ledge-server 0.0.2 → 0.1.0

package/lib/serve.js

@@ -390,9 +390,9 @@ function setFavoriteLine(text, on) {
   if (!on) {
     if (b === null)
       return text;
-    const content2 = b.lines.slice(1, b.close);
-    const kept = content2.filter((l) => !FAVORITE_LINE.test(l));
-    if (kept.length === content2.length)
+    const content = b.lines.slice(1, b.close);
+    const kept = content.filter((l) => !FAVORITE_LINE.test(l));
+    if (kept.length === content.length)
       return text;
     if (kept.every((l) => l.trim() === ""))
       return text.slice(b.end);
@@ -890,8 +890,10 @@ async function loadWorkspaces() {
 }
 async function ensureDefault() {
   if (availableRoots().some((r) => kindOf(r) !== "docs"))
-    return;
-  await createManaged("Scratch");
+    return null;
+  const first = ![...entries.keys()].some((r) => kindOf(r) !== "docs");
+  const root = await createManaged("Scratch");
+  return first ? root : null;
 }
 async function createManaged(name) {
   await ensureAppHome();
@@ -1247,10 +1249,10 @@ async function unlockVault(passphrase, device, probeHeader) {
     } catch {
       return false;
     }
-    const key2 = deriveKey(passphrase, vaultSalt);
-    if (!checkAgainstFile(key2, checkB64))
+    const key = deriveKey(passphrase, vaultSalt);
+    if (!checkAgainstFile(key, checkB64))
       return false;
-    masterKey = key2;
+    masterKey = key;
     authorize(device);
     return true;
   }
@@ -1750,9 +1752,9 @@ async function listNotes(root) {
 }
 async function searchNotes(root, query, folder = "") {
   const metas = notesUnder(await listNotes(root), folder);
-  const open2 = metas.filter((m) => !m.locked);
-  const hits = await collectHits(query, open2, async (path) => (await readNote(path))?.text ?? null);
-  return { hits, lockedSkipped: metas.length - open2.length };
+  const open = metas.filter((m) => !m.locked);
+  const hits = await collectHits(query, open, async (path) => (await readNote(path))?.text ?? null);
+  return { hits, lockedSkipped: metas.length - open.length };
 }
 var CONTEXT_MAX = 200;
 function contextOf(lines, line) {
@@ -1942,14 +1944,14 @@ function assetRefsOf(text, root, from) {
 function rebaseAssetRefs(text, root, from, to) {
   if (dirname3(resolve3(from)) === dirname3(resolve3(to)))
     return text;
-  return text.replace(IMAGE_REF, (whole, open2, ref, close) => {
+  return text.replace(IMAGE_REF, (whole, open, ref, close) => {
     let asset;
     try {
       asset = assetPathOf(root, ref, from);
     } catch {
       return whole;
     }
-    return `${open2}${assetRefFor(root, asset, to)}${close}`;
+    return `${open}${assetRefFor(root, asset, to)}${close}`;
   });
 }
 async function favoriteNote(path, on) {
@@ -2150,13 +2152,13 @@ async function rollBack(done, from, to, salt) {
 async function imageFilesUnder(root) {
   const out = [];
   const walk = async (dir) => {
-    let entries2;
+    let entries;
     try {
-      entries2 = await readdir3(dir, { withFileTypes: true });
+      entries = await readdir3(dir, { withFileTypes: true });
     } catch {
       return;
     }
-    for (const entry of entries2) {
+    for (const entry of entries) {
       if (entry.name.startsWith(".") && entry.name !== ASSETS_DIRNAME)
         continue;
       const path = join5(dir, entry.name);
@@ -2201,8 +2203,8 @@ async function createNote(root, text, folder) {
   const dir = await ensureFolder(root, folder);
   const reserved = reservedIn(dir);
   const taken = new Set(await readdir3(dir));
-  for (const name2 of reserved)
-    taken.add(name2);
+  for (const name of reserved)
+    taken.add(name);
   const name = uniqueName(baseFor(text), taken);
   reserved.add(name);
   const path = join5(dir, name);
@@ -2230,8 +2232,8 @@ async function moveNote(path, folder) {
   }
   const reserved = reservedIn(dir);
   const taken = new Set(await readdir3(dir));
-  for (const name2 of reserved)
-    taken.add(name2);
+  for (const name of reserved)
+    taken.add(name);
   const name = uniqueName(titleOf(from), taken);
   reserved.add(name);
   const target = join5(dir, name);
@@ -2298,8 +2300,8 @@ async function retitleNote(path, text) {
   const reserved = reservedIn(dir);
   const taken = new Set(await readdir3(dir));
   taken.delete(current);
-  for (const name2 of reserved)
-    taken.add(name2);
+  for (const name of reserved)
+    taken.add(name);
   const name = uniqueName(baseFor(text), taken);
   if (name.toLowerCase() === current.toLowerCase()) {
     return metaFor(path, text);
@@ -2379,13 +2381,13 @@ async function stashNote(path, text) {
 async function trashFiles(root) {
   const out = [];
   const walk = async (dir) => {
-    let entries2;
+    let entries;
     try {
-      entries2 = await readdir3(dir, { withFileTypes: true });
+      entries = await readdir3(dir, { withFileTypes: true });
     } catch {
       return;
     }
-    for (const entry of entries2) {
+    for (const entry of entries) {
       if (entry.name.startsWith("."))
         continue;
       const path = join5(dir, entry.name);
@@ -2427,8 +2429,8 @@ async function restoreNote(path) {
   await mkdir3(dir, { recursive: true });
   const reserved = reservedIn(dir);
   const taken = new Set(await readdir3(dir));
-  for (const name2 of reserved)
-    taken.add(name2);
+  for (const name of reserved)
+    taken.add(name);
   const name = uniqueName(titleOf(path), taken);
   reserved.add(name);
   const target = join5(dir, name);
@@ -2506,12 +2508,12 @@ function forceTitle(text, title) {
   const start = frontmatterEnd(text);
   if (heading === null) {
     const body = text.slice(start);
-    const sep4 = body.startsWith(`
+    const sep = body.startsWith(`
 `) || body === "" ? `
 ` : `
 
 `;
-    return `${text.slice(0, start)}# ${title}${sep4}${body}`;
+    return `${text.slice(0, start)}# ${title}${sep}${body}`;
   }
   const gap = start === 0 ? 0 : /^(?:[ \t]*\r?\n)+/.exec(text.slice(start))?.[0].length ?? 0;
   const lineStart = start + gap;
@@ -2563,9 +2565,9 @@ async function findTemplate(title, preferredRoot) {
   const pref = assertRegisteredRoot(preferredRoot);
   const local = resolveWikiTitle(title, await listNotes(pref));
   if (local) {
-    const file2 = await readNote(local.path);
-    if (file2)
-      return { path: local.path, text: templateText(file2, title) };
+    const file = await readNote(local.path);
+    if (file)
+      return { path: local.path, text: templateText(file, title) };
   }
   const others = availableRoots().filter((r) => r !== pref);
   const metas = (await Promise.all(others.map((r) => listNotes(r)))).flat();
@@ -3297,10 +3299,10 @@ function folderOut(meta) {
   return meta.folder ? { folder: meta.folder } : {};
 }
 async function notesIn(workspace, folder = null) {
-  const roots2 = typeof workspace === "string" && workspace !== "" ? [assertRegisteredRoot(workspace)] : availableRoots();
+  const roots = typeof workspace === "string" && workspace !== "" ? [assertRegisteredRoot(workspace)] : availableRoots();
   const scope = folderScopeOf(folder);
   const out = [];
-  for (const root of roots2) {
+  for (const root of roots) {
     try {
       for (const n of notesUnder(await listNotes(root), scope))
         out.push({ ...n, workspace: root });
@@ -3385,10 +3387,10 @@ function targetWorkspace(args) {
       throw new Error(`LEDGE_WORKSPACE names ${env}, which is no longer a registered workspace root \u2014 name one explicitly (list_workspaces shows them)`);
     }
   }
-  const roots2 = writableRoots();
-  if (roots2.length === 1)
-    return roots2[0];
-  throw new Error(roots2.length === 0 ? "no workspace is available to create in (unmounted volume? list_workspaces shows what Ledge knows)" : "several workspaces exist \u2014 name one (list_workspaces shows them), or call from a shell in a Ledge note's terminal, where LEDGE_WORKSPACE names the current one");
+  const roots = writableRoots();
+  if (roots.length === 1)
+    return roots[0];
+  throw new Error(roots.length === 0 ? "no workspace is available to create in (unmounted volume? list_workspaces shows what Ledge knows)" : "several workspaces exist \u2014 name one (list_workspaces shows them), or call from a shell in a Ledge note's terminal, where LEDGE_WORKSPACE names the current one");
 }
 function dailyWorkspace(args, settings) {
   const asked = args["workspace"];
@@ -3502,11 +3504,11 @@ var ledgeTools = [
         throw new Error("give a non-empty query");
       await loadWorkspaces();
       const workspace = args["workspace"];
-      const roots2 = typeof workspace === "string" && workspace !== "" ? [assertRegisteredRoot(workspace)] : availableRoots();
+      const roots = typeof workspace === "string" && workspace !== "" ? [assertRegisteredRoot(workspace)] : availableRoots();
       const folder = folderScopeOf(args["folder"]);
       const all = [];
       let lockedSkipped = 0;
-      for (const root of roots2) {
+      for (const root of roots) {
         try {
           const res = await searchNotes(root, query, folder);
           lockedSkipped += res.lockedSkipped;
@@ -3564,16 +3566,16 @@ var ledgeTools = [
     handler: async (args) => {
       await loadWorkspaces();
       const workspace = args["workspace"];
-      const roots2 = typeof workspace === "string" && workspace !== "" ? [assertRegisteredRoot(workspace)] : availableRoots();
+      const roots = typeof workspace === "string" && workspace !== "" ? [assertRegisteredRoot(workspace)] : availableRoots();
       const tag = args["tag"];
       const folder = folderScopeOf(args["folder"]);
       if (typeof tag === "string" && normalizeTag(tag) !== "") {
         const all = [];
-        let lockedSkipped2 = 0;
-        for (const root of roots2) {
+        let lockedSkipped = 0;
+        for (const root of roots) {
           try {
             const res = await notesTagged(root, tag, folder);
-            lockedSkipped2 += res.lockedSkipped;
+            lockedSkipped += res.lockedSkipped;
             for (const h of res.hits) {
               all.push({ path: h.path, title: h.title, workspace: root, mtimeMs: h.mtimeMs, line: h.line, context: h.context });
             }
@@ -3588,12 +3590,12 @@ var ledgeTools = [
         return {
           hits: hits.map(({ mtimeMs, ...h }) => ({ ...h, modified: iso(mtimeMs) })),
           truncated: all.length > MAX_HITS,
-          ...lockedSkipped2 > 0 ? { lockedNoteBodiesSkipped: lockedSkipped2 } : {}
+          ...lockedSkipped > 0 ? { lockedNoteBodiesSkipped: lockedSkipped } : {}
         };
       }
       const merged = new Map;
       let lockedSkipped = 0;
-      for (const root of roots2) {
+      for (const root of roots) {
         try {
           const res = await tagsIn(root, folder);
           lockedSkipped += res.lockedSkipped;
@@ -3651,9 +3653,9 @@ var ledgeTools = [
         if (typeof title !== "string" || title.trim() === "") {
           throw new Error("creating from a template needs a `title` for the new note");
         }
-        const root2 = targetWorkspace(args);
-        const meta2 = await createFromTemplate(root2, template.trim(), title.trim(), folder);
-        return { path: meta2.path, title: meta2.title, workspace: root2, ...folderOut(meta2), modified: iso(meta2.mtimeMs) };
+        const root = targetWorkspace(args);
+        const meta = await createFromTemplate(root, template.trim(), title.trim(), folder);
+        return { path: meta.path, title: meta.title, workspace: root, ...folderOut(meta), modified: iso(meta.mtimeMs) };
       }
       const text = args["text"];
       if (typeof text !== "string" || text.trim() === "") {
@@ -4077,17 +4079,17 @@ async function runCli(argv, io) {
           const ws = scope ?? (flags.all ? null : here);
           const base = inFolder(ws !== null ? { workspace: ws } : {});
           if (arg === "") {
-            const res2 = await tool("tags", base);
+            const res = await tool("tags", base);
             if (flags.json) {
-              io.out(JSON.stringify(res2, null, 2));
+              io.out(JSON.stringify(res, null, 2));
               return 0;
             }
-            if (res2.tags.length === 0) {
+            if (res.tags.length === 0) {
               io.err(ws !== null ? `no tags in ${tildify(folder === "" ? ws : join10(ws, folder))}` : "no tags");
               return 0;
             }
-            const width = res2.tags.reduce((w, t) => Math.max(w, t.tag.length + 1), 0);
-            for (const t of res2.tags)
+            const width = res.tags.reduce((w, t) => Math.max(w, t.tag.length + 1), 0);
+            for (const t of res.tags)
               io.out(`${`#${t.tag}`.padEnd(width)}  ${t.count}`);
             return 0;
           }
@@ -4119,11 +4121,11 @@ async function runCli(argv, io) {
             const args = inFolder({ template: flags.template, title });
             if (scope !== null)
               args["workspace"] = scope;
-            const n2 = await tool("create_note", args);
+            const n = await tool("create_note", args);
             if (flags.json)
-              io.out(JSON.stringify(n2, null, 2));
+              io.out(JSON.stringify(n, null, 2));
             else
-              io.out(n2.path);
+              io.out(n.path);
             return 0;
           }
           if (title === "" && body === "") {
@@ -4423,8 +4425,8 @@ class PtyProcess {
   constructor(opts) {
     this.interruptViaChar = opts.interruptViaChar ?? false;
     const keep = [];
-    const cstr = (str2) => {
-      const enc = new TextEncoder().encode(str2);
+    const cstr = (str) => {
+      const enc = new TextEncoder().encode(str);
       const b = new Uint8Array(enc.length + 1);
       b.set(enc);
       keep.push(b);
@@ -4742,12 +4744,12 @@ class MarkerParser {
     if (!tag.startsWith("ledge="))
       return null;
     const payload = tag.slice("ledge=".length);
-    const sep5 = payload.indexOf(":");
-    if (sep5 === -1)
+    const sep = payload.indexOf(":");
+    if (sep === -1)
       return null;
-    if (payload.slice(0, sep5) !== this.nonce)
+    if (payload.slice(0, sep) !== this.nonce)
       return null;
-    return payload.slice(sep5 + 1);
+    return payload.slice(sep + 1);
   }
 }
 function concat(a, b) {
@@ -4917,11 +4919,11 @@ class InlinePool {
           continue;
         }
         if (slot.shell.exited) {
-          const open2 = slot.parser.openBlockId ?? slot.activeRun;
-          if (open2 && !slot.began)
+          const open = slot.parser.openBlockId ?? slot.activeRun;
+          if (open && !slot.began)
             this.flushPreamble(slot, emit);
-          if (open2)
-            emit({ type: "ended", blockId: open2, exitCode: null }, slot.client);
+          if (open)
+            emit({ type: "ended", blockId: open, exitCode: null }, slot.client);
           this.dropSlot(session, slot);
         }
       }
@@ -4943,9 +4945,9 @@ class InlinePool {
     const session = this.sessions.get(sessionId);
     if (session) {
       for (const slot of this.slots(session)) {
-        const open2 = slot.parser.openBlockId ?? slot.activeRun;
-        if (open2)
-          emit({ type: "ended", blockId: open2, exitCode: null }, slot.client);
+        const open = slot.parser.openBlockId ?? slot.activeRun;
+        if (open)
+          emit({ type: "ended", blockId: open, exitCode: null }, slot.client);
         slot.shell.close();
       }
       this.sessions.delete(sessionId);
@@ -5057,14 +5059,14 @@ class InlinePool {
   }
   dropSlot(session, slot) {
     slot.shell.close();
-    for (const [host, s2] of session.primaries) {
-      if (s2 === slot) {
+    for (const [host, s] of session.primaries) {
+      if (s === slot) {
         session.primaries.delete(host);
         return;
       }
     }
-    for (const [id, s2] of session.overflow) {
-      if (s2 === slot)
+    for (const [id, s] of session.overflow) {
+      if (s === slot)
         session.overflow.delete(id);
     }
   }
@@ -5134,6 +5136,57 @@ async function writeProfile(name, text) {
   }
 }
 
+// src/shared/welcome.ts
+var WELCOME_TITLE = "Welcome to Ledge";
+var WELCOME_DOC = [
+  `# ${WELCOME_TITLE}`,
+  "",
+  "Ledge runs code and commands straight from your Markdown. This note is yours: edit it, or start a new one with \u2318N.",
+  "",
+  "## Run a block",
+  "",
+  "\u2318\u21A9 inside the block below, or the Run button on it (a tap, on a phone), runs it.",
+  "",
+  "```sh",
+  "curl -s https://api.github.com/zen",
+  "```",
+  "",
+  "One line of output streams into a panel beneath the block, and Dismiss puts the panel away.",
+  "",
+  "## The shell persists between blocks",
+  "",
+  "Each note keeps one shell for inline runs, so a `cd` or an exported variable carries into the next block. Run these two in order:",
+  "",
+  "```sh",
+  "cd /tmp",
+  "export FLAVOR=nautical",
+  "```",
+  "",
+  "```sh",
+  "pwd",
+  'echo "this shell is feeling $FLAVOR"',
+  "```",
+  "",
+  "\u21E7\u2318\u21A9 sends a block to the note's terminal drawer instead, a separate shell you can keep typing in. \u2303` opens the drawer.",
+  "",
+  "## Other languages",
+  "",
+  "`python`, `node`, `ts`, and others are runnable out of the box, each run a fresh process, and TypeScript runs on Bun, which Ledge already has:",
+  "",
+  "```ts",
+  "const now = new Date();",
+  "console.log(`hello from TypeScript, it is ${now.toLocaleTimeString()}`);",
+  "```",
+  "",
+  "## Where to next",
+  "",
+  "- The first line of a note names its file, so this one is `welcome-to-ledge.md`. Delete it from the sidebar once you are done with it.",
+  "- \u2318P opens a note by title, and \u2325\u2318P searches every note.",
+  '- The manual is behind the help button in the header, or "Documentation" in the command palette (\u21E7\u2318P). Getting Started is its first page.',
+  ""
+].join(`
+`);
+
 // src/bun/docs.ts
 import { basename as basename5, join as join13, resolve as resolve9 } from "path";
 import { mkdir as mkdir5, readdir as readdir4, readFile as readFile9, rename as rename8, unlink as unlink7, writeFile as writeFile8 } from "fs/promises";
@@ -5143,7 +5196,7 @@ var _01_getting_started_default = `# Getting Started
 
 Ledge is the notebook for developers and DevOps. It runs code and commands straight from your Markdown.
 
-The manual is read-only and its code blocks do not run. The note called Welcome to Ledge, which opens on a first launch and on a server that has no notes yet, is where the same examples do run.
+The manual is read-only and its code blocks do not run. The note called Welcome to Ledge is where the same examples do run. Ledge creates it the first time it starts on a machine, whether that is your Mac or a new server, and it stays in the Scratch workspace until you delete it.
 
 ## Your first note
 
@@ -6101,17 +6154,36 @@ Closing the last window quits Ledge.
 
 ## Install the server
 
-The other machine needs the \`ledge\` command on the PATH an incoming ssh gets. It comes from the \`ledge-server\` package, so a few commands install it. [[Tutorial: Set Up a Ledge Server]] walks through them on a fresh VPS, with an account for Ledge and the sshd hardening this page describes further down.
+The other machine needs the server, which is the \`ledge-server\` package. One command installs it, on Linux or a Mac. Run it in a terminal on that machine, signed in as the account Ledge will sign in to:
 
-The server runs on Bun, and where Bun goes decides where the server goes, because Bun puts global commands beside itself. On a Linux machine, install Bun into \`/usr/local\` and both names land in \`/usr/local/bin\`, which is where the short PATH of an ssh command looks:
+\`\`\`sh norun
+curl -fsSL https://ledge.sh/server.sh | sh
+\`\`\`
+
+It needs no \`sudo\` and nothing installed first. It downloads the package and a Bun of its own, checks both against the checksums written into the script, and puts them in \`~/.ledge/.server\` in that account's home. Ledge's ssh command looks in \`~/.ledge/.server/bin\` before anything else, so an incoming ssh finds the server with no change to the PATH. The script also adds a PATH line to the shell's startup file, so your own new terminals find \`ledge\` too.
+
+It refuses to run as root, because the server belongs to the account Ledge signs in to. To install for another account, such as one named \`ledge\`, run it through \`sudo\`:
 
 \`\`\`sh norun
-curl -fsSL https://bun.sh/install | sudo BUN_INSTALL=/usr/local bash
+curl -fsSL https://ledge.sh/server.sh | sudo -iu ledge sh
 \`\`\`
 
-Then the server, into the same place:
+Running the same command again updates the server. A server that is already running goes on serving until it exits on its own, a minute or more after the last device disconnects, and the next connection starts the new version. [[Tutorial: Set Up a Ledge Server]] walks through the install on a fresh VPS, with an account for Ledge and the sshd hardening this page describes further down.
+
+A Mac that runs the Ledge app needs none of this. "Install Shell Command (ledge)" in the app's command palette puts \`ledge\` in \`~/.ledge/.server/bin\`, where an incoming ssh looks first, pointing at the app's own copy. Signing in as that account then reaches the notes the app shows, with the app's server answering both. On a Mac, the machine also needs Remote Login turned on ("Expose ssh carefully").
+
+macOS and Linux are supported, on arm64 or x64. On Linux the floor is glibc 2.29, which means Debian 11, Ubuntu 20.04, RHEL 9, or anything newer. Alpine and other musl systems are not supported.
+
+Nothing else has to be installed and no port is opened. Ledge speaks its protocol over ssh's stdin and stdout.
+
+Blocks need zsh or bash on that machine. Ledge spawns the account's login shell when it is one of those, and otherwise the first of the two it finds, so an ordinary Linux install needs nothing extra. Where neither exists, a run refuses and names the shell it looked for instead of appearing to do nothing.
+
+## Install the server with Bun
+
+If the machine already has Bun and you would rather use it, the same package installs with \`bun add -g\`. Where Bun goes decides where the server goes, because Bun puts global commands beside itself, and both have to be on the short PATH an incoming ssh gets. On Linux, that means Bun in \`/usr/local\`:
 
 \`\`\`sh norun
+curl -fsSL https://bun.sh/install | sudo BUN_INSTALL=/usr/local bash
 sudo BUN_INSTALL=/usr/local bun add -g ledge-server
 \`\`\`
 
@@ -6128,27 +6200,23 @@ bun add -g ledge-server
 
 Run them as the account Ledge signs in to. None of them needs \`sudo\`. The account's shell has to be zsh, which it is unless the account predates macOS Catalina.
 
-A Mac that runs the Ledge app needs none of this. "Install Shell Command (ledge)" in the app's command palette puts \`ledge\` in \`~/.ledge/.server/bin\`, where an incoming ssh looks first, pointing at the app's own copy. Signing in as that account then reaches the notes the app shows, with the app's server answering both.
-
-macOS and Linux are supported, on arm64 or x64. On Linux the floor is glibc 2.29, which means Debian 11, Ubuntu 20.04, RHEL 9, or anything newer. Alpine and other musl systems are not supported.
-
-Nothing else has to be installed and no port is opened. Ledge speaks its protocol over ssh's stdin and stdout.
-
-Blocks need zsh or bash on that machine. Ledge spawns the account's login shell when it is one of those, and otherwise the first of the two it finds, so an ordinary Linux install needs nothing extra. Where neither exists, a run refuses and names the shell it looked for instead of appearing to do nothing.
+Updating is \`bun add -g ledge-server@latest\`, with the same \`sudo BUN_INSTALL=/usr/local\` in front on Linux.
 
 ## Check that ssh can find the server
 
 Worth doing once, because Ledge reports the failure it catches as a server that is not installed. A remote shell that cannot find a command says only that, so that is all the app has to go on.
 
-Ledge starts the server by running \`ledge serve\` over ssh. A command run that way gets a short PATH and skips the startup files a terminal reads, so both \`ledge\` and the \`bun\` its first line names have to be on that PATH already. From your Mac's own terminal:
+Ledge starts the server by running \`PATH=$HOME/.ledge/.server/bin:$PATH ledge serve\` over ssh. A command run that way skips the startup files a terminal reads, so \`ledge\` has to be in \`~/.ledge/.server/bin\` or on the short PATH an incoming ssh gets. From your Mac's own terminal, ask the machine the same question:
 
 \`\`\`sh norun
-ssh you@machine 'command -v ledge; command -v bun'
+ssh you@machine 'PATH=$HOME/.ledge/.server/bin:$PATH command -v ledge'
 \`\`\`
 
-Two paths printed means the machine is ready to add.
+A path printed means the machine is ready to add.
 
-On Linux, nothing printed means Bun is installed for one user rather than system-wide, which is what a machine that already had Bun before you started usually has. Its global commands are then in \`~/.bun/bin\`, which an incoming ssh does not search, and \`bun pm bin -g\` on that machine confirms where they went. Linking both names into a system directory, on that machine, fixes it without reinstalling anything:
+Nothing printed after \`server.sh\` means it ran as a different account from the one you signed in as. Run it again as that account.
+
+After an install with Bun, check \`bun\` as well, since the package starts with it: \`ssh you@machine 'command -v bun'\`. On Linux, nothing printed means Bun is installed for one user rather than in \`/usr/local\`, which is what a machine that already had Bun before you started usually has. Its global commands are then in \`~/.bun/bin\`, which an incoming ssh does not search, and \`bun pm bin -g\` on that machine confirms where they went. Linking both names into a system directory, on that machine, fixes it without reinstalling anything:
 
 \`\`\`sh norun
 sudo ln -s "$(bun pm bin -g)/ledge" /usr/local/bin/ledge
@@ -6177,10 +6245,10 @@ Optional, and worth doing on a server you care about. Ledge connects with an ord
 Restricting gives the server a key that can speak Ledge's protocol and nothing else. In that machine's \`~/.ssh/authorized_keys\`:
 
 \`\`\`
-restrict,command="/usr/local/bin/ledge serve" ssh-ed25519 AAAA... ledge@laptop
+restrict,command="PATH=$HOME/.ledge/.server/bin:$PATH ledge serve" ssh-ed25519 AAAA... ledge@laptop
 \`\`\`
 
-Use the absolute path that \`command -v ledge\` printed above. sshd runs this line instead of whatever the client asked for, so naming the file outright settles where it is. It does not settle where Bun is, which is the other half of the check.
+The command is the one Ledge itself runs, so it finds the server wherever the check above found it. sshd runs this line instead of whatever the client asked for.
 
 That key cannot forward a port, run \`scp\`, or open a shell over ssh. What it limits is what the key is good for if it is ever stolen: no route into the network behind that server, and no file copying.
 
@@ -6236,7 +6304,7 @@ Run them as the account the server runs as, on the machine the server runs on.
 
 | Verb | What it does |
 | --- | --- |
-| \`ledge backup setup\` | Asks for the bucket and its key, fetches restic if none is installed, writes the credentials to the \`backup\` profile, creates the repository, and takes the first backup. \`--existing\` joins a repository that already has backups in it. |
+| \`ledge backup setup\` | Asks for the bucket and its key, fetches restic if none is installed, writes the credentials to the \`backup\` profile, creates the repository, and takes the first backup. \`--existing\` joins a repository that already has backups in it, and takes no first backup, since a machine that has just joined has nothing on it to back up. |
 | \`ledge backup now\` | Takes a backup and thins old snapshots. |
 | \`ledge backup status\` | When the last backup ran and how it went, when the next is due, and any attached folder the last run could not find. |
 | \`ledge backup snapshots\` | The snapshots in the repository, newest first. |
@@ -6250,7 +6318,7 @@ Backups run every hour while the server is up, and once more before it exits: af
 
 Three things to know before you rely on it:
 
-- Keep the restic password somewhere other than this machine. \`setup\` prints it once. A restore starts on a machine that has nothing on it, and a password stored only inside the backup is a backup you cannot open.
+- Keep the restic password somewhere other than this machine, such as a password manager. \`setup\` prints it once. It is the only key to the backup, and nothing can be restored without it.
 - The backup holds secrets. Profile values are plain text on disk and so are unlocked notes, which is why restic encrypts before uploading. The bucket sees ciphertext only.
 - Locked notes and the vault travel together. \`.vault.json\` is inside the app home, so it is always in the backup, and a restore opens locked notes with the passphrase they had ([[Note Locking]]).
 
@@ -6395,6 +6463,8 @@ var _10_ledge_on_your_phone_default = `# Ledge on Your Phone
 
 Ledge runs on an iPhone or iPad as a window onto a server. The phone holds no notes: it reaches a server over ssh, the way a Mac does in [[Keep Notes on a Remote Server]], and shows you what is there.
 
+Get Ledge for iPhone from the App Store. It runs on iOS and iPadOS 17 or newer, and it needs a server to connect to before it shows anything.
+
 A server that already serves your Mac needs nothing more. A machine without one needs the server installed first, as "Install the server" on that page describes, and the phone shows the same commands ("Set up a server" below).
 
 ## The first screen
@@ -6415,11 +6485,11 @@ A pairing code names a server and its host keys, so the phone can add it without
 ledge pair
 \`\`\`
 
-On a terminal, it first lists every address the machine has, with a note on which phones reach each one: its tailnet name and address, the address your ssh session reached, its public address when it runs in a cloud, its other network addresses, and its name. Type a number to pick one, or an address of your own as \`host\` or \`host:port\`, or press Return for the first. It then prints the code as a QR code, then the account, host, port, and host keys it holds, then the same code as a link. Without a terminal, it takes the first address and lists the rest under the code, and \`--host\` names one on the next run. \`ledge pair --help\` lists the other flags.
+On a terminal, it first lists every address the machine has, with a note on which devices reach each one: its tailnet name and address, the address your ssh session reached, its public address when it runs in a cloud, its other network addresses, and its name. Type a number to pick one, or an address of your own as \`host\` or \`host:port\`, or press Return for the first. It then prints the code as a QR code, then the account, host, port, and host keys it holds, then the same code as a link. Without a terminal, it takes the first address and lists the rest under the code, and \`--host\` names one on the next run. \`ledge pair --help\` lists the other flags.
 
 A Mac that already has the server in its list can show the same code without a terminal: the QR code icon on the server's row in Notes On\u2026 ("Show a pairing code for a server" on [[Keep Notes on a Remote Server]]). The same link pastes into the Mac app's Add Server form ("Add a server from a pairing code" on that page).
 
-The code names one address, and the phone dials exactly that, so pick the one the phone reaches from where it will be. A tailnet name works from anywhere the phone is on the tailnet. A home network address works from a phone on that network. A cloud machine's public address works from anywhere, when its sshd is reachable from outside. A machine behind a router's port forward has an outside address no source knows: type it at the menu with its port, or give them with \`--host\` and \`--port\`. A Mac's code names the address the Mac dials, with the same reach.
+The code names one address, and the reader connects to exactly that, so pick the one your other devices reach from where they will be. A tailnet name works from anywhere a device is on the tailnet. A home network address works from a device on that network. A cloud machine's public address works from anywhere, when its sshd is reachable from outside. A machine behind a router's port forward has an outside address no source knows: type it at the menu with its port, or give them with \`--host\` and \`--port\`. A Mac's code names the address the Mac dials, with the same reach.
 
 On the phone, tap Scan a pairing code on the first screen, or in Add Server\u2026 inside the app ("More than one server" below), and point the camera at the QR code. Scan it from Ledge rather than the Camera app, which opens the code in Safari. Ledge shows what the code names and connects only when you tap Connect. Choose how to sign in first, the same way as in "Pair by address": with a key, whose line still has to be in the server's \`authorized_keys\`, or with a password. Ledge signs in only if the server offers one of the host keys in the code, so there is no fingerprint to check by eye.
 
@@ -6431,31 +6501,20 @@ A code never replaces a host key the phone already has. When Ledge has a differe
 
 ## Set up a server
 
-I don't have a server yet opens "Set up a server", which shows the commands that make a machine a Ledge server. Choose Linux or Mac above them. On Linux:
+I don't have a server yet opens "Set up a server", which shows the two commands that make a machine a Ledge server, on Linux or a Mac:
 
 \`\`\`sh norun
-curl -fsSL https://bun.sh/install | sudo BUN_INSTALL=/usr/local bash
-sudo BUN_INSTALL=/usr/local bun add -g ledge-server
-ledge pair
-\`\`\`
-
-On a Mac:
-
-\`\`\`sh norun
-curl -fsSL https://bun.sh/install | bash
-echo 'export PATH="$HOME/.bun/bin:$PATH"' >> ~/.zshenv
-source ~/.zshenv
-bun add -g ledge-server
-ledge pair
+curl -fsSL https://ledge.sh/server.sh | sh
+~/.ledge/.server/bin/ledge pair
 \`\`\`
 
-Run them in a terminal on that machine, signed in as the account the phone should use. They install Bun and the server where a command run over ssh can find them, which on Linux needs \`sudo\` and on a Mac needs the \`~/.zshenv\` line instead. The last command prints a pairing code for that account, and Scan the pairing code on the same screen reads it.
+Run them in a terminal on that machine, signed in as the account the phone should use rather than root. The first installs the server in that account's home, where a command run over ssh finds it, and needs no \`sudo\`. The second prints a pairing code for that account, and Scan the pairing code on the same screen reads it. It names \`ledge\` by its full path because the PATH line the installer adds reaches only new terminals.
 
 Copy commands puts them on the phone's pasteboard. Share commands hands them to AirDrop, Messages, or any app that can carry them to a computer with a terminal open on that machine.
 
-On a Mac, turn on Remote Login first, in System Settings under General, then Sharing. A Mac that runs the Ledge app needs only "Install Shell Command (ledge)" from the app's command palette in place of the first four commands: it puts \`ledge\` where the phone's ssh looks, pointing at the app's own copy, so the phone sees the same notes the app shows. \`ledge pair\` in a new terminal then prints the code.
+On a Mac, turn on Remote Login first, in System Settings under General, then Sharing. A Mac that runs the Ledge app needs only "Install Shell Command (ledge)" from the app's command palette in place of the first command: it puts \`ledge\` where the phone's ssh looks, pointing at the app's own copy, so the phone sees the same notes the app shows. The second command then prints the code.
 
-The machine needs sshd running and an address the phone can reach. [[Keep Notes on a Remote Server]] has the details of the install, including a machine that already has Bun, and [[Tutorial: Set Up a Ledge Server]] walks through a fresh VPS.
+The machine needs sshd running and an address the phone can reach. [[Keep Notes on a Remote Server]] has the details of the install, including installing with Bun instead, and [[Tutorial: Set Up a Ledge Server]] walks through a fresh VPS.
 
 If you already have a server, Add an existing server at the bottom of the screen opens the form from "Pair by address", and Back from there returns to the first screen.
 
@@ -6465,13 +6524,19 @@ Add an existing server opens "Pair with a server", a form with three parts. The
 
 The first part is the machine: \`user@host\`, and a port when sshd is not on 22. A phone reads no \`~/.ssh/config\`, so write the address out.
 
-The second is how to sign in. With A key, the default, the form shows a key line. On its first launch the phone makes a key of its own in the Secure Enclave, and that key never leaves the phone: there is no file to copy in or out. What leaves is the public half, as one line for the server's \`~/.ssh/authorized_keys\`:
+The second is how to sign in. With A key, the default, the form shows a command to run on the server. On its first launch the phone makes a key of its own in the Secure Enclave, and that key never leaves the phone: there is no file to copy in or out. What leaves is the public half, as one line for the server's \`~/.ssh/authorized_keys\`:
 
 \`\`\`
 restrict,command="PATH=$HOME/.ledge/.server/bin:$PATH ledge serve" ecdsa-sha2-nistp256 AAAA... ledge-iphone-3f2a91c0
 \`\`\`
 
-Copy line puts it on the phone's pasteboard. Share line hands it to AirDrop, Messages, or any app that can carry it to a machine with a shell on the server, which is where the pasteboard on a phone falls short. Add it to \`~/.ssh/authorized_keys\` there. The comment at the end names the phone, so the line is easy to find again when you want to revoke it.
+The command adds that line to the file, creating \`~/.ssh\` first if the account has none:
+
+\`\`\`sh norun
+mkdir -p ~/.ssh && chmod 700 ~/.ssh && printf '\\n%s\\n' 'restrict,command="PATH=$HOME/.ledge/.server/bin:$PATH ledge serve" ecdsa-sha2-nistp256 AAAA... ledge-iphone-3f2a91c0' >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys
+\`\`\`
+
+Run it on the server, signed in as the account Ledge uses: over ssh from a Mac, or in the provider's web console for a new VPS. Copy command puts it on the phone's pasteboard. Share command hands it to AirDrop, Messages, or any app that can carry it to that terminal, which is where the pasteboard on a phone falls short. The comment at the end of the line names the phone, so the line is easy to find again when you want to revoke it.
 
 The line arrives already restricted, in the way "Restrict the key to Ledge" on [[Keep Notes on a Remote Server]] describes: the phone's key can speak Ledge's protocol and nothing else. It looks for \`ledge\` in \`~/.ledge/.server/bin\` first and then on the PATH an incoming ssh gets, so a server installed in either place starts ("Check that ssh can find the server" on the same page).
 
@@ -6481,7 +6546,7 @@ Ledge adds the server only once \`ledge serve\` answers there. On a machine wher
 
 ## Sign in with a password instead
 
-Choose "A password" under Sign in with and type the password for that account. The phone keeps it in its own keychain, and no key line has to be installed.
+Choose "A password" under Sign in with and type the password for that account. The eye button at the end of the field shows what you typed, to check it before connecting. The phone keeps the password in its own keychain, and no key line has to be installed.
 
 The trade-off is the one described on [[Keep Notes on a Remote Server]]: a password reaches a fresh machine today, and a key is the better long-term answer. A server with \`PasswordAuthentication no\` refuses it.
 
@@ -6497,7 +6562,7 @@ Removing the last server returns the phone to the first screen. Deleting the app
 
 ## More than one server
 
-Inside the app the connection bar works as on a Mac: tap it to add, edit, remove, or switch servers, with the same fingerprint step ([[Keep Notes on a Remote Server]]). The form shows the phone's key line where a Mac's shows a key path, with Share Line beside Copy Line.
+Inside the app the connection bar works as on a Mac: tap it to add, edit, remove, or switch servers, with the same fingerprint step ([[Keep Notes on a Remote Server]]). The form shows the command that installs the phone's key where a Mac's shows a key path, with Share Command beside Copy Command.
 
 Add Server\u2026 starts with Scan a pairing code, where a Mac's form has a field for the pasted link. It opens the camera, then the same "Pair with a server" screen as the first launch, and the app reopens on the new server once you tap Connect there. Cancel returns you to the form, where you can type the address instead. Editing a server has no scan: a code never replaces a host key the phone already has.
 
@@ -7117,7 +7182,7 @@ They combine: a synced drive for the always-on workspaces, a git repo for the on
 `;
 
 // docs/user/20-tutorial-set-up-a-ledge-server.md
-var _20_tutorial_set_up_a_ledge_server_default = '# Tutorial: Set Up a Ledge Server\n\nTurn a fresh Linux VPS into a Ledge server: an account for Ledge, the server package, a key that can do nothing but Ledge, and an sshd that ignores everyone else.\n\nThis builds on [[Keep Notes on a Remote Server]], which is the reference for every step here. The commands assume Debian or Ubuntu. Any Linux with glibc 2.29 or newer works, so substitute your package manager on anything else.\n\nTwo accounts appear throughout. `you@vps` is the account your provider gave you, which can `sudo`. `ledge@vps` is the account you create in step 1, which cannot.\n\n## 1. Create an account for Ledge\n\nOn the VPS, as your own account:\n\n```sh norun\nsudo adduser --disabled-password --gecos "" ledge\n```\n\nThe account has no password and no `sudo`. Everything Ledge does on this machine runs as this account: the server, the shells, and every block in every note. A key for it that is ever stolen cannot become root.\n\nIf your notes need `sudo`, that is a decision for later, made with `visudo` and as narrow as you can make it.\n\n`adduser` gives the account bash as its login shell, which is one of the two shells Ledge runs blocks in.\n\n## 2. Make a key on your Mac\n\nIn a terminal on your Mac:\n\n```sh norun\nssh-keygen -t ed25519 -f ~/.ssh/ledge -C ledge@laptop\ncat ~/.ssh/ledge.pub\n```\n\nLeave the key\'s passphrase empty, or use one your ssh agent already holds. Ledge\'s ssh runs with no terminal attached, so a passphrase it would have to type at a prompt never gets typed. This is about the key file only: signing in with the account\'s password is a choice on the form, and [[Keep Notes on a Remote Server]] covers it. This tutorial uses a key so that step 8 can turn passwords off.\n\nCopy the printed line, then put it on the VPS as the new account\'s only key. As your own account there, with the line pasted in place of the placeholder:\n\n```sh norun\nsudo install -d -m 700 -o ledge -g ledge /home/ledge/.ssh\necho \'ssh-ed25519 AAAA... ledge@laptop\' | sudo tee /home/ledge/.ssh/authorized_keys\nsudo chown ledge:ledge /home/ledge/.ssh/authorized_keys\nsudo chmod 600 /home/ledge/.ssh/authorized_keys\n```\n\nThe line goes in unrestricted for now. Step 7 restricts it, once you know the server works.\n\n## 3. Install the server\n\nStill on the VPS, as your own account:\n\n```sh norun\ncurl -fsSL https://bun.sh/install | sudo BUN_INSTALL=/usr/local bash\nsudo BUN_INSTALL=/usr/local bun add -g ledge-server\n```\n\nBoth commands carry `BUN_INSTALL=/usr/local`. Bun puts global commands beside itself, and `/usr/local/bin` is on the short PATH an incoming ssh gets. Without the variable, the server lands in a home directory that ssh never searches.\n\nNothing else needs installing and no service needs starting. Ledge starts the server over ssh when it connects, and the server exits a minute after the last device leaves, unless a block is still running.\n\n## 4. Check that ssh can find it\n\nFrom your Mac, as the new account, with the new key:\n\n```sh norun\nssh -i ~/.ssh/ledge ledge@vps \'command -v ledge; command -v bun\'\n```\n\nTwo paths printed means the machine is ready. Keep the first one; step 7 needs it.\n\nNothing printed means Bun was already installed for one user before you started, and its commands are in a directory ssh does not search. [[Keep Notes on a Remote Server]] shows the two symlinks that fix it.\n\n## 5. Add the server in Ledge\n\nRun "Notes On\u2026" from the command palette, choose Add, and fill in the form:\n\n| Field | Value |\n| --- | --- |\n| Name | Whatever you want the connection bar to say |\n| SSH destination | `ledge@vps` |\n| Port | Blank |\n| Sign in with | A key |\n| Key | `~/.ssh/ledge` |\n\nLedge fetches the machine\'s host key and shows its fingerprint. Get the same fingerprint from the machine itself, in your terminal on the VPS:\n\n```sh norun\nssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub\n```\n\nChoose "It Matches, Add" when the two agree. Ledge pins the key and refuses any future connection from that address that presents a different one.\n\n## 6. Try it\n\nThe connection bar now names the server. Press \u2318N, and the note you create is a file on the VPS. Give it one block:\n\n````\n```sh\nhostname; whoami\n```\n````\n\n\u2318\u21A9 prints the VPS\'s hostname and `ledge`. The block ran on the server, as the account you made, and the note never left it.\n\n## 7. Restrict the key to Ledge\n\nEdit `/home/ledge/.ssh/authorized_keys` on the VPS and put a prefix in front of the key, using the path step 4 printed:\n\n```\nrestrict,command="/usr/local/bin/ledge serve" ssh-ed25519 AAAA... ledge@laptop\n```\n\nThat key can now speak Ledge\'s protocol and nothing else: no shell, no port forwarding, no file copying. sshd runs the named command whatever the client asks for, so the terminal check in step 4 stops working for this key. That is expected. Your own account is the one for terminals.\n\nThe connection you already have keeps working. Ledge\'s next connection, at the next launch or after a drop, uses the restricted line.\n\n## 8. Turn off passwords in sshd\n\nA Ledge server runs whatever its notes say, so sshd should answer keys and nothing else. Create `/etc/ssh/sshd_config.d/10-ledge.conf`:\n\n```\nPasswordAuthentication no\nKbdInteractiveAuthentication no\nPermitRootLogin prohibit-password\n```\n\nThe `10-` matters. sshd keeps the first value it reads for a setting, and it reads this directory in name order. Cloud images ship a `50-cloud-init.conf` that turns passwords on, and a file named after it would lose.\n\nYour own account has to sign in with a key from now on. The provider usually installed one when it created the VPS, and this line from your Mac says whether it did:\n\n```sh norun\nssh -o PasswordAuthentication=no you@vps true\n```\n\nIf it asks for a password, put a key on that account first, with `ssh-copy-id`.\n\nThen check the configuration and reload, keeping your current terminal open until a second one has logged in:\n\n```sh norun\nsudo sshd -t && sudo systemctl reload ssh\n```\n\n## 9. Ban repeated guesses with fail2ban\n\nKeys-only sshd refuses every guess, but a box on the public internet still receives thousands of them a day, and each one costs a log line and a connection slot. fail2ban blocks an address after a few failures.\n\n```sh norun\nsudo apt-get install -y fail2ban\n```\n\nCreate `/etc/fail2ban/jail.local`:\n\n```ini\n[sshd]\nenabled = true\nbackend = systemd\nmaxretry = 5\nbantime = 1h\n```\n\n`backend = systemd` reads sshd\'s log from the journal. Debian 12, Ubuntu 24.04, and anything newer ship without a text `auth.log`, and fail2ban without this line fails to start on them.\n\n```sh norun\nsudo systemctl enable --now fail2ban\nsudo fail2ban-client status sshd\n```\n\nThe second command prints the jail\'s counts. Ledge never trips it: it connects with a key sshd accepts, and reconnects the same way.\n\n## 10. Close every other port\n\nOnly sshd needs to be reachable. Allow it, then turn the firewall on:\n\n```sh norun\nsudo apt-get install -y ufw\nsudo ufw allow 22/tcp\nsudo ufw enable\nsudo ufw status\n```\n\nUbuntu has `ufw` already, and the install line does nothing there.\n\nIf the VPS is on a tailnet or VPN, allow ssh from that interface alone and drop the public rule:\n\n```sh norun\nsudo ufw allow in on tailscale0 to any port 22\nsudo ufw delete allow 22/tcp\n```\n\nThen use the tailnet address as the SSH destination in Ledge. A server nobody else can reach has nothing for fail2ban to do, and the previous step does no harm.\n\n## 11. Keep it patched\n\nSecurity updates for the operating system should install themselves:\n\n```sh norun\nsudo apt-get install -y unattended-upgrades\nsudo dpkg-reconfigure -plow unattended-upgrades\n```\n\nAnswer Yes. Ubuntu ships with this on, and the two commands confirm it.\n\nThe server itself is a package, and updating it is the install line again:\n\n```sh norun\nsudo BUN_INSTALL=/usr/local bun add -g ledge-server@latest\n```\n\nA connection between an app and a server that cannot understand each other is refused with a sentence naming which end to update, so a version that falls behind is reported rather than guessed at.\n\n## Where to go next\n\n- **Back it up.** The notes now live on one disk that belongs to one provider. [[Tutorial: Back Up Your Notes to S3]] puts an encrypted copy in a bucket every hour, with one `ledge backup setup`.\n- **Add your phone.** Its pairing screen hands you a line for this same `authorized_keys`, already restricted ([[Ledge on Your Phone]]).\n- **Install what your notes run.** `git`, a language, a cloud CLI: whatever a block on this machine needs, installed as your own account with `apt-get`.\n- **Reach other machines from it.** A note on the VPS can carry `host: prod`, and the VPS makes that ssh connection with a key in `/home/ledge/.ssh` ([[Run Code on Remote Hosts]]).\n';
+var _20_tutorial_set_up_a_ledge_server_default = '# Tutorial: Set Up a Ledge Server\n\nTurn a fresh Linux VPS into a Ledge server: an account for Ledge, the server package, a key that can do nothing but Ledge, and an sshd that ignores everyone else.\n\nThis builds on [[Keep Notes on a Remote Server]], which is the reference for every step here. The commands assume Debian or Ubuntu. Any Linux with glibc 2.29 or newer works, so substitute your package manager on anything else.\n\nTwo accounts appear throughout. `you@vps` is the account your provider gave you, which can `sudo`. `ledge@vps` is the account you create in step 1, which cannot.\n\n## 1. Create an account for Ledge\n\nOn the VPS, as your own account:\n\n```sh norun\nsudo adduser --disabled-password --gecos "" ledge\n```\n\nThe account has no password and no `sudo`. Everything Ledge does on this machine runs as this account: the server, the shells, and every block in every note. A key for it that is ever stolen cannot become root.\n\nIf your notes need `sudo`, that is a decision for later, made with `visudo` and as narrow as you can make it.\n\n`adduser` gives the account bash as its login shell, which is one of the two shells Ledge runs blocks in.\n\n## 2. Make a key on your Mac\n\nIn a terminal on your Mac:\n\n```sh norun\nssh-keygen -t ed25519 -f ~/.ssh/ledge -C ledge@laptop\ncat ~/.ssh/ledge.pub\n```\n\nLeave the key\'s passphrase empty, or use one your ssh agent already holds. Ledge\'s ssh runs with no terminal attached, so a passphrase it would have to type at a prompt never gets typed. This is about the key file only: signing in with the account\'s password is a choice on the form, and [[Keep Notes on a Remote Server]] covers it. This tutorial uses a key so that step 8 can turn passwords off.\n\nCopy the printed line, then put it on the VPS as the new account\'s only key. As your own account there, with the line pasted in place of the placeholder:\n\n```sh norun\nsudo install -d -m 700 -o ledge -g ledge /home/ledge/.ssh\necho \'ssh-ed25519 AAAA... ledge@laptop\' | sudo tee /home/ledge/.ssh/authorized_keys\nsudo chown ledge:ledge /home/ledge/.ssh/authorized_keys\nsudo chmod 600 /home/ledge/.ssh/authorized_keys\n```\n\nThe line goes in unrestricted for now. Step 7 restricts it, once you know the server works.\n\n## 3. Install the server\n\nStill on the VPS, as your own account, install the server into the new account\'s home:\n\n```sh norun\ncurl -fsSL https://ledge.sh/server.sh | sudo -iu ledge sh\n```\n\nThe installer runs as `ledge` and puts the server, with a Bun of its own, in `/home/ledge/.ledge/.server`. It refuses to run as root, because the server belongs to the account Ledge signs in to, and `sudo -iu ledge` is how your own account runs it as that one.\n\nNothing else needs installing and no service needs starting. Ledge starts the server over ssh when it connects, and the server exits a minute after the last device leaves, unless a block is still running.\n\n## 4. Check that ssh can find it\n\nFrom your Mac, as the new account, with the new key:\n\n```sh norun\nssh -i ~/.ssh/ledge ledge@vps \'PATH=$HOME/.ledge/.server/bin:$PATH command -v ledge\'\n```\n\nA path printed means the machine is ready. This is the same lookup Ledge makes when it connects.\n\nNothing printed means the installer ran as a different account. Run step 3 again exactly as written.\n\n## 5. Add the server in Ledge\n\nRun "Notes On\u2026" from the command palette, choose Add, and fill in the form:\n\n| Field | Value |\n| --- | --- |\n| Name | Whatever you want the connection bar to say |\n| SSH destination | `ledge@vps` |\n| Port | Blank |\n| Sign in with | A key |\n| Key | `~/.ssh/ledge` |\n\nLedge fetches the machine\'s host key and shows its fingerprint. Get the same fingerprint from the machine itself, in your terminal on the VPS:\n\n```sh norun\nssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub\n```\n\nChoose "It Matches, Add" when the two agree. Ledge pins the key and refuses any future connection from that address that presents a different one.\n\n## 6. Try it\n\nThe connection bar now names the server. Press \u2318N, and the note you create is a file on the VPS. Give it one block:\n\n````\n```sh\nhostname; whoami\n```\n````\n\n\u2318\u21A9 prints the VPS\'s hostname and `ledge`. The block ran on the server, as the account you made, and the note never left it.\n\n## 7. Restrict the key to Ledge\n\nEdit `/home/ledge/.ssh/authorized_keys` on the VPS and put a prefix in front of the key:\n\n```\nrestrict,command="PATH=$HOME/.ledge/.server/bin:$PATH ledge serve" ssh-ed25519 AAAA... ledge@laptop\n```\n\nThat key can now speak Ledge\'s protocol and nothing else: no shell, no port forwarding, no file copying. sshd runs the named command whatever the client asks for, so the terminal check in step 4 stops working for this key. That is expected. Your own account is the one for terminals.\n\nThe connection you already have keeps working. Ledge\'s next connection, at the next launch or after a drop, uses the restricted line.\n\n## 8. Turn off passwords in sshd\n\nA Ledge server runs whatever its notes say, so sshd should answer keys and nothing else. Create `/etc/ssh/sshd_config.d/10-ledge.conf`:\n\n```\nPasswordAuthentication no\nKbdInteractiveAuthentication no\nPermitRootLogin prohibit-password\n```\n\nThe `10-` matters. sshd keeps the first value it reads for a setting, and it reads this directory in name order. Cloud images ship a `50-cloud-init.conf` that turns passwords on, and a file named after it would lose.\n\nYour own account has to sign in with a key from now on. The provider usually installed one when it created the VPS, and this line from your Mac says whether it did:\n\n```sh norun\nssh -o PasswordAuthentication=no you@vps true\n```\n\nIf it asks for a password, put a key on that account first, with `ssh-copy-id`.\n\nThen check the configuration and reload, keeping your current terminal open until a second one has logged in:\n\n```sh norun\nsudo sshd -t && sudo systemctl reload ssh\n```\n\n## 9. Ban repeated guesses with fail2ban\n\nKeys-only sshd refuses every guess, but a box on the public internet still receives thousands of them a day, and each one costs a log line and a connection slot. fail2ban blocks an address after a few failures.\n\n```sh norun\nsudo apt-get install -y fail2ban\n```\n\nCreate `/etc/fail2ban/jail.local`:\n\n```ini\n[sshd]\nenabled = true\nbackend = systemd\nmaxretry = 5\nbantime = 1h\n```\n\n`backend = systemd` reads sshd\'s log from the journal. Debian 12, Ubuntu 24.04, and anything newer ship without a text `auth.log`, and fail2ban without this line fails to start on them.\n\n```sh norun\nsudo systemctl enable --now fail2ban\nsudo fail2ban-client status sshd\n```\n\nThe second command prints the jail\'s counts. Ledge never trips it: it connects with a key sshd accepts, and reconnects the same way.\n\n## 10. Close every other port\n\nOnly sshd needs to be reachable. Allow it, then turn the firewall on:\n\n```sh norun\nsudo apt-get install -y ufw\nsudo ufw allow 22/tcp\nsudo ufw enable\nsudo ufw status\n```\n\nUbuntu has `ufw` already, and the install line does nothing there.\n\nIf the VPS is on a tailnet or VPN, allow ssh from that interface alone and drop the public rule:\n\n```sh norun\nsudo ufw allow in on tailscale0 to any port 22\nsudo ufw delete allow 22/tcp\n```\n\nThen use the tailnet address as the SSH destination in Ledge. A server nobody else can reach has nothing for fail2ban to do, and the previous step does no harm.\n\n## 11. Keep it patched\n\nSecurity updates for the operating system should install themselves:\n\n```sh norun\nsudo apt-get install -y unattended-upgrades\nsudo dpkg-reconfigure -plow unattended-upgrades\n```\n\nAnswer Yes. Ubuntu ships with this on, and the two commands confirm it.\n\nThe server updates with the install line from step 3, run again:\n\n```sh norun\ncurl -fsSL https://ledge.sh/server.sh | sudo -iu ledge sh\n```\n\nA connection between an app and a server that cannot understand each other is refused with a sentence naming which end to update, so a version that falls behind is reported rather than guessed at.\n\n## Where to go next\n\n- **Back it up.** The notes now live on one disk that belongs to one provider. [[Tutorial: Back Up Your Notes to S3]] puts an encrypted copy in a bucket every hour, with one `ledge backup setup`.\n- **Add your phone.** Its pairing screen hands you a line for this same `authorized_keys`, already restricted ([[Ledge on Your Phone]]).\n- **Install what your notes run.** `git`, a language, a cloud CLI: whatever a block on this machine needs, installed as your own account with `apt-get`.\n- **Reach other machines from it.** A note on the VPS can carry `host: prod`, and the VPS makes that ssh connection with a key in `/home/ledge/.ssh` ([[Run Code on Remote Hosts]]).\n';
 
 // docs/user/21-tutorial-back-up-your-notes-to-s3.md
 var _21_tutorial_back_up_your_notes_to_s3_default = `# Tutorial: Back Up Your Notes to S3
@@ -7158,9 +7223,9 @@ It asks for the endpoint, the bucket, the access key ID, and the secret. Then it
 | Credentials | Writes the four values and a generated restic password to the \`backup\` profile, \`~/.config/ledge/profiles/backup.env\`, readable by this account alone ([[Profiles and Secrets]]). |
 | Repository | Creates the restic repository in the bucket. |
 | First backup | Backs up everything \`ledge backup paths\` lists: the app home, every folder attached from elsewhere on the machine, and the profiles. |
-| Password | Prints the password on its last line. |
+| Password | Prints the password, the one thing \`setup\` writes to stdout. |
 
-The password is what encrypts the backup, and it is the only key. Copy it somewhere that is not this machine, such as a password manager. A restore starts on a machine with nothing on it, and a password stored only inside the backup is a backup you cannot open.
+The password is what encrypts the backup, and it is the only key. Nothing can be restored without it. Copy it somewhere that is not this machine, such as a password manager.
 
 ## 3. Leave it running
 
@@ -7171,11 +7236,23 @@ On a Mac, the server is up while the app is open and for a minute after it close
 Nothing else needs installing: no timer, no unit file, no line in a crontab. One line is worth adding on a server where notes are written while no device is connected, by the \`ledge\` command or by an agent, since those do not start the server:
 
 \`\`\`sh norun
-0 * * * * /usr/local/bin/ledge backup now
+0 * * * * $HOME/.ledge/.server/bin/ledge backup now
 \`\`\`
 
 \`ledge backup now\` takes a backup at any time and is safe to run beside the schedule.
 
+Old snapshots are thinned after each backup, and what survives is fixed:
+
+| Kept | For |
+| --- | --- |
+| The ten newest snapshots | however close together they were taken |
+| One an hour | a day |
+| One a day | a month |
+| One a week | a quarter |
+| One a month | two years |
+
+Only the snapshots Ledge took are thinned, so a bucket shared with another tool's backups keeps those whatever this policy says.
+
 ## 4. Check on it
 
 \`\`\`sh norun
@@ -7211,13 +7288,13 @@ On a fresh machine with Ledge installed, the app on a Mac or the server on a VPS
 ledge backup setup --existing
 \`\`\`
 
-It asks the same questions plus the password, opens the repository instead of creating one, and writes the profile. Then, with the app quit or the daemon stopped:
+It asks the same questions plus the password, opens the repository instead of creating one, writes the profile, and prints the newest snapshot in it. It takes no backup, since there is nothing on this machine to back up yet. Then, with the app quit or the daemon stopped:
 
 \`\`\`sh norun
 ledge backup restore --in-place
 \`\`\`
 
-The paths inside the backup are absolute, so this puts the app home, the attached folders, and the profiles back where they were. Then open Ledge, or connect to the server. Your workspaces, images, trash, profiles, and vault are all there, and locked notes open with the passphrase they had ([[Note Locking]]). Backups continue on the new machine with the same repository.
+The paths inside the backup are absolute, so this puts the app home, the attached folders, and the profiles back where they were. \`--snapshot ID\` restores an older one than the newest. Then open Ledge, or connect to the server. Your workspaces, images, trash, profiles, and vault are all there, and locked notes open with the passphrase they had ([[Note Locking]]). Backups continue on the new machine with the same repository.
 
 ## Run restic yourself
 
@@ -9696,9 +9773,9 @@ function sizeOf(path) {
 }
 var logPath = LOG_PATH;
 var prevPath = PREV_LOG_PATH;
-function logToFile(basename7) {
-  logPath = join15(LOG_DIR, `${basename7}.log`);
-  prevPath = join15(LOG_DIR, `${basename7}.previous.log`);
+function logToFile(basename) {
+  logPath = join15(LOG_DIR, `${basename}.log`);
+  prevPath = join15(LOG_DIR, `${basename}.previous.log`);
 }
 function rotate() {
   try {
@@ -9729,12 +9806,12 @@ function write(source, level, args) {
   append(formatLine(new Date, source, level, args));
 }
 var patched = false;
-function startLogging(basename7) {
+function startLogging(basename) {
   if (patched)
     return;
   patched = true;
-  if (basename7)
-    logToFile(basename7);
+  if (basename)
+    logToFile(basename);
   rotate();
   const levels = [
     ["log", "info"],
@@ -9768,13 +9845,13 @@ function relevantChange(filename) {
   if (filename === null)
     return true;
   const segments = filename.split("/");
-  if (segments.slice(0, -1).some((s2) => s2.startsWith(".")))
+  if (segments.slice(0, -1).some((s) => s.startsWith(".")))
     return false;
   return /\.md(\.|$)/i.test(segments[segments.length - 1]);
 }
 var watchers = new Map;
-function syncWatchers(roots2, onChange) {
-  const want = new Set(roots2);
+function syncWatchers(roots, onChange) {
+  const want = new Set(roots);
   for (const [root, w] of watchers) {
     if (want.has(root))
       continue;
@@ -9834,14 +9911,14 @@ function bundledBun(execPath) {
   return /(^|\/)bun$/.test(execPath) ? execPath : "";
 }
 function runnerFor(id, lang, code, interpreters, bunPath, remote = false) {
-  const key2 = (lang ?? "").toLowerCase();
-  const interpreter = interpreters[key2];
+  const key = (lang ?? "").toLowerCase();
+  const interpreter = interpreters[key];
   if (!interpreter) {
-    const path2 = `/tmp/ledge-run-${id}.sh`;
-    const command = remote ? remoteWrite(code, path2, `source ${path2}`) : `source ${path2}`;
-    return { kind: "shell", path: path2, contents: code, command, remote };
+    const path = `/tmp/ledge-run-${id}.sh`;
+    const command = remote ? remoteWrite(code, path, `source ${path}`) : `source ${path}`;
+    return { kind: "shell", path, contents: code, command, remote };
   }
-  const ext = EXT[key2] ?? (key2.replace(/[^a-z0-9]/g, "") || "txt");
+  const ext = EXT[key] ?? (key.replace(/[^a-z0-9]/g, "") || "txt");
   const path = `/tmp/ledge-run-${id}.${ext}`;
   const contents = ext === "php" && !/^\s*<\?/.test(code) ? `<?php
 ${code}` : code;
@@ -9865,8 +9942,8 @@ function hostGlobMatches(pattern, host) {
   const rx = pattern.split("*").map(escapeRegex).join(".*");
   return new RegExp(`^${rx}$`).test(host);
 }
-function escapeRegex(s2) {
-  return s2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+function escapeRegex(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
 // src/bun/remoteSpawn.ts
@@ -9887,11 +9964,11 @@ function buildRemoteSpawn(host, kind, params, warn) {
   const parts = [];
   if (params?.cwd)
     parts.push(remoteCd(params.cwd));
-  for (const [key2, value] of Object.entries(params?.env ?? {})) {
-    if (isEnvName(key2) && typeof value === "string") {
-      parts.push(`export ${key2}=${shellQuote(value)}`);
+  for (const [key, value] of Object.entries(params?.env ?? {})) {
+    if (isEnvName(key) && typeof value === "string") {
+      parts.push(`export ${key}=${shellQuote(value)}`);
     } else {
-      warn(`ignoring unusable env entry "${key2}"`);
+      warn(`ignoring unusable env entry "${key}"`);
     }
   }
   if (kind === "inline") {
@@ -9983,7 +10060,10 @@ async function createServer(deps) {
   const { push } = deps;
   const settings = await loadSettings();
   await loadWorkspaces();
-  await ensureDefault();
+  const first = await ensureDefault();
+  if (first) {
+    await createNote(first, WELCOME_DOC).catch((err) => console.warn("[server] could not write the welcome note", err));
+  }
   await syncDocs();
   await loadVault();
   const shellEnv = { ...process.env, TERM: "xterm-256color" };
@@ -10116,9 +10196,9 @@ async function createServer(deps) {
       watch2(APP_HOME, (_event, filename) => {
         if (filename !== requestName)
           return;
-        takeOpenRequest().then((open2) => {
-          if (open2 !== null)
-            push.all.openExternal(open2);
+        takeOpenRequest().then((open) => {
+          if (open !== null)
+            push.all.openExternal(open);
         });
       });
     } catch (err) {
@@ -10481,9 +10561,9 @@ async function createServer(deps) {
       return { ok: true };
     },
     openRequestTake: async () => {
-      const open2 = await takeOpenRequest();
+      const open = await takeOpenRequest();
       startOpenRequestWatcher();
-      return { open: open2 };
+      return { open };
     },
     logAppend: async ({ level, text }) => {
       write("view", level, [text.slice(0, LOG_TEXT_CAP)]);
@@ -10764,10 +10844,10 @@ function restoreBinary(payload, path, bytes) {
 }
 function walk(payload, path) {
   let at = payload;
-  for (const key2 of path) {
+  for (const key of path) {
     if (typeof at !== "object" || at === null)
       return null;
-    at = at[key2];
+    at = at[key];
   }
   return { value: at };
 }
@@ -10942,8 +11022,8 @@ function names(v) {
   return v.filter((n) => typeof n === "string").slice(0, MAX_DECLARED_NAMES);
 }
 var MAX_DECLARED_NAMES = 512;
-function opt(key2, v) {
-  return typeof v === "string" ? { [key2]: v } : {};
+function opt(key, v) {
+  return typeof v === "string" ? { [key]: v } : {};
 }
 function bin(v) {
   return isId(v) ? { bin: v } : {};
@@ -10990,15 +11070,15 @@ function concat2(a, b) {
   out.set(b, a.length);
   return out;
 }
-function writeMessage(write2, msg, kind, method) {
+function writeMessage(write, msg, kind, method) {
   const path = binaryPath(kind, method);
   const body = msg.t === "req" ? msg.p : msg.t === "res" ? msg.r : msg.t === "push" ? msg.p : null;
   const hoisted = path && body !== null ? hoistBinary(body, path) : null;
   if (!hoisted)
-    return write2(encodeControl(msg));
-  const bin2 = nextBinaryId();
-  write2(encodeBinary(bin2, hoisted.bytes));
-  write2(encodeControl(msg.t === "req" ? { ...msg, p: hoisted.payload, bin: bin2 } : msg.t === "res" ? { ...msg, r: hoisted.payload, bin: bin2 } : { ...msg, p: hoisted.payload, bin: bin2 }));
+    return write(encodeControl(msg));
+  const bin = nextBinaryId();
+  write(encodeBinary(bin, hoisted.bytes));
+  write(encodeControl(msg.t === "req" ? { ...msg, p: hoisted.payload, bin } : msg.t === "res" ? { ...msg, r: hoisted.payload, bin } : { ...msg, p: hoisted.payload, bin }));
 }
 var binaryId = 0;
 function nextBinaryId() {
@@ -11008,19 +11088,19 @@ function nextBinaryId() {
 
 class BinaryHolder {
   held = null;
-  hold(frame2) {
+  hold(frame) {
     if (this.held)
       throw new WireError("the peer sent two binary frames with no control frame between them");
-    this.held = { id: frame2.id, bytes: frame2.bytes };
+    this.held = { id: frame.id, bytes: frame.bytes };
   }
   claim(msg, kind, method) {
-    const bin2 = msg.t === "req" || msg.t === "res" || msg.t === "push" ? msg.bin : undefined;
+    const bin = msg.t === "req" || msg.t === "res" || msg.t === "push" ? msg.bin : undefined;
     const body = msg.t === "req" ? msg.p : msg.t === "res" ? msg.r : msg.t === "push" ? msg.p : null;
-    if (bin2 === undefined)
+    if (bin === undefined)
       return body;
     const held = this.held;
     this.held = null;
-    if (!held || held.id !== bin2)
+    if (!held || held.id !== bin)
       throw new WireError("the peer claimed a binary frame that did not arrive");
     const path = binaryPath(kind, method);
     if (!path)
@@ -11102,7 +11182,7 @@ function serverConnection(duplex, opts) {
   const silentMs = opts.silentMs ?? SILENT_MS2;
   let heardFromClient = false;
   let stopWatching = null;
-  const decoder2 = new FrameDecoder;
+  const decoder = new FrameDecoder;
   const incoming = new BinaryHolder;
   let handlers = null;
   let greeted = false;
@@ -11110,10 +11190,10 @@ function serverConnection(duplex, opts) {
   let peerDevice = "";
   let peerLabel = "";
   let peerHold = 0;
-  let open2 = true;
+  let open = true;
   const waiting = [];
   let settle;
-  const closed = new Promise((resolve11) => settle = resolve11);
+  const closed = new Promise((resolve) => settle = resolve);
   function raw(bytes) {
     try {
       duplex.write(bytes);
@@ -11123,7 +11203,7 @@ function serverConnection(duplex, opts) {
     }
   }
   function send(msg, method = "") {
-    if (!open2)
+    if (!open)
       return;
     if (msg.t !== "push" || msg.m !== "terminalOutput")
       flushOutput();
@@ -11133,11 +11213,11 @@ function serverConnection(duplex, opts) {
       raw(encodeControl(msg));
   }
   function close(why, back = false) {
-    if (!open2)
+    if (!open)
       return;
     if (why !== undefined)
       send({ t: "bye", why, ...back ? { back: true } : {} });
-    open2 = false;
+    open = false;
     stopWatching?.();
     stopWatching = null;
     stopCoalescing();
@@ -11176,7 +11256,7 @@ function serverConnection(duplex, opts) {
     heldBytes = 0;
   }
   function pushOutput(p) {
-    if (!open2)
+    if (!open)
       return;
     const bytes = fromBase64(p.dataB64);
     if (bytes.length === 0)
@@ -11244,18 +11324,18 @@ function serverConnection(duplex, opts) {
     heardFromClient = true;
     let frames;
     try {
-      frames = decoder2.push(chunk);
+      frames = decoder.push(chunk);
     } catch (err) {
       console.error("[wire]", err instanceof Error ? err.message : err);
       return close(err instanceof WireError ? err.message : "unreadable frame");
     }
-    for (const frame2 of frames) {
+    for (const frame of frames) {
       try {
-        if (frame2.type === 1) {
-          incoming.hold(frame2);
+        if (frame.type === 1) {
+          incoming.hold(frame);
           continue;
         }
-        handle(parseControl(frame2.text));
+        handle(parseControl(frame.text));
         if (!incoming.idle())
           throw new WireError("the peer sent bytes that no control frame claimed");
       } catch (err) {
@@ -11265,7 +11345,7 @@ function serverConnection(duplex, opts) {
     }
   };
   duplex.onClose = () => {
-    open2 = false;
+    open = false;
     stopWatching?.();
     stopWatching = null;
     stopCoalescing();
@@ -11436,13 +11516,13 @@ function createOpLog(opts) {
     }
   }
   return {
-    run(key2, exec) {
-      const hit = seen.get(key2);
+    run(key, exec) {
+      const hit = seen.get(key);
       if (hit)
         return hit.result;
       const result = exec();
       result.catch(() => {});
-      seen.set(key2, { at: now(), result });
+      seen.set(key, { at: now(), result });
       evict();
       return result;
     },
@@ -11451,7 +11531,7 @@ function createOpLog(opts) {
 }
 
 // src/shared/version.ts
-var BUILD_VERSION = "0.0.2";
+var BUILD_VERSION = "0.1.0";
 
 // src/bun/daemon.ts
 var SOCKET_PATH = join16(APP_HOME, ".server.sock");
@@ -11482,10 +11562,10 @@ async function startDaemon(opts = {}) {
   const ops = createOpLog();
   const instance = crypto.randomUUID();
   const server = await createServer({ push });
-  let idleTimer2 = null;
+  let idleTimer = null;
   let heldUntil = 0;
   let settleDone;
-  const done = new Promise((resolve11) => settleDone = resolve11);
+  const done = new Promise((resolve) => settleDone = resolve);
   let stopped = false;
   const listener = Bun.listen({
     unix: socketPath,
@@ -11530,9 +11610,9 @@ async function startDaemon(opts = {}) {
     console.error("[daemon] could not write the pid file:", err);
   }
   function accept(io) {
-    if (idleTimer2) {
-      clearTimeout(idleTimer2);
-      idleTimer2 = null;
+    if (idleTimer) {
+      clearTimeout(idleTimer);
+      idleTimer = null;
     }
     const greet = () => {
       const id = conn.client();
@@ -11562,15 +11642,15 @@ async function startDaemon(opts = {}) {
   }
   let leaving = false;
   function armIdleExit() {
-    if (stopped || idleTimer2 || leaving || idleMs <= 0)
+    if (stopped || idleTimer || leaving || idleMs <= 0)
       return;
     const held = server.sessionsOpen() ? heldUntil - Date.now() : 0;
     const wait = Math.max(idleMs, held);
     if (wait !== idleMs) {
       console.error(`[daemon] holding sessions for ${wait >= 1e4 ? `${Math.round(wait / 1000)}s` : `${wait}ms`}`);
     }
-    idleTimer2 = setTimeout(async () => {
-      idleTimer2 = null;
+    idleTimer = setTimeout(async () => {
+      idleTimer = null;
       if (clients.size > 0)
         return;
       if (server.running())
@@ -11614,8 +11694,8 @@ async function startDaemon(opts = {}) {
     if (stopped)
       return;
     stopped = true;
-    if (idleTimer2)
-      clearTimeout(idleTimer2);
+    if (idleTimer)
+      clearTimeout(idleTimer);
     for (const conn of accepted) {
       if (clients.get(conn.client()) === conn)
         conn.close("this server is shutting down", true);
@@ -11673,9 +11753,9 @@ async function tryConnect(socketPath) {
       socket: {
         data: (_s, chunk) => io?.feed(new Uint8Array(chunk)),
         drain: () => out?.drain(),
-        end: (s2) => {
+        end: (s) => {
           io?.finish();
-          s2.end();
+          s.end();
         },
         close: () => io?.finish(),
         error: () => io?.finish()
@@ -11722,7 +11802,7 @@ var reader = null;
 var pending = "";
 async function readLine() {
   reader ??= Bun.stdin.stream().getReader();
-  const decoder2 = new TextDecoder;
+  const decoder = new TextDecoder;
   for (;; ) {
     const nl = pending.indexOf(`
 `);
@@ -11737,7 +11817,7 @@ async function readLine() {
       pending = "";
       return line;
     }
-    pending += decoder2.decode(value, { stream: true });
+    pending += decoder.decode(value, { stream: true });
   }
 }
 async function readHidden() {
@@ -11779,9 +11859,9 @@ async function ask(question, o = {}) {
 // src/bun/backup.ts
 import { join as join17 } from "path";
 function backupSet(input) {
-  const { appHome, profilesDir, roots: roots2, secrets } = input;
+  const { appHome, profilesDir, roots, secrets } = input;
   const include = [appHome];
-  for (const root of roots2)
+  for (const root of roots)
     if (!isInside(appHome, root))
       include.push(root);
   if (secrets && !include.some((p) => isInside(p, profilesDir)))
@@ -11820,9 +11900,9 @@ function backupProfileText(vars) {
     `# RESTIC_PASSWORD is the only key to the backup. Keep a copy somewhere else.`,
     ``
   ];
-  for (const [key2, value] of Object.entries(vars)) {
+  for (const [key, value] of Object.entries(vars)) {
     const quoted = value !== value.trim() || /^["']/.test(value) ? `"${value.replace(/["\\]/g, "\\$&")}"` : value;
-    lines.push(`${key2}=${quoted}`);
+    lines.push(`${key}=${quoted}`);
   }
   lines.push(``);
   return lines.join(`
@@ -11860,7 +11940,7 @@ function versionAtLeast(version, min) {
 var BACKUP_EVERY_MS = 60 * 60 * 1000;
 var PRUNE_EVERY_MS = 24 * 60 * 60 * 1000;
 var IDLE_EXIT_MIN_GAP_MS = 10 * 60 * 1000;
-var KEEP = { hourly: 24, daily: 30, weekly: 12, monthly: 24 };
+var KEEP = { last: 10, hourly: 24, daily: 30, weekly: 12, monthly: 24 };
 var SNAPSHOT_TAG = "ledge";
 var EMPTY_STATE = {
   version: 1,
@@ -11881,7 +11961,7 @@ function parseState(text) {
     return {
       ...EMPTY_STATE,
       ...raw,
-      skipped: Array.isArray(raw.skipped) ? raw.skipped.filter((s2) => typeof s2?.root === "string" && typeof s2?.since === "string") : []
+      skipped: Array.isArray(raw.skipped) ? raw.skipped.filter((s) => typeof s?.root === "string" && typeof s?.since === "string") : []
     };
   } catch {
     return EMPTY_STATE;
@@ -11889,7 +11969,7 @@ function parseState(text) {
 }
 function recordRun(prev, o) {
   const at = o.at.toISOString();
-  const since = new Map(prev.skipped.map((s2) => [s2.root, s2.since]));
+  const since = new Map(prev.skipped.map((s) => [s.root, s.since]));
   return {
     version: 1,
     lastRun: at,
@@ -11911,6 +11991,9 @@ function isOverdue(state, now, every = BACKUP_EVERY_MS) {
 function pruneDue(state, now, every = PRUNE_EVERY_MS) {
   return !state.lastPrune || Date.parse(state.lastPrune) + every <= now.getTime();
 }
+function forgetDue(state) {
+  return state.lastSnapshot !== null;
+}
 function idleExitWorthIt(state, now, gap = IDLE_EXIT_MIN_GAP_MS) {
   return !state.lastOk || Date.parse(state.lastOk) + gap <= now.getTime();
 }
@@ -11932,6 +12015,8 @@ function forgetArgs(prune) {
     "forget",
     "--tag",
     SNAPSHOT_TAG,
+    "--keep-last",
+    String(KEEP.last),
     "--keep-hourly",
     String(KEEP.hourly),
     "--keep-daily",
@@ -11991,16 +12076,16 @@ function parseBackupOutput(stdout) {
 function parseSnapshots(stdout) {
   try {
     const raw = JSON.parse(stdout);
-    return raw.filter((s2) => typeof s2.short_id === "string" && typeof s2.time === "string").map((s2) => ({ short_id: s2.short_id, time: s2.time, hostname: s2.hostname ?? "", paths: s2.paths ?? [] }));
+    return raw.filter((s) => typeof s.short_id === "string" && typeof s.time === "string").map((s) => ({ short_id: s.short_id, time: s.time, hostname: s.hostname ?? "", paths: s.paths ?? [] }));
   } catch {
     return [];
   }
 }
-function statusLines(s2) {
+function statusLines(s) {
   const lines = [];
-  lines.push(`repository   ${s2.repository ?? "none: run `ledge backup setup`"}`);
-  lines.push(`restic       ${"path" in s2.restic ? `${s2.restic.version} at ${s2.restic.path}` : s2.restic.missing}`);
-  const { state, now } = s2;
+  lines.push(`repository   ${s.repository ?? "none: run `ledge backup setup`"}`);
+  lines.push(`restic       ${"path" in s.restic ? `${s.restic.version} at ${s.restic.path}` : s.restic.missing}`);
+  const { state, now } = s;
   if (!state.lastRun)
     lines.push(`last backup  never`);
   else if (state.lastOk === state.lastRun)
@@ -12009,17 +12094,17 @@ function statusLines(s2) {
     lines.push(`last backup  ${ago(state.lastRun, now)}, FAILED: ${state.lastError ?? "unknown"}`);
     lines.push(`last good    ${state.lastOk ? ago(state.lastOk, now) : "never"}`);
   }
-  if (s2.repository) {
-    lines.push(s2.daemonUp ? `next backup  ${nextDue(state, now).getTime() <= now.getTime() ? "due now" : `in ${duration(nextDue(state, now).getTime() - now.getTime())}`} (the server is running)` : `next backup  when the server next runs, and hourly while it does`);
+  if (s.repository) {
+    lines.push(s.daemonUp ? `next backup  ${nextDue(state, now).getTime() <= now.getTime() ? "due now" : `in ${duration(nextDue(state, now).getTime() - now.getTime())}`} (the server is running)` : `next backup  when the server next runs, and hourly while it does`);
   }
   for (const k of state.skipped)
     lines.push(`SKIPPED      ${k.root} (not on disk since ${ago(k.since, now)})`);
   return lines;
 }
-function ago(iso2, now) {
-  const ms = now.getTime() - Date.parse(iso2);
+function ago(iso, now) {
+  const ms = now.getTime() - Date.parse(iso);
   if (!Number.isFinite(ms))
-    return iso2;
+    return iso;
   if (ms < 60000)
     return "just now";
   return `${duration(ms)} ago`;
@@ -12069,16 +12154,16 @@ function fetchedResticPath(version = RESTIC_VERSION) {
 async function findRestic(opts = {}) {
   const onPath = Bun.which("restic", { PATH: process.env["PATH"] ?? "" });
   if (onPath) {
-    const version2 = await versionOf(onPath);
-    if (version2 && versionAtLeast(version2, RESTIC_MIN_VERSION))
-      return { path: onPath, version: version2 };
-    opts.log?.(`[backup] ${onPath} is restic ${version2 ?? "of an unknown version"}; ${RESTIC_MIN_VERSION} or newer is needed`);
+    const version = await versionOf(onPath);
+    if (version && versionAtLeast(version, RESTIC_MIN_VERSION))
+      return { path: onPath, version };
+    opts.log?.(`[backup] ${onPath} is restic ${version ?? "of an unknown version"}; ${RESTIC_MIN_VERSION} or newer is needed`);
   }
   const fetched = fetchedResticPath();
   if (existsSync2(fetched)) {
-    const version2 = await versionOf(fetched);
-    if (version2)
-      return { path: fetched, version: version2 };
+    const version = await versionOf(fetched);
+    if (version)
+      return { path: fetched, version };
   }
   if (!opts.fetch) {
     return { missing: onPath ? `restic on the PATH is too old and none has been fetched: run \`ledge backup setup\`` : "restic is not installed: run `ledge backup setup`" };
@@ -12247,7 +12332,8 @@ async function runBackup(o = { reason: "now" }) {
       const out = parseBackupOutput(backed.stdout);
       for (const e of out.errors)
         log(`[backup] restic: ${e}`);
-      const previous = readState().lastSnapshot;
+      const state = readState();
+      const previous = state.lastSnapshot;
       if (out.snapshot && previous && previous !== out.snapshot) {
         const diff = await runRestic(restic.path, diffArgs(previous, out.snapshot), env);
         if (diff.code === 0 && parseDiffChanges(diff.stdout) === 0) {
@@ -12258,9 +12344,12 @@ async function runBackup(o = { reason: "now" }) {
             out.snapshot = null;
         }
       }
-      const prune = pruneDue(readState(), at);
-      const forgot = await runRestic(restic.path, forgetArgs(prune), env);
-      if (forgot.code !== 0) {
+      const thin = forgetDue(state);
+      const prune = thin && pruneDue(state, at);
+      if (!thin)
+        log("[backup] the first backup from this machine: the snapshots already in the repository are left as they are");
+      const forgot = thin ? await runRestic(restic.path, forgetArgs(prune), env) : null;
+      if (forgot && forgot.code !== 0) {
         const error = `snapshot ${out.snapshot?.slice(0, 8) ?? "kept"}, but restic forget failed: ${resticSaid(forgot)}`;
         log(`[backup] ${error}`);
         writeState(recordRun(readState(), { at, ok: false, error, snapshot: out.snapshot, skipped }));
@@ -12421,14 +12510,14 @@ async function paths(args) {
 async function setup(args) {
   const existing = args.includes("--existing");
   const fromEnv = args.includes("--from-env");
-  const replace2 = args.includes("--replace");
+  const replace = args.includes("--replace");
   const repoFlag = valueOf(args, "--repository");
   if (!fromEnv && !process.stdin.isTTY) {
     say("ledge backup setup asks questions, and stdin is not a terminal. Pass --from-env with the variables set instead.");
     return 2;
   }
   const already = configured();
-  if (already && !replace2) {
+  if (already && !replace) {
     say(`Backups are already set up here, to ${already.repository}. \`ledge backup status\` shows how they are going; \`ledge backup setup --replace\` starts over.`);
     return 1;
   }
@@ -12483,33 +12572,54 @@ async function setup(args) {
       vars["RESTIC_PASSWORD"] = generated;
     }
   }
-  await writeProfile(BACKUP_PROFILE, backupProfileText(vars));
-  const read = readConfig();
-  if (!("config" in read)) {
-    say(`${PROFILE_PATH} is missing ${read.missing.join(", ")}`);
+  const proposed = parseBackupConfig(backupProfileText(vars));
+  if (!("config" in proposed)) {
+    say(`a backup needs ${proposed.missing.join(", ")}`);
     return 1;
   }
-  const env = resticEnv(read.config);
+  const env = resticEnv(proposed.config);
+  const unchanged = already ? `
+Nothing here changed: this machine still backs up to ${already.repository}.` : `
+Nothing was written.`;
   if (existing) {
-    say(`Opening ${read.config.repository}...`);
+    say(`Opening ${proposed.config.repository}...`);
     const r = await runRestic(restic.path, ["cat", "config"], env);
     if (r.code !== 0) {
-      say(`Could not open the repository: ${resticSaid(r)}
-The profile is written at ${PROFILE_PATH}; fix it and run setup again with --replace.`);
+      say(`Could not open the repository: ${resticSaid(r)}${unchanged}`);
       return 1;
     }
   } else {
-    say(`Creating the repository at ${read.config.repository}...`);
+    say(`Creating the repository at ${proposed.config.repository}...`);
     const r = await runRestic(restic.path, ["init"], env);
     if (r.code !== 0) {
       const said = resticSaid(r);
       const hint = /already (exists|initialized)/i.test(said) ? `
-That repository already has backups in it. Run setup again with --existing and its password.` : `
-The profile is written at ${PROFILE_PATH}; fix it and run setup again with --replace.`;
-      say(`Could not create the repository: ${said}${hint}`);
+That repository already has backups in it. Run setup again with --existing and its password.` : "";
+      say(`Could not create the repository: ${said}${hint}${unchanged}`);
       return 1;
     }
   }
+  await writeProfile(BACKUP_PROFILE, backupProfileText(vars));
+  if (existing) {
+    const listed = await listSnapshots();
+    say("");
+    if ("error" in listed)
+      say(`The repository opened, though its snapshots could not be listed: ${listed.error}`);
+    else if (listed.snapshots.length === 0)
+      say("The repository opened. It holds no snapshots yet.");
+    else {
+      const newest = listed.snapshots[0];
+      say(`The repository opened. Its newest snapshot is ${newest.short_id}, from ${snapshotTime(newest.time)}; \`ledge backup snapshots\` lists the rest.`);
+    }
+    say("");
+    say("Nothing has been backed up from this machine yet. To restore this machine, with the app quit or the daemon stopped:");
+    say("");
+    say("    ledge backup restore --in-place");
+    say("");
+    say("Backups run every hour while this machine's Ledge server is up, and once more before it exits.");
+    say(`The repository and its credentials are in ${PROFILE_PATH}, the "${BACKUP_PROFILE}" profile.`);
+    return 0;
+  }
   say("Taking the first backup...");
   await loadWorkspaces();
   const result = await runBackup({ log: say, reason: "setup" });
@@ -12522,10 +12632,11 @@ The profile is written at ${PROFILE_PATH}; fix it and run setup again with --rep
   say(`The repository and its credentials are in ${PROFILE_PATH}, the "${BACKUP_PROFILE}" profile.`);
   if (generated) {
     say("");
-    say("This is the password that encrypts the backup. Keep a copy somewhere that is not this machine:");
-    say("a restore starts on a machine with nothing on it, and a password stored only here is a backup you cannot open.");
-    say("");
+    process.stderr.write("SAVE THIS PASSWORD: ");
     out(generated);
+    say("");
+    say("It is the only key to the backup, and nothing can be restored without it.");
+    say("Keep a copy somewhere that is not this machine, such as a password manager.");
   }
   return 0;
 }
@@ -12565,10 +12676,13 @@ async function snapshots() {
     say("no snapshots yet");
     return 1;
   }
-  for (const s2 of r.snapshots)
-    out(`${s2.short_id}  ${s2.time.replace(/\.\d+/, "").replace("T", " ")}  ${s2.hostname}  ${s2.paths.length} path${s2.paths.length === 1 ? "" : "s"}`);
+  for (const s of r.snapshots)
+    out(`${s.short_id}  ${snapshotTime(s.time)}  ${s.hostname}  ${s.paths.length} path${s.paths.length === 1 ? "" : "s"}`);
   return 0;
 }
+function snapshotTime(time) {
+  return time.replace(/\.\d+/, "").replace("T", " ");
+}
 async function restore(args) {
   const config = configured();
   if (!config) {
@@ -13067,14 +13181,14 @@ function getTotalBits(segs, version) {
   }
   return result;
 }
-function toUtf8ByteArray(str2) {
-  str2 = encodeURI(str2);
+function toUtf8ByteArray(str) {
+  str = encodeURI(str);
   const result = [];
-  for (let i = 0;i < str2.length; i++) {
-    if (str2.charAt(i) !== "%") {
-      result.push(str2.charCodeAt(i));
+  for (let i = 0;i < str.length; i++) {
+    if (str.charAt(i) !== "%") {
+      result.push(str.charCodeAt(i));
     } else {
-      result.push(Number.parseInt(str2.substring(i + 1, i + 3), 16));
+      result.push(Number.parseInt(str.substring(i + 1, i + 3), 16));
       i += 2;
     }
   }
@@ -13294,7 +13408,7 @@ var KEYGEN_PATH = "/usr/bin/ssh-keygen";
 var HOST_KEY_DIR = "/etc/ssh";
 var FLAGS = ["user", "host", "port", "keys"];
 function parsePairArgs(args) {
-  const out2 = {};
+  const out = {};
   for (let i = 0;i < args.length; i++) {
     const arg = args[i];
     const eq = arg.indexOf("=");
@@ -13305,9 +13419,9 @@ function parsePairArgs(args) {
     const value = eq < 0 ? args[++i] : arg.slice(eq + 1);
     if (value === undefined || value === "")
       return { error: `--${flag} needs a value.` };
-    out2[flag] = value;
+    out[flag] = value;
   }
-  return out2;
+  return out;
 }
 function sshServerAddress(sshConnection) {
   const parts = (sshConnection ?? "").trim().split(/\s+/);
@@ -13347,24 +13461,24 @@ function sshClientAddress(sshConnection) {
 }
 var VIRTUAL_INTERFACE = /^(docker|br-|veth|virbr|lxc|lxd|cni|flannel|podman|vmnet|vboxnet)/;
 var NOTES = {
-  tailnetName: "this machine's tailnet name; a phone on the tailnet reaches it from anywhere",
-  tailnetAddress: "this machine's tailnet address; a phone on the tailnet reaches it from anywhere",
+  tailnetName: "this machine's tailnet name, reachable from anywhere on the tailnet",
+  tailnetAddress: "this machine's tailnet address, reachable from anywhere on the tailnet",
   ssh: "the address this ssh session reached",
-  sshInside: "the address this ssh session reached, inside a NAT the session came through; a phone outside needs the outside address",
+  sshInside: "the address this ssh session reached, inside a NAT the session came through; a device outside needs the outside address",
   cloud: "this machine's public address, from the cloud's metadata service",
   public: (name) => `the public address on ${name}`,
-  private: (name) => `the local network address on ${name}; a phone on that network reaches it`,
-  name: "this machine's name; a phone on the same network may resolve it"
+  private: (name) => `the local network address on ${name}`,
+  name: "this machine's name"
 };
 function addressCandidates(inputs) {
-  const out2 = [];
+  const out = [];
   const seen = new Set;
   const add = (host, source, note) => {
-    const key2 = host.toLowerCase();
-    if (host === "" || seen.has(key2))
+    const key = host.toLowerCase();
+    if (host === "" || seen.has(key))
       return;
-    seen.add(key2);
-    out2.push({ host, source, note });
+    seen.add(key);
+    out.push({ host, source, note });
   };
   if (inputs.tailnet?.name)
     add(inputs.tailnet.name, "tailnet", NOTES.tailnetName);
@@ -13392,18 +13506,18 @@ function addressCandidates(inputs) {
     if (addressKind(i.address) === "private")
       add(i.address, "interface", NOTES.private(i.name));
   add(inputs.hostname, "name", NOTES.name);
-  return out2;
+  return out;
 }
 function tailscaleSelf(json) {
-  let status2;
+  let status;
   try {
-    status2 = JSON.parse(json);
+    status = JSON.parse(json);
   } catch {
     return null;
   }
-  if (typeof status2 !== "object" || status2 === null)
+  if (typeof status !== "object" || status === null)
     return null;
-  const { BackendState, Self } = status2;
+  const { BackendState, Self } = status;
   if (BackendState !== "Running" || typeof Self !== "object" || Self === null)
     return null;
   const name = typeof Self.DNSName === "string" ? Self.DNSName.replace(/\.$/, "") : "";
@@ -13447,7 +13561,7 @@ function publicAddressAnswer(body) {
 }
 function candidateMenu(candidates) {
   const width = Math.max(...candidates.map((c) => c.host.length));
-  const lines = ["Which address should a phone dial?"];
+  const lines = ["Which address should Ledge on your other devices use to reach this server?"];
   candidates.forEach((c, i) => lines.push(`  ${String(i + 1).padStart(2)}  ${c.host.padEnd(width)}  ${c.note}`));
   return `${lines.join(`
 `)}
@@ -13484,7 +13598,7 @@ function pairAddress(args, sshConnection, candidates, answer) {
   } else {
     const pick = candidates[0];
     if (!pick)
-      return { error: "This machine has no address a phone could dial. Run again with --host." };
+      return { error: "This machine has no address to put in the code. Run again with --host." };
     ({ host, source, note } = pick);
   }
   if (args.port !== undefined) {
@@ -13553,14 +13667,14 @@ function othersNote(others) {
 function pairReport({ code, keys, note, columns }) {
   const link = pairingLink(code);
   const width = terminalQRWidth(link);
-  const out2 = [];
+  const out = [];
   if (columns !== undefined && columns < width) {
-    out2.push(`This terminal is ${columns} columns wide, and the code needs ${width}. Widen it and run pair again.`);
+    out.push(`This terminal is ${columns} columns wide, and the code needs ${width}. Widen it and run pair again.`);
   } else {
-    out2.push(...terminalQR(link));
+    out.push(...terminalQR(link));
   }
-  out2.push("", "Scan the code with Ledge on your phone. It names this server and its host keys, and holds no password or key.", "", `  Account    ${code.user}`, `  Host       ${code.host}${note === "" ? "" : ` (${note})`}`, `  Port       ${code.port === PORT_UNSET ? DEFAULT_PORT : code.port}`, ...keys.map((k, i) => `  ${i === 0 ? "Host keys" : "         "}  ${k.fingerprint} (${k.keyType})`), "", link);
-  return `${out2.join(`
+  out.push("", "Scan the code with Ledge on your phone, or paste the link below into the Mac app's Add Server form. It names this server and its host keys, and holds no password or key.", "", `  Account    ${code.user}`, `  Host       ${code.host}${note === "" ? "" : ` (${note})`}`, `  Port       ${code.port === PORT_UNSET ? DEFAULT_PORT : code.port}`, ...keys.map((k, i) => `  ${i === 0 ? "Host keys" : "         "}  ${k.fingerprint} (${k.keyType})`), "", link);
+  return `${out.join(`
 `)}
 `;
 }
@@ -13578,7 +13692,7 @@ async function serve2() {
   const upstream = await connectToDaemon();
   const mine = stdioDuplex();
   let over;
-  const done = new Promise((resolve11) => over = resolve11);
+  const done = new Promise((resolve) => over = resolve);
   let ended = false;
   const end = () => {
     if (ended)
@@ -13595,7 +13709,7 @@ async function serve2() {
   mine.onClose = end;
   console.error(`[serve] ledge ${BUILD_VERSION} attached to ${SOCKET_PATH}`);
   await done;
-  await new Promise((resolve11) => process.stdout.write("", () => resolve11()));
+  await new Promise((resolve) => process.stdout.write("", () => resolve()));
 }
 async function daemon(autostart = false) {
   const idleMs = autostart ? IDLE_EXIT_MS : IDLE_EXIT_NEVER;
@@ -13611,9 +13725,9 @@ async function daemon(autostart = false) {
   backups.stop();
 }
 async function pair(argv) {
-  const fail2 = (message, status2 = 1) => {
+  const fail = (message, status = 1) => {
     console.error(message);
-    return status2;
+    return status;
   };
   if (argv.includes("--help") || argv.includes("-h")) {
     process.stdout.write(`${PAIR_USAGE}
@@ -13622,12 +13736,12 @@ async function pair(argv) {
   }
   const args = parsePairArgs(argv.slice(3));
   if ("error" in args)
-    return fail2(`${args.error}
+    return fail(`${args.error}
 ${PAIR_USAGE}`, 2);
   if (existsSync3("/.dockerenv") || existsSync3("/run/.containerenv")) {
     const refusal = containerRefusal(args);
     if (refusal)
-      return fail2(refusal);
+      return fail(refusal);
   }
   const candidates = args.host === undefined ? await gatherCandidates() : [];
   const interactive = args.host === undefined && args.keys !== "-" && process.stdin.isTTY && process.stdout.isTTY;
@@ -13638,7 +13752,7 @@ ${PAIR_USAGE}`, 2);
   }
   const address = pairAddress(args, process.env.SSH_CONNECTION, candidates, answer);
   if ("error" in address)
-    return fail2(address.error, 2);
+    return fail(address.error, 2);
   if (!interactive)
     process.stderr.write(othersNote(candidates.filter((c) => c.host !== address.host)));
   let keyText = "";
@@ -13648,7 +13762,7 @@ ${PAIR_USAGE}`, 2);
     try {
       keyText = readFileSync4(args.keys, "utf8");
     } catch {
-      return fail2(`Could not read ${args.keys}.`);
+      return fail(`Could not read ${args.keys}.`);
     }
   } else {
     const files = existsSync3(HOST_KEY_DIR) ? readdirSync(HOST_KEY_DIR).filter((f) => /^ssh_host_\w+_key\.pub$/.test(f)) : [];
@@ -13659,7 +13773,7 @@ ${PAIR_USAGE}`, 2);
       } catch {}
     }
     if (keyText.trim() === "") {
-      return fail2(`There are no sshd host keys in ${HOST_KEY_DIR}. If sshd keeps them elsewhere, pass the .pub file with --keys.`);
+      return fail(`There are no sshd host keys in ${HOST_KEY_DIR}. If sshd keeps them elsewhere, pass the .pub file with --keys.`);
     }
   }
   let described;
@@ -13670,18 +13784,18 @@ ${PAIR_USAGE}`, 2);
     described = await new Response(p.stdout).text();
     await p.exited;
   } catch (err) {
-    return fail2(`Could not run ssh-keygen (${err instanceof Error ? err.message : String(err)}).`);
+    return fail(`Could not run ssh-keygen (${err instanceof Error ? err.message : String(err)}).`);
   }
   const keys = phoneHostKeys(described);
   if (keys.length === 0) {
     if (!described.includes("SHA256:"))
-      return fail2(`${args.keys === "-" ? "stdin" : args.keys ?? HOST_KEY_DIR} holds no public host keys.`);
-    return fail2(`None of these host keys is Ed25519 or ECDSA, and those are the kinds Ledge on a phone can check.
+      return fail(`${args.keys === "-" ? "stdin" : args.keys ?? HOST_KEY_DIR} holds no public host keys.`);
+    return fail(`None of these host keys is Ed25519 or ECDSA, and those are the kinds Ledge on a phone can check.
 ` + "`sudo ssh-keygen -A` creates the missing default keys. Restart sshd after it.");
   }
   const code = pairCode(args.user ?? userInfo().username, address, keys);
   if ("error" in code)
-    return fail2(code.error);
+    return fail(code.error);
   const columns = process.stdout.isTTY ? process.stdout.columns : undefined;
   process.stdout.write(pairReport({ code, keys, note: address.note, columns }));
   return 0;
@@ -13698,13 +13812,13 @@ async function gatherCandidates() {
 }
 var LOOKUP_MS = 1500;
 function dmi() {
-  const out2 = {};
+  const out = {};
   for (const field of DMI_FIELDS) {
     try {
-      out2[field] = readFileSync4(join20(DMI_DIR, field), "utf8");
+      out[field] = readFileSync4(join20(DMI_DIR, field), "utf8");
     } catch {}
   }
-  return out2;
+  return out;
 }
 async function tailnetSelf() {
   const path = TAILSCALE_PATHS.find((p) => existsSync3(p));
@@ -13744,8 +13858,8 @@ async function cloudAddress() {
 }
 var PAIR_USAGE = [
   "usage: ledge pair [--user NAME] [--host ADDRESS] [--port N] [--keys FILE]",
-  "  --user   the account a phone signs in as (default: whoever runs pair)",
-  "  --host   the name or IPv4 address a phone dials (default: a menu of this machine's addresses on a terminal,",
+  "  --user   the account Ledge signs in as (default: whoever runs pair)",
+  "  --host   the name or IPv4 address Ledge connects to (default: a menu of this machine's addresses on a terminal,",
   "           else the first of them: its tailnet name, this ssh session's address, its public address, its name)",
   "  --port   sshd's port (default: this ssh session's port, or 22)",
   "  --keys   public host keys to describe, - for stdin (default: /etc/ssh/ssh_host_*_key.pub)"
@@ -13775,8 +13889,8 @@ async function main(argv) {
 if (import.meta.main)
   await main(process.argv);
 export {
-  serve2 as serve,
-  pair,
+  daemon,
   main,
-  daemon
+  pair,
+  serve2 as serve
 };