byollm 0.1.0-alpha.63 → 0.1.0-alpha.65

package/README.md

@@ -1,5 +1,5 @@
 > [!WARNING]
-> **Alpha (`0.1.0-alpha.63`) — under active development. Don't use this yet.**
+> **Alpha (`0.1.0-alpha.65`) — under active development. Don't use this yet.**
 >
 > Install it deliberately: `npx byollm@alpha`, or `npm install byollm@alpha`.
 >
@@ -85,7 +85,7 @@
 > packages published and `@byollm/server` did not: a Sigstore
 > transparency-log 409 on its provenance attestation. The workflow's
 > "already published" guard correctly refuses to resume a partial publish,
-> so `0.1.0-alpha.63` is that release, whole.
+> so `0.1.0-alpha.65` is that release, whole.
 >
 > If you run the Supabase adapter, `alpha.21` needs
 > `20260819010000_completed_by_lease_id.sql`: alpha.19 shipped §3.6's

package/dist/bin.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   main
-} from "./chunk-J4GXTVXX.js";
+} from "./chunk-HM5G6ZUG.js";
 
 // src/bin.ts
 process.exitCode = await main(process.argv.slice(2));

package/dist/{chunk-J4GXTVXX.js → chunk-HM5G6ZUG.js}

@@ -51,7 +51,7 @@ function asHttpOrigin(candidate) {
 }
 
 // src/cli.ts
-import { mkdir as mkdir9, readFile as readFile9, rm as rm5, stat as stat3, writeFile as writeFile9 } from "fs/promises";
+import { mkdir as mkdir9, readFile as readFile10, rm as rm5, stat as stat3, writeFile as writeFile10 } from "fs/promises";
 import { hostname, userInfo } from "os";
 import { dirname as dirname10 } from "path";
 import { createInterface as createInterface2 } from "readline/promises";
@@ -229,7 +229,15 @@ ${stderr}`);
         finish({
           ok: false,
           code: authFailed ? "unauthorized" : "backend-error",
-          message: authFailed ? `${displayName} is not signed in` : stderr.trim() === "" ? `${displayName} exited with status ${String(code)}` : `${displayName} failed: ${firstLine(stderr)}`,
+          message: authFailed ? `${displayName} is not signed in` : stderr.trim() !== "" ? `${displayName} failed: ${firstLine(stderr)}` : (
+            /* Nothing on stderr does not mean nothing was said. An
+               agentic CLI writes its errors to stdout — that is where
+               "Failed to authenticate" arrived — and reporting a bare
+               exit code while holding the explanation is the one thing a
+               diagnostic must not do. No new exposure: stdout already
+               goes to the site on success. */
+            stdout.trim() !== "" ? `${displayName} failed: ${firstLine(stdout)}` : `${displayName} exited with status ${String(code)}`
+          ),
           retryable: false,
           durationMs
         });
@@ -256,7 +264,31 @@ var AUTH_FAILURE = [
   /\bnot authenticated\b/,
   /\bauthentication failed\b/,
   /\binvalid api key\b/,
-  /\b401 unauthorized\b/
+  /\b401 unauthorized\b/,
+  /**
+   * The expiry family — Todd's Mac, 2026-08-31, and the reason this list grew.
+   *
+   * The CLI said "Failed to authenticate. API Error: 401 OAuth access token
+   * has expired. Re-authenticate to continue." and not one pattern above
+   * matched it: the list had "authentication failed" and the CLI wrote the
+   * same two words in the other order, and it had "401 unauthorized" against
+   * a 401 that named OAuth instead. So a signed-out backend was reported as
+   * `backend-error`, the service was not withdrawn, and the sentence that
+   * reached the person was "the claude CLI exited with status 1".
+   *
+   * An expired token is the *common* case in a subscription CLI — it is what
+   * happens to everybody eventually, on a machine that was working
+   * yesterday — and it was the one the corpus lacked.
+   *
+   * "failed to authenticate" was in this list for about a minute. The test
+   * below refused it: "the guard had failed to authenticate the visitor's
+   * papers" is a sentence a model can write, and matching it would withdraw a
+   * service that works. The two that remain are auth machinery talking about
+   * itself, which prose has little reason to imitate — and Todd's message
+   * contained both, so nothing was lost by dropping the loose one.
+   */
+  /\baccess token has expired\b/,
+  /\bre-?authenticate\b/
 ];
 function isAuthFailure(output) {
   const text = output.toLowerCase();
@@ -368,6 +400,7 @@ function resolveUncached(binary, platform2, source, npmPackage) {
 var ClaudeCliBackend = class {
   id = "claude-cli";
   class = "process";
+  signIn = "run `claude` in a terminal";
   #binary;
   /**
    * @param binary - which executable to run. Defaults to `claude` and is
@@ -479,6 +512,7 @@ function codexArgv(model) {
 var CodexCliBackend = class {
   id = "codex-cli";
   class = "process";
+  signIn = "run `codex login`";
   #binary;
   /**
    * @param binary - which executable to run. Defaults to `codex` and is **not
@@ -1235,6 +1269,30 @@ var BOTH_KINDS = Object.freeze([
   "llm.generate",
   "llm.chat"
 ]);
+async function detect(id, model) {
+  try {
+    const backend = createBackend(id, {});
+    const health = await backend.health();
+    if (!health.healthy) {
+      return {
+        installed: false,
+        answers: void 0,
+        ...health.detail === void 0 ? {} : { detail: health.detail }
+      };
+    }
+    if (backend.canary === void 0) {
+      return { installed: true, answers: void 0 };
+    }
+    const proof = await backend.canary(model);
+    return {
+      installed: true,
+      answers: proof.healthy,
+      ...proof.detail === void 0 ? {} : { detail: proof.detail }
+    };
+  } catch {
+    return { installed: false, answers: void 0 };
+  }
+}
 async function detectInstalled(id) {
   try {
     const backend = createBackend(id, {});
@@ -1249,7 +1307,7 @@ var yes = (answer, fallback) => {
   if (text === "") return fallback;
   return /^y(es)?$/.test(text);
 };
-async function runSetup(paths, io, detector = detectInstalled, probe = () => probeLocalServers()) {
+async function runSetup(paths, io, detector = detectInstalled, probe = () => probeLocalServers(), verifier = detect) {
   if (!io.interactive) {
     io.err(
       "byollm setup needs a terminal it can ask questions in.\nWrite ~/.byollm/config.json by hand instead: https://docs.byollm.cloud/guides/models\n"
@@ -1258,13 +1316,27 @@ async function runSetup(paths, io, detector = detectInstalled, probe = () => pro
   }
   const existing = await readExisting(paths.config);
   if (existing !== void 0) {
-    io.out(
-      `You already have a config at ${paths.config}.
-It has ${String(Object.keys(existing.services).length)} service(s). Setup will not change it.
+    const count = Object.keys(existing.services).length;
+    if (count > 0) {
+      io.out(
+        `You already have a config at ${paths.config}.
+It has ${String(count)} service(s). Setup will not change it.
 Run \`byollm services\` to see what it does, or edit that file.
+`
+      );
+      return { wrote: false, services: [] };
+    }
+    io.out(
+      `
+Your config at ${paths.config} has no services in it, so nothing
+can run yet. That is how versions before alpha.44 left it.
 `
     );
-    return { wrote: false, services: [] };
+    const go = await io.ask("  Set it up now? [Y/n] ");
+    if (!yes(go, true)) {
+      io.out("  Left alone. Nothing was changed.\n");
+      return { wrote: false, services: [] };
+    }
   }
   io.out(`
 Setting up byollm. Change any of it later in ${paths.config}.
@@ -1283,6 +1355,16 @@ Setting up byollm. Change any of it later in ${paths.config}.
     io.out(`
 Found the \`${cli.binary}\` CLI.
 `);
+    const proof = await verifier(cli.id, cli.model);
+    if (proof.answers === false) {
+      io.out(
+        `  It is installed but cannot answer yet \u2014 it needs signing in.
+  Run \`${cli.binary}\` in a terminal, sign in, then rerun this.
+  Setting it up anyway; nothing will route to it until it can
+  answer, and \`byollm status\` will keep saying so.
+`
+      );
+    }
     io.out(
       `  Uses your ${cli.plan}, for YOUR OWN jobs only \u2014 never shared with a
   team, whatever the config says. Someone else's terms are not yours
@@ -2705,6 +2787,7 @@ function daemonPaths(root = defaultRoot()) {
     ingressLog: join3(root, "ingress.log"),
     budgets: join3(root, "budgets.json"),
     spend: join3(root, "spend.json"),
+    serviceStates: join3(root, "services.json"),
     spentGrants: join3(root, "spent-grants.json"),
     keys: join3(root, "keys.json"),
     pauseFlag: join3(root, "paused"),
@@ -2717,6 +2800,39 @@ function defaultRoot() {
   return process.env["BYOLLM_HOME"] ?? join3(homedir(), ".byollm");
 }
 
+// src/site-outcome.ts
+var SERVICE_UNAVAILABLE = "a device service is unavailable \u2014 its owner has been told";
+var FOR_SITE = Object.freeze({
+  "backend-unreachable": {
+    code: "service_unavailable",
+    message: SERVICE_UNAVAILABLE
+  },
+  "backend-error": {
+    code: "service_unavailable",
+    message: SERVICE_UNAVAILABLE
+  },
+  "model-not-found": {
+    code: "service_unavailable",
+    message: SERVICE_UNAVAILABLE
+  },
+  unauthorized: {
+    code: "service_unavailable",
+    message: SERVICE_UNAVAILABLE
+  },
+  timeout: {
+    code: "timeout",
+    message: "the device did not answer in time"
+  },
+  "output-too-large": {
+    code: "output-too-large",
+    message: "the answer was too large to return"
+  },
+  canceled: { code: "canceled", message: "the job was canceled" }
+});
+function outcomeForSite(code) {
+  return FOR_SITE[code];
+}
+
 // src/runner.ts
 import {
   RETIREMENT_WINDOW_MS,
@@ -2915,7 +3031,15 @@ var Runner = class {
    * daemon then receives no work for it, which is the correct outcome and one
    * the owner can see in `byollm status`.
    */
+  /**
+   * What the last probe learned about each service, for the owner's surfaces.
+   *
+   * Read by `byollm status`, by `byollm connect`'s report and by the daemon's
+   * own output — one answer, three renderings, through `serviceLine`.
+   */
+  serviceStates = /* @__PURE__ */ new Map();
   async detectCapabilities(options = {}) {
+    this.serviceStates = /* @__PURE__ */ new Map();
     const capabilities = [];
     const probed = /* @__PURE__ */ new Map();
     for (const route of this.#options.loaded.routes) {
@@ -2925,9 +3049,33 @@ var Runner = class {
         const backend = this.#backendFor(route);
         const health = await backend.health();
         usable = health.healthy && (health.models.length === 0 || modelPresent(health.models, route.model));
+        const remedy = backend.signIn === void 0 ? {} : { signIn: backend.signIn };
+        if (!health.healthy) {
+          this.serviceStates.set(route.service, {
+            state: { kind: "missing" },
+            ...remedy
+          });
+        } else if (options.canary !== true || backend.canary === void 0) {
+          this.serviceStates.set(route.service, {
+            state: { kind: "unknown", model: route.model },
+            ...remedy
+          });
+        } else {
+          this.serviceStates.set(route.service, {
+            state: { kind: "answers", model: route.model },
+            ...remedy
+          });
+        }
         if (usable && options.canary === true && backend.canary !== void 0) {
           const proof = await backend.canary(route.model);
           if (!proof.healthy) {
+            this.serviceStates.set(route.service, {
+              state: {
+                kind: "signed-out",
+                ...proof.detail === void 0 ? {} : { detail: proof.detail }
+              },
+              ...remedy
+            });
             usable = false;
             this.#unauthenticated.add(route.service);
             this.#options.onEvent?.({
@@ -3320,12 +3468,34 @@ var Runner = class {
           detail: result.message
         });
       }
-      const outcome = result.ok ? { outcome: "ok", text: result.text } : result.code === "canceled" ? { outcome: "canceled" } : {
-        outcome: "error",
-        code: result.code,
-        message: result.message,
-        retryable: result.retryable
-      };
+      const outcome = result.ok ? { outcome: "ok", text: result.text } : result.code === "canceled" ? { outcome: "canceled" } : (
+        /**
+         * The class, never the text — a8137b5.
+         *
+         * `result.message` is the CLI's own words and stays with the
+         * owner: the event above, the ingress log below, `byollm status`
+         * and Your Devices. It does not travel, for two reasons.
+         *
+         * It quotes the owner's machine — paths, usernames, config
+         * locations, account emails all live in CLI errors, and a
+         * stranger's page is not where those go.
+         *
+         * And it names the service. "the claude CLI is not signed in"
+         * tells a site which model answered, which is the one thing the
+         * disclosure fence exists to prevent — arriving through the error
+         * path because nobody was watching the error path. Every message
+         * named its backend, so every failure leaked what every success
+         * is careful to hide.
+         *
+         * `retryable` still travels: whether to try again is the site's
+         * decision and says nothing about whose machine it was.
+         */
+        {
+          outcome: "error",
+          ...outcomeForSite(result.code),
+          retryable: result.retryable
+        }
+      );
       await this.#options.ingress.recordOutcome({
         at: this.#now(),
         jobId: job.id,
@@ -4154,7 +4324,37 @@ WantedBy=default.target
     deactivate: [["schtasks", "/delete", "/tn", SERVICE_LABEL, "/f"]],
     query: ["schtasks", "/query", "/tn", SERVICE_LABEL],
     logPath,
-    supervisor: "Task Scheduler"
+    supervisor: "Task Scheduler",
+    /**
+     * The Startup folder, for a machine that will not register a task.
+     *
+     * A `.cmd` here runs at logon for this user, needs no elevation and no
+     * policy exemption, and cannot be refused. What it does not do is restart
+     * byollm if it stops — which is the whole reason the task XML exists — so
+     * that is said out loud rather than left for somebody to discover when a
+     * crash goes unnoticed.
+     *
+     * `start ""` so the shim exits immediately and the logon does not wait on
+     * a long-running process; the empty title is required because `start`
+     * reads a first quoted argument as the window title.
+     */
+    fallback: {
+      unitPath: join4(
+        process.env["APPDATA"] ?? root,
+        "Microsoft",
+        "Windows",
+        "Start Menu",
+        "Programs",
+        "Startup",
+        "byollm.cmd"
+      ),
+      unitContents: `@echo off\r
+rem byollm \u2014 run an app's LLM jobs on your own models\r
+start "" /b "${execPath}" "${scriptPath}" run >> "${logPath}" 2>&1\r
+`,
+      supervisor: "the Startup folder",
+      caveat: "It starts byollm when you log in. It does not restart it if it stops \u2014 Task Scheduler would have, and this machine would not register the task."
+    }
   };
 }
 async function serviceIsInstalled(target) {
@@ -4201,6 +4401,11 @@ async function serviceState(plan, run2) {
   if (/\bRunning\b/.test(result.output)) return { state: "running" };
   return { state: "installed", detail: "registered, not running" };
 }
+function refusalOf(command, result) {
+  const said = result.output.trim();
+  const denied = /access is denied|requires elevation|0x80070005/i.test(said);
+  return denied ? `${command.join(" ")} \u2014 this machine will not let you register a scheduled task (no administrator rights, or IT policy).` : `${command.join(" ")} \u2014 exit ${String(result.code)}` + (said === "" ? "" : `: ${said}`);
+}
 async function installService(target, run2) {
   const plan = servicePlan(target);
   const refusal = refuseToSupervise(target.scriptPath);
@@ -4213,16 +4418,46 @@ async function installService(target, run2) {
     const result = await run2(command);
     const mayFail = plan.platform === "darwin" && index === 0;
     if (result.code !== 0 && !mayFail) {
+      const fallback = plan.fallback;
+      if (fallback !== void 0) {
+        const fell = await mkdir8(dirname9(fallback.unitPath), {
+          recursive: true
+        }).then(
+          () => writeFile8(fallback.unitPath, fallback.unitContents, "utf8")
+        ).then(
+          () => true,
+          () => false
+        );
+        if (fell) {
+          return {
+            ok: true,
+            plan,
+            lines: [
+              `${plan.supervisor} would not register the task, so byollm is`,
+              `set to start from ${fallback.supervisor} instead.`,
+              "",
+              `  ${fallback.caveat}`,
+              "",
+              `  ${refusalOf(command, result)}`,
+              "",
+              `  startup:  ${fallback.unitPath}`,
+              `  log:      ${plan.logPath}`,
+              `  check:    byollm status`,
+              `  remove:   byollm uninstall`
+            ]
+          };
+        }
+      }
       return {
         ok: false,
         plan,
         lines: [
           `wrote ${plan.unitPath}, but ${plan.supervisor} refused it:`,
           "",
-          `  ${command.join(" ")}`,
-          `  exit ${String(result.code)}${result.output.trim() === "" ? "" : `: ${result.output.trim()}`}`,
+          `  ${refusalOf(command, result)}`,
           "",
-          `The daemon is not supervised. \`byollm run\` still works in a terminal.`
+          `The daemon is not supervised. \`byollm run\` still works in a terminal,`,
+          `and is the way to keep serving until this is sorted.`
         ]
       };
     }
@@ -4290,6 +4525,95 @@ var spawnCommand = async (command) => {
   });
 };
 
+// src/service-line.ts
+function serviceLine(input) {
+  const { service, device, state } = input;
+  switch (state.kind) {
+    case "answers":
+      return { line: `${service} \u2014 ${state.model}` };
+    case "unknown":
+      return { line: `${service} \u2014 ${state.model}` };
+    case "signed-out": {
+      const remedy = input.signIn ?? "sign it in";
+      return {
+        line: `${service} \u2014 needs sign-in on ${device}: ${remedy}`,
+        ...state.detail === void 0 ? {} : { detail: state.detail }
+      };
+    }
+    case "missing": {
+      const remove = input.removeWith ?? `remove it from ~/.byollm/config.json`;
+      return {
+        line: `${service} \u2014 not found on ${device}: install it, or ${remove}`
+      };
+    }
+  }
+}
+function renderServices(states, device) {
+  const lines = [];
+  for (const [service, report2] of states) {
+    const said = serviceLine({
+      service,
+      device,
+      state: report2.state,
+      ...report2.signIn === void 0 ? {} : { signIn: report2.signIn }
+    });
+    lines.push(`  ${said.line}`);
+    if (said.detail !== void 0) lines.push(`    ${said.detail}`);
+  }
+  return lines;
+}
+function authNote(input) {
+  const { report: report2 } = input;
+  if (report2 === void 0) return void 0;
+  if (report2.state.kind === "answers") return void 0;
+  if (report2.state.kind === "unknown") return void 0;
+  return serviceLine({
+    service: input.service,
+    device: input.device,
+    state: report2.state,
+    ...report2.signIn === void 0 ? {} : { signIn: report2.signIn }
+  });
+}
+
+// src/service-states.ts
+import { readFile as readFile9, writeFile as writeFile9 } from "fs/promises";
+import { z as z7 } from "zod";
+var Stored = z7.record(
+  z7.string(),
+  z7.object({
+    state: z7.discriminatedUnion("kind", [
+      z7.object({ kind: z7.literal("answers"), model: z7.string() }),
+      z7.object({
+        kind: z7.literal("signed-out"),
+        detail: z7.string().optional()
+      }),
+      z7.object({ kind: z7.literal("missing") }),
+      z7.object({ kind: z7.literal("unknown"), model: z7.string() })
+    ]),
+    signIn: z7.string().optional()
+  })
+);
+async function writeServiceStates(path, states) {
+  const out = {};
+  for (const [service, report2] of states) out[service] = report2;
+  try {
+    await writeFile9(path, `${JSON.stringify(out, null, 2)}
+`, "utf8");
+  } catch {
+  }
+}
+async function readServiceStates(path) {
+  try {
+    const parsed = Stored.safeParse(
+      JSON.parse(await readFile9(path, "utf8"))
+    );
+    if (!parsed.success) return /* @__PURE__ */ new Map();
+    return new Map(Object.entries(parsed.data));
+  } catch {
+    return /* @__PURE__ */ new Map();
+  }
+}
+
 // src/cli.ts
 var USAGE = `byollm \u2014 run an app's LLM jobs on your own models.
 
@@ -4435,7 +4759,7 @@ async function commandName(paths, args, io) {
     return 0;
   }
   await mkdir9(dirname10(paths.label), { recursive: true });
-  await writeFile9(paths.label, `${next.slice(0, 120)}
+  await writeFile10(paths.label, `${next.slice(0, 120)}
 `, { mode: 384 });
   io.out(
     `This device will pair as ${next.slice(0, 120)}.
@@ -4455,7 +4779,7 @@ function connectTarget(args) {
 async function labelFor(paths, flag) {
   if (flag !== void 0 && flag !== "") return flag.slice(0, 120);
   try {
-    const saved = (await readFile9(paths.label, "utf8")).trim();
+    const saved = (await readFile10(paths.label, "utf8")).trim();
     if (saved !== "") return saved.slice(0, 120);
   } catch {
   }
@@ -4524,9 +4848,21 @@ ${wrap(
     ingress
   });
   const capabilities = await runner.detectCapabilities({ canary: true });
+  await writeServiceStates(paths.serviceStates, runner.serviceStates);
+  {
+    const lines = renderServices(
+      runner.serviceStates,
+      await labelFor(paths, name)
+    );
+    if (lines.length > 0) io.out(`
+services
+${lines.join("\n")}
+`);
+  }
+  await writeServiceStates(paths.serviceStates, runner.serviceStates);
   if (capabilities.length === 0) {
     io.err(
-      "\n0 backends are healthy, so nothing will route to this device yet.\nPairing anyway \u2014 set a model server up (docs.byollm.cloud/guides/models),\nthen check `byollm services`. Work starts arriving on its own once one is healthy.\n"
+      "\nNothing will route to this device yet.\nPairing anyway \u2014 work starts arriving on its own once a service can\nanswer. `byollm status` says where each one stands.\n"
     );
   }
   io.out(`
@@ -4634,7 +4970,7 @@ function reportSkipped(pairings, io) {
 async function retireAllowlist(paths, io) {
   let raw;
   try {
-    raw = await readFile9(paths.allowlist, "utf8");
+    raw = await readFile10(paths.allowlist, "utf8");
   } catch {
     return;
   }
@@ -4931,6 +5267,8 @@ async function commandStatus(paths, io, service) {
     byService.set(route.service, entry);
   }
   io.out("\nservices\n");
+  const recorded = await readServiceStates(paths.serviceStates);
+  const deviceName = await labelFor(paths, void 0);
   const declared = Object.entries(loaded.config.services);
   if (declared.length === 0) {
     io.out("  (none configured)\n");
@@ -4945,6 +5283,11 @@ async function commandStatus(paths, io, service) {
       hasRelay
     });
     const scope = `${summary.scope} (${summary.audience})` + (summary.narrowedBy === void 0 ? "" : ` \u2014 ${summary.narrowedBy}`);
+    const authLine = authNote({
+      service: name,
+      device: deviceName,
+      report: recorded.get(name)
+    });
     io.out(`  ${name}
 `);
     io.out(`      ${shown}
@@ -4960,6 +5303,14 @@ async function commandStatus(paths, io, service) {
       `      ${scope} \xB7 ${says.length === 0 ? "not offered \u2014 see the problems below" : says.join(" \xB7 ")}
 `
     );
+    if (authLine !== void 0) {
+      io.out(`      ${authLine.line}
+`);
+      if (authLine.detail !== void 0) {
+        io.out(`        ${authLine.detail}
+`);
+      }
+    }
   }
   for (const held of loaded.withheld) {
     io.out(
@@ -5082,7 +5433,7 @@ function indent(text) {
 async function commandPause(paths, pause, io) {
   await mkdir9(paths.root, { recursive: true });
   if (pause) {
-    await writeFile9(paths.pauseFlag, `${(/* @__PURE__ */ new Date()).toISOString()}
+    await writeFile10(paths.pauseFlag, `${(/* @__PURE__ */ new Date()).toISOString()}
 `);
     io.out(
       "paused \u2014 no new work will be claimed. `byollm resume` to start again.\n"
@@ -5178,7 +5529,7 @@ async function commandOffer(paths, args, io) {
   }
   let raw;
   try {
-    raw = await readFile9(paths.config, "utf8");
+    raw = await readFile10(paths.config, "utf8");
   } catch {
     io.err(
       `no config at ${paths.config} \u2014 nothing to offer yet.
@@ -5281,7 +5632,7 @@ Offer ${serviceKey} to your team?`
     };
   }
   await mkdir9(dirname10(paths.config), { recursive: true });
-  await writeFile9(paths.config, `${JSON.stringify(result.data, null, 2)}
+  await writeFile10(paths.config, `${JSON.stringify(result.data, null, 2)}
 `);
   const written = result.data.services[serviceKey].spend?.dailyCapCents;
   io.out(
@@ -5491,7 +5842,7 @@ Addresses look like https://app.example.com or localhost:8080.
 }
 
 // src/index.ts
-var DAEMON_VERSION = "0.1.0-alpha.63";
+var DAEMON_VERSION = "0.1.0-alpha.65";
 function daemonVersion() {
   return {
     daemon: DAEMON_VERSION,
@@ -5543,4 +5894,4 @@ export {
   runCli,
   main
 };
-//# sourceMappingURL=chunk-J4GXTVXX.js.map
+//# sourceMappingURL=chunk-HM5G6ZUG.js.map