@betterportal/tunnels 1.0.24 → 1.0.26

package/lib/plugins/service-tunnels-client/index.js

@@ -0,0 +1,733 @@
+import { BSBService, bsb, optional, createConfigSchema, createEventSchemas, createFireAndForgetEvent, createReturnableEvent } from "@bsb/base";
+import * as av from "anyvali";
+import { createServer } from "node:http";
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { H3, toNodeHandler } from "h3";
+import { WebSocketServer } from "ws";
+import { TunnelCreateSchema, ClientFrameSchema, AuthStartRequestSchema, AuthStartResponseSchema, AuthStatusResponseSchema } from "./schemas.js";
+import { buildTunnelSubdomain, hashValue, randomPrefix } from "./ids.js";
+import { prisma } from "../../prisma.js";
+import { initializePrisma } from "../../prisma.js";
+import { AUTH_SESSION_TTL_MS, DEVICE_TOKEN_TTL_MS, bearerToken, hashSecret, normalizeIpRange, randomToken, shortBrowserKey, verifySecret } from "../../auth.js";
+import { TunnelRegistry, tunnelStatusAfterDisconnect } from "./registry.js";
+import TunnelWebClient from "../../.bsb/clients/service-tunnels-proxy.js";
+export const Config = createConfigSchema({
+    name: "service-tunnels-client",
+    description: "Client websocket/API service",
+    tags: ["service", "websocket", "tunnel"]
+}, av.object({
+    database: av.object({
+        connectionString: av.string().minLength(1).describe("PostgreSQL connection string")
+    }, { unknownKeys: "strip" }).describe("Database configuration"),
+    port: av.number().default(8081).describe("Client API listener port"),
+    domain: av.string().default("tunnels.betterportal.dev").describe("Default public tunnel domain"),
+    publicUrl: av.string().default("https://tunnels.betterportal.dev").describe("Public base URL"),
+    authAppBaseUrl: av.string().default("https://betterportal.cloud").describe("BetterPortal app URL used for CLI auth"),
+    authVerifyPath: av.string().default("/cli-auth/verify").describe("BetterPortal CLI auth verify route")
+}).describe("service-tunnels-client config"));
+export const EventSchemas = createEventSchemas({
+    emitEvents: {},
+    onEvents: {
+        "ws.toOrigin": createFireAndForgetEvent(bsb.object({
+            publicServerId: bsb.string({ description: "Web service instance that owns the public websocket" }),
+            publicSocketId: bsb.string({ description: "Web service local websocket id" }),
+            hostname: bsb.string({ description: "Public tunnel hostname" }),
+            path: bsb.string({ description: "Websocket path and query" }),
+            frameType: bsb.string({ description: "msg, ack, or event" }),
+            event: optional(bsb.string({ description: "open or close" })),
+            body: optional(bsb.string({ description: "Base64 websocket payload" }))
+        }, "Public websocket frame to origin"), "Relay a public websocket frame to the connected tunnel client"),
+        "proxy.metrics": createFireAndForgetEvent(bsb.object({
+            hostname: bsb.string({ description: "Public tunnel hostname" }),
+            requestId: bsb.string({ description: "Request id" }),
+            totalMs: bsb.number({ description: "Public request total duration" }),
+            clientApiRoundtripMs: optional(bsb.number({ description: "Client API to CLI roundtrip duration" })),
+            cliOverheadMs: optional(bsb.number({ description: "CLI work outside origin read duration" })),
+            originMs: optional(bsb.number({ description: "CLI to origin/read duration" })),
+            internalServerMs: optional(bsb.number({ description: "Remaining server-side duration" }))
+        }, "Proxy request metrics"), "Send final proxy request timings to the connected tunnel client")
+    },
+    emitReturnableEvents: {},
+    onReturnableEvents: {
+        "proxy.request": createReturnableEvent(bsb.object({
+            hostname: bsb.string({ description: "Public request hostname" }),
+            method: bsb.string({ description: "HTTP method" }),
+            path: bsb.string({ description: "Path and query" }),
+            headers: bsb.record(bsb.string({ description: "Header name" }), bsb.string({ description: "Header value" }), "Headers"),
+            body: optional(bsb.string({ description: "Base64 encoded request body" })),
+            webStartedAt: bsb.number({ description: "Web service request start timestamp" })
+        }, "Proxy request"), bsb.object({
+            requestId: bsb.string({ description: "Request id" }),
+            ownerServerId: bsb.string({ description: "Client API server id" }),
+            status: bsb.number({ description: "HTTP status" }),
+            headers: bsb.record(bsb.string({ description: "Header name" }), bsb.string({ description: "Header value" }), "Headers"),
+            body: bsb.string({ description: "Base64 encoded response body" }),
+            webStartedAt: bsb.number({ description: "Web service request start timestamp" }),
+            clientApiRoundtripMs: bsb.number({ description: "Client API to CLI roundtrip duration" }),
+            cliOverheadMs: optional(bsb.number({ description: "CLI work outside origin read duration" })),
+            originMs: optional(bsb.number({ description: "Origin/read duration" }))
+        }, "Proxy response"), "Proxy an HTTP request through a connected tunnel client", 60)
+    },
+    emitBroadcast: {},
+    onBroadcast: {}
+});
+export class Plugin extends BSBService {
+    static Config = Config;
+    static EventSchemas = EventSchemas;
+    initBeforePlugins = [];
+    initAfterPlugins = [];
+    runBeforePlugins = [];
+    runAfterPlugins = [];
+    registry = new TunnelRegistry();
+    app;
+    server;
+    wss;
+    web;
+    pluginPackageVersion = "0.0.0";
+    constructor(cfg) {
+        super(cfg);
+        this.app = new H3();
+        this.server = createServer(toNodeHandler(this.app));
+        this.wss = new WebSocketServer({ noServer: true });
+        this.web = new TunnelWebClient(this);
+    }
+    async init(obs) {
+        await initializePrisma(this.config.database.connectionString, obs);
+        this.pluginPackageVersion = await loadPluginPackageVersion(this.packageCwd);
+        const now = new Date();
+        const [expired, disconnected] = await prisma.$transaction([
+            prisma.tunnel.updateMany({
+                where: { status: "active", expiresAt: { lte: now } },
+                data: { status: "expired" }
+            }),
+            // ponytail: single client-api replica; add owner heartbeats before horizontal scaling.
+            prisma.tunnel.updateMany({
+                where: { status: "active" },
+                data: { status: "disconnected" }
+            })
+        ]);
+        obs.log.info("CLIENT SESSION reconciled expired={expired} disconnected={disconnected}", {
+            expired: expired.count,
+            disconnected: disconnected.count
+        });
+        obs.log.info("init {plugin}", { plugin: this.pluginName });
+        await this.events.onReturnableEvent("proxy.request", obs, async (_handlerObs, input) => {
+            _handlerObs.log.info("CLIENT API proxy.request {method} {hostname}{path}", {
+                method: input.method,
+                hostname: input.hostname,
+                path: input.path
+            });
+            const tunnel = this.registry.get(input.hostname);
+            const unavailable = {
+                requestId: crypto.randomUUID(),
+                ownerServerId: this.appId,
+                status: 503,
+                headers: {},
+                body: Buffer.from("Tunnel unavailable").toString("base64"),
+                webStartedAt: input.webStartedAt,
+                clientApiRoundtripMs: 0
+            };
+            if (!tunnel)
+                return unavailable;
+            if (tunnel.ws.readyState !== tunnel.ws.OPEN)
+                return unavailable;
+            return this.proxyRequest(tunnel, input.method, input.path, input.headers, input.body ?? "", input.webStartedAt);
+        });
+        await this.events.onEventSpecific("proxy.metrics", this.appId, obs, async (_handlerObs, input) => {
+            const tunnel = this.registry.get(input.hostname);
+            if (!tunnel || tunnel.ws.readyState !== tunnel.ws.OPEN)
+                return;
+            tunnel.ws.send(JSON.stringify({
+                type: "request.metrics",
+                requestId: input.requestId,
+                totalMs: input.totalMs,
+                clientApiRoundtripMs: input.clientApiRoundtripMs,
+                cliOverheadMs: input.cliOverheadMs,
+                originMs: input.originMs,
+                internalServerMs: input.internalServerMs
+            }));
+        });
+        await this.events.onEventSpecific("ws.toOrigin", this.appId, obs, async (_handlerObs, input) => {
+            const tunnel = this.registry.get(input.hostname);
+            if (!tunnel || tunnel.ws.readyState !== tunnel.ws.OPEN) {
+                await this.web.wsFromOriginSpecific(input.publicServerId, _handlerObs, {
+                    publicSocketId: input.publicSocketId,
+                    frameType: "event",
+                    event: "close"
+                });
+                return;
+            }
+            tunnel.ws.send(JSON.stringify({
+                type: "ws.toOrigin",
+                publicServerId: input.publicServerId,
+                publicSocketId: input.publicSocketId,
+                path: input.path,
+                frameType: input.frameType,
+                message: input.event,
+                body: input.body
+            }));
+        });
+        const domain = this.config.domain;
+        const publicUrl = this.config.publicUrl;
+        this.app.get("/health", () => new Response("ok\n", {
+            headers: {
+                "content-type": "text/plain; charset=utf-8",
+                "x-bettertunnels-version": this.pluginPackageVersion
+            }
+        }));
+        this.app.get("/api/client/status", async (event) => {
+            const token = bearerToken(event.req.headers);
+            const auth = await validateDeviceToken(token, proxyClientIpFromHeaders(event.req.headers), event.req.headers.get("user-agent") ?? "");
+            if (!auth)
+                return json({ status: "unauthenticated" }, 401);
+            return json({
+                status: "authenticated",
+                serverVersion: this.pluginPackageVersion,
+                tenantId: auth.tenantId,
+                bpUserSubject: auth.bpUserSubject,
+                tokenExpiresAt: auth.expiresAt.toISOString(),
+                limits: {
+                    tunnelTtlHours: 24,
+                    requestTimeoutSeconds: 300,
+                    idleTimeoutSeconds: 60,
+                    customPrefixes: true
+                }
+            });
+        });
+        this.app.post("/api/client/auth/start", async (event) => {
+            const body = AuthStartRequestSchema.parse(await safeJson(event.req));
+            const browserKey = shortBrowserKey();
+            const pollSecret = randomToken();
+            const expiresAt = new Date(Date.now() + AUTH_SESSION_TTL_MS);
+            const authBase = body.authAppBaseUrl ?? this.config.authAppBaseUrl;
+            const browserUrl = buildAuthUrl(authBase, this.config.authVerifyPath, browserKey);
+            const clientIp = proxyClientIpFromHeaders(event.req.headers);
+            const session = await prisma.clientAuthSession.create({
+                data: {
+                    browserKeyHash: hashSecret(browserKey),
+                    pollSecretHash: hashSecret(pollSecret),
+                    clientIpHash: hashSecret(clientIp),
+                    userAgentHash: hashSecret(event.req.headers.get("user-agent") ?? ""),
+                    expiresAt
+                }
+            });
+            const url = new URL(browserUrl);
+            url.searchParams.set("session", session.id);
+            url.searchParams.set("key", browserKey);
+            return json(AuthStartResponseSchema.parse({
+                sessionId: session.id,
+                pollSecret,
+                browserUrl: url.toString(),
+                expiresAt: expiresAt.toISOString()
+            }));
+        });
+        this.app.get("/api/client/auth/status", async (event) => {
+            const url = new URL(event.req.url);
+            const sessionId = url.searchParams.get("sessionId") ?? "";
+            const pollSecret = bearerToken(event.req.headers) ?? "";
+            if (!sessionId || !pollSecret) {
+                return json(AuthStatusResponseSchema.parse({ status: "invalid", message: "Missing auth session credentials." }), 401);
+            }
+            const session = await prisma.clientAuthSession.findUnique({ where: { id: sessionId } });
+            if (!session || !verifySecret(pollSecret, session.pollSecretHash)) {
+                return json(AuthStatusResponseSchema.parse({ status: "invalid", message: "Invalid auth session." }), 401);
+            }
+            if (session.expiresAt <= new Date() && session.status === "pending") {
+                await prisma.clientAuthSession.update({ where: { id: session.id }, data: { status: "expired" } });
+                return json(AuthStatusResponseSchema.parse({ status: "expired", message: "Authentication session expired." }), 410);
+            }
+            if (session.status === "pending") {
+                return json(AuthStatusResponseSchema.parse({ status: "pending" }));
+            }
+            if (session.status !== "approved" || !session.tenantId || !session.bpUserSubject) {
+                return json(AuthStatusResponseSchema.parse({ status: session.status, message: "Authentication session is not approved." }), 409);
+            }
+            const clientIp = proxyClientIpFromHeaders(event.req.headers);
+            const ipRange = normalizeIpRange(clientIp);
+            if (!ipRange) {
+                return json(AuthStatusResponseSchema.parse({ status: "invalid", message: "Unable to bind token to public IP range." }), 400);
+            }
+            const deviceToken = `bt_${randomToken(32)}`;
+            const tokenExpiresAt = new Date(Date.now() + DEVICE_TOKEN_TTL_MS);
+            await prisma.$transaction([
+                prisma.clientDeviceToken.create({
+                    data: {
+                        tenantId: session.tenantId,
+                        bpUserSubject: session.bpUserSubject,
+                        tokenHash: hashSecret(deviceToken),
+                        name: "BetterTunnels CLI",
+                        ipRangeHash: hashSecret(ipRange.cidr),
+                        ipFamily: ipRange.family,
+                        userAgentHash: hashSecret(event.req.headers.get("user-agent") ?? ""),
+                        expiresAt: tokenExpiresAt
+                    }
+                }),
+                prisma.clientAuthSession.update({
+                    where: { id: session.id },
+                    data: { status: "consumed", consumedAt: new Date() }
+                })
+            ]);
+            return json(AuthStatusResponseSchema.parse({
+                status: "approved",
+                token: deviceToken,
+                expiresAt: tokenExpiresAt.toISOString(),
+                tenantId: session.tenantId,
+                bpUserSubject: session.bpUserSubject,
+                bpUserEmail: session.bpUserEmail ?? undefined
+            }));
+        });
+        this.server.on("upgrade", (request, socket, head) => {
+            const url = new URL(request.url ?? "/", `http://${request.headers.host ?? "localhost"}`);
+            if (url.pathname !== "/api/client/ws") {
+                socket.destroy();
+                return;
+            }
+            this.wss.handleUpgrade(request, socket, head, (ws) => {
+                obs.log.info("CLIENT WS upgrade {path}", { path: url.pathname });
+                void this.handleTunnelSocket(ws, url, request.headers["user-agent"] ?? "", proxyClientIp(request.headers), domain, publicUrl, obs);
+            });
+        });
+    }
+    async run(obs) {
+        const port = this.config.port;
+        await new Promise((resolve) => {
+            this.server.listen(port, "0.0.0.0", () => resolve());
+        });
+        obs.log.info(`client-api listening on port ${port}`);
+    }
+    async dispose() {
+        for (const tunnel of this.registry.values()) {
+            clearTimeout(tunnel.expiryTimer);
+            tunnel.ws.close(1001, "server shutting down");
+        }
+        await prisma.tunnel.updateMany({
+            where: { status: "active", ownerServerId: this.appId },
+            data: { status: "disconnected" }
+        });
+        this.wss.close();
+        await new Promise((resolve, reject) => {
+            this.server.close((error) => error ? reject(error) : resolve());
+        });
+    }
+    async handleTunnelSocket(ws, url, userAgent, clientIp, domain, publicUrl, obs) {
+        const input = TunnelCreateSchema.parse({
+            sessionId: url.searchParams.get("sessionId") ?? "",
+            targetHost: url.searchParams.get("targetHost") ?? "127.0.0.1",
+            targetPort: Number(url.searchParams.get("targetPort") ?? "0"),
+            clientVersion: url.searchParams.get("clientVersion") ?? undefined,
+            authenticated: url.searchParams.get("authenticated") === "true",
+            prefix: url.searchParams.get("prefix") ?? undefined,
+            validation: url.searchParams.get("validation") ?? undefined,
+            token: url.searchParams.get("token") ?? undefined
+        });
+        const versionIssue = incompatibleMajor(input.clientVersion, this.pluginPackageVersion);
+        if (versionIssue) {
+            ws.close(1008, versionIssue);
+            obs.log.warn("CLIENT SESSION rejected incompatible version client={clientVersion} server={serverVersion} from {clientIp}", {
+                clientVersion: input.clientVersion ?? "unknown",
+                serverVersion: this.pluginPackageVersion,
+                clientIp
+            });
+            return;
+        }
+        const authContext = input.authenticated
+            ? await validateDeviceToken(input.token, clientIp, Array.isArray(userAgent) ? userAgent.join(" ") : userAgent)
+            : undefined;
+        if (input.authenticated && !authContext) {
+            ws.close(1008, "reauth required");
+            obs.log.warn("CLIENT SESSION rejected authenticated tunnel from {clientIp}", { clientIp });
+            return;
+        }
+        const authenticated = !!authContext;
+        const validation = authenticated && input.validation === "ip" ? "ip" : "cookie";
+        let subdomain;
+        if (!(authenticated && input.prefix)) {
+            // Reuse the prior subdomain for this session so reconnects keep the same public URL.
+            const prior = await prisma.tunnel.findFirst({
+                where: {
+                    sessionId: input.sessionId,
+                    targetHost: input.targetHost,
+                    targetPort: input.targetPort,
+                    expiresAt: { gt: new Date() }
+                },
+                orderBy: { expiresAt: "desc" }
+            });
+            subdomain = prior?.subdomain;
+        }
+        if (!subdomain) {
+            const prefix = authenticated && input.prefix ? input.prefix : randomPrefix();
+            subdomain = buildTunnelSubdomain(prefix, input.targetPort, clientIp);
+        }
+        const expiresAt = new Date(Date.now() + (authenticated ? 24 * 60 * 60 * 1000 : 6 * 60 * 60 * 1000));
+        const sessionObs = this.createTrace("bt.client.session", {
+            "bt.client.session_id": input.sessionId,
+            "bt.tunnel.subdomain": subdomain,
+            "bt.tunnel.authenticated": authenticated,
+            "client.address": clientIp
+        });
+        sessionObs.log.info("CLIENT SESSION connect {subdomain} from {clientIp}", {
+            subdomain,
+            clientIp
+        });
+        const session = await prisma.clientSession.upsert({
+            where: { id: input.sessionId },
+            create: {
+                id: input.sessionId,
+                accountId: authContext?.accountId,
+                userAgent: Array.isArray(userAgent) ? userAgent.join(" ") : userAgent,
+                ipHash: hashValue(clientIp),
+                expiresAt
+            },
+            update: { expiresAt }
+        });
+        const tunnelRow = await prisma.tunnel.upsert({
+            where: { subdomain },
+            create: {
+                sessionId: session.id,
+                subdomain,
+                ownerServerId: this.appId,
+                targetHost: input.targetHost,
+                targetPort: input.targetPort,
+                authenticated,
+                validation,
+                accountId: authContext?.accountId,
+                status: "active",
+                expiresAt
+            },
+            update: {
+                sessionId: session.id,
+                ownerServerId: this.appId,
+                targetHost: input.targetHost,
+                targetPort: input.targetPort,
+                authenticated,
+                validation,
+                accountId: authContext?.accountId,
+                status: "active",
+                expiresAt
+            }
+        });
+        const expiryTimer = setTimeout(() => {
+            if (this.registry.get(subdomain)?.ws === ws) {
+                ws.close(1008, "tunnel expired");
+            }
+        }, Math.max(0, expiresAt.getTime() - Date.now()));
+        expiryTimer.unref();
+        const tunnel = {
+            id: tunnelRow.id,
+            subdomain,
+            targetHost: input.targetHost,
+            targetPort: input.targetPort,
+            authenticated,
+            expiresAt,
+            ws,
+            expiryTimer,
+            pending: new Map(),
+            sessionObs
+        };
+        this.registry.set(tunnel);
+        sessionObs.log.info("CLIENT TUNNEL active {subdomain} -> {host}:{port}", {
+            subdomain,
+            host: input.targetHost,
+            port: input.targetPort
+        });
+        ws.send(JSON.stringify({
+            type: "tunnel.ready",
+            publicUrl: publicUrl.replace(/\/$/, "").replace(`://${domain}`, `://${subdomain}.${domain}`),
+            subdomain,
+            expiresAt: expiresAt.toISOString(),
+            serverVersion: this.pluginPackageVersion
+        }));
+        ws.on("message", (raw) => this.handleClientFrame(tunnel, raw.toString()));
+        ws.on("close", (code, reason) => {
+            clearTimeout(tunnel.expiryTimer);
+            sessionObs.log.warn("CLIENT TUNNEL disconnected {subdomain}", { subdomain });
+            for (const [requestId, pending] of tunnel.pending.entries()) {
+                this.failPending(tunnel, requestId, pending, new Error("Tunnel client disconnected."));
+            }
+            // A reconnect may already own this subdomain; only tear down if this socket is still the registered one.
+            if (this.registry.get(subdomain)?.ws === ws) {
+                this.registry.delete(subdomain);
+                void prisma.tunnel.update({
+                    where: { id: tunnel.id },
+                    data: { status: tunnelStatusAfterDisconnect(tunnel.expiresAt) }
+                }).catch(() => undefined);
+            }
+            sessionObs.end({ "bt.client.disconnect": true });
+            sessionObs.log.warn("CLIENT TUNNEL socket closed {subdomain} code={code} reason={reason}", {
+                subdomain,
+                code,
+                reason: reason.toString()
+            });
+        });
+        ws.on("error", (error) => {
+            sessionObs.log.error("CLIENT TUNNEL socket error {subdomain}: {message}", {
+                subdomain,
+                message: error.message
+            });
+        });
+    }
+    async proxyRequest(tunnel, method, path, headers, body, webStartedAt) {
+        const requestId = crypto.randomUUID();
+        const clientApiSentAt = Date.now();
+        const timeoutMs = tunnel.authenticated ? 5 * 60 * 1000 : 60 * 1000;
+        const idleTimeoutMs = tunnel.authenticated ? 60 * 1000 : 30 * 1000;
+        const requestObs = tunnel.sessionObs.startSpan("bt.client.proxy", {
+            "bt.tunnel.id": tunnel.id,
+            "bt.tunnel.subdomain": tunnel.subdomain,
+            "http.request.method": method,
+            "url.path": path
+        });
+        requestObs.log.info("CLIENT PROXY start {method} {path} via {subdomain}", {
+            method,
+            path,
+            subdomain: tunnel.subdomain
+        });
+        const responsePromise = new Promise((resolve, reject) => {
+            const pending = {
+                resolve: (response) => {
+                    void response.arrayBuffer().then((arrayBuffer) => {
+                        const responseHeaders = {};
+                        response.headers.forEach((value, key) => {
+                            responseHeaders[key] = value;
+                        });
+                        const output = {
+                            requestId,
+                            ownerServerId: this.appId,
+                            status: response.status,
+                            headers: responseHeaders,
+                            body: Buffer.from(arrayBuffer).toString("base64"),
+                            webStartedAt: pending.webStartedAt,
+                            clientApiRoundtripMs: pending.clientApiRoundtripMs ?? Date.now() - pending.clientApiSentAt,
+                            cliOverheadMs: pending.cliOverheadMs,
+                            originMs: pending.originMs
+                        };
+                        requestObs.log.info("CLIENT PROXY complete {method} {path} -> {status}", {
+                            method,
+                            path,
+                            status: response.status
+                        });
+                        requestObs.end({ "http.response.status_code": response.status });
+                        resolve(output);
+                    }).catch(reject);
+                },
+                reject: (error) => {
+                    requestObs.error(error);
+                    requestObs.end({ "status": "failed" });
+                    reject(error);
+                },
+                chunks: [],
+                webStartedAt,
+                clientApiSentAt,
+                totalTimer: setTimeout(() => this.failPending(tunnel, requestId, pending, new Error("Local app timed out.")), timeoutMs),
+                firstByteTimer: setTimeout(() => this.failPending(tunnel, requestId, pending, new Error("Local app did not acknowledge request within 5s.")), 5 * 1000),
+                idleTimeoutMs
+            };
+            tunnel.pending.set(requestId, pending);
+        });
+        tunnel.ws.send(JSON.stringify({
+            type: "request.start",
+            requestId,
+            method,
+            path,
+            headers,
+            body,
+            webStartedAt,
+            clientApiSentAt
+        }));
+        return responsePromise;
+    }
+    handleClientFrame(tunnel, raw) {
+        let frame;
+        try {
+            frame = ClientFrameSchema.parse(JSON.parse(raw));
+        }
+        catch (error) {
+            tunnel.sessionObs.error(error instanceof Error ? error : new Error(String(error)));
+            tunnel.ws.close(1002, "invalid frame");
+            return;
+        }
+        if (frame.type === "ws.fromOrigin" && frame.publicServerId && frame.publicSocketId && frame.frameType) {
+            void this.web.wsFromOriginSpecific(frame.publicServerId, tunnel.sessionObs, {
+                publicSocketId: frame.publicSocketId,
+                frameType: frame.frameType,
+                event: frame.message,
+                body: frame.body
+            });
+            return;
+        }
+        if (!frame.requestId)
+            return;
+        const pending = tunnel.pending.get(frame.requestId);
+        if (!pending)
+            return;
+        if (frame.type === "response.start") {
+            clearTimeout(pending.firstByteTimer);
+            this.resetIdleTimer(tunnel, frame.requestId, pending);
+            pending.status = frame.status ?? 200;
+            pending.headers = frame.headers ?? {};
+            return;
+        }
+        if (frame.type === "response.body" && frame.body) {
+            this.resetIdleTimer(tunnel, frame.requestId, pending);
+            pending.chunks.push(frame.body);
+            return;
+        }
+        if (frame.type === "response.end") {
+            pending.clientApiRoundtripMs = Date.now() - pending.clientApiSentAt;
+            pending.cliOverheadMs = frame.cliOverheadMs;
+            pending.originMs = frame.originMs;
+            this.clearPendingTimers(pending);
+            tunnel.pending.delete(frame.requestId);
+            const buffer = Buffer.concat(pending.chunks.map((chunk) => Buffer.from(chunk, "base64")));
+            try {
+                pending.resolve(buildProxyResponse(buffer, pending.status ?? 200, stripResponseHeaders(pending.headers ?? {})));
+            }
+            catch (error) {
+                pending.reject(error instanceof Error ? error : new Error(String(error)));
+            }
+            return;
+        }
+        if (frame.type === "error") {
+            this.failPending(tunnel, frame.requestId, pending, new Error(frame.message ?? "Tunnel client error."));
+        }
+    }
+    resetIdleTimer(tunnel, requestId, pending) {
+        if (pending.idleTimer)
+            clearTimeout(pending.idleTimer);
+        pending.idleTimer = setTimeout(() => {
+            this.failPending(tunnel, requestId, pending, new Error("Local app response stalled."));
+        }, pending.idleTimeoutMs);
+    }
+    failPending(tunnel, requestId, pending, error) {
+        if (!tunnel.pending.has(requestId))
+            return;
+        this.clearPendingTimers(pending);
+        tunnel.pending.delete(requestId);
+        pending.reject(error);
+    }
+    clearPendingTimers(pending) {
+        clearTimeout(pending.totalTimer);
+        clearTimeout(pending.firstByteTimer);
+        if (pending.idleTimer)
+            clearTimeout(pending.idleTimer);
+    }
+}
+function incompatibleMajor(clientVersion, serverVersion) {
+    const client = majorVersion(clientVersion);
+    const server = majorVersion(serverVersion);
+    if (client === undefined || server === undefined)
+        return undefined;
+    if (client !== server) {
+        return `BetterTunnels CLI major version ${client} is incompatible with server major version ${server}. Update the CLI.`;
+    }
+    return undefined;
+}
+function majorVersion(value) {
+    const normalized = value?.trim().replace(/^v/, "");
+    if (!normalized || normalized === "dev")
+        return undefined;
+    const major = Number.parseInt(normalized.split(".")[0] ?? "", 10);
+    return Number.isFinite(major) ? major : undefined;
+}
+async function safeJson(request) {
+    try {
+        return await request.json();
+    }
+    catch {
+        return {};
+    }
+}
+async function loadPluginPackageVersion(packageCwd) {
+    try {
+        const raw = await readFile(join(packageCwd, "package.json"), "utf8");
+        const parsed = JSON.parse(raw);
+        return typeof parsed.version === "string" && parsed.version ? parsed.version : "0.0.0";
+    }
+    catch {
+        return "0.0.0";
+    }
+}
+// Response() throws on null-body statuses with a body, and on statuses outside 200-599.
+const NULL_BODY_STATUSES = new Set([101, 204, 205, 304]);
+export function buildProxyResponse(body, status, headers) {
+    const safeStatus = status >= 200 && status <= 599 ? status : 502;
+    return new Response(NULL_BODY_STATUSES.has(safeStatus) ? null : new Uint8Array(body), { status: safeStatus, headers });
+}
+function json(value, status = 200) {
+    return new Response(JSON.stringify(value), {
+        status,
+        headers: { "content-type": "application/json; charset=utf-8" }
+    });
+}
+function buildAuthUrl(base, path, browserKey) {
+    const url = new URL(path.startsWith("/") ? path : `/${path}`, base);
+    url.searchParams.set("key", browserKey);
+    return url.toString();
+}
+async function validateDeviceToken(token, clientIp, userAgent) {
+    if (!token)
+        return undefined;
+    const ipRange = normalizeIpRange(clientIp);
+    if (!ipRange)
+        return undefined;
+    const row = await prisma.clientDeviceToken.findUnique({
+        where: { tokenHash: hashSecret(token) }
+    });
+    if (!row || row.revokedAt || row.expiresAt <= new Date())
+        return undefined;
+    if (row.ipFamily !== ipRange.family || row.ipRangeHash !== hashSecret(ipRange.cidr))
+        return undefined;
+    if (row.userAgentHash && row.userAgentHash !== hashSecret(userAgent))
+        return undefined;
+    await prisma.clientDeviceToken.update({
+        where: { id: row.id },
+        data: { lastUsedAt: new Date() }
+    });
+    return {
+        accountId: row.accountId ?? undefined,
+        tenantId: row.tenantId,
+        bpUserSubject: row.bpUserSubject,
+        expiresAt: row.expiresAt
+    };
+}
+function proxyClientIp(headers) {
+    const forwardedFor = firstPublicForwardedIp(firstHeader(headers["x-forwarded-for"]));
+    if (forwardedFor)
+        return forwardedFor;
+    return firstHeader(headers["x-real-ip"])?.trim() || "unknown";
+}
+function proxyClientIpFromHeaders(headers) {
+    const forwardedFor = firstPublicForwardedIp(headers.get("x-forwarded-for") ?? undefined);
+    if (forwardedFor)
+        return forwardedFor;
+    return headers.get("x-real-ip")?.trim() || "unknown";
+}
+function firstHeader(value) {
+    return Array.isArray(value) ? value[0] : value;
+}
+function firstPublicForwardedIp(value) {
+    return value?.split(",").map((ip) => ip.trim()).find((ip) => ip && !isPrivateIp(ip));
+}
+function isPrivateIp(ip) {
+    return ip === "unknown"
+        || ip.startsWith("10.")
+        || ip.startsWith("192.168.")
+        || /^172\.(1[6-9]|2\d|3[0-1])\./.test(ip)
+        || ip.startsWith("127.")
+        || ip.startsWith("::1")
+        || ip.startsWith("fc")
+        || ip.startsWith("fd")
+        || ip.startsWith("fe80:");
+}
+function stripResponseHeaders(headers) {
+    const out = new Headers();
+    for (const [name, value] of Object.entries(headers)) {
+        const key = name.toLowerCase();
+        if (key === "set-cookie" || key === "connection" || key === "transfer-encoding")
+            continue;
+        out.set(name, value);
+    }
+    return out;
+}
+//# sourceMappingURL=index.js.map