@elisoncampos/local-router 0.1.0

package/dist/cli.js

@@ -0,0 +1,1956 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import chalk from "chalk";
+import * as fs8 from "fs";
+import * as path7 from "path";
+import { spawn as spawn2, spawnSync } from "child_process";
+
+// src/certs.ts
+import * as crypto from "crypto";
+import { execFile as execFileCb, execFileSync } from "child_process";
+import * as fs2 from "fs";
+import * as path from "path";
+import * as tls from "tls";
+import { promisify } from "util";
+
+// src/utils.ts
+import * as fs from "fs";
+function fixOwnership(...paths) {
+  if (process.platform === "win32") return;
+  const uid = process.env.SUDO_UID;
+  const gid = process.env.SUDO_GID;
+  if (!uid || process.getuid?.() !== 0) return;
+  for (const targetPath of paths) {
+    try {
+      fs.chownSync(targetPath, Number(uid), Number(gid ?? uid));
+    } catch {
+    }
+  }
+}
+function isErrnoException(error) {
+  return error instanceof Error && "code" in error;
+}
+function escapeHtml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function formatUrl(hostname, https2, port) {
+  const defaultPort = https2 ? 443 : 80;
+  if (!port || port === defaultPort) {
+    return `${https2 ? "https" : "http"}://${hostname}`;
+  }
+  return `${https2 ? "https" : "http"}://${hostname}:${port}`;
+}
+function removeProtocol(hostname) {
+  return hostname.replace(/^https?:\/\//i, "").split("/")[0].trim();
+}
+function normalizeExplicitHostname(hostname) {
+  const normalized = removeProtocol(hostname).toLowerCase();
+  if (!normalized) {
+    throw new Error("Hostname cannot be empty.");
+  }
+  if (normalized.includes("..")) {
+    throw new Error(`Invalid hostname "${normalized}": consecutive dots are not allowed.`);
+  }
+  if (!/^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$/.test(normalized)) {
+    throw new Error(
+      `Invalid hostname "${normalized}": use lowercase letters, digits, dots, and hyphens only.`
+    );
+  }
+  const labels = normalized.split(".");
+  for (const label of labels) {
+    if (label.length > 63) {
+      throw new Error(
+        `Invalid hostname "${normalized}": label "${label}" exceeds the 63-character DNS limit.`
+      );
+    }
+  }
+  return normalized;
+}
+
+// src/certs.ts
+var CA_VALIDITY_DAYS = 3650;
+var SERVER_VALIDITY_DAYS = 365;
+var EXPIRY_BUFFER_MS = 7 * 24 * 60 * 60 * 1e3;
+var CA_COMMON_NAME = "local-router Local CA";
+var OPENSSL_TIMEOUT_MS = 15e3;
+var CA_KEY_FILE = "ca-key.pem";
+var CA_CERT_FILE = "ca.pem";
+var SERVER_KEY_FILE = "server-key.pem";
+var SERVER_CERT_FILE = "server.pem";
+var HOST_CERTS_DIR = "host-certs";
+var MAX_CN_LENGTH = 64;
+var execFileAsync = promisify(execFileCb);
+function fileExists(filePath) {
+  try {
+    fs2.accessSync(filePath, fs2.constants.R_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function openssl(args, options) {
+  try {
+    return execFileSync("openssl", args, {
+      encoding: "utf-8",
+      input: options?.input,
+      timeout: OPENSSL_TIMEOUT_MS,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(
+      `openssl failed: ${message}
+
+Install or expose openssl in PATH before using HTTPS.`
+    );
+  }
+}
+async function opensslAsync(args) {
+  try {
+    const { stdout } = await execFileAsync("openssl", args, {
+      encoding: "utf-8",
+      timeout: OPENSSL_TIMEOUT_MS
+    });
+    return stdout;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(
+      `openssl failed: ${message}
+
+Install or expose openssl in PATH before using HTTPS.`
+    );
+  }
+}
+function isCertValid(certPath) {
+  try {
+    const cert = new crypto.X509Certificate(fs2.readFileSync(certPath, "utf-8"));
+    const expiry = new Date(cert.validTo).getTime();
+    return Date.now() + EXPIRY_BUFFER_MS < expiry;
+  } catch {
+    return false;
+  }
+}
+function isCertSignatureStrong(certPath) {
+  try {
+    const text = openssl(["x509", "-in", certPath, "-noout", "-text"]);
+    const match = text.match(/Signature Algorithm:\s*(\S+)/i);
+    return !!match && !match[1].toLowerCase().includes("sha1");
+  } catch {
+    return false;
+  }
+}
+function generateCA(stateDir) {
+  const keyPath = path.join(stateDir, CA_KEY_FILE);
+  const certPath = path.join(stateDir, CA_CERT_FILE);
+  openssl(["ecparam", "-genkey", "-name", "prime256v1", "-noout", "-out", keyPath]);
+  openssl([
+    "req",
+    "-new",
+    "-x509",
+    "-sha256",
+    "-key",
+    keyPath,
+    "-out",
+    certPath,
+    "-days",
+    String(CA_VALIDITY_DAYS),
+    "-subj",
+    `/CN=${CA_COMMON_NAME}`,
+    "-addext",
+    "basicConstraints=critical,CA:TRUE",
+    "-addext",
+    "keyUsage=critical,keyCertSign,cRLSign"
+  ]);
+  fs2.chmodSync(keyPath, 384);
+  fs2.chmodSync(certPath, 420);
+  fixOwnership(keyPath, certPath);
+  return { certPath, keyPath };
+}
+function generateBaseServerCert(stateDir) {
+  const caKeyPath = path.join(stateDir, CA_KEY_FILE);
+  const caCertPath = path.join(stateDir, CA_CERT_FILE);
+  const serverKeyPath = path.join(stateDir, SERVER_KEY_FILE);
+  const serverCertPath = path.join(stateDir, SERVER_CERT_FILE);
+  const csrPath = path.join(stateDir, "server.csr");
+  const extPath = path.join(stateDir, "server-ext.cnf");
+  openssl(["ecparam", "-genkey", "-name", "prime256v1", "-noout", "-out", serverKeyPath]);
+  openssl(["req", "-new", "-key", serverKeyPath, "-out", csrPath, "-subj", "/CN=localhost"]);
+  fs2.writeFileSync(
+    extPath,
+    [
+      "authorityKeyIdentifier=keyid,issuer",
+      "basicConstraints=CA:FALSE",
+      "keyUsage=digitalSignature,keyEncipherment",
+      "extendedKeyUsage=serverAuth",
+      "subjectAltName=DNS:localhost,DNS:*.localhost"
+    ].join("\n") + "\n"
+  );
+  openssl([
+    "x509",
+    "-req",
+    "-sha256",
+    "-in",
+    csrPath,
+    "-CA",
+    caCertPath,
+    "-CAkey",
+    caKeyPath,
+    "-CAcreateserial",
+    "-out",
+    serverCertPath,
+    "-days",
+    String(SERVER_VALIDITY_DAYS),
+    "-extfile",
+    extPath
+  ]);
+  for (const tempPath of [csrPath, extPath]) {
+    try {
+      fs2.unlinkSync(tempPath);
+    } catch {
+    }
+  }
+  fs2.chmodSync(serverKeyPath, 384);
+  fs2.chmodSync(serverCertPath, 420);
+  fixOwnership(serverKeyPath, serverCertPath);
+  return { certPath: serverCertPath, keyPath: serverKeyPath };
+}
+function ensureCerts(stateDir) {
+  const caCertPath = path.join(stateDir, CA_CERT_FILE);
+  const caKeyPath = path.join(stateDir, CA_KEY_FILE);
+  const serverCertPath = path.join(stateDir, SERVER_CERT_FILE);
+  const serverKeyPath = path.join(stateDir, SERVER_KEY_FILE);
+  let caGenerated = false;
+  if (!fileExists(caCertPath) || !fileExists(caKeyPath) || !isCertValid(caCertPath) || !isCertSignatureStrong(caCertPath)) {
+    generateCA(stateDir);
+    caGenerated = true;
+  }
+  if (caGenerated || !fileExists(serverCertPath) || !fileExists(serverKeyPath) || !isCertValid(serverCertPath) || !isCertSignatureStrong(serverCertPath)) {
+    generateBaseServerCert(stateDir);
+  }
+  return {
+    certPath: serverCertPath,
+    keyPath: serverKeyPath,
+    caPath: caCertPath,
+    caGenerated
+  };
+}
+function sanitizeHostForFilename(hostname) {
+  return hostname.replace(/\./g, "_").replace(/[^a-z0-9_-]/gi, "");
+}
+async function generateHostCertAsync(stateDir, hostname) {
+  const caKeyPath = path.join(stateDir, CA_KEY_FILE);
+  const caCertPath = path.join(stateDir, CA_CERT_FILE);
+  const hostCertDir = path.join(stateDir, HOST_CERTS_DIR);
+  if (!fs2.existsSync(hostCertDir)) {
+    await fs2.promises.mkdir(hostCertDir, { recursive: true, mode: 493 });
+    fixOwnership(hostCertDir);
+  }
+  const safeName = sanitizeHostForFilename(hostname);
+  const keyPath = path.join(hostCertDir, `${safeName}-key.pem`);
+  const certPath = path.join(hostCertDir, `${safeName}.pem`);
+  const csrPath = path.join(hostCertDir, `${safeName}.csr`);
+  const extPath = path.join(hostCertDir, `${safeName}-ext.cnf`);
+  await opensslAsync(["ecparam", "-genkey", "-name", "prime256v1", "-noout", "-out", keyPath]);
+  const commonName = hostname.length > MAX_CN_LENGTH ? hostname.slice(0, MAX_CN_LENGTH) : hostname;
+  await opensslAsync(["req", "-new", "-key", keyPath, "-out", csrPath, "-subj", `/CN=${commonName}`]);
+  fs2.writeFileSync(
+    extPath,
+    [
+      "authorityKeyIdentifier=keyid,issuer",
+      "basicConstraints=CA:FALSE",
+      "keyUsage=digitalSignature,keyEncipherment",
+      "extendedKeyUsage=serverAuth",
+      `subjectAltName=DNS:${hostname}`
+    ].join("\n") + "\n"
+  );
+  await opensslAsync([
+    "x509",
+    "-req",
+    "-sha256",
+    "-in",
+    csrPath,
+    "-CA",
+    caCertPath,
+    "-CAkey",
+    caKeyPath,
+    "-CAcreateserial",
+    "-out",
+    certPath,
+    "-days",
+    String(SERVER_VALIDITY_DAYS),
+    "-extfile",
+    extPath
+  ]);
+  for (const tempPath of [csrPath, extPath]) {
+    try {
+      fs2.unlinkSync(tempPath);
+    } catch {
+    }
+  }
+  fs2.chmodSync(keyPath, 384);
+  fs2.chmodSync(certPath, 420);
+  fixOwnership(keyPath, certPath);
+  return { certPath, keyPath };
+}
+function createSNICallback(stateDir, defaultCert, defaultKey) {
+  const cache = /* @__PURE__ */ new Map();
+  const defaultContext = tls.createSecureContext({ cert: defaultCert, key: defaultKey });
+  return async (servername, callback) => {
+    try {
+      if (!servername || servername === "localhost") {
+        callback(null, defaultContext);
+        return;
+      }
+      const cached = cache.get(servername);
+      if (cached) {
+        callback(null, cached);
+        return;
+      }
+      const safeName = sanitizeHostForFilename(servername);
+      const certPath = path.join(stateDir, HOST_CERTS_DIR, `${safeName}.pem`);
+      const keyPath = path.join(stateDir, HOST_CERTS_DIR, `${safeName}-key.pem`);
+      let resolvedCertPath = certPath;
+      let resolvedKeyPath = keyPath;
+      if (!fileExists(certPath) || !fileExists(keyPath) || !isCertValid(certPath) || !isCertSignatureStrong(certPath)) {
+        const generated = await generateHostCertAsync(stateDir, servername);
+        resolvedCertPath = generated.certPath;
+        resolvedKeyPath = generated.keyPath;
+      }
+      const context = tls.createSecureContext({
+        cert: fs2.readFileSync(resolvedCertPath),
+        key: fs2.readFileSync(resolvedKeyPath)
+      });
+      cache.set(servername, context);
+      callback(null, context);
+    } catch (error) {
+      callback(error instanceof Error ? error : new Error(String(error)), defaultContext);
+    }
+  };
+}
+function isCATrustedMacOS(caCertPath) {
+  try {
+    execFileSync("security", ["verify-cert", "-c", caCertPath, "-L", "-p", "ssl"], {
+      stdio: "pipe",
+      timeout: 5e3
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function isCATrustedLinux(stateDir) {
+  const candidatePaths = [
+    "/usr/local/share/ca-certificates/local-router-ca.crt",
+    "/etc/pki/ca-trust/source/anchors/local-router-ca.crt",
+    "/etc/ca-certificates/trust-source/anchors/local-router-ca.crt",
+    "/etc/pki/trust/anchors/local-router-ca.crt"
+  ];
+  const localCert = path.join(stateDir, CA_CERT_FILE);
+  if (!fileExists(localCert)) return false;
+  for (const candidate of candidatePaths) {
+    try {
+      if (fs2.readFileSync(candidate, "utf-8").trim() === fs2.readFileSync(localCert, "utf-8").trim()) {
+        return true;
+      }
+    } catch {
+    }
+  }
+  return false;
+}
+function isCATrustedWindows(caCertPath) {
+  try {
+    const fingerprint = openssl(["x509", "-in", caCertPath, "-noout", "-fingerprint", "-sha1"]).trim().replace(/^.*=/, "").replace(/:/g, "").toLowerCase();
+    const result = execFileSync("certutil", ["-store", "-user", "Root"], {
+      encoding: "utf-8",
+      timeout: 1e4,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    return result.replace(/\s/g, "").toLowerCase().includes(fingerprint);
+  } catch {
+    return false;
+  }
+}
+function isCATrusted(stateDir) {
+  const caCertPath = path.join(stateDir, CA_CERT_FILE);
+  if (!fileExists(caCertPath)) return false;
+  if (process.platform === "darwin") return isCATrustedMacOS(caCertPath);
+  if (process.platform === "linux") return isCATrustedLinux(stateDir);
+  if (process.platform === "win32") return isCATrustedWindows(caCertPath);
+  return false;
+}
+function trustCA(stateDir) {
+  const caCertPath = path.join(stateDir, CA_CERT_FILE);
+  if (!fileExists(caCertPath)) {
+    return { trusted: false, error: "CA certificate not found. Start the proxy with HTTPS first." };
+  }
+  try {
+    if (process.platform === "darwin") {
+      execFileSync("security", ["add-trusted-cert", "-d", "-r", "trustRoot", "-k", "/Library/Keychains/System.keychain", caCertPath], {
+        stdio: "pipe",
+        timeout: 1e4
+      });
+      return { trusted: true };
+    }
+    if (process.platform === "linux") {
+      const destination = fs2.existsSync("/usr/local/share/ca-certificates") ? "/usr/local/share/ca-certificates/local-router-ca.crt" : "/etc/pki/ca-trust/source/anchors/local-router-ca.crt";
+      fs2.copyFileSync(caCertPath, destination);
+      const updateCommand = fs2.existsSync("/usr/sbin/update-ca-certificates") || fs2.existsSync("/usr/bin/update-ca-certificates") ? ["update-ca-certificates"] : ["update-ca-trust"];
+      execFileSync(updateCommand[0], [], { stdio: "pipe", timeout: 15e3 });
+      return { trusted: true };
+    }
+    if (process.platform === "win32") {
+      execFileSync("certutil", ["-addstore", "-user", "Root", caCertPath], {
+        stdio: "pipe",
+        timeout: 1e4
+      });
+      return { trusted: true };
+    }
+    return { trusted: false, error: `Unsupported platform: ${process.platform}` };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return { trusted: false, error: message };
+  }
+}
+
+// src/config.ts
+import * as fs4 from "fs";
+import * as path3 from "path";
+import JSON5 from "json5";
+
+// src/auto.ts
+import { createHash } from "crypto";
+import { execFileSync as execFileSync2 } from "child_process";
+import * as fs3 from "fs";
+import * as path2 from "path";
+var MAX_DNS_LABEL_LENGTH = 63;
+function truncateLabel(label) {
+  if (label.length <= MAX_DNS_LABEL_LENGTH) return label;
+  const hash = createHash("sha256").update(label).digest("hex").slice(0, 6);
+  const maxPrefixLength = MAX_DNS_LABEL_LENGTH - 7;
+  const prefix = label.slice(0, maxPrefixLength).replace(/-+$/, "");
+  return `${prefix}-${hash}`;
+}
+function sanitizeForHostname(name) {
+  const sanitized = name.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-{2,}/g, "-").replace(/^-+|-+$/g, "");
+  return truncateLabel(sanitized);
+}
+function findPackageJsonName(startDir) {
+  let dir = startDir;
+  for (; ; ) {
+    const packageJsonPath = path2.join(dir, "package.json");
+    try {
+      const raw = fs3.readFileSync(packageJsonPath, "utf-8");
+      const pkg = JSON.parse(raw);
+      if (typeof pkg.name === "string" && pkg.name) {
+        return pkg.name.replace(/^@[^/]+\//, "");
+      }
+    } catch {
+    }
+    const parent = path2.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+}
+function findGitRoot(startDir) {
+  try {
+    const output = execFileSync2("git", ["rev-parse", "--show-toplevel"], {
+      cwd: startDir,
+      encoding: "utf-8",
+      timeout: 5e3,
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    if (output) return output;
+  } catch {
+  }
+  let dir = startDir;
+  for (; ; ) {
+    const gitPath = path2.join(dir, ".git");
+    try {
+      const stats = fs3.statSync(gitPath);
+      if (stats.isDirectory() || stats.isFile()) {
+        return dir;
+      }
+    } catch {
+    }
+    const parent = path2.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+}
+function inferProjectName(cwd = process.cwd()) {
+  const packageName = findPackageJsonName(cwd);
+  if (packageName) {
+    const sanitized = sanitizeForHostname(packageName);
+    if (sanitized) {
+      return { name: sanitized, source: "package.json" };
+    }
+  }
+  const gitRoot = findGitRoot(cwd);
+  if (gitRoot) {
+    const sanitized = sanitizeForHostname(path2.basename(gitRoot));
+    if (sanitized) {
+      return { name: sanitized, source: "git root" };
+    }
+  }
+  const directoryName = sanitizeForHostname(path2.basename(cwd));
+  if (directoryName) {
+    return { name: directoryName, source: "directory name" };
+  }
+  throw new Error("Could not infer a project name from package.json, git root, or directory name.");
+}
+
+// src/config.ts
+var CONFIG_FILENAMES = [".local-router", ".local-router.json", "local-router.config.json"];
+function findLocalRouterConfig(cwd = process.cwd()) {
+  let dir = cwd;
+  for (; ; ) {
+    for (const filename of CONFIG_FILENAMES) {
+      const candidate = path3.join(dir, filename);
+      if (fs4.existsSync(candidate)) {
+        return candidate;
+      }
+    }
+    const parent = path3.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+}
+function loadLocalRouterConfig(cwd = process.cwd()) {
+  const configPath = findLocalRouterConfig(cwd);
+  if (!configPath) return null;
+  const raw = fs4.readFileSync(configPath, "utf-8");
+  const parsed = JSON5.parse(raw);
+  if (parsed && typeof parsed === "object") {
+    if (parsed.name !== void 0 && typeof parsed.name !== "string") {
+      throw new Error(`Invalid "name" in ${configPath}: expected a string.`);
+    }
+    if (parsed.hosts !== void 0) {
+      if (!Array.isArray(parsed.hosts) || parsed.hosts.some((item) => typeof item !== "string")) {
+        throw new Error(`Invalid "hosts" in ${configPath}: expected an array of strings.`);
+      }
+    }
+  } else {
+    throw new Error(`Invalid ${configPath}: expected an object.`);
+  }
+  return { config: parsed, path: configPath };
+}
+function buildLocalhostName(name) {
+  const sanitized = sanitizeForHostname(name);
+  if (!sanitized) {
+    throw new Error(`Invalid project name "${name}".`);
+  }
+  return `${sanitized}.localhost`;
+}
+function dedupe(values) {
+  return Array.from(new Set(values));
+}
+function resolveProjectHosts(options) {
+  const cwd = options?.cwd ?? process.cwd();
+  const loadedConfig = loadLocalRouterConfig(cwd);
+  const inferred = inferProjectName(cwd);
+  let effectiveName;
+  let nameSource;
+  if (options?.explicitName) {
+    effectiveName = options.explicitName;
+    nameSource = "--name";
+  } else if (loadedConfig?.config.name) {
+    effectiveName = loadedConfig.config.name;
+    nameSource = loadedConfig.path;
+  } else {
+    effectiveName = inferred.name;
+    nameSource = inferred.source;
+  }
+  const baseHostname = buildLocalhostName(effectiveName);
+  const configHosts = loadedConfig?.config.hosts ?? [];
+  const cliHosts = options?.extraDomains ?? [];
+  const hostnames = dedupe([
+    baseHostname,
+    ...configHosts.map((host) => normalizeExplicitHostname(host)),
+    ...cliHosts.map((host) => normalizeExplicitHostname(host))
+  ]);
+  return {
+    name: sanitizeForHostname(effectiveName),
+    baseHostname,
+    hostnames,
+    configPath: loadedConfig?.path,
+    nameSource
+  };
+}
+
+// src/hosts.ts
+import * as dns from "dns";
+import * as fs5 from "fs";
+import * as path4 from "path";
+var isWindows = process.platform === "win32";
+var HOSTS_PATH = isWindows ? path4.join(process.env.SystemRoot ?? "C:\\Windows", "System32", "drivers", "etc", "hosts") : "/etc/hosts";
+var MARKER_START = "# local-router-start";
+var MARKER_END = "# local-router-end";
+function readHostsFile() {
+  try {
+    return fs5.readFileSync(HOSTS_PATH, "utf-8");
+  } catch {
+    return "";
+  }
+}
+function removeManagedBlock(content) {
+  const startIndex = content.indexOf(MARKER_START);
+  const endIndex = content.indexOf(MARKER_END);
+  if (startIndex === -1 || endIndex === -1) return content;
+  const before = content.slice(0, startIndex);
+  const after = content.slice(endIndex + MARKER_END.length);
+  return (before + after).replace(/\n{3,}/g, "\n\n").trimEnd() + "\n";
+}
+function buildManagedBlock(hostnames) {
+  if (hostnames.length === 0) return "";
+  const ipv4Entries = hostnames.map((hostname) => `127.0.0.1 ${hostname}`).join("\n");
+  const ipv6Entries = hostnames.map((hostname) => `::1 ${hostname}`).join("\n");
+  return `${MARKER_START}
+${ipv4Entries}
+${ipv6Entries}
+${MARKER_END}`;
+}
+function syncHostsFile(hostnames) {
+  try {
+    const uniqueHostnames = Array.from(new Set(hostnames)).sort();
+    const current = readHostsFile();
+    const cleaned = removeManagedBlock(current);
+    if (uniqueHostnames.length === 0) {
+      fs5.writeFileSync(HOSTS_PATH, cleaned);
+      return true;
+    }
+    const managedBlock = buildManagedBlock(uniqueHostnames);
+    fs5.writeFileSync(HOSTS_PATH, `${cleaned.trimEnd()}
+
+${managedBlock}
+`);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function cleanHostsFile() {
+  try {
+    const content = readHostsFile();
+    if (!content.includes(MARKER_START)) return true;
+    fs5.writeFileSync(HOSTS_PATH, removeManagedBlock(content));
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/proxy.ts
+import * as http2 from "http";
+import * as http22 from "http2";
+
+// src/state.ts
+import * as fs6 from "fs";
+import * as http from "http";
+import * as https from "https";
+import * as net from "net";
+import * as os from "os";
+import * as path5 from "path";
+import * as readline from "readline";
+import { execSync, spawn } from "child_process";
+var isWindows2 = process.platform === "win32";
+var PRIVILEGED_PORT_THRESHOLD = 1024;
+var DEFAULT_HTTP_PORT = 80;
+var DEFAULT_HTTPS_PORT = 443;
+var SYSTEM_STATE_DIR = isWindows2 ? path5.join(os.tmpdir(), "local-router") : "/tmp/local-router";
+var USER_STATE_DIR = path5.join(os.homedir(), ".local-router");
+var MIN_APP_PORT = 4e3;
+var MAX_APP_PORT = 4999;
+var RANDOM_PORT_ATTEMPTS = 50;
+var SOCKET_TIMEOUT_MS = 750;
+var WAIT_FOR_PROXY_MAX_ATTEMPTS = 24;
+var WAIT_FOR_PROXY_INTERVAL_MS = 250;
+var HEALTH_HEADER = "x-local-router";
+var SIGNAL_CODES = {
+  SIGHUP: 1,
+  SIGINT: 2,
+  SIGQUIT: 3,
+  SIGABRT: 6,
+  SIGKILL: 9,
+  SIGTERM: 15
+};
+function getDefaultHttpPort() {
+  const value = Number(process.env.LOCAL_ROUTER_HTTP_PORT);
+  return Number.isInteger(value) && value > 0 && value <= 65535 ? value : DEFAULT_HTTP_PORT;
+}
+function getDefaultHttpsPort() {
+  const value = Number(process.env.LOCAL_ROUTER_HTTPS_PORT);
+  return Number.isInteger(value) && value > 0 && value <= 65535 ? value : DEFAULT_HTTPS_PORT;
+}
+function resolveStateDir(runtime) {
+  if (process.env.LOCAL_ROUTER_STATE_DIR) return process.env.LOCAL_ROUTER_STATE_DIR;
+  const httpPort = runtime?.httpPort ?? getDefaultHttpPort();
+  const httpsPort = runtime?.httpsPort ?? getDefaultHttpsPort();
+  const needsSystemDir = !isWindows2 && ((runtime?.httpEnabled ?? true) && httpPort < PRIVILEGED_PORT_THRESHOLD || (runtime?.httpsEnabled ?? true) && httpsPort < PRIVILEGED_PORT_THRESHOLD);
+  return needsSystemDir ? SYSTEM_STATE_DIR : USER_STATE_DIR;
+}
+function readProxyState(dir) {
+  try {
+    const raw = fs6.readFileSync(path5.join(dir, "proxy-state.json"), "utf-8");
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+function writeProxyState(dir, state) {
+  fs6.writeFileSync(path5.join(dir, "proxy-state.json"), JSON.stringify(state, null, 2), { mode: 420 });
+}
+function removeProxyState(dir) {
+  try {
+    fs6.unlinkSync(path5.join(dir, "proxy-state.json"));
+  } catch {
+  }
+}
+function requestHealth(port, tls2) {
+  return new Promise((resolve) => {
+    const request2 = (tls2 ? https : http).request(
+      {
+        hostname: "127.0.0.1",
+        port,
+        path: "/__local_router/health",
+        method: "HEAD",
+        timeout: SOCKET_TIMEOUT_MS,
+        ...tls2 ? { rejectUnauthorized: false } : {}
+      },
+      (response) => {
+        response.resume();
+        resolve(response.headers[HEALTH_HEADER] === "1");
+      }
+    );
+    request2.on("error", () => resolve(false));
+    request2.on("timeout", () => {
+      request2.destroy();
+      resolve(false);
+    });
+    request2.end();
+  });
+}
+async function isProxyRunning(runtime) {
+  const checks = [];
+  if (runtime.httpEnabled) {
+    checks.push(requestHealth(runtime.httpPort, false));
+  }
+  if (runtime.httpsEnabled) {
+    checks.push(requestHealth(runtime.httpsPort, true));
+  }
+  if (checks.length === 0) return false;
+  const results = await Promise.all(checks);
+  return results.every(Boolean);
+}
+async function discoverState() {
+  if (process.env.LOCAL_ROUTER_STATE_DIR) {
+    const dir = process.env.LOCAL_ROUTER_STATE_DIR;
+    return { dir, state: readProxyState(dir) };
+  }
+  for (const dir of [USER_STATE_DIR, SYSTEM_STATE_DIR]) {
+    const state = readProxyState(dir);
+    if (!state) continue;
+    if (await isProxyRunning(state)) {
+      return { dir, state };
+    }
+  }
+  const fallback = {
+    pid: 0,
+    httpPort: getDefaultHttpPort(),
+    httpsPort: getDefaultHttpsPort(),
+    httpEnabled: true,
+    httpsEnabled: true
+  };
+  return { dir: resolveStateDir(fallback), state: null };
+}
+async function waitForProxy(runtime) {
+  for (let attempt = 0; attempt < WAIT_FOR_PROXY_MAX_ATTEMPTS; attempt += 1) {
+    await new Promise((resolve) => setTimeout(resolve, WAIT_FOR_PROXY_INTERVAL_MS));
+    if (await isProxyRunning(runtime)) {
+      return true;
+    }
+  }
+  return false;
+}
+async function findFreePort(minPort = MIN_APP_PORT, maxPort = MAX_APP_PORT) {
+  if (minPort > maxPort) {
+    throw new Error(`Invalid app port range: ${minPort}-${maxPort}.`);
+  }
+  const tryPort = (port) => new Promise((resolve) => {
+    const server = net.createServer();
+    server.listen(port, () => server.close(() => resolve(true)));
+    server.on("error", () => resolve(false));
+  });
+  for (let attempt = 0; attempt < RANDOM_PORT_ATTEMPTS; attempt += 1) {
+    const port = minPort + Math.floor(Math.random() * (maxPort - minPort + 1));
+    if (await tryPort(port)) return port;
+  }
+  for (let port = minPort; port <= maxPort; port += 1) {
+    if (await tryPort(port)) return port;
+  }
+  throw new Error(`Could not find a free port between ${minPort} and ${maxPort}.`);
+}
+function collectBinPaths(cwd) {
+  const results = [];
+  let dir = cwd;
+  for (; ; ) {
+    const binDir = path5.join(dir, "node_modules", ".bin");
+    if (fs6.existsSync(binDir)) {
+      results.push(binDir);
+    }
+    const parent = path5.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return results;
+}
+function augmentedPath(env) {
+  const source = env ?? process.env;
+  const basePath = source.PATH ?? source.Path ?? "";
+  const nodeBin = path5.dirname(process.execPath);
+  return [...collectBinPaths(process.cwd()), nodeBin, basePath].join(path5.delimiter);
+}
+function shellEscape(value) {
+  return `'${value.replace(/'/g, "'\\''")}'`;
+}
+function spawnCommand(commandArgs, options) {
+  const env = { ...options?.env ?? process.env, PATH: augmentedPath(options?.env) };
+  const child = isWindows2 ? spawn(commandArgs[0], commandArgs.slice(1), {
+    stdio: "inherit",
+    env,
+    shell: true
+  }) : spawn("/bin/sh", ["-c", commandArgs.map(shellEscape).join(" ")], {
+    stdio: "inherit",
+    env
+  });
+  let exiting = false;
+  const cleanup = () => {
+    process.removeListener("SIGINT", onSigInt);
+    process.removeListener("SIGTERM", onSigTerm);
+    options?.onCleanup?.();
+  };
+  const handleSignal = (signal) => {
+    if (exiting) return;
+    exiting = true;
+    child.kill(signal);
+    cleanup();
+    process.exit(128 + (SIGNAL_CODES[signal] || 15));
+  };
+  const onSigInt = () => handleSignal("SIGINT");
+  const onSigTerm = () => handleSignal("SIGTERM");
+  process.on("SIGINT", onSigInt);
+  process.on("SIGTERM", onSigTerm);
+  child.on("error", (error) => {
+    if (exiting) return;
+    exiting = true;
+    console.error(`Failed to run command: ${error.message}`);
+    cleanup();
+    process.exit(1);
+  });
+  child.on("exit", (code, signal) => {
+    if (exiting) return;
+    exiting = true;
+    cleanup();
+    if (signal) {
+      process.exit(128 + (SIGNAL_CODES[signal] || 15));
+    }
+    process.exit(code ?? 1);
+  });
+}
+function prompt(question) {
+  return new Promise((resolve) => {
+    const rl = readline.createInterface({
+      input: process.stdin,
+      output: process.stdout
+    });
+    rl.question(question, (answer) => {
+      rl.close();
+      resolve(answer.trim().toLowerCase());
+    });
+  });
+}
+function findPidOnPort(port) {
+  try {
+    if (isWindows2) {
+      const output2 = execSync("netstat -ano -p tcp", { encoding: "utf-8", timeout: 5e3 });
+      for (const line of output2.split(/\r?\n/)) {
+        if (!line.includes("LISTENING") || !line.includes(`:${port}`)) continue;
+        const pid2 = Number(line.trim().split(/\s+/).at(-1));
+        if (Number.isInteger(pid2) && pid2 > 0) return pid2;
+      }
+      return null;
+    }
+    const output = execSync(`lsof -ti tcp:${port} -sTCP:LISTEN`, {
+      encoding: "utf-8",
+      timeout: 5e3
+    }).trim();
+    const pid = Number(output.split("\n")[0]);
+    return Number.isInteger(pid) && pid > 0 ? pid : null;
+  } catch {
+    return null;
+  }
+}
+var FRAMEWORKS_NEEDING_PORT = {
+  vite: { strictPort: true },
+  "react-router": { strictPort: true },
+  astro: { strictPort: false },
+  ng: { strictPort: false },
+  "react-native": { strictPort: false },
+  expo: { strictPort: false }
+};
+var PACKAGE_RUNNERS = {
+  npx: [],
+  bunx: [],
+  pnpx: [],
+  yarn: ["dlx", "exec"],
+  pnpm: ["dlx", "exec"]
+};
+function findFrameworkBasename(commandArgs) {
+  if (commandArgs.length === 0) return null;
+  const first = path5.basename(commandArgs[0]);
+  if (FRAMEWORKS_NEEDING_PORT[first]) return first;
+  const subcommands = PACKAGE_RUNNERS[first];
+  if (!subcommands) return null;
+  let index = 1;
+  if (subcommands.length > 0) {
+    while (index < commandArgs.length && commandArgs[index].startsWith("-")) index += 1;
+    if (index >= commandArgs.length) return null;
+    if (!subcommands.includes(commandArgs[index])) {
+      const name2 = path5.basename(commandArgs[index]);
+      return FRAMEWORKS_NEEDING_PORT[name2] ? name2 : null;
+    }
+    index += 1;
+  }
+  while (index < commandArgs.length && commandArgs[index].startsWith("-")) index += 1;
+  if (index >= commandArgs.length) return null;
+  const name = path5.basename(commandArgs[index]);
+  return FRAMEWORKS_NEEDING_PORT[name] ? name : null;
+}
+function injectFrameworkFlags(commandArgs, port) {
+  const basename3 = findFrameworkBasename(commandArgs);
+  if (!basename3) return;
+  if (!commandArgs.includes("--port")) {
+    commandArgs.push("--port", String(port));
+  }
+  if (!commandArgs.includes("--host")) {
+    const hostValue = basename3 === "expo" ? "localhost" : "127.0.0.1";
+    commandArgs.push("--host", hostValue);
+  }
+  if (FRAMEWORKS_NEEDING_PORT[basename3].strictPort && !commandArgs.includes("--strictPort")) {
+    commandArgs.push("--strictPort");
+  }
+}
+function getHealthHeader() {
+  return HEALTH_HEADER;
+}
+
+// src/proxy.ts
+function getRequestHost(req) {
+  const authority = req.headers[":authority"];
+  if (typeof authority === "string" && authority) return authority;
+  return req.headers.host ?? "";
+}
+function buildForwardedHeaders(req, tls2) {
+  const remoteAddress = req.socket.remoteAddress || "127.0.0.1";
+  const hostHeader = getRequestHost(req);
+  return {
+    "x-forwarded-for": req.headers["x-forwarded-for"] ? `${req.headers["x-forwarded-for"]}, ${remoteAddress}` : remoteAddress,
+    "x-forwarded-proto": req.headers["x-forwarded-proto"] || (tls2 ? "https" : "http"),
+    "x-forwarded-host": req.headers["x-forwarded-host"] || hostHeader,
+    "x-forwarded-port": req.headers["x-forwarded-port"] || hostHeader.split(":")[1] || (tls2 ? "443" : "80")
+  };
+}
+function findRoute(routes, host) {
+  return routes.find((route) => route.hostname === host);
+}
+function createNotFoundResponse(host, routes, https2, port) {
+  const links = routes.map(
+    (route) => `<li><a href="${escapeHtml(formatUrl(route.hostname, https2, port))}">${escapeHtml(route.hostname)}</a></li>`
+  ).join("");
+  return `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <title>Route not found</title>
+    <style>
+      body { font-family: system-ui, sans-serif; padding: 32px; line-height: 1.5; }
+      h1 { margin: 0 0 12px; }
+      code { background: #f3f4f6; padding: 2px 6px; border-radius: 6px; }
+    </style>
+  </head>
+  <body>
+    <h1>No route for <code>${escapeHtml(host)}</code></h1>
+    <p>Start an app with <code>local-router run ...</code> or check the configured hostnames.</p>
+    ${links ? `<ul>${links}</ul>` : "<p>No apps are currently registered.</p>"}
+  </body>
+</html>`;
+}
+function createProxyServers(options) {
+  const onError = options.onError ?? ((message) => console.error(message));
+  const handleRequest = (httpsRequest) => (req, res) => {
+    res.setHeader(getHealthHeader(), "1");
+    if (req.method === "HEAD" && req.url === "/__local_router/health") {
+      res.writeHead(200);
+      res.end();
+      return;
+    }
+    const host = getRequestHost(req).split(":")[0];
+    if (!host) {
+      res.writeHead(400, { "content-type": "text/plain" });
+      res.end("Missing Host header.");
+      return;
+    }
+    const route = findRoute(options.getRoutes(), host);
+    if (!route) {
+      res.writeHead(404, { "content-type": "text/html; charset=utf-8" });
+      res.end(
+        createNotFoundResponse(
+          host,
+          options.getRoutes(),
+          httpsRequest,
+          httpsRequest ? options.httpsPort : options.httpPort
+        )
+      );
+      return;
+    }
+    const headers = { ...req.headers, ...buildForwardedHeaders(req, httpsRequest) };
+    headers.host = getRequestHost(req);
+    for (const key of Object.keys(headers)) {
+      if (key.startsWith(":")) {
+        delete headers[key];
+      }
+    }
+    const proxyRequest = http2.request(
+      {
+        hostname: "127.0.0.1",
+        port: route.port,
+        path: req.url,
+        method: req.method,
+        headers
+      },
+      (proxyResponse) => {
+        const responseHeaders = { ...proxyResponse.headers };
+        if (httpsRequest) {
+          delete responseHeaders.connection;
+          delete responseHeaders["keep-alive"];
+          delete responseHeaders["proxy-connection"];
+          delete responseHeaders["transfer-encoding"];
+          delete responseHeaders.upgrade;
+        }
+        res.writeHead(proxyResponse.statusCode || 502, responseHeaders);
+        proxyResponse.on("error", () => {
+          if (!res.headersSent) {
+            res.writeHead(502, { "content-type": "text/plain" });
+          }
+          res.end();
+        });
+        proxyResponse.pipe(res);
+      }
+    );
+    proxyRequest.on("error", (error) => {
+      onError(`Proxy error for ${host}: ${error.message}`);
+      if (!res.headersSent) {
+        res.writeHead(502, { "content-type": "text/plain" });
+        res.end("Target app is not responding.");
+      }
+    });
+    res.on("close", () => {
+      if (!proxyRequest.destroyed) {
+        proxyRequest.destroy();
+      }
+    });
+    req.pipe(proxyRequest);
+  };
+  const handleUpgrade = (httpsRequest) => (req, socket, head) => {
+    socket.on("error", () => socket.destroy());
+    const host = getRequestHost(req).split(":")[0];
+    const route = findRoute(options.getRoutes(), host);
+    if (!route) {
+      socket.destroy();
+      return;
+    }
+    const headers = { ...req.headers, ...buildForwardedHeaders(req, httpsRequest) };
+    headers.host = getRequestHost(req);
+    for (const key of Object.keys(headers)) {
+      if (key.startsWith(":")) {
+        delete headers[key];
+      }
+    }
+    const proxyRequest = http2.request({
+      hostname: "127.0.0.1",
+      port: route.port,
+      path: req.url,
+      method: req.method,
+      headers
+    });
+    proxyRequest.on("upgrade", (proxyResponse, proxySocket, proxyHead) => {
+      let response = "HTTP/1.1 101 Switching Protocols\r\n";
+      for (let index = 0; index < proxyResponse.rawHeaders.length; index += 2) {
+        response += `${proxyResponse.rawHeaders[index]}: ${proxyResponse.rawHeaders[index + 1]}\r
+`;
+      }
+      response += "\r\n";
+      socket.write(response);
+      if (proxyHead.length > 0) {
+        socket.write(proxyHead);
+      }
+      proxySocket.pipe(socket);
+      socket.pipe(proxySocket);
+      proxySocket.on("error", () => socket.destroy());
+      socket.on("error", () => proxySocket.destroy());
+    });
+    proxyRequest.on("response", (response) => {
+      if (!socket.destroyed) {
+        let raw = `HTTP/1.1 ${response.statusCode} ${response.statusMessage}\r
+`;
+        for (let index = 0; index < response.rawHeaders.length; index += 2) {
+          raw += `${response.rawHeaders[index]}: ${response.rawHeaders[index + 1]}\r
+`;
+        }
+        raw += "\r\n";
+        socket.write(raw);
+        response.pipe(socket);
+      }
+    });
+    proxyRequest.on("error", (error) => {
+      onError(`WebSocket proxy error for ${host}: ${error.message}`);
+      socket.destroy();
+    });
+    if (head.length > 0) {
+      proxyRequest.write(head);
+    }
+    proxyRequest.end();
+  };
+  const bundle = {};
+  if (options.httpEnabled) {
+    const server = http2.createServer(handleRequest(false));
+    server.on("upgrade", handleUpgrade(false));
+    bundle.httpServer = server;
+  }
+  if (options.httpsEnabled && options.tls) {
+    const server = http22.createSecureServer({
+      cert: options.tls.cert,
+      key: options.tls.key,
+      allowHTTP1: true,
+      ...options.tls.SNICallback ? { SNICallback: options.tls.SNICallback } : {}
+    });
+    server.on("request", (req, res) => {
+      handleRequest(true)(req, res);
+    });
+    server.on("upgrade", handleUpgrade(true));
+    bundle.httpsServer = server;
+  }
+  return bundle;
+}
+
+// src/routes.ts
+import * as fs7 from "fs";
+import * as path6 from "path";
+var STALE_LOCK_THRESHOLD_MS = 1e4;
+var LOCK_MAX_RETRIES = 20;
+var LOCK_RETRY_DELAY_MS = 50;
+var FILE_MODE = 420;
+var DIR_MODE = 493;
+var SYSTEM_DIR_MODE = 1023;
+var SYSTEM_FILE_MODE = 438;
+var RouteConflictError = class extends Error {
+  hostname;
+  existingPid;
+  constructor(hostname, existingPid) {
+    super(
+      `"${hostname}" is already registered by a running process (PID ${existingPid}). Use --force to override.`
+    );
+    this.name = "RouteConflictError";
+    this.hostname = hostname;
+    this.existingPid = existingPid;
+  }
+};
+function isValidRoute(value) {
+  return typeof value === "object" && value !== null && typeof value.hostname === "string" && typeof value.port === "number" && typeof value.pid === "number";
+}
+var RouteStore = class _RouteStore {
+  dir;
+  routesPath;
+  lockPath;
+  pidPath;
+  statePath;
+  isSystemDir;
+  onWarning;
+  static sleepBuffer = new Int32Array(new SharedArrayBuffer(4));
+  constructor(dir, options) {
+    this.dir = dir;
+    this.isSystemDir = options?.isSystemDir ?? false;
+    this.routesPath = path6.join(dir, "routes.json");
+    this.lockPath = path6.join(dir, "routes.lock");
+    this.pidPath = path6.join(dir, "proxy.pid");
+    this.statePath = path6.join(dir, "proxy-state.json");
+    this.onWarning = options?.onWarning;
+  }
+  get dirMode() {
+    return this.isSystemDir ? SYSTEM_DIR_MODE : DIR_MODE;
+  }
+  get fileMode() {
+    return this.isSystemDir ? SYSTEM_FILE_MODE : FILE_MODE;
+  }
+  ensureDir() {
+    if (!fs7.existsSync(this.dir)) {
+      fs7.mkdirSync(this.dir, { recursive: true, mode: this.dirMode });
+    }
+    try {
+      fs7.chmodSync(this.dir, this.dirMode);
+    } catch {
+    }
+    fixOwnership(this.dir);
+  }
+  syncSleep(ms) {
+    Atomics.wait(_RouteStore.sleepBuffer, 0, 0, ms);
+  }
+  acquireLock(maxRetries = LOCK_MAX_RETRIES, retryDelayMs = LOCK_RETRY_DELAY_MS) {
+    for (let index = 0; index < maxRetries; index += 1) {
+      try {
+        fs7.mkdirSync(this.lockPath);
+        return true;
+      } catch (error) {
+        if (isErrnoException(error) && error.code === "EEXIST") {
+          try {
+            const stats = fs7.statSync(this.lockPath);
+            if (Date.now() - stats.mtimeMs > STALE_LOCK_THRESHOLD_MS) {
+              fs7.rmSync(this.lockPath, { recursive: true, force: true });
+              continue;
+            }
+          } catch {
+            continue;
+          }
+          this.syncSleep(retryDelayMs);
+          continue;
+        }
+        return false;
+      }
+    }
+    return false;
+  }
+  releaseLock() {
+    try {
+      fs7.rmSync(this.lockPath, { recursive: true, force: true });
+    } catch {
+    }
+  }
+  isProcessAlive(pid) {
+    try {
+      process.kill(pid, 0);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  loadRoutes(persistCleanup = false) {
+    if (!fs7.existsSync(this.routesPath)) return [];
+    try {
+      const raw = fs7.readFileSync(this.routesPath, "utf-8");
+      const parsed = JSON.parse(raw);
+      if (!Array.isArray(parsed)) {
+        this.onWarning?.(`Corrupted routes file: expected an array at ${this.routesPath}.`);
+        return [];
+      }
+      const routes = parsed.filter(isValidRoute);
+      const aliveRoutes = routes.filter((route) => this.isProcessAlive(route.pid));
+      if (persistCleanup && aliveRoutes.length !== routes.length) {
+        this.saveRoutes(aliveRoutes);
+      }
+      return aliveRoutes;
+    } catch {
+      this.onWarning?.(`Failed to read routes from ${this.routesPath}.`);
+      return [];
+    }
+  }
+  saveRoutes(routes) {
+    fs7.writeFileSync(this.routesPath, JSON.stringify(routes, null, 2), { mode: this.fileMode });
+    fixOwnership(this.routesPath);
+  }
+  addRoute(hostname, port, pid, force = false) {
+    this.ensureDir();
+    if (!this.acquireLock()) {
+      throw new Error("Failed to acquire route lock.");
+    }
+    try {
+      const routes = this.loadRoutes(true);
+      const existing = routes.find((route) => route.hostname === hostname);
+      if (existing && existing.pid !== pid && this.isProcessAlive(existing.pid) && !force) {
+        throw new RouteConflictError(hostname, existing.pid);
+      }
+      const nextRoutes = routes.filter((route) => route.hostname !== hostname);
+      nextRoutes.push({ hostname, port, pid });
+      this.saveRoutes(nextRoutes);
+    } finally {
+      this.releaseLock();
+    }
+  }
+  removeRoute(hostname) {
+    this.ensureDir();
+    if (!this.acquireLock()) {
+      throw new Error("Failed to acquire route lock.");
+    }
+    try {
+      const nextRoutes = this.loadRoutes(true).filter((route) => route.hostname !== hostname);
+      this.saveRoutes(nextRoutes);
+    } finally {
+      this.releaseLock();
+    }
+  }
+};
+
+// src/cli.ts
+var HOSTS_DISPLAY = isWindows2 ? "hosts file" : "/etc/hosts";
+var SUDO_PREFIX = isWindows2 ? "" : "sudo ";
+var DEBOUNCE_MS = 100;
+var POLL_INTERVAL_MS = 3e3;
+var EXIT_TIMEOUT_MS = 2e3;
+var START_TIMEOUT_MS = 3e4;
+function printHelp() {
+  console.log(`
+${chalk.bold("local-router")} - Stable local domains with HTTP and HTTPS on the real hostnames you want.
+
+${chalk.bold("Core commands:")}
+  ${chalk.cyan("local-router run next dev")}                           Infer the project name and expose it as https://<name>.localhost
+  ${chalk.cyan("local-router run next dev --domain rapha.com.br")}     Add a real domain override that resolves locally
+  ${chalk.cyan("local-router proxy start")}                            Start the shared proxy daemon
+  ${chalk.cyan("local-router proxy stop")}                             Stop the shared proxy daemon
+  ${chalk.cyan("local-router trust")}                                  Trust the generated local CA for HTTPS
+  ${chalk.cyan("local-router hosts sync")}                             Sync managed entries to ${HOSTS_DISPLAY}
+
+${chalk.bold("Config file:")}
+  Create ${chalk.cyan(".local-router")} in the project root:
+
+  {
+    name: "algo",
+    hosts: ["rapha.com.br", "bozo.com.br"]
+  }
+
+  Then:
+    ${chalk.cyan("local-router run next dev")}
+
+  Exposes:
+    ${chalk.cyan("http://algo.localhost")}
+    ${chalk.cyan("https://algo.localhost")}
+    ${chalk.cyan("http://rapha.com.br")}
+    ${chalk.cyan("https://rapha.com.br")}
+    ${chalk.cyan("http://bozo.com.br")}
+    ${chalk.cyan("https://bozo.com.br")}
+
+${chalk.bold("Options:")}
+  run --name <name>                Override the inferred .localhost name
+  run --domain <host>              Add a custom hostname (repeatable, can be placed after the child command)
+  run --app-port <port>            Force the app port instead of auto-assigning one
+  run --force                      Replace an existing route registered by another process
+  proxy start --http-port <port>   Override the HTTP listener port (default: ${DEFAULT_HTTP_PORT})
+  proxy start --https-port <port>  Override the HTTPS listener port (default: ${DEFAULT_HTTPS_PORT})
+  proxy start --no-http            Disable the HTTP listener
+  proxy start --no-https           Disable the HTTPS listener
+  proxy start --foreground         Run in the foreground for debugging
+
+${chalk.bold("Notes:")}
+  - Ports 80 and 443 require sudo on Unix. The CLI will prompt when needed.
+  - Custom domains are managed through ${HOSTS_DISPLAY} and are restored/cleaned automatically.
+  - HTTPS uses a local CA and per-host certificates generated on demand.
+`);
+}
+function parseNumberFlag(flag, value) {
+  if (!value || value.startsWith("-")) {
+    console.error(chalk.red(`Error: ${flag} requires a numeric value.`));
+    process.exit(1);
+  }
+  const parsed = Number(value);
+  if (!Number.isInteger(parsed) || parsed < 1 || parsed > 65535) {
+    console.error(chalk.red(`Error: Invalid port "${value}". Expected a number between 1 and 65535.`));
+    process.exit(1);
+  }
+  return parsed;
+}
+function parseRunArgs(args) {
+  const options = {
+    force: false,
+    domains: [],
+    commandArgs: []
+  };
+  let passthrough = false;
+  for (let index = 0; index < args.length; index += 1) {
+    const token = args[index];
+    if (!passthrough && token === "--") {
+      passthrough = true;
+      continue;
+    }
+    if (!passthrough && token === "--force") {
+      options.force = true;
+      continue;
+    }
+    if (!passthrough && token === "--name") {
+      options.name = args[index + 1];
+      if (!options.name || options.name.startsWith("-")) {
+        console.error(chalk.red("Error: --name requires a value."));
+        process.exit(1);
+      }
+      index += 1;
+      continue;
+    }
+    if (!passthrough && token === "--domain") {
+      const value = args[index + 1];
+      if (!value || value.startsWith("-")) {
+        console.error(chalk.red("Error: --domain requires a hostname."));
+        process.exit(1);
+      }
+      options.domains.push(value);
+      index += 1;
+      continue;
+    }
+    if (!passthrough && token === "--app-port") {
+      options.appPort = parseNumberFlag("--app-port", args[index + 1]);
+      index += 1;
+      continue;
+    }
+    if (!passthrough && (token === "--help" || token === "-h")) {
+      console.log(`
+${chalk.bold("local-router run")} - Infer the project name, register hostnames, and run the app.
+
+${chalk.bold("Usage:")}
+  ${chalk.cyan("local-router run <command...>")}
+  ${chalk.cyan("local-router run next dev --domain rapha.com.br")}
+
+${chalk.bold("Flags accepted anywhere before '--':")}
+  --name <name>          Override the base .localhost name
+  --domain <host>        Add a custom hostname override
+  --app-port <port>      Use a fixed port for the child app
+  --force                Replace routes already claimed by another process
+
+Use ${chalk.cyan("--")} if the child command itself needs a colliding flag name.
+`);
+      process.exit(0);
+    }
+    options.commandArgs.push(token);
+  }
+  return options;
+}
+function parseProxyArgs(args) {
+  const options = {
+    httpPort: getDefaultHttpPort(),
+    httpsPort: getDefaultHttpsPort(),
+    httpEnabled: true,
+    httpsEnabled: true,
+    foreground: false
+  };
+  for (let index = 0; index < args.length; index += 1) {
+    const token = args[index];
+    if (token === "--foreground") {
+      options.foreground = true;
+      continue;
+    }
+    if (token === "--http-port") {
+      options.httpPort = parseNumberFlag("--http-port", args[index + 1]);
+      index += 1;
+      continue;
+    }
+    if (token === "--https-port") {
+      options.httpsPort = parseNumberFlag("--https-port", args[index + 1]);
+      index += 1;
+      continue;
+    }
+    if (token === "--no-http") {
+      options.httpEnabled = false;
+      continue;
+    }
+    if (token === "--no-https") {
+      options.httpsEnabled = false;
+      continue;
+    }
+    if (token === "--help" || token === "-h") {
+      console.log(`
+${chalk.bold("local-router proxy start")} - Start the shared router daemon.
+
+${chalk.bold("Usage:")}
+  ${chalk.cyan("local-router proxy start")}
+  ${chalk.cyan("local-router proxy start --foreground")}
+  ${chalk.cyan("local-router proxy start --http-port 8080 --https-port 8443")}
+
+${chalk.bold("Options:")}
+  --http-port <port>     HTTP listener port (default: ${DEFAULT_HTTP_PORT})
+  --https-port <port>    HTTPS listener port (default: ${DEFAULT_HTTPS_PORT})
+  --no-http              Disable the HTTP listener
+  --no-https             Disable the HTTPS listener
+  --foreground           Run without daemonizing
+`);
+      process.exit(0);
+    }
+    console.error(chalk.red(`Error: Unknown proxy flag "${token}".`));
+    process.exit(1);
+  }
+  if (!options.httpEnabled && !options.httpsEnabled) {
+    console.error(chalk.red("Error: at least one of HTTP or HTTPS must stay enabled."));
+    process.exit(1);
+  }
+  return options;
+}
+function printUrls(hostnames, runtime) {
+  console.log(chalk.blue.bold("\nURLs\n"));
+  for (const hostname of hostnames) {
+    if (runtime.httpEnabled) {
+      console.log(chalk.cyan(`  ${formatUrl(hostname, false, runtime.httpPort)}`));
+    }
+    if (runtime.httpsEnabled) {
+      console.log(chalk.cyan(`  ${formatUrl(hostname, true, runtime.httpsPort)}`));
+    }
+  }
+  console.log();
+}
+function registerHostnames(store, hostnames, port, pid, force) {
+  const registered = [];
+  try {
+    for (const hostname of hostnames) {
+      store.addRoute(hostname, port, pid, force);
+      registered.push(hostname);
+    }
+  } catch (error) {
+    for (const hostname of registered) {
+      try {
+        store.removeRoute(hostname);
+      } catch {
+      }
+    }
+    throw error;
+  }
+}
+async function stopProxy(store, stateDir, runtime) {
+  if (!fs8.existsSync(store.pidPath)) {
+    if (await isProxyRunning(runtime)) {
+      const pid = findPidOnPort(runtime.httpEnabled ? runtime.httpPort : runtime.httpsPort);
+      if (pid !== null) {
+        try {
+          process.kill(pid, "SIGTERM");
+          removeProxyState(stateDir);
+          console.log(chalk.green(`Stopped proxy process ${pid}.`));
+          return;
+        } catch (error) {
+          if (isErrnoException(error) && error.code === "EPERM") {
+            console.error(chalk.red("Permission denied while stopping the proxy."));
+            console.error(chalk.cyan(`  ${SUDO_PREFIX}local-router proxy stop`));
+            process.exit(1);
+          }
+        }
+      }
+    }
+    console.log(chalk.yellow("Proxy is not running."));
+    return;
+  }
+  try {
+    const pid = Number(fs8.readFileSync(store.pidPath, "utf-8"));
+    if (!Number.isInteger(pid) || pid <= 0) {
+      console.error(chalk.red("Corrupted PID file."));
+      process.exit(1);
+    }
+    process.kill(pid, "SIGTERM");
+    console.log(chalk.green("Proxy stopped."));
+  } catch (error) {
+    if (isErrnoException(error) && error.code === "EPERM") {
+      console.error(chalk.red("Permission denied while stopping the proxy."));
+      console.error(chalk.cyan(`  ${SUDO_PREFIX}local-router proxy stop`));
+      process.exit(1);
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    console.error(chalk.red(`Failed to stop the proxy: ${message}`));
+    process.exit(1);
+  }
+}
+function writeEmptyRoutesIfNeeded(store) {
+  if (!fs8.existsSync(store.routesPath)) {
+    fs8.writeFileSync(store.routesPath, "[]", { mode: FILE_MODE });
+    fixOwnership(store.routesPath);
+  }
+}
+function needsPrivileges(runtime) {
+  if (isWindows2) return false;
+  return runtime.httpEnabled && runtime.httpPort < PRIVILEGED_PORT_THRESHOLD || runtime.httpsEnabled && runtime.httpsPort < PRIVILEGED_PORT_THRESHOLD;
+}
+function startProxyServer(store, runtime, stateDir) {
+  store.ensureDir();
+  writeEmptyRoutesIfNeeded(store);
+  let cachedRoutes = store.loadRoutes();
+  let debounceTimer = null;
+  let watcher = null;
+  let poller = null;
+  const reloadRoutes = () => {
+    try {
+      cachedRoutes = store.loadRoutes();
+      syncHostsFile(cachedRoutes.map((route) => route.hostname));
+    } catch {
+    }
+  };
+  try {
+    watcher = fs8.watch(store.routesPath, () => {
+      if (debounceTimer) clearTimeout(debounceTimer);
+      debounceTimer = setTimeout(reloadRoutes, DEBOUNCE_MS);
+    });
+  } catch {
+    poller = setInterval(reloadRoutes, POLL_INTERVAL_MS);
+  }
+  syncHostsFile(cachedRoutes.map((route) => route.hostname));
+  let tlsOptions;
+  if (runtime.httpsEnabled) {
+    const certs = ensureCerts(stateDir);
+    if (!isCATrusted(stateDir)) {
+      const trustResult = trustCA(stateDir);
+      if (!trustResult.trusted) {
+        console.warn(chalk.yellow("Warning: could not trust the local CA automatically."));
+        if (trustResult.error) {
+          console.warn(chalk.gray(trustResult.error));
+        }
+      }
+    }
+    tlsOptions = {
+      cert: fs8.readFileSync(certs.certPath),
+      key: fs8.readFileSync(certs.keyPath),
+      SNICallback: createSNICallback(stateDir, fs8.readFileSync(certs.certPath), fs8.readFileSync(certs.keyPath))
+    };
+  }
+  const servers = createProxyServers({
+    getRoutes: () => cachedRoutes,
+    httpEnabled: runtime.httpEnabled,
+    httpsEnabled: runtime.httpsEnabled,
+    httpPort: runtime.httpPort,
+    httpsPort: runtime.httpsPort,
+    tls: tlsOptions,
+    onError: (message) => console.error(chalk.red(message))
+  });
+  let pendingListeners = 0;
+  const onListening = () => {
+    pendingListeners -= 1;
+    if (pendingListeners > 0) return;
+    fs8.writeFileSync(store.pidPath, String(process.pid), { mode: FILE_MODE });
+    writeProxyState(stateDir, { pid: process.pid, ...runtime });
+    fixOwnership(store.pidPath, store.statePath);
+    console.log(chalk.green("local-router proxy is listening."));
+    if (runtime.httpEnabled) {
+      console.log(chalk.gray(`HTTP  -> ${runtime.httpPort}`));
+    }
+    if (runtime.httpsEnabled) {
+      console.log(chalk.gray(`HTTPS -> ${runtime.httpsPort}`));
+    }
+  };
+  const registerServerError = (label, port) => (error) => {
+    if (error.code === "EADDRINUSE") {
+      console.error(chalk.red(`${label} port ${port} is already in use.`));
+    } else if (error.code === "EACCES") {
+      console.error(chalk.red(`Permission denied while binding ${label} port ${port}.`));
+    } else {
+      console.error(chalk.red(`${label} server error: ${error.message}`));
+    }
+    process.exit(1);
+  };
+  if (servers.httpServer) {
+    pendingListeners += 1;
+    servers.httpServer.on("error", registerServerError("HTTP", runtime.httpPort));
+    servers.httpServer.listen(runtime.httpPort, onListening);
+  }
+  if (servers.httpsServer) {
+    pendingListeners += 1;
+    servers.httpsServer.on("error", registerServerError("HTTPS", runtime.httpsPort));
+    servers.httpsServer.listen(runtime.httpsPort, onListening);
+  }
+  const cleanup = () => {
+    if (debounceTimer) clearTimeout(debounceTimer);
+    if (poller) clearInterval(poller);
+    watcher?.close();
+    try {
+      fs8.unlinkSync(store.pidPath);
+    } catch {
+    }
+    removeProxyState(stateDir);
+    cleanHostsFile();
+    const closePromises = [];
+    if (servers.httpServer) {
+      closePromises.push(new Promise((resolve) => servers.httpServer.close(() => resolve())));
+    }
+    if (servers.httpsServer) {
+      closePromises.push(new Promise((resolve) => servers.httpsServer.close(() => resolve())));
+    }
+    Promise.all(closePromises).finally(() => process.exit(0));
+    setTimeout(() => process.exit(0), EXIT_TIMEOUT_MS).unref();
+  };
+  process.on("SIGINT", cleanup);
+  process.on("SIGTERM", cleanup);
+}
+async function ensureProxy(runtime) {
+  const { dir, state } = await discoverState();
+  const effectiveState = state ?? {
+    pid: 0,
+    ...runtime
+  };
+  const stateDir = resolveStateDir(runtime);
+  const store = new RouteStore(stateDir, {
+    isSystemDir: stateDir === SYSTEM_STATE_DIR,
+    onWarning: (message) => console.warn(chalk.yellow(message))
+  });
+  if (state && await isProxyRunning(state)) {
+    return { dir, store: new RouteStore(dir, { isSystemDir: dir === SYSTEM_STATE_DIR }) };
+  }
+  const requiresSudo = needsPrivileges(effectiveState);
+  if (requiresSudo && (process.getuid?.() ?? -1) !== 0) {
+    if (!process.stdin.isTTY) {
+      console.error(chalk.red("The proxy is not running and the default ports require sudo."));
+      console.error(chalk.cyan(`  ${SUDO_PREFIX}local-router proxy start`));
+      process.exit(1);
+    }
+    const answer = await prompt(chalk.yellow("Proxy not running. Start it with sudo now? [Y/n/skip] "));
+    if (answer === "n" || answer === "no") {
+      process.exit(0);
+    }
+    if (answer === "s" || answer === "skip") {
+      throw new Error("Skipping the proxy is not supported for this command.");
+    }
+    const childArgs = [process.execPath, process.argv[1], "proxy", "start"];
+    if (!runtime.httpEnabled) childArgs.push("--no-http");
+    if (!runtime.httpsEnabled) childArgs.push("--no-https");
+    if (runtime.httpPort !== getDefaultHttpPort()) childArgs.push("--http-port", String(runtime.httpPort));
+    if (runtime.httpsPort !== getDefaultHttpsPort()) childArgs.push("--https-port", String(runtime.httpsPort));
+    const result = spawnSync("sudo", childArgs, {
+      stdio: "inherit",
+      timeout: START_TIMEOUT_MS
+    });
+    if (result.status !== 0) {
+      console.error(chalk.red("Failed to start the proxy with sudo."));
+      process.exit(1);
+    }
+  } else {
+    const childArgs = [process.argv[1], "proxy", "start"];
+    if (!runtime.httpEnabled) childArgs.push("--no-http");
+    if (!runtime.httpsEnabled) childArgs.push("--no-https");
+    if (runtime.httpPort !== getDefaultHttpPort()) childArgs.push("--http-port", String(runtime.httpPort));
+    if (runtime.httpsPort !== getDefaultHttpsPort()) childArgs.push("--https-port", String(runtime.httpsPort));
+    const result = spawnSync(process.execPath, childArgs, {
+      stdio: "inherit",
+      timeout: START_TIMEOUT_MS
+    });
+    if (result.status !== 0) {
+      console.error(chalk.red("Failed to start the proxy."));
+      process.exit(1);
+    }
+  }
+  if (!await waitForProxy(runtime)) {
+    console.error(chalk.red("Proxy failed to become ready."));
+    process.exit(1);
+  }
+  return {
+    dir: stateDir,
+    store
+  };
+}
+async function handleRun(args) {
+  const parsed = parseRunArgs(args);
+  if (parsed.commandArgs.length === 0) {
+    console.error(chalk.red("Error: no child command provided."));
+    console.error(chalk.cyan("  local-router run next dev"));
+    process.exit(1);
+  }
+  const resolved = resolveProjectHosts({
+    explicitName: parsed.name,
+    extraDomains: parsed.domains
+  });
+  console.log(chalk.blue.bold("\nlocal-router\n"));
+  console.log(chalk.gray(`Base hostname: ${resolved.baseHostname}`));
+  console.log(chalk.gray(`Name source: ${resolved.nameSource}`));
+  if (resolved.configPath) {
+    console.log(chalk.gray(`Config: ${resolved.configPath}`));
+  }
+  const runtime = {
+    httpPort: getDefaultHttpPort(),
+    httpsPort: getDefaultHttpsPort(),
+    httpEnabled: true,
+    httpsEnabled: true
+  };
+  const { dir } = await ensureProxy(runtime);
+  const store = new RouteStore(dir, {
+    isSystemDir: dir === SYSTEM_STATE_DIR,
+    onWarning: (message) => console.warn(chalk.yellow(message))
+  });
+  const port = parsed.appPort ?? await findFreePort();
+  console.log(chalk.green(`App port: ${port}`));
+  try {
+    registerHostnames(store, resolved.hostnames, port, process.pid, parsed.force);
+  } catch (error) {
+    if (error instanceof RouteConflictError) {
+      console.error(chalk.red(error.message));
+      process.exit(1);
+    }
+    throw error;
+  }
+  printUrls(resolved.hostnames, runtime);
+  injectFrameworkFlags(parsed.commandArgs, port);
+  const primaryHttpsUrl = formatUrl(resolved.baseHostname, true, runtime.httpsPort);
+  const allHttpsUrls = resolved.hostnames.map((hostname) => formatUrl(hostname, true, runtime.httpsPort)).join(",");
+  const allHttpUrls = resolved.hostnames.map((hostname) => formatUrl(hostname, false, runtime.httpPort)).join(",");
+  spawnCommand(parsed.commandArgs, {
+    env: {
+      ...process.env,
+      PORT: String(port),
+      HOST: "127.0.0.1",
+      LOCAL_ROUTER_URL: primaryHttpsUrl,
+      LOCAL_ROUTER_URLS_HTTPS: allHttpsUrls,
+      LOCAL_ROUTER_URLS_HTTP: allHttpUrls,
+      __VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS: ".localhost"
+    },
+    onCleanup: () => {
+      for (const hostname of resolved.hostnames) {
+        try {
+          store.removeRoute(hostname);
+        } catch {
+        }
+      }
+    }
+  });
+}
+async function handleHosts(args) {
+  const subcommand = args[0];
+  if (subcommand === "clean") {
+    if (!cleanHostsFile()) {
+      console.error(chalk.red(`Failed to update ${HOSTS_DISPLAY}.`));
+      process.exit(1);
+    }
+    console.log(chalk.green(`Removed managed entries from ${HOSTS_DISPLAY}.`));
+    return;
+  }
+  if (subcommand !== "sync") {
+    console.log(`
+${chalk.bold("Usage:")}
+  ${chalk.cyan(`${SUDO_PREFIX}local-router hosts sync`)}
+  ${chalk.cyan(`${SUDO_PREFIX}local-router hosts clean`)}
+`);
+    return;
+  }
+  const { dir } = await discoverState();
+  const store = new RouteStore(dir, { isSystemDir: dir === SYSTEM_STATE_DIR });
+  const hostnames = store.loadRoutes().map((route) => route.hostname);
+  if (!syncHostsFile(hostnames)) {
+    console.error(chalk.red(`Failed to update ${HOSTS_DISPLAY}.`));
+    process.exit(1);
+  }
+  console.log(chalk.green(`Synced ${hostnames.length} hostnames to ${HOSTS_DISPLAY}.`));
+}
+async function handleProxy(args) {
+  const subcommand = args[0];
+  if (subcommand === "stop") {
+    const { dir, state } = await discoverState();
+    const runtime = state ?? {
+      httpPort: getDefaultHttpPort(),
+      httpsPort: getDefaultHttpsPort(),
+      httpEnabled: true,
+      httpsEnabled: true
+    };
+    const store2 = new RouteStore(dir, { isSystemDir: dir === SYSTEM_STATE_DIR });
+    await stopProxy(store2, dir, runtime);
+    return;
+  }
+  if (subcommand !== "start") {
+    console.log(`
+${chalk.bold("Usage:")}
+  ${chalk.cyan("local-router proxy start")}
+  ${chalk.cyan("local-router proxy stop")}
+`);
+    return;
+  }
+  const options = parseProxyArgs(args.slice(1));
+  const stateDir = resolveStateDir(options);
+  const store = new RouteStore(stateDir, {
+    isSystemDir: stateDir === SYSTEM_STATE_DIR,
+    onWarning: (message) => console.warn(chalk.yellow(message))
+  });
+  if (!isWindows2 && needsPrivileges(options) && (process.getuid?.() ?? -1) !== 0) {
+    console.error(chalk.red("The selected ports require sudo."));
+    console.error(chalk.cyan(`  ${SUDO_PREFIX}local-router proxy start`));
+    process.exit(1);
+  }
+  if (await isProxyRunning(options)) {
+    console.log(chalk.yellow("Proxy is already running."));
+    return;
+  }
+  if (options.foreground) {
+    console.log(chalk.blue.bold("\nlocal-router proxy\n"));
+    startProxyServer(store, options, stateDir);
+    return;
+  }
+  store.ensureDir();
+  const logPath = path7.join(stateDir, "proxy.log");
+  const logFd = fs8.openSync(logPath, "a");
+  try {
+    try {
+      fs8.chmodSync(logPath, FILE_MODE);
+      fs8.chmodSync(stateDir, DIR_MODE);
+    } catch {
+    }
+    fixOwnership(logPath, stateDir);
+    const daemonArgs = [process.argv[1], "proxy", "start", "--foreground"];
+    if (!options.httpEnabled) daemonArgs.push("--no-http");
+    if (!options.httpsEnabled) daemonArgs.push("--no-https");
+    if (options.httpPort !== getDefaultHttpPort()) daemonArgs.push("--http-port", String(options.httpPort));
+    if (options.httpsPort !== getDefaultHttpsPort()) daemonArgs.push("--https-port", String(options.httpsPort));
+    const child = spawn2(process.execPath, daemonArgs, {
+      detached: true,
+      stdio: ["ignore", logFd, logFd],
+      env: process.env,
+      windowsHide: true
+    });
+    child.unref();
+  } finally {
+    fs8.closeSync(logFd);
+  }
+  if (!await waitForProxy(options)) {
+    console.error(chalk.red("Proxy failed to start."));
+    console.error(chalk.gray(`Logs: ${logPath}`));
+    process.exit(1);
+  }
+  console.log(chalk.green("local-router proxy started."));
+}
+async function handleTrust() {
+  const { dir } = await discoverState();
+  const result = trustCA(dir);
+  if (!result.trusted) {
+    console.error(chalk.red(`Failed to trust the CA: ${result.error ?? "unknown error"}`));
+    process.exit(1);
+  }
+  console.log(chalk.green("Local CA added to the trust store."));
+}
+async function main() {
+  const args = process.argv.slice(2);
+  const command = args[0];
+  if (!command || command === "--help" || command === "-h") {
+    printHelp();
+    return;
+  }
+  if (command === "--version" || command === "-v") {
+    console.log("0.1.0");
+    return;
+  }
+  if (command === "run") {
+    await handleRun(args.slice(1));
+    return;
+  }
+  if (command === "proxy") {
+    await handleProxy(args.slice(1));
+    return;
+  }
+  if (command === "hosts") {
+    await handleHosts(args.slice(1));
+    return;
+  }
+  if (command === "trust") {
+    await handleTrust();
+    return;
+  }
+  console.error(chalk.red(`Unknown command "${command}".`));
+  printHelp();
+  process.exit(1);
+}
+main().catch((error) => {
+  const message = error instanceof Error ? error.message : String(error);
+  console.error(chalk.red(message));
+  process.exit(1);
+});