@codions/portta 0.0.0-develop.157.sha-ae5ce5e → 0.0.0-develop.159.sha-0da77d5

package/dist/cli.js

@@ -20141,6 +20141,26 @@ function isLoopbackAddress(address) {
 function isWildcardAddress(address) {
   return address === "0.0.0.0" || address === "::";
 }
+function isLoopbackIp(address) {
+  return address === "::1" || /^127(\.\d{1,3}){3}$/.test(address);
+}
+function localhostDnsVerdict(addresses) {
+  const hint = "see docs/product/guides/local-development.md#how-localhost-resolves";
+  if (addresses.length === 0) return check2("dns.local", "warn", "local DNS", "could not confirm *.localhost resolution", hint);
+  const stray = addresses.filter((address) => !isLoopbackIp(address));
+  return stray.length === 0 ? check2("dns.local", "pass", "local DNS", "*.localhost resolves to loopback") : check2("dns.local", "warn", "local DNS", `*.localhost resolves to ${stray.join(", ")}, not loopback`, hint);
+}
+function loopbackDomainVerdict(domain2, resolved2, bind) {
+  if (!isLoopbackIp(resolved2)) return null;
+  const served = isWildcardAddress(bind) || bind === resolved2 || isLoopbackAddress(bind) && resolved2 === "127.0.0.1";
+  return served ? check2("domain.reachable", "pass", "project hostnames", `*.${domain2} resolves to loopback, served on ${bind}`) : check2(
+    "domain.reachable",
+    "warn",
+    "project hostnames",
+    `*.${domain2} resolves to ${resolved2}, but Traefik listens on ${bind}`,
+    "point the wildcard at an address Traefik listens on; see docs/product/guides/local-domains.md"
+  );
+}
 function publishesSensitivePort(published) {
   return SENSITIVE_PORTS.some((port) => published.includes(`0.0.0.0:`) && published.includes(`->${port}`));
 }
@@ -22364,7 +22384,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@codions/portta",
-      version: "0.0.0-develop.157.sha-ae5ce5e",
+      version: "0.0.0-develop.159.sha-0da77d5",
       description: "Machine-first CLI for a shared Docker development gateway",
       license: "MIT",
       type: "module",
@@ -22438,7 +22458,7 @@ var init_version = __esm({
     "use strict";
     init_package();
     CLI_VERSION = package_default.version;
-    CLI_BUILD_DATE = true ? "2026-09-16T21:32:25Z" : void 0;
+    CLI_BUILD_DATE = true ? "2026-09-17T17:01:02Z" : void 0;
   }
 });
 
@@ -89799,7 +89819,7 @@ function createDaemonTaskflowHost(context) {
       port: hostListen(env).port,
       workflowBuiltinsDir: taskflowAssets(env).workflowBuiltinsDir,
       version: env.PORTTA_VERSION || "0.0.0-local",
-      buildDate: true ? "2026-09-16T21:32:25Z" : (/* @__PURE__ */ new Date()).toISOString(),
+      buildDate: true ? "2026-09-17T17:01:02Z" : (/* @__PURE__ */ new Date()).toISOString(),
       environmentStore: createEnvironmentStore(paths3.database),
       hostEnvironmentProvider: new HostEnvironmentProvider(),
       devContainerProvider: new DevContainerProvider(),
@@ -121127,14 +121147,7 @@ async function domainChecks(config3, env) {
   const domain2 = config3.domain;
   const panelExpose = env["PORTTA_WEB_EXPOSE"] || "local";
   if (domain2 === "localhost" || domain2.endsWith(".localhost")) {
-    const probe = await resolveIpv4("portta-probe.localhost");
-    checks.push(probe.length > 0 ? check2("dns.local", "pass", "local DNS", "*.localhost resolves to loopback") : check2(
-      "dns.local",
-      "warn",
-      "local DNS",
-      "could not confirm *.localhost resolution",
-      "see docs/product/guides/local-development.md if hostnames do not resolve"
-    ));
+    checks.push(localhostDnsVerdict(await resolveIpv4("portta-probe.localhost")));
     if (panelExpose !== "local") {
       checks.push(check2(
         "domain.reachable",
@@ -121150,6 +121163,8 @@ async function domainChecks(config3, env) {
   const resolved2 = (await resolveIpv4(`portta-probe.${domain2}`))[0];
   if (!resolved2) {
     checks.push(check2("dns.wildcard", "fail", "wildcard DNS", `*.${domain2} does not resolve`, "portta dns setup"));
+  } else if (isLoopbackIp(resolved2)) {
+    checks.push(check2("dns.wildcard", "pass", "wildcard DNS", `*.${domain2} -> ${resolved2} (this machine)`));
   } else {
     const expected = env["PORTTA_PUBLIC_IP"] ?? "";
     checks.push(!expected ? check2("dns.wildcard", "pass", "wildcard DNS", `*.${domain2} -> ${resolved2}`) : resolved2 === expected ? check2("dns.wildcard", "pass", "wildcard DNS", `*.${domain2} -> ${resolved2} (this host)`) : check2(
@@ -121161,7 +121176,19 @@ async function domainChecks(config3, env) {
     ));
   }
   const bind = config3.bindAddress;
-  if (isLoopbackAddress(bind)) {
+  const loopback = resolved2 ? loopbackDomainVerdict(domain2, resolved2, bind) : null;
+  if (loopback) {
+    checks.push(loopback);
+    if (panelExpose !== "local") {
+      checks.push(check2(
+        "domain.reachable.remote",
+        "warn",
+        "project hostnames",
+        `*.${domain2} resolves to loopback, and the panel is reached from elsewhere`,
+        "point the wildcard at this host, or portta config set domain.mode auto"
+      ));
+    }
+  } else if (isLoopbackAddress(bind)) {
     const publicIp = env["PORTTA_PUBLIC_IP"] ?? "";
     const fix = publicIp && isPrivateAddress(publicIp) ? `portta config set gateway.bindAddress ${publicIp}   serves them on that network only` : "portta public enable   exposes the HTTP services that opted in";
     checks.push(check2(