home-hosted 0.7.17 → 0.7.18

package/dist/cli.js

@@ -1,9 +1,9 @@
-import fs from "node:fs";
 import process from "node:process";
 import { fileURLToPath } from "node:url";
 import { defineCommand, runCommand } from "citty";
 import path from "node:path";
 import readline from "node:readline";
+import fs, { createReadStream } from "node:fs";
 import { exec, execFile, execFileSync, spawn, spawnSync } from "node:child_process";
 import { Buffer as Buffer$1 } from "node:buffer";
 import os from "node:os";
@@ -14,6 +14,8 @@ import { isDevelopment } from "std-env";
 import { DetailedError } from "@namesmt/utils";
 import { type } from "arktype";
 import crypto, { X509Certificate, createPrivateKey, createPublicKey, randomBytes } from "node:crypto";
+import { Readable, Writable } from "node:stream";
+import { bodyLimit } from "hono/body-limit";
 import { streamSSE } from "hono/streaming";
 import { autoRetry } from "@grammyjs/auto-retry";
 import { Bot } from "grammy";
@@ -24,7 +26,6 @@ import { Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
 import { Scalar } from "@scalar/hono-api-reference";
 import https from "node:https";
-import { Readable, Writable } from "node:stream";
 import { finished } from "node:stream/promises";
 import { BlobReader, ZipReader, ZipWriter, configure } from "@zip.js/zip.js";
 import { serve } from "srvx";
@@ -48,6 +49,44 @@ var __exportAll = (all, no_symbols) => {
 	return target;
 };
 //#endregion
+//#region src/cli/nearest.ts
+/**
+* The nearest word to a typo, or null when nothing is close.
+*
+* Two callers need it — a mistyped command and a mistyped option — so it takes its candidate list as
+* a parameter rather than reaching for one. One implementation, so both suggest by the same rule.
+*
+* Levenshtein distance, capped: only a genuinely near miss is worth naming, because suggesting an
+* unrelated word is worse than suggesting none.
+*/
+function nearestWord(input, candidates) {
+	if (candidates.length === 0) return null;
+	const distance = (a, b) => {
+		let previous = Array.from({ length: b.length + 1 }, (_, i) => i);
+		for (let i = 1; i <= a.length; i += 1) {
+			const current = [i];
+			for (let j = 1; j <= b.length; j += 1) {
+				const substitution = previous[j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1);
+				current[j] = Math.min(current[j - 1] + 1, previous[j] + 1, substitution);
+			}
+			previous = current;
+		}
+		return previous[b.length];
+	};
+	const best = candidates.map((name) => ({
+		name,
+		d: distance(input.toLowerCase(), name.toLowerCase())
+	})).sort((left, right) => left.d - right.d || left.name.localeCompare(right.name))[0];
+	if (best === void 0) return null;
+	const proportional = Math.floor(Math.min(input.length, best.name.length) / 2);
+	const allowed = Math.min(proportional, ABSOLUTE_BOUND);
+	return best.d <= allowed ? best.name : null;
+}
+var ABSOLUTE_BOUND;
+var init_nearest = __esmMin((() => {
+	ABSOLUTE_BOUND = 2;
+}));
+//#endregion
 //#region src/cli/args.ts
 /** `--home`/`--project` are handled for every command, so they are peeled off first. */
 function extractDirFlags(argv) {
@@ -130,15 +169,33 @@ function aliasesOf(def) {
 	if (def === void 0 || !("alias" in def) || def.alias === void 0) return [];
 	return Array.isArray(def.alias) ? def.alias : [def.alias];
 }
+/**
+* Every spelling that reaches one declared option: the key, its kebab form, each alias, and the
+* `no-` negation citty gives a boolean. `findArg` accepts on this set and the suggestion offers from
+* it, so a suggestion can never name a spelling the parser would then refuse.
+*/
+function namesOf$1(key, def) {
+	return [
+		key,
+		kebab(key),
+		...aliasesOf(def)
+	];
+}
+/** The spellings of every option this command declares, for a suggestion. */
+function declaredOptionNames(argsDef) {
+	const names = [];
+	for (const [key, def] of Object.entries(argsDef)) {
+		if (def === void 0 || def.type === "positional") continue;
+		names.push(...namesOf$1(key, def));
+		if (def.type === "boolean") names.push(...namesOf$1(key, def).map((name) => `no-${name}`));
+	}
+	return names;
+}
 function findArg(argsDef, name) {
 	for (const [key, def] of Object.entries(argsDef)) {
 		if (def === void 0) continue;
 		if (def.type === "positional") continue;
-		if ((/* @__PURE__ */ new Set([
-			key,
-			kebab(key),
-			...aliasesOf(def)
-		])).has(name)) return def;
+		if (namesOf$1(key, def).includes(name)) return def;
 		if (def.type === "boolean" && (name === `no-${key}` || name === `no-${kebab(key)}`)) return def;
 	}
 }
@@ -166,7 +223,10 @@ function rejectUnknownFlags(argv, argsDef) {
 		const equals = body.indexOf("=");
 		const name = equals === -1 ? body : body.slice(0, equals);
 		const def = name.length === 0 ? void 0 : findArg(argsDef, name);
-		if (def === void 0) return `Unknown option '${token}'`;
+		if (def === void 0) {
+			const suggested = nearestWord(name, declaredOptionNames(argsDef));
+			return `Unknown option '${token}'${suggested === null ? "" : ` — did you mean \`--${suggested}\`?`}`;
+		}
 		if (def.type === "string" && equals === -1 && argv[index + 1] === void 0) return `Option '${token}' needs a value`;
 		if (def.type === "string" && equals === -1) index += 1;
 	}
@@ -188,6 +248,7 @@ function buildDaemonArgv(flags) {
 }
 var HELP_TOKENS, VERSION_TOKENS, HELP_FLAGS, VERSION_FLAGS, CAMEL;
 var init_args = __esmMin((() => {
+	init_nearest();
 	HELP_TOKENS = /* @__PURE__ */ new Set([
 		"help",
 		"--help",
@@ -306,6 +367,54 @@ var init_runtime = __esmMin((() => {
 	NANNY_COMMAND = "__nanny";
 }));
 //#endregion
+//#region src/helpers/version.ts
+var version_exports = /* @__PURE__ */ __exportAll({
+	appVersion: () => appVersion,
+	versionMismatchNote: () => versionMismatchNote
+});
+/**
+* The running release, read from the package manifest.
+*
+* The caller may be `src/**` under tsx or the built `dist/cli.js`, so the manifest
+* is found by walking up rather than by a fixed relative path, and the name is checked:
+* a nested manifest must not be trusted as this package's.
+*
+* `src/cli.ts` reaches this through a **relative** import, not `#src/*`. That file is the
+* bootstrap and may only pull in modules that load node builtins statically — a `#src`
+* import there would pull the daemon graph in before citty is even asked anything.
+*/
+function appVersion() {
+	if (cached !== null) return cached;
+	let dir = path.dirname(fileURLToPath(import.meta.url));
+	for (let depth = 0; depth < 4; depth++) {
+		try {
+			const manifest = JSON.parse(fs.readFileSync(path.join(dir, "package.json"), "utf8"));
+			if (manifest.name === "home-hosted" && typeof manifest.version === "string") {
+				cached = manifest.version;
+				return cached;
+			}
+		} catch {}
+		const parent = path.dirname(dir);
+		if (parent === dir) break;
+		dir = parent;
+	}
+	cached = "0.0.0";
+	return cached;
+}
+/**
+* The one line to add when this CLI and the panel it is talking to are not the same
+* release — which is what a linked checkout, a global install and a project pin
+* produce. `null` when they agree.
+*/
+function versionMismatchNote(panelVersion) {
+	const cli = appVersion();
+	return cli === panelVersion ? null : `note: this CLI is ${cli}, the panel is ${panelVersion}`;
+}
+var cached;
+var init_version = __esmMin((() => {
+	cached = null;
+}));
+//#endregion
 //#region src/helpers/daemon-log.ts
 var daemon_log_exports = /* @__PURE__ */ __exportAll({
 	followLog: () => followLog,
@@ -493,50 +602,6 @@ var init_daemon_log = __esmMin((() => {
 	LOG_ROTATE_BYTES = 5242880;
 }));
 //#endregion
-//#region src/helpers/version.ts
-var version_exports = /* @__PURE__ */ __exportAll({
-	appVersion: () => appVersion,
-	versionMismatchNote: () => versionMismatchNote
-});
-/**
-* The running release, read from the package manifest.
-*
-* The caller may be `src/**` under tsx or the built `dist/cli.js`, so the manifest
-* is found by walking up rather than by a fixed relative path. `src/cli.ts` keeps
-* its own read because it may only import node builtins statically.
-*/
-function appVersion() {
-	if (cached !== null) return cached;
-	let dir = path.dirname(fileURLToPath(import.meta.url));
-	for (let depth = 0; depth < 4; depth++) {
-		try {
-			const manifest = JSON.parse(fs.readFileSync(path.join(dir, "package.json"), "utf8"));
-			if (manifest.name === "home-hosted" && typeof manifest.version === "string") {
-				cached = manifest.version;
-				return cached;
-			}
-		} catch {}
-		const parent = path.dirname(dir);
-		if (parent === dir) break;
-		dir = parent;
-	}
-	cached = "0.0.0";
-	return cached;
-}
-/**
-* The one line to add when this CLI and the panel it is talking to are not the same
-* release — which is what a linked checkout, a global install and a project pin
-* produce. `null` when they agree.
-*/
-function versionMismatchNote(panelVersion) {
-	const cli = appVersion();
-	return cli === panelVersion ? null : `note: this CLI is ${cli}, the panel is ${panelVersion}`;
-}
-var cached;
-var init_version = __esmMin((() => {
-	cached = null;
-}));
-//#endregion
 //#region src/helpers/factory.ts
 var appFactory;
 var init_factory = __esmMin((() => {
@@ -631,7 +696,7 @@ function parseBind(value) {
 	const parsed = bindSchema(value);
 	return parsed instanceof type.errors ? null : parsed;
 }
-var bindSchema, workspaceIdSchema, workspaceSchema, workspaceCreateSchema, workspaceRenameSchema, portSchema, onPortConflictSchema, onPortConflictDefaultSchema, restartSchema, httpCheckSchema, resourcesSchema, healthSchema, stopSchema, bootstrapSchema, bootstrapOrNullSchema, logBufferLinesSchema, serverSchema, authSchema, telegramSchema, notificationsSchema, logsSchema, tlsSchema, hostSchema, ddnsRecordTypeSchema, ddnsAccountSchema, ddnsDomainSchema, ddnsIpv4Schema, ddnsIpv6Schema, ddnsConfigSchema, ddnsRecordStateSchema, ddnsRecordViewSchema, ddnsStatusSchema, ddnsProviderFieldSchema, ddnsProviderInfoSchema, ddnsViewSchema, ddnsCredentialsSchema, backupsSchema, controlSchema, defaultsSchema, restartPatchSchema, httpCheckPatchSchema, resourcesPatchSchema, healthPatchSchema, stopPatchSchema, authPatchSchema, telegramPatchSchema, notificationsPatchSchema, hostPatchSchema, backupsPatchSchema, logsPatchSchema, tlsPatchSchema, controlPatchSchema, defaultsPatchSchema, editableFields, serverPatchSchema, serverCreateSchema, nannySpecSchema, nannyExitSchema, nannyStateSchema, settingsPatchSchema, workspaceSettingsPatchSchema, authStatusSchema, tlsStatusSchema, proxyEngineSchema, proxyTargetSchema, proxyTlsModeSchema, proxyRouteSchema, proxyCertificateSchema, proxyCertificateStateSchema, proxyDns01Schema, proxyConfigSchema, proxyEngineSourceSchema, proxyEngineStatusSchema, proxyEngineInfoSchema, proxyRouteStatusSchema, proxyRouteViewSchema, proxyRunStateSchema, proxyStatusSchema, proxyCertificateViewSchema, proxyDnsAccountViewSchema, proxyViewSchema, proxyRoutePatchSchema, proxyPatchSchema, proxyCertificateUploadSchema, proxyEngineInstallSchema, telegramStatusSchema, notificationViewSchema, sessionViewSchema, loginSchema, passwordValueSchema, passwordSchema, serverStatusSchema, healthStateSchema, portStateSchema, logStreamSchema, logLineSchema, historyEventSchema, serverHistorySchema, processResourcesSchema, hostDiskSchema, hostViewSchema, backupFileSchema, backupEntrySchema, backupsViewSchema, restoreItemSchema, restorePlanSchema, backupCreateSchema, restoreRequestSchema, serverViewSchema, controlViewSchema, uiMetaSchema, uiStatusSchema, workspaceViewSchema, appStateSchema, logQuerySchema, freePortResultSchema, logHistoryQuerySchema, logFileInfoSchema, logServerViewSchema, logServersViewSchema, notificationActionSchema, telegramTokenSchema, apiErrorSchema, tlsUploadSchema, settingsViewSchema, settingsSavedSchema, workspaceSettingsViewSchema, workspaceSettingsSavedSchema;
+var bindSchema, workspaceIdSchema, workspaceSchema, workspaceCreateSchema, workspaceRenameSchema, portSchema, onPortConflictSchema, onPortConflictDefaultSchema, restartSchema, httpCheckSchema, resourcesSchema, healthSchema, stopSchema, bootstrapSchema, bootstrapOrNullSchema, labelOrNullSchema, logBufferLinesSchema, serverSchema, authSchema, telegramSchema, notificationsSchema, logsSchema, tlsSchema, hostSchema, ddnsRecordTypeSchema, ddnsAccountSchema, ddnsDomainSchema, ddnsIpv4Schema, ddnsIpv6Schema, ddnsConfigSchema, ddnsRecordStateSchema, ddnsRecordViewSchema, ddnsStatusSchema, ddnsProviderFieldSchema, ddnsProviderInfoSchema, ddnsViewSchema, ddnsCredentialsSchema, backupsSchema, controlSchema, defaultsSchema, restartPatchSchema, httpCheckPatchSchema, resourcesPatchSchema, healthPatchSchema, stopPatchSchema, authPatchSchema, telegramPatchSchema, notificationsPatchSchema, hostPatchSchema, backupsPatchSchema, logsPatchSchema, tlsPatchSchema, controlPatchSchema, defaultsPatchSchema, editableFields, serverPatchSchema, serverCreateSchema, nannySpecSchema, nannyExitSchema, nannyStateSchema, settingsPatchSchema, workspaceSettingsPatchSchema, authStatusSchema, tlsStatusSchema, proxyEngineSchema, proxyTargetSchema, proxyTlsModeSchema, proxyRouteSchema, proxyCertificateSchema, proxyCertificateStateSchema, proxyDns01Schema, proxyConfigSchema, proxyEngineSourceSchema, proxyEngineStatusSchema, proxyEngineInfoSchema, proxyRouteStatusSchema, proxyRouteViewSchema, proxyRunStateSchema, proxyStatusSchema, proxyCertificateViewSchema, proxyDnsAccountViewSchema, proxyViewSchema, proxyRoutePatchSchema, proxyPatchSchema, proxyCertificateUploadSchema, proxyEngineInstallSchema, telegramStatusSchema, telegramChatsSchema, notificationViewSchema, sessionViewSchema, loginSchema, passwordValueSchema, passwordSchema, serverStatusSchema, healthStateSchema, portStateSchema, logStreamSchema, logLineSchema, historyEventSchema, serverHistorySchema, processResourcesSchema, hostDiskSchema, hostViewSchema, backupFileSchema, backupEntrySchema, backupsViewSchema, restoreItemSchema, restorePlanSchema, backupCreateSchema, restoreRequestSchema, serverViewSchema, healthResponseSchema, controlViewSchema, uiMetaSchema, uiStatusSchema, workspaceViewSchema, appStateSchema, logQuerySchema, freePortResultSchema, logHistoryQuerySchema, logFileInfoSchema, logServerViewSchema, logServersViewSchema, notificationActionSchema, telegramTokenSchema, apiErrorSchema, tlsUploadSchema, settingsViewSchema, settingsSavedSchema, workspaceSettingsViewSchema, workspaceSettingsSavedSchema;
 var init_contracts = __esmMin((() => {
 	bindSchema = type("\"local\" | \"lan\" | /^\\d{1,3}(?:\\.\\d{1,3}){3}$/");
 	workspaceIdSchema = type("/^[a-z0-9][a-z0-9_-]*$/");
@@ -699,10 +764,11 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		runOnce: "boolean = true"
 	}).onUndeclaredKey("reject");
 	bootstrapOrNullSchema = bootstrapSchema.or(type("null"));
+	labelOrNullSchema = type("string | null");
 	logBufferLinesSchema = type("50 <= number.integer <= 100000");
 	serverSchema = type({
 		id: "/^[a-z0-9][a-z0-9_-]*$/",
-		label: "string?",
+		label: labelOrNullSchema.optional(),
 		enabled: "boolean = true",
 		autostart: "boolean = false",
 		/**
@@ -728,7 +794,7 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		health: healthSchema.default(() => ({})),
 		stop: stopSchema.default(() => ({})),
 		logBufferLines: logBufferLinesSchema.default(() => 500),
-		/** Ids this server needs running first (and healthy); stopped in reverse order. */
+		/** Ids this server needs running first (and healthy); `stop-all` stops dependents before it. */
 		dependsOn: type("string[]").default(() => []),
 		/** Optional KEY=value file loaded at spawn; its values override `env`. */
 		envFile: "string = \"\"",
@@ -743,11 +809,12 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 	}).onUndeclaredKey("reject");
 	authSchema = type({
 		enabled: "boolean = true",
+		/** Idle timeout: a session dies this long after its **last** request, not after login. */
 		sessionTtlMs: "number >= 60000 = 604800000",
 		/** `auto` adds `Secure` when the request arrived over https (proxy-aware). */
 		cookieSecure: "\"auto\" | \"always\" | \"never\" = \"auto\"",
 		/** Trust `x-forwarded-*` from a reverse proxy; also drives the client IP. */
-		trustProxy: "boolean = false",
+		trustProxy: "boolean | \"loopback\" = false",
 		maxLoginAttempts: "number.integer >= 1 = 5",
 		lockoutMs: "number >= 1000 = 60000"
 	}).onUndeclaredKey("reject");
@@ -953,7 +1020,7 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		enabled: "boolean?",
 		sessionTtlMs: "number >= 60000?",
 		cookieSecure: "\"auto\" | \"always\" | \"never\"?",
-		trustProxy: "boolean?",
+		trustProxy: "boolean | \"loopback\"?",
 		maxLoginAttempts: "number.integer >= 1?",
 		lockoutMs: "number >= 1000?"
 	}).onUndeclaredKey("reject");
@@ -992,7 +1059,7 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 	}).onUndeclaredKey("reject");
 	tlsPatchSchema = type({ enabled: "boolean?" }).onUndeclaredKey("reject");
 	controlPatchSchema = type({
-		label: "1 <= string <= 60?",
+		label: "1 <= string <= 60 | null?",
 		port: "1 <= number.integer <= 65535?",
 		host: bindSchema.optional(),
 		openBrowser: "boolean?",
@@ -1096,7 +1163,7 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		blockedReason: "string | null",
 		sessionTtlMs: "number",
 		cookieSecure: "string",
-		trustProxy: "boolean",
+		trustProxy: "boolean | \"loopback\"",
 		maxLoginAttempts: "number",
 		lockoutMs: "number"
 	});
@@ -1301,6 +1368,10 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		lastResult: "string | null",
 		lastResultAt: "number | null"
 	});
+	telegramChatsSchema = type({ chats: type({
+		id: "string | number",
+		title: "string"
+	}).array() });
 	notificationViewSchema = type({ telegram: telegramStatusSchema });
 	sessionViewSchema = type({
 		authenticated: "boolean",
@@ -1477,6 +1548,17 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		"responseMs": "number | null",
 		"resources": processResourcesSchema.or(type("null"))
 	});
+	healthResponseSchema = type({
+		"status": "\"ok\" | \"degraded\"",
+		"uptimeMs": "number",
+		"servers?": type({
+			total: "number",
+			running: "number",
+			crashed: "number",
+			unhealthy: "number"
+		}),
+		"hostAlerts?": "string[]"
+	});
 	controlViewSchema = type({
 		/** The configured panel name, for the shell to render. */
 		label: "string",
@@ -1574,7 +1656,12 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 	});
 	logHistoryQuerySchema = type({
 		tail: "string?",
-		/** Case-insensitive substring filter over the tail window. */
+		/**
+		* Case-insensitive substring filter. Both this and `stream` are filters, so the route reads a
+		* wider window than `tail` and applies them to that: filtering only the display tail would
+		* report an older match as "no results", and "the last N stderr lines" as whatever happened
+		* to fall in a window sized for all streams. `searched` reports how many lines were read.
+		*/
 		search: "string?",
 		stream: "\"stdout\" | \"stderr\" | \"system\"?"
 	});
@@ -1607,10 +1694,11 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 	}).onUndeclaredKey("reject");
 	telegramTokenSchema = type({ botToken: "string >= 1" }).onUndeclaredKey("reject");
 	apiErrorSchema = type({
-		message: "string",
+		"message": "string",
 		/** Stable, machine-readable; `AUTH_REQUIRED` also drives the login redirect. */
-		code: "string",
-		detail: "unknown"
+		"code": "string",
+		/** Structured context when the failure has any — a field list, the routes holding a certificate. */
+		"detail?": "unknown"
 	}).onUndeclaredKey("reject");
 	tlsUploadSchema = type({
 		certificate: "string >= 1",
@@ -1663,6 +1751,10 @@ var init_openapi$1 = __esmMin((() => {
 		404: {
 			description: "Unknown id",
 			content: jsonBody(apiErrorSchema)
+		},
+		413: {
+			description: "The body is larger than this route accepts",
+			content: jsonBody(apiErrorSchema)
 		}
 	};
 }));
@@ -1678,6 +1770,7 @@ function validate(target, schema) {
 	return validator(target, schema, (result) => {
 		if (result.success === false) throw new DetailedError("validation failed", {
 			statusCode: 400,
+			code: "INVALID_INPUT",
 			detail: normalizeIssues(result.error)
 		});
 	});
@@ -1712,6 +1805,28 @@ function writeFileAtomic(file, content, options = {}) {
 }
 var init_atomic = __esmMin((() => {}));
 //#endregion
+//#region src/shared/shape.ts
+/**
+* A plain object, and nothing else: not `null`, and not an array.
+*
+* Every untyped boundary here narrows to this shape, and it lived as **nine** definitions across
+* `src/` and the UIs: seven strict (one an inline ternary rather than a named function, which is why
+* a search for the name found only some of them) and two — both UIs' `lib/api.ts` — that accepted an
+* array.
+*
+* The `!Array.isArray` half is the one that matters: `typeof [] === 'object'` is true, so without
+* it an array narrows to a record and reading a property off it silently yields `undefined`
+* instead of failing — and iterating it with `Object.entries` yields the *indices*.
+*
+* The two loose copies happened to behave the same on the payloads they see, but only by accident
+* of which properties they read. They use this one now, so the next reader does not have to work
+* that out.
+*/
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+var init_shape = __esmMin((() => {}));
+//#endregion
 //#region src/config/secrets.ts
 function deriveKey(password, salt, cost, keylen) {
 	return crypto.scryptSync(password.normalize("NFKC"), salt, keylen, { ...cost });
@@ -1760,32 +1875,29 @@ function apiTokenRecord(token, now = Date.now()) {
 		updatedAt: now
 	};
 }
-function isRecord$4(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 /** A field map: strings only, empty values dropped; anything else reads as absent. */
 function readDdnsValues(value) {
-	if (!isRecord$4(value)) return {};
+	if (!isRecord(value)) return {};
 	const out = {};
 	for (const [key, field] of Object.entries(value)) if (typeof field === "string" && field.length > 0) out[key] = field;
 	return out;
 }
 function isSealedDdns(value) {
-	return isRecord$4(value) && value.algo === DDNS_SEALED_ALGO && typeof value.iv === "string" && typeof value.tag === "string" && typeof value.data === "string";
+	return isRecord(value) && value.algo === DDNS_SEALED_ALGO && typeof value.iv === "string" && typeof value.tag === "string" && typeof value.data === "string";
 }
 function isPlainDdns(value) {
 	return "plain" in value;
 }
 /** Every shape this file has held: sealed, `{ provider, values }`, or a bare field map. */
 function readStoredDdns(value) {
-	if (!isRecord$4(value)) return {};
+	if (!isRecord(value)) return {};
 	const out = {};
 	for (const [accountId, entry] of Object.entries(value)) {
 		if (isSealedDdns(entry)) {
 			out[accountId] = entry;
 			continue;
 		}
-		if (!isRecord$4(entry)) continue;
+		if (!isRecord(entry)) continue;
 		const values = readDdnsValues("values" in entry ? entry.values : entry);
 		if (Object.keys(values).length === 0) continue;
 		out[accountId] = {
@@ -1797,8 +1909,8 @@ function readStoredDdns(value) {
 	return out;
 }
 function readDdnsKdf(value) {
-	if (!isRecord$4(value) || value.algo !== "scrypt" || typeof value.salt !== "string") return null;
-	const cost = isRecord$4(value.cost) ? value.cost : {};
+	if (!isRecord(value) || value.algo !== "scrypt" || typeof value.salt !== "string") return null;
+	const cost = isRecord(value.cost) ? value.cost : {};
 	const N = Number(cost.N);
 	const r = Number(cost.r);
 	const p = Number(cost.p);
@@ -1858,6 +1970,7 @@ var COST, KEYLEN, SALT_BYTES, DDNS_KEYLEN, DDNS_IV_BYTES, DDNS_AAD_PREFIX, DDNS_
 var init_secrets = __esmMin((() => {
 	init_atomic();
 	init_logger();
+	init_shape();
 	COST = {
 		N: 16384,
 		r: 8,
@@ -1878,6 +1991,7 @@ var init_secrets = __esmMin((() => {
 		cacheKey = "";
 		ddnsKeyCache = null;
 		warnedAccounts = /* @__PURE__ */ new Set();
+		warnedDefaultSecret = false;
 		ddnsSecret;
 		constructor(file, ddnsSecret, scope = "all") {
 			this.file = file;
@@ -1885,6 +1999,16 @@ var init_secrets = __esmMin((() => {
 			const candidate = (ddnsSecret ?? process.env.HHOSTED_DDNS_SECRET ?? "").trim();
 			this.ddnsSecret = candidate.length > 0 ? candidate : "hh";
 		}
+		/**
+		* Whether the DDNS credentials are sealed under the built-in key.
+		*
+		* Sealing is what stops a leaked *file* — a backup, a committed state directory — from handing over
+		* the DNS credentials. Under the default the key is the literal `hh`, so anyone holding the file can
+		* open it. The docs say so; this is the same fact for code that wants to say so at runtime.
+		*/
+		get usingDefaultDdnsSecret() {
+			return this.ddnsSecret === "hh";
+		}
 		get path() {
 			return this.file;
 		}
@@ -2108,6 +2232,10 @@ var init_secrets = __esmMin((() => {
 		sealStored(contents) {
 			const plain = Object.entries(contents.ddns).filter((entry) => isPlainDdns(entry[1]));
 			if (plain.length === 0) return contents;
+			if (this.usingDefaultDdnsSecret && !this.warnedDefaultSecret) {
+				this.warnedDefaultSecret = true;
+				logger.warn(`ddns: credentials are sealed under the built-in key — set HHOSTED_DDNS_SECRET to protect them if this state directory is ever copied or committed (docs/DDNS.md)`);
+			}
 			const kdf = contents.ddnsKdf ?? newDdnsKdf();
 			const key = this.ddnsKey(kdf);
 			const ddns = { ...contents.ddns };
@@ -2300,7 +2428,6 @@ var init_auth$1 = __esmMin((() => {
 			const token = crypto.randomBytes(32).toString("base64url");
 			this.sessions.set(token, {
 				token,
-				createdAt: now,
 				expiresAt: now + config.sessionTtlMs,
 				lastSeenAt: now,
 				ip
@@ -2499,7 +2626,7 @@ function checkExposure(control, passwordSet, usingDefaultPassword = false) {
 */
 function checkProxyExposure(proxy, authEnabled, passwordSet, usingDefaultPassword = false) {
 	if (!proxy.enabled) return null;
-	const panelRoutes = proxy.routes.filter((route) => route.enabled && route.target === "panel" && route.tls !== "off");
+	const panelRoutes = proxy.routes.filter((route) => route.enabled && route.target === "panel");
 	if (panelRoutes.length === 0) return null;
 	const hosts = panelRoutes.map((route) => route.host).join(", ");
 	if (!authEnabled && !passwordSet) return `the reverse proxy would serve the control panel at ${hosts} but authentication is disabled and no password is set`;
@@ -2508,6 +2635,23 @@ function checkProxyExposure(proxy, authEnabled, passwordSet, usingDefaultPasswor
 	if (usingDefaultPassword) return `the reverse proxy would serve the control panel at ${hosts} but it still uses the default password — change it first`;
 	return null;
 }
+/**
+* A warning for the combination that makes the login lockout advisory.
+*
+* `trustProxy: true` tells srvx to trust `x-forwarded-*` from **any** peer, and it resolves the client
+* address from the leftmost entry of `x-forwarded-for` — a value the caller controls. Login failures are
+* keyed on that address, so a client that rotates the header never accumulates them: measured, 30 wrong
+* passwords from 30 forged addresses produced **zero** 429s, against 27 from a fixed address.
+*
+* This is a warning rather than a refusal because `true` has legitimate uses — a proxy on another host —
+* and, once the header is trusted, the real peer is not reachable through srvx (`#remoteAddress` is
+* private), so the panel cannot re-key the lockout on it. Prefer `host: local` with the proxy on this
+* machine, or leave `trustProxy` off and reach the panel directly.
+*/
+function proxyTrustWarning(control) {
+	if (control.auth.trustProxy !== true || !isExposed(control.host)) return null;
+	return `auth.trustProxy is on while the panel is bound to ${control.host}: the client address comes from the caller's own x-forwarded-for header, so the login lockout (maxLoginAttempts/lockoutMs) counts per forged address and can be bypassed. Keep the bind on local with the proxy on this machine, or put an authenticating gateway in front`;
+}
 var init_exposure = __esmMin((() => {
 	init_bind();
 }));
@@ -2671,10 +2815,8 @@ var paths_exports = /* @__PURE__ */ __exportAll({
 	DEFAULT_WORKSPACE_ID: () => DEFAULT_WORKSPACE_ID,
 	daemonLogPath: () => daemonLogPath,
 	dataRoot: () => dataRoot,
-	defaultBackupsDirName: () => defaultBackupsDirName,
 	globalSecretsPath: () => globalSecretsPath,
 	globalSettingsPath: () => globalSettingsPath,
-	globalSettingsSchemaPath: () => globalSettingsSchemaPath,
 	hasLegacyLayout: () => hasLegacyLayout,
 	hhDir: () => hhDir,
 	legacy: () => legacy,
@@ -2701,12 +2843,9 @@ var paths_exports = /* @__PURE__ */ __exportAll({
 	workspaceLogsDir: () => workspaceLogsDir,
 	workspaceSecretsPath: () => workspaceSecretsPath,
 	workspaceServersPath: () => workspaceServersPath,
-	workspaceServersSchemaPath: () => workspaceServersSchemaPath,
 	workspaceSettingsPath: () => workspaceSettingsPath,
-	workspaceSettingsSchemaPath: () => workspaceSettingsSchemaPath,
 	workspaceStateDir: () => workspaceStateDir,
-	workspacesPath: () => workspacesPath,
-	workspacesSchemaPath: () => workspacesSchemaPath
+	workspacesPath: () => workspacesPath
 });
 /**
 * Where home-hosted keeps everything it owns. `HHOSTED_HOME` overrides it —
@@ -2741,16 +2880,10 @@ function workspaceDir(id) {
 function workspaceSettingsPath(id) {
 	return path.join(workspaceDir(id), "settings.json");
 }
-function workspaceSettingsSchemaPath(id) {
-	return path.join(workspaceDir(id), "settings.schema.json");
-}
 /** The servers a workspace supervises. */
 function workspaceServersPath(id) {
 	return path.join(workspaceDir(id), "servers.config.json");
 }
-function workspaceServersSchemaPath(id) {
-	return path.join(workspaceDir(id), "servers.config.schema.json");
-}
 /** Workspace secrets: Telegram bot token and DDNS credentials. Mode 0600. */
 function workspaceSecretsPath(id) {
 	return path.join(workspaceDir(id), ".secrets.json");
@@ -2791,19 +2924,16 @@ function resolveUserPath(target, base = projectDir) {
 	else if (value.startsWith("~/") || value.startsWith("~\\")) value = path.join(os.homedir(), value.slice(2));
 	return path.isAbsolute(value) ? value : path.resolve(base, value);
 }
-var dataRoot, projectDir, hhDir, DEFAULT_WORKSPACE_ID, globalSettingsPath, globalSettingsSchemaPath, globalSecretsPath, workspacesPath, workspacesSchemaPath, tlsDir, defaultBackupsDirName, daemonLogPath, runtimePath, uiDir, proxyDir, proxyBinDir, proxyEngineDir, proxyConfigPath, proxyPreviousConfigPath, proxyStateDir, proxyAdminPath, proxyTlsDir, proxyChallengeAuthPath, legacy;
+var dataRoot, projectDir, hhDir, DEFAULT_WORKSPACE_ID, globalSettingsPath, globalSecretsPath, workspacesPath, tlsDir, daemonLogPath, runtimePath, uiDir, proxyDir, proxyBinDir, proxyEngineDir, proxyConfigPath, proxyPreviousConfigPath, proxyStateDir, proxyAdminPath, proxyTlsDir, proxyChallengeAuthPath, legacy;
 var init_paths = __esmMin((() => {
 	dataRoot = resolveDataRoot();
 	projectDir = resolveProjectDir();
 	hhDir = path.join(dataRoot, ".hh");
 	DEFAULT_WORKSPACE_ID = "default";
 	globalSettingsPath = path.join(hhDir, "settings.json");
-	globalSettingsSchemaPath = path.join(hhDir, "settings.schema.json");
 	globalSecretsPath = path.join(hhDir, ".control-secrets.json");
 	workspacesPath = path.join(hhDir, "workspaces.json");
-	workspacesSchemaPath = path.join(hhDir, "workspaces.schema.json");
 	tlsDir = path.join(hhDir, ".tls");
-	defaultBackupsDirName = ".backups";
 	daemonLogPath = path.join(hhDir, ".logs", "home-hosted.log");
 	runtimePath = path.join(hhDir, "run.json");
 	uiDir = path.join(hhDir, ".ui");
@@ -2936,14 +3066,14 @@ function createBackupsRoute(deps) {
 			200: { description: "the archive (application/zip)" },
 			404: ERROR_RESPONSES[404]
 		}
-	}), validate("param", nameParam), (c) => {
+	}), validate("param", nameParam), async (c) => {
 		const file = deps.backups.resolve(c.req.valid("param").name);
 		if (file === null) throw new DetailedError("unknown backup", {
 			statusCode: 404,
 			code: "UNKNOWN_BACKUP"
 		});
-		const stats = fs.statSync(file);
-		return c.body(fs.readFileSync(file), 200, {
+		const stats = await fs.promises.stat(file);
+		return c.body(Readable.toWeb(createReadStream(file)), 200, {
 			"Content-Type": "application/zip",
 			"Content-Length": String(stats.size),
 			"Content-Disposition": `attachment; filename="${path.basename(file)}"`
@@ -2964,92 +3094,115 @@ function createBackupsRoute(deps) {
 			ok: true,
 			files: deps.backups.list()
 		});
-	}).post("/backups/restore", describeRoute({
-		tags: ["backups"],
-		summary: "Plan or apply a restore from a stored or uploaded archive",
-		responses: {
-			200: {
-				description: "The plan",
-				content: jsonBody(restorePlanSchema)
-			},
-			400: ERROR_RESPONSES[400],
-			404: ERROR_RESPONSES[404]
-		}
-	}), async (c) => {
-		const confirm = c.req.query("confirm") === "true";
-		const contentType = c.req.header("content-type") ?? "";
-		let archive = null;
-		let uploadedTo = null;
-		let request;
-		try {
-			if (contentType.includes("multipart/form-data")) {
-				const declared = Number.parseInt(c.req.header("content-length") ?? "0", 10);
-				if (Number.isFinite(declared) && declared > MAX_UPLOAD_BYTES) throw new DetailedError(`the upload is larger than ${Math.round(MAX_UPLOAD_BYTES / 1024 / 1024)}MB`, {
-					statusCode: 413,
-					code: "UPLOAD_TOO_LARGE"
-				});
-				const body = await c.req.parseBody();
-				const file = body.file;
-				if (!(file instanceof File)) throw new DetailedError("expected a `file` field with the archive", {
-					statusCode: 400,
-					code: "MISSING_FILE"
-				});
-				if (file.size > MAX_UPLOAD_BYTES) throw new DetailedError(`the upload is larger than ${Math.round(MAX_UPLOAD_BYTES / 1024 / 1024)}MB`, {
+	}).post(
+		"/backups/restore",
+		describeRoute({
+			tags: ["backups"],
+			summary: "Plan or apply a restore from a stored or uploaded archive",
+			responses: {
+				200: {
+					description: "The plan",
+					content: jsonBody(restorePlanSchema)
+				},
+				400: ERROR_RESPONSES[400],
+				404: ERROR_RESPONSES[404],
+				413: ERROR_RESPONSES[413]
+			}
+		}),
+		/**
+		* Bound the body **while it arrives**, not after.
+		*
+		* The handler's own checks read `Content-Length` first — a header a chunked request simply does
+		* not send — and then compare `file.size` after `parseBody()` has already buffered the whole
+		* body into memory. So an upload with no length is buffered in full and *then* refused: the
+		* ceiling was a memory limit rather than a guard. This middleware counts chunks and aborts at the
+		* cap, which is the half the header check cannot do.
+		*/
+		bodyLimit({
+			maxSize: MAX_UPLOAD_BYTES,
+			onError: () => {
+				throw new DetailedError(`the upload is larger than ${Math.round(MAX_UPLOAD_BYTES / 1024 / 1024)}MB`, {
 					statusCode: 413,
 					code: "UPLOAD_TOO_LARGE"
 				});
-				const uploads = path.join(deps.backups.directory, "uploads");
-				fs.mkdirSync(uploads, { recursive: true });
-				uploadedTo = path.join(uploads, `upload-${crypto.randomUUID()}.zip`);
-				fs.writeFileSync(uploadedTo, Buffer$1.from(await file.arrayBuffer()), { mode: 384 });
-				archive = uploadedTo;
-				const rawInclude = typeof body.include === "string" && body.include.length > 0 ? body.include : null;
-				let include;
-				if (rawInclude !== null) try {
-					include = JSON.parse(rawInclude);
-				} catch {
-					throw new DetailedError("`include` must be a JSON array of item ids", {
+			}
+		}),
+		async (c) => {
+			const confirm = c.req.query("confirm") === "true";
+			const contentType = c.req.header("content-type") ?? "";
+			let archive = null;
+			let uploadedTo = null;
+			let request;
+			try {
+				if (contentType.includes("multipart/form-data")) {
+					const declared = Number.parseInt(c.req.header("content-length") ?? "0", 10);
+					if (Number.isFinite(declared) && declared > MAX_UPLOAD_BYTES) throw new DetailedError(`the upload is larger than ${Math.round(MAX_UPLOAD_BYTES / 1024 / 1024)}MB`, {
+						statusCode: 413,
+						code: "UPLOAD_TOO_LARGE"
+					});
+					const body = await c.req.parseBody();
+					const file = body.file;
+					if (!(file instanceof File)) throw new DetailedError("expected a `file` field with the archive", {
 						statusCode: 400,
-						code: "INVALID_INCLUDE"
+						code: "MISSING_FILE"
+					});
+					if (file.size > MAX_UPLOAD_BYTES) throw new DetailedError(`the upload is larger than ${Math.round(MAX_UPLOAD_BYTES / 1024 / 1024)}MB`, {
+						statusCode: 413,
+						code: "UPLOAD_TOO_LARGE"
+					});
+					const uploads = path.join(deps.backups.directory, "uploads");
+					fs.mkdirSync(uploads, { recursive: true });
+					uploadedTo = path.join(uploads, `upload-${crypto.randomUUID()}.zip`);
+					fs.writeFileSync(uploadedTo, Buffer$1.from(await file.arrayBuffer()), { mode: 384 });
+					archive = uploadedTo;
+					const rawInclude = typeof body.include === "string" && body.include.length > 0 ? body.include : null;
+					let include;
+					if (rawInclude !== null) try {
+						include = JSON.parse(rawInclude);
+					} catch {
+						throw new DetailedError("`include` must be a JSON array of item ids", {
+							statusCode: 400,
+							code: "INVALID_INCLUDE"
+						});
+					}
+					request = parseOrThrow(restoreRequestSchema, {
+						...typeof body.password === "string" ? { password: body.password } : {},
+						...rawInclude === null ? {} : { include }
+					}, "body");
+				} else {
+					request = parseOrThrow(restoreRequestSchema, await c.req.json().catch(() => ({})), "body");
+					if (request.name === void 0) throw new DetailedError("expected a backup name or a file upload", {
+						statusCode: 400,
+						code: "MISSING_ARCHIVE"
+					});
+					archive = deps.backups.resolve(request.name);
+					if (archive === null) throw new DetailedError("unknown backup", {
+						statusCode: 404,
+						code: "UNKNOWN_BACKUP"
 					});
 				}
-				request = parseOrThrow(restoreRequestSchema, {
-					...typeof body.password === "string" ? { password: body.password } : {},
-					...rawInclude === null ? {} : { include }
-				}, "body");
-			} else {
-				request = parseOrThrow(restoreRequestSchema, await c.req.json().catch(() => ({})), "body");
-				if (request.name === void 0) throw new DetailedError("expected a backup name or a file upload", {
-					statusCode: 400,
-					code: "MISSING_ARCHIVE"
+				const plan = await deps.backups.restore(archive, {
+					confirm,
+					password: request.password,
+					include: request.include
 				});
-				archive = deps.backups.resolve(request.name);
-				if (archive === null) throw new DetailedError("unknown backup", {
-					statusCode: 404,
-					code: "UNKNOWN_BACKUP"
+				if (plan.needsPassword) return c.json(plan);
+				if (plan.error !== void 0) throw new DetailedError(plan.error, {
+					statusCode: 400,
+					code: "RESTORE_FAILED",
+					detail: {
+						items: plan.items,
+						applied: plan.applied,
+						skipped: plan.skipped
+					}
 				});
+				if (confirm) logger.info(`restored from ${path.basename(archive)}: ${plan.applied.join(", ")}`);
+				return c.json(plan);
+			} finally {
+				if (uploadedTo !== null) fs.rmSync(uploadedTo, { force: true });
 			}
-			const plan = await deps.backups.restore(archive, {
-				confirm,
-				password: request.password,
-				include: request.include
-			});
-			if (plan.needsPassword) return c.json(plan);
-			if (plan.error !== void 0) throw new DetailedError(plan.error, {
-				statusCode: 400,
-				code: "RESTORE_FAILED",
-				detail: {
-					items: plan.items,
-					applied: plan.applied,
-					skipped: plan.skipped
-				}
-			});
-			if (confirm) logger.info(`restored from ${path.basename(archive)}: ${plan.applied.join(", ")}`);
-			return c.json(plan);
-		} finally {
-			if (uploadedTo !== null) fs.rmSync(uploadedTo, { force: true });
 		}
-	});
+	);
 }
 var MAX_UPLOAD_BYTES, nameParam;
 var init_backups$1 = __esmMin((() => {
@@ -3065,12 +3218,37 @@ var init_backups$1 = __esmMin((() => {
 }));
 //#endregion
 //#region src/helpers/action-result.ts
+/** The one shape a missing entry takes, so the marker and the message cannot drift apart. */
+function missingServer(id) {
+	return {
+		ok: false,
+		error: `unknown server "${id}"`,
+		[UNKNOWN_SERVER]: true
+	};
+}
+/**
+* The same failure where the caller throws instead of answering — the route side of `missingServer()`.
+*
+* `api/logs.ts` and `api/servers/$.routes.ts` each carried a byte-identical private copy of this, with
+* six call sites between them. Two copies of a wire contract (the message, the 404, the `UNKNOWN_SERVER`
+* code) is the drift that already happened once for `request`: a change landing in one UI and not the
+* other. Defining it beside the message keeps one owner for the wording.
+*/
+function unknownServerError(id) {
+	return new DetailedError(`unknown server "${id}"`, {
+		statusCode: 404,
+		code: "UNKNOWN_SERVER"
+	});
+}
 /** Unknown ids are 404; a server that exists but cannot act is a 409. */
 function statusForAction(result) {
 	if (result.ok) return 200;
-	return result.error?.startsWith("unknown server") ? 404 : 409;
+	return result[UNKNOWN_SERVER] === true ? 404 : 409;
 }
-var init_action_result = __esmMin((() => {}));
+var UNKNOWN_SERVER;
+var init_action_result = __esmMin((() => {
+	UNKNOWN_SERVER = Symbol("hh.unknownServer");
+}));
 //#endregion
 //#region src/helpers/deferred.ts
 /**
@@ -3088,10 +3266,28 @@ function afterResponse(task, onError) {
 }
 var init_deferred = __esmMin((() => {}));
 //#endregion
-//#region src/config/schema.ts
-function isRecord$3(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
+//#region src/helpers/secret-compare.ts
+/**
+* Compares two secrets without leaking their contents through timing.
+*
+* `a !== b` short-circuits at the first differing byte, so an attacker who can measure response time
+* recovers a secret one byte at a time. That matters wherever the secret is the *only* thing standing
+* between a caller and a privileged action — the `/_hh` control channel, which is deliberately outside
+* `/api` and guarded by nothing else.
+*
+* Length is compared first because `timingSafeEqual` **throws** on differing lengths. That leaks only
+* the length, which is not secret here (the token has a fixed shape and a `hh_` prefix); rejecting it
+* is what keeps a truncated header from becoming a 500.
+*/
+function secretEqual(actual, expected) {
+	const left = Buffer$1.from(actual, "utf8");
+	const right = Buffer$1.from(expected, "utf8");
+	if (left.length !== right.length || left.length === 0) return false;
+	return crypto.timingSafeEqual(left, right);
 }
+var init_secret_compare = __esmMin((() => {}));
+//#endregion
+//#region src/config/schema.ts
 /**
 * Resolves one entry against the workspace's server defaults. A group (`restart`,
 * `health`, `health.http`, `stop`) merges key by key, so an entry that decides one
@@ -3103,13 +3299,14 @@ function mergeDefaults(defaults, entry) {
 	for (const [key, value] of Object.entries(defaults)) {
 		const current = merged[key];
 		if (current === void 0) merged[key] = value;
-		else if (isRecord$3(value) && isRecord$3(current)) merged[key] = mergeDefaults(value, current);
+		else if (isRecord(value) && isRecord(current)) merged[key] = mergeDefaults(value, current);
 	}
 	return merged;
 }
 var metaSchema, globalSettingsSchema, workspaceSettingsSchema, serversFileSchema, GLOBAL_SETTINGS_KEYS, WORKSPACE_SETTINGS_KEYS, SERVERS_FILE_KEYS;
 var init_schema = __esmMin((() => {
 	init_contracts();
+	init_shape();
 	metaSchema = type({
 		writtenBy: "string = \"\"",
 		schema: "number.integer >= 1 = 1"
@@ -3185,6 +3382,11 @@ var init_workspaces = __esmMin((() => {
 	}).onUndeclaredKey("reject");
 	WorkspaceError = class extends Error {
 		name = "WorkspaceError";
+		code;
+		constructor(message, code) {
+			super(message);
+			this.code = code;
+		}
 	};
 	seed = () => [{
 		id: DEFAULT_WORKSPACE_ID,
@@ -3255,14 +3457,14 @@ var init_workspaces = __esmMin((() => {
 				label: label.length > 0 ? label : id
 			});
 			if (validated instanceof type.errors) throw new WorkspaceError(validated.summary);
-			if (this.has(id)) throw new WorkspaceError(`workspace "${id}" already exists`);
+			if (this.has(id)) throw new WorkspaceError(`workspace "${id}" already exists`, "WORKSPACE_EXISTS");
 			const next = [...this.list, validated];
 			this.commit(next);
 			return validated;
 		}
 		rename(id, label) {
 			const index = this.list.findIndex((entry) => entry.id === id);
-			if (index < 0) throw new WorkspaceError(`unknown workspace "${id}"`);
+			if (index < 0) throw new WorkspaceError(`unknown workspace "${id}"`, "UNKNOWN_WORKSPACE");
 			const validated = workspaceSchema({
 				id,
 				label: label.trim()
@@ -3275,7 +3477,7 @@ var init_workspaces = __esmMin((() => {
 		}
 		remove(id) {
 			const entry = this.get(id);
-			if (entry === void 0) throw new WorkspaceError(`unknown workspace "${id}"`);
+			if (entry === void 0) throw new WorkspaceError(`unknown workspace "${id}"`, "UNKNOWN_WORKSPACE");
 			if (this.list.length <= 1) throw new WorkspaceError("cannot remove the only workspace");
 			this.commit(this.list.filter((candidate) => candidate.id !== id));
 			return entry;
@@ -3336,7 +3538,7 @@ function createControlRoute(deps) {
 	/** The one place the local channel's credentials are read. */
 	function assertLocalCall(c, action) {
 		const token = c.req.header("x-home-hosted-token");
-		if (token === void 0 || token !== deps.runtimeToken) throw new DetailedError("invalid token", {
+		if (token === void 0 || !secretEqual(token, deps.runtimeToken)) throw new DetailedError("invalid token", {
 			statusCode: 403,
 			code: "INVALID_TOKEN"
 		});
@@ -3399,6 +3601,7 @@ var init_control = __esmMin((() => {
 	init_deferred();
 	init_factory();
 	init_logger();
+	init_secret_compare();
 	init_validator();
 	init_workspace();
 	init_loopback();
@@ -3408,11 +3611,13 @@ var init_control = __esmMin((() => {
 /** What would have to run to bring `from` up to `to`. */
 function planConfigMigrations(from, options = {}) {
 	const to = options.to ?? 1;
+	const steps = (options.migrations ?? configMigrations).filter((migration) => migration.to > from && migration.to <= to).sort((a, b) => a.to - b.to);
 	return {
 		from,
 		to,
-		steps: (options.migrations ?? configMigrations).filter((migration) => migration.to > from && migration.to <= to).sort((a, b) => a.to - b.to),
-		tooNew: from > to
+		steps,
+		tooNew: from > to,
+		reached: steps.reduce((at, step) => step.to, from)
 	};
 }
 /** Applies the plan in order; the caller owns writing the result. */
@@ -3431,18 +3636,15 @@ var init_migrations = __esmMin((() => {
 }));
 //#endregion
 //#region src/config/parse.ts
-function isRecord$2(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 function deleteAtPath(root, path) {
 	let node = root;
 	for (const key of path.slice(0, -1)) {
-		node = Array.isArray(node) ? node[Number(key)] : isRecord$2(node) ? node[key] : void 0;
+		node = Array.isArray(node) ? node[Number(key)] : isRecord(node) ? node[key] : void 0;
 		if (node === void 0) return;
 	}
 	const last = path[path.length - 1];
 	if (last === void 0) return;
-	if (isRecord$2(node)) delete node[String(last)];
+	if (isRecord(node)) delete node[String(last)];
 	else if (Array.isArray(node) && typeof last === "number") node.splice(last, 1);
 }
 /**
@@ -3467,7 +3669,7 @@ function parseTolerant(value, schema, prefix, unknownKeys) {
 			value: null,
 			error: parsed.summary
 		};
-		if (!isRecord$2(candidate)) return {
+		if (!isRecord(candidate)) return {
 			value: null,
 			error: parsed.summary
 		};
@@ -3497,11 +3699,11 @@ function parseGrouped(raw, label, definition, options) {
 		schemaVersion: 1,
 		writtenBy: null
 	};
-	if (!isRecord$2(raw)) {
+	if (!isRecord(raw)) {
 		errors.push(`the ${label} must contain a JSON object`);
 		return result;
 	}
-	const meta = isRecord$2(raw.meta) ? raw.meta : null;
+	const meta = isRecord(raw.meta) ? raw.meta : null;
 	const schemaVersion = typeof meta?.schema === "number" ? meta.schema : 1;
 	const writtenBy = typeof meta?.writtenBy === "string" && meta.writtenBy.length > 0 ? meta.writtenBy : null;
 	result.schemaVersion = schemaVersion;
@@ -3583,11 +3785,11 @@ function parseServersFile(raw, defaults, options = {}) {
 		schemaVersion: 1,
 		writtenBy: null
 	};
-	if (!isRecord$2(raw)) {
+	if (!isRecord(raw)) {
 		errors.push("the servers config must contain a JSON object");
 		return result;
 	}
-	const meta = isRecord$2(raw.meta) ? raw.meta : null;
+	const meta = isRecord(raw.meta) ? raw.meta : null;
 	const schemaVersion = typeof meta?.schema === "number" ? meta.schema : 1;
 	const writtenBy = typeof meta?.writtenBy === "string" && meta.writtenBy.length > 0 ? meta.writtenBy : null;
 	result.schemaVersion = schemaVersion;
@@ -3605,9 +3807,9 @@ function parseServersFile(raw, defaults, options = {}) {
 	const seen = /* @__PURE__ */ new Set();
 	(Array.isArray(raw.servers) ? raw.servers : []).forEach((entry, index) => {
 		const label = `servers[${index}]`;
-		const parsed = parseTolerant(isRecord$2(entry) ? mergeDefaults(defaults, entry) : entry, serverSchema, label, unknownKeys);
+		const parsed = parseTolerant(isRecord(entry) ? mergeDefaults(defaults, entry) : entry, serverSchema, label, unknownKeys);
 		if (parsed.error !== null) {
-			const id = isRecord$2(entry) ? entry.id : void 0;
+			const id = isRecord(entry) ? entry.id : void 0;
 			errors.push(`${label}${typeof id === "string" ? ` ("${id}")` : ""}: ${parsed.error}`);
 			return;
 		}
@@ -3617,20 +3819,31 @@ function parseServersFile(raw, defaults, options = {}) {
 			return;
 		}
 		seen.add(server.id);
+		const { label: entryLabel, ...rest } = server;
 		result.servers.push({
-			...server,
-			port: server.port ?? null
+			...rest,
+			port: server.port ?? null,
+			...entryLabel === null || entryLabel === void 0 ? {} : { label: entryLabel }
 		});
 	});
-	warnings.push(...validateDependencies(result.servers));
+	warnings.push(...validateCrossField(result.servers));
 	return result;
 }
-/** Dangling dependencies and cycles are reported, not fatal: supervision still runs. */
-function validateDependencies(servers) {
+/**
+* Config that validates field-by-field but is wrong as a whole.
+*
+* Warned rather than refused, because supervision still runs and a hard failure would take a working
+* panel down over a setting one field away from correct.
+*/
+function validateCrossField(servers) {
 	const ids = new Set(servers.map((server) => server.id));
 	const errors = [];
-	for (const server of servers) for (const dependency of server.dependsOn) if (dependency === server.id) errors.push(`"${server.id}" depends on itself`);
-	else if (!ids.has(dependency)) errors.push(`"${server.id}" depends on unknown server "${dependency}"`);
+	for (const server of servers) {
+		const { health } = server;
+		if (health.mode === "http" && health.http.method === "HEAD" && health.http.expectBody.length > 0) errors.push(`"${server.id}" requires a response body with method HEAD, which has none — the body check is ignored`);
+		for (const dependency of server.dependsOn) if (dependency === server.id) errors.push(`"${server.id}" depends on itself`);
+		else if (!ids.has(dependency)) errors.push(`"${server.id}" depends on unknown server "${dependency}"`);
+	}
 	const visiting = /* @__PURE__ */ new Set();
 	const settled = /* @__PURE__ */ new Set();
 	const byId = new Map(servers.map((server) => [server.id, server]));
@@ -3665,20 +3878,22 @@ var init_parse = __esmMin((() => {
 	init_migrations();
 	init_schema();
 	init_version();
+	init_shape();
 	UNDECLARED = "must be removed";
 }));
 //#endregion
 //#region src/config/patch.ts
-function isRecord$1(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 function applyPatch(target, patch, mergeKeys) {
 	for (const [key, value] of Object.entries(patch)) {
 		if (value === void 0) continue;
-		if (mergeKeys.has(key) && isRecord$1(value) && isRecord$1(target[key])) {
+		if (mergeKeys.has(key) && isRecord(value) && isRecord(target[key])) {
 			target[key] = mergeGroup(target[key], value);
 			continue;
 		}
+		if (value === null) {
+			delete target[key];
+			continue;
+		}
 		target[key] = value;
 	}
 }
@@ -3696,7 +3911,7 @@ function mergeGroup(target, patch) {
 			delete merged[key];
 			continue;
 		}
-		if (isRecord$1(value) && isRecord$1(merged[key])) {
+		if (isRecord(value) && isRecord(merged[key])) {
 			merged[key] = mergeGroup(merged[key], value);
 			continue;
 		}
@@ -3706,6 +3921,7 @@ function mergeGroup(target, patch) {
 }
 var SERVER_MERGE_KEYS, CONTROL_MERGE_KEYS, NOTIFICATION_MERGE_KEYS, DDNS_MERGE_KEYS, PROXY_MERGE_KEYS, EMPTY_MERGE_KEYS;
 var init_patch = __esmMin((() => {
+	init_shape();
 	SERVER_MERGE_KEYS = /* @__PURE__ */ new Set([
 		"restart",
 		"health",
@@ -3756,6 +3972,16 @@ var init_settings$1 = __esmMin((() => {
 	init_paths();
 	ConfigError = class extends Error {
 		name = "ConfigError";
+		/**
+		* The *kind* of config problem, when a caller has to branch on it rather than just report it.
+		* `UNKNOWN_SERVER` is the one case today: the servers route answers 404 for a missing id and 400
+		* for an invalid patch, and it decided that by matching the message text.
+		*/
+		code;
+		constructor(message, code) {
+			super(message);
+			this.code = code;
+		}
 	};
 	GlobalSettingsStore = class {
 		file;
@@ -4054,12 +4280,22 @@ async function call$1(path, headers, context, init = {}) {
 * Walks the host's parents through `GET /zones?name=`, which is how the
 * reference image resolves a zone without a pasted zone id; the id is cached in
 * the panel's state file, so it usually costs nothing.
+*
+* A cached id is **confirmed before use**, the same way `findRecord` treats its own. It was returned
+* outright, so a stale id — the zone deleted, the API token swapped to another account, a restored
+* `ddns.json` — made every later call address a zone the token cannot see, and the walk that would have
+* found the right one never ran: the update failed permanently, with the provider's error for a zone
+* that is not even the host's. One extra request per run, and only when a cache exists.
 */
 async function resolveZone(host, headers, context, cached) {
-	if (cached !== void 0) return {
-		id: cached,
-		name: host
-	};
+	if (cached !== void 0) {
+		const confirmed = await call$1(`/zones/${cached}`, headers, context);
+		if (confirmed.error === null && confirmed.data !== null) return {
+			id: cached,
+			name: host
+		};
+		if (confirmed.status === 0) throw new Error(confirmed.error ?? "could not reach Cloudflare");
+	}
 	const labels = host.split(".");
 	for (let index = 0; index <= labels.length - 2; index++) {
 		const candidate = labels.slice(index).join(".");
@@ -5381,6 +5617,8 @@ function validateDdnsConfig(config) {
 			errors.push(`"${domain.host}" points at unknown account "${domain.account}"`);
 			continue;
 		}
+		const zone = domain.zone?.trim().toLowerCase();
+		if (zone !== void 0 && zone.length > 0 && domain.host.toLowerCase() !== zone && !domain.host.toLowerCase().endsWith(`.${zone}`)) errors.push(`"${domain.host}" has zone "${domain.zone}", which it is not inside — a zone is the registered domain the record lives in`);
 		const provider = ddnsProvider(account.provider);
 		if (provider !== null) for (const recordType of domain.types) {
 			if (!provider.families.includes(recordType)) errors.push(`${account.label || provider.label} cannot manage ${recordType} records ("${domain.host}")`);
@@ -5661,7 +5899,7 @@ var init_store = __esmMin((() => {
 		}
 		updateServer(id, patch) {
 			const index = (this.rawServers.servers ?? []).findIndex((entry) => entry.id === id);
-			if (index < 0) throw new ConfigError(`unknown server "${id}"`);
+			if (index < 0) throw new ConfigError(`unknown server "${id}"`, "UNKNOWN_SERVER");
 			const draft = structuredClone(this.rawServers);
 			const entry = draft.servers[index];
 			applyPatch(entry, patch, SERVER_MERGE_KEYS);
@@ -5723,7 +5961,7 @@ var init_store = __esmMin((() => {
 			const list = draft.servers ?? [];
 			const before = list.length;
 			draft.servers = list.filter((entry) => entry.id !== id);
-			if (draft.servers.length === before) throw new ConfigError(`unknown server "${id}"`);
+			if (draft.servers.length === before) throw new ConfigError(`unknown server "${id}"`, "UNKNOWN_SERVER");
 			this.commitServers(draft);
 		}
 		/**
@@ -5945,20 +6183,28 @@ var init_ddns$1 = __esmMin((() => {
 	accountParam = type({ id: "/^[a-z0-9][a-z0-9_-]*$/" });
 }));
 //#endregion
-//#region src/services/events.ts
+//#region src/shared/server-key.ts
 /**
-* Fan-out for SSE subscribers, optionally scoped to one server.
+* The SSE bucket key: one server inside one workspace.
+*
+* A server id is only unique within its workspace, so anything keyed by id alone mixes frames between
+* same-named servers — and this key was **three separate definitions**: `services/events.ts` (which
+* dispatches) and both UIs' composables (which subscribe). Byte-identical today, but a change to the
+* format on either side would route messages to the wrong bucket or to none, silently — the panel
+* would simply stop updating, with nothing to error on.
 *
-* The scope is `workspaceId/serverId`, never the bare id: server ids are only
-* unique *within* a workspace, so keying on the id alone would deliver one
-* workspace's log lines to a subscriber watching another workspace's server of
-* the same name.
+* It lives in `src/shared` rather than a UI because this module imports no Vue and is reachable from
+* the server and both UIs alike.
 */
 function serverKey(workspaceId, serverId) {
 	return `${workspaceId}/${serverId}`;
 }
+var init_server_key = __esmMin((() => {}));
+//#endregion
+//#region src/services/events.ts
 var ALL, EventHub;
 var init_events$1 = __esmMin((() => {
+	init_server_key();
 	ALL = "*";
 	EventHub = class {
 		listeners = /* @__PURE__ */ new Map();
@@ -5976,11 +6222,6 @@ var init_events$1 = __esmMin((() => {
 			this.dispatch(ALL, message);
 			if (message.serverId && message.workspaceId) this.dispatch(serverKey(message.workspaceId, message.serverId), message);
 		}
-		get subscriberCount() {
-			let total = 0;
-			for (const bucket of this.listeners.values()) total += bucket.size;
-			return total;
-		}
 		dispatch(key, message) {
 			const bucket = this.listeners.get(key);
 			if (!bucket) return;
@@ -6084,17 +6325,7 @@ function createHealthRoute(deps) {
 		responses: {
 			200: {
 				description: "Serving",
-				content: jsonBody(type({
-					"status": "\"ok\" | \"degraded\"",
-					"uptimeMs": "number",
-					"servers?": type({
-						total: "number",
-						running: "number",
-						crashed: "number",
-						unhealthy: "number"
-					}),
-					"hostAlerts?": "string[]"
-				}))
+				content: jsonBody(healthResponseSchema)
 			},
 			503: { description: "An autostart server has crashed" }
 		}
@@ -6122,15 +6353,10 @@ var init_health = __esmMin((() => {
 	init_factory();
 	init_openapi$1();
 	init_auth();
+	init_contracts();
 }));
 //#endregion
 //#region src/api/logs.ts
-function unknownServer$1(id) {
-	return new DetailedError(`unknown server "${id}"`, {
-		statusCode: 404,
-		code: "UNKNOWN_SERVER"
-	});
-}
 function createLogsRoute(deps) {
 	return appFactory.createApp().get("/logs", describeRoute({
 		tags: ["logs"],
@@ -6157,15 +6383,24 @@ function createLogsRoute(deps) {
 	}), validate("query", historyQuery), validate("param", idParam$2), (c) => {
 		const runtime = requireWorkspace(deps.panel.requireWorkspace.bind(deps.panel), c.req.valid("query").workspace);
 		const { id } = c.req.valid("param");
-		if (!runtime.store.getServer(id)) throw unknownServer$1(id);
+		if (!runtime.store.getServer(id)) throw unknownServerError(id);
 		const query = c.req.valid("query");
 		const requested = query.tail === void 0 ? DEFAULT_TAIL : Number.parseInt(query.tail, 10);
 		const tail = Number.isNaN(requested) ? DEFAULT_TAIL : Math.min(Math.max(requested, MIN_TAIL), MAX_TAIL);
 		const info = runtime.logFiles.info(id);
 		const search = query.search?.trim() ?? "";
-		const window = search.length > 0 ? Math.max(tail, MAX_TAIL) : tail;
+		const stream = query.stream ?? "";
+		/**
+		* A filter that keeps only *some* of the lines has to read a wider window than the
+		* display tail, or "the last 500 stderr lines" silently means "the stderr lines among
+		* the last 500 overall" — 50 of them, in a log where every tenth line is stderr, and
+		* 500 exist. `search` already widened for exactly this reason; `stream` is the same
+		* shape of filter and did not, so it was short whenever the two streams interleave.
+		*/
+		const window = search.length > 0 || stream.length > 0 ? Math.max(tail, MAX_TAIL) : tail;
 		let lines = runtime.logFiles.readTail(id, window);
-		if (query.stream !== void 0 && query.stream.length > 0) lines = lines.filter((line) => line.stream === query.stream);
+		if (stream.length > 0) lines = lines.filter((line) => line.stream === stream);
+		const windowLines = lines.length;
 		if (search.length > 0) {
 			const needle = search.toLowerCase();
 			lines = lines.filter((line) => line.text.toLowerCase().includes(needle));
@@ -6175,7 +6410,7 @@ function createLogsRoute(deps) {
 			enabled: info.enabled,
 			sizeBytes: info.sizeBytes,
 			files: info.files.map((file) => file.name),
-			searched: search.length > 0 ? window : null,
+			searched: search.length > 0 ? windowLines : null,
 			lines: lines.slice(-tail)
 		});
 	}).get("/logs/:id/download", describeRoute({
@@ -6188,7 +6423,7 @@ function createLogsRoute(deps) {
 	}), validate("query", downloadQuery), validate("param", idParam$2), (c) => {
 		const runtime = requireWorkspace(deps.panel.requireWorkspace.bind(deps.panel), c.req.valid("query").workspace);
 		const { id } = c.req.valid("param");
-		if (!runtime.store.getServer(id)) throw unknownServer$1(id);
+		if (!runtime.store.getServer(id)) throw unknownServerError(id);
 		const requested = c.req.valid("query").file ?? `${id}.log`;
 		if (!runtime.logFiles.info(id).files.map((file) => file.name).includes(requested)) throw new DetailedError("unknown log file", {
 			statusCode: 404,
@@ -6211,13 +6446,14 @@ function createLogsRoute(deps) {
 	}), validate("query", workspaceQuerySchema), validate("param", idParam$2), (c) => {
 		const runtime = requireWorkspace(deps.panel.requireWorkspace.bind(deps.panel), c.req.valid("query").workspace);
 		const { id } = c.req.valid("param");
-		if (!runtime.store.getServer(id)) throw unknownServer$1(id);
+		if (!runtime.store.getServer(id)) throw unknownServerError(id);
 		runtime.logFiles.clear(id);
 		return c.json({ ok: true });
 	});
 }
 var MIN_TAIL, MAX_TAIL, DEFAULT_TAIL, idParam$2, downloadQuery, historyQuery;
 var init_logs$1 = __esmMin((() => {
+	init_action_result();
 	init_factory();
 	init_openapi$1();
 	init_validator();
@@ -6445,10 +6681,7 @@ function createNotificationsRoute(deps) {
 		responses: {
 			200: {
 				description: "Chats",
-				content: jsonBody(type({ chats: type({
-					id: "string | number",
-					title: "string"
-				}).array() }))
+				content: jsonBody(telegramChatsSchema)
 			},
 			400: ERROR_RESPONSES[400]
 		}
@@ -6836,19 +7069,35 @@ function sameArg(a, b) {
 	const normalize = (value) => comparable(value).replace(/["\\]/g, "");
 	return normalize(a) === normalize(b);
 }
-/** The same file spelled differently (`node`, `node.exe`, a relative path) compares equal. */
+/** Whether a value names a file with no directory part, under either platform's separator. */
+function isBare(value) {
+	return !value.includes("/") && !value.includes("\\");
+}
+/**
+* The same file spelled differently compares equal — but only while one of the two spellings is a
+* bare name, which is the case the fallback exists for: the config says `node` and the process table
+* reports `/usr/bin/node`, or the reverse on Windows.
+*
+* When **both** spellings name a directory, they are two different files. Comparing basenames
+* unconditionally made `/tmp/evil/server.js` match `/srv/web/server.js`, and a false match here is
+* not cosmetic: the panel would treat a process it never spawned as its own entry, so `follow` adopts
+* a stranger and `reclaim`/`kill` may remove one.
+*/
 function sameWord(a, b) {
 	const left = comparable(a);
 	const right = comparable(b);
-	if (left === right || path.basename(left) === path.basename(right)) return true;
-	return path.extname(b) === "" && path.basename(left, path.extname(left)) === right;
+	if (left === right) return true;
+	if (!isBare(left) && !isBare(right)) return false;
+	return path.basename(left) === path.basename(right) || path.extname(b) === "" && path.basename(left, path.extname(left)) === right || path.extname(a) === "" && path.basename(right, path.extname(right)) === left;
 }
 /**
 * True when the argv a process is running is the entry's own: the image must match where
 * `spawn` would have looked it up — the image Path, or the first word of the command line
 * — and the words after it must open with the entry's args, compared literally. So
 * `spawn --port 4000` also covers `spawn -p 4000 --extra`, which is what a self-restarting
-* wrapper does, while `/tmp/evil/server.js` never covers `/srv/web/server.js`.
+* wrapper does, while `/tmp/evil/server.js` never covers `/srv/web/server.js` — two paths that name
+* a directory are different files, and the basename fallback applies only while one spelling is bare
+* (see `sameWord`).
 *
 * `words` must already be the process's own argv. A command-line *string* is only correct
 * on Windows, where the OS hands one out; `/proc/<pid>/cmdline` quotes are literal bytes
@@ -7036,13 +7285,20 @@ async function killPortHolders(port, exclude) {
 	} catch {}
 	return pids;
 }
-/** Signal 0 asks the OS whether the pid still exists, without touching it. */
-function isProcessAlive$1(pid) {
+/**
+* Signal 0 asks the OS whether the pid still exists, without touching it.
+*
+* `EPERM` means the process is there but is **not ours to signal** — a port holder owned by another
+* user is exactly that. Returning `false` for it made `nannyIsAlive` report a live nanny as gone, so
+* `resumePersistent` consumed its state file and started a second copy of the entry while the first ran
+* on untracked. `helpers/daemon.ts` already had this right; the two predicates now agree.
+*/
+function isProcessAlive(pid) {
 	try {
 		process.kill(pid, 0);
 		return true;
-	} catch {
-		return false;
+	} catch (error) {
+		return error.code === "EPERM";
 	}
 }
 function signalPid$1(pid, name) {
@@ -7060,13 +7316,13 @@ function delay$2(ms) {
 */
 async function terminatePids(pids, options = {}) {
 	const graceMs = options.graceMs ?? 3e3;
-	const aliveBefore = [...new Set(pids)].filter(isProcessAlive$1);
+	const aliveBefore = [...new Set(pids)].filter(isProcessAlive);
 	for (const pid of aliveBefore) signalPid$1(pid, "SIGTERM");
 	const deadline = Date.now() + graceMs;
-	let alive = aliveBefore.filter(isProcessAlive$1);
+	let alive = aliveBefore.filter(isProcessAlive);
 	while (alive.length > 0 && Date.now() < deadline) {
 		await delay$2(100);
-		alive = alive.filter(isProcessAlive$1);
+		alive = alive.filter(isProcessAlive);
 	}
 	const stopped = aliveBefore.filter((pid) => !alive.includes(pid));
 	for (const pid of alive) signalPid$1(pid, "SIGKILL");
@@ -7117,6 +7373,14 @@ async function listPortHolders(port) {
 		return [];
 	}
 }
+/**
+* Pids from `lsof -ti` (one per line) or `fuser` (space-separated, on one line, with a leading
+* space) — both shapes arrive here, which is why the split is on `\s+` rather than `\n`.
+*
+* Exported for its test: this feeds `killPortHolders`, which sends SIGKILL, so a parser that
+* picked up the wrong number would kill an unrelated process. The filter is not decorative —
+* `Number.parseInt('')` is NaN for the empty leading cell, and a pid of 0 or our own is dropped.
+*/
 function parsePids(stdout) {
 	return [...new Set(stdout.split(/\s+/).map((entry) => Number.parseInt(entry, 10)).filter((pid) => Number.isInteger(pid) && pid > 0 && pid !== process.pid))];
 }
@@ -7219,9 +7483,34 @@ function writeNannyState(file, state) {
 function clearNannyState(file) {
 	fs.rmSync(file, { force: true });
 }
-/** The same wording the supervisor uses for a child's exit, so history reads alike. */
+/**
+* The same wording the supervisor uses for a child's exit, so history reads alike — plus a hint
+* when the code has a conventional meaning, because `code 137` alone tells an operator nothing and
+* that is the one they most want explained (a container limit or the kernel OOM killer).
+*
+* The hint is worded as a possibility, never a claim: 128+N is a shell convention, and a program
+* is free to exit 137 for its own reasons — a JVM reports OOM that way itself. 126 and 127 are
+* firmer, since the shell sets those when it cannot run the command at all.
+*/
 function describeNannyExit(exit) {
-	return exit.signal !== null ? `signal ${exit.signal}` : `code ${exit.code}`;
+	if (exit.signal !== null) return `signal ${exit.signal}`;
+	const hint = exitCodeHint(exit.code);
+	return hint === null ? `code ${exit.code}` : `code ${exit.code} (${hint})`;
+}
+/** What a conventional exit code usually means, or null when there is nothing to add. */
+function exitCodeHint(code) {
+	if (code === null || code === 0) return null;
+	if (code === 126) return "the command is not executable";
+	if (code === 127) return "the command was not found";
+	if (code <= 128 || code > 192) return null;
+	const signal = signalName(code - 128);
+	if (signal === null) return null;
+	return code === 137 ? `${signal} — which the kernel sends when memory runs out` : `${signal}, if the shell reported the kill`;
+}
+/** `SIGKILL` for 9, or null when the number names nothing. */
+function signalName(number) {
+	for (const [name, value] of Object.entries(os.constants.signals)) if (value === number) return name;
+	return null;
 }
 /**
 * Is the nanny this state describes still ours? A live pid proves nothing on its
@@ -7230,7 +7519,7 @@ function describeNannyExit(exit) {
 * everywhere else, Windows included.
 */
 async function nannyIsAlive(state, id) {
-	if (state.nannyPid <= 0 || !isProcessAlive$1(state.nannyPid)) return false;
+	if (state.nannyPid <= 0 || !isProcessAlive(state.nannyPid)) return false;
 	if (Date.now() - state.heartbeatAt <= 3e4) return true;
 	if (await processCarriesServerId(state.nannyPid, id)) return true;
 	const words = await processArgv(state.nannyPid);
@@ -7460,8 +7749,8 @@ function matchFor(route) {
 	const match = { host: [route.host] };
 	const prefix = route.path.trim();
 	if (prefix.length > 0) {
-		const base = prefix.startsWith("/") ? prefix : `/${prefix}`;
-		match.path = base === "/" ? ["/*"] : [base, `${base.replace(/\/$/, "")}/*`];
+		const base = (prefix.startsWith("/") ? prefix : `/${prefix}`).replace(/\/+$/, "");
+		match.path = base.length === 0 ? ["/*"] : [base, `${base}/*`];
 	}
 	return match;
 }
@@ -7590,6 +7879,24 @@ var init_proxy_config = __esmMin((() => {
 }));
 //#endregion
 //#region src/services/tls.ts
+/** Whether the certificate's validity window covers now. Both ends, from one place. */
+function validityError(x509, now = Date.now()) {
+	if (new Date(x509.validFrom).getTime() > now) return `the certificate is not valid until ${x509.validFrom}`;
+	if (new Date(x509.validTo).getTime() < now) return `the certificate expired on ${x509.validTo}`;
+	return null;
+}
+/** Whether the private key is the one that certificate was issued for. */
+function publicKeysMatch(certificate, privateKey) {
+	const fromKey = createPublicKey(createPrivateKey(privateKey)).export({
+		type: "spki",
+		format: "der"
+	});
+	const fromCert = new X509Certificate(certificate).publicKey.export({
+		type: "spki",
+		format: "der"
+	});
+	return Buffer$1.from(fromKey).equals(Buffer$1.from(fromCert));
+}
 /** Checks the certificate parses, is time-valid, and matches the private key. */
 function validatePair(certificate, privateKey) {
 	let x509;
@@ -7602,16 +7909,7 @@ function validatePair(certificate, privateKey) {
 		};
 	}
 	try {
-		const key = createPrivateKey(privateKey);
-		const fromKey = createPublicKey(key).export({
-			type: "spki",
-			format: "der"
-		});
-		const fromCert = x509.publicKey.export({
-			type: "spki",
-			format: "der"
-		});
-		if (!Buffer$1.from(fromKey).equals(Buffer$1.from(fromCert))) return {
+		if (!publicKeysMatch(certificate, privateKey)) return {
 			ok: false,
 			error: "the private key does not match the certificate"
 		};
@@ -7621,15 +7919,17 @@ function validatePair(certificate, privateKey) {
 			error: `private key is not a valid PEM: ${error instanceof Error ? error.message : String(error)}`
 		};
 	}
-	if (new Date(x509.validTo).getTime() < Date.now()) return {
+	const invalid = validityError(x509);
+	if (invalid !== null) return {
 		ok: false,
-		error: `the certificate expired on ${x509.validTo}`
+		error: invalid
 	};
 	return { ok: true };
 }
 var TlsStore;
 var init_tls$1 = __esmMin((() => {
 	init_atomic();
+	init_logger();
 	TlsStore = class {
 		dir;
 		name;
@@ -7690,6 +7990,25 @@ var init_tls$1 = __esmMin((() => {
 			this.cachedMtime = "";
 			return { ok: true };
 		}
+		/**
+		* The pair to serve, or `null` when there is nothing servable.
+		*
+		* `load()` returns whatever is on disk, and `serve({ tls })` **throws synchronously** on a pair that
+		* does not match (`ERR_OSSL_X509_KEY_VALUES_MISMATCH`) — before `listen()`'s `ready()`/`error` race
+		* can catch it. A mismatched pair therefore fails the reboot: hand-copied files, a restore, or a
+		* crash between `save()`'s two writes all reach it, and the panel reports an OpenSSL code instead of
+		* booting on http or naming the problem. Validated here, where the answer is still recoverable.
+		*/
+		servable() {
+			const pair = this.load();
+			if (pair === null) return null;
+			const validation = validatePair(pair.cert, pair.key);
+			if (!validation.ok) {
+				logger.warn(`the stored TLS pair will not be served: ${validation.error ?? "it is not usable"}`);
+				return null;
+			}
+			return pair;
+		}
 		clear() {
 			for (const file of [this.certPath, this.keyPath]) try {
 				fs.rmSync(file, { force: true });
@@ -7722,6 +8041,7 @@ var init_tls$1 = __esmMin((() => {
 				const x509 = new X509Certificate(pair.cert);
 				const validTo = new Date(x509.validTo);
 				const daysRemaining = Math.floor((validTo.getTime() - Date.now()) / 864e5);
+				const keyMatches = publicKeysMatch(pair.cert, pair.key);
 				return {
 					...base,
 					subject: x509.subject.replace(/\n/g, ", "),
@@ -7730,8 +8050,8 @@ var init_tls$1 = __esmMin((() => {
 					validTo: validTo.toISOString(),
 					daysRemaining,
 					fingerprint: x509.fingerprint256,
-					keyMatches: validatePair(pair.cert, pair.key).ok,
-					error: daysRemaining < 0 ? "the certificate has expired" : null
+					keyMatches,
+					error: validityError(x509) ?? (keyMatches ? null : "the private key does not match the certificate")
 				};
 			} catch (error) {
 				return {
@@ -7743,6 +8063,30 @@ var init_tls$1 = __esmMin((() => {
 	};
 }));
 //#endregion
+//#region src/shared/proxy-form.ts
+/** A name an ACME CA could issue for; anything else gets the engine's own CA. */
+function isPublicHost(host) {
+	const name = host.trim().toLowerCase();
+	if (name.length === 0 || name === "localhost" || !name.includes(".")) return false;
+	if (LOCAL_TLDS.some((tld) => name.endsWith(tld))) return false;
+	return !/^\d{1,3}(?:\.\d{1,3}){3,}$/.test(name);
+}
+var LOCAL_TLDS;
+var init_proxy_form = __esmMin((() => {
+	init_contracts();
+	LOCAL_TLDS = [
+		".localhost",
+		".local",
+		".internal",
+		".home.arpa",
+		".lan",
+		".home",
+		".test",
+		".invalid",
+		".example"
+	];
+}));
+//#endregion
 //#region src/services/proxy.ts
 /** The DNS names a certificate covers, from its SANs (and its subject as a fallback). */
 function namesOf(x509) {
@@ -7784,7 +8128,9 @@ function retryWindowMinutes(lifetimeMs) {
 function parseUpstream(value) {
 	const trimmed = value.trim();
 	if (trimmed.length === 0) return null;
-	const withScheme = /^https?:\/\//i.test(trimmed) ? trimmed : `http://${trimmed}`;
+	const explicit = /^([a-z][a-z0-9+.-]*):\/\//i.exec(trimmed);
+	if (explicit !== null && !/^https?$/i.test(explicit[1])) return null;
+	const withScheme = explicit === null ? `http://${trimmed}` : trimmed;
 	try {
 		const url = new URL(withScheme);
 		const port = url.port.length > 0 ? url.port : url.protocol === "https:" ? "443" : "80";
@@ -7850,12 +8196,6 @@ function validateProxyConfig(config, dnsAccount) {
 	}
 	return errors;
 }
-function isPublicHost(host) {
-	const name = host.toLowerCase();
-	if (name === "localhost" || !name.includes(".")) return false;
-	if (LOCAL_TLDS.some((tld) => name.endsWith(tld))) return false;
-	return !/^\d{1,3}(?:\.\d{1,3}){3,}$/.test(name);
-}
 /** Caddy answers with `{"error": "..."}`; that sentence is the useful part. */
 function engineMessage(body) {
 	try {
@@ -7865,7 +8205,7 @@ function engineMessage(body) {
 		return body.trim().length > 0 ? body.trim().slice(0, 400) : null;
 	}
 }
-var PROXY_ID, ADMIN_TIMEOUT_MS, READY_TIMEOUT_MS, READY_POLL_MS, DOWNLOAD_TIMEOUT_MS$1, ENGINE_COMMAND_TIMEOUT_MS, DNS01_MODULE, engineRecordSchema, challengeAuthSchema, appliedRecordSchema, adminRecordSchema, ProxyService, LOCAL_TLDS;
+var PROXY_ID, ADMIN_TIMEOUT_MS, READY_TIMEOUT_MS, READY_POLL_MS, DOWNLOAD_TIMEOUT_MS$1, ENGINE_COMMAND_TIMEOUT_MS, DNS01_MODULE, engineRecordSchema, challengeAuthSchema, appliedRecordSchema, adminRecordSchema, ProxyService;
 var init_proxy$1 = __esmMin((() => {
 	init_atomic();
 	init_logger();
@@ -7878,6 +8218,7 @@ var init_proxy$1 = __esmMin((() => {
 	init_proxy$2();
 	init_proxy_config();
 	init_tls$1();
+	init_proxy_form();
 	PROXY_ID = "proxy";
 	ADMIN_TIMEOUT_MS = 5e3;
 	READY_TIMEOUT_MS = 2e4;
@@ -7914,6 +8255,8 @@ var init_proxy$1 = __esmMin((() => {
 		nanny = null;
 		admin = null;
 		lastError = null;
+		/** The parsed failure map, keyed on the log's identity — see `obtainFailures`. */
+		failureCache = null;
 		/** The installed binary's modules, read once per process; an install clears it. */
 		moduleCache = null;
 		/** A legacy `engine.json` is reported once, not on every state frame. */
@@ -8342,15 +8685,41 @@ var init_proxy$1 = __esmMin((() => {
 		/**
 		* The last thing the engine said about obtaining a certificate, per name. Caddy
 		* has no admin endpoint that lists failures, so its own log is the source.
+		*
+		* Memoised on the file's identity and mtime, because this is called **per route** from
+		* `routeViews()` — which `view()` runs for every state frame and `sync()` runs every tick.
+		* Each call read the whole log (bounded at 2 MB by rotation), split every line and kept the
+		* last 400: ~1.3 ms each, so ~13 ms of blocking synchronous I/O per second at ten routes,
+		* for a file that only changes when the engine tries to obtain a certificate.
+		*
+		* The key is `ino` + `mtimeMs` + size, not mtime alone: rotation replaces the file, and a
+		* replacement can land in the same millisecond as the previous read.
 		*/
 		obtainFailures() {
-			const failures = /* @__PURE__ */ new Map();
+			const file = path.join(this.options.logDir, `${PROXY_ID}.log`);
+			let stamp;
+			try {
+				const stats = fs.statSync(file);
+				stamp = `${stats.ino}:${stats.mtimeMs}:${stats.size}`;
+			} catch {
+				this.failureCache = null;
+				return /* @__PURE__ */ new Map();
+			}
+			if (this.failureCache !== null && this.failureCache.stamp === stamp) return this.failureCache.failures;
 			let text;
 			try {
-				text = fs.readFileSync(path.join(this.options.logDir, `${PROXY_ID}.log`), "utf8");
+				text = fs.readFileSync(file, "utf8");
 			} catch {
-				return failures;
+				return /* @__PURE__ */ new Map();
 			}
+			const failures = this.parseFailures(text, /* @__PURE__ */ new Map());
+			this.failureCache = {
+				stamp,
+				failures
+			};
+			return failures;
+		}
+		parseFailures(text, failures) {
 			for (const line of text.trimEnd().split("\n").slice(-400)) {
 				let inner;
 				try {
@@ -8412,12 +8781,12 @@ var init_proxy$1 = __esmMin((() => {
 		engineRunning() {
 			const state = readNannyState(nannyStatePath(this.options.stateDir, PROXY_ID));
 			if (state === null || state.serverId !== PROXY_ID) return false;
-			return [state.nannyPid, state.childPid].some((pid) => pid !== null && pid > 0 && isProcessAlive$1(pid));
+			return [state.nannyPid, state.childPid].some((pid) => pid !== null && pid > 0 && isProcessAlive(pid));
 		}
 		live() {
 			const state = readNannyState(nannyStatePath(this.options.stateDir, PROXY_ID));
 			if (state === null || state.serverId !== PROXY_ID) return false;
-			return state.nannyPid > 0 && isProcessAlive$1(state.nannyPid) && Date.now() - state.heartbeatAt <= 3e4;
+			return state.nannyPid > 0 && isProcessAlive(state.nannyPid) && Date.now() - state.heartbeatAt <= 3e4;
 		}
 		status() {
 			const config = this.config;
@@ -8443,7 +8812,7 @@ var init_proxy$1 = __esmMin((() => {
 				lastError: "the proxy engine is not installed"
 			};
 			const state = readNannyState(nannyStatePath(this.options.stateDir, PROXY_ID));
-			if (state === null || state.serverId !== PROXY_ID || state.nannyPid <= 0 || !isProcessAlive$1(state.nannyPid)) {
+			if (state === null || state.serverId !== PROXY_ID || state.nannyPid <= 0 || !isProcessAlive(state.nannyPid)) {
 				const lastExit = state?.lastExit;
 				const detail = lastExit === void 0 ? null : `the engine exited with ${lastExit.signal === null ? `code ${lastExit.code}` : `signal ${lastExit.signal}`}`;
 				const lastError = this.lastError ?? detail;
@@ -9243,7 +9612,7 @@ var init_proxy$1 = __esmMin((() => {
 			if (state !== null && state.serverId === PROXY_ID) {
 				const pids = [state.nannyPid, state.childPid].filter((pid) => pid !== null && pid > 0);
 				for (const pid of pids) {
-					if (!isProcessAlive$1(pid)) continue;
+					if (!isProcessAlive(pid)) continue;
 					try {
 						process.kill(pid, "SIGTERM");
 					} catch (error) {
@@ -9251,8 +9620,8 @@ var init_proxy$1 = __esmMin((() => {
 					}
 				}
 				const deadline = Date.now() + (this.options.stopGraceMs ?? 1e4);
-				while (Date.now() < deadline && pids.some((pid) => isProcessAlive$1(pid))) await new Promise((resolve) => setTimeout(resolve, 100));
-				for (const pid of pids.filter(isProcessAlive$1)) try {
+				while (Date.now() < deadline && pids.some((pid) => isProcessAlive(pid))) await new Promise((resolve) => setTimeout(resolve, 100));
+				for (const pid of pids.filter(isProcessAlive)) try {
 					process.kill(pid, "SIGKILL");
 				} catch {}
 				fs.rmSync(statePath, { force: true });
@@ -9410,17 +9779,6 @@ var init_proxy$1 = __esmMin((() => {
 			}
 		}
 	};
-	LOCAL_TLDS = [
-		".localhost",
-		".local",
-		".internal",
-		".home.arpa",
-		".lan",
-		".home",
-		".test",
-		".invalid",
-		".example"
-	];
 }));
 //#endregion
 //#region src/api/proxy.ts
@@ -9631,12 +9989,6 @@ var init_proxy = __esmMin((() => {
 }));
 //#endregion
 //#region src/api/servers/$.routes.ts
-function unknownServer(id) {
-	return new DetailedError(`unknown server "${id}"`, {
-		statusCode: 404,
-		code: "UNKNOWN_SERVER"
-	});
-}
 function createServersRoute(deps) {
 	return appFactory.createApp().get("/", describeRoute({
 		tags: ["servers"],
@@ -9705,7 +10057,7 @@ function createServersRoute(deps) {
 		const runtime = requireWorkspace(deps.panel.requireWorkspace.bind(deps.panel), c.req.valid("query").workspace);
 		const { id } = c.req.valid("param");
 		const server = runtime.supervisor.views().find((entry) => entry.id === id);
-		if (!server) throw unknownServer(id);
+		if (!server) throw unknownServerError(id);
 		return c.json({ server });
 	}).get("/:id/logs", describeRoute({
 		tags: ["servers"],
@@ -9717,7 +10069,7 @@ function createServersRoute(deps) {
 	}), validate("query", bufferedLogsQuery), validate("param", idParam$1), (c) => {
 		const runtime = requireWorkspace(deps.panel.requireWorkspace.bind(deps.panel), c.req.valid("query").workspace);
 		const { id } = c.req.valid("param");
-		if (!runtime.store.getServer(id)) throw unknownServer(id);
+		if (!runtime.store.getServer(id)) throw unknownServerError(id);
 		const { limit } = c.req.valid("query");
 		const parsed = limit === void 0 ? NaN : Number.parseInt(limit, 10);
 		const bounded = Number.isNaN(parsed) ? void 0 : Math.min(Math.max(parsed, 1), 1e5);
@@ -9732,7 +10084,7 @@ function createServersRoute(deps) {
 	}), validate("query", workspaceQuerySchema), validate("param", idParam$1), (c) => {
 		const runtime = requireWorkspace(deps.panel.requireWorkspace.bind(deps.panel), c.req.valid("query").workspace);
 		const { id } = c.req.valid("param");
-		if (!runtime.store.getServer(id)) throw unknownServer(id);
+		if (!runtime.store.getServer(id)) throw unknownServerError(id);
 		return streamSSE(c, async (stream) => {
 			let closed = false;
 			let pending = 0;
@@ -9858,7 +10210,7 @@ function createServersRoute(deps) {
 			return c.json({ server: runtime.store.updateServer(c.req.valid("param").id, c.req.valid("json")) });
 		} catch (error) {
 			if (error instanceof ConfigError) {
-				const status = error.message.startsWith("unknown server") ? 404 : 400;
+				const status = error.code === "UNKNOWN_SERVER" ? 404 : 400;
 				throw new DetailedError(error.message, {
 					statusCode: status,
 					code: status === 404 ? "UNKNOWN_SERVER" : "INVALID_SERVER"
@@ -9884,7 +10236,7 @@ function createServersRoute(deps) {
 			runtime.store.removeServer(id);
 			return c.json({ ok: true });
 		} catch (error) {
-			if (error instanceof ConfigError) throw unknownServer(id);
+			if (error instanceof ConfigError) throw unknownServerError(id);
 			throw error;
 		}
 	});
@@ -10019,47 +10371,66 @@ function createSettingsRoute(deps) {
 			rebinding: endpointChanged || proxyChanged || tlsChanged,
 			targetUrl
 		});
-	}).post("/settings/ui", describeRoute({
-		tags: ["panel"],
-		summary: "Replace the panel UI with an uploaded static build",
-		responses: {
-			200: { description: "Installed" },
-			400: ERROR_RESPONSES[400],
-			413: { description: "Too large" }
-		}
-	}), async (c) => {
-		const declared = Number.parseInt(c.req.header("content-length") ?? "0", 10);
-		if (Number.isFinite(declared) && declared > MAX_UI_UPLOAD_BYTES) throw new DetailedError(`the upload is larger than ${Math.round(MAX_UI_UPLOAD_BYTES / 1024 / 1024)}MB`, {
-			statusCode: 413,
-			code: "UPLOAD_TOO_LARGE"
-		});
-		const file = (await c.req.parseBody()).file;
-		if (!(file instanceof File)) throw new DetailedError("expected a `file` field with the UI archive", {
-			statusCode: 400,
-			code: "MISSING_FILE"
-		});
-		if (file.size > MAX_UI_UPLOAD_BYTES) throw new DetailedError(`the upload is larger than ${Math.round(MAX_UI_UPLOAD_BYTES / 1024 / 1024)}MB`, {
-			statusCode: 413,
-			code: "UPLOAD_TOO_LARGE"
-		});
-		const staging = path.join(path.dirname(deps.ui.directory), `.ui-upload-${Date.now()}.zip`);
-		try {
-			await fs.promises.writeFile(staging, Buffer$1.from(await file.arrayBuffer()));
-			const result = await deps.ui.install(staging, sanitizeName(file.name));
-			if (!result.ok) throw new DetailedError(result.error, {
+	}).post(
+		"/settings/ui",
+		describeRoute({
+			tags: ["panel"],
+			summary: "Replace the panel UI with an uploaded static build",
+			responses: {
+				200: { description: "Installed" },
+				400: ERROR_RESPONSES[400],
+				413: ERROR_RESPONSES[413]
+			}
+		}),
+		/**
+		* Bound the body **while it arrives**, not after. The checks below read `Content-Length`, which a
+		* chunked request does not send, and compare `file.size` only after `parseBody()` has buffered
+		* everything — so an upload with no declared length was read into memory in full and then refused.
+		* See the same reasoning in `api/backups.ts`.
+		*/
+		bodyLimit({
+			maxSize: MAX_UI_UPLOAD_BYTES,
+			onError: () => {
+				throw new DetailedError(`the upload is larger than ${Math.round(MAX_UI_UPLOAD_BYTES / 1024 / 1024)}MB`, {
+					statusCode: 413,
+					code: "UPLOAD_TOO_LARGE"
+				});
+			}
+		}),
+		async (c) => {
+			const declared = Number.parseInt(c.req.header("content-length") ?? "0", 10);
+			if (Number.isFinite(declared) && declared > MAX_UI_UPLOAD_BYTES) throw new DetailedError(`the upload is larger than ${Math.round(MAX_UI_UPLOAD_BYTES / 1024 / 1024)}MB`, {
+				statusCode: 413,
+				code: "UPLOAD_TOO_LARGE"
+			});
+			const file = (await c.req.parseBody()).file;
+			if (!(file instanceof File)) throw new DetailedError("expected a `file` field with the UI archive", {
 				statusCode: 400,
-				code: "INVALID_UI"
+				code: "MISSING_FILE"
 			});
-			logger.info(`UI replaced with ${result.meta.name} (${result.meta.files} files)`);
-			return c.json({
-				ok: true,
-				meta: result.meta,
-				ui: deps.ui.status()
+			if (file.size > MAX_UI_UPLOAD_BYTES) throw new DetailedError(`the upload is larger than ${Math.round(MAX_UI_UPLOAD_BYTES / 1024 / 1024)}MB`, {
+				statusCode: 413,
+				code: "UPLOAD_TOO_LARGE"
 			});
-		} finally {
-			fs.rmSync(staging, { force: true });
+			const staging = path.join(path.dirname(deps.ui.directory), `.ui-upload-${Date.now()}.zip`);
+			try {
+				await fs.promises.writeFile(staging, Buffer$1.from(await file.arrayBuffer()));
+				const result = await deps.ui.install(staging, sanitizeName(file.name));
+				if (!result.ok) throw new DetailedError(result.error, {
+					statusCode: 400,
+					code: "INVALID_UI"
+				});
+				logger.info(`UI replaced with ${result.meta.name} (${result.meta.files} files)`);
+				return c.json({
+					ok: true,
+					meta: result.meta,
+					ui: deps.ui.status()
+				});
+			} finally {
+				fs.rmSync(staging, { force: true });
+			}
 		}
-	}).delete("/settings/ui", describeRoute({
+	).delete("/settings/ui", describeRoute({
 		tags: ["panel"],
 		summary: "Go back to the stock UI",
 		responses: { 200: { description: "Reverted" } }
@@ -10263,7 +10634,9 @@ function createTlsRoute(deps) {
 	}), (c) => {
 		deps.tls.clear();
 		if (deps.panel.settings.control.tls.enabled) afterResponse(async () => {
-			await deps.controlServer.restart();
+			const result = await deps.controlServer.restart();
+			if (!result.ok) logger.error(`could not reload TLS after removing the pair: ${result.error ?? "unknown error"}`);
+			else logger.info(`control panel reloaded — ${deps.panel.settings.control.tls.enabled && deps.tls.servable() !== null ? "https" : "http"}`);
 		}, (error) => logger.error("tls reload failed", error));
 		return c.json(review());
 	});
@@ -10282,8 +10655,8 @@ var init_tls = __esmMin((() => {
 /** A registry failure is an API failure: unknown ids are 404, conflicts 409, the rest 400. */
 function workspaceFailure(error) {
 	if (error instanceof WorkspaceError) {
-		const unknown = error.message.startsWith("unknown workspace");
-		const conflict = error.message.endsWith("already exists");
+		const unknown = error.code === "UNKNOWN_WORKSPACE";
+		const conflict = error.code === "WORKSPACE_EXISTS";
 		throw new DetailedError(error.message, {
 			statusCode: unknown ? 404 : conflict ? 409 : 400,
 			code: unknown ? "UNKNOWN_WORKSPACE" : conflict ? "WORKSPACE_EXISTS" : "INVALID_WORKSPACE"
@@ -10426,18 +10799,11 @@ var init_error = __esmMin((() => {
 * UI author has to be able to read it before they can log in.
 */
 /** The version the package was built with, so the spec never drifts from it. */
-function packageVersion$1() {
-	try {
-		return JSON.parse(fs.readFileSync(new URL("../package.json", import.meta.url), "utf8")).version ?? "0.0.0";
-	} catch {
-		return "0.0.0";
-	}
-}
 function setupOpenAPI(app) {
 	return appFactory.createApp().get(`${PREFIX}/spec.json`, openAPIRouteHandler(app, { documentation: {
 		info: {
 			title: "home-hosted",
-			version: packageVersion$1(),
+			version: appVersion(),
 			description: "Control plane for the processes you host at home: servers, logs, vitals, backups and settings."
 		},
 		tags: [
@@ -10478,6 +10844,7 @@ function setupOpenAPI(app) {
 var PREFIX;
 var init_openapi = __esmMin((() => {
 	init_factory();
+	init_version();
 	PREFIX = "/openapi";
 }));
 //#endregion
@@ -10530,7 +10897,7 @@ var layout_exports = /* @__PURE__ */ __exportAll({
 function readJson(file) {
 	try {
 		const parsed = JSON.parse(fs.readFileSync(file, "utf8"));
-		return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : null;
+		return isRecord(parsed) ? parsed : null;
 	} catch {
 		return null;
 	}
@@ -10736,6 +11103,7 @@ var EMPTY, KNOWN_TOP_LEVEL;
 var init_layout = __esmMin((() => {
 	init_logger();
 	init_paths();
+	init_shape();
 	EMPTY = {
 		migrated: false,
 		moved: [],
@@ -10784,15 +11152,6 @@ function clearRuntime() {
 function newToken() {
 	return randomBytes(32).toString("base64url");
 }
-/** Signal 0 only probes the pid; `EPERM` still means the process is there. */
-function isProcessAlive(pid) {
-	try {
-		process.kill(pid, 0);
-		return true;
-	} catch (error) {
-		return error.code === "EPERM";
-	}
-}
 /** A degraded panel is still answering: a 503 must not read as "not running". */
 async function probeRuntime(runtime, timeoutMs = 2500) {
 	const answer = await localCall(runtime, "/healthz", "GET", void 0, timeoutMs);
@@ -10872,6 +11231,7 @@ var runtimeSchema;
 var init_daemon = __esmMin((() => {
 	init_atomic();
 	init_paths();
+	init_port();
 	runtimeSchema = type({
 		version: "string",
 		pid: "number.integer >= 1",
@@ -10932,15 +11292,9 @@ function failure(status, message) {
 		headers: { "content-type": "application/json" }
 	});
 }
-/** Constant-time, and length-safe: `timingSafeEqual` throws on differing lengths. */
-function matches(actual, expected) {
-	const left = Buffer$1.from(actual, "utf8");
-	const right = Buffer$1.from(expected, "utf8");
-	if (left.length !== right.length) return false;
-	return crypto.timingSafeEqual(left, right);
-}
 var proxyMessageSchema, AcmeChallengeService;
 var init_acme_challenge = __esmMin((() => {
+	init_secret_compare();
 	init_ddns$2();
 	init_types();
 	proxyMessageSchema = type({
@@ -11005,7 +11359,9 @@ var init_acme_challenge = __esmMin((() => {
 				if (separator < 0) return false;
 				const user = decoded.slice(0, separator);
 				const password = decoded.slice(separator + 1);
-				return matches(user, auth.username) && matches(password, auth.password);
+				const userOk = secretEqual(user, auth.username);
+				const passwordOk = secretEqual(password, auth.password);
+				return userOk && passwordOk;
 			} catch {
 				return false;
 			}
@@ -11305,13 +11661,19 @@ async function probeHttp(host, port, options) {
 			ms,
 			detail: `status ${response.status} is >= ${options.expectStatusBelow}`
 		};
-		if (options.expectBody.length > 0 && options.method !== "HEAD") {
+		const bodySkipped = options.expectBody.length > 0 && options.method === "HEAD";
+		if (options.expectBody.length > 0 && !bodySkipped) {
 			if (!(await response.text()).includes(options.expectBody)) return {
 				healthy: false,
 				ms,
 				detail: `body does not contain ${JSON.stringify(options.expectBody)}`
 			};
 		}
+		if (bodySkipped) return {
+			healthy: true,
+			ms,
+			detail: `HTTP ${response.status} (a HEAD carries no body, so the body check was skipped)`
+		};
 		return {
 			healthy: true,
 			ms,
@@ -11507,7 +11869,16 @@ function orderByDependencies(servers) {
 	for (const server of servers) visit(server);
 	return ordered;
 }
-/** The transitive dependencies of a server, nearest first. */
+/**
+* The transitive dependencies of a server, **deepest first** — the order they have to be started in, so
+* every dependency is up before something that depends on it.
+*
+* A dependency is pushed *after* its own dependencies are walked, which is what makes that hold. Pushing
+* it before (the shape this used to have) yielded a list that was not topological: for
+* `a -> [b, c], b -> [x], c -> [b]` it returned `[b, x, c]`, where `b` precedes `x` even though `b`
+* depends on `x` — so `startDependencies` started `b` without `x` running and awaited a readiness that
+* could not arrive.
+*/
 function dependenciesOf(server, servers) {
 	const byId = new Map(servers.map((entry) => [entry.id, entry]));
 	const found = [];
@@ -11518,13 +11889,17 @@ function dependenciesOf(server, servers) {
 			seen.add(dependency);
 			const target = byId.get(dependency);
 			if (!target) continue;
-			found.push(target);
 			walk(target);
+			found.push(target);
 		}
 	};
 	walk(server);
 	return found;
 }
+/** Dependents that must stop before this server does. */
+function dependentsOf(server, servers) {
+	return servers.filter((entry) => entry.id !== server.id && dependenciesOf(entry, servers).some((d) => d.id === server.id));
+}
 var init_dependencies = __esmMin((() => {}));
 //#endregion
 //#region src/services/log-buffer.ts
@@ -11598,10 +11973,11 @@ function parseLogLine(raw) {
 		return null;
 	}
 }
-var MAX_BYTES_PER_READ, MAX_TAIL_BYTES, MAX_CARRY_CHARS, LOG_STREAMS, LogTailer;
+var MAX_BYTES_PER_READ, BACKFILL_INITIAL_BYTES, BACKFILL_MAX_BYTES, MAX_CARRY_CHARS, LOG_STREAMS, LogTailer;
 var init_log_tail = __esmMin((() => {
 	MAX_BYTES_PER_READ = 262144;
-	MAX_TAIL_BYTES = 262144;
+	BACKFILL_INITIAL_BYTES = 262144;
+	BACKFILL_MAX_BYTES = 8388608;
 	MAX_CARRY_CHARS = 1048576;
 	LOG_STREAMS = /* @__PURE__ */ new Set([
 		"stdout",
@@ -11647,7 +12023,6 @@ var init_log_tail = __esmMin((() => {
 			this.offset = size;
 			this.identity = stats.ino === 0 ? stats.birthtimeMs : stats.ino;
 			if (size === 0 || count <= 0) return [];
-			const start = Math.max(0, size - MAX_TAIL_BYTES);
 			let handle;
 			try {
 				handle = fs.openSync(this.file, "r");
@@ -11655,15 +12030,22 @@ var init_log_tail = __esmMin((() => {
 				return [];
 			}
 			try {
-				const buffer = Buffer$1.alloc(size - start);
-				const bytes = fs.readSync(handle, buffer, 0, buffer.length, start);
-				const raw = buffer.subarray(0, bytes).toString("utf8").split("\n");
-				let partialStart = false;
-				if (start > 0) {
-					const previous = Buffer$1.alloc(1);
-					partialStart = fs.readSync(handle, previous, 0, 1, start - 1) === 1 && previous[0] !== 10;
+				let window = Math.min(size, BACKFILL_INITIAL_BYTES);
+				for (;;) {
+					const start = size - window;
+					const buffer = Buffer$1.alloc(window);
+					const bytes = fs.readSync(handle, buffer, 0, buffer.length, start);
+					const raw = buffer.subarray(0, bytes).toString("utf8").split("\n");
+					let partialStart = false;
+					if (start > 0) {
+						const previous = Buffer$1.alloc(1);
+						partialStart = fs.readSync(handle, previous, 0, 1, start - 1) === 1 && previous[0] !== 10;
+					}
+					const lines = (partialStart ? raw.slice(1) : raw).filter((line) => line.trim().length > 0);
+					const grew = window < size && window < BACKFILL_MAX_BYTES;
+					if (lines.length >= count || !grew) return lines.slice(-count).map(parseLogLine).filter((line) => line !== null);
+					window = Math.min(size, window * 4);
 				}
-				return (partialStart ? raw.slice(1) : raw).filter((line) => line.trim().length > 0).slice(-count).map(parseLogLine).filter((line) => line !== null);
 			} catch {
 				return [];
 			} finally {
@@ -11707,14 +12089,17 @@ var init_log_tail = __esmMin((() => {
 				return [];
 			}
 			try {
-				const buffer = Buffer$1.alloc(Math.min(MAX_BYTES_PER_READ, stats.size - this.offset));
-				while (this.offset < stats.size) {
-					const length = Math.min(buffer.length, stats.size - this.offset);
+				const budget = Math.min(MAX_BYTES_PER_READ, stats.size - this.offset);
+				const buffer = Buffer$1.alloc(budget);
+				let consumed = 0;
+				while (consumed < budget && this.offset < stats.size) {
+					const length = Math.min(buffer.length, budget - consumed, stats.size - this.offset);
 					const bytes = fs.readSync(handle, buffer, 0, length, this.offset);
 					if (bytes <= 0) break;
 					this.offset += bytes;
+					consumed += bytes;
 					this.consume(buffer.subarray(0, bytes).toString("utf8"), lines);
-					if (bytes < buffer.length) break;
+					if (bytes < length) break;
 				}
 			} catch {} finally {
 				fs.closeSync(handle);
@@ -11853,6 +12238,7 @@ function serverTemplateVars(config) {
 }
 var HISTORY_WINDOW_MS, HISTORY_CACHE_MS, TICK_INTERVAL_MS, PORT_STATE_INTERVAL_MS, PORT_RELEASE_RECHECK_MS, RESOURCE_SAMPLE_INTERVAL_MS, PERSISTENT_BACKFILL_LINES, ECHOED_LINE_LIMIT, Supervisor;
 var init_supervisor = __esmMin((() => {
+	init_action_result();
 	init_backoff();
 	init_bind();
 	init_env_file();
@@ -11947,10 +12333,7 @@ var init_supervisor = __esmMin((() => {
 		}
 		async start(id, options = {}) {
 			const entry = this.entries.get(id);
-			if (!entry) return {
-				ok: false,
-				error: `unknown server "${id}"`
-			};
+			if (!entry) return missingServer(id);
 			if (!entry.config.enabled) return {
 				ok: false,
 				error: `server "${id}" is disabled`
@@ -12000,10 +12383,7 @@ var init_supervisor = __esmMin((() => {
 		}
 		async stop(id) {
 			const entry = this.entries.get(id);
-			if (!entry) return {
-				ok: false,
-				error: `unknown server "${id}"`
-			};
+			if (!entry) return missingServer(id);
 			return this.stopEntry(entry);
 		}
 		async restart(id) {
@@ -12030,7 +12410,7 @@ var init_supervisor = __esmMin((() => {
 			};
 			if (!entry) return {
 				...empty,
-				error: `unknown server "${id}"`
+				...missingServer(id)
 			};
 			const port = entry.config.port;
 			if (port === null) return {
@@ -12209,6 +12589,11 @@ var init_supervisor = __esmMin((() => {
 				this.publishServer(entry);
 				return { ok: true };
 			}
+			const orphaned = dependentsOf(entry.config, this.store.servers).filter((dependent) => {
+				const state = this.entries.get(dependent.id);
+				return state !== void 0 && this.isActive(state);
+			});
+			if (orphaned.length > 0) this.log(entry, "system", `still running and depending on this: ${orphaned.map((dependent) => dependent.id).join(", ")}`);
 			entry.status = "stopping";
 			this.publishServer(entry);
 			const nannyState = entry.config.persistent ? readNannyState(nannyStatePath(this.options.nannyDir, entry.config.id)) : null;
@@ -12222,7 +12607,7 @@ var init_supervisor = __esmMin((() => {
 				const leftover = await killPortHolders(port, await this.supervisedPids());
 				if (leftover.length > 0) this.log(entry, "system", `port ${port} was still held by pid ${leftover.join(", ")} — killed`);
 			}
-			const survivor = entry.config.persistent && entry.pid !== null && isProcessAlive$1(entry.pid) ? entry.pid : null;
+			const survivor = entry.config.persistent && entry.pid !== null && isProcessAlive(entry.pid) ? entry.pid : null;
 			if (entry.config.persistent) {
 				if (survivor === null) {
 					clearNannyState(nannyStatePath(this.options.nannyDir, entry.config.id));
@@ -12284,6 +12669,8 @@ var init_supervisor = __esmMin((() => {
 				if (!config) {
 					this.entries.delete(id);
 					this.relay.unfollow(id);
+					this.options.logFiles.clear(id);
+					this.options.history.forget(id);
 					this.stopEntry(entry).catch((error) => {
 						logger.error(`could not stop the removed server ${id}`, error);
 					});
@@ -12561,6 +12948,11 @@ var init_supervisor = __esmMin((() => {
 				HHOSTED_CONTROL_PORT: String(this.options.control.port)
 			};
 			for (const key of Object.keys(dataEnvs)) env[key] = path.resolve(cwd, env[key]);
+			for (const key of Object.keys(env)) {
+				if (!key.includes("\0")) continue;
+				delete env[key];
+				this.log(entry, "system", "ignored an environment key containing a null byte");
+			}
 			return {
 				command,
 				args: expandEnvList(resolveTemplates(entry.config.args, vars), expansionVars),
@@ -12856,7 +13248,12 @@ var init_supervisor = __esmMin((() => {
 			entry.exitCode = code;
 			entry.exitSignal = signal;
 			const neverStarted = nannyExit !== null ? nannyExit.code === null && nannyExit.signal === null : code === null && signal === null && entry.lastError !== null;
-			const detail = neverStarted ? entry.lastError ?? "the entry could not start" : nannyExit !== null ? describeNannyExit(nannyExit) : signal !== null ? `signal ${signal}` : `code ${code}`;
+			const detail = neverStarted ? entry.lastError ?? "the entry could not start" : nannyExit !== null ? describeNannyExit(nannyExit) : describeNannyExit({
+				code,
+				signal,
+				runtimeMs: 0,
+				at: Date.now()
+			});
 			const ranForMs = nannyExit?.runtimeMs ?? (entry.startedAt === null ? 0 : Date.now() - entry.startedAt);
 			this.options.history.record(entry.config.id, {
 				type: "exit",
@@ -12913,7 +13310,7 @@ var init_supervisor = __esmMin((() => {
 			await this.sampleResources(now);
 			await Promise.allSettled([...this.entries.values()].map((entry) => this.probeEntry(entry, now)));
 			for (const entry of this.entries.values()) {
-				if (entry.adopted && entry.pid !== null && !isProcessAlive$1(entry.pid)) {
+				if (entry.adopted && entry.pid !== null && !isProcessAlive(entry.pid)) {
 					this.handleAdoptedExit(entry);
 					continue;
 				}
@@ -13287,9 +13684,6 @@ function readText(file) {
 		return null;
 	}
 }
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 /** The label of one item, for `applied`; items are built before actions run. */
 function labelOf(plan, id) {
 	return plan.items.find((item) => item.id === id)?.label ?? id;
@@ -13325,6 +13719,7 @@ var init_backups = __esmMin((() => {
 	init_archive();
 	init_supervisor();
 	init_generated();
+	init_shape();
 	MANIFEST = "manifest.json";
 	ALLOWED_ROOTS = /* @__PURE__ */ new Set([
 		"global",
@@ -14211,13 +14606,27 @@ async function swapUsedPercent(now = Date.now()) {
 	};
 	return percent;
 }
+/**
+* `sysctl -n vm.swapusage` as a percentage. Pure, so the arithmetic is testable with the readings
+* the platform can actually produce rather than only the ones a runner happens to have.
+*/
+function swapPercentFromSysctl(stdout) {
+	const total = /total\s*=\s*([\d.]+)M/.exec(stdout)?.[1];
+	const used = /used\s*=\s*([\d.]+)M/.exec(stdout)?.[1];
+	const totalMb = Number.parseFloat(total ?? "0");
+	return usedPercent(Math.max(0, totalMb - Number.parseFloat(used ?? "0")), totalMb);
+}
+/** One `Win32_PageFileUsage` CSV row as a percentage; see `swapPercentFromSysctl` for the clamp. */
+function swapPercentFromPageFile(stdout) {
+	const cells = (stdout.split(/\r?\n/).slice(1).find((entry) => entry.trim().length > 0) ?? "").split(",").map((entry) => entry.replace(/"/g, "").trim());
+	const totalMb = Number.parseFloat(cells[0] ?? "0");
+	const usedMb = Number.parseFloat(cells[1] ?? "0");
+	return usedPercent(Math.max(0, totalMb - usedMb), totalMb);
+}
 async function readSwapUsedPercent() {
 	if (process.platform === "darwin") try {
 		const { stdout } = await execFileAsync("sysctl", ["-n", "vm.swapusage"], { timeout: 3e3 });
-		const total = /total\s*=\s*([\d.]+)M/.exec(stdout)?.[1];
-		const used = /used\s*=\s*([\d.]+)M/.exec(stdout)?.[1];
-		const totalMb = Number.parseFloat(total ?? "0");
-		return totalMb > 0 ? Number.parseFloat(used ?? "0") / totalMb * 100 : 0;
+		return swapPercentFromSysctl(stdout);
 	} catch {
 		return 0;
 	}
@@ -14228,10 +14637,7 @@ async function readSwapUsedPercent() {
 			"-Command",
 			"Get-CimInstance Win32_PageFileUsage | Select-Object AllocatedBaseSize,CurrentUsage | ConvertTo-Csv -NoTypeInformation"
 		], { timeout: 5e3 });
-		const cells = (stdout.split(/\r?\n/).slice(1).find((entry) => entry.trim().length > 0) ?? "").split(",").map((entry) => entry.replace(/"/g, "").trim());
-		const totalMb = Number.parseFloat(cells[0] ?? "0");
-		const usedMb = Number.parseFloat(cells[1] ?? "0");
-		return totalMb > 0 ? usedMb / totalMb * 100 : 0;
+		return swapPercentFromPageFile(stdout);
 	} catch {
 		return 0;
 	}
@@ -14251,23 +14657,33 @@ async function readSwapUsedPercent() {
 *   `vm_stat` and count what macOS itself counts as available.
 * - Windows: `os.freemem()` is the free physical page count, which is the ordinary reading.
 */
+/**
+* How much of `total` is not `free`, as a percentage clamped into `[0, 100]`; 0 when `total` is
+* meaningless.
+*
+* `MemAvailable` is a kernel *estimate* and can exceed `MemTotal`, and `SwapFree` can exceed
+* `SwapTotal` — both make the raw ratio negative. That matters more than a strange display: the
+* alert is `used >= threshold`, so a negative reading silently **suppresses** the memory alert
+* entirely. The fallback branch already clamped for exactly this reason; the `/proc` branch did not,
+* so the two disagreed on the same quantity.
+*/
+function usedPercent(free, total) {
+	if (!(total > 0)) return 0;
+	return Math.max(0, Math.min(100, (total - free) / total * 100));
+}
 function memoryInfo() {
 	try {
 		const info = fs.readFileSync("/proc/meminfo", "utf8");
 		const read = (key) => Number.parseInt(new RegExp(`^${key}:\\s+(\\d+)`, "m").exec(info)?.[1] ?? "0", 10);
-		const total = read("MemTotal");
-		const available = read("MemAvailable");
-		const swapTotal = read("SwapTotal");
-		const swapFree = read("SwapFree");
 		return {
-			memoryUsedPercent: total > 0 ? (total - available) / total * 100 : 0,
-			swapUsedPercent: swapTotal > 0 ? (swapTotal - swapFree) / swapTotal * 100 : 0
+			memoryUsedPercent: usedPercent(read("MemAvailable"), read("MemTotal")),
+			swapUsedPercent: usedPercent(read("SwapFree"), read("SwapTotal"))
 		};
 	} catch {
 		const total = os.totalmem();
 		const available = availableMemoryBytes(process.platform, os.freemem());
 		return {
-			memoryUsedPercent: total > 0 && available !== null ? Math.max(0, Math.min(100, (total - available) / total * 100)) : 0,
+			memoryUsedPercent: available === null ? 0 : usedPercent(available, total),
 			swapUsedPercent: 0
 		};
 	}
@@ -14374,7 +14790,7 @@ async function diskUsage(target) {
 			path: target,
 			totalBytes,
 			freeBytes,
-			usedPercent: totalBytes > 0 ? (totalBytes - freeBytes) / totalBytes * 100 : 0
+			usedPercent: usedPercent(freeBytes, totalBytes)
 		};
 	} catch {
 		return null;
@@ -14509,9 +14925,50 @@ function isPublicAddress(ip, family) {
 		const [a, b] = parts;
 		return !(a === 0 || a === 10 || a === 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 100 && b >= 64 && b <= 127);
 	}
-	const lower = ip.toLowerCase();
-	if (lower === "::1" || lower === "::") return false;
-	return !(lower.startsWith("fc") || lower.startsWith("fd") || /^fe[89ab]/.test(lower));
+	const words = ipv6Words(ip);
+	if (words === null) return false;
+	const [w0, w1] = words;
+	if (words.every((word) => word === 0) || w0 === 0 && w1 === 0 && words.slice(2, 7).every((word) => word === 0) && words[7] === 1) return false;
+	if (w0 === 0 && w1 === 0 && words[2] === 0 && words[3] === 0 && (words[4] === 65535 || words[4] === 0)) return false;
+	if ((w0 & 65280) === 65280) return false;
+	if ((w0 & 65024) === 64512 || (w0 & 65472) === 65152) return false;
+	if (w0 === 8193 && w1 === 3512) return false;
+	if (w0 === 16383 && (w1 & 61440) === 0) return false;
+	if (w0 === 8194 || w0 === 8193 && w1 <= 511) return false;
+	if (w0 === 100 && w1 === 65435) return false;
+	return true;
+}
+/**
+* An IPv6 address as eight 16-bit words, or null when it cannot be parsed.
+*
+* The prefix checks above compare bits, and the same address has many spellings (`::ffff:c000:201`
+* and `::ffff:192.168.1.5` are one address), so a textual `startsWith` is not enough — that is how
+* the mapped block slipped through.
+*/
+function ipv6Words(ip) {
+	let text = ip.toLowerCase();
+	const dotted = /(\d{1,3}(?:\.\d{1,3}){3})$/.exec(text);
+	if (dotted !== null) {
+		const parts = dotted[1].split(".").map((part) => Number.parseInt(part, 10));
+		if (parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) return null;
+		const hi = ((parts[0] << 8 | parts[1]) >>> 0).toString(16);
+		const lo = ((parts[2] << 8 | parts[3]) >>> 0).toString(16);
+		text = `${text.slice(0, dotted.index)}${hi}:${lo}`;
+	}
+	const halves = text.split("::");
+	if (halves.length > 2) return null;
+	const head = halves[0] === "" ? [] : halves[0].split(":");
+	const tail = halves.length === 1 || halves[1] === "" ? [] : halves[1].split(":");
+	const zeros = [];
+	if (halves.length > 1) for (let index = 0; index < 8 - head.length - tail.length; index += 1) zeros.push("0");
+	const words = halves.length === 1 ? head : [
+		...head,
+		...zeros,
+		...tail
+	];
+	if (words.length !== 8) return null;
+	const numbers = words.map((word) => /^[0-9a-f]{1,4}$/.test(word) ? Number.parseInt(word, 16) : NaN);
+	return numbers.some((number) => Number.isNaN(number)) ? null : numbers;
 }
 /**
 * Reads the address out of whatever the endpoint answered: a bare address, a
@@ -14913,6 +15370,22 @@ var init_history = __esmMin((() => {
 			this.load();
 			return [...this.events];
 		}
+		/**
+		* Drops every event for a server that no longer exists.
+		*
+		* An id is only unique *while* it exists. Nothing pruned on removal, so re-adding an id — a
+		* rename-back, a restore, a config edit — inherited the old entry's crash time and event list, and
+		* the card showed "Last crash" for a server that had never been started. Bounded (5000 events) so it
+		* was never a leak, but wrong in the same way the log files were.
+		*/
+		forget(serverId) {
+			this.load();
+			const kept = this.events.filter((event) => event.serverId !== serverId);
+			if (kept.length === this.events.length) return;
+			this.events = kept;
+			this.version += 1;
+			this.scheduleSave();
+		}
 		/** `runningSince` adds the in-flight up-interval so a long-running server shows its real ratio. */
 		summarize(serverId, windowMs, now = Date.now(), runningSince = null) {
 			this.load();
@@ -14920,7 +15393,11 @@ var init_history = __esmMin((() => {
 			const mine = this.events.filter((event) => event.serverId === serverId);
 			const recent = mine.filter((event) => event.ts >= since);
 			let upMs = 0;
-			for (const event of recent) if (event.runtimeMs !== void 0) upMs += Math.min(event.runtimeMs, windowMs);
+			for (const event of recent) {
+				if (event.runtimeMs === void 0) continue;
+				const startedAt = event.ts - event.runtimeMs;
+				upMs += event.ts - Math.max(startedAt, since);
+			}
 			if (runningSince !== null) upMs += Math.max(0, now - Math.max(runningSince, since));
 			const lastCrash = [...mine].reverse().find((event) => event.type === "crash");
 			const lastExit = [...mine].reverse().find((event) => event.type === "exit" || event.type === "crash");
@@ -14933,7 +15410,7 @@ var init_history = __esmMin((() => {
 				lastCrashAt: lastCrash?.ts ?? null,
 				lastExitAt: lastExit?.ts ?? null,
 				lastRuntimeMs: lastExit?.runtimeMs ?? null,
-				events: mine.slice(-8)
+				events: recent.slice(-8)
 			};
 		}
 		dispose() {
@@ -15512,10 +15989,15 @@ var init_panel = __esmMin((() => {
 			const runtime = this.runtimes.get(id);
 			if (runtime === void 0) throw new WorkspaceError(`unknown workspace "${id}"`);
 			if (this.runtimes.size <= 1) throw new WorkspaceError("cannot remove the only workspace");
-			for (const server of runtime.store.servers) try {
-				await runtime.supervisor.stop(server.id);
-			} catch (error) {
-				logger.warn(`could not stop ${server.id} while removing workspace "${id}"`, error);
+			for (const server of runtime.store.servers) {
+				const stopped = await runtime.supervisor.stop(server.id).catch((error) => {
+					logger.warn(`could not stop ${server.id} while removing workspace "${id}"`, error);
+					return {
+						ok: true,
+						error: void 0
+					};
+				});
+				if (!stopped.ok && stopped.error?.includes("survived the stop")) throw new WorkspaceError(`cannot remove "${id}": ${stopped.error} — stop it first, or the workspace would be deleted while that process is still running and unreachable from here`);
 			}
 			await runtime.supervisor.dispose();
 			this.disposeRuntime(runtime);
@@ -16474,7 +16956,7 @@ async function runControlPlane(options) {
 			return app.fetch(request);
 		},
 		trustProxy: () => settings.control.auth.trustProxy,
-		tls: () => settings.control.tls.enabled ? tls.load() : null
+		tls: () => settings.control.tls.enabled ? tls.servable() : null
 	}, {
 		host: intended.host,
 		port: intended.port,
@@ -16493,12 +16975,18 @@ async function runControlPlane(options) {
 		logger.info("bind the panel back to `local`, or set a password with `home-hosted set-password` and enable auth in Global Settings");
 		process.exit(1);
 	}
+	const trustWarning = proxyTrustWarning({
+		...configured,
+		host: intended.host
+	});
+	if (trustWarning !== null) logger.warn(trustWarning);
 	if (options.printConfig) {
 		printEffectiveConfig(settings, registry, options);
 		return;
 	}
 	if (!await isPortFree(intended.port)) {
-		logger.error(`control port ${intended.port} is already in use — is another home-hosted running?`);
+		const holders = await listPortHolders(intended.port);
+		logger.error(`control port ${intended.port} is already in use${holders.length > 0 ? ` by pid ${holders.join(", ")}` : ""} — another home-hosted, or something else on this port`);
 		process.exit(1);
 	}
 	if (intended.host !== configured.host || intended.port !== configured.port) settings.updateControl({
@@ -16750,7 +17238,8 @@ var up_exports = /* @__PURE__ */ __exportAll({
 function toUpFlags(args) {
 	let port;
 	if (args.port !== void 0) {
-		port = Number.parseInt(args.port, 10);
+		const raw = args.port.trim();
+		port = /^\d+$/.test(raw) ? Number.parseInt(raw, 10) : NaN;
 		if (!Number.isInteger(port) || port <= 0 || port > 65535) fail(`invalid port: ${args.port}`);
 	}
 	return {
@@ -16764,8 +17253,8 @@ function toUpFlags(args) {
 	};
 }
 async function runUp(flags, entry) {
-	const { runControlPlane } = await Promise.resolve().then(() => (init_src(), src_exports));
 	if (flags.foreground || flags.printConfig) {
+		const { runControlPlane } = await Promise.resolve().then(() => (init_src(), src_exports));
 		await runControlPlane({
 			configPath: flags.config,
 			port: flags.port,
@@ -16837,10 +17326,7 @@ async function waitForStartup(child, timeoutMs = 2e4) {
 }
 function upCommand(entry) {
 	return defineCommand({
-		meta: {
-			name: "up",
-			description: "start the panel in the background (detached)"
-		},
+		meta: { name: "up" },
 		args: upArgs,
 		run: async ({ args }) => {
 			await runUp(toUpFlags(args), entry);
@@ -16990,10 +17476,7 @@ var init_down = __esmMin((() => {
 	init_io();
 	init_version();
 	downCommand = defineCommand({
-		meta: {
-			name: "down",
-			description: "stop it, and everything it supervises"
-		},
+		meta: { name: "down" },
 		run: async () => {
 			await runDown();
 		}
@@ -17002,7 +17485,6 @@ var init_down = __esmMin((() => {
 //#endregion
 //#region src/cli/server.ts
 var server_exports = /* @__PURE__ */ __exportAll({
-	restartServerCommand: () => restartServerCommand,
 	runServerAction: () => runServerAction,
 	startCommand: () => startCommand,
 	stopCommand: () => stopCommand
@@ -17029,10 +17511,7 @@ async function runServerAction(action, id, workspace) {
 }
 function serverCommand(action) {
 	return defineCommand({
-		meta: {
-			name: action,
-			description: DESCRIPTION[action]
-		},
+		meta: { name: action },
 		args: {
 			id: {
 				type: "positional",
@@ -17052,17 +17531,11 @@ function serverCommand(action) {
 		}
 	});
 }
-var DESCRIPTION, startCommand, stopCommand, restartServerCommand;
+var startCommand, stopCommand;
 var init_server = __esmMin((() => {
 	init_io();
-	DESCRIPTION = {
-		start: "start one server (the panel keeps running)",
-		stop: "stop one server (the panel keeps running)",
-		restart: "restart one server (the panel keeps running)"
-	};
 	startCommand = serverCommand("start");
 	stopCommand = serverCommand("stop");
-	restartServerCommand = serverCommand("restart");
 }));
 //#endregion
 //#region src/cli/restart.ts
@@ -17077,10 +17550,7 @@ var restart_exports = /* @__PURE__ */ __exportAll({ restartCommand: () => restar
 */
 function restartCommand(entry) {
 	return defineCommand({
-		meta: {
-			name: "restart",
-			description: "down then up — or one server, given an id"
-		},
+		meta: { name: "restart" },
 		args: {
 			...upArgs,
 			id: {
@@ -17122,11 +17592,16 @@ var status_exports = /* @__PURE__ */ __exportAll({
 async function runStatus(json) {
 	const { isProcessAlive, probeRuntime, readRuntime } = await Promise.resolve().then(() => (init_daemon(), daemon_exports));
 	const { UiService } = await Promise.resolve().then(() => (init_ui(), ui_exports));
-	const { hhDir: dataRoot } = await Promise.resolve().then(() => (init_paths(), paths_exports));
+	const { hhDir: dataRoot, workspaceDir, DEFAULT_WORKSPACE_ID, workspacesPath } = await Promise.resolve().then(() => (init_paths(), paths_exports));
 	const runtime = readRuntime();
 	if (runtime === null) {
-		if (json) process.stdout.write(`${JSON.stringify({ running: false }, null, 2)}\n`);
-		else process.stdout.write("home-hosted is not running\n");
+		const initialised = fs.existsSync(workspacesPath);
+		if (json) process.stdout.write(`${JSON.stringify({
+			running: false,
+			initialised
+		}, null, 2)}\n`);
+		else if (initialised) process.stdout.write("home-hosted is not running — start it with `home-hosted up`\n");
+		else process.stdout.write("home-hosted is not running — nothing is set up here yet; `home-hosted init` creates a project, `home-hosted up` starts one here\n");
 		process.exitCode = 1;
 		return;
 	}
@@ -17135,22 +17610,29 @@ async function runStatus(json) {
 		reachable: false,
 		degraded: false
 	};
+	const ui = new UiService({ dataRoot });
+	const uiMeta = ui.status().meta;
+	const uiLabel = ui.custom ? uiMeta?.name ?? "installed" : "stock";
 	if (json) {
 		const { token: _token, ...safe } = runtime;
 		process.stdout.write(`${JSON.stringify({
 			running,
 			answering: probe.reachable,
 			degraded: probe.degraded,
-			...safe
+			...safe,
+			logsDir: path.join(workspaceDir(DEFAULT_WORKSPACE_ID), ".logs"),
+			ui: {
+				custom: ui.custom,
+				name: uiLabel,
+				version: uiMeta?.version ?? null
+			}
 		}, null, 2)}\n`);
 		if (!running) process.exitCode = 1;
 		return;
 	}
 	const uptime = formatDuration(Date.now() - runtime.startedAt);
-	const state = !running ? paint("31", "stale (the process is gone)") : probe.degraded ? paint("33", "running — a server needs attention") : probe.reachable ? green("running") : paint("33", "running, but not answering");
-	const ui = new UiService({ dataRoot });
 	const rows = [
-		["status", state],
+		["status", !running ? paint("31", "stale (the process is gone)") : probe.degraded ? paint("33", "running — a server needs attention") : probe.reachable ? green("running") : paint("33", "running, but not answering")],
 		["pid", running ? `${runtime.pid} · up ${uptime}` : String(runtime.pid)],
 		["url", `${runtime.url} ${dim(`(${runtime.protocol})`)}`],
 		["version", runtime.version],
@@ -17158,10 +17640,15 @@ async function runStatus(json) {
 		["state", runtime.dataRoot],
 		["internal", runtime.configPath],
 		["log", runtime.logFile],
-		["ui", ui.custom ? `custom — ${ui.status().meta?.name ?? "installed"} (revert with \`home-hosted ui-revert\`)` : "stock"]
+		["serverlogs", (() => {
+			const dir = path.join(workspaceDir(DEFAULT_WORKSPACE_ID), ".logs");
+			return fs.existsSync(dir) ? `${dir} (one file per server: <id>.log)` : dir;
+		})()],
+		["ui", ui.custom ? `custom — ${uiLabel} (revert with \`home-hosted ui-revert\`)` : "stock"]
 	];
 	process.stdout.write(`${bold(`home-hosted ${runtime.version}`)}\n`);
-	for (const [label, value] of rows) process.stdout.write(`  ${dim(label.padEnd(8))} ${value}\n`);
+	const width = Math.max(...rows.map(([label]) => label.length));
+	for (const [label, value] of rows) process.stdout.write(`  ${dim(label.padEnd(width))} ${value}\n`);
 	if (!running) process.exitCode = 1;
 }
 function formatDuration(ms) {
@@ -17181,10 +17668,7 @@ var init_status = __esmMin((() => {
 		description: "print machine-readable JSON"
 	} };
 	statusCommand = defineCommand({
-		meta: {
-			name: "status",
-			description: "is it running, where, and how to reach it"
-		},
+		meta: { name: "status" },
 		args: statusArgs,
 		run: async ({ args }) => {
 			await runStatus(args.json === true);
@@ -17198,12 +17682,39 @@ var logs_exports = /* @__PURE__ */ __exportAll({
 	logsCommand: () => logsCommand,
 	runLogs: () => runLogs
 });
-/** `all` or a negative count means the whole log; a bad number is not worth a hard failure. */
+/**
+* Whether a path exists but cannot be read — the case `readLog` cannot distinguish from absence,
+* because it folds every failure into "nothing there".
+*
+* A *missing* log is normal (a panel that has not started), so only a real permission or IO
+* refusal is reported. `R_OK` is the question being asked; existence alone would call an
+* unreadable file readable.
+*/
+function isUnreadable(file) {
+	try {
+		fs.accessSync(file, fs.constants.R_OK);
+		return false;
+	} catch (error) {
+		return error.code !== "ENOENT";
+	}
+}
+/**
+* `all` or a negative count means the whole log; an unreadable count is a typo, not a reason to
+* fail, so it falls back to the default.
+*
+* What it does **not** do is accept a *partly* numeric argument, which is how
+* `Number.parseInt` behaves and why this is not just a `parseInt`. `--lines 1e3` meant 1 line
+* (not 1000), and `--lines 0x10` parsed as 0 — which is the "whole log" sentinel, so a bounded
+* request silently became an unbounded one. Neither is a typo falling back to a default; both are
+* a wrong answer the caller cannot see. The whole trimmed argument has to be a decimal integer.
+*/
 function parseLines(raw) {
 	if (raw === void 0) return DEFAULT_LINES;
-	if (raw.trim().toLowerCase() === "all") return 0;
-	const parsed = Number.parseInt(raw, 10);
-	if (!Number.isFinite(parsed)) return DEFAULT_LINES;
+	const trimmed = raw.trim();
+	if (trimmed.toLowerCase() === "all") return 0;
+	if (!/^[+-]?\d+$/.test(trimmed)) return DEFAULT_LINES;
+	const parsed = Number.parseInt(trimmed, 10);
+	if (!Number.isSafeInteger(parsed)) return DEFAULT_LINES;
 	return parsed < 0 ? 0 : parsed;
 }
 async function runLogs(input) {
@@ -17212,10 +17723,37 @@ async function runLogs(input) {
 	const lines = parseLines(input.lines);
 	if (input.follow === true) {
 		const { followLog } = await Promise.resolve().then(() => (init_daemon_log(), daemon_log_exports));
-		await followLog(daemonLogPath, lines === 0 ? DEFAULT_LINES : lines, (chunk) => process.stdout.write(chunk));
+		const count = lines === 0 ? DEFAULT_LINES : lines;
+		if (input.json !== true) {
+			await followLog(daemonLogPath, count, (chunk) => process.stdout.write(chunk));
+			return;
+		}
+		const emit = (line) => {
+			process.stdout.write(`${JSON.stringify({
+				path: daemonLogPath,
+				line
+			})}\n`);
+		};
+		let pending = "";
+		await followLog(daemonLogPath, count, (chunk) => {
+			pending += chunk;
+			const parts = pending.split("\n");
+			pending = parts.pop() ?? "";
+			for (const part of parts) emit(part);
+		});
+		if (pending.length > 0) emit(pending);
 		return;
 	}
 	const output = readLog(daemonLogPath, lines);
+	if (output.length === 0 && isUnreadable(daemonLogPath)) {
+		if (input.json === true) process.stdout.write(`${JSON.stringify({
+			path: daemonLogPath,
+			error: "unreadable"
+		}, null, 2)}\n`);
+		else process.stdout.write(`${paint("31", "error")} cannot read ${daemonLogPath} — check its permissions\n`);
+		process.exitCode = 1;
+		return;
+	}
 	if (input.json === true) {
 		process.stdout.write(`${JSON.stringify({
 			path: daemonLogPath,
@@ -17249,10 +17787,7 @@ var init_logs = __esmMin((() => {
 	};
 	DEFAULT_LINES = 50;
 	logsCommand = defineCommand({
-		meta: {
-			name: "logs",
-			description: "show the panel's own console output"
-		},
+		meta: { name: "logs" },
 		args: logsArgs,
 		async run({ args }) {
 			try {
@@ -17305,10 +17840,7 @@ var init_set_password = __esmMin((() => {
 		description: "remove the password, which disables authentication"
 	} };
 	setPasswordCommand = defineCommand({
-		meta: {
-			name: "set-password",
-			description: "set the panel password without the API"
-		},
+		meta: { name: "set-password" },
 		args: setPasswordArgs,
 		run: async ({ args }) => {
 			await runSetPassword(args.clear === true);
@@ -17387,10 +17919,7 @@ var init_set_token = __esmMin((() => {
 		}
 	};
 	setTokenCommand = defineCommand({
-		meta: {
-			name: "set-token",
-			description: "set the API token that scripts and agents use"
-		},
+		meta: { name: "set-token" },
 		args: setTokenArgs,
 		run: async ({ args }) => {
 			await runSetToken(args.generate === true, args.clear === true);
@@ -17458,6 +17987,8 @@ async function runMigrate(config, dryRun, yes) {
 		if (plan.tooNew) fail(`${target.file} was written by home-hosted ${meta.writtenBy ?? "a newer release"} (config schema ${from});\n  this release understands schema ${plan.to}. Install that version, or edit the file yourself.`);
 		const problem = target.validate(raw);
 		if (problem !== null) fail(`${target.file} is not a config this release can read: ${problem}`);
+		if (plan.reached !== plan.to) fail(`${target.file} is schema ${from} and this release can only lift it to schema ${plan.reached} — the migration chain in configMigrations has a gap to schema ${plan.to}.
+  That is a bug in this release: report it rather than editing the file.`);
 		if (plan.steps.length === 0) {
 			const stamped = stampConfig(raw);
 			if (JSON.stringify(stamped) !== JSON.stringify(raw)) stampOnly += 1;
@@ -17517,10 +18048,7 @@ var init_migrate = __esmMin((() => {
 		}
 	};
 	migrateCommand = defineCommand({
-		meta: {
-			name: "migrate",
-			description: "bring the state up to this release's layout and schema"
-		},
+		meta: { name: "migrate" },
 		args: migrateArgs,
 		run: async ({ args }) => {
 			await runMigrate(args.config, args.dryRun === true, args.yes === true);
@@ -17722,10 +18250,7 @@ var init_init = __esmMin((() => {
 		}
 	};
 	initCommand = defineCommand({
-		meta: {
-			name: "init",
-			description: "scaffold a project that keeps its state in the repo"
-		},
+		meta: { name: "init" },
 		args: initArgs,
 		run: async ({ args }) => {
 			await runInit({
@@ -17897,10 +18422,7 @@ var init_ui_switch = __esmMin((() => {
 	init_ui_release();
 	init_ui_release();
 	uiSwitchCommand = defineCommand({
-		meta: {
-			name: "ui-switch",
-			description: "install a UI from a release asset, a zip file or a URL"
-		},
+		meta: { name: "ui-switch" },
 		run: async ({ rawArgs }) => {
 			await uiSwitch(rawArgs, {
 				write: (text) => process.stdout.write(text),
@@ -18161,10 +18683,7 @@ var init_ui_update = __esmMin((() => {
 	init_io();
 	init_ui_release();
 	uiUpdateCommand = defineCommand({
-		meta: {
-			name: "ui-update",
-			description: "update the installed UI to match this panel, or pick a release"
-		},
+		meta: { name: "ui-update" },
 		run: async ({ rawArgs }) => {
 			await uiUpdate(rawArgs, {
 				write: (text) => process.stdout.write(text),
@@ -18196,10 +18715,7 @@ var init_ui_revert = __esmMin((() => {
 	init_paths();
 	init_ui();
 	uiRevertCommand = defineCommand({
-		meta: {
-			name: "ui-revert",
-			description: "go back to the stock control panel UI"
-		},
+		meta: { name: "ui-revert" },
 		run: async () => {
 			await runUiRevert();
 		}
@@ -18300,7 +18816,7 @@ async function runNanny(spec, statePath) {
 				at: Date.now(),
 				runtimeMs
 			};
-			emit("system", note ?? (signal !== null ? `persistent: exited with signal ${signal}` : `persistent: exited with code ${code}`));
+			emit("system", note ?? `persistent: exited with ${describeNannyExit(lastExit)}`);
 			persistState();
 			logFiles.dispose();
 			exitCode = code ?? (signal === null ? 0 : 1);
@@ -18357,7 +18873,9 @@ var init_nanny = __esmMin((() => {
 //#region src/cli.ts
 init_args();
 init_io();
+init_nearest();
 init_runtime();
+init_version();
 /**
 * The command line, and nothing else. Two things happen before citty is asked
 * anything: `--home`/`--project` are peeled off and applied (because
@@ -18436,7 +18954,7 @@ var LOGS_SECTION = {
 	lines: [
 		["--lines <n>", "how many lines to show (default 50, `all` for everything)"],
 		["--follow", "keep printing as the panel writes (like tail -f)"],
-		["--json", "print machine-readable JSON"]
+		["--json", "print machine-readable JSON (one object per line with --follow)"]
 	]
 };
 var SERVER_SECTION = {
@@ -18520,6 +19038,14 @@ var ENVIRONMENT_SECTION = {
 		["GITHUB_TOKEN", "a GitHub token for ui-switch (GH_TOKEN also works)"]
 	]
 };
+/**
+* The command name a typo most likely meant, or null when nothing is close. The candidates are
+* `SYNOPSIS`, the same source the reference renders, so a suggestion cannot name a command the CLI
+* does not have.
+*/
+function suggestCommand(input) {
+	return nearestWord(input, Object.keys(SYNOPSIS));
+}
 /** The command list of the full reference, aligned as it always was. */
 function renderCommandList() {
 	const width = Math.max(...Object.values(SYNOPSIS).map((synopsis) => synopsis.length));
@@ -18600,15 +19126,8 @@ function commandHelp(command) {
 		SHARED_TRAILER
 	].join("\n");
 }
-function manifestVersion() {
-	try {
-		return JSON.parse(fs.readFileSync(new URL("../package.json", import.meta.url), "utf8")).version ?? "0.0.0";
-	} catch {
-		return "0.0.0";
-	}
-}
 function version() {
-	process.stdout.write(`${manifestVersion()}\n`);
+	process.stdout.write(`${appVersion()}\n`);
 }
 /**
 * citty owns dispatch and argument parsing. Each entry is a lazy import, so a
@@ -18633,7 +19152,7 @@ var COMMANDS = {
 var rootCommand = defineCommand({
 	meta: {
 		name: "home-hosted",
-		version: manifestVersion(),
+		version: appVersion(),
 		description: "a control panel for the processes on your home server"
 	},
 	subCommands: COMMANDS
@@ -18662,7 +19181,10 @@ async function main() {
 		return;
 	}
 	if (invocation.kind === "unknown") {
-		process.stderr.write(`unknown command: ${invocation.command}\n\n${USAGE}`);
+		const suggestion = suggestCommand(invocation.command);
+		process.stderr.write(`unknown command: ${invocation.command}\n`);
+		if (suggestion !== null) process.stderr.write(`${dim(`did you mean \`${suggestion}\`?`)}\n`);
+		process.stderr.write(`\n${USAGE}`);
 		process.exit(1);
 	}
 	const { ensureLayout } = await Promise.resolve().then(() => (init_layout(), layout_exports));
@@ -18681,6 +19203,6 @@ main().catch((error) => {
 	fail(error instanceof Error ? error.message : String(error));
 });
 //#endregion
-export { commandHelp };
+export { commandHelp, suggestCommand };
 
 //# sourceMappingURL=cli.js.map