pinomad 0.9.1 → 0.11.0

package/dist/{chunk-jgd38rna.js → chunk-xqycs43g.js}

@@ -2,7 +2,176 @@ import {
   HOST_SETTING_KEYS,
   isQueueMode,
   isThinkingLevel
-} from "./chunk-sygeb9qb.js";
+} from "./chunk-pqe7q1s7.js";
+
+// packages/protocol/src/rtc.ts
+function rtcAddressScope(address) {
+  const ip = parseRtcAddress(address);
+  if (ip === undefined)
+    return "unknown";
+  if (ip.family === 4)
+    return ipv4Scope(ip.octets);
+  const octets = mappedIpv4(ip.segments);
+  return octets === undefined ? ipv6Scope(ip.segments) : ipv4Scope(octets);
+}
+function rtcCandidateEnd(info) {
+  return {
+    ...info.type === undefined ? {} : { type: info.type },
+    ...info.address === undefined ? {} : { address: info.address },
+    scope: rtcAddressScope(info.address)
+  };
+}
+function rtcSelectedPair(local, remote) {
+  return { local: rtcCandidateEnd(local), remote: rtcCandidateEnd(remote) };
+}
+function parseRtcAddress(address) {
+  if (address === undefined)
+    return;
+  const text = address.trim();
+  if (text === "")
+    return;
+  let host = text;
+  if (text.startsWith("[")) {
+    const close = text.indexOf("]");
+    if (close === -1)
+      return;
+    const tail = text.slice(close + 1);
+    if (tail !== "" && !/^:\d+$/.test(tail))
+      return;
+    host = text.slice(1, close);
+  } else if (text.split(":").length === 2) {
+    const [candidate, port] = text.split(":");
+    if (/^\d+$/.test(port))
+      host = candidate;
+  }
+  const zone = host.indexOf("%");
+  if (zone !== -1)
+    host = host.slice(0, zone);
+  const ipv4 = parseIpv4(host);
+  if (ipv4 !== undefined)
+    return { family: 4, octets: ipv4 };
+  const ipv6 = parseIpv6(host);
+  return ipv6 === undefined ? undefined : { family: 6, segments: ipv6 };
+}
+function parseIpv4(text) {
+  const parts = text.split(".");
+  if (parts.length !== 4)
+    return;
+  const octets = [];
+  for (const part of parts) {
+    if (!/^(?:0|[1-9]\d{0,2})$/.test(part))
+      return;
+    const value = Number(part);
+    if (value > 255)
+      return;
+    octets.push(value);
+  }
+  return octets;
+}
+function parseIpv6(text) {
+  const halves = text.split("::");
+  if (halves.length > 2)
+    return;
+  const parsePart = (part, allowIpv4) => {
+    if (part === "")
+      return [];
+    const tokens = part.split(":");
+    const groups = [];
+    for (let index = 0;index < tokens.length; index++) {
+      const token = tokens[index];
+      if (allowIpv4 && index === tokens.length - 1 && token.includes(".")) {
+        const v4 = parseIpv4(token);
+        if (v4 === undefined)
+          return;
+        groups.push(v4[0] << 8 | v4[1], v4[2] << 8 | v4[3]);
+        continue;
+      }
+      if (!/^[0-9a-fA-F]{1,4}$/.test(token))
+        return;
+      groups.push(Number.parseInt(token, 16));
+    }
+    return groups;
+  };
+  if (halves.length === 1) {
+    const groups = parsePart(text, true);
+    return groups?.length === 8 ? groups : undefined;
+  }
+  const left = parsePart(halves[0], false);
+  const right = parsePart(halves[1], true);
+  if (left === undefined || right === undefined)
+    return;
+  const zeros = 8 - left.length - right.length;
+  if (zeros < 1)
+    return;
+  return [...left, ...new Array(zeros).fill(0), ...right];
+}
+function mappedIpv4(segments) {
+  if (!segments.slice(0, 5).every((group) => group === 0) || segments[5] !== 65535)
+    return;
+  return [segments[6] >> 8, segments[6] & 255, segments[7] >> 8, segments[7] & 255];
+}
+function ipv4Scope(octets) {
+  const [a, b] = octets;
+  if (a === 127)
+    return "loopback";
+  if (a === 100 && b >= 64 && b <= 127)
+    return "tailnet";
+  if (a === 10 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 169 && b === 254) {
+    return "lan";
+  }
+  return "public";
+}
+function ipv6Scope(segments) {
+  if (segments[0] === 64890 && segments[1] === 4444 && segments[2] === 41440)
+    return "tailnet";
+  if ((segments[0] & 65024) === 64512 || (segments[0] & 65472) === 65152)
+    return "lan";
+  if (segments.slice(0, 7).every((group) => group === 0) && segments[7] === 1)
+    return "loopback";
+  return "public";
+}
+var RTC_DEFAULT_STUN = ["stun:stun.cloudflare.com:3478"];
+var RTC_DATA_CHANNEL_LABEL = "pinomad";
+var RTC_MAX_RECORD_BYTES = 65535;
+var RTC_DEFAULT_MAX_MESSAGE_SIZE = 65536;
+var RTC_MIN_MAX_MESSAGE_SIZE = RTC_MAX_RECORD_BYTES;
+function isRtcHello(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    return false;
+  const hello = value;
+  return Array.isArray(hello.stun) && hello.stun.every((server) => typeof server === "string" && server.length > 0) && hello.signalOnly === true;
+}
+function rtcCandidateType(candidate) {
+  const parts = candidate.trim().split(/\s+/);
+  const at = parts.indexOf("typ");
+  return at === -1 ? undefined : parts[at + 1];
+}
+function sdpCandidates(sdp) {
+  return sdp.split(/\r?\n/).filter((line) => line.startsWith("a=candidate:")).map((line) => line.slice("a=".length));
+}
+function withRtcCandidates(sdp, candidates) {
+  const lines = sdp.split(/\r?\n/).filter((line) => line !== "" && !line.startsWith("a=candidate:") && line !== "a=end-of-candidates");
+  const unique = [...new Set(candidates.map((candidate) => candidate.replace(/^a=/, "")))];
+  return [...lines, ...unique.map((candidate) => `a=${candidate}`), "a=end-of-candidates", ""].join(`\r
+`);
+}
+function parseRtcMaxMessageSize(sdp) {
+  const line = sdp.split(/\r?\n/).find((entry) => entry.startsWith("a=max-message-size:"));
+  if (line === undefined)
+    return { kind: "bounded", bytes: RTC_DEFAULT_MAX_MESSAGE_SIZE };
+  const raw = line.slice("a=max-message-size:".length).trim();
+  if (!/^\d+$/.test(raw))
+    return { kind: "invalid", reason: `malformed a=max-message-size: ${raw}` };
+  const bytes = Number(raw);
+  if (!Number.isSafeInteger(bytes))
+    return { kind: "invalid", reason: `a=max-message-size is not a safe integer: ${raw}` };
+  if (bytes === 0)
+    return { kind: "unlimited" };
+  if (bytes < RTC_MIN_MAX_MESSAGE_SIZE) {
+    return { kind: "invalid", reason: `a=max-message-size ${bytes} cannot carry a ${RTC_MIN_MAX_MESSAGE_SIZE}-byte record` };
+  }
+  return { kind: "bounded", bytes };
+}
 
 // packages/protocol/src/auth.ts
 var CUSTOM_PROVIDER_APIS = ["openai-completions", "openai-responses", "anthropic-messages", "google-generative-ai"];
@@ -218,175 +387,6 @@ function nonempty(value) {
   return typeof value === "string" && value.length > 0;
 }
 
-// packages/protocol/src/rtc.ts
-function rtcAddressScope(address) {
-  const ip = parseRtcAddress(address);
-  if (ip === undefined)
-    return "unknown";
-  if (ip.family === 4)
-    return ipv4Scope(ip.octets);
-  const octets = mappedIpv4(ip.segments);
-  return octets === undefined ? ipv6Scope(ip.segments) : ipv4Scope(octets);
-}
-function rtcCandidateEnd(info) {
-  return {
-    ...info.type === undefined ? {} : { type: info.type },
-    ...info.address === undefined ? {} : { address: info.address },
-    scope: rtcAddressScope(info.address)
-  };
-}
-function rtcSelectedPair(local, remote) {
-  return { local: rtcCandidateEnd(local), remote: rtcCandidateEnd(remote) };
-}
-function parseRtcAddress(address) {
-  if (address === undefined)
-    return;
-  const text = address.trim();
-  if (text === "")
-    return;
-  let host = text;
-  if (text.startsWith("[")) {
-    const close = text.indexOf("]");
-    if (close === -1)
-      return;
-    const tail = text.slice(close + 1);
-    if (tail !== "" && !/^:\d+$/.test(tail))
-      return;
-    host = text.slice(1, close);
-  } else if (text.split(":").length === 2) {
-    const [candidate, port] = text.split(":");
-    if (/^\d+$/.test(port))
-      host = candidate;
-  }
-  const zone = host.indexOf("%");
-  if (zone !== -1)
-    host = host.slice(0, zone);
-  const ipv4 = parseIpv4(host);
-  if (ipv4 !== undefined)
-    return { family: 4, octets: ipv4 };
-  const ipv6 = parseIpv6(host);
-  return ipv6 === undefined ? undefined : { family: 6, segments: ipv6 };
-}
-function parseIpv4(text) {
-  const parts = text.split(".");
-  if (parts.length !== 4)
-    return;
-  const octets = [];
-  for (const part of parts) {
-    if (!/^(?:0|[1-9]\d{0,2})$/.test(part))
-      return;
-    const value = Number(part);
-    if (value > 255)
-      return;
-    octets.push(value);
-  }
-  return octets;
-}
-function parseIpv6(text) {
-  const halves = text.split("::");
-  if (halves.length > 2)
-    return;
-  const parsePart = (part, allowIpv4) => {
-    if (part === "")
-      return [];
-    const tokens = part.split(":");
-    const groups = [];
-    for (let index = 0;index < tokens.length; index++) {
-      const token = tokens[index];
-      if (allowIpv4 && index === tokens.length - 1 && token.includes(".")) {
-        const v4 = parseIpv4(token);
-        if (v4 === undefined)
-          return;
-        groups.push(v4[0] << 8 | v4[1], v4[2] << 8 | v4[3]);
-        continue;
-      }
-      if (!/^[0-9a-fA-F]{1,4}$/.test(token))
-        return;
-      groups.push(Number.parseInt(token, 16));
-    }
-    return groups;
-  };
-  if (halves.length === 1) {
-    const groups = parsePart(text, true);
-    return groups?.length === 8 ? groups : undefined;
-  }
-  const left = parsePart(halves[0], false);
-  const right = parsePart(halves[1], true);
-  if (left === undefined || right === undefined)
-    return;
-  const zeros = 8 - left.length - right.length;
-  if (zeros < 1)
-    return;
-  return [...left, ...new Array(zeros).fill(0), ...right];
-}
-function mappedIpv4(segments) {
-  if (!segments.slice(0, 5).every((group) => group === 0) || segments[5] !== 65535)
-    return;
-  return [segments[6] >> 8, segments[6] & 255, segments[7] >> 8, segments[7] & 255];
-}
-function ipv4Scope(octets) {
-  const [a, b] = octets;
-  if (a === 127)
-    return "loopback";
-  if (a === 100 && b >= 64 && b <= 127)
-    return "tailnet";
-  if (a === 10 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 169 && b === 254) {
-    return "lan";
-  }
-  return "public";
-}
-function ipv6Scope(segments) {
-  if (segments[0] === 64890 && segments[1] === 4444 && segments[2] === 41440)
-    return "tailnet";
-  if ((segments[0] & 65024) === 64512 || (segments[0] & 65472) === 65152)
-    return "lan";
-  if (segments.slice(0, 7).every((group) => group === 0) && segments[7] === 1)
-    return "loopback";
-  return "public";
-}
-var RTC_DEFAULT_STUN = ["stun:stun.cloudflare.com:3478"];
-var RTC_DATA_CHANNEL_LABEL = "pinomad";
-var RTC_MAX_RECORD_BYTES = 65535;
-var RTC_DEFAULT_MAX_MESSAGE_SIZE = 65536;
-var RTC_MIN_MAX_MESSAGE_SIZE = RTC_MAX_RECORD_BYTES;
-function isRtcHello(value) {
-  if (typeof value !== "object" || value === null || Array.isArray(value))
-    return false;
-  const hello = value;
-  return Array.isArray(hello.stun) && hello.stun.every((server) => typeof server === "string" && server.length > 0) && hello.signalOnly === true;
-}
-function rtcCandidateType(candidate) {
-  const parts = candidate.trim().split(/\s+/);
-  const at = parts.indexOf("typ");
-  return at === -1 ? undefined : parts[at + 1];
-}
-function sdpCandidates(sdp) {
-  return sdp.split(/\r?\n/).filter((line) => line.startsWith("a=candidate:")).map((line) => line.slice("a=".length));
-}
-function withRtcCandidates(sdp, candidates) {
-  const lines = sdp.split(/\r?\n/).filter((line) => line !== "" && !line.startsWith("a=candidate:") && line !== "a=end-of-candidates");
-  const unique = [...new Set(candidates.map((candidate) => candidate.replace(/^a=/, "")))];
-  return [...lines, ...unique.map((candidate) => `a=${candidate}`), "a=end-of-candidates", ""].join(`\r
-`);
-}
-function parseRtcMaxMessageSize(sdp) {
-  const line = sdp.split(/\r?\n/).find((entry) => entry.startsWith("a=max-message-size:"));
-  if (line === undefined)
-    return { kind: "bounded", bytes: RTC_DEFAULT_MAX_MESSAGE_SIZE };
-  const raw = line.slice("a=max-message-size:".length).trim();
-  if (!/^\d+$/.test(raw))
-    return { kind: "invalid", reason: `malformed a=max-message-size: ${raw}` };
-  const bytes = Number(raw);
-  if (!Number.isSafeInteger(bytes))
-    return { kind: "invalid", reason: `a=max-message-size is not a safe integer: ${raw}` };
-  if (bytes === 0)
-    return { kind: "unlimited" };
-  if (bytes < RTC_MIN_MAX_MESSAGE_SIZE) {
-    return { kind: "invalid", reason: `a=max-message-size ${bytes} cannot carry a ${RTC_MIN_MAX_MESSAGE_SIZE}-byte record` };
-  }
-  return { kind: "bounded", bytes };
-}
-
 // packages/protocol/src/attachments.ts
 var MAX_ATTACHMENT_BYTES = 10 * 1024 * 1024;
 var MAX_ATTACHMENTS_PER_MESSAGE = 10;
@@ -619,4 +619,4 @@ function homeOf(index, summaries, id) {
   return;
 }
 
-export { isCustomProviderApi, HOST_STREAM_NAMES, hostStreams, conversationStream, docStream, UNAUTHORIZED_CLOSE_CODE, INVALID_FRAME_CLOSE_CODE, PROTOCOL, hostSupportsCall, hostSupportsFeature, parseClientFrame, rtcSelectedPair, RTC_DEFAULT_STUN, RTC_DATA_CHANNEL_LABEL, RTC_MAX_RECORD_BYTES, isRtcHello, rtcCandidateType, sdpCandidates, withRtcCandidates, parseRtcMaxMessageSize, MAX_ATTACHMENTS_PER_MESSAGE, MAX_PENDING_ATTACHMENTS, MAX_PENDING_ATTACHMENT_BYTES, ATTACHMENT_TTL_MS, MAX_ATTACHMENT_NAME_LENGTH, isAttachmentId, base64DecodedLength, attachmentBeginProblem, attachmentChunkProblem, attachmentBlock, parseAttachmentBlock, organize, checkoutOf, homeOf };
+export { rtcSelectedPair, RTC_DEFAULT_STUN, RTC_DATA_CHANNEL_LABEL, RTC_MAX_RECORD_BYTES, isRtcHello, rtcCandidateType, sdpCandidates, withRtcCandidates, parseRtcMaxMessageSize, isCustomProviderApi, HOST_STREAM_NAMES, hostStreams, conversationStream, docStream, UNAUTHORIZED_CLOSE_CODE, INVALID_FRAME_CLOSE_CODE, PROTOCOL, hostSupportsCall, hostSupportsFeature, parseClientFrame, MAX_ATTACHMENTS_PER_MESSAGE, MAX_PENDING_ATTACHMENTS, MAX_PENDING_ATTACHMENT_BYTES, ATTACHMENT_TTL_MS, MAX_ATTACHMENT_NAME_LENGTH, isAttachmentId, base64DecodedLength, attachmentBeginProblem, attachmentChunkProblem, attachmentBlock, parseAttachmentBlock, organize, checkoutOf, homeOf };

package/dist/{chunk-khcpv54k.js → chunk-y127fe1a.js}

@@ -3,7 +3,7 @@ import {
   fromBase64Url,
   parseEndpointSet,
   toBase64Url
-} from "./chunk-sygeb9qb.js";
+} from "./chunk-pqe7q1s7.js";
 
 // packages/protocol/src/relay.ts
 import { ed25519 } from "@noble/curves/ed25519.js";
@@ -12,8 +12,11 @@ var RELAY_CLOSE = {
   hostNotAllowed: 4603,
   hostOffline: 4604,
   unknownConnection: 4605,
+  handshakeTimeout: 4608,
   replaced: 4609,
-  acceptTimeout: 4610
+  acceptTimeout: 4610,
+  tooManyConnections: 4629,
+  trafficLimit: 4630
 };
 function encodeRelayFrame(frame) {
   return JSON.stringify(frame);
@@ -21,6 +24,7 @@ function encodeRelayFrame(frame) {
 var isString = (value) => typeof value === "string";
 var isRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var isBoundedString = (value, max = 64) => isString(value) && value.length > 0 && value.length <= max;
+var isDeviceKey = (value) => isBoundedString(value) && /^[A-Za-z0-9_-]+$/.test(value);
 function decodeJson(text) {
   try {
     return JSON.parse(text);
@@ -45,6 +49,10 @@ function decodeRelayToHost(text) {
       if (!isBoundedString(value.requestId))
         throw new Error("malformed pairing-request");
       return { t: "pairing-request", requestId: value.requestId };
+    case "revoke-device":
+      if (!isDeviceKey(value.publicKey))
+        throw new Error("malformed revoke-device");
+      return { t: "revoke-device", publicKey: value.publicKey };
     case "push-result":
       return decodePushResult(value);
     case "joined":
@@ -140,6 +148,14 @@ function decodeHostToRelay(text) {
       if (!isBoundedString(value.name, HOST_NAME_MAX_UNITS))
         throw new Error("malformed name");
       return { t: "name", name: value.name };
+    case "device-admitted":
+      if (!isBoundedString(value.requestId) || !isDeviceKey(value.publicKey))
+        throw new Error("malformed device-admitted");
+      return { t: "device-admitted", requestId: value.requestId, publicKey: value.publicKey };
+    case "device-revoked":
+      if (!isDeviceKey(value.publicKey))
+        throw new Error("malformed device-revoked");
+      return { t: "device-revoked", publicKey: value.publicKey };
     default:
       throw new Error("unknown host frame");
   }
@@ -234,6 +250,7 @@ function verifyRelayChallengeV2(signature, args) {
 // apps/host/src/relay-link.ts
 import { randomBytes } from "node:crypto";
 import { WebSocket } from "ws";
+var MAX_UNSENT_REPORTS = 64;
 function relayWsBase(origin) {
   const normalized = origin.replace(/\/+$/, "");
   if (normalized.startsWith("https://"))
@@ -257,6 +274,10 @@ function startRelayLink(options) {
   const minDelay = options.reconnectDelayMs?.min ?? 1000;
   const maxDelay = options.reconnectDelayMs?.max ?? 30000;
   const maxPendingAccepts = options.maxPendingAccepts ?? 16;
+  const features = [
+    ...options.accountOffer === undefined ? [] : ["pairing"],
+    ...options.deviceReports === undefined ? [] : ["device-reports"]
+  ];
   let state = { status: "connecting" };
   let stopped = false;
   let control;
@@ -266,6 +287,8 @@ function startRelayLink(options) {
   let pushEnvironments;
   let reportedName;
   let nameDeclared = false;
+  let reportsDeclared = false;
+  const unsentReports = [];
   const pushes = new Map;
   function setState(next) {
     const changed = state.status !== next.status || state.status === "rejected" && next.status === "rejected" && state.reason !== next.reason;
@@ -302,6 +325,7 @@ function startRelayLink(options) {
     control = socket;
     pushEnvironments = undefined;
     nameDeclared = false;
+    reportsDeclared = false;
     reportedName = undefined;
     watch(socket);
     socket.on("message", (data, isBinary) => onControlMessage(socket, data, isBinary));
@@ -336,7 +360,7 @@ function startRelayLink(options) {
           signature: signRelayChallenge(options.signingKey.secretKey, challenge),
           signatureV2: signRelayChallengeV2(options.signingKey.secretKey, { ...challenge, noisePublicKey }),
           noisePublicKey,
-          ...options.accountOffer === undefined ? {} : { features: ["pairing"] },
+          ...features.length === 0 ? {} : { features },
           ...reportedName === undefined ? {} : { name: reportedName }
         }));
         break;
@@ -345,6 +369,12 @@ function startRelayLink(options) {
         delay = minDelay;
         pushEnvironments = frame.push;
         nameDeclared = frame.features?.includes("name") === true;
+        reportsDeclared = options.deviceReports !== undefined && frame.features?.includes("device-reports") === true;
+        if (reportsDeclared) {
+          for (const report of unsentReports.splice(0)) {
+            socket.send(encodeRelayFrame({ t: "device-admitted", ...report }));
+          }
+        }
         const current = options.hostName?.value;
         if (nameDeclared && current !== undefined && current !== reportedName) {
           reportedName = current;
@@ -371,7 +401,7 @@ function startRelayLink(options) {
           refused("unavailable");
           break;
         }
-        accountOffer().then((result) => {
+        accountOffer(frame.requestId).then((result) => {
           if (socket !== control || socket.readyState !== WebSocket.OPEN)
             return;
           const checked = result.ok && result.endpointSet !== undefined ? parseEndpointSet(result.endpointSet) : undefined;
@@ -393,6 +423,18 @@ function startRelayLink(options) {
         });
         break;
       }
+      case "revoke-device": {
+        const reports = options.deviceReports;
+        if (reports === undefined)
+          break;
+        const { publicKey } = frame;
+        reports.revoke(publicKey).then(() => {
+          if (socket === control && socket.readyState === WebSocket.OPEN) {
+            socket.send(encodeRelayFrame({ t: "device-revoked", publicKey }));
+          }
+        }, () => {});
+        break;
+      }
       case "incoming": {
         if (pendingAccepts >= maxPendingAccepts)
           break;
@@ -415,6 +457,7 @@ function startRelayLink(options) {
     control = undefined;
     pushEnvironments = undefined;
     nameDeclared = false;
+    reportsDeclared = false;
     reportedName = undefined;
     for (const [requestId, request] of pushes) {
       if (request.socket === socket) {
@@ -478,6 +521,18 @@ function startRelayLink(options) {
         socket.send(encodeRelayFrame({ t: "push", requestId, ...request }));
       });
     },
+    reportAdmitted(requestId, publicKey) {
+      if (options.deviceReports === undefined)
+        return;
+      const socket = control;
+      if (reportsDeclared && socket !== undefined && socket.readyState === WebSocket.OPEN) {
+        socket.send(encodeRelayFrame({ t: "device-admitted", requestId, publicKey }));
+        return;
+      }
+      unsentReports.push({ requestId, publicKey });
+      if (unsentReports.length > MAX_UNSENT_REPORTS)
+        unsentReports.shift();
+    },
     close() {
       stopped = true;
       if (retryTimer !== undefined)

package/dist/pinomad.js

@@ -5,39 +5,45 @@ import {
 } from "./chunk-kzbzacz9.js";
 import {
   packagedVersion
-} from "./chunk-fqgvf8v0.js";
+} from "./chunk-sd5fkxjj.js";
 import {
   __require
 } from "./chunk-df32avw6.js";
 
 // apps/cli/src/pinomad.ts
 var COMMANDS = {
-  host: () => import("./chunk-n8cz7skh.js"),
-  server: () => import("./chunk-cx8jgpdt.js"),
-  relay: () => import("./chunk-cx8jgpdt.js"),
-  service: () => import("./chunk-3gcpzpjq.js"),
-  upgrade: () => import("./chunk-azarj0f4.js"),
-  link: () => import("./chunk-029mmh7d.js"),
-  pair: () => import("./chunk-vax4zspw.js"),
-  join: () => import("./chunk-n58m5hgh.js"),
-  leave: () => import("./chunk-nj5gz6qh.js")
+  up: () => import("./chunk-n1m1tjrk.js"),
+  status: () => import("./chunk-b457q0tm.js"),
+  host: () => import("./chunk-67gq282t.js"),
+  server: () => import("./chunk-9h5vawnm.js"),
+  relay: () => import("./chunk-9h5vawnm.js"),
+  service: () => import("./chunk-h5q2y57m.js"),
+  upgrade: () => import("./chunk-6d16c2fv.js"),
+  link: () => import("./chunk-as6pyf00.js"),
+  pair: () => import("./chunk-tj57aqav.js"),
+  join: () => import("./chunk-greb3dp6.js"),
+  leave: () => import("./chunk-4dcs8sbj.js")
 };
 var USAGE = `pinomad — PiNomad host, server, and utilities
 
 usage: pinomad <command> [args…]
 
+  up [--server] [--lan] [--yes]        set this host up: account, LAN, service
+  up --origin URL --remote-port N      server to join (app.pinomad.si), LAN port (7422)
+  up --no-server|--no-lan [--data-dir D]   turn a path off; with no flags, up asks
+  status [--data-dir D]                joined server and account, LAN, service, host
   host [--data-dir DIR] [--port 7420] [--project DIR]…   run the host in the foreground
   host --remote-port PORT [--public-url URL]   remote access, LAN (ADR-0008)
   host --relay URL   remote access via relay (ADR-0015)
   host --faux "answer" [--faux-tps 40]   no real model, for tests
   server --public-origin O [--data-dir D] [--trust-proxy]   run the server
-  server passwd [--data-dir D] [--user U]   change the account password (stdin)
+  server passwd [--data-dir D] [--user U]   reset an account's password (stdin)
   relay …                              old name of server
   service install|uninstall|status|restart|logs   user-level host service
   upgrade [--force] [address flags]    upgrade the package and restart the service
   link [--data-dir D|--url U …]        print the browser link
   pair [--data-dir D|--url U …]        print a pairing QR
-  join <origin> <token> [--data-dir D] join this host to a server account
+  join <origin> [token] [--data-dir D] join this host to a server account
   leave [--data-dir D]                 leave the server account
   --version, -v                        print the version
 `;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pinomad",
-  "version": "0.9.1",
+  "version": "0.11.0",
   "description": "PiNomad — self-hosted coding agent: host, relay, and web client in one package",
   "license": "Apache-2.0",
   "type": "module",