@decentnetwork/lan 0.1.138 → 0.1.140

package/dist/proxy/geo-cn.d.ts

@@ -0,0 +1,25 @@
+/** True if the IPv4 literal falls in a China-allocated block. */
+export declare function isChinaIpv4(ip: string): boolean;
+export interface GeoCnOptions {
+    /** Cache lifetime for a host verdict (default 10 min — DNS/GeoDNS shifts). */
+    ttlMs?: number;
+    /** Per-lookup DNS timeout (default 2s — never block a page on a slow resolve). */
+    dnsTimeoutMs?: number;
+    /** Max hosts cached (default 4000). */
+    maxHosts?: number;
+}
+/**
+ * Caching China-host classifier. `isChinaHost(host)` resolves the name once,
+ * caches the verdict, and answers instantly thereafter.
+ */
+export declare class GeoCnClassifier {
+    #private;
+    constructor(opts?: GeoCnOptions);
+    /** Synchronous verdict if the host is a literal IP or already cached; else
+     *  null (caller may fall back to direct and let `classify()` warm the cache
+     *  for next time). */
+    peek(host: string): boolean | null;
+    /** Resolve (if needed) and classify, caching the verdict. Never rejects —
+     *  a failed/timed-out resolve yields `false` (treat as non-China). */
+    classify(host: string): Promise<boolean>;
+}

package/dist/proxy/geo-cn.js

@@ -0,0 +1,144 @@
+//
+// China-IP geolocation — the "is this host in China?" oracle that lets the
+// router auto-classify hosts the domain table misses (e.g. CCTV content on
+// ldcctvwbcdbd.a.bdydns.com, a Baidu CDN hostname no suffix list anticipates).
+//
+// It resolves a hostname and tests the resolved IPv4 against the bundled APNIC
+// China allocation table (chnroutes-cn.ts). China-hosted CDNs (Baidu, Ali,
+// Tencent) have no foreign edge, so from abroad they resolve to a China IP and
+// this correctly routes them through a China exit — no hand-maintained domain
+// list required.
+//
+// Limit: GeoIP tells you where the resolved edge IS, not what the content is
+// authorized for. A global CDN (Akamai/Cloudflare) that geo-fences by policy
+// resolves to a LOCAL edge → looks non-China here. Those are caught by the
+// route learner's 403/RST signals instead. This is one heuristic layer, not a
+// silver bullet.
+//
+import dns from "node:dns";
+import net from "node:net";
+import { CN_IPV4_RANGES } from "./data/chnroutes-cn.js";
+const resolver = new dns.promises.Resolver();
+function ipv4ToInt(ip) {
+    const p = ip.split(".");
+    if (p.length !== 4)
+        return null;
+    let v = 0;
+    for (const oct of p) {
+        const n = Number(oct);
+        if (!Number.isInteger(n) || n < 0 || n > 255)
+            return null;
+        v = v * 256 + n;
+    }
+    return v >>> 0;
+}
+/** True if the IPv4 literal falls in a China-allocated block. */
+export function isChinaIpv4(ip) {
+    const v = ipv4ToInt(ip);
+    if (v === null)
+        return false;
+    // Binary search the flat [start,end,start,end,...] sorted interval array.
+    let lo = 0;
+    let hi = CN_IPV4_RANGES.length / 2 - 1;
+    while (lo <= hi) {
+        const mid = (lo + hi) >> 1;
+        const s = CN_IPV4_RANGES[mid * 2];
+        const e = CN_IPV4_RANGES[mid * 2 + 1];
+        if (v < s)
+            hi = mid - 1;
+        else if (v > e)
+            lo = mid + 1;
+        else
+            return true;
+    }
+    return false;
+}
+/**
+ * Caching China-host classifier. `isChinaHost(host)` resolves the name once,
+ * caches the verdict, and answers instantly thereafter.
+ */
+export class GeoCnClassifier {
+    #cache = new Map();
+    #inflight = new Map();
+    #ttlMs;
+    #dnsTimeoutMs;
+    #maxHosts;
+    constructor(opts = {}) {
+        this.#ttlMs = opts.ttlMs ?? 600_000;
+        this.#dnsTimeoutMs = opts.dnsTimeoutMs ?? 2000;
+        this.#maxHosts = opts.maxHosts ?? 4000;
+    }
+    /** Synchronous verdict if the host is a literal IP or already cached; else
+     *  null (caller may fall back to direct and let `classify()` warm the cache
+     *  for next time). */
+    peek(host) {
+        const h = host.toLowerCase();
+        if (net.isIPv4(h))
+            return isChinaIpv4(h);
+        if (net.isIPv6(h))
+            return false; // no v6 table yet — treat as non-CN
+        const e = this.#cache.get(h);
+        if (e && Date.now() - e.at <= this.#ttlMs)
+            return e.cn;
+        return null;
+    }
+    /** Resolve (if needed) and classify, caching the verdict. Never rejects —
+     *  a failed/timed-out resolve yields `false` (treat as non-China). */
+    async classify(host) {
+        const cached = this.peek(host);
+        if (cached !== null)
+            return cached;
+        const h = host.toLowerCase();
+        const inflight = this.#inflight.get(h);
+        if (inflight)
+            return inflight;
+        const p = this.#resolveAndClassify(h);
+        this.#inflight.set(h, p);
+        try {
+            return await p;
+        }
+        finally {
+            this.#inflight.delete(h);
+        }
+    }
+    async #resolveAndClassify(host) {
+        let cn = false;
+        try {
+            const addrs = await this.#resolve4(host);
+            // Any resolved address in China → treat the host as China. A China CDN
+            // returns only China IPs from abroad; a global CDN returns a local edge.
+            cn = addrs.some((a) => isChinaIpv4(a));
+        }
+        catch {
+            cn = false;
+        }
+        this.#insert(host, cn);
+        return cn;
+    }
+    #resolve4(host) {
+        return new Promise((resolvep, rejectp) => {
+            let settled = false;
+            const timer = setTimeout(() => { if (!settled) {
+                settled = true;
+                rejectp(new Error("dns timeout"));
+            } }, this.#dnsTimeoutMs);
+            resolver.resolve4(host).then((a) => { if (!settled) {
+                settled = true;
+                clearTimeout(timer);
+                resolvep(a);
+            } }, (e) => { if (!settled) {
+                settled = true;
+                clearTimeout(timer);
+                rejectp(e);
+            } });
+        });
+    }
+    #insert(host, cn) {
+        if (this.#cache.size >= this.#maxHosts) {
+            const oldest = this.#cache.keys().next().value;
+            if (oldest)
+                this.#cache.delete(oldest);
+        }
+        this.#cache.set(host, { cn, at: Date.now() });
+    }
+}

package/dist/proxy/hls-prefetch.d.ts

@@ -0,0 +1,67 @@
+export interface FetchedResponse {
+    status: number;
+    headers: Record<string, string | string[] | undefined>;
+    body: Buffer;
+}
+/** Fetch one absolute http:// URL through some exit; provided by the router.
+ *  `label` lets the router log the fetch (e.g. "prefetch"). */
+export type UrlFetcher = (url: URL, headers: Record<string, string>, label?: string) => Promise<FetchedResponse>;
+export declare function looksLikePlaylist(pathname: string): boolean;
+export declare function looksLikeSegment(pathname: string): boolean;
+export interface HlsVariant {
+    bandwidth: number;
+    resolution: string;
+    url: string;
+}
+/**
+ * Extract the variant streams from a MASTER playlist (#EXT-X-STREAM-INF), so we
+ * can see what resolutions a source offers and which one the player picks.
+ * Returns [] for a media playlist (no variants).
+ */
+export declare function parseM3u8Variants(playlist: string, baseUrl: string): HlsVariant[];
+/**
+ * Extract the media-segment URLs from an m3u8 playlist, resolved against the
+ * playlist's own URL. Returns [] for master playlists (variant lists) — those
+ * reference further playlists, not media.
+ */
+export declare function parseM3u8Segments(playlist: string, baseUrl: string): string[];
+interface CacheEntry {
+    body: Buffer;
+    contentType: string | undefined;
+    at: number;
+}
+export interface HlsPrefetcherOptions {
+    /** Cache budget in bytes (default 128 MB). */
+    maxBytes?: number;
+    /** Entry lifetime (default 120 s — live segments rotate fast). */
+    ttlMs?: number;
+    /** How many upcoming segments to keep fetched ahead (default 4). */
+    prefetchAhead?: number;
+    /** Max concurrent prefetch downloads (default 4). */
+    concurrency?: number;
+    /** Skip caching bodies larger than this (default 32 MB). */
+    maxEntryBytes?: number;
+}
+export declare class HlsPrefetcher {
+    #private;
+    constructor(fetcher: UrlFetcher, opts?: HlsPrefetcherOptions);
+    get stats(): {
+        hits: number;
+        misses: number;
+        entries: number;
+        bytes: number;
+    };
+    /** Insert a fetched body into the cache (for a cold segment miss the router
+     *  fetched directly, so a re-request is served from memory). */
+    put(url: string, body: Buffer, contentType: string | undefined): void;
+    /** Cached entry for a URL, or null. Counts hit/miss for the stats line. */
+    lookup(url: string): CacheEntry | null;
+    /** If the URL is currently being prefetched, the promise resolving when it
+     *  lands — lets a player request "join" an in-flight prefetch instead of
+     *  double-downloading. */
+    pending(url: string): Promise<CacheEntry | null> | null;
+    /** Called with every playlist body that passes through the router: parse it
+     *  and top up the prefetch pipeline for its upcoming segments. */
+    onPlaylist(playlistUrl: string, body: string): void;
+}
+export {};

package/dist/proxy/hls-prefetch.js

@@ -0,0 +1,195 @@
+//
+// HLS-aware segment prefetcher for the multi-exit router.
+//
+// Problem: an HLS player downloads media segments SEQUENTIALLY — one segment,
+// then the next. So no matter how many exits a region has, a single stream
+// only ever rides ONE exit's bandwidth at a time, and the aggregate capacity
+// of the pool (observed ~7 Mbps across five 0.4–2.5 Mbps exits) goes unused.
+//
+// Fix: when a plain-HTTP .m3u8 playlist passes through the router, parse the
+// segment URLs it lists and prefetch the upcoming segments IN PARALLEL, each
+// through a different exit, into a small in-memory cache. When the player asks
+// for a segment we already hold, answer from cache instantly. The player's
+// ABR sees the pool's aggregate bandwidth instead of one exit's.
+//
+// Scope: transparent for http:// streams only (an https:// stream is an opaque
+// CONNECT tunnel — the router never sees its URLs). Media playlists only; a
+// master playlist (#EXT-X-STREAM-INF) lists variants, not segments.
+//
+const SEGMENT_EXTS = [".ts", ".m4s", ".m4a", ".m4v", ".aac", ".mp3", ".mp4", ".vtt"];
+export function looksLikePlaylist(pathname) {
+    const p = pathname.toLowerCase();
+    return p.endsWith(".m3u8") || p.endsWith(".m3u");
+}
+export function looksLikeSegment(pathname) {
+    const p = pathname.toLowerCase();
+    return SEGMENT_EXTS.some((e) => p.endsWith(e));
+}
+/**
+ * Extract the variant streams from a MASTER playlist (#EXT-X-STREAM-INF), so we
+ * can see what resolutions a source offers and which one the player picks.
+ * Returns [] for a media playlist (no variants).
+ */
+export function parseM3u8Variants(playlist, baseUrl) {
+    if (!playlist.includes("#EXT-X-STREAM-INF"))
+        return [];
+    const out = [];
+    const lines = playlist.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i].trim();
+        if (!line.startsWith("#EXT-X-STREAM-INF"))
+            continue;
+        const bw = /BANDWIDTH=(\d+)/.exec(line);
+        const res = /RESOLUTION=([0-9x]+)/.exec(line);
+        // The URL is the next non-comment line.
+        let url = "";
+        for (let j = i + 1; j < lines.length; j++) {
+            const l = lines[j].trim();
+            if (l.length === 0 || l.startsWith("#"))
+                continue;
+            try {
+                url = new URL(l, baseUrl).toString();
+            }
+            catch {
+                url = l;
+            }
+            break;
+        }
+        out.push({ bandwidth: bw ? Number(bw[1]) : 0, resolution: res ? res[1] : "", url });
+    }
+    return out;
+}
+/**
+ * Extract the media-segment URLs from an m3u8 playlist, resolved against the
+ * playlist's own URL. Returns [] for master playlists (variant lists) — those
+ * reference further playlists, not media.
+ */
+export function parseM3u8Segments(playlist, baseUrl) {
+    if (playlist.includes("#EXT-X-STREAM-INF"))
+        return [];
+    const out = [];
+    for (const raw of playlist.split(/\r?\n/)) {
+        const line = raw.trim();
+        if (line.length === 0 || line.startsWith("#"))
+            continue;
+        try {
+            out.push(new URL(line, baseUrl).toString());
+        }
+        catch {
+            /* malformed line — skip */
+        }
+    }
+    return out;
+}
+export class HlsPrefetcher {
+    #cache = new Map(); // Map preserves insertion order → LRU-ish
+    #cacheBytes = 0;
+    #inflight = new Map();
+    #fetcher;
+    #maxBytes;
+    #ttlMs;
+    #ahead;
+    #concurrency;
+    #maxEntryBytes;
+    #hits = 0;
+    #misses = 0;
+    constructor(fetcher, opts = {}) {
+        this.#fetcher = fetcher;
+        this.#maxBytes = opts.maxBytes ?? 128 * 1024 * 1024;
+        this.#ttlMs = opts.ttlMs ?? 120_000;
+        this.#ahead = opts.prefetchAhead ?? 4;
+        this.#concurrency = opts.concurrency ?? 4;
+        this.#maxEntryBytes = opts.maxEntryBytes ?? 32 * 1024 * 1024;
+    }
+    get stats() {
+        return { hits: this.#hits, misses: this.#misses, entries: this.#cache.size, bytes: this.#cacheBytes };
+    }
+    /** Insert a fetched body into the cache (for a cold segment miss the router
+     *  fetched directly, so a re-request is served from memory). */
+    put(url, body, contentType) {
+        if (body.length === 0 || body.length > this.#maxEntryBytes)
+            return;
+        this.#insert(url, { body, contentType, at: Date.now() });
+    }
+    /** Cached entry for a URL, or null. Counts hit/miss for the stats line. */
+    lookup(url) {
+        const e = this.#peek(url);
+        if (e)
+            this.#hits++;
+        else
+            this.#misses++;
+        return e;
+    }
+    /** If the URL is currently being prefetched, the promise resolving when it
+     *  lands — lets a player request "join" an in-flight prefetch instead of
+     *  double-downloading. */
+    pending(url) {
+        return this.#inflight.get(url) ?? null;
+    }
+    #peek(url) {
+        const e = this.#cache.get(url);
+        if (!e)
+            return null;
+        if (Date.now() - e.at > this.#ttlMs) {
+            this.#cache.delete(url);
+            this.#cacheBytes -= e.body.length;
+            return null;
+        }
+        return e;
+    }
+    /** Called with every playlist body that passes through the router: parse it
+     *  and top up the prefetch pipeline for its upcoming segments. */
+    onPlaylist(playlistUrl, body) {
+        const segs = parseM3u8Segments(body, playlistUrl);
+        if (segs.length === 0)
+            return;
+        // For a live playlist the tail is "upcoming"; for VOD the player walks the
+        // list from wherever it is, and refetches of the playlist don't happen —
+        // prefetching the head of the list still fills the startup buffer. Either
+        // way: take the last `ahead` entries we don't already hold.
+        const want = segs.slice(-this.#ahead).filter((u) => !this.#peek(u) && !this.#inflight.has(u));
+        for (const u of want) {
+            if (this.#inflight.size >= this.#concurrency)
+                break;
+            this.#prefetch(u);
+        }
+    }
+    #prefetch(url) {
+        const p = (async () => {
+            try {
+                const u = new URL(url);
+                const res = await this.#fetcher(u, { host: u.host }, "prefetch");
+                if (res.status !== 200 || res.body.length === 0 || res.body.length > this.#maxEntryBytes)
+                    return null;
+                const ct = res.headers["content-type"];
+                const entry = {
+                    body: res.body,
+                    contentType: Array.isArray(ct) ? ct[0] : ct,
+                    at: Date.now(),
+                };
+                this.#insert(url, entry);
+                return entry;
+            }
+            catch {
+                return null;
+            }
+            finally {
+                this.#inflight.delete(url);
+            }
+        })();
+        this.#inflight.set(url, p);
+    }
+    #insert(url, entry) {
+        const old = this.#cache.get(url);
+        if (old)
+            this.#cacheBytes -= old.body.length;
+        this.#cache.set(url, entry);
+        this.#cacheBytes += entry.body.length;
+        while (this.#cacheBytes > this.#maxBytes && this.#cache.size > 0) {
+            const oldest = this.#cache.keys().next().value;
+            const e = this.#cache.get(oldest);
+            this.#cache.delete(oldest);
+            this.#cacheBytes -= e.body.length;
+        }
+    }
+}

package/dist/proxy/mitm-ca.d.ts

@@ -0,0 +1,27 @@
+export interface CaFiles {
+    certPem: string;
+    keyPem: string;
+}
+/** Load the root CA from configDir, generating and persisting it on first use. */
+export declare function loadOrCreateCa(configDir: string): {
+    ca: CaFiles;
+    caCertPath: string;
+    created: boolean;
+};
+interface LeafEntry {
+    key: string;
+    cert: string;
+}
+/**
+ * Mints and caches leaf certificates for MITM'd hosts, each signed by the
+ * loaded root CA. One RSA keypair is reused across leaves (fine for a local
+ * MITM — the trust boundary is the CA, and generating a keypair per host is
+ * needlessly slow).
+ */
+export declare class LeafCertFactory {
+    #private;
+    constructor(ca: CaFiles);
+    /** { key, cert } PEM pair for a host, minted on first use and cached. */
+    for(host: string): LeafEntry;
+}
+export {};

package/dist/proxy/mitm-ca.js

@@ -0,0 +1,120 @@
+//
+// MITM certificate authority for the HLS aggregation gateway.
+//
+// To aggregate an HTTPS video stream across several exits we must SEE the
+// playlist and segment URLs — which are encrypted inside the browser↔CDN TLS
+// session. So for the (few, explicitly China-video) hosts we choose to
+// accelerate, the router terminates TLS locally with a leaf certificate signed
+// by a root CA the user has trusted once, reads the plaintext HTTP, and
+// prefetches segments across the exit pool.
+//
+// Scope guard: this is used ONLY for hosts the router decides to MITM (China
+// video CDNs). Every other HTTPS host stays an opaque CONNECT tunnel the router
+// never decrypts. The CA private key lives in the user's own config dir.
+//
+// The root CA is generated once and persisted; leaf certs are generated per
+// SNI host on demand and cached in memory.
+//
+import forge from "node-forge";
+import fs from "node:fs";
+import { resolve } from "node:path";
+const CA_CERT_FILE = "mitm-ca-cert.pem";
+const CA_KEY_FILE = "mitm-ca-key.pem";
+/** Load the root CA from configDir, generating and persisting it on first use. */
+export function loadOrCreateCa(configDir) {
+    const caCertPath = resolve(configDir, CA_CERT_FILE);
+    const caKeyPath = resolve(configDir, CA_KEY_FILE);
+    if (fs.existsSync(caCertPath) && fs.existsSync(caKeyPath)) {
+        return {
+            ca: { certPem: fs.readFileSync(caCertPath, "utf8"), keyPem: fs.readFileSync(caKeyPath, "utf8") },
+            caCertPath,
+            created: false,
+        };
+    }
+    const ca = generateCa();
+    fs.writeFileSync(caCertPath, ca.certPem, { mode: 0o644 });
+    fs.writeFileSync(caKeyPath, ca.keyPem, { mode: 0o600 });
+    return { ca, caCertPath, created: true };
+}
+function generateCa() {
+    const keys = forge.pki.rsa.generateKeyPair(2048);
+    const cert = forge.pki.createCertificate();
+    cert.publicKey = keys.publicKey;
+    cert.serialNumber = randomSerial();
+    cert.validity.notBefore = new Date();
+    // 10-year CA. notBefore backdated a day to tolerate clock skew.
+    cert.validity.notBefore.setDate(cert.validity.notBefore.getDate() - 1);
+    cert.validity.notAfter = new Date();
+    cert.validity.notAfter.setFullYear(cert.validity.notAfter.getFullYear() + 10);
+    const attrs = [
+        { name: "commonName", value: "AgentNet Local HLS CA" },
+        { name: "organizationName", value: "Decent AgentNet" },
+        { shortName: "OU", value: "Local MITM (video acceleration)" },
+    ];
+    cert.setSubject(attrs);
+    cert.setIssuer(attrs);
+    cert.setExtensions([
+        { name: "basicConstraints", cA: true, critical: true },
+        { name: "keyUsage", keyCertSign: true, cRLSign: true, critical: true },
+        { name: "subjectKeyIdentifier" },
+    ]);
+    cert.sign(keys.privateKey, forge.md.sha256.create());
+    return {
+        certPem: forge.pki.certificateToPem(cert),
+        keyPem: forge.pki.privateKeyToPem(keys.privateKey),
+    };
+}
+/**
+ * Mints and caches leaf certificates for MITM'd hosts, each signed by the
+ * loaded root CA. One RSA keypair is reused across leaves (fine for a local
+ * MITM — the trust boundary is the CA, and generating a keypair per host is
+ * needlessly slow).
+ */
+export class LeafCertFactory {
+    #caCert;
+    #caKey;
+    #leafKeys;
+    #leafKeyPem;
+    #cache = new Map();
+    constructor(ca) {
+        this.#caCert = forge.pki.certificateFromPem(ca.certPem);
+        this.#caKey = forge.pki.privateKeyFromPem(ca.keyPem);
+        this.#leafKeys = forge.pki.rsa.generateKeyPair(2048);
+        this.#leafKeyPem = forge.pki.privateKeyToPem(this.#leafKeys.privateKey);
+    }
+    /** { key, cert } PEM pair for a host, minted on first use and cached. */
+    for(host) {
+        const cached = this.#cache.get(host);
+        if (cached)
+            return cached;
+        const cert = forge.pki.createCertificate();
+        cert.publicKey = this.#leafKeys.publicKey;
+        cert.serialNumber = randomSerial();
+        cert.validity.notBefore = new Date();
+        cert.validity.notBefore.setDate(cert.validity.notBefore.getDate() - 1);
+        cert.validity.notAfter = new Date();
+        cert.validity.notAfter.setFullYear(cert.validity.notAfter.getFullYear() + 2);
+        cert.setSubject([{ name: "commonName", value: host }]);
+        cert.setIssuer(this.#caCert.subject.attributes);
+        const isIp = /^\d{1,3}(\.\d{1,3}){3}$/.test(host);
+        cert.setExtensions([
+            { name: "basicConstraints", cA: false },
+            { name: "keyUsage", digitalSignature: true, keyEncipherment: true },
+            { name: "extKeyUsage", serverAuth: true },
+            { name: "subjectAltName", altNames: [isIp ? { type: 7, ip: host } : { type: 2, value: host }] },
+        ]);
+        cert.sign(this.#caKey, forge.md.sha256.create());
+        const entry = { key: this.#leafKeyPem, cert: forge.pki.certificateToPem(cert) };
+        this.#cache.set(host, entry);
+        return entry;
+    }
+}
+function randomSerial() {
+    // Positive hex serial. forge wants a hex string; ensure the high bit is clear
+    // so it isn't read as negative.
+    const bytes = forge.random.getBytesSync(16);
+    let hex = forge.util.bytesToHex(bytes);
+    // Force the first nibble low so the integer is positive.
+    hex = "0" + hex.slice(1);
+    return hex;
+}

package/dist/proxy/mitm-gateway.d.ts

@@ -0,0 +1,22 @@
+import http from "node:http";
+import net from "node:net";
+export interface MitmGatewayOptions {
+    configDir: string;
+    /** Handles a decrypted request. `host`/`port` identify the real origin so the
+     *  handler can build the absolute https URL and fetch it via the exit pool. */
+    onRequest: (req: http.IncomingMessage, res: http.ServerResponse, host: string, port: number) => void;
+    log: (msg: string) => void;
+}
+export declare class MitmGateway {
+    #private;
+    readonly caCertPath: string;
+    readonly caCreated: boolean;
+    constructor(opts: MitmGatewayOptions);
+    get caCertPem(): string;
+    /**
+     * MITM a CONNECT to `host:port`: acknowledge the tunnel, complete a TLS
+     * handshake against the browser using a leaf cert for `host`, then feed the
+     * decrypted socket into the internal HTTP server.
+     */
+    handleConnect(host: string, port: number, client: net.Socket, head: Buffer): void;
+}

package/dist/proxy/mitm-gateway.js

@@ -0,0 +1,76 @@
+//
+// HLS aggregation gateway — selective HTTPS MITM for video acceleration.
+//
+// For the (few, explicitly China-video) hosts the router chooses to accelerate,
+// we terminate the browser↔CDN TLS locally so we can read the .m3u8 and segment
+// URLs, then prefetch segments in PARALLEL across the whole exit pool. That
+// turns a set of small, unstable friend-run exits into one smooth aggregate
+// pipe — the point is not raw bandwidth but hiding any single exit's stalls
+// behind a prefetch buffer fed from several exits at once.
+//
+// Every other HTTPS host stays an opaque CONNECT tunnel the router never
+// decrypts (see the router's shouldMitm gate). The CA is the user's own, in
+// their config dir, trusted once.
+//
+import http from "node:http";
+import tls from "node:tls";
+import { loadOrCreateCa, LeafCertFactory } from "./mitm-ca.js";
+export class MitmGateway {
+    #leaf;
+    #server;
+    caCertPath;
+    caCreated;
+    #ca;
+    constructor(opts) {
+        const { ca, caCertPath, created } = loadOrCreateCa(opts.configDir);
+        this.#ca = ca;
+        this.caCertPath = caCertPath;
+        this.caCreated = created;
+        this.#leaf = new LeafCertFactory(ca);
+        // Internal HTTP server: it never listens on a socket. We hand it decrypted
+        // TLS sockets via emit('connection'), and it parses HTTP requests off them
+        // and calls our handler — reusing Node's battle-tested HTTP parser instead
+        // of hand-rolling one over the TLS stream.
+        this.#server = new http.Server((req, res) => {
+            // The Host header carries the real origin; the socket remembers the port.
+            const sock = req.socket;
+            const host = (sock._mitmHost || (req.headers.host || "").split(":")[0] || "").toLowerCase();
+            const port = sock._mitmPort || 443;
+            opts.onRequest(req, res, host, port);
+        });
+        this.#server.on("clientError", (_e, socket) => { try {
+            socket.destroy();
+        }
+        catch { /* ignore */ } });
+    }
+    get caCertPem() { return this.#ca.certPem; }
+    /**
+     * MITM a CONNECT to `host:port`: acknowledge the tunnel, complete a TLS
+     * handshake against the browser using a leaf cert for `host`, then feed the
+     * decrypted socket into the internal HTTP server.
+     */
+    handleConnect(host, port, client, head) {
+        const leaf = this.#leaf.for(host);
+        client.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+        // Any bytes already read past the CONNECT request are the start of the
+        // browser's TLS ClientHello — put them back on the RAW socket so the TLS
+        // layer (which reads ciphertext from `client`) sees them.
+        if (head && head.length)
+            client.unshift(head);
+        const tlsSock = new tls.TLSSocket(client, {
+            isServer: true,
+            key: leaf.key,
+            cert: leaf.cert,
+            // Speak HTTP/1.1 only — our internal server is HTTP/1.1 and h2 over this
+            // path would need a different parser.
+            ALPNProtocols: ["http/1.1"],
+        });
+        tlsSock._mitmHost = host;
+        tlsSock._mitmPort = port;
+        tlsSock.on("error", () => { try {
+            tlsSock.destroy();
+        }
+        catch { /* ignore */ } });
+        this.#server.emit("connection", tlsSock);
+    }
+}