@betterportal/tunnels 1.0.0

package/lib/plugins/service-tunnel-client-api/registry.d.ts

@@ -0,0 +1,36 @@
+import type { Observable } from "@bsb/base";
+import type { WebSocket } from "ws";
+export interface ActiveTunnel {
+    id: string;
+    subdomain: string;
+    targetHost: string;
+    targetPort: number;
+    authenticated: boolean;
+    expiresAt: Date;
+    ws: WebSocket;
+    pending: Map<string, PendingRequest>;
+    sessionObs: Observable;
+}
+export interface PendingRequest {
+    resolve: (response: Response) => void;
+    reject: (error: Error) => void;
+    chunks: string[];
+    status?: number;
+    headers?: Record<string, string>;
+    webStartedAt: number;
+    clientApiSentAt: number;
+    clientApiRoundtripMs?: number;
+    cliOverheadMs?: number;
+    originMs?: number;
+    totalTimer: NodeJS.Timeout;
+    firstByteTimer: NodeJS.Timeout;
+    idleTimer?: NodeJS.Timeout;
+    idleTimeoutMs: number;
+}
+export declare class TunnelRegistry {
+    private readonly tunnels;
+    set(tunnel: ActiveTunnel): void;
+    get(hostname: string): ActiveTunnel | undefined;
+    delete(subdomain: string): void;
+}
+//# sourceMappingURL=registry.d.ts.map

package/lib/plugins/service-tunnel-client-api/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/plugins/service-tunnel-client-api/registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAEpC,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,IAAI,CAAC;IAChB,EAAE,EAAE,SAAS,CAAC;IACd,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACrC,UAAU,EAAE,UAAU,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,IAAI,CAAC;IACtC,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IAC/B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAE3D,GAAG,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI;IAI/B,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS;IAK/C,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;CAGhC"}

package/lib/plugins/service-tunnel-client-api/registry.js

@@ -0,0 +1,14 @@
+export class TunnelRegistry {
+    tunnels = new Map();
+    set(tunnel) {
+        this.tunnels.set(tunnel.subdomain, tunnel);
+    }
+    get(hostname) {
+        const subdomain = hostname.split(".")[0] ?? "";
+        return this.tunnels.get(subdomain);
+    }
+    delete(subdomain) {
+        this.tunnels.delete(subdomain);
+    }
+}
+//# sourceMappingURL=registry.js.map

package/lib/plugins/service-tunnel-client-api/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/plugins/service-tunnel-client-api/registry.ts"],"names":[],"mappings":"AAgCA,MAAM,OAAO,cAAc;IACR,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAC;IAE3D,GAAG,CAAC,MAAoB;QACtB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED,GAAG,CAAC,QAAgB;QAClB,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,CAAC,SAAiB;QACtB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;CACF"}

package/lib/plugins/service-tunnel-client-api/schemas.d.ts

@@ -0,0 +1,66 @@
+import * as av from "anyvali";
+import type { Infer } from "anyvali";
+export declare const TunnelCreateSchema: av.ObjectSchema<{
+    sessionId: av.StringSchema;
+    targetHost: av.StringSchema;
+    targetPort: av.NumberSchema;
+    authenticated: av.BoolSchema;
+    prefix: av.OptionalSchema<av.StringSchema>;
+    token: av.OptionalSchema<av.StringSchema>;
+}>;
+export type TunnelCreateInput = Infer<typeof TunnelCreateSchema>;
+export declare const ClientFrameSchema: av.ObjectSchema<{
+    type: av.StringSchema;
+    code: av.OptionalSchema<av.NumberSchema>;
+    requestId: av.OptionalSchema<av.StringSchema>;
+    status: av.OptionalSchema<av.NumberSchema>;
+    headers: av.OptionalSchema<av.RecordSchema<av.StringSchema>>;
+    body: av.OptionalSchema<av.StringSchema>;
+    message: av.OptionalSchema<av.StringSchema>;
+    publicServerId: av.OptionalSchema<av.StringSchema>;
+    publicSocketId: av.OptionalSchema<av.StringSchema>;
+    frameType: av.OptionalSchema<av.StringSchema>;
+    path: av.OptionalSchema<av.StringSchema>;
+    webStartedAt: av.OptionalSchema<av.NumberSchema>;
+    clientApiRoundtripMs: av.OptionalSchema<av.NumberSchema>;
+    cliOverheadMs: av.OptionalSchema<av.NumberSchema>;
+    originMs: av.OptionalSchema<av.NumberSchema>;
+    totalMs: av.OptionalSchema<av.NumberSchema>;
+    internalServerMs: av.OptionalSchema<av.NumberSchema>;
+}>;
+export declare const TunnelConfigSchema: av.ObjectSchema<{
+    host: av.StringSchema;
+    port: av.NumberSchema;
+    prefix: av.OptionalSchema<av.StringSchema>;
+    host_header: av.OptionalSchema<av.StringSchema>;
+}>;
+export type TunnelConfig = Infer<typeof TunnelConfigSchema>;
+export declare const FileConfigSchema: av.ObjectSchema<{
+    tunnels: av.ArraySchema<av.ObjectSchema<{
+        host: av.StringSchema;
+        port: av.NumberSchema;
+        prefix: av.OptionalSchema<av.StringSchema>;
+        host_header: av.OptionalSchema<av.StringSchema>;
+    }>>;
+}>;
+export type FileConfig = Infer<typeof FileConfigSchema>;
+export declare const AuthStartRequestSchema: av.ObjectSchema<{
+    deviceName: av.OptionalSchema<av.StringSchema>;
+    authAppBaseUrl: av.OptionalSchema<av.StringSchema>;
+}>;
+export type AuthStartRequest = Infer<typeof AuthStartRequestSchema>;
+export declare const AuthStartResponseSchema: av.ObjectSchema<{
+    sessionId: av.StringSchema;
+    pollSecret: av.StringSchema;
+    browserUrl: av.StringSchema;
+    expiresAt: av.StringSchema;
+}>;
+export declare const AuthStatusResponseSchema: av.ObjectSchema<{
+    status: av.StringSchema;
+    token: av.OptionalSchema<av.StringSchema>;
+    expiresAt: av.OptionalSchema<av.StringSchema>;
+    tenantId: av.OptionalSchema<av.StringSchema>;
+    bpUserSubject: av.OptionalSchema<av.StringSchema>;
+    message: av.OptionalSchema<av.StringSchema>;
+}>;
+//# sourceMappingURL=schemas.d.ts.map

package/lib/plugins/service-tunnel-client-api/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../../src/plugins/service-tunnel-client-api/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAErC,eAAO,MAAM,kBAAkB;;;;;;;EAOH,CAAC;AAC7B,MAAM,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEjE,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;EAkBF,CAAC;AAE7B,eAAO,MAAM,kBAAkB;;;;;EAKH,CAAC;AAC7B,MAAM,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE5D,eAAO,MAAM,gBAAgB;;;;;;;EAED,CAAC;AAC7B,MAAM,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAExD,eAAO,MAAM,sBAAsB;;;EAGP,CAAC;AAC7B,MAAM,MAAM,gBAAgB,GAAG,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEpE,eAAO,MAAM,uBAAuB;;;;;EAKR,CAAC;AAE7B,eAAO,MAAM,wBAAwB;;;;;;;EAOT,CAAC"}

package/lib/plugins/service-tunnel-client-api/schemas.js

@@ -0,0 +1,56 @@
+import * as av from "anyvali";
+export const TunnelCreateSchema = av.object({
+    sessionId: av.string().minLength(1),
+    targetHost: av.string().minLength(1).default("127.0.0.1"),
+    targetPort: av.number(),
+    authenticated: av.bool().default(false),
+    prefix: av.optional(av.string()),
+    token: av.optional(av.string())
+}, { unknownKeys: "strip" });
+export const ClientFrameSchema = av.object({
+    type: av.string().minLength(1),
+    code: av.optional(av.number()),
+    requestId: av.optional(av.string()),
+    status: av.optional(av.number()),
+    headers: av.optional(av.record(av.string())),
+    body: av.optional(av.string()),
+    message: av.optional(av.string()),
+    publicServerId: av.optional(av.string()),
+    publicSocketId: av.optional(av.string()),
+    frameType: av.optional(av.string()),
+    path: av.optional(av.string()),
+    webStartedAt: av.optional(av.number()),
+    clientApiRoundtripMs: av.optional(av.number()),
+    cliOverheadMs: av.optional(av.number()),
+    originMs: av.optional(av.number()),
+    totalMs: av.optional(av.number()),
+    internalServerMs: av.optional(av.number())
+}, { unknownKeys: "strip" });
+export const TunnelConfigSchema = av.object({
+    host: av.string().minLength(1).default("127.0.0.1"),
+    port: av.number(),
+    prefix: av.optional(av.string()),
+    host_header: av.optional(av.string())
+}, { unknownKeys: "strip" });
+export const FileConfigSchema = av.object({
+    tunnels: av.array(TunnelConfigSchema).default([])
+}, { unknownKeys: "strip" });
+export const AuthStartRequestSchema = av.object({
+    deviceName: av.optional(av.string()),
+    authAppBaseUrl: av.optional(av.string())
+}, { unknownKeys: "strip" });
+export const AuthStartResponseSchema = av.object({
+    sessionId: av.string(),
+    pollSecret: av.string(),
+    browserUrl: av.string(),
+    expiresAt: av.string()
+}, { unknownKeys: "strip" });
+export const AuthStatusResponseSchema = av.object({
+    status: av.string(),
+    token: av.optional(av.string()),
+    expiresAt: av.optional(av.string()),
+    tenantId: av.optional(av.string()),
+    bpUserSubject: av.optional(av.string()),
+    message: av.optional(av.string())
+}, { unknownKeys: "strip" });
+//# sourceMappingURL=schemas.js.map

package/lib/plugins/service-tunnel-client-api/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../../src/plugins/service-tunnel-client-api/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAG9B,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IACnC,UAAU,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IACzD,UAAU,EAAE,EAAE,CAAC,MAAM,EAAE;IACvB,aAAa,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;IAChC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;CAChC,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;AAG7B,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9B,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;IAC9B,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;IACnC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;IAChC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5C,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;IAC9B,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;IACjC,cAAc,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;IACxC,cAAc,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;IACxC,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;IACnC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;IAC9B,YAAY,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;IACtC,oBAAoB,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;IAC9C,aAAa,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;IACvC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;IAClC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;IACjC,gBAAgB,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;CAC3C,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;AAE7B,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IACnD,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE;IACjB,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;IAChC,WAAW,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;CACtC,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;AAG7B,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC,MAAM,CAAC;IACxC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAClD,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;AAG7B,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC,MAAM,CAAC;IAC9C,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;IACpC,cAAc,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;CACzC,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;AAG7B,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC,MAAM,CAAC;IAC/C,SAAS,EAAE,EAAE,CAAC,MAAM,EAAE;IACtB,UAAU,EAAE,EAAE,CAAC,MAAM,EAAE;IACvB,UAAU,EAAE,EAAE,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,EAAE,CAAC,MAAM,EAAE;CACvB,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;AAE7B,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,CAAC,MAAM,CAAC;IAChD,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE;IACnB,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;IAC/B,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;IACnC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;IAClC,aAAa,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;IACvC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;CAClC,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC"}

package/lib/plugins/service-tunnel-web/http.d.ts

@@ -0,0 +1,4 @@
+export declare function forwardedHeaders(headers: Headers, hostname: string): Record<string, string>;
+export declare function proxyClientIp(headers: Headers): string | undefined;
+export declare function tunnelUnavailable(headers: Headers, status?: number): Response;
+//# sourceMappingURL=http.d.ts.map

package/lib/plugins/service-tunnel-web/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../src/plugins/service-tunnel-web/http.ts"],"names":[],"mappings":"AAWA,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAgB3F;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAKlE;AAkBD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAM,GAAG,QAAQ,CAwC1E"}

package/lib/plugins/service-tunnel-web/http.js

@@ -0,0 +1,119 @@
+const HOP_BY_HOP = new Set([
+    "connection",
+    "keep-alive",
+    "proxy-authenticate",
+    "proxy-authorization",
+    "te",
+    "trailer",
+    "transfer-encoding",
+    "upgrade"
+]);
+export function forwardedHeaders(headers, hostname) {
+    const out = {};
+    const clientIp = proxyClientIp(headers);
+    headers.forEach((value, name) => {
+        const key = name.toLowerCase();
+        if (HOP_BY_HOP.has(key))
+            return;
+        if (key === "cookie")
+            return;
+        out[key] = value;
+    });
+    out["x-forwarded-host"] = hostname;
+    out["x-forwarded-proto"] = "https";
+    if (clientIp) {
+        out["x-forwarded-for"] = clientIp;
+        out["x-real-ip"] = clientIp;
+    }
+    return out;
+}
+export function proxyClientIp(headers) {
+    const forwardedFor = firstPublicForwardedIp(headers.get("x-forwarded-for") ?? undefined);
+    if (forwardedFor)
+        return forwardedFor;
+    return headers.get("x-real-ip")?.trim() || undefined;
+}
+function firstPublicForwardedIp(value) {
+    return value?.split(",").map((ip) => ip.trim()).find((ip) => ip && !isPrivateIp(ip));
+}
+function isPrivateIp(ip) {
+    return ip === "unknown"
+        || ip.startsWith("10.")
+        || ip.startsWith("192.168.")
+        || /^172\.(1[6-9]|2\d|3[0-1])\./.test(ip)
+        || ip.startsWith("127.")
+        || ip.startsWith("::1")
+        || ip.startsWith("fc")
+        || ip.startsWith("fd")
+        || ip.startsWith("fe80:");
+}
+export function tunnelUnavailable(headers, status = 503) {
+    const accept = headers.get("accept")?.toLowerCase() ?? "";
+    const payload = {
+        error: "tunnel_unavailable",
+        message: "This development tunnel is not available right now.",
+        status
+    };
+    if (!accept || accept.includes("text/html") || accept.includes("application/xhtml+xml") || accept.includes("*/*")) {
+        return tunnelUnavailableHtml(status);
+    }
+    if (accept.includes("application/json")) {
+        return new Response(JSON.stringify(payload), {
+            status,
+            headers: { "content-type": "application/json; charset=utf-8" }
+        });
+    }
+    if (accept.includes("xml")) {
+        return new Response(`<?xml version="1.0" encoding="UTF-8"?>
+<error>
+  <code>${payload.error}</code>
+  <message>${payload.message}</message>
+  <status>${status}</status>
+</error>
+`, {
+            status,
+            headers: { "content-type": "application/xml; charset=utf-8" }
+        });
+    }
+    if (accept.includes("text/plain")) {
+        return new Response(`${payload.message}\n`, {
+            status,
+            headers: { "content-type": "text/plain; charset=utf-8" }
+        });
+    }
+    return tunnelUnavailableHtml(status);
+}
+function tunnelUnavailableHtml(status) {
+    return new Response(`<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Development tunnel unavailable</title>
+  <style>
+    :root { color-scheme: dark; --bg: #120506; --panel: #1b0b0d; --line: #5b2027; --text: #fff6f6; --muted: #f0b8bd; --danger: #ff344c; --danger2: #ff6b7b; }
+    * { box-sizing: border-box; }
+    body { margin: 0; min-height: 100vh; display: grid; place-items: center; padding: 24px; background: radial-gradient(circle at top, #3b0c13 0, #120506 46%, #080203 100%); color: var(--text); font-family: Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; }
+    main { width: min(560px, 100%); border: 1px solid var(--line); background: linear-gradient(180deg, rgba(255,52,76,.14), rgba(255,255,255,.02)), var(--panel); border-radius: 12px; box-shadow: 0 28px 90px rgba(0,0,0,.5); padding: 30px; }
+    .brand { color: var(--danger2); font-weight: 900; letter-spacing: .1em; text-transform: uppercase; font-size: 12px; }
+    h1 { margin: 18px 0 0; font-size: clamp(34px, 7vw, 62px); line-height: .95; letter-spacing: 0; }
+    p { margin: 18px 0 0; color: var(--muted); font-size: 18px; line-height: 1.45; }
+    .notice { border: 1px solid var(--danger); background: rgba(255,52,76,.12); padding: 16px; border-radius: 8px; margin-top: 22px; font-weight: 800; }
+    small { display: block; margin-top: 18px; color: #d8969d; line-height: 1.45; }
+  </style>
+</head>
+<body>
+  <main>
+    <div class="brand">BetterTunnels</div>
+    <h1>Unavailable.</h1>
+    <p>This is a temporary developer tunnel. It is not a real login, bank, Microsoft, or production service.</p>
+    <div class="notice">This tunnel is not available right now, or the local service is not responding.</div>
+    <small>Status ${status}. Close this tab unless you expected this exact developer tunnel.</small>
+  </main>
+</body>
+</html>`, {
+        status,
+        headers: { "content-type": "text/html; charset=utf-8" }
+    });
+}
+//# sourceMappingURL=http.js.map

package/lib/plugins/service-tunnel-web/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/plugins/service-tunnel-web/http.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,YAAY;IACZ,YAAY;IACZ,oBAAoB;IACpB,qBAAqB;IACrB,IAAI;IACJ,SAAS;IACT,mBAAmB;IACnB,SAAS;CACV,CAAC,CAAC;AAEH,MAAM,UAAU,gBAAgB,CAAC,OAAgB,EAAE,QAAgB;IACjE,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACxC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/B,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO;QAChC,IAAI,GAAG,KAAK,QAAQ;YAAE,OAAO;QAC7B,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,kBAAkB,CAAC,GAAG,QAAQ,CAAC;IACnC,GAAG,CAAC,mBAAmB,CAAC,GAAG,OAAO,CAAC;IACnC,IAAI,QAAQ,EAAE,CAAC;QACb,GAAG,CAAC,iBAAiB,CAAC,GAAG,QAAQ,CAAC;QAClC,GAAG,CAAC,WAAW,CAAC,GAAG,QAAQ,CAAC;IAC9B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,MAAM,YAAY,GAAG,sBAAsB,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS,CAAC,CAAC;IACzF,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IAEtC,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAyB;IACvD,OAAO,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,WAAW,CAAC,EAAU;IAC7B,OAAO,EAAE,KAAK,SAAS;WAClB,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC;WACpB,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;WACzB,6BAA6B,CAAC,IAAI,CAAC,EAAE,CAAC;WACtC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;WACrB,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC;WACpB,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;WACnB,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;WACnB,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAgB,EAAE,MAAM,GAAG,GAAG;IAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC1D,MAAM,OAAO,GAAG;QACd,KAAK,EAAE,oBAAoB;QAC3B,OAAO,EAAE,qDAAqD;QAC9D,MAAM;KACP,CAAC;IAEF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAClH,OAAO,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACxC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE;YAC3C,MAAM;YACN,OAAO,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE;SAC/D,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,QAAQ,CAAC;;UAEd,OAAO,CAAC,KAAK;aACV,OAAO,CAAC,OAAO;YAChB,MAAM;;CAEjB,EAAE;YACG,MAAM;YACN,OAAO,EAAE,EAAE,cAAc,EAAE,gCAAgC,EAAE;SAC9D,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,QAAQ,CAAC,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE;YAC1C,MAAM;YACN,OAAO,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE;SACzD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,qBAAqB,CAAC,MAAM,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAc;IAC3C,OAAO,IAAI,QAAQ,CAAC;;;;;;;;;;;;;;;;;;;;;;;;oBAwBF,MAAM;;;QAGlB,EAAE;QACN,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;KACxD,CAAC,CAAC;AACL,CAAC"}

package/lib/plugins/service-tunnel-web/index.d.ts

@@ -0,0 +1,79 @@
+import { BSBService, type BSBServiceConstructor, type Observable } from "@bsb/base";
+import * as av from "anyvali";
+export declare const Config: import("@bsb/base").BSBPluginConfigClass<av.ObjectSchema<{
+    port: av.NumberSchema;
+    domain: av.StringSchema;
+    verificationHost: av.StringSchema;
+    cookieSecret: av.StringSchema;
+    turnstileSiteKey: av.OptionalSchema<av.StringSchema>;
+    turnstileSecretKey: av.OptionalSchema<av.StringSchema>;
+    maxHeaderBytes: av.NumberSchema;
+    maxBodyBytes: av.NumberSchema;
+}>>;
+export declare const EventSchemas: {
+    readonly emitEvents: {};
+    readonly onEvents: {
+        readonly "ws.fromOrigin": {
+            input: av.ObjectSchema<{
+                publicSocketId: av.StringSchema;
+                frameType: av.StringSchema;
+                event: av.OptionalSchema<av.StringSchema>;
+                body: av.OptionalSchema<av.StringSchema>;
+            }>;
+            description?: string;
+            readonly __brand: "fire-and-forget";
+        };
+    };
+    readonly emitReturnableEvents: {};
+    readonly onReturnableEvents: {};
+    readonly emitBroadcast: {};
+    readonly onBroadcast: {};
+};
+export declare class Plugin extends BSBService<InstanceType<typeof Config>, typeof EventSchemas> {
+    static Config: import("@bsb/base").BSBPluginConfigClass<av.ObjectSchema<{
+        port: av.NumberSchema;
+        domain: av.StringSchema;
+        verificationHost: av.StringSchema;
+        cookieSecret: av.StringSchema;
+        turnstileSiteKey: av.OptionalSchema<av.StringSchema>;
+        turnstileSecretKey: av.OptionalSchema<av.StringSchema>;
+        maxHeaderBytes: av.NumberSchema;
+        maxBodyBytes: av.NumberSchema;
+    }>>;
+    static EventSchemas: {
+        readonly emitEvents: {};
+        readonly onEvents: {
+            readonly "ws.fromOrigin": {
+                input: av.ObjectSchema<{
+                    publicSocketId: av.StringSchema;
+                    frameType: av.StringSchema;
+                    event: av.OptionalSchema<av.StringSchema>;
+                    body: av.OptionalSchema<av.StringSchema>;
+                }>;
+                description?: string;
+                readonly __brand: "fire-and-forget";
+            };
+        };
+        readonly emitReturnableEvents: {};
+        readonly onReturnableEvents: {};
+        readonly emitBroadcast: {};
+        readonly onBroadcast: {};
+    };
+    readonly initBeforePlugins: string[];
+    readonly initAfterPlugins: string[];
+    readonly runBeforePlugins: string[];
+    readonly runAfterPlugins: string[];
+    private readonly clientApi;
+    private readonly app;
+    private readonly server;
+    private readonly wss;
+    private readonly publicSockets;
+    private readonly verification;
+    constructor(cfg: BSBServiceConstructor<InstanceType<typeof Config>, typeof EventSchemas>);
+    init(obs: Observable): Promise<void>;
+    run(obs: Observable): Promise<void>;
+    dispose(): Promise<void>;
+    private handlePublicSocket;
+    private sendProxyMetrics;
+}
+//# sourceMappingURL=index.d.ts.map

package/lib/plugins/service-tunnel-web/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/plugins/service-tunnel-web/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,KAAK,qBAAqB,EAC1B,KAAK,UAAU,EAMhB,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAU9B,eAAO,MAAM,MAAM;;;;;;;;;GAgBlB,CAAC;AAEF,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;CAiBvB,CAAC;AAEH,qBAAa,MAAO,SAAQ,UAAU,CAAC,YAAY,CAAC,OAAO,MAAM,CAAC,EAAE,OAAO,YAAY,CAAC;IACtF,MAAM,CAAC,MAAM;;;;;;;;;QAAU;IACvB,MAAM,CAAC,YAAY;;;;;;;;;;;;;;;;;;MAAgB;IACnC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,EAAE,CAAM;IAC1C,QAAQ,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAM;IACzC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAM;IACzC,QAAQ,CAAC,eAAe,EAAE,MAAM,EAAE,CAAM;IACxC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwB;IAClD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAK;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAkB;IACtC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgC;IAC9D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAmB;gBAEpC,GAAG,EAAE,qBAAqB,CAAC,YAAY,CAAC,OAAO,MAAM,CAAC,EAAE,OAAO,YAAY,CAAC;IAelF,IAAI,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAiIpC,GAAG,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAQnC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;YAOhB,kBAAkB;IA2ChC,OAAO,CAAC,gBAAgB;CAmBzB"}