@dutodev/cli 0.7.0 → 1.1.0

package/dist/index.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import {
   C,
+  MAX_NAME,
   TRUNCATED_NOTE,
   bodyNote,
   formatBytes,
@@ -10,7 +11,7 @@ import {
   normalizeName,
   statusColor,
   validateName
-} from "./chunk-74IJFYGT.js";
+} from "./chunk-76YCOMXH.js";
 
 // src/ui/brand.ts
 function colorOn(stream = process.stdout) {
@@ -20,7 +21,6 @@ function colorOn(stream = process.stdout) {
 }
 var SGR = {
   signal: "38;2;45;212;191",
-  // #2dd4bf
   muted: "38;2;138;143;139",
   strong: "1",
   ok: "38;2;74;222;128",
@@ -36,7 +36,7 @@ var fail = (msg) => `${paint("err", "\u2716", process.stderr)} ${msg}`;
 var warn = (msg) => `${paint("warn", "\u26A0")} ${msg}`;
 
 // src/index.ts
-import { hostname } from "os";
+import { hostname as hostname2 } from "os";
 import { join as join6, relative } from "path";
 import cac from "cac";
 
@@ -52,9 +52,10 @@ var DutoApiError = class extends Error {
   code;
 };
 var MESSAGES = {
-  unauthorized: "Authtoken inv\xE1lido. Gere um novo em https://duto.dev e rode: duto login <token>",
-  suspended: "Sua conta est\xE1 suspensa.",
-  network: "N\xE3o consegui falar com duto.dev. Verifique sua conex\xE3o."
+  unauthorized: "This machine is not logged in. Run: duto login",
+  suspended: "Your account is suspended.",
+  network: "Could not reach duto.dev. Check your connection.",
+  loginExpired: "The login code expired. Run duto login again."
 };
 function createApiClient(o) {
   const doFetch = o.fetchImpl ?? fetch;
@@ -64,7 +65,7 @@ function createApiClient(o) {
       res = await doFetch(`${o.baseUrl}${path}`, {
         method,
         headers: {
-          authorization: `Bearer ${o.token}`,
+          ...o.token === void 0 ? {} : { authorization: `Bearer ${o.token}` },
           ...body === void 0 ? {} : { "content-type": "application/json" },
           "user-agent": "duto-cli"
         },
@@ -80,7 +81,7 @@ function createApiClient(o) {
     const code = data.error ?? "http_error";
     if (res.status === 401) throw new DutoApiError(MESSAGES.unauthorized, 401, code);
     if (res.status === 403 && code === "suspended") throw new DutoApiError(MESSAGES.suspended, 403, code);
-    throw new DutoApiError(data.message ?? `Erro ${res.status} ao falar com duto.dev.`, res.status, code);
+    throw new DutoApiError(data.message ?? `duto.dev returned HTTP ${res.status}.`, res.status, code);
   }
   async function json(method, path, body) {
     const res = await call(method, path, body);
@@ -99,6 +100,12 @@ function createApiClient(o) {
       const res = await call("DELETE", `/api/tunnels/${encodeURIComponent(id)}`);
       if (!res.ok && res.status !== 404) await fail3(res);
     },
+    startLogin: (r) => json("POST", "/api/cli/login", r),
+    pollLogin: (deviceCode) => json("POST", "/api/cli/login/poll", { deviceCode }),
+    async revokeSelf() {
+      const res = await call("DELETE", "/api/cli/token");
+      if (!res.ok && res.status !== 401 && res.status !== 404) await fail3(res);
+    },
     me: () => json("GET", "/api/me"),
     endpoints: () => json("GET", "/api/endpoints")
   };
@@ -169,7 +176,7 @@ function assetFor(platform, arch) {
     case "win32/x64":
       return { asset: "cloudflared-windows-amd64.exe", kind: "exe" };
     default:
-      throw new Error(`Plataforma n\xE3o suportada: ${key}`);
+      throw new Error(`Unsupported platform: ${key}`);
   }
 }
 function downloadUrl(asset, version = CLOUDFLARED_VERSION) {
@@ -184,13 +191,13 @@ async function ensureCloudflared(opts = {}) {
   opts.onDownload?.();
   mkdirSync2(binDir, { recursive: true });
   const res = await (opts.fetchImpl ?? fetch)(downloadUrl(asset));
-  if (!res.ok) throw new Error(`N\xE3o consegui baixar o cloudflared (HTTP ${res.status}).`);
+  if (!res.ok) throw new Error(`Could not download cloudflared (HTTP ${res.status}).`);
   const bytes = Buffer.from(await res.arrayBuffer());
   const expected = (opts.checksums ?? CHECKSUMS)[asset];
   const actual = createHash("sha256").update(bytes).digest("hex");
   if (!expected || actual !== expected) {
     rmSync(target, { force: true });
-    throw new Error("Falha na verifica\xE7\xE3o do cloudflared");
+    throw new Error("cloudflared checksum mismatch. Try again; if it keeps failing, update duto.");
   }
   const tmp = mkdtempSync(join2(binDir, ".download-"));
   try {
@@ -217,13 +224,13 @@ async function ensureCloudflaredWithProgress(write, opts = {}) {
       ...opts,
       onDownload: () => {
         downloading = true;
-        write("\u2193 Baixando cloudflared (s\xF3 na primeira vez)... ");
+        write("\u2193 Downloading cloudflared (first run only)... ");
       }
     });
     if (downloading) write("ok\n");
     return path;
   } catch (err) {
-    if (downloading) write("falhou\n");
+    if (downloading) write("failed\n");
     throw err;
   }
 }
@@ -274,8 +281,8 @@ var SOURCES = {
   github: { url: "https://api.github.com/meta", pick: (j) => j?.hooks }
 };
 function splitCidr(raw) {
-  const [ip, p, ...resto] = raw.split("/");
-  if (!ip || resto.length) return null;
+  const [ip, p, ...extra] = raw.split("/");
+  if (!ip || extra.length) return null;
   const v = isIP(ip);
   if (!v) return null;
   const max = v === 4 ? 32 : 128;
@@ -311,9 +318,9 @@ async function fetchRanges(name, f) {
   const res = await f(src.url, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS), headers: { accept: "application/json" } });
   if (!res.ok) throw new Error(`HTTP ${res.status}`);
   const list = src.pick(await res.json());
-  if (!Array.isArray(list)) throw new Error("formato inesperado");
+  if (!Array.isArray(list)) throw new Error("unexpected format");
   const out = list.filter((x) => typeof x === "string" && splitCidr(x) !== null);
-  if (!out.length) throw new Error("lista vazia");
+  if (!out.length) throw new Error("empty list");
   return out.map((x) => x.includes("/") ? x : `${x}/${splitCidr(x).prefix}`);
 }
 async function resolveAllow(entries, o = {}) {
@@ -325,7 +332,8 @@ async function resolveAllow(entries, o = {}) {
   const cached = readCache(cacheFile);
   const fresh = cached && now - cached.fetchedAt >= 0 && now - cached.fetchedAt < CACHE_MS ? cached : null;
   const lists = {};
-  if (fresh && names.every((n) => Array.isArray(fresh.lists[n]) && fresh.lists[n].length)) {
+  const coversEveryName = fresh && names.every((n) => Array.isArray(fresh.lists[n]) && fresh.lists[n].length);
+  if (fresh && coversEveryName) {
     for (const n of names) lists[n] = fresh.lists[n];
   } else {
     const net = {};
@@ -336,7 +344,8 @@ async function resolveAllow(entries, o = {}) {
         lists[name] = ALLOW_SNAPSHOT[name];
       }
     }
-    if (names.length && Object.keys(net).length === names.length) {
+    const everyListFromNetwork = names.length > 0 && Object.keys(net).length === names.length;
+    if (everyListFromNetwork) {
       try {
         mkdirSync3(dirname(cacheFile), { recursive: true });
         writeFileSync3(cacheFile, JSON.stringify({ fetchedAt: now, lists: net }));
@@ -366,7 +375,7 @@ import { dirname as dirname2, join as join4 } from "path";
 import { isMap, isScalar, isSeq, LineCounter, parseDocument } from "yaml";
 var ConfigError = class extends Error {
   constructor(message2, line, file = CONFIG_FILES[0]) {
-    super(!file ? message2 : line ? `${file}, linha ${line}: ${message2}` : `${file}: ${message2}`);
+    super(!file ? message2 : line ? `${file}, line ${line}: ${message2}` : `${file}: ${message2}`);
     this.line = line;
     this.name = "ConfigError";
   }
@@ -376,7 +385,7 @@ var CONFIG_FILES = ["duto.yml", "duto.yaml"];
 var LABEL = "[a-z0-9](?:[a-z0-9-]*[a-z0-9])?";
 var HOST_RE = new RegExp(`^${LABEL}(?:\\.${LABEL})*(?::\\d{1,5})?$`);
 var HEADER_NAME_RE = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
-var TUNNEL_KEYS = ["port", "host", "headers", "rewrite_redirects", "auth", "permitir"];
+var TUNNEL_KEYS = ["port", "host", "headers", "rewrite_redirects", "auth", "allow"];
 var ENV_REF_RE = /\$\{([A-Z_0-9]+)\}/g;
 function parseHost(raw) {
   const host = raw.trim().toLowerCase();
@@ -402,11 +411,11 @@ function parseConfig(text, file = CONFIG_FILES[0], env = process.env) {
   const lineAt = (offset) => offset === void 0 ? void 0 : lc.linePos(offset).line;
   if (doc.errors.length) {
     const e = doc.errors[0];
-    throw fail3("YAML inv\xE1lido. Confira a indenta\xE7\xE3o e os dois-pontos.", lineAt(e.pos[0]));
+    throw fail3("invalid YAML. Check the indentation and the colons.", lineAt(e.pos[0]));
   }
   const tunnels = isMap(doc.contents) ? doc.contents.get("tunnels", true) : void 0;
   if (!isMap(tunnels) || tunnels.items.length === 0) {
-    throw fail3('declare os t\xFAneis em "tunnels:", um por linha (ex.: web: 3000).');
+    throw fail3('declare the tunnels under "tunnels:", one per line (e.g. web: 3000)');
   }
   const specs = [];
   for (const pair of tunnels.items) {
@@ -416,40 +425,40 @@ function parseConfig(text, file = CONFIG_FILES[0], env = process.env) {
     const v = validateName(name);
     if (!v.ok) {
       throw fail3(
-        v.reason === "reserved" ? `nome reservado: "${raw}". Escolha outro.` : `nome inv\xE1lido: "${raw}" (use s\xF3 letras min\xFAsculas e n\xFAmeros, sem h\xEDfen)`,
+        v.reason === "reserved" ? `"${raw}" is reserved. Pick another name.` : `invalid name: "${raw}" (use only lowercase letters and digits, no hyphen)`,
         line
       );
     }
     const port = portOf(pair.value);
-    if (port === null) throw fail3(`porta inv\xE1lida para "${raw}" (use 1\u201365535)`, line);
+    if (port === null) throw fail3(`invalid port for "${raw}" (use 1\u201365535)`, line);
     const spec = { name, port };
     if (isMap(pair.value)) {
       const body = pair.value;
       for (const item of body.items) {
         const key = isScalar(item.key) ? String(item.key.value) : "";
-        if (!TUNNEL_KEYS.includes(key)) throw fail3(`chave desconhecida em "${raw}": ${key} (use port, host, headers, rewrite_redirects, auth ou permitir)`, line);
+        if (!TUNNEL_KEYS.includes(key)) throw fail3(`unknown key in "${raw}": ${key} (use port, host, headers, rewrite_redirects, auth or allow)`, line);
       }
       const hostNode = body.get("host", true);
       if (hostNode !== void 0) {
         const host = isScalar(hostNode) && typeof hostNode.value === "string" ? parseHost(hostNode.value) : null;
-        if (!host) throw fail3(`host inv\xE1lido para "${raw}": use s\xF3 o dom\xEDnio, como meuapp.test`, line);
+        if (!host) throw fail3(`invalid host for "${raw}": use only the domain, like myapp.test`, line);
         spec.host = host;
       }
       const headersNode = body.get("headers", true);
       if (headersNode !== void 0) {
-        if (!isMap(headersNode)) throw fail3(`headers de "${raw}" deve ser uma lista de Nome: valor`, line);
+        if (!isMap(headersNode)) throw fail3(`headers in "${raw}" must be a list of Name: value`, line);
         const headers = {};
         for (const h of headersNode.items) {
           const hName = isScalar(h.key) ? String(h.key.value) : "";
           const hLine = lineAt(h.key?.range?.[0]);
-          if (!HEADER_NAME_RE.test(hName)) throw fail3(`cabe\xE7alho inv\xE1lido em "${raw}": "${hName}"`, hLine);
-          if (hName.toLowerCase() === "host") throw fail3(`para trocar o Host de "${raw}", use host: em vez de headers`, hLine);
+          if (!HEADER_NAME_RE.test(hName)) throw fail3(`invalid header in "${raw}": "${hName}"`, hLine);
+          if (hName.toLowerCase() === "host") throw fail3(`to change the Host of "${raw}", use host: instead of headers`, hLine);
           const value = h.value === null ? null : isScalar(h.value) ? h.value.value : void 0;
           if (value !== null && !["string", "number", "boolean"].includes(typeof value)) {
-            throw fail3(`valor inv\xE1lido para o cabe\xE7alho "${hName}" em "${raw}"`, hLine);
+            throw fail3(`invalid value for header "${hName}" in "${raw}"`, hLine);
           }
           const str = value === null ? "" : String(value);
-          if (/[\r\n]/.test(str)) throw fail3(`valor inv\xE1lido para o cabe\xE7alho "${hName}" em "${raw}"`, hLine);
+          if (/[\r\n]/.test(str)) throw fail3(`invalid value for header "${hName}" in "${raw}"`, hLine);
           headers[hName.toLowerCase()] = str;
         }
         spec.headers = headers;
@@ -457,50 +466,50 @@ function parseConfig(text, file = CONFIG_FILES[0], env = process.env) {
       const rewriteNode = body.get("rewrite_redirects", true);
       if (rewriteNode !== void 0) {
         const value = isScalar(rewriteNode) ? rewriteNode.value : void 0;
-        if (typeof value !== "boolean") throw fail3(`rewrite_redirects de "${raw}" deve ser true ou false`, line);
-        if (!spec.host) throw fail3(`rewrite_redirects de "${raw}" s\xF3 vale junto com host:`, line);
+        if (typeof value !== "boolean") throw fail3(`rewrite_redirects in "${raw}" must be true or false`, line);
+        if (!spec.host) throw fail3(`rewrite_redirects in "${raw}" only works together with host:`, line);
         if (value === false) spec.rewriteRedirects = false;
       }
       const authNode = body.get("auth", true);
       if (authNode !== void 0) {
-        if (!isSeq(authNode)) throw fail3(`auth de "${raw}" deve ser uma lista de usuario:senha`, line);
+        if (!isSeq(authNode)) throw fail3(`auth in "${raw}" must be a list of user:password`, line);
         const auth = [];
         for (const item of authNode.items) {
           const iLine = lineAt(item.range?.[0]) ?? line;
           const text2 = isScalar(item) && typeof item.value === "string" ? item.value : null;
-          if (text2 === null) throw fail3(`credencial inv\xE1lida em "${raw}": use usuario:senha`, iLine);
+          if (text2 === null) throw fail3(`invalid credential in "${raw}": use user:password`, iLine);
           const expanded = text2.replace(ENV_REF_RE, (_m, name2) => {
             const val = env[name2];
-            if (val === void 0) throw fail3(`vari\xE1vel de ambiente ${name2} n\xE3o definida (usada em auth de "${raw}")`, iLine);
+            if (val === void 0) throw fail3(`environment variable ${name2} is not set (used in auth of "${raw}")`, iLine);
             return val;
           });
           const parsed = parseCredential(expanded);
           if (!parsed.ok) {
-            if (parsed.reason === "format") throw fail3(`credencial inv\xE1lida em "${raw}": use usuario:senha`, iLine);
-            if (parsed.reason === "user") throw fail3(`usu\xE1rio inv\xE1lido em "${raw}": de 1 a 128 caracteres, sem espa\xE7o`, iLine);
-            throw fail3(`senha de "${expanded.slice(0, expanded.indexOf(":"))}" em "${raw}" precisa ter de 8 a 128 caracteres`, iLine);
+            if (parsed.reason === "format") throw fail3(`invalid credential in "${raw}": use user:password`, iLine);
+            if (parsed.reason === "user") throw fail3(`invalid user in "${raw}": 1 to 128 characters, no spaces`, iLine);
+            throw fail3(`password for "${expanded.slice(0, expanded.indexOf(":"))}" in "${raw}" must be 8 to 128 characters`, iLine);
           }
-          if (auth.some((c) => c.user === parsed.cred.user)) throw fail3(`usu\xE1rio "${parsed.cred.user}" aparece duas vezes em "${raw}"`, iLine);
+          if (auth.some((c) => c.user === parsed.cred.user)) throw fail3(`user "${parsed.cred.user}" appears twice in "${raw}"`, iLine);
           auth.push(parsed.cred);
         }
-        if (!auth.length) throw fail3(`auth de "${raw}" n\xE3o pode ficar vazia`, line);
+        if (!auth.length) throw fail3(`auth in "${raw}" cannot be empty`, line);
         spec.auth = auth;
       }
-      const allowNode = body.get("permitir", true);
+      const allowNode = body.get("allow", true);
       if (allowNode !== void 0) {
-        if (!isSeq(allowNode)) throw fail3(`permitir de "${raw}" deve ser uma lista`, line);
-        if (!spec.auth) throw fail3(`permitir de "${raw}" s\xF3 vale junto com auth:`, line);
+        if (!isSeq(allowNode)) throw fail3(`allow in "${raw}" must be a list`, line);
+        if (!spec.auth) throw fail3(`allow in "${raw}" only works together with auth:`, line);
         const allow = [];
         for (const item of allowNode.items) {
           const iLine = lineAt(item.range?.[0]) ?? line;
           const value = isScalar(item) ? String(item.value) : "";
-          if (!parseAllowEntry(value)) throw fail3(`permitir de "${raw}": "${value}" n\xE3o \xE9 um nome conhecido (stripe, github) nem uma faixa de IP`, iLine);
+          if (!parseAllowEntry(value)) throw fail3(`allow in "${raw}": "${value}" is not a known name (stripe, github) or an IP range`, iLine);
           allow.push(value);
         }
         if (allow.length) spec.allow = allow;
       }
     }
-    if (specs.some((s) => s.name === name)) throw fail3(`o nome "${raw}" aparece duas vezes`, line);
+    if (specs.some((s) => s.name === name)) throw fail3(`the name "${raw}" appears twice`, line);
     specs.push(spec);
   }
   return specs;
@@ -509,7 +518,7 @@ function findConfig(cwd) {
   let dir = cwd;
   for (; ; ) {
     const present = CONFIG_FILES.filter((f) => existsSync3(join4(dir, f)));
-    if (present.length > 1) throw new ConfigError(`${CONFIG_FILES.join(" e ")} na mesma pasta. Apague um dos dois.`, void 0, "");
+    if (present.length > 1) throw new ConfigError(`${CONFIG_FILES.join(" and ")} in the same folder. Delete one of them.`, void 0, "");
     if (present.length === 1) {
       const path = join4(dir, present[0]);
       return { path, tunnels: parseConfig(readFileSync3(path, "utf8"), present[0]) };
@@ -521,7 +530,96 @@ function findConfig(cwd) {
   }
 }
 
+// src/login.ts
+import { spawn } from "child_process";
+import { hostname } from "os";
+var SLOW_DOWN_MS = 5e3;
+var MAX_NETWORK_ERRORS_IN_A_ROW = 3;
+async function browserLogin(o) {
+  const api = createApiClient({ baseUrl: o.baseUrl, fetchImpl: o.fetchImpl });
+  const start = await api.startLogin({
+    deviceId: o.deviceId,
+    deviceName: hostname(),
+    cliVersion: "1.1.0",
+    nodeVersion: process.version,
+    os: process.platform,
+    arch: process.arch
+  });
+  o.out(`  Visit ${start.verificationUrl}`);
+  tryOpen(o.open, start.verificationUrl);
+  let waitMs = start.interval * 1e3;
+  let networkErrors = 0;
+  for (; ; ) {
+    await o.sleep(waitMs);
+    let poll;
+    try {
+      poll = await api.pollLogin(start.deviceCode);
+      networkErrors = 0;
+    } catch (err) {
+      const isNetwork = err instanceof DutoApiError && err.code === "network";
+      if (!isNetwork || ++networkErrors > MAX_NETWORK_ERRORS_IN_A_ROW) throw err;
+      continue;
+    }
+    if (poll.status === "approved") return { token: poll.token, username: poll.username };
+    if (poll.status === "expired") throw new DutoApiError(MESSAGES.loginExpired, 410, "expired");
+    if (poll.status === "slow_down") waitMs += SLOW_DOWN_MS;
+  }
+}
+function tryOpen(open, url) {
+  try {
+    open(url);
+  } catch {
+    return;
+  }
+}
+function openCommand(url) {
+  if (process.platform === "darwin") return { command: "open", args: [url] };
+  if (process.platform === "win32") return { command: "cmd", args: ["/c", "start", '""', url] };
+  return { command: "xdg-open", args: [url] };
+}
+function loggedInLine(username) {
+  return ok(`Logged in as ${username}.`);
+}
+function loginSuccessLines(username) {
+  return [
+    loggedInLine(username),
+    "",
+    "To open a tunnel, run `duto 3000`, or `duto` in a folder with a duto.yml."
+  ];
+}
+function openBrowser(url) {
+  try {
+    const { command, args } = openCommand(url);
+    const child = spawn(command, args, { detached: true, stdio: "ignore" });
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+    return;
+  }
+}
+var FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
+function startSpinner(label, stream = process.stderr) {
+  if (!stream.isTTY) {
+    stream.write(`${label}
+`);
+    return () => {
+    };
+  }
+  let frame = 0;
+  const draw = () => stream.write(`\r${FRAMES[frame++ % FRAMES.length]} ${label}`);
+  draw();
+  const timer = setInterval(draw, 80);
+  return () => {
+    clearInterval(timer);
+    stream.write("\r\x1B[K");
+  };
+}
+
 // src/inspector/jsonView.ts
+function countLabel(n, one, many) {
+  return n + " " + (n === 1 ? one : many);
+}
 function jsonSyntaxError(text) {
   try {
     JSON.parse(text);
@@ -697,14 +795,15 @@ th { color: ${JSON_KEY}; font-weight: 400; white-space: nowrap; }
 }
 `;
 var SCRIPT = String.raw`"use strict";
+var countLabel = (${countLabel.toString()});
 var jsonSyntaxError = (${jsonSyntaxError.toString()});
 var jsonTokens = (${jsonTokens.toString()});
 var jsonIndent = (${jsonIndent.toString()});
 var COLORS = ${JSON.stringify(C)};
 var TOKEN = new URLSearchParams(location.search).get("t") || "";
-var TABS = ["Corpo", "Cabeçalhos", "Resposta", "Raw"];
+var TABS = ["Body", "Headers", "Response", "Raw"];
 
-var state = { items: [], tunnels: [], selected: null, detail: null, detailKey: "", tab: "Corpo", ended: false };
+var state = { items: [], tunnels: [], selected: null, detail: null, detailKey: "", tab: "Body", ended: false };
 var listSeq = 0, detailSeq = 0, msgTimer = null;
 var es = null, lost = false, replaying = false;
 function fail(e) { if (!state.ended) console.error(e); }
@@ -725,12 +824,12 @@ function banner(text) {
 }
 function ended() {
   state.ended = true;
-  banner("Sessão encerrada; abra o inspetor de novo pela tecla i.");
+  banner("Session ended. Press i in duto to open the inspector again.");
   if (es) es.close();
 }
 
 function api(path, method) {
-  return fetch(path, { method: method || "GET", headers: { "X-Duto-Inspetor": TOKEN }, cache: "no-store" }).then(function (r) {
+  return fetch(path, { method: method || "GET", headers: { "X-Duto-Inspector": TOKEN }, cache: "no-store" }).then(function (r) {
     if (r.status === 403) { ended(); throw new Error("403"); }
     return r.json().then(function (body) { return { status: r.status, body: body }; });
   });
@@ -742,22 +841,20 @@ function statusInfo(it) {
     var color = s >= 500 ? COLORS.err : s >= 400 ? COLORS.warn : s >= 300 ? COLORS.signal : COLORS.ok;
     return { text: String(s), color: color };
   }
-  if (it.error) return { text: "erro", color: COLORS.err };
+  if (it.error) return { text: "error", color: COLORS.err };
   return { text: "…", color: COLORS.muted };
 }
 function duration(it) { return it.durationMs === null || it.durationMs === undefined ? "" : it.durationMs + " ms"; }
 function size(n) {
   if (n < 1024) return n + " B";
-  if (n < 1024 * 1024) return (n / 1024).toFixed(1).replace(".", ",") + " KB";
-  return (n / 1024 / 1024).toFixed(1).replace(".", ",") + " MB";
+  if (n < 1024 * 1024) return (n / 1024).toFixed(1) + " KB";
+  return (n / 1024 / 1024).toFixed(1) + " MB";
 }
 function methodOf(it) { return it.websocket ? "WS" : it.method; }
 function header(h, name) {
   for (var k in h) if (k.toLowerCase() === name) return h[k];
   return "";
 }
-
-// Mesma regra do filtro da tela do terminal.
 function visible() {
   var f = $("filter").value.trim().toLowerCase();
   if (!f) return state.items;
@@ -768,13 +865,13 @@ function visible() {
 
 function renderTop() {
   var n = state.items.length;
-  $("count").textContent = n + (n === 1 ? " requisição" : " requisições");
+  $("count").textContent = countLabel(n, "request", "requests");
   var box = $("tunnels");
   clear(box);
   state.tunnels.forEach(function (t) {
     var s = el("span");
     s.appendChild(el("span", "k", t.key));
-    s.appendChild(document.createTextNode(" " + (t.url || "sem endereço ainda")));
+    s.appendChild(document.createTextNode(" " + (t.url || "no URL yet")));
     box.appendChild(s);
   });
 }
@@ -786,7 +883,7 @@ function renderList() {
   clear(list);
   var items = visible();
   if (items.length === 0) {
-    list.appendChild(el("div", "empty", state.items.length === 0 ? "Nenhuma requisição ainda." : "Nada casa com o filtro."));
+    list.appendChild(el("div", "empty", state.items.length === 0 ? "No requests yet." : "No requests match the filter."));
     return;
   }
   items.forEach(function (it) {
@@ -812,7 +909,7 @@ function renderList() {
 
 function loadList() {
   var seq = ++listSeq;
-  return Promise.all([api("/api/requisicoes"), api("/api/sessao")]).then(function (rs) {
+  return Promise.all([api("/api/requests"), api("/api/session")]).then(function (rs) {
     if (seq !== listSeq) return;
     state.items = rs[0].body.items || [];
     state.tunnels = rs[1].body.tunnels || [];
@@ -837,13 +934,13 @@ function select(id) {
 
 function loadDetail(id) {
   var seq = ++detailSeq;
-  return api("/api/requisicoes/" + id).then(function (r) {
+  return api("/api/requests/" + id).then(function (r) {
     if (seq !== detailSeq || state.selected !== id) return;
     var key = JSON.stringify(r.body);
-    if (key === state.detailKey) return; // nada mudou: mantém dobras e rolagem
+    if (key === state.detailKey) return;
     state.detailKey = key;
     state.detail = r.status === 200 ? r.body : null;
-    if (r.status !== 200) renderGone(r.body && r.body.error ? r.body.error : "Essa requisição já saiu da lista.");
+    if (r.status !== 200) renderGone(r.body && r.body.error ? r.body.error : "That request is no longer in the list.");
     else renderDetail();
   }).catch(fail);
 }
@@ -872,7 +969,7 @@ function renderDetail() {
   if (duration(d)) parts.push(duration(d));
   parts.push(size(d.bytes));
   parts.push(d.tunnel);
-  if (d.replayOf !== undefined) parts.push("↻ reenvio de #" + d.replayOf);
+  if (d.replayOf !== undefined) parts.push("↻ replay of #" + d.replayOf);
   head.appendChild(el("span", "mut", " · " + parts.join(" · ")));
   if (d.error) head.appendChild(el("div", "msg err", d.error));
 
@@ -891,12 +988,12 @@ function renderContent() {
   var box = $("content");
   var top = box.scrollTop;
   clear(box);
-  if (state.tab === "Corpo") renderBody(box, d.reqBody, d.reqNote, d.reqTruncatedNote, d.reqHeaders);
-  else if (state.tab === "Cabeçalhos") box.appendChild(table(d.reqHeaders));
-  else if (state.tab === "Resposta") {
-    box.appendChild(el("div", "sect", "Cabeçalhos"));
+  if (state.tab === "Body") renderBody(box, d.reqBody, d.reqNote, d.reqTruncatedNote, d.reqHeaders);
+  else if (state.tab === "Headers") box.appendChild(table(d.reqHeaders));
+  else if (state.tab === "Response") {
+    box.appendChild(el("div", "sect", "Headers"));
     box.appendChild(table(d.resHeaders));
-    box.appendChild(el("div", "sect", "Corpo"));
+    box.appendChild(el("div", "sect", "Body"));
     renderBody(box, d.resBody, d.resNote, d.resTruncatedNote, d.resHeaders);
   } else {
     var lines = [d.method + " " + d.path + " HTTP/1.1"];
@@ -910,7 +1007,7 @@ function renderContent() {
 
 function table(h) {
   var keys = Object.keys(h || {});
-  if (keys.length === 0) return el("div", "note", "Sem cabeçalhos.");
+  if (keys.length === 0) return el("div", "note", "No headers.");
   var t = el("table");
   keys.forEach(function (k) {
     var tr = el("tr");
@@ -927,7 +1024,7 @@ function renderBody(box, body, note, truncNote, headers) {
     return;
   }
   if (body === null || body === undefined) {
-    box.appendChild(el("div", "note", "Sem corpo."));
+    box.appendChild(el("div", "note", "No body."));
   } else if (header(headers, "content-type").toLowerCase().indexOf("json") >= 0) {
     var err = jsonSyntaxError(body);
     if (err === null) box.appendChild(jsonTree(jsonIndent(body)));
@@ -947,8 +1044,6 @@ function renderBody(box, body, note, truncNote, headers) {
 }
 
 var KIND = { key: "k", string: "s", number: "n", literal: "n", punct: "", space: "" };
-
-// JSON colorido; clicar no { ou [ recolhe para "{ ▸ N campos }".
 function jsonTree(text) {
   var pre = el("pre");
   var stack = [{ node: pre }];
@@ -973,8 +1068,8 @@ function jsonTree(text) {
       var n = c.has ? c.count + 1 : 0;
       if (n > 0) {
         c.wrap.dataset.n = String(n);
-        c.open.title = "recolher ou abrir";
-        c.sum.textContent = " ▸ " + n + (c.obj ? (n === 1 ? " campo " : " campos ") : n === 1 ? " item " : " itens ");
+        c.open.title = "collapse or expand";
+        c.sum.textContent = " ▸ " + (c.obj ? countLabel(n, "field", "fields") : countLabel(n, "item", "items")) + " ";
       } else c.open.className = "";
       c.wrap.appendChild(document.createTextNode(t.text));
       return;
@@ -1006,13 +1101,11 @@ function renderButtons() {
   var notes = [];
   if (d.curl !== null && d.curlNote) notes.push(d.curlNote);
   var tunnel = state.tunnels.filter(function (t) { return t.key === d.tunnel; })[0];
-  if (d.curl !== null && tunnel && tunnel.auth) notes.push("Troque SENHA pela senha do túnel.");
+  if (d.curl !== null && tunnel && tunnel.auth) notes.push("Replace PASSWORD with the tunnel password.");
   $("curlNote").textContent = notes.join(" ");
 }
-
-// "Copiar corpo" copia o corpo da aba ativa: a resposta na aba Resposta, senão a requisição.
 function copyable(d) {
-  return state.tab === "Resposta" ? { text: d.resBody, note: d.resNote } : { text: d.reqBody, note: d.reqNote };
+  return state.tab === "Response" ? { text: d.resBody, note: d.resNote } : { text: d.reqBody, note: d.reqNote };
 }
 
 function showMsg(text, isErr) {
@@ -1031,10 +1124,10 @@ function hideMsg() {
 
 function copy(text) {
   navigator.clipboard.writeText(text).then(function () {
-    showMsg("Copiado.", false);
+    showMsg("Copied.", false);
     msgTimer = setTimeout(hideMsg, 2000);
   }, function () {
-    showMsg("Não deu para copiar.", true);
+    showMsg("Could not copy.", true);
   });
 }
 
@@ -1045,14 +1138,14 @@ function replay() {
   if (replaying) return;
   replaying = true;
   $("replay").disabled = true;
-  api("/api/requisicoes/" + d.id + "/reenviar", "POST").then(function (r) {
+  api("/api/requests/" + d.id + "/replay", "POST").then(function (r) {
     replaying = false;
     if (state.detail) renderButtons();
     if (r.body && r.body.ok) {
       hideMsg();
       return loadList().then(function () { return select(r.body.id); });
     }
-    showMsg(r.body && r.body.reason ? r.body.reason : "Não deu para reenviar.", true);
+    showMsg(r.body && r.body.reason ? r.body.reason : "Could not replay.", true);
   }).catch(function (e) {
     replaying = false;
     if (state.detail) renderButtons();
@@ -1071,11 +1164,10 @@ function move(delta) {
 
 function connect() {
   if (state.ended) return;
-  es = new EventSource("/api/eventos?t=" + encodeURIComponent(TOKEN));
+  es = new EventSource("/api/events?t=" + encodeURIComponent(TOKEN));
   es.addEventListener("open", function () {
     if (state.ended) return;
     banner("");
-    // Reconectou: o que mudou no meio do caminho não chegou por evento.
     if (lost) {
       lost = false;
       loadList();
@@ -1085,22 +1177,18 @@ function connect() {
   es.addEventListener("error", function () {
     if (state.ended) return;
     lost = true;
-    banner("Desconectado da sessão.");
-    // Resposta não 200 (ex.: 403 de outra sessão) fecha o EventSource de vez.
+    banner("Disconnected from the session.");
     if (es.readyState === 2) probe();
   });
-  es.addEventListener("mudou", function (ev) {
+  es.addEventListener("changed", function (ev) {
     var ids = [];
     try { ids = JSON.parse(ev.data).ids || []; } catch (e) {}
     loadList();
-    // Lista vazia de ids: algo mudou fora da assinatura; busca o detalhe de novo também.
     if (state.selected !== null && (ids.length === 0 || ids.indexOf(state.selected) >= 0)) loadDetail(state.selected);
   });
 }
-
-// EventSource fechado: a API diz se a sessão acabou (403 → ended) ou se dá para reconectar.
 function probe() {
-  api("/api/sessao").then(function () {
+  api("/api/session").then(function () {
     if (!state.ended) setTimeout(connect, 3000);
   }, function () {
     if (!state.ended) setTimeout(connect, 3000);
@@ -1150,35 +1238,35 @@ function init() {
 init();
 `;
 function inspectorPage(nonce) {
-  const tabs = ["Corpo", "Cabe\xE7alhos", "Resposta", "Raw"].map((t, i) => `<button type="button" class="tab${i === 0 ? " on" : ""}" role="tab" data-tab="${t}">${t}</button>`).join("");
+  const tabs = ["Body", "Headers", "Response", "Raw"].map((t, i) => `<button type="button" class="tab${i === 0 ? " on" : ""}" role="tab" data-tab="${t}">${t}</button>`).join("");
   return `<!doctype html>
-<html lang="pt-BR">
+<html lang="en">
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
-<title>duto \xB7 inspetor</title>
+<title>duto \xB7 inspector</title>
 <link rel="icon" href="data:,">
 <style nonce="${nonce}">${STYLE}</style>
 </head>
 <body>
 <div class="app">
-  <div class="top"><span><b>\u25B0 duto</b> \xB7 inspetor \xB7 <span id="count">0 requisi\xE7\xF5es</span></span><span class="tunnels" id="tunnels"></span></div>
+  <div class="top"><span><b>\u25B0 duto</b> \xB7 inspector \xB7 <span id="count">0 requests</span></span><span class="tunnels" id="tunnels"></span></div>
   <div class="banner" id="banner" role="status" hidden></div>
   <div class="main">
     <div class="side">
-      <input class="search" id="filter" type="search" placeholder="filtrar\u2026" aria-label="Filtrar requisi\xE7\xF5es" autocomplete="off" spellcheck="false">
-      <div class="list" id="list" role="listbox" aria-label="Requisi\xE7\xF5es"></div>
+      <input class="search" id="filter" type="search" placeholder="filter\u2026" aria-label="Filter requests" autocomplete="off" spellcheck="false">
+      <div class="list" id="list" role="listbox" aria-label="Requests"></div>
     </div>
     <div class="detail">
-      <div class="empty" id="none">Escolha uma requisi\xE7\xE3o na lista.</div>
+      <div class="empty" id="none">Select a request from the list.</div>
       <div class="detail pane" id="detail" hidden>
         <div class="head" id="head"></div>
         <div class="tabs" role="tablist">${tabs}</div>
         <div class="content" id="content"></div>
         <div class="btns">
-          <span><button type="button" class="btn pri" id="replay">\u21BB Reenviar</button></span>
-          <span><button type="button" class="btn" id="copyBody">Copiar corpo</button></span>
-          <span><button type="button" class="btn" id="copyCurl">Copiar como curl</button></span>
+          <span><button type="button" class="btn pri" id="replay">\u21BB Replay</button></span>
+          <span><button type="button" class="btn" id="copyBody">Copy body</button></span>
+          <span><button type="button" class="btn" id="copyCurl">Copy as curl</button></span>
           <span class="msg" id="curlNote"></span>
           <span class="msg" id="msg" role="status" hidden></span>
         </div>
@@ -1197,21 +1285,21 @@ import { createHash as createHash2, randomBytes, timingSafeEqual } from "crypto"
 import { createServer } from "http";
 
 // src/session/replay.ts
-var tunnelClosedReason = (tunnel2) => `O t\xFAnel ${tunnel2} n\xE3o est\xE1 aberto nesta sess\xE3o.`;
+var tunnelClosedReason = (tunnel2) => `Tunnel ${tunnel2} is not open in this session.`;
 function replayBlock(r) {
-  if (!r) return "Essa requisi\xE7\xE3o j\xE1 saiu da lista.";
-  if (r.websocket) return "WebSocket n\xE3o d\xE1 para reenviar.";
+  if (!r) return "That request is no longer in the list.";
+  if (r.websocket) return "WebSocket requests cannot be replayed.";
   if (r.noReplay) return r.noReplay;
-  if (r.access?.kind === "denied") return "Barrada pela senha do t\xFAnel; n\xE3o d\xE1 para reenviar.";
-  if (!r.reqComplete) return "A requisi\xE7\xE3o ainda n\xE3o chegou inteira.";
-  if (r.reqTruncated) return "Corpo acima de 64 KB; n\xE3o d\xE1 para reenviar.";
-  if (r.reqBodyBytes > 0 && r.reqRaw === null) return "Corpo bin\xE1rio n\xE3o \xE9 guardado; n\xE3o d\xE1 para reenviar.";
+  if (r.access?.kind === "denied") return "Blocked by the tunnel password; cannot replay.";
+  if (!r.reqComplete) return "The request has not fully arrived yet.";
+  if (r.reqTruncated) return "Body over 64 KB; cannot replay.";
+  if (r.reqBodyBytes > 0 && r.reqRaw === null) return "Binary body is not stored; cannot replay.";
   return null;
 }
-var DROP = /* @__PURE__ */ new Set(["connection", "keep-alive", "transfer-encoding", "expect", "content-length", "upgrade", "te", "trailer", "proxy-connection"]);
+var HOP_BY_HOP_AND_BODY_HEADERS = /* @__PURE__ */ new Set(["connection", "keep-alive", "transfer-encoding", "expect", "content-length", "upgrade", "te", "trailer", "proxy-connection"]);
 function replayHeaders(r) {
   const out = {};
-  for (const [k, v] of Object.entries(r.reqHeaders)) if (!DROP.has(k.toLowerCase())) out[k] = v;
+  for (const [k, v] of Object.entries(r.reqHeaders)) if (!HOP_BY_HOP_AND_BODY_HEADERS.has(k.toLowerCase())) out[k] = v;
   const hadLength = Object.keys(r.reqHeaders).some((k) => k.toLowerCase() === "content-length");
   if (r.reqBodyBytes > 0 || hadLength) out["content-length"] = String(r.reqRaw?.length ?? 0);
   return out;
@@ -1232,7 +1320,7 @@ function toCurl(r, o) {
   for (const [k, v] of Object.entries(r.reqHeaders)) {
     if (!skip(k)) parts.push(`-H ${shellQuote(`${k}: ${v}`)}`);
   }
-  if (o.authUser !== null) parts.push(`-H ${shellQuote(`X-Duto-Auth: ${o.authUser}:SENHA`)}`);
+  if (o.authUser !== null) parts.push(`-H ${shellQuote(`X-Duto-Auth: ${o.authUser}:PASSWORD`)}`);
   if (r.reqBody !== null) parts.push(`--data-binary ${shellQuote(r.reqBody)}`);
   return parts.join(" \\\n  ");
 }
@@ -1240,12 +1328,12 @@ function toCurl(r, o) {
 // src/inspector/server.ts
 var DEFAULT_PORT = 4141;
 var PORT_TRIES = 20;
-var NO_TOKEN = "Abra o inspetor pela tecla i da tela do duto ou pelo endere\xE7o impresso no terminal.";
-var GONE = "Essa requisi\xE7\xE3o j\xE1 saiu da lista.";
-var NO_URL = "O t\xFAnel ainda n\xE3o tem endere\xE7o p\xFAblico.";
-var CURL_BYTES = "O corpo do curl pode n\xE3o ser id\xEAntico ao recebido (bytes fora de UTF-8).";
+var NO_TOKEN = "Open the inspector with the i key in the duto screen, or with the address printed in the terminal.";
+var GONE = "That request is no longer in the list.";
+var NO_URL = "The tunnel has no public URL yet.";
+var CURL_BYTES = "The curl body may differ from the one received (non-UTF-8 bytes).";
 var sha = (s) => createHash2("sha256").update(s).digest();
-var same = (a, b) => timingSafeEqual(sha(a), sha(b));
+var constantTimeEqual = (a, b) => timingSafeEqual(sha(a), sha(b));
 var first = (v) => Array.isArray(v) ? v[0] : v;
 function listItem(r) {
   return {
@@ -1308,7 +1396,7 @@ async function startInspector(o) {
       if (seen.get(r.id) !== s) ids.push(r.id);
     }
     seen = next;
-    const msg = `event: mudou
+    const msg = `event: changed
 data: ${JSON.stringify({ ids })}
 
 `;
@@ -1339,19 +1427,19 @@ data: ${JSON.stringify({ ids })}
   const handle = (req, res) => {
     base(res);
     const host = first(req.headers.host)?.toLowerCase();
-    if (host !== `127.0.0.1:${port}` && host !== `localhost:${port}`) return text(res, 403, "Host n\xE3o permitido.");
+    if (host !== `127.0.0.1:${port}` && host !== `localhost:${port}`) return text(res, 403, "Host not allowed.");
     let url2;
     try {
       url2 = new URL(req.url ?? "/", `http://127.0.0.1:${port}`);
     } catch {
-      return text(res, 404, "N\xE3o encontrado.");
+      return text(res, 404, "Not found.");
     }
     const path = url2.pathname;
     const method = req.method ?? "GET";
     const queryToken = url2.searchParams.get("t") ?? "";
-    const headerToken = first(req.headers["x-duto-inspetor"]) ?? "";
+    const headerToken = first(req.headers["x-duto-inspector"]) ?? "";
     if (method === "GET" && path === "/") {
-      if (!same(queryToken, token)) return text(res, 403, NO_TOKEN);
+      if (!constantTimeEqual(queryToken, token)) return text(res, 403, NO_TOKEN);
       const nonce = randomBytes(16).toString("base64url");
       res.writeHead(200, {
         "Content-Type": "text/html; charset=utf-8",
@@ -1359,11 +1447,11 @@ data: ${JSON.stringify({ ids })}
       });
       return void res.end(o.page(nonce));
     }
-    const isEvents = method === "GET" && path === "/api/eventos";
-    const detailId = /^\/api\/requisicoes\/([1-9]\d{0,15})(\/reenviar)?$/.exec(path);
-    const known = method === "GET" && (path === "/api/sessao" || path === "/api/requisicoes" || detailId && !detailId[2]) || isEvents || method === "POST" && detailId && detailId[2];
-    if (!known) return text(res, 404, "N\xE3o encontrado.");
-    if (!same(headerToken, token) && !(isEvents && same(queryToken, token))) return json(res, 403, { error: NO_TOKEN });
+    const isEvents = method === "GET" && path === "/api/events";
+    const detailId = /^\/api\/requests\/([1-9]\d{0,15})(\/replay)?$/.exec(path);
+    const known = method === "GET" && (path === "/api/session" || path === "/api/requests" || detailId && !detailId[2]) || isEvents || method === "POST" && detailId && detailId[2];
+    if (!known) return text(res, 404, "Not found.");
+    if (!constantTimeEqual(headerToken, token) && !(isEvents && constantTimeEqual(queryToken, token))) return json(res, 403, { error: NO_TOKEN });
     if (isEvents) {
       res.writeHead(200, { "Content-Type": "text/event-stream; charset=utf-8", Connection: "keep-alive" });
       res.write(": duto\n\n");
@@ -1372,10 +1460,10 @@ data: ${JSON.stringify({ ids })}
       res.on("close", () => clients.delete(res));
       return;
     }
-    if (path === "/api/sessao") {
+    if (path === "/api/session") {
       return json(res, 200, { tunnels: session.getState().tunnels.map((t) => ({ key: t.key, url: t.url, auth: !!t.auth })) });
     }
-    if (path === "/api/requisicoes") return json(res, 200, { items: session.records.list().map(listItem) });
+    if (path === "/api/requests") return json(res, 200, { items: session.records.list().map(listItem) });
     const id = Number(detailId[1]);
     if (!Number.isSafeInteger(id)) return json(res, 404, { error: GONE });
     if (method === "POST") return json(res, 200, session.replay(id));
@@ -1387,7 +1475,7 @@ data: ${JSON.stringify({ ids })}
     try {
       handle(req, res);
     } catch {
-      if (!res.headersSent) text(res, 500, "Erro interno.");
+      if (!res.headersSent) text(res, 500, "Internal error.");
       else res.end();
     }
   });
@@ -1437,7 +1525,7 @@ data: ${JSON.stringify({ ids })}
 }
 
 // src/session/session.ts
-import { spawn } from "child_process";
+import { spawn as spawn2 } from "child_process";
 
 // src/portcheck.ts
 import { connect } from "net";
@@ -1460,10 +1548,11 @@ async function isPortListening(port, timeoutMs = 500) {
 
 // src/session/auth.ts
 import { createHash as createHash3, createHmac, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "crypto";
-var TUNNEL_COOKIE = "__Host-duto_tunel";
+var TUNNEL_COOKIE = "__Host-duto_tunnel";
+var SEC_FETCH_SITE_SAME_SITE = "same-site";
 var QR_TTL_MS = 5 * 6e4;
 var sha2 = (s) => createHash3("sha256").update(s).digest();
-var same2 = (a, b) => timingSafeEqual2(sha2(a), sha2(b));
+var constantTimeEqual2 = (a, b) => timingSafeEqual2(sha2(a), sha2(b));
 function splitPair(raw) {
   const i = raw.indexOf(":");
   return i < 0 ? null : { user: raw.slice(0, i), password: raw.slice(i + 1) };
@@ -1475,7 +1564,7 @@ function parseBasic(value) {
 var first2 = (v) => Array.isArray(v) ? v[0] : v;
 var bareHost = (s) => s.replace(/:\d+$/, "").toLowerCase();
 function sameHostOrigin(h) {
-  if (first2(h["sec-fetch-site"])?.toLowerCase() === "same-site") return false;
+  if (first2(h["sec-fetch-site"])?.toLowerCase() === SEC_FETCH_SITE_SAME_SITE) return false;
   const origin = first2(h.origin);
   if (origin === void 0) return true;
   let host;
@@ -1510,16 +1599,16 @@ var TunnelAuth = class {
     }
     const cookieUser = this.cookieUser(h.cookie);
     if (cookieUser && sameHostOrigin(h)) return { kind: "user", user: cookieUser };
-    const duto = first2(h["x-duto-auth"]);
-    const cand = duto !== void 0 ? splitPair(duto) : parseBasic(first2(h.authorization));
-    if (cand && this.checkPassword(cand.user, cand.password)) return { kind: "user", user: cand.user };
+    const dutoAuthHeader = first2(h["x-duto-auth"]);
+    const candidate = dutoAuthHeader !== void 0 ? splitPair(dutoAuthHeader) : parseBasic(first2(h.authorization));
+    if (candidate && this.checkPassword(candidate.user, candidate.password)) return { kind: "user", user: candidate.user };
     return { kind: "denied" };
   }
   checkPassword(user, password) {
     let ok2 = false;
     for (const c of this.credentials) {
-      const userOk = same2(c.user, user);
-      const passOk = same2(c.password, password);
+      const userOk = constantTimeEqual2(c.user, user);
+      const passOk = constantTimeEqual2(c.password, password);
       if (userOk && passOk) ok2 = true;
     }
     return ok2;
@@ -1536,7 +1625,7 @@ var TunnelAuth = class {
   }
   consumeQrToken(token) {
     const qr = this.qr;
-    if (!qr || !same2(qr.token, token)) return false;
+    if (!qr || !constantTimeEqual2(qr.token, token)) return false;
     this.qr = null;
     return this.now() <= qr.expiresAt;
   }
@@ -1554,7 +1643,6 @@ var TunnelAuth = class {
     }
     return out;
   }
-  // Valor: usuário em base64url + "." + HMAC(túnel, usuário).
   cookieValue(user) {
     return `${Buffer.from(user).toString("base64url")}.${this.sign(user)}`;
   }
@@ -1567,10 +1655,10 @@ var TunnelAuth = class {
     for (const p of list) {
       const item = p.trim();
       if (!item.startsWith(`${TUNNEL_COOKIE}=`)) continue;
-      const [b64, sig2, ...resto] = item.slice(TUNNEL_COOKIE.length + 1).split(".");
-      if (!b64 || !sig2 || resto.length) continue;
+      const [b64, sig2, ...extra] = item.slice(TUNNEL_COOKIE.length + 1).split(".");
+      if (!b64 || !sig2 || extra.length) continue;
       const user = Buffer.from(b64, "base64url").toString("utf8");
-      if (same2(sig2, this.sign(user)) && this.credentials.some((c) => c.user === user)) return user;
+      if (constantTimeEqual2(sig2, this.sign(user)) && this.credentials.some((c) => c.user === user)) return user;
     }
     return null;
   }
@@ -1622,14 +1710,14 @@ var WAIT_SCRIPT = `
   }
   function again() { delay = Math.min(delay * 2, 30000); poll(); }
   if (!window.EventSource) return poll();
-  var fails = 0, es = new EventSource("/__duto/espera");
+  var fails = 0, es = new EventSource("/__duto/wait");
   es.addEventListener("up", function () { es.close(); location.reload(); });
   es.onerror = function () { if (++fails >= 3) { es.close(); poll(); } };
 })();
 </script>`;
 function pageShell(title, body, css = "") {
   return `<!doctype html>
-<html lang="pt-BR">
+<html lang="en">
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
@@ -1661,13 +1749,13 @@ function unavailablePage(o) {
   const tunnel2 = esc(o.tunnel);
   const local = `localhost:${o.port}`;
   return pageShell(
-    `Nada respondendo em ${local} \xB7 duto`,
+    `Nothing responding on ${local} \xB7 duto`,
     `<main>
 <div class="mark"><span class="dot"></span>duto \xB7 ${tunnel2}</div>
-<h1>Nada respondendo em <code>${local}</code></h1>
-<p>O t\xFAnel <code>${tunnel2}</code> est\xE1 no ar, mas o servi\xE7o local n\xE3o respondeu. Suba o servidor na m\xE1quina que abriu o t\xFAnel.</p>
-<p>Se voc\xEA s\xF3 recebeu este link, avise quem o enviou.</p>
-<div class="retry">${o.retry ? `<b>Aguardando o servi\xE7o.</b> A p\xE1gina volta sozinha quando ele responder.<noscript> Recarregue quando o servi\xE7o estiver no ar.</noscript>` : "Recarregue a p\xE1gina quando o servi\xE7o estiver no ar."}</div>
+<h1>Nothing is responding on <code>${local}</code></h1>
+<p>The tunnel <code>${tunnel2}</code> is live, but your local service did not respond. Start the server on the machine that opened the tunnel.</p>
+<p>If you were only sent this link, let whoever shared it know.</p>
+<div class="retry">${o.retry ? `<b>Waiting for the service.</b> This page reloads when it responds.<noscript> Reload once the service is up.</noscript>` : "Reload the page once the service is up."}</div>
 </main>${o.retry ? WAIT_SCRIPT : ""}`
   );
 }
@@ -1680,35 +1768,35 @@ button{margin-top:18px;width:100%;padding:10px;border:0;border-radius:.3rem;back
 .error{margin:14px 0 0;color:#b42318;font-weight:600}
 @media (prefers-color-scheme:dark){.error{color:#f97066}}
 `;
-function safeVolta(raw) {
+function safeNext(raw) {
   if (!raw || !raw.startsWith("/") || raw.startsWith("//") || raw.startsWith("/\\")) return "/";
   return /^[\x21-\x7e]+$/.test(raw) ? raw : "/";
 }
 function loginPage(o) {
   return pageShell(
-    "Entrar \xB7 duto",
+    "Sign in \xB7 duto",
     `<main>
 <div class="mark"><span class="dot"></span>duto \xB7 ${esc(o.tunnel)}</div>
-<h1>Este t\xFAnel tem senha</h1>
-<p>Pe\xE7a o acesso a quem enviou o link.</p>
-<form method="post" action="/__duto/entrar">
-<input type="hidden" name="volta" value="${esc(o.volta)}">
-<label for="usuario">Usu\xE1rio</label>
-<input id="usuario" name="usuario" autocomplete="username" autocapitalize="none" spellcheck="false" required autofocus>
-<label for="senha">Senha</label>
-<input id="senha" name="senha" type="password" autocomplete="current-password" required>
-${o.error ? `<p class="error" role="alert">Usu\xE1rio ou senha incorretos.</p>
-` : ""}<button type="submit">Entrar</button>
+<h1>This tunnel is password protected</h1>
+<p>Ask whoever sent you the link for access.</p>
+<form method="post" action="/__duto/login">
+<input type="hidden" name="next" value="${esc(o.next)}">
+<label for="username">Username</label>
+<input id="username" name="username" autocomplete="username" autocapitalize="none" spellcheck="false" required autofocus>
+<label for="password">Password</label>
+<input id="password" name="password" type="password" autocomplete="current-password" required>
+${o.error ? `<p class="error" role="alert">Wrong username or password.</p>
+` : ""}<button type="submit">Sign in</button>
 </form>
-<div class="retry">Voc\xEA continua conectado at\xE9 o t\xFAnel fechar.</div>
+<div class="retry">You stay signed in until you close the browser or the tunnel closes.</div>
 </main>`,
     CSS
   );
 }
 
 // src/session/proxy.ts
-var DENIED_NO_REPLAY = "Barrada pela senha do t\xFAnel; n\xE3o d\xE1 para reenviar.";
-var PREFLIGHT_NO_REPLAY = "Preflight de CORS n\xE3o d\xE1 para reenviar.";
+var DENIED_NO_REPLAY = "Blocked by the tunnel password; cannot replay.";
+var PREFLIGHT_NO_REPLAY = "CORS preflight cannot be replayed.";
 var TEXT2 = /^(text\/|application\/(json|xml|javascript|x-www-form-urlencoded|graphql)|[^;]*\+(json|xml))/i;
 var MAX_BODY = 64 * 1024;
 var LOCAL_AGENT = new Agent({ keepAlive: false });
@@ -1726,7 +1814,6 @@ var Capture = class {
   max;
   chunks = [];
   size = 0;
-  /** Bytes vistos, capturados ou não. */
   total = 0;
   truncated = false;
   push(c) {
@@ -1749,6 +1836,7 @@ var Capture = class {
     return this.enabled && this.size > 0 ? Buffer.concat(this.chunks).toString("utf8") : null;
   }
 };
+var HOST_CACHE_MS = 5e3;
 var hostCache = /* @__PURE__ */ new Map();
 function probe(host, port) {
   return new Promise((resolve) => {
@@ -1764,7 +1852,7 @@ function probe(host, port) {
 }
 async function localHost(port) {
   const hit = hostCache.get(port);
-  if (hit && Date.now() - hit.at < 5e3) return hit.host;
+  if (hit && Date.now() - hit.at < HOST_CACHE_MS) return hit.host;
   const host = await probe("127.0.0.1", port) ? "127.0.0.1" : await probe("::1", port) ? "::1" : null;
   if (!host) return "127.0.0.1";
   hostCache.set(port, { host, at: Date.now() });
@@ -1793,13 +1881,16 @@ function hostOf(req) {
   return (req.headers.host ?? "").replace(/:\d+$/, "").toLowerCase();
 }
 var DUTO_PREFIX = "/__duto/";
-var WAIT_PATH = "/__duto/espera";
+var WAIT_PATH = "/__duto/wait";
 var WAIT_MAX_MS = 10 * 6e4;
-var LOGIN_PATH = "/__duto/entrar";
-var LOGOUT_PATH = "/__duto/sair";
+var DEFAULT_ROUTE_WAIT_MS = 3e3;
+var DEFAULT_WAIT_CHECK_MS = 1e3;
+var SSE_KEEPALIVE_MS = 25e3;
+var LOGIN_PATH = "/__duto/login";
+var LOGOUT_PATH = "/__duto/logout";
 var QR_PREFIX = "/__duto/qr/";
 var MAX_FORM = 8 * 1024;
-var DENIED_TEXT = "Este t\xFAnel tem senha. Envie Authorization: Basic ou X-Duto-Auth: usuario:senha.";
+var DENIED_TEXT = "This tunnel is password protected. Send Authorization: Basic or X-Duto-Auth: user:password.";
 var WS_DENIED = 'HTTP/1.1 401 Unauthorized\r\nWWW-Authenticate: Basic realm="duto"\r\nContent-Length: 0\r\nConnection: close\r\n\r\n';
 function readForm(req, max) {
   return new Promise((resolve) => {
@@ -1822,9 +1913,9 @@ function readForm(req, max) {
 }
 async function authRoute(req, res, route, auth) {
   const url = new URL(req.url ?? "/", "http://duto");
-  const page = (status, volta, error) => {
+  const page = (status, next, error) => {
     res.writeHead(status, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" });
-    res.end(loginPage({ tunnel: route.tunnel, volta, error }));
+    res.end(loginPage({ tunnel: route.tunnel, next, error }));
   };
   const go = (location, cookie) => {
     res.writeHead(303, { location, "cache-control": "no-store", ...cookie && { "set-cookie": cookie } });
@@ -1832,21 +1923,21 @@ async function authRoute(req, res, route, auth) {
   };
   const { pathname } = url;
   if (pathname === LOGIN_PATH && req.method === "GET") {
-    page(200, safeVolta(url.searchParams.get("volta")), false);
+    page(200, safeNext(url.searchParams.get("next")), false);
     return true;
   }
   if (pathname === LOGIN_PATH && req.method === "POST") {
     const raw = await readForm(req, MAX_FORM);
     if (raw === null) {
       res.writeHead(413, { "content-type": "text/plain; charset=utf-8", connection: "close" });
-      res.end("Formul\xE1rio grande demais");
+      res.end("Form too large");
       return true;
     }
     const form = new URLSearchParams(raw);
-    const user = form.get("usuario") ?? "";
-    const volta = safeVolta(form.get("volta"));
-    if (auth.checkPassword(user, form.get("senha") ?? "")) go(volta, auth.loginCookie(user));
-    else page(401, volta, true);
+    const user = form.get("username") ?? "";
+    const next = safeNext(form.get("next"));
+    if (auth.checkPassword(user, form.get("password") ?? "")) go(next, auth.loginCookie(user));
+    else page(401, next, true);
     return true;
   }
   if (pathname === LOGOUT_PATH && req.method === "GET") {
@@ -1862,7 +1953,7 @@ async function authRoute(req, res, route, auth) {
 }
 function deny(req, res, html) {
   const status = html ? 303 : 401;
-  const out = html ? { location: `${LOGIN_PATH}?volta=${encodeURIComponent(req.url ?? "/")}`, "cache-control": "no-store" } : { "www-authenticate": 'Basic realm="duto"', "content-type": "text/plain; charset=utf-8", "cache-control": "no-store", ...cors401(req.headers.origin) };
+  const out = html ? { location: `${LOGIN_PATH}?next=${encodeURIComponent(req.url ?? "/")}`, "cache-control": "no-store" } : { "www-authenticate": 'Basic realm="duto"', "content-type": "text/plain; charset=utf-8", "cache-control": "no-store", ...cors401(req.headers.origin) };
   const body = html || req.method === "HEAD" ? "" : DENIED_TEXT;
   res.writeHead(status, out);
   res.end(body);
@@ -1904,7 +1995,7 @@ function waitForService(res, port, checkMs, pingMs) {
 async function startProxy(o) {
   const max = o.maxBody ?? MAX_BODY;
   let nextId = 1;
-  const routeWaitMs = o.routeWaitMs ?? 3e3;
+  const routeWaitMs = o.routeWaitMs ?? DEFAULT_ROUTE_WAIT_MS;
   async function routeFor(req) {
     const host = hostOf(req);
     for (let waited = 0; ; waited += 50) {
@@ -1965,7 +2056,7 @@ async function startProxy(o) {
   function replay(id) {
     const r = o.store.get(id);
     const blocked = replayBlock(r);
-    if (blocked || !r) return { ok: false, reason: blocked ?? "Essa requisi\xE7\xE3o j\xE1 saiu da lista." };
+    if (blocked || !r) return { ok: false, reason: blocked ?? "That request is no longer in the list." };
     const route = [...o.routes.values()].find((x) => x.tunnel === r.tunnel);
     if (!route) return { ok: false, reason: tunnelClosedReason(r.tunnel) };
     const newId = nextId++;
@@ -2006,17 +2097,17 @@ async function startProxy(o) {
     const route = await routeFor(req);
     if (!route) {
       res.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
-      res.end("T\xFAnel n\xE3o encontrado nesta sess\xE3o");
+      res.end("Tunnel not found in this session");
       return;
     }
     if ((req.url ?? "").startsWith(DUTO_PREFIX)) {
       if (req.url === WAIT_PATH && req.method === "GET") {
         if (route.auth?.access(req.headers).kind === "denied") return void deny(req, res, false);
-        return waitForService(res, route.port, o.waitCheckMs ?? 1e3, o.waitPingMs ?? 25e3);
+        return waitForService(res, route.port, o.waitCheckMs ?? DEFAULT_WAIT_CHECK_MS, o.waitPingMs ?? SSE_KEEPALIVE_MS);
       }
       if (route.auth && await authRoute(req, res, route, route.auth)) return;
       res.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
-      res.end("Rota reservada do Duto");
+      res.end("Reserved Duto route");
       return;
     }
     const preflight = !!route.auth && isPreflight(req.method, req.headers);
@@ -2059,7 +2150,7 @@ async function startProxy(o) {
       req.resume();
       if (res.destroyed && res.writableFinished === false && !res.headersSent) return;
       const html = wantsHtml(req.headers.accept);
-      const msg = html ? unavailablePage({ tunnel: route.tunnel, port: route.port, retry: req.method === "GET" }) : `Nada escutando em localhost:${route.port}. Suba o servidor e tente de novo.`;
+      const msg = html ? unavailablePage({ tunnel: route.tunnel, port: route.port, retry: req.method === "GET" }) : `Nothing is listening on localhost:${route.port}. Start the server and try again.`;
       if (!res.headersSent) {
         res.writeHead(503, { "content-type": html ? "text/html; charset=utf-8" : "text/plain; charset=utf-8", "cache-control": "no-store", "retry-after": "3" });
         res.end(req.method === "HEAD" ? void 0 : msg);
@@ -2223,7 +2314,6 @@ var RecordStore = class {
   get(id) {
     return this.items.find((x) => x.id === id);
   }
-  /** Mais recentes primeiro. Mesma referência até a próxima mudança (serve de snapshot para a tela). */
   list() {
     this.snapshot ??= [...this.items].reverse();
     return this.snapshot;
@@ -2243,8 +2333,8 @@ var READY = "Registered tunnel connection";
 var CLOSE_TIMEOUT_MS = 3e3;
 var HEARTBEAT_MS = 3e4;
 var RESTART_CF_MS = 2e3;
-var ALREADY_OPEN = "J\xE1 aberto em outra sess\xE3o nesta m\xE1quina";
-var STALE_MS = 75e3;
+var ALREADY_OPEN = "Already open in another session on this machine";
+var STALE_AFTER_MISSED_HEARTBEATS_MS = 75e3;
 function message(err) {
   return err instanceof Error ? err.message : String(err);
 }
@@ -2252,7 +2342,7 @@ function withTimeout(p, ms) {
   return Promise.race([p, new Promise((r) => setTimeout(() => r(void 0), ms).unref())]);
 }
 function keyOf(spec) {
-  return spec.name ?? "(padr\xE3o)";
+  return spec.name ?? "(default)";
 }
 var Session = class {
   constructor(o) {
@@ -2264,8 +2354,7 @@ var Session = class {
   tunnels = [];
   routes = /* @__PURE__ */ new Map();
   specs = /* @__PURE__ */ new Map();
-  /** Um TunnelAuth por túnel, reaproveitado nas reaberturas para não desconectar quem já entrou. */
-  auths = /* @__PURE__ */ new Map();
+  persistentAuths = /* @__PURE__ */ new Map();
   proxy = null;
   child = null;
   token = null;
@@ -2276,7 +2365,6 @@ var Session = class {
   connection = "connecting";
   listeners = /* @__PURE__ */ new Set();
   snapshot = null;
-  /** Mesma referência até a próxima mudança (serve de snapshot para a tela). */
   getState() {
     this.snapshot ??= { account: this.account, source: this.o.source, connection: this.connection, tunnels: this.tunnels.map((t) => ({ ...t })) };
     return this.snapshot;
@@ -2285,23 +2373,18 @@ var Session = class {
     this.listeners.add(fn);
     return () => this.listeners.delete(fn);
   }
-  /** Abre os túneis em sequência; falhas ficam no estado e não interrompem os outros. */
   async start(specs) {
     if (this.o.runDir) reapOrphans(this.o.runDir);
     this.proxy = await startProxy({ routes: this.routes, store: this.records });
     this.tunnels = specs.map((s) => this.blank(s, false));
     this.emit();
-    try {
-      const me = await this.o.api.me();
-      this.account = me.username ?? me.email;
-    } catch {
-    }
+    const me = await this.o.api.me().catch(() => null);
+    if (me) this.account = me.username ?? me.email;
     const existing = await this.o.api.endpoints().catch(() => []);
     for (const t of this.tunnels) await this.open(t, existing);
     const every = this.o.heartbeatMs ?? HEARTBEAT_MS;
     this.timer = setInterval(() => void this.beat(), every);
   }
-  /** Túnel avulso, só nesta sessão. */
   async add(spec) {
     if (this.tunnels.some((t2) => t2.key === keyOf(spec))) return;
     const t = this.blank(spec, true);
@@ -2310,33 +2393,29 @@ var Session = class {
     const existing = await this.o.api.endpoints().catch(() => []);
     await this.open(t, existing);
   }
-  /** Link para o QR: com senha, um token de uso único; sem senha, só a URL. */
   qrLink(key) {
     const t = this.tunnels.find((x) => x.key === key);
     if (!t?.url) return null;
-    const auth = this.auths.get(key);
+    const auth = this.persistentAuths.get(key);
     if (!auth) return { url: t.url, expiresAt: null };
     const { token, expiresAt } = auth.issueQrToken();
     return { url: `${t.url}/__duto/qr/${token}`, expiresAt };
   }
-  /** Primeiro usuário configurado do túnel, ou null quando ele não tem senha. */
   authUser(key) {
-    return this.auths.get(key)?.qrUser ?? null;
+    return this.persistentAuths.get(key)?.qrUser ?? null;
   }
-  /** Cria o TunnelAuth na primeira abertura (precisa do allow resolvido) e o mantém depois. */
   async authFor(key) {
-    const existing = this.auths.get(key);
+    const existing = this.persistentAuths.get(key);
     if (existing) return existing;
     const spec = this.specs.get(key);
     if (!spec?.auth?.length) return void 0;
     const allow = spec.allow?.length ? await (this.o.resolveAllow ?? resolveAllow)(spec.allow) : void 0;
     const auth = new TunnelAuth({ tunnel: key, credentials: spec.auth, allow });
-    this.auths.set(key, auth);
+    this.persistentAuths.set(key, auth);
     return auth;
   }
-  /** Reenvia uma requisição da lista ao serviço local. */
   replay(id) {
-    return this.proxy ? this.proxy.replay(id) : { ok: false, reason: "Sess\xE3o ainda n\xE3o come\xE7ou." };
+    return this.proxy ? this.proxy.replay(id) : { ok: false, reason: "Session has not started yet." };
   }
   async stop() {
     if (this.stopped) return;
@@ -2355,10 +2434,10 @@ var Session = class {
   }
   async open(t, existing, retrying = false) {
     if (this.stopped) return;
-    const taken = existing?.some(
-      (e) => e.name === t.name && e.connected && e.deviceId === this.o.deviceId && e.lastUsedAt !== null && Date.now() - e.lastUsedAt < STALE_MS
+    const takenByLiveSession = existing?.some(
+      (e) => e.name === t.name && e.connected && e.deviceId === this.o.deviceId && e.lastUsedAt !== null && Date.now() - e.lastUsedAt < STALE_AFTER_MISSED_HEARTBEATS_MS
     );
-    if (taken) return this.fail(t, ALREADY_OPEN);
+    if (takenByLiveSession) return this.fail(t, ALREADY_OPEN);
     try {
       const res = await this.o.api.openTunnel({
         deviceId: this.o.deviceId,
@@ -2405,7 +2484,7 @@ var Session = class {
     if (this.child && this.token === token) return;
     if (this.child) this.child.kill("SIGTERM");
     this.token = token;
-    const c = spawn(this.o.cloudflaredPath, ["tunnel", "--no-autoupdate", "run"], {
+    const c = spawn2(this.o.cloudflaredPath, ["tunnel", "--no-autoupdate", "run"], {
       env: { ...process.env, TUNNEL_TOKEN: token },
       stdio: ["ignore", "ignore", "pipe"]
     });
@@ -2534,7 +2613,7 @@ function runPlain(session, out) {
 }
 
 // src/index.ts
-var LOGIN_HINT = "Fa\xE7a login primeiro: duto login <token> (pegue o token em https://duto.dev)";
+var LOGIN_HINT = "Log in first: duto login";
 function fail2(message2) {
   console.error(fail(message2));
   process.exit(1);
@@ -2542,19 +2621,19 @@ function fail2(message2) {
 function parsePort(raw) {
   const s = String(raw ?? "");
   const n = Number(s);
-  if (!/^\d+$/.test(s) || n < 1 || n > 65535) fail2(`Porta inv\xE1lida: ${s} (use 1\u201365535)`);
+  if (!/^\d+$/.test(s) || n < 1 || n > 65535) fail2(`Invalid port: ${s} (use 1\u201365535)`);
   return n;
 }
 function parseName(raw) {
   if (raw === void 0 || raw === true || raw === "") return void 0;
   const name = normalizeName(String(raw));
   const v = validateName(name);
-  if (!v.ok) fail2(v.reason === "reserved" ? `Nome reservado: "${name}". Escolha outro.` : "Nome inv\xE1lido: use s\xF3 letras min\xFAsculas e n\xFAmeros (sem h\xEDfen)");
+  if (!v.ok) fail2(v.reason === "reserved" ? `"${name}" is reserved. Pick another name.` : `Invalid name. Use only lowercase letters and digits (no hyphens), up to ${MAX_NAME} characters.`);
   return name;
 }
 function parseHostFlag(raw) {
   if (raw === void 0 || raw === true || raw === "") return void 0;
-  return parseHost(String(raw)) ?? fail2("Host inv\xE1lido: use s\xF3 o dom\xEDnio, como meuapp.test");
+  return parseHost(String(raw)) ?? fail2("Invalid host: use the domain only, like myapp.test");
 }
 function listFlag(raw) {
   if (raw === void 0) return [];
@@ -2564,14 +2643,14 @@ function parseAuthFlags(raw) {
   const out = [];
   for (const entry of listFlag(raw)) {
     const r = parseCredential(entry);
-    if (!r.ok) fail2(r.reason === "password" ? "Senha precisa ter de 8 a 128 caracteres" : r.reason === "user" ? "Usu\xE1rio inv\xE1lido: de 1 a 128 caracteres, sem espa\xE7o" : "Credencial inv\xE1lida: use usuario:senha");
-    if (out.some((c) => c.user === r.cred.user)) fail2(`Usu\xE1rio "${r.cred.user}" aparece duas vezes`);
+    if (!r.ok) fail2(r.reason === "password" ? "Password must be 8 to 128 characters" : r.reason === "user" ? "Invalid user: 1 to 128 characters, no spaces" : "Invalid credential: use user:password");
+    if (out.some((c) => c.user === r.cred.user)) fail2(`Duplicate user "${r.cred.user}"`);
     out.push(r.cred);
   }
   return out;
 }
 function parseAllowFlags(raw) {
-  return listFlag(raw).map((v) => parseAllowEntry(v) ? v : fail2(`"${v}" n\xE3o \xE9 um nome conhecido (stripe, github) nem uma faixa de IP`));
+  return listFlag(raw).map((v) => parseAllowEntry(v) ? v : fail2(`"${v}" is not a known name (stripe, github) or an IP range`));
 }
 function wantsUi(flags) {
   if (flags.ui === false) return false;
@@ -2589,7 +2668,7 @@ async function runSession(specs, source, flags) {
   } catch (err) {
     fail2(err instanceof Error ? err.message : String(err));
   }
-  const session = new Session({ api, deviceId: config.deviceId, deviceName: hostname(), cloudflaredPath, source, runDir: join6(dutoHome(), "run") });
+  const session = new Session({ api, deviceId: config.deviceId, deviceName: hostname2(), cloudflaredPath, source, runDir: join6(dutoHome(), "run") });
   let inspector = null;
   let inspectorError;
   if (flags.inspect !== false) {
@@ -2600,14 +2679,14 @@ async function runSession(specs, source, flags) {
     }
   }
   if (wantsUi(flags)) {
-    const { runFullscreen } = await import("./fullscreen-YK365XSO.js");
-    const code = await runFullscreen(session, specs, "0.7.0", inspector, inspectorError);
+    const { runFullscreen } = await import("./fullscreen-ECEH3R2V.js");
+    const code = await runFullscreen(session, specs, "1.1.0", inspector, inspectorError);
     await inspector?.close().catch(() => void 0);
     process.exit(code);
   }
-  console.log(`${mark()} ${paint("muted", `${"0.7.0"} \xB7 ${source} \xB7 Ctrl+C para encerrar`)}`);
-  if (inspector) console.log(paint("muted", `inspetor: ${inspector.openUrl}`));
-  if (inspectorError) console.log(warn(`inspetor n\xE3o subiu: ${inspectorError}`));
+  console.log(`${mark()} ${paint("muted", `${"1.1.0"} \xB7 ${source} \xB7 Ctrl+C to stop`)}`);
+  if (inspector) console.log(paint("muted", `inspector: ${inspector.openUrl}`));
+  if (inspectorError) console.log(warn(`inspector failed to start: ${inspectorError}`));
   const stopLog = runPlain(session, (l) => console.log(l));
   const stopped = new Promise((resolve) => {
     const onSignal = () => {
@@ -2629,9 +2708,9 @@ async function runSession(specs, source, flags) {
 }
 async function tunnel(rawPort, flags) {
   if (rawPort === void 0) {
-    if (flags.host !== void 0) fail2("Use --host junto com a porta (duto 8080 --host meuapp.test) ou host: no duto.yml");
-    if (flags.auth !== void 0) fail2("Use --auth junto com a porta (duto 3000 --auth ana:senha) ou auth: no duto.yml");
-    if (flags.permitir !== void 0) fail2("Use --permitir junto com a porta (duto 3000 --permitir stripe) ou permitir: no duto.yml");
+    if (flags.host !== void 0) fail2("Use --host with a port (duto 8080 --host myapp.test) or host: in duto.yml");
+    if (flags.auth !== void 0) fail2("Use --auth with a port (duto 3000 --auth ana:secret) or auth: in duto.yml");
+    if (flags.allow !== void 0) fail2("Use --allow with a port (duto 3000 --allow stripe) or allow: in duto.yml");
     let found;
     try {
       found = findConfig(process.cwd());
@@ -2641,7 +2720,7 @@ async function tunnel(rawPort, flags) {
     if (!found) {
       cli.outputHelp();
       console.log(`
-${paint("signal", "Dica:")} crie um duto.yml com os t\xFAneis do projeto e rode s\xF3 ${paint("strong", "duto")}:
+${paint("signal", "Tip:")} create a duto.yml with your project's tunnels and just run ${paint("strong", "duto")}:
 
   tunnels:
     web: 3000
@@ -2655,30 +2734,67 @@ ${paint("signal", "Dica:")} crie um duto.yml com os t\xFAneis do projeto e rode
   const name = parseName(flags.name) ?? null;
   const host = parseHostFlag(flags.host);
   const keepRedirects = flags.rewriteRedirects === false;
-  if (keepRedirects && !host) fail2("--no-rewrite-redirects s\xF3 vale junto com --host");
+  if (keepRedirects && !host) fail2("--no-rewrite-redirects only works with --host");
   const auth = parseAuthFlags(flags.auth);
-  const allow = parseAllowFlags(flags.permitir);
-  if (allow.length && !auth.length) fail2("--permitir s\xF3 vale junto com --auth");
-  return runSession([{ name, port, ...host ? { host } : {}, ...keepRedirects ? { rewriteRedirects: false } : {}, ...auth.length ? { auth } : {}, ...allow.length ? { allow } : {} }], "linha de comando", flags);
+  const allow = parseAllowFlags(flags.allow);
+  if (allow.length && !auth.length) fail2("--allow only works with --auth");
+  return runSession([{ name, port, ...host ? { host } : {}, ...keepRedirects ? { rewriteRedirects: false } : {}, ...auth.length ? { auth } : {}, ...allow.length ? { allow } : {} }], "command line", flags);
 }
 var cli = cac("duto");
-cli.command("[port]", "Sem porta: abre os t\xFAneis do duto.yml. Com porta: abre um t\xFAnel para ela").option("--name <nome>", "Nome do endere\xE7o fixo (ex.: web \u2192 https://web-<usu\xE1rio>.duto.dev)").option("--host <host>", "Host que o servi\xE7o local recebe no lugar do p\xFAblico (ex.: meuapp.test)").option("--no-rewrite-redirects", "Com --host: n\xE3o troca o host local pelo p\xFAblico nos redirecionamentos").option("--auth <usuario:senha>", "Pede usu\xE1rio e senha para abrir o endere\xE7o (repet\xEDvel)").option("--permitir <faixa>", "Com --auth: IP, faixa (CIDR) ou nome (stripe, github) que entra sem senha (repet\xEDvel)").option("--no-ui", "Sem tela cheia: s\xF3 um log das requisi\xE7\xF5es (\xFAtil em scripts)").option("--no-inspect", "N\xE3o sobe o inspetor no navegador (127.0.0.1:4141)").option("--ui", "For\xE7a a tela cheia (no Windows ela vem desligada)").action((port, opts) => tunnel(port, opts));
-cli.command("http <port>", "O mesmo que duto <porta> (para quem vem do ngrok)").option("--name <nome>", "Nome do endere\xE7o fixo").option("--host <host>", "Host que o servi\xE7o local recebe no lugar do p\xFAblico").option("--no-rewrite-redirects", "Com --host: mant\xE9m os redirecionamentos como o servi\xE7o mandou").option("--auth <usuario:senha>", "Pede usu\xE1rio e senha para abrir o endere\xE7o (repet\xEDvel)").option("--permitir <faixa>", "Com --auth: IP, faixa (CIDR) ou nome (stripe, github) que entra sem senha (repet\xEDvel)").option("--no-ui", "Sem tela cheia").option("--no-inspect", "N\xE3o sobe o inspetor no navegador (127.0.0.1:4141)").action((port, opts) => tunnel(port, opts));
-cli.command("login <token>", "Salva o authtoken (pegue em https://duto.dev)").action(async (token) => {
+cli.command("[port]", "No port: open the tunnels in duto.yml. With a port: open a tunnel to it").option("--name <name>", "Fixed address name (e.g. web \u2192 https://web-<user>.duto.dev)").option("--host <host>", "Host the local service receives instead of the public one (e.g. myapp.test)").option("--no-rewrite-redirects", "With --host: do not swap the local host for the public one in redirects").option("--auth <user:password>", "Ask for a username and password to open the address (repeatable)").option("--allow <range>", "With --auth: IP, CIDR range or name (stripe, github) that gets in without a password (repeatable)").option("--no-ui", "No full screen: just a request log (useful in scripts)").option("--no-inspect", "Do not start the browser inspector (127.0.0.1:4141)").option("--ui", "Force full screen (off by default on Windows)").action((port, opts) => tunnel(port, opts));
+cli.command("http <port>", "Same as duto <port> (for people coming from ngrok)").option("--name <name>", "Fixed address name").option("--host <host>", "Host the local service receives instead of the public one").option("--no-rewrite-redirects", "With --host: keep redirects as the service sent them").option("--auth <user:password>", "Ask for a username and password to open the address (repeatable)").option("--allow <range>", "With --auth: IP, CIDR range or name (stripe, github) that gets in without a password (repeatable)").option("--no-ui", "No full screen").option("--no-inspect", "Do not start the browser inspector (127.0.0.1:4141)").action((port, opts) => tunnel(port, opts));
+cli.command("login [token]", "Log in through the browser, or save an authtoken").action(async (token) => {
   try {
+    if (token === void 0) return await loginWithBrowser();
     const me = await createApiClient({ baseUrl: apiUrl(), token: String(token) }).me();
     saveConfig({ ...loadConfig(), authtoken: String(token) });
-    console.log(ok(`Conectado como ${paint("strong", me.username ?? me.email)}`));
+    console.log(loggedInLine(me.username ?? me.email));
   } catch (err) {
     fail2(err instanceof Error ? err.message : String(err));
   }
 });
-cli.command("logout", "Remove o authtoken desta m\xE1quina").action(() => {
-  const { authtoken: _removed, ...rest } = loadConfig();
+async function loginWithBrowser() {
+  const config = loadConfig();
+  let stopSpinner = () => {
+  };
+  try {
+    const { token, username } = await browserLogin({
+      baseUrl: apiUrl(),
+      deviceId: config.deviceId,
+      open: openBrowser,
+      sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+      out: (line) => {
+        console.log(line);
+        stopSpinner = startSpinner("Waiting for authentication...");
+      }
+    });
+    stopSpinner();
+    saveConfig({ ...config, authtoken: token });
+    for (const line of loginSuccessLines(username)) console.log(line);
+  } catch (err) {
+    stopSpinner();
+    throw err;
+  }
+}
+cli.command("logout", "Remove the authtoken from this machine").action(async () => {
+  const { authtoken, ...rest } = loadConfig();
+  let reachable = true;
   saveConfig(rest);
-  console.log(ok("Authtoken removido"));
+  if (authtoken) {
+    try {
+      await createApiClient({ baseUrl: apiUrl(), token: authtoken }).revokeSelf();
+    } catch (err) {
+      if (!(err instanceof DutoApiError) || err.code !== "network") fail2(err instanceof Error ? err.message : String(err));
+      reachable = false;
+    }
+  }
+  console.log(
+    ok(
+      reachable ? "Authtoken removed" : "Authtoken removed from this machine. Could not reach duto.dev; revoke it on the Machines page."
+    )
+  );
 });
-cli.command("status", "Mostra a conta e os t\xFAneis no ar").action(async () => {
+cli.command("status", "Show your account and live tunnels").action(async () => {
   const config = loadConfig();
   if (!config.authtoken) fail2(LOGIN_HINT);
   try {
@@ -2686,23 +2802,17 @@ cli.command("status", "Mostra a conta e os t\xFAneis no ar").action(async () =>
     const [me, endpoints] = await Promise.all([api.me(), api.endpoints()]);
     console.log(`${mark()}  ${paint("muted", `${me.username} \xB7 ${me.email}`)}`);
     const live = endpoints.filter((e) => e.connected);
-    if (!live.length) console.log(paint("muted", "Nenhum t\xFAnel no ar."));
+    if (!live.length) console.log(paint("muted", "No live tunnels."));
     for (const e of live)
       console.log(
-        `${paint("signal", "\u25CF")} https://${e.hostname} ${paint("muted", `\u2192 localhost:${e.port}${e.deviceId === config.deviceId ? "" : ` \xB7 ${e.deviceName ?? "outra m\xE1quina"}`}`)}`
+        `${paint("signal", "\u25CF")} https://${e.hostname} ${paint("muted", `\u2192 localhost:${e.port}${e.deviceId === config.deviceId ? "" : ` \xB7 ${e.deviceName ?? "another machine"}`}`)}`
       );
   } catch (err) {
     fail2(err instanceof DutoApiError ? err.message : String(err));
   }
 });
-cli.help(
-  (sections) => sections.map((s) => ({
-    ...s,
-    title: s.title === "Usage" ? "Uso" : s.title === "Commands" ? "Comandos" : s.title === "Options" ? "Op\xE7\xF5es" : s.title,
-    body: s.body.replace(/^\s*For more info, run any command with the `--help` flag:/m, "  Mais detalhes de um comando: duto <comando> --help").replace("Display this message", "Mostra esta ajuda").replace("Display version number", "Mostra a vers\xE3o")
-  }))
-);
-cli.version("0.7.0");
+cli.help();
+cli.version("1.1.0");
 try {
   cli.parse(process.argv, { run: false });
   await cli.runMatchedCommand();