@stacksjs/rpx 0.11.19 → 0.11.21

package/src/cert-inspect.ts

@@ -1,69 +0,0 @@
-import { execSync } from 'node:child_process'
-
-/**
- * Normalize openssl / security fingerprint output to uppercase hex without separators.
- */
-export function normalizeSha256Fingerprint(raw: string): string {
-  const value = raw.includes('=') ? raw.split('=').pop()! : raw
-  return value.replace(/SHA-256\s+hash:\s*/gi, '').replace(/:/g, '').trim().toUpperCase()
-}
-
-export function readCertSha256Fingerprint(certPath: string): string | null {
-  try {
-    const out = execSync(`openssl x509 -noout -fingerprint -sha256 -in "${certPath}"`, { encoding: 'utf8' })
-    return normalizeSha256Fingerprint(out)
-  }
-  catch {
-    return null
-  }
-}
-
-export function readCertCommonName(certPath: string): string | null {
-  try {
-    const subject = execSync(`openssl x509 -in "${certPath}" -noout -subject -nameopt RFC2253`, { encoding: 'utf8' })
-    const match = subject.match(/CN=([^,/]+)/)
-    return match?.[1]?.trim() ?? null
-  }
-  catch {
-    return null
-  }
-}
-
-export function certIncludesSanHostnames(certPath: string, hostnames: string[]): boolean {
-  try {
-    const text = execSync(`openssl x509 -in "${certPath}" -noout -text`, { encoding: 'utf8' })
-    return hostnames.every(host => text.includes(`DNS:${host}`))
-  }
-  catch {
-    return false
-  }
-}
-
-/**
- * True when :443 (or `port`) presents a chain trusted by `caPath` for `domain`.
- */
-export function verifyHttpsChain(domain: string, caPath: string, port = 443): boolean {
-  try {
-    const out = execSync(
-      `echo | openssl s_client -connect ${domain}:${port} -servername ${domain} -CAfile "${caPath}" 2>/dev/null | grep "Verify return code"`,
-      { encoding: 'utf8', timeout: 4000 },
-    )
-    return out.includes(': 0 (ok)')
-  }
-  catch {
-    return false
-  }
-}
-
-/**
- * Parse `security find-certificate -Z` listing lines into SHA-256 hashes.
- */
-export function parseSha256HashesFromSecurityListing(listing: string): string[] {
-  const hashes: string[] = []
-  for (const line of listing.split('\n')) {
-    const match = line.match(/SHA-256 hash:\s*([A-F0-9]+)/i)
-    if (match)
-      hashes.push(match[1]!.toUpperCase())
-  }
-  return hashes
-}

package/src/colors.ts

@@ -1,13 +0,0 @@
-const c = (open: number, close: number): (str: string) => string => (str: string): string => `\x1B[${open}m${str}\x1B[${close}m`
-
-export const colors: {
-  bold: (str: string) => string
-  dim: (str: string) => string
-  green: (str: string) => string
-  cyan: (str: string) => string
-} = {
-  bold: c(1, 22),
-  dim: c(2, 22),
-  green: c(32, 39),
-  cyan: c(36, 39),
-}

package/src/config.ts

@@ -1,45 +0,0 @@
-import type { ProxyConfig } from './types'
-import { homedir } from 'node:os'
-import { join, resolve } from 'node:path'
-import { loadConfig } from 'bunfig'
-
-export const defaultConfig: ProxyConfig = {
-  from: 'localhost:5173',
-  to: 'stacks.localhost',
-  cleanUrls: false,
-  https: {
-    basePath: '',
-    caCertPath: join(homedir(), '.stacks', 'ssl', `stacks.localhost.ca.crt`),
-    certPath: join(homedir(), '.stacks', 'ssl', `stacks.localhost.crt`),
-    keyPath: join(homedir(), '.stacks', 'ssl', `stacks.localhost.crt.key`),
-  },
-  cleanup: {
-    certs: false,
-    hosts: false,
-  },
-  vitePluginUsage: false,
-  verbose: true,
-  changeOrigin: false,
-  /**
-   * If true, will regenerate and re-trust certs that exist but are not trusted by the system.
-   * If false, will use the existing cert even if not trusted (may result in browser warnings).
-   */
-  regenerateUntrustedCerts: true,
-}
-
-// Lazy-loaded config to avoid top-level await (enables bun --compile)
-let _config: ProxyConfig | null = null
-
-export async function getConfig(): Promise<ProxyConfig> {
-  if (!_config) {
-    _config = await loadConfig({
-  name: 'rpx',
-  cwd: resolve(__dirname, '..'),
-  defaultConfig,
-})
-  }
-  return _config
-}
-
-// For backwards compatibility - synchronous access with default fallback
-export const config: ProxyConfig = defaultConfig

package/src/daemon-runner.ts

@@ -1,180 +0,0 @@
-/**
- * Bridges the `startProxy` / `startProxies` entrypoints to the long-running
- * rpx daemon. When `viaDaemon: true` is set on a proxy config (or
- * `--via-daemon` is passed to the CLI), we don't bind our own `:443` —
- * instead we:
- *
- *   1. Write a registry entry per proxy under `~/.stacks/rpx/registry.d`.
- *   2. Ensure the daemon is running (lazy-spawn if needed).
- *   3. Block until SIGINT/SIGTERM, then unregister our entries.
- *
- * The daemon's PID-GC reaps anything we miss if this process dies `kill -9`.
- */
-import type { PathRewrite, StaticRouteConfig } from './types'
-import * as fs from 'node:fs'
-import * as path from 'node:path'
-import * as process from 'node:process'
-import { ensureDaemonRunning } from './daemon'
-import { log } from './logger'
-import { getRegistryDir, isValidId, removeEntry, writeEntry } from './registry'
-import { debugLog } from './utils'
-
-export interface DaemonRunnerProxy {
-  id?: string
-  /** Upstream `host:port`. Optional when `static` is set. */
-  from?: string
-  to: string
-  /**
-   * Optional path prefix this route owns under the host `to` (e.g. `'/api'`).
-   * Lets several routes share one host on different paths. When two proxies
-   * share `to` but differ by `path`, give each an explicit `id` (or rely on the
-   * path being folded into the derived id).
-   */
-  path?: string
-  cleanUrls?: boolean
-  changeOrigin?: boolean
-  pathRewrites?: PathRewrite[]
-  /** Serve a local directory for this route instead of proxying. */
-  static?: string | StaticRouteConfig
-}
-
-export interface DaemonRunnerOptions {
-  proxies: DaemonRunnerProxy[]
-  verbose?: boolean
-  /** Override the registry dir (tests). Defaults to `~/.stacks/rpx/registry.d`. */
-  registryDir?: string
-  /** Override the rpx state dir (tests). Defaults to `~/.stacks/rpx`. */
-  rpxDir?: string
-  /**
-   * Skip the blocking await + signal handlers. Tests use this to register
-   * entries, verify, and tear down without keeping the test runner alive.
-   */
-  detached?: boolean
-  /** Override the daemon spawn command (tests). */
-  spawnCommand?: string[]
-  /** Passed through to `ensureDaemonRunning` (default 5000ms). */
-  startupTimeoutMs?: number
-  /** Extra env for the daemon child (e.g. `SUDO_PASSWORD`). */
-  spawnEnv?: Record<string, string>
-  /**
-   * When true, registry entries omit `pid` so they persist until
-   * `rpx unregister` — avoids PID-GC dropping routes when the registering
-   * process is short-lived (e.g. a CLI wrapper).
-   */
-  persistent?: boolean
-}
-
-/**
- * Sanitize an arbitrary `to` host into a valid registry id. Drops anything
- * that isn't `[a-zA-Z0-9._-]`, collapses runs to a single dash, and trims
- * leading/trailing dashes. Falls back to `'rpx'` if nothing's left.
- */
-export function deriveIdFromTarget(to: string, routePath?: string): string {
-  // Fold the path into the id so several routes on the same host don't collide
-  // (e.g. `stacksjs.com` + `/api` and `stacksjs.com` + `/docs`).
-  const base = routePath && routePath !== '/' ? `${to}${routePath}` : to
-  const cleaned = base.replace(/[^a-zA-Z0-9._-]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 128)
-  return cleaned.length > 0 ? cleaned : 'rpx'
-}
-
-/**
- * Register every proxy with the daemon and (unless `detached`) block until a
- * shutdown signal arrives. Throws if any id collides or the daemon fails to
- * spawn.
- */
-export async function runViaDaemon(opts: DaemonRunnerOptions): Promise<void> {
-  if (opts.proxies.length === 0)
-    throw new Error('runViaDaemon: no proxies provided')
-
-  const verbose = opts.verbose ?? false
-  const registryDir = opts.registryDir
-  const ids = new Set<string>()
-
-  // Resolve and validate all ids up front so we don't half-register and bail.
-  const resolved = opts.proxies.map((p) => {
-    const id = p.id ?? deriveIdFromTarget(p.to, p.path)
-    if (!isValidId(id))
-      throw new Error(`invalid registry id "${id}" derived from to="${p.to}"`)
-    if (ids.has(id))
-      throw new Error(`duplicate registry id "${id}" — set an explicit \`id\` on one of the proxies`)
-    ids.add(id)
-    return { ...p, id }
-  })
-
-  const createdAt = new Date().toISOString()
-  for (const p of resolved) {
-    await writeEntry({
-      id: p.id,
-      from: p.from,
-      to: p.to,
-      path: p.path,
-      pid: opts.persistent ? undefined : process.pid,
-      cwd: process.cwd(),
-      createdAt,
-      cleanUrls: p.cleanUrls,
-      changeOrigin: p.changeOrigin,
-      pathRewrites: p.pathRewrites,
-      static: p.static,
-    }, registryDir, verbose)
-  }
-
-  const result = await ensureDaemonRunning({
-    rpxDir: opts.rpxDir,
-    verbose,
-    spawnCommand: opts.spawnCommand,
-    startupTimeoutMs: opts.startupTimeoutMs,
-    spawnEnv: opts.spawnEnv,
-  })
-
-  for (const p of resolved) {
-    const target = p.static
-      ? `static ${typeof p.static === 'string' ? p.static : p.static.dir}`
-      : p.from
-    log.success(`https://${p.to}  →  ${target}`)
-  }
-  log.info(`(via rpx daemon pid=${result.pid}; \`rpx daemon:status\` to inspect)`)
-
-  if (opts.detached)
-    return
-
-  // Cleanup registry entries on shutdown so the daemon's routing table reflects
-  // reality immediately (its PID-GC would catch us eventually, but this is
-  // faster and avoids a stale-route window).
-  let cleaned = false
-  const dirForCleanup = registryDir ?? getRegistryDir()
-  const idsForCleanup = resolved.map(p => p.id)
-
-  const cleanup = async (): Promise<void> => {
-    if (cleaned)
-      return
-    cleaned = true
-    for (const id of idsForCleanup) {
-      await removeEntry(id, registryDir, verbose).catch((err) => {
-        debugLog('runner', `removeEntry(${id}) failed: ${err}`, verbose)
-      })
-    }
-  }
-
-  const onSignal = (sig: NodeJS.Signals): void => {
-    debugLog('runner', `received ${sig}, unregistering ${idsForCleanup.length} entries`, verbose)
-    cleanup().finally(() => process.exit(0))
-  }
-  process.once('SIGINT', onSignal)
-  process.once('SIGTERM', onSignal)
-
-  // Last-resort sync cleanup if the process exits without our signal handlers
-  // running (e.g. a thrown uncaught exception or `process.exit()` from elsewhere).
-  process.once('exit', () => {
-    if (cleaned)
-      return
-    for (const id of idsForCleanup) {
-      try {
-        fs.unlinkSync(path.join(dirForCleanup, `${id}.json`))
-      }
-      catch {}
-    }
-  })
-
-  // Park forever; signal handlers do the actual exiting.
-  await new Promise<void>(() => {})
-}