@limrun/api 0.48.3 → 0.49.0

package/destination-tunnel.js

@@ -1,37 +1,59 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DestinationTunnelProtocolError = exports.DestinationTunnelRouteError = exports.DESTINATION_TUNNEL_CONN_ID_HEADER_BYTES = exports.DESTINATION_TUNNEL_MAX_ROUTES = exports.DESTINATION_TUNNEL_VERSION = void 0;
+exports.DestinationTunnelSelectorError = exports.DESTINATION_TUNNEL_MAX_TTL_SECONDS = exports.DESTINATION_TUNNEL_DEFAULT_TTL_SECONDS = exports.DESTINATION_TUNNEL_MAX_BODY_BYTES = exports.DESTINATION_TUNNEL_DEFAULT_MAX_BODY_BYTES = exports.DESTINATION_TUNNEL_MAX_WINDOW_INCREMENT = exports.DESTINATION_TUNNEL_DEFAULT_WINDOW = exports.DESTINATION_TUNNEL_MAX_WINDOW = exports.DESTINATION_TUNNEL_FAKE_RANGE = exports.DESTINATION_TUNNEL_CONN_ID_HEADER_BYTES = exports.DESTINATION_TUNNEL_MAX_DOMAINS = exports.DESTINATION_TUNNEL_MAX_ROUTES = exports.DESTINATION_TUNNEL_VERSION = exports.DestinationTunnelProtocolError = void 0;
 exports.encodeDestinationTunnelDataFrame = encodeDestinationTunnelDataFrame;
 exports.decodeDestinationTunnelDataFrame = decodeDestinationTunnelDataFrame;
 exports.validateDestinationTunnelRoutes = validateDestinationTunnelRoutes;
+exports.validateDestinationTunnelSelectors = validateDestinationTunnelSelectors;
+exports.classifyDestinationTunnelSelectors = classifyDestinationTunnelSelectors;
+exports.validateDestinationTunnelDomains = validateDestinationTunnelDomains;
+exports.destinationTunnelConfigHash = destinationTunnelConfigHash;
+exports.normalizeDestinationTunnelInspection = normalizeDestinationTunnelInspection;
+exports.disabledDestinationTunnelInspection = disabledDestinationTunnelInspection;
+exports.destinationTunnelSelectorIds = destinationTunnelSelectorIds;
+exports.destinationTunnelDomainMatches = destinationTunnelDomainMatches;
 exports.assertDestinationTunnelOpenAllowed = assertDestinationTunnelOpenAllowed;
 exports.assertDestinationTunnelReady = assertDestinationTunnelReady;
 exports.encodeDestinationTunnelClientMessage = encodeDestinationTunnelClientMessage;
 exports.decodeDestinationTunnelServerMessage = decodeDestinationTunnelServerMessage;
 const tslib_1 = require("./internal/tslib.js");
+const crypto_1 = tslib_1.__importDefault(require("crypto"));
 const net_1 = tslib_1.__importDefault(require("net"));
+const url_1 = require("url");
+const destination_tunnel_wire_reader_1 = require("./internal/destination-tunnel-wire-reader.js");
+var destination_tunnel_wire_reader_2 = require("./internal/destination-tunnel-wire-reader.js");
+Object.defineProperty(exports, "DestinationTunnelProtocolError", { enumerable: true, get: function () { return destination_tunnel_wire_reader_2.DestinationTunnelProtocolError; } });
 exports.DESTINATION_TUNNEL_VERSION = 1;
 exports.DESTINATION_TUNNEL_MAX_ROUTES = 10;
+exports.DESTINATION_TUNNEL_MAX_DOMAINS = 64;
 exports.DESTINATION_TUNNEL_CONN_ID_HEADER_BYTES = 4;
-class DestinationTunnelRouteError extends Error {
+/**
+ * IPv4 range used by the device side for synthetic (fake) DNS answers of
+ * matched domain selectors.
+ */
+exports.DESTINATION_TUNNEL_FAKE_RANGE = '198.18.0.0/15';
+/** Upper bound for per-flow receive windows advertised in open/openOk. */
+exports.DESTINATION_TUNNEL_MAX_WINDOW = 64 * 1024 * 1024;
+/** Default receive window advertised by generic SDK tunnel clients. */
+exports.DESTINATION_TUNNEL_DEFAULT_WINDOW = 1024 * 1024;
+/** Upper bound for a single windowUpdate increment. */
+exports.DESTINATION_TUNNEL_MAX_WINDOW_INCREMENT = 2147483647;
+exports.DESTINATION_TUNNEL_DEFAULT_MAX_BODY_BYTES = 10 * 1024 * 1024;
+exports.DESTINATION_TUNNEL_MAX_BODY_BYTES = 64 * 1024 * 1024;
+exports.DESTINATION_TUNNEL_DEFAULT_TTL_SECONDS = 72 * 60 * 60;
+exports.DESTINATION_TUNNEL_MAX_TTL_SECONDS = 30 * 24 * 60 * 60;
+class DestinationTunnelSelectorError extends Error {
     constructor(code, message) {
         super(message);
         this.code = code;
-        this.name = 'DestinationTunnelRouteError';
+        this.name = 'DestinationTunnelSelectorError';
     }
 }
-exports.DestinationTunnelRouteError = DestinationTunnelRouteError;
-class DestinationTunnelProtocolError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = 'DestinationTunnelProtocolError';
-    }
-}
-exports.DestinationTunnelProtocolError = DestinationTunnelProtocolError;
+exports.DestinationTunnelSelectorError = DestinationTunnelSelectorError;
 function encodeDestinationTunnelDataFrame(connId, payload) {
     validateConnectionId(connId);
     if (payload.length === 0) {
-        throw new DestinationTunnelProtocolError('tunnel data frame must include a payload');
+        throw new destination_tunnel_wire_reader_1.DestinationTunnelProtocolError('tunnel data frame must include a payload');
     }
     const frame = Buffer.allocUnsafe(exports.DESTINATION_TUNNEL_CONN_ID_HEADER_BYTES + payload.length);
     frame.writeUInt32BE(connId, 0);
@@ -40,58 +62,220 @@ function encodeDestinationTunnelDataFrame(connId, payload) {
 }
 function decodeDestinationTunnelDataFrame(frame) {
     if (frame.length <= exports.DESTINATION_TUNNEL_CONN_ID_HEADER_BYTES) {
-        throw new DestinationTunnelProtocolError('tunnel data frame must include a payload');
+        throw new destination_tunnel_wire_reader_1.DestinationTunnelProtocolError('tunnel data frame must include a payload');
     }
     return {
         connId: frame.readUInt32BE(0),
         payload: frame.subarray(exports.DESTINATION_TUNNEL_CONN_ID_HEADER_BYTES),
     };
 }
-function validateDestinationTunnelRoutes(routes) {
+function validateDestinationTunnelRoutes(routes, options = {}) {
     if (routes.length === 0) {
-        throw new DestinationTunnelRouteError('empty', 'at least one tunnel route is required');
+        throw new DestinationTunnelSelectorError('empty', 'at least one tunnel route is required');
     }
     if (routes.length > exports.DESTINATION_TUNNEL_MAX_ROUTES) {
-        throw new DestinationTunnelRouteError('too_many', `at most ${exports.DESTINATION_TUNNEL_MAX_ROUTES} tunnel routes are allowed`);
+        throw new DestinationTunnelSelectorError('too_many', `at most ${exports.DESTINATION_TUNNEL_MAX_ROUTES} tunnel routes are allowed`);
     }
     const canonicalRoutes = [];
     const seen = new Set();
     for (const route of routes) {
-        const canonical = canonicalizeDestinationTunnelRoute(route);
+        const canonical = canonicalizeDestinationTunnelRoute(route, options.minPort);
         const key = `${canonical.host}\0${canonical.port}`;
         if (seen.has(key)) {
-            throw new DestinationTunnelRouteError('duplicate', `duplicate tunnel route ${canonical.host}:${canonical.port}`);
+            throw new DestinationTunnelSelectorError('duplicate', `duplicate tunnel route ${canonical.host}:${canonical.port}`);
         }
         seen.add(key);
         canonicalRoutes.push(canonical);
     }
     return canonicalRoutes;
 }
-function assertDestinationTunnelOpenAllowed(message, routes) {
-    const index = parseRouteId(message.routeId);
-    const route = routes[index];
-    if (!route || message.host !== route.host || message.port !== route.port || message.proto !== 'tcp') {
-        throw new DestinationTunnelProtocolError(`server requested undeclared route ${message.routeId} ${message.host}:${message.port}/${message.proto}`);
+/**
+ * Validate and canonicalize a full selector set. Selector policy specific to
+ * one product (such as the Android bind-listener minimum route port) is
+ * expressed via options rather than separate message shapes.
+ */
+function validateDestinationTunnelSelectors(selectors, options = {}) {
+    if (!Array.isArray(selectors)) {
+        throw new DestinationTunnelSelectorError('invalid_host', 'tunnel selectors must be an array');
+    }
+    if (selectors.length === 0) {
+        throw new DestinationTunnelSelectorError('empty', 'at least one tunnel selector is required');
+    }
+    const canonical = [];
+    const seen = new Set();
+    let routeCount = 0;
+    let domainCount = 0;
+    for (const selector of selectors) {
+        const parsed = parseDestinationTunnelSelector(selector, options.minRoutePort);
+        if (parsed.route)
+            routeCount++;
+        else
+            domainCount++;
+        if (routeCount > exports.DESTINATION_TUNNEL_MAX_ROUTES) {
+            throw new DestinationTunnelSelectorError('too_many', `at most ${exports.DESTINATION_TUNNEL_MAX_ROUTES} exact tunnel selectors are allowed`);
+        }
+        if (domainCount > exports.DESTINATION_TUNNEL_MAX_DOMAINS) {
+            throw new DestinationTunnelSelectorError('too_many', `at most ${exports.DESTINATION_TUNNEL_MAX_DOMAINS} domain tunnel selectors are allowed`);
+        }
+        if (seen.has(parsed.value)) {
+            throw new DestinationTunnelSelectorError('duplicate', `duplicate tunnel selector ${parsed.value}`);
+        }
+        seen.add(parsed.value);
+        canonical.push(parsed.value);
+    }
+    return canonical;
+}
+function classifyDestinationTunnelSelectors(selectors, options = {}) {
+    const canonical = validateDestinationTunnelSelectors(selectors, options);
+    const routes = [];
+    const domains = [];
+    for (const selector of canonical) {
+        const parsed = parseDestinationTunnelSelector(selector, options.minRoutePort);
+        if (parsed.route)
+            routes.push(parsed.route);
+        else
+            domains.push(parsed.domain);
+    }
+    return {
+        ...(routes.length > 0 ? { routes } : {}),
+        ...(domains.length > 0 ? { domains } : {}),
+    };
+}
+function validateDestinationTunnelDomains(domains) {
+    if (domains.length > exports.DESTINATION_TUNNEL_MAX_DOMAINS) {
+        throw new DestinationTunnelSelectorError('too_many', `at most ${exports.DESTINATION_TUNNEL_MAX_DOMAINS} tunnel domains are allowed`);
+    }
+    const canonical = [];
+    const seen = new Set();
+    for (const domain of domains) {
+        const normalized = canonicalizeDestinationTunnelDomain(domain);
+        if (seen.has(normalized)) {
+            throw new DestinationTunnelSelectorError('duplicate', `duplicate tunnel domain ${normalized}`);
+        }
+        seen.add(normalized);
+        canonical.push(normalized);
+    }
+    return canonical;
+}
+/**
+ * Deterministic hash of the canonical selector configuration. Servers echo it
+ * in `ready` so clients can detect config mismatches across reconnects. The
+ * hashed JSON has fixed key order.
+ */
+function destinationTunnelConfigHash(selectors, inspection = disabledDestinationTunnelInspection()) {
+    const canonical = validateDestinationTunnelSelectors(selectors);
+    const canonicalInspection = normalizeDestinationTunnelInspection(inspection);
+    const parts = [
+        `"version":${exports.DESTINATION_TUNNEL_VERSION}`,
+        `"selectors":[${canonical.map((selector) => JSON.stringify(selector)).join(',')}]`,
+    ];
+    parts.push(`"inspection":{"enabled":${canonicalInspection.enabled},"captureBodies":${canonicalInspection.captureBodies},"maxBodyBytes":${canonicalInspection.maxBodyBytes},"persist":${canonicalInspection.persist},"ttlSeconds":${canonicalInspection.ttlSeconds}}`);
+    return crypto_1.default
+        .createHash('sha256')
+        .update(`{${parts.join(',')}}`, 'utf8')
+        .digest('hex');
+}
+function normalizeDestinationTunnelInspection(inspection) {
+    const enabled = inspection.enabled ?? false;
+    const captureBodies = inspection.captureBodies ?? false;
+    const maxBodyBytes = inspection.maxBodyBytes ?? exports.DESTINATION_TUNNEL_DEFAULT_MAX_BODY_BYTES;
+    const persist = inspection.persist ?? false;
+    const ttlSeconds = inspection.ttlSeconds ?? exports.DESTINATION_TUNNEL_DEFAULT_TTL_SECONDS;
+    if (captureBodies && !enabled) {
+        throw new destination_tunnel_wire_reader_1.DestinationTunnelProtocolError('captureBodies requires inspection to be enabled');
+    }
+    if (persist && !enabled) {
+        throw new destination_tunnel_wire_reader_1.DestinationTunnelProtocolError('persist requires inspection to be enabled');
+    }
+    if (!Number.isInteger(maxBodyBytes) ||
+        maxBodyBytes < 1 ||
+        maxBodyBytes > exports.DESTINATION_TUNNEL_MAX_BODY_BYTES) {
+        throw new destination_tunnel_wire_reader_1.DestinationTunnelProtocolError(`maxBodyBytes must be an integer between 1 and ${exports.DESTINATION_TUNNEL_MAX_BODY_BYTES}`);
+    }
+    if (!Number.isInteger(ttlSeconds) || ttlSeconds < 1 || ttlSeconds > exports.DESTINATION_TUNNEL_MAX_TTL_SECONDS) {
+        throw new destination_tunnel_wire_reader_1.DestinationTunnelProtocolError(`ttlSeconds must be an integer between 1 and ${exports.DESTINATION_TUNNEL_MAX_TTL_SECONDS}`);
+    }
+    return { enabled, captureBodies, maxBodyBytes, persist, ttlSeconds };
+}
+function disabledDestinationTunnelInspection() {
+    return normalizeDestinationTunnelInspection({ enabled: false, captureBodies: false });
+}
+/** Selector IDs are one-based positions in the canonical selector array. */
+function destinationTunnelSelectorIds(selectors) {
+    return validateDestinationTunnelSelectors(selectors).map((_, index) => `selector-${index + 1}`);
+}
+function destinationTunnelDomainMatches(pattern, host) {
+    const candidate = host.toLowerCase();
+    if (pattern.startsWith('*.')) {
+        const base = pattern.slice(2);
+        return candidate.length > base.length + 1 && candidate.endsWith(`.${base}`);
+    }
+    return candidate === pattern;
+}
+/**
+ * Verify a server OPEN against the negotiated selectors. Every OPEN must name
+ * a known selector ID and a target that the selector actually covers.
+ */
+function assertDestinationTunnelOpenAllowed(message, selectors) {
+    const canonical = validateDestinationTunnelSelectors(selectors);
+    const match = /^selector-([1-9]\d*)$/.exec(message.selectorId);
+    const index = match?.[1] ? Number(match[1]) - 1 : -1;
+    const fail = () => {
+        throw new destination_tunnel_wire_reader_1.DestinationTunnelProtocolError(`server requested undeclared selector ${message.selectorId} ${message.host}:${message.port}`);
+    };
+    if (index < 0)
+        fail();
+    if (message.port === 53)
+        fail();
+    const selector = canonical[index];
+    if (selector === undefined)
+        return fail();
+    const parsed = parseDestinationTunnelSelector(selector);
+    if (parsed.route) {
+        if (message.host !== parsed.route.host || message.port !== parsed.route.port)
+            fail();
+        return 'route';
     }
+    if (!destinationTunnelDomainMatches(parsed.domain, message.host))
+        fail();
+    return 'domain';
 }
 function assertDestinationTunnelReady(message) {
     if (message.version !== exports.DESTINATION_TUNNEL_VERSION) {
-        throw new DestinationTunnelProtocolError(`unsupported tunnel version ${message.version}`);
+        throw new destination_tunnel_wire_reader_1.DestinationTunnelProtocolError(`unsupported tunnel version ${message.version}`);
     }
 }
 function encodeDestinationTunnelClientMessage(message) {
-    const record = readRecord(message, 'tunnel control message');
-    const type = readString(record, 'type');
+    const record = (0, destination_tunnel_wire_reader_1.readRecord)(message, 'tunnel control message');
+    const type = (0, destination_tunnel_wire_reader_1.readString)(record, 'type');
     switch (type) {
         case 'start': {
-            const version = readInteger(record, 'version');
+            const version = (0, destination_tunnel_wire_reader_1.readInteger)(record, 'version');
             if (version !== exports.DESTINATION_TUNNEL_VERSION) {
-                throw new DestinationTunnelProtocolError(`unsupported tunnel version ${version}`);
+                throw new destination_tunnel_wire_reader_1.DestinationTunnelProtocolError(`unsupported tunnel version ${version}`);
             }
-            const routes = validateDestinationTunnelRoutes(readArray(record, 'routes').map(readRoute));
-            return JSON.stringify({ type, version, routes });
+            const selectors = validateDestinationTunnelSelectors((0, destination_tunnel_wire_reader_1.readArray)(record, 'selectors').map((value) => {
+                if (typeof value !== 'string') {
+                    throw new destination_tunnel_wire_reader_1.DestinationTunnelProtocolError('tunnel selector must be a string');
+                }
+                return value;
+            }));
+            const inspection = readInspectionConfig(record);
+            return JSON.stringify({
+                type,
+                version,
+                selectors,
+                inspection,
+                window: readWindow(record),
+            });
         }
         case 'openOk':
+            return JSON.stringify({
+                type,
+                connId: readConnectionId(record),
+                transport: readTransportResult(record),
+                window: readWindow(record),
+            });
         case 'fin':
             return JSON.stringify({ type, connId: readConnectionId(record) });
         case 'openFail':
@@ -99,31 +283,40 @@ function encodeDestinationTunnelClientMessage(message) {
             return JSON.stringify({
                 type,
                 connId: readConnectionId(record),
-                reason: readString(record, 'reason'),
-                ...readOptionalString(record, 'osCode'),
+                reason: (0, destination_tunnel_wire_reader_1.readString)(record, 'reason'),
+                ...(0, destination_tunnel_wire_reader_1.readOptionalString)(record, 'osCode'),
+            });
+        case 'windowUpdate':
+            return JSON.stringify({
+                type,
+                connId: readConnectionId(record),
+                increment: readWindowIncrement(record),
             });
         default:
-            throw new DestinationTunnelProtocolError(`unknown tunnel control message type ${type}`);
+            throw new destination_tunnel_wire_reader_1.DestinationTunnelProtocolError(`unknown tunnel control message type ${type}`);
     }
 }
 function decodeDestinationTunnelServerMessage(value) {
-    const message = readRecord(value, 'tunnel control message');
-    const type = readString(message, 'type');
+    const message = (0, destination_tunnel_wire_reader_1.readRecord)(value, 'tunnel control message');
+    const type = (0, destination_tunnel_wire_reader_1.readString)(message, 'type');
     switch (type) {
         case 'ready':
             return {
                 type,
-                version: readInteger(message, 'version'),
-                tunnelId: readString(message, 'tunnelId'),
+                version: (0, destination_tunnel_wire_reader_1.readInteger)(message, 'version'),
+                tunnelId: (0, destination_tunnel_wire_reader_1.readString)(message, 'tunnelId'),
+                selectors: (0, destination_tunnel_wire_reader_1.readArray)(message, 'selectors').map((value, index) => readSelectorReport(value, `selector-${index + 1}`)),
+                configHash: (0, destination_tunnel_wire_reader_1.readString)(message, 'configHash'),
             };
         case 'open':
             return {
                 type,
                 connId: readConnectionId(message),
-                routeId: readString(message, 'routeId'),
-                host: readString(message, 'host'),
+                selectorId: (0, destination_tunnel_wire_reader_1.readString)(message, 'selectorId'),
+                host: (0, destination_tunnel_wire_reader_1.readString)(message, 'host'),
                 port: readPort(message, 'port'),
-                proto: readTCP(message),
+                transport: readTransportRequest(message),
+                window: readWindow(message),
             };
         case 'fin':
             return { type, connId: readConnectionId(message) };
@@ -131,18 +324,57 @@ function decodeDestinationTunnelServerMessage(value) {
             return {
                 type,
                 connId: readConnectionId(message),
-                reason: readString(message, 'reason'),
-                ...readOptionalString(message, 'osCode'),
+                reason: (0, destination_tunnel_wire_reader_1.readString)(message, 'reason'),
+                ...(0, destination_tunnel_wire_reader_1.readOptionalString)(message, 'osCode'),
+            };
+        case 'windowUpdate':
+            return {
+                type,
+                connId: readConnectionId(message),
+                increment: readWindowIncrement(message),
             };
         case 'error':
-            return { type, code: readString(message, 'code') };
+            return { type, code: (0, destination_tunnel_wire_reader_1.readString)(message, 'code') };
         default:
-            throw new DestinationTunnelProtocolError(`unknown tunnel control message type ${type}`);
+            throw new destination_tunnel_wire_reader_1.DestinationTunnelProtocolError(`unknown tunnel control message type ${type}`);
+    }
+}
+function parseDestinationTunnelSelector(selector, minRoutePort = 1) {
+    if (typeof selector !== 'string' || selector.length === 0) {
+        throw new DestinationTunnelSelectorError('empty', 'tunnel selector must not be empty');
+    }
+    if (!selector.startsWith('[') && !selector.includes(':')) {
+        const domain = canonicalizeDestinationTunnelDomain(selector);
+        return { value: domain, domain };
+    }
+    let host;
+    let portText;
+    if (selector.startsWith('[')) {
+        const match = /^\[([^\]]+)\]:(\d+)$/.exec(selector);
+        if (!match?.[1] || !match[2]) {
+            throw new DestinationTunnelSelectorError('invalid_host', `invalid tunnel selector ${selector}`);
+        }
+        host = match[1];
+        portText = match[2];
+    }
+    else {
+        const separator = selector.lastIndexOf(':');
+        if (separator <= 0 || selector.indexOf(':') !== separator) {
+            throw new DestinationTunnelSelectorError('invalid_host', `invalid tunnel selector ${selector}`);
+        }
+        host = selector.slice(0, separator);
+        portText = selector.slice(separator + 1);
     }
+    if (!/^\d+$/.test(portText)) {
+        throw new DestinationTunnelSelectorError('invalid_port', `invalid tunnel selector port ${portText}`);
+    }
+    const route = canonicalizeDestinationTunnelRoute({ host, port: Number(portText) }, minRoutePort);
+    const formattedHost = route.host.includes(':') ? `[${route.host}]` : route.host;
+    return { value: `${formattedHost}:${route.port}`, route };
 }
-function canonicalizeDestinationTunnelRoute(route) {
-    if (!Number.isInteger(route.port) || route.port < 1 || route.port > 65535 || route.port === 53) {
-        throw new DestinationTunnelRouteError('invalid_port', `invalid tunnel route port ${route.port}`);
+function canonicalizeDestinationTunnelRoute(route, minPort = 1) {
+    if (!Number.isInteger(route.port) || route.port < minPort || route.port > 65535 || route.port === 53) {
+        throw new DestinationTunnelSelectorError('invalid_port', `invalid tunnel route port ${route.port}`);
     }
     const asciiHost = Buffer.byteLength(route.host, 'utf8') === route.host.length;
     if (asciiHost && route.host.toLowerCase() === 'localhost') {
@@ -156,11 +388,49 @@ function canonicalizeDestinationTunnelRoute(route) {
         const hostname = new URL(`http://[${route.host}]/`).hostname;
         const canonical = hostname.slice(1, -1);
         if (canonical !== '::1' && /^::(?:[0-9a-f]{1,4}:)?[0-9a-f]{1,4}$/.test(canonical)) {
-            throw new DestinationTunnelRouteError('invalid_host', `invalid tunnel route host ${route.host}`);
+            throw new DestinationTunnelSelectorError('invalid_host', `invalid tunnel route host ${route.host}`);
         }
         return { host: canonicalizeIPv6(canonical), port: route.port };
     }
-    throw new DestinationTunnelRouteError('invalid_host', `invalid tunnel route host ${route.host}`);
+    throw new DestinationTunnelSelectorError('invalid_host', `invalid tunnel route host ${route.host}`);
+}
+function canonicalizeDestinationTunnelDomain(domain) {
+    const invalid = () => {
+        throw new DestinationTunnelSelectorError('invalid_domain', `invalid tunnel domain ${domain}`);
+    };
+    if (typeof domain !== 'string' || domain.length === 0 || domain.length > 260)
+        invalid();
+    // ASCII only: reject anything IDNA mapping would change to avoid ambiguity
+    // between implementations. Users provide punycode (xn--) names directly.
+    if (Buffer.byteLength(domain, 'utf8') !== domain.length)
+        invalid();
+    const lowered = domain.toLowerCase();
+    const wildcard = lowered.startsWith('*.');
+    const base = wildcard ? lowered.slice(2) : lowered;
+    if (base.length === 0 || base.length > 253)
+        invalid();
+    if (base.includes('*'))
+        invalid();
+    if (base.endsWith('.') || base.startsWith('.'))
+        invalid();
+    if (net_1.default.isIP(base) !== 0)
+        invalid();
+    if (base === 'localhost')
+        invalid();
+    if ((0, url_1.domainToASCII)(base) !== base)
+        invalid();
+    const labels = base.split('.');
+    for (const label of labels) {
+        if (label.length === 0 || label.length > 63)
+            invalid();
+        if (!/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/.test(label))
+            invalid();
+    }
+    // All-numeric final labels would be ambiguous with IPv4 literals.
+    const finalLabel = labels[labels.length - 1];
+    if (finalLabel !== undefined && /^\d+$/.test(finalLabel))
+        invalid();
+    return wildcard ? `*.${base}` : base;
 }
 function canonicalizeIPv6(host) {
     const mappedIPv4 = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(host);
@@ -171,79 +441,118 @@ function canonicalizeIPv6(host) {
     const low = Number.parseInt(mappedIPv4[2], 16);
     return `${high >> 8}.${high & 0xff}.${low >> 8}.${low & 0xff}`;
 }
-function parseRouteId(routeId) {
-    const match = /^route-([1-9]\d*)$/.exec(routeId);
-    if (!match?.[1]) {
-        return -1;
+function readSelectorReport(value, expectedId) {
+    const report = (0, destination_tunnel_wire_reader_1.readRecord)(value, 'tunnel selector');
+    const id = (0, destination_tunnel_wire_reader_1.readString)(report, 'id');
+    if (id !== expectedId) {
+        throw new destination_tunnel_wire_reader_1.DestinationTunnelProtocolError(`invalid tunnel selector id ${id}`);
+    }
+    const kind = (0, destination_tunnel_wire_reader_1.readString)(report, 'kind');
+    if (kind !== 'route' && kind !== 'domain') {
+        throw new destination_tunnel_wire_reader_1.DestinationTunnelProtocolError(`invalid tunnel selector kind ${kind}`);
+    }
+    const result = {
+        id,
+        kind,
+        value: (0, destination_tunnel_wire_reader_1.readString)(report, 'value'),
+    };
+    if (report['binds'] !== undefined) {
+        result.binds = (0, destination_tunnel_wire_reader_1.readArray)(report, 'binds').map(readBindReport);
     }
-    return Number(match[1]) - 1;
+    return result;
 }
-function readRoute(value) {
-    const route = readRecord(value, 'tunnel route');
+function readBindReport(value) {
+    const bind = (0, destination_tunnel_wire_reader_1.readRecord)(value, 'tunnel bind report');
+    const status = (0, destination_tunnel_wire_reader_1.readString)(bind, 'status');
+    if (status !== 'ok' && status !== 'conflict' && status !== 'error') {
+        throw new destination_tunnel_wire_reader_1.DestinationTunnelProtocolError(`invalid tunnel bind status ${status}`);
+    }
     return {
-        host: readString(route, 'host'),
-        port: readPort(route, 'port'),
+        address: (0, destination_tunnel_wire_reader_1.readString)(bind, 'address'),
+        status,
+        ...(0, destination_tunnel_wire_reader_1.readOptionalString)(bind, 'osCode'),
     };
 }
-function readRecord(value, name) {
-    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
-        throw new DestinationTunnelProtocolError(`${name} must be an object`);
-    }
-    return value;
+function readInspectionConfig(record) {
+    const inspection = (0, destination_tunnel_wire_reader_1.readRecord)(record['inspection'], 'inspection');
+    const enabled = (0, destination_tunnel_wire_reader_1.readBoolean)(inspection, 'enabled');
+    const captureBodies = (0, destination_tunnel_wire_reader_1.readBoolean)(inspection, 'captureBodies');
+    const maxBodyBytes = (0, destination_tunnel_wire_reader_1.readInteger)(inspection, 'maxBodyBytes');
+    const persist = (0, destination_tunnel_wire_reader_1.readBoolean)(inspection, 'persist');
+    const ttlSeconds = (0, destination_tunnel_wire_reader_1.readInteger)(inspection, 'ttlSeconds');
+    return normalizeDestinationTunnelInspection({
+        enabled,
+        captureBodies,
+        maxBodyBytes,
+        persist,
+        ttlSeconds,
+    });
 }
-function readArray(record, key) {
-    const value = record[key];
-    if (!Array.isArray(value)) {
-        throw new DestinationTunnelProtocolError(`${key} must be an array`);
+function readTransportRequest(record) {
+    const transport = (0, destination_tunnel_wire_reader_1.readRecord)(record['transport'], 'transport');
+    const type = (0, destination_tunnel_wire_reader_1.readString)(transport, 'type');
+    if (type === 'tcp') {
+        return { type };
     }
-    return value;
-}
-function readString(record, key) {
-    const value = record[key];
-    if (typeof value !== 'string') {
-        throw new DestinationTunnelProtocolError(`${key} must be a string`);
+    if (type === 'tls') {
+        const serverName = (0, destination_tunnel_wire_reader_1.readString)(transport, 'serverName');
+        if (serverName.length === 0) {
+            throw new destination_tunnel_wire_reader_1.DestinationTunnelProtocolError('TLS transport requires serverName');
+        }
+        const alpnProtocols = (0, destination_tunnel_wire_reader_1.readArray)(transport, 'alpnProtocols').map((protocol) => {
+            if (typeof protocol !== 'string' || protocol.length === 0) {
+                throw new destination_tunnel_wire_reader_1.DestinationTunnelProtocolError('alpnProtocols must contain non-empty strings');
+            }
+            return protocol;
+        });
+        return { type, serverName, alpnProtocols };
     }
-    return value;
+    throw new destination_tunnel_wire_reader_1.DestinationTunnelProtocolError(`unsupported tunnel transport ${type}`);
 }
-function readOptionalString(record, key) {
-    const value = record[key];
-    if (value === undefined) {
-        return {};
+function readTransportResult(record) {
+    const transport = (0, destination_tunnel_wire_reader_1.readRecord)(record['transport'], 'transport');
+    const type = (0, destination_tunnel_wire_reader_1.readString)(transport, 'type');
+    if (type !== 'tcp' && type !== 'tls') {
+        throw new destination_tunnel_wire_reader_1.DestinationTunnelProtocolError(`unsupported tunnel transport ${type}`);
     }
-    if (typeof value !== 'string') {
-        throw new DestinationTunnelProtocolError(`${key} must be a string`);
+    return {
+        type,
+        ...(0, destination_tunnel_wire_reader_1.readOptionalString)(transport, 'alpnProtocol'),
+        ...(0, destination_tunnel_wire_reader_1.readOptionalString)(transport, 'remoteAddress'),
+        ...(0, destination_tunnel_wire_reader_1.readOptionalNonNegativeInteger)(transport, 'dnsMs'),
+        ...(0, destination_tunnel_wire_reader_1.readOptionalNonNegativeInteger)(transport, 'connectMs'),
+        ...(0, destination_tunnel_wire_reader_1.readOptionalNonNegativeInteger)(transport, 'tlsMs'),
+    };
+}
+function readPort(record, key) {
+    const value = (0, destination_tunnel_wire_reader_1.readInteger)(record, key);
+    if (value < 1 || value > 65535) {
+        throw new destination_tunnel_wire_reader_1.DestinationTunnelProtocolError(`${key} must be between 1 and 65535`);
     }
-    return { [key]: value };
+    return value;
 }
-function readInteger(record, key) {
-    const value = record[key];
-    if (!Number.isInteger(value)) {
-        throw new DestinationTunnelProtocolError(`${key} must be an integer`);
+function readWindow(record) {
+    const value = (0, destination_tunnel_wire_reader_1.readInteger)(record, 'window');
+    if (value < 1 || value > exports.DESTINATION_TUNNEL_MAX_WINDOW) {
+        throw new destination_tunnel_wire_reader_1.DestinationTunnelProtocolError(`window must be an integer between 1 and ${exports.DESTINATION_TUNNEL_MAX_WINDOW}`);
     }
     return value;
 }
-function readPort(record, key) {
-    const value = readInteger(record, key);
-    if (value < 1 || value > 65535) {
-        throw new DestinationTunnelProtocolError(`${key} must be between 1 and 65535`);
+function readWindowIncrement(record) {
+    const value = (0, destination_tunnel_wire_reader_1.readInteger)(record, 'increment');
+    if (value < 1 || value > exports.DESTINATION_TUNNEL_MAX_WINDOW_INCREMENT) {
+        throw new destination_tunnel_wire_reader_1.DestinationTunnelProtocolError(`increment must be an integer between 1 and ${exports.DESTINATION_TUNNEL_MAX_WINDOW_INCREMENT}`);
     }
     return value;
 }
 function readConnectionId(record) {
-    const value = readInteger(record, 'connId');
+    const value = (0, destination_tunnel_wire_reader_1.readInteger)(record, 'connId');
     validateConnectionId(value);
     return value;
 }
 function validateConnectionId(value) {
     if (!Number.isInteger(value) || value < 0 || value > 4294967295) {
-        throw new DestinationTunnelProtocolError('connId must be an unsigned 32-bit integer');
-    }
-}
-function readTCP(record) {
-    const value = readString(record, 'proto');
-    if (value !== 'tcp') {
-        throw new DestinationTunnelProtocolError(`unsupported tunnel transport ${value}`);
+        throw new destination_tunnel_wire_reader_1.DestinationTunnelProtocolError('connId must be an unsigned 32-bit integer');
     }
-    return value;
 }
 //# sourceMappingURL=destination-tunnel.js.map