@dainprotocol/tunnel 1.1.35 → 2.0.1

package/dist/server/index.js

@@ -1,20 +1,12 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = __importDefault(require("express"));
-const http_1 = __importDefault(require("http"));
-const ws_1 = __importDefault(require("ws"));
-const body_parser_1 = __importDefault(require("body-parser"));
-const auth_1 = require("@dainprotocol/service-sdk/service/auth");
-const crypto_1 = require("crypto");
+import { Hono } from "hono";
+import { parseAPIKey } from "@dainprotocol/service-sdk/service/auth";
+import { createHmac, timingSafeEqual } from "crypto";
 const TIMEOUTS = {
     CHALLENGE_TTL: 30000,
     PING_INTERVAL: 30000,
     REQUEST_TIMEOUT: 30000,
     SSE_KEEPALIVE: 5000,
-    TUNNEL_RETRY_DELAY: 20, // Reduced from 100ms
+    TUNNEL_RETRY_DELAY: 20,
     SERVER_KEEPALIVE: 65000,
     SERVER_HEADERS: 66000,
 };
@@ -23,17 +15,16 @@ const LIMITS = {
     MAX_MISSED_PONGS: 2,
     MAX_PAYLOAD_BYTES: 100 * 1024 * 1024,
     BACKPRESSURE_THRESHOLD: 1024 * 1024,
+    MAX_PENDING_WS_EVENTS_PER_CONNECTION: 256,
     SERVER_MAX_HEADERS: 100,
     WS_BACKLOG: 100,
-    TUNNEL_RETRY_COUNT: 2, // Reduced from 3
+    TUNNEL_RETRY_COUNT: 2,
 };
-// Fast ID generator - no crypto needed for internal IDs
 let idCounter = 0;
 const ID_PREFIX = Date.now().toString(36);
 function fastId() {
     return `${ID_PREFIX}-${(++idCounter).toString(36)}`;
 }
-// Fast path extraction - avoids URL parsing overhead
 function extractPathParts(url) {
     if (!url)
         return [];
@@ -41,31 +32,45 @@ function extractPathParts(url) {
     const path = qIdx >= 0 ? url.slice(0, qIdx) : url;
     return path.split('/');
 }
-function rawDataToString(message) {
-    if (typeof message === "string")
-        return message;
-    if (Buffer.isBuffer(message))
-        return message.toString("utf8");
-    if (Array.isArray(message))
-        return Buffer.concat(message).toString("utf8");
-    return Buffer.from(message).toString("utf8");
-}
-function rawDataToBase64(data) {
-    if (typeof data === "string")
-        return Buffer.from(data, "utf8").toString("base64");
-    if (Buffer.isBuffer(data))
-        return data.toString("base64");
-    if (Array.isArray(data))
-        return Buffer.concat(data).toString("base64");
-    return Buffer.from(data).toString("base64");
-}
 function normalizeHostToBaseUrl(hostname) {
     return /^https?:\/\//i.test(hostname) ? hostname : `http://${hostname}`;
 }
+function parseAllowedCorsOrigins(raw) {
+    if (!raw)
+        return null;
+    const origins = raw
+        .split(",")
+        .map((origin) => origin.trim().toLowerCase())
+        .filter(Boolean);
+    return origins.length > 0 ? new Set(origins) : null;
+}
+function isCorsOriginAllowed(origin, allowedOrigins) {
+    if (!allowedOrigins)
+        return true;
+    if (allowedOrigins.has("*"))
+        return true;
+    return allowedOrigins.has(origin.trim().toLowerCase());
+}
+const ALLOWED_CORS_ORIGINS = parseAllowedCorsOrigins(process.env.TUNNEL_ALLOWED_ORIGINS || process.env.CORS_ALLOWED_ORIGINS);
 class DainTunnelServer {
+    buildCorsHeaders(origin) {
+        const headers = {
+            "access-control-allow-methods": "GET, POST, PUT, DELETE, PATCH, OPTIONS",
+            "access-control-allow-headers": "X-DAIN-SIGNATURE, X-DAIN-SMART-ACCOUNT-PDA, X-DAIN-AGENT-ID, X-DAIN-ORG-ID, X-DAIN-ADDRESS, X-DAIN-TIMESTAMP, X-DAIN-WEBHOOK-URL, X-Service, X-Service-Token, Content-Type, Authorization, Accept, Origin, X-Requested-With",
+        };
+        if (origin && isCorsOriginAllowed(origin, this.allowedCorsOrigins)) {
+            headers["access-control-allow-origin"] = origin;
+            headers["access-control-allow-credentials"] = "true";
+            headers["vary"] = "Origin";
+        }
+        else if (!origin) {
+            headers["access-control-allow-origin"] = "*";
+        }
+        return headers;
+    }
     safeSend(ws, data) {
         try {
-            if (ws.readyState === ws_1.default.OPEN) {
+            if (ws.readyState === 1) { // WebSocket.OPEN
                 ws.send(JSON.stringify(data));
                 return true;
             }
@@ -103,55 +108,43 @@ class DainTunnelServer {
     constructor(hostname, port) {
         this.hostname = hostname;
         this.port = port;
+        this.server = null;
+        this.allowedCorsOrigins = ALLOWED_CORS_ORIGINS;
         this.tunnels = new Map();
         this.pendingRequests = new Map();
         this.challenges = new Map();
         this.sseConnections = new Map();
         this.wsConnections = new Map();
+        this.pendingProxiedWSEvents = new Map();
         this.tunnelRequestCount = new Map();
-        this.app = (0, express_1.default)();
-        this.server = http_1.default.createServer(this.app);
-        this.server.keepAliveTimeout = TIMEOUTS.SERVER_KEEPALIVE;
-        this.server.headersTimeout = TIMEOUTS.SERVER_HEADERS;
-        this.server.maxHeadersCount = LIMITS.SERVER_MAX_HEADERS;
-        this.wss = new ws_1.default.Server({
-            server: this.server,
-            path: undefined,
-            backlog: LIMITS.WS_BACKLOG,
-            perMessageDeflate: false,
-            maxPayload: LIMITS.MAX_PAYLOAD_BYTES,
-        });
-        this.app.use((req, res, next) => {
-            const origin = req.headers.origin;
+        this.app = new Hono();
+        this.setupRoutes();
+    }
+    setupRoutes() {
+        // CORS middleware
+        this.app.use("*", async (c, next) => {
+            const origin = c.req.header("origin");
             if (origin) {
-                res.header("Access-Control-Allow-Origin", origin);
-                res.header("Vary", "Origin");
-                res.header("Access-Control-Allow-Credentials", "true");
+                if (!isCorsOriginAllowed(origin, this.allowedCorsOrigins)) {
+                    return c.json({ error: "Origin not allowed" }, 403);
+                }
+                c.header("Access-Control-Allow-Origin", origin);
+                c.header("Vary", "Origin");
+                c.header("Access-Control-Allow-Credentials", "true");
             }
             else {
-                res.header("Access-Control-Allow-Origin", "*");
+                c.header("Access-Control-Allow-Origin", "*");
             }
-            res.header("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, PATCH, OPTIONS");
-            res.header("Access-Control-Allow-Headers", "X-DAIN-SIGNATURE, X-DAIN-SMART-ACCOUNT-PDA, X-DAIN-AGENT-ID, X-DAIN-ORG-ID, X-DAIN-ADDRESS, X-DAIN-TIMESTAMP, X-DAIN-WEBHOOK-URL, Content-Type, Authorization, Accept, Origin, X-Requested-With");
-            if (req.method === "OPTIONS")
-                return res.sendStatus(204);
-            next();
-        });
-        this.app.use((req, res, next) => {
-            if (req.method === 'GET' || req.method === 'HEAD' || req.method === 'OPTIONS') {
-                return next();
+            c.header("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, PATCH, OPTIONS");
+            c.header("Access-Control-Allow-Headers", "X-DAIN-SIGNATURE, X-DAIN-SMART-ACCOUNT-PDA, X-DAIN-AGENT-ID, X-DAIN-ORG-ID, X-DAIN-ADDRESS, X-DAIN-TIMESTAMP, X-DAIN-WEBHOOK-URL, X-Service, X-Service-Token, Content-Type, Authorization, Accept, Origin, X-Requested-With");
+            if (c.req.method === "OPTIONS") {
+                return c.body(null, 204);
             }
-            body_parser_1.default.raw({ type: "*/*", limit: "100mb" })(req, res, next);
+            await next();
         });
-        this.setupExpressRoutes();
-        this.setupWebSocketServer();
-    }
-    setupExpressRoutes() {
-        this.app.get("/", (req, res, next) => {
-            var _a;
-            if (((_a = req.headers.upgrade) === null || _a === void 0 ? void 0 : _a.toLowerCase()) === 'websocket')
-                return next();
-            res.status(200).json({
+        // Health/status at root
+        this.app.get("/", (c) => {
+            return c.json({
                 status: "healthy",
                 tunnels: this.tunnels.size,
                 pendingRequests: this.pendingRequests.size,
@@ -160,102 +153,87 @@ class DainTunnelServer {
                 uptime: process.uptime()
             });
         });
-        this.app.get("/health", (req, res) => {
-            res.status(200).json({
+        this.app.get("/health", (c) => {
+            return c.json({
                 status: "ok",
                 tunnels: this.tunnels.size,
                 pendingRequests: this.pendingRequests.size,
                 uptime: process.uptime()
             });
         });
-        this.app.use("/:tunnelId", this.handleRequest.bind(this));
+        // Tunnel request handler - all methods
+        this.app.all("/:tunnelId/*", (c) => this.handleRequest(c));
+        this.app.all("/:tunnelId", (c) => this.handleRequest(c));
     }
-    setupWebSocketServer() {
-        this.wss.on("connection", (ws, req) => {
-            try {
-                const pathParts = extractPathParts(req.url);
-                const isRootConnection = pathParts.length <= 1 || !pathParts[1];
-                if (isRootConnection) {
-                    this.handleTunnelClientConnection(ws, req);
-                }
-                else {
-                    this.handleProxiedWebSocketConnection(ws, req);
-                }
-            }
-            catch (error) {
-                console.error("[Tunnel] WebSocket setup error:", error);
-                ws.close(1011, "Internal server error");
+    // --- WebSocket handlers for Bun.serve ---
+    handleWsOpen(ws) {
+        // Nothing needed on open for tunnel clients; proxied WS connections
+        // are set up via the data attached during upgrade
+    }
+    handleWsMessage(ws, message) {
+        const data = ws.data;
+        if (data.isProxiedWebSocket) {
+            // This is a proxied WebSocket client connection
+            this.handleProxiedWebSocketClientMessage(ws, message);
+            return;
+        }
+        // This is a tunnel client connection
+        try {
+            const msgStr = typeof message === "string" ? message : Buffer.from(message).toString("utf8");
+            const parsed = JSON.parse(msgStr);
+            switch (parsed.type) {
+                case "challenge_request":
+                    this.handleChallengeRequest(ws);
+                    break;
+                case "start":
+                    this.handleStartMessage(ws, parsed);
+                    break;
+                case "response":
+                    this.handleResponseMessage(parsed);
+                    break;
+                case "sse":
+                    this.handleSSEMessage(parsed);
+                    break;
+                case "websocket":
+                    this.handleWebSocketMessage(parsed);
+                    break;
             }
-        });
+        }
+        catch (error) {
+            console.error("[Tunnel] Message error:", error);
+            ws.close(1008, "Invalid message");
+        }
     }
-    handleTunnelClientConnection(ws, req) {
-        ws.on("message", (message) => {
-            try {
-                const data = JSON.parse(rawDataToString(message));
-                switch (data.type) {
-                    case "challenge_request":
-                        this.handleChallengeRequest(ws);
-                        break;
-                    case "start":
-                        this.handleStartMessage(ws, data);
-                        break;
-                    case "response":
-                        this.handleResponseMessage(data);
-                        break;
-                    case "sse":
-                        this.handleSSEMessage(data);
-                        break;
-                    case "websocket":
-                        this.handleWebSocketMessage(data);
-                        break;
+    handleWsClose(ws, code, reason) {
+        const data = ws.data;
+        if (data.isProxiedWebSocket) {
+            // Proxied WS client disconnected
+            if (data.proxiedWsId && data.proxiedTunnelId) {
+                const tunnel = this.tunnels.get(data.proxiedTunnelId);
+                if (tunnel) {
+                    this.safeSend(tunnel.ws, { type: "websocket", id: data.proxiedWsId, event: "close" });
                 }
+                this.wsConnections.delete(data.proxiedWsId);
             }
-            catch (error) {
-                console.error("[Tunnel] Message error:", error);
-                ws.close(1008, "Invalid message");
-            }
-        });
-        ws.on("close", () => this.removeTunnel(ws));
-        ws.on("error", (error) => console.error("[Tunnel] WS error:", error));
-    }
-    handleProxiedWebSocketConnection(ws, req) {
-        const pathParts = extractPathParts(req.url);
-        if (pathParts.length < 2) {
-            ws.close(1008, "Invalid tunnel ID");
             return;
         }
-        const tunnelId = pathParts[1];
-        const remainingPath = '/' + pathParts.slice(2).join('/');
-        const tunnel = this.tunnels.get(tunnelId);
-        if (!tunnel) {
-            ws.close(1008, "Tunnel not found");
+        // Tunnel client disconnected
+        this.removeTunnel(ws);
+    }
+    // --- Proxied WebSocket handling ---
+    handleProxiedWebSocketClientMessage(ws, message) {
+        const { proxiedWsId, proxiedTunnelId } = ws.data;
+        if (!proxiedWsId || !proxiedTunnelId)
             return;
-        }
-        const wsConnectionId = fastId();
-        const forwardedHeaders = this.buildForwardedHeaders(req.headers, tunnelId);
-        this.wsConnections.set(wsConnectionId, {
-            clientSocket: ws,
-            id: wsConnectionId,
-            path: remainingPath,
-            headers: forwardedHeaders,
-            tunnelId
-        });
-        this.safeSend(tunnel.ws, {
-            type: "websocket_connection",
-            id: wsConnectionId,
-            path: remainingPath,
-            headers: forwardedHeaders
-        });
-        const sendToTunnel = (event, data) => {
-            const currentTunnel = this.tunnels.get(tunnelId);
-            if (currentTunnel) {
-                this.safeSend(currentTunnel.ws, { type: "websocket", id: wsConnectionId, event, data });
-            }
-        };
-        ws.on("message", (data) => sendToTunnel("message", rawDataToBase64(data)));
-        ws.on("close", () => { sendToTunnel("close"); this.wsConnections.delete(wsConnectionId); });
-        ws.on("error", (error) => sendToTunnel("error", error.message));
+        const tunnel = this.tunnels.get(proxiedTunnelId);
+        if (!tunnel)
+            return;
+        const base64Data = typeof message === "string"
+            ? Buffer.from(message, "utf8").toString("base64")
+            : Buffer.from(message).toString("base64");
+        this.safeSend(tunnel.ws, { type: "websocket", id: proxiedWsId, event: "message", data: base64Data });
     }
+    // --- Tunnel client message handlers ---
     handleChallengeRequest(ws) {
         const challenge = fastId();
         this.challenges.set(challenge, { ws, challenge, timestamp: Date.now() });
@@ -275,16 +253,16 @@ class DainTunnelServer {
                 ws.close(1008, "API key required");
                 return;
             }
-            const parsed = (0, auth_1.parseAPIKey)(apiKey);
+            const parsed = parseAPIKey(apiKey);
             if (!parsed) {
                 ws.close(1008, "Invalid API key format");
                 return;
             }
-            const expectedSignature = (0, crypto_1.createHmac)('sha256', parsed.secret).update(challenge).digest('hex');
+            const expectedSignature = createHmac('sha256', parsed.secret).update(challenge).digest('hex');
             const expectedSigBuffer = Buffer.from(expectedSignature, 'hex');
             const receivedSigBuffer = Buffer.from(signature, 'hex');
             if (expectedSigBuffer.length !== receivedSigBuffer.length ||
-                !(0, crypto_1.timingSafeEqual)(expectedSigBuffer, receivedSigBuffer)) {
+                !timingSafeEqual(expectedSigBuffer, receivedSigBuffer)) {
                 ws.close(1008, "Invalid signature");
                 return;
             }
@@ -298,19 +276,20 @@ class DainTunnelServer {
                 existingTunnel.ws.close(1000, "Replaced by new connection");
             }
             this.tunnels.set(tunnelId, { id: tunnelId, ws });
-            ws.tunnelId = tunnelId;
+            ws.data.tunnelId = tunnelId;
             let isAlive = true;
             let missedPongs = 0;
-            ws.on("pong", () => { isAlive = true; missedPongs = 0; });
+            // Bun ServerWebSocket doesn't have pong events or ping() method the same way.
+            // Use a simple send-based keepalive check instead.
             const intervalId = setInterval(() => {
                 if (!this.tunnels.has(tunnelId)) {
                     clearInterval(intervalId);
                     return;
                 }
                 const tunnel = this.tunnels.get(tunnelId);
-                if (!tunnel || tunnel.ws !== ws || ws.readyState !== ws_1.default.OPEN) {
+                if (!tunnel || tunnel.ws !== ws || ws.readyState !== 1) {
                     clearInterval(intervalId);
-                    if ((tunnel === null || tunnel === void 0 ? void 0 : tunnel.ws) === ws)
+                    if (tunnel?.ws === ws)
                         this.tunnels.delete(tunnelId);
                     return;
                 }
@@ -319,24 +298,29 @@ class DainTunnelServer {
                     if (missedPongs >= LIMITS.MAX_MISSED_PONGS) {
                         console.log(`[Tunnel] ${tunnelId} failed liveness check (${missedPongs} missed pongs), terminating`);
                         clearInterval(intervalId);
-                        ws.terminate();
+                        ws.close(1001, "Liveness check failed");
                         return;
                     }
                 }
                 isAlive = false;
                 try {
+                    // Bun supports ws.ping() on ServerWebSocket
                     ws.ping();
                 }
-                catch (_a) {
+                catch {
                     clearInterval(intervalId);
-                    ws.terminate();
+                    ws.close(1001, "Ping failed");
                 }
             }, TIMEOUTS.PING_INTERVAL);
-            ws.keepAliveInterval = intervalId;
-            ws.on("close", () => clearInterval(intervalId));
+            ws.data.keepAliveInterval = intervalId;
+            // Bun's pong is received via the websocket handler pong callback
+            // We track isAlive through the pong handler set up in Bun.serve websocket config
             const tunnelUrl = this.buildTunnelUrl(tunnelId);
             ws.send(JSON.stringify({ type: "tunnelUrl", url: tunnelUrl }));
             console.log(`[Tunnel] Created: ${tunnelUrl}`);
+            // Store isAlive/missedPongs on ws.data for the pong handler
+            ws.data._isAlive = true;
+            ws.data._missedPongsReset = () => { isAlive = true; missedPongs = 0; };
         }
         catch (error) {
             console.error(`Error in handleStartMessage for tunnel ${tunnelId}:`, error);
@@ -347,66 +331,91 @@ class DainTunnelServer {
         const pendingRequest = this.pendingRequests.get(data.requestId);
         if (!pendingRequest)
             return;
-        const { res, tunnelId, timeoutId } = pendingRequest;
+        const { resolve, tunnelId, timeoutId, origin } = pendingRequest;
         this.pendingRequests.delete(data.requestId);
         if (timeoutId)
             clearTimeout(timeoutId);
         this.decrementRequestCount(tunnelId);
-        // Modify headers in place instead of spreading
         const headers = data.headers;
         delete headers["transfer-encoding"];
         delete headers["content-length"];
+        // Inject CORS headers — Hono middleware doesn't apply to Promise-resolved responses
+        Object.assign(headers, this.buildCorsHeaders(origin));
         const bodyBuffer = Buffer.from(data.body, "base64");
-        res.status(data.status).set(headers).set("Content-Length", bodyBuffer.length.toString()).send(bodyBuffer);
+        headers["content-length"] = bodyBuffer.length.toString();
+        resolve(new Response(bodyBuffer, {
+            status: data.status,
+            headers,
+        }));
     }
     handleSSEMessage(data) {
         const connection = this.sseConnections.get(data.id);
-        if (!connection)
+        if (!connection || connection.closed)
             return;
-        const { res, tunnelId } = connection;
         if (data.event === 'connected')
             return;
         if (data.event === 'close') {
             try {
-                res.end();
+                connection.controller.close();
             }
-            catch (_a) { }
-            this.cleanupSSEConnection(data.id, tunnelId);
+            catch { }
+            connection.closed = true;
+            this.cleanupSSEConnection(data.id, connection.tunnelId);
             return;
         }
         if (data.event === 'error') {
             try {
-                res.write(`event: error\ndata: ${data.data}\n\n`);
-                res.end();
+                connection.controller.enqueue(new TextEncoder().encode(`event: error\ndata: ${data.data}\n\n`));
+                connection.controller.close();
             }
-            catch (_b) { }
-            this.cleanupSSEConnection(data.id, tunnelId);
+            catch { }
+            connection.closed = true;
+            this.cleanupSSEConnection(data.id, connection.tunnelId);
             return;
         }
         try {
-            // Batch write SSE event in single call
             const lines = data.data.split('\n');
             const message = (data.event ? `event: ${data.event}\n` : '') +
-                lines.map(line => `data: ${line}`).join('\n') + '\n\n';
-            res.write(message);
+                lines.map((line) => `data: ${line}`).join('\n') + '\n\n';
+            connection.controller.enqueue(new TextEncoder().encode(message));
         }
-        catch (_c) {
-            this.cleanupSSEConnection(data.id, tunnelId);
+        catch {
+            this.cleanupSSEConnection(data.id, connection.tunnelId);
         }
     }
     cleanupSSEConnection(id, tunnelId) {
         const connection = this.sseConnections.get(id);
-        if (connection === null || connection === void 0 ? void 0 : connection.keepAliveInterval)
+        if (connection?.keepAliveInterval)
             clearInterval(connection.keepAliveInterval);
         this.decrementRequestCount(tunnelId);
         this.sseConnections.delete(id);
     }
     handleWebSocketMessage(data) {
         const connection = this.wsConnections.get(data.id);
-        if (!connection)
+        if (!connection) {
+            const pendingEvents = this.pendingProxiedWSEvents.get(data.id);
+            if (!pendingEvents)
+                return;
+            if (data.event === "message" &&
+                pendingEvents.length >= LIMITS.MAX_PENDING_WS_EVENTS_PER_CONNECTION) {
+                pendingEvents.push({
+                    type: "websocket",
+                    id: data.id,
+                    event: "error",
+                    data: "WebSocket downstream overloaded",
+                });
+                pendingEvents.push({
+                    type: "websocket",
+                    id: data.id,
+                    event: "close",
+                });
+                return;
+            }
+            pendingEvents.push(data);
             return;
+        }
         const { clientSocket } = connection;
-        const isOpen = clientSocket.readyState === ws_1.default.OPEN;
+        const isOpen = clientSocket.readyState === 1;
         switch (data.event) {
             case 'message':
                 if (data.data && isOpen)
@@ -424,17 +433,24 @@ class DainTunnelServer {
                 break;
         }
     }
-    async handleRequest(req, res) {
-        var _a, _b;
-        const tunnelId = req.params.tunnelId;
-        if (((_a = req.headers.upgrade) === null || _a === void 0 ? void 0 : _a.toLowerCase()) === 'websocket')
+    flushPendingWebSocketEvents(id) {
+        const pendingEvents = this.pendingProxiedWSEvents.get(id);
+        if (!pendingEvents || pendingEvents.length === 0) {
+            this.pendingProxiedWSEvents.delete(id);
             return;
+        }
+        this.pendingProxiedWSEvents.delete(id);
+        for (const event of pendingEvents) {
+            this.handleWebSocketMessage(event);
+        }
+    }
+    async handleRequest(c) {
+        const tunnelId = c.req.param("tunnelId");
         if (!tunnelId || !tunnelId.includes("_")) {
-            res.status(404).json({
+            return c.json({
                 error: "Not Found",
                 message: `Tunnel "${tunnelId}" does not exist.`,
-            });
-            return;
+            }, 404);
         }
         let tunnel;
         let retries = LIMITS.TUNNEL_RETRY_COUNT;
@@ -446,142 +462,180 @@ class DainTunnelServer {
             }
         }
         if (!tunnel) {
-            res.status(502).json({
+            return c.json({
                 error: "Bad Gateway",
                 message: `Tunnel "${tunnelId}" not connected. The service may be offline or reconnecting.`,
                 availableTunnels: this.tunnels.size
-            });
-            return;
-        }
-        if (tunnel.ws.bufferedAmount > LIMITS.BACKPRESSURE_THRESHOLD) {
-            res.status(503).json({ error: "Service Unavailable", message: "Tunnel high load" });
-            return;
+            }, 502);
         }
         const currentCount = this.tunnelRequestCount.get(tunnelId) || 0;
         if (currentCount >= LIMITS.MAX_CONCURRENT_REQUESTS_PER_TUNNEL) {
-            res.status(503).json({ error: "Service Unavailable", message: "Too many concurrent requests" });
-            return;
+            return c.json({ error: "Service Unavailable", message: "Too many concurrent requests" }, 503);
         }
         this.tunnelRequestCount.set(tunnelId, currentCount + 1);
-        if ((_b = req.headers.accept) === null || _b === void 0 ? void 0 : _b.includes('text/event-stream')) {
-            this.handleSSERequest(req, res, tunnelId, tunnel);
-            return;
+        // Check for SSE
+        if (c.req.header("accept")?.includes('text/event-stream')) {
+            return this.handleSSERequest(c, tunnelId, tunnel);
         }
+        // Regular HTTP request
         const requestId = fastId();
-        const startTime = Date.now();
-        const timeoutId = setTimeout(() => {
-            const pendingRequest = this.pendingRequests.get(requestId);
-            if (pendingRequest) {
-                this.decrementRequestCount(tunnelId);
-                this.pendingRequests.delete(requestId);
-                if (!res.headersSent) {
-                    res.status(504).json({ error: "Gateway Timeout", message: "Request timed out" });
-                }
-            }
-        }, TIMEOUTS.REQUEST_TIMEOUT);
-        this.pendingRequests.set(requestId, { res, startTime, tunnelId, timeoutId });
-        const hasBody = req.method !== "GET" && req.method !== "HEAD" &&
-            req.body && Buffer.isBuffer(req.body) && req.body.length > 0;
-        const sent = this.safeSend(tunnel.ws, {
-            type: "request",
-            id: requestId,
-            method: req.method,
-            path: req.url,
-            headers: this.buildForwardedHeaders(req.headers, tunnelId),
-            body: hasBody ? req.body.toString("base64") : undefined,
+        // Extract headers as a plain object
+        const reqHeaders = {};
+        c.req.raw.headers.forEach((value, key) => {
+            reqHeaders[key] = value;
         });
-        if (!sent) {
-            clearTimeout(timeoutId);
-            this.pendingRequests.delete(requestId);
-            this.decrementRequestCount(tunnelId);
-            if (!res.headersSent) {
-                res.status(502).json({ error: "Bad Gateway", message: "Tunnel connection lost" });
+        const forwardedHeaders = this.buildForwardedHeaders(reqHeaders, tunnelId);
+        // Get the path relative to the tunnel ID (everything after /:tunnelId)
+        const fullUrl = new URL(c.req.url);
+        const tunnelPrefix = `/${tunnelId}`;
+        let path = fullUrl.pathname.slice(tunnelPrefix.length) || '/';
+        if (fullUrl.search)
+            path += fullUrl.search;
+        // Read body for non-GET/HEAD methods
+        let bodyBase64;
+        const method = c.req.method;
+        if (method !== "GET" && method !== "HEAD") {
+            try {
+                const bodyBuffer = await c.req.arrayBuffer();
+                if (bodyBuffer.byteLength > 0) {
+                    bodyBase64 = Buffer.from(bodyBuffer).toString("base64");
+                }
             }
+            catch { }
         }
+        const origin = c.req.header("origin");
+        const corsHeaders = this.buildCorsHeaders(origin);
+        return new Promise((resolve) => {
+            const timeoutId = setTimeout(() => {
+                const pendingRequest = this.pendingRequests.get(requestId);
+                if (pendingRequest) {
+                    this.decrementRequestCount(tunnelId);
+                    this.pendingRequests.delete(requestId);
+                    resolve(new Response(JSON.stringify({ error: "Gateway Timeout", message: "Request timed out" }), {
+                        status: 504,
+                        headers: { "content-type": "application/json", ...corsHeaders },
+                    }));
+                }
+            }, TIMEOUTS.REQUEST_TIMEOUT);
+            this.pendingRequests.set(requestId, { resolve, startTime: Date.now(), tunnelId, timeoutId, origin });
+            const sent = this.safeSend(tunnel.ws, {
+                type: "request",
+                id: requestId,
+                method,
+                path,
+                headers: forwardedHeaders,
+                body: bodyBase64,
+            });
+            if (!sent) {
+                clearTimeout(timeoutId);
+                this.pendingRequests.delete(requestId);
+                this.decrementRequestCount(tunnelId);
+                resolve(new Response(JSON.stringify({ error: "Bad Gateway", message: "Tunnel connection lost" }), {
+                    status: 502,
+                    headers: { "content-type": "application/json", ...corsHeaders },
+                }));
+            }
+        });
     }
-    handleSSERequest(req, res, tunnelId, tunnel) {
-        var _a, _b;
+    async handleSSERequest(c, tunnelId, tunnel) {
         const sseId = fastId();
-        if (req.socket) {
-            req.socket.setNoDelay(true);
-            req.socket.setTimeout(0);
+        const requestUrl = new URL(c.req.url);
+        let path = requestUrl.pathname.slice(`/${tunnelId}`.length) || "/";
+        if (requestUrl.search)
+            path += requestUrl.search;
+        // Extract headers
+        const reqHeaders = {};
+        c.req.raw.headers.forEach((value, key) => {
+            reqHeaders[key] = value;
+        });
+        const forwardedHeaders = this.buildForwardedHeaders(reqHeaders, tunnelId);
+        let bodyBase64;
+        if (c.req.method !== "GET" && c.req.method !== "HEAD") {
+            try {
+                const bodyBuffer = await c.req.arrayBuffer();
+                if (bodyBuffer.byteLength > 0) {
+                    bodyBase64 = Buffer.from(bodyBuffer).toString("base64");
+                }
+            }
+            catch {
+                // Best-effort body forwarding for streaming requests
+            }
         }
-        const origin = req.headers.origin;
-        const sseHeaders = {
+        const origin = c.req.header("origin");
+        const responseHeaders = {
             'Content-Type': 'text/event-stream',
             'Cache-Control': 'no-cache, no-transform',
             'Connection': 'keep-alive',
             'X-Accel-Buffering': 'no',
             'X-Content-Type-Options': 'nosniff',
             'Content-Encoding': 'identity',
-            'Transfer-Encoding': 'chunked',
         };
-        if (typeof origin === 'string') {
-            sseHeaders['Access-Control-Allow-Origin'] = origin;
-            sseHeaders['Access-Control-Allow-Credentials'] = 'true';
-            sseHeaders['Vary'] = 'Origin';
+        if (origin) {
+            responseHeaders['Access-Control-Allow-Origin'] = origin;
+            responseHeaders['Access-Control-Allow-Credentials'] = 'true';
+            responseHeaders['Vary'] = 'Origin';
         }
         else {
-            sseHeaders['Access-Control-Allow-Origin'] = '*';
-        }
-        res.writeHead(200, sseHeaders);
-        const flush = () => {
-            if (typeof res.flush === 'function')
-                res.flush();
-        };
-        (_a = res.flushHeaders) === null || _a === void 0 ? void 0 : _a.call(res);
-        res.write(':keepalive\n\n');
-        flush();
-        const keepAliveInterval = setInterval(() => {
-            try {
-                if (!res.writableEnded) {
-                    res.write(':keepalive\n\n');
-                    flush();
+            responseHeaders['Access-Control-Allow-Origin'] = '*';
+        }
+        const encoder = new TextEncoder();
+        let sseController;
+        const stream = new ReadableStream({
+            start: (controller) => {
+                sseController = controller;
+                // Send initial keepalive
+                controller.enqueue(encoder.encode(':keepalive\n\n'));
+                const keepAliveInterval = setInterval(() => {
+                    const conn = this.sseConnections.get(sseId);
+                    if (!conn || conn.closed) {
+                        clearInterval(keepAliveInterval);
+                        return;
+                    }
+                    try {
+                        controller.enqueue(encoder.encode(':keepalive\n\n'));
+                    }
+                    catch {
+                        clearInterval(keepAliveInterval);
+                    }
+                }, TIMEOUTS.SSE_KEEPALIVE);
+                this.sseConnections.set(sseId, {
+                    controller,
+                    id: sseId,
+                    tunnelId,
+                    keepAliveInterval,
+                    closed: false,
+                });
+                const sent = this.safeSend(tunnel.ws, {
+                    type: "sse_connection",
+                    id: sseId,
+                    path,
+                    method: c.req.method,
+                    headers: forwardedHeaders,
+                    body: bodyBase64,
+                });
+                if (!sent) {
+                    this.cleanupSSEConnection(sseId, tunnelId);
+                    try {
+                        controller.close();
+                    }
+                    catch { }
                 }
-                else
-                    clearInterval(keepAliveInterval);
-            }
-            catch (_a) {
-                clearInterval(keepAliveInterval);
-            }
-        }, TIMEOUTS.SSE_KEEPALIVE);
-        this.sseConnections.set(sseId, { req, res, id: sseId, tunnelId, keepAliveInterval });
-        const hasBody = req.method !== "GET" && req.body &&
-            Buffer.isBuffer(req.body) && req.body.length > 0;
-        const sent = this.safeSend(tunnel.ws, {
-            type: "sse_connection",
-            id: sseId,
-            path: req.url,
-            method: req.method,
-            headers: this.buildForwardedHeaders(req.headers, tunnelId),
-            body: hasBody ? req.body.toString("base64") : undefined
+            },
+            cancel: () => {
+                // Client disconnected
+                this.safeSend(tunnel.ws, { type: "sse_close", id: sseId });
+                this.cleanupSSEConnection(sseId, tunnelId);
+            },
         });
-        if (!sent) {
-            this.cleanupSSEConnection(sseId, tunnelId);
-            res.end();
-            return;
-        }
-        let cleanedUp = false;
-        const doCleanup = () => {
-            if (cleanedUp)
-                return;
-            cleanedUp = true;
-            this.safeSend(tunnel.ws, { type: "sse_close", id: sseId });
-            this.cleanupSSEConnection(sseId, tunnelId);
-        };
-        req.on('close', () => {
-            var _a;
-            if (((_a = req.socket) === null || _a === void 0 ? void 0 : _a.destroyed) || res.writableEnded)
-                doCleanup();
+        return new Response(stream, {
+            status: 200,
+            headers: responseHeaders,
         });
-        (_b = req.socket) === null || _b === void 0 ? void 0 : _b.on('close', doCleanup);
-        req.on('error', doCleanup);
-        res.on('error', doCleanup);
     }
     removeTunnel(ws) {
         try {
-            if (ws.keepAliveInterval)
-                clearInterval(ws.keepAliveInterval);
+            if (ws.data.keepAliveInterval)
+                clearInterval(ws.data.keepAliveInterval);
             const removedTunnelId = this.findAndRemoveTunnel(ws);
             if (removedTunnelId) {
                 this.tunnelRequestCount.delete(removedTunnelId);
@@ -596,10 +650,10 @@ class DainTunnelServer {
         }
     }
     findAndRemoveTunnel(ws) {
-        const tunnelId = ws.tunnelId;
+        const tunnelId = ws.data.tunnelId;
         if (tunnelId && this.tunnels.has(tunnelId)) {
             const tunnel = this.tunnels.get(tunnelId);
-            if ((tunnel === null || tunnel === void 0 ? void 0 : tunnel.ws) === ws) {
+            if (tunnel?.ws === ws) {
                 this.tunnels.delete(tunnelId);
                 return tunnelId;
             }
@@ -615,14 +669,15 @@ class DainTunnelServer {
     cleanupPendingRequests(tunnelId) {
         for (const [requestId, pending] of this.pendingRequests.entries()) {
             if (pending.tunnelId === tunnelId) {
-                try {
-                    if (pending.timeoutId)
-                        clearTimeout(pending.timeoutId);
-                    if (!pending.res.headersSent) {
-                        pending.res.status(502).json({ error: "Bad Gateway", message: "Tunnel closed" });
-                    }
-                }
-                catch (_a) { }
+                if (pending.timeoutId)
+                    clearTimeout(pending.timeoutId);
+                pending.resolve(new Response(JSON.stringify({ error: "Bad Gateway", message: "Tunnel closed" }), {
+                    status: 502,
+                    headers: {
+                        "content-type": "application/json",
+                        ...this.buildCorsHeaders(pending.origin),
+                    },
+                }));
                 this.pendingRequests.delete(requestId);
             }
         }
@@ -633,9 +688,10 @@ class DainTunnelServer {
                 if (conn.keepAliveInterval)
                     clearInterval(conn.keepAliveInterval);
                 try {
-                    conn.res.end();
+                    conn.controller.close();
                 }
-                catch (_a) { }
+                catch { }
+                conn.closed = true;
                 this.sseConnections.delete(sseId);
             }
         }
@@ -646,7 +702,7 @@ class DainTunnelServer {
                 try {
                     conn.clientSocket.close(1001, "Tunnel closed");
                 }
-                catch (_a) { }
+                catch { }
                 this.wsConnections.delete(wsId);
             }
         }
@@ -659,78 +715,168 @@ class DainTunnelServer {
         }
     }
     async start() {
-        return new Promise((resolve) => {
-            this.server.listen(this.port, () => {
-                console.log(`DainTunnel Server is running on ${this.hostname}:${this.port}`);
-                resolve();
-            });
-        });
-    }
-    async stop() {
-        return new Promise((resolve) => {
-            try {
-                for (const tunnel of this.tunnels.values()) {
-                    if (tunnel.ws.keepAliveInterval)
-                        clearInterval(tunnel.ws.keepAliveInterval);
-                    try {
-                        tunnel.ws.terminate();
+        const self = this;
+        this.server = Bun.serve({
+            port: this.port,
+            hostname: "0.0.0.0",
+            fetch(req, server) {
+                const url = new URL(req.url);
+                // Check for WebSocket upgrade
+                if (req.headers.get('upgrade')?.toLowerCase() === 'websocket') {
+                    const pathParts = url.pathname.split('/').filter(Boolean);
+                    if (pathParts.length === 0) {
+                        // Root WebSocket = tunnel client connection
+                        const success = server.upgrade(req, {
+                            data: {
+                                isProxiedWebSocket: false,
+                                tunnelId: undefined,
+                                keepAliveInterval: undefined,
+                            },
+                        });
+                        if (success)
+                            return undefined;
+                        return new Response("WebSocket upgrade failed", { status: 400 });
+                    }
+                    // Proxied WebSocket = /:tunnelId/...
+                    const tunnelId = pathParts[0];
+                    const remainingPath = '/' + pathParts.slice(1).join('/');
+                    const tunnel = self.tunnels.get(tunnelId);
+                    if (!tunnel) {
+                        return new Response("Tunnel not found", { status: 404 });
                     }
-                    catch (error) {
-                        console.error(`Error closing tunnel ${tunnel.id}:`, error);
+                    const wsConnectionId = fastId();
+                    const reqHeaders = {};
+                    req.headers.forEach((value, key) => {
+                        reqHeaders[key] = value;
+                    });
+                    const forwardedHeaders = self.buildForwardedHeaders(reqHeaders, tunnelId);
+                    self._pendingProxiedWs = self._pendingProxiedWs || new Map();
+                    self._pendingProxiedWs.set(wsConnectionId, {
+                        tunnelId,
+                        path: remainingPath,
+                        headers: forwardedHeaders,
+                    });
+                    self.pendingProxiedWSEvents.set(wsConnectionId, []);
+                    const success = server.upgrade(req, {
+                        data: {
+                            isProxiedWebSocket: true,
+                            proxiedWsId: wsConnectionId,
+                            proxiedTunnelId: tunnelId,
+                        },
+                    });
+                    if (success) {
+                        self.safeSend(tunnel.ws, {
+                            type: "websocket_connection",
+                            id: wsConnectionId,
+                            path: remainingPath,
+                            headers: forwardedHeaders,
+                        });
+                        return undefined;
                     }
+                    self._pendingProxiedWs?.delete(wsConnectionId);
+                    self.pendingProxiedWSEvents.delete(wsConnectionId);
+                    return new Response("WebSocket upgrade failed", { status: 400 });
                 }
-                this.tunnels.clear();
-                this.tunnelRequestCount.clear();
-                for (const [requestId, pending] of this.pendingRequests.entries()) {
-                    if (pending.timeoutId)
-                        clearTimeout(pending.timeoutId);
-                    if (!pending.res.headersSent) {
-                        try {
-                            pending.res.status(503).json({ error: "Service Unavailable", message: "Server shutting down" });
+                // Regular HTTP request - pass to Hono
+                return self.app.fetch(req);
+            },
+            websocket: {
+                open(ws) {
+                    if (ws.data.isProxiedWebSocket && ws.data.proxiedWsId) {
+                        const pendingMap = self._pendingProxiedWs;
+                        const pending = pendingMap?.get(ws.data.proxiedWsId);
+                        if (pending) {
+                            self.wsConnections.set(ws.data.proxiedWsId, {
+                                clientSocket: ws,
+                                id: ws.data.proxiedWsId,
+                                path: pending.path,
+                                headers: pending.headers,
+                                tunnelId: pending.tunnelId,
+                            });
+                            pendingMap.delete(ws.data.proxiedWsId);
+                            self.flushPendingWebSocketEvents(ws.data.proxiedWsId);
                         }
-                        catch (_a) { }
                     }
-                    this.pendingRequests.delete(requestId);
+                    self.handleWsOpen(ws);
+                },
+                message(ws, message) {
+                    self.handleWsMessage(ws, message);
+                },
+                close(ws, code, reason) {
+                    self.handleWsClose(ws, code, reason);
+                },
+                pong(ws) {
+                    // Reset liveness tracking when pong received
+                    const resetFn = ws.data?._missedPongsReset;
+                    if (resetFn)
+                        resetFn();
+                },
+                perMessageDeflate: false,
+                maxPayloadLength: LIMITS.MAX_PAYLOAD_BYTES,
+                backpressureLimit: LIMITS.BACKPRESSURE_THRESHOLD,
+            },
+        });
+        console.log(`DainTunnel Server is running on ${this.hostname}:${this.port}`);
+    }
+    async stop() {
+        try {
+            for (const tunnel of this.tunnels.values()) {
+                if (tunnel.ws.data.keepAliveInterval)
+                    clearInterval(tunnel.ws.data.keepAliveInterval);
+                try {
+                    tunnel.ws.close(1001, "Server shutting down");
                 }
-                this.challenges.clear();
-                for (const [sseId, conn] of this.sseConnections.entries()) {
-                    if (conn.keepAliveInterval)
-                        clearInterval(conn.keepAliveInterval);
-                    try {
-                        conn.res.end();
-                    }
-                    catch (error) {
-                        console.error(`Error closing SSE ${sseId}:`, error);
-                    }
-                    this.sseConnections.delete(sseId);
+                catch (error) {
+                    console.error(`Error closing tunnel ${tunnel.id}:`, error);
                 }
-                for (const [wsId, conn] of this.wsConnections.entries()) {
-                    try {
-                        conn.clientSocket.close(1001, "Server shutting down");
-                    }
-                    catch (error) {
-                        console.error(`Error closing WS ${wsId}:`, error);
-                    }
-                    this.wsConnections.delete(wsId);
+            }
+            this.tunnels.clear();
+            this.tunnelRequestCount.clear();
+            for (const [requestId, pending] of this.pendingRequests.entries()) {
+                if (pending.timeoutId)
+                    clearTimeout(pending.timeoutId);
+                pending.resolve(new Response(JSON.stringify({
+                    error: "Service Unavailable",
+                    message: "Server shutting down",
+                }), {
+                    status: 503,
+                    headers: {
+                        "content-type": "application/json",
+                        ...this.buildCorsHeaders(pending.origin),
+                    },
+                }));
+                this.pendingRequests.delete(requestId);
+            }
+            this.challenges.clear();
+            for (const [sseId, conn] of this.sseConnections.entries()) {
+                if (conn.keepAliveInterval)
+                    clearInterval(conn.keepAliveInterval);
+                try {
+                    conn.controller.close();
                 }
-                for (const socket of this.wss.clients) {
-                    try {
-                        socket.terminate();
-                    }
-                    catch (_b) { }
+                catch (error) {
+                    console.error(`Error closing SSE ${sseId}:`, error);
                 }
-                this.wss.close(() => {
-                    var _a, _b, _c, _d;
-                    (_b = (_a = this.server).closeIdleConnections) === null || _b === void 0 ? void 0 : _b.call(_a);
-                    (_d = (_c = this.server).closeAllConnections) === null || _d === void 0 ? void 0 : _d.call(_c);
-                    this.server.close(() => resolve());
-                });
+                conn.closed = true;
+                this.sseConnections.delete(sseId);
             }
-            catch (error) {
-                console.error('Error during server shutdown:', error);
-                resolve();
+            for (const [wsId, conn] of this.wsConnections.entries()) {
+                try {
+                    conn.clientSocket.close(1001, "Server shutting down");
+                }
+                catch (error) {
+                    console.error(`Error closing WS ${wsId}:`, error);
+                }
+                this.wsConnections.delete(wsId);
             }
-        });
+            if (this.server) {
+                this.server.stop();
+                this.server = null;
+            }
+        }
+        catch (error) {
+            console.error('Error during server shutdown:', error);
+        }
     }
 }
-exports.default = DainTunnelServer;
+export default DainTunnelServer;