farming-code 2.2.30 → 2.2.32

package/backend/farming-net-pass.js

@@ -1,285 +0,0 @@
-const crypto = require('crypto');
-const fs = require('fs');
-const path = require('path');
-
-const PASS_QUERY_PARAM = 'farming_net_pass';
-const PASS_SCOPE = 'farming:open';
-const DEFAULT_PASS_TTL_SECONDS = 30;
-const MAX_PASS_TTL_SECONDS = 60;
-const CLOCK_SKEW_SECONDS = 5;
-
-function normalizeAudience(value) {
-  const audience = String(value || '').trim().toLowerCase();
-  if (!/^[a-z0-9][a-z0-9._-]{0,63}$/.test(audience)) {
-    throw new Error('Invalid Farming Net audience');
-  }
-  return audience;
-}
-
-function normalizeIssuerId(value) {
-  const issuerId = String(value || '').trim();
-  if (!/^[A-Za-z0-9_-]{8,80}$/.test(issuerId)) {
-    throw new Error('Invalid Farming Net issuer id');
-  }
-  return issuerId;
-}
-
-function normalizeSubject(value) {
-  const subject = String(value || 'owner').trim();
-  if (!subject || subject.length > 80 || /[\x00-\x1f\x7f]/.test(subject)) {
-    throw new Error('Invalid Farming Net subject');
-  }
-  return subject;
-}
-
-function safeTtlSeconds(value) {
-  const ttl = Number(value);
-  if (!Number.isInteger(ttl)) return DEFAULT_PASS_TTL_SECONDS;
-  return Math.min(MAX_PASS_TTL_SECONDS, Math.max(5, ttl));
-}
-
-function publicKeyDetails(publicKeyPem) {
-  const publicKey = publicKeyPem && typeof publicKeyPem === 'object' && publicKeyPem.type === 'public'
-    ? publicKeyPem
-    : crypto.createPublicKey(String(publicKeyPem || ''));
-  if (publicKey.asymmetricKeyType !== 'ed25519') {
-    throw new Error('Farming Net requires an Ed25519 public key');
-  }
-  const canonicalPem = publicKey.export({ format: 'pem', type: 'spki' }).toString();
-  const der = publicKey.export({ format: 'der', type: 'spki' });
-  const issuer = `fnet_${crypto.createHash('sha256').update(der).digest('base64url').slice(0, 24)}`;
-  return { canonicalPem, issuer, publicKey };
-}
-
-function privateKeyDetails(privateKeyPem) {
-  const privateKey = crypto.createPrivateKey(String(privateKeyPem || ''));
-  if (privateKey.asymmetricKeyType !== 'ed25519') {
-    throw new Error('Farming Net requires an Ed25519 private key');
-  }
-  const canonicalPem = privateKey.export({ format: 'pem', type: 'pkcs8' }).toString();
-  const publicDetails = publicKeyDetails(crypto.createPublicKey(privateKey));
-  return { canonicalPem, privateKey, publicDetails };
-}
-
-function writePrivateFile(filePath, contents) {
-  fs.mkdirSync(path.dirname(filePath), { recursive: true });
-  const tempFile = `${filePath}.${process.pid}.${crypto.randomBytes(6).toString('hex')}.tmp`;
-  fs.writeFileSync(tempFile, contents, { flag: 'wx', mode: 0o600 });
-  try {
-    fs.renameSync(tempFile, filePath);
-    fs.chmodSync(filePath, 0o600);
-  } finally {
-    try {
-      fs.unlinkSync(tempFile);
-    } catch {
-      // The rename already consumed the temporary file.
-    }
-  }
-}
-
-function loadOrCreateFarmingNetSigningIdentity(options = {}) {
-  const privateKeyFile = options.privateKeyFile;
-  const publicKeyFile = options.publicKeyFile;
-  if (!privateKeyFile || !publicKeyFile) {
-    throw new Error('Farming Net signing key paths are required');
-  }
-
-  let privateKeyPem = '';
-  try {
-    privateKeyPem = fs.readFileSync(privateKeyFile, 'utf8');
-  } catch (error) {
-    if (!error || error.code !== 'ENOENT') throw error;
-    const generated = crypto.generateKeyPairSync('ed25519');
-    const generatedPem = generated.privateKey.export({ format: 'pem', type: 'pkcs8' }).toString();
-    try {
-      fs.mkdirSync(path.dirname(privateKeyFile), { recursive: true });
-      fs.writeFileSync(privateKeyFile, generatedPem, { flag: 'wx', mode: 0o600 });
-      privateKeyPem = generatedPem;
-    } catch (writeError) {
-      if (!writeError || writeError.code !== 'EEXIST') throw writeError;
-      privateKeyPem = fs.readFileSync(privateKeyFile, 'utf8');
-    }
-  }
-
-  const details = privateKeyDetails(privateKeyPem);
-  fs.chmodSync(privateKeyFile, 0o600);
-  writePrivateFile(publicKeyFile, details.publicDetails.canonicalPem);
-  return {
-    issuer: details.publicDetails.issuer,
-    privateKey: details.privateKey,
-    privateKeyFile,
-    publicKey: details.publicDetails.publicKey,
-    publicKeyFile,
-    publicKeyPem: details.publicDetails.canonicalPem,
-  };
-}
-
-function encodeJsonSegment(value) {
-  return Buffer.from(JSON.stringify(value), 'utf8').toString('base64url');
-}
-
-function decodeJsonSegment(segment) {
-  if (typeof segment !== 'string' || segment.length < 2 || segment.length > 2048) {
-    throw new Error('Invalid Farming Net pass segment');
-  }
-  if (!/^[A-Za-z0-9_-]+$/.test(segment)) {
-    throw new Error('Invalid Farming Net pass encoding');
-  }
-  const parsed = JSON.parse(Buffer.from(segment, 'base64url').toString('utf8'));
-  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
-    throw new Error('Invalid Farming Net pass JSON');
-  }
-  return parsed;
-}
-
-function createFarmingNetPass(identity, options = {}) {
-  if (!identity || !identity.privateKey || !identity.issuer) {
-    throw new Error('Farming Net signing identity is required');
-  }
-  const audience = normalizeAudience(options.audience);
-  const subject = normalizeSubject(options.subject);
-  const nowSeconds = Math.floor(Number(options.nowMs ?? Date.now()) / 1000);
-  if (!Number.isSafeInteger(nowSeconds) || nowSeconds <= 0) {
-    throw new Error('Invalid Farming Net pass time');
-  }
-  const ttlSeconds = safeTtlSeconds(options.ttlSeconds);
-  const header = {
-    alg: 'EdDSA',
-    kid: normalizeIssuerId(identity.issuer),
-    typ: 'FarmingNetPass',
-  };
-  const payload = {
-    aud: audience,
-    exp: nowSeconds + ttlSeconds,
-    iat: nowSeconds,
-    iss: header.kid,
-    jti: crypto.randomBytes(18).toString('base64url'),
-    scope: PASS_SCOPE,
-    sub: subject,
-  };
-  const signingInput = `${encodeJsonSegment(header)}.${encodeJsonSegment(payload)}`;
-  const signature = crypto.sign(null, Buffer.from(signingInput, 'ascii'), identity.privateKey);
-  return `${signingInput}.${signature.toString('base64url')}`;
-}
-
-function normalizeFarmingNetTrust(rawTrust) {
-  if (!rawTrust || typeof rawTrust !== 'object' || Array.isArray(rawTrust)) {
-    throw new Error('Invalid Farming Net trust document');
-  }
-  const audience = normalizeAudience(rawTrust.audience);
-  const seenIssuers = new Set();
-  const issuers = (Array.isArray(rawTrust.issuers) ? rawTrust.issuers : []).map(rawIssuer => {
-    if (!rawIssuer || typeof rawIssuer !== 'object' || Array.isArray(rawIssuer)) {
-      throw new Error('Invalid Farming Net trusted issuer');
-    }
-    const id = normalizeIssuerId(rawIssuer.id);
-    const details = publicKeyDetails(rawIssuer.publicKey);
-    if (details.issuer !== id) {
-      throw new Error('Farming Net trusted issuer id does not match its public key');
-    }
-    if (seenIssuers.has(id)) throw new Error('Duplicate Farming Net trusted issuer');
-    seenIssuers.add(id);
-    return {
-      id,
-      name: String(rawIssuer.name || '').trim().slice(0, 80),
-      publicKey: details.canonicalPem,
-    };
-  });
-  if (issuers.length === 0 || issuers.length > 16) {
-    throw new Error('Farming Net trust requires between 1 and 16 issuers');
-  }
-  return { version: 1, audience, issuers };
-}
-
-function writeFarmingNetTrust(filePath, trust) {
-  const normalized = normalizeFarmingNetTrust(trust);
-  writePrivateFile(filePath, `${JSON.stringify(normalized, null, 2)}\n`);
-  return normalized;
-}
-
-function loadFarmingNetTrust(filePath) {
-  try {
-    return normalizeFarmingNetTrust(JSON.parse(fs.readFileSync(filePath, 'utf8')));
-  } catch (error) {
-    if (error && error.code === 'ENOENT') return null;
-    throw error;
-  }
-}
-
-class FarmingNetPassVerifier {
-  constructor(options = {}) {
-    this.trustFile = String(options.trustFile || '');
-    this.seenPasses = new Map();
-  }
-
-  verify(pass, options = {}) {
-    try {
-      if (!this.trustFile) return { valid: false, reason: 'trust_not_configured' };
-      const trust = loadFarmingNetTrust(this.trustFile);
-      if (!trust) return { valid: false, reason: 'trust_not_configured' };
-      if (typeof pass !== 'string' || pass.length < 32 || pass.length > 4096) {
-        return { valid: false, reason: 'invalid_pass' };
-      }
-      const segments = pass.split('.');
-      if (segments.length !== 3 || !/^[A-Za-z0-9_-]+$/.test(segments[2])) {
-        return { valid: false, reason: 'invalid_pass' };
-      }
-      const header = decodeJsonSegment(segments[0]);
-      const payload = decodeJsonSegment(segments[1]);
-      if (header.alg !== 'EdDSA' || header.typ !== 'FarmingNetPass') {
-        return { valid: false, reason: 'invalid_header' };
-      }
-      const issuerId = normalizeIssuerId(header.kid);
-      const issuer = trust.issuers.find(item => item.id === issuerId);
-      if (!issuer || payload.iss !== issuerId) return { valid: false, reason: 'untrusted_issuer' };
-      if (payload.aud !== trust.audience) return { valid: false, reason: 'wrong_audience' };
-      if (payload.scope !== PASS_SCOPE) return { valid: false, reason: 'wrong_scope' };
-      normalizeSubject(payload.sub);
-      if (!Number.isSafeInteger(payload.iat) || !Number.isSafeInteger(payload.exp)) {
-        return { valid: false, reason: 'invalid_time' };
-      }
-      if (payload.exp <= payload.iat || payload.exp - payload.iat > MAX_PASS_TTL_SECONDS) {
-        return { valid: false, reason: 'invalid_lifetime' };
-      }
-      const nowSeconds = Math.floor(Number(options.nowMs ?? Date.now()) / 1000);
-      if (!Number.isSafeInteger(nowSeconds) || nowSeconds < payload.iat - CLOCK_SKEW_SECONDS) {
-        return { valid: false, reason: 'not_yet_valid' };
-      }
-      if (nowSeconds >= payload.exp) return { valid: false, reason: 'expired' };
-      if (typeof payload.jti !== 'string' || !/^[A-Za-z0-9_-]{16,128}$/.test(payload.jti)) {
-        return { valid: false, reason: 'invalid_jti' };
-      }
-
-      const publicKey = publicKeyDetails(issuer.publicKey).publicKey;
-      const signature = Buffer.from(segments[2], 'base64url');
-      const signingInput = Buffer.from(`${segments[0]}.${segments[1]}`, 'ascii');
-      if (!crypto.verify(null, signingInput, publicKey, signature)) {
-        return { valid: false, reason: 'invalid_signature' };
-      }
-
-      for (const [key, expiresAt] of this.seenPasses) {
-        if (expiresAt <= nowSeconds) this.seenPasses.delete(key);
-      }
-      const replayKey = `${issuerId}:${payload.jti}`;
-      if (this.seenPasses.has(replayKey)) return { valid: false, reason: 'replayed' };
-      this.seenPasses.set(replayKey, payload.exp);
-      return { valid: true, payload };
-    } catch {
-      return { valid: false, reason: 'invalid_pass' };
-    }
-  }
-}
-
-module.exports = {
-  CLOCK_SKEW_SECONDS,
-  DEFAULT_PASS_TTL_SECONDS,
-  FarmingNetPassVerifier,
-  MAX_PASS_TTL_SECONDS,
-  PASS_QUERY_PARAM,
-  PASS_SCOPE,
-  createFarmingNetPass,
-  loadFarmingNetTrust,
-  loadOrCreateFarmingNetSigningIdentity,
-  normalizeFarmingNetTrust,
-  writeFarmingNetTrust,
-};

package/backend/farming-net-registry.js

@@ -1,112 +0,0 @@
-const fs = require('fs');
-const path = require('path');
-
-const ENDPOINT_SCOPES = new Set(['this-device', 'intranet', 'remote', 'tunnel']);
-
-function boundedText(value, maxLength) {
-  return String(value || '').trim().slice(0, maxLength);
-}
-
-function normalizeEndpointUrl(value) {
-  try {
-    const url = new URL(String(value || '').trim());
-    if (!['http:', 'https:'].includes(url.protocol)) return '';
-    if (url.username || url.password) return '';
-    url.search = '';
-    url.hash = '';
-    return url.toString();
-  } catch {
-    return '';
-  }
-}
-
-function normalizeEndpoint(rawEndpoint) {
-  if (!rawEndpoint || typeof rawEndpoint !== 'object' || Array.isArray(rawEndpoint)) return null;
-  const url = normalizeEndpointUrl(rawEndpoint.url);
-  if (!url) return null;
-  const scope = ENDPOINT_SCOPES.has(rawEndpoint.scope) ? rawEndpoint.scope : 'remote';
-  return {
-    label: boundedText(rawEndpoint.label, 40) || 'Open',
-    url,
-    scope,
-    primary: rawEndpoint.primary === true,
-  };
-}
-
-function normalizeInstance(rawInstance) {
-  if (!rawInstance || typeof rawInstance !== 'object' || Array.isArray(rawInstance)) return null;
-  const id = boundedText(rawInstance.id, 64).toLowerCase();
-  const name = boundedText(rawInstance.name, 80);
-  if (!/^[a-z0-9][a-z0-9._-]*$/.test(id) || !name) return null;
-
-  const seenUrls = new Set();
-  const endpoints = (Array.isArray(rawInstance.endpoints) ? rawInstance.endpoints : [])
-    .map(normalizeEndpoint)
-    .filter(Boolean)
-    .filter(endpoint => {
-      if (seenUrls.has(endpoint.url)) return false;
-      seenUrls.add(endpoint.url);
-      return true;
-    })
-    .slice(0, 8);
-  if (endpoints.length === 0) return null;
-  if (!endpoints.some(endpoint => endpoint.primary)) endpoints[0].primary = true;
-
-  return {
-    id,
-    name,
-    owner: boundedText(rawInstance.owner, 80),
-    description: boundedText(rawInstance.description, 180),
-    federated: rawInstance.federated === true,
-    platform: boundedText(rawInstance.platform, 40),
-    pinned: rawInstance.pinned === true,
-    endpoints,
-  };
-}
-
-function normalizeFarmingNetRegistry(rawRegistry) {
-  const source = rawRegistry && typeof rawRegistry === 'object' && !Array.isArray(rawRegistry)
-    ? rawRegistry
-    : {};
-  const seenIds = new Set();
-  const instances = (Array.isArray(source.instances) ? source.instances : [])
-    .map(normalizeInstance)
-    .filter(Boolean)
-    .filter(instance => {
-      if (seenIds.has(instance.id)) return false;
-      seenIds.add(instance.id);
-      return true;
-    })
-    .slice(0, 200);
-
-  return {
-    version: 1,
-    title: boundedText(source.title, 80) || 'Farming Net',
-    subtitle: boundedText(source.subtitle, 160),
-    instances,
-  };
-}
-
-function writeFarmingNetRegistry(filePath, registry) {
-  const normalized = normalizeFarmingNetRegistry(registry);
-  fs.mkdirSync(path.dirname(filePath), { recursive: true });
-  fs.writeFileSync(filePath, `${JSON.stringify(normalized, null, 2)}\n`, { mode: 0o600 });
-  return normalized;
-}
-
-function loadFarmingNetRegistry(filePath) {
-  try {
-    return normalizeFarmingNetRegistry(JSON.parse(fs.readFileSync(filePath, 'utf8')));
-  } catch (error) {
-    if (error && error.code !== 'ENOENT') throw error;
-    return writeFarmingNetRegistry(filePath, { version: 1, title: 'Farming Net', instances: [] });
-  }
-}
-
-module.exports = {
-  ENDPOINT_SCOPES,
-  loadFarmingNetRegistry,
-  normalizeEndpointUrl,
-  normalizeFarmingNetRegistry,
-  writeFarmingNetRegistry,
-};

package/backend/farming-net-server.js

@@ -1,298 +0,0 @@
-#!/usr/bin/env node
-
-const fs = require('fs');
-const http = require('http');
-const os = require('os');
-const path = require('path');
-const TokenAuth = require('./auth');
-const {
-  createFarmingNetPass,
-  loadOrCreateFarmingNetSigningIdentity,
-  PASS_QUERY_PARAM,
-} = require('./farming-net-pass');
-const { loadFarmingNetRegistry } = require('./farming-net-registry');
-const storageLayout = require('./storage-layout');
-
-const DEFAULT_PORT = 6693;
-const DEFAULT_BASE_PATH = '/farming-net';
-
-function normalizeBasePath(basePath) {
-  const value = String(basePath || '').trim();
-  if (!value || value === '/') return '';
-  const normalized = value.startsWith('/') ? value : `/${value}`;
-  return normalized.endsWith('/') ? normalized.slice(0, -1) : normalized;
-}
-
-function isTruthy(value) {
-  return ['1', 'true', 'yes', 'on'].includes(String(value || '').toLowerCase());
-}
-
-function safePort(value, fallback = DEFAULT_PORT) {
-  const port = Number(value);
-  return Number.isInteger(port) && port > 0 && port <= 65535 ? port : fallback;
-}
-
-function loadPackageVersion(projectRoot) {
-  try {
-    return String(JSON.parse(fs.readFileSync(path.join(projectRoot, 'package.json'), 'utf8')).version || 'dev');
-  } catch {
-    return 'dev';
-  }
-}
-
-function setSecurityHeaders(res) {
-  res.setHeader('Content-Security-Policy', [
-    "default-src 'self'",
-    "connect-src 'self' http: https:",
-    "img-src 'self' data:",
-    "style-src 'self'",
-    "script-src 'self'",
-    "base-uri 'none'",
-    "frame-ancestors 'none'",
-    "form-action 'self'",
-  ].join('; '));
-  res.setHeader('Cross-Origin-Opener-Policy', 'same-origin-allow-popups');
-  res.setHeader('Referrer-Policy', 'no-referrer');
-  res.setHeader('X-Content-Type-Options', 'nosniff');
-  res.setHeader('X-Frame-Options', 'DENY');
-}
-
-function sendBuffer(req, res, statusCode, body, contentType, cacheControl = 'no-store') {
-  const buffer = Buffer.isBuffer(body) ? body : Buffer.from(String(body));
-  res.writeHead(statusCode, {
-    'Cache-Control': cacheControl,
-    'Content-Length': buffer.length,
-    'Content-Type': contentType,
-  });
-  if (req.method === 'HEAD') res.end();
-  else res.end(buffer);
-}
-
-function sendJson(req, res, statusCode, payload) {
-  sendBuffer(req, res, statusCode, `${JSON.stringify(payload)}\n`, 'application/json; charset=utf-8');
-}
-
-function readAsset(filePath) {
-  try {
-    return fs.readFileSync(filePath);
-  } catch {
-    return null;
-  }
-}
-
-function browserRegistry(registry, basePath) {
-  return {
-    ...registry,
-    instances: registry.instances.map(instance => ({
-      ...instance,
-      endpoints: instance.endpoints.map((endpoint, index) => ({
-        ...endpoint,
-        launchUrl: instance.federated
-          ? `${basePath}/open/${encodeURIComponent(instance.id)}/${index}`
-          : endpoint.url,
-      })),
-    })),
-  };
-}
-
-function createFarmingNetServer(options = {}) {
-  const env = options.env || process.env;
-  const projectRoot = options.projectRoot || path.resolve(__dirname, '..');
-  const basePath = normalizeBasePath(options.basePath ?? env.FARMING_NET_BASE_PATH ?? DEFAULT_BASE_PATH);
-  const configDir = options.configDir
-    || env.FARMING_NET_CONFIG_DIR
-    || path.join(env.HOME || os.homedir(), '.farming-net');
-  const assetDir = options.assetDir || path.join(projectRoot, 'frontend', 'farming-net');
-  const registryFile = options.registryFile || storageLayout.farmingNetInstancesFile(configDir);
-  const stateFile = options.stateFile || storageLayout.farmingNetServerStateFile(configDir);
-  const packageVersion = options.packageVersion || loadPackageVersion(projectRoot);
-  const iconCandidates = [
-    options.iconFile,
-    path.join(projectRoot, 'public', 'farming-2', 'app-icon-v2-180.png'),
-    path.join(projectRoot, 'dist', 'farming-2', 'app-icon-v2-180.png'),
-  ].filter(Boolean);
-  const iconFile = iconCandidates.find(candidate => fs.existsSync(candidate)) || '';
-  fs.mkdirSync(configDir, { recursive: true });
-  loadFarmingNetRegistry(registryFile);
-  const signingIdentity = options.signingIdentity || loadOrCreateFarmingNetSigningIdentity({
-    privateKeyFile: storageLayout.farmingNetSigningPrivateKeyFile(configDir),
-    publicKeyFile: storageLayout.farmingNetSigningPublicKeyFile(configDir),
-  });
-
-  const authEnv = {
-    ...env,
-    FARMING_DISABLE_AUTH: env.FARMING_NET_DISABLE_AUTH || '',
-    FARMING_TOKEN: env.FARMING_NET_TOKEN || '',
-  };
-  const tokenAuth = options.tokenAuth || new TokenAuth({
-    basePath: basePath || '/',
-    cookieName: 'farming_net_token',
-    cookiePath: basePath || '/',
-    disabled: options.authDisabled === true || isTruthy(env.FARMING_NET_DISABLE_AUTH),
-    env: authEnv,
-    farmingDir: configDir,
-    farmingNetPassVerifier: false,
-    redirectQueryToken: true,
-    token: env.FARMING_NET_TOKEN || '',
-  });
-
-  const routePath = suffix => `${basePath}${suffix}` || '/';
-  const staticAssets = new Map([
-    [routePath('/app.css'), { file: path.join(assetDir, 'app.css'), type: 'text/css; charset=utf-8' }],
-    [routePath('/app.js'), { file: path.join(assetDir, 'app.js'), type: 'text/javascript; charset=utf-8' }],
-    [routePath('/icon.png'), { file: iconFile, type: 'image/png' }],
-  ]);
-
-  const server = http.createServer((req, res) => {
-    setSecurityHeaders(res);
-    tokenAuth.middleware()(req, res, () => {
-      try {
-        const url = new URL(req.url || '/', `http://${req.headers.host || 'localhost'}`);
-        const pathname = url.pathname;
-        if (!['GET', 'HEAD'].includes(String(req.method || 'GET').toUpperCase())) {
-          sendJson(req, res, 405, { error: 'Method not allowed' });
-          return;
-        }
-
-        if (pathname === routePath('/api/auth/status')) {
-          sendJson(req, res, 200, { authRequired: tokenAuth.isEnabled() });
-          return;
-        }
-        if (pathname === routePath('/api/status')) {
-          sendJson(req, res, 200, {
-            name: 'Farming Net',
-            version: packageVersion,
-            basePath: basePath || '/',
-          });
-          return;
-        }
-        if (pathname === routePath('/api/instances')) {
-          sendJson(req, res, 200, browserRegistry(loadFarmingNetRegistry(registryFile), basePath));
-          return;
-        }
-        const openPrefix = routePath('/open/');
-        if (pathname.startsWith(openPrefix)) {
-          const parts = pathname.slice(openPrefix.length).split('/');
-          const instanceId = parts[0] || '';
-          const endpointIndex = Number(parts[1]);
-          const registry = loadFarmingNetRegistry(registryFile);
-          const instance = registry.instances.find(item => item.id === instanceId);
-          const endpoint = Number.isInteger(endpointIndex) && endpointIndex >= 0
-            ? instance && instance.endpoints[endpointIndex]
-            : null;
-          if (!instance || !endpoint || parts.length !== 2) {
-            sendJson(req, res, 404, { error: 'Farming instance endpoint not found' });
-            return;
-          }
-          const target = new URL(endpoint.url);
-          if (instance.federated) {
-            target.searchParams.set(PASS_QUERY_PARAM, createFarmingNetPass(signingIdentity, {
-              audience: instance.id,
-              subject: 'owner',
-              ttlSeconds: env.FARMING_NET_PASS_TTL_SECONDS,
-            }));
-          }
-          res.writeHead(302, {
-            'Cache-Control': 'no-store',
-            Location: target.toString(),
-          });
-          res.end();
-          return;
-        }
-        if (basePath && pathname === basePath) {
-          res.writeHead(302, { Location: `${basePath || ''}/` });
-          res.end();
-          return;
-        }
-        if (pathname === (basePath ? `${basePath}/` : '/')) {
-          const index = readAsset(path.join(assetDir, 'index.html'));
-          if (!index) {
-            sendJson(req, res, 500, { error: 'Farming Net frontend assets are missing' });
-            return;
-          }
-          sendBuffer(req, res, 200, index, 'text/html; charset=utf-8');
-          return;
-        }
-
-        const asset = staticAssets.get(pathname);
-        if (asset && asset.file) {
-          const body = readAsset(asset.file);
-          if (body) {
-            sendBuffer(req, res, 200, body, asset.type, 'public, max-age=3600');
-            return;
-          }
-        }
-        sendJson(req, res, 404, { error: 'Not found' });
-      } catch (error) {
-        console.error('Farming Net request failed:', error);
-        if (!res.headersSent) sendJson(req, res, 500, { error: 'Farming Net request failed' });
-        else res.end();
-      }
-    });
-  });
-
-  server.on('listening', () => {
-    const address = server.address();
-    const listeningPort = address && typeof address === 'object' ? address.port : null;
-    fs.writeFileSync(stateFile, `${JSON.stringify({
-      pid: process.pid,
-      port: listeningPort,
-      basePath: basePath || '/',
-      configDir,
-      registryFile,
-      signingIssuer: signingIdentity.issuer,
-      updatedAt: new Date().toISOString(),
-    }, null, 2)}\n`, { mode: 0o600 });
-  });
-  server.on('close', () => {
-    try {
-      const state = JSON.parse(fs.readFileSync(stateFile, 'utf8'));
-      if (state.pid === process.pid) fs.unlinkSync(stateFile);
-    } catch {
-      // Ignore missing or stale state files.
-    }
-  });
-
-  return {
-    basePath,
-    configDir,
-    packageVersion,
-    registryFile,
-    server,
-    stateFile,
-    signingIdentity,
-    tokenAuth,
-  };
-}
-
-function startFromCommandLine() {
-  const service = createFarmingNetServer();
-  const port = safePort(process.env.FARMING_NET_PORT || process.env.PORT, DEFAULT_PORT);
-  const host = process.env.FARMING_NET_HOST || '0.0.0.0';
-  service.server.listen(port, host, () => {
-    const entryPath = `${service.basePath || ''}/`;
-    const token = service.tokenAuth.getToken();
-    const query = token ? `?token=${encodeURIComponent(token)}` : '';
-    console.log(`Farming Net ${service.packageVersion}`);
-    console.log(`URL: http://127.0.0.1:${port}${entryPath}${query}`);
-    console.log(`Registry: ${service.registryFile}`);
-  });
-
-  const shutdown = signal => {
-    console.log(`Farming Net received ${signal}; shutting down.`);
-    service.server.close(() => process.exit(0));
-    setTimeout(() => process.exit(1), 5000).unref();
-  };
-  process.once('SIGINT', () => shutdown('SIGINT'));
-  process.once('SIGTERM', () => shutdown('SIGTERM'));
-}
-
-if (require.main === module) startFromCommandLine();
-
-module.exports = {
-  DEFAULT_BASE_PATH,
-  DEFAULT_PORT,
-  createFarmingNetServer,
-  normalizeBasePath,
-  safePort,
-};