@stacksjs/rpx 0.11.19 → 0.11.21

package/src/index.ts

@@ -1,161 +0,0 @@
-import { startProxies as startProxiesFunc } from './start'
-
-export { colors } from './colors'
-
-export { config, config as defaultConfig } from './config'
-
-export {
-  addHosts,
-  checkHosts,
-  removeHosts,
-} from './hosts'
-
-export {
-  SHARED_DEV_HOST_CERT_PATH,
-  buildRegistryTlsProxyOptions,
-  checkExistingCertificates,
-  cleanupCertificates,
-  clearSslConfigCache,
-  devSslToSniEntries,
-  forceTrustCertificate,
-  generateCertificate,
-  getRootCAPaths,
-  getSharedDaemonCertPaths,
-  httpsConfig,
-  isCertTrusted,
-  loadSSLConfig,
-} from './https'
-
-export {
-  MACOS_CA_TRUST_FLAGS,
-  MACOS_SYSTEM_KEYCHAIN,
-  RPX_ROOT_CA_COMMON_NAME,
-  getMacosLoginKeychainPath,
-  getMacosTrustKeychains,
-  isRootCaFingerprintInKeychains,
-  isRootCaTrustedForSsl,
-  listCertSha256HashesByCommonName,
-  pruneStaleRootCas,
-  trustRootCaForBrowsers,
-} from './macos-trust'
-
-export {
-  certIncludesSanHostnames,
-  normalizeSha256Fingerprint,
-  parseSha256HashesFromSecurityListing,
-  readCertCommonName,
-  readCertSha256Fingerprint,
-  verifyHttpsChain,
-} from './cert-inspect'
-
-export { DefaultPortManager, findAvailablePort, isPortInUse, portManager } from './port-manager'
-
-export {
-  gcStaleEntries,
-  getRegistryDir,
-  isPidAlive,
-  isValidId,
-  readAll,
-  readEntry,
-  removeEntry,
-  watchRegistry,
-  writeEntry,
-} from './registry'
-
-export type { RegistryEntry, WatchHandle, WatchOptions } from './registry'
-
-export {
-  DNS_PORT,
-  RPX_RESOLVER_MARKER,
-  contentLooksLikeRpxResolver,
-  isDnsServerRunning,
-  reconcileStaleDevelopmentDns,
-  removeLegacyTldResolvers,
-  removeResolver,
-  resolverFilePath,
-  setupDevelopmentDns,
-  setupResolver,
-  startDnsServer,
-  stopDnsServer,
-  syncDevelopmentDnsFromRegistry,
-  tearDownDevelopmentDns,
-} from './dns'
-
-export type { DevelopmentDnsOptions } from './dns'
-
-export {
-  DNS_STATE_VERSION,
-  LEGACY_TLD_RESOLVER_LABELS,
-  devDomainsFromHosts,
-  normalizeDevDomain,
-  resolverBasenameForDomain,
-  resolverBasenamesForDomains,
-} from './dns-state'
-
-export {
-  acquireDaemonLock,
-  defaultDaemonSpawnCommand,
-  ensureDaemonRunning,
-  getDaemonPidPath,
-  getDaemonRpxDir,
-  isDaemonRunning,
-  readDaemonPid,
-  reconcileDevelopmentDnsOnIdle,
-  releaseDaemonLock,
-  runDaemon,
-  stopDaemon,
-} from './daemon'
-
-export type {
-  DaemonHandle,
-  DaemonOptions,
-  EnsureDaemonOptions,
-  EnsureDaemonResult,
-  StopDaemonOptions,
-  StopDaemonResult,
-} from './daemon'
-
-export { createProxyFetchHandler, createProxyWebSocketHandler, stripBasePath } from './proxy-handler'
-export type { GetRoute, ProxyFetchHandler, ProxyRoute, ProxyServer } from './proxy-handler'
-
-export { isWildcardPattern, matchesWildcard, matchHost } from './host-match'
-
-export { createOriginGuard } from './origin-guard'
-export type { OriginGuard, OriginGuardOptions } from './origin-guard'
-
-export {
-  buildHostRoutes,
-  matchHostList,
-  matchHostRoute,
-  normalizePathPrefix,
-  pathPrefixMatches,
-} from './host-routes'
-export type { HostRoutes, PathRoute } from './host-routes'
-
-export {
-  contentTypeFor,
-  resolveStaticFile,
-  resolveStaticRoute,
-  safeRelativePath,
-  serveStaticFile,
-} from './static-files'
-export type { ResolvedStaticRoute, StaticResolution } from './static-files'
-
-export { buildSniTlsConfig, serverNameFromCertFilename } from './sni'
-export type { SniTlsEntry } from './sni'
-
-export { isLikelyHostname, matchesAllowedSuffix, OnDemandCertManager } from './on-demand'
-export type { CertIssuer, OnDemandCertManagerOptions } from './on-demand'
-
-export { deriveIdFromTarget, runViaDaemon } from './daemon-runner'
-export type { DaemonRunnerOptions, DaemonRunnerProxy } from './daemon-runner'
-
-export { cleanup } from './start'
-
-export { startProxies, startProxy, startServer } from './start'
-
-export * from './types'
-
-export * from './utils'
-
-export default startProxiesFunc

package/src/logger.ts

@@ -1,19 +0,0 @@
-export const log: {
-  info: (...args: unknown[]) => void
-  success: (...args: unknown[]) => void
-  warn: (...args: unknown[]) => void
-  error: (...args: unknown[]) => void
-  debug: (...args: unknown[]) => void
-  log: (...args: unknown[]) => void
-  start: (...args: unknown[]) => void
-  box: (...args: unknown[]) => void
-} = {
-  info: (...args: unknown[]) => console.log('[info]', ...args),
-  success: (...args: unknown[]) => console.log('[success]', ...args),
-  warn: (...args: unknown[]) => console.warn('[warn]', ...args),
-  error: (...args: unknown[]) => console.error('[error]', ...args),
-  debug: (...args: unknown[]) => console.debug('[debug]', ...args),
-  log: (...args: unknown[]) => console.log(...args),
-  start: (...args: unknown[]) => console.log('[start]', ...args),
-  box: (...args: unknown[]) => console.log('[box]', ...args),
-}

package/src/macos-trust.ts

@@ -1,175 +0,0 @@
-import { execSync } from 'node:child_process'
-import { homedir } from 'node:os'
-import { join } from 'node:path'
-import { readCertSha256Fingerprint } from './cert-inspect'
-import { debugLog, execSudoSync } from './utils'
-
-/** Chrome/Edge need SSL + basic trust policies — plain trustRoot often leaves "trust settings: 0". */
-export const MACOS_CA_TRUST_FLAGS = '-d -r trustRoot -p ssl -p basic'
-
-export const MACOS_SYSTEM_KEYCHAIN = '/Library/Keychains/System.keychain'
-
-/** Default CN label for the shared rpx Root CA in macOS keychain listings. */
-export const RPX_ROOT_CA_COMMON_NAME = 'rpx.localhost'
-
-export function getMacosLoginKeychainPath(): string {
-  return join(homedir(), 'Library/Keychains/login.keychain-db')
-}
-
-export function getMacosTrustKeychains(): string[] {
-  return [MACOS_SYSTEM_KEYCHAIN, getMacosLoginKeychainPath()]
-}
-
-export interface ListCertsByCommonNameOptions {
-  keychain: string
-  commonName?: string
-}
-
-export function listCertSha256HashesByCommonName(
-  keychain: string,
-  commonName: string = RPX_ROOT_CA_COMMON_NAME,
-): string[] {
-  const listing = execSync(
-    `security find-certificate -a -c "${commonName}" -Z "${keychain}" 2>/dev/null || true`,
-    { encoding: 'utf8' },
-  )
-  const hashes: string[] = []
-  for (const line of listing.split('\n')) {
-    const match = line.match(/SHA-256 hash:\s*([A-F0-9]+)/i)
-    if (match)
-      hashes.push(match[1]!.toUpperCase())
-  }
-  return hashes
-}
-
-export interface PruneStaleRootCasOptions {
-  caPath: string
-  commonName?: string
-  keychains?: string[]
-  verbose?: boolean
-}
-
-/**
- * Remove older rpx Root CA copies from keychains, keeping only the fingerprint
- * that matches the on-disk `caPath` file.
- */
-export function pruneStaleRootCas(options: PruneStaleRootCasOptions): void {
-  if (process.platform !== 'darwin')
-    return
-
-  const keep = readCertSha256Fingerprint(options.caPath)
-  if (!keep)
-    return
-
-  const commonName = options.commonName ?? RPX_ROOT_CA_COMMON_NAME
-  const keychains = options.keychains ?? getMacosTrustKeychains()
-
-  for (const keychain of keychains) {
-    for (const hash of listCertSha256HashesByCommonName(keychain, commonName)) {
-      if (hash === keep)
-        continue
-      try {
-        if (keychain.startsWith('/Library'))
-          execSudoSync(`security delete-certificate -Z ${hash} "${keychain}"`)
-        else
-          execSync(`security delete-certificate -Z ${hash} "${keychain}"`, { stdio: 'ignore' })
-        debugLog('ssl', `Removed stale Root CA ${hash} from ${keychain}`, options.verbose)
-      }
-      catch { /* already removed */ }
-    }
-  }
-}
-
-/**
- * True when the Root CA is trusted for SSL to `serverName` (macOS verify-cert).
- * On other platforms, falls back to fingerprint presence in trust stores.
- */
-export function isRootCaTrustedForSsl(
-  caPath: string,
-  serverName: string,
-  options?: { verbose?: boolean },
-): boolean {
-  if (process.platform !== 'darwin')
-    return isRootCaFingerprintInKeychains(caPath, options)
-
-  try {
-    const out = execSync(
-      `security verify-cert -c "${caPath}" -s "${serverName}" -l -L -R ssl 2>&1`,
-      { encoding: 'utf8' },
-    )
-    const ok = out.includes('successful')
-    debugLog('ssl', `verify-cert ${serverName}: ${ok ? 'trusted' : 'not trusted'}`, options?.verbose)
-    return ok
-  }
-  catch {
-    return false
-  }
-}
-
-export function isRootCaFingerprintInKeychains(
-  caPath: string,
-  options?: { verbose?: boolean },
-): boolean {
-  const fp = readCertSha256Fingerprint(caPath)
-  if (!fp)
-    return false
-
-  for (const keychain of getMacosTrustKeychains()) {
-    try {
-      const listing = execSync(`security find-certificate -a -Z "${keychain}" 2>/dev/null || true`, { encoding: 'utf8' })
-      for (const line of listing.split('\n')) {
-        if (line.toUpperCase().includes('SHA-256')) {
-          const lineFp = line.split('=').pop()!.replace(/SHA-256\s+hash:\s*/gi, '').replace(/:/g, '').trim().toUpperCase()
-          if (lineFp === fp) {
-            debugLog('ssl', `Root CA fingerprint found in ${keychain}`, options?.verbose)
-            return true
-          }
-        }
-      }
-    }
-    catch { /* try next keychain */ }
-  }
-
-  return false
-}
-
-export interface TrustRootCaForBrowsersOptions {
-  serverName: string
-  commonName?: string
-  verbose?: boolean
-}
-
-/**
- * Install the Root CA into login + system keychains with SSL/basic policies,
- * pruning stale copies first. Returns true when SSL verification succeeds or
- * the cert fingerprint is present in a keychain.
- */
-export function trustRootCaForBrowsers(
-  caPath: string,
-  options: TrustRootCaForBrowsersOptions,
-): boolean {
-  if (process.platform !== 'darwin')
-    return false
-
-  const serverName = options.serverName
-  pruneStaleRootCas({ caPath, commonName: options.commonName, verbose: options.verbose })
-
-  const loginKeychain = getMacosLoginKeychainPath()
-  try {
-    execSync(
-      `security add-trusted-cert ${MACOS_CA_TRUST_FLAGS} -k "${loginKeychain}" "${caPath}"`,
-      { stdio: 'ignore' },
-    )
-  }
-  catch { /* may already exist — re-apply trust below */ }
-
-  try {
-    execSudoSync(`security add-trusted-cert ${MACOS_CA_TRUST_FLAGS} -k ${MACOS_SYSTEM_KEYCHAIN} "${caPath}"`)
-  }
-  catch {
-    return false
-  }
-
-  return isRootCaTrustedForSsl(caPath, serverName, { verbose: options.verbose })
-    || isRootCaFingerprintInKeychains(caPath, { verbose: options.verbose })
-}

package/src/on-demand.ts

@@ -1,264 +0,0 @@
-/**
- * On-demand TLS for rpx: issue a real (Let's Encrypt, http-01) certificate for
- * an unknown host the first time it's needed, gated by an `ask` callback and/or
- * an `allowedSuffixes` allowlist.
- *
- * ## The Bun limitation this works around (verified on Bun 1.3.14 + 1.4.0)
- *
- * Bun.serve has **no working `SNICallback`**, and `server.reload({ tls })` does
- * **NOT** update certificates at runtime. So rpx cannot mint a cert *during* the
- * TLS handshake (the way Caddy's on-demand TLS does). Instead this manager
- * implements on-demand as **ask-gated issuance + listener recreate**:
- *
- *   - rpx serves the ACME `http-01` challenge from its own `:80` listener (same
- *     process, so the challenge token is reachable the instant we register it).
- *   - issuance is triggered before the HTTPS request — either reactively from
- *     the `:80` handler (first plaintext hit for the host), or programmatically
- *     via {@link OnDemandCertManager.ensureCert} (e.g. a tunnel server
- *     pre-warming a subdomain's cert at registration time).
- *   - once a cert is issued it's written to `certsDir` and added to the live SNI
- *     set; the manager then asks its host to rebuild the `:443` listener so the
- *     new cert is actually served (a sub-second `server.stop()` + re-`Bun.serve`).
- *
- * Concurrency: per-host in-flight de-dupe means N concurrent `ensureCert(host)`
- * calls drive exactly one ACME order. Failures are logged and negatively cached
- * for a short window so we don't hammer Let's Encrypt (which is rate-limited).
- */
-import type { Http01Store, ObtainCertificateOptions, ObtainCertificateResult } from '@stacksjs/tlsx'
-import type { OnDemandTlsConfig } from './types'
-import type { SniTlsEntry } from './sni'
-import * as fsp from 'node:fs/promises'
-import * as path from 'node:path'
-import { defaultHttp01Store, obtainCertificate } from '@stacksjs/tlsx'
-import { debugLog } from './utils'
-
-/**
- * The issuance function the manager calls. Defaults to tlsx's
- * {@link obtainCertificate}; tests inject a stub so the suite never touches
- * Let's Encrypt.
- */
-export type CertIssuer = (options: ObtainCertificateOptions) => Promise<ObtainCertificateResult>
-
-export interface OnDemandCertManagerOptions {
-  /** Resolved on-demand config (already merged with defaults). */
-  config: OnDemandTlsConfig
-  /** Where issued PEMs are written / read. Required (resolved by the caller). */
-  certsDir: string
-  /** Initial SNI set to seed from (e.g. productionCerts already on disk). */
-  initial?: SniTlsEntry[]
-  /**
-   * Called after a new cert is added to the SNI set so the host can rebuild its
-   * `:443` listener (Bun can't hot-update tls — see file header).
-   */
-  onCertAdded?: (entries: SniTlsEntry[]) => void | Promise<void>
-  /** http-01 challenge store rpx's `:80` listener serves from. */
-  http01Store?: Http01Store
-  /** Inject the issuer (tests stub this). Defaults to tlsx `obtainCertificate`. */
-  issuer?: CertIssuer
-  verbose?: boolean
-  /** How long to negatively-cache a failed host before retrying. Default 60s. */
-  negativeCacheMs?: number
-}
-
-const DEFAULT_NEGATIVE_CACHE_MS = 60_000
-
-/**
- * True if `host` is covered by the `allowedSuffixes` allowlist: it equals a
- * suffix, or is a subdomain of one (`a.example.com` for suffix `example.com`).
- */
-export function matchesAllowedSuffix(host: string, suffixes: string[] | undefined): boolean {
-  if (!suffixes || suffixes.length === 0)
-    return false
-  return suffixes.some((s) => {
-    const suffix = s.startsWith('.') ? s.slice(1) : s
-    return host === suffix || host.endsWith(`.${suffix}`)
-  })
-}
-
-/** Strict-ish hostname guard so we never feed junk Host headers into ACME. */
-export function isLikelyHostname(host: string): boolean {
-  if (!host || host.length > 253)
-    return false
-  if (host.includes('/') || host.includes(':') || host.includes(' '))
-    return false
-  // No wildcards (http-01 can't do them) and must contain a dot (a real FQDN).
-  if (host.startsWith('*'))
-    return false
-  return /^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,}$/i.test(host)
-}
-
-/**
- * Holds the live SNI cert set and lazily issues certs for approved hosts.
- *
- * The set is keyed by SNI server name; `ensureCert(host)` is the entry point for
- * both the reactive `:80` path and programmatic pre-warming.
- */
-export class OnDemandCertManager {
-  private readonly config: OnDemandTlsConfig
-  private readonly certsDir: string
-  private readonly onCertAdded?: (entries: SniTlsEntry[]) => void | Promise<void>
-  private readonly http01Store: Http01Store
-  private readonly issuer: CertIssuer
-  private readonly verbose: boolean
-  private readonly negativeCacheMs: number
-
-  /** Live SNI set, keyed by server name. */
-  private readonly certs = new Map<string, SniTlsEntry>()
-  /** In-flight issuances, keyed by host — de-dupes concurrent ensureCert calls. */
-  private readonly inFlight = new Map<string, Promise<boolean>>()
-  /** host → epoch-ms until which we refuse to retry after a failure. */
-  private readonly negativeCache = new Map<string, number>()
-
-  constructor(opts: OnDemandCertManagerOptions) {
-    this.config = opts.config
-    this.certsDir = opts.certsDir
-    this.onCertAdded = opts.onCertAdded
-    this.http01Store = opts.http01Store ?? defaultHttp01Store
-    this.issuer = opts.issuer ?? obtainCertificate
-    this.verbose = opts.verbose ?? false
-    this.negativeCacheMs = opts.negativeCacheMs ?? DEFAULT_NEGATIVE_CACHE_MS
-    for (const e of opts.initial ?? [])
-      this.certs.set(e.serverName, e)
-  }
-
-  /** The http-01 store rpx's `:80` listener must serve challenge tokens from. */
-  get challengeStore(): Http01Store {
-    return this.http01Store
-  }
-
-  /** A snapshot of the current SNI set for `Bun.serve({ tls })`. */
-  sniEntries(): SniTlsEntry[] {
-    return Array.from(this.certs.values())
-  }
-
-  /** True if a usable cert for `host` is already loaded in the live set. */
-  hasCert(host: string): boolean {
-    return this.certs.has(host)
-  }
-
-  /**
-   * Decide whether rpx may issue a cert for `host`. A host is approved when the
-   * `allowedSuffixes` allowlist matches OR `ask(host)` resolves truthy. With
-   * neither configured, every host is refused (fail-closed, anti-abuse).
-   */
-  async isApproved(host: string): Promise<boolean> {
-    if (!isLikelyHostname(host))
-      return false
-    if (matchesAllowedSuffix(host, this.config.allowedSuffixes))
-      return true
-    if (this.config.ask) {
-      try {
-        return await this.config.ask(host)
-      }
-      catch (err) {
-        debugLog('on-demand', `ask(${host}) threw: ${(err as Error).message}`, this.verbose)
-        return false
-      }
-    }
-    return false
-  }
-
-  /**
-   * Ensure a cert exists for `host`, issuing one via ACME http-01 if needed.
-   *
-   * No-ops (resolves `true`) when a cert is already loaded. Otherwise checks
-   * approval, then drives issuance — de-duping concurrent calls for the same
-   * host so only one ACME order runs. Resolves `false` when refused or on a
-   * negatively-cached failure. Never throws; errors are logged + cached.
-   */
-  async ensureCert(host: string): Promise<boolean> {
-    if (!this.config.enabled)
-      return false
-    if (this.certs.has(host))
-      return true
-
-    const inFlight = this.inFlight.get(host)
-    if (inFlight)
-      return inFlight
-
-    const until = this.negativeCache.get(host)
-    if (until !== undefined && Date.now() < until) {
-      debugLog('on-demand', `${host} negatively cached for ${until - Date.now()}ms`, this.verbose)
-      return false
-    }
-
-    const promise = this.issue(host).finally(() => {
-      this.inFlight.delete(host)
-    })
-    this.inFlight.set(host, promise)
-    return promise
-  }
-
-  private async issue(host: string): Promise<boolean> {
-    // A concurrent caller may have already loaded it while we were queued.
-    if (this.certs.has(host))
-      return true
-
-    // Maybe it's already on disk (issued by a prior run) — adopt without ACME.
-    if (await this.loadFromDisk(host))
-      return true
-
-    if (!(await this.isApproved(host))) {
-      debugLog('on-demand', `refused issuance for ${host} (not approved)`, this.verbose)
-      return false
-    }
-
-    try {
-      debugLog('on-demand', `issuing cert for ${host} (staging=${this.config.staging ?? false})`, this.verbose)
-      const result = await this.issuer({
-        domains: [host],
-        method: 'http-01',
-        http01Store: this.http01Store,
-        email: this.config.email,
-        staging: this.config.staging,
-      })
-      await this.persist(host, result.fullChainPem, result.keyPem)
-      const entry: SniTlsEntry = { serverName: host, cert: result.fullChainPem, key: result.keyPem }
-      this.certs.set(host, entry)
-      this.negativeCache.delete(host)
-      debugLog('on-demand', `issued + installed cert for ${host}`, this.verbose)
-      await this.onCertAdded?.(this.sniEntries())
-      return true
-    }
-    catch (err) {
-      this.negativeCache.set(host, Date.now() + this.negativeCacheMs)
-      debugLog('on-demand', `issuance for ${host} failed: ${(err as Error).message}`, this.verbose)
-      return false
-    }
-  }
-
-  /** Try to load an already-present `<host>.{crt,key}` pair from `certsDir`. */
-  private async loadFromDisk(host: string): Promise<boolean> {
-    const { certPath, keyPath } = this.pathsFor(host)
-    try {
-      const [cert, key] = await Promise.all([
-        fsp.readFile(certPath, 'utf8'),
-        fsp.readFile(keyPath, 'utf8'),
-      ])
-      const entry: SniTlsEntry = { serverName: host, cert, key }
-      this.certs.set(host, entry)
-      debugLog('on-demand', `adopted existing on-disk cert for ${host}`, this.verbose)
-      await this.onCertAdded?.(this.sniEntries())
-      return true
-    }
-    catch {
-      return false
-    }
-  }
-
-  private pathsFor(host: string): { certPath: string, keyPath: string } {
-    return {
-      certPath: path.join(this.certsDir, `${host}.crt`),
-      keyPath: path.join(this.certsDir, `${host}.key`),
-    }
-  }
-
-  private async persist(host: string, certPem: string, keyPem: string): Promise<void> {
-    await fsp.mkdir(this.certsDir, { recursive: true }).catch(() => {})
-    const { certPath, keyPath } = this.pathsFor(host)
-    await Promise.all([
-      fsp.writeFile(certPath, certPem, 'utf8'),
-      fsp.writeFile(keyPath, keyPem, { encoding: 'utf8', mode: 0o600 }),
-    ])
-  }
-}