@cimplify/cli 0.11.1 → 0.12.0

package/dist/dev-3TPDHU67.mjs

@@ -0,0 +1,1724 @@
+#!/usr/bin/env node
+import { parseEnvFile, formatEnvFile } from './chunk-DBZ3UOQ2.mjs';
+import { ENV_SCOPE, PUBLIC_ENV_PREFIX } from './chunk-MXYUAJEW.mjs';
+import { parseArgs, flagBool } from './chunk-C4M3DXKC.mjs';
+import { ApiClient } from './chunk-F4S5KETY.mjs';
+import { readAuth, readProjectLink } from './chunk-UBAI443T.mjs';
+import { info, CliError, CLI_ERROR_CODE, dim } from './chunk-E2T2SBP5.mjs';
+import { spawn } from 'child_process';
+import { promises } from 'fs';
+import path2 from 'path';
+import http from 'http';
+
+// src/tunnel/v2/codec.ts
+var HEADER_LEN = 9;
+var SUBPROTOCOL_V2 = "cimplify-tunnel.v2";
+var DEFAULT_MAX_FRAME_PAYLOAD = 65536;
+var DEFAULT_INITIAL_STREAM_WINDOW = 262144;
+var DEFAULT_CONNECTION_WINDOW = 4194304;
+var DEFAULT_MAX_CONCURRENT_STREAMS = 256;
+var MAX_HEAD_BYTES = 65536;
+var FRAME_TYPE_V2 = {
+  HELLO: 1,
+  OPEN: 2,
+  ACCEPT: 3,
+  DATA: 4,
+  END: 5,
+  CLOSE: 6,
+  RST: 7,
+  WINDOW_UPDATE: 8,
+  PING: 9,
+  PONG: 10,
+  GOAWAY: 11
+};
+var ERROR_CODE = {
+  PROTOCOL_ERROR: 1,
+  FLOW_CONTROL_ERROR: 3,
+  STREAM_CLOSED: 4,
+  REFUSED: 5,
+  UNSUPPORTED: 6};
+var WS_DATA_PREFIX = {
+  TEXT: 0,
+  BINARY: 1,
+  TEXT_CONT: 2,
+  BINARY_CONT: 3
+};
+var CodecV2Error = class extends Error {
+};
+function encodeFrameV2(frame) {
+  const bytes = new Uint8Array(HEADER_LEN + frame.payload.length);
+  const view = new DataView(bytes.buffer);
+  view.setUint32(0, frame.streamId);
+  view.setUint8(4, frame.frameType);
+  view.setUint32(5, frame.payload.length);
+  bytes.set(frame.payload, HEADER_LEN);
+  return bytes;
+}
+function decodeFrameV2(bytes, maxPayload = DEFAULT_MAX_FRAME_PAYLOAD) {
+  if (bytes.length < HEADER_LEN) {
+    throw new CodecV2Error(`frame truncated: ${bytes.length} bytes`);
+  }
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  const streamId = view.getUint32(0);
+  const frameType = view.getUint8(4);
+  const declared = view.getUint32(5);
+  if (declared > maxPayload) {
+    throw new CodecV2Error(`payload length ${declared} exceeds negotiated max ${maxPayload}`);
+  }
+  const actual = bytes.length - HEADER_LEN;
+  if (declared !== actual) {
+    throw new CodecV2Error(`payload length field ${declared} does not match remaining ${actual} bytes`);
+  }
+  return { streamId, frameType, payload: bytes.subarray(HEADER_LEN) };
+}
+function payloadU32(frame) {
+  if (frame.payload.length !== 4) return null;
+  return new DataView(frame.payload.buffer, frame.payload.byteOffset, 4).getUint32(0);
+}
+function rstFrame(streamId, code) {
+  const payload = new Uint8Array(4);
+  new DataView(payload.buffer).setUint32(0, code);
+  return { streamId, frameType: FRAME_TYPE_V2.RST, payload };
+}
+function windowUpdateFrame(streamId, credit) {
+  const payload = new Uint8Array(4);
+  new DataView(payload.buffer).setUint32(0, credit);
+  return { streamId, frameType: FRAME_TYPE_V2.WINDOW_UPDATE, payload };
+}
+function defaultHello(build) {
+  return {
+    version: 2,
+    initial_stream_window: DEFAULT_INITIAL_STREAM_WINDOW,
+    connection_window: DEFAULT_CONNECTION_WINDOW,
+    max_frame_payload: DEFAULT_MAX_FRAME_PAYLOAD,
+    max_concurrent_streams: DEFAULT_MAX_CONCURRENT_STREAMS,
+    capabilities: ["http", "ws", "control"],
+    ...{}
+  };
+}
+function parseHello(payload) {
+  const raw = JSON.parse(new TextDecoder().decode(payload));
+  if (typeof raw.version !== "number") {
+    throw new CodecV2Error("HELLO missing version");
+  }
+  return {
+    version: raw.version,
+    initial_stream_window: raw.initial_stream_window ?? DEFAULT_INITIAL_STREAM_WINDOW,
+    connection_window: raw.connection_window ?? DEFAULT_CONNECTION_WINDOW,
+    max_frame_payload: raw.max_frame_payload ?? DEFAULT_MAX_FRAME_PAYLOAD,
+    max_concurrent_streams: raw.max_concurrent_streams ?? DEFAULT_MAX_CONCURRENT_STREAMS,
+    capabilities: raw.capabilities ?? [],
+    ...raw.build ? { build: raw.build } : {}
+  };
+}
+
+// src/tunnel/v2/ws-framing.ts
+var textEncoder = new TextEncoder();
+var textDecoder = new TextDecoder();
+function encodeWsMessage(message, maxPayload) {
+  const body = message.type === "text" ? textEncoder.encode(message.data) : message.data;
+  const contPrefix = message.type === "text" ? WS_DATA_PREFIX.TEXT_CONT : WS_DATA_PREFIX.BINARY_CONT;
+  const finalPrefix = message.type === "text" ? WS_DATA_PREFIX.TEXT : WS_DATA_PREFIX.BINARY;
+  const chunkSize = Math.max(1, maxPayload - 1);
+  const frames = [];
+  if (body.length === 0) {
+    return [Uint8Array.of(finalPrefix)];
+  }
+  for (let offset = 0; offset < body.length; offset += chunkSize) {
+    const chunk = body.subarray(offset, offset + chunkSize);
+    const isLast = offset + chunkSize >= body.length;
+    const framed = new Uint8Array(chunk.length + 1);
+    framed[0] = isLast ? finalPrefix : contPrefix;
+    framed.set(chunk, 1);
+    frames.push(framed);
+  }
+  return frames;
+}
+var WsReassembler = class {
+  buffer = [];
+  bufferedType = null;
+  /** Feed one DATA payload; returns a completed message, or null mid-fragment. */
+  push(payload) {
+    if (payload.length === 0) return null;
+    const prefix = payload[0];
+    const chunk = payload.subarray(1);
+    switch (prefix) {
+      case WS_DATA_PREFIX.TEXT_CONT:
+        this.startOrAppend("text", chunk);
+        return null;
+      case WS_DATA_PREFIX.BINARY_CONT:
+        this.startOrAppend("binary", chunk);
+        return null;
+      case WS_DATA_PREFIX.TEXT:
+        return this.finish("text", chunk);
+      case WS_DATA_PREFIX.BINARY:
+        return this.finish("binary", chunk);
+      default:
+        return null;
+    }
+  }
+  startOrAppend(type, chunk) {
+    if (this.bufferedType === null) this.bufferedType = type;
+    this.buffer.push(chunk);
+  }
+  finish(type, chunk) {
+    if (this.buffer.length === 0) {
+      return this.materialize(type, [chunk]);
+    }
+    const resolvedType = this.bufferedType ?? type;
+    this.buffer.push(chunk);
+    const parts = this.buffer;
+    this.buffer = [];
+    this.bufferedType = null;
+    return this.materialize(resolvedType, parts);
+  }
+  materialize(type, parts) {
+    const total = parts.reduce((sum, p) => sum + p.length, 0);
+    const joined = new Uint8Array(total);
+    let offset = 0;
+    for (const part of parts) {
+      joined.set(part, offset);
+      offset += part.length;
+    }
+    return type === "text" ? { type: "text", data: textDecoder.decode(joined) } : { type: "binary", data: joined };
+  }
+};
+
+// src/tunnel/v2/agent-kinds.ts
+var LOCAL_HOST = "127.0.0.1";
+var HEADER_SEC_WS_PROTOCOL = "sec-websocket-protocol";
+var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
+  "connection",
+  "keep-alive",
+  "proxy-authenticate",
+  "proxy-authorization",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade"
+]);
+var textEncoder2 = new TextEncoder();
+var AgentDispatcher = class {
+  kinds = /* @__PURE__ */ new Map();
+  register(kind) {
+    this.kinds.set(kind.kind, kind);
+    return this;
+  }
+  dispatch(incoming) {
+    const handler = this.kinds.get(incoming.kind);
+    if (!handler) {
+      void incoming.stream.rst(ERROR_CODE.UNSUPPORTED);
+      return;
+    }
+    handler.handle(incoming);
+  }
+};
+var HttpProxyKind = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  ctx;
+  kind = "http";
+  handle(incoming) {
+    void this.proxy(incoming);
+  }
+  async proxy(incoming) {
+    const head = incoming.head;
+    const request = http.request({
+      host: LOCAL_HOST,
+      port: this.ctx.localPort,
+      method: head.method,
+      path: head.path,
+      headers: toNodeHeaders(head.headers)
+    });
+    request.on("response", (response) => void this.pumpResponse(incoming.stream, response));
+    request.on("error", (error) => void this.answerError(incoming.stream, error));
+    void this.pumpRequestBody(incoming.stream, request);
+  }
+  async pumpRequestBody(stream, request) {
+    for (; ; ) {
+      const event = await stream.recv();
+      if (event === null) {
+        request.destroy();
+        return;
+      }
+      if (event.type === "data") {
+        request.write(Buffer.from(event.payload));
+      } else if (event.type === "end") {
+        request.end();
+        return;
+      } else {
+        request.destroy();
+        return;
+      }
+    }
+  }
+  async pumpResponse(stream, response) {
+    const headers = [];
+    for (let i = 0; i + 1 < response.rawHeaders.length; i += 2) {
+      headers.push([response.rawHeaders[i].toLowerCase(), response.rawHeaders[i + 1]]);
+    }
+    await stream.accept({ status: response.statusCode ?? 502, headers });
+    for await (const chunk of response) {
+      await stream.data(new Uint8Array(chunk));
+    }
+    await stream.end();
+  }
+  async answerError(stream, error) {
+    try {
+      await stream.accept({
+        status: 502,
+        headers: [["content-type", "text/plain; charset=utf-8"]]
+      });
+      await stream.data(textEncoder2.encode(`dev server unreachable: ${error.message}`));
+      await stream.end();
+    } catch {
+    }
+  }
+};
+var WsSpliceKind = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  ctx;
+  kind = "ws";
+  handle(incoming) {
+    void this.splice(incoming);
+  }
+  async splice(incoming) {
+    const head = incoming.head;
+    const protocols = head.headers.filter(([name]) => name === HEADER_SEC_WS_PROTOCOL).flatMap(([, value]) => value.split(",")).map((value) => value.trim()).filter((value) => value.length > 0);
+    const local = this.ctx.createLocalSocket(
+      `ws://${LOCAL_HOST}:${this.ctx.localPort}${head.path}`,
+      protocols
+    );
+    local.binaryType = "arraybuffer";
+    let opened = false;
+    const reassembler = new WsReassembler();
+    local.addEventListener("open", () => {
+      opened = true;
+      const headers = local.protocol ? [[HEADER_SEC_WS_PROTOCOL, local.protocol]] : [];
+      void incoming.stream.accept({ status: 101, headers });
+    });
+    local.addEventListener("message", (event) => {
+      const message = toWsMessage(event.data);
+      if (!message) return;
+      for (const frame of encodeWsMessage(message, this.ctx.maxFramePayload)) {
+        void incoming.stream.data(frame);
+      }
+    });
+    local.addEventListener("close", (event) => {
+      void incoming.stream.close({ code: sendableCloseCode(event.code), reason: event.reason });
+    });
+    local.addEventListener("error", () => {
+      if (opened) return;
+      void this.refuse(incoming.stream);
+    });
+    for (; ; ) {
+      const event = await incoming.stream.recv();
+      if (event === null) return;
+      if (event.type === "data") {
+        const message = reassembler.push(event.payload);
+        if (message) {
+          local.send(message.type === "text" ? message.data : message.data);
+        }
+      } else if (event.type === "close") {
+        const info2 = event.info;
+        local.close(sendableCloseCode(info2?.code), info2?.reason);
+        return;
+      } else if (event.type === "end" || event.type === "rst") {
+        local.close();
+        return;
+      }
+    }
+  }
+  async refuse(stream) {
+    try {
+      await stream.accept({
+        status: 502,
+        headers: [["content-type", "text/plain; charset=utf-8"]]
+      });
+      await stream.data(textEncoder2.encode("dev server refused the websocket"));
+      await stream.end();
+    } catch {
+    }
+  }
+};
+function toNodeHeaders(pairs) {
+  const out = {};
+  for (const [name, value] of pairs) {
+    if (HOP_BY_HOP_HEADERS.has(name)) continue;
+    const existing = out[name];
+    if (existing === void 0) out[name] = value;
+    else if (Array.isArray(existing)) existing.push(value);
+    else out[name] = [existing, value];
+  }
+  return out;
+}
+function toWsMessage(data) {
+  if (typeof data === "string") return { type: "text", data };
+  if (data instanceof ArrayBuffer) return { type: "binary", data: new Uint8Array(data) };
+  if (data instanceof Uint8Array) return { type: "binary", data };
+  return null;
+}
+function sendableCloseCode(code) {
+  if (code === void 0) return void 0;
+  const legal = code >= 1e3 && code <= 1003 || code >= 1007 && code <= 1014 || code >= 3e3 && code <= 4999;
+  return legal ? code : void 0;
+}
+
+// src/tunnel/protocol.ts
+var MAX_PAYLOAD = 262144;
+var HEADER_LEN2 = 9;
+var SUBPROTOCOL = "cimplify-tunnel.v1";
+var CONNECT_PATH = "/__cimplify/connect";
+var FRAME_TYPE = {
+  OPEN_HTTP: 1,
+  OPEN_WS: 2,
+  RESP_HEAD: 3,
+  BODY: 4,
+  END: 5,
+  WS_TEXT: 6,
+  WS_BIN: 7,
+  CLOSE: 8
+};
+var KNOWN_FRAME_TYPES = new Set(Object.values(FRAME_TYPE));
+var TunnelProtocolError = class extends Error {
+};
+function encodeFrame(frame) {
+  if (frame.payload.length > MAX_PAYLOAD) {
+    throw new TunnelProtocolError(`payload length ${frame.payload.length} exceeds ${MAX_PAYLOAD}`);
+  }
+  const bytes = new Uint8Array(HEADER_LEN2 + frame.payload.length);
+  const view = new DataView(bytes.buffer);
+  view.setUint32(0, frame.streamId);
+  view.setUint8(4, frame.frameType);
+  view.setUint32(5, frame.payload.length);
+  bytes.set(frame.payload, HEADER_LEN2);
+  return bytes;
+}
+function decodeFrame(bytes) {
+  if (bytes.length < HEADER_LEN2) {
+    throw new TunnelProtocolError(`frame truncated: ${bytes.length} bytes`);
+  }
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  const streamId = view.getUint32(0);
+  const rawType = view.getUint8(4);
+  if (!KNOWN_FRAME_TYPES.has(rawType)) {
+    throw new TunnelProtocolError(`unknown frame type 0x${rawType.toString(16).padStart(2, "0")}`);
+  }
+  const declared = view.getUint32(5);
+  if (declared > MAX_PAYLOAD) {
+    throw new TunnelProtocolError(`payload length ${declared} exceeds ${MAX_PAYLOAD}`);
+  }
+  const actual = bytes.length - HEADER_LEN2;
+  if (declared !== actual) {
+    throw new TunnelProtocolError(
+      `payload length field ${declared} does not match remaining ${actual} bytes`
+    );
+  }
+  return { streamId, frameType: rawType, payload: bytes.subarray(HEADER_LEN2) };
+}
+var textEncoder3 = new TextEncoder();
+var textDecoder2 = new TextDecoder();
+function encodeJsonPayload(value) {
+  return textEncoder3.encode(JSON.stringify(value));
+}
+function decodeJsonPayload(payload) {
+  return JSON.parse(textDecoder2.decode(payload));
+}
+function* chunkPayload(bytes) {
+  if (bytes.length === 0) {
+    return;
+  }
+  for (let offset = 0; offset < bytes.length; offset += MAX_PAYLOAD) {
+    yield bytes.subarray(offset, Math.min(offset + MAX_PAYLOAD, bytes.length));
+  }
+}
+
+// src/tunnel/client.ts
+var LOCAL_HOST2 = "127.0.0.1";
+var SEND_HIGH_WATER_BYTES = 4 * 1024 * 1024;
+var BACKPRESSURE_POLL_MS = 25;
+var EMPTY_PAYLOAD = new Uint8Array(0);
+var HEADER_SEC_WS_PROTOCOL2 = "sec-websocket-protocol";
+var HEADER_CONTENT_TYPE_TEXT = ["content-type", "text/plain; charset=utf-8"];
+var WS_CLOSE_NORMAL = 1e3;
+var HOP_BY_HOP_HEADERS2 = /* @__PURE__ */ new Set([
+  "connection",
+  "keep-alive",
+  "proxy-authenticate",
+  "proxy-authorization",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade"
+]);
+var textEncoder4 = new TextEncoder();
+var textDecoder3 = new TextDecoder();
+function defaultSocketFactory(url, protocols) {
+  const ctor = globalThis.WebSocket;
+  if (!ctor) {
+    throw new Error("global WebSocket is unavailable; the preview tunnel requires Bun or Node 22+");
+  }
+  return new ctor(url, protocols);
+}
+function connectUrl(baseUrl, token) {
+  return `${baseUrl.replace(/\/+$/, "")}${CONNECT_PATH}?token=${encodeURIComponent(token)}`;
+}
+var TunnelClient = class {
+  constructor(options) {
+    this.options = options;
+  }
+  options;
+  streams = /* @__PURE__ */ new Map();
+  socket = null;
+  closed = false;
+  start() {
+    const factory = this.options.createSocket ?? defaultSocketFactory;
+    const socket = factory(connectUrl(this.options.url, this.options.token), [SUBPROTOCOL]);
+    socket.binaryType = "arraybuffer";
+    this.socket = socket;
+    socket.addEventListener("open", () => {
+      if (!this.closed) this.options.events?.onConnected?.();
+    });
+    socket.addEventListener("message", (event) => this.handleMessage(event.data));
+    socket.addEventListener(
+      "close",
+      (event) => this.teardown(`connection closed (${event.code ?? "unknown"})`, event.code)
+    );
+    socket.addEventListener("error", () => this.teardown("connection error"));
+    if (this.options.socketAlreadyOpen && !this.closed) this.options.events?.onConnected?.();
+  }
+  stop() {
+    if (this.closed) return;
+    try {
+      this.socket?.close(WS_CLOSE_NORMAL);
+    } catch {
+    }
+    this.teardown("stopped");
+  }
+  teardown(reason, closeCode) {
+    if (this.closed) return;
+    this.closed = true;
+    for (const handler of this.streams.values()) {
+      handler.abort();
+    }
+    this.streams.clear();
+    this.socket = null;
+    this.options.events?.onClosed?.(reason, closeCode);
+  }
+  handleMessage(data) {
+    if (this.closed) return;
+    let bytes;
+    if (data instanceof ArrayBuffer) {
+      bytes = new Uint8Array(data);
+    } else if (data instanceof Uint8Array) {
+      bytes = data;
+    } else {
+      this.failConnection("non-binary message violates the tunnel protocol");
+      return;
+    }
+    let frame;
+    try {
+      frame = decodeFrame(bytes);
+    } catch (err) {
+      this.failConnection(`undecodable frame: ${err.message}`);
+      return;
+    }
+    this.dispatch(frame);
+  }
+  dispatch(frame) {
+    const handler = this.streams.get(frame.streamId);
+    if (handler) {
+      if (frame.frameType === FRAME_TYPE.CLOSE) this.streams.delete(frame.streamId);
+      handler.handleFrame(frame);
+      return;
+    }
+    switch (frame.frameType) {
+      case FRAME_TYPE.OPEN_HTTP:
+        this.openHttp(frame);
+        break;
+      case FRAME_TYPE.OPEN_WS:
+        this.openWs(frame);
+        break;
+      case FRAME_TYPE.CLOSE:
+        break;
+      default:
+        this.sendClose(frame.streamId);
+    }
+  }
+  openHttp(frame) {
+    let head;
+    try {
+      head = decodeJsonPayload(frame.payload);
+    } catch {
+      this.sendClose(frame.streamId);
+      return;
+    }
+    this.streams.set(
+      frame.streamId,
+      new HttpProxyStream(this.contextFor(frame.streamId), head, this.options.localPort)
+    );
+  }
+  openWs(frame) {
+    let head;
+    try {
+      head = decodeJsonPayload(frame.payload);
+    } catch {
+      this.sendClose(frame.streamId);
+      return;
+    }
+    const factory = this.options.createLocalSocket ?? defaultSocketFactory;
+    this.streams.set(
+      frame.streamId,
+      new WsProxyStream(this.contextFor(frame.streamId), head, this.options.localPort, factory)
+    );
+  }
+  contextFor(streamId) {
+    return {
+      send: (frameType, payload) => this.sendFrame({ streamId, frameType, payload }),
+      sendJson: (frameType, value) => this.sendFrame({ streamId, frameType, payload: encodeJsonPayload(value) }),
+      finish: () => {
+        this.streams.delete(streamId);
+      },
+      fail: (info2) => {
+        this.streams.delete(streamId);
+        this.sendClose(streamId, info2);
+      },
+      bufferedAmount: () => this.socket?.bufferedAmount ?? 0
+    };
+  }
+  sendClose(streamId, info2) {
+    const payload = info2 && (info2.code !== void 0 || info2.reason !== void 0) ? encodeJsonPayload(info2) : EMPTY_PAYLOAD;
+    this.sendFrame({ streamId, frameType: FRAME_TYPE.CLOSE, payload });
+  }
+  sendFrame(frame) {
+    if (this.closed || !this.socket) return false;
+    try {
+      this.socket.send(encodeFrame(frame));
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  failConnection(reason) {
+    try {
+      this.socket?.close(WS_CLOSE_NORMAL);
+    } catch {
+    }
+    this.teardown(reason);
+  }
+};
+var HttpProxyStream = class {
+  constructor(ctx, head, localPort) {
+    this.ctx = ctx;
+    this.request = http.request({
+      host: LOCAL_HOST2,
+      port: localPort,
+      method: head.method,
+      path: head.path,
+      headers: toNodeHeaders2(head.headers)
+    });
+    this.request.on("response", (response) => this.pumpResponse(response));
+    this.request.on("error", (err) => this.handleRequestError(err));
+  }
+  ctx;
+  request;
+  responded = false;
+  done = false;
+  handleFrame(frame) {
+    switch (frame.frameType) {
+      case FRAME_TYPE.BODY:
+        this.request.write(Buffer.from(frame.payload));
+        break;
+      case FRAME_TYPE.END:
+        this.request.end();
+        break;
+      case FRAME_TYPE.CLOSE:
+        this.abort();
+        break;
+      default:
+        this.ctx.fail();
+        this.abort();
+    }
+  }
+  abort() {
+    this.done = true;
+    this.request.destroy();
+  }
+  pumpResponse(response) {
+    this.responded = true;
+    const headers = [];
+    for (let i = 0; i + 1 < response.rawHeaders.length; i += 2) {
+      headers.push([response.rawHeaders[i].toLowerCase(), response.rawHeaders[i + 1]]);
+    }
+    const head = { status: response.statusCode ?? 502, headers };
+    if (!this.ctx.sendJson(FRAME_TYPE.RESP_HEAD, head)) {
+      this.abort();
+      return;
+    }
+    response.on("data", (chunk) => {
+      for (const piece of chunkPayload(chunk)) {
+        if (!this.ctx.send(FRAME_TYPE.BODY, piece)) {
+          this.abort();
+          return;
+        }
+      }
+      this.applyBackpressure(response);
+    });
+    response.on("end", () => {
+      if (this.done) return;
+      this.done = true;
+      this.ctx.send(FRAME_TYPE.END, EMPTY_PAYLOAD);
+      this.ctx.finish();
+    });
+    response.on("error", () => {
+      if (this.done) return;
+      this.done = true;
+      this.ctx.fail();
+    });
+  }
+  /** The mux socket has no stream-level flow control; pause the local read
+   * side when the shared connection's send buffer backs up. */
+  applyBackpressure(response) {
+    if (this.ctx.bufferedAmount() <= SEND_HIGH_WATER_BYTES) return;
+    response.pause();
+    const poll = () => {
+      if (this.done) return;
+      if (this.ctx.bufferedAmount() <= SEND_HIGH_WATER_BYTES) {
+        response.resume();
+      } else {
+        setTimeout(poll, BACKPRESSURE_POLL_MS);
+      }
+    };
+    setTimeout(poll, BACKPRESSURE_POLL_MS);
+  }
+  handleRequestError(err) {
+    if (this.done) return;
+    this.done = true;
+    if (this.responded) {
+      this.ctx.fail();
+      return;
+    }
+    this.ctx.sendJson(FRAME_TYPE.RESP_HEAD, {
+      status: 502,
+      headers: [HEADER_CONTENT_TYPE_TEXT]
+    });
+    this.ctx.send(FRAME_TYPE.BODY, textEncoder4.encode(`dev server unreachable: ${err.message}`));
+    this.ctx.send(FRAME_TYPE.END, EMPTY_PAYLOAD);
+    this.ctx.finish();
+  }
+};
+var WsProxyStream = class {
+  constructor(ctx, head, localPort, factory) {
+    this.ctx = ctx;
+    const protocols = head.headers.filter(([name]) => name === HEADER_SEC_WS_PROTOCOL2).flatMap(([, value]) => value.split(",")).map((value) => value.trim()).filter((value) => value.length > 0);
+    this.local = factory(`ws://${LOCAL_HOST2}:${localPort}${head.path}`, protocols);
+    this.local.binaryType = "arraybuffer";
+    this.local.addEventListener("open", () => {
+      this.opened = true;
+      const headers = this.local.protocol ? [[HEADER_SEC_WS_PROTOCOL2, this.local.protocol]] : [];
+      if (!this.ctx.sendJson(FRAME_TYPE.RESP_HEAD, { status: 101, headers })) {
+        this.abort();
+      }
+    });
+    this.local.addEventListener("message", (event) => this.forward(event.data));
+    this.local.addEventListener("close", (event) => {
+      if (this.done) return;
+      this.done = true;
+      this.ctx.fail({ code: sendableCloseCode2(event.code), reason: event.reason || void 0 });
+    });
+    this.local.addEventListener("error", () => {
+      if (this.done || this.opened) return;
+      this.done = true;
+      this.ctx.sendJson(FRAME_TYPE.RESP_HEAD, {
+        status: 502,
+        headers: [HEADER_CONTENT_TYPE_TEXT]
+      });
+      this.ctx.send(FRAME_TYPE.BODY, textEncoder4.encode("dev server refused the websocket"));
+      this.ctx.send(FRAME_TYPE.END, EMPTY_PAYLOAD);
+      this.ctx.finish();
+    });
+  }
+  ctx;
+  local;
+  opened = false;
+  done = false;
+  handleFrame(frame) {
+    switch (frame.frameType) {
+      case FRAME_TYPE.WS_TEXT:
+        this.local.send(textDecoder3.decode(frame.payload));
+        break;
+      case FRAME_TYPE.WS_BIN:
+        this.local.send(frame.payload);
+        break;
+      case FRAME_TYPE.CLOSE: {
+        this.done = true;
+        const info2 = parseCloseInfo(frame.payload);
+        this.local.close(sanitizeCloseCode(info2.code), info2.reason);
+        break;
+      }
+      default:
+        this.ctx.fail();
+        this.abort();
+    }
+  }
+  abort() {
+    this.done = true;
+    try {
+      this.local.close();
+    } catch {
+    }
+  }
+  forward(data) {
+    if (this.done) return;
+    let payload;
+    let frameType;
+    if (typeof data === "string") {
+      payload = textEncoder4.encode(data);
+      frameType = FRAME_TYPE.WS_TEXT;
+    } else if (data instanceof ArrayBuffer) {
+      payload = new Uint8Array(data);
+      frameType = FRAME_TYPE.WS_BIN;
+    } else if (data instanceof Uint8Array) {
+      payload = data;
+      frameType = FRAME_TYPE.WS_BIN;
+    } else {
+      return;
+    }
+    if (payload.length > MAX_PAYLOAD) {
+      this.done = true;
+      this.ctx.fail({ reason: "message exceeds tunnel frame cap" });
+      this.abort();
+      return;
+    }
+    if (!this.ctx.send(frameType, payload)) this.abort();
+  }
+};
+function toNodeHeaders2(pairs) {
+  const out = {};
+  for (const [name, value] of pairs) {
+    if (HOP_BY_HOP_HEADERS2.has(name)) continue;
+    const existing = out[name];
+    if (existing === void 0) {
+      out[name] = value;
+    } else if (Array.isArray(existing)) {
+      existing.push(value);
+    } else {
+      out[name] = [existing, value];
+    }
+  }
+  return out;
+}
+function parseCloseInfo(payload) {
+  if (payload.length === 0) return {};
+  try {
+    return decodeJsonPayload(payload);
+  } catch {
+    return {};
+  }
+}
+function sanitizeCloseCode(code) {
+  if (code === void 0) return void 0;
+  return code === WS_CLOSE_NORMAL || code >= 3e3 && code <= 4999 ? code : void 0;
+}
+function sendableCloseCode2(code) {
+  if (code === void 0) return void 0;
+  const legal = code >= 1e3 && code <= 1003 || code >= 1007 && code <= 1014 || code >= 3e3 && code <= 4999;
+  return legal ? code : void 0;
+}
+
+// src/tunnel/v2/flow.ts
+var SendWindow = class {
+  available;
+  constructor(initial) {
+    this.available = initial;
+  }
+  get availableCredit() {
+    return this.available;
+  }
+  grantable(wanted) {
+    return this.available <= 0 ? 0 : Math.min(this.available, wanted);
+  }
+  consume(n) {
+    this.available = Math.max(0, this.available - n);
+  }
+  /** Returns false on overflow past Number.MAX_SAFE_INTEGER (protocol error). */
+  increase(credit) {
+    const next = this.available + credit;
+    if (next > Number.MAX_SAFE_INTEGER) return false;
+    this.available = next;
+    return true;
+  }
+};
+var RecvWindow = class {
+  constructor(window) {
+    this.window = window;
+  }
+  window;
+  consumed = 0;
+  /** Credit to emit as WINDOW_UPDATE once half the window is consumed, else 0. */
+  recordConsumed(n) {
+    this.consumed += n;
+    if (this.window === 0 || this.consumed < Math.ceil(this.window / 2)) return 0;
+    const credit = this.consumed;
+    this.consumed = 0;
+    return credit;
+  }
+  outstandingCapacity() {
+    return Math.max(0, this.window - this.consumed);
+  }
+};
+
+// src/tunnel/v2/session.ts
+var SessionV2Error = class extends Error {
+};
+var StreamHandleV2 = class {
+  constructor(session, streamId) {
+    this.session = session;
+    this.streamId = streamId;
+  }
+  session;
+  streamId;
+  accept(head) {
+    return this.session.sendHead(this.streamId, FRAME_TYPE_V2.ACCEPT, head);
+  }
+  data(bytes) {
+    return this.session.queueData(this.streamId, bytes);
+  }
+  end() {
+    return this.session.sendEnd(this.streamId);
+  }
+  close(info2) {
+    return this.session.closeStream(this.streamId, info2);
+  }
+  rst(code) {
+    return this.session.rstStream(this.streamId, code);
+  }
+  /** Next event; null when the stream is gone. Reads drive window replenish. */
+  recv() {
+    return this.session.nextEvent(this.streamId);
+  }
+};
+var CONNECTION_STREAM_ID = 0;
+var textEncoder5 = new TextEncoder();
+var textDecoder4 = new TextDecoder();
+var SessionV2 = class {
+  constructor(transport, options) {
+    this.transport = transport;
+    this.options = options;
+    this.nextStreamId = options.role === "service" ? 1 : 2;
+    this.connectionSend = new SendWindow(0);
+    this.connectionRecv = new RecvWindow(options.local.connection_window);
+    transport.onMessage((bytes) => this.onMessage(bytes));
+    transport.onClose((reason) => this.teardown(reason));
+  }
+  transport;
+  options;
+  streams = /* @__PURE__ */ new Map();
+  ready = [];
+  connectionSend;
+  connectionRecv;
+  peer = null;
+  nextStreamId;
+  draining = false;
+  closed = false;
+  sending = Promise.resolve();
+  /** Send our HELLO; the peer's must arrive as its first frame. */
+  async start() {
+    const payload = textEncoder5.encode(JSON.stringify(this.options.local));
+    await this.transport.send(
+      encodeFrameV2({ streamId: CONNECTION_STREAM_ID, frameType: FRAME_TYPE_V2.HELLO, payload })
+    );
+  }
+  get peerHello() {
+    return this.peer;
+  }
+  async open(kind, head) {
+    if (this.closed || this.draining) throw new SessionV2Error("session closed or draining");
+    const peer = this.requirePeer();
+    if (!peer.capabilities.includes(kind)) throw new SessionV2Error(`peer lacks ${kind}`);
+    const streamId = this.nextStreamId;
+    this.nextStreamId += 2;
+    this.registerStream(streamId);
+    await this.sendHead(streamId, FRAME_TYPE_V2.OPEN, { kind, head });
+    return new StreamHandleV2(this, streamId);
+  }
+  async goAway(code, reason) {
+    this.draining = true;
+    await this.sendHead(CONNECTION_STREAM_ID, FRAME_TYPE_V2.GOAWAY, {
+      code,
+      last_stream_id: this.nextStreamId,
+      ...reason ? { reason } : {}
+    });
+  }
+  requirePeer() {
+    if (!this.peer) throw new SessionV2Error("handshake incomplete");
+    return this.peer;
+  }
+  registerStream(streamId) {
+    const peer = this.requirePeer();
+    const state = {
+      events: [],
+      waiter: null,
+      sendWindow: new SendWindow(peer.initial_stream_window),
+      recvWindow: new RecvWindow(this.options.local.initial_stream_window),
+      pending: [],
+      localEnded: false,
+      remoteEnded: false,
+      finished: false
+    };
+    this.streams.set(streamId, state);
+    return state;
+  }
+  onMessage(bytes) {
+    if (this.closed) return;
+    let frame;
+    try {
+      frame = decodeFrameV2(bytes, this.options.local.max_frame_payload);
+    } catch (error) {
+      this.fail(`undecodable frame: ${error.message}`);
+      return;
+    }
+    if (!this.peer) {
+      this.onHandshakeFrame(frame);
+      return;
+    }
+    void this.dispatch(frame);
+  }
+  onHandshakeFrame(frame) {
+    if (frame.frameType !== FRAME_TYPE_V2.HELLO || frame.streamId !== CONNECTION_STREAM_ID) {
+      this.fail("first frame was not HELLO");
+      return;
+    }
+    try {
+      const peer = parseHello(frame.payload);
+      if (peer.version !== this.options.local.version) {
+        this.fail(`peer version ${peer.version}`);
+        return;
+      }
+      this.peer = peer;
+      this.connectionSend = new SendWindow(peer.connection_window);
+    } catch (error) {
+      this.fail(error.message);
+    }
+  }
+  async dispatch(frame) {
+    switch (frame.frameType) {
+      case FRAME_TYPE_V2.HELLO:
+        this.fail("HELLO after handshake");
+        return;
+      case FRAME_TYPE_V2.OPEN:
+        this.onOpen(frame);
+        return;
+      case FRAME_TYPE_V2.ACCEPT:
+        this.deliver(frame.streamId, { type: "accepted", head: parseJson(frame.payload) });
+        return;
+      case FRAME_TYPE_V2.DATA:
+        this.onData(frame);
+        return;
+      case FRAME_TYPE_V2.END:
+        this.onEnd(frame.streamId);
+        return;
+      case FRAME_TYPE_V2.CLOSE:
+        this.finishStream(frame.streamId, { type: "close", info: parseJson(frame.payload) });
+        return;
+      case FRAME_TYPE_V2.RST:
+        this.finishStream(frame.streamId, {
+          type: "rst",
+          code: payloadU32(frame) ?? ERROR_CODE.PROTOCOL_ERROR
+        });
+        return;
+      case FRAME_TYPE_V2.WINDOW_UPDATE:
+        this.onWindowUpdate(frame);
+        return;
+      case FRAME_TYPE_V2.PING:
+        this.enqueueSend({ streamId: 0, frameType: FRAME_TYPE_V2.PONG, payload: frame.payload });
+        return;
+      case FRAME_TYPE_V2.GOAWAY:
+        this.draining = true;
+        return;
+      default:
+        return;
+    }
+  }
+  onOpen(frame) {
+    const streamId = frame.streamId;
+    const allocatesLocally = this.options.role === "service" ? streamId % 2 === 1 : streamId % 2 === 0;
+    if (streamId === CONNECTION_STREAM_ID || allocatesLocally || this.streams.has(streamId)) {
+      this.fail(`peer opened stream ${streamId}`);
+      return;
+    }
+    if (this.streams.size >= this.options.local.max_concurrent_streams || this.draining) {
+      this.enqueueSend(rstFrame(streamId, ERROR_CODE.REFUSED));
+      return;
+    }
+    const open = parseJson(frame.payload);
+    if (!open || typeof open.kind !== "string") {
+      this.enqueueSend(rstFrame(streamId, ERROR_CODE.PROTOCOL_ERROR));
+      return;
+    }
+    if (!this.options.local.capabilities.includes(open.kind)) {
+      this.enqueueSend(rstFrame(streamId, ERROR_CODE.UNSUPPORTED));
+      return;
+    }
+    this.registerStream(streamId);
+    this.options.onIncoming({
+      kind: open.kind,
+      head: open.head ?? null,
+      stream: new StreamHandleV2(this, streamId)
+    });
+  }
+  onData(frame) {
+    const len = frame.payload.length;
+    if (len > this.connectionRecv.outstandingCapacity()) {
+      this.fail("connection window overrun");
+      return;
+    }
+    const state = this.streams.get(frame.streamId);
+    if (!state) {
+      this.enqueueSend(rstFrame(frame.streamId, ERROR_CODE.STREAM_CLOSED));
+      return;
+    }
+    if (len > state.recvWindow.outstandingCapacity()) {
+      this.enqueueSend(rstFrame(frame.streamId, ERROR_CODE.FLOW_CONTROL_ERROR));
+      this.dropStream(frame.streamId);
+      return;
+    }
+    this.deliver(frame.streamId, { type: "data", payload: frame.payload });
+  }
+  onEnd(streamId) {
+    const state = this.streams.get(streamId);
+    if (!state) return;
+    state.remoteEnded = true;
+    this.deliver(streamId, { type: "end" });
+    if (state.localEnded) this.dropStream(streamId);
+  }
+  onWindowUpdate(frame) {
+    const credit = payloadU32(frame);
+    if (!credit) {
+      this.fail("bad WINDOW_UPDATE");
+      return;
+    }
+    const grew = frame.streamId === CONNECTION_STREAM_ID ? this.connectionSend.increase(credit) : this.streams.get(frame.streamId)?.sendWindow.increase(credit) ?? true;
+    if (!grew) {
+      this.fail("window overflow");
+      return;
+    }
+    this.drainReady();
+  }
+  // --- outbound path -------------------------------------------------------
+  queueData(streamId, bytes) {
+    const state = this.streams.get(streamId);
+    if (!state || this.closed) return Promise.reject(new SessionV2Error("stream closed"));
+    return new Promise((resolve, reject) => {
+      state.pending.push({ bytes, resolve, reject });
+      if (!this.ready.includes(streamId)) this.ready.push(streamId);
+      this.drainReady();
+    });
+  }
+  /** Round-robin: one window-and-frame-capped chunk per ready stream per turn. */
+  drainReady() {
+    const peer = this.peer;
+    if (!peer) return;
+    let turns = this.ready.length;
+    while (turns > 0) {
+      turns -= 1;
+      const streamId = this.ready.shift();
+      if (streamId === void 0) break;
+      const state = this.streams.get(streamId);
+      if (!state) continue;
+      const item = state.pending[0];
+      if (!item) continue;
+      const wanted = Math.min(item.bytes.length, peer.max_frame_payload);
+      const grant = this.connectionSend.grantable(state.sendWindow.grantable(wanted));
+      if (grant === 0) {
+        this.ready.push(streamId);
+        if (this.connectionSend.availableCredit <= 0) break;
+        continue;
+      }
+      const chunk = item.bytes.subarray(0, grant);
+      item.bytes = item.bytes.subarray(grant);
+      state.sendWindow.consume(grant);
+      this.connectionSend.consume(grant);
+      const finished = item.bytes.length === 0;
+      if (finished) state.pending.shift();
+      if (state.pending.length > 0) {
+        this.ready.push(streamId);
+        turns += 1;
+      }
+      this.enqueueSend({ streamId, frameType: FRAME_TYPE_V2.DATA, payload: chunk });
+      if (finished) item.resolve();
+    }
+  }
+  sendHead(streamId, frameType, value) {
+    const payload = textEncoder5.encode(JSON.stringify(value ?? null));
+    if (payload.length > MAX_HEAD_BYTES) {
+      return Promise.reject(new SessionV2Error("head exceeds MAX_HEAD_BYTES"));
+    }
+    return this.enqueueSend({ streamId, frameType, payload });
+  }
+  sendEnd(streamId) {
+    const state = this.streams.get(streamId);
+    const result = this.enqueueSend({
+      streamId,
+      frameType: FRAME_TYPE_V2.END,
+      payload: new Uint8Array(0)
+    });
+    if (state) {
+      state.localEnded = true;
+      if (state.remoteEnded) this.dropStream(streamId);
+    }
+    return result;
+  }
+  async closeStream(streamId, info2) {
+    await this.sendHead(streamId, FRAME_TYPE_V2.CLOSE, info2);
+    this.dropStream(streamId);
+  }
+  async rstStream(streamId, code) {
+    await this.enqueueSend(rstFrame(streamId, code));
+    this.dropStream(streamId);
+  }
+  /** Serialize transport writes so frames never interleave mid-encode. */
+  enqueueSend(frame) {
+    const encoded = encodeFrameV2(frame);
+    const next = this.sending.then(() => this.transport.send(encoded));
+    this.sending = next.catch(() => {
+    });
+    return next;
+  }
+  // --- delivery ------------------------------------------------------------
+  nextEvent(streamId) {
+    const state = this.streams.get(streamId);
+    if (!state) return Promise.resolve(null);
+    const queued = state.events.shift();
+    if (queued) {
+      this.recordConsumption(streamId, queued);
+      if (state.finished && state.events.length === 0) this.streams.delete(streamId);
+      return Promise.resolve(queued);
+    }
+    if (state.finished) {
+      this.streams.delete(streamId);
+      return Promise.resolve(null);
+    }
+    return new Promise((resolve) => {
+      state.waiter = (event) => {
+        if (event) this.recordConsumption(streamId, event);
+        resolve(event);
+      };
+    });
+  }
+  recordConsumption(streamId, event) {
+    if (event.type !== "data") return;
+    const bytes = event.payload.length;
+    const connectionCredit = this.connectionRecv.recordConsumed(bytes);
+    if (connectionCredit > 0) {
+      this.enqueueSend(windowUpdateFrame(CONNECTION_STREAM_ID, connectionCredit));
+    }
+    const state = this.streams.get(streamId);
+    if (state) {
+      const streamCredit = state.recvWindow.recordConsumed(bytes);
+      if (streamCredit > 0) this.enqueueSend(windowUpdateFrame(streamId, streamCredit));
+    }
+  }
+  deliver(streamId, event) {
+    const state = this.streams.get(streamId);
+    if (!state) return;
+    if (state.waiter) {
+      const waiter = state.waiter;
+      state.waiter = null;
+      waiter(event);
+    } else {
+      state.events.push(event);
+    }
+  }
+  finishStream(streamId, event) {
+    this.deliver(streamId, event);
+    this.dropStream(streamId);
+  }
+  dropStream(streamId) {
+    const state = this.streams.get(streamId);
+    if (!state) return;
+    state.finished = true;
+    for (const pending of state.pending) {
+      pending.reject(new SessionV2Error("stream closed"));
+    }
+    state.pending = [];
+    const readyIndex = this.ready.indexOf(streamId);
+    if (readyIndex !== -1) this.ready.splice(readyIndex, 1);
+    if (state.waiter) {
+      const waiter = state.waiter;
+      state.waiter = null;
+      this.streams.delete(streamId);
+      waiter(null);
+    } else if (state.events.length === 0) {
+      this.streams.delete(streamId);
+    }
+  }
+  fail(reason) {
+    void this.sendHead(CONNECTION_STREAM_ID, FRAME_TYPE_V2.GOAWAY, {
+      code: ERROR_CODE.PROTOCOL_ERROR,
+      last_stream_id: this.nextStreamId,
+      reason
+    });
+    this.teardown(reason);
+    this.transport.close(1002, "protocol error");
+  }
+  teardown(reason) {
+    if (this.closed) return;
+    this.closed = true;
+    for (const streamId of this.streams.keys()) {
+      this.dropStream(streamId);
+    }
+    this.options.onClosed?.(reason);
+  }
+};
+function parseJson(payload) {
+  if (payload.length === 0) return null;
+  try {
+    return JSON.parse(textDecoder4.decode(payload));
+  } catch {
+    return null;
+  }
+}
+
+// src/tunnel/v2/ws-transport.ts
+var WsTransportV2 = class {
+  constructor(socket) {
+    this.socket = socket;
+    socket.binaryType = "arraybuffer";
+    socket.addEventListener("message", (event) => {
+      const data = event.data;
+      if (data instanceof ArrayBuffer) {
+        this.messageListener?.(new Uint8Array(data));
+      } else if (data instanceof Uint8Array) {
+        this.messageListener?.(data);
+      }
+    });
+    socket.addEventListener(
+      "close",
+      (event) => this.closeListener?.(`connection closed (${event.code ?? "unknown"})`)
+    );
+    socket.addEventListener("error", () => this.closeListener?.("connection error"));
+  }
+  socket;
+  messageListener = null;
+  closeListener = null;
+  send(frame) {
+    this.socket.send(frame);
+    return Promise.resolve();
+  }
+  onMessage(listener) {
+    this.messageListener = listener;
+  }
+  onClose(listener) {
+    this.closeListener = listener;
+  }
+  close(code, reason) {
+    try {
+      this.socket.close(code, reason);
+    } catch {
+    }
+  }
+};
+
+// src/tunnel/negotiating-client.ts
+var NegotiatingAgentClient = class {
+  constructor(options) {
+    this.options = options;
+  }
+  options;
+  socket = null;
+  driver = null;
+  closed = false;
+  start() {
+    const factory = this.options.createSocket ?? defaultSocketFactory;
+    const socket = factory(connectUrl(this.options.url, this.options.token), [
+      SUBPROTOCOL_V2,
+      SUBPROTOCOL
+    ]);
+    socket.binaryType = "arraybuffer";
+    this.socket = socket;
+    socket.addEventListener("open", () => {
+      if (this.closed || this.driver) return;
+      this.driver = socket.protocol === SUBPROTOCOL_V2 ? this.startV2(socket) : this.startV1(socket);
+    });
+    socket.addEventListener(
+      "close",
+      (event) => this.teardown(`connection closed (${event.code ?? "unknown"})`, event.code)
+    );
+    socket.addEventListener("error", () => this.teardown("connection error"));
+  }
+  stop() {
+    if (this.closed) return;
+    this.closed = true;
+    this.driver?.stop();
+    this.driver = null;
+    try {
+      this.socket?.close(1e3);
+    } catch {
+    }
+    this.socket = null;
+  }
+  teardown(reason, closeCode) {
+    if (this.closed) return;
+    this.closed = true;
+    this.driver?.stop();
+    this.driver = null;
+    this.socket = null;
+    this.options.events?.onClosed?.(reason, closeCode);
+  }
+  startV2(socket) {
+    const hello = defaultHello();
+    const transport = new WsTransportV2(socket);
+    const createLocalSocket = this.options.createLocalSocket ?? defaultSocketFactory;
+    const dispatcher = new AgentDispatcher().register(new HttpProxyKind(makeAgentContext(this.options.localPort, hello, createLocalSocket))).register(new WsSpliceKind(makeAgentContext(this.options.localPort, hello, createLocalSocket)));
+    const session = new SessionV2(transport, {
+      role: "agent",
+      local: hello,
+      onIncoming: (incoming) => dispatcher.dispatch(incoming),
+      onClosed: (reason) => this.teardown(`v2 session closed \u2014 ${reason}`)
+    });
+    void session.start();
+    this.options.events?.onConnected?.();
+    return { stop: () => transport.close(1e3, "stopped") };
+  }
+  startV1(socket) {
+    const client = new TunnelClient({
+      url: this.options.url,
+      token: this.options.token,
+      localPort: this.options.localPort,
+      createSocket: () => socket,
+      createLocalSocket: this.options.createLocalSocket,
+      events: this.options.events,
+      socketAlreadyOpen: true
+    });
+    client.start();
+    return { stop: () => client.stop() };
+  }
+};
+function makeAgentContext(localPort, hello, createLocalSocket) {
+  return {
+    localPort,
+    maxFramePayload: hello.max_frame_payload,
+    createLocalSocket: (url, protocols) => createLocalSocket(url, protocols)
+  };
+}
+var TUNNEL_URL_ENV = "CIMPLIFY_TUNNEL_URL";
+var TUNNEL_TOKEN_ENV = "CIMPLIFY_TUNNEL_TOKEN";
+var TUNNEL_LOCAL_PORT_ENV = "CIMPLIFY_TUNNEL_LOCAL_PORT";
+var TUNNEL_CONFIG_DIR = ".cimplify";
+var TUNNEL_CONFIG_FILE = "tunnel.json";
+var DEFAULT_DEV_SERVER_PORT = 3e3;
+function tunnelConfigPath(cwd) {
+  return path2.join(cwd, TUNNEL_CONFIG_DIR, TUNNEL_CONFIG_FILE);
+}
+async function readTunnelConfig(cwd, env = process.env) {
+  const url = env[TUNNEL_URL_ENV];
+  const token = env[TUNNEL_TOKEN_ENV];
+  if (url && token) {
+    return { url, token, localPort: envPort(env) ?? DEFAULT_DEV_SERVER_PORT };
+  }
+  return readTunnelConfigFile(cwd);
+}
+function envPort(env) {
+  const raw = env[TUNNEL_LOCAL_PORT_ENV];
+  if (!raw) return null;
+  const port = Number.parseInt(raw, 10);
+  return Number.isInteger(port) && port > 0 && port < 65536 ? port : null;
+}
+async function readTunnelConfigFile(cwd) {
+  let raw;
+  try {
+    raw = await promises.readFile(tunnelConfigPath(cwd), "utf8");
+  } catch {
+    return null;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (typeof parsed !== "object" || parsed === null) return null;
+  const record = parsed;
+  if (typeof record.url !== "string" || record.url.length === 0) return null;
+  if (typeof record.token !== "string" || record.token.length === 0) return null;
+  const localPort = typeof record.port === "number" && Number.isInteger(record.port) && record.port > 0 ? record.port : DEFAULT_DEV_SERVER_PORT;
+  return { url: record.url, token: record.token, localPort };
+}
+function sameTunnelConfig(a, b) {
+  if (a === null || b === null) return a === b;
+  return a.url === b.url && a.token === b.token && a.localPort === b.localPort;
+}
+function sameTunnelEndpoint(a, b) {
+  return a.url === b.url && a.localPort === b.localPort;
+}
+
+// src/tunnel/manager.ts
+var CONFIG_POLL_MS = 2e3;
+var RECONNECT_MIN_MS = 1e3;
+var RECONNECT_MAX_MS = 3e4;
+var CLOSE_CODE_REPLACED = 4e3;
+function defaultCreateClient(config, events) {
+  return new NegotiatingAgentClient({
+    url: config.url,
+    token: config.token,
+    localPort: config.localPort,
+    events
+  });
+}
+function startTunnelRuntime(cwd, options = {}) {
+  const pollIntervalMs = options.pollIntervalMs ?? CONFIG_POLL_MS;
+  const createClient = options.createClient ?? defaultCreateClient;
+  const onStatus = options.onStatus ?? ((message) => info(dim(message)));
+  let stopped = false;
+  let generation = 0;
+  let activeConfig = null;
+  let activeClient = null;
+  let reconnectDelay = RECONNECT_MIN_MS;
+  let reconnectTimer = null;
+  let polling = false;
+  let connected = false;
+  let standDown = false;
+  const clearReconnect = () => {
+    if (reconnectTimer !== null) {
+      clearTimeout(reconnectTimer);
+      reconnectTimer = null;
+    }
+  };
+  const startClient = (config) => {
+    generation += 1;
+    standDown = false;
+    const myGeneration = generation;
+    const client = createClient(config, {
+      onConnected: () => {
+        if (stopped || myGeneration !== generation) return;
+        connected = true;
+        reconnectDelay = RECONNECT_MIN_MS;
+        onStatus("(preview tunnel: connected)");
+      },
+      onClosed: (reason, closeCode) => {
+        if (stopped || myGeneration !== generation) return;
+        connected = false;
+        if (closeCode === CLOSE_CODE_REPLACED) {
+          standDown = true;
+          onStatus("(preview tunnel: replaced by a newer agent; standing down)");
+          return;
+        }
+        onStatus(`(preview tunnel: disconnected \u2014 ${reason})`);
+        scheduleReconnect();
+      }
+    });
+    activeConfig = config;
+    activeClient = client;
+    client.start();
+  };
+  const retireClient = () => {
+    generation += 1;
+    activeClient?.stop();
+    activeClient = null;
+  };
+  const scheduleReconnect = () => {
+    if (reconnectTimer !== null) return;
+    const delay = reconnectDelay + Math.floor(Math.random() * (reconnectDelay / 4));
+    reconnectDelay = Math.min(reconnectDelay * 2, RECONNECT_MAX_MS);
+    reconnectTimer = setTimeout(() => {
+      reconnectTimer = null;
+      if (stopped || activeConfig === null) return;
+      retireClient();
+      startClient(activeConfig);
+    }, delay);
+  };
+  const stopClient = () => {
+    clearReconnect();
+    retireClient();
+    activeConfig = null;
+    connected = false;
+  };
+  const poll = async () => {
+    if (polling || stopped) return;
+    polling = true;
+    try {
+      const config = await readTunnelConfig(cwd, options.env);
+      if (stopped || sameTunnelConfig(config, activeConfig)) return;
+      if (config === null) {
+        stopClient();
+        onStatus("(preview tunnel: credentials removed, stopped)");
+        return;
+      }
+      if (activeConfig && sameTunnelEndpoint(config, activeConfig) && connected && !standDown) {
+        activeConfig = config;
+        return;
+      }
+      stopClient();
+      onStatus("(preview tunnel: credentials found, connecting)");
+      reconnectDelay = RECONNECT_MIN_MS;
+      startClient(config);
+    } finally {
+      polling = false;
+    }
+  };
+  const interval = setInterval(() => {
+    void poll();
+  }, pollIntervalMs);
+  void poll();
+  return () => {
+    if (stopped) return;
+    stopped = true;
+    clearInterval(interval);
+    stopClient();
+  };
+}
+
+// src/commands/dev.ts
+var FLAG_REMOTE = "remote";
+var PACKAGE_JSON = "package.json";
+var ENV_LOCAL_FILE = ".env.local";
+var PUBLIC_API_URL_KEY = "NEXT_PUBLIC_CIMPLIFY_API_URL";
+var SCRIPT_DEV = "dev";
+var PREVIEW_ORIGIN_ENV = "CIMPLIFY_PREVIEW_ORIGIN";
+async function applyPreviewOrigin(cwd, originList) {
+  const { ensurePreviewOrigin } = await import('./preview-config-344CUZLO.mjs');
+  const origins = originList.split(",").map((origin) => origin.trim()).filter((origin) => origin.length > 0);
+  if (origins.length === 0) return;
+  try {
+    const result = await ensurePreviewOrigin(cwd, origins);
+    if (result.status === "unrecognized") {
+      info(
+        dim(
+          `(preview: could not resolve ${result.file} config shape; hot-reload may be limited)`
+        )
+      );
+    }
+  } catch (err) {
+    info(dim(`(preview: dev-origin setup skipped: ${err.message})`));
+  }
+}
+var PM_BUN = "bun";
+var PM_PNPM = "pnpm";
+var PM_YARN = "yarn";
+var PM_NPM = "npm";
+var LOCKFILE_BUN = "bun.lock";
+var LOCKFILE_BUN_BINARY = "bun.lockb";
+var LOCKFILE_PNPM = "pnpm-lock.yaml";
+var LOCKFILE_YARN = "yarn.lock";
+var BUNFIG = "bunfig.toml";
+function envEndpoint(businessId, projectId) {
+  return `/v1/businesses/${encodeURIComponent(businessId)}/projects/${encodeURIComponent(projectId)}/env-vars`;
+}
+async function detectPackageManager(cwd) {
+  if (await pathExists(path2.join(cwd, LOCKFILE_BUN))) return PM_BUN;
+  if (await pathExists(path2.join(cwd, LOCKFILE_BUN_BINARY))) return PM_BUN;
+  if (await pathExists(path2.join(cwd, BUNFIG))) return PM_BUN;
+  if (await pathExists(path2.join(cwd, LOCKFILE_PNPM))) return PM_PNPM;
+  if (await pathExists(path2.join(cwd, LOCKFILE_YARN))) return PM_YARN;
+  return PM_NPM;
+}
+async function pathExists(target) {
+  try {
+    await promises.stat(target);
+    return true;
+  } catch (err) {
+    if (err.code === "ENOENT") return false;
+    throw err;
+  }
+}
+async function readPackageJson(cwd) {
+  const pkgPath = path2.join(cwd, PACKAGE_JSON);
+  let raw;
+  try {
+    raw = await promises.readFile(pkgPath, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      throw new CliError(
+        CLI_ERROR_CODE.INVALID_INPUT,
+        `No package.json in ${cwd}. \`cimplify dev\` runs your project's dev script.`
+      );
+    }
+    throw err;
+  }
+  return JSON.parse(raw);
+}
+function mergeEnvEntries(existing, incoming) {
+  const seen = new Set(existing.map((e) => e.key));
+  const merged = [...existing];
+  for (const entry of incoming) {
+    if (seen.has(entry.key)) continue;
+    merged.push(entry);
+    seen.add(entry.key);
+  }
+  return merged;
+}
+async function applyRemoteEnv(client, businessId, projectId, apiBaseUrl, cwd) {
+  const records = await client.get(envEndpoint(businessId, projectId), {
+    query: { scope: ENV_SCOPE.PRODUCTION }
+  });
+  const incoming = records.filter((r) => r.value !== null && !r.is_secret).map((r) => ({ key: r.key, value: r.value }));
+  incoming.push({ key: PUBLIC_API_URL_KEY, value: apiBaseUrl });
+  const envPath = path2.join(cwd, ENV_LOCAL_FILE);
+  let existing = [];
+  try {
+    const raw = await promises.readFile(envPath, "utf8");
+    existing = parseEnvFile(raw);
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err;
+  }
+  const merged = mergeEnvEntries(existing, incoming);
+  await promises.writeFile(envPath, formatEnvFile(merged), "utf8");
+  const publicCount = incoming.filter((e) => e.key.startsWith(PUBLIC_ENV_PREFIX)).length;
+  return publicCount;
+}
+async function run(argv) {
+  const args = parseArgs(argv);
+  const remote = flagBool(args, FLAG_REMOTE);
+  const cwd = process.cwd();
+  const previewOrigin = process.env[PREVIEW_ORIGIN_ENV];
+  if (remote) {
+    const auth = await readAuth();
+    const link = await readProjectLink();
+    const client = ApiClient.fromAuth(auth);
+    const publicCount = await applyRemoteEnv(
+      client,
+      link.businessId,
+      link.projectId,
+      auth.apiBaseUrl,
+      cwd
+    );
+    const label = link.businessHandle ?? auth.businessHandle ?? auth.businessId;
+    info(`Dev mode: connected to ${label} production data (${publicCount} public var${publicCount === 1 ? "" : "s"} merged)`);
+  } else if (previewOrigin) {
+    info("Dev mode: hosted preview");
+  } else {
+    info("Dev mode: using local mock (`cimplify mock`)");
+  }
+  const pkg = await readPackageJson(cwd);
+  if (!pkg.scripts || !pkg.scripts[SCRIPT_DEV]) {
+    throw new CliError(
+      CLI_ERROR_CODE.INVALID_INPUT,
+      `No "${SCRIPT_DEV}" script in package.json. Add one (e.g. "next dev") and re-run.`
+    );
+  }
+  let stopTunnel = null;
+  if (previewOrigin) {
+    await applyPreviewOrigin(cwd, previewOrigin);
+    stopTunnel = startTunnelRuntime(cwd);
+  }
+  const pm = await detectPackageManager(cwd);
+  info(dim(`(running: ${pm} run ${SCRIPT_DEV})`));
+  const child = spawn(pm, ["run", SCRIPT_DEV], { cwd, stdio: "inherit" });
+  try {
+    await new Promise((resolve, reject) => {
+      child.on("error", (err) => reject(new CliError(CLI_ERROR_CODE.INVALID_INPUT, `Failed to spawn ${pm}: ${err.message}`)));
+      child.on("close", (code) => {
+        process.exitCode = code ?? 0;
+        resolve();
+      });
+    });
+  } finally {
+    stopTunnel?.();
+  }
+}
+
+export { run as default, detectPackageManager, mergeEnvEntries };