@stacksjs/buddy 0.70.155 → 0.70.157

package/dist/cli.js

@@ -2,6 +2,7 @@
 import process from "node:process";
 import { cli, log } from "@stacksjs/cli";
 import { path as p } from "@stacksjs/path";
+import { registerGlobalOptions } from "./global-options";
 try {
   const { isSupportedBunVersion, minimumBunVersion } = await import("@stacksjs/utils"), currentBunVersion = typeof Bun < "u" ? Bun.version : process.versions.bun;
   if (currentBunVersion && !isSupportedBunVersion(currentBunVersion)) {
@@ -9,7 +10,7 @@ try {
     process.exit(1);
   }
 } catch {}
-const args = process.argv.slice(2), requestedCommand = args[0] || "help", isHelpFlag = args.includes("--help") || args.includes("-h"), isVersionOnly = ["--version", "-v", "version"].includes(requestedCommand), isHelpMode = requestedCommand === "help" || isHelpFlag && args.length <= 2, skipAppKeyCheck = [
+const args = process.argv.slice(2), requestedCommand = args[0] || "help", isHelpFlag = args.includes("--help") || args.includes("-h"), isVersionOnly = ["--version", "-V", "version"].includes(requestedCommand), isHelpMode = requestedCommand === "help" || isHelpFlag && args.length <= 2, skipAppKeyCheck = [
   "build",
   "lint",
   "lint:fix",
@@ -53,7 +54,9 @@ if (needsFullSetup) {
   process.on("unhandledRejection", (error) => reportFatal("unhandledRejection", error));
 }
 async function main() {
-  const buddy = cli("buddy"), configPath = "./buddy.config.js";
+  const buddy = cli("buddy");
+  registerGlobalOptions(buddy);
+  const configPath = "./buddy.config.js";
   try {
     await Bun.file(configPath).text();
     const { applyBuddyConfig } = await import("./config.js");

package/dist/commands/create.js

@@ -27,7 +27,7 @@ export function create(buddy) {
     minimal: "Skip optional feature bundles (cms, commerce, dashboard, marketing, monitoring, realtime, queue) \u2014 bare-bones API/SPA starter that can re-add them later via `./buddy <feature>:install`.",
     verbose: "Enable verbose output"
   };
-  buddy.command("new [name]", descriptions.command).alias("create [name]").option("-n, --name [name]", descriptions.name, { default: !1 }).option("-u, --ui", descriptions.ui, { default: !0 }).option("-c, --components", descriptions.components, { default: !0 }).option("-w, --web-components", descriptions.webComponents, { default: !0 }).option("-v, --vue", descriptions.vue, { default: !0 }).option("-p, --views", descriptions.views, { default: !0 }).option("-f, --functions", descriptions.functions, { default: !0 }).option("-a, --api", descriptions.api, { default: !0 }).option("-d, --database", descriptions.database, { default: !0 }).option("-ca, --cache", descriptions.cache, { default: !1 }).option("-e, --email", descriptions.email, { default: !1 }).option("-P, --project [project]", descriptions.project, { default: !1 }).option("-m, --minimal", descriptions.minimal, { default: !1 }).option("--verbose", descriptions.verbose, { default: !1 }).action(async (name, options) => {
+  buddy.command("new [name]", descriptions.command).alias("create [name]").option("-n, --name [name]", descriptions.name, { default: !1 }).option("-u, --ui", descriptions.ui, { default: !0 }).option("-c, --components", descriptions.components, { default: !0 }).option("-w, --web-components", descriptions.webComponents, { default: !0 }).option("--vue", descriptions.vue, { default: !0 }).option("-p, --views", descriptions.views, { default: !0 }).option("-f, --functions", descriptions.functions, { default: !0 }).option("-a, --api", descriptions.api, { default: !0 }).option("-d, --database", descriptions.database, { default: !0 }).option("-ca, --cache", descriptions.cache, { default: !1 }).option("-e, --email", descriptions.email, { default: !1 }).option("-P, --project [project]", descriptions.project, { default: !1 }).option("-m, --minimal", descriptions.minimal, { default: !1 }).option("--verbose", descriptions.verbose, { default: !1 }).action(async (name, options) => {
     log.debug("Running `buddy new <name>` ...", options);
     const startTime = await intro("buddy new");
     name = name ?? options.name;

package/dist/commands/dev.d.ts

@@ -1,7 +1,48 @@
 import type { CLI, DevOptions } from '@stacksjs/types';
+export declare function dispatchInteractiveDevSelection(selection: string, runners: InteractiveDevRunners): Promise<boolean>;
+export declare function resolvePrettyDevDomain(appUrl: string | undefined, nativeMode?: boolean): string | null;
+export declare function shouldUsePrettyDevUrls(input: {
+  domain: string | null
+  localhostOnly: boolean
+  proxyManagedExternally: boolean
+  systemAuthorized: boolean
+}): boolean;
 export declare function dev(buddy: CLI): void;
 export declare function startDevelopmentServer(_options: DevOptions, _startTime?: number): Promise<void>;
+export declare function setupPrettyDevEnvironment(input: {
+  domain?: string
+  skipHosts?: boolean
+  skipTrust?: boolean
+  verbose?: boolean
+}): Promise<boolean>;
+export declare const interactiveDevChoices: readonly [{
+  value: 'all';
+  title: 'All'
+}, {
+  value: 'frontend';
+  title: 'Frontend'
+}, {
+  value: 'api';
+  title: 'Backend'
+}, {
+  value: 'dashboard';
+  title: 'Dashboard'
+}, {
+  value: 'desktop';
+  title: 'Desktop'
+}, {
+  value: 'native';
+  title: 'Native App'
+}, {
+  value: 'components';
+  title: 'Components'
+}, {
+  value: 'docs';
+  title: 'Documentation'
+}];
 declare type DevelopmentRpx = typeof import('@stacksjs/rpx');
+declare type InteractiveDevSelection = typeof interactiveDevChoices[number]['value'];
+declare type InteractiveDevRunners = Record<InteractiveDevSelection, () => Promise<unknown>>;
 type RpxProxySpec = {
   id: string
   from: string

package/dist/commands/dev.js

@@ -41,6 +41,47 @@ async function actions() {
     _actions = await import("@stacksjs/actions");
   return _actions;
 }
+export const interactiveDevChoices = [
+  { value: "all", title: "All" },
+  { value: "frontend", title: "Frontend" },
+  { value: "api", title: "Backend" },
+  { value: "dashboard", title: "Dashboard" },
+  { value: "desktop", title: "Desktop" },
+  { value: "native", title: "Native App" },
+  { value: "components", title: "Components" },
+  { value: "docs", title: "Documentation" }
+];
+export async function dispatchInteractiveDevSelection(selection, runners) {
+  if (!Object.hasOwn(runners, selection))
+    return !1;
+  await runners[selection]();
+  return !0;
+}
+export function resolvePrettyDevDomain(appUrl, nativeMode = !1) {
+  if (!appUrl || nativeMode)
+    return null;
+  try {
+    const hostname = new URL(/^https?:\/\//i.test(appUrl) ? appUrl : `https://${appUrl}`).hostname.toLowerCase();
+    if (hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "0.0.0.0")
+      return null;
+    return hostname;
+  } catch {
+    return null;
+  }
+}
+export function shouldUsePrettyDevUrls(input) {
+  return input.domain !== null && !input.localhostOnly && (input.proxyManagedExternally || input.systemAuthorized);
+}
+async function canStartPrettyDevProxy() {
+  if (await waitForHttpsProxy(443, 150))
+    return !0;
+  try {
+    const { authorizeSystemAccess } = await importDevelopmentRpx();
+    return authorizeSystemAccess({ interactive: !1 });
+  } catch {
+    return !1;
+  }
+}
 export function dev(buddy) {
   const descriptions = {
     dev: "Start development server",
@@ -50,7 +91,6 @@ export function dev(buddy) {
     native: "Start the app in a native Craft window",
     dashboard: "Start the Dashboard development server",
     api: "Start the local API development server",
-    email: "Start the Email development server",
     docs: "Start the Documentation development server",
     systemTray: "Start the System Tray development server",
     interactive: "Get asked which development server to start",
@@ -59,7 +99,7 @@ export function dev(buddy) {
     project: "Target a specific project",
     verbose: "Enable verbose output"
   };
-  buddy.command("dev [server]", descriptions.dev).option("-f, --frontend", descriptions.frontend).option("-a, --api", descriptions.api).option("-e, --email", descriptions.email).option("-c, --components", descriptions.components).option("-d, --dashboard", descriptions.dashboard).option("-k, --desktop", descriptions.desktop).option("-n, --native", descriptions.native).option("-o, --docs", descriptions.docs).option("-s, --system-tray", descriptions.systemTray).option("-i, --interactive", descriptions.interactive, { default: !1 }).option("-l, --with-localhost", descriptions.withLocalhost, { default: !1 }).option("-p, --project [project]", descriptions.project, { default: !1 }).option("--verbose", descriptions.verbose, { default: !1 }).action(async (server, options) => {
+  buddy.command("dev [server]", descriptions.dev).option("-f, --frontend", descriptions.frontend).option("-a, --api", descriptions.api).option("-c, --components", descriptions.components).option("-d, --dashboard", descriptions.dashboard).option("-k, --desktop", descriptions.desktop).option("-n, --native", descriptions.native).option("-o, --docs", descriptions.docs).option("-s, --system-tray", descriptions.systemTray).option("-i, --interactive", descriptions.interactive, { default: !1 }).option("-l, --with-localhost", descriptions.withLocalhost, { default: !1 }).option("-p, --project [project]", descriptions.project, { default: !1 }).option("--verbose", descriptions.verbose, { default: !1 }).action(async (server, options) => {
     const perf = Bun.nanoseconds(), target = server || (options.frontend ? "frontend" : void 0) || (options.api ? "api" : void 0) || (options.components ? "components" : void 0) || (options.dashboard ? "dashboard" : void 0) || (options.desktop ? "desktop" : void 0) || (options.native ? "native" : void 0) || (options.systemTray || options["system-tray"] ? "system-tray" : void 0) || (options.docs ? "docs" : void 0);
     if (target) {
       const serverOptions = { ...options }, a = await actions();
@@ -97,29 +137,18 @@ export function dev(buddy) {
         type: "select",
         name: "value",
         message: descriptions.select,
-        choices: [
-          { value: "all", title: "All" },
-          { value: "frontend", title: "Frontend" },
-          { value: "api", title: "Backend" },
-          { value: "dashboard", title: "Dashboard" },
-          { value: "desktop", title: "Desktop" },
-          { value: "native", title: "Native App" },
-          { value: "email", title: "Email" },
-          { value: "components", title: "Components" },
-          { value: "docs", title: "Documentation" }
-        ]
-      })).value;
-      if (selectedValue === "components")
-        await (await actions()).runComponentsDevServer(options);
-      else if (selectedValue === "api")
-        await (await actions()).runApiDevServer(options);
-      else if (selectedValue === "dashboard")
-        await (await actions()).runDashboardDevServer(options);
-      else if (selectedValue === "native")
-        await startDevelopmentServer({ ...options, native: !0 }, perf);
-      else if (selectedValue === "docs")
-        await (await actions()).runDocsDevServer(options);
-      else {
+        choices: interactiveDevChoices
+      })).value, a = await actions();
+      if (!await dispatchInteractiveDevSelection(selectedValue, {
+        all: () => startDevelopmentServer(options, perf),
+        frontend: () => a.runFrontendDevServer(options),
+        api: () => a.runApiDevServer(options),
+        dashboard: () => a.runDashboardDevServer(options),
+        desktop: () => a.runDesktopDevServer(options),
+        native: () => startDevelopmentServer({ ...options, native: !0 }, perf),
+        components: () => a.runComponentsDevServer(options),
+        docs: () => a.runDocsDevServer(options)
+      })) {
         log.error("Invalid option during interactive mode");
         process.exit(ExitCode.InvalidArgument);
       }
@@ -186,7 +215,12 @@ export function dev(buddy) {
   onUnknownSubcommand(buddy, "dev");
 }
 export async function startDevelopmentServer(_options, _startTime) {
-  const options = _options, startedAt = _startTime, appUrl = process.env.APP_URL, nativeMode = options.native === !0, proxyManagedExternally = process.env.STACKS_PROXY_MANAGED === "1", frontendPort = Number(process.env.PORT) || 3000, apiPort = Number(process.env.PORT_API) || 3008, docsPort = Number(process.env.PORT_DOCS) || 3006, dashboardPort = Number(process.env.PORT_ADMIN) || 3002, includeDashboard = process.env.STACKS_DEV_DASHBOARD === "1", appLooksCustom = !nativeMode && appUrl && appUrl !== "localhost" && !appUrl.includes("localhost:"), domain = appLooksCustom ? appUrl.replace(/^https?:\/\//, "") : null, localhostOnly = process.env.STACKS_DEV_LOCALHOST === "1", hasCustomDomain = appLooksCustom && !proxyManagedExternally && !localhostOnly, dashboardDomain = domain ? `dashboard.${domain}` : null, frontendUrl = domain ? `https://${domain}` : `http://localhost:${frontendPort}`, apiUrl = domain ? `https://${domain}/api` : `http://localhost:${apiPort}`, docsUrl = domain ? `https://${domain}/docs` : `http://localhost:${docsPort}`, dashboardUrl = dashboardDomain ? `https://${dashboardDomain}` : `http://localhost:${dashboardPort}`, managedPorts = [
+  const options = _options, startedAt = _startTime, appUrl = process.env.APP_URL ?? "stacks.localhost", nativeMode = options.native === !0, proxyManagedExternally = process.env.STACKS_PROXY_MANAGED === "1", frontendPort = Number(process.env.PORT) || 3000, apiPort = Number(process.env.PORT_API) || 3008, docsPort = Number(process.env.PORT_DOCS) || 3006, dashboardPort = Number(process.env.PORT_ADMIN) || 3002, includeDashboard = process.env.STACKS_DEV_DASHBOARD === "1", domain = resolvePrettyDevDomain(appUrl, nativeMode), appLooksCustom = domain !== null, localhostOnly = process.env.STACKS_DEV_LOCALHOST === "1", prettyUrlsRequested = appLooksCustom && !localhostOnly, systemAuthorized = !prettyUrlsRequested || proxyManagedExternally ? !0 : await canStartPrettyDevProxy(), usePrettyUrls = shouldUsePrettyDevUrls({
+    domain,
+    localhostOnly,
+    proxyManagedExternally,
+    systemAuthorized
+  }), prettySetupRequired = prettyUrlsRequested && !usePrettyUrls, hasCustomDomain = usePrettyUrls && !proxyManagedExternally, displayedDomain = usePrettyUrls ? domain : null, dashboardDomain = displayedDomain ? `dashboard.${displayedDomain}` : null, frontendUrl = displayedDomain ? `https://${displayedDomain}` : `http://localhost:${frontendPort}`, apiUrl = displayedDomain ? `https://${displayedDomain}/api` : `http://localhost:${apiPort}`, docsUrl = displayedDomain ? `https://${displayedDomain}/docs` : `http://localhost:${docsPort}`, dashboardUrl = dashboardDomain ? `https://${dashboardDomain}` : `http://localhost:${dashboardPort}`, managedPorts = [
     frontendPort,
     apiPort,
     docsPort,
@@ -195,6 +229,11 @@ export async function startDevelopmentServer(_options, _startTime) {
   process.env.STACKS_PROXY_MANAGED = "1";
   process.env.STACKS_DEV_QUIET = "1";
   console.log();
+  if (prettySetupRequired) {
+    console.log(`  ${yellow("\u26A0")}  ${yellow("Pretty URL setup required")} ${dim("- using localhost for this session")}`);
+    console.log(`  ${dim("    ")}${dim("Run `./buddy setup:ssl` once, then restart `./buddy dev`.")}`);
+    console.log();
+  }
   console.log(`  ${bold(cyan("stacks"))} ${dim(`v${version}`)}  ${dim("starting\u2026")}`);
   console.log();
   if (process.env.STACKS_DEV_NO_KILL !== "1")
@@ -607,104 +646,7 @@ async function waitForHttpsProxy(port, timeoutMs) {
   }
   return !1;
 }
-const RPX_SSL_DIR = join(homedir(), ".stacks", "ssl"), RPX_ROOT_CA_PATH = join(RPX_SSL_DIR, "rpx-root-ca.crt"), RPX_HOST_CERT_PATH = join(RPX_SSL_DIR, "rpx.localhost.crt"), LOGIN_KEYCHAIN = join(homedir(), "Library/Keychains/login.keychain-db");
-function normalizeSha256Fingerprint(raw) {
-  return (raw.includes("=") ? raw.split("=").pop() : raw).replace(/SHA-256\s+hash:\s*/gi, "").replace(/:/g, "").trim().toUpperCase();
-}
-function readCertFingerprint(certPath) {
-  try {
-    const out = execSync(`openssl x509 -noout -fingerprint -sha256 -in "${certPath}"`, { encoding: "utf8" });
-    return normalizeSha256Fingerprint(out);
-  } catch {
-    return null;
-  }
-}
-function isRpxRootCaInKeychain(caPath) {
-  const fp = readCertFingerprint(caPath);
-  if (!fp)
-    return !1;
-  const keychains = [
-    "/Library/Keychains/System.keychain",
-    LOGIN_KEYCHAIN
-  ];
-  for (const keychain of keychains)
-    try {
-      const listing = execSync(`security find-certificate -a -Z "${keychain}" 2>/dev/null || true`, { encoding: "utf8" });
-      for (const line of listing.split(`
-`))
-        if (line.toUpperCase().includes("SHA-256") && normalizeSha256Fingerprint(line) === fp)
-          return !0;
-    } catch {}
-  return !1;
-}
-function execSudoSh(command) {
-  const sudoPassword = process.env.SUDO_PASSWORD, escaped = command.replace(/'/g, "'\\''");
-  if (sudoPassword)
-    execSync(`echo '${sudoPassword}' | sudo -S sh -c '${escaped}' 2>/dev/null`, { stdio: ["pipe", "pipe", "pipe"] });
-  else
-    execSync(`sudo -n sh -c '${escaped}'`, { stdio: ["pipe", "pipe", "pipe"] });
-}
-const MACOS_CA_TRUST_FLAGS = "-d -r trustRoot -p ssl -p basic";
-function listRpxRootCaHashesInKeychain(keychain) {
-  const listing = execSync(`security find-certificate -a -c "rpx.localhost" -Z "${keychain}" 2>/dev/null || true`, { encoding: "utf8" }), hashes = [];
-  for (const line of listing.split(`
-`)) {
-    const match = line.match(/SHA-256 hash:\s*([A-F0-9]+)/i);
-    if (match)
-      hashes.push(match[1].toUpperCase());
-  }
-  return hashes;
-}
-function pruneStaleRpxRootCas(caPath) {
-  if (process.platform !== "darwin")
-    return;
-  const keep = readCertFingerprint(caPath);
-  if (!keep)
-    return;
-  for (const keychain of ["/Library/Keychains/System.keychain", LOGIN_KEYCHAIN])
-    for (const hash of listRpxRootCaHashesInKeychain(keychain)) {
-      if (hash === keep)
-        continue;
-      try {
-        if (keychain.startsWith("/Library"))
-          execSudoSh(`security delete-certificate -Z ${hash} "${keychain}"`);
-        else
-          execSync(`security delete-certificate -Z ${hash} "${keychain}"`, { stdio: "ignore" });
-      } catch {}
-    }
-}
-function isRpxRootCaTrustedForSsl(caPath, serverName) {
-  if (process.platform !== "darwin")
-    return isRpxRootCaInKeychain(caPath);
-  try {
-    return execSync(`security verify-cert -c "${caPath}" -s "${serverName}" -l -L -R ssl 2>&1`, { encoding: "utf8" }).includes("successful");
-  } catch {
-    return !1;
-  }
-}
-function trustRpxRootCaForBrowsers(caPath, serverName) {
-  if (process.platform !== "darwin")
-    return !1;
-  pruneStaleRpxRootCas(caPath);
-  try {
-    execSync(`security add-trusted-cert ${MACOS_CA_TRUST_FLAGS} -k "${LOGIN_KEYCHAIN}" "${caPath}"`, { stdio: "ignore" });
-  } catch {}
-  try {
-    execSudoSh(`security add-trusted-cert ${MACOS_CA_TRUST_FLAGS} -k /Library/Keychains/System.keychain "${caPath}"`);
-  } catch {
-    return !1;
-  }
-  return isRpxRootCaTrustedForSsl(caPath, serverName) || isRpxRootCaInKeychain(caPath);
-}
-function isLiveHttpsChainValid(domain) {
-  if (!existsSync(RPX_ROOT_CA_PATH))
-    return !1;
-  try {
-    return execSync(`echo | openssl s_client -connect ${domain}:443 -servername ${domain} -CAfile "${RPX_ROOT_CA_PATH}" 2>/dev/null | grep "Verify return code"`, { encoding: "utf8", timeout: 4000 }).includes(": 0 (ok)");
-  } catch {
-    return !1;
-  }
-}
+const RPX_SSL_DIR = join(homedir(), ".stacks", "ssl"), RPX_ROOT_CA_PATH = join(RPX_SSL_DIR, "rpx-root-ca.crt"), RPX_HOST_CERT_PATH = join(RPX_SSL_DIR, "rpx.localhost.crt");
 function buildDevelopmentTlsHostnames(domain, includeDashboard) {
   return [
     domain,
@@ -712,66 +654,45 @@ function buildDevelopmentTlsHostnames(domain, includeDashboard) {
     "rpx.localhost"
   ];
 }
-function readCertCommonName(certPath) {
-  try {
-    return execSync(`openssl x509 -in "${certPath}" -noout -subject -nameopt RFC2253`, { encoding: "utf8" }).match(/CN=([^,/]+)/)?.[1]?.trim() ?? null;
-  } catch {
-    return null;
-  }
-}
-async function buildDevelopmentTlsOptions(domain, includeDashboard, verbose) {
-  const hostnames = buildDevelopmentTlsHostnames(domain, includeDashboard);
-  try {
-    const { getRegistryDir, readAll } = await importDevelopmentRpx(), entries = await readAll(getRegistryDir(), !1);
-    for (const entry of entries) {
-      const host = entry.to?.trim();
-      if (host && !hostnames.includes(host))
-        hostnames.push(host);
-    }
-  } catch {}
-  return {
-    https: {
-      certPath: RPX_HOST_CERT_PATH,
-      keyPath: join(RPX_SSL_DIR, "rpx.localhost.key"),
-      caCertPath: join(RPX_SSL_DIR, "rpx.localhost.ca.crt"),
-      commonName: domain
-    },
-    verbose,
-    regenerateUntrustedCerts: !0,
-    proxies: hostnames.map((to) => ({ from: "localhost:1", to }))
-  };
-}
-async function ensureRpxDevelopmentHttps(domain, options, includeDashboard) {
+async function ensureRpxDevelopmentHttps(domain, options, includeDashboard, trustCertificate = !0) {
   const verbose = options.verbose ?? !1, {
+    buildRegistryTlsProxyOptions,
+    certIncludesSanHostnames,
     checkExistingCertificates,
     clearSslConfigCache,
     forceTrustCertificate,
     generateCertificate,
+    getRegistryDir,
     isDaemonRunning,
-    stopDaemon
-  } = await importDevelopmentRpx(), hostnames = buildDevelopmentTlsHostnames(domain, includeDashboard), tlsOptions = await buildDevelopmentTlsOptions(domain, includeDashboard, verbose), hostnameInCert = hostnames.every((host) => {
-    try {
-      return execSync(`openssl x509 -in "${RPX_HOST_CERT_PATH}" -noout -text`, { encoding: "utf8" }).includes(`DNS:${host}`);
-    } catch {
-      return !1;
-    }
-  }), cnMatchesApp = readCertCommonName(RPX_HOST_CERT_PATH) === domain;
+    isRootCaTrustedForSsl,
+    readAll,
+    readCertCommonName,
+    stopDaemon,
+    trustRootCaForBrowsers,
+    verifyHttpsChain
+  } = await importDevelopmentRpx(), hostnames = buildDevelopmentTlsHostnames(domain, includeDashboard), entries = await readAll(getRegistryDir(), !1).catch(() => []);
+  for (const entry of entries) {
+    const host = entry.to?.trim();
+    if (host && !hostnames.includes(host))
+      hostnames.push(host);
+  }
+  const tlsOptions = buildRegistryTlsProxyOptions(hostnames, domain, verbose), hostnameInCert = certIncludesSanHostnames(RPX_HOST_CERT_PATH, hostnames), cnMatchesApp = readCertCommonName(RPX_HOST_CERT_PATH) === domain;
   let certRegenerated = !1;
   if (!await checkExistingCertificates(tlsOptions) || !hostnameInCert || !cnMatchesApp) {
     clearSslConfigCache();
     await generateCertificate({ ...tlsOptions, forceRegenerate: !0 });
     certRegenerated = !0;
   }
-  let trusted = isRpxRootCaTrustedForSsl(RPX_ROOT_CA_PATH, domain);
-  if (!trusted) {
-    trusted = trustRpxRootCaForBrowsers(RPX_ROOT_CA_PATH, domain) || await forceTrustCertificate(RPX_ROOT_CA_PATH, { serverName: domain, verbose }) || isRpxRootCaTrustedForSsl(RPX_ROOT_CA_PATH, domain);
+  let trusted = isRootCaTrustedForSsl(RPX_ROOT_CA_PATH, domain, { verbose });
+  if (!trusted && trustCertificate) {
+    trusted = trustRootCaForBrowsers(RPX_ROOT_CA_PATH, { serverName: domain, verbose }) || await forceTrustCertificate(RPX_ROOT_CA_PATH, { serverName: domain, verbose }) || isRootCaTrustedForSsl(RPX_ROOT_CA_PATH, domain, { verbose });
     if (trusted)
       console.log(`  ${green("\u2713")}  ${dim("HTTPS")}:         ${dim("Local CA trusted \u2014 reload the browser if you still see a warning")}`);
     else
       console.log(`  ${yellow("\u26A0")}  ${yellow("HTTPS")}:         ${yellow(`Local CA not trusted \u2014 run: sh ${join(RPX_SSL_DIR, "trust-rpx-cert.sh")}`)}`);
   } else if (verbose)
     console.log(`  ${green("\u2713")}  ${dim("HTTPS")}:         ${dim("Local certificate trusted for SSL")}`);
-  const chainOk = isLiveHttpsChainValid(domain);
+  const chainOk = existsSync(RPX_ROOT_CA_PATH) ? await verifyHttpsChain(domain, RPX_ROOT_CA_PATH) : !1;
   if ((certRegenerated || !hostnameInCert || !cnMatchesApp) && await isDaemonRunning()) {
     await stopDaemon({ timeoutMs: 8000 }).catch(() => {});
     if (verbose)
@@ -851,23 +772,62 @@ async function removeStalePublicDomainOverrides(domain, includeDashboard, verbos
   }
 }
 async function prepareRpxTlsForDev(input) {
-  const { domain, includeDashboard, options } = input, verbose = options.verbose ?? !1, hosts = [
+  const { domain, includeDashboard, options, skipHosts = !1, trustCertificate = !0 } = input, verbose = options.verbose ?? !1, hosts = [
     domain,
     ...includeDashboard ? [`dashboard.${domain}`] : []
   ], hostsNeedingFile = hosts.filter((host) => {
     const h = host.trim().toLowerCase();
     return h !== "localhost" && !h.endsWith(".localhost") && !h.endsWith(".localhost.");
-  }), { addHosts, setupDevelopmentDns } = await importDevelopmentRpx(), dnsDomains = hostsNeedingFile.length > 0 ? hosts : [];
+  }), { addHosts, setupDevelopmentDns } = await importDevelopmentRpx(), dnsDomains = !skipHosts && hostsNeedingFile.length > 0 ? hosts : [];
   if (dnsDomains.length > 0) {
     if (!await setupDevelopmentDns({ domains: dnsDomains, verbose }).catch(() => !1) && verbose)
       log.warn(`Dev DNS not configured for ${dnsDomains.join(", ")} \u2014 falling back to /etc/hosts`);
   }
-  if (hostsNeedingFile.length > 0)
+  if (!skipHosts && hostsNeedingFile.length > 0)
     await addHosts(hostsNeedingFile, verbose).catch((err) => {
       log.warn(`Could not update /etc/hosts for ${hostsNeedingFile.join(", ")}: ${err.message}`);
       log.warn("Add 127.0.0.1 entries manually or set SUDO_PASSWORD in .env");
     });
-  await ensureRpxDevelopmentHttps(domain, options, includeDashboard);
+  await ensureRpxDevelopmentHttps(domain, options, includeDashboard, trustCertificate);
+}
+export async function setupPrettyDevEnvironment(input) {
+  const domain = resolvePrettyDevDomain(input.domain ?? process.env.APP_URL ?? "stacks.localhost");
+  if (!domain) {
+    log.info("APP_URL already uses localhost; no pretty URL setup is needed");
+    return !0;
+  }
+  const rpx = await importDevelopmentRpx();
+  if (!rpx.authorizeSystemAccess({ interactive: process.stdin.isTTY === !0 && process.stdout.isTTY === !0 })) {
+    log.error("Pretty URL setup needs administrator authorization to bind ports 80 and 443 and trust the local CA");
+    return !1;
+  }
+  await prepareRpxTlsForDev({
+    domain,
+    includeDashboard: process.env.STACKS_DEV_DASHBOARD === "1",
+    options: { verbose: input.verbose },
+    skipHosts: input.skipHosts,
+    trustCertificate: !input.skipTrust
+  });
+  const spawnEnv = {};
+  if (process.env.SUDO_PASSWORD)
+    spawnEnv.SUDO_PASSWORD = process.env.SUDO_PASSWORD;
+  if (input.verbose)
+    spawnEnv.RPX_VERBOSE = "1";
+  const rpxEntry = resolveRpxEntryPath();
+  if (rpxEntry)
+    spawnEnv.RPX_MODULE = rpxEntry;
+  await startRpxDaemonIfNeeded({
+    spawnCommand: await resolveRpxDaemonSpawnCommand(),
+    spawnEnv,
+    verbose: input.verbose ?? !1,
+    stopRpx: rpx.stopDaemon
+  });
+  const ready = await waitForHttpsProxy(443, 5000);
+  if (ready)
+    log.success(`Pretty URLs are ready at https://${domain}`);
+  else
+    log.error("rpx did not become reachable on port 443");
+  return ready;
 }
 async function startRpxDaemonIfNeeded(input) {
   const { ensureDaemonRunning, isDaemonRunning: isRpxUp } = await importDevelopmentRpx();

package/dist/commands/setup.js

@@ -1,13 +1,14 @@
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import process from "node:process";
-import { runAction, setupSSL } from "@stacksjs/actions";
+import { runAction } from "@stacksjs/actions";
 import { log, onUnknownSubcommand, runCommand } from "@stacksjs/cli";
 import { Action } from "@stacksjs/enums";
 import { handleError } from "@stacksjs/error-handling";
 import { path as p } from "@stacksjs/path";
 import { copyFile, storage } from "@stacksjs/storage";
 import { ExitCode } from "@stacksjs/types";
+import { setupPrettyDevEnvironment } from "./dev";
 function getTimeoutMs(envVar, fallbackMs) {
   const value = Number(process.env[envVar]);
   if (Number.isFinite(value) && value > 0)
@@ -37,7 +38,7 @@ export function setup(buddy) {
   });
   buddy.command("setup:ssl", descriptions.ssl).alias("ssl:setup").option("-d, --domain [domain]", descriptions.domain).option("--skip-hosts", descriptions.skipHosts, { default: !1 }).option("--skip-trust", descriptions.skipTrust, { default: !1 }).option("--verbose", descriptions.verbose, { default: !1 }).action(async (options) => {
     log.debug("Running `buddy setup:ssl` ...", options);
-    if (!await setupSSL({
+    if (!await setupPrettyDevEnvironment({
       domain: options.domain,
       skipHosts: options.skipHosts,
       skipTrust: options.skipTrust,

package/dist/commands/upgrade.js

@@ -21,7 +21,7 @@ export function upgrade(buddy) {
     project: "Target a specific project",
     all: "Upgrade framework, dependencies, Bun, and binary"
   };
-  buddy.command("upgrade", descriptions.upgrade).option("-v, --version <version>", descriptions.version).option("--canary", descriptions.canary, { default: !1 }).option("--stable", descriptions.stable, { default: !1 }).option("--dry-run", descriptions.dryRun, { default: !1 }).option("-f, --force", descriptions.force, { default: !1 }).option("--from <path>", descriptions.from).option("--no-postinstall", descriptions.noPostinstall).option("--verbose", descriptions.verbose, { default: !1 }).alias("update").example("buddy upgrade").example("buddy update").example("buddy upgrade --from ~/Code/stacks").example("buddy upgrade --version 0.70.23").example("buddy upgrade --dry-run").example("buddy upgrade --canary").example("buddy upgrade --stable").example("buddy upgrade --force").action(async (options) => {
+  buddy.command("upgrade", descriptions.upgrade).option("-V, --version <version>", descriptions.version).option("--canary", descriptions.canary, { default: !1 }).option("--stable", descriptions.stable, { default: !1 }).option("--dry-run", descriptions.dryRun, { default: !1 }).option("-f, --force", descriptions.force, { default: !1 }).option("--from <path>", descriptions.from).option("--no-postinstall", descriptions.noPostinstall).option("--verbose", descriptions.verbose, { default: !1 }).alias("update").example("buddy upgrade").example("buddy update").example("buddy upgrade --from ~/Code/stacks").example("buddy upgrade --version 0.70.23").example("buddy upgrade --dry-run").example("buddy upgrade --canary").example("buddy upgrade --stable").example("buddy upgrade --force").action(async (options) => {
     log.debug("Running `buddy upgrade` ...", options);
     const opts = { ...options };
     if (opts.postinstall === !1) {

package/dist/commands/version.js

@@ -1,6 +1,5 @@
-import process from "node:process";
 import { bold, dim, green, intro, log, onUnknownSubcommand } from "@stacksjs/cli";
-import { storage } from "@stacksjs/storage";
+import { versionLine } from "../version-info";
 export function version(buddy) {
   const descriptions = {
     version: "Retrieving Stacks build version"
@@ -8,9 +7,8 @@ export function version(buddy) {
   buddy.command("version", descriptions.version).action(async () => {
     log.debug("Running `buddy version` ...");
     await intro("buddy version");
-    const pkg = await storage.readPackageJson("./package.json"), bunVersion = "wip", stacksVersion = pkg.version;
-    log.info(green(bold("@stacksjs/ ")) + dim(` ${stacksVersion}`));
-    log.info(green(bold("Bun: ")) + dim(`   ${bunVersion}`));
+    log.info(green(bold("Stacks: ")) + dim(` ${versionLine}`));
+    log.info(green(bold("Bun: ")) + dim(`    ${Bun.version}`));
   });
   onUnknownSubcommand(buddy, "version");
 }

package/dist/global-options.d.ts

@@ -0,0 +1,3 @@
+import type { CLI } from '@stacksjs/cli';
+/** Register Buddy's process-wide controls before any command modules load. */
+export declare function registerGlobalOptions(buddy: CLI): void;

package/dist/global-options.js

@@ -0,0 +1,4 @@
+import { versionDescriptor } from "./version-info";
+export function registerGlobalOptions(buddy) {
+  buddy.version(versionDescriptor, "-V, --version").option("-v, --verbose", "Enable verbose output").option("-q, --quiet", "Suppress non-essential output").option("--debug", "Enable debug output and stack traces").option("--no-interaction", "Do not ask interactive questions").option("--env <environment>", "Target an environment").option("--dry-run", "Preview actions without making changes").option("--force", "Skip confirmation prompts").option("--no-emoji", "Disable emoji in output").option("--no-cache", "Disable command metadata caching");
+}

package/dist/version-info.d.ts

@@ -0,0 +1,9 @@
+import { version as buddyVersion } from '../package.json';
+// Every published Stacks framework package shares the release version. Buddy's
+// own package metadata is therefore the portable source of truth for both
+// labels. Reading the monorepo parent's package.json works from src/ but escapes
+// the package after compilation to dist/ and breaks clean npm installs.
+declare const stacksVersion: unknown;
+export declare const versionDescriptor: string;
+export declare const versionLine: string;
+export { buddyVersion, stacksVersion };

package/dist/version-info.js

@@ -0,0 +1,5 @@
+import { version as buddyVersion } from "../package.json";
+const stacksVersion = buddyVersion;
+
+export { buddyVersion, stacksVersion };
+export const versionDescriptor = `${buddyVersion} stacks/${stacksVersion}`, versionLine = `buddy/${versionDescriptor}`;

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/buddy",
   "type": "module",
   "sideEffects": false,
-  "version": "0.70.155",
+  "version": "0.70.157",
   "description": "Meet Buddy. The Stacks runtime.",
   "author": "Chris Breuer",
   "contributors": [
@@ -92,51 +92,51 @@
     "prepublishOnly": "bun run build"
   },
   "dependencies": {
-    "@stacksjs/actions": "^0.70.155",
-    "@stacksjs/ai": "^0.70.155",
-    "@stacksjs/alias": "^0.70.155",
-    "@stacksjs/arrays": "^0.70.155",
-    "@stacksjs/auth": "^0.70.155",
-    "@stacksjs/build": "^0.70.155",
-    "@stacksjs/cache": "^0.70.155",
-    "@stacksjs/cli": "^0.70.155",
-    "@stacksjs/clapp": "^0.2.10",
-    "@stacksjs/cloud": "^0.70.155",
-    "@stacksjs/collections": "^0.70.155",
-    "@stacksjs/config": "^0.70.155",
-    "@stacksjs/database": "^0.70.155",
-    "@stacksjs/desktop": "^0.70.155",
-    "@stacksjs/dns": "^0.70.155",
-    "@stacksjs/email": "^0.70.155",
-    "@stacksjs/enums": "^0.70.155",
-    "@stacksjs/error-handling": "^0.70.155",
-    "@stacksjs/events": "^0.70.155",
-    "@stacksjs/git": "^0.70.155",
+    "@stacksjs/actions": "^0.70.157",
+    "@stacksjs/ai": "^0.70.157",
+    "@stacksjs/alias": "^0.70.157",
+    "@stacksjs/arrays": "^0.70.157",
+    "@stacksjs/auth": "^0.70.157",
+    "@stacksjs/build": "^0.70.157",
+    "@stacksjs/cache": "^0.70.157",
+    "@stacksjs/cli": "^0.70.157",
+    "@stacksjs/clapp": "^0.2.12",
+    "@stacksjs/cloud": "^0.70.157",
+    "@stacksjs/collections": "^0.70.157",
+    "@stacksjs/config": "^0.70.157",
+    "@stacksjs/database": "^0.70.157",
+    "@stacksjs/desktop": "^0.70.157",
+    "@stacksjs/dns": "^0.70.157",
+    "@stacksjs/email": "^0.70.157",
+    "@stacksjs/enums": "^0.70.157",
+    "@stacksjs/error-handling": "^0.70.157",
+    "@stacksjs/events": "^0.70.157",
+    "@stacksjs/git": "^0.70.157",
     "@stacksjs/gitit": "^0.2.5",
-    "@stacksjs/health": "^0.70.155",
+    "@stacksjs/health": "^0.70.157",
     "@stacksjs/dnsx": "^0.2.3",
     "@stacksjs/httx": "^0.1.10",
-    "@stacksjs/lint": "^0.70.155",
-    "@stacksjs/logging": "^0.70.155",
-    "@stacksjs/notifications": "^0.70.155",
-    "@stacksjs/objects": "^0.70.155",
-    "@stacksjs/orm": "^0.70.155",
-    "@stacksjs/path": "^0.70.155",
-    "@stacksjs/payments": "^0.70.155",
-    "@stacksjs/realtime": "^0.70.155",
-    "@stacksjs/router": "^0.70.155",
-    "@stacksjs/rpx": "^0.11.29",
-    "@stacksjs/search-engine": "^0.70.155",
-    "@stacksjs/security": "^0.70.155",
-    "@stacksjs/server": "^0.70.155",
-    "@stacksjs/storage": "^0.70.155",
-    "@stacksjs/strings": "^0.70.155",
-    "@stacksjs/testing": "^0.70.155",
-    "@stacksjs/tunnel": "^0.70.155",
-    "@stacksjs/types": "^0.70.155",
-    "@stacksjs/ui": "^0.70.155",
-    "@stacksjs/utils": "^0.70.155",
-    "@stacksjs/validation": "^0.70.155",
+    "@stacksjs/lint": "^0.70.157",
+    "@stacksjs/logging": "^0.70.157",
+    "@stacksjs/notifications": "^0.70.157",
+    "@stacksjs/objects": "^0.70.157",
+    "@stacksjs/orm": "^0.70.157",
+    "@stacksjs/path": "^0.70.157",
+    "@stacksjs/payments": "^0.70.157",
+    "@stacksjs/realtime": "^0.70.157",
+    "@stacksjs/router": "^0.70.157",
+    "@stacksjs/rpx": "^0.11.31",
+    "@stacksjs/search-engine": "^0.70.157",
+    "@stacksjs/security": "^0.70.157",
+    "@stacksjs/server": "^0.70.157",
+    "@stacksjs/storage": "^0.70.157",
+    "@stacksjs/strings": "^0.70.157",
+    "@stacksjs/testing": "^0.70.157",
+    "@stacksjs/tunnel": "^0.70.157",
+    "@stacksjs/types": "^0.70.157",
+    "@stacksjs/ui": "^0.70.157",
+    "@stacksjs/utils": "^0.70.157",
+    "@stacksjs/validation": "^0.70.157",
     "@stacksjs/ts-cloud": "^0.7.47"
   },
   "devDependencies": {