuses to start as public."
@@ -6983,10 +7802,18 @@ var validateExposure = (existing, options) => {
       "--bind must be a literal IPv4 or IPv6 address, such as 127.0.0.1 or 0.0.0.0."
     );
   }
+  const requestedSshBind = options.sshBind ?? existing?.sshBind;
+  if (requestedSshBind !== void 0 && net3.isIP(requestedSshBind) === 0) {
+    throw setupError(
+      "--ssh-bind must be a literal IPv4 or IPv6 address, such as 127.0.0.1 or 0.0.0.0."
+    );
+  }
+  const sshBind = requestedSshBind === bind ? void 0 : requestedSshBind;
   const edgeHost = options.noEdge ? void 0 : options.edge ?? existing?.edgeHost;
   const exposure = options.exposure ?? existing?.exposure;
   const tenancy = options.tenancy ?? existing?.tenancy;
-  checkPosture(bind, { appPort, sshPort }, edgeHost, exposure);
+  const declared = options.declared ?? existing?.declared ?? [];
+  checkPosture(bind, sshBind ?? bind, { appPort, sshPort }, edgeHost, exposure, declared);
   const appUrl = resolveAppUrl(existing, options, appPort, edgeHost);
   if (edgeHost === void 0)
     checkExposurePair(bind, appUrl, options.url === void 0 && existing === null);
@@ -6997,13 +7824,15 @@ var validateExposure = (existing, options) => {
   ];
   return {
     bind,
+    ...sshBind === void 0 ? {} : { sshBind },
     appUrl,
     allowedOrigins,
     appPort,
     sshPort,
     ...edgeHost === void 0 ? {} : { edgeHost },
     ...exposure === void 0 ? {} : { exposure },
-    ...tenancy === void 0 ? {} : { tenancy }
+    ...tenancy === void 0 ? {} : { tenancy },
+    ...declared.length === 0 ? {} : { declared }
   };
 };
 var parseServerConfig = (raw) => {
@@ -7042,6 +7871,13 @@ var parseServerConfig = (raw) => {
   if (tenancy !== void 0 && !isTenancy(tenancy)) {
     throw setupError(`Server config is corrupt: tenancy must be one of ${TENANCIES.join(", ")}.`);
   }
+  const declaredField = fields.get("declared");
+  if (declaredField !== void 0 && (!Array.isArray(declaredField) || !declaredField.every((item) => typeof item === "string" && isDeclarableItem(item)))) {
+    throw setupError(
+      `Server config is corrupt: declared must be an array of ${DECLARABLE_ITEMS.join(", ")}.`
+    );
+  }
+  const declared = Array.isArray(declaredField) ? declaredField.filter((item) => isDeclarableItem(String(item))) : [];
   const config = {
     schemaVersion: requiredInteger(fields, "schemaVersion"),
     assetContract: requiredString(fields, "assetContract"),
@@ -7051,6 +7887,7 @@ var parseServerConfig = (raw) => {
     dockerSocket: parseDockerSocketPath(requiredString(fields, "dockerSocket")),
     dockerSocketSource,
     bind: requiredString(fields, "bind"),
+    ...fields.has("sshBind") ? { sshBind: requiredString(fields, "sshBind") } : {},
     appUrl: parseHttpOrigin(requiredString(fields, "appUrl"), "Server config appUrl"),
     allowedOrigins: origins.map(
       (origin) => parseHttpOrigin(origin, "Server config allowedOrigins")
@@ -7061,7 +7898,9 @@ var parseServerConfig = (raw) => {
     ...fields.has("bucket") ? { bucket: requiredBucket(fields) } : {},
     ...edgeHost === void 0 ? {} : { edgeHost },
     ...exposure === void 0 ? {} : { exposure },
-    ...tenancy === void 0 ? {} : { tenancy }
+    ...tenancy === void 0 ? {} : { tenancy },
+    ...declared.length === 0 ? {} : { declared },
+    ...fields.has("mirrors") ? { mirrors: parseMirrorsField(fields.get("mirrors")) } : {}
   };
   if (config.schemaVersion !== CONFIG_SCHEMA_VERSION || config.assetContract !== ASSET_CONTRACT && !LEGACY_ASSET_CONTRACTS.has(config.assetContract)) {
     throw setupError(
@@ -7076,6 +7915,7 @@ var parseServerConfig = (raw) => {
     context: void 0,
     version: void 0,
     bind: config.bind,
+    sshBind: config.sshBind,
     url: config.appUrl,
     origins: config.allowedOrigins,
     appPort: config.appPort,
@@ -7086,7 +7926,15 @@ var parseServerConfig = (raw) => {
     edge: config.edgeHost,
     noEdge: false,
     exposure: config.exposure,
-    tenancy: config.tenancy
+    tenancy: config.tenancy,
+    declared: config.declared,
+    npmMirror: void 0,
+    npmMirrorMaxSize: void 0,
+    dockerMirror: void 0,
+    dockerMirrorMaxSize: void 0,
+    dockerHubUsername: void 0,
+    dockerHubTokenStdin: false,
+    noDockerHubLogin: false
   });
   return config;
 };
@@ -7117,8 +7965,12 @@ var parseSecrets = (raw) => {
     betterAuthSecret: envValue(fields, "BETTER_AUTH_SECRET"),
     sealantCredentialsKey: envValue(fields, "SEALANT_CREDENTIALS_KEY"),
     sealantServiceKey: envValue(fields, "SEALANT_SERVICE_KEY"),
-    workspaceSshGatewayToken: envValue(fields, "WORKSPACE_SSH_GATEWAY_TOKEN")
+    workspaceSshGatewayToken: envValue(fields, "WORKSPACE_SSH_GATEWAY_TOKEN"),
+    ...fields.has("MEND_DOCKER_HUB_TOKEN") ? { dockerHubToken: envValue(fields, "MEND_DOCKER_HUB_TOKEN") } : {}
   };
+  if (secrets.dockerHubToken !== void 0 && !isDockerHubCredential(secrets.dockerHubToken)) {
+    throw setupError("Server secrets are corrupt: MEND_DOCKER_HUB_TOKEN has an invalid value.");
+  }
   if (!/^slt_svc_[0-9a-f]{64}$/.test(secrets.sealantServiceKey)) {
     throw setupError("Server secrets are corrupt: SEALANT_SERVICE_KEY has an invalid value.");
   }
@@ -7423,9 +8275,10 @@ var renderGarage = (secrets, config) => {
   ];
 };
 var namespaceOf = (config) => config.bucket === "garage" ? MEND_DOCKER_NAMESPACE_WITH_GARAGE : MEND_DOCKER_NAMESPACE;
+var composeHost = (address) => net3.isIP(address) === 6 ? `[${address}]` : address;
 var renderSecrets = (secrets, config) => {
   const sshHost = parseUrl(config.appUrl, "Server config appUrl").hostname.replace(/^\[|\]$/g, "");
-  const composeBind = net3.isIP(config.bind) === 6 ? `[${config.bind}]` : config.bind;
+  const composeBind = composeHost(config.bind);
   return [
     `MEND_VERSION=${config.serverVersion}`,
     "MEND_IMAGE_REPOSITORY=ghcr.io/sealant-sh/mend",
@@ -7433,6 +8286,7 @@ var renderSecrets = (secrets, config) => {
     `APP_URL=${config.appUrl}`,
     `MEND_ALLOWED_ORIGINS=${JSON.stringify(config.allowedOrigins)}`,
     `MEND_BIND_HOST=${composeBind}`,
+    ...config.sshBind === void 0 ? [] : [`MEND_SSH_BIND_HOST=${composeHost(config.sshBind)}`],
     `MEND_PORT=${config.appPort}`,
     `MEND_SSH_PORT=${config.sshPort}`,
     ...config.registryPort === void 0 ? [] : [`MEND_REGISTRY_PORT=${config.registryPort}`],
@@ -7443,6 +8297,9 @@ var renderSecrets = (secrets, config) => {
     "MEND_STORE_VOLUME_NAME=mend-store",
     "MEND_CONTROL_VOLUME_NAME=mend-control",
     ...renderGarage(secrets, config),
+    // The mirrors' size cap and Docker Hub login (server-mirrors.ts); the token reaches only the
+    // Docker mirror's container.
+    ...mirrorsEnvLines(config.mirrors, secrets.dockerHubToken),
     `DOCKER_SOCKET_PATH=${config.dockerSocket}`,
     ""
   ].join("\n");
@@ -7493,6 +8350,47 @@ var validateOverlays = (config, files) => {
   }
   return edgeImageOf(files.edge);
 };
+var validateMirrors = (config, secrets, files) => {
+  const mirrors = config.mirrors;
+  if (runsMirrors(mirrors) !== (files.mirrors !== void 0)) {
+    throw setupError(
+      `Server generation is corrupt: ${MIRRORS_COMPOSE_FILE} does not match the persisted server config.`
+    );
+  }
+  if ((mirrors !== void 0 && mirrors.npm !== null) !== (files.npmMirrorConf !== void 0)) {
+    throw setupError(
+      `Server generation is corrupt: ${NPM_MIRROR_CONF_NAME} does not match the persisted server config.`
+    );
+  }
+  if (dockerMirrorLogin(mirrors?.docker ?? null) === void 0 !== (secrets.dockerHubToken === void 0)) {
+    throw setupError(
+      "Server secrets are corrupt: a Docker Hub login needs both MEND_DOCKER_HUB_USERNAME and MEND_DOCKER_HUB_TOKEN."
+    );
+  }
+  if (files.mirrors === void 0) return [];
+  for (const service of mirrorServices(mirrors)) {
+    if (!files.mirrors.includes(`
+  ${service}:
+`))
+      throw setupError(
+        `Server generation is corrupt: ${MIRRORS_COMPOSE_FILE} does not run the ${service} its config declares.`
+      );
+  }
+  if ((mirrors !== void 0 && mirrors.docker !== null) !== (files.dockerMirrorGuard !== void 0)) {
+    throw setupError(
+      `Server generation is corrupt: ${DOCKER_MIRROR_GUARD_NAME} does not match the persisted server config.`
+    );
+  }
+  if (files.dockerMirrorGuard !== void 0 && !files.dockerMirrorGuard.includes("registry serve /etc/distribution/config.yml"))
+    throw setupError(
+      `Server generation is corrupt: ${DOCKER_MIRROR_GUARD_NAME} is not the Docker mirror's guard.`
+    );
+  if (files.npmMirrorConf !== void 0 && !files.npmMirrorConf.includes("proxy_cache npm;"))
+    throw setupError(
+      `Server generation is corrupt: ${NPM_MIRROR_CONF_NAME} is not the npm mirror's configuration.`
+    );
+  return mirrorImagesOf(files.mirrors);
+};
 var readServerInstallation = (store) => {
   try {
     const generation = storeValue(store.readActive());
@@ -7507,12 +8405,14 @@ var readServerInstallation = (store) => {
     validateComposeAsset(generation.files.compose);
     validatePostgresAsset(generation.files.postgresInit);
     const edgeImage = validateOverlays(config, generation.files);
+    const mirrorImages = validateMirrors(config, secrets, generation.files);
     return {
       _tag: "ok",
       value: {
         config,
         directory: generation.directory,
-        ...edgeImage === void 0 ? {} : { edgeImage }
+        ...edgeImage === void 0 ? {} : { edgeImage },
+        ...mirrorImages.length === 0 ? {} : { mirrorImages }
       }
     };
   } catch (cause) {
@@ -7543,7 +8443,10 @@ var readServerInstallationFacts = async (configDir) => {
         overlays: [
           ...generation.files.edge === void 0 ? [] : [{ name: "compose.edge.yaml", content: generation.files.edge }],
           ...generation.files.caddyfile === void 0 ? [] : [{ name: "Caddyfile", content: generation.files.caddyfile }],
-          ...generation.files.posture === void 0 ? [] : [{ name: "compose.posture.yaml", content: generation.files.posture }]
+          ...generation.files.posture === void 0 ? [] : [{ name: "compose.posture.yaml", content: generation.files.posture }],
+          ...generation.files.mirrors === void 0 ? [] : [{ name: MIRRORS_COMPOSE_FILE, content: generation.files.mirrors }],
+          ...generation.files.npmMirrorConf === void 0 ? [] : [{ name: NPM_MIRROR_CONF_NAME, content: generation.files.npmMirrorConf }],
+          ...generation.files.dockerMirrorGuard === void 0 ? [] : [{ name: DOCKER_MIRROR_GUARD_NAME, content: generation.files.dockerMirrorGuard }]
         ],
         envKeys: envKeyNames(generation.files.env)
       };
@@ -7555,6 +8458,7 @@ var readServerInstallationFacts = async (configDir) => {
 };
 var generationFiles = (config, secrets, assets, identity = renderIdentity(secrets)) => {
   const posture = renderPostureOverlay(config);
+  const mirrors = renderMirrorsOverlay(config.mirrors);
   return {
     identity,
     config: `${JSON.stringify(config, null, 2)}
@@ -7562,7 +8466,10 @@ var generationFiles = (config, secrets, assets, identity = renderIdentity(secret
     env: renderSecrets(secrets, config),
     ...assets,
     ...posture === void 0 ? {} : { posture },
-    ...config.edgeHost === void 0 ? {} : { edge: EDGE_COMPOSE_OVERLAY, caddyfile: EDGE_CADDYFILE }
+    ...config.edgeHost === void 0 ? {} : { edge: EDGE_COMPOSE_OVERLAY, caddyfile: EDGE_CADDYFILE },
+    ...mirrors === void 0 ? {} : { mirrors },
+    ...config.mirrors === void 0 || config.mirrors.npm === null ? {} : { npmMirrorConf: NPM_MIRROR_CONF },
+    ...config.mirrors === void 0 || config.mirrors.docker === null ? {} : { dockerMirrorGuard: DOCKER_MIRROR_GUARD }
   };
 };
 var persistSetup = (store, config, secrets, assets) => storeValue(store.prepare(generationFiles(config, secrets, assets)));
@@ -7632,6 +8539,13 @@ var resolveDockerSocket = (runtime, options, existing, selectedContext) => {
     dockerSocketSource: override === void 0 ? "detected" : "override"
   };
 };
+var checkSshBindAsset = (config, compose) => {
+  if (config.sshBind !== void 0 && !compose.includes("MEND_SSH_BIND_HOST")) {
+    throw setupError(
+      `Mend ${config.serverVersion}'s ${COMPOSE_ASSET} publishes workspace SSH on --bind and cannot honour --ssh-bind ${config.sshBind}. Use a release that supports --ssh-bind, or pass --ssh-bind with the --bind address.`
+    );
+  }
+};
 var resolveAssets = async (runtime, serverVersion, existing, store, options) => {
   if (options.assetsDir !== void 0) {
     try {
@@ -7724,6 +8638,17 @@ var checkLocalImages = async (runtime, installation, policy = "local") => {
     if (edge.status !== 0)
       throw commandFailure(`Preload ${installation.edgeImage} before continuing`, edge);
   }
+  for (const mirrorImage of installation.mirrorImages ?? []) {
+    const mirror = await inspectImage(
+      runtime,
+      config.dockerContext,
+      mirrorImage,
+      "{{.Id}}",
+      policy
+    );
+    if (mirror.status !== 0)
+      throw commandFailure(`Preload ${mirrorImage} before continuing`, mirror);
+  }
 };
 var checkComposeImages = async (runtime, installation) => {
   const output = await runtime.run(
@@ -7736,11 +8661,12 @@ var checkComposeImages = async (runtime, installation) => {
     `ghcr.io/sealant-sh/mend:${installation.config.serverVersion}`,
     "postgres:17-alpine",
     ...installation.config.bucket === "garage" ? [GARAGE_IMAGE] : [],
-    ...installation.edgeImage === void 0 ? [] : [installation.edgeImage]
+    ...installation.edgeImage === void 0 ? [] : [installation.edgeImage],
+    ...installation.mirrorImages ?? []
   ].toSorted();
   if (images.join("\n") !== expected.join("\n")) {
     throw setupError(
-      `Compose must use only the canonical pinned Mend image, official postgres:17-alpine${installation.config.bucket === "garage" ? ` and ${GARAGE_IMAGE}` : ""}${installation.edgeImage === void 0 ? "" : ` and the edge's ${installation.edgeImage}`}.`
+      `Compose must use only the canonical pinned Mend image, official postgres:17-alpine${installation.config.bucket === "garage" ? ` and ${GARAGE_IMAGE}` : ""}${installation.edgeImage === void 0 ? "" : ` and the edge's ${installation.edgeImage}`}${installation.mirrorImages === void 0 ? "" : ` and the mirrors' ${installation.mirrorImages.join(", ")}`}.`
     );
   }
 };
@@ -7787,8 +8713,16 @@ var initGarage = async (runtime, installation, secrets) => {
 var startingNotice = (runtime, version) => runtime.writeLine(
   `Starting Mend ${version} containers; Docker waits up to ${serverProcessDeadlines.composeWaitSeconds}s for them to report healthy`
 );
-var removeStrayEdge = async (runtime, installation) => {
-  if (installation.config.edgeHost !== void 0) return;
+var strayServices = (config) => [
+  ...config.edgeHost === void 0 ? [{ service: "edge", label: "edge", holds: "It may still hold 80 and 443." }] : [],
+  ...config.mirrors?.npm === null ? [{ service: "npm-mirror", label: "npm mirror", holds: "It keeps running beside Mend." }] : [],
+  ...config.mirrors?.docker === null ? [{ service: "docker-mirror", label: "Docker mirror", holds: "It keeps running beside Mend." }] : []
+];
+var removeStrayServices = async (runtime, installation) => {
+  for (const stray of strayServices(installation.config))
+    await removeStrayService(runtime, installation, stray);
+};
+var removeStrayService = async (runtime, installation, stray) => {
   const context = installation.config.dockerContext;
   const listed = await runtime.run("docker", [
     "--context",
@@ -7799,13 +8733,13 @@ var removeStrayEdge = async (runtime, installation) => {
     "--filter",
     "label=com.docker.compose.project=mend",
     "--filter",
-    "label=com.docker.compose.service=edge",
+    `label=com.docker.compose.service=${stray.service}`,
     "--format",
     '{{.Names}}	{{.Label "com.docker.compose.project.working_dir"}}'
   ]);
   if (listed.status !== 0 || listed.error !== void 0) {
     runtime.writeLine(
-      `Could not list this project's containers: ${outputDetail(listed)}. An edge container left by an earlier generation, if any, stays until the next start. mend server status shows it.`
+      `Could not list this project's containers: ${outputDetail(listed)}. An ${stray.label} container left by an earlier generation, if any, stays until the next start. mend server status shows it.`
     );
     return;
   }
@@ -7821,9 +8755,10 @@ var removeStrayEdge = async (runtime, installation) => {
     const [name = "", workingDir = ""] = line.split("	");
     return { name, workingDir };
   }).filter((row) => row.name !== "");
+  const label = stray.label.charAt(0).toUpperCase() + stray.label.slice(1);
   for (const row of rows.filter((candidate) => !own(candidate.workingDir))) {
     runtime.writeLine(
-      `Edge container ${row.name} was started from ${row.workingDir || "an unknown directory"}, not from this installation's generations. It stays.`
+      `${label} container ${row.name} was started from ${row.workingDir || "an unknown directory"}, not from this installation's generations. It stays.`
     );
   }
   const names = rows.filter((row) => own(row.workingDir)).map((row) => row.name);
@@ -7838,16 +8773,16 @@ var removeStrayEdge = async (runtime, installation) => {
   ]);
   if (removed.status !== 0 || removed.error !== void 0) {
     runtime.writeLine(
-      `Could not remove the edge container ${names.join(", ")}: ${outputDetail(removed)}. It may still hold 80 and 443. To remove it: docker --context ${context} container rm --force ${names.join(" ")}`
+      `Could not remove the ${stray.label} container ${names.join(", ")}: ${outputDetail(removed)}. ${stray.holds} To remove it: docker --context ${context} container rm --force ${names.join(" ")}`
     );
     return;
   }
   runtime.writeLine(
-    `Removed the edge container ${names.join(", ")}, which this generation does not run.`
+    `Removed the ${stray.label} container ${names.join(", ")}, which this generation does not run.`
   );
 };
 var startCompose = async (runtime, installation) => {
-  await removeStrayEdge(runtime, installation);
+  await removeStrayServices(runtime, installation);
   startingNotice(runtime, installation.config.serverVersion);
   const compose = await runtime.run(
     "docker",
@@ -7865,7 +8800,70 @@ var startCompose = async (runtime, installation) => {
   );
   if (compose.status !== 0) throw commandFailure("Mend containers did not start", compose);
 };
-var edgeStartedLine = (config) => config.edgeHost === void 0 ? null : `The edge for ${config.edgeHost} is up on 80 and 443. Caddy asks for its certificate once ${config.edgeHost} resolves to this machine and both ports reach it from the Internet. mend server status says whether it holds one, and mend server logs shows what Caddy tried.`;
+var SSH_PROBE_BOUND_MS = 1e4;
+var sshPublicationLine = async (runtime, config) => {
+  if (config.sshBind === void 0 || isLoopbackBind(config.sshBind)) return null;
+  const published = publishedAddress(config.sshBind, config.sshPort);
+  if (runtime.probeSsh === void 0) return null;
+  const boundMs = runtime.sshProbeBoundMs ?? SSH_PROBE_BOUND_MS;
+  let bound;
+  const probes = await Promise.race([
+    runtime.probeSsh(config.sshBind, config.sshPort),
+    new Promise((resolve8) => {
+      bound = setTimeout(() => resolve8(null), boundMs);
+    })
+  ]).finally(() => clearTimeout(bound));
+  if (probes === null) {
+    return `Workspace SSH is published on ${published}. This machine's look at it did not finish within ${boundMs / 1e3} s. Who reaches it is up to the network and its firewall; mend operator exposure reports it as workspace-ssh.`;
+  }
+  const observed = probes.length === 0 ? "this machine has no address to try it at" : probes.map(
+    (probe) => probe.banner === null ? `${publishedAddress(probe.address, config.sshPort)} did not answer` : `${publishedAddress(probe.address, config.sshPort)} answers (${probe.banner})`
+  ).join(", ");
+  return `Workspace SSH is published on ${published}. From this machine: ${observed}. Who else reaches it is up to the network and its firewall; mend operator exposure reports it as workspace-ssh.`;
+};
+var edgeStartedLine = (config) => config.edgeHost === void 0 ? null : `The edge for ${config.edgeHost} is up on 80 and 443. Caddy asks for its certificate once ${config.edgeHost} resolves to this machine and both ports reach it from the Internet. mend server status says whether it holds one, and mend server logs shows what Caddy tried.${config.sshBind === void 0 ? ` Workspace SSH is published on ${config.bind}:${config.sshPort} only, so Remote-SSH and mend ssh from another machine cannot reach it; --ssh-bind 0.0.0.0 publishes it.` : ` Workspace SSH is published on ${config.sshBind}:${config.sshPort}.`}`;
+var resolveDockerHubToken = async (runtime, options, mirrors, store) => {
+  if (dockerMirrorLogin(mirrors.docker) === void 0) return void 0;
+  if (options.dockerHubTokenStdin) {
+    if (runtime.readStdin === void 0)
+      throw setupError("--docker-hub-token-stdin needs standard input, and none is available.");
+    const token = (await runtime.readStdin()).trim();
+    if (!isDockerHubCredential(token))
+      throw setupError(
+        "--docker-hub-token-stdin read no Docker Hub access token: pipe the token alone, such as a personal access token (dckr_pat_\u2026)."
+      );
+    return token;
+  }
+  const active = storeValue(store.readActive());
+  return active === null ? void 0 : parseSecrets(active.files.env).dockerHubToken;
+};
+var mirrorsChangedLines = (before, config) => {
+  const after = config.mirrors;
+  if (after === void 0) return [];
+  const lines = [];
+  const said = (name, was, is, volume, reach) => {
+    if (is && !was) lines.push(`The ${name} runs on this install. ${reach}`);
+    if (was && !is)
+      lines.push(
+        `The ${name} is off. Its cache stays until you remove it: docker --context ${config.dockerContext} volume rm ${volume}`
+      );
+  };
+  said(
+    "npm mirror",
+    before !== void 0 && before.npm !== null,
+    after.npm !== null,
+    "mend_mend-npm-mirror",
+    `New sessions install npm packages through it, capped at ${after.npm?.maxSize ?? ""}.`
+  );
+  said(
+    "Docker mirror",
+    before !== void 0 && before.docker !== null,
+    after.docker !== null,
+    "mend_mend-docker-mirror",
+    `New sessions' Docker daemons pull Docker Hub images through it (${DOCKER_MIRROR_CONTAINER}).`
+  );
+  return lines;
+};
 var setupServer = async (args, runtime, store) => {
   if (runtime.platform !== "linux" && runtime.platform !== "darwin") {
     throw setupError(`mend server setup supports Linux and macOS, not ${runtime.platform}.`);
@@ -7891,6 +8889,7 @@ var setupServer = async (args, runtime, store) => {
   const operatingSystem = await checkDocker(runtime, selectedContext.name);
   runtime.writeLine(`Using Docker context "${selectedContext.name}" (${selectedContext.endpoint})`);
   const serverVersion = await resolveServerVersion(runtime, options, existing?.config ?? null);
+  const mirrors = resolveMirrors(existing?.config.mirrors, options);
   const configWithoutBucket = {
     schemaVersion: CONFIG_SCHEMA_VERSION,
     assetContract: ASSET_CONTRACT,
@@ -7901,9 +8900,12 @@ var setupServer = async (args, runtime, store) => {
       ...selectedContext,
       operatingSystem
     }),
-    ...validateExposure(existing?.config ?? null, options)
+    ...validateExposure(existing?.config ?? null, options),
+    mirrors
   };
+  const dockerHubToken = await resolveDockerHubToken(runtime, options, mirrors, store);
   const assets = await resolveAssets(runtime, serverVersion, existing, store, options);
+  checkSshBindAsset(configWithoutBucket, assets.compose);
   const bucket = composeBucket(assets.compose);
   if (bucket !== void 0 && runtime.dockerDaemonFacts !== void 0) {
     const info = await runtime.run("docker", [
@@ -7927,12 +8929,16 @@ var setupServer = async (args, runtime, store) => {
       `A fresh install cannot start with the edge or as public: until the first account exists, registration is open to whoever reaches the origin first, and the server refuses MEND_EXPOSURE=public without an operator account. Run mend server setup without --edge and --exposure public, create the first account at http://localhost:${config.appPort}, then run mend server setup --edge <host> and declare the posture.`
     );
   }
-  const secrets = savedSecrets ?? createSecrets(runtime);
+  const secrets = {
+    ...savedSecrets ?? createSecrets(runtime),
+    ...dockerHubToken === void 0 ? {} : { dockerHubToken }
+  };
   const generation = persistSetup(store, config, secrets, assets);
   const installation = {
     directory: generation.directory,
     config,
-    ...generation.files.edge === void 0 ? {} : { edgeImage: edgeImageOf(generation.files.edge) }
+    ...generation.files.edge === void 0 ? {} : { edgeImage: edgeImageOf(generation.files.edge) },
+    ...generation.files.mirrors === void 0 ? {} : { mirrorImages: mirrorImagesOf(generation.files.mirrors) }
   };
   await checkComposeImages(runtime, installation);
   const ownership2 = await claimServerDockerVolumes(runtime, {
@@ -7954,11 +8960,14 @@ var setupServer = async (args, runtime, store) => {
   runtime.writeLine(reachableLine(config));
   const edgeStarted = edgeStartedLine(config);
   if (edgeStarted !== null) runtime.writeLine(edgeStarted);
+  const sshPublication = await sshPublicationLine(runtime, config);
+  if (sshPublication !== null) runtime.writeLine(sshPublication);
   if (existing?.config.edgeHost !== void 0 && config.edgeHost === void 0) {
     runtime.writeLine(
       `The edge for ${existing.config.edgeHost} is gone. Its certificate volumes stay until you remove them: docker --context ${config.dockerContext} volume rm mend_mend-edge-data mend_mend-edge-config`
     );
   }
+  for (const line of mirrorsChangedLines(existing?.config.mirrors, config)) runtime.writeLine(line);
   runtime.writeLine(
     `Open ${config.appUrl}, create the first account, then run: mend login --url ${config.appUrl}`
   );
@@ -8023,7 +9032,7 @@ var interruptionNotice = (runtime) => runtime.writeLine(
   "Connections will be interrupted. Workspace containers and data are retained, but active work can lose connectivity and may need reconnection. Mend does not stop workspace containers."
 );
 var startInstallation = async (runtime, installation, secrets) => {
-  await removeStrayEdge(runtime, installation);
+  await removeStrayServices(runtime, installation);
   startingNotice(runtime, installation.config.serverVersion);
   await composeCommand(runtime, installation, [
     "up",
@@ -8071,7 +9080,7 @@ var parseUpgradeOptions = (args) => {
     );
   return { ...options, fromPreview, keepBackups };
 };
-var formatBytes3 = (bytes) => {
+var formatBytes4 = (bytes) => {
   if (bytes < 1024) return `${bytes} B`;
   const units = ["KiB", "MiB", "GiB", "TiB"];
   let value = bytes / 1024;
@@ -8114,11 +9123,11 @@ var pruneUpgradeBackups = (runtime, store, backup, keep) => {
   const { removed, kept, held, failed, unsynced } = pruned.value;
   for (const entry of removed)
     runtime.writeLine(
-      `Removed upgrade backup ${entry.directory} \xB7 ${formatBytes3(entry.bytes)}${entry.interrupted ? " \xB7 finishing a removal a crash cut short" : entry.legacy ? " \xB7 from before 0.36, no recorded outcome" : ""}`
+      `Removed upgrade backup ${entry.directory} \xB7 ${formatBytes4(entry.bytes)}${entry.interrupted ? " \xB7 finishing a removal a crash cut short" : entry.legacy ? " \xB7 from before 0.36, no recorded outcome" : ""}`
     );
   const freed = removed.reduce((total, entry) => total + entry.bytes, 0);
   runtime.writeLine(
-    `Upgrade backups \xB7 removed ${removed.length}${removed.length > 0 ? ` \xB7 ${formatBytes3(freed)} freed` : ""} \xB7 kept ${kept.length} (--keep-backups ${keep})`
+    `Upgrade backups \xB7 removed ${removed.length}${removed.length > 0 ? ` \xB7 ${formatBytes4(freed)} freed` : ""} \xB7 kept ${kept.length} (--keep-backups ${keep})`
   );
   for (const entry of failed)
     runtime.writeLine(`Could not remove upgrade backup ${entry.directory}: ${entry.message}`);
@@ -8276,6 +9285,7 @@ var upgradeServer = async (args, runtime, store, existing) => {
   const previous = storeValue(store.readActive());
   if (previous === null) throw setupError("The active server generation is missing.");
   const assets = await resolveAssets(runtime, version, existing, store, options);
+  checkSshBindAsset({ ...existing.config, serverVersion: version }, assets.compose);
   const {
     registryPort: _legacyRegistryPort,
     bucket: _previousBucket,
@@ -8286,14 +9296,23 @@ var upgradeServer = async (args, runtime, store, existing) => {
     ...carried,
     assetContract: ASSET_CONTRACT,
     serverVersion: version,
-    ...bucket === void 0 ? {} : { bucket }
+    ...bucket === void 0 ? {} : { bucket },
+    // An install from before the mirrors gains both here; one that turned a mirror off keeps it off.
+    mirrors: carried.mirrors ?? DEFAULT_MIRRORS
+  };
+  const previousToken = parseSecrets(previous.files.env).dockerHubToken;
+  const secrets = {
+    ...parseSecrets(previous.files.identity),
+    ...previousToken === void 0 ? {} : { dockerHubToken: previousToken }
   };
-  const secrets = parseSecrets(previous.files.identity);
   const files = generationFiles(config, secrets, assets, previous.files.identity);
   const parsed = parseServerConfig(files.config);
   if (renderSecrets(parseSecrets(files.env), parsed) !== files.env)
     throw setupError("Invalid upgrade configuration.");
-  const edgeImage = files.edge === void 0 ? {} : { edgeImage: edgeImageOf(files.edge) };
+  const edgeImage = {
+    ...files.edge === void 0 ? {} : { edgeImage: edgeImageOf(files.edge) },
+    ...files.mirrors === void 0 ? {} : { mirrorImages: mirrorImagesOf(files.mirrors) }
+  };
   await checkLocalImages(
     runtime,
     { config, ...edgeImage },
@@ -8378,6 +9397,7 @@ var upgradeServer = async (args, runtime, store, existing) => {
     );
   }
   runtime.writeLine(`Upgraded to ${version}. Retained database backup: ${backup.directory}`);
+  for (const line of mirrorsChangedLines(existing.config.mirrors, config)) runtime.writeLine(line);
   pruneUpgradeBackups(runtime, store, backup, options.keepBackups);
 };
 var observeEdgeCertificate = async (runtime, installation, host) => {
@@ -8481,6 +9501,75 @@ var exposureReportOf = (value) => {
   const parsed = items.flatMap(exposureItemOf);
   return parsed.length === items.length && parsed.length > 0 ? { declared, items: parsed } : null;
 };
+var mirrorStatusLines = async (runtime, installation, runningServices) => {
+  const mirrors = installation.config.mirrors;
+  if (mirrors === void 0) return [];
+  const run2 = (args) => runtime.run("docker", serverComposeArgs(composeTarget(installation), args), {
+    timeoutMs: serverProcessDeadlines.ordinary
+  });
+  const failed = (output) => output.status !== 0 || output.error !== void 0 ? outputDetail(output) : null;
+  const diskOf = async (service, directory) => {
+    const probe = await run2(["exec", "-T", service, "sh", "-c", mirrorDiskProbe(directory)]);
+    return failed(probe) ?? mirrorDiskOf(probe.stdout) ?? "du and df answered nothing readable";
+  };
+  const lines = [];
+  const npmRunning = runningServices.includes("npm-mirror");
+  if (mirrors.npm === null || !npmRunning) {
+    lines.push(observedNpmMirrorLine(mirrors, { running: false, disk: "", traffic: "" }));
+  } else {
+    const log = await run2([
+      "logs",
+      "--no-color",
+      "--no-log-prefix",
+      "--since",
+      "24h",
+      "npm-mirror"
+    ]);
+    lines.push(
+      observedNpmMirrorLine(mirrors, {
+        running: true,
+        disk: await diskOf("npm-mirror", "/var/cache/npm-mirror"),
+        traffic: failed(log) ?? npmMirrorTraffic(log.stdout)
+      })
+    );
+  }
+  const dockerRunning = runningServices.includes("docker-mirror");
+  if (mirrors.docker === null || !dockerRunning) {
+    lines.push(
+      observedDockerMirrorLine(mirrors, { running: false, disk: "", traffic: "", startedAt: null })
+    );
+  } else {
+    const metrics = await run2([
+      "exec",
+      "-T",
+      "docker-mirror",
+      "wget",
+      "-q",
+      "-O",
+      "-",
+      "http://127.0.0.1:5001/metrics"
+    ]);
+    const started = await runtime.run("docker", [
+      "--context",
+      installation.config.dockerContext,
+      "container",
+      "inspect",
+      "--format",
+      "{{.State.StartedAt}}",
+      DOCKER_MIRROR_CONTAINER
+    ]);
+    const startedAt = failed(started) === null ? started.stdout.trim().replace(/\.\d+Z$/, "Z") : "";
+    lines.push(
+      observedDockerMirrorLine(mirrors, {
+        running: true,
+        disk: await diskOf("docker-mirror", "/var/lib/registry"),
+        traffic: failed(metrics) ?? dockerMirrorTraffic(metrics.stdout) ?? "the registry reported no proxy counters",
+        startedAt: startedAt === "" ? null : startedAt
+      })
+    );
+  }
+  return lines;
+};
 var serverStatus = async (runtime, installation) => {
   const { config } = installation;
   runtime.writeLine(`Pinned Mend ${config.serverVersion} at ${config.appUrl}`);
@@ -8504,6 +9593,8 @@ var serverStatus = async (runtime, installation) => {
       })
     );
   }
+  for (const line of await mirrorStatusLines(runtime, installation, runningServices))
+    runtime.writeLine(line);
   if (!runningServices.includes("mend")) {
     runtime.writeLine("Mend is stopped. No health claim was made.");
     return;
@@ -8572,7 +9663,10 @@ var manageServer = async (command, args, runtime, store) => {
       "Mend",
       "Postgres",
       ...installation.config.bucket === "garage" ? ["Garage"] : [],
-      ...installation.config.edgeHost === void 0 ? [] : ["the edge"]
+      ...installation.config.edgeHost === void 0 ? [] : ["the edge"],
+      ...mirrorServices(installation.config.mirrors).map(
+        (service) => service === "npm-mirror" ? "the npm mirror" : "the Docker mirror"
+      )
     ];
     runtime.writeLine(
       `${stopped.slice(0, -1).join(", ")} and ${stopped.at(-1)} stopped. Volumes, configuration and workspace containers are retained.`
@@ -8615,9 +9709,51 @@ var nodeServerRuntime = () => {
     writeLine: (line) => process.stdout.write(`${redactCredentials(line)}
 `),
     dockerDaemonFacts: hostDockerDaemonFacts,
-    readLogin: (configDir) => savedLogin(configDir, environment)
+    readLogin: (configDir) => savedLogin(configDir, environment),
+    probeSsh: probeSshFromHere,
+    readStdin: async () => {
+      const chunks = [];
+      for await (const chunk of process.stdin)
+        chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : Buffer.from(chunk));
+      return Buffer.concat(chunks).toString("utf8");
+    }
   };
 };
+var sshBannerAt = async (host, port, timeoutMs) => {
+  const socket = net3.connect({ host, port });
+  let deadline;
+  try {
+    return await Promise.race([
+      new Promise((resolve8) => {
+        socket.once(
+          "data",
+          (bytes) => resolve8(bytes.toString("utf8").split(/\r?\n/)[0]?.trim() ?? "")
+        );
+        socket.once("end", () => resolve8(null));
+        socket.once("close", () => resolve8(null));
+        socket.once("error", () => resolve8(null));
+      }),
+      new Promise((resolve8) => {
+        deadline = setTimeout(() => resolve8(null), timeoutMs);
+      })
+    ]);
+  } finally {
+    clearTimeout(deadline);
+    socket.destroy();
+  }
+};
+var probeSshFromHere = async (bind, port) => {
+  const unspecified = bind === "0.0.0.0" || bind === "::";
+  const addresses = unspecified ? Object.values(os10.networkInterfaces()).flatMap((entries) => entries ?? []).filter(
+    (entry) => !entry.internal && (entry.family === "IPv4" || bind === "::" && !entry.address.startsWith("fe80"))
+  ).map((entry) => entry.address).slice(0, 4) : [bind];
+  return Promise.all(
+    addresses.map(async (address) => ({
+      address,
+      banner: await sshBannerAt(address, port, 3e3)
+    }))
+  );
+};
 var savedLogin = (configDir, environment) => {
   let saved = null;
   try {
@@ -9782,6 +10918,7 @@ var describeUninstall = async (runtime, scope) => {
         appUrl: read.value.config.appUrl,
         dockerContext: read.value.config.dockerContext,
         edgeHost: read.value.config.edgeHost ?? null,
+        mirrors: mirrorServices(read.value.config.mirrors),
         generations: countEntries(path20.join(configDir, "generations")),
         backups: countEntries(path20.join(configDir, "backups"))
       };
@@ -9811,8 +10948,12 @@ var planLines = (plan, configDir) => {
       `server   Mend ${version}${appUrl === "" ? "" : ` at ${appUrl}`}${dockerContext === "" ? "" : ` \xB7 docker context ${dockerContext}`}`
     );
     if (dockerContext !== "") {
-      const edge = edgeHost === null ? [] : ["edge"];
-      const edgeVolumes = edgeHost === null ? [] : ["mend-edge-data", "mend-edge-config"];
+      const mirrors = plan.server.mirrors ?? [];
+      const edge = [...edgeHost === null ? [] : ["edge"], ...mirrors];
+      const edgeVolumes = [
+        ...edgeHost === null ? [] : ["mend-edge-data", "mend-edge-config"],
+        ...mirrors.map((service) => `mend-${service}`)
+      ];
       lines.push(
         `         containers ${["mend", "postgres", "garage", ...edge].join(", ")} \xB7 volumes ${[MEND_DOCKER_NAMESPACE_WITH_GARAGE.store, ...secondaryVolumesOf(MEND_DOCKER_NAMESPACE_WITH_GARAGE), "mend-config", "mend-ssh", "mend-postgres", ...edgeVolumes].join(", ")} \xB7 image ghcr.io/sealant-sh/mend:${version}${edgeHost === null ? "" : ` \xB7 the edge for ${edgeHost}`}`
       );
@@ -9871,7 +11012,9 @@ var removeServer = async (runtime, failures, leftovers) => {
             `docker compose down failed: ${(down.error ?? down.stderr.trim()) || "no output"}. Containers and files are retained; fix Docker and run mend uninstall again.`
           );
         }
-        server.writeLine("removed containers mend, postgres, garage and the Compose-owned volumes");
+        server.writeLine(
+          `removed containers ${["mend", "postgres", "garage", ...mirrorServices(installation.config.mirrors)].join(", ")} and the Compose-owned volumes`
+        );
         const namespace = installation.config.bucket === "garage" ? MEND_DOCKER_NAMESPACE_WITH_GARAGE : MEND_DOCKER_NAMESPACE;
         const dataVolumes = [namespace.store, ...secondaryVolumesOf(namespace)];
         const identity = store.readIdentity();
@@ -10844,7 +11987,7 @@ var attachTty = async (config, sessionId, harness, from, processId, options) =>
       process.stdout.write("\x07");
     }
   };
-  const connect2 = async () => {
+  const connect3 = async () => {
     let url;
     try {
       url = await socketUrl(
@@ -10913,7 +12056,7 @@ ${dim7(`read-only \xB7 ${detachKeyEnabled ? "Ctrl+] or " : ""}Ctrl+C detaches`)}
 `
       );
     }
-    const connected = await connect2();
+    const connected = await connect3();
     stopConnecting();
     if (connected === "unavailable") return "unavailable";
     if (connected === "aborted") return abortReason ?? "interrupted";
@@ -11320,8 +12463,9 @@ var printService = (config, service) => {
   const status = service.status === "reachable" ? green7(service.status) : amber2(service.status);
   const port = `:${service.workspacePort ?? "?"}${service.protocol === "udp" ? "/udp" : ""}`;
   const statusPad = " ".repeat(Math.max(1, 12 - service.status.length));
+  const processLine2 = service.processId === null ? "no process" : `process ${service.processId.slice(0, 8)}`;
   say7(
-    `${(service.label ?? service.id.slice(0, 8)).padEnd(14)} ${status}${statusPad}${dim7(port.padEnd(7))} ${dim7(service.id.slice(0, 8))}`
+    `${(service.label ?? service.id.slice(0, 8)).padEnd(14)} ${status}${statusPad}${dim7(port.padEnd(7))} ${dim7(`service ${service.id.slice(0, 8)} \xB7 ${processLine2}`)}`
   );
   printServiceAccess(config, service);
   printWorkspaceTtlFailure(service);
@@ -11364,8 +12508,30 @@ var serviceAdd = async (config, args) => {
     say7(dim7(`  nothing answered on :${port} yet \u2014 the URL goes live when something listens`));
   }
 };
-var serviceList = async (config) => {
+var serviceList = async (config, args) => {
+  const unknown = args.find((arg) => arg !== "--json");
+  if (unknown !== void 0) {
+    return fail7(`unknown argument ${unknown} \xB7 ${usageOf("service list")}`);
+  }
   const services = await fetchServices(config);
+  if (args.includes("--json")) {
+    printJson({
+      version: 1,
+      services: services.map((service) => ({
+        id: service.id,
+        name: service.label,
+        sessionId: service.sessionId,
+        processId: service.processId,
+        status: service.status,
+        workspacePort: service.workspacePort,
+        protocol: service.protocol,
+        hostPort: service.hostPort,
+        authority: service.authority,
+        browserUrl: service.browserUrl
+      }))
+    });
+    return;
+  }
   if (services.length === 0) {
     say7(dim7("no live services \u2014 mend service add <port> adopts a listening one"));
     return;
@@ -11404,48 +12570,184 @@ var autoConnect = async (config, service) => {
   say7(dim7("  remote server \u2014 tunneling the port here \xB7 Ctrl-C stops the tunnel, not the Service"));
   await tunnelServices(config, [service], null);
 };
-var SERVICE_WAIT_MS = (() => {
+var SERVICE_WAIT_DEFAULT_MS = (() => {
   const configured = Number(process.env["MEND_SERVICE_WAIT_MS"]);
-  return Number.isFinite(configured) && configured > 0 ? configured : 9e4;
+  return Number.isFinite(configured) && configured > 0 ? configured : 10 * 6e4;
 })();
-var withinServiceWait = async (work, deadline) => {
-  const bounded = await beforeDeadline(work, clock, deadline);
+var SERVICE_RUN_VALUED = /* @__PURE__ */ new Set(["--port", "--name", "--timeout"]);
+var serviceWaitOf = (head) => {
+  const timeoutFlag = head.indexOf("--timeout");
+  const timeoutText = timeoutFlag === -1 ? void 0 : head[timeoutFlag + 1];
+  if (!head.includes("--wait")) {
+    return timeoutFlag === -1 ? null : fail7("--timeout bounds --wait: pass --wait too, or leave --timeout out");
+  }
+  const timeoutMs = timeoutFlag === -1 ? SERVICE_WAIT_DEFAULT_MS : timeoutText === void 0 ? null : parseDuration(timeoutText);
+  if (timeoutMs === null) return fail7(`${DURATION_ISSUE} \xB7 ${usageOf("service run")}`);
+  return { deadline: clock.now() + timeoutMs, timeoutMs };
+};
+var serviceRunPositionals = (head) => head.filter(
+  (arg, index) => !arg.startsWith("--") && !SERVICE_RUN_VALUED.has(head[index - 1] ?? "")
+);
+var failWith = (code, message) => {
+  process.stderr.write(`mend: ${redactCredentials(message)}
+`);
+  return exitFlushed(code);
+};
+var withinServiceWait = async (work, wait) => {
+  const bounded = await beforeDeadline(work, clock, wait?.deadline ?? null);
   if (bounded.done) return bounded.value;
-  process.stderr.write(
-    `mend: no answer within ${Math.round(SERVICE_WAIT_MS / 1e3)} s \xB7 the Service may still be starting \xB7 mend service list
-`
+  return failWith(
+    WAIT_TIMED_OUT,
+    `Mend gave no answer within ${durationLine(wait?.timeoutMs ?? 0)} \xB7 nothing was started`
+  );
+};
+var errorText = (error) => error instanceof Error ? error.message : String(error);
+var exitCodeText = (exitCode) => exitCode === null ? "no exit code reported" : `code ${exitCode}`;
+var readServiceStart = async (config, sessionId) => {
+  const [services, sessionStatus] = await Promise.all([
+    request(config, "GET", "/services?all=1"),
+    request(config, "GET", `/sessions/${sessionId}`).then(
+      (detail) => detail.session.status,
+      (error) => {
+        if (error instanceof MendRequestError && error.kind === "http" && error.status === 404) {
+          return null;
+        }
+        throw error;
+      }
+    )
+  ]);
+  return { services, sessionStatus };
+};
+var reportAnswered = (config, service) => {
+  const name = service.label;
+  say7(`${green7("\u2713")} Service ${name} \xB7 ${service.status}`);
+  printServiceEndpoint(config, service, false);
+  say7(dim7(`  logs: mend service logs ${name}`));
+  if (willAutoConnect(config, service, false)) say7(dim7(`  connect: mend service connect ${name}`));
+};
+var startServiceWaited = async (config, session, target, wait, spinner, start) => {
+  const { name, port } = target;
+  const startId = crypto.randomUUID();
+  const after = durationLine(wait.timeoutMs);
+  const stillStarting = (processId, more = "") => failWith(
+    WAIT_TIMED_OUT,
+    `${name} \xB7 still starting after ${after} \xB7 ${processId === null ? "" : `process ${processId.slice(0, 8)} runs \xB7 `}:${port} has not answered${more} \xB7 the Service keeps starting \xB7 mend logs --service ${name} --follow`
+  );
+  const ended = (processId, status, exitCode, more) => failWith(
+    SERVICE_PROCESS_ENDED,
+    `${name} \xB7 process ${processId.slice(0, 8)} ${status} \xB7 ${exitCodeText(exitCode)} \xB7 before :${port} answered \xB7 ${more}`
+  );
+  const posted = await withSpinner(
+    spinner,
+    beforeDeadline(
+      start(startId).then(
+        (view) => ({ ok: true, view }),
+        (error) => ({ ok: false, error })
+      ),
+      clock,
+      wait.deadline
+    )
   );
-  return exitFlushed(WAIT_TIMED_OUT);
-};
-var failUnlessAnswered = (config, service, wait) => {
-  if (!wait) return;
-  const name = service.label ?? service.id.slice(0, 8);
-  if (service.status !== "reachable") {
-    fail7(
-      `nothing answered on :${service.workspacePort} \xB7 ${service.status} \xB7 the Service keeps running \xB7 mend service logs ${name}`
+  if (!posted.done) return stillStarting(null, " \xB7 the start request has not returned");
+  let attemptId = null;
+  if (posted.value.ok) {
+    const { view } = posted.value;
+    attemptId = answeredAttemptId(view, startId);
+    if (attemptId !== null) {
+      const first = serviceStartStateOf(
+        { services: [view], sessionStatus: session.status },
+        { attemptId, sessionId: session.id, startId }
+      );
+      if (first.kind === "answered") return reportAnswered(config, flattenService(view));
+      if (first.kind === "process-ended") {
+        return ended(first.processId, first.status, first.exitCode, `mend logs --service ${name}`);
+      }
+    }
+    say7(
+      `${amber2("\xB7")} ${name} \xB7 ${attemptId === null ? "started" : `process ${attemptId.slice(0, 8)} runs`} \xB7 :${port} has not answered yet \xB7 waiting up to ${after}; Mend probes the port every 20 s`
     );
-  }
-  if (willAutoConnect(config, service, false)) {
-    say7(dim7(`  connect: mend service connect ${name}`));
+  } else {
+    const { error } = posted.value;
+    if (!mayStillBeWorking(error)) {
+      const read = await readWithin(
+        () => request(config, "GET", "/services?all=1"),
+        clock,
+        wait.deadline
+      ).catch(() => null);
+      const found = read?.done === true ? findStartAttempt(read.value, { attemptId: null, sessionId: session.id, startId }) : void 0;
+      if (found !== void 0 && found.attempt.exitedAt !== null) {
+        return ended(
+          found.attempt.id,
+          found.attempt.status,
+          found.attempt.exitCode,
+          errorText(error)
+        );
+      }
+      return failWith(1, errorText(error));
+    }
+    say7(dim7(`  the start got no answer (${errorText(error)}) \xB7 looking for the attempt it began\u2026`));
+  }
+  const started = clock.now();
+  let line = `${name} \xB7 starting \xB7 waiting for :${port} to answer\u2026`;
+  let nextReport = started + 6e4;
+  const outcome = await withSpinner(
+    () => line,
+    waitForServiceStart({
+      read: () => readServiceStart(config, session.id),
+      target: { attemptId, sessionId: session.id, startId },
+      deadline: wait.deadline,
+      ...clock,
+      onStarting: (state) => {
+        const running = state.processId === null ? "" : ` \xB7 process ${state.processId.slice(0, 8)} runs`;
+        line = `${name} \xB7 starting${running} \xB7 :${port} has not answered`;
+        if (chrome.isTTY !== true && clock.now() >= nextReport) {
+          nextReport = clock.now() + 6e4;
+          say7(dim7(`  ${line} \xB7 ${durationLine(clock.now() - started)} so far`));
+        }
+      }
+    })
+  ).catch((error) => failFlushed(errorText(error)));
+  switch (outcome.kind) {
+    case "answered":
+      return reportAnswered(config, flattenService(outcome.view));
+    case "process-ended":
+      return ended(
+        outcome.processId,
+        outcome.status,
+        outcome.exitCode,
+        `mend logs --service ${name}`
+      );
+    case "workspace-ended":
+      return failWith(
+        SERVICE_WORKSPACE_ENDED,
+        `${name} \xB7 session ${session.id.slice(0, 8)} no longer exists, and its workspace went with it \xB7 before :${port} answered`
+      );
+    case "timeout":
+      return stillStarting(outcome.last?.kind === "starting" ? outcome.last.processId : null);
+    case "no-attempt":
+      return failWith(
+        1,
+        `${name} \xB7 the start got no answer, and no attempt carrying its id appeared within a minute (a server older than this CLI stamps none) \xB7 mend service list`
+      );
   }
 };
 var serviceRun = async (config, args) => {
   const dashdash = args.indexOf("--");
   const usage2 = usageOf("service run");
-  const wait = (dashdash === -1 ? args : args.slice(0, dashdash)).includes("--wait");
-  const deadline = wait ? clock.now() + SERVICE_WAIT_MS : null;
+  const head = dashdash === -1 ? args : args.slice(0, dashdash);
+  const wait = serviceWaitOf(head);
   if (dashdash === -1) {
-    const positionals = args.filter((a) => !a.startsWith("--"));
+    const positionals = serviceRunPositionals(head);
     const name2 = positionals.at(-1);
     if (name2 === void 0) return fail7(usage2);
     const prefix2 = positionals.length > 1 ? positionals[0] : void 0;
     const session2 = await withinServiceWait(
       resolveLiveSession(config, prefix2, "service run"),
-      deadline
+      wait
     );
     const recipes = await withinServiceWait(
       api(config, "GET", `/sessions/${session2.id}/recipes`),
-      deadline
+      wait
     );
     const recipe = recipes.find((entry) => entry.name === name2);
     if (recipe === void 0) {
@@ -11454,34 +12756,43 @@ var serviceRun = async (config, args) => {
         recipes.length === 0 ? `no mend.toml recipes in this worktree \u2014 declare [service.${name2}] first` : `no recipe named "${name2}" \u2014 declared: ${known}`
       );
     }
-    if (wait && recipe.protocol === "udp") {
-      return fail7(`--wait needs a TCP port: ${recipe.name} is UDP, which has no probe`);
-    }
-    if (wait && recipe.command === null) {
-      return fail7(
-        `--wait needs a command Mend starts: ${recipe.name} declares only a port, which Mend adopts with one probe \xB7 run it without --wait, or give the recipe a command`
+    const startRecipe = (startId) => request(config, "POST", `/sessions/${session2.id}/services/recipe`, {
+      name: recipe.name,
+      startId
+    });
+    if (wait !== null) {
+      if (recipe.protocol === "udp") {
+        return fail7(`--wait needs a TCP port: ${recipe.name} is UDP, which has no probe`);
+      }
+      if (recipe.command === null) {
+        return fail7(
+          `--wait needs a command Mend starts: ${recipe.name} declares only a port, which Mend adopts with one probe \xB7 run it without --wait, or give the recipe a command`
+        );
+      }
+      return startServiceWaited(
+        config,
+        session2,
+        { name: recipe.name, port: recipe.port },
+        wait,
+        `starting ${recipe.name} \u2014 waiting for :${recipe.port} to answer\u2026`,
+        startRecipe
       );
     }
     const service2 = await withSpinner(
       recipe.command === null ? `adopting ${recipe.name} on :${recipe.port}\u2026` : recipe.protocol === "udp" ? `starting ${recipe.name} (udp :${recipe.port})\u2026` : `starting ${recipe.name} \u2014 waiting for :${recipe.port} to answer\u2026`,
-      withinServiceWait(
-        mutateService(config, "POST", `/sessions/${session2.id}/services/recipe`, {
-          name: recipe.name
-        }),
-        deadline
-      )
+      mutateService(config, "POST", `/sessions/${session2.id}/services/recipe`, {
+        name: recipe.name
+      })
     );
-    const tunneling2 = willAutoConnect(config, service2, args.includes("--no-connect") || wait);
+    const tunneling2 = willAutoConnect(config, service2, args.includes("--no-connect"));
     say7(`${green7("\u2713")} Service ${service2.label ?? ""} \xB7 ${service2.status}`);
     printServiceEndpoint(config, service2, tunneling2);
     say7(dim7(`  logs: mend service logs ${service2.label ?? service2.id.slice(0, 8)}`));
-    failUnlessAnswered(config, service2, wait);
     if (tunneling2) await autoConnect(config, service2);
     return;
   }
   const argv = args.slice(dashdash + 1);
   if (argv.length === 0) return fail7(usage2);
-  const head = args.slice(0, dashdash);
   const portFlag = head.indexOf("--port");
   const port = portFlag === -1 ? Number.NaN : Number(head[portFlag + 1]);
   if (!Number.isInteger(port) || port < 1 || port > 65535) return fail7(usage2);
@@ -11493,34 +12804,33 @@ var serviceRun = async (config, args) => {
   if (http && https) return fail7(usage2);
   const browserScheme = https ? "https" : http ? "http" : null;
   if (protocol === "udp" && browserScheme !== null) return fail7(usage2);
-  if (protocol === "udp" && wait) {
+  if (protocol === "udp" && wait !== null) {
     return fail7("--wait needs a TCP port: UDP has no probe, so nothing could be waited for");
   }
-  const prefix = head.find(
-    (a, i) => !a.startsWith("--") && (portFlag === -1 || i !== portFlag + 1) && (nameFlag === -1 || i !== nameFlag + 1)
-  );
-  const session = await withinServiceWait(
-    resolveLiveSession(config, prefix, "service run"),
-    deadline
-  );
+  const prefix = serviceRunPositionals(head)[0];
+  const session = await withinServiceWait(resolveLiveSession(config, prefix, "service run"), wait);
+  const body = { argv, port, name, protocol, browserScheme };
+  if (wait !== null) {
+    return startServiceWaited(
+      config,
+      session,
+      { name: name ?? argv[0] ?? "service", port },
+      wait,
+      `starting ${name ?? argv[0]} \u2014 waiting for :${port} to answer\u2026`,
+      (startId) => request(config, "POST", `/sessions/${session.id}/services/run`, {
+        ...body,
+        startId
+      })
+    );
+  }
   const service = await withSpinner(
     protocol === "udp" ? `starting ${name ?? argv[0]} (udp :${port})\u2026` : `starting ${name ?? argv[0]} \u2014 waiting for :${port} to answer\u2026`,
-    withinServiceWait(
-      mutateService(config, "POST", `/sessions/${session.id}/services/run`, {
-        argv,
-        port,
-        name,
-        protocol,
-        browserScheme
-      }),
-      deadline
-    )
+    mutateService(config, "POST", `/sessions/${session.id}/services/run`, body)
   );
-  const tunneling = willAutoConnect(config, service, head.includes("--no-connect") || wait);
+  const tunneling = willAutoConnect(config, service, head.includes("--no-connect"));
   say7(`${green7("\u2713")} Service ${service.label ?? ""} \xB7 ${service.status}`);
   printServiceEndpoint(config, service, tunneling);
   say7(dim7(`  logs: mend service logs ${service.label ?? service.id.slice(0, 8)}`));
-  failUnlessAnswered(config, service, wait);
   if (tunneling) await autoConnect(config, service);
 };
 var serviceLogs = async (config, args) => {
@@ -11748,8 +13058,9 @@ var serviceCommand = async (config, args) => {
     case "connect":
       return serviceConnect(config, rest);
     case "list":
+      return serviceList(config, rest);
     case void 0:
-      return serviceList(config);
+      return serviceList(config, []);
     case "logs":
       return serviceLogs(config, rest);
     case "restart":
@@ -12882,7 +14193,7 @@ var printJson = (value) => {
 `);
 };
 var outputOnTerminal = false;
-var stdoutErrorsHandled = false;
+var recordedOutput = false;
 var outputStopped = false;
 var restoreTerminal = () => {
   if (!outputOnTerminal || process.stdout.isTTY !== true) return;
@@ -12890,13 +14201,17 @@ var restoreTerminal = () => {
   process.stdout.write(`${TERMINAL_MODES_RESET}\x1B[0m`);
 };
 process.once("exit", restoreTerminal);
+var onClosedPipe = (error) => {
+  if (error.code !== "EPIPE") throw error;
+  if (recordedOutput) return;
+  process.exit(0);
+};
+process.stdout.on("error", onClosedPipe);
+process.stderr.on("error", onClosedPipe);
 var writeOutput = (bytes) => {
   if (outputStopped) return Promise.reject(new Error("stopped by a signal"));
   if (process.stdout.isTTY === true) outputOnTerminal = true;
-  if (!stdoutErrorsHandled) {
-    stdoutErrorsHandled = true;
-    process.stdout.on("error", () => void 0);
-  }
+  recordedOutput = true;
   return new Promise((resolve8, reject) => {
     process.stdout.write(bytes, (error) => {
       if (error === null || error === void 0) resolve8();
@@ -13076,26 +14391,57 @@ var resolveAnySession = async (config, word) => {
   if ("error" in picked) return fail7(picked.error);
   return picked.session;
 };
+var serviceLogsTarget = async (config, needle, sessionWord) => {
+  const session = sessionWord === null ? null : await resolveAnySession(config, sessionWord);
+  const picked = pickServiceAttempt(
+    await fetchServiceViews(config, true),
+    needle,
+    session?.id ?? null
+  );
+  if ("error" in picked) return fail7(picked.error);
+  return { processId: picked.processId, again: `mend logs --service ${needle}` };
+};
 var logsCommand = async (config, args) => {
   chromeToStderr();
   const parsed = parseLogsArgs(args);
   if ("error" in parsed) return fail7(`${parsed.error} \xB7 ${usageOf("logs")}`);
-  const { session: word, follow, from, process: processPrefix } = parsed.args;
-  const session = word === null ? await resolveLiveSession(config, void 0, "logs") : await resolveAnySession(config, word);
-  const detail = await api(config, "GET", `/sessions/${session.id}`);
-  const picked = pickProcess(detail, processPrefix);
-  if ("error" in picked) return fail7(`session ${session.id.slice(0, 8)} \xB7 ${picked.error}`);
-  const target = picked.process;
-  if (target.id === void 0 || target.sealantSessionId === null) {
-    return fail7(
-      `session ${session.id.slice(0, 8)} \xB7 this process has no recorded terminal (an adopted port, or a server older than process ids)`
-    );
+  const { session: word, follow, from, process: processPrefix, service } = parsed.args;
+  let target;
+  if (service !== null) {
+    target = await serviceLogsTarget(config, service, word);
+  } else {
+    const session = word === null ? await resolveLiveSession(config, void 0, "logs") : await resolveAnySession(config, word);
+    const id8 = session.id.slice(0, 8);
+    const detail = await api(config, "GET", `/sessions/${session.id}`);
+    const picked = pickProcess(detail, processPrefix);
+    if ("error" in picked) {
+      const asService = processPrefix === null ? null : pickServiceAttempt(await fetchServiceViews(config, true), processPrefix, session.id);
+      if (asService === null || "error" in asService && !asService.named) {
+        return fail7(`session ${id8} \xB7 ${picked.error}`);
+      }
+      if ("error" in asService) return fail7(`session ${id8} \xB7 ${asService.error}`);
+      target = {
+        processId: asService.processId,
+        again: `mend logs ${id8} --process ${processPrefix}`
+      };
+    } else {
+      const chosen = picked.process;
+      if (chosen.id === void 0 || chosen.sealantSessionId === null) {
+        return fail7(
+          `session ${id8} \xB7 this process has no recorded terminal (an adopted port, or a server older than process ids)`
+        );
+      }
+      target = {
+        processId: chosen.id,
+        again: processPrefix === null ? `mend logs ${id8}` : `mend logs ${id8} --process ${processPrefix}`
+      };
+    }
   }
   stopOutputOnSignal(
-    follow ? `stopped watching \xB7 the process keeps running \xB7 mend logs ${session.id.slice(0, 8)} --follow` : "stopped reading the record"
+    follow ? `stopped watching \xB7 the process keeps running \xB7 ${target.again} --follow` : "stopped reading the record"
   );
   try {
-    const last = await writeProcessLogs(config, target.id, from, follow);
+    const last = await writeProcessLogs(config, target.processId, from, follow);
     restoreTerminal();
     if (follow) say7(dim7(`
 record ended \xB7 ${last.status} \xB7 next sequence ${last.next}`));
@@ -13112,7 +14458,7 @@ var waitCommand = async (config, args) => {
   if ("error" in parsed) return fail7(`${parsed.error} \xB7 ${usageOf("wait")}`);
   const { session: word, timeoutMs, json: json2, process: processPrefix } = parsed.args;
   const deadline = timeoutMs === null ? null : clock.now() + timeoutMs;
-  const after = `${Math.round((timeoutMs ?? 0) / 1e3)} s`;
+  const after = durationLine(timeoutMs ?? 0);
   const timedOut = async (session2, processId2, last) => {
     say7(
       session2 === null ? `${amber2("\xB7")} no session found within ${after}` : `${amber2("\xB7")} session ${session2.id.slice(0, 8)} \xB7 still running after ${after} \xB7 the command keeps running`
@@ -13674,7 +15020,7 @@ var dashboard = async (config, options = {}) => {
     );
     process.exit(rerun.status ?? 0);
   }
-  const { runDashboard } = await import("./dashboard-CEJN6IOO.js");
+  const { runDashboard } = await import("./dashboard-RAZDVFR7.js");
   const agentShare = await startShareIfBridge(config);
   const tunnels = options.noTunnel === true || serverIsLocal(config) ? null : createServiceTunnels({
     listServices: () => fetchServices(config),