unplugin-https-reverse-proxy 4.0.3 → 4.1.0-beta.10

package/dist/privileged-helper.cjs

@@ -0,0 +1,824 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// src/privileged-helper.ts
+var import_node_process3 = __toESM(require("process"), 1);
+
+// src/privileged/bootstrap.ts
+var import_node_buffer = require("buffer");
+var import_node_fs3 = require("fs");
+var import_node_net3 = require("net");
+var import_node_path2 = require("path");
+var import_node_process2 = __toESM(require("process"), 1);
+
+// src/privileged/path-guard.ts
+var import_node_fs = require("fs");
+function describe(stats) {
+  return `uid=${stats.uid} mode=${(stats.mode & 511).toString(8)}`;
+}
+function checkPrivilegedPath(path, options) {
+  let stats;
+  try {
+    stats = (0, import_node_fs.lstatSync)(path);
+  } catch (error) {
+    return { path, reason: `${options.label} is not readable: ${error.message}` };
+  }
+  if (stats.isSymbolicLink())
+    return { path, reason: `${options.label} is a symbolic link (${describe(stats)})` };
+  if (!stats.isFile() && !stats.isDirectory())
+    return { path, reason: `${options.label} is neither a file nor a directory` };
+  const allowedOwner = stats.uid === 0 || options.ownerUid !== void 0 && stats.uid === options.ownerUid;
+  if (!allowedOwner)
+    return { path, reason: `${options.label} is owned by another user (${describe(stats)})` };
+  if (stats.mode & 18)
+    return { path, reason: `${options.label} is group- or world-writable (${describe(stats)})` };
+  return void 0;
+}
+function describeRejection(rejection) {
+  return `refusing to start: ${rejection.reason} (${rejection.path})`;
+}
+
+// src/privileged/server.ts
+var import_node_child_process = require("child_process");
+var import_node_fs2 = require("fs");
+var import_node_os = require("os");
+var import_node_path = require("path");
+var import_node_process = __toESM(require("process"), 1);
+var import_node_util = require("util");
+
+// src/privileged/hosts-file.ts
+var import_node_net = require("net");
+var HOSTS_MARKER = "# uhrp";
+var HOSTS_MARKER_PATTERN = /#\s*uhrp\b/;
+function detectEol(content) {
+  return content.includes("\r\n") ? "\r\n" : "\n";
+}
+function toBodyLines(content) {
+  const lines = content.split(/\r?\n/);
+  if (lines.length > 0 && lines[lines.length - 1] === "")
+    lines.pop();
+  return lines;
+}
+function parseLine(line) {
+  const withoutComment = line.replace(/#.*/, "").trim();
+  if (!withoutComment)
+    return void 0;
+  const [ip, ...hosts] = withoutComment.split(/\s+/);
+  if (!ip || hosts.length === 0)
+    return void 0;
+  return { ip, hosts };
+}
+function isOwned(line) {
+  return HOSTS_MARKER_PATTERN.test(line);
+}
+function mentionsHost(entry, host) {
+  return entry.hosts.some((candidate) => candidate.toLowerCase() === host.toLowerCase());
+}
+function sameIpFamily(left, right) {
+  const leftVersion = (0, import_node_net.isIP)(left);
+  return leftVersion !== 0 && leftVersion === (0, import_node_net.isIP)(right);
+}
+function rebuild(lines, original, eol) {
+  const content = lines.length > 0 ? lines.join(eol) + eol : "";
+  return { content, changed: content !== original };
+}
+function addHost(content, ip, host) {
+  var _a;
+  const eol = detectEol(content);
+  const lines = [];
+  for (const line of toBodyLines(content)) {
+    const entry = parseLine(line);
+    if (!entry || !mentionsHost(entry, host) || !sameIpFamily(entry.ip, ip)) {
+      lines.push(line);
+      continue;
+    }
+    const remaining = entry.hosts.filter((candidate) => candidate.toLowerCase() !== host.toLowerCase());
+    if (remaining.length === 0)
+      continue;
+    const comment = ((_a = line.match(/#.*/)) == null ? void 0 : _a[0]) ?? "";
+    const rebuilt = `${entry.ip} ${remaining.join(" ")}${comment ? ` ${comment}` : ""}`;
+    lines.push(rebuilt);
+  }
+  lines.push(`${ip} ${host} ${HOSTS_MARKER}`);
+  return rebuild(lines, content, eol);
+}
+function removeHost(content, ip, host) {
+  var _a;
+  const eol = detectEol(content);
+  const lines = [];
+  for (const line of toBodyLines(content)) {
+    const entry = parseLine(line);
+    if (!entry || entry.ip !== ip || !mentionsHost(entry, host)) {
+      lines.push(line);
+      continue;
+    }
+    const remaining = entry.hosts.filter((candidate) => candidate.toLowerCase() !== host.toLowerCase());
+    if (remaining.length === 0)
+      continue;
+    const comment = ((_a = line.match(/#.*/)) == null ? void 0 : _a[0]) ?? "";
+    lines.push(`${entry.ip} ${remaining.join(" ")}${comment ? ` ${comment}` : ""}`);
+  }
+  return rebuild(lines, content, eol);
+}
+function removeMarkedHosts(content) {
+  const eol = detectEol(content);
+  const lines = toBodyLines(content).filter((line) => !isOwned(line));
+  return rebuild(lines, content, eol);
+}
+
+// src/privileged/ports.ts
+function parseListeningPids(output) {
+  const pids = /* @__PURE__ */ new Set();
+  for (const line of output.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed)
+      continue;
+    if (!/^\d+$/.test(trimmed))
+      continue;
+    const pid = Number(trimmed);
+    if (Number.isSafeInteger(pid) && pid > 0)
+      pids.add(pid);
+  }
+  return [...pids];
+}
+function parseWindowsListeningPids(output, port) {
+  const pids = /* @__PURE__ */ new Set();
+  const suffix = `:${port}`;
+  for (const line of output.split(/\r?\n/)) {
+    const columns = line.trim().split(/\s+/);
+    if (columns.length < 5)
+      continue;
+    const protocol = columns[0].toUpperCase();
+    if (protocol !== "TCP")
+      continue;
+    if (!columns[1].endsWith(suffix))
+      continue;
+    if (columns[3].toUpperCase() !== "LISTENING")
+      continue;
+    const pid = Number(columns[4]);
+    if (Number.isSafeInteger(pid) && pid > 0)
+      pids.add(pid);
+  }
+  return [...pids];
+}
+
+// src/privileged/protocol.ts
+function serializeMessage(message) {
+  return `${JSON.stringify(message)}
+`;
+}
+
+// src/privileged/validation.ts
+var import_node_net2 = require("net");
+var ALLOWED_FREE_PORTS = /* @__PURE__ */ new Set([80, 443]);
+var HOSTNAME_PATTERN = /^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)*[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i;
+var IPV6_IN_HOSTS = /^[0-9a-f:.]+$/i;
+function isSafeHost(host) {
+  if (typeof host !== "string" || host.length === 0 || host.length > 253)
+    return false;
+  if (/[\s#\0]/.test(host))
+    return false;
+  return HOSTNAME_PATTERN.test(host);
+}
+function isSafeIp(ip) {
+  if (typeof ip !== "string")
+    return false;
+  if ((0, import_node_net2.isIP)(ip) !== 0)
+    return true;
+  return IPV6_IN_HOSTS.test(ip);
+}
+function isAllowedFreePort(port) {
+  return typeof port === "number" && Number.isInteger(port) && ALLOWED_FREE_PORTS.has(port);
+}
+
+// src/privileged/server.ts
+var execFileAsync = (0, import_node_util.promisify)(import_node_child_process.execFile);
+function execFileQuiet(file, args) {
+  return new Promise((resolve) => {
+    (0, import_node_child_process.execFile)(file, args, (error, stdout) => resolve({ stdout: error && !stdout ? "" : stdout }));
+  });
+}
+var HOSTS_PATH = (0, import_node_os.platform)() === "win32" ? "C:\\Windows\\System32\\drivers\\etc\\hosts" : "/etc/hosts";
+var FLUSH_COMMANDS = {
+  win32: [{ file: "ipconfig", args: ["/flushdns"] }],
+  darwin: [{ file: "killall", args: ["-HUP", "mDNSResponder"] }],
+  // systemd-resolved is the common case; the legacy name covers older distros
+  // and hosts without resolved simply have no cache to drop.
+  linux: [
+    { file: "resolvectl", args: ["flush-caches"] },
+    { file: "systemd-resolve", args: ["--flush-caches"] }
+  ]
+};
+var FLUSH_FALLBACK = [{ file: "killall", args: ["-HUP", "mDNSResponder"] }];
+async function flushDnsBestEffort(deps) {
+  try {
+    await deps.flushDns();
+  } catch (error) {
+    deps.log(`dns flush failed: ${error.message}`);
+  }
+}
+function createHelperRuntime(deps) {
+  const clients = /* @__PURE__ */ new Set();
+  let teardown;
+  let generation = 0;
+  let caddy;
+  const hostOwners = /* @__PURE__ */ new Map();
+  const hostId = (ip, host) => `${ip} ${host.toLowerCase()}`;
+  function addHostOwner(client, ip, host) {
+    const id = hostId(ip, host);
+    let owners = hostOwners.get(id);
+    if (!owners) {
+      owners = /* @__PURE__ */ new Set();
+      hostOwners.set(id, owners);
+    }
+    owners.add(client ?? deps);
+  }
+  function releaseHostOwner(client, ip, host) {
+    const id = hostId(ip, host);
+    const owners = hostOwners.get(id);
+    if (!owners)
+      return true;
+    owners.delete(client ?? deps);
+    if (owners.size > 0)
+      return false;
+    hostOwners.delete(id);
+    return true;
+  }
+  const broadcast = (event) => {
+    const line = serializeMessage(event);
+    for (const client of clients) {
+      const socket = client;
+      if (typeof socket.write === "function" && !socket.destroyed)
+        socket.write(line);
+    }
+  };
+  async function stopCaddy() {
+    const current = caddy;
+    caddy = void 0;
+    if (current) {
+      try {
+        current.kill("SIGTERM");
+      } catch {
+      }
+    }
+    await deps.stopCaddy().catch(() => {
+    });
+    if (deps.caddyStoragePath && deps.storageOwner)
+      await reclaimTree(deps.caddyStoragePath, deps.storageOwner.uid, deps.storageOwner.gid).catch(() => {
+      });
+  }
+  function dispose() {
+    if (!teardown) {
+      const startedAt = generation;
+      teardown = (async () => {
+        try {
+          if (generation === startedAt) {
+            const edited = removeMarkedHosts(deps.readHosts());
+            if (edited.changed) {
+              deps.writeHosts(edited.content);
+              await deps.flushDns().catch(() => {
+              });
+            }
+          }
+        } catch (error) {
+          deps.log(`hosts cleanup failed: ${error.message}`);
+        }
+        if (generation === startedAt)
+          await stopCaddy();
+      })();
+    }
+    return teardown;
+  }
+  async function sweepStaleEntries() {
+    try {
+      const edited = removeMarkedHosts(deps.readHosts());
+      if (!edited.changed)
+        return false;
+      deps.writeHosts(edited.content);
+      await flushDnsBestEffort(deps);
+      return true;
+    } catch (error) {
+      deps.log(`stale hosts cleanup failed: ${error.message}`);
+      return false;
+    }
+  }
+  async function handle(request, client) {
+    try {
+      switch (request.method) {
+        case "ping":
+          return { id: request.id, ok: true, result: { pid: import_node_process.default.pid } };
+        case "hosts.add": {
+          const { ip, host } = request.params;
+          if (!isSafeIp(ip) || !isSafeHost(host))
+            return { id: request.id, ok: false, error: { message: "invalid hosts entry" } };
+          const edited = addHost(deps.readHosts(), ip, host);
+          if (edited.changed)
+            deps.writeHosts(edited.content);
+          addHostOwner(client, ip, host);
+          await flushDnsBestEffort(deps);
+          return { id: request.id, ok: true };
+        }
+        case "hosts.remove": {
+          const { ip, host } = request.params;
+          if (!isSafeIp(ip) || !isSafeHost(host))
+            return { id: request.id, ok: false, error: { message: "invalid hosts entry" } };
+          const last = releaseHostOwner(client, ip, host);
+          if (!last)
+            return { id: request.id, ok: true, result: { kept: true } };
+          const edited = removeHost(deps.readHosts(), ip, host);
+          if (edited.changed)
+            deps.writeHosts(edited.content);
+          await flushDnsBestEffort(deps);
+          return { id: request.id, ok: true };
+        }
+        case "port.free": {
+          const { port } = request.params;
+          if (!isAllowedFreePort(port))
+            return { id: request.id, ok: false, error: { message: `port ${port} is not releasable` } };
+          const killed = await deps.freePort(port, caddy == null ? void 0 : caddy.pid);
+          return { id: request.id, ok: true, result: { killed } };
+        }
+        case "caddy.start": {
+          if (caddy && caddy.running !== false)
+            return { id: request.id, ok: true, result: { pid: caddy.pid, started: false } };
+          caddy = deps.startCaddy(broadcast);
+          return { id: request.id, ok: true, result: { pid: caddy.pid, started: true } };
+        }
+        case "caddy.stop": {
+          await stopCaddy();
+          return { id: request.id, ok: true };
+        }
+        case "ca.trust": {
+          const result = await deps.trustLocalCa();
+          return { id: request.id, ok: true, result };
+        }
+        default:
+          return { id: request.id, ok: false, error: { message: "unknown method" } };
+      }
+    } catch (error) {
+      return { id: request.id, ok: false, error: { message: error.message } };
+    }
+  }
+  return {
+    handle,
+    attach(client) {
+      clients.add(client);
+      generation++;
+      teardown = void 0;
+    },
+    async detach(client) {
+      clients.delete(client);
+      for (const [id, owners] of [...hostOwners]) {
+        if (!owners.delete(client) || owners.size > 0)
+          continue;
+        hostOwners.delete(id);
+        const [ip, host] = id.split(" ");
+        try {
+          const edited = removeHost(deps.readHosts(), ip, host);
+          if (edited.changed) {
+            deps.writeHosts(edited.content);
+            await flushDnsBestEffort(deps);
+          }
+        } catch (error) {
+          deps.log(`hosts cleanup failed: ${error.message}`);
+        }
+      }
+      if (clients.size === 0)
+        await dispose();
+    },
+    dispose,
+    sweepStaleEntries,
+    clientCount: () => clients.size
+  };
+}
+async function reclaimTree(target, uid, gid) {
+  const reclaimed = [];
+  const walk = (path) => {
+    let stats;
+    try {
+      stats = (0, import_node_fs2.lstatSync)(path);
+    } catch {
+      return;
+    }
+    try {
+      (0, import_node_fs2.lchownSync)(path, uid, gid);
+      reclaimed.push(path);
+    } catch {
+    }
+    if (!stats.isDirectory())
+      return;
+    let entries;
+    try {
+      entries = (0, import_node_fs2.readdirSync)(path);
+    } catch {
+      return;
+    }
+    for (const entry of entries)
+      walk((0, import_node_path.join)(path, entry));
+  };
+  walk(target);
+  return reclaimed;
+}
+async function trustLocalCaWithSystemTools(caddyBin, adminSocket) {
+  const address = adminSocket ? `unix/${adminSocket}` : "127.0.0.1:2019";
+  try {
+    const { stdout, stderr } = await execFileAsync(
+      caddyBin,
+      ["trust", "--ca", "local", "--address", address],
+      { timeout: 12e4 }
+    );
+    return { trusted: true, output: `${stdout}${stderr}`.trim() };
+  } catch (error) {
+    const output = String(error.stdout ?? "") + String(error.stderr ?? "");
+    if (/already|not modified|no changes/i.test(output))
+      return { trusted: true, output: output.trim() };
+    throw new Error(output.trim() || error.message);
+  }
+}
+function createNodeHelperDeps(options) {
+  const hostsPath = options.hostsPath ?? HOSTS_PATH;
+  const log = options.log ?? ((message) => import_node_process.default.stdout.write(`${message}
+`));
+  let caddy;
+  import_node_process.default.on("exit", () => {
+    if ((caddy == null ? void 0 : caddy.pid) === void 0)
+      return;
+    try {
+      import_node_process.default.kill(caddy.pid, "SIGTERM");
+    } catch {
+    }
+  });
+  return {
+    readHosts: () => (0, import_node_fs2.readFileSync)(hostsPath, "utf8"),
+    writeHosts: (content) => {
+      (0, import_node_fs2.writeFileSync)(hostsPath, content);
+    },
+    flushDns: async () => {
+      const candidates = FLUSH_COMMANDS[(0, import_node_os.platform)()] ?? [...FLUSH_FALLBACK];
+      let lastError;
+      for (const candidate of candidates) {
+        try {
+          await execFileAsync(candidate.file, candidate.args);
+          return;
+        } catch (error) {
+          lastError = error;
+        }
+      }
+      throw lastError ?? new Error("no DNS cache flush command for this platform");
+    },
+    freePort: async (port, keepPid) => {
+      const pids = (0, import_node_os.platform)() === "win32" ? parseWindowsListeningPids((await execFileAsync("netstat", ["-ano"])).stdout, port) : parseListeningPids((await execFileQuiet("lsof", [`-ti:${port}`, "-sTCP:LISTEN"])).stdout);
+      const killed = [];
+      for (const pid of pids) {
+        if (pid === import_node_process.default.pid || keepPid !== void 0 && pid === keepPid)
+          continue;
+        try {
+          import_node_process.default.kill(pid, "SIGTERM");
+          killed.push(pid);
+        } catch {
+        }
+      }
+      return killed;
+    },
+    caddyBin: options.caddyBin,
+    caddyConfigPath: options.caddyConfigPath,
+    caddyCwd: options.caddyCwd ?? import_node_process.default.cwd(),
+    caddyEnv: options.caddyEnv ?? {},
+    trustLocalCa: () => trustLocalCaWithSystemTools(options.caddyBin, options.caddyAdminSocket),
+    caddyStoragePath: options.caddyStoragePath,
+    storageOwner: options.storageOwner,
+    startCaddy: (emit) => {
+      var _a, _b;
+      const child = (0, import_node_child_process.spawn)(options.caddyBin, ["run", "--adapter", "caddyfile", "--config", options.caddyConfigPath, "--watch"], {
+        cwd: options.caddyCwd ?? import_node_process.default.cwd(),
+        env: { ...import_node_process.default.env, ...options.caddyEnv },
+        stdio: ["ignore", "pipe", "pipe"],
+        detached: (0, import_node_os.platform)() !== "win32"
+      });
+      const handle = {
+        pid: child.pid,
+        kill: (signal) => child.kill(signal),
+        running: true
+      };
+      (_a = child.stdout) == null ? void 0 : _a.on("data", (data) => emit({ type: "event", kind: "caddy.stdout", data: data.toString() }));
+      (_b = child.stderr) == null ? void 0 : _b.on("data", (data) => emit({ type: "event", kind: "caddy.stderr", data: data.toString() }));
+      child.on("exit", (code, signal) => {
+        handle.running = false;
+        emit({ type: "event", kind: "caddy.exit", code, signal });
+      });
+      caddy = handle;
+      return handle;
+    },
+    stopCaddy: async () => {
+      const current = caddy;
+      caddy = void 0;
+      if (!current)
+        return;
+      try {
+        current.kill("SIGTERM");
+      } catch {
+      }
+    },
+    log
+  };
+}
+function attachSocket(socket, runtime, log) {
+  let buffer = "";
+  runtime.attach(socket);
+  socket.on("data", (chunk) => {
+    buffer += chunk.toString("utf8");
+    let index = buffer.indexOf("\n");
+    while (index >= 0) {
+      const line = buffer.slice(0, index);
+      buffer = buffer.slice(index + 1);
+      index = buffer.indexOf("\n");
+      if (!line.trim())
+        continue;
+      let request;
+      try {
+        request = JSON.parse(line);
+      } catch (error) {
+        log(`invalid request: ${error.message}`);
+        continue;
+      }
+      void runtime.handle(request, socket).then((response) => {
+        if (!socket.destroyed)
+          socket.write(serializeMessage(response));
+      });
+    }
+  });
+  socket.on("error", (error) => {
+    log(`connection error: ${error.message}`);
+  });
+  socket.on("close", () => {
+    void runtime.detach(socket);
+  });
+}
+
+// src/privileged/bootstrap.ts
+var HANDSHAKE_TIMEOUT_MS = 12e4;
+var DEFAULT_IDLE_TIMEOUT_MS = 3e4;
+async function startHelper(options) {
+  const { socketPath, token } = options;
+  const log = options.log ?? ((message) => import_node_process2.default.stdout.write(`[uhrp-helper] ${message}
+`));
+  for (const check of [
+    checkPrivilegedPath(options.caddyBin, { label: "Caddy binary", ownerUid: options.ownerUid }),
+    checkPrivilegedPath(options.caddyConfigPath, { label: "Caddyfile", ownerUid: options.ownerUid })
+  ]) {
+    if (check) {
+      log(describeRejection(check));
+      throw new Error(describeRejection(check));
+    }
+  }
+  const deps = options.deps ?? createNodeHelperDeps({
+    hostsPath: options.hostsPath,
+    log,
+    caddyBin: options.caddyBin,
+    caddyConfigPath: options.caddyConfigPath,
+    caddyAdminSocket: options.caddyAdminSocket,
+    caddyCwd: options.caddyCwd,
+    caddyEnv: options.caddyEnv,
+    caddyStoragePath: options.caddyStoragePath,
+    storageOwner: typeof options.ownerUid === "number" ? { uid: options.ownerUid, gid: options.ownerGid ?? options.ownerUid } : void 0
+  });
+  const runtime = createHelperRuntime(deps);
+  await runtime.sweepStaleEntries().catch(() => {
+  });
+  try {
+    (0, import_node_fs3.rmSync)(socketPath, { force: true });
+  } catch {
+  }
+  const connections = /* @__PURE__ */ new Set();
+  const idleTimeoutMs = options.idleTimeoutMs ?? DEFAULT_IDLE_TIMEOUT_MS;
+  const exitOnIdle = options.exitOnIdle ?? true;
+  let idleTimer;
+  const stopIdleTimer = () => {
+    if (idleTimer) {
+      clearTimeout(idleTimer);
+      idleTimer = void 0;
+    }
+  };
+  const server = (0, import_node_net3.createServer)((socket) => {
+    var _a;
+    let buffer = "";
+    let authenticated = false;
+    stopIdleTimer();
+    connections.add(socket);
+    socket.on("close", () => {
+      connections.delete(socket);
+      if (connections.size === 0)
+        scheduleIdleExit();
+    });
+    const timer = setTimeout(() => {
+      if (!authenticated)
+        socket.destroy();
+    }, HANDSHAKE_TIMEOUT_MS);
+    (_a = timer.unref) == null ? void 0 : _a.call(timer);
+    const onData = (chunk) => {
+      buffer += chunk.toString("utf8");
+      const index = buffer.indexOf("\n");
+      if (index < 0)
+        return;
+      const line = buffer.slice(0, index);
+      const rest = buffer.slice(index + 1);
+      let parsed;
+      try {
+        parsed = JSON.parse(line);
+      } catch {
+        socket.destroy();
+        return;
+      }
+      if (parsed.type !== "handshake" || typeof parsed.token !== "string") {
+        socket.destroy();
+        return;
+      }
+      clearTimeout(timer);
+      socket.removeListener("data", onData);
+      if (parsed.token !== token) {
+        socket.end(`${JSON.stringify({ type: "handshake", ok: false, reason: "invalid token" })}
+`);
+        return;
+      }
+      authenticated = true;
+      socket.write(`${JSON.stringify({ type: "handshake", ok: true, pid: import_node_process2.default.pid })}
+`);
+      attachSocket(socket, runtime, log);
+      if (rest.trim() !== "")
+        socket.emit("data", import_node_buffer.Buffer.from(rest));
+    };
+    socket.on("data", onData);
+    socket.on("error", () => {
+    });
+  });
+  function scheduleIdleExit() {
+    var _a;
+    if (idleTimer || connections.size > 0)
+      return;
+    idleTimer = setTimeout(() => {
+      var _a2, _b;
+      idleTimer = void 0;
+      if (connections.size > 0)
+        return;
+      log("no clients left; shutting down");
+      removeOwnSocket(socketPath, token);
+      if (!exitOnIdle) {
+        server.close();
+        return;
+      }
+      server.close(() => import_node_process2.default.exit(0));
+      (_b = (_a2 = setTimeout(() => import_node_process2.default.exit(0), 1e3)).unref) == null ? void 0 : _b.call(_a2);
+    }, idleTimeoutMs);
+    (_a = idleTimer.unref) == null ? void 0 : _a.call(idleTimer);
+  }
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(socketPath, () => resolve());
+  });
+  scheduleIdleExit();
+  try {
+    if (typeof options.ownerUid === "number") {
+      (0, import_node_fs3.chownSync)(socketPath, options.ownerUid, options.ownerGid ?? options.ownerUid);
+      (0, import_node_fs3.chmodSync)(socketPath, 384);
+    } else {
+      (0, import_node_fs3.chmodSync)(socketPath, 384);
+    }
+  } catch (error) {
+    log(`could not set socket ownership: ${error.message}`);
+  }
+  return {
+    runtime,
+    async close() {
+      for (const socket of connections)
+        socket.destroy();
+      connections.clear();
+      await new Promise((resolve) => {
+        server.close(() => resolve());
+      });
+    }
+  };
+}
+function removeOwnSocket(socketPath, token) {
+  if (import_node_process2.default.platform === "win32")
+    return;
+  try {
+    const tokensDir = (0, import_node_path2.dirname)(socketPath);
+    const tokenFile = (0, import_node_path2.join)(tokensDir, "helper.token");
+    const current = (0, import_node_fs3.existsSync)(tokenFile) ? (0, import_node_fs3.readFileSync)(tokenFile, "utf8").trim() : void 0;
+    if (current === token)
+      (0, import_node_fs3.rmSync)(tokenFile, { force: true });
+  } catch {
+  }
+  try {
+    (0, import_node_fs3.rmSync)(socketPath, { force: true });
+  } catch {
+  }
+}
+
+// src/privileged-helper.ts
+function parseArgs(argv) {
+  let socket = "";
+  let token = "";
+  let hosts;
+  let caddyBin = "";
+  let caddyConfig = "";
+  let ownerUid;
+  let ownerGid;
+  let caddyStorage;
+  let caddyAdmin;
+  for (let index = 0; index < argv.length; index++) {
+    const current = argv[index];
+    if (current === "--socket")
+      socket = argv[++index] ?? "";
+    else if (current === "--token")
+      token = argv[++index] ?? "";
+    else if (current === "--hosts")
+      hosts = argv[++index] ?? void 0;
+    else if (current === "--caddy")
+      caddyBin = argv[++index] ?? "";
+    else if (current === "--caddy-config")
+      caddyConfig = argv[++index] ?? "";
+    else if (current === "--owner-uid")
+      ownerUid = Number(argv[++index]);
+    else if (current === "--owner-gid")
+      ownerGid = Number(argv[++index]);
+    else if (current === "--caddy-storage")
+      caddyStorage = argv[++index] ?? void 0;
+    else if (current === "--caddy-admin")
+      caddyAdmin = argv[++index] ?? void 0;
+  }
+  if (!socket || !token)
+    throw new Error("usage: privileged-helper --socket <path> --token <token> --caddy <bin> --caddy-config <path>");
+  if (!caddyBin || !caddyConfig)
+    throw new Error("privileged-helper requires --caddy and --caddy-config");
+  return {
+    socket,
+    token,
+    hosts,
+    caddyBin,
+    caddyConfig,
+    ownerUid: Number.isInteger(ownerUid) ? ownerUid : void 0,
+    ownerGid: Number.isInteger(ownerGid) ? ownerGid : void 0,
+    caddyStorage,
+    caddyAdmin
+  };
+}
+async function main() {
+  const args = parseArgs(import_node_process3.default.argv.slice(2));
+  const helper = await startHelper({
+    socketPath: args.socket,
+    token: args.token,
+    hostsPath: args.hosts,
+    caddyBin: args.caddyBin,
+    caddyConfigPath: args.caddyConfig,
+    ownerUid: args.ownerUid,
+    ownerGid: args.ownerGid,
+    caddyStoragePath: args.caddyStorage,
+    caddyAdminSocket: args.caddyAdmin,
+    caddyEnv: {
+      HOME: import_node_process3.default.env.HOME ?? "",
+      // Keep Caddy's storage next to the invoking user's home even though the
+      // process runs as root.
+      XDG_DATA_HOME: import_node_process3.default.env.XDG_DATA_HOME ?? ""
+    }
+  });
+  for (const signal of ["SIGINT", "SIGQUIT", "SIGTSTP", "SIGHUP"])
+    import_node_process3.default.on(signal, () => {
+    });
+  import_node_process3.default.on("SIGTERM", () => {
+    if (helper.runtime.clientCount() > 0)
+      return;
+    void helper.runtime.dispose().finally(() => import_node_process3.default.exit(0));
+  });
+  import_node_process3.default.stdout.on("error", () => {
+  });
+  import_node_process3.default.stderr.on("error", () => {
+  });
+}
+main().catch((error) => {
+  import_node_process3.default.stderr.write(`[uhrp-helper] fatal: ${error.message}
+`);
+  import_node_process3.default.exit(1);
+});
+exports.default = module.exports;