@dutodev/cli 1.0.0 → 1.2.0

package/README.md

@@ -124,7 +124,7 @@ People get in one of these ways:
 
 Without credentials, a browser is sent to the sign-in page and other clients get `401`. Your local app never receives Duto's credentials: the `Authorization: Basic` that matched, `X-Duto-Auth` and the tunnel cookie are stripped before the request is forwarded (other cookies pass through). An `Authorization: Bearer` from your own app passes unchanged.
 
-**Logging out and sessions.** In a browser, signing in sets a cookie that is valid for that tunnel only. To log out, open `/__duto/logout`: it clears the cookie and returns to the sign-in page. The cookie lasts until the browser closes or the CLI stops. Restarting the CLI signs everyone out, because the key that signs the cookies is new every session. The cookie only counts on requests to the tunnel itself: a page on another origin (another tunnel, another site) that calls the tunnel has to send `X-Duto-Auth` or `Authorization: Basic`. So opening the tunnel from a link on another `*.duto.dev` address (the dashboard or another tunnel) asks for the password again; a link from outside (email, chat) or a typed URL gets straight in.
+**Signing out and sessions.** In a browser, signing in sets a cookie that is valid for that tunnel only. To sign out, open `/__duto/logout`: it clears the cookie and returns to the sign-in page. The cookie lasts until the browser closes or the CLI stops. Restarting the CLI signs everyone out, because the key that signs the cookies is new every session. The cookie only counts on requests to the tunnel itself: a page on another origin (another tunnel, another site) that calls the tunnel has to send `X-Duto-Auth` or `Authorization: Basic`. So opening the tunnel from a link on another `*.duto.dev` address (the dashboard or another tunnel) asks for the password again; a link from outside (email, chat) or a typed URL gets straight in.
 
 **QR code.** With the full screen open, key `m` shows the QR of the selected tunnel in place of the request list. On a tunnel without a password, the QR points to the tunnel URL. On a tunnel with a password, it points to a link that signs in directly, as the first user in the `auth` list. That link is valid for 5 minutes and for one device only: once opened, or after it expires, it falls back to the sign-in page. On the QR screen, `g` generates a new link (and invalidates the previous one) and `esc` goes back to the list.
 

package/dist/chunk-KBH2C2UC.js

@@ -0,0 +1,462 @@
+#!/usr/bin/env node
+
+// ../shared/src/names.ts
+var EMAIL_SENDING_SUBDOMAINS = ["send"];
+var RESERVED_NAMES = [
+  "www",
+  "api",
+  "app",
+  "dash",
+  "admin",
+  "docs",
+  "status",
+  "mail",
+  "custom",
+  "cname",
+  "duto",
+  "auth",
+  "login",
+  "signup",
+  "invite",
+  "static",
+  "assets",
+  "cdn",
+  "help",
+  "support",
+  "blog",
+  ...EMAIL_SENDING_SUBDOMAINS
+];
+var MAX_NAME = 40;
+var FORMAT = /^[a-z0-9]+$/;
+function normalizeName(input) {
+  return input.trim().toLowerCase();
+}
+function validateName(name, max = MAX_NAME) {
+  if (name.length === 0 || name.length > max) return { ok: false, reason: "length" };
+  if (!FORMAT.test(name)) return { ok: false, reason: "format" };
+  if (RESERVED_NAMES.includes(name)) return { ok: false, reason: "reserved" };
+  return { ok: true };
+}
+
+// ../shared/src/places.ts
+var PLACES = {
+  AAE: ["Annaba", "Algeria"],
+  ABJ: ["Abidjan", "C\xF4te d\u2019Ivoire"],
+  ABQ: ["Albuquerque", "United States"],
+  ACC: ["Accra", "Ghana"],
+  ACX: ["Xingyi", "China"],
+  ADB: ["Izmir", "Turkey"],
+  ADD: ["Addis Ababa", "Ethiopia"],
+  ADL: ["Adelaide", "Australia"],
+  AGR: ["Agra", "India"],
+  AIP: ["Jalandhar", "India"],
+  AKL: ["Auckland", "New Zealand"],
+  AKX: ["Aktobe", "Kazakhstan"],
+  ALA: ["Almaty", "Kazakhstan"],
+  ALG: ["Algiers", "Algeria"],
+  AMD: ["Ahmedabad", "India"],
+  AMM: ["Amman", "Jordan"],
+  AMS: ["Amsterdam", "Netherlands"],
+  ANC: ["Anchorage", "United States"],
+  ARI: ["Arica", "Chile"],
+  ARN: ["Stockholm", "Sweden"],
+  ARU: ["Aracatuba", "Brazil"],
+  ASK: ["Yamoussoukro", "C\xF4te d\u2019Ivoire"],
+  ASU: ["Asunci\xF3n", "Paraguay"],
+  ATH: ["Athens", "Greece"],
+  ATL: ["Atlanta", "United States"],
+  AUS: ["Austin", "United States"],
+  AVA: ["Anshun", "China"],
+  BAH: ["Manama", "Bahrain"],
+  BAQ: ["Barranquilla", "Colombia"],
+  BBI: ["Bhubaneswar", "India"],
+  BCN: ["Barcelona", "Spain"],
+  BDQ: ["Jamnagar", "India"],
+  BEG: ["Belgrade", "Serbia"],
+  BEL: ["Bel\xE9m", "Brazil"],
+  BEY: ["Beirut", "Lebanon"],
+  BGI: ["Bridgetown", "Barbados"],
+  BGR: ["Bangor", "United States"],
+  BGW: ["Baghdad", "Iraq"],
+  BKK: ["Bangkok", "Thailand"],
+  BLR: ["Bangalore", "India"],
+  BNA: ["Nashville", "United States"],
+  BNE: ["Brisbane", "Australia"],
+  BOD: ["Bordeaux", "France"],
+  BOG: ["Bogot\xE1", "Colombia"],
+  BOM: ["Mumbai", "India"],
+  BOS: ["Boston", "United States"],
+  BRU: ["Brussels", "Belgium"],
+  BSB: ["Brasilia", "Brazil"],
+  BSR: ["Basra", "Iraq"],
+  BTS: ["Bratislava", "Slovakia"],
+  BUD: ["Budapest", "Hungary"],
+  BWN: ["Bandar Seri Begawan", "Brunei"],
+  CAI: ["Cairo", "Egypt"],
+  CAN: ["Guangzhou", "China"],
+  CAW: ["Campos dos Goytacazes", "Brazil"],
+  CBR: ["Canberra", "Australia"],
+  CCU: ["Kolkata", "India"],
+  CDG: ["Paris", "France"],
+  CEB: ["Cebu", "Philippines"],
+  CFC: ["Cacador", "Brazil"],
+  CGB: ["Cuiaba", "Brazil"],
+  CGD: ["Changde", "China"],
+  CGK: ["Jakarta", "Indonesia"],
+  CGO: ["Zhengzhou", "China"],
+  CGP: ["Chittagong", "Bangladesh"],
+  CGY: ["Cagayan de Oro", "Philippines"],
+  CHC: ["Christchurch", "New Zealand"],
+  CJB: ["Coimbatore", "India"],
+  CKG: ["Chongqing", "China"],
+  CLE: ["Cleveland", "United States"],
+  CLO: ["Cali", "Colombia"],
+  CLT: ["Charlotte", "United States"],
+  CMB: ["Colombo", "Sri Lanka"],
+  CMH: ["Columbus", "United States"],
+  CNF: ["Belo Horizonte", "Brazil"],
+  CNN: ["Kannur", "India"],
+  CNX: ["Chiang Mai", "Thailand"],
+  COK: ["Kochi", "India"],
+  COR: ["C\xF3rdoba", "Argentina"],
+  CPH: ["Copenhagen", "Denmark"],
+  CPT: ["Cape Town", "South Africa"],
+  CRK: ["Tarlac City", "Philippines"],
+  CSX: ["Changsha", "China"],
+  CTU: ["Chengdu", "China"],
+  CVG: ["Cincinnati", "United States"],
+  CWB: ["Curitiba", "Brazil"],
+  CZL: ["Constantine", "Algeria"],
+  CZX: ["Changzhou", "China"],
+  DAC: ["Dhaka", "Bangladesh"],
+  DAD: ["Da Nang", "Vietnam"],
+  DAR: ["Dar es Salaam", "Tanzania"],
+  DEL: ["New Delhi", "India"],
+  DEN: ["Denver", "United States"],
+  DFW: ["Dallas", "United States"],
+  DKR: ["Dakar", "Senegal"],
+  DLA: ["Douala", "Cameroon"],
+  DLC: ["Dalian", "China"],
+  DME: ["Moscow", "Russia"],
+  DMM: ["Dammam", "Saudi Arabia"],
+  DOH: ["Doha", "Qatar"],
+  DPS: ["Denpasar", "Indonesia"],
+  DTW: ["Detroit", "United States"],
+  DUB: ["Dublin", "Ireland"],
+  DUR: ["Durban", "South Africa"],
+  DUS: ["D\xFCsseldorf", "Germany"],
+  DXB: ["Dubai", "United Arab Emirates"],
+  DYU: ["Dushanbe", "Tajikistan"],
+  EBB: ["Kampala", "Uganda"],
+  EBL: ["Erbil", "Iraq"],
+  EVN: ["Yerevan", "Armenia"],
+  EWR: ["Newark", "United States"],
+  EZE: ["Buenos Aires", "Argentina"],
+  FCO: ["Rome", "Italy"],
+  FLN: ["Florianopolis", "Brazil"],
+  FOC: ["Fuzhou", "China"],
+  FOR: ["Fortaleza", "Brazil"],
+  FRA: ["Frankfurt", "Germany"],
+  FRU: ["Bishkek", "Kyrgyzstan"],
+  FSD: ["Sioux Falls", "United States"],
+  FUK: ["Fukuoka", "Japan"],
+  FUO: ["Foshan", "China"],
+  GBE: ["Gaborone", "Botswana"],
+  GDL: ["Guadalajara", "Mexico"],
+  GEO: ["Georgetown", "Guyana"],
+  GIG: ["Rio de Janeiro", "Brazil"],
+  GND: ["St. George's", "Grenada"],
+  GOT: ["Gothenburg", "Sweden"],
+  GRU: ["S\xE3o Paulo", "Brazil"],
+  GUA: ["Guatemala City", "Guatemala"],
+  GUM: ["Hagatna", "Guam"],
+  GVA: ["Geneva", "Switzerland"],
+  GYD: ["Baku", "Azerbaijan"],
+  GYE: ["Guayaquil", "Ecuador"],
+  GYN: ["Goiania", "Brazil"],
+  HAK: ["Chengmai", "China"],
+  HAM: ["Hamburg", "Germany"],
+  HAN: ["Hanoi", "Vietnam"],
+  HBA: ["Hobart", "Australia"],
+  HEL: ["Helsinki", "Finland"],
+  HFA: ["Haifa", "Israel"],
+  HGH: ["Shaoxing", "China"],
+  HKG: ["Hong Kong", null],
+  HNL: ["Honolulu", "United States"],
+  HRE: ["Harare", "Zimbabwe"],
+  HYD: ["Hyderabad", "India"],
+  HYN: ["Taizhou", "China"],
+  IAD: ["Ashburn", "United States"],
+  IAH: ["Houston", "United States"],
+  ICN: ["Seoul", "South Korea"],
+  IND: ["Indianapolis", "United States"],
+  ISB: ["Islamabad", "Pakistan"],
+  IST: ["Istanbul", "Turkey"],
+  ISU: ["Sulaymaniyah", "Iraq"],
+  IXC: ["Chandigarh", "India"],
+  JAI: ["\u201CJaipur\u201D", "India"],
+  JAX: ["Jacksonville", "United States"],
+  JDO: ["Juazeiro do Norte", "Brazil"],
+  JED: ["Jeddah", "Saudi Arabia"],
+  JHB: ["Johor Bahru", "Malaysia"],
+  JIB: ["Djibouti", "Djibouti"],
+  JNB: ["Johannesburg", "South Africa"],
+  JOG: ["Yogyakarta", "Indonesia"],
+  JOI: ["Joinville", "Brazil"],
+  JRG: ["Sambalpur", "India"],
+  JXG: ["Jiaxing", "China"],
+  KBP: ["Kyiv", "Ukraine"],
+  KCH: ["Kuching", "Malaysia"],
+  KEF: ["Reykjav\xEDk", "Iceland"],
+  KGL: ["Kigali", "Rwanda"],
+  KHH: ["Kaohsiung City", null],
+  KHI: ["Karachi", "Pakistan"],
+  KHN: ["Nanchang", "China"],
+  KIN: ["Kingston", "Jamaica"],
+  KIV: ["Chi\u0219in\u0103u", "Moldova"],
+  KIX: ["Osaka", "Japan"],
+  KMG: ["Kunming", "China"],
+  KNU: ["Kanpur", "India"],
+  KTM: ["Kathmandu", "Nepal"],
+  KUL: ["Kuala Lumpur", "Malaysia"],
+  KWE: ["Guiyang", "China"],
+  KWI: ["Kuwait City", "Kuwait"],
+  LAD: ["Luanda", "Angola"],
+  LAS: ["Las Vegas", "United States"],
+  LAX: ["Los Angeles", "United States"],
+  LCA: ["Nicosia", "Cyprus"],
+  LED: ["Saint Petersburg", "Russia"],
+  LHE: ["Lahore", "Pakistan"],
+  LHR: ["London", "United Kingdom"],
+  LHW: ["Lanzhou", "China"],
+  LIM: ["Lima", "Peru"],
+  LIS: ["Lisbon", "Portugal"],
+  LJU: ["Ljubljana", "Slovenia"],
+  LLK: ["Astara", "Azerbaijan"],
+  LLW: ["Lilongwe", "Malawi"],
+  LOS: ["Lagos", "Nigeria"],
+  LPB: ["La Paz", "Bolivia"],
+  LUH: ["Ludhiana", "India"],
+  LUN: ["Lusaka", "Zambia"],
+  LUX: ["Luxembourg City", "Luxembourg"],
+  LYA: ["Luoyang", "China"],
+  LYS: ["Lyon", "France"],
+  MAA: ["Chennai", "India"],
+  MAD: ["Madrid", "Spain"],
+  MAN: ["Manchester", "United Kingdom"],
+  MAO: ["Manaus", "Brazil"],
+  MBA: ["Mombasa", "Kenya"],
+  MCI: ["Kansas City", "United States"],
+  MCT: ["Muscat", "Oman"],
+  MDE: ["Medell\xEDn", "Colombia"],
+  MEL: ["Melbourne", "Australia"],
+  MEM: ["Memphis", "United States"],
+  MEX: ["Mexico City", "Mexico"],
+  MFM: ["Macau", null],
+  MIA: ["Miami", "United States"],
+  MLA: ["Valletta", "Malta"],
+  MLE: ["Male", "Maldives"],
+  MLG: ["Malang", "Indonesia"],
+  MNL: ["Manila", "Philippines"],
+  MPM: ["Maputo", "Mozambique"],
+  MRS: ["Marseille", "France"],
+  MRU: ["Port Louis", "Mauritius"],
+  MSP: ["Minneapolis", "United States"],
+  MSQ: ["Minsk", "Belarus"],
+  MUC: ["Munich", "Germany"],
+  MXP: ["Milan", "Italy"],
+  NAG: ["Nagpur", "India"],
+  NBO: ["Nairobi", "Kenya"],
+  NJF: ["Najaf", "Iraq"],
+  NOU: ["Noumea", "New Caledonia"],
+  NQN: ["Neuquen", "Argentina"],
+  NQZ: ["Astana", "Kazakhstan"],
+  NRT: ["Tokyo", "Japan"],
+  NVT: ["Timbo", "Brazil"],
+  OKA: ["Naha", "Japan"],
+  OKC: ["Oklahoma City", "United States"],
+  OMA: ["Omaha", "United States"],
+  ORD: ["Chicago", "United States"],
+  ORF: ["Norfolk", "United States"],
+  ORN: ["Oran", "Algeria"],
+  OSL: ["Oslo", "Norway"],
+  OTP: ["Bucharest", "Romania"],
+  OUA: ["Ouagadougou", "Burkina Faso"],
+  PAT: ["Patna", "India"],
+  PBH: ["Thimphu", "Bhutan"],
+  PBM: ["Paramaribo", "Suriname"],
+  PDX: ["Portland", "United States"],
+  PER: ["Perth", "Australia"],
+  PHL: ["Philadelphia", "United States"],
+  PHX: ["Phoenix", "United States"],
+  PIT: ["Pittsburgh", "United States"],
+  PKX: ["Beijing", "China"],
+  PMO: ["Palermo", "Italy"],
+  PMW: ["Palmas", "Brazil"],
+  PNH: ["Phnom Penh", "Cambodia"],
+  PNQ: ["Pune", "India"],
+  POA: ["Porto Alegre", "Brazil"],
+  POS: ["Port of Spain", "Trinidad & Tobago"],
+  PPT: ["Tahiti", "French Polynesia"],
+  PRG: ["Prague", "Czechia"],
+  PRN: ["Prishtine", "Kosovo"],
+  PTY: ["Panama City", "Panama"],
+  QRO: ["Queretaro", "Mexico"],
+  QWJ: ["Americana", "Brazil"],
+  RAO: ["Ribeirao Preto", "Brazil"],
+  RDU: ["Durham", "United States"],
+  REC: ["Recife", "Brazil"],
+  RIC: ["Richmond", "United States"],
+  RIX: ["Riga", "Latvia"],
+  RUH: ["Riyadh", "Saudi Arabia"],
+  RUN: ["Saint-Denis", "R\xE9union"],
+  SAN: ["San Diego", "United States"],
+  SAP: ["San Pedro Sula", "Honduras"],
+  SAT: ["San Antonio", "United States"],
+  SCL: ["Santiago", "Chile"],
+  SDQ: ["Santo Domingo", "Dominican Republic"],
+  SEA: ["Seattle", "United States"],
+  SFO: ["San Francisco", "United States"],
+  SGN: ["Ho Chi Minh City", "Vietnam"],
+  SHA: ["Shanghai", "China"],
+  SIN: ["Singapore", "Singapore"],
+  SJC: ["San Jose", "United States"],
+  SJK: ["S\xE3o Jos\xE9 dos Campos", "Brazil"],
+  SJO: ["San Jos\xE9", "Costa Rica"],
+  SJP: ["S\xE3o Jos\xE9 do Rio Preto", "Brazil"],
+  SJU: ["San Juan", "Puerto Rico"],
+  SJW: ["Hengshui", "China"],
+  SKG: ["Thessaloniki", "Greece"],
+  SKP: ["Skopje", "Macedonia"],
+  SLC: ["Salt Lake City", "United States"],
+  SMF: ["Sacramento", "United States"],
+  SOD: ["Sorocaba", "Brazil"],
+  SOF: ["Sofia", "Bulgaria"],
+  SSA: ["Salvador", "Brazil"],
+  STI: ["Santiago de los Caballeros", "Dominican Republic"],
+  STL: ["St. Louis", "United States"],
+  STR: ["Stuttgart", "Germany"],
+  SUV: ["Suva", "Fiji"],
+  SYD: ["Sydney", "Australia"],
+  SZX: ["Shenzhen", "China"],
+  TAO: ["Qingdao", "China"],
+  TBS: ["Tbilisi", "Georgia"],
+  TEN: ["Tongren", "China"],
+  TGU: ["Tegucigalpa", "Honduras"],
+  TIA: ["Tirana", "Albania"],
+  TLH: ["Tallahassee", "United States"],
+  TLL: ["Tallinn", "Estonia"],
+  TLV: ["Tel Aviv", "Israel"],
+  TNA: ["Jinan", "China"],
+  TNR: ["Antananarivo", "Madagascar"],
+  TPA: ["Tampa", "United States"],
+  TPE: ["Taipei", null],
+  TUN: ["Tunis", "Tunisia"],
+  TXL: ["Berlin", "Germany"],
+  TYN: ["Yangquan", "China"],
+  UDI: ["Uberlandia", "Brazil"],
+  UDR: ["Udaipur", "India"],
+  UIO: ["Quito", "Ecuador"],
+  ULN: ["Ulaanbaatar", "Mongolia"],
+  URT: ["Surat Thani", "Thailand"],
+  VCP: ["Campinas", "Brazil"],
+  VIE: ["Vienna", "Austria"],
+  VIX: ["Vitoria", "Brazil"],
+  VNO: ["Vilnius", "Lithuania"],
+  VTE: ["Vientiane", "Laos"],
+  WAW: ["Warsaw", "Poland"],
+  WDH: ["Windhoek", "Namibia"],
+  WLG: ["Wellington", "New Zealand"],
+  WRO: ["Wroclaw", "Poland"],
+  XAP: ["Chapeco", "Brazil"],
+  XFN: ["Xiangyang", "China"],
+  XIY: ["Baoji", "China"],
+  XNH: ["Nasiriyah", "Iraq"],
+  YHZ: ["Halifax", "Canada"],
+  YUL: ["Montr\xE9al", "Canada"],
+  YVR: ["Vancouver", "Canada"],
+  YWG: ["Winnipeg", "Canada"],
+  YXE: ["Saskatoon", "Canada"],
+  YYC: ["Calgary", "Canada"],
+  YYZ: ["Toronto", "Canada"],
+  ZAG: ["Zagreb", "Croatia"],
+  ZDM: ["Ramallah", null],
+  ZRH: ["Zurich", "Switzerland"]
+};
+function placeOf(colo) {
+  const entry = colo ? PLACES[colo] : void 0;
+  return entry ? { city: entry[0], country: entry[1] } : null;
+}
+
+// src/ui/theme.ts
+var C = {
+  signal: "#2dd4bf",
+  muted: "#8a8f8b",
+  strong: "#f3f4f1",
+  ok: "#4ade80",
+  warn: "#facc15",
+  err: "#f87171"
+};
+var TUNNEL_COLORS = ["#93c5fd", "#c4b5fd", "#facc15", "#4ade80", "#f9a8d4", "#fdba74", "#67e8f9"];
+function tunnelColor(index) {
+  return TUNNEL_COLORS[index % TUNNEL_COLORS.length];
+}
+function fit(text, width) {
+  if (width <= 0) return "";
+  return text.length > width ? `${text.slice(0, Math.max(0, width - 1))}\u2026` : text.padEnd(width);
+}
+
+// src/session/bodyNote.ts
+var TRUNCATED_NOTE = "Body cut at 64 KB.";
+function bodyNote(r, side) {
+  if (side === "req") {
+    if (r.reqBodyBytes === 0) return "No body.";
+    if (r.reqBody === null && !r.reqTruncated) return "Binary body; not stored.";
+    return null;
+  }
+  if (r.bytes === 0) return "No body.";
+  if (r.resBody === null) return "Binary body; not stored.";
+  return null;
+}
+
+// src/ui/format.ts
+function statusColor(status) {
+  if (status === null) return "muted";
+  if (status === 101) return "signal";
+  if (status >= 500) return "err";
+  if (status >= 400) return "warn";
+  if (status >= 300) return "muted";
+  return "ok";
+}
+function formatDuration(ms) {
+  return ms < 1e3 ? `${Math.round(ms)}ms` : `${(ms / 1e3).toFixed(1)}s`;
+}
+function formatBytes(n) {
+  if (n < 1024) return `${n} B`;
+  if (n < 1024 * 1024) return `${(n / 1024).toFixed(1)} KB`;
+  return `${(n / 1024 / 1024).toFixed(1)} MB`;
+}
+function formatTime(ms) {
+  const d = new Date(ms);
+  return [d.getHours(), d.getMinutes(), d.getSeconds()].map((n) => String(n).padStart(2, "0")).join(":");
+}
+function localLabel(t) {
+  return t.host ? `localhost:${t.port} (Host: ${t.host})` : `localhost:${t.port}`;
+}
+
+export {
+  MAX_NAME,
+  normalizeName,
+  validateName,
+  placeOf,
+  C,
+  tunnelColor,
+  fit,
+  TRUNCATED_NOTE,
+  bodyNote,
+  statusColor,
+  formatDuration,
+  formatBytes,
+  formatTime,
+  localLabel
+};

package/dist/{fullscreen-IWZCH3IP.js → fullscreen-2I3U6JL7.js}

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import {
   C,
+  MAX_NAME,
   TRUNCATED_NOTE,
   bodyNote,
   fit,
@@ -12,7 +13,7 @@ import {
   statusColor,
   tunnelColor,
   validateName
-} from "./chunk-BPOXISIM.js";
+} from "./chunk-KBH2C2UC.js";
 
 // src/ui/fullscreen.tsx
 import { render } from "ink";
@@ -369,7 +370,7 @@ function App({ session, version, system, onExit, inspector = null, inspectorErro
     const name = raw ? normalizeName(raw) : null;
     if (name !== null) {
       const v = validateName(name);
-      if (!v.ok) return setMessage({ text: v.reason === "reserved" ? `Reserved name: "${raw}"` : "Invalid name: use lowercase letters and numbers only (no hyphens)", tone: "err" });
+      if (!v.ok) return setMessage({ text: v.reason === "reserved" ? `"${raw}" is reserved. Pick another name.` : `Invalid name. Use only lowercase letters and digits (no hyphens), up to ${MAX_NAME} characters.`, tone: "err" });
     }
     setMode({ kind: "list" });
     void session.add({ name, port });

package/dist/index.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import {
   C,
+  MAX_NAME,
   TRUNCATED_NOTE,
   bodyNote,
   formatBytes,
@@ -8,9 +9,10 @@ import {
   formatTime,
   localLabel,
   normalizeName,
+  placeOf,
   statusColor,
   validateName
-} from "./chunk-BPOXISIM.js";
+} from "./chunk-KBH2C2UC.js";
 
 // src/ui/brand.ts
 function colorOn(stream = process.stdout) {
@@ -35,7 +37,7 @@ var fail = (msg) => `${paint("err", "\u2716", process.stderr)} ${msg}`;
 var warn = (msg) => `${paint("warn", "\u26A0")} ${msg}`;
 
 // src/index.ts
-import { hostname } from "os";
+import { hostname as hostname2 } from "os";
 import { join as join6, relative } from "path";
 import cac from "cac";
 
@@ -50,21 +52,25 @@ var DutoApiError = class extends Error {
   status;
   code;
 };
+var BOOKMARK_HEADER = "x-d1-bookmark";
 var MESSAGES = {
-  unauthorized: "Invalid authtoken. Generate a new one at https://duto.dev and run: duto login <token>",
+  unauthorized: "This machine is not logged in. Run: duto login",
   suspended: "Your account is suspended.",
-  network: "Could not reach duto.dev. Check your connection."
+  network: "Could not reach duto.dev. Check your connection.",
+  loginExpired: "The login code expired. Run duto login again."
 };
 function createApiClient(o) {
   const doFetch = o.fetchImpl ?? fetch;
+  let bookmark = null;
   async function call(method, path, body) {
     let res;
     try {
       res = await doFetch(`${o.baseUrl}${path}`, {
         method,
         headers: {
-          authorization: `Bearer ${o.token}`,
+          ...o.token === void 0 ? {} : { authorization: `Bearer ${o.token}` },
           ...body === void 0 ? {} : { "content-type": "application/json" },
+          ...bookmark === null ? {} : { [BOOKMARK_HEADER]: bookmark },
           "user-agent": "duto-cli"
         },
         body: body === void 0 ? void 0 : JSON.stringify(body)
@@ -72,6 +78,7 @@ function createApiClient(o) {
     } catch {
       throw new DutoApiError(MESSAGES.network, 0, "network");
     }
+    bookmark = res.headers.get(BOOKMARK_HEADER) ?? bookmark;
     return res;
   }
   async function fail3(res) {
@@ -98,6 +105,12 @@ function createApiClient(o) {
       const res = await call("DELETE", `/api/tunnels/${encodeURIComponent(id)}`);
       if (!res.ok && res.status !== 404) await fail3(res);
     },
+    startLogin: (r) => json("POST", "/api/cli/login", r),
+    pollLogin: (deviceCode) => json("POST", "/api/cli/login/poll", { deviceCode }),
+    async revokeSelf() {
+      const res = await call("DELETE", "/api/cli/token");
+      if (!res.ok && res.status !== 401 && res.status !== 404) await fail3(res);
+    },
     me: () => json("GET", "/api/me"),
     endpoints: () => json("GET", "/api/endpoints")
   };
@@ -417,7 +430,7 @@ function parseConfig(text, file = CONFIG_FILES[0], env = process.env) {
     const v = validateName(name);
     if (!v.ok) {
       throw fail3(
-        v.reason === "reserved" ? `reserved name: "${raw}". Choose another.` : `invalid name: "${raw}" (use only lowercase letters and digits, no hyphen)`,
+        v.reason === "reserved" ? `"${raw}" is reserved. Pick another name.` : `invalid name: "${raw}" (use only lowercase letters and digits, no hyphen)`,
         line
       );
     }
@@ -522,6 +535,108 @@ function findConfig(cwd) {
   }
 }
 
+// src/login.ts
+import { spawn } from "child_process";
+import { hostname } from "os";
+var SLOW_DOWN_MS = 5e3;
+var MAX_NETWORK_ERRORS_IN_A_ROW = 3;
+async function browserLogin(o) {
+  const api = createApiClient({ baseUrl: o.baseUrl, fetchImpl: o.fetchImpl });
+  const start = await api.startLogin({
+    deviceId: o.deviceId,
+    deviceName: hostname(),
+    cliVersion: "1.2.0",
+    nodeVersion: process.version,
+    os: process.platform,
+    arch: process.arch
+  });
+  o.out(`  Visit ${start.verificationUrl}`);
+  tryOpen(o.open, start.verificationUrl);
+  let waitMs = start.interval * 1e3;
+  let networkErrors = 0;
+  for (; ; ) {
+    await o.sleep(waitMs);
+    let poll;
+    try {
+      poll = await api.pollLogin(start.deviceCode);
+      networkErrors = 0;
+    } catch (err) {
+      const isNetwork = err instanceof DutoApiError && err.code === "network";
+      if (!isNetwork || ++networkErrors > MAX_NETWORK_ERRORS_IN_A_ROW) throw err;
+      continue;
+    }
+    if (poll.status === "approved") return { token: poll.token, username: poll.username };
+    if (poll.status === "expired") throw new DutoApiError(MESSAGES.loginExpired, 410, "expired");
+    if (poll.status === "slow_down") waitMs += SLOW_DOWN_MS;
+  }
+}
+function tryOpen(open, url) {
+  try {
+    open(url);
+  } catch {
+    return;
+  }
+}
+function openCommand(url) {
+  if (process.platform === "darwin") return { command: "open", args: [url] };
+  if (process.platform === "win32") return { command: "cmd", args: ["/c", "start", '""', url] };
+  return { command: "xdg-open", args: [url] };
+}
+function loggedInLine(username) {
+  return ok(`Logged in as ${username}.`);
+}
+function loginSuccessLines(username) {
+  return [
+    loggedInLine(username),
+    "",
+    "To open a tunnel, run `duto 3000`, or `duto` in a folder with a duto.yml."
+  ];
+}
+function openBrowser(url) {
+  try {
+    const { command, args } = openCommand(url);
+    const child = spawn(command, args, { detached: true, stdio: "ignore" });
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+    return;
+  }
+}
+var FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
+function startSpinner(label, stream = process.stderr) {
+  if (!stream.isTTY) {
+    stream.write(`${label}
+`);
+    return () => {
+    };
+  }
+  let frame = 0;
+  const draw = () => stream.write(`\r${FRAMES[frame++ % FRAMES.length]} ${label}`);
+  draw();
+  const timer = setInterval(draw, 80);
+  return () => {
+    clearInterval(timer);
+    stream.write("\r\x1B[K");
+  };
+}
+
+// src/inspector/edge.ts
+var RAY_COLO = /-([A-Za-z]{3})$/;
+function edgeOf(headers) {
+  const name = Object.keys(headers).find((k) => k.toLowerCase() === "cf-ray");
+  const code = name ? RAY_COLO.exec(headers[name] ?? "")?.[1] : void 0;
+  if (!code) return null;
+  const colo = code.toUpperCase();
+  const place = placeOf(colo);
+  return { colo, city: place?.city ?? null, country: place?.country ?? null };
+}
+function edgeLabel(edge) {
+  if (!edge) return "";
+  const place = [edge.city, edge.country].filter(Boolean).join(", ");
+  return place ? "via " + edge.colo + " (" + place + ")" : "via " + edge.colo;
+}
+
 // src/inspector/jsonView.ts
 function countLabel(n, one, many) {
   return n + " " + (n === 1 ? one : many);
@@ -702,6 +817,7 @@ th { color: ${JSON_KEY}; font-weight: 400; white-space: nowrap; }
 `;
 var SCRIPT = String.raw`"use strict";
 var countLabel = (${countLabel.toString()});
+var edgeLabel = (${edgeLabel.toString()});
 var jsonSyntaxError = (${jsonSyntaxError.toString()});
 var jsonTokens = (${jsonTokens.toString()});
 var jsonIndent = (${jsonIndent.toString()});
@@ -875,6 +991,7 @@ function renderDetail() {
   if (duration(d)) parts.push(duration(d));
   parts.push(size(d.bytes));
   parts.push(d.tunnel);
+  if (d.edge) parts.push(edgeLabel(d.edge));
   if (d.replayOf !== undefined) parts.push("↻ replay of #" + d.replayOf);
   head.appendChild(el("span", "mut", " · " + parts.join(" · ")));
   if (d.error) head.appendChild(el("div", "msg err", d.error));
@@ -1268,6 +1385,7 @@ function detail(r, session) {
   }
   return {
     ...listItem(r),
+    edge: edgeOf(r.reqHeaders),
     reqHeaders: r.reqHeaders,
     resHeaders: r.resHeaders,
     reqBody: r.reqBody,
@@ -1431,7 +1549,7 @@ data: ${JSON.stringify({ ids })}
 }
 
 // src/session/session.ts
-import { spawn } from "child_process";
+import { spawn as spawn2 } from "child_process";
 
 // src/portcheck.ts
 import { connect } from "net";
@@ -1455,7 +1573,7 @@ async function isPortListening(port, timeoutMs = 500) {
 // src/session/auth.ts
 import { createHash as createHash3, createHmac, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var TUNNEL_COOKIE = "__Host-duto_tunnel";
-var SAME_SITE_SIBLING_TUNNEL_COOKIE_REJECTED = "same-site";
+var SEC_FETCH_SITE_SAME_SITE = "same-site";
 var QR_TTL_MS = 5 * 6e4;
 var sha2 = (s) => createHash3("sha256").update(s).digest();
 var constantTimeEqual2 = (a, b) => timingSafeEqual2(sha2(a), sha2(b));
@@ -1470,7 +1588,7 @@ function parseBasic(value) {
 var first2 = (v) => Array.isArray(v) ? v[0] : v;
 var bareHost = (s) => s.replace(/:\d+$/, "").toLowerCase();
 function sameHostOrigin(h) {
-  if (first2(h["sec-fetch-site"])?.toLowerCase() === SAME_SITE_SIBLING_TUNNEL_COOKIE_REJECTED) return false;
+  if (first2(h["sec-fetch-site"])?.toLowerCase() === SEC_FETCH_SITE_SAME_SITE) return false;
   const origin = first2(h.origin);
   if (origin === void 0) return true;
   let host;
@@ -1694,7 +1812,7 @@ function loginPage(o) {
 ${o.error ? `<p class="error" role="alert">Wrong username or password.</p>
 ` : ""}<button type="submit">Sign in</button>
 </form>
-<div class="retry">You stay signed in until the tunnel closes.</div>
+<div class="retry">You stay signed in until you close the browser or the tunnel closes.</div>
 </main>`,
     CSS
   );
@@ -2390,7 +2508,7 @@ var Session = class {
     if (this.child && this.token === token) return;
     if (this.child) this.child.kill("SIGTERM");
     this.token = token;
-    const c = spawn(this.o.cloudflaredPath, ["tunnel", "--no-autoupdate", "run"], {
+    const c = spawn2(this.o.cloudflaredPath, ["tunnel", "--no-autoupdate", "run"], {
       env: { ...process.env, TUNNEL_TOKEN: token },
       stdio: ["ignore", "ignore", "pipe"]
     });
@@ -2519,7 +2637,7 @@ function runPlain(session, out) {
 }
 
 // src/index.ts
-var LOGIN_HINT = "Log in first: duto login <token> (get your token at https://duto.dev)";
+var LOGIN_HINT = "Log in first: duto login";
 function fail2(message2) {
   console.error(fail(message2));
   process.exit(1);
@@ -2534,7 +2652,7 @@ function parseName(raw) {
   if (raw === void 0 || raw === true || raw === "") return void 0;
   const name = normalizeName(String(raw));
   const v = validateName(name);
-  if (!v.ok) fail2(v.reason === "reserved" ? `Reserved name: "${name}". Pick another.` : "Invalid name: use lowercase letters and numbers only (no hyphens)");
+  if (!v.ok) fail2(v.reason === "reserved" ? `"${name}" is reserved. Pick another name.` : `Invalid name. Use only lowercase letters and digits (no hyphens), up to ${MAX_NAME} characters.`);
   return name;
 }
 function parseHostFlag(raw) {
@@ -2574,7 +2692,7 @@ async function runSession(specs, source, flags) {
   } catch (err) {
     fail2(err instanceof Error ? err.message : String(err));
   }
-  const session = new Session({ api, deviceId: config.deviceId, deviceName: hostname(), cloudflaredPath, source, runDir: join6(dutoHome(), "run") });
+  const session = new Session({ api, deviceId: config.deviceId, deviceName: hostname2(), cloudflaredPath, source, runDir: join6(dutoHome(), "run") });
   let inspector = null;
   let inspectorError;
   if (flags.inspect !== false) {
@@ -2585,12 +2703,12 @@ async function runSession(specs, source, flags) {
     }
   }
   if (wantsUi(flags)) {
-    const { runFullscreen } = await import("./fullscreen-IWZCH3IP.js");
-    const code = await runFullscreen(session, specs, "1.0.0", inspector, inspectorError);
+    const { runFullscreen } = await import("./fullscreen-2I3U6JL7.js");
+    const code = await runFullscreen(session, specs, "1.2.0", inspector, inspectorError);
     await inspector?.close().catch(() => void 0);
     process.exit(code);
   }
-  console.log(`${mark()} ${paint("muted", `${"1.0.0"} \xB7 ${source} \xB7 Ctrl+C to stop`)}`);
+  console.log(`${mark()} ${paint("muted", `${"1.2.0"} \xB7 ${source} \xB7 Ctrl+C to stop`)}`);
   if (inspector) console.log(paint("muted", `inspector: ${inspector.openUrl}`));
   if (inspectorError) console.log(warn(`inspector failed to start: ${inspectorError}`));
   const stopLog = runPlain(session, (l) => console.log(l));
@@ -2649,19 +2767,56 @@ ${paint("signal", "Tip:")} create a duto.yml with your project's tunnels and jus
 var cli = cac("duto");
 cli.command("[port]", "No port: open the tunnels in duto.yml. With a port: open a tunnel to it").option("--name <name>", "Fixed address name (e.g. web \u2192 https://web-<user>.duto.dev)").option("--host <host>", "Host the local service receives instead of the public one (e.g. myapp.test)").option("--no-rewrite-redirects", "With --host: do not swap the local host for the public one in redirects").option("--auth <user:password>", "Ask for a username and password to open the address (repeatable)").option("--allow <range>", "With --auth: IP, CIDR range or name (stripe, github) that gets in without a password (repeatable)").option("--no-ui", "No full screen: just a request log (useful in scripts)").option("--no-inspect", "Do not start the browser inspector (127.0.0.1:4141)").option("--ui", "Force full screen (off by default on Windows)").action((port, opts) => tunnel(port, opts));
 cli.command("http <port>", "Same as duto <port> (for people coming from ngrok)").option("--name <name>", "Fixed address name").option("--host <host>", "Host the local service receives instead of the public one").option("--no-rewrite-redirects", "With --host: keep redirects as the service sent them").option("--auth <user:password>", "Ask for a username and password to open the address (repeatable)").option("--allow <range>", "With --auth: IP, CIDR range or name (stripe, github) that gets in without a password (repeatable)").option("--no-ui", "No full screen").option("--no-inspect", "Do not start the browser inspector (127.0.0.1:4141)").action((port, opts) => tunnel(port, opts));
-cli.command("login <token>", "Save your authtoken (get it at https://duto.dev)").action(async (token) => {
+cli.command("login [token]", "Log in through the browser, or save an authtoken").action(async (token) => {
   try {
+    if (token === void 0) return await loginWithBrowser();
     const me = await createApiClient({ baseUrl: apiUrl(), token: String(token) }).me();
     saveConfig({ ...loadConfig(), authtoken: String(token) });
-    console.log(ok(`Logged in as ${paint("strong", me.username ?? me.email)}`));
+    console.log(loggedInLine(me.username ?? me.email));
   } catch (err) {
     fail2(err instanceof Error ? err.message : String(err));
   }
 });
-cli.command("logout", "Remove the authtoken from this machine").action(() => {
-  const { authtoken: _removed, ...rest } = loadConfig();
+async function loginWithBrowser() {
+  const config = loadConfig();
+  let stopSpinner = () => {
+  };
+  try {
+    const { token, username } = await browserLogin({
+      baseUrl: apiUrl(),
+      deviceId: config.deviceId,
+      open: openBrowser,
+      sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+      out: (line) => {
+        console.log(line);
+        stopSpinner = startSpinner("Waiting for authentication...");
+      }
+    });
+    stopSpinner();
+    saveConfig({ ...config, authtoken: token });
+    for (const line of loginSuccessLines(username)) console.log(line);
+  } catch (err) {
+    stopSpinner();
+    throw err;
+  }
+}
+cli.command("logout", "Remove the authtoken from this machine").action(async () => {
+  const { authtoken, ...rest } = loadConfig();
+  let reachable = true;
   saveConfig(rest);
-  console.log(ok("Authtoken removed"));
+  if (authtoken) {
+    try {
+      await createApiClient({ baseUrl: apiUrl(), token: authtoken }).revokeSelf();
+    } catch (err) {
+      if (!(err instanceof DutoApiError) || err.code !== "network") fail2(err instanceof Error ? err.message : String(err));
+      reachable = false;
+    }
+  }
+  console.log(
+    ok(
+      reachable ? "Authtoken removed" : "Authtoken removed from this machine. Could not reach duto.dev; revoke it on the Machines page."
+    )
+  );
 });
 cli.command("status", "Show your account and live tunnels").action(async () => {
   const config = loadConfig();
@@ -2681,7 +2836,7 @@ cli.command("status", "Show your account and live tunnels").action(async () => {
   }
 });
 cli.help();
-cli.version("1.0.0");
+cli.version("1.2.0");
 try {
   cli.parse(process.argv, { run: false });
   await cli.runMatchedCommand();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dutodev/cli",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "description": "Expose a local port at https://<name>-<user>.duto.dev with one command.",
   "license": "MIT",
   "type": "module",

package/dist/chunk-BPOXISIM.js

@@ -1,110 +0,0 @@
-#!/usr/bin/env node
-
-// ../shared/src/names.ts
-var EMAIL_SENDING_SUBDOMAINS = ["send"];
-var RESERVED_NAMES = [
-  "www",
-  "api",
-  "app",
-  "dash",
-  "admin",
-  "docs",
-  "status",
-  "mail",
-  "custom",
-  "cname",
-  "duto",
-  "auth",
-  "login",
-  "signup",
-  "invite",
-  "static",
-  "assets",
-  "cdn",
-  "help",
-  "support",
-  "blog",
-  ...EMAIL_SENDING_SUBDOMAINS
-];
-var MAX_NAME = 40;
-var FORMAT = /^[a-z0-9]+$/;
-function normalizeName(input) {
-  return input.trim().toLowerCase();
-}
-function validateName(name, max = MAX_NAME) {
-  if (name.length === 0 || name.length > max) return { ok: false, reason: "length" };
-  if (!FORMAT.test(name)) return { ok: false, reason: "format" };
-  if (RESERVED_NAMES.includes(name)) return { ok: false, reason: "reserved" };
-  return { ok: true };
-}
-
-// src/ui/theme.ts
-var C = {
-  signal: "#2dd4bf",
-  muted: "#8a8f8b",
-  strong: "#f3f4f1",
-  ok: "#4ade80",
-  warn: "#facc15",
-  err: "#f87171"
-};
-var TUNNEL_COLORS = ["#93c5fd", "#c4b5fd", "#facc15", "#4ade80", "#f9a8d4", "#fdba74", "#67e8f9"];
-function tunnelColor(index) {
-  return TUNNEL_COLORS[index % TUNNEL_COLORS.length];
-}
-function fit(text, width) {
-  if (width <= 0) return "";
-  return text.length > width ? `${text.slice(0, Math.max(0, width - 1))}\u2026` : text.padEnd(width);
-}
-
-// src/session/bodyNote.ts
-var TRUNCATED_NOTE = "Body cut at 64 KB.";
-function bodyNote(r, side) {
-  if (side === "req") {
-    if (r.reqBodyBytes === 0) return "No body.";
-    if (r.reqBody === null && !r.reqTruncated) return "Binary body; not stored.";
-    return null;
-  }
-  if (r.bytes === 0) return "No body.";
-  if (r.resBody === null) return "Binary body; not stored.";
-  return null;
-}
-
-// src/ui/format.ts
-function statusColor(status) {
-  if (status === null) return "muted";
-  if (status === 101) return "signal";
-  if (status >= 500) return "err";
-  if (status >= 400) return "warn";
-  if (status >= 300) return "muted";
-  return "ok";
-}
-function formatDuration(ms) {
-  return ms < 1e3 ? `${Math.round(ms)}ms` : `${(ms / 1e3).toFixed(1)}s`;
-}
-function formatBytes(n) {
-  if (n < 1024) return `${n} B`;
-  if (n < 1024 * 1024) return `${(n / 1024).toFixed(1)} KB`;
-  return `${(n / 1024 / 1024).toFixed(1)} MB`;
-}
-function formatTime(ms) {
-  const d = new Date(ms);
-  return [d.getHours(), d.getMinutes(), d.getSeconds()].map((n) => String(n).padStart(2, "0")).join(":");
-}
-function localLabel(t) {
-  return t.host ? `localhost:${t.port} (Host: ${t.host})` : `localhost:${t.port}`;
-}
-
-export {
-  normalizeName,
-  validateName,
-  C,
-  tunnelColor,
-  fit,
-  TRUNCATED_NOTE,
-  bodyNote,
-  statusColor,
-  formatDuration,
-  formatBytes,
-  formatTime,
-  localLabel
-};