pinomad 0.10.0 → 0.11.0

package/dist/chunk-greb3dp6.js

@@ -0,0 +1,22 @@
+#!/usr/bin/env node
+import {
+  joinServer,
+  main
+} from "./chunk-gtdpjqa3.js";
+import"./chunk-ncbqa8jk.js";
+import"./chunk-44pnts98.js";
+import"./chunk-t91zt5f0.js";
+import"./chunk-etf7ef97.js";
+import"./chunk-y127fe1a.js";
+import"./chunk-vvj9b1gc.js";
+import"./chunk-jt34g8st.js";
+import"./chunk-kzbzacz9.js";
+import"./chunk-xqycs43g.js";
+import"./chunk-pqe7q1s7.js";
+import"./chunk-ngf1zatm.js";
+import"./chunk-sd5fkxjj.js";
+import"./chunk-df32avw6.js";
+export {
+  main,
+  joinServer
+};

package/dist/chunk-gtdpjqa3.js

@@ -0,0 +1,317 @@
+import {
+  assertSecureServerOrigin,
+  isSecureServerOrigin,
+  probeServerAccounts,
+  runServerOperation
+} from "./chunk-ncbqa8jk.js";
+import {
+  constantValue,
+  openHostSettings
+} from "./chunk-44pnts98.js";
+import {
+  loadHostKey,
+  loadRelayKey
+} from "./chunk-t91zt5f0.js";
+import {
+  writeServerConfig
+} from "./chunk-etf7ef97.js";
+import {
+  relayHostId
+} from "./chunk-y127fe1a.js";
+import {
+  argValue,
+  installSpec,
+  restartService,
+  serviceManager,
+  withoutRelayArgs
+} from "./chunk-vvj9b1gc.js";
+import {
+  cleanHostName,
+  normalizeHostName
+} from "./chunk-pqe7q1s7.js";
+import {
+  DEFAULT_DATA_DIR
+} from "./chunk-ngf1zatm.js";
+import {
+  commandHint,
+  hostEntry
+} from "./chunk-sd5fkxjj.js";
+
+// apps/host/src/cli/join.ts
+import { mkdir } from "node:fs/promises";
+import { hostname } from "node:os";
+import { join, resolve as resolve2 } from "node:path";
+import { parseArgs } from "node:util";
+
+// apps/host/src/cli/host-link.ts
+import { spawn } from "node:child_process";
+import { arch, platform } from "node:os";
+var SLOW_DOWN_STEP_MS = 5000;
+var REQUEST_TIMEOUT_MS = 15000;
+var EXPIRY_GRACE_MS = 2 * 60000;
+function browserCommand(os, env) {
+  if (env.SSH_CONNECTION !== undefined || env.SSH_TTY !== undefined)
+    return;
+  if (os === "darwin")
+    return "open";
+  if (os === "linux" && (env.DISPLAY !== undefined || env.WAYLAND_DISPLAY !== undefined))
+    return "xdg-open";
+  return;
+}
+function openInBrowser(url) {
+  const command = browserCommand(process.platform, process.env);
+  if (command === undefined)
+    return false;
+  try {
+    const child = spawn(command, [url], { detached: true, stdio: "ignore" });
+    child.on("error", () => {});
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
+function hostOsLabel() {
+  const os = platform();
+  const name = os === "darwin" ? "macOS" : os === "linux" ? "Linux" : os === "win32" ? "Windows" : os;
+  return `${name} (${arch()})`;
+}
+var isRecord = (value) => typeof value === "object" && value !== null;
+var errorCode = (body) => isRecord(body) && typeof body.error === "string" ? body.error : undefined;
+async function requestJoinToken(args, deps) {
+  const fetchImpl = deps?.fetch ?? fetch;
+  const sleep = deps?.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const log = deps?.log ?? ((line) => console.log(line));
+  const now = deps?.now ?? Date.now;
+  const { origin } = args;
+  const timeoutMs = deps?.requestTimeoutMs ?? REQUEST_TIMEOUT_MS;
+  const post = async (path, payload) => {
+    const controller = new AbortController;
+    let timer;
+    const expired = new Promise((resolve) => {
+      timer = setTimeout(() => {
+        controller.abort();
+        resolve(undefined);
+      }, timeoutMs);
+    });
+    const attempt = (async () => {
+      const response = await fetchImpl(`${origin}${path}`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(payload),
+        redirect: "manual",
+        signal: controller.signal
+      });
+      const text = await response.text();
+      let body2;
+      try {
+        body2 = JSON.parse(text);
+      } catch {
+        body2 = undefined;
+      }
+      return { status: response.status, body: body2 };
+    })().catch(() => {
+      return;
+    });
+    try {
+      return await Promise.race([attempt, expired]);
+    } finally {
+      clearTimeout(timer);
+    }
+  };
+  const started = await post("/api/host-link/start", { hostId: args.hostId, name: args.name, os: args.os ?? hostOsLabel() });
+  if (started === undefined)
+    throw new Error(`cannot reach ${origin} — check the address and that the server is up`);
+  const { body } = started;
+  if (started.status !== 200) {
+    const code = errorCode(body);
+    if (started.status === 404) {
+      throw new Error(`${origin} can't confirm hosts in the browser yet — create a join token under "Add a host" and run the join command with it`);
+    }
+    if (code === "rate_limited")
+      throw new Error("too many join requests from this address — wait a few minutes and try again");
+    if (code === "busy")
+      throw new Error(`${origin} has too many hosts waiting to join right now — try again in a few minutes`);
+    throw new Error(`${origin} refused to start the join: ${code ?? `HTTP ${started.status}`}`);
+  }
+  if (!isRecord(body) || typeof body.deviceCode !== "string" || typeof body.userCode !== "string" || typeof body.verifyUrl !== "string" || typeof body.interval !== "number" || typeof body.expiresAt !== "number" || !isSecureServerOrigin(body.verifyUrl)) {
+    throw new Error(`${origin} answered the join request with something unexpected`);
+  }
+  const { deviceCode, userCode, verifyUrl, expiresAt } = body;
+  let intervalMs = Math.max(1, body.interval) * 1000;
+  const minutes = Math.max(1, Math.round((expiresAt - now()) / 60000));
+  log(`To add this host to your account on ${origin}:`);
+  log(`  1. Open ${verifyUrl} and sign in.`);
+  log(`  2. Enter this code: ${userCode}`);
+  log("");
+  log(`Only confirm it if you started this on ${args.name} (host id ${args.hostId}).`);
+  const opened = await Promise.resolve((deps?.openBrowser ?? openInBrowser)(verifyUrl)).catch(() => false);
+  log(`${opened ? "Opened the page in your browser. " : ""}Waiting for confirmation (the code expires in ${minutes} min)…`);
+  for (;; ) {
+    await sleep(intervalMs);
+    const response = await post("/api/host-link/poll", { deviceCode });
+    if (response === undefined || response.status >= 500) {
+      if (now() > expiresAt + EXPIRY_GRACE_MS) {
+        throw new Error(`the code expired before anyone confirmed it — run the command again for a new one`);
+      }
+      continue;
+    }
+    const answer = response.body;
+    if (response.status === 200 && isRecord(answer) && typeof answer.token === "string") {
+      log("Confirmed.");
+      return answer.token;
+    }
+    const code = response.status === 400 ? errorCode(answer) : undefined;
+    if (code === "access_denied")
+      throw new Error(`the join was denied on ${origin}`);
+    if (code === "expired_token")
+      throw new Error(`the code expired before anyone confirmed it — run the command again for a new one`);
+    if (code === "slow_down") {
+      const asked = isRecord(answer) && typeof answer.interval === "number" ? answer.interval * 1000 : 0;
+      intervalMs = Math.max(intervalMs + SLOW_DOWN_STEP_MS, asked);
+    } else if (code !== "authorization_pending") {
+      throw new Error(`${origin} refused the join: ${code ?? `HTTP ${response.status}`}`);
+    }
+  }
+}
+
+// apps/host/src/cli/service-slot.ts
+import { homedir } from "node:os";
+import { resolve } from "node:path";
+async function openServiceSlot(dataDir, manager) {
+  const state = await manager.state().catch(() => ({ installed: false, running: false, detail: "unknown" }));
+  const previous = state.installed ? await manager.read() : undefined;
+  if (previous !== undefined && resolve(previous.dataDir) !== dataDir) {
+    throw new Error(`the installed service uses a different data dir (${previous.dataDir}); ` + `run this again with --data-dir ${previous.dataDir} or uninstall the service first`);
+  }
+  return { dataDir, manager, state, previous };
+}
+async function writeService(slot, edit, options) {
+  const { dataDir, manager, previous } = slot;
+  const fresh = installSpec(["--data-dir", dataDir, ...edit([])], {
+    execPath: process.execPath,
+    env: process.env,
+    home: homedir(),
+    cwd: process.cwd(),
+    mainPath: hostEntry.script,
+    entryArgs: hostEntry.args
+  });
+  if (!slot.state.installed) {
+    await manager.install(fresh);
+    return "installed";
+  }
+  const spec = previous === undefined ? fresh : { ...previous, hostArgs: edit(previous.hostArgs) };
+  const same = previous !== undefined && spec.hostArgs.join("\x00") === previous.hostArgs.join("\x00");
+  if (same && !options.changed && slot.state.running)
+    return "unchanged";
+  const port = argValue(spec.hostArgs, "--port");
+  const code = await restartService({
+    force: false,
+    argv: ["--data-dir", dataDir, ...port === undefined ? [] : ["--url", `ws://127.0.0.1:${port}`]],
+    manager,
+    restart: async () => {
+      await manager.install(spec);
+    }
+  });
+  return code === 0 ? "updated" : "failed";
+}
+
+// apps/host/src/cli/join.ts
+var message = (error) => error instanceof Error ? error.message : String(error);
+async function joinServer(args, deps) {
+  const origin = args.origin.replace(/\/+$/, "");
+  const dataDir = resolve2(args.dataDir);
+  assertSecureServerOrigin(origin);
+  if (args.name !== undefined && cleanHostName(args.name) === "") {
+    throw new Error(`Invalid host name: ${JSON.stringify(args.name)}`);
+  }
+  await mkdir(dataDir, { recursive: true });
+  const signingKey = await loadRelayKey(dataDir);
+  const hostKey = await loadHostKey(dataDir);
+  const hostId = relayHostId(signingKey.publicKey);
+  const slot = await openServiceSlot(dataDir, deps?.manager ?? serviceManager());
+  const probe = await probeServerAccounts(origin, deps?.fetch);
+  if (probe === "unreachable")
+    throw new Error(`cannot reach ${origin} — check the address and that the server is up`);
+  if (probe === "disabled") {
+    throw new Error(`${origin} does not run server accounts — the server is too old or was started without a data dir`);
+  }
+  const settings = await openHostSettings({
+    path: join(dataDir, "settings.json"),
+    fallback: {
+      defaultModel: () => null,
+      defaultThinkingLevel: () => null,
+      steeringMode: () => "one-at-a-time",
+      followUpMode: () => "one-at-a-time"
+    },
+    models: constantValue([])
+  });
+  const current = settings.value;
+  const storedName = current.custom.includes("hostName") ? current.hostName : undefined;
+  const name = normalizeHostName(args.name ?? storedName ?? deps?.hostname ?? hostname());
+  const joinToken = args.token ?? await requestJoinToken({ origin, hostId, name }, deps);
+  const reply = await runServerOperation({
+    origin,
+    signingKey,
+    noisePublicKey: hostKey.publicKey,
+    op: "join",
+    joinToken,
+    name
+  });
+  if (reply.t === "refused") {
+    throw new Error(reply.reason === "expired_token" ? "the join token expired — generate a fresh one" : reply.reason === "invalid_token" ? "the join token is invalid or already spent — generate a fresh one" : `the server refused the join: ${reply.reason}`);
+  }
+  if (reply.t !== "joined")
+    throw new Error(`unexpected answer to join: ${reply.t}`);
+  const username = reply.username;
+  let service;
+  try {
+    await writeServerConfig(dataDir, { origin, username });
+    if (args.name !== undefined)
+      await settings.update({ hostName: args.name });
+    const edit = args.editHostArgs ?? ((hostArgs) => hostArgs);
+    service = await writeService(slot, (hostArgs) => edit(withoutRelayArgs(hostArgs)), { changed: true });
+  } catch (error) {
+    throw new Error(`joined ${username} at ${origin}, but local setup failed: ${message(error)}
+` + (args.token === undefined ? `run the command again and confirm the new code (re-joining the same host is safe)` : `generate a fresh join token and run the command again (re-joining the same host is safe)`));
+  }
+  return { hostId, username, origin, service };
+}
+async function main(argv, deps) {
+  const { values, positionals } = parseArgs({
+    args: [...argv],
+    allowPositionals: true,
+    options: { "data-dir": { type: "string" }, name: { type: "string" } }
+  });
+  const [origin, token] = positionals;
+  if (origin === undefined || positionals.length > 2) {
+    console.error(`usage: ${commandHint("join")} <server-origin> [join-token] [--data-dir DIR] [--name NAME]`);
+    console.error("       without a join token, confirm the printed code in the browser where you're signed in");
+    process.exit(1);
+  }
+  try {
+    const outcome = await joinServer({
+      origin,
+      ...token === undefined ? {} : { token },
+      dataDir: values["data-dir"] ?? DEFAULT_DATA_DIR,
+      ...values.name === undefined ? {} : { name: values.name }
+    }, deps);
+    console.log(`host id: ${outcome.hostId}`);
+    console.log(`joined ${outcome.username} at ${outcome.origin}`);
+    if (outcome.service === "installed")
+      console.log("service installed and started");
+    else if (outcome.service === "updated")
+      console.log("service definition updated; host restarted when idle");
+    else {
+      console.error("joined, but the service restart did not finish — check `service status`");
+      process.exitCode = 1;
+    }
+  } catch (error) {
+    console.error(message(error));
+    process.exitCode = 1;
+  }
+}
+if (false)
+  ;
+
+export { openServiceSlot, writeService, joinServer, main };

package/dist/chunk-h5q2y57m.js

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+import {
+  main,
+  reachabilityLine,
+  restartService,
+  versionLine
+} from "./chunk-vvj9b1gc.js";
+import"./chunk-jt34g8st.js";
+import"./chunk-kzbzacz9.js";
+import"./chunk-xqycs43g.js";
+import"./chunk-pqe7q1s7.js";
+import"./chunk-ngf1zatm.js";
+import"./chunk-sd5fkxjj.js";
+import"./chunk-df32avw6.js";
+export {
+  versionLine,
+  restartService,
+  reachabilityLine,
+  main
+};

package/dist/{chunk-4sepcfpy.js → chunk-jt34g8st.js}

@@ -15,7 +15,7 @@ import {
   organize,
   parseRtcMaxMessageSize,
   rtcSelectedPair
-} from "./chunk-jgd38rna.js";
+} from "./chunk-xqycs43g.js";
 import {
   SECURE_PROLOGUE,
   SecureSession,
@@ -24,7 +24,7 @@ import {
   initiateIK,
   isLoopbackUrl,
   parseEndpointSet
-} from "./chunk-sygeb9qb.js";
+} from "./chunk-pqe7q1s7.js";
 
 // packages/protocol/src/remote-durable.ts
 import { applyImmutable } from "@earendil-works/chord/delta";

package/dist/chunk-n1m1tjrk.js

@@ -0,0 +1,214 @@
+#!/usr/bin/env node
+import {
+  joinServer,
+  openServiceSlot,
+  writeService
+} from "./chunk-gtdpjqa3.js";
+import"./chunk-ncbqa8jk.js";
+import"./chunk-44pnts98.js";
+import"./chunk-t91zt5f0.js";
+import {
+  normalizeOrigin,
+  readServerConfig
+} from "./chunk-etf7ef97.js";
+import"./chunk-y127fe1a.js";
+import {
+  argValue,
+  serviceManager,
+  withoutArg,
+  withoutRelayArgs
+} from "./chunk-vvj9b1gc.js";
+import"./chunk-jt34g8st.js";
+import"./chunk-kzbzacz9.js";
+import"./chunk-xqycs43g.js";
+import"./chunk-pqe7q1s7.js";
+import {
+  DEFAULT_DATA_DIR
+} from "./chunk-ngf1zatm.js";
+import {
+  commandHint
+} from "./chunk-sd5fkxjj.js";
+import"./chunk-df32avw6.js";
+
+// apps/host/src/cli/up.ts
+import { resolve } from "node:path";
+import { createInterface } from "node:readline/promises";
+import { parseArgs } from "node:util";
+var OFFICIAL_SERVER_ORIGIN = "https://app.pinomad.si";
+var DEFAULT_REMOTE_PORT = "7422";
+var message = (error) => error instanceof Error ? error.message : String(error);
+function resolveReach(flags, current) {
+  if (flags.server === undefined && flags.lan === undefined)
+    return;
+  if (current !== undefined)
+    return { server: flags.server ?? current.server, lan: flags.lan ?? current.lan };
+  return { server: flags.server ?? !flags.lan, lan: flags.lan ?? !flags.server };
+}
+async function currentReach(dataDir, deps) {
+  const slot = await openServiceSlot(dataDir, deps?.manager ?? serviceManager());
+  const config = await readServerConfig(dataDir);
+  if (config === undefined && !slot.state.installed)
+    return;
+  return {
+    server: config !== undefined,
+    lan: argValue(slot.previous?.hostArgs ?? [], "--remote-port") !== undefined
+  };
+}
+function withLan(hostArgs, port) {
+  if (port === undefined)
+    return withoutArg(withoutArg(hostArgs, "--remote-port"), "--public-url");
+  if (argValue(hostArgs, "--remote-port") === port)
+    return hostArgs;
+  return [...withoutArg(hostArgs, "--remote-port"), "--remote-port", port];
+}
+async function upHost(args, deps) {
+  const dataDir = resolve(args.dataDir);
+  const { reach } = args;
+  if (!reach.server && !reach.lan)
+    throw new Error("nothing to set up: choose the server, the LAN, or both");
+  const port = args.remotePort;
+  if (port !== undefined && !(/^\d+$/.test(port) && Number(port) >= 1 && Number(port) <= 65535)) {
+    throw new Error(`--remote-port must be a port number from 1 to 65535, got ${port}`);
+  }
+  const manager = deps?.manager ?? serviceManager();
+  const slot = await openServiceSlot(dataDir, manager);
+  const config = await readServerConfig(dataDir);
+  const origin = normalizeOrigin(args.origin ?? config?.origin ?? OFFICIAL_SERVER_ORIGIN);
+  if (reach.server && config !== undefined && normalizeOrigin(config.origin) !== origin) {
+    throw new Error(`this host is joined to ${config.origin} — run \`${commandHint("leave")}\` first to join ${origin}, ` + `or leave out --origin to stay`);
+  }
+  const lanPort = reach.lan ? args.remotePort ?? argValue(slot.previous?.hostArgs ?? [], "--remote-port") ?? DEFAULT_REMOTE_PORT : undefined;
+  const lan = (hostArgs) => withLan(hostArgs, lanPort);
+  const notes = [];
+  if (reach.server && config === undefined) {
+    const joined = await joinServer({ origin, dataDir, editHostArgs: lan }, { ...deps, manager });
+    return {
+      joined: { origin: joined.origin, username: joined.username, fresh: true },
+      ...lanPort === undefined ? {} : { lanPort },
+      service: joined.service,
+      notes
+    };
+  }
+  const edit = reach.server ? (hostArgs) => lan(withoutRelayArgs(hostArgs)) : lan;
+  const service = await writeService(slot, edit, { changed: reach.server });
+  if (!reach.server && config !== undefined) {
+    notes.push(`still joined to ${config.origin} — run \`${commandHint("leave")}\` to leave it`);
+  }
+  return {
+    ...reach.server && config !== undefined ? { joined: { origin: config.origin, ...config.username === undefined ? {} : { username: config.username }, fresh: false } } : {},
+    ...lanPort === undefined ? {} : { lanPort },
+    service,
+    notes
+  };
+}
+async function askOnTerminal(question) {
+  const terminal = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    return await terminal.question(question);
+  } finally {
+    terminal.close();
+  }
+}
+var CHOICES = [
+  { server: true, lan: false },
+  { server: false, lan: true },
+  { server: true, lan: true }
+];
+async function askReach(origin, fallback, ask) {
+  const preset = CHOICES.findIndex((choice) => choice.server === fallback.server && choice.lan === fallback.lan) + 1;
+  let question = `How should your other devices reach this host?
+` + `  1) Through ${origin}: from anywhere, with push notifications
+` + `  2) Only on your local network and tailnet
+` + `  3) Both
+` + `Choose 1, 2 or 3 [${preset}]: `;
+  for (;; ) {
+    const answer = (await ask(question)).trim();
+    if (answer === "")
+      return CHOICES[preset - 1];
+    const picked = CHOICES[Number(answer) - 1];
+    if (/^[123]$/.test(answer) && picked !== undefined)
+      return picked;
+    question = "Choose 1, 2 or 3: ";
+  }
+}
+var FLAGS = `choose with flags:
+  --server [--origin URL]   through a PiNomad server (default ${OFFICIAL_SERVER_ORIGIN})
+  --lan [--remote-port N]   only on the local network and tailnet (default port ${DEFAULT_REMOTE_PORT})
+  --server --lan            both
+  --yes                     keep what this host has, or the server on a new host`;
+async function main(argv, deps) {
+  const { values } = parseArgs({
+    args: [...argv],
+    allowNegative: true,
+    options: {
+      server: { type: "boolean" },
+      lan: { type: "boolean" },
+      yes: { type: "boolean", short: "y" },
+      origin: { type: "string" },
+      "remote-port": { type: "string" },
+      "data-dir": { type: "string" }
+    }
+  });
+  const log = deps?.log ?? ((line) => console.log(line));
+  try {
+    const dataDir = resolve(values["data-dir"] ?? DEFAULT_DATA_DIR);
+    const origin = normalizeOrigin(values.origin ?? (await readServerConfig(dataDir))?.origin ?? OFFICIAL_SERVER_ORIGIN);
+    const current = await currentReach(dataDir, deps);
+    let reach = resolveReach({ server: values.server, lan: values.lan }, current);
+    if (reach === undefined) {
+      const fallback = current !== undefined && (current.server || current.lan) ? current : { server: true, lan: false };
+      if (values.yes === true) {
+        reach = fallback;
+      } else if (!(deps?.interactive ?? (process.stdin.isTTY && process.stdout.isTTY))) {
+        console.error(`${commandHint("up")}: no terminal to ask how other devices reach this host — ${FLAGS}`);
+        process.exitCode = 2;
+        return;
+      } else {
+        reach = await askReach(origin, fallback, deps?.ask ?? askOnTerminal);
+      }
+    }
+    if (!reach.server && !reach.lan) {
+      console.error(`${commandHint("up")}: neither the server nor the LAN would be on — ` + `\`${commandHint("service")} install\` runs a host only this machine can reach`);
+      process.exitCode = 2;
+      return;
+    }
+    const outcome = await upHost({
+      dataDir,
+      origin,
+      reach,
+      ...values["remote-port"] === undefined ? {} : { remotePort: values["remote-port"] }
+    }, deps);
+    if (outcome.joined !== undefined) {
+      const who = outcome.joined.username ?? "an account";
+      log(outcome.joined.fresh ? `joined ${who} at ${outcome.joined.origin}` : `already joined ${who} at ${outcome.joined.origin}`);
+      log(`Sign in at ${outcome.joined.origin} on your other devices; they pair with this host on their own.`);
+    }
+    if (outcome.lanPort !== undefined) {
+      log(`LAN and tailnet: port ${outcome.lanPort}. Pair a device with \`${commandHint("pair")}\`.`);
+    }
+    for (const note of outcome.notes)
+      log(`note: ${note}`);
+    if (outcome.service === "installed")
+      log("service installed and started");
+    else if (outcome.service === "updated")
+      log("service updated; host restarted when idle");
+    else if (outcome.service === "unchanged")
+      log("service already running with these settings");
+    else {
+      console.error(`the service restart did not finish — check \`${commandHint("status")}\``);
+      process.exitCode = 1;
+    }
+  } catch (error) {
+    console.error(message(error));
+    process.exitCode = 1;
+  }
+}
+if (false)
+  ;
+export {
+  upHost,
+  resolveReach,
+  main,
+  OFFICIAL_SERVER_ORIGIN,
+  DEFAULT_REMOTE_PORT
+};

package/dist/{chunk-4h7pkkzr.js → chunk-ncbqa8jk.js}

@@ -6,10 +6,10 @@ import {
   relayWsBase,
   signRelayChallenge,
   signRelayChallengeV2
-} from "./chunk-cx8k63by.js";
+} from "./chunk-y127fe1a.js";
 import {
   toBase64Url
-} from "./chunk-sygeb9qb.js";
+} from "./chunk-pqe7q1s7.js";
 
 // apps/host/src/cli/server-ops.ts
 import { WebSocket } from "ws";
@@ -130,4 +130,4 @@ async function runServerOperation(options) {
   });
 }
 
-export { assertSecureServerOrigin, probeServerAccounts, runServerOperation };
+export { isSecureServerOrigin, assertSecureServerOrigin, probeServerAccounts, runServerOperation };

package/dist/{chunk-sygeb9qb.js → chunk-pqe7q1s7.js}

@@ -427,4 +427,4 @@ function concatParts(parts) {
   return out;
 }
 
-export { ENDPOINT_SET_SCHEMA_VERSION, MAX_HOST_ENDPOINT_URL_LENGTH, isLoopbackUrl, parseEndpointSet, encodeEndpointSetParam, HOST_SETTING_KEYS, THINKING_LEVELS, isThinkingLevel, isQueueMode, HOST_NAME_MAX_UNITS, cleanHostName, normalizeHostName, generateKeyPair, keyPairFromPrivate, initiateIK, respondIK, SECURE_PROLOGUE, SIGNAL_PROLOGUE, encodeClientHello, encodeHostHello, decodeClientHello, decodeHostHello, toBase64Url, fromBase64Url, SecureSession };
+export { ENDPOINT_SET_SCHEMA_VERSION, MAX_HOST_ENDPOINT_URL_LENGTH, isLoopbackUrl, parseEndpointSet, encodeEndpointSetParam, generateKeyPair, keyPairFromPrivate, initiateIK, respondIK, SECURE_PROLOGUE, SIGNAL_PROLOGUE, encodeClientHello, encodeHostHello, decodeClientHello, decodeHostHello, toBase64Url, fromBase64Url, SecureSession, HOST_SETTING_KEYS, THINKING_LEVELS, isThinkingLevel, isQueueMode, HOST_NAME_MAX_UNITS, cleanHostName, normalizeHostName };

package/dist/{chunk-zehwx009.js → chunk-sd5fkxjj.js}

@@ -1,6 +1,6 @@
 // apps/host/src/distribution.ts
 import { fileURLToPath } from "node:url";
-var packagedVersion = "0.10.0";
+var packagedVersion = "0.11.0";
 var webRoot = fileURLToPath(new URL(packagedVersion === undefined ? "../../web/dist" : "../web/", import.meta.url));
 var hostEntry = packagedVersion === undefined ? { script: fileURLToPath(new URL("./main.ts", import.meta.url)), args: [] } : { script: fileURLToPath(new URL("./pinomad.js", import.meta.url)), args: ["host"] };
 var commandHint = (name) => packagedVersion === undefined ? `bun run ${name}` : `pinomad ${name}`;