{"record":{"id":"be7728139c62b4e6","repo":"paperclipai/paperclip","slug":"broker-protected-ports-contains-an-out-of-range-po","errorCode":null,"errorMessage":"BROKER_PROTECTED_PORTS contains an out-of-range port: ${token}","messagePattern":"BROKER_PROTECTED_PORTS contains an out-of-range port: (.+?)","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/tailscale-https-broker/src/port-policy.ts","lineNumber":40,"sourceCode":" * set of operator-protected ports (PAP-17285).\n *\n * Fails closed: a malformed list throws so the broker refuses to start rather\n * than silently protecting nothing. Protecting a port the broker cannot mutate\n * anyway is harmless, so no range restriction is applied — but `443` is rejected\n * because the primary route has its own stronger, non-optional invariant and\n * listing it here would imply it were opt-in.\n */\nexport function parseProtectedPorts(raw: string | undefined): number[] {\n  if (raw === undefined) return [];\n  const tokens = raw.split(/[,\\s]+/).filter((token) => token.length > 0);\n  const ports = new Set<number>();\n  for (const token of tokens) {\n    if (!/^[0-9]{1,5}$/.test(token)) {\n      throw new Error(`BROKER_PROTECTED_PORTS contains a non-numeric entry: ${JSON.stringify(token)}`);\n    }\n    const port = Number(token);\n    if (port < 1 || port > 65535) {\n      throw new Error(`BROKER_PROTECTED_PORTS contains an out-of-range port: ${token}`);\n    }\n    if (port === 443) {\n      throw new Error(\"BROKER_PROTECTED_PORTS must not list 443; the primary route is always protected\");\n    }\n    ports.add(port);\n  }\n  return [...ports].sort((a, b) => a - b);\n}\n","sourceCodeStart":22,"sourceCodeEnd":49,"githubUrl":"https://github.com/paperclipai/paperclip/blob/120ae5428fa29bee300bcf806491cd4d965fbb7c/packages/tailscale-https-broker/src/port-policy.ts#L22-L49","documentation":"parseProtectedPorts guard: a token parses numerically but the resulting port falls outside the valid TCP range. Because the broker would then be protecting a port that can't exist, startup aborts to surface the operator typo.","triggerScenarios":"Thrown at packages/tailscale-https-broker/src/port-policy.ts:40 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Change the listed entry in BROKER_PROTECTED_PORTS to a valid port number within 1-65535."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"120ae5428fa29bee300bcf806491cd4d965fbb7c","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}