parasor 0.1.0

package/server/lib/sd-notify.js

@@ -0,0 +1,27 @@
+import { spawnSync } from "node:child_process";
+const defaultSpawn = (cmd, args) => {
+    spawnSync(cmd, args, { stdio: "ignore" });
+};
+function notify(payload, deps) {
+    if (!process.env.NOTIFY_SOCKET)
+        return;
+    const spawn = deps?.spawn ?? defaultSpawn;
+    try {
+        spawn("systemd-notify", [payload]);
+    }
+    catch {
+        /*
+         * systemd-notify missing (e.g. NOTIFY_SOCKET leaked from an unusual env
+         * without systemd installed) must not crash the server -- the watchdog
+         * will still fire via systemd's own timeout and the operator will see
+         * the restart in journalctl.
+         */
+    }
+}
+export function notifyReady(deps) {
+    notify("READY=1", deps);
+}
+export function notifyWatchdog(deps) {
+    notify("WATCHDOG=1", deps);
+}
+//# sourceMappingURL=sd-notify.js.map

package/server/lib/sd-notify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sd-notify.js","sourceRoot":"","sources":["../../src/lib/sd-notify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAoB/C,MAAM,YAAY,GAAY,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;IAC1C,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;AAC5C,CAAC,CAAC;AAEF,SAAS,MAAM,CAAC,OAAe,EAAE,IAAmB;IAClD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa;QAAE,OAAO;IACvC,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,YAAY,CAAC;IAC1C,IAAI,CAAC;QACH,KAAK,CAAC,gBAAgB,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP;;;;;WAKG;IACL,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAmB;IAC7C,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAmB;IAChD,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;AAC7B,CAAC"}

package/server/net/local-machine.d.ts

@@ -0,0 +1,7 @@
+export interface LocalMachineAddressOptions {
+    interfaceAddresses?: Iterable<string>;
+}
+export declare function isLocalMachineAddress(remoteAddress: string | null, options?: LocalMachineAddressOptions): boolean;
+export declare function collectHostInterfaceAddresses(): string[];
+export declare function normalizeAddress(address: string | null): string | null;
+//# sourceMappingURL=local-machine.d.ts.map

package/server/net/local-machine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-machine.d.ts","sourceRoot":"","sources":["../../src/net/local-machine.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,0BAA0B;IACzC,kBAAkB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;CACvC;AAED,wBAAgB,qBAAqB,CACnC,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAWT;AAED,wBAAgB,6BAA6B,IAAI,MAAM,EAAE,CAUxD;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CA6BtE"}

package/server/net/local-machine.js

@@ -0,0 +1,79 @@
+import { isIP } from "node:net";
+import { networkInterfaces } from "node:os";
+const LOOPBACK_LITERALS = new Set(["localhost", "::1"]);
+export function isLocalMachineAddress(remoteAddress, options = {}) {
+    const normalized = normalizeAddress(remoteAddress);
+    if (!normalized)
+        return false;
+    if (isLoopbackAddress(normalized))
+        return true;
+    const localAddresses = options.interfaceAddresses ?? collectHostInterfaceAddresses();
+    for (const address of localAddresses) {
+        if (normalizeAddress(address) === normalized)
+            return true;
+    }
+    return false;
+}
+export function collectHostInterfaceAddresses() {
+    const result = [];
+    for (const entries of Object.values(networkInterfaces())) {
+        if (!entries)
+            continue;
+        for (const entry of entries) {
+            const normalized = normalizeAddress(entry.address);
+            if (normalized)
+                result.push(normalized);
+        }
+    }
+    return result;
+}
+export function normalizeAddress(address) {
+    if (!address)
+        return null;
+    let value = address.trim().toLowerCase();
+    if (!value)
+        return null;
+    if (value.startsWith("[") && value.endsWith("]")) {
+        value = value.slice(1, -1);
+    }
+    const zoneIndex = value.indexOf("%");
+    if (zoneIndex >= 0)
+        value = value.slice(0, zoneIndex);
+    const dottedMapped = /^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/i.exec(value);
+    if (dottedMapped)
+        return normalizeIpv4(dottedMapped[1]);
+    const hexMapped = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i.exec(value);
+    if (hexMapped) {
+        const high = parseInt(hexMapped[1], 16);
+        const low = parseInt(hexMapped[2], 16);
+        return [
+            (high >>> 8) & 0xff,
+            high & 0xff,
+            (low >>> 8) & 0xff,
+            low & 0xff,
+        ].join(".");
+    }
+    const ipv4 = normalizeIpv4(value);
+    if (ipv4)
+        return ipv4;
+    if (isIP(value) === 6 || value === "localhost")
+        return value;
+    return null;
+}
+function normalizeIpv4(value) {
+    const parts = value.split(".");
+    if (parts.length !== 4)
+        return null;
+    const numbers = parts.map((part) => Number(part));
+    if (numbers.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) {
+        return null;
+    }
+    return numbers.join(".");
+}
+function isLoopbackAddress(address) {
+    if (LOOPBACK_LITERALS.has(address))
+        return true;
+    const ipv4 = normalizeIpv4(address);
+    return ipv4 !== null && ipv4.split(".")[0] === "127";
+}
+//# sourceMappingURL=local-machine.js.map

package/server/net/local-machine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-machine.js","sourceRoot":"","sources":["../../src/net/local-machine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAE5C,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;AAMxD,MAAM,UAAU,qBAAqB,CACnC,aAA4B,EAC5B,UAAsC,EAAE;IAExC,MAAM,UAAU,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;IACnD,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,IAAI,iBAAiB,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/C,MAAM,cAAc,GAClB,OAAO,CAAC,kBAAkB,IAAI,6BAA6B,EAAE,CAAC;IAChE,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;QACrC,IAAI,gBAAgB,CAAC,OAAO,CAAC,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC;IAC5D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,6BAA6B;IAC3C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,UAAU;gBAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAsB;IACrD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,SAAS,IAAI,CAAC;QAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAEtD,MAAM,YAAY,GAAG,qCAAqC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvE,IAAI,YAAY;QAAE,OAAO,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IAExD,MAAM,SAAS,GAAG,2CAA2C,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1E,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvC,OAAO;YACL,CAAC,IAAI,KAAK,CAAC,CAAC,GAAG,IAAI;YACnB,IAAI,GAAG,IAAI;YACX,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI;YAClB,GAAG,GAAG,IAAI;SACX,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACd,CAAC;IAED,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC;IAC7D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAClD,IACE,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,GAAG,CAAC,EACzE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,IAAI,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC;AACvD,CAAC"}

package/server/net/reachable-host.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Resolve the address a per-port TCP forwarder should bind on, given the
+ * address parasor's own HTTP server is bound to:
+ * - loopback (`127.0.0.0/8` / `::1` / `localhost`) ⇒ `null` -- the viewer is on
+ *   this machine, `localhost:<port>` already works, so no forwarder.
+ * - anything else (a specific address, or `0.0.0.0` / `::`) ⇒ that host
+ *   verbatim. The forwarder listens on an OS-assigned free port so binding
+ *   `0.0.0.0` does not collide with the dev server's own `127.0.0.1:<port>`.
+ *   Exposure is ≤ parasor's own, which the viewer already reached it through.
+ */
+export declare function resolveForwarderBindHost(parasorBindHost: string): string | null;
+//# sourceMappingURL=reachable-host.d.ts.map

package/server/net/reachable-host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reachable-host.d.ts","sourceRoot":"","sources":["../../src/net/reachable-host.ts"],"names":[],"mappings":"AAYA;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CACtC,eAAe,EAAE,MAAM,GACtB,MAAM,GAAG,IAAI,CAGf"}

package/server/net/reachable-host.js

@@ -0,0 +1,25 @@
+const LOOPBACK_HOSTS = new Set(["localhost", "::1"]);
+function isLoopbackHost(host) {
+    if (LOOPBACK_HOSTS.has(host))
+        return true;
+    const parts = host.split(".").map(Number);
+    return (parts.length === 4 &&
+        parts.every((n) => Number.isInteger(n) && n >= 0 && n <= 255) &&
+        parts[0] === 127);
+}
+/**
+ * Resolve the address a per-port TCP forwarder should bind on, given the
+ * address parasor's own HTTP server is bound to:
+ * - loopback (`127.0.0.0/8` / `::1` / `localhost`) ⇒ `null` -- the viewer is on
+ *   this machine, `localhost:<port>` already works, so no forwarder.
+ * - anything else (a specific address, or `0.0.0.0` / `::`) ⇒ that host
+ *   verbatim. The forwarder listens on an OS-assigned free port so binding
+ *   `0.0.0.0` does not collide with the dev server's own `127.0.0.1:<port>`.
+ *   Exposure is ≤ parasor's own, which the viewer already reached it through.
+ */
+export function resolveForwarderBindHost(parasorBindHost) {
+    if (isLoopbackHost(parasorBindHost))
+        return null;
+    return parasorBindHost;
+}
+//# sourceMappingURL=reachable-host.js.map

package/server/net/reachable-host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reachable-host.js","sourceRoot":"","sources":["../../src/net/reachable-host.ts"],"names":[],"mappings":"AAAA,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;AAErD,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO,CACL,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;QAC7D,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,CACjB,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CACtC,eAAuB;IAEvB,IAAI,cAAc,CAAC,eAAe,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/server/network/endpoints.d.ts

@@ -0,0 +1,14 @@
+import type { NetworkInterfaceInfo } from "node:os";
+export interface NetworkEndpoint {
+    category: "Local" | "LAN" | "Tailscale" | "VPN";
+    address: string;
+    iface?: string;
+}
+export interface TailscaleStatus {
+    state: "running" | "stopped" | "not-installed";
+    magicDNS?: string;
+}
+export declare function classifyInterfaces(ifaces?: Record<string, NetworkInterfaceInfo[]>): NetworkEndpoint[];
+export declare function checkTailscale(): Promise<TailscaleStatus>;
+export declare function withMagicDNS(endpoints: NetworkEndpoint[], magicDNS: string | undefined): NetworkEndpoint[];
+//# sourceMappingURL=endpoints.d.ts.map

package/server/network/endpoints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoints.d.ts","sourceRoot":"","sources":["../../src/network/endpoints.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AAMpD,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,OAAO,GAAG,KAAK,GAAG,WAAW,GAAG,KAAK,CAAC;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,SAAS,GAAG,SAAS,GAAG,eAAe,CAAC;IAC/C,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAiBD,wBAAgB,kBAAkB,CAChC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,EAAE,CAAC,GAC9C,eAAe,EAAE,CAmCnB;AAUD,wBAAsB,cAAc,IAAI,OAAO,CAAC,eAAe,CAAC,CAkB/D;AAED,wBAAgB,YAAY,CAC1B,SAAS,EAAE,eAAe,EAAE,EAC5B,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,eAAe,EAAE,CAkBnB"}

package/server/network/endpoints.js

@@ -0,0 +1,104 @@
+import { execFile } from "node:child_process";
+import { networkInterfaces } from "node:os";
+import { promisify } from "node:util";
+const execFileAsync = promisify(execFile);
+const VPN_IFACE_RE = /^(utun|tun|ppp|ipsec|wg)/;
+function isCGNAT(addr) {
+    const parts = addr.split(".").map(Number);
+    return parts[0] === 100 && parts[1] >= 64 && parts[1] <= 127;
+}
+function isRFC1918(addr) {
+    const parts = addr.split(".").map(Number);
+    if (parts[0] === 10)
+        return true;
+    if (parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31)
+        return true;
+    if (parts[0] === 192 && parts[1] === 168)
+        return true;
+    return false;
+}
+export function classifyInterfaces(ifaces) {
+    const raw = ifaces ?? networkInterfaces();
+    const endpoints = [
+        { category: "Local", address: "127.0.0.1" },
+    ];
+    for (const [name, addrs] of Object.entries(raw)) {
+        if (!addrs)
+            continue;
+        for (const info of addrs) {
+            if (info.internal || info.family !== "IPv4")
+                continue;
+            // Tailscale: CGNAT range or tailscale0 interface
+            if (isCGNAT(info.address) || name === "tailscale0") {
+                endpoints.push({
+                    category: "Tailscale",
+                    address: info.address,
+                    iface: name,
+                });
+                continue;
+            }
+            // VPN: utun/tun/ppp/ipsec/wg interface with non-CGNAT address
+            if (VPN_IFACE_RE.test(name)) {
+                endpoints.push({ category: "VPN", address: info.address, iface: name });
+                continue;
+            }
+            // LAN: RFC1918
+            if (isRFC1918(info.address)) {
+                endpoints.push({ category: "LAN", address: info.address, iface: name });
+            }
+        }
+    }
+    return endpoints;
+}
+function extractMagicDNS(data) {
+    if (!data || typeof data !== "object")
+        return undefined;
+    const self = data.Self;
+    const dnsName = self?.DNSName;
+    if (typeof dnsName !== "string" || dnsName.length === 0)
+        return undefined;
+    return dnsName.replace(/\.$/, "");
+}
+export async function checkTailscale() {
+    try {
+        const { stdout } = await execFileAsync("tailscale", ["status", "--json"], {
+            timeout: 3000,
+        });
+        const data = JSON.parse(stdout);
+        if (data.BackendState !== "Running")
+            return { state: "stopped" };
+        const magicDNS = extractMagicDNS(data);
+        return magicDNS ? { state: "running", magicDNS } : { state: "running" };
+    }
+    catch (err) {
+        const isNotFound = err instanceof Error &&
+            ("code" in err
+                ? err.code === "ENOENT"
+                : false);
+        if (isNotFound)
+            return { state: "not-installed" };
+        return { state: "stopped" };
+    }
+}
+export function withMagicDNS(endpoints, magicDNS) {
+    if (!magicDNS)
+        return endpoints;
+    const entry = {
+        category: "Tailscale",
+        address: magicDNS,
+        iface: "MagicDNS",
+    };
+    const result = [];
+    let inserted = false;
+    for (const e of endpoints) {
+        result.push(e);
+        if (!inserted && e.category === "Tailscale" && e.iface !== "MagicDNS") {
+            result.push(entry);
+            inserted = true;
+        }
+    }
+    if (!inserted)
+        result.push(entry);
+    return result;
+}
+//# sourceMappingURL=endpoints.js.map

package/server/network/endpoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoints.js","sourceRoot":"","sources":["../../src/network/endpoints.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAa1C,MAAM,YAAY,GAAG,0BAA0B,CAAC;AAEhD,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;AAC/D,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IACtE,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACtD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,MAA+C;IAE/C,MAAM,GAAG,GAAG,MAAM,IAAI,iBAAiB,EAAE,CAAC;IAC1C,MAAM,SAAS,GAAsB;QACnC,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE;KAC5C,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM;gBAAE,SAAS;YAEtD,iDAAiD;YACjD,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;gBACnD,SAAS,CAAC,IAAI,CAAC;oBACb,QAAQ,EAAE,WAAW;oBACrB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,KAAK,EAAE,IAAI;iBACZ,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,8DAA8D;YAC9D,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,SAAS,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxE,SAAS;YACX,CAAC;YAED,eAAe;YACf,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5B,SAAS,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,eAAe,CAAC,IAAa;IACpC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACxD,MAAM,IAAI,GAAI,IAAyC,CAAC,IAAI,CAAC;IAC7D,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,CAAC;IAC9B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1E,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE;YACxE,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAChC,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;YAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QACjE,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC1E,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,UAAU,GACd,GAAG,YAAY,KAAK;YACpB,CAAC,MAAM,IAAI,GAAG;gBACZ,CAAC,CAAE,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAClD,CAAC,CAAC,KAAK,CAAC,CAAC;QACb,IAAI,UAAU;YAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;QAClD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,SAA4B,EAC5B,QAA4B;IAE5B,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,KAAK,GAAoB;QAC7B,QAAQ,EAAE,WAAW;QACrB,OAAO,EAAE,QAAQ;QACjB,KAAK,EAAE,UAAU;KAClB,CAAC;IACF,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACf,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,WAAW,IAAI,CAAC,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YACtE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ;QAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/server/network/qr.d.ts

@@ -0,0 +1,16 @@
+import type { NetworkEndpoint } from "./endpoints.js";
+export declare function selectQrEndpoint(endpoints: NetworkEndpoint[], iface?: string): NetworkEndpoint | undefined;
+export declare function buildAuthUrl(address: string, port: number, authMode: "token" | "allowlist" | "none", token: string): string;
+export declare function buildPairingUrl(address: string, port: number, token: string, path?: string): string;
+export declare function renderQrLines(url: string): string[];
+export interface QrSectionOptions {
+    endpoints: NetworkEndpoint[];
+    port: number;
+    authMode: "token" | "allowlist" | "none";
+    token?: string;
+    makeAccessUrl?: (endpoint: NetworkEndpoint) => string;
+    iface?: string;
+    clickable?: boolean;
+}
+export declare function buildQrSection({ endpoints, port, authMode, token, makeAccessUrl, iface, clickable, }: QrSectionOptions): string[];
+//# sourceMappingURL=qr.d.ts.map

package/server/network/qr.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"qr.d.ts","sourceRoot":"","sources":["../../src/network/qr.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAKtD,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,eAAe,EAAE,EAC5B,KAAK,CAAC,EAAE,MAAM,GACb,eAAe,GAAG,SAAS,CAU7B;AAED,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,OAAO,GAAG,WAAW,GAAG,MAAM,EACxC,KAAK,EAAE,MAAM,GACZ,MAAM,CAGR;AAED,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,SAAM,GACT,MAAM,CAIR;AA6BD,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAMnD;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,GAAG,WAAW,GAAG,MAAM,CAAC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,eAAe,KAAK,MAAM,CAAC;IACtD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAiBD,wBAAgB,cAAc,CAAC,EAC7B,SAAS,EACT,IAAI,EACJ,QAAQ,EACR,KAAK,EACL,aAAa,EACb,KAAK,EACL,SAAiB,GAClB,EAAE,gBAAgB,GAAG,MAAM,EAAE,CA6B7B"}

package/server/network/qr.js

@@ -0,0 +1,89 @@
+import qrcodeTerminal from "qrcode-terminal";
+// macOS virtual / ephemeral interfaces we never want to surface to a phone.
+const VIRTUAL_IFACE_RE = /^(bridge|awdl|llw|anpi|ap|pktap|gif|stf)/;
+export function selectQrEndpoint(endpoints, iface) {
+    if (iface) {
+        return endpoints.find((e) => e.iface === iface);
+    }
+    const tailscale = endpoints.find((e) => e.category === "Tailscale");
+    if (tailscale)
+        return tailscale;
+    return endpoints.find((e) => e.category === "LAN" && (!e.iface || !VIRTUAL_IFACE_RE.test(e.iface)));
+}
+export function buildAuthUrl(address, port, authMode, token) {
+    const base = `http://${address}:${port}`;
+    return authMode === "token" ? `${base}/?t=${token}` : base;
+}
+export function buildPairingUrl(address, port, token, path = "/") {
+    const url = new URL(`http://${address}:${port}${normalizeAccessPath(path)}`);
+    url.searchParams.set("t", token);
+    return url.toString();
+}
+// biome-ignore lint/suspicious/noControlCharactersInRegex: access paths must reject terminal/header control bytes.
+const CONTROL_CHAR_RE = /[\x00-\x1f\x7f]/;
+function normalizeAccessPath(path) {
+    if (!path.startsWith("/") ||
+        path.startsWith("//") ||
+        path.includes("\\") ||
+        CONTROL_CHAR_RE.test(path)) {
+        throw new Error("access URL path must be same-origin relative");
+    }
+    return path;
+}
+function buildDefaultAccessUrl(address, port, authMode, token) {
+    if (authMode === "token" && !token) {
+        throw new Error("token or makeAccessUrl is required for token auth URLs");
+    }
+    return buildAuthUrl(address, port, authMode, token ?? "");
+}
+export function renderQrLines(url) {
+    let output = "";
+    qrcodeTerminal.generate(url, { small: true }, (rendered) => {
+        output = rendered;
+    });
+    return output.replace(/\n$/, "").split("\n");
+}
+/*
+ * OSC 8 hyperlink. Refuse to wrap when the URL or label contains a
+ * terminal control character, since those would break the escape
+ * sequence (and could be used to inject other escapes if the input is
+ * untrusted).
+ */
+// biome-ignore lint/suspicious/noControlCharactersInRegex: OSC8 labels/URLs must reject terminal control bytes.
+const TERMINAL_CONTROL_RE = /[\x00-\x1f\x7f]/;
+const OSC8_HYPERLINK = (url, label) => {
+    if (TERMINAL_CONTROL_RE.test(url) || TERMINAL_CONTROL_RE.test(label)) {
+        return label;
+    }
+    return `\x1b]8;;${url}\x1b\\${label}\x1b]8;;\x1b\\`;
+};
+export function buildQrSection({ endpoints, port, authMode, token, makeAccessUrl, iface, clickable = false, }) {
+    const target = selectQrEndpoint(endpoints, iface);
+    if (!target) {
+        if (iface) {
+            const candidates = endpoints
+                .map((e) => e.iface)
+                .filter(Boolean)
+                .join(", ");
+            return [
+                `QR: interface "${iface}" not found. Available: ${candidates || "(none)"}`,
+            ];
+        }
+        return [
+            "QR: no remote endpoint detected. Run `tailscale up` or connect to a LAN.",
+        ];
+    }
+    const url = makeAccessUrl?.(target) ??
+        buildDefaultAccessUrl(target.address, port, authMode, token);
+    const label = target.iface
+        ? `${target.category} (${target.iface})`
+        : target.category;
+    const linkedUrl = clickable ? OSC8_HYPERLINK(url, url) : url;
+    return [
+        `Scan to open on mobile -- ${label}`,
+        `  ${linkedUrl}`,
+        "",
+        ...renderQrLines(url),
+    ];
+}
+//# sourceMappingURL=qr.js.map

package/server/network/qr.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"qr.js","sourceRoot":"","sources":["../../src/network/qr.ts"],"names":[],"mappings":"AAAA,OAAO,cAAc,MAAM,iBAAiB,CAAC;AAG7C,4EAA4E;AAC5E,MAAM,gBAAgB,GAAG,0CAA0C,CAAC;AAEpE,MAAM,UAAU,gBAAgB,CAC9B,SAA4B,EAC5B,KAAc;IAEd,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,WAAW,CAAC,CAAC;IACpE,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAChC,OAAO,SAAS,CAAC,IAAI,CACnB,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,QAAQ,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CACxE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,OAAe,EACf,IAAY,EACZ,QAAwC,EACxC,KAAa;IAEb,MAAM,IAAI,GAAG,UAAU,OAAO,IAAI,IAAI,EAAE,CAAC;IACzC,OAAO,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,OAAe,EACf,IAAY,EACZ,KAAa,EACb,IAAI,GAAG,GAAG;IAEV,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,OAAO,IAAI,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7E,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACjC,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,mHAAmH;AACnH,MAAM,eAAe,GAAG,iBAAiB,CAAC;AAE1C,SAAS,mBAAmB,CAAC,IAAY;IACvC,IACE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QACrB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QACrB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QACnB,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAC1B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAAe,EACf,IAAY,EACZ,QAAwC,EACxC,KAAyB;IAEzB,IAAI,QAAQ,KAAK,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,cAAc,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,QAAQ,EAAE,EAAE;QACzD,MAAM,GAAG,QAAQ,CAAC;IACpB,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC/C,CAAC;AAYD;;;;;GAKG;AACH,gHAAgH;AAChH,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAC9C,MAAM,cAAc,GAAG,CAAC,GAAW,EAAE,KAAa,EAAU,EAAE;IAC5D,IAAI,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,WAAW,GAAG,SAAS,KAAK,gBAAgB,CAAC;AACtD,CAAC,CAAC;AAEF,MAAM,UAAU,cAAc,CAAC,EAC7B,SAAS,EACT,IAAI,EACJ,QAAQ,EACR,KAAK,EACL,aAAa,EACb,KAAK,EACL,SAAS,GAAG,KAAK,GACA;IACjB,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,UAAU,GAAG,SAAS;iBACzB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;iBACnB,MAAM,CAAC,OAAO,CAAC;iBACf,IAAI,CAAC,IAAI,CAAC,CAAC;YACd,OAAO;gBACL,kBAAkB,KAAK,2BAA2B,UAAU,IAAI,QAAQ,EAAE;aAC3E,CAAC;QACJ,CAAC;QACD,OAAO;YACL,0EAA0E;SAC3E,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GACP,aAAa,EAAE,CAAC,MAAM,CAAC;QACvB,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK;QACxB,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,KAAK,GAAG;QACxC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;IACpB,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC7D,OAAO;QACL,6BAA6B,KAAK,EAAE;QACpC,KAAK,SAAS,EAAE;QAChB,EAAE;QACF,GAAG,aAAa,CAAC,GAAG,CAAC;KACtB,CAAC;AACJ,CAAC"}

package/server/port-forwarder/forwarder.d.ts

@@ -0,0 +1,47 @@
+export interface ForwardedPortSpec {
+    port: number;
+    bindsAll: boolean;
+}
+/**
+ * Per-port raw TCP forwarder (Tier A .). For each detected
+ * dev-server port that is *not* already bound to all interfaces, a
+ * `net.Server` listens on `<bindHost>:0` (an OS-assigned free port) and pipes
+ * every connection byte-for-byte to `localhost:<devPort>` (both loopback
+ * families -- a `localhost` dev server often binds only `::1`). No HTTP parsing
+ * -- HMR/WebSocket pass through transparently because it is L4. Using a free
+ * listen port means binding `0.0.0.0` does not collide with the dev server's
+ * own `localhost:<devPort>`.
+ *
+ * `bindHost === null` ⇒ the forwarder is inert: parasor is loopback-bound so
+ * the viewer is on this machine and `localhost:<port>` already works. `sync`
+ * is a no-op and `getReachablePort` always returns `null`.
+ *
+ * Forwarders are keyed by `projectId` -> `devPort` so a project going inactive
+ * (next `sync` with `[]`) tears its forwarders down.
+ */
+export declare class PortForwarder {
+    private readonly bindHost;
+    private readonly byProject;
+    private onChange;
+    constructor(bindHost: string | null);
+    isInert(): boolean;
+    /**
+     * Register a callback invoked whenever a forwarder finishes binding (its
+     * `reachablePort` becomes available) or its bind errors (it is torn down).
+     * `PortForwarder`'s state changes out-of-band of `sync` here -- `listen` is
+     * async -- so callers that mirror `getReachablePort` results (e.g. the
+     * runtime's `ports-updated` broadcast) must re-read on this signal.
+     */
+    setOnChange(cb: (projectId: string) => void): void;
+    sync(projectId: string, ports: ForwardedPortSpec[]): void;
+    /**
+     * The OS-assigned listen port for `devPort` in `projectId`, or `null` if no
+     * forwarder exists, it has not finished binding, or its bind errored.
+     */
+    getReachablePort(projectId: string, devPort: number): number | null;
+    stop(): void;
+    private teardownForwarder;
+    private createForwarder;
+    private wirePair;
+}
+//# sourceMappingURL=forwarder.d.ts.map

package/server/port-forwarder/forwarder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forwarder.d.ts","sourceRoot":"","sources":["../../src/port-forwarder/forwarder.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;CACnB;AAYD;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,aAAa;IAIZ,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAHrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiD;IAC3E,OAAO,CAAC,QAAQ,CAA8C;gBAEjC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAEpD,OAAO,IAAI,OAAO;IAIlB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI;IAIlD,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAAG,IAAI;IAqBzD;;;OAGG;IACH,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAOnE,IAAI,IAAI,IAAI;IASZ,OAAO,CAAC,iBAAiB;IAMzB,OAAO,CAAC,eAAe;IAsDvB,OAAO,CAAC,QAAQ;CAuBjB"}

package/server/port-forwarder/forwarder.js

@@ -0,0 +1,159 @@
+import net from "node:net";
+/**
+ * Per-port raw TCP forwarder (Tier A .). For each detected
+ * dev-server port that is *not* already bound to all interfaces, a
+ * `net.Server` listens on `<bindHost>:0` (an OS-assigned free port) and pipes
+ * every connection byte-for-byte to `localhost:<devPort>` (both loopback
+ * families -- a `localhost` dev server often binds only `::1`). No HTTP parsing
+ * -- HMR/WebSocket pass through transparently because it is L4. Using a free
+ * listen port means binding `0.0.0.0` does not collide with the dev server's
+ * own `localhost:<devPort>`.
+ *
+ * `bindHost === null` ⇒ the forwarder is inert: parasor is loopback-bound so
+ * the viewer is on this machine and `localhost:<port>` already works. `sync`
+ * is a no-op and `getReachablePort` always returns `null`.
+ *
+ * Forwarders are keyed by `projectId` -> `devPort` so a project going inactive
+ * (next `sync` with `[]`) tears its forwarders down.
+ */
+export class PortForwarder {
+    bindHost;
+    byProject = new Map();
+    onChange = null;
+    constructor(bindHost) {
+        this.bindHost = bindHost;
+    }
+    isInert() {
+        return this.bindHost === null;
+    }
+    /**
+     * Register a callback invoked whenever a forwarder finishes binding (its
+     * `reachablePort` becomes available) or its bind errors (it is torn down).
+     * `PortForwarder`'s state changes out-of-band of `sync` here -- `listen` is
+     * async -- so callers that mirror `getReachablePort` results (e.g. the
+     * runtime's `ports-updated` broadcast) must re-read on this signal.
+     */
+    setOnChange(cb) {
+        this.onChange = cb;
+    }
+    sync(projectId, ports) {
+        if (this.bindHost === null)
+            return;
+        const wanted = new Set(ports.filter((p) => !p.bindsAll).map((p) => p.port));
+        const current = this.byProject.get(projectId) ?? new Map();
+        for (const [devPort, forwarder] of current) {
+            if (!wanted.has(devPort)) {
+                this.teardownForwarder(forwarder);
+                current.delete(devPort);
+            }
+        }
+        for (const devPort of wanted) {
+            if (current.has(devPort))
+                continue;
+            const forwarder = this.createForwarder(projectId, devPort);
+            if (forwarder)
+                current.set(devPort, forwarder);
+        }
+        if (current.size === 0)
+            this.byProject.delete(projectId);
+        else
+            this.byProject.set(projectId, current);
+    }
+    /**
+     * The OS-assigned listen port for `devPort` in `projectId`, or `null` if no
+     * forwarder exists, it has not finished binding, or its bind errored.
+     */
+    getReachablePort(projectId, devPort) {
+        if (this.bindHost === null)
+            return null;
+        const forwarder = this.byProject.get(projectId)?.get(devPort);
+        if (!forwarder?.server.listening)
+            return null;
+        return forwarder.reachablePort;
+    }
+    stop() {
+        for (const forwarders of this.byProject.values()) {
+            for (const forwarder of forwarders.values()) {
+                this.teardownForwarder(forwarder);
+            }
+        }
+        this.byProject.clear();
+    }
+    teardownForwarder(forwarder) {
+        forwarder.server.close();
+        for (const socket of forwarder.sockets)
+            socket.destroy();
+        forwarder.sockets.clear();
+    }
+    createForwarder(projectId, devPort) {
+        const bindHost = this.bindHost;
+        if (bindHost === null)
+            return null;
+        const sockets = new Set();
+        const server = net.createServer((clientSocket) => {
+            // `localhost`, not `127.0.0.1`: a dev server started on `localhost` often
+            // binds only `::1` (Node's default resolution order on macOS), so an
+            // IPv4-only upstream would `ECONNREFUSED`. Node ≥18 `autoSelectFamily`
+            // tries both loopback families.
+            const upstream = net.connect(devPort, "localhost");
+            this.wirePair(sockets, clientSocket, upstream);
+        });
+        const forwarder = {
+            server,
+            devPort,
+            reachablePort: null,
+            sockets,
+        };
+        server.on("listening", () => {
+            const addr = server.address();
+            forwarder.reachablePort =
+                addr && typeof addr === "object" ? addr.port : null;
+            // The listen completed asynchronously, after the `sync` tick -- signal
+            // upward so any mirrored reachability state is re-read and re-broadcast.
+            this.onChange?.(projectId);
+        });
+        server.on("error", (err) => {
+            // Best effort: a preview forwarder must never crash the server. On any
+            // listen error (EADDRINUSE is unlikely on a free port) drop this
+            // forwarder; the dev server stays loopback-only and the port is
+            // reported unreachable.
+            if (err.code !== "EADDRINUSE") {
+                console.warn(`[port-forwarder] failed to bind ${bindHost} for dev port ${devPort}: ${err.message}`);
+            }
+            let removed = false;
+            for (const [pid, forwarders] of this.byProject) {
+                if (forwarders.get(devPort) === forwarder) {
+                    this.teardownForwarder(forwarder);
+                    forwarders.delete(devPort);
+                    if (forwarders.size === 0)
+                        this.byProject.delete(pid);
+                    removed = true;
+                }
+            }
+            if (removed)
+                this.onChange?.(projectId);
+        });
+        server.listen(0, bindHost);
+        return forwarder;
+    }
+    wirePair(sockets, clientSocket, upstream) {
+        sockets.add(clientSocket);
+        sockets.add(upstream);
+        const closePeer = (peer) => {
+            peer.destroy();
+        };
+        clientSocket.on("error", () => closePeer(upstream));
+        upstream.on("error", () => closePeer(clientSocket));
+        clientSocket.on("close", () => {
+            sockets.delete(clientSocket);
+            closePeer(upstream);
+        });
+        upstream.on("close", () => {
+            sockets.delete(upstream);
+            closePeer(clientSocket);
+        });
+        clientSocket.pipe(upstream);
+        upstream.pipe(clientSocket);
+    }
+}
+//# sourceMappingURL=forwarder.js.map