feat: make version optional in registry package remove, add --force flag

When version is omitted, removes the entire package entry. Requires
--force if the package has any existing versions.

.github/actions/setup-build/action.yml

@@ -47,7 +47,7 @@ runs:
         sudo rm -rf /usr/share/swift
         sudo rm -rf "$AGENT_TOOLSDIRECTORY"
 
-    # BuildJet runners lack /opt/hostedtoolcache, which setup-python and setup-qemu expect
+    # Some runners lack /opt/hostedtoolcache, which setup-python and setup-qemu expect
     - name: Ensure hostedtoolcache exists
       shell: bash
       run: sudo mkdir -p /opt/hostedtoolcache && sudo chown $USER:$USER /opt/hostedtoolcache

.github/workflows/start-cli.yaml

@@ -63,7 +63,7 @@ jobs:
               "ALL": ["x86_64-unknown-linux-musl", "x86_64-apple-darwin", "aarch64-unknown-linux-musl", "aarch64-apple-darwin", "riscv64gc-unknown-linux-musl"]
             }')[github.event.inputs.platform || 'ALL']
           }}
-    runs-on: ${{ fromJson('["ubuntu-latest", "buildjet-32vcpu-ubuntu-2204"]')[github.event.inputs.runner == 'fast'] }}
+    runs-on: ${{ fromJson('["ubuntu-latest", "ubuntu-24.04-32-cores"]')[github.event.inputs.runner == 'fast'] }}
     steps:
       - name: Mount tmpfs
         if: ${{ github.event.inputs.runner == 'fast' }}

.github/workflows/start-registry.yaml

@@ -59,7 +59,7 @@ jobs:
               "ALL": ["x86_64", "aarch64", "riscv64"]
             }')[github.event.inputs.platform || 'ALL']
           }}
-    runs-on: ${{ fromJson('["ubuntu-latest", "buildjet-32vcpu-ubuntu-2204"]')[github.event.inputs.runner == 'fast'] }}
+    runs-on: ${{ fromJson('["ubuntu-latest", "ubuntu-24.04-32-cores"]')[github.event.inputs.runner == 'fast'] }}
     steps:
       - name: Mount tmpfs
         if: ${{ github.event.inputs.runner == 'fast' }}
@@ -89,7 +89,7 @@ jobs:
     permissions:
       contents: read
       packages: write
-    runs-on: ${{ fromJson('["ubuntu-latest", "buildjet-32vcpu-ubuntu-2204"]')[github.event.inputs.runner == 'fast'] }}
+    runs-on: ${{ fromJson('["ubuntu-latest", "ubuntu-24.04-32-cores"]')[github.event.inputs.runner == 'fast'] }}
     steps:
       - name: Cleaning up unnecessary files
         run: |

.github/workflows/start-tunnel.yaml

@@ -59,7 +59,7 @@ jobs:
               "ALL": ["x86_64", "aarch64", "riscv64"]
             }')[github.event.inputs.platform || 'ALL']
           }}
-    runs-on: ${{ fromJson('["ubuntu-latest", "buildjet-32vcpu-ubuntu-2204"]')[github.event.inputs.runner == 'fast'] }}
+    runs-on: ${{ fromJson('["ubuntu-latest", "ubuntu-24.04-32-cores"]')[github.event.inputs.runner == 'fast'] }}
     steps:
       - name: Mount tmpfs
         if: ${{ github.event.inputs.runner == 'fast' }}

.github/workflows/startos-iso.yaml

@@ -29,7 +29,7 @@ on:
           - aarch64
           - aarch64-nonfree
           - aarch64-nvidia
-          # - raspberrypi
+          - raspberrypi
           - riscv64
           - riscv64-nonfree
       deploy:
@@ -89,9 +89,9 @@ jobs:
               "riscv64": "ubuntu-latest"
             }')[matrix.arch],
             fromJson('{
-              "x86_64": "buildjet-32vcpu-ubuntu-2204",
-              "aarch64": "buildjet-32vcpu-ubuntu-2204-arm",
-              "riscv64": "buildjet-32vcpu-ubuntu-2204"
+              "x86_64": "amd64-fast",
+              "aarch64": "aarch64-fast",
+              "riscv64": "amd64-fast"
             }')[matrix.arch]
           )
         )[github.event.inputs.runner == 'fast']
@@ -153,15 +153,15 @@ jobs:
               "riscv64-nonfree": "ubuntu-24.04-arm",
             }')[matrix.platform],
             fromJson('{
-              "x86_64": "buildjet-8vcpu-ubuntu-2204",
-              "x86_64-nonfree": "buildjet-8vcpu-ubuntu-2204",
-              "x86_64-nvidia": "buildjet-8vcpu-ubuntu-2204",
-              "aarch64": "buildjet-8vcpu-ubuntu-2204-arm",
-              "aarch64-nonfree": "buildjet-8vcpu-ubuntu-2204-arm",
-              "aarch64-nvidia": "buildjet-8vcpu-ubuntu-2204-arm",
-              "raspberrypi": "buildjet-8vcpu-ubuntu-2204-arm",
-              "riscv64": "buildjet-8vcpu-ubuntu-2204",
-              "riscv64-nonfree": "buildjet-8vcpu-ubuntu-2204",
+              "x86_64": "amd64-fast",
+              "x86_64-nonfree": "amd64-fast",
+              "x86_64-nvidia": "amd64-fast",
+              "aarch64": "aarch64-fast",
+              "aarch64-nonfree": "aarch64-fast",
+              "aarch64-nvidia": "aarch64-fast",
+              "raspberrypi": "aarch64-fast",
+              "riscv64": "amd64-fast",
+              "riscv64-nonfree": "amd64-fast",
             }')[matrix.platform]
           )
         )[github.event.inputs.runner == 'fast']
@@ -203,7 +203,7 @@ jobs:
           sudo rm -rf "$AGENT_TOOLSDIRECTORY"    # Pre-cached tool cache (Go, Node, etc.)
         if: ${{ github.event.inputs.runner != 'fast' }}
 
-      # BuildJet runners lack /opt/hostedtoolcache, which setup-qemu expects
+      # Some runners lack /opt/hostedtoolcache, which setup-qemu expects
       - name: Ensure hostedtoolcache exists
         run: sudo mkdir -p /opt/hostedtoolcache && sudo chown $USER:$USER /opt/hostedtoolcache
 
@@ -268,3 +268,123 @@ jobs:
           name: ${{ matrix.platform }}.img
           path: results/*.img
         if: ${{ matrix.platform == 'raspberrypi' }}
+
+  deploy:
+    name: Deploy
+    needs: [image]
+    if: github.event_name == 'workflow_dispatch' && github.event.inputs.deploy != 'NONE'
+    runs-on: ubuntu-latest
+    env:
+      REGISTRY: >-
+        ${{
+          fromJson('{
+            "alpha": "https://alpha-registry-x.start9.com",
+            "beta": "https://beta-registry.start9.com"
+          }')[github.event.inputs.deploy]
+        }}
+      S3_BUCKET: s3://startos-images
+      S3_CDN: https://startos-images.nyc3.cdn.digitaloceanspaces.com
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          sparse-checkout: web/package.json
+
+      - name: Determine version
+        id: version
+        run: |
+          VERSION=$(sed -n 's/.*"version": *"\([^"]*\)".*/\1/p' web/package.json | head -1)
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "Version: $VERSION"
+
+      - name: Determine platforms
+        id: platforms
+        run: |
+          INPUT="${{ github.event.inputs.platform }}"
+          if [ "$INPUT" = "ALL" ]; then
+            PLATFORMS="x86_64 x86_64-nonfree x86_64-nvidia aarch64 aarch64-nonfree aarch64-nvidia riscv64 riscv64-nonfree"
+          else
+            PLATFORMS="$INPUT"
+          fi
+          echo "list=$PLATFORMS" >> "$GITHUB_OUTPUT"
+          echo "Platforms: $PLATFORMS"
+
+      - name: Download squashfs artifacts
+        uses: actions/download-artifact@v8
+        with:
+          pattern: "*.squashfs"
+          path: artifacts/
+          merge-multiple: true
+
+      - name: Download ISO artifacts
+        uses: actions/download-artifact@v8
+        with:
+          pattern: "*.iso"
+          path: artifacts/
+          merge-multiple: true
+
+      - name: Install start-cli
+        run: |
+          ARCH=$(uname -m)
+          OS=$(uname -s | tr '[:upper:]' '[:lower:]')
+          ASSET_NAME="start-cli_${ARCH}-${OS}"
+          DOWNLOAD_URL=$(curl -fsS \
+            -H "Authorization: token ${{ github.token }}" \
+            https://api.github.com/repos/Start9Labs/start-os/releases \
+            | jq -r '[.[].assets[] | select(.name=="'"$ASSET_NAME"'")] | first | .browser_download_url')
+          curl -fsSL \
+            -H "Authorization: token ${{ github.token }}" \
+            -H "Accept: application/octet-stream" \
+            "$DOWNLOAD_URL" -o /tmp/start-cli
+          sudo install -m 755 /tmp/start-cli /usr/local/bin/start-cli
+          echo "start-cli: $(start-cli --version)"
+
+      - name: Configure S3
+        run: |
+          sudo apt-get install -y -qq s3cmd > /dev/null
+          cat > ~/.s3cfg <<EOF
+          [default]
+          access_key = ${{ secrets.S3_ACCESS_KEY }}
+          secret_key = ${{ secrets.S3_SECRET_KEY }}
+          host_base = nyc3.digitaloceanspaces.com
+          host_bucket = %(bucket)s.nyc3.digitaloceanspaces.com
+          use_https = True
+          EOF
+
+      - name: Set up developer key
+        run: |
+          mkdir -p ~/.startos
+          printf '%s' "${{ secrets.DEV_KEY }}" > ~/.startos/developer.key.pem
+
+      - name: Upload to S3
+        run: |
+          VERSION="${{ steps.version.outputs.version }}"
+          cd artifacts
+          for PLATFORM in ${{ steps.platforms.outputs.list }}; do
+            for file in *_${PLATFORM}.squashfs *_${PLATFORM}.iso; do
+              [ -f "$file" ] || continue
+              echo "Uploading $file..."
+              s3cmd put -P "$file" "${{ env.S3_BUCKET }}/v${VERSION}/$file"
+            done
+          done
+
+      - name: Register OS version
+        run: |
+          VERSION="${{ steps.version.outputs.version }}"
+          start-cli --registry="${{ env.REGISTRY }}" registry os version add \
+            "$VERSION" "v${VERSION}" '' ">=0.3.5 <=${VERSION}"
+
+      - name: Index assets in registry
+        run: |
+          VERSION="${{ steps.version.outputs.version }}"
+          cd artifacts
+          for PLATFORM in ${{ steps.platforms.outputs.list }}; do
+            for file in *_${PLATFORM}.squashfs *_${PLATFORM}.iso; do
+              [ -f "$file" ] || continue
+              echo "Indexing $file for platform $PLATFORM..."
+              start-cli --registry="${{ env.REGISTRY }}" registry os asset add \
+                --platform="$PLATFORM" \
+                --version="$VERSION" \
+                "$file" \
+                "${{ env.S3_CDN }}/v${VERSION}/$file"
+            done
+          done

.gitignore

@@ -23,3 +23,4 @@ tmp
 web/.i18n-checked
 docs/USER.md
 *.s9pk
+/build/lib/migration-images

Makefile

@@ -15,7 +15,7 @@ IMAGE_TYPE=$(shell if [ "$(PLATFORM)" = raspberrypi ]; then echo img; else echo
 WEB_UIS := web/dist/raw/ui/index.html web/dist/raw/setup-wizard/index.html
 COMPRESSED_WEB_UIS := web/dist/static/ui/index.html web/dist/static/setup-wizard/index.html
 FIRMWARE_ROMS := build/lib/firmware/$(PLATFORM) $(shell jq --raw-output '.[] | select(.platform[] | contains("$(PLATFORM)")) | "./build/lib/firmware/$(PLATFORM)/" + .id + ".rom.gz"' build/lib/firmware.json)
-BUILD_SRC := $(call ls-files, build/lib) build/lib/depends build/lib/conflicts $(FIRMWARE_ROMS)
+BUILD_SRC := $(call ls-files, build/lib) build/lib/depends build/lib/conflicts $(FIRMWARE_ROMS) build/lib/migration-images/.done
 IMAGE_RECIPE_SRC := $(call ls-files, build/image-recipe/)
 STARTD_SRC := core/startd.service $(BUILD_SRC)
 CORE_SRC := $(call ls-files, core) $(shell git ls-files --recurse-submodules patch-db) $(GIT_HASH_FILE)
@@ -89,6 +89,7 @@ clean:
 	rm -rf container-runtime/node_modules
 	rm -f container-runtime/*.squashfs
 	(cd sdk && make clean)
+	rm -rf build/lib/migration-images
 	rm -f env/*.txt
 
 format:
@@ -105,6 +106,10 @@ test-sdk: $(call ls-files, sdk) sdk/base/lib/osBindings/index.ts
 test-container-runtime: container-runtime/node_modules/.package-lock.json $(call ls-files, container-runtime/src) container-runtime/package.json container-runtime/tsconfig.json 
 	cd container-runtime && npm test
 
+build/lib/migration-images/.done: build/save-migration-images.sh
+	ARCH=$(ARCH) ./build/save-migration-images.sh build/lib/migration-images
+	touch $@
+
 install-cli: $(GIT_HASH_FILE)
 	./core/build/build-cli.sh --install
 

build/apt/publish-deb.sh

@@ -83,11 +83,16 @@ if [ ${#DEB_FILES[@]} -eq 0 ]; then
     exit 1
 fi
 
-# Copy each deb to the pool, renaming to standard format
+# Copy each deb to the pool, removing old versions of the same package+arch
 for deb in "${DEB_FILES[@]}"; do
     PKG_NAME="$(dpkg-deb --field "$deb" Package)"
+    PKG_ARCH="$(dpkg-deb --field "$deb" Architecture)"
     POOL_DIR="$REPO_DIR/pool/${COMPONENT}/${PKG_NAME:0:1}/${PKG_NAME}"
     mkdir -p "$POOL_DIR"
+    # Remove old versions for the same architecture
+    for old in "$POOL_DIR"/${PKG_NAME}_*_${PKG_ARCH}.deb; do
+        [ -f "$old" ] && rm -v "$old"
+    done
     cp "$deb" "$POOL_DIR/"
     dpkg-name -o "$POOL_DIR/$(basename "$deb")" 2>/dev/null || true
     echo "Added: $(basename "$deb") -> pool/${COMPONENT}/${PKG_NAME:0:1}/${PKG_NAME}/"
@@ -133,7 +138,7 @@ fi
 
 # Upload to S3
 echo "Uploading to s3://${BUCKET}/ ..."
-s3 sync --acl-public --no-mime-magic "$REPO_DIR/" "s3://${BUCKET}/"
+s3 sync --acl-public --no-mime-magic --delete-removed "$REPO_DIR/" "s3://${BUCKET}/"
 
 [ -n "$S3CMD_CONFIG" ] && rm -f "$S3CMD_CONFIG"
 echo "Done."

build/lib/scripts/forward-port

@@ -58,15 +58,18 @@ iptables -t nat -A ${NAME}_OUTPUT -d "$sip" -p udp --dport "$sport" -j DNAT --to
 iptables -A ${NAME}_FORWARD -d $dip -p tcp --dport $dport -m state --state NEW -j ACCEPT
 iptables -A ${NAME}_FORWARD -d $dip -p udp --dport $dport -m state --state NEW -j ACCEPT
 
-# NAT hairpin: masquerade traffic from the bridge subnet or host to the DNAT
-# target, so replies route back through the host for proper NAT reversal.
-# Container-to-container hairpin (source is on the bridge subnet)
-if [ -n "$bridge_subnet" ]; then
-    iptables -t nat -A ${NAME}_POSTROUTING -s "$bridge_subnet" -d "$dip" -p tcp --dport "$dport" -j MASQUERADE
-    iptables -t nat -A ${NAME}_POSTROUTING -s "$bridge_subnet" -d "$dip" -p udp --dport "$dport" -j MASQUERADE
-fi
-# Host-to-container hairpin (host connects to its own gateway IP, source is sip)
-iptables -t nat -A ${NAME}_POSTROUTING -s "$sip" -d "$dip" -p tcp --dport "$dport" -j MASQUERADE
-iptables -t nat -A ${NAME}_POSTROUTING -s "$sip" -d "$dip" -p udp --dport "$dport" -j MASQUERADE
+# NAT hairpin: masquerade so replies route back through this host for proper
+# NAT reversal instead of taking a direct path that bypasses conntrack.
+# Host-to-target hairpin: locally-originated packets whose original destination
+# was sip (before OUTPUT DNAT rewrote it to dip).  Using --ctorigdst ties the
+# rule to this specific sip, so multiple WAN IPs forwarding the same port to
+# different targets each get their own masquerade.
+iptables -t nat -A ${NAME}_POSTROUTING -m addrtype --src-type LOCAL -m conntrack --ctorigdst "$sip" -d "$dip" -p tcp --dport "$dport" -j MASQUERADE
+iptables -t nat -A ${NAME}_POSTROUTING -m addrtype --src-type LOCAL -m conntrack --ctorigdst "$sip" -d "$dip" -p udp --dport "$dport" -j MASQUERADE
+# Same-subnet hairpin: when traffic originates from the same subnet as the DNAT
+# target (e.g. a container reaching another container, or a WireGuard peer
+# connecting to itself via the tunnel's public IP).
+iptables -t nat -A ${NAME}_POSTROUTING -s "$dip/$dprefix" -d "$dip" -p tcp --dport "$dport" -j MASQUERADE
+iptables -t nat -A ${NAME}_POSTROUTING -s "$dip/$dprefix" -d "$dip" -p udp --dport "$dport" -j MASQUERADE
 
 exit $err

build/manage-release.sh

@@ -8,6 +8,7 @@ S3_BUCKET="s3://startos-images"
 S3_CDN="https://startos-images.nyc3.cdn.digitaloceanspaces.com"
 START9_GPG_KEY="2D63C217"
 
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ARCHES="aarch64 aarch64-nonfree aarch64-nvidia riscv64 riscv64-nonfree x86_64 x86_64-nonfree x86_64-nvidia"
 CLI_ARCHES="aarch64 riscv64 x86_64"
 
@@ -83,16 +84,21 @@ resolve_gh_user() {
     GH_GPG_KEY=$(git config user.signingkey 2>/dev/null || true)
 }
 
+# Fetch the URL for an OS asset from the registry index.
+# Usage: registry_url <iso|squashfs|img> <platform>
+registry_url() {
+    local ext=$1 platform=$2
+    if [ -z "${_REGISTRY_INDEX:-}" ]; then
+        _REGISTRY_INDEX=$(start-cli --registry=$REGISTRY registry os index)
+    fi
+    echo "$_REGISTRY_INDEX" | jq -r ".versions[\"$VERSION\"].$ext[\"$platform\"].urls[0]"
+}
+
 # --- Subcommands ---
 
 cmd_download() {
     require_version
 
-    if [ -z "${RUN_ID:-}" ]; then
-        read -rp "RUN_ID (OS images, leave blank to skip): " RUN_ID
-    fi
-    RUN_ID=$(parse_run_id "${RUN_ID:-}")
-
     if [ -z "${ST_RUN_ID:-}" ]; then
         read -rp "ST_RUN_ID (start-tunnel, leave blank to skip): " ST_RUN_ID
     fi
@@ -105,14 +111,14 @@ cmd_download() {
 
     ensure_release_dir
 
-    if [ -n "$RUN_ID" ]; then
-        for arch in $ARCHES; do
-            while ! gh run download -R $REPO "$RUN_ID" -n "$arch.squashfs" -D "$(pwd)"; do sleep 1; done
+    # Download OS images from registry (deployed by GitHub workflow)
+    echo "Downloading OS images from registry..."
+    for arch in $ARCHES; do
+        for ext in squashfs iso; do
+            echo "  $ext $arch"
+            start-cli --registry=$REGISTRY registry os asset get "$ext" "$VERSION" "$arch" -d "$(pwd)"
         done
-        for arch in $ARCHES; do
-            while ! gh run download -R $REPO "$RUN_ID" -n "$arch.iso" -D "$(pwd)"; do sleep 1; done
-        done
-    fi
+    done
 
     if [ -n "$ST_RUN_ID" ]; then
         for arch in $CLI_ARCHES; do
@@ -143,19 +149,12 @@ cmd_pull() {
         gh release download -R $REPO "v$VERSION" -p "$file" -D "$(pwd)" --clobber
     done
 
-    # Download ISOs and squashfs from S3 CDN
+    # Download ISOs and squashfs from registry
+    echo "Downloading OS images from registry..."
     for arch in $ARCHES; do
         for ext in squashfs iso; do
-            # Get the actual filename from the GH release asset list or body
-            local filename
-            filename=$(gh release view -R $REPO "v$VERSION" --json assets -q ".assets[].name" | grep "_${arch}\\.${ext}$" || true)
-            if [ -z "$filename" ]; then
-                filename=$(gh release view -R $REPO "v$VERSION" --json body -q .body | grep -oP "[^ ]*_${arch}\\.${ext}" | head -1 || true)
-            fi
-            if [ -n "$filename" ]; then
-                echo "Downloading $filename from S3..."
-                curl -fSL -o "$filename" "$S3_CDN/v$VERSION/$filename"
-            fi
+            echo "  $ext $arch"
+            start-cli --registry=$REGISTRY registry os asset get "$ext" "$VERSION" "$arch" -d "$(pwd)"
         done
     done
 }
@@ -170,14 +169,12 @@ cmd_upload() {
     require_version
     enter_release_dir
 
+    # OS images (iso/squashfs) are already on S3 via the GitHub workflow.
+    # Upload only debs and CLI binaries to the GitHub Release.
     for file in $(release_files); do
         case "$file" in
-            *.iso|*.squashfs)
-                s3cmd put -P "$file" "$S3_BUCKET/v$VERSION/$file"
-                ;;
-            *)
-                gh release upload -R $REPO "v$VERSION" "$file"
-                ;;
+            *.iso|*.squashfs) ;;
+            *) gh release upload -R $REPO "v$VERSION" "$file" ;;
         esac
     done
 }
@@ -248,6 +245,24 @@ cmd_cosign() {
     echo "Done. Personal signatures for $GH_USER added to v$VERSION."
 }
 
+cmd_publish_tunnel() {
+    require_version
+    enter_release_dir
+
+    local tunnel_debs=()
+    for file in start-tunnel*.deb; do
+        [ -f "$file" ] && tunnel_debs+=("$file")
+    done
+
+    if [ ${#tunnel_debs[@]} -eq 0 ]; then
+        >&2 echo "No start-tunnel .deb files found in release directory"
+        exit 1
+    fi
+
+    echo "Publishing start-tunnel debs to apt repository..."
+    "$SCRIPT_DIR/apt/publish-deb.sh" "${tunnel_debs[@]}"
+}
+
 cmd_notes() {
     require_version
     enter_release_dir
@@ -255,14 +270,14 @@ cmd_notes() {
     cat << EOF
 # ISO Downloads
 
-- [x86_64/AMD64]($S3_CDN/v$VERSION/$(ls *_x86_64-nonfree.iso))
-- [x86_64/AMD64 + NVIDIA]($S3_CDN/v$VERSION/$(ls *_x86_64-nvidia.iso))
-- [x86_64/AMD64-slim (FOSS-only)]($S3_CDN/v$VERSION/$(ls *_x86_64.iso) "Without proprietary software or drivers")
-- [aarch64/ARM64]($S3_CDN/v$VERSION/$(ls *_aarch64-nonfree.iso))
-- [aarch64/ARM64 + NVIDIA]($S3_CDN/v$VERSION/$(ls *_aarch64-nvidia.iso))
-- [aarch64/ARM64-slim (FOSS-Only)]($S3_CDN/v$VERSION/$(ls *_aarch64.iso) "Without proprietary software or drivers")
-- [RISCV64 (RVA23)]($S3_CDN/v$VERSION/$(ls *_riscv64-nonfree.iso))
-- [RISCV64 (RVA23)-slim (FOSS-only)]($S3_CDN/v$VERSION/$(ls *_riscv64.iso) "Without proprietary software or drivers")
+- [x86_64/AMD64]($(registry_url iso x86_64-nonfree))
+- [x86_64/AMD64 + NVIDIA]($(registry_url iso x86_64-nvidia))
+- [x86_64/AMD64-slim (FOSS-only)]($(registry_url iso x86_64) "Without proprietary software or drivers")
+- [aarch64/ARM64]($(registry_url iso aarch64-nonfree))
+- [aarch64/ARM64 + NVIDIA]($(registry_url iso aarch64-nvidia))
+- [aarch64/ARM64-slim (FOSS-Only)]($(registry_url iso aarch64) "Without proprietary software or drivers")
+- [RISCV64 (RVA23)]($(registry_url iso riscv64-nonfree))
+- [RISCV64 (RVA23)-slim (FOSS-only)]($(registry_url iso riscv64) "Without proprietary software or drivers")
 
 EOF
     cat << 'EOF'
@@ -318,9 +333,8 @@ EOF
 
 cmd_full_release() {
     cmd_download
-    cmd_register
     cmd_upload
-    cmd_index
+    cmd_publish_tunnel
     cmd_sign
     cmd_notes
 }
@@ -330,22 +344,23 @@ usage() {
 Usage: manage-release.sh <subcommand>
 
 Subcommands:
-  download      Download artifacts from GitHub Actions runs
-                Requires: RUN_ID, ST_RUN_ID, CLI_RUN_ID (any combination)
-  pull          Download an existing release from the GH tag and S3
-  register      Register the version in the Start9 registry
-  upload        Upload artifacts to GitHub Releases and S3
-  index         Add assets to the registry index
-  sign          Sign all artifacts with Start9 org key (+ personal key if available)
-                and upload signatures.tar.gz
-  cosign        Add personal GPG signature to an existing release's signatures
-                (requires 'pull' first so you can verify assets before signing)
-  notes         Print release notes with download links and checksums
-  full-release  Run: download → register → upload → index → sign → notes
+  download        Download OS images from registry + other artifacts from GH Actions
+                  OS images are pulled via start-cli from the registry (deployed by GH workflow)
+                  Requires: ST_RUN_ID, CLI_RUN_ID (any combination)
+  pull            Download an existing release from the GH tag and S3
+  register        Register the version in the Start9 registry
+  upload          Upload artifacts to GitHub Releases and S3
+  index           Add assets to the registry index
+  publish-tunnel  Publish start-tunnel .deb files to the apt repository
+  sign            Sign all artifacts with Start9 org key (+ personal key if available)
+                  and upload signatures.tar.gz
+  cosign          Add personal GPG signature to an existing release's signatures
+                  (requires 'pull' first so you can verify assets before signing)
+  notes           Print release notes with download links and checksums
+  full-release    Run: download → register → upload → publish-tunnel → sign → notes
 
 Environment variables:
   VERSION     (required) Release version
-  RUN_ID      GitHub Actions run ID for OS images (download subcommand)
   ST_RUN_ID   GitHub Actions run ID for start-tunnel (download subcommand)
   CLI_RUN_ID  GitHub Actions run ID for start-cli (download subcommand)
   GH_USER     Override GitHub username (default: autodetected via gh cli)
@@ -354,14 +369,15 @@ EOF
 }
 
 case "${1:-}" in
-    download) cmd_download ;;
-    pull)     cmd_pull ;;
-    register) cmd_register ;;
-    upload)   cmd_upload ;;
-    index)    cmd_index ;;
-    sign)     cmd_sign ;;
-    cosign)   cmd_cosign ;;
-    notes)    cmd_notes ;;
-    full-release) cmd_full_release ;;
-    *)            usage; exit 1 ;;
+    download)       cmd_download ;;
+    pull)           cmd_pull ;;
+    register)       cmd_register ;;
+    upload)         cmd_upload ;;
+    index)          cmd_index ;;
+    publish-tunnel) cmd_publish_tunnel ;;
+    sign)           cmd_sign ;;
+    cosign)         cmd_cosign ;;
+    notes)          cmd_notes ;;
+    full-release)   cmd_full_release ;;
+    *)              usage; exit 1 ;;
 esac

build/save-migration-images.sh

@@ -0,0 +1,36 @@
+#!/bin/bash
+# Save Docker images needed by the 0.3.6-alpha.0 migration as tarballs
+# so they can be bundled into the OS and loaded without internet access.
+set -e
+
+ARCH="${ARCH:-x86_64}"
+DESTDIR="${1:-build/lib/migration-images}"
+
+if [ "$ARCH" = "x86_64" ]; then
+    DOCKER_PLATFORM="linux/amd64"
+elif [ "$ARCH" = "aarch64" ]; then
+    DOCKER_PLATFORM="linux/arm64"
+else
+    DOCKER_PLATFORM="linux/$ARCH"
+fi
+
+IMAGES=("tonistiigi/binfmt:latest")
+if [ "$ARCH" != "riscv64" ]; then
+    IMAGES=("start9/compat:latest" "start9/utils:latest" "${IMAGES[@]}")
+fi
+
+mkdir -p "$DESTDIR"
+
+for IMAGE in "${IMAGES[@]}"; do
+    FILENAME=$(echo "$IMAGE" | sed 's|/|_|g; s/:/_/g').tar
+    if [ -f "$DESTDIR/$FILENAME" ]; then
+        echo "Skipping $IMAGE (already saved)"
+        continue
+    fi
+    echo "Pulling $IMAGE for $DOCKER_PLATFORM..."
+    docker pull --platform "$DOCKER_PLATFORM" "$IMAGE"
+    echo "Saving $IMAGE to $DESTDIR/$FILENAME..."
+    docker save "$IMAGE" -o "$DESTDIR/$FILENAME"
+done
+
+echo "Migration images saved to $DESTDIR"

container-runtime/package-lock.json

@@ -37,7 +37,7 @@
     },
     "../sdk/dist": {
       "name": "@start9labs/start-sdk",
-      "version": "0.4.0-beta.64",
+      "version": "1.0.0",
       "license": "MIT",
       "dependencies": {
         "@iarna/toml": "^3.0.0",

container-runtime/src/Adapters/Systems/SystemForEmbassy/index.ts

@@ -396,6 +396,12 @@ export class SystemForEmbassy implements System {
     if (this.manifest.id === "nostr") {
       this.manifest.id = "nostr-rs-relay"
     }
+    if (this.manifest.id === "ghost") {
+      this.manifest.id = "ghost-legacy"
+    }
+    if (this.manifest.id === "synapse") {
+      this.manifest.id = "synapse-legacy"
+    }
   }
 
   async init(
@@ -494,7 +500,7 @@ export class SystemForEmbassy implements System {
       const host = new MultiHost({ effects, id })
       const internalPorts = new Set(
         Object.values(interfaceValue["tor-config"]?.["port-mapping"] ?? {})
-          .map(Number.parseInt)
+          .map((v) => parseInt(v))
           .concat(
             ...Object.values(interfaceValue["lan-config"] ?? {}).map(
               (c) => c.internal,

core/Cargo.lock

@@ -1967,6 +1967,18 @@ dependencies = [
  "once_cell",
 ]
 
+[[package]]
+name = "fallible-iterator"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2acce4a10f12dc2fb14a218589d4f1f62ef011b2d0cc4b3cb1bba8e94da14649"
+
+[[package]]
+name = "fallible-streaming-iterator"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7360491ce676a36bf9bb3c56c1aa791658183a54d2744120f27285738d90465a"
+
 [[package]]
 name = "fastrand"
 version = "2.3.0"
@@ -3562,6 +3574,17 @@ dependencies = [
  "redox_syscall 0.7.3",
 ]
 
+[[package]]
+name = "libsqlite3-sys"
+version = "0.32.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fbb8270bb4060bd76c6e96f20c52d80620f1d82a3470885694e41e0f81ef6fe7"
+dependencies = [
+ "cc",
+ "pkg-config",
+ "vcpkg",
+]
+
 [[package]]
 name = "libyml"
 version = "0.0.5"
@@ -5444,6 +5467,20 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "rusqlite"
+version = "0.34.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37e34486da88d8e051c7c0e23c3f15fd806ea8546260aa2fec247e97242ec143"
+dependencies = [
+ "bitflags 2.11.0",
+ "fallible-iterator",
+ "fallible-streaming-iterator",
+ "hashlink",
+ "libsqlite3-sys",
+ "smallvec",
+]
+
 [[package]]
 name = "rust-argon2"
 version = "3.0.0"
@@ -6439,7 +6476,7 @@ dependencies = [
 
 [[package]]
 name = "start-os"
-version = "0.4.0-alpha.22"
+version = "0.4.0-beta.0"
 dependencies = [
  "aes",
  "async-acme",
@@ -6536,6 +6573,7 @@ dependencies = [
  "reqwest_cookie_store",
  "rpassword",
  "rpc-toolkit",
+ "rusqlite",
  "rust-argon2",
  "rust-i18n",
  "semver",

core/Cargo.toml

@@ -15,7 +15,7 @@ license = "MIT"
 name = "start-os"
 readme = "README.md"
 repository = "https://github.com/Start9Labs/start-os"
-version = "0.4.0-alpha.22" # VERSION_BUMP
+version = "0.4.0-beta.0" # VERSION_BUMP
 
 [lib]
 name = "startos"
@@ -182,6 +182,7 @@ qrcode = "0.14.1"
 r3bl_tui = "0.7.6"
 rand = "0.9.2"
 regex = "1.10.2"
+rusqlite = { version = "0.34", features = ["bundled"] }
 reqwest = { version = "0.12.25", features = [
   "http2",
   "json",
@@ -250,5 +251,3 @@ opt-level = 3
 [profile.dev.package.backtrace]
 opt-level = 3
 
-[profile.dev.package.sqlx-macros]
-opt-level = 3

core/locales/i18n.yaml

@@ -1721,6 +1721,14 @@ lxc.mod.cleaned-up-containers:
   fr_FR: "Conteneurs LXC orphelins nettoyés avec succès"
   pl_PL: "Pomyślnie wyczyszczono wiszące kontenery LXC"
 
+# version/v0_3_6_alpha_0.rs
+migration.migrating-package:
+  en_US: "Migrating package %{package}..."
+  de_DE: "Paket %{package} wird migriert..."
+  es_ES: "Migrando paquete %{package}..."
+  fr_FR: "Migration du paquet %{package}..."
+  pl_PL: "Migracja pakietu %{package}..."
+
 # registry/admin.rs
 registry.admin.unknown-signer:
   en_US: "Unknown signer"
@@ -1818,13 +1826,28 @@ registry.os.version.signer-not-authorized:
   fr_FR: "Le signataire %{signer} n'est pas autorisé à signer pour v%{version}"
   pl_PL: "Sygnatariusz %{signer} nie jest autoryzowany do podpisywania v%{version}"
 
+# registry/os/promote.rs
+registry.os.promote.need-from-or-to:
+  en_US: "At least one of --from or --to must be specified"
+  de_DE: "Mindestens --from oder --to muss angegeben werden"
+  es_ES: "Se debe especificar al menos --from o --to"
+  fr_FR: "Au moins --from ou --to doit être spécifié"
+  pl_PL: "Należy podać przynajmniej --from lub --to"
+
+registry.os.promote.version-not-found:
+  en_US: "OS version %{version} not found on source registry"
+  de_DE: "OS-Version %{version} nicht in der Quell-Registry gefunden"
+  es_ES: "Versión del SO %{version} no encontrada en el registro de origen"
+  fr_FR: "Version OS %{version} introuvable dans le registre source"
+  pl_PL: "Wersja OS %{version} nie znaleziona w rejestrze źródłowym"
+
 # registry/package/mod.rs
 registry.package.remove-not-exist:
-  en_US: "%{id}@%{version}%{sighash} does not exist, so not removed"
-  de_DE: "%{id}@%{version}%{sighash} existiert nicht, daher nicht entfernt"
-  es_ES: "%{id}@%{version}%{sighash} no existe, por lo que no se eliminó"
-  fr_FR: "%{id}@%{version}%{sighash} n'existe pas, donc non supprimé"
-  pl_PL: "%{id}@%{version}%{sighash} nie istnieje, więc nie usunięto"
+  en_US: "%{id}%{version}%{sighash} does not exist, so not removed"
+  de_DE: "%{id}%{version}%{sighash} existiert nicht, daher nicht entfernt"
+  es_ES: "%{id}%{version}%{sighash} no existe, por lo que no se eliminó"
+  fr_FR: "%{id}%{version}%{sighash} n'existe pas, donc non supprimé"
+  pl_PL: "%{id}%{version}%{sighash} nie istnieje, więc nie usunięto"
 
 # registry/package/add.rs
 registry.package.add.must-specify-url:
@@ -1848,6 +1871,13 @@ registry.package.missing-signer:
   fr_FR: "Signataire manquant"
   pl_PL: "Brak sygnatariusza"
 
+registry.package.remove-has-versions:
+  en_US: "Package %{id} has versions; use --force to remove"
+  de_DE: "Paket %{id} hat Versionen; verwenden Sie --force zum Entfernen"
+  es_ES: "El paquete %{id} tiene versiones; use --force para eliminar"
+  fr_FR: "Le paquet %{id} a des versions ; utilisez --force pour supprimer"
+  pl_PL: "Pakiet %{id} ma wersje; użyj --force aby usunąć"
+
 registry.package.unauthorized:
   en_US: "Unauthorized"
   de_DE: "Nicht autorisiert"
@@ -1862,6 +1892,20 @@ registry.package.add-mirror.unauthorized:
   fr_FR: "Non autorisé"
   pl_PL: "Brak autoryzacji"
 
+registry.package.promote.need-from-or-to:
+  en_US: "At least one of --from or --to must be specified"
+  de_DE: "Mindestens --from oder --to muss angegeben werden"
+  es_ES: "Se debe especificar al menos --from o --to"
+  fr_FR: "Au moins --from ou --to doit être spécifié"
+  pl_PL: "Należy podać przynajmniej --from lub --to"
+
+registry.package.promote.version-not-found:
+  en_US: "Version %{version} of %{id} not found on source registry"
+  de_DE: "Version %{version} von %{id} nicht in der Quell-Registry gefunden"
+  es_ES: "Versión %{version} de %{id} no encontrada en el registro de origen"
+  fr_FR: "Version %{version} de %{id} introuvable dans le registre source"
+  pl_PL: "Wersja %{version} pakietu %{id} nie znaleziona w rejestrze źródłowym"
+
 registry.package.cannot-remove-last-mirror:
   en_US: "Cannot remove last mirror from an s9pk"
   de_DE: "Letzter Spiegel kann nicht aus einem s9pk entfernt werden"
@@ -2649,6 +2693,13 @@ help.arg.add-signer-key:
   fr_FR: "Ajouter une clé publique au signataire"
   pl_PL: "Dodaj klucz publiczny do sygnatariusza"
 
+help.arg.address:
+  en_US: "Network address"
+  de_DE: "Netzwerkadresse"
+  es_ES: "Dirección de red"
+  fr_FR: "Adresse réseau"
+  pl_PL: "Adres sieciowy"
+
 help.arg.allow-model-mismatch:
   en_US: "Allow database model mismatch"
   de_DE: "Datenbankmodell-Abweichung erlauben"
@@ -2803,6 +2854,13 @@ help.arg.echoip-urls:
   fr_FR: "URLs du service Echo IP pour la détection d'IP externe"
   pl_PL: "Adresy URL usługi Echo IP do wykrywania zewnętrznego IP"
 
+help.arg.ed25519:
+  en_US: "Use Ed25519 instead of NIST P-256"
+  de_DE: "Ed25519 anstelle von NIST P-256 verwenden"
+  es_ES: "Usar Ed25519 en lugar de NIST P-256"
+  fr_FR: "Utiliser Ed25519 au lieu de NIST P-256"
+  pl_PL: "Użyj Ed25519 zamiast NIST P-256"
+
 help.arg.emulate-missing-arch:
   en_US: "Emulate missing architecture using this one"
   de_DE: "Fehlende Architektur mit dieser emulieren"
@@ -2859,6 +2917,13 @@ help.arg.force-clear-task:
   fr_FR: "Forcer la suppression de la tâche même si elle est en cours"
   pl_PL: "Wymuś wyczyszczenie zadania nawet jeśli jest uruchomione"
 
+help.arg.force-remove-package:
+  en_US: "Force removal even if the package has versions"
+  de_DE: "Entfernung erzwingen, auch wenn das Paket Versionen hat"
+  es_ES: "Forzar la eliminación aunque el paquete tenga versiones"
+  fr_FR: "Forcer la suppression même si le paquet a des versions"
+  pl_PL: "Wymuś usunięcie nawet jeśli pakiet ma wersje"
+
 help.arg.force-stderr-tty:
   en_US: "Force stderr to be treated as a TTY"
   de_DE: "stderr als TTY behandeln erzwingen"
@@ -2880,6 +2945,13 @@ help.arg.force-uninstall:
   fr_FR: "Ignorer les erreurs dans le script de désinitialisation du service"
   pl_PL: "Ignoruj błędy w skrypcie deinicjalizacji usługi"
 
+help.arg.from-registry-url:
+  en_US: "Source registry URL to promote from"
+  de_DE: "Quell-Registry-URL zum Heraufstufen"
+  es_ES: "URL del registro de origen para promover"
+  fr_FR: "URL du registre source pour la promotion"
+  pl_PL: "URL rejestru źródłowego do promowania"
+
 help.arg.host-url:
   en_US: "URL of the StartOS server"
   de_DE: "URL des StartOS-Servers"
@@ -2887,6 +2959,13 @@ help.arg.host-url:
   fr_FR: "URL du serveur StartOS"
   pl_PL: "URL serwera StartOS"
 
+help.arg.hostnames:
+  en_US: "Hostnames to include in the certificate"
+  de_DE: "Hostnamen, die in das Zertifikat aufgenommen werden sollen"
+  es_ES: "Nombres de host para incluir en el certificado"
+  fr_FR: "Noms d'hôtes à inclure dans le certificat"
+  pl_PL: "Nazwy hostów do uwzględnienia w certyfikacie"
+
 help.arg.icon-path:
   en_US: "Path to service icon file"
   de_DE: "Pfad zur Service-Icon-Datei"
@@ -2894,6 +2973,13 @@ help.arg.icon-path:
   fr_FR: "Chemin vers le fichier d'icône du service"
   pl_PL: "Ścieżka do pliku ikony usługi"
 
+help.arg.icon-source:
+  en_US: "Icon source: file path, file:// URL, http(s):// URL, or data: URL"
+  de_DE: "Icon-Quelle: Dateipfad, file://-URL, http(s)://-URL oder data:-URL"
+  es_ES: "Fuente del icono: ruta de archivo, URL file://, URL http(s):// o URL data:"
+  fr_FR: "Source de l'icône : chemin de fichier, URL file://, URL http(s):// ou URL data:"
+  pl_PL: "Źródło ikony: ścieżka pliku, URL file://, URL http(s):// lub URL data:"
+
 help.arg.image-id:
   en_US: "Docker image identifier"
   de_DE: "Docker-Image-Kennung"
@@ -2978,6 +3064,34 @@ help.arg.merge:
   fr_FR: "Fusionner avec la plage de versions existante au lieu de remplacer"
   pl_PL: "Połącz z istniejącym zakresem wersji zamiast zastępować"
 
+help.arg.metrics-after:
+  en_US: "Start of time range (RFC 3339 timestamp)"
+  de_DE: "Beginn des Zeitraums (RFC 3339 Zeitstempel)"
+  es_ES: "Inicio del rango de tiempo (marca de tiempo RFC 3339)"
+  fr_FR: "Début de la plage temporelle (horodatage RFC 3339)"
+  pl_PL: "Początek zakresu czasu (znacznik czasu RFC 3339)"
+
+help.arg.metrics-before:
+  en_US: "End of time range (RFC 3339 timestamp)"
+  de_DE: "Ende des Zeitraums (RFC 3339 Zeitstempel)"
+  es_ES: "Fin del rango de tiempo (marca de tiempo RFC 3339)"
+  fr_FR: "Fin de la plage temporelle (horodatage RFC 3339)"
+  pl_PL: "Koniec zakresu czasu (znacznik czasu RFC 3339)"
+
+help.arg.metrics-pkg-id:
+  en_US: "Filter by package ID"
+  de_DE: "Nach Paket-ID filtern"
+  es_ES: "Filtrar por ID de paquete"
+  fr_FR: "Filtrer par identifiant de paquet"
+  pl_PL: "Filtruj według identyfikatora pakietu"
+
+help.arg.metrics-version:
+  en_US: "Filter by version"
+  de_DE: "Nach Version filtern"
+  es_ES: "Filtrar por versión"
+  fr_FR: "Filtrer par version"
+  pl_PL: "Filtruj według wersji"
+
 help.arg.mirror-url:
   en_US: "URL of the mirror"
   de_DE: "URL des Spiegels"
@@ -3090,12 +3204,12 @@ help.arg.platform:
   fr_FR: "Identifiant de la plateforme cible"
   pl_PL: "Identyfikator platformy docelowej"
 
-help.arg.postgres-connection-url:
-  en_US: "PostgreSQL connection URL"
-  de_DE: "PostgreSQL-Verbindungs-URL"
-  es_ES: "URL de conexión PostgreSQL"
-  fr_FR: "URL de connexion PostgreSQL"
-  pl_PL: "URL połączenia PostgreSQL"
+help.arg.port:
+  en_US: "Port number"
+  de_DE: "Portnummer"
+  es_ES: "Número de puerto"
+  fr_FR: "Numéro de port"
+  pl_PL: "Numer portu"
 
 help.arg.proxy-url:
   en_US: "HTTP/SOCKS proxy URL"
@@ -3174,6 +3288,13 @@ help.arg.server-id:
   fr_FR: "Identifiant unique du serveur"
   pl_PL: "Unikalny identyfikator serwera"
 
+help.arg.set-as-default-outbound:
+  en_US: "Set as the default outbound gateway"
+  de_DE: "Als Standard-Ausgangs-Gateway festlegen"
+  es_ES: "Establecer como puerta de enlace de salida predeterminada"
+  fr_FR: "Définir comme passerelle de sortie par défaut"
+  pl_PL: "Ustaw jako domyślną bramę wychodzącą"
+
 help.arg.set-signer-name:
   en_US: "Set the signer name"
   de_DE: "Unterzeichnernamen festlegen"
@@ -3314,6 +3435,13 @@ help.arg.target-version-range:
   fr_FR: "Contrainte de plage de version cible"
   pl_PL: "Ograniczenie zakresu wersji docelowej"
 
+help.arg.to-registry-url:
+  en_US: "Destination registry URL to promote to"
+  de_DE: "Ziel-Registry-URL zum Heraufstufen"
+  es_ES: "URL del registro de destino para promover"
+  fr_FR: "URL du registre de destination pour la promotion"
+  pl_PL: "URL rejestru docelowego do promowania"
+
 help.arg.tor-proxy-url:
   en_US: "Tor SOCKS proxy URL"
   de_DE: "Tor-SOCKS-Proxy-URL"
@@ -3538,6 +3666,13 @@ help.arg.gateway-name:
   fr_FR: "Nom de la passerelle"
   pl_PL: "Nazwa bramy"
 
+help.arg.gateway-type:
+  en_US: "Type of gateway"
+  de_DE: "Typ des Gateways"
+  es_ES: "Tipo de puerta de enlace"
+  fr_FR: "Type de passerelle"
+  pl_PL: "Typ bramy"
+
 help.arg.governor-name:
   en_US: "CPU governor name"
   de_DE: "CPU-Governor-Name"
@@ -4064,6 +4199,13 @@ about.add-version-signer:
   fr_FR: "Ajouter un signataire de version"
   pl_PL: "Dodaj sygnatariusza wersji"
 
+about.add-vhost-passthrough:
+  en_US: "Add vhost passthrough"
+  de_DE: "Vhost-Passthrough hinzufügen"
+  es_ES: "Agregar passthrough de vhost"
+  fr_FR: "Ajouter un passthrough vhost"
+  pl_PL: "Dodaj passthrough vhost"
+
 about.add-wifi-ssid-password:
   en_US: "Add wifi ssid and password"
   de_DE: "WLAN-SSID und Passwort hinzufügen"
@@ -4113,6 +4255,13 @@ about.check-for-updates:
   fr_FR: "Vérifier les mises à jour disponibles"
   pl_PL: "Sprawdź dostępne aktualizacje"
 
+about.check-port-reachability:
+  en_US: "Check if a port is reachable from the WAN"
+  de_DE: "Prüfen, ob ein Port vom WAN erreichbar ist"
+  es_ES: "Comprobar si un puerto es accesible desde la WAN"
+  fr_FR: "Vérifier si un port est accessible depuis le WAN"
+  pl_PL: "Sprawdź, czy port jest osiągalny z WAN"
+
 about.check-update-startos:
   en_US: "Check a given registry for StartOS updates and update if available"
   de_DE: "Ein bestimmtes Registry auf StartOS-Updates prüfen und bei Verfügbarkeit aktualisieren"
@@ -4211,6 +4360,13 @@ about.commands-authentication:
   fr_FR: "Commandes liées à l'authentification, comme connexion, déconnexion"
   pl_PL: "Polecenia związane z uwierzytelnianiem, np. logowanie, wylogowanie"
 
+about.commands-authorized-keys:
+  en_US: "Commands for managing authorized keys"
+  de_DE: "Befehle zur Verwaltung autorisierter Schlüssel"
+  es_ES: "Comandos para gestionar claves autorizadas"
+  fr_FR: "Commandes pour gérer les clés autorisées"
+  pl_PL: "Polecenia do zarządzania autoryzowanymi kluczami"
+
 about.commands-backup:
   en_US: "Commands related to backup creation and backup targets"
   de_DE: "Befehle zur Backup-Erstellung und Backup-Zielen"
@@ -4274,6 +4430,41 @@ about.commands-experimental:
   fr_FR: "Commandes liées à la configuration d'options expérimentales comme zram et le gouverneur CPU"
   pl_PL: "Polecenia konfiguracji opcji eksperymentalnych jak zram i regulator CPU"
 
+about.commands-host-address-domain:
+  en_US: "Commands for managing host address domains"
+  de_DE: "Befehle zur Verwaltung von Host-Adressdomänen"
+  es_ES: "Comandos para gestionar dominios de direcciones del host"
+  fr_FR: "Commandes pour gérer les domaines d'adresses de l'hôte"
+  pl_PL: "Polecenia do zarządzania domenami adresów hosta"
+
+about.commands-host-addresses:
+  en_US: "Commands for managing host addresses"
+  de_DE: "Befehle zur Verwaltung von Host-Adressen"
+  es_ES: "Comandos para gestionar direcciones del host"
+  fr_FR: "Commandes pour gérer les adresses de l'hôte"
+  pl_PL: "Polecenia do zarządzania adresami hosta"
+
+about.commands-host-bindings:
+  en_US: "Commands for managing host bindings"
+  de_DE: "Befehle zur Verwaltung von Host-Bindungen"
+  es_ES: "Comandos para gestionar vínculos del host"
+  fr_FR: "Commandes pour gérer les liaisons de l'hôte"
+  pl_PL: "Polecenia do zarządzania powiązaniami hosta"
+
+about.commands-host-private-domain:
+  en_US: "Commands for managing private domains for a host"
+  de_DE: "Befehle zur Verwaltung privater Domänen für einen Host"
+  es_ES: "Comandos para gestionar dominios privados de un host"
+  fr_FR: "Commandes pour gérer les domaines privés d'un hôte"
+  pl_PL: "Polecenia do zarządzania prywatnymi domenami hosta"
+
+about.commands-host-public-domain:
+  en_US: "Commands for managing public domains for a host"
+  de_DE: "Befehle zur Verwaltung öffentlicher Domänen für einen Host"
+  es_ES: "Comandos para gestionar dominios públicos de un host"
+  fr_FR: "Commandes pour gérer les domaines publics d'un hôte"
+  pl_PL: "Polecenia do zarządzania publicznymi domenami hosta"
+
 about.commands-host-system-ui:
   en_US: "Commands for modifying the host for the system ui"
   de_DE: "Befehle zum Ändern des Hosts für die System-UI"
@@ -4330,6 +4521,13 @@ about.commands-packages:
   fr_FR: "Commandes liées aux paquets"
   pl_PL: "Polecenia związane z pakietami"
 
+about.commands-port-forward:
+  en_US: "Commands for managing port forwards"
+  de_DE: "Befehle zur Verwaltung von Portweiterleitungen"
+  es_ES: "Comandos para gestionar reenvíos de puertos"
+  fr_FR: "Commandes pour gérer les redirections de ports"
+  pl_PL: "Polecenia do zarządzania przekierowaniami portów"
+
 about.commands-registry:
   en_US: "Commands related to the registry"
   de_DE: "Befehle zum Registry"
@@ -4344,6 +4542,20 @@ about.commands-registry-db:
   fr_FR: "Commandes pour interagir avec la base de données, comme dump et apply"
   pl_PL: "Polecenia interakcji z bazą danych, np. dump i apply"
 
+about.commands-registry-metrics:
+  en_US: "Query registry usage metrics"
+  de_DE: "Registry-Nutzungsmetriken abfragen"
+  es_ES: "Consultar métricas de uso del registro"
+  fr_FR: "Consulter les métriques d'utilisation du registre"
+  pl_PL: "Zapytaj o metryki użycia rejestru"
+
+about.commands-registry-info:
+  en_US: "View or edit registry information"
+  de_DE: "Registry-Informationen anzeigen oder bearbeiten"
+  es_ES: "Ver o editar información del registro"
+  fr_FR: "Afficher ou modifier les informations du registre"
+  pl_PL: "Wyświetl lub edytuj informacje rejestru"
+
 about.commands-restore-backup:
   en_US: "Commands for restoring package(s) from backup"
   de_DE: "Befehle zum Wiederherstellen von Paketen aus dem Backup"
@@ -4386,6 +4598,20 @@ about.commands-tunnel:
   fr_FR: "Commandes liées à StartTunnel"
   pl_PL: "Polecenia związane z StartTunnel"
 
+about.commands-tunnel-update:
+  en_US: "Commands for checking and applying tunnel updates"
+  de_DE: "Befehle zum Prüfen und Anwenden von Tunnel-Updates"
+  es_ES: "Comandos para verificar y aplicar actualizaciones del túnel"
+  fr_FR: "Commandes pour vérifier et appliquer les mises à jour du tunnel"
+  pl_PL: "Polecenia do sprawdzania i stosowania aktualizacji tunelu"
+
+about.commands-tunnel-web:
+  en_US: "Commands for managing the tunnel web interface"
+  de_DE: "Befehle zur Verwaltung der Tunnel-Weboberfläche"
+  es_ES: "Comandos para gestionar la interfaz web del túnel"
+  fr_FR: "Commandes pour gérer l'interface web du tunnel"
+  pl_PL: "Polecenia do zarządzania interfejsem webowym tunelu"
+
 about.commands-wifi:
   en_US: "Commands related to wifi networks i.e. add, connect, delete"
   de_DE: "Befehle zu WLAN-Netzwerken, z.B. hinzufügen, verbinden, löschen"
@@ -4526,6 +4752,13 @@ about.display-s9pk-manifest:
   fr_FR: "Afficher le manifeste s9pk"
   pl_PL: "Wyświetl manifest s9pk"
 
+about.display-s9pk-root-sighash-and-maxsize:
+  en_US: "Display the s9pk root signature hash and max size"
+  de_DE: "Den s9pk-Root-Signaturhash und die maximale Größe anzeigen"
+  es_ES: "Mostrar el hash de firma raíz y el tamaño máximo del s9pk"
+  fr_FR: "Afficher le hachage de signature racine et la taille maximale du s9pk"
+  pl_PL: "Wyświetl hash podpisu głównego i maksymalny rozmiar s9pk"
+
 about.display-server-metrics:
   en_US: "Display server metrics"
   de_DE: "Server-Metriken anzeigen"
@@ -4589,6 +4822,20 @@ about.dump-address-resolution-table:
   fr_FR: "Exporter la table de résolution d'adresses"
   pl_PL: "Zrzuć tabelę rozpoznawania adresów"
 
+about.dump-port-forward-table:
+  en_US: "Dump port forward table"
+  de_DE: "Portweiterleitungstabelle ausgeben"
+  es_ES: "Volcar tabla de reenvío de puertos"
+  fr_FR: "Exporter la table de redirection de ports"
+  pl_PL: "Zrzuć tabelę przekierowań portów"
+
+about.dump-vhost-proxy-table:
+  en_US: "Dump vhost proxy table"
+  de_DE: "Vhost-Proxy-Tabelle ausgeben"
+  es_ES: "Volcar tabla de proxy vhost"
+  fr_FR: "Exporter la table de proxy vhost"
+  pl_PL: "Zrzuć tabelę proxy vhost"
+
 about.echo-message:
   en_US: "Echo a message back"
   de_DE: "Eine Nachricht zurückgeben"
@@ -4624,6 +4871,13 @@ about.enable-kiosk-mode:
   fr_FR: "Activer le mode kiosque"
   pl_PL: "Włącz tryb kiosku"
 
+about.enable-or-disable-port-forward:
+  en_US: "Enable or disable a port forward"
+  de_DE: "Portweiterleitung aktivieren oder deaktivieren"
+  es_ES: "Habilitar o deshabilitar un reenvío de puerto"
+  fr_FR: "Activer ou désactiver une redirection de port"
+  pl_PL: "Włącz lub wyłącz przekierowanie portu"
+
 about.enable-webserver:
   en_US: "Enable the webserver"
   de_DE: "Webserver aktivieren"
@@ -4715,6 +4969,13 @@ about.get-developer-pubkey:
   fr_FR: "Obtenir la clé publique du développeur"
   pl_PL: "Pobierz klucz publiczny dewelopera"
 
+about.get-device-info:
+  en_US: "Display device information"
+  de_DE: "Geräteinformationen anzeigen"
+  es_ES: "Mostrar información del dispositivo"
+  fr_FR: "Afficher les informations de l'appareil"
+  pl_PL: "Wyświetl informacje o urządzeniu"
+
 about.get-initialization-progress:
   en_US: "Get initialization progress"
   de_DE: "Initialisierungsfortschritt abrufen"
@@ -4729,6 +4990,27 @@ about.get-listen-address-for-webserver:
   fr_FR: "Obtenir l'adresse d'écoute du serveur web"
   pl_PL: "Pobierz adres nasłuchiwania serwera internetowego"
 
+about.get-metrics-downloads:
+  en_US: "Count package download requests with optional filters"
+  de_DE: "Paket-Download-Anfragen mit optionalen Filtern zählen"
+  es_ES: "Contar solicitudes de descarga de paquetes con filtros opcionales"
+  fr_FR: "Compter les demandes de téléchargement de paquets avec filtres optionnels"
+  pl_PL: "Zlicz żądania pobrania pakietów z opcjonalnymi filtrami"
+
+about.get-metrics-summary:
+  en_US: "Get a summary of registry usage metrics"
+  de_DE: "Zusammenfassung der Registry-Nutzungsmetriken abrufen"
+  es_ES: "Obtener un resumen de las métricas de uso del registro"
+  fr_FR: "Obtenir un résumé des métriques d'utilisation du registre"
+  pl_PL: "Pobierz podsumowanie metryk użycia rejestru"
+
+about.get-metrics-users:
+  en_US: "Count unique active users within a time range"
+  de_DE: "Eindeutige aktive Benutzer in einem Zeitraum zählen"
+  es_ES: "Contar usuarios activos únicos dentro de un rango de tiempo"
+  fr_FR: "Compter les utilisateurs actifs uniques dans un intervalle de temps"
+  pl_PL: "Zlicz unikalnych aktywnych użytkowników w zakresie czasu"
+
 about.get-os-versions-info:
   en_US: "Get OS versions info"
   de_DE: "Informationen zu Betriebssystemversionen abrufen"
@@ -4904,6 +5186,13 @@ about.list-paths-of-package-ingredients:
   fr_FR: "Lister les chemins des composants du package"
   pl_PL: "Wyświetl ścieżki składników pakietu"
 
+about.list-registry-categories:
+  en_US: "List registry categories"
+  de_DE: "Registry-Kategorien auflisten"
+  es_ES: "Listar categorías del registro"
+  fr_FR: "Lister les catégories du registre"
+  pl_PL: "Wyświetl kategorie rejestru"
+
 about.list-registry-info-packages:
   en_US: "List registry info and packages"
   de_DE: "Registry-Informationen und Pakete auflisten"
@@ -4932,6 +5221,13 @@ about.list-version-signers:
   fr_FR: "Lister les signataires de versions"
   pl_PL: "Wyświetl sygnatariuszy wersji"
 
+about.list-vhost-passthrough:
+  en_US: "List vhost passthroughs"
+  de_DE: "Vhost-Passthroughs auflisten"
+  es_ES: "Listar passthroughs de vhost"
+  fr_FR: "Lister les passthroughs vhost"
+  pl_PL: "Wyświetl passthrough vhost"
+
 about.list-wifi-info:
   en_US: "List wifi information"
   de_DE: "WLAN-Informationen auflisten"
@@ -4981,6 +5277,13 @@ about.manage-query-dns:
   fr_FR: "Gérer et interroger le DNS"
   pl_PL: "Zarządzaj i odpytuj DNS"
 
+about.manage-ssl-certificates:
+  en_US: "Manage SSL certificates"
+  de_DE: "SSL-Zertifikate verwalten"
+  es_ES: "Gestionar certificados SSL"
+  fr_FR: "Gérer les certificats SSL"
+  pl_PL: "Zarządzaj certyfikatami SSL"
+
 about.manage-ssl-vhost-proxy:
   en_US: "Manage SSL vhost proxy"
   de_DE: "SSL-vhost-Proxy verwalten"
@@ -5044,6 +5347,20 @@ about.persist-new-notification:
   fr_FR: "Persister une nouvelle notification"
   pl_PL: "Utrwal nowe powiadomienie"
 
+about.promote-os-registry:
+  en_US: "Promote an OS version from one registry to another"
+  de_DE: "Eine OS-Version von einer Registry in eine andere heraufstufen"
+  es_ES: "Promover una versión del SO de un registro a otro"
+  fr_FR: "Promouvoir une version OS d'un registre à un autre"
+  pl_PL: "Promuj wersję OS z jednego rejestru do drugiego"
+
+about.promote-package-registry:
+  en_US: "Promote a package from one registry to another"
+  de_DE: "Ein Paket von einer Registry in eine andere heraufstufen"
+  es_ES: "Promover un paquete de un registro a otro"
+  fr_FR: "Promouvoir un paquet d'un registre à un autre"
+  pl_PL: "Promuj pakiet z jednego rejestru do drugiego"
+
 about.publish-s9pk:
   en_US: "Publish s9pk to S3 bucket and index on registry"
   de_DE: "S9pk in S3-Bucket veröffentlichen und in Registry indizieren"
@@ -5177,6 +5494,13 @@ about.remove-package-signer:
   fr_FR: "Supprimer le signataire du package"
   pl_PL: "Usuń sygnatariusza pakietu"
 
+about.remove-signer:
+  en_US: "Remove signer and all their authorizations"
+  de_DE: "Unterzeichner und alle Autorisierungen entfernen"
+  es_ES: "Eliminar firmante y todas sus autorizaciones"
+  fr_FR: "Supprimer le signataire et toutes ses autorisations"
+  pl_PL: "Usuń sygnatariusza i wszystkie jego autoryzacje"
+
 about.remove-port-forward:
   en_US: "Remove port forward"
   de_DE: "Portweiterleitung entfernen"
@@ -5226,6 +5550,13 @@ about.remove-version-signer:
   fr_FR: "Supprimer le signataire de version"
   pl_PL: "Usuń sygnatariusza wersji"
 
+about.remove-vhost-passthrough:
+  en_US: "Remove vhost passthrough"
+  de_DE: "Vhost-Passthrough entfernen"
+  es_ES: "Eliminar passthrough de vhost"
+  fr_FR: "Supprimer un passthrough vhost"
+  pl_PL: "Usuń passthrough vhost"
+
 about.remove-wifi-network:
   en_US: "Remove a wifi network"
   de_DE: "Ein WLAN-Netzwerk entfernen"
@@ -5310,6 +5641,13 @@ about.run-service-action:
   fr_FR: "Exécuter une action de service"
   pl_PL: "Uruchom akcję usługi"
 
+about.set-address-enabled-for-binding:
+  en_US: "Set a gateway address enabled for a binding"
+  de_DE: "Gateway-Adresse für eine Bindung aktivieren"
+  es_ES: "Establecer una dirección de gateway habilitada para un vínculo"
+  fr_FR: "Définir une adresse de passerelle activée pour une liaison"
+  pl_PL: "Ustaw adres bramy jako włączony dla powiązania"
+
 about.set-country:
   en_US: "Set the country"
   de_DE: "Das Land festlegen"
@@ -5317,6 +5655,13 @@ about.set-country:
   fr_FR: "Définir le pays"
   pl_PL: "Ustaw kraj"
 
+about.set-default-outbound-gateway:
+  en_US: "Set the default outbound gateway"
+  de_DE: "Standard-Ausgangs-Gateway festlegen"
+  es_ES: "Establecer la puerta de enlace de salida predeterminada"
+  fr_FR: "Définir la passerelle sortante par défaut"
+  pl_PL: "Ustaw domyślną bramę wychodzącą"
+
 about.set-echoip-urls:
   en_US: "Set the Echo IP service URLs"
   de_DE: "Die Echo-IP-Dienst-URLs festlegen"
@@ -5359,6 +5704,13 @@ about.set-listen-address-for-webserver:
   fr_FR: "Définir l'adresse d'écoute du serveur web"
   pl_PL: "Ustaw adres nasłuchiwania serwera internetowego"
 
+about.set-outbound-gateway-package:
+  en_US: "Set the outbound gateway for a package"
+  de_DE: "Ausgangs-Gateway für ein Paket festlegen"
+  es_ES: "Establecer la puerta de enlace de salida para un paquete"
+  fr_FR: "Définir la passerelle sortante pour un package"
+  pl_PL: "Ustaw bramę wychodzącą dla pakietu"
+
 about.set-registry-icon:
   en_US: "Set the registry icon"
   de_DE: "Das Registry-Symbol festlegen"
@@ -5457,6 +5809,13 @@ about.stop-service:
   fr_FR: "Arrêter un service"
   pl_PL: "Zatrzymaj usługę"
 
+about.ssl-generate-certificate:
+  en_US: "Generate an SSL certificate from the system root CA"
+  de_DE: "SSL-Zertifikat von der System-Root-CA generieren"
+  es_ES: "Generar un certificado SSL desde la CA raíz del sistema"
+  fr_FR: "Générer un certificat SSL depuis l'autorité racine du système"
+  pl_PL: "Wygeneruj certyfikat SSL z głównego CA systemu"
+
 about.teardown-rebuild-containers:
   en_US: "Teardown and rebuild containers"
   de_DE: "Container abbauen und neu erstellen"
@@ -5527,6 +5886,13 @@ about.update-firmware:
   fr_FR: "Mettre à jour le firmware"
   pl_PL: "Zaktualizuj oprogramowanie układowe"
 
+about.update-port-forward-label:
+  en_US: "Update the label of a port forward"
+  de_DE: "Bezeichnung einer Portweiterleitung aktualisieren"
+  es_ES: "Actualizar la etiqueta de un reenvío de puerto"
+  fr_FR: "Mettre à jour le libellé d'une redirection de port"
+  pl_PL: "Zaktualizuj etykietę przekierowania portu"
+
 about.view-edit-gateway-configs:
   en_US: "View and edit gateway configurations"
   de_DE: "Gateway-Konfigurationen anzeigen und bearbeiten"

core/man/start-cli/start-cli-net-forward-dump-table.1

@@ -2,10 +2,11 @@
 .el .ds Aq '
 .TH start-cli-net-forward-dump-table 1  "dump-table " 
 .SH NAME
-start\-cli\-net\-forward\-dump\-table
+start\-cli\-net\-forward\-dump\-table \- Dump port forward table
 .SH SYNOPSIS
 \fBstart\-cli net forward dump\-table\fR [\fB\-\-format\fR] [\fB\-h\fR|\fB\-\-help\fR] 
 .SH DESCRIPTION
+Dump port forward table
 .SH OPTIONS
 .TP
 \fB\-\-format\fR

core/man/start-cli/start-cli-net-forward.1

@@ -14,3 +14,4 @@ Print help
 .SH SUBCOMMANDS
 .TP
 start\-cli\-net\-forward\-dump\-table(1)
+Dump port forward table

core/man/start-cli/start-cli-net-gateway-check-port.1

@@ -2,11 +2,11 @@
 .el .ds Aq '
 .TH start-cli-net-gateway-check-port 1  "check-port " 
 .SH NAME
-start\-cli\-net\-gateway\-check\-port \- about.check\-port\-reachability
+start\-cli\-net\-gateway\-check\-port \- Check if a port is reachable from the WAN
 .SH SYNOPSIS
 \fBstart\-cli net gateway check\-port\fR [\fB\-\-format\fR] [\fB\-h\fR|\fB\-\-help\fR] <\fIPORT\fR> <\fIGATEWAY\fR> 
 .SH DESCRIPTION
-about.check\-port\-reachability
+Check if a port is reachable from the WAN
 .SH OPTIONS
 .TP
 \fB\-\-format\fR
@@ -16,7 +16,7 @@ about.check\-port\-reachability
 Print help
 .TP
 <\fIPORT\fR>
-help.arg.port
+Port number
 .TP
 <\fIGATEWAY\fR>
 Gateway identifier

core/man/start-cli/start-cli-net-gateway-set-default-outbound.1

@@ -2,11 +2,11 @@
 .el .ds Aq '
 .TH start-cli-net-gateway-set-default-outbound 1  "set-default-outbound " 
 .SH NAME
-start\-cli\-net\-gateway\-set\-default\-outbound \- about.set\-default\-outbound\-gateway
+start\-cli\-net\-gateway\-set\-default\-outbound \- Set the default outbound gateway
 .SH SYNOPSIS
 \fBstart\-cli net gateway set\-default\-outbound\fR [\fB\-h\fR|\fB\-\-help\fR] [\fIGATEWAY\fR] 
 .SH DESCRIPTION
-about.set\-default\-outbound\-gateway
+Set the default outbound gateway
 .SH OPTIONS
 .TP
 \fB\-h\fR, \fB\-\-help\fR

core/man/start-cli/start-cli-net-gateway.1

@@ -17,7 +17,7 @@ start\-cli\-net\-gateway\-check\-dns(1)
 Check DNS configuration for a gateway
 .TP
 start\-cli\-net\-gateway\-check\-port(1)
-about.check\-port\-reachability
+Check if a port is reachable from the WAN
 .TP
 start\-cli\-net\-gateway\-forget(1)
 Forget a disconnected gateway
@@ -26,7 +26,7 @@ start\-cli\-net\-gateway\-list(1)
 Show gateways StartOS can listen on
 .TP
 start\-cli\-net\-gateway\-set\-default\-outbound(1)
-about.set\-default\-outbound\-gateway
+Set the default outbound gateway
 .TP
 start\-cli\-net\-gateway\-set\-name(1)
 Rename a gateway

core/man/start-cli/start-cli-net-ssl-generate-certificate.1

@@ -0,0 +1,22 @@
+.ie \n(.g .ds Aq \(aq
+.el .ds Aq '
+.TH start-cli-net-ssl-generate-certificate 1  "generate-certificate " 
+.SH NAME
+start\-cli\-net\-ssl\-generate\-certificate \- Generate an SSL certificate from the system root CA
+.SH SYNOPSIS
+\fBstart\-cli net ssl generate\-certificate\fR [\fB\-\-ed25519\fR] [\fB\-\-format\fR] [\fB\-h\fR|\fB\-\-help\fR] [\fIHOSTNAMES\fR] 
+.SH DESCRIPTION
+Generate an SSL certificate from the system root CA
+.SH OPTIONS
+.TP
+\fB\-\-ed25519\fR
+Use Ed25519 instead of NIST P\-256
+.TP
+\fB\-\-format\fR
+
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+Print help
+.TP
+[\fIHOSTNAMES\fR]
+Hostnames to include in the certificate

core/man/start-cli/start-cli-net-ssl.1

@@ -0,0 +1,17 @@
+.ie \n(.g .ds Aq \(aq
+.el .ds Aq '
+.TH start-cli-net-ssl 1  "ssl " 
+.SH NAME
+start\-cli\-net\-ssl \- Manage SSL certificates
+.SH SYNOPSIS
+\fBstart\-cli net ssl\fR [\fB\-h\fR|\fB\-\-help\fR] <\fIsubcommands\fR>
+.SH DESCRIPTION
+Manage SSL certificates
+.SH OPTIONS
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+Print help
+.SH SUBCOMMANDS
+.TP
+start\-cli\-net\-ssl\-generate\-certificate(1)
+Generate an SSL certificate from the system root CA

core/man/start-cli/start-cli-net-tunnel-add.1

@@ -10,7 +10,7 @@ Add a new tunnel
 .SH OPTIONS
 .TP
 \fB\-\-set\-as\-default\-outbound\fR
-help.arg.set\-as\-default\-outbound
+Set as the default outbound gateway
 .TP
 \fB\-h\fR, \fB\-\-help\fR
 Print help
@@ -22,7 +22,7 @@ Tunnel name
 WireGuard configuration
 .TP
 [\fIGATEWAY_TYPE\fR]
-help.arg.gateway\-type
+Type of gateway
 .br
 
 .br

core/man/start-cli/start-cli-net-vhost-add-passthrough.1

@@ -2,10 +2,11 @@
 .el .ds Aq '
 .TH start-cli-net-vhost-add-passthrough 1  "add-passthrough " 
 .SH NAME
-start\-cli\-net\-vhost\-add\-passthrough
+start\-cli\-net\-vhost\-add\-passthrough \- Add vhost passthrough
 .SH SYNOPSIS
 \fBstart\-cli net vhost add\-passthrough\fR <\fB\-\-hostname\fR> <\fB\-\-listen\-port\fR> <\fB\-\-backend\fR> [\fB\-\-public\-gateway\fR] [\fB\-\-private\-ip\fR] [\fB\-h\fR|\fB\-\-help\fR] 
 .SH DESCRIPTION
+Add vhost passthrough
 .SH OPTIONS
 .TP
 \fB\-\-hostname\fR \fI<HOSTNAME>\fR

core/man/start-cli/start-cli-net-vhost-dump-table.1

@@ -2,10 +2,11 @@
 .el .ds Aq '
 .TH start-cli-net-vhost-dump-table 1  "dump-table " 
 .SH NAME
-start\-cli\-net\-vhost\-dump\-table
+start\-cli\-net\-vhost\-dump\-table \- Dump vhost proxy table
 .SH SYNOPSIS
 \fBstart\-cli net vhost dump\-table\fR [\fB\-\-format\fR] [\fB\-h\fR|\fB\-\-help\fR] 
 .SH DESCRIPTION
+Dump vhost proxy table
 .SH OPTIONS
 .TP
 \fB\-\-format\fR

core/man/start-cli/start-cli-net-vhost-list-passthrough.1

@@ -2,10 +2,11 @@
 .el .ds Aq '
 .TH start-cli-net-vhost-list-passthrough 1  "list-passthrough " 
 .SH NAME
-start\-cli\-net\-vhost\-list\-passthrough
+start\-cli\-net\-vhost\-list\-passthrough \- List vhost passthroughs
 .SH SYNOPSIS
 \fBstart\-cli net vhost list\-passthrough\fR [\fB\-\-format\fR] [\fB\-h\fR|\fB\-\-help\fR] 
 .SH DESCRIPTION
+List vhost passthroughs
 .SH OPTIONS
 .TP
 \fB\-\-format\fR

core/man/start-cli/start-cli-net-vhost-remove-passthrough.1

@@ -2,10 +2,11 @@
 .el .ds Aq '
 .TH start-cli-net-vhost-remove-passthrough 1  "remove-passthrough " 
 .SH NAME
-start\-cli\-net\-vhost\-remove\-passthrough
+start\-cli\-net\-vhost\-remove\-passthrough \- Remove vhost passthrough
 .SH SYNOPSIS
 \fBstart\-cli net vhost remove\-passthrough\fR <\fB\-\-hostname\fR> <\fB\-\-listen\-port\fR> [\fB\-h\fR|\fB\-\-help\fR] 
 .SH DESCRIPTION
+Remove vhost passthrough
 .SH OPTIONS
 .TP
 \fB\-\-hostname\fR \fI<HOSTNAME>\fR

core/man/start-cli/start-cli-net-vhost.1

@@ -14,9 +14,13 @@ Print help
 .SH SUBCOMMANDS
 .TP
 start\-cli\-net\-vhost\-add\-passthrough(1)
+Add vhost passthrough
 .TP
 start\-cli\-net\-vhost\-dump\-table(1)
+Dump vhost proxy table
 .TP
 start\-cli\-net\-vhost\-list\-passthrough(1)
+List vhost passthroughs
 .TP
 start\-cli\-net\-vhost\-remove\-passthrough(1)
+Remove vhost passthrough

core/man/start-cli/start-cli-net.1

@@ -25,6 +25,9 @@ Manage port forwards
 start\-cli\-net\-gateway(1)
 View and edit gateway configurations
 .TP
+start\-cli\-net\-ssl(1)
+Manage SSL certificates
+.TP
 start\-cli\-net\-tunnel(1)
 Manage tunnels
 .TP

core/man/start-cli/start-cli-package-attach.1

@@ -2,10 +2,11 @@
 .el .ds Aq '
 .TH start-cli-package-attach 1  "attach " 
 .SH NAME
-start\-cli\-package\-attach
+start\-cli\-package\-attach \- Execute commands in container
 .SH SYNOPSIS
 \fBstart\-cli package attach\fR [\fB\-\-force\-tty\fR] [\fB\-s\fR|\fB\-\-subcontainer\fR] [\fB\-n\fR|\fB\-\-name\fR] [\fB\-u\fR|\fB\-\-user\fR] [\fB\-i\fR|\fB\-\-image\-id\fR] [\fB\-h\fR|\fB\-\-help\fR] <\fIID\fR> [\fICOMMAND\fR] 
 .SH DESCRIPTION
+Execute commands in container
 .SH OPTIONS
 .TP
 \fB\-\-force\-tty\fR

core/man/start-cli/start-cli-package-backup-restore.1

@@ -4,11 +4,14 @@
 .SH NAME
 start\-cli\-package\-backup\-restore \- Restore packages from backup
 .SH SYNOPSIS
-\fBstart\-cli package backup restore\fR [\fB\-h\fR|\fB\-\-help\fR] <\fITARGET_ID\fR> <\fIPASSWORD\fR> [\fIIDS\fR] 
+\fBstart\-cli package backup restore\fR [\fB\-\-server\-id\fR] [\fB\-h\fR|\fB\-\-help\fR] <\fITARGET_ID\fR> <\fIPASSWORD\fR> [\fIIDS\fR] 
 .SH DESCRIPTION
 Restore packages from backup
 .SH OPTIONS
 .TP
+\fB\-\-server\-id\fR \fI<SERVER_ID>\fR
+Unique server identifier
+.TP
 \fB\-h\fR, \fB\-\-help\fR
 Print help
 .TP

core/man/start-cli/start-cli-package-host-address-domain-private.1

@@ -2,10 +2,11 @@
 .el .ds Aq '
 .TH start-cli-package-host-address-domain-private 1  "private " 
 .SH NAME
-start\-cli\-package\-host\-address\-domain\-private
+start\-cli\-package\-host\-address\-domain\-private \- Commands for managing private domains for a host
 .SH SYNOPSIS
 \fBstart\-cli package host address domain private\fR [\fB\-h\fR|\fB\-\-help\fR] <\fIsubcommands\fR>
 .SH DESCRIPTION
+Commands for managing private domains for a host
 .SH OPTIONS
 .TP
 \fB\-h\fR, \fB\-\-help\fR

core/man/start-cli/start-cli-package-host-address-domain-public.1

@@ -2,10 +2,11 @@
 .el .ds Aq '
 .TH start-cli-package-host-address-domain-public 1  "public " 
 .SH NAME
-start\-cli\-package\-host\-address\-domain\-public
+start\-cli\-package\-host\-address\-domain\-public \- Commands for managing public domains for a host
 .SH SYNOPSIS
 \fBstart\-cli package host address domain public\fR [\fB\-h\fR|\fB\-\-help\fR] <\fIsubcommands\fR>
 .SH DESCRIPTION
+Commands for managing public domains for a host
 .SH OPTIONS
 .TP
 \fB\-h\fR, \fB\-\-help\fR

core/man/start-cli/start-cli-package-host-address-domain.1

@@ -2,10 +2,11 @@
 .el .ds Aq '
 .TH start-cli-package-host-address-domain 1  "domain " 
 .SH NAME
-start\-cli\-package\-host\-address\-domain
+start\-cli\-package\-host\-address\-domain \- Commands for managing host address domains
 .SH SYNOPSIS
 \fBstart\-cli package host address domain\fR [\fB\-h\fR|\fB\-\-help\fR] <\fIsubcommands\fR>
 .SH DESCRIPTION
+Commands for managing host address domains
 .SH OPTIONS
 .TP
 \fB\-h\fR, \fB\-\-help\fR
@@ -13,5 +14,7 @@ Print help
 .SH SUBCOMMANDS
 .TP
 start\-cli\-package\-host\-address\-domain\-private(1)
+Commands for managing private domains for a host
 .TP
 start\-cli\-package\-host\-address\-domain\-public(1)
+Commands for managing public domains for a host

core/man/start-cli/start-cli-package-host-address.1

@@ -2,10 +2,11 @@
 .el .ds Aq '
 .TH start-cli-package-host-address 1  "address " 
 .SH NAME
-start\-cli\-package\-host\-address
+start\-cli\-package\-host\-address \- Commands for managing host addresses
 .SH SYNOPSIS
 \fBstart\-cli package host address\fR [\fB\-h\fR|\fB\-\-help\fR] <\fIHOST\fR> <\fIsubcommands\fR>
 .SH DESCRIPTION
+Commands for managing host addresses
 .SH OPTIONS
 .TP
 \fB\-h\fR, \fB\-\-help\fR
@@ -16,6 +17,7 @@ Host identifier
 .SH SUBCOMMANDS
 .TP
 start\-cli\-package\-host\-address\-domain(1)
+Commands for managing host address domains
 .TP
 start\-cli\-package\-host\-address\-list(1)
 List addresses for a host

core/man/start-cli/start-cli-package-host-binding-set-address-enabled.1

@@ -2,15 +2,15 @@
 .el .ds Aq '
 .TH start-cli-package-host-binding-set-address-enabled 1  "set-address-enabled " 
 .SH NAME
-start\-cli\-package\-host\-binding\-set\-address\-enabled \- about.set\-address\-enabled\-for\-binding
+start\-cli\-package\-host\-binding\-set\-address\-enabled \- Set a gateway address enabled for a binding
 .SH SYNOPSIS
 \fBstart\-cli package host binding set\-address\-enabled\fR <\fB\-\-address\fR> [\fB\-\-enabled\fR] [\fB\-h\fR|\fB\-\-help\fR] <\fIINTERNAL_PORT\fR> 
 .SH DESCRIPTION
-about.set\-address\-enabled\-for\-binding
+Set a gateway address enabled for a binding
 .SH OPTIONS
 .TP
 \fB\-\-address\fR \fI<ADDRESS>\fR
-help.arg.address
+Network address
 .TP
 \fB\-\-enabled\fR \fI<ENABLED>\fR
 Enable or disable this binding

core/man/start-cli/start-cli-package-host-binding.1

@@ -2,10 +2,11 @@
 .el .ds Aq '
 .TH start-cli-package-host-binding 1  "binding " 
 .SH NAME
-start\-cli\-package\-host\-binding
+start\-cli\-package\-host\-binding \- Commands for managing host bindings
 .SH SYNOPSIS
 \fBstart\-cli package host binding\fR [\fB\-h\fR|\fB\-\-help\fR] <\fIHOST\fR> <\fIsubcommands\fR>
 .SH DESCRIPTION
+Commands for managing host bindings
 .SH OPTIONS
 .TP
 \fB\-h\fR, \fB\-\-help\fR
@@ -19,4 +20,4 @@ start\-cli\-package\-host\-binding\-list(1)
 List bindings for a host
 .TP
 start\-cli\-package\-host\-binding\-set\-address\-enabled(1)
-about.set\-address\-enabled\-for\-binding
+Set a gateway address enabled for a binding

core/man/start-cli/start-cli-package-host.1

@@ -17,5 +17,7 @@ Package identifier
 .SH SUBCOMMANDS
 .TP
 start\-cli\-package\-host\-address(1)
+Commands for managing host addresses
 .TP
 start\-cli\-package\-host\-binding(1)
+Commands for managing host bindings

core/man/start-cli/start-cli-package-set-outbound-gateway.1

@@ -2,11 +2,11 @@
 .el .ds Aq '
 .TH start-cli-package-set-outbound-gateway 1  "set-outbound-gateway " 
 .SH NAME
-start\-cli\-package\-set\-outbound\-gateway \- about.set\-outbound\-gateway\-package
+start\-cli\-package\-set\-outbound\-gateway \- Set the outbound gateway for a package
 .SH SYNOPSIS
 \fBstart\-cli package set\-outbound\-gateway\fR [\fB\-h\fR|\fB\-\-help\fR] <\fIPACKAGE\fR> [\fIGATEWAY\fR] 
 .SH DESCRIPTION
-about.set\-outbound\-gateway\-package
+Set the outbound gateway for a package
 .SH OPTIONS
 .TP
 \fB\-h\fR, \fB\-\-help\fR

core/man/start-cli/start-cli-package.1

@@ -17,6 +17,7 @@ start\-cli\-package\-action(1)
 Commands to get action input or run an action
 .TP
 start\-cli\-package\-attach(1)
+Execute commands in container
 .TP
 start\-cli\-package\-backup(1)
 Commands for restoring package(s) from backup
@@ -46,7 +47,7 @@ start\-cli\-package\-restart(1)
 Restart a service
 .TP
 start\-cli\-package\-set\-outbound\-gateway(1)
-about.set\-outbound\-gateway\-package
+Set the outbound gateway for a package
 .TP
 start\-cli\-package\-start(1)
 Start a service

core/man/start-cli/start-cli-registry-admin-signer-remove.1

@@ -0,0 +1,16 @@
+.ie \n(.g .ds Aq \(aq
+.el .ds Aq '
+.TH start-cli-registry-admin-signer-remove 1  "remove " 
+.SH NAME
+start\-cli\-registry\-admin\-signer\-remove \- Remove signer and all their authorizations
+.SH SYNOPSIS
+\fBstart\-cli registry admin signer remove\fR [\fB\-h\fR|\fB\-\-help\fR] <\fIID\fR> 
+.SH DESCRIPTION
+Remove signer and all their authorizations
+.SH OPTIONS
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+Print help
+.TP
+<\fIID\fR>
+Signer identifier

core/man/start-cli/start-cli-registry-admin-signer.1

@@ -21,3 +21,6 @@ Edit signer information
 .TP
 start\-cli\-registry\-admin\-signer\-list(1)
 List signers
+.TP
+start\-cli\-registry\-admin\-signer\-remove(1)
+Remove signer and all their authorizations

core/man/start-cli/start-cli-registry-info-set-icon.1

@@ -13,4 +13,4 @@ Set the registry icon
 Print help
 .TP
 <\fIICON\fR>
-Path to service icon file
+Icon source: file path, file:// URL, http(s):// URL, or data: URL

core/man/start-cli/start-cli-registry-info.1

@@ -2,11 +2,11 @@
 .el .ds Aq '
 .TH start-cli-registry-info 1  "info " 
 .SH NAME
-start\-cli\-registry\-info \- Display registry info
+start\-cli\-registry\-info \- View or edit registry information
 .SH SYNOPSIS
 \fBstart\-cli registry info\fR [\fB\-\-format\fR] [\fB\-h\fR|\fB\-\-help\fR] [\fIsubcommands\fR]
 .SH DESCRIPTION
-Display registry info
+View or edit registry information
 .SH OPTIONS
 .TP
 \fB\-\-format\fR

core/man/start-cli/start-cli-registry-metrics-downloads.1

@@ -0,0 +1,28 @@
+.ie \n(.g .ds Aq \(aq
+.el .ds Aq '
+.TH start-cli-registry-metrics-downloads 1  "downloads " 
+.SH NAME
+start\-cli\-registry\-metrics\-downloads \- Count package download requests with optional filters
+.SH SYNOPSIS
+\fBstart\-cli registry metrics downloads\fR [\fB\-\-pkg\-id\fR] [\fB\-\-version\fR] [\fB\-\-after\fR] [\fB\-\-before\fR] [\fB\-\-format\fR] [\fB\-h\fR|\fB\-\-help\fR] 
+.SH DESCRIPTION
+Count package download requests with optional filters
+.SH OPTIONS
+.TP
+\fB\-\-pkg\-id\fR \fI<PKG_ID>\fR
+Filter by package ID
+.TP
+\fB\-\-version\fR \fI<VERSION>\fR
+Filter by version
+.TP
+\fB\-\-after\fR \fI<AFTER>\fR
+Start of time range (RFC 3339 timestamp)
+.TP
+\fB\-\-before\fR \fI<BEFORE>\fR
+End of time range (RFC 3339 timestamp)
+.TP
+\fB\-\-format\fR
+
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+Print help

core/man/start-cli/start-cli-registry-metrics-summary.1

@@ -0,0 +1,16 @@
+.ie \n(.g .ds Aq \(aq
+.el .ds Aq '
+.TH start-cli-registry-metrics-summary 1  "summary " 
+.SH NAME
+start\-cli\-registry\-metrics\-summary \- Get a summary of registry usage metrics
+.SH SYNOPSIS
+\fBstart\-cli registry metrics summary\fR [\fB\-\-format\fR] [\fB\-h\fR|\fB\-\-help\fR] 
+.SH DESCRIPTION
+Get a summary of registry usage metrics
+.SH OPTIONS
+.TP
+\fB\-\-format\fR
+
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+Print help

core/man/start-cli/start-cli-registry-metrics-users.1

@@ -0,0 +1,22 @@
+.ie \n(.g .ds Aq \(aq
+.el .ds Aq '
+.TH start-cli-registry-metrics-users 1  "users " 
+.SH NAME
+start\-cli\-registry\-metrics\-users \- Count unique active users within a time range
+.SH SYNOPSIS
+\fBstart\-cli registry metrics users\fR [\fB\-\-after\fR] [\fB\-\-before\fR] [\fB\-\-format\fR] [\fB\-h\fR|\fB\-\-help\fR] 
+.SH DESCRIPTION
+Count unique active users within a time range
+.SH OPTIONS
+.TP
+\fB\-\-after\fR \fI<AFTER>\fR
+Start of time range (RFC 3339 timestamp)
+.TP
+\fB\-\-before\fR \fI<BEFORE>\fR
+End of time range (RFC 3339 timestamp)
+.TP
+\fB\-\-format\fR
+
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+Print help

core/man/start-cli/start-cli-registry-metrics.1

@@ -0,0 +1,23 @@
+.ie \n(.g .ds Aq \(aq
+.el .ds Aq '
+.TH start-cli-registry-metrics 1  "metrics " 
+.SH NAME
+start\-cli\-registry\-metrics \- Query registry usage metrics
+.SH SYNOPSIS
+\fBstart\-cli registry metrics\fR [\fB\-h\fR|\fB\-\-help\fR] <\fIsubcommands\fR>
+.SH DESCRIPTION
+Query registry usage metrics
+.SH OPTIONS
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+Print help
+.SH SUBCOMMANDS
+.TP
+start\-cli\-registry\-metrics\-downloads(1)
+Count package download requests with optional filters
+.TP
+start\-cli\-registry\-metrics\-summary(1)
+Get a summary of registry usage metrics
+.TP
+start\-cli\-registry\-metrics\-users(1)
+Count unique active users within a time range

core/man/start-cli/start-cli-registry-os-promote.1

@@ -0,0 +1,22 @@
+.ie \n(.g .ds Aq \(aq
+.el .ds Aq '
+.TH start-cli-registry-os-promote 1  "promote " 
+.SH NAME
+start\-cli\-registry\-os\-promote \- Promote an OS version from one registry to another
+.SH SYNOPSIS
+\fBstart\-cli registry os promote\fR [\fB\-\-from\fR] [\fB\-\-to\fR] [\fB\-h\fR|\fB\-\-help\fR] <\fIVERSION\fR> 
+.SH DESCRIPTION
+Promote an OS version from one registry to another
+.SH OPTIONS
+.TP
+\fB\-\-from\fR \fI<FROM>\fR
+Source registry URL to promote from
+.TP
+\fB\-\-to\fR \fI<TO>\fR
+Destination registry URL to promote to
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+Print help
+.TP
+<\fIVERSION\fR>
+StartOS version number

core/man/start-cli/start-cli-registry-os.1

@@ -19,5 +19,8 @@ Commands to add, sign, or get registry assets
 start\-cli\-registry\-os\-index(1)
 List OS versions index
 .TP
+start\-cli\-registry\-os\-promote(1)
+Promote an OS version from one registry to another
+.TP
 start\-cli\-registry\-os\-version(1)
 Commands to add, remove, or list versions or version signers

core/man/start-cli/start-cli-registry-package-category-list.1

@@ -2,10 +2,11 @@
 .el .ds Aq '
 .TH start-cli-registry-package-category-list 1  "list " 
 .SH NAME
-start\-cli\-registry\-package\-category\-list
+start\-cli\-registry\-package\-category\-list \- List registry categories
 .SH SYNOPSIS
 \fBstart\-cli registry package category list\fR [\fB\-\-format\fR] [\fB\-h\fR|\fB\-\-help\fR] 
 .SH DESCRIPTION
+List registry categories
 .SH OPTIONS
 .TP
 \fB\-\-format\fR

core/man/start-cli/start-cli-registry-package-category.1

@@ -20,6 +20,7 @@ start\-cli\-registry\-package\-category\-add\-package(1)
 Add a package to a category
 .TP
 start\-cli\-registry\-package\-category\-list(1)
+List registry categories
 .TP
 start\-cli\-registry\-package\-category\-remove(1)
 Remove category from registry

core/man/start-cli/start-cli-registry-package-download.1

@@ -4,7 +4,7 @@
 .SH NAME
 start\-cli\-registry\-package\-download \- Download s9pk package
 .SH SYNOPSIS
-\fBstart\-cli registry package download\fR [\fB\-v\fR|\fB\-\-target\-version\fR] [\fB\-d\fR|\fB\-\-dest\fR] [\fB\-h\fR|\fB\-\-help\fR] <\fIID\fR> 
+\fBstart\-cli registry package download\fR [\fB\-v\fR|\fB\-\-target\-version\fR] [\fB\-d\fR|\fB\-\-dest\fR] [\fB\-a\fR|\fB\-\-arch\fR] [\fB\-h\fR|\fB\-\-help\fR] <\fIID\fR> 
 .SH DESCRIPTION
 Download s9pk package
 .SH OPTIONS
@@ -15,6 +15,9 @@ Target version range constraint
 \fB\-d\fR, \fB\-\-dest\fR \fI<DEST>\fR
 Destination path for download
 .TP
+\fB\-a\fR, \fB\-\-arch\fR \fI<ARCH>\fR
+Target CPU architecture (e.g. x86_64, aarch64)
+.TP
 \fB\-h\fR, \fB\-\-help\fR
 Print help
 .TP

core/man/start-cli/start-cli-registry-package-promote.1

@@ -0,0 +1,25 @@
+.ie \n(.g .ds Aq \(aq
+.el .ds Aq '
+.TH start-cli-registry-package-promote 1  "promote " 
+.SH NAME
+start\-cli\-registry\-package\-promote \- Promote a package from one registry to another
+.SH SYNOPSIS
+\fBstart\-cli registry package promote\fR [\fB\-\-from\fR] [\fB\-\-to\fR] [\fB\-h\fR|\fB\-\-help\fR] <\fIID\fR> <\fIVERSION\fR> 
+.SH DESCRIPTION
+Promote a package from one registry to another
+.SH OPTIONS
+.TP
+\fB\-\-from\fR \fI<FROM>\fR
+Source registry URL to promote from
+.TP
+\fB\-\-to\fR \fI<TO>\fR
+Destination registry URL to promote to
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+Print help
+.TP
+<\fIID\fR>
+Package identifier
+.TP
+<\fIVERSION\fR>
+Package version

core/man/start-cli/start-cli-registry-package-remove.1

@@ -4,7 +4,7 @@
 .SH NAME
 start\-cli\-registry\-package\-remove \- Remove package from registry
 .SH SYNOPSIS
-\fBstart\-cli registry package remove\fR [\fB\-\-sighash\fR] [\fB\-h\fR|\fB\-\-help\fR] <\fIID\fR> <\fIVERSION\fR> 
+\fBstart\-cli registry package remove\fR [\fB\-\-sighash\fR] [\fB\-\-force\fR] [\fB\-h\fR|\fB\-\-help\fR] <\fIID\fR> [\fIVERSION\fR] 
 .SH DESCRIPTION
 Remove package from registry
 .SH OPTIONS
@@ -12,11 +12,14 @@ Remove package from registry
 \fB\-\-sighash\fR \fI<SIGHASH>\fR
 Hash for signature verification
 .TP
+\fB\-\-force\fR
+Force removal even if the package has versions
+.TP
 \fB\-h\fR, \fB\-\-help\fR
 Print help
 .TP
 <\fIID\fR>
 Package identifier
 .TP
-<\fIVERSION\fR>
+[\fIVERSION\fR]
 Package version

core/man/start-cli/start-cli-registry-package.1

@@ -31,6 +31,9 @@ List installation candidates
 start\-cli\-registry\-package\-index(1)
 List packages and categories
 .TP
+start\-cli\-registry\-package\-promote(1)
+Promote a package from one registry to another
+.TP
 start\-cli\-registry\-package\-remove(1)
 Remove package from registry
 .TP

core/man/start-cli/start-cli-registry.1

@@ -23,7 +23,10 @@ start\-cli\-registry\-index(1)
 List registry info and packages
 .TP
 start\-cli\-registry\-info(1)
-Display registry info
+View or edit registry information
+.TP
+start\-cli\-registry\-metrics(1)
+Query registry usage metrics
 .TP
 start\-cli\-registry\-os(1)
 Commands related to OS assets and versions

core/man/start-cli/start-cli-s9pk-inspect-commitment.1

@@ -2,11 +2,11 @@
 .el .ds Aq '
 .TH start-cli-s9pk-inspect-commitment 1  "commitment " 
 .SH NAME
-start\-cli\-s9pk\-inspect\-commitment \- about.display\-s9pk\-root\-sighash\-and\-maxsize
+start\-cli\-s9pk\-inspect\-commitment \- Display the s9pk root signature hash and max size
 .SH SYNOPSIS
 \fBstart\-cli s9pk inspect commitment\fR [\fB\-\-format\fR] [\fB\-h\fR|\fB\-\-help\fR] 
 .SH DESCRIPTION
-about.display\-s9pk\-root\-sighash\-and\-maxsize
+Display the s9pk root signature hash and max size
 .SH OPTIONS
 .TP
 \fB\-\-format\fR

core/man/start-cli/start-cli-s9pk-inspect.1

@@ -20,7 +20,7 @@ start\-cli\-s9pk\-inspect\-cat(1)
 Display file contents from s9pk
 .TP
 start\-cli\-s9pk\-inspect\-commitment(1)
-about.display\-s9pk\-root\-sighash\-and\-maxsize
+Display the s9pk root signature hash and max size
 .TP
 start\-cli\-s9pk\-inspect\-file\-tree(1)
 Display list of paths in s9pk

core/man/start-cli/start-cli-server-device-info.1

@@ -2,11 +2,11 @@
 .el .ds Aq '
 .TH start-cli-server-device-info 1  "device-info " 
 .SH NAME
-start\-cli\-server\-device\-info \- about.get\-device\-info
+start\-cli\-server\-device\-info \- Display device information
 .SH SYNOPSIS
 \fBstart\-cli server device\-info\fR [\fB\-\-format\fR] [\fB\-h\fR|\fB\-\-help\fR] 
 .SH DESCRIPTION
-about.get\-device\-info
+Display device information
 .SH OPTIONS
 .TP
 \fB\-\-format\fR

core/man/start-cli/start-cli-server-host-address-domain-private.1

@@ -2,10 +2,11 @@
 .el .ds Aq '
 .TH start-cli-server-host-address-domain-private 1  "private " 
 .SH NAME
-start\-cli\-server\-host\-address\-domain\-private
+start\-cli\-server\-host\-address\-domain\-private \- Commands for managing private domains for a host
 .SH SYNOPSIS
 \fBstart\-cli server host address domain private\fR [\fB\-h\fR|\fB\-\-help\fR] <\fIsubcommands\fR>
 .SH DESCRIPTION
+Commands for managing private domains for a host
 .SH OPTIONS
 .TP
 \fB\-h\fR, \fB\-\-help\fR

core/man/start-cli/start-cli-server-host-address-domain-public.1

@@ -2,10 +2,11 @@
 .el .ds Aq '
 .TH start-cli-server-host-address-domain-public 1  "public " 
 .SH NAME
-start\-cli\-server\-host\-address\-domain\-public
+start\-cli\-server\-host\-address\-domain\-public \- Commands for managing public domains for a host
 .SH SYNOPSIS
 \fBstart\-cli server host address domain public\fR [\fB\-h\fR|\fB\-\-help\fR] <\fIsubcommands\fR>
 .SH DESCRIPTION
+Commands for managing public domains for a host
 .SH OPTIONS
 .TP
 \fB\-h\fR, \fB\-\-help\fR

core/man/start-cli/start-cli-server-host-address-domain.1

@@ -2,10 +2,11 @@
 .el .ds Aq '
 .TH start-cli-server-host-address-domain 1  "domain " 
 .SH NAME
-start\-cli\-server\-host\-address\-domain
+start\-cli\-server\-host\-address\-domain \- Commands for managing host address domains
 .SH SYNOPSIS
 \fBstart\-cli server host address domain\fR [\fB\-h\fR|\fB\-\-help\fR] <\fIsubcommands\fR>
 .SH DESCRIPTION
+Commands for managing host address domains
 .SH OPTIONS
 .TP
 \fB\-h\fR, \fB\-\-help\fR
@@ -13,5 +14,7 @@ Print help
 .SH SUBCOMMANDS
 .TP
 start\-cli\-server\-host\-address\-domain\-private(1)
+Commands for managing private domains for a host
 .TP
 start\-cli\-server\-host\-address\-domain\-public(1)
+Commands for managing public domains for a host

core/man/start-cli/start-cli-server-host-address.1

@@ -2,10 +2,11 @@
 .el .ds Aq '
 .TH start-cli-server-host-address 1  "address " 
 .SH NAME
-start\-cli\-server\-host\-address
+start\-cli\-server\-host\-address \- Commands for managing host addresses
 .SH SYNOPSIS
 \fBstart\-cli server host address\fR [\fB\-h\fR|\fB\-\-help\fR] <\fIsubcommands\fR>
 .SH DESCRIPTION
+Commands for managing host addresses
 .SH OPTIONS
 .TP
 \fB\-h\fR, \fB\-\-help\fR
@@ -13,6 +14,7 @@ Print help
 .SH SUBCOMMANDS
 .TP
 start\-cli\-server\-host\-address\-domain(1)
+Commands for managing host address domains
 .TP
 start\-cli\-server\-host\-address\-list(1)
 List addresses for a host

core/man/start-cli/start-cli-server-host-binding-set-address-enabled.1

@@ -2,15 +2,15 @@
 .el .ds Aq '
 .TH start-cli-server-host-binding-set-address-enabled 1  "set-address-enabled " 
 .SH NAME
-start\-cli\-server\-host\-binding\-set\-address\-enabled \- about.set\-address\-enabled\-for\-binding
+start\-cli\-server\-host\-binding\-set\-address\-enabled \- Set a gateway address enabled for a binding
 .SH SYNOPSIS
 \fBstart\-cli server host binding set\-address\-enabled\fR <\fB\-\-address\fR> [\fB\-\-enabled\fR] [\fB\-h\fR|\fB\-\-help\fR] <\fIINTERNAL_PORT\fR> 
 .SH DESCRIPTION
-about.set\-address\-enabled\-for\-binding
+Set a gateway address enabled for a binding
 .SH OPTIONS
 .TP
 \fB\-\-address\fR \fI<ADDRESS>\fR
-help.arg.address
+Network address
 .TP
 \fB\-\-enabled\fR \fI<ENABLED>\fR
 Enable or disable this binding

core/man/start-cli/start-cli-server-host-binding.1

@@ -2,10 +2,11 @@
 .el .ds Aq '
 .TH start-cli-server-host-binding 1  "binding " 
 .SH NAME
-start\-cli\-server\-host\-binding
+start\-cli\-server\-host\-binding \- Commands for managing host bindings
 .SH SYNOPSIS
 \fBstart\-cli server host binding\fR [\fB\-h\fR|\fB\-\-help\fR] <\fIsubcommands\fR>
 .SH DESCRIPTION
+Commands for managing host bindings
 .SH OPTIONS
 .TP
 \fB\-h\fR, \fB\-\-help\fR
@@ -16,4 +17,4 @@ start\-cli\-server\-host\-binding\-list(1)
 List bindings for a host
 .TP
 start\-cli\-server\-host\-binding\-set\-address\-enabled(1)
-about.set\-address\-enabled\-for\-binding
+Set a gateway address enabled for a binding

core/man/start-cli/start-cli-server-host.1

@@ -14,5 +14,7 @@ Print help
 .SH SUBCOMMANDS
 .TP
 start\-cli\-server\-host\-address(1)
+Commands for managing host addresses
 .TP
 start\-cli\-server\-host\-binding(1)
+Commands for managing host bindings

core/man/start-cli/start-cli-server.1

@@ -17,7 +17,7 @@ start\-cli\-server\-clear\-smtp(1)
 Remove system smtp server and credentials
 .TP
 start\-cli\-server\-device\-info(1)
-about.get\-device\-info
+Display device information
 .TP
 start\-cli\-server\-experimental(1)
 Commands related to configuring experimental options such as zram and cpu governor

core/man/start-cli/start-cli-tunnel-auth-key.1

@@ -2,10 +2,11 @@
 .el .ds Aq '
 .TH start-cli-tunnel-auth-key 1  "key " 
 .SH NAME
-start\-cli\-tunnel\-auth\-key
+start\-cli\-tunnel\-auth\-key \- Commands for managing authorized keys
 .SH SYNOPSIS
 \fBstart\-cli tunnel auth key\fR [\fB\-h\fR|\fB\-\-help\fR] <\fIsubcommands\fR>
 .SH DESCRIPTION
+Commands for managing authorized keys
 .SH OPTIONS
 .TP
 \fB\-h\fR, \fB\-\-help\fR

core/man/start-cli/start-cli-tunnel-auth.1

@@ -17,6 +17,7 @@ start\-cli\-tunnel\-auth\-get\-pubkey(1)
 Get the public key from the server
 .TP
 start\-cli\-tunnel\-auth\-key(1)
+Commands for managing authorized keys
 .TP
 start\-cli\-tunnel\-auth\-login(1)
 Login to a new auth session

core/man/start-cli/start-cli-tunnel-port-forward-set-enabled.1

@@ -2,11 +2,11 @@
 .el .ds Aq '
 .TH start-cli-tunnel-port-forward-set-enabled 1  "set-enabled " 
 .SH NAME
-start\-cli\-tunnel\-port\-forward\-set\-enabled \- about.enable\-or\-disable\-port\-forward
+start\-cli\-tunnel\-port\-forward\-set\-enabled \- Enable or disable a port forward
 .SH SYNOPSIS
 \fBstart\-cli tunnel port\-forward set\-enabled\fR [\fB\-\-enabled\fR] [\fB\-h\fR|\fB\-\-help\fR] <\fISOURCE\fR> 
 .SH DESCRIPTION
-about.enable\-or\-disable\-port\-forward
+Enable or disable a port forward
 .SH OPTIONS
 .TP
 \fB\-\-enabled\fR

core/man/start-cli/start-cli-tunnel-port-forward-update-label.1

@@ -2,11 +2,11 @@
 .el .ds Aq '
 .TH start-cli-tunnel-port-forward-update-label 1  "update-label " 
 .SH NAME
-start\-cli\-tunnel\-port\-forward\-update\-label \- about.update\-port\-forward\-label
+start\-cli\-tunnel\-port\-forward\-update\-label \- Update the label of a port forward
 .SH SYNOPSIS
 \fBstart\-cli tunnel port\-forward update\-label\fR [\fB\-h\fR|\fB\-\-help\fR] <\fISOURCE\fR> [\fILABEL\fR] 
 .SH DESCRIPTION
-about.update\-port\-forward\-label
+Update the label of a port forward
 .SH OPTIONS
 .TP
 \fB\-h\fR, \fB\-\-help\fR

core/man/start-cli/start-cli-tunnel-port-forward.1

@@ -2,10 +2,11 @@
 .el .ds Aq '
 .TH start-cli-tunnel-port-forward 1  "port-forward " 
 .SH NAME
-start\-cli\-tunnel\-port\-forward
+start\-cli\-tunnel\-port\-forward \- Commands for managing port forwards
 .SH SYNOPSIS
 \fBstart\-cli tunnel port\-forward\fR [\fB\-h\fR|\fB\-\-help\fR] <\fIsubcommands\fR>
 .SH DESCRIPTION
+Commands for managing port forwards
 .SH OPTIONS
 .TP
 \fB\-h\fR, \fB\-\-help\fR
@@ -19,7 +20,7 @@ start\-cli\-tunnel\-port\-forward\-remove(1)
 Remove port forward
 .TP
 start\-cli\-tunnel\-port\-forward\-set\-enabled(1)
-about.enable\-or\-disable\-port\-forward
+Enable or disable a port forward
 .TP
 start\-cli\-tunnel\-port\-forward\-update\-label(1)
-about.update\-port\-forward\-label
+Update the label of a port forward

core/man/start-cli/start-cli-tunnel-update.1

@@ -2,10 +2,11 @@
 .el .ds Aq '
 .TH start-cli-tunnel-update 1  "update " 
 .SH NAME
-start\-cli\-tunnel\-update
+start\-cli\-tunnel\-update \- Commands for checking and applying tunnel updates
 .SH SYNOPSIS
 \fBstart\-cli tunnel update\fR [\fB\-h\fR|\fB\-\-help\fR] <\fIsubcommands\fR>
 .SH DESCRIPTION
+Commands for checking and applying tunnel updates
 .SH OPTIONS
 .TP
 \fB\-h\fR, \fB\-\-help\fR

core/man/start-cli/start-cli-tunnel-web.1

@@ -2,10 +2,11 @@
 .el .ds Aq '
 .TH start-cli-tunnel-web 1  "web " 
 .SH NAME
-start\-cli\-tunnel\-web
+start\-cli\-tunnel\-web \- Commands for managing the tunnel web interface
 .SH SYNOPSIS
 \fBstart\-cli tunnel web\fR [\fB\-h\fR|\fB\-\-help\fR] <\fIsubcommands\fR>
 .SH DESCRIPTION
+Commands for managing the tunnel web interface
 .SH OPTIONS
 .TP
 \fB\-h\fR, \fB\-\-help\fR

core/man/start-cli/start-cli-tunnel.1

@@ -23,6 +23,7 @@ start\-cli\-tunnel\-device(1)
 Add, remove, or list devices in subnets
 .TP
 start\-cli\-tunnel\-port\-forward(1)
+Commands for managing port forwards
 .TP
 start\-cli\-tunnel\-restart(1)
 Reboot the tunnel server
@@ -31,5 +32,7 @@ start\-cli\-tunnel\-subnet(1)
 Add, remove, or modify subnets
 .TP
 start\-cli\-tunnel\-update(1)
+Commands for checking and applying tunnel updates
 .TP
 start\-cli\-tunnel\-web(1)
+Commands for managing the tunnel web interface

core/man/start-cli/start-cli.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH start-cli 1  "start-cli 0.4.0-alpha.21" 
+.TH start-cli 1  "start-cli 0.4.0-beta.0" 
 .SH NAME
 start\-cli
 .SH SYNOPSIS
@@ -117,4 +117,4 @@ Command for calculating the blake3 hash of a file
 start\-cli\-wifi(1)
 Commands related to wifi networks i.e. add, connect, delete
 .SH VERSION
-v0.4.0\-alpha.21
+v0.4.0\-beta.0

core/man/start-container/start-container-pipe-wrap.1

@@ -0,0 +1,15 @@
+.ie \n(.g .ds Aq \(aq
+.el .ds Aq '
+.TH start-container-pipe-wrap 1  "pipe-wrap " 
+.SH NAME
+start\-container\-pipe\-wrap
+.SH SYNOPSIS
+\fBstart\-container pipe\-wrap\fR [\fB\-h\fR|\fB\-\-help\fR] [\fICOMMAND\fR] 
+.SH DESCRIPTION
+.SH OPTIONS
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+Print help
+.TP
+[\fICOMMAND\fR]
+Command to execute in the container

core/man/start-container/start-container.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH start-container 1  "start-container 0.4.0-alpha.21" 
+.TH start-container 1  "start-container 0.4.0-beta.0" 
 .SH NAME
 start\-container
 .SH SYNOPSIS
@@ -34,6 +34,8 @@ start\-container\-get\-status(1)
 .TP
 start\-container\-git\-info(1)
 .TP
+start\-container\-pipe\-wrap(1)
+.TP
 start\-container\-plugin(1)
 .TP
 start\-container\-rebuild(1)
@@ -50,4 +52,4 @@ start\-container\-shutdown(1)
 .TP
 start\-container\-subcontainer(1)
 .SH VERSION
-v0.4.0\-alpha.21
+v0.4.0\-beta.0

core/man/start-registry/start-registry-admin-signer-remove.1

@@ -0,0 +1,16 @@
+.ie \n(.g .ds Aq \(aq
+.el .ds Aq '
+.TH start-registry-admin-signer-remove 1  "remove " 
+.SH NAME
+start\-registry\-admin\-signer\-remove \- Remove signer and all their authorizations
+.SH SYNOPSIS
+\fBstart\-registry admin signer remove\fR [\fB\-h\fR|\fB\-\-help\fR] <\fIID\fR> 
+.SH DESCRIPTION
+Remove signer and all their authorizations
+.SH OPTIONS
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+Print help
+.TP
+<\fIID\fR>
+Signer identifier

core/man/start-registry/start-registry-admin-signer.1

@@ -21,3 +21,6 @@ Edit signer information
 .TP
 start\-registry\-admin\-signer\-list(1)
 List signers
+.TP
+start\-registry\-admin\-signer\-remove(1)
+Remove signer and all their authorizations

core/man/start-registry/start-registry-info-set-icon.1

@@ -13,4 +13,4 @@ Set the registry icon
 Print help
 .TP
 <\fIICON\fR>
-Path to service icon file
+Icon source: file path, file:// URL, http(s):// URL, or data: URL

core/man/start-registry/start-registry-info.1

@@ -2,11 +2,11 @@
 .el .ds Aq '
 .TH start-registry-info 1  "info " 
 .SH NAME
-start\-registry\-info \- Display registry info
+start\-registry\-info \- View or edit registry information
 .SH SYNOPSIS
 \fBstart\-registry info\fR [\fB\-\-format\fR] [\fB\-h\fR|\fB\-\-help\fR] [\fIsubcommands\fR]
 .SH DESCRIPTION
-Display registry info
+View or edit registry information
 .SH OPTIONS
 .TP
 \fB\-\-format\fR

core/man/start-registry/start-registry-metrics-downloads.1

@@ -0,0 +1,28 @@
+.ie \n(.g .ds Aq \(aq
+.el .ds Aq '
+.TH start-registry-metrics-downloads 1  "downloads " 
+.SH NAME
+start\-registry\-metrics\-downloads \- Count package download requests with optional filters
+.SH SYNOPSIS
+\fBstart\-registry metrics downloads\fR [\fB\-\-pkg\-id\fR] [\fB\-\-version\fR] [\fB\-\-after\fR] [\fB\-\-before\fR] [\fB\-\-format\fR] [\fB\-h\fR|\fB\-\-help\fR] 
+.SH DESCRIPTION
+Count package download requests with optional filters
+.SH OPTIONS
+.TP
+\fB\-\-pkg\-id\fR \fI<PKG_ID>\fR
+Filter by package ID
+.TP
+\fB\-\-version\fR \fI<VERSION>\fR
+Filter by version
+.TP
+\fB\-\-after\fR \fI<AFTER>\fR
+Start of time range (RFC 3339 timestamp)
+.TP
+\fB\-\-before\fR \fI<BEFORE>\fR
+End of time range (RFC 3339 timestamp)
+.TP
+\fB\-\-format\fR
+
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+Print help

core/man/start-registry/start-registry-metrics-summary.1

@@ -0,0 +1,16 @@
+.ie \n(.g .ds Aq \(aq
+.el .ds Aq '
+.TH start-registry-metrics-summary 1  "summary " 
+.SH NAME
+start\-registry\-metrics\-summary \- Get a summary of registry usage metrics
+.SH SYNOPSIS
+\fBstart\-registry metrics summary\fR [\fB\-\-format\fR] [\fB\-h\fR|\fB\-\-help\fR] 
+.SH DESCRIPTION
+Get a summary of registry usage metrics
+.SH OPTIONS
+.TP
+\fB\-\-format\fR
+
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+Print help

core/man/start-registry/start-registry-metrics-users.1

@@ -0,0 +1,22 @@
+.ie \n(.g .ds Aq \(aq
+.el .ds Aq '
+.TH start-registry-metrics-users 1  "users " 
+.SH NAME
+start\-registry\-metrics\-users \- Count unique active users within a time range
+.SH SYNOPSIS
+\fBstart\-registry metrics users\fR [\fB\-\-after\fR] [\fB\-\-before\fR] [\fB\-\-format\fR] [\fB\-h\fR|\fB\-\-help\fR] 
+.SH DESCRIPTION
+Count unique active users within a time range
+.SH OPTIONS
+.TP
+\fB\-\-after\fR \fI<AFTER>\fR
+Start of time range (RFC 3339 timestamp)
+.TP
+\fB\-\-before\fR \fI<BEFORE>\fR
+End of time range (RFC 3339 timestamp)
+.TP
+\fB\-\-format\fR
+
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+Print help

core/man/start-registry/start-registry-metrics.1

@@ -0,0 +1,23 @@
+.ie \n(.g .ds Aq \(aq
+.el .ds Aq '
+.TH start-registry-metrics 1  "metrics " 
+.SH NAME
+start\-registry\-metrics \- Query registry usage metrics
+.SH SYNOPSIS
+\fBstart\-registry metrics\fR [\fB\-h\fR|\fB\-\-help\fR] <\fIsubcommands\fR>
+.SH DESCRIPTION
+Query registry usage metrics
+.SH OPTIONS
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+Print help
+.SH SUBCOMMANDS
+.TP
+start\-registry\-metrics\-downloads(1)
+Count package download requests with optional filters
+.TP
+start\-registry\-metrics\-summary(1)
+Get a summary of registry usage metrics
+.TP
+start\-registry\-metrics\-users(1)
+Count unique active users within a time range

core/man/start-registry/start-registry-os-promote.1

@@ -0,0 +1,22 @@
+.ie \n(.g .ds Aq \(aq
+.el .ds Aq '
+.TH start-registry-os-promote 1  "promote " 
+.SH NAME
+start\-registry\-os\-promote \- Promote an OS version from one registry to another
+.SH SYNOPSIS
+\fBstart\-registry os promote\fR [\fB\-\-from\fR] [\fB\-\-to\fR] [\fB\-h\fR|\fB\-\-help\fR] <\fIVERSION\fR> 
+.SH DESCRIPTION
+Promote an OS version from one registry to another
+.SH OPTIONS
+.TP
+\fB\-\-from\fR \fI<FROM>\fR
+Source registry URL to promote from
+.TP
+\fB\-\-to\fR \fI<TO>\fR
+Destination registry URL to promote to
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+Print help
+.TP
+<\fIVERSION\fR>
+StartOS version number

core/man/start-registry/start-registry-os.1

@@ -19,5 +19,8 @@ Commands to add, sign, or get registry assets
 start\-registry\-os\-index(1)
 List OS versions index
 .TP
+start\-registry\-os\-promote(1)
+Promote an OS version from one registry to another
+.TP
 start\-registry\-os\-version(1)
 Commands to add, remove, or list versions or version signers

core/man/start-registry/start-registry-package-category-list.1

@@ -2,10 +2,11 @@
 .el .ds Aq '
 .TH start-registry-package-category-list 1  "list " 
 .SH NAME
-start\-registry\-package\-category\-list
+start\-registry\-package\-category\-list \- List registry categories
 .SH SYNOPSIS
 \fBstart\-registry package category list\fR [\fB\-\-format\fR] [\fB\-h\fR|\fB\-\-help\fR] 
 .SH DESCRIPTION
+List registry categories
 .SH OPTIONS
 .TP
 \fB\-\-format\fR

core/man/start-registry/start-registry-package-category.1

@@ -20,6 +20,7 @@ start\-registry\-package\-category\-add\-package(1)
 Add a package to a category
 .TP
 start\-registry\-package\-category\-list(1)
+List registry categories
 .TP
 start\-registry\-package\-category\-remove(1)
 Remove category from registry

core/man/start-registry/start-registry-package-download.1

@@ -4,7 +4,7 @@
 .SH NAME
 start\-registry\-package\-download \- Download s9pk package
 .SH SYNOPSIS
-\fBstart\-registry package download\fR [\fB\-v\fR|\fB\-\-target\-version\fR] [\fB\-d\fR|\fB\-\-dest\fR] [\fB\-h\fR|\fB\-\-help\fR] <\fIID\fR> 
+\fBstart\-registry package download\fR [\fB\-v\fR|\fB\-\-target\-version\fR] [\fB\-d\fR|\fB\-\-dest\fR] [\fB\-a\fR|\fB\-\-arch\fR] [\fB\-h\fR|\fB\-\-help\fR] <\fIID\fR> 
 .SH DESCRIPTION
 Download s9pk package
 .SH OPTIONS
@@ -15,6 +15,9 @@ Target version range constraint
 \fB\-d\fR, \fB\-\-dest\fR \fI<DEST>\fR
 Destination path for download
 .TP
+\fB\-a\fR, \fB\-\-arch\fR \fI<ARCH>\fR
+Target CPU architecture (e.g. x86_64, aarch64)
+.TP
 \fB\-h\fR, \fB\-\-help\fR
 Print help
 .TP

core/man/start-registry/start-registry-package-promote.1

@@ -0,0 +1,25 @@
+.ie \n(.g .ds Aq \(aq
+.el .ds Aq '
+.TH start-registry-package-promote 1  "promote " 
+.SH NAME
+start\-registry\-package\-promote \- Promote a package from one registry to another
+.SH SYNOPSIS
+\fBstart\-registry package promote\fR [\fB\-\-from\fR] [\fB\-\-to\fR] [\fB\-h\fR|\fB\-\-help\fR] <\fIID\fR> <\fIVERSION\fR> 
+.SH DESCRIPTION
+Promote a package from one registry to another
+.SH OPTIONS
+.TP
+\fB\-\-from\fR \fI<FROM>\fR
+Source registry URL to promote from
+.TP
+\fB\-\-to\fR \fI<TO>\fR
+Destination registry URL to promote to
+.TP
+\fB\-h\fR, \fB\-\-help\fR
+Print help
+.TP
+<\fIID\fR>
+Package identifier
+.TP
+<\fIVERSION\fR>
+Package version

core/man/start-registry/start-registry-package-remove.1

@@ -4,7 +4,7 @@
 .SH NAME
 start\-registry\-package\-remove \- Remove package from registry
 .SH SYNOPSIS
-\fBstart\-registry package remove\fR [\fB\-\-sighash\fR] [\fB\-h\fR|\fB\-\-help\fR] <\fIID\fR> <\fIVERSION\fR> 
+\fBstart\-registry package remove\fR [\fB\-\-sighash\fR] [\fB\-\-force\fR] [\fB\-h\fR|\fB\-\-help\fR] <\fIID\fR> [\fIVERSION\fR] 
 .SH DESCRIPTION
 Remove package from registry
 .SH OPTIONS
@@ -12,11 +12,14 @@ Remove package from registry
 \fB\-\-sighash\fR \fI<SIGHASH>\fR
 Hash for signature verification
 .TP
+\fB\-\-force\fR
+Force removal even if the package has versions
+.TP
 \fB\-h\fR, \fB\-\-help\fR
 Print help
 .TP
 <\fIID\fR>
 Package identifier
 .TP
-<\fIVERSION\fR>
+[\fIVERSION\fR]
 Package version

core/man/start-registry/start-registry-package.1

@@ -31,6 +31,9 @@ List installation candidates
 start\-registry\-package\-index(1)
 List packages and categories
 .TP
+start\-registry\-package\-promote(1)
+Promote a package from one registry to another
+.TP
 start\-registry\-package\-remove(1)
 Remove package from registry
 .TP

core/man/start-registry/start-registry.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH start-registry 1  "start-registry 0.4.0-alpha.21" 
+.TH start-registry 1  "start-registry 0.4.0-beta.0" 
 .SH NAME
 start\-registry
 .SH SYNOPSIS
@@ -55,7 +55,10 @@ start\-registry\-index(1)
 List registry info and packages
 .TP
 start\-registry\-info(1)
-Display registry info
+View or edit registry information
+.TP
+start\-registry\-metrics(1)
+Query registry usage metrics
 .TP
 start\-registry\-os(1)
 Commands related to OS assets and versions
@@ -63,4 +66,4 @@ Commands related to OS assets and versions
 start\-registry\-package(1)
 Commands to index, add, or get packages
 .SH VERSION
-v0.4.0\-alpha.21
+v0.4.0\-beta.0

core/man/start-tunnel/start-tunnel-auth-key.1

@@ -2,10 +2,11 @@
 .el .ds Aq '
 .TH start-tunnel-auth-key 1  "key " 
 .SH NAME
-start\-tunnel\-auth\-key
+start\-tunnel\-auth\-key \- Commands for managing authorized keys
 .SH SYNOPSIS
 \fBstart\-tunnel auth key\fR [\fB\-h\fR|\fB\-\-help\fR] <\fIsubcommands\fR>
 .SH DESCRIPTION
+Commands for managing authorized keys
 .SH OPTIONS
 .TP
 \fB\-h\fR, \fB\-\-help\fR

core/man/start-tunnel/start-tunnel-auth.1

@@ -17,6 +17,7 @@ start\-tunnel\-auth\-get\-pubkey(1)
 Get the public key from the server
 .TP
 start\-tunnel\-auth\-key(1)
+Commands for managing authorized keys
 .TP
 start\-tunnel\-auth\-login(1)
 Login to a new auth session

core/man/start-tunnel/start-tunnel-port-forward-set-enabled.1

@@ -2,11 +2,11 @@
 .el .ds Aq '
 .TH start-tunnel-port-forward-set-enabled 1  "set-enabled " 
 .SH NAME
-start\-tunnel\-port\-forward\-set\-enabled \- about.enable\-or\-disable\-port\-forward
+start\-tunnel\-port\-forward\-set\-enabled \- Enable or disable a port forward
 .SH SYNOPSIS
 \fBstart\-tunnel port\-forward set\-enabled\fR [\fB\-\-enabled\fR] [\fB\-h\fR|\fB\-\-help\fR] <\fISOURCE\fR> 
 .SH DESCRIPTION
-about.enable\-or\-disable\-port\-forward
+Enable or disable a port forward
 .SH OPTIONS
 .TP
 \fB\-\-enabled\fR