@jingyi0605/codingns 0.4.0 → 0.5.0

package/dist/server/modules/relay-tunnel/crypto/relay-tunnel-protocol.js

@@ -0,0 +1,302 @@
+import { createCipheriv, createDecipheriv, createHash, createHmac, createPrivateKey, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { buildRelayTunnelPublicKeyFingerprint } from "./relay-tunnel-identity-service.js";
+export const RELAY_TUNNEL_PROTOCOL_VERSION = 1;
+export const RELAY_TUNNEL_CIPHER_SUITE = "x25519-hkdf-sha256-aes-256-gcm";
+const RELAY_TUNNEL_KEY_ALGORITHM = "x25519";
+const RELAY_TUNNEL_FRAME_ALGORITHM = "aes-256-gcm";
+const RELAY_TUNNEL_FRAME_IV_LENGTH = 12;
+const RELAY_TUNNEL_FRAME_KEY_LENGTH = 32;
+export class RelayTunnelProtocolError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "RelayTunnelProtocolError";
+    }
+}
+export function createRelayTunnelClientHandshake(input) {
+    const expectedHostFingerprint = normalizeRequiredText(input.expectedHostFingerprint, "expectedHostFingerprint");
+    const expectedHostPublicKey = normalizeRequiredText(input.expectedHostPublicKey, "expectedHostPublicKey");
+    const actualFingerprint = buildRelayTunnelPublicKeyFingerprint(expectedHostPublicKey);
+    if (actualFingerprint !== expectedHostFingerprint) {
+        throw new RelayTunnelProtocolError("RELAY_TUNNEL_HOST_FINGERPRINT_MISMATCH", "客户端持有的 Host 公钥和指纹不一致");
+    }
+    const { privateKey, publicKey } = generateKeyPairSync(RELAY_TUNNEL_KEY_ALGORITHM);
+    const clientHello = {
+        version: RELAY_TUNNEL_PROTOCOL_VERSION,
+        cipherSuite: RELAY_TUNNEL_CIPHER_SUITE,
+        clientEphemeralPublicKey: exportPublicKeyAsSpkiBase64Url(publicKey),
+        clientNonce: randomBytes(16).toString("base64url"),
+        expectedHostFingerprint
+    };
+    return {
+        pendingHandshake: {
+            expectedHostPublicKey,
+            expectedHostFingerprint,
+            clientEphemeralPrivateKey: privateKey,
+            clientHello
+        },
+        clientHello
+    };
+}
+export function acceptRelayTunnelClientHandshake(input) {
+    validateHandshakeEnvelope(input.clientHello);
+    if (input.clientHello.expectedHostFingerprint !== input.hostIdentity.keyFingerprint) {
+        throw new RelayTunnelProtocolError("RELAY_TUNNEL_HOST_FINGERPRINT_MISMATCH", "客户端请求的 Host 指纹和当前 Host 身份不匹配");
+    }
+    const clientEphemeralPublicKey = importPublicKeyFromSpkiBase64Url(input.clientHello.clientEphemeralPublicKey);
+    const hostStaticPrivateKey = createPrivateKey(input.hostIdentity.privateKeyPem);
+    const { privateKey: serverEphemeralPrivateKey, publicKey: serverEphemeralPublicKey } = generateKeyPairSync(RELAY_TUNNEL_KEY_ALGORITHM);
+    const serverHello = {
+        version: RELAY_TUNNEL_PROTOCOL_VERSION,
+        cipherSuite: RELAY_TUNNEL_CIPHER_SUITE,
+        sessionId: randomUUID(),
+        hostPublicKey: input.hostIdentity.publicKeyPem,
+        hostKeyFingerprint: input.hostIdentity.keyFingerprint,
+        serverEphemeralPublicKey: exportPublicKeyAsSpkiBase64Url(serverEphemeralPublicKey),
+        serverNonce: randomBytes(16).toString("base64url"),
+        proof: ""
+    };
+    const transcriptHash = buildHandshakeTranscriptHash(input.clientHello, serverHello);
+    const ikm = deriveHandshakeInputKeyMaterial({
+        clientEphemeralPublicKey,
+        clientEphemeralPrivateKey: null,
+        hostStaticPrivateKey,
+        hostStaticPublicKey: null,
+        serverEphemeralPrivateKey,
+        serverEphemeralPublicKey: null
+    });
+    serverHello.proof = createHandshakeProof(ikm, transcriptHash);
+    return {
+        serverHello,
+        session: createRelayTunnelSession({
+            sessionId: serverHello.sessionId,
+            role: "host",
+            peerHostFingerprint: input.hostIdentity.keyFingerprint,
+            ikm,
+            transcriptHash
+        })
+    };
+}
+export function finalizeRelayTunnelClientHandshake(input) {
+    validateHandshakeEnvelope(input.pendingHandshake.clientHello);
+    validateServerHelloEnvelope(input.serverHello);
+    if (input.serverHello.hostKeyFingerprint !== input.pendingHandshake.expectedHostFingerprint) {
+        throw new RelayTunnelProtocolError("RELAY_TUNNEL_HOST_FINGERPRINT_MISMATCH", "服务端返回的 Host 指纹和客户端预期不一致");
+    }
+    const actualFingerprint = buildRelayTunnelPublicKeyFingerprint(input.serverHello.hostPublicKey);
+    if (actualFingerprint !== input.pendingHandshake.expectedHostFingerprint) {
+        throw new RelayTunnelProtocolError("RELAY_TUNNEL_HOST_FINGERPRINT_MISMATCH", "服务端返回的 Host 公钥与指纹不一致");
+    }
+    if (normalizePem(input.serverHello.hostPublicKey) !== normalizePem(input.pendingHandshake.expectedHostPublicKey)) {
+        throw new RelayTunnelProtocolError("RELAY_TUNNEL_HOST_PUBLIC_KEY_MISMATCH", "服务端返回的 Host 公钥和客户端持有的公钥不一致");
+    }
+    const transcriptHash = buildHandshakeTranscriptHash(input.pendingHandshake.clientHello, input.serverHello);
+    const ikm = deriveHandshakeInputKeyMaterial({
+        clientEphemeralPublicKey: null,
+        clientEphemeralPrivateKey: input.pendingHandshake.clientEphemeralPrivateKey,
+        hostStaticPrivateKey: null,
+        hostStaticPublicKey: createPublicKey(input.pendingHandshake.expectedHostPublicKey),
+        serverEphemeralPrivateKey: null,
+        serverEphemeralPublicKey: importPublicKeyFromSpkiBase64Url(input.serverHello.serverEphemeralPublicKey)
+    });
+    const expectedProof = createHandshakeProof(ikm, transcriptHash);
+    const expectedProofBuffer = Buffer.from(expectedProof, "utf8");
+    const actualProofBuffer = Buffer.from(input.serverHello.proof, "utf8");
+    if (expectedProofBuffer.length !== actualProofBuffer.length
+        || !timingSafeEqual(expectedProofBuffer, actualProofBuffer)) {
+        throw new RelayTunnelProtocolError("RELAY_TUNNEL_HANDSHAKE_PROOF_INVALID", "服务端握手证明无效");
+    }
+    return createRelayTunnelSession({
+        sessionId: input.serverHello.sessionId,
+        role: "client",
+        peerHostFingerprint: input.serverHello.hostKeyFingerprint,
+        ikm,
+        transcriptHash
+    });
+}
+export function encryptRelayTunnelFrame(session, payload) {
+    const nextSequence = session.sendSequence + 1;
+    const direction = resolveSendDirection(session.role);
+    const iv = randomBytes(RELAY_TUNNEL_FRAME_IV_LENGTH);
+    const cipher = createCipheriv(RELAY_TUNNEL_FRAME_ALGORITHM, session.sendKey, iv);
+    const plaintext = normalizePayload(payload);
+    const aad = buildFrameAad({
+        sessionId: session.sessionId,
+        direction,
+        sequence: nextSequence
+    });
+    cipher.setAAD(aad);
+    const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+    const authTag = cipher.getAuthTag();
+    session.sendSequence = nextSequence;
+    return {
+        version: RELAY_TUNNEL_PROTOCOL_VERSION,
+        cipherSuite: RELAY_TUNNEL_CIPHER_SUITE,
+        sessionId: session.sessionId,
+        direction,
+        sequence: nextSequence,
+        iv: iv.toString("base64url"),
+        authTag: authTag.toString("base64url"),
+        ciphertext: ciphertext.toString("base64url")
+    };
+}
+export function decryptRelayTunnelFrame(session, frame) {
+    validateFrameEnvelope(frame);
+    if (frame.sessionId !== session.sessionId) {
+        throw new RelayTunnelProtocolError("RELAY_TUNNEL_FRAME_SESSION_MISMATCH", "加密帧的会话标识和当前会话不匹配");
+    }
+    const expectedDirection = resolveReceiveDirection(session.role);
+    if (frame.direction !== expectedDirection) {
+        throw new RelayTunnelProtocolError("RELAY_TUNNEL_FRAME_DIRECTION_MISMATCH", "加密帧方向和当前接收方向不匹配");
+    }
+    const expectedSequence = session.receiveSequence + 1;
+    if (frame.sequence !== expectedSequence) {
+        throw new RelayTunnelProtocolError("RELAY_TUNNEL_FRAME_SEQUENCE_MISMATCH", `加密帧序号错误，期望 ${expectedSequence}，实际 ${frame.sequence}`);
+    }
+    const decipher = createDecipheriv(RELAY_TUNNEL_FRAME_ALGORITHM, session.receiveKey, Buffer.from(frame.iv, "base64url"));
+    const aad = buildFrameAad({
+        sessionId: frame.sessionId,
+        direction: frame.direction,
+        sequence: frame.sequence
+    });
+    decipher.setAAD(aad);
+    decipher.setAuthTag(Buffer.from(frame.authTag, "base64url"));
+    try {
+        const plaintext = Buffer.concat([
+            decipher.update(Buffer.from(frame.ciphertext, "base64url")),
+            decipher.final()
+        ]);
+        session.receiveSequence = frame.sequence;
+        return plaintext;
+    }
+    catch {
+        throw new RelayTunnelProtocolError("RELAY_TUNNEL_FRAME_AUTH_INVALID", "加密帧完整性校验失败");
+    }
+}
+function createRelayTunnelSession(input) {
+    const clientToHostKey = deriveSessionKey(input.ikm, input.transcriptHash, "codingns-relay-client-to-host");
+    const hostToClientKey = deriveSessionKey(input.ikm, input.transcriptHash, "codingns-relay-host-to-client");
+    return {
+        sessionId: input.sessionId,
+        role: input.role,
+        cipherSuite: RELAY_TUNNEL_CIPHER_SUITE,
+        peerHostFingerprint: input.peerHostFingerprint,
+        sendSequence: 0,
+        receiveSequence: 0,
+        sendKey: input.role === "client" ? clientToHostKey : hostToClientKey,
+        receiveKey: input.role === "client" ? hostToClientKey : clientToHostKey
+    };
+}
+function validateHandshakeEnvelope(hello) {
+    if (hello.version !== RELAY_TUNNEL_PROTOCOL_VERSION
+        || hello.cipherSuite !== RELAY_TUNNEL_CIPHER_SUITE) {
+        throw new RelayTunnelProtocolError("RELAY_TUNNEL_PROTOCOL_UNSUPPORTED", "客户端握手协议版本或套件不受支持");
+    }
+}
+function validateServerHelloEnvelope(hello) {
+    if (hello.version !== RELAY_TUNNEL_PROTOCOL_VERSION
+        || hello.cipherSuite !== RELAY_TUNNEL_CIPHER_SUITE) {
+        throw new RelayTunnelProtocolError("RELAY_TUNNEL_PROTOCOL_UNSUPPORTED", "服务端握手协议版本或套件不受支持");
+    }
+}
+function validateFrameEnvelope(frame) {
+    if (frame.version !== RELAY_TUNNEL_PROTOCOL_VERSION
+        || frame.cipherSuite !== RELAY_TUNNEL_CIPHER_SUITE) {
+        throw new RelayTunnelProtocolError("RELAY_TUNNEL_PROTOCOL_UNSUPPORTED", "加密帧协议版本或套件不受支持");
+    }
+}
+function deriveHandshakeInputKeyMaterial(input) {
+    const staticShared = input.hostStaticPrivateKey
+        ? diffieHellman({
+            privateKey: input.hostStaticPrivateKey,
+            publicKey: input.clientEphemeralPublicKey
+        })
+        : diffieHellman({
+            privateKey: input.clientEphemeralPrivateKey,
+            publicKey: input.hostStaticPublicKey
+        });
+    const ephemeralShared = input.serverEphemeralPrivateKey
+        ? diffieHellman({
+            privateKey: input.serverEphemeralPrivateKey,
+            publicKey: input.clientEphemeralPublicKey
+        })
+        : diffieHellman({
+            privateKey: input.clientEphemeralPrivateKey,
+            publicKey: input.serverEphemeralPublicKey
+        });
+    return Buffer.concat([staticShared, ephemeralShared]);
+}
+function buildHandshakeTranscriptHash(clientHello, serverHello) {
+    return createHash("sha256")
+        .update(JSON.stringify({
+        version: RELAY_TUNNEL_PROTOCOL_VERSION,
+        cipherSuite: RELAY_TUNNEL_CIPHER_SUITE,
+        clientEphemeralPublicKey: clientHello.clientEphemeralPublicKey,
+        clientNonce: clientHello.clientNonce,
+        expectedHostFingerprint: clientHello.expectedHostFingerprint,
+        hostPublicKey: normalizePem(serverHello.hostPublicKey),
+        hostKeyFingerprint: serverHello.hostKeyFingerprint,
+        serverEphemeralPublicKey: serverHello.serverEphemeralPublicKey,
+        serverNonce: serverHello.serverNonce,
+        sessionId: serverHello.sessionId
+    }))
+        .digest();
+}
+function createHandshakeProof(ikm, transcriptHash) {
+    const proofKey = hkdfBuffer(ikm, transcriptHash, "codingns-relay-handshake-proof");
+    return createHmac("sha256", proofKey)
+        .update(transcriptHash)
+        .digest("base64url");
+}
+function deriveSessionKey(ikm, transcriptHash, info) {
+    return hkdfBuffer(ikm, transcriptHash, info);
+}
+function hkdfBuffer(ikm, salt, info) {
+    return Buffer.from(hkdfSync("sha256", ikm, salt, Buffer.from(info, "utf8"), RELAY_TUNNEL_FRAME_KEY_LENGTH));
+}
+function buildFrameAad(input) {
+    return Buffer.from(JSON.stringify({
+        version: RELAY_TUNNEL_PROTOCOL_VERSION,
+        cipherSuite: RELAY_TUNNEL_CIPHER_SUITE,
+        sessionId: input.sessionId,
+        direction: input.direction,
+        sequence: input.sequence
+    }), "utf8");
+}
+function exportPublicKeyAsSpkiBase64Url(key) {
+    return key.export({
+        type: "spki",
+        format: "der"
+    }).toString("base64url");
+}
+function importPublicKeyFromSpkiBase64Url(value) {
+    return createPublicKey({
+        key: Buffer.from(value, "base64url"),
+        type: "spki",
+        format: "der"
+    });
+}
+function normalizePayload(payload) {
+    if (typeof payload === "string") {
+        return Buffer.from(payload, "utf8");
+    }
+    return Buffer.from(payload);
+}
+function resolveSendDirection(role) {
+    return role === "client" ? "client_to_host" : "host_to_client";
+}
+function resolveReceiveDirection(role) {
+    return role === "client" ? "host_to_client" : "client_to_host";
+}
+function normalizeRequiredText(value, field) {
+    const normalized = value.trim();
+    if (!normalized) {
+        throw new RelayTunnelProtocolError("RELAY_TUNNEL_PROTOCOL_UNSUPPORTED", `${field} 不能为空`);
+    }
+    return normalized;
+}
+function normalizePem(value) {
+    return value.trim().replace(/\r\n/g, "\n");
+}
+//# sourceMappingURL=relay-tunnel-protocol.js.map

package/dist/server/modules/relay-tunnel/crypto/relay-tunnel-protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay-tunnel-protocol.js","sourceRoot":"","sources":["../../../../../src/modules/relay-tunnel/crypto/relay-tunnel-protocol.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,QAAQ,EACR,WAAW,EACX,UAAU,EACV,eAAe,EAEhB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,oCAAoC,EAAE,MAAM,oCAAoC,CAAC;AAE1F,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC;AAC/C,MAAM,CAAC,MAAM,yBAAyB,GAAG,gCAAyC,CAAC;AAEnF,MAAM,0BAA0B,GAAG,QAAQ,CAAC;AAC5C,MAAM,4BAA4B,GAAG,aAAa,CAAC;AACnD,MAAM,4BAA4B,GAAG,EAAE,CAAC;AACxC,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAsDzC,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAEtC;IADX,YACW,IAQ4B,EACrC,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAXN,SAAI,GAAJ,IAAI,CAQwB;QAIrC,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED,MAAM,UAAU,gCAAgC,CAAC,KAGhD;IAIC,MAAM,uBAAuB,GAAG,qBAAqB,CACnD,KAAK,CAAC,uBAAuB,EAC7B,yBAAyB,CAC1B,CAAC;IACF,MAAM,qBAAqB,GAAG,qBAAqB,CACjD,KAAK,CAAC,qBAAqB,EAC3B,uBAAuB,CACxB,CAAC;IACF,MAAM,iBAAiB,GAAG,oCAAoC,CAAC,qBAAqB,CAAC,CAAC;IAEtF,IAAI,iBAAiB,KAAK,uBAAuB,EAAE,CAAC;QAClD,MAAM,IAAI,wBAAwB,CAChC,wCAAwC,EACxC,sBAAsB,CACvB,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,0BAA0B,CAAC,CAAC;IAClF,MAAM,WAAW,GAA2B;QAC1C,OAAO,EAAE,6BAA6B;QACtC,WAAW,EAAE,yBAAyB;QACtC,wBAAwB,EAAE,8BAA8B,CAAC,SAAS,CAAC;QACnE,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QAClD,uBAAuB;KACxB,CAAC;IAEF,OAAO;QACL,gBAAgB,EAAE;YAChB,qBAAqB;YACrB,uBAAuB;YACvB,yBAAyB,EAAE,UAAU;YACrC,WAAW;SACZ;QACD,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,KAGhD;IAIC,yBAAyB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAE7C,IAAI,KAAK,CAAC,WAAW,CAAC,uBAAuB,KAAK,KAAK,CAAC,YAAY,CAAC,cAAc,EAAE,CAAC;QACpF,MAAM,IAAI,wBAAwB,CAChC,wCAAwC,EACxC,8BAA8B,CAC/B,CAAC;IACJ,CAAC;IAED,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,WAAW,CAAC,wBAAwB,CAC3C,CAAC;IACF,MAAM,oBAAoB,GAAG,gBAAgB,CAAC,KAAK,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;IAChF,MAAM,EAAE,UAAU,EAAE,yBAAyB,EAAE,SAAS,EAAE,wBAAwB,EAAE,GAClF,mBAAmB,CAAC,0BAA0B,CAAC,CAAC;IAClD,MAAM,WAAW,GAA2B;QAC1C,OAAO,EAAE,6BAA6B;QACtC,WAAW,EAAE,yBAAyB;QACtC,SAAS,EAAE,UAAU,EAAE;QACvB,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC,YAAY;QAC9C,kBAAkB,EAAE,KAAK,CAAC,YAAY,CAAC,cAAc;QACrD,wBAAwB,EAAE,8BAA8B,CAAC,wBAAwB,CAAC;QAClF,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QAClD,KAAK,EAAE,EAAE;KACV,CAAC;IACF,MAAM,cAAc,GAAG,4BAA4B,CAAC,KAAK,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACpF,MAAM,GAAG,GAAG,+BAA+B,CAAC;QAC1C,wBAAwB;QACxB,yBAAyB,EAAE,IAAI;QAC/B,oBAAoB;QACpB,mBAAmB,EAAE,IAAI;QACzB,yBAAyB;QACzB,wBAAwB,EAAE,IAAI;KAC/B,CAAC,CAAC;IAEH,WAAW,CAAC,KAAK,GAAG,oBAAoB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAE9D,OAAO;QACL,WAAW;QACX,OAAO,EAAE,wBAAwB,CAAC;YAChC,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,IAAI,EAAE,MAAM;YACZ,mBAAmB,EAAE,KAAK,CAAC,YAAY,CAAC,cAAc;YACtD,GAAG;YACH,cAAc;SACf,CAAC;KACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kCAAkC,CAAC,KAGlD;IACC,yBAAyB,CAAC,KAAK,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC9D,2BAA2B,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAE/C,IAAI,KAAK,CAAC,WAAW,CAAC,kBAAkB,KAAK,KAAK,CAAC,gBAAgB,CAAC,uBAAuB,EAAE,CAAC;QAC5F,MAAM,IAAI,wBAAwB,CAChC,wCAAwC,EACxC,yBAAyB,CAC1B,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GAAG,oCAAoC,CAAC,KAAK,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;IAEhG,IAAI,iBAAiB,KAAK,KAAK,CAAC,gBAAgB,CAAC,uBAAuB,EAAE,CAAC;QACzE,MAAM,IAAI,wBAAwB,CAChC,wCAAwC,EACxC,sBAAsB,CACvB,CAAC;IACJ,CAAC;IAED,IAAI,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC,aAAa,CAAC,KAAK,YAAY,CAAC,KAAK,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACjH,MAAM,IAAI,wBAAwB,CAChC,uCAAuC,EACvC,4BAA4B,CAC7B,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,4BAA4B,CACjD,KAAK,CAAC,gBAAgB,CAAC,WAAW,EAClC,KAAK,CAAC,WAAW,CAClB,CAAC;IACF,MAAM,GAAG,GAAG,+BAA+B,CAAC;QAC1C,wBAAwB,EAAE,IAAI;QAC9B,yBAAyB,EAAE,KAAK,CAAC,gBAAgB,CAAC,yBAAyB;QAC3E,oBAAoB,EAAE,IAAI;QAC1B,mBAAmB,EAAE,eAAe,CAAC,KAAK,CAAC,gBAAgB,CAAC,qBAAqB,CAAC;QAClF,yBAAyB,EAAE,IAAI;QAC/B,wBAAwB,EAAE,gCAAgC,CACxD,KAAK,CAAC,WAAW,CAAC,wBAAwB,CAC3C;KACF,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,oBAAoB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAChE,MAAM,mBAAmB,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAC/D,MAAM,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAEvE,IACE,mBAAmB,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM;WACpD,CAAC,eAAe,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,EAC3D,CAAC;QACD,MAAM,IAAI,wBAAwB,CAChC,sCAAsC,EACtC,WAAW,CACZ,CAAC;IACJ,CAAC;IAED,OAAO,wBAAwB,CAAC;QAC9B,SAAS,EAAE,KAAK,CAAC,WAAW,CAAC,SAAS;QACtC,IAAI,EAAE,QAAQ;QACd,mBAAmB,EAAE,KAAK,CAAC,WAAW,CAAC,kBAAkB;QACzD,GAAG;QACH,cAAc;KACf,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,OAA2B,EAC3B,OAAqC;IAErC,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,GAAG,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,EAAE,GAAG,WAAW,CAAC,4BAA4B,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,cAAc,CAAC,4BAA4B,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACjF,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,aAAa,CAAC;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS;QACT,QAAQ,EAAE,YAAY;KACvB,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAEnB,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACpC,OAAO,CAAC,YAAY,GAAG,YAAY,CAAC;IAEpC,OAAO;QACL,OAAO,EAAE,6BAA6B;QACtC,WAAW,EAAE,yBAAyB;QACtC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS;QACT,QAAQ,EAAE,YAAY;QACtB,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC5B,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;QACtC,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,OAA2B,EAC3B,KAAgC;IAEhC,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAE7B,IAAI,KAAK,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;QAC1C,MAAM,IAAI,wBAAwB,CAChC,qCAAqC,EACrC,kBAAkB,CACnB,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhE,IAAI,KAAK,CAAC,SAAS,KAAK,iBAAiB,EAAE,CAAC;QAC1C,MAAM,IAAI,wBAAwB,CAChC,uCAAuC,EACvC,iBAAiB,CAClB,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAG,OAAO,CAAC,eAAe,GAAG,CAAC,CAAC;IAErD,IAAI,KAAK,CAAC,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QACxC,MAAM,IAAI,wBAAwB,CAChC,sCAAsC,EACtC,cAAc,gBAAgB,OAAO,KAAK,CAAC,QAAQ,EAAE,CACtD,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,4BAA4B,EAC5B,OAAO,CAAC,UAAU,EAClB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,WAAW,CAAC,CACnC,CAAC;IACF,MAAM,GAAG,GAAG,aAAa,CAAC;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;IAEH,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACrB,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;IAE7D,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;YAC3D,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC;QACH,OAAO,CAAC,eAAe,GAAG,KAAK,CAAC,QAAQ,CAAC;QACzC,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,wBAAwB,CAChC,iCAAiC,EACjC,YAAY,CACb,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,KAMjC;IACC,MAAM,eAAe,GAAG,gBAAgB,CACtC,KAAK,CAAC,GAAG,EACT,KAAK,CAAC,cAAc,EACpB,+BAA+B,CAChC,CAAC;IACF,MAAM,eAAe,GAAG,gBAAgB,CACtC,KAAK,CAAC,GAAG,EACT,KAAK,CAAC,cAAc,EACpB,+BAA+B,CAChC,CAAC;IAEF,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,yBAAyB;QACtC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,YAAY,EAAE,CAAC;QACf,eAAe,EAAE,CAAC;QAClB,OAAO,EAAE,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe;QACpE,UAAU,EAAE,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe;KACxE,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,KAA6B;IAC9D,IACE,KAAK,CAAC,OAAO,KAAK,6BAA6B;WAC5C,KAAK,CAAC,WAAW,KAAK,yBAAyB,EAClD,CAAC;QACD,MAAM,IAAI,wBAAwB,CAChC,mCAAmC,EACnC,kBAAkB,CACnB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAAC,KAA6B;IAChE,IACE,KAAK,CAAC,OAAO,KAAK,6BAA6B;WAC5C,KAAK,CAAC,WAAW,KAAK,yBAAyB,EAClD,CAAC;QACD,MAAM,IAAI,wBAAwB,CAChC,mCAAmC,EACnC,kBAAkB,CACnB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAgC;IAC7D,IACE,KAAK,CAAC,OAAO,KAAK,6BAA6B;WAC5C,KAAK,CAAC,WAAW,KAAK,yBAAyB,EAClD,CAAC;QACD,MAAM,IAAI,wBAAwB,CAChC,mCAAmC,EACnC,gBAAgB,CACjB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,+BAA+B,CAAC,KAOxC;IACC,MAAM,YAAY,GAAG,KAAK,CAAC,oBAAoB;QAC7C,CAAC,CAAC,aAAa,CAAC;YACd,UAAU,EAAE,KAAK,CAAC,oBAAoB;YACtC,SAAS,EAAE,KAAK,CAAC,wBAAyB;SAC3C,CAAC;QACF,CAAC,CAAC,aAAa,CAAC;YACd,UAAU,EAAE,KAAK,CAAC,yBAA0B;YAC5C,SAAS,EAAE,KAAK,CAAC,mBAAoB;SACtC,CAAC,CAAC;IACL,MAAM,eAAe,GAAG,KAAK,CAAC,yBAAyB;QACrD,CAAC,CAAC,aAAa,CAAC;YACd,UAAU,EAAE,KAAK,CAAC,yBAAyB;YAC3C,SAAS,EAAE,KAAK,CAAC,wBAAyB;SAC3C,CAAC;QACF,CAAC,CAAC,aAAa,CAAC;YACd,UAAU,EAAE,KAAK,CAAC,yBAA0B;YAC5C,SAAS,EAAE,KAAK,CAAC,wBAAyB;SAC3C,CAAC,CAAC;IAEL,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,4BAA4B,CACnC,WAAmC,EACnC,WAAmC;IAEnC,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CACL,IAAI,CAAC,SAAS,CAAC;QACb,OAAO,EAAE,6BAA6B;QACtC,WAAW,EAAE,yBAAyB;QACtC,wBAAwB,EAAE,WAAW,CAAC,wBAAwB;QAC9D,WAAW,EAAE,WAAW,CAAC,WAAW;QACpC,uBAAuB,EAAE,WAAW,CAAC,uBAAuB;QAC5D,aAAa,EAAE,YAAY,CAAC,WAAW,CAAC,aAAa,CAAC;QACtD,kBAAkB,EAAE,WAAW,CAAC,kBAAkB;QAClD,wBAAwB,EAAE,WAAW,CAAC,wBAAwB;QAC9D,WAAW,EAAE,WAAW,CAAC,WAAW;QACpC,SAAS,EAAE,WAAW,CAAC,SAAS;KACjC,CAAC,CACH;SACA,MAAM,EAAE,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAW,EAAE,cAAsB;IAC/D,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,cAAc,EAAE,gCAAgC,CAAC,CAAC;IAEnF,OAAO,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC;SAClC,MAAM,CAAC,cAAc,CAAC;SACtB,MAAM,CAAC,WAAW,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW,EAAE,cAAsB,EAAE,IAAY;IACzE,OAAO,UAAU,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,IAAY,EAAE,IAAY;IACzD,OAAO,MAAM,CAAC,IAAI,CAChB,QAAQ,CACN,QAAQ,EACR,GAAG,EACH,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EACzB,6BAA6B,CAC9B,CACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAItB;IACC,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,CAAC,SAAS,CAAC;QACb,OAAO,EAAE,6BAA6B;QACtC,WAAW,EAAE,yBAAyB;QACtC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,EACF,MAAM,CACP,CAAC;AACJ,CAAC;AAED,SAAS,8BAA8B,CAAC,GAAc;IACpD,OAAO,GAAG,CAAC,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,KAAK;KACd,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,gCAAgC,CAAC,KAAa;IACrD,OAAO,eAAe,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC;QACpC,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAqC;IAC7D,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,oBAAoB,CAAC,IAA6B;IACzD,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;AACjE,CAAC;AAED,SAAS,uBAAuB,CAAC,IAA6B;IAC5D,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;AACjE,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa,EAAE,KAAa;IACzD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAEhC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,wBAAwB,CAChC,mCAAmC,EACnC,GAAG,KAAK,OAAO,CAChB,CAAC;IACJ,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAC7C,CAAC"}

package/dist/server/modules/relay-tunnel/relay-tunnel-controller.d.ts

@@ -0,0 +1,33 @@
+import type { FastifyReply, FastifyRequest } from "fastify";
+import type { RelayTunnelControlLoginInput, RelayTunnelBindInput, RelayTunnelConfigUpdateInput } from "./relay-tunnel-service.js";
+import { RelayTunnelService } from "./relay-tunnel-service.js";
+export declare class RelayTunnelController {
+    private readonly relayTunnelService;
+    constructor(relayTunnelService: RelayTunnelService);
+    readonly getStatus: (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+    readonly ensureIdentity: (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+    readonly updateConfig: (request: FastifyRequest<{
+        Body: RelayTunnelConfigUpdateInput;
+    }>, reply: FastifyReply) => Promise<void>;
+    readonly loginControl: (request: FastifyRequest<{
+        Body: RelayTunnelControlLoginInput;
+    }>, reply: FastifyReply) => Promise<void>;
+    readonly logoutControl: (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+    readonly checkHostLabelAvailability: (request: FastifyRequest<{
+        Querystring: {
+            hostLabel?: string;
+        };
+    }>, reply: FastifyReply) => Promise<void>;
+    readonly bindControlHost: (request: FastifyRequest<{
+        Body: {
+            hostLabel?: string;
+        };
+    }>, reply: FastifyReply) => Promise<void>;
+    readonly getTrafficWallet: (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+    readonly bind: (request: FastifyRequest<{
+        Body: RelayTunnelBindInput;
+    }>, reply: FastifyReply) => Promise<void>;
+    readonly unbind: (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+    readonly enable: (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+    readonly disable: (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+}

package/dist/server/modules/relay-tunnel/relay-tunnel-controller.js

@@ -0,0 +1,57 @@
+import { requireUserId } from "../preferences/common.js";
+export class RelayTunnelController {
+    relayTunnelService;
+    constructor(relayTunnelService) {
+        this.relayTunnelService = relayTunnelService;
+    }
+    getStatus = async (request, reply) => {
+        requireUserId(request);
+        reply.send(await this.relayTunnelService.getStatus());
+    };
+    ensureIdentity = async (request, reply) => {
+        requireUserId(request);
+        reply.send(await this.relayTunnelService.ensureIdentity());
+    };
+    updateConfig = async (request, reply) => {
+        requireUserId(request);
+        reply.send(await this.relayTunnelService.updateConfig(request.body ?? {}));
+    };
+    loginControl = async (request, reply) => {
+        requireUserId(request);
+        reply.send(await this.relayTunnelService.loginControl(request.body ?? {}));
+    };
+    logoutControl = async (request, reply) => {
+        requireUserId(request);
+        reply.send(await this.relayTunnelService.logoutControl());
+    };
+    checkHostLabelAvailability = async (request, reply) => {
+        requireUserId(request);
+        reply.send(await this.relayTunnelService.checkHostLabelAvailability(request.query.hostLabel ?? ""));
+    };
+    bindControlHost = async (request, reply) => {
+        requireUserId(request);
+        reply.send(await this.relayTunnelService.bindControlHost(request.body?.hostLabel ?? ""));
+    };
+    getTrafficWallet = async (request, reply) => {
+        requireUserId(request);
+        const wallet = await this.relayTunnelService.getTrafficWallet();
+        reply.send({ wallet });
+    };
+    bind = async (request, reply) => {
+        requireUserId(request);
+        reply.send(await this.relayTunnelService.bind(request.body ?? {}));
+    };
+    unbind = async (request, reply) => {
+        requireUserId(request);
+        reply.send(await this.relayTunnelService.unbind());
+    };
+    enable = async (request, reply) => {
+        requireUserId(request);
+        reply.send(await this.relayTunnelService.enable());
+    };
+    disable = async (request, reply) => {
+        requireUserId(request);
+        reply.send(await this.relayTunnelService.disable());
+    };
+}
+//# sourceMappingURL=relay-tunnel-controller.js.map

package/dist/server/modules/relay-tunnel/relay-tunnel-controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay-tunnel-controller.js","sourceRoot":"","sources":["../../../../src/modules/relay-tunnel/relay-tunnel-controller.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAQzD,MAAM,OAAO,qBAAqB;IACH;IAA7B,YAA6B,kBAAsC;QAAtC,uBAAkB,GAAlB,kBAAkB,CAAoB;IAAG,CAAC;IAE9D,SAAS,GAAG,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAiB,EAAE;QACzF,aAAa,CAAC,OAAO,CAAC,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,CAAC,CAAC;IACxD,CAAC,CAAC;IAEO,cAAc,GAAG,KAAK,EAC7B,OAAuB,EACvB,KAAmB,EACJ,EAAE;QACjB,aAAa,CAAC,OAAO,CAAC,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC;IAEO,YAAY,GAAG,KAAK,EAC3B,OAA+D,EAC/D,KAAmB,EACJ,EAAE;QACjB,aAAa,CAAC,OAAO,CAAC,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7E,CAAC,CAAC;IAEO,YAAY,GAAG,KAAK,EAC3B,OAA+D,EAC/D,KAAmB,EACJ,EAAE;QACjB,aAAa,CAAC,OAAO,CAAC,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7E,CAAC,CAAC;IAEO,aAAa,GAAG,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAiB,EAAE;QAC7F,aAAa,CAAC,OAAO,CAAC,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC;IAEO,0BAA0B,GAAG,KAAK,EACzC,OAAgE,EAChE,KAAmB,EACJ,EAAE;QACjB,aAAa,CAAC,OAAO,CAAC,CAAC;QACvB,KAAK,CAAC,IAAI,CACR,MAAM,IAAI,CAAC,kBAAkB,CAAC,0BAA0B,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CACxF,CAAC;IACJ,CAAC,CAAC;IAEO,eAAe,GAAG,KAAK,EAC9B,OAAyD,EACzD,KAAmB,EACJ,EAAE;QACjB,aAAa,CAAC,OAAO,CAAC,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;IAC3F,CAAC,CAAC;IAEO,gBAAgB,GAAG,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAiB,EAAE;QAChG,aAAa,CAAC,OAAO,CAAC,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,EAAE,CAAC;QAChE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACzB,CAAC,CAAC;IAEO,IAAI,GAAG,KAAK,EACnB,OAAuD,EACvD,KAAmB,EACJ,EAAE;QACjB,aAAa,CAAC,OAAO,CAAC,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IACrE,CAAC,CAAC;IAEO,MAAM,GAAG,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAiB,EAAE;QACtF,aAAa,CAAC,OAAO,CAAC,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC,CAAC;IACrD,CAAC,CAAC;IAEO,MAAM,GAAG,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAiB,EAAE;QACtF,aAAa,CAAC,OAAO,CAAC,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC,CAAC;IACrD,CAAC,CAAC;IAEO,OAAO,GAAG,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAiB,EAAE;QACvF,aAAa,CAAC,OAAO,CAAC,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC;CACH"}

package/dist/server/modules/relay-tunnel/relay-tunnel-edge-proof.d.ts

@@ -0,0 +1,9 @@
+export declare function createRelayTunnelHostClaimProof(input: {
+    challengeId: string;
+    bindingId: string;
+    tunnelDomain: string;
+    hostFingerprint: string;
+    relayNonce: string;
+    relayPublicKey: string;
+    hostPrivateKeyPem: string;
+}): string;

package/dist/server/modules/relay-tunnel/relay-tunnel-edge-proof.js

@@ -0,0 +1,25 @@
+import { createHash, createHmac, createPrivateKey, createPublicKey, diffieHellman, hkdfSync } from "node:crypto";
+export function createRelayTunnelHostClaimProof(input) {
+    const transcript = Buffer.from(JSON.stringify({
+        challengeId: input.challengeId.trim(),
+        bindingId: input.bindingId.trim(),
+        tunnelDomain: input.tunnelDomain.trim().toLowerCase(),
+        hostFingerprint: input.hostFingerprint.trim(),
+        relayPublicKey: input.relayPublicKey.trim(),
+        relayNonce: input.relayNonce.trim()
+    }), "utf8");
+    const transcriptHash = createHash("sha256").update(transcript).digest();
+    const sharedSecret = diffieHellman({
+        privateKey: createPrivateKey(input.hostPrivateKeyPem),
+        publicKey: createPublicKey({
+            key: Buffer.from(input.relayPublicKey, "base64url"),
+            type: "spki",
+            format: "der"
+        })
+    });
+    const proofKey = Buffer.from(hkdfSync("sha256", sharedSecret, transcriptHash, Buffer.from("codingns-relay-host-claim-proof", "utf8"), 32));
+    return createHmac("sha256", proofKey)
+        .update(transcriptHash)
+        .digest("base64url");
+}
+//# sourceMappingURL=relay-tunnel-edge-proof.js.map

package/dist/server/modules/relay-tunnel/relay-tunnel-edge-proof.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay-tunnel-edge-proof.js","sourceRoot":"","sources":["../../../../src/modules/relay-tunnel/relay-tunnel-edge-proof.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,QAAQ,EACT,MAAM,aAAa,CAAC;AAErB,MAAM,UAAU,+BAA+B,CAAC,KAQ/C;IACC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAC5B,IAAI,CAAC,SAAS,CAAC;QACb,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE;QACrC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE;QACjC,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;QACrD,eAAe,EAAE,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE;QAC7C,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE;QAC3C,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE;KACpC,CAAC,EACF,MAAM,CACP,CAAC;IACF,MAAM,cAAc,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,CAAC;IACxE,MAAM,YAAY,GAAG,aAAa,CAAC;QACjC,UAAU,EAAE,gBAAgB,CAAC,KAAK,CAAC,iBAAiB,CAAC;QACrD,SAAS,EAAE,eAAe,CAAC;YACzB,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,WAAW,CAAC;YACnD,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,KAAK;SACd,CAAC;KACH,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAC1B,QAAQ,CACN,QAAQ,EACR,YAAY,EACZ,cAAc,EACd,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,MAAM,CAAC,EACtD,EAAE,CACH,CACF,CAAC;IAEF,OAAO,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC;SAClC,MAAM,CAAC,cAAc,CAAC;SACtB,MAAM,CAAC,WAAW,CAAC,CAAC;AACzB,CAAC"}

package/dist/server/modules/relay-tunnel/relay-tunnel-gateway-service.d.ts

@@ -0,0 +1,18 @@
+import type { RelayTunnelGatewayPacket } from "./crypto/relay-tunnel-packets.js";
+export declare class RelayTunnelGatewayService {
+    private readonly localHttpBaseUrl;
+    private readonly localWsBaseUrl;
+    private readonly wsSockets;
+    constructor(options: {
+        localTargetBaseUrl: string;
+        onPacket: (packet: RelayTunnelGatewayPacket) => void | Promise<void>;
+    });
+    private readonly onPacket;
+    handlePacket(packet: RelayTunnelGatewayPacket): Promise<void>;
+    close(): void;
+    private handleHttpRequest;
+    private handleWsOpen;
+    private handleWsMessage;
+    private handleWsClosed;
+    private emitError;
+}