@dainprotocol/tunnel 1.1.26 → 1.1.30

package/dist/server/index.js

@@ -10,16 +10,29 @@ const body_parser_1 = __importDefault(require("body-parser"));
 const auth_1 = require("@dainprotocol/service-sdk/service/auth");
 const crypto_1 = require("crypto");
 const url_1 = require("url");
-// High-frequency optimization: Fast ID generation using crypto.randomBytes
-// ~10x faster than uuid v4 for high-frequency scenarios
+const TIMEOUTS = {
+    CHALLENGE_TTL: 30000,
+    PING_INTERVAL: 30000,
+    REQUEST_TIMEOUT: 30000,
+    SSE_KEEPALIVE: 5000,
+    TUNNEL_RETRY_DELAY: 100,
+    SERVER_KEEPALIVE: 65000,
+    SERVER_HEADERS: 66000,
+};
+const LIMITS = {
+    MAX_CONCURRENT_REQUESTS_PER_TUNNEL: 100,
+    MAX_MISSED_PONGS: 2,
+    MAX_PAYLOAD_BYTES: 100 * 1024 * 1024,
+    BACKPRESSURE_THRESHOLD: 1024 * 1024,
+    SERVER_MAX_HEADERS: 100,
+    WS_BACKLOG: 100,
+    TUNNEL_RETRY_COUNT: 3,
+};
 let idCounter = 0;
 function fastId() {
     return `${Date.now().toString(36)}-${(idCounter++).toString(36)}-${(0, crypto_1.randomBytes)(4).toString('hex')}`;
 }
 class DainTunnelServer {
-    /**
-     * Safely send a message to a WebSocket, handling errors gracefully
-     */
     safeSend(ws, data) {
         try {
             if (ws.readyState === ws_1.default.OPEN) {
@@ -32,6 +45,10 @@ class DainTunnelServer {
         }
         return false;
     }
+    decrementRequestCount(tunnelId) {
+        const currentCount = this.tunnelRequestCount.get(tunnelId) || 1;
+        this.tunnelRequestCount.set(tunnelId, Math.max(0, currentCount - 1));
+    }
     constructor(hostname, port) {
         this.hostname = hostname;
         this.port = port;
@@ -40,34 +57,35 @@ class DainTunnelServer {
         this.challenges = new Map();
         this.sseConnections = new Map();
         this.wsConnections = new Map();
-        // High-frequency optimization: Track active request count per tunnel for backpressure
         this.tunnelRequestCount = new Map();
-        this.MAX_CONCURRENT_REQUESTS_PER_TUNNEL = 100;
         this.app = (0, express_1.default)();
         this.server = http_1.default.createServer(this.app);
-        // High-frequency optimization: Configure server for better throughput
-        this.server.keepAliveTimeout = 65000; // Keep connections alive longer (default 5s)
-        this.server.headersTimeout = 66000; // Must be higher than keepAliveTimeout
-        this.server.maxHeadersCount = 100; // Limit header count for security
+        this.server.keepAliveTimeout = TIMEOUTS.SERVER_KEEPALIVE;
+        this.server.headersTimeout = TIMEOUTS.SERVER_HEADERS;
+        this.server.maxHeadersCount = LIMITS.SERVER_MAX_HEADERS;
         this.wss = new ws_1.default.Server({
             server: this.server,
-            path: undefined, // Allow connections on any path
-            // High-frequency optimization: Increase backlog and disable per-message deflate
-            backlog: 100,
-            perMessageDeflate: false, // Disable compression for lower latency
-            maxPayload: 100 * 1024 * 1024, // 100MB max payload
+            path: undefined,
+            backlog: LIMITS.WS_BACKLOG,
+            perMessageDeflate: false,
+            maxPayload: LIMITS.MAX_PAYLOAD_BYTES,
         });
-        // Single optimized CORS middleware (avoid duplicate cors() + manual headers)
         this.app.use((req, res, next) => {
-            res.header("Access-Control-Allow-Origin", "*");
+            const origin = req.headers.origin;
+            if (origin) {
+                res.header("Access-Control-Allow-Origin", origin);
+                res.header("Vary", "Origin");
+                res.header("Access-Control-Allow-Credentials", "true");
+            }
+            else {
+                res.header("Access-Control-Allow-Origin", "*");
+            }
             res.header("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, PATCH, OPTIONS");
             res.header("Access-Control-Allow-Headers", "X-DAIN-SIGNATURE, X-DAIN-SMART-ACCOUNT-PDA, X-DAIN-AGENT-ID, X-DAIN-ORG-ID, X-DAIN-ADDRESS, X-DAIN-TIMESTAMP, X-DAIN-WEBHOOK-URL, Content-Type, Authorization, Accept, Origin, X-Requested-With");
-            res.header("Access-Control-Allow-Credentials", "true");
             if (req.method === "OPTIONS")
                 return res.sendStatus(204);
             next();
         });
-        // Add body-parser middleware (skip for GET/HEAD/OPTIONS which don't have bodies)
         this.app.use((req, res, next) => {
             if (req.method === 'GET' || req.method === 'HEAD' || req.method === 'OPTIONS') {
                 return next();
@@ -78,12 +96,10 @@ class DainTunnelServer {
         this.setupWebSocketServer();
     }
     setupExpressRoutes() {
-        // Health check endpoint for App Platform / load balancers
-        // Skip WebSocket upgrade requests - let WebSocket server handle them
         this.app.get("/", (req, res, next) => {
-            if (req.headers.upgrade && req.headers.upgrade.toLowerCase() === 'websocket') {
+            var _a;
+            if (((_a = req.headers.upgrade) === null || _a === void 0 ? void 0 : _a.toLowerCase()) === 'websocket')
                 return next();
-            }
             res.status(200).json({
                 status: "healthy",
                 tunnels: this.tunnels.size,
@@ -101,18 +117,16 @@ class DainTunnelServer {
                 uptime: process.uptime()
             });
         });
-        // Generic route handler for all tunnel requests
         this.app.use("/:tunnelId", this.handleRequest.bind(this));
     }
     setupWebSocketServer() {
-        // Handle WebSocket connections from tunnel clients
         this.wss.on("connection", (ws, req) => {
             var _a;
             try {
                 const url = (0, url_1.parse)(req.url || '', true);
                 const pathParts = ((_a = url.pathname) === null || _a === void 0 ? void 0 : _a.split('/')) || [];
-                // Client tunnel connection has no tunnelId in the path (or is at root)
-                if (!url.pathname || url.pathname === '/' || pathParts.length <= 1 || !pathParts[1]) {
+                const isRootConnection = !url.pathname || url.pathname === '/' || pathParts.length <= 1 || !pathParts[1];
+                if (isRootConnection) {
                     this.handleTunnelClientConnection(ws, req);
                 }
                 else {
@@ -125,25 +139,26 @@ class DainTunnelServer {
             }
         });
     }
-    // Handle WebSocket connections from tunnel clients
     handleTunnelClientConnection(ws, req) {
         ws.on("message", (message) => {
             try {
                 const data = JSON.parse(message);
-                if (data.type === "challenge_request") {
-                    this.handleChallengeRequest(ws);
-                }
-                else if (data.type === "start") {
-                    this.handleStartMessage(ws, data);
-                }
-                else if (data.type === "response") {
-                    this.handleResponseMessage(data);
-                }
-                else if (data.type === "sse") {
-                    this.handleSSEMessage(data);
-                }
-                else if (data.type === "websocket") {
-                    this.handleWebSocketMessage(data);
+                switch (data.type) {
+                    case "challenge_request":
+                        this.handleChallengeRequest(ws);
+                        break;
+                    case "start":
+                        this.handleStartMessage(ws, data);
+                        break;
+                    case "response":
+                        this.handleResponseMessage(data);
+                        break;
+                    case "sse":
+                        this.handleSSEMessage(data);
+                        break;
+                    case "websocket":
+                        this.handleWebSocketMessage(data);
+                        break;
                 }
             }
             catch (error) {
@@ -154,7 +169,6 @@ class DainTunnelServer {
         ws.on("close", () => this.removeTunnel(ws));
         ws.on("error", (error) => console.error("[Tunnel] WS error:", error));
     }
-    // Handle incoming WebSocket connections to be proxied through the tunnel
     handleProxiedWebSocketConnection(ws, req) {
         var _a;
         const url = (0, url_1.parse)(req.url || '', true);
@@ -170,67 +184,35 @@ class DainTunnelServer {
             ws.close(1008, "Tunnel not found");
             return;
         }
-        // Create a WebSocket connection ID
         const wsConnectionId = fastId();
-        // Store this connection with tunnelId for proper cleanup
         this.wsConnections.set(wsConnectionId, {
             clientSocket: ws,
             id: wsConnectionId,
             path: remainingPath,
             headers: req.headers,
-            tunnelId: tunnelId
+            tunnelId
         });
-        // Notify tunnel client about the new WebSocket connection
         this.safeSend(tunnel.ws, {
             type: "websocket_connection",
             id: wsConnectionId,
             path: remainingPath,
             headers: req.headers
         });
-        // Handle messages from the client
-        ws.on("message", (data) => {
+        const sendToTunnel = (event, data) => {
             const currentTunnel = this.tunnels.get(tunnelId);
             if (currentTunnel) {
-                this.safeSend(currentTunnel.ws, {
-                    type: "websocket",
-                    id: wsConnectionId,
-                    event: "message",
-                    data: data.toString('base64')
-                });
+                this.safeSend(currentTunnel.ws, { type: "websocket", id: wsConnectionId, event, data });
             }
-        });
-        // Handle client disconnection
-        ws.on("close", () => {
-            const currentTunnel = this.tunnels.get(tunnelId);
-            if (currentTunnel) {
-                this.safeSend(currentTunnel.ws, {
-                    type: "websocket",
-                    id: wsConnectionId,
-                    event: "close"
-                });
-            }
-            this.wsConnections.delete(wsConnectionId);
-        });
-        // Handle errors
-        ws.on("error", (error) => {
-            const currentTunnel = this.tunnels.get(tunnelId);
-            if (currentTunnel) {
-                this.safeSend(currentTunnel.ws, {
-                    type: "websocket",
-                    id: wsConnectionId,
-                    event: "error",
-                    data: error.message
-                });
-            }
-        });
+        };
+        ws.on("message", (data) => sendToTunnel("message", data.toString('base64')));
+        ws.on("close", () => { sendToTunnel("close"); this.wsConnections.delete(wsConnectionId); });
+        ws.on("error", (error) => sendToTunnel("error", error.message));
     }
     handleChallengeRequest(ws) {
         const challenge = fastId();
-        const challengeObj = { ws, challenge, timestamp: Date.now() };
-        this.challenges.set(challenge, challengeObj);
+        this.challenges.set(challenge, { ws, challenge, timestamp: Date.now() });
         ws.send(JSON.stringify({ type: "challenge", challenge }));
-        // Auto-cleanup expired challenges (30 second TTL)
-        setTimeout(() => this.challenges.delete(challenge), 30000);
+        setTimeout(() => this.challenges.delete(challenge), TIMEOUTS.CHALLENGE_TTL);
     }
     handleStartMessage(ws, data) {
         const { challenge, signature, tunnelId, apiKey } = data;
@@ -241,7 +223,6 @@ class DainTunnelServer {
         }
         this.challenges.delete(challenge);
         try {
-            // Parse API key to get the secret for HMAC validation
             if (!apiKey) {
                 ws.close(1008, "API key required");
                 return;
@@ -251,45 +232,28 @@ class DainTunnelServer {
                 ws.close(1008, "Invalid API key format");
                 return;
             }
-            // Validate HMAC signature using constant-time comparison
-            const expectedSignature = (0, crypto_1.createHmac)('sha256', parsed.secret)
-                .update(challenge)
-                .digest('hex');
-            // Convert to buffers for timing-safe comparison
+            const expectedSignature = (0, crypto_1.createHmac)('sha256', parsed.secret).update(challenge).digest('hex');
             const expectedSigBuffer = Buffer.from(expectedSignature, 'hex');
             const receivedSigBuffer = Buffer.from(signature, 'hex');
-            // Constant-time comparison to prevent timing attacks
             if (expectedSigBuffer.length !== receivedSigBuffer.length ||
                 !(0, crypto_1.timingSafeEqual)(expectedSigBuffer, receivedSigBuffer)) {
                 ws.close(1008, "Invalid signature");
                 return;
             }
-            // Verify that tunnelId matches orgId_agentId from the API key
             const expectedTunnelId = `${parsed.orgId}_${parsed.agentId}`;
             if (tunnelId !== expectedTunnelId) {
                 ws.close(1008, `Tunnel ID does not match API key. Expected: ${expectedTunnelId}, Got: ${tunnelId}`);
                 return;
             }
-            // If tunnel already exists, remove old one
-            if (this.tunnels.has(tunnelId)) {
-                const oldTunnel = this.tunnels.get(tunnelId);
-                if (oldTunnel && oldTunnel.ws !== ws) {
-                    oldTunnel.ws.close(1000, "Replaced by new connection");
-                }
+            const existingTunnel = this.tunnels.get(tunnelId);
+            if (existingTunnel && existingTunnel.ws !== ws) {
+                existingTunnel.ws.close(1000, "Replaced by new connection");
             }
             this.tunnels.set(tunnelId, { id: tunnelId, ws });
-            // Save tunnel ID on the WebSocket object for easy lookup on close
             ws.tunnelId = tunnelId;
-            // Liveness detection: track pong responses
             let isAlive = true;
             let missedPongs = 0;
-            const MAX_MISSED_PONGS = 2; // Allow 2 missed pongs before considering dead
-            // Handle pong responses to verify connection is alive
-            ws.on("pong", () => {
-                isAlive = true;
-                missedPongs = 0;
-            });
-            // Add a periodic ping to keep the connection alive and detect dead connections
+            ws.on("pong", () => { isAlive = true; missedPongs = 0; });
             const intervalId = setInterval(() => {
                 if (!this.tunnels.has(tunnelId)) {
                     clearInterval(intervalId);
@@ -298,38 +262,33 @@ class DainTunnelServer {
                 const tunnel = this.tunnels.get(tunnelId);
                 if (!tunnel || tunnel.ws !== ws || ws.readyState !== ws_1.default.OPEN) {
                     clearInterval(intervalId);
-                    if (tunnel && tunnel.ws === ws) {
+                    if ((tunnel === null || tunnel === void 0 ? void 0 : tunnel.ws) === ws)
                         this.tunnels.delete(tunnelId);
-                    }
                     return;
                 }
-                // Check if previous ping was acknowledged
                 if (!isAlive) {
                     missedPongs++;
-                    if (missedPongs >= MAX_MISSED_PONGS) {
+                    if (missedPongs >= LIMITS.MAX_MISSED_PONGS) {
                         console.log(`[Tunnel] ${tunnelId} failed liveness check (${missedPongs} missed pongs), terminating`);
                         clearInterval(intervalId);
-                        ws.terminate(); // Force close without waiting for close handshake
+                        ws.terminate();
                         return;
                     }
                 }
-                // Send new ping and mark as waiting for pong
                 isAlive = false;
                 try {
                     ws.ping();
                 }
-                catch (error) {
+                catch (_a) {
                     clearInterval(intervalId);
                     ws.terminate();
                 }
-            }, 30000); // Ping every 30 seconds
-            // Store the interval ID on the WebSocket object so we can clean it up
+            }, TIMEOUTS.PING_INTERVAL);
             ws.keepAliveInterval = intervalId;
             ws.on("close", () => clearInterval(intervalId));
-            let tunnelUrl = `${this.hostname}`;
-            if (process.env.SKIP_PORT !== "true") {
+            let tunnelUrl = this.hostname;
+            if (process.env.SKIP_PORT !== "true")
                 tunnelUrl += `:${this.port}`;
-            }
             tunnelUrl += `/${tunnelId}`;
             ws.send(JSON.stringify({ type: "tunnelUrl", url: tunnelUrl }));
             console.log(`[Tunnel] Created: ${tunnelUrl}`);
@@ -342,43 +301,27 @@ class DainTunnelServer {
     handleResponseMessage(data) {
         console.log(`[Response] Received for: ${data.requestId}, status: ${data.status}`);
         const pendingRequest = this.pendingRequests.get(data.requestId);
-        if (pendingRequest) {
-            const { res, startTime, tunnelId, timeoutId } = pendingRequest;
-            const endTime = Date.now();
-            console.log(`[Response] Completed in ${endTime - startTime}ms`);
-            // Clear the timeout since we received a response
-            if (timeoutId) {
-                clearTimeout(timeoutId);
-            }
-            // Decrement request counter for backpressure tracking
-            const currentCount = this.tunnelRequestCount.get(tunnelId) || 1;
-            this.tunnelRequestCount.set(tunnelId, Math.max(0, currentCount - 1));
-            const headers = { ...data.headers };
-            delete headers["transfer-encoding"];
-            delete headers["content-length"];
-            const bodyBuffer = Buffer.from(data.body, "base64");
-            res
-                .status(data.status)
-                .set(headers)
-                .set("Content-Length", bodyBuffer.length.toString())
-                .send(bodyBuffer);
-            this.pendingRequests.delete(data.requestId);
-        }
+        if (!pendingRequest)
+            return;
+        const { res, startTime, tunnelId, timeoutId } = pendingRequest;
+        console.log(`[Response] Completed in ${Date.now() - startTime}ms`);
+        if (timeoutId)
+            clearTimeout(timeoutId);
+        this.decrementRequestCount(tunnelId);
+        const headers = { ...data.headers };
+        delete headers["transfer-encoding"];
+        delete headers["content-length"];
+        const bodyBuffer = Buffer.from(data.body, "base64");
+        res.status(data.status).set(headers).set("Content-Length", bodyBuffer.length.toString()).send(bodyBuffer);
+        this.pendingRequests.delete(data.requestId);
     }
     handleSSEMessage(data) {
-        console.log(`[SSE] Received message: id=${data.id}, event=${data.event}`);
         const connection = this.sseConnections.get(data.id);
-        if (!connection) {
-            console.log(`[SSE] Connection not found for id: ${data.id}`);
+        if (!connection)
             return;
-        }
         const { res, tunnelId } = connection;
-        // Skip 'connected' event - we already wrote headers
-        if (data.event === 'connected') {
-            console.log(`[SSE] Received 'connected' event, skipping`);
+        if (data.event === 'connected')
             return;
-        }
-        // Handle close event - end the response and cleanup
         if (data.event === 'close') {
             try {
                 res.end();
@@ -387,7 +330,6 @@ class DainTunnelServer {
             this.cleanupSSEConnection(data.id, tunnelId);
             return;
         }
-        // Handle error event
         if (data.event === 'error') {
             try {
                 res.write(`event: error\ndata: ${data.data}\n\n`);
@@ -397,30 +339,23 @@ class DainTunnelServer {
             this.cleanupSSEConnection(data.id, tunnelId);
             return;
         }
-        // Forward SSE event to client
         try {
-            if (data.event) {
+            if (data.event)
                 res.write(`event: ${data.event}\n`);
-            }
-            // Split data by newlines and send each line with data: prefix
-            const dataLines = data.data.split('\n');
-            for (const line of dataLines) {
+            for (const line of data.data.split('\n')) {
                 res.write(`data: ${line}\n`);
             }
             res.write('\n');
         }
         catch (_c) {
-            // Client disconnected
             this.cleanupSSEConnection(data.id, tunnelId);
         }
     }
     cleanupSSEConnection(id, tunnelId) {
         const connection = this.sseConnections.get(id);
-        if (connection === null || connection === void 0 ? void 0 : connection.keepAliveInterval) {
+        if (connection === null || connection === void 0 ? void 0 : connection.keepAliveInterval)
             clearInterval(connection.keepAliveInterval);
-        }
-        const currentCount = this.tunnelRequestCount.get(tunnelId) || 1;
-        this.tunnelRequestCount.set(tunnelId, Math.max(0, currentCount - 1));
+        this.decrementRequestCount(tunnelId);
         this.sseConnections.delete(id);
     }
     handleWebSocketMessage(data) {
@@ -428,90 +363,79 @@ class DainTunnelServer {
         if (!connection)
             return;
         const { clientSocket } = connection;
-        if (data.event === 'message' && data.data) {
-            const messageData = Buffer.from(data.data, 'base64');
-            if (clientSocket.readyState === ws_1.default.OPEN) {
-                clientSocket.send(messageData);
-            }
-        }
-        else if (data.event === 'close') {
-            if (clientSocket.readyState === ws_1.default.OPEN) {
-                clientSocket.close();
-            }
-            this.wsConnections.delete(data.id);
-        }
-        else if (data.event === 'error' && data.data) {
-            if (clientSocket.readyState === ws_1.default.OPEN) {
-                clientSocket.close(1011, data.data);
-            }
-            this.wsConnections.delete(data.id);
+        const isOpen = clientSocket.readyState === ws_1.default.OPEN;
+        switch (data.event) {
+            case 'message':
+                if (data.data && isOpen)
+                    clientSocket.send(Buffer.from(data.data, 'base64'));
+                break;
+            case 'close':
+                if (isOpen)
+                    clientSocket.close();
+                this.wsConnections.delete(data.id);
+                break;
+            case 'error':
+                if (isOpen)
+                    clientSocket.close(1011, data.data);
+                this.wsConnections.delete(data.id);
+                break;
         }
     }
     async handleRequest(req, res) {
-        var _a;
+        var _a, _b, _c;
         const tunnelId = req.params.tunnelId;
         console.log(`[Request] ${req.method} /${tunnelId}${req.url}, Accept: ${(_a = req.headers.accept) === null || _a === void 0 ? void 0 : _a.substring(0, 30)}`);
-        // Check for upgraded connections (WebSockets) - these are handled by the WebSocket server
-        if (req.headers.upgrade && req.headers.upgrade.toLowerCase() === 'websocket') {
-            // This is handled by the WebSocket server now
+        if (((_b = req.headers.upgrade) === null || _b === void 0 ? void 0 : _b.toLowerCase()) === 'websocket')
             return;
-        }
         let tunnel;
-        let retries = 3;
+        let retries = LIMITS.TUNNEL_RETRY_COUNT;
         while (retries > 0 && !tunnel) {
             tunnel = this.tunnels.get(tunnelId);
             if (!tunnel) {
-                await new Promise(resolve => setTimeout(resolve, 100));
+                await new Promise(resolve => setTimeout(resolve, TIMEOUTS.TUNNEL_RETRY_DELAY));
                 retries--;
             }
         }
         if (!tunnel) {
             const available = Array.from(this.tunnels.keys());
             console.log(`[Request] Tunnel not found: ${tunnelId}, available tunnels: [${available.join(', ')}], count: ${available.length}`);
-            // Decrement counter since we incremented speculatively
-            const count = this.tunnelRequestCount.get(tunnelId) || 1;
-            this.tunnelRequestCount.set(tunnelId, Math.max(0, count - 1));
-            return res.status(502).json({
+            this.decrementRequestCount(tunnelId);
+            res.status(502).json({
                 error: "Bad Gateway",
                 message: `Tunnel "${tunnelId}" not connected. The service may be offline or reconnecting.`,
                 availableTunnels: available.length
             });
+            return;
         }
         console.log(`[Request] Tunnel found: ${tunnelId}, wsState: ${tunnel.ws.readyState}`);
-        // High-frequency optimization: Check WebSocket buffer and apply backpressure
-        if (tunnel.ws.bufferedAmount > 1024 * 1024) {
-            return res.status(503).json({ error: "Service Unavailable", message: "Tunnel high load" });
+        if (tunnel.ws.bufferedAmount > LIMITS.BACKPRESSURE_THRESHOLD) {
+            res.status(503).json({ error: "Service Unavailable", message: "Tunnel high load" });
+            return;
         }
-        // Check concurrent request limit per tunnel
         const currentCount = this.tunnelRequestCount.get(tunnelId) || 0;
-        if (currentCount >= this.MAX_CONCURRENT_REQUESTS_PER_TUNNEL) {
-            return res.status(503).json({ error: "Service Unavailable", message: "Too many concurrent requests" });
+        if (currentCount >= LIMITS.MAX_CONCURRENT_REQUESTS_PER_TUNNEL) {
+            res.status(503).json({ error: "Service Unavailable", message: "Too many concurrent requests" });
+            return;
         }
         this.tunnelRequestCount.set(tunnelId, currentCount + 1);
-        // Check for SSE request
-        if (req.headers.accept && req.headers.accept.includes('text/event-stream')) {
-            return this.handleSSERequest(req, res, tunnelId, tunnel);
+        if ((_c = req.headers.accept) === null || _c === void 0 ? void 0 : _c.includes('text/event-stream')) {
+            this.handleSSERequest(req, res, tunnelId, tunnel);
+            return;
         }
-        // Handle regular HTTP request
         const requestId = fastId();
         const startTime = Date.now();
-        // Set a timeout for the request (30 seconds)
-        const REQUEST_TIMEOUT = 30000;
         const timeoutId = setTimeout(() => {
             const pendingRequest = this.pendingRequests.get(requestId);
             if (pendingRequest) {
-                const currentCount = this.tunnelRequestCount.get(tunnelId) || 1;
-                this.tunnelRequestCount.set(tunnelId, Math.max(0, currentCount - 1));
+                this.decrementRequestCount(tunnelId);
                 this.pendingRequests.delete(requestId);
                 if (!res.headersSent) {
                     res.status(504).json({ error: "Gateway Timeout", message: "Request timed out" });
                 }
             }
-        }, REQUEST_TIMEOUT);
+        }, TIMEOUTS.REQUEST_TIMEOUT);
         this.pendingRequests.set(requestId, { res, startTime, tunnelId, timeoutId });
         console.log(`[Request] Sending to tunnel client: ${requestId}, wsState: ${tunnel.ws.readyState}, buffered: ${tunnel.ws.bufferedAmount}`);
-        // FIX: Only include body if it has actual content (not empty buffer)
-        // Empty buffer is truthy but should be treated as no body
         const hasBody = req.method !== "GET" && req.method !== "HEAD" &&
             req.body && Buffer.isBuffer(req.body) && req.body.length > 0;
         const sent = this.safeSend(tunnel.ws, {
@@ -523,53 +447,66 @@ class DainTunnelServer {
             body: hasBody ? req.body.toString("base64") : undefined,
         });
         console.log(`[Request] Sent to tunnel client: ${sent}`);
-        // If send failed, clean up immediately
         if (!sent) {
             clearTimeout(timeoutId);
             this.pendingRequests.delete(requestId);
-            const count = this.tunnelRequestCount.get(tunnelId) || 1;
-            this.tunnelRequestCount.set(tunnelId, Math.max(0, count - 1));
+            this.decrementRequestCount(tunnelId);
             if (!res.headersSent) {
                 res.status(502).json({ error: "Bad Gateway", message: "Tunnel connection lost" });
             }
         }
     }
     handleSSERequest(req, res, tunnelId, tunnel) {
-        var _a;
+        var _a, _b;
         const sseId = fastId();
-        console.log(`[SSE] New request: ${sseId}, tunnel: ${tunnelId}, path: ${req.url}`);
-        // Setup SSE headers
-        res.writeHead(200, {
+        const startTime = Date.now();
+        console.log(`[SSE] ${sseId} started: ${req.url}`);
+        if (req.socket) {
+            req.socket.setNoDelay(true);
+            req.socket.setTimeout(0);
+        }
+        const origin = req.headers.origin;
+        const sseHeaders = {
             'Content-Type': 'text/event-stream',
-            'Cache-Control': 'no-cache',
-            'Connection': 'keep-alive'
-        });
-        // Flush headers and send immediate keepalive to establish the stream
+            'Cache-Control': 'no-cache, no-transform',
+            'Connection': 'keep-alive',
+            'X-Accel-Buffering': 'no',
+            'X-Content-Type-Options': 'nosniff',
+            'Content-Encoding': 'identity',
+            'Transfer-Encoding': 'chunked',
+        };
+        if (typeof origin === 'string') {
+            sseHeaders['Access-Control-Allow-Origin'] = origin;
+            sseHeaders['Access-Control-Allow-Credentials'] = 'true';
+            sseHeaders['Vary'] = 'Origin';
+        }
+        else {
+            sseHeaders['Access-Control-Allow-Origin'] = '*';
+        }
+        res.writeHead(200, sseHeaders);
+        const flush = () => {
+            if (typeof res.flush === 'function')
+                res.flush();
+        };
         (_a = res.flushHeaders) === null || _a === void 0 ? void 0 : _a.call(res);
         res.write(':keepalive\n\n');
-        // Send periodic keep-alive comments to prevent proxy timeouts
-        const keepAliveIntervalMs = 5000;
+        flush();
         const keepAliveInterval = setInterval(() => {
             try {
                 if (!res.writableEnded) {
                     res.write(':keepalive\n\n');
+                    flush();
                 }
-                else {
+                else
                     clearInterval(keepAliveInterval);
-                }
             }
             catch (_a) {
                 clearInterval(keepAliveInterval);
             }
-        }, keepAliveIntervalMs);
-        // Store the SSE connection
-        this.sseConnections.set(sseId, {
-            req, res, id: sseId, tunnelId, keepAliveInterval
-        });
-        // FIX: Only include body if it has actual content (not empty buffer)
+        }, TIMEOUTS.SSE_KEEPALIVE);
+        this.sseConnections.set(sseId, { req, res, id: sseId, tunnelId, keepAliveInterval });
         const hasBody = req.method !== "GET" && req.body &&
             Buffer.isBuffer(req.body) && req.body.length > 0;
-        // Notify the tunnel client about the new SSE connection
         const sent = this.safeSend(tunnel.ws, {
             type: "sse_connection",
             id: sseId,
@@ -578,92 +515,108 @@ class DainTunnelServer {
             headers: req.headers,
             body: hasBody ? req.body.toString("base64") : undefined
         });
-        console.log(`[SSE] Sent sse_connection to tunnel client: ${sent}`);
         if (!sent) {
-            console.log(`[SSE] Failed to send sse_connection, cleaning up`);
             this.cleanupSSEConnection(sseId, tunnelId);
             res.end();
             return;
         }
-        // Handle client disconnect
-        req.on('close', () => {
-            console.log(`[SSE] Client disconnected: ${sseId}`);
+        let cleanedUp = false;
+        const doCleanup = () => {
+            if (cleanedUp)
+                return;
+            cleanedUp = true;
+            console.log(`[SSE] ${sseId} completed in ${Date.now() - startTime}ms`);
             this.safeSend(tunnel.ws, { type: "sse_close", id: sseId });
             this.cleanupSSEConnection(sseId, tunnelId);
+        };
+        req.on('close', () => {
+            var _a;
+            if (((_a = req.socket) === null || _a === void 0 ? void 0 : _a.destroyed) || res.writableEnded)
+                doCleanup();
         });
+        (_b = req.socket) === null || _b === void 0 ? void 0 : _b.on('close', doCleanup);
+        req.on('error', doCleanup);
+        res.on('error', doCleanup);
     }
     removeTunnel(ws) {
         try {
             if (ws.keepAliveInterval)
                 clearInterval(ws.keepAliveInterval);
-            const tunnelId = ws.tunnelId;
-            let removedTunnelId = tunnelId;
-            if (tunnelId && this.tunnels.has(tunnelId)) {
-                const tunnel = this.tunnels.get(tunnelId);
-                if (tunnel && tunnel.ws === ws)
-                    this.tunnels.delete(tunnelId);
-            }
-            else {
-                removedTunnelId = undefined;
-                for (const [id, tunnel] of this.tunnels.entries()) {
-                    if (tunnel.ws === ws) {
-                        this.tunnels.delete(id);
-                        removedTunnelId = id;
-                        break;
-                    }
-                }
-            }
+            const removedTunnelId = this.findAndRemoveTunnel(ws);
             if (removedTunnelId) {
                 this.tunnelRequestCount.delete(removedTunnelId);
-                // Close all pending HTTP requests associated with this tunnel
-                for (const [requestId, pendingRequest] of this.pendingRequests.entries()) {
-                    if (pendingRequest.tunnelId === removedTunnelId) {
-                        try {
-                            if (pendingRequest.timeoutId)
-                                clearTimeout(pendingRequest.timeoutId);
-                            if (!pendingRequest.res.headersSent) {
-                                pendingRequest.res.status(502).json({ error: "Bad Gateway", message: "Tunnel closed" });
-                            }
-                        }
-                        catch (error) { /* ignore */ }
-                        this.pendingRequests.delete(requestId);
-                    }
-                }
-                // Close all SSE connections associated with this tunnel
-                for (const [sseId, sseConnection] of this.sseConnections.entries()) {
-                    if (sseConnection.tunnelId === removedTunnelId) {
-                        // Clear keepalive interval to prevent memory leak
-                        if (sseConnection.keepAliveInterval) {
-                            clearInterval(sseConnection.keepAliveInterval);
-                        }
-                        try {
-                            sseConnection.res.end();
-                        }
-                        catch (error) { /* ignore */ }
-                        this.sseConnections.delete(sseId);
+                this.cleanupPendingRequests(removedTunnelId);
+                this.cleanupTunnelSSEConnections(removedTunnelId);
+                this.cleanupTunnelWSConnections(removedTunnelId);
+            }
+            this.cleanupChallengesForSocket(ws);
+        }
+        catch (error) {
+            console.error("[Tunnel] Remove error:", error);
+        }
+    }
+    findAndRemoveTunnel(ws) {
+        const tunnelId = ws.tunnelId;
+        if (tunnelId && this.tunnels.has(tunnelId)) {
+            const tunnel = this.tunnels.get(tunnelId);
+            if ((tunnel === null || tunnel === void 0 ? void 0 : tunnel.ws) === ws) {
+                this.tunnels.delete(tunnelId);
+                return tunnelId;
+            }
+        }
+        for (const [id, tunnel] of this.tunnels.entries()) {
+            if (tunnel.ws === ws) {
+                this.tunnels.delete(id);
+                return id;
+            }
+        }
+        return undefined;
+    }
+    cleanupPendingRequests(tunnelId) {
+        for (const [requestId, pending] of this.pendingRequests.entries()) {
+            if (pending.tunnelId === tunnelId) {
+                try {
+                    if (pending.timeoutId)
+                        clearTimeout(pending.timeoutId);
+                    if (!pending.res.headersSent) {
+                        pending.res.status(502).json({ error: "Bad Gateway", message: "Tunnel closed" });
                     }
                 }
-                // Close all WebSocket connections associated with this tunnel
-                for (const [wsId, wsConnection] of this.wsConnections.entries()) {
-                    if (wsConnection.tunnelId === removedTunnelId) {
-                        try {
-                            wsConnection.clientSocket.close(1001, "Tunnel closed");
-                        }
-                        catch (error) { /* ignore */ }
-                        this.wsConnections.delete(wsId);
-                    }
+                catch (_a) { }
+                this.pendingRequests.delete(requestId);
+            }
+        }
+    }
+    cleanupTunnelSSEConnections(tunnelId) {
+        for (const [sseId, conn] of this.sseConnections.entries()) {
+            if (conn.tunnelId === tunnelId) {
+                if (conn.keepAliveInterval)
+                    clearInterval(conn.keepAliveInterval);
+                try {
+                    conn.res.end();
                 }
+                catch (_a) { }
+                this.sseConnections.delete(sseId);
             }
-            // Remove any pending challenges for this WebSocket
-            for (const [challenge, challengeObj] of this.challenges.entries()) {
-                if (challengeObj.ws === ws) {
-                    this.challenges.delete(challenge);
-                    break;
+        }
+    }
+    cleanupTunnelWSConnections(tunnelId) {
+        for (const [wsId, conn] of this.wsConnections.entries()) {
+            if (conn.tunnelId === tunnelId) {
+                try {
+                    conn.clientSocket.close(1001, "Tunnel closed");
                 }
+                catch (_a) { }
+                this.wsConnections.delete(wsId);
             }
         }
-        catch (error) {
-            console.error("[Tunnel] Remove error:", error);
+    }
+    cleanupChallengesForSocket(ws) {
+        for (const [challenge, obj] of this.challenges.entries()) {
+            if (obj.ws === ws) {
+                this.challenges.delete(challenge);
+                break;
+            }
         }
     }
     async start() {
@@ -677,37 +630,31 @@ class DainTunnelServer {
     async stop() {
         return new Promise((resolve) => {
             try {
-                // Close all SSE connections
-                for (const [sseId, sseConnection] of this.sseConnections.entries()) {
+                for (const [sseId, conn] of this.sseConnections.entries()) {
                     try {
-                        sseConnection.res.end();
+                        conn.res.end();
                     }
                     catch (error) {
-                        console.error(`Error closing SSE connection ${sseId}:`, error);
+                        console.error(`Error closing SSE ${sseId}:`, error);
                     }
                     this.sseConnections.delete(sseId);
                 }
-                // Close all WebSocket connections
-                for (const [wsId, wsConnection] of this.wsConnections.entries()) {
+                for (const [wsId, conn] of this.wsConnections.entries()) {
                     try {
-                        wsConnection.clientSocket.close(1001, "Server shutting down");
+                        conn.clientSocket.close(1001, "Server shutting down");
                     }
                     catch (error) {
-                        console.error(`Error closing WebSocket connection ${wsId}:`, error);
+                        console.error(`Error closing WS ${wsId}:`, error);
                     }
                     this.wsConnections.delete(wsId);
                 }
-                // Close the WebSocket server
                 this.wss.close(() => {
-                    // Close the HTTP server
-                    this.server.close(() => {
-                        resolve();
-                    });
+                    this.server.close(() => resolve());
                 });
             }
             catch (error) {
                 console.error('Error during server shutdown:', error);
-                resolve(); // Resolve anyway to prevent hanging
+                resolve();
             }
         });
     }