@inkbox/sdk 0.2.16 → 0.3.0

package/dist/tunnels/client/_h1_server.js

@@ -0,0 +1,433 @@
+/**
+ * inkbox-tunnels/client/_h1_server.ts
+ *
+ * In-process HTTP/1.1 server-side parser. Drives `node:http`'s server
+ * over an in-memory Duplex (the "WireDuplex" pattern — the underlying
+ * Socket surface is mocked just enough that node:http accepts it) to
+ * turn plaintext bytes from the third party into `DispatchRequest`
+ * objects, hands them to a `Dispatch` impl, and serializes responses
+ * back to plaintext bytes.
+ *
+ * Implements the Plaintext adapter contract used by the runtime in
+ * passthrough mode after the TLS terminator.
+ */
+import * as http from "node:http";
+import { Duplex } from "node:stream";
+import { HOP_BY_HOP_RESPONSE } from "./_protocol.js";
+import { ByteChannelWebSocketSink, computeWsAccept, } from "./_ws_passthrough.js";
+/** Sentinel pushed onto the outbound queue to signal "no more bytes". */
+const OUTBOUND_END = Symbol("outbound-end");
+/**
+ * Bidirectional in-memory pipe that we feed wire bytes into and read
+ * wire bytes out of. `node:http`'s server treats this as a connection
+ * via `server.emit("connection", duplex)`.
+ */
+class H1WireDuplex extends Duplex {
+    inbound = [];
+    outboundQueue = [];
+    outboundResolvers = [];
+    constructor() {
+        super({ allowHalfOpen: true });
+    }
+    pushIncoming(buf) {
+        this.inbound.push(buf);
+        this._read(0);
+    }
+    /** Wait for one outbound chunk; returns `OUTBOUND_END` on close. */
+    takeOutbound() {
+        if (this.outboundQueue.length > 0) {
+            return Promise.resolve(this.outboundQueue.shift());
+        }
+        return new Promise((resolve) => this.outboundResolvers.push(resolve));
+    }
+    endOutbound() {
+        this._enqueueOutbound(OUTBOUND_END);
+    }
+    _read(_size) {
+        while (this.inbound.length > 0) {
+            const chunk = this.inbound.shift();
+            if (!this.push(chunk))
+                return;
+        }
+    }
+    _write(chunk, _enc, cb) {
+        const buf = typeof chunk === "string" ? Buffer.from(chunk) : chunk;
+        this._enqueueOutbound(buf);
+        cb();
+    }
+    _final(cb) {
+        cb();
+    }
+    // Socket-like methods node:http's server probes for. These cover the
+    // surface it touches when the underlying transport isn't a real net
+    // socket (return self / no-ops are fine — there's no kernel socket
+    // to configure).
+    setTimeout(_ms, _cb) { return this; }
+    setNoDelay(_b) { return this; }
+    setKeepAlive(_b, _ms) { return this; }
+    unref() { return this; }
+    ref() { return this; }
+    address() {
+        return { port: 0, family: "IPv4", address: "127.0.0.1" };
+    }
+    get remoteAddress() { return "127.0.0.1"; }
+    get remoteFamily() { return "IPv4"; }
+    get remotePort() { return 0; }
+    get localAddress() { return "127.0.0.1"; }
+    get localPort() { return 0; }
+    _enqueueOutbound(item) {
+        if (this.outboundResolvers.length > 0) {
+            const resolve = this.outboundResolvers.shift();
+            resolve(item);
+            return;
+        }
+        this.outboundQueue.push(item);
+    }
+}
+/**
+ * h1 parser exposed as a Plaintext adapter. One instance per third-
+ * party TLS session.
+ */
+export class InProcH1ParserPlaintext {
+    wire;
+    server;
+    maxInboundBodyBytes;
+    closed = false;
+    constructor(opts) {
+        this.wire = new H1WireDuplex();
+        this.maxInboundBodyBytes = opts.maxInboundBodyBytes;
+        this.server = http.createServer();
+        this.server.on("request", (req, res) => {
+            void this.handleRequest(opts.dispatch, opts.forwardedForIp, opts.sniHost, req, res);
+        });
+        this.server.on("upgrade", (req, socket, head) => {
+            void this.handleUpgrade(opts.dispatch, opts.forwardedForIp, opts.sniHost, req, socket, head);
+        });
+        this.server.emit("connection", this.wire);
+    }
+    async feed(plaintext) {
+        if (this.closed)
+            return;
+        this.wire.pushIncoming(plaintext);
+    }
+    async pumpOutbound(send) {
+        while (true) {
+            const item = await this.wire.takeOutbound();
+            if (item === OUTBOUND_END)
+                return;
+            try {
+                await send(item);
+            }
+            catch {
+                return;
+            }
+        }
+    }
+    async aclose() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        try {
+            this.server.close();
+        }
+        catch {
+            /* swallow */
+        }
+        this.wire.endOutbound();
+    }
+    async handleUpgrade(dispatch, forwardedForIp, sniHost, req, socket, head) {
+        const headers = [];
+        let isWebSocket = false;
+        let wsSubprotocol = null;
+        let wsKey = null;
+        const rawHeaders = req.rawHeaders;
+        for (let i = 0; i + 1 < rawHeaders.length; i += 2) {
+            const name = rawHeaders[i].toLowerCase();
+            const value = rawHeaders[i + 1];
+            headers.push([name, value]);
+            if (name === "upgrade" && value.toLowerCase() === "websocket") {
+                isWebSocket = true;
+            }
+            else if (name === "sec-websocket-protocol") {
+                wsSubprotocol = value;
+            }
+            else if (name === "sec-websocket-key") {
+                wsKey = value;
+            }
+        }
+        if (!isWebSocket ||
+            wsKey === null ||
+            typeof dispatch.dispatchWebSocket !== "function") {
+            try {
+                socket.write("HTTP/1.1 501 Not Implemented\r\n" +
+                    "Connection: close\r\n" +
+                    "Content-Length: 0\r\n" +
+                    "\r\n");
+                socket.end();
+            }
+            catch {
+                /* swallow */
+            }
+            return;
+        }
+        const acceptValue = computeWsAccept(wsKey);
+        const buildAccept = (subprotocol, extraHeaders) => {
+            const lines = [
+                "HTTP/1.1 101 Switching Protocols",
+                "Upgrade: websocket",
+                "Connection: Upgrade",
+                `Sec-WebSocket-Accept: ${acceptValue}`,
+            ];
+            if (subprotocol !== null) {
+                lines.push(`Sec-WebSocket-Protocol: ${subprotocol}`);
+            }
+            if (extraHeaders !== null) {
+                for (const [hk, hv] of extraHeaders) {
+                    lines.push(`${hk}: ${hv}`);
+                }
+            }
+            return Buffer.from(lines.join("\r\n") + "\r\n\r\n", "ascii");
+        };
+        const buildReject = (status) => {
+            const phrase = status === 400
+                ? "Bad Request"
+                : status === 403
+                    ? "Forbidden"
+                    : status === 500
+                        ? "Internal Server Error"
+                        : "Error";
+            const body = "upgrade refused";
+            return Buffer.from(`HTTP/1.1 ${status} ${phrase}\r\n` +
+                `Content-Type: text/plain\r\n` +
+                `Content-Length: ${body.length}\r\n` +
+                `Connection: close\r\n\r\n${body}`, "ascii");
+        };
+        const sendPlaintext = async (data) => {
+            await new Promise((resolve, reject) => {
+                socket.write(data, (err) => (err ? reject(err) : resolve()));
+            });
+        };
+        const sink = new ByteChannelWebSocketSink({
+            sendPlaintext,
+            buildAcceptResponse: buildAccept,
+            buildRejectResponse: buildReject,
+            onClose: async () => {
+                try {
+                    socket.end();
+                }
+                catch {
+                    /* swallow */
+                }
+            },
+        });
+        socket.on("data", (chunk) => {
+            const buf = typeof chunk === "string" ? Buffer.from(chunk) : chunk;
+            sink.feedInbound(buf);
+        });
+        socket.on("end", () => sink.signalInboundEof());
+        socket.on("close", () => sink.signalInboundEof());
+        socket.on("error", () => sink.signalInboundEof());
+        if (head !== undefined && head.length > 0) {
+            sink.feedInbound(head);
+        }
+        const dispatchRequest = {
+            method: req.method ?? "GET",
+            path: req.url ?? "/",
+            headers,
+            body: emptyAsyncIter(),
+            forwardedForIp,
+            sniHost,
+            isWebSocket: true,
+            wsSubprotocol,
+            transport: "h1",
+        };
+        try {
+            await dispatch.dispatchWebSocket(dispatchRequest, sink);
+        }
+        catch {
+            try {
+                await sink.aclose();
+            }
+            catch {
+                /* swallow */
+            }
+        }
+    }
+    async handleRequest(dispatch, forwardedForIp, sniHost, req, res) {
+        const headers = [];
+        let isWebSocket = false;
+        let wsSubprotocol = null;
+        const rawHeaders = req.rawHeaders;
+        for (let i = 0; i + 1 < rawHeaders.length; i += 2) {
+            const name = rawHeaders[i].toLowerCase();
+            const value = rawHeaders[i + 1];
+            headers.push([name, value]);
+            if (name === "upgrade" && value.toLowerCase() === "websocket") {
+                isWebSocket = true;
+            }
+            else if (name === "sec-websocket-protocol") {
+                wsSubprotocol = value;
+            }
+        }
+        let inboundCount = 0;
+        let oversize = false;
+        const bodyChunks = [];
+        const bodyResolvers = [];
+        const enqueue = (item) => {
+            if (bodyResolvers.length > 0) {
+                bodyResolvers.shift()(item);
+                return;
+            }
+            bodyChunks.push(item ?? Buffer.alloc(0));
+            if (item === null)
+                bodyChunks.push(Buffer.alloc(0)); // sentinel marker
+        };
+        req.on("data", (chunk) => {
+            if (oversize)
+                return;
+            const buf = typeof chunk === "string" ? Buffer.from(chunk) : chunk;
+            inboundCount += buf.length;
+            if (inboundCount > this.maxInboundBodyBytes) {
+                oversize = true;
+                // Best-effort 413, then destroy.
+                if (!res.headersSent) {
+                    res.statusCode = 413;
+                    res.setHeader("content-type", "text/plain");
+                    res.setHeader("content-length", String("payload too large".length));
+                    res.setHeader("connection", "close");
+                    res.end("payload too large");
+                }
+                req.destroy();
+                return;
+            }
+            enqueue(buf);
+        });
+        req.on("end", () => enqueue(null));
+        req.on("error", () => enqueue(null));
+        async function* bodyIter() {
+            while (true) {
+                if (bodyChunks.length === 0) {
+                    const item = await new Promise((resolve) => bodyResolvers.push(resolve));
+                    if (item === null)
+                        return;
+                    yield item;
+                    continue;
+                }
+                const chunk = bodyChunks.shift();
+                // Empty buffer = sentinel for end.
+                if (chunk.length === 0 && bodyChunks.length === 0)
+                    return;
+                if (chunk.length > 0)
+                    yield chunk;
+            }
+        }
+        const dispatchRequest = {
+            method: req.method ?? "GET",
+            path: req.url ?? "/",
+            headers,
+            body: bodyIter(),
+            forwardedForIp,
+            sniHost,
+            isWebSocket,
+            wsSubprotocol,
+            transport: "h1",
+        };
+        const sink = makeResponseSink(res);
+        try {
+            await dispatch.dispatch(dispatchRequest, sink);
+        }
+        catch {
+            if (!res.headersSent) {
+                try {
+                    res.statusCode = 502;
+                    res.setHeader("content-type", "text/plain");
+                    res.end("upstream error");
+                }
+                catch {
+                    /* swallow */
+                }
+            }
+        }
+        try {
+            if (!res.writableEnded)
+                res.end();
+        }
+        catch {
+            /* swallow */
+        }
+    }
+}
+async function* emptyAsyncIter() {
+    if (false)
+        yield Buffer.alloc(0);
+}
+function makeResponseSink(res) {
+    let headSent = false;
+    let bodyEnded = false;
+    return {
+        async sendHead(head) {
+            if (headSent)
+                return;
+            headSent = true;
+            res.statusCode = head.status;
+            // Strip hop-by-hop response headers; let node:http manage
+            // transfer-encoding from the rest. Accumulate values per name
+            // before calling setHeader once: setHeader(name, value) overwrites
+            // the previous value, which would drop earlier Set-Cookie /
+            // multi-value entries when iterating one-at-a-time.
+            const grouped = new Map();
+            for (const [k, v] of head.headers) {
+                const kl = k.toLowerCase();
+                if (HOP_BY_HOP_RESPONSE.has(kl))
+                    continue;
+                const list = grouped.get(kl);
+                if (list === undefined) {
+                    grouped.set(kl, [v]);
+                }
+                else {
+                    list.push(v);
+                }
+            }
+            for (const [kl, values] of grouped) {
+                try {
+                    // node:http accepts string | string[]; passing an array of
+                    // length 1 is equivalent to a single string, but using the
+                    // array form keeps the multi-value Set-Cookie path correct.
+                    res.setHeader(kl, values.length === 1 ? values[0] : values);
+                }
+                catch {
+                    /* invalid header — skip */
+                }
+            }
+            // node:http calls writeHead lazily on first write; force it now
+            // so headers are flushed before any body bytes.
+            res.flushHeaders();
+        },
+        async sendBody(chunk) {
+            if (bodyEnded)
+                return;
+            await new Promise((resolve, reject) => {
+                res.write(chunk, (err) => (err ? reject(err) : resolve()));
+            });
+        },
+        async endBody() {
+            if (bodyEnded)
+                return;
+            bodyEnded = true;
+            await new Promise((resolve) => res.end(resolve));
+        },
+        async reset(reason) {
+            bodyEnded = true;
+            // h1 has no graceful mid-response reset — destroy the socket.
+            // Reason surfaces in logs only; transport closes.
+            void reason;
+            try {
+                res.destroy();
+            }
+            catch {
+                /* swallow */
+            }
+        },
+    };
+}
+//# sourceMappingURL=_h1_server.js.map

package/dist/tunnels/client/_h1_server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_h1_server.js","sourceRoot":"","sources":["../../../src/tunnels/client/_h1_server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAOrC,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EACL,wBAAwB,EACxB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAE9B,yEAAyE;AACzE,MAAM,YAAY,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;AAE5C;;;;GAIG;AACH,MAAM,YAAa,SAAQ,MAAM;IACvB,OAAO,GAAa,EAAE,CAAC;IACvB,aAAa,GAAwC,EAAE,CAAC;IACxD,iBAAiB,GAErB,EAAE,CAAC;IAEP;QACE,KAAK,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACjC,CAAC;IAED,YAAY,CAAC,GAAW;QACtB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChB,CAAC;IAED,oEAAoE;IACpE,YAAY;QACV,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClC,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAG,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,WAAW;QACT,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;IACtC,CAAC;IAEQ,KAAK,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAG,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO;QAChC,CAAC;IACH,CAAC;IAEQ,MAAM,CACb,KAAsB,EACtB,IAAY,EACZ,EAAgC;QAEhC,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACnE,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC3B,EAAE,EAAE,CAAC;IACP,CAAC;IAEQ,MAAM,CAAC,EAAgC;QAC9C,EAAE,EAAE,CAAC;IACP,CAAC;IAED,qEAAqE;IACrE,oEAAoE;IACpE,mEAAmE;IACnE,iBAAiB;IACjB,UAAU,CAAC,GAAW,EAAE,GAAgB,IAAU,OAAO,IAAI,CAAC,CAAC,CAAC;IAChE,UAAU,CAAC,EAAY,IAAU,OAAO,IAAI,CAAC,CAAC,CAAC;IAC/C,YAAY,CAAC,EAAY,EAAE,GAAY,IAAU,OAAO,IAAI,CAAC,CAAC,CAAC;IAC/D,KAAK,KAAW,OAAO,IAAI,CAAC,CAAC,CAAC;IAC9B,GAAG,KAAW,OAAO,IAAI,CAAC,CAAC,CAAC;IAC5B,OAAO;QACL,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,aAAa,KAAa,OAAO,WAAW,CAAC,CAAC,CAAC;IACnD,IAAI,YAAY,KAAa,OAAO,MAAM,CAAC,CAAC,CAAC;IAC7C,IAAI,UAAU,KAAa,OAAO,CAAC,CAAC,CAAC,CAAC;IACtC,IAAI,YAAY,KAAa,OAAO,WAAW,CAAC,CAAC,CAAC;IAClD,IAAI,SAAS,KAAa,OAAO,CAAC,CAAC,CAAC,CAAC;IAE7B,gBAAgB,CAAC,IAAkC;QACzD,IAAI,IAAI,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAG,CAAC;YAChD,OAAO,CAAC,IAAI,CAAC,CAAC;YACd,OAAO;QACT,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;CACF;AASD;;;GAGG;AACH,MAAM,OAAO,uBAAuB;IACjB,IAAI,CAAe;IACnB,MAAM,CAAc;IACpB,mBAAmB,CAAS;IACrC,MAAM,GAAG,KAAK,CAAC;IAEvB,YAAY,IAAiC;QAC3C,IAAI,CAAC,IAAI,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,mBAAmB,CAAC;QACpD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAElC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACrC,KAAK,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACtF,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;YAC9C,KAAK,IAAI,CAAC,aAAa,CACrB,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CACpE,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,SAAiB;QAC1B,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAsC;QACvD,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5C,IAAI,IAAI,KAAK,YAAY;gBAAE,OAAO;YAClC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO;YACT,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM;QACV,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,aAAa;QACf,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,QAAkB,EAClB,cAA6B,EAC7B,OAAsB,EACtB,GAAyB,EACzB,MAAoC,EACpC,IAAY;QAEZ,MAAM,OAAO,GAA4B,EAAE,CAAC;QAC5C,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,IAAI,aAAa,GAAkB,IAAI,CAAC;QACxC,IAAI,KAAK,GAAkB,IAAI,CAAC;QAChC,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;QAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;YAC5B,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,WAAW,EAAE,CAAC;gBAC9D,WAAW,GAAG,IAAI,CAAC;YACrB,CAAC;iBAAM,IAAI,IAAI,KAAK,wBAAwB,EAAE,CAAC;gBAC7C,aAAa,GAAG,KAAK,CAAC;YACxB,CAAC;iBAAM,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;gBACxC,KAAK,GAAG,KAAK,CAAC;YAChB,CAAC;QACH,CAAC;QAED,IACE,CAAC,WAAW;YACZ,KAAK,KAAK,IAAI;YACd,OAAO,QAAQ,CAAC,iBAAiB,KAAK,UAAU,EAChD,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,CAAC,KAAK,CACV,kCAAkC;oBAChC,uBAAuB;oBACvB,uBAAuB;oBACvB,MAAM,CACT,CAAC;gBACF,MAAM,CAAC,GAAG,EAAE,CAAC;YACf,CAAC;YAAC,MAAM,CAAC;gBACP,aAAa;YACf,CAAC;YACD,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,WAAW,GAAG,CAClB,WAA0B,EAC1B,YAA4C,EACpC,EAAE;YACV,MAAM,KAAK,GAAG;gBACZ,kCAAkC;gBAClC,oBAAoB;gBACpB,qBAAqB;gBACrB,yBAAyB,WAAW,EAAE;aACvC,CAAC;YACF,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC,2BAA2B,WAAW,EAAE,CAAC,CAAC;YACvD,CAAC;YACD,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;gBAC1B,KAAK,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,YAAY,EAAE,CAAC;oBACpC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC;YACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,UAAU,EAAE,OAAO,CAAC,CAAC;QAC/D,CAAC,CAAC;QACF,MAAM,WAAW,GAAG,CAAC,MAAc,EAAU,EAAE;YAC7C,MAAM,MAAM,GACV,MAAM,KAAK,GAAG;gBACZ,CAAC,CAAC,aAAa;gBACf,CAAC,CAAC,MAAM,KAAK,GAAG;oBACd,CAAC,CAAC,WAAW;oBACb,CAAC,CAAC,MAAM,KAAK,GAAG;wBACd,CAAC,CAAC,uBAAuB;wBACzB,CAAC,CAAC,OAAO,CAAC;YAClB,MAAM,IAAI,GAAG,iBAAiB,CAAC;YAC/B,OAAO,MAAM,CAAC,IAAI,CAChB,YAAY,MAAM,IAAI,MAAM,MAAM;gBAChC,8BAA8B;gBAC9B,mBAAmB,IAAI,CAAC,MAAM,MAAM;gBACpC,4BAA4B,IAAI,EAAE,EACpC,OAAO,CACR,CAAC;QACJ,CAAC,CAAC;QAEF,MAAM,aAAa,GAAG,KAAK,EAAE,IAAY,EAAiB,EAAE;YAC1D,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC1C,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC/D,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,MAAM,IAAI,GAAG,IAAI,wBAAwB,CAAC;YACxC,aAAa;YACb,mBAAmB,EAAE,WAAW;YAChC,mBAAmB,EAAE,WAAW;YAChC,OAAO,EAAE,KAAK,IAAI,EAAE;gBAClB,IAAI,CAAC;oBACH,MAAM,CAAC,GAAG,EAAE,CAAC;gBACf,CAAC;gBAAC,MAAM,CAAC;oBACP,aAAa;gBACf,CAAC;YACH,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE;YAC3C,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YACnE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAChD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAClD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAElD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QAED,MAAM,eAAe,GAAoB;YACvC,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK;YAC3B,IAAI,EAAE,GAAG,CAAC,GAAG,IAAI,GAAG;YACpB,OAAO;YACP,IAAI,EAAE,cAAc,EAAE;YACtB,cAAc;YACd,OAAO;YACP,WAAW,EAAE,IAAI;YACjB,aAAa;YACb,SAAS,EAAE,IAAI;SAChB,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,iBAAiB,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,aAAa;YACf,CAAC;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,QAAkB,EAClB,cAA6B,EAC7B,OAAsB,EACtB,GAAyB,EACzB,GAAwB;QAExB,MAAM,OAAO,GAA4B,EAAE,CAAC;QAC5C,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,IAAI,aAAa,GAAkB,IAAI,CAAC;QACxC,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;QAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;YAC5B,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,WAAW,EAAE,CAAC;gBAC9D,WAAW,GAAG,IAAI,CAAC;YACrB,CAAC;iBAAM,IAAI,IAAI,KAAK,wBAAwB,EAAE,CAAC;gBAC7C,aAAa,GAAG,KAAK,CAAC;YACxB,CAAC;QACH,CAAC;QAED,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,MAAM,aAAa,GAA0C,EAAE,CAAC;QAEhE,MAAM,OAAO,GAAG,CAAC,IAAmB,EAAQ,EAAE;YAC5C,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,aAAa,CAAC,KAAK,EAAG,CAAC,IAAI,CAAC,CAAC;gBAC7B,OAAO;YACT,CAAC;YACD,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACzC,IAAI,IAAI,KAAK,IAAI;gBAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB;QACzE,CAAC,CAAC;QAEF,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE;YACxC,IAAI,QAAQ;gBAAE,OAAO;YACrB,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YACnE,YAAY,IAAI,GAAG,CAAC,MAAM,CAAC;YAC3B,IAAI,YAAY,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBAC5C,QAAQ,GAAG,IAAI,CAAC;gBAChB,iCAAiC;gBACjC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBACrB,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;oBACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;oBAC5C,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;oBACpE,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;oBACrC,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;gBAC/B,CAAC;gBACD,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,CAAC;QACf,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACnC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAErC,KAAK,SAAS,CAAC,CAAC,QAAQ;YACtB,OAAO,IAAI,EAAE,CAAC;gBACZ,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC5B,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,EAAE,CACxD,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAC5B,CAAC;oBACF,IAAI,IAAI,KAAK,IAAI;wBAAE,OAAO;oBAC1B,MAAM,IAAI,CAAC;oBACX,SAAS;gBACX,CAAC;gBACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,EAAG,CAAC;gBAClC,mCAAmC;gBACnC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO;gBAC1D,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;oBAAE,MAAM,KAAK,CAAC;YACpC,CAAC;QACH,CAAC;QAED,MAAM,eAAe,GAAoB;YACvC,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK;YAC3B,IAAI,EAAE,GAAG,CAAC,GAAG,IAAI,GAAG;YACpB,OAAO;YACP,IAAI,EAAE,QAAQ,EAAE;YAChB,cAAc;YACd,OAAO;YACP,WAAW;YACX,aAAa;YACb,SAAS,EAAE,IAAI;SAChB,CAAC;QAEF,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,IAAI,CAAC;oBACH,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;oBACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;oBAC5C,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;gBAC5B,CAAC;gBAAC,MAAM,CAAC;oBACP,aAAa;gBACf,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,aAAa;gBAAE,GAAG,CAAC,GAAG,EAAE,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,aAAa;QACf,CAAC;IACH,CAAC;CACF;AAED,KAAK,SAAS,CAAC,CAAC,cAAc;IAC5B,IAAI,KAAgB;QAAE,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAwB;IAChD,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,OAAO;QACL,KAAK,CAAC,QAAQ,CAAC,IAA0B;YACvC,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC;YAC7B,0DAA0D;YAC1D,8DAA8D;YAC9D,mEAAmE;YACnE,4DAA4D;YAC5D,oDAAoD;YACpD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;YAC5C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBAClC,MAAM,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;gBAC3B,IAAI,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;oBAAE,SAAS;gBAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC7B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;oBACvB,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;gBACvB,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACf,CAAC;YACH,CAAC;YACD,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACnC,IAAI,CAAC;oBACH,2DAA2D;oBAC3D,2DAA2D;oBAC3D,4DAA4D;oBAC5D,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBAC9D,CAAC;gBAAC,MAAM,CAAC;oBACP,2BAA2B;gBAC7B,CAAC;YACH,CAAC;YACD,gEAAgE;YAChE,gDAAgD;YAChD,GAAG,CAAC,YAAY,EAAE,CAAC;QACrB,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,KAAa;YAC1B,IAAI,SAAS;gBAAE,OAAO;YACtB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC1C,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC7D,CAAC,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,OAAO;YACX,IAAI,SAAS;gBAAE,OAAO;YACtB,SAAS,GAAG,IAAI,CAAC;YACjB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,MAAc;YACxB,SAAS,GAAG,IAAI,CAAC;YACjB,8DAA8D;YAC9D,kDAAkD;YAClD,KAAK,MAAM,CAAC;YACZ,IAAI,CAAC;gBACH,GAAG,CAAC,OAAO,EAAE,CAAC;YAChB,CAAC;YAAC,MAAM,CAAC;gBACP,aAAa;YACf,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/tunnels/client/_h2_transcode.d.ts

@@ -0,0 +1,43 @@
+/**
+ * inkbox-tunnels/client/_h2_transcode.ts
+ *
+ * Server-side HTTP/2 fed by TLS plaintext via the WireDuplex pattern.
+ * Each h2 stream becomes a `DispatchRequest` handed to a `Dispatch`
+ * impl; the dispatcher's streamed response is encoded back into
+ * HEADERS+DATA+END_STREAM frames.
+ *
+ * Implements the Plaintext adapter contract used by the runtime in
+ * passthrough mode after the TLS terminator.
+ *
+ * WebSocket-over-h2 (RFC 8441 Extended CONNECT) is supported when the
+ * dispatcher exposes ``dispatchWebSocket``: the transcoder builds a
+ * byte-channel sink whose inbound DATA frames feed a frame decoder
+ * (unmasked per RFC 8441 §5.1) and whose outbound bytes ride h2 DATA
+ * frames. Dispatchers without that method respond ``:status 501``.
+ */
+import type { Dispatch } from "./_dispatch.js";
+export interface H2TranscoderPlaintextOpts {
+    dispatch: Dispatch;
+    maxInboundBodyBytes: number;
+    forwardedForIp: string | null;
+    sniHost: string | null;
+}
+/**
+ * h2 server fed by TLS plaintext; routes streams to a Dispatch impl.
+ * One instance per third-party TLS session.
+ */
+export declare class H2TranscoderPlaintext {
+    private readonly wire;
+    private readonly server;
+    private readonly maxInboundBodyBytes;
+    private readonly forwardedForIp;
+    private readonly sniHost;
+    private closed;
+    constructor(opts: H2TranscoderPlaintextOpts);
+    feed(plaintext: Buffer): Promise<void>;
+    pumpOutbound(send: (chunk: Buffer) => Promise<void>): Promise<void>;
+    aclose(): Promise<void>;
+    private handleStream;
+    private handleWebSocketStream;
+}
+//# sourceMappingURL=_h2_transcode.d.ts.map

package/dist/tunnels/client/_h2_transcode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_h2_transcode.d.ts","sourceRoot":"","sources":["../../../src/tunnels/client/_h2_transcode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,KAAK,EACV,QAAQ,EAIT,MAAM,gBAAgB,CAAC;AAyFxB,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,QAAQ,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED;;;GAGG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAe;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoB;IAC3C,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAS;IAC7C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAgB;IAC/C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;IACxC,OAAO,CAAC,MAAM,CAAS;gBAEX,IAAI,EAAE,yBAAyB;IAsBrC,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKtC,YAAY,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAYnE,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;YAWf,YAAY;YAwIZ,qBAAqB;CA2IpC"}