@davidrydberg/proofy 0.0.0-stage → 0.1.0

package/dist/sandbox/sandbox.js

@@ -0,0 +1,239 @@
+import { createHash } from "node:crypto";
+import { mkdir, readdir, readFile, rename, rm, symlink, writeFile } from "node:fs/promises";
+import { createRequire } from "node:module";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { stringify } from "yaml";
+import { CliError } from "../errors.js";
+import { MOUNT, RUNNER } from "./contract.js";
+import { sandboxCompose, subnetFor } from "./compose.js";
+import { tail } from "./docker.js";
+export const PKG_DIR = fileURLToPath(new URL("../../", import.meta.url));
+export function cacheDirFor(env, root) {
+    const base = env.XDG_CACHE_HOME || join(homedir(), ".cache");
+    return join(base, "proofy", createHash("sha256").update(root).digest("hex").slice(0, 12));
+}
+export function playwrightVersion() {
+    const require = createRequire(import.meta.url);
+    return require("@playwright/test/package.json").version;
+}
+export function runnerImage() {
+    return `mcr.microsoft.com/playwright:v${playwrightVersion()}-noble`;
+}
+export function standinImage() {
+    const pkg = createRequire(import.meta.url)(join(PKG_DIR, "package.json"));
+    return `proofy-standin:${pkg.version}`;
+}
+/** Install phase, with internet: images and builds. Nothing of the app runs yet. */
+export async function installImages(proc, options, sandbox) {
+    const { log } = options;
+    const standin = standinImage();
+    if ((await proc("docker", ["image", "inspect", standin])).code !== 0) {
+        log(`building ${standin}`);
+        await must(proc("docker", ["build", "-q", "-t", standin, "-f", join(PKG_DIR, "docker", "standin.Dockerfile"), join(PKG_DIR, "docker")]), "Building the fake-service image failed");
+    }
+    const runner = runnerImage();
+    if ((await proc("docker", ["image", "inspect", runner])).code !== 0) {
+        log(`pulling ${runner} (once, about 1.5 GB)`);
+        await must(proc("docker", ["pull", "-q", runner]), `Pulling ${runner} failed`);
+    }
+    log("building and pulling the app's images");
+    await must(proc("docker", [...compose(sandbox), "build", "--quiet"]), "Building the app's images failed");
+    await must(proc("docker", [...compose(sandbox), "pull", "--ignore-buildable", "--policy", "missing", "--quiet"]), "Pulling the app's images failed");
+    await mkdir(options.cacheDir, { recursive: true });
+    const ca = join(options.cacheDir, "ca");
+    await mkdir(ca, { recursive: true });
+    await must(proc("docker", ["run", "--rm", "--user", hostUser(), "-v", `${ca}:${MOUNT.ca}`, "-v", `${PKG_DIR}:${MOUNT.pkg}:ro`, standin, "node", `${MOUNT.pkg}/dist/standin/server.js`, "ca"]), "Creating the sandbox certificate authority failed");
+    await downloadAssets(options, sandbox);
+}
+/** Writes the sealed compose file and everything the containers mount. */
+export async function prepare(proc, options, attempt = 0) {
+    const { config, sourceDir } = options;
+    if (config.compose.length === 0) {
+        throw new CliError("e2e/proofy.json lists no compose file", "CONFIG_INVALID", ['Ask your agent: "set up proofy" (Setup in e2e/AGENTS.md)']);
+    }
+    if (!config.app) {
+        throw new CliError("e2e/proofy.json has no app: the browser does not know where to start", "CONFIG_INVALID", ['Ask your agent: "set up proofy"']);
+    }
+    const workDir = join(options.cacheDir, "sandboxes", options.project);
+    await rm(workDir, { recursive: true, force: true });
+    const dirs = {
+        pkg: PKG_DIR.replace(/\/$/, ""),
+        ca: join(options.cacheDir, "ca"),
+        runSetup: join(workDir, "setup"),
+        out: join(workDir, "out"),
+        e2e: options.e2eDir,
+        work: join(workDir, "runner"),
+        nodeModules: join(workDir, "node_modules"),
+    };
+    for (const dir of [dirs.ca, dirs.runSetup, dirs.out, join(dirs.work, "exec"), join(dirs.nodeModules, "@davidrydberg"), join(dirs.nodeModules, "@playwright")]) {
+        await mkdir(dir, { recursive: true });
+    }
+    // Test files import "@davidrydberg/proofy/test"; Node finds it through /node_modules in the runner container.
+    await symlink(MOUNT.pkg, join(dirs.nodeModules, "@davidrydberg", "proofy"));
+    await symlink(`${MOUNT.pkg}/node_modules/@playwright/test`, join(dirs.nodeModules, "@playwright", "test"));
+    // An empty env file keeps compose from reading the repository's .env for interpolation. Relative paths in the
+    // compose files resolve against the first file's folder, as they do when the app is started by hand.
+    const emptyEnv = join(workDir, "empty.env");
+    await writeFile(emptyEnv, "");
+    const args = ["compose", ...config.compose.flatMap((file) => ["-f", join(sourceDir, file)]), "--env-file", emptyEnv];
+    const normalized = await proc("docker", [...args, "config", "--format", "json", "--no-env-resolution"]);
+    if (normalized.code !== 0) {
+        throw new CliError(`docker compose could not read ${config.compose.join(", ")}`, "CONFIG_INVALID", [tail(normalized.stderr, 8)]);
+    }
+    const model = JSON.parse(normalized.stdout);
+    const { subnet, standinIp } = subnetFor(options.project, attempt);
+    const generated = sandboxCompose({ model, config, mode: options.mode, subnet, standinIp, standinImage: standinImage(), runnerImage: runnerImage(), user: hostUser(), dirs });
+    const composeFile = join(workDir, "compose.yml");
+    await writeFile(composeFile, stringify(generated.compose));
+    const assets = Object.fromEntries(config.assets.map((url) => [assetKey(url), assetFile(url)]));
+    await writeFile(join(dirs.runSetup, "standin.json"), JSON.stringify({ hosts: config.hosts, assets, address: standinIp, standinsDir: `${MOUNT.e2e}/standins`, assetsDir: `${MOUNT.runSetup}/assets` }));
+    return { project: options.project, composeFile, workDir, notes: generated.notes };
+}
+/** Sealed phase: starts the app with no way out, waits for it, seeds the empty database. */
+export async function start(proc, options, sandbox) {
+    const { config, log } = options;
+    await mkdir(options.logDir, { recursive: true });
+    let current = sandbox;
+    for (let attempt = 0;; attempt++) {
+        log("starting the sealed sandbox");
+        const up = await proc("docker", [...compose(current), "up", "-d", "--wait", "--wait-timeout", String(Math.round(config.limits.startMinutes * 60))], {
+            timeoutMs: config.limits.startMinutes * 60_000 + 30_000,
+        });
+        if (up.code === 0)
+            break;
+        if (/overlap/i.test(up.stderr) && attempt < 5) {
+            await stop(proc, current);
+            current = await prepare(proc, options, attempt + 1);
+            continue;
+        }
+        throw new CliError(up.timedOut ? "The sandbox did not start in time" : "The sandbox did not start", "ENVIRONMENT_ERROR", [
+            tail(up.stderr || up.stdout, 12),
+            `Container logs: ${join(options.logDir, "sandbox.log")}`,
+        ]);
+    }
+    if (config.seed) {
+        log(`seeding: ${config.seed.command.join(" ")}`);
+        const seed = await proc("docker", [...compose(current), "exec", "-T", config.seed.service, ...config.seed.command], { timeoutMs: config.limits.startMinutes * 60_000 });
+        await writeFile(join(options.logDir, "seed.log"), `${seed.stdout}\n${seed.stderr}`);
+        if (seed.code !== 0) {
+            throw new CliError(`The seed command failed with exit code ${seed.code}`, "ENVIRONMENT_ERROR", [tail(seed.stderr || seed.stdout, 12), `Full output: ${join(options.logDir, "seed.log")}`]);
+        }
+    }
+    return current;
+}
+/** Runs Playwright in the runner container, answering exec() requests from the tests meanwhile. */
+export async function runTests(proc, options, sandbox, playwrightArgs) {
+    const bridge = startExecBridge(proc, options, sandbox);
+    try {
+        const limit = options.config.limits.maxRunMinutes;
+        const result = await proc("docker", [...compose(sandbox), "run", "--rm", "-T", RUNNER, "node", `${MOUNT.pkg}/node_modules/@playwright/test/cli.js`, "test", "-c", `${MOUNT.work}/playwright.config.mjs`, ...playwrightArgs], limit === undefined ? {} : { timeoutMs: limit * 60_000 });
+        await writeFile(join(sandbox.workDir, "out", "playwright.log"), `${result.stdout}\n${result.stderr}`);
+        if (result.timedOut) {
+            throw new CliError(`The run took longer than maxRunMinutes (${limit})`, "ENVIRONMENT_ERROR", ["Raise limits.maxRunMinutes in e2e/proofy.json or run fewer flows"]);
+        }
+        return result.code;
+    }
+    finally {
+        await bridge.stop();
+    }
+}
+export async function saveLogs(proc, sandbox, dir) {
+    const logs = await proc("docker", [...compose(sandbox), "logs", "--no-color", "--timestamps"]);
+    await mkdir(dir, { recursive: true });
+    await writeFile(join(dir, "sandbox.log"), logs.stdout + logs.stderr);
+}
+export async function stop(proc, sandbox) {
+    await proc("docker", [...compose(sandbox), "down", "-v", "--remove-orphans", "--timeout", "5"], { timeoutMs: 120_000 });
+}
+export async function forwardedPorts(proc, sandbox) {
+    const port = async (inner) => {
+        const result = await proc("docker", [...compose(sandbox), "port", "proofy-forward", inner]);
+        const match = /:(\d+)\s*$/.exec(result.stdout.trim());
+        return match ? `http://127.0.0.1:${match[1]}` : undefined;
+    };
+    const app = await port("8080");
+    const mail = await port("8025");
+    return { ...(app ? { app } : {}), ...(mail ? { mail } : {}) };
+}
+export function hostUser() {
+    return `${process.getuid?.() ?? 0}:${process.getgid?.() ?? 0}`;
+}
+export function compose(sandbox) {
+    return ["compose", "-p", sandbox.project, "-f", sandbox.composeFile];
+}
+// Tests ask for exec() by writing a request file to a folder shared with the host, which runs the named command
+// with docker compose exec. The runner container never gets access to Docker itself.
+function startExecBridge(proc, options, sandbox) {
+    const dir = join(sandbox.workDir, "runner", "exec");
+    let running = true;
+    const busy = new Set();
+    const handle = async (file) => {
+        const id = file.slice(0, -".req.json".length);
+        const request = JSON.parse(await readFile(join(dir, file), "utf8"));
+        await rm(join(dir, file), { force: true });
+        const named = options.config.exec[request.name];
+        let response;
+        if (!named) {
+            response = { error: `exec("${request.name}") is not in e2e/proofy.json exec. Named commands: ${Object.keys(options.config.exec).join(", ") || "none"}` };
+        }
+        else {
+            const result = await proc("docker", [...compose(sandbox), "exec", "-T", named.service, ...named.command, ...request.args], {
+                timeoutMs: options.config.limits.testMinutes * 60_000,
+            });
+            response = { code: result.code, stdout: result.stdout, stderr: result.stderr };
+        }
+        await writeFile(join(dir, `${id}.tmp`), JSON.stringify(response));
+        await rename(join(dir, `${id}.tmp`), join(dir, `${id}.res.json`));
+    };
+    const loop = (async () => {
+        while (running) {
+            let files = [];
+            try {
+                files = await readdir(dir);
+            }
+            catch {
+                // The folder appears with the first request.
+            }
+            for (const file of files) {
+                if (!file.endsWith(".req.json") || busy.has(file))
+                    continue;
+                busy.add(file);
+                void handle(file).finally(() => busy.delete(file));
+            }
+            await new Promise((resolve) => setTimeout(resolve, 100));
+        }
+    })();
+    return {
+        stop: async () => {
+            running = false;
+            await loop;
+        },
+    };
+}
+async function downloadAssets(options, sandbox) {
+    if (options.config.assets.length === 0)
+        return;
+    const dir = join(sandbox.workDir, "setup", "assets");
+    await mkdir(dir, { recursive: true });
+    for (const url of options.config.assets) {
+        options.log(`downloading ${url}`);
+        const response = await fetch(url);
+        if (!response.ok)
+            throw new CliError(`Downloading asset ${url} failed with HTTP ${response.status}`, "ENVIRONMENT_ERROR", ["Check the URL in e2e/proofy.json assets"]);
+        await writeFile(join(dir, assetFile(url)), Buffer.from(await response.arrayBuffer()));
+    }
+}
+function assetKey(url) {
+    const parsed = new URL(url);
+    return `${parsed.hostname}${parsed.pathname}`;
+}
+function assetFile(url) {
+    return createHash("sha256").update(assetKey(url)).digest("hex").slice(0, 24);
+}
+async function must(result, message) {
+    const done = await result;
+    if (done.code !== 0)
+        throw new CliError(message, "ENVIRONMENT_ERROR", [tail(done.stderr || done.stdout, 12)]);
+}

package/dist/standin/ca.d.ts

@@ -0,0 +1,6 @@
+export declare function ensureCa(dir: string): void;
+/** A certificate for one hostname, signed by the sandbox authority and cached on disk. */
+export declare function leafFor(dir: string, host: string): {
+    key: Buffer;
+    cert: Buffer;
+};

package/dist/standin/ca.js

@@ -0,0 +1,40 @@
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+// Runs inside the fake-service container, which has openssl. The certificate authority lives in the project's
+// cache folder, so apps that copy it into their trust store at start keep trusting it across runs.
+const SYSTEM_BUNDLE = "/etc/ssl/certs/ca-certificates.crt";
+export function ensureCa(dir) {
+    mkdirSync(join(dir, "leaf"), { recursive: true });
+    if (!existsSync(join(dir, "ca.crt"))) {
+        openssl([
+            "req", "-x509", "-newkey", "ec", "-pkeyopt", "ec_paramgen_curve:P-256", "-nodes",
+            "-keyout", join(dir, "ca.key"), "-out", join(dir, "ca.crt"), "-days", "3650",
+            "-subj", "/CN=proofy sandbox CA",
+            "-addext", "basicConstraints=critical,CA:TRUE", "-addext", "keyUsage=critical,keyCertSign,cRLSign",
+        ]);
+    }
+    if (!existsSync(join(dir, "leaf.key"))) {
+        openssl(["genpkey", "-algorithm", "EC", "-pkeyopt", "ec_paramgen_curve:P-256", "-out", join(dir, "leaf.key")]);
+    }
+    // For clients that take one bundle file instead of adding to the system store, such as Python's requests.
+    const system = existsSync(SYSTEM_BUNDLE) ? readFileSync(SYSTEM_BUNDLE, "utf8") : "";
+    writeFileSync(join(dir, "ca-bundle.crt"), `${system}\n${readFileSync(join(dir, "ca.crt"), "utf8")}`);
+}
+/** A certificate for one hostname, signed by the sandbox authority and cached on disk. */
+export function leafFor(dir, host) {
+    const safe = host.replace(/[^a-z0-9.-]/gi, "_");
+    const file = join(dir, "leaf", `${safe}.crt`);
+    if (!existsSync(file)) {
+        openssl([
+            "req", "-x509", "-new", "-key", join(dir, "leaf.key"), "-subj", `/CN=${safe}`,
+            "-addext", `subjectAltName=DNS:${safe}`, "-addext", "basicConstraints=critical,CA:FALSE",
+            "-addext", "extendedKeyUsage=serverAuth",
+            "-CA", join(dir, "ca.crt"), "-CAkey", join(dir, "ca.key"), "-days", "365", "-out", file,
+        ]);
+    }
+    return { key: readFileSync(join(dir, "leaf.key")), cert: readFileSync(file) };
+}
+function openssl(args) {
+    execFileSync("openssl", args, { stdio: ["ignore", "ignore", "pipe"] });
+}

package/dist/standin/dns.d.ts

@@ -0,0 +1,10 @@
+export interface Question {
+    id: number;
+    name: string;
+    type: number;
+    end: number;
+}
+export declare function parseQuery(msg: Buffer): Question | undefined;
+/** Answers A queries with the given address and everything else with an empty, successful answer. */
+export declare function answer(msg: Buffer, question: Question, address: string): Buffer;
+export declare function startDns(address: string, onQuery: (name: string) => void, port?: number): void;

package/dist/standin/dns.js

@@ -0,0 +1,53 @@
+import { createSocket } from "node:dgram";
+// A catch-all DNS server. Docker's embedded DNS answers compose service names itself and forwards every other
+// name here, so every outside hostname resolves to the fake-service container and no call can slip past it.
+const TYPE_A = 1;
+export function parseQuery(msg) {
+    if (msg.length < 17)
+        return undefined;
+    const labels = [];
+    let i = 12;
+    while (i < msg.length && msg[i] !== 0) {
+        const length = msg[i] ?? 0;
+        if (length > 63 || i + 1 + length > msg.length)
+            return undefined;
+        labels.push(msg.subarray(i + 1, i + 1 + length).toString("latin1"));
+        i += length + 1;
+    }
+    if (i + 5 > msg.length)
+        return undefined;
+    return { id: msg.readUInt16BE(0), name: labels.join(".").toLowerCase(), type: msg.readUInt16BE(i + 1), end: i + 5 };
+}
+/** Answers A queries with the given address and everything else with an empty, successful answer. */
+export function answer(msg, question, address) {
+    const header = Buffer.alloc(12);
+    header.writeUInt16BE(question.id, 0);
+    header.writeUInt16BE(0x8180, 2);
+    header.writeUInt16BE(1, 4);
+    const isA = question.type === TYPE_A;
+    header.writeUInt16BE(isA ? 1 : 0, 6);
+    const parts = [header, msg.subarray(12, question.end)];
+    if (isA) {
+        const record = Buffer.alloc(16);
+        record.writeUInt16BE(0xc00c, 0);
+        record.writeUInt16BE(TYPE_A, 2);
+        record.writeUInt16BE(1, 4);
+        record.writeUInt32BE(5, 6);
+        record.writeUInt16BE(4, 10);
+        address.split(".").forEach((octet, index) => record.writeUInt8(Number(octet), 12 + index));
+        parts.push(record);
+    }
+    return Buffer.concat(parts);
+}
+export function startDns(address, onQuery, port = 53) {
+    const socket = createSocket("udp4");
+    socket.on("message", (msg, remote) => {
+        const question = parseQuery(msg);
+        if (!question)
+            return;
+        if (question.type === TYPE_A)
+            onQuery(question.name);
+        socket.send(answer(msg, question, address), remote.port, remote.address);
+    });
+    socket.bind(port);
+}

package/dist/standin/forward.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/standin/forward.js

@@ -0,0 +1,17 @@
+import { connect, createServer } from "node:net";
+// Opens ports of the sealed sandbox to the host for `proofy dev up`. This container is the only one with a
+// second network; the app itself stays on the sealed one. Arguments: listenPort=host:port ...
+for (const pair of process.argv.slice(2)) {
+    const [listen = "", target = ""] = pair.split("=");
+    const [host = "", port = ""] = target.split(":");
+    createServer((client) => {
+        const upstream = connect(Number(port), host);
+        client.pipe(upstream).pipe(client);
+        const close = () => {
+            client.destroy();
+            upstream.destroy();
+        };
+        client.on("error", close);
+        upstream.on("error", close);
+    }).listen(Number(listen));
+}

package/dist/standin/handle.d.ts

@@ -0,0 +1,49 @@
+export type HostMode = "fake" | "record";
+export interface StandinRequest {
+    method: string;
+    path: string;
+    query: Record<string, string>;
+    headers: Record<string, string>;
+    body: string;
+    json: unknown;
+}
+export interface StandinResponse {
+    status: number;
+    json?: unknown;
+    body?: string | Buffer;
+    headers?: Record<string, string>;
+}
+export interface RecordedRequest {
+    seq: number;
+    at: string;
+    host: string;
+    method: string;
+    path: string;
+    query: Record<string, string>;
+    headers: Record<string, string>;
+    body: string;
+    handledAs: HostMode | "asset" | "refused" | "error";
+    status: number;
+    error?: string;
+}
+export interface StandinSetup {
+    hosts: Record<string, HostMode>;
+    /** "host/path" to a file downloaded during the install phase. */
+    assets: Record<string, string>;
+    standinsDir: string;
+    assetsDir: string;
+}
+export declare class Standin {
+    private readonly setup;
+    private readonly onRecord;
+    readonly requests: RecordedRequest[];
+    private readonly handlers;
+    private readonly states;
+    constructor(setup: StandinSetup, onRecord?: (request: RecordedRequest) => void);
+    handle(host: string, method: string, url: string, headers: Record<string, string>, body: Buffer): Promise<StandinResponse>;
+    /** Recorded requests for one host, or all of them. */
+    recordedFor(host: string | undefined): RecordedRequest[];
+    private handler;
+    private state;
+}
+export declare function refusal(host: string): StandinResponse;

package/dist/standin/handle.js

@@ -0,0 +1,130 @@
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+const SECRET_HEADER = /^(authorization|proxy-authorization|cookie|set-cookie|x-api-key|api-key|x-auth-token)$|secret|token|signature/i;
+const MAX_BODY = 64 * 1024;
+const CONTENT_TYPES = {
+    js: "text/javascript",
+    mjs: "text/javascript",
+    css: "text/css",
+    json: "application/json",
+    svg: "image/svg+xml",
+    png: "image/png",
+    jpg: "image/jpeg",
+    jpeg: "image/jpeg",
+    gif: "image/gif",
+    webp: "image/webp",
+    woff: "font/woff",
+    woff2: "font/woff2",
+    ttf: "font/ttf",
+};
+export class Standin {
+    setup;
+    onRecord;
+    requests = [];
+    handlers = new Map();
+    states = new Map();
+    constructor(setup, onRecord = () => { }) {
+        this.setup = setup;
+        this.onRecord = onRecord;
+    }
+    async handle(host, method, url, headers, body) {
+        const parsed = new URL(url, `http://${host}`);
+        const path = parsed.pathname;
+        const query = Object.fromEntries(parsed.searchParams);
+        const text = body.toString("utf8");
+        const record = {
+            seq: this.requests.length + 1,
+            at: new Date().toISOString(),
+            host,
+            method,
+            path,
+            query,
+            headers: redact(headers),
+            body: text.length > MAX_BODY ? `${text.slice(0, MAX_BODY)}... (${text.length} characters)` : text,
+        };
+        let response;
+        let handledAs;
+        let error;
+        const asset = this.setup.assets[`${host}${path}`];
+        const mode = this.setup.hosts[host];
+        try {
+            if (asset !== undefined) {
+                handledAs = "asset";
+                response = { status: 200, body: await readFile(join(this.setup.assetsDir, asset)), headers: { "content-type": contentType(path) } };
+            }
+            else if (mode === "record") {
+                handledAs = "record";
+                response = { status: 200, json: {} };
+            }
+            else if (mode === "fake") {
+                handledAs = "fake";
+                const handler = await this.handler(host);
+                response = await handler({ method, path, query, headers, body: text, json: parseJson(text) }, { state: this.state(host) });
+                if (!response || typeof response.status !== "number")
+                    throw new Error(`the fake for ${host} returned no status`);
+            }
+            else {
+                handledAs = "refused";
+                response = refusal(host);
+            }
+        }
+        catch (caught) {
+            handledAs = "error";
+            error = caught instanceof Error ? caught.message : String(caught);
+            response = { status: 500, json: { error: { code: "proofy_fake_error", message: error } } };
+        }
+        const done = { ...record, handledAs, status: response.status, ...(error ? { error } : {}) };
+        this.requests.push(done);
+        this.onRecord(done);
+        return response;
+    }
+    /** Recorded requests for one host, or all of them. */
+    recordedFor(host) {
+        return host ? this.requests.filter((request) => request.host === host) : this.requests;
+    }
+    handler(host) {
+        let handler = this.handlers.get(host);
+        if (!handler) {
+            const file = join(this.setup.standinsDir, `${host}.mjs`);
+            handler = import(pathToFileURL(file).href).then((module) => {
+                if (typeof module.default !== "function")
+                    throw new Error(`e2e/standins/${host}.mjs has no default export function`);
+                return module.default;
+            });
+            this.handlers.set(host, handler);
+        }
+        return handler;
+    }
+    state(host) {
+        let state = this.states.get(host);
+        if (!state) {
+            state = new Map();
+            this.states.set(host, state);
+        }
+        return state;
+    }
+}
+export function refusal(host) {
+    return {
+        status: 502,
+        json: { error: { code: "proofy_refused", message: `${host} is not allowed in the sealed sandbox. List it in e2e/proofy.json hosts as fake or record` } },
+    };
+}
+function redact(headers) {
+    return Object.fromEntries(Object.entries(headers).map(([key, value]) => [key, SECRET_HEADER.test(key) ? "(redacted)" : value]));
+}
+function parseJson(text) {
+    if (!text)
+        return undefined;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+}
+function contentType(path) {
+    const extension = path.slice(path.lastIndexOf(".") + 1).toLowerCase();
+    return CONTENT_TYPES[extension] ?? "application/octet-stream";
+}

package/dist/standin/server.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/standin/server.js

@@ -0,0 +1,88 @@
+import { appendFileSync, readFileSync } from "node:fs";
+import { createServer as createHttp } from "node:http";
+import { createServer as createHttps } from "node:https";
+import { createSecureContext } from "node:tls";
+import { ADMIN_PORT, MOUNT } from "../sandbox/contract.js";
+import { ensureCa, leafFor } from "./ca.js";
+import { startDns } from "./dns.js";
+import { Standin } from "./handle.js";
+// The fake-service container's entry point. Paths are the container's mounts, set up by the sandbox compose file.
+const SETUP_FILE = `${MOUNT.runSetup}/standin.json`;
+const CA_DIR = MOUNT.ca;
+const OUT = MOUNT.out;
+const command = process.argv[2];
+if (command === "ca") {
+    ensureCa(CA_DIR);
+}
+else {
+    serve();
+}
+function serve() {
+    const setup = JSON.parse(readFileSync(SETUP_FILE, "utf8"));
+    ensureCa(CA_DIR);
+    const standin = new Standin(setup, (request) => appendFileSync(`${OUT}/requests.jsonl`, `${JSON.stringify(request)}\n`));
+    const seen = new Set();
+    startDns(setup.address, (name) => {
+        if (seen.has(name))
+            return;
+        seen.add(name);
+        appendFileSync(`${OUT}/dns.jsonl`, `${JSON.stringify({ at: new Date().toISOString(), name })}\n`);
+    });
+    const listener = (secure) => async (req, res) => {
+        const host = (req.headers.host ?? "").replace(/:\d+$/, "").toLowerCase();
+        const body = await readBody(req);
+        const headers = Object.fromEntries(Object.entries(req.headers).map(([key, value]) => [key, Array.isArray(value) ? value.join(", ") : (value ?? "")]));
+        send(res, await standin.handle(host, req.method ?? "GET", req.url ?? "/", { ...headers, "x-proofy-scheme": secure ? "https" : "http" }, body));
+    };
+    createHttp(listener(false)).listen(80);
+    const contexts = new Map();
+    createHttps({
+        ...leafFor(CA_DIR, "localhost"),
+        SNICallback: (servername, done) => {
+            try {
+                let context = contexts.get(servername);
+                if (!context) {
+                    context = createSecureContext(leafFor(CA_DIR, servername));
+                    contexts.set(servername, context);
+                }
+                done(null, context);
+            }
+            catch (error) {
+                done(error);
+            }
+        },
+    }, listener(true)).listen(443);
+    createHttp((req, res) => {
+        const url = new URL(req.url ?? "/", "http://admin");
+        if (url.pathname === "/health") {
+            send(res, { status: 200, json: { ok: true } });
+        }
+        else if (url.pathname === "/requests") {
+            send(res, { status: 200, json: standin.recordedFor(url.searchParams.get("host") ?? undefined) });
+        }
+        else {
+            send(res, { status: 404, json: { error: "unknown admin path" } });
+        }
+    }).listen(ADMIN_PORT);
+}
+function readBody(req) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        req.on("data", (chunk) => chunks.push(chunk));
+        req.on("end", () => resolve(Buffer.concat(chunks)));
+        req.on("error", reject);
+    });
+}
+function send(res, response) {
+    const headers = { ...(response.headers ?? {}) };
+    let body = "";
+    if (response.json !== undefined) {
+        headers["content-type"] ??= "application/json";
+        body = JSON.stringify(response.json);
+    }
+    else if (response.body !== undefined) {
+        body = response.body;
+    }
+    res.writeHead(response.status, headers);
+    res.end(body);
+}

package/dist/style.d.ts

@@ -0,0 +1,23 @@
+export interface Style {
+    color: boolean;
+    width: number;
+}
+export interface Painter {
+    bold: (text: string) => string;
+    dim: (text: string) => string;
+    red: (text: string) => string;
+    green: (text: string) => string;
+    yellow: (text: string) => string;
+    cyan: (text: string) => string;
+}
+export declare const GLYPH: {
+    ok: string;
+    fail: string;
+    warn: string;
+    dot: string;
+};
+export declare function resolveStyle(env: NodeJS.ProcessEnv, isTTY: boolean, columns: number | undefined): Style;
+export declare function painter(style: Style): Painter;
+export declare function truncate(text: string, max: number): string;
+export declare function padVisible(text: string, width: number, align?: "left" | "right"): string;
+export declare function stripAnsi(text: string): string;