roster-server 3.4.2 → 3.5.0

package/README.md

@@ -180,7 +180,7 @@ module.exports = { createMyPlugin };
 
 On `close()`, or a handled signal, each isolated process drains its requests, runs its `onClose` hooks, and exits. Hook errors from those processes appear in the same `AggregateError`. When `closeTimeoutMs` expires, Roster kills the remaining isolated processes. Isolated processes ignore `SIGINT` and `SIGTERM` and wait for the main process, so a signal sent to the whole process group by a terminal or process manager does not cut their drain short. If the main process exits without closing, each isolated process closes itself.
 
-Isolation needs a Roster-owned listener, so it applies only when `start()` initializes the instance. Calling `init()` yourself keeps every site in the current process for `attach()` and the other external-server helpers. Isolation is not available on Bun, whose HTTPS server cannot adopt a passed socket; there, Roster logs a warning and serves every site in the main process. Isolation cannot be combined with the legacy `cluster: true` launcher, which disables it by default.
+Isolation needs a Roster-owned listener, so it applies only when `start()` initializes the instance. Calling `init()` yourself keeps every site in the current process for `attach()` and the other external-server helpers. Isolation cannot be combined with the legacy `cluster: true` launcher, which disables it by default.
 
 Each isolated process loads Node.js and its site, so memory use grows with the number of site directories. Code that runs when a site's module loads runs in that site's process, not in the main process.
 
@@ -204,7 +204,7 @@ export default {
 };
 ```
 
-In production, `socket` is the client's TCP connection and `head` holds the TLS ClientHello that Roster already read; put it back with `socket.unshift(head)` before terminating TLS, and do not `resume()` the socket after wrapping it. In local mode, the site's assigned port accepts plain TCP connections, `socket` arrives paused, and `head` is empty. `connection()` runs synchronously; if it throws, Roster destroys the socket.
+In production, `socket` is the client's TCP connection and `head` holds the TLS ClientHello that Roster already read; put it back with `socket.unshift(head)` before terminating TLS, and do not `resume()` the socket after wrapping it. To terminate TLS with an HTTPS server, create it with `Roster.createHttpsServer()` and hand it the socket with `Roster.acceptTlsConnection(server, socket)`: on Node these are `https.createServer()` and `server.emit('connection', socket)`, and on Bun they also select certificates per host and adopt the socket, which Bun's own `https.Server` does not. In local mode, the site's assigned port accepts plain TCP connections, `socket` arrives paused, and `head` is empty. `connection()` runs synchronously; if it throws, Roster destroys the socket.
 
 `certificate(servername)` returns the certificate Roster would serve for that host, with the same wildcard and zone matching. A missing certificate is issued by the main process first, as for any isolated site. Roster also renews it; call `certificate()` again to pick up a renewal, for example on an interval or when a cached copy gets old. It is not available in local mode. Request plugins, `www.` redirects, and `onClose` hooks do not apply: the site owns every connection it receives. A socket site must run isolated; Roster rejects it when it would be served by the main process.
 
@@ -348,6 +348,8 @@ Pass operational settings through the constructor, using the consuming applicati
 | `createManagedHttpsServer({ servername, port?, ensureCertificate?, tlsOptions? })` | `Promise<https.Server>` with certificates and dispatchers; does not listen. Certificate assurance defaults to `true`. Requires production-mode `init()`. |
 | `createServingHttpsServer({ servername, port?, tlsOptions? })` | Same helper with `ensureCertificate: false`; set `autoCertificates: false` for a serving-only instance. |
 | `virtualServer.onClose(fn)` | Register a cleanup hook; returns the virtual server. See [shutdown](#startup-and-shutdown). |
+| `Roster.createHttpsServer(options, handler?)` | `https.createServer()` with per-host `SNICallback`, `setSecureContext()`, and adopted sockets on both Node and Bun. Roster creates its HTTPS servers with it. |
+| `Roster.acceptTlsConnection(server, socket)` | Hand a raw client socket, with any bytes already read put back, to a server from `createHttpsServer()` to terminate TLS. |
 | `Roster.pluginSource` | Symbol for a request plugin's `{ module, export, options }` descriptor. See [site isolation](#site-isolation). |
 
 ## Request plugins
@@ -378,7 +380,7 @@ Enable `trustProxy` only behind a trusted proxy that overwrites `X-Forwarded-For
 | Certificates are missing in a worker | Ensure the manager has issued them into the same store before worker startup. `init()` alone does not bind ACME HTTP. |
 | Shutdown times out | Inspect the aggregated errors and site hooks, active requests, and pending certificate operations. |
 
-Local integration checks cover Node HTTP/TLS and Socket.IO polling/WebSocket shutdown on Node and Bun. In **Bun 1.3.4**, the tested `node:https` serving helper did not invoke `SNICallback`, and changing certificate files did not replace the served default certificate. This also occurred with the previous synchronous resolver; do not assume Node's SNI reload behavior on that runtime.
+Local integration checks cover Node HTTP/TLS and Socket.IO polling/WebSocket shutdown on Node and Bun, and the test suite runs on both. Bun's `node:https` server never invokes `SNICallback`, lacks `addContext()` and `setSecureContext()`, and cannot adopt a socket passed to `emit('connection')` (checked on Bun 1.3.4 and 1.4.4). On Bun, Roster therefore terminates TLS with a `tls.Server` in front of an `http.Server`, so per-host certificates, certificate reload, custom HTTPS ports and site isolation behave as on Node. The visible difference is the server's class: on Bun, `Roster.createHttpsServer()`, `createManagedHttpsServer()` and `createServingHttpsServer()` return an `http.Server` whose `listen()`, `close()`, `address()` and certificate methods act on the inner `tls.Server`, so `instanceof https.Server` is `false` there.
 
 ## Agent skill and development
 
@@ -388,7 +390,7 @@ The [RosterServer skill](skills/roster-server/SKILL.md) guides application integ
 npx skills add https://github.com/clasen/RosterServer --skill roster-server
 ```
 
-Contributors can run `pnpm test` for the Node test suite. Examples live in [demo](demo); they are separate from the published API reference above.
+Contributors can run `pnpm test` for the Node test suite and `pnpm test:bun` to run the same suite under Bun. Examples live in [demo](demo); they are separate from the published API reference above.
 
 ## License
 

package/index.js

@@ -1,13 +1,13 @@
 const fs = require('fs');
 const path = require('path');
 const http = require('http');
-const https = require('https');
 const net = require('net');
 const tls = require('tls');
 const crypto = require('crypto');
 const { EventEmitter } = require('events');
 const Greenlock = require('./vendor/greenlock-express/greenlock-express.js');
 const GreenlockShim = require('./vendor/greenlock-express/greenlock-shim.js');
+const { createHttpsServer, acceptTlsConnection, isBunRuntime } = require('./lib/https-server.js');
 const { locateSiteEntry, resolveSiteApp, isSocketSite } = require('./lib/resolve-site-app.js');
 const { IsolatedSite } = require('./lib/isolated-site.js');
 const { parseClientHello } = require('./lib/client-hello.js');
@@ -58,8 +58,6 @@ function invokeRequest(handler, req, res) {
     }
 }
 
-const isBunRuntime = typeof Bun !== 'undefined' || (typeof process !== 'undefined' && process.release?.name === 'bun');
-
 // CRC32 implementation for deterministic port assignment
 function crc32(str) {
     const crcTable = [];
@@ -372,9 +370,6 @@ class Roster {
         }
         this.disableWildcard = parseBooleanFlag(options.disableWildcard, false);
         this.combineWildcardCerts = parseBooleanFlag(options.combineWildcardCerts, false);
-        if (isBunRuntime && this.combineWildcardCerts) {
-            log.info('Bun runtime detected: combined wildcard certificates enabled (SNI bypass)');
-        }
 
         this.skipLocalCheck = parseBooleanFlag(options.skipLocalCheck, true);
         this.autoCertificates = parseBooleanFlag(options.autoCertificates, true);
@@ -1015,7 +1010,7 @@ class Roster {
                 return;
             }
             socket.unshift(head);
-            server.emit('connection', socket);
+            acceptTlsConnection(server, socket);
         };
         socket.on('data', read);
     }
@@ -1488,7 +1483,8 @@ class Roster {
                 Promise.allSettled([...this._certificateChecks.values(), ...this._contextLoads.values()])
             ]));
             if (isBunRuntime) {
-                for (const server of this._ownedServers) server.closeAllConnections();
+                // Isolation routers are plain TCP servers; their sockets are in _sockets.
+                for (const server of this._ownedServers) server.closeAllConnections?.();
                 await wait(Promise.all([...this._ownedServers].map(closeServer)));
             }
 
@@ -1582,7 +1578,7 @@ class Roster {
             ? await this.ensureCertificate(normalizedServername)
             : this.loadCertificate(normalizedServername);
 
-        const server = this._configureSiteServer(https.createServer({
+        const server = this._configureSiteServer(createHttpsServer({
             minVersion: this.tlsMinVersion,
             maxVersion: this.tlsMaxVersion,
             ...tlsOptions,
@@ -1661,13 +1657,7 @@ class Roster {
         if (this._closing) return Promise.reject(new Error('Roster is closing or closed'));
         if (!this._startPromise) {
             // Isolation requires Roster to own the listeners, so only start() initializes for it.
-            if (this.isolation && !this._initPromise) {
-                if (isBunRuntime) {
-                    log.warn('⚠️  Bun runtime detected: site isolation is not supported; all sites run in the main process');
-                } else {
-                    this._isolate = true;
-                }
-            }
+            if (this.isolation && !this._initPromise) this._isolate = true;
             this._startPromise = this._start().catch(async error => {
                 if (!this._closing) {
                     try { await this.close(); } catch (cleanupError) {
@@ -1705,7 +1695,6 @@ class Roster {
         this._assertOpen();
         {
             const httpServer = glx.httpServer();
-            const bunTlsHotReloadHandlers = [];
 
             await this._listen(httpServer, 80, this.hostname);
             log.info('HTTP server listening on port 80');
@@ -1717,182 +1706,28 @@ class Roster {
                 const portData = this._sitesByPort[port] || { virtualServers: {}, appHandlers: {} };
                 const dispatcher = this._createDispatcher(portData);
                 const upgradeHandler = this._createUpgradeHandler(portData);
+                const tlsOpts = { minVersion: this.tlsMinVersion, maxVersion: this.tlsMaxVersion };
 
-                const issueAndReloadPemsForServername = async (servername) => {
-                    const host = this._normalizeHostInput(servername).trim().toLowerCase();
-                    if (!host) return null;
-
-                    let pems = this._resolvePemsForServername(host);
-                    if (pems) return pems;
-
-                    try {
-                        await this._checkCertificate(host);
-                    } catch (error) {
-                        log.warn(`⚠️  Greenlock issuance failed for ${host}: ${error?.message || error}`);
-                    }
-
-                    pems = this._resolvePemsForServername(host);
-                    if (pems) return pems;
-
-                    const wildcardSubject = wildcardSubjectForHost(host);
-                    const zone = wildcardSubject ? wildcardRoot(wildcardSubject) : null;
-                    if (zone) {
-                        const bootstrapHost = `bun-bootstrap.${zone}`;
-                        try {
-                            await this._checkCertificate(bootstrapHost);
-                        } catch (error) {
-                            log.warn(`⚠️  Greenlock wildcard bootstrap failed for ${bootstrapHost}: ${error?.message || error}`);
-                        }
-                        pems = this._resolvePemsForServername(host);
-                    }
-
-                    return pems;
-                };
-
-                const ensureBunDefaultPems = async (primaryDomain) => {
-                    let pems = await issueAndReloadPemsForServername(primaryDomain);
-
-                    const needsWildcard = this.combineWildcardCerts
-                        && this.wildcardZones.has(primaryDomain)
-                        && this.dnsChallenge;
-
-                    if (pems && needsWildcard && !certCoversName(pems.cert, `*.${primaryDomain}`)) {
-                        log.warn(`⚠️  Existing cert for ${primaryDomain} lacks *.${primaryDomain} SAN — clearing stale cert for combined re-issuance`);
-                        const certDir = path.join(this.greenlockStorePath, 'live', primaryDomain);
-                        try { fs.rmSync(certDir, { recursive: true, force: true }); } catch {}
-                        pems = null;
-                    }
-
-                    if (pems) return pems;
-
-                    const certSubject = primaryDomain.startsWith('*.') ? wildcardRoot(primaryDomain) : primaryDomain;
-                    log.warn(`⚠️  Bun: requesting ${needsWildcard ? 'combined wildcard' : ''} certificate for ${certSubject} via Greenlock before HTTPS bind`);
-                    try {
-                        await this._checkCertificate(certSubject);
-                    } catch (error) {
-                        log.error(`❌ Failed to obtain certificate for ${certSubject} under Bun:`, error?.message || error);
-                    }
-
-                    pems = this._resolvePemsForServername(primaryDomain);
-                    if (pems) return pems;
-
-                    throw new Error(
-                        `Bun runtime could not load TLS certificate files for ${primaryDomain}. ` +
-                        `Refusing to start HTTPS on port ${portNum} to avoid serving invalid TLS.`
-                    );
-                };
-
+                let httpsServer;
                 if (portNum === this.defaultPort) {
-                    const tlsOpts = { minVersion: this.tlsMinVersion, maxVersion: this.tlsMaxVersion };
-                    let httpsServer;
-
-                    if (isBunRuntime) {
-                        const primaryDomain = Object.keys(portData.virtualServers)[0];
-                        let defaultPems = await ensureBunDefaultPems(primaryDomain);
-                        let defaultContext = tls.createSecureContext(defaultPems);
-                        httpsServer = https.createServer({
-                            ...tlsOpts,
-                            key: defaultPems.key,
-                            cert: defaultPems.cert,
-                            SNICallback: (servername, callback) => {
-                                const resolveContext = async () => {
-                                    const cached = await this._resolveSecureContext(servername);
-                                    if (cached) return cached;
-                                    const pems = await issueAndReloadPemsForServername(servername);
-                                    this._assertOpen();
-                                    return pems ? this._getSecureContext(servername, false) : defaultContext;
-                                };
-                                resolveContext().then(context => callback(null, context), callback);
-                            }
-                        }, dispatcher);
-                        const reloadBunDefaultTls = async (servername, reason) => {
-                            const nextPems = await issueAndReloadPemsForServername(servername);
-                            if (!nextPems) return false;
-                            this._assertOpen();
-                            defaultPems = nextPems;
-                            defaultContext = tls.createSecureContext(defaultPems);
-                            if (typeof httpsServer.setSecureContext === 'function') {
-                                try {
-                                    httpsServer.setSecureContext({ key: defaultPems.key, cert: defaultPems.cert });
-                                    log.info(`🔄 Bun TLS default certificate reloaded on port ${portNum} (${reason})`);
-                                } catch (error) {
-                                    log.warn(`⚠️  Failed to hot-reload Bun TLS context on port ${portNum}: ${error?.message || error}`);
-                                }
-                            }
-                            return true;
-                        };
-                        bunTlsHotReloadHandlers.push(reloadBunDefaultTls);
-                        log.warn(`⚠️  Bun runtime detected: using file-based TLS with SNI for ${primaryDomain} on port ${portNum}`);
-                    } else {
-                        httpsServer = glx.httpsServer(tlsOpts, dispatcher);
-                    }
-
-                    httpsServer.on('upgrade', upgradeHandler);
-
-                    await this._listenSite(httpsServer, portNum);
-                    log.info(`HTTPS server listening on port ${portNum}`);
+                    httpsServer = glx.httpsServer(tlsOpts, dispatcher);
                 } else {
-                    const httpsOptions = {
-                        minVersion: this.tlsMinVersion,
-                        maxVersion: this.tlsMaxVersion,
+                    httpsServer = createHttpsServer({
+                        ...tlsOpts,
                         SNICallback: (servername, callback) => {
                             this._getSecureContext(servername, false).then(context => callback(null, context), callback);
                         }
-                    };
-
-                    const httpsServer = https.createServer(httpsOptions, dispatcher);
-                    httpsServer.on('upgrade', upgradeHandler);
-
+                    }, dispatcher);
                     httpsServer.on('tlsClientError', (error) => {
                         if (!error.message.includes('http request')) {
                             log.error(`TLS error on port ${portNum}:`, error.message);
                         }
                     });
-
-                    await this._listenSite(httpsServer, portNum);
-                    log.info(`HTTPS server listening on port ${portNum}`);
                 }
-            }
-
-            if (isBunRuntime && !this.combineWildcardCerts && this.wildcardZones.size > 0 && bunTlsHotReloadHandlers.length > 0) {
-                const retryDelayMs = Number.isFinite(Number(process.env.ROSTER_BUN_WILDCARD_PREWARM_RETRY_MS))
-                    ? Math.max(1000, Number(process.env.ROSTER_BUN_WILDCARD_PREWARM_RETRY_MS))
-                    : 30000;
-                const maxAttempts = Number.isFinite(Number(process.env.ROSTER_BUN_WILDCARD_PREWARM_MAX_ATTEMPTS))
-                    ? Math.max(0, Number(process.env.ROSTER_BUN_WILDCARD_PREWARM_MAX_ATTEMPTS))
-                    : 0;
-
-                for (const zone of this.wildcardZones) {
-                    const bootstrapHost = `bun-bootstrap.${zone}`;
-                    const attemptPrewarm = async (attempt = 1) => {
-                        if (this._closing) return;
-                        try {
-                            log.warn(`⚠️  Bun runtime detected: prewarming wildcard certificate via ${bootstrapHost} (attempt ${attempt})`);
-                            let reloaded = false;
-                            for (const reloadTls of bunTlsHotReloadHandlers) {
-                                reloaded = (await reloadTls(bootstrapHost, `prewarm ${bootstrapHost} attempt ${attempt}`)) || reloaded;
-                            }
-                            if (!reloaded) {
-                                throw new Error(`No certificate could be loaded for ${bootstrapHost}`);
-                            }
-                            log.info(`✅ Bun wildcard prewarm succeeded for ${zone} on attempt ${attempt}`);
-                        } catch (error) {
-                            log.warn(`⚠️  Bun wildcard prewarm failed for ${zone} (attempt ${attempt}): ${error?.message || error}`);
-                            if (maxAttempts > 0 && attempt >= maxAttempts) {
-                                log.warn(`⚠️  Bun wildcard prewarm stopped for ${zone} after ${attempt} attempts`);
-                                return;
-                            }
-                            if (this._closing) return;
-                            const timer = setTimeout(() => {
-                                this._retryTimers.delete(timer);
-                                attemptPrewarm(attempt + 1).catch(() => {});
-                            }, retryDelayMs);
-                            this._retryTimers.add(timer);
-                        }
-                    };
+                httpsServer.on('upgrade', upgradeHandler);
 
-                    attemptPrewarm().catch(() => {});
-                }
+                await this._listenSite(httpsServer, portNum);
+                log.info(`HTTPS server listening on port ${portNum}`);
             }
         }
         return this;
@@ -1901,6 +1736,8 @@ class Roster {
 
 module.exports = Roster;
 module.exports.isBunRuntime = isBunRuntime;
+module.exports.createHttpsServer = createHttpsServer;
+module.exports.acceptTlsConnection = acceptTlsConnection;
 module.exports.pluginSource = PLUGIN_SOURCE;
 module.exports.wildcardRoot = wildcardRoot;
 module.exports.hostMatchesWildcard = hostMatchesWildcard;

package/lib/https-server.js

@@ -0,0 +1,101 @@
+'use strict';
+
+// HTTPS servers that select certificates per host and adopt handed-off sockets on Node and Bun.
+// Bun's https.Server never calls SNICallback and treats a socket passed to emit('connection') as plain
+// text, but its tls.Server does both. On Bun, a tls.Server therefore terminates TLS in front of an
+// http.Server, which is returned so request, upgrade and connection handling stay those of Node.
+const http = require('http');
+const https = require('https');
+const tls = require('tls');
+
+const isBunRuntime = typeof Bun !== 'undefined' || process.release?.name === 'bun';
+const kTlsServer = Symbol('roster.tlsServer');
+
+function createHttpsServer(options = {}, handler) {
+    if (!isBunRuntime) return https.createServer(options, handler);
+
+    const server = http.createServer(handler);
+    const tlsServer = tls.createServer({ ALPNProtocols: ['http/1.1'], ...options });
+    server[kTlsServer] = tlsServer;
+
+    trackConnections(server);
+    tlsServer.on('secureConnection', socket => server.emit('connection', socket));
+    tlsServer.on('tlsClientError', (error, socket) => {
+        if (server.listenerCount('tlsClientError')) server.emit('tlsClientError', error, socket);
+        else socket.destroy();
+    });
+    tlsServer.on('listening', () => server.emit('listening'));
+    tlsServer.on('error', error => server.emit('error', error));
+    tlsServer.on('close', () => server.emit('close'));
+
+    server.listen = (...args) => {
+        tlsServer.listen(...args);
+        return server;
+    };
+    server.close = callback => {
+        tlsServer.close(callback);
+        server.closeIdleConnections();
+        return server;
+    };
+    server.address = () => tlsServer.address();
+    server.ref = () => { tlsServer.ref(); return server; };
+    server.unref = () => { tlsServer.unref(); return server; };
+    Object.defineProperty(server, 'listening', { get: () => tlsServer.listening });
+    server.setSecureContext = options => tlsServer.setSecureContext(options);
+    server.addContext = (hostname, context) => tlsServer.addContext(hostname, context);
+    return server;
+}
+
+// Bun's http.Server neither applies keepAliveTimeout to connections passed to emit('connection') nor
+// closes them in closeIdleConnections(), so the connection lifecycle is kept here.
+function trackConnections(server) {
+    const active = new Set();
+    const idleTimers = new Map();
+    const setIdle = socket => {
+        active.delete(socket);
+        clearTimeout(idleTimers.get(socket));
+        const timeout = server.keepAliveTimeout;
+        idleTimers.set(socket, timeout > 0 ? setTimeout(() => socket.destroy(), timeout).unref() : null);
+    };
+    const forget = socket => {
+        active.delete(socket);
+        clearTimeout(idleTimers.get(socket));
+        idleTimers.delete(socket);
+    };
+    const onRequest = (req, res) => {
+        const socket = req.socket;
+        if (!idleTimers.has(socket)) return;
+        clearTimeout(idleTimers.get(socket));
+        idleTimers.set(socket, null);
+        active.add(socket);
+        res.once('finish', () => { if (idleTimers.has(socket) && !socket.destroyed) setIdle(socket); });
+    };
+    // Observed from emit() so the server's listeners stay exactly those its users added.
+    const emit = server.emit;
+    server.emit = function (event, ...args) {
+        if (event === 'connection') {
+            const socket = args[0];
+            idleTimers.set(socket, null);
+            socket.once('close', () => forget(socket));
+        } else if (event === 'request') {
+            onRequest(...args);
+        } else if (event === 'upgrade') {
+            // An upgraded socket belongs to its upgrade handler.
+            forget(args[0].socket);
+        }
+        return emit.call(this, event, ...args);
+    };
+    server.closeIdleConnections = () => {
+        for (const socket of idleTimers.keys()) if (!active.has(socket)) socket.destroy();
+    };
+    server.closeAllConnections = () => {
+        for (const socket of idleTimers.keys()) socket.destroy();
+    };
+}
+
+// Hands a raw client socket, with any bytes already read pushed back, to an HTTPS server to terminate TLS.
+function acceptTlsConnection(server, socket) {
+    (server[kTlsServer] || server).emit('connection', socket);
+}
+
+module.exports = { createHttpsServer, acceptTlsConnection, isBunRuntime };

package/lib/site-worker.js

@@ -1,7 +1,7 @@
 'use strict';
 
 // Entry point of an isolated site process, forked by IsolatedSite.
-const https = require('https');
+const { createHttpsServer, acceptTlsConnection } = require('./https-server.js');
 const net = require('net');
 const Roster = require('../index.js');
 const { resolveSiteApp, isSocketSite } = require('./resolve-site-app.js');
@@ -131,7 +131,7 @@ class SiteWorkerRoster extends Roster {
         for (const port of ports) {
             // Only the default port issues missing certificates, as in the main process.
             const issue = port === this.defaultPort;
-            const server = this._configureSiteServer(https.createServer({
+            const server = this._configureSiteServer(createHttpsServer({
                 minVersion: this.tlsMinVersion,
                 maxVersion: this.tlsMaxVersion,
                 SNICallback: (servername, callback) => {
@@ -157,7 +157,7 @@ class SiteWorkerRoster extends Roster {
         this._sockets.add(socket);
         socket.once('close', () => this._sockets.delete(socket));
         socket.unshift(head);
-        server.emit('connection', socket);
+        acceptTlsConnection(server, socket);
     }
 }
 

package/package.json

@@ -1,10 +1,11 @@
 {
     "name": "roster-server",
-    "version": "3.4.2",
+    "version": "3.5.0",
     "description": "👾 RosterServer - A domain host router to host multiple HTTPS.",
     "main": "index.js",
     "scripts": {
-        "test": "node --test 'test/**/*.test.js'"
+        "test": "node --test 'test/**/*.test.js'",
+        "test:bun": "bun test ./test"
     },
     "repository": {
         "type": "git",
@@ -41,14 +42,12 @@
         "@root/csr": "^0.8.1",
         "@root/encoding": "^1.0.1",
         "@root/keypairs": "^0.10.0",
-        "@root/mkdirp": "^1.0.0",
         "@root/request": "^1.6.1",
         "acme-dns-01-cli": "^3.0.7",
         "acme-http-01-standalone": "^3.0.5",
         "cert-info": "^1.5.1",
         "greenlock-store-fs": "^3.2.2",
         "lemonlog": "^1.2.0",
-        "redirect-https": "^1.3.1",
-        "safe-replace": "^1.1.0"
+        "redirect-https": "^1.3.1"
     }
 }

package/skills/roster-server/SKILL.md

@@ -72,7 +72,7 @@ A virtual request listener owns its request even before it ends the response. Ro
 - For unattended Linode operation that must fail rather than fall back to manual DNS, set `dnsChallenge.dnsApiFallbackToManual: false`. Keep other provider choices explicit.
 - `combineWildcardCerts` combines apex/www/wildcard issuance using DNS-01; `disableWildcard` ignores wildcard sites. Do not enable either as a generic troubleshooting step.
 - `ensureCertificate(name)` loads existing PEMs or issues missing ones; `loadCertificate(name)` only reads files. Neither means “force renewal.” File-based SNI caches detect certificate changes on supported runtimes.
-- In local testing, Bun 1.3.4's `node:https` serving helper did not invoke `SNICallback`, including with the previous synchronous resolver. Do not promise SNI certificate reload merely because files changed; Node and Bun require separate runtime verification.
+- Bun's own `https.Server` ignores `SNICallback` and cannot adopt passed sockets; Roster works around it with `Roster.createHttpsServer()` (a `tls.Server` in front of an `http.Server` on Bun), so per-host certificates, reload, custom ports and isolation match Node. Socket sites that terminate TLS should use `Roster.createHttpsServer()` and `Roster.acceptTlsConnection(server, socket)` rather than `https.createServer()` to work on Bun. Verify both runtimes with `pnpm test` and `pnpm test:bun`.
 - Request plugins registered with `roster.use(fn)` are synchronous and run before redirects/dispatch. Return `true` only after handling the response. Promise returns produce 500.
 - The optional `createScannerBlocker` comes from `roster-server/plugins/scanner-blocker.js`. Its ban state is per process and in memory. Enable `trustProxy` only when a trusted proxy overwrites `X-Forwarded-For`; `onBlock` does not itself provide shared bans.
 

package/test/https-server.test.js

@@ -0,0 +1,189 @@
+'use strict';
+
+// The HTTPS server factory must behave the same on Node and Bun: run with `pnpm test` and `pnpm test:bun`.
+const { it, before } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const net = require('node:net');
+const tls = require('node:tls');
+const https = require('node:https');
+const { execFileSync } = require('node:child_process');
+const Roster = require('../index.js');
+const { createHttpsServer, acceptTlsConnection } = Roster;
+const { parseClientHello } = require('../lib/client-hello.js');
+
+const pems = {};
+before(() => {
+    const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'roster-https-server-'));
+    for (const [name, serial] of [['one.test', 1], ['two.test', 2]]) {
+        const key = path.join(directory, `${name}.key`);
+        const cert = path.join(directory, `${name}.crt`);
+        execFileSync('openssl', ['req', '-x509', '-newkey', 'rsa:2048', '-nodes', '-keyout', key, '-out', cert,
+            '-subj', `/CN=${name}`, '-days', '1', '-set_serial', String(serial)], { stdio: 'ignore' });
+        pems[name] = { key: fs.readFileSync(key), cert: fs.readFileSync(cert) };
+    }
+    fs.rmSync(directory, { recursive: true, force: true });
+});
+
+const sni = (servername, callback) => callback(null, tls.createSecureContext(pems[servername] || pems['one.test']));
+
+async function listen(t, server) {
+    t.after(() => new Promise(resolve => {
+        server.closeAllConnections?.();
+        server.close(() => resolve());
+    }));
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(0, '127.0.0.1', resolve);
+    });
+    return server.address().port;
+}
+
+function get(port, servername, agent = false) {
+    return new Promise((resolve, reject) => {
+        https.get({ hostname: '127.0.0.1', port, servername, rejectUnauthorized: false, agent }, res => {
+            const serial = res.socket.getPeerCertificate().serialNumber;
+            let body = '';
+            res.on('data', chunk => { body += chunk; });
+            res.on('end', () => resolve({ serial, body }));
+        }).on('error', reject);
+    });
+}
+
+it('reports the runtime it is loaded in', () => {
+    assert.equal(Roster.isBunRuntime, typeof process.versions.bun === 'string');
+});
+
+it('selects the certificate of each host through SNICallback', async t => {
+    const server = createHttpsServer({ ...pems['one.test'], SNICallback: sni },
+        (req, res) => res.end(`${req.socket.encrypted} ${req.socket.servername}`));
+    const port = await listen(t, server);
+    assert.equal(server.listening, true);
+    assert.deepEqual(await get(port, 'one.test'), { serial: '01', body: 'true one.test' });
+    assert.deepEqual(await get(port, 'two.test'), { serial: '02', body: 'true two.test' });
+});
+
+it('replaces the default certificate with setSecureContext', async t => {
+    const server = createHttpsServer(pems['one.test'], (req, res) => res.end('ok'));
+    const port = await listen(t, server);
+    assert.equal((await get(port, '')).serial, '01');
+    server.setSecureContext(pems['two.test']);
+    assert.equal((await get(port, '')).serial, '02');
+});
+
+it('terminates TLS on a raw socket handed over after its ClientHello was read', async t => {
+    const server = createHttpsServer({ SNICallback: sni }, (req, res) => res.end('adopted'));
+    const front = net.createServer(socket => {
+        let head = Buffer.alloc(0);
+        const read = chunk => {
+            head = Buffer.concat([head, chunk]);
+            if (parseClientHello(head) === undefined) return;
+            socket.removeListener('data', read);
+            socket.pause();
+            socket.unshift(head);
+            acceptTlsConnection(server, socket);
+        };
+        socket.on('data', read);
+    });
+    const port = await listen(t, front);
+    assert.deepEqual(await get(port, 'two.test'), { serial: '02', body: 'adopted' });
+});
+
+it('keeps connections alive between requests and closes them once idle', async t => {
+    const server = createHttpsServer({ SNICallback: sni }, (req, res) => res.end(req.url));
+    server.keepAliveTimeout = 300;
+    let connections = 0;
+    server.on('connection', () => connections++);
+    const port = await listen(t, server);
+    const { bodies, idleMs } = await new Promise((resolve, reject) => {
+        const socket = tls.connect({ host: '127.0.0.1', port, servername: 'one.test', rejectUnauthorized: false });
+        const send = pathname => socket.write(`GET ${pathname} HTTP/1.1\r\nHost: one.test\r\nConnection: keep-alive\r\n\r\n`);
+        const bodies = [];
+        let buffer = '';
+        let answeredAt = null;
+        socket.once('secureConnect', () => send('/first'));
+        socket.on('data', data => {
+            buffer += data;
+            const responses = buffer.split('HTTP/1.1 ').slice(1).map(response => response.split('\r\n\r\n')[1]).filter(Boolean);
+            if (responses.length === 1 && bodies.length === 0) {
+                bodies.push(responses[0]);
+                send('/second');
+            } else if (responses.length === 2 && bodies.length === 1) {
+                bodies.push(responses[1]);
+                answeredAt = Date.now();
+            }
+        });
+        socket.on('close', () => resolve({ bodies, idleMs: Date.now() - answeredAt }));
+        socket.on('error', reject);
+    });
+    assert.deepEqual(bodies, ['/first', '/second']);
+    assert.equal(connections, 1);
+    assert.ok(idleMs >= 250 && idleMs < 2500, `connection stayed open ${idleMs} ms`);
+});
+
+it('closes idle connections but lets an active request finish', async t => {
+    let release;
+    const server = createHttpsServer({ SNICallback: sni }, (req, res) => {
+        if (req.url === '/slow') release = () => res.end('slow');
+        else res.end('fast');
+    });
+    const port = await listen(t, server);
+    const agent = new https.Agent({ keepAlive: true, rejectUnauthorized: false });
+    t.after(() => agent.destroy());
+    await get(port, 'one.test', agent);
+    const idleSocket = Object.values(agent.freeSockets).flat()[0];
+    const idleClosed = new Promise(resolve => idleSocket.once('close', resolve));
+    const slow = new Promise((resolve, reject) => {
+        https.get({ hostname: '127.0.0.1', port, path: '/slow', servername: 'one.test', rejectUnauthorized: false, agent: false },
+            res => { let body = ''; res.on('data', chunk => { body += chunk; }); res.on('end', () => resolve(body)); })
+            .on('error', reject);
+    });
+    while (!release) await new Promise(resolve => setTimeout(resolve, 10));
+    server.closeIdleConnections();
+    await idleClosed;
+    release();
+    assert.equal(await slow, 'slow');
+});
+
+it('delivers upgrade requests with their socket', async t => {
+    const server = createHttpsServer({ SNICallback: sni }, (req, res) => res.end('not upgraded'));
+    server.on('upgrade', (req, socket) => {
+        socket.write('HTTP/1.1 101 Switching Protocols\r\nUpgrade: echo\r\nConnection: Upgrade\r\n\r\n');
+        socket.on('data', data => socket.write(`echo:${data}`));
+    });
+    server.keepAliveTimeout = 50;
+    const port = await listen(t, server);
+    const echoed = await new Promise((resolve, reject) => {
+        const socket = tls.connect({ host: '127.0.0.1', port, servername: 'one.test', rejectUnauthorized: false }, () => {
+            socket.write('GET / HTTP/1.1\r\nHost: one.test\r\nConnection: Upgrade\r\nUpgrade: echo\r\n\r\n');
+        });
+        let buffer = '';
+        socket.on('data', data => {
+            buffer += data;
+            if (buffer.includes('\r\n\r\n') && !buffer.includes('echo:')) setTimeout(() => socket.write('ping'), 200);
+            if (buffer.includes('echo:ping')) {
+                socket.destroy();
+                resolve(buffer.split('\r\n\r\n')[1]);
+            }
+        });
+        socket.on('error', reject);
+    });
+    assert.equal(echoed, 'echo:ping');
+});
+
+it('reports listening, address and close like a Node server', async t => {
+    const server = createHttpsServer({ SNICallback: sni }, (req, res) => res.end('ok'));
+    const events = [];
+    server.on('listening', () => events.push('listening'));
+    server.on('close', () => events.push('close'));
+    assert.equal(server.listening, false);
+    await new Promise(resolve => server.listen(0, '127.0.0.1', resolve));
+    assert.equal(server.address().address, '127.0.0.1');
+    await new Promise(resolve => server.close(resolve));
+    assert.equal(server.listening, false);
+    assert.deepEqual(events, ['listening', 'close']);
+    const error = await new Promise(resolve => server.close(resolve));
+    assert.equal(error?.code, 'ERR_SERVER_NOT_RUNNING');
+});

package/test/isolation.test.js

@@ -13,6 +13,7 @@ const { once } = require('node:events');
 const { execFileSync, spawn } = require('node:child_process');
 const Roster = require('../index.js');
 const { parseClientHello } = require('../lib/client-hello.js');
+const { createHttpsServer } = require('../lib/https-server.js');
 const { createScannerBlocker } = require('../plugins/scanner-blocker.js');
 const shim = require('../vendor/greenlock-express/greenlock-shim.js');
 const greenlock = require('../vendor/greenlock-express/greenlock-express.js');
@@ -64,7 +65,7 @@ async function startProduction(t, sites, { certificates = [], issue = async () =
         ready(callback) {
             setImmediate(() => callback({
                 httpServer: () => http.createServer(),
-                httpsServer: (options, handler) => https.createServer({ ...options, SNICallback: roster.sniCallback() }, handler)
+                httpsServer: (options, handler) => createHttpsServer({ ...options, SNICallback: roster.sniCallback() }, handler)
             }));
             return this;
         }
@@ -410,6 +411,7 @@ it('closes isolated sites when the main process dies without closing', { timeout
 
 function socketSite(server, marker, start = 'async start() {}') {
     return `const fs = require('fs');
+const { createHttpsServer, acceptTlsConnection } = require(${JSON.stringify(path.join(__dirname, '..', 'index.js'))});
 let server = ${server};
 module.exports = {
     ${start},
@@ -417,7 +419,7 @@ module.exports = {
         fs.writeFileSync(${JSON.stringify(marker)} + '.head', String(head.length));
         // A ClientHello read by Roster goes back on the stream; a local connection arrives paused.
         if (head.length > 0) socket.unshift(head);
-        server.emit('connection', socket);
+        acceptTlsConnection(server, socket);
         if (head.length === 0) socket.resume();
     },
     reply(req, res) {
@@ -435,7 +437,7 @@ it('hands raw client sockets with their ClientHello to a socket site that termin
     // The site gets its certificate from Roster's store through start(), not from files it reads.
     const start = `async start({ certificate }) {
         const pems = await certificate('raw.example.com');
-        server = require('https').createServer(pems, (req, res) => module.exports.reply(req, res));
+        server = createHttpsServer(pems, (req, res) => module.exports.reply(req, res));
     }`;
     const { roster, port } = await startProduction(t, {
         'raw.example.com': socketSite('null', marker, start),
@@ -458,7 +460,7 @@ it('issues a missing certificate through the main process when a socket site ask
     const store = path.join(path.dirname(marker), 'greenlock.d');
     const issued = [];
     const start = `async start({ certificate }) {
-        server = require('https').createServer(await certificate('fresh.example.com'), (req, res) => module.exports.reply(req, res));
+        server = createHttpsServer(await certificate('fresh.example.com'), (req, res) => module.exports.reply(req, res));
     }`;
     const { port } = await startProduction(t, { 'fresh.example.com': socketSite('null', marker, start) }, {
         options: { greenlockStorePath: store },

package/test/lifecycle.test.js

@@ -337,7 +337,11 @@ it('preserves initialization and cleanup errors when both fail', async t => {
     });
 });
 
-it('cancels a pending listen without opening a port when DNS resolves after shutdown', { timeout: 5000 }, async t => {
+it('cancels a pending listen without opening a port when DNS resolves after shutdown', {
+    timeout: 5000,
+    // Bun resolves listen() hostnames natively, so mocking node:dns cannot hold the lookup open.
+    skip: Roster.isBunRuntime && 'Bun listen() does not use node:dns.lookup'
+}, async t => {
     const dns = require('node:dns');
     let resolveLookup;
     t.mock.method(dns, 'lookup', (hostname, options, callback) => { resolveLookup = callback; });

package/vendor/greenlock-express/servers.js

@@ -52,7 +52,8 @@ Servers.create = function(greenlock, onError) {
     };
     servers.httpsServer = function(secureOpts, defaultApp) {
         return servers._httpsServer(secureOpts, defaultApp, function(secureOpts, fn) {
-            return require("https").createServer(secureOpts, fn);
+            // Roster's factory keeps per-host SNI working on Bun, whose https.Server ignores SNICallback.
+            return require("../../lib/https-server.js").createHttpsServer(secureOpts, fn);
         });
     };
     servers._httpsServer = function(secureOpts, defaultApp, createSecureServer) {