@dainprotocol/tunnel 1.1.25 → 1.1.29

package/dist/server/index.js

@@ -10,40 +10,45 @@ const body_parser_1 = __importDefault(require("body-parser"));
 const auth_1 = require("@dainprotocol/service-sdk/service/auth");
 const crypto_1 = require("crypto");
 const url_1 = require("url");
-// High-frequency optimization: Fast ID generation using crypto.randomBytes
-// ~10x faster than uuid v4 for high-frequency scenarios
+const TIMEOUTS = {
+    CHALLENGE_TTL: 30000,
+    PING_INTERVAL: 30000,
+    REQUEST_TIMEOUT: 30000,
+    SSE_KEEPALIVE: 5000,
+    TUNNEL_RETRY_DELAY: 100,
+    SERVER_KEEPALIVE: 65000,
+    SERVER_HEADERS: 66000,
+};
+const LIMITS = {
+    MAX_CONCURRENT_REQUESTS_PER_TUNNEL: 100,
+    MAX_MISSED_PONGS: 2,
+    MAX_PAYLOAD_BYTES: 100 * 1024 * 1024,
+    BACKPRESSURE_THRESHOLD: 1024 * 1024,
+    SERVER_MAX_HEADERS: 100,
+    WS_BACKLOG: 100,
+    TUNNEL_RETRY_COUNT: 3,
+};
 let idCounter = 0;
 function fastId() {
     return `${Date.now().toString(36)}-${(idCounter++).toString(36)}-${(0, crypto_1.randomBytes)(4).toString('hex')}`;
 }
-/**
- * Force immediate flush of SSE data to prevent buffering
- * SSE requires immediate delivery; Node.js res.write() doesn't guarantee this
- *
- * @param res Express response object
- */
-function flushSSE(res) {
-    try {
-        // Node.js TCP sockets use cork/uncork for buffering control
-        // We uncork to force immediate transmission of buffered data
-        const socket = res.socket;
-        if (socket) {
-            // If socket is corked, uncork it to flush immediately
-            if (socket.uncork) {
-                socket.uncork();
-            }
-            // Disable Nagle's algorithm for low-latency streaming
-            if (socket.setNoDelay && !socket._noDelay) {
-                socket.setNoDelay(true);
+class DainTunnelServer {
+    safeSend(ws, data) {
+        try {
+            if (ws.readyState === ws_1.default.OPEN) {
+                ws.send(JSON.stringify(data));
+                return true;
             }
         }
+        catch (error) {
+            console.error("[Tunnel] SafeSend error:", error);
+        }
+        return false;
     }
-    catch (error) {
-        // Flush is best-effort; log but don't fail the request
-        console.error('[SSE Flush] Error flushing socket:', error);
+    decrementRequestCount(tunnelId) {
+        const currentCount = this.tunnelRequestCount.get(tunnelId) || 1;
+        this.tunnelRequestCount.set(tunnelId, Math.max(0, currentCount - 1));
     }
-}
-class DainTunnelServer {
     constructor(hostname, port) {
         this.hostname = hostname;
         this.port = port;
@@ -52,34 +57,35 @@ class DainTunnelServer {
         this.challenges = new Map();
         this.sseConnections = new Map();
         this.wsConnections = new Map();
-        // High-frequency optimization: Track active request count per tunnel for backpressure
         this.tunnelRequestCount = new Map();
-        this.MAX_CONCURRENT_REQUESTS_PER_TUNNEL = 100;
         this.app = (0, express_1.default)();
         this.server = http_1.default.createServer(this.app);
-        // High-frequency optimization: Configure server for better throughput
-        this.server.keepAliveTimeout = 65000; // Keep connections alive longer (default 5s)
-        this.server.headersTimeout = 66000; // Must be higher than keepAliveTimeout
-        this.server.maxHeadersCount = 100; // Limit header count for security
+        this.server.keepAliveTimeout = TIMEOUTS.SERVER_KEEPALIVE;
+        this.server.headersTimeout = TIMEOUTS.SERVER_HEADERS;
+        this.server.maxHeadersCount = LIMITS.SERVER_MAX_HEADERS;
         this.wss = new ws_1.default.Server({
             server: this.server,
-            path: undefined, // Allow connections on any path
-            // High-frequency optimization: Increase backlog and disable per-message deflate
-            backlog: 100,
-            perMessageDeflate: false, // Disable compression for lower latency
-            maxPayload: 100 * 1024 * 1024, // 100MB max payload
+            path: undefined,
+            backlog: LIMITS.WS_BACKLOG,
+            perMessageDeflate: false,
+            maxPayload: LIMITS.MAX_PAYLOAD_BYTES,
         });
-        // Single optimized CORS middleware (avoid duplicate cors() + manual headers)
         this.app.use((req, res, next) => {
-            res.header("Access-Control-Allow-Origin", "*");
+            const origin = req.headers.origin;
+            if (origin) {
+                res.header("Access-Control-Allow-Origin", origin);
+                res.header("Vary", "Origin");
+                res.header("Access-Control-Allow-Credentials", "true");
+            }
+            else {
+                res.header("Access-Control-Allow-Origin", "*");
+            }
             res.header("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, PATCH, OPTIONS");
             res.header("Access-Control-Allow-Headers", "X-DAIN-SIGNATURE, X-DAIN-SMART-ACCOUNT-PDA, X-DAIN-AGENT-ID, X-DAIN-ORG-ID, X-DAIN-ADDRESS, X-DAIN-TIMESTAMP, X-DAIN-WEBHOOK-URL, Content-Type, Authorization, Accept, Origin, X-Requested-With");
-            res.header("Access-Control-Allow-Credentials", "true");
             if (req.method === "OPTIONS")
                 return res.sendStatus(204);
             next();
         });
-        // Add body-parser middleware (skip for GET/HEAD/OPTIONS which don't have bodies)
         this.app.use((req, res, next) => {
             if (req.method === 'GET' || req.method === 'HEAD' || req.method === 'OPTIONS') {
                 return next();
@@ -90,18 +96,37 @@ class DainTunnelServer {
         this.setupWebSocketServer();
     }
     setupExpressRoutes() {
-        // Generic route handler for all tunnel requests
+        this.app.get("/", (req, res, next) => {
+            var _a;
+            if (((_a = req.headers.upgrade) === null || _a === void 0 ? void 0 : _a.toLowerCase()) === 'websocket')
+                return next();
+            res.status(200).json({
+                status: "healthy",
+                tunnels: this.tunnels.size,
+                pendingRequests: this.pendingRequests.size,
+                sseConnections: this.sseConnections.size,
+                wsConnections: this.wsConnections.size,
+                uptime: process.uptime()
+            });
+        });
+        this.app.get("/health", (req, res) => {
+            res.status(200).json({
+                status: "ok",
+                tunnels: this.tunnels.size,
+                pendingRequests: this.pendingRequests.size,
+                uptime: process.uptime()
+            });
+        });
         this.app.use("/:tunnelId", this.handleRequest.bind(this));
     }
     setupWebSocketServer() {
-        // Handle WebSocket connections from tunnel clients
         this.wss.on("connection", (ws, req) => {
             var _a;
             try {
                 const url = (0, url_1.parse)(req.url || '', true);
                 const pathParts = ((_a = url.pathname) === null || _a === void 0 ? void 0 : _a.split('/')) || [];
-                // Client tunnel connection has no tunnelId in the path (or is at root)
-                if (!url.pathname || url.pathname === '/' || pathParts.length <= 1 || !pathParts[1]) {
+                const isRootConnection = !url.pathname || url.pathname === '/' || pathParts.length <= 1 || !pathParts[1];
+                if (isRootConnection) {
                     this.handleTunnelClientConnection(ws, req);
                 }
                 else {
@@ -114,25 +139,26 @@ class DainTunnelServer {
             }
         });
     }
-    // Handle WebSocket connections from tunnel clients
     handleTunnelClientConnection(ws, req) {
         ws.on("message", (message) => {
             try {
                 const data = JSON.parse(message);
-                if (data.type === "challenge_request") {
-                    this.handleChallengeRequest(ws);
-                }
-                else if (data.type === "start") {
-                    this.handleStartMessage(ws, data);
-                }
-                else if (data.type === "response") {
-                    this.handleResponseMessage(data);
-                }
-                else if (data.type === "sse") {
-                    this.handleSSEMessage(data);
-                }
-                else if (data.type === "websocket") {
-                    this.handleWebSocketMessage(data);
+                switch (data.type) {
+                    case "challenge_request":
+                        this.handleChallengeRequest(ws);
+                        break;
+                    case "start":
+                        this.handleStartMessage(ws, data);
+                        break;
+                    case "response":
+                        this.handleResponseMessage(data);
+                        break;
+                    case "sse":
+                        this.handleSSEMessage(data);
+                        break;
+                    case "websocket":
+                        this.handleWebSocketMessage(data);
+                        break;
                 }
             }
             catch (error) {
@@ -143,7 +169,6 @@ class DainTunnelServer {
         ws.on("close", () => this.removeTunnel(ws));
         ws.on("error", (error) => console.error("[Tunnel] WS error:", error));
     }
-    // Handle incoming WebSocket connections to be proxied through the tunnel
     handleProxiedWebSocketConnection(ws, req) {
         var _a;
         const url = (0, url_1.parse)(req.url || '', true);
@@ -159,57 +184,35 @@ class DainTunnelServer {
             ws.close(1008, "Tunnel not found");
             return;
         }
-        // Create a WebSocket connection ID
         const wsConnectionId = fastId();
-        // Store this connection
         this.wsConnections.set(wsConnectionId, {
             clientSocket: ws,
             id: wsConnectionId,
             path: remainingPath,
-            headers: req.headers
+            headers: req.headers,
+            tunnelId
         });
-        // Notify tunnel client about the new WebSocket connection
-        tunnel.ws.send(JSON.stringify({
+        this.safeSend(tunnel.ws, {
             type: "websocket_connection",
             id: wsConnectionId,
             path: remainingPath,
             headers: req.headers
-        }));
-        // Handle messages from the client
-        ws.on("message", (data) => {
-            tunnel.ws.send(JSON.stringify({
-                type: "websocket",
-                id: wsConnectionId,
-                event: "message",
-                data: data.toString('base64')
-            }));
-        });
-        // Handle client disconnection
-        ws.on("close", () => {
-            tunnel.ws.send(JSON.stringify({
-                type: "websocket",
-                id: wsConnectionId,
-                event: "close"
-            }));
-            this.wsConnections.delete(wsConnectionId);
-        });
-        // Handle errors
-        ws.on("error", (error) => {
-            tunnel.ws.send(JSON.stringify({
-                type: "websocket",
-                id: wsConnectionId,
-                event: "error",
-                data: error.message
-            }));
         });
+        const sendToTunnel = (event, data) => {
+            const currentTunnel = this.tunnels.get(tunnelId);
+            if (currentTunnel) {
+                this.safeSend(currentTunnel.ws, { type: "websocket", id: wsConnectionId, event, data });
+            }
+        };
+        ws.on("message", (data) => sendToTunnel("message", data.toString('base64')));
+        ws.on("close", () => { sendToTunnel("close"); this.wsConnections.delete(wsConnectionId); });
+        ws.on("error", (error) => sendToTunnel("error", error.message));
     }
     handleChallengeRequest(ws) {
         const challenge = fastId();
-        const challengeObj = { ws, challenge, timestamp: Date.now() };
-        this.challenges.set(challenge, challengeObj);
+        this.challenges.set(challenge, { ws, challenge, timestamp: Date.now() });
         ws.send(JSON.stringify({ type: "challenge", challenge }));
-        // Auto-cleanup expired challenges (30 second TTL)
-        setTimeout(() => this.challenges.delete(challenge), 30000);
+        setTimeout(() => this.challenges.delete(challenge), TIMEOUTS.CHALLENGE_TTL);
     }
     handleStartMessage(ws, data) {
         const { challenge, signature, tunnelId, apiKey } = data;
@@ -220,7 +223,6 @@ class DainTunnelServer {
         }
         this.challenges.delete(challenge);
         try {
-            // Parse API key to get the secret for HMAC validation
             if (!apiKey) {
                 ws.close(1008, "API key required");
                 return;
@@ -230,65 +232,63 @@ class DainTunnelServer {
                 ws.close(1008, "Invalid API key format");
                 return;
             }
-            // Validate HMAC signature using constant-time comparison
-            const expectedSignature = (0, crypto_1.createHmac)('sha256', parsed.secret)
-                .update(challenge)
-                .digest('hex');
-            // Convert to buffers for timing-safe comparison
+            const expectedSignature = (0, crypto_1.createHmac)('sha256', parsed.secret).update(challenge).digest('hex');
             const expectedSigBuffer = Buffer.from(expectedSignature, 'hex');
             const receivedSigBuffer = Buffer.from(signature, 'hex');
-            // Constant-time comparison to prevent timing attacks
             if (expectedSigBuffer.length !== receivedSigBuffer.length ||
                 !(0, crypto_1.timingSafeEqual)(expectedSigBuffer, receivedSigBuffer)) {
                 ws.close(1008, "Invalid signature");
                 return;
             }
-            // Verify that tunnelId matches orgId_agentId from the API key
             const expectedTunnelId = `${parsed.orgId}_${parsed.agentId}`;
             if (tunnelId !== expectedTunnelId) {
                 ws.close(1008, `Tunnel ID does not match API key. Expected: ${expectedTunnelId}, Got: ${tunnelId}`);
                 return;
             }
-            // If tunnel already exists, remove old one
-            if (this.tunnels.has(tunnelId)) {
-                const oldTunnel = this.tunnels.get(tunnelId);
-                if (oldTunnel && oldTunnel.ws !== ws) {
-                    oldTunnel.ws.close(1000, "Replaced by new connection");
-                }
+            const existingTunnel = this.tunnels.get(tunnelId);
+            if (existingTunnel && existingTunnel.ws !== ws) {
+                existingTunnel.ws.close(1000, "Replaced by new connection");
             }
             this.tunnels.set(tunnelId, { id: tunnelId, ws });
-            // Save tunnel ID on the WebSocket object for easy lookup on close
             ws.tunnelId = tunnelId;
-            // Add a periodic ping to keep the connection alive (silent - no logging)
+            let isAlive = true;
+            let missedPongs = 0;
+            ws.on("pong", () => { isAlive = true; missedPongs = 0; });
             const intervalId = setInterval(() => {
-                if (this.tunnels.has(tunnelId)) {
-                    const tunnel = this.tunnels.get(tunnelId);
-                    if (tunnel && tunnel.ws === ws && ws.readyState === ws_1.default.OPEN) {
-                        try {
-                            ws.ping();
-                        }
-                        catch (error) {
-                            clearInterval(intervalId);
-                        }
-                    }
-                    else {
+                if (!this.tunnels.has(tunnelId)) {
+                    clearInterval(intervalId);
+                    return;
+                }
+                const tunnel = this.tunnels.get(tunnelId);
+                if (!tunnel || tunnel.ws !== ws || ws.readyState !== ws_1.default.OPEN) {
+                    clearInterval(intervalId);
+                    if ((tunnel === null || tunnel === void 0 ? void 0 : tunnel.ws) === ws)
+                        this.tunnels.delete(tunnelId);
+                    return;
+                }
+                if (!isAlive) {
+                    missedPongs++;
+                    if (missedPongs >= LIMITS.MAX_MISSED_PONGS) {
+                        console.log(`[Tunnel] ${tunnelId} failed liveness check (${missedPongs} missed pongs), terminating`);
                         clearInterval(intervalId);
-                        if (tunnel && tunnel.ws === ws) {
-                            this.tunnels.delete(tunnelId);
-                        }
+                        ws.terminate();
+                        return;
                     }
                 }
-                else {
+                isAlive = false;
+                try {
+                    ws.ping();
+                }
+                catch (_a) {
                     clearInterval(intervalId);
+                    ws.terminate();
                 }
-            }, 30000); // Ping every 30 seconds (reduced frequency)
-            // Store the interval ID on the WebSocket object so we can clean it up
+            }, TIMEOUTS.PING_INTERVAL);
             ws.keepAliveInterval = intervalId;
             ws.on("close", () => clearInterval(intervalId));
-            let tunnelUrl = `${this.hostname}`;
-            if (process.env.SKIP_PORT !== "true") {
+            let tunnelUrl = this.hostname;
+            if (process.env.SKIP_PORT !== "true")
                 tunnelUrl += `:${this.port}`;
-            }
             tunnelUrl += `/${tunnelId}`;
             ws.send(JSON.stringify({ type: "tunnelUrl", url: tunnelUrl }));
             console.log(`[Tunnel] Created: ${tunnelUrl}`);
@@ -299,84 +299,63 @@ class DainTunnelServer {
         }
     }
     handleResponseMessage(data) {
+        console.log(`[Response] Received for: ${data.requestId}, status: ${data.status}`);
         const pendingRequest = this.pendingRequests.get(data.requestId);
-        if (pendingRequest) {
-            const { res, startTime, tunnelId, timeoutId } = pendingRequest;
-            const endTime = Date.now();
-            // Clear the timeout since we received a response
-            if (timeoutId) {
-                clearTimeout(timeoutId);
-            }
-            // Decrement request counter for backpressure tracking
-            const currentCount = this.tunnelRequestCount.get(tunnelId) || 1;
-            this.tunnelRequestCount.set(tunnelId, Math.max(0, currentCount - 1));
-            const headers = { ...data.headers };
-            delete headers["transfer-encoding"];
-            delete headers["content-length"];
-            const bodyBuffer = Buffer.from(data.body, "base64");
-            res
-                .status(data.status)
-                .set(headers)
-                .set("Content-Length", bodyBuffer.length.toString())
-                .send(bodyBuffer);
-            this.pendingRequests.delete(data.requestId);
-        }
+        if (!pendingRequest)
+            return;
+        const { res, startTime, tunnelId, timeoutId } = pendingRequest;
+        console.log(`[Response] Completed in ${Date.now() - startTime}ms`);
+        if (timeoutId)
+            clearTimeout(timeoutId);
+        this.decrementRequestCount(tunnelId);
+        const headers = { ...data.headers };
+        delete headers["transfer-encoding"];
+        delete headers["content-length"];
+        const bodyBuffer = Buffer.from(data.body, "base64");
+        res.status(data.status).set(headers).set("Content-Length", bodyBuffer.length.toString()).send(bodyBuffer);
+        this.pendingRequests.delete(data.requestId);
     }
     handleSSEMessage(data) {
         const connection = this.sseConnections.get(data.id);
         if (!connection)
             return;
         const { res, tunnelId } = connection;
-        const conn = connection;
-        // Skip 'connected' event - we already wrote headers
         if (data.event === 'connected')
             return;
-        // Handle close event
         if (data.event === 'close') {
-            const tunnel = this.tunnels.get(tunnelId);
-            if (tunnel)
-                tunnel.ws.send(JSON.stringify({ type: "sse_close", id: data.id }));
-            if (!conn.clientDisconnected && res.writable) {
-                try {
-                    res.end();
-                }
-                catch (_a) { }
+            try {
+                res.end();
             }
+            catch (_a) { }
             this.cleanupSSEConnection(data.id, tunnelId);
             return;
         }
-        // Handle error - send as SSE error event (headers already written)
         if (data.event === 'error') {
-            if (!conn.clientDisconnected && res.writable) {
-                try {
-                    res.write(`event: error\ndata: ${data.data}\n\n`);
-                    flushSSE(res);
-                    res.end();
-                }
-                catch (_b) { }
+            try {
+                res.write(`event: error\ndata: ${data.data}\n\n`);
+                res.end();
             }
+            catch (_b) { }
             this.cleanupSSEConnection(data.id, tunnelId);
             return;
         }
-        // Skip if client disconnected
-        if (conn.clientDisconnected || !res.writable) {
-            conn.clientDisconnected = true;
-            return;
-        }
-        // Forward SSE event
         try {
             if (data.event)
                 res.write(`event: ${data.event}\n`);
-            res.write(`data: ${data.data.replace(/\n/g, '\ndata: ')}\n\n`);
-            flushSSE(res);
+            for (const line of data.data.split('\n')) {
+                res.write(`data: ${line}\n`);
+            }
+            res.write('\n');
         }
         catch (_c) {
-            conn.clientDisconnected = true;
+            this.cleanupSSEConnection(data.id, tunnelId);
         }
     }
     cleanupSSEConnection(id, tunnelId) {
-        const currentCount = this.tunnelRequestCount.get(tunnelId) || 1;
-        this.tunnelRequestCount.set(tunnelId, Math.max(0, currentCount - 1));
+        const connection = this.sseConnections.get(id);
+        if (connection === null || connection === void 0 ? void 0 : connection.keepAliveInterval)
+            clearInterval(connection.keepAliveInterval);
+        this.decrementRequestCount(tunnelId);
         this.sseConnections.delete(id);
     }
     handleWebSocketMessage(data) {
@@ -384,199 +363,260 @@ class DainTunnelServer {
         if (!connection)
             return;
         const { clientSocket } = connection;
-        if (data.event === 'message' && data.data) {
-            const messageData = Buffer.from(data.data, 'base64');
-            if (clientSocket.readyState === ws_1.default.OPEN) {
-                clientSocket.send(messageData);
-            }
-        }
-        else if (data.event === 'close') {
-            if (clientSocket.readyState === ws_1.default.OPEN) {
-                clientSocket.close();
-            }
-            this.wsConnections.delete(data.id);
-        }
-        else if (data.event === 'error' && data.data) {
-            if (clientSocket.readyState === ws_1.default.OPEN) {
-                clientSocket.close(1011, data.data);
-            }
-            this.wsConnections.delete(data.id);
+        const isOpen = clientSocket.readyState === ws_1.default.OPEN;
+        switch (data.event) {
+            case 'message':
+                if (data.data && isOpen)
+                    clientSocket.send(Buffer.from(data.data, 'base64'));
+                break;
+            case 'close':
+                if (isOpen)
+                    clientSocket.close();
+                this.wsConnections.delete(data.id);
+                break;
+            case 'error':
+                if (isOpen)
+                    clientSocket.close(1011, data.data);
+                this.wsConnections.delete(data.id);
+                break;
         }
     }
     async handleRequest(req, res) {
+        var _a, _b, _c;
         const tunnelId = req.params.tunnelId;
-        // Check for upgraded connections (WebSockets) - these are handled by the WebSocket server
-        if (req.headers.upgrade && req.headers.upgrade.toLowerCase() === 'websocket') {
-            // This is handled by the WebSocket server now
+        console.log(`[Request] ${req.method} /${tunnelId}${req.url}, Accept: ${(_a = req.headers.accept) === null || _a === void 0 ? void 0 : _a.substring(0, 30)}`);
+        if (((_b = req.headers.upgrade) === null || _b === void 0 ? void 0 : _b.toLowerCase()) === 'websocket')
             return;
-        }
         let tunnel;
-        let retries = 3;
+        let retries = LIMITS.TUNNEL_RETRY_COUNT;
         while (retries > 0 && !tunnel) {
             tunnel = this.tunnels.get(tunnelId);
             if (!tunnel) {
-                await new Promise(resolve => setTimeout(resolve, 100));
+                await new Promise(resolve => setTimeout(resolve, TIMEOUTS.TUNNEL_RETRY_DELAY));
                 retries--;
             }
         }
         if (!tunnel) {
-            return res.status(404).send("Tunnel not found");
+            const available = Array.from(this.tunnels.keys());
+            console.log(`[Request] Tunnel not found: ${tunnelId}, available tunnels: [${available.join(', ')}], count: ${available.length}`);
+            this.decrementRequestCount(tunnelId);
+            res.status(502).json({
+                error: "Bad Gateway",
+                message: `Tunnel "${tunnelId}" not connected. The service may be offline or reconnecting.`,
+                availableTunnels: available.length
+            });
+            return;
         }
-        // High-frequency optimization: Check WebSocket buffer and apply backpressure
-        if (tunnel.ws.bufferedAmount > 1024 * 1024) {
-            return res.status(503).json({ error: "Service Unavailable", message: "Tunnel high load" });
+        console.log(`[Request] Tunnel found: ${tunnelId}, wsState: ${tunnel.ws.readyState}`);
+        if (tunnel.ws.bufferedAmount > LIMITS.BACKPRESSURE_THRESHOLD) {
+            res.status(503).json({ error: "Service Unavailable", message: "Tunnel high load" });
+            return;
         }
-        // Check concurrent request limit per tunnel
         const currentCount = this.tunnelRequestCount.get(tunnelId) || 0;
-        if (currentCount >= this.MAX_CONCURRENT_REQUESTS_PER_TUNNEL) {
-            return res.status(503).json({ error: "Service Unavailable", message: "Too many concurrent requests" });
+        if (currentCount >= LIMITS.MAX_CONCURRENT_REQUESTS_PER_TUNNEL) {
+            res.status(503).json({ error: "Service Unavailable", message: "Too many concurrent requests" });
+            return;
         }
         this.tunnelRequestCount.set(tunnelId, currentCount + 1);
-        // Check for SSE request
-        if (req.headers.accept && req.headers.accept.includes('text/event-stream')) {
-            return this.handleSSERequest(req, res, tunnelId, tunnel);
+        if ((_c = req.headers.accept) === null || _c === void 0 ? void 0 : _c.includes('text/event-stream')) {
+            this.handleSSERequest(req, res, tunnelId, tunnel);
+            return;
         }
-        // Handle regular HTTP request
         const requestId = fastId();
         const startTime = Date.now();
-        // Set a timeout for the request (30 seconds)
-        const REQUEST_TIMEOUT = 30000;
         const timeoutId = setTimeout(() => {
             const pendingRequest = this.pendingRequests.get(requestId);
             if (pendingRequest) {
-                const currentCount = this.tunnelRequestCount.get(tunnelId) || 1;
-                this.tunnelRequestCount.set(tunnelId, Math.max(0, currentCount - 1));
+                this.decrementRequestCount(tunnelId);
                 this.pendingRequests.delete(requestId);
                 if (!res.headersSent) {
                     res.status(504).json({ error: "Gateway Timeout", message: "Request timed out" });
                 }
             }
-        }, REQUEST_TIMEOUT);
+        }, TIMEOUTS.REQUEST_TIMEOUT);
         this.pendingRequests.set(requestId, { res, startTime, tunnelId, timeoutId });
-        tunnel.ws.send(JSON.stringify({
+        console.log(`[Request] Sending to tunnel client: ${requestId}, wsState: ${tunnel.ws.readyState}, buffered: ${tunnel.ws.bufferedAmount}`);
+        const hasBody = req.method !== "GET" && req.method !== "HEAD" &&
+            req.body && Buffer.isBuffer(req.body) && req.body.length > 0;
+        const sent = this.safeSend(tunnel.ws, {
             type: "request",
             id: requestId,
             method: req.method,
             path: req.url,
             headers: req.headers,
-            body: req.method !== "GET" && req.method !== "HEAD" && req.body
-                ? req.body.toString("base64")
-                : undefined,
-        }));
+            body: hasBody ? req.body.toString("base64") : undefined,
+        });
+        console.log(`[Request] Sent to tunnel client: ${sent}`);
+        if (!sent) {
+            clearTimeout(timeoutId);
+            this.pendingRequests.delete(requestId);
+            this.decrementRequestCount(tunnelId);
+            if (!res.headersSent) {
+                res.status(502).json({ error: "Bad Gateway", message: "Tunnel connection lost" });
+            }
+        }
     }
     handleSSERequest(req, res, tunnelId, tunnel) {
+        var _a, _b;
         const sseId = fastId();
-        // Optimize TCP for streaming
-        const socket = req.socket || req.connection;
-        if (socket === null || socket === void 0 ? void 0 : socket.setNoDelay)
-            socket.setNoDelay(true);
-        // Write SSE headers immediately to keep browser connection alive
-        res.writeHead(200, {
+        const startTime = Date.now();
+        console.log(`[SSE] ${sseId} started: ${req.url}`);
+        if (req.socket) {
+            req.socket.setNoDelay(true);
+            req.socket.setTimeout(0);
+        }
+        const origin = req.headers.origin;
+        const sseHeaders = {
             'Content-Type': 'text/event-stream',
-            'Cache-Control': 'no-cache',
+            'Cache-Control': 'no-cache, no-transform',
+            'Connection': 'keep-alive',
             'X-Accel-Buffering': 'no',
-        });
-        res.flushHeaders();
-        res.write(': connected\n\n');
-        flushSSE(res);
-        this.sseConnections.set(sseId, {
-            req, res, id: sseId, tunnelId,
-            clientDisconnected: false
-        });
-        // Forward to tunnel client
-        tunnel.ws.send(JSON.stringify({
+            'X-Content-Type-Options': 'nosniff',
+            'Content-Encoding': 'identity',
+            'Transfer-Encoding': 'chunked',
+        };
+        if (typeof origin === 'string') {
+            sseHeaders['Access-Control-Allow-Origin'] = origin;
+            sseHeaders['Access-Control-Allow-Credentials'] = 'true';
+            sseHeaders['Vary'] = 'Origin';
+        }
+        else {
+            sseHeaders['Access-Control-Allow-Origin'] = '*';
+        }
+        res.writeHead(200, sseHeaders);
+        const flush = () => {
+            if (typeof res.flush === 'function')
+                res.flush();
+        };
+        (_a = res.flushHeaders) === null || _a === void 0 ? void 0 : _a.call(res);
+        res.write(':keepalive\n\n');
+        flush();
+        const keepAliveInterval = setInterval(() => {
+            try {
+                if (!res.writableEnded) {
+                    res.write(':keepalive\n\n');
+                    flush();
+                }
+                else
+                    clearInterval(keepAliveInterval);
+            }
+            catch (_a) {
+                clearInterval(keepAliveInterval);
+            }
+        }, TIMEOUTS.SSE_KEEPALIVE);
+        this.sseConnections.set(sseId, { req, res, id: sseId, tunnelId, keepAliveInterval });
+        const hasBody = req.method !== "GET" && req.body &&
+            Buffer.isBuffer(req.body) && req.body.length > 0;
+        const sent = this.safeSend(tunnel.ws, {
             type: "sse_connection",
             id: sseId,
             path: req.url,
             method: req.method,
             headers: req.headers,
-            body: req.method !== "GET" && req.body ? req.body.toString("base64") : undefined
-        }));
-        // Track response close (not request close) - for POST SSE, req closes immediately
-        res.on('close', () => {
-            const connection = this.sseConnections.get(sseId);
-            if (connection) {
-                connection.clientDisconnected = true;
-                setTimeout(() => {
-                    if (this.sseConnections.has(sseId)) {
-                        this.cleanupSSEConnection(sseId, tunnelId);
-                        const t = this.tunnels.get(tunnelId);
-                        if ((t === null || t === void 0 ? void 0 : t.ws.readyState) === ws_1.default.OPEN) {
-                            t.ws.send(JSON.stringify({ type: "sse_close", id: sseId }));
-                        }
-                    }
-                }, 100);
-            }
+            body: hasBody ? req.body.toString("base64") : undefined
+        });
+        if (!sent) {
+            this.cleanupSSEConnection(sseId, tunnelId);
+            res.end();
+            return;
+        }
+        let cleanedUp = false;
+        const doCleanup = () => {
+            if (cleanedUp)
+                return;
+            cleanedUp = true;
+            console.log(`[SSE] ${sseId} completed in ${Date.now() - startTime}ms`);
+            this.safeSend(tunnel.ws, { type: "sse_close", id: sseId });
+            this.cleanupSSEConnection(sseId, tunnelId);
+        };
+        req.on('close', () => {
+            var _a;
+            if (((_a = req.socket) === null || _a === void 0 ? void 0 : _a.destroyed) || res.writableEnded)
+                doCleanup();
         });
+        (_b = req.socket) === null || _b === void 0 ? void 0 : _b.on('close', doCleanup);
+        req.on('error', doCleanup);
+        res.on('error', doCleanup);
     }
     removeTunnel(ws) {
         try {
             if (ws.keepAliveInterval)
                 clearInterval(ws.keepAliveInterval);
-            const tunnelId = ws.tunnelId;
-            let removedTunnelId = tunnelId;
-            if (tunnelId && this.tunnels.has(tunnelId)) {
-                const tunnel = this.tunnels.get(tunnelId);
-                if (tunnel && tunnel.ws === ws)
-                    this.tunnels.delete(tunnelId);
-            }
-            else {
-                removedTunnelId = undefined;
-                for (const [id, tunnel] of this.tunnels.entries()) {
-                    if (tunnel.ws === ws) {
-                        this.tunnels.delete(id);
-                        removedTunnelId = id;
-                        break;
-                    }
-                }
-            }
+            const removedTunnelId = this.findAndRemoveTunnel(ws);
             if (removedTunnelId) {
                 this.tunnelRequestCount.delete(removedTunnelId);
-                // Close all pending HTTP requests associated with this tunnel
-                for (const [requestId, pendingRequest] of this.pendingRequests.entries()) {
-                    if (pendingRequest.tunnelId === removedTunnelId) {
-                        try {
-                            if (pendingRequest.timeoutId)
-                                clearTimeout(pendingRequest.timeoutId);
-                            if (!pendingRequest.res.headersSent) {
-                                pendingRequest.res.status(502).json({ error: "Bad Gateway", message: "Tunnel closed" });
-                            }
-                        }
-                        catch (error) { /* ignore */ }
-                        this.pendingRequests.delete(requestId);
-                    }
-                }
-                // Close all SSE connections associated with this tunnel
-                for (const [sseId, sseConnection] of this.sseConnections.entries()) {
-                    if (sseConnection.tunnelId === removedTunnelId) {
-                        try {
-                            sseConnection.res.end();
-                        }
-                        catch (error) { /* ignore */ }
-                        this.sseConnections.delete(sseId);
+                this.cleanupPendingRequests(removedTunnelId);
+                this.cleanupTunnelSSEConnections(removedTunnelId);
+                this.cleanupTunnelWSConnections(removedTunnelId);
+            }
+            this.cleanupChallengesForSocket(ws);
+        }
+        catch (error) {
+            console.error("[Tunnel] Remove error:", error);
+        }
+    }
+    findAndRemoveTunnel(ws) {
+        const tunnelId = ws.tunnelId;
+        if (tunnelId && this.tunnels.has(tunnelId)) {
+            const tunnel = this.tunnels.get(tunnelId);
+            if ((tunnel === null || tunnel === void 0 ? void 0 : tunnel.ws) === ws) {
+                this.tunnels.delete(tunnelId);
+                return tunnelId;
+            }
+        }
+        for (const [id, tunnel] of this.tunnels.entries()) {
+            if (tunnel.ws === ws) {
+                this.tunnels.delete(id);
+                return id;
+            }
+        }
+        return undefined;
+    }
+    cleanupPendingRequests(tunnelId) {
+        for (const [requestId, pending] of this.pendingRequests.entries()) {
+            if (pending.tunnelId === tunnelId) {
+                try {
+                    if (pending.timeoutId)
+                        clearTimeout(pending.timeoutId);
+                    if (!pending.res.headersSent) {
+                        pending.res.status(502).json({ error: "Bad Gateway", message: "Tunnel closed" });
                     }
                 }
-                // Close all WebSocket connections associated with this tunnel
-                for (const [wsId, wsConnection] of this.wsConnections.entries()) {
-                    if (wsConnection.path.startsWith(`/${removedTunnelId}/`)) {
-                        try {
-                            wsConnection.clientSocket.close(1001, "Tunnel closed");
-                        }
-                        catch (error) { /* ignore */ }
-                        this.wsConnections.delete(wsId);
-                    }
+                catch (_a) { }
+                this.pendingRequests.delete(requestId);
+            }
+        }
+    }
+    cleanupTunnelSSEConnections(tunnelId) {
+        for (const [sseId, conn] of this.sseConnections.entries()) {
+            if (conn.tunnelId === tunnelId) {
+                if (conn.keepAliveInterval)
+                    clearInterval(conn.keepAliveInterval);
+                try {
+                    conn.res.end();
                 }
+                catch (_a) { }
+                this.sseConnections.delete(sseId);
             }
-            // Remove any pending challenges for this WebSocket
-            for (const [challenge, challengeObj] of this.challenges.entries()) {
-                if (challengeObj.ws === ws) {
-                    this.challenges.delete(challenge);
-                    break;
+        }
+    }
+    cleanupTunnelWSConnections(tunnelId) {
+        for (const [wsId, conn] of this.wsConnections.entries()) {
+            if (conn.tunnelId === tunnelId) {
+                try {
+                    conn.clientSocket.close(1001, "Tunnel closed");
                 }
+                catch (_a) { }
+                this.wsConnections.delete(wsId);
             }
         }
-        catch (error) {
-            console.error("[Tunnel] Remove error:", error);
+    }
+    cleanupChallengesForSocket(ws) {
+        for (const [challenge, obj] of this.challenges.entries()) {
+            if (obj.ws === ws) {
+                this.challenges.delete(challenge);
+                break;
+            }
         }
     }
     async start() {
@@ -590,37 +630,31 @@ class DainTunnelServer {
     async stop() {
         return new Promise((resolve) => {
             try {
-                // Close all SSE connections
-                for (const [sseId, sseConnection] of this.sseConnections.entries()) {
+                for (const [sseId, conn] of this.sseConnections.entries()) {
                     try {
-                        sseConnection.res.end();
+                        conn.res.end();
                     }
                     catch (error) {
-                        console.error(`Error closing SSE connection ${sseId}:`, error);
+                        console.error(`Error closing SSE ${sseId}:`, error);
                     }
                     this.sseConnections.delete(sseId);
                 }
-                // Close all WebSocket connections
-                for (const [wsId, wsConnection] of this.wsConnections.entries()) {
+                for (const [wsId, conn] of this.wsConnections.entries()) {
                     try {
-                        wsConnection.clientSocket.close(1001, "Server shutting down");
+                        conn.clientSocket.close(1001, "Server shutting down");
                     }
                     catch (error) {
-                        console.error(`Error closing WebSocket connection ${wsId}:`, error);
+                        console.error(`Error closing WS ${wsId}:`, error);
                     }
                     this.wsConnections.delete(wsId);
                 }
-                // Close the WebSocket server
                 this.wss.close(() => {
-                    // Close the HTTP server
-                    this.server.close(() => {
-                        resolve();
-                    });
+                    this.server.close(() => resolve());
                 });
             }
             catch (error) {
                 console.error('Error during server shutdown:', error);
-                resolve(); // Resolve anyway to prevent hanging
+                resolve();
             }
         });
     }