@viaalink/caddy-api-client 0.0.0-stage → 0.10.0

package/dist/index.d.ts

@@ -0,0 +1,101 @@
+export { o as ActiveHealthChecksSchema, A as AdaptOptionsSchema, h as AddDomainWithAutoTlsOptionsSchema, i as AddDomainWithTlsOptionsSchema, x as AuthenticationHandlerSchema, B as BasicAuthOptionsSchema, g as CaddyAdapterSchema, a6 as CaddyClient, f as CaddyClientOptionsSchema, n as CaddyDurationSchema, a1 as CaddyHandlerSchema, d as CaddyRouteHandlerSchema, C as CaddyRouteMatcherSchema, e as CaddyRouteSchema, Z as CopyResponseHandlerSchema, _ as CopyResponseHeadersHandlerSchema, j as DeleteDomainOptionsSchema, a as DialAddressSchema, D as DomainSchema, z as EncodeHandlerSchema, Y as ErrorHandlerSchema, E as ExtendedRouteMatcherSchema, G as FileServerHandlerSchema, F as FrameOptionsSchema, t as HeaderRegexpSchema, v as HeadersHandlerSchema, l as HealthCheckRouteOptionsSchema, q as HealthChecksSchema, m as HostRouteOptionsSchema, H as HttpMethodSchema, O as InterceptHandlerSchema, Q as InvokeHandlerSchema, a0 as KnownCaddyHandlerSchema, L as LoadBalancerRouteOptionsSchema, r as LoadBalancingSchema, X as LogAppendHandlerSchema, J as MapHandlerSchema, c as MatchHeaderSchema, M as MatchQuerySchema, a4 as MitmwebOptionsSchema, p as PassiveHealthChecksSchema, P as PathRouteOptionsSchema, K as PushHandlerSchema, R as RedirectModeSchema, b as RedirectStatusCodeSchema, N as RequestBodyHandlerSchema, u as ReverseProxyHandlerSchema, y as RewriteHandlerSchema, S as SecurityHeadersSchema, k as ServiceRouteOptionsSchema, w as StaticResponseHandlerSchema, $ as SubrouteHandlerSchema, I as TemplatesHandlerSchema, T as TlsIssuerSchema, W as TracingHandlerSchema, U as UpdateDomainOptionsSchema, s as UpstreamSchema, a3 as UpstreamStatusArraySchema, a2 as UpstreamStatusSchema, V as VarsHandlerSchema, a5 as validate } from './client-Bf2QoSWQ.js';
+export { q as AuthenticationHandler, A as AuthenticationPortal, f as AuthorizationPolicy, C as CaddyClientOptions, k as CaddyRoute, j as CaddyRouteHandler, i as CaddyRouteMatcher, D as CopyResponseHandler, G as CopyResponseHeadersHandler, E as EncodeHandler, B as ErrorHandler, F as FileServerHandler, J as GenericHandler, o as HeadersHandler, l as HealthCheckRouteOptions, m as HostRouteOptions, H as HttpMethod, I as IdentityStore, w as InterceptHandler, x as InvokeHandler, g as LdapIdentityStore, L as LocalIdentityStore, z as LogAppendHandler, M as MapHandler, K as MitmwebOptions, N as MitmwebStatus, O as OAuth2IdentityProvider, h as OidcIdentityProvider, P as PathRouteOptions, u as PushHandler, R as RedirectStatusCode, v as RequestBodyHandler, n as ReverseProxyHandler, r as RewriteHandler, d as SecurityApp, S as SecurityAuthenticatorHandler, b as SecurityAuthorizationHandler, a as SecurityAuthorizerProvider, e as SecurityConfig, c as SecurityHandler, p as StaticResponseHandler, s as SubrouteHandler, t as TemplatesHandler, T as TlsConnectionPolicy, y as TracingHandler, U as UpstreamStatus, V as VarsHandler } from './types-DIjkvykh.js';
+export { aJ as ACME_DNS_PROVIDER_MODULE_MAP, aL as AcmeDnsPolicyOptions, aE as AutomaticHttpsConfigOptions, B as BasicAuthRouteOptions, C as CaddyAdapter, aN as CertificateInfo, x as CertificateManager, z as CertificateWithMetadata, af as ErrorRouteOptions, E as ExpirationCheckResult, ab as FileServerRouteOptions, av as HTTP1_ALPN_PROTOCOLS, au as HTTP2_ALPN_PROTOCOLS, at as HTTP_ALPN_PROTOCOLS, H as HealthRouteOptions, a3 as IframeProxyRouteOptions, aB as InternalFallbackPoliciesOptions, aA as InternalIssuerJson, t as LoadBalancerRouteOptions, L as LoadConfigOptions, ar as MODERN_CIPHER_SUITES, an as MapHandlerOptions, as as RECOMMENDED_CURVES, R as ROUTE_PRIORITIES, ah as RequestBodyHandlerOptions, w as RewriteRouteOptions, A as RotateCertificateOptions, D as RotationResult, S as ServiceRouteOptions, aq as TLS_1_2_CIPHER_SUITES, ap as TLS_1_3_CIPHER_SUITES, ad as TemplatesRouteOptions, aw as TlsConnectionPolicyOptions, al as TracingHandlerOptions, aj as VarsHandlerOptions, a6 as WebSocketProxyRouteOptions, b as addDomainWithAutoTls, c as addDomainWithTls, aH as applyLocalCaInstallTrust, aM as buildAcmeDnsPolicy, aF as buildAutomaticHttpsConfig, aC as buildAutomationPoliciesWithInternalFallback, V as buildBasicAuthHandler, az as buildCompatibleTlsPolicy, $ as buildCompressionHandler, aa as buildDnsRebindingBypassHandler, ag as buildErrorRoute, ac as buildFileServerRoute, N as buildHealthCheckRoute, O as buildHostRoute, Z as buildIframeHeadersHandler, a9 as buildIframePermissiveHandler, a4 as buildIframeProxyRoute, X as buildIngressTagHeadersHandler, Q as buildLoadBalancerRoute, ao as buildMapHandler, a1 as buildMitmproxyRoute, a2 as buildMitmproxyRoutePair, a8 as buildMitmproxyWebSocketRoute, a5 as buildMitmproxyWebUiRoute, ay as buildModernTlsPolicy, P as buildPathRoute, Y as buildProjectIdHeadersHandler, _ as buildRedirectRoute, ai as buildRequestBodyHandler, T as buildReverseProxyHandler, W as buildRewriteHandler, U as buildSecurityHeadersHandler, M as buildServiceRoutes, ae as buildTemplatesRoute, ax as buildTlsConnectionPolicy, am as buildTracingHandler, ak as buildVarsHandler, a7 as buildWebSocketProxyRoute, a0 as buildWwwRedirect, i as calculateRoutePriority, aD as collectExternalHostsFromRoutes, J as createBasicAuthAccount, K as createBasicAuthAccounts, n as createBasicAuthRoute, y as createCertificateManager, k as createHealthRoute, o as createLoadBalancerRoute, q as createRedirectRoute, p as createRewriteRoute, m as createServiceRoute, e as deleteDomain, d as detectAdapter, aR as extractSerialNumber, aG as filterAcmeManagedFromSkip, aP as generateCertTag, aU as getDaysUntilExpiration, g as getDomainConfig, F as hashPassword, I as hashPasswordWithCaddy, aI as hostMatchesPattern, j as insertRouteRelative, aS as isCertificateExpired, aT as isCertificateExpiringSoon, f as listDomains, a as loadCaddyfile, l as loadConfig, aO as parseCertificate, h as removeOldCertificates, aK as resolveAcmeDnsProviderModule, r as rotateCertificate, s as sortRoutes, aQ as splitCertificateBundle, u as updateDomain, v as validateRouteOrdering, G as verifyPassword } from './index-BmimANG7.js';
+export { EnableOptions, MitmproxyInstance, MitmproxyManager, ServiceRegistration, ServiceStatus, autoInstallMitmproxy, getMitmproxyVersion, getMitmwebStatus, isMitmproxyInstalled, startMitmweb, stopMitmweb } from './mitm/index.js';
+export { v as AccessListEntry, A as AuthenticationPortalSchema, f as AuthorizationPolicySchema, t as BuildAuthenticationPortalOptions, M as BuildAuthenticationRouteOptions, G as BuildAuthenticatorHandlerOptions, H as BuildAuthorizationHandlerOptions, u as BuildAuthorizationPolicyOptions, l as BuildLdapIdentityStoreOptions, B as BuildLocalIdentityStoreOptions, p as BuildOAuth2ProviderOptions, q as BuildOidcProviderOptions, N as BuildProtectedRouteOptions, D as BuildSecurityAppOptions, z as BuildSecurityConfigOptions, C as CookieOptions, w as CryptoKeyConfig, I as IdentityStoreSchema, g as LdapIdentityStoreSchema, m as LdapServerConfig, L as LocalIdentityStoreSchema, O as OAuth2IdentityProviderSchema, h as OidcIdentityProviderSchema, P as PortalUiOptions, Q as SECURITY_TEMPLATES, d as SecurityAppSchema, S as SecurityAuthenticatorHandlerSchema, b as SecurityAuthorizationHandlerSchema, a as SecurityAuthorizerProviderSchema, e as SecurityConfigSchema, c as SecurityHandlerSchema, U as SecurityTemplate, V as TemplateVariable, r as buildAuthenticationPortal, E as buildAuthenticatorHandler, J as buildAuthenticatorRoute, F as buildAuthorizationHandler, s as buildAuthorizationPolicy, k as buildLdapIdentityStore, j as buildLocalIdentityStore, n as buildOAuth2Provider, o as buildOidcProvider, K as buildProtectedRoute, y as buildSecurityApp, x as buildSecurityConfig, i as caddySecurity, T as getTemplateById, R as getTemplatesByCategory } from './index-Q5Jc47QL.js';
+export { A as AcmeDnsProviderConfigResult, a as CloudflareDnsProviderConfig, C as CloudflareDnsProviderConfigSchema, D as DigitaloceanDnsProviderConfig, e as DigitaloceanDnsProviderConfigSchema, b as GodaddyDnsProviderConfig, G as GodaddyDnsProviderConfigSchema, c as KNOWN_ACME_DNS_PROVIDERS, K as KnownAcmeDnsProvider, P as PorkbunDnsProviderConfig, d as PorkbunDnsProviderConfigSchema, l as buildAcmeDnsProviderConfig, g as buildCloudflareDnsConfig, j as buildDigitaloceanDnsConfig, k as buildGodaddyDnsConfig, f as buildPorkbunDnsConfig, h as buildRoute53DnsConfig, i as caddyDns } from './index-BijF7qR9.js';
+export { ae as adminConfigSchema, ag as configSchema, y as durationSchema, af as loggingSchema, b as routeListSchema, r as routeSchema, s as serverSchema } from './caddy-http.zod-Cx-dcFkE.js';
+import 'zod';
+import './caddy-http-DLxwstYo.js';
+
+/**
+ * Custom error classes for Caddy API client
+ */
+/**
+ * Base error class for all Caddy API client errors
+ */
+declare class CaddyApiClientError extends Error {
+    readonly context?: Record<string, unknown> | undefined;
+    constructor(message: string, context?: Record<string, unknown> | undefined);
+}
+/**
+ * Error thrown when input validation fails
+ */
+declare class ValidationError extends CaddyApiClientError {
+    readonly errors?: unknown[] | undefined;
+    constructor(message: string, errors?: unknown[] | undefined);
+}
+/**
+ * Error thrown when Caddy API returns an error response
+ *
+ * Includes request context (URL, method) to help with debugging.
+ *
+ * @example
+ * ```typescript
+ * try {
+ *   await client.adapt(content, "caddyfile");
+ * } catch (error) {
+ *   if (error instanceof CaddyApiError) {
+ *     console.error(`${error.method} ${error.url} failed: ${error.statusCode}`);
+ *     console.error(`Response: ${error.responseBody}`);
+ *   }
+ * }
+ * ```
+ */
+declare class CaddyApiError extends CaddyApiClientError {
+    readonly statusCode: number;
+    readonly responseBody?: string | undefined;
+    readonly url?: string | undefined;
+    readonly method?: string | undefined;
+    constructor(message: string, statusCode: number, responseBody?: string | undefined, url?: string | undefined, method?: string | undefined);
+}
+/**
+ * Error thrown when network request fails
+ */
+declare class NetworkError extends CaddyApiClientError {
+    readonly cause?: Error | undefined;
+    constructor(message: string, cause?: Error | undefined);
+}
+/**
+ * Error thrown when request times out
+ */
+declare class TimeoutError extends CaddyApiClientError {
+    readonly timeoutMs: number;
+    constructor(message: string, timeoutMs: number);
+}
+/**
+ * Error thrown when domain is not found
+ */
+declare class DomainNotFoundError extends CaddyApiClientError {
+    readonly domain: string;
+    constructor(domain: string);
+}
+/**
+ * Error thrown when domain already exists
+ */
+declare class DomainAlreadyExistsError extends CaddyApiClientError {
+    readonly domain: string;
+    constructor(domain: string);
+}
+/**
+ * Error thrown when MITMproxy is not installed
+ */
+declare class MitmproxyNotInstalledError extends CaddyApiClientError {
+    constructor(message?: string);
+}
+/**
+ * Error thrown when MITMproxy fails to start
+ */
+declare class MitmproxyStartError extends CaddyApiClientError {
+    readonly exitCode?: number | undefined;
+    constructor(message: string, exitCode?: number | undefined);
+}
+
+/**
+ * @viaalink/caddy-api-client
+ * TypeScript client for Caddy Admin API with MITMproxy integration
+ */
+
+declare const VERSION: string;
+
+export { CaddyApiClientError, CaddyApiError, DomainAlreadyExistsError, DomainNotFoundError, MitmproxyNotInstalledError, MitmproxyStartError, NetworkError, TimeoutError, VERSION, ValidationError };

package/dist/index.js

@@ -0,0 +1,6 @@
+import {z as z$1,ZodError}from'zod';import {join,normalize,isAbsolute,resolve}from'path';import {X509Certificate}from'@peculiar/x509';import {readFile}from'fs/promises';import {spawn}from'child_process';import {writeFileSync,existsSync,unlinkSync,readFileSync}from'fs';var Ko=Object.defineProperty;var x=(t,e)=>()=>(t&&(e=t(t=0)),e);var Qe=(t,e)=>{for(var r in e)Ko(t,r,{get:e[r],enumerable:true});};var P,L,ie,Ce,we,Q,ae,Pe,Re,F=x(()=>{P=class t extends Error{constructor(r,n){super(r);this.context=n;this.name="CaddyApiClientError",Object.setPrototypeOf(this,t.prototype);}},L=class t extends P{constructor(r,n){super(r,{errors:n});this.errors=n;this.name="ValidationError",Object.setPrototypeOf(this,t.prototype);}},ie=class t extends P{constructor(r,n,a,s,u){super(r,{statusCode:n,responseBody:a,url:s,method:u});this.statusCode=n;this.responseBody=a;this.url=s;this.method=u;this.name="CaddyApiError",Object.setPrototypeOf(this,t.prototype);}},Ce=class t extends P{constructor(r,n){super(r,{cause:n?.message});this.cause=n;this.name="NetworkError",Object.setPrototypeOf(this,t.prototype);}},we=class t extends P{constructor(r,n){super(r,{timeoutMs:n});this.timeoutMs=n;this.name="TimeoutError",Object.setPrototypeOf(this,t.prototype);}},Q=class t extends P{constructor(r){super(`Domain not found: ${r}`,{domain:r});this.domain=r;this.name="DomainNotFoundError",Object.setPrototypeOf(this,t.prototype);}},ae=class t extends P{constructor(r){super(`Domain already exists: ${r}`,{domain:r});this.domain=r;this.name="DomainAlreadyExistsError",Object.setPrototypeOf(this,t.prototype);}},Pe=class t extends P{constructor(e="MITMproxy is not installed"){super(e),this.name="MitmproxyNotInstalledError",Object.setPrototypeOf(this,t.prototype);}},Re=class t extends P{constructor(r,n){super(r,{exitCode:n});this.exitCode=n;this.name="MitmproxyStartError",Object.setPrototypeOf(this,t.prototype);}};});var Xo,tr,Vo,Yo,Zo,Jo,rr,Qo,en,tn,rn,on,nn,or,nr,et,ir=x(()=>{Xo=z$1.object({identifiers:z$1.array(z$1.string()).optional(),issuers:z$1.array(z$1.unknown()).optional()}),tr=z$1.union([z$1.number(),z$1.string()]),Vo=z$1.object({paths:z$1.array(z$1.string()).optional(),methods:z$1.array(z$1.string()).optional()}),z$1.any(),Yo=z$1.any(),z$1.any(),z$1.object({error:z$1.string()}),Zo=z$1.record(z$1.string(),z$1.unknown()),z$1.any(),z$1.any(),z$1.object({id:z$1.string(),source:z$1.string(),specversion:z$1.string(),type:z$1.string(),time:z$1.string(),datacontenttype:z$1.string().optional(),data:z$1.unknown().optional()}),z$1.string(),z$1.object({Context:z$1.unknown()}),z$1.any(),z$1.object({Network:z$1.string(),Host:z$1.string(),StartPort:z$1.number(),EndPort:z$1.number()}),z$1.any(),z$1.any(),z$1.any(),z$1.unknown(),Jo=z$1.object({interval:z$1.union([z$1.number(),z$1.string()]).optional(),first:z$1.number().optional(),thereafter:z$1.number().optional()}),rr=z$1.object({writer:z$1.unknown().optional(),encoder:z$1.unknown().optional(),core:z$1.unknown().optional(),level:z$1.string().optional(),sampling:Jo.optional(),with_caller:z$1.boolean().optional(),with_caller_skip:z$1.number().optional(),with_stacktrace:z$1.string().optional()}),Qo=z$1.object({BaseLog:rr,include:z$1.array(z$1.string()).optional(),exclude:z$1.array(z$1.string()).optional()}),z$1.object({}),z$1.object({}),z$1.object({}),z$1.any(),z$1.any(),en=z$1.string(),z$1.any(),z$1.any(),z$1.any(),z$1.any(),z$1.object({}),z$1.any(),z$1.any(),z$1.any(),z$1.object({RWMutex:z$1.unknown()}),z$1.any(),z$1.any(),tn=z$1.object({persist:z$1.boolean().optional(),load:z$1.unknown().optional(),load_delay:tr.optional()}),rn=z$1.object({public_keys:z$1.array(z$1.string()).optional(),permissions:z$1.array(Vo).optional()}),z$1.object({Pattern:z$1.string(),Handler:Yo}),on=z$1.object({BaseLog:rr}),z$1.object({ID:en,New:z$1.any()}),nn=z$1.object({listen:z$1.string().optional(),access_control:z$1.array(z$1.union([rn,z$1.undefined()])).optional()}),or=z$1.object({disabled:z$1.boolean().optional(),listen:z$1.string().optional(),enforce_origin:z$1.boolean().optional(),origins:z$1.array(z$1.string()).optional(),config:tn.optional(),identity:Xo.optional(),remote:nn.optional()}),nr=z$1.object({sink:on.optional(),logs:z$1.record(z$1.string(),z$1.union([Qo,z$1.undefined()])).optional()}),et=z$1.object({admin:or.optional(),logging:nr.optional(),storage:z$1.unknown().optional(),apps:Zo.optional()});});var ar,sr,an,tt,rt,ot,nt,cn,it,at,ke,st,yn,cr,ct,$,fn,bn,xn,ee,te,lr,se,Ae=x(()=>{ar=z$1.object({per_host:z$1.boolean().optional(),observe_catchall_hosts:z$1.boolean().optional(),otlp:z$1.boolean().optional()}),sr=z$1.object({disable:z$1.boolean().optional(),disable_redirects:z$1.boolean().optional(),disable_certificates:z$1.boolean().optional(),skip:z$1.array(z$1.string()).optional(),skip_certificates:z$1.array(z$1.string()).optional(),ignore_loaded_certificates:z$1.boolean().optional()}),z$1.any(),z$1.any(),z$1.any(),z$1.any(),z$1.any(),z$1.any(),an=z$1.object({status_code:z$1.array(z$1.number()).optional(),headers:z$1.record(z$1.string(),z$1.array(z$1.string())).optional()}),tt=z$1.string(),z$1.object({expr:z$1.string().optional(),name:z$1.string().optional()}),z$1.any(),z$1.any(),z$1.any(),z$1.object({max_header_bytes:z$1.number().optional()}),rt=z$1.object({name:z$1.string().optional()}),ot=z$1.object({ranges:z$1.array(z$1.string()).optional()}),nt=z$1.object({ranges:z$1.array(z$1.string()).optional()}),z$1.any(),z$1.object({ranges:z$1.array(z$1.string()).optional()}),cn=z$1.array(z$1.string()),z$1.object({}),z$1.object({Request:z$1.unknown().optional(),ShouldLogCredentials:z$1.boolean()}),z$1.any(),z$1.any(),z$1.unknown(),z$1.array(z$1.string()),z$1.array(z$1.string()),it=z$1.object({name:z$1.string().optional(),pattern:z$1.string()}),z$1.array(z$1.string()),z$1.record(z$1.string(),z$1.array(z$1.string())),z$1.record(z$1.string(),z$1.array(z$1.string())),at=z$1.record(z$1.string(),z$1.union([it,z$1.undefined()])),ke=z$1.string(),st=z$1.object({handshake_complete:z$1.boolean().optional()}),z$1.object({}),z$1.object({ResponseWriter:z$1.unknown()}),z$1.unknown(),z$1.any(),yn=z$1.array(z$1.any()),z$1.array(yn),cr=z$1.object({default_logger_name:z$1.string().optional(),logger_names:z$1.record(z$1.string(),cn).optional(),skip_hosts:z$1.array(z$1.string()).optional(),skip_unmapped_hosts:z$1.boolean().optional(),should_log_credentials:z$1.boolean().optional(),trace:z$1.boolean().optional()}),ct=z$1.object({error:z$1.string().optional(),status_code:tt.optional()}),z$1.object({status_code:tt.optional(),headers:z$1.record(z$1.string(),z$1.array(z$1.string())).optional(),body:z$1.string().optional(),close:z$1.boolean().optional(),abort:z$1.boolean().optional()}),z$1.record(z$1.string(),z$1.any()),z$1.record(z$1.string(),z$1.array(z$1.string())),z$1.record(z$1.string(),z$1.union([it,z$1.undefined()])),$=z$1.any(),fn=z$1.any(),bn=z$1.any(),z$1.object({MatchRegexp:it}),xn=z$1.array(fn),ee=z$1.object({group:z$1.string().optional(),match:xn.optional(),handle:z$1.array(z$1.unknown()).optional(),terminal:z$1.boolean().optional()}),te=z$1.array(ee),lr=z$1.object({routes:te.optional()}),z$1.object({routes:te.optional(),errors:lr.optional()}),se=z$1.object({listen:z$1.array(z$1.string()).optional(),listener_wrappers:z$1.array(z$1.unknown()).optional(),packet_conn_wrappers:z$1.array(z$1.unknown()).optional(),read_timeout:$.optional(),read_header_timeout:$.optional(),write_timeout:$.optional(),idle_timeout:$.optional(),keepalive_interval:$.optional(),keepalive_idle:$.optional(),keepalive_count:z$1.number().optional(),max_header_bytes:z$1.number().optional(),enable_full_duplex:z$1.boolean().optional(),routes:te.optional(),errors:lr.optional(),named_routes:z$1.record(z$1.string(),z$1.union([ee,z$1.undefined()])).optional(),tls_connection_policies:bn.optional(),automatic_https:sr.optional(),strict_sni_host:z$1.boolean().optional(),trusted_proxies:z$1.unknown().optional(),client_ip_headers:z$1.array(z$1.string()).optional(),trusted_proxies_strict:z$1.number().optional(),trusted_proxies_unix:z$1.boolean().optional(),logs:cr.optional(),protocols:z$1.array(z$1.string()).optional(),listen_protocols:z$1.array(z$1.array(z$1.string())).optional(),allow_0rtt:z$1.boolean().optional(),metrics:ar.optional()}),z$1.object({match:an.optional(),status_code:tt.optional(),routes:te.optional()}),z$1.object({http_port:z$1.number().optional(),https_port:z$1.number().optional(),grace_period:$.optional(),shutdown_delay:$.optional(),servers:z$1.record(z$1.string(),z$1.union([se,z$1.undefined()])).optional(),metrics:ar.optional()});});var pr,dr,Cn,ur,mr,wn,hr,yr,Pn,gr,An,In,fr,Tn,I,lt,br,pt,Dn,Sr,En,xr,Ln,zn,_r=x(()=>{pr=z$1.object({smallest:z$1.boolean().optional(),root_common_name:z$1.array(z$1.string()).optional(),any_common_name:z$1.array(z$1.string()).optional()}),dr=z$1.object({subjects:z$1.array(z$1.string()).optional(),issuers:z$1.array(z$1.unknown()).optional(),get_certificate:z$1.array(z$1.unknown()).optional(),must_staple:z$1.boolean().optional(),renewal_window_ratio:z$1.number().optional(),key_type:z$1.string().optional(),storage:z$1.unknown().optional(),on_demand:z$1.boolean().optional(),reuse_private_keys:z$1.boolean().optional(),disable_ocsp_stapling:z$1.boolean().optional(),ocsp_overrides:z$1.record(z$1.string(),z$1.string()).optional()}),Cn=z$1.object({ask:z$1.string().optional(),permission:z$1.unknown().optional()}),ur=z$1.object({disabled:z$1.boolean().optional(),alternate_port:z$1.number().optional()}),mr=z$1.object({disabled:z$1.boolean().optional(),alternate_port:z$1.number().optional()}),z$1.any(),z$1.any(),z$1.any(),z$1.object({trusted_ca_certs:z$1.array(z$1.string()).optional()}),z$1.object({pem_files:z$1.array(z$1.string()).optional()}),z$1.object({authority:z$1.array(z$1.string()).optional()}),z$1.object({authority:z$1.array(z$1.string()).optional()}),z$1.object({storage:z$1.unknown().optional(),pem_keys:z$1.array(z$1.string()).optional()}),z$1.object({}),z$1.object({sources:z$1.array(z$1.unknown()).optional()}),z$1.object({}),z$1.object({url:z$1.string().optional()}),wn=z$1.number(),hr=z$1.object({serial_number:z$1.array(z$1.string()).optional(),subject_organization:z$1.array(z$1.string()).optional(),public_key_algorithm:wn.optional(),any_tag:z$1.array(z$1.string()).optional(),all_tags:z$1.array(z$1.string()).optional()}),yr=z$1.object({ca:z$1.unknown().optional(),trusted_ca_certs:z$1.array(z$1.string()).optional(),trusted_ca_certs_pem_files:z$1.array(z$1.string()).optional(),trusted_leaf_certs:z$1.array(z$1.string()).optional(),verifiers:z$1.array(z$1.unknown()).optional(),mode:z$1.string().optional()}),z$1.any(),z$1.object({leaf_certs_loaders:z$1.array(z$1.unknown()).optional()}),z$1.any(),z$1.any(),z$1.any(),Pn=z$1.object({public_name:z$1.string()}),z$1.unknown().and(z$1.unknown()),z$1.object({provider:z$1.unknown().optional()}),z$1.any(),gr=z$1.object({certificate:z$1.string(),key:z$1.string(),format:z$1.string().optional(),tags:z$1.array(z$1.string()).optional()}),z$1.array(z$1.string()),z$1.object({files:z$1.array(z$1.string()).optional()}),z$1.object({folders:z$1.array(z$1.string()).optional()}),z$1.object({certificates:z$1.array(z$1.string()).optional()}),z$1.object({certificates:z$1.array(z$1.string()).optional(),storage:z$1.unknown().optional()}),z$1.array(z$1.string()),An=z$1.object({name:z$1.string().optional(),pattern:z$1.string()}),z$1.object({MatchRegexp:An}),z$1.object({ranges:z$1.array(z$1.string()).optional(),not_ranges:z$1.array(z$1.string()).optional()}),z$1.object({ranges:z$1.array(z$1.string()).optional()}),z$1.any(),z$1.object({endpoint:z$1.string()}),In=z$1.object({certificate:z$1.string(),key:z$1.string(),tags:z$1.array(z$1.string()).optional()}),z$1.any(),z$1.object({pairs:z$1.array(gr).optional()}),fr=z$1.object({capacity:z$1.number().optional()}),z$1.any(),Tn=z$1.lazy(()=>z$1.object({Certificate:Tn,Tags:z$1.array(z$1.string())})),z$1.array(z$1.string()),I=z$1.any(),lt=z$1.any(),br=z$1.object({policies:z$1.array(z$1.union([dr,z$1.undefined()])).optional(),on_demand:Cn.optional(),ocsp_interval:I.optional(),renew_interval:I.optional(),storage_clean_interval:I.optional()}),pt=z$1.object({provider:z$1.unknown().optional(),ttl:I.optional(),propagation_delay:I.optional(),propagation_timeout:I.optional(),resolvers:z$1.array(z$1.string()).optional(),override_domain:z$1.string().optional()}),Dn=z$1.object({ca:z$1.unknown().optional(),insecure_skip_verify:z$1.boolean().optional(),handshake_timeout:I.optional(),server_name:z$1.string().optional(),renegotiation:z$1.string().optional()}),z$1.object({endpoints:z$1.array(z$1.string()).optional(),tls:Dn.optional()}),Sr=z$1.object({match:lt.optional(),certificate_selection:hr.optional(),cipher_suites:z$1.array(z$1.string()).optional(),curves:z$1.array(z$1.string()).optional(),alpn:z$1.array(z$1.string()).optional(),protocol_min:z$1.string().optional(),protocol_max:z$1.string().optional(),drop:z$1.boolean().optional(),client_authentication:yr.optional(),default_sni:z$1.string().optional(),fallback_sni:z$1.string().optional(),insecure_secrets_log:z$1.string().optional(),handshake_context:z$1.unknown().optional()}),En=z$1.object({configs:z$1.array(z$1.string()).optional(),domains:z$1.array(z$1.string()).optional(),publishers:lt.optional()}),z$1.array(gr),z$1.object({ca:z$1.string().optional(),lifetime:I.optional(),sign_with_root:z$1.boolean().optional()}),z$1.array(In),xr=z$1.object({key_source:z$1.unknown().optional(),rotation_interval:I.optional(),max_keys:z$1.number().optional(),disable_rotation:z$1.boolean().optional(),disabled:z$1.boolean().optional()}),Ln=z$1.object({configs:z$1.array(Pn).optional(),publication:z$1.array(z$1.union([En,z$1.undefined()])).optional()}),z$1.object({api_key:z$1.string().optional(),validity_days:z$1.number().optional(),listen_host:z$1.string().optional(),alternate_http_port:z$1.number().optional(),cname_validation:pt.optional()}),zn=z$1.object({http:ur.optional(),"tls-alpn":mr.optional(),dns:pt.optional(),bind_host:z$1.string().optional(),distributed:z$1.boolean().optional()}),z$1.array(z$1.union([Sr,z$1.undefined()])),z$1.object({certificates:lt.optional(),automation:br.optional(),session_tickets:xr.optional(),cache:fr.optional(),disable_ocsp_stapling:z$1.boolean().optional(),disable_storage_check:z$1.boolean().optional(),disable_storage_clean:z$1.boolean().optional(),encrypted_client_hello:Ln.optional(),dns:z$1.unknown().optional(),resolvers:z$1.array(z$1.string()).optional()}),z$1.object({ca:z$1.string().optional(),test_ca:z$1.string().optional(),email:z$1.string().optional(),profile:z$1.string().optional(),account_key:z$1.string().optional(),external_account:z$1.object({kid:z$1.string().optional(),hmacEncoded:z$1.string().optional()}).optional(),acme_timeout:I.optional(),challenges:zn.optional(),trusted_roots_pem_files:z$1.array(z$1.string()).optional(),preferred_chains:pr.optional(),certificate_lifetime:I.optional(),network_proxy:z$1.unknown().optional()});});var He=x(()=>{ir();Ae();Ae();_r();});var Bn,vr,Fn,Wn,Cr,wr=x(()=>{Bn=z$1.object({template_file:z$1.string().optional(),reveal_symlinks:z$1.boolean().optional(),sort:z$1.array(z$1.string()).optional(),file_limit:z$1.number().optional()}),vr=z$1.object({fs:z$1.string().optional(),root:z$1.string().optional(),try_files:z$1.array(z$1.string()).optional(),try_policy:z$1.string().optional(),split_path:z$1.array(z$1.string()).optional()}),Fn=z$1.any(),Wn=z$1.any(),Cr=z$1.object({fs:z$1.string().optional(),root:z$1.string().optional(),hide:z$1.array(z$1.string()).optional(),index_names:z$1.array(z$1.string()).optional(),browse:Bn.optional(),canonical_uris:z$1.boolean().optional(),status_code:Fn.optional(),pass_thru:z$1.boolean().optional(),precompressed:Wn.optional(),precompressed_order:z$1.array(z$1.string()).optional(),etag_file_extensions:z$1.array(z$1.string()).optional()});});var qn,Gn,dt,Kn,ut,Pr=x(()=>{qn=z$1.object({find:z$1.string().optional(),replace:z$1.string().optional(),limit:z$1.number().optional()}),Gn=z$1.object({find:z$1.string().optional(),replace:z$1.string().optional()}),dt=z$1.object({key:z$1.string(),val:z$1.string()}),Kn=z$1.object({key:z$1.string().optional(),search:z$1.string().optional(),search_regexp:z$1.string().optional(),replace:z$1.string().optional()}),ut=z$1.object({delete:z$1.array(z$1.string()).optional(),set:z$1.array(dt).optional(),add:z$1.array(dt).optional(),replace:z$1.array(Kn).optional(),rename:z$1.array(dt).optional()}),z$1.object({method:z$1.string().optional(),uri:z$1.string().optional(),strip_path_prefix:z$1.string().optional(),strip_path_suffix:z$1.string().optional(),uri_substring:z$1.array(qn).optional(),path_regexp:z$1.array(Gn).optional(),query:ut.optional()});});var Xn,Vn,Rr,kr=x(()=>{z$1.any(),Xn=z$1.object({Header:z$1.record(z$1.string(),z$1.array(z$1.string()))}),Vn=z$1.any(),Rr=z$1.object({file_root:z$1.string().optional(),mime_types:z$1.array(z$1.string()).optional(),delimiters:z$1.array(z$1.string()).optional(),match:Vn.optional()}),z$1.object({Root:z$1.unknown(),Req:z$1.unknown().optional(),Args:z$1.array(z$1.any()),RespHeader:Xn,CustomFuncs:z$1.array(z$1.record(z$1.string(),z$1.unknown()))});});var Yn,Ar,Hr=x(()=>{Yn=z$1.object({input:z$1.string().optional(),input_regexp:z$1.string().optional(),outputs:z$1.array(z$1.any()).optional()}),Ar=z$1.object({source:z$1.string().optional(),destinations:z$1.array(z$1.string()).optional(),mappings:z$1.array(Yn).optional(),defaults:z$1.array(z$1.string()).optional()});});var Zn,Jn,Qn,Ir,Or=x(()=>{Zn=z$1.object({method:z$1.string().optional(),target:z$1.string().optional()}),Jn=z$1.any(),Qn=z$1.object({HeaderOps:Jn}),Ir=z$1.object({resources:z$1.array(Zn).optional(),headers:Qn.optional()});});var jr,Tr=x(()=>{jr=z$1.object({max_size:z$1.number().optional(),read_timeout:z$1.union([z$1.number(),z$1.string()]).optional(),write_timeout:z$1.union([z$1.number(),z$1.string()]).optional(),set:z$1.string().optional()});});var ei,Dr,Er=x(()=>{ei=z$1.any(),Dr=z$1.object({handle_response:z$1.array(ei).optional()});});var Mr,Lr=x(()=>{Mr=z$1.object({span:z$1.string(),span_attributes:z$1.record(z$1.string(),z$1.string()).optional()});});var $r,zr=x(()=>{$r=z$1.object({key:z$1.string().optional(),value:z$1.string().optional(),early:z$1.boolean().optional()});});var Nr,Ur,ht,ti,ri,oi,S,ni,ii,ai,si,Br,ci,li,pi,di,ui,mi,Fr=x(()=>{Nr=z$1.object({include:z$1.array(z$1.string()).optional(),exclude:z$1.array(z$1.string()).optional()}),z$1.any(),Ur=z$1.object({dial:z$1.string().optional(),max_requests:z$1.number().optional()}),z$1.object({}),z$1.object({Upstream:Ur.optional(),Network:z$1.string(),Address:z$1.string(),Host:z$1.string(),Port:z$1.string()}),z$1.object({AddrPort:z$1.string()}),ht=z$1.object({addresses:z$1.array(z$1.string()).optional()}),ti=z$1.array(z$1.union([Ur,z$1.undefined()])),z$1.any(),z$1.any(),z$1.object({}),z$1.any(),z$1.any(),z$1.any(),z$1.any(),z$1.any(),z$1.any(),z$1.object({}),z$1.object({weights:z$1.array(z$1.number()).optional()}),z$1.object({choose:z$1.number().optional()}),z$1.object({}),z$1.object({}),z$1.object({}),z$1.object({}),z$1.object({}),z$1.object({}),z$1.object({key:z$1.string().optional(),fallback:z$1.unknown().optional()}),z$1.object({field:z$1.string().optional(),fallback:z$1.unknown().optional()}),ri=z$1.object({ipv4:z$1.boolean().optional(),ipv6:z$1.boolean().optional()}),z$1.object({sources:z$1.array(z$1.unknown()).optional()}),oi=z$1.any(),S=z$1.any(),ni=z$1.any(),ii=z$1.any(),ai=z$1.any(),si=z$1.any(),Br=z$1.object({status_code:oi.optional()}),ci=z$1.object({path:z$1.string().optional(),uri:z$1.string().optional(),upstream:z$1.string().optional(),port:z$1.number().optional(),headers:z$1.record(z$1.string(),z$1.array(z$1.string())).optional(),method:z$1.string().optional(),body:z$1.string().optional(),follow_redirects:z$1.boolean().optional(),interval:S.optional(),timeout:S.optional(),passes:z$1.number().optional(),fails:z$1.number().optional(),max_size:z$1.number().optional(),expect_status:z$1.number().optional(),expect_body:z$1.string().optional()}),li=z$1.object({fail_duration:S.optional(),max_fails:z$1.number().optional(),unhealthy_request_count:z$1.number().optional(),unhealthy_status:z$1.array(z$1.number()).optional(),unhealthy_latency:S.optional()}),pi=z$1.object({ca:z$1.unknown().optional(),root_ca_pool:z$1.array(z$1.string()).optional(),root_ca_pem_files:z$1.array(z$1.string()).optional(),client_certificate_file:z$1.string().optional(),client_certificate_key_file:z$1.string().optional(),client_certificate_automate:z$1.string().optional(),insecure_skip_verify:z$1.boolean().optional(),handshake_timeout:S.optional(),server_name:z$1.string().optional(),renegotiation:z$1.string().optional(),except_ports:z$1.array(z$1.string()).optional(),curves:z$1.array(z$1.string()).optional()}),di=z$1.object({enabled:z$1.boolean().optional(),probe_interval:S.optional(),max_idle_conns:z$1.number().optional(),max_idle_conns_per_host:z$1.number().optional(),idle_timeout:S.optional()}),ui=z$1.object({selection_policy:z$1.unknown().optional(),retries:z$1.number().optional(),try_duration:S.optional(),try_interval:S.optional(),retry_match:si.optional()}),mi=z$1.object({active:ci.optional(),passive:li.optional()}),z$1.object({name:z$1.string().optional(),secret:z$1.string().optional(),max_age:S.optional(),fallback:z$1.unknown().optional()}),z$1.object({service:z$1.string().optional(),proto:z$1.string().optional(),name:z$1.string().optional(),refresh:S.optional(),grace_period:S.optional(),resolver:ht.optional(),dial_timeout:S.optional(),dial_fallback_delay:S.optional(),dial_network:z$1.string().optional()}),z$1.object({name:z$1.string().optional(),port:z$1.string().optional(),refresh:S.optional(),resolver:ht.optional(),dial_timeout:S.optional(),dial_fallback_delay:S.optional(),versions:ri.optional()}),z$1.object({resolver:ht.optional(),tls:pi.optional(),keep_alive:di.optional(),compression:z$1.boolean().optional(),max_conns_per_host:z$1.number().optional(),proxy_protocol:z$1.string().optional(),forward_proxy_url:z$1.string().optional(),dial_timeout:S.optional(),dial_fallback_delay:S.optional(),response_header_timeout:S.optional(),expect_continue_timeout:S.optional(),max_response_header_size:z$1.number().optional(),write_buffer_size:z$1.number().optional(),read_buffer_size:z$1.number().optional(),read_timeout:S.optional(),write_timeout:S.optional(),versions:z$1.array(z$1.string()).optional(),local_address:z$1.string().optional(),network_proxy:z$1.unknown().optional()}),z$1.object({transport:z$1.unknown().optional(),circuit_breaker:z$1.unknown().optional(),load_balancing:ui.optional(),health_checks:mi.optional(),upstreams:ti.optional(),dynamic_upstreams:z$1.unknown().optional(),flush_interval:S.optional(),trusted_proxies:z$1.array(z$1.string()).optional(),headers:ni.optional(),request_buffers:z$1.number().optional(),response_buffers:z$1.number().optional(),stream_timeout:S.optional(),stream_buffer_size:z$1.number().optional(),stream_close_delay:S.optional(),rewrite:ii.optional(),handle_response:z$1.array(ai).optional(),verbose_logs:z$1.boolean().optional()});});var gi,Wr=x(()=>{z$1.any(),z$1.object({route_matcher:z$1.string().optional(),portal_name:z$1.string().optional()}),z$1.object({route_matcher:z$1.string().optional(),gatekeeper_name:z$1.string().optional()}),gi=z$1.any(),z$1.object({config:gi.optional(),secrets_managers:z$1.array(z$1.unknown()).optional()});});var q,yt,le,qr,bi,pe,Si,xi,_i,de,Gr,Oe,Kr,je,gt,vi,Ci,wi,Pi,ue,Ri,ki,Ai,me,Hi,he,Ii,Te,De=x(()=>{Wr();q=z$1.object({handler:z$1.literal("authenticator"),portal_name:z$1.string().optional(),route_matcher:z$1.string().optional()}),yt=z$1.object({gatekeeper_name:z$1.string().optional(),route_matcher:z$1.string().optional()}),le=z$1.object({handler:z$1.literal("authentication"),providers:z$1.object({authorizer:yt})}),qr=z$1.discriminatedUnion("handler",[q,le]),bi=z$1.object({realm:z$1.string().optional(),path:z$1.string()}),pe=z$1.object({name:z$1.string(),kind:z$1.literal("local"),params:bi}),Si=z$1.object({address:z$1.string(),port:z$1.number().int().positive().max(65535).optional()}),xi=z$1.object({dn:z$1.string(),roles:z$1.array(z$1.string()).optional()}),_i=z$1.object({realm:z$1.string().optional(),servers:z$1.array(Si).optional(),bind_username:z$1.string().optional(),bind_password:z$1.string().optional(),search_base_dn:z$1.string().optional(),search_user_filter:z$1.string().optional(),groups:z$1.array(xi).optional()}),de=z$1.object({name:z$1.string(),kind:z$1.literal("ldap"),params:_i.passthrough()}),Gr=z$1.object({driver:z$1.string().optional(),realm:z$1.string().optional(),client_id:z$1.string().optional(),client_secret:z$1.string().optional(),scopes:z$1.array(z$1.string()).optional(),authorization_url:z$1.string().optional(),token_url:z$1.string().optional()}),Oe=z$1.object({name:z$1.string(),kind:z$1.literal("oauth"),params:Gr}),Kr=z$1.object({driver:z$1.string().optional(),realm:z$1.string().optional(),client_id:z$1.string().optional(),client_secret:z$1.string().optional(),metadata_url:z$1.string().optional(),scopes:z$1.array(z$1.string()).optional()}),je=z$1.object({name:z$1.string(),kind:z$1.literal("oauth"),params:Kr}),gt=z$1.discriminatedUnion("kind",[pe,de]),vi=z$1.object({name:z$1.string(),kind:z$1.literal("oauth"),params:z$1.union([Gr.passthrough(),Kr.passthrough()])}),Ci=z$1.object({theme:z$1.string().optional(),logo_url:z$1.string().optional(),custom_css:z$1.string().optional()}),wi=z$1.object({lifetime:z$1.number().optional(),insecure:z$1.boolean().optional(),same_site:z$1.string().optional()}),Pi=z$1.object({domains:z$1.record(z$1.string(),wi).optional(),path:z$1.string().optional(),lifetime:z$1.number().optional(),insecure:z$1.boolean().optional(),same_site:z$1.string().optional()}),ue=z$1.object({name:z$1.string(),ui:Ci.optional(),cookie_config:Pi.optional(),identity_stores:z$1.array(z$1.string()).optional(),identity_providers:z$1.array(z$1.string()).optional(),user_transformer_configs:z$1.array(z$1.record(z$1.string(),z$1.unknown())).optional()}),Ri=z$1.object({comment:z$1.string().optional(),conditions:z$1.array(z$1.string()).optional(),action:z$1.enum(["allow","deny"]).optional()}),ki=z$1.object({token_name:z$1.string().optional(),source:z$1.string().optional()}),Ai=z$1.object({match_type:z$1.string(),uri:z$1.string().optional()}),me=z$1.object({name:z$1.string(),access_list_rules:z$1.array(Ri).optional(),crypto_key_configs:z$1.array(ki).optional(),bypass_configs:z$1.array(Ai).optional()}),Hi=z$1.object({generic:z$1.record(z$1.string(),z$1.unknown()).optional()}),he=z$1.object({authentication_portals:z$1.array(ue).optional(),authorization_policies:z$1.array(me).optional(),credentials:Hi.optional(),identity_stores:z$1.array(gt).optional(),identity_providers:z$1.array(vi).optional()}),Ii=z$1.object({driver:z$1.string()}).passthrough(),Te=z$1.object({config:he.optional(),secrets_managers:z$1.array(Ii).optional()});});function Mp(t,e){let r=t.safeParse(e);if(!r.success)throw new L(`Validation failed: ${r.error.message}`,r.error.errors);return r.data}var G,Ee,Vr,ft,Yr,Zr,_p,Oi,ji,Ti,Jr,z,bt,Di,Qr,St,xt,eo,to,ro,_t,vt,Ct,wt,Pt,Rt,M,Ei,Mi,Li,$i,zi,Ni,Xr,vp,Ui,Bi,oo,Fi,Wi,qi,Gi,Ki,Xi,Vi,Yi,Zi,Ji,Qi,ea,ta,ra,oa,na,ia,aa,sa,Ep,ca,no,kt,N=x(()=>{F();He();He();wr();Pr();kr();Hr();Or();Tr();Er();Lr();zr();Ae();Fr();De();G=z$1.string().min(1,"Domain cannot be empty").regex(/^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/,"Invalid domain format"),Ee=z$1.string().regex(/^.+:\d+$/,"Dial address must be in host:port format"),Vr=z$1.string(),ft=z$1.enum(["DENY","SAMEORIGIN"]),Yr=z$1.enum(["none","www_to_domain","domain_to_www"]),Zr=z$1.union([z$1.literal(301),z$1.literal(302),z$1.literal(307),z$1.literal(308)]),_p=z$1.enum(["letsencrypt","zerossl","acme"]),Oi=z$1.record(z$1.string(),z$1.array(z$1.string())),ji=z$1.record(z$1.string(),z$1.array(z$1.string())),Ti=z$1.object({host:z$1.array(z$1.string()).optional(),path:z$1.array(z$1.string()).optional(),path_regexp:z$1.object({name:z$1.string().optional(),pattern:z$1.string()}).optional(),method:z$1.array(Vr).optional(),header:ji.optional(),header_regexp:at.optional(),query:Oi.optional(),client_ip:nt.optional(),remote_ip:ot.optional(),protocol:ke.optional(),tls:st.optional(),file:vr.optional(),not:z$1.array(z$1.record(z$1.string(),z$1.unknown())).optional(),expression:z$1.string().optional()}),Jr=z$1.object({handler:z$1.string()}).passthrough(),z=z$1.object({"@id":z$1.string().optional(),match:z$1.array(Ti).optional(),handle:z$1.array(Jr).min(1,"Route must have at least one handler"),terminal:z$1.boolean().optional(),priority:z$1.number().int().optional()}),bt=z$1.object({adminUrl:z$1.string().url().optional().default("http://127.0.0.1:2019"),timeout:z$1.number().int().positive().optional().default(5e3)}),Di=z$1.enum(["caddyfile","json","yaml","nginx","apache"]),Qr=z$1.object({config:z$1.string().min(1,"Config cannot be empty"),adapter:Di.optional().default("caddyfile")}),St=z$1.object({enableHsts:z$1.boolean().optional().default(false),hstsMaxAge:z$1.number().int().positive().optional().default(31536e3),frameOptions:ft.optional().default("DENY"),enableCompression:z$1.boolean().optional().default(true)}),xt=z$1.object({domain:G,target:z$1.string().min(1,"Target cannot be empty"),targetPort:z$1.number().int().positive().max(65535,"Port must be between 1 and 65535"),enableSecurityHeaders:z$1.boolean().optional().default(true),enableHsts:z$1.boolean().optional().default(false),hstsMaxAge:z$1.number().int().positive().optional().default(31536e3),frameOptions:ft.optional().default("DENY"),enableCompression:z$1.boolean().optional().default(true),redirectMode:Yr.optional().default("none"),redirectStatusCode:Zr.optional().default(308),adminUrl:z$1.string().url().optional()}),eo=xt.extend({certFile:z$1.string().min(1,"Certificate file path cannot be empty"),keyFile:z$1.string().min(1,"Key file path cannot be empty")}),to=z$1.object({domain:G,target:z$1.string().min(1).optional(),targetPort:z$1.number().int().positive().max(65535).optional(),enableSecurityHeaders:z$1.boolean().optional(),enableHsts:z$1.boolean().optional(),hstsMaxAge:z$1.number().int().positive().optional(),frameOptions:ft.optional(),enableCompression:z$1.boolean().optional(),redirectMode:Yr.optional(),redirectStatusCode:Zr.optional(),adminUrl:z$1.string().url().optional()}),ro=z$1.object({domain:G,adminUrl:z$1.string().url().optional()}),_t=z$1.object({enabled:z$1.boolean(),username:z$1.string().min(1).optional(),passwordHash:z$1.string().min(1).optional(),realm:z$1.string().optional(),routes:z$1.array(z$1.enum(["host","path","tunnel"])).optional()}),vt=z$1.object({host:z$1.string().optional(),path:z$1.string().optional(),pathRouteHost:z$1.string().optional().default("asd.localhost"),dial:Ee,serviceId:z$1.string().optional().default("unknown"),enableHostRoute:z$1.boolean().optional().default(true),enablePathRoute:z$1.boolean().optional().default(true),stripPrefix:z$1.boolean().optional().default(true),priority:z$1.number().int().optional().default(50),securityHeaders:St.optional(),basicAuth:_t.optional(),ingressTag:z$1.string().nullable().optional(),iframeOrigin:z$1.string().nullable().optional(),deleteResponseHeaders:z$1.array(z$1.string()).optional(),serviceType:z$1.string().optional(),isTunnelDomain:z$1.boolean().optional().default(false),flushInterval:z$1.number().optional(),projectId:z$1.string().nullable().optional()}),Ct=z$1.object({host:z$1.string().min(1),serviceId:z$1.string().min(1),priority:z$1.number().int().optional(),ingressTag:z$1.string().nullable().optional(),dial:z$1.string().min(1).optional(),projectId:z$1.string().nullable().optional()}),wt=z$1.object({host:z$1.string().min(1),dial:Ee,securityHeaders:St.optional(),basicAuth:_t.optional(),priority:z$1.number().int().optional(),ingressTag:z$1.string().nullable().optional(),iframeOrigin:z$1.string().nullable().optional(),deleteResponseHeaders:z$1.array(z$1.string()).optional(),serviceId:z$1.string().optional(),serviceType:z$1.string().optional(),flushInterval:z$1.number().optional(),projectId:z$1.string().nullable().optional()}),Pt=z$1.object({path:z$1.string().min(1),host:z$1.string().min(1),dial:Ee,stripPrefix:z$1.boolean().optional().default(true),securityHeaders:St.optional(),basicAuth:_t.optional(),priority:z$1.number().int().optional(),ingressTag:z$1.string().nullable().optional(),iframeOrigin:z$1.string().nullable().optional(),deleteResponseHeaders:z$1.array(z$1.string()).optional(),serviceId:z$1.string().optional(),serviceType:z$1.string().optional(),flushInterval:z$1.number().optional(),projectId:z$1.string().nullable().optional()}),Rt=z$1.object({host:z$1.string().min(1),upstreams:z$1.array(Ee).min(1,"At least one upstream is required"),healthCheckPath:z$1.string().optional().default("/health"),healthCheckInterval:z$1.string().optional().default("10s"),policy:z$1.enum(["first","random","least_conn","round_robin"]).optional().default("first"),priority:z$1.number().int().optional()}),M=z$1.union([z$1.number().int(),z$1.literal("0"),z$1.string().regex(/^-?(\d+(\.\d+)?(ns|us|µs|ms|s|m|h|d))+$/,"Invalid Go duration format. Use units: ns, us, \xB5s, ms, s, m, h, d (e.g., '30s', '1h30m', '1.5d')")]),Ei=z$1.object({uri:z$1.string().optional(),path:z$1.string().optional(),port:z$1.number().int().positive().max(65535).optional(),headers:z$1.record(z$1.string(),z$1.array(z$1.string())).optional(),follow_redirects:z$1.boolean().optional(),interval:M.optional(),timeout:M.optional(),passes:z$1.number().int().positive().optional(),fails:z$1.number().int().positive().optional(),max_size:z$1.number().int().positive().optional(),expect_status:z$1.number().int().min(100).max(599).optional(),expect_body:z$1.string().optional()}),Mi=z$1.object({fail_duration:M.optional(),max_fails:z$1.number().int().positive().optional(),unhealthy_request_count:z$1.number().int().positive().optional(),unhealthy_status:z$1.array(z$1.number().int().min(100).max(599)).optional(),unhealthy_latency:M.optional()}),Li=z$1.object({active:Ei.optional(),passive:Mi.optional()}),$i=z$1.object({selection_policy:z$1.object({policy:z$1.enum(["first","random","least_conn","round_robin","ip_hash","uri_hash","header","cookie"])}).passthrough().optional(),retries:z$1.number().int().nonnegative().optional(),try_duration:M.optional(),try_interval:M.optional()}),zi=z$1.object({dial:z$1.string().min(1),max_requests:z$1.number().int().positive().optional()}),Ni=z$1.object({name:z$1.string().optional(),pattern:z$1.string()}),Xr=z$1.object({host:z$1.array(z$1.string()).optional(),path:z$1.array(z$1.string()).optional(),path_regexp:z$1.object({name:z$1.string().optional(),pattern:z$1.string()}).optional(),method:z$1.array(Vr).optional(),header:z$1.record(z$1.string(),z$1.array(z$1.string())).optional(),header_regexp:z$1.record(z$1.string(),Ni).optional(),query:z$1.record(z$1.string(),z$1.array(z$1.string())).optional(),client_ip:z$1.object({ranges:z$1.array(z$1.string())}).optional(),remote_ip:z$1.object({ranges:z$1.array(z$1.string())}).optional(),protocol:ke.optional(),expression:z$1.string().optional(),tls:z$1.object({handshake_complete:z$1.boolean().optional()}).optional(),file:z$1.object({fs:z$1.string().optional(),root:z$1.string().optional(),try_files:z$1.array(z$1.string()).optional(),try_policy:z$1.enum(["first_exist","first_exist_fallback","smallest_size","largest_size","most_recently_modified"]).optional(),split_path:z$1.array(z$1.string()).optional()}).optional()}),vp=Xr.extend({not:z$1.array(z$1.lazy(()=>Xr)).optional()}),Ui=z$1.object({handler:z$1.literal("reverse_proxy"),upstreams:z$1.array(zi).optional(),load_balancing:$i.optional(),health_checks:Li.optional(),transport:z$1.object({protocol:z$1.string()}).passthrough().optional(),circuit_breaker:z$1.object({type:z$1.string()}).passthrough().optional(),dynamic_upstreams:z$1.object({source:z$1.string()}).passthrough().optional(),flush_interval:M.optional(),stream_timeout:M.optional(),stream_close_delay:M.optional(),trusted_proxies:z$1.array(z$1.string()).optional(),request_buffers:z$1.number().int().nonnegative().optional(),response_buffers:z$1.number().int().nonnegative().optional(),headers:z$1.object({request:z$1.object({add:z$1.record(z$1.string(),z$1.array(z$1.string())).optional(),set:z$1.record(z$1.string(),z$1.array(z$1.string())).optional(),delete:z$1.array(z$1.string()).optional()}).optional(),response:z$1.object({add:z$1.record(z$1.string(),z$1.array(z$1.string())).optional(),set:z$1.record(z$1.string(),z$1.array(z$1.string())).optional(),delete:z$1.array(z$1.string()).optional()}).optional()}).optional(),rewrite:z$1.object({uri:z$1.string().optional(),strip_path_prefix:z$1.string().optional(),strip_path_suffix:z$1.string().optional()}).passthrough().optional(),handle_response:z$1.array(z$1.object({match:z$1.object({status_code:z$1.array(z$1.number().int()).optional()}).passthrough().optional(),routes:z$1.array(z$1.any()).optional()}).passthrough()).optional(),verbose_logs:z$1.boolean().optional()}),Bi=z$1.object({handler:z$1.literal("headers"),response:z$1.object({deferred:z$1.boolean().optional(),set:z$1.record(z$1.string(),z$1.array(z$1.string())).optional(),add:z$1.record(z$1.string(),z$1.array(z$1.string())).optional(),delete:z$1.array(z$1.string()).optional()}).optional(),request:z$1.object({set:z$1.record(z$1.string(),z$1.array(z$1.string())).optional(),add:z$1.record(z$1.string(),z$1.array(z$1.string())).optional(),delete:z$1.array(z$1.string()).optional()}).optional()}),oo=z$1.union([z$1.number().int(),z$1.string()]).optional(),Fi=z$1.object({handler:z$1.literal("static_response"),status_code:oo,body:z$1.string().optional(),headers:z$1.record(z$1.string(),z$1.array(z$1.string())).optional(),close:z$1.boolean().optional(),abort:z$1.boolean().optional()}),Wi=z$1.object({handler:z$1.literal("authentication"),providers:z$1.object({http_basic:z$1.object({accounts:z$1.array(z$1.object({username:z$1.string(),password:z$1.string()})).optional(),realm:z$1.string().optional(),hash:z$1.object({algorithm:z$1.string().optional()}).optional()}).optional()}).optional()}),qi=z$1.object({handler:z$1.literal("rewrite"),uri:z$1.string().optional(),strip_path_prefix:z$1.string().optional(),strip_path_suffix:z$1.string().optional(),uri_substring:z$1.array(z$1.object({find:z$1.string(),replace:z$1.string(),limit:z$1.number().int().optional()})).optional(),query:ut.optional()}),Gi=z$1.object({handler:z$1.literal("encode"),encodings:z$1.object({gzip:z$1.object({}).passthrough().optional(),zstd:z$1.object({}).passthrough().optional(),br:z$1.object({}).passthrough().optional()}).passthrough().optional(),prefer:z$1.array(z$1.string()).optional(),minimum_length:z$1.number().int().positive().optional()}),Ki=Cr.extend({handler:z$1.literal("file_server")}),Xi=Rr.extend({handler:z$1.literal("templates")}),Vi=Ar.extend({handler:z$1.literal("map")}),Yi=Ir.extend({handler:z$1.literal("push")}),Zi=jr.extend({handler:z$1.literal("request_body")}),Ji=z$1.object({handler:z$1.literal("vars")}).passthrough(),Qi=Dr.extend({handler:z$1.literal("intercept")}),ea=rt.extend({handler:z$1.literal("invoke")}),ta=Mr.extend({handler:z$1.literal("tracing")}),ra=$r.extend({handler:z$1.literal("log_append")}),oa=ct.extend({handler:z$1.literal("error"),status_code:oo}),na=Br.extend({handler:z$1.literal("copy_response")}),ia=Nr.extend({handler:z$1.literal("copy_response_headers")}),aa=z$1.object({handler:z$1.literal("subroute"),routes:z$1.array(z$1.lazy(()=>z)).optional(),errors:z$1.any().optional()}),sa=z$1.discriminatedUnion("handler",[Ui,Bi,Fi,Wi,qi,Gi,Ki,Xi,Vi,Yi,Zi,Ji,Qi,ea,ta,ra,oa,na,ia,aa,q]),Ep=z$1.union([sa,Jr]),ca=z$1.object({address:z$1.string(),num_requests:z$1.number(),fails:z$1.number(),healthy:z$1.boolean()}),no=z$1.array(ca),kt=z$1.object({webPort:z$1.number().int().positive().max(65535).optional().default(8081),proxyPort:z$1.number().int().positive().max(65535).optional().default(8080),listenAddress:z$1.string().optional().default("127.0.0.1"),openBrowser:z$1.boolean().optional().default(true),scripts:z$1.array(z$1.string()).optional(),workingDir:z$1.string().optional()});});function K(t,e){let{baseDir:r,requireWithinBase:n=false}={};if(t.includes(".."))throw new L(`Path traversal detected: "${t}" contains ".." segments`,[{code:"custom",path:["filePath"],message:'Path must not contain ".." traversal segments'}]);let a=normalize(t),s=isAbsolute(a)?a:resolve(r??process.cwd(),a);if(n&&r){let u=resolve(r);if(!s.startsWith(u))throw new L(`Path "${t}" resolves outside allowed directory "${r}"`,[{code:"custom",path:["filePath"],message:"Path must be within the allowed directory"}])}return s}function y(t,e,r){try{return t.parse(e)}catch(n){if(n instanceof ZodError){let a=r?`${r}: ${ao(n)}`:ao(n);throw new L(a,n.errors)}throw n}}function ao(t){if(t.issues.length===1){let e=t.issues[0];return so(e)}return t.issues.map((e,r)=>`${r+1}. ${so(e)}`).join("; ")}function so(t){return `${t.path.length>0?`${t.path.join(".")}: `:""}${t.message}`}var X=x(()=>{F();});var At,co,ua,ma,ha,ya,A,Me=x(()=>{F();N();He();X();At=et.extend({logging:z$1.any().optional()}).passthrough(),co=se.passthrough(),ua=z$1.record(z$1.string(),co),ma=ee.passthrough(),ha=z$1.array(ma),ya=z$1.object({version:z$1.string().optional()}).passthrough(),A=class{adminUrl;timeout;origin;constructor(e={}){let r=y(bt,e,"client options");this.adminUrl=r.adminUrl,this.timeout=r.timeout;let n=new URL(this.adminUrl);this.origin=n.origin;}async request(e,r={}){let n=`${this.adminUrl}${e}`,a=(r.method??"GET").toUpperCase(),s=new AbortController,u=setTimeout(()=>s.abort(),this.timeout);try{let m=await fetch(n,{...r,signal:s.signal,headers:{"Content-Type":"application/json",Origin:this.origin,...r.headers}});if(clearTimeout(u),!m.ok){let h=await m.text().catch(()=>"");throw new ie(`Caddy API request failed: ${a} ${n} - ${m.status} ${m.statusText}`,m.status,h,n,a)}return m}catch(m){throw clearTimeout(u),m instanceof ie?m:m.name==="AbortError"?new we(`Request to ${e} timed out after ${this.timeout}ms`,this.timeout):new Ce(`Network request to ${e} failed: ${m.message}`,m)}}async getConfig(){let r=await(await this.request("/config/")).json();return At.parse(r)}escapeServerName(e){return e.replace(/\./g,"%2E")}async getRoutes(e){let r=this.escapeServerName(e),a=await(await this.request(`/config/apps/http/servers/${r}/routes`)).json(),s=ha.safeParse(a);if(!s.success)throw new P(`Invalid routes response from Caddy: ${s.error.message}`);return s.data}async addRoute(e,r){y(z,r,"route");try{let a=await this.getRoutes(e),s=r.match?.[0];if(s&&this.routeExists(a,s))return !1}catch{}let n=this.escapeServerName(e);return await this.request(`/config/apps/http/servers/${n}/routes`,{method:"POST",body:JSON.stringify(r)}),true}async addRoutes(e,r){let n=0,a=0,s=[];try{s=await this.getRoutes(e);}catch{}let u=this.escapeServerName(e);for(let m of r){y(z,m,"route");let h=m.match?.[0];if(h&&this.routeExists(s,h)){a++;continue}await this.request(`/config/apps/http/servers/${u}/routes`,{method:"POST",body:JSON.stringify(m)}),s.push(m),n++;}return {added:n,skipped:a}}routeExists(e,r){return e.some(n=>{let a=n.match?.[0];if(!a)return  false;let s=JSON.stringify(a.host)===JSON.stringify(r.host),u=JSON.stringify(a.path)===JSON.stringify(r.path);return s&&u})}async patchRoutes(e,r){r.forEach((a,s)=>y(z,a,`route[${s}]`));let n=this.escapeServerName(e);await this.request(`/config/apps/http/servers/${n}/routes`,{method:"PATCH",body:JSON.stringify(r)});}async removeRoutesByHost(e,r="https_server"){if(!e||typeof e!="string")throw new P("hostname is required and must be a string");let n;try{n=await this.getRoutes(r);}catch{return 0}let a=n.filter(u=>u.match?.[0]?.host?.[0]!==e),s=n.length-a.length;if(s>0)try{await this.patchRoutes(r,a);}catch{return 0}return s}async removeHostFromRoutes(e,r="https_server"){if(!e||typeof e!="string")throw new P("hostname is required and must be a string");let n;try{n=await this.getRoutes(r);}catch{return {stripped:0,dropped:0}}let a=0,s=0,u=false,m=[];for(let h of n){let g=false,v=[];for(let w of h.match??[])if(Array.isArray(w.host)&&w.host.includes(e)){let T=w.host.filter(R=>R!==e);if(g=true,T.length===0)continue;v.push({...w,host:T});}else v.push(w);if(g){if(u=true,v.length===0){s++;continue}m.push({...h,match:v}),a++;}else m.push(h);}if(u)try{await this.patchRoutes(r,m);}catch{return {stripped:0,dropped:0}}return {stripped:a,dropped:s}}async getServers(){let r=await(await this.request("/config/apps/http/servers")).json();return ua.parse(r)}async getServerConfig(e){let r=this.escapeServerName(e),a=await(await this.request(`/config/apps/http/servers/${r}`)).json();return co.parse(a)}async patchServer(e){await this.request("/config/apps/http/servers",{method:"PATCH",body:JSON.stringify(e)});}async reload(){await this.request("/load",{method:"POST"});}async getVersion(){let r=await(await this.request("/")).json();return ya.parse(r)}async insertRoute(e,r,n="after-health-checks"){let a=y(z,r,"route"),s=await this.getRoutes(e),u=0;if(n==="after-health-checks"){let h=-1;for(let g=0;g<s.length;g++)s[g].handle?.[0]?.handler==="static_response"&&(h=g);u=h+1;}else n==="end"&&(u=s.length);s.splice(u,0,a);let m=await this.getServerConfig(e);await this.patchServer({[e]:{...m,routes:s}});}async replaceRouteById(e,r,n){let a=y(z,n,"route"),s=await this.getRoutes(e),u=s.findIndex(h=>h["@id"]===r);if(u===-1)return  false;s[u]={...a,"@id":r};let m=await this.getServerConfig(e);return await this.patchServer({[e]:{...m,routes:s}}),true}async removeRouteById(e,r){let n=await this.getRoutes(e),a=n.length,s=n.filter(m=>m["@id"]!==r);if(s.length===a)return  false;let u=await this.getServerConfig(e);return await this.patchServer({[e]:{...u,routes:s}}),true}async stop(){await this.request("/stop",{method:"POST"});}async getUpstreams(){let r=await(await this.request("/reverse_proxy/upstreams")).json();return no.parse(r)}async adapt(e,r="caddyfile"){let n=y(Qr,{config:e,adapter:r},"adapt options"),s=await(await this.request("/adapt",{method:"POST",headers:{"Content-Type":"text/caddyfile"},body:JSON.stringify({config:n.config,adapter:n.adapter})})).json();return At.parse(s)}async applyConfig(e){y(At,e,"config"),await this.request("/load",{method:"POST",body:JSON.stringify(e)});}};});function Zp(t){let e=y(vt,t,"buildServiceRoutes options"),r=[],n=e.basicAuth?.routes??["host","path","tunnel"],a=s=>{if(!e.basicAuth)return;let u=e.isTunnelDomain?"tunnel":s;return n.includes(u)?e.basicAuth:void 0};if(e.enableHostRoute&&e.host&&(r.push(lo({host:e.host,serviceId:e.serviceId??"unknown",priority:e.priority!==void 0?e.priority+1e3:void 0,ingressTag:e.ingressTag,projectId:e.projectId})),r.push(Ht({host:e.host,dial:e.dial,securityHeaders:e.securityHeaders,basicAuth:a("host"),priority:e.priority,ingressTag:e.ingressTag,iframeOrigin:e.iframeOrigin,deleteResponseHeaders:e.deleteResponseHeaders,serviceId:e.serviceId,serviceType:e.serviceType,flushInterval:e.flushInterval,projectId:e.projectId}))),e.enablePathRoute&&e.path&&e.path!=="/"){let s=e.pathRouteHost??"asd.localhost";r.push(lo({host:s,serviceId:e.serviceId??"unknown",priority:e.priority!==void 0?e.priority+1e3:void 0,ingressTag:e.ingressTag,projectId:e.projectId})),r.push(ga({path:e.path,host:s,dial:e.dial,stripPrefix:e.stripPrefix??true,securityHeaders:e.securityHeaders,basicAuth:a("path"),priority:e.priority,ingressTag:e.ingressTag,iframeOrigin:e.iframeOrigin,deleteResponseHeaders:e.deleteResponseHeaders,serviceId:e.serviceId,serviceType:e.serviceType,flushInterval:e.flushInterval,projectId:e.projectId}));}return r}function lo(t){let e=y(Ct,t,"buildHealthCheckRoute options"),r=[];e.ingressTag&&r.push(It(e.ingressTag)),e.projectId&&r.push(Ot(e.projectId)),r.push({handler:"headers",response:{set:{"X-ASD-Health":["ok"],"X-ASD-Service-ID":[e.serviceId]}}}),e.dial?r.push({handler:"reverse_proxy",upstreams:[{dial:e.dial}],headers:{request:{set:{"X-Forwarded-Proto":["{http.request.scheme}"],"X-Forwarded-Host":["{http.request.host}"],"X-Forwarded-Port":["{http.request.port}"]}}}}):r.push({handler:"static_response",body:`{"status":"ok","service":"${e.serviceId}","timestamp":"{http.time.now.unix}"}`,status_code:200,headers:{"Content-Type":["application/json"]}});let n={match:[{host:[e.host],path:["/asd/healthcheck"]}],handle:r,terminal:true};return e.priority!==void 0&&(n.priority=e.priority),n}function Ht(t){let e=y(wt,t,"buildHostRoute options"),r=[];e.ingressTag&&r.push(It(e.ingressTag)),e.projectId&&r.push(Ot(e.projectId)),e.iframeOrigin&&r.push(ho(e.iframeOrigin));let n=mo(e.serviceId,e.serviceType);n&&r.push(n),e.securityHeaders&&r.push(po(e.securityHeaders)),e.basicAuth?.enabled&&e.basicAuth.username&&e.basicAuth.passwordHash&&r.push(uo(e.basicAuth)),r.push(V(e.dial,{deleteResponseHeaders:e.deleteResponseHeaders,flushInterval:e.flushInterval}));let a={match:[{host:[e.host]}],handle:r,terminal:true};return e.priority!==void 0&&(a.priority=e.priority),a}function ga(t){let e=y(Pt,t,"buildPathRoute options"),r=[];e.ingressTag&&r.push(It(e.ingressTag)),e.projectId&&r.push(Ot(e.projectId)),e.iframeOrigin&&r.push(ho(e.iframeOrigin));let n=mo(e.serviceId,e.serviceType);n&&r.push(n),e.stripPrefix&&r.push(ye(e.path)),e.securityHeaders&&r.push(po(e.securityHeaders)),e.basicAuth?.enabled&&e.basicAuth.username&&e.basicAuth.passwordHash&&r.push(uo(e.basicAuth)),r.push(V(e.dial,{deleteResponseHeaders:e.deleteResponseHeaders,flushInterval:e.flushInterval}));let a={match:[{host:[e.host],path:[e.path.endsWith("*")?e.path:`${e.path}*`]}],handle:r,terminal:true};return e.priority!==void 0&&(a.priority=e.priority),a}function Jp(t){let e=y(Rt,t,"buildLoadBalancerRoute options"),r={match:[{host:[e.host]}],handle:[{handler:"reverse_proxy",upstreams:e.upstreams.map(n=>({dial:n})),transport:{protocol:"http"},...e.policy!=="first"&&{load_balancing:{selection_policy:{policy:e.policy}}},health_checks:{active:{path:e.healthCheckPath,interval:e.healthCheckInterval,timeout:"5s",expect_status:200}}}],terminal:true};return e.priority!==void 0&&(r.priority=e.priority),r}function V(t,e){let r=typeof t=="string"&&t.startsWith("https://"),n=r?t.replace("https://",""):t,a=e?.tls??r,s={handler:"reverse_proxy",upstreams:[{dial:n}]};if(a){let u={};e?.tlsServerName&&(u.server_name=e.tlsServerName),e?.tlsInsecureSkipVerify===true&&(u.insecure_skip_verify=true),e?.tlsTrustedCACerts&&(u.ca=e.tlsTrustedCACerts),s.transport={protocol:"http",tls:u};}else s.transport={protocol:"http"};return e?.deleteResponseHeaders&&e.deleteResponseHeaders.length>0&&(s.headers={response:{delete:e.deleteResponseHeaders}}),e?.flushInterval!==void 0&&(s.flush_interval=e.flushInterval),s}function po(t){let e={"X-Frame-Options":[t.frameOptions??"DENY"],"X-Content-Type-Options":["nosniff"],"X-XSS-Protection":["1; mode=block"]};return t.enableHsts&&(e["Strict-Transport-Security"]=[`max-age=${t.hstsMaxAge??31536e3}; includeSubDomains`]),{handler:"headers",response:{set:e}}}function uo(t){let e=t.accounts??(t.username&&t.passwordHash?[{username:t.username,password:t.passwordHash}]:[]);if(e.length===0)throw new Error("Basic auth requires at least one account (username + passwordHash or accounts array)");let r={handler:"authentication",providers:{http_basic:{accounts:e,realm:t.realm??"Restricted Area"}}};return t.hash?.algorithm&&t.hash.algorithm!=="bcrypt"&&r.providers?.http_basic&&(r.providers.http_basic.hash={algorithm:t.hash.algorithm}),r}function ye(t){return {handler:"rewrite",strip_path_prefix:t}}function mo(t,e){let r={};return t&&(r["X-ASD-Service-ID"]=[t]),e&&(r["X-ASD-Service-Type"]=[e]),Object.keys(r).length?{handler:"headers",response:{set:r}}:null}function It(t){return {handler:"headers",response:{set:{"X-ASD-Ingress":[t]}}}}function Ot(t){return {handler:"headers",response:{set:{"X-ASD-Project":[t]}}}}function ho(t="*"){let e=t.trim();return {handler:"headers",response:{set:{...e==="*"||fa.test(e)?{"Access-Control-Allow-Origin":[e],"Access-Control-Allow-Methods":["GET","POST","PUT","DELETE","OPTIONS"],"Access-Control-Allow-Headers":["Content-Type","Authorization"]}:{},"Content-Security-Policy":[`frame-ancestors ${t}`]}}}}function jt(t){let e=t.statusCode??(t.permanent!==false?308:307);return {"@id":t.id,match:[{host:[t.fromHost]}],handle:[{handler:"static_response",status_code:e,headers:{Location:[`https://${t.toHost}{http.request.uri}`]}}],terminal:true}}function Tt(t){let e={};return t?.gzip!==false&&(e.gzip={}),t?.zstd!==false&&(e.zstd={}),t?.brotli===true&&(e.br={}),{handler:"encode",encodings:e}}function Dt(t){let{domain:e,mode:r,permanent:n=true,priority:a}=t,s=e.replace(/^www\./,"");return r==="www-to-domain"?{"@id":`redirect-www-to-domain-${s}`,match:[{host:[`www.${s}`]}],handle:[{handler:"static_response",status_code:n?301:302,headers:{Location:[`https://${s}{http.request.uri}`]}}],terminal:true,...a!==void 0&&{priority:a}}:{"@id":`redirect-domain-to-www-${s}`,match:[{host:[s]}],handle:[{handler:"static_response",status_code:n?301:302,headers:{Location:[`https://www.${s}{http.request.uri}`]}}],terminal:true,...a!==void 0&&{priority:a}}}function ba(t){let e=t.mitmproxyPort??8080,r=`${t.mitmproxyHost}:${e}`,n=Ht({host:t.host,dial:r,priority:t.priority});return t.id&&(n["@id"]=t.id),n}function Qp(t){let e=`${t.backendHost}:${t.backendPort}`,r=t.mitmproxyPort??8080,n=Ht({host:t.host,dial:e,priority:t.priority});n["@id"]=t.routeId;let a=ba({host:t.host,mitmproxyHost:t.mitmproxyHost,mitmproxyPort:r,backendHost:t.backendHost,backendPort:t.backendPort,id:t.routeId,priority:t.priority});return {direct:n,proxied:a}}function Sa(t){let e=`${t.upstreamHost}:${t.upstreamPort}`,r=t.routeId??`iframe_proxy_${t.pathPrefix.replace(/\//g,"_")}`,n=t.iframeEmbed!==false,a=[ye(t.pathPrefix)];n&&a.push(_a());let s={handler:"reverse_proxy",transport:{protocol:"http"},upstreams:[{dial:e}]};return t.overrideHost&&(s.headers={request:{set:{Host:[t.overrideHost],Origin:[`http://${t.overrideHost}/`]}}}),a.push(s),{"@id":r,match:[{path:[t.pathPrefix,`${t.pathPrefix}/*`]}],handle:a,terminal:true}}function ed(t){let e=t.mitmproxyWebPort??8081;return Sa({pathPrefix:t.pathPrefix,upstreamHost:t.mitmproxyHost,upstreamPort:e,routeId:t.routeId,iframeEmbed:t.iframeEmbed,overrideHost:`127.0.0.1:${e}`})}function xa(t){let e=`${t.upstreamHost}:${t.upstreamPort}`,r=t.routeId??`ws_proxy_${t.path.replace(/\//g,"_")}`,n={handler:"reverse_proxy",transport:{protocol:"http"},upstreams:[{dial:e}]};return t.overrideHost&&(n.headers={request:{set:{Host:[t.overrideHost],Origin:[`http://${t.overrideHost}/`]}}}),{"@id":r,match:[{path:[t.path]}],handle:[n],terminal:true}}function td(t){let e=t.mitmproxyWebPort??8081;return xa({path:t.path??"/updates",upstreamHost:t.mitmproxyHost,upstreamPort:e,routeId:t.routeId,overrideHost:`127.0.0.1:${e}`})}function _a(t){let e=t?.deleteHeaders??["X-Frame-Options","Content-Security-Policy","X-Xss-Protection"],r=t?.corsOrigin??"*";return {handler:"headers",response:{deferred:true,delete:e,set:{"Access-Control-Allow-Origin":[r],"X-Frame-Options":["ALLOWALL"]}}}}function rd(t){return {handler:"headers",request:{set:{Host:[t.targetHost],Origin:[`http://${t.targetHost}/`]}}}}function od(t){let e={handler:"file_server",root:t.root};t.indexNames&&t.indexNames.length>0&&(e.index_names=t.indexNames),t.browse&&(e.browse=t.browseTemplate?{template_file:t.browseTemplate}:{}),t.hidePatterns&&t.hidePatterns.length>0&&(e.hide=t.hidePatterns),t.precompressed&&(e.precompressed={gzip:{},br:{}});let r={match:[{path:[t.path]}],handle:[e],terminal:true};return t.id&&(r["@id"]=t.id),t.priority!==void 0&&(r.priority=t.priority),r}function nd(t){let e={handler:"templates",file_root:t.fileRoot};t.mimeTypes&&t.mimeTypes.length>0&&(e.mime_types=t.mimeTypes),t.delimiters&&(e.delimiters=t.delimiters);let r={handler:"file_server",root:t.fileRoot},n={match:[{path:[t.path]}],handle:[e,r],terminal:true};return t.id&&(n["@id"]=t.id),t.priority!==void 0&&(n.priority=t.priority),n}function id(t){let e={handler:"error",status_code:String(t.statusCode)};t.message&&(e.error=t.message);let r={handle:[e],terminal:true};if(t.match){let n={};t.match.path&&(n.path=t.match.path),t.match.host&&(n.host=t.match.host),r.match=[n];}return t.id&&(r["@id"]=t.id),t.priority!==void 0&&(r.priority=t.priority),r}function ad(t){return {handler:"request_body",max_size:t.maxSize}}function sd(t){return {handler:"vars",...t.vars}}function cd(t){let e={handler:"tracing"};return t?.span&&(e.span=t.span),e}function ld(t){let e={handler:"map",source:t.source,destinations:t.destinations,mappings:t.mappings};return t.defaults&&(e.defaults=t.defaults),e}var fa,Le=x(()=>{N();X();fa=/^https?:\/\/[^\s*/]+$/;});function $e(t){let e=new X509Certificate(t);return {serialNumber:e.serialNumber,subject:e.subject,issuer:e.issuer,notBefore:e.notBefore,notAfter:e.notAfter}}function fe(t,e){let r=new Date().toISOString().replace(/[:-]/g,"").replace("T","").slice(0,14);return `${t}-${e}-${r}`}function Et(t){let e=[],r=t.split(`
+`),n=[],a=false;for(let s of r)s.includes("-----BEGIN CERTIFICATE-----")?(a=true,n=[s]):s.includes("-----END CERTIFICATE-----")?(n.push(s),e.push(n.join(`
+`)),n=[],a=false):a&&n.push(s);return e}function Mt(t){return new X509Certificate(t).serialNumber}function Lt(t){let e=new X509Certificate(t);return new Date>e.notAfter}function $t(t,e){let r=new X509Certificate(t),n=new Date;return n.setDate(n.getDate()+e),r.notAfter<=n}function zt(t){let e=new X509Certificate(t),r=new Date,n=e.notAfter.getTime()-r.getTime();return Math.floor(n/(1e3*60*60*24))}var ze=x(()=>{});var Ft={};Qe(Ft,{addDomainWithAutoTls:()=>Nt,addDomainWithTls:()=>Ut,deleteDomain:()=>Bt,getDomainConfig:()=>Y,listDomains:()=>xo,removeOldCertificates:()=>So,rotateCertificate:()=>bo,updateDomain:()=>fo});async function Nt(t){let e=y(xt,t,"addDomainWithAutoTls options"),r=new A({adminUrl:e.adminUrl});if(await Y(e.domain,e.adminUrl))throw new ae(e.domain);let a=[];e.redirectMode==="www_to_domain"?a.push(Dt({domain:e.domain,mode:"www-to-domain",permanent:true})):e.redirectMode==="domain_to_www"&&a.push(Dt({domain:e.domain,mode:"domain-to-www",permanent:true}));let s=[];e.enableSecurityHeaders&&s.push({handler:"headers",response:{set:{"X-Frame-Options":[e.frameOptions??"DENY"],"X-Content-Type-Options":["nosniff"],...e.enableHsts?{"Strict-Transport-Security":[`max-age=${e.hstsMaxAge}; includeSubDomains`]}:{}}}}),e.enableCompression!==false&&s.push(Tt()),s.push({handler:"reverse_proxy",upstreams:[{dial:`${e.target}:${e.targetPort}`}]}),a.push({"@id":e.domain,handle:s});let u={[e.domain]:{listen:[":443"],routes:a,automatic_https:{disable:false}}},h=await r.getConfig();return h.apps??={},h.apps.tls??={},h.apps.tls.automation??={policies:[]},h.apps.tls.automation.policies??=[],h.apps.tls.automation.policies.push({subjects:[e.domain],issuers:[{module:"acme"}]}),await r.patchServer(u),{domain:e.domain,target:e.target,targetPort:e.targetPort,tlsEnabled:true,autoTls:true,securityHeaders:{enableHsts:e.enableHsts??false,hstsMaxAge:e.hstsMaxAge??31536e3,frameOptions:e.frameOptions??"DENY",enableCompression:e.enableCompression??true},redirectMode:e.redirectMode??"none"}}async function Ut(t){let e=y(eo,t,"addDomainWithTls options"),r=new A({adminUrl:e.adminUrl});if(await Y(e.domain,e.adminUrl))throw new ae(e.domain);let a=[];e.redirectMode==="www_to_domain"?a.push(jt({fromHost:`www.${e.domain}`,toHost:e.domain,permanent:true,statusCode:e.redirectStatusCode,id:`${e.domain}-redirect`})):e.redirectMode==="domain_to_www"&&a.push(jt({fromHost:e.domain,toHost:`www.${e.domain}`,permanent:true,statusCode:e.redirectStatusCode,id:`${e.domain}-redirect`}));let s=[];e.enableSecurityHeaders&&s.push({handler:"headers",response:{set:{"X-Frame-Options":[e.frameOptions??"DENY"],"X-Content-Type-Options":["nosniff"],...e.enableHsts?{"Strict-Transport-Security":[`max-age=${e.hstsMaxAge}; includeSubDomains`]}:{}}}}),e.enableCompression!==false&&s.push(Tt()),s.push({handler:"reverse_proxy",upstreams:[{dial:`${e.target}:${e.targetPort}`}]}),a.push({"@id":e.domain,match:[{host:[e.domain]}],handle:s,terminal:true});let u={[e.domain]:{listen:[":443"],routes:a,tls_connection_policies:[{certificate_selection:{any_tag:["manual"]}}]}},h=await r.getConfig();h.apps??={},h.apps.tls??={},h.apps.tls.certificates??={load_files:[]},h.apps.tls.certificates.load_files??=[];let g=K(e.certFile),v=K(e.keyFile),T=await(await import('fs/promises')).readFile(g,"utf-8"),D=Et(T)[0],k=Mt(D),ve=fe(e.domain,k);return h.apps.tls.certificates.load_files.push({certificate:g,key:v,tags:[ve,"manual"]}),await r.request("/config/apps/tls",{method:"POST",body:JSON.stringify(h.apps.tls)}),await r.patchServer(u),{domain:e.domain,target:e.target,targetPort:e.targetPort,tlsEnabled:true,autoTls:false,certFile:e.certFile,keyFile:e.keyFile,securityHeaders:{enableHsts:e.enableHsts??false,hstsMaxAge:e.hstsMaxAge??31536e3,frameOptions:e.frameOptions??"DENY",enableCompression:e.enableCompression??true},redirectMode:e.redirectMode??"none"}}async function fo(t){let e=y(to,t,"updateDomain options"),r=await Y(e.domain,e.adminUrl);if(!r)throw new Q(e.domain);let n={...r,...e.target&&{target:e.target},...e.targetPort&&{targetPort:e.targetPort},securityHeaders:{...r.securityHeaders,...e.enableHsts!==void 0&&{enableHsts:e.enableHsts},...e.hstsMaxAge!==void 0&&{hstsMaxAge:e.hstsMaxAge},...e.frameOptions!==void 0&&{frameOptions:e.frameOptions},...e.enableCompression!==void 0&&{enableCompression:e.enableCompression}},...e.redirectMode!==void 0&&{redirectMode:e.redirectMode}};return await Bt({domain:e.domain,adminUrl:e.adminUrl}),n.autoTls?Nt({domain:n.domain,target:n.target,targetPort:n.targetPort,enableSecurityHeaders:true,enableHsts:n.securityHeaders.enableHsts,hstsMaxAge:n.securityHeaders.hstsMaxAge,frameOptions:n.securityHeaders.frameOptions,enableCompression:n.securityHeaders.enableCompression,redirectMode:n.redirectMode,adminUrl:e.adminUrl}):n.certFile&&n.keyFile?Ut({domain:n.domain,target:n.target,targetPort:n.targetPort,certFile:n.certFile,keyFile:n.keyFile,enableSecurityHeaders:true,enableHsts:n.securityHeaders.enableHsts,hstsMaxAge:n.securityHeaders.hstsMaxAge,frameOptions:n.securityHeaders.frameOptions,enableCompression:n.securityHeaders.enableCompression,redirectMode:n.redirectMode,adminUrl:e.adminUrl}):n}async function Bt(t){let e=y(ro,t,"deleteDomain options"),r=new A({adminUrl:e.adminUrl});if(!await Y(e.domain,e.adminUrl))throw new Q(e.domain);let a=await r.getConfig();a.apps?.http?.servers?.[e.domain]&&delete a.apps.http.servers[e.domain],a.apps?.tls?.certificates&&(a.apps.tls.certificates.load_files&&(a.apps.tls.certificates.load_files=a.apps.tls.certificates.load_files.filter(s=>{let u=s.tags?.some(h=>h.includes(e.domain)),m=s.certificate?.includes(e.domain)??s.key?.includes(e.domain);return !u&&!m})),a.apps.tls.certificates.load_pem&&(a.apps.tls.certificates.load_pem=a.apps.tls.certificates.load_pem.filter(s=>!s.tags?.some(m=>m.includes(e.domain))))),a.apps?.tls?.automation?.policies&&(a.apps.tls.automation.policies=a.apps.tls.automation.policies.filter(s=>!s.subjects?.includes(e.domain))),await r.request("/config/",{method:"POST",body:JSON.stringify(a)});}async function Y(t,e){let r=y(G,t,"domain"),n=new A({adminUrl:e});try{let s=(await n.getServers())[r];if(!s)return null;let u="127.0.0.1",m=3e3,h=!1,g="DENY",v=31536e3;if(s.routes&&s.routes.length>0){for(let T of s.routes)if(T.handle)for(let R of T.handle){if(R.handler==="reverse_proxy"&&R.upstreams?.[0]?.dial){let D=R.upstreams[0].dial,k=/^(.+):(\d+)$/.exec(D);k&&(u=k[1],m=parseInt(k[2],10));}if(R.handler==="headers"&&R.headers?.response?.set){let D=R.headers.response.set;if(D["Strict-Transport-Security"]){h=!0;let k=D["Strict-Transport-Security"][0],ve=/max-age=(\d+)/.exec(k);ve&&(v=parseInt(ve[1],10));}if(D["X-Frame-Options"]){let k=D["X-Frame-Options"][0];(k==="SAMEORIGIN"||k==="DENY")&&(g=k);}}}}let w=s.automatic_https?.disable!==!0;return {domain:r,target:u,targetPort:m,tlsEnabled:!0,autoTls:w,securityHeaders:{enableHsts:h,hstsMaxAge:v,frameOptions:g,enableCompression:!0},redirectMode:"none"}}catch{return null}}async function bo(t,e,r,n){let a=y(G,t,"domain"),s=K(e),u=K(r),m=new A({adminUrl:n});if(!await Y(a,n))throw new Q(a);let g=await m.getConfig(),w=await(await import('fs/promises')).readFile(s,"utf-8"),R=Et(w)[0],D=Mt(R),k=fe(a,D);return $e(R),g.apps??={},g.apps.tls??={},g.apps.tls.certificates??={load_files:[]},g.apps.tls.certificates.load_files??=[],g.apps.tls.certificates.load_files.push({certificate:s,key:u,tags:[k,"manual"]}),await m.request("/config/apps/tls/certificates",{method:"PATCH",body:JSON.stringify(g.apps.tls.certificates)}),k}async function So(t,e,r){let n=y(G,t,"domain"),a=new A({adminUrl:r}),s=await a.getConfig();if(!s.apps?.tls?.certificates?.load_files)return 0;let u=s.apps.tls.certificates.load_files.length;s.apps.tls.certificates.load_files=s.apps.tls.certificates.load_files.filter(h=>{let g=h.tags?.some(w=>w.includes(n)),v=h.tags?.includes(e);return !g||v});let m=u-s.apps.tls.certificates.load_files.length;return m>0&&await a.request("/config/apps/tls/certificates",{method:"PATCH",body:JSON.stringify(s.apps.tls.certificates)}),m}async function xo(t){let e=new A({adminUrl:t});try{let r=await e.getServers(),n=new Set;for(let a of Object.values(r))if(a.routes){for(let s of a.routes)if(s.match){for(let u of s.match)if(u.host)for(let m of u.host)n.add(m);}}return Array.from(n).sort()}catch{return []}}var Ne=x(()=>{N();Me();F();X();ze();Le();});F();N();Me();Le();Me();X();function yo(t){let e=t.toLowerCase();return e.endsWith(".json")?"json":e.endsWith(".yaml")||e.endsWith(".yml")?"yaml":e.endsWith(".nginx")||e.includes("nginx.conf")?"nginx":e.endsWith(".apache")||e.includes("httpd.conf")?"apache":"caddyfile"}async function go(t,e,r){let n=K(t),a=await readFile(n,"utf-8"),s=e??yo(t);return new A(r).adapt(a,s)}async function Ca(t,e){return go(t,"caddyfile",e)}Ne();function Wt(t,e){if(e===t)return  true;if(!e.includes("*"))return  false;if(e.startsWith("*.")&&!e.slice(2).includes("*")){let n=e.slice(2);if(!t.endsWith("."+n))return  false;let a=t.slice(0,t.length-n.length-1);return a.length>0&&!a.includes(".")}return new RegExp("^"+e.split(/\*+/).map(wa).join(".*")+"$").test(t)}function wa(t){return t.replace(/[.+?^${}()|[\]\\]/g,"\\$&")}var Pa=["TLS_AES_128_GCM_SHA256","TLS_AES_256_GCM_SHA384","TLS_CHACHA20_POLY1305_SHA256"],Ra=["TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256","TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"],ka=[...Pa,...Ra],Aa=["x25519","secp256r1","secp384r1"],Ha=["h3","h2","http/1.1"],Ia=["h2","http/1.1"],Oa=["http/1.1"];function _o(t){let e={};return t.sni&&t.sni.length>0&&(e.match={sni:t.sni}),(t.certificateTags||t.requiredCertificateTags)&&(e.certificate_selection={},t.certificateTags&&(e.certificate_selection.any_tag=t.certificateTags),t.requiredCertificateTags&&(e.certificate_selection.all_tags=t.requiredCertificateTags)),t.protocolMin&&(e.protocol_min=t.protocolMin==="1.2"?"tls1.2":"tls1.3"),t.protocolMax&&(e.protocol_max=t.protocolMax==="1.2"?"tls1.2":"tls1.3"),t.cipherSuites&&(t.cipherSuites==="modern"?e.cipher_suites=[...ka]:e.cipher_suites=t.cipherSuites),t.curves&&(t.curves==="recommended"?e.curves=[...Aa]:e.curves=t.curves),t.alpn&&(t.alpn==="http3"?e.alpn=[...Ha]:t.alpn==="http2"?e.alpn=[...Ia]:t.alpn==="http1"?e.alpn=[...Oa]:e.alpn=t.alpn),(t.clientAuthMode||t.clientCaCertFiles)&&(e.client_authentication={},t.clientAuthMode&&(e.client_authentication.mode=t.clientAuthMode),t.clientCaCertFiles&&(e.client_authentication.trusted_ca_certs_pem_files=t.clientCaCertFiles)),e}function Pd(t){return _o({...t,protocolMin:"1.3",cipherSuites:"modern",curves:"recommended",alpn:"http3"})}function Rd(t){return _o({...t,protocolMin:"1.2",cipherSuites:"modern",curves:"recommended",alpn:"http2"})}function kd(t={}){let e={module:"internal",...t.internalIssuer??{}},r=[];return t.includeLocalhostPolicy!==false&&r.push({subjects:["*.localhost","localhost"],issuers:[{...e}]}),r.push({issuers:[{...e}]}),{policies:r}}function vo(t){let e=t.toLowerCase().trim();return !!(!e||e==="localhost"||e==="*.localhost"||e.endsWith(".localhost")||/^\d{1,3}(\.\d{1,3}){3}(:\d+)?$/.test(e)||/^\[[0-9a-f:]+\](:\d+)?$/.test(e))}function Ad(t){let e=new Set,r=n=>{if(!n)return;if(Array.isArray(n)){for(let s of n)r(s);return}if(typeof n!="object")return;let a=n;if(Array.isArray(a.match))for(let s of a.match){if(!s||typeof s!="object")continue;let u=s.host;if(Array.isArray(u))for(let m of u)typeof m!="string"||!m||vo(m)||e.add(m);}if(Array.isArray(a.handle))for(let s of a.handle)r(s);if(Array.isArray(a.routes))for(let s of a.routes)r(s);};return r(t),Array.from(e).sort()}function Hd(t={}){let e={};t.disable&&(e.disable=true),t.disableRedirects&&(e.disable_redirects=true),t.disableCertificates&&(e.disable_certificates=true),t.ignoreLoadedCertificates&&(e.ignore_loaded_certificates=true);let r=s=>{if(!s||s.length===0)return [];let u=new Set;for(let m of s)typeof m!="string"||!m||vo(m)||u.add(m);return Array.from(u).sort()},n=r(t.skip);n.length>0&&(e.skip=n);let a=r(t.skipCerts);return a.length>0&&(e.skip_certificates=a),Object.keys(e).length>0?e:void 0}function Id(t,e){if(e.size===0)return [...t];let r=new Set,n=[];for(let a of e){let s=a.toLowerCase();r.add(s),s.includes("*")&&n.push(s);}return t.filter(a=>{let s=a.toLowerCase();if(r.has(s))return  false;if(s.includes("*")){for(let u of r)if(Wt(u,s))return  false}for(let u of n)if(Wt(s,u))return  false;return  true})}function Od(t,e){if(!t||typeof t!="object")throw new Error("applyLocalCaInstallTrust: `config` must be an object");let r=Ue(t,"apps","config.apps"),n=Ue(r,"pki","config.apps.pki"),a=Ue(n,"certificate_authorities","config.apps.pki.certificate_authorities"),s=Ue(a,"local","config.apps.pki.certificate_authorities.local");s.install_trust=e;}function Ue(t,e,r){let n=t[e];if(n==null){let a={};return t[e]=a,a}if(typeof n!="object"||Array.isArray(n))throw new Error(`applyLocalCaInstallTrust: ${r} exists but is not an object (got ${Array.isArray(n)?"array":typeof n})`);return n}var ja=Object.freeze({porkbun:"porkbun",cloudflare:"cloudflare",route53:"route53",digitalocean:"digitalocean",godaddy:"godaddy"});function qt(t){let e=t.trim().toLowerCase();return ja[e]??e}function Td(t){if(!Array.isArray(t.subjects)||t.subjects.length===0)throw new Error("buildAcmeDnsPolicy: `subjects` must be a non-empty array");let e=[];for(let s of t.subjects){if(typeof s!="string"||!s.trim())throw new Error("buildAcmeDnsPolicy: `subjects` entries must be non-empty strings");e.push(s.trim());}if(typeof t.dnsProvider!="string"||!t.dnsProvider.trim())throw new Error("buildAcmeDnsPolicy: `dnsProvider` is required");if(t.providerConfig){if(Object.prototype.hasOwnProperty.call(t.providerConfig,"name"))throw new Error("buildAcmeDnsPolicy: `providerConfig.name` is reserved \u2014 set the provider via `dnsProvider`");if(Object.prototype.hasOwnProperty.call(t.providerConfig,"module"))throw new Error("buildAcmeDnsPolicy: `providerConfig.module` is reserved \u2014 `module` is the issuer-level discriminator, not a provider field")}let r=qt(t.dnsProvider),a={module:"acme",challenges:{dns:{provider:{...t.providerConfig??{},name:r}}}};return t.email&&(a.email=t.email),t.ca&&(a.ca=t.ca),{subjects:e,issuers:[a]}}var C={HEALTH:0,AUTH_DOMAIN:10,AUTH_PATH:20,SPECIFIC_PATH:30,REWRITE:40,SERVICE:50,WILDCARD:90,FALLBACK:100};function Be(t){if(typeof t.priority=="number")return t.priority;if(t["@id"]==="global-health"||Co(t))return C.HEALTH;let e=t.match??[];if(e.length===0)return C.FALLBACK;let r=C.SERVICE;for(let n of e){let a=n.path??[];for(let s of a)s==="/health"?r=Math.min(r,C.HEALTH):s.includes("/admin")||s.includes("/auth")?r=Math.min(r,C.AUTH_PATH):s==="/*"?r=Math.max(r,C.WILDCARD):(s.includes("*"),r=Math.min(r,C.SPECIFIC_PATH));}return r}function Co(t){return (t.match??[]).some(r=>r.path?.some(n=>n==="/health"||n.includes("health")))}function Ta(t){return !t.includes("*")&&!t.includes("{")?100:t.includes("{")?50:t.endsWith("*")?30+t.split("/").filter(r=>r&&r!=="*").length*5:t==="/*"?10:20}function Da(t){let e=t.map(r=>({route:r,priority:Be(r),specificity:Ea(r)}));return e.sort((r,n)=>r.priority!==n.priority?r.priority-n.priority:n.specificity-r.specificity),e.map(r=>{let{priority:n,...a}=r.route;return a})}function Ea(t){let e=t.match??[];if(e.length===0)return 0;let r=0;for(let n of e){let a=n.path??[];for(let u of a)r+=Ta(u);let s=n.host??[];for(let u of s)u.includes("*")?r+=10:r+=20;r+=Object.keys(n).length*5;}return r}function Ma(t){if(t.length===0)return;let e=t.findIndex(n=>n["@id"]==="global-health"||Co(n));if(e>0)throw new Error(`Route ordering violation: Health check route must be first, but found at index ${e}`);for(let n=0;n<t.length-1;n++){let a=Be(t[n]),s=Be(t[n+1]);if(a>s){let u=t[n]["@id"]??`route-${n}`,m=t[n+1]["@id"]??`route-${n+1}`;throw new Error(`Route ordering violation: Route "${u}" (priority ${a}) should come after route "${m}" (priority ${s})`)}}let r=La(t);for(let[n,a]of Object.entries(r)){let s=a.findIndex(u=>u.match?.some(m=>m.path?.some(h=>h==="/*")));if(s!==-1)for(let u=s+1;u<a.length;u++){let m=a[u];if(m.match?.some(g=>g.path?.some(v=>v!=="/*"&&!v.includes("*")))){let g=a[s]["@id"]??`route-${s}`,v=m["@id"]??`route-${u}`;throw new Error(`Route ordering violation on host "${n}": Specific path route "${v}" should come before wildcard route "${g}"`)}}}}function La(t){let e={};for(let r of t){let n=r.match?.flatMap(a=>a.host??[])??["*"];for(let a of n)e[a]||(e[a]=[]),e[a].push(r);}return e}function $a(t,e,r={}){let n=[...t];if(r.position==="beginning")return n.unshift(e),n;if(r.position==="end")return n.push(e),n;if(r.beforeId){let a=n.findIndex(s=>s["@id"]===r.beforeId);if(a===-1)throw new Error(`Route with @id "${r.beforeId}" not found`);return n.splice(a,0,e),n}if(r.afterId){let a=n.findIndex(s=>s["@id"]===r.afterId);if(a===-1)throw new Error(`Route with @id "${r.afterId}" not found`);return n.splice(a+1,0,e),n}return n.push(e),n}function za(t){let e=t.path??"/health",r=JSON.stringify({status:"healthy",...t.services!==void 0&&{services:t.services},...t.version&&{version:t.version}});return {"@id":"global-health",priority:C.HEALTH,match:[{path:[e]}],handle:[{handler:"headers",response:{set:{"X-ASD-Health":["ok"],"X-ASD-Service-ID":[t.instanceId],...t.projectId?{"X-ASD-Project":[t.projectId]}:{}}}},{handler:"static_response",status_code:200,headers:{"Content-Type":["application/json"]},body:r}],terminal:true}}function Na(t){let e=t.path??"/*",r=typeof t.upstream=="string"?[{dial:t.upstream}]:t.upstream,n={"X-Content-Type-Options":["nosniff"],"X-Frame-Options":["DENY"],...t.headers};t.serviceId&&(n["X-ASD-Service-ID"]=[t.serviceId]),t.serviceType&&(n["X-ASD-Service-Type"]=[t.serviceType]),t.projectId&&(n["X-ASD-Project"]=[t.projectId]);let a=[];t.enableCompression!==false&&a.push({handler:"encode",encodings:{gzip:{},zstd:{}}}),a.push({handler:"headers",response:{set:n}}),a.push({handler:"reverse_proxy",upstreams:r});let s=t.priority??(e==="/*"?C.WILDCARD:C.SPECIFIC_PATH);return {"@id":t.id,priority:s,match:[{host:[t.host],path:[e]}],handle:a,terminal:true}}function Ua(t){let e=t.id??`auth-${t.host}${t.path?`-${t.path.replace(/[/*]/g,"")}`:""}`,r=t.path,n=typeof t.upstream=="string"?[{dial:t.upstream}]:t.upstream,a={"X-Content-Type-Options":["nosniff"],"X-Frame-Options":["DENY"],"X-ASD-Auth-Type":[r?"path-level":"domain-level"],...t.headers};t.serviceId&&(a["X-ASD-Service-ID"]=[t.serviceId]),t.serviceType&&(a["X-ASD-Service-Type"]=[t.serviceType]),t.projectId&&(a["X-ASD-Project"]=[t.projectId]);let s=t.priority??(r?C.AUTH_PATH:C.AUTH_DOMAIN);return {"@id":e,priority:s,match:[{host:[t.host],...r&&{path:[r]}}],handle:[{handler:"authentication",providers:{http_basic:{accounts:t.accounts,realm:t.realm??"Protected Area"}}},{handler:"headers",response:{set:a}},{handler:"reverse_proxy",upstreams:n}],terminal:true}}function Ba(t){let e=t.path??"/*",r=t.upstreams.map(s=>typeof s=="string"?{dial:s}:s),n={"X-Content-Type-Options":["nosniff"],"X-Frame-Options":["DENY"],...t.headers};t.serviceId&&(n["X-ASD-Service-ID"]=[t.serviceId]);let a={handler:"reverse_proxy",upstreams:r};return t.policy&&(a.load_balancing={selection_policy:{policy:t.policy}}),t.healthCheck&&(a.health_checks={active:{path:t.healthCheck.path??"/health",interval:t.healthCheck.interval??"10s",timeout:t.healthCheck.timeout??"2s"}}),{"@id":t.id,priority:C.SERVICE,match:[{host:[t.host],path:[e]}],handle:[{handler:"headers",response:{set:n}},a],terminal:true}}function Fa(t){let e=typeof t.upstream=="string"?[{dial:t.upstream}]:t.upstream,r={"X-ASD-Path-Rewrite":["true"],"X-Content-Type-Options":["nosniff"],"X-Frame-Options":["SAMEORIGIN"],...t.headers};return t.serviceId&&(r["X-ASD-Service-ID"]=[t.serviceId]),{"@id":t.id,priority:C.REWRITE,match:[{host:[t.host],path:[`${t.pathPrefix}/*`]}],handle:[{handler:"rewrite",strip_path_prefix:t.pathPrefix},{handler:"headers",response:{set:r}},{handler:"reverse_proxy",upstreams:e}],terminal:true}}function Wa(t){let e=t.statusCode??(t.permanent===false?307:308);return {"@id":t.id??`redirect-${t.from}-to-${t.to}`,priority:C.SERVICE,match:[{host:[t.from]}],handle:[{handler:"static_response",status_code:e,headers:{Location:[`https://${t.to}{http.request.uri}`]}}],terminal:true}}ze();var Fe=class{constructor(e){this.client=e;}inspect(e){return Promise.resolve($e(e))}async rotate(e){let{domain:r,certPath:n,keyPath:a,adminUrl:s,cleanupOld:u=false}=e,{rotateCertificate:m}=await Promise.resolve().then(()=>(Ne(),Ft)),h=await m(r,n,a,s),g={tag:h};return u&&(g.removedCount=await this.cleanupOld(r,h,s)),g}async cleanupOld(e,r,n){let{removeOldCertificates:a}=await Promise.resolve().then(()=>(Ne(),Ft));return a(e,r,n)}async list(e){let n=(await this.client.getConfig()).apps?.tls;if(!n)return [];let a=n.certificates?.load_files??[],s=[];for(let u of a){let h=(u.tags??[]).find(v=>v.startsWith(`${e}-`));if(!h)continue;let g=u.certificate;if(typeof g=="string")try{let w=await(await import('fs/promises')).readFile(g,"utf-8"),T=await this.inspect(w),R=zt(w);s.push({...T,tag:h,isExpired:Lt(w),expiringSoon:$t(w,30),daysUntilExpiration:R});}catch{continue}}return s}async checkExpiration(e,r=30){let n=await this.list(e),a=n.filter(s=>s.isExpired||s.daysUntilExpiration<=r);return {hasExpiring:a.length>0,expiringCertificates:a,allCertificates:n}}generateTag(e,r){return Promise.resolve(fe(e,r))}async isExpired(e){return Promise.resolve(Lt(e))}async isExpiringSoon(e,r=30){return Promise.resolve($t(e,r))}async getDaysUntilExpiration(e){return Promise.resolve(zt(e))}};function qa(t){return new Fe(t)}async function wo(t,e=10){if(e<4||e>31)throw new Error("Bcrypt rounds must be between 4 and 31");try{return await(await import('bcrypt')).hash(t,e)}catch{throw new Error("bcrypt module not found. Install it with: npm install bcrypt @types/bcrypt")}}async function Ga(t,e){try{return await(await import('bcrypt')).compare(t,e)}catch{throw new Error("bcrypt module not found. Install it with: npm install bcrypt @types/bcrypt")}}async function Po(t){let{execFile:e}=await import('child_process'),{promisify:r}=await import('util'),n=r(e);try{let{stdout:a}=await n("caddy",["hash-password","--plaintext",t]);return a.trim()}catch{throw new Error(`Failed to hash password with Caddy CLI. Is Caddy installed?
+Alternative: Use hashPassword() with npm install bcrypt
+Or manually run: caddy hash-password --plaintext <your-password>`)}}async function Ro(t,e,r){let n=r?.useCaddyCLI?await Po(e):await wo(e,r?.rounds);return {username:t,password:n}}async function Ka(t,e){return Promise.all(t.map(r=>Ro(r.username,r.password,e)))}N();N();F();async function Ho(){return new Promise(t=>{let e=spawn("which",["mitmweb"]);e.on("close",r=>t(r===0)),e.on("error",()=>t(false));})}async function iu(){return await Ho()?new Promise(t=>{let e=spawn("mitmweb",["--version"]),r="";e.stdout.on("data",n=>{r+=n.toString();}),e.on("close",n=>{if(n===0){let a=/(\d+\.\d+\.\d+)/.exec(r);t(a?a[1]:null);}else t(null);}),e.on("error",()=>t(null));}):null}async function au(t={}){let e=kt.parse(t);if(!await Ho())throw new Pe("MITMproxy is not installed. Install with: pip install mitmproxy");let r=Io(e.workingDir);if(r.running)throw new P("MITMweb is already running",{pid:r.pid});let n=["--web-port",e.webPort.toString(),"--listen-port",e.proxyPort.toString(),"--listen-host",e.listenAddress,"--no-web-open-browser"];if(e.scripts&&e.scripts.length>0)for(let m of e.scripts)n.push("-s",m);let a=spawn("mitmweb",n,{detached:true,stdio:"ignore"}),s=e.workingDir??process.cwd(),u=join(s,"mitmweb.pid");if(writeFileSync(u,a.pid.toString(),"utf-8"),a.unref(),await Ya(e.webPort,1e4),e.openBrowser){let m=`http://${e.listenAddress}:${e.webPort}`;Za(m);}return {pid:a.pid,webUrl:`http://${e.listenAddress}:${e.webPort}`,proxyUrl:`http://${e.listenAddress}:${e.proxyPort}`,pidFile:u}}async function su(t){let e=Io(t);if(!e.running||!e.pid)return;try{process.kill(e.pid,"SIGTERM"),await new Promise(a=>{let s=setInterval(()=>{try{process.kill(e.pid,0);}catch{clearInterval(s),a();}},100);setTimeout(()=>{clearInterval(s);try{process.kill(e.pid,"SIGKILL");}catch{}a();},5e3);});}catch{}let r=t??process.cwd(),n=join(r,"mitmweb.pid");existsSync(n)&&unlinkSync(n);}function Io(t){let e=t??process.cwd(),r=join(e,"mitmweb.pid");if(!existsSync(r))return {running:false};try{let n=readFileSync(r,"utf-8").trim(),a=parseInt(n,10);if(isNaN(a))return {running:!1};try{return process.kill(a,0),{running:!0,pid:a,webUrl:"http://127.0.0.1:8081",proxyUrl:"http://127.0.0.1:8080"}}catch{return unlinkSync(r),{running:!1}}}catch{return {running:false}}}async function Ya(t,e){let r=Date.now(),n=`http://127.0.0.1:${t}`;for(;Date.now()-r<e;){try{if((await fetch(n)).ok)return}catch{}await new Promise(a=>setTimeout(a,500));}throw new Re("Mitmweb failed to start within timeout")}function Za(t){let e=process.platform,r;e==="darwin"?r="open":e==="win32"?r="start":r="xdg-open",spawn(r,[t],{detached:true,stdio:"ignore"}).unref();}async function cu(){return await new Promise(r=>{let n=spawn("which",["pipx"]);n.on("close",a=>r(a===0)),n.on("error",()=>r(false));})&&(console.log("Installing mitmproxy with pipx..."),await new Promise(n=>{let a=spawn("pipx",["install","mitmproxy"],{stdio:"inherit"});a.on("close",s=>n(s===0)),a.on("error",()=>n(false));}))||(console.log("Installing mitmproxy with pip..."),await new Promise(r=>{let n=spawn("pip",["install","--user","mitmproxy"],{stdio:"inherit"});n.on("close",a=>r(a===0)),n.on("error",()=>r(false));}))?(console.log("\u2705 MITMproxy installed successfully"),true):(console.error("\u274C Failed to install mitmproxy"),false)}Le();var Oo=class{caddy;proxies;services=new Map;constructor(e,r){if(this.caddy=e,this.proxies=r,Object.keys(r).length===0)throw new Error("At least one MITMproxy instance must be configured");if(!r.default){let n=Object.keys(r)[0];this.proxies.default=r[n];}}register(e){let r=`mitm_${e.id}`;this.services.set(e.id,{registration:e,enabled:false,activeProxy:null,routeId:r});}unregister(e){return this.services.delete(e)}getService(e){return this.services.get(e)}getProxy(e="default"){let r=this.proxies[e];if(!r)throw new Error(`Unknown proxy: ${e}. Available: ${Object.keys(this.proxies).join(", ")}`);return r}buildDirectRoute(e,r){let n=`${e.backend.host}:${e.backend.port}`;return e.host?{"@id":r,match:[{host:[e.host]}],handle:[V(n)],terminal:true}:{"@id":r,match:[{path:[`${e.pathPrefix}/*`]}],handle:[ye(e.pathPrefix),V(n)],terminal:true}}buildProxiedRoute(e,r,n){let a=`${r.host}:${r.port}`;return e.host?{"@id":n,match:[{host:[e.host]}],handle:[V(a)],terminal:true}:{"@id":n,match:[{path:[`${e.pathPrefix}/*`]}],handle:[ye(e.pathPrefix),V(a)],terminal:true}}async enable(e,r={}){let n=this.getService(e);if(!n)throw new Error(`Service not registered: ${e}`);let a=r.proxy??"default",s=this.getProxy(a),{registration:u,routeId:m}=n,h=this.buildProxiedRoute(u,s,m);await this.caddy.removeRouteById(u.serverId,m).catch(()=>{}),await this.caddy.addRoute(u.serverId,h),n.enabled=true,n.activeProxy=a;}async disable(e){let r=this.getService(e);if(!r)throw new Error(`Service not registered: ${e}`);let{registration:n,routeId:a}=r,s=this.buildDirectRoute(n,a);await this.caddy.removeRouteById(n.serverId,a).catch(()=>{}),await this.caddy.addRoute(n.serverId,s),r.enabled=false,r.activeProxy=null;}async enableAll(e={}){let r=Array.from(this.services.keys()).map(n=>this.enable(n,e));await Promise.all(r);}async disableAll(){let e=Array.from(this.services.keys()).map(r=>this.disable(r));await Promise.all(e);}isEnabled(e){return this.getService(e)?.enabled??false}getStatus(){let e={};for(let[r,n]of this.services)e[r]={enabled:n.enabled,proxy:n.activeProxy,service:n.registration};return e}getServiceStatus(e){let r=this.getService(e);if(r)return {enabled:r.enabled,proxy:r.activeProxy,service:r.registration}}getRegisteredServices(){return Array.from(this.services.keys())}getAvailableProxies(){return Object.keys(this.proxies)}getProxyConfig(e){return this.proxies[e]}};N();var Eo={};Qe(Eo,{AuthenticationPortalSchema:()=>ue,AuthorizationPolicySchema:()=>me,IdentityStoreSchema:()=>gt,LdapIdentityStoreSchema:()=>de,LocalIdentityStoreSchema:()=>pe,OAuth2IdentityProviderSchema:()=>Oe,OidcIdentityProviderSchema:()=>je,SECURITY_TEMPLATES:()=>Ke,SecurityAppSchema:()=>Te,SecurityAuthenticatorHandlerSchema:()=>q,SecurityAuthorizationHandlerSchema:()=>le,SecurityAuthorizerProviderSchema:()=>yt,SecurityConfigSchema:()=>he,SecurityHandlerSchema:()=>qr,buildAuthenticationPortal:()=>U,buildAuthenticatorHandler:()=>Kt,buildAuthenticatorRoute:()=>qe,buildAuthorizationHandler:()=>Xt,buildAuthorizationPolicy:()=>B,buildLdapIdentityStore:()=>We,buildLocalIdentityStore:()=>be,buildOAuth2Provider:()=>Se,buildOidcProvider:()=>J,buildProtectedRoute:()=>Ge,buildSecurityApp:()=>jo,buildSecurityConfig:()=>xe,getTemplateById:()=>Do,getTemplatesByCategory:()=>To});De();X();De();function be(t){let e={name:t.name??"local",kind:"local",params:{realm:t.realm??"local",path:t.path}};return y(pe,e,"buildLocalIdentityStore")}function We(t){let e={name:t.name??"ldapdb",kind:"ldap",params:{realm:t.realm??"ldap",servers:t.servers.map(r=>{let n=r.address;return !n.startsWith("ldap://")&&!n.startsWith("ldaps://")&&(n=(r.port===636?"ldaps://":"ldap://")+n),{address:n,...r.port&&{port:r.port}}}),bind_username:t.bindUsername,bind_password:t.bindPassword,search_base_dn:t.searchBaseDn,search_user_filter:(t.searchUserFilter??"(uid={username})").replace(/\{username\}/g,"%s"),groups:t.groups&&t.groups.length>0?t.groups.map(r=>({dn:r.groupDn??t.searchBaseDn,...r.roles&&{roles:r.roles}})):[{dn:t.searchBaseDn,roles:["authp/user"]}]}};return y(de,e,"buildLdapIdentityStore")}function Se(t){let e={name:t.name??t.provider,kind:"oauth",params:{driver:t.provider,realm:t.realm??t.provider,client_id:t.clientId,client_secret:t.clientSecret,scopes:t.scopes??["openid","email","profile"],...t.authorizationUrl&&{authorization_url:t.authorizationUrl},...t.tokenUrl&&{token_url:t.tokenUrl}}};return y(Oe,e,"buildOAuth2Provider")}function J(t){let e=t.metadataUrl;e.endsWith("/.well-known/openid-configuration")||(e=e.replace(/\/$/,"")+"/.well-known/openid-configuration");let r={name:t.name??t.provider,kind:"oauth",params:{driver:"generic",realm:t.realm??t.provider,client_id:t.clientId,client_secret:t.clientSecret,metadata_url:e,scopes:t.scopes??["openid","email","profile"]}};return y(je,r,"buildOidcProvider")}function U(t){let e={name:t.name};if(t.ui&&(e.ui={...t.ui.theme&&{theme:t.ui.theme},...t.ui.logoUrl&&{logo_url:t.ui.logoUrl},...t.ui.customCss&&{custom_css:t.ui.customCss}}),t.cookie){let r={},n;if(t.cookie.lifetime!==void 0)if(typeof t.cookie.lifetime=="number")n=t.cookie.lifetime;else {let a=/^(\d+)(h|m|s)?$/.exec(t.cookie.lifetime);if(a){let s=parseInt(a[1],10),u=a[2]??"s";n=u==="h"?s*3600:u==="m"?s*60:s;}}if(t.cookie.domain){let a={};n!==void 0&&(a.lifetime=n),t.cookie.insecure!==void 0&&(a.insecure=t.cookie.insecure),t.cookie.sameSite&&(a.same_site=t.cookie.sameSite),r.domains={[t.cookie.domain]:a};}else n!==void 0&&(r.lifetime=n),t.cookie.insecure!==void 0&&(r.insecure=t.cookie.insecure),t.cookie.sameSite&&(r.same_site=t.cookie.sameSite);t.cookie.path&&(r.path=t.cookie.path),Object.keys(r).length>0&&(e.cookie_config=r);}return t.identityStores&&(e.identity_stores=t.identityStores),t.identityProviders&&(e.identity_providers=t.identityProviders),t.transformUser&&(e.user_transformer_configs=[t.transformUser]),y(ue,e,"buildAuthenticationPortal")}function B(t){let e={name:t.name};return t.accessLists&&t.accessLists.length>0&&(e.access_list_rules=t.accessLists.map(r=>({action:r.action??"allow",conditions:[`match ${r.claim} ${r.values.join(" ")}`]}))),t.cryptoKey&&(e.crypto_key_configs=[{...t.cryptoKey.tokenName&&{token_name:t.cryptoKey.tokenName},...t.cryptoKey.source&&{source:t.cryptoKey.source}}]),t.bypass&&t.bypass.length>0&&(e.bypass_configs=t.bypass.map(r=>({uri:r,match_type:"prefix"}))),y(me,e,"buildAuthorizationPolicy")}function xe(t){let e={};return t.portals&&t.portals.length>0&&(e.authentication_portals=t.portals),t.policies&&t.policies.length>0&&(e.authorization_policies=t.policies),t.identityStores&&t.identityStores.length>0&&(e.identity_stores=t.identityStores),t.identityProviders&&t.identityProviders.length>0&&(e.identity_providers=t.identityProviders),y(he,e,"buildSecurityConfig")}function jo(t){let e={config:t.config};return y(Te,e,"buildSecurityApp")}function Kt(t){let e={handler:"authenticator",portal_name:t.portalName,...t.routeMatcher&&{route_matcher:t.routeMatcher}};return y(q,e,"buildAuthenticatorHandler")}function Xt(t){let e={handler:"authentication",providers:{authorizer:{gatekeeper_name:t.gatekeeperName,...t.routeMatcher&&{route_matcher:t.routeMatcher}}}};return y(le,e,"buildAuthorizationHandler")}function qe(t){let e=Kt({portalName:t.portalName,routeMatcher:"*"});return {"@id":t.routeId??`auth-portal-${t.portalName}`,match:[{host:t.hosts}],handle:[e],terminal:true}}function Ge(t){let e=t.paths?.join(" ")??"*",r=Xt({gatekeeperName:t.gatekeeperName,routeMatcher:e}),n={host:t.hosts};return t.paths&&(n.path=t.paths),{"@id":t.routeId??`protected-${t.gatekeeperName}`,match:[n],handle:[r,{handler:"reverse_proxy",upstreams:[{dial:t.dial}]}],terminal:true}}var Ja={id:"caddy-sec-local-store",name:"Local Identity Store",description:"File-based user authentication with JSON credentials file",category:"identity-store",variables:[{name:"path",description:"Path to users JSON file",default:"/etc/caddy/users.json"},{name:"realm",description:"Authentication realm name",default:"local"}],build:()=>be({path:"/etc/caddy/users.json",realm:"local"}),snippet:["buildLocalIdentityStore({",'  path: "${1:/etc/caddy/users.json}",','  realm: "${2:local}",',"})"]},Qa={id:"caddy-sec-ldap-store",name:"LDAP Identity Store",description:"LDAP/Active Directory authentication",category:"identity-store",variables:[{name:"server",description:"LDAP server address",default:"ldap.example.com"},{name:"port",description:"LDAP server port",default:"389"},{name:"bindUsername",description:"Bind username/DN for LDAP queries",default:"cn=admin,dc=example,dc=com"},{name:"bindPassword",description:"Bind password",default:"secret"},{name:"searchBaseDn",description:"Base DN for user searches",default:"ou=users,dc=example,dc=com"}],build:()=>We({servers:[{address:"ldap.example.com",port:389}],bindUsername:"cn=admin,dc=example,dc=com",bindPassword:"secret",searchBaseDn:"ou=users,dc=example,dc=com",searchUserFilter:"(uid={username})"}),snippet:["buildLdapIdentityStore({",'  servers: [{ address: "${1:ldap.example.com}", port: ${2:389} }],','  bindUsername: "${3:cn=admin,dc=example,dc=com}",','  bindPassword: "${4:secret}",','  searchBaseDn: "${5:ou=users,dc=example,dc=com}",','  searchUserFilter: "${6:(uid={username})}",',"})"]},es={id:"caddy-sec-oauth2-github",name:"GitHub OAuth2 Provider",description:"GitHub OAuth2 authentication for developer tools",category:"identity-provider",variables:[{name:"clientId",description:"GitHub OAuth App client ID",default:"your-client-id"},{name:"clientSecret",description:"GitHub OAuth App client secret",default:"your-client-secret"}],build:()=>Se({provider:"github",clientId:"your-client-id",clientSecret:"your-client-secret",scopes:["user:email","read:user"]}),snippet:["buildOAuth2Provider({",'  provider: "github",','  clientId: "${1:your-client-id}",','  clientSecret: "${2:your-client-secret}",','  scopes: ["user:email", "read:user"],',"})"]},ts={id:"caddy-sec-oauth2-google",name:"Google OAuth2 Provider",description:"Google OAuth2 authentication",category:"identity-provider",variables:[{name:"clientId",description:"Google OAuth client ID",default:"your-client-id.apps.googleusercontent.com"},{name:"clientSecret",description:"Google OAuth client secret",default:"your-client-secret"}],build:()=>Se({provider:"google",clientId:"your-client-id.apps.googleusercontent.com",clientSecret:"your-client-secret",scopes:["openid","email","profile"]}),snippet:["buildOAuth2Provider({",'  provider: "google",','  clientId: "${1:your-client-id.apps.googleusercontent.com}",','  clientSecret: "${2:your-client-secret}",','  scopes: ["openid", "email", "profile"],',"})"]},rs={id:"caddy-sec-oidc-keycloak",name:"Keycloak OIDC Provider",description:"Keycloak OpenID Connect authentication",category:"identity-provider",variables:[{name:"clientId",description:"Keycloak client ID",default:"my-app"},{name:"clientSecret",description:"Keycloak client secret",default:"your-client-secret"},{name:"metadataUrl",description:"OIDC metadata/discovery URL",default:"https://keycloak.example.com/realms/myrealm/.well-known/openid-configuration"}],build:()=>J({provider:"keycloak",clientId:"my-app",clientSecret:"your-client-secret",metadataUrl:"https://keycloak.example.com/realms/myrealm/.well-known/openid-configuration",scopes:["openid","email","profile"]}),snippet:["buildOidcProvider({",'  provider: "keycloak",','  clientId: "${1:my-app}",','  clientSecret: "${2:your-client-secret}",','  metadataUrl: "${3:https://keycloak.example.com/realms/myrealm/.well-known/openid-configuration}",','  scopes: ["openid", "email", "profile"],',"})"]},os={id:"caddy-sec-oidc-okta",name:"Okta OIDC Provider",description:"Okta OpenID Connect authentication",category:"identity-provider",variables:[{name:"clientId",description:"Okta client ID",default:"your-client-id"},{name:"clientSecret",description:"Okta client secret",default:"your-client-secret"},{name:"domain",description:"Okta domain",default:"your-domain.okta.com"}],build:()=>J({provider:"okta",clientId:"your-client-id",clientSecret:"your-client-secret",metadataUrl:"https://your-domain.okta.com/.well-known/openid-configuration"}),snippet:["buildOidcProvider({",'  provider: "okta",','  clientId: "${1:your-client-id}",','  clientSecret: "${2:your-client-secret}",','  metadataUrl: "https://${3:your-domain.okta.com}/.well-known/openid-configuration",',"})"]},ns={id:"caddy-sec-oidc-auth0",name:"Auth0 OIDC Provider",description:"Auth0 OpenID Connect authentication",category:"identity-provider",variables:[{name:"clientId",description:"Auth0 client ID",default:"your-client-id"},{name:"clientSecret",description:"Auth0 client secret",default:"your-client-secret"},{name:"domain",description:"Auth0 domain",default:"your-tenant.auth0.com"}],build:()=>J({provider:"auth0",clientId:"your-client-id",clientSecret:"your-client-secret",metadataUrl:"https://your-tenant.auth0.com/.well-known/openid-configuration"}),snippet:["buildOidcProvider({",'  provider: "auth0",','  clientId: "${1:your-client-id}",','  clientSecret: "${2:your-client-secret}",','  metadataUrl: "https://${3:your-tenant.auth0.com}/.well-known/openid-configuration",',"})"]},is={id:"caddy-sec-portal-basic",name:"Basic Authentication Portal",description:"Simple authentication portal with local identity store",category:"portal",variables:[{name:"name",description:"Portal name",default:"myportal"},{name:"identityStore",description:"Identity store name",default:"local"}],build:()=>U({name:"myportal",identityStores:["local"]}),snippet:["buildAuthenticationPortal({",'  name: "${1:myportal}",','  identityStores: ["${2:local}"],',"})"]},as={id:"caddy-sec-portal-cookie",name:"Portal with Cookie Configuration",description:"Authentication portal with custom cookie settings",category:"portal",variables:[{name:"name",description:"Portal name",default:"myportal"},{name:"domain",description:"Cookie domain",default:".example.com"},{name:"lifetime",description:"Session lifetime",default:"24h"}],build:()=>U({name:"myportal",identityStores:["local"],cookie:{domain:".example.com",path:"/",lifetime:"24h"}}),snippet:["buildAuthenticationPortal({",'  name: "${1:myportal}",','  identityStores: ["${2:local}"],',"  cookie: {",'    domain: "${3:.example.com}",','    path: "/",','    lifetime: "${4:24h}",',"  },","})"]},ss={id:"caddy-sec-portal-sso",name:"Portal with SSO Providers",description:"Authentication portal with OAuth/OIDC single sign-on",category:"portal",variables:[{name:"name",description:"Portal name",default:"myportal"},{name:"providers",description:"Identity providers",default:"keycloak"}],build:()=>U({name:"myportal",identityStores:["local"],identityProviders:["keycloak","google"]}),snippet:["buildAuthenticationPortal({",'  name: "${1:myportal}",','  identityStores: ["${2:local}"],','  identityProviders: ["${3:keycloak}", "${4:google}"],',"})"]},cs={id:"caddy-sec-policy-basic",name:"Basic Authorization Policy",description:"Simple role-based access control policy",category:"policy",variables:[{name:"name",description:"Policy name",default:"mypolicy"},{name:"roles",description:"Allowed roles",default:"user"}],build:()=>B({name:"mypolicy",accessLists:[{claim:"roles",values:["user"]}]}),snippet:["buildAuthorizationPolicy({",'  name: "${1:mypolicy}",',"  accessLists: [",'    { claim: "roles", values: ["${2:user}"] },',"  ],","})"]},ls={id:"caddy-sec-policy-admin",name:"Admin-Only Policy",description:"Policy that restricts access to admin role only",category:"policy",variables:[{name:"name",description:"Policy name",default:"admin-policy"}],build:()=>B({name:"admin-policy",accessLists:[{claim:"roles",values:["admin"]}]}),snippet:["buildAuthorizationPolicy({",'  name: "${1:admin-policy}",',"  accessLists: [",'    { claim: "roles", values: ["admin"], action: "allow" },',"  ],","})"]},ps={id:"caddy-sec-policy-bypass",name:"Policy with Bypass Paths",description:"Policy with public endpoints that skip authentication",category:"policy",variables:[{name:"name",description:"Policy name",default:"api-policy"},{name:"bypass",description:"Paths to bypass",default:"/health,/metrics"}],build:()=>B({name:"api-policy",accessLists:[{claim:"roles",values:["user","admin"]}],bypass:["/health","/metrics","/public/*"]}),snippet:["buildAuthorizationPolicy({",'  name: "${1:api-policy}",',"  accessLists: [",'    { claim: "roles", values: ["user", "admin"] },',"  ],",'  bypass: ["/health", "/metrics", "${2:/public/*}"],',"})"]},ds={id:"caddy-sec-route-portal",name:"Authentication Portal Route",description:"Route that serves the login portal",category:"route",variables:[{name:"host",description:"Portal hostname",default:"auth.example.com"},{name:"portalName",description:"Portal name",default:"myportal"}],build:()=>qe({hosts:["auth.example.com"],portalName:"myportal",routeId:"auth-portal"}),snippet:["buildAuthenticatorRoute({",'  hosts: ["${1:auth.example.com}"],','  portalName: "${2:myportal}",','  routeId: "${3:auth-portal}",',"})"]},us={id:"caddy-sec-route-protected",name:"Protected Route",description:"Route with authentication required",category:"route",variables:[{name:"host",description:"Service hostname",default:"api.example.com"},{name:"path",description:"Protected path",default:"/api/*"},{name:"gatekeeperName",description:"Policy name",default:"mypolicy"},{name:"upstream",description:"Upstream address",default:"localhost:3000"}],build:()=>Ge({hosts:["api.example.com"],paths:["/api/*"],gatekeeperName:"mypolicy",dial:"localhost:3000",routeId:"protected-api"}),snippet:["buildProtectedRoute({",'  hosts: ["${1:api.example.com}"],','  paths: ["${2:/api/*}"],','  gatekeeperName: "${3:mypolicy}",','  dial: "${4:localhost:3000}",','  routeId: "${5:protected-api}",',"})"]},ms={id:"caddy-sec-full-local",name:"Complete Local Authentication Setup",description:"Full setup with local users, portal, policy, and routes",category:"full-setup",variables:[{name:"usersPath",description:"Path to users file",default:"/etc/caddy/users.json"},{name:"authHost",description:"Auth portal hostname",default:"auth.example.com"},{name:"apiHost",description:"API hostname",default:"api.example.com"}],build:()=>{let t=be({path:"/etc/caddy/users.json"}),e=U({name:"portal",identityStores:["local"],cookie:{domain:".example.com",lifetime:"24h"}}),r=B({name:"policy",accessLists:[{claim:"roles",values:["user","admin"]}],bypass:["/health"]});return xe({identityStores:[t],portals:[e],policies:[r]})},snippet:["// Complete local authentication setup","const store = buildLocalIdentityStore({",'  path: "${1:/etc/caddy/users.json}",',"});","","const portal = buildAuthenticationPortal({",'  name: "${2:portal}",','  identityStores: ["local"],',"  cookie: {",'    domain: "${3:.example.com}",','    lifetime: "24h",',"  },","});","","const policy = buildAuthorizationPolicy({",'  name: "${4:policy}",',"  accessLists: [",'    { claim: "roles", values: ["user", "admin"] },',"  ],",'  bypass: ["/health"],',"});","","const config = buildSecurityConfig({","  identityStores: [store],","  portals: [portal],","  policies: [policy],","});"]},hs={id:"caddy-sec-full-oidc",name:"Complete OIDC Authentication Setup",description:"Full setup with Keycloak OIDC, portal, policy, and routes",category:"full-setup",variables:[{name:"clientId",description:"OIDC client ID",default:"my-app"},{name:"clientSecret",description:"OIDC client secret",default:"your-secret"},{name:"metadataUrl",description:"OIDC metadata/discovery URL",default:"https://keycloak.example.com/realms/myrealm/.well-known/openid-configuration"}],build:()=>{let t=J({provider:"keycloak",clientId:"my-app",clientSecret:"your-secret",metadataUrl:"https://keycloak.example.com/realms/myrealm/.well-known/openid-configuration"}),e=U({name:"portal",identityProviders:["keycloak"]}),r=B({name:"policy",accessLists:[{claim:"roles",values:["user"]}]});return xe({identityProviders:[t],portals:[e],policies:[r]})},snippet:["// Complete OIDC authentication setup","const provider = buildOidcProvider({",'  provider: "keycloak",','  clientId: "${1:my-app}",','  clientSecret: "${2:your-secret}",','  metadataUrl: "${3:https://keycloak.example.com/realms/myrealm/.well-known/openid-configuration}",',"});","","const portal = buildAuthenticationPortal({",'  name: "${4:portal}",','  identityProviders: ["keycloak"],',"});","","const policy = buildAuthorizationPolicy({",'  name: "${5:policy}",',"  accessLists: [",'    { claim: "roles", values: ["user"] },',"  ],","});","","const config = buildSecurityConfig({","  identityProviders: [provider],","  portals: [portal],","  policies: [policy],","});"]},Ke=[Ja,Qa,es,ts,rs,os,ns,is,as,ss,cs,ls,ps,ds,us,ms,hs];function To(t){return Ke.filter(e=>e.category===t)}function Do(t){return Ke.find(e=>e.id===t)}var qo={};Qe(qo,{CloudflareDnsProviderConfigSchema:()=>Ye,DigitaloceanDnsProviderConfigSchema:()=>Je,GodaddyDnsProviderConfigSchema:()=>Ze,KNOWN_ACME_DNS_PROVIDERS:()=>Mo,PorkbunDnsProviderConfigSchema:()=>Ve,buildAcmeDnsProviderConfig:()=>Wo,buildCloudflareDnsConfig:()=>Zt,buildDigitaloceanDnsConfig:()=>Qt,buildGodaddyDnsConfig:()=>er,buildPorkbunDnsConfig:()=>Yt,buildRoute53DnsConfig:()=>Jt});var Mo=["porkbun","cloudflare","route53","digitalocean","godaddy"];z$1.object({apikey:z$1.string(),secretapikey:z$1.string()});var Lo=z$1.object({api_key:z$1.string().optional(),api_secret_key:z$1.string().optional()});z$1.any();var $o=z$1.object({api_token:z$1.string().optional(),zone_token:z$1.string().optional()});var zo=z$1.object({api_token:z$1.string().optional()});z$1.object({data:z$1.string(),ttl:z$1.number()});var ys=z$1.object({});z$1.object({Record:z$1.any(),ID:z$1.string()});var No=z$1.object({Client:ys,auth_token:z$1.string()});var Uo=z$1.object({region:z$1.string().optional(),profile:z$1.string().optional(),access_key_id:z$1.string().optional(),secret_access_key:z$1.string().optional(),session_token:z$1.string().optional(),max_retries:z$1.number().optional(),route53_max_wait:z$1.number().optional(),wait_for_route53_sync:z$1.boolean().optional(),skip_route53_sync_on_delete:z$1.boolean().optional(),hosted_zone_id:z$1.string().optional()});var Bo=z$1.object({Provider:z$1.any().optional(),debug_logging:z$1.boolean().optional()});var Ve=Lo,Ye=$o,Ze=zo,Je=No.omit({Client:true}),Fo=Uo.extend(Bo.pick({debug_logging:true}).shape);X();function Yt(){return {providerConfig:y(Ve,{api_key:"{env.PORKBUN_API_KEY}",api_secret_key:"{env.PORKBUN_API_SECRET_KEY}"},"buildPorkbunDnsConfig"),envVars:["PORKBUN_API_KEY","PORKBUN_API_SECRET_KEY"]}}function Zt(){return {providerConfig:y(Ye,{api_token:"{env.CLOUDFLARE_API_TOKEN}"},"buildCloudflareDnsConfig"),envVars:["CLOUDFLARE_API_TOKEN"]}}function Jt(t){let e=["AWS_ACCESS_KEY_ID","AWS_SECRET_ACCESS_KEY","AWS_REGION"];return !t||Object.keys(t).length===0?{envVars:e}:{providerConfig:y(Fo,t,"buildRoute53DnsConfig"),envVars:e}}function Qt(){return {providerConfig:y(Je,{auth_token:"{env.DIGITALOCEAN_API_TOKEN}"},"buildDigitaloceanDnsConfig"),envVars:["DIGITALOCEAN_API_TOKEN"]}}function er(){return {providerConfig:y(Ze,{api_token:"{env.GODADDY_API_TOKEN}"},"buildGodaddyDnsConfig"),envVars:["GODADDY_API_TOKEN"]}}function Wo(t){switch(qt(t)){case "porkbun":return Yt();case "cloudflare":return Zt();case "route53":return Jt();case "digitalocean":return Qt();case "godaddy":return er();default:return {envVars:[]}}}ze();var Go={version:"0.10.0"};var am=Go.version;
+export{ja as ACME_DNS_PROVIDER_MODULE_MAP,Ei as ActiveHealthChecksSchema,Qr as AdaptOptionsSchema,xt as AddDomainWithAutoTlsOptionsSchema,eo as AddDomainWithTlsOptionsSchema,Wi as AuthenticationHandlerSchema,ue as AuthenticationPortalSchema,me as AuthorizationPolicySchema,_t as BasicAuthOptionsSchema,Di as CaddyAdapterSchema,P as CaddyApiClientError,ie as CaddyApiError,A as CaddyClient,bt as CaddyClientOptionsSchema,M as CaddyDurationSchema,Ep as CaddyHandlerSchema,Jr as CaddyRouteHandlerSchema,Ti as CaddyRouteMatcherSchema,z as CaddyRouteSchema,Fe as CertificateManager,Ye as CloudflareDnsProviderConfigSchema,na as CopyResponseHandlerSchema,ia as CopyResponseHeadersHandlerSchema,ro as DeleteDomainOptionsSchema,Ee as DialAddressSchema,Je as DigitaloceanDnsProviderConfigSchema,ae as DomainAlreadyExistsError,Q as DomainNotFoundError,G as DomainSchema,Gi as EncodeHandlerSchema,oa as ErrorHandlerSchema,vp as ExtendedRouteMatcherSchema,Ki as FileServerHandlerSchema,ft as FrameOptionsSchema,Ze as GodaddyDnsProviderConfigSchema,Oa as HTTP1_ALPN_PROTOCOLS,Ia as HTTP2_ALPN_PROTOCOLS,Ha as HTTP_ALPN_PROTOCOLS,Ni as HeaderRegexpSchema,Bi as HeadersHandlerSchema,Ct as HealthCheckRouteOptionsSchema,Li as HealthChecksSchema,wt as HostRouteOptionsSchema,Vr as HttpMethodSchema,gt as IdentityStoreSchema,Qi as InterceptHandlerSchema,ea as InvokeHandlerSchema,Mo as KNOWN_ACME_DNS_PROVIDERS,sa as KnownCaddyHandlerSchema,de as LdapIdentityStoreSchema,Rt as LoadBalancerRouteOptionsSchema,$i as LoadBalancingSchema,pe as LocalIdentityStoreSchema,ra as LogAppendHandlerSchema,ka as MODERN_CIPHER_SUITES,Vi as MapHandlerSchema,ji as MatchHeaderSchema,Oi as MatchQuerySchema,Oo as MitmproxyManager,Pe as MitmproxyNotInstalledError,Re as MitmproxyStartError,kt as MitmwebOptionsSchema,Ce as NetworkError,Oe as OAuth2IdentityProviderSchema,je as OidcIdentityProviderSchema,Mi as PassiveHealthChecksSchema,Pt as PathRouteOptionsSchema,Ve as PorkbunDnsProviderConfigSchema,Yi as PushHandlerSchema,Aa as RECOMMENDED_CURVES,C as ROUTE_PRIORITIES,Yr as RedirectModeSchema,Zr as RedirectStatusCodeSchema,Zi as RequestBodyHandlerSchema,Ui as ReverseProxyHandlerSchema,qi as RewriteHandlerSchema,Ke as SECURITY_TEMPLATES,Te as SecurityAppSchema,q as SecurityAuthenticatorHandlerSchema,le as SecurityAuthorizationHandlerSchema,yt as SecurityAuthorizerProviderSchema,he as SecurityConfigSchema,qr as SecurityHandlerSchema,St as SecurityHeadersSchema,vt as ServiceRouteOptionsSchema,Fi as StaticResponseHandlerSchema,aa as SubrouteHandlerSchema,Ra as TLS_1_2_CIPHER_SUITES,Pa as TLS_1_3_CIPHER_SUITES,Xi as TemplatesHandlerSchema,we as TimeoutError,_p as TlsIssuerSchema,ta as TracingHandlerSchema,to as UpdateDomainOptionsSchema,zi as UpstreamSchema,no as UpstreamStatusArraySchema,ca as UpstreamStatusSchema,am as VERSION,L as ValidationError,Ji as VarsHandlerSchema,Nt as addDomainWithAutoTls,Ut as addDomainWithTls,or as adminConfigSchema,Od as applyLocalCaInstallTrust,cu as autoInstallMitmproxy,Td as buildAcmeDnsPolicy,Wo as buildAcmeDnsProviderConfig,U as buildAuthenticationPortal,Kt as buildAuthenticatorHandler,qe as buildAuthenticatorRoute,Xt as buildAuthorizationHandler,B as buildAuthorizationPolicy,Hd as buildAutomaticHttpsConfig,kd as buildAutomationPoliciesWithInternalFallback,uo as buildBasicAuthHandler,Zt as buildCloudflareDnsConfig,Rd as buildCompatibleTlsPolicy,Tt as buildCompressionHandler,Qt as buildDigitaloceanDnsConfig,rd as buildDnsRebindingBypassHandler,id as buildErrorRoute,od as buildFileServerRoute,er as buildGodaddyDnsConfig,lo as buildHealthCheckRoute,Ht as buildHostRoute,ho as buildIframeHeadersHandler,_a as buildIframePermissiveHandler,Sa as buildIframeProxyRoute,It as buildIngressTagHeadersHandler,We as buildLdapIdentityStore,Jp as buildLoadBalancerRoute,be as buildLocalIdentityStore,ld as buildMapHandler,ba as buildMitmproxyRoute,Qp as buildMitmproxyRoutePair,td as buildMitmproxyWebSocketRoute,ed as buildMitmproxyWebUiRoute,Pd as buildModernTlsPolicy,Se as buildOAuth2Provider,J as buildOidcProvider,ga as buildPathRoute,Yt as buildPorkbunDnsConfig,Ot as buildProjectIdHeadersHandler,Ge as buildProtectedRoute,jt as buildRedirectRoute,ad as buildRequestBodyHandler,V as buildReverseProxyHandler,ye as buildRewriteHandler,Jt as buildRoute53DnsConfig,jo as buildSecurityApp,xe as buildSecurityConfig,po as buildSecurityHeadersHandler,Zp as buildServiceRoutes,nd as buildTemplatesRoute,_o as buildTlsConnectionPolicy,cd as buildTracingHandler,sd as buildVarsHandler,xa as buildWebSocketProxyRoute,Dt as buildWwwRedirect,qo as caddyDns,Eo as caddySecurity,Be as calculateRoutePriority,Ad as collectExternalHostsFromRoutes,et as configSchema,Ro as createBasicAuthAccount,Ka as createBasicAuthAccounts,Ua as createBasicAuthRoute,qa as createCertificateManager,za as createHealthRoute,Ba as createLoadBalancerRoute,Wa as createRedirectRoute,Fa as createRewriteRoute,Na as createServiceRoute,Bt as deleteDomain,yo as detectAdapter,tr as durationSchema,Mt as extractSerialNumber,Id as filterAcmeManagedFromSkip,fe as generateCertTag,zt as getDaysUntilExpiration,Y as getDomainConfig,iu as getMitmproxyVersion,Io as getMitmwebStatus,Do as getTemplateById,To as getTemplatesByCategory,wo as hashPassword,Po as hashPasswordWithCaddy,Wt as hostMatchesPattern,$a as insertRouteRelative,Lt as isCertificateExpired,$t as isCertificateExpiringSoon,Ho as isMitmproxyInstalled,xo as listDomains,Ca as loadCaddyfile,go as loadConfig,nr as loggingSchema,$e as parseCertificate,So as removeOldCertificates,qt as resolveAcmeDnsProviderModule,bo as rotateCertificate,te as routeListSchema,ee as routeSchema,se as serverSchema,Da as sortRoutes,Et as splitCertificateBundle,au as startMitmweb,su as stopMitmweb,fo as updateDomain,Mp as validate,Ma as validateRouteOrdering,Ga as verifyPassword};

package/dist/mitm/index.d.ts

@@ -0,0 +1,218 @@
+import { K as MitmwebOptions, N as MitmwebStatus } from '../types-DIjkvykh.js';
+import { a6 as CaddyClient } from '../client-Bf2QoSWQ.js';
+export { a4 as MitmwebOptionsSchema } from '../client-Bf2QoSWQ.js';
+import 'zod';
+import '../caddy-http-DLxwstYo.js';
+
+/**
+ * Check if mitmproxy is installed
+ * @returns True if mitmweb is available
+ */
+declare function isMitmproxyInstalled(): Promise<boolean>;
+/**
+ * Get mitmproxy version
+ * @returns Version string
+ */
+declare function getMitmproxyVersion(): Promise<string | null>;
+/**
+ * Start mitmweb proxy
+ * @param options - Mitmweb configuration
+ * @returns Process information
+ */
+declare function startMitmweb(options?: MitmwebOptions): Promise<{
+    pid: number;
+    webUrl: string;
+    proxyUrl: string;
+    pidFile: string;
+}>;
+/**
+ * Stop mitmweb proxy
+ * @param workingDir - Working directory (to find PID file)
+ */
+declare function stopMitmweb(workingDir?: string): Promise<void>;
+/**
+ * Get mitmweb status
+ * @param workingDir - Working directory (to find PID file)
+ * @returns Status information
+ */
+declare function getMitmwebStatus(workingDir?: string): MitmwebStatus;
+/**
+ * Auto-install mitmproxy using pipx (recommended) or pip
+ * @returns True if installation successful
+ */
+declare function autoInstallMitmproxy(): Promise<boolean>;
+
+/**
+ * MitmproxyManager - High-level API for managing MITMproxy interception
+ *
+ * Provides simple enable/disable functionality for traffic inspection
+ * with support for multiple services and multiple MITMproxy instances.
+ */
+
+/**
+ * Configuration for a MITMproxy instance
+ */
+interface MitmproxyInstance {
+    /** MITMproxy host (e.g., "mitmproxy" or "localhost") */
+    host: string;
+    /** Proxy port for intercepting traffic (default: 8080) */
+    port: number;
+    /** Web UI port for viewing traffic (optional, e.g., 8081) */
+    webPort?: number;
+}
+/**
+ * Service registration for interception
+ */
+interface ServiceRegistration {
+    /** Unique identifier for this service */
+    id: string;
+    /** Caddy server name (e.g., "srv0", "https_server") */
+    serverId: string;
+    /** Path prefix to match (e.g., "/es", "/api") */
+    pathPrefix: string;
+    /** Backend service to forward to */
+    backend: {
+        host: string;
+        port: number;
+    };
+    /** Optional: host pattern for host-based routing (e.g., "api.example.com") */
+    host?: string;
+}
+/**
+ * Status of a registered service
+ */
+interface ServiceStatus {
+    /** Whether interception is currently enabled */
+    enabled: boolean;
+    /** Which proxy instance is being used (null if disabled) */
+    proxy: string | null;
+    /** Service registration details */
+    service: ServiceRegistration;
+}
+/**
+ * Options for enabling interception
+ */
+interface EnableOptions {
+    /** Which proxy instance to use (default: "default") */
+    proxy?: string;
+}
+/**
+ * MitmproxyManager - Simplified API for MITMproxy traffic interception
+ *
+ * @example
+ * ```typescript
+ * const manager = new MitmproxyManager(caddy, {
+ *   default: { host: "mitmproxy", port: 8080, webPort: 8081 },
+ *   debug: { host: "mitmproxy-debug", port: 8082, webPort: 8083 },
+ * });
+ *
+ * // Register services
+ * manager.register({
+ *   id: "elasticsearch",
+ *   serverId: "srv0",
+ *   pathPrefix: "/es",
+ *   backend: { host: "elasticsearch", port: 9200 },
+ * });
+ *
+ * // Enable/disable interception
+ * await manager.enable("elasticsearch");
+ * await manager.disable("elasticsearch");
+ *
+ * // Check status
+ * const status = manager.getStatus();
+ * ```
+ */
+declare class MitmproxyManager {
+    private readonly caddy;
+    private readonly proxies;
+    private readonly services;
+    /**
+     * Create a new MitmproxyManager
+     * @param caddy - CaddyClient instance
+     * @param proxies - Map of proxy names to MITMproxy instance configurations
+     */
+    constructor(caddy: CaddyClient, proxies: Record<string, MitmproxyInstance>);
+    /**
+     * Register a service for potential interception
+     * @param service - Service configuration
+     */
+    register(service: ServiceRegistration): void;
+    /**
+     * Unregister a service
+     * @param serviceId - Service ID to unregister
+     * @returns true if service was found and unregistered
+     */
+    unregister(serviceId: string): boolean;
+    /**
+     * Get a registered service state
+     * @param serviceId - Service ID
+     * @returns Service state or undefined
+     */
+    private getService;
+    /**
+     * Get a proxy instance configuration
+     * @param proxyName - Proxy name (default: "default")
+     * @returns Proxy configuration
+     */
+    private getProxy;
+    /**
+     * Build a direct route for a service (no interception)
+     */
+    private buildDirectRoute;
+    /**
+     * Build an intercepted route for a service (through MITMproxy)
+     */
+    private buildProxiedRoute;
+    /**
+     * Enable interception for a service
+     * @param serviceId - Service ID to enable interception for
+     * @param options - Enable options (proxy selection)
+     */
+    enable(serviceId: string, options?: EnableOptions): Promise<void>;
+    /**
+     * Disable interception for a service (restore direct routing)
+     * @param serviceId - Service ID to disable interception for
+     */
+    disable(serviceId: string): Promise<void>;
+    /**
+     * Enable interception for all registered services
+     * @param options - Enable options (proxy selection)
+     */
+    enableAll(options?: EnableOptions): Promise<void>;
+    /**
+     * Disable interception for all registered services
+     */
+    disableAll(): Promise<void>;
+    /**
+     * Check if interception is enabled for a service
+     * @param serviceId - Service ID to check
+     * @returns true if enabled
+     */
+    isEnabled(serviceId: string): boolean;
+    /**
+     * Get status of all registered services
+     * @returns Map of service ID to status
+     */
+    getStatus(): Record<string, ServiceStatus>;
+    /**
+     * Get status of a specific service
+     * @param serviceId - Service ID
+     * @returns Service status or undefined
+     */
+    getServiceStatus(serviceId: string): ServiceStatus | undefined;
+    /**
+     * Get list of registered service IDs
+     */
+    getRegisteredServices(): string[];
+    /**
+     * Get list of available proxy instances
+     */
+    getAvailableProxies(): string[];
+    /**
+     * Get proxy instance configuration
+     * @param proxyName - Proxy name
+     */
+    getProxyConfig(proxyName: string): MitmproxyInstance | undefined;
+}
+
+export { type EnableOptions, type MitmproxyInstance, MitmproxyManager, MitmwebOptions, MitmwebStatus, type ServiceRegistration, type ServiceStatus, autoInstallMitmproxy, getMitmproxyVersion, getMitmwebStatus, isMitmproxyInstalled, startMitmweb, stopMitmweb };