@hamedb89/localghost 0.1.9 → 0.1.12

package/dist/index.js

@@ -129,6 +129,24 @@ function unregisterLocalghostSetup(options, path = getLocalghostActivityPath())
   }
 }
 
+// src/brand.ts
+function renderLocalghostBanner() {
+  return [
+    "   .-.",
+    "  (o o)   LOCALGHOST",
+    "  | O \\   friendly local domains",
+    "   \\   \\",
+    "    `~~~'"
+  ].join("\n");
+}
+function renderCompactLocalghostBanner() {
+  return [
+    "  .--.",
+    " ( oo )  localghost",
+    "  \\__/   friendly local domains"
+  ].join("\n");
+}
+
 // src/config.ts
 import { existsSync as existsSync2, readFileSync as readFileSync2, readdirSync } from "fs";
 import { basename, join as join2, resolve } from "path";
@@ -251,1085 +269,1928 @@ function sanitizeProjectName(value) {
   return projectName || "app";
 }
 
-// src/caddy.ts
-import { dirname as dirname3, join as join3 } from "path";
-import { execa } from "execa";
-
-// src/fs.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
-import { dirname as dirname2 } from "path";
-function readTextFile(path) {
-  return readFileSync3(path, "utf8");
-}
-function writeTextFile(path, value) {
-  mkdirSync2(dirname2(path), { recursive: true });
-  writeFileSync2(path, value, "utf8");
-  return path;
-}
-
-// src/caddy.ts
-function groupByPort(entries) {
-  const groups = /* @__PURE__ */ new Map();
-  for (const entry of entries) {
-    const group = groups.get(entry.port) ?? [];
-    group.push(entry);
-    groups.set(entry.port, group);
-  }
-  return groups;
-}
-function getCaddyfilePath(cwd = process.cwd()) {
-  return join3(cwd, "ops/local/Caddyfile");
-}
-function renderCaddyfile(entries, options = {}) {
-  const groups = groupByPort(entries);
-  const https = options.https === true;
-  const blocks = [...groups.entries()].sort(([leftPort], [rightPort]) => leftPort - rightPort).map(([port, group]) => {
-    const hosts = group.map((entry) => https ? entry.host : `http://${entry.host}`).sort().join(", ");
-    return `${hosts} {
-  reverse_proxy 127.0.0.1:${port}
-}`;
-  });
-  const globalOptions = https ? `{
-  local_certs
+// src/ghost-file.ts
+var LOCALGHOST_GHOST_TUNNEL_FILE = ".ghosttunnel";
+function toGhostTunnelOptions(options = {}) {
+  const resolved = typeof options === "string" ? { cwd: options } : options;
+  return {
+    ...resolved,
+    fileName: resolved.fileName ?? LOCALGHOST_GHOST_TUNNEL_FILE
+  };
 }
-
-` : "";
-  return `${globalOptions}${blocks.join("\n\n")}
-`;
+function normalizeHost(value) {
+  return value.trim().toLowerCase().replace(/\.$/, "");
 }
-async function writeCaddyfile(entries, cwd = process.cwd(), options = {}) {
-  const path = getCaddyfilePath(cwd);
-  writeTextFile(path, renderCaddyfile(entries, options));
-  return path;
+function resolveGhostTunnelPath(options = {}) {
+  return resolveDevHostsPath(toGhostTunnelOptions(options));
 }
-async function validateCaddyfile(path) {
-  await execa("caddy", ["validate", "--config", path], {
-    cwd: dirname3(path),
-    stdio: "inherit"
-  });
+function getGhostTunnelPath(options = {}) {
+  return resolveGhostTunnelPath(options).path;
 }
-async function runCaddy(path) {
-  await execa("caddy", ["run", "--config", path], {
-    cwd: dirname3(path),
-    stdio: "inherit"
-  });
+function readGhostTunnelEntries(options = {}) {
+  return readDevHosts(toGhostTunnelOptions(options));
 }
-function startCaddy(path) {
-  return execa("caddy", ["run", "--config", path], {
-    cwd: dirname3(path),
-    stdio: "inherit"
-  });
+function listGhostTunnelEntries(options = {}) {
+  const resolved = resolveGhostTunnelPath(options);
+  if (!resolved.exists) return [];
+  return readGhostTunnelEntries(options);
 }
-async function trustCaddy(path) {
-  await execa("caddy", ["trust", "--config", path], {
-    cwd: dirname3(path),
-    stdio: "inherit"
-  });
+function findGhostTunnelEntry(host, options = {}) {
+  const normalizedHost = normalizeHost(host);
+  return listGhostTunnelEntries(options).find((entry) => entry.host === normalizedHost);
 }
 
-// src/context.ts
-import { existsSync as existsSync3, readFileSync as readFileSync4 } from "fs";
-import { join as join4 } from "path";
-import { pathToFileURL } from "url";
-
-// src/port.ts
-import { createServer } from "net";
-async function isPortAvailable(port, host = "127.0.0.1") {
-  return new Promise((resolve2) => {
-    const server = createServer();
-    server.once("error", () => {
-      resolve2(false);
-    });
-    server.once("listening", () => {
-      server.close(() => resolve2(true));
-    });
-    server.listen(port, host);
-  });
-}
-async function findAvailablePort(startPort, options = {}) {
-  const host = options.host ?? "127.0.0.1";
-  const maxAttempts = options.maxAttempts ?? 50;
-  for (let offset = 0; offset < maxAttempts; offset += 1) {
-    const port = startPort + offset;
-    if (await isPortAvailable(port, host)) {
-      return port;
-    }
-  }
-  throw new Error(`No available port found from ${startPort} to ${startPort + maxAttempts - 1}.`);
-}
+// src/ghost-agent.ts
+import { randomUUID as randomUUID2 } from "crypto";
 
-// src/tunnel.ts
+// src/relay.ts
+import { createHmac, timingSafeEqual } from "crypto";
 import { domainToASCII } from "url";
-var DEFAULT_GHOST_TUNNEL_SUBDOMAIN = "ghost";
-var DEFAULT_GHOST_TUNNEL_NAMESPACE_TAGS = ["route", "project", "owner"];
-var DEFAULT_GHOST_TUNNEL_NAMESPACE_SEPARATOR = "-";
-var DEFAULT_GHOST_TUNNEL_MODE = "manual";
-function isResolvedGhostTunnelConfig(value) {
-  return typeof value === "object" && value !== null && "enabled" in value;
+var DEFAULT_RELAY_ALLOWED_TARGET_HOSTS = ["localhost", "127.0.0.1", "::1"];
+var DEFAULT_RELAY_BLOCKED_PORTS = [22, 2375, 2376, 5432, 6379, 9200, 9229, 27017];
+var DEFAULT_RELAY_LIMITS = {
+  requestBodyBytes: 5 * 1024 * 1024,
+  responseBytes: 25 * 1024 * 1024,
+  timeoutMs: 3e4,
+  maxConcurrentRequests: 20,
+  perRouteRequestsPerMinute: 120,
+  perIpRequestsPerMinute: 60
+};
+var DEFAULT_RELAY_TARGET_POLICY = {
+  allowedHosts: [...DEFAULT_RELAY_ALLOWED_TARGET_HOSTS],
+  blockedPorts: [...DEFAULT_RELAY_BLOCKED_PORTS],
+  allowPrivateNetworkTargets: false
+};
+var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
+  "connection",
+  "keep-alive",
+  "proxy-authenticate",
+  "proxy-authorization",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade"
+]);
+var SENSITIVE_HEADERS = /* @__PURE__ */ new Set(["authorization", "cookie", "set-cookie"]);
+var TOKEN_QUERY_PATTERN = /(token|secret|key|password|session|jwt|auth)/i;
+var HOST_PATTERN2 = /^(?=.{1,253}$)(?!-)[a-z0-9-]+(\.[a-z0-9-]+)*$/i;
+var IPV4_PATTERN = /^\d{1,3}(?:\.\d{1,3}){3}$/;
+function base64UrlEncode(value) {
+  return Buffer.from(value).toString("base64url");
 }
-function toGhostTunnelConfig(options) {
-  return isResolvedGhostTunnelConfig(options) ? options : resolveGhostTunnelConfig(options);
+function base64UrlDecode(value) {
+  return Buffer.from(value, "base64url").toString("utf8");
 }
-function stripHostPort(value) {
-  const trimmed = value.trim().toLowerCase();
-  if (trimmed.startsWith("[") || trimmed.includes("/")) return "";
-  const portSeparator = trimmed.lastIndexOf(":");
-  if (portSeparator === -1) return trimmed;
-  const port = trimmed.slice(portSeparator + 1);
-  return /^\d+$/.test(port) ? trimmed.slice(0, portSeparator) : trimmed;
+function signPayload(payload, secret) {
+  return createHmac("sha256", secret).update(payload).digest("base64url");
 }
-function normalizeDomain(value) {
-  const host = stripHostPort(value.replace(/^\*\./, ""));
-  const ascii = domainToASCII(host);
-  if (!ascii || ascii.length > 253 || ascii.includes("..")) return null;
-  if (ascii.startsWith(".") || ascii.endsWith(".")) return null;
-  if (ascii.includes("*")) return null;
-  if (!ascii.split(".").every(isValidHostLabel)) return null;
-  return ascii;
+function secureEqual(left, right) {
+  const leftBuffer = Buffer.from(left);
+  const rightBuffer = Buffer.from(right);
+  return leftBuffer.length === rightBuffer.length && timingSafeEqual(leftBuffer, rightBuffer);
 }
-function isValidHostLabel(value) {
-  return value.length > 0 && value.length <= 63 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(value);
+function normalizeHost2(host) {
+  const trimmed = host.trim().toLowerCase().replace(/\.$/, "");
+  if (!trimmed || trimmed.includes("*") || trimmed.includes("/") || trimmed.includes(":")) return null;
+  const ascii = domainToASCII(trimmed);
+  if (!ascii || ascii.includes("..")) return null;
+  return HOST_PATTERN2.test(ascii) ? ascii : null;
 }
-function isValidNamespaceTag(value) {
-  return /^[a-z][a-z0-9_]*$/i.test(value);
+function normalizeTargetHost(host) {
+  const trimmed = host.trim().toLowerCase();
+  if (trimmed === "::1" || trimmed === "[::1]") return "::1";
+  if (trimmed.includes("/") || trimmed.includes("*")) return null;
+  if (IPV4_PATTERN.test(trimmed)) return isValidIpv4(trimmed) ? trimmed : null;
+  return normalizeHost2(trimmed);
 }
-function isNamespaceTagList(options) {
-  return Array.isArray(options);
+function isValidIpv4(value) {
+  return value.split(".").every((part) => {
+    const octet = Number(part);
+    return Number.isInteger(octet) && octet >= 0 && octet <= 255 && String(octet) === part;
+  });
 }
-function assertValidSubdomain(value) {
-  if (!isValidHostLabel(value)) {
-    throw new Error(`Invalid ghost tunnel subdomain: ${value}`);
-  }
+function isPrivateIpv4(value) {
+  if (!isValidIpv4(value)) return false;
+  const [first = 0, second = 0] = value.split(".").map((part) => Number(part));
+  return first === 10 || first === 127 || first === 172 && second >= 16 && second <= 31 || first === 192 && second === 168 || first === 169 && second === 254;
 }
-function normalizeDomains(domains) {
-  const values = typeof domains === "string" ? [domains] : [...domains ?? []];
-  const normalized = values.map((value) => value.trim()).filter(Boolean).map((value) => {
-    const domain = normalizeDomain(value);
-    if (!domain) throw new Error(`Invalid ghost tunnel domain: ${value}`);
-    return domain;
-  });
-  return [...new Set(normalized)];
+function isLocalTargetHost(host) {
+  return host === "localhost" || host === "127.0.0.1" || host === "::1";
 }
-function parseGhostTunnelMode(value) {
-  return value ?? DEFAULT_GHOST_TUNNEL_MODE;
+function mergeTargetPolicy(policy) {
+  return {
+    allowedHosts: policy?.allowedHosts ?? DEFAULT_RELAY_TARGET_POLICY.allowedHosts,
+    blockedPorts: policy?.blockedPorts ?? DEFAULT_RELAY_TARGET_POLICY.blockedPorts,
+    allowPrivateNetworkTargets: policy?.allowPrivateNetworkTargets ?? DEFAULT_RELAY_TARGET_POLICY.allowPrivateNetworkTargets
+  };
 }
-function resolveNamespaceConfig(options) {
-  const tags = isNamespaceTagList(options) ? [...options] : [...options?.tags ?? DEFAULT_GHOST_TUNNEL_NAMESPACE_TAGS];
-  let separator = DEFAULT_GHOST_TUNNEL_NAMESPACE_SEPARATOR;
-  let spreadTag = tags.includes("project") ? "project" : void 0;
-  if (options && !isNamespaceTagList(options)) {
-    separator = options.separator ?? DEFAULT_GHOST_TUNNEL_NAMESPACE_SEPARATOR;
-    spreadTag = options.spreadTag === false ? false : options.spreadTag ?? spreadTag;
+function mergeLimits(limits) {
+  const merged = {
+    ...DEFAULT_RELAY_LIMITS,
+    ...limits ?? {}
+  };
+  for (const [key, value] of Object.entries(merged)) {
+    if (!Number.isInteger(value) || value < 1) {
+      throw new Error(`Invalid relay limit ${key}: ${value}`);
+    }
   }
-  if (tags.length === 0) {
-    throw new Error("Ghost tunnel namespace must include at least one tag.");
+  return merged;
+}
+function assertExactRelayHost(host) {
+  const normalized = normalizeHost2(host);
+  if (!normalized) {
+    throw new Error(`Relay route claims must use an exact hostname: ${host}`);
   }
-  for (const tag of tags) {
-    if (!isValidNamespaceTag(tag)) {
-      throw new Error(`Invalid ghost tunnel namespace tag: ${tag}`);
-    }
+  return normalized;
+}
+function assertRelayLocalTarget(target, policyInput) {
+  if (!target || typeof target !== "object") {
+    throw new Error("Relay target must be an explicit local target object.");
   }
-  if (spreadTag && !tags.includes(spreadTag)) {
-    throw new Error(`Ghost tunnel namespace spreadTag must be listed in tags: ${spreadTag}`);
+  const policy = mergeTargetPolicy(policyInput);
+  const host = normalizeTargetHost(target.host);
+  if (!host) {
+    throw new Error(`Invalid relay target host: ${target.host}`);
   }
-  if (!separator || separator.length > 8 || !/^[a-z0-9-]+$/.test(separator)) {
-    throw new Error(`Invalid ghost tunnel namespace separator: ${separator}`);
+  if (!Number.isInteger(target.port) || target.port < 1 || target.port > 65535) {
+    throw new Error(`Invalid relay target port: ${target.port}`);
+  }
+  const protocol = target.protocol ?? "http";
+  if (protocol !== "http" && protocol !== "https") {
+    throw new Error(`Invalid relay target protocol: ${String(protocol)}`);
+  }
+  if (policy.blockedPorts.includes(target.port)) {
+    throw new Error(`Relay target port is blocked: ${target.port}`);
+  }
+  const allowedHosts = new Set(policy.allowedHosts.map((allowedHost) => normalizeTargetHost(allowedHost)).filter((value) => Boolean(value)));
+  if (!allowedHosts.has(host)) {
+    throw new Error(`Relay target host is not explicitly allowed: ${host}`);
+  }
+  if (!policy.allowPrivateNetworkTargets && !isLocalTargetHost(host) && (host === "::1" || isPrivateIpv4(host))) {
+    throw new Error(`Private-network relay target requires explicit opt-in: ${host}`);
   }
   return {
-    tags,
-    separator,
-    ...spreadTag ? { spreadTag } : {}
+    protocol,
+    host,
+    port: target.port
   };
 }
-function normalizeNamespaceValue(tag, value, separator, options = {}) {
-  const normalized = normalizeDomain(value);
-  if (!normalized || normalized.includes(".")) {
-    throw new Error(`Invalid ghost tunnel namespace value for ${tag}: ${value}`);
+function authenticateRelayAgentToken(input) {
+  const expected = `Bearer ${input.agentToken}`;
+  return typeof input.authorizationHeader === "string" && secureEqual(input.authorizationHeader, expected);
+}
+function signRelayRouteClaim(claim, signingSecret) {
+  const payload = {
+    ...claim,
+    host: assertExactRelayHost(claim.host)
+  };
+  if (!payload.scope) throw new Error("Relay route claim requires a scope.");
+  if (!payload.agentId) throw new Error("Relay route claim requires an agentId.");
+  if (Number.isNaN(Date.parse(payload.expiresAt))) throw new Error("Relay route claim requires a valid expiresAt.");
+  const encodedPayload = base64UrlEncode(JSON.stringify(payload));
+  const signature = signPayload(encodedPayload, signingSecret);
+  return {
+    payload,
+    token: `${encodedPayload}.${signature}`
+  };
+}
+function verifyRelayRouteClaim(token, signingSecret, options) {
+  const [encodedPayload, signature] = token.split(".");
+  if (!encodedPayload || !signature || token.split(".").length !== 2) {
+    throw new Error("Invalid relay route claim token.");
   }
-  if (!options.allowSeparator && normalized.includes(separator)) {
-    throw new Error(`Ghost tunnel namespace value for ${tag} cannot include separator "${separator}": ${value}`);
+  const expectedSignature = signPayload(encodedPayload, signingSecret);
+  if (!secureEqual(signature, expectedSignature)) {
+    throw new Error("Invalid relay route claim signature.");
   }
-  return normalized;
+  const parsed = JSON.parse(base64UrlDecode(encodedPayload));
+  const host = assertExactRelayHost(parsed.host);
+  if (parsed.scope !== options.expectedScope) {
+    throw new Error("Relay route claim scope mismatch.");
+  }
+  const now = options.now ?? /* @__PURE__ */ new Date();
+  if (Date.parse(parsed.expiresAt) <= now.getTime()) {
+    throw new Error("Relay route claim has expired.");
+  }
+  if (!parsed.agentId) {
+    throw new Error("Relay route claim requires an agentId.");
+  }
+  return { ...parsed, host };
 }
-function createNamespaceSlug(config, values) {
-  const parts = config.tags.map((tag) => {
-    const value = values[tag];
-    if (!value) {
-      throw new Error(`Missing ghost tunnel namespace value: ${tag}`);
-    }
-    return normalizeNamespaceValue(tag, value, config.separator, { allowSeparator: tag === config.spreadTag });
+function createRelayRouteRegistration(input) {
+  if (!authenticateRelayAgentToken({
+    agentToken: input.agentToken,
+    ...typeof input.authorizationHeader !== "undefined" ? { authorizationHeader: input.authorizationHeader } : {}
+  })) {
+    throw new Error("Relay route registration requires an authenticated local agent.");
+  }
+  const claim = verifyRelayRouteClaim(input.claimToken, input.signingSecret, {
+    expectedScope: input.expectedScope,
+    ...input.now ? { now: input.now } : {}
   });
-  const slug = parts.join(config.separator);
-  if (!isValidHostLabel(slug)) {
-    throw new Error(`Ghost tunnel namespace is too long for a DNS label: ${slug}`);
+  const target = assertRelayLocalTarget(input.target, input.targetPolicy);
+  const access = input.publicMode === true ? "public" : input.access ?? "private";
+  const passwordProtected = input.passwordProtected ?? false;
+  const authRequired = input.authRequired ?? false;
+  if (access === "public" && input.publicMode !== true) {
+    throw new Error("Relay public mode must be explicitly enabled.");
   }
-  return slug;
+  if (access === "private" && !passwordProtected && !authRequired) {
+    throw new Error("Private relay previews require password or auth.");
+  }
+  return {
+    host: claim.host,
+    scope: claim.scope,
+    agentId: claim.agentId,
+    expiresAt: claim.expiresAt,
+    target,
+    access,
+    passwordProtected,
+    authRequired,
+    limits: mergeLimits(input.limits)
+  };
 }
-function createNamespaceDisplaySlug(config, values = {}) {
-  return config.tags.map((tag) => {
-    const value = values[tag];
-    if (!value) return `<${tag}>`;
-    try {
-      return normalizeNamespaceValue(tag, value, config.separator, { allowSeparator: tag === config.spreadTag });
-    } catch {
-      return `<${tag}>`;
+function isRelayRouteActive(route, options) {
+  if (!options.agentConnected) return false;
+  return Date.parse(route.expiresAt) > (options.now ?? /* @__PURE__ */ new Date()).getTime();
+}
+function stripRelayForwardHeaders(headers) {
+  const stripped = {};
+  for (const [name, value] of Object.entries(headers)) {
+    if (typeof value === "undefined") continue;
+    const lowerName = name.toLowerCase();
+    if (HOP_BY_HOP_HEADERS.has(lowerName)) continue;
+    if (lowerName.startsWith("x-localghost-")) continue;
+    stripped[name] = value;
+  }
+  return stripped;
+}
+function redactRelayHeaders(headers) {
+  const redacted = {};
+  for (const [name, value] of Object.entries(headers)) {
+    if (typeof value === "undefined") continue;
+    redacted[name] = SENSITIVE_HEADERS.has(name.toLowerCase()) ? "[redacted]" : value;
+  }
+  return redacted;
+}
+function redactRelayLogUrl(input) {
+  const url = new URL(input, "http://localghost.invalid");
+  for (const key of [...url.searchParams.keys()]) {
+    if (TOKEN_QUERY_PATTERN.test(key)) {
+      url.searchParams.set(key, "[redacted]");
     }
-  }).join(config.separator);
+  }
+  return input.startsWith("http://") || input.startsWith("https://") ? url.toString() : `${url.pathname}${url.search}`;
 }
-function getPreviewDefaults(preview, defaults) {
+function renderRelayOfflineResponse() {
   return {
-    domain: preview?.domain ?? defaults?.domain,
-    route: preview?.route ?? defaults?.route,
-    project: preview?.project ?? defaults?.project,
-    owner: preview?.owner ?? defaults?.owner,
-    values: {
-      ...defaults?.values ?? {},
-      ...preview?.values ?? {}
+    status: 503,
+    headers: {
+      "content-type": "text/html; charset=utf-8",
+      "cache-control": "no-store"
     },
-    path: preview?.path,
-    protocol: preview?.protocol
+    body: [
+      "<!doctype html>",
+      "<html>",
+      '<head><meta charset="utf-8"><title>Preview offline</title></head>',
+      "<body><h1>Preview offline</h1><p>The local agent is not connected. Try again later.</p></body>",
+      "</html>"
+    ].join("")
   };
 }
-function getDisplayValues(input) {
+
+// src/ghost-tunnel-store.ts
+import { randomUUID } from "crypto";
+var DEFAULT_GHOST_TUNNEL_RESPONSE_TTL_SECONDS = 60;
+function base64Encode(value) {
+  return value.toString("base64");
+}
+function encodeGhostTunnelBody(value) {
+  return base64Encode(Buffer.isBuffer(value) ? value : Buffer.from(value));
+}
+function decodeGhostTunnelBody(value) {
+  return value ? Buffer.from(value, "base64") : void 0;
+}
+function createGhostTunnelQueuedRequest(input) {
+  const now = input.now ?? /* @__PURE__ */ new Date();
+  const bodyBase64 = typeof input.body === "undefined" ? void 0 : encodeGhostTunnelBody(input.body);
   return {
-    ...input.route ? { route: input.route } : {},
-    ...input.project ? { project: input.project } : {},
-    ...input.owner ? { owner: input.owner } : {},
-    ...input.values
+    id: randomUUID(),
+    host: input.host,
+    method: input.method.toUpperCase(),
+    path: input.path,
+    headers: input.headers ?? {},
+    createdAt: now.toISOString(),
+    expiresAt: new Date(now.getTime() + input.ttlSeconds * 1e3).toISOString(),
+    ...bodyBase64 ? { bodyBase64 } : {}
   };
 }
-function createDisplayUrl(config, defaults, domain) {
-  const input = getPreviewDefaults(config.preview, defaults);
-  const protocol = input.protocol ?? "https";
-  const slug = createNamespaceDisplaySlug(config.namespace, getDisplayValues(input));
-  const entryHost = domain ? getGhostTunnelEntryHost(domain, config) : input.domain ? getGhostTunnelEntryHost(input.domain, config) : `${config.subdomain}.*`;
-  const url = `${protocol}://${slug}.${entryHost}/`;
-  if (!input.path) return url;
-  return `${url}${input.path.replace(/^\/+/, "")}`;
+function createGhostTunnelRouteHeartbeat(input) {
+  const now = input.now ?? /* @__PURE__ */ new Date();
+  return {
+    host: input.host,
+    agentId: input.agentId,
+    target: input.target,
+    updatedAt: now.toISOString(),
+    expiresAt: new Date(now.getTime() + input.ttlSeconds * 1e3).toISOString()
+  };
 }
-function createDisplayUrls(config, defaults) {
-  const domains = config.domains.length > 0 ? config.domains : defaults?.domain ? [defaults.domain] : [];
-  const urls = domains.length > 0 ? domains.map((domain) => createDisplayUrl(config, defaults, domain)) : [createDisplayUrl(config, defaults)];
-  return [...new Set(urls)];
+function isExpired(expiresAt, now = /* @__PURE__ */ new Date()) {
+  const timestamp = Date.parse(expiresAt);
+  return Number.isNaN(timestamp) || timestamp <= now.getTime();
 }
-function maybeConstructPreviewUrl(config, defaults) {
-  if (!config.preview) return void 0;
-  const input = getPreviewDefaults(config.preview, defaults);
-  if (!input.domain || !input.route || !input.project || !input.owner) return void 0;
-  return constructGhostTunnelUrl({
-    domain: input.domain,
-    route: input.route,
-    project: input.project,
-    owner: input.owner,
-    values: input.values,
-    ...input.path ? { path: input.path } : {},
-    ...input.protocol ? { protocol: input.protocol } : {},
-    ghostTunnel: config
-  });
+function serializeJson(value) {
+  return JSON.stringify(value);
 }
-function parseNamespaceSlug(slug, config) {
-  const parts = slug.split(config.separator);
-  if (parts.length < config.tags.length) return null;
-  if (parts.length !== config.tags.length && !config.spreadTag) return null;
-  const namespace = {};
-  const spreadIndex = config.spreadTag ? config.tags.indexOf(config.spreadTag) : -1;
-  const spreadWidth = spreadIndex >= 0 ? parts.length - config.tags.length + 1 : 1;
-  let partIndex = 0;
-  for (const [tagIndex, tag] of config.tags.entries()) {
-    const value = tagIndex === spreadIndex ? parts.slice(partIndex, partIndex + spreadWidth).join(config.separator) : parts[partIndex];
-    if (!value || !isValidHostLabel(value)) return null;
-    if (tagIndex !== spreadIndex && value.includes(config.separator)) return null;
-    namespace[tag] = value;
-    partIndex += tagIndex === spreadIndex ? spreadWidth : 1;
+function parseJson(value) {
+  if (typeof value !== "string") return null;
+  try {
+    return JSON.parse(value);
+  } catch {
+    return null;
   }
-  return namespace;
 }
-function resolveGhostTunnelConfig(options, defaults) {
-  if (options === false || typeof options === "undefined") {
-    return {
-      enabled: false,
-      mode: DEFAULT_GHOST_TUNNEL_MODE,
-      domains: [],
-      subdomain: DEFAULT_GHOST_TUNNEL_SUBDOMAIN,
-      namespace: resolveNamespaceConfig(void 0),
-      displayUrls: [],
-      requireHttps: true,
-      requireAuth: true
-    };
+function keyPart(value) {
+  return value.toLowerCase().replace(/[^a-z0-9._:-]/g, "_");
+}
+var MemoryGhostTunnelStore = class {
+  routes = /* @__PURE__ */ new Map();
+  queues = /* @__PURE__ */ new Map();
+  responses = /* @__PURE__ */ new Map();
+  async heartbeatRoute(route) {
+    this.routes.set(route.host, route);
   }
-  const config = typeof options === "string" ? { mode: options } : options;
-  const subdomain = config.subdomain ?? DEFAULT_GHOST_TUNNEL_SUBDOMAIN;
-  assertValidSubdomain(subdomain);
-  const domains = normalizeDomains(config.domains);
-  const enabled = config.enabled ?? true;
-  const resolved = {
-    enabled,
-    mode: parseGhostTunnelMode(config.mode),
-    domains,
-    subdomain,
-    namespace: resolveNamespaceConfig(config.namespace),
-    ...config.preview ? { preview: config.preview } : {},
-    displayUrls: [],
-    requireHttps: config.requireHttps ?? true,
-    requireAuth: config.requireAuth ?? true
-  };
-  if (!enabled) {
-    return resolved;
+  async getRoute(host) {
+    const route = this.routes.get(host);
+    if (!route) return null;
+    if (!isExpired(route.expiresAt)) return route;
+    this.routes.delete(host);
+    return null;
   }
-  const previewUrl = maybeConstructPreviewUrl(resolved, defaults);
-  const displayUrls = previewUrl ? [previewUrl] : createDisplayUrls(resolved, defaults);
-  return {
-    ...resolved,
-    displayUrls,
-    ...displayUrls[0] ? { displayUrl: displayUrls[0] } : {},
-    ...previewUrl ? { previewUrl } : {}
-  };
-}
-function getGhostTunnelEntryHost(domain, options = {}) {
-  const config = toGhostTunnelConfig(options);
-  const normalizedDomain = normalizeDomain(domain);
-  if (!normalizedDomain) {
-    throw new Error(`Invalid ghost tunnel domain: ${domain}`);
+  async enqueueRequest(request) {
+    const queue = this.queues.get(request.host) ?? [];
+    queue.push(request);
+    this.queues.set(request.host, queue);
+  }
+  async claimRequest(host) {
+    const queue = this.queues.get(host) ?? [];
+    while (queue.length > 0) {
+      const request = queue.shift();
+      if (request && !isExpired(request.expiresAt)) {
+        return request;
+      }
+    }
+    return null;
   }
-  return `${config.subdomain}.${normalizedDomain}`;
-}
-function getGhostTunnelWildcardHost(domain, options = {}) {
-  return `*.${getGhostTunnelEntryHost(domain, options)}`;
-}
-function constructGhostTunnelHost(input) {
-  const config = toGhostTunnelConfig(input.ghostTunnel ?? {});
-  if (!config.enabled) {
-    throw new Error("Ghost tunnel is not enabled.");
+  async writeResponse(response, ttlSeconds) {
+    this.responses.set(response.id, {
+      value: response,
+      expiresAt: new Date(Date.now() + ttlSeconds * 1e3).toISOString()
+    });
   }
-  const namespaceValues = {
-    route: input.route,
-    project: input.project,
-    owner: input.owner,
-    ...input.values ?? {}
-  };
-  const slug = createNamespaceSlug(config.namespace, namespaceValues);
-  return `${slug}.${getGhostTunnelEntryHost(input.domain, config)}`;
-}
-function constructGhostTunnelUrl(input) {
-  const protocol = input.protocol ?? "https";
-  const host = constructGhostTunnelHost(input);
-  const url = new URL(`${protocol}://${host}/`);
-  if (input.path) {
-    url.pathname = `/${input.path.replace(/^\/+/, "")}`;
+  async readResponse(requestId) {
+    const response = this.responses.get(requestId);
+    if (!response) return null;
+    if (!isExpired(response.expiresAt)) return response.value;
+    this.responses.delete(requestId);
+    return null;
   }
-  if (input.searchParams instanceof URLSearchParams) {
-    url.search = input.searchParams.toString();
-  } else if (input.searchParams) {
-    for (const [key, value] of Object.entries(input.searchParams)) {
-      if (typeof value !== "undefined" && value !== null) {
-        url.searchParams.set(key, String(value));
-      }
+  async cleanup(requestId) {
+    this.responses.delete(requestId);
+  }
+};
+function createMemoryGhostTunnelStore() {
+  return new MemoryGhostTunnelStore();
+}
+var RedisGhostTunnelStore = class {
+  url;
+  token;
+  namespace;
+  fetchImpl;
+  constructor(options) {
+    this.url = options.url.replace(/\/+$/, "");
+    this.token = options.token;
+    this.namespace = options.namespace ?? "localghost";
+    this.fetchImpl = options.fetch ?? fetch;
+  }
+  key(kind, id) {
+    return `${this.namespace}:ghost-tunnel:${kind}:${keyPart(id)}`;
+  }
+  async command(command, ...args) {
+    const response = await this.fetchImpl(this.url, {
+      method: "POST",
+      headers: {
+        authorization: `Bearer ${this.token}`,
+        "content-type": "application/json"
+      },
+      body: JSON.stringify([command, ...args])
+    });
+    if (!response.ok) {
+      throw new Error(`Redis Ghost Tunnel command failed: ${response.status} ${response.statusText}`);
+    }
+    const payload = await response.json();
+    if (payload.error) {
+      throw new Error(`Redis Ghost Tunnel command failed: ${payload.error}`);
+    }
+    return typeof payload.result === "undefined" ? null : payload.result;
+  }
+  async heartbeatRoute(route, ttlSeconds) {
+    await this.command("SET", this.key("route", route.host), serializeJson(route), "EX", ttlSeconds);
+  }
+  async getRoute(host) {
+    const route = parseJson(await this.command("GET", this.key("route", host)));
+    return route && !isExpired(route.expiresAt) ? route : null;
+  }
+  async enqueueRequest(request, ttlSeconds) {
+    const queueKey = this.key("queue", request.host);
+    await this.command("RPUSH", queueKey, serializeJson(request));
+    await this.command("EXPIRE", queueKey, ttlSeconds);
+  }
+  async claimRequest(host) {
+    const queueKey = this.key("queue", host);
+    while (true) {
+      const request = parseJson(await this.command("LPOP", queueKey));
+      if (!request) return null;
+      if (!isExpired(request.expiresAt)) return request;
     }
   }
-  return url.toString();
+  async writeResponse(response, ttlSeconds) {
+    await this.command("SET", this.key("response", response.id), serializeJson(response), "EX", ttlSeconds);
+  }
+  async readResponse(requestId) {
+    return parseJson(await this.command("GET", this.key("response", requestId)));
+  }
+  async cleanup(requestId) {
+    await this.command("DEL", this.key("response", requestId));
+  }
+};
+function createRedisGhostTunnelStore(options) {
+  return new RedisGhostTunnelStore(options);
+}
+function resolveRedisGhostTunnelEnv(env = process.env) {
+  const candidates = [
+    env.LOCALGHOST_REDIS_REST_URL && env.LOCALGHOST_REDIS_REST_TOKEN ? { url: env.LOCALGHOST_REDIS_REST_URL, token: env.LOCALGHOST_REDIS_REST_TOKEN, source: "localghost" } : null,
+    env.UPSTASH_REDIS_REST_URL && env.UPSTASH_REDIS_REST_TOKEN ? { url: env.UPSTASH_REDIS_REST_URL, token: env.UPSTASH_REDIS_REST_TOKEN, source: "upstash" } : null,
+    env.KV_REST_API_URL && env.KV_REST_API_TOKEN ? { url: env.KV_REST_API_URL, token: env.KV_REST_API_TOKEN, source: "vercel-kv" } : null,
+    env.REDIS_REST_API_URL && env.REDIS_REST_API_TOKEN ? { url: env.REDIS_REST_API_URL, token: env.REDIS_REST_API_TOKEN, source: "redis" } : null
+  ];
+  const match = candidates.find((candidate) => Boolean(candidate));
+  if (!match) {
+    throw new Error("Ghost Tunnel Redis transport requires REST env vars: UPSTASH_REDIS_REST_URL/UPSTASH_REDIS_REST_TOKEN, KV_REST_API_URL/KV_REST_API_TOKEN, or LOCALGHOST_REDIS_REST_URL/LOCALGHOST_REDIS_REST_TOKEN.");
+  }
+  return match;
+}
+function createRedisGhostTunnelStoreFromEnv(input = {}) {
+  const resolved = resolveRedisGhostTunnelEnv(input.env);
+  return createRedisGhostTunnelStore({
+    url: resolved.url,
+    token: resolved.token,
+    ...input.namespace ? { namespace: input.namespace } : {},
+    ...input.fetch ? { fetch: input.fetch } : {}
+  });
 }
-var constructGhostTunnelURL = constructGhostTunnelUrl;
-function getGhostTunnelDefaultDisplayUrl(options = {}, defaults) {
-  const config = toGhostTunnelConfig(options);
-  if (!config.enabled) return null;
-  return createDisplayUrl(config, defaults);
+
+// src/ghost-agent.ts
+function isStopped(signal, localSignal) {
+  return localSignal.aborted || signal?.aborted === true;
+}
+function wait(ms, signal, localSignal) {
+  if (isStopped(signal, localSignal)) return Promise.resolve();
+  return new Promise((resolve3) => {
+    const timeout = setTimeout(resolve3, ms);
+    const stop = () => {
+      clearTimeout(timeout);
+      resolve3();
+    };
+    signal?.addEventListener("abort", stop, { once: true });
+    localSignal.addEventListener("abort", stop, { once: true });
+  });
 }
-function getGhostTunnelDisplayUrl(options, defaults) {
-  const config = toGhostTunnelConfig(options);
-  if (!config.enabled) return null;
-  return config.displayUrl ?? config.previewUrl ?? getGhostTunnelDefaultDisplayUrl(config, defaults);
+function toHeaderRecord(headers) {
+  const result = {};
+  headers.forEach((value, name) => {
+    result[name] = value;
+  });
+  return result;
 }
-function getGhostTunnelDisplayUrls(options, defaults) {
-  const config = toGhostTunnelConfig(options);
-  if (!config.enabled) return [];
-  if (config.displayUrls.length > 0) return config.displayUrls;
-  const displayUrl = getGhostTunnelDisplayUrl(config, defaults);
-  return displayUrl ? [displayUrl] : [];
+function hasRequestBody(method) {
+  return method !== "GET" && method !== "HEAD";
 }
-function getGhostTunnelPreviewUrl(options) {
-  const config = toGhostTunnelConfig(options);
-  if (!config.enabled) return null;
-  return config.previewUrl ?? maybeConstructPreviewUrl(config) ?? null;
+async function serveGhostTunnelLocalRequest(input) {
+  const fetchImpl = input.fetch ?? fetch;
+  const localUrl = new URL(`${input.target.protocol}://${input.target.host}:${input.target.port}/`);
+  const requestPath = new URL(input.request.path, "http://localghost.invalid");
+  localUrl.pathname = requestPath.pathname;
+  localUrl.search = requestPath.search;
+  try {
+    const body = hasRequestBody(input.request.method) ? decodeGhostTunnelBody(input.request.bodyBase64) : void 0;
+    const response = await fetchImpl(localUrl, {
+      method: input.request.method,
+      headers: {
+        ...stripRelayForwardHeaders(input.request.headers),
+        "x-forwarded-host": input.request.host,
+        "x-localghost-tunnel": "1"
+      },
+      ...body ? { body } : {}
+    });
+    const responseBody = Buffer.from(await response.arrayBuffer());
+    if (responseBody.byteLength > input.maxResponseBodyBytes) {
+      throw new Error(`Ghost Tunnel response exceeded ${input.maxResponseBodyBytes} bytes.`);
+    }
+    return {
+      id: input.request.id,
+      status: response.status,
+      headers: toHeaderRecord(response.headers),
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      ...responseBody.byteLength > 0 ? { bodyBase64: encodeGhostTunnelBody(responseBody) } : {}
+    };
+  } catch (error) {
+    return {
+      id: input.request.id,
+      status: 502,
+      headers: {
+        "content-type": "text/plain; charset=utf-8",
+        "cache-control": "no-store"
+      },
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      error: error instanceof Error ? error.message : String(error),
+      bodyBase64: encodeGhostTunnelBody("Ghost Tunnel local target failed.")
+    };
+  }
 }
-function parseGhostTunnelHost(host, domain, options = {}) {
-  const config = toGhostTunnelConfig(options);
-  if (!config.enabled) return null;
-  const normalizedHost = normalizeDomain(host);
-  const normalizedDomain = normalizeDomain(domain);
-  if (!normalizedHost || !normalizedDomain) return null;
-  const entryHost = getGhostTunnelEntryHost(normalizedDomain, config);
-  const suffix = `.${entryHost}`;
-  if (!normalizedHost.endsWith(suffix)) return null;
-  const slug = normalizedHost.slice(0, -suffix.length);
-  if (!isValidHostLabel(slug)) return null;
-  const namespace = parseNamespaceSlug(slug, config.namespace);
-  if (!namespace) return null;
+async function heartbeatRoutes(input) {
+  for (const entry of input.entries) {
+    const target = assertRelayLocalTarget({ host: input.targetHost, port: entry.port });
+    await input.store.heartbeatRoute(createGhostTunnelRouteHeartbeat({
+      host: entry.host,
+      agentId: input.agentId,
+      target,
+      ttlSeconds: input.routeTtlSeconds
+    }), input.routeTtlSeconds);
+  }
+}
+async function claimAndServe(input) {
+  const request = await input.store.claimRequest(input.entry.host);
+  if (!request) return false;
+  const target = assertRelayLocalTarget({ host: input.targetHost, port: input.entry.port });
+  const response = await serveGhostTunnelLocalRequest({
+    request,
+    target,
+    maxResponseBodyBytes: input.maxResponseBodyBytes,
+    ...input.fetch ? { fetch: input.fetch } : {}
+  });
+  await input.store.writeResponse(response, input.requestTtlSeconds);
+  return true;
+}
+function startGhostTunnelAgent(options) {
+  const controller = new AbortController();
+  const localSignal = controller.signal;
+  const signal = options.signal;
+  const agentId = options.agentId ?? `localghost-${randomUUID2()}`;
+  const targetHost = options.targetHost ?? "127.0.0.1";
+  const routeTtlSeconds = options.routeTtlSeconds ?? 30;
+  const requestTtlSeconds = options.requestTtlSeconds ?? 60;
+  const pollIntervalMs = options.pollIntervalMs ?? 500;
+  const maxResponseBodyBytes = options.maxResponseBodyBytes ?? 5 * 1024 * 1024;
+  const done = (async () => {
+    if (options.entries.length === 0) {
+      throw new Error("Ghost Tunnel agent requires at least one .ghosttunnel entry.");
+    }
+    options.log?.(`localghost tunnel agent ${agentId}`);
+    for (const entry of options.entries) {
+      options.log?.(`  ${entry.host} -> ${targetHost}:${entry.port}`);
+    }
+    let lastHeartbeat = 0;
+    while (!isStopped(signal, localSignal)) {
+      const now = Date.now();
+      if (now - lastHeartbeat >= Math.max(1e3, Math.floor(routeTtlSeconds * 1e3 / 3))) {
+        await heartbeatRoutes({
+          entries: options.entries,
+          store: options.store,
+          agentId,
+          targetHost,
+          routeTtlSeconds
+        });
+        lastHeartbeat = now;
+      }
+      let served = false;
+      for (const entry of options.entries) {
+        served = await claimAndServe({
+          entry,
+          store: options.store,
+          targetHost,
+          requestTtlSeconds,
+          maxResponseBodyBytes,
+          ...options.fetch ? { fetch: options.fetch } : {}
+        }) || served;
+      }
+      if (!served) {
+        await wait(pollIntervalMs, signal, localSignal);
+      }
+    }
+  })();
   return {
-    host: normalizedHost,
-    slug,
-    namespace,
-    entryHost,
-    wildcardHost: `*.${entryHost}`,
-    domain: normalizedDomain
+    agentId,
+    stop() {
+      controller.abort();
+    },
+    done
   };
 }
-function assertSecureGhostTunnelRequest(input) {
-  const config = toGhostTunnelConfig(input.ghostTunnel);
-  if (!config.enabled) {
-    throw new Error("Ghost tunnel is not enabled.");
-  }
-  if (config.requireHttps && input.protocol !== "https") {
-    throw new Error("Ghost tunnel requests must use HTTPS.");
-  }
-  if (config.requireAuth && input.authenticated !== true) {
-    throw new Error("Ghost tunnel requests must be authenticated.");
-  }
-  const route = parseGhostTunnelHost(input.host, input.domain, config);
-  if (!route) {
-    throw new Error(`Host is not a valid ghost tunnel host for ${input.domain}.`);
-  }
-  return route;
-}
 
-// src/context.ts
-var LOCALGHOST_PROJECT_CONFIG_FILES = [
-  "localghost.config.mjs",
-  "localghost.config.js",
-  "localghost.config.cjs"
-];
-function parsePort(value) {
-  if (!value) return void 0;
-  const port = Number.parseInt(value, 10);
-  return Number.isInteger(port) && port > 0 && port <= 65535 ? port : void 0;
+// src/ghost-transport.ts
+import { createHmac as createHmac2, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { isIP } from "net";
+
+// src/tunnel.ts
+import { domainToASCII as domainToASCII2 } from "url";
+var DEFAULT_GHOST_TUNNEL_SUBDOMAIN = "ghost";
+var DEFAULT_GHOST_TUNNEL_NAMESPACE_TAGS = ["route", "project", "owner"];
+var DEFAULT_GHOST_TUNNEL_NAMESPACE_SEPARATOR = "-";
+var DEFAULT_GHOST_TUNNEL_MODE = "manual";
+var DEFAULT_GHOST_TUNNEL_ADAPTER_STRATEGY = "same-project";
+var DEFAULT_GHOST_TUNNEL_TRANSPORT_KIND = "none";
+var DEFAULT_GHOST_TUNNEL_TUNNEL_STORE_PROVIDER = "vercel-redis";
+var DEFAULT_GHOST_TUNNEL_TUNNEL_STORE_ENV = "auto";
+var DEFAULT_GHOST_TUNNEL_TUNNEL_STORE_NAMESPACE = "localghost";
+var DEFAULT_GHOST_TUNNEL_TUNNEL_WAIT_MS = 25e3;
+var DEFAULT_GHOST_TUNNEL_TUNNEL_POLL_INTERVAL_MS = 250;
+var DEFAULT_GHOST_TUNNEL_TUNNEL_ROUTE_TTL_SECONDS = 30;
+var DEFAULT_GHOST_TUNNEL_TUNNEL_REQUEST_TTL_SECONDS = 60;
+var DEFAULT_GHOST_TUNNEL_TUNNEL_MAX_REQUEST_BODY_BYTES = 1024 * 1024;
+var DEFAULT_GHOST_TUNNEL_TUNNEL_MAX_RESPONSE_BODY_BYTES = 5 * 1024 * 1024;
+function isResolvedGhostTunnelConfig(value) {
+  return typeof value === "object" && value !== null && "enabled" in value;
 }
-function envPort() {
-  return parsePort(process.env.LOCALGHOST_PORT) ?? parsePort(process.env.VITE_PORT);
+function toGhostTunnelConfig(options) {
+  return isResolvedGhostTunnelConfig(options) ? options : resolveGhostTunnelConfig(options);
 }
-function envDynamicPort() {
-  const value = process.env.LOCALGHOST_DYNAMIC_PORT;
-  if (!value) return void 0;
-  return ["1", "true", "yes", "on"].includes(value.toLowerCase());
+function stripHostPort(value) {
+  const trimmed = value.trim().toLowerCase();
+  if (trimmed.startsWith("[") || trimmed.includes("/")) return "";
+  const portSeparator = trimmed.lastIndexOf(":");
+  if (portSeparator === -1) return trimmed;
+  const port = trimmed.slice(portSeparator + 1);
+  return /^\d+$/.test(port) ? trimmed.slice(0, portSeparator) : trimmed;
 }
-function envHttps() {
-  const value = process.env.LOCALGHOST_HTTPS;
-  if (!value) return void 0;
-  return ["1", "true", "yes", "on"].includes(value.toLowerCase());
+function normalizeDomain(value) {
+  const host = stripHostPort(value.replace(/^\*\./, ""));
+  const ascii = domainToASCII2(host);
+  if (!ascii || ascii.length > 253 || ascii.includes("..")) return null;
+  if (ascii.startsWith(".") || ascii.endsWith(".")) return null;
+  if (ascii.includes("*")) return null;
+  if (!ascii.split(".").every(isValidHostLabel)) return null;
+  return ascii;
 }
-function getPackageName(cwd) {
-  try {
-    const pkg = JSON.parse(readFileSync4(join4(cwd, "package.json"), "utf8"));
-    return typeof pkg.name === "string" ? pkg.name : void 0;
-  } catch {
-    return void 0;
+function isValidHostLabel(value) {
+  return value.length > 0 && value.length <= 63 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(value);
+}
+function isValidNamespaceTag(value) {
+  return /^[a-z][a-z0-9_]*$/i.test(value);
+}
+function isNamespaceTagList(options) {
+  return Array.isArray(options);
+}
+function assertValidSubdomain(value) {
+  if (!isValidHostLabel(value)) {
+    throw new Error(`Invalid ghost tunnel subdomain: ${value}`);
   }
 }
-function getPackageOwner(cwd) {
-  const packageName = getPackageName(cwd);
-  if (!packageName?.startsWith("@")) return void 0;
-  return packageName.slice(1).split("/")[0];
+function normalizeDomains(domains) {
+  const values = typeof domains === "string" ? [domains] : [...domains ?? []];
+  const normalized = values.map((value) => value.trim()).filter(Boolean).map((value) => {
+    const domain = normalizeDomain(value);
+    if (!domain) throw new Error(`Invalid ghost tunnel domain: ${value}`);
+    return domain;
+  });
+  return [...new Set(normalized)];
 }
-function getLocalOwner(cwd) {
-  return sanitizeProjectName(process.env.LOCALGHOST_OWNER ?? getPackageOwner(cwd) ?? process.env.USER ?? process.env.USERNAME ?? "local");
+function parseGhostTunnelMode(value) {
+  return value ?? DEFAULT_GHOST_TUNNEL_MODE;
 }
-function getRouteName(primaryHost, fallback) {
-  return sanitizeProjectName(primaryHost.split(".")[0] ?? fallback);
+function parseGhostTunnelAdapterStrategy(value) {
+  if (typeof value === "undefined") return DEFAULT_GHOST_TUNNEL_ADAPTER_STRATEGY;
+  if (value === "same-project" || value === "separate-relay") return value;
+  throw new Error(`Unsupported ghost tunnel adapter strategy: ${String(value)}`);
 }
-function readOptionsFromContext(options) {
-  return {
-    cwd: options.cwd ?? process.cwd(),
-    ...options.fileName ? { fileName: options.fileName } : {},
-    ...options.configFiles ? { configFiles: options.configFiles } : {},
-    ...options.configPattern ? { configPattern: options.configPattern } : {}
-  };
+function parseGhostTunnelTransportKind(value) {
+  if (typeof value === "undefined") return DEFAULT_GHOST_TUNNEL_TRANSPORT_KIND;
+  if (value === "none" || value === "ip" || value === "tunnel") return value;
+  throw new Error(`Unsupported ghost tunnel transport: ${String(value)}`);
 }
-function withRuntimePort(entries, requestedPort, port) {
-  if (requestedPort === port) return entries;
-  const hasRequestedPort = entries.some((entry) => entry.port === requestedPort);
-  if (!hasRequestedPort) return entries;
-  return entries.map((entry) => entry.port === requestedPort ? { ...entry, port } : entry);
+function parsePositiveInteger(value, fallback, name) {
+  if (typeof value === "undefined") return fallback;
+  if (!Number.isInteger(value) || value < 1) {
+    throw new Error(`Invalid ghost tunnel ${name}: ${value}`);
+  }
+  return value;
 }
-function uniqueHosts(entries) {
-  return [...new Set(entries.map((entry) => entry.host))];
+function parseTunnelStoreProvider(value) {
+  if (typeof value === "undefined") return DEFAULT_GHOST_TUNNEL_TUNNEL_STORE_PROVIDER;
+  if (value === "vercel-redis" || value === "redis") return value;
+  throw new Error(`Unsupported ghost tunnel tunnel store provider: ${String(value)}`);
 }
-function isAliasableHost(host) {
-  return host.includes(".") && !host.startsWith("www.") && !host.includes(":");
+function parseTunnelStoreEnv(value) {
+  if (typeof value === "undefined") return DEFAULT_GHOST_TUNNEL_TUNNEL_STORE_ENV;
+  if (value === "auto") return value;
+  throw new Error(`Unsupported ghost tunnel tunnel store env: ${String(value)}`);
 }
-function getDefaultWwwAlias(host) {
-  return isAliasableHost(host) ? `www.${host}` : null;
+function parseTunnelStoreNamespace(value) {
+  const namespace = value ?? DEFAULT_GHOST_TUNNEL_TUNNEL_STORE_NAMESPACE;
+  if (!/^[a-z][a-z0-9:_-]{0,63}$/i.test(namespace)) {
+    throw new Error(`Invalid ghost tunnel tunnel store namespace: ${namespace}`);
+  }
+  return namespace;
 }
-function addDefaultWwwAliases(entries) {
-  const seen = new Set(entries.map((entry) => entry.host));
-  const aliases = [];
-  for (const entry of entries) {
-    const alias = getDefaultWwwAlias(entry.host);
-    if (alias && !seen.has(alias)) {
-      aliases.push({ host: alias, port: entry.port, target: `127.0.0.1:${entry.port}` });
-      seen.add(alias);
-    }
+function resolveGhostTunnelAdapter(input) {
+  if (!input) return void 0;
+  const provider = typeof input === "string" ? input : input.provider;
+  if (provider !== "vercel") {
+    throw new Error(`Unsupported ghost tunnel adapter provider: ${String(provider)}`);
   }
-  return [...entries, ...aliases];
+  return {
+    provider,
+    strategy: typeof input === "string" ? DEFAULT_GHOST_TUNNEL_ADAPTER_STRATEGY : parseGhostTunnelAdapterStrategy(input.strategy)
+  };
 }
-function defined(input) {
-  return Object.fromEntries(Object.entries(input).filter(([, value]) => typeof value !== "undefined"));
+function getLegacyGhostTunnelTransport(input) {
+  if (!input || typeof input === "string" || !("transport" in input)) return void 0;
+  return input.transport;
 }
-async function readLocalghostProjectConfig(options = {}) {
-  const cwd = options.cwd ?? process.cwd();
-  if (options.configFile === false) return { config: {} };
-  const candidates = options.configFile ? [options.configFile] : LOCALGHOST_PROJECT_CONFIG_FILES;
-  const path = candidates.map((candidate) => resolveDevHostsPath({ cwd, fileName: candidate }).path).find((candidate) => existsSync3(candidate));
-  if (!path) return { config: {} };
-  const imported = await import(`${pathToFileURL(path).href}?localghost=${Date.now()}`);
-  const config = imported.default ?? imported;
-  return { config, path };
+function resolveGhostTunnelTransport(input) {
+  if (!input) {
+    return { kind: "none" };
+  }
+  const kind = typeof input === "string" ? parseGhostTunnelTransportKind(input) : parseGhostTunnelTransportKind(input.kind);
+  if (kind === "ip") {
+    return {
+      kind,
+      allowPrivateNetworkAddress: typeof input === "string" ? false : input.kind === "ip" ? input.allowPrivateNetworkAddress ?? false : false
+    };
+  }
+  if (kind === "tunnel") {
+    const config = typeof input === "string" || input.kind !== "tunnel" ? void 0 : input;
+    const store = config?.store ?? {};
+    return {
+      kind,
+      store: {
+        provider: parseTunnelStoreProvider(store.provider),
+        env: parseTunnelStoreEnv(store.env),
+        namespace: parseTunnelStoreNamespace(store.namespace)
+      },
+      waitMs: parsePositiveInteger(config?.waitMs, DEFAULT_GHOST_TUNNEL_TUNNEL_WAIT_MS, "tunnel waitMs"),
+      pollIntervalMs: parsePositiveInteger(config?.pollIntervalMs, DEFAULT_GHOST_TUNNEL_TUNNEL_POLL_INTERVAL_MS, "tunnel pollIntervalMs"),
+      routeTtlSeconds: parsePositiveInteger(config?.routeTtlSeconds, DEFAULT_GHOST_TUNNEL_TUNNEL_ROUTE_TTL_SECONDS, "tunnel routeTtlSeconds"),
+      requestTtlSeconds: parsePositiveInteger(config?.requestTtlSeconds, DEFAULT_GHOST_TUNNEL_TUNNEL_REQUEST_TTL_SECONDS, "tunnel requestTtlSeconds"),
+      maxRequestBodyBytes: parsePositiveInteger(config?.maxRequestBodyBytes, DEFAULT_GHOST_TUNNEL_TUNNEL_MAX_REQUEST_BODY_BYTES, "tunnel maxRequestBodyBytes"),
+      maxResponseBodyBytes: parsePositiveInteger(config?.maxResponseBodyBytes, DEFAULT_GHOST_TUNNEL_TUNNEL_MAX_RESPONSE_BODY_BYTES, "tunnel maxResponseBodyBytes")
+    };
+  }
+  return { kind: "none" };
 }
-function defineLocalghostConfig(config) {
-  return config;
+function resolveNamespaceConfig(options) {
+  const tags = isNamespaceTagList(options) ? [...options] : [...options?.tags ?? DEFAULT_GHOST_TUNNEL_NAMESPACE_TAGS];
+  let separator = DEFAULT_GHOST_TUNNEL_NAMESPACE_SEPARATOR;
+  let spreadTag = tags.includes("project") ? "project" : void 0;
+  if (options && !isNamespaceTagList(options)) {
+    separator = options.separator ?? DEFAULT_GHOST_TUNNEL_NAMESPACE_SEPARATOR;
+    spreadTag = options.spreadTag === false ? false : options.spreadTag ?? spreadTag;
+  }
+  if (tags.length === 0) {
+    throw new Error("Ghost tunnel namespace must include at least one tag.");
+  }
+  for (const tag of tags) {
+    if (!isValidNamespaceTag(tag)) {
+      throw new Error(`Invalid ghost tunnel namespace tag: ${tag}`);
+    }
+  }
+  if (spreadTag && !tags.includes(spreadTag)) {
+    throw new Error(`Ghost tunnel namespace spreadTag must be listed in tags: ${spreadTag}`);
+  }
+  if (!separator || separator.length > 8 || !/^[a-z0-9-]+$/.test(separator)) {
+    throw new Error(`Invalid ghost tunnel namespace separator: ${separator}`);
+  }
+  return {
+    tags,
+    separator,
+    ...spreadTag ? { spreadTag } : {}
+  };
 }
-async function resolveLocalghostContext(options = {}) {
-  const cwd = options.cwd ?? process.cwd();
-  const projectConfig = await readLocalghostProjectConfig({
-    cwd,
-    ...typeof options.localghostConfig !== "undefined" ? { configFile: options.localghostConfig } : {}
+function normalizeNamespaceValue(tag, value, separator, options = {}) {
+  const normalized = normalizeDomain(value);
+  if (!normalized || normalized.includes(".")) {
+    throw new Error(`Invalid ghost tunnel namespace value for ${tag}: ${value}`);
+  }
+  if (!options.allowSeparator && normalized.includes(separator)) {
+    throw new Error(`Ghost tunnel namespace value for ${tag} cannot include separator "${separator}": ${value}`);
+  }
+  return normalized;
+}
+function createNamespaceSlug(config, values) {
+  const parts = config.tags.map((tag) => {
+    const value = values[tag];
+    if (!value) {
+      throw new Error(`Missing ghost tunnel namespace value: ${tag}`);
+    }
+    return normalizeNamespaceValue(tag, value, config.separator, { allowSeparator: tag === config.spreadTag });
   });
-  const merged = {
-    ...projectConfig.config,
-    ...defined(options)
+  const slug = parts.join(config.separator);
+  if (!isValidHostLabel(slug)) {
+    throw new Error(`Ghost tunnel namespace is too long for a DNS label: ${slug}`);
+  }
+  return slug;
+}
+function createNamespaceDisplaySlug(config, values = {}) {
+  return config.tags.map((tag) => {
+    const value = values[tag];
+    if (!value) return `<${tag}>`;
+    try {
+      return normalizeNamespaceValue(tag, value, config.separator, { allowSeparator: tag === config.spreadTag });
+    } catch {
+      return `<${tag}>`;
+    }
+  }).join(config.separator);
+}
+function getPreviewDefaults(preview, defaults) {
+  return {
+    domain: preview?.domain ?? defaults?.domain,
+    route: preview?.route ?? defaults?.route,
+    project: preview?.project ?? defaults?.project,
+    owner: preview?.owner ?? defaults?.owner,
+    values: {
+      ...defaults?.values ?? {},
+      ...preview?.values ?? {}
+    },
+    path: preview?.path,
+    protocol: preview?.protocol
   };
-  const readOptions = readOptionsFromContext({ ...merged, cwd });
-  const resolvedPath = resolveDevHostsPath(readOptions);
-  const configEntries = readDevHosts(readOptions);
-  const requestedPort = merged.port ?? envPort() ?? configEntries[0]?.port ?? 5173;
-  const dynamicPort = merged.dynamicPort ?? envDynamicPort() ?? true;
-  const bindHost = merged.bindHost ?? "127.0.0.1";
-  const probeHost = typeof bindHost === "string" ? bindHost : "127.0.0.1";
-  const port = dynamicPort ? await findAvailablePort(requestedPort, { host: probeHost }) : requestedPort;
-  const wwwAlias = merged.wwwAlias ?? true;
-  const entries = wwwAlias ? addDefaultWwwAliases(withRuntimePort(configEntries, requestedPort, port)) : withRuntimePort(configEntries, requestedPort, port);
-  const hosts = uniqueHosts(entries);
-  const primaryHost = merged.primaryHost ?? entries.find((entry) => entry.port === port)?.host ?? hosts[0] ?? `${sanitizeProjectName(getProjectName(cwd))}.localhost`;
-  const projectName = sanitizeProjectName(merged.project ?? getProjectName(cwd));
-  const ghostTunnel = resolveGhostTunnelConfig(merged.ghostTunnel, {
-    route: getRouteName(primaryHost, projectName),
-    project: projectName,
-    owner: getLocalOwner(cwd)
+}
+function getDisplayValues(input) {
+  return {
+    ...input.route ? { route: input.route } : {},
+    ...input.project ? { project: input.project } : {},
+    ...input.owner ? { owner: input.owner } : {},
+    ...input.values
+  };
+}
+function getDisplayDefaults(defaults) {
+  return defaults;
+}
+function createDisplayUrl(config, defaults, domain) {
+  const input = getPreviewDefaults(config.preview, getDisplayDefaults(defaults));
+  const protocol = input.protocol ?? "https";
+  const slug = createNamespaceDisplaySlug(config.namespace, getDisplayValues(input));
+  const entryHost = domain ? getGhostTunnelEntryHost(domain, config) : input.domain ? getGhostTunnelEntryHost(input.domain, config) : `${config.subdomain}.*`;
+  const url = `${protocol}://${slug}.${entryHost}/`;
+  if (!input.path) return url;
+  return `${url}${input.path.replace(/^\/+/, "")}`;
+}
+function createDisplayUrls(config, defaults) {
+  const displayDefaults = getDisplayDefaults(defaults);
+  const domains = config.domains.length > 0 ? config.domains : displayDefaults?.domain ? [displayDefaults.domain] : [];
+  const urls = domains.length > 0 ? domains.map((domain) => createDisplayUrl(config, displayDefaults, domain)) : [createDisplayUrl(config, displayDefaults)];
+  return [...new Set(urls)];
+}
+function maybeConstructPreviewUrl(config, defaults) {
+  if (!config.preview) return void 0;
+  const input = getPreviewDefaults(config.preview, defaults);
+  if (!input.domain || !input.route || !input.project || !input.owner) return void 0;
+  return constructGhostTunnelUrl({
+    domain: input.domain,
+    route: input.route,
+    project: input.project,
+    owner: input.owner,
+    values: input.values,
+    ...input.path ? { path: input.path } : {},
+    ...input.protocol ? { protocol: input.protocol } : {},
+    ghostTunnel: config
   });
+}
+function parseNamespaceSlug(slug, config) {
+  const parts = slug.split(config.separator);
+  if (parts.length < config.tags.length) return null;
+  if (parts.length !== config.tags.length && !config.spreadTag) return null;
+  const namespace = {};
+  const spreadIndex = config.spreadTag ? config.tags.indexOf(config.spreadTag) : -1;
+  const spreadWidth = spreadIndex >= 0 ? parts.length - config.tags.length + 1 : 1;
+  let partIndex = 0;
+  for (const [tagIndex, tag] of config.tags.entries()) {
+    const value = tagIndex === spreadIndex ? parts.slice(partIndex, partIndex + spreadWidth).join(config.separator) : parts[partIndex];
+    if (!value || !isValidHostLabel(value)) return null;
+    if (tagIndex !== spreadIndex && value.includes(config.separator)) return null;
+    namespace[tag] = value;
+    partIndex += tagIndex === spreadIndex ? spreadWidth : 1;
+  }
+  return namespace;
+}
+function resolveGhostTunnelConfig(options, defaults) {
+  if (options === false || typeof options === "undefined") {
+    return {
+      enabled: false,
+      mode: DEFAULT_GHOST_TUNNEL_MODE,
+      domains: [],
+      subdomain: DEFAULT_GHOST_TUNNEL_SUBDOMAIN,
+      namespace: resolveNamespaceConfig(void 0),
+      displayUrls: [],
+      requireHttps: true,
+      requireAuth: true,
+      transport: resolveGhostTunnelTransport(void 0)
+    };
+  }
+  const config = typeof options === "string" ? { mode: options } : options;
+  const subdomain = config.subdomain ?? DEFAULT_GHOST_TUNNEL_SUBDOMAIN;
+  assertValidSubdomain(subdomain);
+  const domains = normalizeDomains(config.domains);
+  const enabled = config.enabled ?? true;
+  const adapter = resolveGhostTunnelAdapter(config.adapter);
+  const transport = resolveGhostTunnelTransport(config.transport ?? getLegacyGhostTunnelTransport(config.adapter));
+  const resolved = {
+    enabled,
+    mode: parseGhostTunnelMode(config.mode),
+    domains,
+    subdomain,
+    namespace: resolveNamespaceConfig(config.namespace),
+    ...config.preview ? { preview: config.preview } : {},
+    displayUrls: [],
+    requireHttps: config.requireHttps ?? true,
+    requireAuth: config.requireAuth ?? true,
+    transport,
+    ...adapter ? { adapter } : {}
+  };
+  if (!enabled) {
+    return resolved;
+  }
+  const previewUrl = maybeConstructPreviewUrl(resolved, defaults);
+  const displayUrls = previewUrl ? [previewUrl] : createDisplayUrls(resolved, defaults);
+  return {
+    ...resolved,
+    displayUrls,
+    ...displayUrls[0] ? { displayUrl: displayUrls[0] } : {},
+    ...previewUrl ? { previewUrl } : {}
+  };
+}
+function getGhostTunnelEntryHost(domain, options = {}) {
+  const config = toGhostTunnelConfig(options);
+  const normalizedDomain = normalizeDomain(domain);
+  if (!normalizedDomain) {
+    throw new Error(`Invalid ghost tunnel domain: ${domain}`);
+  }
+  return `${config.subdomain}.${normalizedDomain}`;
+}
+function getGhostTunnelWildcardHost(domain, options = {}) {
+  return `*.${getGhostTunnelEntryHost(domain, options)}`;
+}
+function constructGhostTunnelHost(input) {
+  const config = toGhostTunnelConfig(input.ghostTunnel ?? {});
+  if (!config.enabled) {
+    throw new Error("Ghost tunnel is not enabled.");
+  }
+  const namespaceValues = {
+    route: input.route,
+    project: input.project,
+    owner: input.owner,
+    ...input.values ?? {}
+  };
+  const slug = createNamespaceSlug(config.namespace, namespaceValues);
+  return `${slug}.${getGhostTunnelEntryHost(input.domain, config)}`;
+}
+function constructGhostTunnelUrl(input) {
+  const protocol = input.protocol ?? "https";
+  const host = constructGhostTunnelHost(input);
+  const url = new URL(`${protocol}://${host}/`);
+  if (input.path) {
+    url.pathname = `/${input.path.replace(/^\/+/, "")}`;
+  }
+  if (input.searchParams instanceof URLSearchParams) {
+    url.search = input.searchParams.toString();
+  } else if (input.searchParams) {
+    for (const [key, value] of Object.entries(input.searchParams)) {
+      if (typeof value !== "undefined" && value !== null) {
+        url.searchParams.set(key, String(value));
+      }
+    }
+  }
+  return url.toString();
+}
+var constructGhostTunnelURL = constructGhostTunnelUrl;
+function getGhostTunnelDefaultDisplayUrl(options = {}, defaults) {
+  const config = toGhostTunnelConfig(options);
+  if (!config.enabled) return null;
+  return createDisplayUrl(config, defaults);
+}
+function getGhostTunnelDisplayUrl(options, defaults) {
+  const config = toGhostTunnelConfig(options);
+  if (!config.enabled) return null;
+  return config.displayUrl ?? config.previewUrl ?? getGhostTunnelDefaultDisplayUrl(config, defaults);
+}
+function getGhostTunnelDisplayUrls(options, defaults) {
+  const config = toGhostTunnelConfig(options);
+  if (!config.enabled) return [];
+  if (config.displayUrls.length > 0) return config.displayUrls;
+  const displayUrl = getGhostTunnelDisplayUrl(config, defaults);
+  return displayUrl ? [displayUrl] : [];
+}
+function getGhostTunnelPreviewUrl(options) {
+  const config = toGhostTunnelConfig(options);
+  if (!config.enabled) return null;
+  return config.previewUrl ?? maybeConstructPreviewUrl(config) ?? null;
+}
+function parseGhostTunnelHost(host, domain, options = {}) {
+  const config = toGhostTunnelConfig(options);
+  if (!config.enabled) return null;
+  const normalizedHost = normalizeDomain(host);
+  const normalizedDomain = normalizeDomain(domain);
+  if (!normalizedHost || !normalizedDomain) return null;
+  const entryHost = getGhostTunnelEntryHost(normalizedDomain, config);
+  const suffix = `.${entryHost}`;
+  if (!normalizedHost.endsWith(suffix)) return null;
+  const slug = normalizedHost.slice(0, -suffix.length);
+  if (!isValidHostLabel(slug)) return null;
+  const namespace = parseNamespaceSlug(slug, config.namespace);
+  if (!namespace) return null;
   return {
-    cwd,
-    projectName,
-    readOptions,
-    configPath: resolvedPath.path,
-    configFileName: resolvedPath.fileName,
-    configEntries,
-    entries,
-    hosts,
-    requestedPort,
-    port,
-    dynamicPort,
-    bindHost,
-    primaryHost,
-    https: merged.https ?? envHttps() ?? false,
-    wwwAlias,
-    ghostTunnel,
-    ...projectConfig.path ? { projectConfigPath: projectConfig.path } : {}
+    host: normalizedHost,
+    slug,
+    namespace,
+    entryHost,
+    wildcardHost: `*.${entryHost}`,
+    domain: normalizedDomain
   };
 }
+function assertSecureGhostTunnelRequest(input) {
+  const config = toGhostTunnelConfig(input.ghostTunnel);
+  if (!config.enabled) {
+    throw new Error("Ghost tunnel is not enabled.");
+  }
+  if (config.requireHttps && input.protocol !== "https") {
+    throw new Error("Ghost tunnel requests must use HTTPS.");
+  }
+  if (config.requireAuth && input.authenticated !== true) {
+    throw new Error("Ghost tunnel requests must be authenticated.");
+  }
+  const route = parseGhostTunnelHost(input.host, input.domain, config);
+  if (!route) {
+    throw new Error(`Host is not a valid ghost tunnel host for ${input.domain}.`);
+  }
+  return route;
+}
 
-// src/doctor.ts
-import { execa as execa2 } from "execa";
-async function checkCaddy() {
-  try {
-    const result = await execa2("caddy", ["version"], { reject: false });
-    const version = [result.stdout, result.stderr].filter(Boolean).join("\n").trim();
-    return {
-      found: result.exitCode === 0,
-      ...version ? { version } : {},
-      installHint: "brew install caddy"
-    };
-  } catch {
-    return {
-      found: false,
-      installHint: "brew install caddy"
-    };
+// src/ghost-transport.ts
+var DEFAULT_GHOST_TUNNEL_TRANSPORT_QUERY_PARAM = "__localghost";
+var DEFAULT_GHOST_TUNNEL_IP_TRANSPORT_TTL_SECONDS = 10 * 60;
+function base64UrlEncode2(value) {
+  return Buffer.from(value).toString("base64url");
+}
+function base64UrlDecode2(value) {
+  return Buffer.from(value, "base64url").toString("utf8");
+}
+function signPayload2(payload, secret) {
+  return createHmac2("sha256", secret).update(payload).digest("base64url");
+}
+function secureEqual2(left, right) {
+  const leftBuffer = Buffer.from(left);
+  const rightBuffer = Buffer.from(right);
+  return leftBuffer.length === rightBuffer.length && timingSafeEqual2(leftBuffer, rightBuffer);
+}
+function isValidIpv42(value) {
+  return isIP(value) === 4;
+}
+function isPrivateIpv42(value) {
+  if (!isValidIpv42(value)) return false;
+  const [first = 0, second = 0] = value.split(".").map((part) => Number(part));
+  return first === 10 || first === 127 || first === 172 && second >= 16 && second <= 31 || first === 192 && second === 168 || first === 169 && second === 254;
+}
+function assertGhostTunnelIpAddress(address, allowPrivateNetworkAddress = false) {
+  const normalized = address.trim();
+  if (!isValidIpv42(normalized)) {
+    throw new Error(`Ghost tunnel IP transport requires a valid IPv4 address: ${address}`);
   }
+  if (!allowPrivateNetworkAddress && isPrivateIpv42(normalized)) {
+    throw new Error(`Ghost tunnel IP transport requires explicit private-network opt-in: ${normalized}`);
+  }
+  return normalized;
 }
-async function runDoctor() {
-  const caddy = await checkCaddy();
+function assertRelayProtocol(value) {
+  const protocol = value ?? "http";
+  if (protocol !== "http" && protocol !== "https") {
+    throw new Error(`Invalid ghost tunnel IP transport protocol: ${String(value)}`);
+  }
+  return protocol;
+}
+function resolveTransportConfig(input) {
+  return resolveGhostTunnelConfig({
+    enabled: true,
+    ...typeof input !== "undefined" ? { transport: input } : {}
+  }).transport;
+}
+function resolveExpiresAt(input, now = /* @__PURE__ */ new Date()) {
+  if (input.expiresAt) {
+    if (Number.isNaN(Date.parse(input.expiresAt))) {
+      throw new Error("Ghost tunnel IP transport requires a valid expiresAt value.");
+    }
+    return input.expiresAt;
+  }
+  const ttlSeconds = input.ttlSeconds ?? DEFAULT_GHOST_TUNNEL_IP_TRANSPORT_TTL_SECONDS;
+  if (!Number.isInteger(ttlSeconds) || ttlSeconds < 1) {
+    throw new Error(`Ghost tunnel IP transport ttlSeconds must be a positive integer: ${ttlSeconds}`);
+  }
+  return new Date(now.getTime() + ttlSeconds * 1e3).toISOString();
+}
+function getBaseGhostTunnelUrl(input) {
+  if ("url" in input) {
+    return new URL(input.url);
+  }
+  return new URL(constructGhostTunnelUrl(input));
+}
+function signGhostTunnelIpTransportClaim(claim, signingSecret, options = {}) {
+  const payload = {
+    kind: "ip",
+    host: assertExactRelayHost(claim.host),
+    address: assertGhostTunnelIpAddress(claim.address, options.allowPrivateNetworkAddress),
+    protocol: assertRelayProtocol(claim.protocol),
+    expiresAt: resolveExpiresAt({ expiresAt: claim.expiresAt })
+  };
+  const encodedPayload = base64UrlEncode2(JSON.stringify(payload));
+  const signature = signPayload2(encodedPayload, signingSecret);
   return {
-    ok: caddy.found,
-    caddy
+    payload,
+    token: `${encodedPayload}.${signature}`
   };
 }
-
-// src/env.ts
-var PRODUCTION_ENV_KEYS = ["NODE_ENV", "VERCEL_ENV", "NETLIFY", "CF_PAGES_BRANCH", "LOCALGHOST_ENV"];
-function getProductionReason(env = process.env) {
-  if (env.LOCALGHOST_ENV === "production") return "LOCALGHOST_ENV=production";
-  if (env.NODE_ENV === "production") return "NODE_ENV=production";
-  if (env.VERCEL_ENV === "production") return "VERCEL_ENV=production";
-  if (env.NETLIFY === "true" && env.CONTEXT === "production") return "NETLIFY=true and CONTEXT=production";
-  if (env.CF_PAGES_BRANCH && env.CF_PAGES_BRANCH === env.CF_PAGES_PRODUCTION_BRANCH) {
-    return "CF_PAGES_BRANCH matches CF_PAGES_PRODUCTION_BRANCH";
+function verifyGhostTunnelIpTransportClaim(token, signingSecret, options) {
+  const [encodedPayload, signature] = token.split(".");
+  if (!encodedPayload || !signature || token.split(".").length !== 2) {
+    throw new Error("Invalid ghost tunnel IP transport token.");
   }
-  return null;
+  const expectedSignature = signPayload2(encodedPayload, signingSecret);
+  if (!secureEqual2(signature, expectedSignature)) {
+    throw new Error("Invalid ghost tunnel IP transport signature.");
+  }
+  const parsed = JSON.parse(base64UrlDecode2(encodedPayload));
+  const host = assertExactRelayHost(parsed.host);
+  const expectedHost = assertExactRelayHost(options.host);
+  if (host !== expectedHost) {
+    throw new Error("Ghost tunnel IP transport host mismatch.");
+  }
+  const now = options.now ?? /* @__PURE__ */ new Date();
+  if (Number.isNaN(Date.parse(parsed.expiresAt)) || Date.parse(parsed.expiresAt) <= now.getTime()) {
+    throw new Error("Ghost tunnel IP transport token has expired.");
+  }
+  return {
+    kind: "ip",
+    host,
+    address: assertGhostTunnelIpAddress(parsed.address, options.allowPrivateNetworkAddress),
+    protocol: assertRelayProtocol(parsed.protocol),
+    expiresAt: parsed.expiresAt
+  };
 }
-function isProductionLike(env = process.env) {
-  return getProductionReason(env) !== null;
+function constructGhostTunnelIpUrl(input) {
+  const baseUrl = getBaseGhostTunnelUrl(input);
+  const host = assertExactRelayHost(baseUrl.host);
+  const token = signGhostTunnelIpTransportClaim({
+    kind: "ip",
+    host,
+    address: input.address,
+    protocol: input.targetProtocol ?? "http",
+    expiresAt: resolveExpiresAt(input)
+  }, input.signingSecret, {
+    ...typeof input.allowPrivateNetworkAddress === "boolean" ? { allowPrivateNetworkAddress: input.allowPrivateNetworkAddress } : {}
+  }).token;
+  const queryParam = input.queryParam ?? DEFAULT_GHOST_TUNNEL_TRANSPORT_QUERY_PARAM;
+  baseUrl.searchParams.set(queryParam, token);
+  return baseUrl.toString();
+}
+function resolveGhostTunnelIpRedirect(input) {
+  const transport = resolveTransportConfig(input.transport);
+  if (transport.kind !== "ip") {
+    throw new Error(`Ghost tunnel transport is not configured for IP redirect: ${transport.kind}`);
+  }
+  const queryParam = input.queryParam ?? DEFAULT_GHOST_TUNNEL_TRANSPORT_QUERY_PARAM;
+  const requestUrl = new URL(input.requestUrl);
+  const token = requestUrl.searchParams.get(queryParam);
+  if (!token) {
+    throw new Error(`Ghost tunnel IP transport token is missing. Add ${queryParam}=... to the URL.`);
+  }
+  const claim = verifyGhostTunnelIpTransportClaim(token, input.signingSecret, {
+    host: input.host,
+    allowPrivateNetworkAddress: transport.allowPrivateNetworkAddress,
+    ...input.now ? { now: input.now } : {}
+  });
+  requestUrl.searchParams.delete(queryParam);
+  const target = assertRelayLocalTarget({
+    protocol: claim.protocol,
+    host: claim.address,
+    port: input.entryPort
+  }, {
+    allowedHosts: [claim.address],
+    allowPrivateNetworkTargets: transport.allowPrivateNetworkAddress
+  });
+  const redirectUrl = new URL(`${target.protocol}://${target.host}:${target.port}/`);
+  redirectUrl.pathname = requestUrl.pathname;
+  redirectUrl.search = requestUrl.searchParams.toString();
+  redirectUrl.hash = requestUrl.hash;
+  return {
+    claim,
+    queryParam,
+    target,
+    url: redirectUrl.toString()
+  };
 }
-function assertLocalDevelopment(command, env = process.env) {
-  const reason = getProductionReason(env);
-  if (!reason) return;
-  throw new Error(`Localghost only runs in local development. Refusing \`${command}\` because ${reason}.`);
+
+// src/caddy.ts
+import { dirname as dirname3, join as join3 } from "path";
+import { execa } from "execa";
+
+// src/fs.ts
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname2 } from "path";
+function readTextFile(path) {
+  return readFileSync3(path, "utf8");
 }
-function getProductionEnvKeys() {
-  return PRODUCTION_ENV_KEYS;
+function writeTextFile(path, value) {
+  mkdirSync2(dirname2(path), { recursive: true });
+  writeFileSync2(path, value, "utf8");
+  return path;
 }
 
-// src/hosts-file.ts
-import { writeFileSync as writeFileSync3 } from "fs";
-import { tmpdir } from "os";
-import { join as join5 } from "path";
-import { execa as execa3 } from "execa";
-function escapeRegExp(value) {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+// src/caddy.ts
+function shouldShowCaddyLogs() {
+  return ["1", "true", "yes", "on"].includes((process.env.LOCALGHOST_CADDY_VERBOSE ?? "").toLowerCase());
 }
-function getManagedBlockPattern(projectName) {
-  const sanitizedProjectName = sanitizeProjectName(projectName);
-  const start = `# localghost:start ${sanitizedProjectName}`;
-  const end = `# localghost:end ${sanitizedProjectName}`;
-  return new RegExp(`${escapeRegExp(start)}[\\s\\S]*?${escapeRegExp(end)}\\n?`, "m");
+function caddyStdio() {
+  return shouldShowCaddyLogs() ? "inherit" : "pipe";
 }
-function getSystemHostsPath() {
-  return process.platform === "win32" ? "C:\\Windows\\System32\\drivers\\etc\\hosts" : "/etc/hosts";
+function groupByPort(entries) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const entry of entries) {
+    const group = groups.get(entry.port) ?? [];
+    group.push(entry);
+    groups.set(entry.port, group);
+  }
+  return groups;
 }
-function renderHostsBlock(projectName, entries) {
-  const sanitizedProjectName = sanitizeProjectName(projectName);
-  const hosts = [...new Set(entries.map((entry) => entry.host))].sort();
-  return [
-    `# localghost:start ${sanitizedProjectName}`,
-    ...hosts.map((host) => `127.0.0.1 ${host}`),
-    `# localghost:end ${sanitizedProjectName}`,
-    ""
-  ].join("\n");
+function getCaddyfilePath(cwd = process.cwd()) {
+  return join3(cwd, "ops/local/Caddyfile");
+}
+function renderCaddyfile(entries, options = {}) {
+  const groups = groupByPort(entries);
+  const https = options.https === true;
+  const blocks = [...groups.entries()].sort(([leftPort], [rightPort]) => leftPort - rightPort).map(([port, group]) => {
+    const hosts = group.map((entry) => https ? entry.host : `http://${entry.host}`).sort().join(", ");
+    return `${hosts} {
+	reverse_proxy 127.0.0.1:${port}
+}`;
+  });
+  const globalOptions = https ? `{
+  local_certs
 }
-function upsertManagedBlock(existing, projectName, block) {
-  const pattern = getManagedBlockPattern(projectName);
-  if (pattern.test(existing)) {
-    return existing.replace(pattern, block);
-  }
-  return `${existing.trimEnd()}
 
-${block}`;
+` : "";
+  return `${globalOptions}${blocks.join("\n\n")}
+`;
 }
-function removeManagedBlock(existing, projectName) {
-  const pattern = getManagedBlockPattern(projectName);
-  if (!pattern.test(existing)) {
-    return existing;
-  }
-  return existing.replace(pattern, "").replace(/\n{3,}/g, "\n\n").trimEnd() + "\n";
+async function writeCaddyfile(entries, cwd = process.cwd(), options = {}) {
+  const path = getCaddyfilePath(cwd);
+  writeTextFile(path, renderCaddyfile(entries, options));
+  return path;
 }
-async function writeSystemHostsFile(hostsPath, next, projectName) {
-  const sanitizedProjectName = sanitizeProjectName(projectName);
-  const tempPath = join5(tmpdir(), `localghost-${sanitizedProjectName}-hosts`);
-  writeFileSync3(tempPath, next, "utf8");
-  if (process.platform === "win32") {
-    throw new Error(`Windows support: run as administrator and copy ${tempPath} to ${hostsPath}.`);
-  }
-  await execa3("sudo", ["cp", tempPath, hostsPath], { stdio: "inherit" });
-  return tempPath;
+async function validateCaddyfile(path) {
+  await execa("caddy", ["validate", "--config", path], {
+    cwd: dirname3(path),
+    stdio: caddyStdio()
+  });
 }
-async function updateSystemHosts(projectName, entries) {
-  const sanitizedProjectName = sanitizeProjectName(projectName);
-  const hostsPath = getSystemHostsPath();
-  const existing = readTextFile(hostsPath);
-  const block = renderHostsBlock(sanitizedProjectName, entries);
-  const next = upsertManagedBlock(existing, sanitizedProjectName, block);
-  if (next === existing) {
-    return { changed: false, hostsPath };
-  }
-  const tempPath = await writeSystemHostsFile(hostsPath, next, sanitizedProjectName);
-  return { changed: true, hostsPath, tempPath };
+async function runCaddy(path) {
+  await execa("caddy", ["run", "--config", path], {
+    cwd: dirname3(path),
+    stdio: caddyStdio()
+  });
+}
+function startCaddy(path) {
+  return execa("caddy", ["run", "--config", path], {
+    cwd: dirname3(path),
+    stdio: caddyStdio()
+  });
+}
+async function trustCaddy(path) {
+  await execa("caddy", ["trust", "--config", path], {
+    cwd: dirname3(path),
+    stdio: "inherit"
+  });
+}
+
+// src/context.ts
+import { existsSync as existsSync3, readFileSync as readFileSync4 } from "fs";
+import { join as join4 } from "path";
+import { pathToFileURL } from "url";
+
+// src/port.ts
+import { createServer } from "net";
+async function isPortAvailable(port, host = "127.0.0.1") {
+  return new Promise((resolve3) => {
+    const server = createServer();
+    server.once("error", () => {
+      resolve3(false);
+    });
+    server.once("listening", () => {
+      server.close(() => resolve3(true));
+    });
+    server.listen(port, host);
+  });
 }
-async function removeSystemHosts(projectName) {
-  const sanitizedProjectName = sanitizeProjectName(projectName);
-  const hostsPath = getSystemHostsPath();
-  const existing = readTextFile(hostsPath);
-  const next = removeManagedBlock(existing, sanitizedProjectName);
-  if (next === existing) {
-    return { changed: false, removed: false, hostsPath };
+async function findAvailablePort(startPort, options = {}) {
+  const host = options.host ?? "127.0.0.1";
+  const maxAttempts = options.maxAttempts ?? 50;
+  for (let offset = 0; offset < maxAttempts; offset += 1) {
+    const port = startPort + offset;
+    if (await isPortAvailable(port, host)) {
+      return port;
+    }
   }
-  const tempPath = await writeSystemHostsFile(hostsPath, next, sanitizedProjectName);
-  return { changed: true, removed: true, hostsPath, tempPath };
+  throw new Error(`No available port found from ${startPort} to ${startPort + maxAttempts - 1}.`);
 }
 
-// src/init.ts
-import { existsSync as existsSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
-import { join as join6 } from "path";
-function detectPackageManager(cwd = process.cwd()) {
-  if (existsSync4(join6(cwd, "pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync4(join6(cwd, "yarn.lock"))) return "yarn";
-  return "npm";
+// src/context.ts
+var LOCALGHOST_PROJECT_CONFIG_FILES = [
+  "localghost.config.mjs",
+  "localghost.config.js",
+  "localghost.config.cjs"
+];
+function parsePort(value) {
+  if (!value) return void 0;
+  const port = Number.parseInt(value, 10);
+  return Number.isInteger(port) && port > 0 && port <= 65535 ? port : void 0;
 }
-function packageRunCommand(packageManager, script) {
-  if (packageManager === "yarn") return `yarn ${script}`;
-  if (packageManager === "pnpm") return `pnpm ${script}`;
-  return `npm run ${script}`;
+function envPort() {
+  return parsePort(process.env.LOCALGHOST_PORT) ?? parsePort(process.env.VITE_PORT);
 }
-function packageAddCommand(packageManager, packageName = "@hamedb89/localghost") {
-  if (packageManager === "yarn") return `yarn add -D ${packageName}`;
-  if (packageManager === "pnpm") return `pnpm add -D ${packageName}`;
-  return `npm install -D ${packageName}`;
+function envDynamicPort() {
+  const value = process.env.LOCALGHOST_DYNAMIC_PORT;
+  if (!value) return void 0;
+  return ["1", "true", "yes", "on"].includes(value.toLowerCase());
 }
-function renderConfig(options) {
-  return [
-    "# Buh. Friendly names for local services.",
-    "# Format: <host> <port>",
-    `${options.host} ${options.port}`,
-    `www.${options.host} ${options.port}`,
-    `${options.apiHost} ${options.apiPort}`,
-    ""
-  ].join("\n");
+function envHttps() {
+  const value = process.env.LOCALGHOST_HTTPS;
+  if (!value) return void 0;
+  return ["1", "true", "yes", "on"].includes(value.toLowerCase());
 }
-function readPackageJson(path) {
+function getPackageName(cwd) {
   try {
-    return JSON.parse(readFileSync5(path, "utf8"));
+    const pkg = JSON.parse(readFileSync4(join4(cwd, "package.json"), "utf8"));
+    return typeof pkg.name === "string" ? pkg.name : void 0;
   } catch {
-    return null;
+    return void 0;
   }
 }
-function shellQuote(value) {
-  if (/^[A-Za-z0-9_./:-]+$/.test(value)) return value;
-  return `'${value.replace(/'/g, `'"'"'`)}'`;
+function getPackageOwner(cwd) {
+  const packageName = getPackageName(cwd);
+  if (!packageName?.startsWith("@")) return void 0;
+  return packageName.slice(1).split("/")[0];
 }
-function getConfigFlag(configFile) {
-  return configFile === LOCALGHOST_CONFIG_FILE ? "" : ` --config ${shellQuote(configFile)}`;
+function getLocalOwner(cwd) {
+  return sanitizeProjectName(process.env.LOCALGHOST_OWNER ?? getPackageOwner(cwd) ?? process.env.USER ?? process.env.USERNAME ?? "local");
 }
-function updatePackageScripts(packageJsonPath, configFile) {
-  const pkg = readPackageJson(packageJsonPath);
-  if (!pkg) return false;
-  const scripts = typeof pkg.scripts === "object" && pkg.scripts ? pkg.scripts : {};
-  const configFlag = getConfigFlag(configFile);
-  const nextScripts = {
-    ...scripts,
-    "localghost:setup": scripts["localghost:setup"] ?? `localghost setup${configFlag}`,
-    "localghost:proxy": scripts["localghost:proxy"] ?? `localghost dev${configFlag}`,
-    "localghost:proxy:https": scripts["localghost:proxy:https"] ?? `localghost dev${configFlag} --https`,
-    "localghost:run": scripts["localghost:run"] ?? `localghost run${configFlag} --`,
-    "localghost:ready": scripts["localghost:ready"] ?? `localghost status${configFlag} --ready`,
-    "localghost:trust": scripts["localghost:trust"] ?? `localghost trust${configFlag}`,
-    "localghost:ps": scripts["localghost:ps"] ?? "localghost ps",
-    "localghost:print": scripts["localghost:print"] ?? `localghost print${configFlag}`,
-    "localghost:routes": scripts["localghost:routes"] ?? `localghost routes${configFlag}`,
-    "localghost:status": scripts["localghost:status"] ?? "localghost status",
-    "localghost:reset": scripts["localghost:reset"] ?? "localghost reset",
-    "localghost:teardown": scripts["localghost:teardown"] ?? "localghost teardown",
-    "localghost:doctor": scripts["localghost:doctor"] ?? "localghost doctor",
-    "localghost:update": scripts["localghost:update"] ?? "localghost update",
-    "caddy:setup": scripts["caddy:setup"] ?? `localghost setup${configFlag}`,
-    "caddy:dev": scripts["caddy:dev"] ?? `localghost dev${configFlag}`
-  };
-  const changed = JSON.stringify(scripts) !== JSON.stringify(nextScripts);
-  if (!changed) return false;
-  pkg.scripts = nextScripts;
-  writeFileSync4(packageJsonPath, `${JSON.stringify(pkg, null, 2)}
-`, "utf8");
-  return true;
+function getRouteName(primaryHost, fallback) {
+  return sanitizeProjectName(primaryHost.split(".")[0] ?? fallback);
 }
-function initLocalghost(options = {}) {
-  const cwd = options.cwd ?? process.cwd();
-  const projectName = sanitizeProjectName(getProjectName(cwd).split("/").pop() ?? "app");
-  const host = options.host ?? `${projectName}.localhost`;
-  const port = options.port ?? 5173;
-  const apiHost = options.apiHost ?? `api.${host}`;
-  const apiPort = options.apiPort ?? 8787;
-  const packageManager = options.packageManager ?? detectPackageManager(cwd);
-  const configFile = options.configFile ?? LOCALGHOST_CONFIG_FILE;
-  const configPath = join6(cwd, configFile);
-  const configExists = existsSync4(configPath);
-  if (configExists && !options.force) {
-    return {
-      configPath,
-      configCreated: false,
-      packageJsonChanged: false,
-      packageManager,
-      nextSteps: [
-        packageRunCommand(packageManager, "localghost:doctor"),
-        packageRunCommand(packageManager, "localghost:setup"),
-        packageRunCommand(packageManager, "localghost:ready"),
-        packageRunCommand(packageManager, "localghost:proxy")
-      ]
-    };
-  }
-  writeTextFile(configPath, renderConfig({ host, port, apiHost, apiPort }));
-  const packageJsonPath = join6(cwd, "package.json");
-  const packageJsonChanged = options.writeScripts ? updatePackageScripts(packageJsonPath, configFile) : false;
+function readOptionsFromContext(options) {
   return {
-    configPath,
-    configCreated: true,
-    ...existsSync4(packageJsonPath) ? { packageJsonPath } : {},
-    packageJsonChanged,
-    packageManager,
-    nextSteps: [
-      packageRunCommand(packageManager, "localghost:doctor"),
-      packageRunCommand(packageManager, "localghost:setup"),
-      packageRunCommand(packageManager, "localghost:ready"),
-      packageRunCommand(packageManager, "localghost:proxy")
-    ]
+    cwd: options.cwd ?? process.cwd(),
+    ...options.fileName ? { fileName: options.fileName } : {},
+    ...options.configFiles ? { configFiles: options.configFiles } : {},
+    ...options.configPattern ? { configPattern: options.configPattern } : {}
   };
 }
-
-// src/relay.ts
-import { createHmac, timingSafeEqual } from "crypto";
-import { domainToASCII as domainToASCII2 } from "url";
-var DEFAULT_RELAY_ALLOWED_TARGET_HOSTS = ["localhost", "127.0.0.1", "::1"];
-var DEFAULT_RELAY_BLOCKED_PORTS = [22, 2375, 2376, 5432, 6379, 9200, 9229, 27017];
-var DEFAULT_RELAY_LIMITS = {
-  requestBodyBytes: 5 * 1024 * 1024,
-  responseBytes: 25 * 1024 * 1024,
-  timeoutMs: 3e4,
-  maxConcurrentRequests: 20,
-  perRouteRequestsPerMinute: 120,
-  perIpRequestsPerMinute: 60
-};
-var DEFAULT_RELAY_TARGET_POLICY = {
-  allowedHosts: [...DEFAULT_RELAY_ALLOWED_TARGET_HOSTS],
-  blockedPorts: [...DEFAULT_RELAY_BLOCKED_PORTS],
-  allowPrivateNetworkTargets: false
-};
-var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
-  "connection",
-  "keep-alive",
-  "proxy-authenticate",
-  "proxy-authorization",
-  "te",
-  "trailer",
-  "transfer-encoding",
-  "upgrade"
-]);
-var SENSITIVE_HEADERS = /* @__PURE__ */ new Set(["authorization", "cookie", "set-cookie"]);
-var TOKEN_QUERY_PATTERN = /(token|secret|key|password|session|jwt|auth)/i;
-var HOST_PATTERN2 = /^(?=.{1,253}$)(?!-)[a-z0-9-]+(\.[a-z0-9-]+)*$/i;
-var IPV4_PATTERN = /^\d{1,3}(?:\.\d{1,3}){3}$/;
-function base64UrlEncode(value) {
-  return Buffer.from(value).toString("base64url");
+function withRuntimePort(entries, requestedPort, port) {
+  if (requestedPort === port) return entries;
+  const hasRequestedPort = entries.some((entry) => entry.port === requestedPort);
+  if (!hasRequestedPort) return entries;
+  return entries.map((entry) => entry.port === requestedPort ? { ...entry, port, target: `127.0.0.1:${port}` } : entry);
 }
-function base64UrlDecode(value) {
-  return Buffer.from(value, "base64url").toString("utf8");
+function uniqueHosts(entries) {
+  return [...new Set(entries.map((entry) => entry.host))];
 }
-function signPayload(payload, secret) {
-  return createHmac("sha256", secret).update(payload).digest("base64url");
+function isAliasableHost(host) {
+  return host.includes(".") && !host.startsWith("www.") && !host.includes(":");
 }
-function secureEqual(left, right) {
-  const leftBuffer = Buffer.from(left);
-  const rightBuffer = Buffer.from(right);
-  return leftBuffer.length === rightBuffer.length && timingSafeEqual(leftBuffer, rightBuffer);
+function getDefaultWwwAlias(host) {
+  return isAliasableHost(host) ? `www.${host}` : null;
 }
-function normalizeHost(host) {
-  const trimmed = host.trim().toLowerCase().replace(/\.$/, "");
-  if (!trimmed || trimmed.includes("*") || trimmed.includes("/") || trimmed.includes(":")) return null;
-  const ascii = domainToASCII2(trimmed);
-  if (!ascii || ascii.includes("..")) return null;
-  return HOST_PATTERN2.test(ascii) ? ascii : null;
+function addDefaultWwwAliases(entries) {
+  const seen = new Set(entries.map((entry) => entry.host));
+  const aliases = [];
+  for (const entry of entries) {
+    const alias = getDefaultWwwAlias(entry.host);
+    if (alias && !seen.has(alias)) {
+      aliases.push({ host: alias, port: entry.port, target: `127.0.0.1:${entry.port}` });
+      seen.add(alias);
+    }
+  }
+  return [...entries, ...aliases];
 }
-function normalizeTargetHost(host) {
-  const trimmed = host.trim().toLowerCase();
-  if (trimmed === "::1" || trimmed === "[::1]") return "::1";
-  if (trimmed.includes("/") || trimmed.includes("*")) return null;
-  if (IPV4_PATTERN.test(trimmed)) return isValidIpv4(trimmed) ? trimmed : null;
-  return normalizeHost(trimmed);
+function defined(input) {
+  return Object.fromEntries(Object.entries(input).filter(([, value]) => typeof value !== "undefined"));
 }
-function isValidIpv4(value) {
-  return value.split(".").every((part) => {
-    const octet = Number(part);
-    return Number.isInteger(octet) && octet >= 0 && octet <= 255 && String(octet) === part;
+async function readLocalghostProjectConfig(options = {}) {
+  const cwd = options.cwd ?? process.cwd();
+  if (options.configFile === false) return { config: {} };
+  const candidates = options.configFile ? [options.configFile] : LOCALGHOST_PROJECT_CONFIG_FILES;
+  const path = candidates.map((candidate) => resolveDevHostsPath({ cwd, fileName: candidate }).path).find((candidate) => existsSync3(candidate));
+  if (!path) return { config: {} };
+  const imported = await import(`${pathToFileURL(path).href}?localghost=${Date.now()}`);
+  const config = imported.default ?? imported;
+  return { config, path };
+}
+function defineLocalghostConfig(config) {
+  return config;
+}
+async function resolveLocalghostContext(options = {}) {
+  const cwd = options.cwd ?? process.cwd();
+  const projectConfig = await readLocalghostProjectConfig({
+    cwd,
+    ...typeof options.localghostConfig !== "undefined" ? { configFile: options.localghostConfig } : {}
+  });
+  const merged = {
+    ...projectConfig.config,
+    ...defined(options)
+  };
+  const readOptions = readOptionsFromContext({ ...merged, cwd });
+  const resolvedPath = resolveDevHostsPath(readOptions);
+  const configEntries = readDevHosts(readOptions);
+  const requestedPort = merged.port ?? envPort() ?? configEntries[0]?.port ?? 5173;
+  const dynamicPort = merged.dynamicPort ?? envDynamicPort() ?? true;
+  const autoRepair = merged.autoRepair ?? true;
+  const bindHost = merged.bindHost ?? "127.0.0.1";
+  const probeHost = typeof bindHost === "string" ? bindHost : "127.0.0.1";
+  const port = dynamicPort ? await findAvailablePort(requestedPort, { host: probeHost }) : requestedPort;
+  const wwwAlias = merged.wwwAlias ?? true;
+  const entries = wwwAlias ? addDefaultWwwAliases(withRuntimePort(configEntries, requestedPort, port)) : withRuntimePort(configEntries, requestedPort, port);
+  const hosts = uniqueHosts(entries);
+  const primaryHost = merged.primaryHost ?? entries.find((entry) => entry.port === port)?.host ?? hosts[0] ?? `${sanitizeProjectName(getProjectName(cwd))}.localhost`;
+  const projectName = sanitizeProjectName(merged.project ?? getProjectName(cwd));
+  const ghostTunnel = resolveGhostTunnelConfig(merged.ghostTunnel, {
+    route: getRouteName(primaryHost, projectName),
+    project: projectName,
+    owner: getLocalOwner(cwd)
   });
+  return {
+    cwd,
+    projectName,
+    readOptions,
+    configPath: resolvedPath.path,
+    configFileName: resolvedPath.fileName,
+    configEntries,
+    entries,
+    hosts,
+    requestedPort,
+    port,
+    dynamicPort,
+    autoRepair,
+    bindHost,
+    primaryHost,
+    https: merged.https ?? envHttps() ?? false,
+    wwwAlias,
+    ghostTunnel,
+    ...projectConfig.path ? { projectConfigPath: projectConfig.path } : {}
+  };
 }
-function isPrivateIpv4(value) {
-  if (!isValidIpv4(value)) return false;
-  const [first = 0, second = 0] = value.split(".").map((part) => Number(part));
-  return first === 10 || first === 127 || first === 172 && second >= 16 && second <= 31 || first === 192 && second === 168 || first === 169 && second === 254;
-}
-function isLocalTargetHost(host) {
-  return host === "localhost" || host === "127.0.0.1" || host === "::1";
-}
-function mergeTargetPolicy(policy) {
+
+// src/ghost-request.ts
+function getGhostTunnelReadOptions(input) {
   return {
-    allowedHosts: policy?.allowedHosts ?? DEFAULT_RELAY_TARGET_POLICY.allowedHosts,
-    blockedPorts: policy?.blockedPorts ?? DEFAULT_RELAY_TARGET_POLICY.blockedPorts,
-    allowPrivateNetworkTargets: policy?.allowPrivateNetworkTargets ?? DEFAULT_RELAY_TARGET_POLICY.allowPrivateNetworkTargets
+    ...input.cwd ? { cwd: input.cwd } : {},
+    ...input.ghostTunnelFile ? { fileName: input.ghostTunnelFile } : {}
   };
 }
-function mergeLimits(limits) {
-  const merged = {
-    ...DEFAULT_RELAY_LIMITS,
-    ...limits ?? {}
+async function resolveGhostTunnelRequest(input) {
+  const projectConfig = await readLocalghostProjectConfig({
+    ...input.cwd ? { cwd: input.cwd } : {},
+    ...typeof input.localghostConfig !== "undefined" ? { configFile: input.localghostConfig } : {}
+  });
+  const ghostTunnel = resolveGhostTunnelConfig(projectConfig.config.ghostTunnel, {
+    domain: input.domain
+  });
+  const route = assertSecureGhostTunnelRequest({
+    host: input.host,
+    domain: input.domain,
+    protocol: input.protocol,
+    ghostTunnel,
+    ...typeof input.authenticated === "boolean" ? { authenticated: input.authenticated } : {}
+  });
+  const ghostTunnelPath = resolveGhostTunnelPath(getGhostTunnelReadOptions(input));
+  const entry = findGhostTunnelEntry(route.host, getGhostTunnelReadOptions(input));
+  const target = entry ? assertRelayLocalTarget({ host: "127.0.0.1", port: entry.port }) : void 0;
+  return {
+    route,
+    ghostTunnel,
+    ...entry ? { entry } : {},
+    ...target ? { target } : {},
+    ...projectConfig.path ? { projectConfigPath: projectConfig.path } : {},
+    ...ghostTunnelPath.exists ? { ghostTunnelPath: ghostTunnelPath.path } : {}
   };
-  for (const [key, value] of Object.entries(merged)) {
-    if (!Number.isInteger(value) || value < 1) {
-      throw new Error(`Invalid relay limit ${key}: ${value}`);
-    }
-  }
-  return merged;
 }
-function assertExactRelayHost(host) {
-  const normalized = normalizeHost(host);
-  if (!normalized) {
-    throw new Error(`Relay route claims must use an exact hostname: ${host}`);
-  }
-  return normalized;
+function renderGhostTunnelRouteMissingResponse(resolved) {
+  return {
+    status: 404,
+    headers: {
+      "content-type": "text/html; charset=utf-8",
+      "cache-control": "no-store",
+      "x-localghost-relay": "missing",
+      "x-localghost-route": resolved.route.slug
+    },
+    body: [
+      "<!doctype html>",
+      "<html>",
+      '<head><meta charset="utf-8"><title>Ghost Tunnel route not configured</title></head>',
+      "<body>",
+      "<h1>Ghost Tunnel route not configured</h1>",
+      `<p>The wildcard host <code>${resolved.route.host}</code> reached the deployed Ghost Tunnel handler, but no exact <code>.ghosttunnel</code> entry matched it.</p>`,
+      "</body>",
+      "</html>"
+    ].join("")
+  };
 }
-function assertRelayLocalTarget(target, policyInput) {
-  if (!target || typeof target !== "object") {
-    throw new Error("Relay target must be an explicit local target object.");
-  }
-  const policy = mergeTargetPolicy(policyInput);
-  const host = normalizeTargetHost(target.host);
-  if (!host) {
-    throw new Error(`Invalid relay target host: ${target.host}`);
-  }
-  if (!Number.isInteger(target.port) || target.port < 1 || target.port > 65535) {
-    throw new Error(`Invalid relay target port: ${target.port}`);
-  }
-  const protocol = target.protocol ?? "http";
-  if (protocol !== "http" && protocol !== "https") {
-    throw new Error(`Invalid relay target protocol: ${String(protocol)}`);
-  }
-  if (policy.blockedPorts.includes(target.port)) {
-    throw new Error(`Relay target port is blocked: ${target.port}`);
-  }
-  const allowedHosts = new Set(policy.allowedHosts.map((allowedHost) => normalizeTargetHost(allowedHost)).filter((value) => Boolean(value)));
-  if (!allowedHosts.has(host)) {
-    throw new Error(`Relay target host is not explicitly allowed: ${host}`);
-  }
-  if (!policy.allowPrivateNetworkTargets && !isLocalTargetHost(host) && (host === "::1" || isPrivateIpv4(host))) {
-    throw new Error(`Private-network relay target requires explicit opt-in: ${host}`);
-  }
+function renderGhostTunnelRelayOfflineResponse(resolved) {
+  const response = renderRelayOfflineResponse();
   return {
-    protocol,
-    host,
-    port: target.port
+    ...response,
+    headers: {
+      ...response.headers,
+      "x-localghost-relay": "offline",
+      "x-localghost-route": resolved.route.slug,
+      "x-localghost-entry": resolved.entry ? "configured" : "missing"
+    },
+    body: [
+      "<!doctype html>",
+      "<html>",
+      '<head><meta charset="utf-8"><title>Ghost Tunnel offline</title></head>',
+      "<body>",
+      "<h1>Ghost Tunnel offline</h1>",
+      `<p>The wildcard host <code>${resolved.route.host}</code> reached the deployed Ghost Tunnel handler.</p>`,
+      resolved.entry ? "<p>The route is configured locally, but no active local relay connection is available yet.</p>" : "<p>No exact <code>.ghosttunnel</code> entry matched this host.</p>",
+      "</body>",
+      "</html>"
+    ].join("")
   };
 }
-function authenticateRelayAgentToken(input) {
-  const expected = `Bearer ${input.agentToken}`;
-  return typeof input.authorizationHeader === "string" && secureEqual(input.authorizationHeader, expected);
+
+// src/doctor.ts
+import { execa as execa2 } from "execa";
+async function checkCaddy() {
+  try {
+    const result = await execa2("caddy", ["version"], { reject: false });
+    const version = [result.stdout, result.stderr].filter(Boolean).join("\n").trim();
+    return {
+      found: result.exitCode === 0,
+      ...version ? { version } : {},
+      installHint: "brew install caddy"
+    };
+  } catch {
+    return {
+      found: false,
+      installHint: "brew install caddy"
+    };
+  }
 }
-function signRelayRouteClaim(claim, signingSecret) {
-  const payload = {
-    ...claim,
-    host: assertExactRelayHost(claim.host)
-  };
-  if (!payload.scope) throw new Error("Relay route claim requires a scope.");
-  if (!payload.agentId) throw new Error("Relay route claim requires an agentId.");
-  if (Number.isNaN(Date.parse(payload.expiresAt))) throw new Error("Relay route claim requires a valid expiresAt.");
-  const encodedPayload = base64UrlEncode(JSON.stringify(payload));
-  const signature = signPayload(encodedPayload, signingSecret);
+async function runDoctor() {
+  const caddy = await checkCaddy();
   return {
-    payload,
-    token: `${encodedPayload}.${signature}`
+    ok: caddy.found,
+    caddy
   };
 }
-function verifyRelayRouteClaim(token, signingSecret, options) {
-  const [encodedPayload, signature] = token.split(".");
-  if (!encodedPayload || !signature || token.split(".").length !== 2) {
-    throw new Error("Invalid relay route claim token.");
+
+// src/command.ts
+import { existsSync as existsSync4, readFileSync as readFileSync5 } from "fs";
+import { isAbsolute, join as join5, relative, resolve as resolve2 } from "path";
+function readPackageJson(cwd) {
+  const path = join5(cwd, "package.json");
+  if (!existsSync4(path)) {
+    throw new Error(`No package.json found in ${cwd}. Pass an explicit command with \`localghost run -- <command>\`.`);
   }
-  const expectedSignature = signPayload(encodedPayload, signingSecret);
-  if (!secureEqual(signature, expectedSignature)) {
-    throw new Error("Invalid relay route claim signature.");
+  try {
+    return JSON.parse(readFileSync5(path, "utf8"));
+  } catch {
+    throw new Error(`Could not parse ${path}.`);
   }
-  const parsed = JSON.parse(base64UrlDecode(encodedPayload));
-  const host = assertExactRelayHost(parsed.host);
-  if (parsed.scope !== options.expectedScope) {
-    throw new Error("Relay route claim scope mismatch.");
+}
+function detectDevPackageManager(cwd, packageManager) {
+  if (typeof packageManager === "string") {
+    const name = packageManager.split("@")[0];
+    if (name === "npm" || name === "pnpm" || name === "yarn" || name === "bun") return name;
   }
-  const now = options.now ?? /* @__PURE__ */ new Date();
-  if (Date.parse(parsed.expiresAt) <= now.getTime()) {
-    throw new Error("Relay route claim has expired.");
+  if (existsSync4(join5(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync4(join5(cwd, "yarn.lock"))) return "yarn";
+  if (existsSync4(join5(cwd, "bun.lock")) || existsSync4(join5(cwd, "bun.lockb"))) return "bun";
+  return "npm";
+}
+function scriptCommand(packageManager, script) {
+  if (packageManager === "yarn") return ["yarn", script];
+  return [packageManager, "run", script];
+}
+function invokesLocalghost(script) {
+  return /(^|[\s;&|])(?:npm\s+exec\s+|pnpm\s+exec\s+|bunx\s+|npx\s+)?localghost(?:\s|$)/.test(script);
+}
+function detectDevCommand(options = {}) {
+  const cwd = options.cwd ?? process.cwd();
+  if (options.command) {
+    if (options.command.length === 0 || options.command.some((part) => typeof part !== "string" || part.length === 0)) {
+      throw new Error("localghost.config.mjs command must be a non-empty array of strings.");
+    }
+    if (invokesLocalghost(options.command.join(" "))) {
+      throw new Error("localghost.config.mjs command cannot invoke Localghost recursively.");
+    }
+    return { command: [...options.command], source: "config" };
   }
-  if (!parsed.agentId) {
-    throw new Error("Relay route claim requires an agentId.");
+  const pkg = readPackageJson(cwd);
+  const scripts = typeof pkg.scripts === "object" && pkg.scripts ? pkg.scripts : {};
+  const packageManager = detectDevPackageManager(cwd, pkg.packageManager);
+  for (const script of ["dev:raw", "dev"]) {
+    const value = scripts[script];
+    if (typeof value !== "string" || invokesLocalghost(value)) continue;
+    return {
+      command: scriptCommand(packageManager, script),
+      source: "script",
+      packageManager,
+      script
+    };
   }
-  return { ...parsed, host };
+  throw new Error([
+    `Could not detect a safe development command in ${join5(cwd, "package.json")}.`,
+    "Add a non-recursive dev or dev:raw script, configure command in localghost.config.mjs,",
+    "or pass an explicit command with `localghost run -- <command>`."
+  ].join(" "));
+}
+function formatDetectedDevCommand(detected) {
+  const command = detected.command.map((part) => /^[A-Za-z0-9_./:@=-]+$/.test(part) ? part : JSON.stringify(part)).join(" ");
+  const source = detected.source === "config" ? "localghost.config.mjs" : `package.json#scripts.${detected.script}`;
+  return `${command} (${source})`;
+}
+function assertServicePath(root, serviceCwd, name) {
+  const cwd = resolve2(root, serviceCwd);
+  const relativeCwd = relative(root, cwd);
+  if (isAbsolute(relativeCwd) || relativeCwd === ".." || relativeCwd.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`)) {
+    throw new Error(`Service ${name} cwd must stay inside the project root.`);
+  }
+  return { cwd, relativeCwd: relativeCwd || "." };
+}
+function detectDevServices(options) {
+  const root = options.cwd ?? process.cwd();
+  if (options.services.length === 0) throw new Error("services must contain at least one service.");
+  const names = /* @__PURE__ */ new Set();
+  const hosts = /* @__PURE__ */ new Set();
+  return options.services.map((service, index) => {
+    if (!service || typeof service !== "object") throw new Error(`Service at index ${index} must be an object.`);
+    if (!service.name || names.has(service.name)) throw new Error(`Service name must be unique: ${service.name || `<index ${index}>`}.`);
+    if (!/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(service.name)) throw new Error(`Invalid service name: ${service.name}.`);
+    if (!service.host || hosts.has(service.host)) throw new Error(`Service host must be unique: ${service.host || `<index ${index}>`}.`);
+    if (!Number.isInteger(service.port) || service.port < 1 || service.port > 65535) {
+      throw new Error(`Invalid port for service ${service.name}: ${service.port}.`);
+    }
+    names.add(service.name);
+    hosts.add(service.host);
+    const path = assertServicePath(root, service.cwd, service.name);
+    const detected = detectDevCommand({
+      cwd: path.cwd,
+      ...service.command ? { command: service.command } : {}
+    });
+    return {
+      name: service.name,
+      ...path,
+      host: service.host,
+      requestedPort: service.port,
+      command: detected.command,
+      commandSource: detected.source
+    };
+  });
 }
-function createRelayRouteRegistration(input) {
-  if (!authenticateRelayAgentToken({
-    agentToken: input.agentToken,
-    ...typeof input.authorizationHeader !== "undefined" ? { authorizationHeader: input.authorizationHeader } : {}
-  })) {
-    throw new Error("Relay route registration requires an authenticated local agent.");
+function formatDetectedDevServices(services) {
+  return [
+    `Localghost detected ${services.length} services:`,
+    ...services.map((service) => `${service.name}: ${service.command.map((part) => /^[A-Za-z0-9_./:@=-]+$/.test(part) ? part : JSON.stringify(part)).join(" ")} (${service.relativeCwd}, ${service.host} -> ${service.requestedPort})`)
+  ].join("\n");
+}
+
+// src/env.ts
+var PRODUCTION_ENV_KEYS = ["NODE_ENV", "VERCEL_ENV", "NETLIFY", "CF_PAGES_BRANCH", "LOCALGHOST_ENV"];
+function getProductionReason(env = process.env) {
+  if (env.LOCALGHOST_ENV === "production") return "LOCALGHOST_ENV=production";
+  if (env.NODE_ENV === "production") return "NODE_ENV=production";
+  if (env.VERCEL_ENV === "production") return "VERCEL_ENV=production";
+  if (env.NETLIFY === "true" && env.CONTEXT === "production") return "NETLIFY=true and CONTEXT=production";
+  if (env.CF_PAGES_BRANCH && env.CF_PAGES_BRANCH === env.CF_PAGES_PRODUCTION_BRANCH) {
+    return "CF_PAGES_BRANCH matches CF_PAGES_PRODUCTION_BRANCH";
   }
-  const claim = verifyRelayRouteClaim(input.claimToken, input.signingSecret, {
-    expectedScope: input.expectedScope,
-    ...input.now ? { now: input.now } : {}
-  });
-  const target = assertRelayLocalTarget(input.target, input.targetPolicy);
-  const access = input.publicMode === true ? "public" : input.access ?? "private";
-  const passwordProtected = input.passwordProtected ?? false;
-  const authRequired = input.authRequired ?? false;
-  if (access === "public" && input.publicMode !== true) {
-    throw new Error("Relay public mode must be explicitly enabled.");
+  return null;
+}
+function isProductionLike(env = process.env) {
+  return getProductionReason(env) !== null;
+}
+function assertLocalDevelopment(command, env = process.env) {
+  const reason = getProductionReason(env);
+  if (!reason) return;
+  throw new Error(`Localghost only runs in local development. Refusing \`${command}\` because ${reason}.`);
+}
+function getProductionEnvKeys() {
+  return PRODUCTION_ENV_KEYS;
+}
+
+// src/hosts-file.ts
+import { writeFileSync as writeFileSync3 } from "fs";
+import { tmpdir } from "os";
+import { join as join6 } from "path";
+import { execa as execa3 } from "execa";
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function getManagedBlockPattern(projectName) {
+  const sanitizedProjectName = sanitizeProjectName(projectName);
+  const start = `# localghost:start ${sanitizedProjectName}`;
+  const end = `# localghost:end ${sanitizedProjectName}`;
+  return new RegExp(`${escapeRegExp(start)}[\\s\\S]*?${escapeRegExp(end)}\\n?`, "m");
+}
+function getSystemHostsPath(env = process.env) {
+  if (env.LOCALGHOST_HOSTS_PATH) return env.LOCALGHOST_HOSTS_PATH;
+  return process.platform === "win32" ? "C:\\Windows\\System32\\drivers\\etc\\hosts" : "/etc/hosts";
+}
+function renderHostsBlock(projectName, entries) {
+  const sanitizedProjectName = sanitizeProjectName(projectName);
+  const hosts = [...new Set(entries.map((entry) => entry.host))].sort();
+  return [
+    `# localghost:start ${sanitizedProjectName}`,
+    ...hosts.map((host) => `127.0.0.1 ${host}`),
+    `# localghost:end ${sanitizedProjectName}`,
+    ""
+  ].join("\n");
+}
+function upsertManagedBlock(existing, projectName, block) {
+  const pattern = getManagedBlockPattern(projectName);
+  if (pattern.test(existing)) {
+    return existing.replace(pattern, block);
   }
-  if (access === "private" && !passwordProtected && !authRequired) {
-    throw new Error("Private relay previews require password or auth.");
+  return `${existing.trimEnd()}
+
+${block}`;
+}
+function removeManagedBlock(existing, projectName) {
+  const pattern = getManagedBlockPattern(projectName);
+  if (!pattern.test(existing)) {
+    return existing;
   }
-  return {
-    host: claim.host,
-    scope: claim.scope,
-    agentId: claim.agentId,
-    expiresAt: claim.expiresAt,
-    target,
-    access,
-    passwordProtected,
-    authRequired,
-    limits: mergeLimits(input.limits)
-  };
+  return existing.replace(pattern, "").replace(/\n{3,}/g, "\n\n").trimEnd() + "\n";
 }
-function isRelayRouteActive(route, options) {
-  if (!options.agentConnected) return false;
-  return Date.parse(route.expiresAt) > (options.now ?? /* @__PURE__ */ new Date()).getTime();
+async function writeSystemHostsFile(hostsPath, next, projectName) {
+  const sanitizedProjectName = sanitizeProjectName(projectName);
+  const tempPath = join6(tmpdir(), `localghost-${sanitizedProjectName}-hosts`);
+  writeFileSync3(tempPath, next, "utf8");
+  if (process.env.LOCALGHOST_HOSTS_PATH) {
+    writeFileSync3(hostsPath, next, "utf8");
+    return tempPath;
+  }
+  if (process.platform === "win32") {
+    throw new Error(`Windows support: run as administrator and copy ${tempPath} to ${hostsPath}.`);
+  }
+  await execa3("sudo", ["cp", tempPath, hostsPath], { stdio: "inherit" });
+  return tempPath;
 }
-function stripRelayForwardHeaders(headers) {
-  const stripped = {};
-  for (const [name, value] of Object.entries(headers)) {
-    if (typeof value === "undefined") continue;
-    const lowerName = name.toLowerCase();
-    if (HOP_BY_HOP_HEADERS.has(lowerName)) continue;
-    if (lowerName.startsWith("x-localghost-")) continue;
-    stripped[name] = value;
+async function updateSystemHosts(projectName, entries) {
+  const sanitizedProjectName = sanitizeProjectName(projectName);
+  const hostsPath = getSystemHostsPath();
+  const existing = readTextFile(hostsPath);
+  const block = renderHostsBlock(sanitizedProjectName, entries);
+  const next = upsertManagedBlock(existing, sanitizedProjectName, block);
+  if (next === existing) {
+    return { changed: false, hostsPath };
   }
-  return stripped;
+  const tempPath = await writeSystemHostsFile(hostsPath, next, sanitizedProjectName);
+  return { changed: true, hostsPath, tempPath };
 }
-function redactRelayHeaders(headers) {
-  const redacted = {};
-  for (const [name, value] of Object.entries(headers)) {
-    if (typeof value === "undefined") continue;
-    redacted[name] = SENSITIVE_HEADERS.has(name.toLowerCase()) ? "[redacted]" : value;
+async function removeSystemHosts(projectName) {
+  const sanitizedProjectName = sanitizeProjectName(projectName);
+  const hostsPath = getSystemHostsPath();
+  const existing = readTextFile(hostsPath);
+  const next = removeManagedBlock(existing, sanitizedProjectName);
+  if (next === existing) {
+    return { changed: false, removed: false, hostsPath };
   }
-  return redacted;
+  const tempPath = await writeSystemHostsFile(hostsPath, next, sanitizedProjectName);
+  return { changed: true, removed: true, hostsPath, tempPath };
 }
-function redactRelayLogUrl(input) {
-  const url = new URL(input, "http://localghost.invalid");
-  for (const key of [...url.searchParams.keys()]) {
-    if (TOKEN_QUERY_PATTERN.test(key)) {
-      url.searchParams.set(key, "[redacted]");
-    }
+
+// src/init.ts
+import { existsSync as existsSync5, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "fs";
+import { join as join7 } from "path";
+function detectPackageManager(cwd = process.cwd()) {
+  if (existsSync5(join7(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync5(join7(cwd, "yarn.lock"))) return "yarn";
+  return "npm";
+}
+function packageRunCommand(packageManager, script) {
+  if (packageManager === "yarn") return `yarn ${script}`;
+  if (packageManager === "pnpm") return `pnpm ${script}`;
+  return `npm run ${script}`;
+}
+function packageAddCommand(packageManager, packageName = "@hamedb89/localghost") {
+  if (packageManager === "yarn") return `yarn add -D ${packageName}`;
+  if (packageManager === "pnpm") return `pnpm add -D ${packageName}`;
+  return `npm install -D ${packageName}`;
+}
+function renderConfig(options) {
+  return [
+    "# Buh. Friendly names for local services.",
+    "# Format: <host> <port>",
+    `${options.host} ${options.port}`,
+    `www.${options.host} ${options.port}`,
+    `${options.apiHost} ${options.apiPort}`,
+    ""
+  ].join("\n");
+}
+function readPackageJson2(path) {
+  try {
+    return JSON.parse(readFileSync6(path, "utf8"));
+  } catch {
+    return null;
   }
-  return input.startsWith("http://") || input.startsWith("https://") ? url.toString() : `${url.pathname}${url.search}`;
 }
-function renderRelayOfflineResponse() {
+function shellQuote(value) {
+  if (/^[A-Za-z0-9_./:-]+$/.test(value)) return value;
+  return `'${value.replace(/'/g, `'"'"'`)}'`;
+}
+function getConfigFlag(configFile) {
+  return configFile === LOCALGHOST_CONFIG_FILE ? "" : ` --config ${shellQuote(configFile)}`;
+}
+function updatePackageScripts(packageJsonPath, configFile) {
+  const pkg = readPackageJson2(packageJsonPath);
+  if (!pkg) return false;
+  const scripts = typeof pkg.scripts === "object" && pkg.scripts ? pkg.scripts : {};
+  const configFlag = getConfigFlag(configFile);
+  const nextScripts = {
+    ...scripts,
+    "localghost:setup": scripts["localghost:setup"] ?? `localghost setup${configFlag}`,
+    "localghost:proxy": scripts["localghost:proxy"] ?? `localghost dev${configFlag}`,
+    "localghost:proxy:https": scripts["localghost:proxy:https"] ?? `localghost dev${configFlag} --https`,
+    "localghost:run": scripts["localghost:run"] ?? `localghost run${configFlag} --`,
+    "localghost:ready": scripts["localghost:ready"] ?? `localghost status${configFlag} --ready`,
+    "localghost:repair": scripts["localghost:repair"] ?? `localghost repair${configFlag}`,
+    "localghost:trust": scripts["localghost:trust"] ?? `localghost trust${configFlag}`,
+    "localghost:ps": scripts["localghost:ps"] ?? "localghost ps",
+    "localghost:print": scripts["localghost:print"] ?? `localghost print${configFlag}`,
+    "localghost:routes": scripts["localghost:routes"] ?? `localghost routes${configFlag}`,
+    "localghost:status": scripts["localghost:status"] ?? "localghost status",
+    "localghost:reset": scripts["localghost:reset"] ?? "localghost reset",
+    "localghost:teardown": scripts["localghost:teardown"] ?? "localghost teardown",
+    "localghost:doctor": scripts["localghost:doctor"] ?? "localghost doctor",
+    "localghost:update": scripts["localghost:update"] ?? "localghost update",
+    "caddy:setup": scripts["caddy:setup"] ?? `localghost setup${configFlag}`,
+    "caddy:dev": scripts["caddy:dev"] ?? `localghost dev${configFlag}`
+  };
+  const changed = JSON.stringify(scripts) !== JSON.stringify(nextScripts);
+  if (!changed) return false;
+  pkg.scripts = nextScripts;
+  writeFileSync4(packageJsonPath, `${JSON.stringify(pkg, null, 2)}
+`, "utf8");
+  return true;
+}
+function initLocalghost(options = {}) {
+  const cwd = options.cwd ?? process.cwd();
+  const projectName = sanitizeProjectName(getProjectName(cwd).split("/").pop() ?? "app");
+  const host = options.host ?? `${projectName}.localhost`;
+  const port = options.port ?? 5173;
+  const apiHost = options.apiHost ?? `api.${host}`;
+  const apiPort = options.apiPort ?? 8787;
+  const packageManager = options.packageManager ?? detectPackageManager(cwd);
+  const configFile = options.configFile ?? LOCALGHOST_CONFIG_FILE;
+  const configPath = join7(cwd, configFile);
+  const configExists = existsSync5(configPath);
+  if (configExists && !options.force) {
+    return {
+      configPath,
+      configCreated: false,
+      packageJsonChanged: false,
+      packageManager,
+      nextSteps: [
+        packageRunCommand(packageManager, "localghost:doctor"),
+        packageRunCommand(packageManager, "localghost:setup"),
+        packageRunCommand(packageManager, "localghost:ready"),
+        packageRunCommand(packageManager, "localghost:proxy")
+      ]
+    };
+  }
+  writeTextFile(configPath, renderConfig({ host, port, apiHost, apiPort }));
+  const packageJsonPath = join7(cwd, "package.json");
+  const packageJsonChanged = options.writeScripts ? updatePackageScripts(packageJsonPath, configFile) : false;
   return {
-    status: 503,
-    headers: {
-      "content-type": "text/html; charset=utf-8",
-      "cache-control": "no-store"
-    },
-    body: [
-      "<!doctype html>",
-      "<html>",
-      '<head><meta charset="utf-8"><title>Preview offline</title></head>',
-      "<body><h1>Preview offline</h1><p>The local agent is not connected. Try again later.</p></body>",
-      "</html>"
-    ].join("")
+    configPath,
+    configCreated: true,
+    ...existsSync5(packageJsonPath) ? { packageJsonPath } : {},
+    packageJsonChanged,
+    packageManager,
+    nextSteps: [
+      packageRunCommand(packageManager, "localghost:doctor"),
+      packageRunCommand(packageManager, "localghost:setup"),
+      packageRunCommand(packageManager, "localghost:ready"),
+      packageRunCommand(packageManager, "localghost:proxy")
+    ]
   };
 }
 
@@ -1390,21 +2251,22 @@ function formatGhostTunnel(config, options = {}) {
   if (options.verbose) {
     lines.push(`  domains: ${config.domains.length > 0 ? config.domains.join(", ") : "*"}`);
     lines.push(`  access: ${config.requireAuth ? "auth required" : "app decides"}`);
-    lines.push(`  transport: ${config.requireHttps ? "https required" : "http allowed"}`);
+    lines.push(`  protocol: ${config.requireHttps ? "https required" : "http allowed"}`);
+    lines.push(`  transport: ${config.transport.kind}`);
   }
   return lines.join("\n");
 }
 
 // src/state.ts
-import { existsSync as existsSync5 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync6 } from "fs";
+import { join as join8 } from "path";
 var LOCALGHOST_STATE_FILE = "ops/local/localghost-state.json";
 function getLocalghostStatePath(cwd = process.cwd()) {
-  return join7(cwd, LOCALGHOST_STATE_FILE);
+  return join8(cwd, LOCALGHOST_STATE_FILE);
 }
 function readLocalghostState(cwd = process.cwd()) {
   const path = getLocalghostStatePath(cwd);
-  if (!existsSync5(path)) return null;
+  if (!existsSync6(path)) return null;
   return JSON.parse(readTextFile(path));
 }
 function writeLocalghostState(cwd, state) {
@@ -1419,12 +2281,239 @@ function patchLocalghostState(cwd, patch) {
   return writeLocalghostState(cwd, { ...current, ...patch });
 }
 
+// src/vercel.ts
+function getHeaderValue(value) {
+  if (Array.isArray(value)) return value[0] ?? "";
+  return value ?? "";
+}
+function getTrustedProtocol(request) {
+  const forwarded = getHeaderValue(request.headers["x-forwarded-proto"]).split(",")[0]?.trim().toLowerCase();
+  return forwarded === "http" ? "http" : "https";
+}
+function getTrustedRequestUrl(request, host, protocol) {
+  return new URL(request.url ?? "/", `${protocol}://${host}`).toString();
+}
+function getTunnelRequestPath(request) {
+  const url = new URL(request.url ?? "/", "http://localghost.invalid");
+  return `${url.pathname}${url.search}`;
+}
+function normalizeRequestHeaders(headers) {
+  const stripped = stripRelayForwardHeaders(headers);
+  return Object.fromEntries(Object.entries(stripped).map(([name, value]) => [
+    name,
+    Array.isArray(value) ? value.join(", ") : value
+  ]));
+}
+function getTunnelStore(options, namespace) {
+  return options.tunnelStore ?? createRedisGhostTunnelStoreFromEnv({
+    ...options.tunnelEnv ? { env: options.tunnelEnv } : {},
+    namespace
+  });
+}
+async function readRequestBody(request, maxBytes) {
+  if (!request[Symbol.asyncIterator]) return void 0;
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of request) {
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    size += buffer.byteLength;
+    if (size > maxBytes) {
+      throw new Error(`Ghost Tunnel request exceeded ${maxBytes} bytes.`);
+    }
+    chunks.push(buffer);
+  }
+  return chunks.length > 0 ? Buffer.concat(chunks) : void 0;
+}
+function writeResponse(response, payload) {
+  response.statusCode = payload.status;
+  for (const [name, value] of Object.entries(payload.headers)) {
+    response.setHeader(name, value);
+  }
+  response.end(payload.body);
+}
+function renderGhostTunnelIpRedirectResponse(url) {
+  return {
+    status: 307,
+    headers: {
+      location: url,
+      "cache-control": "no-store",
+      "content-type": "text/html; charset=utf-8",
+      "x-localghost-relay": "ip"
+    },
+    body: [
+      "<!doctype html>",
+      "<html>",
+      '<head><meta charset="utf-8"><title>Redirecting to local preview</title></head>',
+      "<body>",
+      `<p>Redirecting to <a href="${url}">${url}</a>.</p>`,
+      "</body>",
+      "</html>"
+    ].join("")
+  };
+}
+function renderGhostTunnelTransportRejectedResponse(message, status = 400) {
+  return {
+    status,
+    headers: {
+      "content-type": "text/html; charset=utf-8",
+      "cache-control": "no-store",
+      "x-localghost-relay": "rejected"
+    },
+    body: [
+      "<!doctype html>",
+      "<html>",
+      '<head><meta charset="utf-8"><title>Ghost Tunnel transport rejected</title></head>',
+      "<body>",
+      "<h1>Ghost Tunnel transport rejected</h1>",
+      `<p>${message}</p>`,
+      "</body>",
+      "</html>"
+    ].join("")
+  };
+}
+function renderGhostTunnelTunnelTimeoutResponse() {
+  return {
+    status: 504,
+    headers: {
+      "content-type": "text/html; charset=utf-8",
+      "cache-control": "no-store",
+      "x-localghost-relay": "timeout"
+    },
+    body: [
+      "<!doctype html>",
+      "<html>",
+      '<head><meta charset="utf-8"><title>Ghost Tunnel timed out</title></head>',
+      "<body>",
+      "<h1>Ghost Tunnel timed out</h1>",
+      "<p>The deployed handler did not receive a local response before the request window closed.</p>",
+      "</body>",
+      "</html>"
+    ].join("")
+  };
+}
+function renderGhostTunnelQueuedResponse(response) {
+  const body = decodeGhostTunnelBody(response.bodyBase64)?.toString() ?? "";
+  return {
+    status: response.status,
+    headers: {
+      ...response.headers,
+      "x-localghost-relay": response.error ? "target-error" : "tunnel"
+    },
+    body
+  };
+}
+async function waitForTunnelResponse(input) {
+  const startedAt = Date.now();
+  while (Date.now() - startedAt < input.waitMs) {
+    const response = await input.store.readResponse(input.requestId);
+    if (response) {
+      await input.store.cleanup(input.requestId);
+      return response;
+    }
+    await new Promise((resolve3) => setTimeout(resolve3, input.pollIntervalMs));
+  }
+  return null;
+}
+async function resolveAuthenticatedState(input, request) {
+  if (typeof input === "function") {
+    return await input(request);
+  }
+  return input;
+}
+function createVercelGhostTunnelHandler(options) {
+  return async function handler(request, response) {
+    const host = getHeaderValue(request.headers.host);
+    const protocol = getTrustedProtocol(request);
+    try {
+      const authenticated = typeof options.authenticated !== "undefined" ? await resolveAuthenticatedState(options.authenticated, request) : void 0;
+      const resolved = await resolveGhostTunnelRequest({
+        ...options.cwd ? { cwd: options.cwd } : {},
+        ...typeof options.localghostConfig !== "undefined" ? { localghostConfig: options.localghostConfig } : {},
+        ...options.ghostTunnelFile ? { ghostTunnelFile: options.ghostTunnelFile } : {},
+        host,
+        domain: options.domain,
+        protocol,
+        ...typeof authenticated === "boolean" ? { authenticated } : {}
+      });
+      if (!resolved.entry) {
+        writeResponse(response, renderGhostTunnelRouteMissingResponse(resolved));
+        return;
+      }
+      if (resolved.ghostTunnel.transport.kind === "ip") {
+        if (!options.ipSigningSecret) {
+          writeResponse(response, renderGhostTunnelTransportRejectedResponse("Ghost Tunnel IP transport requires ipSigningSecret in the deployed handler.", 500));
+          return;
+        }
+        try {
+          const redirect = resolveGhostTunnelIpRedirect({
+            requestUrl: getTrustedRequestUrl(request, host, protocol),
+            host: resolved.route.host,
+            entryPort: resolved.entry.port,
+            signingSecret: options.ipSigningSecret,
+            transport: resolved.ghostTunnel.transport
+          });
+          writeResponse(response, renderGhostTunnelIpRedirectResponse(redirect.url));
+        } catch (error) {
+          const message = error instanceof Error ? error.message : String(error);
+          const status = /expired/i.test(message) ? 410 : 400;
+          writeResponse(response, renderGhostTunnelTransportRejectedResponse(message, status));
+        }
+        return;
+      }
+      if (resolved.ghostTunnel.transport.kind === "tunnel") {
+        const transport = resolved.ghostTunnel.transport;
+        const store = getTunnelStore(options, transport.store.namespace);
+        const route = await store.getRoute(resolved.route.host);
+        if (!route) {
+          writeResponse(response, renderGhostTunnelRelayOfflineResponse(resolved));
+          return;
+        }
+        try {
+          const requestBody = await readRequestBody(request, transport.maxRequestBodyBytes);
+          const queuedRequest = createGhostTunnelQueuedRequest({
+            host: resolved.route.host,
+            method: request.method ?? "GET",
+            path: getTunnelRequestPath(request),
+            headers: normalizeRequestHeaders(request.headers),
+            ...requestBody ? { body: requestBody } : {},
+            ttlSeconds: transport.requestTtlSeconds
+          });
+          await store.enqueueRequest(queuedRequest, transport.requestTtlSeconds);
+          const tunnelResponse = await waitForTunnelResponse({
+            store,
+            requestId: queuedRequest.id,
+            waitMs: transport.waitMs,
+            pollIntervalMs: transport.pollIntervalMs
+          });
+          writeResponse(response, tunnelResponse ? renderGhostTunnelQueuedResponse(tunnelResponse) : renderGhostTunnelTunnelTimeoutResponse());
+        } catch (error) {
+          const message = error instanceof Error ? error.message : String(error);
+          writeResponse(response, renderGhostTunnelTransportRejectedResponse(message, 400));
+        }
+        return;
+      }
+      writeResponse(response, renderGhostTunnelRelayOfflineResponse(resolved));
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      writeResponse(response, {
+        status: /authenticated/i.test(message) ? 401 : 404,
+        headers: {
+          "content-type": "text/plain; charset=utf-8",
+          "cache-control": "no-store",
+          "x-localghost-relay": "rejected"
+        },
+        body: message
+      });
+    }
+  };
+}
+
 // src/update-check.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "fs";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname4, join as join8 } from "path";
+import { dirname as dirname4, join as join9 } from "path";
 var LOCALGHOST_PACKAGE_NAME = "@hamedb89/localghost";
-var LOCALGHOST_VERSION = "0.1.9";
+var LOCALGHOST_VERSION = "0.1.12";
 var UPDATE_CHECK_CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
 var UPDATE_CHECK_NOTIFY_TTL_MS = 24 * 60 * 60 * 1e3;
 var UPDATE_CHECK_TIMEOUT_MS = 900;
@@ -1436,13 +2525,13 @@ function isUpdateCheckDisabled(env = process.env) {
 }
 function getUpdateCheckCachePath(env = process.env) {
   if (env.LOCALGHOST_UPDATE_CHECK_CACHE) return env.LOCALGHOST_UPDATE_CHECK_CACHE;
-  const cacheRoot = env.XDG_CACHE_HOME || join8(homedir2(), ".cache");
-  return join8(cacheRoot, "localghost", "update-check.json");
+  const cacheRoot = env.XDG_CACHE_HOME || join9(homedir2(), ".cache");
+  return join9(cacheRoot, "localghost", "update-check.json");
 }
 function readCache(path = getUpdateCheckCachePath()) {
-  if (!existsSync6(path)) return null;
+  if (!existsSync7(path)) return null;
   try {
-    return JSON.parse(readFileSync6(path, "utf8"));
+    return JSON.parse(readFileSync7(path, "utf8"));
   } catch {
     return null;
   }
@@ -1586,12 +2675,16 @@ ${message}`);
   markUpdateNotified(result, cachePath);
 }
 export {
+  DEFAULT_GHOST_TUNNEL_IP_TRANSPORT_TTL_SECONDS,
+  DEFAULT_GHOST_TUNNEL_RESPONSE_TTL_SECONDS,
+  DEFAULT_GHOST_TUNNEL_TRANSPORT_QUERY_PARAM,
   DEFAULT_RELAY_ALLOWED_TARGET_HOSTS,
   DEFAULT_RELAY_BLOCKED_PORTS,
   DEFAULT_RELAY_LIMITS,
   DEFAULT_RELAY_TARGET_POLICY,
   LOCALGHOST_ACTIVITY_VERSION,
   LOCALGHOST_CONFIG_FILE,
+  LOCALGHOST_GHOST_TUNNEL_FILE,
   LOCALGHOST_PACKAGE_NAME,
   LOCALGHOST_STATE_FILE,
   LOCALGHOST_VERSION,
@@ -1607,13 +2700,28 @@ export {
   checkForUpdate,
   compareVersions,
   constructGhostTunnelHost,
+  constructGhostTunnelIpUrl,
   constructGhostTunnelURL,
   constructGhostTunnelUrl,
+  createGhostTunnelQueuedRequest,
+  createGhostTunnelRouteHeartbeat,
+  createMemoryGhostTunnelStore,
+  createRedisGhostTunnelStore,
+  createRedisGhostTunnelStoreFromEnv,
   createRelayRouteRegistration,
+  createVercelGhostTunnelHandler,
+  decodeGhostTunnelBody,
   defineLocalghostConfig,
+  detectDevCommand,
+  detectDevPackageManager,
+  detectDevServices,
   detectPackageManager,
+  encodeGhostTunnelBody,
   findAvailablePort,
+  findGhostTunnelEntry,
   findLocalMdnsHosts,
+  formatDetectedDevCommand,
+  formatDetectedDevServices,
   formatDomainRoutes,
   formatGhostTunnel,
   formatUpdateMessage,
@@ -1625,6 +2733,7 @@ export {
   getGhostTunnelDisplayUrl,
   getGhostTunnelDisplayUrls,
   getGhostTunnelEntryHost,
+  getGhostTunnelPath,
   getGhostTunnelPreviewUrl,
   getGhostTunnelWildcardHost,
   getLocalghostActivityPath,
@@ -1641,6 +2750,7 @@ export {
   isProductionLike,
   isRelayRouteActive,
   isUpdateCheckDisabled,
+  listGhostTunnelEntries,
   listLocalghostRuns,
   listLocalghostSetups,
   markUpdateNotified,
@@ -1652,6 +2762,7 @@ export {
   patchLocalghostState,
   pruneLocalghostActivity,
   readDevHosts,
+  readGhostTunnelEntries,
   readLocalghostActivity,
   readLocalghostProjectConfig,
   readLocalghostState,
@@ -1662,17 +2773,28 @@ export {
   removeManagedBlock,
   removeSystemHosts,
   renderCaddyfile,
+  renderCompactLocalghostBanner,
+  renderGhostTunnelRelayOfflineResponse,
+  renderGhostTunnelRouteMissingResponse,
   renderHostsBlock,
+  renderLocalghostBanner,
   renderRelayOfflineResponse,
   resolveDevHostsPath,
   resolveGhostTunnelConfig,
+  resolveGhostTunnelIpRedirect,
+  resolveGhostTunnelPath,
+  resolveGhostTunnelRequest,
   resolveLocalghostContext,
+  resolveRedisGhostTunnelEnv,
   runCaddy,
   runDoctor,
   sanitizeProjectName,
+  serveGhostTunnelLocalRequest,
   shouldNotifyAboutUpdate,
+  signGhostTunnelIpTransportClaim,
   signRelayRouteClaim,
   startCaddy,
+  startGhostTunnelAgent,
   stripRelayForwardHeaders,
   trustCaddy,
   unregisterLocalghostRun,
@@ -1680,6 +2802,7 @@ export {
   updateSystemHosts,
   upsertManagedBlock,
   validateCaddyfile,
+  verifyGhostTunnelIpTransportClaim,
   verifyRelayRouteClaim,
   writeCaddyfile,
   writeLocalghostActivity,