meta-sovereign 0.49.18 → 0.50.0

package/README.hi.md

@@ -55,9 +55,11 @@ node js/bin/meta-sovereign.js serve
 
 Package npm पर publish होने के बाद `npx -y meta-sovereign serve` (या `npm install -g meta-sovereign && meta-sovereign serve`) काम करेगा। तब तक toolchain के बिना server चलाने का तरीका desktop app (ऊपर) है।
 
-दोनों backend default रूप से <http://127.0.0.1:8787> पर listen करते हैं। JS server hosted app के origin (`https://link-foundation.github.io`) को CORS headers के साथ जवाब देता है; दूसरे origins `meta-sovereign serve --allow-origin=<origins>` या `MS_ALLOW_ORIGINS` से allow करें। Safari `https` pages को `http://127.0.0.1` तक नहीं पहुँचने देता, लेकिन `https://127.0.0.1` तक पहुँचने देता है; server अब उसी port पर HTTPS का भी जवाब देता है और इसके लिए localhost का अपना certificate बनाता है। एक बार `node js/bin/meta-sovereign.js trust` चलाएँ (macOS login keychain में जोड़ता है; दूसरे systems पर certificate का path print होता है) या Safari में `https://127.0.0.1:8787/trust` खोलें और prompts follow करें — उसके बाद hosted app Safari में सीधे server से connect हो जाता है। Trust से पहले notice server का नाम दिखाता है, उसकी copy (<http://127.0.0.1:8787>) और **सर्वर पर भरोसा करें** (<https://127.0.0.1:8787/trust>) का link देता है। `--tls=false` / `MS_TLS=off` HTTPS बंद करता है; server की अपनी copy fallback रहती है। Hosted SPA `discoverServer()` से local server खोजता है (saved override → `127.0.0.1` ports)। अगर browser auto-connect नहीं करता, app में **Settings → Server** खोलें और binary द्वारा print किया गया URL paste करें।
+दोनों backend default रूप से <http://127.0.0.1:8787> पर listen करते हैं। JS server hosted app के origin (`https://link-foundation.github.io`) को CORS headers के साथ जवाब देता है; दूसरे origins `meta-sovereign serve --allow-origin=<origins>` या `MS_ALLOW_ORIGINS` से allow करें। Safari `https` pages को `http://127.0.0.1` तक नहीं पहुँचने देता, लेकिन `https://127.0.0.1` तक पहुँचने देता है; server अब उसी port पर HTTPS का भी जवाब देता है और इसके लिए localhost का अपना certificate बनाता है। एक बार `node js/bin/meta-sovereign.js trust` चलाएँ (macOS login keychain में जोड़ता है; दूसरे systems पर certificate का path print होता है) या Safari में `https://127.0.0.1:8787/trust` खोलें और prompts follow करें — उसके बाद hosted app Safari में सीधे server से connect हो जाता है। Trust से पहले notice server का नाम और **सर्वर पर भरोसा करें** (<https://127.0.0.1:8787/trust>) दिखाता है; localhost UI का link तभी मिलता है जब वह स्पष्ट रूप से enable हो। `--tls=false` / `MS_TLS=off` HTTPS बंद करता है। Safari trusted local HTTPS API से hosted app उपयोग करता है; localhost UI वैकल्पिक है। Hosted SPA `discoverServer()` से local server खोजता है (saved override → `127.0.0.1` ports)। अगर browser auto-connect नहीं करता, app में **Settings → Server** खोलें और binary द्वारा print किया गया URL paste करें।
 
-Default UI hosted app है: `serve` उसका पता छापता है, <https://link-foundation.github.io/meta-sovereign/>, और app हमारे port 8787 पर server को खुद ढूँढ लेता है (वह 8788, 7001, 7002 और 3000 भी देखता है; किसी दूसरे port पर `serve` बताता है कि उसे **Settings → Server** में set करें), इसलिए server को web site host नहीं करनी पड़ती। <http://127.0.0.1:8787> पर उसकी अपनी copy Safari और बिना internet काम के लिए fallback रहती है; `serve --local-ui=false` (या `MS_LOCAL_UI=off`) उसे बंद करता है, और तब `/` hosted app खोलता है। `--ui-url=<url>` (या `MS_UI_URL`) कोई दूसरी hosted copy बताता है, जैसे किसी fork का Pages, और उसके origin को अनुमति देता है।
+Default UI hosted app है: `serve` उसका पता छापता है, <https://link-foundation.github.io/meta-sovereign/>, और app हमारे port 8787 पर server को खुद ढूँढ लेता है (वह 8788, 7001, 7002 और 3000 भी देखता है; किसी दूसरे port पर `serve` बताता है कि उसे **Settings → Server** में set करें), इसलिए server को web site host नहीं करनी पड़ती। Default रूप से `/` GitHub Pages पर redirect करता है और server केवल API, sync transports और connection helpers देता है। बिना internet के लिए localhost web app वैकल्पिक है: `serve --local-ui=true` (या `MS_LOCAL_UI=on`) से enable करें; फिर वह <http://127.0.0.1:8787> पर मिलता है। Desktop shell अपना bundled UI स्पष्ट रूप से enable करता है। `--ui-url=<url>` (या `MS_UI_URL`) कोई दूसरी hosted copy बताता है, जैसे किसी fork का Pages, और उसके origin को अनुमति देता है।
+
+macOS पर interactive `serve` पूरा setup करता है: इस installation की TLS key को Secure Enclave से protect करता है, certificate trust जाँचता है, जरूरत पर ही trust माँगता है और GitHub Pages app खोलता है। Headless launch: `node js/bin/meta-sovereign.js serve --trust=true --open=true`। `--trust=false` और `--open=false` से opt out करें। Swift helper को macOS Command Line Tools चाहिए; unsupported Mac पर `--hardware-key=false` स्पष्ट रूप से file key चुनता है। Hardware protection disk की key पर लागू है; Node key को memory में उपयोग करता है। नियम और सीमाएँ: [local server setup और security](docs/LOCAL-SERVER-SECURITY.md)।
 
 ## SPA को server से जोड़ें
 
@@ -78,6 +80,7 @@ SPA server को इस क्रम में चुनता है ([`js/src
 - **एकीकृत इनबॉक्स**: VK, Telegram, X, WhatsApp, Facebook, Instagram, LinkedIn, ईमेल, GitHub, Upwork, PeoplePerHour और जॉब बोर्ड; जहाँ नेटवर्क अनुमति देता है वहाँ लाइव अपडेट (Telegram, VK Long Poll, incremental IMAP, GitHub), बाकी के लिए किसी भी आकार के आर्काइव का आयात।
 - **Telegram के अपने ऐप जैसी चैट**: हर संदेश एक बार भेजा जाता है, डिलीवरी टिक, लाइव अपडेट और अंतराल के बाद catch-up, पढ़ा-चिह्न, cloud ड्राफ़्ट, reload के बाद भी बचे रहने वाले retry ([`docs/CHAT-REFERENCES.hi.md`](docs/CHAT-REFERENCES.hi.md))।
 - **CRM**: किसी संपर्क के बारे में सब कुछ एक दृश्य में, अलग-अलग नेटवर्क पर वही व्यक्ति, communities और सदस्यताएँ, खोज, नियम से ऑडियंस (`friends:vk & chat:vk:… - list:blocked`)।
+- **संपर्क आयात**: macOS Contacts (सिंक किए गए iCloud खातों सहित) या किसी भी प्लेटफ़ॉर्म के vCard निर्यात का पूर्वावलोकन करके आयात करें। दोबारा आयात करने पर रिकॉर्ड की पहचान बनी रहती है। निर्देशिका सिंक के दौरान अपडेट होती है और बिना संदेश वाले लोग भी दिखाती है। [संपर्क आयात](docs/CONTACTS-IMPORT.md) देखें।
 - **Outreach, broadcast और ऑटोमेशन**: किसे, कब, किन शर्तों पर और किस पाठ से लिखना है; कौन क्या पाएगा इसका preview; डिफ़ॉल्ट रूप से सुरक्षित ड्राफ़्ट, या quiet hours, हर चैट का cooldown, दैनिक सीमा और opt-out सूची के साथ धीमी गति से स्वचालित भेजना। हर स्वचालित भेजना एक ही outbox से जाता है: अधिक से अधिक एक बार, और अस्पष्ट परिणाम अपने आप दोहराया नहीं जाता ([`docs/USER-GUIDE.hi.md`](docs/USER-GUIDE.hi.md), §11)।
 - **Operator कतार और उत्तर**: अपठित संदेश चैट-दर-चैट, आपके पिछले उत्तरों से सुझाव (Tab एक चुनता है), पैटर्न और उत्तर के रूप, मिलते संदेश पर auto-reply।
 - **व्यवसाय और community खाते**: VK community token Bots Long Poll चलाता है; Telegram Business के quick replies, स्वागत और अनुपस्थिति संदेश, कार्य-समय और chatbots।

package/README.md

@@ -55,9 +55,11 @@ node js/bin/meta-sovereign.js serve
 
 Once the package is published to npm, `npx -y meta-sovereign serve` (or `npm install -g meta-sovereign && meta-sovereign serve`) will work. Until then, the desktop app (above) is the way to run the server without a toolchain.
 
-Either backend listens on <http://127.0.0.1:8787> by default. The JS server answers the hosted app's origin (`https://link-foundation.github.io`) with CORS headers; allow other origins with `meta-sovereign serve --allow-origin=<origins>` or `MS_ALLOW_ORIGINS`. Safari does not let `https` pages reach `http://127.0.0.1`, but it allows `https://127.0.0.1`; the server also answers HTTPS on the same port with its own certificate for localhost — run `node js/bin/meta-sovereign.js trust` once (macOS adds it to the login keychain; other systems print the certificate path), or open `https://127.0.0.1:8787/trust` in Safari and follow the prompts, and the hosted app connects directly. Before trusting, the notice names the server, links its own copy (<http://127.0.0.1:8787>) and a **Trust the server** link (<https://127.0.0.1:8787/trust>). `--tls=false` / `MS_TLS=off` turns HTTPS off; the server's own copy remains the fallback. The hosted SPA discovers the local server automatically through `discoverServer()` (saved override → `127.0.0.1` ports). If your browser does not auto-connect, open the in-app **Settings → Server** prompt and paste the URL the binary printed.
+Either backend listens on <http://127.0.0.1:8787> by default. The JS server answers the hosted app's origin (`https://link-foundation.github.io`) with CORS headers; allow other origins with `meta-sovereign serve --allow-origin=<origins>` or `MS_ALLOW_ORIGINS`. Safari does not let `https` pages reach `http://127.0.0.1`, but it allows `https://127.0.0.1`; the server also answers HTTPS on the same port with its own certificate for localhost — run `node js/bin/meta-sovereign.js trust` once (macOS adds it to the login keychain; other systems print the certificate path), or open `https://127.0.0.1:8787/trust` in Safari and follow the prompts, and the hosted app connects directly. Before trusting, the notice names the server and offers **Trust the server** (<https://127.0.0.1:8787/trust>); it links a localhost UI only if that UI was explicitly enabled. `--tls=false` / `MS_TLS=off` turns HTTPS off. Safari uses the hosted app through the trusted local HTTPS API; the localhost UI is optional. The hosted SPA discovers the local server automatically through `discoverServer()` (saved override → `127.0.0.1` ports). If your browser does not auto-connect, open the in-app **Settings → Server** prompt and paste the URL the binary printed.
 
-The hosted app is the default UI: `serve` prints its address, <https://link-foundation.github.io/meta-sovereign/>, and the app finds the server on our port 8787 by itself (it also looks at 8788, 7001, 7002 and 3000; on another port `serve` says to set it in **Settings → Server**), so the server does not have to host a web site. Its own copy at <http://127.0.0.1:8787> stays as a fallback for Safari and for working offline; `serve --local-ui=false` (or `MS_LOCAL_UI=off`) turns it off, and `/` then opens the hosted app. `--ui-url=<url>` (or `MS_UI_URL`) names another hosted copy, such as a fork's Pages, and allows its origin.
+The hosted app is the default UI: `serve` prints its address, <https://link-foundation.github.io/meta-sovereign/>, and the app finds the server on our port 8787 by itself (it also looks at 8788, 7001, 7002 and 3000; on another port `serve` says to set it in **Settings → Server**), so the server does not have to host a web site. By default `/` redirects to GitHub Pages and the server serves only its API, sync transports and connection helpers. To opt into a localhost web app for offline use, run `serve --local-ui=true` (or set `MS_LOCAL_UI=on`); that copy is then available at <http://127.0.0.1:8787>. Desktop shells explicitly enable their bundled UI. `--ui-url=<url>` (or `MS_UI_URL`) names another hosted copy, such as a fork's Pages, and allows its origin.
+
+On macOS, interactive `serve` now handles the full setup: it protects this installation’s TLS key with Secure Enclave, detects existing certificate trust, requests trust only when needed, and opens the GitHub Pages app. For a headless launch use `node js/bin/meta-sovereign.js serve --trust=true --open=true`. `--trust=false` and `--open=false` opt out. The Swift helper needs the macOS Command Line Tools; `--hardware-key=false` explicitly opts into a file key on unsupported Macs. Hardware protection applies to the key on disk; Node uses it in memory. See [local server setup and security](docs/LOCAL-SERVER-SECURITY.md) for the exact access rules and limits.
 
 ## Connect the SPA to your server
 
@@ -78,6 +80,7 @@ The full user-facing flow — install nothing, install Rust server, install JS s
 - **Unified inbox** across VK, Telegram, X, WhatsApp, Facebook, Instagram, LinkedIn, email, GitHub, Upwork, PeoplePerHour and job boards, with live updates where the network allows (Telegram, the VK Long Poll, incremental IMAP, GitHub) and full-size archive imports for the rest.
 - **Chat that behaves like Telegram's own apps**: each message sent once, delivery ticks, live updates and catch-up after a gap, read marking, cloud drafts, retries that survive a reload. How the open-source Telegram, Signal and Element clients do it, pinned to the commits we read, is in [`docs/CHAT-REFERENCES.md`](docs/CHAT-REFERENCES.md).
 - **CRM**: everything known about a contact in one view, the same person across networks, communities and memberships, search, audiences by rule (`friends:vk & chat:vk:… - list:blocked`).
+- **Contact imports**: preview and import macOS Contacts (including synced iCloud accounts) or vCard exports from any platform; repeated imports keep stable identities. The directory updates during sync and includes people without messages. See [contact imports](docs/CONTACTS-IMPORT.md).
 - **Outreach, broadcasts and automations**: who to message, when, on what conditions and with which text; a preview of who gets what; safe drafts by default or paced auto-send with quiet hours, a per-chat cooldown, daily caps and an opt-out list. Every automated send goes through one outbox, so it happens at most once and an unclear result is never retried by itself ([`docs/USER-GUIDE.md` §11](docs/USER-GUIDE.md#11-automations-message-people-by-rule-safely)).
 - **Operator queue and replies**: walk unread messages chat by chat, reply suggestions from your own past answers (Tab takes one), patterns and reply variations, auto-replies on a matching message.
 - **Business and community accounts**: a VK community token runs the Bots Long Poll; Telegram Business quick replies, greeting and away messages, hours and chatbots.

package/README.ru.md

@@ -55,9 +55,11 @@ node js/bin/meta-sovereign.js serve
 
 Когда пакет будет опубликован в npm, заработают `npx -y meta-sovereign serve` (или `npm install -g meta-sovereign && meta-sovereign serve`). До тех пор запустить server без toolchain можно через desktop app (выше).
 
-Оба backend по умолчанию слушают <http://127.0.0.1:8787>. JS server отвечает origin hosted app (`https://link-foundation.github.io`) с CORS headers; другие origins разрешаются через `meta-sovereign serve --allow-origin=<origins>` или `MS_ALLOW_ORIGINS`. Safari не пускает `https` страницы на `http://127.0.0.1`, но пускает на `https://127.0.0.1`; сервер теперь отвечает по HTTPS на том же порту с собственным сертификатом для localhost. Выполните `node js/bin/meta-sovereign.js trust` один раз (macOS добавляет сертификат в login keychain; на других системах печатается путь к сертификату) или откройте `https://127.0.0.1:8787/trust` в Safari и следуйте подсказкам — после этого hosted app в Safari подключается к серверу напрямую. До того уведомление называет сервер, даёт ссылку на его копию (<http://127.0.0.1:8787>) и **Доверять серверу** (<https://127.0.0.1:8787/trust>). `--tls=false` / `MS_TLS=off` отключает HTTPS; копия приложения с сервера остаётся запасным вариантом. Hosted SPA автоматически находит локальный сервер через `discoverServer()` (сохраненный override → порты `127.0.0.1`). Если браузер не подключился сам, откройте **Settings → Server** в приложении и вставьте URL, который напечатал сервер.
+Оба backend по умолчанию слушают <http://127.0.0.1:8787>. JS server отвечает origin hosted app (`https://link-foundation.github.io`) с CORS headers; другие origins разрешаются через `meta-sovereign serve --allow-origin=<origins>` или `MS_ALLOW_ORIGINS`. Safari не пускает `https` страницы на `http://127.0.0.1`, но пускает на `https://127.0.0.1`; сервер теперь отвечает по HTTPS на том же порту с собственным сертификатом для localhost. Выполните `node js/bin/meta-sovereign.js trust` один раз (macOS добавляет сертификат в login keychain; на других системах печатается путь к сертификату) или откройте `https://127.0.0.1:8787/trust` в Safari и следуйте подсказкам — после этого hosted app в Safari подключается к серверу напрямую. До того уведомление называет сервер и предлагает **Доверять серверу** (<https://127.0.0.1:8787/trust>); ссылка на localhost-копию появляется только при её явном включении. `--tls=false` / `MS_TLS=off` отключает HTTPS. Safari использует размещённое приложение через доверенный локальный HTTPS API; localhost-интерфейс необязателен. Hosted SPA автоматически находит локальный сервер через `discoverServer()` (сохраненный override → порты `127.0.0.1`). Если браузер не подключился сам, откройте **Settings → Server** в приложении и вставьте URL, который напечатал сервер.
 
-По умолчанию интерфейс — размещённое приложение: `serve` печатает его адрес, <https://link-foundation.github.io/meta-sovereign/>, а приложение само находит сервер на нашем порту 8787 (а также смотрит 8788, 7001, 7002 и 3000; на другом порту `serve` подскажет указать его в **Settings → Server**), так что серверу не нужно держать сайт. Своя копия на <http://127.0.0.1:8787> остаётся запасной — для Safari и работы без интернета; `serve --local-ui=false` (или `MS_LOCAL_UI=off`) её выключает, и тогда `/` открывает размещённое приложение. `--ui-url=<url>` (или `MS_UI_URL`) задаёт другую размещённую копию, например Pages форка, и разрешает её origin.
+По умолчанию интерфейс — размещённое приложение: `serve` печатает его адрес, <https://link-foundation.github.io/meta-sovereign/>, а приложение само находит сервер на нашем порту 8787 (а также смотрит 8788, 7001, 7002 и 3000; на другом порту `serve` подскажет указать его в **Settings → Server**), так что серверу не нужно держать сайт. По умолчанию `/` перенаправляет на GitHub Pages, а сервер предоставляет API, синхронизацию и вспомогательные маршруты подключения. Копия на localhost для работы без интернета включается отдельно: `serve --local-ui=true` (или `MS_LOCAL_UI=on`), после чего она доступна на <http://127.0.0.1:8787>. Desktop-оболочка явно включает свой встроенный интерфейс. `--ui-url=<url>` (или `MS_UI_URL`) задаёт другую размещённую копию, например Pages форка, и разрешает её origin.
+
+В macOS интерактивный `serve` выполняет настройку целиком: защищает TLS-ключ этой установки через Secure Enclave, проверяет доверие сертификату, запрашивает его только при необходимости и открывает приложение на GitHub Pages. Без интерактивного терминала: `node js/bin/meta-sovereign.js serve --trust=true --open=true`. `--trust=false` и `--open=false` отключают эти действия. Для Swift-помощника нужны macOS Command Line Tools; `--hardware-key=false` явно выбирает файловый ключ на неподдерживаемом Mac. Аппаратная защита действует на диске; Node использует ключ в памяти. Правила и ограничения: [настройка и безопасность локального сервера](docs/LOCAL-SERVER-SECURITY.md).
 
 ## Подключение SPA к серверу
 
@@ -78,6 +80,7 @@ SPA выбирает сервер в таком порядке ([`js/src/web/dis
 - **Единый inbox** для VK, Telegram, X, WhatsApp, Facebook, Instagram, LinkedIn, почты, GitHub, Upwork, PeoplePerHour и сайтов вакансий: живые обновления там, где сеть это позволяет (Telegram, VK Long Poll, инкрементальный IMAP, GitHub), и импорт архивов любого размера для остальных.
 - **Чат, который ведёт себя как приложения Telegram**: каждое сообщение отправляется один раз, галочки доставки, живые обновления и догрузка после разрыва, отметки о прочтении, облачные черновики, повторы, переживающие перезагрузку ([`docs/CHAT-REFERENCES.ru.md`](docs/CHAT-REFERENCES.ru.md)).
 - **CRM**: всё о контакте в одном окне, один и тот же человек в разных сетях, сообщества и членства, поиск, аудитории по правилам (`friends:vk & chat:vk:… - list:blocked`).
+- **Импорт контактов**: предпросмотр и импорт из Контактов macOS (включая синхронизированные учётные записи iCloud) или файлов vCard на любой платформе; повторный импорт сохраняет идентичность записей. Список обновляется при синхронизации и включает людей без сообщений. См. [импорт контактов](docs/CONTACTS-IMPORT.md).
 - **Рассылки, broadcast и автоматизации**: кому писать, когда, при каких условиях и каким текстом; предпросмотр, кто что получит; по умолчанию безопасные черновики или отправка с паузами, тихими часами, перерывом для каждого чата, дневными лимитами и списком отписавшихся. Каждая автоматическая отправка идёт через один outbox: не больше одного раза, а неясный результат сам не повторяется ([`docs/USER-GUIDE.ru.md`](docs/USER-GUIDE.ru.md), §11).
 - **Очередь оператора и ответы**: непрочитанные сообщения чат за чатом, подсказки ответов из ваших прошлых ответов (Tab берёт подсказку), паттерны и варианты ответов, автоответы на подходящее сообщение.
 - **Аккаунты бизнеса и сообществ**: токен сообщества VK запускает Bots Long Poll; Telegram Business: быстрые ответы, приветствие и сообщение об отсутствии, часы работы, чат-боты.

package/README.zh.md

@@ -55,9 +55,11 @@ node js/bin/meta-sovereign.js serve
 
 包发布到 npm 之后，`npx -y meta-sovereign serve`（或 `npm install -g meta-sovereign && meta-sovereign serve`）才会可用。在此之前，不想装工具链的话可以使用桌面 app（见上文）。
 
-两个后端默认监听 <http://127.0.0.1:8787>。JS 服务器会对托管 app 的 origin（`https://link-foundation.github.io`）返回 CORS 头；其他 origin 可以用 `meta-sovereign serve --allow-origin=<origins>` 或 `MS_ALLOW_ORIGINS` 允许。Safari 不允许 `https` 页面访问 `http://127.0.0.1`，但允许访问 `https://127.0.0.1`；服务器现在也在同一端口上提供 HTTPS 服务，并使用专为 localhost 颁发的自签名证书。运行一次 `node js/bin/meta-sovereign.js trust`（macOS：将证书添加到 login keychain；其他系统：打印证书路径），或在 Safari 中打开 `https://127.0.0.1:8787/trust` 并按提示操作，之后托管 app 在 Safari 中即可直接连接服务器。信任之前，提示会显示服务器地址，并提供其自带副本的链接（<http://127.0.0.1:8787>）以及 **信任服务器**（<https://127.0.0.1:8787/trust>）链接。`--tls=false` / `MS_TLS=off` 可关闭 HTTPS；服务器自带副本仍作为备用保留。托管的 SPA 会通过 `discoverServer()` 自动发现本地服务器（保存的覆盖值 → `127.0.0.1` 端口）。如果浏览器没有自动连接，请打开应用内 **Settings → Server**，粘贴服务器打印的 URL。
+两个后端默认监听 <http://127.0.0.1:8787>。JS 服务器会对托管 app 的 origin（`https://link-foundation.github.io`）返回 CORS 头；其他 origin 可以用 `meta-sovereign serve --allow-origin=<origins>` 或 `MS_ALLOW_ORIGINS` 允许。Safari 不允许 `https` 页面访问 `http://127.0.0.1`，但允许访问 `https://127.0.0.1`；服务器现在也在同一端口上提供 HTTPS 服务，并使用专为 localhost 颁发的自签名证书。运行一次 `node js/bin/meta-sovereign.js trust`（macOS：将证书添加到 login keychain；其他系统：打印证书路径），或在 Safari 中打开 `https://127.0.0.1:8787/trust` 并按提示操作，之后托管 app 在 Safari 中即可直接连接服务器。信任之前，提示会显示服务器地址及 **信任服务器**（<https://127.0.0.1:8787/trust>）链接；仅当显式启用 localhost 界面时才显示其链接。`--tls=false` / `MS_TLS=off` 可关闭 HTTPS。Safari 通过受信任的本地 HTTPS API 使用托管应用；localhost 界面是可选的。托管的 SPA 会通过 `discoverServer()` 自动发现本地服务器（保存的覆盖值 → `127.0.0.1` 端口）。如果浏览器没有自动连接，请打开应用内 **Settings → Server**，粘贴服务器打印的 URL。
 
-默认界面是托管的应用：`serve` 会打印其地址 <https://link-foundation.github.io/meta-sovereign/>，应用会自行在我们的端口 8787 上找到服务器（也会查看 8788、7001、7002 和 3000；若使用其他端口，`serve` 会提示在 **Settings → Server** 中设置），因此服务器无需自己托管网站。它在 <http://127.0.0.1:8787> 上的副本作为备用保留，供 Safari 和离线使用；`serve --local-ui=false`（或 `MS_LOCAL_UI=off`）可将其关闭，此时 `/` 会打开托管的应用。`--ui-url=<url>`（或 `MS_UI_URL`）指定另一个托管副本（例如某个 fork 的 Pages），并允许其 origin。
+默认界面是托管的应用：`serve` 会打印其地址 <https://link-foundation.github.io/meta-sovereign/>，应用会自行在我们的端口 8787 上找到服务器（也会查看 8788、7001、7002 和 3000；若使用其他端口，`serve` 会提示在 **Settings → Server** 中设置），因此服务器无需自己托管网站。默认情况下，`/` 重定向到 GitHub Pages，服务器只提供 API、同步传输和连接辅助路由。如需离线使用 localhost 网页，请显式运行 `serve --local-ui=true`（或设置 `MS_LOCAL_UI=on`），随后可在 <http://127.0.0.1:8787> 访问该副本。桌面壳会显式启用其内置界面。`--ui-url=<url>`（或 `MS_UI_URL`）指定另一个托管副本（例如某个 fork 的 Pages），并允许其 origin。
+
+在 macOS 交互式终端中，`serve` 会完成整个设置：使用 Secure Enclave 保护本次安装的 TLS 私钥，检测证书是否已受信任，仅在需要时请求信任，并打开 GitHub Pages 应用。无交互终端时可运行 `node js/bin/meta-sovereign.js serve --trust=true --open=true`。`--trust=false` 和 `--open=false` 可关闭相应操作。Swift 辅助程序需要 macOS Command Line Tools；不支持的 Mac 可显式使用 `--hardware-key=false` 选择文件密钥。硬件保护针对磁盘上的密钥；Node 在内存中使用密钥。详见[本地服务器设置与安全](docs/LOCAL-SERVER-SECURITY.md)。
 
 ## 将 SPA 连接到服务器
 
@@ -78,6 +80,7 @@ SPA 按以下顺序选择服务器（[`js/src/web/discover.js`](js/src/web/disco
 - **统一收件箱**：覆盖 VK、Telegram、X、WhatsApp、Facebook、Instagram、LinkedIn、电子邮件、GitHub、Upwork、PeoplePerHour 和招聘网站；网络允许时实时更新（Telegram、VK Long Poll、增量 IMAP、GitHub），其余可导入任意大小的存档。
 - **像 Telegram 官方应用一样的聊天**：每条消息只发送一次，送达对勾，实时更新与断线后补齐，已读标记，云端草稿，刷新后仍保留的重试（[`docs/CHAT-REFERENCES.zh.md`](docs/CHAT-REFERENCES.zh.md)）。
 - **CRM**：一个视图看到联系人的全部信息，跨网络识别同一个人，社区与成员关系，搜索，按规则定义受众（`friends:vk & chat:vk:… - list:blocked`）。
+- **导入联系人**：预览并导入 macOS 通讯录（包括已同步的 iCloud 账户）或任何平台导出的 vCard；重复导入保留记录身份。目录在同步期间自动更新，也包含没有消息的联系人。参见[联系人导入](docs/CONTACTS-IMPORT.md)。
 - **外联、群发与自动化**：给谁发、何时发、在什么条件下发、发什么内容；预览谁会收到什么；默认生成安全草稿，或按节奏自动发送，并有安静时段、每个聊天的冷却期、每日上限和退订名单。每次自动发送都经过同一个发件箱：最多发送一次，结果不明时不会自行重试（[`docs/USER-GUIDE.zh.md`](docs/USER-GUIDE.zh.md) 第 11 节）。
 - **Operator 队列与回复**：逐个聊天处理未读消息，根据您以往的回答给出回复建议（按 Tab 采用），模式与回复变体，对匹配消息自动回复。
 - **企业与社区账号**：VK 社区令牌运行 Bots Long Poll；Telegram Business 的快捷回复、问候与离开消息、营业时间和聊天机器人。

package/js/src/cli/browser-open.js

@@ -0,0 +1,25 @@
+// Open the hosted face of the app, including when the local UI is enabled.
+import { spawn } from 'node:child_process';
+
+export const maybeOpenHostedApp = (args, handle, log) => {
+  const interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY);
+  const enabled =
+    args.open === undefined ? interactive : String(args.open) !== 'false';
+  if (args.foreground === false || !enabled) {
+    return;
+  }
+  const [program, ...prefix] =
+    process.platform === 'darwin'
+      ? ['open']
+      : process.platform === 'win32'
+        ? ['rundll32.exe', 'url.dll,FileProtocolHandler']
+        : ['xdg-open'];
+  const browser = spawn(program, [...prefix, handle.uiUrl], {
+    detached: true,
+    stdio: 'ignore',
+  });
+  browser.on('error', () =>
+    log(`open the app in your browser → ${handle.uiUrl}`)
+  );
+  browser.unref();
+};

package/js/src/cli/contact-commands.js

@@ -0,0 +1,42 @@
+// Local address-book imports, with the same parser and plan as the app.
+import { promises as fs } from 'node:fs';
+import { decodeVcard, parseVcard } from '../sources/vcard.js';
+import { readSystemContacts } from '../sources/system-contacts.js';
+import {
+  planContactsImport,
+  applyContactsImport,
+} from '../sources/contacts-import.js';
+
+export const CONTACTS_HELP = `  contacts-import [--file=<contacts.vcf> | --system] [--store=<dir>] [--preview]
+                import a vCard export or macOS Contacts (including synced iCloud accounts); nothing is uploaded`;
+
+export const createContactCommands = ({ openStore }) => ({
+  'contacts-import': async (args, log) => {
+    const system = args.system === true || args.system === 'true';
+    if (system === Boolean(args.file)) {
+      log('choose --file=<contacts.vcf> or --system');
+      return 1;
+    }
+    const storeDir = args.store ?? '.meta-sovereign';
+    const store = await openStore(storeDir);
+    try {
+      const rows = system
+        ? await readSystemContacts(storeDir)
+        : parseVcard(decodeVcard(await fs.readFile(args.file)));
+      const plan = await planContactsImport(store, rows, {
+        source: system ? 'system' : 'vcard',
+      });
+      const preview = args.preview === true || args.preview === 'true';
+      log(
+        JSON.stringify(
+          preview
+            ? { preview: true, ...plan.stats }
+            : await applyContactsImport(store, plan)
+        )
+      );
+      return 0;
+    } finally {
+      await store.close?.();
+    }
+  },
+});

package/js/src/cli/index.js

@@ -14,6 +14,8 @@
  */
 
 import path from 'node:path';
+import { maybeOpenHostedApp } from './browser-open.js';
+import { CONTACTS_HELP, createContactCommands } from './contact-commands.js';
 import { promises as fs } from 'node:fs';
 import { parseArgs } from './lino-args.js';
 import { CV_HELP, createCvCommands } from './cv-commands.js';
@@ -25,7 +27,11 @@ import {
   GREETINGS_HELP,
   createGreetingCommands,
 } from './greetings-commands.js';
-import { TRUST_HELP, createTrustCommands } from './trust-commands.js';
+import {
+  TRUST_HELP,
+  createTrustCommands,
+  setupLocalCertificate,
+} from './trust-commands.js';
 import {
   MIGRATE_HELP,
   SCHEMA_ERROR_CODES,
@@ -83,10 +89,13 @@ Commands:
   backup        --store=<dir> --archive=<dir> [--keep=<n>]
   restore       --file=<path> --store=<dir> [--replace]
   passcode      --clear [--store=<dir>]   (remove a forgotten local passcode)
-  serve         [--port=<n>] [--store=<dir>] [--allow-origin=<origins|none>] [--ui-url=<url>] [--local-ui=false] [--tls=false] [--quiet-logs]
+  serve         [--port=<n>] [--store=<dir>] [--allow-origin=<origins|none>] [--ui-url=<url>] [--local-ui=true] [--tls=false] [--trust=true|false] [--hardware-key=false] [--open=true|false] [--quiet-logs]
+                open https://link-foundation.github.io/meta-sovereign/; the localhost UI is opt-in
+                on macOS: protect the TLS key with Secure Enclave; detect trust, set it up once in an interactive terminal
                 verbose logs are written to <store>/logs/meta-sovereign.log by default
                 https is served on the same port (for Safari); --tls=false or MS_TLS=off turns it off
 ${TRUST_HELP}
+${CONTACTS_HELP}
   sources
   source-pull   --source=<name> [--protocol=<p>] [--host=<mail-host>] [--owner=<o>] [--repo=<r>] [--state=<s>] [--offset=<n>] [--limit=<n>] [--store=<dir>]
   email-send    --protocol=<gmail|microsoft-graph|jmap|smtp> --to=<email> --subject=<s> --text=<body> [--host=<mail-host>]
@@ -196,7 +205,7 @@ const serveOptions = (args) => ({
   // back to MS_ALLOW_ORIGINS and then the built-in defaults.
   ...(args['allow-origin'] ? { allowOrigins: args['allow-origin'] } : {}),
   // The hosted app is the UI; the server's own copy is a fallback
-  // that `--local-ui=false` turns off (R-Y58, R-Y59).
+  // enabled with `--local-ui=true` (R-Y58, R-Y59).
   ...(args['ui-url'] ? { uiUrl: args['ui-url'] } : {}),
   ...(args['local-ui'] !== undefined ? { localUi: args['local-ui'] } : {}),
   // https beside http on the same port, for Safari (R-Y64).
@@ -221,7 +230,7 @@ const logAddresses = (handle, log) => {
   log(
     handle.localUi
       ? `local copy (fallback, e.g. for Safari or offline) → ${origin}/`
-      : `local copy off: ${origin}/ opens the app above`
+      : `local copy off: ${origin}/ opens the app above (enable with --local-ui=true)`
   );
 };
 
@@ -242,6 +251,9 @@ const serveCmd = async (args, log) => {
   }
   let handle;
   try {
+    if (args.foreground !== false) {
+      await setupLocalCertificate(args, log);
+    }
     handle = await startServer({
       port: Number(args.port ?? 8787),
       storeDir,
@@ -256,6 +268,7 @@ const serveCmd = async (args, log) => {
     return 1;
   }
   logAddresses(handle, log);
+  maybeOpenHostedApp(args, handle, log);
   if (serverLog) {
     log(`verbose logs → ${serverLog.file}`);
   }
@@ -816,6 +829,7 @@ const COMMANDS = {
   ...createGreetingCommands({ openStore }),
   // Let Safari trust the server's own certificate (R-Y64).
   ...createTrustCommands(),
+  ...createContactCommands({ openStore }),
   // Bring a store to the current data schema, or look first (R-Z17).
   ...createMigrateCommands(),
   help: async (_a, log) => {

package/js/src/cli/trust-commands.js

@@ -15,11 +15,81 @@ import { spawnSync } from 'node:child_process';
 import os from 'node:os';
 import path from 'node:path';
 
-import { loadLocalTls } from '../server/local-tls.js';
+import { canShareTlsPort, loadLocalTls } from '../server/local-tls.js';
+import { createDeviceKeyProtector } from '../server/local-key.js';
 
 export const TRUST_HELP = `  trust         [--store=<dir>] [--remove=true]
                 lets Safari use the server from the hosted app: trusts the server's own certificate (localhost and 127.0.0.1 only) once`;
 
+const enabled = (value, fallback = true) =>
+  value === undefined ? fallback : String(value) !== 'false';
+
+/** Ask macOS to evaluate this exact leaf certificate for local TLS only. */
+export const certificateIsTrusted = (
+  certPath,
+  { platform = process.platform, run = spawnSync } = {}
+) =>
+  platform === 'darwin' &&
+  ['localhost', '127.0.0.1'].every(
+    (name) =>
+      run(
+        'security',
+        ['verify-cert', '-c', certPath, '-p', 'ssl', '-n', name, '-L', '-q'],
+        { stdio: 'ignore', timeout: 10_000 }
+      ).status === 0
+  );
+
+/** Full certificate setup used by serve; tests inject every OS operation. */
+export const setupLocalCertificate = async (args, log, options = {}) => {
+  const {
+    platform,
+    deviceProtector,
+    load,
+    trusted,
+    trust,
+    interactive,
+    supported,
+  } = {
+    platform: process.platform,
+    deviceProtector: createDeviceKeyProtector,
+    load: loadLocalTls,
+    trusted: certificateIsTrusted,
+    trust: (a, out) => createTrustCommands().trust(a, out),
+    interactive: Boolean(process.stdin.isTTY && process.stdout.isTTY),
+    supported: canShareTlsPort(),
+    ...options,
+  };
+  if (!enabled(args.tls) || process.env.MS_TLS === 'off' || !supported) {
+    return null;
+  }
+  const storeDir = args.store ?? '.meta-sovereign';
+  const protector =
+    enabled(args['hardware-key']) && platform === 'darwin'
+      ? await deviceProtector(storeDir)
+      : null;
+  const local = await load(storeDir, { protector });
+  log(`local TLS identity (SHA-256) → ${local.fingerprint}`);
+  log(`local TLS key protection → ${local.protection}`);
+  if (platform !== 'darwin' || trusted(local.certPath)) {
+    return local;
+  }
+  // Interactive serve sets up Safari by default; headless runs opt in.
+  const shouldTrust = enabled(args.trust, interactive);
+  if (shouldTrust) {
+    const code = await trust({ store: storeDir }, log);
+    if (code !== 0) {
+      log(
+        'certificate trust was not granted; use the app’s Trust the server link when ready'
+      );
+    }
+  } else {
+    log(
+      'Safari setup → run serve --trust=true, or node js/bin/meta-sovereign.js trust'
+    );
+  }
+  return local;
+};
+
 const runCommand = (cmd, args) => {
   const done = spawnSync(cmd, args, { stdio: 'inherit' });
   return done.status ?? 1;
@@ -54,6 +124,7 @@ export const createTrustCommands = ({
   run = runCommand,
   platform = process.platform,
   home = os.homedir(),
+  trusted = certificateIsTrusted,
 } = {}) => ({
   trust: async (args, log) => {
     const remove = String(args.remove ?? 'false') !== 'false';
@@ -62,6 +133,10 @@ export const createTrustCommands = ({
       log(manualSteps(certPath));
       return 0;
     }
+    if (!remove && trusted(certPath)) {
+      log('this local server certificate is already trusted');
+      return 0;
+    }
     log(
       remove
         ? `no longer trusting ${certPath}`

package/js/src/index.d.ts

@@ -21,6 +21,12 @@ export declare const runCli: (argv: string[]) => Promise<number>;
 export declare const startServer: (opts: {
   port?: number;
   storeDir?: string;
+  /** Serve the bundled web UI; defaults to false (GitHub Pages is the UI). */
+  localUi?: boolean | string;
+  /** Override the default GitHub Pages app URL. */
+  uiUrl?: string;
+  /** Inject a local system address-book reader; used only after an import request. */
+  systemContactsReader?: (storeDir: string) => Promise<unknown[]>;
   emailLiveFactory?: (config: unknown) => unknown;
   /** Periodic pull of a connected mailbox; `false` turns it off. */
   emailPoll?: false | { intervalMs?: number; firstMs?: number };

package/js/src/server/aggregate.js

@@ -63,7 +63,18 @@ const addPerson = (entry, person) => {
   entry.name ??= person.name ?? null;
   entry.handle ??= person.handle ?? null;
   // A private chat is addressed by the person's own id.
-  entry.open ??= { source: person.source, chat: String(person.user) };
+  if (person.source !== 'addressbook') {
+    entry.open ??= { source: person.source, chat: String(person.user) };
+  }
+  if (person.emails?.length) {
+    entry.emails = person.emails;
+  }
+  if (person.phones?.length) {
+    entry.phones = person.phones;
+  }
+  if (person.organization) {
+    entry.organization = person.organization;
+  }
   if (person.contact) {
     entry.contact = true;
   }

package/js/src/server/confirmations.js

@@ -46,6 +46,7 @@ export const withoutToken = (body = {}) => {
 export const createConfirmations = ({
   ttlMs = CONFIRM_TTL_MS,
   now = () => Date.now(),
+  maxPending = MAX_PENDING,
 } = {}) => {
   const pending = new Map();
   const digest = (action, payload) =>
@@ -55,7 +56,7 @@ export const createConfirmations = ({
   const prune = () => {
     const at = now();
     for (const [token, entry] of pending) {
-      if (entry.expires <= at || pending.size > MAX_PENDING) {
+      if (entry.expires <= at || pending.size >= maxPending) {
         pending.delete(token);
       }
     }

package/js/src/server/cors.js

@@ -15,23 +15,23 @@
  *   - origins on the allow-list get `Access-Control-Allow-Origin`
  *     echoed back, plus a preflight answer that also opts in to
  *     Chrome's Private Network Access check;
- *   - every other origin gets no CORS headers, a 403 on preflight and
- *     a 403 on state-changing methods, so a random website cannot
+ *   - every other origin gets no CORS headers and a 403 on every method,
+ *     so a random website cannot
  *     post `text/plain` bodies (which skip preflight) to the store.
  *
- * The allow-list defaults to the official hosted app plus the
- * Capacitor WebView origins, and can be replaced with the
+ * The allow-list defaults only to the official GitHub Pages origin.
+ * Same-origin localhost is checked separately. Other embedders explicitly
+ * configure their WebView origin. The list can be replaced with the
  * `MS_ALLOW_ORIGINS` environment variable or `serve --allow-origin=`
  * (comma/space separated; `none` disables cross-origin access).
  */
 
+import { fail } from './util.js';
+
 export const DEFAULT_ALLOWED_ORIGINS = Object.freeze([
   'https://link-foundation.github.io',
-  'https://localhost',
-  'capacitor://localhost',
 ]);
 
-const SAFE_METHODS = new Set(['GET', 'HEAD']);
 const ALLOWED_METHODS = 'GET, HEAD, PUT, POST, DELETE, OPTIONS';
 const ALLOWED_HEADERS = 'content-type';
 
@@ -75,7 +75,11 @@ const LOOPBACK_NAMES = new Set(['127.0.0.1', 'localhost', '[::1]']);
 const parseHost = (value) => {
   try {
     const url = new URL(`http://${String(value ?? '')}`);
-    return url.username || url.pathname !== '/' || url.search
+    return url.username ||
+      url.password ||
+      url.pathname !== '/' ||
+      url.search ||
+      url.hash
       ? null
       : { hostname: url.hostname, port: url.port };
   } catch {
@@ -117,7 +121,7 @@ const isSameOrigin = (req, origin) => {
   const host = String(req.headers.host ?? '');
   return (
     hostAllowed(req) &&
-    (origin === `http://${host}` || origin === `https://${host}`)
+    origin === `${req.socket?.encrypted ? 'https' : 'http'}://${host}`
   );
 };
 
@@ -147,14 +151,24 @@ const writeEmpty = (res, status) => {
  */
 export const handleCors = (req, res, allowed) => {
   const verdict = classifyOrigin(req, allowed);
+  res.setHeader('vary', 'Origin');
   if (verdict === 'allowed') {
     res.setHeader('access-control-allow-origin', req.headers.origin);
-    res.setHeader('vary', 'Origin');
   }
   const preflight =
     req.method === 'OPTIONS' && req.headers['access-control-request-method'];
   if (preflight) {
-    if (verdict !== 'allowed') {
+    const method = req.headers['access-control-request-method'];
+    const headers = String(req.headers['access-control-request-headers'] ?? '')
+      .toLowerCase()
+      .split(',')
+      .map((h) => h.trim())
+      .filter(Boolean);
+    if (
+      verdict !== 'allowed' ||
+      !ALLOWED_METHODS.split(', ').includes(method) ||
+      headers.some((h) => h !== ALLOWED_HEADERS)
+    ) {
       writeEmpty(res, 403);
       return true;
     }
@@ -167,8 +181,14 @@ export const handleCors = (req, res, allowed) => {
     writeEmpty(res, 204);
     return true;
   }
-  if (verdict === 'denied' && !SAFE_METHODS.has(req.method)) {
-    writeEmpty(res, 403);
+  // Cross-site no-cors image/form requests omit Origin. Only the tiny
+  // public discovery beacon may be read this way; no API or stream may.
+  const foreignWithoutOrigin =
+    verdict === 'none' &&
+    req.headers['sec-fetch-site'] === 'cross-site' &&
+    req.url?.split('?')[0] !== '/api/beacon.svg';
+  if (verdict === 'denied' || foreignWithoutOrigin) {
+    fail(res, 403, 'forbidden', 'origin is not allowed');
     return true;
   }
   return false;

package/js/src/server/hosted-ui.js

@@ -4,10 +4,10 @@
  * By default it is the hosted one on GitHub Pages: a static bundle that
  * finds this server (./../web/discover.js) and becomes the full app
  * through it, so the server does not have to host a web site. The copy
- * the server serves itself stays as a fallback — for Safari, which does
- * not let an https page talk to http://127.0.0.1, and for a machine
- * without internet — and can be turned off (`serve --local-ui=false`
- * or `MS_LOCAL_UI=off`); `/` then sends the browser to the hosted app.
+ * the server serves itself is an opt-in fallback for offline use:
+ * `serve --local-ui=true` or `MS_LOCAL_UI=on`. By default `/` sends the
+ * browser to the hosted app. Safari uses the local HTTPS API after the
+ * server's certificate is trusted; it does not need the local UI.
  *
  * The hosted app finds the server by itself, on our port (8787) and the
  * few others it looks at (DEFAULT_PORTS in ../web/discover.js); no
@@ -19,7 +19,8 @@
  * Safari refuses the hosted page's requests to http://127.0.0.1 but
  * still shows it images from there, so the server answers one small
  * picture (BEACON_PATH) whose size says "here I am" and whether its own
- * copy is on; the hosted page then links that copy (../web/discover.js).
+ * copy is on; the hosted page offers certificate setup and links the
+ * optional local copy only when enabled (../web/discover.js).
  * With cross-origin use off (`--allow-origin=none`) there is no picture.
  *
  * With HTTPS on (./local-tls.js, R-Y64) Safari can use the server at
@@ -49,10 +50,10 @@ export const hostedUiUrl = (value = process.env.MS_UI_URL) => {
   }
 };
 
-/** Whether the server serves its own copy of the app (default yes). */
+/** Whether the server serves its own copy of the app (default no). */
 export const localUiEnabled = (value = process.env.MS_LOCAL_UI) =>
   value === undefined || value === null || value === true
-    ? true
+    ? value === true
     : !OFF.has(String(value).trim().toLowerCase());
 
 /** Whether the hosted app looks for a server on this port by itself. */
@@ -105,9 +106,10 @@ export const serveBeacon = (req, res, p, ctx) => {
   return true;
 };
 
-const TRUST_PAGE = (secure, port, uiUrl) => `<!doctype html>
+const TRUST_PAGE = (secure, port, uiUrl, fingerprint) => `<!doctype html>
 <html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
 <title>meta-sovereign server</title></head><body>
+<p>Certificate SHA-256: <code>${fingerprint}</code></p>
 ${
   secure
     ? `<h1>This browser trusts the meta-sovereign server</h1>
@@ -117,7 +119,7 @@ ${
 <p>To let Safari reach this server from the app, open
 <a href="https://127.0.0.1:${port}/trust">https://127.0.0.1:${port}/trust</a>,
 choose Show Details, then visit this website, and enter your password.
-Or run <code>npx -y meta-sovereign trust</code>.</p>`
+Or run <code>node js/bin/meta-sovereign.js trust</code>.</p>`
 }
 </body></html>
 `;
@@ -131,7 +133,12 @@ export const serveTrust = (req, res, p, ctx) => {
     return false;
   }
   const port = req.socket?.localPort ?? 8787;
-  const body = TRUST_PAGE(Boolean(req.socket?.encrypted), port, ctx.uiUrl);
+  const body = TRUST_PAGE(
+    Boolean(req.socket?.encrypted),
+    port,
+    ctx.uiUrl,
+    ctx.tls.fingerprint
+  );
   res.writeHead(200, {
     'content-type': 'text/html; charset=utf-8',
     'cache-control': 'no-store',