movehat 0.2.4 → 0.2.5

package/src/fork/server.ts

@@ -1,380 +0,0 @@
-import http from 'http';
-import { URL } from 'url';
-import { ForkManager } from './manager.js';
-import { logger } from '../ui/index.js';
-
-export interface ForkServerOptions {
-  /**
-   * Origins allowed to make cross-origin requests. When unset (default),
-   * no `Access-Control-Allow-Origin` header is emitted — any browser
-   * cross-origin read is rejected by the user agent. Setting this to a
-   * non-empty list opts into echoing matching `Origin` request headers
-   * back. Wildcard `'*'` is intentionally NOT supported: cached fork
-   * state may include resources that should not be readable by every
-   * page in the dev's browser.
-   */
-  corsAllowOrigins?: readonly string[];
-}
-
-/**
- * Fork Server - Serves fork data via Movement L1 RPC API
- * Emulates a Movement L1 node using local fork storage
- */
-export class ForkServer {
-  private server: http.Server | null = null;
-  private forkManager: ForkManager;
-  private port: number;
-  private host: string;
-  private readonly corsAllowOrigins: ReadonlySet<string>;
-
-  /**
-   * @param host Interface to bind. Defaults to `127.0.0.1` so cached fork
-   *   state (which may include sensitive resources) is not exposed on the LAN.
-   *   Pass `'0.0.0.0'` only if you intentionally need to expose the server.
-   * @param options Optional CORS allowlist (see {@link ForkServerOptions}).
-   */
-  constructor(
-    forkPath: string,
-    port: number = 8080,
-    host: string = '127.0.0.1',
-    options: ForkServerOptions = {}
-  ) {
-    this.forkManager = new ForkManager(forkPath);
-    this.port = port;
-    this.host = host;
-    this.corsAllowOrigins = new Set(options.corsAllowOrigins ?? []);
-  }
-
-  /**
-   * Set CORS headers for a request when the request's `Origin` is in
-   * the allowlist. No-op otherwise.
-   */
-  private applyCors(req: http.IncomingMessage, res: http.ServerResponse): void {
-    const origin = req.headers.origin;
-    if (typeof origin === 'string' && this.corsAllowOrigins.has(origin)) {
-      res.setHeader('Access-Control-Allow-Origin', origin);
-      res.setHeader('Vary', 'Origin');
-      res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
-      res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
-    }
-  }
-
-  /**
-   * Start the fork server
-   */
-  async start(): Promise<void> {
-    // Load fork metadata
-    this.forkManager.load();
-    const metadata = this.forkManager.getMetadata();
-
-    logger.newline();
-    logger.phase("Fork Server");
-    logger.kv("Network", metadata.network, 2);
-    logger.kv("Chain ID", String(metadata.chainId), 2);
-    logger.kv("Ledger Version", String(metadata.ledgerVersion), 2);
-    logger.kv("Forked at", metadata.createdAt, 2);
-
-    this.server = http.createServer((req, res) => {
-      this.handleRequest(req, res).catch((error) => {
-        // Log full error server-side for diagnostics
-        logger.error(`Error handling request: ${error instanceof Error ? error.message : String(error)}`);
-
-        // Only send response if headers haven't been sent yet
-        if (!res.headersSent) {
-          this.applyCors(req, res);
-
-          // Send generic error response (no internal details exposed)
-          this.sendJSON(res, 500, {
-            message: 'Internal server error',
-            error_code: 'internal_error',
-            vm_error_code: null
-          });
-        }
-      });
-    });
-
-    // Capture the just-assigned server into a non-null local so we don't
-    // have to repeatedly assert `this.server!` (which TS forces because
-    // `http.createServer` returns an unrelated narrow that the field
-    // declaration doesn't track).
-    const server = this.server;
-
-    return new Promise((resolve, reject) => {
-      // Handle server errors (port in use, permission denied, etc.)
-      const onError = (error: NodeJS.ErrnoException) => {
-        if (error.code === 'EADDRINUSE') {
-          reject(new Error(`Port ${this.port} is already in use. Please use a different port with --port <number>`));
-        } else if (error.code === 'EACCES') {
-          reject(new Error(`Permission denied to bind to port ${this.port}. Try using a port above 1024 or run with appropriate permissions.`));
-        } else {
-          reject(new Error(`Failed to start server: ${error.message}`));
-        }
-      };
-
-      // Listen for errors during startup
-      server.once('error', onError);
-
-      server.listen(this.port, this.host, () => {
-        // Remove error listener after successful start
-        server.removeListener('error', onError);
-
-        // IPv6 literals must be wrapped in brackets in URLs (RFC 3986).
-        const isIpv6 = this.host.includes(':');
-        const displayHost =
-          this.host === '0.0.0.0'
-            ? 'localhost'
-            : isIpv6
-              ? `[${this.host}]`
-              : this.host;
-        logger.newline();
-        logger.success(`Fork Server listening on http://${displayHost}:${this.port}`);
-        logger.kv("Bound interface", this.host, 2);
-        logger.kv("Ledger Info", `http://${displayHost}:${this.port}/v1/`, 2);
-        if (this.host === '0.0.0.0') {
-          logger.warning("Server is bound to 0.0.0.0 — fork state is reachable from the LAN.", 2);
-        }
-        logger.newline();
-        logger.info("Press Ctrl+C to stop");
-        resolve();
-      });
-    });
-  }
-
-  /**
-   * Stop the fork server
-   */
-  stop(): Promise<void> {
-    return new Promise((resolve) => {
-      if (this.server) {
-        this.server.close(() => {
-          logger.newline();
-          logger.success("Fork Server stopped");
-          resolve();
-        });
-      } else {
-        resolve();
-      }
-    });
-  }
-
-  /**
-   * Sanitize pathname for error messages to prevent log injection
-   */
-  private sanitizePathname(pathname: string): string {
-    // Remove control characters and newlines
-    const sanitized = pathname.replace(/[\x00-\x1F\x7F]/g, '');
-    // Truncate to reasonable length
-    return sanitized.length > 100 ? sanitized.substring(0, 100) + '...' : sanitized;
-  }
-
-  /**
-   * Handle incoming HTTP requests
-   */
-  private async handleRequest(
-    req: http.IncomingMessage,
-    res: http.ServerResponse
-  ): Promise<void> {
-    const url = new URL(req.url || '/', `http://localhost:${this.port}`);
-    const pathname = url.pathname;
-
-    // Log request — plain so the fork-server access log retains its
-    // grep-friendly line shape (timestamp + method + path, no symbol).
-    logger.plain(`[${new Date().toISOString()}] ${req.method} ${pathname}`);
-
-    this.applyCors(req, res);
-
-    // Handle OPTIONS for CORS preflight
-    if (req.method === 'OPTIONS') {
-      res.writeHead(200);
-      res.end();
-      return;
-    }
-
-    try {
-      // Route requests
-      if (pathname === '/v1' || pathname === '/v1/') {
-        await this.handleLedgerInfo(res);
-      } else if (pathname.match(/^\/v1\/accounts\/0x[a-fA-F0-9]{1,64}$/)) {
-        const address = pathname.split('/').pop()!;
-        await this.handleGetAccount(address, res);
-      } else if (pathname.match(/^\/v1\/accounts\/0x[a-fA-F0-9]{1,64}\/resource\/.+$/)) {
-        const parts = pathname.split('/');
-        const accountIndex = parts.indexOf('accounts') + 1;
-        const resourceIndex = parts.indexOf('resource') + 1;
-        const address = parts[accountIndex];
-        const resourceType = decodeURIComponent(parts.slice(resourceIndex).join('/'));
-        if (!address) {
-          this.send404(res, 'Malformed resource path', 'malformed_path');
-          return;
-        }
-        await this.handleGetResource(address, resourceType, res);
-      } else {
-        // Use regex capture for resources endpoint
-        const resourcesMatch = pathname.match(/^\/v1\/accounts\/(0x[a-fA-F0-9]{1,64})\/resources$/);
-        if (resourcesMatch && resourcesMatch[1]) {
-          const address = resourcesMatch[1];
-          await this.handleGetResources(address, res);
-        } else {
-          // Sanitize pathname to prevent log injection
-          const safePath = this.sanitizePathname(pathname);
-          this.send404(res, `Endpoint not found: ${safePath}`, 'endpoint_not_found');
-        }
-      }
-    } catch (error) {
-      // Log full error server-side for diagnostics
-      logger.error(`Error handling request: ${error instanceof Error ? error.message : String(error)}`);
-
-      // Send generic error to client (don't expose internal details)
-      this.sendError(res, 500, 'Internal server error');
-    }
-  }
-
-  /**
-   * Handle GET /v1/ - Ledger info
-   */
-  private async handleLedgerInfo(res: http.ServerResponse): Promise<void> {
-    const metadata = this.forkManager.getMetadata();
-
-    const ledgerInfo = {
-      chain_id: metadata.chainId,
-      epoch: metadata.epoch,
-      ledger_version: metadata.ledgerVersion,
-      oldest_ledger_version: "0",
-      ledger_timestamp: metadata.timestamp,
-      node_role: "full_node",
-      oldest_block_height: "0",
-      block_height: metadata.blockHeight,
-      git_hash: "movehat-fork"
-    };
-
-    this.sendJSON(res, 200, ledgerInfo, {
-      'x-aptos-chain-id': String(metadata.chainId),
-      'x-aptos-ledger-version': metadata.ledgerVersion,
-      'x-aptos-ledger-oldest-version': '0',
-      'x-aptos-ledger-timestampusec': metadata.timestamp,
-      'x-aptos-epoch': metadata.epoch,
-      'x-aptos-block-height': metadata.blockHeight,
-      'x-aptos-oldest-block-height': '0'
-    });
-  }
-
-  /**
-   * Handle GET /v1/accounts/:address
-   */
-  private async handleGetAccount(
-    address: string,
-    res: http.ServerResponse
-  ): Promise<void> {
-    try {
-      const account = await this.forkManager.getAccount(address);
-
-      this.sendJSON(res, 200, {
-        sequence_number: account.sequenceNumber,
-        authentication_key: account.authenticationKey
-      });
-    } catch (error) {
-      const msg = error instanceof Error ? error.message : String(error);
-      if (msg.includes('not found')) {
-        this.send404(res, `Account not found: ${address}`);
-      } else {
-        throw error;
-      }
-    }
-  }
-
-  /**
-   * Handle GET /v1/accounts/:address/resource/:resourceType
-   */
-  private async handleGetResource(
-    address: string,
-    resourceType: string,
-    res: http.ServerResponse
-  ): Promise<void> {
-    try {
-      const resource = await this.forkManager.getResource(address, resourceType);
-
-      this.sendJSON(res, 200, {
-        type: resourceType,
-        data: resource
-      });
-    } catch (error) {
-      const msg = error instanceof Error ? error.message : String(error);
-      if (msg.includes('not found')) {
-        this.send404(res, `Resource not found: ${resourceType}`, 'resource_not_found');
-      } else {
-        throw error;
-      }
-    }
-  }
-
-  /**
-   * Handle GET /v1/accounts/:address/resources
-   */
-  private async handleGetResources(
-    address: string,
-    res: http.ServerResponse
-  ): Promise<void> {
-    try {
-      const resources = await this.forkManager.getAllResources(address);
-
-      // Convert to array format expected by the Movement L1 API
-      const resourcesArray = Object.entries(resources).map(([type, data]) => ({
-        type,
-        data
-      }));
-
-      this.sendJSON(res, 200, resourcesArray);
-    } catch (error) {
-      const msg = error instanceof Error ? error.message : String(error);
-      if (msg.includes('not found')) {
-        this.send404(res, `Account not found: ${address}`);
-      } else {
-        throw error;
-      }
-    }
-  }
-
-  /**
-   * Send JSON response.
-   * unknown: arbitrary JSON-serializable payload; structural shape varies by
-   * endpoint (account metadata, resource arrays, error envelopes).
-   */
-  private sendJSON(
-    res: http.ServerResponse,
-    status: number,
-    data: unknown,
-    extraHeaders: Record<string, string> = {}
-  ): void {
-    const body = JSON.stringify(data, null, 2);
-
-    res.writeHead(status, {
-      'Content-Type': 'application/json',
-      'Content-Length': Buffer.byteLength(body),
-      ...extraHeaders
-    });
-
-    res.end(body);
-  }
-
-  /**
-   * Send 404 error
-   */
-  private send404(res: http.ServerResponse, message: string, errorCode: string = 'account_not_found'): void {
-    this.sendJSON(res, 404, {
-      message,
-      error_code: errorCode,
-      vm_error_code: null
-    });
-  }
-
-  /**
-   * Send error response
-   */
-  private sendError(res: http.ServerResponse, status: number, message: string): void {
-    this.sendJSON(res, status, {
-      message,
-      error_code: 'internal_error',
-      vm_error_code: null
-    });
-  }
-}

package/src/fork/storage.ts

@@ -1,253 +0,0 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync, readdirSync, unlinkSync } from 'fs';
-import { join } from 'path';
-import type { ForkMetadata, AccountState } from '../types/fork.js';
-import { isHexAddress } from '../utils/address.js';
-
-/**
- * Sanitize address to create a safe filename. Validates the address through
- * the shared `isHexAddress` helper (length 1–64 hex chars, optional `0x`),
- * then rebuilds a canonical `0x…` form. The trailing path-separator check is
- * defense-in-depth: unreachable after `isHexAddress`, but cheap to keep.
- */
-function sanitizeAddressForFilename(address: string): string {
-  if (!isHexAddress(address)) {
-    throw new Error(`Invalid address format: ${address}. Expected hexadecimal string.`);
-  }
-
-  const normalized = address.toLowerCase().replace(/^0x/, '');
-  const safe = `0x${normalized}`;
-
-  if (safe.includes('/') || safe.includes('\\') || safe.includes('..')) {
-    throw new Error(`Address contains invalid characters: ${address}`);
-  }
-
-  return safe;
-}
-
-/**
- * Storage system for fork state
- * Manages the file structure and I/O for fork data
- */
-export class ForkStorage {
-  private forkPath: string;
-
-  constructor(forkPath: string) {
-    this.forkPath = forkPath;
-  }
-
-  /**
-   * Get safe resource file path for an address
-   * Prevents path traversal attacks
-   */
-  private getResourceFilePath(address: string): string {
-    const safeFilename = sanitizeAddressForFilename(address);
-    return join(this.forkPath, 'resources', `${safeFilename}.json`);
-  }
-
-  /**
-   * Initialize fork directory structure
-   */
-  initialize(): void {
-    // Create main fork directory
-    if (!existsSync(this.forkPath)) {
-      mkdirSync(this.forkPath, { recursive: true });
-    }
-
-    // Create subdirectories
-    const resourcesDir = join(this.forkPath, 'resources');
-    if (!existsSync(resourcesDir)) {
-      mkdirSync(resourcesDir, { recursive: true });
-    }
-
-    const cacheDir = join(this.forkPath, 'cache');
-    if (!existsSync(cacheDir)) {
-      mkdirSync(cacheDir, { recursive: true });
-    }
-
-    // Create .gitignore for cache
-    const gitignorePath = join(cacheDir, '.gitignore');
-    if (!existsSync(gitignorePath)) {
-      writeFileSync(gitignorePath, '*\n!.gitignore\n');
-    }
-
-    // Initialize accounts.json if it doesn't exist
-    const accountsPath = join(this.forkPath, 'accounts.json');
-    if (!existsSync(accountsPath)) {
-      writeFileSync(accountsPath, JSON.stringify({}, null, 2));
-    }
-  }
-
-  /**
-   * Check if fork exists
-   */
-  exists(): boolean {
-    return existsSync(this.forkPath) && existsSync(join(this.forkPath, 'metadata.json'));
-  }
-
-  /**
-   * Save fork metadata
-   */
-  saveMetadata(metadata: ForkMetadata): void {
-    const metadataPath = join(this.forkPath, 'metadata.json');
-    writeFileSync(metadataPath, JSON.stringify(metadata, null, 2));
-  }
-
-  /**
-   * Load fork metadata
-   */
-  loadMetadata(): ForkMetadata {
-    const metadataPath = join(this.forkPath, 'metadata.json');
-
-    if (!existsSync(metadataPath)) {
-      throw new Error(`Fork metadata not found at ${metadataPath}`);
-    }
-
-    const data = readFileSync(metadataPath, 'utf-8');
-    return JSON.parse(data);
-  }
-
-  /**
-   * Get account state
-   */
-  getAccount(address: string): AccountState | null {
-    const accountsPath = join(this.forkPath, 'accounts.json');
-
-    if (!existsSync(accountsPath)) {
-      return null;
-    }
-
-    const accounts = JSON.parse(readFileSync(accountsPath, 'utf-8'));
-    return accounts[address] || null;
-  }
-
-  /**
-   * Save account state
-   */
-  saveAccount(address: string, state: AccountState): void {
-    const accountsPath = join(this.forkPath, 'accounts.json');
-
-    let accounts: Record<string, AccountState> = {};
-    if (existsSync(accountsPath)) {
-      accounts = JSON.parse(readFileSync(accountsPath, 'utf-8'));
-    }
-
-    accounts[address] = state;
-    writeFileSync(accountsPath, JSON.stringify(accounts, null, 2));
-  }
-
-  /**
-   * Get resource for an account
-   */
-  getResource(address: string, resourceType: string): unknown | null {
-    const resourceFilePath = this.getResourceFilePath(address);
-
-    if (!existsSync(resourceFilePath)) {
-      return null;
-    }
-
-    const resources = JSON.parse(readFileSync(resourceFilePath, 'utf-8'));
-    return resources[resourceType] || null;
-  }
-
-  /**
-   * Get all resources for an account
-   */
-  getAllResources(address: string): Record<string, unknown> {
-    const resourceFilePath = this.getResourceFilePath(address);
-
-    if (!existsSync(resourceFilePath)) {
-      return {};
-    }
-
-    return JSON.parse(readFileSync(resourceFilePath, 'utf-8'));
-  }
-
-  /**
-   * Save resource for an account
-   */
-  saveResource(address: string, resourceType: string, data: unknown): void {
-    const resourceFilePath = this.getResourceFilePath(address);
-
-    // Ensure resources directory exists
-    const resourcesDir = join(this.forkPath, 'resources');
-    if (!existsSync(resourcesDir)) {
-      mkdirSync(resourcesDir, { recursive: true });
-    }
-
-    let resources: Record<string, unknown> = {};
-    if (existsSync(resourceFilePath)) {
-      resources = JSON.parse(readFileSync(resourceFilePath, 'utf-8'));
-    }
-
-    resources[resourceType] = data;
-    writeFileSync(resourceFilePath, JSON.stringify(resources, null, 2));
-  }
-
-  /**
-   * Save all resources for an account
-   */
-  saveAllResources(address: string, resources: Record<string, unknown>): void {
-    const resourceFilePath = this.getResourceFilePath(address);
-
-    // Ensure resources directory exists
-    const resourcesDir = join(this.forkPath, 'resources');
-    if (!existsSync(resourcesDir)) {
-      mkdirSync(resourcesDir, { recursive: true });
-    }
-
-    writeFileSync(resourceFilePath, JSON.stringify(resources, null, 2));
-  }
-
-  /**
-   * Check if resource is cached
-   */
-  hasResource(address: string, resourceType: string): boolean {
-    return this.getResource(address, resourceType) !== null;
-  }
-
-  /**
-   * List all accounts in the fork
-   */
-  listAccounts(): string[] {
-    const accountsPath = join(this.forkPath, 'accounts.json');
-
-    if (!existsSync(accountsPath)) {
-      return [];
-    }
-
-    const accounts = JSON.parse(readFileSync(accountsPath, 'utf-8'));
-    return Object.keys(accounts);
-  }
-
-  /**
-   * Clear all cached accounts
-   * Resets accounts.json to empty object
-   */
-  clearAccounts(): void {
-    const accountsPath = join(this.forkPath, 'accounts.json');
-    writeFileSync(accountsPath, JSON.stringify({}, null, 2));
-  }
-
-  /**
-   * Clear all cached resources
-   * Deletes all resource files from the resources directory
-   */
-  clearResources(): void {
-    const resourcesDir = join(this.forkPath, 'resources');
-
-    if (!existsSync(resourcesDir)) {
-      return;
-    }
-
-    // Read all files in resources directory
-    const files = readdirSync(resourcesDir);
-
-    // Delete each resource file
-    for (const file of files) {
-      if (file.endsWith('.json')) {
-        const filePath = join(resourcesDir, file);
-        unlinkSync(filePath);
-      }
-    }
-  }
-}