@neuralnomads/codenomad-dev 0.20.0-dev-20260908-e5115fe8 → 0.20.0-dev-20260910-abaf6eba

package/dist/server/listener-base-url.js

@@ -1,7 +1,16 @@
+import { isIP } from "node:net";
+import { formatHostForUrl, isLoopbackHost, isWildcardHost, normalizeNetworkHost } from "./network-host";
+export function resolvePreferredRemoteListener(input) {
+    return input.httpsStart ?? input.httpStart ?? null;
+}
 export function resolvePluginBaseUrl(input) {
     const loopbackListener = [input.httpStart, input.httpsStart].find((listener) => listener && acceptsLoopback(listener.bindHost));
     if (loopbackListener) {
-        return `${loopbackListener.protocol}://127.0.0.1:${loopbackListener.port}`;
+        const bindHost = normalizeNetworkHost(loopbackListener.bindHost);
+        const loopbackHost = isWildcardHost(bindHost)
+            ? isIP(bindHost) === 6 ? "::1" : "127.0.0.1"
+            : bindHost;
+        return `${loopbackListener.protocol}://${formatHostForUrl(loopbackHost)}:${loopbackListener.port}`;
     }
     if (input.remoteUrl) {
         return input.remoteUrl;
@@ -10,7 +19,7 @@ export function resolvePluginBaseUrl(input) {
     if (!fallbackListener) {
         throw new Error("No listeners started");
     }
-    return `${fallbackListener.protocol}://${fallbackListener.bindHost}:${fallbackListener.port}`;
+    return `${fallbackListener.protocol}://${formatHostForUrl(fallbackListener.bindHost)}:${fallbackListener.port}`;
 }
 export function resolveAutomationBridgeUrl(listener) {
     if (listener.protocol !== "http" || !acceptsLoopback(listener.bindHost)) {
@@ -19,6 +28,6 @@ export function resolveAutomationBridgeUrl(listener) {
     return `http://127.0.0.1:${listener.port}`;
 }
 function acceptsLoopback(bindHost) {
-    return bindHost === "0.0.0.0" || bindHost === "::" || bindHost === "localhost" || bindHost === "::1" || bindHost.startsWith("127.");
+    return bindHost === "localhost" || isWildcardHost(bindHost) || isLoopbackHost(bindHost);
 }
 //# sourceMappingURL=listener-base-url.js.map

package/dist/server/listener-base-url.js.map

@@ -1 +1 @@
-{"version":3,"file":"listener-base-url.js","sourceRoot":"","sources":["../../src/server/listener-base-url.ts"],"names":[],"mappings":"AAYA,MAAM,UAAU,oBAAoB,CAAC,KAAgC;IACnE,MAAM,gBAAgB,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,IAAI,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC/H,IAAI,gBAAgB,EAAE,CAAC;QACrB,OAAO,GAAG,gBAAgB,CAAC,QAAQ,gBAAgB,gBAAgB,CAAC,IAAI,EAAE,CAAA;IAC5E,CAAC;IAED,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC,SAAS,CAAA;IACxB,CAAC;IAED,MAAM,gBAAgB,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,UAAU,CAAA;IAC5D,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;IACzC,CAAC;IAED,OAAO,GAAG,gBAAgB,CAAC,QAAQ,MAAM,gBAAgB,CAAC,QAAQ,IAAI,gBAAgB,CAAC,IAAI,EAAE,CAAA;AAC/F,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,QAAqC;IAC9E,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;IACrE,CAAC;IACD,OAAO,oBAAoB,QAAQ,CAAC,IAAI,EAAE,CAAA;AAC5C,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB;IACvC,OAAO,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;AACrI,CAAC","sourcesContent":["export interface StartedListenerBaseUrlInput {\n  protocol: \"http\" | \"https\"\n  bindHost: string\n  port: number\n}\n\nexport interface ResolvePluginBaseUrlInput {\n  httpStart?: StartedListenerBaseUrlInput | null\n  httpsStart?: StartedListenerBaseUrlInput | null\n  remoteUrl?: string\n}\n\nexport function resolvePluginBaseUrl(input: ResolvePluginBaseUrlInput): string {\n  const loopbackListener = [input.httpStart, input.httpsStart].find((listener) => listener && acceptsLoopback(listener.bindHost))\n  if (loopbackListener) {\n    return `${loopbackListener.protocol}://127.0.0.1:${loopbackListener.port}`\n  }\n\n  if (input.remoteUrl) {\n    return input.remoteUrl\n  }\n\n  const fallbackListener = input.httpStart ?? input.httpsStart\n  if (!fallbackListener) {\n    throw new Error(\"No listeners started\")\n  }\n\n  return `${fallbackListener.protocol}://${fallbackListener.bindHost}:${fallbackListener.port}`\n}\n\nexport function resolveAutomationBridgeUrl(listener: StartedListenerBaseUrlInput): string {\n  if (listener.protocol !== \"http\" || !acceptsLoopback(listener.bindHost)) {\n    throw new Error(\"Developer Mode requires a loopback HTTP listener\")\n  }\n  return `http://127.0.0.1:${listener.port}`\n}\n\nfunction acceptsLoopback(bindHost: string): boolean {\n  return bindHost === \"0.0.0.0\" || bindHost === \"::\" || bindHost === \"localhost\" || bindHost === \"::1\" || bindHost.startsWith(\"127.\")\n}\n"]}
+{"version":3,"file":"listener-base-url.js","sourceRoot":"","sources":["../../src/server/listener-base-url.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AAcvG,MAAM,UAAU,8BAA8B,CAC5C,KAAkE;IAElE,OAAO,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAA;AACpD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAgC;IACnE,MAAM,gBAAgB,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,IAAI,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC/H,IAAI,gBAAgB,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAA;QAChE,MAAM,YAAY,GAAG,cAAc,CAAC,QAAQ,CAAC;YAC3C,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW;YAC5C,CAAC,CAAC,QAAQ,CAAA;QACZ,OAAO,GAAG,gBAAgB,CAAC,QAAQ,MAAM,gBAAgB,CAAC,YAAY,CAAC,IAAI,gBAAgB,CAAC,IAAI,EAAE,CAAA;IACpG,CAAC;IAED,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC,SAAS,CAAA;IACxB,CAAC;IAED,MAAM,gBAAgB,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,UAAU,CAAA;IAC5D,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;IACzC,CAAC;IAED,OAAO,GAAG,gBAAgB,CAAC,QAAQ,MAAM,gBAAgB,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,gBAAgB,CAAC,IAAI,EAAE,CAAA;AACjH,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,QAAqC;IAC9E,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;IACrE,CAAC;IACD,OAAO,oBAAoB,QAAQ,CAAC,IAAI,EAAE,CAAA;AAC5C,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB;IACvC,OAAO,QAAQ,KAAK,WAAW,IAAI,cAAc,CAAC,QAAQ,CAAC,IAAI,cAAc,CAAC,QAAQ,CAAC,CAAA;AACzF,CAAC","sourcesContent":["import { isIP } from \"node:net\"\nimport { formatHostForUrl, isLoopbackHost, isWildcardHost, normalizeNetworkHost } from \"./network-host\"\n\nexport interface StartedListenerBaseUrlInput {\n  protocol: \"http\" | \"https\"\n  bindHost: string\n  port: number\n}\n\nexport interface ResolvePluginBaseUrlInput {\n  httpStart?: StartedListenerBaseUrlInput | null\n  httpsStart?: StartedListenerBaseUrlInput | null\n  remoteUrl?: string\n}\n\nexport function resolvePreferredRemoteListener(\n  input: Pick<ResolvePluginBaseUrlInput, \"httpStart\" | \"httpsStart\">,\n): StartedListenerBaseUrlInput | null {\n  return input.httpsStart ?? input.httpStart ?? null\n}\n\nexport function resolvePluginBaseUrl(input: ResolvePluginBaseUrlInput): string {\n  const loopbackListener = [input.httpStart, input.httpsStart].find((listener) => listener && acceptsLoopback(listener.bindHost))\n  if (loopbackListener) {\n    const bindHost = normalizeNetworkHost(loopbackListener.bindHost)\n    const loopbackHost = isWildcardHost(bindHost)\n      ? isIP(bindHost) === 6 ? \"::1\" : \"127.0.0.1\"\n      : bindHost\n    return `${loopbackListener.protocol}://${formatHostForUrl(loopbackHost)}:${loopbackListener.port}`\n  }\n\n  if (input.remoteUrl) {\n    return input.remoteUrl\n  }\n\n  const fallbackListener = input.httpStart ?? input.httpsStart\n  if (!fallbackListener) {\n    throw new Error(\"No listeners started\")\n  }\n\n  return `${fallbackListener.protocol}://${formatHostForUrl(fallbackListener.bindHost)}:${fallbackListener.port}`\n}\n\nexport function resolveAutomationBridgeUrl(listener: StartedListenerBaseUrlInput): string {\n  if (listener.protocol !== \"http\" || !acceptsLoopback(listener.bindHost)) {\n    throw new Error(\"Developer Mode requires a loopback HTTP listener\")\n  }\n  return `http://127.0.0.1:${listener.port}`\n}\n\nfunction acceptsLoopback(bindHost: string): boolean {\n  return bindHost === \"localhost\" || isWildcardHost(bindHost) || isLoopbackHost(bindHost)\n}\n"]}

package/dist/server/network-addresses.js

@@ -1,51 +1,40 @@
 import os from "os";
+import { isIP } from "node:net";
+import { formatHostForUrl, isLoopbackHost, isWildcardHost, normalizeNetworkHost } from "./network-host";
 export function resolveNetworkAddresses(args) {
-    const { host, protocol, port } = args;
+    const { protocol, port } = args;
+    const host = normalizeNetworkHost(args.host);
     const interfaces = os.networkInterfaces();
     const seen = new Set();
     const results = [];
     const addAddress = (ip, scope) => {
-        if (!ip || ip === "0.0.0.0")
+        const normalizedIp = normalizeNetworkHost(ip);
+        const ipVersion = isIP(normalizedIp);
+        if (!ipVersion || isWildcardHost(normalizedIp) || (ipVersion === 6 && isLinkLocalIPv6(normalizedIp)))
             return;
-        const key = `ipv4-${ip}`;
+        const family = ipVersion === 6 ? "ipv6" : "ipv4";
+        const key = `${family}-${normalizedIp}`;
         if (seen.has(key))
             return;
         seen.add(key);
-        results.push({ ip, family: "ipv4", scope, remoteUrl: `${protocol}://${ip}:${port}` });
+        results.push({ ip: normalizedIp, family, scope, remoteUrl: `${protocol}://${formatHostForUrl(normalizedIp)}:${port}` });
     };
-    const normalizeFamily = (value) => {
-        if (typeof value === "string") {
-            const lowered = value.toLowerCase();
-            if (lowered === "ipv4") {
-                return "ipv4";
-            }
-        }
-        if (value === 4)
-            return "ipv4";
-        return null;
-    };
-    if (host === "0.0.0.0") {
-        // Enumerate system interfaces (IPv4 only)
+    if (isWildcardHost(host)) {
+        const wildcardVersion = isIP(host);
         for (const entries of Object.values(interfaces)) {
             if (!entries)
                 continue;
             for (const entry of entries) {
-                const family = normalizeFamily(entry.family);
-                if (!family)
-                    continue;
-                if (!entry.address || entry.address === "0.0.0.0")
+                const entryVersion = isIP(normalizeNetworkHost(entry.address));
+                if (entryVersion !== wildcardVersion && !(wildcardVersion === 6 && entryVersion === 4))
                     continue;
                 const scope = entry.internal ? "loopback" : "external";
                 addAddress(entry.address, scope);
             }
         }
     }
-    // Always include loopback address
-    addAddress("127.0.0.1", "loopback");
-    // Include explicitly configured host if it was IPv4
-    if (isIPv4Address(host) && host !== "0.0.0.0") {
-        const isLoopback = host.startsWith("127.");
-        addAddress(host, isLoopback ? "loopback" : "external");
+    else if (isIP(host)) {
+        addAddress(host, isLoopbackHost(host) ? "loopback" : "external");
     }
     const scopeWeight = { external: 0, internal: 1, loopback: 2 };
     return results.sort((a, b) => {
@@ -93,23 +82,12 @@ function isPrivateIPv4(ip) {
     return first === 172 && second >= 16 && second <= 31;
 }
 function parseIPv4(value) {
-    if (!isIPv4Address(value))
+    if (isIP(value) !== 4)
         return null;
     return value.split(".").map((part) => Number(part));
 }
-function isIPv4Address(value) {
-    if (!value)
-        return false;
-    const parts = value.split(".");
-    if (parts.length !== 4)
-        return false;
-    return parts.every((part) => {
-        if (part.length === 0 || part.length > 3)
-            return false;
-        if (!/^[0-9]+$/.test(part))
-            return false;
-        const num = Number(part);
-        return Number.isInteger(num) && num >= 0 && num <= 255;
-    });
+function isLinkLocalIPv6(ip) {
+    const firstSegment = Number.parseInt(ip.split(":", 1)[0], 16);
+    return Number.isInteger(firstSegment) && firstSegment >= 0xfe80 && firstSegment <= 0xfebf;
 }
 //# sourceMappingURL=network-addresses.js.map

package/dist/server/network-addresses.js.map

@@ -1 +1 @@
-{"version":3,"file":"network-addresses.js","sourceRoot":"","sources":["../../src/server/network-addresses.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAA;AASnB,MAAM,UAAU,uBAAuB,CAAC,IAIvC;IACC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAI,CAAA;IACrC,MAAM,UAAU,GAAG,EAAE,CAAC,iBAAiB,EAAE,CAAA;IACzC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,MAAM,OAAO,GAAqB,EAAE,CAAA;IAEpC,MAAM,UAAU,GAAG,CAAC,EAAU,EAAE,KAA8B,EAAE,EAAE;QAChE,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,SAAS;YAAE,OAAM;QACnC,MAAM,GAAG,GAAG,QAAQ,EAAE,EAAE,CAAA;QACxB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAM;QACzB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACb,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,QAAQ,MAAM,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAA;IACvF,CAAC,CAAA;IAED,MAAM,eAAe,GAAG,CAAC,KAAsB,EAAE,EAAE;QACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,EAAE,CAAA;YACnC,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;gBACvB,OAAO,MAAe,CAAA;YACxB,CAAC;QACH,CAAC;QACD,IAAI,KAAK,KAAK,CAAC;YAAE,OAAO,MAAe,CAAA;QACvC,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,0CAA0C;QAC1C,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,OAAO;gBAAE,SAAQ;YACtB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;gBAC5C,IAAI,CAAC,MAAM;oBAAE,SAAQ;gBACrB,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;oBAAE,SAAQ;gBAC3D,MAAM,KAAK,GAA4B,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAA;gBAC/E,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;YAClC,CAAC;QACH,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,UAAU,CAAC,WAAW,EAAE,UAAU,CAAC,CAAA;IAEnC,oDAAoD;IACpD,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QAC1C,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAA;IACxD,CAAC;IAED,MAAM,WAAW,GAA4C,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAA;IAEtG,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC3B,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;QAC9D,IAAI,UAAU,KAAK,CAAC;YAAE,OAAO,UAAU,CAAA;QAEvC,OAAO,CAAC,CAAA;IACV,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAItC;IACC,MAAM,GAAG,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAA;IACzC,MAAM,WAAW,GAAG,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAA;IACnG,OAAO;QACL,GAAG;QACH,WAAW;QACX,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,SAAS;KAC5C,CAAA;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,SAA2B;IAC3D,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAA;AACjH,CAAC;AAED,SAAS,sBAAsB,CAAC,EAAU;IACxC,IAAI,aAAa,CAAC,EAAE,CAAC;QAAE,OAAO,CAAC,CAAA;IAC/B,IAAI,eAAe,CAAC,EAAE,CAAC;QAAE,OAAO,CAAC,CAAA;IACjC,OAAO,CAAC,CAAA;AACV,CAAC;AAED,SAAS,eAAe,CAAC,EAAU;IACjC,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAAA;IAC5B,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACzB,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,CAAA;IAC9B,OAAO,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAA;AACxC,CAAC;AAED,SAAS,aAAa,CAAC,EAAU;IAC/B,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAAA;IAC5B,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACzB,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,CAAA;IAE9B,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAA;IAC7B,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IAChD,OAAO,KAAK,KAAK,GAAG,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE,CAAA;AACtD,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACtC,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;AACrD,CAAC;AAED,SAAS,aAAa,CAAC,KAAyB;IAC9C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IACxB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACpC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE;QAC1B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAA;QACtD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;QACxC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;QACxB,OAAO,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,CAAA;IACxD,CAAC,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import os from \"os\"\nimport type { NetworkAddress } from \"../api-types\"\n\nexport interface ResolvedRemoteAddresses {\n  all: NetworkAddress[]\n  userVisible: NetworkAddress[]\n  primaryRemoteUrl?: string\n}\n\nexport function resolveNetworkAddresses(args: {\n  host: string\n  protocol: \"http\" | \"https\"\n  port: number\n}): NetworkAddress[] {\n  const { host, protocol, port } = args\n  const interfaces = os.networkInterfaces()\n  const seen = new Set<string>()\n  const results: NetworkAddress[] = []\n\n  const addAddress = (ip: string, scope: NetworkAddress[\"scope\"]) => {\n    if (!ip || ip === \"0.0.0.0\") return\n    const key = `ipv4-${ip}`\n    if (seen.has(key)) return\n    seen.add(key)\n    results.push({ ip, family: \"ipv4\", scope, remoteUrl: `${protocol}://${ip}:${port}` })\n  }\n\n  const normalizeFamily = (value: string | number) => {\n    if (typeof value === \"string\") {\n      const lowered = value.toLowerCase()\n      if (lowered === \"ipv4\") {\n        return \"ipv4\" as const\n      }\n    }\n    if (value === 4) return \"ipv4\" as const\n    return null\n  }\n\n  if (host === \"0.0.0.0\") {\n    // Enumerate system interfaces (IPv4 only)\n    for (const entries of Object.values(interfaces)) {\n      if (!entries) continue\n      for (const entry of entries) {\n        const family = normalizeFamily(entry.family)\n        if (!family) continue\n        if (!entry.address || entry.address === \"0.0.0.0\") continue\n        const scope: NetworkAddress[\"scope\"] = entry.internal ? \"loopback\" : \"external\"\n        addAddress(entry.address, scope)\n      }\n    }\n  }\n\n  // Always include loopback address\n  addAddress(\"127.0.0.1\", \"loopback\")\n\n  // Include explicitly configured host if it was IPv4\n  if (isIPv4Address(host) && host !== \"0.0.0.0\") {\n    const isLoopback = host.startsWith(\"127.\")\n    addAddress(host, isLoopback ? \"loopback\" : \"external\")\n  }\n\n  const scopeWeight: Record<NetworkAddress[\"scope\"], number> = { external: 0, internal: 1, loopback: 2 }\n\n  return results.sort((a, b) => {\n    const scopeDelta = scopeWeight[a.scope] - scopeWeight[b.scope]\n    if (scopeDelta !== 0) return scopeDelta\n\n    return 0\n  })\n}\n\nexport function resolveRemoteAddresses(args: {\n  host: string\n  protocol: \"http\" | \"https\"\n  port: number\n}): ResolvedRemoteAddresses {\n  const all = resolveNetworkAddresses(args)\n  const userVisible = sortUserVisibleAddresses(all.filter((address) => address.scope === \"external\"))\n  return {\n    all,\n    userVisible,\n    primaryRemoteUrl: userVisible[0]?.remoteUrl,\n  }\n}\n\nfunction sortUserVisibleAddresses(addresses: NetworkAddress[]): NetworkAddress[] {\n  return [...addresses].sort((left, right) => getUserVisiblePriority(left.ip) - getUserVisiblePriority(right.ip))\n}\n\nfunction getUserVisiblePriority(ip: string): number {\n  if (isPrivateIPv4(ip)) return 0\n  if (isLinkLocalIPv4(ip)) return 2\n  return 1\n}\n\nfunction isLinkLocalIPv4(ip: string): boolean {\n  const octets = parseIPv4(ip)\n  if (!octets) return false\n  const [first, second] = octets\n  return first === 169 && second === 254\n}\n\nfunction isPrivateIPv4(ip: string): boolean {\n  const octets = parseIPv4(ip)\n  if (!octets) return false\n  const [first, second] = octets\n\n  if (first === 10) return true\n  if (first === 192 && second === 168) return true\n  return first === 172 && second >= 16 && second <= 31\n}\n\nfunction parseIPv4(value: string): number[] | null {\n  if (!isIPv4Address(value)) return null\n  return value.split(\".\").map((part) => Number(part))\n}\n\nfunction isIPv4Address(value: string | undefined): value is string {\n  if (!value) return false\n  const parts = value.split(\".\")\n  if (parts.length !== 4) return false\n  return parts.every((part) => {\n    if (part.length === 0 || part.length > 3) return false\n    if (!/^[0-9]+$/.test(part)) return false\n    const num = Number(part)\n    return Number.isInteger(num) && num >= 0 && num <= 255\n  })\n}\n"]}
+{"version":3,"file":"network-addresses.js","sourceRoot":"","sources":["../../src/server/network-addresses.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAA;AACnB,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAE/B,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AAQvG,MAAM,UAAU,uBAAuB,CAAC,IAIvC;IACC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAI,CAAA;IAC/B,MAAM,IAAI,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC5C,MAAM,UAAU,GAAG,EAAE,CAAC,iBAAiB,EAAE,CAAA;IACzC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,MAAM,OAAO,GAAqB,EAAE,CAAA;IAEpC,MAAM,UAAU,GAAG,CAAC,EAAU,EAAE,KAA8B,EAAE,EAAE;QAChE,MAAM,YAAY,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAA;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,CAAA;QACpC,IAAI,CAAC,SAAS,IAAI,cAAc,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,IAAI,eAAe,CAAC,YAAY,CAAC,CAAC;YAAE,OAAM;QAC5G,MAAM,MAAM,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAA;QAChD,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,YAAY,EAAE,CAAA;QACvC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAM;QACzB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACb,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,QAAQ,MAAM,gBAAgB,CAAC,YAAY,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAA;IACzH,CAAC,CAAA;IAED,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,CAAA;QAClC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,OAAO;gBAAE,SAAQ;YACtB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,MAAM,YAAY,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;gBAC9D,IAAI,YAAY,KAAK,eAAe,IAAI,CAAC,CAAC,eAAe,KAAK,CAAC,IAAI,YAAY,KAAK,CAAC,CAAC;oBAAE,SAAQ;gBAChG,MAAM,KAAK,GAA4B,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAA;gBAC/E,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;YAClC,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,UAAU,CAAC,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAA;IAClE,CAAC;IAED,MAAM,WAAW,GAA4C,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAA;IAEtG,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC3B,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;QAC9D,IAAI,UAAU,KAAK,CAAC;YAAE,OAAO,UAAU,CAAA;QAEvC,OAAO,CAAC,CAAA;IACV,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAItC;IACC,MAAM,GAAG,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAA;IACzC,MAAM,WAAW,GAAG,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAA;IACnG,OAAO;QACL,GAAG;QACH,WAAW;QACX,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,SAAS;KAC5C,CAAA;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,SAA2B;IAC3D,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAA;AACjH,CAAC;AAED,SAAS,sBAAsB,CAAC,EAAU;IACxC,IAAI,aAAa,CAAC,EAAE,CAAC;QAAE,OAAO,CAAC,CAAA;IAC/B,IAAI,eAAe,CAAC,EAAE,CAAC;QAAE,OAAO,CAAC,CAAA;IACjC,OAAO,CAAC,CAAA;AACV,CAAC;AAED,SAAS,eAAe,CAAC,EAAU;IACjC,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAAA;IAC5B,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACzB,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,CAAA;IAC9B,OAAO,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAA;AACxC,CAAC;AAED,SAAS,aAAa,CAAC,EAAU;IAC/B,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAAA;IAC5B,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACzB,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,CAAA;IAE9B,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAA;IAC7B,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IAChD,OAAO,KAAK,KAAK,GAAG,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE,CAAA;AACtD,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAClC,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;AACrD,CAAC;AAED,SAAS,eAAe,CAAC,EAAU;IACjC,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAC7D,OAAO,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,MAAM,IAAI,YAAY,IAAI,MAAM,CAAA;AAC3F,CAAC","sourcesContent":["import os from \"os\"\nimport { isIP } from \"node:net\"\nimport type { NetworkAddress } from \"../api-types\"\nimport { formatHostForUrl, isLoopbackHost, isWildcardHost, normalizeNetworkHost } from \"./network-host\"\n\nexport interface ResolvedRemoteAddresses {\n  all: NetworkAddress[]\n  userVisible: NetworkAddress[]\n  primaryRemoteUrl?: string\n}\n\nexport function resolveNetworkAddresses(args: {\n  host: string\n  protocol: \"http\" | \"https\"\n  port: number\n}): NetworkAddress[] {\n  const { protocol, port } = args\n  const host = normalizeNetworkHost(args.host)\n  const interfaces = os.networkInterfaces()\n  const seen = new Set<string>()\n  const results: NetworkAddress[] = []\n\n  const addAddress = (ip: string, scope: NetworkAddress[\"scope\"]) => {\n    const normalizedIp = normalizeNetworkHost(ip)\n    const ipVersion = isIP(normalizedIp)\n    if (!ipVersion || isWildcardHost(normalizedIp) || (ipVersion === 6 && isLinkLocalIPv6(normalizedIp))) return\n    const family = ipVersion === 6 ? \"ipv6\" : \"ipv4\"\n    const key = `${family}-${normalizedIp}`\n    if (seen.has(key)) return\n    seen.add(key)\n    results.push({ ip: normalizedIp, family, scope, remoteUrl: `${protocol}://${formatHostForUrl(normalizedIp)}:${port}` })\n  }\n\n  if (isWildcardHost(host)) {\n    const wildcardVersion = isIP(host)\n    for (const entries of Object.values(interfaces)) {\n      if (!entries) continue\n      for (const entry of entries) {\n        const entryVersion = isIP(normalizeNetworkHost(entry.address))\n        if (entryVersion !== wildcardVersion && !(wildcardVersion === 6 && entryVersion === 4)) continue\n        const scope: NetworkAddress[\"scope\"] = entry.internal ? \"loopback\" : \"external\"\n        addAddress(entry.address, scope)\n      }\n    }\n  } else if (isIP(host)) {\n    addAddress(host, isLoopbackHost(host) ? \"loopback\" : \"external\")\n  }\n\n  const scopeWeight: Record<NetworkAddress[\"scope\"], number> = { external: 0, internal: 1, loopback: 2 }\n\n  return results.sort((a, b) => {\n    const scopeDelta = scopeWeight[a.scope] - scopeWeight[b.scope]\n    if (scopeDelta !== 0) return scopeDelta\n\n    return 0\n  })\n}\n\nexport function resolveRemoteAddresses(args: {\n  host: string\n  protocol: \"http\" | \"https\"\n  port: number\n}): ResolvedRemoteAddresses {\n  const all = resolveNetworkAddresses(args)\n  const userVisible = sortUserVisibleAddresses(all.filter((address) => address.scope === \"external\"))\n  return {\n    all,\n    userVisible,\n    primaryRemoteUrl: userVisible[0]?.remoteUrl,\n  }\n}\n\nfunction sortUserVisibleAddresses(addresses: NetworkAddress[]): NetworkAddress[] {\n  return [...addresses].sort((left, right) => getUserVisiblePriority(left.ip) - getUserVisiblePriority(right.ip))\n}\n\nfunction getUserVisiblePriority(ip: string): number {\n  if (isPrivateIPv4(ip)) return 0\n  if (isLinkLocalIPv4(ip)) return 2\n  return 1\n}\n\nfunction isLinkLocalIPv4(ip: string): boolean {\n  const octets = parseIPv4(ip)\n  if (!octets) return false\n  const [first, second] = octets\n  return first === 169 && second === 254\n}\n\nfunction isPrivateIPv4(ip: string): boolean {\n  const octets = parseIPv4(ip)\n  if (!octets) return false\n  const [first, second] = octets\n\n  if (first === 10) return true\n  if (first === 192 && second === 168) return true\n  return first === 172 && second >= 16 && second <= 31\n}\n\nfunction parseIPv4(value: string): number[] | null {\n  if (isIP(value) !== 4) return null\n  return value.split(\".\").map((part) => Number(part))\n}\n\nfunction isLinkLocalIPv6(ip: string): boolean {\n  const firstSegment = Number.parseInt(ip.split(\":\", 1)[0], 16)\n  return Number.isInteger(firstSegment) && firstSegment >= 0xfe80 && firstSegment <= 0xfebf\n}\n"]}

package/dist/server/network-host.js

@@ -0,0 +1,62 @@
+import { isIP } from "node:net";
+import { domainToASCII } from "node:url";
+export function stripHostBrackets(host) {
+    const trimmed = host.trim();
+    return trimmed.startsWith("[") && trimmed.endsWith("]") ? trimmed.slice(1, -1) : trimmed;
+}
+export function normalizeNetworkHost(host) {
+    const value = stripHostBrackets(host).toLowerCase();
+    if (isIP(value) === 6) {
+        const canonical = canonicalIPv6(value);
+        const mapped = canonical?.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+        if (mapped) {
+            const high = Number.parseInt(mapped[1], 16);
+            const low = Number.parseInt(mapped[2], 16);
+            return `${high >> 8}.${high & 0xff}.${low >> 8}.${low & 0xff}`;
+        }
+    }
+    if (isIP(value))
+        return value;
+    return domainToASCII(value) || value;
+}
+export function hasIPv6Zone(host) {
+    const value = stripHostBrackets(host);
+    return value.includes("%") && isIP(value) === 6;
+}
+export function stripIPv6Zone(host) {
+    const value = stripHostBrackets(host);
+    return hasIPv6Zone(value) ? value.slice(0, value.lastIndexOf("%")) : value;
+}
+export function isWildcardHost(host) {
+    const value = normalizeNetworkHost(host);
+    if (value === "0.0.0.0")
+        return true;
+    return isIP(value) === 6 && value.split(":").every((segment) => segment === "" || /^0+$/.test(segment));
+}
+export function isLoopbackHost(host) {
+    const value = normalizeNetworkHost(host);
+    if (value === "localhost")
+        return true;
+    if (isIP(value) === 4)
+        return value.startsWith("127.");
+    if (isIP(value) !== 6)
+        return false;
+    const segments = value.split(":");
+    const last = segments.pop();
+    return Boolean(last && /^0*1$/.test(last)) && segments.every((segment) => segment === "" || /^0+$/.test(segment));
+}
+export function formatHostForUrl(host) {
+    const value = normalizeNetworkHost(host);
+    return isIP(value) === 6 ? `[${value}]` : value;
+}
+function canonicalIPv6(value) {
+    if (hasIPv6Zone(value))
+        return null;
+    try {
+        return new URL(`http://[${value}]`).hostname.slice(1, -1);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=network-host.js.map

package/dist/server/network-host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-host.js","sourceRoot":"","sources":["../../src/server/network-host.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAExC,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IAC3B,OAAO,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;AAC1F,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAA;IACnD,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,CAAA;QACtC,MAAM,MAAM,GAAG,SAAS,EAAE,KAAK,CAAC,0CAA0C,CAAC,CAAA;QAC3E,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YAC1C,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,IAAI,EAAE,CAAA;QAChE,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAC7B,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,CAAA;AACtC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;IACrC,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;AACjD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;IACrC,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;AAC5E,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAA;IACxC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACpC,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;AACzG,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAA;IACxC,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,IAAI,CAAA;IACtC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IACtD,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAEnC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACjC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAA;IAC3B,OAAO,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;AACnH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAA;IACxC,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAA;AACjD,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,WAAW,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC","sourcesContent":["import { isIP } from \"node:net\"\nimport { domainToASCII } from \"node:url\"\n\nexport function stripHostBrackets(host: string): string {\n  const trimmed = host.trim()\n  return trimmed.startsWith(\"[\") && trimmed.endsWith(\"]\") ? trimmed.slice(1, -1) : trimmed\n}\n\nexport function normalizeNetworkHost(host: string): string {\n  const value = stripHostBrackets(host).toLowerCase()\n  if (isIP(value) === 6) {\n    const canonical = canonicalIPv6(value)\n    const mapped = canonical?.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/)\n    if (mapped) {\n      const high = Number.parseInt(mapped[1], 16)\n      const low = Number.parseInt(mapped[2], 16)\n      return `${high >> 8}.${high & 0xff}.${low >> 8}.${low & 0xff}`\n    }\n  }\n  if (isIP(value)) return value\n  return domainToASCII(value) || value\n}\n\nexport function hasIPv6Zone(host: string): boolean {\n  const value = stripHostBrackets(host)\n  return value.includes(\"%\") && isIP(value) === 6\n}\n\nexport function stripIPv6Zone(host: string): string {\n  const value = stripHostBrackets(host)\n  return hasIPv6Zone(value) ? value.slice(0, value.lastIndexOf(\"%\")) : value\n}\n\nexport function isWildcardHost(host: string): boolean {\n  const value = normalizeNetworkHost(host)\n  if (value === \"0.0.0.0\") return true\n  return isIP(value) === 6 && value.split(\":\").every((segment) => segment === \"\" || /^0+$/.test(segment))\n}\n\nexport function isLoopbackHost(host: string): boolean {\n  const value = normalizeNetworkHost(host)\n  if (value === \"localhost\") return true\n  if (isIP(value) === 4) return value.startsWith(\"127.\")\n  if (isIP(value) !== 6) return false\n\n  const segments = value.split(\":\")\n  const last = segments.pop()\n  return Boolean(last && /^0*1$/.test(last)) && segments.every((segment) => segment === \"\" || /^0+$/.test(segment))\n}\n\nexport function formatHostForUrl(host: string): string {\n  const value = normalizeNetworkHost(host)\n  return isIP(value) === 6 ? `[${value}]` : value\n}\n\nfunction canonicalIPv6(value: string): string | null {\n  if (hasIPv6Zone(value)) return null\n  try {\n    return new URL(`http://[${value}]`).hostname.slice(1, -1)\n  } catch {\n    return null\n  }\n}\n"]}

package/dist/server/routes/meta.js

@@ -1,3 +1,4 @@
+import { isLoopbackHost, isWildcardHost } from "../network-host";
 export function registerMetaRoutes(app, deps) {
     app.get("/api/meta", async () => buildMetaResponse(deps.serverMeta));
 }
@@ -8,7 +9,7 @@ function buildMetaResponse(meta) {
         ...meta,
         localPort,
         remotePort: remote?.port,
-        listeningMode: meta.host === "0.0.0.0" || !isLoopbackHost(meta.host) ? "all" : "local",
+        listeningMode: isWildcardHost(meta.host) || !isLoopbackHost(meta.host) ? "all" : "local",
     };
 }
 function resolveLocalPort(meta) {
@@ -38,8 +39,5 @@ function resolveRemote(meta) {
         return null;
     }
 }
-function isLoopbackHost(host) {
-    return host === "127.0.0.1" || host === "::1" || host.startsWith("127.");
-}
 // NetworkAddress shape is resolved in ../network-addresses
 //# sourceMappingURL=meta.js.map

package/dist/server/routes/meta.js.map

@@ -1 +1 @@
-{"version":3,"file":"meta.js","sourceRoot":"","sources":["../../../src/server/routes/meta.ts"],"names":[],"mappings":"AAQA,MAAM,UAAU,kBAAkB,CAAC,GAAoB,EAAE,IAAe;IACtE,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAA;AACtE,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAgB;IACzC,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAA;IACxC,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IAElC,OAAO;QACL,GAAG,IAAI;QACP,SAAS;QACT,UAAU,EAAE,MAAM,EAAE,IAAI;QACxB,aAAa,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO;KACvF,CAAA;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAgB;IACxC,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC,SAAS,CAAA;IACvB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACrC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAChC,OAAO,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAA;IACV,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAgB;IACrC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAA;QAChE,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAChC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;AAC1E,CAAC;AAED,2DAA2D","sourcesContent":["import { FastifyInstance } from \"fastify\"\nimport { ServerMeta } from \"../../api-types\"\n \n\ninterface RouteDeps {\n  serverMeta: ServerMeta\n}\n\nexport function registerMetaRoutes(app: FastifyInstance, deps: RouteDeps) {\n  app.get(\"/api/meta\", async () => buildMetaResponse(deps.serverMeta))\n}\n\nfunction buildMetaResponse(meta: ServerMeta): ServerMeta {\n  const localPort = resolveLocalPort(meta)\n  const remote = resolveRemote(meta)\n\n  return {\n    ...meta,\n    localPort,\n    remotePort: remote?.port,\n    listeningMode: meta.host === \"0.0.0.0\" || !isLoopbackHost(meta.host) ? \"all\" : \"local\",\n  }\n}\n\nfunction resolveLocalPort(meta: ServerMeta): number {\n  if (Number.isInteger(meta.localPort) && meta.localPort > 0) {\n    return meta.localPort\n  }\n  try {\n    const parsed = new URL(meta.localUrl)\n    const port = Number(parsed.port)\n    return Number.isInteger(port) && port > 0 ? port : 0\n  } catch {\n    return 0\n  }\n}\n\nfunction resolveRemote(meta: ServerMeta): { protocol: \"http\" | \"https\"; port: number } | null {\n  if (!meta.remoteUrl) {\n    return null\n  }\n  try {\n    const parsed = new URL(meta.remoteUrl)\n    const protocol = parsed.protocol === \"https:\" ? \"https\" : \"http\"\n    const port = Number(parsed.port)\n    return { protocol, port: Number.isInteger(port) && port > 0 ? port : 0 }\n  } catch {\n    return null\n  }\n}\n\nfunction isLoopbackHost(host: string): boolean {\n  return host === \"127.0.0.1\" || host === \"::1\" || host.startsWith(\"127.\")\n}\n\n// NetworkAddress shape is resolved in ../network-addresses\n"]}
+{"version":3,"file":"meta.js","sourceRoot":"","sources":["../../../src/server/routes/meta.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAOhE,MAAM,UAAU,kBAAkB,CAAC,GAAoB,EAAE,IAAe;IACtE,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAA;AACtE,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAgB;IACzC,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAA;IACxC,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IAElC,OAAO;QACL,GAAG,IAAI;QACP,SAAS;QACT,UAAU,EAAE,MAAM,EAAE,IAAI;QACxB,aAAa,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO;KACzF,CAAA;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAgB;IACxC,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC,SAAS,CAAA;IACvB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACrC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAChC,OAAO,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAA;IACV,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAgB;IACrC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAA;QAChE,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAChC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,2DAA2D","sourcesContent":["import { FastifyInstance } from \"fastify\"\nimport { ServerMeta } from \"../../api-types\"\nimport { isLoopbackHost, isWildcardHost } from \"../network-host\"\n \n\ninterface RouteDeps {\n  serverMeta: ServerMeta\n}\n\nexport function registerMetaRoutes(app: FastifyInstance, deps: RouteDeps) {\n  app.get(\"/api/meta\", async () => buildMetaResponse(deps.serverMeta))\n}\n\nfunction buildMetaResponse(meta: ServerMeta): ServerMeta {\n  const localPort = resolveLocalPort(meta)\n  const remote = resolveRemote(meta)\n\n  return {\n    ...meta,\n    localPort,\n    remotePort: remote?.port,\n    listeningMode: isWildcardHost(meta.host) || !isLoopbackHost(meta.host) ? \"all\" : \"local\",\n  }\n}\n\nfunction resolveLocalPort(meta: ServerMeta): number {\n  if (Number.isInteger(meta.localPort) && meta.localPort > 0) {\n    return meta.localPort\n  }\n  try {\n    const parsed = new URL(meta.localUrl)\n    const port = Number(parsed.port)\n    return Number.isInteger(port) && port > 0 ? port : 0\n  } catch {\n    return 0\n  }\n}\n\nfunction resolveRemote(meta: ServerMeta): { protocol: \"http\" | \"https\"; port: number } | null {\n  if (!meta.remoteUrl) {\n    return null\n  }\n  try {\n    const parsed = new URL(meta.remoteUrl)\n    const protocol = parsed.protocol === \"https:\" ? \"https\" : \"http\"\n    const port = Number(parsed.port)\n    return { protocol, port: Number.isInteger(port) && port > 0 ? port : 0 }\n  } catch {\n    return null\n  }\n}\n\n// NetworkAddress shape is resolved in ../network-addresses\n"]}

package/dist/server/tls.js

@@ -2,6 +2,8 @@ import crypto from "crypto";
 import fs from "fs";
 import path from "path";
 import { createRequire } from "module";
+import { isIP } from "node:net";
+import { isWildcardHost, normalizeNetworkHost, stripIPv6Zone } from "./network-host";
 const require = createRequire(import.meta.url);
 function loadForge() {
     // node-forge is CJS in many installs; require keeps this compatible with our ESM output.
@@ -39,12 +41,12 @@ function ensureGeneratedTls(args) {
             if (!fs.existsSync(certPath))
                 return true;
             const pem = fs.readFileSync(certPath, "utf-8");
-            const x509 = new crypto.X509Certificate(pem);
-            const validToMs = Date.parse(x509.validTo);
+            const certificate = new crypto.X509Certificate(pem);
+            const validToMs = Date.parse(certificate.validTo);
             if (!Number.isFinite(validToMs))
                 return true;
             const rotateAt = validToMs - ROTATE_IF_EXPIRES_WITHIN_DAYS * 24 * 60 * 60 * 1000;
-            return Date.now() >= rotateAt;
+            return Date.now() >= rotateAt || !certificateCoversRequiredSans(certificate, args.host, args.tlsSANs);
         }
         catch {
             return true;
@@ -164,44 +166,73 @@ function generateServerCertificate(args) {
     };
 }
 function pickCommonName(host) {
-    if (!host || host === "0.0.0.0") {
+    const normalizedHost = normalizeCertificateHost(host);
+    if (!normalizedHost || isWildcardHost(normalizedHost)) {
         return "localhost";
     }
-    if (host === "127.0.0.1") {
+    if (normalizedHost === "127.0.0.1") {
         return "localhost";
     }
-    return host;
+    return normalizedHost;
 }
 function buildSubjectAltNames(host, tlsSANs) {
+    const { dns, ips } = resolveRequiredSubjectAltNames(host, tlsSANs);
+    const altNames = [];
+    // 2 = DNS, 7 = IP
+    for (const name of dns) {
+        altNames.push({ type: 2, value: name });
+    }
+    for (const ip of ips) {
+        altNames.push({ type: 7, ip });
+    }
+    return altNames;
+}
+function resolveRequiredSubjectAltNames(host, tlsSANs) {
     const dns = new Set();
     const ips = new Set();
     dns.add("localhost");
     ips.add("127.0.0.1");
-    if (host && host !== "0.0.0.0") {
-        if (isIPv4(host)) {
-            ips.add(host);
+    const normalizedHost = normalizeCertificateHost(host);
+    if (isWildcardHost(normalizedHost) && isIP(normalizedHost) === 6) {
+        ips.add("::1");
+    }
+    else if (normalizedHost) {
+        if (isIP(normalizedHost)) {
+            ips.add(normalizedHost);
         }
         else {
-            dns.add(host);
+            dns.add(normalizedHost);
         }
     }
     for (const token of splitList(tlsSANs)) {
-        if (isIPv4(token)) {
-            ips.add(token);
+        const normalizedToken = normalizeCertificateHost(token);
+        if (isIP(normalizedToken)) {
+            ips.add(normalizedToken);
         }
-        else if (token) {
-            dns.add(token);
+        else if (normalizedToken) {
+            dns.add(normalizedToken);
         }
     }
-    const altNames = [];
-    // 2 = DNS, 7 = IP
-    for (const name of Array.from(dns)) {
-        altNames.push({ type: 2, value: name });
+    return { dns, ips };
+}
+function normalizeCertificateHost(host) {
+    return normalizeNetworkHost(stripIPv6Zone(host));
+}
+function certificateCoversRequiredSans(certificate, host, tlsSANs) {
+    const { dns, ips } = resolveRequiredSubjectAltNames(host, tlsSANs);
+    const existingDns = new Set((certificate.subjectAltName ?? "")
+        .split(/,\s*/)
+        .filter((entry) => entry.startsWith("DNS:"))
+        .map((entry) => entry.slice(4).toLowerCase()));
+    for (const name of dns) {
+        if (!existingDns.has(name.toLowerCase()))
+            return false;
     }
-    for (const ip of Array.from(ips)) {
-        altNames.push({ type: 7, ip });
+    for (const ip of ips) {
+        if (!certificate.checkIP(ip))
+            return false;
     }
-    return altNames;
+    return true;
 }
 function splitList(input) {
     if (!input)
@@ -211,15 +242,4 @@ function splitList(input) {
         .map((part) => part.trim())
         .filter(Boolean);
 }
-function isIPv4(value) {
-    const parts = value.split(".");
-    if (parts.length !== 4)
-        return false;
-    return parts.every((part) => {
-        if (!/^[0-9]+$/.test(part))
-            return false;
-        const num = Number(part);
-        return Number.isInteger(num) && num >= 0 && num <= 255;
-    });
-}
 //# sourceMappingURL=tls.js.map

package/dist/server/tls.js.map

@@ -1 +1 @@
-{"version":3,"file":"tls.js","sourceRoot":"","sources":["../../src/server/tls.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAA;AAC3B,OAAO,EAAE,MAAM,IAAI,CAAA;AACnB,OAAO,IAAI,MAAM,MAAM,CAAA;AACvB,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAA;AAGtC,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAI9C,SAAS,SAAS;IAChB,yFAAyF;IACzF,OAAO,OAAO,CAAC,YAAY,CAAU,CAAA;AACvC,CAAC;AAoBD,MAAM,kBAAkB,GAAG,EAAE,CAAA;AAC7B,MAAM,6BAA6B,GAAG,CAAC,CAAA;AAEvC,MAAM,gBAAgB,GAAG,GAAG,CAAA;AAE5B,MAAM,UAAU,mBAAmB,CAAC,IAA6B;IAC/D,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,WAAW,CAAC,CAAA;IAChE,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAW,EAAE,OAAO,CAAC,CAAA;QACtD,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,WAAY,EAAE,OAAO,CAAC,CAAA;QACxD,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAChF,OAAO;YACL,YAAY,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE;YAC/B,UAAU,EAAE,IAAI,CAAC,SAAS;YAC1B,IAAI,EAAE,UAAU;SACjB,CAAA;IACH,CAAC;IAED,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAA;AACjC,CAAC;AAED,SAAS,kBAAkB,CAAC,IAA6B;IACvD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;IAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IACjD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;IACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAA;IAErD,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAEzC,MAAM,gBAAgB,GAAG,GAAG,EAAE;QAC5B,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAA;YACzC,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;YAC9C,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;YAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,OAAO,IAAI,CAAA;YAC5C,MAAM,QAAQ,GAAG,SAAS,GAAG,6BAA6B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;YAChF,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,CAAA;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC,CAAA;IAED,MAAM,cAAc,GAAG,GAAG,EAAE;QAC1B,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;gBAAE,OAAO,IAAI,CAAA;YAC3C,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;YAChD,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;YAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,OAAO,IAAI,CAAA;YAC5C,gCAAgC;YAChC,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,SAAS,CAAA;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC,CAAA;IAED,IAAI,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAClD,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,qBAAqB,EAAE,CAAA;QACvD,YAAY,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAA;QACxC,YAAY,CAAC,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;QAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,EAAE,gDAAgD,CAAC,CAAA;IACpF,CAAC;IAED,IAAI,gBAAgB,EAAE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;QACpD,MAAM,SAAS,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;QAEtD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,yBAAyB,CAAC;YACpD,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,QAAQ;YACR,SAAS;SACV,CAAC,CAAA;QAEF,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;QACpC,YAAY,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,uCAAuC,CAAC,CAAA;IACzE,CAAC;IAED,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IAC7C,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC/C,MAAM,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;IAE/C,uCAAuC;IACvC,MAAM,WAAW,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,CAAA;IAEpD,OAAO;QACL,YAAY,EAAE;YACZ,GAAG;YACH,IAAI,EAAE,WAAW;SAClB;QACD,UAAU;QACV,IAAI,EAAE,WAAW;KAClB,CAAA;AACH,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB,EAAE,OAAe,EAAE,IAAY;IACnE,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAChE,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,6CAA6C;IAC/C,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB;IAC5B,MAAM,KAAK,GAAG,SAAS,EAAE,CAAA;IAEzB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAA;IAChD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAA;IAC1C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;IAC/B,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAE1D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IACtB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,CAAA;IAClD,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,gBAAgB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACjF,IAAI,CAAC,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAA;IACnC,IAAI,CAAC,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAEjC,MAAM,KAAK,GAAG,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAA;IACnE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;IACtB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAErB,IAAI,CAAC,aAAa,CAAC;QACjB,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,IAAI,EAAE;QACtC,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE;QAC9E,EAAE,IAAI,EAAE,sBAAsB,EAAE;KACjC,CAAC,CAAA;IAEF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;IAEpD,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC;QACpD,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC;KAC5C,CAAA;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,IAKlC;IACC,MAAM,KAAK,GAAG,SAAS,EAAE,CAAA;IAEzB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACxD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAE3D,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAA;IAChD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAA;IAC1C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;IAC/B,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAE1D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IACtB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,CAAA;IAClD,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACnF,IAAI,CAAC,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAA;IACnC,IAAI,CAAC,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAEjC,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC5C,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,CAAA;IAC5D,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IAEzC,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;IAEzD,IAAI,CAAC,aAAa,CAAC;QACjB,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,KAAK,EAAE;QACvC,EAAE,IAAI,EAAE,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE;QACnE,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,IAAI,EAAE;QACzC,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,GAAG,EAAE;QACzC,EAAE,IAAI,EAAE,sBAAsB,EAAE;KACjC,CAAC,CAAA;IAEF,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;IAE1C,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC;QAClD,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC;KAC1C,CAAA;AACH,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,WAAW,CAAA;IACpB,CAAC;IACD,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,OAAO,WAAW,CAAA;IACpB,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,OAAgB;IAC1D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAA;IAC7B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAA;IAE7B,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IACpB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IAEpB,IAAI,IAAI,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACjB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACf,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACf,CAAC;IACH,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAClB,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAChB,CAAC;aAAM,IAAI,KAAK,EAAE,CAAC;YACjB,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAChB,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAyD,EAAE,CAAA;IAEzE,kBAAkB;IAClB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACzC,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;IAChC,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,SAAS,SAAS,CAAC,KAAyB;IAC1C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAA;IACrB,OAAO,KAAK;SACT,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CAAA;AACpB,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACpC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE;QAC1B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;QACxC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;QACxB,OAAO,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,CAAA;IACxD,CAAC,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import crypto from \"crypto\"\nimport fs from \"fs\"\nimport path from \"path\"\nimport { createRequire } from \"module\"\nimport type { Logger } from \"../logger\"\n\nconst require = createRequire(import.meta.url)\n\ntype Forge = typeof import(\"node-forge\")\n\nfunction loadForge(): Forge {\n  // node-forge is CJS in many installs; require keeps this compatible with our ESM output.\n  return require(\"node-forge\") as Forge\n}\n\nexport interface ResolvedHttpsOptions {\n  httpsOptions: { key: string | Buffer; cert: string | Buffer; ca?: string | Buffer }\n  /** Path to CA certificate suitable for NODE_EXTRA_CA_CERTS. */\n  caCertPath?: string\n  mode: \"provided\" | \"generated\"\n}\n\nexport interface ResolveHttpsOptionsArgs {\n  enabled: boolean\n  configDir: string\n  host: string\n  tlsKeyPath?: string\n  tlsCertPath?: string\n  tlsCaPath?: string\n  tlsSANs?: string\n  logger: Logger\n}\n\nconst LEAF_VALIDITY_DAYS = 30\nconst ROTATE_IF_EXPIRES_WITHIN_DAYS = 3\n\nconst CA_VALIDITY_DAYS = 365\n\nexport function resolveHttpsOptions(args: ResolveHttpsOptionsArgs): ResolvedHttpsOptions | null {\n  if (!args.enabled) {\n    return null\n  }\n\n  const hasProvided = Boolean(args.tlsKeyPath && args.tlsCertPath)\n  if (hasProvided) {\n    const key = fs.readFileSync(args.tlsKeyPath!, \"utf-8\")\n    const cert = fs.readFileSync(args.tlsCertPath!, \"utf-8\")\n    const ca = args.tlsCaPath ? fs.readFileSync(args.tlsCaPath, \"utf-8\") : undefined\n    return {\n      httpsOptions: { key, cert, ca },\n      caCertPath: args.tlsCaPath,\n      mode: \"provided\",\n    }\n  }\n\n  return ensureGeneratedTls(args)\n}\n\nfunction ensureGeneratedTls(args: ResolveHttpsOptionsArgs): ResolvedHttpsOptions {\n  const tlsDir = path.join(args.configDir, \"tls\")\n  const caKeyPath = path.join(tlsDir, \"ca-key.pem\")\n  const caCertPath = path.join(tlsDir, \"ca-cert.pem\")\n  const keyPath = path.join(tlsDir, \"server-key.pem\")\n  const certPath = path.join(tlsDir, \"server-cert.pem\")\n\n  fs.mkdirSync(tlsDir, { recursive: true })\n\n  const shouldRotateLeaf = () => {\n    try {\n      if (!fs.existsSync(certPath)) return true\n      const pem = fs.readFileSync(certPath, \"utf-8\")\n      const x509 = new crypto.X509Certificate(pem)\n      const validToMs = Date.parse(x509.validTo)\n      if (!Number.isFinite(validToMs)) return true\n      const rotateAt = validToMs - ROTATE_IF_EXPIRES_WITHIN_DAYS * 24 * 60 * 60 * 1000\n      return Date.now() >= rotateAt\n    } catch {\n      return true\n    }\n  }\n\n  const shouldRotateCa = () => {\n    try {\n      if (!fs.existsSync(caCertPath)) return true\n      const pem = fs.readFileSync(caCertPath, \"utf-8\")\n      const x509 = new crypto.X509Certificate(pem)\n      const validToMs = Date.parse(x509.validTo)\n      if (!Number.isFinite(validToMs)) return true\n      // CA rotates only when expired.\n      return Date.now() >= validToMs\n    } catch {\n      return true\n    }\n  }\n\n  if (shouldRotateCa() || !fs.existsSync(caKeyPath)) {\n    const { caKeyPem, caCertPem } = generateCaCertificate()\n    writePemFile(caKeyPath, caKeyPem, 0o600)\n    writePemFile(caCertPath, caCertPem, 0o644)\n    args.logger.info({ caCertPath }, \"Generated self-signed CodeNomad CA certificate\")\n  }\n\n  if (shouldRotateLeaf() || !fs.existsSync(keyPath)) {\n    const caKeyPem = fs.readFileSync(caKeyPath, \"utf-8\")\n    const caCertPem = fs.readFileSync(caCertPath, \"utf-8\")\n\n    const { keyPem, certPem } = generateServerCertificate({\n      host: args.host,\n      tlsSANs: args.tlsSANs,\n      caKeyPem,\n      caCertPem,\n    })\n\n    writePemFile(keyPath, keyPem, 0o600)\n    writePemFile(certPath, certPem, 0o644)\n    args.logger.info({ certPath }, \"Generated CodeNomad HTTPS certificate\")\n  }\n\n  const key = fs.readFileSync(keyPath, \"utf-8\")\n  const cert = fs.readFileSync(certPath, \"utf-8\")\n  const ca = fs.readFileSync(caCertPath, \"utf-8\")\n\n  // Present the CA as part of the chain.\n  const chainedCert = `${cert.trim()}\\n${ca.trim()}\\n`\n\n  return {\n    httpsOptions: {\n      key,\n      cert: chainedCert,\n    },\n    caCertPath,\n    mode: \"generated\",\n  }\n}\n\nfunction writePemFile(filePath: string, content: string, mode: number) {\n  fs.writeFileSync(filePath, content, { encoding: \"utf-8\", mode })\n  try {\n    fs.chmodSync(filePath, mode)\n  } catch {\n    // best effort on platforms that ignore chmod\n  }\n}\n\nfunction generateCaCertificate(): { caKeyPem: string; caCertPem: string } {\n  const forge = loadForge()\n\n  const keys = forge.pki.rsa.generateKeyPair(2048)\n  const cert = forge.pki.createCertificate()\n  cert.publicKey = keys.publicKey\n  cert.serialNumber = crypto.randomBytes(16).toString(\"hex\")\n\n  const now = new Date()\n  const notBefore = new Date(now.getTime() - 60_000)\n  const notAfter = new Date(now.getTime() + CA_VALIDITY_DAYS * 24 * 60 * 60 * 1000)\n  cert.validity.notBefore = notBefore\n  cert.validity.notAfter = notAfter\n\n  const attrs = [{ name: \"commonName\", value: \"CodeNomad Local CA\" }]\n  cert.setSubject(attrs)\n  cert.setIssuer(attrs)\n\n  cert.setExtensions([\n    { name: \"basicConstraints\", cA: true },\n    { name: \"keyUsage\", keyCertSign: true, cRLSign: true, digitalSignature: true },\n    { name: \"subjectKeyIdentifier\" },\n  ])\n\n  cert.sign(keys.privateKey, forge.md.sha256.create())\n\n  return {\n    caKeyPem: forge.pki.privateKeyToPem(keys.privateKey),\n    caCertPem: forge.pki.certificateToPem(cert),\n  }\n}\n\nfunction generateServerCertificate(args: {\n  host: string\n  tlsSANs?: string\n  caKeyPem: string\n  caCertPem: string\n}): { keyPem: string; certPem: string } {\n  const forge = loadForge()\n\n  const caKey = forge.pki.privateKeyFromPem(args.caKeyPem)\n  const caCert = forge.pki.certificateFromPem(args.caCertPem)\n\n  const keys = forge.pki.rsa.generateKeyPair(2048)\n  const cert = forge.pki.createCertificate()\n  cert.publicKey = keys.publicKey\n  cert.serialNumber = crypto.randomBytes(16).toString(\"hex\")\n\n  const now = new Date()\n  const notBefore = new Date(now.getTime() - 60_000)\n  const notAfter = new Date(now.getTime() + LEAF_VALIDITY_DAYS * 24 * 60 * 60 * 1000)\n  cert.validity.notBefore = notBefore\n  cert.validity.notAfter = notAfter\n\n  const commonName = pickCommonName(args.host)\n  cert.setSubject([{ name: \"commonName\", value: commonName }])\n  cert.setIssuer(caCert.subject.attributes)\n\n  const san = buildSubjectAltNames(args.host, args.tlsSANs)\n\n  cert.setExtensions([\n    { name: \"basicConstraints\", cA: false },\n    { name: \"keyUsage\", digitalSignature: true, keyEncipherment: true },\n    { name: \"extKeyUsage\", serverAuth: true },\n    { name: \"subjectAltName\", altNames: san },\n    { name: \"subjectKeyIdentifier\" },\n  ])\n\n  cert.sign(caKey, forge.md.sha256.create())\n\n  return {\n    keyPem: forge.pki.privateKeyToPem(keys.privateKey),\n    certPem: forge.pki.certificateToPem(cert),\n  }\n}\n\nfunction pickCommonName(host: string): string {\n  if (!host || host === \"0.0.0.0\") {\n    return \"localhost\"\n  }\n  if (host === \"127.0.0.1\") {\n    return \"localhost\"\n  }\n  return host\n}\n\nfunction buildSubjectAltNames(host: string, tlsSANs?: string): Array<{ type: number; value?: string; ip?: string }> {\n  const dns = new Set<string>()\n  const ips = new Set<string>()\n\n  dns.add(\"localhost\")\n  ips.add(\"127.0.0.1\")\n\n  if (host && host !== \"0.0.0.0\") {\n    if (isIPv4(host)) {\n      ips.add(host)\n    } else {\n      dns.add(host)\n    }\n  }\n\n  for (const token of splitList(tlsSANs)) {\n    if (isIPv4(token)) {\n      ips.add(token)\n    } else if (token) {\n      dns.add(token)\n    }\n  }\n\n  const altNames: Array<{ type: number; value?: string; ip?: string }> = []\n\n  // 2 = DNS, 7 = IP\n  for (const name of Array.from(dns)) {\n    altNames.push({ type: 2, value: name })\n  }\n  for (const ip of Array.from(ips)) {\n    altNames.push({ type: 7, ip })\n  }\n\n  return altNames\n}\n\nfunction splitList(input: string | undefined): string[] {\n  if (!input) return []\n  return input\n    .split(\",\")\n    .map((part) => part.trim())\n    .filter(Boolean)\n}\n\nfunction isIPv4(value: string): boolean {\n  const parts = value.split(\".\")\n  if (parts.length !== 4) return false\n  return parts.every((part) => {\n    if (!/^[0-9]+$/.test(part)) return false\n    const num = Number(part)\n    return Number.isInteger(num) && num >= 0 && num <= 255\n  })\n}\n"]}
+{"version":3,"file":"tls.js","sourceRoot":"","sources":["../../src/server/tls.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAA;AAC3B,OAAO,EAAE,MAAM,IAAI,CAAA;AACnB,OAAO,IAAI,MAAM,MAAM,CAAA;AACvB,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAA;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAE/B,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAEpF,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAI9C,SAAS,SAAS;IAChB,yFAAyF;IACzF,OAAO,OAAO,CAAC,YAAY,CAAU,CAAA;AACvC,CAAC;AAoBD,MAAM,kBAAkB,GAAG,EAAE,CAAA;AAC7B,MAAM,6BAA6B,GAAG,CAAC,CAAA;AAEvC,MAAM,gBAAgB,GAAG,GAAG,CAAA;AAE5B,MAAM,UAAU,mBAAmB,CAAC,IAA6B;IAC/D,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,WAAW,CAAC,CAAA;IAChE,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAW,EAAE,OAAO,CAAC,CAAA;QACtD,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,WAAY,EAAE,OAAO,CAAC,CAAA;QACxD,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAChF,OAAO;YACL,YAAY,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE;YAC/B,UAAU,EAAE,IAAI,CAAC,SAAS;YAC1B,IAAI,EAAE,UAAU;SACjB,CAAA;IACH,CAAC;IAED,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAA;AACjC,CAAC;AAED,SAAS,kBAAkB,CAAC,IAA6B;IACvD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;IAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IACjD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;IACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAA;IAErD,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAEzC,MAAM,gBAAgB,GAAG,GAAG,EAAE;QAC5B,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAA;YACzC,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;YAC9C,MAAM,WAAW,GAAG,IAAI,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;YACnD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;YACjD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,OAAO,IAAI,CAAA;YAC5C,MAAM,QAAQ,GAAG,SAAS,GAAG,6BAA6B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;YAChF,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,IAAI,CAAC,6BAA6B,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;QACvG,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC,CAAA;IAED,MAAM,cAAc,GAAG,GAAG,EAAE;QAC1B,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;gBAAE,OAAO,IAAI,CAAA;YAC3C,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;YAChD,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;YAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,OAAO,IAAI,CAAA;YAC5C,gCAAgC;YAChC,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,SAAS,CAAA;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC,CAAA;IAED,IAAI,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAClD,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,qBAAqB,EAAE,CAAA;QACvD,YAAY,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAA;QACxC,YAAY,CAAC,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;QAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,EAAE,gDAAgD,CAAC,CAAA;IACpF,CAAC;IAED,IAAI,gBAAgB,EAAE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;QACpD,MAAM,SAAS,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;QAEtD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,yBAAyB,CAAC;YACpD,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,QAAQ;YACR,SAAS;SACV,CAAC,CAAA;QAEF,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;QACpC,YAAY,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,uCAAuC,CAAC,CAAA;IACzE,CAAC;IAED,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IAC7C,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC/C,MAAM,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;IAE/C,uCAAuC;IACvC,MAAM,WAAW,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,CAAA;IAEpD,OAAO;QACL,YAAY,EAAE;YACZ,GAAG;YACH,IAAI,EAAE,WAAW;SAClB;QACD,UAAU;QACV,IAAI,EAAE,WAAW;KAClB,CAAA;AACH,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB,EAAE,OAAe,EAAE,IAAY;IACnE,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAChE,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,6CAA6C;IAC/C,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB;IAC5B,MAAM,KAAK,GAAG,SAAS,EAAE,CAAA;IAEzB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAA;IAChD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAA;IAC1C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;IAC/B,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAE1D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IACtB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,CAAA;IAClD,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,gBAAgB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACjF,IAAI,CAAC,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAA;IACnC,IAAI,CAAC,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAEjC,MAAM,KAAK,GAAG,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAA;IACnE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;IACtB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAErB,IAAI,CAAC,aAAa,CAAC;QACjB,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,IAAI,EAAE;QACtC,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE;QAC9E,EAAE,IAAI,EAAE,sBAAsB,EAAE;KACjC,CAAC,CAAA;IAEF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;IAEpD,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC;QACpD,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC;KAC5C,CAAA;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,IAKlC;IACC,MAAM,KAAK,GAAG,SAAS,EAAE,CAAA;IAEzB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACxD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAE3D,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAA;IAChD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAA;IAC1C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;IAC/B,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAE1D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IACtB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,CAAA;IAClD,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACnF,IAAI,CAAC,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAA;IACnC,IAAI,CAAC,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAEjC,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC5C,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,CAAA;IAC5D,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IAEzC,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;IAEzD,IAAI,CAAC,aAAa,CAAC;QACjB,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,KAAK,EAAE;QACvC,EAAE,IAAI,EAAE,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE;QACnE,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,IAAI,EAAE;QACzC,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,GAAG,EAAE;QACzC,EAAE,IAAI,EAAE,sBAAsB,EAAE;KACjC,CAAC,CAAA;IAEF,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;IAE1C,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC;QAClD,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC;KAC1C,CAAA;AACH,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,cAAc,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAA;IACrD,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,cAAc,CAAC,EAAE,CAAC;QACtD,OAAO,WAAW,CAAA;IACpB,CAAC;IACD,IAAI,cAAc,KAAK,WAAW,EAAE,CAAC;QACnC,OAAO,WAAW,CAAA;IACpB,CAAC;IACD,OAAO,cAAc,CAAA;AACvB,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,OAAgB;IAC1D,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,8BAA8B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAClE,MAAM,QAAQ,GAAyD,EAAE,CAAA;IAEzE,kBAAkB;IAClB,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACzC,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;IAChC,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,SAAS,8BAA8B,CAAC,IAAY,EAAE,OAAgB;IACpE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAA;IAC7B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAA;IAE7B,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IACpB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IAEpB,MAAM,cAAc,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAA;IACrD,IAAI,cAAc,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IAChB,CAAC;SAAM,IAAI,cAAc,EAAE,CAAC;QAC1B,IAAI,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;QACzB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;QACzB,CAAC;IACH,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,eAAe,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAA;QACvD,IAAI,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YAC1B,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;QAC1B,CAAC;aAAM,IAAI,eAAe,EAAE,CAAC;YAC3B,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA;AACrB,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAY;IAC5C,OAAO,oBAAoB,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAA;AAClD,CAAC;AAED,SAAS,6BAA6B,CAAC,WAAmC,EAAE,IAAY,EAAE,OAAgB;IACxG,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,8BAA8B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAClE,MAAM,WAAW,GAAG,IAAI,GAAG,CACzB,CAAC,WAAW,CAAC,cAAc,IAAI,EAAE,CAAC;SAC/B,KAAK,CAAC,MAAM,CAAC;SACb,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;SAC3C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAChD,CAAA;IAED,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,KAAK,CAAA;IACxD,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YAAE,OAAO,KAAK,CAAA;IAC5C,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,SAAS,CAAC,KAAyB;IAC1C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAA;IACrB,OAAO,KAAK;SACT,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CAAA;AACpB,CAAC","sourcesContent":["import crypto from \"crypto\"\nimport fs from \"fs\"\nimport path from \"path\"\nimport { createRequire } from \"module\"\nimport { isIP } from \"node:net\"\nimport type { Logger } from \"../logger\"\nimport { isWildcardHost, normalizeNetworkHost, stripIPv6Zone } from \"./network-host\"\n\nconst require = createRequire(import.meta.url)\n\ntype Forge = typeof import(\"node-forge\")\n\nfunction loadForge(): Forge {\n  // node-forge is CJS in many installs; require keeps this compatible with our ESM output.\n  return require(\"node-forge\") as Forge\n}\n\nexport interface ResolvedHttpsOptions {\n  httpsOptions: { key: string | Buffer; cert: string | Buffer; ca?: string | Buffer }\n  /** Path to CA certificate suitable for NODE_EXTRA_CA_CERTS. */\n  caCertPath?: string\n  mode: \"provided\" | \"generated\"\n}\n\nexport interface ResolveHttpsOptionsArgs {\n  enabled: boolean\n  configDir: string\n  host: string\n  tlsKeyPath?: string\n  tlsCertPath?: string\n  tlsCaPath?: string\n  tlsSANs?: string\n  logger: Logger\n}\n\nconst LEAF_VALIDITY_DAYS = 30\nconst ROTATE_IF_EXPIRES_WITHIN_DAYS = 3\n\nconst CA_VALIDITY_DAYS = 365\n\nexport function resolveHttpsOptions(args: ResolveHttpsOptionsArgs): ResolvedHttpsOptions | null {\n  if (!args.enabled) {\n    return null\n  }\n\n  const hasProvided = Boolean(args.tlsKeyPath && args.tlsCertPath)\n  if (hasProvided) {\n    const key = fs.readFileSync(args.tlsKeyPath!, \"utf-8\")\n    const cert = fs.readFileSync(args.tlsCertPath!, \"utf-8\")\n    const ca = args.tlsCaPath ? fs.readFileSync(args.tlsCaPath, \"utf-8\") : undefined\n    return {\n      httpsOptions: { key, cert, ca },\n      caCertPath: args.tlsCaPath,\n      mode: \"provided\",\n    }\n  }\n\n  return ensureGeneratedTls(args)\n}\n\nfunction ensureGeneratedTls(args: ResolveHttpsOptionsArgs): ResolvedHttpsOptions {\n  const tlsDir = path.join(args.configDir, \"tls\")\n  const caKeyPath = path.join(tlsDir, \"ca-key.pem\")\n  const caCertPath = path.join(tlsDir, \"ca-cert.pem\")\n  const keyPath = path.join(tlsDir, \"server-key.pem\")\n  const certPath = path.join(tlsDir, \"server-cert.pem\")\n\n  fs.mkdirSync(tlsDir, { recursive: true })\n\n  const shouldRotateLeaf = () => {\n    try {\n      if (!fs.existsSync(certPath)) return true\n      const pem = fs.readFileSync(certPath, \"utf-8\")\n      const certificate = new crypto.X509Certificate(pem)\n      const validToMs = Date.parse(certificate.validTo)\n      if (!Number.isFinite(validToMs)) return true\n      const rotateAt = validToMs - ROTATE_IF_EXPIRES_WITHIN_DAYS * 24 * 60 * 60 * 1000\n      return Date.now() >= rotateAt || !certificateCoversRequiredSans(certificate, args.host, args.tlsSANs)\n    } catch {\n      return true\n    }\n  }\n\n  const shouldRotateCa = () => {\n    try {\n      if (!fs.existsSync(caCertPath)) return true\n      const pem = fs.readFileSync(caCertPath, \"utf-8\")\n      const x509 = new crypto.X509Certificate(pem)\n      const validToMs = Date.parse(x509.validTo)\n      if (!Number.isFinite(validToMs)) return true\n      // CA rotates only when expired.\n      return Date.now() >= validToMs\n    } catch {\n      return true\n    }\n  }\n\n  if (shouldRotateCa() || !fs.existsSync(caKeyPath)) {\n    const { caKeyPem, caCertPem } = generateCaCertificate()\n    writePemFile(caKeyPath, caKeyPem, 0o600)\n    writePemFile(caCertPath, caCertPem, 0o644)\n    args.logger.info({ caCertPath }, \"Generated self-signed CodeNomad CA certificate\")\n  }\n\n  if (shouldRotateLeaf() || !fs.existsSync(keyPath)) {\n    const caKeyPem = fs.readFileSync(caKeyPath, \"utf-8\")\n    const caCertPem = fs.readFileSync(caCertPath, \"utf-8\")\n\n    const { keyPem, certPem } = generateServerCertificate({\n      host: args.host,\n      tlsSANs: args.tlsSANs,\n      caKeyPem,\n      caCertPem,\n    })\n\n    writePemFile(keyPath, keyPem, 0o600)\n    writePemFile(certPath, certPem, 0o644)\n    args.logger.info({ certPath }, \"Generated CodeNomad HTTPS certificate\")\n  }\n\n  const key = fs.readFileSync(keyPath, \"utf-8\")\n  const cert = fs.readFileSync(certPath, \"utf-8\")\n  const ca = fs.readFileSync(caCertPath, \"utf-8\")\n\n  // Present the CA as part of the chain.\n  const chainedCert = `${cert.trim()}\\n${ca.trim()}\\n`\n\n  return {\n    httpsOptions: {\n      key,\n      cert: chainedCert,\n    },\n    caCertPath,\n    mode: \"generated\",\n  }\n}\n\nfunction writePemFile(filePath: string, content: string, mode: number) {\n  fs.writeFileSync(filePath, content, { encoding: \"utf-8\", mode })\n  try {\n    fs.chmodSync(filePath, mode)\n  } catch {\n    // best effort on platforms that ignore chmod\n  }\n}\n\nfunction generateCaCertificate(): { caKeyPem: string; caCertPem: string } {\n  const forge = loadForge()\n\n  const keys = forge.pki.rsa.generateKeyPair(2048)\n  const cert = forge.pki.createCertificate()\n  cert.publicKey = keys.publicKey\n  cert.serialNumber = crypto.randomBytes(16).toString(\"hex\")\n\n  const now = new Date()\n  const notBefore = new Date(now.getTime() - 60_000)\n  const notAfter = new Date(now.getTime() + CA_VALIDITY_DAYS * 24 * 60 * 60 * 1000)\n  cert.validity.notBefore = notBefore\n  cert.validity.notAfter = notAfter\n\n  const attrs = [{ name: \"commonName\", value: \"CodeNomad Local CA\" }]\n  cert.setSubject(attrs)\n  cert.setIssuer(attrs)\n\n  cert.setExtensions([\n    { name: \"basicConstraints\", cA: true },\n    { name: \"keyUsage\", keyCertSign: true, cRLSign: true, digitalSignature: true },\n    { name: \"subjectKeyIdentifier\" },\n  ])\n\n  cert.sign(keys.privateKey, forge.md.sha256.create())\n\n  return {\n    caKeyPem: forge.pki.privateKeyToPem(keys.privateKey),\n    caCertPem: forge.pki.certificateToPem(cert),\n  }\n}\n\nfunction generateServerCertificate(args: {\n  host: string\n  tlsSANs?: string\n  caKeyPem: string\n  caCertPem: string\n}): { keyPem: string; certPem: string } {\n  const forge = loadForge()\n\n  const caKey = forge.pki.privateKeyFromPem(args.caKeyPem)\n  const caCert = forge.pki.certificateFromPem(args.caCertPem)\n\n  const keys = forge.pki.rsa.generateKeyPair(2048)\n  const cert = forge.pki.createCertificate()\n  cert.publicKey = keys.publicKey\n  cert.serialNumber = crypto.randomBytes(16).toString(\"hex\")\n\n  const now = new Date()\n  const notBefore = new Date(now.getTime() - 60_000)\n  const notAfter = new Date(now.getTime() + LEAF_VALIDITY_DAYS * 24 * 60 * 60 * 1000)\n  cert.validity.notBefore = notBefore\n  cert.validity.notAfter = notAfter\n\n  const commonName = pickCommonName(args.host)\n  cert.setSubject([{ name: \"commonName\", value: commonName }])\n  cert.setIssuer(caCert.subject.attributes)\n\n  const san = buildSubjectAltNames(args.host, args.tlsSANs)\n\n  cert.setExtensions([\n    { name: \"basicConstraints\", cA: false },\n    { name: \"keyUsage\", digitalSignature: true, keyEncipherment: true },\n    { name: \"extKeyUsage\", serverAuth: true },\n    { name: \"subjectAltName\", altNames: san },\n    { name: \"subjectKeyIdentifier\" },\n  ])\n\n  cert.sign(caKey, forge.md.sha256.create())\n\n  return {\n    keyPem: forge.pki.privateKeyToPem(keys.privateKey),\n    certPem: forge.pki.certificateToPem(cert),\n  }\n}\n\nfunction pickCommonName(host: string): string {\n  const normalizedHost = normalizeCertificateHost(host)\n  if (!normalizedHost || isWildcardHost(normalizedHost)) {\n    return \"localhost\"\n  }\n  if (normalizedHost === \"127.0.0.1\") {\n    return \"localhost\"\n  }\n  return normalizedHost\n}\n\nfunction buildSubjectAltNames(host: string, tlsSANs?: string): Array<{ type: number; value?: string; ip?: string }> {\n  const { dns, ips } = resolveRequiredSubjectAltNames(host, tlsSANs)\n  const altNames: Array<{ type: number; value?: string; ip?: string }> = []\n\n  // 2 = DNS, 7 = IP\n  for (const name of dns) {\n    altNames.push({ type: 2, value: name })\n  }\n  for (const ip of ips) {\n    altNames.push({ type: 7, ip })\n  }\n\n  return altNames\n}\n\nfunction resolveRequiredSubjectAltNames(host: string, tlsSANs?: string): { dns: Set<string>; ips: Set<string> } {\n  const dns = new Set<string>()\n  const ips = new Set<string>()\n\n  dns.add(\"localhost\")\n  ips.add(\"127.0.0.1\")\n\n  const normalizedHost = normalizeCertificateHost(host)\n  if (isWildcardHost(normalizedHost) && isIP(normalizedHost) === 6) {\n    ips.add(\"::1\")\n  } else if (normalizedHost) {\n    if (isIP(normalizedHost)) {\n      ips.add(normalizedHost)\n    } else {\n      dns.add(normalizedHost)\n    }\n  }\n\n  for (const token of splitList(tlsSANs)) {\n    const normalizedToken = normalizeCertificateHost(token)\n    if (isIP(normalizedToken)) {\n      ips.add(normalizedToken)\n    } else if (normalizedToken) {\n      dns.add(normalizedToken)\n    }\n  }\n\n  return { dns, ips }\n}\n\nfunction normalizeCertificateHost(host: string): string {\n  return normalizeNetworkHost(stripIPv6Zone(host))\n}\n\nfunction certificateCoversRequiredSans(certificate: crypto.X509Certificate, host: string, tlsSANs?: string): boolean {\n  const { dns, ips } = resolveRequiredSubjectAltNames(host, tlsSANs)\n  const existingDns = new Set(\n    (certificate.subjectAltName ?? \"\")\n      .split(/,\\s*/)\n      .filter((entry) => entry.startsWith(\"DNS:\"))\n      .map((entry) => entry.slice(4).toLowerCase()),\n  )\n\n  for (const name of dns) {\n    if (!existingDns.has(name.toLowerCase())) return false\n  }\n  for (const ip of ips) {\n    if (!certificate.checkIP(ip)) return false\n  }\n  return true\n}\n\nfunction splitList(input: string | undefined): string[] {\n  if (!input) return []\n  return input\n    .split(\",\")\n    .map((part) => part.trim())\n    .filter(Boolean)\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neuralnomads/codenomad-dev",
-  "version": "0.20.0-dev-20260908-e5115fe8",
+  "version": "0.20.0-dev-20260910-abaf6eba",
   "description": "CodeNomad Server",
   "license": "MIT",
   "author": {