home-hosted 0.6.5 → 0.6.6

package/AGENTS.md

@@ -247,6 +247,9 @@ either is a last resort, and never an accidental one.
   every entry's child) instead of killing it — a port held by a sibling is a config mistake.
 - **Never expose beyond loopback without auth and a non-default password.** `checkExposure()` is the
   single rule, enforced at startup, on every settings write, and in the UI.
+- **The CLI drives a running panel through `/_hh`, never `/api`.** `down` and `start`/`stop` read
+  run.json's token and speak over loopback through one guard (`assertLocalCall`), so they need no
+  session, password or API token — and a new local command must not open an unauthenticated `/api` route.
 - **UIs are external clients.** Nothing in `src/**` may know a UI's markup or files;
   `$HHOSTED_HOME/.ui` overrides the packaged UI at runtime.
 - **A restore writes only where a config says** — archive allowlist, `origin` matching first,

package/README.md

@@ -79,8 +79,8 @@ some arguments, and the environment you give it:
 { "id": "gateway", "command": "node", "args": ["server.js"], "port": 4000, "autostart": true }
 ```
 
-<sub>Manage them from the panel, `home-hosted status --json`, or `GET /api/state`; `GET /healthz` is
-the same status line for your own monitor, no session needed.</sub>
+<sub>Manage them from the panel, `home-hosted start|stop <id>` from a shell, `home-hosted status --json`,
+or `GET /api/state`; `GET /healthz` is the same status line for your own monitor, no session needed.</sub>
 
 ---
 
@@ -293,6 +293,8 @@ restarts itself), and how hand-edits are validated: [SERVERS.md](./docs/SERVERS.
 | `home-hosted down` | stop it cleanly — supervised processes included, persistent entries left running |
 | `home-hosted restart` | `down`, then `up` |
 | `home-hosted status` | pid, URL, health, uptime, state and log paths (`--json` for scripts) |
+| `home-hosted start <id>` | start one server, leaving the panel and its other servers alone |
+| `home-hosted stop <id>` | stop one server — the panel stays up |
 | `home-hosted set-password` | set the panel password without opening a browser |
 | `home-hosted set-token` | set the API token scripts and agents use (`--generate`, `--clear`) |
 | `home-hosted migrate` | bring `servers.config.json` up to this release's schema (`--dry-run`, `--yes`) |
@@ -311,6 +313,7 @@ up, restart       -c/--config -p/--port --host --open --no-autostart --foregroun
 
 down              (no flags)
 status            --json
+start, stop       <id>   (the server's id in servers.config.json; both need the panel up)
 init              --dir --name --pm --no-install -y/--yes
 set-password      --clear
 set-token         --generate --clear

package/dist/cli.js

@@ -133,6 +133,7 @@ function aliasesOf(def) {
 function findArg(argsDef, name) {
 	for (const [key, def] of Object.entries(argsDef)) {
 		if (def === void 0) continue;
+		if (def.type === "positional") continue;
 		if ((/* @__PURE__ */ new Set([
 			key,
 			kebab(key),
@@ -152,10 +153,15 @@ function findArg(argsDef, name) {
 */
 function rejectUnknownFlags(argv, argsDef) {
 	if (argsDef === void 0 || Object.keys(argsDef).length === 0) return null;
+	let positionals = Object.values(argsDef).filter((def) => def?.type === "positional").length;
 	for (let index = 0; index < argv.length; index++) {
 		const token = argv[index];
 		if (token === "--") return null;
-		if (!token.startsWith("-") || token.length === 1) return `Unexpected argument '${token}'`;
+		if (!token.startsWith("-") || token.length === 1) {
+			if (positionals === 0) return `Unexpected argument '${token}'`;
+			positionals -= 1;
+			continue;
+		}
 		const body = token.startsWith("--") ? token.slice(2) : token.slice(1);
 		const equals = body.indexOf("=");
 		const name = equals === -1 ? body : body.slice(0, equals);
@@ -300,6 +306,50 @@ var init_runtime = __esmMin((() => {
 	NANNY_COMMAND = "__nanny";
 }));
 //#endregion
+//#region src/helpers/version.ts
+var version_exports = /* @__PURE__ */ __exportAll({
+	appVersion: () => appVersion,
+	versionMismatchNote: () => versionMismatchNote
+});
+/**
+* The running release, read from the package manifest.
+*
+* The caller may be `src/**` under tsx or the built `dist/cli.js`, so the manifest
+* is found by walking up rather than by a fixed relative path. `src/cli.ts` keeps
+* its own read because it may only import node builtins statically.
+*/
+function appVersion() {
+	if (cached !== null) return cached;
+	let dir = path.dirname(fileURLToPath(import.meta.url));
+	for (let depth = 0; depth < 4; depth++) {
+		try {
+			const manifest = JSON.parse(fs.readFileSync(path.join(dir, "package.json"), "utf8"));
+			if (manifest.name === "home-hosted" && typeof manifest.version === "string") {
+				cached = manifest.version;
+				return cached;
+			}
+		} catch {}
+		const parent = path.dirname(dir);
+		if (parent === dir) break;
+		dir = parent;
+	}
+	cached = "0.0.0";
+	return cached;
+}
+/**
+* The one line to add when this CLI and the panel it is talking to are not the same
+* release — which is what a linked checkout, a global install and a project pin
+* produce. `null` when they agree.
+*/
+function versionMismatchNote(panelVersion) {
+	const cli = appVersion();
+	return cli === panelVersion ? null : `note: this CLI is ${cli}, the panel is ${panelVersion}`;
+}
+var cached;
+var init_version = __esmMin((() => {
+	cached = null;
+}));
+//#endregion
 //#region src/helpers/cookies.ts
 function parseCookies(header) {
 	const cookies = {};
@@ -893,20 +943,22 @@ password: passwordValueSchema.optional() }).onUndeclaredKey("reject");
 		tls: tlsStatusSchema
 	});
 	appStateSchema = type({
-		control: controlViewSchema,
-		defaults: defaultsSchema,
-		logs: logsSchema,
-		notifications: notificationViewSchema,
-		host: hostViewSchema,
-		backups: backupsViewSchema,
-		configPath: "string",
-		configError: "string | null",
+		"control": controlViewSchema,
+		"defaults": defaultsSchema,
+		"logs": logsSchema,
+		"notifications": notificationViewSchema,
+		"host": hostViewSchema,
+		"backups": backupsViewSchema,
+		"configPath": "string",
+		"configError": "string | null",
 		/** The directory the panel was started from; relative entry paths use it. */
-		projectDir: "string",
+		"projectDir": "string",
 		/** `HHOSTED_HOME`: every file home-hosted owns lives under here. */
-		dataRoot: "string",
-		logsDir: "string",
-		servers: serverViewSchema.array()
+		"dataRoot": "string",
+		"logsDir": "string",
+		/** The release this panel is running. Optional: an older panel does not send one. */
+		"version?": "string",
+		"servers": serverViewSchema.array()
 	});
 	type({
 		type: "\"hello\" | \"state\" | \"log\" | \"server\"",
@@ -1934,11 +1986,13 @@ function buildAppState(deps) {
 		projectDir,
 		dataRoot,
 		logsDir: deps.logsDir,
+		version: appVersion(),
 		servers: deps.views
 	};
 }
 var init_state$1 = __esmMin((() => {
 	init_paths();
+	init_version();
 	init_exposure();
 }));
 //#endregion
@@ -2108,6 +2162,14 @@ var init_backups$1 = __esmMin((() => {
 	nameParam = type({ name: "string >= 1" });
 }));
 //#endregion
+//#region src/helpers/action-result.ts
+/** Unknown ids are 404; a server that exists but cannot act is a 409. */
+function statusForAction(result) {
+	if (result.ok) return 200;
+	return result.error?.startsWith("unknown server") ? 404 : 409;
+}
+var init_action_result = __esmMin((() => {}));
+//#endregion
 //#region src/helpers/deferred.ts
 /**
 * Runs a task after the current response has been written.
@@ -2126,35 +2188,64 @@ var init_deferred = __esmMin((() => {}));
 //#endregion
 //#region src/api/control.ts
 /**
-* The local control channel used by `home-hosted down`.
+* The local control channel used by `home-hosted down` and `home-hosted start|stop`.
 *
 * It is deliberately outside `/api` (so no session is needed) and guarded by a
 * token that only the owner of `run.json` can read, plus a loopback check: a
 * different local user, or anyone on the network, gets nothing.
 */
 function createControlRoute(deps) {
-	return appFactory.createApp().post("/shutdown", describeRoute({
-		tags: ["panel"],
-		summary: "Stop the panel and everything it supervises (local token required)",
-		responses: {
-			200: { description: "Stopping" },
-			403: { description: "Bad token, or not a local caller" }
-		}
-	}), (c) => {
+	/** The one place the local channel's credentials are read. */
+	function assertLocalCall(c, action) {
 		const token = c.req.header("x-home-hosted-token");
 		if (token === void 0 || token !== deps.runtimeToken) throw new DetailedError("invalid token", {
 			statusCode: 403,
 			code: "INVALID_TOKEN"
 		});
-		if (!isLoopbackRequest(c)) throw new DetailedError("only this machine may stop the control panel", {
+		if (!isLoopbackRequest(c)) throw new DetailedError(`only this machine may ${action}`, {
 			statusCode: 403,
 			code: "NOT_LOOPBACK"
 		});
+	}
+	return appFactory.createApp().post("/shutdown", describeRoute({
+		tags: ["panel"],
+		summary: "Stop the panel and everything it supervises (local token required)",
+		responses: {
+			200: { description: "Stopping" },
+			403: { description: "Bad token, or not a local caller" }
+		}
+	}), (c) => {
+		assertLocalCall(c, "stop the control panel");
 		afterResponse(deps.onShutdown, (error) => logger.error("shutdown failed", error));
 		return c.json({ ok: true });
+	}).post("/servers/:id/start", describeRoute({
+		tags: ["panel"],
+		summary: "Start one server, without a session (local token required)",
+		responses: {
+			200: { description: "Started" },
+			403: { description: "Bad token, or not a local caller" },
+			404: { description: "No such server" }
+		}
+	}), async (c) => {
+		assertLocalCall(c, "start or stop a server");
+		const result = await deps.supervisor.start(c.req.param("id"));
+		return c.json(result, statusForAction(result));
+	}).post("/servers/:id/stop", describeRoute({
+		tags: ["panel"],
+		summary: "Stop one server, without a session (local token required)",
+		responses: {
+			200: { description: "Stopped" },
+			403: { description: "Bad token, or not a local caller" },
+			404: { description: "No such server" }
+		}
+	}), async (c) => {
+		assertLocalCall(c, "start or stop a server");
+		const result = await deps.supervisor.stop(c.req.param("id"));
+		return c.json(result, statusForAction(result));
 	});
 }
 var init_control = __esmMin((() => {
+	init_action_result();
 	init_deferred();
 	init_factory();
 	init_logger();
@@ -2676,38 +2767,6 @@ var init_schema = __esmMin((() => {
 	];
 }));
 //#endregion
-//#region src/helpers/version.ts
-var version_exports = /* @__PURE__ */ __exportAll({ appVersion: () => appVersion });
-/**
-* The running release, read from the package manifest.
-*
-* The caller may be `src/**` under tsx or the built `dist/cli.js`, so the manifest
-* is found by walking up rather than by a fixed relative path. `src/cli.ts` keeps
-* its own read because it may only import node builtins statically.
-*/
-function appVersion() {
-	if (cached !== null) return cached;
-	let dir = path.dirname(fileURLToPath(import.meta.url));
-	for (let depth = 0; depth < 4; depth++) {
-		try {
-			const manifest = JSON.parse(fs.readFileSync(path.join(dir, "package.json"), "utf8"));
-			if (manifest.name === "home-hosted" && typeof manifest.version === "string") {
-				cached = manifest.version;
-				return cached;
-			}
-		} catch {}
-		const parent = path.dirname(dir);
-		if (parent === dir) break;
-		dir = parent;
-	}
-	cached = "0.0.0";
-	return cached;
-}
-var cached;
-var init_version = __esmMin((() => {
-	cached = null;
-}));
-//#endregion
 //#region src/config/parse.ts
 function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -3233,11 +3292,6 @@ var init_store = __esmMin((() => {
 }));
 //#endregion
 //#region src/api/servers/$.routes.ts
-/** Unknown ids are 404; a server that exists but cannot start is a 409. */
-function statusFor(result) {
-	if (result.ok) return 200;
-	return result.error?.startsWith("unknown server") ? 404 : 409;
-}
 function unknownServer(id) {
 	return new DetailedError(`unknown server "${id}"`, {
 		statusCode: 404,
@@ -3387,7 +3441,7 @@ function createServersRoute(deps) {
 		}
 	}), validate("param", idParam), async (c) => {
 		const result = await deps.supervisor.start(c.req.valid("param").id);
-		return c.json(result, statusFor(result));
+		return c.json(result, statusForAction(result));
 	}).post("/:id/stop", describeRoute({
 		tags: ["servers"],
 		summary: "Stop a server",
@@ -3407,7 +3461,7 @@ function createServersRoute(deps) {
 		}
 	}), validate("param", idParam), async (c) => {
 		const result = await deps.supervisor.restart(c.req.valid("param").id);
-		return c.json(result, statusFor(result));
+		return c.json(result, statusForAction(result));
 	}).post("/:id/clear-logs", describeRoute({
 		tags: ["servers"],
 		summary: "Forget the buffered log lines",
@@ -3433,7 +3487,7 @@ function createServersRoute(deps) {
 		const { id } = c.req.valid("param");
 		const result = await deps.supervisor.freePort(id);
 		if (!result.ok) throw new DetailedError(result.error ?? `could not free the port for "${id}"`, {
-			statusCode: statusFor(result),
+			statusCode: statusForAction(result),
 			code: "FREE_PORT_FAILED"
 		});
 		return c.json(result);
@@ -3486,6 +3540,7 @@ function createServersRoute(deps) {
 var idParam, MAX_PENDING_WRITES, serverResponse, serversResponse, okResponse;
 var init_$_routes = __esmMin((() => {
 	init_store();
+	init_action_result();
 	init_factory();
 	init_openapi$1();
 	init_validator();
@@ -3968,6 +4023,7 @@ var daemon_exports = /* @__PURE__ */ __exportAll({
 	newToken: () => newToken,
 	probeRuntime: () => probeRuntime,
 	readRuntime: () => readRuntime,
+	requestControl: () => requestControl,
 	requestShutdown: () => requestShutdown,
 	runtimeSchema: () => runtimeSchema,
 	writeRuntime: () => writeRuntime
@@ -4000,10 +4056,10 @@ function isProcessAlive$1(pid) {
 }
 /** A degraded panel is still answering: a 503 must not read as "not running". */
 async function probeRuntime(runtime, timeoutMs = 2500) {
-	const status = await localRequest(runtime, "/healthz", "GET", void 0, timeoutMs);
+	const answer = await localCall(runtime, "/healthz", "GET", void 0, timeoutMs);
 	return {
-		reachable: status !== null,
-		degraded: status === 503
+		reachable: answer !== null,
+		degraded: answer?.status === 503
 	};
 }
 /**
@@ -4011,15 +4067,36 @@ async function probeRuntime(runtime, timeoutMs = 2500) {
 * shut down cleanly on every platform (a bare signal is not graceful on Windows).
 */
 async function requestShutdown(runtime, timeoutMs = 4e3) {
-	const status = await localRequest(runtime, "/_hh/shutdown", "POST", runtime.token, timeoutMs);
-	return status !== null && status >= 200 && status < 300;
+	const answer = await localCall(runtime, "/_hh/shutdown", "POST", runtime.token, timeoutMs);
+	return answer !== null && answer.status >= 200 && answer.status < 300;
+}
+/**
+* Drives a supervised server from this machine (`home-hosted start`/`stop`). The
+* token comes from run.json, so it needs no session, no password and no API token —
+* only the owner of that 0600 file, talking over loopback.
+*
+* The wait is generous on purpose: a start may have to run a bootstrap, which has a
+* 120s default timeout of its own. Past this it is a wedged panel, not a slow one.
+*/
+async function requestControl(runtime, path, timeoutMs = 15e4) {
+	const answer = await localCall(runtime, path, "POST", runtime.token, timeoutMs);
+	if (answer === null) return null;
+	let body = null;
+	try {
+		body = JSON.parse(answer.body);
+	} catch {}
+	return {
+		status: answer.status,
+		body
+	};
 }
 /**
 * Talks to the panel over loopback. Node's `fetch` cannot be told to accept the
 * self-signed certificate an uploaded TLS pair usually is, which would break
-* `status` and the graceful `down` — so this speaks http/https directly.
+* `status`, the graceful `down` and the local start/stop — so this speaks
+* http/https directly.
 */
-function localRequest(runtime, path, method, token, timeoutMs) {
+function localCall(runtime, path, method, token, timeoutMs) {
 	return new Promise((resolve) => {
 		const url = new URL(`${runtime.probeUrl}${path}`);
 		const secure = url.protocol === "https:";
@@ -4032,8 +4109,15 @@ function localRequest(runtime, path, method, token, timeoutMs) {
 			headers: token === void 0 ? {} : { "x-home-hosted-token": token },
 			timeout: timeoutMs
 		}, (response) => {
-			response.resume();
-			response.once("end", () => resolve(response.statusCode ?? null));
+			let body = "";
+			response.setEncoding("utf8");
+			response.on("data", (chunk) => {
+				body += chunk;
+			});
+			response.once("end", () => resolve({
+				status: response.statusCode ?? 0,
+				body
+			}));
 		});
 		request.once("error", () => resolve(null));
 		request.once("timeout", () => {
@@ -9530,7 +9614,9 @@ async function runUp(flags, entry) {
 	const { daemonLogPath, dataRoot, projectDir } = await Promise.resolve().then(() => (init_paths(), paths_exports));
 	const existing = readRuntime();
 	if (existing !== null && isProcessAlive(existing.pid)) {
-		process.stdout.write(`${green("already running")} (pid ${existing.pid}) at ${existing.url}\n`);
+		process.stdout.write(`${green("already running")} home-hosted ${existing.version} (pid ${existing.pid}) at ${existing.url}\n`);
+		const note = versionMismatchNote(existing.version);
+		if (note !== null) process.stdout.write(`${dim(note)}\n`);
 		process.stdout.write(`${dim("stop it with `home-hosted down`")}\n`);
 		return;
 	}
@@ -9566,7 +9652,7 @@ async function runUp(flags, entry) {
 		if (output.length > 0) process.stderr.write(`${dim(`${daemonLogPath}:`)}\n${output}\n`);
 		process.exit(1);
 	}
-	process.stdout.write(`${green("home-hosted is up")} (pid ${runtime.pid})\n`);
+	process.stdout.write(`${green(`home-hosted ${runtime.version} is up`)} (pid ${runtime.pid})\n`);
 	process.stdout.write(`  ${bold(runtime.url)}\n`);
 	process.stdout.write(`  ${dim(`project ${runtime.projectDir}`)}\n`);
 	process.stdout.write(`  ${dim(`state   ${runtime.dataRoot}`)}\n`);
@@ -9600,6 +9686,7 @@ var init_up = __esmMin((() => {
 	init_args();
 	init_io();
 	init_runtime();
+	init_version();
 	DEFAULT_PORT$1 = 3999;
 	LOG_ROTATE_BYTES = 5242880;
 	upArgs = {
@@ -9652,14 +9739,20 @@ async function runDown() {
 	}
 	if (!isProcessAlive(runtime.pid)) {
 		clearRuntime();
-		process.stdout.write("home-hosted is not running (removed a stale run.json)\n");
+		process.stdout.write(`home-hosted is not running (removed a stale run.json from home-hosted ${runtime.version})\n`);
 		return;
 	}
+	/** What was stopped, and whether this CLI is a different release than it was. */
+	const reportStopped = (forced) => {
+		process.stdout.write(`${green("stopped")}${forced ? " (forced)" : ""} ${dim(`— was home-hosted ${runtime.version}`)}\n`);
+		const note = versionMismatchNote(runtime.version);
+		if (note !== null) process.stdout.write(`${dim(note)}\n`);
+	};
 	process.stdout.write(`stopping pid ${runtime.pid}…\n`);
 	if (!await requestShutdown(runtime)) signal(runtime.pid, "SIGTERM");
 	if (await waitForExit(runtime.pid, 2e4)) {
 		clearRuntime();
-		process.stdout.write(`${green("stopped")}\n`);
+		reportStopped(false);
 		await reportPersistent();
 		return;
 	}
@@ -9667,7 +9760,7 @@ async function runDown() {
 	forceStop(runtime.pid);
 	await waitForExit(runtime.pid, 5e3);
 	clearRuntime();
-	process.stdout.write(`${green("stopped")} (forced)\n`);
+	reportStopped(true);
 	await reportPersistent();
 }
 /**
@@ -9725,6 +9818,7 @@ function forceStop(pid) {
 var downCommand;
 var init_down = __esmMin((() => {
 	init_io();
+	init_version();
 	downCommand = defineCommand({
 		meta: {
 			name: "down",
@@ -9836,6 +9930,55 @@ var init_status = __esmMin((() => {
 	});
 }));
 //#endregion
+//#region src/cli/server.ts
+var server_exports = /* @__PURE__ */ __exportAll({
+	runServerAction: () => runServerAction,
+	startCommand: () => startCommand,
+	stopCommand: () => stopCommand
+});
+async function runServerAction(action, id) {
+	const { clearRuntime, isProcessAlive, readRuntime, requestControl } = await Promise.resolve().then(() => (init_daemon(), daemon_exports));
+	const runtime = readRuntime();
+	if (runtime === null || !isProcessAlive(runtime.pid)) {
+		if (runtime !== null) clearRuntime();
+		fail("home-hosted is not running — start it with `home-hosted up`");
+	}
+	const answer = await requestControl(runtime, `/_hh/servers/${encodeURIComponent(id)}/${action}`);
+	if (answer === null) fail(`the control panel is not answering on ${runtime.probeUrl}`);
+	const body = answer.body ?? {};
+	if (body.ok !== true) {
+		const reason = body.error ?? body.message;
+		if (reason !== void 0) fail(reason);
+		if (answer.status === 404) fail(`the panel on ${runtime.url} is home-hosted ${runtime.version}, which does not know this command — restart it on this release`);
+		fail(`the panel answered ${answer.status}`);
+	}
+	process.stdout.write(`${green(action === "start" ? "started" : "stopped")} ${id}\n`);
+}
+function serverCommand(action) {
+	return defineCommand({
+		meta: {
+			name: action,
+			description: action === "start" ? "start one server (the panel keeps running)" : "stop one server (the panel keeps running)"
+		},
+		args: { id: {
+			type: "positional",
+			required: false,
+			description: "the server id from servers.config.json"
+		} },
+		run: async ({ args }) => {
+			const id = typeof args.id === "string" ? args.id.trim() : "";
+			if (id.length === 0) fail(`${action} needs a server id — see \`home-hosted status\` or servers.config.json`);
+			await runServerAction(action, id);
+		}
+	});
+}
+var startCommand, stopCommand;
+var init_server = __esmMin((() => {
+	init_io();
+	startCommand = serverCommand("start");
+	stopCommand = serverCommand("stop");
+}));
+//#endregion
 //#region src/cli/set-password.ts
 var set_password_exports = /* @__PURE__ */ __exportAll({
 	runSetPassword: () => runSetPassword,
@@ -10894,6 +11037,8 @@ var SYNOPSIS = {
 	"down": "home-hosted down",
 	"restart": "home-hosted restart [options]",
 	"status": "home-hosted status [--json]",
+	"start": "home-hosted start <id>",
+	"stop": "home-hosted stop <id>",
 	"set-password": "home-hosted set-password",
 	"set-token": "home-hosted set-token",
 	"migrate": "home-hosted migrate",
@@ -10907,6 +11052,8 @@ var SUMMARIES = {
 	"down": "stop it, and everything it supervises",
 	"restart": "down, then up",
 	"status": "is it running, where, and how to reach it",
+	"start": "start one server, leaving the panel up",
+	"stop": "stop one server, leaving the panel up",
 	"set-password": "set the panel password without the API",
 	"set-token": "set the API token that scripts and agents use",
 	"migrate": "bring the config up to this release's schema",
@@ -10933,6 +11080,10 @@ var STATUS_SECTION = {
 	heading: "Options for status",
 	lines: [["--json", "print machine-readable JSON"]]
 };
+var SERVER_SECTION = {
+	heading: "Arguments for start/stop",
+	lines: [["<id>", "the server id from servers.config.json"]]
+};
 var SET_PASSWORD_SECTION = {
 	heading: "Options for set-password",
 	lines: [["--clear", "remove the password, which disables authentication"]]
@@ -11044,11 +11195,15 @@ var USAGE = [
 	"",
 	renderSection(STATUS_SECTION),
 	"",
+	renderSection(SERVER_SECTION),
+	"",
 	SHARED_TRAILER
 ].join("\n");
 var UP_COMMANDS = /* @__PURE__ */ new Set(["up", "restart"]);
 var SECTIONS = {
 	"status": STATUS_SECTION,
+	"start": SERVER_SECTION,
+	"stop": SERVER_SECTION,
 	"set-password": SET_PASSWORD_SECTION,
 	"set-token": SET_TOKEN_SECTION,
 	"migrate": MIGRATE_SECTION,
@@ -11095,6 +11250,8 @@ var COMMANDS = {
 	"down": () => Promise.resolve().then(() => (init_down(), down_exports)).then((module) => module.downCommand),
 	"restart": () => Promise.resolve().then(() => (init_restart(), restart_exports)).then((module) => module.restartCommand(CLI_ENTRY)),
 	"status": () => Promise.resolve().then(() => (init_status(), status_exports)).then((module) => module.statusCommand),
+	"start": () => Promise.resolve().then(() => (init_server(), server_exports)).then((module) => module.startCommand),
+	"stop": () => Promise.resolve().then(() => (init_server(), server_exports)).then((module) => module.stopCommand),
 	"set-password": () => Promise.resolve().then(() => (init_set_password(), set_password_exports)).then((module) => module.setPasswordCommand),
 	"set-token": () => Promise.resolve().then(() => (init_set_token(), set_token_exports)).then((module) => module.setTokenCommand),
 	"migrate": () => Promise.resolve().then(() => (init_migrate(), migrate_exports)).then((module) => module.migrateCommand),