@hamedb89/localghost 0.5.0 → 0.6.2

package/dist/index.js

@@ -352,1236 +352,1580 @@ function formatLocalghostAgentGuide(format = "text") {
   return LOCALGHOST_AGENT_GUIDE;
 }
 
-// src/ghost-file.ts
-var LOCALGHOST_GHOST_TUNNEL_FILE = ".ghosttunnel";
-function toGhostTunnelOptions(options = {}) {
-  const resolved = typeof options === "string" ? { cwd: options } : options;
-  return {
-    ...resolved,
-    fileName: resolved.fileName ?? LOCALGHOST_GHOST_TUNNEL_FILE
-  };
+// packages/ghost-tunnel/src/tunnel.ts
+import { domainToASCII } from "url";
+var DEFAULT_GHOST_TUNNEL_SUBDOMAIN = "ghost";
+var DEFAULT_GHOST_TUNNEL_NAMESPACE_TAGS = ["route", "project", "owner"];
+var DEFAULT_GHOST_TUNNEL_NAMESPACE_SEPARATOR = "-";
+var DEFAULT_GHOST_TUNNEL_MODE = "manual";
+var DEFAULT_GHOST_TUNNEL_ADAPTER_STRATEGY = "same-project";
+var DEFAULT_GHOST_TUNNEL_TRANSPORT_KIND = "none";
+var DEFAULT_GHOST_TUNNEL_TUNNEL_STORE_PROVIDER = "vercel-redis";
+var DEFAULT_GHOST_TUNNEL_TUNNEL_STORE_ENV = "auto";
+var DEFAULT_GHOST_TUNNEL_TUNNEL_STORE_NAMESPACE = "localghost";
+var DEFAULT_GHOST_TUNNEL_TUNNEL_WAIT_MS = 25e3;
+var DEFAULT_GHOST_TUNNEL_TUNNEL_POLL_INTERVAL_MS = 250;
+var DEFAULT_GHOST_TUNNEL_TUNNEL_ROUTE_TTL_SECONDS = 30;
+var DEFAULT_GHOST_TUNNEL_TUNNEL_REQUEST_TTL_SECONDS = 60;
+var DEFAULT_GHOST_TUNNEL_TUNNEL_MAX_REQUEST_BODY_BYTES = 1024 * 1024;
+var DEFAULT_GHOST_TUNNEL_TUNNEL_MAX_RESPONSE_BODY_BYTES = 5 * 1024 * 1024;
+function isResolvedGhostTunnelConfig(value) {
+  return typeof value === "object" && value !== null && "enabled" in value;
 }
-function normalizeHost(value) {
-  return value.trim().toLowerCase().replace(/\.$/, "");
+function toGhostTunnelConfig(options) {
+  return isResolvedGhostTunnelConfig(options) ? options : resolveGhostTunnelConfig(options);
 }
-function resolveGhostTunnelPath(options = {}) {
-  return resolveDevHostsPath(toGhostTunnelOptions(options));
+function stripHostPort(value) {
+  const trimmed = value.trim().toLowerCase();
+  if (trimmed.startsWith("[") || trimmed.includes("/")) return "";
+  const portSeparator = trimmed.lastIndexOf(":");
+  if (portSeparator === -1) return trimmed;
+  const port = trimmed.slice(portSeparator + 1);
+  return /^\d+$/.test(port) ? trimmed.slice(0, portSeparator) : trimmed;
 }
-function getGhostTunnelPath(options = {}) {
-  return resolveGhostTunnelPath(options).path;
+function normalizeDomain(value) {
+  const host = stripHostPort(value.replace(/^\*\./, ""));
+  const ascii = domainToASCII(host);
+  if (!ascii || ascii.length > 253 || ascii.includes("..")) return null;
+  if (ascii.startsWith(".") || ascii.endsWith(".")) return null;
+  if (ascii.includes("*")) return null;
+  if (!ascii.split(".").every(isValidHostLabel)) return null;
+  return ascii;
 }
-function readGhostTunnelEntries(options = {}) {
-  return readDevHosts(toGhostTunnelOptions(options));
+function isValidHostLabel(value) {
+  return value.length > 0 && value.length <= 63 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(value);
 }
-function listGhostTunnelEntries(options = {}) {
-  const resolved = resolveGhostTunnelPath(options);
-  if (!resolved.exists) return [];
-  return readGhostTunnelEntries(options);
+function isValidNamespaceTag(value) {
+  return /^[a-z][a-z0-9_]*$/i.test(value);
 }
-function findGhostTunnelEntry(host, options = {}) {
-  const normalizedHost = normalizeHost(host);
-  return listGhostTunnelEntries(options).find((entry) => entry.host === normalizedHost);
+function isNamespaceTagList(options) {
+  return Array.isArray(options);
 }
-
-// src/ghost-agent.ts
-import { randomUUID as randomUUID2 } from "crypto";
-
-// src/relay.ts
-import { createHmac, timingSafeEqual } from "crypto";
-import { domainToASCII } from "url";
-var DEFAULT_RELAY_ALLOWED_TARGET_HOSTS = ["localhost", "127.0.0.1", "::1"];
-var DEFAULT_RELAY_BLOCKED_PORTS = [22, 2375, 2376, 5432, 6379, 9200, 9229, 27017];
-var DEFAULT_RELAY_LIMITS = {
-  requestBodyBytes: 5 * 1024 * 1024,
-  responseBytes: 25 * 1024 * 1024,
-  timeoutMs: 3e4,
-  maxConcurrentRequests: 20,
-  perRouteRequestsPerMinute: 120,
-  perIpRequestsPerMinute: 60
-};
-var DEFAULT_RELAY_TARGET_POLICY = {
-  allowedHosts: [...DEFAULT_RELAY_ALLOWED_TARGET_HOSTS],
-  blockedPorts: [...DEFAULT_RELAY_BLOCKED_PORTS],
-  allowPrivateNetworkTargets: false
-};
-var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
-  "connection",
-  "keep-alive",
-  "proxy-authenticate",
-  "proxy-authorization",
-  "te",
-  "trailer",
-  "transfer-encoding",
-  "upgrade"
-]);
-var SENSITIVE_HEADERS = /* @__PURE__ */ new Set(["authorization", "cookie", "set-cookie"]);
-var TOKEN_QUERY_PATTERN = /(token|secret|key|password|session|jwt|auth)/i;
-var HOST_PATTERN2 = /^(?=.{1,253}$)(?!-)[a-z0-9-]+(\.[a-z0-9-]+)*$/i;
-var IPV4_PATTERN = /^\d{1,3}(?:\.\d{1,3}){3}$/;
-function base64UrlEncode(value) {
-  return Buffer.from(value).toString("base64url");
+function assertValidSubdomain(value) {
+  if (!isValidHostLabel(value)) {
+    throw new Error(`Invalid ghost tunnel subdomain: ${value}`);
+  }
 }
-function base64UrlDecode(value) {
-  return Buffer.from(value, "base64url").toString("utf8");
+function normalizeDomains(domains) {
+  const values = typeof domains === "string" ? [domains] : [...domains ?? []];
+  const normalized = values.map((value) => value.trim()).filter(Boolean).map((value) => {
+    const domain = normalizeDomain(value);
+    if (!domain) throw new Error(`Invalid ghost tunnel domain: ${value}`);
+    return domain;
+  });
+  return [...new Set(normalized)];
 }
-function signPayload(payload, secret) {
-  return createHmac("sha256", secret).update(payload).digest("base64url");
+function parseGhostTunnelMode(value) {
+  return value ?? DEFAULT_GHOST_TUNNEL_MODE;
 }
-function secureEqual(left, right) {
-  const leftBuffer = Buffer.from(left);
-  const rightBuffer = Buffer.from(right);
-  return leftBuffer.length === rightBuffer.length && timingSafeEqual(leftBuffer, rightBuffer);
+function parseGhostTunnelAdapterStrategy(value) {
+  if (typeof value === "undefined") return DEFAULT_GHOST_TUNNEL_ADAPTER_STRATEGY;
+  if (value === "same-project" || value === "separate-relay") return value;
+  throw new Error(`Unsupported ghost tunnel adapter strategy: ${String(value)}`);
 }
-function normalizeHost2(host) {
-  const trimmed = host.trim().toLowerCase().replace(/\.$/, "");
-  if (!trimmed || trimmed.includes("*") || trimmed.includes("/") || trimmed.includes(":")) return null;
-  const ascii = domainToASCII(trimmed);
-  if (!ascii || ascii.includes("..")) return null;
-  return HOST_PATTERN2.test(ascii) ? ascii : null;
+function parseGhostTunnelTransportKind(value) {
+  if (typeof value === "undefined") return DEFAULT_GHOST_TUNNEL_TRANSPORT_KIND;
+  if (value === "none" || value === "ip" || value === "tunnel") return value;
+  throw new Error(`Unsupported ghost tunnel transport: ${String(value)}`);
 }
-function normalizeTargetHost(host) {
-  const trimmed = host.trim().toLowerCase();
-  if (trimmed === "::1" || trimmed === "[::1]") return "::1";
-  if (trimmed.includes("/") || trimmed.includes("*")) return null;
-  if (IPV4_PATTERN.test(trimmed)) return isValidIpv4(trimmed) ? trimmed : null;
-  return normalizeHost2(trimmed);
+function parsePositiveInteger(value, fallback, name) {
+  if (typeof value === "undefined") return fallback;
+  if (!Number.isInteger(value) || value < 1) {
+    throw new Error(`Invalid ghost tunnel ${name}: ${value}`);
+  }
+  return value;
 }
-function isValidIpv4(value) {
-  return value.split(".").every((part) => {
-    const octet = Number(part);
-    return Number.isInteger(octet) && octet >= 0 && octet <= 255 && String(octet) === part;
-  });
+function parseTunnelStoreProvider(value) {
+  if (typeof value === "undefined") return DEFAULT_GHOST_TUNNEL_TUNNEL_STORE_PROVIDER;
+  if (value === "vercel-redis" || value === "redis") return value;
+  throw new Error(`Unsupported ghost tunnel tunnel store provider: ${String(value)}`);
 }
-function isPrivateIpv4(value) {
-  if (!isValidIpv4(value)) return false;
-  const [first = 0, second = 0] = value.split(".").map((part) => Number(part));
-  return first === 10 || first === 127 || first === 172 && second >= 16 && second <= 31 || first === 192 && second === 168 || first === 169 && second === 254;
+function parseTunnelStoreEnv(value) {
+  if (typeof value === "undefined") return DEFAULT_GHOST_TUNNEL_TUNNEL_STORE_ENV;
+  if (value === "auto") return value;
+  throw new Error(`Unsupported ghost tunnel tunnel store env: ${String(value)}`);
 }
-function isLocalTargetHost(host) {
-  return host === "localhost" || host === "127.0.0.1" || host === "::1";
+function parseTunnelStoreNamespace(value) {
+  const namespace = value ?? DEFAULT_GHOST_TUNNEL_TUNNEL_STORE_NAMESPACE;
+  if (!/^[a-z][a-z0-9:_-]{0,63}$/i.test(namespace)) {
+    throw new Error(`Invalid ghost tunnel tunnel store namespace: ${namespace}`);
+  }
+  return namespace;
 }
-function mergeTargetPolicy(policy) {
+function resolveGhostTunnelAdapter(input) {
+  if (!input) return void 0;
+  const provider = typeof input === "string" ? input : input.provider;
+  if (provider !== "vercel") {
+    throw new Error(`Unsupported ghost tunnel adapter provider: ${String(provider)}`);
+  }
   return {
-    allowedHosts: policy?.allowedHosts ?? DEFAULT_RELAY_TARGET_POLICY.allowedHosts,
-    blockedPorts: policy?.blockedPorts ?? DEFAULT_RELAY_TARGET_POLICY.blockedPorts,
-    allowPrivateNetworkTargets: policy?.allowPrivateNetworkTargets ?? DEFAULT_RELAY_TARGET_POLICY.allowPrivateNetworkTargets
+    provider,
+    strategy: typeof input === "string" ? DEFAULT_GHOST_TUNNEL_ADAPTER_STRATEGY : parseGhostTunnelAdapterStrategy(input.strategy)
   };
 }
-function mergeLimits(limits) {
-  const merged = {
-    ...DEFAULT_RELAY_LIMITS,
-    ...limits ?? {}
-  };
-  for (const [key, value] of Object.entries(merged)) {
-    if (!Number.isInteger(value) || value < 1) {
-      throw new Error(`Invalid relay limit ${key}: ${value}`);
-    }
-  }
-  return merged;
+function getLegacyGhostTunnelTransport(input) {
+  if (!input || typeof input === "string" || !("transport" in input)) return void 0;
+  return input.transport;
 }
-function assertExactRelayHost(host) {
-  const normalized = normalizeHost2(host);
-  if (!normalized) {
-    throw new Error(`Relay route claims must use an exact hostname: ${host}`);
+function resolveGhostTunnelTransport(input) {
+  if (!input) {
+    return { kind: "none" };
   }
-  return normalized;
-}
-function assertRelayLocalTarget(target, policyInput) {
-  if (!target || typeof target !== "object") {
-    throw new Error("Relay target must be an explicit local target object.");
+  const kind = typeof input === "string" ? parseGhostTunnelTransportKind(input) : parseGhostTunnelTransportKind(input.kind);
+  if (kind === "ip") {
+    return {
+      kind,
+      allowPrivateNetworkAddress: typeof input === "string" ? false : input.kind === "ip" ? input.allowPrivateNetworkAddress ?? false : false
+    };
   }
-  const policy = mergeTargetPolicy(policyInput);
-  const host = normalizeTargetHost(target.host);
-  if (!host) {
-    throw new Error(`Invalid relay target host: ${target.host}`);
+  if (kind === "tunnel") {
+    const config = typeof input === "string" || input.kind !== "tunnel" ? void 0 : input;
+    const store = config?.store ?? {};
+    return {
+      kind,
+      store: {
+        provider: parseTunnelStoreProvider(store.provider),
+        env: parseTunnelStoreEnv(store.env),
+        namespace: parseTunnelStoreNamespace(store.namespace)
+      },
+      waitMs: parsePositiveInteger(config?.waitMs, DEFAULT_GHOST_TUNNEL_TUNNEL_WAIT_MS, "tunnel waitMs"),
+      pollIntervalMs: parsePositiveInteger(config?.pollIntervalMs, DEFAULT_GHOST_TUNNEL_TUNNEL_POLL_INTERVAL_MS, "tunnel pollIntervalMs"),
+      routeTtlSeconds: parsePositiveInteger(config?.routeTtlSeconds, DEFAULT_GHOST_TUNNEL_TUNNEL_ROUTE_TTL_SECONDS, "tunnel routeTtlSeconds"),
+      requestTtlSeconds: parsePositiveInteger(config?.requestTtlSeconds, DEFAULT_GHOST_TUNNEL_TUNNEL_REQUEST_TTL_SECONDS, "tunnel requestTtlSeconds"),
+      maxRequestBodyBytes: parsePositiveInteger(config?.maxRequestBodyBytes, DEFAULT_GHOST_TUNNEL_TUNNEL_MAX_REQUEST_BODY_BYTES, "tunnel maxRequestBodyBytes"),
+      maxResponseBodyBytes: parsePositiveInteger(config?.maxResponseBodyBytes, DEFAULT_GHOST_TUNNEL_TUNNEL_MAX_RESPONSE_BODY_BYTES, "tunnel maxResponseBodyBytes")
+    };
   }
-  if (!Number.isInteger(target.port) || target.port < 1 || target.port > 65535) {
-    throw new Error(`Invalid relay target port: ${target.port}`);
+  return { kind: "none" };
+}
+function resolveNamespaceConfig(options) {
+  const tags = isNamespaceTagList(options) ? [...options] : [...options?.tags ?? DEFAULT_GHOST_TUNNEL_NAMESPACE_TAGS];
+  let separator = DEFAULT_GHOST_TUNNEL_NAMESPACE_SEPARATOR;
+  let spreadTag = tags.includes("project") ? "project" : void 0;
+  if (options && !isNamespaceTagList(options)) {
+    separator = options.separator ?? DEFAULT_GHOST_TUNNEL_NAMESPACE_SEPARATOR;
+    spreadTag = options.spreadTag === false ? false : options.spreadTag ?? spreadTag;
   }
-  const protocol = target.protocol ?? "http";
-  if (protocol !== "http" && protocol !== "https") {
-    throw new Error(`Invalid relay target protocol: ${String(protocol)}`);
+  if (tags.length === 0) {
+    throw new Error("Ghost tunnel namespace must include at least one tag.");
   }
-  if (policy.blockedPorts.includes(target.port)) {
-    throw new Error(`Relay target port is blocked: ${target.port}`);
+  for (const tag of tags) {
+    if (!isValidNamespaceTag(tag)) {
+      throw new Error(`Invalid ghost tunnel namespace tag: ${tag}`);
+    }
   }
-  const allowedHosts = new Set(policy.allowedHosts.map((allowedHost) => normalizeTargetHost(allowedHost)).filter((value) => Boolean(value)));
-  if (!allowedHosts.has(host)) {
-    throw new Error(`Relay target host is not explicitly allowed: ${host}`);
+  if (spreadTag && !tags.includes(spreadTag)) {
+    throw new Error(`Ghost tunnel namespace spreadTag must be listed in tags: ${spreadTag}`);
   }
-  if (!policy.allowPrivateNetworkTargets && !isLocalTargetHost(host) && (host === "::1" || isPrivateIpv4(host))) {
-    throw new Error(`Private-network relay target requires explicit opt-in: ${host}`);
+  if (!separator || separator.length > 8 || !/^[a-z0-9-]+$/.test(separator)) {
+    throw new Error(`Invalid ghost tunnel namespace separator: ${separator}`);
   }
   return {
-    protocol,
-    host,
-    port: target.port
-  };
-}
-function authenticateRelayAgentToken(input) {
-  const expected = `Bearer ${input.agentToken}`;
-  return typeof input.authorizationHeader === "string" && secureEqual(input.authorizationHeader, expected);
-}
-function signRelayRouteClaim(claim, signingSecret) {
-  const payload = {
-    ...claim,
-    host: assertExactRelayHost(claim.host)
-  };
-  if (!payload.scope) throw new Error("Relay route claim requires a scope.");
-  if (!payload.agentId) throw new Error("Relay route claim requires an agentId.");
-  if (Number.isNaN(Date.parse(payload.expiresAt))) throw new Error("Relay route claim requires a valid expiresAt.");
-  const encodedPayload = base64UrlEncode(JSON.stringify(payload));
-  const signature = signPayload(encodedPayload, signingSecret);
-  return {
-    payload,
-    token: `${encodedPayload}.${signature}`
+    tags,
+    separator,
+    ...spreadTag ? { spreadTag } : {}
   };
 }
-function verifyRelayRouteClaim(token, signingSecret, options) {
-  const [encodedPayload, signature] = token.split(".");
-  if (!encodedPayload || !signature || token.split(".").length !== 2) {
-    throw new Error("Invalid relay route claim token.");
-  }
-  const expectedSignature = signPayload(encodedPayload, signingSecret);
-  if (!secureEqual(signature, expectedSignature)) {
-    throw new Error("Invalid relay route claim signature.");
-  }
-  const parsed = JSON.parse(base64UrlDecode(encodedPayload));
-  const host = assertExactRelayHost(parsed.host);
-  if (parsed.scope !== options.expectedScope) {
-    throw new Error("Relay route claim scope mismatch.");
-  }
-  const now = options.now ?? /* @__PURE__ */ new Date();
-  if (Date.parse(parsed.expiresAt) <= now.getTime()) {
-    throw new Error("Relay route claim has expired.");
+function normalizeNamespaceValue(tag, value, separator, options = {}) {
+  const normalized = normalizeDomain(value);
+  if (!normalized || normalized.includes(".")) {
+    throw new Error(`Invalid ghost tunnel namespace value for ${tag}: ${value}`);
   }
-  if (!parsed.agentId) {
-    throw new Error("Relay route claim requires an agentId.");
+  if (!options.allowSeparator && normalized.includes(separator)) {
+    throw new Error(`Ghost tunnel namespace value for ${tag} cannot include separator "${separator}": ${value}`);
   }
-  return { ...parsed, host };
+  return normalized;
 }
-function createRelayRouteRegistration(input) {
-  if (!authenticateRelayAgentToken({
-    agentToken: input.agentToken,
-    ...typeof input.authorizationHeader !== "undefined" ? { authorizationHeader: input.authorizationHeader } : {}
-  })) {
-    throw new Error("Relay route registration requires an authenticated local agent.");
-  }
-  const claim = verifyRelayRouteClaim(input.claimToken, input.signingSecret, {
-    expectedScope: input.expectedScope,
-    ...input.now ? { now: input.now } : {}
+function createNamespaceSlug(config, values) {
+  const parts = config.tags.map((tag) => {
+    const value = values[tag];
+    if (!value) {
+      throw new Error(`Missing ghost tunnel namespace value: ${tag}`);
+    }
+    return normalizeNamespaceValue(tag, value, config.separator, { allowSeparator: tag === config.spreadTag });
   });
-  const target = assertRelayLocalTarget(input.target, input.targetPolicy);
-  const access = input.publicMode === true ? "public" : input.access ?? "private";
-  const passwordProtected = input.passwordProtected ?? false;
-  const authRequired = input.authRequired ?? false;
-  if (access === "public" && input.publicMode !== true) {
-    throw new Error("Relay public mode must be explicitly enabled.");
-  }
-  if (access === "private" && !passwordProtected && !authRequired) {
-    throw new Error("Private relay previews require password or auth.");
-  }
-  return {
-    host: claim.host,
-    scope: claim.scope,
-    agentId: claim.agentId,
-    expiresAt: claim.expiresAt,
-    target,
-    access,
-    passwordProtected,
-    authRequired,
-    limits: mergeLimits(input.limits)
-  };
-}
-function isRelayRouteActive(route, options) {
-  if (!options.agentConnected) return false;
-  return Date.parse(route.expiresAt) > (options.now ?? /* @__PURE__ */ new Date()).getTime();
-}
-function stripRelayForwardHeaders(headers) {
-  const stripped = {};
-  for (const [name, value] of Object.entries(headers)) {
-    if (typeof value === "undefined") continue;
-    const lowerName = name.toLowerCase();
-    if (HOP_BY_HOP_HEADERS.has(lowerName)) continue;
-    if (lowerName.startsWith("x-localghost-")) continue;
-    stripped[name] = value;
-  }
-  return stripped;
-}
-function redactRelayHeaders(headers) {
-  const redacted = {};
-  for (const [name, value] of Object.entries(headers)) {
-    if (typeof value === "undefined") continue;
-    redacted[name] = SENSITIVE_HEADERS.has(name.toLowerCase()) ? "[redacted]" : value;
+  const slug = parts.join(config.separator);
+  if (!isValidHostLabel(slug)) {
+    throw new Error(`Ghost tunnel namespace is too long for a DNS label: ${slug}`);
   }
-  return redacted;
+  return slug;
 }
-function redactRelayLogUrl(input) {
-  const url = new URL(input, "http://localghost.invalid");
-  for (const key of [...url.searchParams.keys()]) {
-    if (TOKEN_QUERY_PATTERN.test(key)) {
-      url.searchParams.set(key, "[redacted]");
+function createNamespaceDisplaySlug(config, values = {}) {
+  return config.tags.map((tag) => {
+    const value = values[tag];
+    if (!value) return `<${tag}>`;
+    try {
+      return normalizeNamespaceValue(tag, value, config.separator, { allowSeparator: tag === config.spreadTag });
+    } catch {
+      return `<${tag}>`;
     }
-  }
-  return input.startsWith("http://") || input.startsWith("https://") ? url.toString() : `${url.pathname}${url.search}`;
+  }).join(config.separator);
 }
-function renderRelayOfflineResponse() {
+function getPreviewDefaults(preview, defaults) {
   return {
-    status: 503,
-    headers: {
-      "content-type": "text/html; charset=utf-8",
-      "cache-control": "no-store"
+    domain: preview?.domain ?? defaults?.domain,
+    route: preview?.route ?? defaults?.route,
+    project: preview?.project ?? defaults?.project,
+    owner: preview?.owner ?? defaults?.owner,
+    values: {
+      ...defaults?.values ?? {},
+      ...preview?.values ?? {}
     },
-    body: [
-      "<!doctype html>",
-      "<html>",
-      '<head><meta charset="utf-8"><title>Preview offline</title></head>',
-      "<body><h1>Preview offline</h1><p>The local agent is not connected. Try again later.</p></body>",
-      "</html>"
-    ].join("")
+    path: preview?.path,
+    protocol: preview?.protocol
   };
 }
-
-// src/ghost-tunnel-store.ts
-import { randomUUID } from "crypto";
-var DEFAULT_GHOST_TUNNEL_RESPONSE_TTL_SECONDS = 60;
-function base64Encode(value) {
-  return value.toString("base64");
-}
-function encodeGhostTunnelBody(value) {
-  return base64Encode(Buffer.isBuffer(value) ? value : Buffer.from(value));
-}
-function decodeGhostTunnelBody(value) {
-  return value ? Buffer.from(value, "base64") : void 0;
-}
-function createGhostTunnelQueuedRequest(input) {
-  const now = input.now ?? /* @__PURE__ */ new Date();
-  const bodyBase64 = typeof input.body === "undefined" ? void 0 : encodeGhostTunnelBody(input.body);
+function getDisplayValues(input) {
   return {
-    id: randomUUID(),
-    host: input.host,
-    method: input.method.toUpperCase(),
-    path: input.path,
-    headers: input.headers ?? {},
-    createdAt: now.toISOString(),
-    expiresAt: new Date(now.getTime() + input.ttlSeconds * 1e3).toISOString(),
-    ...bodyBase64 ? { bodyBase64 } : {}
+    ...input.route ? { route: input.route } : {},
+    ...input.project ? { project: input.project } : {},
+    ...input.owner ? { owner: input.owner } : {},
+    ...input.values
   };
 }
-function createGhostTunnelRouteHeartbeat(input) {
-  const now = input.now ?? /* @__PURE__ */ new Date();
-  return {
-    host: input.host,
-    agentId: input.agentId,
-    target: input.target,
-    updatedAt: now.toISOString(),
-    expiresAt: new Date(now.getTime() + input.ttlSeconds * 1e3).toISOString()
-  };
+function getDisplayDefaults(defaults) {
+  return defaults;
 }
-function isExpired(expiresAt, now = /* @__PURE__ */ new Date()) {
-  const timestamp = Date.parse(expiresAt);
-  return Number.isNaN(timestamp) || timestamp <= now.getTime();
+function createDisplayUrl(config, defaults, domain) {
+  const input = getPreviewDefaults(config.preview, getDisplayDefaults(defaults));
+  const protocol = input.protocol ?? "https";
+  const slug = createNamespaceDisplaySlug(config.namespace, getDisplayValues(input));
+  const entryHost = domain ? getGhostTunnelEntryHost(domain, config) : input.domain ? getGhostTunnelEntryHost(input.domain, config) : `${config.subdomain}.*`;
+  const url = `${protocol}://${slug}.${entryHost}/`;
+  if (!input.path) return url;
+  return `${url}${input.path.replace(/^\/+/, "")}`;
 }
-function serializeJson(value) {
-  return JSON.stringify(value);
+function createDisplayUrls(config, defaults) {
+  const displayDefaults = getDisplayDefaults(defaults);
+  const domains = config.domains.length > 0 ? config.domains : displayDefaults?.domain ? [displayDefaults.domain] : [];
+  const urls = domains.length > 0 ? domains.map((domain) => createDisplayUrl(config, displayDefaults, domain)) : [createDisplayUrl(config, displayDefaults)];
+  return [...new Set(urls)];
 }
-function parseJson(value) {
-  if (typeof value !== "string") return null;
-  try {
-    return JSON.parse(value);
-  } catch {
-    return null;
-  }
+function maybeConstructPreviewUrl(config, defaults) {
+  if (!config.preview) return void 0;
+  const input = getPreviewDefaults(config.preview, defaults);
+  if (!input.domain || !input.route || !input.project || !input.owner) return void 0;
+  return constructGhostTunnelUrl({
+    domain: input.domain,
+    route: input.route,
+    project: input.project,
+    owner: input.owner,
+    values: input.values,
+    ...input.path ? { path: input.path } : {},
+    ...input.protocol ? { protocol: input.protocol } : {},
+    ghostTunnel: config
+  });
 }
-function keyPart(value) {
-  return value.toLowerCase().replace(/[^a-z0-9._:-]/g, "_");
+function parseNamespaceSlug(slug, config) {
+  const parts = slug.split(config.separator);
+  if (parts.length < config.tags.length) return null;
+  if (parts.length !== config.tags.length && !config.spreadTag) return null;
+  const namespace = {};
+  const spreadIndex = config.spreadTag ? config.tags.indexOf(config.spreadTag) : -1;
+  const spreadWidth = spreadIndex >= 0 ? parts.length - config.tags.length + 1 : 1;
+  let partIndex = 0;
+  for (const [tagIndex, tag] of config.tags.entries()) {
+    const value = tagIndex === spreadIndex ? parts.slice(partIndex, partIndex + spreadWidth).join(config.separator) : parts[partIndex];
+    if (!value || !isValidHostLabel(value)) return null;
+    if (tagIndex !== spreadIndex && value.includes(config.separator)) return null;
+    namespace[tag] = value;
+    partIndex += tagIndex === spreadIndex ? spreadWidth : 1;
+  }
+  return namespace;
 }
-function removeTrailingSlashes(value) {
-  let end = value.length;
-  while (end > 0 && value.charCodeAt(end - 1) === 47) end -= 1;
-  return value.slice(0, end);
-}
-var MemoryGhostTunnelStore = class {
-  routes = /* @__PURE__ */ new Map();
-  queues = /* @__PURE__ */ new Map();
-  responses = /* @__PURE__ */ new Map();
-  async heartbeatRoute(route) {
-    this.routes.set(route.host, route);
-  }
-  async getRoute(host) {
-    const route = this.routes.get(host);
-    if (!route) return null;
-    if (!isExpired(route.expiresAt)) return route;
-    this.routes.delete(host);
-    return null;
-  }
-  async enqueueRequest(request) {
-    const queue = this.queues.get(request.host) ?? [];
-    queue.push(request);
-    this.queues.set(request.host, queue);
-  }
-  async claimRequest(host) {
-    const queue = this.queues.get(host) ?? [];
-    while (queue.length > 0) {
-      const request = queue.shift();
-      if (request && !isExpired(request.expiresAt)) {
-        return request;
-      }
-    }
-    return null;
-  }
-  async writeResponse(response, ttlSeconds) {
-    this.responses.set(response.id, {
-      value: response,
-      expiresAt: new Date(Date.now() + ttlSeconds * 1e3).toISOString()
-    });
-  }
-  async readResponse(requestId) {
-    const response = this.responses.get(requestId);
-    if (!response) return null;
-    if (!isExpired(response.expiresAt)) return response.value;
-    this.responses.delete(requestId);
-    return null;
+function resolveGhostTunnelConfig(options, defaults) {
+  if (options === false || typeof options === "undefined") {
+    return {
+      enabled: false,
+      mode: DEFAULT_GHOST_TUNNEL_MODE,
+      domains: [],
+      subdomain: DEFAULT_GHOST_TUNNEL_SUBDOMAIN,
+      namespace: resolveNamespaceConfig(void 0),
+      displayUrls: [],
+      requireHttps: true,
+      requireAuth: true,
+      transport: resolveGhostTunnelTransport(void 0)
+    };
   }
-  async cleanup(requestId) {
-    this.responses.delete(requestId);
+  const config = typeof options === "string" ? { mode: options } : options;
+  const subdomain = config.subdomain ?? DEFAULT_GHOST_TUNNEL_SUBDOMAIN;
+  assertValidSubdomain(subdomain);
+  const domains = normalizeDomains(config.domains);
+  const enabled = config.enabled ?? true;
+  const adapter = resolveGhostTunnelAdapter(config.adapter);
+  const transport = resolveGhostTunnelTransport(config.transport ?? getLegacyGhostTunnelTransport(config.adapter));
+  const resolved = {
+    enabled,
+    mode: parseGhostTunnelMode(config.mode),
+    domains,
+    subdomain,
+    namespace: resolveNamespaceConfig(config.namespace),
+    ...config.preview ? { preview: config.preview } : {},
+    displayUrls: [],
+    requireHttps: config.requireHttps ?? true,
+    requireAuth: config.requireAuth ?? true,
+    transport,
+    ...adapter ? { adapter } : {}
+  };
+  if (!enabled) {
+    return resolved;
   }
-};
-function createMemoryGhostTunnelStore() {
-  return new MemoryGhostTunnelStore();
+  const previewUrl = maybeConstructPreviewUrl(resolved, defaults);
+  const displayUrls = previewUrl ? [previewUrl] : createDisplayUrls(resolved, defaults);
+  return {
+    ...resolved,
+    displayUrls,
+    ...displayUrls[0] ? { displayUrl: displayUrls[0] } : {},
+    ...previewUrl ? { previewUrl } : {}
+  };
 }
-var RedisGhostTunnelStore = class {
-  url;
-  token;
-  namespace;
-  fetchImpl;
-  constructor(options) {
-    this.url = removeTrailingSlashes(options.url);
-    this.token = options.token;
-    this.namespace = options.namespace ?? "localghost";
-    this.fetchImpl = options.fetch ?? fetch;
-  }
-  key(kind, id) {
-    return `${this.namespace}:ghost-tunnel:${kind}:${keyPart(id)}`;
-  }
-  async command(command, ...args) {
-    const response = await this.fetchImpl(this.url, {
-      method: "POST",
-      headers: {
-        authorization: `Bearer ${this.token}`,
-        "content-type": "application/json"
-      },
-      body: JSON.stringify([command, ...args])
-    });
-    if (!response.ok) {
-      throw new Error(`Redis Ghost Tunnel command failed: ${response.status} ${response.statusText}`);
-    }
-    const payload = await response.json();
-    if (payload.error) {
-      throw new Error(`Redis Ghost Tunnel command failed: ${payload.error}`);
-    }
-    return typeof payload.result === "undefined" ? null : payload.result;
-  }
-  async heartbeatRoute(route, ttlSeconds) {
-    await this.command("SET", this.key("route", route.host), serializeJson(route), "EX", ttlSeconds);
+function getGhostTunnelEntryHost(domain, options = {}) {
+  const config = toGhostTunnelConfig(options);
+  const normalizedDomain = normalizeDomain(domain);
+  if (!normalizedDomain) {
+    throw new Error(`Invalid ghost tunnel domain: ${domain}`);
   }
-  async getRoute(host) {
-    const route = parseJson(await this.command("GET", this.key("route", host)));
-    return route && !isExpired(route.expiresAt) ? route : null;
+  return `${config.subdomain}.${normalizedDomain}`;
+}
+function getGhostTunnelWildcardHost(domain, options = {}) {
+  return `*.${getGhostTunnelEntryHost(domain, options)}`;
+}
+function constructGhostTunnelHost(input) {
+  const config = toGhostTunnelConfig(input.ghostTunnel ?? {});
+  if (!config.enabled) {
+    throw new Error("Ghost tunnel is not enabled.");
   }
-  async enqueueRequest(request, ttlSeconds) {
-    const queueKey = this.key("queue", request.host);
-    await this.command("RPUSH", queueKey, serializeJson(request));
-    await this.command("EXPIRE", queueKey, ttlSeconds);
+  const namespaceValues = {
+    route: input.route,
+    project: input.project,
+    owner: input.owner,
+    ...input.values ?? {}
+  };
+  const slug = createNamespaceSlug(config.namespace, namespaceValues);
+  return `${slug}.${getGhostTunnelEntryHost(input.domain, config)}`;
+}
+function constructGhostTunnelUrl(input) {
+  const protocol = input.protocol ?? "https";
+  const host = constructGhostTunnelHost(input);
+  const url = new URL(`${protocol}://${host}/`);
+  if (input.path) {
+    url.pathname = `/${input.path.replace(/^\/+/, "")}`;
   }
-  async claimRequest(host) {
-    const queueKey = this.key("queue", host);
-    while (true) {
-      const request = parseJson(await this.command("LPOP", queueKey));
-      if (!request) return null;
-      if (!isExpired(request.expiresAt)) return request;
+  if (input.searchParams instanceof URLSearchParams) {
+    url.search = input.searchParams.toString();
+  } else if (input.searchParams) {
+    for (const [key, value] of Object.entries(input.searchParams)) {
+      if (typeof value !== "undefined" && value !== null) {
+        url.searchParams.set(key, String(value));
+      }
     }
   }
-  async writeResponse(response, ttlSeconds) {
-    await this.command("SET", this.key("response", response.id), serializeJson(response), "EX", ttlSeconds);
-  }
-  async readResponse(requestId) {
-    return parseJson(await this.command("GET", this.key("response", requestId)));
-  }
-  async cleanup(requestId) {
-    await this.command("DEL", this.key("response", requestId));
-  }
-};
-function createRedisGhostTunnelStore(options) {
-  return new RedisGhostTunnelStore(options);
-}
-function resolveRedisGhostTunnelEnv(env = process.env) {
-  const candidates = [
-    env.LOCALGHOST_REDIS_REST_URL && env.LOCALGHOST_REDIS_REST_TOKEN ? { url: env.LOCALGHOST_REDIS_REST_URL, token: env.LOCALGHOST_REDIS_REST_TOKEN, source: "localghost" } : null,
-    env.UPSTASH_REDIS_REST_URL && env.UPSTASH_REDIS_REST_TOKEN ? { url: env.UPSTASH_REDIS_REST_URL, token: env.UPSTASH_REDIS_REST_TOKEN, source: "upstash" } : null,
-    env.KV_REST_API_URL && env.KV_REST_API_TOKEN ? { url: env.KV_REST_API_URL, token: env.KV_REST_API_TOKEN, source: "vercel-kv" } : null,
-    env.REDIS_REST_API_URL && env.REDIS_REST_API_TOKEN ? { url: env.REDIS_REST_API_URL, token: env.REDIS_REST_API_TOKEN, source: "redis" } : null
-  ];
-  const match = candidates.find((candidate) => Boolean(candidate));
-  if (!match) {
-    throw new Error("Ghost Tunnel Redis transport requires REST env vars: UPSTASH_REDIS_REST_URL/UPSTASH_REDIS_REST_TOKEN, KV_REST_API_URL/KV_REST_API_TOKEN, or LOCALGHOST_REDIS_REST_URL/LOCALGHOST_REDIS_REST_TOKEN.");
-  }
-  return match;
-}
-function createRedisGhostTunnelStoreFromEnv(input = {}) {
-  const resolved = resolveRedisGhostTunnelEnv(input.env);
-  return createRedisGhostTunnelStore({
-    url: resolved.url,
-    token: resolved.token,
-    ...input.namespace ? { namespace: input.namespace } : {},
-    ...input.fetch ? { fetch: input.fetch } : {}
-  });
+  return url.toString();
 }
-
-// src/ghost-agent.ts
-function isStopped(signal, localSignal) {
-  return localSignal.aborted || signal?.aborted === true;
+var constructGhostTunnelURL = constructGhostTunnelUrl;
+function getGhostTunnelDefaultDisplayUrl(options = {}, defaults) {
+  const config = toGhostTunnelConfig(options);
+  if (!config.enabled) return null;
+  return createDisplayUrl(config, defaults);
 }
-function wait(ms, signal, localSignal) {
-  if (isStopped(signal, localSignal)) return Promise.resolve();
-  return new Promise((resolve5) => {
-    const timeout = setTimeout(resolve5, ms);
-    const stop = () => {
-      clearTimeout(timeout);
-      resolve5();
-    };
-    signal?.addEventListener("abort", stop, { once: true });
-    localSignal.addEventListener("abort", stop, { once: true });
-  });
+function getGhostTunnelDisplayUrl(options, defaults) {
+  const config = toGhostTunnelConfig(options);
+  if (!config.enabled) return null;
+  return config.displayUrl ?? config.previewUrl ?? getGhostTunnelDefaultDisplayUrl(config, defaults);
 }
-function toHeaderRecord(headers) {
-  const result = {};
-  headers.forEach((value, name) => {
-    result[name] = value;
-  });
-  return result;
+function getGhostTunnelDisplayUrls(options, defaults) {
+  const config = toGhostTunnelConfig(options);
+  if (!config.enabled) return [];
+  if (config.displayUrls.length > 0) return config.displayUrls;
+  const displayUrl = getGhostTunnelDisplayUrl(config, defaults);
+  return displayUrl ? [displayUrl] : [];
 }
-function hasRequestBody(method) {
-  return method !== "GET" && method !== "HEAD";
+function getGhostTunnelPreviewUrl(options) {
+  const config = toGhostTunnelConfig(options);
+  if (!config.enabled) return null;
+  return config.previewUrl ?? maybeConstructPreviewUrl(config) ?? null;
 }
-async function serveGhostTunnelLocalRequest(input) {
-  const fetchImpl = input.fetch ?? fetch;
-  const localUrl = new URL(`${input.target.protocol}://${input.target.host}:${input.target.port}/`);
-  const requestPath = new URL(input.request.path, "http://localghost.invalid");
-  localUrl.pathname = requestPath.pathname;
-  localUrl.search = requestPath.search;
-  try {
-    const body = hasRequestBody(input.request.method) ? decodeGhostTunnelBody(input.request.bodyBase64) : void 0;
-    const response = await fetchImpl(localUrl, {
-      method: input.request.method,
-      headers: {
-        ...stripRelayForwardHeaders(input.request.headers),
-        "x-forwarded-host": input.request.host,
-        "x-localghost-tunnel": "1"
-      },
-      ...body ? { body } : {}
-    });
-    const responseBody = Buffer.from(await response.arrayBuffer());
-    if (responseBody.byteLength > input.maxResponseBodyBytes) {
-      throw new Error(`Ghost Tunnel response exceeded ${input.maxResponseBodyBytes} bytes.`);
-    }
-    return {
-      id: input.request.id,
-      status: response.status,
-      headers: toHeaderRecord(response.headers),
-      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-      ...responseBody.byteLength > 0 ? { bodyBase64: encodeGhostTunnelBody(responseBody) } : {}
-    };
-  } catch (error) {
-    return {
-      id: input.request.id,
-      status: 502,
-      headers: {
-        "content-type": "text/plain; charset=utf-8",
-        "cache-control": "no-store"
-      },
-      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-      error: error instanceof Error ? error.message : String(error),
-      bodyBase64: encodeGhostTunnelBody("Ghost Tunnel local target failed.")
-    };
-  }
-}
-async function heartbeatRoutes(input) {
-  for (const entry of input.entries) {
-    const target = assertRelayLocalTarget({ host: input.targetHost, port: entry.port });
-    await input.store.heartbeatRoute(createGhostTunnelRouteHeartbeat({
-      host: entry.host,
-      agentId: input.agentId,
-      target,
-      ttlSeconds: input.routeTtlSeconds
-    }), input.routeTtlSeconds);
-  }
-}
-async function claimAndServe(input) {
-  const request = await input.store.claimRequest(input.entry.host);
-  if (!request) return false;
-  const target = assertRelayLocalTarget({ host: input.targetHost, port: input.entry.port });
-  const response = await serveGhostTunnelLocalRequest({
-    request,
-    target,
-    maxResponseBodyBytes: input.maxResponseBodyBytes,
-    ...input.fetch ? { fetch: input.fetch } : {}
-  });
-  await input.store.writeResponse(response, input.requestTtlSeconds);
-  return true;
-}
-function startGhostTunnelAgent(options) {
-  const controller = new AbortController();
-  const localSignal = controller.signal;
-  const signal = options.signal;
-  const agentId = options.agentId ?? `localghost-${randomUUID2()}`;
-  const targetHost = options.targetHost ?? "127.0.0.1";
-  const routeTtlSeconds = options.routeTtlSeconds ?? 30;
-  const requestTtlSeconds = options.requestTtlSeconds ?? 60;
-  const pollIntervalMs = options.pollIntervalMs ?? 500;
-  const maxResponseBodyBytes = options.maxResponseBodyBytes ?? 5 * 1024 * 1024;
-  const done = (async () => {
-    if (options.entries.length === 0) {
-      throw new Error("Ghost Tunnel agent requires at least one .ghosttunnel entry.");
-    }
-    options.log?.(`localghost tunnel agent ${agentId}`);
-    for (const entry of options.entries) {
-      options.log?.(`  ${entry.host} -> ${targetHost}:${entry.port}`);
-    }
-    let lastHeartbeat = 0;
-    while (!isStopped(signal, localSignal)) {
-      const now = Date.now();
-      if (now - lastHeartbeat >= Math.max(1e3, Math.floor(routeTtlSeconds * 1e3 / 3))) {
-        await heartbeatRoutes({
-          entries: options.entries,
-          store: options.store,
-          agentId,
-          targetHost,
-          routeTtlSeconds
-        });
-        lastHeartbeat = now;
-      }
-      let served = false;
-      for (const entry of options.entries) {
-        served = await claimAndServe({
-          entry,
-          store: options.store,
-          targetHost,
-          requestTtlSeconds,
-          maxResponseBodyBytes,
-          ...options.fetch ? { fetch: options.fetch } : {}
-        }) || served;
-      }
-      if (!served) {
-        await wait(pollIntervalMs, signal, localSignal);
-      }
-    }
-  })();
+function parseGhostTunnelHost(host, domain, options = {}) {
+  const config = toGhostTunnelConfig(options);
+  if (!config.enabled) return null;
+  const normalizedHost = normalizeDomain(host);
+  const normalizedDomain = normalizeDomain(domain);
+  if (!normalizedHost || !normalizedDomain) return null;
+  const entryHost = getGhostTunnelEntryHost(normalizedDomain, config);
+  const suffix = `.${entryHost}`;
+  if (!normalizedHost.endsWith(suffix)) return null;
+  const slug = normalizedHost.slice(0, -suffix.length);
+  if (!isValidHostLabel(slug)) return null;
+  const namespace = parseNamespaceSlug(slug, config.namespace);
+  if (!namespace) return null;
   return {
-    agentId,
-    stop() {
-      controller.abort();
-    },
-    done
+    host: normalizedHost,
+    slug,
+    namespace,
+    entryHost,
+    wildcardHost: `*.${entryHost}`,
+    domain: normalizedDomain
   };
 }
+function assertSecureGhostTunnelRequest(input) {
+  const config = toGhostTunnelConfig(input.ghostTunnel);
+  if (!config.enabled) {
+    throw new Error("Ghost tunnel is not enabled.");
+  }
+  if (config.requireHttps && input.protocol !== "https") {
+    throw new Error("Ghost tunnel requests must use HTTPS.");
+  }
+  if (config.requireAuth && input.authenticated !== true) {
+    throw new Error("Ghost tunnel requests must be authenticated.");
+  }
+  const route = parseGhostTunnelHost(input.host, input.domain, config);
+  if (!route) {
+    throw new Error(`Host is not a valid ghost tunnel host for ${input.domain}.`);
+  }
+  return route;
+}
 
-// src/ghost-transport.ts
-import { createHmac as createHmac2, timingSafeEqual as timingSafeEqual2 } from "crypto";
-import { isIP } from "net";
-
-// src/tunnel.ts
+// packages/ghost-tunnel/src/relay.ts
+import { createHmac, timingSafeEqual } from "crypto";
 import { domainToASCII as domainToASCII2 } from "url";
-var DEFAULT_GHOST_TUNNEL_SUBDOMAIN = "ghost";
-var DEFAULT_GHOST_TUNNEL_NAMESPACE_TAGS = ["route", "project", "owner"];
-var DEFAULT_GHOST_TUNNEL_NAMESPACE_SEPARATOR = "-";
-var DEFAULT_GHOST_TUNNEL_MODE = "manual";
-var DEFAULT_GHOST_TUNNEL_ADAPTER_STRATEGY = "same-project";
-var DEFAULT_GHOST_TUNNEL_TRANSPORT_KIND = "none";
-var DEFAULT_GHOST_TUNNEL_TUNNEL_STORE_PROVIDER = "vercel-redis";
-var DEFAULT_GHOST_TUNNEL_TUNNEL_STORE_ENV = "auto";
-var DEFAULT_GHOST_TUNNEL_TUNNEL_STORE_NAMESPACE = "localghost";
-var DEFAULT_GHOST_TUNNEL_TUNNEL_WAIT_MS = 25e3;
-var DEFAULT_GHOST_TUNNEL_TUNNEL_POLL_INTERVAL_MS = 250;
-var DEFAULT_GHOST_TUNNEL_TUNNEL_ROUTE_TTL_SECONDS = 30;
-var DEFAULT_GHOST_TUNNEL_TUNNEL_REQUEST_TTL_SECONDS = 60;
-var DEFAULT_GHOST_TUNNEL_TUNNEL_MAX_REQUEST_BODY_BYTES = 1024 * 1024;
-var DEFAULT_GHOST_TUNNEL_TUNNEL_MAX_RESPONSE_BODY_BYTES = 5 * 1024 * 1024;
-function isResolvedGhostTunnelConfig(value) {
-  return typeof value === "object" && value !== null && "enabled" in value;
-}
-function toGhostTunnelConfig(options) {
-  return isResolvedGhostTunnelConfig(options) ? options : resolveGhostTunnelConfig(options);
-}
-function stripHostPort(value) {
-  const trimmed = value.trim().toLowerCase();
-  if (trimmed.startsWith("[") || trimmed.includes("/")) return "";
-  const portSeparator = trimmed.lastIndexOf(":");
-  if (portSeparator === -1) return trimmed;
-  const port = trimmed.slice(portSeparator + 1);
-  return /^\d+$/.test(port) ? trimmed.slice(0, portSeparator) : trimmed;
+var DEFAULT_RELAY_ALLOWED_TARGET_HOSTS = ["localhost", "127.0.0.1", "::1"];
+var DEFAULT_RELAY_BLOCKED_PORTS = [22, 2375, 2376, 5432, 6379, 9200, 9229, 27017];
+var DEFAULT_RELAY_LIMITS = {
+  requestBodyBytes: 5 * 1024 * 1024,
+  responseBytes: 25 * 1024 * 1024,
+  timeoutMs: 3e4,
+  maxConcurrentRequests: 20,
+  perRouteRequestsPerMinute: 120,
+  perIpRequestsPerMinute: 60
+};
+var DEFAULT_RELAY_TARGET_POLICY = {
+  allowedHosts: [...DEFAULT_RELAY_ALLOWED_TARGET_HOSTS],
+  blockedPorts: [...DEFAULT_RELAY_BLOCKED_PORTS],
+  allowPrivateNetworkTargets: false
+};
+var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
+  "connection",
+  "keep-alive",
+  "proxy-authenticate",
+  "proxy-authorization",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade"
+]);
+var SENSITIVE_HEADERS = /* @__PURE__ */ new Set(["authorization", "cookie", "set-cookie"]);
+var TOKEN_QUERY_PATTERN = /(token|secret|key|password|session|jwt|auth)/i;
+var HOST_PATTERN2 = /^(?=.{1,253}$)(?!-)[a-z0-9-]+(\.[a-z0-9-]+)*$/i;
+var IPV4_PATTERN = /^\d{1,3}(?:\.\d{1,3}){3}$/;
+function base64UrlEncode(value) {
+  return Buffer.from(value).toString("base64url");
 }
-function normalizeDomain(value) {
-  const host = stripHostPort(value.replace(/^\*\./, ""));
-  const ascii = domainToASCII2(host);
-  if (!ascii || ascii.length > 253 || ascii.includes("..")) return null;
-  if (ascii.startsWith(".") || ascii.endsWith(".")) return null;
-  if (ascii.includes("*")) return null;
-  if (!ascii.split(".").every(isValidHostLabel)) return null;
-  return ascii;
+function base64UrlDecode(value) {
+  return Buffer.from(value, "base64url").toString("utf8");
 }
-function isValidHostLabel(value) {
-  return value.length > 0 && value.length <= 63 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(value);
+function signPayload(payload, secret) {
+  return createHmac("sha256", secret).update(payload).digest("base64url");
 }
-function isValidNamespaceTag(value) {
-  return /^[a-z][a-z0-9_]*$/i.test(value);
+function secureEqual(left, right) {
+  const leftBuffer = Buffer.from(left);
+  const rightBuffer = Buffer.from(right);
+  return leftBuffer.length === rightBuffer.length && timingSafeEqual(leftBuffer, rightBuffer);
 }
-function isNamespaceTagList(options) {
-  return Array.isArray(options);
+function normalizeHost(host) {
+  const trimmed = host.trim().toLowerCase().replace(/\.$/, "");
+  if (!trimmed || trimmed.includes("*") || trimmed.includes("/") || trimmed.includes(":")) return null;
+  const ascii = domainToASCII2(trimmed);
+  if (!ascii || ascii.includes("..")) return null;
+  return HOST_PATTERN2.test(ascii) ? ascii : null;
 }
-function assertValidSubdomain(value) {
-  if (!isValidHostLabel(value)) {
-    throw new Error(`Invalid ghost tunnel subdomain: ${value}`);
-  }
+function normalizeTargetHost(host) {
+  const trimmed = host.trim().toLowerCase();
+  if (trimmed === "::1" || trimmed === "[::1]") return "::1";
+  if (trimmed.includes("/") || trimmed.includes("*")) return null;
+  if (IPV4_PATTERN.test(trimmed)) return isValidIpv4(trimmed) ? trimmed : null;
+  return normalizeHost(trimmed);
 }
-function normalizeDomains(domains) {
-  const values = typeof domains === "string" ? [domains] : [...domains ?? []];
-  const normalized = values.map((value) => value.trim()).filter(Boolean).map((value) => {
-    const domain = normalizeDomain(value);
-    if (!domain) throw new Error(`Invalid ghost tunnel domain: ${value}`);
-    return domain;
+function isValidIpv4(value) {
+  return value.split(".").every((part) => {
+    const octet = Number(part);
+    return Number.isInteger(octet) && octet >= 0 && octet <= 255 && String(octet) === part;
   });
-  return [...new Set(normalized)];
-}
-function parseGhostTunnelMode(value) {
-  return value ?? DEFAULT_GHOST_TUNNEL_MODE;
 }
-function parseGhostTunnelAdapterStrategy(value) {
-  if (typeof value === "undefined") return DEFAULT_GHOST_TUNNEL_ADAPTER_STRATEGY;
-  if (value === "same-project" || value === "separate-relay") return value;
-  throw new Error(`Unsupported ghost tunnel adapter strategy: ${String(value)}`);
-}
-function parseGhostTunnelTransportKind(value) {
-  if (typeof value === "undefined") return DEFAULT_GHOST_TUNNEL_TRANSPORT_KIND;
-  if (value === "none" || value === "ip" || value === "tunnel") return value;
-  throw new Error(`Unsupported ghost tunnel transport: ${String(value)}`);
+function isPrivateIpv4(value) {
+  if (!isValidIpv4(value)) return false;
+  const [first = 0, second = 0] = value.split(".").map((part) => Number(part));
+  return first === 10 || first === 127 || first === 172 && second >= 16 && second <= 31 || first === 192 && second === 168 || first === 169 && second === 254;
 }
-function parsePositiveInteger(value, fallback, name) {
-  if (typeof value === "undefined") return fallback;
-  if (!Number.isInteger(value) || value < 1) {
-    throw new Error(`Invalid ghost tunnel ${name}: ${value}`);
-  }
-  return value;
+function isLocalTargetHost(host) {
+  return host === "localhost" || host === "127.0.0.1" || host === "::1";
 }
-function parseTunnelStoreProvider(value) {
-  if (typeof value === "undefined") return DEFAULT_GHOST_TUNNEL_TUNNEL_STORE_PROVIDER;
-  if (value === "vercel-redis" || value === "redis") return value;
-  throw new Error(`Unsupported ghost tunnel tunnel store provider: ${String(value)}`);
+function mergeTargetPolicy(policy) {
+  return {
+    allowedHosts: policy?.allowedHosts ?? DEFAULT_RELAY_TARGET_POLICY.allowedHosts,
+    blockedPorts: policy?.blockedPorts ?? DEFAULT_RELAY_TARGET_POLICY.blockedPorts,
+    allowPrivateNetworkTargets: policy?.allowPrivateNetworkTargets ?? DEFAULT_RELAY_TARGET_POLICY.allowPrivateNetworkTargets
+  };
 }
-function parseTunnelStoreEnv(value) {
-  if (typeof value === "undefined") return DEFAULT_GHOST_TUNNEL_TUNNEL_STORE_ENV;
-  if (value === "auto") return value;
-  throw new Error(`Unsupported ghost tunnel tunnel store env: ${String(value)}`);
+function mergeLimits(limits) {
+  const merged = {
+    ...DEFAULT_RELAY_LIMITS,
+    ...limits ?? {}
+  };
+  for (const [key, value] of Object.entries(merged)) {
+    if (!Number.isInteger(value) || value < 1) {
+      throw new Error(`Invalid relay limit ${key}: ${value}`);
+    }
+  }
+  return merged;
 }
-function parseTunnelStoreNamespace(value) {
-  const namespace = value ?? DEFAULT_GHOST_TUNNEL_TUNNEL_STORE_NAMESPACE;
-  if (!/^[a-z][a-z0-9:_-]{0,63}$/i.test(namespace)) {
-    throw new Error(`Invalid ghost tunnel tunnel store namespace: ${namespace}`);
+function assertExactRelayHost(host) {
+  const normalized = normalizeHost(host);
+  if (!normalized) {
+    throw new Error(`Relay route claims must use an exact hostname: ${host}`);
   }
-  return namespace;
+  return normalized;
 }
-function resolveGhostTunnelAdapter(input) {
-  if (!input) return void 0;
-  const provider = typeof input === "string" ? input : input.provider;
-  if (provider !== "vercel") {
-    throw new Error(`Unsupported ghost tunnel adapter provider: ${String(provider)}`);
+function assertRelayLocalTarget(target, policyInput) {
+  if (!target || typeof target !== "object") {
+    throw new Error("Relay target must be an explicit local target object.");
+  }
+  const policy = mergeTargetPolicy(policyInput);
+  const host = normalizeTargetHost(target.host);
+  if (!host) {
+    throw new Error(`Invalid relay target host: ${target.host}`);
+  }
+  if (!Number.isInteger(target.port) || target.port < 1 || target.port > 65535) {
+    throw new Error(`Invalid relay target port: ${target.port}`);
+  }
+  const protocol = target.protocol ?? "http";
+  if (protocol !== "http" && protocol !== "https") {
+    throw new Error(`Invalid relay target protocol: ${String(protocol)}`);
+  }
+  if (policy.blockedPorts.includes(target.port)) {
+    throw new Error(`Relay target port is blocked: ${target.port}`);
+  }
+  const allowedHosts = new Set(policy.allowedHosts.map((allowedHost) => normalizeTargetHost(allowedHost)).filter((value) => Boolean(value)));
+  if (!allowedHosts.has(host)) {
+    throw new Error(`Relay target host is not explicitly allowed: ${host}`);
+  }
+  if (!policy.allowPrivateNetworkTargets && !isLocalTargetHost(host) && (host === "::1" || isPrivateIpv4(host))) {
+    throw new Error(`Private-network relay target requires explicit opt-in: ${host}`);
   }
   return {
-    provider,
-    strategy: typeof input === "string" ? DEFAULT_GHOST_TUNNEL_ADAPTER_STRATEGY : parseGhostTunnelAdapterStrategy(input.strategy)
+    protocol,
+    host,
+    port: target.port
   };
 }
-function getLegacyGhostTunnelTransport(input) {
-  if (!input || typeof input === "string" || !("transport" in input)) return void 0;
-  return input.transport;
+function authenticateRelayAgentToken(input) {
+  const expected = `Bearer ${input.agentToken}`;
+  return typeof input.authorizationHeader === "string" && secureEqual(input.authorizationHeader, expected);
 }
-function resolveGhostTunnelTransport(input) {
-  if (!input) {
-    return { kind: "none" };
+function signRelayRouteClaim(claim, signingSecret) {
+  const payload = {
+    ...claim,
+    host: assertExactRelayHost(claim.host)
+  };
+  if (!payload.scope) throw new Error("Relay route claim requires a scope.");
+  if (!payload.agentId) throw new Error("Relay route claim requires an agentId.");
+  if (Number.isNaN(Date.parse(payload.expiresAt))) throw new Error("Relay route claim requires a valid expiresAt.");
+  const encodedPayload = base64UrlEncode(JSON.stringify(payload));
+  const signature = signPayload(encodedPayload, signingSecret);
+  return {
+    payload,
+    token: `${encodedPayload}.${signature}`
+  };
+}
+function verifyRelayRouteClaim(token, signingSecret, options) {
+  const [encodedPayload, signature] = token.split(".");
+  if (!encodedPayload || !signature || token.split(".").length !== 2) {
+    throw new Error("Invalid relay route claim token.");
   }
-  const kind = typeof input === "string" ? parseGhostTunnelTransportKind(input) : parseGhostTunnelTransportKind(input.kind);
-  if (kind === "ip") {
-    return {
-      kind,
-      allowPrivateNetworkAddress: typeof input === "string" ? false : input.kind === "ip" ? input.allowPrivateNetworkAddress ?? false : false
-    };
+  const expectedSignature = signPayload(encodedPayload, signingSecret);
+  if (!secureEqual(signature, expectedSignature)) {
+    throw new Error("Invalid relay route claim signature.");
   }
-  if (kind === "tunnel") {
-    const config = typeof input === "string" || input.kind !== "tunnel" ? void 0 : input;
-    const store = config?.store ?? {};
-    return {
-      kind,
-      store: {
-        provider: parseTunnelStoreProvider(store.provider),
-        env: parseTunnelStoreEnv(store.env),
-        namespace: parseTunnelStoreNamespace(store.namespace)
-      },
-      waitMs: parsePositiveInteger(config?.waitMs, DEFAULT_GHOST_TUNNEL_TUNNEL_WAIT_MS, "tunnel waitMs"),
-      pollIntervalMs: parsePositiveInteger(config?.pollIntervalMs, DEFAULT_GHOST_TUNNEL_TUNNEL_POLL_INTERVAL_MS, "tunnel pollIntervalMs"),
-      routeTtlSeconds: parsePositiveInteger(config?.routeTtlSeconds, DEFAULT_GHOST_TUNNEL_TUNNEL_ROUTE_TTL_SECONDS, "tunnel routeTtlSeconds"),
-      requestTtlSeconds: parsePositiveInteger(config?.requestTtlSeconds, DEFAULT_GHOST_TUNNEL_TUNNEL_REQUEST_TTL_SECONDS, "tunnel requestTtlSeconds"),
-      maxRequestBodyBytes: parsePositiveInteger(config?.maxRequestBodyBytes, DEFAULT_GHOST_TUNNEL_TUNNEL_MAX_REQUEST_BODY_BYTES, "tunnel maxRequestBodyBytes"),
-      maxResponseBodyBytes: parsePositiveInteger(config?.maxResponseBodyBytes, DEFAULT_GHOST_TUNNEL_TUNNEL_MAX_RESPONSE_BODY_BYTES, "tunnel maxResponseBodyBytes")
-    };
+  const parsed = JSON.parse(base64UrlDecode(encodedPayload));
+  const host = assertExactRelayHost(parsed.host);
+  if (parsed.scope !== options.expectedScope) {
+    throw new Error("Relay route claim scope mismatch.");
   }
-  return { kind: "none" };
-}
-function resolveNamespaceConfig(options) {
-  const tags = isNamespaceTagList(options) ? [...options] : [...options?.tags ?? DEFAULT_GHOST_TUNNEL_NAMESPACE_TAGS];
-  let separator = DEFAULT_GHOST_TUNNEL_NAMESPACE_SEPARATOR;
-  let spreadTag = tags.includes("project") ? "project" : void 0;
-  if (options && !isNamespaceTagList(options)) {
-    separator = options.separator ?? DEFAULT_GHOST_TUNNEL_NAMESPACE_SEPARATOR;
-    spreadTag = options.spreadTag === false ? false : options.spreadTag ?? spreadTag;
+  const now = options.now ?? /* @__PURE__ */ new Date();
+  if (Date.parse(parsed.expiresAt) <= now.getTime()) {
+    throw new Error("Relay route claim has expired.");
   }
-  if (tags.length === 0) {
-    throw new Error("Ghost tunnel namespace must include at least one tag.");
+  if (!parsed.agentId) {
+    throw new Error("Relay route claim requires an agentId.");
   }
-  for (const tag of tags) {
-    if (!isValidNamespaceTag(tag)) {
-      throw new Error(`Invalid ghost tunnel namespace tag: ${tag}`);
-    }
+  return { ...parsed, host };
+}
+function createRelayRouteRegistration(input) {
+  if (!authenticateRelayAgentToken({
+    agentToken: input.agentToken,
+    ...typeof input.authorizationHeader !== "undefined" ? { authorizationHeader: input.authorizationHeader } : {}
+  })) {
+    throw new Error("Relay route registration requires an authenticated local agent.");
   }
-  if (spreadTag && !tags.includes(spreadTag)) {
-    throw new Error(`Ghost tunnel namespace spreadTag must be listed in tags: ${spreadTag}`);
+  const claim = verifyRelayRouteClaim(input.claimToken, input.signingSecret, {
+    expectedScope: input.expectedScope,
+    ...input.now ? { now: input.now } : {}
+  });
+  const target = assertRelayLocalTarget(input.target, input.targetPolicy);
+  const access = input.publicMode === true ? "public" : input.access ?? "private";
+  const passwordProtected = input.passwordProtected ?? false;
+  const authRequired = input.authRequired ?? false;
+  if (access === "public" && input.publicMode !== true) {
+    throw new Error("Relay public mode must be explicitly enabled.");
   }
-  if (!separator || separator.length > 8 || !/^[a-z0-9-]+$/.test(separator)) {
-    throw new Error(`Invalid ghost tunnel namespace separator: ${separator}`);
+  if (access === "private" && !passwordProtected && !authRequired) {
+    throw new Error("Private relay previews require password or auth.");
   }
   return {
-    tags,
-    separator,
-    ...spreadTag ? { spreadTag } : {}
+    host: claim.host,
+    scope: claim.scope,
+    agentId: claim.agentId,
+    expiresAt: claim.expiresAt,
+    target,
+    access,
+    passwordProtected,
+    authRequired,
+    limits: mergeLimits(input.limits)
   };
 }
-function normalizeNamespaceValue(tag, value, separator, options = {}) {
-  const normalized = normalizeDomain(value);
-  if (!normalized || normalized.includes(".")) {
-    throw new Error(`Invalid ghost tunnel namespace value for ${tag}: ${value}`);
+function isRelayRouteActive(route, options) {
+  if (!options.agentConnected) return false;
+  return Date.parse(route.expiresAt) > (options.now ?? /* @__PURE__ */ new Date()).getTime();
+}
+function stripRelayForwardHeaders(headers) {
+  const stripped = {};
+  for (const [name, value] of Object.entries(headers)) {
+    if (typeof value === "undefined") continue;
+    const lowerName = name.toLowerCase();
+    if (HOP_BY_HOP_HEADERS.has(lowerName)) continue;
+    if (lowerName.startsWith("x-localghost-")) continue;
+    stripped[name] = value;
   }
-  if (!options.allowSeparator && normalized.includes(separator)) {
-    throw new Error(`Ghost tunnel namespace value for ${tag} cannot include separator "${separator}": ${value}`);
+  return stripped;
+}
+function redactRelayHeaders(headers) {
+  const redacted = {};
+  for (const [name, value] of Object.entries(headers)) {
+    if (typeof value === "undefined") continue;
+    redacted[name] = SENSITIVE_HEADERS.has(name.toLowerCase()) ? "[redacted]" : value;
   }
-  return normalized;
+  return redacted;
 }
-function createNamespaceSlug(config, values) {
-  const parts = config.tags.map((tag) => {
-    const value = values[tag];
-    if (!value) {
-      throw new Error(`Missing ghost tunnel namespace value: ${tag}`);
+function redactRelayLogUrl(input) {
+  const url = new URL(input, "http://localghost.invalid");
+  for (const key of [...url.searchParams.keys()]) {
+    if (TOKEN_QUERY_PATTERN.test(key)) {
+      url.searchParams.set(key, "[redacted]");
     }
-    return normalizeNamespaceValue(tag, value, config.separator, { allowSeparator: tag === config.spreadTag });
-  });
-  const slug = parts.join(config.separator);
-  if (!isValidHostLabel(slug)) {
-    throw new Error(`Ghost tunnel namespace is too long for a DNS label: ${slug}`);
   }
-  return slug;
+  return input.startsWith("http://") || input.startsWith("https://") ? url.toString() : `${url.pathname}${url.search}`;
 }
-function createNamespaceDisplaySlug(config, values = {}) {
-  return config.tags.map((tag) => {
-    const value = values[tag];
-    if (!value) return `<${tag}>`;
-    try {
-      return normalizeNamespaceValue(tag, value, config.separator, { allowSeparator: tag === config.spreadTag });
-    } catch {
-      return `<${tag}>`;
-    }
-  }).join(config.separator);
-}
-function getPreviewDefaults(preview, defaults) {
+function renderRelayOfflineResponse() {
   return {
-    domain: preview?.domain ?? defaults?.domain,
-    route: preview?.route ?? defaults?.route,
-    project: preview?.project ?? defaults?.project,
-    owner: preview?.owner ?? defaults?.owner,
-    values: {
-      ...defaults?.values ?? {},
-      ...preview?.values ?? {}
+    status: 503,
+    headers: {
+      "content-type": "text/html; charset=utf-8",
+      "cache-control": "no-store"
     },
-    path: preview?.path,
-    protocol: preview?.protocol
+    body: [
+      "<!doctype html>",
+      "<html>",
+      '<head><meta charset="utf-8"><title>Preview offline</title></head>',
+      "<body><h1>Preview offline</h1><p>The local agent is not connected. Try again later.</p></body>",
+      "</html>"
+    ].join("")
   };
 }
-function getDisplayValues(input) {
+
+// packages/ghost-tunnel/src/ghost-file.ts
+import { existsSync as existsSync3, readFileSync as readFileSync3, readdirSync as readdirSync2 } from "fs";
+import { basename as basename2, resolve as resolve2 } from "path";
+var LOCALGHOST_GHOST_TUNNEL_FILE = ".ghosttunnel";
+function getCandidates(options) {
+  const exact = [.../* @__PURE__ */ new Set([...options.fileName ? [options.fileName] : [], ...options.configFiles ?? []])];
+  const pattern = options.configPattern ? readdirSync2(options.cwd ?? process.cwd(), { withFileTypes: true }).filter((entry) => entry.isFile()).map((entry) => entry.name).filter((name) => {
+    const matcher = typeof options.configPattern === "string" ? new RegExp(options.configPattern) : options.configPattern;
+    if (!matcher) return false;
+    matcher.lastIndex = 0;
+    return matcher.test(name);
+  }).sort() : [];
+  if (exact.length > 0 || pattern.length > 0) return [.../* @__PURE__ */ new Set([...exact, ...pattern])];
+  return [LOCALGHOST_GHOST_TUNNEL_FILE];
+}
+function parseGhostTunnelEntries(input, fileName) {
+  const entries = [];
+  input.split(/\r?\n/).forEach((rawLine, index) => {
+    const line = rawLine.replace(/#.*/, "").trim();
+    if (!line) return;
+    const parts = line.split(/\s+/);
+    const host = parts[0];
+    const portRaw = parts[1];
+    if (!host || !portRaw || parts.length > 2) {
+      throw new Error(`Invalid ${fileName} line ${index + 1}: "${rawLine}"`);
+    }
+    if (!/^(?=.{1,253}$)(?!-)[a-z0-9-]+(\.[a-z0-9-]+)*\.?$/i.test(host)) {
+      throw new Error(`Invalid host on line ${index + 1}: "${host}"`);
+    }
+    const port = Number(portRaw);
+    if (!Number.isInteger(port) || port < 1 || port > 65535) {
+      throw new Error(`Invalid port on line ${index + 1}: "${portRaw}"`);
+    }
+    entries.push({ host: host.toLowerCase().replace(/\.$/, ""), port, target: `127.0.0.1:${port}` });
+  });
+  return entries;
+}
+function toGhostTunnelOptions(options = {}) {
+  const resolved = typeof options === "string" ? { cwd: options } : options;
   return {
-    ...input.route ? { route: input.route } : {},
-    ...input.project ? { project: input.project } : {},
-    ...input.owner ? { owner: input.owner } : {},
-    ...input.values
+    ...resolved,
+    fileName: resolved.fileName ?? LOCALGHOST_GHOST_TUNNEL_FILE
   };
 }
-function getDisplayDefaults(defaults) {
-  return defaults;
+function normalizeHost2(value) {
+  return value.trim().toLowerCase().replace(/\.$/, "");
 }
-function createDisplayUrl(config, defaults, domain) {
-  const input = getPreviewDefaults(config.preview, getDisplayDefaults(defaults));
-  const protocol = input.protocol ?? "https";
-  const slug = createNamespaceDisplaySlug(config.namespace, getDisplayValues(input));
-  const entryHost = domain ? getGhostTunnelEntryHost(domain, config) : input.domain ? getGhostTunnelEntryHost(input.domain, config) : `${config.subdomain}.*`;
-  const url = `${protocol}://${slug}.${entryHost}/`;
-  if (!input.path) return url;
-  return `${url}${input.path.replace(/^\/+/, "")}`;
+function resolveGhostTunnelPath(options = {}) {
+  const resolved = toGhostTunnelOptions(options);
+  const cwd = resolved.cwd ?? process.cwd();
+  const searchedFiles = getCandidates(resolved);
+  for (const fileName2 of searchedFiles) {
+    const path = resolve2(cwd, fileName2);
+    if (existsSync3(path)) return { path, fileName: basename2(fileName2), exists: true, searchedFiles };
+  }
+  const fileName = searchedFiles[0] ?? LOCALGHOST_GHOST_TUNNEL_FILE;
+  return { path: resolve2(cwd, fileName), fileName: basename2(fileName), exists: false, searchedFiles };
 }
-function createDisplayUrls(config, defaults) {
-  const displayDefaults = getDisplayDefaults(defaults);
-  const domains = config.domains.length > 0 ? config.domains : displayDefaults?.domain ? [displayDefaults.domain] : [];
-  const urls = domains.length > 0 ? domains.map((domain) => createDisplayUrl(config, displayDefaults, domain)) : [createDisplayUrl(config, displayDefaults)];
-  return [...new Set(urls)];
+function getGhostTunnelPath(options = {}) {
+  return resolveGhostTunnelPath(options).path;
 }
-function maybeConstructPreviewUrl(config, defaults) {
-  if (!config.preview) return void 0;
-  const input = getPreviewDefaults(config.preview, defaults);
-  if (!input.domain || !input.route || !input.project || !input.owner) return void 0;
-  return constructGhostTunnelUrl({
-    domain: input.domain,
-    route: input.route,
-    project: input.project,
-    owner: input.owner,
-    values: input.values,
-    ...input.path ? { path: input.path } : {},
-    ...input.protocol ? { protocol: input.protocol } : {},
-    ghostTunnel: config
-  });
+function readGhostTunnelEntries(options = {}) {
+  const resolved = resolveGhostTunnelPath(options);
+  if (!resolved.exists) throw new Error(`Missing Ghost Tunnel file: ${resolved.path}`);
+  return parseGhostTunnelEntries(readFileSync3(resolved.path, "utf8"), resolved.fileName);
 }
-function parseNamespaceSlug(slug, config) {
-  const parts = slug.split(config.separator);
-  if (parts.length < config.tags.length) return null;
-  if (parts.length !== config.tags.length && !config.spreadTag) return null;
-  const namespace = {};
-  const spreadIndex = config.spreadTag ? config.tags.indexOf(config.spreadTag) : -1;
-  const spreadWidth = spreadIndex >= 0 ? parts.length - config.tags.length + 1 : 1;
-  let partIndex = 0;
-  for (const [tagIndex, tag] of config.tags.entries()) {
-    const value = tagIndex === spreadIndex ? parts.slice(partIndex, partIndex + spreadWidth).join(config.separator) : parts[partIndex];
-    if (!value || !isValidHostLabel(value)) return null;
-    if (tagIndex !== spreadIndex && value.includes(config.separator)) return null;
-    namespace[tag] = value;
-    partIndex += tagIndex === spreadIndex ? spreadWidth : 1;
-  }
-  return namespace;
+function listGhostTunnelEntries(options = {}) {
+  const resolved = resolveGhostTunnelPath(options);
+  if (!resolved.exists) return [];
+  return readGhostTunnelEntries(options);
 }
-function resolveGhostTunnelConfig(options, defaults) {
-  if (options === false || typeof options === "undefined") {
-    return {
-      enabled: false,
-      mode: DEFAULT_GHOST_TUNNEL_MODE,
-      domains: [],
-      subdomain: DEFAULT_GHOST_TUNNEL_SUBDOMAIN,
-      namespace: resolveNamespaceConfig(void 0),
-      displayUrls: [],
-      requireHttps: true,
-      requireAuth: true,
-      transport: resolveGhostTunnelTransport(void 0)
-    };
+function findGhostTunnelEntry(host, options = {}) {
+  const normalizedHost = normalizeHost2(host);
+  return listGhostTunnelEntries(options).find((entry) => entry.host === normalizedHost);
+}
+
+// packages/ghost-tunnel/src/ghost-transport.ts
+import { createHmac as createHmac2, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { isIP } from "net";
+var DEFAULT_GHOST_TUNNEL_TRANSPORT_QUERY_PARAM = "__localghost";
+var DEFAULT_GHOST_TUNNEL_IP_TRANSPORT_TTL_SECONDS = 10 * 60;
+function base64UrlEncode2(value) {
+  return Buffer.from(value).toString("base64url");
+}
+function base64UrlDecode2(value) {
+  return Buffer.from(value, "base64url").toString("utf8");
+}
+function signPayload2(payload, secret) {
+  return createHmac2("sha256", secret).update(payload).digest("base64url");
+}
+function secureEqual2(left, right) {
+  const leftBuffer = Buffer.from(left);
+  const rightBuffer = Buffer.from(right);
+  return leftBuffer.length === rightBuffer.length && timingSafeEqual2(leftBuffer, rightBuffer);
+}
+function isValidIpv42(value) {
+  return isIP(value) === 4;
+}
+function isPrivateIpv42(value) {
+  if (!isValidIpv42(value)) return false;
+  const [first = 0, second = 0] = value.split(".").map((part) => Number(part));
+  return first === 10 || first === 127 || first === 172 && second >= 16 && second <= 31 || first === 192 && second === 168 || first === 169 && second === 254;
+}
+function assertGhostTunnelIpAddress(address, allowPrivateNetworkAddress = false) {
+  const normalized = address.trim();
+  if (!isValidIpv42(normalized)) {
+    throw new Error(`Ghost tunnel IP transport requires a valid IPv4 address: ${address}`);
   }
-  const config = typeof options === "string" ? { mode: options } : options;
-  const subdomain = config.subdomain ?? DEFAULT_GHOST_TUNNEL_SUBDOMAIN;
-  assertValidSubdomain(subdomain);
-  const domains = normalizeDomains(config.domains);
-  const enabled = config.enabled ?? true;
-  const adapter = resolveGhostTunnelAdapter(config.adapter);
-  const transport = resolveGhostTunnelTransport(config.transport ?? getLegacyGhostTunnelTransport(config.adapter));
-  const resolved = {
-    enabled,
-    mode: parseGhostTunnelMode(config.mode),
-    domains,
-    subdomain,
-    namespace: resolveNamespaceConfig(config.namespace),
-    ...config.preview ? { preview: config.preview } : {},
-    displayUrls: [],
-    requireHttps: config.requireHttps ?? true,
-    requireAuth: config.requireAuth ?? true,
-    transport,
-    ...adapter ? { adapter } : {}
-  };
-  if (!enabled) {
-    return resolved;
+  if (!allowPrivateNetworkAddress && isPrivateIpv42(normalized)) {
+    throw new Error(`Ghost tunnel IP transport requires explicit private-network opt-in: ${normalized}`);
   }
-  const previewUrl = maybeConstructPreviewUrl(resolved, defaults);
-  const displayUrls = previewUrl ? [previewUrl] : createDisplayUrls(resolved, defaults);
-  return {
-    ...resolved,
-    displayUrls,
-    ...displayUrls[0] ? { displayUrl: displayUrls[0] } : {},
-    ...previewUrl ? { previewUrl } : {}
-  };
+  return normalized;
 }
-function getGhostTunnelEntryHost(domain, options = {}) {
-  const config = toGhostTunnelConfig(options);
-  const normalizedDomain = normalizeDomain(domain);
-  if (!normalizedDomain) {
-    throw new Error(`Invalid ghost tunnel domain: ${domain}`);
+function assertRelayProtocol(value) {
+  const protocol = value ?? "http";
+  if (protocol !== "http" && protocol !== "https") {
+    throw new Error(`Invalid ghost tunnel IP transport protocol: ${String(value)}`);
   }
-  return `${config.subdomain}.${normalizedDomain}`;
+  return protocol;
 }
-function getGhostTunnelWildcardHost(domain, options = {}) {
-  return `*.${getGhostTunnelEntryHost(domain, options)}`;
+function resolveTransportConfig(input) {
+  return resolveGhostTunnelConfig({
+    enabled: true,
+    ...typeof input !== "undefined" ? { transport: input } : {}
+  }).transport;
 }
-function constructGhostTunnelHost(input) {
-  const config = toGhostTunnelConfig(input.ghostTunnel ?? {});
-  if (!config.enabled) {
-    throw new Error("Ghost tunnel is not enabled.");
+function resolveExpiresAt(input, now = /* @__PURE__ */ new Date()) {
+  if (input.expiresAt) {
+    if (Number.isNaN(Date.parse(input.expiresAt))) {
+      throw new Error("Ghost tunnel IP transport requires a valid expiresAt value.");
+    }
+    return input.expiresAt;
   }
-  const namespaceValues = {
-    route: input.route,
-    project: input.project,
-    owner: input.owner,
-    ...input.values ?? {}
-  };
-  const slug = createNamespaceSlug(config.namespace, namespaceValues);
-  return `${slug}.${getGhostTunnelEntryHost(input.domain, config)}`;
-}
-function constructGhostTunnelUrl(input) {
-  const protocol = input.protocol ?? "https";
-  const host = constructGhostTunnelHost(input);
-  const url = new URL(`${protocol}://${host}/`);
-  if (input.path) {
-    url.pathname = `/${input.path.replace(/^\/+/, "")}`;
+  const ttlSeconds = input.ttlSeconds ?? DEFAULT_GHOST_TUNNEL_IP_TRANSPORT_TTL_SECONDS;
+  if (!Number.isInteger(ttlSeconds) || ttlSeconds < 1) {
+    throw new Error(`Ghost tunnel IP transport ttlSeconds must be a positive integer: ${ttlSeconds}`);
   }
-  if (input.searchParams instanceof URLSearchParams) {
-    url.search = input.searchParams.toString();
-  } else if (input.searchParams) {
-    for (const [key, value] of Object.entries(input.searchParams)) {
-      if (typeof value !== "undefined" && value !== null) {
-        url.searchParams.set(key, String(value));
-      }
-    }
+  return new Date(now.getTime() + ttlSeconds * 1e3).toISOString();
+}
+function getBaseGhostTunnelUrl(input) {
+  if ("url" in input) {
+    return new URL(input.url);
   }
-  return url.toString();
+  return new URL(constructGhostTunnelUrl(input));
 }
-var constructGhostTunnelURL = constructGhostTunnelUrl;
-function getGhostTunnelDefaultDisplayUrl(options = {}, defaults) {
-  const config = toGhostTunnelConfig(options);
-  if (!config.enabled) return null;
-  return createDisplayUrl(config, defaults);
+function signGhostTunnelIpTransportClaim(claim, signingSecret, options = {}) {
+  const payload = {
+    kind: "ip",
+    host: assertExactRelayHost(claim.host),
+    address: assertGhostTunnelIpAddress(claim.address, options.allowPrivateNetworkAddress),
+    protocol: assertRelayProtocol(claim.protocol),
+    expiresAt: resolveExpiresAt({ expiresAt: claim.expiresAt })
+  };
+  const encodedPayload = base64UrlEncode2(JSON.stringify(payload));
+  const signature = signPayload2(encodedPayload, signingSecret);
+  return {
+    payload,
+    token: `${encodedPayload}.${signature}`
+  };
 }
-function getGhostTunnelDisplayUrl(options, defaults) {
-  const config = toGhostTunnelConfig(options);
-  if (!config.enabled) return null;
-  return config.displayUrl ?? config.previewUrl ?? getGhostTunnelDefaultDisplayUrl(config, defaults);
+function verifyGhostTunnelIpTransportClaim(token, signingSecret, options) {
+  const [encodedPayload, signature] = token.split(".");
+  if (!encodedPayload || !signature || token.split(".").length !== 2) {
+    throw new Error("Invalid ghost tunnel IP transport token.");
+  }
+  const expectedSignature = signPayload2(encodedPayload, signingSecret);
+  if (!secureEqual2(signature, expectedSignature)) {
+    throw new Error("Invalid ghost tunnel IP transport signature.");
+  }
+  const parsed = JSON.parse(base64UrlDecode2(encodedPayload));
+  const host = assertExactRelayHost(parsed.host);
+  const expectedHost = assertExactRelayHost(options.host);
+  if (host !== expectedHost) {
+    throw new Error("Ghost tunnel IP transport host mismatch.");
+  }
+  const now = options.now ?? /* @__PURE__ */ new Date();
+  if (Number.isNaN(Date.parse(parsed.expiresAt)) || Date.parse(parsed.expiresAt) <= now.getTime()) {
+    throw new Error("Ghost tunnel IP transport token has expired.");
+  }
+  return {
+    kind: "ip",
+    host,
+    address: assertGhostTunnelIpAddress(parsed.address, options.allowPrivateNetworkAddress),
+    protocol: assertRelayProtocol(parsed.protocol),
+    expiresAt: parsed.expiresAt
+  };
 }
-function getGhostTunnelDisplayUrls(options, defaults) {
-  const config = toGhostTunnelConfig(options);
-  if (!config.enabled) return [];
-  if (config.displayUrls.length > 0) return config.displayUrls;
-  const displayUrl = getGhostTunnelDisplayUrl(config, defaults);
-  return displayUrl ? [displayUrl] : [];
+function constructGhostTunnelIpUrl(input) {
+  const baseUrl = getBaseGhostTunnelUrl(input);
+  const host = assertExactRelayHost(baseUrl.host);
+  const token = signGhostTunnelIpTransportClaim({
+    kind: "ip",
+    host,
+    address: input.address,
+    protocol: input.targetProtocol ?? "http",
+    expiresAt: resolveExpiresAt(input)
+  }, input.signingSecret, {
+    ...typeof input.allowPrivateNetworkAddress === "boolean" ? { allowPrivateNetworkAddress: input.allowPrivateNetworkAddress } : {}
+  }).token;
+  const queryParam = input.queryParam ?? DEFAULT_GHOST_TUNNEL_TRANSPORT_QUERY_PARAM;
+  baseUrl.searchParams.set(queryParam, token);
+  return baseUrl.toString();
 }
-function getGhostTunnelPreviewUrl(options) {
-  const config = toGhostTunnelConfig(options);
-  if (!config.enabled) return null;
-  return config.previewUrl ?? maybeConstructPreviewUrl(config) ?? null;
+function resolveGhostTunnelIpRedirect(input) {
+  const transport = resolveTransportConfig(input.transport);
+  if (transport.kind !== "ip") {
+    throw new Error(`Ghost tunnel transport is not configured for IP redirect: ${transport.kind}`);
+  }
+  const queryParam = input.queryParam ?? DEFAULT_GHOST_TUNNEL_TRANSPORT_QUERY_PARAM;
+  const requestUrl = new URL(input.requestUrl);
+  const token = requestUrl.searchParams.get(queryParam);
+  if (!token) {
+    throw new Error(`Ghost tunnel IP transport token is missing. Add ${queryParam}=... to the URL.`);
+  }
+  const claim = verifyGhostTunnelIpTransportClaim(token, input.signingSecret, {
+    host: input.host,
+    allowPrivateNetworkAddress: transport.allowPrivateNetworkAddress,
+    ...input.now ? { now: input.now } : {}
+  });
+  requestUrl.searchParams.delete(queryParam);
+  const target = assertRelayLocalTarget({
+    protocol: claim.protocol,
+    host: claim.address,
+    port: input.entryPort
+  }, {
+    allowedHosts: [claim.address],
+    allowPrivateNetworkTargets: transport.allowPrivateNetworkAddress
+  });
+  const redirectUrl = new URL(`${target.protocol}://${target.host}:${target.port}/`);
+  redirectUrl.pathname = requestUrl.pathname;
+  redirectUrl.search = requestUrl.searchParams.toString();
+  redirectUrl.hash = requestUrl.hash;
+  return {
+    claim,
+    queryParam,
+    target,
+    url: redirectUrl.toString()
+  };
 }
-function parseGhostTunnelHost(host, domain, options = {}) {
-  const config = toGhostTunnelConfig(options);
-  if (!config.enabled) return null;
-  const normalizedHost = normalizeDomain(host);
-  const normalizedDomain = normalizeDomain(domain);
-  if (!normalizedHost || !normalizedDomain) return null;
-  const entryHost = getGhostTunnelEntryHost(normalizedDomain, config);
-  const suffix = `.${entryHost}`;
-  if (!normalizedHost.endsWith(suffix)) return null;
-  const slug = normalizedHost.slice(0, -suffix.length);
-  if (!isValidHostLabel(slug)) return null;
-  const namespace = parseNamespaceSlug(slug, config.namespace);
-  if (!namespace) return null;
+
+// packages/ghost-tunnel/src/ghost-tunnel-store.ts
+import { randomUUID } from "crypto";
+var DEFAULT_GHOST_TUNNEL_RESPONSE_TTL_SECONDS = 60;
+function base64Encode(value) {
+  return value.toString("base64");
+}
+function encodeGhostTunnelBody(value) {
+  return base64Encode(Buffer.isBuffer(value) ? value : Buffer.from(value));
+}
+function decodeGhostTunnelBody(value) {
+  return value ? Buffer.from(value, "base64") : void 0;
+}
+function createGhostTunnelQueuedRequest(input) {
+  const now = input.now ?? /* @__PURE__ */ new Date();
+  const bodyBase64 = typeof input.body === "undefined" ? void 0 : encodeGhostTunnelBody(input.body);
+  return {
+    id: randomUUID(),
+    host: input.host,
+    method: input.method.toUpperCase(),
+    path: input.path,
+    headers: input.headers ?? {},
+    createdAt: now.toISOString(),
+    expiresAt: new Date(now.getTime() + input.ttlSeconds * 1e3).toISOString(),
+    ...bodyBase64 ? { bodyBase64 } : {}
+  };
+}
+function createGhostTunnelRouteHeartbeat(input) {
+  const now = input.now ?? /* @__PURE__ */ new Date();
+  return {
+    host: input.host,
+    agentId: input.agentId,
+    target: input.target,
+    updatedAt: now.toISOString(),
+    expiresAt: new Date(now.getTime() + input.ttlSeconds * 1e3).toISOString()
+  };
+}
+function isExpired(expiresAt, now = /* @__PURE__ */ new Date()) {
+  const timestamp = Date.parse(expiresAt);
+  return Number.isNaN(timestamp) || timestamp <= now.getTime();
+}
+function serializeJson(value) {
+  return JSON.stringify(value);
+}
+function parseJson(value) {
+  if (typeof value !== "string") return null;
+  try {
+    return JSON.parse(value);
+  } catch {
+    return null;
+  }
+}
+function keyPart(value) {
+  return value.toLowerCase().replace(/[^a-z0-9._:-]/g, "_");
+}
+function removeTrailingSlashes(value) {
+  let end = value.length;
+  while (end > 0 && value.charCodeAt(end - 1) === 47) end -= 1;
+  return value.slice(0, end);
+}
+var MemoryGhostTunnelStore = class {
+  routes = /* @__PURE__ */ new Map();
+  queues = /* @__PURE__ */ new Map();
+  responses = /* @__PURE__ */ new Map();
+  async heartbeatRoute(route) {
+    this.routes.set(route.host, route);
+  }
+  async getRoute(host) {
+    const route = this.routes.get(host);
+    if (!route) return null;
+    if (!isExpired(route.expiresAt)) return route;
+    this.routes.delete(host);
+    return null;
+  }
+  async enqueueRequest(request) {
+    const queue = this.queues.get(request.host) ?? [];
+    queue.push(request);
+    this.queues.set(request.host, queue);
+  }
+  async claimRequest(host) {
+    const queue = this.queues.get(host) ?? [];
+    while (queue.length > 0) {
+      const request = queue.shift();
+      if (request && !isExpired(request.expiresAt)) {
+        return request;
+      }
+    }
+    return null;
+  }
+  async writeResponse(response, ttlSeconds) {
+    this.responses.set(response.id, {
+      value: response,
+      expiresAt: new Date(Date.now() + ttlSeconds * 1e3).toISOString()
+    });
+  }
+  async readResponse(requestId) {
+    const response = this.responses.get(requestId);
+    if (!response) return null;
+    if (!isExpired(response.expiresAt)) return response.value;
+    this.responses.delete(requestId);
+    return null;
+  }
+  async cleanup(requestId) {
+    this.responses.delete(requestId);
+  }
+};
+function createMemoryGhostTunnelStore() {
+  return new MemoryGhostTunnelStore();
+}
+var RedisGhostTunnelStore = class {
+  url;
+  token;
+  namespace;
+  fetchImpl;
+  constructor(options) {
+    this.url = removeTrailingSlashes(options.url);
+    this.token = options.token;
+    this.namespace = options.namespace ?? "localghost";
+    this.fetchImpl = options.fetch ?? fetch;
+  }
+  key(kind, id) {
+    return `${this.namespace}:ghost-tunnel:${kind}:${keyPart(id)}`;
+  }
+  async command(command, ...args) {
+    const response = await this.fetchImpl(this.url, {
+      method: "POST",
+      headers: {
+        authorization: `Bearer ${this.token}`,
+        "content-type": "application/json"
+      },
+      body: JSON.stringify([command, ...args])
+    });
+    if (!response.ok) {
+      throw new Error(`Redis Ghost Tunnel command failed: ${response.status} ${response.statusText}`);
+    }
+    const payload = await response.json();
+    if (payload.error) {
+      throw new Error(`Redis Ghost Tunnel command failed: ${payload.error}`);
+    }
+    return typeof payload.result === "undefined" ? null : payload.result;
+  }
+  async heartbeatRoute(route, ttlSeconds) {
+    await this.command("SET", this.key("route", route.host), serializeJson(route), "EX", ttlSeconds);
+  }
+  async getRoute(host) {
+    const route = parseJson(await this.command("GET", this.key("route", host)));
+    return route && !isExpired(route.expiresAt) ? route : null;
+  }
+  async enqueueRequest(request, ttlSeconds) {
+    const queueKey = this.key("queue", request.host);
+    await this.command("RPUSH", queueKey, serializeJson(request));
+    await this.command("EXPIRE", queueKey, ttlSeconds);
+  }
+  async claimRequest(host) {
+    const queueKey = this.key("queue", host);
+    while (true) {
+      const request = parseJson(await this.command("LPOP", queueKey));
+      if (!request) return null;
+      if (!isExpired(request.expiresAt)) return request;
+    }
+  }
+  async writeResponse(response, ttlSeconds) {
+    await this.command("SET", this.key("response", response.id), serializeJson(response), "EX", ttlSeconds);
+  }
+  async readResponse(requestId) {
+    return parseJson(await this.command("GET", this.key("response", requestId)));
+  }
+  async cleanup(requestId) {
+    await this.command("DEL", this.key("response", requestId));
+  }
+};
+function createRedisGhostTunnelStore(options) {
+  return new RedisGhostTunnelStore(options);
+}
+function resolveRedisGhostTunnelEnv(env = process.env) {
+  const candidates = [
+    env.LOCALGHOST_REDIS_REST_URL && env.LOCALGHOST_REDIS_REST_TOKEN ? { url: env.LOCALGHOST_REDIS_REST_URL, token: env.LOCALGHOST_REDIS_REST_TOKEN, source: "localghost" } : null,
+    env.UPSTASH_REDIS_REST_URL && env.UPSTASH_REDIS_REST_TOKEN ? { url: env.UPSTASH_REDIS_REST_URL, token: env.UPSTASH_REDIS_REST_TOKEN, source: "upstash" } : null,
+    env.KV_REST_API_URL && env.KV_REST_API_TOKEN ? { url: env.KV_REST_API_URL, token: env.KV_REST_API_TOKEN, source: "vercel-kv" } : null,
+    env.REDIS_REST_API_URL && env.REDIS_REST_API_TOKEN ? { url: env.REDIS_REST_API_URL, token: env.REDIS_REST_API_TOKEN, source: "redis" } : null
+  ];
+  const match = candidates.find((candidate) => Boolean(candidate));
+  if (!match) {
+    throw new Error("Ghost Tunnel Redis transport requires REST env vars: UPSTASH_REDIS_REST_URL/UPSTASH_REDIS_REST_TOKEN, KV_REST_API_URL/KV_REST_API_TOKEN, or LOCALGHOST_REDIS_REST_URL/LOCALGHOST_REDIS_REST_TOKEN.");
+  }
+  return match;
+}
+function createRedisGhostTunnelStoreFromEnv(input = {}) {
+  const resolved = resolveRedisGhostTunnelEnv(input.env);
+  return createRedisGhostTunnelStore({
+    url: resolved.url,
+    token: resolved.token,
+    ...input.namespace ? { namespace: input.namespace } : {},
+    ...input.fetch ? { fetch: input.fetch } : {}
+  });
+}
+
+// packages/ghost-tunnel/src/ghost-agent.ts
+import { randomUUID as randomUUID2 } from "crypto";
+function isStopped(signal, localSignal) {
+  return localSignal.aborted || signal?.aborted === true;
+}
+function wait(ms, signal, localSignal) {
+  if (isStopped(signal, localSignal)) return Promise.resolve();
+  return new Promise((resolve6) => {
+    const timeout = setTimeout(resolve6, ms);
+    const stop = () => {
+      clearTimeout(timeout);
+      resolve6();
+    };
+    signal?.addEventListener("abort", stop, { once: true });
+    localSignal.addEventListener("abort", stop, { once: true });
+  });
+}
+function toHeaderRecord(headers) {
+  const result = {};
+  headers.forEach((value, name) => {
+    result[name] = value;
+  });
+  return result;
+}
+function hasRequestBody(method) {
+  return method !== "GET" && method !== "HEAD";
+}
+async function serveGhostTunnelLocalRequest(input) {
+  const fetchImpl = input.fetch ?? fetch;
+  const localUrl = new URL(`${input.target.protocol}://${input.target.host}:${input.target.port}/`);
+  const requestPath = new URL(input.request.path, "http://localghost.invalid");
+  localUrl.pathname = requestPath.pathname;
+  localUrl.search = requestPath.search;
+  try {
+    const body = hasRequestBody(input.request.method) ? decodeGhostTunnelBody(input.request.bodyBase64) : void 0;
+    const response = await fetchImpl(localUrl, {
+      method: input.request.method,
+      headers: {
+        ...stripRelayForwardHeaders(input.request.headers),
+        "x-forwarded-host": input.request.host,
+        "x-localghost-tunnel": "1"
+      },
+      ...body ? { body } : {}
+    });
+    const responseBody = Buffer.from(await response.arrayBuffer());
+    if (responseBody.byteLength > input.maxResponseBodyBytes) {
+      throw new Error(`Ghost Tunnel response exceeded ${input.maxResponseBodyBytes} bytes.`);
+    }
+    return {
+      id: input.request.id,
+      status: response.status,
+      headers: toHeaderRecord(response.headers),
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      ...responseBody.byteLength > 0 ? { bodyBase64: encodeGhostTunnelBody(responseBody) } : {}
+    };
+  } catch (error) {
+    return {
+      id: input.request.id,
+      status: 502,
+      headers: {
+        "content-type": "text/plain; charset=utf-8",
+        "cache-control": "no-store"
+      },
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      error: error instanceof Error ? error.message : String(error),
+      bodyBase64: encodeGhostTunnelBody("Ghost Tunnel local target failed.")
+    };
+  }
+}
+async function heartbeatRoutes(input) {
+  for (const entry of input.entries) {
+    const target = assertRelayLocalTarget({ host: input.targetHost, port: entry.port });
+    await input.store.heartbeatRoute(createGhostTunnelRouteHeartbeat({
+      host: entry.host,
+      agentId: input.agentId,
+      target,
+      ttlSeconds: input.routeTtlSeconds
+    }), input.routeTtlSeconds);
+  }
+}
+async function claimAndServe(input) {
+  const request = await input.store.claimRequest(input.entry.host);
+  if (!request) return false;
+  const target = assertRelayLocalTarget({ host: input.targetHost, port: input.entry.port });
+  const response = await serveGhostTunnelLocalRequest({
+    request,
+    target,
+    maxResponseBodyBytes: input.maxResponseBodyBytes,
+    ...input.fetch ? { fetch: input.fetch } : {}
+  });
+  await input.store.writeResponse(response, input.requestTtlSeconds);
+  return true;
+}
+function startGhostTunnelAgent(options) {
+  const controller = new AbortController();
+  const localSignal = controller.signal;
+  const signal = options.signal;
+  const agentId = options.agentId ?? `localghost-${randomUUID2()}`;
+  const targetHost = options.targetHost ?? "127.0.0.1";
+  const routeTtlSeconds = options.routeTtlSeconds ?? 30;
+  const requestTtlSeconds = options.requestTtlSeconds ?? 60;
+  const pollIntervalMs = options.pollIntervalMs ?? 500;
+  const maxResponseBodyBytes = options.maxResponseBodyBytes ?? 5 * 1024 * 1024;
+  const done = (async () => {
+    if (options.entries.length === 0) {
+      throw new Error("Ghost Tunnel agent requires at least one .ghosttunnel entry.");
+    }
+    options.log?.(`localghost tunnel agent ${agentId}`);
+    for (const entry of options.entries) {
+      options.log?.(`  ${entry.host} -> ${targetHost}:${entry.port}`);
+    }
+    let lastHeartbeat = 0;
+    while (!isStopped(signal, localSignal)) {
+      const now = Date.now();
+      if (now - lastHeartbeat >= Math.max(1e3, Math.floor(routeTtlSeconds * 1e3 / 3))) {
+        await heartbeatRoutes({
+          entries: options.entries,
+          store: options.store,
+          agentId,
+          targetHost,
+          routeTtlSeconds
+        });
+        lastHeartbeat = now;
+      }
+      let served = false;
+      for (const entry of options.entries) {
+        served = await claimAndServe({
+          entry,
+          store: options.store,
+          targetHost,
+          requestTtlSeconds,
+          maxResponseBodyBytes,
+          ...options.fetch ? { fetch: options.fetch } : {}
+        }) || served;
+      }
+      if (!served) {
+        await wait(pollIntervalMs, signal, localSignal);
+      }
+    }
+  })();
   return {
-    host: normalizedHost,
-    slug,
-    namespace,
-    entryHost,
-    wildcardHost: `*.${entryHost}`,
-    domain: normalizedDomain
+    agentId,
+    stop() {
+      controller.abort();
+    },
+    done
   };
 }
-function assertSecureGhostTunnelRequest(input) {
-  const config = toGhostTunnelConfig(input.ghostTunnel);
-  if (!config.enabled) {
-    throw new Error("Ghost tunnel is not enabled.");
-  }
-  if (config.requireHttps && input.protocol !== "https") {
-    throw new Error("Ghost tunnel requests must use HTTPS.");
-  }
-  if (config.requireAuth && input.authenticated !== true) {
-    throw new Error("Ghost tunnel requests must be authenticated.");
-  }
-  const route = parseGhostTunnelHost(input.host, input.domain, config);
-  if (!route) {
-    throw new Error(`Host is not a valid ghost tunnel host for ${input.domain}.`);
-  }
-  return route;
-}
 
-// src/ghost-transport.ts
-var DEFAULT_GHOST_TUNNEL_TRANSPORT_QUERY_PARAM = "__localghost";
-var DEFAULT_GHOST_TUNNEL_IP_TRANSPORT_TTL_SECONDS = 10 * 60;
-function base64UrlEncode2(value) {
-  return Buffer.from(value).toString("base64url");
+// packages/ghost-tunnel/src/ghost-request.ts
+function getGhostTunnelReadOptions(input) {
+  return {
+    ...input.cwd ? { cwd: input.cwd } : {},
+    ...input.ghostTunnelFile ? { fileName: input.ghostTunnelFile } : {}
+  };
 }
-function base64UrlDecode2(value) {
-  return Buffer.from(value, "base64url").toString("utf8");
+async function resolveGhostTunnelRequest(input) {
+  const configured = input.resolveGhostTunnel ? await input.resolveGhostTunnel({ domain: input.domain, ...input.cwd ? { cwd: input.cwd } : {} }) : input.ghostTunnel;
+  const ghostTunnel = typeof configured === "object" && configured !== null && "enabled" in configured ? configured : resolveGhostTunnelConfig(configured, {
+    domain: input.domain
+  });
+  const route = assertSecureGhostTunnelRequest({
+    host: input.host,
+    domain: input.domain,
+    protocol: input.protocol,
+    ghostTunnel,
+    ...typeof input.authenticated === "boolean" ? { authenticated: input.authenticated } : {}
+  });
+  const ghostTunnelPath = resolveGhostTunnelPath(getGhostTunnelReadOptions(input));
+  const entry = findGhostTunnelEntry(route.host, getGhostTunnelReadOptions(input));
+  const target = entry ? assertRelayLocalTarget({ host: "127.0.0.1", port: entry.port }) : void 0;
+  return {
+    route,
+    ghostTunnel,
+    ...entry ? { entry } : {},
+    ...target ? { target } : {},
+    ...ghostTunnelPath.exists ? { ghostTunnelPath: ghostTunnelPath.path } : {}
+  };
 }
-function signPayload2(payload, secret) {
-  return createHmac2("sha256", secret).update(payload).digest("base64url");
+function renderGhostTunnelRouteMissingResponse(resolved) {
+  return {
+    status: 404,
+    headers: {
+      "content-type": "text/html; charset=utf-8",
+      "cache-control": "no-store",
+      "x-localghost-relay": "missing",
+      "x-localghost-route": resolved.route.slug
+    },
+    body: [
+      "<!doctype html>",
+      "<html>",
+      '<head><meta charset="utf-8"><title>Ghost Tunnel route not configured</title></head>',
+      "<body>",
+      "<h1>Ghost Tunnel route not configured</h1>",
+      `<p>The wildcard host <code>${resolved.route.host}</code> reached the deployed Ghost Tunnel handler, but no exact <code>.ghosttunnel</code> entry matched it.</p>`,
+      "</body>",
+      "</html>"
+    ].join("")
+  };
 }
-function secureEqual2(left, right) {
-  const leftBuffer = Buffer.from(left);
-  const rightBuffer = Buffer.from(right);
-  return leftBuffer.length === rightBuffer.length && timingSafeEqual2(leftBuffer, rightBuffer);
+function renderGhostTunnelRelayOfflineResponse(resolved) {
+  const response = renderRelayOfflineResponse();
+  return {
+    ...response,
+    headers: {
+      ...response.headers,
+      "x-localghost-relay": "offline",
+      "x-localghost-route": resolved.route.slug,
+      "x-localghost-entry": resolved.entry ? "configured" : "missing"
+    },
+    body: [
+      "<!doctype html>",
+      "<html>",
+      '<head><meta charset="utf-8"><title>Ghost Tunnel offline</title></head>',
+      "<body>",
+      "<h1>Ghost Tunnel offline</h1>",
+      `<p>The wildcard host <code>${resolved.route.host}</code> reached the deployed Ghost Tunnel handler.</p>`,
+      resolved.entry ? "<p>The route is configured locally, but no active local relay connection is available yet.</p>" : "<p>No exact <code>.ghosttunnel</code> entry matched this host.</p>",
+      "</body>",
+      "</html>"
+    ].join("")
+  };
 }
-function isValidIpv42(value) {
-  return isIP(value) === 4;
+
+// packages/ghost-tunnel/src/vercel.ts
+function getHeaderValue(value) {
+  if (Array.isArray(value)) return value[0] ?? "";
+  return value ?? "";
 }
-function isPrivateIpv42(value) {
-  if (!isValidIpv42(value)) return false;
-  const [first = 0, second = 0] = value.split(".").map((part) => Number(part));
-  return first === 10 || first === 127 || first === 172 && second >= 16 && second <= 31 || first === 192 && second === 168 || first === 169 && second === 254;
+function getTrustedProtocol(request) {
+  const forwarded = getHeaderValue(request.headers["x-forwarded-proto"]).split(",")[0]?.trim().toLowerCase();
+  return forwarded === "http" ? "http" : "https";
 }
-function assertGhostTunnelIpAddress(address, allowPrivateNetworkAddress = false) {
-  const normalized = address.trim();
-  if (!isValidIpv42(normalized)) {
-    throw new Error(`Ghost tunnel IP transport requires a valid IPv4 address: ${address}`);
-  }
-  if (!allowPrivateNetworkAddress && isPrivateIpv42(normalized)) {
-    throw new Error(`Ghost tunnel IP transport requires explicit private-network opt-in: ${normalized}`);
-  }
-  return normalized;
+function getTrustedRequestUrl(request, host, protocol) {
+  return new URL(request.url ?? "/", `${protocol}://${host}`).toString();
 }
-function assertRelayProtocol(value) {
-  const protocol = value ?? "http";
-  if (protocol !== "http" && protocol !== "https") {
-    throw new Error(`Invalid ghost tunnel IP transport protocol: ${String(value)}`);
-  }
-  return protocol;
+function getTunnelRequestPath(request) {
+  const url = new URL(request.url ?? "/", "http://localghost.invalid");
+  return `${url.pathname}${url.search}`;
 }
-function resolveTransportConfig(input) {
-  return resolveGhostTunnelConfig({
-    enabled: true,
-    ...typeof input !== "undefined" ? { transport: input } : {}
-  }).transport;
+function normalizeRequestHeaders(headers) {
+  const stripped = stripRelayForwardHeaders(headers);
+  return Object.fromEntries(Object.entries(stripped).map(([name, value]) => [
+    name,
+    Array.isArray(value) ? value.join(", ") : value
+  ]));
 }
-function resolveExpiresAt(input, now = /* @__PURE__ */ new Date()) {
-  if (input.expiresAt) {
-    if (Number.isNaN(Date.parse(input.expiresAt))) {
-      throw new Error("Ghost tunnel IP transport requires a valid expiresAt value.");
+function getTunnelStore(options, namespace) {
+  return options.tunnelStore ?? createRedisGhostTunnelStoreFromEnv({
+    ...options.tunnelEnv ? { env: options.tunnelEnv } : {},
+    namespace
+  });
+}
+async function readRequestBody(request, maxBytes) {
+  if (!request[Symbol.asyncIterator]) return void 0;
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of request) {
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    size += buffer.byteLength;
+    if (size > maxBytes) {
+      throw new Error(`Ghost Tunnel request exceeded ${maxBytes} bytes.`);
     }
-    return input.expiresAt;
-  }
-  const ttlSeconds = input.ttlSeconds ?? DEFAULT_GHOST_TUNNEL_IP_TRANSPORT_TTL_SECONDS;
-  if (!Number.isInteger(ttlSeconds) || ttlSeconds < 1) {
-    throw new Error(`Ghost tunnel IP transport ttlSeconds must be a positive integer: ${ttlSeconds}`);
+    chunks.push(buffer);
   }
-  return new Date(now.getTime() + ttlSeconds * 1e3).toISOString();
+  return chunks.length > 0 ? Buffer.concat(chunks) : void 0;
 }
-function getBaseGhostTunnelUrl(input) {
-  if ("url" in input) {
-    return new URL(input.url);
+function writeResponse(response, payload) {
+  response.statusCode = payload.status;
+  for (const [name, value] of Object.entries(payload.headers)) {
+    response.setHeader(name, value);
   }
-  return new URL(constructGhostTunnelUrl(input));
+  response.end(payload.body);
 }
-function signGhostTunnelIpTransportClaim(claim, signingSecret, options = {}) {
-  const payload = {
-    kind: "ip",
-    host: assertExactRelayHost(claim.host),
-    address: assertGhostTunnelIpAddress(claim.address, options.allowPrivateNetworkAddress),
-    protocol: assertRelayProtocol(claim.protocol),
-    expiresAt: resolveExpiresAt({ expiresAt: claim.expiresAt })
+function renderGhostTunnelIpRedirectResponse(url) {
+  return {
+    status: 307,
+    headers: {
+      location: url,
+      "cache-control": "no-store",
+      "content-type": "text/html; charset=utf-8",
+      "x-localghost-relay": "ip"
+    },
+    body: [
+      "<!doctype html>",
+      "<html>",
+      '<head><meta charset="utf-8"><title>Redirecting to local preview</title></head>',
+      "<body>",
+      `<p>Redirecting to <a href="${url}">${url}</a>.</p>`,
+      "</body>",
+      "</html>"
+    ].join("")
   };
-  const encodedPayload = base64UrlEncode2(JSON.stringify(payload));
-  const signature = signPayload2(encodedPayload, signingSecret);
+}
+function renderGhostTunnelTransportRejectedResponse(message, status = 400) {
   return {
-    payload,
-    token: `${encodedPayload}.${signature}`
+    status,
+    headers: {
+      "content-type": "text/html; charset=utf-8",
+      "cache-control": "no-store",
+      "x-localghost-relay": "rejected"
+    },
+    body: [
+      "<!doctype html>",
+      "<html>",
+      '<head><meta charset="utf-8"><title>Ghost Tunnel transport rejected</title></head>',
+      "<body>",
+      "<h1>Ghost Tunnel transport rejected</h1>",
+      `<p>${message}</p>`,
+      "</body>",
+      "</html>"
+    ].join("")
+  };
+}
+function renderGhostTunnelTunnelTimeoutResponse() {
+  return {
+    status: 504,
+    headers: {
+      "content-type": "text/html; charset=utf-8",
+      "cache-control": "no-store",
+      "x-localghost-relay": "timeout"
+    },
+    body: [
+      "<!doctype html>",
+      "<html>",
+      '<head><meta charset="utf-8"><title>Ghost Tunnel timed out</title></head>',
+      "<body>",
+      "<h1>Ghost Tunnel timed out</h1>",
+      "<p>The deployed handler did not receive a local response before the request window closed.</p>",
+      "</body>",
+      "</html>"
+    ].join("")
   };
 }
-function verifyGhostTunnelIpTransportClaim(token, signingSecret, options) {
-  const [encodedPayload, signature] = token.split(".");
-  if (!encodedPayload || !signature || token.split(".").length !== 2) {
-    throw new Error("Invalid ghost tunnel IP transport token.");
-  }
-  const expectedSignature = signPayload2(encodedPayload, signingSecret);
-  if (!secureEqual2(signature, expectedSignature)) {
-    throw new Error("Invalid ghost tunnel IP transport signature.");
-  }
-  const parsed = JSON.parse(base64UrlDecode2(encodedPayload));
-  const host = assertExactRelayHost(parsed.host);
-  const expectedHost = assertExactRelayHost(options.host);
-  if (host !== expectedHost) {
-    throw new Error("Ghost tunnel IP transport host mismatch.");
-  }
-  const now = options.now ?? /* @__PURE__ */ new Date();
-  if (Number.isNaN(Date.parse(parsed.expiresAt)) || Date.parse(parsed.expiresAt) <= now.getTime()) {
-    throw new Error("Ghost tunnel IP transport token has expired.");
-  }
+function renderGhostTunnelQueuedResponse(response) {
+  const body = decodeGhostTunnelBody(response.bodyBase64)?.toString() ?? "";
   return {
-    kind: "ip",
-    host,
-    address: assertGhostTunnelIpAddress(parsed.address, options.allowPrivateNetworkAddress),
-    protocol: assertRelayProtocol(parsed.protocol),
-    expiresAt: parsed.expiresAt
+    status: response.status,
+    headers: {
+      ...response.headers,
+      "x-localghost-relay": response.error ? "target-error" : "tunnel"
+    },
+    body
   };
 }
-function constructGhostTunnelIpUrl(input) {
-  const baseUrl = getBaseGhostTunnelUrl(input);
-  const host = assertExactRelayHost(baseUrl.host);
-  const token = signGhostTunnelIpTransportClaim({
-    kind: "ip",
-    host,
-    address: input.address,
-    protocol: input.targetProtocol ?? "http",
-    expiresAt: resolveExpiresAt(input)
-  }, input.signingSecret, {
-    ...typeof input.allowPrivateNetworkAddress === "boolean" ? { allowPrivateNetworkAddress: input.allowPrivateNetworkAddress } : {}
-  }).token;
-  const queryParam = input.queryParam ?? DEFAULT_GHOST_TUNNEL_TRANSPORT_QUERY_PARAM;
-  baseUrl.searchParams.set(queryParam, token);
-  return baseUrl.toString();
-}
-function resolveGhostTunnelIpRedirect(input) {
-  const transport = resolveTransportConfig(input.transport);
-  if (transport.kind !== "ip") {
-    throw new Error(`Ghost tunnel transport is not configured for IP redirect: ${transport.kind}`);
+async function waitForTunnelResponse(input) {
+  const startedAt = Date.now();
+  while (Date.now() - startedAt < input.waitMs) {
+    const response = await input.store.readResponse(input.requestId);
+    if (response) {
+      await input.store.cleanup(input.requestId);
+      return response;
+    }
+    await new Promise((resolve6) => setTimeout(resolve6, input.pollIntervalMs));
   }
-  const queryParam = input.queryParam ?? DEFAULT_GHOST_TUNNEL_TRANSPORT_QUERY_PARAM;
-  const requestUrl = new URL(input.requestUrl);
-  const token = requestUrl.searchParams.get(queryParam);
-  if (!token) {
-    throw new Error(`Ghost tunnel IP transport token is missing. Add ${queryParam}=... to the URL.`);
+  return null;
+}
+async function resolveAuthenticatedState(input, request) {
+  if (typeof input === "function") {
+    return await input(request);
   }
-  const claim = verifyGhostTunnelIpTransportClaim(token, input.signingSecret, {
-    host: input.host,
-    allowPrivateNetworkAddress: transport.allowPrivateNetworkAddress,
-    ...input.now ? { now: input.now } : {}
-  });
-  requestUrl.searchParams.delete(queryParam);
-  const target = assertRelayLocalTarget({
-    protocol: claim.protocol,
-    host: claim.address,
-    port: input.entryPort
-  }, {
-    allowedHosts: [claim.address],
-    allowPrivateNetworkTargets: transport.allowPrivateNetworkAddress
-  });
-  const redirectUrl = new URL(`${target.protocol}://${target.host}:${target.port}/`);
-  redirectUrl.pathname = requestUrl.pathname;
-  redirectUrl.search = requestUrl.searchParams.toString();
-  redirectUrl.hash = requestUrl.hash;
-  return {
-    claim,
-    queryParam,
-    target,
-    url: redirectUrl.toString()
+  return input;
+}
+function createVercelGhostTunnelHandler(options) {
+  return async function handler(request, response) {
+    const host = getHeaderValue(request.headers.host);
+    const protocol = getTrustedProtocol(request);
+    try {
+      const authenticated = typeof options.authenticated !== "undefined" ? await resolveAuthenticatedState(options.authenticated, request) : void 0;
+      const resolved = await resolveGhostTunnelRequest({
+        ...options.cwd ? { cwd: options.cwd } : {},
+        ...typeof options.ghostTunnel !== "undefined" ? { ghostTunnel: options.ghostTunnel } : {},
+        ...options.resolveGhostTunnel ? { resolveGhostTunnel: options.resolveGhostTunnel } : {},
+        ...options.ghostTunnelFile ? { ghostTunnelFile: options.ghostTunnelFile } : {},
+        host,
+        domain: options.domain,
+        protocol,
+        ...typeof authenticated === "boolean" ? { authenticated } : {}
+      });
+      if (!resolved.entry) {
+        writeResponse(response, renderGhostTunnelRouteMissingResponse(resolved));
+        return;
+      }
+      if (resolved.ghostTunnel.transport.kind === "ip") {
+        if (!options.ipSigningSecret) {
+          writeResponse(response, renderGhostTunnelTransportRejectedResponse("Ghost Tunnel IP transport requires ipSigningSecret in the deployed handler.", 500));
+          return;
+        }
+        try {
+          const redirect = resolveGhostTunnelIpRedirect({
+            requestUrl: getTrustedRequestUrl(request, host, protocol),
+            host: resolved.route.host,
+            entryPort: resolved.entry.port,
+            signingSecret: options.ipSigningSecret,
+            transport: resolved.ghostTunnel.transport
+          });
+          writeResponse(response, renderGhostTunnelIpRedirectResponse(redirect.url));
+        } catch (error) {
+          const message = error instanceof Error ? error.message : String(error);
+          const status = /expired/i.test(message) ? 410 : 400;
+          writeResponse(response, renderGhostTunnelTransportRejectedResponse(message, status));
+        }
+        return;
+      }
+      if (resolved.ghostTunnel.transport.kind === "tunnel") {
+        const transport = resolved.ghostTunnel.transport;
+        const store = getTunnelStore(options, transport.store.namespace);
+        const route = await store.getRoute(resolved.route.host);
+        if (!route) {
+          writeResponse(response, renderGhostTunnelRelayOfflineResponse(resolved));
+          return;
+        }
+        try {
+          const requestBody = await readRequestBody(request, transport.maxRequestBodyBytes);
+          const queuedRequest = createGhostTunnelQueuedRequest({
+            host: resolved.route.host,
+            method: request.method ?? "GET",
+            path: getTunnelRequestPath(request),
+            headers: normalizeRequestHeaders(request.headers),
+            ...requestBody ? { body: requestBody } : {},
+            ttlSeconds: transport.requestTtlSeconds
+          });
+          await store.enqueueRequest(queuedRequest, transport.requestTtlSeconds);
+          const tunnelResponse = await waitForTunnelResponse({
+            store,
+            requestId: queuedRequest.id,
+            waitMs: transport.waitMs,
+            pollIntervalMs: transport.pollIntervalMs
+          });
+          writeResponse(response, tunnelResponse ? renderGhostTunnelQueuedResponse(tunnelResponse) : renderGhostTunnelTunnelTimeoutResponse());
+        } catch (error) {
+          const message = error instanceof Error ? error.message : String(error);
+          writeResponse(response, renderGhostTunnelTransportRejectedResponse(message, 400));
+        }
+        return;
+      }
+      writeResponse(response, renderGhostTunnelRelayOfflineResponse(resolved));
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      writeResponse(response, {
+        status: /authenticated/i.test(message) ? 401 : 404,
+        headers: {
+          "content-type": "text/plain; charset=utf-8",
+          "cache-control": "no-store",
+          "x-localghost-relay": "rejected"
+        },
+        body: message
+      });
+    }
   };
 }
 
@@ -1590,10 +1934,10 @@ import { dirname as dirname3, join as join3 } from "path";
 import { execa } from "execa";
 
 // src/fs.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "fs";
 import { dirname as dirname2 } from "path";
 function readTextFile(path) {
-  return readFileSync3(path, "utf8");
+  return readFileSync4(path, "utf8");
 }
 function writeTextFile(path, value) {
   mkdirSync2(dirname2(path), { recursive: true });
@@ -1689,20 +2033,20 @@ async function trustCaddy(path) {
 }
 
 // src/context.ts
-import { existsSync as existsSync3, readFileSync as readFileSync4 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync5 } from "fs";
 import { join as join5 } from "path";
 import { pathToFileURL } from "url";
 
 // src/port.ts
 import { createServer } from "net";
 async function isPortAvailable(port, host = "127.0.0.1") {
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     const server = createServer();
     server.once("error", () => {
-      resolve5(false);
+      resolve6(false);
     });
     server.once("listening", () => {
-      server.close(() => resolve5(true));
+      server.close(() => resolve6(true));
     });
     server.listen(port, host);
   });
@@ -1723,7 +2067,7 @@ async function findAvailablePort(startPort, options = {}) {
 import { randomUUID as randomUUID3 } from "crypto";
 import { mkdir, open, readFile, rename, rm, stat, unlink, writeFile } from "fs/promises";
 import { homedir as homedir2 } from "os";
-import { join as join4, normalize, resolve as resolve2 } from "path";
+import { join as join4, normalize, resolve as resolve3 } from "path";
 var LOCALGHOST_REGISTRY_FILE = "registry.json";
 var LOCALGHOST_REGISTRY_LOCK_FILE = "registry.lock";
 function defaultProcessRunning(pid) {
@@ -1736,10 +2080,10 @@ function defaultProcessRunning(pid) {
   }
 }
 function getLocalghostRegistryRoot(env = process.env) {
-  return resolve2(env.LOCALGHOST_HOME || join4(homedir2(), ".localghost"));
+  return resolve3(env.LOCALGHOST_HOME || join4(homedir2(), ".localghost"));
 }
 function canonicalizeLocalghostProjectCwd(cwd = process.cwd()) {
-  return normalize(resolve2(cwd));
+  return normalize(resolve3(cwd));
 }
 function emptyRegistry() {
   return { version: 1, allocations: [], leases: [] };
@@ -1755,6 +2099,9 @@ function validRegistry(value) {
 function pruneRegistry(registry, now, isRunning) {
   registry.leases = registry.leases.filter((lease) => lease.expiresAt > now && isRunning(lease.pid));
 }
+function isTestSessionKey(instanceKey) {
+  return instanceKey.startsWith("test:");
+}
 async function readJson(path) {
   try {
     return JSON.parse(await readFile(path, "utf8"));
@@ -1764,7 +2111,7 @@ async function readJson(path) {
   }
 }
 function createLocalghostRegistry(options = {}) {
-  const root = resolve2(options.stateRoot ?? getLocalghostRegistryRoot());
+  const root = resolve3(options.stateRoot ?? getLocalghostRegistryRoot());
   const registryPath = join4(root, LOCALGHOST_REGISTRY_FILE);
   const lockPath = join4(root, LOCALGHOST_REGISTRY_LOCK_FILE);
   const cwd = canonicalizeLocalghostProjectCwd(options.cwd);
@@ -1851,6 +2198,37 @@ function createLocalghostRegistry(options = {}) {
         await releaseLock();
       }
     },
+    async pruneTestSessions() {
+      const releaseLock = await lock();
+      try {
+        const registry = await readRegistry();
+        const staleTestKeys = new Set(
+          registry.leases.filter((lease) => isTestSessionKey(lease.instanceKey) && (lease.expiresAt <= now() || !isRunning(lease.pid))).map((lease) => leaseKey(lease.projectCwd, lease.instanceKey))
+        );
+        const beforeLeases = registry.leases.length;
+        registry.leases = registry.leases.filter((lease) => !staleTestKeys.has(leaseKey(lease.projectCwd, lease.instanceKey)));
+        const activeKeys = new Set(registry.leases.map((lease) => leaseKey(lease.projectCwd, lease.instanceKey)));
+        const beforeAllocations = registry.allocations.length;
+        registry.allocations = registry.allocations.filter(
+          (allocation) => !isTestSessionKey(allocation.instanceKey) || activeKeys.has(leaseKey(allocation.projectCwd, allocation.instanceKey))
+        );
+        await writeRegistry(registry);
+        return {
+          removedLeases: beforeLeases - registry.leases.length,
+          removedAllocations: beforeAllocations - registry.allocations.length
+        };
+      } finally {
+        await releaseLock();
+      }
+    },
+    async reset() {
+      const releaseLock = await lock();
+      try {
+        await writeRegistry({ version: 1, allocations: [], leases: [] });
+      } finally {
+        await releaseLock();
+      }
+    },
     async acquirePort(acquireOptions) {
       const projectCwd = canonicalizeLocalghostProjectCwd(acquireOptions.projectCwd ?? cwd);
       if (!acquireOptions.instanceKey) throw new Error("instanceKey is required");
@@ -1939,7 +2317,7 @@ function envHttps() {
 }
 function getPackageName(cwd) {
   try {
-    const pkg = JSON.parse(readFileSync4(join5(cwd, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync5(join5(cwd, "package.json"), "utf8"));
     return typeof pkg.name === "string" ? pkg.name : void 0;
   } catch {
     return void 0;
@@ -1998,7 +2376,7 @@ async function readLocalghostProjectConfig(options = {}) {
   const cwd = options.cwd ?? process.cwd();
   if (options.configFile === false) return { config: {} };
   const candidates = options.configFile ? [options.configFile] : LOCALGHOST_PROJECT_CONFIG_FILES;
-  const path = candidates.map((candidate) => resolveDevHostsPath({ cwd, fileName: candidate }).path).find((candidate) => existsSync3(candidate));
+  const path = candidates.map((candidate) => resolveDevHostsPath({ cwd, fileName: candidate }).path).find((candidate) => existsSync4(candidate));
   if (!path) return { config: {} };
   const imported = await import(`${pathToFileURL(path).href}?localghost=${Date.now()}`);
   const config = imported.default ?? imported;
@@ -2075,83 +2453,21 @@ async function resolveLocalghostContext(options = {}) {
     ...releasePort ? { releasePort } : {}
   };
 }
-
-// src/ghost-request.ts
-function getGhostTunnelReadOptions(input) {
-  return {
-    ...input.cwd ? { cwd: input.cwd } : {},
-    ...input.ghostTunnelFile ? { fileName: input.ghostTunnelFile } : {}
-  };
-}
-async function resolveGhostTunnelRequest(input) {
-  const projectConfig = await readLocalghostProjectConfig({
-    ...input.cwd ? { cwd: input.cwd } : {},
-    ...typeof input.localghostConfig !== "undefined" ? { configFile: input.localghostConfig } : {}
-  });
-  const ghostTunnel = resolveGhostTunnelConfig(projectConfig.config.ghostTunnel, {
-    domain: input.domain
-  });
-  const route = assertSecureGhostTunnelRequest({
-    host: input.host,
-    domain: input.domain,
-    protocol: input.protocol,
-    ghostTunnel,
-    ...typeof input.authenticated === "boolean" ? { authenticated: input.authenticated } : {}
-  });
-  const ghostTunnelPath = resolveGhostTunnelPath(getGhostTunnelReadOptions(input));
-  const entry = findGhostTunnelEntry(route.host, getGhostTunnelReadOptions(input));
-  const target = entry ? assertRelayLocalTarget({ host: "127.0.0.1", port: entry.port }) : void 0;
-  return {
-    route,
-    ghostTunnel,
-    ...entry ? { entry } : {},
-    ...target ? { target } : {},
-    ...projectConfig.path ? { projectConfigPath: projectConfig.path } : {},
-    ...ghostTunnelPath.exists ? { ghostTunnelPath: ghostTunnelPath.path } : {}
-  };
-}
-function renderGhostTunnelRouteMissingResponse(resolved) {
-  return {
-    status: 404,
-    headers: {
-      "content-type": "text/html; charset=utf-8",
-      "cache-control": "no-store",
-      "x-localghost-relay": "missing",
-      "x-localghost-route": resolved.route.slug
-    },
-    body: [
-      "<!doctype html>",
-      "<html>",
-      '<head><meta charset="utf-8"><title>Ghost Tunnel route not configured</title></head>',
-      "<body>",
-      "<h1>Ghost Tunnel route not configured</h1>",
-      `<p>The wildcard host <code>${resolved.route.host}</code> reached the deployed Ghost Tunnel handler, but no exact <code>.ghosttunnel</code> entry matched it.</p>`,
-      "</body>",
-      "</html>"
-    ].join("")
-  };
-}
-function renderGhostTunnelRelayOfflineResponse(resolved) {
-  const response = renderRelayOfflineResponse();
+
+// src/ghost-request.ts
+async function resolveGhostTunnelRequest2(input) {
+  const projectConfig = await readLocalghostProjectConfig({
+    ...input.cwd ? { cwd: input.cwd } : {},
+    ...typeof input.localghostConfig !== "undefined" ? { configFile: input.localghostConfig } : {}
+  });
+  const { localghostConfig: _localghostConfig, ...requestInput } = input;
+  const resolved = await resolveGhostTunnelRequest({
+    ...requestInput,
+    ...projectConfig.config.ghostTunnel ? { ghostTunnel: projectConfig.config.ghostTunnel } : {}
+  });
   return {
-    ...response,
-    headers: {
-      ...response.headers,
-      "x-localghost-relay": "offline",
-      "x-localghost-route": resolved.route.slug,
-      "x-localghost-entry": resolved.entry ? "configured" : "missing"
-    },
-    body: [
-      "<!doctype html>",
-      "<html>",
-      '<head><meta charset="utf-8"><title>Ghost Tunnel offline</title></head>',
-      "<body>",
-      "<h1>Ghost Tunnel offline</h1>",
-      `<p>The wildcard host <code>${resolved.route.host}</code> reached the deployed Ghost Tunnel handler.</p>`,
-      resolved.entry ? "<p>The route is configured locally, but no active local relay connection is available yet.</p>" : "<p>No exact <code>.ghosttunnel</code> entry matched this host.</p>",
-      "</body>",
-      "</html>"
-    ].join("")
+    ...resolved,
+    ...projectConfig.path ? { projectConfigPath: projectConfig.path } : {}
   };
 }
 
@@ -2223,15 +2539,15 @@ async function runDoctor(options = {}) {
 }
 
 // src/command.ts
-import { existsSync as existsSync4, readFileSync as readFileSync5 } from "fs";
-import { isAbsolute, join as join6, relative, resolve as resolve3 } from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync6 } from "fs";
+import { isAbsolute, join as join6, relative, resolve as resolve4 } from "path";
 function readPackageJson(cwd) {
   const path = join6(cwd, "package.json");
-  if (!existsSync4(path)) {
+  if (!existsSync5(path)) {
     throw new Error(`No package.json found in ${cwd}. Pass an explicit command with \`localghost run -- <command>\`.`);
   }
   try {
-    return JSON.parse(readFileSync5(path, "utf8"));
+    return JSON.parse(readFileSync6(path, "utf8"));
   } catch {
     throw new Error(`Could not parse ${path}.`);
   }
@@ -2241,9 +2557,9 @@ function detectDevPackageManager(cwd, packageManager) {
     const name = packageManager.split("@")[0];
     if (name === "npm" || name === "pnpm" || name === "yarn" || name === "bun") return name;
   }
-  if (existsSync4(join6(cwd, "pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync4(join6(cwd, "yarn.lock"))) return "yarn";
-  if (existsSync4(join6(cwd, "bun.lock")) || existsSync4(join6(cwd, "bun.lockb"))) return "bun";
+  if (existsSync5(join6(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync5(join6(cwd, "yarn.lock"))) return "yarn";
+  if (existsSync5(join6(cwd, "bun.lock")) || existsSync5(join6(cwd, "bun.lockb"))) return "bun";
   return "npm";
 }
 function scriptCommand(packageManager, script) {
@@ -2289,7 +2605,7 @@ function formatDetectedDevCommand(detected) {
   return `${command} (${source})`;
 }
 function assertServicePath(root, serviceCwd, name) {
-  const cwd = resolve3(root, serviceCwd);
+  const cwd = resolve4(root, serviceCwd);
   const relativeCwd = relative(root, cwd);
   if (isAbsolute(relativeCwd) || relativeCwd === ".." || relativeCwd.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`)) {
     throw new Error(`Service ${name} cwd must stay inside the project root.`);
@@ -2440,12 +2756,12 @@ async function removeSystemHosts(projectName) {
 }
 
 // src/init.ts
-import { existsSync as existsSync5, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "fs";
-import { dirname as dirname4, join as join8, resolve as resolve4 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "fs";
+import { dirname as dirname4, join as join8, resolve as resolve5 } from "path";
 function detectPackageManager(cwd = process.cwd()) {
-  if (existsSync5(join8(cwd, "pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync5(join8(cwd, "yarn.lock"))) return "yarn";
-  if (existsSync5(join8(cwd, "bun.lock")) || existsSync5(join8(cwd, "bun.lockb"))) return "bun";
+  if (existsSync6(join8(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync6(join8(cwd, "yarn.lock"))) return "yarn";
+  if (existsSync6(join8(cwd, "bun.lock")) || existsSync6(join8(cwd, "bun.lockb"))) return "bun";
   return "npm";
 }
 function packageRunCommand(packageManager, script) {
@@ -2472,7 +2788,7 @@ function renderConfig(options) {
 }
 function readPackageJson2(path) {
   try {
-    return JSON.parse(readFileSync6(path, "utf8"));
+    return JSON.parse(readFileSync7(path, "utf8"));
   } catch {
     return null;
   }
@@ -2540,7 +2856,7 @@ function initLocalghost(options = {}) {
   const packageManager = options.packageManager ?? detectPackageManager(cwd);
   const configFile = options.configFile ?? LOCALGHOST_CONFIG_FILE;
   const configPath = join8(cwd, configFile);
-  const configExists = existsSync5(configPath);
+  const configExists = existsSync6(configPath);
   if (configExists && !options.force) {
     return {
       configPath,
@@ -2561,7 +2877,7 @@ function initLocalghost(options = {}) {
   return {
     configPath,
     configCreated: true,
-    ...existsSync5(packageJsonPath) ? { packageJsonPath } : {},
+    ...existsSync6(packageJsonPath) ? { packageJsonPath } : {},
     packageJsonChanged,
     packageManager,
     nextSteps: [
@@ -2628,7 +2944,7 @@ async function createLocalghostTestSession(options) {
 
 // src/process.ts
 function signalManagedProcessPid(pid, signal, killProcess = (value, processSignal) => process.kill(value, processSignal)) {
-  if (typeof pid !== "number" || !Number.isInteger(pid) || pid < 1) return false;
+  if (typeof pid !== "number" || !Number.isInteger(pid) || pid <= 1 || pid === process.pid) return false;
   try {
     killProcess(process.platform === "win32" ? pid : -pid, signal);
     return true;
@@ -2709,7 +3025,7 @@ function formatGhostTunnel(config, options = {}) {
 }
 
 // src/state.ts
-import { existsSync as existsSync6 } from "fs";
+import { existsSync as existsSync7 } from "fs";
 import { join as join9 } from "path";
 var LOCALGHOST_STATE_FILE = "ops/local/localghost-state.json";
 function getLocalghostStatePath(cwd = process.cwd()) {
@@ -2717,7 +3033,7 @@ function getLocalghostStatePath(cwd = process.cwd()) {
 }
 function readLocalghostState(cwd = process.cwd()) {
   const path = getLocalghostStatePath(cwd);
-  if (!existsSync6(path)) return null;
+  if (!existsSync7(path)) return null;
   return JSON.parse(readTextFile(path));
 }
 function writeLocalghostState(cwd, state) {
@@ -2733,238 +3049,26 @@ function patchLocalghostState(cwd, patch) {
 }
 
 // src/vercel.ts
-function getHeaderValue(value) {
-  if (Array.isArray(value)) return value[0] ?? "";
-  return value ?? "";
-}
-function getTrustedProtocol(request) {
-  const forwarded = getHeaderValue(request.headers["x-forwarded-proto"]).split(",")[0]?.trim().toLowerCase();
-  return forwarded === "http" ? "http" : "https";
-}
-function getTrustedRequestUrl(request, host, protocol) {
-  return new URL(request.url ?? "/", `${protocol}://${host}`).toString();
-}
-function getTunnelRequestPath(request) {
-  const url = new URL(request.url ?? "/", "http://localghost.invalid");
-  return `${url.pathname}${url.search}`;
-}
-function normalizeRequestHeaders(headers) {
-  const stripped = stripRelayForwardHeaders(headers);
-  return Object.fromEntries(Object.entries(stripped).map(([name, value]) => [
-    name,
-    Array.isArray(value) ? value.join(", ") : value
-  ]));
-}
-function getTunnelStore(options, namespace) {
-  return options.tunnelStore ?? createRedisGhostTunnelStoreFromEnv({
-    ...options.tunnelEnv ? { env: options.tunnelEnv } : {},
-    namespace
-  });
-}
-async function readRequestBody(request, maxBytes) {
-  if (!request[Symbol.asyncIterator]) return void 0;
-  const chunks = [];
-  let size = 0;
-  for await (const chunk of request) {
-    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-    size += buffer.byteLength;
-    if (size > maxBytes) {
-      throw new Error(`Ghost Tunnel request exceeded ${maxBytes} bytes.`);
-    }
-    chunks.push(buffer);
-  }
-  return chunks.length > 0 ? Buffer.concat(chunks) : void 0;
-}
-function writeResponse(response, payload) {
-  response.statusCode = payload.status;
-  for (const [name, value] of Object.entries(payload.headers)) {
-    response.setHeader(name, value);
-  }
-  response.end(payload.body);
-}
-function renderGhostTunnelIpRedirectResponse(url) {
-  return {
-    status: 307,
-    headers: {
-      location: url,
-      "cache-control": "no-store",
-      "content-type": "text/html; charset=utf-8",
-      "x-localghost-relay": "ip"
-    },
-    body: [
-      "<!doctype html>",
-      "<html>",
-      '<head><meta charset="utf-8"><title>Redirecting to local preview</title></head>',
-      "<body>",
-      `<p>Redirecting to <a href="${url}">${url}</a>.</p>`,
-      "</body>",
-      "</html>"
-    ].join("")
-  };
-}
-function renderGhostTunnelTransportRejectedResponse(message, status = 400) {
-  return {
-    status,
-    headers: {
-      "content-type": "text/html; charset=utf-8",
-      "cache-control": "no-store",
-      "x-localghost-relay": "rejected"
-    },
-    body: [
-      "<!doctype html>",
-      "<html>",
-      '<head><meta charset="utf-8"><title>Ghost Tunnel transport rejected</title></head>',
-      "<body>",
-      "<h1>Ghost Tunnel transport rejected</h1>",
-      `<p>${message}</p>`,
-      "</body>",
-      "</html>"
-    ].join("")
-  };
-}
-function renderGhostTunnelTunnelTimeoutResponse() {
-  return {
-    status: 504,
-    headers: {
-      "content-type": "text/html; charset=utf-8",
-      "cache-control": "no-store",
-      "x-localghost-relay": "timeout"
-    },
-    body: [
-      "<!doctype html>",
-      "<html>",
-      '<head><meta charset="utf-8"><title>Ghost Tunnel timed out</title></head>',
-      "<body>",
-      "<h1>Ghost Tunnel timed out</h1>",
-      "<p>The deployed handler did not receive a local response before the request window closed.</p>",
-      "</body>",
-      "</html>"
-    ].join("")
-  };
-}
-function renderGhostTunnelQueuedResponse(response) {
-  const body = decodeGhostTunnelBody(response.bodyBase64)?.toString() ?? "";
-  return {
-    status: response.status,
-    headers: {
-      ...response.headers,
-      "x-localghost-relay": response.error ? "target-error" : "tunnel"
-    },
-    body
-  };
-}
-async function waitForTunnelResponse(input) {
-  const startedAt = Date.now();
-  while (Date.now() - startedAt < input.waitMs) {
-    const response = await input.store.readResponse(input.requestId);
-    if (response) {
-      await input.store.cleanup(input.requestId);
-      return response;
-    }
-    await new Promise((resolve5) => setTimeout(resolve5, input.pollIntervalMs));
-  }
-  return null;
-}
-async function resolveAuthenticatedState(input, request) {
-  if (typeof input === "function") {
-    return await input(request);
-  }
-  return input;
-}
-function createVercelGhostTunnelHandler(options) {
-  return async function handler(request, response) {
-    const host = getHeaderValue(request.headers.host);
-    const protocol = getTrustedProtocol(request);
-    try {
-      const authenticated = typeof options.authenticated !== "undefined" ? await resolveAuthenticatedState(options.authenticated, request) : void 0;
-      const resolved = await resolveGhostTunnelRequest({
-        ...options.cwd ? { cwd: options.cwd } : {},
-        ...typeof options.localghostConfig !== "undefined" ? { localghostConfig: options.localghostConfig } : {},
-        ...options.ghostTunnelFile ? { ghostTunnelFile: options.ghostTunnelFile } : {},
-        host,
-        domain: options.domain,
-        protocol,
-        ...typeof authenticated === "boolean" ? { authenticated } : {}
-      });
-      if (!resolved.entry) {
-        writeResponse(response, renderGhostTunnelRouteMissingResponse(resolved));
-        return;
-      }
-      if (resolved.ghostTunnel.transport.kind === "ip") {
-        if (!options.ipSigningSecret) {
-          writeResponse(response, renderGhostTunnelTransportRejectedResponse("Ghost Tunnel IP transport requires ipSigningSecret in the deployed handler.", 500));
-          return;
-        }
-        try {
-          const redirect = resolveGhostTunnelIpRedirect({
-            requestUrl: getTrustedRequestUrl(request, host, protocol),
-            host: resolved.route.host,
-            entryPort: resolved.entry.port,
-            signingSecret: options.ipSigningSecret,
-            transport: resolved.ghostTunnel.transport
-          });
-          writeResponse(response, renderGhostTunnelIpRedirectResponse(redirect.url));
-        } catch (error) {
-          const message = error instanceof Error ? error.message : String(error);
-          const status = /expired/i.test(message) ? 410 : 400;
-          writeResponse(response, renderGhostTunnelTransportRejectedResponse(message, status));
-        }
-        return;
-      }
-      if (resolved.ghostTunnel.transport.kind === "tunnel") {
-        const transport = resolved.ghostTunnel.transport;
-        const store = getTunnelStore(options, transport.store.namespace);
-        const route = await store.getRoute(resolved.route.host);
-        if (!route) {
-          writeResponse(response, renderGhostTunnelRelayOfflineResponse(resolved));
-          return;
-        }
-        try {
-          const requestBody = await readRequestBody(request, transport.maxRequestBodyBytes);
-          const queuedRequest = createGhostTunnelQueuedRequest({
-            host: resolved.route.host,
-            method: request.method ?? "GET",
-            path: getTunnelRequestPath(request),
-            headers: normalizeRequestHeaders(request.headers),
-            ...requestBody ? { body: requestBody } : {},
-            ttlSeconds: transport.requestTtlSeconds
-          });
-          await store.enqueueRequest(queuedRequest, transport.requestTtlSeconds);
-          const tunnelResponse = await waitForTunnelResponse({
-            store,
-            requestId: queuedRequest.id,
-            waitMs: transport.waitMs,
-            pollIntervalMs: transport.pollIntervalMs
-          });
-          writeResponse(response, tunnelResponse ? renderGhostTunnelQueuedResponse(tunnelResponse) : renderGhostTunnelTunnelTimeoutResponse());
-        } catch (error) {
-          const message = error instanceof Error ? error.message : String(error);
-          writeResponse(response, renderGhostTunnelTransportRejectedResponse(message, 400));
-        }
-        return;
-      }
-      writeResponse(response, renderGhostTunnelRelayOfflineResponse(resolved));
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      writeResponse(response, {
-        status: /authenticated/i.test(message) ? 401 : 404,
-        headers: {
-          "content-type": "text/plain; charset=utf-8",
-          "cache-control": "no-store",
-          "x-localghost-relay": "rejected"
-        },
-        body: message
+function createVercelGhostTunnelHandler2(options) {
+  const { localghostConfig, ...packageOptions } = options;
+  return createVercelGhostTunnelHandler({
+    ...packageOptions,
+    resolveGhostTunnel: async ({ cwd }) => {
+      const projectConfig = await readLocalghostProjectConfig({
+        ...cwd ? { cwd } : {},
+        ...typeof localghostConfig !== "undefined" ? { configFile: localghostConfig } : {}
       });
+      return projectConfig.config.ghostTunnel ?? false;
     }
-  };
+  });
 }
 
 // src/update-check.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync8, mkdirSync as mkdirSync3, readFileSync as readFileSync8, writeFileSync as writeFileSync5 } from "fs";
 import { homedir as homedir3 } from "os";
 import { dirname as dirname5, join as join10 } from "path";
 var LOCALGHOST_PACKAGE_NAME = "@hamedb89/localghost";
-var LOCALGHOST_VERSION = "0.5.0";
+var LOCALGHOST_VERSION = "0.6.2";
 var UPDATE_CHECK_CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
 var UPDATE_CHECK_NOTIFY_TTL_MS = 24 * 60 * 60 * 1e3;
 var UPDATE_CHECK_TIMEOUT_MS = 900;
@@ -2980,9 +3084,9 @@ function getUpdateCheckCachePath(env = process.env) {
   return join10(cacheRoot, "localghost", "update-check.json");
 }
 function readCache(path = getUpdateCheckCachePath()) {
-  if (!existsSync7(path)) return null;
+  if (!existsSync8(path)) return null;
   try {
-    return JSON.parse(readFileSync7(path, "utf8"));
+    return JSON.parse(readFileSync8(path, "utf8"));
   } catch {
     return null;
   }
@@ -3167,7 +3271,7 @@ export {
   createRedisGhostTunnelStore,
   createRedisGhostTunnelStoreFromEnv,
   createRelayRouteRegistration,
-  createVercelGhostTunnelHandler,
+  createVercelGhostTunnelHandler2 as createVercelGhostTunnelHandler,
   decodeGhostTunnelBody,
   defineLocalghostConfig,
   detectDevCommand,
@@ -3243,7 +3347,7 @@ export {
   resolveGhostTunnelConfig,
   resolveGhostTunnelIpRedirect,
   resolveGhostTunnelPath,
-  resolveGhostTunnelRequest,
+  resolveGhostTunnelRequest2 as resolveGhostTunnelRequest,
   resolveLocalghostContext,
   resolveRedisGhostTunnelEnv,
   runCaddy,