portless 0.15.0 → 0.15.1

package/dist/cli.js

@@ -14,9 +14,10 @@ import {
   isErrnoException,
   isProcessAlive,
   parseHostname,
+  parseHostnames,
   shouldAutoSyncHosts,
   syncHostsFile
-} from "./chunk-PCBKLZK2.js";
+} from "./chunk-SD2PIWJU.js";
 
 // src/colors.ts
 function supportsColor() {
@@ -501,15 +502,16 @@ async function generateHostCertAsync(stateDir, hostname) {
   fixOwnership(keyPath, certPath);
   return { certPath, keyPath };
 }
-function createSNICallback(stateDir, defaultCert, defaultKey, tld = "localhost", caCert) {
+function createSNICallback(stateDir, defaultCert, defaultKey, tlds = "localhost", caCert) {
   const cache = /* @__PURE__ */ new Map();
   const pending = /* @__PURE__ */ new Map();
+  const configuredTlds = Array.isArray(tlds) ? tlds : [tlds];
   const defaultCtx = tls.createSecureContext({
     cert: caCert ? Buffer.concat([defaultCert, caCert]) : defaultCert,
     key: defaultKey
   });
   return (servername, cb) => {
-    if (servername === tld) {
+    if (servername === "localhost" && configuredTlds.includes("localhost")) {
       cb(null, defaultCtx);
       return;
     }
@@ -1584,8 +1586,25 @@ function validateTld(tld) {
   }
   return null;
 }
+function parseTldList(value, source = "TLD") {
+  const trimmed = value.trim();
+  if (!trimmed) return [];
+  const tlds = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const rawPart of trimmed.split(",")) {
+    const tld = rawPart.trim().toLowerCase();
+    const err = validateTld(tld);
+    if (err) throw new Error(source === "TLD" ? err : `${source}: ${err}`);
+    if (!seen.has(tld)) {
+      seen.add(tld);
+      tlds.push(tld);
+    }
+  }
+  return tlds;
+}
 var TLD_FILE = "proxy.tld";
-function readTldFromDir(dir) {
+var TLDS_FILE = "proxy.tlds";
+function readLegacyTldFromDir(dir) {
   try {
     const raw = fs3.readFileSync(path3.join(dir, TLD_FILE), "utf-8").trim();
     return raw || DEFAULT_TLD;
@@ -1593,23 +1612,43 @@ function readTldFromDir(dir) {
     return DEFAULT_TLD;
   }
 }
-function writeTldFile(dir, tld) {
-  const filePath = path3.join(dir, TLD_FILE);
-  if (tld === DEFAULT_TLD) {
+function readTldsFromDir(dir) {
+  try {
+    const raw = fs3.readFileSync(path3.join(dir, TLDS_FILE), "utf-8").trim();
+    const parsed = raw.startsWith("[") ? JSON.parse(raw) : raw.split(/\r?\n/).flatMap((line) => line.split(",")).map((line) => line.trim()).filter(Boolean);
+    if (!Array.isArray(parsed)) return [readLegacyTldFromDir(dir)];
+    const tlds = parsed.flatMap((value) => typeof value === "string" ? parseTldList(value) : []);
+    return tlds.length > 0 ? [...new Set(tlds)] : [DEFAULT_TLD];
+  } catch {
+    return [readLegacyTldFromDir(dir)];
+  }
+}
+function writeTldsFile(dir, tlds) {
+  const uniqueTlds = [...new Set(tlds)];
+  const tldsPath = path3.join(dir, TLDS_FILE);
+  const tldPath = path3.join(dir, TLD_FILE);
+  if (uniqueTlds.length === 1 && uniqueTlds[0] === DEFAULT_TLD) {
     try {
-      fs3.unlinkSync(filePath);
+      fs3.unlinkSync(tldsPath);
+    } catch {
+    }
+    try {
+      fs3.unlinkSync(tldPath);
     } catch {
     }
   } else {
-    fs3.writeFileSync(filePath, tld, { mode: 420 });
+    fs3.writeFileSync(tldsPath, uniqueTlds.join("\n") + "\n", { mode: 420 });
+    fs3.writeFileSync(tldPath, uniqueTlds[0] ?? DEFAULT_TLD, { mode: 420 });
   }
 }
-function getDefaultTld() {
+function writeTldFile(dir, tld) {
+  writeTldsFile(dir, [tld]);
+}
+function getDefaultTlds() {
   const val = process.env.PORTLESS_TLD?.trim().toLowerCase();
-  if (!val) return DEFAULT_TLD;
-  const err = validateTld(val);
-  if (err) throw new Error(`PORTLESS_TLD: ${err}`);
-  return val;
+  if (!val) return [DEFAULT_TLD];
+  const tlds = parseTldList(val, "PORTLESS_TLD");
+  return tlds.length > 0 ? tlds : [DEFAULT_TLD];
 }
 function isHttpsEnvDisabled() {
   const val = process.env.PORTLESS_HTTPS;
@@ -1628,14 +1667,17 @@ function readPersistedProxyState() {
   const port = readPortFromDir(dir);
   if (port !== null) {
     const tls2 = readTlsMarker(dir);
-    const tld = readTldFromDir(dir);
+    const tlds = readTldsFromDir(dir);
+    const tld = tlds[0] ?? DEFAULT_TLD;
     const lanIp = readLanMarker(dir);
-    return { port, tls: tls2, tld, lanMode: lanIp !== null || tld === "local" };
+    return { port, tls: tls2, tld, tlds, lanMode: lanIp !== null || tlds.includes("local") };
   }
   return null;
 }
 function buildProxyStartConfig(options) {
-  const effectiveTld = options.lanMode ? "local" : options.tld;
+  const requestedTlds = options.tlds && options.tlds.length > 0 ? [...options.tlds] : [options.tld];
+  const effectiveTlds = options.lanMode ? ["local"] : [...new Set(requestedTlds)];
+  const effectiveTld = effectiveTlds[0] ?? DEFAULT_TLD;
   const args = [];
   if (options.foreground) {
     args.push("--foreground");
@@ -1661,8 +1703,10 @@ function buildProxyStartConfig(options) {
         args.push(INTERNAL_LAN_IP_FLAG, options.lanIp);
       }
     }
-  } else if (effectiveTld !== DEFAULT_TLD) {
-    args.push("--tld", effectiveTld);
+  } else if (effectiveTlds.length > 1 || effectiveTld !== DEFAULT_TLD) {
+    for (const tld of effectiveTlds) {
+      args.push("--tld", tld);
+    }
   }
   if (options.useWildcard) {
     args.push("--wildcard");
@@ -1670,7 +1714,7 @@ function buildProxyStartConfig(options) {
   if (options.skipTrust) {
     args.push("--skip-trust");
   }
-  return { effectiveTld, args };
+  return { effectiveTld, effectiveTlds, args };
 }
 async function discoverState() {
   if (process.env.PORTLESS_STATE_DIR) {
@@ -1679,14 +1723,25 @@ async function discoverState() {
     const lanIp = readLanMarker(dir2);
     if (await isProxyRunning(port) || await isPortListening(port)) {
       const tls2 = readTlsMarker(dir2);
-      const tld = readTldFromDir(dir2);
-      return { dir: dir2, port, tls: tls2, tld, lanMode: lanIp !== null || tld === "local", lanIp };
+      const tlds3 = readTldsFromDir(dir2);
+      const tld = tlds3[0] ?? DEFAULT_TLD;
+      return {
+        dir: dir2,
+        port,
+        tls: tls2,
+        tld,
+        tlds: tlds3,
+        lanMode: lanIp !== null || tlds3.includes("local"),
+        lanIp
+      };
     }
+    const tlds2 = readTldsFromDir(dir2);
     return {
       dir: dir2,
       port,
       tls: readTlsMarker(dir2),
-      tld: readTldFromDir(dir2),
+      tld: tlds2[0] ?? DEFAULT_TLD,
+      tlds: tlds2,
       lanMode: lanIp !== null,
       lanIp: null
     };
@@ -1695,14 +1750,16 @@ async function discoverState() {
   if (userPort !== null) {
     if (await isProxyRunning(userPort)) {
       const tls2 = readTlsMarker(USER_STATE_DIR);
-      const tld = readTldFromDir(USER_STATE_DIR);
+      const tlds2 = readTldsFromDir(USER_STATE_DIR);
+      const tld = tlds2[0] ?? DEFAULT_TLD;
       const lanIp = readLanMarker(USER_STATE_DIR);
       return {
         dir: USER_STATE_DIR,
         port: userPort,
         tls: tls2,
         tld,
-        lanMode: lanIp !== null || tld === "local",
+        tlds: tlds2,
+        lanMode: lanIp !== null || tlds2.includes("local"),
         lanIp
       };
     }
@@ -1711,14 +1768,16 @@ async function discoverState() {
   if (legacyPort !== null) {
     if (await isProxyRunning(legacyPort)) {
       const tls2 = readTlsMarker(LEGACY_SYSTEM_STATE_DIR);
-      const tld = readTldFromDir(LEGACY_SYSTEM_STATE_DIR);
+      const tlds2 = readTldsFromDir(LEGACY_SYSTEM_STATE_DIR);
+      const tld = tlds2[0] ?? DEFAULT_TLD;
       const lanIp = readLanMarker(LEGACY_SYSTEM_STATE_DIR);
       return {
         dir: LEGACY_SYSTEM_STATE_DIR,
         port: legacyPort,
         tls: tls2,
         tld,
-        lanMode: lanIp !== null || tld === "local",
+        tlds: tlds2,
+        lanMode: lanIp !== null || tlds2.includes("local"),
         lanIp
       };
     }
@@ -1730,17 +1789,28 @@ async function discoverState() {
       const dir2 = resolveStateDir(port);
       const markerTls = readTlsMarker(dir2);
       const tls2 = markerTls || port === getProtocolPort(true);
-      const tld = readTldFromDir(dir2);
+      const tlds2 = readTldsFromDir(dir2);
+      const tld = tlds2[0] ?? DEFAULT_TLD;
       const lanIp = readLanMarker(dir2);
-      return { dir: dir2, port, tls: tls2, tld, lanMode: lanIp !== null || tld === "local", lanIp };
+      return {
+        dir: dir2,
+        port,
+        tls: tls2,
+        tld,
+        tlds: tlds2,
+        lanMode: lanIp !== null || tlds2.includes("local"),
+        lanIp
+      };
     }
   }
   const dir = resolveStateDir(configuredPort);
+  const tlds = readTldsFromDir(dir);
   return {
     dir,
     port: configuredPort,
     tls: readTlsMarker(dir),
-    tld: readTldFromDir(dir),
+    tld: tlds[0] ?? DEFAULT_TLD,
+    tlds,
     lanMode: readLanMarker(dir) !== null,
     lanIp: null
   };
@@ -2025,6 +2095,7 @@ var PORTLESS_STATE_FILES = [
   "proxy.tls",
   "proxy.custom-cert",
   "proxy.tld",
+  "proxy.tlds",
   "proxy.lan",
   "ca-key.pem",
   "ca.pem",
@@ -2797,6 +2868,15 @@ var SYSTEMD_SERVICE = "portless.service";
 var WINDOWS_TASK_NAME = "Portless Proxy";
 var INTERNAL_ELEVATED_ENV = "PORTLESS_INTERNAL_SERVICE_ELEVATED";
 var SERVICE_ENV_KEYS = /* @__PURE__ */ new Set(["PORTLESS_SYNC_HOSTS"]);
+function normalizeTlds(tlds) {
+  return [...new Set(tlds.length > 0 ? tlds : [DEFAULT_TLD])];
+}
+function primaryTld(tlds) {
+  return tlds[0] ?? DEFAULT_TLD;
+}
+function formatTldList(tlds) {
+  return tlds.map((tld) => `.${tld}`).join(", ");
+}
 var DEFAULT_SERVICE_CONFIG = {
   proxyPort: DEFAULT_SERVICE_PORT,
   useHttps: true,
@@ -2806,6 +2886,7 @@ var DEFAULT_SERVICE_CONFIG = {
   lanIp: null,
   lanIpExplicit: false,
   tld: DEFAULT_TLD,
+  tlds: [DEFAULT_TLD],
   useWildcard: false,
   extraEnv: {}
 };
@@ -2892,10 +2973,8 @@ function parseServiceInstallConfig(args, env = process.env, options = {}) {
     config.lanIpExplicit = true;
   }
   if (env.PORTLESS_TLD) {
-    const tld = env.PORTLESS_TLD.trim().toLowerCase();
-    const err = validateTld(tld);
-    if (err) throw new Error(`PORTLESS_TLD: ${err}`);
-    config.tld = tld;
+    config.tlds = normalizeTlds(parseTldList(env.PORTLESS_TLD, "PORTLESS_TLD"));
+    config.tld = primaryTld(config.tlds);
   }
   const envWildcard = parseBooleanEnv(env.PORTLESS_WILDCARD);
   if (envWildcard !== null) {
@@ -2907,6 +2986,7 @@ function parseServiceInstallConfig(args, env = process.env, options = {}) {
     config.proxyPort = getProtocolPort(config.useHttps);
   }
   const tokens = args[0] === "service" ? args.slice(2) : args;
+  let tldFlagSeen = false;
   for (let i = 0; i < tokens.length; i += 1) {
     const token = tokens[i];
     switch (token) {
@@ -2931,10 +3011,10 @@ function parseServiceInstallConfig(args, env = process.env, options = {}) {
         i += 1;
         break;
       case "--tld": {
-        const tld = getFlagValue(tokens, i, token).trim().toLowerCase();
-        const err = validateTld(tld);
-        if (err) throw new Error(err);
-        config.tld = tld;
+        const tlds = parseTldList(getFlagValue(tokens, i, token));
+        config.tlds = normalizeTlds([...tldFlagSeen ? config.tlds : [], ...tlds]);
+        config.tld = primaryTld(config.tlds);
+        tldFlagSeen = true;
         i += 1;
         break;
       }
@@ -2974,6 +3054,9 @@ function parseServiceInstallConfig(args, env = process.env, options = {}) {
   if (!config.lanMode) {
     config.lanIp = null;
     config.lanIpExplicit = false;
+  } else {
+    config.tlds = ["local"];
+    config.tld = "local";
   }
   return config;
 }
@@ -3019,6 +3102,7 @@ function buildProxyCommand(entryScript, serviceConfig) {
     lanIp: serviceConfig.lanIp,
     lanIpExplicit: serviceConfig.lanIpExplicit,
     tld: serviceConfig.tld,
+    tlds: serviceConfig.tlds,
     useWildcard: serviceConfig.useWildcard,
     foreground: true,
     includePort: true,
@@ -3041,8 +3125,8 @@ function buildServiceEnv(ctx) {
   }
   if (ctx.config.lanMode) {
     env.PORTLESS_TLD = "local";
-  } else if (ctx.config.tld !== DEFAULT_TLD) {
-    env.PORTLESS_TLD = ctx.config.tld;
+  } else if (ctx.config.tlds.length > 1 || ctx.config.tld !== DEFAULT_TLD) {
+    env.PORTLESS_TLD = ctx.config.tlds.join(",");
   }
   if (ctx.platform === "win32") {
     env.USERPROFILE = ctx.user.home;
@@ -3127,6 +3211,10 @@ function buildServiceSpec(options) {
     ...options.installConfig,
     extraEnv: options.installConfig?.extraEnv ?? {}
   };
+  installConfig.tlds = installConfig.lanMode ? ["local"] : normalizeTlds(
+    options.installConfig?.tlds ?? (options.installConfig?.tld ? [options.installConfig.tld] : installConfig.tlds)
+  );
+  installConfig.tld = primaryTld(installConfig.tlds);
   const stateDir = options.stateDir || installConfig.stateDir || defaultStateDir(options.platform, options.userHome);
   const normalizedConfig = {
     ...installConfig,
@@ -3617,7 +3705,7 @@ async function printServiceStatus(entryScript, runner) {
     `  Proxy on ${config.proxyPort}: ${status.proxyRunning ? "responding" : "not responding"}`
   );
   console.log(`  HTTPS: ${config.useHttps ? "yes" : "no"}`);
-  console.log(`  TLD: ${config.lanMode ? "local" : config.tld}`);
+  console.log(`  TLDs: ${config.lanMode ? ".local" : formatTldList(config.tlds)}`);
   console.log(`  LAN mode: ${config.lanMode ? "yes" : "no"}`);
   if (config.lanIpExplicit && config.lanIp) {
     console.log(`  LAN IP: ${config.lanIp}`);
@@ -3645,7 +3733,7 @@ ${colors_default.bold("Install options:")}
   --https                          Enable HTTPS
   --lan                            Enable LAN mode
   --ip <address>                   Pin a specific LAN IP
-  --tld <tld>                      Use a custom TLD outside LAN mode
+  --tld <tld>                      Use a custom TLD outside LAN mode, repeatable
   --wildcard                       Allow subdomain fallback
   --cert <path>                    Use a custom TLS certificate
   --key <path>                     Use a custom TLS private key
@@ -3695,7 +3783,17 @@ var DEBOUNCE_MS = 100;
 var POLL_INTERVAL_MS = 3e3;
 var EXIT_TIMEOUT_MS = 2e3;
 var SUDO_SPAWN_TIMEOUT_MS = 3e4;
-function defaultProxyConfig(tld, useHttps, lanMode) {
+function normalizeTlds2(tlds) {
+  return [...new Set(tlds.length > 0 ? tlds : [DEFAULT_TLD])];
+}
+function primaryTld2(tlds) {
+  return tlds[0] ?? DEFAULT_TLD;
+}
+function formatTldList2(tlds) {
+  return tlds.map((tld) => `.${tld}`).join(", ");
+}
+function defaultProxyConfig(tlds, useHttps, lanMode) {
+  const effectiveTlds = lanMode ? ["local"] : normalizeTlds2(tlds);
   return {
     useHttps,
     customCertPath: null,
@@ -3703,13 +3801,14 @@ function defaultProxyConfig(tld, useHttps, lanMode) {
     lanMode,
     lanIp: null,
     lanIpExplicit: false,
-    tld: lanMode ? "local" : tld,
+    tld: primaryTld2(effectiveTlds),
+    tlds: effectiveTlds,
     useWildcard: false
   };
 }
 function resolveProxyConfig(options) {
   const config = defaultProxyConfig(
-    options.defaultTld,
+    options.defaultTlds,
     options.useHttps,
     options.explicit.lanMode ? options.lanMode : options.persistedLanMode
   );
@@ -3730,8 +3829,9 @@ function resolveProxyConfig(options) {
     if (!options.lanMode) {
       config.lanIp = null;
       config.lanIpExplicit = false;
-      if (!options.explicit.tld) {
-        config.tld = options.defaultTld;
+      if (!options.explicit.tlds) {
+        config.tlds = normalizeTlds2(options.defaultTlds);
+        config.tld = primaryTld2(config.tlds);
       }
     }
   }
@@ -3740,8 +3840,9 @@ function resolveProxyConfig(options) {
     config.lanIp = options.lanIp;
     config.lanIpExplicit = true;
   }
-  if (options.explicit.tld) {
-    config.tld = options.tld;
+  if (options.explicit.tlds) {
+    config.tlds = normalizeTlds2(options.tlds);
+    config.tld = primaryTld2(config.tlds);
   }
   if (options.explicit.useWildcard) {
     config.useWildcard = options.useWildcard;
@@ -3751,6 +3852,7 @@ function resolveProxyConfig(options) {
     config.lanIpExplicit = false;
   }
   if (config.lanMode) {
+    config.tlds = ["local"];
     config.tld = "local";
     if (!config.lanIpExplicit) {
       config.lanIp = null;
@@ -3764,15 +3866,17 @@ function resolveProxyConfig(options) {
 }
 function readCurrentProxyConfig(dir) {
   const lanIp = readLanMarker(dir);
-  const tld = readTldFromDir(dir);
+  const tlds = readTldsFromDir(dir);
+  const tld = primaryTld2(tlds);
   return {
     useHttps: readTlsMarker(dir),
     customCertPath: null,
     customKeyPath: null,
-    lanMode: lanIp !== null || tld === "local",
+    lanMode: lanIp !== null || tlds.includes("local"),
     lanIp,
     lanIpExplicit: false,
     tld,
+    tlds,
     useWildcard: false
   };
 }
@@ -3793,9 +3897,9 @@ function getProxyConfigMismatchMessages(desiredConfig, actualConfig, explicit) {
       desiredConfig.useHttps ? "requested HTTPS, but the running proxy is using HTTP" : "requested HTTP, but the running proxy is using HTTPS"
     );
   }
-  if (explicit.tld && desiredConfig.tld !== actualConfig.tld) {
+  if (explicit.tlds && (desiredConfig.tlds.length !== actualConfig.tlds.length || desiredConfig.tlds.some((tld, index) => tld !== actualConfig.tlds[index]))) {
     messages.push(
-      `requested .${desiredConfig.tld}, but the running proxy is using .${actualConfig.tld}`
+      `requested ${formatTldList2(desiredConfig.tlds)}, but the running proxy is using ${formatTldList2(actualConfig.tlds)}`
     );
   }
   return messages;
@@ -3810,6 +3914,7 @@ function formatProxyStartCommand(proxyPort, config) {
     lanIp: config.lanIpExplicit ? config.lanIp : null,
     lanIpExplicit: config.lanIpExplicit,
     tld: config.tld,
+    tlds: config.tlds,
     useWildcard: config.useWildcard,
     includePort: proxyPort !== getDefaultPort(config.useHttps),
     proxyPort
@@ -3903,7 +4008,46 @@ function formatProcessExitSuffix(code, signal) {
   if (code !== null) return ` (exit ${code})`;
   return "";
 }
-function startProxyServer(store, proxyPort, tld, tlsOptions, lanIp, strict, customCert = false) {
+function buildHostnames(name, tlds) {
+  return parseHostnames(name, normalizeTlds2(tlds));
+}
+function formatUrls(hostnames, proxyPort, tls2) {
+  return hostnames.map((hostname) => formatUrl(hostname, proxyPort, tls2));
+}
+function formatViteAllowedHosts(tlds) {
+  return tlds.map((configuredTld) => `.${configuredTld}`).join(",");
+}
+function addRoutes(store, hostnames, port, pid, force = false) {
+  const registered = [];
+  const killedPids = [];
+  try {
+    for (const hostname of hostnames) {
+      const killedPid = store.addRoute(hostname, port, pid, force);
+      registered.push(hostname);
+      if (killedPid !== void 0) {
+        killedPids.push(killedPid);
+      }
+    }
+  } catch (err) {
+    for (const hostname of registered) {
+      try {
+        store.removeRoute(hostname, pid);
+      } catch {
+      }
+    }
+    throw err;
+  }
+  return [...new Set(killedPids)];
+}
+function removeRoutes(store, hostnames, ownerPid) {
+  for (const hostname of hostnames) {
+    try {
+      store.removeRoute(hostname, ownerPid);
+    } catch {
+    }
+  }
+}
+function startProxyServer(store, proxyPort, tld, tlds, tlsOptions, lanIp, strict, customCert = false) {
   store.ensureDir();
   const isTls = !!tlsOptions;
   const mdnsSupport = isMdnsSupported();
@@ -3995,6 +4139,7 @@ function startProxyServer(store, proxyPort, tld, tlsOptions, lanIp, strict, cust
     getRoutes: () => cachedRoutes,
     proxyPort,
     tld,
+    tlds,
     strict,
     onError: (msg) => console.error(colors_default.red(msg)),
     tls: tlsOptions
@@ -4033,11 +4178,11 @@ function startProxyServer(store, proxyPort, tld, tlsOptions, lanIp, strict, cust
     fs9.writeFileSync(store.portFilePath, proxyPort.toString(), { mode: FILE_MODE });
     writeTlsMarker(store.dir, isTls);
     writeCustomCertMarker(store.dir, isTls && customCert);
-    writeTldFile(store.dir, tld);
+    writeTldsFile(store.dir, tlds);
     writeLanMarker(store.dir, activeLanIp);
     fixOwnership(store.dir, store.pidPath, store.portFilePath);
     const proto = isTls ? "HTTPS/2" : "HTTP";
-    const tldLabel = tld !== DEFAULT_TLD ? ` (TLD: .${tld})` : "";
+    const tldLabel = tlds.length > 1 || tld !== DEFAULT_TLD ? ` (TLDs: ${formatTldList2(tlds)})` : "";
     const modeLabel = strict === false ? " (wildcard)" : "";
     console.log(
       colors_default.green(`${proto} proxy listening on port ${proxyPort}${tldLabel}${modeLabel}`)
@@ -4255,28 +4400,29 @@ function listRoutes(store, proxyPort, tls2) {
   console.log();
 }
 function resolveProxyDesiredState(lanMode) {
-  const envTld = getDefaultTld();
+  const envTlds = getDefaultTlds();
+  const envTld = primaryTld2(envTlds);
   const explicit = {
     useHttps: process.env.PORTLESS_HTTPS !== void 0,
     customCert: false,
     lanMode: process.env.PORTLESS_LAN !== void 0,
     lanIp: process.env.PORTLESS_LAN_IP !== void 0,
-    tld: process.env.PORTLESS_TLD !== void 0,
+    tlds: process.env.PORTLESS_TLD !== void 0,
     useWildcard: process.env.PORTLESS_WILDCARD !== void 0
   };
   const desiredConfig = resolveProxyConfig({
     persistedLanMode: lanMode,
     explicit,
-    defaultTld: envTld,
+    defaultTlds: envTlds,
     useHttps: !isHttpsEnvDisabled(),
     customCertPath: null,
     customKeyPath: null,
     lanMode: isLanEnvEnabled(),
     lanIp: process.env.PORTLESS_LAN_IP || null,
-    tld: envTld,
+    tlds: envTlds,
     useWildcard: isWildcardEnvEnabled()
   });
-  return { explicit, desiredConfig, envTld };
+  return { explicit, desiredConfig, envTld, envTlds };
 }
 async function ensureProxyRunning(proxyPort, tls2, desired) {
   const { explicit, desiredConfig } = desired;
@@ -4292,8 +4438,9 @@ async function ensureProxyRunning(proxyPort, tls2, desired) {
     if (!explicit.useHttps && persisted.tls !== desiredConfig.useHttps) {
       startConfig.useHttps = persisted.tls;
     }
-    if (!explicit.tld && persisted.tld !== desiredConfig.tld) {
-      startConfig.tld = persisted.tld;
+    if (!explicit.tlds && (persisted.tlds.length !== desiredConfig.tlds.length || persisted.tlds.some((tld, index) => tld !== desiredConfig.tlds[index]))) {
+      startConfig.tlds = persisted.tlds;
+      startConfig.tld = primaryTld2(persisted.tlds);
     }
     if (!explicit.lanMode && persisted.lanMode !== desiredConfig.lanMode) {
       startConfig.lanMode = persisted.lanMode;
@@ -4329,6 +4476,7 @@ async function ensureProxyRunning(proxyPort, tls2, desired) {
     lanIp: startConfig.lanIpExplicit ? startConfig.lanIp : null,
     lanIpExplicit: startConfig.lanIpExplicit,
     tld: startConfig.tld,
+    tlds: startConfig.tlds,
     useWildcard: startConfig.useWildcard,
     includePort: startPort !== void 0,
     proxyPort: startPort
@@ -4363,7 +4511,7 @@ async function ensureProxyRunning(proxyPort, tls2, desired) {
   }
   return { started: true, state: discovered };
 }
-async function runApp(initialStore, proxyPort, stateDir, name, commandArgs, tls2, tld, force, autoInfo, desiredPort, lanMode = false, lanIp) {
+async function runApp(initialStore, proxyPort, stateDir, name, commandArgs, tls2, tlds, force, autoInfo, desiredPort, lanMode = false, lanIp) {
   let store = initialStore;
   console.log(chalk.blue.bold(`
 portless
@@ -4410,12 +4558,12 @@ portless
     console.error(colors_default.red(`Error: ${err.message}`));
     process.exit(1);
   }
-  parseHostname(name, tld);
+  buildHostnames(name, tlds);
   const ensureResult = await ensureProxyRunning(proxyPort, tls2, desired);
   if (ensureResult.started) {
     proxyPort = ensureResult.state.port;
     stateDir = ensureResult.state.dir;
-    tld = ensureResult.state.tld;
+    tlds = ensureResult.state.tlds;
     tls2 = ensureResult.state.tls;
     lanMode = ensureResult.state.lanMode;
     lanIp = ensureResult.state.lanIp;
@@ -4437,20 +4585,22 @@ portless
     }
     lanMode = runningConfig.lanMode;
     lanIp = runningConfig.lanIp;
+    tlds = runningConfig.tlds;
     console.log(chalk.gray("-- Proxy is running"));
   }
-  const hostname = parseHostname(name, tld);
-  if (desired.envTld !== DEFAULT_TLD && desired.envTld !== tld) {
+  const hostnames = buildHostnames(name, tlds);
+  const hostname = hostnames[0];
+  if (desired.explicit.tlds && (desired.envTlds.some((envConfiguredTld, index) => envConfiguredTld !== tlds[index]) || desired.envTlds.length !== tlds.length)) {
     console.warn(
       chalk.yellow(
-        `Warning: PORTLESS_TLD=${desired.envTld} but the running proxy uses .${tld}. Using .${tld}.`
+        `Warning: PORTLESS_TLD=${desired.envTlds.join(",")} but the running proxy uses ${formatTldList2(tlds)}.`
       )
     );
   }
   if (lanIp) {
-    console.log(chalk.gray(`-- ${hostname} (LAN: ${lanIp})`));
+    console.log(chalk.gray(`-- ${hostnames.join(", ")} (LAN: ${lanIp})`));
   } else {
-    console.log(chalk.gray(`-- ${hostname} (auto-resolves to 127.0.0.1)`));
+    console.log(chalk.gray(`-- ${hostnames.join(", ")} (auto-resolves to 127.0.0.1)`));
   }
   if (autoInfo) {
     const baseName = autoInfo.prefix ? name.slice(autoInfo.prefix.length + 1) : name;
@@ -4465,9 +4615,9 @@ portless
   } else {
     console.log(colors_default.green(`-- Using port ${port}`));
   }
-  let killedPid;
+  let killedPids = [];
   try {
-    killedPid = store.addRoute(hostname, port, process.pid, force);
+    killedPids = addRoutes(store, hostnames, port, process.pid, force);
   } catch (err) {
     if (err instanceof RouteConflictError) {
       console.error(colors_default.red(`Error: ${err.message}`));
@@ -4475,13 +4625,20 @@ portless
     }
     throw err;
   }
-  if (killedPid !== void 0) {
-    console.log(colors_default.yellow(`Killed existing process (PID ${killedPid})`));
+  if (killedPids.length > 0) {
+    console.log(colors_default.yellow(`Killed existing process(es): ${killedPids.join(", ")}`));
   }
   const finalUrl = formatUrl(hostname, proxyPort, tls2);
+  const allUrls = formatUrls(hostnames, proxyPort, tls2);
   console.log(chalk.cyan.bold(`
   -> ${finalUrl}
 `));
+  for (const extraUrl of allUrls.slice(1)) {
+    console.log(chalk.cyan(`  also -> ${extraUrl}`));
+  }
+  if (allUrls.length > 1) {
+    console.log("");
+  }
   if (lanIp) {
     console.log(chalk.green(`  LAN -> ${finalUrl}`));
     console.log(chalk.gray("  (accessible from other devices on the same WiFi network)\n"));
@@ -4594,7 +4751,7 @@ portless
       } catch {
       }
       try {
-        store.removeRoute(hostname, process.pid);
+        removeRoutes(store, hostnames, process.pid);
       } catch {
       }
       process.exit(1);
@@ -4628,7 +4785,7 @@ portless
       PORT: port.toString(),
       ...hostBind ? { HOST: hostBind } : {},
       PORTLESS_URL: finalUrl,
-      __VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS: `.${tld}`,
+      __VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS: formatViteAllowedHosts(tlds),
       // Note: EXPO_PACKAGER_PROXY_URL is not used — expo-dev-client removed
       // baked-in pinging, making this env var ineffective. Expo handles its
       // own LAN discovery natively.
@@ -4648,7 +4805,7 @@ portless
       } catch {
       }
       try {
-        store.removeRoute(hostname, process.pid);
+        removeRoutes(store, hostnames, process.pid);
       } catch {
       }
     }
@@ -4941,7 +5098,7 @@ ${colors_default.bold("Options:")}
   --cert <path>                 Use a custom TLS certificate
   --key <path>                  Use a custom TLS private key
   --foreground                  Run proxy in foreground (for debugging)
-  --tld <tld>                   Use a custom TLD instead of .localhost (e.g. test, dev)
+  --tld <tld>                   Use a custom TLD instead of .localhost; repeat for more
   --wildcard                    Allow unregistered subdomains to fall back to parent route
   --state-dir <path>            Use a custom state directory with service install
   --app-port <number>           Use a fixed port for the app (skip auto-assignment)
@@ -4958,7 +5115,7 @@ ${colors_default.bold("Environment variables:")}
   PORTLESS_HTTPS=0              Disable HTTPS (same as --no-tls)
   PORTLESS_LAN=1                Enable LAN mode when set to 1 (set in .bashrc / .zshrc)
   PORTLESS_LAN_IP=<address>     Pin a specific LAN IP for LAN mode
-  PORTLESS_TLD=<tld>            Use a custom TLD (e.g. test, dev; default: localhost)
+  PORTLESS_TLD=<tld>[,<tld>]    Use one or more TLDs (e.g. localhost,test)
   PORTLESS_WILDCARD=1           Allow unregistered subdomains to fall back to parent route
   PORTLESS_SYNC_HOSTS=0         Disable auto-sync of ${HOSTS_DISPLAY} (on by default)
   PORTLESS_TAILSCALE=1          Share apps on your Tailscale network (same as --tailscale)
@@ -4970,7 +5127,7 @@ ${colors_default.bold("Environment variables:")}
 ${colors_default.bold("Child process environment:")}
   PORT                          Ephemeral port the child should listen on
   HOST                          Usually 127.0.0.1 (omitted for Expo in LAN mode)
-  PORTLESS_URL                  Public URL of the app (e.g. https://myapp.localhost)
+  PORTLESS_URL                  Primary public URL of the app
   PORTLESS_LAN                  Set to 1 when proxy is in LAN mode
   PORTLESS_TAILSCALE_URL        Tailscale URL of the app (when --tailscale is active)
   PORTLESS_NGROK_URL            ngrok URL of the app (when --ngrok is active)
@@ -4996,7 +5153,7 @@ ${colors_default.bold("Reserved names:")}
   process.exit(0);
 }
 function printVersion() {
-  console.log("0.15.0");
+  console.log("0.15.1");
   process.exit(0);
 }
 async function handleTrust() {
@@ -5271,8 +5428,8 @@ ${colors_default.bold("Examples:")}
   const name = positional[0];
   const worktree = skipWorktree ? null : detectWorktreePrefix();
   const effectiveName = worktree ? `${worktree.prefix}.${name}` : name;
-  const { port, tls: tls2, tld } = await discoverState();
-  const hostname = parseHostname(effectiveName, tld);
+  const { port, tls: tls2, tlds } = await discoverState();
+  const hostname = buildHostnames(effectiveName, tlds)[0];
   const url = formatUrl(hostname, port, tls2);
   process.stdout.write(url + "\n");
 }
@@ -5293,7 +5450,7 @@ ${colors_default.bold("Examples:")}
 `);
     process.exit(0);
   }
-  const { dir, tld } = await discoverState();
+  const { dir, tlds } = await discoverState();
   const store = new RouteStore(dir, {
     onWarning: (msg) => console.warn(colors_default.yellow(msg))
   });
@@ -5304,15 +5461,15 @@ ${colors_default.bold("Examples:")}
       console.error(colors_default.cyan("  portless alias --remove <name>"));
       process.exit(1);
     }
-    const hostname2 = parseHostname(aliasName2, tld);
+    const hostnames2 = buildHostnames(aliasName2, tlds);
     const routes = store.loadRoutes();
-    const existing = routes.find((r) => r.hostname === hostname2 && r.pid === 0);
+    const existing = routes.find((r) => hostnames2.includes(r.hostname) && r.pid === 0);
     if (!existing) {
-      console.error(colors_default.red(`Error: No alias found for "${hostname2}".`));
+      console.error(colors_default.red(`Error: No alias found for "${hostnames2.join(", ")}".`));
       process.exit(1);
     }
-    store.removeRoute(hostname2);
-    console.log(colors_default.green(`Removed alias: ${hostname2}`));
+    removeRoutes(store, hostnames2);
+    console.log(colors_default.green(`Removed alias: ${hostnames2.join(", ")}`));
     return;
   }
   const aliasName = args[1];
@@ -5326,15 +5483,15 @@ ${colors_default.bold("Examples:")}
     console.error(colors_default.cyan("  portless alias my-postgres 5432"));
     process.exit(1);
   }
-  const hostname = parseHostname(aliasName, tld);
+  const hostnames = buildHostnames(aliasName, tlds);
   const port = parseInt(aliasPort, 10);
   if (isNaN(port) || port < 1 || port > 65535) {
     console.error(colors_default.red(`Error: Invalid port "${aliasPort}". Must be 1-65535.`));
     process.exit(1);
   }
   const force = args.includes("--force");
-  store.addRoute(hostname, port, 0, force);
-  console.log(colors_default.green(`Alias registered: ${hostname} -> 127.0.0.1:${port}`));
+  addRoutes(store, hostnames, port, 0, force);
+  console.log(colors_default.green(`Alias registered: ${hostnames.join(", ")} -> 127.0.0.1:${port}`));
 }
 async function handleHosts(args) {
   if (args[1] === "--help" || args[1] === "-h") {
@@ -5524,6 +5681,7 @@ ${colors_default.bold("Options:")}
       port: getDefaultPort(!isHttpsEnvDisabled()),
       tls: !isHttpsEnvDisabled(),
       tld: DEFAULT_TLD,
+      tlds: [DEFAULT_TLD],
       lanMode: isLanEnvEnabled(),
       lanIp: null
     };
@@ -5545,12 +5703,14 @@ ${colors_default.bold("Options:")}
   const proxyUsesCustomCert = proxyTls && readCustomCertMarker(state.dir);
   const stateExists = fs9.existsSync(state.dir);
   console.log(colors_default.blue.bold("\nportless doctor\n"));
-  console.log(`Version: ${"0.15.0"}`);
+  console.log(`Version: ${"0.15.1"}`);
   console.log(`Node.js: ${process.versions.node}`);
   console.log(`Platform: ${process.platform} ${process.arch}`);
   console.log(`State dir: ${state.dir}`);
   console.log(`Proxy target: ${formatUrl("127.0.0.1", proxyPort, proxyTls)}`);
-  console.log(`Mode: ${proxyTls ? "HTTPS" : "HTTP"}, .${state.tld}${state.lanMode ? ", LAN" : ""}`);
+  console.log(
+    `Mode: ${proxyTls ? "HTTPS" : "HTTP"}, ${formatTldList2(state.tlds)}${state.lanMode ? ", LAN" : ""}`
+  );
   console.log("");
   const nodeMajor = parseInt(process.versions.node.split(".")[0], 10);
   if (nodeMajor >= 24) {
@@ -5822,6 +5982,7 @@ ${colors_default.bold("Usage:")}
   ${colors_default.cyan("portless proxy start --foreground")}   Start in foreground (for debugging)
   ${colors_default.cyan("portless proxy start -p 1355")}        Start on a custom port (no sudo)
   ${colors_default.cyan("portless proxy start --tld test")}     Use .test instead of .localhost
+  ${colors_default.cyan("portless proxy start --tld localhost --tld test")}  Serve both TLDs
   ${colors_default.cyan("portless proxy start --wildcard")}     Allow unregistered subdomains to fall back to parent
   ${colors_default.cyan("portless proxy stop")}                 Stop the proxy
 
@@ -5883,34 +6044,41 @@ ${colors_default.bold("LAN mode (--lan):")}
     }
     hasExplicitPort = true;
   }
-  let tld;
+  let tlds;
   try {
-    tld = getDefaultTld();
+    tlds = getDefaultTlds();
   } catch (err) {
     console.error(colors_default.red(`Error: ${err.message}`));
     process.exit(1);
   }
-  const tldIdx = args.indexOf("--tld");
-  if (tldIdx !== -1) {
-    const tldValue = args[tldIdx + 1];
-    if (!tldValue || tldValue.startsWith("-")) {
-      console.error(colors_default.red("Error: --tld requires a TLD value (e.g. test, localhost)."));
-      process.exit(1);
+  const tldFlagValues = [];
+  for (let i = 0; i < args.length; i += 1) {
+    if (args[i] === "--tld") {
+      const tldValue = args[i + 1];
+      if (!tldValue || tldValue.startsWith("-")) {
+        console.error(colors_default.red("Error: --tld requires a TLD value (e.g. test, localhost)."));
+        process.exit(1);
+      }
+      tldFlagValues.push(tldValue);
+      i += 1;
     }
-    tld = tldValue.trim().toLowerCase();
-    const tldErr = validateTld(tld);
-    if (tldErr) {
-      console.error(colors_default.red(`Error: ${tldErr}`));
+  }
+  if (tldFlagValues.length > 0) {
+    try {
+      tlds = normalizeTlds2(tldFlagValues.flatMap((value) => parseTldList(value)));
+    } catch (err) {
+      console.error(colors_default.red(`Error: ${err.message}`));
       process.exit(1);
     }
   }
+  let tld = primaryTld2(tlds);
   const useWildcard = args.includes("--wildcard") || isWildcardEnvEnabled();
   const explicit = {
     useHttps: hasHttpsFlag || hasNoTls || customCertPath !== null || customKeyPath !== null || process.env.PORTLESS_HTTPS !== void 0,
     customCert: customCertPath !== null || customKeyPath !== null,
     lanMode: process.env.PORTLESS_LAN !== void 0,
     lanIp: process.env.PORTLESS_LAN_IP !== void 0,
-    tld: tldIdx !== -1 || process.env.PORTLESS_TLD !== void 0,
+    tlds: tldFlagValues.length > 0 || process.env.PORTLESS_TLD !== void 0,
     useWildcard: args.includes("--wildcard") || process.env.PORTLESS_WILDCARD !== void 0
   };
   let stateDir = resolveStateDir(proxyPort);
@@ -5928,13 +6096,13 @@ ${colors_default.bold("LAN mode (--lan):")}
   const desiredConfig = resolveProxyConfig({
     persistedLanMode,
     explicit,
-    defaultTld: getDefaultTld(),
+    defaultTlds: getDefaultTlds(),
     useHttps: wantHttps || !!(customCertPath && customKeyPath),
     customCertPath,
     customKeyPath,
     lanMode: isLanEnvEnabled(),
     lanIp: process.env.PORTLESS_LAN_IP || null,
-    tld,
+    tlds,
     useWildcard
   });
   const lanMode = desiredConfig.lanMode;
@@ -5942,31 +6110,35 @@ ${colors_default.bold("LAN mode (--lan):")}
   customCertPath = desiredConfig.customCertPath;
   customKeyPath = desiredConfig.customKeyPath;
   tld = desiredConfig.tld;
+  tlds = desiredConfig.tlds;
   const desiredWildcard = desiredConfig.useWildcard;
   let lanIp = desiredConfig.lanIpExplicit ? desiredConfig.lanIp : null;
   if (!hasExplicitPort && runningPort === null) {
     proxyPort = getDefaultPort(useHttps);
     stateDir = resolveStateDir(proxyPort);
   }
-  if (lanMode && tldIdx !== -1) {
-    const userTld = args[tldIdx + 1];
-    if (userTld && userTld !== "local") {
+  if (lanMode && tldFlagValues.length > 0) {
+    const userTlds = tldFlagValues.join(", ");
+    if (userTlds !== "local") {
       console.warn(
         chalk.yellow(
-          `Warning: --lan forces .local TLD (mDNS requirement). Ignoring --tld ${userTld}.`
+          `Warning: --lan forces .local TLD (mDNS requirement). Ignoring --tld ${userTlds}.`
         )
       );
     }
   }
-  const riskyReason = RISKY_TLDS.get(tld);
-  if (riskyReason && !lanMode) {
-    console.warn(colors_default.yellow(`Warning: .${tld}: ${riskyReason}`));
+  for (const configuredTld of tlds) {
+    const riskyReason = RISKY_TLDS.get(configuredTld);
+    if (riskyReason && !lanMode) {
+      console.warn(colors_default.yellow(`Warning: .${configuredTld}: ${riskyReason}`));
+    }
   }
   const syncDisabled = process.env.PORTLESS_SYNC_HOSTS === "0" || process.env.PORTLESS_SYNC_HOSTS === "false";
-  if (tld !== DEFAULT_TLD && !lanMode && syncDisabled) {
+  const nonDefaultTlds = tlds.filter((configuredTld) => configuredTld !== DEFAULT_TLD);
+  if (nonDefaultTlds.length > 0 && !lanMode && syncDisabled) {
     console.warn(
       colors_default.yellow(
-        `Warning: .${tld} domains require ${HOSTS_DISPLAY} entries to resolve to 127.0.0.1.`
+        `Warning: ${formatTldList2(nonDefaultTlds)} domains require ${HOSTS_DISPLAY} entries to resolve to 127.0.0.1.`
       )
     );
     console.warn(colors_default.yellow("Hosts sync is disabled. To add entries manually, run:"));
@@ -6028,6 +6200,7 @@ ${colors_default.bold("LAN mode (--lan):")}
     lanIp: desiredConfig.lanIpExplicit ? lanIp : null,
     lanIpExplicit: desiredConfig.lanIpExplicit,
     tld,
+    tlds,
     useWildcard: desiredWildcard
   };
   if (!isWindows && proxyPort < PRIVILEGED_PORT_THRESHOLD && (process.getuid?.() ?? -1) !== 0) {
@@ -6044,6 +6217,7 @@ ${colors_default.bold("LAN mode (--lan):")}
         lanIp: desiredConfig.lanIpExplicit ? lanIp : null,
         lanIpExplicit: desiredConfig.lanIpExplicit,
         tld,
+        tlds,
         useWildcard: desiredWildcard,
         foreground: isForeground,
         includePort: true,
@@ -6161,7 +6335,7 @@ ${colors_default.bold("LAN mode (--lan):")}
         cert,
         key,
         ca,
-        SNICallback: createSNICallback(stateDir, cert, key, tld, ca)
+        SNICallback: createSNICallback(stateDir, cert, key, tlds, ca)
       };
     }
   }
@@ -6171,6 +6345,7 @@ ${colors_default.bold("LAN mode (--lan):")}
       store,
       proxyPort,
       tld,
+      tlds,
       tlsOptions,
       lanIp,
       desiredWildcard ? false : void 0,
@@ -6199,6 +6374,7 @@ ${colors_default.bold("LAN mode (--lan):")}
         lanIp: desiredConfig.lanIpExplicit ? lanIp : null,
         lanIpExplicit: desiredConfig.lanIpExplicit,
         tld,
+        tlds,
         useWildcard: desiredWildcard,
         foreground: true,
         includePort: true,
@@ -6292,7 +6468,7 @@ async function handleDefaultSingle(cwd, scriptName, appConfig) {
   }
   const worktree = detectWorktreePrefix(cwd);
   const effectiveName = worktree ? `${worktree.prefix}.${baseName}` : baseName;
-  const { dir, port, tls: tls2, tld, lanMode, lanIp } = await discoverState();
+  const { dir, port, tls: tls2, tlds, lanMode, lanIp } = await discoverState();
   const store = new RouteStore(dir, {
     onWarning: (msg) => console.warn(colors_default.yellow(msg))
   });
@@ -6303,7 +6479,7 @@ async function handleDefaultSingle(cwd, scriptName, appConfig) {
     effectiveName,
     resolved,
     tls2,
-    tld,
+    tlds,
     false,
     { nameSource, prefix: worktree?.prefix, prefixSource: worktree?.source },
     appConfig?.appPort,
@@ -6343,13 +6519,13 @@ function pipeOutput(child, prefix) {
   prefixStream(child.stdout, process.stdout, prefix);
   prefixStream(child.stderr, process.stderr, prefix);
 }
-async function spawnProxiedApp(app, stateDir, proxyPort, tls2, tld, exitCodes) {
+async function spawnProxiedApp(app, stateDir, proxyPort, tls2, tlds, exitCodes) {
   const usesPortless = app.commandArgs[0] === "portless";
   const pkgEnv = { ...process.env };
   pkgEnv.PATH = augmentedPath(pkgEnv, app.pkg.dir);
   let env;
   let store = null;
-  let hostname = null;
+  let hostnames = [];
   let displayUrl;
   if (usesPortless) {
     env = pkgEnv;
@@ -6359,17 +6535,17 @@ async function spawnProxiedApp(app, stateDir, proxyPort, tls2, tld, exitCodes) {
       onWarning: (msg) => console.warn(colors_default.yellow(`[${app.name}] ${msg}`))
     });
     const appPort = app.appPort ?? await findFreePort();
-    const protocol = tls2 ? "https" : "http";
-    const portSuffix = tls2 && proxyPort === 443 || !tls2 && proxyPort === 80 ? "" : `:${proxyPort}`;
-    const url = `${protocol}://${app.name}.${tld}${portSuffix}`;
+    hostnames = buildHostnames(app.name, tlds);
+    const urls = formatUrls(hostnames, proxyPort, tls2);
+    const url = urls[0];
     displayUrl = url;
-    hostname = parseHostname(app.name, tld);
-    store.addRoute(hostname, appPort, process.pid);
+    addRoutes(store, hostnames, appPort, process.pid);
     env = {
       ...pkgEnv,
       PORT: String(appPort),
       HOST: "127.0.0.1",
-      PORTLESS_URL: url
+      PORTLESS_URL: url,
+      __VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS: formatViteAllowedHosts(tlds)
     };
     if (tls2) {
       const caPath = path9.join(stateDir, "ca.pem");
@@ -6381,7 +6557,7 @@ async function spawnProxiedApp(app, stateDir, proxyPort, tls2, tld, exitCodes) {
   const child = spawnChildProcess(app.commandArgs, env, app.pkg.dir);
   pipeOutput(child, chalk.cyan(`[${app.name}]`));
   const capturedStore = store;
-  const capturedHostname = hostname;
+  const capturedHostnames = hostnames;
   child.on("exit", (code, signal) => {
     exitCodes.set(app.name, code);
     if (code !== 0 && code !== null) {
@@ -6389,14 +6565,11 @@ async function spawnProxiedApp(app, stateDir, proxyPort, tls2, tld, exitCodes) {
     } else if (signal) {
       console.error(colors_default.yellow(`[${app.name}] killed by ${signal}`));
     }
-    if (capturedStore && capturedHostname) {
-      try {
-        capturedStore.removeRoute(capturedHostname, process.pid);
-      } catch {
-      }
+    if (capturedStore && capturedHostnames.length > 0) {
+      removeRoutes(capturedStore, capturedHostnames, process.pid);
     }
   });
-  const route = store && hostname ? { store, hostname } : null;
+  const route = store && hostnames.length > 0 ? { store, hostnames } : null;
   return { child, displayUrl, route };
 }
 function spawnTaskApp(app, exitCodes) {
@@ -6507,7 +6680,7 @@ async function handleDefaultMulti(wsRoot, globalScript, extraArgs = []) {
   console.log(chalk.blue.bold(`
 portless
 `));
-  let { dir, port, tls: tls2, tld } = await discoverState();
+  let { dir, port, tls: tls2, tlds } = await discoverState();
   if (proxiedApps.length > 0) {
     let multiDesired;
     try {
@@ -6521,9 +6694,9 @@ portless
       dir = ensureResult.state.dir;
       port = ensureResult.state.port;
       tls2 = ensureResult.state.tls;
-      tld = ensureResult.state.tld;
+      tlds = ensureResult.state.tlds;
     } else {
-      ({ dir, port, tls: tls2, tld } = await discoverState());
+      ({ dir, port, tls: tls2, tlds } = await discoverState());
     }
     if (tls2 && !isCATrusted(dir)) {
       await handleTrust();
@@ -6531,12 +6704,12 @@ portless
   }
   const useTurbo = loaded?.config.turbo !== false && hasTurboConfig(wsRoot);
   if (useTurbo) {
-    await runWithTurbo(wsRoot, dir, port, tls2, tld, scriptName, proxiedApps, taskApps, extraArgs);
+    await runWithTurbo(wsRoot, dir, port, tls2, tlds, scriptName, proxiedApps, taskApps, extraArgs);
   } else {
-    await runWithDirectSpawn(dir, port, tls2, tld, proxiedApps, taskApps);
+    await runWithDirectSpawn(dir, port, tls2, tlds, proxiedApps, taskApps);
   }
 }
-async function runWithTurbo(wsRoot, stateDir, proxyPort, tls2, tld, scriptName, proxiedApps, taskApps, extraArgs = []) {
+async function runWithTurbo(wsRoot, stateDir, proxyPort, tls2, tlds, scriptName, proxiedApps, taskApps, extraArgs = []) {
   const store = new RouteStore(stateDir, {
     onWarning: (msg) => console.warn(colors_default.yellow(msg))
   });
@@ -6550,17 +6723,17 @@ async function runWithTurbo(wsRoot, stateDir, proxyPort, tls2, tld, scriptName,
       continue;
     }
     const appPort = app.appPort ?? await findFreePort();
-    const protocol = tls2 ? "https" : "http";
-    const portSuffix = tls2 && proxyPort === 443 || !tls2 && proxyPort === 80 ? "" : `:${proxyPort}`;
-    const url = `${protocol}://${app.name}.${tld}${portSuffix}`;
+    const hostnames = buildHostnames(app.name, tlds);
+    const urls = formatUrls(hostnames, proxyPort, tls2);
+    const url = urls[0];
     appUrls.push({ label: app.label, url });
-    const hostname = parseHostname(app.name, tld);
-    store.addRoute(hostname, appPort, process.pid);
-    routes.push({ hostname });
+    addRoutes(store, hostnames, appPort, process.pid);
+    routes.push({ hostnames });
     const entry = {
       PORT: String(appPort),
       HOST: "127.0.0.1",
-      PORTLESS_URL: url
+      PORTLESS_URL: url,
+      __VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS: formatViteAllowedHosts(tlds)
     };
     if (tls2) {
       const caPath = path9.join(stateDir, "ca.pem");
@@ -6603,11 +6776,8 @@ async function runWithTurbo(wsRoot, stateDir, proxyPort, tls2, tld, scriptName,
         killTree(turboChild, "SIGKILL");
       }
     }, SIGKILL_TIMEOUT_MS).unref();
-    for (const { hostname } of routes) {
-      try {
-        store.removeRoute(hostname, process.pid);
-      } catch {
-      }
+    for (const { hostnames } of routes) {
+      removeRoutes(store, hostnames, process.pid);
     }
     removeManifest();
   };
@@ -6621,7 +6791,7 @@ async function runWithTurbo(wsRoot, stateDir, proxyPort, tls2, tld, scriptName,
     process.exit(exitCode);
   }
 }
-async function runWithDirectSpawn(stateDir, proxyPort, tls2, tld, proxiedApps, taskApps) {
+async function runWithDirectSpawn(stateDir, proxyPort, tls2, tlds, proxiedApps, taskApps) {
   const children = [];
   const exitCodes = /* @__PURE__ */ new Map();
   const appUrls = [];
@@ -6632,7 +6802,7 @@ async function runWithDirectSpawn(stateDir, proxyPort, tls2, tld, proxiedApps, t
       stateDir,
       proxyPort,
       tls2,
-      tld,
+      tlds,
       exitCodes
     );
     children.push(child);
@@ -6667,11 +6837,8 @@ async function runWithDirectSpawn(stateDir, proxyPort, tls2, tld, proxiedApps, t
         }
       }
     }, SIGKILL_TIMEOUT_MS).unref();
-    for (const { store, hostname } of routeEntries) {
-      try {
-        store.removeRoute(hostname, process.pid);
-      } catch {
-      }
+    for (const { store, hostnames } of routeEntries) {
+      removeRoutes(store, hostnames, process.pid);
     }
   };
   process.on("SIGINT", cleanup);
@@ -6730,7 +6897,7 @@ async function handleRunMode(args, globalScript) {
   }
   const worktree = detectWorktreePrefix();
   const effectiveName = worktree ? `${worktree.prefix}.${baseName}` : baseName;
-  const { dir, port, tls: tls2, tld, lanMode, lanIp } = await discoverState();
+  const { dir, port, tls: tls2, tlds, lanMode, lanIp } = await discoverState();
   const store = new RouteStore(dir, {
     onWarning: (msg) => console.warn(colors_default.yellow(msg))
   });
@@ -6741,7 +6908,7 @@ async function handleRunMode(args, globalScript) {
     effectiveName,
     parsed.commandArgs,
     tls2,
-    tld,
+    tlds,
     parsed.force,
     { nameSource, prefix: worktree?.prefix, prefixSource: worktree?.source },
     parsed.appPort,
@@ -6767,7 +6934,7 @@ async function handleNamedMode(args) {
   }
   const safeName = parsed.name.split(".").map((label) => truncateLabel(label)).join(".");
   parseHostname(safeName, DEFAULT_TLD);
-  const { dir, port, tls: tls2, tld, lanMode, lanIp } = await discoverState();
+  const { dir, port, tls: tls2, tlds, lanMode, lanIp } = await discoverState();
   const store = new RouteStore(dir, {
     onWarning: (msg) => console.warn(colors_default.yellow(msg))
   });
@@ -6778,7 +6945,7 @@ async function handleNamedMode(args) {
     safeName,
     parsed.commandArgs,
     tls2,
-    tld,
+    tlds,
     parsed.force,
     void 0,
     parsed.appPort,