@blakearoberts/visage 0.0.1-rc.6 → 0.0.1-rc.8

package/README.md

@@ -125,7 +125,7 @@ Do not treat the managed Dex and OAuth2 Proxy defaults as production auth infras
 - If startup fails immediately, confirm Docker is running and `docker compose` works.
 - If NGINX cannot start, check whether the configured `port` is already in use.
 - If the hostname cannot be resolved, Visage may need permission to update `/etc/hosts`.
-- If the browser rejects the certificate, allow the local certificate authority prompt from `mkcert`.
+- If the browser rejects the certificate, allow the local certificate authority prompt from `mkcert`; CI test runners should be configured to ignore local HTTPS errors.
 
 ## TO-DO
 

package/dist/certs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"certs.d.ts","sourceRoot":"","sources":["../src/certs.ts"],"names":[],"mappings":"AAOA,KAAK,OAAO,GAAG;IACb,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,wBAAsB,WAAW,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAuC7E"}
+{"version":3,"file":"certs.d.ts","sourceRoot":"","sources":["../src/certs.ts"],"names":[],"mappings":"AAcA,KAAK,OAAO,GAAG;IACb,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAIF,wBAAsB,WAAW,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CA0C7E"}

package/dist/compose.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compose.d.ts","sourceRoot":"","sources":["../src/compose.ts"],"names":[],"mappings":"AAGA,KAAK,WAAW,GAAG,MAAM,IAAI,CAAC;AAI9B,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAoBtD"}
+{"version":3,"file":"compose.d.ts","sourceRoot":"","sources":["../src/compose.ts"],"names":[],"mappings":"AAIA,KAAK,WAAW,GAAG,MAAM,IAAI,CAAC;AAI9B,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAwCtD"}

package/dist/config.d.ts

@@ -1,5 +1,5 @@
 import type { ResolvedConfig } from 'vite';
-import type { VisageDexExpiry, VisageDexOptions, VisageDexUser, VisageExternalIdpOptions, VisageOptions, VisageService, VisageUpstream } from './types';
+import type { VisageDexExpiry, VisageDexOptions, VisageDexUser, VisageExternalIdpOptions, VisageOptions, VisageProxyPolicy, VisageService, VisageUpstream } from './types';
 type Volume = readonly [from: string, to: string];
 type ResolvedCookiePolicy = {
     readonly cookie_name: string;
@@ -17,20 +17,14 @@ type ResolvedOAuth2Client = {
     readonly scopes: readonly string[];
     readonly public: boolean;
 };
-type ResolvedService = Omit<VisageService, 'upstream'>;
-type ResolvedUpstream = Omit<VisageUpstream, 'host' | 'port' | 'scheme'> & {
-    readonly host: string;
-    readonly port: number;
-    readonly scheme: 'http' | 'https';
-};
 type ResolvedVisageOptions = {
     readonly host: string;
     readonly port: number;
     readonly cookie: ResolvedCookiePolicy;
     readonly idp: ResolvedIdpOption;
     readonly oauth2: ResolvedOAuth2Client;
-    readonly services: Readonly<Record<string, ResolvedService>>;
-    readonly upstreams?: Record<string, ResolvedUpstream>;
+    readonly services: Readonly<Record<string, VisageService>>;
+    readonly upstreams: Record<string, VisageUpstream>;
 };
 type ResolvedBaseIdpConfig = {
     readonly upstream: string;
@@ -49,6 +43,20 @@ type ResolvedExternalIdpConfig = ResolvedBaseIdpConfig & {
     readonly dex?: never;
 };
 type ResolvedIdpConfig = ResolvedDexIdpConfig | ResolvedExternalIdpConfig;
+type ResolvedService = Omit<VisageService, 'upstream'>;
+type ResolvedUpstream = {
+    readonly scheme: 'http' | 'https';
+    readonly host: string;
+    readonly port: number;
+    readonly locations: Readonly<Record<string, VisageProxyPolicy>>;
+};
+type ResolvedProxyPolicy = {
+    readonly auth: Required<VisageProxyPolicy['auth']>;
+    readonly headers: VisageProxyPolicy['headers'];
+};
+type ResolvedConfigUpstream = Omit<ResolvedUpstream, 'locations'> & {
+    readonly locations: Readonly<Record<string, ResolvedProxyPolicy>>;
+};
 export type VisageConfig = {
     readonly host: string;
     readonly port: number;
@@ -65,7 +73,7 @@ export type VisageConfig = {
         readonly oauth2ProxyClientSecret: Volume;
     };
     readonly services: Readonly<Record<string, ResolvedService>>;
-    readonly upstreams: Readonly<Record<string, ResolvedUpstream>>;
+    readonly upstreams: Readonly<Record<string, ResolvedConfigUpstream>>;
 };
 export declare function resolveOptions(options: VisageOptions): ResolvedVisageOptions;
 export declare function resolveConfig(options: ResolvedVisageOptions, config: ResolvedConfig, vitePort: number): VisageConfig;

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,MAAM,CAAC;AAE3C,OAAO,KAAK,EACV,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,wBAAwB,EACxB,aAAa,EAEb,aAAa,EACb,cAAc,EACf,MAAM,SAAS,CAAC;AAEjB,KAAK,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AAElD,KAAK,oBAAoB,GAAG;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,KAAK,iBAAiB,GAClB;IACE,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC;CAChC,GACD,wBAAwB,CAAC;AAE7B,KAAK,oBAAoB,GAAG;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF,KAAK,eAAe,GAAG,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;AAEvD,KAAK,gBAAgB,GAAG,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,GAAG,QAAQ,CAAC,GAAG;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;CACnC,CAAC;AAEF,KAAK,qBAAqB,GAAG;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,iBAAiB,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;IAC7D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CACvD,CAAC;AAEF,KAAK,qBAAqB,GAAG;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;AACF,KAAK,oBAAoB,GAAG,qBAAqB,GAAG;IAClD,QAAQ,CAAC,GAAG,EAAE;QACZ,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;QAClC,QAAQ,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,CAAC;KAC1C,CAAC;CACH,CAAC;AACF,KAAK,yBAAyB,GAAG,qBAAqB,GAAG;IACvD,QAAQ,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;CACtB,CAAC;AACF,KAAK,iBAAiB,GAAG,oBAAoB,GAAG,yBAAyB,CAAC;AAE1E,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,iBAAiB,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IAEtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;KAC1C,CAAC;IAEF,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;IAC7D,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC;CAChE,CAAC;AA2GF,wBAAgB,cAAc,CAAC,OAAO,EAAE,aAAa,GAAG,qBAAqB,CAmE5E;AAqHD,wBAAgB,aAAa,CAC3B,OAAO,EAAE,qBAAqB,EAC9B,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,MAAM,GACf,YAAY,CAsDd"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,MAAM,CAAC;AAE3C,OAAO,KAAK,EACV,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,wBAAwB,EACxB,aAAa,EACb,iBAAiB,EACjB,aAAa,EACb,cAAc,EACf,MAAM,SAAS,CAAC;AAEjB,KAAK,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AAElD,KAAK,oBAAoB,GAAG;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,KAAK,iBAAiB,GAClB;IACE,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC;CAChC,GACD,wBAAwB,CAAC;AAE7B,KAAK,oBAAoB,GAAG;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF,KAAK,qBAAqB,GAAG;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,iBAAiB,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;IAC3D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CACpD,CAAC;AAEF,KAAK,qBAAqB,GAAG;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;AACF,KAAK,oBAAoB,GAAG,qBAAqB,GAAG;IAClD,QAAQ,CAAC,GAAG,EAAE;QACZ,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;QAClC,QAAQ,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,CAAC;KAC1C,CAAC;CACH,CAAC;AACF,KAAK,yBAAyB,GAAG,qBAAqB,GAAG;IACvD,QAAQ,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;CACtB,CAAC;AACF,KAAK,iBAAiB,GAAG,oBAAoB,GAAG,yBAAyB,CAAC;AAE1E,KAAK,eAAe,GAAG,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;AAEvD,KAAK,gBAAgB,GAAG;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC;CACjE,CAAC;AAEF,KAAK,mBAAmB,GAAG;IACzB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;IACnD,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;CAChD,CAAC;AAEF,KAAK,sBAAsB,GAAG,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,GAAG;IAClE,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;CACnE,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,iBAAiB,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IAEtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;KAC1C,CAAC;IAEF,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;IAC7D,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC,CAAC;CACtE,CAAC;AAuGF,wBAAgB,cAAc,CAAC,OAAO,EAAE,aAAa,GAAG,qBAAqB,CAsC5E;AA6ID,wBAAgB,aAAa,CAC3B,OAAO,EAAE,qBAAqB,EAC9B,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,MAAM,GACf,YAAY,CAoEd"}

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAOnC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7C,YAAY,EACV,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,wBAAwB,EACxB,kBAAkB,EAClB,aAAa,EACb,iBAAiB,EACjB,aAAa,EACb,cAAc,GACf,MAAM,SAAS,CAAC;AAEjB,wBAAgB,MAAM,CAAC,OAAO,GAAE,aAAkB,GAAG,MAAM,CAkD1D;AAED,eAAe,MAAM,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAOnC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAG7C,YAAY,EACV,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,wBAAwB,EACxB,kBAAkB,EAClB,aAAa,EACb,iBAAiB,EACjB,aAAa,EACb,cAAc,GACf,MAAM,SAAS,CAAC;AAUjB,wBAAgB,MAAM,CAAC,OAAO,GAAE,aAAkB,GAAG,MAAM,CAgE1D;AAED,eAAe,MAAM,CAAC"}

package/dist/index.js

@@ -1,6 +1,6 @@
-import { dirname, join } from 'node:path';
-import { spawnSync } from 'node:child_process';
-import { existsSync, mkdirSync, chmodSync, createWriteStream, readFileSync, appendFileSync, writeFileSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { spawn, spawnSync } from 'node:child_process';
+import { mkdirSync, openSync, chmodSync, rmSync, existsSync, createWriteStream, readFileSync, appendFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { Readable } from 'node:stream';
 import { pipeline } from 'node:stream/promises';
@@ -9,83 +9,78 @@ import { hashSync } from 'bcryptjs';
 import { Eta } from 'eta';
 import { createHash } from 'node:crypto';
 
-let stopCompose;
+let stopRef;
 function startCompose(file) {
-    stopCompose?.();
-    stopCompose = undefined;
+    stopRef?.();
+    stopRef = undefined;
+    const logs = join(dirname(file), 'logs');
+    mkdirSync(logs, { recursive: true });
+    const output = openSync(join(logs, 'compose.log'), 'w');
+    const compose = [
+        'compose',
+        `--project-name=${process.env.COMPOSE_PROJECT_NAME ?? 'visage'}`,
+        `--file=${file}`,
+    ];
+    const env = { ...process.env, COMPOSE_MENU: 'false' };
+    const opts = {
+        cwd: dirname(file),
+        stdio: ['ignore', output, output],
+        env,
+    };
+    const up = [
+        ...compose,
+        'up',
+        '--abort-on-container-failure',
+        '--no-color',
+        '--remove-orphans',
+    ];
+    const child = spawn('docker', up, opts);
     const stop = () => {
-        if (stopCompose !== stop)
+        if (stopRef !== stop)
             return;
-        stopCompose = undefined;
-        process.off('SIGINT', onSigInt);
-        process.off('SIGTERM', onSigTerm);
-        run(file, ['down'], 'Failed to stop Docker Compose');
+        stopRef = undefined;
+        child.kill();
+        const down = [...compose, 'down', '--remove-orphans'];
+        spawnSync('docker', down, opts);
     };
-    run(file, ['up', '-d'], 'Failed to start Docker Compose');
-    stopCompose = stop;
-    process.off('SIGINT', onSigInt);
-    process.off('SIGTERM', onSigTerm);
-    process.once('SIGINT', onSigInt);
-    process.once('SIGTERM', onSigTerm);
+    stopRef = stop;
     return stop;
 }
-function run(file, args, message) {
-    const result = spawnSync('docker', ['compose', '-f', file, ...args], {
-        cwd: dirname(file),
-        stdio: 'inherit',
-    });
-    if (result.error)
-        throw result.error;
-    if (result.status !== 0)
-        throw new Error(message);
-}
-function onSigInt() {
-    try {
-        stopCompose?.();
-    }
-    finally {
-        process.exit(130);
-    }
-}
-function onSigTerm() {
-    try {
-        stopCompose?.();
-    }
-    finally {
-        process.exit(143);
-    }
-}
 
+const CACHE_HOME = process.env.XDG_CACHE_HOME || join(homedir(), '.cache');
 async function ensureCerts({ certs, hostname }) {
-    const cert = join(certs, 'tls.crt');
-    const key = join(certs, 'tls.key');
-    if (existsSync(cert) && existsSync(key))
-        return;
+    const CAROOT = join(CACHE_HOME, 'visage/ca');
+    mkdirSync(CAROOT, { recursive: true, mode: 0o700 });
+    chmodSync(CAROOT, 0o700);
     const mkcert = await ensureMkCert();
-    const env = {
-        ...process.env,
-        CAROOT: join(process.env.XDG_CACHE_HOME || join(homedir(), '.cache'), 'visage/ca'),
-        TRUST_STORES: process.env.TRUST_STORES ?? 'system',
-    };
-    mkdirSync(env.CAROOT, { recursive: true, mode: 0o700 });
-    chmodSync(env.CAROOT, 0o700);
-    // mkcert -install is idempotent; CA files alone do not prove trust-store state.
-    {
-        const result = spawnSync(mkcert, ['-install'], {
-            env,
-            stdio: [process.stdin.isTTY ? 'inherit' : 'ignore', 'inherit', 'inherit'],
-        });
+    const logs = join(dirname(certs), 'logs');
+    mkdirSync(logs, { recursive: true });
+    const log = join(logs, 'mkcert.log');
+    const output = openSync(log, 'w');
+    const env = { CAROOT, TRUST_STORES: 'system', ...process.env };
+    const tty = process.stdin.isTTY;
+    const stdio = [
+        tty ? 'inherit' : 'ignore',
+        output,
+        output,
+    ];
+    if (process.env.CI !== 'true') {
+        // mkcert -install is idempotent; CA files alone do not prove trust-store state.
+        const result = spawnSync(mkcert, ['-install'], { env, stdio });
         if (result.error)
             throw result.error;
         if (result.status !== 0) {
             throw new Error('Failed to install CA');
         }
     }
-    // generate certs
+    const cert = join(certs, 'tls.crt');
+    const key = join(certs, 'tls.key');
     mkdirSync(certs, { recursive: true });
+    rmSync(cert, { force: true });
+    rmSync(key, { force: true });
     const names = [...new Set([hostname, 'localhost', '127.0.0.1', '::1'])];
     const args = ['-cert-file', cert, '-key-file', key, ...names];
-    const result = spawnSync(mkcert, args, { env, stdio: 'inherit' });
+    const result = spawnSync(mkcert, args, { env, stdio });
     if (result.error)
         throw result.error;
     if (result.status !== 0) {
@@ -93,7 +88,7 @@ async function ensureCerts({ certs, hostname }) {
     }
 }
 async function ensureMkCert() {
-    const bin = join(process.env.XDG_CACHE_HOME || join(homedir(), '.cache'), 'visage/bin');
+    const bin = join(CACHE_HOME, 'visage/bin');
     const file = join(bin, `mkcert-${process.platform}-${process.arch}`);
     if (existsSync(file))
         return file;
@@ -254,6 +249,9 @@ http {
         ssl_certificate     <%~ it.ssl.cert %>;
         ssl_certificate_key <%~ it.ssl.key %>;
 
+        # Redirect accidental plaintext HTTP requests sent to the HTTPS port.
+        error_page 497 =301 https://$http_host$request_uri;
+
         <%_ for (const [name, upstream] of Object.entries(it.upstreams)) { %>
             <%_ for (const [path, location] of Object.entries(upstream.locations ?? {})) { %>
         location <%~ path %> {
@@ -334,6 +332,8 @@ function renderOauth2ProxyConfig(config) {
         cookie_httponly: true,
         cookie_secure: true,
         cookie_samesite: 'lax',
+        cookie_csrf_per_request: true,
+        cookie_csrf_per_request_limit: 16,
         email_domains: ['*'],
         scope: config.oauth2.scopes.join(' '),
         upstreams: ['static://202'],
@@ -342,6 +342,7 @@ function renderOauth2ProxyConfig(config) {
         pass_access_token: true,
         pass_authorization_header: true,
         skip_provider_button: true,
+        whitelist_domains: [config.host, `${config.host}:${config.port}`],
     };
     return `${Object.entries(data)
         .map(([key, value]) => {
@@ -409,11 +410,7 @@ const BaseOauth2ProxyUpstream = {
         '/oauth2/': {
             auth: { enabled: false },
             headers: {
-                Cookie: '$http_cookie',
-                Host: '$host',
-                'X-Real-IP': '$remote_addr',
-                'X-Forwarded-For': '$proxy_add_x_forwarded_for',
-                'X-Forwarded-Proto': '$scheme',
+                Cookie: '$http_cookie', // Forward session cookie.
                 'X-Auth-Request-Redirect': '$request_uri',
             },
         },
@@ -461,19 +458,17 @@ function resolveOptions(options) {
     const { host = 'localhost', port = 9001, cookie = {}, oauth2 = {} } = options;
     const cookieName = cookie.name ?? 'session';
     const publicClient = oauth2.clientSecret === null;
-    const upstreams = {
-        ...resolveServiceUpstreams(options.services),
-        ...resolveUpstreams(options.upstreams),
-    };
+    const services = resolveServicesOptions(options.services);
+    const upstreams = resolveUpstreamsOptions(services, options.upstreams);
     return {
         host,
         port,
         cookie: {
             ...DefaultCookiePolicy,
             cookie_name: cookie.domains === undefined
-                ? cookieName.startsWith('__HOST-')
+                ? cookieName.startsWith('__Host-')
                     ? cookieName
-                    : `__HOST-${cookieName}`
+                    : `__Host-${cookieName}`
                 : cookieName,
             ...(cookie.expire === undefined ? {} : { cookie_expire: cookie.expire }),
             ...(cookie.refresh === undefined
@@ -493,62 +488,61 @@ function resolveOptions(options) {
             scopes: oauth2.scopes ?? DefaultOAuth2Client.scopes,
             public: publicClient,
         },
-        services: {
-            ...Object.fromEntries(Object.entries(options.services ?? {}).map(([name, service]) => [
-                name,
-                resolveService(service),
-            ])),
-            nginx: {
-                ...BaseServiceNginx,
-                ...{
-                    ...resolveService(options.services?.nginx ?? {}),
-                    extra_hosts: [
-                        ...BaseServiceNginx.extra_hosts,
-                        ...(options.services?.nginx?.extra_hosts ?? []),
-                    ],
-                },
+        services,
+        upstreams,
+    };
+}
+function resolveServicesOptions(services = {}) {
+    return {
+        ...services,
+        nginx: {
+            ...BaseServiceNginx,
+            ...{
+                ...(services.nginx ?? {}),
+                extra_hosts: [
+                    ...BaseServiceNginx.extra_hosts,
+                    ...(services.nginx?.extra_hosts ?? []),
+                ],
             },
-            oauth2_proxy: {
-                ...BaseOAuth2ProxyService,
-                ...{
-                    ...resolveService(options.services?.oauth2_proxy ?? {}),
-                    extra_hosts: [
-                        ...BaseOAuth2ProxyService.extra_hosts,
-                        ...(options.services?.oauth2_proxy?.extra_hosts ?? []),
-                    ],
-                },
+        },
+        oauth2_proxy: {
+            ...BaseOAuth2ProxyService,
+            ...{
+                ...(services.oauth2_proxy ?? {}),
+                extra_hosts: [
+                    ...BaseOAuth2ProxyService.extra_hosts,
+                    ...(services.oauth2_proxy?.extra_hosts ?? []),
+                ],
             },
         },
-        ...(Object.keys(upstreams).length === 0 ? {} : { upstreams }),
     };
 }
-function resolveService(service) {
-    const { upstream: _upstream, ...resolved } = service;
-    return resolved;
-}
-function resolveServiceUpstreams(services = {}) {
-    return Object.fromEntries(Object.entries(services)
-        .filter(([name]) => 
-    // Exclude base services handled separately.
-    name !== 'dex' && name !== 'nginx' && name !== 'oauth2_proxy')
-        .map(([name, service]) => [
-        name,
-        resolveUpstream(name, service.upstream ?? {}),
-    ]));
-}
-function resolveUpstreams(upstreams = {}) {
-    return Object.fromEntries(Object.entries(upstreams).map(([name, upstream]) => [
-        name,
-        resolveUpstream(name, upstream),
-    ]));
-}
-function resolveUpstream(name, upstream) {
+function resolveUpstreamsOptions(services, upstreams = {}) {
+    function resolveUpstream(name, upstream) {
+        return {
+            ...upstream,
+            scheme: upstream.scheme,
+            host: upstream.host ?? name,
+            port: upstream.port ?? (upstream.scheme === 'https' ? 443 : 80),
+            locations: upstream.locations ?? { [`/${name}/`]: {} },
+        };
+    }
     return {
-        ...upstream,
-        host: upstream.host ?? name,
-        locations: upstream.locations ?? { [`/${name}/`]: {} },
-        port: upstream.port ?? 80,
-        scheme: upstream.scheme ?? 'http',
+        ...Object.fromEntries(Object.entries(services)
+            .filter(([name]) => 
+        // Exclude base services handled separately.
+        name !== 'dex' && name !== 'nginx' && name !== 'oauth2_proxy')
+            .map(([name, service]) => [
+            name,
+            resolveUpstream(name, { scheme: 'http', ...service.upstream }),
+        ])),
+        ...Object.fromEntries(Object.entries(upstreams).map(([name, upstream]) => [
+            name,
+            resolveUpstream(name, {
+                scheme: services[name] === undefined ? 'https' : 'http',
+                ...upstream,
+            }),
+        ])),
     };
 }
 function resolveIdpOption(idp) {
@@ -605,6 +599,7 @@ function resolveExternalIdpUpstream(idp) {
     const issuer = new URL(idp.issuer);
     return {
         host: issuer.hostname,
+        locations: {},
         scheme: issuer.protocol === 'https:' ? 'https' : 'http',
         port: Number(issuer.port) || (issuer.protocol === 'https:' ? 443 : 80),
     };
@@ -643,27 +638,47 @@ function resolveConfig(options, config, vitePort) {
                         depends_on: ['dex'],
                     },
                 }),
-            ...options.services,
+            ...Object.fromEntries(Object.entries(options.services).map(([name, { upstream: _upstream, ...service }]) => [name, service])),
         },
-        upstreams: Object.fromEntries(Object.entries(upstreams).map(([name, upstream]) => [
-            name,
-            {
-                ...upstream,
-                locations: Object.fromEntries(Object.entries(upstream.locations ?? {}).map(([path, policy]) => [
-                    path,
-                    {
-                        auth: { ...DefaultProxyPolicy.auth, ...policy.auth },
-                        headers: { ...DefaultProxyPolicy.headers, ...policy.headers },
-                    },
-                ])),
-            },
-        ])),
+        upstreams: Object.fromEntries(Object.entries(upstreams).map(([name, upstream]) => {
+            const external = options.upstreams[name] !== undefined &&
+                options.services[name] === undefined;
+            return [
+                name,
+                {
+                    ...upstream,
+                    locations: Object.fromEntries(Object.entries(upstream.locations ?? {}).map(([path, policy]) => [
+                        path,
+                        {
+                            auth: { ...DefaultProxyPolicy.auth, ...policy.auth },
+                            headers: {
+                                ...(external
+                                    ? { ...DefaultProxyPolicy.headers, Host: upstream.host }
+                                    : DefaultProxyPolicy.headers),
+                                ...policy.headers,
+                            },
+                        },
+                    ])),
+                },
+            ];
+        })),
     };
 }
 
+function formatUrl(host, port) {
+    const AnsiGreen = '\x1b[32m';
+    const AnsiCyan = '\x1b[36m';
+    const AnsiBold = '\x1b[1m';
+    const AnsiReset = '\x1b[0m';
+    return `  ${AnsiGreen}➜${AnsiReset}  ${AnsiBold}Visage${AnsiReset}:  ${AnsiCyan}https://${host}:${AnsiBold}${port}${AnsiReset}${AnsiCyan}/${AnsiReset}`;
+}
 function visage(options = {}) {
     const resolvedOptions = resolveOptions(options);
     let stop;
+    const closeBundle = () => {
+        stop?.();
+        stop = undefined;
+    };
     return {
         name: 'visage',
         apply: 'serve',
@@ -680,8 +695,17 @@ function visage(options = {}) {
             };
         },
         configureServer(server) {
+            let url;
+            const printUrls = server.printUrls.bind(server);
+            server.printUrls = () => {
+                printUrls();
+                if (url)
+                    server.config.logger.info(formatUrl(url.host, url.port));
+            };
             async function startVisage(port) {
                 const config = resolveConfig(resolvedOptions, server.config, port);
+                url = { host: config.host, port: config.port };
+                rmSync(join(config.cache, 'logs'), { recursive: true, force: true });
                 await ensureCerts({
                     certs: join(config.cache, config.files.certs[0]),
                     hostname: config.host,
@@ -698,13 +722,11 @@ function visage(options = {}) {
                     throw new Error('Failed to resolve port for Visage');
                 }
                 stop = await startVisage(address.port);
+                server.httpServer?.once('close', closeBundle);
                 return result;
             };
         },
-        closeBundle() {
-            stop?.();
-            stop = undefined;
-        },
+        closeBundle,
     };
 }
 

package/dist/render/nginx.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nginx.d.ts","sourceRoot":"","sources":["../../src/render/nginx.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAuD9C,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAI3D"}
+{"version":3,"file":"nginx.d.ts","sourceRoot":"","sources":["../../src/render/nginx.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AA0D9C,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAI3D"}

package/dist/types.d.ts

@@ -15,7 +15,8 @@ export type VisageOptions = {
      */
     readonly port?: number;
     /**
-     * Session cookie settings normalized into OAuth2 Proxy configuration.
+     * OAuth2 Proxy session cookie settings for name, browser scope, lifetime, and
+     * refresh timing.
      */
     readonly cookie?: VisageCookiePolicy;
     /**
@@ -38,37 +39,48 @@ export type VisageOptions = {
     readonly upstreams?: Record<string, VisageUpstream>;
 };
 /**
- * Cookie lifetime, scope, and naming policy for the OAuth2 Proxy session.
+ * Settings for the browser session cookie managed by OAuth2 Proxy.
+ *
+ * OAuth2 Proxy keeps OIDC session state behind this cookie. The cookie lifetime
+ * caps the browser session, while the refresh interval controls when OAuth2
+ * Proxy tries to renew token state with the provider.
  */
 export type VisageCookiePolicy = {
     /**
-     * Session cookie name. Host-only cookies are automatically prefixed with
-     * `__HOST-` when no domains are configured, so the default rendered
-     * host-only cookie name is `__HOST-session`.
+     * Browser session cookie base name. When no domains are configured, Visage
+     * renders a host-only name with a `__Host-` prefix, so the default rendered
+     * name is `__Host-session`.
      *
      * @defaultValue `'session'`
      */
     readonly name?: string;
     /**
-     * Maximum cookie lifetime using an OAuth2 Proxy duration string.
+     * Maximum browser session lifetime. Rendered as OAuth2 Proxy `cookie_expire`
+     * using its duration syntax. Keep this aligned with the identity provider's
+     * refresh-token lifetime to avoid sessions that can no longer be renewed
+     * silently.
      *
      * @defaultValue `'8h'`
      */
     readonly expire?: string;
     /**
-     * Interval after which OAuth2 Proxy refreshes the session using an OAuth2
-     * Proxy duration string.
+     * Session age after which OAuth2 Proxy attempts silent renewal using the
+     * stored refresh token, when one is available. Rendered as `cookie_refresh`
+     * using OAuth2 Proxy duration syntax. If upstreams validate forwarded access
+     * tokens, set this below the access-token lifetime so OAuth2 Proxy refreshes
+     * before forwarding an expired bearer token.
      *
      * @defaultValue `'15m'`
      */
     readonly refresh?: string;
     /**
-     * Cookie domains for sharing the session across local hostnames. Leave unset
-     * for a host-only cookie.
+     * Cookie domains for sharing one session across hostnames. Omit for a
+     * host-only cookie.
      */
     readonly domains?: readonly string[];
     /**
-     * Cookie path scope.
+     * Cookie path scope. Keep broad enough for every protected route that should
+     * send the session.
      *
      * @defaultValue `'/'`
      */
@@ -139,11 +151,15 @@ export type VisageDexExpiry = {
 export type VisageDexUser = {
     /**
      * Email address used as the Dex login identifier.
+     *
+     * @defaultValue `'user@example.com'`
      */
     readonly email: string;
     /**
      * Plain-text development password. Visage hashes this before rendering the
      * Dex config.
+     *
+     * @defaultValue `'pass'`
      */
     readonly password: string;
     /**
@@ -254,13 +270,13 @@ export type VisageUpstream = {
     /**
      * URL scheme NGINX should use when proxying to this upstream.
      *
-     * @defaultValue `'http'`
+     * @defaultValue `'https'` for external upstreams; `'http'` otherwise.
      */
     readonly scheme?: 'http' | 'https';
     /**
      * Port NGINX should proxy to on {@link VisageUpstream.host}.
      *
-     * @defaultValue `80`
+     * @defaultValue `80`, or `443` when {@link VisageUpstream.scheme} is `'https'`.
      */
     readonly port?: number;
     /**
@@ -304,7 +320,8 @@ export type VisageProxyPolicy = {
      * Request headers to set when proxying to the upstream. Values may include
      * NGINX variables. These are merged with Visage's default proxy headers:
      * `Cookie`, `Host`, `X-Real-IP`, `X-Forwarded-For`, and
-     * `X-Forwarded-Proto`.
+     * `X-Forwarded-Proto`. `Host` defaults to the upstream host for top-level
+     * upstreams with no matching service, and to `$host` otherwise.
      */
     readonly headers?: {
         readonly [key: string]: string;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,gBAAgB,GAAG,wBAAwB,CAAC;IAC3D;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAClD;;OAEG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CACrD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;IAClC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;CAC3C,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B;;OAEG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;OAEG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;OAEG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;OAEG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE;QACvB;;WAEG;QACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;QACpC;;WAEG;QACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;QACnC;;WAEG;QACH,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;QACnC;;WAEG;QACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;KACjC,CAAC;CACH,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,wBAAwB,GAAG;IACrC;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;OAEG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;CACpC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,iBAAiB,CAAA;KAAE,CAAC;CACrE,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;OAEG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE;QACd;;;;WAIG;QACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;QAC3B;;;;WAIG;QACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;QAC5B;;;;;WAKG;QACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;KAC5B,CAAC;IACF;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC;CACvD,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,gBAAgB,GAAG,wBAAwB,CAAC;IAC3D;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAClD;;OAEG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CACrD,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;IAClC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;CAC3C,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B;;OAEG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;OAEG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;OAEG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;OAEG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE;QACvB;;WAEG;QACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;QACpC;;WAEG;QACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;QACnC;;WAEG;QACH,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;QACnC;;WAEG;QACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;KACjC,CAAC;CACH,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,wBAAwB,GAAG;IACrC;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;OAEG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;CACpC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,iBAAiB,CAAA;KAAE,CAAC;CACrE,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;OAEG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE;QACd;;;;WAIG;QACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;QAC3B;;;;WAIG;QACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;QAC5B;;;;;WAKG;QACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;KAC5B,CAAC;IACF;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC;CACvD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blakearoberts/visage",
-  "version": "0.0.1-rc.6",
+  "version": "0.0.1-rc.8",
   "description": "Vite plugin for local development with HMR and OIDC session cookie lifecycle semantics.",
   "type": "module",
   "author": "Blake Roberts",
@@ -14,14 +14,15 @@
   },
   "homepage": "https://github.com/blakearoberts/visage#readme",
   "keywords": [
-    "vite",
-    "plugin",
-    "oidc",
+    "authentication",
     "hmr",
-    "session",
-    "cookie",
-    "lifecycle",
-    "development"
+    "local-development",
+    "oauth2",
+    "oidc",
+    "pkce",
+    "session-cookie",
+    "vite",
+    "vite-plugin"
   ],
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -44,11 +45,14 @@
   "scripts": {
     "build": "npm run clean && rollup -c",
     "clean": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\"",
-    "test": "npm run test:unit",
+    "dev:example": "cd examples/managed-service && npm run dev",
+    "format": "prettier --write \"{docs,examples,src,test}/**/*.{ts,tsx,js,jsx,json,css,html,md}\" \"*.{json,md}\"",
+    "format:check": "prettier --check \"{docs,examples,src,test}/**/*.{ts,tsx,js,jsx,json,css,html,md}\" \"*.{json,md}\"",
+    "test": "npm run typecheck && npm run test:unit",
+    "test:all": "npm test && npm run test:e2e",
     "test:e2e": "playwright test test/e2e",
     "test:unit": "node --experimental-strip-types --test test/unit/*.test.ts",
-    "format": "prettier --write \"{docs,examples,src,test}/**/*.{ts,tsx,js,jsx,json,css,html,md}\" \"*.{json,md}\"",
-    "format:check": "prettier --check \"{docs,examples,src,test}/**/*.{ts,tsx,js,jsx,json,css,html,md}\" \"*.{json,md}\""
+    "typecheck": "tsc --noEmit && tsc -p tsconfig.test.json"
   },
   "devDependencies": {
     "@playwright/test": "^1.59.1",