Release 7.0.0-beta

.github/BRANCH-PROTECTION.md

@@ -0,0 +1,30 @@
+# Branch protection (beta / stable)
+
+Configure in GitHub **Settings → Rules → Rulesets** (or classic branch protection).
+
+## Ruleset: `release-lines` (`beta`, `stable`)
+
+| Rule | Value |
+|------|-------|
+| Restrict creations | optional |
+| Restrict updates / deletions | yes |
+| Block force pushes | yes |
+| Require a pull request before merging | **yes** |
+| Require approvals | recommended (≥1 maintainer) |
+| Require conversation resolution | recommended |
+| Require status checks to pass | **yes** |
+| Required checks | `.NET / build`, `.NET / ui-portable` (all matrix legs), `RPS saturation / rps` |
+| Allow bypass | admins only for emergencies |
+
+## `develop`
+
+Keep lighter rules for velocity (direct push OK if that is current practice). Do **not** require full `compare-product` on every feature PR.
+
+## Applying via `gh` (optional)
+
+```bash
+# Example — adjust org/repo and exact check names from Actions UI after first green run
+gh api repos/{owner}/{repo}/rulesets --input .github/branch-ruleset-beta-stable.json
+```
+
+Exact check names must match the Actions job names as shown on a PR (including matrix suffixes for `ui-portable`).

.github/CODEOWNERS

@@ -0,0 +1,8 @@
+# Default
+* @justcoding121
+
+# PolyForm Noncommercial products — maintainer only
+/src/Titanium.Plus/ @justcoding121
+/tests/Titanium.Plus.Tests/ @justcoding121
+/src/Titanium.Inspector/ @justcoding121
+/tests/Titanium.Inspector.Tests/ @justcoding121

.github/dns/README.md

@@ -0,0 +1,12 @@
+# DNS / CloudFront helpers for titaniumproxy.com
+
+Public hostnames only — **no AWS credentials or certificate private keys**.
+
+Live edge (maintainer machine, profile `jthomas`):
+
+1. ACM cert in `us-east-1` for `titaniumproxy.com` + `www` (DNS validation into zone `Z08516571F59U4HNOJXAT`)
+2. CloudFront distribution aliases those names; origin `justcoding121.github.io` (HTTPS)
+3. CloudFront Function [`cloudfront-path-rewrite.js`](cloudfront-path-rewrite.js) (`titaniumproxy-path-rewrite`) prepends `/titanium-web-proxy` so project Pages works with VitePress `base: '/'`. Do **not** attach an origin-request policy that forwards the viewer `Host` — GitHub Pages returns “Site not found” unless the origin Host is `justcoding121.github.io`.
+4. Route53 A/AAAA aliases → CloudFront ([`route53-alias.json`](route53-alias.json))
+
+Template: [`cloudfront-distribution.json`](cloudfront-distribution.json) (substitute ACM ARN; function ARN uses your account).

.github/dns/cloudfront-distribution.json

@@ -0,0 +1,71 @@
+{
+  "CallerReference": "titaniumproxy-website-v1",
+  "Comment": "titaniumproxy.com → GitHub Pages origin (path rewrite via CloudFront Function titaniumproxy-path-rewrite)",
+  "Enabled": true,
+  "Aliases": {
+    "Quantity": 2,
+    "Items": ["titaniumproxy.com", "www.titaniumproxy.com"]
+  },
+  "DefaultRootObject": "index.html",
+  "Origins": {
+    "Quantity": 1,
+    "Items": [
+      {
+        "Id": "github-pages",
+        "DomainName": "justcoding121.github.io",
+        "OriginPath": "",
+        "CustomOriginConfig": {
+          "HTTPPort": 80,
+          "HTTPSPort": 443,
+          "OriginProtocolPolicy": "https-only",
+          "OriginSslProtocols": {
+            "Quantity": 1,
+            "Items": ["TLSv1.2"]
+          }
+        },
+        "CustomHeaders": {
+          "Quantity": 0
+        },
+        "ConnectionAttempts": 3,
+        "ConnectionTimeout": 10,
+        "OriginShield": {
+          "Enabled": false
+        }
+      }
+    ]
+  },
+  "DefaultCacheBehavior": {
+    "TargetOriginId": "github-pages",
+    "ViewerProtocolPolicy": "redirect-to-https",
+    "AllowedMethods": {
+      "Quantity": 3,
+      "Items": ["GET", "HEAD", "OPTIONS"],
+      "CachedMethods": {
+        "Quantity": 2,
+        "Items": ["GET", "HEAD"]
+      }
+    },
+    "Compress": true,
+    "CachePolicyId": "658327ea-f89d-4fab-a63d-7e88639e58f6",
+    "FunctionAssociations": {
+      "Quantity": 1,
+      "Items": [
+        {
+          "EventType": "viewer-request",
+          "FunctionARN": "arn:aws:cloudfront::ACCOUNT_ID:function/titaniumproxy-path-rewrite"
+        }
+      ]
+    }
+  },
+  "CustomErrorResponses": {
+    "Quantity": 0
+  },
+  "ViewerCertificate": {
+    "ACMCertificateArn": "REPLACE_WITH_ACM_CERTIFICATE_ARN",
+    "SSLSupportMethod": "sni-only",
+    "MinimumProtocolVersion": "TLSv1.2_2021"
+  },
+  "HttpVersion": "http2and3",
+  "IsIPV6Enabled": true,
+  "PriceClass": "PriceClass_100"
+}

.github/dns/cloudfront-path-rewrite.js

@@ -0,0 +1,12 @@
+function handler(event) {
+  const request = event.request;
+  const uri = request.uri;
+  if (uri.indexOf('/titanium-web-proxy') !== 0) {
+    if (uri === '/') {
+      request.uri = '/titanium-web-proxy/';
+    } else {
+      request.uri = '/titanium-web-proxy' + uri;
+    }
+  }
+  return request;
+}

.github/dns/route53-alias.json

@@ -0,0 +1,53 @@
+{
+  "Comment": "Alias titaniumproxy.com and www to CloudFront (public CF domain only — no secrets)",
+  "Changes": [
+    {
+      "Action": "UPSERT",
+      "ResourceRecordSet": {
+        "Name": "titaniumproxy.com.",
+        "Type": "A",
+        "AliasTarget": {
+          "HostedZoneId": "Z2FDTNDATAQYW2",
+          "DNSName": "d19r96hj1fsq1c.cloudfront.net.",
+          "EvaluateTargetHealth": false
+        }
+      }
+    },
+    {
+      "Action": "UPSERT",
+      "ResourceRecordSet": {
+        "Name": "titaniumproxy.com.",
+        "Type": "AAAA",
+        "AliasTarget": {
+          "HostedZoneId": "Z2FDTNDATAQYW2",
+          "DNSName": "d19r96hj1fsq1c.cloudfront.net.",
+          "EvaluateTargetHealth": false
+        }
+      }
+    },
+    {
+      "Action": "UPSERT",
+      "ResourceRecordSet": {
+        "Name": "www.titaniumproxy.com.",
+        "Type": "A",
+        "AliasTarget": {
+          "HostedZoneId": "Z2FDTNDATAQYW2",
+          "DNSName": "d19r96hj1fsq1c.cloudfront.net.",
+          "EvaluateTargetHealth": false
+        }
+      }
+    },
+    {
+      "Action": "UPSERT",
+      "ResourceRecordSet": {
+        "Name": "www.titaniumproxy.com.",
+        "Type": "AAAA",
+        "AliasTarget": {
+          "HostedZoneId": "Z2FDTNDATAQYW2",
+          "DNSName": "d19r96hj1fsq1c.cloudfront.net.",
+          "EvaluateTargetHealth": false
+        }
+      }
+    }
+  ]
+}

.github/workflows/cla.yml

@@ -0,0 +1,34 @@
+name: CLA
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+  issue_comment:
+    types: [created]
+
+permissions:
+  contents: write
+  pull-requests: write
+  statuses: write
+
+jobs:
+  cla:
+    runs-on: ubuntu-latest
+    steps:
+      - name: CLA Assistant
+        if: >
+          (github.event.issue.pull_request &&
+            contains(github.event.comment.body, 'I have read the CLA and I hereby sign the CLA')) ||
+          github.event_name == 'pull_request_target'
+        uses: contributor-assistant/github-action@ca4a40a7d1004f18d9960b404b97e5f30a505a08 # v2.6.1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PERSONAL_ACCESS_TOKEN: ${{ secrets.CLA_ASSISTANT_PAT || secrets.GITHUB_TOKEN }}
+        with:
+          path-to-document: https://github.com/justcoding121/titanium-web-proxy/blob/develop/CLA.md
+          path-to-signatures: signatures/version1/cla.json
+          branch: cla-signatures
+          allowlist: justcoding121,bot*
+          custom-notsigned-prcomment: >
+            Thanks for your contribution. Please read [CLA.md](https://github.com/justcoding121/titanium-web-proxy/blob/develop/CLA.md)
+            and reply with: I have read the CLA and I hereby sign the CLA.

.github/workflows/deploy-website.yml

@@ -0,0 +1,99 @@
+name: Deploy website
+
+on:
+  push:
+    branches:
+      - develop
+    paths:
+      - 'website/**'
+      - 'wiki/images/**'
+      - 'docs/api/**'
+      - 'docs/styles/**'
+      - 'docs/fonts/**'
+      - '.github/workflows/deploy-website.yml'
+  pull_request:
+    branches:
+      - develop
+    paths:
+      - 'website/**'
+      - 'wiki/images/**'
+      - 'docs/api/**'
+      - 'docs/styles/**'
+      - 'docs/fonts/**'
+      - '.github/workflows/deploy-website.yml'
+  release:
+    types: [published]
+  workflow_dispatch:
+
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  build:
+    # NuGet-only GitHub Releases must not redeploy Pages; only v* product tags.
+    if: github.event_name != 'release' || startsWith(github.event.release.tag_name, 'v')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: website/package-lock.json
+
+      - name: Install and build
+        working-directory: website
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          npm ci --ignore-scripts
+          npm run docs:build
+
+      - name: Copy DocFX API into site
+        shell: bash
+        run: |
+          mkdir -p website/.vitepress/dist/api
+          if [ -d docs/api ]; then
+            cp -a docs/api/. website/.vitepress/dist/api/
+            # DocFX HTML references ../styles and ../fonts from /api/*.html
+            if [ -d docs/styles ]; then
+              cp -a docs/styles website/.vitepress/dist/styles
+            fi
+            if [ -d docs/fonts ]; then
+              cp -a docs/fonts website/.vitepress/dist/fonts
+            fi
+            # Prefer DocFX logo only if VitePress did not already emit one
+            if [ -f docs/logo.svg ] && [ ! -f website/.vitepress/dist/logo.svg ]; then
+              cp docs/logo.svg website/.vitepress/dist/logo.svg
+            fi
+            if [ -f docs/favicon.ico ]; then
+              cp docs/favicon.ico website/.vitepress/dist/favicon.ico
+            fi
+          else
+            echo "Warning: docs/api missing; API pages will not be published"
+          fi
+
+      - name: Upload Pages artifact
+        if: github.event_name != 'pull_request'
+        uses: actions/upload-pages-artifact@v3
+        with:
+          path: website/.vitepress/dist
+
+  deploy:
+    if: github.event_name != 'pull_request' && (github.ref == 'refs/heads/develop' || github.event_name == 'release' || github.event_name == 'workflow_dispatch')
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v4