pinomad 0.9.1 → 0.11.0

package/dist/{chunk-cx8jgpdt.js → chunk-9h5vawnm.js}

@@ -9,14 +9,14 @@ import {
   relayWsBase,
   verifyRelayChallenge,
   verifyRelayChallengeV2
-} from "./chunk-khcpv54k.js";
+} from "./chunk-y127fe1a.js";
+import {
+  normalizeHostName
+} from "./chunk-pqe7q1s7.js";
 import {
   commandHint,
   webRoot
-} from "./chunk-fqgvf8v0.js";
-import {
-  normalizeHostName
-} from "./chunk-sygeb9qb.js";
+} from "./chunk-sd5fkxjj.js";
 import"./chunk-df32avw6.js";
 
 // apps/server/src/main.ts
@@ -25,7 +25,7 @@ import { join as join2, resolve } from "node:path";
 import { parseArgs } from "node:util";
 
 // apps/server/src/accounts.ts
-import { createHash, randomBytes, scrypt, timingSafeEqual } from "node:crypto";
+import { createHash, randomBytes, randomInt, scrypt, timingSafeEqual } from "node:crypto";
 import { mkdir } from "node:fs/promises";
 import { join } from "node:path";
 import { DatabaseSync } from "node:sqlite";
@@ -33,6 +33,7 @@ import { promisify } from "node:util";
 
 // apps/server/src/lock.ts
 import lockfile from "proper-lockfile";
+var isDataDirInUse = (error) => error.cause?.code === "ELOCKED";
 async function lockDataDir(dir, options) {
   const stale = Math.max(2000, options?.staleMs ?? 1e4);
   let releasing = false;
@@ -57,15 +58,49 @@ async function lockDataDir(dir, options) {
 
 // apps/server/src/accounts.ts
 var DB_FILE = "server.sqlite";
-var SCHEMA_VERSION = 3;
+var SCHEMA_VERSION = 6;
 var SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000;
 var JOIN_TOKEN_TTL_MS = 10 * 60 * 1000;
+var USER_CODE_ALPHABET = "BCDFGHJKLMNPQRSTVWXZ";
+var USER_CODE_LENGTH = 8;
+var HOST_LINK_TTL_MS = JOIN_TOKEN_TTL_MS;
+var HOST_LINK_INTERVAL_S = 5;
+var SLOW_DOWN_STEP_S = 5;
+var POLL_SLACK_MS = 1000;
+var HOST_OS_MAX_CODEPOINTS = 64;
+function normalizeUserCode(input) {
+  const code = input.replace(/[\s-]/g, "").toUpperCase();
+  if (code.length !== USER_CODE_LENGTH)
+    return;
+  for (const letter of code)
+    if (!USER_CODE_ALPHABET.includes(letter))
+      return;
+  return code;
+}
+var formatUserCode = (code) => `${code.slice(0, 4)}-${code.slice(4)}`;
 var INVITE_TTL_MS = 7 * 24 * 60 * 60 * 1000;
 var SIGN_UP_USERNAME = /^[a-z0-9][a-z0-9._-]{1,31}$/;
 var PUSH_TOKEN_TTL_MS = 90 * 24 * 60 * 60 * 1000;
 var MAX_PUSH_TOKENS_PER_USER = 32;
 var APNS_TOKEN_PATTERN = /^(?:[0-9a-f]{2})+$/;
 var APNS_TOKEN_MAX_CHARS = 256;
+var DEVICE_ID_PATTERN = /^[A-Za-z0-9_-]{22,64}$/;
+var DEVICE_NAME_MAX_CODEPOINTS = 64;
+var ADMISSION_REPORT_GRACE_MS = 24 * 60 * 60 * 1000;
+var MAX_OFFER_TTL_MS = 6 * 60 * 1000;
+function parseDeviceClaim(raw) {
+  if (raw === undefined)
+    return;
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw))
+    return "invalid";
+  const { id, name } = raw;
+  if (typeof id !== "string" || !DEVICE_ID_PATTERN.test(id))
+    return "invalid";
+  if (name !== undefined && typeof name !== "string")
+    return "invalid";
+  const clipped = [...(name ?? "").trim()].slice(0, DEVICE_NAME_MAX_CODEPOINTS).join("").trim();
+  return clipped === "" ? { id } : { id, name: clipped };
+}
 function normalizeApnsToken(raw) {
   const token = raw.toLowerCase();
   return token.length <= APNS_TOKEN_MAX_CHARS && APNS_TOKEN_PATTERN.test(token) ? token : undefined;
@@ -117,11 +152,17 @@ function assertUsernamePolicy(username) {
     throw new Error(`username must be 1–${MAX_USERNAME_CODEPOINTS} characters`);
   }
 }
-function migrate(db) {
+var BUSY_TIMEOUT_MS = 5000;
+function openDatabase(dataDir) {
+  const db = new DatabaseSync(join(dataDir, DB_FILE));
+  db.exec(`PRAGMA busy_timeout = ${BUSY_TIMEOUT_MS}`);
   db.exec("PRAGMA journal_mode = WAL");
   db.exec("PRAGMA foreign_keys = ON");
-  const row = db.prepare("PRAGMA user_version").get();
-  const version = row?.user_version ?? 0;
+  return db;
+}
+var schemaVersion = (db) => db.prepare("PRAGMA user_version").get()?.user_version ?? 0;
+function migrate(db) {
+  const version = schemaVersion(db);
   if (version > SCHEMA_VERSION) {
     throw new Error(`server database schema ${version} is newer than this build (${SCHEMA_VERSION})`);
   }
@@ -164,6 +205,95 @@ function migrate(db) {
       COMMIT;
     `);
   }
+  if (version < 4)
+    migrateTo4(db);
+  if (version < 5) {
+    db.exec(`
+      BEGIN;
+      ALTER TABLE push_tokens ADD COLUMN device_id INTEGER REFERENCES account_devices(id) ON DELETE SET NULL;
+      CREATE INDEX push_tokens_device ON push_tokens (device_id);
+      PRAGMA user_version = 5;
+      COMMIT;
+    `);
+  }
+  if (version < 6) {
+    db.exec(`
+      BEGIN;
+      CREATE TABLE host_link_requests (
+        device_code_hash TEXT PRIMARY KEY,
+        user_code_hash TEXT NOT NULL UNIQUE,
+        host_id TEXT NOT NULL,
+        host_name TEXT,
+        host_os TEXT,
+        source_ip TEXT,
+        state TEXT NOT NULL DEFAULT 'pending',
+        user_id INTEGER REFERENCES users(id) ON DELETE CASCADE,
+        interval_s INTEGER NOT NULL,
+        last_poll_at INTEGER,
+        created_at INTEGER NOT NULL,
+        expires_at INTEGER NOT NULL
+      );
+      CREATE INDEX host_link_requests_expiry ON host_link_requests (expires_at);
+      ALTER TABLE join_tokens ADD COLUMN host_id TEXT;
+      PRAGMA user_version = 6;
+      COMMIT;
+    `);
+  }
+}
+function migrateTo4(db) {
+  db.exec("BEGIN");
+  try {
+    db.exec(`
+      -- AUTOINCREMENT: ids appear in kick URLs, and a reused one would let a
+      -- stale list kick a device that signed in later.
+      CREATE TABLE account_devices (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+        -- The client's own ID; NULL for clients that send none, which never
+        -- match each other (SQLite UNIQUE treats NULLs as distinct).
+        client_id TEXT,
+        name TEXT,
+        created_at INTEGER NOT NULL,
+        last_seen_at INTEGER NOT NULL,
+        kicked_at INTEGER,
+        UNIQUE (user_id, client_id)
+      );
+      ALTER TABLE sessions ADD COLUMN device_id INTEGER REFERENCES account_devices(id) ON DELETE CASCADE;
+      CREATE INDEX sessions_device ON sessions (device_id);
+      ALTER TABLE hosts ADD COLUMN device_reports INTEGER NOT NULL DEFAULT 0;
+      CREATE TABLE vouchings (
+        request_id TEXT PRIMARY KEY,
+        device_id INTEGER NOT NULL REFERENCES account_devices(id) ON DELETE CASCADE,
+        host_id TEXT NOT NULL REFERENCES hosts(host_id) ON DELETE CASCADE,
+        expires_at INTEGER NOT NULL,
+        -- Filled by the host's device-admitted report.
+        public_key TEXT,
+        admitted_at INTEGER,
+        -- Set when the account withdrew this vouching (a kick), reported
+        -- yet or not: a report that arrives later is revoked at once.
+        revoked_at INTEGER
+      );
+      CREATE INDEX vouchings_device ON vouchings (device_id);
+      CREATE INDEX vouchings_host_key ON vouchings (host_id, public_key);
+      CREATE TABLE pending_revocations (
+        host_id TEXT NOT NULL REFERENCES hosts(host_id) ON DELETE CASCADE,
+        public_key TEXT NOT NULL,
+        created_at INTEGER NOT NULL,
+        PRIMARY KEY (host_id, public_key)
+      );
+    `);
+    const sessions = db.prepare("SELECT token_hash AS tokenHash, user_id AS userId, created_at AS createdAt FROM sessions").all();
+    const insert = db.prepare("INSERT INTO account_devices (user_id, created_at, last_seen_at) VALUES (?, ?, ?)");
+    const link = db.prepare("UPDATE sessions SET device_id = ? WHERE token_hash = ?");
+    for (const session of sessions) {
+      const deviceId = insert.run(session.userId, session.createdAt, session.createdAt).lastInsertRowid;
+      link.run(deviceId, session.tokenHash);
+    }
+    db.exec("PRAGMA user_version = 4; COMMIT");
+  } catch (error) {
+    db.exec("ROLLBACK");
+    throw error;
+  }
 }
 function migrateTo1(db) {
   db.exec(`
@@ -276,7 +406,7 @@ async function openAccounts(options) {
   const release = await lockDataDir(options.dataDir, { staleMs: options.lockStaleMs });
   let db;
   try {
-    db = new DatabaseSync(join(options.dataDir, DB_FILE));
+    db = openDatabase(options.dataDir);
     migrate(db);
     const userCount = db.prepare("SELECT COUNT(*) AS n FROM users").get().n;
     if (userCount === 0) {
@@ -305,13 +435,112 @@ async function openAccounts(options) {
   const gate = new ScryptGate(limits.scryptConcurrency, limits.scryptQueue);
   const ipAttempts = new WindowedCounter(limits.counterMaxEntries, now);
   const userFailures = new WindowedCounter(limits.counterMaxEntries, now);
-  const issueSession = (userId) => {
+  const linkLimits = {
+    startMaxPerIp: options.hostLinkLimits?.startMaxPerIp ?? 10,
+    startWindowMs: options.hostLinkLimits?.startWindowMs ?? 10 * 60000,
+    maxPending: options.hostLinkLimits?.maxPending ?? 1000,
+    userMaxFailures: options.hostLinkLimits?.userMaxFailures ?? 10,
+    ipMaxFailures: options.hostLinkLimits?.ipMaxFailures ?? 30,
+    failureWindowMs: options.hostLinkLimits?.failureWindowMs ?? 15 * 60000,
+    counterMaxEntries: options.hostLinkLimits?.counterMaxEntries ?? 4096
+  };
+  const linkStarts = new WindowedCounter(linkLimits.counterMaxEntries, now);
+  const linkUserFailures = new WindowedCounter(linkLimits.counterMaxEntries, now);
+  const linkIpFailures = new WindowedCounter(linkLimits.counterMaxEntries, now);
+  const sweepExpired = () => {
+    const at = now();
+    db.prepare("DELETE FROM join_tokens WHERE expires_at <= ?").run(at);
+    db.prepare("DELETE FROM host_link_requests WHERE expires_at <= ?").run(at);
+  };
+  const mintJoinToken = (userId, hostId) => {
+    const token = randomBytes(32).toString("base64url");
+    const expiresAt = now() + JOIN_TOKEN_TTL_MS;
+    db.prepare("INSERT INTO join_tokens (token_hash, user_id, created_at, expires_at, host_id) VALUES (?, ?, ?, ?, ?)").run(sha256Hex(token), userId, now(), expiresAt, hostId);
+    return { token, expiresAt };
+  };
+  const pendingByCode = (userId, userCode, ip) => {
+    const userKey = String(userId);
+    if (linkUserFailures.isOver(userKey, linkLimits.userMaxFailures) || linkIpFailures.isOver(ip, linkLimits.ipMaxFailures)) {
+      return "limited";
+    }
+    const code = normalizeUserCode(userCode);
+    const codeHash = code === undefined ? undefined : sha256Hex(code);
+    const row = codeHash === undefined ? undefined : db.prepare(`SELECT host_id AS hostId, host_name AS name, host_os AS os, source_ip AS sourceIp, expires_at AS expiresAt
+               FROM host_link_requests WHERE user_code_hash = ? AND state = 'pending' AND expires_at > ?`).get(codeHash, now());
+    if (codeHash === undefined || row === undefined) {
+      linkUserFailures.bump(userKey, linkLimits.failureWindowMs);
+      linkIpFailures.bump(ip, linkLimits.failureWindowMs);
+      return "not_found";
+    }
+    return { codeHash, row };
+  };
+  const settleHostLink = (args, state) => {
+    const found = pendingByCode(args.userId, args.userCode, args.ip);
+    if (found === "limited" || found === "not_found")
+      return { status: found };
+    const settled = db.prepare(`UPDATE host_link_requests SET state = ?, user_id = ?, host_name = NULL, host_os = NULL, source_ip = NULL
+         WHERE user_code_hash = ? AND state = 'pending' AND expires_at > ?`).run(state, state === "confirmed" ? args.userId : null, found.codeHash, now());
+    return Number(settled.changes) === 1 ? { status: "ok" } : { status: "not_found" };
+  };
+  const deviceForSignIn = (userId, claim) => {
+    const at = now();
+    if (claim === undefined) {
+      db.prepare(`DELETE FROM account_devices WHERE user_id = ? AND client_id IS NULL
+           AND NOT EXISTS (SELECT 1 FROM sessions s WHERE s.device_id = account_devices.id AND s.expires_at > ?)
+           AND NOT EXISTS (SELECT 1 FROM vouchings v WHERE v.device_id = account_devices.id)`).run(userId, at);
+      return Number(db.prepare("INSERT INTO account_devices (user_id, created_at, last_seen_at) VALUES (?, ?, ?)").run(userId, at, at).lastInsertRowid);
+    }
+    const row = db.prepare(`INSERT INTO account_devices (user_id, client_id, name, created_at, last_seen_at) VALUES (?, ?, ?, ?, ?)
+         ON CONFLICT (user_id, client_id) DO UPDATE SET
+           name = COALESCE(excluded.name, name), last_seen_at = excluded.last_seen_at, kicked_at = NULL
+         RETURNING id`).get(userId, claim.id, claim.name ?? null, at, at);
+    return row.id;
+  };
+  const issueSession = (userId, device) => {
     db.prepare("DELETE FROM sessions WHERE expires_at <= ?").run(now());
+    const deviceId = deviceForSignIn(userId, device);
     const token = randomBytes(32).toString("base64url");
     const expiresAt = now() + SESSION_TTL_MS;
-    db.prepare("INSERT INTO sessions (token_hash, user_id, created_at, expires_at) VALUES (?, ?, ?, ?)").run(sha256Hex(token), userId, now(), expiresAt);
+    db.prepare("INSERT INTO sessions (token_hash, user_id, created_at, expires_at, device_id) VALUES (?, ?, ?, ?, ?)").run(sha256Hex(token), userId, now(), expiresAt, deviceId);
     return { token, expiresAt };
   };
+  const sweepVouchings = () => {
+    db.prepare("DELETE FROM vouchings WHERE public_key IS NULL AND expires_at <= ?").run(now() - ADMISSION_REPORT_GRACE_MS);
+  };
+  const withdrawDevice = (deviceId) => {
+    const at = now();
+    sweepVouchings();
+    db.prepare("DELETE FROM sessions WHERE device_id = ?").run(deviceId);
+    db.prepare("DELETE FROM push_tokens WHERE device_id = ?").run(deviceId);
+    db.prepare("UPDATE account_devices SET kicked_at = ? WHERE id = ?").run(at, deviceId);
+    const hostIds = db.prepare("SELECT DISTINCT host_id AS hostId FROM vouchings WHERE device_id = ? AND public_key IS NOT NULL AND revoked_at IS NULL").all(deviceId).map((row) => row.hostId);
+    db.prepare(`INSERT OR IGNORE INTO pending_revocations (host_id, public_key, created_at)
+       SELECT host_id, public_key, ? FROM vouchings
+       WHERE device_id = ? AND public_key IS NOT NULL AND revoked_at IS NULL`).run(at, deviceId);
+    db.prepare("UPDATE vouchings SET revoked_at = ? WHERE device_id = ? AND revoked_at IS NULL").run(at, deviceId);
+    return hostIds;
+  };
+  const currentHash = (userId) => db.prepare("SELECT password_hash AS passwordHash FROM users WHERE id = ?").get(userId)?.passwordHash;
+  const checkPassword = async (userId, username, password) => {
+    if (userFailures.isOver(username, limits.userMaxFailures))
+      return "limited";
+    const stored = currentHash(userId);
+    const outcome = await gate.run(async () => {
+      if (userFailures.isOver(username, limits.userMaxFailures))
+        return "limited";
+      if (!await verifyPassword(password, stored ?? DUMMY_HASH) || stored === undefined) {
+        userFailures.bump(username, limits.userWindowMs);
+        return "wrong_password";
+      }
+      return "ok";
+    });
+    if (outcome === undefined || outcome === "limited")
+      return "limited";
+    if (outcome === "wrong_password")
+      return "wrong_password";
+    userFailures.reset(username);
+    return { verifiedHash: stored };
+  };
   const inviteState = (codeHash) => {
     const row = db.prepare("SELECT expires_at AS expiresAt, used_at AS usedAt FROM invites WHERE code_hash = ?").get(codeHash);
     if (row === undefined || row.usedAt !== null)
@@ -321,7 +550,7 @@ async function openAccounts(options) {
   const usernameTaken = (username) => db.prepare("SELECT 1 AS x FROM users WHERE lower(username) = ?").get(username) !== undefined;
   return {
     dbPath: join(options.dataDir, DB_FILE),
-    async login(username, password, ip) {
+    async login(username, password, ip, device) {
       if (ipAttempts.hit(ip, limits.ipMaxAttempts, limits.ipWindowMs))
         return { status: "limited" };
       if (userFailures.isOver(username, limits.userMaxFailures))
@@ -341,10 +570,22 @@ async function openAccounts(options) {
         return { status: "limited" };
       if (outcome === "invalid")
         return { status: "invalid" };
+      db.exec("BEGIN IMMEDIATE");
+      let session;
+      try {
+        if (currentHash(outcome) === user?.passwordHash)
+          session = issueSession(outcome, device);
+        db.exec("COMMIT");
+      } catch (error) {
+        db.exec("ROLLBACK");
+        throw error;
+      }
+      if (session === undefined)
+        return { status: "invalid" };
       userFailures.reset(username);
-      return { status: "ok", ...issueSession(outcome), admin: user?.admin === 1 };
+      return { status: "ok", ...session, admin: user?.admin === 1 };
     },
-    async register({ invite, username, password, ip }) {
+    async register({ invite, username, password, ip, device }) {
       if (ipAttempts.hit(ip, limits.ipMaxAttempts, limits.ipWindowMs))
         return { status: "limited" };
       const codeHash = sha256Hex(invite);
@@ -376,7 +617,7 @@ async function openAccounts(options) {
           db.exec("ROLLBACK");
           return { status: "refused", reason: "invalid_invite" };
         }
-        const session = issueSession(userId);
+        const session = issueSession(userId, device);
         db.exec("COMMIT");
         return { status: "ok", ...session };
       } catch (error) {
@@ -406,14 +647,86 @@ async function openAccounts(options) {
       return Number(db.prepare("DELETE FROM invites WHERE id = ? AND used_at IS NULL").run(id).changes) > 0;
     },
     authenticate(token) {
-      const row = db.prepare(`SELECT s.user_id AS userId, u.username AS username, u.admin AS admin, s.expires_at AS expiresAt
+      const row = db.prepare(`SELECT s.user_id AS userId, u.username AS username, u.admin AS admin, s.expires_at AS expiresAt, s.device_id AS deviceId
            FROM sessions s JOIN users u ON u.id = s.user_id WHERE s.token_hash = ?`).get(sha256Hex(token));
       if (row === undefined || row.expiresAt <= now())
         return;
-      return { userId: row.userId, username: row.username, admin: row.admin === 1 };
+      return {
+        userId: row.userId,
+        username: row.username,
+        admin: row.admin === 1,
+        ...row.deviceId === null ? {} : { deviceId: row.deviceId }
+      };
+    },
+    logout(token, options2) {
+      const tokenHash = sha256Hex(token);
+      if (options2?.revoke !== true) {
+        db.prepare("DELETE FROM sessions WHERE token_hash = ?").run(tokenHash);
+        return [];
+      }
+      db.exec("BEGIN IMMEDIATE");
+      try {
+        const session = db.prepare("SELECT device_id AS deviceId FROM sessions WHERE token_hash = ?").get(tokenHash);
+        db.prepare("DELETE FROM sessions WHERE token_hash = ?").run(tokenHash);
+        const hostIds = session?.deviceId == null ? [] : withdrawDevice(session.deviceId);
+        db.exec("COMMIT");
+        return hostIds;
+      } catch (error) {
+        db.exec("ROLLBACK");
+        throw error;
+      }
     },
-    logout(token) {
-      db.prepare("DELETE FROM sessions WHERE token_hash = ?").run(sha256Hex(token));
+    async changePassword({ userId, username, keepToken, currentPassword, newPassword }) {
+      const length = [...newPassword].length;
+      if (length < MIN_PASSWORD_CODEPOINTS || length > MAX_PASSWORD_CODEPOINTS) {
+        return { status: "refused", reason: "weak_password" };
+      }
+      const checked = await checkPassword(userId, username, currentPassword);
+      if (checked === "limited")
+        return { status: "limited" };
+      if (checked === "wrong_password")
+        return { status: "refused", reason: "wrong_password" };
+      const hash = await gate.run(() => hashPassword(newPassword));
+      if (hash === undefined)
+        return { status: "limited" };
+      db.exec("BEGIN IMMEDIATE");
+      try {
+        const swapped = db.prepare("UPDATE users SET password_hash = ? WHERE id = ? AND password_hash = ?").run(hash, userId, checked.verifiedHash);
+        if (Number(swapped.changes) !== 1) {
+          db.exec("ROLLBACK");
+          return { status: "refused", reason: "wrong_password" };
+        }
+        dropCredentials(db, userId, sha256Hex(keepToken));
+        db.exec("COMMIT");
+      } catch (error) {
+        db.exec("ROLLBACK");
+        throw error;
+      }
+      return { status: "ok" };
+    },
+    async deleteAccount({ userId, username, password }) {
+      const user = db.prepare("SELECT admin FROM users WHERE id = ?").get(userId);
+      if (user?.admin === 1)
+        return { status: "refused", reason: "admin_account" };
+      const checked = await checkPassword(userId, username, password);
+      if (checked === "limited")
+        return { status: "limited" };
+      if (checked === "wrong_password")
+        return { status: "refused", reason: "wrong_password" };
+      db.exec("BEGIN IMMEDIATE");
+      try {
+        const hostIds = db.prepare("SELECT host_id AS hostId FROM hosts WHERE user_id = ?").all(userId).map((row) => row.hostId);
+        const deleted = db.prepare("DELETE FROM users WHERE id = ? AND password_hash = ?").run(userId, checked.verifiedHash);
+        if (Number(deleted.changes) !== 1) {
+          db.exec("ROLLBACK");
+          return { status: "refused", reason: "wrong_password" };
+        }
+        db.exec("COMMIT");
+        return { status: "ok", hostIds };
+      } catch (error) {
+        db.exec("ROLLBACK");
+        throw error;
+      }
     },
     revokeAllSessions(userId) {
       db.exec("BEGIN");
@@ -433,13 +746,14 @@ async function openAccounts(options) {
       const row = db.prepare("SELECT user_id AS userId FROM hosts WHERE host_id = ?").get(hostId);
       return row?.userId;
     },
-    registerPushToken(userId, token, environment) {
+    registerPushToken(userId, token, environment, deviceId) {
       const at = now();
       db.exec("BEGIN");
       try {
         db.prepare("DELETE FROM push_tokens WHERE updated_at < ?").run(at - PUSH_TOKEN_TTL_MS);
-        db.prepare(`INSERT INTO push_tokens (token, environment, user_id, updated_at) VALUES (?, ?, ?, ?)
-           ON CONFLICT (token, environment) DO UPDATE SET user_id = excluded.user_id, updated_at = excluded.updated_at`).run(token.toLowerCase(), environment, userId, at);
+        db.prepare(`INSERT INTO push_tokens (token, environment, user_id, updated_at, device_id) VALUES (?, ?, ?, ?, ?)
+           ON CONFLICT (token, environment) DO UPDATE SET
+             user_id = excluded.user_id, updated_at = excluded.updated_at, device_id = excluded.device_id`).run(token.toLowerCase(), environment, userId, at, deviceId ?? null);
         db.prepare(`DELETE FROM push_tokens WHERE user_id = ? AND rowid NOT IN (
              SELECT rowid FROM push_tokens WHERE user_id = ? ORDER BY updated_at DESC LIMIT ?
            )`).run(userId, userId, MAX_PUSH_TOKENS_PER_USER);
@@ -460,22 +774,96 @@ async function openAccounts(options) {
       db.prepare("DELETE FROM push_tokens WHERE token = ? AND environment = ? AND updated_at < ?").run(token.toLowerCase(), environment, unregisteredAt);
     },
     createJoinToken(userId) {
-      db.prepare("DELETE FROM join_tokens WHERE expires_at <= ?").run(now());
-      const token = randomBytes(32).toString("base64url");
-      const expiresAt = now() + JOIN_TOKEN_TTL_MS;
-      db.prepare("INSERT INTO join_tokens (token_hash, user_id, created_at, expires_at) VALUES (?, ?, ?, ?)").run(sha256Hex(token), userId, now(), expiresAt);
-      return { token, expiresAt };
+      sweepExpired();
+      return mintJoinToken(userId, null);
+    },
+    startHostLink({ hostId, name, os, ip }) {
+      if (linkStarts.hit(ip, linkLimits.startMaxPerIp, linkLimits.startWindowMs))
+        return { status: "limited" };
+      sweepExpired();
+      const live = db.prepare("SELECT COUNT(*) AS n FROM host_link_requests").get().n;
+      if (live >= linkLimits.maxPending)
+        return { status: "busy" };
+      const deviceCode = randomBytes(32).toString("base64url");
+      const at = now();
+      const expiresAt = at + HOST_LINK_TTL_MS;
+      const insert = db.prepare(`INSERT INTO host_link_requests
+           (device_code_hash, user_code_hash, host_id, host_name, host_os, source_ip, interval_s, created_at, expires_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`);
+      for (let attempt = 0;; attempt++) {
+        const code = Array.from({ length: USER_CODE_LENGTH }, () => USER_CODE_ALPHABET[randomInt(USER_CODE_ALPHABET.length)]).join("");
+        try {
+          insert.run(sha256Hex(deviceCode), sha256Hex(code), hostId, normalizeHostName(name), [...os.trim()].slice(0, HOST_OS_MAX_CODEPOINTS).join(""), ip, HOST_LINK_INTERVAL_S, at, expiresAt);
+          return { status: "ok", deviceCode, userCode: formatUserCode(code), expiresAt, interval: HOST_LINK_INTERVAL_S };
+        } catch (error) {
+          if (attempt >= 4 || !String(error).includes("UNIQUE"))
+            throw error;
+        }
+      }
+    },
+    pollHostLink(deviceCode) {
+      const deviceCodeHash = sha256Hex(deviceCode);
+      const at = now();
+      db.exec("BEGIN IMMEDIATE");
+      try {
+        const row = db.prepare(`SELECT host_id AS hostId, state, user_id AS userId, interval_s AS intervalS, last_poll_at AS lastPollAt, expires_at AS expiresAt
+             FROM host_link_requests WHERE device_code_hash = ?`).get(deviceCodeHash);
+        let result;
+        if (row === undefined || row.expiresAt <= at) {
+          db.prepare("DELETE FROM host_link_requests WHERE device_code_hash = ?").run(deviceCodeHash);
+          result = { status: "expired" };
+        } else if (row.lastPollAt !== null && at - row.lastPollAt < row.intervalS * 1000 - POLL_SLACK_MS) {
+          const interval = row.intervalS + SLOW_DOWN_STEP_S;
+          db.prepare("UPDATE host_link_requests SET interval_s = ?, last_poll_at = ? WHERE device_code_hash = ?").run(interval, at, deviceCodeHash);
+          result = { status: "slow_down", interval };
+        } else if (row.state === "pending") {
+          db.prepare("UPDATE host_link_requests SET last_poll_at = ? WHERE device_code_hash = ?").run(at, deviceCodeHash);
+          result = { status: "pending" };
+        } else {
+          db.prepare("DELETE FROM host_link_requests WHERE device_code_hash = ?").run(deviceCodeHash);
+          result = row.state === "confirmed" && row.userId !== null ? { status: "confirmed", ...mintJoinToken(row.userId, row.hostId) } : { status: "denied" };
+        }
+        db.exec("COMMIT");
+        return result;
+      } catch (error) {
+        db.exec("ROLLBACK");
+        throw error;
+      }
     },
+    lookupHostLink({ userId, userCode, ip }) {
+      const found = pendingByCode(userId, userCode, ip);
+      if (found === "limited" || found === "not_found")
+        return { status: found };
+      const { row } = found;
+      return {
+        status: "ok",
+        request: {
+          hostId: row.hostId,
+          name: row.name ?? "",
+          os: row.os ?? "",
+          sourceIp: row.sourceIp ?? "",
+          ipDiffers: row.sourceIp !== ip,
+          expiresAt: row.expiresAt
+        }
+      };
+    },
+    confirmHostLink(args) {
+      return settleHostLink(args, "confirmed");
+    },
+    denyHostLink(args) {
+      return settleHostLink(args, "denied");
+    },
+    sweepExpired,
     joinHost({ token, hostId, noisePublicKey, name }) {
       const tokenHash = sha256Hex(token);
       const at = now();
       db.exec("BEGIN");
       try {
-        const row = db.prepare("SELECT user_id AS userId, expires_at AS expiresAt, used_at AS usedAt FROM join_tokens WHERE token_hash = ?").get(tokenHash);
+        const row = db.prepare("SELECT user_id AS userId, expires_at AS expiresAt, used_at AS usedAt, host_id AS boundHostId FROM join_tokens WHERE token_hash = ?").get(tokenHash);
         let failure;
-        if (row === undefined || row.usedAt !== null)
+        if (row === undefined || row.usedAt !== null || row.boundHostId !== null && row.boundHostId !== hostId) {
           failure = "invalid_token";
-        else if (row.expiresAt <= at)
+        } else if (row.expiresAt <= at)
           failure = "expired_token";
         else {
           const consumed = db.prepare("UPDATE join_tokens SET used_at = ? WHERE token_hash = ? AND used_at IS NULL").run(at, tokenHash);
@@ -487,6 +875,11 @@ async function openAccounts(options) {
           return { status: "refused", reason: failure };
         }
         const hostName = name === undefined ? "Unknown host" : normalizeHostName(name);
+        const previousOwner = db.prepare("SELECT user_id AS userId FROM hosts WHERE host_id = ?").get(hostId)?.userId;
+        if (previousOwner !== undefined && previousOwner !== row.userId) {
+          db.prepare("DELETE FROM vouchings WHERE host_id = ?").run(hostId);
+          db.prepare("DELETE FROM pending_revocations WHERE host_id = ?").run(hostId);
+        }
         db.prepare(`INSERT INTO hosts (host_id, user_id, noise_public_key, name, joined_at, last_seen_at)
            VALUES (?, ?, ?, ?, ?, ?)
            ON CONFLICT(host_id) DO UPDATE SET
@@ -508,16 +901,111 @@ async function openAccounts(options) {
     },
     listHosts(userId) {
       return db.prepare(`SELECT host_id AS hostId, user_id AS userId, noise_public_key AS noisePublicKey,
-                  name, joined_at AS joinedAt, last_seen_at AS lastSeenAt
-           FROM hosts WHERE user_id = ? ORDER BY joined_at`).all(userId);
+                    name, joined_at AS joinedAt, last_seen_at AS lastSeenAt, device_reports AS deviceReports
+             FROM hosts WHERE user_id = ? ORDER BY joined_at`).all(userId).map((row) => ({ ...row, deviceReports: row.deviceReports === 1 }));
     },
     hostFor(userId, hostId) {
-      return db.prepare(`SELECT host_id AS hostId, user_id AS userId, noise_public_key AS noisePublicKey,
-                  name, joined_at AS joinedAt, last_seen_at AS lastSeenAt
+      const row = db.prepare(`SELECT host_id AS hostId, user_id AS userId, noise_public_key AS noisePublicKey,
+                  name, joined_at AS joinedAt, last_seen_at AS lastSeenAt, device_reports AS deviceReports
            FROM hosts WHERE user_id = ? AND host_id = ?`).get(userId, hostId);
+      return row === undefined ? undefined : { ...row, deviceReports: row.deviceReports === 1 };
+    },
+    markHostSeen(hostId, deviceReports) {
+      db.prepare("UPDATE hosts SET last_seen_at = ?, device_reports = ? WHERE host_id = ?").run(now(), deviceReports ? 1 : 0, hostId);
+    },
+    listDevices(userId) {
+      const devices = db.prepare(`SELECT id, name, created_at AS createdAt, last_seen_at AS lastSeenAt, kicked_at AS kickedAt
+           FROM account_devices WHERE user_id = ? ORDER BY last_seen_at DESC, id DESC`).all(userId);
+      const keys = db.prepare(`SELECT v.device_id AS deviceId, v.host_id AS hostId, h.name AS hostName,
+                  v.revoked_at IS NOT NULL AS revoked,
+                  EXISTS (SELECT 1 FROM pending_revocations p WHERE p.host_id = v.host_id AND p.public_key = v.public_key) AS pending
+           FROM vouchings v JOIN hosts h ON h.host_id = v.host_id JOIN account_devices d ON d.id = v.device_id
+           WHERE d.user_id = ? AND v.public_key IS NOT NULL
+           ORDER BY h.joined_at, v.host_id`).all(userId);
+      const rank = { registered: 2, revoking: 1, revoked: 0 };
+      const hosts = new Map;
+      for (const key of keys) {
+        const state = key.pending === 1 ? "revoking" : key.revoked === 1 ? "revoked" : "registered";
+        const perDevice = hosts.get(key.deviceId) ?? new Map;
+        hosts.set(key.deviceId, perDevice);
+        const seen = perDevice.get(key.hostId);
+        if (seen === undefined || rank[state] > rank[seen.state])
+          perDevice.set(key.hostId, { hostId: key.hostId, name: key.hostName, state });
+      }
+      return devices.map((device) => ({
+        id: device.id,
+        ...device.name === null ? {} : { name: device.name },
+        createdAt: device.createdAt,
+        lastSeenAt: device.lastSeenAt,
+        ...device.kickedAt === null ? {} : { kickedAt: device.kickedAt },
+        hosts: [...hosts.get(device.id)?.values() ?? []]
+      }));
     },
-    markHostSeen(hostId) {
-      db.prepare("UPDATE hosts SET last_seen_at = ? WHERE host_id = ?").run(now(), hostId);
+    recordVouching({ token, hostId, requestId, expiresAt }) {
+      sweepVouchings();
+      const session = db.prepare(`SELECT s.device_id AS deviceId FROM sessions s JOIN hosts h ON h.user_id = s.user_id
+           WHERE s.token_hash = ? AND s.expires_at > ? AND h.host_id = ?`).get(sha256Hex(token), now(), hostId);
+      if (session === undefined)
+        return false;
+      if (session.deviceId !== null) {
+        db.prepare("INSERT OR IGNORE INTO vouchings (request_id, device_id, host_id, expires_at) VALUES (?, ?, ?, ?)").run(requestId, session.deviceId, hostId, Math.min(expiresAt, now() + MAX_OFFER_TTL_MS));
+      }
+      return true;
+    },
+    recordAdmission(hostId, requestId, publicKey) {
+      db.exec("BEGIN");
+      try {
+        const vouching = db.prepare(`SELECT expires_at AS expiresAt, public_key AS publicKey, revoked_at AS revokedAt
+             FROM vouchings WHERE request_id = ? AND host_id = ?`).get(requestId, hostId);
+        if (vouching === undefined || vouching.publicKey !== null || vouching.expiresAt + ADMISSION_REPORT_GRACE_MS <= now()) {
+          db.exec("ROLLBACK");
+          return "ignored";
+        }
+        db.prepare("UPDATE vouchings SET public_key = ?, admitted_at = ? WHERE request_id = ?").run(publicKey, now(), requestId);
+        if (vouching.revokedAt !== null) {
+          db.prepare("INSERT OR IGNORE INTO pending_revocations (host_id, public_key, created_at) VALUES (?, ?, ?)").run(hostId, publicKey, now());
+        }
+        db.exec("COMMIT");
+        return vouching.revokedAt === null ? "recorded" : "revoke";
+      } catch (error) {
+        db.exec("ROLLBACK");
+        throw error;
+      }
+    },
+    pendingRevocations(hostId) {
+      return db.prepare("SELECT public_key AS publicKey FROM pending_revocations WHERE host_id = ? ORDER BY created_at").all(hostId).map((row) => row.publicKey);
+    },
+    confirmRevocation(hostId, publicKey) {
+      db.prepare("DELETE FROM pending_revocations WHERE host_id = ? AND public_key = ?").run(hostId, publicKey);
+    },
+    async kickDevice({ userId, username, password, deviceId, currentDeviceId }) {
+      const owned = () => db.prepare("SELECT 1 AS x FROM account_devices WHERE id = ? AND user_id = ?").get(deviceId, userId) !== undefined;
+      if (!owned())
+        return { status: "refused", reason: "not_found" };
+      if (deviceId === currentDeviceId)
+        return { status: "refused", reason: "current_device" };
+      const checked = await checkPassword(userId, username, password);
+      if (checked === "limited")
+        return { status: "limited" };
+      if (checked === "wrong_password")
+        return { status: "refused", reason: "wrong_password" };
+      db.exec("BEGIN IMMEDIATE");
+      try {
+        if (currentHash(userId) !== checked.verifiedHash) {
+          db.exec("ROLLBACK");
+          return { status: "refused", reason: "wrong_password" };
+        }
+        if (!owned()) {
+          db.exec("ROLLBACK");
+          return { status: "refused", reason: "not_found" };
+        }
+        const hostIds = withdrawDevice(deviceId);
+        db.exec("COMMIT");
+        return { status: "ok", hostIds };
+      } catch (error) {
+        db.exec("ROLLBACK");
+        throw error;
+      }
     },
     renameHost(hostId, name) {
       db.prepare("UPDATE hosts SET name = ? WHERE host_id = ?").run(normalizeHostName(name), hostId);
@@ -528,26 +1016,41 @@ async function openAccounts(options) {
     }
   };
 }
-async function changePassword(options) {
+function dropCredentials(db, userId, keepTokenHash) {
+  if (keepTokenHash === undefined)
+    db.prepare("DELETE FROM sessions WHERE user_id = ?").run(userId);
+  else
+    db.prepare("DELETE FROM sessions WHERE user_id = ? AND token_hash <> ?").run(userId, keepTokenHash);
+  db.prepare("DELETE FROM join_tokens WHERE user_id = ? AND used_at IS NULL").run(userId);
+  db.prepare("DELETE FROM host_link_requests WHERE user_id = ?").run(userId);
+  db.prepare("DELETE FROM push_tokens WHERE user_id = ?").run(userId);
+}
+async function resetPassword(options) {
   assertPasswordPolicy(options.password);
   await mkdir(options.dataDir, { recursive: true });
-  const release = await lockDataDir(options.dataDir, { retries: 0 });
-  const db = new DatabaseSync(join(options.dataDir, DB_FILE));
+  const release = await lockDataDir(options.dataDir, { retries: 0 }).catch((error) => {
+    if (isDataDirInUse(error))
+      return;
+    throw error;
+  });
+  const db = openDatabase(options.dataDir);
   try {
-    migrate(db);
-    const users = options.user === undefined ? db.prepare("SELECT id FROM users").all() : db.prepare("SELECT id FROM users WHERE username = ?").all(options.user);
-    if (users.length === 0)
-      throw new Error(options.user === undefined ? "no account exists yet" : `no such account: ${options.user}`);
-    if (users.length > 1)
-      throw new Error("more than one account exists — pass --user");
-    const userId = users[0].id;
+    if (release !== undefined) {
+      migrate(db);
+    } else if (schemaVersion(db) !== SCHEMA_VERSION) {
+      throw new Error(`the running server's database schema (${schemaVersion(db)}) differs from this build's (${SCHEMA_VERSION}); restart the server on this version first`);
+    }
     const hash = await hashPassword(options.password);
-    db.exec("BEGIN");
+    db.exec("BEGIN IMMEDIATE");
     try {
+      const users = options.user === undefined ? db.prepare("SELECT id FROM users").all() : db.prepare("SELECT id FROM users WHERE username = ?").all(options.user);
+      if (users.length === 0)
+        throw new Error(options.user === undefined ? "no account exists yet" : `no such account: ${options.user}`);
+      if (users.length > 1)
+        throw new Error("more than one account exists — pass --user");
+      const userId = users[0].id;
       db.prepare("UPDATE users SET password_hash = ? WHERE id = ?").run(hash, userId);
-      db.prepare("DELETE FROM sessions WHERE user_id = ?").run(userId);
-      db.prepare("DELETE FROM join_tokens WHERE user_id = ? AND used_at IS NULL").run(userId);
-      db.prepare("DELETE FROM push_tokens WHERE user_id = ?").run(userId);
+      dropCredentials(db, userId);
       db.exec("COMMIT");
     } catch (error) {
       db.exec("ROLLBACK");
@@ -555,7 +1058,7 @@ async function changePassword(options) {
     }
   } finally {
     db.close();
-    await release();
+    await release?.();
   }
 }
 
@@ -789,8 +1292,136 @@ import { once } from "node:events";
 import { createServer } from "node:http";
 import { WebSocket, WebSocketServer } from "ws";
 
+// apps/server/src/relay-limits.ts
+var DEFAULT_RELAY_LIMITS = {
+  perHost: 64,
+  perAccount: 256,
+  unauthenticatedPerHost: 32,
+  handshakeTimeoutMs: 30000,
+  handshakeBytes: 64 * 1024,
+  accountBytesPerSecond: 4 * 1024 * 1024,
+  accountBurstBytes: 1024 * 1024 * 1024
+};
+var RELAY_LIMIT_OPTIONS = [
+  { field: "perHost", flag: "relay-max-per-host", env: "PINOMAD_SERVER_RELAY_MAX_PER_HOST", unit: "count" },
+  { field: "perAccount", flag: "relay-max-per-account", env: "PINOMAD_SERVER_RELAY_MAX_PER_ACCOUNT", unit: "count" },
+  {
+    field: "unauthenticatedPerHost",
+    flag: "relay-max-unauthenticated-per-host",
+    env: "PINOMAD_SERVER_RELAY_MAX_UNAUTHENTICATED_PER_HOST",
+    unit: "count"
+  },
+  { field: "handshakeTimeoutMs", flag: "relay-handshake-timeout", env: "PINOMAD_SERVER_RELAY_HANDSHAKE_TIMEOUT", unit: "seconds" },
+  { field: "handshakeBytes", flag: "relay-handshake-bytes", env: "PINOMAD_SERVER_RELAY_HANDSHAKE_BYTES", unit: "bytes" },
+  { field: "accountBytesPerSecond", flag: "relay-account-rate", env: "PINOMAD_SERVER_RELAY_ACCOUNT_RATE", unit: "bytes" },
+  { field: "accountBurstBytes", flag: "relay-account-burst", env: "PINOMAD_SERVER_RELAY_ACCOUNT_BURST", unit: "bytes" }
+];
+var BYTE_SUFFIX = { "": 1, k: 1024, m: 1024 ** 2, g: 1024 ** 3 };
+function readRelayLimits(flags, env) {
+  const limits = {};
+  for (const option of RELAY_LIMIT_OPTIONS) {
+    const flag = flags[option.flag];
+    const raw = typeof flag === "string" ? flag : env[option.env];
+    if (raw === undefined)
+      continue;
+    const match = /^(\d+)([kmg]?)$/i.exec(raw.trim());
+    const suffix = match?.[2]?.toLowerCase() ?? "";
+    if (match === null || option.unit !== "bytes" && suffix !== "") {
+      throw new Error(`--${option.flag} (${option.env}) must be a whole number${option.unit === "bytes" ? " with an optional k/m/g suffix" : ""}, got "${raw}"`);
+    }
+    const value = Number(match[1]) * BYTE_SUFFIX[suffix];
+    limits[option.field] = option.unit === "seconds" ? value * 1000 : value;
+  }
+  return limits;
+}
+var TRAFFIC_LIMIT = { code: RELAY_CLOSE.trafficLimit, reason: "account traffic limit" };
+var HANDSHAKE_TRAFFIC = { code: RELAY_CLOSE.trafficLimit, reason: "too much data before the handshake" };
+function createRelayLimiter(limits, now = Date.now) {
+  const hosts = new Map;
+  const accounts = new Map;
+  const rate = limits.accountBytesPerSecond;
+  const capacity = limits.accountBurstBytes > 0 ? limits.accountBurstBytes : rate;
+  const over = (cap, count) => cap > 0 && count >= cap;
+  function refill(state) {
+    const at = now();
+    state.tokens = Math.min(capacity, state.tokens + (at - state.updatedAt) / 1000 * rate);
+    state.updatedAt = at;
+  }
+  return {
+    admit(hostId, account) {
+      const host = hosts.get(hostId) ?? { connections: 0, unauthenticated: 0 };
+      const owner = accounts.get(account) ?? { connections: 0, tokens: capacity, updatedAt: now() };
+      if (rate > 0) {
+        refill(owner);
+        if (owner.tokens < 0)
+          return { ok: false, ...TRAFFIC_LIMIT };
+      }
+      if (over(limits.perHost, host.connections)) {
+        return { ok: false, code: RELAY_CLOSE.tooManyConnections, reason: "too many connections to this host" };
+      }
+      if (over(limits.perAccount, owner.connections)) {
+        return { ok: false, code: RELAY_CLOSE.tooManyConnections, reason: "too many connections for this account" };
+      }
+      if (over(limits.unauthenticatedPerHost, host.unauthenticated)) {
+        return { ok: false, code: RELAY_CLOSE.tooManyConnections, reason: "too many pending handshakes for this host" };
+      }
+      hosts.set(hostId, host);
+      accounts.set(account, owner);
+      host.connections += 1;
+      host.unauthenticated += 1;
+      owner.connections += 1;
+      let authenticated = false;
+      let released = false;
+      let handshakeBytes = 0;
+      return {
+        ok: true,
+        lease: {
+          authenticate() {
+            if (authenticated || released)
+              return;
+            authenticated = true;
+            host.unauthenticated -= 1;
+          },
+          charge(bytes) {
+            if (!authenticated) {
+              handshakeBytes += bytes;
+              return limits.handshakeBytes > 0 && handshakeBytes > limits.handshakeBytes ? HANDSHAKE_TRAFFIC : undefined;
+            }
+            if (rate <= 0)
+              return;
+            refill(owner);
+            owner.tokens -= bytes;
+            return owner.tokens < 0 ? TRAFFIC_LIMIT : undefined;
+          },
+          release() {
+            if (released)
+              return;
+            released = true;
+            host.connections -= 1;
+            if (!authenticated)
+              host.unauthenticated -= 1;
+            owner.connections -= 1;
+            if (host.connections === 0 && hosts.get(hostId) === host)
+              hosts.delete(hostId);
+            if (owner.connections === 0 && accounts.get(account) === owner) {
+              if (rate > 0)
+                refill(owner);
+              if (rate <= 0 || owner.tokens >= capacity)
+                accounts.delete(account);
+            }
+          }
+        }
+      };
+    },
+    forgetAccount(account) {
+      accounts.delete(account);
+    }
+  };
+}
+
 // apps/server/src/api.ts
 var SESSION_COOKIE = "__Host-pinomad-session";
+var HOST_ID_PATTERN = /^[A-Za-z0-9_-]{43}$/;
 var MAX_BODY = 8 * 1024;
 var MUTATING = new Set(["POST", "PUT", "PATCH", "DELETE"]);
 var DESKTOP_ORIGIN = "app://pinomad";
@@ -816,7 +1447,7 @@ function respond(response, status, body, headers) {
   response.writeHead(status, all);
   response.end(body === undefined ? undefined : JSON.stringify(body));
 }
-async function readJson(request) {
+async function readJson(request, optional = false) {
   const chunks = [];
   let size = 0;
   let tooLarge = false;
@@ -830,6 +1461,8 @@ async function readJson(request) {
   }
   if (tooLarge)
     return { ok: false, tooLarge: true };
+  if (optional && size === 0)
+    return { ok: true, value: undefined };
   try {
     return { ok: true, value: JSON.parse(Buffer.concat(chunks).toString("utf8")) };
   } catch {
@@ -879,7 +1512,8 @@ async function handleApiRequest(request, response, ctx) {
   }
   const bearer = (request.headers.authorization ?? "").startsWith("Bearer ");
   const loginTokenMode = (pathname === "/api/login" || pathname === "/api/register") && (origin === undefined || origin === DESKTOP_ORIGIN);
-  if (MUTATING.has(method) && !bearer && !loginTokenMode && origin !== ctx.publicOrigin) {
+  const hostLinkHostMode = (pathname === "/api/host-link/start" || pathname === "/api/host-link/poll") && origin === undefined;
+  if (MUTATING.has(method) && !bearer && !loginTokenMode && !hostLinkHostMode && origin !== ctx.publicOrigin) {
     deny(403, "origin_mismatch");
     return;
   }
@@ -899,11 +1533,12 @@ async function handleApiRequest(request, response, ctx) {
       return;
     }
     const { username, password } = value;
-    if ([...username].length === 0 || [...username].length > MAX_USERNAME_CODEPOINTS || [...password].length > MAX_PASSWORD_CODEPOINTS) {
+    const device = parseDeviceClaim(value.device);
+    if ([...username].length === 0 || [...username].length > MAX_USERNAME_CODEPOINTS || [...password].length > MAX_PASSWORD_CODEPOINTS || device === "invalid") {
       deny(400, "invalid_request");
       return;
     }
-    const result = await accounts.login(username, password, clientIp(request, ctx.trustProxy));
+    const result = await accounts.login(username, password, clientIp(request, ctx.trustProxy), device);
     if (result.status === "limited") {
       deny(429, "rate_limited");
       return;
@@ -932,7 +1567,8 @@ async function handleApiRequest(request, response, ctx) {
       return;
     }
     const value = body.value;
-    if (typeof value?.invite !== "string" || typeof value.username !== "string" || typeof value.password !== "string") {
+    const device = parseDeviceClaim(value?.device);
+    if (typeof value?.invite !== "string" || typeof value.username !== "string" || typeof value.password !== "string" || device === "invalid") {
       deny(400, "invalid_request");
       return;
     }
@@ -941,7 +1577,8 @@ async function handleApiRequest(request, response, ctx) {
       invite,
       username,
       password: value.password,
-      ip: clientIp(request, ctx.trustProxy)
+      ip: clientIp(request, ctx.trustProxy),
+      ...device === undefined ? {} : { device }
     });
     if (result.status === "limited") {
       deny(429, "rate_limited");
@@ -956,6 +1593,110 @@ async function handleApiRequest(request, response, ctx) {
     send(200, { user: { username }, expiresAt: result.expiresAt, ...cookieMode ? {} : { token: result.token } }, cookieMode ? { "set-cookie": setSessionCookie(result.token) } : undefined);
     return;
   }
+  if (pathname === "/api/host-link/start" || pathname === "/api/host-link/poll") {
+    if (method !== "POST") {
+      deny(405, "method_not_allowed", { allow: "POST" });
+      return;
+    }
+    const body = await readJson(request);
+    if (!body.ok) {
+      deny(body.tooLarge ? 413 : 400, body.tooLarge ? "payload_too_large" : "invalid_json");
+      return;
+    }
+    if (pathname === "/api/host-link/start") {
+      const value = body.value;
+      if (typeof value?.hostId !== "string" || !HOST_ID_PATTERN.test(value.hostId) || typeof value.name !== "string" || typeof value.os !== "string") {
+        deny(400, "invalid_request");
+        return;
+      }
+      const result2 = accounts.startHostLink({
+        hostId: value.hostId,
+        name: value.name,
+        os: value.os,
+        ip: clientIp(request, ctx.trustProxy)
+      });
+      if (result2.status === "limited") {
+        deny(429, "rate_limited");
+        return;
+      }
+      if (result2.status === "busy") {
+        deny(503, "busy");
+        return;
+      }
+      send(200, {
+        deviceCode: result2.deviceCode,
+        userCode: result2.userCode,
+        verifyUrl: `${ctx.publicOrigin}/host-link`,
+        interval: result2.interval,
+        expiresAt: result2.expiresAt
+      });
+      return;
+    }
+    const deviceCode = body.value?.deviceCode;
+    if (typeof deviceCode !== "string" || deviceCode.length > 256) {
+      deny(400, "invalid_request");
+      return;
+    }
+    const result = accounts.pollHostLink(deviceCode);
+    switch (result.status) {
+      case "confirmed":
+        send(200, { token: result.token, expiresAt: result.expiresAt });
+        return;
+      case "pending":
+        deny(400, "authorization_pending");
+        return;
+      case "slow_down":
+        send(400, { error: "slow_down", interval: result.interval });
+        return;
+      case "denied":
+        deny(400, "access_denied");
+        return;
+      case "expired":
+        deny(400, "expired_token");
+        return;
+    }
+  }
+  if (pathname === "/api/host-link/lookup" || pathname === "/api/host-link/confirm" || pathname === "/api/host-link/deny") {
+    if (method !== "POST") {
+      deny(405, "method_not_allowed", { allow: "POST" });
+      return;
+    }
+    const token = sessionToken(request);
+    if (token === undefined || accounts.authenticate(token) === undefined) {
+      deny(401, "unauthenticated");
+      return;
+    }
+    const body = await readJson(request);
+    if (!body.ok) {
+      deny(body.tooLarge ? 413 : 400, body.tooLarge ? "payload_too_large" : "invalid_json");
+      return;
+    }
+    const userCode = body.value?.userCode;
+    if (typeof userCode !== "string" || userCode.length > 64) {
+      deny(400, "invalid_request");
+      return;
+    }
+    const session = accounts.authenticate(token);
+    if (session === undefined) {
+      deny(401, "unauthenticated");
+      return;
+    }
+    const args = { userId: session.userId, userCode, ip: clientIp(request, ctx.trustProxy) };
+    const result = pathname === "/api/host-link/lookup" ? accounts.lookupHostLink(args) : pathname === "/api/host-link/confirm" ? accounts.confirmHostLink(args) : accounts.denyHostLink(args);
+    if (result.status === "limited") {
+      deny(429, "rate_limited");
+      return;
+    }
+    if (result.status === "not_found") {
+      deny(404, "not_found");
+      return;
+    }
+    if ("request" in result)
+      send(200, result.request);
+    else
+      send(204);
+    return;
+  }
   if (pathname === "/api/invites" || pathname === "/api/invites/revoke") {
     const allowed = pathname === "/api/invites" ? ["GET", "POST"] : ["POST"];
     if (!allowed.includes(method)) {
@@ -1021,7 +1762,8 @@ async function handleApiRequest(request, response, ctx) {
           noisePublicKey: row2.noisePublicKey,
           online: pairing !== "offline",
           lastSeenAt: row2.lastSeenAt,
-          pairing
+          pairing,
+          deviceReports: row2.deviceReports
         };
       }));
       return;
@@ -1046,6 +1788,10 @@ async function handleApiRequest(request, response, ctx) {
       deny(404, "not_found");
       return;
     }
+    if (result.status === "ok" && !accounts.recordVouching({ token, hostId: row.hostId, requestId: result.requestId, expiresAt: result.expiresAt })) {
+      deny(401, "unauthenticated");
+      return;
+    }
     switch (result.status) {
       case "ok":
         send(200, {
@@ -1071,7 +1817,59 @@ async function handleApiRequest(request, response, ctx) {
     }
     return;
   }
-  if (pathname === "/api/me" || pathname === "/api/logout" || pathname === "/api/sessions/revoke-all" || pathname === "/api/join-tokens" || pathname === "/api/push-tokens" || pathname === "/api/push-tokens/remove") {
+  const deviceKick = /^\/api\/devices\/([1-9][0-9]{0,14})\/kick$/.exec(pathname);
+  if (pathname === "/api/devices" || deviceKick !== null) {
+    const expected = pathname === "/api/devices" ? "GET" : "POST";
+    if (method !== expected) {
+      deny(405, "method_not_allowed", { allow: expected });
+      return;
+    }
+    const token = sessionToken(request);
+    const session = token === undefined ? undefined : accounts.authenticate(token);
+    if (session === undefined) {
+      deny(401, "unauthenticated");
+      return;
+    }
+    if (deviceKick === null) {
+      send(200, accounts.listDevices(session.userId).map((device) => ({ ...device, current: device.id === session.deviceId })));
+      return;
+    }
+    const body = await readJson(request);
+    if (!body.ok) {
+      deny(body.tooLarge ? 413 : 400, body.tooLarge ? "payload_too_large" : "invalid_json");
+      return;
+    }
+    const value = body.value;
+    if (typeof value?.password !== "string" || [...value.password].length > MAX_PASSWORD_CODEPOINTS) {
+      deny(400, "invalid_request");
+      return;
+    }
+    const current = accounts.authenticate(token);
+    if (current === undefined) {
+      deny(401, "unauthenticated");
+      return;
+    }
+    const result = await accounts.kickDevice({
+      userId: current.userId,
+      username: current.username,
+      password: value.password,
+      deviceId: Number(deviceKick[1]),
+      ...current.deviceId === undefined ? {} : { currentDeviceId: current.deviceId }
+    });
+    if (result.status === "limited") {
+      deny(429, "rate_limited");
+      return;
+    }
+    if (result.status === "refused") {
+      deny(result.reason === "not_found" ? 404 : result.reason === "current_device" ? 409 : 403, result.reason);
+      return;
+    }
+    for (const hostId of result.hostIds)
+      ctx.sendRevocations(hostId);
+    send(204);
+    return;
+  }
+  if (pathname === "/api/me" || pathname === "/api/logout" || pathname === "/api/sessions/revoke-all" || pathname === "/api/password" || pathname === "/api/me/delete" || pathname === "/api/join-tokens" || pathname === "/api/push-tokens" || pathname === "/api/push-tokens/remove") {
     const expected = pathname === "/api/me" ? "GET" : "POST";
     if (method !== expected) {
       deny(405, "method_not_allowed", { allow: expected });
@@ -1100,28 +1898,96 @@ async function handleApiRequest(request, response, ctx) {
         deny(400, "invalid_request");
         return;
       }
-      if (accounts.authenticate(token) === undefined) {
+      const current = accounts.authenticate(token);
+      if (current === undefined) {
         deny(401, "unauthenticated");
         return;
       }
       if (pathname === "/api/push-tokens")
-        accounts.registerPushToken(session.userId, apns, environment);
+        accounts.registerPushToken(session.userId, apns, environment, current.deviceId);
       else
         accounts.removePushToken(session.userId, apns, environment);
       send(204);
       return;
     }
+    if (pathname === "/api/me/delete") {
+      const body = await readJson(request);
+      if (!body.ok) {
+        deny(body.tooLarge ? 413 : 400, body.tooLarge ? "payload_too_large" : "invalid_json");
+        return;
+      }
+      const value = body.value;
+      if (typeof value?.password !== "string" || [...value.password].length > MAX_PASSWORD_CODEPOINTS) {
+        deny(400, "invalid_request");
+        return;
+      }
+      const result = await accounts.deleteAccount({ userId: session.userId, username: session.username, password: value.password });
+      if (result.status === "limited") {
+        deny(429, "rate_limited");
+        return;
+      }
+      if (result.status === "refused") {
+        deny(403, result.reason);
+        return;
+      }
+      for (const hostId of result.hostIds)
+        ctx.disconnectHost(hostId);
+      ctx.forgetAccount(session.userId);
+      send(204, undefined, { "set-cookie": clearSessionCookie });
+      return;
+    }
+    if (pathname === "/api/password") {
+      const body = await readJson(request);
+      if (!body.ok) {
+        deny(body.tooLarge ? 413 : 400, body.tooLarge ? "payload_too_large" : "invalid_json");
+        return;
+      }
+      const value = body.value;
+      if (typeof value?.currentPassword !== "string" || typeof value.newPassword !== "string" || [...value.currentPassword].length > MAX_PASSWORD_CODEPOINTS) {
+        deny(400, "invalid_request");
+        return;
+      }
+      const result = await accounts.changePassword({
+        userId: session.userId,
+        username: session.username,
+        keepToken: token,
+        currentPassword: value.currentPassword,
+        newPassword: value.newPassword
+      });
+      if (result.status === "limited") {
+        deny(429, "rate_limited");
+        return;
+      }
+      if (result.status === "refused") {
+        deny(result.reason === "wrong_password" ? 403 : 400, result.reason);
+        return;
+      }
+      send(204);
+      return;
+    }
     if (pathname === "/api/join-tokens") {
       const joinToken = accounts.createJoinToken(session.userId);
       send(200, {
         token: joinToken.token,
         expiresAt: joinToken.expiresAt,
-        command: `npm i -g pinomad && pinomad join ${ctx.publicOrigin} ${joinToken.token}`
+        command: `curl -fsSL https://pinomad.si/install.sh | sh -s -- join ${ctx.publicOrigin} ${joinToken.token}`
       });
       return;
     }
     if (pathname === "/api/logout") {
-      accounts.logout(token);
+      const body = await readJson(request, true);
+      if (!body.ok) {
+        deny(body.tooLarge ? 413 : 400, body.tooLarge ? "payload_too_large" : "invalid_json");
+        return;
+      }
+      const value = body.value;
+      const revoke = typeof value === "object" && value !== null ? value.revoke : undefined;
+      if (value === null || value !== undefined && typeof value !== "object" || revoke !== undefined && typeof revoke !== "boolean") {
+        deny(400, "invalid_request");
+        return;
+      }
+      for (const hostId of accounts.logout(token, { revoke: revoke === true }))
+        ctx.sendRevocations(hostId);
       send(204, undefined, { "set-cookie": clearSessionCookie });
       return;
     }
@@ -1163,6 +2029,10 @@ async function startRelay(options) {
   const pushTotal = options.pushLimits?.total ?? MAX_PUSH_TOTAL;
   let pushInflightTotal = 0;
   const pushInflightHosts = new Map;
+  const limits = { ...DEFAULT_RELAY_LIMITS, ...options.limits };
+  const limiter = createRelayLimiter(limits, options.now);
+  const accountKey = (userId) => `account:${userId}`;
+  const hostDevices = new Map;
   const controls = new Map;
   const pending = new Map;
   const pairingRequests = new Map;
@@ -1175,11 +2045,23 @@ async function startRelay(options) {
     socket.on("close", () => sockets.delete(socket));
     socket.on("error", () => socket.terminate());
   }
-  function splice(a, b) {
+  function splice(host, device, lease, handshakeTimer) {
+    let authenticated = false;
     const forward = (from, to) => {
       from.on("message", (data, isBinary) => {
         if (to.readyState !== WebSocket.OPEN)
           return;
+        if (from === host && !authenticated) {
+          authenticated = true;
+          lease.authenticate();
+          clearTimeout(handshakeTimer);
+        }
+        const refusal = lease.charge(rawLength(data));
+        if (refusal !== undefined) {
+          device.close(refusal.code, refusal.reason);
+          host.close(refusal.code, refusal.reason);
+          return;
+        }
         to.send(data, { binary: isBinary }, () => {
           if (from.isPaused && to.bufferedAmount <= LOW_WATER)
             from.resume();
@@ -1193,8 +2075,8 @@ async function startRelay(options) {
         to.close(isSendableCloseCode(code) ? code : 1001, reason);
       });
     };
-    forward(a, b);
-    forward(b, a);
+    forward(host, device);
+    forward(device, host);
   }
   function pairingStatus(hostId, boundNoiseKey) {
     const control = controls.get(hostId);
@@ -1236,6 +2118,22 @@ async function startRelay(options) {
     });
   }
   const pairing = { status: pairingStatus, request: requestPairing };
+  function disconnectHost(hostId) {
+    controls.get(hostId)?.socket.close(RELAY_CLOSE.hostNotAllowed);
+    closeHostDevices(hostId, RELAY_CLOSE.hostNotAllowed, "host left its account");
+  }
+  function closeHostDevices(hostId, code, reason) {
+    for (const device of hostDevices.get(hostId) ?? [])
+      device.close(code, reason);
+  }
+  function sendRevocations(hostId) {
+    const control = controls.get(hostId);
+    if (accounts === undefined || control?.features?.includes("device-reports") !== true)
+      return;
+    for (const publicKey of accounts.pendingRevocations(hostId)) {
+      control.socket.send(encodeRelayFrame({ t: "revoke-device", publicKey }));
+    }
+  }
   function handlePush(socket, hostId, frame) {
     const startedAt = Date.now();
     const finish = (verdict) => {
@@ -1296,6 +2194,7 @@ async function startRelay(options) {
         answer({ t: "refused", reason: "bad_request" });
         return;
       }
+      const previousOwner = accounts.hostOwner(frame.hostId);
       const result = accounts.joinHost({
         token: frame.joinToken,
         hostId: frame.hostId,
@@ -1307,6 +2206,9 @@ async function startRelay(options) {
           if (request.hostId === frame.hostId)
             request.settle({ status: "gone" });
         }
+        if (previousOwner !== undefined && previousOwner !== accounts.hostOwner(frame.hostId)) {
+          closeHostDevices(frame.hostId, RELAY_CLOSE.replaced, "host moved to another account");
+        }
       }
       answer(result.status === "joined" ? { t: "joined", username: result.username } : { t: "refused", reason: result.reason });
       return;
@@ -1316,7 +2218,7 @@ async function startRelay(options) {
       return;
     }
     answer({ t: "left" });
-    controls.get(frame.hostId)?.socket.close(RELAY_CLOSE.hostNotAllowed);
+    disconnectHost(frame.hostId);
   }
   function onControl(socket) {
     track(socket);
@@ -1341,6 +2243,16 @@ async function startRelay(options) {
           handlePush(socket, hostId, answer);
           return;
         }
+        if (answer.t === "device-admitted") {
+          if (accounts?.recordAdmission(hostId, answer.requestId, answer.publicKey) === "revoke") {
+            sendRevocations(hostId);
+          }
+          return;
+        }
+        if (answer.t === "device-revoked") {
+          accounts?.confirmRevocation(hostId, answer.publicKey);
+          return;
+        }
         if (answer.t === "name") {
           if (controls.get(hostId)?.socket === socket)
             accounts?.renameHost(hostId, answer.name);
@@ -1352,6 +2264,7 @@ async function startRelay(options) {
             return;
           request.settle(answer.t === "pairing" ? {
             status: "ok",
+            requestId: answer.requestId,
             secret: answer.secret,
             expiresAt: answer.expiresAt,
             ...answer.endpointSet === undefined ? {} : { endpointSet: answer.endpointSet }
@@ -1406,10 +2319,11 @@ async function startRelay(options) {
         ...noisePublicKey === undefined ? {} : { noisePublicKey },
         ...frame.features === undefined ? {} : { features: frame.features }
       });
-      accounts?.markHostSeen(hostId);
+      accounts?.markHostSeen(hostId, frame.features?.includes("device-reports") === true);
       if (frame.name !== undefined)
         accounts?.renameHost(hostId, frame.name);
-      socket.send(encodeRelayFrame({ t: "registered", push: pushEnvironments, features: ["name"] }));
+      socket.send(encodeRelayFrame({ t: "registered", push: pushEnvironments, features: ["name", "device-reports"] }));
+      sendRevocations(hostId);
     });
     socket.once("close", () => {
       clearTimeout(deadline);
@@ -1435,10 +2349,29 @@ async function startRelay(options) {
       socket.close(RELAY_CLOSE.hostOffline);
       return;
     }
+    const owner = accounts?.hostOwner(hostId);
+    const admission = limiter.admit(hostId, owner === undefined ? `host:${hostId}` : accountKey(owner));
+    if (!admission.ok) {
+      socket.close(admission.code, admission.reason);
+      return;
+    }
+    const { lease } = admission;
+    const handshakeTimer = limits.handshakeTimeoutMs > 0 ? setTimeout(() => socket.close(RELAY_CLOSE.handshakeTimeout, "handshake timeout"), limits.handshakeTimeoutMs) : undefined;
+    const devices = hostDevices.get(hostId) ?? new Set;
+    hostDevices.set(hostId, devices.add(socket));
+    socket.once("close", () => {
+      clearTimeout(handshakeTimer);
+      lease.release();
+      devices.delete(socket);
+      if (devices.size === 0 && hostDevices.get(hostId) === devices)
+        hostDevices.delete(hostId);
+    });
     const connId = randomBytes2(16).toString("base64url");
     const entry = {
       control,
       socket,
+      lease,
+      handshakeTimer,
       buffered: [],
       bufferedBytes: 0,
       timer: setTimeout(() => {
@@ -1475,7 +2408,13 @@ async function startRelay(options) {
     const device = entry.socket;
     device.removeListener("message", entry.onMessage);
     device.removeListener("close", entry.onClose);
-    splice(socket, device);
+    const refusal = entry.lease.charge(entry.bufferedBytes);
+    if (refusal !== undefined) {
+      device.close(refusal.code, refusal.reason);
+      socket.close(refusal.code, refusal.reason);
+      return;
+    }
+    splice(socket, device, entry.lease, entry.handshakeTimer);
     for (const { data, isBinary } of entry.buffered)
       socket.send(data, { binary: isBinary });
   }
@@ -1492,7 +2431,15 @@ async function startRelay(options) {
         response.end(JSON.stringify({ error: "accounts_disabled" }));
         return;
       }
-      handleApiRequest(request, response, { accounts, publicOrigin, trustProxy, pairing }).catch(() => {
+      handleApiRequest(request, response, {
+        accounts,
+        publicOrigin,
+        trustProxy,
+        pairing,
+        disconnectHost,
+        forgetAccount: (userId) => limiter.forgetAccount(accountKey(userId)),
+        sendRevocations
+      }).catch(() => {
         if (!response.headersSent)
           response.writeHead(500);
         response.end();
@@ -1558,6 +2505,9 @@ async function startRelay(options) {
         socket.terminate();
       }
     }
+    try {
+      accounts?.sweepExpired();
+    } catch {}
   }, pingIntervalMs);
   return {
     port,
@@ -1619,7 +2569,7 @@ async function passwdMain(argv) {
   }
   const dataDir = resolveDataDir(values["data-dir"]);
   const password = (await readStdin(16 * 1024)).replace(/[\r\n]+$/, "");
-  await changePassword({ dataDir, user: values.user, password });
+  await resetPassword({ dataDir, user: values.user, password });
   console.log(JSON.stringify({ event: "passwd", dataDir }));
 }
 async function main(argv) {
@@ -1637,13 +2587,22 @@ async function main(argv) {
       listen: { type: "string", default: "127.0.0.1" },
       "public-origin": { type: "string" },
       "data-dir": { type: "string" },
-      "trust-proxy": { type: "boolean", default: false }
+      "trust-proxy": { type: "boolean", default: false },
+      ...Object.fromEntries(RELAY_LIMIT_OPTIONS.map((option) => [option.flag, { type: "string" }]))
     }
   });
   if (values["public-origin"] === undefined) {
     console.error(`usage: ${commandHint("server")} --public-origin ORIGIN [--data-dir DIR] [--trust-proxy] [--port 7430] [--listen 127.0.0.1]
-` + `       ${commandHint("server")} passwd [--data-dir DIR] [--user NAME]   (server stopped; new password on stdin)
-` + "       env: PINOMAD_SERVER_USER, PINOMAD_SERVER_PASSWORD, PINOMAD_SERVER_DATA_DIR");
+` + `       ${commandHint("server")} passwd [--data-dir DIR] [--user NAME]   (reset a password, server running or not; new password on stdin)
+` + `       env: PINOMAD_SERVER_USER, PINOMAD_SERVER_PASSWORD, PINOMAD_SERVER_DATA_DIR
+` + "       relay limits (flag or env, 0 = off): " + RELAY_LIMIT_OPTIONS.map((option) => `--${option.flag} / ${option.env}`).join(", "));
+    process.exit(1);
+  }
+  let limits;
+  try {
+    limits = readRelayLimits(values, process.env);
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
     process.exit(1);
   }
   const accounts = await openAccounts({
@@ -1663,13 +2622,15 @@ async function main(argv) {
     webRoot,
     accounts,
     trustProxy: values["trust-proxy"],
-    ...apns === undefined ? {} : { push: apns }
+    ...apns === undefined ? {} : { push: apns },
+    limits
   });
   console.log(JSON.stringify({
     event: "ready",
     url: relay.url,
     publicOrigin: values["public-origin"],
-    push: apns?.environments ?? []
+    push: apns?.environments ?? [],
+    relayLimits: { ...DEFAULT_RELAY_LIMITS, ...limits }
   }));
   let stopping = false;
   const stop = () => {