@linzumi/cli 1.0.276 → 1.0.278

package/dist/tcp-tunnel-cli.mjs

@@ -1,24 +1,24 @@
 import { createRequire as __linzumiBundleCreateRequire } from 'node:module';
 const require = __linzumiBundleCreateRequire(import.meta.url);
-import*as ne from"ws";import*as w from"node:fs";import*as j from"node:os";import*as re from"node:net";import*as L from"node:path";function O(e){return e===void 0?{BS_PRIVATE_NESTED_SOME_NONE:0}:e!==null&&e.BS_PRIVATE_NESTED_SOME_NONE!==void 0?{BS_PRIVATE_NESTED_SOME_NONE:e.BS_PRIVATE_NESTED_SOME_NONE+1|0}:e}function M(e){if(e!=null)return O(e)}function T(e){if(e===null||e.BS_PRIVATE_NESTED_SOME_NONE===void 0)return e;let n=e.BS_PRIVATE_NESTED_SOME_NONE;if(n!==0)return{BS_PRIVATE_NESTED_SOME_NONE:n-1|0}}function W(e,n){let r=e.findIndex(n);if(r!==-1)return r}function H(e,n){let r=n!==void 0?parseInt(e,n):parseInt(e);if(!(Number.isNaN(r)||r>2147483647||r<-2147483648))return r|0}import*as D from"node:crypto";function q(e){if(e.RE_EXN_ID==="JsExn")return O(e._1)}var N=(e=>n=>n&&typeof n[e]=="string"?n[e]:void 0),Je=N("stack"),K=N("message"),je=N("name"),Ue=N("fileName");function G(e,n){if(e!==void 0)return n(T(e))}function S(e,n){return e!==void 0?T(e):n}function se(e){return e==null?!1:typeof e.RE_EXN_ID=="string"}function P(e){return se(e)?e:{RE_EXN_ID:"JsExn",_1:e}}function U(e,n){return e.catch(r=>n(P(r)))}import{existsSync as Q,readFileSync as Z}from"node:fs";import{Agent as ce}from"undici";import He from"ws";function $(){let e=process.env.KANDAN_TLS_CA_FILE;if(e===void 0||e.trim()==="")return;let n=e.trim();if(!Q(n))throw new Error(`KANDAN_TLS_CA_FILE does not exist: ${n}`);return Z(n,"utf8")}function ye(){return pe(process.env.KANDAN_TLS_CA_FILE)}function pe(e){if(e===void 0||e.trim()==="")return;let n=e.trim();if(!Q(n))throw new Error(`KANDAN_TLS_CA_FILE does not exist: ${n}`);let r=Z(n,"utf8");return{caFile:n,ca:r,dispatcher:new ce({connect:{ca:r}})}}function fe(e){return e===void 0?fetch:((n,r)=>{let t={...r??{},dispatcher:e.dispatcher};return fetch(n,t)})}function A(){return fe(ye())}var Qe=64*1024*1024,Ze=32*1024;function en(e){return $()}function nn(e){return A()}var ge="wss://linzumi.link",he="https://serve.linzumi.com";function rn(e){return new Error(e)}function z(e){let n=q(e);return n!==void 0?S(K(T(n)),"unknown error"):"unknown error"}function J(e,n){let r=e.trim();if(r==="")throw new Error(n+" must not be empty");return r}function tn(e){return e%256}function we(e,n){let r=new Error("tunnel refused "+e.toString()+": "+n);return r.name="TunnelRefusalError",r.code=e,r.reason=n,r.exitCode=e%256,r}function be(e,n,r){let t=new Error(n);return t.name="TunnelListenerError",t.code=e,t.exitCode=r,t}function _e(e,n){let r=new URL(e),t=r.protocol,i;switch(t){case"https:":case"wss:":i="wss:";break;default:i="ws:"}return r.protocol=i,r.pathname="/tunnel/connect",r.search="",r.searchParams.set("forward_id",n),r.hash="",r.toString()}function ve(e){switch(e){case 4001:return"authentication invalid, expired, or timed out";case 4002:return"share revoked or unpublished";case 4003:return"preview origin unavailable";case 4004:return"target is not a registered approved forward";case 4005:return"runner offline or runner-side connection failed";case 4006:return"protocol error";case 4007:return"idle timeout";case 4008:return"concurrency cap reached";default:return"connection closed"}}function Ie(e){let n;try{n=JSON.parse(e)}catch{n=void 0}if(n===void 0||typeof n!="object"||n===null||Array.isArray(n))return"Invalid";let r=n.ok,t=n.tunnel_id;if(r===!0&&typeof t=="string"?t.trim()!=="":!1)return"Ready";let o=n.error,a=n.reason;return o!==void 0&&typeof o=="number"&&a!==void 0&&typeof a=="string"&&o>=4001&&o<=4008&&a.trim()!==""?{NAME:"Refusal",VAL:[o|0,a]}:"Invalid"}async function te(e,n,r,t,i){let o=i!==void 0?i:b=>{},a=n.kind,u;switch(a){case"share-token":u="Bearer share_token:"+n.token;break;case"user-session":u="Bearer user_session:"+n.token;break;default:throw new Error("unknown tunnel credential kind: "+a)}let c=Object.fromEntries([["authorization",u]]),l=t!==void 0?r(e,{headers:c,ca:t}):r(e,{headers:c});o(l);let d={contents:!1},s={contents:void 0},p={contents:[]},y={contents:void 0},f={contents:void 0},v=new Promise((b,I)=>{f.contents=b});return await new Promise((b,I)=>{l.on("message",(_,g)=>{if(g){let k=d.contents,x=_.byteLength<=65536;if(k&&x){let F=s.contents;if(F!==void 0)return F(_,l);p.contents.push(_);return}return l.close(4006,"protocol error"),d.contents?void 0:I(new Error("tunnel sent binary data before authentication"))}let m=Ie(_.toString("utf8"));if(typeof m!="object")return m==="Invalid"?(l.close(4006,"unexpected text frame"),d.contents?void 0:I(new Error("tunnel returned an invalid authentication frame"))):(d.contents=!0,b());let h=m.VAL;y.contents=[h[0],h[1]]}),l.once("error",_=>{if(!d.contents)return I(P(_))}),l.once("close",(_,g)=>{let m=y.contents,h;if(m!==void 0)h=m[1];else{let F=g.toString("utf8").trim();h=F===""?ve(_):F}let k=f.contents;if(k!==void 0&&k({code:_,reason:h}),d.contents)return;let x=y.contents;return I(x!==void 0?we(x[0],x[1]):new Error("tunnel closed before authentication ("+_.toString()+": "+h+")"))})}),{websocket:l,closed:v,attachBinary:b=>{if(s.contents!==void 0)throw new Error("tunnel binary pipe is already attached");s.contents=b,p.contents.forEach(_=>b(_,l)),p.contents=[]},close:async()=>{let b=l.readyState;return b!==3&&b!==2&&l.close(1e3,"local stream closed"),await v.then(I=>Promise.resolve())},terminate:async()=>(l.readyState!==3&&l.terminate(),await v.then(I=>Promise.resolve()))}}function ke(e,n){return new Promise((r,t)=>{if(e.readyState!==1)return t(new Error("tunnel WebSocket is not open"));e.send(n,{binary:!0},o=>o==null?r():t(P(o)))})}function Se(e){return e.destroyed?Promise.resolve():new Promise((n,r)=>{let t={contents:!1},i={contents:void 0},o=()=>{if(t.contents)return;t.contents=!0;let a=i.contents;a!==void 0&&clearTimeout(a),n()};e.once("close",o),e.end(()=>{if(e.destroyed)return o();i.contents=setTimeout(()=>{e.destroyed||e.destroy(),o()},2e3)})})}function Ee(e){e.socket.destroyed||e.socket.destroy();let n=e.tunnel,r=n!==void 0?O(n.websocket):e.websocket;if(r===void 0)return;let t=T(r);if(t.readyState!==3){t.terminate();return}}function Pe(e,n,r){let t={contents:void 0},i={contents:!1};return o=>{let a=t.contents;if(a!==void 0){let d=i.contents;return o==="ListenerShutdown"&&(d||(i.contents=!0,Ee(e))),a}let u={contents:void 0},c=new Promise((d,s)=>{u.contents=d});return t.contents=c,U((async()=>{if(o==="RelayFailure"){let s=e.tunnel;if(s!==void 0){let p=s.websocket.readyState,y=0;p>=2?p>=4&&(y=1):p>=0?s.websocket.terminate():y=1,y===1&&n("linzumi connect: stream "+e.id+" relay-failure teardown saw unknown WebSocket state "+p.toString()+`
-`),await s.closed.then(f=>Promise.resolve())}else n("linzumi connect: stream "+e.id+` relay-failure teardown had no active tunnel to abort
-`)}switch(o){case"LocalFirst":break;case"RemoteFirst":case"RelayFailure":await Se(e.socket);break;case"ListenerShutdown":e.socket.destroy();break}let d=0;switch(o){case"LocalFirst":case"RemoteFirst":d=1;break;case"RelayFailure":break;case"ListenerShutdown":let s=e.tunnel;if(s!==void 0)await s.terminate();else{let p=e.websocket;if(p!==void 0){let y=T(p);y.readyState!==3&&y.terminate()}else n("linzumi connect: stream "+e.id+` teardown had no WebSocket to close
-`)}break}if(d===1){let s=e.tunnel;if(s!==void 0)await s.close();else{let p=e.websocket;if(p!==void 0){let y=T(p),f=y.readyState;f>3||f<1?f!==0?n("linzumi connect: stream "+e.id+" teardown saw unknown WebSocket state "+f.toString()+`
-`):y.terminate():f>=2||y.close(1e3,"local stream closed")}else n("linzumi connect: stream "+e.id+` teardown had no WebSocket to close
+import*as ne from"ws";import*as w from"node:fs";import*as j from"node:os";import*as re from"node:net";import*as L from"node:path";function O(e){return e===void 0?{BS_PRIVATE_NESTED_SOME_NONE:0}:e!==null&&e.BS_PRIVATE_NESTED_SOME_NONE!==void 0?{BS_PRIVATE_NESTED_SOME_NONE:e.BS_PRIVATE_NESTED_SOME_NONE+1|0}:e}function M(e){if(e!=null)return O(e)}function T(e){if(e===null||e.BS_PRIVATE_NESTED_SOME_NONE===void 0)return e;let n=e.BS_PRIVATE_NESTED_SOME_NONE;if(n!==0)return{BS_PRIVATE_NESTED_SOME_NONE:n-1|0}}function W(e,n){let r=e.findIndex(n);if(r!==-1)return r}function H(e,n){let r=n!==void 0?parseInt(e,n):parseInt(e);if(!(Number.isNaN(r)||r>2147483647||r<-2147483648))return r|0}import*as U from"node:crypto";function q(e){if(e.RE_EXN_ID==="JsExn")return O(e._1)}var N=(e=>n=>n&&typeof n[e]=="string"?n[e]:void 0),Je=N("stack"),K=N("message"),je=N("name"),De=N("fileName");function G(e,n){if(e!==void 0)return n(T(e))}function S(e,n){return e!==void 0?T(e):n}function se(e){return e==null?!1:typeof e.RE_EXN_ID=="string"}function P(e){return se(e)?e:{RE_EXN_ID:"JsExn",_1:e}}function D(e,n){return e.catch(r=>n(P(r)))}import{existsSync as Q,readFileSync as Z}from"node:fs";import{Agent as ce}from"undici";import He from"ws";function $(){let e=process.env.KANDAN_TLS_CA_FILE;if(e===void 0||e.trim()==="")return;let n=e.trim();if(!Q(n))throw new Error(`KANDAN_TLS_CA_FILE does not exist: ${n}`);return Z(n,"utf8")}function ye(){return fe(process.env.KANDAN_TLS_CA_FILE)}function fe(e){if(e===void 0||e.trim()==="")return;let n=e.trim();if(!Q(n))throw new Error(`KANDAN_TLS_CA_FILE does not exist: ${n}`);let r=Z(n,"utf8");return{caFile:n,ca:r,dispatcher:new ce({connect:{ca:r}})}}function pe(e){return e===void 0?fetch:((n,r)=>{let t={...r??{},dispatcher:e.dispatcher};return fetch(n,t)})}function A(){return pe(ye())}var Qe=64*1024*1024,Ze=32*1024;function en(e){return $()}function nn(e){return A()}var ge="wss://linzumi.link",he="https://serve.linzumi.com";function rn(e){return new Error(e)}function z(e){let n=q(e);return n!==void 0?S(K(T(n)),"unknown error"):"unknown error"}function J(e,n){let r=e.trim();if(r==="")throw new Error(n+" must not be empty");return r}function tn(e){return e%256}function we(e,n){let r=new Error("tunnel refused "+e.toString()+": "+n);return r.name="TunnelRefusalError",r.code=e,r.reason=n,r.exitCode=e%256,r}function be(e,n,r){let t=new Error(n);return t.name="TunnelListenerError",t.code=e,t.exitCode=r,t}function _e(e,n){let r=new URL(e),t=r.protocol,i;switch(t){case"https:":case"wss:":i="wss:";break;default:i="ws:"}return r.protocol=i,r.pathname="/tunnel/connect",r.search="",r.searchParams.set("forward_id",n),r.hash="",r.toString()}function ve(e){switch(e){case 4001:return"authentication invalid, expired, or timed out";case 4002:return"share revoked or unpublished";case 4003:return"preview origin unavailable";case 4004:return"target is not a registered approved forward";case 4005:return"runner offline or runner-side connection failed";case 4006:return"protocol error";case 4007:return"idle timeout";case 4008:return"concurrency cap reached";default:return"connection closed"}}function Ie(e){let n;try{n=JSON.parse(e)}catch{n=void 0}if(n===void 0||typeof n!="object"||n===null||Array.isArray(n))return"Invalid";let r=n.ok,t=n.tunnel_id;if(r===!0&&typeof t=="string"?t.trim()!=="":!1)return"Ready";let o=n.error,a=n.reason;return o!==void 0&&typeof o=="number"&&a!==void 0&&typeof a=="string"&&o>=4001&&o<=4008&&a.trim()!==""?{NAME:"Refusal",VAL:[o|0,a]}:"Invalid"}async function te(e,n,r,t,i){let o=i!==void 0?i:b=>{},a=n.kind,u;switch(a){case"share-token":u="Bearer share_token:"+n.token;break;case"user-session":u="Bearer user_session:"+n.token;break;default:throw new Error("unknown tunnel credential kind: "+a)}let c=Object.fromEntries([["authorization",u]]),l=t!==void 0?r(e,{headers:c,ca:t}):r(e,{headers:c});o(l);let d={contents:!1},s={contents:void 0},f={contents:[]},y={contents:void 0},p={contents:void 0},v=new Promise((b,I)=>{p.contents=b});return await new Promise((b,I)=>{l.on("message",(_,g)=>{if(g){let k=d.contents,x=_.byteLength<=65536;if(k&&x){let F=s.contents;if(F!==void 0)return F(_,l);f.contents.push(_);return}return l.close(4006,"protocol error"),d.contents?void 0:I(new Error("tunnel sent binary data before authentication"))}let m=Ie(_.toString("utf8"));if(typeof m!="object")return m==="Invalid"?(l.close(4006,"unexpected text frame"),d.contents?void 0:I(new Error("tunnel returned an invalid authentication frame"))):(d.contents=!0,b());let h=m.VAL;y.contents=[h[0],h[1]]}),l.once("error",_=>{if(!d.contents)return I(P(_))}),l.once("close",(_,g)=>{let m=y.contents,h;if(m!==void 0)h=m[1];else{let F=g.toString("utf8").trim();h=F===""?ve(_):F}let k=p.contents;if(k!==void 0&&k({code:_,reason:h}),d.contents)return;let x=y.contents;return I(x!==void 0?we(x[0],x[1]):new Error("tunnel closed before authentication ("+_.toString()+": "+h+")"))})}),{websocket:l,closed:v,attachBinary:b=>{if(s.contents!==void 0)throw new Error("tunnel binary pipe is already attached");s.contents=b,f.contents.forEach(_=>b(_,l)),f.contents=[]},close:async()=>{let b=l.readyState;return b!==3&&b!==2&&l.close(1e3,"local stream closed"),await v.then(I=>Promise.resolve())},terminate:async()=>(l.readyState!==3&&l.terminate(),await v.then(I=>Promise.resolve()))}}function ke(e,n){return new Promise((r,t)=>{if(e.readyState!==1)return t(new Error("tunnel WebSocket is not open"));e.send(n,{binary:!0},o=>o==null?r():t(P(o)))})}function Se(e){return e.destroyed?Promise.resolve():new Promise((n,r)=>{let t={contents:!1},i={contents:void 0},o=()=>{if(t.contents)return;t.contents=!0;let a=i.contents;a!==void 0&&clearTimeout(a),n()};e.once("close",o),e.end(()=>{if(e.destroyed)return o();i.contents=setTimeout(()=>{e.destroyed||e.destroy(),o()},2e3)})})}function Ee(e){e.socket.destroyed||e.socket.destroy();let n=e.tunnel,r=n!==void 0?O(n.websocket):e.websocket;if(r===void 0)return;let t=T(r);if(t.readyState!==3){t.terminate();return}}function Pe(e,n,r){let t={contents:void 0},i={contents:!1};return o=>{let a=t.contents;if(a!==void 0){let d=i.contents;return o==="ListenerShutdown"&&(d||(i.contents=!0,Ee(e))),a}let u={contents:void 0},c=new Promise((d,s)=>{u.contents=d});return t.contents=c,D((async()=>{if(o==="RelayFailure"){let s=e.tunnel;if(s!==void 0){let f=s.websocket.readyState,y=0;f>=2?f>=4&&(y=1):f>=0?s.websocket.terminate():y=1,y===1&&n("linzumi connect: stream "+e.id+" relay-failure teardown saw unknown WebSocket state "+f.toString()+`
+`),await s.closed.then(p=>Promise.resolve())}else n("linzumi connect: stream "+e.id+` relay-failure teardown had no active tunnel to abort
+`)}switch(o){case"LocalFirst":break;case"RemoteFirst":case"RelayFailure":await Se(e.socket);break;case"ListenerShutdown":e.socket.destroy();break}let d=0;switch(o){case"LocalFirst":case"RemoteFirst":d=1;break;case"RelayFailure":break;case"ListenerShutdown":let s=e.tunnel;if(s!==void 0)await s.terminate();else{let f=e.websocket;if(f!==void 0){let y=T(f);y.readyState!==3&&y.terminate()}else n("linzumi connect: stream "+e.id+` teardown had no WebSocket to close
+`)}break}if(d===1){let s=e.tunnel;if(s!==void 0)await s.close();else{let f=e.websocket;if(f!==void 0){let y=T(f),p=y.readyState;p>3||p<1?p!==0?n("linzumi connect: stream "+e.id+" teardown saw unknown WebSocket state "+p.toString()+`
+`):y.terminate():p>=2||y.close(1e3,"local stream closed")}else n("linzumi connect: stream "+e.id+` teardown had no WebSocket to close
 `)}}return e.websocket=void 0,e.tunnel=void 0,r(e.id)})(),d=>(n("linzumi connect: stream "+e.id+" teardown failed: "+z(d)+`
 `),e.socket.destroy(),e.websocket=void 0,e.tunnel=void 0,r(e.id),Promise.resolve())).then(()=>{let d=u.contents;return d!==void 0?d():n("linzumi connect: stream "+e.id+` teardown completion was unavailable
 `),Promise.resolve()}),c}}function xe(e){return e.listening?new Promise((n,r)=>{e.close(t=>t==null?n():r(P(t)))}):Promise.resolve()}function Te(e,n){return new Promise((r,t)=>{let i=a=>{e.off("listening",o),t(P(a))},o=()=>{e.off("error",i),r()};e.once("error",i),e.once("listening",o),e.listen(n,"127.0.0.1")})}async function Fe(e,n,r,t,i,o,a,u){let c=Pe(e,o,u);e.teardown=c,e.socket.once("error",l=>{o("linzumi connect: local stream failed: "+l.message+`
-`),e.socket.destroy(),c("LocalFirst")}),e.socket.once("close",()=>{c("LocalFirst")});try{let l=await te(n,r,t,i,f=>{e.websocket=O(f)});e.tunnel=l;let d=a(),s=e.socket.destroyed;if(d)return await c("ListenerShutdown");if(s)return await c("LocalFirst");l.attachBinary((f,v)=>{if(!e.socket.write(f)){v.pause(),e.socket.once("drain",()=>{v.resume()});return}});let p={contents:Promise.resolve()};e.socket.on("data",f=>{e.socket.pause(),p.contents=U(p.contents.then(async()=>{let v=async E=>{if(E>=f.byteLength)return;let b=(E+65536|0)>f.byteLength?f.byteLength:E+65536|0;return await ke(l.websocket,f.subarray(E,b)),await v(E+65536|0)};if(await v(0),!e.socket.destroyed){e.socket.resume();return}}),v=>(o("linzumi connect: stream relay failed: "+z(v)+`
+`),e.socket.destroy(),c("LocalFirst")}),e.socket.once("close",()=>{c("LocalFirst")});try{let l=await te(n,r,t,i,p=>{e.websocket=O(p)});e.tunnel=l;let d=a(),s=e.socket.destroyed;if(d)return await c("ListenerShutdown");if(s)return await c("LocalFirst");l.attachBinary((p,v)=>{if(!e.socket.write(p)){v.pause(),e.socket.once("drain",()=>{v.resume()});return}});let f={contents:Promise.resolve()};e.socket.on("data",p=>{e.socket.pause(),f.contents=D(f.contents.then(async()=>{let v=async E=>{if(E>=p.byteLength)return;let b=(E+65536|0)>p.byteLength?p.byteLength:E+65536|0;return await ke(l.websocket,p.subarray(E,b)),await v(E+65536|0)};if(await v(0),!e.socket.destroyed){e.socket.resume();return}}),v=>(o("linzumi connect: stream relay failed: "+z(v)+`
 `),c("RelayFailure"),Promise.resolve()))}),e.socket.resume();let y=await l.closed;return await c("RemoteFirst"),a()?void 0:o("linzumi connect: stream closed "+y.code.toString()+": "+y.reason+`
 `)}catch(l){let d=P(l);return o("linzumi connect: stream failed: "+z(d)+`
-`),e.socket.destroy(),await c(a()?"ListenerShutdown":"LocalFirst")}}async function Oe(e){let n=J(e.forwardId,"forward id"),t=e.credential.kind,i=J(e.credential.token,"tunnel credential"),o={kind:t,token:i},a=S(e.writeStderr,g=>{process.stderr.write(g)}),u=S(e.webSocketFactory,(g,m)=>new ne.WebSocket(g,m)),c=$(),l=c==null?void 0:O(c),d=_e(e.tunnelBaseUrl,n);await(await te(d,o,u,l,void 0)).terminate();let p=re.createServer({allowHalfOpen:!0}),y=[],f={contents:!1},v={contents:void 0},E=new Promise((g,m)=>{v.contents=g});p.on("connection",g=>{g.pause();let m={id:D.randomUUID(),socket:g,websocket:void 0,tunnel:void 0,teardown:void 0};y.push(m),Fe(m,d,o,u,l,a,()=>f.contents,h=>{let k=W(y,x=>x.id===h);if(k!==void 0){y.splice(k,1);return}else return a("linzumi connect: completed stream "+h+` was absent from the registry
-`)})});try{await Te(p,e.localPort)}catch(g){let m=P(g),h=q(m);if(h!==void 0){let k=T(h).code;throw k==null?m:k==="EADDRINUSE"?be("EADDRINUSE","127.0.0.1:"+e.localPort.toString()+" is already in use",2):m}throw m}let b=p.address(),I;if(b==null)throw new Error("TCP tunnel listener did not expose a loopback TCP port");return I=b.port,{port:I,closed:E,close:async()=>{if(f.contents)return await E;f.contents=!0;let g=y.map(h=>{let k=h.teardown;return k!==void 0?k("ListenerShutdown"):(a("linzumi connect: stream "+h.id+` had no teardown during listener shutdown
-`),h.socket.destroy(),Promise.resolve())});await xe(p),await Promise.all(g).then(h=>Promise.resolve());let m=v.contents;if(m!==void 0)return m()},activeStreamCount:()=>y.length}}function on(e){return L.join(e,".linzumi","user-auth.json")}function an(){return L.join(j.homedir(),".linzumi","user-auth.json")}function B(e){let n=new URL(e),r=n.protocol,t;switch(r){case"https:":case"wss:":t="https:";break;default:t="http:"}n.protocol=t,n.pathname="",n.search="",n.hash="";let i=n.toString();return i.endsWith("/")?i.slice(0,i.length-1|0):i}function C(e,n){let r=e[n];if(typeof r=="string"){if(r.trim()==="")throw new Error("Linzumi CLI login response was missing "+n);return r}throw new Error("Linzumi CLI login response was missing "+n)}function Y(e,n){let r=e[n];if(typeof r=="number"){if(r>0)return r;throw new Error("Linzumi CLI login response had invalid "+n)}throw new Error("Linzumi CLI login response had invalid "+n)}function Ce(e){let n;try{n=JSON.parse(w.readFileSync(e,"utf8"))}catch(r){let t=P(r);throw new Error("cannot read Linzumi user auth at "+e+"; run `linzumi login` ("+z(t)+")")}if(typeof n=="object"&&n!==null&&!Array.isArray(n)){if(n.version===1)return{version:1,apiUrl:C(n,"apiUrl"),token:C(n,"token")};throw new Error("invalid Linzumi user auth at "+e+"; run `linzumi login`")}throw new Error("invalid Linzumi user auth at "+e+"; run `linzumi login`")}function Le(e,n){let r=L.dirname(n);w.mkdirSync(r,{recursive:!0,mode:448}),w.chmodSync(r,448);let t=n+"."+process.pid.toString()+"."+D.randomUUID()+".tmp",i;try{let o=w.openSync(t,"wx",384);i=o;let a=JSON.stringify({version:e.version,apiUrl:e.apiUrl,token:e.token}),u;if(a!==void 0)u=a;else throw new Error("Linzumi user auth serialization failed");w.writeFileSync(o,u+`
-`,"utf8"),w.closeSync(o),i=void 0,w.chmodSync(t,384),w.renameSync(t,n),w.chmodSync(n,384);return}catch(o){let a=i;throw a!==void 0&&w.closeSync(a),w.rmSync(t,{force:!0}),o}}async function ee(e,n,r,t,i){let o=JSON.stringify({operationName:r,documentId:t,variables:i}),a;if(o!==void 0)a=o;else throw new Error("Linzumi CLI login request serialization failed");let u=await e(n,{method:"POST",headers:Object.fromEntries([["content-type","application/json"]]),body:a}),c=await u.json();if(u.ok){if(typeof c=="object"&&c!==null&&!Array.isArray(c)){let l=c.errors;if(l!==void 0)if(Array.isArray(l)){if(l.length!==0)throw new Error("Linzumi CLI login returned GraphQL errors")}else throw new Error("Linzumi CLI login returned GraphQL errors");let d=c.data;if(d!==void 0){if(typeof d=="object"&&d!==null&&!Array.isArray(d))return d;throw new Error("Linzumi CLI login returned no GraphQL data")}throw new Error("Linzumi CLI login returned no GraphQL data")}throw new Error("Linzumi CLI login returned invalid GraphQL JSON")}throw new Error("Linzumi CLI login request failed: HTTP "+u.status.toString()+" "+u.statusText)}async function dn(e,n){let r=n.fetchImpl,t=r!==void 0?r:A(),i=S(n.wait,_=>new Promise((g,m)=>{setTimeout(()=>g(),_)})),o=S(n.now,()=>Date.now()),a=S(e.writeStdout,_=>{process.stdout.write(_)}),u=B(e.apiUrl),c=new URL("/api/v2/graphql",u).toString(),d=(await ee(t,c,"StartCliDeviceLogin","CE6X73GvfyE",{})).startCliDeviceLogin,s;if(d!==void 0)if(typeof d=="object"&&d!==null&&!Array.isArray(d))s=d;else throw new Error("Linzumi CLI login response was missing startCliDeviceLogin");else throw new Error("Linzumi CLI login response was missing startCliDeviceLogin");switch(C(s,"__typename")){case"StartCliDeviceLoginPendingSessionLimit":throw new Error("Linzumi CLI login reached the pending session limit; finish an existing login");case"StartCliDeviceLoginRateLimited":throw new Error("Linzumi CLI login was rate limited; try again later");case"StartCliDeviceLoginSuccess":break;default:throw new Error("Linzumi CLI login returned an unknown startCliDeviceLogin result")}let y=C(s,"deviceCode"),f=C(s,"userCode"),v=C(s,"verifyUrl"),E=Y(s,"interval")*1e3,b=o()+Y(s,"expiresIn")*1e3;a(`Log in to Linzumi:
-Code: `+f+`
+`),e.socket.destroy(),await c(a()?"ListenerShutdown":"LocalFirst")}}async function Oe(e){let n=J(e.forwardId,"forward id"),t=e.credential.kind,i=J(e.credential.token,"tunnel credential"),o={kind:t,token:i},a=S(e.writeStderr,g=>{process.stderr.write(g)}),u=S(e.webSocketFactory,(g,m)=>new ne.WebSocket(g,m)),c=$(),l=c==null?void 0:O(c),d=_e(e.tunnelBaseUrl,n);await(await te(d,o,u,l,void 0)).terminate();let f=re.createServer({allowHalfOpen:!0}),y=[],p={contents:!1},v={contents:void 0},E=new Promise((g,m)=>{v.contents=g});f.on("connection",g=>{g.pause();let m={id:U.randomUUID(),socket:g,websocket:void 0,tunnel:void 0,teardown:void 0};y.push(m),Fe(m,d,o,u,l,a,()=>p.contents,h=>{let k=W(y,x=>x.id===h);if(k!==void 0){y.splice(k,1);return}else return a("linzumi connect: completed stream "+h+` was absent from the registry
+`)})});try{await Te(f,e.localPort)}catch(g){let m=P(g),h=q(m);if(h!==void 0){let k=T(h).code;throw k==null?m:k==="EADDRINUSE"?be("EADDRINUSE","127.0.0.1:"+e.localPort.toString()+" is already in use",2):m}throw m}let b=f.address(),I;if(b==null)throw new Error("TCP tunnel listener did not expose a loopback TCP port");return I=b.port,{port:I,closed:E,close:async()=>{if(p.contents)return await E;p.contents=!0;let g=y.map(h=>{let k=h.teardown;return k!==void 0?k("ListenerShutdown"):(a("linzumi connect: stream "+h.id+` had no teardown during listener shutdown
+`),h.socket.destroy(),Promise.resolve())});await xe(f),await Promise.all(g).then(h=>Promise.resolve());let m=v.contents;if(m!==void 0)return m()},activeStreamCount:()=>y.length}}function on(e){return L.join(e,".linzumi","user-auth.json")}function an(){return L.join(j.homedir(),".linzumi","user-auth.json")}function B(e){let n=new URL(e),r=n.protocol,t;switch(r){case"https:":case"wss:":t="https:";break;default:t="http:"}n.protocol=t,n.pathname="",n.search="",n.hash="";let i=n.toString();return i.endsWith("/")?i.slice(0,i.length-1|0):i}function C(e,n){let r=e[n];if(typeof r=="string"){if(r.trim()==="")throw new Error("Linzumi CLI login response was missing "+n);return r}throw new Error("Linzumi CLI login response was missing "+n)}function Y(e,n){let r=e[n];if(typeof r=="number"){if(r>0)return r;throw new Error("Linzumi CLI login response had invalid "+n)}throw new Error("Linzumi CLI login response had invalid "+n)}function Ce(e){let n;try{n=JSON.parse(w.readFileSync(e,"utf8"))}catch(r){let t=P(r);throw new Error("cannot read Linzumi user auth at "+e+"; run `linzumi login` ("+z(t)+")")}if(typeof n=="object"&&n!==null&&!Array.isArray(n)){if(n.version===1)return{version:1,apiUrl:C(n,"apiUrl"),token:C(n,"token")};throw new Error("invalid Linzumi user auth at "+e+"; run `linzumi login`")}throw new Error("invalid Linzumi user auth at "+e+"; run `linzumi login`")}function Le(e,n){let r=L.dirname(n);w.mkdirSync(r,{recursive:!0,mode:448}),w.chmodSync(r,448);let t=n+"."+process.pid.toString()+"."+U.randomUUID()+".tmp",i;try{let o=w.openSync(t,"wx",384);i=o;let a=JSON.stringify({version:e.version,apiUrl:e.apiUrl,token:e.token}),u;if(a!==void 0)u=a;else throw new Error("Linzumi user auth serialization failed");w.writeFileSync(o,u+`
+`,"utf8"),w.closeSync(o),i=void 0,w.chmodSync(t,384),w.renameSync(t,n),w.chmodSync(n,384);return}catch(o){let a=i;throw a!==void 0&&w.closeSync(a),w.rmSync(t,{force:!0}),o}}async function ee(e,n,r,t,i){let o=JSON.stringify({operationName:r,documentId:t,variables:i}),a;if(o!==void 0)a=o;else throw new Error("Linzumi CLI login request serialization failed");let u=await e(n,{method:"POST",headers:Object.fromEntries([["content-type","application/json"]]),body:a}),c=await u.json();if(u.ok){if(typeof c=="object"&&c!==null&&!Array.isArray(c)){let l=c.errors;if(l!==void 0)if(Array.isArray(l)){if(l.length!==0)throw new Error("Linzumi CLI login returned GraphQL errors")}else throw new Error("Linzumi CLI login returned GraphQL errors");let d=c.data;if(d!==void 0){if(typeof d=="object"&&d!==null&&!Array.isArray(d))return d;throw new Error("Linzumi CLI login returned no GraphQL data")}throw new Error("Linzumi CLI login returned no GraphQL data")}throw new Error("Linzumi CLI login returned invalid GraphQL JSON")}throw new Error("Linzumi CLI login request failed: HTTP "+u.status.toString()+" "+u.statusText)}async function dn(e,n){let r=n.fetchImpl,t=r!==void 0?r:A(),i=S(n.wait,_=>new Promise((g,m)=>{setTimeout(()=>g(),_)})),o=S(n.now,()=>Date.now()),a=S(e.writeStdout,_=>{process.stdout.write(_)}),u=B(e.apiUrl),c=new URL("/api/v2/graphql",u).toString(),d=(await ee(t,c,"StartCliDeviceLogin","CE6X73GvfyE",{})).startCliDeviceLogin,s;if(d!==void 0)if(typeof d=="object"&&d!==null&&!Array.isArray(d))s=d;else throw new Error("Linzumi CLI login response was missing startCliDeviceLogin");else throw new Error("Linzumi CLI login response was missing startCliDeviceLogin");switch(C(s,"__typename")){case"StartCliDeviceLoginPendingSessionLimit":throw new Error("Linzumi CLI login reached the pending session limit; finish an existing login");case"StartCliDeviceLoginRateLimited":throw new Error("Linzumi CLI login was rate limited; try again later");case"StartCliDeviceLoginSuccess":break;default:throw new Error("Linzumi CLI login returned an unknown startCliDeviceLogin result")}let y=C(s,"deviceCode"),p=C(s,"userCode"),v=C(s,"verifyUrl"),E=Y(s,"interval")*1e3,b=o()+Y(s,"expiresIn")*1e3;a(`Log in to Linzumi:
+Code: `+p+`
 Open: `+v+`
 `);let I=async()=>{if(o()<b){await i(E);let g=(await ee(t,c,"PollCliDeviceLogin","u2t1DgIfG-8",{deviceCode:y})).pollCliDeviceLogin,m;if(g!==void 0)if(typeof g=="object"&&g!==null&&!Array.isArray(g))m=g;else throw new Error("Linzumi CLI login response was missing pollCliDeviceLogin");else throw new Error("Linzumi CLI login response was missing pollCliDeviceLogin");switch(C(m,"__typename")){case"CliDeviceLoginApproved":let k=C(m,"token"),x={version:1,apiUrl:u,token:k},F=S(e.authFilePath,L.join(j.homedir(),".linzumi","user-auth.json"));return Le(x,F),a("Login saved to "+F+`
-`),x;case"CliDeviceLoginDenied":throw new Error("Linzumi CLI login was denied");case"CliDeviceLoginExpired":throw new Error("Linzumi CLI login expired; run `linzumi login` again");case"CliDeviceLoginPending":return await I();default:throw new Error("Linzumi CLI login returned an unknown pollCliDeviceLogin result")}}else throw new Error("Linzumi CLI login expired; run `linzumi login` again")};return await I()}function Ae(e){let n=!1,r=[],t={},i=["local-port","share-token","api-url","linzumi-url","tunnel-url"],o=0;for(;o<e.length;){let s=e[o];if(s!==void 0)switch(s){case"--help":case"-h":n=!0,o=o+1|0;break;default:if(s.startsWith("--")){let p=s.indexOf("="),y=p!==-1?s.slice(2,p):s.slice(2,s.length);if(i.includes(y)){let f=p!==-1?s.slice(p+1|0,s.length):e[o+1|0];if(f!==void 0){if(f.startsWith("--"))throw new Error("--"+y+" requires a value");t[y]=f,o=o+(p!==-1?1:2)|0}else throw new Error("--"+y+" requires a value")}else throw new Error("unknown tunnel flag --"+y)}else r.push(s),o=o+1|0}else o=e.length}if(r.length>1)throw new Error("linzumi connect accepts exactly one forward id");let a=t["local-port"],u;if(a!==void 0){let s=H(a,void 0);if(s!==void 0)if(s>=1&&s<=65535)u=s;else throw new Error("--local-port must be a TCP port from 1 to 65535");else throw new Error("--local-port must be a TCP port from 1 to 65535")}else u=0;let c=t["api-url"],l=t["linzumi-url"],d;if(c!==void 0)if(l!==void 0){if(c!==l)throw new Error("use only one of --api-url or --linzumi-url");d=c}else d=c;else d=l!==void 0?l:he;return{help:n,forwardReference:r[0],localPort:u,shareToken:t["share-token"],apiUrl:d,tunnelUrl:S(t["tunnel-url"],ge)}}function ze(e){let n=e.kind;switch(n){case"share-token":return"Bearer share_token:"+e.token;case"user-session":return"Bearer user_session:"+e.token;default:throw new Error("unknown tunnel credential kind: "+n)}}function Re(e,n,r){if(e!==void 0)return{kind:"share-token",token:J(e,"share token")};let t=Ce(S(r,L.join(j.homedir(),".linzumi","user-auth.json"))),i=B(n);if(t.apiUrl===i)return{kind:"user-session",token:t.token};throw new Error("stored user login is for "+t.apiUrl+", not "+i+"; run `linzumi login --api-url "+i+"`")}async function qe(e,n,r,t){let i=J(e,"forward id");if(!i.includes(":"))return i;let o=new URL("/api/v2/tcp-tunnel/forwards/resolve",n);o.searchParams.set("alias",i);let a=await t(o.toString(),{method:"GET",headers:Object.fromEntries([["authorization",ze(r)]])}),u=await a.json();if(a.ok&&typeof u=="object"&&u!==null&&!Array.isArray(u)){let l=u.forward_id,d=0;if(l!==void 0){if(typeof l=="string"){if(l.trim()==="")throw new Error("tunnel target "+i+" did not resolve to a forward id");return l}d=2}else d=2;if(d===2)throw new Error("tunnel target "+i+" did not resolve to a forward id")}throw new Error("cannot resolve tunnel target "+i+" (HTTP "+a.status.toString()+")")}function ln(){return`Usage: linzumi connect <forward-id> [options]
+`),x;case"CliDeviceLoginDenied":throw new Error("Linzumi CLI login was denied");case"CliDeviceLoginExpired":throw new Error("Linzumi CLI login expired; run `linzumi login` again");case"CliDeviceLoginPending":return await I();default:throw new Error("Linzumi CLI login returned an unknown pollCliDeviceLogin result")}}else throw new Error("Linzumi CLI login expired; run `linzumi login` again")};return await I()}function Ae(e){let n=!1,r=[],t={},i=["local-port","share-token","api-url","linzumi-url","tunnel-url"],o=0;for(;o<e.length;){let s=e[o];if(s!==void 0)switch(s){case"--help":case"-h":n=!0,o=o+1|0;break;default:if(s.startsWith("--")){let f=s.indexOf("="),y=f!==-1?s.slice(2,f):s.slice(2,s.length);if(i.includes(y)){let p=f!==-1?s.slice(f+1|0,s.length):e[o+1|0];if(p!==void 0){if(p.startsWith("--"))throw new Error("--"+y+" requires a value");t[y]=p,o=o+(f!==-1?1:2)|0}else throw new Error("--"+y+" requires a value")}else throw new Error("unknown tunnel flag --"+y)}else r.push(s),o=o+1|0}else o=e.length}if(r.length>1)throw new Error("linzumi connect accepts exactly one forward id");let a=t["local-port"],u;if(a!==void 0){let s=H(a,void 0);if(s!==void 0)if(s>=1&&s<=65535)u=s;else throw new Error("--local-port must be a TCP port from 1 to 65535");else throw new Error("--local-port must be a TCP port from 1 to 65535")}else u=0;let c=t["api-url"],l=t["linzumi-url"],d;if(c!==void 0)if(l!==void 0){if(c!==l)throw new Error("use only one of --api-url or --linzumi-url");d=c}else d=c;else d=l!==void 0?l:he;return{help:n,forwardReference:r[0],localPort:u,shareToken:t["share-token"],apiUrl:d,tunnelUrl:S(t["tunnel-url"],ge)}}function ze(e){let n=e.kind;switch(n){case"share-token":return"Bearer share_token:"+e.token;case"user-session":return"Bearer user_session:"+e.token;default:throw new Error("unknown tunnel credential kind: "+n)}}function Re(e,n,r){if(e!==void 0)return{kind:"share-token",token:J(e,"share token")};let t=Ce(S(r,L.join(j.homedir(),".linzumi","user-auth.json"))),i=B(n);if(t.apiUrl===i)return{kind:"user-session",token:t.token};throw new Error("stored user login is for "+t.apiUrl+", not "+i+"; run `linzumi login --api-url "+i+"`")}async function qe(e,n,r,t){let i=J(e,"forward id");if(!i.includes(":"))return i;let o=new URL("/api/v2/tcp-tunnel/forwards/resolve",n);o.searchParams.set("alias",i);let a=await t(o.toString(),{method:"GET",headers:Object.fromEntries([["authorization",ze(r)]])}),u=await a.json();if(a.ok&&typeof u=="object"&&u!==null&&!Array.isArray(u)){let l=u.forward_id,d=0;if(l!==void 0){if(typeof l=="string"){if(l.trim()==="")throw new Error("tunnel target "+i+" did not resolve to a forward id");return l}d=2}else d=2;if(d===2)throw new Error("tunnel target "+i+" did not resolve to a forward id")}throw new Error("cannot resolve tunnel target "+i+" (HTTP "+a.status.toString()+")")}function ln(){return`Usage: linzumi connect <forward-id> [options]
 
 Expose one registered Linzumi TCP forward on IPv4 loopback. Any
 client-initiated, single-stream TCP protocol is supported. UDP, FTP-style
@@ -42,8 +42,8 @@ Options:
   --api-url <url>      Linzumi product API origin
   --tunnel-url <url>   Linzumi preview tunnel origin
   -h, --help           Show this help
-`),0;if(a!==void 0){let u=B(i.apiUrl),c=Re(i.shareToken,u,n.authFilePath),l=n.fetchImpl,d=l!==void 0?l:A(),s=await qe(a,u,c,d),p=await Oe({forwardId:s,tunnelBaseUrl:i.tunnelUrl,credential:c,localPort:i.localPort,writeStderr:t});r("Listening on 127.0.0.1:"+p.port.toString()+`
-`);let y=()=>{p.close()};return process.once("SIGINT",y),process.once("SIGTERM",y),await p.closed,process.off("SIGINT",y),process.off("SIGTERM",y),0}return t(`linzumi connect: a forward id is required
+`),0;if(a!==void 0){let u=B(i.apiUrl),c=Re(i.shareToken,u,n.authFilePath),l=n.fetchImpl,d=l!==void 0?l:A(),s=await qe(a,u,c,d),f=await Oe({forwardId:s,tunnelBaseUrl:i.tunnelUrl,credential:c,localPort:i.localPort,writeStderr:t});r("Listening on 127.0.0.1:"+f.port.toString()+`
+`);let y=()=>{f.close()};return process.once("SIGINT",y),process.once("SIGTERM",y),await f.closed,process.off("SIGINT",y),process.off("SIGTERM",y),0}return t(`linzumi connect: a forward id is required
 `),1}catch(i){let o=P(i),a=z(o),u=G(q(o),c=>M(c.exitCode));return u!==void 0?(t("linzumi connect: "+a+`
 `),u):(t("linzumi connect: "+a+`
 `),1)}}var un=65536,cn=2e3;export{Ee as abortStream,ve as closeReasonDefault,xe as closeServer,ze as credentialAuthorization,he as defaultHttpUrl,ge as defaultTcpTunnelWebSocketUrl,on as defaultUserAuthFilePath,an as defaultUserAuthFilePathDefault,Se as drainAndEndSocket,rn as errorExn,ee as graphqlMutation,en as linzumiTlsCaFromEnv,nn as linzumiTrustedFetchFromEnv,Te as listenLoopback,be as listenerError,cn as localHalfOpenGraceMs,Pe as makeStreamTeardown,un as maxTcpTunnelFrameBytes,z as messageOfUnknown,B as normalizedUserAuthApiUrl,te as openAuthenticatedTunnel,Fe as openTcpStream,Ie as parseAuthFrame,Ae as parseConnectArgs,Ce as readStoredUserAuth,we as refusalError,Y as requiredPositiveNumberField,C as requiredStringField,J as requiredValue,Re as resolveCredential,qe as resolveForwardReference,sn as runTcpConnectCommand,dn as runUserLogin,ke as sendBinaryFrame,Oe as startTcpTunnelListener,ln as tcpConnectHelpText,_e as tcpTunnelWebSocketUrl,tn as tunnelRefusalExitCode,Le as writeStoredUserAuth};