pinomad 0.8.0 → 0.9.1

package/README.md

@@ -26,6 +26,8 @@ pinomad link        # in another terminal: prints a browser link to the web clie
 
 Sign in to a model provider under Settings → Providers: a subscription you already pay for (Claude, ChatGPT, Copilot, …), an API key, or your own OpenAI- or Anthropic-compatible endpoint. To click around without one, `pinomad host --faux "hi"` runs a scripted fake model.
 
+To reach the host from your Mac and iPhone anywhere without running a server, [use the official server](https://pinomad.si/docs/official-server/) at app.pinomad.si.
+
 ## Documentation
 
 User docs live on **[pinomad.si/docs](https://pinomad.si/docs/)**: [getting started](https://pinomad.si/docs/) (connecting your other devices, keeping the host running, clients) and [what the agent can do](https://pinomad.si/docs/features/). Usage, remote access, and the service reference are in Chinese for now: [中文文档](https://pinomad.si/zh/docs/).

package/dist/{chunk-p15hqqjz.js → chunk-029mmh7d.js}

@@ -1,6 +1,6 @@
 import {
   packagedVersion
-} from "./chunk-p56xf1r8.js";
+} from "./chunk-fqgvf8v0.js";
 import {
   hostAddress
 } from "./chunk-ngf1zatm.js";

package/dist/{chunk-73vxwjs7.js → chunk-32g3m2h0.js}

@@ -5,11 +5,11 @@ import {
   commandHint,
   hostEntry,
   packagedVersion
-} from "./chunk-p56xf1r8.js";
+} from "./chunk-fqgvf8v0.js";
 import {
   ProtocolMismatchError,
   connectRemoteDurable
-} from "./chunk-a4b61tx5.js";
+} from "./chunk-4sepcfpy.js";
 import {
   DEFAULT_DATA_DIR,
   hostAddress

package/dist/{chunk-ptjyk94f.js → chunk-3gcpzpjq.js}

@@ -2,10 +2,10 @@
 import {
   main,
   restartService
-} from "./chunk-73vxwjs7.js";
+} from "./chunk-32g3m2h0.js";
 import"./chunk-kzbzacz9.js";
-import"./chunk-p56xf1r8.js";
-import"./chunk-a4b61tx5.js";
+import"./chunk-fqgvf8v0.js";
+import"./chunk-4sepcfpy.js";
 import"./chunk-jgd38rna.js";
 import"./chunk-sygeb9qb.js";
 import"./chunk-ngf1zatm.js";

package/dist/{chunk-a4b61tx5.js → chunk-4sepcfpy.js}

@@ -2022,6 +2022,8 @@ class RemoteClient {
     }
   }
   #snapshot(stream, endSatisfies = false) {
+    if (!this.#wanted.has(stream))
+      return Promise.resolve();
     return new Promise((resolve, reject) => {
       const waiters = this.#snapshotWaiters.get(stream) ?? [];
       waiters.push({ resolve, reject, endSatisfies });
@@ -2044,9 +2046,10 @@ class RemoteClient {
   async#acquire(id) {
     const missing = this.#conversationStreams(id).filter((stream) => !this.#wanted.has(stream));
     const stale = this.#conversationStreams(id).filter((stream) => this.#wanted.has(stream) && !this.#fresh.has(stream));
+    for (const stream of missing)
+      this.#wanted.add(stream);
     const shown = Promise.all([...missing, ...stale].map((stream) => this.#snapshot(stream)));
     for (const stream of missing) {
-      this.#wanted.add(stream);
       if (this.#helloReceived)
         this.#subscribe(stream);
     }
@@ -2060,6 +2063,8 @@ class RemoteClient {
       this.#wanted.delete(stream);
       this.#values.delete(stream);
       this.#fresh.delete(stream);
+      for (const waiter of this.#snapshotWaiters.get(stream)?.splice(0) ?? [])
+        waiter.resolve();
       this.#send({ type: "unsubscribe", stream });
     }
   }
@@ -2814,6 +2819,7 @@ class RemoteClient {
       }),
       switchConversation: (id) => this.#command(() => this.#switch(id)),
       showSide: (id) => this.#command(() => this.#showSide(id)),
+      clearConversation: () => this.#command(() => this.#clear()),
       fork: (entryId, prompt, removeTools, options) => this.#command(async () => {
         const { conversationId: forked } = await this.#call("fork", {
           conversationId: conversationId(),
@@ -2956,6 +2962,10 @@ class RemoteClient {
     this.#release(previous, this.#side);
     this.#refresh();
   }
+  async#clear() {
+    this.#unshow();
+    await this.#showSide(undefined);
+  }
   async#showSide(id) {
     const previous = this.#side;
     if (id === previous)

package/dist/{chunk-r2ssa2ex.js → chunk-5gp9svzs.js}

@@ -15,7 +15,8 @@ var DevicesDoc = defineDoc({
   kind: "pinomad.devices",
   version: 1,
   scope: "session",
-  initial: () => ({ devices: [] })
+  initial: () => ({ devices: [] }),
+  checkpointWhen: () => false
 });
 async function ensureDevices(harness, context) {
   await harness.commit(async (tx) => void await tx.doc(DevicesDoc), context);
@@ -24,7 +25,8 @@ var RevocationsDoc = defineDoc({
   kind: "pinomad.revocations",
   version: 1,
   scope: "session",
-  initial: () => ({ revoked: [] })
+  initial: () => ({ revoked: [] }),
+  checkpointWhen: () => false
 });
 async function admitDevice(harness, input, context) {
   return await harness.commit(async (tx) => {

package/dist/{chunk-fes7wjw1.js → chunk-azarj0f4.js}

@@ -2,14 +2,14 @@
 import {
   restartService,
   serviceManager
-} from "./chunk-73vxwjs7.js";
+} from "./chunk-32g3m2h0.js";
 import"./chunk-kzbzacz9.js";
 import {
   globalPrefixOf,
   packageDir,
   packagedVersion
-} from "./chunk-p56xf1r8.js";
-import"./chunk-a4b61tx5.js";
+} from "./chunk-fqgvf8v0.js";
+import"./chunk-4sepcfpy.js";
 import"./chunk-jgd38rna.js";
 import"./chunk-sygeb9qb.js";
 import {

package/dist/{chunk-1r8a2434.js → chunk-cx8jgpdt.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   serveWebClient
-} from "./chunk-r6w5aqkw.js";
+} from "./chunk-wb10efyq.js";
 import {
   RELAY_CLOSE,
   decodeHostToRelay,
@@ -13,7 +13,7 @@ import {
 import {
   commandHint,
   webRoot
-} from "./chunk-p56xf1r8.js";
+} from "./chunk-fqgvf8v0.js";
 import {
   normalizeHostName
 } from "./chunk-sygeb9qb.js";
@@ -57,9 +57,19 @@ async function lockDataDir(dir, options) {
 
 // apps/server/src/accounts.ts
 var DB_FILE = "server.sqlite";
-var SCHEMA_VERSION = 1;
+var SCHEMA_VERSION = 3;
 var SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000;
 var JOIN_TOKEN_TTL_MS = 10 * 60 * 1000;
+var INVITE_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+var SIGN_UP_USERNAME = /^[a-z0-9][a-z0-9._-]{1,31}$/;
+var PUSH_TOKEN_TTL_MS = 90 * 24 * 60 * 60 * 1000;
+var MAX_PUSH_TOKENS_PER_USER = 32;
+var APNS_TOKEN_PATTERN = /^(?:[0-9a-f]{2})+$/;
+var APNS_TOKEN_MAX_CHARS = 256;
+function normalizeApnsToken(raw) {
+  const token = raw.toLowerCase();
+  return token.length <= APNS_TOKEN_MAX_CHARS && APNS_TOKEN_PATTERN.test(token) ? token : undefined;
+}
 var SCRYPT = { N: 16384, r: 8, p: 1 };
 var KEY_LEN = 32;
 var SALT_LEN = 16;
@@ -117,6 +127,45 @@ function migrate(db) {
   }
   if (version === SCHEMA_VERSION)
     return;
+  if (version < 1)
+    migrateTo1(db);
+  if (version < 2) {
+    db.exec(`
+      BEGIN;
+      CREATE TABLE push_tokens (
+        token TEXT NOT NULL,
+        environment TEXT NOT NULL,
+        user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+        updated_at INTEGER NOT NULL,
+        PRIMARY KEY (token, environment)
+      );
+      CREATE INDEX push_tokens_user ON push_tokens (user_id, updated_at);
+      PRAGMA user_version = 2;
+      COMMIT;
+    `);
+  }
+  if (version < 3) {
+    db.exec(`
+      BEGIN;
+      ALTER TABLE users ADD COLUMN admin INTEGER NOT NULL DEFAULT 0;
+      UPDATE users SET admin = 1 WHERE id = (SELECT MIN(id) FROM users);
+      -- AUTOINCREMENT: minting sweeps expired invites, and a reused id would
+      -- let a revoke from a stale list hit a code already sent to someone.
+      CREATE TABLE invites (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        code_hash TEXT NOT NULL UNIQUE,
+        created_by INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+        created_at INTEGER NOT NULL,
+        expires_at INTEGER NOT NULL,
+        used_at INTEGER,
+        used_by INTEGER REFERENCES users(id) ON DELETE SET NULL
+      );
+      PRAGMA user_version = 3;
+      COMMIT;
+    `);
+  }
+}
+function migrateTo1(db) {
   db.exec(`
     BEGIN;
     CREATE TABLE users (
@@ -146,7 +195,7 @@ function migrate(db) {
       joined_at INTEGER NOT NULL,
       last_seen_at INTEGER NOT NULL
     );
-    PRAGMA user_version = ${SCHEMA_VERSION};
+    PRAGMA user_version = 1;
     COMMIT;
   `);
 }
@@ -237,7 +286,7 @@ async function openAccounts(options) {
       assertUsernamePolicy(options.bootstrapUser);
       assertPasswordPolicy(options.bootstrapPassword);
       const hash = await hashPassword(options.bootstrapPassword);
-      db.prepare("INSERT INTO users (username, password_hash, created_at) VALUES (?, ?, ?)").run(options.bootstrapUser, hash, now());
+      db.prepare("INSERT INTO users (username, password_hash, created_at, admin) VALUES (?, ?, ?, 1)").run(options.bootstrapUser, hash, now());
     }
   } catch (error) {
     db?.close();
@@ -256,6 +305,20 @@ async function openAccounts(options) {
   const gate = new ScryptGate(limits.scryptConcurrency, limits.scryptQueue);
   const ipAttempts = new WindowedCounter(limits.counterMaxEntries, now);
   const userFailures = new WindowedCounter(limits.counterMaxEntries, now);
+  const issueSession = (userId) => {
+    db.prepare("DELETE FROM sessions WHERE expires_at <= ?").run(now());
+    const token = randomBytes(32).toString("base64url");
+    const expiresAt = now() + SESSION_TTL_MS;
+    db.prepare("INSERT INTO sessions (token_hash, user_id, created_at, expires_at) VALUES (?, ?, ?, ?)").run(sha256Hex(token), userId, now(), expiresAt);
+    return { token, expiresAt };
+  };
+  const inviteState = (codeHash) => {
+    const row = db.prepare("SELECT expires_at AS expiresAt, used_at AS usedAt FROM invites WHERE code_hash = ?").get(codeHash);
+    if (row === undefined || row.usedAt !== null)
+      return "invalid_invite";
+    return row.expiresAt <= now() ? "invite_expired" : "ok";
+  };
+  const usernameTaken = (username) => db.prepare("SELECT 1 AS x FROM users WHERE lower(username) = ?").get(username) !== undefined;
   return {
     dbPath: join(options.dataDir, DB_FILE),
     async login(username, password, ip) {
@@ -263,7 +326,7 @@ async function openAccounts(options) {
         return { status: "limited" };
       if (userFailures.isOver(username, limits.userMaxFailures))
         return { status: "limited" };
-      const user = db.prepare("SELECT id, username, password_hash AS passwordHash FROM users WHERE username = ?").get(username);
+      const user = db.prepare("SELECT id, username, password_hash AS passwordHash, admin FROM users WHERE username = ?").get(username);
       const outcome = await gate.run(async () => {
         if (userFailures.isOver(username, limits.userMaxFailures))
           return "limited";
@@ -279,28 +342,123 @@ async function openAccounts(options) {
       if (outcome === "invalid")
         return { status: "invalid" };
       userFailures.reset(username);
-      db.prepare("DELETE FROM sessions WHERE expires_at <= ?").run(now());
-      const token = randomBytes(32).toString("base64url");
-      const expiresAt = now() + SESSION_TTL_MS;
-      db.prepare("INSERT INTO sessions (token_hash, user_id, created_at, expires_at) VALUES (?, ?, ?, ?)").run(sha256Hex(token), outcome, now(), expiresAt);
-      return { status: "ok", token, expiresAt };
+      return { status: "ok", ...issueSession(outcome), admin: user?.admin === 1 };
+    },
+    async register({ invite, username, password, ip }) {
+      if (ipAttempts.hit(ip, limits.ipMaxAttempts, limits.ipWindowMs))
+        return { status: "limited" };
+      const codeHash = sha256Hex(invite);
+      const invited = inviteState(codeHash);
+      if (invited !== "ok")
+        return { status: "refused", reason: invited };
+      if (!SIGN_UP_USERNAME.test(username))
+        return { status: "refused", reason: "invalid_username" };
+      const length = [...password].length;
+      if (length < MIN_PASSWORD_CODEPOINTS || length > MAX_PASSWORD_CODEPOINTS) {
+        return { status: "refused", reason: "weak_password" };
+      }
+      if (usernameTaken(username))
+        return { status: "refused", reason: "username_taken" };
+      const hash = await gate.run(() => hashPassword(password));
+      if (hash === undefined)
+        return { status: "limited" };
+      db.exec("BEGIN");
+      try {
+        const again = inviteState(codeHash);
+        const failure = again !== "ok" ? again : usernameTaken(username) ? "username_taken" : undefined;
+        if (failure !== undefined) {
+          db.exec("ROLLBACK");
+          return { status: "refused", reason: failure };
+        }
+        const userId = Number(db.prepare("INSERT INTO users (username, password_hash, created_at) VALUES (?, ?, ?)").run(username, hash, now()).lastInsertRowid);
+        const claimed = db.prepare("UPDATE invites SET used_at = ?, used_by = ? WHERE code_hash = ? AND used_at IS NULL").run(now(), userId, codeHash);
+        if (Number(claimed.changes) !== 1) {
+          db.exec("ROLLBACK");
+          return { status: "refused", reason: "invalid_invite" };
+        }
+        const session = issueSession(userId);
+        db.exec("COMMIT");
+        return { status: "ok", ...session };
+      } catch (error) {
+        db.exec("ROLLBACK");
+        throw error;
+      }
+    },
+    createInvite(userId) {
+      db.prepare("DELETE FROM invites WHERE used_at IS NULL AND expires_at <= ?").run(now());
+      const code = randomBytes(16).toString("base64url");
+      const expiresAt = now() + INVITE_TTL_MS;
+      db.prepare("INSERT INTO invites (code_hash, created_by, created_at, expires_at) VALUES (?, ?, ?, ?)").run(sha256Hex(code), userId, now(), expiresAt);
+      return { code, expiresAt };
+    },
+    listInvites() {
+      const rows = db.prepare(`SELECT i.id AS id, i.created_at AS createdAt, i.expires_at AS expiresAt, i.used_at AS usedAt, u.username AS usedBy
+           FROM invites i LEFT JOIN users u ON u.id = i.used_by ORDER BY i.created_at DESC, i.id DESC`).all();
+      return rows.map((row) => ({
+        id: row.id,
+        createdAt: row.createdAt,
+        expiresAt: row.expiresAt,
+        ...row.usedAt === null ? {} : { usedAt: row.usedAt },
+        ...row.usedBy === null ? {} : { usedBy: row.usedBy }
+      }));
+    },
+    revokeInvite(id) {
+      return Number(db.prepare("DELETE FROM invites WHERE id = ? AND used_at IS NULL").run(id).changes) > 0;
     },
     authenticate(token) {
-      const row = db.prepare(`SELECT s.user_id AS userId, u.username AS username, s.expires_at AS expiresAt
+      const row = db.prepare(`SELECT s.user_id AS userId, u.username AS username, u.admin AS admin, s.expires_at AS expiresAt
            FROM sessions s JOIN users u ON u.id = s.user_id WHERE s.token_hash = ?`).get(sha256Hex(token));
       if (row === undefined || row.expiresAt <= now())
         return;
-      return { userId: row.userId, username: row.username };
+      return { userId: row.userId, username: row.username, admin: row.admin === 1 };
     },
     logout(token) {
       db.prepare("DELETE FROM sessions WHERE token_hash = ?").run(sha256Hex(token));
     },
     revokeAllSessions(userId) {
-      db.prepare("DELETE FROM sessions WHERE user_id = ?").run(userId);
+      db.exec("BEGIN");
+      try {
+        db.prepare("DELETE FROM sessions WHERE user_id = ?").run(userId);
+        db.prepare("DELETE FROM push_tokens WHERE user_id = ?").run(userId);
+        db.exec("COMMIT");
+      } catch (error) {
+        db.exec("ROLLBACK");
+        throw error;
+      }
     },
     hasHost(hostId) {
       return db.prepare("SELECT 1 AS x FROM hosts WHERE host_id = ?").get(hostId) !== undefined;
     },
+    hostOwner(hostId) {
+      const row = db.prepare("SELECT user_id AS userId FROM hosts WHERE host_id = ?").get(hostId);
+      return row?.userId;
+    },
+    registerPushToken(userId, token, environment) {
+      const at = now();
+      db.exec("BEGIN");
+      try {
+        db.prepare("DELETE FROM push_tokens WHERE updated_at < ?").run(at - PUSH_TOKEN_TTL_MS);
+        db.prepare(`INSERT INTO push_tokens (token, environment, user_id, updated_at) VALUES (?, ?, ?, ?)
+           ON CONFLICT (token, environment) DO UPDATE SET user_id = excluded.user_id, updated_at = excluded.updated_at`).run(token.toLowerCase(), environment, userId, at);
+        db.prepare(`DELETE FROM push_tokens WHERE user_id = ? AND rowid NOT IN (
+             SELECT rowid FROM push_tokens WHERE user_id = ? ORDER BY updated_at DESC LIMIT ?
+           )`).run(userId, userId, MAX_PUSH_TOKENS_PER_USER);
+        db.exec("COMMIT");
+      } catch (error) {
+        db.exec("ROLLBACK");
+        throw error;
+      }
+    },
+    removePushToken(userId, token, environment) {
+      db.prepare("DELETE FROM push_tokens WHERE token = ? AND environment = ? AND user_id = ?").run(token.toLowerCase(), environment, userId);
+    },
+    pushTokenOwner(token, environment) {
+      const row = db.prepare("SELECT user_id AS userId FROM push_tokens WHERE token = ? AND environment = ? AND updated_at >= ?").get(token.toLowerCase(), environment, now() - PUSH_TOKEN_TTL_MS);
+      return row?.userId;
+    },
+    forgetPushToken(token, environment, unregisteredAt) {
+      db.prepare("DELETE FROM push_tokens WHERE token = ? AND environment = ? AND updated_at < ?").run(token.toLowerCase(), environment, unregisteredAt);
+    },
     createJoinToken(userId) {
       db.prepare("DELETE FROM join_tokens WHERE expires_at <= ?").run(now());
       const token = randomBytes(32).toString("base64url");
@@ -389,6 +547,7 @@ async function changePassword(options) {
       db.prepare("UPDATE users SET password_hash = ? WHERE id = ?").run(hash, userId);
       db.prepare("DELETE FROM sessions WHERE user_id = ?").run(userId);
       db.prepare("DELETE FROM join_tokens WHERE user_id = ? AND used_at IS NULL").run(userId);
+      db.prepare("DELETE FROM push_tokens WHERE user_id = ?").run(userId);
       db.exec("COMMIT");
     } catch (error) {
       db.exec("ROLLBACK");
@@ -719,7 +878,7 @@ async function handleApiRequest(request, response, ctx) {
     return;
   }
   const bearer = (request.headers.authorization ?? "").startsWith("Bearer ");
-  const loginTokenMode = pathname === "/api/login" && (origin === undefined || origin === DESKTOP_ORIGIN);
+  const loginTokenMode = (pathname === "/api/login" || pathname === "/api/register") && (origin === undefined || origin === DESKTOP_ORIGIN);
   if (MUTATING.has(method) && !bearer && !loginTokenMode && origin !== ctx.publicOrigin) {
     deny(403, "origin_mismatch");
     return;
@@ -754,9 +913,92 @@ async function handleApiRequest(request, response, ctx) {
       return;
     }
     const cookieMode = origin === ctx.publicOrigin;
+    send(200, {
+      user: { username },
+      ...result.admin ? { admin: true } : {},
+      expiresAt: result.expiresAt,
+      ...cookieMode ? {} : { token: result.token }
+    }, cookieMode ? { "set-cookie": setSessionCookie(result.token) } : undefined);
+    return;
+  }
+  if (pathname === "/api/register") {
+    if (method !== "POST") {
+      deny(405, "method_not_allowed", { allow: "POST" });
+      return;
+    }
+    const body = await readJson(request);
+    if (!body.ok) {
+      deny(body.tooLarge ? 413 : 400, body.tooLarge ? "payload_too_large" : "invalid_json");
+      return;
+    }
+    const value = body.value;
+    if (typeof value?.invite !== "string" || typeof value.username !== "string" || typeof value.password !== "string") {
+      deny(400, "invalid_request");
+      return;
+    }
+    const { invite, username } = value;
+    const result = await accounts.register({
+      invite,
+      username,
+      password: value.password,
+      ip: clientIp(request, ctx.trustProxy)
+    });
+    if (result.status === "limited") {
+      deny(429, "rate_limited");
+      return;
+    }
+    if (result.status === "refused") {
+      const status = result.reason === "invalid_invite" || result.reason === "invite_expired" ? 403 : result.reason === "username_taken" ? 409 : 400;
+      deny(status, result.reason);
+      return;
+    }
+    const cookieMode = origin === ctx.publicOrigin;
     send(200, { user: { username }, expiresAt: result.expiresAt, ...cookieMode ? {} : { token: result.token } }, cookieMode ? { "set-cookie": setSessionCookie(result.token) } : undefined);
     return;
   }
+  if (pathname === "/api/invites" || pathname === "/api/invites/revoke") {
+    const allowed = pathname === "/api/invites" ? ["GET", "POST"] : ["POST"];
+    if (!allowed.includes(method)) {
+      deny(405, "method_not_allowed", { allow: allowed.join(", ") });
+      return;
+    }
+    const token = sessionToken(request);
+    const session = token === undefined ? undefined : accounts.authenticate(token);
+    if (session === undefined) {
+      deny(401, "unauthenticated");
+      return;
+    }
+    if (!session.admin) {
+      deny(403, "forbidden");
+      return;
+    }
+    if (pathname === "/api/invites") {
+      if (method === "GET")
+        send(200, accounts.listInvites());
+      else
+        send(200, accounts.createInvite(session.userId));
+      return;
+    }
+    const body = await readJson(request);
+    if (!body.ok) {
+      deny(body.tooLarge ? 413 : 400, body.tooLarge ? "payload_too_large" : "invalid_json");
+      return;
+    }
+    const id = body.value?.id;
+    if (typeof id !== "number" || !Number.isSafeInteger(id)) {
+      deny(400, "invalid_request");
+      return;
+    }
+    if (accounts.authenticate(token)?.admin !== true) {
+      deny(401, "unauthenticated");
+      return;
+    }
+    if (accounts.revokeInvite(id))
+      send(204);
+    else
+      deny(404, "not_found");
+    return;
+  }
   const hostPairing = /^\/api\/hosts\/([A-Za-z0-9_-]{43})\/pairing$/.exec(pathname);
   if (pathname === "/api/hosts" || hostPairing !== null) {
     const expected = pathname === "/api/hosts" ? "GET" : "POST";
@@ -829,7 +1071,7 @@ async function handleApiRequest(request, response, ctx) {
     }
     return;
   }
-  if (pathname === "/api/me" || pathname === "/api/logout" || pathname === "/api/sessions/revoke-all" || pathname === "/api/join-tokens") {
+  if (pathname === "/api/me" || pathname === "/api/logout" || pathname === "/api/sessions/revoke-all" || pathname === "/api/join-tokens" || pathname === "/api/push-tokens" || pathname === "/api/push-tokens/remove") {
     const expected = pathname === "/api/me" ? "GET" : "POST";
     if (method !== expected) {
       deny(405, "method_not_allowed", { allow: expected });
@@ -842,7 +1084,31 @@ async function handleApiRequest(request, response, ctx) {
       return;
     }
     if (pathname === "/api/me") {
-      send(200, { user: { username: session.username } });
+      send(200, { user: { username: session.username }, ...session.admin ? { admin: true } : {} });
+      return;
+    }
+    if (pathname === "/api/push-tokens" || pathname === "/api/push-tokens/remove") {
+      const body = await readJson(request);
+      if (!body.ok) {
+        deny(body.tooLarge ? 413 : 400, body.tooLarge ? "payload_too_large" : "invalid_json");
+        return;
+      }
+      const value = body.value;
+      const apns = typeof value?.apns === "string" ? normalizeApnsToken(value.apns) : undefined;
+      const environment = value?.environment;
+      if (apns === undefined || environment !== "production" && environment !== "development") {
+        deny(400, "invalid_request");
+        return;
+      }
+      if (accounts.authenticate(token) === undefined) {
+        deny(401, "unauthenticated");
+        return;
+      }
+      if (pathname === "/api/push-tokens")
+        accounts.registerPushToken(session.userId, apns, environment);
+      else
+        accounts.removePushToken(session.userId, apns, environment);
+      send(204);
       return;
     }
     if (pathname === "/api/join-tokens") {
@@ -985,7 +1251,8 @@ async function startRelay(options) {
         socket.send(encodeRelayFrame({ t: "push-result", requestId: frame.requestId, ...verdict }));
       }
     };
-    if (accounts?.hasHost(hostId) !== true) {
+    const owner = accounts?.hostOwner(hostId);
+    if (accounts === undefined || owner === undefined) {
       finish({ result: "rejected", reason: "unauthorized" });
       return;
     }
@@ -993,6 +1260,10 @@ async function startRelay(options) {
       finish({ result: "unavailable", reason: "environment not configured" });
       return;
     }
+    if (accounts.pushTokenOwner(frame.token, frame.environment) !== owner) {
+      finish({ result: "rejected", reason: "token_not_registered" });
+      return;
+    }
     const perHost = pushInflightHosts.get(hostId) ?? 0;
     if (perHost >= pushPerHost || pushInflightTotal >= pushTotal) {
       finish({ result: "retry", reason: "rate_limited" });
@@ -1000,7 +1271,12 @@ async function startRelay(options) {
     }
     pushInflightTotal += 1;
     pushInflightHosts.set(hostId, perHost + 1);
-    apns.send({ token: frame.token, environment: frame.environment, notification: frame.notification }).then(finish, () => finish({ result: "retry", reason: "server error" })).finally(() => {
+    apns.send({ token: frame.token, environment: frame.environment, notification: frame.notification }).then((verdict) => {
+      if (verdict.result === "unregistered") {
+        accounts.forgetPushToken(frame.token, frame.environment, verdict.unregisteredAt);
+      }
+      finish(verdict);
+    }, () => finish({ result: "retry", reason: "server error" })).finally(() => {
       pushInflightTotal -= 1;
       const left = (pushInflightHosts.get(hostId) ?? 1) - 1;
       if (left <= 0)

package/dist/{chunk-p56xf1r8.js → chunk-fqgvf8v0.js}

@@ -1,6 +1,6 @@
 // apps/host/src/distribution.ts
 import { fileURLToPath } from "node:url";
-var packagedVersion = "0.8.0";
+var packagedVersion = "0.9.1";
 var webRoot = fileURLToPath(new URL(packagedVersion === undefined ? "../../web/dist" : "../web/", import.meta.url));
 var hostEntry = packagedVersion === undefined ? { script: fileURLToPath(new URL("./main.ts", import.meta.url)), args: [] } : { script: fileURLToPath(new URL("./pinomad.js", import.meta.url)), args: ["host"] };
 var commandHint = (name) => packagedVersion === undefined ? `bun run ${name}` : `pinomad ${name}`;

package/dist/{chunk-cytnycs9.js → chunk-n58m5hgh.js}

@@ -12,7 +12,7 @@ import {
   loadHostKey,
   loadRelayKey,
   writeServerConfig
-} from "./chunk-r2ssa2ex.js";
+} from "./chunk-5gp9svzs.js";
 import {
   relayHostId
 } from "./chunk-khcpv54k.js";
@@ -22,13 +22,13 @@ import {
   restartService,
   serviceManager,
   withoutRelayArgs
-} from "./chunk-73vxwjs7.js";
+} from "./chunk-32g3m2h0.js";
 import"./chunk-kzbzacz9.js";
 import {
   commandHint,
   hostEntry
-} from "./chunk-p56xf1r8.js";
-import"./chunk-a4b61tx5.js";
+} from "./chunk-fqgvf8v0.js";
+import"./chunk-4sepcfpy.js";
 import"./chunk-jgd38rna.js";
 import {
   cleanHostName,