create-stitchkit 0.2.0 → 0.3.1

package/template/tsconfig.json

@@ -5,9 +5,11 @@
     "moduleResolution": "bundler",
     "strict": true,
     "skipLibCheck": true,
+    "types": ["bun", "node"],
     "allowImportingTsExtensions": true,
     "noEmit": true,
     "resolveJsonModule": true,
     "verbatimModuleSyntax": true
-  }
+  },
+  "include": ["scripts/**/*.ts", "e2e/**/*.ts", "playwright.config.ts"]
 }

package/examples/repository/_env.append

@@ -1,3 +0,0 @@
-GITHUB_REPOSITORY=max-listov/stitchkit
-GITHUB_CACHE_TTL_SECONDS=900
-# GITHUB_TOKEN=github_pat_...

package/examples/repository/packages/shared/src/events/repository.ts

@@ -1,9 +0,0 @@
-import type { RepositorySnapshot } from '../schemas/repository';
-
-export interface ServerToClientEvents {
-  'repository:refreshed': (snapshot: RepositorySnapshot) => void;
-}
-
-export interface ClientToServerEvents {
-  'repository:watch': () => void;
-}

package/template/_env

@@ -1,9 +0,0 @@
-NODE_ENV=development
-DATABASE_URL=postgresql://USER:PASSWORD@127.0.0.1:5432/stitchkit_starter
-API_PORT=3211
-WEB_PORT=3210
-NEXT_PUBLIC_API_URL=http://127.0.0.1:3211
-INTERNAL_API_URL=http://127.0.0.1:3211
-NEXT_PUBLIC_WEB_URL=http://127.0.0.1:3210
-LOG_FORMAT=pretty
-CORS_ORIGIN=*

package/template/docs/LAN_HTTPS.md

@@ -1,28 +0,0 @@
-# Trusted LAN HTTPS development
-
-Use this optional mode to test microphone, camera, PWA and WebRTC behavior on a
-physical device connected to the same private network:
-
-```bash
-# Install the maintained local-CA tool first:
-brew install mkcert
-
-bun run dev:lan
-# Multiple private interfaces:
-bun run dev:lan --host 192.168.1.20
-```
-
-The launcher uses mkcert, stores leaf certificates under
-`~/.local/share/<app-slug>/lan-https`, and keeps the CA in mkcert's own CAROOT.
-No certificate or machine address is written into the project. When the chosen
-address changes, only the leaf certificate is renewed.
-
-The command prints the HTTPS web/API URLs and a development-only onboarding URL.
-Open that URL on the phone to download the **public** root certificate. On iOS,
-install the profile and enable full trust under Certificate Trust Settings. On
-Android, install it as a CA certificate; native development builds must opt into
-user-installed roots. The private CA key is never served.
-
-`bun run dev` remains plain localhost HTTP. Production never reads the LAN
-certificate variables or mounts the onboarding routes.
-

package/template/packages/backend/src/transport/lan-onboarding.ts

@@ -1,29 +0,0 @@
-import { env } from '@app/config';
-import type { RawRoute } from 'stitchkit/server';
-
-export function createLanOnboardingRoutes(): RawRoute[] {
-  if (env.NODE_ENV !== 'development' || !env.DEV_HTTPS_CA) return [];
-  const caPath = env.DEV_HTTPS_CA;
-  return [
-    {
-      method: 'GET',
-      path: '/__dev/lan-ca',
-      handler: () =>
-        new Response(Bun.file(caPath), {
-          headers: {
-            'Content-Disposition': 'attachment; filename="stitchkit-lan-root-ca.pem"',
-            'Content-Type': 'application/x-pem-file',
-          },
-        }),
-    },
-    {
-      method: 'GET',
-      path: '/__dev/lan',
-      handler: () =>
-        new Response(
-          `<!doctype html><meta name="viewport" content="width=device-width"><title>LAN HTTPS setup</title><main><h1>Trust this development CA</h1><p><a href="/__dev/lan-ca">Download the public root certificate</a>.</p><h2>iOS</h2><p>Install the downloaded profile, then enable full trust in Settings → General → About → Certificate Trust Settings.</p><h2>Android</h2><p>Install it as a CA certificate. Native development builds must explicitly allow user-installed roots.</p><p>No private key is exposed by this server.</p></main>`,
-          { headers: { 'Content-Type': 'text/html; charset=utf-8' } },
-        ),
-    },
-  ];
-}

package/template/scripts/dev-lan.test.ts

@@ -1,58 +0,0 @@
-import { describe, expect, test } from 'bun:test';
-import { developmentEnvironment } from './dev';
-import { privateLanAddresses, selectLanAddress } from './dev-lan';
-
-describe('LAN HTTPS address selection', () => {
-  test('normal development clears every LAN-only process variable', () => {
-    expect(developmentEnvironment()).toMatchObject({
-      DEV_HTTPS_CA: '',
-      DEV_HTTPS_CERT: '',
-      DEV_HTTPS_KEY: '',
-      NODE_EXTRA_CA_CERTS: '',
-    });
-    expect(developmentEnvironment({ DEV_HTTPS_CERT: '/cert.pem' }).DEV_HTTPS_CERT).toBe(
-      '/cert.pem',
-    );
-  });
-
-  test('keeps private IPv4 interfaces and ignores public/internal addresses', () => {
-    expect(
-      privateLanAddresses({
-        eth0: [
-          {
-            address: '192.168.1.20',
-            netmask: '',
-            family: 'IPv4',
-            mac: '',
-            internal: false,
-            cidr: null,
-          },
-          {
-            address: '8.8.8.8',
-            netmask: '',
-            family: 'IPv4',
-            mac: '',
-            internal: false,
-            cidr: null,
-          },
-        ],
-        lo: [
-          {
-            address: '127.0.0.1',
-            netmask: '',
-            family: 'IPv4',
-            mac: '',
-            internal: true,
-            cidr: null,
-          },
-        ],
-      }),
-    ).toEqual(['192.168.1.20']);
-  });
-
-  test('auto-selects one address and fails on ambiguity', () => {
-    expect(selectLanAddress(['10.0.0.4'])).toBe('10.0.0.4');
-    expect(() => selectLanAddress(['10.0.0.4', '192.168.1.20'])).toThrow('ambiguous');
-    expect(() => selectLanAddress(['10.0.0.4'], '10.0.0.5')).toThrow('unavailable');
-  });
-});

package/template/scripts/dev-lan.ts

@@ -1,176 +0,0 @@
-import { mkdir, readFile, writeFile } from 'node:fs/promises';
-import { homedir, networkInterfaces } from 'node:os';
-import { join } from 'node:path';
-import { z } from 'zod';
-import { appIdentity } from '../packages/config/src/identity';
-import { childEnvironment, env } from '../packages/config/src/server';
-import { runDevelopment } from './dev';
-
-export function privateLanAddresses(
-  interfaces: ReturnType<typeof networkInterfaces>,
-): string[] {
-  const addresses = new Set<string>();
-  for (const entries of Object.values(interfaces)) {
-    for (const entry of entries ?? []) {
-      if (entry.family !== 'IPv4' || entry.internal) continue;
-      const [first, second] = entry.address.split('.').map(Number);
-      if (
-        first === 10 ||
-        (first === 172 && second !== undefined && second >= 16 && second <= 31) ||
-        (first === 192 && second === 168)
-      ) {
-        addresses.add(entry.address);
-      }
-    }
-  }
-  return [...addresses].sort();
-}
-
-export function selectLanAddress(addresses: readonly string[], requested?: string): string {
-  if (requested) {
-    if (!addresses.includes(requested)) {
-      throw new Error(
-        `Requested LAN address ${requested} is unavailable. Detected: ${addresses.join(', ') || '(none)'}`,
-      );
-    }
-    return requested;
-  }
-  if (addresses.length !== 1) {
-    throw new Error(
-      `LAN address is ${addresses.length === 0 ? 'unavailable' : 'ambiguous'}. Use --host <address>. Detected: ${addresses.join(', ') || '(none)'}`,
-    );
-  }
-  return addresses[0];
-}
-
-async function run(command: string[], environment?: Record<string, string>): Promise<string> {
-  const child = Bun.spawn(command, {
-    env: environment ? childEnvironment(environment) : undefined,
-    stdout: 'pipe',
-    stderr: 'inherit',
-  });
-  const output = await new Response(child.stdout).text();
-  const exitCode = await child.exited;
-  if (exitCode !== 0) throw new Error(`${command.join(' ')} failed with exit code ${exitCode}`);
-  return output.trim();
-}
-
-function requestedHost(args: readonly string[]): string | undefined {
-  const index = args.indexOf('--host');
-  if (index === -1) return undefined;
-  const value = args[index + 1];
-  if (!value) throw new Error('--host requires an IPv4 address');
-  return value;
-}
-
-async function ensureCertificates(host: string) {
-  if (!Bun.which('mkcert')) {
-    throw new Error(
-      'dev:lan requires mkcert. Install it with `brew install mkcert` (macOS/Linuxbrew) or the official prebuilt binary, then rerun.',
-    );
-  }
-  const caRoot = await run(['mkcert', '-CAROOT']);
-  const ca = join(caRoot, 'rootCA.pem');
-  if (!(await Bun.file(ca).exists())) await run(['mkcert', '-install']);
-
-  const directory = join(homedir(), '.local', 'share', appIdentity.slug, 'lan-https');
-  const cert = join(directory, 'leaf.pem');
-  const key = join(directory, 'leaf-key.pem');
-  const marker = join(directory, 'host');
-  await mkdir(directory, { recursive: true, mode: 0o700 });
-  const previous = await readFile(marker, 'utf8').catch(() => '');
-  if (
-    previous.trim() !== host ||
-    !(await Bun.file(cert).exists()) ||
-    !(await Bun.file(key).exists())
-  ) {
-    await run([
-      'mkcert',
-      '-cert-file',
-      cert,
-      '-key-file',
-      key,
-      host,
-      'localhost',
-      '127.0.0.1',
-      '::1',
-    ]);
-    await writeFile(marker, `${host}\n`, { mode: 0o600 });
-  }
-  return { ca, cert, key };
-}
-
-async function isPortOccupied(port: number): Promise<boolean> {
-  return new Promise((resolve) => {
-    let settled = false;
-    const finish = (occupied: boolean, socket?: { end(): void }) => {
-      if (settled) return;
-      settled = true;
-      resolve(occupied);
-      socket?.end();
-    };
-    void Bun.connect({
-      hostname: '127.0.0.1',
-      port,
-      socket: {
-        open: (socket) => finish(true, socket),
-        data: () => undefined,
-        close: () => finish(false),
-        error: () => finish(false),
-      },
-    }).catch(() => finish(false));
-  });
-}
-
-async function assertDevelopmentPortsAvailable(): Promise<void> {
-  const processList = await run(['pm2', 'jlist']);
-  const onlineNames = new Set(
-    z
-      .array(
-        z.object({
-          name: z.string(),
-          pm2_env: z.object({ status: z.string() }),
-        }),
-      )
-      .parse(JSON.parse(processList))
-      .filter((process) => process.pm2_env.status === 'online')
-      .map((process) => process.name),
-  );
-  const expected = new Map([
-    [env.WEB_PORT, `${appIdentity.slug}-frontend-dev`],
-    [env.API_PORT, `${appIdentity.slug}-backend-dev`],
-  ]);
-  for (const [port, owner] of expected) {
-    if ((await isPortOccupied(port)) && !onlineNames.has(owner)) {
-      throw new Error(`Port ${port} is occupied by a process outside ${owner}`);
-    }
-  }
-}
-
-if (import.meta.main) {
-  if (env.NODE_ENV !== 'development') {
-    throw new Error('dev:lan is development-only');
-  }
-  const host = selectLanAddress(
-    privateLanAddresses(networkInterfaces()),
-    requestedHost(Bun.argv),
-  );
-  await assertDevelopmentPortsAvailable();
-  const certificates = await ensureCertificates(host);
-  const apiOrigin = `https://${host}:${env.API_PORT}`;
-  const webOrigin = `https://${host}:${env.WEB_PORT}`;
-  await runDevelopment({
-    CORS_ORIGIN: webOrigin,
-    DEV_HTTPS_CA: certificates.ca,
-    DEV_HTTPS_CERT: certificates.cert,
-    DEV_HTTPS_KEY: certificates.key,
-    INTERNAL_API_URL: apiOrigin,
-    NEXT_PUBLIC_API_URL: apiOrigin,
-    NEXT_PUBLIC_WEB_URL: webOrigin,
-    NODE_EXTRA_CA_CERTS: certificates.ca,
-  });
-  console.log(`${appIdentity.name} trusted LAN development is running`);
-  console.log(`Web: ${webOrigin}/en`);
-  console.log(`API: ${apiOrigin}`);
-  console.log(`Device CA setup: ${apiOrigin}/__dev/lan`);
-}