@jsenv/core 41.5.34 → 41.5.37

package/dist/start_build_server/jsenv_core_node_modules.js

@@ -47,7 +47,11 @@ function envForceColor() {
 		return 1;
 	}
 
-	const level = Math.min(Number.parseInt(env.FORCE_COLOR, 10), 3);
+	if (!/^\d+$/v.test(env.FORCE_COLOR)) {
+		return;
+	}
+
+	const level = Math.min(Number(env.FORCE_COLOR), 3);
 
 	if (![0, 1, 2, 3].includes(level)) {
 		return;
@@ -69,6 +73,7 @@ function translateLevel(level) {
 	};
 }
 
+// eslint-disable-next-line complexity -- Color support detection necessarily handles multiple environments.
 function _supportsColor(haveStream, {streamIsTTY, sniffFlags = true} = {}) {
 	const noFlagForceColor = envForceColor();
 	if (noFlagForceColor !== undefined) {
@@ -93,6 +98,11 @@ function _supportsColor(haveStream, {streamIsTTY, sniffFlags = true} = {}) {
 		}
 	}
 
+	// A numeric `FORCE_COLOR` requests an exact level, while `FORCE_COLOR=true` and `FORCE_COLOR=` only enable color and let the level be detected.
+	if (forceColor !== undefined && /^\d+$/v.test(env.FORCE_COLOR)) {
+		return forceColor;
+	}
+
 	// Check for Azure DevOps pipelines.
 	// Has to be above the `!streamIsTTY` check.
 	if ('TF_BUILD' in env && 'AGENT_NAME' in env) {
@@ -124,11 +134,11 @@ function _supportsColor(haveStream, {streamIsTTY, sniffFlags = true} = {}) {
 	}
 
 	if ('CI' in env) {
-		if (['GITHUB_ACTIONS', 'GITEA_ACTIONS', 'CIRCLECI'].some(key => key in env)) {
+		if (['GITHUB_ACTIONS', 'GITEA_ACTIONS', 'CIRCLECI'].some(key => Object.hasOwn(env, key))) {
 			return 3;
 		}
 
-		if (['TRAVIS', 'APPVEYOR', 'GITLAB_CI', 'BUILDKITE', 'DRONE'].some(sign => sign in env) || env.CI_NAME === 'codeship') {
+		if (['TRAVIS', 'APPVEYOR', 'GITLAB_CI', 'BUILDKITE', 'DRONE'].some(sign => Object.hasOwn(env, sign)) || env.CI_NAME === 'codeship') {
 			return 1;
 		}
 
@@ -136,7 +146,7 @@ function _supportsColor(haveStream, {streamIsTTY, sniffFlags = true} = {}) {
 	}
 
 	if ('TEAMCITY_VERSION' in env) {
-		return /^(9\.(0*[1-9]\d*)\.|\d{2,}\.)/.test(env.TEAMCITY_VERSION) ? 1 : 0;
+		return /^(?:9\.0*[1-9]\d*\.|\d{2,}\.)/v.test(env.TEAMCITY_VERSION) ? 1 : 0;
 	}
 
 	if (env.COLORTERM === 'truecolor') {
@@ -156,7 +166,7 @@ function _supportsColor(haveStream, {streamIsTTY, sniffFlags = true} = {}) {
 	}
 
 	if ('TERM_PROGRAM' in env) {
-		const version = Number.parseInt((env.TERM_PROGRAM_VERSION || '').split('.')[0], 10);
+		const version = Number((env.TERM_PROGRAM_VERSION || '').split('.', 1)[0]);
 
 		switch (env.TERM_PROGRAM) {
 			case 'iTerm.app': {
@@ -170,11 +180,11 @@ function _supportsColor(haveStream, {streamIsTTY, sniffFlags = true} = {}) {
 		}
 	}
 
-	if (/-256(color)?$/i.test(env.TERM)) {
+	if (/-256(?:color)?$/iv.test(env.TERM)) {
 		return 2;
 	}
 
-	if (/^screen|^xterm|^vt100|^vt220|^rxvt|color|ansi|cygwin|linux/i.test(env.TERM)) {
+	if (/^screen|^xterm|^vt100|^vt220|^rxvt|color|ansi|cygwin|linux/iv.test(env.TERM)) {
 		return 1;
 	}
 
@@ -231,7 +241,7 @@ const fullwidthRanges = [12288, 12288, 65281, 65376, 65504, 65510];
 
 const wideMinimalCodePoint = 4352;
 const wideMaximumCodePoint = 262141;
-const wideRanges = [4352, 4447, 8986, 8987, 9001, 9002, 9193, 9196, 9200, 9200, 9203, 9203, 9725, 9726, 9748, 9749, 9776, 9783, 9800, 9811, 9855, 9855, 9866, 9871, 9875, 9875, 9889, 9889, 9898, 9899, 9917, 9918, 9924, 9925, 9934, 9934, 9940, 9940, 9962, 9962, 9970, 9971, 9973, 9973, 9978, 9978, 9981, 9981, 9989, 9989, 9994, 9995, 10024, 10024, 10060, 10060, 10062, 10062, 10067, 10069, 10071, 10071, 10133, 10135, 10160, 10160, 10175, 10175, 11035, 11036, 11088, 11088, 11093, 11093, 11904, 11929, 11931, 12019, 12032, 12245, 12272, 12287, 12289, 12350, 12353, 12438, 12441, 12543, 12549, 12591, 12593, 12686, 12688, 12773, 12783, 12830, 12832, 12871, 12880, 42124, 42128, 42182, 43360, 43388, 44032, 55203, 63744, 64255, 65040, 65049, 65072, 65106, 65108, 65126, 65128, 65131, 94176, 94180, 94192, 94198, 94208, 101589, 101631, 101662, 101760, 101874, 110576, 110579, 110581, 110587, 110589, 110590, 110592, 110882, 110898, 110898, 110928, 110930, 110933, 110933, 110948, 110951, 110960, 111355, 119552, 119638, 119648, 119670, 126980, 126980, 127183, 127183, 127374, 127374, 127377, 127386, 127488, 127490, 127504, 127547, 127552, 127560, 127568, 127569, 127584, 127589, 127744, 127776, 127789, 127797, 127799, 127868, 127870, 127891, 127904, 127946, 127951, 127955, 127968, 127984, 127988, 127988, 127992, 128062, 128064, 128064, 128066, 128252, 128255, 128317, 128331, 128334, 128336, 128359, 128378, 128378, 128405, 128406, 128420, 128420, 128507, 128591, 128640, 128709, 128716, 128716, 128720, 128722, 128725, 128728, 128732, 128735, 128747, 128748, 128756, 128764, 128992, 129003, 129008, 129008, 129292, 129338, 129340, 129349, 129351, 129535, 129648, 129660, 129664, 129674, 129678, 129734, 129736, 129736, 129741, 129756, 129759, 129770, 129775, 129784, 131072, 196605, 196608, 262141];
+const wideRanges = [4352, 4447, 8986, 8987, 9001, 9002, 9193, 9196, 9200, 9200, 9203, 9203, 9725, 9726, 9748, 9749, 9776, 9783, 9800, 9811, 9855, 9855, 9866, 9871, 9875, 9875, 9889, 9889, 9898, 9899, 9917, 9918, 9924, 9925, 9934, 9934, 9940, 9940, 9962, 9962, 9970, 9971, 9973, 9973, 9978, 9978, 9981, 9981, 9989, 9989, 9994, 9995, 10024, 10024, 10060, 10060, 10062, 10062, 10067, 10069, 10071, 10071, 10133, 10135, 10160, 10160, 10175, 10175, 11035, 11036, 11088, 11088, 11093, 11093, 11904, 11929, 11931, 12019, 12032, 12245, 12272, 12287, 12289, 12350, 12353, 12438, 12441, 12543, 12549, 12591, 12593, 12686, 12688, 12773, 12783, 12830, 12832, 12871, 12880, 42124, 42128, 42182, 43360, 43388, 44032, 55203, 63744, 64255, 65040, 65049, 65072, 65106, 65108, 65126, 65128, 65131, 94176, 94180, 94192, 94198, 94208, 101594, 101631, 101664, 101760, 101874, 101888, 102801, 102816, 102866, 110576, 110579, 110581, 110587, 110589, 110590, 110592, 110888, 110898, 110898, 110928, 110930, 110933, 110933, 110948, 110952, 110960, 111355, 119552, 119638, 119648, 119670, 126980, 126980, 127183, 127183, 127374, 127374, 127377, 127386, 127406, 127406, 127488, 127490, 127504, 127547, 127552, 127560, 127568, 127569, 127584, 127589, 127744, 127776, 127789, 127797, 127799, 127868, 127870, 127891, 127904, 127946, 127951, 127955, 127968, 127984, 127988, 127988, 127992, 128062, 128064, 128064, 128066, 128252, 128255, 128317, 128331, 128334, 128336, 128359, 128378, 128378, 128405, 128406, 128420, 128420, 128507, 128591, 128640, 128709, 128716, 128716, 128720, 128722, 128725, 128729, 128732, 128735, 128747, 128748, 128756, 128764, 128986, 128986, 128992, 129003, 129008, 129008, 129292, 129338, 129340, 129349, 129351, 129535, 129648, 129660, 129664, 129734, 129736, 129736, 129740, 129757, 129759, 129771, 129775, 129786, 131072, 196605, 196608, 262141];
 
 /**
 Binary search on a sorted flat array of [start, end] pairs.
@@ -299,7 +309,7 @@ const isAmbiguous = codePoint => {
 	return isInRange(ambiguousRanges, codePoint);
 };
 
-const isFullWidth = codePoint => {
+const isFullwidth = codePoint => {
 	if (
 		codePoint < fullwidthMinimalCodePoint
 		|| codePoint > fullwidthMaximumCodePoint
@@ -338,7 +348,7 @@ function eastAsianWidth(codePoint, {ambiguousAsWide = false} = {}) {
 	validate(codePoint);
 
 	if (
-		isFullWidth(codePoint)
+		isFullwidth(codePoint)
 		|| isWide(codePoint)
 		|| (ambiguousAsWide && isAmbiguous(codePoint))
 	) {

package/dist/start_build_server/jsenv_core_packages.js

@@ -1461,7 +1461,8 @@ const startSpinner = ({
 
 const createTaskLog = (
   label,
-  { disabled = false, animated = true, stopOnWriteFromOutside } = {},
+  // animated defaults to what the spinner decides: only when stdout is a terminal
+  { disabled = false, animated, stopOnWriteFromOutside } = {},
 ) => {
   if (disabled) {
     return {
@@ -1471,7 +1472,7 @@ const createTaskLog = (
       fail: () => {},
     };
   }
-  if (animated && process.env.CAPTURING_SIDE_EFFECTS) {
+  if (process.env.CAPTURING_SIDE_EFFECTS) {
     animated = false;
   }
   const startMs = Date.now();

package/dist/start_dev_server/jsenv_core_node_modules.js

@@ -47,7 +47,11 @@ function envForceColor() {
 		return 1;
 	}
 
-	const level = Math.min(Number.parseInt(env.FORCE_COLOR, 10), 3);
+	if (!/^\d+$/v.test(env.FORCE_COLOR)) {
+		return;
+	}
+
+	const level = Math.min(Number(env.FORCE_COLOR), 3);
 
 	if (![0, 1, 2, 3].includes(level)) {
 		return;
@@ -69,6 +73,7 @@ function translateLevel(level) {
 	};
 }
 
+// eslint-disable-next-line complexity -- Color support detection necessarily handles multiple environments.
 function _supportsColor(haveStream, {streamIsTTY, sniffFlags = true} = {}) {
 	const noFlagForceColor = envForceColor();
 	if (noFlagForceColor !== undefined) {
@@ -93,6 +98,11 @@ function _supportsColor(haveStream, {streamIsTTY, sniffFlags = true} = {}) {
 		}
 	}
 
+	// A numeric `FORCE_COLOR` requests an exact level, while `FORCE_COLOR=true` and `FORCE_COLOR=` only enable color and let the level be detected.
+	if (forceColor !== undefined && /^\d+$/v.test(env.FORCE_COLOR)) {
+		return forceColor;
+	}
+
 	// Check for Azure DevOps pipelines.
 	// Has to be above the `!streamIsTTY` check.
 	if ('TF_BUILD' in env && 'AGENT_NAME' in env) {
@@ -124,11 +134,11 @@ function _supportsColor(haveStream, {streamIsTTY, sniffFlags = true} = {}) {
 	}
 
 	if ('CI' in env) {
-		if (['GITHUB_ACTIONS', 'GITEA_ACTIONS', 'CIRCLECI'].some(key => key in env)) {
+		if (['GITHUB_ACTIONS', 'GITEA_ACTIONS', 'CIRCLECI'].some(key => Object.hasOwn(env, key))) {
 			return 3;
 		}
 
-		if (['TRAVIS', 'APPVEYOR', 'GITLAB_CI', 'BUILDKITE', 'DRONE'].some(sign => sign in env) || env.CI_NAME === 'codeship') {
+		if (['TRAVIS', 'APPVEYOR', 'GITLAB_CI', 'BUILDKITE', 'DRONE'].some(sign => Object.hasOwn(env, sign)) || env.CI_NAME === 'codeship') {
 			return 1;
 		}
 
@@ -136,7 +146,7 @@ function _supportsColor(haveStream, {streamIsTTY, sniffFlags = true} = {}) {
 	}
 
 	if ('TEAMCITY_VERSION' in env) {
-		return /^(9\.(0*[1-9]\d*)\.|\d{2,}\.)/.test(env.TEAMCITY_VERSION) ? 1 : 0;
+		return /^(?:9\.0*[1-9]\d*\.|\d{2,}\.)/v.test(env.TEAMCITY_VERSION) ? 1 : 0;
 	}
 
 	if (env.COLORTERM === 'truecolor') {
@@ -156,7 +166,7 @@ function _supportsColor(haveStream, {streamIsTTY, sniffFlags = true} = {}) {
 	}
 
 	if ('TERM_PROGRAM' in env) {
-		const version = Number.parseInt((env.TERM_PROGRAM_VERSION || '').split('.')[0], 10);
+		const version = Number((env.TERM_PROGRAM_VERSION || '').split('.', 1)[0]);
 
 		switch (env.TERM_PROGRAM) {
 			case 'iTerm.app': {
@@ -170,11 +180,11 @@ function _supportsColor(haveStream, {streamIsTTY, sniffFlags = true} = {}) {
 		}
 	}
 
-	if (/-256(color)?$/i.test(env.TERM)) {
+	if (/-256(?:color)?$/iv.test(env.TERM)) {
 		return 2;
 	}
 
-	if (/^screen|^xterm|^vt100|^vt220|^rxvt|color|ansi|cygwin|linux/i.test(env.TERM)) {
+	if (/^screen|^xterm|^vt100|^vt220|^rxvt|color|ansi|cygwin|linux/iv.test(env.TERM)) {
 		return 1;
 	}
 
@@ -231,7 +241,7 @@ const fullwidthRanges = [12288, 12288, 65281, 65376, 65504, 65510];
 
 const wideMinimalCodePoint = 4352;
 const wideMaximumCodePoint = 262141;
-const wideRanges = [4352, 4447, 8986, 8987, 9001, 9002, 9193, 9196, 9200, 9200, 9203, 9203, 9725, 9726, 9748, 9749, 9776, 9783, 9800, 9811, 9855, 9855, 9866, 9871, 9875, 9875, 9889, 9889, 9898, 9899, 9917, 9918, 9924, 9925, 9934, 9934, 9940, 9940, 9962, 9962, 9970, 9971, 9973, 9973, 9978, 9978, 9981, 9981, 9989, 9989, 9994, 9995, 10024, 10024, 10060, 10060, 10062, 10062, 10067, 10069, 10071, 10071, 10133, 10135, 10160, 10160, 10175, 10175, 11035, 11036, 11088, 11088, 11093, 11093, 11904, 11929, 11931, 12019, 12032, 12245, 12272, 12287, 12289, 12350, 12353, 12438, 12441, 12543, 12549, 12591, 12593, 12686, 12688, 12773, 12783, 12830, 12832, 12871, 12880, 42124, 42128, 42182, 43360, 43388, 44032, 55203, 63744, 64255, 65040, 65049, 65072, 65106, 65108, 65126, 65128, 65131, 94176, 94180, 94192, 94198, 94208, 101589, 101631, 101662, 101760, 101874, 110576, 110579, 110581, 110587, 110589, 110590, 110592, 110882, 110898, 110898, 110928, 110930, 110933, 110933, 110948, 110951, 110960, 111355, 119552, 119638, 119648, 119670, 126980, 126980, 127183, 127183, 127374, 127374, 127377, 127386, 127488, 127490, 127504, 127547, 127552, 127560, 127568, 127569, 127584, 127589, 127744, 127776, 127789, 127797, 127799, 127868, 127870, 127891, 127904, 127946, 127951, 127955, 127968, 127984, 127988, 127988, 127992, 128062, 128064, 128064, 128066, 128252, 128255, 128317, 128331, 128334, 128336, 128359, 128378, 128378, 128405, 128406, 128420, 128420, 128507, 128591, 128640, 128709, 128716, 128716, 128720, 128722, 128725, 128728, 128732, 128735, 128747, 128748, 128756, 128764, 128992, 129003, 129008, 129008, 129292, 129338, 129340, 129349, 129351, 129535, 129648, 129660, 129664, 129674, 129678, 129734, 129736, 129736, 129741, 129756, 129759, 129770, 129775, 129784, 131072, 196605, 196608, 262141];
+const wideRanges = [4352, 4447, 8986, 8987, 9001, 9002, 9193, 9196, 9200, 9200, 9203, 9203, 9725, 9726, 9748, 9749, 9776, 9783, 9800, 9811, 9855, 9855, 9866, 9871, 9875, 9875, 9889, 9889, 9898, 9899, 9917, 9918, 9924, 9925, 9934, 9934, 9940, 9940, 9962, 9962, 9970, 9971, 9973, 9973, 9978, 9978, 9981, 9981, 9989, 9989, 9994, 9995, 10024, 10024, 10060, 10060, 10062, 10062, 10067, 10069, 10071, 10071, 10133, 10135, 10160, 10160, 10175, 10175, 11035, 11036, 11088, 11088, 11093, 11093, 11904, 11929, 11931, 12019, 12032, 12245, 12272, 12287, 12289, 12350, 12353, 12438, 12441, 12543, 12549, 12591, 12593, 12686, 12688, 12773, 12783, 12830, 12832, 12871, 12880, 42124, 42128, 42182, 43360, 43388, 44032, 55203, 63744, 64255, 65040, 65049, 65072, 65106, 65108, 65126, 65128, 65131, 94176, 94180, 94192, 94198, 94208, 101594, 101631, 101664, 101760, 101874, 101888, 102801, 102816, 102866, 110576, 110579, 110581, 110587, 110589, 110590, 110592, 110888, 110898, 110898, 110928, 110930, 110933, 110933, 110948, 110952, 110960, 111355, 119552, 119638, 119648, 119670, 126980, 126980, 127183, 127183, 127374, 127374, 127377, 127386, 127406, 127406, 127488, 127490, 127504, 127547, 127552, 127560, 127568, 127569, 127584, 127589, 127744, 127776, 127789, 127797, 127799, 127868, 127870, 127891, 127904, 127946, 127951, 127955, 127968, 127984, 127988, 127988, 127992, 128062, 128064, 128064, 128066, 128252, 128255, 128317, 128331, 128334, 128336, 128359, 128378, 128378, 128405, 128406, 128420, 128420, 128507, 128591, 128640, 128709, 128716, 128716, 128720, 128722, 128725, 128729, 128732, 128735, 128747, 128748, 128756, 128764, 128986, 128986, 128992, 129003, 129008, 129008, 129292, 129338, 129340, 129349, 129351, 129535, 129648, 129660, 129664, 129734, 129736, 129736, 129740, 129757, 129759, 129771, 129775, 129786, 131072, 196605, 196608, 262141];
 
 /**
 Binary search on a sorted flat array of [start, end] pairs.
@@ -299,7 +309,7 @@ const isAmbiguous = codePoint => {
 	return isInRange(ambiguousRanges, codePoint);
 };
 
-const isFullWidth = codePoint => {
+const isFullwidth = codePoint => {
 	if (
 		codePoint < fullwidthMinimalCodePoint
 		|| codePoint > fullwidthMaximumCodePoint
@@ -338,7 +348,7 @@ function eastAsianWidth(codePoint, {ambiguousAsWide = false} = {}) {
 	validate(codePoint);
 
 	if (
-		isFullWidth(codePoint)
+		isFullwidth(codePoint)
 		|| isWide(codePoint)
 		|| (ambiguousAsWide && isAmbiguous(codePoint))
 	) {

package/dist/start_dev_server/jsenv_core_packages.js

@@ -1264,7 +1264,8 @@ const startSpinner = ({
 
 const createTaskLog = (
   label,
-  { disabled = false, animated = true, stopOnWriteFromOutside } = {},
+  // animated defaults to what the spinner decides: only when stdout is a terminal
+  { disabled = false, animated, stopOnWriteFromOutside } = {},
 ) => {
   if (disabled) {
     return {
@@ -1274,7 +1275,7 @@ const createTaskLog = (
       fail: () => {},
     };
   }
-  if (animated && process.env.CAPTURING_SIDE_EFFECTS) {
+  if (process.env.CAPTURING_SIDE_EFFECTS) {
     animated = false;
   }
   const startMs = Date.now();

package/dist/start_dev_server/start_dev_server.js

@@ -1,4 +1,5 @@
 import { WebSocketResponse, pickContentType, ServerEvents, serverPluginErrorHandler, fetchDirectory, composeTwoResponses, serverPluginCORS, jsenvAccessControlAllowedHeaders, startServer } from "@jsenv/server";
+import { randomUUID, X509Certificate } from "node:crypto";
 import { existsSync, statSync, readFileSync, realpathSync, readdirSync, lstatSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 import { urlToRelativeUrl, registerFileLifecycle, lookupPackageDirectory, readPackageAtOrNull, generateContentFrame, errorToHTML, URL_META, asUrlWithoutSearch, DATA_URL, CONTENT_TYPE, normalizeImportMap, composeTwoImportMaps, resolveImport, createDetailedMessage, UNICODE, JS_QUOTES, urlToExtension, urlToBasename, applyNodeEsmResolution, readCustomConditionsFromProcessArgs, urlIsOrIsInsideOf, collectFiles, registerDirectoryLifecycle, readEntryStatSync, applyFileSystemMagicResolution, getExtensionsToTry, urlToFilename, ensurePathnameTrailingSlash, compareFileUrls, setUrlExtension, stringifyUrlSite, injectQueryParamsIntoSpecifier, isSpecifierForNodeBuiltin, injectQueryParams, urlToFileSystemPath, writeFileSync, moveUrl, ensureWindowsDriveLetter, validateResponseIntegrity, setUrlFilename, getCallerPosition, asSpecifierWithoutSearch, bufferToEtag, isFileSystemPath, urlToPathname, setUrlBasename, createLogger, normalizeUrl, ANSI, RUNTIME_COMPAT, formatError, assertAndNormalizeDirectoryUrl, browserDefaultRuntimeCompat, inferRuntimeCompatFromClosestPackage, createTaskLog } from "./jsenv_core_packages.js";
@@ -8,7 +9,6 @@ import { createMagicSource, composeTwoSourcemaps, generateSourcemapFileUrl, gene
 import { jsenvPluginSupervisor } from "@jsenv/plugin-supervisor";
 import { jsenvPluginTranspilation } from "@jsenv/plugin-transpilation";
 import { bundleJsModules } from "@jsenv/plugin-bundling";
-import { randomUUID } from "node:crypto";
 import { convertFileSystemErrorToResponseProperties } from "@jsenv/server/src/plugins/filesystem/filesystem_error_to_response.js";
 import "./jsenv_core_node_modules.js";
 import "node:process";
@@ -986,11 +986,11 @@ const clientReporterFileUrl = new URL(
   import.meta.url,
 ).href;
 const clientsPageFileUrl = new URL(
-  "../html/clients_page.html",
+  "../client/client_monitoring/clients_page.html",
   import.meta.url,
 ).href;
 const clientMonitorPageFileUrl = new URL(
-  "../html/client_monitor_page.html",
+  "../client/client_monitoring/client_monitor_page.html",
   import.meta.url,
 ).href;
 
@@ -8602,6 +8602,99 @@ const devServerPluginChromeDevToolsJson = ({ sourceDirectoryUrl }) => {
   };
 };
 
+/*
+ * Lets another device (a phone) trust the root certificate that signs the dev
+ * server certificate, so it opens the dev server over https without a warning.
+ *
+ * Everything under HTTPS_TRUST_PATHNAME is served over plain http too (see the
+ * redirectHttpToHttps passed by startDevServer): it is the one page that must
+ * load before the certificate is trusted, over https it would show the very
+ * warning it exists to remove. Only the certificate is served, never its key.
+ *
+ * The page is sent as written, not cooked like the project pages: it needs
+ * nothing cooking injects, and a project plugin rewriting html must not be able
+ * to break the one page reached before trust.
+ *
+ * What it means for the device, and why the fingerprint must be compared with
+ * the terminal: docs/users/b_dev/b_dev.md, "Trusting it on a phone".
+ */
+
+
+const HTTPS_TRUST_PATHNAME = "/.internal/https/";
+
+const httpsTrustPageFileUrl = new URL(
+  "../client/https_trust/https_trust.html",
+  import.meta.url,
+);
+
+// rootCertificate is a node:crypto X509Certificate
+const devServerPluginHttpsTrust = ({ rootCertificate }) => {
+  const commonName = readCommonName(rootCertificate.subject);
+  const rootCertificateInfo = {
+    fingerprint256: rootCertificate.fingerprint256,
+    commonName,
+  };
+  // "https local root certificate" -> "https_local_root_certificate.crt"
+  const rootCertificateFilename = `${commonName.replace(/[^\w.-]+/g, "_")}.crt`;
+
+  return {
+    name: "jsenv:https_trust",
+    routes: [
+      {
+        endpoint: `GET ${HTTPS_TRUST_PATHNAME}`,
+        description:
+          "Page to trust the dev server https on another device (a phone). Served over http.",
+        declarationSource: import.meta.url,
+        fetch: () => {
+          return new Response(readFileSync(httpsTrustPageFileUrl), {
+            headers: { "content-type": "text/html" },
+          });
+        },
+      },
+      {
+        endpoint: `GET ${HTTPS_TRUST_PATHNAME}root.crt`,
+        description: "The root certificate signing the dev server certificate.",
+        declarationSource: import.meta.url,
+        fetch: () => {
+          return new Response(rootCertificate.toString(), {
+            headers: {
+              "content-type": "application/x-x509-ca-cert",
+              "content-disposition": `attachment; filename="${rootCertificateFilename}"`,
+            },
+          });
+        },
+      },
+      {
+        endpoint: `GET ${HTTPS_TRUST_PATHNAME}root.json`,
+        description: "Fingerprint and name of the root certificate.",
+        declarationSource: import.meta.url,
+        fetch: () => {
+          return Response.json(rootCertificateInfo);
+        },
+      },
+      {
+        endpoint: `GET ${HTTPS_TRUST_PATHNAME}ping`,
+        description:
+          "Fetched over https by the page: it fails as long as the device does not trust the certificate.",
+        declarationSource: import.meta.url,
+        fetch: () => {
+          return new Response(null, { status: 204 });
+        },
+      },
+    ],
+  };
+};
+
+// "CN=https local root certificate\nO=..." -> "https local root certificate"
+const readCommonName = (subject) => {
+  for (const line of subject.split("\n")) {
+    if (line.startsWith("CN=")) {
+      return line.slice("CN=".length);
+    }
+  }
+  return subject;
+};
+
 const devServerPluginInjectServerResponseHeader = ({
   sourceDirectoryUrl,
 }) => {
@@ -12527,7 +12620,7 @@ const EXECUTED_BY_TEST_PLAN = process.argv.includes("--jsenv-test");
  * @param {number} [params.port=3456] - Port to listen on (0 = a free port).
  * @param {string} [params.hostname] - Hostname to bind to.
  * @param {boolean} [params.acceptAnyIp=false] - Also accept connections on the machine's IPs (so other devices on the network — a phone — can reach the server). Off by default: exposing the dev server beyond localhost is an explicit choice, not something a dev tool decides.
- * @param {boolean|object} [params.https=false] - HTTPS as `{ certificate, privateKey }`.
+ * @param {object} [params.https] - HTTPS as `{ certificate, privateKey }` (PEM strings). With `rootCertificate` (the PEM of the authority that signed `certificate`) and `acceptAnyIp`, the dev server also serves `http://<ip>:<port>/.internal/https/`, a page to trust that authority on a phone (see docs/users/b_dev/b_dev.md, "Trusting it on a phone").
  * @param {boolean} [params.http2=false] - HTTP/2 (requires https).
  * @param {Array} [params.plugins=[]] - jsenv plugins (transformUrlContent, serverRoutes, serverEvents, effect, …).
  * @param {Array} [params.serverPlugins=[]] - `@jsenv/server`-level plugins.
@@ -12659,6 +12752,7 @@ const startDevServer = async ({
       );
     }
   }
+  let httpsTrust = null;
   // params normalization
   {
     if (runtimeCompat === undefined) {
@@ -12673,6 +12767,16 @@ const startDevServer = async ({
     if (clientAutoreload === false) {
       clientAutoreload = { enabled: false };
     }
+    if (https) {
+      const { certificate, privateKey, rootCertificate } = https;
+      https = { certificate, privateKey };
+      // a localhost-only server has no phone to serve
+      if (rootCertificate && acceptAnyIp) {
+        httpsTrust = {
+          rootCertificate: new X509Certificate(rootCertificate),
+        };
+      }
+    }
   }
 
   const logger = createLogger({ logLevel });
@@ -12830,6 +12934,7 @@ const startDevServer = async ({
     }),
     // chrome devtools
     devServerPluginChromeDevToolsJson({ sourceDirectoryUrl }),
+    ...(httpsTrust ? [devServerPluginHttpsTrust(httpsTrust)] : []),
     ...serverPlugins,
     devServerPluginServeSourceFiles({
       packageDirectory,
@@ -12868,6 +12973,12 @@ const startDevServer = async ({
     startLog: false,
 
     https,
+    ...(httpsTrust
+      ? {
+          redirectHttpToHttps: ({ resource }) =>
+            !resource.startsWith(HTTPS_TRUST_PATHNAME),
+        }
+      : {}),
     http2,
     acceptAnyIp,
     hostname,
@@ -12893,6 +13004,17 @@ const startDevServer = async ({
   logger.info(``);
   Object.keys(server.origins).forEach((key) => {
     logger.info(`- ${server.origins[key]}`);
+    if (httpsTrust && key === "externalip") {
+      const externalHostname = new URL(server.origins.externalip).hostname;
+      const httpsTrustPageUrl = new URL(
+        HTTPS_TRUST_PATHNAME,
+        `http://${externalHostname}:${server.port}`,
+      );
+      logger.info(`  trust it on a phone: ${httpsTrustPageUrl}`);
+      logger.info(
+        `  root certificate SHA-256: ${httpsTrust.rootCertificate.fingerprint256}`,
+      );
+    }
   });
   logger.info(``);
   return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jsenv/core",
-  "version": "41.5.34",
+  "version": "41.5.37",
   "type": "module",
   "description": "Tool to develop, test and build js projects",
   "repository": {
@@ -57,9 +57,10 @@
     "https:setup": "npx @jsenv/https-local setup",
     "md:build": "node ./docs/build.js",
     "monorepo:node_modules_clear": "npx @jsenv/filesystem clear **/node_modules/",
-    "monorepo:publish": "node ./scripts/monorepo/publish_packages.mjs",
+    "monorepo:publish": "node ./scripts/monorepo/prepare_publish.mjs",
     "monorepo:sync_versions": "node ./scripts/monorepo/sync_packages_versions.mjs",
     "monorepo:upgrade_versions": "node ./scripts/monorepo/upgrade_external_versions.mjs",
+    "monorepo:wait_publish": "node ./scripts/monorepo/wait_publish.mjs",
     "oto:start": "npm run start -w oto",
     "performances": "node --expose-gc ./scripts/performance/generate_performance_report.mjs --log --once",
     "playwright:install": "npx playwright install-deps && npx playwright install",
@@ -73,14 +74,14 @@
     "test:snapshot_clear": "npx @jsenv/filesystem clear **/tests/**/side_effects/"
   },
   "dependencies": {
-    "@jsenv/ast": "6.10.9",
-    "@jsenv/js-module-fallback": "1.6.13",
-    "@jsenv/plugin-bundling": "2.10.31",
-    "@jsenv/plugin-minification": "1.7.26",
-    "@jsenv/plugin-supervisor": "1.8.28",
-    "@jsenv/plugin-transpilation": "1.7.13",
-    "@jsenv/server": "17.6.8",
-    "@jsenv/sourcemap": "1.4.12",
+    "@jsenv/ast": "6.10.10",
+    "@jsenv/js-module-fallback": "1.6.14",
+    "@jsenv/plugin-bundling": "2.10.32",
+    "@jsenv/plugin-minification": "1.7.27",
+    "@jsenv/plugin-supervisor": "1.8.29",
+    "@jsenv/plugin-transpilation": "1.7.14",
+    "@jsenv/server": "17.6.9",
+    "@jsenv/sourcemap": "1.4.13",
     "react-table": "7.8.0"
   },
   "devDependencies": {