daycare-cli 0.0.0-canary.f57680e

package/dist/engine/expose/exposeProxy.js

@@ -0,0 +1,188 @@
+import http from "node:http";
+import { pipeline } from "node:stream/promises";
+import bcrypt from "bcryptjs";
+import Fastify from "fastify";
+import { exposeDomainNormalize } from "./exposeTypes.js";
+/**
+ * Reverse proxy with host-header routing and optional basic auth.
+ * Expects: routes are keyed by normalized domain names.
+ */
+export class ExposeProxy {
+    server = null;
+    routes = new Map();
+    listenPort = null;
+    async start() {
+        if (this.server && this.listenPort !== null) {
+            return { port: this.listenPort };
+        }
+        const server = Fastify({ logger: false });
+        server.removeAllContentTypeParsers();
+        server.addContentTypeParser("*", { parseAs: "buffer" }, (_request, body, done) => {
+            done(null, body);
+        });
+        server.all("*", async (request, reply) => this.routeRequest(request, reply));
+        await server.listen({ host: "127.0.0.1", port: 0 });
+        const address = server.server.address();
+        if (!address || typeof address === "string") {
+            await server.close();
+            throw new Error("Expose proxy failed to resolve listen address.");
+        }
+        this.server = server;
+        this.listenPort = address.port;
+        return { port: address.port };
+    }
+    async stop() {
+        if (!this.server) {
+            return;
+        }
+        await this.server.close();
+        this.server = null;
+        this.listenPort = null;
+    }
+    addRoute(domain, target, passwordHash) {
+        const normalizedDomain = exposeDomainNormalize(domain);
+        this.routes.set(normalizedDomain, {
+            target,
+            passwordHash: passwordHash ?? null
+        });
+    }
+    removeRoute(domain) {
+        const normalizedDomain = exposeDomainNormalize(domain);
+        this.routes.delete(normalizedDomain);
+    }
+    updateRoute(domain, update) {
+        const normalizedDomain = exposeDomainNormalize(domain);
+        const current = this.routes.get(normalizedDomain);
+        if (!current) {
+            throw new Error(`Expose proxy route not found: ${normalizedDomain}`);
+        }
+        this.routes.set(normalizedDomain, {
+            ...current,
+            passwordHash: "passwordHash" in update
+                ? update.passwordHash ?? null
+                : current.passwordHash
+        });
+    }
+    async routeRequest(request, reply) {
+        const host = hostHeaderNormalize(request.headers.host ?? request.hostname ?? "");
+        const route = this.routes.get(host);
+        if (!route) {
+            reply.status(404).send("Expose route not found.");
+            return;
+        }
+        if (route.passwordHash) {
+            const authorized = await authorizationCheck(request.headers.authorization, route.passwordHash);
+            if (!authorized) {
+                reply
+                    .status(401)
+                    .header("WWW-Authenticate", 'Basic realm="daycare"')
+                    .send("Unauthorized");
+                return;
+            }
+        }
+        await this.proxyRequest(request, reply, route.target, route.passwordHash !== null);
+    }
+    async proxyRequest(request, reply, target, stripAuthorizationHeader) {
+        const headers = { ...request.headers };
+        delete headers.connection;
+        if (stripAuthorizationHeader) {
+            delete headers.authorization;
+        }
+        const options = {
+            method: request.raw.method,
+            path: request.raw.url,
+            headers
+        };
+        if (target.type === "port") {
+            options.hostname = "127.0.0.1";
+            options.port = target.port;
+        }
+        else {
+            options.socketPath = target.path;
+        }
+        reply.hijack();
+        await new Promise((resolve) => {
+            let settled = false;
+            const settle = () => {
+                if (settled) {
+                    return;
+                }
+                settled = true;
+                resolve();
+            };
+            const upstreamRequest = http.request(options, (upstreamResponse) => {
+                const statusCode = upstreamResponse.statusCode ?? 502;
+                reply.raw.writeHead(statusCode, upstreamResponse.headers);
+                void pipeline(upstreamResponse, reply.raw)
+                    .catch(() => {
+                    // Socket errors are expected on abrupt disconnects.
+                })
+                    .finally(settle);
+            });
+            upstreamRequest.on("error", () => {
+                if (!reply.raw.headersSent) {
+                    reply.raw.statusCode = 502;
+                    reply.raw.setHeader("content-type", "text/plain; charset=utf-8");
+                    reply.raw.end("Expose upstream unavailable.");
+                }
+                else {
+                    reply.raw.destroy();
+                }
+                settle();
+            });
+            const parsedBody = request.body;
+            if (Buffer.isBuffer(parsedBody)) {
+                if (headers["content-length"] !== undefined) {
+                    upstreamRequest.setHeader("content-length", parsedBody.length);
+                }
+                upstreamRequest.end(parsedBody);
+                return;
+            }
+            void pipeline(request.raw, upstreamRequest).catch(() => {
+                upstreamRequest.destroy();
+            });
+        });
+    }
+}
+function hostHeaderNormalize(value) {
+    const raw = Array.isArray(value) ? (value[0] ?? "") : value;
+    const normalized = raw.trim().toLowerCase();
+    if (!normalized) {
+        return "";
+    }
+    if (normalized.startsWith("[")) {
+        return normalized;
+    }
+    const split = normalized.split(":");
+    return split[0] ?? normalized;
+}
+async function authorizationCheck(authorization, passwordHash) {
+    const value = Array.isArray(authorization)
+        ? (authorization[0] ?? "")
+        : (authorization ?? "");
+    if (!value.startsWith("Basic ")) {
+        return false;
+    }
+    const encoded = value.slice("Basic ".length).trim();
+    if (!encoded) {
+        return false;
+    }
+    let decoded = "";
+    try {
+        decoded = Buffer.from(encoded, "base64").toString("utf8");
+    }
+    catch {
+        return false;
+    }
+    const separatorIndex = decoded.indexOf(":");
+    if (separatorIndex <= 0) {
+        return false;
+    }
+    const username = decoded.slice(0, separatorIndex);
+    const password = decoded.slice(separatorIndex + 1);
+    if (username !== "daycare") {
+        return false;
+    }
+    return bcrypt.compare(password, passwordHash);
+}
+//# sourceMappingURL=exposeProxy.js.map

package/dist/engine/expose/exposeProxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exposeProxy.js","sourceRoot":"","sources":["../../../sources/engine/expose/exposeProxy.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD,OAAO,MAAM,MAAM,UAAU,CAAC;AAC9B,OAAO,OAAyE,MAAM,SAAS,CAAC;AAGhG,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAWzD;;;GAGG;AACH,MAAM,OAAO,WAAW;IACd,MAAM,GAA2B,IAAI,CAAC;IAC7B,MAAM,GAAG,IAAI,GAAG,EAA4B,CAAC;IACtD,UAAU,GAAkB,IAAI,CAAC;IAEzC,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;YAC5C,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;QACnC,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1C,MAAM,CAAC,2BAA2B,EAAE,CAAC;QACrC,MAAM,CAAC,oBAAoB,CACzB,GAAG,EACH,EAAE,OAAO,EAAE,QAAQ,EAAE,EACrB,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YACvB,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACnB,CAAC,CACF,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QAE7E,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACxC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QAED,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;QAC/B,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;IACzB,CAAC;IAED,QAAQ,CAAC,MAAc,EAAE,MAAoB,EAAE,YAAqB;QAClE,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE;YAChC,MAAM;YACN,YAAY,EAAE,YAAY,IAAI,IAAI;SACnC,CAAC,CAAC;IACL,CAAC;IAED,WAAW,CAAC,MAAc;QACxB,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACvC,CAAC;IAED,WAAW,CAAC,MAAc,EAAE,MAA8B;QACxD,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,iCAAiC,gBAAgB,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE;YAChC,GAAG,OAAO;YACV,YAAY,EACV,cAAc,IAAI,MAAM;gBACtB,CAAC,CAAC,MAAM,CAAC,YAAY,IAAI,IAAI;gBAC7B,CAAC,CAAC,OAAO,CAAC,YAAY;SAC3B,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,OAAuB,EACvB,KAAmB;QAEnB,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QACjF,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;YAClD,OAAO;QACT,CAAC;QAED,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,UAAU,GAAG,MAAM,kBAAkB,CACzC,OAAO,CAAC,OAAO,CAAC,aAAa,EAC7B,KAAK,CAAC,YAAY,CACnB,CAAC;YACF,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,KAAK;qBACF,MAAM,CAAC,GAAG,CAAC;qBACX,MAAM,CAAC,kBAAkB,EAAE,uBAAuB,CAAC;qBACnD,IAAI,CAAC,cAAc,CAAC,CAAC;gBACxB,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,IAAI,CAAC,YAAY,CACrB,OAAO,EACP,KAAK,EACL,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,YAAY,KAAK,IAAI,CAC5B,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,OAAuB,EACvB,KAAmB,EACnB,MAAoB,EACpB,wBAAiC;QAEjC,MAAM,OAAO,GAA6B,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;QACjE,OAAO,OAAO,CAAC,UAAU,CAAC;QAC1B,IAAI,wBAAwB,EAAE,CAAC;YAC7B,OAAO,OAAO,CAAC,aAAa,CAAC;QAC/B,CAAC;QAED,MAAM,OAAO,GAAwB;YACnC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM;YAC1B,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG;YACrB,OAAO;SACR,CAAC;QAEF,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC3B,OAAO,CAAC,QAAQ,GAAG,WAAW,CAAC;YAC/B,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC;QACnC,CAAC;QAED,KAAK,CAAC,MAAM,EAAE,CAAC;QAEf,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,MAAM,GAAG,GAAG,EAAE;gBAClB,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO;gBACT,CAAC;gBACD,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC;YAEF,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,gBAAgB,EAAE,EAAE;gBACjE,MAAM,UAAU,GAAG,gBAAgB,CAAC,UAAU,IAAI,GAAG,CAAC;gBACtD,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC;gBAC1D,KAAK,QAAQ,CAAC,gBAAgB,EAAE,KAAK,CAAC,GAAG,CAAC;qBACvC,KAAK,CAAC,GAAG,EAAE;oBACV,oDAAoD;gBACtD,CAAC,CAAC;qBACD,OAAO,CAAC,MAAM,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;YAEH,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBAC/B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBAC3B,KAAK,CAAC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;oBAC3B,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;oBACjE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;gBAChD,CAAC;qBAAM,CAAC;oBACN,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;gBACtB,CAAC;gBACD,MAAM,EAAE,CAAC;YACX,CAAC,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;YAChC,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChC,IAAI,OAAO,CAAC,gBAAgB,CAAC,KAAK,SAAS,EAAE,CAAC;oBAC5C,eAAe,CAAC,SAAS,CAAC,gBAAgB,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;gBACjE,CAAC;gBACD,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBAChC,OAAO;YACT,CAAC;YAED,KAAK,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;gBACrD,eAAe,CAAC,OAAO,EAAE,CAAC;YAC5B,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,SAAS,mBAAmB,CAAC,KAAwB;IACnD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5D,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpC,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,aAA4C,EAC5C,YAAoB;IAEpB,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;QACxC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1B,CAAC,CAAC,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IAC1B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,cAAc,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC;IACnD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;AAChD,CAAC"}

package/dist/engine/expose/exposeProxy.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=exposeProxy.spec.d.ts.map

package/dist/engine/expose/exposeProxy.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exposeProxy.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/expose/exposeProxy.spec.ts"],"names":[],"mappings":""}

package/dist/engine/expose/exposeProxy.spec.js

@@ -0,0 +1,179 @@
+import { mkdtemp, rm } from "node:fs/promises";
+import http from "node:http";
+import os from "node:os";
+import path from "node:path";
+import bcrypt from "bcryptjs";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { ExposeProxy } from "./exposeProxy.js";
+let proxy;
+const cleanup = [];
+beforeEach(() => {
+    proxy = new ExposeProxy();
+});
+afterEach(async () => {
+    await proxy.stop();
+    while (cleanup.length > 0) {
+        const item = cleanup.pop();
+        if (!item) {
+            continue;
+        }
+        await item();
+    }
+});
+describe("ExposeProxy", () => {
+    it("routes by host header to local TCP targets", async () => {
+        const upstream = await serverStart((request, response) => {
+            response.statusCode = 200;
+            response.end(`${request.method}:${request.url}`);
+        });
+        const { port } = await proxy.start();
+        proxy.addRoute("app.example.com", { type: "port", port: upstream.port });
+        const result = await requestRun({
+            port,
+            host: "app.example.com",
+            path: "/health?check=1",
+            method: "POST"
+        });
+        expect(result.statusCode).toBe(200);
+        expect(result.body).toBe("POST:/health?check=1");
+    });
+    it("forwards JSON request bodies", async () => {
+        const upstream = await serverStart((request, response) => {
+            const chunks = [];
+            request.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
+            request.on("end", () => {
+                response.statusCode = 200;
+                response.end(Buffer.concat(chunks).toString("utf8"));
+            });
+        });
+        const { port } = await proxy.start();
+        proxy.addRoute("json.example.com", { type: "port", port: upstream.port });
+        const payload = JSON.stringify({ hello: "world" });
+        const result = await requestRun({
+            port,
+            host: "json.example.com",
+            path: "/echo",
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                "content-length": String(Buffer.byteLength(payload))
+            },
+            body: payload
+        });
+        expect(result.statusCode).toBe(200);
+        expect(result.body).toBe(payload);
+    });
+    it("routes requests to unix socket targets", async () => {
+        const tempDir = await mkdtemp(path.join(os.tmpdir(), "daycare-expose-unix-"));
+        const socketPath = path.join(tempDir, "server.sock");
+        const server = http.createServer((_, response) => {
+            response.statusCode = 200;
+            response.end("unix-ok");
+        });
+        await new Promise((resolve, reject) => {
+            server.once("error", reject);
+            server.listen(socketPath, () => resolve());
+        });
+        cleanup.push(async () => {
+            await new Promise((resolve) => server.close(() => resolve()));
+            await rm(tempDir, { recursive: true, force: true });
+        });
+        const { port } = await proxy.start();
+        proxy.addRoute("unix.example.com", { type: "unix", path: socketPath });
+        const result = await requestRun({
+            port,
+            host: "unix.example.com",
+            path: "/"
+        });
+        expect(result.statusCode).toBe(200);
+        expect(result.body).toBe("unix-ok");
+    });
+    it("enforces basic auth when configured", async () => {
+        const upstream = await serverStart((request, response) => {
+            response.statusCode = 200;
+            response.end(String(request.headers.authorization ?? "none"));
+        });
+        const passwordHash = await bcrypt.hash("secret", 10);
+        const { port } = await proxy.start();
+        proxy.addRoute("auth.example.com", { type: "port", port: upstream.port }, passwordHash);
+        const noAuth = await requestRun({
+            port,
+            host: "auth.example.com",
+            path: "/"
+        });
+        expect(noAuth.statusCode).toBe(401);
+        expect(noAuth.headers["www-authenticate"]).toBe('Basic realm="daycare"');
+        const wrongAuth = await requestRun({
+            port,
+            host: "auth.example.com",
+            path: "/",
+            headers: {
+                authorization: `Basic ${Buffer.from("daycare:wrong").toString("base64")}`
+            }
+        });
+        expect(wrongAuth.statusCode).toBe(401);
+        const validAuth = await requestRun({
+            port,
+            host: "auth.example.com",
+            path: "/",
+            headers: {
+                authorization: `Basic ${Buffer.from("daycare:secret").toString("base64")}`
+            }
+        });
+        expect(validAuth.statusCode).toBe(200);
+        expect(validAuth.body).toBe("none");
+        proxy.updateRoute("auth.example.com", { passwordHash: null });
+        const afterDisable = await requestRun({
+            port,
+            host: "auth.example.com",
+            path: "/",
+            headers: {
+                authorization: "Bearer local-service-token"
+            }
+        });
+        expect(afterDisable.statusCode).toBe(200);
+        expect(afterDisable.body).toBe("Bearer local-service-token");
+    });
+});
+async function serverStart(handler) {
+    const server = http.createServer(handler);
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(0, "127.0.0.1", () => resolve());
+    });
+    cleanup.push(async () => {
+        await new Promise((resolve) => server.close(() => resolve()));
+    });
+    const address = server.address();
+    if (!address || typeof address === "string") {
+        throw new Error("Failed to resolve upstream address");
+    }
+    return { port: address.port };
+}
+async function requestRun(options) {
+    return new Promise((resolve, reject) => {
+        const request = http.request({
+            hostname: "127.0.0.1",
+            port: options.port,
+            path: options.path,
+            method: options.method ?? "GET",
+            headers: {
+                host: options.host,
+                ...(options.headers ?? {})
+            }
+        }, (response) => {
+            const chunks = [];
+            response.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
+            response.on("end", () => {
+                resolve({
+                    statusCode: response.statusCode ?? 0,
+                    body: Buffer.concat(chunks).toString("utf8"),
+                    headers: response.headers
+                });
+            });
+        });
+        request.on("error", reject);
+        request.end(options.body ?? "");
+    });
+}
+//# sourceMappingURL=exposeProxy.spec.js.map

package/dist/engine/expose/exposeProxy.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exposeProxy.spec.js","sourceRoot":"","sources":["../../../sources/engine/expose/exposeProxy.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,MAAM,MAAM,UAAU,CAAC;AAC9B,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAErE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,IAAI,KAAkB,CAAC;AACvB,MAAM,OAAO,GAA+B,EAAE,CAAC;AAE/C,UAAU,CAAC,GAAG,EAAE;IACd,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC;AAC5B,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;IACnB,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,MAAM,IAAI,EAAE,CAAC;IACf,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;YACvD,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;YAC1B,QAAQ,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;QAEH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;QACrC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAEzE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC;YAC9B,IAAI;YACJ,IAAI,EAAE,iBAAiB;YACvB,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;YACvD,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC/D,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACrB,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;gBAC1B,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACvD,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;QACrC,KAAK,CAAC,QAAQ,CAAC,kBAAkB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAE1E,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC;YAC9B,IAAI;YACJ,IAAI,EAAE,kBAAkB;YACxB,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;aACrD;YACD,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;QAC9E,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE;YAC/C,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;YAC1B,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC7B,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YACtB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACpE,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QAEH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;QACrC,KAAK,CAAC,QAAQ,CAAC,kBAAkB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAEvE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC;YAC9B,IAAI;YACJ,IAAI,EAAE,kBAAkB;YACxB,IAAI,EAAE,GAAG;SACV,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;YACvD,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;YAC1B,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,IAAI,MAAM,CAAC,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACrD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;QACrC,KAAK,CAAC,QAAQ,CAAC,kBAAkB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,YAAY,CAAC,CAAC;QAExF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC;YAC9B,IAAI;YACJ,IAAI,EAAE,kBAAkB;YACxB,IAAI,EAAE,GAAG;SACV,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QAEzE,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC;YACjC,IAAI;YACJ,IAAI,EAAE,kBAAkB;YACxB,IAAI,EAAE,GAAG;YACT,OAAO,EAAE;gBACP,aAAa,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;aAC1E;SACF,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEvC,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC;YACjC,IAAI;YACJ,IAAI,EAAE,kBAAkB;YACxB,IAAI,EAAE,GAAG;YACT,OAAO,EAAE;gBACP,aAAa,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;aAC3E;SACF,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAEpC,KAAK,CAAC,WAAW,CAAC,kBAAkB,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC;YACpC,IAAI;YACJ,IAAI,EAAE,kBAAkB;YACxB,IAAI,EAAE,GAAG;YACT,OAAO,EAAE;gBACP,aAAa,EAAE,4BAA4B;aAC5C;SACF,CAAC,CAAC;QACH,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,WAAW,CACxB,OAGS;IAET,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;QACtB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,OAOzB;IACC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAC1B;YACE,QAAQ,EAAE,WAAW;YACrB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,KAAK;YAC/B,OAAO,EAAE;gBACP,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;aAC3B;SACF,EACD,CAAC,QAAQ,EAAE,EAAE;YACX,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAChE,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACtB,OAAO,CAAC;oBACN,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,CAAC;oBACpC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAC5C,OAAO,EAAE,QAAQ,CAAC,OAAO;iBAC1B,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CACF,CAAC;QAEF,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/engine/expose/exposeTypes.d.ts

@@ -0,0 +1,89 @@
+export type ExposeTarget = {
+    type: "port";
+    port: number;
+} | {
+    type: "unix";
+    path: string;
+};
+export type ExposeMode = "public" | "local-network";
+export type ExposeEndpointAuth = {
+    enabled: true;
+    passwordHash: string;
+};
+export type ExposeEndpoint = {
+    id: string;
+    target: ExposeTarget;
+    provider: string;
+    domain: string;
+    mode: ExposeMode;
+    auth: ExposeEndpointAuth | null;
+    createdAt: number;
+    updatedAt: number;
+};
+export type ExposeTunnelProvider = {
+    instanceId: string;
+    domain: string;
+    capabilities: {
+        public: boolean;
+        localNetwork: boolean;
+    };
+    createTunnel: (proxyPort: number, mode: ExposeMode) => Promise<{
+        domain: string;
+    }>;
+    destroyTunnel: (domain: string) => Promise<void>;
+};
+export type ExposeCreateInput = {
+    target: ExposeTarget;
+    provider?: string;
+    mode: ExposeMode;
+    authenticated: boolean;
+};
+export type ExposeUpdateInput = {
+    authenticated: boolean;
+};
+export type ExposeProviderRegistrationApi = {
+    registerProvider: (provider: ExposeTunnelProvider) => Promise<void>;
+    unregisterProvider: (instanceId: string) => Promise<void>;
+    listProviders: () => Array<{
+        instanceId: string;
+        domain: string;
+        capabilities: {
+            public: boolean;
+            localNetwork: boolean;
+        };
+    }>;
+};
+/**
+ * Validates and normalizes an expose target payload.
+ * Expects: value is either a port target or unix socket target.
+ */
+export declare function exposeTargetParse(value: unknown): ExposeTarget;
+/**
+ * Validates and normalizes expose create arguments.
+ * Expects: mode and target are provided.
+ */
+export declare function exposeCreateInputParse(value: unknown): ExposeCreateInput;
+/**
+ * Validates expose update arguments.
+ * Expects: authenticated boolean is present.
+ */
+export declare function exposeUpdateInputParse(value: unknown): ExposeUpdateInput;
+/**
+ * Validates a persisted endpoint object.
+ * Expects: timestamps are unix milliseconds.
+ */
+export declare function exposeEndpointParse(value: unknown): ExposeEndpoint;
+/**
+ * Normalizes and validates a DNS host value.
+ * Expects: domain is a fully-qualified hostname.
+ */
+export declare function exposeDomainNormalize(domain: string): string;
+/**
+ * Validates that a mode is supported by provider capabilities.
+ * Expects: provider capability flags are explicit booleans.
+ */
+export declare function exposeModeSupported(mode: ExposeMode, capabilities: {
+    public: boolean;
+    localNetwork: boolean;
+}): boolean;
+//# sourceMappingURL=exposeTypes.d.ts.map

package/dist/engine/expose/exposeTypes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exposeTypes.d.ts","sourceRoot":"","sources":["../../../sources/engine/expose/exposeTypes.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,YAAY,GACpB;IACE,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,GACD;IACE,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEN,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,eAAe,CAAC;AAEpD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,IAAI,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,YAAY,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE;QACZ,MAAM,EAAE,OAAO,CAAC;QAChB,YAAY,EAAE,OAAO,CAAC;KACvB,CAAC;IACF,YAAY,EAAE,CACZ,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,UAAU,KACb,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjC,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,EAAE,YAAY,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,UAAU,CAAC;IACjB,aAAa,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,aAAa,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,gBAAgB,EAAE,CAAC,QAAQ,EAAE,oBAAoB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE,kBAAkB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,aAAa,EAAE,MAAM,KAAK,CAAC;QACzB,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;QACf,YAAY,EAAE;YACZ,MAAM,EAAE,OAAO,CAAC;YAChB,YAAY,EAAE,OAAO,CAAC;SACvB,CAAC;KACH,CAAC,CAAC;CACJ,CAAC;AAqDF;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,CAE9D;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB,CAMxE;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB,CAExE;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,CAMlE;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAM5D;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,UAAU,EAChB,YAAY,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,OAAO,CAAA;CAAE,GACvD,OAAO,CAKT"}

package/dist/engine/expose/exposeTypes.js

@@ -0,0 +1,106 @@
+import { z } from "zod";
+const EXPOSE_DOMAIN_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+$/;
+const exposeTargetSchema = z.discriminatedUnion("type", [
+    z
+        .object({
+        type: z.literal("port"),
+        port: z.number().int().min(1).max(65535)
+    })
+        .strict(),
+    z
+        .object({
+        type: z.literal("unix"),
+        path: z.string().trim().min(1)
+    })
+        .strict()
+]);
+const exposeModeSchema = z.union([z.literal("public"), z.literal("local-network")]);
+const exposeCreateInputSchema = z
+    .object({
+    target: exposeTargetSchema,
+    provider: z.string().trim().min(1).optional(),
+    mode: exposeModeSchema,
+    authenticated: z.boolean()
+})
+    .strict();
+const exposeUpdateInputSchema = z
+    .object({
+    authenticated: z.boolean()
+})
+    .strict();
+const exposeEndpointSchema = z
+    .object({
+    id: z.string().trim().min(1),
+    target: exposeTargetSchema,
+    provider: z.string().trim().min(1),
+    domain: z.string().trim().min(1),
+    mode: exposeModeSchema,
+    auth: z
+        .object({
+        enabled: z.literal(true),
+        passwordHash: z.string().trim().min(1)
+    })
+        .strict()
+        .nullable(),
+    createdAt: z.number().int().nonnegative(),
+    updatedAt: z.number().int().nonnegative()
+})
+    .strict();
+/**
+ * Validates and normalizes an expose target payload.
+ * Expects: value is either a port target or unix socket target.
+ */
+export function exposeTargetParse(value) {
+    return exposeTargetSchema.parse(value);
+}
+/**
+ * Validates and normalizes expose create arguments.
+ * Expects: mode and target are provided.
+ */
+export function exposeCreateInputParse(value) {
+    const parsed = exposeCreateInputSchema.parse(value);
+    return {
+        ...parsed,
+        provider: parsed.provider?.trim()
+    };
+}
+/**
+ * Validates expose update arguments.
+ * Expects: authenticated boolean is present.
+ */
+export function exposeUpdateInputParse(value) {
+    return exposeUpdateInputSchema.parse(value);
+}
+/**
+ * Validates a persisted endpoint object.
+ * Expects: timestamps are unix milliseconds.
+ */
+export function exposeEndpointParse(value) {
+    const parsed = exposeEndpointSchema.parse(value);
+    return {
+        ...parsed,
+        domain: exposeDomainNormalize(parsed.domain)
+    };
+}
+/**
+ * Normalizes and validates a DNS host value.
+ * Expects: domain is a fully-qualified hostname.
+ */
+export function exposeDomainNormalize(domain) {
+    const normalized = domain.trim().toLowerCase();
+    if (!EXPOSE_DOMAIN_PATTERN.test(normalized)) {
+        throw new Error(`Invalid expose domain: ${domain}`);
+    }
+    return normalized;
+}
+/**
+ * Validates that a mode is supported by provider capabilities.
+ * Expects: provider capability flags are explicit booleans.
+ */
+export function exposeModeSupported(mode, capabilities) {
+    if (mode === "public") {
+        return capabilities.public;
+    }
+    return capabilities.localNetwork;
+}
+//# sourceMappingURL=exposeTypes.js.map

package/dist/engine/expose/exposeTypes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exposeTypes.js","sourceRoot":"","sources":["../../../sources/engine/expose/exposeTypes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,qBAAqB,GAAG,mFAAmF,CAAC;AAoElH,MAAM,kBAAkB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACtD,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;KACzC,CAAC;SACD,MAAM,EAAE;IACX,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC/B,CAAC;SACD,MAAM,EAAE;CACZ,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;AAEpF,MAAM,uBAAuB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,MAAM,EAAE,kBAAkB;IAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC7C,IAAI,EAAE,gBAAgB;IACtB,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,uBAAuB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,oBAAoB,GAAG,CAAC;KAC3B,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,MAAM,EAAE,kBAAkB;IAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,IAAI,EAAE,gBAAgB;IACtB,IAAI,EAAE,CAAC;SACJ,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACxB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACvC,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,EAAE;IACb,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACzC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CAC1C,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,OAAO,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAiB,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,MAAM,MAAM,GAAG,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAsB,CAAC;IACzE,OAAO;QACL,GAAG,MAAM;QACT,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE;KAClC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,OAAO,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAsB,CAAC;AACnE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAmB,CAAC;IACnE,OAAO;QACL,GAAG,MAAM;QACT,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAgB,EAChB,YAAwD;IAExD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,YAAY,CAAC,MAAM,CAAC;IAC7B,CAAC;IACD,OAAO,YAAY,CAAC,YAAY,CAAC;AACnC,CAAC"}

package/dist/engine/expose/exposeTypes.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=exposeTypes.spec.d.ts.map

package/dist/engine/expose/exposeTypes.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exposeTypes.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/expose/exposeTypes.spec.ts"],"names":[],"mappings":""}