bunqueue 2.8.6 → 2.8.8

package/dist/infrastructure/server/tcp.js

@@ -11,6 +11,7 @@ import { getRateLimiter } from './rateLimiter';
 import { pack, unpack } from 'msgpackr';
 import { Semaphore, withSemaphore } from '../../shared/semaphore';
 import { SocketWriteQueue } from './socketWriteQueue';
+import { loadTlsOptions } from './tls';
 /** Max concurrent commands per connection for pipelining */
 const MAX_CONCURRENT_PER_CONNECTION = 50;
 /**
@@ -236,10 +237,13 @@ export function createTcpServer(queueManager, config) {
             socket.data.writeQueue.flush(socket);
         },
     };
-    // Create TCP server
+    // Create TCP server (validate TLS files BEFORE binding the port, so a bad
+    // path doesn't leave a half-started listener behind)
+    const tlsOptions = config.tls ? loadTlsOptions(config.tls) : undefined;
     const server = Bun.listen({
         hostname: config.hostname ?? '0.0.0.0',
         port: config.port ?? 6789,
+        ...(tlsOptions && { tls: tlsOptions }),
         socket: socketHandlers,
     });
     return {

package/dist/infrastructure/server/tls.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Server TLS options
+ * Shared by the TCP (Bun.listen) and HTTP (Bun.serve) servers.
+ */
+import type { BunFile } from 'bun';
+/** TLS configuration for a server (paths to PEM files) */
+export interface TlsServerOptions {
+    /** Path to the PEM certificate (or full chain) file */
+    certFile: string;
+    /** Path to the PEM private key file */
+    keyFile: string;
+}
+/**
+ * Validate cert/key paths and build the `tls` option object for
+ * Bun.listen/Bun.serve. Fails fast with a descriptive error so a typo in a
+ * path surfaces at startup instead of as an opaque handshake failure.
+ */
+export declare function loadTlsOptions(tls: TlsServerOptions): {
+    cert: BunFile;
+    key: BunFile;
+};

package/dist/infrastructure/server/tls.js

@@ -0,0 +1,19 @@
+/**
+ * Server TLS options
+ * Shared by the TCP (Bun.listen) and HTTP (Bun.serve) servers.
+ */
+import { existsSync } from 'node:fs';
+/**
+ * Validate cert/key paths and build the `tls` option object for
+ * Bun.listen/Bun.serve. Fails fast with a descriptive error so a typo in a
+ * path surfaces at startup instead of as an opaque handshake failure.
+ */
+export function loadTlsOptions(tls) {
+    if (!existsSync(tls.certFile)) {
+        throw new Error(`TLS cert file not found: ${tls.certFile}`);
+    }
+    if (!existsSync(tls.keyFile)) {
+        throw new Error(`TLS key file not found: ${tls.keyFile}`);
+    }
+    return { cert: Bun.file(tls.certFile), key: Bun.file(tls.keyFile) };
+}

package/dist/main.js

@@ -48,7 +48,7 @@ import { VERSION } from './shared/version';
 import { S3BackupManager } from './infrastructure/backup';
 import { CloudAgent } from './infrastructure/cloud';
 import { SHARD_COUNT } from './shared/hash';
-import { loadConfigFile, resolveServerConfig, resolveCloudConfig, resolveBackupConfig, } from './config';
+import { loadConfigFile, resolveServerConfig, resolveCloudConfig, resolveBackupConfig, resolveTlsServerOptions, } from './config';
 export { defineConfig } from './config';
 /** Print startup banner */
 function printBanner(config, cloudUrl) {
@@ -82,6 +82,7 @@ ${dim}────────────────────────
   ${green}●${reset} HTTP   ${httpDisplay}
   ${yellow}●${reset} Socket ${socketDisplay}
   ${yellow}●${reset} Data   ${config.dataPath ?? 'in-memory'}
+  ${yellow}●${reset} TLS    ${config.tlsCertFile ? `${green}enabled${reset}` : `${dim}disabled${reset}`}
   ${yellow}●${reset} Auth   ${config.authTokens.length > 0 ? `${green}enabled${reset}` : `${dim}disabled${reset}`}
   ${yellow}●${reset} S3 Backup ${config.s3BackupEnabled ? `${green}enabled${reset}` : `${dim}disabled${reset}`}
   ${yellow}●${reset} Cloud  ${cloudUrl ? `${green}enabled${reset} ${dim}→ ${cloudUrl}${reset}` : `${dim}disabled${reset}`}
@@ -108,6 +109,15 @@ async function startServer() {
     }
     // Resolve cloud config
     const cloudConfig = resolveCloudConfig(fileConfig, config.dataPath);
+    // Resolve TLS config — fail fast on partial cert/key before binding anything
+    let tlsConfig;
+    try {
+        tlsConfig = resolveTlsServerOptions(config);
+    }
+    catch (err) {
+        serverLog.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
     printBanner(config, cloudConfig?.url);
     // Create queue manager
     const queueManager = new QueueManager({
@@ -118,6 +128,7 @@ async function startServer() {
         port: config.tcpPort,
         hostname: config.hostname,
         authTokens: config.authTokens,
+        ...(tlsConfig && { tls: tlsConfig }),
     });
     // Start HTTP server
     const httpServer = createHttpServer(queueManager, {
@@ -126,6 +137,7 @@ async function startServer() {
         authTokens: config.authTokens,
         corsOrigins: config.corsOrigins,
         requireAuthForMetrics: config.requireAuthForMetrics,
+        ...(tlsConfig && { tls: tlsConfig }),
     });
     // Initialize S3 backup manager
     let backupManager = null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bunqueue",
-  "version": "2.8.6",
+  "version": "2.8.8",
   "description": "High-performance job queue for Bun & AI agents. SQLite persistence, cron scheduling, priorities, retries, DLQ, webhooks, native MCP server. Zero external dependencies.",
   "type": "module",
   "main": "dist/main.js",