@agimon-ai/doompi-core 0.0.1-alpha.100

package/dist/src/server/devProxyForward.cjs

@@ -0,0 +1,141 @@
+const require_runtime = require("../../_virtual/_rolldown/runtime.cjs");
+const require_remote = require("../constants/remote.cjs");
+const require_index = require("../services/loopbackAddress/index.cjs");
+let node_http = require("node:http");
+node_http = require_runtime.__toESM(node_http, 1);
+let node_stream = require("node:stream");
+//#region src/server/devProxyForward.ts
+/**
+* One HTTP request forwarded to a local dev server, the way nginx would.
+*
+* Three rewrites are not optional, and each one is a bug report waiting to
+* happen if it is skipped:
+*
+* - `Host` becomes the upstream's own address. Vite's `server.allowedHosts`
+*   and Next's dev-origin check refuse a request whose Host they do not
+*   recognize, so forwarding the cockpit's public hostname makes the dev
+*   server answer with a block page rather than the app.
+* - A root-relative `Location` gains the prefix, or the first redirect walks
+*   the browser out of the proxy and into the cockpit.
+* - `Set-Cookie` with `Path=/` is narrowed to the prefix, or the dev app's
+*   session cookie is sent on every cockpit request for the rest of the day.
+*
+* The cockpit's own cookies are removed on the way out. nginx would forward
+* them, but `__Host-doompi_device` is a bearer credential for the cockpit and
+* the dev server has no use for it. Handing it to an unaudited dev dependency,
+* or into its request log, is a leak with no upside.
+*/
+/** Headers that describe one hop and must not be copied onto the next. */
+const HOP_BY_HOP = /* @__PURE__ */ new Set([
+	"connection",
+	"keep-alive",
+	"transfer-encoding",
+	"upgrade"
+]);
+/** Set from the target rather than copied, so the browser's value never reaches the upstream. */
+const REPLACED = /* @__PURE__ */ new Set(["host"]);
+/** Cookies belonging to the cockpit rather than to the proxied application. */
+const COCKPIT_COOKIE_MARKER = "doompi";
+const BAD_GATEWAY = 502;
+const NO_BODY_STATUSES = /* @__PURE__ */ new Set([204, 304]);
+/** An IPv6 literal needs brackets before it can be a Host header value. */
+function hostHeader(host, port) {
+	return host.includes(":") ? `[${host}]:${String(port)}` : `${host}:${String(port)}`;
+}
+/** Drops the cockpit's cookies and keeps the application's own. */
+function filterCookies(raw) {
+	const kept = raw.split(";").map((pair) => pair.trim()).filter((pair) => pair !== "" && !pair.slice(0, pair.indexOf("=")).toLowerCase().includes(COCKPIT_COOKIE_MARKER));
+	return kept.length === 0 ? void 0 : kept.join("; ");
+}
+function outgoingHeaders(input, host) {
+	const out = {};
+	input.headers.forEach((value, key) => {
+		const normalized = key.toLowerCase();
+		if (HOP_BY_HOP.has(normalized) || REPLACED.has(normalized)) return;
+		if (normalized === "cookie") {
+			const kept = filterCookies(value);
+			if (kept !== void 0) out.cookie = kept;
+			return;
+		}
+		out[key] = value;
+	});
+	out.host = hostHeader(host, input.port);
+	out["x-forwarded-proto"] = input.forwardedProto;
+	if (input.forwardedHost !== void 0) out["x-forwarded-host"] = input.forwardedHost;
+	out["x-forwarded-prefix"] = `${require_remote.DEV_PROXY_PREFIX}${input.name}`;
+	return out;
+}
+/** Prefixes a root-relative redirect so it stays inside the proxied target. */
+function rewriteLocation(value, name) {
+	const mount = `${require_remote.DEV_PROXY_PREFIX}${name}`;
+	if (!value.startsWith("/") || value.startsWith("//") || value.startsWith(`${mount}/`)) return value;
+	return `${mount}${value}`;
+}
+/**
+* Narrows a cookie's Path to the proxied mount.
+*
+* A dev app setting `Path=/` means it on its own origin, where it is the only
+* tenant. Here it is not, so the attribute is rewritten rather than honoured.
+* A cookie with no Path at all already defaults to the request's directory,
+* which is inside the mount, so it is left alone.
+*/
+function rewriteSetCookie(value, name) {
+	const mount = `${require_remote.DEV_PROXY_PREFIX}${name}/`;
+	return value.replaceAll(/;\s*path=([^;]*)/giu, (_match, current) => {
+		const trimmed = current.trim();
+		if (trimmed.startsWith(mount)) return `; Path=${trimmed}`;
+		const suffix = trimmed === "/" || trimmed === "" ? "" : trimmed.replace(/^\//u, "");
+		return `; Path=${mount}${suffix}`;
+	});
+}
+function responseHeaders(incoming, name) {
+	const headers = new Headers();
+	for (const [key, value] of Object.entries(incoming.headers)) {
+		const normalized = key.toLowerCase();
+		if (value === void 0 || HOP_BY_HOP.has(normalized)) continue;
+		if (normalized === "set-cookie") {
+			for (const cookie of Array.isArray(value) ? value : [value]) headers.append("set-cookie", rewriteSetCookie(cookie, name));
+			continue;
+		}
+		const single = Array.isArray(value) ? value.join(", ") : value;
+		headers.set(key, normalized === "location" ? rewriteLocation(single, name) : single);
+	}
+	return headers;
+}
+/**
+* Forwards one request and returns the upstream's answer.
+*
+* Both bodies stream. A dev server sends multi-megabyte source maps and
+* receives file uploads, and buffering either would hold the whole thing in
+* memory for no benefit.
+*/
+async function forwardToDevServer(input) {
+	const host = await require_index.loopbackFor(input.port);
+	return new Promise((resolve, reject) => {
+		const request = node_http.default.request({
+			host,
+			port: input.port,
+			path: input.upstreamPath,
+			method: input.method,
+			headers: outgoingHeaders(input, host),
+			signal: input.signal
+		}, (incoming) => {
+			const status = incoming.statusCode ?? BAD_GATEWAY;
+			const body = NO_BODY_STATUSES.has(status) ? null : node_stream.Readable.toWeb(incoming);
+			resolve(new Response(body, {
+				status,
+				headers: responseHeaders(incoming, input.name)
+			}));
+		});
+		request.once("error", reject);
+		if (input.body === null) {
+			request.end();
+			return;
+		}
+		node_stream.Readable.fromWeb(input.body).on("error", reject).pipe(request);
+	});
+}
+//#endregion
+exports.forwardToDevServer = forwardToDevServer;
+
+//# sourceMappingURL=devProxyForward.cjs.map

package/dist/src/server/devProxyForward.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"devProxyForward.cjs","names":["DEV_PROXY_PREFIX","loopbackFor","http","Readable"],"sources":["../../../src/server/devProxyForward.ts"],"sourcesContent":["import http from 'node:http';\nimport { Readable } from 'node:stream';\n\nimport { DEV_PROXY_PREFIX } from '../constants/remote';\nimport { loopbackFor, type LoopbackAddress } from '../services/loopbackAddress';\n\n/**\n * One HTTP request forwarded to a local dev server, the way nginx would.\n *\n * Three rewrites are not optional, and each one is a bug report waiting to\n * happen if it is skipped:\n *\n * - `Host` becomes the upstream's own address. Vite's `server.allowedHosts`\n *   and Next's dev-origin check refuse a request whose Host they do not\n *   recognize, so forwarding the cockpit's public hostname makes the dev\n *   server answer with a block page rather than the app.\n * - A root-relative `Location` gains the prefix, or the first redirect walks\n *   the browser out of the proxy and into the cockpit.\n * - `Set-Cookie` with `Path=/` is narrowed to the prefix, or the dev app's\n *   session cookie is sent on every cockpit request for the rest of the day.\n *\n * The cockpit's own cookies are removed on the way out. nginx would forward\n * them, but `__Host-doompi_device` is a bearer credential for the cockpit and\n * the dev server has no use for it. Handing it to an unaudited dev dependency,\n * or into its request log, is a leak with no upside.\n */\n\n/** Headers that describe one hop and must not be copied onto the next. */\nconst HOP_BY_HOP = new Set(['connection', 'keep-alive', 'transfer-encoding', 'upgrade']);\n/** Set from the target rather than copied, so the browser's value never reaches the upstream. */\nconst REPLACED = new Set(['host']);\n/** Cookies belonging to the cockpit rather than to the proxied application. */\nconst COCKPIT_COOKIE_MARKER = 'doompi';\nconst BAD_GATEWAY = 502;\nconst NO_BODY_STATUSES = new Set([204, 304]);\n\nexport interface ForwardInput {\n  /** The registered target's name, which is also its path segment. */\n  name: string;\n  port: number;\n  /** Path and query exactly as the browser sent them, prefix included. */\n  upstreamPath: string;\n  method: string;\n  headers: Headers;\n  body: ReadableStream<Uint8Array> | null;\n  /** The scheme the browser used, which is https whenever a tunnel is in front. */\n  forwardedProto: string;\n  /** The Host the browser addressed, for an app that builds absolute URLs. */\n  forwardedHost: string | undefined;\n  signal?: AbortSignal;\n}\n\n/** An IPv6 literal needs brackets before it can be a Host header value. */\nfunction hostHeader(host: LoopbackAddress, port: number): string {\n  return host.includes(':') ? `[${host}]:${String(port)}` : `${host}:${String(port)}`;\n}\n\n/** Drops the cockpit's cookies and keeps the application's own. */\nfunction filterCookies(raw: string): string | undefined {\n  const kept = raw\n    .split(';')\n    .map((pair) => pair.trim())\n    .filter((pair) => pair !== '' && !pair.slice(0, pair.indexOf('=')).toLowerCase().includes(COCKPIT_COOKIE_MARKER));\n  return kept.length === 0 ? undefined : kept.join('; ');\n}\n\nfunction outgoingHeaders(input: ForwardInput, host: LoopbackAddress): Record<string, string> {\n  const out: Record<string, string> = {};\n  input.headers.forEach((value, key) => {\n    const normalized = key.toLowerCase();\n    if (HOP_BY_HOP.has(normalized) || REPLACED.has(normalized)) return;\n    if (normalized === 'cookie') {\n      const kept = filterCookies(value);\n      if (kept !== undefined) out.cookie = kept;\n      return;\n    }\n    out[key] = value;\n  });\n  out.host = hostHeader(host, input.port);\n  out['x-forwarded-proto'] = input.forwardedProto;\n  if (input.forwardedHost !== undefined) out['x-forwarded-host'] = input.forwardedHost;\n  // Read by frameworks that can self-configure their base path. Vite and Next\n  // ignore it and need their own `base`/`basePath`, which is documented.\n  out['x-forwarded-prefix'] = `${DEV_PROXY_PREFIX}${input.name}`;\n  return out;\n}\n\n/** Prefixes a root-relative redirect so it stays inside the proxied target. */\nfunction rewriteLocation(value: string, name: string): string {\n  const mount = `${DEV_PROXY_PREFIX}${name}`;\n  if (!value.startsWith('/') || value.startsWith('//') || value.startsWith(`${mount}/`)) return value;\n  return `${mount}${value}`;\n}\n\n/**\n * Narrows a cookie's Path to the proxied mount.\n *\n * A dev app setting `Path=/` means it on its own origin, where it is the only\n * tenant. Here it is not, so the attribute is rewritten rather than honoured.\n * A cookie with no Path at all already defaults to the request's directory,\n * which is inside the mount, so it is left alone.\n */\nfunction rewriteSetCookie(value: string, name: string): string {\n  const mount = `${DEV_PROXY_PREFIX}${name}/`;\n  return value.replaceAll(/;\\s*path=([^;]*)/giu, (_match, current: string) => {\n    const trimmed = current.trim();\n    if (trimmed.startsWith(mount)) return `; Path=${trimmed}`;\n    const suffix = trimmed === '/' || trimmed === '' ? '' : trimmed.replace(/^\\//u, '');\n    return `; Path=${mount}${suffix}`;\n  });\n}\n\nfunction responseHeaders(incoming: http.IncomingMessage, name: string): Headers {\n  const headers = new Headers();\n  for (const [key, value] of Object.entries(incoming.headers)) {\n    const normalized = key.toLowerCase();\n    if (value === undefined || HOP_BY_HOP.has(normalized)) continue;\n    if (normalized === 'set-cookie') {\n      // The only header that legitimately repeats, so it is appended rather\n      // than set; joining several cookies into one value discards all but one.\n      for (const cookie of Array.isArray(value) ? value : [value]) {\n        headers.append('set-cookie', rewriteSetCookie(cookie, name));\n      }\n      continue;\n    }\n    const single = Array.isArray(value) ? value.join(', ') : value;\n    headers.set(key, normalized === 'location' ? rewriteLocation(single, name) : single);\n  }\n  return headers;\n}\n\n/**\n * Forwards one request and returns the upstream's answer.\n *\n * Both bodies stream. A dev server sends multi-megabyte source maps and\n * receives file uploads, and buffering either would hold the whole thing in\n * memory for no benefit.\n */\nexport async function forwardToDevServer(input: ForwardInput): Promise<Response> {\n  const host = await loopbackFor(input.port);\n  return new Promise<Response>((resolve, reject) => {\n    const request = http.request(\n      {\n        host,\n        port: input.port,\n        path: input.upstreamPath,\n        method: input.method,\n        headers: outgoingHeaders(input, host),\n        signal: input.signal,\n      },\n      (incoming) => {\n        const status = incoming.statusCode ?? BAD_GATEWAY;\n        // 204 and 304 carry no body, and constructing one with a stream throws.\n        const body = NO_BODY_STATUSES.has(status) ? null : (Readable.toWeb(incoming) as ReadableStream);\n        resolve(new Response(body, { status, headers: responseHeaders(incoming, input.name) }));\n      },\n    );\n    request.once('error', reject);\n    if (input.body === null) {\n      request.end();\n      return;\n    }\n    Readable.fromWeb(input.body as Parameters<typeof Readable.fromWeb>[0])\n      .on('error', reject)\n      .pipe(request);\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,MAAM,6BAAa,IAAI,IAAI;CAAC;CAAc;CAAc;CAAqB;AAAS,CAAC;;AAEvF,MAAM,2BAAW,IAAI,IAAI,CAAC,MAAM,CAAC;;AAEjC,MAAM,wBAAwB;AAC9B,MAAM,cAAc;AACpB,MAAM,mCAAmB,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC;;AAmB3C,SAAS,WAAW,MAAuB,MAAsB;CAC/D,OAAO,KAAK,SAAS,GAAG,IAAI,IAAI,KAAK,IAAI,OAAO,IAAI,MAAM,GAAG,KAAK,GAAG,OAAO,IAAI;AAClF;;AAGA,SAAS,cAAc,KAAiC;CACtD,MAAM,OAAO,IACV,MAAM,GAAG,CAAC,CACV,KAAK,SAAS,KAAK,KAAK,CAAC,CAAC,CAC1B,QAAQ,SAAS,SAAS,MAAM,CAAC,KAAK,MAAM,GAAG,KAAK,QAAQ,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,SAAS,qBAAqB,CAAC;CAClH,OAAO,KAAK,WAAW,IAAI,KAAA,IAAY,KAAK,KAAK,IAAI;AACvD;AAEA,SAAS,gBAAgB,OAAqB,MAA+C;CAC3F,MAAM,MAA8B,CAAC;CACrC,MAAM,QAAQ,SAAS,OAAO,QAAQ;EACpC,MAAM,aAAa,IAAI,YAAY;EACnC,IAAI,WAAW,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,GAAG;EAC5D,IAAI,eAAe,UAAU;GAC3B,MAAM,OAAO,cAAc,KAAK;GAChC,IAAI,SAAS,KAAA,GAAW,IAAI,SAAS;GACrC;EACF;EACA,IAAI,OAAO;CACb,CAAC;CACD,IAAI,OAAO,WAAW,MAAM,MAAM,IAAI;CACtC,IAAI,uBAAuB,MAAM;CACjC,IAAI,MAAM,kBAAkB,KAAA,GAAW,IAAI,sBAAsB,MAAM;CAGvE,IAAI,wBAAwB,GAAGA,eAAAA,mBAAmB,MAAM;CACxD,OAAO;AACT;;AAGA,SAAS,gBAAgB,OAAe,MAAsB;CAC5D,MAAM,QAAQ,GAAGA,eAAAA,mBAAmB;CACpC,IAAI,CAAC,MAAM,WAAW,GAAG,KAAK,MAAM,WAAW,IAAI,KAAK,MAAM,WAAW,GAAG,MAAM,EAAE,GAAG,OAAO;CAC9F,OAAO,GAAG,QAAQ;AACpB;;;;;;;;;AAUA,SAAS,iBAAiB,OAAe,MAAsB;CAC7D,MAAM,QAAQ,GAAGA,eAAAA,mBAAmB,KAAK;CACzC,OAAO,MAAM,WAAW,wBAAwB,QAAQ,YAAoB;EAC1E,MAAM,UAAU,QAAQ,KAAK;EAC7B,IAAI,QAAQ,WAAW,KAAK,GAAG,OAAO,UAAU;EAChD,MAAM,SAAS,YAAY,OAAO,YAAY,KAAK,KAAK,QAAQ,QAAQ,QAAQ,EAAE;EAClF,OAAO,UAAU,QAAQ;CAC3B,CAAC;AACH;AAEA,SAAS,gBAAgB,UAAgC,MAAuB;CAC9E,MAAM,UAAU,IAAI,QAAQ;CAC5B,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,SAAS,OAAO,GAAG;EAC3D,MAAM,aAAa,IAAI,YAAY;EACnC,IAAI,UAAU,KAAA,KAAa,WAAW,IAAI,UAAU,GAAG;EACvD,IAAI,eAAe,cAAc;GAG/B,KAAK,MAAM,UAAU,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK,GACxD,QAAQ,OAAO,cAAc,iBAAiB,QAAQ,IAAI,CAAC;GAE7D;EACF;EACA,MAAM,SAAS,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,IAAI,IAAI;EACzD,QAAQ,IAAI,KAAK,eAAe,aAAa,gBAAgB,QAAQ,IAAI,IAAI,MAAM;CACrF;CACA,OAAO;AACT;;;;;;;;AASA,eAAsB,mBAAmB,OAAwC;CAC/E,MAAM,OAAO,MAAMC,cAAAA,YAAY,MAAM,IAAI;CACzC,OAAO,IAAI,SAAmB,SAAS,WAAW;EAChD,MAAM,UAAUC,UAAAA,QAAK,QACnB;GACE;GACA,MAAM,MAAM;GACZ,MAAM,MAAM;GACZ,QAAQ,MAAM;GACd,SAAS,gBAAgB,OAAO,IAAI;GACpC,QAAQ,MAAM;EAChB,IACC,aAAa;GACZ,MAAM,SAAS,SAAS,cAAc;GAEtC,MAAM,OAAO,iBAAiB,IAAI,MAAM,IAAI,OAAQC,YAAAA,SAAS,MAAM,QAAQ;GAC3E,QAAQ,IAAI,SAAS,MAAM;IAAE;IAAQ,SAAS,gBAAgB,UAAU,MAAM,IAAI;GAAE,CAAC,CAAC;EACxF,CACF;EACA,QAAQ,KAAK,SAAS,MAAM;EAC5B,IAAI,MAAM,SAAS,MAAM;GACvB,QAAQ,IAAI;GACZ;EACF;EACA,YAAA,SAAS,QAAQ,MAAM,IAA8C,CAAC,CACnE,GAAG,SAAS,MAAM,CAAC,CACnB,KAAK,OAAO;CACjB,CAAC;AACH"}

package/dist/src/server/devProxyForward.mjs

@@ -0,0 +1,139 @@
+import { DEV_PROXY_PREFIX } from "../constants/remote.mjs";
+import { loopbackFor } from "../services/loopbackAddress/index.mjs";
+import http from "node:http";
+import { Readable } from "node:stream";
+//#region src/server/devProxyForward.ts
+/**
+* One HTTP request forwarded to a local dev server, the way nginx would.
+*
+* Three rewrites are not optional, and each one is a bug report waiting to
+* happen if it is skipped:
+*
+* - `Host` becomes the upstream's own address. Vite's `server.allowedHosts`
+*   and Next's dev-origin check refuse a request whose Host they do not
+*   recognize, so forwarding the cockpit's public hostname makes the dev
+*   server answer with a block page rather than the app.
+* - A root-relative `Location` gains the prefix, or the first redirect walks
+*   the browser out of the proxy and into the cockpit.
+* - `Set-Cookie` with `Path=/` is narrowed to the prefix, or the dev app's
+*   session cookie is sent on every cockpit request for the rest of the day.
+*
+* The cockpit's own cookies are removed on the way out. nginx would forward
+* them, but `__Host-doompi_device` is a bearer credential for the cockpit and
+* the dev server has no use for it. Handing it to an unaudited dev dependency,
+* or into its request log, is a leak with no upside.
+*/
+/** Headers that describe one hop and must not be copied onto the next. */
+const HOP_BY_HOP = /* @__PURE__ */ new Set([
+	"connection",
+	"keep-alive",
+	"transfer-encoding",
+	"upgrade"
+]);
+/** Set from the target rather than copied, so the browser's value never reaches the upstream. */
+const REPLACED = /* @__PURE__ */ new Set(["host"]);
+/** Cookies belonging to the cockpit rather than to the proxied application. */
+const COCKPIT_COOKIE_MARKER = "doompi";
+const BAD_GATEWAY = 502;
+const NO_BODY_STATUSES = /* @__PURE__ */ new Set([204, 304]);
+/** An IPv6 literal needs brackets before it can be a Host header value. */
+function hostHeader(host, port) {
+	return host.includes(":") ? `[${host}]:${String(port)}` : `${host}:${String(port)}`;
+}
+/** Drops the cockpit's cookies and keeps the application's own. */
+function filterCookies(raw) {
+	const kept = raw.split(";").map((pair) => pair.trim()).filter((pair) => pair !== "" && !pair.slice(0, pair.indexOf("=")).toLowerCase().includes(COCKPIT_COOKIE_MARKER));
+	return kept.length === 0 ? void 0 : kept.join("; ");
+}
+function outgoingHeaders(input, host) {
+	const out = {};
+	input.headers.forEach((value, key) => {
+		const normalized = key.toLowerCase();
+		if (HOP_BY_HOP.has(normalized) || REPLACED.has(normalized)) return;
+		if (normalized === "cookie") {
+			const kept = filterCookies(value);
+			if (kept !== void 0) out.cookie = kept;
+			return;
+		}
+		out[key] = value;
+	});
+	out.host = hostHeader(host, input.port);
+	out["x-forwarded-proto"] = input.forwardedProto;
+	if (input.forwardedHost !== void 0) out["x-forwarded-host"] = input.forwardedHost;
+	out["x-forwarded-prefix"] = `${DEV_PROXY_PREFIX}${input.name}`;
+	return out;
+}
+/** Prefixes a root-relative redirect so it stays inside the proxied target. */
+function rewriteLocation(value, name) {
+	const mount = `${DEV_PROXY_PREFIX}${name}`;
+	if (!value.startsWith("/") || value.startsWith("//") || value.startsWith(`${mount}/`)) return value;
+	return `${mount}${value}`;
+}
+/**
+* Narrows a cookie's Path to the proxied mount.
+*
+* A dev app setting `Path=/` means it on its own origin, where it is the only
+* tenant. Here it is not, so the attribute is rewritten rather than honoured.
+* A cookie with no Path at all already defaults to the request's directory,
+* which is inside the mount, so it is left alone.
+*/
+function rewriteSetCookie(value, name) {
+	const mount = `${DEV_PROXY_PREFIX}${name}/`;
+	return value.replaceAll(/;\s*path=([^;]*)/giu, (_match, current) => {
+		const trimmed = current.trim();
+		if (trimmed.startsWith(mount)) return `; Path=${trimmed}`;
+		const suffix = trimmed === "/" || trimmed === "" ? "" : trimmed.replace(/^\//u, "");
+		return `; Path=${mount}${suffix}`;
+	});
+}
+function responseHeaders(incoming, name) {
+	const headers = new Headers();
+	for (const [key, value] of Object.entries(incoming.headers)) {
+		const normalized = key.toLowerCase();
+		if (value === void 0 || HOP_BY_HOP.has(normalized)) continue;
+		if (normalized === "set-cookie") {
+			for (const cookie of Array.isArray(value) ? value : [value]) headers.append("set-cookie", rewriteSetCookie(cookie, name));
+			continue;
+		}
+		const single = Array.isArray(value) ? value.join(", ") : value;
+		headers.set(key, normalized === "location" ? rewriteLocation(single, name) : single);
+	}
+	return headers;
+}
+/**
+* Forwards one request and returns the upstream's answer.
+*
+* Both bodies stream. A dev server sends multi-megabyte source maps and
+* receives file uploads, and buffering either would hold the whole thing in
+* memory for no benefit.
+*/
+async function forwardToDevServer(input) {
+	const host = await loopbackFor(input.port);
+	return new Promise((resolve, reject) => {
+		const request = http.request({
+			host,
+			port: input.port,
+			path: input.upstreamPath,
+			method: input.method,
+			headers: outgoingHeaders(input, host),
+			signal: input.signal
+		}, (incoming) => {
+			const status = incoming.statusCode ?? BAD_GATEWAY;
+			const body = NO_BODY_STATUSES.has(status) ? null : Readable.toWeb(incoming);
+			resolve(new Response(body, {
+				status,
+				headers: responseHeaders(incoming, input.name)
+			}));
+		});
+		request.once("error", reject);
+		if (input.body === null) {
+			request.end();
+			return;
+		}
+		Readable.fromWeb(input.body).on("error", reject).pipe(request);
+	});
+}
+//#endregion
+export { forwardToDevServer };
+
+//# sourceMappingURL=devProxyForward.mjs.map

package/dist/src/server/devProxyForward.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"devProxyForward.mjs","names":[],"sources":["../../../src/server/devProxyForward.ts"],"sourcesContent":["import http from 'node:http';\nimport { Readable } from 'node:stream';\n\nimport { DEV_PROXY_PREFIX } from '../constants/remote';\nimport { loopbackFor, type LoopbackAddress } from '../services/loopbackAddress';\n\n/**\n * One HTTP request forwarded to a local dev server, the way nginx would.\n *\n * Three rewrites are not optional, and each one is a bug report waiting to\n * happen if it is skipped:\n *\n * - `Host` becomes the upstream's own address. Vite's `server.allowedHosts`\n *   and Next's dev-origin check refuse a request whose Host they do not\n *   recognize, so forwarding the cockpit's public hostname makes the dev\n *   server answer with a block page rather than the app.\n * - A root-relative `Location` gains the prefix, or the first redirect walks\n *   the browser out of the proxy and into the cockpit.\n * - `Set-Cookie` with `Path=/` is narrowed to the prefix, or the dev app's\n *   session cookie is sent on every cockpit request for the rest of the day.\n *\n * The cockpit's own cookies are removed on the way out. nginx would forward\n * them, but `__Host-doompi_device` is a bearer credential for the cockpit and\n * the dev server has no use for it. Handing it to an unaudited dev dependency,\n * or into its request log, is a leak with no upside.\n */\n\n/** Headers that describe one hop and must not be copied onto the next. */\nconst HOP_BY_HOP = new Set(['connection', 'keep-alive', 'transfer-encoding', 'upgrade']);\n/** Set from the target rather than copied, so the browser's value never reaches the upstream. */\nconst REPLACED = new Set(['host']);\n/** Cookies belonging to the cockpit rather than to the proxied application. */\nconst COCKPIT_COOKIE_MARKER = 'doompi';\nconst BAD_GATEWAY = 502;\nconst NO_BODY_STATUSES = new Set([204, 304]);\n\nexport interface ForwardInput {\n  /** The registered target's name, which is also its path segment. */\n  name: string;\n  port: number;\n  /** Path and query exactly as the browser sent them, prefix included. */\n  upstreamPath: string;\n  method: string;\n  headers: Headers;\n  body: ReadableStream<Uint8Array> | null;\n  /** The scheme the browser used, which is https whenever a tunnel is in front. */\n  forwardedProto: string;\n  /** The Host the browser addressed, for an app that builds absolute URLs. */\n  forwardedHost: string | undefined;\n  signal?: AbortSignal;\n}\n\n/** An IPv6 literal needs brackets before it can be a Host header value. */\nfunction hostHeader(host: LoopbackAddress, port: number): string {\n  return host.includes(':') ? `[${host}]:${String(port)}` : `${host}:${String(port)}`;\n}\n\n/** Drops the cockpit's cookies and keeps the application's own. */\nfunction filterCookies(raw: string): string | undefined {\n  const kept = raw\n    .split(';')\n    .map((pair) => pair.trim())\n    .filter((pair) => pair !== '' && !pair.slice(0, pair.indexOf('=')).toLowerCase().includes(COCKPIT_COOKIE_MARKER));\n  return kept.length === 0 ? undefined : kept.join('; ');\n}\n\nfunction outgoingHeaders(input: ForwardInput, host: LoopbackAddress): Record<string, string> {\n  const out: Record<string, string> = {};\n  input.headers.forEach((value, key) => {\n    const normalized = key.toLowerCase();\n    if (HOP_BY_HOP.has(normalized) || REPLACED.has(normalized)) return;\n    if (normalized === 'cookie') {\n      const kept = filterCookies(value);\n      if (kept !== undefined) out.cookie = kept;\n      return;\n    }\n    out[key] = value;\n  });\n  out.host = hostHeader(host, input.port);\n  out['x-forwarded-proto'] = input.forwardedProto;\n  if (input.forwardedHost !== undefined) out['x-forwarded-host'] = input.forwardedHost;\n  // Read by frameworks that can self-configure their base path. Vite and Next\n  // ignore it and need their own `base`/`basePath`, which is documented.\n  out['x-forwarded-prefix'] = `${DEV_PROXY_PREFIX}${input.name}`;\n  return out;\n}\n\n/** Prefixes a root-relative redirect so it stays inside the proxied target. */\nfunction rewriteLocation(value: string, name: string): string {\n  const mount = `${DEV_PROXY_PREFIX}${name}`;\n  if (!value.startsWith('/') || value.startsWith('//') || value.startsWith(`${mount}/`)) return value;\n  return `${mount}${value}`;\n}\n\n/**\n * Narrows a cookie's Path to the proxied mount.\n *\n * A dev app setting `Path=/` means it on its own origin, where it is the only\n * tenant. Here it is not, so the attribute is rewritten rather than honoured.\n * A cookie with no Path at all already defaults to the request's directory,\n * which is inside the mount, so it is left alone.\n */\nfunction rewriteSetCookie(value: string, name: string): string {\n  const mount = `${DEV_PROXY_PREFIX}${name}/`;\n  return value.replaceAll(/;\\s*path=([^;]*)/giu, (_match, current: string) => {\n    const trimmed = current.trim();\n    if (trimmed.startsWith(mount)) return `; Path=${trimmed}`;\n    const suffix = trimmed === '/' || trimmed === '' ? '' : trimmed.replace(/^\\//u, '');\n    return `; Path=${mount}${suffix}`;\n  });\n}\n\nfunction responseHeaders(incoming: http.IncomingMessage, name: string): Headers {\n  const headers = new Headers();\n  for (const [key, value] of Object.entries(incoming.headers)) {\n    const normalized = key.toLowerCase();\n    if (value === undefined || HOP_BY_HOP.has(normalized)) continue;\n    if (normalized === 'set-cookie') {\n      // The only header that legitimately repeats, so it is appended rather\n      // than set; joining several cookies into one value discards all but one.\n      for (const cookie of Array.isArray(value) ? value : [value]) {\n        headers.append('set-cookie', rewriteSetCookie(cookie, name));\n      }\n      continue;\n    }\n    const single = Array.isArray(value) ? value.join(', ') : value;\n    headers.set(key, normalized === 'location' ? rewriteLocation(single, name) : single);\n  }\n  return headers;\n}\n\n/**\n * Forwards one request and returns the upstream's answer.\n *\n * Both bodies stream. A dev server sends multi-megabyte source maps and\n * receives file uploads, and buffering either would hold the whole thing in\n * memory for no benefit.\n */\nexport async function forwardToDevServer(input: ForwardInput): Promise<Response> {\n  const host = await loopbackFor(input.port);\n  return new Promise<Response>((resolve, reject) => {\n    const request = http.request(\n      {\n        host,\n        port: input.port,\n        path: input.upstreamPath,\n        method: input.method,\n        headers: outgoingHeaders(input, host),\n        signal: input.signal,\n      },\n      (incoming) => {\n        const status = incoming.statusCode ?? BAD_GATEWAY;\n        // 204 and 304 carry no body, and constructing one with a stream throws.\n        const body = NO_BODY_STATUSES.has(status) ? null : (Readable.toWeb(incoming) as ReadableStream);\n        resolve(new Response(body, { status, headers: responseHeaders(incoming, input.name) }));\n      },\n    );\n    request.once('error', reject);\n    if (input.body === null) {\n      request.end();\n      return;\n    }\n    Readable.fromWeb(input.body as Parameters<typeof Readable.fromWeb>[0])\n      .on('error', reject)\n      .pipe(request);\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,MAAM,6BAAa,IAAI,IAAI;CAAC;CAAc;CAAc;CAAqB;AAAS,CAAC;;AAEvF,MAAM,2BAAW,IAAI,IAAI,CAAC,MAAM,CAAC;;AAEjC,MAAM,wBAAwB;AAC9B,MAAM,cAAc;AACpB,MAAM,mCAAmB,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC;;AAmB3C,SAAS,WAAW,MAAuB,MAAsB;CAC/D,OAAO,KAAK,SAAS,GAAG,IAAI,IAAI,KAAK,IAAI,OAAO,IAAI,MAAM,GAAG,KAAK,GAAG,OAAO,IAAI;AAClF;;AAGA,SAAS,cAAc,KAAiC;CACtD,MAAM,OAAO,IACV,MAAM,GAAG,CAAC,CACV,KAAK,SAAS,KAAK,KAAK,CAAC,CAAC,CAC1B,QAAQ,SAAS,SAAS,MAAM,CAAC,KAAK,MAAM,GAAG,KAAK,QAAQ,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,SAAS,qBAAqB,CAAC;CAClH,OAAO,KAAK,WAAW,IAAI,KAAA,IAAY,KAAK,KAAK,IAAI;AACvD;AAEA,SAAS,gBAAgB,OAAqB,MAA+C;CAC3F,MAAM,MAA8B,CAAC;CACrC,MAAM,QAAQ,SAAS,OAAO,QAAQ;EACpC,MAAM,aAAa,IAAI,YAAY;EACnC,IAAI,WAAW,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,GAAG;EAC5D,IAAI,eAAe,UAAU;GAC3B,MAAM,OAAO,cAAc,KAAK;GAChC,IAAI,SAAS,KAAA,GAAW,IAAI,SAAS;GACrC;EACF;EACA,IAAI,OAAO;CACb,CAAC;CACD,IAAI,OAAO,WAAW,MAAM,MAAM,IAAI;CACtC,IAAI,uBAAuB,MAAM;CACjC,IAAI,MAAM,kBAAkB,KAAA,GAAW,IAAI,sBAAsB,MAAM;CAGvE,IAAI,wBAAwB,GAAG,mBAAmB,MAAM;CACxD,OAAO;AACT;;AAGA,SAAS,gBAAgB,OAAe,MAAsB;CAC5D,MAAM,QAAQ,GAAG,mBAAmB;CACpC,IAAI,CAAC,MAAM,WAAW,GAAG,KAAK,MAAM,WAAW,IAAI,KAAK,MAAM,WAAW,GAAG,MAAM,EAAE,GAAG,OAAO;CAC9F,OAAO,GAAG,QAAQ;AACpB;;;;;;;;;AAUA,SAAS,iBAAiB,OAAe,MAAsB;CAC7D,MAAM,QAAQ,GAAG,mBAAmB,KAAK;CACzC,OAAO,MAAM,WAAW,wBAAwB,QAAQ,YAAoB;EAC1E,MAAM,UAAU,QAAQ,KAAK;EAC7B,IAAI,QAAQ,WAAW,KAAK,GAAG,OAAO,UAAU;EAChD,MAAM,SAAS,YAAY,OAAO,YAAY,KAAK,KAAK,QAAQ,QAAQ,QAAQ,EAAE;EAClF,OAAO,UAAU,QAAQ;CAC3B,CAAC;AACH;AAEA,SAAS,gBAAgB,UAAgC,MAAuB;CAC9E,MAAM,UAAU,IAAI,QAAQ;CAC5B,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,SAAS,OAAO,GAAG;EAC3D,MAAM,aAAa,IAAI,YAAY;EACnC,IAAI,UAAU,KAAA,KAAa,WAAW,IAAI,UAAU,GAAG;EACvD,IAAI,eAAe,cAAc;GAG/B,KAAK,MAAM,UAAU,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK,GACxD,QAAQ,OAAO,cAAc,iBAAiB,QAAQ,IAAI,CAAC;GAE7D;EACF;EACA,MAAM,SAAS,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,IAAI,IAAI;EACzD,QAAQ,IAAI,KAAK,eAAe,aAAa,gBAAgB,QAAQ,IAAI,IAAI,MAAM;CACrF;CACA,OAAO;AACT;;;;;;;;AASA,eAAsB,mBAAmB,OAAwC;CAC/E,MAAM,OAAO,MAAM,YAAY,MAAM,IAAI;CACzC,OAAO,IAAI,SAAmB,SAAS,WAAW;EAChD,MAAM,UAAU,KAAK,QACnB;GACE;GACA,MAAM,MAAM;GACZ,MAAM,MAAM;GACZ,QAAQ,MAAM;GACd,SAAS,gBAAgB,OAAO,IAAI;GACpC,QAAQ,MAAM;EAChB,IACC,aAAa;GACZ,MAAM,SAAS,SAAS,cAAc;GAEtC,MAAM,OAAO,iBAAiB,IAAI,MAAM,IAAI,OAAQ,SAAS,MAAM,QAAQ;GAC3E,QAAQ,IAAI,SAAS,MAAM;IAAE;IAAQ,SAAS,gBAAgB,UAAU,MAAM,IAAI;GAAE,CAAC,CAAC;EACxF,CACF;EACA,QAAQ,KAAK,SAAS,MAAM;EAC5B,IAAI,MAAM,SAAS,MAAM;GACvB,QAAQ,IAAI;GACZ;EACF;EACA,SAAS,QAAQ,MAAM,IAA8C,CAAC,CACnE,GAAG,SAAS,MAAM,CAAC,CACnB,KAAK,OAAO;CACjB,CAAC;AACH"}

package/dist/src/server/devProxyRoutes.cjs

@@ -0,0 +1,97 @@
+const require_remote = require("../constants/remote.cjs");
+const require_index = require("../services/devProxyPolicy/index.cjs");
+const require_devProxyForward = require("./devProxyForward.cjs");
+//#region src/server/devProxyRoutes.ts
+/**
+* The dev proxy's control plane and its HTTP forwarding route.
+*
+* Registering a target is refused anywhere but the host, and that refusal is the entire consent
+* model: putting a local port on the public internet is decided by someone sitting at the machine.
+* A passkey gesture cannot carry it, because a quick tunnel's rotating hostname has no relying party.
+* Using a registered target is then open to any paired device, which is what makes the feature
+* usable away from the desk; a stolen phone reaches only the ports its owner chose to name.
+*/
+const BAD_REQUEST = 400;
+const FORBIDDEN = 403;
+const NOT_FOUND = 404;
+const CREATED = 201;
+const NO_CONTENT = 204;
+const MOVED_PERMANENTLY = 301;
+const BAD_GATEWAY = 502;
+const CONNECTION_REFUSED = "ECONNREFUSED";
+/** The scheme the browser used, trusting the edge's header only for its own hop. */
+function forwardedProto(context, listener) {
+	const declared = context.req.header("x-forwarded-proto");
+	if (declared === "https" || declared === "http") return declared;
+	return listener === "local" ? "http" : "https";
+}
+function describeUpstreamFailure(error, target) {
+	if (error?.code === CONNECTION_REFUSED) return `Nothing is answering on port ${String(target.port)}. Is "${target.name}" running?`;
+	return `The dev server for "${target.name}" did not answer: ${error instanceof Error ? error.message : String(error)}`;
+}
+function registerDevProxyRoutes(app, options) {
+	const { store } = options;
+	const isLocal = (context) => options.listenerOf(context) === "local";
+	app.get(require_remote.DEV_PROXY_TARGETS_ROUTE, (context) => context.json({
+		targets: store.targets(),
+		canRegister: isLocal(context)
+	}));
+	app.post(require_remote.DEV_PROXY_TARGETS_ROUTE, async (context) => {
+		if (!isLocal(context)) return context.json({ error: "A dev proxy target can only be added on the host, not through the tunnel." }, FORBIDDEN);
+		let body;
+		try {
+			body = await context.req.json();
+		} catch {
+			return context.json({ error: "Expected a JSON body with a name and a port." }, BAD_REQUEST);
+		}
+		const name = require_index.validateTargetName(body.name);
+		if (!name.ok) return context.json({ error: name.reason }, BAD_REQUEST);
+		const port = require_index.validateTargetPort(body.port, options.reservedPorts());
+		if (!port.ok) return context.json({ error: port.reason }, BAD_REQUEST);
+		const target = {
+			name: name.name,
+			port: port.port,
+			createdAt: Date.now()
+		};
+		store.save(target);
+		options.onNotice(`dev proxy target "${target.name}" now serves port ${String(target.port)}`);
+		return context.json({ target }, CREATED);
+	});
+	app.delete(`${require_remote.DEV_PROXY_TARGETS_ROUTE}/:name`, (context) => {
+		if (!isLocal(context)) return context.json({ error: "A dev proxy target can only be removed on the host." }, FORBIDDEN);
+		const name = require_index.validateTargetName(context.req.param("name"));
+		if (!name.ok) return context.json({ error: name.reason }, BAD_REQUEST);
+		if (!store.remove(name.name)) return context.json({ error: "No such dev proxy target." }, NOT_FOUND);
+		options.onNotice(`dev proxy target "${name.name}" removed`);
+		return context.body(null, NO_CONTENT);
+	});
+	app.all(`${require_remote.DEV_PROXY_PREFIX}*`, async (context) => {
+		const url = new URL(context.req.url);
+		const parsed = require_index.parseProxyPath(url.pathname);
+		if (parsed.kind === "reject") return context.text(parsed.reason, BAD_REQUEST);
+		if (parsed.kind === "redirect") return context.redirect(parsed.location, MOVED_PERMANENTLY);
+		const target = store.find(parsed.name);
+		if (target === void 0) return context.text(`No dev proxy target named "${parsed.name}".`, NOT_FOUND);
+		try {
+			return await require_devProxyForward.forwardToDevServer({
+				name: target.name,
+				port: target.port,
+				upstreamPath: `${parsed.upstreamPath}${url.search}`,
+				method: context.req.method,
+				headers: context.req.raw.headers,
+				body: context.req.raw.body,
+				forwardedProto: forwardedProto(context, options.listenerOf(context)),
+				forwardedHost: context.req.header("host"),
+				signal: context.req.raw.signal
+			});
+		} catch (error) {
+			const message = describeUpstreamFailure(error, target);
+			options.onNotice(message);
+			return context.text(message, BAD_GATEWAY);
+		}
+	});
+}
+//#endregion
+exports.registerDevProxyRoutes = registerDevProxyRoutes;
+
+//# sourceMappingURL=devProxyRoutes.cjs.map

package/dist/src/server/devProxyRoutes.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"devProxyRoutes.cjs","names":["DEV_PROXY_TARGETS_ROUTE","validateTargetName","validateTargetPort","DEV_PROXY_PREFIX","parseProxyPath","forwardToDevServer"],"sources":["../../../src/server/devProxyRoutes.ts"],"sourcesContent":["import type { Context, Hono } from 'hono';\n\nimport { DEV_PROXY_PREFIX, DEV_PROXY_TARGETS_ROUTE } from '../constants/remote';\nimport { parseProxyPath, validateTargetName, validateTargetPort } from '../services/devProxyPolicy';\nimport type { DevProxyStore } from '../services/devProxyStore';\nimport type { GuardListener } from '../services/remoteGuardPolicy';\nimport type { DevProxyTarget } from '../types/remote';\nimport { forwardToDevServer } from './devProxyForward';\n\n/**\n * The dev proxy's control plane and its HTTP forwarding route.\n *\n * Registering a target is refused anywhere but the host, and that refusal is the entire consent\n * model: putting a local port on the public internet is decided by someone sitting at the machine.\n * A passkey gesture cannot carry it, because a quick tunnel's rotating hostname has no relying party.\n * Using a registered target is then open to any paired device, which is what makes the feature\n * usable away from the desk; a stolen phone reaches only the ports its owner chose to name.\n */\n\nconst BAD_REQUEST = 400;\nconst FORBIDDEN = 403;\nconst NOT_FOUND = 404;\nconst CREATED = 201;\nconst NO_CONTENT = 204;\nconst MOVED_PERMANENTLY = 301;\nconst BAD_GATEWAY = 502;\nconst CONNECTION_REFUSED = 'ECONNREFUSED';\n\nexport interface DevProxyRoutesOptions {\n  store: DevProxyStore;\n  listenerOf: (context: Context) => GuardListener;\n  /** Ports the cockpit itself holds, read per call so a toggled tunnel is never stale. */\n  reservedPorts: () => readonly (number | undefined)[];\n  onNotice: (message: string) => void;\n}\n\ninterface TargetRequestBody {\n  name?: unknown;\n  port?: unknown;\n}\n\n/** The scheme the browser used, trusting the edge's header only for its own hop. */\nfunction forwardedProto(context: Context, listener: GuardListener): string {\n  const declared = context.req.header('x-forwarded-proto');\n  if (declared === 'https' || declared === 'http') return declared;\n  return listener === 'local' ? 'http' : 'https';\n}\n\nfunction describeUpstreamFailure(error: unknown, target: DevProxyTarget): string {\n  const code = (error as { code?: string } | undefined)?.code;\n  if (code === CONNECTION_REFUSED) {\n    return `Nothing is answering on port ${String(target.port)}. Is \"${target.name}\" running?`;\n  }\n  return `The dev server for \"${target.name}\" did not answer: ${error instanceof Error ? error.message : String(error)}`;\n}\n\nexport function registerDevProxyRoutes(app: Hono, options: DevProxyRoutesOptions): void {\n  const { store } = options;\n  const isLocal = (context: Context): boolean => options.listenerOf(context) === 'local';\n\n  app.get(DEV_PROXY_TARGETS_ROUTE, (context) =>\n    context.json({ targets: store.targets(), canRegister: isLocal(context) }),\n  );\n\n  app.post(DEV_PROXY_TARGETS_ROUTE, async (context) => {\n    if (!isLocal(context)) {\n      return context.json(\n        { error: 'A dev proxy target can only be added on the host, not through the tunnel.' },\n        FORBIDDEN,\n      );\n    }\n    let body: TargetRequestBody;\n    try {\n      body = (await context.req.json()) as TargetRequestBody;\n    } catch {\n      return context.json({ error: 'Expected a JSON body with a name and a port.' }, BAD_REQUEST);\n    }\n    const name = validateTargetName(body.name);\n    if (!name.ok) return context.json({ error: name.reason }, BAD_REQUEST);\n    const port = validateTargetPort(body.port, options.reservedPorts());\n    if (!port.ok) return context.json({ error: port.reason }, BAD_REQUEST);\n\n    const target: DevProxyTarget = { name: name.name, port: port.port, createdAt: Date.now() };\n    store.save(target);\n    options.onNotice(`dev proxy target \"${target.name}\" now serves port ${String(target.port)}`);\n    return context.json({ target }, CREATED);\n  });\n\n  app.delete(`${DEV_PROXY_TARGETS_ROUTE}/:name`, (context) => {\n    if (!isLocal(context)) {\n      return context.json({ error: 'A dev proxy target can only be removed on the host.' }, FORBIDDEN);\n    }\n    const name = validateTargetName(context.req.param('name'));\n    if (!name.ok) return context.json({ error: name.reason }, BAD_REQUEST);\n    if (!store.remove(name.name)) return context.json({ error: 'No such dev proxy target.' }, NOT_FOUND);\n    options.onNotice(`dev proxy target \"${name.name}\" removed`);\n    return context.body(null, NO_CONTENT);\n  });\n\n  app.all(`${DEV_PROXY_PREFIX}*`, async (context) => {\n    const url = new URL(context.req.url);\n    const parsed = parseProxyPath(url.pathname);\n    if (parsed.kind === 'reject') return context.text(parsed.reason, BAD_REQUEST);\n    if (parsed.kind === 'redirect') return context.redirect(parsed.location, MOVED_PERMANENTLY);\n\n    const target = store.find(parsed.name);\n    if (target === undefined) return context.text(`No dev proxy target named \"${parsed.name}\".`, NOT_FOUND);\n\n    try {\n      return await forwardToDevServer({\n        name: target.name,\n        port: target.port,\n        upstreamPath: `${parsed.upstreamPath}${url.search}`,\n        method: context.req.method,\n        headers: context.req.raw.headers,\n        body: context.req.raw.body,\n        forwardedProto: forwardedProto(context, options.listenerOf(context)),\n        forwardedHost: context.req.header('host'),\n        signal: context.req.raw.signal,\n      });\n    } catch (error) {\n      const message = describeUpstreamFailure(error, target);\n      options.onNotice(message);\n      return context.text(message, BAD_GATEWAY);\n    }\n  });\n}\n"],"mappings":";;;;;;;;;;;;;AAmBA,MAAM,cAAc;AACpB,MAAM,YAAY;AAClB,MAAM,YAAY;AAClB,MAAM,UAAU;AAChB,MAAM,aAAa;AACnB,MAAM,oBAAoB;AAC1B,MAAM,cAAc;AACpB,MAAM,qBAAqB;;AAgB3B,SAAS,eAAe,SAAkB,UAAiC;CACzE,MAAM,WAAW,QAAQ,IAAI,OAAO,mBAAmB;CACvD,IAAI,aAAa,WAAW,aAAa,QAAQ,OAAO;CACxD,OAAO,aAAa,UAAU,SAAS;AACzC;AAEA,SAAS,wBAAwB,OAAgB,QAAgC;CAE/E,IADc,OAAyC,SAC1C,oBACX,OAAO,gCAAgC,OAAO,OAAO,IAAI,EAAE,QAAQ,OAAO,KAAK;CAEjF,OAAO,uBAAuB,OAAO,KAAK,oBAAoB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrH;AAEA,SAAgB,uBAAuB,KAAW,SAAsC;CACtF,MAAM,EAAE,UAAU;CAClB,MAAM,WAAW,YAA8B,QAAQ,WAAW,OAAO,MAAM;CAE/E,IAAI,IAAIA,eAAAA,0BAA0B,YAChC,QAAQ,KAAK;EAAE,SAAS,MAAM,QAAQ;EAAG,aAAa,QAAQ,OAAO;CAAE,CAAC,CAC1E;CAEA,IAAI,KAAKA,eAAAA,yBAAyB,OAAO,YAAY;EACnD,IAAI,CAAC,QAAQ,OAAO,GAClB,OAAO,QAAQ,KACb,EAAE,OAAO,4EAA4E,GACrF,SACF;EAEF,IAAI;EACJ,IAAI;GACF,OAAQ,MAAM,QAAQ,IAAI,KAAK;EACjC,QAAQ;GACN,OAAO,QAAQ,KAAK,EAAE,OAAO,+CAA+C,GAAG,WAAW;EAC5F;EACA,MAAM,OAAOC,cAAAA,mBAAmB,KAAK,IAAI;EACzC,IAAI,CAAC,KAAK,IAAI,OAAO,QAAQ,KAAK,EAAE,OAAO,KAAK,OAAO,GAAG,WAAW;EACrE,MAAM,OAAOC,cAAAA,mBAAmB,KAAK,MAAM,QAAQ,cAAc,CAAC;EAClE,IAAI,CAAC,KAAK,IAAI,OAAO,QAAQ,KAAK,EAAE,OAAO,KAAK,OAAO,GAAG,WAAW;EAErE,MAAM,SAAyB;GAAE,MAAM,KAAK;GAAM,MAAM,KAAK;GAAM,WAAW,KAAK,IAAI;EAAE;EACzF,MAAM,KAAK,MAAM;EACjB,QAAQ,SAAS,qBAAqB,OAAO,KAAK,oBAAoB,OAAO,OAAO,IAAI,GAAG;EAC3F,OAAO,QAAQ,KAAK,EAAE,OAAO,GAAG,OAAO;CACzC,CAAC;CAED,IAAI,OAAO,GAAGF,eAAAA,wBAAwB,UAAU,YAAY;EAC1D,IAAI,CAAC,QAAQ,OAAO,GAClB,OAAO,QAAQ,KAAK,EAAE,OAAO,sDAAsD,GAAG,SAAS;EAEjG,MAAM,OAAOC,cAAAA,mBAAmB,QAAQ,IAAI,MAAM,MAAM,CAAC;EACzD,IAAI,CAAC,KAAK,IAAI,OAAO,QAAQ,KAAK,EAAE,OAAO,KAAK,OAAO,GAAG,WAAW;EACrE,IAAI,CAAC,MAAM,OAAO,KAAK,IAAI,GAAG,OAAO,QAAQ,KAAK,EAAE,OAAO,4BAA4B,GAAG,SAAS;EACnG,QAAQ,SAAS,qBAAqB,KAAK,KAAK,UAAU;EAC1D,OAAO,QAAQ,KAAK,MAAM,UAAU;CACtC,CAAC;CAED,IAAI,IAAI,GAAGE,eAAAA,iBAAiB,IAAI,OAAO,YAAY;EACjD,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI,GAAG;EACnC,MAAM,SAASC,cAAAA,eAAe,IAAI,QAAQ;EAC1C,IAAI,OAAO,SAAS,UAAU,OAAO,QAAQ,KAAK,OAAO,QAAQ,WAAW;EAC5E,IAAI,OAAO,SAAS,YAAY,OAAO,QAAQ,SAAS,OAAO,UAAU,iBAAiB;EAE1F,MAAM,SAAS,MAAM,KAAK,OAAO,IAAI;EACrC,IAAI,WAAW,KAAA,GAAW,OAAO,QAAQ,KAAK,8BAA8B,OAAO,KAAK,KAAK,SAAS;EAEtG,IAAI;GACF,OAAO,MAAMC,wBAAAA,mBAAmB;IAC9B,MAAM,OAAO;IACb,MAAM,OAAO;IACb,cAAc,GAAG,OAAO,eAAe,IAAI;IAC3C,QAAQ,QAAQ,IAAI;IACpB,SAAS,QAAQ,IAAI,IAAI;IACzB,MAAM,QAAQ,IAAI,IAAI;IACtB,gBAAgB,eAAe,SAAS,QAAQ,WAAW,OAAO,CAAC;IACnE,eAAe,QAAQ,IAAI,OAAO,MAAM;IACxC,QAAQ,QAAQ,IAAI,IAAI;GAC1B,CAAC;EACH,SAAS,OAAO;GACd,MAAM,UAAU,wBAAwB,OAAO,MAAM;GACrD,QAAQ,SAAS,OAAO;GACxB,OAAO,QAAQ,KAAK,SAAS,WAAW;EAC1C;CACF,CAAC;AACH"}

package/dist/src/server/devProxyRoutes.mjs

@@ -0,0 +1,97 @@
+import { DEV_PROXY_PREFIX, DEV_PROXY_TARGETS_ROUTE } from "../constants/remote.mjs";
+import { parseProxyPath, validateTargetName, validateTargetPort } from "../services/devProxyPolicy/index.mjs";
+import { forwardToDevServer } from "./devProxyForward.mjs";
+//#region src/server/devProxyRoutes.ts
+/**
+* The dev proxy's control plane and its HTTP forwarding route.
+*
+* Registering a target is refused anywhere but the host, and that refusal is the entire consent
+* model: putting a local port on the public internet is decided by someone sitting at the machine.
+* A passkey gesture cannot carry it, because a quick tunnel's rotating hostname has no relying party.
+* Using a registered target is then open to any paired device, which is what makes the feature
+* usable away from the desk; a stolen phone reaches only the ports its owner chose to name.
+*/
+const BAD_REQUEST = 400;
+const FORBIDDEN = 403;
+const NOT_FOUND = 404;
+const CREATED = 201;
+const NO_CONTENT = 204;
+const MOVED_PERMANENTLY = 301;
+const BAD_GATEWAY = 502;
+const CONNECTION_REFUSED = "ECONNREFUSED";
+/** The scheme the browser used, trusting the edge's header only for its own hop. */
+function forwardedProto(context, listener) {
+	const declared = context.req.header("x-forwarded-proto");
+	if (declared === "https" || declared === "http") return declared;
+	return listener === "local" ? "http" : "https";
+}
+function describeUpstreamFailure(error, target) {
+	if (error?.code === CONNECTION_REFUSED) return `Nothing is answering on port ${String(target.port)}. Is "${target.name}" running?`;
+	return `The dev server for "${target.name}" did not answer: ${error instanceof Error ? error.message : String(error)}`;
+}
+function registerDevProxyRoutes(app, options) {
+	const { store } = options;
+	const isLocal = (context) => options.listenerOf(context) === "local";
+	app.get(DEV_PROXY_TARGETS_ROUTE, (context) => context.json({
+		targets: store.targets(),
+		canRegister: isLocal(context)
+	}));
+	app.post(DEV_PROXY_TARGETS_ROUTE, async (context) => {
+		if (!isLocal(context)) return context.json({ error: "A dev proxy target can only be added on the host, not through the tunnel." }, FORBIDDEN);
+		let body;
+		try {
+			body = await context.req.json();
+		} catch {
+			return context.json({ error: "Expected a JSON body with a name and a port." }, BAD_REQUEST);
+		}
+		const name = validateTargetName(body.name);
+		if (!name.ok) return context.json({ error: name.reason }, BAD_REQUEST);
+		const port = validateTargetPort(body.port, options.reservedPorts());
+		if (!port.ok) return context.json({ error: port.reason }, BAD_REQUEST);
+		const target = {
+			name: name.name,
+			port: port.port,
+			createdAt: Date.now()
+		};
+		store.save(target);
+		options.onNotice(`dev proxy target "${target.name}" now serves port ${String(target.port)}`);
+		return context.json({ target }, CREATED);
+	});
+	app.delete(`${DEV_PROXY_TARGETS_ROUTE}/:name`, (context) => {
+		if (!isLocal(context)) return context.json({ error: "A dev proxy target can only be removed on the host." }, FORBIDDEN);
+		const name = validateTargetName(context.req.param("name"));
+		if (!name.ok) return context.json({ error: name.reason }, BAD_REQUEST);
+		if (!store.remove(name.name)) return context.json({ error: "No such dev proxy target." }, NOT_FOUND);
+		options.onNotice(`dev proxy target "${name.name}" removed`);
+		return context.body(null, NO_CONTENT);
+	});
+	app.all(`${DEV_PROXY_PREFIX}*`, async (context) => {
+		const url = new URL(context.req.url);
+		const parsed = parseProxyPath(url.pathname);
+		if (parsed.kind === "reject") return context.text(parsed.reason, BAD_REQUEST);
+		if (parsed.kind === "redirect") return context.redirect(parsed.location, MOVED_PERMANENTLY);
+		const target = store.find(parsed.name);
+		if (target === void 0) return context.text(`No dev proxy target named "${parsed.name}".`, NOT_FOUND);
+		try {
+			return await forwardToDevServer({
+				name: target.name,
+				port: target.port,
+				upstreamPath: `${parsed.upstreamPath}${url.search}`,
+				method: context.req.method,
+				headers: context.req.raw.headers,
+				body: context.req.raw.body,
+				forwardedProto: forwardedProto(context, options.listenerOf(context)),
+				forwardedHost: context.req.header("host"),
+				signal: context.req.raw.signal
+			});
+		} catch (error) {
+			const message = describeUpstreamFailure(error, target);
+			options.onNotice(message);
+			return context.text(message, BAD_GATEWAY);
+		}
+	});
+}
+//#endregion
+export { registerDevProxyRoutes };
+
+//# sourceMappingURL=devProxyRoutes.mjs.map

package/dist/src/server/devProxyRoutes.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"devProxyRoutes.mjs","names":[],"sources":["../../../src/server/devProxyRoutes.ts"],"sourcesContent":["import type { Context, Hono } from 'hono';\n\nimport { DEV_PROXY_PREFIX, DEV_PROXY_TARGETS_ROUTE } from '../constants/remote';\nimport { parseProxyPath, validateTargetName, validateTargetPort } from '../services/devProxyPolicy';\nimport type { DevProxyStore } from '../services/devProxyStore';\nimport type { GuardListener } from '../services/remoteGuardPolicy';\nimport type { DevProxyTarget } from '../types/remote';\nimport { forwardToDevServer } from './devProxyForward';\n\n/**\n * The dev proxy's control plane and its HTTP forwarding route.\n *\n * Registering a target is refused anywhere but the host, and that refusal is the entire consent\n * model: putting a local port on the public internet is decided by someone sitting at the machine.\n * A passkey gesture cannot carry it, because a quick tunnel's rotating hostname has no relying party.\n * Using a registered target is then open to any paired device, which is what makes the feature\n * usable away from the desk; a stolen phone reaches only the ports its owner chose to name.\n */\n\nconst BAD_REQUEST = 400;\nconst FORBIDDEN = 403;\nconst NOT_FOUND = 404;\nconst CREATED = 201;\nconst NO_CONTENT = 204;\nconst MOVED_PERMANENTLY = 301;\nconst BAD_GATEWAY = 502;\nconst CONNECTION_REFUSED = 'ECONNREFUSED';\n\nexport interface DevProxyRoutesOptions {\n  store: DevProxyStore;\n  listenerOf: (context: Context) => GuardListener;\n  /** Ports the cockpit itself holds, read per call so a toggled tunnel is never stale. */\n  reservedPorts: () => readonly (number | undefined)[];\n  onNotice: (message: string) => void;\n}\n\ninterface TargetRequestBody {\n  name?: unknown;\n  port?: unknown;\n}\n\n/** The scheme the browser used, trusting the edge's header only for its own hop. */\nfunction forwardedProto(context: Context, listener: GuardListener): string {\n  const declared = context.req.header('x-forwarded-proto');\n  if (declared === 'https' || declared === 'http') return declared;\n  return listener === 'local' ? 'http' : 'https';\n}\n\nfunction describeUpstreamFailure(error: unknown, target: DevProxyTarget): string {\n  const code = (error as { code?: string } | undefined)?.code;\n  if (code === CONNECTION_REFUSED) {\n    return `Nothing is answering on port ${String(target.port)}. Is \"${target.name}\" running?`;\n  }\n  return `The dev server for \"${target.name}\" did not answer: ${error instanceof Error ? error.message : String(error)}`;\n}\n\nexport function registerDevProxyRoutes(app: Hono, options: DevProxyRoutesOptions): void {\n  const { store } = options;\n  const isLocal = (context: Context): boolean => options.listenerOf(context) === 'local';\n\n  app.get(DEV_PROXY_TARGETS_ROUTE, (context) =>\n    context.json({ targets: store.targets(), canRegister: isLocal(context) }),\n  );\n\n  app.post(DEV_PROXY_TARGETS_ROUTE, async (context) => {\n    if (!isLocal(context)) {\n      return context.json(\n        { error: 'A dev proxy target can only be added on the host, not through the tunnel.' },\n        FORBIDDEN,\n      );\n    }\n    let body: TargetRequestBody;\n    try {\n      body = (await context.req.json()) as TargetRequestBody;\n    } catch {\n      return context.json({ error: 'Expected a JSON body with a name and a port.' }, BAD_REQUEST);\n    }\n    const name = validateTargetName(body.name);\n    if (!name.ok) return context.json({ error: name.reason }, BAD_REQUEST);\n    const port = validateTargetPort(body.port, options.reservedPorts());\n    if (!port.ok) return context.json({ error: port.reason }, BAD_REQUEST);\n\n    const target: DevProxyTarget = { name: name.name, port: port.port, createdAt: Date.now() };\n    store.save(target);\n    options.onNotice(`dev proxy target \"${target.name}\" now serves port ${String(target.port)}`);\n    return context.json({ target }, CREATED);\n  });\n\n  app.delete(`${DEV_PROXY_TARGETS_ROUTE}/:name`, (context) => {\n    if (!isLocal(context)) {\n      return context.json({ error: 'A dev proxy target can only be removed on the host.' }, FORBIDDEN);\n    }\n    const name = validateTargetName(context.req.param('name'));\n    if (!name.ok) return context.json({ error: name.reason }, BAD_REQUEST);\n    if (!store.remove(name.name)) return context.json({ error: 'No such dev proxy target.' }, NOT_FOUND);\n    options.onNotice(`dev proxy target \"${name.name}\" removed`);\n    return context.body(null, NO_CONTENT);\n  });\n\n  app.all(`${DEV_PROXY_PREFIX}*`, async (context) => {\n    const url = new URL(context.req.url);\n    const parsed = parseProxyPath(url.pathname);\n    if (parsed.kind === 'reject') return context.text(parsed.reason, BAD_REQUEST);\n    if (parsed.kind === 'redirect') return context.redirect(parsed.location, MOVED_PERMANENTLY);\n\n    const target = store.find(parsed.name);\n    if (target === undefined) return context.text(`No dev proxy target named \"${parsed.name}\".`, NOT_FOUND);\n\n    try {\n      return await forwardToDevServer({\n        name: target.name,\n        port: target.port,\n        upstreamPath: `${parsed.upstreamPath}${url.search}`,\n        method: context.req.method,\n        headers: context.req.raw.headers,\n        body: context.req.raw.body,\n        forwardedProto: forwardedProto(context, options.listenerOf(context)),\n        forwardedHost: context.req.header('host'),\n        signal: context.req.raw.signal,\n      });\n    } catch (error) {\n      const message = describeUpstreamFailure(error, target);\n      options.onNotice(message);\n      return context.text(message, BAD_GATEWAY);\n    }\n  });\n}\n"],"mappings":";;;;;;;;;;;;;AAmBA,MAAM,cAAc;AACpB,MAAM,YAAY;AAClB,MAAM,YAAY;AAClB,MAAM,UAAU;AAChB,MAAM,aAAa;AACnB,MAAM,oBAAoB;AAC1B,MAAM,cAAc;AACpB,MAAM,qBAAqB;;AAgB3B,SAAS,eAAe,SAAkB,UAAiC;CACzE,MAAM,WAAW,QAAQ,IAAI,OAAO,mBAAmB;CACvD,IAAI,aAAa,WAAW,aAAa,QAAQ,OAAO;CACxD,OAAO,aAAa,UAAU,SAAS;AACzC;AAEA,SAAS,wBAAwB,OAAgB,QAAgC;CAE/E,IADc,OAAyC,SAC1C,oBACX,OAAO,gCAAgC,OAAO,OAAO,IAAI,EAAE,QAAQ,OAAO,KAAK;CAEjF,OAAO,uBAAuB,OAAO,KAAK,oBAAoB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrH;AAEA,SAAgB,uBAAuB,KAAW,SAAsC;CACtF,MAAM,EAAE,UAAU;CAClB,MAAM,WAAW,YAA8B,QAAQ,WAAW,OAAO,MAAM;CAE/E,IAAI,IAAI,0BAA0B,YAChC,QAAQ,KAAK;EAAE,SAAS,MAAM,QAAQ;EAAG,aAAa,QAAQ,OAAO;CAAE,CAAC,CAC1E;CAEA,IAAI,KAAK,yBAAyB,OAAO,YAAY;EACnD,IAAI,CAAC,QAAQ,OAAO,GAClB,OAAO,QAAQ,KACb,EAAE,OAAO,4EAA4E,GACrF,SACF;EAEF,IAAI;EACJ,IAAI;GACF,OAAQ,MAAM,QAAQ,IAAI,KAAK;EACjC,QAAQ;GACN,OAAO,QAAQ,KAAK,EAAE,OAAO,+CAA+C,GAAG,WAAW;EAC5F;EACA,MAAM,OAAO,mBAAmB,KAAK,IAAI;EACzC,IAAI,CAAC,KAAK,IAAI,OAAO,QAAQ,KAAK,EAAE,OAAO,KAAK,OAAO,GAAG,WAAW;EACrE,MAAM,OAAO,mBAAmB,KAAK,MAAM,QAAQ,cAAc,CAAC;EAClE,IAAI,CAAC,KAAK,IAAI,OAAO,QAAQ,KAAK,EAAE,OAAO,KAAK,OAAO,GAAG,WAAW;EAErE,MAAM,SAAyB;GAAE,MAAM,KAAK;GAAM,MAAM,KAAK;GAAM,WAAW,KAAK,IAAI;EAAE;EACzF,MAAM,KAAK,MAAM;EACjB,QAAQ,SAAS,qBAAqB,OAAO,KAAK,oBAAoB,OAAO,OAAO,IAAI,GAAG;EAC3F,OAAO,QAAQ,KAAK,EAAE,OAAO,GAAG,OAAO;CACzC,CAAC;CAED,IAAI,OAAO,GAAG,wBAAwB,UAAU,YAAY;EAC1D,IAAI,CAAC,QAAQ,OAAO,GAClB,OAAO,QAAQ,KAAK,EAAE,OAAO,sDAAsD,GAAG,SAAS;EAEjG,MAAM,OAAO,mBAAmB,QAAQ,IAAI,MAAM,MAAM,CAAC;EACzD,IAAI,CAAC,KAAK,IAAI,OAAO,QAAQ,KAAK,EAAE,OAAO,KAAK,OAAO,GAAG,WAAW;EACrE,IAAI,CAAC,MAAM,OAAO,KAAK,IAAI,GAAG,OAAO,QAAQ,KAAK,EAAE,OAAO,4BAA4B,GAAG,SAAS;EACnG,QAAQ,SAAS,qBAAqB,KAAK,KAAK,UAAU;EAC1D,OAAO,QAAQ,KAAK,MAAM,UAAU;CACtC,CAAC;CAED,IAAI,IAAI,GAAG,iBAAiB,IAAI,OAAO,YAAY;EACjD,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI,GAAG;EACnC,MAAM,SAAS,eAAe,IAAI,QAAQ;EAC1C,IAAI,OAAO,SAAS,UAAU,OAAO,QAAQ,KAAK,OAAO,QAAQ,WAAW;EAC5E,IAAI,OAAO,SAAS,YAAY,OAAO,QAAQ,SAAS,OAAO,UAAU,iBAAiB;EAE1F,MAAM,SAAS,MAAM,KAAK,OAAO,IAAI;EACrC,IAAI,WAAW,KAAA,GAAW,OAAO,QAAQ,KAAK,8BAA8B,OAAO,KAAK,KAAK,SAAS;EAEtG,IAAI;GACF,OAAO,MAAM,mBAAmB;IAC9B,MAAM,OAAO;IACb,MAAM,OAAO;IACb,cAAc,GAAG,OAAO,eAAe,IAAI;IAC3C,QAAQ,QAAQ,IAAI;IACpB,SAAS,QAAQ,IAAI,IAAI;IACzB,MAAM,QAAQ,IAAI,IAAI;IACtB,gBAAgB,eAAe,SAAS,QAAQ,WAAW,OAAO,CAAC;IACnE,eAAe,QAAQ,IAAI,OAAO,MAAM;IACxC,QAAQ,QAAQ,IAAI,IAAI;GAC1B,CAAC;EACH,SAAS,OAAO;GACd,MAAM,UAAU,wBAAwB,OAAO,MAAM;GACrD,QAAQ,SAAS,OAAO;GACxB,OAAO,QAAQ,KAAK,SAAS,WAAW;EAC1C;CACF,CAAC;AACH"}

package/dist/src/server/devProxySocket.cjs

@@ -0,0 +1,87 @@
+const require_index = require("../services/loopbackAddress/index.cjs");
+let ws = require("ws");
+//#region src/server/devProxySocket.ts
+/**
+* A WebSocket carried between a paired device and a local dev server.
+*
+* This is what carries hot module reload. Vite negotiates the `vite-hmr` subprotocol, so the
+* handshake's protocol list is forwarded rather than dropped; without it the dev client connects
+* and then gives up. The tunnel listener has already authorized the handshake, so this only
+* relays frames.
+*/
+/** Sent when the upstream never came up, or died in a way with no code to relay. */
+const INTERNAL_ERROR = 1011;
+const NORMAL_CLOSURE = 1e3;
+/** Reserved codes a peer may observe but no endpoint may transmit. */
+const UNSENDABLE_CLOSE_CODES = /* @__PURE__ */ new Set([
+	1005,
+	1006,
+	1015
+]);
+const MAX_CLOSE_REASON = 120;
+/** Frames held while the upstream connects; a dev client that speaks first must not lose them. */
+const MAX_PENDING_BYTES = 1048576;
+/** A code the upstream reported that this endpoint is actually allowed to send on. */
+function sendableCode(code) {
+	return code === 0 || UNSENDABLE_CLOSE_CODES.has(code) ? NORMAL_CLOSURE : code;
+}
+function frameBytes(data) {
+	if (Array.isArray(data)) return Buffer.concat(data);
+	return Buffer.isBuffer(data) ? data : Buffer.from(new Uint8Array(data));
+}
+/** Relays one accepted browser socket to the dev server on the target's port until either side closes. */
+function relayDevProxySocket(client, input) {
+	let upstream;
+	let pending = [];
+	let pendingBytes = 0;
+	let closed = false;
+	const closeBoth = (code, reason) => {
+		if (closed) return;
+		closed = true;
+		pending = [];
+		if (client.readyState === ws.WebSocket.OPEN) client.close(code, reason.slice(0, MAX_CLOSE_REASON));
+		upstream?.close();
+	};
+	client.on("message", (data, binary) => {
+		if (closed) return;
+		const bytes = frameBytes(data);
+		if (upstream?.readyState === ws.WebSocket.OPEN) {
+			upstream.send(binary ? bytes : bytes.toString("utf8"));
+			return;
+		}
+		pendingBytes += bytes.byteLength;
+		if (pendingBytes > MAX_PENDING_BYTES) closeBoth(INTERNAL_ERROR, "dev server socket did not open");
+		else pending.push({
+			data: bytes,
+			binary
+		});
+	});
+	client.on("close", () => closeBoth(NORMAL_CLOSURE, ""));
+	client.on("error", () => closeBoth(INTERNAL_ERROR, "browser socket failed"));
+	const protocols = input.protocols?.split(",").map((entry) => entry.trim()).filter((entry) => entry !== "");
+	require_index.loopbackFor(input.port).then((host) => {
+		if (closed) return;
+		const target = `ws://${host.includes(":") ? `[${host}]` : host}:${String(input.port)}${input.upstreamPath}`;
+		const socket = protocols === void 0 || protocols.length === 0 ? new ws.WebSocket(target) : new ws.WebSocket(target, protocols);
+		upstream = socket;
+		socket.on("open", () => {
+			for (const frame of pending) socket.send(frame.binary ? frame.data : frame.data.toString("utf8"));
+			pending = [];
+			pendingBytes = 0;
+		});
+		socket.on("message", (data, binary) => {
+			if (closed || client.readyState !== ws.WebSocket.OPEN) return;
+			const bytes = frameBytes(data);
+			client.send(binary ? bytes : bytes.toString("utf8"));
+		});
+		socket.on("close", (code, reason) => closeBoth(sendableCode(code), reason.toString()));
+		socket.on("error", (error) => {
+			input.onNotice?.(`dev proxy socket to port ${String(input.port)} failed: ${error.message}`);
+			closeBoth(INTERNAL_ERROR, "dev server socket failed");
+		});
+	});
+}
+//#endregion
+exports.relayDevProxySocket = relayDevProxySocket;
+
+//# sourceMappingURL=devProxySocket.cjs.map