pinomad 0.3.0 → 0.5.0

package/dist/chunk-4by4x5c4.js

@@ -0,0 +1,1376 @@
+#!/usr/bin/env node
+import {
+  serveWebClient
+} from "./chunk-r6w5aqkw.js";
+import {
+  RELAY_CLOSE,
+  decodeHostToRelay,
+  encodeRelayFrame,
+  relayWsBase,
+  verifyRelayChallenge,
+  verifyRelayChallengeV2
+} from "./chunk-kmbh44dt.js";
+import {
+  commandHint,
+  webRoot
+} from "./chunk-1d9sppj0.js";
+import"./chunk-df32avw6.js";
+
+// apps/server/src/main.ts
+import { homedir } from "node:os";
+import { join as join2, resolve } from "node:path";
+import { parseArgs } from "node:util";
+
+// apps/server/src/accounts.ts
+import { createHash, randomBytes, scrypt, timingSafeEqual } from "node:crypto";
+import { mkdir } from "node:fs/promises";
+import { join } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+import { promisify } from "node:util";
+
+// apps/server/src/lock.ts
+import lockfile from "proper-lockfile";
+async function lockDataDir(dir, options) {
+  const stale = Math.max(2000, options?.staleMs ?? 1e4);
+  let releasing = false;
+  const release = await lockfile.lock(dir, {
+    realpath: false,
+    stale,
+    retries: { retries: options?.retries ?? Math.ceil(stale / 1000) + 2, minTimeout: 1000, maxTimeout: 1000 },
+    onCompromised: (error) => {
+      if (!releasing)
+        throw error;
+    }
+  }).catch((error) => {
+    if (error.code !== "ELOCKED")
+      throw error;
+    throw new Error(`Data directory is already in use by a running process: ${dir}`, { cause: error });
+  });
+  return async () => {
+    releasing = true;
+    await release();
+  };
+}
+
+// apps/server/src/accounts.ts
+var DB_FILE = "server.sqlite";
+var SCHEMA_VERSION = 1;
+var SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+var JOIN_TOKEN_TTL_MS = 10 * 60 * 1000;
+var SCRYPT = { N: 16384, r: 8, p: 1 };
+var KEY_LEN = 32;
+var SALT_LEN = 16;
+var MIN_PASSWORD_CODEPOINTS = 12;
+var MAX_PASSWORD_CODEPOINTS = 1024;
+var MAX_USERNAME_CODEPOINTS = 254;
+var scryptAsync = promisify(scrypt);
+var DUMMY_HASH = `scrypt$${SCRYPT.N}$${SCRYPT.r}$${SCRYPT.p}$${"A".repeat(22)}$${"A".repeat(43)}`;
+var sha256Hex = (input) => createHash("sha256").update(input, "utf8").digest("hex");
+async function hashPassword(password) {
+  const salt = randomBytes(SALT_LEN);
+  const hash = await scryptAsync(password, salt, KEY_LEN, SCRYPT);
+  return `scrypt$${SCRYPT.N}$${SCRYPT.r}$${SCRYPT.p}$${salt.toString("base64url")}$${hash.toString("base64url")}`;
+}
+async function verifyPassword(password, stored) {
+  const parts = stored.split("$");
+  if (parts.length !== 6 || parts[0] !== "scrypt")
+    return false;
+  const [n, r, p] = [Number(parts[1]), Number(parts[2]), Number(parts[3])];
+  if (!Number.isSafeInteger(n) || !Number.isSafeInteger(r) || !Number.isSafeInteger(p))
+    return false;
+  if (n < 1024 || n > 1 << 20 || r < 1 || r > 32 || p < 1 || p > 16)
+    return false;
+  let salt, expected;
+  try {
+    salt = Buffer.from(parts[4], "base64url");
+    expected = Buffer.from(parts[5], "base64url");
+  } catch {
+    return false;
+  }
+  if (salt.length === 0 || expected.length === 0 || expected.length > 256)
+    return false;
+  const derived = await scryptAsync(password, salt, expected.length, { N: n, r, p });
+  return timingSafeEqual(derived, expected);
+}
+function assertPasswordPolicy(password) {
+  const length = [...password].length;
+  if (length < MIN_PASSWORD_CODEPOINTS || length > MAX_PASSWORD_CODEPOINTS) {
+    throw new Error(`password must be ${MIN_PASSWORD_CODEPOINTS}–${MAX_PASSWORD_CODEPOINTS} characters`);
+  }
+}
+function assertUsernamePolicy(username) {
+  const length = [...username].length;
+  if (length === 0 || length > MAX_USERNAME_CODEPOINTS) {
+    throw new Error(`username must be 1–${MAX_USERNAME_CODEPOINTS} characters`);
+  }
+}
+function migrate(db) {
+  db.exec("PRAGMA journal_mode = WAL");
+  db.exec("PRAGMA foreign_keys = ON");
+  const row = db.prepare("PRAGMA user_version").get();
+  const version = row?.user_version ?? 0;
+  if (version > SCHEMA_VERSION) {
+    throw new Error(`server database schema ${version} is newer than this build (${SCHEMA_VERSION})`);
+  }
+  if (version === SCHEMA_VERSION)
+    return;
+  db.exec(`
+    BEGIN;
+    CREATE TABLE users (
+      id INTEGER PRIMARY KEY,
+      username TEXT NOT NULL UNIQUE,
+      password_hash TEXT NOT NULL,
+      created_at INTEGER NOT NULL
+    );
+    CREATE TABLE sessions (
+      token_hash TEXT PRIMARY KEY,
+      user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+      created_at INTEGER NOT NULL,
+      expires_at INTEGER NOT NULL
+    );
+    CREATE TABLE join_tokens (
+      token_hash TEXT PRIMARY KEY,
+      user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+      created_at INTEGER NOT NULL,
+      expires_at INTEGER NOT NULL,
+      used_at INTEGER
+    );
+    CREATE TABLE hosts (
+      host_id TEXT PRIMARY KEY,
+      user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+      noise_public_key TEXT NOT NULL,
+      name TEXT NOT NULL,
+      joined_at INTEGER NOT NULL,
+      last_seen_at INTEGER NOT NULL
+    );
+    PRAGMA user_version = ${SCHEMA_VERSION};
+    COMMIT;
+  `);
+}
+
+class WindowedCounter {
+  map = new Map;
+  maxEntries;
+  now;
+  constructor(maxEntries, now) {
+    this.maxEntries = maxEntries;
+    this.now = now;
+  }
+  hit(key, max, windowMs) {
+    if (this.isOver(key, max))
+      return true;
+    this.bump(key, windowMs);
+    return false;
+  }
+  isOver(key, max) {
+    const entry = this.map.get(key);
+    return entry !== undefined && entry.resetAt > this.now() && entry.count >= max;
+  }
+  bump(key, windowMs) {
+    const now = this.now();
+    let entry = this.map.get(key);
+    if (entry === undefined || entry.resetAt <= now) {
+      entry = { count: 0, resetAt: now + windowMs };
+      this.map.delete(key);
+      if (this.map.size >= this.maxEntries) {
+        const oldest = this.map.keys().next();
+        if (!oldest.done)
+          this.map.delete(oldest.value);
+      }
+      this.map.set(key, entry);
+    }
+    entry.count += 1;
+  }
+  reset(key) {
+    this.map.delete(key);
+  }
+}
+
+class ScryptGate {
+  running = 0;
+  waiters = [];
+  concurrency;
+  maxQueue;
+  constructor(concurrency, maxQueue) {
+    this.concurrency = concurrency;
+    this.maxQueue = maxQueue;
+  }
+  run(task) {
+    if (this.running < this.concurrency) {
+      this.running += 1;
+      return this.finish(task());
+    }
+    if (this.waiters.length >= this.maxQueue)
+      return;
+    return new Promise((resolve, reject) => {
+      this.waiters.push(() => {
+        this.running += 1;
+        this.finish(task()).then(resolve, reject);
+      });
+    });
+  }
+  async finish(pending) {
+    try {
+      return await pending;
+    } finally {
+      this.running -= 1;
+      this.waiters.shift()?.();
+    }
+  }
+}
+async function openAccounts(options) {
+  const now = options.now ?? Date.now;
+  await mkdir(options.dataDir, { recursive: true });
+  const release = await lockDataDir(options.dataDir, { staleMs: options.lockStaleMs });
+  let db;
+  try {
+    db = new DatabaseSync(join(options.dataDir, DB_FILE));
+    migrate(db);
+    const userCount = db.prepare("SELECT COUNT(*) AS n FROM users").get().n;
+    if (userCount === 0) {
+      if (options.bootstrapUser === undefined || options.bootstrapPassword === undefined) {
+        throw new Error("PINOMAD_SERVER_USER and PINOMAD_SERVER_PASSWORD are required to create the first account");
+      }
+      assertUsernamePolicy(options.bootstrapUser);
+      assertPasswordPolicy(options.bootstrapPassword);
+      const hash = await hashPassword(options.bootstrapPassword);
+      db.prepare("INSERT INTO users (username, password_hash, created_at) VALUES (?, ?, ?)").run(options.bootstrapUser, hash, now());
+    }
+  } catch (error) {
+    db?.close();
+    await release();
+    throw error;
+  }
+  const limits = {
+    scryptConcurrency: options.limits?.scryptConcurrency ?? 4,
+    scryptQueue: options.limits?.scryptQueue ?? 64,
+    ipMaxAttempts: options.limits?.ipMaxAttempts ?? 30,
+    ipWindowMs: options.limits?.ipWindowMs ?? 5 * 60000,
+    userMaxFailures: options.limits?.userMaxFailures ?? 5,
+    userWindowMs: options.limits?.userWindowMs ?? 15 * 60000,
+    counterMaxEntries: options.limits?.counterMaxEntries ?? 4096
+  };
+  const gate = new ScryptGate(limits.scryptConcurrency, limits.scryptQueue);
+  const ipAttempts = new WindowedCounter(limits.counterMaxEntries, now);
+  const userFailures = new WindowedCounter(limits.counterMaxEntries, now);
+  return {
+    dbPath: join(options.dataDir, DB_FILE),
+    async login(username, password, ip) {
+      if (ipAttempts.hit(ip, limits.ipMaxAttempts, limits.ipWindowMs))
+        return { status: "limited" };
+      if (userFailures.isOver(username, limits.userMaxFailures))
+        return { status: "limited" };
+      const user = db.prepare("SELECT id, username, password_hash AS passwordHash FROM users WHERE username = ?").get(username);
+      const outcome = await gate.run(async () => {
+        if (userFailures.isOver(username, limits.userMaxFailures))
+          return "limited";
+        const ok = await verifyPassword(password, user?.passwordHash ?? DUMMY_HASH);
+        if (!ok || user === undefined) {
+          userFailures.bump(username, limits.userWindowMs);
+          return "invalid";
+        }
+        return user.id;
+      });
+      if (outcome === undefined || outcome === "limited")
+        return { status: "limited" };
+      if (outcome === "invalid")
+        return { status: "invalid" };
+      userFailures.reset(username);
+      db.prepare("DELETE FROM sessions WHERE expires_at <= ?").run(now());
+      const token = randomBytes(32).toString("base64url");
+      const expiresAt = now() + SESSION_TTL_MS;
+      db.prepare("INSERT INTO sessions (token_hash, user_id, created_at, expires_at) VALUES (?, ?, ?, ?)").run(sha256Hex(token), outcome, now(), expiresAt);
+      return { status: "ok", token, expiresAt };
+    },
+    authenticate(token) {
+      const row = db.prepare(`SELECT s.user_id AS userId, u.username AS username, s.expires_at AS expiresAt
+           FROM sessions s JOIN users u ON u.id = s.user_id WHERE s.token_hash = ?`).get(sha256Hex(token));
+      if (row === undefined || row.expiresAt <= now())
+        return;
+      return { userId: row.userId, username: row.username };
+    },
+    logout(token) {
+      db.prepare("DELETE FROM sessions WHERE token_hash = ?").run(sha256Hex(token));
+    },
+    revokeAllSessions(userId) {
+      db.prepare("DELETE FROM sessions WHERE user_id = ?").run(userId);
+    },
+    hasHost(hostId) {
+      return db.prepare("SELECT 1 AS x FROM hosts WHERE host_id = ?").get(hostId) !== undefined;
+    },
+    createJoinToken(userId) {
+      db.prepare("DELETE FROM join_tokens WHERE expires_at <= ?").run(now());
+      const token = randomBytes(32).toString("base64url");
+      const expiresAt = now() + JOIN_TOKEN_TTL_MS;
+      db.prepare("INSERT INTO join_tokens (token_hash, user_id, created_at, expires_at) VALUES (?, ?, ?, ?)").run(sha256Hex(token), userId, now(), expiresAt);
+      return { token, expiresAt };
+    },
+    joinHost({ token, hostId, noisePublicKey, name }) {
+      const tokenHash = sha256Hex(token);
+      const at = now();
+      db.exec("BEGIN");
+      try {
+        const row = db.prepare("SELECT user_id AS userId, expires_at AS expiresAt, used_at AS usedAt FROM join_tokens WHERE token_hash = ?").get(tokenHash);
+        let failure;
+        if (row === undefined || row.usedAt !== null)
+          failure = "invalid_token";
+        else if (row.expiresAt <= at)
+          failure = "expired_token";
+        else {
+          const consumed = db.prepare("UPDATE join_tokens SET used_at = ? WHERE token_hash = ? AND used_at IS NULL").run(at, tokenHash);
+          if (Number(consumed.changes) !== 1)
+            failure = "invalid_token";
+        }
+        if (failure !== undefined) {
+          db.exec("ROLLBACK");
+          return { status: "refused", reason: failure };
+        }
+        const hostName = name === undefined || name.trim() === "" ? "Unknown host" : name.trim().slice(0, 64);
+        db.prepare(`INSERT INTO hosts (host_id, user_id, noise_public_key, name, joined_at, last_seen_at)
+           VALUES (?, ?, ?, ?, ?, ?)
+           ON CONFLICT(host_id) DO UPDATE SET
+             user_id = excluded.user_id,
+             noise_public_key = excluded.noise_public_key,
+             name = excluded.name,
+             joined_at = excluded.joined_at,
+             last_seen_at = excluded.last_seen_at`).run(hostId, row.userId, noisePublicKey, hostName, at, at);
+        const user = db.prepare("SELECT username FROM users WHERE id = ?").get(row.userId);
+        db.exec("COMMIT");
+        return { status: "joined", username: user?.username ?? "unknown" };
+      } catch (error) {
+        db.exec("ROLLBACK");
+        throw error;
+      }
+    },
+    leaveHost(hostId) {
+      return Number(db.prepare("DELETE FROM hosts WHERE host_id = ?").run(hostId).changes) > 0;
+    },
+    listHosts(userId) {
+      return db.prepare(`SELECT host_id AS hostId, user_id AS userId, noise_public_key AS noisePublicKey,
+                  name, joined_at AS joinedAt, last_seen_at AS lastSeenAt
+           FROM hosts WHERE user_id = ? ORDER BY joined_at`).all(userId);
+    },
+    hostFor(userId, hostId) {
+      return db.prepare(`SELECT host_id AS hostId, user_id AS userId, noise_public_key AS noisePublicKey,
+                  name, joined_at AS joinedAt, last_seen_at AS lastSeenAt
+           FROM hosts WHERE user_id = ? AND host_id = ?`).get(userId, hostId);
+    },
+    markHostSeen(hostId) {
+      db.prepare("UPDATE hosts SET last_seen_at = ? WHERE host_id = ?").run(now(), hostId);
+    },
+    async close() {
+      db.close();
+      await release();
+    }
+  };
+}
+async function changePassword(options) {
+  assertPasswordPolicy(options.password);
+  await mkdir(options.dataDir, { recursive: true });
+  const release = await lockDataDir(options.dataDir, { retries: 0 });
+  const db = new DatabaseSync(join(options.dataDir, DB_FILE));
+  try {
+    migrate(db);
+    const users = options.user === undefined ? db.prepare("SELECT id FROM users").all() : db.prepare("SELECT id FROM users WHERE username = ?").all(options.user);
+    if (users.length === 0)
+      throw new Error(options.user === undefined ? "no account exists yet" : `no such account: ${options.user}`);
+    if (users.length > 1)
+      throw new Error("more than one account exists — pass --user");
+    const userId = users[0].id;
+    const hash = await hashPassword(options.password);
+    db.exec("BEGIN");
+    try {
+      db.prepare("UPDATE users SET password_hash = ? WHERE id = ?").run(hash, userId);
+      db.prepare("DELETE FROM sessions WHERE user_id = ?").run(userId);
+      db.prepare("DELETE FROM join_tokens WHERE user_id = ? AND used_at IS NULL").run(userId);
+      db.exec("COMMIT");
+    } catch (error) {
+      db.exec("ROLLBACK");
+      throw error;
+    }
+  } finally {
+    db.close();
+    await release();
+  }
+}
+
+// apps/server/src/apns.ts
+import { createPrivateKey, sign } from "node:crypto";
+import { connect } from "node:http2";
+var AUTHORITIES = {
+  production: "https://api.push.apple.com",
+  development: "https://api.sandbox.push.apple.com"
+};
+var PAYLOAD_MAX_BYTES = 4096;
+var EXPIRATION_SECONDS = 3600;
+var TOKEN_REFRESH_MS = 45 * 60 * 1000;
+var REQUEST_TIMEOUT_MS = 8000;
+var SERVER_ERROR_RETRY_MS = 15 * 60 * 1000;
+var base64url = (text) => Buffer.from(text, "utf8").toString("base64url");
+function loadApnsConfig(env = process.env) {
+  const teamId = env.PINOMAD_SERVER_APNS_TEAM_ID?.trim();
+  const topic = env.PINOMAD_SERVER_APNS_TOPIC?.trim();
+  if (teamId === undefined || teamId === "" || topic === undefined || topic === "")
+    return;
+  const loadEnv = (name) => {
+    const keyId = env[`PINOMAD_SERVER_APNS_${name}_KEY_ID`]?.trim();
+    const keyPem = env[`PINOMAD_SERVER_APNS_${name}_KEY`]?.replace(/\\n/g, `
+`).trim();
+    if (keyId === undefined && keyPem === undefined)
+      return;
+    if (keyId === undefined || keyId === "" || keyPem === undefined || keyPem === "") {
+      console.error(`apns: PINOMAD_SERVER_APNS_${name}_KEY and _KEY_ID must both be set — environment disabled`);
+      return;
+    }
+    return { keyId, keyPem };
+  };
+  const production = loadEnv("PRODUCTION");
+  const development = loadEnv("DEVELOPMENT");
+  return {
+    teamId,
+    topic,
+    environments: {
+      ...production === undefined ? {} : { production },
+      ...development === undefined ? {} : { development }
+    }
+  };
+}
+function providerToken(key, keyId, teamId, iatSeconds) {
+  const signingInput = `${base64url(JSON.stringify({ alg: "ES256", kid: keyId }))}.${base64url(JSON.stringify({ iss: teamId, iat: iatSeconds }))}`;
+  const signature = sign("sha256", Buffer.from(signingInput, "utf8"), { key, dsaEncoding: "ieee-p1363" });
+  return `${signingInput}.${signature.toString("base64url")}`;
+}
+function openApns(config) {
+  const states = new Map;
+  for (const environment of ["production", "development"]) {
+    const env = config.environments[environment];
+    if (env === undefined)
+      continue;
+    try {
+      states.set(environment, {
+        key: createPrivateKey(env.keyPem),
+        keyId: env.keyId,
+        authority: env.authority ?? AUTHORITIES[environment]
+      });
+    } catch {
+      console.error(`apns: the ${environment} key is not a valid EC private key — environment disabled`);
+    }
+  }
+  const environments = [...states.keys()];
+  const bearerFor = (state) => {
+    const now = Date.now();
+    if (state.token !== undefined && now - state.token.issuedAt < TOKEN_REFRESH_MS)
+      return state.token.jwt;
+    const jwt = providerToken(state.key, state.keyId, config.teamId, Math.floor(now / 1000));
+    state.token = { jwt, issuedAt: now };
+    return jwt;
+  };
+  const sessionFor = (environment, state) => {
+    const existing = state.session;
+    if (existing !== undefined && !existing.destroyed && !existing.closed)
+      return existing;
+    const session = connect(state.authority);
+    const drop = () => {
+      if (state.session === session)
+        state.session = undefined;
+      if (!session.destroyed)
+        session.destroy();
+    };
+    session.once("goaway", drop);
+    session.once("error", drop);
+    session.once("close", () => {
+      if (state.session === session)
+        state.session = undefined;
+    });
+    state.session = session;
+    return session;
+  };
+  const payloadFor = (notification) => JSON.stringify({
+    aps: {
+      alert: { title: notification.title, body: notification.body },
+      sound: "default",
+      "thread-id": notification.collapseId
+    },
+    hostKey: notification.hostKey,
+    conversationId: notification.conversationId
+  });
+  const classify = (environment, status, headers, body, state) => {
+    const reason = typeof body?.reason === "string" ? body.reason : `HTTP ${status}`;
+    const timestamp = body?.timestamp;
+    if (status === 200)
+      return { result: "accepted", reason: "ok" };
+    if (status === 410) {
+      return {
+        result: "unregistered",
+        reason,
+        unregisteredAt: typeof timestamp === "number" ? timestamp : Date.now()
+      };
+    }
+    if (status === 403 && reason === "ExpiredProviderToken") {
+      state.token = undefined;
+      return { result: "retry", reason };
+    }
+    if (reason === "InvalidProviderToken" || reason === "TooManyProviderTokenUpdates") {
+      console.error(`apns: provider token problem for ${environment}: ${reason}`);
+      return { result: "rejected", reason };
+    }
+    if (status === 429) {
+      const retryAfter = Number(headers["retry-after"]);
+      return {
+        result: "retry",
+        reason,
+        ...Number.isFinite(retryAfter) && retryAfter > 0 ? { retryAfterMs: retryAfter * 1000 } : {}
+      };
+    }
+    if (status >= 500)
+      return { result: "retry", reason, retryAfterMs: SERVER_ERROR_RETRY_MS };
+    return { result: "rejected", reason };
+  };
+  return {
+    environments,
+    async send(request) {
+      const state = states.get(request.environment);
+      if (state === undefined)
+        return { result: "unavailable", reason: "environment not configured" };
+      const body = payloadFor(request.notification);
+      if (Buffer.byteLength(body, "utf8") > PAYLOAD_MAX_BYTES) {
+        return { result: "rejected", reason: "PayloadTooLarge" };
+      }
+      return await new Promise((resolve) => {
+        let session;
+        try {
+          session = sessionFor(request.environment, state);
+        } catch {
+          resolve({ result: "retry", reason: "session unavailable" });
+          return;
+        }
+        let stream;
+        try {
+          stream = session.request({
+            ":method": "POST",
+            ":path": `/3/device/${request.token}`,
+            authorization: `bearer ${bearerFor(state)}`,
+            "apns-push-type": "alert",
+            "apns-topic": config.topic,
+            "apns-expiration": String(Math.floor(Date.now() / 1000) + EXPIRATION_SECONDS),
+            "apns-collapse-id": request.notification.collapseId,
+            "content-type": "application/json"
+          });
+        } catch {
+          resolve({ result: "retry", reason: "session unavailable" });
+          return;
+        }
+        let status = 0;
+        let responseHeaders = {};
+        const chunks = [];
+        let settled = false;
+        const finish = (verdict) => {
+          if (settled)
+            return;
+          settled = true;
+          clearTimeout(timer);
+          stream.destroy();
+          resolve(verdict);
+        };
+        const timer = setTimeout(() => finish({ result: "retry", reason: "apns timeout" }), REQUEST_TIMEOUT_MS);
+        stream.on("response", (headers) => {
+          status = Number(headers[":status"] ?? 0);
+          responseHeaders = headers;
+        });
+        stream.on("data", (chunk) => chunks.push(chunk));
+        stream.on("end", () => {
+          let body2;
+          try {
+            body2 = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+          } catch {
+            body2 = undefined;
+          }
+          finish(classify(request.environment, status, responseHeaders, body2, state));
+        });
+        stream.on("error", () => finish({ result: "retry", reason: "connection error" }));
+        stream.on("aborted", () => finish({ result: "retry", reason: "connection aborted" }));
+        stream.end(body);
+      });
+    },
+    close() {
+      for (const state of states.values())
+        state.session?.destroy();
+      states.clear();
+      return Promise.resolve();
+    }
+  };
+}
+
+// apps/server/src/relay.ts
+import { randomBytes as randomBytes2 } from "node:crypto";
+import { once } from "node:events";
+import { createServer } from "node:http";
+import { WebSocket, WebSocketServer } from "ws";
+
+// apps/server/src/api.ts
+var SESSION_COOKIE = "__Host-pinomad-session";
+var MAX_BODY = 8 * 1024;
+var MUTATING = new Set(["POST", "PUT", "PATCH", "DELETE"]);
+var DESKTOP_ORIGIN = "app://pinomad";
+var isLoopback = (address) => address !== undefined && (address.startsWith("127.") || address === "::1" || address.startsWith("::ffff:127."));
+function secureTransport(request, trustProxy) {
+  if (trustProxy)
+    return request.headers["x-forwarded-proto"] === "https";
+  return isLoopback(request.socket.remoteAddress);
+}
+function clientIp(request, trustProxy) {
+  if (trustProxy) {
+    const forwarded = request.headers["x-forwarded-for"];
+    const first = (Array.isArray(forwarded) ? forwarded[0] : forwarded)?.split(",")[0]?.trim();
+    if (first !== undefined && first !== "")
+      return first;
+  }
+  return request.socket.remoteAddress ?? "unknown";
+}
+function respond(response, status, body, headers) {
+  const all = { ...headers };
+  if (body !== undefined)
+    all["content-type"] = "application/json";
+  response.writeHead(status, all);
+  response.end(body === undefined ? undefined : JSON.stringify(body));
+}
+async function readJson(request) {
+  const chunks = [];
+  let size = 0;
+  let tooLarge = false;
+  for await (const chunk of request) {
+    size += chunk.length;
+    if (size > MAX_BODY) {
+      tooLarge = true;
+    } else if (!tooLarge) {
+      chunks.push(chunk);
+    }
+  }
+  if (tooLarge)
+    return { ok: false, tooLarge: true };
+  try {
+    return { ok: true, value: JSON.parse(Buffer.concat(chunks).toString("utf8")) };
+  } catch {
+    return { ok: false, tooLarge: false };
+  }
+}
+function sessionToken(request) {
+  const authorization = request.headers.authorization;
+  if (authorization !== undefined && authorization.startsWith("Bearer "))
+    return authorization.slice("Bearer ".length);
+  const header = request.headers.cookie;
+  if (header === undefined)
+    return;
+  for (const part of header.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq > 0 && part.slice(0, eq).trim() === SESSION_COOKIE)
+      return part.slice(eq + 1).trim();
+  }
+  return;
+}
+var cookieAttributes = "Path=/; Secure; HttpOnly; SameSite=Strict";
+var setSessionCookie = (token) => `${SESSION_COOKIE}=${token}; ${cookieAttributes}`;
+var clearSessionCookie = `${SESSION_COOKIE}=; ${cookieAttributes}; Max-Age=0`;
+async function handleApiRequest(request, response, ctx) {
+  const { accounts } = ctx;
+  const origin = request.headers.origin;
+  const method = request.method ?? "";
+  let pathname;
+  try {
+    pathname = new URL(request.url ?? "/", "http://server.invalid").pathname;
+  } catch {
+    pathname = "";
+  }
+  const cors = origin === DESKTOP_ORIGIN ? { "access-control-allow-origin": DESKTOP_ORIGIN, vary: "Origin" } : {};
+  const send = (status, body, headers) => respond(response, status, body, { ...cors, ...headers });
+  const deny = (status, error, headers) => send(status, { error }, headers);
+  if (!secureTransport(request, ctx.trustProxy)) {
+    deny(403, "https_required");
+    return;
+  }
+  if (method === "OPTIONS") {
+    send(204, undefined, origin === DESKTOP_ORIGIN ? {
+      "access-control-allow-methods": "GET, POST",
+      "access-control-allow-headers": "authorization, content-type"
+    } : {});
+    return;
+  }
+  const bearer = (request.headers.authorization ?? "").startsWith("Bearer ");
+  const loginTokenMode = pathname === "/api/login" && (origin === undefined || origin === DESKTOP_ORIGIN);
+  if (MUTATING.has(method) && !bearer && !loginTokenMode && origin !== ctx.publicOrigin) {
+    deny(403, "origin_mismatch");
+    return;
+  }
+  if (pathname === "/api/login") {
+    if (method !== "POST") {
+      deny(405, "method_not_allowed", { allow: "POST" });
+      return;
+    }
+    const body = await readJson(request);
+    if (!body.ok) {
+      deny(body.tooLarge ? 413 : 400, body.tooLarge ? "payload_too_large" : "invalid_json");
+      return;
+    }
+    const value = body.value;
+    if (typeof value !== "object" || value === null || typeof value.username !== "string" || typeof value.password !== "string") {
+      deny(400, "invalid_request");
+      return;
+    }
+    const { username, password } = value;
+    if ([...username].length === 0 || [...username].length > MAX_USERNAME_CODEPOINTS || [...password].length > MAX_PASSWORD_CODEPOINTS) {
+      deny(400, "invalid_request");
+      return;
+    }
+    const result = await accounts.login(username, password, clientIp(request, ctx.trustProxy));
+    if (result.status === "limited") {
+      deny(429, "rate_limited");
+      return;
+    }
+    if (result.status === "invalid") {
+      deny(401, "invalid_credentials");
+      return;
+    }
+    const cookieMode = origin === ctx.publicOrigin;
+    send(200, { user: { username }, expiresAt: result.expiresAt, ...cookieMode ? {} : { token: result.token } }, cookieMode ? { "set-cookie": setSessionCookie(result.token) } : undefined);
+    return;
+  }
+  const hostPairing = /^\/api\/hosts\/([A-Za-z0-9_-]{43})\/pairing$/.exec(pathname);
+  if (pathname === "/api/hosts" || hostPairing !== null) {
+    const expected = pathname === "/api/hosts" ? "GET" : "POST";
+    if (method !== expected) {
+      deny(405, "method_not_allowed", { allow: expected });
+      return;
+    }
+    const token = sessionToken(request);
+    const session = token === undefined ? undefined : accounts.authenticate(token);
+    if (session === undefined) {
+      deny(401, "unauthenticated");
+      return;
+    }
+    if (pathname === "/api/hosts") {
+      send(200, accounts.listHosts(session.userId).map((row2) => {
+        const pairing = ctx.pairing.status(row2.hostId, row2.noisePublicKey);
+        return {
+          hostId: row2.hostId,
+          name: row2.name,
+          noisePublicKey: row2.noisePublicKey,
+          online: pairing !== "offline",
+          lastSeenAt: row2.lastSeenAt,
+          pairing
+        };
+      }));
+      return;
+    }
+    const row = accounts.hostFor(session.userId, hostPairing[1]);
+    if (row === undefined) {
+      deny(404, "not_found");
+      return;
+    }
+    const status = ctx.pairing.status(row.hostId, row.noisePublicKey);
+    if (status !== "available") {
+      deny(409, status === "offline" ? "host_offline" : status);
+      return;
+    }
+    const abort = new AbortController;
+    response.once("close", () => {
+      if (!response.writableEnded)
+        abort.abort();
+    });
+    const result = await ctx.pairing.request(row.hostId, token, abort.signal);
+    if (result.status === "ok" && accounts.hostFor(session.userId, row.hostId) === undefined) {
+      deny(404, "not_found");
+      return;
+    }
+    switch (result.status) {
+      case "ok":
+        send(200, {
+          url: `${relayWsBase(ctx.publicOrigin)}/c/${row.hostId}`,
+          hostKey: row.noisePublicKey,
+          secret: result.secret,
+          expiresAt: result.expiresAt
+        });
+        return;
+      case "refused":
+        deny(409, result.reason);
+        return;
+      case "gone":
+        deny(409, "host_offline");
+        return;
+      case "timeout":
+        deny(504, "host_timeout");
+        return;
+      case "too_many":
+        deny(429, "rate_limited");
+        return;
+    }
+    return;
+  }
+  if (pathname === "/api/me" || pathname === "/api/logout" || pathname === "/api/sessions/revoke-all" || pathname === "/api/join-tokens") {
+    const expected = pathname === "/api/me" ? "GET" : "POST";
+    if (method !== expected) {
+      deny(405, "method_not_allowed", { allow: expected });
+      return;
+    }
+    const token = sessionToken(request);
+    const session = token === undefined ? undefined : accounts.authenticate(token);
+    if (session === undefined) {
+      deny(401, "unauthenticated");
+      return;
+    }
+    if (pathname === "/api/me") {
+      send(200, { user: { username: session.username } });
+      return;
+    }
+    if (pathname === "/api/join-tokens") {
+      const joinToken = accounts.createJoinToken(session.userId);
+      send(200, {
+        token: joinToken.token,
+        expiresAt: joinToken.expiresAt,
+        command: `npm i -g pinomad && pinomad join ${ctx.publicOrigin} ${joinToken.token}`
+      });
+      return;
+    }
+    if (pathname === "/api/logout") {
+      accounts.logout(token);
+      send(204, undefined, { "set-cookie": clearSessionCookie });
+      return;
+    }
+    accounts.revokeAllSessions(session.userId);
+    send(204, undefined, { "set-cookie": clearSessionCookie });
+    return;
+  }
+  deny(404, "not_found");
+}
+
+// apps/server/src/relay.ts
+var MAX_PAYLOAD = 128 * 1024;
+var MAX_BUFFERED = 64 * 1024;
+var HIGH_WATER = 1024 * 1024;
+var LOW_WATER = 256 * 1024;
+var HOST_PATH = "/host";
+var DEVICE_PATH = /^\/c\/([A-Za-z0-9_-]{43})$/;
+var ACCEPT_PATH = /^\/accept\/([A-Za-z0-9_-]{22})$/;
+var isSendableCloseCode = (code) => code >= 1000 && code <= 1003 || code >= 1007 && code <= 1014 || code >= 3000 && code <= 4999;
+var rawLength = (data) => Array.isArray(data) ? data.reduce((sum, part) => sum + part.length, 0) : data.byteLength;
+var MAX_PAIRING_PER_HOST = 4;
+var MAX_PAIRING_PER_SESSION = 2;
+var MAX_PUSH_PER_HOST = 4;
+var MAX_PUSH_TOTAL = 32;
+async function startRelay(options) {
+  const publicOrigin = options.publicOrigin.replace(/\/+$/, "");
+  if (publicOrigin === "")
+    throw new Error("publicOrigin is required");
+  const acceptTimeoutMs = options.acceptTimeoutMs ?? 1e4;
+  const registerTimeoutMs = options.registerTimeoutMs ?? 1e4;
+  const pingIntervalMs = options.pingIntervalMs ?? 30000;
+  const listenHost = options.listenHost ?? "127.0.0.1";
+  const accounts = options.accounts;
+  const trustProxy = options.trustProxy ?? false;
+  const pairingTimeoutMs = options.pairingTimeoutMs ?? 1e4;
+  const apns = options.push;
+  const pushEnvironments = apns?.environments ?? [];
+  const pushPerHost = options.pushLimits?.perHost ?? MAX_PUSH_PER_HOST;
+  const pushTotal = options.pushLimits?.total ?? MAX_PUSH_TOTAL;
+  let pushInflightTotal = 0;
+  const pushInflightHosts = new Map;
+  const controls = new Map;
+  const pending = new Map;
+  const pairingRequests = new Map;
+  const sockets = new Set;
+  const alive = new WeakMap;
+  function track(socket) {
+    sockets.add(socket);
+    alive.set(socket, true);
+    socket.on("pong", () => alive.set(socket, true));
+    socket.on("close", () => sockets.delete(socket));
+    socket.on("error", () => socket.terminate());
+  }
+  function splice(a, b) {
+    const forward = (from, to) => {
+      from.on("message", (data, isBinary) => {
+        if (to.readyState !== WebSocket.OPEN)
+          return;
+        to.send(data, { binary: isBinary }, () => {
+          if (from.isPaused && to.bufferedAmount <= LOW_WATER)
+            from.resume();
+        });
+        if (to.bufferedAmount > HIGH_WATER)
+          from.pause();
+      });
+      from.on("close", (code, reason) => {
+        if (to.readyState !== WebSocket.OPEN)
+          return;
+        to.close(isSendableCloseCode(code) ? code : 1001, reason);
+      });
+    };
+    forward(a, b);
+    forward(b, a);
+  }
+  function pairingStatus(hostId, boundNoiseKey) {
+    const control = controls.get(hostId);
+    if (control === undefined)
+      return "offline";
+    if (control.noisePublicKey === undefined || control.features?.includes("pairing") !== true)
+      return "host_too_old";
+    return control.noisePublicKey === boundNoiseKey ? "available" : "key_mismatch";
+  }
+  function requestPairing(hostId, sessionKey, signal) {
+    const control = controls.get(hostId);
+    if (control === undefined)
+      return Promise.resolve({ status: "gone" });
+    let perHost = 0;
+    let perSession = 0;
+    for (const entry of pairingRequests.values()) {
+      if (entry.hostId === hostId)
+        perHost += 1;
+      if (entry.sessionKey === sessionKey)
+        perSession += 1;
+    }
+    if (perHost >= MAX_PAIRING_PER_HOST || perSession >= MAX_PAIRING_PER_SESSION) {
+      return Promise.resolve({ status: "too_many" });
+    }
+    return new Promise((resolve) => {
+      const requestId = randomBytes2(16).toString("base64url");
+      const settle = (result) => {
+        if (!pairingRequests.delete(requestId))
+          return;
+        clearTimeout(timer);
+        signal.removeEventListener("abort", abort);
+        resolve(result);
+      };
+      const timer = setTimeout(() => settle({ status: "timeout" }), pairingTimeoutMs);
+      const abort = () => settle({ status: "cancelled" });
+      pairingRequests.set(requestId, { control: control.socket, hostId, sessionKey, settle, timer });
+      signal.addEventListener("abort", abort, { once: true });
+      control.socket.send(encodeRelayFrame({ t: "pairing-request", requestId }));
+    });
+  }
+  const pairing = { status: pairingStatus, request: requestPairing };
+  function handlePush(socket, hostId, frame) {
+    const startedAt = Date.now();
+    const finish = (verdict) => {
+      console.log(JSON.stringify({
+        event: "push",
+        hostId,
+        environment: frame.environment,
+        result: verdict.result,
+        reason: verdict.reason,
+        ms: Date.now() - startedAt
+      }));
+      if (socket.readyState === WebSocket.OPEN) {
+        socket.send(encodeRelayFrame({ t: "push-result", requestId: frame.requestId, ...verdict }));
+      }
+    };
+    if (accounts?.hasHost(hostId) !== true) {
+      finish({ result: "rejected", reason: "unauthorized" });
+      return;
+    }
+    if (apns === undefined || !pushEnvironments.includes(frame.environment)) {
+      finish({ result: "unavailable", reason: "environment not configured" });
+      return;
+    }
+    const perHost = pushInflightHosts.get(hostId) ?? 0;
+    if (perHost >= pushPerHost || pushInflightTotal >= pushTotal) {
+      finish({ result: "retry", reason: "rate_limited" });
+      return;
+    }
+    pushInflightTotal += 1;
+    pushInflightHosts.set(hostId, perHost + 1);
+    apns.send({ token: frame.token, environment: frame.environment, notification: frame.notification }).then(finish, () => finish({ result: "retry", reason: "server error" })).finally(() => {
+      pushInflightTotal -= 1;
+      const left = (pushInflightHosts.get(hostId) ?? 1) - 1;
+      if (left <= 0)
+        pushInflightHosts.delete(hostId);
+      else
+        pushInflightHosts.set(hostId, left);
+    });
+  }
+  function runOp(socket, frame, noisePublicKey) {
+    const answer = (reply) => socket.send(encodeRelayFrame(reply), () => socket.close(1000));
+    if (accounts === undefined) {
+      answer({ t: "refused", reason: "accounts_disabled" });
+      return;
+    }
+    if (frame.op === "join") {
+      if (frame.joinToken === undefined || noisePublicKey === undefined) {
+        answer({ t: "refused", reason: "bad_request" });
+        return;
+      }
+      const result = accounts.joinHost({
+        token: frame.joinToken,
+        hostId: frame.hostId,
+        noisePublicKey,
+        ...frame.name === undefined ? {} : { name: frame.name }
+      });
+      if (result.status === "joined") {
+        for (const request of pairingRequests.values()) {
+          if (request.hostId === frame.hostId)
+            request.settle({ status: "gone" });
+        }
+      }
+      answer(result.status === "joined" ? { t: "joined", username: result.username } : { t: "refused", reason: result.reason });
+      return;
+    }
+    if (!accounts.leaveHost(frame.hostId)) {
+      answer({ t: "refused", reason: "not_joined" });
+      return;
+    }
+    answer({ t: "left" });
+    controls.get(frame.hostId)?.socket.close(RELAY_CLOSE.hostNotAllowed);
+  }
+  function onControl(socket) {
+    track(socket);
+    const nonce = randomBytes2(32).toString("base64url");
+    socket.send(encodeRelayFrame({ t: "challenge", nonce }));
+    let hostId;
+    const deadline = setTimeout(() => socket.close(1008, "register timeout"), registerTimeoutMs);
+    socket.on("message", (data, isBinary) => {
+      if (isBinary) {
+        socket.close(1008, "unexpected frame");
+        return;
+      }
+      if (hostId !== undefined) {
+        let answer;
+        try {
+          answer = decodeHostToRelay(data.toString());
+        } catch {
+          socket.close(1008, "malformed frame");
+          return;
+        }
+        if (answer.t === "push") {
+          handlePush(socket, hostId, answer);
+          return;
+        }
+        if (answer.t === "pairing" || answer.t === "pairing-refused") {
+          const request = pairingRequests.get(answer.requestId);
+          if (request === undefined || request.control !== socket)
+            return;
+          request.settle(answer.t === "pairing" ? { status: "ok", secret: answer.secret, expiresAt: answer.expiresAt } : { status: "refused", reason: answer.reason });
+          return;
+        }
+        socket.close(1008, "unexpected frame");
+        return;
+      }
+      let frame;
+      try {
+        const decoded = decodeHostToRelay(data.toString());
+        if (decoded.t !== "register")
+          throw new Error("expected register");
+        frame = decoded;
+      } catch {
+        socket.close(1008, "malformed frame");
+        return;
+      }
+      let noisePublicKey;
+      if (frame.signatureV2 !== undefined) {
+        const bound = frame.noisePublicKey !== undefined && verifyRelayChallengeV2(frame.signatureV2, {
+          relayOrigin: publicOrigin,
+          hostId: frame.hostId,
+          nonce,
+          noisePublicKey: frame.noisePublicKey
+        });
+        if (!bound) {
+          socket.close(RELAY_CLOSE.badSignature);
+          return;
+        }
+        noisePublicKey = frame.noisePublicKey;
+      } else if (!verifyRelayChallenge(frame.signature, { relayOrigin: publicOrigin, hostId: frame.hostId, nonce })) {
+        socket.close(RELAY_CLOSE.badSignature);
+        return;
+      }
+      if (frame.op !== undefined) {
+        runOp(socket, frame, noisePublicKey);
+        return;
+      }
+      if (accounts?.hasHost(frame.hostId) !== true) {
+        socket.close(RELAY_CLOSE.hostNotAllowed);
+        return;
+      }
+      hostId = frame.hostId;
+      clearTimeout(deadline);
+      const previous = controls.get(hostId);
+      if (previous !== undefined)
+        previous.socket.close(RELAY_CLOSE.replaced);
+      controls.set(hostId, {
+        socket,
+        ...noisePublicKey === undefined ? {} : { noisePublicKey },
+        ...frame.features === undefined ? {} : { features: frame.features }
+      });
+      accounts?.markHostSeen(hostId);
+      socket.send(encodeRelayFrame({ t: "registered", push: pushEnvironments }));
+    });
+    socket.once("close", () => {
+      clearTimeout(deadline);
+      if (hostId !== undefined && controls.get(hostId)?.socket === socket)
+        controls.delete(hostId);
+      for (const [connId, entry] of pending) {
+        if (entry.control === socket) {
+          pending.delete(connId);
+          clearTimeout(entry.timer);
+          entry.socket.close(RELAY_CLOSE.hostOffline);
+        }
+      }
+      for (const request of pairingRequests.values()) {
+        if (request.control === socket)
+          request.settle({ status: "gone" });
+      }
+    });
+  }
+  function onDevice(socket, hostId) {
+    track(socket);
+    const control = controls.get(hostId)?.socket;
+    if (control === undefined) {
+      socket.close(RELAY_CLOSE.hostOffline);
+      return;
+    }
+    const connId = randomBytes2(16).toString("base64url");
+    const entry = {
+      control,
+      socket,
+      buffered: [],
+      bufferedBytes: 0,
+      timer: setTimeout(() => {
+        if (pending.delete(connId))
+          socket.close(RELAY_CLOSE.acceptTimeout);
+      }, acceptTimeoutMs),
+      onMessage(data, isBinary) {
+        entry.buffered.push({ data, isBinary });
+        entry.bufferedBytes += rawLength(data);
+        if (entry.bufferedBytes > MAX_BUFFERED && pending.delete(connId)) {
+          clearTimeout(entry.timer);
+          socket.close(1009);
+        }
+      },
+      onClose() {
+        if (pending.delete(connId))
+          clearTimeout(entry.timer);
+      }
+    };
+    pending.set(connId, entry);
+    socket.on("message", entry.onMessage);
+    socket.once("close", entry.onClose);
+    control.send(encodeRelayFrame({ t: "incoming", connId }));
+  }
+  function onAccept(socket, connId) {
+    track(socket);
+    const entry = pending.get(connId);
+    if (entry === undefined) {
+      socket.close(RELAY_CLOSE.unknownConnection);
+      return;
+    }
+    pending.delete(connId);
+    clearTimeout(entry.timer);
+    const device = entry.socket;
+    device.removeListener("message", entry.onMessage);
+    device.removeListener("close", entry.onClose);
+    splice(socket, device);
+    for (const { data, isBinary } of entry.buffered)
+      socket.send(data, { binary: isBinary });
+  }
+  const httpServer = createServer((request, response) => {
+    let pathname;
+    try {
+      pathname = new URL(request.url ?? "/", "http://relay.invalid").pathname;
+    } catch {
+      pathname = "";
+    }
+    if (pathname === "/api" || pathname.startsWith("/api/")) {
+      if (accounts === undefined) {
+        response.writeHead(404, { "content-type": "application/json" });
+        response.end(JSON.stringify({ error: "accounts_disabled" }));
+        return;
+      }
+      handleApiRequest(request, response, { accounts, publicOrigin, trustProxy, pairing }).catch(() => {
+        if (!response.headersSent)
+          response.writeHead(500);
+        response.end();
+      });
+      return;
+    }
+    if (options.webRoot !== undefined) {
+      serveWebClient(request, response, options.webRoot).catch(() => {
+        if (!response.headersSent)
+          response.writeHead(500);
+        response.end();
+      });
+      return;
+    }
+    response.writeHead(404);
+    response.end();
+  });
+  const wss = new WebSocketServer({ noServer: true, maxPayload: MAX_PAYLOAD });
+  httpServer.on("upgrade", (request, socket, head) => {
+    let pathname;
+    try {
+      pathname = new URL(request.url ?? "/", "http://relay.invalid").pathname;
+    } catch {
+      pathname = "";
+    }
+    const upgrade = (handle) => {
+      wss.handleUpgrade(request, socket, head, handle);
+    };
+    const device = DEVICE_PATH.exec(pathname);
+    const accept = ACCEPT_PATH.exec(pathname);
+    if (pathname === HOST_PATH) {
+      if (accounts !== undefined && !secureTransport(request, trustProxy)) {
+        socket.write(`HTTP/1.1 403 Forbidden\r
+\r
+`);
+        socket.destroy();
+      } else {
+        upgrade(onControl);
+      }
+    } else if (device !== null)
+      upgrade((ws) => onDevice(ws, device[1]));
+    else if (accept !== null)
+      upgrade((ws) => onAccept(ws, accept[1]));
+    else {
+      socket.write(`HTTP/1.1 404 Not Found\r
+\r
+`);
+      socket.destroy();
+    }
+  });
+  await new Promise((resolveListen, reject) => {
+    httpServer.once("listening", resolveListen);
+    httpServer.once("error", reject);
+    httpServer.listen(options.port, listenHost);
+  });
+  const { port } = httpServer.address();
+  const pingTimer = setInterval(() => {
+    for (const socket of sockets) {
+      if (alive.get(socket) === true) {
+        alive.set(socket, false);
+        socket.ping();
+      } else {
+        socket.terminate();
+      }
+    }
+  }, pingIntervalMs);
+  return {
+    port,
+    url: `ws://${listenHost.includes(":") ? `[${listenHost}]` : listenHost}:${port}`,
+    controlInfo(hostId) {
+      const entry = controls.get(hostId);
+      if (entry === undefined)
+        return;
+      return {
+        ...entry.noisePublicKey === undefined ? {} : { noisePublicKey: entry.noisePublicKey },
+        ...entry.features === undefined ? {} : { features: entry.features }
+      };
+    },
+    pairing,
+    async close() {
+      clearInterval(pingTimer);
+      for (const entry of pending.values())
+        clearTimeout(entry.timer);
+      pending.clear();
+      for (const socket of sockets)
+        socket.terminate();
+      const closing = once(wss, "close");
+      wss.close();
+      await closing;
+      await new Promise((resolve) => httpServer.close(() => resolve()));
+      await accounts?.close();
+      await apns?.close();
+    }
+  };
+}
+
+// apps/server/src/main.ts
+function resolveDataDir(flag) {
+  return resolve(flag ?? process.env.PINOMAD_SERVER_DATA_DIR ?? join2(homedir(), ".pinomad-server"));
+}
+async function readStdin(limit) {
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of process.stdin) {
+    size += chunk.length;
+    if (size > limit)
+      throw new Error("stdin exceeds the password size limit");
+    chunks.push(chunk);
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+async function passwdMain(argv) {
+  const { values } = parseArgs({
+    args: [...argv],
+    options: {
+      "data-dir": { type: "string" },
+      user: { type: "string" }
+    },
+    strict: true
+  });
+  if (process.stdin.isTTY) {
+    console.error("pipe the new password on stdin, e.g. `printenv NEW_PINOMAD_SERVER_PASSWORD | " + commandHint("server") + " passwd`");
+    process.exit(1);
+  }
+  const dataDir = resolveDataDir(values["data-dir"]);
+  const password = (await readStdin(16 * 1024)).replace(/[\r\n]+$/, "");
+  await changePassword({ dataDir, user: values.user, password });
+  console.log(JSON.stringify({ event: "passwd", dataDir }));
+}
+async function main(argv) {
+  if (argv[0] === "passwd") {
+    await passwdMain(argv.slice(1)).catch((error) => {
+      console.error(error instanceof Error ? error.message : String(error));
+      process.exit(1);
+    });
+    return;
+  }
+  const { values } = parseArgs({
+    args: [...argv],
+    options: {
+      port: { type: "string", default: "7430" },
+      listen: { type: "string", default: "127.0.0.1" },
+      "public-origin": { type: "string" },
+      "data-dir": { type: "string" },
+      "trust-proxy": { type: "boolean", default: false }
+    }
+  });
+  if (values["public-origin"] === undefined) {
+    console.error(`usage: ${commandHint("server")} --public-origin ORIGIN [--data-dir DIR] [--trust-proxy] [--port 7430] [--listen 127.0.0.1]
+` + `       ${commandHint("server")} passwd [--data-dir DIR] [--user NAME]   (server stopped; new password on stdin)
+` + "       env: PINOMAD_SERVER_USER, PINOMAD_SERVER_PASSWORD, PINOMAD_SERVER_DATA_DIR");
+    process.exit(1);
+  }
+  const accounts = await openAccounts({
+    dataDir: resolveDataDir(values["data-dir"]),
+    bootstrapUser: process.env.PINOMAD_SERVER_USER,
+    bootstrapPassword: process.env.PINOMAD_SERVER_PASSWORD
+  }).catch((error) => {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exit(1);
+  });
+  const apnsConfig = loadApnsConfig();
+  const apns = apnsConfig === undefined ? undefined : openApns(apnsConfig);
+  const relay = await startRelay({
+    port: Number(values.port),
+    listenHost: values.listen,
+    publicOrigin: values["public-origin"],
+    webRoot,
+    accounts,
+    trustProxy: values["trust-proxy"],
+    ...apns === undefined ? {} : { push: apns }
+  });
+  console.log(JSON.stringify({
+    event: "ready",
+    url: relay.url,
+    publicOrigin: values["public-origin"],
+    push: apns?.environments ?? []
+  }));
+  let stopping = false;
+  const stop = () => {
+    if (stopping)
+      return;
+    stopping = true;
+    relay.close().finally(() => process.exit(0));
+  };
+  process.on("SIGINT", stop);
+  process.on("SIGTERM", stop);
+}
+if (false)
+  ;
+export {
+  main
+};