@planx.machina.at/tunnel 0.0.0-PLACEHOLDER

package/README.md

@@ -0,0 +1,89 @@
+# @planx.machina.at/tunnel
+
+TUN device + smoltcp userspace TCP/IP stack NAPI module for planx vnet (Pattern C privileged daemon).
+
+## Overview
+
+Pattern C 分離 model の native side。 planx-networkd (= root process) が本 NAPI module を load
+して TUN device + smoltcp Interface + tokio poll loop を起動する。 USER process side の
+planx daemon は tRPC over unix socket で networkd に接続し、 L4 event のみ boundary を超える。
+
+## NAPI exports
+
+- `setup_vnet({ selfHip, prefix, mtu })` → `{ ifaceName }`
+- `addPeerAddress({ hipBytes })` / `removePeerAddress({ hipBytes })`
+- `injectTcpData({ connId, payload })` / `injectTcpClose({ connId })` / `injectUdpSend({ dstPort, srcAddr, srcPort, payload })`
+- `onEvent((ev: NetworkdEvent) => void)` / `offEvent()`
+
+## Dev build (single platform)
+
+```bash
+nx build @planx.machina.at/tunnel              # release .node (native target only)
+nx build:debug @planx.machina.at/tunnel        # debug .node
+nx test @planx.machina.at/tunnel               # cargo test
+nx lint @planx.machina.at/tunnel               # cargo clippy
+```
+
+## Release flow (5 platform fan-out + publish)
+
+5 per-arch package を repo commit して GAR publish するための flow。
+**Mac local で実行する想定** (= CI では走らせない)。
+
+### Prerequisites
+
+```bash
+brew install zig
+rustup target add aarch64-apple-darwin x86_64-apple-darwin \
+                  x86_64-unknown-linux-gnu aarch64-unknown-linux-gnu \
+                  x86_64-unknown-linux-musl
+gcloud auth application-default login   # or GOOGLE_APPLICATION_CREDENTIALS export
+```
+
+### Steps
+
+```bash
+# 1. 5 platform 分の .node を prebuilt/ に生成
+nx prebuild @planx.machina.at/tunnel
+
+# 2. prebuilt/*.node を packages/@planx.machina.at/tunnel-{arch}/ に配布 +
+#    main package の index.js / index.d.ts を最新化
+nx build @planx.machina.at/tunnel
+
+# 3. (commit .node files to repo — Rust source 改修ごとに必要)
+git add prebuilt/ ../../../packages/@planx.machina.at/tunnel-*/planx-tunnel.*.node
+git commit -m "chore(tunnel): rebuild native binaries"
+
+# 4. 全 publish (= main + 5 per-arch を tag:package run-many で publish)
+nx run-many -t deploy -p 'tag:package' --parallel=2
+```
+
+### Dry run
+
+```bash
+DRY_RUN=true nx run @planx.machina.at/tunnel:deploy
+```
+
+## Per-arch binaries
+
+| Package                                          | Platform         | libc |
+| ------------------------------------------------ | ---------------- | ---- |
+| `@planx.machina.at/tunnel-darwin-arm64`          | macOS Apple Silicon | -    |
+| `@planx.machina.at/tunnel-darwin-x64`            | macOS Intel      | -    |
+| `@planx.machina.at/tunnel-linux-x64-gnu`         | Linux x86_64     | glibc |
+| `@planx.machina.at/tunnel-linux-arm64-gnu`       | Linux ARM64      | glibc |
+| `@planx.machina.at/tunnel-linux-x64-musl`        | Linux x86_64     | musl |
+
+main `@planx.machina.at/tunnel` package が optionalDependencies で各 per-arch を参照し、
+runtime に NAPI loader (`index.js`) が platform 判定で適切な `.node` を require する。
+
+## Troubleshooting
+
+- **401/403 on publish** → ~/.npmrc の GAR token 切れ / 権限を確認。
+  CI では on-merge-to-develop.yml の "Configure Artifact Registry auth" step が token を
+  供給する (deploy script 自身は auth しない、#4645 で npx auth-refresh を撤去)。
+  手動で publish する場合のみ `npx google-artifactregistry-auth` で refresh する。
+- **napi build で "linker `cc` not found"** (Linux cross-compile) →
+  `--zig` flag が抜けている。 `prebuild.sh` 経由で実行する。
+- **`cargo: command not found`** → rustup PATH 未設定。
+  `export PATH="$HOME/.cargo/bin:$PATH"`。
+- **prebuilt/*.node が古い** → `nx prebuild` を re-run して `git add` し直す。

package/index.d.ts

@@ -0,0 +1,91 @@
+/* tslint:disable */
+/* eslint-disable */
+
+/* auto-generated by NAPI-RS */
+
+/**
+ * L4 event。 tagged union (= JS では `type` field で discriminator)。
+ *
+ * Note: NAPI-RS は Rust enum を tagged union として直接 export できないため、
+ * flat struct + `event_type` 文字列 + 全 field optional の形にする (= 旧 PacketEvent 互換)。
+ */
+export interface NetworkdEvent {
+  /**
+   * "tcp_open" | "tcp_data" | "tcp_fin" | "tcp_rst" | "udp_dgram" |
+   * "tun_open_ok" | "tun_open_error" | "iface_build_error" | "iface_ready"
+   */
+  eventType: string
+  /** connection id (TCP 系のみ、 UDP / 状態 event は 0)。 */
+  connId: bigint
+  /** dst port (tcp_open / udp_dgram で meaningful、 他は 0)。 */
+  dstPort: number
+  /** payload bytes (event_type に依存)。 */
+  payload: Buffer
+  /** 送信元 IPv6 address (16 bytes raw)。 L4 event で meaningful、 状態 event は 0 bytes。 */
+  srcAddr: Buffer
+  /** 送信元 port。 */
+  srcPort: number
+  /** 宛先 IPv6 address (16 bytes raw)。 tcp_* で meaningful。 */
+  dstAddr: Buffer
+}
+/**
+ * JS から渡された callback を global state に登録する。
+ *
+ * 1 callback / engine の制約 (旧 callback は overwrite される)。 poll loop は state から
+ * callback を都度 lock-load して呼ぶ。
+ */
+export declare function onEvent(callback: (arg: NetworkdEvent) => any): void
+/** global state から callback を解除する (= 以降の poll loop event は dropped)。 */
+export declare function offEvent(): void
+export declare function injectTcpData(input: InjectTcpDataInput): void
+export declare function injectTcpClose(input: InjectTcpCloseInput): void
+export declare function injectUdpSend(input: InjectUdpSendInput): void
+export declare function addPeerAddress(input: PeerAddressInput): void
+export declare function removePeerAddress(input: PeerAddressInput): void
+export declare function addSelfAddress(input: AddSelfAddressInput): void
+export declare function setupVnet(input: SetupVnetInput): SetupVnetOutput
+/** setup_vnet input。 */
+export interface SetupVnetInput {
+  /** 自端末 HIP (= ORCHID v2 IPv6 文字列、 例: "2001:2a:dead:beef:8000:abcd:1234:5678")。 */
+  selfHip: string
+  /** routing prefix 長 (推奨: 32 = ORCHID v2 prefix + planx OGA ID で peer space 全域)。 */
+  prefix: number
+  /** MTU (推奨: 1280 = IPv6 minimum)。 */
+  mtu: number
+  /** 任意で interface name (None なら OS 既定)。 */
+  interfaceName?: string
+}
+/** setup_vnet output。 */
+export interface SetupVnetOutput {
+  /** OS が assign した実 interface name (= "utun9" 等)。 */
+  ifaceName: string
+}
+/** add_self_address input (P3: hip 単位 additive 登録)。 */
+export interface AddSelfAddressInput {
+  /** 追加する自 hip (= ORCHID v2 IPv6 文字列)。 */
+  selfHip: string
+}
+/** add/remove_peer_address input。 */
+export interface PeerAddressInput {
+  /** peer HIP IPv6 raw 16 byte buffer。 */
+  hipBytes: Buffer
+}
+/** inject_tcp_data input。 */
+export interface InjectTcpDataInput {
+  connId: bigint
+  payload: Buffer
+}
+/** inject_tcp_close input。 */
+export interface InjectTcpCloseInput {
+  connId: bigint
+}
+/** inject_udp_send input。 */
+export interface InjectUdpSendInput {
+  dstPort: number
+  /** 送信元 IPv6 address (16 bytes raw、 = remote peer の HIP)。 */
+  srcAddr: Buffer
+  srcPort: number
+  payload: Buffer
+}
+/** crate version (Cargo.toml の `[package].version` を expose)。 sanity check 用。 */
+export declare function version(): string

package/index.js

@@ -0,0 +1,324 @@
+/* tslint:disable */
+/* eslint-disable */
+/* prettier-ignore */
+
+/* auto-generated by NAPI-RS */
+
+const { existsSync, readFileSync } = require('fs')
+const { join } = require('path')
+
+const { platform, arch } = process
+
+let nativeBinding = null
+let localFileExisted = false
+let loadError = null
+
+function isMusl() {
+  // For Node 10
+  if (!process.report || typeof process.report.getReport !== 'function') {
+    try {
+      const lddPath = require('child_process').execSync('which ldd').toString().trim()
+      return readFileSync(lddPath, 'utf8').includes('musl')
+    } catch (e) {
+      return true
+    }
+  } else {
+    const { glibcVersionRuntime } = process.report.getReport().header
+    return !glibcVersionRuntime
+  }
+}
+
+switch (platform) {
+  case 'android':
+    switch (arch) {
+      case 'arm64':
+        localFileExisted = existsSync(join(__dirname, 'index.android-arm64.node'))
+        try {
+          if (localFileExisted) {
+            nativeBinding = require('./index.android-arm64.node')
+          } else {
+            nativeBinding = require('@planx.machina.at/tunnel-android-arm64')
+          }
+        } catch (e) {
+          loadError = e
+        }
+        break
+      case 'arm':
+        localFileExisted = existsSync(join(__dirname, 'index.android-arm-eabi.node'))
+        try {
+          if (localFileExisted) {
+            nativeBinding = require('./index.android-arm-eabi.node')
+          } else {
+            nativeBinding = require('@planx.machina.at/tunnel-android-arm-eabi')
+          }
+        } catch (e) {
+          loadError = e
+        }
+        break
+      default:
+        throw new Error(`Unsupported architecture on Android ${arch}`)
+    }
+    break
+  case 'win32':
+    switch (arch) {
+      case 'x64':
+        localFileExisted = existsSync(
+          join(__dirname, 'index.win32-x64-msvc.node')
+        )
+        try {
+          if (localFileExisted) {
+            nativeBinding = require('./index.win32-x64-msvc.node')
+          } else {
+            nativeBinding = require('@planx.machina.at/tunnel-win32-x64-msvc')
+          }
+        } catch (e) {
+          loadError = e
+        }
+        break
+      case 'ia32':
+        localFileExisted = existsSync(
+          join(__dirname, 'index.win32-ia32-msvc.node')
+        )
+        try {
+          if (localFileExisted) {
+            nativeBinding = require('./index.win32-ia32-msvc.node')
+          } else {
+            nativeBinding = require('@planx.machina.at/tunnel-win32-ia32-msvc')
+          }
+        } catch (e) {
+          loadError = e
+        }
+        break
+      case 'arm64':
+        localFileExisted = existsSync(
+          join(__dirname, 'index.win32-arm64-msvc.node')
+        )
+        try {
+          if (localFileExisted) {
+            nativeBinding = require('./index.win32-arm64-msvc.node')
+          } else {
+            nativeBinding = require('@planx.machina.at/tunnel-win32-arm64-msvc')
+          }
+        } catch (e) {
+          loadError = e
+        }
+        break
+      default:
+        throw new Error(`Unsupported architecture on Windows: ${arch}`)
+    }
+    break
+  case 'darwin':
+    localFileExisted = existsSync(join(__dirname, 'index.darwin-universal.node'))
+    try {
+      if (localFileExisted) {
+        nativeBinding = require('./index.darwin-universal.node')
+      } else {
+        nativeBinding = require('@planx.machina.at/tunnel-darwin-universal')
+      }
+      break
+    } catch {}
+    switch (arch) {
+      case 'x64':
+        localFileExisted = existsSync(join(__dirname, 'index.darwin-x64.node'))
+        try {
+          if (localFileExisted) {
+            nativeBinding = require('./index.darwin-x64.node')
+          } else {
+            nativeBinding = require('@planx.machina.at/tunnel-darwin-x64')
+          }
+        } catch (e) {
+          loadError = e
+        }
+        break
+      case 'arm64':
+        localFileExisted = existsSync(
+          join(__dirname, 'index.darwin-arm64.node')
+        )
+        try {
+          if (localFileExisted) {
+            nativeBinding = require('./index.darwin-arm64.node')
+          } else {
+            nativeBinding = require('@planx.machina.at/tunnel-darwin-arm64')
+          }
+        } catch (e) {
+          loadError = e
+        }
+        break
+      default:
+        throw new Error(`Unsupported architecture on macOS: ${arch}`)
+    }
+    break
+  case 'freebsd':
+    if (arch !== 'x64') {
+      throw new Error(`Unsupported architecture on FreeBSD: ${arch}`)
+    }
+    localFileExisted = existsSync(join(__dirname, 'index.freebsd-x64.node'))
+    try {
+      if (localFileExisted) {
+        nativeBinding = require('./index.freebsd-x64.node')
+      } else {
+        nativeBinding = require('@planx.machina.at/tunnel-freebsd-x64')
+      }
+    } catch (e) {
+      loadError = e
+    }
+    break
+  case 'linux':
+    switch (arch) {
+      case 'x64':
+        if (isMusl()) {
+          localFileExisted = existsSync(
+            join(__dirname, 'index.linux-x64-musl.node')
+          )
+          try {
+            if (localFileExisted) {
+              nativeBinding = require('./index.linux-x64-musl.node')
+            } else {
+              nativeBinding = require('@planx.machina.at/tunnel-linux-x64-musl')
+            }
+          } catch (e) {
+            loadError = e
+          }
+        } else {
+          localFileExisted = existsSync(
+            join(__dirname, 'index.linux-x64-gnu.node')
+          )
+          try {
+            if (localFileExisted) {
+              nativeBinding = require('./index.linux-x64-gnu.node')
+            } else {
+              nativeBinding = require('@planx.machina.at/tunnel-linux-x64-gnu')
+            }
+          } catch (e) {
+            loadError = e
+          }
+        }
+        break
+      case 'arm64':
+        if (isMusl()) {
+          localFileExisted = existsSync(
+            join(__dirname, 'index.linux-arm64-musl.node')
+          )
+          try {
+            if (localFileExisted) {
+              nativeBinding = require('./index.linux-arm64-musl.node')
+            } else {
+              nativeBinding = require('@planx.machina.at/tunnel-linux-arm64-musl')
+            }
+          } catch (e) {
+            loadError = e
+          }
+        } else {
+          localFileExisted = existsSync(
+            join(__dirname, 'index.linux-arm64-gnu.node')
+          )
+          try {
+            if (localFileExisted) {
+              nativeBinding = require('./index.linux-arm64-gnu.node')
+            } else {
+              nativeBinding = require('@planx.machina.at/tunnel-linux-arm64-gnu')
+            }
+          } catch (e) {
+            loadError = e
+          }
+        }
+        break
+      case 'arm':
+        if (isMusl()) {
+          localFileExisted = existsSync(
+            join(__dirname, 'index.linux-arm-musleabihf.node')
+          )
+          try {
+            if (localFileExisted) {
+              nativeBinding = require('./index.linux-arm-musleabihf.node')
+            } else {
+              nativeBinding = require('@planx.machina.at/tunnel-linux-arm-musleabihf')
+            }
+          } catch (e) {
+            loadError = e
+          }
+        } else {
+          localFileExisted = existsSync(
+            join(__dirname, 'index.linux-arm-gnueabihf.node')
+          )
+          try {
+            if (localFileExisted) {
+              nativeBinding = require('./index.linux-arm-gnueabihf.node')
+            } else {
+              nativeBinding = require('@planx.machina.at/tunnel-linux-arm-gnueabihf')
+            }
+          } catch (e) {
+            loadError = e
+          }
+        }
+        break
+      case 'riscv64':
+        if (isMusl()) {
+          localFileExisted = existsSync(
+            join(__dirname, 'index.linux-riscv64-musl.node')
+          )
+          try {
+            if (localFileExisted) {
+              nativeBinding = require('./index.linux-riscv64-musl.node')
+            } else {
+              nativeBinding = require('@planx.machina.at/tunnel-linux-riscv64-musl')
+            }
+          } catch (e) {
+            loadError = e
+          }
+        } else {
+          localFileExisted = existsSync(
+            join(__dirname, 'index.linux-riscv64-gnu.node')
+          )
+          try {
+            if (localFileExisted) {
+              nativeBinding = require('./index.linux-riscv64-gnu.node')
+            } else {
+              nativeBinding = require('@planx.machina.at/tunnel-linux-riscv64-gnu')
+            }
+          } catch (e) {
+            loadError = e
+          }
+        }
+        break
+      case 's390x':
+        localFileExisted = existsSync(
+          join(__dirname, 'index.linux-s390x-gnu.node')
+        )
+        try {
+          if (localFileExisted) {
+            nativeBinding = require('./index.linux-s390x-gnu.node')
+          } else {
+            nativeBinding = require('@planx.machina.at/tunnel-linux-s390x-gnu')
+          }
+        } catch (e) {
+          loadError = e
+        }
+        break
+      default:
+        throw new Error(`Unsupported architecture on Linux: ${arch}`)
+    }
+    break
+  default:
+    throw new Error(`Unsupported OS: ${platform}, architecture: ${arch}`)
+}
+
+if (!nativeBinding) {
+  if (loadError) {
+    throw loadError
+  }
+  throw new Error(`Failed to load native binding`)
+}
+
+const { onEvent, offEvent, injectTcpData, injectTcpClose, injectUdpSend, addPeerAddress, removePeerAddress, addSelfAddress, setupVnet, version } = nativeBinding
+
+module.exports.onEvent = onEvent
+module.exports.offEvent = offEvent
+module.exports.injectTcpData = injectTcpData
+module.exports.injectTcpClose = injectTcpClose
+module.exports.injectUdpSend = injectUdpSend
+module.exports.addPeerAddress = addPeerAddress
+module.exports.removePeerAddress = removePeerAddress
+module.exports.addSelfAddress = addSelfAddress
+module.exports.setupVnet = setupVnet
+module.exports.version = version

package/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "@planx.machina.at/tunnel",
+  "version": "0.0.0-PLACEHOLDER",
+  "description": "TUN device + smoltcp userspace TCP/IP stack NAPI module for planx vnet (Pattern C privileged daemon)",
+  "main": "index.js",
+  "types": "index.d.ts",
+  "homepage": "https://github.com/nontangent/x_x_machina/tree/develop/projects/@planx.machina.at/tunnel",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/nontangent/x_x_machina.git"
+  },
+  "license": "MIT",
+  "napi": {
+    "binaryName": "planx-tunnel",
+    "targets": [
+      "aarch64-apple-darwin",
+      "x86_64-apple-darwin",
+      "x86_64-unknown-linux-gnu",
+      "aarch64-unknown-linux-gnu",
+      "x86_64-unknown-linux-musl",
+      "x86_64-pc-windows-msvc"
+    ]
+  },
+  "scripts": {
+    "artifacts": "napi artifacts",
+    "build": "napi build --platform --release",
+    "build:debug": "napi build --platform",
+    "version": "napi version"
+  },
+  "devDependencies": {
+    "@napi-rs/cli": "^2.18.4"
+  },
+  "engines": {
+    "node": ">= 20"
+  },
+  "files": [
+    "index.js",
+    "index.d.ts",
+    "*.node"
+  ]
+}