mk-https 1.0.0

package/dist/index.js

@@ -0,0 +1,1109 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { Command, Option } from "commander";
+import chalk8 from "chalk";
+
+// src/commands/init.ts
+import { mkdir as mkdir2 } from "fs/promises";
+import path7 from "path";
+import chalk from "chalk";
+import ora2 from "ora";
+import { input } from "@inquirer/prompts";
+
+// src/lib/elevation.ts
+import { writeFile, unlink } from "fs/promises";
+import path from "path";
+import os from "os";
+import { execa } from "execa";
+var ELEVATED_FLAG = "--elevated";
+async function isElevated() {
+  if (process.platform === "win32") {
+    try {
+      const result = await execa("net", ["session"], { reject: false, all: true });
+      return result.exitCode === 0;
+    } catch {
+      return false;
+    }
+  }
+  return process.getuid !== void 0 && process.getuid() === 0;
+}
+async function elevateUnix() {
+  const scriptPath = process.argv[1];
+  if (!scriptPath) {
+    throw new Error("Cannot determine script path for sudo re-invocation.");
+  }
+  const args = process.argv.slice(2).filter((a) => a !== ELEVATED_FLAG);
+  try {
+    await execa("sudo", [scriptPath, ...args, ELEVATED_FLAG], {
+      stdio: "inherit"
+    });
+  } catch {
+    process.stderr.write(
+      `sudo failed. To run manually with elevated privileges:
+  sudo ${scriptPath} ${args.join(" ")} ${ELEVATED_FLAG}
+`
+    );
+    process.exit(1);
+  }
+  process.exit(0);
+}
+async function elevateWindows() {
+  const scriptPath = process.argv[1];
+  if (!scriptPath) {
+    throw new Error("Cannot determine script path for UAC re-invocation.");
+  }
+  const args = process.argv.slice(2).filter((a) => a !== ELEVATED_FLAG);
+  const cmdLine = [scriptPath, ...args, ELEVATED_FLAG].map((a) => `"${a.replace(/"/g, '\\"')}"`).join(" ");
+  const ps1Path = path.join(os.tmpdir(), `mk-https-elevate-${process.pid}.ps1`);
+  const script = `Start-Process node -Verb RunAs -ArgumentList ${cmdLine} -Wait
+`;
+  await writeFile(ps1Path, script, "utf-8");
+  try {
+    await execa("powershell", [
+      "-ExecutionPolicy",
+      "Bypass",
+      "-NonInteractive",
+      "-File",
+      ps1Path
+    ]);
+  } finally {
+    await unlink(ps1Path).catch(() => void 0);
+  }
+  process.exit(0);
+}
+async function requireElevation() {
+  if (await isElevated()) return;
+  process.stderr.write(
+    "This operation modifies /etc/hosts and requires administrator privileges.\n"
+  );
+  if (process.platform === "win32") {
+    await elevateWindows();
+  } else {
+    await elevateUnix();
+  }
+}
+
+// src/lib/hosts.ts
+import { readFile, writeFile as writeFile2 } from "fs/promises";
+import path2 from "path";
+var MARKER_START = "# mk-https:start";
+var MARKER_END = "# mk-https:end";
+var ALLOWED_TLDS = [".local", ".test", ".localhost", ".internal"];
+function hostsPath() {
+  if (process.platform === "win32") {
+    return path2.join(
+      process.env["SystemRoot"] ?? "C:\\Windows",
+      "System32",
+      "drivers",
+      "etc",
+      "hosts"
+    );
+  }
+  return "/etc/hosts";
+}
+function validateDomain(domain) {
+  if (!ALLOWED_TLDS.some((tld) => domain.endsWith(tld))) return false;
+  const LABEL_REGEX = /^[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?$/;
+  const labels = domain.split(".");
+  if (labels.length < 2) return false;
+  return labels.every((label) => LABEL_REGEX.test(label));
+}
+async function readHostsContent() {
+  return readFile(hostsPath(), "utf-8");
+}
+async function writeHostsContent(content) {
+  await writeFile2(hostsPath(), content, "utf-8");
+}
+function hasMarkers(content) {
+  return content.includes(MARKER_START) && content.includes(MARKER_END);
+}
+function buildDomainLines(domains) {
+  return domains.flatMap((d) => [`127.0.0.1 ${d}`, `::1 ${d}`]).join("\n");
+}
+function insertMarkersBlock(content, domains) {
+  const separator = content.endsWith("\n") ? "" : "\n";
+  const block = `${MARKER_START}
+${buildDomainLines(domains)}
+${MARKER_END}
+`;
+  return `${content}${separator}${block}`;
+}
+function replaceMarkersBlock(content, domains) {
+  const startIdx = content.indexOf(MARKER_START);
+  const endIdx = content.indexOf(MARKER_END);
+  if (startIdx === -1 || endIdx === -1) {
+    return insertMarkersBlock(content, domains);
+  }
+  const before = content.slice(0, startIdx);
+  const after = content.slice(endIdx + MARKER_END.length);
+  const block = `${MARKER_START}
+${buildDomainLines(domains)}
+${MARKER_END}`;
+  return `${before}${block}${after}`;
+}
+function stripMarkersBlock(content) {
+  const startIdx = content.indexOf(MARKER_START);
+  const endIdx = content.indexOf(MARKER_END);
+  if (startIdx === -1 || endIdx === -1) return content;
+  const before = content.slice(0, startIdx);
+  const afterMarker = content.slice(endIdx + MARKER_END.length);
+  const after = afterMarker.startsWith("\n") ? afterMarker.slice(1) : afterMarker;
+  return `${before}${after}`;
+}
+async function syncHostsEntries(domains) {
+  let content;
+  try {
+    content = await readHostsContent();
+  } catch {
+    content = "";
+  }
+  const updated = hasMarkers(content) ? replaceMarkersBlock(content, domains) : insertMarkersBlock(content, domains);
+  await writeHostsContent(updated);
+}
+async function removeHostsEntries() {
+  let content;
+  try {
+    content = await readHostsContent();
+  } catch {
+    return;
+  }
+  await writeHostsContent(stripMarkersBlock(content));
+}
+async function getHostedDomains() {
+  let content;
+  try {
+    content = await readHostsContent();
+  } catch {
+    return [];
+  }
+  if (!hasMarkers(content)) return [];
+  const startIdx = content.indexOf(MARKER_START);
+  const endIdx = content.indexOf(MARKER_END);
+  const block = content.slice(startIdx + MARKER_START.length, endIdx);
+  return block.split("\n").map((line) => line.trim()).filter((line) => line.startsWith("127.0.0.1 ") || line.startsWith("::1 ")).map((line) => {
+    if (line.startsWith("127.0.0.1 ")) return line.slice("127.0.0.1 ".length).trim();
+    return line.slice("::1 ".length).trim();
+  }).filter((domain, index, arr) => arr.indexOf(domain) === index);
+}
+
+// src/lib/config.ts
+import { readFile as readFile2, writeFile as writeFile3, mkdir } from "fs/promises";
+import { existsSync } from "fs";
+import path3 from "path";
+var CONFIG_VERSION = "1.0.0";
+var CONFIG_DIR = ".mk-https";
+var CONFIG_FILE = path3.join(CONFIG_DIR, "mk-https.json");
+function resolveConfigPath() {
+  return path3.resolve(process.cwd(), CONFIG_FILE);
+}
+function resolveConfigDir() {
+  return path3.resolve(process.cwd(), CONFIG_DIR);
+}
+function configExists() {
+  return existsSync(resolveConfigPath());
+}
+function isValidConfig(obj) {
+  if (typeof obj !== "object" || obj === null) return false;
+  const c = obj;
+  return typeof c["version"] === "string" && Array.isArray(c["domains"]) && c["domains"].every((d) => typeof d === "string") && typeof c["certPath"] === "string" && typeof c["keyPath"] === "string" && (c["framework"] === null || typeof c["framework"] === "string") && typeof c["createdAt"] === "string" && typeof c["updatedAt"] === "string";
+}
+async function readConfig() {
+  let raw;
+  try {
+    raw = await readFile2(resolveConfigPath(), "utf-8");
+  } catch {
+    throw new Error(
+      "No mk-https.json found. Run `mk-https init` to set up HTTPS for this project."
+    );
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error(
+      "mk-https.json contains invalid JSON. Delete the .mk-https/ directory and run `mk-https init` to start fresh."
+    );
+  }
+  if (!isValidConfig(parsed)) {
+    throw new Error(
+      "mk-https.json has an unrecognized schema. Delete the .mk-https/ directory and run `mk-https init` to start fresh."
+    );
+  }
+  if (parsed.version !== CONFIG_VERSION) {
+    process.stderr.write(
+      `Warning: mk-https.json schema version ${parsed.version} differs from expected ${CONFIG_VERSION}. Some features may behave unexpectedly. Consider running \`mk-https clean && mk-https init\`.
+`
+    );
+  }
+  return parsed;
+}
+async function writeConfig(config) {
+  await mkdir(resolveConfigDir(), { recursive: true });
+  const toWrite = {
+    ...config,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await writeFile3(
+    resolveConfigPath(),
+    JSON.stringify(toWrite, null, 2) + "\n",
+    "utf-8"
+  );
+}
+
+// src/lib/gitignore.ts
+import { readFile as readFile3, writeFile as writeFile4 } from "fs/promises";
+import { existsSync as existsSync2 } from "fs";
+import path4 from "path";
+var MARKER_START2 = "# mk-https:start";
+var MARKER_END2 = "# mk-https:end";
+var GITIGNORE_ENTRY = ".mk-https/";
+function resolveGitignorePath() {
+  return path4.resolve(process.cwd(), ".gitignore");
+}
+function isCoveredByPattern(line) {
+  const trimmed = line.trim();
+  if (trimmed === GITIGNORE_ENTRY || trimmed === ".mk-https") return true;
+  if (trimmed === ".*" || trimmed === ".*/" || trimmed === ".*/**") return true;
+  return false;
+}
+async function isAlreadyIgnored() {
+  const gitignorePath = resolveGitignorePath();
+  if (!existsSync2(gitignorePath)) return false;
+  let content;
+  try {
+    content = await readFile3(gitignorePath, "utf-8");
+  } catch {
+    return false;
+  }
+  return content.split("\n").some(isCoveredByPattern);
+}
+async function addToGitignore() {
+  if (await isAlreadyIgnored()) return;
+  const gitignorePath = resolveGitignorePath();
+  let existing = "";
+  if (existsSync2(gitignorePath)) {
+    try {
+      existing = await readFile3(gitignorePath, "utf-8");
+    } catch {
+      existing = "";
+    }
+  }
+  const separator = existing && !existing.endsWith("\n") ? "\n" : "";
+  const block = `${MARKER_START2}
+${GITIGNORE_ENTRY}
+${MARKER_END2}
+`;
+  await writeFile4(gitignorePath, `${existing}${separator}${block}`, "utf-8");
+}
+async function removeFromGitignore() {
+  const gitignorePath = resolveGitignorePath();
+  if (!existsSync2(gitignorePath)) return;
+  let content;
+  try {
+    content = await readFile3(gitignorePath, "utf-8");
+  } catch {
+    return;
+  }
+  const startIdx = content.indexOf(MARKER_START2);
+  const endIdx = content.indexOf(MARKER_END2);
+  if (startIdx === -1 || endIdx === -1) return;
+  const before = content.slice(0, startIdx);
+  const afterMarker = content.slice(endIdx + MARKER_END2.length);
+  const after = afterMarker.startsWith("\n") ? afterMarker.slice(1) : afterMarker;
+  await writeFile4(gitignorePath, `${before}${after}`, "utf-8");
+}
+
+// src/lib/mkcert.ts
+import { chown } from "fs/promises";
+import { existsSync as existsSync3 } from "fs";
+import path5 from "path";
+import { execa as execa2 } from "execa";
+import ora from "ora";
+var MKCERT_INSTALL_URL = "https://github.com/FiloSottile/mkcert#installation";
+async function which(bin) {
+  const cmd = process.platform === "win32" ? "where" : "which";
+  try {
+    const result = await execa2(cmd, [bin], { reject: false });
+    if (result.exitCode === 0 && result.stdout.trim()) {
+      return result.stdout.trim().split("\n")[0]?.trim() ?? null;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+async function hasBin(name) {
+  return await which(name) !== null;
+}
+async function detectMkcert() {
+  return which("mkcert");
+}
+async function installOnMacos() {
+  if (!await hasBin("brew")) {
+    throw new Error(
+      `Homebrew is not installed. Install mkcert manually:
+  ${MKCERT_INSTALL_URL}`
+    );
+  }
+  await execa2("brew", ["install", "mkcert"], { stdio: "inherit" });
+}
+async function installOnLinux() {
+  if (await hasBin("brew")) {
+    await execa2("brew", ["install", "mkcert"], { stdio: "inherit" });
+    return;
+  }
+  if (await hasBin("snap")) {
+    await execa2("snap", ["install", "mkcert"], { stdio: "inherit" });
+    return;
+  }
+  if (await hasBin("apt-get")) {
+    await execa2("apt-get", ["install", "-y", "libnss3-tools"], { stdio: "inherit" });
+    try {
+      await execa2("apt-get", ["install", "-y", "mkcert"], { stdio: "inherit" });
+      return;
+    } catch {
+    }
+  }
+  throw new Error(
+    `No supported package manager found (brew, snap, apt-get).
+Install mkcert manually:
+  ${MKCERT_INSTALL_URL}`
+  );
+}
+async function installOnWindows() {
+  if (await hasBin("choco")) {
+    await execa2("choco", ["install", "mkcert", "-y"], { stdio: "inherit" });
+    return;
+  }
+  if (await hasBin("scoop")) {
+    await execa2("scoop", ["install", "mkcert"], { stdio: "inherit" });
+    return;
+  }
+  throw new Error(
+    `No supported package manager found (choco, scoop).
+Install mkcert manually:
+  ${MKCERT_INSTALL_URL}`
+  );
+}
+async function installMkcert() {
+  const spinner = ora("Installing mkcert...").start();
+  try {
+    if (process.platform === "darwin") {
+      spinner.stop();
+      await installOnMacos();
+    } else if (process.platform === "linux") {
+      spinner.stop();
+      await installOnLinux();
+    } else if (process.platform === "win32") {
+      spinner.stop();
+      await installOnWindows();
+    } else {
+      spinner.fail(`Unsupported platform: ${process.platform}`);
+      throw new Error(
+        `Unsupported platform. Install mkcert manually:
+  ${MKCERT_INSTALL_URL}`
+      );
+    }
+  } catch (err) {
+    spinner.fail("mkcert installation failed");
+    throw err;
+  }
+}
+async function ensureMkcert() {
+  const existing = await detectMkcert();
+  if (existing) return existing;
+  process.stdout.write("mkcert not found. Attempting to install...\n");
+  await installMkcert();
+  const installed = await detectMkcert();
+  if (!installed) {
+    throw new Error(
+      `mkcert was not found after installation. Install it manually:
+  ${MKCERT_INSTALL_URL}`
+    );
+  }
+  return installed;
+}
+async function getCARootPath() {
+  const result = await execa2("mkcert", ["-CAROOT"]);
+  return result.stdout.trim();
+}
+async function caRootExists() {
+  try {
+    const caRoot = await getCARootPath();
+    return existsSync3(path5.join(caRoot, "rootCA.pem")) && existsSync3(path5.join(caRoot, "rootCA-key.pem"));
+  } catch {
+    return false;
+  }
+}
+async function installCA() {
+  const spinner = ora("Installing local CA (may prompt for password)...").start();
+  try {
+    await execa2("mkcert", ["-install"], { stdio: "inherit" });
+    spinner.succeed("Local CA installed and trusted");
+  } catch {
+    spinner.fail("Failed to install local CA");
+    throw new Error(
+      "Could not install the local CA. Try running `mkcert -install` manually."
+    );
+  }
+}
+function getSudoOriginalUser() {
+  const uid = parseInt(process.env["SUDO_UID"] ?? "", 10);
+  const gid = parseInt(process.env["SUDO_GID"] ?? "", 10);
+  if (isNaN(uid) || isNaN(gid)) return null;
+  if (typeof process.getuid === "function" && process.getuid() === uid) return null;
+  return { uid, gid };
+}
+async function grantReadToUsersWindows(filePath) {
+  await execa2("icacls", [filePath, "/grant", "Users:R"], { reject: false });
+}
+async function generateCert(domains, certPath, keyPath) {
+  await execa2(
+    "mkcert",
+    ["-cert-file", certPath, "-key-file", keyPath, ...domains],
+    { stdio: "inherit" }
+  );
+  if (process.platform === "win32") {
+    await Promise.all([
+      grantReadToUsersWindows(certPath),
+      grantReadToUsersWindows(keyPath)
+    ]);
+  } else {
+    const originalUser = getSudoOriginalUser();
+    if (originalUser) {
+      await Promise.all([
+        chown(certPath, originalUser.uid, originalUser.gid),
+        chown(keyPath, originalUser.uid, originalUser.gid)
+      ]);
+    }
+  }
+}
+
+// src/lib/frameworks.ts
+import { readFile as readFile4 } from "fs/promises";
+import { existsSync as existsSync4 } from "fs";
+import path6 from "path";
+import semver from "semver";
+function fileExists(...segments) {
+  return existsSync4(path6.resolve(process.cwd(), ...segments));
+}
+async function readJson(filePath) {
+  try {
+    const raw = await readFile4(path6.resolve(process.cwd(), filePath), "utf-8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed === "object" && parsed !== null) {
+      return parsed;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+async function detectFramework() {
+  const nextConfigs = ["next.config.ts", "next.config.js", "next.config.mjs", "next.config.cjs"];
+  for (const f of nextConfigs) {
+    if (fileExists(f)) return "nextjs";
+  }
+  const viteConfigs = ["vite.config.ts", "vite.config.js", "vite.config.mjs"];
+  for (const f of viteConfigs) {
+    if (fileExists(f)) return "vite";
+  }
+  if (fileExists("angular.json")) return "angular";
+  const pkg = await readJson("package.json");
+  if (pkg) {
+    const deps = {
+      ...pkg["dependencies"],
+      ...pkg["devDependencies"]
+    };
+    if ("next" in deps) return "nextjs";
+    if ("vite" in deps) return "vite";
+    if ("express" in deps) return "express";
+    if ("@angular/core" in deps) return "angular";
+  }
+  return null;
+}
+async function getNextjsVersion() {
+  const pkg = await readJson("package.json");
+  if (!pkg) return null;
+  const deps = {
+    ...pkg["dependencies"],
+    ...pkg["devDependencies"]
+  };
+  const raw = deps["next"];
+  if (!raw) return null;
+  return semver.coerce(raw)?.version ?? null;
+}
+function getConfigSnippet(framework, certPath, keyPath, nextjsVersion) {
+  switch (framework) {
+    case "nextjs":
+      return getNextjsSnippet(certPath, keyPath, nextjsVersion ?? null);
+    case "vite":
+      return getViteSnippet(certPath, keyPath);
+    case "express":
+      return getExpressSnippet(certPath, keyPath);
+    case "angular":
+      return getAngularSnippet(certPath, keyPath);
+  }
+}
+function getNextjsSnippet(certPath, keyPath, version) {
+  const isGte14 = version ? semver.gte(version, "14.0.0") : false;
+  const isGte131 = version ? semver.gte(version, "13.1.0") : true;
+  const caveat = isGte14 ? "\n// Note (Next.js 14+ App Router): local HTTPS dev server works with experimental.https,\n// but some middleware and edge features may behave differently over HTTPS." : "";
+  if (isGte131) {
+    return `// next.config.ts (or next.config.js)${caveat}
+const nextConfig = {
+  experimental: {
+    https: {
+      key: '${keyPath}',
+      cert: '${certPath}',
+    },
+  },
+};
+
+export default nextConfig;`;
+  }
+  return `// next.config.js (Next.js < 13.1 \u2014 requires a custom HTTPS server)
+// Create a server.js at your project root:
+//
+// import https from 'https';
+// import { readFileSync } from 'fs';
+// import { createServer } from 'http';
+// import next from 'next';
+//
+// const app = next({ dev: process.env.NODE_ENV !== 'production' });
+// const handle = app.getRequestHandler();
+// const opts = { key: readFileSync('${keyPath}'), cert: readFileSync('${certPath}') };
+//
+// app.prepare().then(() => {
+//   https.createServer(opts, (req, res) => handle(req, res)).listen(3000);
+// });`;
+}
+function getViteSnippet(certPath, keyPath) {
+  return `// vite.config.ts
+import { defineConfig } from 'vite';
+import fs from 'fs';
+
+export default defineConfig({
+  server: {
+    https: {
+      key: fs.readFileSync('${keyPath}'),
+      cert: fs.readFileSync('${certPath}'),
+    },
+  },
+});`;
+}
+function getExpressSnippet(certPath, keyPath) {
+  return `// In your server entry file (e.g. server.js / index.js)
+import https from 'https';
+import { readFileSync } from 'fs';
+import app from './app.js'; // your Express app
+
+const server = https.createServer(
+  {
+    key: readFileSync('${keyPath}'),
+    cert: readFileSync('${certPath}'),
+  },
+  app,
+);
+
+server.listen(443, () => {
+  console.log('HTTPS server listening on port 443');
+});`;
+}
+function getAngularSnippet(certPath, keyPath) {
+  return `// In angular.json, under projects.<your-project>.architect.serve.options:
+{
+  "ssl": true,
+  "sslKey": "${keyPath}",
+  "sslCert": "${certPath}"
+}
+
+// Or pass flags directly:
+// ng serve --ssl --ssl-key ${keyPath} --ssl-cert ${certPath}`;
+}
+
+// src/commands/init.ts
+var CERT_PATH = path7.join(CONFIG_DIR, "cert.pem");
+var KEY_PATH = path7.join(CONFIG_DIR, "key.pem");
+async function promptDomains() {
+  const domain = await input({
+    message: "Primary domain (e.g. myapp.local):",
+    validate: (raw) => validateDomain(raw.trim()) || "Must be a valid local domain (e.g. myapp.local, myapp.test)"
+  });
+  const extra = await input({
+    message: "Additional domains? (comma-separated, leave blank to skip):",
+    default: ""
+  });
+  const additional = extra.split(",").map((d) => d.trim()).filter((d) => d.length > 0);
+  const invalid = additional.filter((d) => !validateDomain(d));
+  if (invalid.length) {
+    process.stderr.write(
+      chalk.yellow(`Skipping invalid domains: ${invalid.join(", ")}
+`)
+    );
+  }
+  return [domain.trim(), ...additional.filter((d) => validateDomain(d))];
+}
+async function initCommand(options) {
+  if (!options.elevated) {
+    await requireElevation();
+  }
+  let domains;
+  let framework;
+  let fromExisting = false;
+  let existing;
+  if (configExists()) {
+    existing = await readConfig();
+    domains = existing.domains;
+    framework = existing.framework;
+    fromExisting = true;
+    process.stdout.write(
+      chalk.dim(`Using existing config: ${domains.join(", ")}
+`)
+    );
+  } else if (options.domains?.length) {
+    const invalid = options.domains.filter((d) => !validateDomain(d));
+    if (invalid.length) {
+      throw new Error(`Invalid domain(s): ${invalid.join(", ")}`);
+    }
+    domains = options.domains;
+    framework = await detectFramework();
+    if (framework) {
+      process.stdout.write(chalk.dim(`Detected framework: ${framework}
+`));
+    }
+  } else {
+    domains = await promptDomains();
+    framework = await detectFramework();
+    if (framework) {
+      process.stdout.write(chalk.dim(`Detected framework: ${framework}
+`));
+    }
+  }
+  await ensureMkcert();
+  if (!await caRootExists()) {
+    process.stdout.write(
+      chalk.yellow("Local CA not found \u2014 installing (this runs mkcert -install)...\n")
+    );
+    await installCA();
+  }
+  await mkdir2(path7.resolve(process.cwd(), CONFIG_DIR), { recursive: true });
+  const certAbsPath = path7.resolve(process.cwd(), CERT_PATH);
+  const keyAbsPath = path7.resolve(process.cwd(), KEY_PATH);
+  const spinner = ora2(`Generating certificate for ${domains.join(", ")}...`).start();
+  try {
+    await generateCert(domains, certAbsPath, keyAbsPath);
+    spinner.succeed(`Certificate generated \u2192 ${CERT_PATH}`);
+  } catch (err) {
+    spinner.fail("Certificate generation failed");
+    throw err;
+  }
+  const hostsSpinner = ora2("Updating /etc/hosts...").start();
+  try {
+    await syncHostsEntries(domains);
+    hostsSpinner.succeed("/etc/hosts updated");
+  } catch (err) {
+    hostsSpinner.fail("Failed to update /etc/hosts");
+    throw err;
+  }
+  await addToGitignore();
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const config = fromExisting ? { ...existing, updatedAt: now } : {
+    version: CONFIG_VERSION,
+    domains,
+    certPath: CERT_PATH,
+    keyPath: KEY_PATH,
+    framework,
+    createdAt: now,
+    updatedAt: now
+  };
+  await writeConfig(config);
+  process.stdout.write("\n" + chalk.green("\u2714 HTTPS is ready.\n\n"));
+  if (framework) {
+    let snippet;
+    if (framework === "nextjs") {
+      const version = await getNextjsVersion();
+      snippet = getNextjsSnippet(CERT_PATH, KEY_PATH, version);
+    } else {
+      snippet = getConfigSnippet(framework, CERT_PATH, KEY_PATH);
+    }
+    process.stdout.write(chalk.bold("Add this to your framework config:\n\n"));
+    process.stdout.write(chalk.cyan(snippet) + "\n\n");
+  }
+  const domainList = domains.map((d) => chalk.underline(`https://${d}`)).join(", ");
+  process.stdout.write(`Your app will be available at: ${domainList}
+`);
+}
+
+// src/commands/add.ts
+import path8 from "path";
+import chalk2 from "chalk";
+import ora3 from "ora";
+async function addCommand(domain, options) {
+  if (!options.elevated) {
+    await requireElevation();
+  }
+  const trimmed = domain.trim();
+  if (!validateDomain(trimmed)) {
+    process.stderr.write(
+      chalk2.red(
+        `Invalid domain: "${trimmed}". Domain must be a valid local hostname (e.g. api.myapp.local, api.myapp.test).
+`
+      )
+    );
+    process.exit(1);
+  }
+  const config = await readConfig();
+  if (config.domains.includes(trimmed)) {
+    process.stdout.write(chalk2.yellow(`Domain "${trimmed}" is already in your config.
+`));
+    return;
+  }
+  const newDomains = [...config.domains, trimmed];
+  const certAbsPath = path8.resolve(process.cwd(), config.certPath);
+  const keyAbsPath = path8.resolve(process.cwd(), config.keyPath);
+  const certSpinner = ora3(`Regenerating certificate for ${newDomains.join(", ")}...`).start();
+  try {
+    await generateCert(newDomains, certAbsPath, keyAbsPath);
+    certSpinner.succeed("Certificate regenerated");
+  } catch (err) {
+    certSpinner.fail("Certificate generation failed");
+    throw err;
+  }
+  const hostsSpinner = ora3(`Adding ${trimmed} to /etc/hosts...`).start();
+  try {
+    await syncHostsEntries(newDomains);
+    hostsSpinner.succeed("/etc/hosts updated");
+  } catch (err) {
+    hostsSpinner.fail("Failed to update /etc/hosts");
+    throw err;
+  }
+  await writeConfig({ ...config, domains: newDomains });
+  process.stdout.write(chalk2.green(`\u2714 Added ${trimmed}
+`));
+}
+
+// src/commands/remove.ts
+import path9 from "path";
+import chalk3 from "chalk";
+import ora4 from "ora";
+async function removeCommand(domain, options) {
+  if (!options.elevated) {
+    await requireElevation();
+  }
+  const trimmed = domain.trim();
+  const config = await readConfig();
+  if (!config.domains.includes(trimmed)) {
+    process.stdout.write(
+      chalk3.yellow(`Domain "${trimmed}" is not in your config. Nothing to remove.
+`)
+    );
+    return;
+  }
+  const newDomains = config.domains.filter((d) => d !== trimmed);
+  if (newDomains.length === 0) {
+    process.stdout.write(
+      chalk3.yellow(
+        "Removing this domain would leave no domains configured. Run `mk-https clean` to remove all HTTPS config, or add another domain first.\n"
+      )
+    );
+    return;
+  }
+  const certAbsPath = path9.resolve(process.cwd(), config.certPath);
+  const keyAbsPath = path9.resolve(process.cwd(), config.keyPath);
+  const certSpinner = ora4(`Regenerating certificate for ${newDomains.join(", ")}...`).start();
+  try {
+    await generateCert(newDomains, certAbsPath, keyAbsPath);
+    certSpinner.succeed("Certificate regenerated");
+  } catch (err) {
+    certSpinner.fail("Certificate generation failed");
+    throw err;
+  }
+  const hostsSpinner = ora4(`Removing ${trimmed} from /etc/hosts...`).start();
+  try {
+    await syncHostsEntries(newDomains);
+    hostsSpinner.succeed("/etc/hosts updated");
+  } catch (err) {
+    hostsSpinner.fail("Failed to update /etc/hosts");
+    throw err;
+  }
+  await writeConfig({ ...config, domains: newDomains });
+  process.stdout.write(chalk3.green(`\u2714 Removed ${trimmed}
+`));
+}
+
+// src/commands/status.ts
+import { readFile as readFile5 } from "fs/promises";
+import { existsSync as existsSync5 } from "fs";
+import path10 from "path";
+import { X509Certificate } from "crypto";
+import chalk4 from "chalk";
+var WARN_DAYS = 30;
+async function parseCertExpiry(certPath) {
+  try {
+    const pem = await readFile5(certPath, "utf-8");
+    const cert = new X509Certificate(pem);
+    return new Date(cert.validTo);
+  } catch {
+    return null;
+  }
+}
+async function statusCommand() {
+  const config = await readConfig();
+  process.stdout.write("\n");
+  process.stdout.write(chalk4.bold("mk-https status\n\n"));
+  process.stdout.write(chalk4.dim("Domains:\n"));
+  for (const domain of config.domains) {
+    process.stdout.write(`  \u2022 https://${domain}
+`);
+  }
+  process.stdout.write("\n");
+  const certAbsPath = path10.resolve(process.cwd(), config.certPath);
+  if (!existsSync5(certAbsPath)) {
+    process.stdout.write(
+      chalk4.red(`Cert file not found: ${config.certPath}
+`) + "Run `mk-https renew` to regenerate.\n\n"
+    );
+  } else {
+    const expiry = await parseCertExpiry(certAbsPath);
+    if (expiry) {
+      const now = Date.now();
+      const daysLeft = Math.floor((expiry.getTime() - now) / 864e5);
+      if (daysLeft < 0) {
+        process.stdout.write(
+          chalk4.red(`Cert expired on ${expiry.toDateString()}. Run \`mk-https renew\`.
+
+`)
+        );
+      } else if (daysLeft < WARN_DAYS) {
+        process.stdout.write(
+          chalk4.yellow(
+            `Cert expires in ${daysLeft} day${daysLeft === 1 ? "" : "s"} (${expiry.toDateString()}). Run \`mk-https renew\` soon.
+
+`
+          )
+        );
+      } else {
+        process.stdout.write(
+          chalk4.green(`Cert valid until ${expiry.toDateString()} (${daysLeft} days)
+
+`)
+        );
+      }
+    } else {
+      process.stdout.write(chalk4.yellow("Could not parse cert expiry date.\n\n"));
+    }
+  }
+  const caOk = await caRootExists();
+  process.stdout.write(
+    caOk ? chalk4.green("\u2714 Local CA trusted\n") : chalk4.red("\u2718 Local CA not trusted \u2014 run `mkcert -install`\n")
+  );
+  const hostedDomains = await getHostedDomains();
+  const allPresent = config.domains.every((d) => hostedDomains.includes(d));
+  const missing = config.domains.filter((d) => !hostedDomains.includes(d));
+  if (allPresent) {
+    process.stdout.write(chalk4.green("\u2714 /etc/hosts entries present\n"));
+  } else {
+    process.stdout.write(
+      chalk4.red(`\u2718 /etc/hosts missing entries: ${missing.join(", ")}
+`) + "  Run `mk-https init` to repair.\n"
+    );
+  }
+  process.stdout.write("\n");
+}
+
+// src/commands/clean.ts
+import { rm } from "fs/promises";
+import chalk5 from "chalk";
+import ora5 from "ora";
+async function cleanCommand(options) {
+  if (!options.elevated) {
+    await requireElevation();
+  }
+  const hostsSpinner = ora5("Removing /etc/hosts entries...").start();
+  try {
+    await removeHostsEntries();
+    hostsSpinner.succeed("/etc/hosts entries removed");
+  } catch (err) {
+    hostsSpinner.fail("Failed to remove /etc/hosts entries");
+    throw err;
+  }
+  const dirSpinner = ora5("Removing .mk-https/ directory...").start();
+  try {
+    await rm(resolveConfigDir(), { recursive: true, force: true });
+    dirSpinner.succeed(".mk-https/ removed");
+  } catch (err) {
+    dirSpinner.fail("Failed to remove .mk-https/");
+    throw err;
+  }
+  await removeFromGitignore();
+  process.stdout.write(chalk5.green("\n\u2714 Cleaned up. Run `mk-https init` to start fresh.\n"));
+}
+
+// src/commands/renew.ts
+import path11 from "path";
+import chalk6 from "chalk";
+import ora6 from "ora";
+async function renewCommand() {
+  const config = await readConfig();
+  const certAbsPath = path11.resolve(process.cwd(), config.certPath);
+  const keyAbsPath = path11.resolve(process.cwd(), config.keyPath);
+  const spinner = ora6(
+    `Renewing certificate for ${config.domains.join(", ")}...`
+  ).start();
+  try {
+    await generateCert(config.domains, certAbsPath, keyAbsPath);
+    spinner.succeed("Certificate renewed");
+  } catch (err) {
+    spinner.fail("Certificate renewal failed");
+    throw err;
+  }
+  await writeConfig(config);
+  process.stdout.write(chalk6.green("\u2714 Certificate renewed successfully.\n"));
+}
+
+// src/lib/doctor.ts
+import { readFile as readFile6 } from "fs/promises";
+import { existsSync as existsSync6 } from "fs";
+import path12 from "path";
+import { X509Certificate as X509Certificate2 } from "crypto";
+import chalk7 from "chalk";
+import { execa as execa3 } from "execa";
+var WARN_DAYS2 = 30;
+function check(ok, label, detail) {
+  const icon = ok ? chalk7.green("\u2714") : chalk7.red("\u2718");
+  const text = ok ? chalk7.white(label) : chalk7.red(label);
+  const suffix = detail ? chalk7.dim(` \u2014 ${detail}`) : "";
+  process.stdout.write(`  ${icon} ${text}${suffix}
+`);
+}
+async function hasBin2(name) {
+  const cmd = process.platform === "win32" ? "where" : "which";
+  try {
+    const result = await execa3(cmd, [name], { reject: false });
+    return result.exitCode === 0;
+  } catch {
+    return false;
+  }
+}
+async function getCertInfo(certPath) {
+  if (!existsSync6(certPath)) return { exists: false, expiry: null, domains: [] };
+  try {
+    const pem = await readFile6(certPath, "utf-8");
+    const cert = new X509Certificate2(pem);
+    const expiry = new Date(cert.validTo);
+    const san = cert.subjectAltName ?? "";
+    const domains = san.split(", ").filter((s) => s.startsWith("DNS:")).map((s) => s.slice(4));
+    return { exists: true, expiry, domains };
+  } catch {
+    return { exists: true, expiry: null, domains: [] };
+  }
+}
+async function runDoctor(config) {
+  process.stdout.write(chalk7.bold("\nmk-https doctor\n\n"));
+  let cfg = config;
+  if (!cfg) {
+    try {
+      cfg = await readConfig();
+    } catch {
+      cfg = void 0;
+    }
+  }
+  const mkcertPath = await detectMkcert();
+  check(mkcertPath !== null, "mkcert installed", mkcertPath ?? void 0);
+  const caOk = await caRootExists();
+  let caDetail;
+  if (caOk) {
+    try {
+      caDetail = await getCARootPath();
+    } catch {
+      caDetail = void 0;
+    }
+  }
+  check(caOk, "Local CA trusted (OS cert store)", caDetail);
+  const certutilOk = await hasBin2("certutil");
+  check(
+    certutilOk,
+    "Firefox trust (NSS certutil present)",
+    certutilOk ? void 0 : "install libnss3-tools (Linux) or nss (macOS/brew) for Firefox support"
+  );
+  if (!cfg) {
+    check(false, "mk-https.json found", "run `mk-https init` to set up this project");
+    process.stdout.write("\n");
+    return;
+  }
+  const certAbsPath = path12.resolve(process.cwd(), cfg.certPath);
+  const keyAbsPath = path12.resolve(process.cwd(), cfg.keyPath);
+  const certInfo = await getCertInfo(certAbsPath);
+  check(certInfo.exists, "Cert file exists", cfg.certPath);
+  check(existsSync6(keyAbsPath), "Key file exists", cfg.keyPath);
+  const allCovered = certInfo.exists && cfg.domains.every((d) => certInfo.domains.includes(d));
+  const uncovered = cfg.domains.filter((d) => !certInfo.domains.includes(d));
+  check(
+    allCovered,
+    "Cert covers all configured domains",
+    uncovered.length ? `missing: ${uncovered.join(", ")}` : void 0
+  );
+  if (certInfo.expiry) {
+    const now = Date.now();
+    const msLeft = certInfo.expiry.getTime() - now;
+    const daysLeft = Math.floor(msLeft / 864e5);
+    const expired = daysLeft < 0;
+    const expiring = daysLeft >= 0 && daysLeft < WARN_DAYS2;
+    const ok = !expired && !expiring;
+    const detail = expired ? "run `mk-https renew`" : expiring ? `expires in ${daysLeft} days \u2014 run \`mk-https renew\`` : `expires ${certInfo.expiry.toDateString()}`;
+    check(ok, expired ? "Cert not expired" : "Cert validity", detail);
+  } else {
+    check(false, "Cert not expired", "could not parse cert");
+  }
+  const hostedDomains = await getHostedDomains();
+  const allHosted = cfg.domains.every((d) => hostedDomains.includes(d));
+  const missingHosts = cfg.domains.filter((d) => !hostedDomains.includes(d));
+  check(
+    allHosted,
+    "/etc/hosts entries present",
+    missingHosts.length ? `missing: ${missingHosts.join(", ")}` : void 0
+  );
+  const versionOk = cfg.version === CONFIG_VERSION;
+  check(
+    versionOk,
+    "mk-https.json schema version current",
+    versionOk ? cfg.version : `found ${cfg.version}, expected ${CONFIG_VERSION}`
+  );
+  process.stdout.write("\n");
+}
+
+// src/index.ts
+var program = new Command();
+program.name("mk-https").description("Zero to https://myapp.local in one command").version("1.0.0");
+var elevatedOption = new Option("--elevated").hideHelp();
+function handleError(err) {
+  const message = err instanceof Error ? err.message : String(err);
+  process.stderr.write(chalk8.red(`
+Error: ${message}
+`));
+  process.exit(1);
+}
+program.command("init").description("Set up HTTPS for this project").option("-d, --domain <domain...>", "domain(s) to configure (skips interactive prompt)").addOption(elevatedOption).action(async (opts) => {
+  await initCommand({ elevated: opts.elevated ?? false, domains: opts.domain }).catch(handleError);
+});
+program.command("add <domain>").description("Add a domain to your local HTTPS config").addOption(elevatedOption).action(async (domain, opts) => {
+  await addCommand(domain, { elevated: opts.elevated ?? false }).catch(handleError);
+});
+program.command("remove <domain>").description("Remove a domain from your local HTTPS config").addOption(elevatedOption).action(async (domain, opts) => {
+  await removeCommand(domain, { elevated: opts.elevated ?? false }).catch(handleError);
+});
+program.command("status").description("Show cert and hosts status for this project").action(async () => {
+  await statusCommand().catch(handleError);
+});
+program.command("clean").description("Remove all mk-https configuration for this project").addOption(elevatedOption).action(async (opts) => {
+  await cleanCommand({ elevated: opts.elevated ?? false }).catch(handleError);
+});
+program.command("renew").description("Renew the certificate without changing /etc/hosts").action(async () => {
+  await renewCommand().catch(handleError);
+});
+program.command("doctor").description("Check the full mk-https environment").action(async () => {
+  await runDoctor().catch(handleError);
+});
+program.parse();