pinomad 0.10.0 → 0.12.0

package/dist/{chunk-p978qj9m.js → chunk-mnmqyq7d.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   serveWebClient
-} from "./chunk-wb10efyq.js";
+} from "./chunk-445cevpm.js";
 import {
   RELAY_CLOSE,
   decodeHostToRelay,
@@ -9,14 +9,14 @@ import {
   relayWsBase,
   verifyRelayChallenge,
   verifyRelayChallengeV2
-} from "./chunk-cx8k63by.js";
+} from "./chunk-g3ahp7b9.js";
+import {
+  normalizeHostName
+} from "./chunk-pqe7q1s7.js";
 import {
   commandHint,
   webRoot
-} from "./chunk-zehwx009.js";
-import {
-  normalizeHostName
-} from "./chunk-sygeb9qb.js";
+} from "./chunk-7wj0jh3t.js";
 import"./chunk-df32avw6.js";
 
 // apps/server/src/main.ts
@@ -25,7 +25,7 @@ import { join as join2, resolve } from "node:path";
 import { parseArgs } from "node:util";
 
 // apps/server/src/accounts.ts
-import { createHash, randomBytes, scrypt, timingSafeEqual } from "node:crypto";
+import { createHash, randomBytes, randomInt, scrypt, timingSafeEqual } from "node:crypto";
 import { mkdir } from "node:fs/promises";
 import { join } from "node:path";
 import { DatabaseSync } from "node:sqlite";
@@ -58,9 +58,27 @@ async function lockDataDir(dir, options) {
 
 // apps/server/src/accounts.ts
 var DB_FILE = "server.sqlite";
-var SCHEMA_VERSION = 4;
+var SCHEMA_VERSION = 8;
 var SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000;
 var JOIN_TOKEN_TTL_MS = 10 * 60 * 1000;
+var USER_CODE_ALPHABET = "BCDFGHJKLMNPQRSTVWXZ";
+var USER_CODE_LENGTH = 8;
+var HOST_LINK_TTL_MS = JOIN_TOKEN_TTL_MS;
+var HOST_LINK_INTERVAL_S = 5;
+var HOST_LINK_CODE_TTL_MS = 2 * 60000;
+var SLOW_DOWN_STEP_S = 5;
+var POLL_SLACK_MS = 1000;
+var HOST_OS_MAX_CODEPOINTS = 64;
+function normalizeUserCode(input) {
+  const code = input.replace(/[\s-]/g, "").toUpperCase();
+  if (code.length !== USER_CODE_LENGTH)
+    return;
+  for (const letter of code)
+    if (!USER_CODE_ALPHABET.includes(letter))
+      return;
+  return code;
+}
+var formatUserCode = (code) => `${code.slice(0, 4)}-${code.slice(4)}`;
 var INVITE_TTL_MS = 7 * 24 * 60 * 60 * 1000;
 var SIGN_UP_USERNAME = /^[a-z0-9][a-z0-9._-]{1,31}$/;
 var PUSH_TOKEN_TTL_MS = 90 * 24 * 60 * 60 * 1000;
@@ -97,6 +115,11 @@ var MAX_USERNAME_CODEPOINTS = 254;
 var scryptAsync = promisify(scrypt);
 var DUMMY_HASH = `scrypt$${SCRYPT.N}$${SCRYPT.r}$${SCRYPT.p}$${"A".repeat(22)}$${"A".repeat(43)}`;
 var sha256Hex = (input) => createHash("sha256").update(input, "utf8").digest("hex");
+var safeEqual = (a, b) => {
+  const left = Buffer.from(a);
+  const right = Buffer.from(b);
+  return left.length === right.length && timingSafeEqual(left, right);
+};
 async function hashPassword(password) {
   const salt = randomBytes(SALT_LEN);
   const hash = await scryptAsync(password, salt, KEY_LEN, SCRYPT);
@@ -190,6 +213,64 @@ function migrate(db) {
   }
   if (version < 4)
     migrateTo4(db);
+  if (version < 5) {
+    db.exec(`
+      BEGIN;
+      ALTER TABLE push_tokens ADD COLUMN device_id INTEGER REFERENCES account_devices(id) ON DELETE SET NULL;
+      CREATE INDEX push_tokens_device ON push_tokens (device_id);
+      PRAGMA user_version = 5;
+      COMMIT;
+    `);
+  }
+  if (version < 6) {
+    db.exec(`
+      BEGIN;
+      CREATE TABLE host_link_requests (
+        device_code_hash TEXT PRIMARY KEY,
+        user_code_hash TEXT NOT NULL UNIQUE,
+        host_id TEXT NOT NULL,
+        host_name TEXT,
+        host_os TEXT,
+        source_ip TEXT,
+        state TEXT NOT NULL DEFAULT 'pending',
+        user_id INTEGER REFERENCES users(id) ON DELETE CASCADE,
+        interval_s INTEGER NOT NULL,
+        last_poll_at INTEGER,
+        created_at INTEGER NOT NULL,
+        expires_at INTEGER NOT NULL
+      );
+      CREATE INDEX host_link_requests_expiry ON host_link_requests (expires_at);
+      ALTER TABLE join_tokens ADD COLUMN host_id TEXT;
+      PRAGMA user_version = 6;
+      COMMIT;
+    `);
+  }
+  if (version < 7) {
+    db.exec(`
+      BEGIN;
+      CREATE TABLE removed_hosts (
+        host_id TEXT PRIMARY KEY,
+        removed_at INTEGER NOT NULL
+      );
+      PRAGMA user_version = 7;
+      COMMIT;
+    `);
+  }
+  if (version < 8) {
+    db.exec(`
+      BEGIN;
+      ALTER TABLE host_link_requests ADD COLUMN request_id_hash TEXT;
+      ALTER TABLE host_link_requests ADD COLUMN redirect_uri TEXT;
+      ALTER TABLE host_link_requests ADD COLUMN code_challenge TEXT;
+      ALTER TABLE host_link_requests ADD COLUMN client_state TEXT;
+      ALTER TABLE host_link_requests ADD COLUMN auth_code_hash TEXT;
+      ALTER TABLE host_link_requests ADD COLUMN auth_code_expires_at INTEGER;
+      CREATE UNIQUE INDEX host_link_requests_request_id ON host_link_requests (request_id_hash);
+      CREATE UNIQUE INDEX host_link_requests_auth_code ON host_link_requests (auth_code_hash);
+      PRAGMA user_version = 8;
+      COMMIT;
+    `);
+  }
 }
 function migrateTo4(db) {
   db.exec("BEGIN");
@@ -280,6 +361,12 @@ function migrateTo1(db) {
     COMMIT;
   `);
 }
+var loopbackRedirect = (redirectUri, params) => {
+  const url = new URL(redirectUri);
+  for (const [key, value] of Object.entries(params))
+    url.searchParams.set(key, value);
+  return url.toString();
+};
 
 class WindowedCounter {
   map = new Map;
@@ -386,6 +473,73 @@ async function openAccounts(options) {
   const gate = new ScryptGate(limits.scryptConcurrency, limits.scryptQueue);
   const ipAttempts = new WindowedCounter(limits.counterMaxEntries, now);
   const userFailures = new WindowedCounter(limits.counterMaxEntries, now);
+  const linkLimits = {
+    startMaxPerIp: options.hostLinkLimits?.startMaxPerIp ?? 10,
+    startWindowMs: options.hostLinkLimits?.startWindowMs ?? 10 * 60000,
+    maxPending: options.hostLinkLimits?.maxPending ?? 1000,
+    userMaxFailures: options.hostLinkLimits?.userMaxFailures ?? 10,
+    ipMaxFailures: options.hostLinkLimits?.ipMaxFailures ?? 30,
+    failureWindowMs: options.hostLinkLimits?.failureWindowMs ?? 15 * 60000,
+    counterMaxEntries: options.hostLinkLimits?.counterMaxEntries ?? 4096
+  };
+  const linkStarts = new WindowedCounter(linkLimits.counterMaxEntries, now);
+  const linkUserFailures = new WindowedCounter(linkLimits.counterMaxEntries, now);
+  const linkIpFailures = new WindowedCounter(linkLimits.counterMaxEntries, now);
+  const PENDING_SELECT = `SELECT host_id AS hostId, host_name AS name, host_os AS os, source_ip AS sourceIp, expires_at AS expiresAt,
+      redirect_uri AS redirectUri, client_state AS clientState FROM host_link_requests`;
+  const sweepExpired = () => {
+    const at = now();
+    db.prepare("DELETE FROM join_tokens WHERE expires_at <= ?").run(at);
+    db.prepare("DELETE FROM host_link_requests WHERE expires_at <= ?").run(at);
+  };
+  const mintJoinToken = (userId, hostId) => {
+    const token = randomBytes(32).toString("base64url");
+    const expiresAt = now() + JOIN_TOKEN_TTL_MS;
+    db.prepare("INSERT INTO join_tokens (token_hash, user_id, created_at, expires_at, host_id) VALUES (?, ?, ?, ?, ?)").run(sha256Hex(token), userId, now(), expiresAt, hostId);
+    return { token, expiresAt };
+  };
+  const pendingByRef = (userId, ref, ip) => {
+    if ("requestId" in ref) {
+      const hash = sha256Hex(ref.requestId);
+      const row2 = db.prepare(`${PENDING_SELECT} WHERE request_id_hash = ? AND state = 'pending' AND expires_at > ?`).get(hash, now());
+      return row2 === undefined ? "not_found" : { column: "request_id_hash", hash, row: row2 };
+    }
+    const { userCode } = ref;
+    const userKey = String(userId);
+    if (linkUserFailures.isOver(userKey, linkLimits.userMaxFailures) || linkIpFailures.isOver(ip, linkLimits.ipMaxFailures)) {
+      return "limited";
+    }
+    const code = normalizeUserCode(userCode);
+    const codeHash = code === undefined ? undefined : sha256Hex(code);
+    const row = codeHash === undefined ? undefined : db.prepare(`${PENDING_SELECT} WHERE user_code_hash = ? AND state = 'pending' AND expires_at > ?`).get(codeHash, now());
+    if (codeHash === undefined || row === undefined) {
+      linkUserFailures.bump(userKey, linkLimits.failureWindowMs);
+      linkIpFailures.bump(ip, linkLimits.failureWindowMs);
+      return "not_found";
+    }
+    return { column: "user_code_hash", hash: codeHash, row };
+  };
+  const settleHostLink = (args, state) => {
+    const found = pendingByRef(args.userId, args, args.ip);
+    if (found === "limited" || found === "not_found")
+      return { status: found };
+    const { column, hash, row } = found;
+    const at = now();
+    const loopback = row.redirectUri === null ? undefined : { redirectUri: row.redirectUri, state: row.clientState ?? "" };
+    if (loopback !== undefined && state === "denied") {
+      const dropped = db.prepare(`DELETE FROM host_link_requests WHERE ${column} = ? AND state = 'pending' AND expires_at > ?`).run(hash, at);
+      if (Number(dropped.changes) !== 1)
+        return { status: "not_found" };
+      return { status: "ok", redirect: loopbackRedirect(loopback.redirectUri, { error: "access_denied", state: loopback.state }) };
+    }
+    const code = loopback === undefined ? undefined : randomBytes(32).toString("base64url");
+    const settled = db.prepare(`UPDATE host_link_requests SET state = ?, user_id = ?, host_name = NULL, host_os = NULL, source_ip = NULL,
+           auth_code_hash = ?, auth_code_expires_at = ?
+         WHERE ${column} = ? AND state = 'pending' AND expires_at > ?`).run(state, state === "confirmed" ? args.userId : null, code === undefined ? null : sha256Hex(code), code === undefined ? null : at + HOST_LINK_CODE_TTL_MS, hash, at);
+    if (Number(settled.changes) !== 1)
+      return { status: "not_found" };
+    return loopback === undefined || code === undefined ? { status: "ok" } : { status: "ok", redirect: loopbackRedirect(loopback.redirectUri, { code, state: loopback.state }) };
+  };
   const deviceForSignIn = (userId, claim) => {
     const at = now();
     if (claim === undefined) {
@@ -411,6 +565,19 @@ async function openAccounts(options) {
   const sweepVouchings = () => {
     db.prepare("DELETE FROM vouchings WHERE public_key IS NULL AND expires_at <= ?").run(now() - ADMISSION_REPORT_GRACE_MS);
   };
+  const withdrawDevice = (deviceId) => {
+    const at = now();
+    sweepVouchings();
+    db.prepare("DELETE FROM sessions WHERE device_id = ?").run(deviceId);
+    db.prepare("DELETE FROM push_tokens WHERE device_id = ?").run(deviceId);
+    db.prepare("UPDATE account_devices SET kicked_at = ? WHERE id = ?").run(at, deviceId);
+    const hostIds = db.prepare("SELECT DISTINCT host_id AS hostId FROM vouchings WHERE device_id = ? AND public_key IS NOT NULL AND revoked_at IS NULL").all(deviceId).map((row) => row.hostId);
+    db.prepare(`INSERT OR IGNORE INTO pending_revocations (host_id, public_key, created_at)
+       SELECT host_id, public_key, ? FROM vouchings
+       WHERE device_id = ? AND public_key IS NOT NULL AND revoked_at IS NULL`).run(at, deviceId);
+    db.prepare("UPDATE vouchings SET revoked_at = ? WHERE device_id = ? AND revoked_at IS NULL").run(at, deviceId);
+    return hostIds;
+  };
   const currentHash = (userId) => db.prepare("SELECT password_hash AS passwordHash FROM users WHERE id = ?").get(userId)?.passwordHash;
   const checkPassword = async (userId, username, password) => {
     if (userFailures.isOver(username, limits.userMaxFailures))
@@ -549,8 +716,23 @@ async function openAccounts(options) {
         ...row.deviceId === null ? {} : { deviceId: row.deviceId }
       };
     },
-    logout(token) {
-      db.prepare("DELETE FROM sessions WHERE token_hash = ?").run(sha256Hex(token));
+    logout(token, options2) {
+      const tokenHash = sha256Hex(token);
+      if (options2?.revoke !== true) {
+        db.prepare("DELETE FROM sessions WHERE token_hash = ?").run(tokenHash);
+        return [];
+      }
+      db.exec("BEGIN IMMEDIATE");
+      try {
+        const session = db.prepare("SELECT device_id AS deviceId FROM sessions WHERE token_hash = ?").get(tokenHash);
+        db.prepare("DELETE FROM sessions WHERE token_hash = ?").run(tokenHash);
+        const hostIds = session?.deviceId == null ? [] : withdrawDevice(session.deviceId);
+        db.exec("COMMIT");
+        return hostIds;
+      } catch (error) {
+        db.exec("ROLLBACK");
+        throw error;
+      }
     },
     async changePassword({ userId, username, keepToken, currentPassword, newPassword }) {
       const length = [...newPassword].length;
@@ -622,13 +804,14 @@ async function openAccounts(options) {
       const row = db.prepare("SELECT user_id AS userId FROM hosts WHERE host_id = ?").get(hostId);
       return row?.userId;
     },
-    registerPushToken(userId, token, environment) {
+    registerPushToken(userId, token, environment, deviceId) {
       const at = now();
       db.exec("BEGIN");
       try {
         db.prepare("DELETE FROM push_tokens WHERE updated_at < ?").run(at - PUSH_TOKEN_TTL_MS);
-        db.prepare(`INSERT INTO push_tokens (token, environment, user_id, updated_at) VALUES (?, ?, ?, ?)
-           ON CONFLICT (token, environment) DO UPDATE SET user_id = excluded.user_id, updated_at = excluded.updated_at`).run(token.toLowerCase(), environment, userId, at);
+        db.prepare(`INSERT INTO push_tokens (token, environment, user_id, updated_at, device_id) VALUES (?, ?, ?, ?, ?)
+           ON CONFLICT (token, environment) DO UPDATE SET
+             user_id = excluded.user_id, updated_at = excluded.updated_at, device_id = excluded.device_id`).run(token.toLowerCase(), environment, userId, at, deviceId ?? null);
         db.prepare(`DELETE FROM push_tokens WHERE user_id = ? AND rowid NOT IN (
              SELECT rowid FROM push_tokens WHERE user_id = ? ORDER BY updated_at DESC LIMIT ?
            )`).run(userId, userId, MAX_PUSH_TOKENS_PER_USER);
@@ -649,22 +832,125 @@ async function openAccounts(options) {
       db.prepare("DELETE FROM push_tokens WHERE token = ? AND environment = ? AND updated_at < ?").run(token.toLowerCase(), environment, unregisteredAt);
     },
     createJoinToken(userId) {
-      db.prepare("DELETE FROM join_tokens WHERE expires_at <= ?").run(now());
-      const token = randomBytes(32).toString("base64url");
-      const expiresAt = now() + JOIN_TOKEN_TTL_MS;
-      db.prepare("INSERT INTO join_tokens (token_hash, user_id, created_at, expires_at) VALUES (?, ?, ?, ?)").run(sha256Hex(token), userId, now(), expiresAt);
-      return { token, expiresAt };
+      sweepExpired();
+      return mintJoinToken(userId, null);
     },
+    startHostLink({ hostId, name, os, ip, loopback }) {
+      if (linkStarts.hit(ip, linkLimits.startMaxPerIp, linkLimits.startWindowMs))
+        return { status: "limited" };
+      sweepExpired();
+      const live = db.prepare("SELECT COUNT(*) AS n FROM host_link_requests").get().n;
+      if (live >= linkLimits.maxPending)
+        return { status: "busy" };
+      const deviceCode = randomBytes(32).toString("base64url");
+      const at = now();
+      const expiresAt = at + HOST_LINK_TTL_MS;
+      const hostName = normalizeHostName(name);
+      const hostOs = [...os.trim()].slice(0, HOST_OS_MAX_CODEPOINTS).join("");
+      if (loopback !== undefined) {
+        const requestId = randomBytes(32).toString("base64url");
+        db.prepare(`INSERT INTO host_link_requests
+             (device_code_hash, user_code_hash, request_id_hash, redirect_uri, code_challenge, client_state,
+              host_id, host_name, host_os, source_ip, interval_s, created_at, expires_at)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(sha256Hex(randomBytes(32).toString("base64url")), sha256Hex(randomBytes(32).toString("base64url")), sha256Hex(requestId), loopback.redirectUri, loopback.codeChallenge, loopback.state, hostId, hostName, hostOs, ip, HOST_LINK_INTERVAL_S, at, expiresAt);
+        return { status: "ok", mode: "loopback", requestId, expiresAt };
+      }
+      const insert = db.prepare(`INSERT INTO host_link_requests
+           (device_code_hash, user_code_hash, host_id, host_name, host_os, source_ip, interval_s, created_at, expires_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`);
+      for (let attempt = 0;; attempt++) {
+        const code = Array.from({ length: USER_CODE_LENGTH }, () => USER_CODE_ALPHABET[randomInt(USER_CODE_ALPHABET.length)]).join("");
+        try {
+          insert.run(sha256Hex(deviceCode), sha256Hex(code), hostId, hostName, hostOs, ip, HOST_LINK_INTERVAL_S, at, expiresAt);
+          return { status: "ok", mode: "code", deviceCode, userCode: formatUserCode(code), expiresAt, interval: HOST_LINK_INTERVAL_S };
+        } catch (error) {
+          if (attempt >= 4 || !String(error).includes("UNIQUE"))
+            throw error;
+        }
+      }
+    },
+    pollHostLink(deviceCode) {
+      const deviceCodeHash = sha256Hex(deviceCode);
+      const at = now();
+      db.exec("BEGIN IMMEDIATE");
+      try {
+        const row = db.prepare(`SELECT host_id AS hostId, state, user_id AS userId, interval_s AS intervalS, last_poll_at AS lastPollAt, expires_at AS expiresAt
+             FROM host_link_requests WHERE device_code_hash = ?`).get(deviceCodeHash);
+        let result;
+        if (row === undefined || row.expiresAt <= at) {
+          db.prepare("DELETE FROM host_link_requests WHERE device_code_hash = ?").run(deviceCodeHash);
+          result = { status: "expired" };
+        } else if (row.lastPollAt !== null && at - row.lastPollAt < row.intervalS * 1000 - POLL_SLACK_MS) {
+          const interval = row.intervalS + SLOW_DOWN_STEP_S;
+          db.prepare("UPDATE host_link_requests SET interval_s = ?, last_poll_at = ? WHERE device_code_hash = ?").run(interval, at, deviceCodeHash);
+          result = { status: "slow_down", interval };
+        } else if (row.state === "pending") {
+          db.prepare("UPDATE host_link_requests SET last_poll_at = ? WHERE device_code_hash = ?").run(at, deviceCodeHash);
+          result = { status: "pending" };
+        } else {
+          db.prepare("DELETE FROM host_link_requests WHERE device_code_hash = ?").run(deviceCodeHash);
+          result = row.state === "confirmed" && row.userId !== null ? { status: "confirmed", ...mintJoinToken(row.userId, row.hostId) } : { status: "denied" };
+        }
+        db.exec("COMMIT");
+        return result;
+      } catch (error) {
+        db.exec("ROLLBACK");
+        throw error;
+      }
+    },
+    lookupHostLink(args) {
+      const { userId, ip } = args;
+      const found = pendingByRef(userId, args, ip);
+      if (found === "limited" || found === "not_found")
+        return { status: found };
+      const { row } = found;
+      return {
+        status: "ok",
+        request: {
+          hostId: row.hostId,
+          name: row.name ?? "",
+          os: row.os ?? "",
+          sourceIp: row.sourceIp ?? "",
+          ipDiffers: row.sourceIp !== ip,
+          expiresAt: row.expiresAt
+        }
+      };
+    },
+    confirmHostLink(args) {
+      return settleHostLink(args, "confirmed");
+    },
+    denyHostLink(args) {
+      return settleHostLink(args, "denied");
+    },
+    exchangeHostLinkCode(code, codeVerifier) {
+      const codeHash = sha256Hex(code);
+      const at = now();
+      db.exec("BEGIN IMMEDIATE");
+      try {
+        const row = db.prepare(`SELECT host_id AS hostId, user_id AS userId, code_challenge AS challenge, auth_code_expires_at AS codeExpiresAt
+             FROM host_link_requests WHERE auth_code_hash = ? AND state = 'confirmed'`).get(codeHash);
+        if (row !== undefined)
+          db.prepare("DELETE FROM host_link_requests WHERE auth_code_hash = ?").run(codeHash);
+        const valid = row !== undefined && row.userId !== null && row.challenge !== null && row.codeExpiresAt !== null && row.codeExpiresAt > at && safeEqual(createHash("sha256").update(codeVerifier).digest("base64url"), row.challenge);
+        const result = valid ? { status: "ok", ...mintJoinToken(row.userId, row.hostId) } : { status: "invalid" };
+        db.exec("COMMIT");
+        return result;
+      } catch (error) {
+        db.exec("ROLLBACK");
+        throw error;
+      }
+    },
+    sweepExpired,
     joinHost({ token, hostId, noisePublicKey, name }) {
       const tokenHash = sha256Hex(token);
       const at = now();
       db.exec("BEGIN");
       try {
-        const row = db.prepare("SELECT user_id AS userId, expires_at AS expiresAt, used_at AS usedAt FROM join_tokens WHERE token_hash = ?").get(tokenHash);
+        const row = db.prepare("SELECT user_id AS userId, expires_at AS expiresAt, used_at AS usedAt, host_id AS boundHostId FROM join_tokens WHERE token_hash = ?").get(tokenHash);
         let failure;
-        if (row === undefined || row.usedAt !== null)
+        if (row === undefined || row.usedAt !== null || row.boundHostId !== null && row.boundHostId !== hostId) {
           failure = "invalid_token";
-        else if (row.expiresAt <= at)
+        } else if (row.expiresAt <= at)
           failure = "expired_token";
         else {
           const consumed = db.prepare("UPDATE join_tokens SET used_at = ? WHERE token_hash = ? AND used_at IS NULL").run(at, tokenHash);
@@ -689,6 +975,7 @@ async function openAccounts(options) {
              name = excluded.name,
              joined_at = excluded.joined_at,
              last_seen_at = excluded.last_seen_at`).run(hostId, row.userId, noisePublicKey, hostName, at, at);
+        db.prepare("DELETE FROM removed_hosts WHERE host_id = ?").run(hostId);
         const user = db.prepare("SELECT username FROM users WHERE id = ?").get(row.userId);
         db.exec("COMMIT");
         return { status: "joined", username: user?.username ?? "unknown" };
@@ -700,6 +987,37 @@ async function openAccounts(options) {
     leaveHost(hostId) {
       return Number(db.prepare("DELETE FROM hosts WHERE host_id = ?").run(hostId).changes) > 0;
     },
+    async removeHost({ userId, username, password, hostId }) {
+      const owned = () => db.prepare("SELECT 1 AS x FROM hosts WHERE host_id = ? AND user_id = ?").get(hostId, userId) !== undefined;
+      if (!owned())
+        return { status: "refused", reason: "not_found" };
+      const checked = await checkPassword(userId, username, password);
+      if (checked === "limited")
+        return { status: "limited" };
+      if (checked === "wrong_password")
+        return { status: "refused", reason: "wrong_password" };
+      db.exec("BEGIN IMMEDIATE");
+      try {
+        if (currentHash(userId) !== checked.verifiedHash) {
+          db.exec("ROLLBACK");
+          return { status: "refused", reason: "wrong_password" };
+        }
+        if (!owned()) {
+          db.exec("ROLLBACK");
+          return { status: "refused", reason: "not_found" };
+        }
+        db.prepare("DELETE FROM hosts WHERE host_id = ?").run(hostId);
+        db.prepare("INSERT INTO removed_hosts (host_id, removed_at) VALUES (?, ?) ON CONFLICT(host_id) DO UPDATE SET removed_at = excluded.removed_at").run(hostId, now());
+        db.exec("COMMIT");
+        return { status: "ok" };
+      } catch (error) {
+        db.exec("ROLLBACK");
+        throw error;
+      }
+    },
+    wasRemoved(hostId) {
+      return db.prepare("SELECT 1 AS x FROM removed_hosts WHERE host_id = ?").get(hostId) !== undefined;
+    },
     listHosts(userId) {
       return db.prepare(`SELECT host_id AS hostId, user_id AS userId, noise_public_key AS noisePublicKey,
                     name, joined_at AS joinedAt, last_seen_at AS lastSeenAt, device_reports AS deviceReports
@@ -800,15 +1118,7 @@ async function openAccounts(options) {
           db.exec("ROLLBACK");
           return { status: "refused", reason: "not_found" };
         }
-        const at = now();
-        sweepVouchings();
-        db.prepare("DELETE FROM sessions WHERE device_id = ?").run(deviceId);
-        db.prepare("UPDATE account_devices SET kicked_at = ? WHERE id = ?").run(at, deviceId);
-        const hostIds = db.prepare("SELECT DISTINCT host_id AS hostId FROM vouchings WHERE device_id = ? AND public_key IS NOT NULL AND revoked_at IS NULL").all(deviceId).map((row) => row.hostId);
-        db.prepare(`INSERT OR IGNORE INTO pending_revocations (host_id, public_key, created_at)
-           SELECT host_id, public_key, ? FROM vouchings
-           WHERE device_id = ? AND public_key IS NOT NULL AND revoked_at IS NULL`).run(at, deviceId);
-        db.prepare("UPDATE vouchings SET revoked_at = ? WHERE device_id = ? AND revoked_at IS NULL").run(at, deviceId);
+        const hostIds = withdrawDevice(deviceId);
         db.exec("COMMIT");
         return { status: "ok", hostIds };
       } catch (error) {
@@ -831,6 +1141,7 @@ function dropCredentials(db, userId, keepTokenHash) {
   else
     db.prepare("DELETE FROM sessions WHERE user_id = ? AND token_hash <> ?").run(userId, keepTokenHash);
   db.prepare("DELETE FROM join_tokens WHERE user_id = ? AND used_at IS NULL").run(userId);
+  db.prepare("DELETE FROM host_link_requests WHERE user_id = ?").run(userId);
   db.prepare("DELETE FROM push_tokens WHERE user_id = ?").run(userId);
 }
 async function resetPassword(options) {
@@ -1229,6 +1540,28 @@ function createRelayLimiter(limits, now = Date.now) {
 
 // apps/server/src/api.ts
 var SESSION_COOKIE = "__Host-pinomad-session";
+var HOST_ID_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+var PKCE_CHALLENGE = /^[A-Za-z0-9_-]{43}$/;
+var PKCE_VERIFIER = /^[A-Za-z0-9._~-]{43,128}$/;
+var LOOPBACK_STATE = /^[A-Za-z0-9_-]{1,128}$/;
+var MAX_REDIRECT_URI = 256;
+function parseLoopback(value) {
+  const { redirectUri, codeChallenge, state } = value;
+  if (typeof redirectUri !== "string" || redirectUri.length > MAX_REDIRECT_URI)
+    return null;
+  if (typeof codeChallenge !== "string" || !PKCE_CHALLENGE.test(codeChallenge))
+    return null;
+  if (typeof state !== "string" || !LOOPBACK_STATE.test(state))
+    return null;
+  let url;
+  try {
+    url = new URL(redirectUri);
+  } catch {
+    return null;
+  }
+  const loopbackOnly = url.protocol === "http:" && url.hostname === "127.0.0.1" && url.port !== "" && url.username === "" && url.password === "" && url.search === "" && url.hash === "" && url.href === redirectUri;
+  return loopbackOnly ? { redirectUri, codeChallenge, state } : null;
+}
 var MAX_BODY = 8 * 1024;
 var MUTATING = new Set(["POST", "PUT", "PATCH", "DELETE"]);
 var DESKTOP_ORIGIN = "app://pinomad";
@@ -1254,7 +1587,7 @@ function respond(response, status, body, headers) {
   response.writeHead(status, all);
   response.end(body === undefined ? undefined : JSON.stringify(body));
 }
-async function readJson(request) {
+async function readJson(request, optional = false) {
   const chunks = [];
   let size = 0;
   let tooLarge = false;
@@ -1268,6 +1601,8 @@ async function readJson(request) {
   }
   if (tooLarge)
     return { ok: false, tooLarge: true };
+  if (optional && size === 0)
+    return { ok: true, value: undefined };
   try {
     return { ok: true, value: JSON.parse(Buffer.concat(chunks).toString("utf8")) };
   } catch {
@@ -1317,7 +1652,8 @@ async function handleApiRequest(request, response, ctx) {
   }
   const bearer = (request.headers.authorization ?? "").startsWith("Bearer ");
   const loginTokenMode = (pathname === "/api/login" || pathname === "/api/register") && (origin === undefined || origin === DESKTOP_ORIGIN);
-  if (MUTATING.has(method) && !bearer && !loginTokenMode && origin !== ctx.publicOrigin) {
+  const hostLinkHostMode = (pathname === "/api/host-link/start" || pathname === "/api/host-link/poll" || pathname === "/api/host-link/token") && origin === undefined;
+  if (MUTATING.has(method) && !bearer && !loginTokenMode && !hostLinkHostMode && origin !== ctx.publicOrigin) {
     deny(403, "origin_mismatch");
     return;
   }
@@ -1397,6 +1733,136 @@ async function handleApiRequest(request, response, ctx) {
     send(200, { user: { username }, expiresAt: result.expiresAt, ...cookieMode ? {} : { token: result.token } }, cookieMode ? { "set-cookie": setSessionCookie(result.token) } : undefined);
     return;
   }
+  if (pathname === "/api/host-link/start" || pathname === "/api/host-link/poll" || pathname === "/api/host-link/token") {
+    if (method !== "POST") {
+      deny(405, "method_not_allowed", { allow: "POST" });
+      return;
+    }
+    const body = await readJson(request);
+    if (!body.ok) {
+      deny(body.tooLarge ? 413 : 400, body.tooLarge ? "payload_too_large" : "invalid_json");
+      return;
+    }
+    if (pathname === "/api/host-link/start") {
+      const value = body.value;
+      const loopback = value?.redirectUri === undefined ? undefined : parseLoopback(value);
+      if (typeof value?.hostId !== "string" || !HOST_ID_PATTERN.test(value.hostId) || typeof value.name !== "string" || typeof value.os !== "string" || loopback === null) {
+        deny(400, "invalid_request");
+        return;
+      }
+      const result2 = accounts.startHostLink({
+        hostId: value.hostId,
+        name: value.name,
+        os: value.os,
+        ip: clientIp(request, ctx.trustProxy),
+        ...loopback === undefined ? {} : { loopback }
+      });
+      if (result2.status === "limited") {
+        deny(429, "rate_limited");
+        return;
+      }
+      if (result2.status === "busy") {
+        deny(503, "busy");
+        return;
+      }
+      if (result2.mode === "loopback") {
+        send(200, {
+          requestId: result2.requestId,
+          verifyUrl: `${ctx.publicOrigin}/host-link?request=${result2.requestId}`,
+          expiresAt: result2.expiresAt
+        });
+        return;
+      }
+      send(200, {
+        deviceCode: result2.deviceCode,
+        userCode: result2.userCode,
+        verifyUrl: `${ctx.publicOrigin}/host-link`,
+        interval: result2.interval,
+        expiresAt: result2.expiresAt
+      });
+      return;
+    }
+    if (pathname === "/api/host-link/token") {
+      const value = body.value;
+      if (typeof value?.code !== "string" || value.code.length > 256 || typeof value.codeVerifier !== "string" || !PKCE_VERIFIER.test(value.codeVerifier)) {
+        deny(400, "invalid_request");
+        return;
+      }
+      const result2 = accounts.exchangeHostLinkCode(value.code, value.codeVerifier);
+      if (result2.status === "invalid")
+        deny(400, "invalid_grant");
+      else
+        send(200, { token: result2.token, expiresAt: result2.expiresAt });
+      return;
+    }
+    const deviceCode = body.value?.deviceCode;
+    if (typeof deviceCode !== "string" || deviceCode.length > 256) {
+      deny(400, "invalid_request");
+      return;
+    }
+    const result = accounts.pollHostLink(deviceCode);
+    switch (result.status) {
+      case "confirmed":
+        send(200, { token: result.token, expiresAt: result.expiresAt });
+        return;
+      case "pending":
+        deny(400, "authorization_pending");
+        return;
+      case "slow_down":
+        send(400, { error: "slow_down", interval: result.interval });
+        return;
+      case "denied":
+        deny(400, "access_denied");
+        return;
+      case "expired":
+        deny(400, "expired_token");
+        return;
+    }
+  }
+  if (pathname === "/api/host-link/lookup" || pathname === "/api/host-link/confirm" || pathname === "/api/host-link/deny") {
+    if (method !== "POST") {
+      deny(405, "method_not_allowed", { allow: "POST" });
+      return;
+    }
+    const token = sessionToken(request);
+    if (token === undefined || accounts.authenticate(token) === undefined) {
+      deny(401, "unauthenticated");
+      return;
+    }
+    const body = await readJson(request);
+    if (!body.ok) {
+      deny(body.tooLarge ? 413 : 400, body.tooLarge ? "payload_too_large" : "invalid_json");
+      return;
+    }
+    const named = body.value;
+    const ref = typeof named?.userCode === "string" && named.userCode.length <= 64 && named.requestId === undefined ? { userCode: named.userCode } : typeof named?.requestId === "string" && named.requestId.length <= 64 && named.userCode === undefined ? { requestId: named.requestId } : undefined;
+    if (ref === undefined) {
+      deny(400, "invalid_request");
+      return;
+    }
+    const session = accounts.authenticate(token);
+    if (session === undefined) {
+      deny(401, "unauthenticated");
+      return;
+    }
+    const args = { userId: session.userId, ip: clientIp(request, ctx.trustProxy), ...ref };
+    const result = pathname === "/api/host-link/lookup" ? accounts.lookupHostLink(args) : pathname === "/api/host-link/confirm" ? accounts.confirmHostLink(args) : accounts.denyHostLink(args);
+    if (result.status === "limited") {
+      deny(429, "rate_limited");
+      return;
+    }
+    if (result.status === "not_found") {
+      deny(404, "not_found");
+      return;
+    }
+    if ("request" in result)
+      send(200, result.request);
+    else if (result.redirect !== undefined)
+      send(200, { redirect: result.redirect });
+    else
+      send(204);
+    return;
+  }
   if (pathname === "/api/invites" || pathname === "/api/invites/revoke") {
     const allowed = pathname === "/api/invites" ? ["GET", "POST"] : ["POST"];
     if (!allowed.includes(method)) {
@@ -1440,6 +1906,50 @@ async function handleApiRequest(request, response, ctx) {
       deny(404, "not_found");
     return;
   }
+  const hostRemove = /^\/api\/hosts\/([A-Za-z0-9_-]{43})\/remove$/.exec(pathname);
+  if (hostRemove !== null) {
+    if (method !== "POST") {
+      deny(405, "method_not_allowed", { allow: "POST" });
+      return;
+    }
+    const token = sessionToken(request);
+    if (token === undefined || accounts.authenticate(token) === undefined) {
+      deny(401, "unauthenticated");
+      return;
+    }
+    const body = await readJson(request);
+    if (!body.ok) {
+      deny(body.tooLarge ? 413 : 400, body.tooLarge ? "payload_too_large" : "invalid_json");
+      return;
+    }
+    const value = body.value;
+    if (typeof value?.password !== "string" || [...value.password].length > MAX_PASSWORD_CODEPOINTS) {
+      deny(400, "invalid_request");
+      return;
+    }
+    const current = accounts.authenticate(token);
+    if (current === undefined) {
+      deny(401, "unauthenticated");
+      return;
+    }
+    const result = await accounts.removeHost({
+      userId: current.userId,
+      username: current.username,
+      password: value.password,
+      hostId: hostRemove[1]
+    });
+    if (result.status === "limited") {
+      deny(429, "rate_limited");
+      return;
+    }
+    if (result.status === "refused") {
+      deny(result.reason === "not_found" ? 404 : 403, result.reason);
+      return;
+    }
+    ctx.disconnectHost(hostRemove[1], true);
+    send(204);
+    return;
+  }
   const hostPairing = /^\/api\/hosts\/([A-Za-z0-9_-]{43})\/pairing$/.exec(pathname);
   if (pathname === "/api/hosts" || hostPairing !== null) {
     const expected = pathname === "/api/hosts" ? "GET" : "POST";
@@ -1598,12 +2108,13 @@ async function handleApiRequest(request, response, ctx) {
         deny(400, "invalid_request");
         return;
       }
-      if (accounts.authenticate(token) === undefined) {
+      const current = accounts.authenticate(token);
+      if (current === undefined) {
         deny(401, "unauthenticated");
         return;
       }
       if (pathname === "/api/push-tokens")
-        accounts.registerPushToken(session.userId, apns, environment);
+        accounts.registerPushToken(session.userId, apns, environment, current.deviceId);
       else
         accounts.removePushToken(session.userId, apns, environment);
       send(204);
@@ -1669,12 +2180,24 @@ async function handleApiRequest(request, response, ctx) {
       send(200, {
         token: joinToken.token,
         expiresAt: joinToken.expiresAt,
-        command: `npm i -g pinomad && pinomad join ${ctx.publicOrigin} ${joinToken.token}`
+        command: `curl -fsSL https://pinomad.si/install.sh | sh -s -- join ${ctx.publicOrigin} ${joinToken.token}`
       });
       return;
     }
     if (pathname === "/api/logout") {
-      accounts.logout(token);
+      const body = await readJson(request, true);
+      if (!body.ok) {
+        deny(body.tooLarge ? 413 : 400, body.tooLarge ? "payload_too_large" : "invalid_json");
+        return;
+      }
+      const value = body.value;
+      const revoke = typeof value === "object" && value !== null ? value.revoke : undefined;
+      if (value === null || value !== undefined && typeof value !== "object" || revoke !== undefined && typeof revoke !== "boolean") {
+        deny(400, "invalid_request");
+        return;
+      }
+      for (const hostId of accounts.logout(token, { revoke: revoke === true }))
+        ctx.sendRevocations(hostId);
       send(204, undefined, { "set-cookie": clearSessionCookie });
       return;
     }
@@ -1805,8 +2328,8 @@ async function startRelay(options) {
     });
   }
   const pairing = { status: pairingStatus, request: requestPairing };
-  function disconnectHost(hostId) {
-    controls.get(hostId)?.socket.close(RELAY_CLOSE.hostNotAllowed);
+  function disconnectHost(hostId, removed = false) {
+    controls.get(hostId)?.socket.close(removed ? RELAY_CLOSE.hostRemoved : RELAY_CLOSE.hostNotAllowed);
     closeHostDevices(hostId, RELAY_CLOSE.hostNotAllowed, "host left its account");
   }
   function closeHostDevices(hostId, code, reason) {
@@ -1993,7 +2516,7 @@ async function startRelay(options) {
         return;
       }
       if (accounts?.hasHost(frame.hostId) !== true) {
-        socket.close(RELAY_CLOSE.hostNotAllowed);
+        socket.close(accounts?.wasRemoved(frame.hostId) === true ? RELAY_CLOSE.hostRemoved : RELAY_CLOSE.hostNotAllowed);
         return;
       }
       hostId = frame.hostId;
@@ -2192,6 +2715,9 @@ async function startRelay(options) {
         socket.terminate();
       }
     }
+    try {
+      accounts?.sweepExpired();
+    } catch {}
   }, pingIntervalMs);
   return {
     port,