@specific.dev/spectest 0.94.0 → 0.95.0

package/src/harness/tls-terminator.ts

@@ -34,7 +34,8 @@
  *
  * The terminator does TLS and *nothing else*: it accepts on :443, picks a
  * leaf by SNI, and pipes the decrypted stream to a plaintext `Bun.serve`
- * bound on loopback. Everything downstream — routing, fakes,
+ * bound on loopback. Opted-in HTTP/2 routes select a separate stream router
+ * by ALPN; HTTP/1.1 and WebSockets retain the existing listener. Everything downstream — routing, fakes,
  * interceptors, reverse-proxying, and `server.upgrade()` WebSocket
  * bridging — is the same `Bun.serve` code that already serves :80, run
  * unchanged. Terminating HTTP here instead (`node:https`, `(req, res)`)
@@ -69,6 +70,9 @@ export interface TlsTerminatorOptions {
   hostname: string;
   /** Loopback port of the plaintext ingress server to pipe into. */
   upstreamPort: number;
+  /** Loopback HTTP/2 router, selected only for an opted-in SNI hostname. */
+  http2Port?: number;
+  supportsHttp2?(serverName: string): boolean;
   /**
    * The leaf to serve for an SNI server name, read live on every
    * handshake — this is what lets a certificate be added with no restart.
@@ -153,6 +157,9 @@ export function startTlsTerminator(opts: TlsTerminatorOptions): Promise<TlsTermi
   const server = tls.createServer(
     {
       ...(fallback ? { cert: fallback.cert, key: fallback.key } : {}),
+      ...(opts.http2Port ? { ALPNCallback: ({ servername, protocols }: { servername: string; protocols: string[] }) =>
+        protocols.includes("h2") && opts.supportsHttp2?.(servername) ? "h2"
+          : protocols.includes("http/1.1") ? "http/1.1" : undefined } : {}),
       SNICallback: (serverName, cb) => {
         const leaf = opts.certFor(serverName) ?? fallback;
         // No certificate at all is a handshake we cannot complete. Answer
@@ -175,7 +182,8 @@ export function startTlsTerminator(opts: TlsTerminatorOptions): Promise<TlsTermi
       // its bytes are buffered rather than dropped — which is the normal
       // case, since a client sends its first request the instant the
       // handshake completes.
-      const upstream = net.connect(opts.upstreamPort, "127.0.0.1");
+      const upstreamPort = client.alpnProtocol === "h2" ? opts.http2Port! : opts.upstreamPort;
+      const upstream = net.connect(upstreamPort, "127.0.0.1");
       upstream.setTimeout(0);
       upstream.setNoDelay(true);
       client.setNoDelay(true);
@@ -204,7 +212,7 @@ export function startTlsTerminator(opts: TlsTerminatorOptions): Promise<TlsTermi
         teardown();
       });
       upstream.on("error", (err) => {
-        warn(`ingress upstream :${opts.upstreamPort} failed`, err);
+        warn(`ingress upstream :${upstreamPort} failed`, err);
         teardown();
       });
       client.on("close", teardown);
@@ -224,7 +232,7 @@ export function startTlsTerminator(opts: TlsTerminatorOptions): Promise<TlsTermi
     server.listen(opts.port, opts.hostname, () => {
       server.removeListener("error", reject);
       resolve({
-        port: opts.port,
+        port: (server.address() as net.AddressInfo).port,
         clientIpFor: (upstreamPort) =>
           upstreamPort === undefined ? undefined : clientIpByUpstreamPort.get(upstreamPort),
         connectionCount: () => live.size,

package/src/index.ts

@@ -1161,6 +1161,9 @@ export interface ServiceTls {
   /** HTTP port the service listens on inside its container. The
    * daemon forwards proxied requests here over `spectest-net`. */
   port: number;
+  /** Accept HTTP/2 over TLS and forward it as plaintext HTTP/2 (h2c).
+   * Required for gRPC. HTTP/1.1 continues to use the existing HTTP proxy. */
+  http2?: boolean;
 }
 
 /** @internal Normalized wire representation; legacy definitions remain accepted. */
@@ -1661,6 +1664,7 @@ function validateEnvironmentConfig<S extends ServicesMap>(
           `service "${name}" tls entry must be { hostname: string, port: number }; got ${JSON.stringify(entry)}`,
         );
       }
+      if (entry.http2 !== undefined && typeof entry.http2 !== "boolean") throw new Error(`service "${name}" tls http2 must be a boolean`);
       const h = entry.hostname.toLowerCase();
       if (!HOSTNAME_RE.test(hostPatternBody(h))) {
         throw new Error(

package/src/ingress.ts

@@ -40,7 +40,7 @@ export interface DnsDecl {
 export interface ProxyDecl {
   kind: "proxy";
   hostname: string;
-  upstream: { service: string; port: number };
+  upstream: { service: string; port: number; http2?: boolean };
 }
 
 export type IngressDecl = CertificateDecl | DnsDecl | ProxyDecl;
@@ -137,7 +137,7 @@ export function dnsName(hostname: string, target: DnsTarget): DnsDecl {
  */
 export function proxy(
   hostname: string,
-  upstream: { service: string; port: number },
+  upstream: { service: string; port: number; http2?: boolean },
 ): ProxyDecl {
   assertNameOrWildcard(hostname, "proxy()");
   if (!upstream || typeof upstream.service !== "string" || typeof upstream.port !== "number") {
@@ -145,6 +145,7 @@ export function proxy(
       `proxy(${JSON.stringify(hostname)}): upstream must be { service: string, port: number }`,
     );
   }
+  if (upstream.http2 !== undefined && typeof upstream.http2 !== "boolean") throw new Error("proxy(): http2 must be a boolean");
   return { kind: "proxy", hostname: hostname.toLowerCase(), upstream };
 }
 
@@ -197,7 +198,7 @@ export interface LoweredIngress {
   /** One leaf cert per group; SANs = the group's hostnames. */
   certificates: { hostnames: string[] }[];
   /** Reverse-proxy routes: hostname → upstream service:port. */
-  proxies: { hostname: string; service: string; port: number }[];
+  proxies: { hostname: string; service: string; port: number; http2?: boolean }[];
   /** Hostnames that resolve to the daemon ingress gateway (DNS registry
    *  + `--add-host` on every container). Covers fakes, TLS proxies, and
    *  any `dnsName(h, { ingress: true })`. */
@@ -226,7 +227,7 @@ function resolveSelf(service: string, selfKey: string): string {
  */
 export function lowerIngress(project: Project): LoweredIngress {
   const certificates: { hostnames: string[] }[] = [];
-  const proxies: { hostname: string; service: string; port: number }[] = [];
+  const proxies: { hostname: string; service: string; port: number; http2?: boolean }[] = [];
   const ingressSet = new Set<string>();
   const aliasesByService: Record<string, string[]> = {};
   const wildcards: { pattern: string; target: DnsTarget }[] = [];
@@ -241,7 +242,7 @@ export function lowerIngress(project: Project): LoweredIngress {
         break;
       case "proxy": {
         const service = resolveSelf(decl.upstream.service, selfKey);
-        proxies.push({ hostname: decl.hostname, service, port: decl.upstream.port });
+        proxies.push({ hostname: decl.hostname, service, port: decl.upstream.port, ...(decl.upstream.http2 ? { http2: true } : {}) });
         // A proxied hostname must route to the daemon. A wildcard one can
         // only be answered by the resolver (there is no `--add-host` for a
         // pattern), so it goes in the wildcard table pointed at the ingress.
@@ -278,7 +279,7 @@ export function lowerIngress(project: Project): LoweredIngress {
     // `tls: [{ hostname, port }]` → cert + TLS-terminated reverse proxy.
     for (const entry of (svc as ServiceConfig).tls ?? []) {
       applyDecl(certificate([entry.hostname]), name);
-      applyDecl(proxy(entry.hostname, { service: name, port: entry.port }), name);
+      applyDecl(proxy(entry.hostname, { service: name, port: entry.port, ...(entry.http2 ? { http2: true } : {}) }), name);
     }
     // `hostnames: [h]` → plain peer alias (no daemon hop).
     for (const h of (svc as ServiceConfig).hostnames ?? []) {