@codeagentswarm/cas-cloud 0.0.1

package/dist/cas-preview.js

@@ -0,0 +1,761 @@
+#!/usr/bin/env node
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __commonJS = (cb, mod) => function __require() {
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
+};
+
+// src/infrastructure/headless/ephemeral-preview-service.js
+var require_ephemeral_preview_service = __commonJS({
+  "src/infrastructure/headless/ephemeral-preview-service.js"(exports2, module2) {
+    var crypto = require("crypto");
+    var fs = require("fs");
+    var http2 = require("http");
+    var net = require("net");
+    var path2 = require("path");
+    var { spawn } = require("child_process");
+    var DEFAULT_TTL_MS2 = 2 * 60 * 60 * 1e3;
+    var DEFAULT_READY_TIMEOUT_MS = 3e4;
+    var MAX_CONTROL_BODY_BYTES = 64 * 1024;
+    var MAX_REWRITE_BYTES = 10 * 1024 * 1024;
+    var TOMBSTONE_TTL_MS = 10 * 60 * 1e3;
+    var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
+      "connection",
+      "keep-alive",
+      "proxy-authenticate",
+      "proxy-authorization",
+      "te",
+      "trailer",
+      "transfer-encoding",
+      "upgrade"
+    ]);
+    function isInside(parent, candidate) {
+      const relative = path2.relative(parent, candidate);
+      return relative === "" || !relative.startsWith(`..${path2.sep}`) && relative !== ".." && !path2.isAbsolute(relative);
+    }
+    function projectSlug(projectPath) {
+      const name = path2.basename(projectPath).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 40) || "project";
+      const digest = crypto.createHash("sha256").update(projectPath).digest("hex").slice(0, 8);
+      return `${name}-${digest}`;
+    }
+    function previewPrefix(lease) {
+      return `/${lease.projectSlug}/${lease.id}`;
+    }
+    function normalizePublicOrigin(value) {
+      let origin;
+      try {
+        origin = new URL(value);
+      } catch {
+        throw new Error("Preview public origin must be a valid HTTP or HTTPS origin");
+      }
+      if (!["http:", "https:"].includes(origin.protocol) || origin.username || origin.password || origin.pathname !== "/" || origin.search || origin.hash) {
+        throw new Error("Preview public origin must contain only an HTTP or HTTPS origin");
+      }
+      return origin.origin;
+    }
+    function rewritePreviewText(value, origin, proxyBase) {
+      const escapedOrigin = origin.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      return value.replace(new RegExp(escapedOrigin, "g"), proxyBase).replace(/\b(href|src|action)=(['"])\/(?!\/)/gi, `$1=$2${proxyBase}/`).replace(/\b(url\(\s*['"]?)\/(?!\/)/gi, `$1${proxyBase}/`).replace(/\b((?:from|import)\s*\(?\s*['"])\/(?!\/)/g, `$1${proxyBase}/`).replace(/\b((?:fetch|new URL)\s*\(\s*['"])\/(?!\/)/g, `$1${proxyBase}/`).replace(/(sourceMappingURL=)\/(?!\/)/g, `$1${proxyBase}/`);
+    }
+    function canConnect(port, host = "127.0.0.1", timeoutMs = 300) {
+      return new Promise((resolve) => {
+        const socket = net.createConnection({ host, port });
+        const finish = (value) => {
+          socket.destroy();
+          resolve(value);
+        };
+        socket.setTimeout(timeoutMs);
+        socket.once("connect", () => finish(true));
+        socket.once("timeout", () => finish(false));
+        socket.once("error", () => finish(false));
+      });
+    }
+    function delay(milliseconds) {
+      return new Promise((resolve) => setTimeout(resolve, milliseconds));
+    }
+    function canConnectSocket(socketPath, timeoutMs = 300) {
+      return new Promise((resolve) => {
+        const socket = net.createConnection({ path: socketPath });
+        const finish = (value) => {
+          socket.destroy();
+          resolve(value);
+        };
+        socket.setTimeout(timeoutMs);
+        socket.once("connect", () => finish(true));
+        socket.once("timeout", () => finish(false));
+        socket.once("error", () => finish(false));
+      });
+    }
+    function hasWildcardListener(port) {
+      if (process.platform !== "linux") return false;
+      const expectedPort = Number(port).toString(16).toUpperCase().padStart(4, "0");
+      for (const file of ["/proc/net/tcp", "/proc/net/tcp6"]) {
+        let rows;
+        try {
+          rows = fs.readFileSync(file, "utf8").trim().split("\n").slice(1);
+        } catch {
+          continue;
+        }
+        for (const row of rows) {
+          const fields = row.trim().split(/\s+/);
+          if (fields[3] !== "0A") continue;
+          const [address, portHex] = fields[1].split(":");
+          if (portHex === expectedPort && /^0+$/.test(address)) return true;
+        }
+      }
+      return false;
+    }
+    function signalProcessGroup(child, signal) {
+      if (!(child == null ? void 0 : child.pid)) return;
+      try {
+        if (process.platform !== "win32") process.kill(-child.pid, signal);
+        else child.kill(signal);
+      } catch (error) {
+        if (error.code !== "ESRCH") throw error;
+      }
+    }
+    function childEnvironment(lease) {
+      const allowed = [
+        "COLORTERM",
+        "FORCE_COLOR",
+        "HOME",
+        "LANG",
+        "LC_ALL",
+        "LOGNAME",
+        "NO_COLOR",
+        "PATH",
+        "SHELL",
+        "TEMP",
+        "TERM",
+        "TMP",
+        "TMPDIR",
+        "USER",
+        "COREPACK_HOME",
+        "NVM_BIN",
+        "NVM_DIR",
+        "PNPM_HOME",
+        "XDG_CACHE_HOME",
+        "XDG_CONFIG_HOME",
+        "XDG_DATA_HOME"
+      ];
+      const environment = {};
+      for (const name of allowed) {
+        if (process.env[name] !== void 0) environment[name] = process.env[name];
+      }
+      environment.PATH ||= "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
+      return {
+        ...environment,
+        BROWSER: "none",
+        HOST: "127.0.0.1",
+        PORT: String(lease.port),
+        CAS_PREVIEW_BASE_PATH: `${previewPrefix(lease)}/`
+      };
+    }
+    function stripRoutingCookie(value) {
+      if (!value) return value;
+      return value.split(";").map((part) => part.trim()).filter((part) => !part.startsWith("cas_preview=")).join("; ");
+    }
+    function proxyHeaders(request, lease, targetPath) {
+      const headers = {};
+      for (const [name, value] of Object.entries(request.headers)) {
+        if (!HOP_BY_HOP_HEADERS.has(name) && name !== "host" && name !== "content-length") headers[name] = value;
+      }
+      const prefix = previewPrefix(lease);
+      const upstreamOrigin = `http://127.0.0.1:${lease.port}`;
+      headers.host = `127.0.0.1:${lease.port}`;
+      headers["x-forwarded-host"] = request.headers.host || "";
+      headers["x-forwarded-proto"] = new URL(lease.publicOrigin).protocol.slice(0, -1);
+      headers["x-forwarded-prefix"] = prefix;
+      headers["accept-encoding"] = "identity";
+      if (request.headers.origin) headers.origin = upstreamOrigin;
+      if (request.headers.referer) headers.referer = `${upstreamOrigin}${targetPath}`;
+      const cookie = stripRoutingCookie(request.headers.cookie);
+      if (cookie) headers.cookie = cookie;
+      else delete headers.cookie;
+      return headers;
+    }
+    function parseCookies(value) {
+      return String(value || "").split(";").reduce((cookies, entry) => {
+        const separator = entry.indexOf("=");
+        if (separator <= 0) return cookies;
+        cookies[entry.slice(0, separator).trim()] = entry.slice(separator + 1).trim();
+        return cookies;
+      }, {});
+    }
+    var EphemeralPreviewService2 = class {
+      constructor({
+        root,
+        publicOrigin,
+        ttlMs = DEFAULT_TTL_MS2,
+        readyTimeoutMs = DEFAULT_READY_TIMEOUT_MS,
+        now = Date.now,
+        spawnImpl = spawn,
+        logger = console
+      } = {}) {
+        if (!root) throw new Error("EphemeralPreviewService requires a project root");
+        if (!publicOrigin) throw new Error("EphemeralPreviewService requires a public origin");
+        this.root = fs.realpathSync(root);
+        this.publicOrigin = normalizePublicOrigin(publicOrigin);
+        this.ttlMs = ttlMs;
+        this.readyTimeoutMs = readyTimeoutMs;
+        this.now = now;
+        this.spawn = spawnImpl;
+        this.logger = logger;
+        this.leases = /* @__PURE__ */ new Map();
+        this.tombstones = /* @__PURE__ */ new Map();
+      }
+      prune() {
+        const current = this.now();
+        for (const [id, stoppedAt] of this.tombstones) {
+          if (stoppedAt + TOMBSTONE_TTL_MS <= current) this.tombstones.delete(id);
+        }
+      }
+      resolveLease(id) {
+        const lease = this.leases.get(id);
+        if (lease && lease.expiresAt <= this.now()) {
+          this.stopLease(id, "expired").catch((error) => {
+            var _a, _b;
+            return (_b = (_a = this.logger).error) == null ? void 0 : _b.call(_a, error);
+          });
+          return { expired: true };
+        }
+        if (lease) return { lease };
+        if (this.tombstones.has(id)) return { expired: true };
+        return null;
+      }
+      publicLease(lease) {
+        return {
+          id: lease.id,
+          project: lease.projectSlug,
+          cwd: lease.cwd,
+          port: lease.port,
+          command: lease.command,
+          createdAt: lease.createdAt,
+          expiresAt: lease.expiresAt,
+          url: `${this.publicOrigin}${previewPrefix(lease)}/`
+        };
+      }
+      async startLease({ cwd, port, command }) {
+        var _a, _b, _c, _d;
+        this.prune();
+        const resolvedCwd = fs.realpathSync(path2.resolve(cwd || ""));
+        if (!isInside(this.root, resolvedCwd)) {
+          throw new Error(`Preview projects must be inside ${this.root}`);
+        }
+        const numericPort = Number(port);
+        if (!Number.isInteger(numericPort) || numericPort < 1024 || numericPort > 65535) {
+          throw new Error("Preview port must be an integer from 1024 to 65535");
+        }
+        if (!Array.isArray(command) || !command.length || !command[0] || command.some((value) => typeof value !== "string")) {
+          throw new Error("Preview command is required after --");
+        }
+        if ([...this.leases.values()].some((lease2) => lease2.port === numericPort)) {
+          throw new Error(`Port ${numericPort} already belongs to an active preview`);
+        }
+        if (await canConnect(numericPort)) {
+          throw new Error(`Port ${numericPort} is already in use; refusing to adopt an unmanaged process`);
+        }
+        const createdAt = this.now();
+        const lease = {
+          id: crypto.randomBytes(18).toString("base64url"),
+          projectSlug: projectSlug(resolvedCwd),
+          cwd: resolvedCwd,
+          port: numericPort,
+          command: [...command],
+          createdAt,
+          expiresAt: createdAt + this.ttlMs,
+          publicOrigin: this.publicOrigin,
+          child: null,
+          timer: null,
+          stopping: false,
+          spawnError: null
+        };
+        const child = this.spawn(command[0], command.slice(1), {
+          cwd: resolvedCwd,
+          detached: process.platform !== "win32",
+          env: childEnvironment(lease),
+          stdio: ["ignore", "pipe", "pipe"]
+        });
+        lease.child = child;
+        this.leases.set(lease.id, lease);
+        const log = (stream, chunk) => {
+          var _a2, _b2;
+          const output = String(chunk).trimEnd();
+          if (output) (_b2 = (_a2 = this.logger)[stream]) == null ? void 0 : _b2.call(_a2, `[preview ${lease.projectSlug}/${lease.id.slice(0, 8)}] ${output}`);
+        };
+        (_a = child.stdout) == null ? void 0 : _a.on("data", (chunk) => log("log", chunk));
+        (_b = child.stderr) == null ? void 0 : _b.on("data", (chunk) => log("error", chunk));
+        child.once("error", (error) => {
+          var _a2, _b2;
+          lease.spawnError = error;
+          (_b2 = (_a2 = this.logger).error) == null ? void 0 : _b2.call(_a2, `[preview ${lease.id.slice(0, 8)}] ${error.message}`);
+        });
+        child.once("close", () => {
+          if (lease.timer) clearTimeout(lease.timer);
+          if (this.leases.get(lease.id) === lease) this.leases.delete(lease.id);
+          this.tombstones.set(lease.id, this.now());
+        });
+        const deadline = this.now() + this.readyTimeoutMs;
+        while (this.now() < deadline) {
+          if (lease.spawnError || child.exitCode !== null || child.signalCode !== null || !this.leases.has(lease.id)) break;
+          if (await canConnect(numericPort)) {
+            if (hasWildcardListener(numericPort)) {
+              await this.stopLease(lease.id, "unsafe wildcard listener");
+              throw new Error(`Preview command must bind 127.0.0.1, not a wildcard address, on port ${numericPort}`);
+            }
+            lease.timer = setTimeout(() => {
+              this.stopLease(lease.id, "expired").catch((error) => {
+                var _a2, _b2;
+                return (_b2 = (_a2 = this.logger).error) == null ? void 0 : _b2.call(_a2, error);
+              });
+            }, Math.max(0, lease.expiresAt - this.now()));
+            (_d = (_c = lease.timer).unref) == null ? void 0 : _d.call(_c);
+            return this.publicLease(lease);
+          }
+          await delay(150);
+        }
+        await this.stopLease(lease.id, "startup failed");
+        if (lease.spawnError) throw new Error(`Could not start preview command: ${lease.spawnError.message}`);
+        throw new Error(`Preview command did not listen on 127.0.0.1:${numericPort} within ${this.readyTimeoutMs} ms`);
+      }
+      async stopLease(id, reason = "stopped") {
+        var _a, _b;
+        const lease = this.leases.get(id);
+        if (!lease) return false;
+        if (lease.stopping) return true;
+        lease.stopping = true;
+        if (lease.timer) clearTimeout(lease.timer);
+        (_b = (_a = this.logger).log) == null ? void 0 : _b.call(_a, `[preview ${lease.projectSlug}/${lease.id.slice(0, 8)}] ${reason}; terminating process group`);
+        signalProcessGroup(lease.child, "SIGTERM");
+        let forceTimer;
+        const exited = await Promise.race([
+          new Promise((resolve) => {
+            if (lease.child.exitCode !== null || lease.child.signalCode !== null) resolve(true);
+            else lease.child.once("close", () => resolve(true));
+          }),
+          new Promise((resolve) => {
+            forceTimer = setTimeout(() => resolve(false), 5e3);
+          })
+        ]);
+        clearTimeout(forceTimer);
+        if (!exited) signalProcessGroup(lease.child, "SIGKILL");
+        this.leases.delete(id);
+        this.tombstones.set(id, this.now());
+        return true;
+      }
+      async stopAll(reason = "service stopping") {
+        await Promise.all([...this.leases.keys()].map((id) => this.stopLease(id, reason)));
+      }
+      list() {
+        this.prune();
+        return [...this.leases.values()].flatMap((lease) => {
+          const resolved = this.resolveLease(lease.id);
+          return (resolved == null ? void 0 : resolved.lease) ? [this.publicLease(resolved.lease)] : [];
+        });
+      }
+      resolveRequest(request) {
+        this.prune();
+        const requestUrl = new URL(request.url, "http://preview.internal");
+        const segments = requestUrl.pathname.split("/").filter(Boolean);
+        if (segments.length >= 2) {
+          const resolved2 = this.resolveLease(segments[1]);
+          if ((resolved2 == null ? void 0 : resolved2.lease) && resolved2.lease.projectSlug === segments[0]) {
+            const rest = `/${segments.slice(2).join("/")}`;
+            return { lease: resolved2.lease, targetPath: `${rest}${requestUrl.search}` };
+          }
+          if (resolved2 == null ? void 0 : resolved2.expired) return resolved2;
+        }
+        const referer = request.headers.referer;
+        if (referer) {
+          try {
+            const refererSegments = new URL(referer).pathname.split("/").filter(Boolean);
+            const resolved2 = this.resolveLease(refererSegments[1]);
+            if ((resolved2 == null ? void 0 : resolved2.lease) && resolved2.lease.projectSlug === refererSegments[0]) {
+              return { lease: resolved2.lease, targetPath: `${requestUrl.pathname}${requestUrl.search}` };
+            }
+            if (resolved2 == null ? void 0 : resolved2.expired) return resolved2;
+          } catch {
+          }
+        }
+        const cookieId = parseCookies(request.headers.cookie).cas_preview;
+        const resolved = this.resolveLease(cookieId);
+        if (resolved == null ? void 0 : resolved.lease) return { lease: resolved.lease, targetPath: `${requestUrl.pathname}${requestUrl.search}` };
+        if (resolved == null ? void 0 : resolved.expired) return resolved;
+        return null;
+      }
+    };
+    function copyResponseHeaders(upstream, response, lease, rewritten) {
+      const prefix = previewPrefix(lease);
+      const upstreamOrigin = `http://127.0.0.1:${lease.port}`;
+      for (const [name, value] of Object.entries(upstream.headers)) {
+        if (HOP_BY_HOP_HEADERS.has(name) || rewritten && name === "content-length") continue;
+        if (name === "location" && typeof value === "string") {
+          response.setHeader(name, value.startsWith("/") ? `${prefix}${value}` : value.replace(upstreamOrigin, prefix));
+        } else if (name === "set-cookie") {
+          const cookies = (Array.isArray(value) ? value : [value]).filter((cookie) => !/^cas_preview=/i.test(String(cookie))).map((cookie) => String(cookie).replace(/Path=\//i, `Path=${prefix}/`));
+          if (cookies.length) response.setHeader(name, cookies);
+        } else {
+          response.setHeader(name, value);
+        }
+      }
+      const remainingSeconds = Math.max(0, Math.ceil((lease.expiresAt - Date.now()) / 1e3));
+      const secure = new URL(lease.publicOrigin).protocol === "https:" ? "; Secure" : "";
+      response.appendHeader("set-cookie", `cas_preview=${lease.id}; Path=/; HttpOnly${secure}; SameSite=Lax; Max-Age=${remainingSeconds}`);
+      response.setHeader("cache-control", "no-store");
+      response.setHeader("x-content-type-options", "nosniff");
+      response.setHeader("x-robots-tag", "noindex, nofollow, noarchive");
+    }
+    function proxyHttp(request, response, resolved) {
+      const { lease, targetPath } = resolved;
+      const prefix = previewPrefix(lease);
+      const upstreamOrigin = `http://127.0.0.1:${lease.port}`;
+      const upstreamRequest = http2.request({
+        hostname: "127.0.0.1",
+        port: lease.port,
+        method: request.method,
+        path: targetPath,
+        headers: proxyHeaders(request, lease, targetPath)
+      }, (upstream) => {
+        const contentType = String(upstream.headers["content-type"] || "");
+        const rewritten = /(?:text\/|javascript|json|xml)/i.test(contentType) && !upstream.headers["content-encoding"];
+        response.statusCode = upstream.statusCode || 502;
+        copyResponseHeaders(upstream, response, lease, rewritten);
+        if (!rewritten || request.method === "HEAD" || [204, 304].includes(upstream.statusCode)) {
+          upstream.pipe(response);
+          return;
+        }
+        const chunks = [];
+        let total = 0;
+        let tooLarge = false;
+        upstream.on("data", (chunk) => {
+          total += chunk.length;
+          if (total <= MAX_REWRITE_BYTES) chunks.push(chunk);
+          else tooLarge = true;
+        });
+        upstream.on("end", () => {
+          if (response.destroyed) return;
+          if (tooLarge) response.destroy(new Error("Preview response exceeded rewrite limit"));
+          else response.end(rewritePreviewText(Buffer.concat(chunks).toString(), upstreamOrigin, prefix));
+        });
+      });
+      upstreamRequest.setTimeout(3e4, () => upstreamRequest.destroy(new Error("Preview upstream timed out")));
+      upstreamRequest.on("error", (error) => {
+        if (response.headersSent) response.destroy(error);
+        else {
+          response.statusCode = 502;
+          response.setHeader("content-type", "text/plain; charset=utf-8");
+          response.end(`Could not reach the preview process: ${error.message}`);
+        }
+      });
+      request.pipe(upstreamRequest);
+    }
+    function proxyUpgrade(request, socket, head, resolved) {
+      const { lease, targetPath } = resolved;
+      const upstreamRequest = http2.request({
+        hostname: "127.0.0.1",
+        port: lease.port,
+        method: request.method,
+        path: targetPath,
+        headers: { ...proxyHeaders(request, lease, targetPath), connection: "Upgrade", upgrade: request.headers.upgrade }
+      });
+      upstreamRequest.once("upgrade", (upstream, upstreamSocket, upstreamHead) => {
+        const lines = [`HTTP/1.1 ${upstream.statusCode} ${upstream.statusMessage}`];
+        for (let index = 0; index < upstream.rawHeaders.length; index += 2) {
+          lines.push(`${upstream.rawHeaders[index]}: ${upstream.rawHeaders[index + 1]}`);
+        }
+        socket.write(`${lines.join("\r\n")}\r
+\r
+`);
+        if (upstreamHead.length) socket.write(upstreamHead);
+        if (head.length) upstreamSocket.write(head);
+        upstreamSocket.pipe(socket).pipe(upstreamSocket);
+      });
+      upstreamRequest.once("response", (upstream) => {
+        socket.end(`HTTP/1.1 ${upstream.statusCode || 502} Preview upgrade rejected\r
+Connection: close\r
+\r
+`);
+      });
+      upstreamRequest.once("error", () => socket.destroy());
+      upstreamRequest.end();
+    }
+    function sendJson(response, status, value) {
+      const body = `${JSON.stringify(value)}
+`;
+      response.writeHead(status, {
+        "content-type": "application/json; charset=utf-8",
+        "content-length": Buffer.byteLength(body),
+        "cache-control": "no-store"
+      });
+      response.end(body);
+    }
+    function readJson(request) {
+      return new Promise((resolve, reject) => {
+        const chunks = [];
+        let total = 0;
+        request.on("data", (chunk) => {
+          total += chunk.length;
+          if (total > MAX_CONTROL_BODY_BYTES) request.destroy(new Error("Control request is too large"));
+          else chunks.push(chunk);
+        });
+        request.on("end", () => {
+          try {
+            resolve(JSON.parse(Buffer.concat(chunks).toString() || "{}"));
+          } catch {
+            reject(new Error("Control request must contain valid JSON"));
+          }
+        });
+        request.on("error", reject);
+      });
+    }
+    function createPreviewServers2(service, {
+      listenHost = "127.0.0.1",
+      listenPort = 41820,
+      socketPath = "/run/cas-preview.sock"
+    } = {}) {
+      const publicServer = http2.createServer((request, response) => {
+        const resolved = service.resolveRequest(request);
+        if (resolved == null ? void 0 : resolved.expired) {
+          response.writeHead(410, { "content-type": "text/plain; charset=utf-8", "cache-control": "no-store" });
+          response.end("This development preview has expired. Start it again from CAS Cloud.");
+        } else if (!resolved) {
+          response.writeHead(404, { "content-type": "text/plain; charset=utf-8", "cache-control": "no-store" });
+          response.end("Development preview not found.");
+        } else {
+          proxyHttp(request, response, resolved);
+        }
+      });
+      publicServer.on("upgrade", (request, socket, head) => {
+        const resolved = service.resolveRequest(request);
+        if (!resolved || resolved.expired) {
+          socket.end(`HTTP/1.1 ${(resolved == null ? void 0 : resolved.expired) ? 410 : 404} Preview unavailable\r
+Connection: close\r
+\r
+`);
+          return;
+        }
+        proxyUpgrade(request, socket, head, resolved);
+      });
+      const controlServer = http2.createServer(async (request, response) => {
+        try {
+          const requestUrl = new URL(request.url, "http://control.internal");
+          if (request.method === "GET" && requestUrl.pathname === "/leases") {
+            sendJson(response, 200, { leases: service.list() });
+          } else if (request.method === "POST" && requestUrl.pathname === "/leases") {
+            sendJson(response, 201, { lease: await service.startLease(await readJson(request)) });
+          } else if (request.method === "DELETE" && requestUrl.pathname.startsWith("/leases/")) {
+            const id = decodeURIComponent(requestUrl.pathname.slice("/leases/".length));
+            const stopped = await service.stopLease(id, "stopped by user");
+            sendJson(response, stopped ? 200 : 404, { stopped });
+          } else {
+            sendJson(response, 404, { error: "Not found" });
+          }
+        } catch (error) {
+          sendJson(response, 400, { error: error.message });
+        }
+      });
+      async function listen() {
+        if (fs.existsSync(socketPath)) {
+          if (await canConnectSocket(socketPath)) throw new Error(`Preview control socket is already active: ${socketPath}`);
+          fs.unlinkSync(socketPath);
+        }
+        await new Promise((resolve, reject) => controlServer.once("error", reject).listen(socketPath, resolve));
+        fs.chmodSync(socketPath, 384);
+        try {
+          await new Promise((resolve, reject) => publicServer.once("error", reject).listen(listenPort, listenHost, resolve));
+        } catch (error) {
+          await new Promise((resolve) => controlServer.close(resolve));
+          if (fs.existsSync(socketPath)) fs.unlinkSync(socketPath);
+          throw error;
+        }
+        return { listenHost, listenPort, socketPath };
+      }
+      async function close() {
+        await service.stopAll();
+        await Promise.all([publicServer, controlServer].map((server) => new Promise((resolve) => server.close(resolve))));
+        if (fs.existsSync(socketPath)) fs.unlinkSync(socketPath);
+      }
+      return { publicServer, controlServer, listen, close };
+    }
+    module2.exports = {
+      DEFAULT_TTL_MS: DEFAULT_TTL_MS2,
+      EphemeralPreviewService: EphemeralPreviewService2,
+      createPreviewServers: createPreviewServers2,
+      normalizePublicOrigin,
+      previewPrefix,
+      projectSlug,
+      rewritePreviewText
+    };
+  }
+});
+
+// src/cli/cas-preview.js
+var http = require("http");
+var os = require("os");
+var path = require("path");
+var {
+  DEFAULT_TTL_MS,
+  EphemeralPreviewService,
+  createPreviewServers
+} = require_ephemeral_preview_service();
+function defaultSocketPath() {
+  if (process.env.CAS_PREVIEW_SOCKET) return path.resolve(process.env.CAS_PREVIEW_SOCKET);
+  if (process.env.XDG_RUNTIME_DIR && path.isAbsolute(process.env.XDG_RUNTIME_DIR)) {
+    return path.join(process.env.XDG_RUNTIME_DIR, "cas-preview.sock");
+  }
+  const identity = typeof process.getuid === "function" ? process.getuid() : "user";
+  return path.join(os.tmpdir(), `cas-preview-${identity}.sock`);
+}
+var DEFAULT_SOCKET = defaultSocketPath();
+function help() {
+  return `CAS ephemeral development previews
+
+Usage:
+  cas-preview start --cwd DIR --port PORT -- COMMAND [ARGS...]
+  cas-preview list
+  cas-preview stop LEASE_ID
+  cas-preview serve [--listen HOST] [--port PORT] [--socket PATH]
+                    [--root DIR] [--public-origin URL] [--ttl-seconds N]
+
+Every process started by this service has a hard two-hour TTL by default.
+The service refuses to adopt or terminate processes it did not start.`;
+}
+function takeOption(args, name, fallback) {
+  const index = args.indexOf(name);
+  if (index === -1) return fallback;
+  if (!args[index + 1]) throw new Error(`${name} requires a value`);
+  const value = args[index + 1];
+  args.splice(index, 2);
+  return value;
+}
+function controlRequest(socketPath, method, requestPath, body) {
+  return new Promise((resolve, reject) => {
+    const payload = body === void 0 ? null : Buffer.from(JSON.stringify(body));
+    const request = http.request({
+      socketPath,
+      method,
+      path: requestPath,
+      headers: payload ? { "content-type": "application/json", "content-length": payload.length } : {}
+    }, (response) => {
+      const chunks = [];
+      response.on("data", (chunk) => chunks.push(chunk));
+      response.on("end", () => {
+        let value;
+        try {
+          value = JSON.parse(Buffer.concat(chunks).toString() || "{}");
+        } catch {
+          reject(new Error(`Preview service returned HTTP ${response.statusCode}`));
+          return;
+        }
+        if ((response.statusCode || 500) >= 400) reject(new Error(value.error || `Preview service returned HTTP ${response.statusCode}`));
+        else resolve(value);
+      });
+    });
+    request.once("error", (error) => reject(new Error(`Cannot reach the preview service at ${socketPath}: ${error.message}`)));
+    if (payload) request.end(payload);
+    else request.end();
+  });
+}
+async function serve(args) {
+  const listenHost = takeOption(args, "--listen", "127.0.0.1");
+  const listenPort = Number(takeOption(args, "--port", "41820"));
+  const socketPath = path.resolve(takeOption(args, "--socket", DEFAULT_SOCKET));
+  const root = path.resolve(takeOption(args, "--root", process.env.CAS_PREVIEW_ROOT || process.cwd()));
+  const ttlSeconds = Number(takeOption(args, "--ttl-seconds", String(DEFAULT_TTL_MS / 1e3)));
+  const publicOrigin = takeOption(
+    args,
+    "--public-origin",
+    process.env.CAS_PREVIEW_PUBLIC_ORIGIN || `http://${listenHost}:${listenPort}`
+  );
+  if (args.length) throw new Error(`Unknown serve arguments: ${args.join(" ")}`);
+  if (!["127.0.0.1", "::1", "localhost"].includes(listenHost)) {
+    throw new Error("Preview service must listen on loopback; place a TLS reverse proxy in front of it");
+  }
+  if (!Number.isInteger(listenPort) || listenPort < 1 || listenPort > 65535) throw new Error("Invalid listen port");
+  if (!Number.isFinite(ttlSeconds) || ttlSeconds <= 0) throw new Error("Invalid TTL");
+  const service = new EphemeralPreviewService({ root, publicOrigin, ttlMs: ttlSeconds * 1e3 });
+  const servers = createPreviewServers(service, { listenHost, listenPort, socketPath });
+  await servers.listen();
+  console.log(`CAS preview service listening on http://${listenHost}:${listenPort}`);
+  console.log(`Public origin: ${service.publicOrigin}; root: ${service.root}`);
+  console.log(`Control socket: ${socketPath}; TTL: ${ttlSeconds} seconds`);
+  let closing = false;
+  const close = async (signal) => {
+    if (closing) return;
+    closing = true;
+    console.log(`${signal}; stopping ephemeral previews`);
+    await servers.close();
+    process.exitCode = 0;
+  };
+  process.once("SIGTERM", () => close("SIGTERM").catch((error) => {
+    console.error(error);
+    process.exitCode = 1;
+  }));
+  process.once("SIGINT", () => close("SIGINT").catch((error) => {
+    console.error(error);
+    process.exitCode = 1;
+  }));
+}
+async function start(args) {
+  const separator = args.indexOf("--");
+  if (separator === -1 || separator === args.length - 1) throw new Error("Pass the server command after --");
+  const options = args.slice(0, separator);
+  const command = args.slice(separator + 1);
+  const socketPath = path.resolve(takeOption(options, "--socket", DEFAULT_SOCKET));
+  const cwd = path.resolve(takeOption(options, "--cwd", process.cwd()));
+  const port = Number(takeOption(options, "--port"));
+  const json = options.includes("--json");
+  if (json) options.splice(options.indexOf("--json"), 1);
+  if (options.length) throw new Error(`Unknown start arguments: ${options.join(" ")}`);
+  const { lease } = await controlRequest(socketPath, "POST", "/leases", { cwd, port, command });
+  if (json) console.log(JSON.stringify(lease));
+  else {
+    console.log(lease.url);
+    console.log(`Lease: ${lease.id}`);
+    console.log(`Expires: ${new Date(lease.expiresAt).toISOString()}`);
+  }
+}
+async function list(args) {
+  const socketPath = path.resolve(takeOption(args, "--socket", DEFAULT_SOCKET));
+  if (args.length) throw new Error(`Unknown list arguments: ${args.join(" ")}`);
+  const { leases } = await controlRequest(socketPath, "GET", "/leases");
+  if (!leases.length) {
+    console.log("No active ephemeral previews.");
+    return;
+  }
+  for (const lease of leases) console.log(`${lease.id}	${new Date(lease.expiresAt).toISOString()}	${lease.url}`);
+}
+async function stop(args) {
+  const socketPath = path.resolve(takeOption(args, "--socket", DEFAULT_SOCKET));
+  const id = args.shift();
+  if (!id || args.length) throw new Error("Usage: cas-preview stop LEASE_ID");
+  await controlRequest(socketPath, "DELETE", `/leases/${encodeURIComponent(id)}`);
+  console.log(`Stopped preview ${id}.`);
+}
+async function main(argv = process.argv.slice(2)) {
+  const nodeMajor = Number.parseInt(process.versions.node.split(".")[0], 10);
+  if (!Number.isInteger(nodeMajor) || nodeMajor < 20) throw new Error(`Node.js 20 or newer is required; found ${process.version}`);
+  const args = [...argv];
+  const command = args.shift();
+  if (!command || ["help", "--help", "-h"].includes(command)) {
+    console.log(help());
+    return;
+  }
+  if (command === "serve") return serve(args);
+  if (command === "start") return start(args);
+  if (command === "list") return list(args);
+  if (command === "stop") return stop(args);
+  throw new Error(`Unknown command: ${command}
+
+${help()}`);
+}
+if (require.main === module) {
+  Promise.resolve(main()).catch((error) => {
+    console.error(`cas-preview: ${error.message}`);
+    process.exitCode = 1;
+  });
+}
+module.exports = { controlRequest, defaultSocketPath, help, main };