ysk-server-core 1.0.0 → 1.1.0

package/dist/hosting/nginx-sync.d.ts

@@ -18,12 +18,45 @@ export interface NginxSyncResult {
 /**
  * Ensure managed nginx conf dir exists; optionally copy to system sites and nginx -t.
  */
+/** Managed `ysks_xxx.conf` or system `ysk-ysks_xxx.conf`. */
+export declare function isProjectNginxConfName(name: string): boolean;
+export declare function linuxUserFromNginxConfName(name: string): string;
+/** Remove project vhosts whose linux user is no longer in the store. */
+export declare function pruneOrphanProjectNginxConfs(opts: {
+    managedDir: string;
+    systemDir?: string | null;
+    keepLinuxUsers: string[];
+}): string[];
+export declare const YSK_DEFAULT_NGINX_BASENAME = "000-default.conf";
+export type YskDefaultSslMode = 'reject' | 'selfsigned';
+/** Catch-all so unknown Host / SNI does not fall into another site's vhost. */
+export declare function renderYskDefaultNginxConf(opts?: {
+    sslMode?: YskDefaultSslMode;
+    sslCertificate?: string;
+    sslCertificateKey?: string;
+}): string;
+export declare function ensureYskDefaultNginxConf(managedDir: string, opts?: {
+    sslMode?: YskDefaultSslMode;
+    sslCertificate?: string;
+    sslCertificateKey?: string;
+}): string;
+/** Remove default_server from listen lines (keep our catch-all file). */
+export declare function stripListenDefaultServer(body: string): string;
+export declare function isYskManagedSystemConfName(name: string): boolean;
+/** System copies whose managed source is gone (all ysk-*.conf, not only ysks_*). */
+export declare function pruneStaleYskSystemNginxConfs(systemDir: string, managedBasenames: string[]): string[];
+export declare function publicFilesConfBasename(serverName: string): string;
+export declare function pruneStalePublicFilesNginxConfs(managedDir: string, keepBasename?: string | null): string[];
 export declare function syncNginxConfigs(opts: {
     dataDir: string;
     /** e.g. /etc/nginx/conf.d — only used when executeEnabled + writable */
     systemConfDir?: string;
     host: HostExecutor;
     dryRun?: boolean;
+    /** When set, drop ysks_* vhosts whose linux user is not live */
+    keepLinuxUsers?: string[];
+    /** Keep this public-files-*.conf; drop other public-files leftovers */
+    keepPublicFilesConf?: string;
 }): Promise<NginxSyncResult>;
 /**
  * Write a single server block into managed conf.d.

package/dist/hosting/nginx-sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nginx-sync.d.ts","sourceRoot":"","sources":["../../src/hosting/nginx-sync.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGxD,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,iEAAiE;IACjE,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,GAAG,OAAO,CAAC,eAAe,CAAC,CAwG3B;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAchG;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAS3G"}
+{"version":3,"file":"nginx-sync.d.ts","sourceRoot":"","sources":["../../src/hosting/nginx-sync.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGxD,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,iEAAiE;IACjE,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;GAEG;AACH,6DAA6D;AAC7D,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,wEAAwE;AACxE,wBAAgB,4BAA4B,CAAC,IAAI,EAAE;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B,GAAG,MAAM,EAAE,CAqBX;AAED,eAAO,MAAM,0BAA0B,qBAAqB,CAAC;AAE7D,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,YAAY,CAAC;AAExD,+EAA+E;AAC/E,wBAAgB,yBAAyB,CAAC,IAAI,CAAC,EAAE;IAC/C,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,GAAG,MAAM,CA8BT;AAED,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE;IACL,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,GACA,MAAM,CAKR;AAED,yEAAyE;AACzE,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAK7D;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEhE;AAED,oFAAoF;AACpF,wBAAgB,6BAA6B,CAC3C,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,MAAM,EAAE,GACzB,MAAM,EAAE,CAkBV;AAED,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,wBAAgB,+BAA+B,CAC7C,UAAU,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,GAC3B,MAAM,EAAE,CAeV;AAwFD,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gEAAgE;IAChE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,uEAAuE;IACvE,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B,GAAG,OAAO,CAAC,eAAe,CAAC,CAqJ3B;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAchG;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAS3G"}

package/dist/hosting/nginx-sync.js

@@ -8,9 +8,236 @@ import { injectDefenseLimitsIntoConf } from './defense/nginx-limits.js';
 /**
  * Ensure managed nginx conf dir exists; optionally copy to system sites and nginx -t.
  */
+/** Managed `ysks_xxx.conf` or system `ysk-ysks_xxx.conf`. */
+export function isProjectNginxConfName(name) {
+    return /^(ysk-)?ysks_[a-z0-9]+\.conf$/i.test(name);
+}
+export function linuxUserFromNginxConfName(name) {
+    return name.replace(/^ysk-/i, '').replace(/\.conf$/i, '');
+}
+/** Remove project vhosts whose linux user is no longer in the store. */
+export function pruneOrphanProjectNginxConfs(opts) {
+    const keep = new Set(opts.keepLinuxUsers.map((u) => u.trim().toLowerCase()).filter(Boolean));
+    const removed = [];
+    const sweep = (dir) => {
+        if (!dir || !existsSync(dir))
+            return;
+        for (const f of readdirSync(dir)) {
+            if (!isProjectNginxConfName(f))
+                continue;
+            const user = linuxUserFromNginxConfName(f).toLowerCase();
+            if (keep.has(user))
+                continue;
+            const path = join(dir, f);
+            try {
+                unlinkSync(path);
+                removed.push(path);
+            }
+            catch {
+                /* leave in place */
+            }
+        }
+    };
+    sweep(opts.managedDir);
+    sweep(opts.systemDir ?? undefined);
+    return removed;
+}
+export const YSK_DEFAULT_NGINX_BASENAME = '000-default.conf';
+/** Catch-all so unknown Host / SNI does not fall into another site's vhost. */
+export function renderYskDefaultNginxConf(opts) {
+    const sslMode = opts?.sslMode ?? 'reject';
+    const http = `server {
+  listen 80 default_server;
+  listen [::]:80 default_server;
+  server_name _;
+  return 444;
+}`;
+    if (sslMode === 'selfsigned' && opts?.sslCertificate && opts.sslCertificateKey) {
+        return `# YSK catch-all — unknown Host / SNI must not serve another site
+${http}
+server {
+  listen 443 ssl default_server;
+  listen [::]:443 ssl default_server;
+  server_name _;
+  ssl_certificate ${opts.sslCertificate};
+  ssl_certificate_key ${opts.sslCertificateKey};
+  return 444;
+}
+`;
+    }
+    return `# YSK catch-all — unknown Host / SNI must not serve another site
+${http}
+server {
+  listen 443 ssl default_server;
+  listen [::]:443 ssl default_server;
+  server_name _;
+  ssl_reject_handshake on;
+}
+`;
+}
+export function ensureYskDefaultNginxConf(managedDir, opts) {
+    mkdirSync(managedDir, { recursive: true });
+    const path = join(managedDir, YSK_DEFAULT_NGINX_BASENAME);
+    writeFileSync(path, renderYskDefaultNginxConf(opts), 'utf8');
+    return path;
+}
+/** Remove default_server from listen lines (keep our catch-all file). */
+export function stripListenDefaultServer(body) {
+    return body.replace(/^(\s*listen\s+[^;]*?)\s+default_server(\s+[^;]*)?;/gm, (_, pre, rest) => `${pre}${rest ?? ''};`);
+}
+export function isYskManagedSystemConfName(name) {
+    return /^ysk-.+\.conf$/i.test(name);
+}
+/** System copies whose managed source is gone (all ysk-*.conf, not only ysks_*). */
+export function pruneStaleYskSystemNginxConfs(systemDir, managedBasenames) {
+    if (!existsSync(systemDir))
+        return [];
+    const keep = new Set(managedBasenames.map((f) => (f.startsWith('ysk-') ? f : `ysk-${f}`)));
+    const removed = [];
+    for (const f of readdirSync(systemDir)) {
+        if (!isYskManagedSystemConfName(f))
+            continue;
+        if (keep.has(f))
+            continue;
+        const path = join(systemDir, f);
+        try {
+            unlinkSync(path);
+            removed.push(path);
+        }
+        catch {
+            /* leave */
+        }
+    }
+    return removed;
+}
+export function publicFilesConfBasename(serverName) {
+    return `public-files-${serverName.trim().toLowerCase().replace(/\./g, '-')}.conf`;
+}
+export function pruneStalePublicFilesNginxConfs(managedDir, keepBasename) {
+    if (!existsSync(managedDir) || !keepBasename)
+        return [];
+    const removed = [];
+    for (const f of readdirSync(managedDir)) {
+        if (!f.startsWith('public-files-') || !f.endsWith('.conf'))
+            continue;
+        if (f === keepBasename)
+            continue;
+        const path = join(managedDir, f);
+        try {
+            unlinkSync(path);
+            removed.push(path);
+        }
+        catch {
+            /* leave */
+        }
+    }
+    return removed;
+}
+const YSK_DEFAULT_SYSTEM_NAME = `ysk-${YSK_DEFAULT_NGINX_BASENAME}`;
+function stripForeignDefaultServer(dir, notes) {
+    if (!existsSync(dir))
+        return;
+    for (const f of readdirSync(dir)) {
+        if (!f.endsWith('.conf'))
+            continue;
+        if (f === YSK_DEFAULT_NGINX_BASENAME || f === YSK_DEFAULT_SYSTEM_NAME)
+            continue;
+        const path = join(dir, f);
+        try {
+            const prev = readFileSync(path, 'utf8');
+            if (!/\bdefault_server\b/.test(prev))
+                continue;
+            const next = stripListenDefaultServer(prev);
+            if (next !== prev) {
+                writeFileSync(path, next, 'utf8');
+                notes.push(`stripped default_server from ${path}`);
+            }
+        }
+        catch {
+            /* leave */
+        }
+    }
+}
+async function disableDistroNginxDefault(host, notes) {
+    const targets = [
+        '/etc/nginx/sites-enabled/default',
+        '/etc/nginx/sites-enabled/default-ssl',
+    ];
+    for (const p of targets) {
+        if (!host.pathExists(p))
+            continue;
+        try {
+            unlinkSync(p);
+            notes.push(`disabled distro nginx site ${p}`);
+        }
+        catch {
+            const r = await host.runCommand(['rm', '-f', p], { timeoutMs: 5_000 });
+            if (r.exitCode === 0)
+                notes.push(`disabled distro nginx site ${p}`);
+        }
+    }
+}
+async function ensureDefaultSelfSigned(host, dataDir) {
+    const dir = join(dataDir, 'nginx', 'default-tls');
+    const cert = join(dir, 'fullchain.pem');
+    const key = join(dir, 'privkey.pem');
+    if (existsSync(cert) && existsSync(key))
+        return { cert, key };
+    mkdirSync(dir, { recursive: true });
+    const r = await host.runCommand([
+        'openssl',
+        'req',
+        '-x509',
+        '-newkey',
+        'rsa:2048',
+        '-keyout',
+        key,
+        '-out',
+        cert,
+        '-days',
+        '3650',
+        '-nodes',
+        '-subj',
+        '/CN=_',
+    ], { timeoutMs: 20_000 });
+    if (r.exitCode !== 0 || !existsSync(cert) || !existsSync(key))
+        return null;
+    return { cert, key };
+}
+function keepPublicFilesBasenameFromMeta(dataDir) {
+    const metaPath = join(dataDir, 'files', 'public-files-meta.json');
+    if (!existsSync(metaPath))
+        return undefined;
+    try {
+        const meta = JSON.parse(readFileSync(metaPath, 'utf8'));
+        const sn = String(meta.serverName ?? '').trim();
+        return sn ? publicFilesConfBasename(sn) : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 export async function syncNginxConfigs(opts) {
     const sourceDir = join(opts.dataDir, 'nginx', 'conf.d');
     mkdirSync(sourceDir, { recursive: true });
+    const pruneNotes = [];
+    if (!opts.dryRun) {
+        const keepPf = opts.keepPublicFilesConf ?? keepPublicFilesBasenameFromMeta(opts.dataDir);
+        for (const p of pruneStalePublicFilesNginxConfs(sourceDir, keepPf)) {
+            pruneNotes.push(tl('notes.nginx.removedOrphan', { path: p }));
+        }
+    }
+    ensureYskDefaultNginxConf(sourceDir);
+    if (opts.keepLinuxUsers && !opts.dryRun) {
+        const removed = pruneOrphanProjectNginxConfs({
+            managedDir: sourceDir,
+            systemDir: opts.systemConfDir,
+            keepLinuxUsers: opts.keepLinuxUsers,
+        });
+        for (const p of removed) {
+            pruneNotes.push(tl('notes.nginx.removedOrphan', { path: p }));
+        }
+    }
     // always write a managed main include snippet for documentation
     const managedMain = join(opts.dataDir, 'nginx', 'ysk-managed.conf');
     writeFileSync(managedMain, `# Generated by YSK Server — include from main nginx.conf:\n# include ${sourceDir}/*.conf;\n`, 'utf8');
@@ -23,6 +250,7 @@ export async function syncNginxConfigs(opts) {
     const notes = [
         tl('notes.nginx.managedDir', { path: sourceDir }),
         tl('notes.nginx.includeHint', { path: sourceDir }),
+        ...pruneNotes,
     ];
     const copied = [];
     const targetDir = opts.systemConfDir ?? null;
@@ -54,24 +282,20 @@ export async function syncNginxConfigs(opts) {
             copyFileSync(src, dest);
             copied.push(dest);
         }
-        // Drop orphan project vhosts left after delete/recreate (same server_name → 502)
         try {
-            const managedSet = new Set(files.map((f) => `ysk-${f}`));
-            for (const f of readdirSync(targetDir)) {
-                // Only project linux_user confs: ysk-ysks_xxxxxxxx.conf
-                if (!/^ysk-ysks_[a-z0-9]+\.conf$/i.test(f))
-                    continue;
-                if (managedSet.has(f))
-                    continue;
-                const orphan = join(targetDir, f);
-                unlinkSync(orphan);
-                notes.push(tl('notes.nginx.removedOrphan', { path: orphan }));
+            for (const p of pruneStaleYskSystemNginxConfs(targetDir, files)) {
+                notes.push(tl('notes.nginx.removedOrphan', { path: p }));
             }
         }
         catch (e) {
             const msg = e instanceof Error ? e.message : String(e);
             notes.push(tl('notes.nginx.orphanCleanupFailed', { detail: msg.slice(0, 120) }));
         }
+        await disableDistroNginxDefault(opts.host, notes);
+        stripForeignDefaultServer(targetDir, notes);
+        if (existsSync('/etc/nginx/sites-enabled')) {
+            stripForeignDefaultServer('/etc/nginx/sites-enabled', notes);
+        }
         notes.push(tl('notes.auto.t0427', { v0: (copied.length) }));
     }
     else if (targetDir) {
@@ -84,6 +308,29 @@ export async function syncNginxConfigs(opts) {
         const r = await opts.host.runCommand(['nginx', '-t'], { timeoutMs: 10_000 });
         tested = r.exitCode === 0;
         testOutput = `${r.stdout}\n${r.stderr}`.trim();
+        if (!tested &&
+            /ssl_reject_handshake|unknown directive/i.test(testOutput) &&
+            targetDir &&
+            opts.host.executeEnabled()) {
+            const tls = await ensureDefaultSelfSigned(opts.host, opts.dataDir);
+            if (tls) {
+                ensureYskDefaultNginxConf(sourceDir, {
+                    sslMode: 'selfsigned',
+                    sslCertificate: tls.cert,
+                    sslCertificateKey: tls.key,
+                });
+                try {
+                    copyFileSync(join(sourceDir, YSK_DEFAULT_NGINX_BASENAME), join(targetDir, YSK_DEFAULT_SYSTEM_NAME));
+                }
+                catch {
+                    /* */
+                }
+                const r2 = await opts.host.runCommand(['nginx', '-t'], { timeoutMs: 10_000 });
+                tested = r2.exitCode === 0;
+                testOutput = `${r2.stdout}\n${r2.stderr}`.trim();
+                notes.push('catch-all 443 fell back to a local self-signed cert (ssl_reject_handshake unavailable)');
+            }
+        }
         notes.push(tested ? tl('notes.nginx.configOk') : tl('notes.tpl.nginxConfigFailed', { detail: testOutput || tl('notes.tpl.unknownError') }));
     }
     else {

package/dist/hosting/nginx-sync.js.map

@@ -1 +1 @@
-{"version":3,"file":"nginx-sync.js","sourceRoot":"","sources":["../../src/hosting/nginx-sync.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACpH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAC,MAAM,mBAAmB,CAAC;AAE5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AAgBxE;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAMtC;IACC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACxD,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,gEAAgE;IAChE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,kBAAkB,CAAC,CAAC;IACpE,aAAa,CACX,WAAW,EACX,wEAAwE,SAAS,YAAY,EAC7F,MAAM,CACP,CAAC;IAEF,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC;QACjC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC3D,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC;QACpC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1D,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,KAAK,GAAa;QACtB,EAAE,CAAC,wBAAwB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACjD,EAAE,CAAC,yBAAyB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;KACnD,CAAC;IACF,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC;IAE7C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO;YACL,SAAS;YACT,SAAS;YACT,KAAK;YACL,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC;YACzC,EAAE,EAAE,IAAI;SAAE,CAAC;IACf,CAAC;IAED,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QAC5C,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;YAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YACzC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;QACD,sDAAsD;QACtD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;YAC/B,uEAAuE;YACvE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACpE,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;QACD,iFAAiF;QACjF,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YACzD,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvC,wDAAwD;gBACxD,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,CAAC,CAAC;oBAAE,SAAS;gBACrD,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;oBAAE,SAAS;gBAChC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;gBAClC,UAAU,CAAC,MAAM,CAAC,CAAC;gBACnB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,2BAA2B,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACnF,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9D,CAAC;SAAM,IAAI,SAAS,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACnC,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IAED,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,UAA8B,CAAC;IACnC,IAAI,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC1E,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7E,MAAM,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC;QAC1B,UAAU,GAAG,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;QAC/C,KAAK,CAAC,IAAI,CACR,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,6BAA6B,EAAE,EAAE,MAAM,EAAE,UAAU,IAAI,EAAE,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAChI,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,mFAAmF;IACnF,MAAM,EAAE,GAAG,OAAO;QAChB,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YACjB,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC;YACpD,CAAC,CAAC,IAAI,CAAC;IAEX,OAAO;QACL,SAAS;QACT,SAAS;QACT,KAAK;QACL,MAAM;QACN,MAAM;QACN,UAAU;QACV,KAAK;QACL,EAAE;QACF,OAAO,EAAE,OAAO,IAAI,SAAS;QAC7B,eAAe,EAAE,OAAO,IAAI,SAAS;KAAE,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAAE,QAAgB,EAAE,OAAe;IACtF,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC7C,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACjC,IAAI,IAAI,GAAG,OAAO,CAAC;IACnB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;IACtD,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC7F,IAAI,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;IACD,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAClC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,OAAO,WAAW,CAAC,GAAG,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;SAClC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7B,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;IACtE,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"nginx-sync.js","sourceRoot":"","sources":["../../src/hosting/nginx-sync.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACpH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAC,MAAM,mBAAmB,CAAC;AAE5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AAgBxE;;GAEG;AACH,6DAA6D;AAC7D,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,OAAO,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,IAAY;IACrD,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,4BAA4B,CAAC,IAI5C;IACC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7F,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,CAAC,GAA8B,EAAE,EAAE;QAC/C,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO;QACrC,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC;gBAAE,SAAS;YACzC,MAAM,IAAI,GAAG,0BAA0B,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACzD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC1B,IAAI,CAAC;gBACH,UAAU,CAAC,IAAI,CAAC,CAAC;gBACjB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,oBAAoB;YACtB,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvB,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC;IACnC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAG,kBAAkB,CAAC;AAI7D,+EAA+E;AAC/E,MAAM,UAAU,yBAAyB,CAAC,IAIzC;IACC,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,IAAI,QAAQ,CAAC;IAC1C,MAAM,IAAI,GAAG;;;;;EAKb,CAAC;IACD,IAAI,OAAO,KAAK,YAAY,IAAI,IAAI,EAAE,cAAc,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/E,OAAO;EACT,IAAI;;;;;oBAKc,IAAI,CAAC,cAAc;wBACf,IAAI,CAAC,iBAAiB;;;CAG7C,CAAC;IACA,CAAC;IACD,OAAO;EACP,IAAI;;;;;;;CAOL,CAAC;AACF,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,UAAkB,EAClB,IAIC;IAED,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,0BAA0B,CAAC,CAAC;IAC1D,aAAa,CAAC,IAAI,EAAE,yBAAyB,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IAC7D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,OAAO,IAAI,CAAC,OAAO,CACjB,sDAAsD,EACtD,CAAC,CAAC,EAAE,GAAW,EAAE,IAAa,EAAE,EAAE,CAAC,GAAG,GAAG,GAAG,IAAI,IAAI,EAAE,GAAG,CAC1D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,IAAY;IACrD,OAAO,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,6BAA6B,CAC3C,SAAiB,EACjB,gBAA0B;IAE1B,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,GAAG,CAClB,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CACrE,CAAC;IACF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,0BAA0B,CAAC,CAAC,CAAC;YAAE,SAAS;QAC7C,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,CAAC,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,WAAW;QACb,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,UAAkB;IACxD,OAAO,gBAAgB,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,UAAkB,EAClB,YAA4B;IAE5B,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,CAAC;IACxD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;QACxC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACrE,IAAI,CAAC,KAAK,YAAY;YAAE,SAAS;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QACjC,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,CAAC,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,WAAW;QACb,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,uBAAuB,GAAG,OAAO,0BAA0B,EAAE,CAAC;AAEpE,SAAS,yBAAyB,CAAC,GAAW,EAAE,KAAe;IAC7D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO;IAC7B,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACnC,IAAI,CAAC,KAAK,0BAA0B,IAAI,CAAC,KAAK,uBAAuB;YAAE,SAAS;QAChF,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACxC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC/C,MAAM,IAAI,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;gBAClC,KAAK,CAAC,IAAI,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,WAAW;QACb,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,IAAkB,EAClB,KAAe;IAEf,MAAM,OAAO,GAAG;QACd,kCAAkC;QAClC,sCAAsC;KACvC,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,SAAS;QAClC,IAAI,CAAC;YACH,UAAU,CAAC,CAAC,CAAC,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,8BAA8B,CAAC,EAAE,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YACvE,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,8BAA8B,CAAC,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,IAAkB,EAClB,OAAe;IAEf,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IACrC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IAC9D,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,UAAU,CAC7B;QACE,SAAS;QACT,KAAK;QACL,OAAO;QACP,SAAS;QACT,UAAU;QACV,SAAS;QACT,GAAG;QACH,MAAM;QACN,IAAI;QACJ,OAAO;QACP,MAAM;QACN,QAAQ;QACR,OAAO;QACP,OAAO;KACR,EACD,EAAE,SAAS,EAAE,MAAM,EAAE,CACtB,CAAC;IACF,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3E,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACvB,CAAC;AAED,SAAS,+BAA+B,CAAC,OAAe;IACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,wBAAwB,CAAC,CAAC;IAClE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAA4B,CAAC;QACnF,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAChD,OAAO,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAUtC;IACC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACxD,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,MAAM,GACV,IAAI,CAAC,mBAAmB,IAAI,+BAA+B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5E,KAAK,MAAM,CAAC,IAAI,+BAA+B,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;YACnE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,2BAA2B,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IACD,yBAAyB,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,4BAA4B,CAAC;YAC3C,UAAU,EAAE,SAAS;YACrB,SAAS,EAAE,IAAI,CAAC,aAAa;YAC7B,cAAc,EAAE,IAAI,CAAC,cAAc;SACpC,CAAC,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,2BAA2B,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IACD,gEAAgE;IAChE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,kBAAkB,CAAC,CAAC;IACpE,aAAa,CACX,WAAW,EACX,wEAAwE,SAAS,YAAY,EAC7F,MAAM,CACP,CAAC;IAEF,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC;QACjC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC3D,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC;QACpC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1D,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,KAAK,GAAa;QACtB,EAAE,CAAC,wBAAwB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACjD,EAAE,CAAC,yBAAyB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAClD,GAAG,UAAU;KACd,CAAC;IACF,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC;IAE7C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO;YACL,SAAS;YACT,SAAS;YACT,KAAK;YACL,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC;YACzC,EAAE,EAAE,IAAI;SAAE,CAAC;IACf,CAAC;IAED,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QAC5C,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;YAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YACzC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;QACD,sDAAsD;QACtD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;YAC/B,uEAAuE;YACvE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACpE,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;QACD,IAAI,CAAC;YACH,KAAK,MAAM,CAAC,IAAI,6BAA6B,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC;gBAChE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,2BAA2B,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,yBAAyB,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAClD,yBAAyB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC5C,IAAI,UAAU,CAAC,0BAA0B,CAAC,EAAE,CAAC;YAC3C,yBAAyB,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;QAC/D,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9D,CAAC;SAAM,IAAI,SAAS,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACnC,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IAED,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,UAA8B,CAAC;IACnC,IAAI,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC1E,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7E,MAAM,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC;QAC1B,UAAU,GAAG,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;QAC/C,IACE,CAAC,MAAM;YACP,yCAAyC,CAAC,IAAI,CAAC,UAAU,CAAC;YAC1D,SAAS;YACT,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAC1B,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YACnE,IAAI,GAAG,EAAE,CAAC;gBACR,yBAAyB,CAAC,SAAS,EAAE;oBACnC,OAAO,EAAE,YAAY;oBACrB,cAAc,EAAE,GAAG,CAAC,IAAI;oBACxB,iBAAiB,EAAE,GAAG,CAAC,GAAG;iBAC3B,CAAC,CAAC;gBACH,IAAI,CAAC;oBACH,YAAY,CACV,IAAI,CAAC,SAAS,EAAE,0BAA0B,CAAC,EAC3C,IAAI,CAAC,SAAS,EAAE,uBAAuB,CAAC,CACzC,CAAC;gBACJ,CAAC;gBAAC,MAAM,CAAC;oBACP,KAAK;gBACP,CAAC;gBACD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC9E,MAAM,GAAG,EAAE,CAAC,QAAQ,KAAK,CAAC,CAAC;gBAC3B,UAAU,GAAG,GAAG,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;gBACjD,KAAK,CAAC,IAAI,CAAC,wFAAwF,CAAC,CAAC;YACvG,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CACR,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,6BAA6B,EAAE,EAAE,MAAM,EAAE,UAAU,IAAI,EAAE,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAChI,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,mFAAmF;IACnF,MAAM,EAAE,GAAG,OAAO;QAChB,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YACjB,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC;YACpD,CAAC,CAAC,IAAI,CAAC;IAEX,OAAO;QACL,SAAS;QACT,SAAS;QACT,KAAK;QACL,MAAM;QACN,MAAM;QACN,UAAU;QACV,KAAK;QACL,EAAE;QACF,OAAO,EAAE,OAAO,IAAI,SAAS;QAC7B,eAAe,EAAE,OAAO,IAAI,SAAS;KAAE,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAAE,QAAgB,EAAE,OAAe;IACtF,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC7C,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACjC,IAAI,IAAI,GAAG,OAAO,CAAC;IACnB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;IACtD,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC7F,IAAI,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;IACD,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAClC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,OAAO,WAAW,CAAC,GAAG,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;SAClC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7B,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;IACtE,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/hosting/ops-log.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Live log hook for long host jobs (SSE / OpsStream).
+ */
+export type OpsLogEvent = {
+    stream: 'stdout' | 'stderr' | 'status';
+    line: string;
+};
+export type OpsLogFn = (ev: OpsLogEvent) => void;
+export declare function runOpts(input: {
+    execute?: boolean;
+    timeoutMs?: number;
+    onLog?: OpsLogFn;
+    signal?: AbortSignal;
+}): {
+    timeoutMs?: number;
+    dryRun?: boolean;
+    signal?: AbortSignal;
+    onChunk?: (c: {
+        stream: 'stdout' | 'stderr';
+        text: string;
+    }) => void;
+};
+//# sourceMappingURL=ops-log.d.ts.map

package/dist/hosting/ops-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ops-log.d.ts","sourceRoot":"","sources":["../../src/hosting/ops-log.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG;IAAE,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AACnF,MAAM,MAAM,QAAQ,GAAG,CAAC,EAAE,EAAE,WAAW,KAAK,IAAI,CAAC;AAEjD,wBAAgB,OAAO,CAAC,KAAK,EAAE;IAC7B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,QAAQ,CAAC;IACjB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,GAAG;IACF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE;QAAE,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CACtE,CAYA"}

package/dist/hosting/ops-log.js

@@ -0,0 +1,15 @@
+export function runOpts(input) {
+    return {
+        timeoutMs: input.timeoutMs,
+        dryRun: input.execute === false,
+        signal: input.signal,
+        onChunk: input.onLog
+            ? (c) => {
+                const line = c.text.replace(/\r/g, '').trimEnd();
+                if (line)
+                    input.onLog({ stream: c.stream, line });
+            }
+            : undefined,
+    };
+}
+//# sourceMappingURL=ops-log.js.map

package/dist/hosting/ops-log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ops-log.js","sourceRoot":"","sources":["../../src/hosting/ops-log.ts"],"names":[],"mappings":"AAMA,MAAM,UAAU,OAAO,CAAC,KAKvB;IAMC,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,OAAO,KAAK,KAAK;QAC/B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,KAAK;YAClB,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE;gBACJ,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;gBACjD,IAAI,IAAI;oBAAE,KAAK,CAAC,KAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACrD,CAAC;YACH,CAAC,CAAC,SAAS;KACd,CAAC;AACJ,CAAC"}

package/dist/hosting/panel-tls.d.ts

@@ -91,10 +91,19 @@ export declare function loadPanelTlsOptions(config?: YskConfig | null): {
     cert: Buffer;
     key: Buffer;
 } | null;
+/** Parse `ss -lnt` / `ss -lntp` lines for a TCP listen port. */
+export declare function parseSsListenHosts(ssOut: string, port: number): string[];
+export declare function isWildcardListenHost(host: string | undefined): boolean;
+export declare function isBootstrapPanelCert(certPath?: string | null): boolean;
+export declare function probeListenHosts(host: HostExecutor, port: number): Promise<string[]>;
 export declare function getPanelTlsStatus(input: {
     config?: YskConfig | null;
     /** True when this process bound with HTTPS */
     servingHttps?: boolean;
+    /** Host header of the current request (panel UI) — never invent 127.0.0.1 */
+    requestHost?: string;
+    /** Actual listen addresses from `ss` when known */
+    listenHostsActual?: string[];
 }): PanelTlsStatus;
 /**
  * Enable panel HTTPS: resolve cert for domain (existing LE/managed), write config.

package/dist/hosting/panel-tls.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"panel-tls.d.ts","sourceRoot":"","sources":["../../src/hosting/panel-tls.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAWH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAUlD,0EAA0E;AAC1E,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;CACb,CAOA;AAED,8DAA8D;AAC9D,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAyBtD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;CAChB,GAAG,MAAM,CAgBT;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wBAAwB;IACxB,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,8BAA8B;IAC9B,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8CAA8C;IAC9C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,uBAAuB,CAsJ1B;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,uBAAuB;IACvB,UAAU,EAAE,OAAO,CAAC;IACpB,6CAA6C;IAC7C,YAAY,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,6BAA6B;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,eAAe,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,cAAc,CAAC;IACvB,0EAA0E;IAC1E,eAAe,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAWF,wBAAgB,wBAAwB,CAAC,MAAM,CAAC,EAAE,SAAS,GAAG,IAAI,GAAG;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAUA;AAED,2EAA2E;AAC3E,wBAAgB,mBAAmB,CAAC,MAAM,CAAC,EAAE,SAAS,GAAG,IAAI,GAAG;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;CACb,GAAG,IAAI,CAYP;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,MAAM,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;IAC1B,8CAA8C;IAC9C,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,GAAG,cAAc,CAmCjB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GAAG,cAAc,CAgEjB;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,cAAc,CAkB7E;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,YAAY,CAAC;CACpB,GAAG,OAAO,CAAC;IACV,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC,CAyDD;AAED;;GAEG;AACH,wBAAsB,sBAAsB,CAAC,KAAK,EAAE;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,WAAW,CAAC;IAChB,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,cAAc,CAAC,CA0E1B;AAED,yEAAyE;AACzE,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC;IACxE,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,CAAC,CAsBD;AAED,6CAA6C;AAC7C,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE1D"}
+{"version":3,"file":"panel-tls.d.ts","sourceRoot":"","sources":["../../src/hosting/panel-tls.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAWH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAUlD,0EAA0E;AAC1E,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;CACb,CAOA;AAED,8DAA8D;AAC9D,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAyBtD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;CAChB,GAAG,MAAM,CAgBT;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wBAAwB;IACxB,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,8BAA8B;IAC9B,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8CAA8C;IAC9C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,uBAAuB,CAsJ1B;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,uBAAuB;IACvB,UAAU,EAAE,OAAO,CAAC;IACpB,6CAA6C;IAC7C,YAAY,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,6BAA6B;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,eAAe,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,cAAc,CAAC;IACvB,0EAA0E;IAC1E,eAAe,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAWF,wBAAgB,wBAAwB,CAAC,MAAM,CAAC,EAAE,SAAS,GAAG,IAAI,GAAG;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAUA;AAED,2EAA2E;AAC3E,wBAAgB,mBAAmB,CAAC,MAAM,CAAC,EAAE,SAAS,GAAG,IAAI,GAAG;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;CACb,GAAG,IAAI,CAYP;AAED,gEAAgE;AAChE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAgBxE;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAGtE;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAEtE;AAED,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,EAAE,CAAC,CAInB;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,MAAM,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;IAC1B,8CAA8C;IAC9C,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B,GAAG,cAAc,CAoDjB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GAAG,cAAc,CAgEjB;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,cAAc,CAkB7E;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,YAAY,CAAC;CACpB,GAAG,OAAO,CAAC;IACV,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC,CAyDD;AAED;;GAEG;AACH,wBAAsB,sBAAsB,CAAC,KAAK,EAAE;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,WAAW,CAAC;IAChB,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,cAAc,CAAC,CA0E1B;AAED,yEAAyE;AACzE,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC;IACxE,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,CAAC,CAsBD;AAED,6CAA6C;AAC7C,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE1D"}

package/dist/hosting/panel-tls.js

@@ -247,10 +247,44 @@ export function loadPanelTlsOptions(config) {
         return null;
     }
 }
+/** Parse `ss -lnt` / `ss -lntp` lines for a TCP listen port. */
+export function parseSsListenHosts(ssOut, port) {
+    const hosts = [];
+    const seen = new Set();
+    const re = new RegExp(`(?:^|\\s)(\\*|0\\.0\\.0\\.0|::|\\[::\\]|\\d+\\.\\d+\\.\\d+\\.\\d+|\\[[0-9a-fA-F:]+\\]):${port}\\b`);
+    for (const line of String(ssOut || '').split('\n')) {
+        const m = line.match(re);
+        if (!m)
+            continue;
+        let h = m[1];
+        if (h === '*' || h === '[::]')
+            h = h === '*' ? '0.0.0.0' : '::';
+        if (seen.has(h))
+            continue;
+        seen.add(h);
+        hosts.push(h);
+    }
+    return hosts;
+}
+export function isWildcardListenHost(host) {
+    const h = String(host || '').trim();
+    return h === '0.0.0.0' || h === '::' || h === '*' || h === '[::]';
+}
+export function isBootstrapPanelCert(certPath) {
+    return /bootstrap-cert\.pem$/i.test(String(certPath || ''));
+}
+export async function probeListenHosts(host, port) {
+    const r = await host.runCommand(['ss', '-lnt'], { timeoutMs: 3_000 });
+    if (r.exitCode !== 0)
+        return [];
+    return parseSsListenHosts(r.stdout, port);
+}
 export function getPanelTlsStatus(input) {
     const config = input.config;
     const listenPort = config?.listenPort ?? 9287;
-    const listenHost = config?.listenHost ?? '127.0.0.1';
+    const configListen = config?.listenHost ?? '127.0.0.1';
+    const actual = (input.listenHostsActual ?? []).filter(Boolean);
+    const listenHost = actual[0] || configListen;
     const domain = config?.panelDomain?.trim() || undefined;
     const m = resolvePanelTlsMaterials(config);
     const tlsEnabled = Boolean(config?.tlsEnabled);
@@ -262,8 +296,22 @@ export function getPanelTlsStatus(input) {
     if (tlsEnabled && !servingHttps) {
         notes.push(tl('system.panelTls.restartToApply'));
     }
+    const publicBind = isWildcardListenHost(listenHost) || actual.some((h) => isWildcardListenHost(h));
+    if (publicBind) {
+        notes.push(tl('system.panelTls.listenPublic'));
+    }
+    if (isBootstrapPanelCert(m.certPath)) {
+        notes.push(tl('system.panelTls.bootstrapCert'));
+    }
+    const reqHost = String(input.requestHost || '')
+        .trim()
+        .replace(/:\d+$/, '');
     const hostLabel = domain ||
-        (listenHost === '0.0.0.0' || listenHost === '::' ? '127.0.0.1' : listenHost);
+        (reqHost && reqHost !== '127.0.0.1' && reqHost !== 'localhost' && reqHost !== '::1'
+            ? reqHost
+            : publicBind
+                ? listenHost
+                : listenHost);
     return {
         ok: !tlsEnabled || (m.certExists && m.keyExists),
         tlsEnabled,