vite-plugin-rpx 0.11.20 → 0.11.21

package/dist/index.js

@@ -22443,6 +22443,158 @@ var init_https = __esm(() => {
   SHARED_DEV_HOST_CERT_PATH = join12(homedir8(), ".stacks", "ssl", "rpx.localhost.crt");
 });
 
+// ../rpx/src/auth.ts
+import { createHash, timingSafeEqual } from "node:crypto";
+import { readFileSync as readFileSync2 } from "node:fs";
+function safeEqual(a2, b2) {
+  const ab = Buffer.from(a2, "utf8");
+  const bb = Buffer.from(b2, "utf8");
+  if (ab.length !== bb.length) {
+    timingSafeEqual(ab, ab);
+    return false;
+  }
+  return timingSafeEqual(ab, bb);
+}
+function apr1Crypt(password, salt) {
+  const md5 = (buf) => createHash("md5").update(buf).digest();
+  const pw = Buffer.from(password, "utf8");
+  const saltBuf = Buffer.from(salt, "utf8");
+  const result = md5(Buffer.concat([pw, saltBuf, pw]));
+  const ctx = [pw, Buffer.from("$apr1$", "utf8"), saltBuf];
+  for (let i2 = pw.length;i2 > 0; i2 -= 16)
+    ctx.push(result.subarray(0, Math.min(i2, 16)));
+  for (let i2 = pw.length;i2 > 0; i2 >>= 1)
+    ctx.push(i2 & 1 ? Buffer.from([0]) : pw.subarray(0, 1));
+  let final = md5(Buffer.concat(ctx));
+  for (let i2 = 0;i2 < 1000; i2++) {
+    const round = [];
+    round.push(i2 & 1 ? pw : final.subarray(0, 16));
+    if (i2 % 3)
+      round.push(saltBuf);
+    if (i2 % 7)
+      round.push(pw);
+    round.push(i2 & 1 ? final.subarray(0, 16) : pw);
+    final = md5(Buffer.concat(round));
+  }
+  const itoa64 = "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+  const to64 = (value, count) => {
+    let out = "";
+    let v2 = value;
+    for (let i2 = 0;i2 < count; i2++) {
+      out += itoa64[v2 & 63];
+      v2 >>= 6;
+    }
+    return out;
+  };
+  const p2 = final;
+  let encoded = "";
+  encoded += to64(p2[0] << 16 | p2[6] << 8 | p2[12], 4);
+  encoded += to64(p2[1] << 16 | p2[7] << 8 | p2[13], 4);
+  encoded += to64(p2[2] << 16 | p2[8] << 8 | p2[14], 4);
+  encoded += to64(p2[3] << 16 | p2[9] << 8 | p2[15], 4);
+  encoded += to64(p2[4] << 16 | p2[10] << 8 | p2[5], 4);
+  encoded += to64(p2[11], 2);
+  return `$apr1$${salt}$${encoded}`;
+}
+function verifyHtpasswdHash(password, hash) {
+  if (/^\$2[aby]?\$/.test(hash)) {
+    try {
+      return Bun.password.verifySync(password, hash);
+    } catch {
+      return false;
+    }
+  }
+  if (hash.startsWith("$apr1$")) {
+    const parts = hash.split("$");
+    const salt = parts[2] ?? "";
+    return safeEqual(apr1Crypt(password, salt), hash);
+  }
+  if (hash.startsWith("{SHA}")) {
+    const digest = createHash("sha1").update(password, "utf8").digest("base64");
+    return safeEqual(`{SHA}${digest}`, hash);
+  }
+  return safeEqual(password, hash);
+}
+function parseHtpasswd(body) {
+  const entries = new Map;
+  for (const rawLine of body.split(`
+`)) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#"))
+      continue;
+    const idx = line.indexOf(":");
+    if (idx <= 0)
+      continue;
+    entries.set(line.slice(0, idx), line.slice(idx + 1));
+  }
+  return entries;
+}
+function resolveAuth(cfg) {
+  if (!cfg)
+    return;
+  const realm = (cfg.realm ?? "").trim() || "Restricted";
+  const inline = [];
+  if (cfg.username)
+    inline.push({ username: cfg.username, password: cfg.password ?? "" });
+  for (const user of cfg.users ?? []) {
+    if (user?.username)
+      inline.push({ username: user.username, password: user.password ?? "" });
+  }
+  let htpasswd;
+  if (cfg.htpasswdFile) {
+    try {
+      htpasswd = parseHtpasswd(readFileSync2(cfg.htpasswdFile, "utf8"));
+    } catch {
+      htpasswd = undefined;
+    }
+  }
+  if (inline.length === 0 && (!htpasswd || htpasswd.size === 0))
+    return;
+  const verify = (username, password) => {
+    let ok = false;
+    for (const cred of inline) {
+      if (safeEqual(username, cred.username) && safeEqual(password, cred.password))
+        ok = true;
+    }
+    if (htpasswd) {
+      const hash = htpasswd.get(username);
+      if (hash && verifyHtpasswdHash(password, hash))
+        ok = true;
+    }
+    return ok;
+  };
+  return { realm, verify };
+}
+function enforceBasicAuth(req, pathname, auth) {
+  if (pathname.startsWith(ACME_CHALLENGE_PREFIX))
+    return;
+  const header = req.headers.get("authorization") ?? "";
+  const sep = header.indexOf(" ");
+  const scheme = sep === -1 ? header : header.slice(0, sep);
+  const encoded = sep === -1 ? "" : header.slice(sep + 1).trim();
+  if (scheme.toLowerCase() === "basic" && encoded) {
+    let decoded = "";
+    try {
+      decoded = Buffer.from(encoded, "base64").toString("utf8");
+    } catch {
+      decoded = "";
+    }
+    const idx = decoded.indexOf(":");
+    if (idx >= 0 && auth.verify(decoded.slice(0, idx), decoded.slice(idx + 1)))
+      return;
+  }
+  const realm = auth.realm.replace(/["\\]/g, "");
+  return new Response("401 Unauthorized", {
+    status: 401,
+    headers: {
+      "www-authenticate": `Basic realm="${realm}", charset="UTF-8"`,
+      "content-type": "text/plain; charset=utf-8"
+    }
+  });
+}
+var ACME_CHALLENGE_PREFIX = "/.well-known/acme-challenge/";
+var init_auth = () => {};
+
 // ../rpx/src/proxy-pool.ts
 function isIdempotent(method) {
   return IDEMPOTENT_METHODS.has(method.toUpperCase());
@@ -23231,6 +23383,27 @@ var init_proxy_pool = __esm(() => {
   pools = new Map;
 });
 
+// ../rpx/src/redirect.ts
+function resolveRedirect(input) {
+  const cfg = typeof input === "string" ? { to: input } : input;
+  let to = (cfg.to ?? "").trim();
+  if (to && !/^[a-z][\w+.-]*:\/\//i.test(to))
+    to = `https://${to}`;
+  to = to.replace(/\/+$/, "");
+  return {
+    to,
+    status: cfg.status ?? DEFAULT_REDIRECT_STATUS,
+    preservePath: cfg.preservePath ?? true
+  };
+}
+function buildRedirectLocation(redirect, pathname, search) {
+  if (!redirect.preservePath)
+    return redirect.to || "/";
+  const tail = `${pathname}${search}`;
+  return tail === "/" ? `${redirect.to}/` : `${redirect.to}${tail}`;
+}
+var DEFAULT_REDIRECT_STATUS = 301;
+
 // ../rpx/src/static-files.ts
 import * as path2 from "node:path";
 function resolveStaticRoute(cfg, cleanUrls) {
@@ -23384,15 +23557,34 @@ function splitPathQuery(rawUrl) {
     return { pathname: rawUrl.slice(pathStart), search: "" };
   return { pathname: rawUrl.slice(pathStart, q), search: rawUrl.slice(q) };
 }
-function createProxyFetchHandler(getRoute, verbose) {
+function createProxyFetchHandler(getRoute, verbose, onNoRoute) {
   const inner = async (req, server) => {
     const { pathname, search } = splitPathQuery(req.url);
     const hostname = extractHostname2(req);
-    const route = getRoute(hostname, pathname);
+    let route = getRoute(hostname, pathname);
+    if (!route && onNoRoute) {
+      const outcome = await onNoRoute(hostname, pathname, req);
+      if (outcome instanceof Response)
+        return outcome;
+      if (outcome && outcome.retry)
+        route = getRoute(hostname, pathname);
+    }
     if (!route) {
       debugLog("request", `No route found for host: ${hostname}`, verbose);
       return new Response(`No proxy configured for ${hostname}`, { status: 404 });
     }
+    if (route.auth) {
+      const challenge = enforceBasicAuth(req, pathname, route.auth);
+      if (challenge) {
+        debugLog("request", `401 challenge for ${hostname}${pathname}`, verbose);
+        return challenge;
+      }
+    }
+    if (route.redirect) {
+      const location = buildRedirectLocation(route.redirect, pathname, search);
+      debugLog("request", `${route.redirect.status} redirect ${hostname}${pathname} → ${location}`, verbose);
+      return new Response(null, { status: route.redirect.status, headers: { location } });
+    }
     if (route.static) {
       const strip = route.stripBasePathPrefix ?? true;
       const staticPath = strip ? stripBasePath(pathname, route.basePath) : pathname;
@@ -23544,6 +23736,7 @@ function createProxyWebSocketHandler(verbose) {
 }
 var HOP_BY_HOP;
 var init_proxy_handler = __esm(() => {
+  init_auth();
   init_proxy_pool();
   init_static_files();
   init_utils();
@@ -23875,6 +24068,144 @@ var init_on_demand = __esm(() => {
   init_utils();
 });
 
+// ../rpx/src/site-resolver.ts
+var DEFAULT_IDLE_TIMEOUT_MS;
+var init_site_resolver = __esm(() => {
+  DEFAULT_IDLE_TIMEOUT_MS = 30 * 60000;
+});
+
+// ../rpx/src/port-manager.ts
+import * as net from "node:net";
+function isPortInUse(port, hostname, verbose) {
+  debugLog("port", `Checking if port ${port} is in use on ${hostname}`, verbose);
+  return new Promise((resolve14) => {
+    const server = net.createServer();
+    const timeout = setTimeout(() => {
+      debugLog("port", `Checking port ${port} timed out, assuming it's in use`, verbose);
+      server.close();
+      resolve14(true);
+    }, 3000);
+    server.once("error", (err) => {
+      clearTimeout(timeout);
+      if (err.code === "EADDRINUSE") {
+        debugLog("port", `Port ${port} is in use`, verbose);
+        resolve14(true);
+      } else {
+        debugLog("port", `Error checking port ${port}: ${err.message}`, verbose);
+        resolve14(true);
+      }
+    });
+    server.once("listening", () => {
+      clearTimeout(timeout);
+      debugLog("port", `Port ${port} is available`, verbose);
+      server.close();
+      resolve14(false);
+    });
+    try {
+      server.listen(port, hostname);
+    } catch (err) {
+      clearTimeout(timeout);
+      debugLog("port", `Exception checking port ${port}: ${err}`, verbose);
+      resolve14(true);
+    }
+  });
+}
+async function findAvailablePort(startPort, hostname, verbose, maxAttempts = 50) {
+  debugLog("port", `Finding available port starting from ${startPort} (max attempts: ${maxAttempts})`, verbose);
+  let port = startPort;
+  let attempts = 0;
+  while (attempts < maxAttempts) {
+    attempts++;
+    const isInUse = await isPortInUse(port, hostname, verbose);
+    if (!isInUse) {
+      debugLog("port", `Found available port: ${port} after ${attempts} attempts`, verbose);
+      return port;
+    }
+    debugLog("port", `Port ${port} is in use, trying ${port + 1} (attempt ${attempts}/${maxAttempts})`, verbose);
+    port++;
+  }
+  throw new Error(`Unable to find available port after ${maxAttempts} attempts starting from ${startPort}`);
+}
+function testPortConnectivity(port, hostname, timeout = 5000, verbose) {
+  debugLog("port", `Testing connection to ${hostname}:${port}`, verbose);
+  return new Promise((resolve14) => {
+    const socket = net.connect({
+      host: hostname,
+      port,
+      timeout
+    });
+    socket.once("connect", () => {
+      debugLog("port", `Successfully connected to ${hostname}:${port}`, verbose);
+      socket.end();
+      resolve14(true);
+    });
+    socket.once("timeout", () => {
+      debugLog("port", `Connection to ${hostname}:${port} timed out`, verbose);
+      socket.destroy();
+      resolve14(false);
+    });
+    socket.once("error", (err) => {
+      debugLog("port", `Failed to connect to ${hostname}:${port}: ${err.message}`, verbose);
+      socket.destroy();
+      resolve14(false);
+    });
+  });
+}
+
+class DefaultPortManager {
+  usedPorts = new Set;
+  hostname;
+  verbose;
+  maxRetries;
+  constructor(hostname = "0.0.0.0", verbose, maxRetries = 50) {
+    this.hostname = hostname;
+    this.verbose = verbose;
+    this.maxRetries = maxRetries;
+  }
+  async getNextAvailablePort(startPort, testConnectivity = false) {
+    if (this.usedPorts.has(startPort)) {
+      return this.findNextAvailablePort(startPort + 1, testConnectivity);
+    }
+    const isInUse = await isPortInUse(startPort, this.hostname, this.verbose);
+    if (isInUse) {
+      return this.findNextAvailablePort(startPort + 1, testConnectivity);
+    }
+    if (testConnectivity) {
+      const isConnectable = await testPortConnectivity(startPort, this.hostname, 3000, this.verbose);
+      if (!isConnectable) {
+        debugLog("port", `Port ${startPort} is available but not connectable, trying next port`, this.verbose);
+        return this.findNextAvailablePort(startPort + 1, testConnectivity);
+      }
+    }
+    this.usedPorts.add(startPort);
+    return startPort;
+  }
+  async findNextAvailablePort(startPort, testConnectivity = false) {
+    const port = await findAvailablePort(startPort, this.hostname, this.verbose, this.maxRetries);
+    if (testConnectivity) {
+      const isConnectable = await testPortConnectivity(port, this.hostname, 3000, this.verbose);
+      if (!isConnectable) {
+        if (port < startPort + this.maxRetries) {
+          return this.findNextAvailablePort(port + 1, testConnectivity);
+        } else {
+          throw new Error(`Unable to find a connectable port after ${this.maxRetries} attempts`);
+        }
+      }
+    }
+    this.usedPorts.add(port);
+    return port;
+  }
+  releasePort(port) {
+    debugLog("port", `Releasing port ${port}`, this.verbose);
+    this.usedPorts.delete(port);
+  }
+}
+var portManager;
+var init_port_manager = __esm(() => {
+  init_utils();
+  portManager = new DefaultPortManager;
+});
+
 // ../rpx/src/registry.ts
 import * as fsp3 from "node:fs/promises";
 import { homedir as homedir9 } from "node:os";
@@ -23946,19 +24277,399 @@ var init_registry = __esm(() => {
   ID_PATTERN = /^[a-zA-Z0-9._-]+$/;
 });
 
-// ../rpx/src/dns-state.ts
+// ../rpx/src/site-supervisor.ts
+import { closeSync as closeSync6, openSync as openSync6, readFileSync as readFileSync3 } from "node:fs";
 import * as fsp4 from "node:fs/promises";
+import { spawn } from "node:child_process";
 import { homedir as homedir10 } from "node:os";
 import * as path6 from "node:path";
+import * as process25 from "node:process";
+
+class SiteSupervisor {
+  resolver;
+  registryDir;
+  rpxDir;
+  verbose;
+  startupTimeoutMs;
+  pollIntervalMs;
+  restartDelayMs;
+  killGraceMs;
+  launch;
+  probePort;
+  pickPort;
+  isHostRoutable;
+  onSiteActivating;
+  now;
+  writeEntry;
+  removeEntry;
+  sites = new Map;
+  reaper;
+  stopped = false;
+  constructor(opts) {
+    this.resolver = opts.resolver;
+    this.registryDir = opts.registryDir ?? getRegistryDir();
+    this.rpxDir = opts.rpxDir ?? path6.join(homedir10(), ".stacks", "rpx");
+    this.verbose = opts.verbose ?? false;
+    this.startupTimeoutMs = opts.startupTimeoutMs ?? DEFAULT_STARTUP_TIMEOUT_MS;
+    this.pollIntervalMs = opts.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+    this.restartDelayMs = opts.restartDelayMs ?? DEFAULT_RESTART_DELAY_MS;
+    this.killGraceMs = opts.killGraceMs ?? KILL_GRACE_MS;
+    this.launch = opts.launcher ?? makeDefaultLauncher(this.verbose);
+    this.probePort = opts.probePort ?? defaultReadinessProbe;
+    this.pickPort = opts.pickPort ?? ((preferred) => findAvailablePort(preferred, "127.0.0.1"));
+    this.isHostRoutable = opts.isHostRoutable ?? (() => false);
+    this.onSiteActivating = opts.onSiteActivating;
+    this.now = opts.now ?? Date.now;
+    this.writeEntry = opts.writeEntry ?? writeEntry;
+    this.removeEntry = opts.removeEntry ?? removeEntry;
+    const reapInterval = opts.reapIntervalMs ?? DEFAULT_REAP_INTERVAL_MS;
+    this.reaper = setInterval(() => {
+      this.reapIdle();
+    }, reapInterval);
+    if (typeof this.reaper.unref === "function")
+      this.reaper.unref();
+  }
+  async onRequest(host) {
+    if (this.stopped)
+      return { kind: "unknown" };
+    let state = this.sites.get(host);
+    if (state && state.status === "failed" && this.now() - state.failedAt >= this.restartDelayMs) {
+      this.sites.delete(host);
+      state = undefined;
+    }
+    if (!state) {
+      const site = this.resolver.resolve(host);
+      if (!site)
+        return { kind: "unknown" };
+      state = await this.start(site);
+    }
+    state.lastAccess = this.now();
+    if (state.status === "ready")
+      return { kind: "ready", host };
+    if (state.status === "failed")
+      return { kind: "failed", host, error: state.error ?? "failed to start", logTail: this.readLogTail(state) };
+    return { kind: "starting", host, sinceMs: this.now() - state.startedAt, source: state.site.source, logTail: this.readLogTail(state, 16) };
+  }
+  async start(site) {
+    try {
+      this.onSiteActivating?.(site.host);
+    } catch {}
+    const ports = new Map;
+    if (!site.selfRegisters) {
+      for (const route of site.routes) {
+        if (ports.has(route.portEnv))
+          continue;
+        const port = await this.pickPort(route.defaultPort ?? 3000);
+        ports.set(route.portEnv, port);
+      }
+    }
+    const logPath = path6.join(this.rpxDir, "sites", `${site.id}.log`);
+    await fsp4.mkdir(path6.dirname(logPath), { recursive: true }).catch(() => {});
+    const env2 = this.buildEnv(site, ports);
+    let handle = null;
+    let startError;
+    try {
+      handle = this.launch({ command: site.command, cwd: site.dir, env: env2, logPath });
+    } catch (err) {
+      startError = `failed to spawn: ${err.message}`;
+    }
+    const state = {
+      site,
+      status: startError ? "failed" : "starting",
+      handle,
+      ports,
+      routeIds: [],
+      startedAt: this.now(),
+      lastAccess: this.now(),
+      failedAt: startError ? this.now() : 0,
+      error: startError,
+      logPath,
+      exited: false,
+      ready: Promise.resolve()
+    };
+    this.sites.set(site.host, state);
+    if (startError) {
+      log.warn(`rpx: site ${site.host} ${startError}`);
+      return state;
+    }
+    log.info(`rpx: booting ${site.host} → ${site.command} (${site.dir})`);
+    handle.exited.then((code) => this.onProcessExit(state, code)).catch(() => {});
+    state.ready = this.driveReadiness(state).catch((err) => {
+      debugLog("sites", `readiness loop for ${site.host} threw: ${err}`, this.verbose);
+    });
+    return state;
+  }
+  async onProcessExit(state, code) {
+    state.exited = true;
+    if (this.stopped || this.sites.get(state.site.host) !== state)
+      return;
+    if (state.status === "ready") {
+      log.warn(`rpx: ${state.site.host} exited${code !== null ? ` (code ${code})` : ""} — will reboot on next request`);
+      this.sites.delete(state.site.host);
+      for (const id of state.routeIds)
+        await this.removeEntry(id, this.registryDir, this.verbose).catch(() => {});
+    } else if (state.status === "starting") {
+      this.fail(state, `process exited${code !== null ? ` with code ${code}` : ""} before becoming ready`);
+    }
+  }
+  async driveReadiness(state) {
+    const { site } = state;
+    const deadline = this.now() + this.startupTimeoutMs;
+    const ready = site.selfRegisters ? () => this.isHostRoutable(site.host) : await this.makeGateProbe(site, state.ports);
+    while (this.now() < deadline && !this.stopped) {
+      if (state.status !== "starting" || state.exited)
+        return;
+      if (await ready()) {
+        await this.publishRoutes(state);
+        if (state.status === "starting") {
+          state.status = "ready";
+          log.success(`rpx: ${site.host} ready`);
+        }
+        return;
+      }
+      await delay(this.pollIntervalMs);
+    }
+    if (state.status === "starting")
+      this.fail(state, `did not become ready within ${Math.round(this.startupTimeoutMs / 1000)}s`);
+  }
+  async makeGateProbe(site, ports) {
+    const gatePorts = site.routes.filter((r2) => r2.readyGate ?? normalizePathPrefix(r2.path) === "/").map((r2) => ports.get(r2.portEnv)).filter((p2) => typeof p2 === "number");
+    const probePorts = gatePorts.length > 0 ? gatePorts : [...ports.values()];
+    return async () => {
+      for (const port of probePorts) {
+        if (!await this.probePort(port))
+          return false;
+      }
+      return probePorts.length > 0;
+    };
+  }
+  async publishRoutes(state) {
+    const { site, ports } = state;
+    if (site.selfRegisters || site.routes.length === 0)
+      return;
+    const defaultRoute = site.routes.find((r2) => normalizePathPrefix(r2.path) === "/") ?? site.routes[0];
+    const fromPort = ports.get(defaultRoute.portEnv);
+    if (fromPort === undefined)
+      return;
+    const pathRewrites = [];
+    for (const route of site.routes) {
+      if (route === defaultRoute)
+        continue;
+      const port = ports.get(route.portEnv);
+      if (port === undefined)
+        continue;
+      pathRewrites.push({
+        from: normalizePathPrefix(route.path),
+        to: `localhost:${port}`,
+        stripPrefix: route.stripPrefix ?? false
+      });
+    }
+    const entry = {
+      id: site.id,
+      from: `localhost:${fromPort}`,
+      to: site.host,
+      cwd: site.dir,
+      createdAt: new Date(this.now()).toISOString(),
+      pathRewrites: pathRewrites.length > 0 ? pathRewrites : undefined,
+      pid: state.handle?.pid
+    };
+    await this.writeEntry(entry, this.registryDir, this.verbose);
+    state.routeIds = [site.id];
+    const tableDeadline = this.now() + 2000;
+    while (this.now() < tableDeadline && !this.isHostRoutable(site.host)) {
+      await delay(50);
+    }
+  }
+  fail(state, error) {
+    state.status = "failed";
+    state.error = error;
+    state.failedAt = this.now();
+    log.warn(`rpx: site ${state.site.host} failed — ${error}`);
+    this.killProcess(state);
+  }
+  buildEnv(site, ports) {
+    const env2 = {};
+    for (const [k2, v2] of Object.entries(process25.env)) {
+      if (typeof v2 === "string")
+        env2[k2] = v2;
+    }
+    Object.assign(env2, site.env);
+    for (const [name, port] of ports)
+      env2[name] = String(port);
+    env2.RPX_SITE_HOST = site.host;
+    env2.RPX_SITE_URL = `https://${site.host}`;
+    return env2;
+  }
+  readLogTail(state, lines = 40) {
+    try {
+      const text = readFileSync3(state.logPath, "utf8");
+      return text.split(`
+`).slice(-lines).join(`
+`).trim();
+    } catch {
+      return "";
+    }
+  }
+  async stop(host) {
+    const state = this.sites.get(host);
+    if (!state)
+      return;
+    this.sites.delete(host);
+    for (const id of state.routeIds)
+      await this.removeEntry(id, this.registryDir, this.verbose).catch(() => {});
+    await this.killProcess(state);
+    log.info(`rpx: stopped ${host}`);
+  }
+  async killProcess(state) {
+    const handle = state.handle;
+    if (!handle)
+      return;
+    state.handle = null;
+    try {
+      handle.stop("SIGTERM");
+    } catch {}
+    const timer = setTimeout(() => {
+      try {
+        handle.stop("SIGKILL");
+      } catch {}
+    }, this.killGraceMs);
+    if (typeof timer.unref === "function")
+      timer.unref();
+    await Promise.race([handle.exited.catch(() => {}), delay(this.killGraceMs + 500)]);
+    clearTimeout(timer);
+  }
+  async reapIdle() {
+    if (this.stopped)
+      return;
+    const now = this.now();
+    for (const [host, state] of this.sites) {
+      const idle = state.site.idleTimeoutMs;
+      if (idle <= 0)
+        continue;
+      const idleFor = now - state.lastAccess;
+      const settled = state.status === "ready" || now - state.startedAt > this.startupTimeoutMs;
+      if (settled && idleFor > idle) {
+        debugLog("sites", `reaping ${host} (idle ${Math.round(idleFor / 1000)}s)`, this.verbose);
+        await this.stop(host);
+      }
+    }
+  }
+  list() {
+    const now = this.now();
+    return [...this.sites.values()].map((s) => ({
+      host: s.site.host,
+      dir: s.site.dir,
+      status: s.status,
+      pid: s.handle?.pid ?? null,
+      ports: Object.fromEntries(s.ports),
+      uptimeMs: now - s.startedAt,
+      idleMs: now - s.lastAccess,
+      error: s.error
+    }));
+  }
+  async stopAll() {
+    this.stopped = true;
+    clearInterval(this.reaper);
+    await Promise.allSettled([...this.sites.keys()].map((host) => this.stop(host)));
+  }
+}
+function delay(ms) {
+  return new Promise((resolve14) => setTimeout(resolve14, ms));
+}
+async function defaultReadinessProbe(port) {
+  const controller = new AbortController;
+  const timer = setTimeout(() => controller.abort(), 2000);
+  try {
+    await fetch(`http://127.0.0.1:${port}/`, { signal: controller.signal, redirect: "manual" });
+    return true;
+  } catch {
+    return false;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function makeDefaultLauncher(verbose) {
+  const drop = privilegeDrop();
+  return ({ command, cwd, env: env2, logPath }) => {
+    const fd = openSync6(logPath, "a");
+    try {
+      const child = spawn("sh", ["-c", command], {
+        cwd,
+        env: env2,
+        detached: true,
+        stdio: ["ignore", fd, fd],
+        ...drop ? { uid: drop.uid, gid: drop.gid } : {}
+      });
+      const pid2 = child.pid;
+      if (pid2 === undefined)
+        throw new Error("spawn returned no pid");
+      const exited = new Promise((resolve14) => {
+        child.once("exit", (code) => {
+          resolve14(code);
+        });
+        child.once("error", () => {
+          resolve14(null);
+        });
+      }).finally(() => {
+        try {
+          closeSync6(fd);
+        } catch {}
+      });
+      debugLog("sites", `spawned pid ${pid2}: sh -c ${command} (cwd ${cwd})`, verbose);
+      return {
+        pid: pid2,
+        exited,
+        stop: (signal = "SIGTERM") => {
+          try {
+            process25.kill(-pid2, signal);
+          } catch {
+            try {
+              child.kill(signal);
+            } catch {}
+          }
+        }
+      };
+    } catch (err) {
+      try {
+        closeSync6(fd);
+      } catch {}
+      throw err;
+    }
+  };
+}
+function privilegeDrop() {
+  if (process25.platform === "win32")
+    return null;
+  const isRoot = typeof process25.getuid === "function" && process25.getuid() === 0;
+  if (!isRoot)
+    return null;
+  const uid = Number.parseInt(process25.env.SUDO_UID ?? "", 10);
+  const gid = Number.parseInt(process25.env.SUDO_GID ?? "", 10);
+  if (!Number.isInteger(uid) || uid <= 0 || !Number.isInteger(gid) || gid <= 0)
+    return null;
+  return { uid, gid };
+}
+var DEFAULT_STARTUP_TIMEOUT_MS = 120000, DEFAULT_POLL_INTERVAL_MS = 200, DEFAULT_REAP_INTERVAL_MS = 30000, DEFAULT_RESTART_DELAY_MS = 3000, KILL_GRACE_MS = 4000;
+var init_site_supervisor = __esm(() => {
+  init_host_routes();
+  init_port_manager();
+  init_registry();
+  init_utils();
+  init_logger();
+});
+// ../rpx/src/dns-state.ts
+import * as fsp5 from "node:fs/promises";
+import { homedir as homedir11 } from "node:os";
+import * as path7 from "node:path";
 function defaultRpxDir() {
-  return path6.join(homedir10(), ".stacks", "rpx");
+  return path7.join(homedir11(), ".stacks", "rpx");
 }
 function getDnsStatePath(rpxDir = defaultRpxDir()) {
-  return path6.join(rpxDir, RPX_DNS_STATE_FILE);
+  return path7.join(rpxDir, RPX_DNS_STATE_FILE);
 }
 async function loadDnsState(rpxDir = defaultRpxDir()) {
   try {
-    const raw = await fsp4.readFile(getDnsStatePath(rpxDir), "utf8");
+    const raw = await fsp5.readFile(getDnsStatePath(rpxDir), "utf8");
     const parsed = JSON.parse(raw);
     if (parsed.version !== DNS_STATE_VERSION || !Array.isArray(parsed.resolvers))
       return null;
@@ -23976,12 +24687,12 @@ async function loadDnsState(rpxDir = defaultRpxDir()) {
   }
 }
 async function saveDnsState(rpxDir, state) {
-  await fsp4.mkdir(rpxDir, { recursive: true });
-  await fsp4.writeFile(getDnsStatePath(rpxDir), `${JSON.stringify(state, null, 2)}
+  await fsp5.mkdir(rpxDir, { recursive: true });
+  await fsp5.writeFile(getDnsStatePath(rpxDir), `${JSON.stringify(state, null, 2)}
 `, "utf8");
 }
 async function clearDnsState(rpxDir) {
-  await fsp4.rm(getDnsStatePath(rpxDir), { force: true });
+  await fsp5.rm(getDnsStatePath(rpxDir), { force: true });
 }
 function normalizeDevDomain(raw) {
   const domain = raw.trim().toLowerCase().replace(/\.$/, "");
@@ -24057,9 +24768,9 @@ __export(exports_dns, {
   DNS_PORT: () => DNS_PORT
 });
 import dgram from "node:dgram";
-import * as fsp5 from "node:fs/promises";
-import * as path7 from "node:path";
-import * as process25 from "node:process";
+import * as fsp6 from "node:fs/promises";
+import * as path8 from "node:path";
+import * as process26 from "node:process";
 function parseHeader(buffer) {
   return {
     id: buffer.readUInt16BE(0),
@@ -24173,7 +24884,7 @@ function buildNxdomainResponse(queryId, question) {
   return Buffer.concat(parts);
 }
 async function startDnsServer(domains, verbose) {
-  if (process25.platform !== "darwin")
+  if (process26.platform !== "darwin")
     return false;
   const devDomains = devDomainsFromHosts(domains);
   if (devDomains.length === 0)
@@ -24293,14 +25004,14 @@ port ${DNS_PORT}
 `;
 }
 function resolverFilePath(basename) {
-  return path7.join(MACOS_RESOLVER_DIR, basename);
+  return path8.join(MACOS_RESOLVER_DIR, basename);
 }
 function contentLooksLikeRpxResolver(content) {
   return content.includes("127.0.0.1") && content.includes(String(DNS_PORT));
 }
 async function readResolverFile(basename) {
   try {
-    return await fsp5.readFile(resolverFilePath(basename), "utf8");
+    return await fsp6.readFile(resolverFilePath(basename), "utf8");
   } catch (err) {
     if (err.code === "ENOENT")
       return null;
@@ -24308,7 +25019,7 @@ async function readResolverFile(basename) {
   }
 }
 async function flushDnsCache(verbose) {
-  if (process25.platform !== "darwin")
+  if (process26.platform !== "darwin")
     return;
   const { execSudoSync: execSudoSync2, getSudoPassword: getSudoPassword2, isProcessElevated: isProcessElevated2 } = await Promise.resolve().then(() => (init_utils(), exports_utils));
   if (!isProcessElevated2() && !getSudoPassword2()) {
@@ -24345,7 +25056,7 @@ async function setupResolver(verbose, domains) {
   return setupDevelopmentDns({ domains: domains ?? [], verbose });
 }
 async function installResolvers(basenames, verbose) {
-  if (process25.platform !== "darwin")
+  if (process26.platform !== "darwin")
     return true;
   const { getSudoPassword: getSudoPassword2, isProcessElevated: isProcessElevated2 } = await Promise.resolve().then(() => (init_utils(), exports_utils));
   if (!isProcessElevated2() && !getSudoPassword2()) {
@@ -24363,7 +25074,7 @@ async function installResolvers(basenames, verbose) {
   }
 }
 async function uninstallResolvers(basenames, verbose) {
-  if (process25.platform !== "darwin")
+  if (process26.platform !== "darwin")
     return;
   const { getSudoPassword: getSudoPassword2, isProcessElevated: isProcessElevated2 } = await Promise.resolve().then(() => (init_utils(), exports_utils));
   if (!isProcessElevated2() && !getSudoPassword2())
@@ -24377,7 +25088,7 @@ async function uninstallResolvers(basenames, verbose) {
   }
 }
 async function removeLegacyTldResolvers(verbose) {
-  if (process25.platform !== "darwin")
+  if (process26.platform !== "darwin")
     return [];
   const removed = [];
   for (const label of LEGACY_TLD_RESOLVER_LABELS) {
@@ -24412,7 +25123,7 @@ async function setupDevelopmentDns(opts) {
     version: DNS_STATE_VERSION,
     resolvers: basenames,
     domains,
-    ownerPid: opts.ownerPid ?? process25.pid,
+    ownerPid: opts.ownerPid ?? process26.pid,
     updatedAt: new Date().toISOString()
   };
   await saveDnsState(rpxDir, state);
@@ -24436,7 +25147,7 @@ async function syncDevelopmentDnsFromRegistry(entries, opts = {}) {
     domains,
     rpxDir,
     verbose: opts.verbose,
-    ownerPid: opts.ownerPid ?? process25.pid
+    ownerPid: opts.ownerPid ?? process26.pid
   });
 }
 async function tearDownDevelopmentDns(opts = {}) {
@@ -24476,19 +25187,19 @@ var init_dns = __esm(() => {
 
 // ../rpx/src/daemon.ts
 import { spawn as nodeSpawn } from "node:child_process";
-import * as fsp6 from "node:fs/promises";
-import { homedir as homedir11 } from "node:os";
-import * as path8 from "node:path";
-import * as process26 from "node:process";
+import * as fsp7 from "node:fs/promises";
+import { homedir as homedir12 } from "node:os";
+import * as path9 from "node:path";
+import * as process27 from "node:process";
 function getDaemonRpxDir() {
-  return path8.join(homedir11(), ".stacks", "rpx");
+  return path9.join(homedir12(), ".stacks", "rpx");
 }
 function getDaemonPidPath(rpxDir = getDaemonRpxDir()) {
-  return path8.join(rpxDir, "daemon.pid");
+  return path9.join(rpxDir, "daemon.pid");
 }
 async function readDaemonPid(rpxDir = getDaemonRpxDir()) {
   try {
-    const raw = await fsp6.readFile(getDaemonPidPath(rpxDir), "utf8");
+    const raw = await fsp7.readFile(getDaemonPidPath(rpxDir), "utf8");
     const n2 = Number.parseInt(raw.trim(), 10);
     if (!Number.isFinite(n2) || n2 <= 0)
       return null;
@@ -24500,14 +25211,14 @@ async function readDaemonPid(rpxDir = getDaemonRpxDir()) {
   }
 }
 async function releaseDaemonLock(rpxDir = getDaemonRpxDir()) {
-  await fsp6.unlink(getDaemonPidPath(rpxDir)).catch(() => {});
+  await fsp7.unlink(getDaemonPidPath(rpxDir)).catch(() => {});
 }
 function defaultDaemonSpawnCommand() {
-  const exec = process26.execPath;
-  const interpName = path8.basename(exec).toLowerCase();
+  const exec = process27.execPath;
+  const interpName = path9.basename(exec).toLowerCase();
   const isInterpreter = interpName === "bun" || interpName === "node" || interpName.startsWith("bun-");
-  if (isInterpreter && process26.argv[1])
-    return [exec, process26.argv[1], "daemon:start"];
+  if (isInterpreter && process27.argv[1])
+    return [exec, process27.argv[1], "daemon:start"];
   return [exec, "daemon:start"];
 }
 async function ensureDaemonRunning(opts = {}) {
@@ -24525,7 +25236,7 @@ async function ensureDaemonRunning(opts = {}) {
     debugLog("daemon", `ensureDaemonRunning: clearing stale pid=${existingPid}`, verbose);
     await releaseDaemonLock(rpxDir);
   }
-  await fsp6.mkdir(rpxDir, { recursive: true });
+  await fsp7.mkdir(rpxDir, { recursive: true });
   const command = opts.spawnCommand ?? defaultDaemonSpawnCommand();
   if (command.length === 0)
     throw new Error("ensureDaemonRunning: spawnCommand is empty");
@@ -24533,8 +25244,8 @@ async function ensureDaemonRunning(opts = {}) {
   const child = nodeSpawn(command[0], command.slice(1), {
     detached: true,
     stdio: "ignore",
-    cwd: opts.spawnCwd ?? process26.cwd(),
-    env: opts.spawnEnv ? { ...process26.env, ...opts.spawnEnv } : process26.env
+    cwd: opts.spawnCwd ?? process27.cwd(),
+    env: opts.spawnEnv ? { ...process27.env, ...opts.spawnEnv } : process27.env
   });
   child.unref();
   let spawnError = null;
@@ -24565,15 +25276,18 @@ var init_daemon = __esm(() => {
   init_host_routes();
   init_sni();
   init_on_demand();
+  init_site_resolver();
+  init_site_supervisor();
   init_static_files();
+  init_auth();
   init_registry();
   init_dns();
   init_utils();
 });
 
 // src/index.ts
-import { exec as exec3, spawn as spawn2 } from "node:child_process";
-import * as process31 from "node:process";
+import { exec as exec3, spawn as spawn3 } from "node:child_process";
+import * as process34 from "node:process";
 import { promisify as promisify2 } from "node:util";
 
 // ../rpx/src/start.ts
@@ -24581,7 +25295,7 @@ init_logger();
 import { execSync as execSync4 } from "node:child_process";
 import * as http from "node:http";
 import * as net2 from "node:net";
-import * as process30 from "node:process";
+import * as process31 from "node:process";
 
 // ../rpx/src/colors.ts
 var c = (open, close) => (str) => `\x1B[${open}m${str}\x1B[${close}m`;
@@ -24601,8 +25315,8 @@ init_logger();
 init_registry();
 init_utils();
 import * as fs3 from "node:fs";
-import * as path9 from "node:path";
-import * as process27 from "node:process";
+import * as path10 from "node:path";
+import * as process28 from "node:process";
 function deriveIdFromTarget(to, routePath) {
   const base = routePath && routePath !== "/" ? `${to}${routePath}` : to;
   const cleaned = base.replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 128);
@@ -24630,8 +25344,8 @@ async function runViaDaemon(opts) {
       from: p2.from,
       to: p2.to,
       path: p2.path,
-      pid: opts.persistent ? undefined : process27.pid,
-      cwd: process27.cwd(),
+      pid: opts.persistent ? undefined : process28.pid,
+      cwd: process28.cwd(),
       createdAt,
       cleanUrls: p2.cleanUrls,
       changeOrigin: p2.changeOrigin,
@@ -24668,16 +25382,16 @@ async function runViaDaemon(opts) {
   };
   const onSignal = (sig) => {
     debugLog("runner", `received ${sig}, unregistering ${idsForCleanup.length} entries`, verbose);
-    cleanup().finally(() => process27.exit(0));
+    cleanup().finally(() => process28.exit(0));
   };
-  process27.once("SIGINT", onSignal);
-  process27.once("SIGTERM", onSignal);
-  process27.once("exit", () => {
+  process28.once("SIGINT", onSignal);
+  process28.once("SIGTERM", onSignal);
+  process28.once("exit", () => {
     if (cleaned)
       return;
     for (const id of idsForCleanup) {
       try {
-        fs3.unlinkSync(path9.join(dirForCleanup, `${id}.json`));
+        fs3.unlinkSync(path10.join(dirForCleanup, `${id}.json`));
       } catch {}
     }
   });
@@ -24689,18 +25403,18 @@ init_utils();
 import { exec } from "node:child_process";
 import fs4 from "node:fs";
 import os2 from "node:os";
-import path10 from "node:path";
-import * as process28 from "node:process";
+import path11 from "node:path";
+import * as process29 from "node:process";
 import { promisify } from "node:util";
 var execAsync = promisify(exec);
 function isLoopbackDevelopmentHost(host) {
   const normalized = host.trim().toLowerCase();
   return normalized === "localhost" || normalized.endsWith(".localhost") || normalized.endsWith(".localhost.");
 }
-var hostsFilePath = process28.platform === "win32" ? path10.join(process28.env.windir || "C:\\Windows", "System32", "drivers", "etc", "hosts") : "/etc/hosts";
+var hostsFilePath = process29.platform === "win32" ? path11.join(process29.env.windir || "C:\\Windows", "System32", "drivers", "etc", "hosts") : "/etc/hosts";
 var sudoPrivilegesAcquired = false;
 async function execSudo(command) {
-  if (process28.platform === "win32")
+  if (process29.platform === "win32")
     throw new Error("Administrator privileges required on Windows");
   if (isProcessElevated()) {
     const { stdout } = await execAsync(command);
@@ -24771,7 +25485,7 @@ async function addHosts(hosts, verbose) {
 127.0.0.1 ${host}
 ::1 ${host}`).join(`
 `);
-    const tmpFile = path10.join(os2.tmpdir(), `rpx-hosts-${Date.now()}.tmp`);
+    const tmpFile = path11.join(os2.tmpdir(), `rpx-hosts-${Date.now()}.tmp`);
     try {
       await fs4.promises.writeFile(tmpFile, existingContent + hostEntries, "utf8");
       await execSudo(`cat "${tmpFile}" | tee "${hostsFilePath}" > /dev/null`);
@@ -24833,7 +25547,7 @@ async function removeHosts(hosts, verbose) {
     const newContent = `${filteredLines.join(`
 `)}
 `;
-    const tmpFile = path10.join(os2.tmpdir(), `rpx-hosts-${Date.now()}.tmp`);
+    const tmpFile = path11.join(os2.tmpdir(), `rpx-hosts-${Date.now()}.tmp`);
     try {
       await fs4.promises.writeFile(tmpFile, newContent, "utf8");
       await execSudo(`cat "${tmpFile}" | tee "${hostsFilePath}" > /dev/null`);
@@ -24882,141 +25596,13 @@ async function checkHosts(hosts, verbose) {
 
 // ../rpx/src/start.ts
 init_https();
-
-// ../rpx/src/port-manager.ts
-init_utils();
-import * as net from "node:net";
-function isPortInUse(port, hostname, verbose) {
-  debugLog("port", `Checking if port ${port} is in use on ${hostname}`, verbose);
-  return new Promise((resolve14) => {
-    const server = net.createServer();
-    const timeout = setTimeout(() => {
-      debugLog("port", `Checking port ${port} timed out, assuming it's in use`, verbose);
-      server.close();
-      resolve14(true);
-    }, 3000);
-    server.once("error", (err) => {
-      clearTimeout(timeout);
-      if (err.code === "EADDRINUSE") {
-        debugLog("port", `Port ${port} is in use`, verbose);
-        resolve14(true);
-      } else {
-        debugLog("port", `Error checking port ${port}: ${err.message}`, verbose);
-        resolve14(true);
-      }
-    });
-    server.once("listening", () => {
-      clearTimeout(timeout);
-      debugLog("port", `Port ${port} is available`, verbose);
-      server.close();
-      resolve14(false);
-    });
-    try {
-      server.listen(port, hostname);
-    } catch (err) {
-      clearTimeout(timeout);
-      debugLog("port", `Exception checking port ${port}: ${err}`, verbose);
-      resolve14(true);
-    }
-  });
-}
-async function findAvailablePort(startPort, hostname, verbose, maxAttempts = 50) {
-  debugLog("port", `Finding available port starting from ${startPort} (max attempts: ${maxAttempts})`, verbose);
-  let port = startPort;
-  let attempts = 0;
-  while (attempts < maxAttempts) {
-    attempts++;
-    const isInUse = await isPortInUse(port, hostname, verbose);
-    if (!isInUse) {
-      debugLog("port", `Found available port: ${port} after ${attempts} attempts`, verbose);
-      return port;
-    }
-    debugLog("port", `Port ${port} is in use, trying ${port + 1} (attempt ${attempts}/${maxAttempts})`, verbose);
-    port++;
-  }
-  throw new Error(`Unable to find available port after ${maxAttempts} attempts starting from ${startPort}`);
-}
-function testPortConnectivity(port, hostname, timeout = 5000, verbose) {
-  debugLog("port", `Testing connection to ${hostname}:${port}`, verbose);
-  return new Promise((resolve14) => {
-    const socket = net.connect({
-      host: hostname,
-      port,
-      timeout
-    });
-    socket.once("connect", () => {
-      debugLog("port", `Successfully connected to ${hostname}:${port}`, verbose);
-      socket.end();
-      resolve14(true);
-    });
-    socket.once("timeout", () => {
-      debugLog("port", `Connection to ${hostname}:${port} timed out`, verbose);
-      socket.destroy();
-      resolve14(false);
-    });
-    socket.once("error", (err) => {
-      debugLog("port", `Failed to connect to ${hostname}:${port}: ${err.message}`, verbose);
-      socket.destroy();
-      resolve14(false);
-    });
-  });
-}
-
-class DefaultPortManager {
-  usedPorts = new Set;
-  hostname;
-  verbose;
-  maxRetries;
-  constructor(hostname = "0.0.0.0", verbose, maxRetries = 50) {
-    this.hostname = hostname;
-    this.verbose = verbose;
-    this.maxRetries = maxRetries;
-  }
-  async getNextAvailablePort(startPort, testConnectivity = false) {
-    if (this.usedPorts.has(startPort)) {
-      return this.findNextAvailablePort(startPort + 1, testConnectivity);
-    }
-    const isInUse = await isPortInUse(startPort, this.hostname, this.verbose);
-    if (isInUse) {
-      return this.findNextAvailablePort(startPort + 1, testConnectivity);
-    }
-    if (testConnectivity) {
-      const isConnectable = await testPortConnectivity(startPort, this.hostname, 3000, this.verbose);
-      if (!isConnectable) {
-        debugLog("port", `Port ${startPort} is available but not connectable, trying next port`, this.verbose);
-        return this.findNextAvailablePort(startPort + 1, testConnectivity);
-      }
-    }
-    this.usedPorts.add(startPort);
-    return startPort;
-  }
-  async findNextAvailablePort(startPort, testConnectivity = false) {
-    const port = await findAvailablePort(startPort, this.hostname, this.verbose, this.maxRetries);
-    if (testConnectivity) {
-      const isConnectable = await testPortConnectivity(port, this.hostname, 3000, this.verbose);
-      if (!isConnectable) {
-        if (port < startPort + this.maxRetries) {
-          return this.findNextAvailablePort(port + 1, testConnectivity);
-        } else {
-          throw new Error(`Unable to find a connectable port after ${this.maxRetries} attempts`);
-        }
-      }
-    }
-    this.usedPorts.add(port);
-    return port;
-  }
-  releasePort(port) {
-    debugLog("port", `Releasing port ${port}`, this.verbose);
-    this.usedPorts.delete(port);
-  }
-}
-var portManager = new DefaultPortManager;
+init_port_manager();
 
 // ../rpx/src/process-manager.ts
 init_logger();
 init_utils();
-import { spawn } from "node:child_process";
-import * as process29 from "node:process";
+import { spawn as spawn2 } from "node:child_process";
+import * as process30 from "node:process";
 
 class ProcessManager {
   processes = new Map;
@@ -25027,14 +25613,14 @@ class ProcessManager {
       return;
     }
     const [cmd, ...args] = options.command.split(" ");
-    const cwd4 = options.cwd || process29.cwd();
+    const cwd4 = options.cwd || process30.cwd();
     debugLog("start", `Starting process ${id}:`, verbose);
     debugLog("start", `  Command: ${cmd} ${args.join(" ")}`, verbose);
     debugLog("start", `  Working directory: ${cwd4}`, verbose);
     debugLog("start", `  Environment variables: ${safeStringify(options.env)}`, verbose);
-    const childProcess = spawn(cmd, args, {
+    const childProcess = spawn2(cmd, args, {
       cwd: cwd4,
-      env: { ...process29.env, ...options.env },
+      env: { ...process30.env, ...options.env },
       shell: true,
       stdio: "inherit"
     });
@@ -25134,7 +25720,7 @@ class ProcessManager {
 var processManager = new ProcessManager;
 
 // ../rpx/src/origin-guard.ts
-import { timingSafeEqual } from "node:crypto";
+import { timingSafeEqual as timingSafeEqual2 } from "node:crypto";
 function secretMatches(provided, expected) {
   if (provided == null)
     return false;
@@ -25142,7 +25728,7 @@ function secretMatches(provided, expected) {
   const b2 = Buffer.from(expected);
   if (a2.length !== b2.length)
     return false;
-  return timingSafeEqual(a2, b2);
+  return timingSafeEqual2(a2, b2);
 }
 function normalizeHost(host) {
   return host.toLowerCase().replace(/\.$/, "");
@@ -25196,6 +25782,26 @@ function createOriginGuard(options) {
 
 // ../rpx/src/start.ts
 init_proxy_handler();
+
+// ../rpx/src/acme-challenge.ts
+import * as fs5 from "node:fs";
+import * as path12 from "node:path";
+var ACME_CHALLENGE_PREFIX2 = "/.well-known/acme-challenge/";
+function readAcmeChallenge(webroot, pathname) {
+  if (!webroot || !pathname.startsWith(ACME_CHALLENGE_PREFIX2))
+    return null;
+  const token = pathname.slice(ACME_CHALLENGE_PREFIX2.length);
+  if (!token || !/^[A-Za-z0-9_-]+$/.test(token))
+    return null;
+  try {
+    return fs5.readFileSync(path12.join(webroot, token), "utf8");
+  } catch {
+    return null;
+  }
+}
+
+// ../rpx/src/start.ts
+init_auth();
 init_host_routes();
 init_sni();
 init_static_files();
@@ -25288,8 +25894,8 @@ async function cleanup(options) {
     cleanupPromiseResolve = null;
     isCleaningUp = false;
     const isVitePluginCall = options && "vitePluginUsage" in options && options.vitePluginUsage === true;
-    if (process30.env.NODE_ENV !== "test" && process30.env.BUN_ENV !== "test" && !isVitePluginCall) {
-      process30.exit(0);
+    if (process31.env.NODE_ENV !== "test" && process31.env.BUN_ENV !== "test" && !isVitePluginCall) {
+      process31.exit(0);
     }
   }
   return cleanupPromise;
@@ -25298,31 +25904,31 @@ var isHandlingSignal = false;
 function signalHandler(signal) {
   if (isHandlingSignal) {
     debugLog("signal", `Received second ${signal} signal, forcing exit`, true);
-    process30.exit(1);
+    process31.exit(1);
     return;
   }
   isHandlingSignal = true;
   debugLog("signal", `Received ${signal} signal, initiating cleanup`, true);
   cleanup().catch((err) => {
     debugLog("signal", `Cleanup failed after ${signal}: ${err}`, true);
-    process30.exit(1);
+    process31.exit(1);
   }).finally(() => {
     isHandlingSignal = false;
   });
 }
-process30.once("SIGINT", () => signalHandler("SIGINT"));
-process30.once("SIGTERM", () => signalHandler("SIGTERM"));
-process30.on("uncaughtException", (err) => {
+process31.once("SIGINT", () => signalHandler("SIGINT"));
+process31.once("SIGTERM", () => signalHandler("SIGTERM"));
+process31.on("uncaughtException", (err) => {
   log.error("Uncaught exception (continuing):", err);
 });
-process30.on("unhandledRejection", (reason) => {
+process31.on("unhandledRejection", (reason) => {
   log.error("Unhandled rejection (continuing):", reason);
 });
 async function testConnection(hostname, port, verbose, retries = 5) {
   debugLog("connection", `Testing connection to ${hostname}:${port} (retries left: ${retries})`, verbose);
   const maxTestDuration = 15000;
   const startTime = Date.now();
-  if (process30.env.RPX_BYPASS_CONNECTION_TEST === "true") {
+  if (process31.env.RPX_BYPASS_CONNECTION_TEST === "true") {
     debugLog("connection", `Bypassing connection test for ${hostname}:${port} due to RPX_BYPASS_CONNECTION_TEST flag`, verbose);
     return;
   }
@@ -25418,7 +26024,7 @@ async function startServer(options) {
           log.warn("You can manually add this entry to your hosts file:");
           log.warn(`127.0.0.1 ${toUrl.hostname}`);
           log.warn(`::1 ${toUrl.hostname}`);
-          if (process30.platform === "win32") {
+          if (process31.platform === "win32") {
             log.warn("On Windows:");
             log.warn("1. Run notepad as administrator");
             log.warn("2. Open C:\\Windows\\System32\\drivers\\etc\\hosts");
@@ -25491,7 +26097,7 @@ async function startServer(options) {
     ssl: sslConfig
   });
 }
-async function createProxyServer(from, to, listenPort, sourceUrl, ssl, vitePluginUsage, verbose, cleanUrls, changeOrigin) {
+async function createProxyServer(from, to, listenPort, sourceUrl, ssl, vitePluginUsage, verbose, cleanUrls, changeOrigin, auth) {
   debugLog("proxy", `Creating proxy server ${from} -> ${to} with cleanUrls: ${cleanUrls}`, verbose);
   const routeEntries = [{
     host: to,
@@ -25499,7 +26105,8 @@ async function createProxyServer(from, to, listenPort, sourceUrl, ssl, vitePlugi
       sourceHost: sourceUrl.host,
       cleanUrls: cleanUrls || false,
       changeOrigin: changeOrigin || false,
-      basePath: "/"
+      basePath: "/",
+      auth
     }
   }];
   const server = createSharedProxyServer({ routeEntries, listenPort, sslConfig: ssl, originGuard: null, verbose: verbose ?? false });
@@ -25537,7 +26144,7 @@ async function setupProxy(options) {
         }
       }
     } else {
-      if (hostsEnabled && process30.platform !== "darwin" && to && to.includes("localhost") && !to.match(/^(localhost|127\.0\.0\.1)$/)) {
+      if (hostsEnabled && process31.platform !== "darwin" && to && to.includes("localhost") && !to.match(/^(localhost|127\.0\.0\.1)$/)) {
         const hostsExist = await checkHosts([to], verbose);
         if (!hostsExist[0]) {
           debugLog("hosts", `${to} not found in hosts file, adding...`, verbose);
@@ -25584,7 +26191,7 @@ async function setupProxy(options) {
       portManager2.usedPorts.add(finalPort);
       debugLog("setup", `Using standard ${targetPort === 443 ? "HTTPS" : "HTTP"} port ${targetPort} for ${to}`, verbose);
     }
-    await createProxyServer(from, to, finalPort, sourceUrl, ssl, vitePluginUsage, verbose, cleanUrls, changeOrigin);
+    await createProxyServer(from, to, finalPort, sourceUrl, ssl, vitePluginUsage, verbose, cleanUrls, changeOrigin, resolveAuth(options.auth));
   } catch (err) {
     debugLog("setup", `Setup failed: ${err}`, verbose);
     log.error(`Failed to setup reverse proxy: ${err.message}`);
@@ -25597,9 +26204,19 @@ async function setupProxy(options) {
     });
   }
 }
-function startHttpRedirectServer(verbose, httpPort = 80, httpsPort = 443) {
+function startHttpRedirectServer(verbose, httpPort = 80, httpsPort = 443, acmeChallengeWebroot) {
   debugLog("redirect", `Starting HTTP redirect server on port ${httpPort}`, verbose);
   const server = http.createServer((req, res) => {
+    if (acmeChallengeWebroot && req.url) {
+      const pathname = req.url.split("?", 1)[0];
+      const keyAuth = readAcmeChallenge(acmeChallengeWebroot, pathname);
+      if (keyAuth != null) {
+        debugLog("redirect", `Serving ACME challenge ${pathname}`, verbose);
+        res.writeHead(200, { "content-type": "text/plain" });
+        res.end(keyAuth);
+        return;
+      }
+    }
     const rawHost = req.headers.host || "";
     const hostname = rawHost.includes(":") ? rawHost.slice(0, rawHost.indexOf(":")) : rawHost;
     const target = httpsPort === 443 ? hostname : `${hostname}:${httpsPort}`;
@@ -25726,7 +26343,7 @@ async function startProxies(options) {
     debugLog("watch", "No start command found in config", verbose);
   }
   const primaryDomain = "proxies" in mergedOptions && Array.isArray(mergedOptions.proxies) ? mergedOptions.proxies[0]?.to : ("to" in mergedOptions) ? mergedOptions.to : "rpx.localhost";
-  if (process30.platform !== "win32" && (mergedOptions.https || hostsEnabled)) {
+  if (process31.platform !== "win32" && (mergedOptions.https || hostsEnabled)) {
     const sudoPassword = getSudoPassword();
     if (!sudoPassword) {
       try {
@@ -25776,6 +26393,7 @@ async function startProxies(options) {
     vitePluginUsage: mergedOptions.vitePluginUsage,
     start: "start" in mergedOptions ? mergedOptions.start : undefined,
     changeOrigin: mergedOptions.changeOrigin,
+    auth: "auth" in mergedOptions ? mergedOptions.auth : undefined,
     verbose,
     _cachedSSLConfig: mergedOptions._cachedSSLConfig
   }];
@@ -25791,7 +26409,7 @@ async function startProxies(options) {
     log.info(`  These TLDs have HSTS preloading which can bypass local DNS`);
     log.info(`  Consider using reserved TLDs: .test, .localhost, or .local`);
   }
-  if (hostsEnabled && process30.platform === "darwin" && customDomains.length > 0) {
+  if (hostsEnabled && process31.platform === "darwin" && customDomains.length > 0) {
     const { setupDevelopmentDns: setupDevelopmentDns2 } = await Promise.resolve().then(() => (init_dns(), exports_dns));
     const dnsStarted = await setupDevelopmentDns2({ domains: customDomains, verbose });
     if (dnsStarted) {
@@ -25827,8 +26445,8 @@ async function startProxies(options) {
       verbose: mergedOptions.verbose || false
     });
   };
-  process30.on("SIGINT", cleanupHandler);
-  process30.on("SIGTERM", cleanupHandler);
+  process31.on("SIGINT", cleanupHandler);
+  process31.on("SIGTERM", cleanupHandler);
   const singlePortMode = mergedOptions.singlePortMode === true;
   const httpsPort = mergedOptions.httpsPort ?? 443;
   const httpPort = mergedOptions.httpPort ?? 80;
@@ -25840,7 +26458,7 @@ async function startProxies(options) {
     const routeEntries = await collectRouteEntries(proxyOptions, hostsEnabled, verbose);
     const isHttpPortBusy = await isPortInUse(httpPort, "0.0.0.0", verbose);
     if (!isHttpPortBusy) {
-      startHttpRedirectServer(verbose, httpPort, httpsPort);
+      startHttpRedirectServer(verbose, httpPort, httpsPort, mergedOptions.acmeChallengeWebroot);
     }
     const isPortBusy = await isPortInUse(httpsPort, "0.0.0.0", verbose);
     if (isPortBusy) {
@@ -25900,13 +26518,22 @@ async function collectRouteEntries(proxyOptions, hostsEnabled, verbose) {
     const cleanUrls = option.cleanUrls || false;
     const routePath = option.path;
     const basePath = normalizePathPrefix(routePath);
-    if (option.static) {
+    const auth = resolveAuth(option.auth);
+    if (option.redirect) {
+      const redirect = resolveRedirect(option.redirect);
+      routeEntries.push({
+        host: domain,
+        path: routePath,
+        route: { redirect, basePath, auth }
+      });
+      debugLog("proxies", `Route: ${domain}${routePath ?? ""} → redirect ${redirect.status} ${redirect.to}${auth ? " (auth)" : ""}`, verbose);
+    } else if (option.static) {
       routeEntries.push({
         host: domain,
         path: routePath,
-        route: { static: resolveStaticRoute(option.static, cleanUrls), cleanUrls, basePath }
+        route: { static: resolveStaticRoute(option.static, cleanUrls), cleanUrls, basePath, auth }
       });
-      debugLog("proxies", `Route: ${domain}${routePath ?? ""} → static ${typeof option.static === "string" ? option.static : option.static.dir}`, verbose);
+      debugLog("proxies", `Route: ${domain}${routePath ?? ""} → static ${typeof option.static === "string" ? option.static : option.static.dir}${auth ? " (auth)" : ""}`, verbose);
     } else {
       const fromUrl = new URL(option.from?.startsWith("http") ? option.from : `http://${option.from}`);
       routeEntries.push({
@@ -25917,10 +26544,11 @@ async function collectRouteEntries(proxyOptions, hostsEnabled, verbose) {
           cleanUrls,
           changeOrigin: option.changeOrigin || false,
           pathRewrites: option.pathRewrites,
-          basePath
+          basePath,
+          auth
         }
       });
-      debugLog("proxies", `Route: ${domain}${routePath ?? ""} → ${fromUrl.host}`, verbose);
+      debugLog("proxies", `Route: ${domain}${routePath ?? ""} → ${fromUrl.host}${auth ? " (auth)" : ""}`, verbose);
     }
     if (seenDomains.has(domain)) {
       continue;
@@ -25998,15 +26626,19 @@ init_config();
 init_https();
 init_macos_trust();
 init_cert_inspect();
+init_port_manager();
 init_registry();
 init_dns();
 init_dns_state();
 init_daemon();
 init_proxy_handler();
+init_auth();
 init_host_routes();
 init_static_files();
 init_sni();
 init_on_demand();
+init_site_resolver();
+init_site_supervisor();
 init_utils();
 
 // src/simplified-plugin.ts
@@ -26167,11 +26799,11 @@ function VitePluginRpx(options) {
         if (!hasSudoAccess) {
           const origLog = console.log;
           console.log = () => {};
-          process31.stdout.write(`
+          process34.stdout.write(`
 Sudo access required for proxy setup.
 `);
           const gotSudoAccess = await new Promise((resolve14) => {
-            const sudo = spawn2("sudo", ["true"], {
+            const sudo = spawn3("sudo", ["true"], {
               stdio: "inherit"
             });
             sudo.on("exit", (code) => {
@@ -26181,7 +26813,7 @@ Sudo access required for proxy setup.
           console.log = origLog;
           if (!gotSudoAccess) {
             console.error("Failed to get sudo access. Please try again.");
-            process31.exit(1);
+            process34.exit(1);
           }
         }
       }
@@ -26191,10 +26823,10 @@ Sudo access required for proxy setup.
           handleSignal("CLOSE").catch(console.error);
         });
       }
-      const registeredEvents = process31.listeners("SIGINT").length > 0 && process31.listeners("SIGTERM").length > 0;
+      const registeredEvents = process34.listeners("SIGINT").length > 0 && process34.listeners("SIGTERM").length > 0;
       if (!registeredEvents) {
-        process31.once("SIGINT", () => handleSignal("SIGINT").catch(console.error));
-        process31.once("SIGTERM", () => handleSignal("SIGTERM").catch(console.error));
+        process34.once("SIGINT", () => handleSignal("SIGINT").catch(console.error));
+        process34.once("SIGTERM", () => handleSignal("SIGTERM").catch(console.error));
       }
       const colorUrl = (url) => colors.cyan(url.replace(/:(\d+)\//, (_, port) => `:${colors.bold(port)}/`));
       const originalPrintUrls = serverInstance.printUrls;
@@ -26232,7 +26864,7 @@ Sudo access required for proxy setup.
           debug("Proxy setup complete");
         } catch (error) {
           console.error("Failed to start reverse proxy:", error);
-          process31.exit(1);
+          process34.exit(1);
         }
       };
       if (serverInstance.httpServer) {