@dylanpiercey/work 0.1.1 → 0.2.1

package/dist/rtc-helper.mjs

@@ -0,0 +1,1170 @@
+import { syncBuiltinESMExports } from "node:module";
+import childProcess from "node:child_process";
+import net from "node:net";
+import zlib from "node:zlib";
+import dgram from "node:dgram";
+import fs from "node:fs";
+//#region src/server/rtc/upnp.ts
+/**
+* A UPnP IGD client, just enough to open one UDP port on the LAN's router
+* for direct connections (server/rtc): find the gateway (an SSDP
+* M-SEARCH), read its description for the WAN connection service, then
+* SOAP `GetExternalIPAddress`, `AddPortMapping` and `DeletePortMapping`. A
+* phone behind carrier NAT cannot punch through to this machine by itself;
+* with the router forwarding the port, its checks arrive as they would on
+* the LAN.
+*
+* Only on demand: the user allowed it (Settings), and a page that could
+* use it failed to connect without it (server/rtc). The mapping is leased
+* (LEASE_S) and renewed while a peer uses it, given back once none has for
+* IDLE_MS, and deleted when the permission goes or the helper this runs in
+* exits (helper.ts); the lease is what closes it if the helper dies
+* without deleting it.
+*
+* Whatever answers on the LAN is untrusted: only a default gateway is
+* listened to, only its own address is fetched from and posted to, and
+* nothing it sends is read past a small size.
+*/
+/** A fixed SSDP target (`WORK_UPNP_SSDP`, host:port) instead of the group
+* and the default gateways: a fake gateway to test against, which is then
+* the one gateway trusted. */
+var OVERRIDE = hostPort(process.env.WORK_UPNP_SSDP);
+var GROUP = "239.255.255.250";
+var SSDP_PORT = OVERRIDE?.port ?? 1900;
+var SEARCH = [
+	"urn:schemas-upnp-org:device:InternetGatewayDevice:1",
+	"urn:schemas-upnp-org:device:InternetGatewayDevice:2",
+	"urn:schemas-upnp-org:service:WANIPConnection:1",
+	"urn:schemas-upnp-org:service:WANIPConnection:2",
+	"urn:schemas-upnp-org:service:WANPPPConnection:1"
+];
+/** The services that map ports, best first. */
+var SERVICES = [
+	"urn:schemas-upnp-org:service:WANIPConnection:2",
+	"urn:schemas-upnp-org:service:WANIPConnection:1",
+	"urn:schemas-upnp-org:service:WANPPPConnection:1"
+];
+/** An hour: long enough that renewing costs nothing, short enough that a
+* machine that vanished without deleting it does not leave the port open
+* for good. `WORK_UPNP_LEASE` (seconds) shortens it, and the idle release
+* with it, to watch them in a test. */
+var LEASE_S = Number(process.env.WORK_UPNP_LEASE) || 3600;
+/** Unused this long, the mapping is given back: a page that walks away
+* does not leave the router's port open. */
+var IDLE_MS = Math.min(12e4, LEASE_S * 1e3 / 4);
+var CHECK_MS = Math.max(500, IDLE_MS / 4);
+/** Every network step's limit: a LAN gateway answers in milliseconds. */
+var TIMEOUT_MS = 3e3;
+/** The most read of what a device on the LAN sends. */
+var MAX_SSDP = 2048;
+var MAX_XML = 65536;
+var MAX_SOAP = 16384;
+/** How long a found gateway is used before looking again. */
+var GATEWAY_TTL_MS = 6e5;
+var DESCRIPTION = "work direct connections";
+var UpnpError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.code = code;
+	}
+};
+var status = { state: "off" };
+var mapping = null;
+var gateway = null;
+var busy = null;
+var renewTimer;
+var useTimer;
+var lastUse = 0;
+var inUse = () => false;
+var listeners = /* @__PURE__ */ new Set();
+function upnpStatus() {
+	return status;
+}
+function onUpnpStatus(fn) {
+	listeners.add(fn);
+	return () => listeners.delete(fn);
+}
+function setStatus(next) {
+	status = next;
+	for (const fn of listeners) fn(next);
+}
+/** The router's address and the port it forwards to this machine's
+* `port`, when mapped. */
+function upnpCandidate() {
+	return mapping && status.state === "mapped" ? {
+		ip: mapping.externalIp,
+		port: mapping.externalPort
+	} : null;
+}
+/** Map UDP `port` on the router, or keep the mapping there is. `used`
+* says, as it is checked, whether a peer still uses it. Settles when the
+* mapping is made or has failed; the status says which. */
+function upnpWant(port, used) {
+	lastUse = Date.now();
+	inUse = used;
+	if (busy) return busy;
+	if (mapping && mapping.internalPort === port && status.state === "mapped") return Promise.resolve();
+	busy = (async () => {
+		if (mapping) await unmap();
+		await map(port);
+	})().finally(() => {
+		busy = null;
+	});
+	return busy;
+}
+/** Delete the mapping, if there is one (the permission went, it is no
+* longer used, or the server is stopping). */
+async function upnpRelease() {
+	clearTimeout(renewTimer);
+	clearInterval(useTimer);
+	useTimer = void 0;
+	inUse = () => false;
+	await busy?.catch(() => {});
+	await unmap();
+	if (status.state !== "off") setStatus({ state: "off" });
+}
+async function map(port) {
+	setStatus({ state: "mapping" });
+	try {
+		const gw = await findGateway();
+		const lanIp = await localAddressFor(gw.host);
+		const externalIp = tag(await soap(gw, "GetExternalIPAddress", []), "NewExternalIPAddress");
+		if (!net.isIPv4(externalIp)) throw new Error(`the router gave no WAN address (${externalIp || "none"})`);
+		const ports = [port, ...[
+			1,
+			2,
+			3
+		].map(() => 49152 + randomInt(16e3))];
+		let lease = LEASE_S;
+		let made = null;
+		let last;
+		for (const external of ports) try {
+			await addMapping(gw, external, port, lanIp, lease);
+			made = external;
+			break;
+		} catch (err) {
+			last = err;
+			if (err instanceof UpnpError && err.code === 725 && lease) {
+				lease = 0;
+				try {
+					await addMapping(gw, external, port, lanIp, lease);
+					made = external;
+					break;
+				} catch (again) {
+					last = again;
+				}
+			}
+			if (!(last instanceof UpnpError) || ![718, 729].includes(last.code)) break;
+		}
+		if (made === null) throw last;
+		mapping = {
+			gateway: gw,
+			externalIp,
+			externalPort: made,
+			internalPort: port,
+			lanIp,
+			lease
+		};
+		setStatus({
+			state: "mapped",
+			external: `${externalIp}:${made}`,
+			internal: `${lanIp}:${port}`,
+			expires: lease ? Date.now() + lease * 1e3 : 0,
+			note: privateV4(externalIp) ? `the router's own WAN address ${externalIp} is private: another NAT is in front of it, so this opens nothing to the internet` : void 0
+		});
+		scheduleRenew();
+		watchUse();
+	} catch (err) {
+		gateway = null;
+		setStatus({
+			state: "error",
+			error: describe(err)
+		});
+	}
+}
+/** Given back once no peer has used it for IDLE_MS. */
+function watchUse() {
+	clearInterval(useTimer);
+	useTimer = setInterval(() => {
+		if (inUse()) lastUse = Date.now();
+		else if (Date.now() - lastUse > IDLE_MS) upnpRelease();
+	}, CHECK_MS);
+	useTimer.unref?.();
+}
+function scheduleRenew() {
+	clearTimeout(renewTimer);
+	if (!mapping?.lease) return;
+	renewTimer = setTimeout(renew, LEASE_S * 1e3 / 2);
+	renewTimer.unref?.();
+}
+async function renew() {
+	const m = mapping;
+	if (!m) return;
+	try {
+		await addMapping(m.gateway, m.externalPort, m.internalPort, m.lanIp, m.lease);
+		setStatus({
+			...status,
+			expires: Date.now() + m.lease * 1e3
+		});
+		scheduleRenew();
+	} catch (err) {
+		mapping = null;
+		gateway = null;
+		setStatus({
+			state: "error",
+			error: `renewing: ${describe(err)}`
+		});
+		upnpWant(m.internalPort, inUse);
+	}
+}
+async function unmap() {
+	const m = mapping;
+	mapping = null;
+	if (!m) return;
+	await soap(m.gateway, "DeletePortMapping", [
+		["NewRemoteHost", ""],
+		["NewExternalPort", m.externalPort],
+		["NewProtocol", "UDP"]
+	]).catch(() => {});
+}
+function addMapping(gw, external, internal, lanIp, lease) {
+	return soap(gw, "AddPortMapping", [
+		["NewRemoteHost", ""],
+		["NewExternalPort", external],
+		["NewProtocol", "UDP"],
+		["NewInternalPort", internal],
+		["NewInternalClient", lanIp],
+		["NewEnabled", 1],
+		["NewPortMappingDescription", DESCRIPTION],
+		["NewLeaseDuration", lease]
+	]);
+}
+async function soap(gw, action, args) {
+	const fields = args.map(([name, value]) => `<${name}>${escapeXml(String(value))}</${name}>`).join("");
+	const body = `<?xml version="1.0"?>\r
+<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:${action} xmlns:u="${gw.service}">${fields}</u:${action}></s:Body></s:Envelope>`;
+	const res = await fetch(gw.control, {
+		method: "POST",
+		headers: {
+			"content-type": "text/xml; charset=\"utf-8\"",
+			soapaction: `"${gw.service}#${action}"`
+		},
+		body,
+		redirect: "error",
+		signal: AbortSignal.timeout(TIMEOUT_MS)
+	});
+	const text = await readCapped(res, MAX_SOAP);
+	if (!res.ok) {
+		const code = Number(tag(text, "errorCode")) || 0;
+		const what = tag(text, "errorDescription") || `HTTP ${res.status}`;
+		throw new UpnpError(code, `${action}: ${code ? `${code} ` : ""}${what}`);
+	}
+	return text;
+}
+async function findGateway() {
+	if (gateway && Date.now() - gateway.found < GATEWAY_TTL_MS) return gateway;
+	const gateways = OVERRIDE ? [OVERRIDE.host] : await defaultGateways();
+	if (!gateways.length) throw new Error("this machine has no default gateway");
+	const answers = await search(gateways);
+	let last = /* @__PURE__ */ new Error("no UPnP gateway answered on the LAN");
+	for (const { location, from } of answers) try {
+		gateway = await describeGateway(location, from);
+		return gateway;
+	} catch (err) {
+		last = err;
+	}
+	throw last;
+}
+/** The device descriptions the gateways point at, from answers to a search
+* sent to the SSDP group and to each gateway directly — a host firewall
+* (firewalld's default zones) drops a gateway's unicast answer to a
+* multicast search, matching no flow this machine opened, where the answer
+* to a query sent to it comes back on one. Only an answer from a gateway's
+* own address, naming that address, is kept: anything else on the LAN can
+* answer a search. The first answer ends the wait a moment later. */
+function search(gateways) {
+	return new Promise((resolve) => {
+		const found = /* @__PURE__ */ new Map();
+		const sock = dgram.createSocket({
+			type: "udp4",
+			reuseAddr: true
+		});
+		let timer;
+		const finish = () => {
+			clearTimeout(timer);
+			try {
+				sock.close();
+			} catch {}
+			resolve([...found].map(([location, from]) => ({
+				location,
+				from
+			})));
+		};
+		timer = setTimeout(finish, TIMEOUT_MS);
+		sock.on("error", finish);
+		sock.on("message", (msg, rinfo) => {
+			if (msg.length > MAX_SSDP || !gateways.includes(rinfo.address)) return;
+			const location = /^location:\s*(\S+)/im.exec(msg.toString())?.[1];
+			if (!location || !trustedUrl(location, rinfo.address)) return;
+			if (!found.size) {
+				clearTimeout(timer);
+				timer = setTimeout(finish, 300);
+			}
+			found.set(location, rinfo.address);
+		});
+		sock.bind(0, () => {
+			const targets = OVERRIDE ? [OVERRIDE.host] : [GROUP, ...gateways];
+			try {
+				if (!OVERRIDE) sock.setMulticastTTL(2);
+			} catch {}
+			for (const host of targets) for (const st of SEARCH) {
+				const req = `M-SEARCH * HTTP/1.1\r\nHOST: ${host}:${SSDP_PORT}\r\nMAN: "ssdp:discover"\r\nMX: 2\r\nST: ${st}\r\n\r\n`;
+				sock.send(req, SSDP_PORT, host);
+			}
+		});
+	});
+}
+/** Where the default gateways come from when /proc/net/route does not
+* say (macOS, whose `route` has to be run): this module runs in direct
+* connections' helper, which never starts a process (helper.ts), so the
+* server runs it and answers. */
+var gatewayLookup = async () => [];
+function setGatewayLookup(fn) {
+	gatewayLookup = fn;
+}
+/** The IPv4 default gateways on the LAN: Linux's routing table, else what
+* the server's `route` says. */
+async function defaultGateways() {
+	const lan = (ips) => ips.filter((ip) => privateV4(ip));
+	try {
+		return lan(fs.readFileSync("/proc/net/route", "utf8").split("\n").slice(1).map((line) => line.trim().split(/\s+/)).filter((f) => f[1] === "00000000" && /^[0-9A-F]{8}$/i.test(f[2] ?? "")).map((f) => [
+			3,
+			2,
+			1,
+			0
+		].map((i) => parseInt(f[2].slice(i * 2, i * 2 + 2), 16)).join(".")));
+	} catch {}
+	return lan((await gatewayLookup().catch(() => [])).filter(net.isIPv4));
+}
+/** Whether `url` is one to fetch from the gateway at `host`: http(s), at
+* that very address, which is a LAN one. */
+function trustedUrl(url, host) {
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		return false;
+	}
+	return (parsed.protocol === "http:" || parsed.protocol === "https:") && parsed.hostname === host && lanAddress(host);
+}
+function lanAddress(host) {
+	if (!net.isIPv4(host)) return false;
+	if (OVERRIDE && host === OVERRIDE.host && /^127\./.test(host)) return true;
+	return privateV4(host);
+}
+/** The gateway's WAN connection service, from its description at
+* `location`. Its control URL is taken relative to that address and must
+* stay on it: a description's `URLBase` or an absolute control URL could
+* send the requests anywhere. */
+async function describeGateway(location, host) {
+	const res = await fetch(location, {
+		redirect: "error",
+		signal: AbortSignal.timeout(TIMEOUT_MS)
+	});
+	const xml = await readCapped(res, MAX_XML);
+	if (!res.ok) throw new Error(`${location}: HTTP ${res.status}`);
+	const services = [...xml.matchAll(/<service>([\s\S]*?)<\/service>/gi)].map((m) => ({
+		type: tag(m[1], "serviceType"),
+		control: tag(m[1], "controlURL")
+	}));
+	for (const type of SERVICES) {
+		const s = services.find((x) => x.type === type && x.control);
+		if (!s) continue;
+		let control;
+		try {
+			control = new URL(s.control, location).toString();
+		} catch {
+			continue;
+		}
+		if (!trustedUrl(control, host)) throw new Error(`${host}'s description points its control elsewhere (${control})`);
+		return {
+			control,
+			service: type,
+			host,
+			found: Date.now()
+		};
+	}
+	throw new Error(`${location} offers no WAN connection service`);
+}
+/** A response's text, refused past `max` bytes. */
+async function readCapped(res, max) {
+	const reader = res.body?.getReader();
+	if (!reader) return "";
+	const chunks = [];
+	let size = 0;
+	for (;;) {
+		const { done, value } = await reader.read();
+		if (done) break;
+		size += value.length;
+		if (size > max) {
+			await reader.cancel().catch(() => {});
+			throw new Error(`the gateway's answer is over ${max} bytes`);
+		}
+		chunks.push(value);
+	}
+	return Buffer.concat(chunks).toString("utf8");
+}
+/** This machine's address on the way to `host`: the one the router
+* forwards to. A connected UDP socket sends nothing. */
+function localAddressFor(host) {
+	return new Promise((resolve, reject) => {
+		const sock = dgram.createSocket("udp4");
+		sock.on("error", (err) => {
+			sock.close();
+			reject(err);
+		});
+		sock.connect(9, host, () => {
+			try {
+				resolve(sock.address().address);
+			} catch (err) {
+				reject(err);
+			} finally {
+				sock.close();
+			}
+		});
+	});
+}
+function tag(xml, name) {
+	const m = new RegExp(`<(?:\\w+:)?${name}>([^<]*)</(?:\\w+:)?${name}>`, "i").exec(xml);
+	return m ? unescapeXml(m[1].trim()) : "";
+}
+function escapeXml(s) {
+	return s.replace(/[<>&'"]/g, (c) => `&#${c.charCodeAt(0)};`);
+}
+function unescapeXml(s) {
+	return s.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, "\"").replace(/&apos;/g, "'").replace(/&amp;/g, "&");
+}
+var PRIVATE = new net.BlockList();
+for (const [ip, bits] of [
+	["10.0.0.0", 8],
+	["172.16.0.0", 12],
+	["192.168.0.0", 16],
+	["100.64.0.0", 10],
+	["169.254.0.0", 16]
+]) PRIVATE.addSubnet(ip, bits, "ipv4");
+function privateV4(ip) {
+	return net.isIPv4(ip) && PRIVATE.check(ip, "ipv4");
+}
+function hostPort(value) {
+	const m = /^\[?([^\]]+?)\]?:(\d+)$/.exec(value?.trim() || "");
+	return m ? {
+		host: m[1],
+		port: Number(m[2])
+	} : null;
+}
+function randomInt(n) {
+	return Math.floor(Math.random() * n);
+}
+function describe(err) {
+	if (err instanceof Error) {
+		if (err.name === "TimeoutError") return "the router did not answer";
+		return err.message;
+	}
+	return String(err);
+}
+var HEAD = 9;
+/** Nothing either end sends comes near this: a larger length is a pipe
+* out of step, and reading on would misread everything after it. */
+var MAX_FRAME = 67108864;
+/** One end of the pipe. */
+var Wire = class {
+	sock;
+	onFrame;
+	pending = null;
+	corked = false;
+	broken = false;
+	constructor(sock, onFrame) {
+		this.sock = sock;
+		this.onFrame = onFrame;
+		sock.on("data", (data) => this.read(data));
+	}
+	send(kind, chan, payload) {
+		if (this.broken || this.sock.destroyed) return;
+		const head = Buffer.allocUnsafe(HEAD);
+		head.writeUInt32LE(payload.length + HEAD - 4, 0);
+		head.writeUInt8(kind, 4);
+		head.writeUInt32LE(chan, 5);
+		if (!this.corked) {
+			this.corked = true;
+			this.sock.cork();
+			process.nextTick(() => {
+				this.corked = false;
+				this.sock.uncork();
+			});
+		}
+		this.sock.write(head);
+		this.sock.write(payload);
+	}
+	message(msg) {
+		this.send(0, 0, Buffer.from(JSON.stringify(msg)));
+	}
+	read(data) {
+		let buf = this.pending ? Buffer.concat([this.pending, data]) : data;
+		while (buf.length >= 4) {
+			const size = buf.readUInt32LE(0);
+			if (size < 5 || size > MAX_FRAME) {
+				this.broken = true;
+				this.sock.destroy(/* @__PURE__ */ new Error(`a frame of ${size} bytes`));
+				return;
+			}
+			if (buf.length < size + 4) break;
+			const kind = buf.readUInt8(4);
+			const chan = buf.readUInt32LE(5);
+			const payload = buf.subarray(HEAD, size + 4);
+			buf = buf.subarray(size + 4);
+			this.onFrame(kind, chan, payload);
+		}
+		this.pending = buf.length ? buf : null;
+	}
+};
+/** `host 192.168.0.5:7171`: a candidate as the log and the page show it. */
+function side(c) {
+	const host = c.address?.includes(":") ? `[${c.address}]` : c.address;
+	return `${c.type ?? "?"} ${host}:${c.port}`;
+}
+//#endregion
+//#region src/server/rtc/helper.ts
+/**
+* Direct connections' network half, a process of its own that the server
+* starts at a page's first offer (link.ts): node-datachannel, the UDP
+* port, every PeerConnection and DataChannel, the compression of what
+* terminals send down them, and the router port (upnp.ts). The server
+* keeps the rest — the signalling on its events sockets and the access
+* and Origin checks they passed, the path verdict, the firewall, and the
+* terminals themselves — and talks to this over a pipe (wire.ts): each
+* terminal's DataChannel is a channel number there, which the server hands
+* term-ws as a TermChannel.
+*
+* It never starts a process, and that is why it is one. libjuice opens the
+* ICE socket without close-on-exec, so whatever is started from the
+* process holding it inherits the port: a tmux server started from the
+* server kept it bound across the server's restart, and the next bind
+* failed (EADDRINUSE) for as long as tmux ran. Here nothing inherits it,
+* and the port is free the moment this exits — so it can exit when idle.
+* The spawning functions are replaced below so a change that starts one
+* fails at once rather than leaking the socket; the gateway that macOS
+* only names through `route`, the server looks up (`gateways?`).
+*
+* It exits when the pipe closes (the server stopped or was killed), on
+* SIGTERM or SIGINT, when the server says so, and after IDLE_MS with no
+* peer — each time giving back a router port it holds first. A native
+* crash here costs the pages their peers, not the server: the server
+* sees the pipe close, tells each page, and their terminals resume on
+* their websockets.
+*/
+for (const name of [
+	"spawn",
+	"spawnSync",
+	"exec",
+	"execSync",
+	"execFile",
+	"execFileSync",
+	"fork"
+]) childProcess[name] = () => {
+	throw new Error("direct connections' helper never starts a process: it would inherit the UDP port");
+};
+syncBuiltinESMExports();
+/** A page pings every few seconds while it is open: one silent this long
+* is gone (a phone put away, a laptop shut), and its terminals' attaches
+* are held for it as a lost socket's are. */
+var SILENT_MS = 6e4;
+/** A peer that has not connected in this long never will. */
+var CONNECT_MS = 3e4;
+/** What this end accepts in one message, and so what a page may send. */
+var MAX_MESSAGE = 262144;
+/** Output is sent in pieces of at most this many characters (48 KiB of
+* UTF-8 at worst), well under what any browser accepts in one message; a
+* compressor's chunks are no larger. */
+var PIECE = 16384;
+/** How often a channel whose output is still queued says how much. */
+var REPORT_MS = 50;
+var pipe = new net.Socket({
+	fd: 3,
+	readable: true,
+	writable: true
+});
+var wire = new Wire(pipe, frame);
+var peers = /* @__PURE__ */ new Map();
+var chans = /* @__PURE__ */ new Map();
+/** A page's candidates that came before its peer was made. */
+var early = /* @__PURE__ */ new Map();
+var ndc = null;
+var port = 0;
+var stun = [];
+var idleMs = 6e5;
+var chanCount = 0;
+/** When it last had a peer, or an offer. */
+var busyAt = Date.now();
+var leaving = false;
+/** The port's mux, held for this process's life: a peer of no page's,
+* gathered on the port and never answered, whose ICE agent keeps the mux
+* registered. Left to itself the mux closes with its last peer, and a
+* peer made while it closes cannot bind the port. */
+var anchor = null;
+function say(msg) {
+	wire.message(msg);
+}
+pipe.on("error", () => {});
+pipe.on("close", () => void leave("the server went"));
+for (const signal of ["SIGTERM", "SIGINT"]) process.on(signal, () => void leave(signal));
+function frame(kind, chan, payload) {
+	if (kind !== 0) return chans.get(chan)?.output(kind, payload);
+	let msg;
+	try {
+		msg = JSON.parse(payload.toString());
+	} catch {
+		return;
+	}
+	switch (msg.t) {
+		case "init":
+			start(msg);
+			return;
+		case "offer":
+			offer(msg);
+			return;
+		case "candidate": {
+			const peer = peers.get(msg.id);
+			if (!peer) {
+				const list = early.get(msg.id);
+				if (list && list.length < 64) list.push(msg);
+				return;
+			}
+			try {
+				peer.pc.addRemoteCandidate(msg.candidate, msg.mid);
+			} catch {}
+			return;
+		}
+		case "close":
+			closePeer(msg.id, null);
+			return;
+		case "end":
+			chans.get(msg.chan)?.close(msg.code);
+			return;
+		case "drop":
+			chans.get(msg.chan)?.terminate();
+			return;
+		case "upnp.release":
+			upnpRelease();
+			return;
+		case "gateways":
+			lookups.get(msg.n)?.(msg.ips);
+			return;
+		case "shutdown":
+			leave("the server is stopping");
+			return;
+	}
+}
+var lookups = /* @__PURE__ */ new Map();
+var lookupCount = 0;
+setGatewayLookup(() => new Promise((resolve) => {
+	const n = ++lookupCount;
+	const done = (ips) => {
+		lookups.delete(n);
+		resolve(ips);
+	};
+	lookups.set(n, done);
+	say({
+		t: "gateways?",
+		n
+	});
+	setTimeout(() => done([]), 3e3).unref();
+}));
+onUpnpStatus((status) => say({
+	t: "upnp",
+	status
+}));
+/** node-datachannel and the port, then ready; either failing is said, and
+* this exits (the server starts another at a later offer). */
+async function start(init) {
+	port = init.port;
+	stun = init.stun;
+	idleMs = init.idleMs;
+	try {
+		ndc = await import("node-datachannel");
+	} catch (err) {
+		say({
+			t: "failed",
+			error: message(err),
+			unavailable: true
+		});
+		return leave("node-datachannel did not load");
+	}
+	if (init.log) ndc.initLogger("Debug", (level, text) => console.error(`[rtc ${level}] ${text}`));
+	ndc.setSctpSettings({
+		sendBufferSize: 262144,
+		recvBufferSize: 262144
+	});
+	try {
+		anchor = await hold(ndc);
+	} catch (err) {
+		say({
+			t: "failed",
+			error: message(err),
+			bind: true
+		});
+		return leave("the port could not be bound");
+	}
+	say({ t: "ready" });
+	setInterval(() => {
+		if (!peers.size && Date.now() - busyAt > idleMs) leave("idle");
+	}, Math.min(6e4, Math.max(1e3, idleMs / 4))).unref();
+}
+function hold(lib) {
+	return new Promise((resolve, reject) => {
+		const pc = new lib.PeerConnection("work-port", {
+			iceServers: [],
+			enableIceUdpMux: true,
+			portRangeBegin: port,
+			portRangeEnd: port
+		});
+		let settled = false;
+		const done = () => {
+			if (settled) return;
+			settled = true;
+			resolve(pc);
+		};
+		pc.onGatheringStateChange((state) => {
+			if (state === "complete") done();
+		});
+		setTimeout(done, 1e3);
+		try {
+			pc.createDataChannel("hold");
+		} catch (err) {
+			settled = true;
+			try {
+				pc.close();
+			} catch {}
+			reject(/* @__PURE__ */ new Error(`UDP port ${port} could not be bound (${message(err)})`));
+		}
+	});
+}
+async function offer(msg) {
+	const { id, sdp } = msg;
+	if (!ndc || leaving) return;
+	busyAt = Date.now();
+	early.set(id, early.get(id) ?? []);
+	if (msg.usesPort) await Promise.race([upnpWant(port, portInUse), new Promise((r) => setTimeout(r, 2500))]);
+	if (msg.needsPort) say({
+		t: "port",
+		id
+	});
+	const queued = early.get(id);
+	early.delete(id);
+	if (!queued) return;
+	closePeer(id, null);
+	let pc;
+	try {
+		pc = new ndc.PeerConnection(`work-${id}`, {
+			iceServers: stun,
+			enableIceUdpMux: true,
+			portRangeBegin: port,
+			portRangeEnd: port,
+			maxMessageSize: MAX_MESSAGE
+		});
+	} catch (err) {
+		say({
+			t: "closed",
+			id,
+			why: message(err)
+		});
+		return;
+	}
+	const now = Date.now();
+	const peer = {
+		id,
+		pc,
+		state: "new",
+		channels: /* @__PURE__ */ new Set(),
+		heard: now,
+		born: now,
+		usesPort: msg.usesPort,
+		timer: setInterval(() => {
+			if (peer.state !== "connected" && Date.now() - peer.born > CONNECT_MS) closePeer(id, "never connected");
+			else if (Date.now() - peer.heard > SILENT_MS) closePeer(id, "silent: its page stopped pinging");
+		}, 5e3)
+	};
+	peers.set(id, peer);
+	pc.onLocalDescription((answer, type) => {
+		say({
+			t: "answer",
+			id,
+			sdp: answer,
+			type
+		});
+		const ext = msg.routerCandidate ? upnpCandidate() : null;
+		if (ext) say({
+			t: "candidate",
+			id,
+			candidate: `candidate:upnp1 1 UDP 1694498815 ${ext.ip} ${ext.port} typ srflx raddr 0.0.0.0 rport 0`,
+			mid: /^a=mid:(\S+)/m.exec(sdp)?.[1] ?? "0"
+		});
+	});
+	pc.onLocalCandidate((candidate, mid) => say({
+		t: "candidate",
+		id,
+		candidate: candidate.replace(/^a=/, ""),
+		mid
+	}));
+	pc.onStateChange((state) => {
+		peer.state = state;
+		if (state === "connected") setImmediate(() => connected(peer));
+		if (state === "failed" || state === "closed") setImmediate(() => closePeer(id, state === "failed" ? "ICE failed" : "closed by the page's end"));
+	});
+	pc.onDataChannel((dc) => {
+		const label = dc.getLabel();
+		if (label === "ctl") control(peer, dc);
+		else if (label === "term") term(peer, dc);
+		else dc.close();
+	});
+	try {
+		pc.setRemoteDescription(sdp, "offer");
+	} catch (err) {
+		closePeer(id, message(err));
+		return;
+	}
+	for (const c of queued) try {
+		pc.addRemoteCandidate(c.candidate, c.mid);
+	} catch {}
+}
+/** Whether a peer that asked for the router's port is connected. */
+function portInUse() {
+	for (const p of peers.values()) if (p.usesPort && p.state === "connected") return true;
+	return false;
+}
+/** Connected: the pair in use, as this end sees it — the page's address
+* too, which the page itself cannot see (a browser keeps its own host
+* address behind an mDNS name). */
+function connected(peer, tries = 0) {
+	if (peers.get(peer.id) !== peer) return;
+	let pair = null;
+	try {
+		pair = peer.pc.getSelectedCandidatePair();
+	} catch {}
+	if (!pair) {
+		if (tries < 5) setTimeout(() => connected(peer, tries + 1), 200);
+		return;
+	}
+	say({
+		t: "pair",
+		id: peer.id,
+		page: side(pair.remote),
+		server: side(pair.local)
+	});
+}
+/** Closed, and said so unless the server asked (`why` null). */
+function closePeer(id, why) {
+	early.delete(id);
+	const peer = peers.get(id);
+	if (!peer) return;
+	peers.delete(id);
+	if (!peers.size) busyAt = Date.now();
+	if (why !== null) say({
+		t: "closed",
+		id,
+		why
+	});
+	clearInterval(peer.timer);
+	for (const chan of peer.channels) chan.lost();
+	try {
+		peer.pc.close();
+	} catch {}
+}
+/** The page's pings: echoed as they came, from here (the server is not
+* asked), and heard as its liveness. */
+function control(peer, dc) {
+	dc.onMessage((msg) => {
+		peer.heard = Date.now();
+		if (typeof msg !== "string") return;
+		try {
+			dc.sendMessage(msg);
+		} catch {}
+	});
+}
+/** A terminal: its first message is the /term path, which the server is
+* handed with a channel number; from then on its frames go both ways. */
+function term(peer, dc) {
+	let chan = null;
+	dc.onMessage((msg) => {
+		peer.heard = Date.now();
+		if (chan) return chan.receive(msg);
+		if (typeof msg !== "string" || !msg.startsWith("/term/")) {
+			dc.close();
+			return;
+		}
+		const made = new Chan(++chanCount, peer, dc, codecOf(msg));
+		chan = made;
+		say({
+			t: "open",
+			chan: made.id,
+			peer: peer.id,
+			path: msg
+		});
+	});
+	dc.onClosed(() => chan?.lost());
+}
+function codecOf(path) {
+	const asked = new URLSearchParams(path.split("?")[1] ?? "").get("codec");
+	return asked === "brotli" || asked === "deflate-raw" ? asked : null;
+}
+/** One compressor for a channel's whole life, flushed at every message so
+* nothing waits on the next: a terminal's output repeats itself across
+* frames (a redrawn status line, a prompt), which a running context finds
+* and a per-frame one cannot. Brotli at quality 5 with a 1 MiB window
+* (lgwin 20: 22 made no recording smaller); deflate at its default level
+* and full 32 KiB window. */
+function compressor(codec) {
+	const c = zlib.constants;
+	return codec === "brotli" ? zlib.createBrotliCompress({
+		flush: c.BROTLI_OPERATION_FLUSH,
+		chunkSize: PIECE,
+		params: {
+			[c.BROTLI_PARAM_QUALITY]: 5,
+			[c.BROTLI_PARAM_LGWIN]: 20,
+			[c.BROTLI_PARAM_MODE]: c.BROTLI_MODE_TEXT
+		}
+	}) : zlib.createDeflateRaw({
+		flush: c.Z_SYNC_FLUSH,
+		windowBits: 15,
+		memLevel: 8,
+		chunkSize: PIECE
+	});
+}
+/** Marks a message of the server's own (JSON) in a compressed stream: a
+* byte UTF-8 never holds, so output needs no framing around it. */
+var MARK = 255;
+/** Channels whose queued output the server has not heard the last of. */
+var reporting = /* @__PURE__ */ new Set();
+var reportTimer;
+var reportSoon = false;
+/**
+* A terminal's DataChannel, the network end of the server's TermChannel
+* for it (index.ts `ipcChannel`). A DataChannel has no close code, so each
+* end says its code in a last message (`{bye}`) before closing; one that
+* closes without a word was lost. It has no pings either: its liveness is
+* the peer's (ICE state, and the page's pings on its control channel).
+*
+* With a codec, everything the server sends on it is one compressed
+* stream (keys up from the page are not: they are small, and the page's
+* CPU is the scarcer): output as its UTF-8, the server's own messages each
+* between two MARKs, so the page reads them back in the one order they
+* were sent. The stream sits under the attach's resume: offsets and the
+* replay are characters, and a new channel starts a new stream. It ends
+* properly before a `bye`'d close, so the page can tell the end from a
+* loss. Without one (a browser with no DecompressionStream), output is
+* text frames and the server's messages binary, as on a websocket.
+*
+* The server's side of it counts what it sent and hears back what was
+* taken and what is still queued here (`drain`), so the attach's read
+* pauses on a slow page as it would on a slow websocket.
+*/
+var Chan = class {
+	id;
+	peer;
+	dc;
+	packed;
+	code = null;
+	done = false;
+	closing = false;
+	/** Output bytes taken off the pipe. */
+	taken = 0;
+	constructor(id, peer, dc, codec) {
+		this.id = id;
+		this.peer = peer;
+		this.dc = dc;
+		chans.set(id, this);
+		peer.channels.add(this);
+		this.packed = codec ? compressor(codec) : null;
+		this.packed?.on("data", (chunk) => {
+			try {
+				if (dc.isOpen()) dc.sendMessageBinary(chunk);
+			} catch {}
+			this.report();
+		});
+		this.packed?.on("error", () => this.shut());
+	}
+	get queued() {
+		try {
+			return this.dc.bufferedAmount() + (this.packed?.writableLength ?? 0);
+		} catch {
+			return 0;
+		}
+	}
+	get open() {
+		if (this.done || this.closing) return false;
+		try {
+			return this.dc.isOpen();
+		} catch {
+			return false;
+		}
+	}
+	/** From the server: output (text, its UTF-8) or its own word (binary). */
+	output(kind, payload) {
+		this.taken += payload.length;
+		this.report();
+		if (!this.open) return;
+		if (this.packed) {
+			this.packed.write(kind === 1 ? payload : this.mark(payload));
+			return;
+		}
+		try {
+			if (kind === 2) this.dc.sendMessageBinary(payload);
+			else for (const piece of pieces(payload.toString())) this.dc.sendMessage(piece);
+		} catch {}
+	}
+	/** From the page: keys (binary) or its control (text), or its bye. */
+	receive(msg) {
+		if (this.done) return;
+		if (typeof msg === "string") {
+			const bye = byeOf(msg);
+			if (bye !== null) {
+				this.code = bye;
+				return;
+			}
+			wire.send(1, this.id, Buffer.from(msg));
+		} else wire.send(2, this.id, Buffer.isBuffer(msg) ? msg : Buffer.from(msg));
+	}
+	close(code) {
+		if (this.closing || this.done) return;
+		const said = code !== void 0 && this.open;
+		this.closing = true;
+		if (!said) return this.shut();
+		const bye = Buffer.from(JSON.stringify({ bye: code }));
+		if (!this.packed) {
+			try {
+				this.dc.sendMessageBinary(bye);
+			} catch {}
+			return this.shut();
+		}
+		this.packed.once("end", () => this.shut());
+		this.packed.end(this.mark(bye));
+		setTimeout(() => this.shut(), 2e3).unref();
+	}
+	terminate() {
+		this.shut();
+	}
+	/** Gone, with whatever code the page said before it went (1006 when it
+	* said none: lost, and the attach is held). */
+	lost() {
+		if (this.done) return;
+		this.done = true;
+		chans.delete(this.id);
+		reporting.delete(this);
+		this.peer.channels.delete(this);
+		this.packed?.destroy();
+		say({
+			t: "lost",
+			chan: this.id,
+			code: this.code ?? 1006
+		});
+	}
+	/** Tells the server how far its output has got: at once for the bytes
+	* taken, then every REPORT_MS while any is still queued. */
+	report() {
+		reporting.add(this);
+		if (reportSoon) return;
+		reportSoon = true;
+		setImmediate(sendReports);
+	}
+	shut() {
+		if (this.done) return;
+		try {
+			this.dc.close();
+		} catch {}
+		setImmediate(() => this.lost());
+	}
+	mark(json) {
+		return Buffer.concat([
+			Buffer.of(MARK),
+			json,
+			Buffer.of(MARK)
+		]);
+	}
+	/** What the last report said was queued, to stop reporting a channel
+	* once it said nothing was. */
+	said = -1;
+	drain() {
+		const buffered = this.queued;
+		say({
+			t: "drain",
+			chan: this.id,
+			done: this.taken,
+			buffered
+		});
+		this.said = buffered;
+	}
+};
+function sendReports() {
+	reportSoon = false;
+	for (const chan of reporting) {
+		chan.drain();
+		if (chan.said === 0) reporting.delete(chan);
+	}
+	if (reporting.size && !reportTimer) reportTimer = setInterval(() => {
+		if (!reporting.size) {
+			clearInterval(reportTimer);
+			reportTimer = void 0;
+			return;
+		}
+		sendReports();
+	}, REPORT_MS);
+}
+function byeOf(text) {
+	if (!text.startsWith("{\"bye\":")) return null;
+	try {
+		const bye = JSON.parse(text).bye;
+		return Number.isInteger(bye) ? bye : null;
+	} catch {
+		return null;
+	}
+}
+/** `text` in pieces of at most PIECE characters, never splitting a
+* surrogate pair: each piece is encoded on its own, and half a pair would
+* arrive as U+FFFD, a character the page's count would not agree with. */
+function* pieces(text) {
+	if (text.length <= PIECE) {
+		yield text;
+		return;
+	}
+	for (let i = 0; i < text.length;) {
+		let end = Math.min(i + PIECE, text.length);
+		const last = text.charCodeAt(end - 1);
+		if (end < text.length && last >= 55296 && last <= 56319) end--;
+		yield text.slice(i, end);
+		i = end;
+	}
+}
+/** Closes every peer (their pages fall back to websockets at once rather
+* than when their paths time out), gives back a router port it holds
+* (bounded: a router that does not answer cannot hold this up), and
+* exits, which frees the UDP port. */
+async function leave(why) {
+	if (leaving) return;
+	leaving = true;
+	for (const id of [...peers.keys()]) closePeer(id, null);
+	try {
+		anchor?.close();
+	} catch {}
+	if (upnpStatus().state !== "off") await Promise.race([upnpRelease().catch(() => {}), new Promise((r) => setTimeout(r, 1500))]);
+	say({
+		t: "exit",
+		why
+	});
+	pipe.end(() => process.exit(0));
+	setTimeout(() => process.exit(0), 500).unref();
+}
+function message(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+//#endregion
+export {};