rolldown-perf-kit 0.0.0-stage → 0.1.0

package/lib/parity/png.mjs

@@ -0,0 +1,166 @@
+// Minimal PNG codec for screenshot comparison. The lab has no dependencies, and the
+// only PNG files it ever reads are its own CDP screenshots (8-bit, non-interlaced),
+// so a full decoder is ~100 lines of zlib + scanline unfiltering. Everything decodes
+// to RGBA so the comparison loop never branches on color type.
+
+import zlib from 'node:zlib';
+
+const SIGNATURE = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
+const CHANNELS = { 0: 1, 2: 3, 3: 1, 4: 2, 6: 4 };
+
+/** @returns {{ width: number, height: number, data: Uint8Array }} RGBA, 4 bytes per pixel */
+export function decodePng(buf) {
+  if (buf.length < 8 || !buf.subarray(0, 8).equals(SIGNATURE)) throw new Error('not a PNG');
+  let offset = 8;
+  let header = null;
+  let palette = null;
+  let transparency = null;
+  const idat = [];
+  while (offset + 8 <= buf.length) {
+    const length = buf.readUInt32BE(offset);
+    const type = buf.toString('latin1', offset + 4, offset + 8);
+    const data = buf.subarray(offset + 8, offset + 8 + length);
+    offset += 12 + length;
+    if (type === 'IHDR') {
+      header = {
+        width: data.readUInt32BE(0),
+        height: data.readUInt32BE(4),
+        bitDepth: data[8],
+        colorType: data[9],
+        interlace: data[12],
+      };
+    } else if (type === 'PLTE') palette = data;
+    else if (type === 'tRNS') transparency = data;
+    else if (type === 'IDAT') idat.push(data);
+    else if (type === 'IEND') break;
+  }
+  if (!header) throw new Error('PNG has no IHDR chunk');
+  const { width, height, bitDepth, colorType, interlace } = header;
+  const channels = CHANNELS[colorType];
+  if (bitDepth !== 8 || interlace !== 0 || !channels) {
+    throw new Error(
+      `unsupported PNG (bit depth ${bitDepth}, color type ${colorType}, interlace ${interlace}) - only 8-bit non-interlaced screenshots are read`,
+    );
+  }
+  const raw = zlib.inflateSync(Buffer.concat(idat));
+  const stride = width * channels;
+  if (raw.length < (stride + 1) * height) throw new Error('PNG image data is truncated');
+  const out = new Uint8Array(width * height * 4);
+  let prev = new Uint8Array(stride);
+  let cur = new Uint8Array(stride);
+  for (let y = 0; y < height; y++) {
+    const rowStart = y * (stride + 1);
+    unfilter(raw[rowStart], raw.subarray(rowStart + 1, rowStart + 1 + stride), prev, cur, channels);
+    expandRow(cur, out, y * width * 4, width, colorType, palette, transparency);
+    [prev, cur] = [cur, prev];
+  }
+  return { width, height, data: out };
+}
+
+function paeth(a, b, c) {
+  const p = a + b - c;
+  const pa = Math.abs(p - a);
+  const pb = Math.abs(p - b);
+  const pc = Math.abs(p - c);
+  if (pa <= pb && pa <= pc) return a;
+  return pb <= pc ? b : c;
+}
+
+function unfilter(filter, line, prev, cur, bpp) {
+  const n = line.length;
+  switch (filter) {
+    case 0:
+      cur.set(line);
+      return;
+    case 1:
+      for (let i = 0; i < n; i++) cur[i] = line[i] + (i >= bpp ? cur[i - bpp] : 0);
+      return;
+    case 2:
+      for (let i = 0; i < n; i++) cur[i] = line[i] + prev[i];
+      return;
+    case 3:
+      for (let i = 0; i < n; i++)
+        cur[i] = line[i] + (((i >= bpp ? cur[i - bpp] : 0) + prev[i]) >> 1);
+      return;
+    case 4:
+      for (let i = 0; i < n; i++) {
+        cur[i] =
+          line[i] + paeth(i >= bpp ? cur[i - bpp] : 0, prev[i], i >= bpp ? prev[i - bpp] : 0);
+      }
+      return;
+    default:
+      throw new Error(`PNG scanline has unknown filter type ${filter}`);
+  }
+}
+
+function expandRow(cur, out, base, width, colorType, palette, transparency) {
+  if (colorType === 6) {
+    out.set(cur, base);
+    return;
+  }
+  for (let x = 0, o = base; x < width; x++, o += 4) {
+    if (colorType === 2) {
+      out[o] = cur[x * 3];
+      out[o + 1] = cur[x * 3 + 1];
+      out[o + 2] = cur[x * 3 + 2];
+      out[o + 3] = 255;
+    } else if (colorType === 3) {
+      const i = cur[x];
+      out[o] = palette?.[i * 3] ?? 0;
+      out[o + 1] = palette?.[i * 3 + 1] ?? 0;
+      out[o + 2] = palette?.[i * 3 + 2] ?? 0;
+      out[o + 3] = transparency?.[i] ?? 255;
+    } else {
+      const gray = colorType === 4 ? cur[x * 2] : cur[x];
+      out[o] = gray;
+      out[o + 1] = gray;
+      out[o + 2] = gray;
+      out[o + 3] = colorType === 4 ? cur[x * 2 + 1] : 255;
+    }
+  }
+}
+
+const CRC_TABLE = (() => {
+  const table = new Uint32Array(256);
+  for (let n = 0; n < 256; n++) {
+    let c = n;
+    for (let k = 0; k < 8; k++) c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
+    table[n] = c >>> 0;
+  }
+  return table;
+})();
+
+function crc32(bytes) {
+  let c = 0xffffffff;
+  for (let i = 0; i < bytes.length; i++) c = CRC_TABLE[(c ^ bytes[i]) & 0xff] ^ (c >>> 8);
+  return (c ^ 0xffffffff) >>> 0;
+}
+
+function chunk(type, data) {
+  const head = Buffer.alloc(8);
+  head.writeUInt32BE(data.length, 0);
+  head.write(type, 4, 'latin1');
+  const crc = Buffer.alloc(4);
+  crc.writeUInt32BE(crc32(Buffer.concat([head.subarray(4), data])), 0);
+  return Buffer.concat([head, data, crc]);
+}
+
+/** RGBA -> PNG (filter 0 on every row; these are diagnostic images, not assets). */
+export function encodePng({ width, height, data }) {
+  const stride = width * 4;
+  const raw = Buffer.alloc((stride + 1) * height);
+  for (let y = 0; y < height; y++) {
+    raw.set(data.subarray(y * stride, (y + 1) * stride), y * (stride + 1) + 1);
+  }
+  const ihdr = Buffer.alloc(13);
+  ihdr.writeUInt32BE(width, 0);
+  ihdr.writeUInt32BE(height, 4);
+  ihdr[8] = 8; // bit depth
+  ihdr[9] = 6; // RGBA
+  return Buffer.concat([
+    SIGNATURE,
+    chunk('IHDR', ihdr),
+    chunk('IDAT', zlib.deflateSync(raw, { level: 4 })),
+    chunk('IEND', Buffer.alloc(0)),
+  ]);
+}

package/lib/parity/run.mjs

@@ -0,0 +1,145 @@
+// Parity runner: for each pinned page, render the original build and the candidate
+// back to back in ONE browser session, from ONE origin (the server's root swaps
+// between captures), compare, and write the evidence images.
+//
+// Capture order per page: original (A), candidate (A), original (B). Interleaving
+// keeps drift within the session (a slow third-party font early on) from landing on
+// one side only; the second original, under a moved clock and another random seed,
+// maps what the original itself does not render the same twice.
+
+import fs from 'node:fs';
+import path from 'node:path';
+
+import { startServer } from '../serve.mjs';
+import { CONDITION_A, CONDITION_B, capturePage } from './capture.mjs';
+import { MIN_CHANGED_PIXELS, comparePage, pageSignature, renderDiffImage } from './compare.mjs';
+import { decodePng, encodePng } from './png.mjs';
+
+export function pageSlug(pagePath) {
+  return pagePath.replace(/[^a-z0-9.]+/gi, '-').replace(/^-+|-+$/g, '') || 'root';
+}
+
+const decode = (capture) => ({
+  ...capture,
+  images: {
+    viewport: decodePng(capture.viewport),
+    full: capture.full ? decodePng(capture.full) : null,
+  },
+});
+
+function failedPage(pagePath, state, reason, lcp) {
+  return {
+    page: pagePath,
+    state,
+    reasons: state === 'open' ? [reason] : [],
+    notes: state === 'open' ? [] : [reason],
+    views: {},
+    text: { missing: [], added: [] },
+    a11y: { missing: [], added: [] },
+    runtime: { added: [] },
+    location: null,
+    lcp,
+    fonts: [],
+    images: { missing: [], added: [] },
+    faces: { missing: [], added: [] },
+    styles: null,
+  };
+}
+
+function writeEvidence(dir, { a1, c1, result }) {
+  fs.rmSync(dir, { recursive: true, force: true });
+  fs.mkdirSync(dir, { recursive: true });
+  const files = {};
+  const put = (name, bytes) => {
+    const file = path.join(dir, `${name}.png`);
+    fs.writeFileSync(file, bytes);
+    files[name] = file;
+  };
+  put('anchor', a1.viewport);
+  if (a1.full) put('anchor-full', a1.full);
+  put('current', c1.viewport);
+  if (c1.full) put('current-full', c1.full);
+  // A diff image for every view that changed, and for every view too unstable to
+  // judge - its blue areas are where masks belong.
+  for (const [name, view] of Object.entries(result.views)) {
+    if (!view.masks || (view.changedPixels < MIN_CHANGED_PIXELS && view.state !== 'unknown')) {
+      continue;
+    }
+    const img = name === 'viewport' ? c1.images.viewport : c1.images.full;
+    put(name === 'viewport' ? 'diff' : 'diff-full', encodePng(renderDiffImage(img, view)));
+  }
+  return files;
+}
+
+/** Compare every given page of the candidate build with the original. */
+export async function runParity({
+  cdp,
+  anchorDist,
+  candidateDist,
+  pages,
+  masks,
+  outDir,
+  lcpByPage = {},
+  log = () => {},
+}) {
+  let root = anchorDist;
+  const server = await startServer(() => root);
+  const capture = async (dist, pagePath, condition) => {
+    root = dist;
+    try {
+      return decode(await capturePage(cdp, { origin: server.origin, pagePath, condition, masks }));
+    } catch (err) {
+      return { error: err.message };
+    }
+  };
+  const results = [];
+  const fail = (pagePath, state, reason, lcp) => {
+    const result = failedPage(pagePath, state, reason, lcp);
+    result.signature = pageSignature(result, {});
+    results.push(result);
+  };
+  try {
+    for (const pagePath of pages) {
+      const lcp = lcpByPage[pagePath] ?? null;
+      log(`parity ${pagePath}: original build...`);
+      const a1 = await capture(anchorDist, pagePath, CONDITION_A);
+      log(`parity ${pagePath}: this build...`);
+      const c1 = await capture(candidateDist, pagePath, CONDITION_A);
+      log(`parity ${pagePath}: original build again (moved clock, new seed)...`);
+      const a2 = await capture(anchorDist, pagePath, CONDITION_B);
+      if (a1.error || a2.error) {
+        fail(
+          pagePath,
+          'unknown',
+          `the original build did not render this page: ${a1.error ?? a2.error}`,
+          lcp,
+        );
+        continue;
+      }
+      if (c1.error) {
+        fail(pagePath, 'open', `this build did not render the page: ${c1.error}`, lcp);
+        continue;
+      }
+      let result = comparePage({ a1, a2, c1, lcp });
+      // A finding must reproduce: a second capture of this build has to disagree
+      // with the original in the same pixels / lines / errors before it is reported.
+      if (result.state === 'open') {
+        log(`parity ${pagePath}: confirming with a second capture of this build...`);
+        const c2 = await capture(candidateDist, pagePath, CONDITION_A);
+        if (!c2.error) result = comparePage({ a1, a2, c1, c2, lcp });
+      }
+      result.page = pagePath;
+      result.signature = pageSignature(result, c1.images);
+      result.files = writeEvidence(path.join(outDir, pageSlug(pagePath)), { a1, c1, result });
+      for (const view of Object.values(result.views)) {
+        view.changedCells = view.cells.length;
+        delete view.masks;
+        delete view.cells;
+      }
+      results.push(result);
+    }
+  } finally {
+    await server.close();
+  }
+  return results;
+}

package/lib/profile.mjs

@@ -0,0 +1,281 @@
+// Boot CPU profile: sample from navigation until FCP is observed, then
+// attribute self-time through every sampled same-origin chunk's sourcemap.
+// Answers the question coverage can't: "what RAN before paint, and for how long?"
+// — which is exactly the evidence needed to judge whether eager boot work
+// (telemetry, warm-up caches, data-module evaluation) belongs on the critical path.
+
+import { openPage, sleep } from './cdp.mjs';
+import { generatedSpans } from './coverage.mjs';
+import { OBSERVER_JS } from './measure.mjs';
+
+/**
+ * One profiled navigation. Arms the sampling profiler on the same-origin blank
+ * page, navigates, and stops when FCP is observed. The polling tail can include
+ * post-paint work; these samples are leads rather than exact paint costs.
+ */
+export async function profileRun(cdp, { origin, throttle, timeoutMs = 60_000 }) {
+  const page = await openPage(cdp, { throttle, injectScript: OBSERVER_JS });
+  try {
+    await page.navigate(`${origin}/blank.html`);
+    await sleep(150);
+    await page.send('Profiler.enable');
+    await page.send('Profiler.setSamplingInterval', { interval: 200 }); // microseconds
+    await page.send('Profiler.start');
+    // '/' not '/index.html': router-strict SPAs 404 on the literal file path.
+    await page.navigate(`${origin}/`);
+
+    const deadline = Date.now() + timeoutMs;
+    for (;;) {
+      const fcp = await page.evaluate(
+        "(location.pathname !== '/blank.html' && window.__perfMetrics) ? window.__perfMetrics.fcp : null",
+      );
+      if (fcp != null) break;
+      if (Date.now() > deadline) throw new Error('profile run: FCP never fired');
+      await sleep(25);
+    }
+    const { profile } = await page.send('Profiler.stop');
+    return { ...profile, origin };
+  } finally {
+    await page.close().catch(() => {});
+  }
+}
+
+/** Locate generated (line, column) positions back to source modules. */
+function sourceLocator(code, map) {
+  const lineStarts = [0];
+  for (let i = 0; i < code.length; i++) {
+    if (code.charCodeAt(i) === 10) lineStarts.push(i + 1);
+  }
+  const spans = generatedSpans(code, map); // sorted [{start, end, srcIdx}]
+  const sourceName = (idx) => String(map.sources[idx] ?? `#${idx}`).replaceAll('\\', '/');
+  const locate = (line, column) => {
+    if (!Number.isInteger(line) || !Number.isInteger(column) || line < 0 || column < 0) return null;
+    const lineStart = lineStarts[line];
+    if (lineStart === undefined) return null;
+    const offset = lineStart + column;
+    let lo = 0;
+    let hi = spans.length - 1;
+    while (lo <= hi) {
+      const mid = (lo + hi) >> 1;
+      const span = spans[mid];
+      if (offset < span.start) hi = mid - 1;
+      else if (offset >= span.end) lo = mid + 1;
+      else return span.srcIdx >= 0 ? sourceName(span.srcIdx) : '(unmapped)';
+    }
+    return '(unmapped)';
+  };
+  /** The one source that a generated line holds, or null when the line mixes sources. */
+  const lineSource = (line) => {
+    const start = lineStarts[line];
+    if (start === undefined) return null;
+    const end = lineStarts[line + 1] ?? code.length;
+    let lo = 0;
+    let hi = spans.length;
+    while (lo < hi) {
+      const mid = (lo + hi) >> 1;
+      if (spans[mid].end <= start) lo = mid + 1;
+      else hi = mid;
+    }
+    let found = null;
+    for (let i = lo; i < spans.length && spans[i].start < end; i++) {
+      const idx = spans[i].srcIdx;
+      if (idx < 0) continue;
+      if (found !== null && found !== idx) return null;
+      found = idx;
+    }
+    return found === null ? null : sourceName(found);
+  };
+  return { locate, lineSource };
+}
+
+/**
+ * Aggregate sampled self-time across all chunks, including dynamic imports.
+ * Missing maps and unmapped frames remain explicit; a filename is not evidence
+ * of engine work. readChunk(file) reads a local emitted file and its sourcemap.
+ * Profiling stops when FCP is observed, so the polling tail can include some
+ * post-paint work. Use these rows as leads, not exact paint-blocking costs.
+ * `isLocal(url)` says which script URLs are local chunks (default: same origin).
+ * `baseUrl` resolves relative script URLs (Miniflare reports bare module names).
+ */
+export function aggregateProfile(
+  profile,
+  { origin = profile.origin, isLocal = (url) => url.origin === origin, readChunk, baseUrl },
+) {
+  const nodesById = new Map(profile.nodes.map((node) => [node.id, node]));
+  const parents = new Map();
+  for (const node of profile.nodes)
+    for (const child of node.children ?? []) parents.set(child, node);
+  const selfMicros = new Map();
+  const samples = profile.samples ?? [];
+  const deltas = profile.timeDeltas ?? [];
+  for (let i = 0; i < samples.length; i++) {
+    const delta = deltas[i] ?? 0;
+    if (!Number.isFinite(delta) || delta <= 0) continue;
+    selfMicros.set(samples[i], (selfMicros.get(samples[i]) ?? 0) + delta);
+  }
+
+  const locators = new Map();
+  const locateChunk = (file) => {
+    if (!locators.has(file)) {
+      let result;
+      try {
+        const chunk = readChunk(file);
+        if (!chunk) {
+          result = { reason: 'no-sourcemap' };
+        } else if (
+          typeof chunk.code !== 'string' ||
+          !Array.isArray(chunk.map?.sources) ||
+          typeof chunk.map?.mappings !== 'string'
+        ) {
+          result = { reason: 'invalid-sourcemap' };
+        } else {
+          result = sourceLocator(chunk.code, chunk.map);
+        }
+      } catch {
+        result = { reason: 'invalid-sourcemap' };
+      }
+      locators.set(file, result);
+    }
+    return locators.get(file);
+  };
+
+  const buckets = new Map();
+  const add = (kind, bucket, file, micros) => {
+    const key = JSON.stringify([kind, bucket]);
+    const row = buckets.get(key) ?? { bucket, kind, micros: 0, chunks: new Set() };
+    row.micros += micros;
+    if (file) row.chunks.add(file);
+    buckets.set(key, row);
+  };
+  for (const [nodeId, micros] of selfMicros) {
+    let node = nodesById.get(nodeId);
+    const fn = node?.callFrame?.functionName ?? '';
+    if (fn === '(idle)' || fn === '(program)') continue;
+    if (!node?.callFrame?.url && fn === '(garbage collector)') {
+      add('engine', '(engine: gc)', null, micros);
+      continue;
+    }
+    // A frame without a URL (a builtin or a host call: performance.now, JSON.parse,
+    // a DOM method) does the work of the script that called it.
+    while (node && !node.callFrame?.url) node = parents.get(node.id);
+    if (!node) {
+      add('engine', '(engine)', null, micros);
+      continue;
+    }
+    const frame = node.callFrame;
+    let url;
+    try {
+      url = new URL(frame.url, baseUrl);
+    } catch {
+      /* Unresolved eval/sourceURL frames stay unattributed. */
+    }
+    if (!url) {
+      add('unmapped', frame.url, null, micros);
+      continue;
+    }
+    if (!isLocal(url)) {
+      add(
+        'external',
+        url.origin === 'null' ? frame.url : `${url.origin}${url.pathname}`,
+        null,
+        micros,
+      );
+      continue;
+    }
+    let file = null;
+    try {
+      const decoded = decodeURIComponent(url.pathname).replace(/^\/+/, '');
+      // Never resolve encoded traversal or separators.
+      if (
+        !decoded.includes('\\') &&
+        !decoded.split('/').some((part) => part === '..' || part === '.') &&
+        /\.[cm]?js$/.test(decoded)
+      )
+        file = decoded;
+    } catch {
+      /* Invalid URL escapes stay unattributed. */
+    }
+    if (!file) {
+      add('inline', url.pathname, null, micros);
+      continue;
+    }
+    const locator = locateChunk(file);
+    if (locator.reason) {
+      add(locator.reason, file, file, micros);
+    } else if (
+      frame.functionName === '' &&
+      ((frame.lineNumber === 0 && frame.columnNumber === 0) ||
+        (frame.lineNumber === -1 && frame.columnNumber === -1))
+    ) {
+      // Top-level code (0:0 in Chrome, -1:-1 in workerd). A bundled chunk runs the
+      // top-level code of many modules in one frame, so its start position names only
+      // the first module. Split the time by the sampled lines; a line that holds more
+      // than one source stays unattributed.
+      const ticks = (node.positionTicks ?? []).filter((t) => t.ticks > 0);
+      const total = ticks.reduce((sum, t) => sum + t.ticks, 0);
+      if (!total) add('top-level', file, file, micros);
+      for (const t of total ? ticks : []) {
+        const source = locator.lineSource(t.line - 1);
+        add(source ? 'source' : 'top-level', source ?? file, file, (micros * t.ticks) / total);
+      }
+    } else {
+      const source = locator.locate(frame.lineNumber, frame.columnNumber);
+      if (source && source !== '(unmapped)') add('source', source, file, micros);
+      else add('unmapped', file, file, micros);
+    }
+  }
+
+  const rows = [...buckets.values()]
+    .map(({ bucket, kind, micros, chunks }) => ({
+      bucket,
+      kind,
+      ms: Math.round(micros / 100) / 10,
+      chunks: [...chunks].sort((a, b) => a.localeCompare(b)),
+    }))
+    .sort((a, b) => b.ms - a.ms || a.bucket.localeCompare(b.bucket));
+  const sumMs = (predicate) =>
+    Math.round(
+      [...buckets.values()].filter(predicate).reduce((sum, row) => sum + row.micros, 0) / 100,
+    ) / 10;
+  return {
+    scope: 'all-chunks',
+    rows,
+    totalMs: sumMs(() => true),
+    attribution: {
+      sourceMs: sumMs((r) => r.kind === 'source'),
+      engineMs: sumMs((r) => r.kind === 'engine'),
+      unattributedMs: sumMs((r) => r.kind !== 'source' && r.kind !== 'engine'),
+    },
+  };
+}
+
+/** A sampled module is a source lead, never proof that its work is optional. */
+export function profileEvidence(report) {
+  if (report?.scope !== 'all-chunks') {
+    return {
+      state: 'unknown',
+      reason: 'profile does not attribute all sampled chunks',
+      candidates: [],
+      unattributed: [],
+    };
+  }
+  if (!report.rows?.length) {
+    return {
+      state: 'unknown',
+      reason: 'profile has no sampled work',
+      candidates: [],
+      unattributed: [],
+    };
+  }
+  const candidates = report.rows.filter((row) => row.kind === 'source' && row.ms >= 15);
+  // A row under the candidate threshold cannot hide a source module that reaches it:
+  // unattributed rows are kept per chunk file, so a module in one has at most its time.
+  const unattributed = report.rows.filter(
+    (row) => row.kind !== 'source' && row.kind !== 'engine' && row.ms >= 15,
+  );
+  return {
+    state: candidates.length ? 'open' : unattributed.length ? 'unknown' : 'clear',
+    candidates,
+    unattributed,
+  };
+}

package/lib/replay/cert.mjs

@@ -0,0 +1,45 @@
+// A self-signed certificate for the replay server. Chrome runs with
+// --ignore-certificate-errors (a throwaway profile, the replay hosts only), so the
+// names in it do not matter; TLS is needed because Chrome speaks HTTP/2 only
+// over TLS, and the recorded site used HTTP/2.
+
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+export function replayCertificate(dir = path.join(os.tmpdir(), 'perf-kit-replay', 'cert')) {
+  const keyFile = path.join(dir, 'key.pem');
+  const certFile = path.join(dir, 'cert.pem');
+  if (!fs.existsSync(keyFile) || !fs.existsSync(certFile)) {
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    try {
+      execFileSync(
+        'openssl',
+        [
+          'req',
+          '-x509',
+          '-newkey',
+          'ec',
+          '-pkeyopt',
+          'ec_paramgen_curve:prime256v1',
+          '-nodes',
+          '-days',
+          '365',
+          '-subj',
+          '/CN=perf-kit-replay',
+          '-addext',
+          'subjectAltName=DNS:localhost,IP:127.0.0.1',
+          '-keyout',
+          keyFile,
+          '-out',
+          certFile,
+        ],
+        { stdio: ['ignore', 'ignore', 'pipe'] },
+      );
+    } catch (err) {
+      throw new Error(`replay needs openssl to make a local TLS certificate: ${err.message}`);
+    }
+  }
+  return { key: fs.readFileSync(keyFile), cert: fs.readFileSync(certFile) };
+}