@limrun/api 0.48.4 → 0.49.1

package/destination-tunnel-dialer.js

@@ -1,15 +1,47 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DESTINATION_TUNNEL_SERVER_ERROR_PREFIX = void 0;
+exports.isTerminalDestinationTunnelError = isTerminalDestinationTunnelError;
 exports.startDestinationTcpTunnel = startDestinationTcpTunnel;
+exports.isDialableResolvedAddress = isDialableResolvedAddress;
 exports.classifyOpenFailure = classifyOpenFailure;
 const tslib_1 = require("./internal/tslib.js");
+const dns_1 = tslib_1.__importDefault(require("dns"));
 const net_1 = tslib_1.__importDefault(require("net"));
+const tls_1 = tslib_1.__importDefault(require("tls"));
 const ws_1 = require("ws");
 const proxy_transport_1 = require("./internal/proxy-transport.js");
+const destination_tunnel_wire_reader_1 = require("./internal/destination-tunnel-wire-reader.js");
+const destination_tunnel_inspection_1 = require("./destination-tunnel-inspection.js");
 const destination_tunnel_1 = require("./destination-tunnel.js");
+const blockedResolvedAddresses = new net_1.default.BlockList();
+blockedResolvedAddresses.addSubnet('0.0.0.0', 8, 'ipv4');
+blockedResolvedAddresses.addSubnet('127.0.0.0', 8, 'ipv4');
+blockedResolvedAddresses.addSubnet('169.254.0.0', 16, 'ipv4');
+blockedResolvedAddresses.addSubnet('224.0.0.0', 3, 'ipv4');
+blockedResolvedAddresses.addSubnet('::', 96, 'ipv6');
+blockedResolvedAddresses.addSubnet('fe80::', 10, 'ipv6');
+blockedResolvedAddresses.addSubnet('ff00::', 8, 'ipv6');
+blockedResolvedAddresses.addSubnet('::ffff:0.0.0.0', 104, 'ipv6');
+blockedResolvedAddresses.addSubnet('::ffff:127.0.0.0', 104, 'ipv6');
+blockedResolvedAddresses.addSubnet('::ffff:169.254.0.0', 112, 'ipv6');
+blockedResolvedAddresses.addSubnet('::ffff:224.0.0.0', 99, 'ipv6');
+/** Thrown (message prefix) when the server terminates the session with `error`. */
+exports.DESTINATION_TUNNEL_SERVER_ERROR_PREFIX = 'destination tunnel failed: ';
+/**
+ * True when the failure is a terminal protocol/policy rejection from the
+ * server rather than a transient transport problem. Reconnect supervisors
+ * must not retry terminal failures.
+ */
+function isTerminalDestinationTunnelError(error) {
+    return error instanceof Error && error.message.startsWith(exports.DESTINATION_TUNNEL_SERVER_ERROR_PREFIX);
+}
 async function startDestinationTcpTunnel(remoteURL, token, options) {
-    const routes = (0, destination_tunnel_1.validateDestinationTunnelRoutes)(options.routes);
+    const selectors = (0, destination_tunnel_1.validateDestinationTunnelSelectors)(options.selectors);
+    const routes = (0, destination_tunnel_1.classifyDestinationTunnelSelectors)(selectors).routes ?? [];
+    const inspection = (0, destination_tunnel_1.normalizeDestinationTunnelInspection)(options.inspection ?? (0, destination_tunnel_1.disabledDestinationTunnelInspection)());
     const logLevel = options.logLevel ?? 'info';
+    const creditWindow = positiveInteger(options.window ?? destination_tunnel_1.DESTINATION_TUNNEL_DEFAULT_WINDOW, 'window');
     const maxConnections = positiveInteger(options.maxConnections ?? 64, 'maxConnections');
     const maxPendingBytesPerConnection = positiveInteger(options.maxPendingBytesPerConnection ?? 16 * 1024 * 1024, 'maxPendingBytesPerConnection');
     const maxTotalPendingBytes = positiveInteger(options.maxTotalPendingBytes ?? 16 * 1024 * 1024, 'maxTotalPendingBytes');
@@ -56,6 +88,7 @@ async function startDestinationTcpTunnel(remoteURL, token, options) {
         let livenessTimer;
         let tunnelReady = false;
         let closed = false;
+        let inspectionStream;
         let pausedForBackpressure = false;
         let totalPendingWriteBytes = 0;
         const updateConnectionState = (state) => {
@@ -89,9 +122,10 @@ async function startDestinationTcpTunnel(remoteURL, token, options) {
             if (!connection)
                 return;
             connections.delete(connId);
+            connection.abortController.abort();
             clearTimeout(connection.connectTimer);
             markRecentlyClosed(connId);
-            if (destroySocket && !connection.socket.destroyed) {
+            if (destroySocket && connection.socket && !connection.socket.destroyed) {
                 connection.socket.destroy();
             }
         };
@@ -122,6 +156,8 @@ async function startDestinationTcpTunnel(remoteURL, token, options) {
                 livenessTimer = undefined;
             }
             closeAllConnections();
+            inspectionStream?.close();
+            inspectionStream = undefined;
             ws.removeAllListeners('open');
             ws.removeAllListeners('message');
             ws.removeAllListeners('ping');
@@ -140,12 +176,13 @@ async function startDestinationTcpTunnel(remoteURL, token, options) {
                 reject(error);
             }
         };
+        const mayReadFromSocket = (connection) => !pausedForBackpressure && connection.creditQueueBytes === 0;
         const pauseForBackpressure = () => {
             if (pausedForBackpressure)
                 return;
             pausedForBackpressure = true;
             for (const connection of connections.values()) {
-                if (!connection.socket.destroyed)
+                if (connection.socket && !connection.socket.destroyed)
                     connection.socket.pause();
             }
         };
@@ -154,8 +191,12 @@ async function startDestinationTcpTunnel(remoteURL, token, options) {
                 return;
             pausedForBackpressure = false;
             for (const connection of connections.values()) {
-                if (!connection.socket.destroyed)
+                // Flows still waiting on per-flow credit stay paused; they resume
+                // when the server grants more window, keeping one stalled flow from
+                // holding every other flow back.
+                if (connection.socket && !connection.socket.destroyed && mayReadFromSocket(connection)) {
                     connection.socket.resume();
+                }
             }
         };
         const frameQueued = () => {
@@ -207,12 +248,110 @@ async function startDestinationTcpTunnel(remoteURL, token, options) {
                 ...(osCode ? { osCode } : {}),
             });
         };
+        /**
+         * Push local socket bytes toward the server through the per-flow credit
+         * gate. Chunks beyond the current credit wait in a FIFO queue with the
+         * local socket paused, so a server-throttled flow stops reading instead
+         * of buffering unboundedly.
+         */
+        const pushThroughCreditGate = (connId, connection, payload) => {
+            if (payload && payload.length > 0) {
+                connection.creditQueue.push(payload);
+                connection.creditQueueBytes += payload.length;
+            }
+            while (connection.creditQueue.length > 0 && connection.sendCredit > 0) {
+                const chunk = connection.creditQueue[0];
+                if (chunk.length <= connection.sendCredit) {
+                    connection.creditQueue.shift();
+                    connection.creditQueueBytes -= chunk.length;
+                    connection.sendCredit -= chunk.length;
+                    sendData(connId, chunk);
+                }
+                else {
+                    const portion = chunk.subarray(0, connection.sendCredit);
+                    connection.creditQueue[0] = chunk.subarray(connection.sendCredit);
+                    connection.creditQueueBytes -= portion.length;
+                    connection.sendCredit = 0;
+                    sendData(connId, portion);
+                }
+                if (closed)
+                    return;
+            }
+            if (connection.creditQueue.length === 0 && connection.finPending) {
+                // The local socket ended while data was still waiting on credit; the
+                // queue has drained, so half-close can now be signaled in order.
+                connection.finPending = false;
+                connection.localInputEnded = true;
+                sendControl({ type: 'fin', connId });
+            }
+            if (!connection.socket || connection.socket.destroyed)
+                return;
+            if (connection.creditQueueBytes > 0) {
+                connection.socket.pause();
+            }
+            else if (!pausedForBackpressure) {
+                connection.socket.resume();
+            }
+        };
+        const dialTarget = async (message) => {
+            // Domain selectors resolve through the user's OS resolver and may only
+            // reach ordinary unicast targets. Loopback and similar special targets
+            // require an explicit exact route grant.
+            const startedAt = Date.now();
+            const results = await dns_1.default.promises.lookup(message.host, { all: true, verbatim: true });
+            const dnsMs = Date.now() - startedAt;
+            for (const result of results) {
+                if (isDialableResolvedAddress(result.address, message.port, routes)) {
+                    return { host: result.address, dnsMs };
+                }
+            }
+            const blockedError = new Error(`all resolved addresses for ${message.host} are blocked`);
+            blockedError.code = 'EBLOCKED';
+            throw blockedError;
+        };
+        const wrapTls = (socket, transport, abortController) => new Promise((resolveTls, rejectTls) => {
+            const tlsSocket = tls_1.default.connect({
+                socket,
+                rejectUnauthorized: true,
+                servername: transport.serverName,
+                ALPNProtocols: transport.alpnProtocols,
+            });
+            tlsSocket.allowHalfOpen = true;
+            const cleanup = () => {
+                tlsSocket.removeListener('secureConnect', onSecureConnect);
+                tlsSocket.removeListener('error', onError);
+                abortController.signal.removeEventListener('abort', onAbort);
+            };
+            const onSecureConnect = () => {
+                cleanup();
+                tlsSocket.pause();
+                resolveTls(tlsSocket);
+            };
+            const onError = (error) => {
+                cleanup();
+                rejectTls(error);
+            };
+            const onAbort = () => {
+                cleanup();
+                tlsSocket.destroy();
+                rejectTls(Object.assign(new Error('TLS connection cancelled'), { code: 'ECANCELED' }));
+            };
+            tlsSocket.once('secureConnect', onSecureConnect);
+            tlsSocket.once('error', onError);
+            if (abortController.signal.aborted) {
+                onAbort();
+            }
+            else {
+                abortController.signal.addEventListener('abort', onAbort, { once: true });
+            }
+        });
         const handleOpen = (message) => {
+            let kind;
             try {
-                (0, destination_tunnel_1.assertDestinationTunnelOpenAllowed)(message, routes);
+                kind = (0, destination_tunnel_1.assertDestinationTunnelOpenAllowed)(message, selectors);
             }
             catch {
-                sendOpenFailure(message.connId, 'route_not_allowed');
+                sendOpenFailure(message.connId, 'selector_not_allowed');
                 return;
             }
             if (connections.has(message.connId) || recentlyClosed.has(message.connId)) {
@@ -222,75 +361,126 @@ async function startDestinationTcpTunnel(remoteURL, token, options) {
                 sendOpenFailure(message.connId, 'resource_exhausted');
                 return;
             }
-            const socket = net_1.default.createConnection({
-                host: message.host,
-                port: message.port,
-                allowHalfOpen: true,
-            });
+            const abortController = new AbortController();
             const connectTimer = setTimeout(() => {
                 if (connections.get(message.connId)?.phase !== 'connecting')
                     return;
+                logger.warn(`Failed to connect to ${message.host}:${message.port}: timed out`);
                 sendOpenFailure(message.connId, 'connection_timed_out', 'ETIMEDOUT');
                 removeConnection(message.connId, true);
             }, connectTimeoutMs);
             connectTimer.unref();
             const connection = {
-                socket,
                 phase: 'connecting',
+                abortController,
                 connectTimer,
                 localInputEnded: false,
                 remoteInputEnded: false,
                 pendingWriteBytes: 0,
+                sendCredit: message.window,
+                creditQueue: [],
+                creditQueueBytes: 0,
+                finPending: false,
+                deliveredSinceUpdate: 0,
             };
             connections.set(message.connId, connection);
-            if (pausedForBackpressure) {
-                socket.pause();
-            }
-            socket.once('connect', () => {
-                if (connections.get(message.connId) !== connection)
-                    return;
-                clearTimeout(connectTimer);
-                connection.phase = 'open';
-                sendControl({ type: 'openOk', connId: message.connId });
-                logger.debug(`Connected ${message.connId} to ${message.host}:${message.port}`);
-            });
-            socket.on('data', (payload) => {
-                if (connections.get(message.connId) !== connection || connection.phase !== 'open')
-                    return;
-                sendData(message.connId, payload);
-            });
-            socket.once('end', () => {
-                if (connections.get(message.connId) !== connection || connection.phase !== 'open')
+            void (async () => {
+                let host = message.host;
+                if (kind === 'domain') {
+                    const resolved = await dialTarget(message);
+                    host = resolved.host;
+                    connection.dnsMs = resolved.dnsMs;
+                }
+                if (connections.get(message.connId) !== connection || closed)
                     return;
-                connection.localInputEnded = true;
-                sendControl({ type: 'fin', connId: message.connId });
-            });
-            socket.once('error', (error) => {
-                if (connections.get(message.connId) !== connection)
+                const tcp = await proxy_transport_1.nodeProxyTransport.connectTcp({
+                    host,
+                    port: message.port,
+                    proxyLookupHost: message.host,
+                    proxyLookupProtocol: message.transport.type === 'tls' ? 'https:' : 'http:',
+                    timeoutMs: connectTimeoutMs,
+                    signal: abortController.signal,
+                });
+                if (connections.get(message.connId) !== connection || closed) {
+                    tcp.socket.destroy();
                     return;
-                if (connection.phase === 'connecting') {
-                    sendOpenFailure(message.connId, classifyOpenFailure(error), error.code);
                 }
-                else {
-                    sendReset(message.connId, 'connection_error', error.code);
+                connection.socket = tcp.socket;
+                let socket = tcp.socket;
+                let tlsMs;
+                if (message.transport.type === 'tls') {
+                    const tlsStartedAt = Date.now();
+                    socket = await wrapTls(tcp.socket, message.transport, abortController);
+                    tlsMs = Date.now() - tlsStartedAt;
+                    if (connections.get(message.connId) !== connection || closed) {
+                        socket.destroy();
+                        return;
+                    }
+                    connection.socket = socket;
                 }
-                removeConnection(message.connId, true);
-            });
-            socket.once('close', () => {
+                clearTimeout(connectTimer);
+                socket.on('data', (payload) => {
+                    if (connections.get(message.connId) !== connection || connection.phase !== 'open')
+                        return;
+                    pushThroughCreditGate(message.connId, connection, payload);
+                });
+                socket.once('end', () => {
+                    if (connections.get(message.connId) !== connection || connection.phase !== 'open')
+                        return;
+                    if (connection.creditQueueBytes > 0) {
+                        // Queued bytes are still waiting on send credit; fin must follow
+                        // them, so defer it until the credit gate drains the queue.
+                        connection.finPending = true;
+                        return;
+                    }
+                    connection.localInputEnded = true;
+                    sendControl({ type: 'fin', connId: message.connId });
+                });
+                socket.once('error', (error) => {
+                    if (connections.get(message.connId) !== connection)
+                        return;
+                    sendReset(message.connId, 'connection_error', error.code);
+                    removeConnection(message.connId, true);
+                });
+                socket.once('close', () => {
+                    if (connections.get(message.connId) !== connection)
+                        return;
+                    if (!connection.localInputEnded || !connection.remoteInputEnded) {
+                        sendReset(message.connId, 'connection_error');
+                    }
+                    removeConnection(message.connId, false);
+                });
+                connection.phase = 'open';
+                sendControl({
+                    type: 'openOk',
+                    connId: message.connId,
+                    transport: {
+                        type: message.transport.type,
+                        ...(tcp.remoteAddress === undefined ? {} : { remoteAddress: tcp.remoteAddress }),
+                        ...(connection.dnsMs === undefined ? {} : { dnsMs: connection.dnsMs }),
+                        connectMs: tcp.connectMs,
+                        ...(tlsMs === undefined ? {} : { tlsMs }),
+                        ...(socket instanceof tls_1.default.TLSSocket && socket.alpnProtocol ?
+                            { alpnProtocol: socket.alpnProtocol }
+                            : {}),
+                    },
+                    window: creditWindow,
+                });
+                logger.debug(`Forwarding connection ${message.connId} to ${message.host}:${message.port}`);
+                if (!pausedForBackpressure && connection.creditQueueBytes === 0)
+                    socket.resume();
+            })().catch((error) => {
                 if (connections.get(message.connId) !== connection)
                     return;
-                if (connection.phase === 'connecting') {
-                    sendOpenFailure(message.connId, 'internal');
-                }
-                else if (!connection.localInputEnded || !connection.remoteInputEnded) {
-                    sendReset(message.connId, 'connection_error');
-                }
-                removeConnection(message.connId, false);
+                logger.warn(`Failed to connect to ${message.host}:${message.port}: ${error.code ?? error.message}`);
+                const reason = error.code === 'EBLOCKED' ? 'selector_not_allowed' : classifyOpenFailure(error);
+                sendOpenFailure(message.connId, reason, error.code === 'EBLOCKED' ? undefined : error.code);
+                removeConnection(message.connId, true);
             });
         };
         const findOpenConnection = (connId) => {
             const connection = connections.get(connId);
-            if (connection?.phase === 'open')
+            if (connection?.phase === 'open' && connection.socket)
                 return connection;
             if (connection) {
                 sendReset(connId, 'protocol_error');
@@ -319,6 +509,14 @@ async function startDestinationTcpTunnel(remoteURL, token, options) {
                 removeConnection(connId, true);
             }
         };
+        const handleRemoteWindowUpdate = (connId, increment) => {
+            const connection = connections.get(connId);
+            // Updates racing a local close are expected; ignore unknown flows.
+            if (!connection || connection.phase !== 'open')
+                return;
+            connection.sendCredit += increment;
+            pushThroughCreditGate(connId, connection);
+        };
         const handleBinary = (frame) => {
             if (!tunnelReady) {
                 throw new destination_tunnel_1.DestinationTunnelProtocolError('received tunnel data before READY');
@@ -349,15 +547,32 @@ async function startDestinationTcpTunnel(remoteURL, token, options) {
                     const osCode = error.code;
                     sendReset(connId, 'connection_error', osCode);
                     removeConnection(connId, true);
+                    return;
+                }
+                // Replenish the server's send window once the local socket accepted
+                // the bytes, batching updates to roughly half the window.
+                if (connections.get(connId) !== connection)
+                    return;
+                connection.deliveredSinceUpdate += payload.length;
+                if (connection.deliveredSinceUpdate >= Math.ceil(creditWindow / 2)) {
+                    const increment = connection.deliveredSinceUpdate;
+                    connection.deliveredSinceUpdate = 0;
+                    if (!closed && ws.readyState === ws_1.WebSocket.OPEN) {
+                        sendControl({ type: 'windowUpdate', connId, increment });
+                    }
                 }
             });
         };
         const handleControl = (message) => {
             switch (message.type) {
-                case 'ready':
+                case 'ready': {
                     if (tunnelReady)
                         throw new destination_tunnel_1.DestinationTunnelProtocolError('received duplicate READY');
                     (0, destination_tunnel_1.assertDestinationTunnelReady)(message);
+                    const expected = (0, destination_tunnel_1.destinationTunnelConfigHash)(selectors, inspection);
+                    if (message.configHash !== expected) {
+                        throw new destination_tunnel_1.DestinationTunnelProtocolError(`server acknowledged config ${message.configHash} but ${expected} was negotiated`);
+                    }
                     tunnelReady = true;
                     if (handshakeTimer) {
                         clearTimeout(handshakeTimer);
@@ -365,16 +580,37 @@ async function startDestinationTcpTunnel(remoteURL, token, options) {
                     }
                     armLivenessDeadline();
                     updateConnectionState('connected');
-                    logger.info(`Destination tunnel ready with ${routes.length} route(s)`);
+                    logger.info(`Destination tunnel ready with ${selectors.length} selector(s)`);
+                    if (inspection.enabled) {
+                        try {
+                            inspectionStream = (0, destination_tunnel_inspection_1.startDestinationTunnelInspectionStream)(remoteURL, message.tunnelId, token, {
+                                ...(options.onInspectionEvent ? { onEvent: options.onInspectionEvent } : {}),
+                                ...(options.onInspectionError ? { onError: options.onInspectionError } : {}),
+                            });
+                        }
+                        catch (error) {
+                            try {
+                                options.onInspectionError?.(error instanceof Error ? error : new Error(String(error)));
+                            }
+                            catch {
+                                // Inspection callbacks are isolated from the main tunnel.
+                            }
+                        }
+                    }
                     resolve({
                         tunnelId: message.tunnelId,
+                        selectors: message.selectors,
+                        configHash: message.configHash,
+                        inspection,
+                        ...(inspectionStream ? { inspectionStream } : {}),
                         close,
                         getConnectionState,
                         onConnectionStateChange,
                     });
                     return;
+                }
                 case 'error':
-                    throw new Error(`destination tunnel failed: ${message.code}`);
+                    throw new Error(`${exports.DESTINATION_TUNNEL_SERVER_ERROR_PREFIX}${message.code}`);
                 case 'open':
                     if (!tunnelReady)
                         throw new destination_tunnel_1.DestinationTunnelProtocolError('received OPEN before READY');
@@ -385,6 +621,11 @@ async function startDestinationTcpTunnel(remoteURL, token, options) {
                         throw new destination_tunnel_1.DestinationTunnelProtocolError('received FIN before READY');
                     handleRemoteFIN(message.connId);
                     return;
+                case 'windowUpdate':
+                    if (!tunnelReady)
+                        throw new destination_tunnel_1.DestinationTunnelProtocolError('received windowUpdate before READY');
+                    handleRemoteWindowUpdate(message.connId, message.increment);
+                    return;
                 case 'reset':
                     if (!tunnelReady)
                         throw new destination_tunnel_1.DestinationTunnelProtocolError('received RESET before READY');
@@ -406,7 +647,13 @@ async function startDestinationTcpTunnel(remoteURL, token, options) {
         }, handshakeTimeoutMs);
         handshakeTimer.unref();
         ws.on('open', () => {
-            sendControl({ type: 'start', version: destination_tunnel_1.DESTINATION_TUNNEL_VERSION, routes });
+            sendControl({
+                type: 'start',
+                version: destination_tunnel_1.DESTINATION_TUNNEL_VERSION,
+                selectors,
+                inspection,
+                window: creditWindow,
+            });
             pingInterval = setInterval(() => {
                 if (ws.readyState === ws_1.WebSocket.OPEN) {
                     ws.ping(undefined, true, frameSent);
@@ -419,10 +666,10 @@ async function startDestinationTcpTunnel(remoteURL, token, options) {
             try {
                 armLivenessDeadline();
                 if (isBinary) {
-                    handleBinary(toBuffer(data));
+                    handleBinary((0, destination_tunnel_wire_reader_1.toBuffer)(data));
                 }
                 else {
-                    handleControl((0, destination_tunnel_1.decodeDestinationTunnelServerMessage)(JSON.parse(toBuffer(data).toString('utf8'))));
+                    handleControl((0, destination_tunnel_1.decodeDestinationTunnelServerMessage)(JSON.parse((0, destination_tunnel_wire_reader_1.toBuffer)(data).toString('utf8'))));
                 }
             }
             catch (error) {
@@ -444,6 +691,28 @@ async function startDestinationTcpTunnel(remoteURL, token, options) {
         });
     });
 }
+/**
+ * Whether a resolved domain address may be dialed. Ordinary unicast targets
+ * (including private ranges the user's machine can reach) are allowed;
+ * loopback, link-local, multicast, unspecified, broadcast, and similar
+ * special targets are blocked unless an exact route grants them.
+ */
+function isDialableResolvedAddress(address, port, routes) {
+    for (const route of routes) {
+        if (route.port !== port)
+            continue;
+        if (route.host === address)
+            return true;
+        if (route.host === 'localhost' && (address === '127.0.0.1' || address === '::1'))
+            return true;
+    }
+    const version = net_1.default.isIP(address);
+    if (version === 4)
+        return !blockedResolvedAddresses.check(address, 'ipv4');
+    if (version === 6)
+        return !blockedResolvedAddresses.check(address, 'ipv6');
+    return false;
+}
 function classifyOpenFailure(error) {
     switch (error.code) {
         case 'ENOTFOUND':
@@ -461,6 +730,7 @@ function classifyOpenFailure(error) {
             return 'unreachable';
         case 'EACCES':
         case 'EPERM':
+        case 'EPROXYAUTH':
             return 'permission_denied';
         case 'EMFILE':
         case 'ENFILE':
@@ -469,7 +739,30 @@ function classifyOpenFailure(error) {
             return 'resource_exhausted';
         case 'ECANCELED':
             return 'cancelled';
+        case 'CERT_HAS_EXPIRED':
+        case 'CERT_NOT_YET_VALID':
+        case 'CERT_REJECTED':
+        case 'CERT_REVOKED':
+        case 'CERT_SIGNATURE_FAILURE':
+        case 'CERT_UNTRUSTED':
+        case 'DEPTH_ZERO_SELF_SIGNED_CERT':
+        case 'ERR_TLS_CERT_ALTNAME_FORMAT':
+        case 'SELF_SIGNED_CERT_IN_CHAIN':
+        case 'HOSTNAME_MISMATCH':
+        case 'INVALID_CA':
+        case 'INVALID_PURPOSE':
+        case 'PATH_LENGTH_EXCEEDED':
+        case 'UNABLE_TO_GET_ISSUER_CERT':
+        case 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY':
+        case 'UNABLE_TO_VERIFY_LEAF_SIGNATURE':
+        case 'ERR_TLS_CERT_ALTNAME_INVALID':
+            return 'tls_validation_failed';
+        case 'EPROTO':
+            return 'tls_protocol_error';
         default:
+            if (error.code?.startsWith('ERR_SSL_') || error.code?.startsWith('ERR_TLS_')) {
+                return 'tls_handshake_failed';
+            }
             return 'internal';
     }
 }
@@ -479,13 +772,4 @@ function positiveInteger(value, name) {
     }
     return value;
 }
-function toBuffer(data) {
-    if (Buffer.isBuffer(data))
-        return data;
-    if (Array.isArray(data))
-        return Buffer.concat(data);
-    if (data instanceof ArrayBuffer)
-        return Buffer.from(data);
-    throw new destination_tunnel_1.DestinationTunnelProtocolError('unsupported WebSocket payload type');
-}
 //# sourceMappingURL=destination-tunnel-dialer.js.map