spb/sp-wallet

1// TCP relay 127.0.0.1:<port> -> signer node. Runs as a system LaunchDaemon on the API node because macOS denies2// local-network access to PM2/LaunchAgent background processes (EHOSTUNREACH). It forwards bytes only: requests stay3// HMAC-authenticated end to end and the signer still verifies the passkey itself. The target is resolved per connection4// (mDNS name), so a DHCP renumbering does not break it.5import net from 'node:net';6const [host, port] = (process.env.SPW_RELAY_TARGET ?? '').split(':');7const listen = Number(process.env.SPW_RELAY_PORT ?? 8652);8if (!host || !port) { console.error('SPW_RELAY_TARGET=host:port required'); process.exit(2); }9net.createServer((c) => {10  const u = net.connect({ host, port: Number(port), timeout: 10000 });11  const end = (why) => { if (why) console.error(`${new Date().toISOString()} relay: ${why}`); c.destroy(); u.destroy(); };12  u.on('timeout', () => end('upstream timeout')).on('error', (e) => end(`upstream ${e.code ?? e.message}`));13  c.on('error', () => end()).setTimeout(30000, () => end());14  c.pipe(u); u.pipe(c);15}).listen(listen, '127.0.0.1', () => console.log(`signer relay 127.0.0.1:${listen} -> ${host}:${port}`));16