@seedprotocol/gateway-hyper 0.5.1

package/README.md

@@ -0,0 +1,40 @@
+# @seedprotocol/gateway-hyper
+
+Expose a local **seed-protocol-server + ar.io gateway** stack (via Traefik or direct upstream) to SDK users over **HyperDHT**, with a localhost HTTP sidecar for apps and RSS-style tooling.
+
+See [docs/GATEWAY_HYPER.md](../../docs/GATEWAY_HYPER.md) for operator and developer runbooks.
+
+## Install
+
+```bash
+bun add @seedprotocol/gateway-hyper
+```
+
+Requires Node 20+ and Holepunch native addons.
+
+## CLI
+
+```bash
+# Operator
+seed gateway tunnel serve --upstream http://127.0.0.1:80 --key-file ./.seed/gateway-tunnel/operator.key.json
+
+# Client sidecar
+seed gateway tunnel connect <z32-key> --port 1984
+```
+
+## Library
+
+```ts
+import { serveTunnel, connectTunnel } from '@seedprotocol/gateway-hyper'
+
+const operator = await serveTunnel({ upstream: 'http://127.0.0.1:80' })
+console.log(operator.key)
+
+const client = await connectTunnel({ key: operator.key, port: 1984 })
+console.log(client.baseUrl) // http://127.0.0.1:1984
+```
+
+## Tests
+
+- Unit tests always run.
+- DHT integration: `GATEWAY_HYPER_TESTS=1 bun run test`

package/dist/constants.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Official Seed Protocol gateway Hyper tunnel operator key (z32).
+ * Empty until ops generate and back up the first operator keypair.
+ */
+export declare const DEFAULT_SEED_GATEWAY_HYPER_KEY = "";
+//# sourceMappingURL=constants.d.ts.map

package/dist/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,eAAO,MAAM,8BAA8B,KAAK,CAAA"}

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+export { encodePublicKeyZ32, decodePublicKey, loadOrCreateOperatorKeypair } from './keys';
+export { serveTunnel } from './tunnel/serve';
+export { connectTunnel, localGatewayUrl } from './tunnel/connect';
+export { writeFrame, readFrame, writeTunnelRequest, readTunnelRequest, writeTunnelResponse, readTunnelResponse, flattenRequestHeaders, filterResponseHeaders, MAX_FRAME_BYTES, } from './tunnel/protocol';
+export type { TunnelMeta, TunnelResponseMeta, ServeTunnelOptions, ServeTunnelResult, ConnectTunnelOptions, ConnectTunnelResult, OperatorKeyPair, } from './types';
+export { DEFAULT_SEED_GATEWAY_HYPER_KEY } from './constants';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,2BAA2B,EAAE,MAAM,QAAQ,CAAA;AAEzF,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAEjE,OAAO,EACL,UAAU,EACV,SAAS,EACT,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,GAChB,MAAM,mBAAmB,CAAA;AAE1B,YAAY,EACV,UAAU,EACV,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,eAAe,GAChB,MAAM,SAAS,CAAA;AAEhB,OAAO,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAA"}

package/dist/index.js

@@ -0,0 +1,251 @@
+import e from "node:fs";
+import t from "node:path";
+import n from "hyperdht";
+import r from "hypercore-id-encoding";
+import i from "node:http";
+import { URL as a } from "node:url";
+//#region src/keys.ts
+function o(e) {
+	return e.toString("hex");
+}
+function s(e) {
+	return Buffer.from(e, "hex");
+}
+function c(e) {
+	return r.encode(e);
+}
+function l(e) {
+	let t = e.trim();
+	if (!t) throw Error("Gateway Hyper key is empty");
+	try {
+		return Buffer.from(r.decode(t));
+	} catch {
+		if (/^[a-fA-F0-9]{64}$/.test(t)) return s(t);
+		throw Error(`Invalid Gateway Hyper key (expected z32 or 64-char hex): ${t.slice(0, 12)}…`);
+	}
+}
+function u(r) {
+	let i = t.resolve(r);
+	if (e.existsSync(i)) {
+		let t = e.readFileSync(i, "utf8"), n = JSON.parse(t);
+		if (!n.publicKey || !n.secretKey) throw Error(`Invalid key file at ${i}: missing publicKey or secretKey`);
+		let r = s(n.publicKey);
+		return {
+			publicKey: r,
+			secretKey: s(n.secretKey),
+			z32: c(r)
+		};
+	}
+	let a = t.dirname(i);
+	e.mkdirSync(a, { recursive: !0 });
+	let l = n.keyPair(), u = {
+		publicKey: o(l.publicKey),
+		secretKey: o(l.secretKey),
+		encoding: "hex"
+	};
+	return e.writeFileSync(i, `${JSON.stringify(u, null, 2)}\n`, { mode: 384 }), {
+		publicKey: l.publicKey,
+		secretKey: l.secretKey,
+		z32: c(l.publicKey)
+	};
+}
+function d() {
+	let e = n.keyPair();
+	return {
+		publicKey: e.publicKey,
+		secretKey: e.secretKey,
+		z32: c(e.publicKey)
+	};
+}
+//#endregion
+//#region src/tunnel/protocol.ts
+var f = 64 * 1024 * 1024;
+function p(e, t) {
+	return new Promise((n, r) => {
+		let i = [], a = 0, o = (r) => {
+			if (i.push(r), a += r.length, a >= t) {
+				l();
+				let r = Buffer.concat(i);
+				n(r.subarray(0, t));
+				let a = r.subarray(t);
+				a.length > 0 && e.unshift(a);
+			}
+		}, s = (e) => {
+			l(), r(e);
+		}, c = () => {
+			l(), r(/* @__PURE__ */ Error(`Unexpected end of stream (expected ${t} bytes, got ${a})`));
+		}, l = () => {
+			e.off("data", o), e.off("error", s), e.off("end", c);
+		};
+		e.on("data", o), e.on("error", s), e.on("end", c);
+	});
+}
+function m(e, t) {
+	return new Promise((n, r) => {
+		e.write(t, (e) => {
+			e ? r(e) : n();
+		});
+	});
+}
+async function h(e, t) {
+	if (t.length > 67108864) throw Error(`Frame too large: ${t.length} bytes (max ${f})`);
+	let n = Buffer.alloc(4);
+	n.writeUInt32BE(t.length, 0), await m(e, n), t.length > 0 && await m(e, t);
+}
+async function g(e) {
+	let t = (await p(e, 4)).readUInt32BE(0);
+	if (t === 0) return Buffer.alloc(0);
+	if (t > 67108864) throw Error(`Frame too large: ${t} bytes (max ${f})`);
+	return p(e, t);
+}
+async function _(e, t, n) {
+	await h(e, Buffer.from(JSON.stringify(t), "utf8")), await h(e, n);
+}
+async function v(e) {
+	let t = await g(e), n = JSON.parse(t.toString("utf8"));
+	if (!n.method || !n.path) throw Error("Invalid tunnel request meta: missing method or path");
+	return n.headers = n.headers ?? {}, {
+		meta: n,
+		body: await g(e)
+	};
+}
+async function y(e, t, n) {
+	await h(e, Buffer.from(JSON.stringify(t), "utf8")), await h(e, n);
+}
+async function b(e) {
+	let t = await g(e), n = JSON.parse(t.toString("utf8"));
+	if (typeof n.status != "number") throw Error("Invalid tunnel response meta: missing status");
+	return n.headers = n.headers ?? {}, {
+		meta: n,
+		body: await g(e)
+	};
+}
+function x(e) {
+	let t = {};
+	for (let [n, r] of Object.entries(e)) r != null && (t[n] = Array.isArray(r) ? r.join(", ") : r);
+	return t;
+}
+function S(e) {
+	let t = new Set([
+		"connection",
+		"keep-alive",
+		"transfer-encoding",
+		"upgrade"
+	]), n = {};
+	for (let [r, i] of Object.entries(e)) t.has(r.toLowerCase()) || i != null && (n[r] = Array.isArray(i) ? i.join(", ") : i);
+	return n;
+}
+//#endregion
+//#region src/tunnel/proxy.ts
+async function C(e, t, n) {
+	let r = e.replace(/\/$/, ""), o = new a(t.path, `${r}/`);
+	return new Promise((e, r) => {
+		let a = i.request(o, {
+			method: t.method,
+			headers: t.headers
+		}, (t) => {
+			let n = [];
+			t.on("data", (e) => n.push(e)), t.on("end", () => {
+				e({
+					status: t.statusCode ?? 502,
+					headers: S(t.headers),
+					body: Buffer.concat(n)
+				});
+			}), t.on("error", r);
+		});
+		a.on("error", r), n.length > 0 && a.write(n), a.end();
+	});
+}
+//#endregion
+//#region src/tunnel/serve.ts
+function w(e, t) {
+	(async () => {
+		try {
+			for (;;) {
+				let { meta: n, body: r } = await v(e), i = await C(t, n, r);
+				await y(e, {
+					status: i.status,
+					headers: i.headers
+				}, i.body);
+			}
+		} catch {
+			e.destroy();
+		}
+	})();
+}
+async function T(e) {
+	let t = e.upstream.replace(/\/$/, ""), r = u(e.keyFile ?? ".seed/gateway-tunnel/operator.key.json"), i = new n(), a = i.createServer((e) => {
+		w(e, t);
+	});
+	return await a.listen(r), {
+		key: r.z32,
+		upstream: t,
+		close: async () => {
+			await a.close(), await i.destroy();
+		}
+	};
+}
+//#endregion
+//#region src/tunnel/connect.ts
+async function E(e) {
+	let t = [];
+	for await (let n of e) t.push(Buffer.isBuffer(n) ? n : Buffer.from(n));
+	return Buffer.concat(t);
+}
+function D(e) {
+	return i.createServer((t, n) => {
+		(async () => {
+			try {
+				let r = await E(t), i = t.url ?? "/", a = {
+					method: t.method ?? "GET",
+					path: i,
+					headers: x(t.headers)
+				}, { meta: o, body: s } = await e(async (e) => (await _(e, a, r), b(e)));
+				n.writeHead(o.status, o.headers), n.end(s);
+			} catch (e) {
+				let t = e instanceof Error ? e.message : String(e);
+				n.headersSent || n.writeHead(502, { "Content-Type": "text/plain; charset=utf-8" }), n.end(`Gateway Hyper tunnel error: ${t}`);
+			}
+		})();
+	});
+}
+async function O(e) {
+	let t = e.host ?? "127.0.0.1", r = e.port ?? 1984, i = l(e.key), a = d(), o = new n(), s = null, c = null, u = async () => s && !s.destroyed ? s : c || (c = new Promise((e, t) => {
+		let n = o.connect(i, { keyPair: {
+			publicKey: a.publicKey,
+			secretKey: a.secretKey
+		} }), r = () => {
+			s = n, c = null, e(n);
+		};
+		n.once("open", r), n.once("connect", r), n.once("error", (e) => {
+			c = null, t(e);
+		});
+	}), c), f = Promise.resolve(), p = async (e) => {
+		let t = f.then(() => u()).then(e);
+		return f = t.catch(() => {}), t;
+	}, m = D((e) => p(e));
+	await new Promise((e, n) => {
+		m.once("error", n), m.listen(r, t, () => e());
+	});
+	let h = m.address(), g = h && typeof h == "object" ? h.port : r, _ = `http://${t}:${g}`;
+	return {
+		key: e.key,
+		host: t,
+		port: g,
+		baseUrl: _,
+		close: async () => {
+			await new Promise((e) => m.close(() => e())), s && !s.destroyed && s.destroy(), await o.destroy();
+		}
+	};
+}
+function k(e, t = "") {
+	let n = e.replace(/\/$/, "");
+	return t ? t.startsWith("/") ? `${n}${t}` : `${n}/${t}` : n;
+}
+//#endregion
+//#region src/constants.ts
+var A = "";
+//#endregion
+export { A as DEFAULT_SEED_GATEWAY_HYPER_KEY, f as MAX_FRAME_BYTES, O as connectTunnel, l as decodePublicKey, c as encodePublicKeyZ32, S as filterResponseHeaders, x as flattenRequestHeaders, u as loadOrCreateOperatorKeypair, k as localGatewayUrl, g as readFrame, v as readTunnelRequest, b as readTunnelResponse, T as serveTunnel, h as writeFrame, _ as writeTunnelRequest, y as writeTunnelResponse };
+
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../src/keys.ts","../src/tunnel/protocol.ts","../src/tunnel/proxy.ts","../src/tunnel/serve.ts","../src/tunnel/connect.ts","../src/constants.ts"],"sourcesContent":["import fs from 'node:fs'\nimport path from 'node:path'\nimport HyperDHT from 'hyperdht'\nimport ID from 'hypercore-id-encoding'\nimport type { OperatorKeyPair } from './types'\n\nexport interface PersistedKeyFile {\n  publicKey: string\n  secretKey: string\n  encoding: 'hex'\n}\n\nfunction toHex(buf: Buffer): string {\n  return buf.toString('hex')\n}\n\nfunction fromHex(hex: string): Buffer {\n  return Buffer.from(hex, 'hex')\n}\n\nexport function encodePublicKeyZ32(publicKey: Buffer): string {\n  return ID.encode(publicKey)\n}\n\nexport function decodePublicKey(key: string): Buffer {\n  const trimmed = key.trim()\n  if (!trimmed) {\n    throw new Error('Gateway Hyper key is empty')\n  }\n  try {\n    return Buffer.from(ID.decode(trimmed))\n  } catch {\n    if (/^[a-fA-F0-9]{64}$/.test(trimmed)) {\n      return fromHex(trimmed)\n    }\n    throw new Error(`Invalid Gateway Hyper key (expected z32 or 64-char hex): ${trimmed.slice(0, 12)}…`)\n  }\n}\n\nexport function loadOrCreateOperatorKeypair(keyFile: string): OperatorKeyPair {\n  const resolved = path.resolve(keyFile)\n  if (fs.existsSync(resolved)) {\n    const raw = fs.readFileSync(resolved, 'utf8')\n    const parsed = JSON.parse(raw) as PersistedKeyFile\n    if (!parsed.publicKey || !parsed.secretKey) {\n      throw new Error(`Invalid key file at ${resolved}: missing publicKey or secretKey`)\n    }\n    const publicKey = fromHex(parsed.publicKey)\n    const secretKey = fromHex(parsed.secretKey)\n    return {\n      publicKey,\n      secretKey,\n      z32: encodePublicKeyZ32(publicKey),\n    }\n  }\n\n  const dir = path.dirname(resolved)\n  fs.mkdirSync(dir, { recursive: true })\n  const kp = HyperDHT.keyPair()\n  const persisted: PersistedKeyFile = {\n    publicKey: toHex(kp.publicKey),\n    secretKey: toHex(kp.secretKey),\n    encoding: 'hex',\n  }\n  fs.writeFileSync(resolved, `${JSON.stringify(persisted, null, 2)}\\n`, { mode: 0o600 })\n  return {\n    publicKey: kp.publicKey,\n    secretKey: kp.secretKey,\n    z32: encodePublicKeyZ32(kp.publicKey),\n  }\n}\n\nexport function createEphemeralClientKeypair(): OperatorKeyPair {\n  const kp = HyperDHT.keyPair()\n  return {\n    publicKey: kp.publicKey,\n    secretKey: kp.secretKey,\n    z32: encodePublicKeyZ32(kp.publicKey),\n  }\n}\n","import type { Readable, Writable } from 'node:stream'\nimport type { TunnelMeta, TunnelResponseMeta } from '../types'\n\n/** Maximum single frame payload (64 MiB). */\nexport const MAX_FRAME_BYTES = 64 * 1024 * 1024\n\nfunction readExact(stream: Readable, length: number): Promise<Buffer> {\n  return new Promise((resolve, reject) => {\n    const chunks: Buffer[] = []\n    let total = 0\n\n    const onData = (chunk: Buffer) => {\n      chunks.push(chunk)\n      total += chunk.length\n      if (total >= length) {\n        cleanup()\n        const buf = Buffer.concat(chunks)\n        resolve(buf.subarray(0, length))\n        const extra = buf.subarray(length)\n        if (extra.length > 0) {\n          stream.unshift(extra)\n        }\n      }\n    }\n\n    const onError = (err: Error) => {\n      cleanup()\n      reject(err)\n    }\n\n    const onEnd = () => {\n      cleanup()\n      reject(new Error(`Unexpected end of stream (expected ${length} bytes, got ${total})`))\n    }\n\n    const cleanup = () => {\n      stream.off('data', onData)\n      stream.off('error', onError)\n      stream.off('end', onEnd)\n    }\n\n    stream.on('data', onData)\n    stream.on('error', onError)\n    stream.on('end', onEnd)\n  })\n}\n\nfunction writeBuffer(stream: Writable, buf: Buffer): Promise<void> {\n  return new Promise((resolve, reject) => {\n    stream.write(buf, (err) => {\n      if (err) reject(err)\n      else resolve()\n    })\n  })\n}\n\nexport async function writeFrame(stream: Writable, payload: Buffer): Promise<void> {\n  if (payload.length > MAX_FRAME_BYTES) {\n    throw new Error(`Frame too large: ${payload.length} bytes (max ${MAX_FRAME_BYTES})`)\n  }\n  const header = Buffer.alloc(4)\n  header.writeUInt32BE(payload.length, 0)\n  await writeBuffer(stream, header)\n  if (payload.length > 0) {\n    await writeBuffer(stream, payload)\n  }\n}\n\nexport async function readFrame(stream: Readable): Promise<Buffer> {\n  const header = await readExact(stream, 4)\n  const length = header.readUInt32BE(0)\n  if (length === 0) {\n    return Buffer.alloc(0)\n  }\n  if (length > MAX_FRAME_BYTES) {\n    throw new Error(`Frame too large: ${length} bytes (max ${MAX_FRAME_BYTES})`)\n  }\n  return readExact(stream, length)\n}\n\nexport async function writeTunnelRequest(\n  stream: Writable,\n  meta: TunnelMeta,\n  body: Buffer,\n): Promise<void> {\n  const metaFrame = Buffer.from(JSON.stringify(meta), 'utf8')\n  await writeFrame(stream, metaFrame)\n  await writeFrame(stream, body)\n}\n\nexport async function readTunnelRequest(\n  stream: Readable,\n): Promise<{ meta: TunnelMeta; body: Buffer }> {\n  const metaBuf = await readFrame(stream)\n  const meta = JSON.parse(metaBuf.toString('utf8')) as TunnelMeta\n  if (!meta.method || !meta.path) {\n    throw new Error('Invalid tunnel request meta: missing method or path')\n  }\n  meta.headers = meta.headers ?? {}\n  const body = await readFrame(stream)\n  return { meta, body }\n}\n\nexport async function writeTunnelResponse(\n  stream: Writable,\n  meta: TunnelResponseMeta,\n  body: Buffer,\n): Promise<void> {\n  const metaFrame = Buffer.from(JSON.stringify(meta), 'utf8')\n  await writeFrame(stream, metaFrame)\n  await writeFrame(stream, body)\n}\n\nexport async function readTunnelResponse(\n  stream: Readable,\n): Promise<{ meta: TunnelResponseMeta; body: Buffer }> {\n  const metaBuf = await readFrame(stream)\n  const meta = JSON.parse(metaBuf.toString('utf8')) as TunnelResponseMeta\n  if (typeof meta.status !== 'number') {\n    throw new Error('Invalid tunnel response meta: missing status')\n  }\n  meta.headers = meta.headers ?? {}\n  const body = await readFrame(stream)\n  return { meta, body }\n}\n\n/** Normalize header values to strings for tunnel transport. */\nexport function flattenRequestHeaders(\n  headers: Record<string, string | string[] | undefined>,\n): Record<string, string> {\n  const out: Record<string, string> = {}\n  for (const [key, value] of Object.entries(headers)) {\n    if (value == null) continue\n    out[key] = Array.isArray(value) ? value.join(', ') : value\n  }\n  return out\n}\n\n/** Pick response headers safe to forward to the local HTTP client. */\nexport function filterResponseHeaders(\n  headers: Record<string, string | string[] | undefined>,\n): Record<string, string> {\n  const skip = new Set([\n    'connection',\n    'keep-alive',\n    'transfer-encoding',\n    'upgrade',\n  ])\n  const out: Record<string, string> = {}\n  for (const [key, value] of Object.entries(headers)) {\n    if (skip.has(key.toLowerCase())) continue\n    if (value == null) continue\n    out[key] = Array.isArray(value) ? value.join(', ') : value\n  }\n  return out\n}\n","import http from 'node:http'\nimport { URL } from 'node:url'\nimport { filterResponseHeaders } from './protocol'\nimport type { TunnelMeta } from '../types'\n\nexport async function proxyTunnelRequest(\n  upstreamBase: string,\n  meta: TunnelMeta,\n  body: Buffer,\n): Promise<{ status: number; headers: Record<string, string>; body: Buffer }> {\n  const base = upstreamBase.replace(/\\/$/, '')\n  const targetUrl = new URL(meta.path, `${base}/`)\n\n  return new Promise((resolve, reject) => {\n    const req = http.request(\n      targetUrl,\n      {\n        method: meta.method,\n        headers: meta.headers,\n      },\n      (res) => {\n        const chunks: Buffer[] = []\n        res.on('data', (chunk: Buffer) => chunks.push(chunk))\n        res.on('end', () => {\n          resolve({\n            status: res.statusCode ?? 502,\n            headers: filterResponseHeaders(res.headers as Record<string, string | string[] | undefined>),\n            body: Buffer.concat(chunks),\n          })\n        })\n        res.on('error', reject)\n      },\n    )\n    req.on('error', reject)\n    if (body.length > 0) {\n      req.write(body)\n    }\n    req.end()\n  })\n}\n","import type { Duplex } from 'node:stream'\nimport HyperDHT from 'hyperdht'\nimport { readTunnelRequest, writeTunnelResponse } from './protocol'\nimport { proxyTunnelRequest } from './proxy'\nimport { loadOrCreateOperatorKeypair } from '../keys'\nimport type { ServeTunnelOptions, ServeTunnelResult } from '../types'\n\nfunction handleConnection(\n  socket: Duplex,\n  upstream: string,\n): void {\n  void (async () => {\n    try {\n      while (true) {\n        const { meta, body } = await readTunnelRequest(socket)\n        const result = await proxyTunnelRequest(upstream, meta, body)\n        await writeTunnelResponse(\n          socket,\n          { status: result.status, headers: result.headers },\n          result.body,\n        )\n      }\n    } catch {\n      socket.destroy()\n    }\n  })()\n}\n\n/**\n * Operator: accept Hyperswarm/DHT connections and proxy framed HTTP to upstream Traefik.\n */\nexport async function serveTunnel(options: ServeTunnelOptions): Promise<ServeTunnelResult> {\n  const upstream = options.upstream.replace(/\\/$/, '')\n  const keyFile = options.keyFile ?? '.seed/gateway-tunnel/operator.key.json'\n  const keypair = loadOrCreateOperatorKeypair(keyFile)\n\n  const dht = new HyperDHT()\n  const server = dht.createServer((socket) => {\n    handleConnection(socket as Duplex, upstream)\n  })\n\n  await server.listen(keypair)\n\n  return {\n    key: keypair.z32,\n    upstream,\n    close: async () => {\n      await server.close()\n      await dht.destroy()\n    },\n  }\n}\n","import http from 'node:http'\nimport type { Duplex } from 'node:stream'\nimport type { IncomingMessage, ServerResponse } from 'node:http'\nimport HyperDHT from 'hyperdht'\nimport {\n  flattenRequestHeaders,\n  readTunnelResponse,\n  writeTunnelRequest,\n} from './protocol'\nimport { createEphemeralClientKeypair, decodePublicKey } from '../keys'\nimport type { ConnectTunnelOptions, ConnectTunnelResult } from '../types'\n\nasync function readRequestBody(req: IncomingMessage): Promise<Buffer> {\n  const chunks: Buffer[] = []\n  for await (const chunk of req) {\n    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk))\n  }\n  return Buffer.concat(chunks)\n}\n\nfunction createLocalServer(\n  runOnTunnel: <T>(fn: (socket: Duplex) => Promise<T>) => Promise<T>,\n): http.Server {\n  return http.createServer((req, res) => {\n    void (async () => {\n      try {\n        const body = await readRequestBody(req)\n        const path = req.url ?? '/'\n        const meta = {\n          method: req.method ?? 'GET',\n          path,\n          headers: flattenRequestHeaders(req.headers as Record<string, string | string[] | undefined>),\n        }\n\n        const { meta: responseMeta, body: responseBody } = await runOnTunnel(async (socket) => {\n          await writeTunnelRequest(socket, meta, body)\n          return readTunnelResponse(socket)\n        })\n\n        res.writeHead(responseMeta.status, responseMeta.headers)\n        res.end(responseBody)\n      } catch (err) {\n        const message = err instanceof Error ? err.message : String(err)\n        if (!res.headersSent) {\n          res.writeHead(502, { 'Content-Type': 'text/plain; charset=utf-8' })\n        }\n        res.end(`Gateway Hyper tunnel error: ${message}`)\n      }\n    })()\n  })\n}\n\n/**\n * Client: dial operator key and expose a localhost HTTP server that forwards through the tunnel.\n */\nexport async function connectTunnel(options: ConnectTunnelOptions): Promise<ConnectTunnelResult> {\n  const host = options.host ?? '127.0.0.1'\n  const port = options.port ?? 1984\n  const remotePublicKey = decodePublicKey(options.key)\n  const clientKey = createEphemeralClientKeypair()\n\n  const dht = new HyperDHT()\n  let activeSocket: Duplex | null = null\n  let connecting: Promise<Duplex> | null = null\n\n  const getSocket = async (): Promise<Duplex> => {\n    if (activeSocket && !activeSocket.destroyed) {\n      return activeSocket\n    }\n    if (connecting) {\n      return connecting\n    }\n    connecting = new Promise<Duplex>((resolve, reject) => {\n      const socket = dht.connect(remotePublicKey, {\n        keyPair: { publicKey: clientKey.publicKey, secretKey: clientKey.secretKey },\n      }) as Duplex\n      const onReady = () => {\n        activeSocket = socket\n        connecting = null\n        resolve(socket)\n      }\n      socket.once('open', onReady)\n      socket.once('connect', onReady)\n      socket.once('error', (err: Error) => {\n        connecting = null\n        reject(err)\n      })\n    })\n    return connecting\n  }\n\n  /** Serialize tunnel transactions on one persistent socket. */\n  let tunnelQueue: Promise<unknown> = Promise.resolve()\n  const runOnTunnel = async <T>(fn: (socket: Duplex) => Promise<T>): Promise<T> => {\n    const run = tunnelQueue.then(() => getSocket()).then(fn)\n    tunnelQueue = run.catch(() => {})\n    return run\n  }\n\n  const server = createLocalServer((handler) => runOnTunnel(handler))\n\n  await new Promise<void>((resolve, reject) => {\n    server.once('error', reject)\n    server.listen(port, host, () => resolve())\n  })\n\n  const address = server.address()\n  const boundPort =\n    address && typeof address === 'object' ? address.port : port\n\n  const baseUrl = `http://${host}:${boundPort}`\n\n  return {\n    key: options.key,\n    host,\n    port: boundPort,\n    baseUrl,\n    close: async () => {\n      await new Promise<void>((resolve) => server.close(() => resolve()))\n      if (activeSocket && !activeSocket.destroyed) {\n        activeSocket.destroy()\n      }\n      await dht.destroy()\n    },\n  }\n}\n\nexport function localGatewayUrl(baseUrl: string, path = ''): string {\n  const base = baseUrl.replace(/\\/$/, '')\n  if (!path) return base\n  return path.startsWith('/') ? `${base}${path}` : `${base}/${path}`\n}\n","/**\n * Official Seed Protocol gateway Hyper tunnel operator key (z32).\n * Empty until ops generate and back up the first operator keypair.\n */\nexport const DEFAULT_SEED_GATEWAY_HYPER_KEY = ''\n"],"mappings":";;;;;;;AAYA,SAAS,EAAM,GAAqB;CAClC,OAAO,EAAI,SAAS,KAAK;AAC3B;AAEA,SAAS,EAAQ,GAAqB;CACpC,OAAO,OAAO,KAAK,GAAK,KAAK;AAC/B;AAEA,SAAgB,EAAmB,GAA2B;CAC5D,OAAO,EAAG,OAAO,CAAS;AAC5B;AAEA,SAAgB,EAAgB,GAAqB;CACnD,IAAM,IAAU,EAAI,KAAK;CACzB,IAAI,CAAC,GACH,MAAU,MAAM,4BAA4B;CAE9C,IAAI;EACF,OAAO,OAAO,KAAK,EAAG,OAAO,CAAO,CAAC;CACvC,QAAQ;EACN,IAAI,oBAAoB,KAAK,CAAO,GAClC,OAAO,EAAQ,CAAO;EAExB,MAAU,MAAM,4DAA4D,EAAQ,MAAM,GAAG,EAAE,EAAE,EAAE;CACrG;AACF;AAEA,SAAgB,EAA4B,GAAkC;CAC5E,IAAM,IAAW,EAAK,QAAQ,CAAO;CACrC,IAAI,EAAG,WAAW,CAAQ,GAAG;EAC3B,IAAM,IAAM,EAAG,aAAa,GAAU,MAAM,GACtC,IAAS,KAAK,MAAM,CAAG;EAC7B,IAAI,CAAC,EAAO,aAAa,CAAC,EAAO,WAC/B,MAAU,MAAM,uBAAuB,EAAS,iCAAiC;EAEnF,IAAM,IAAY,EAAQ,EAAO,SAAS;EAE1C,OAAO;GACL;GACA,WAHgB,EAAQ,EAAO,SAG/B;GACA,KAAK,EAAmB,CAAS;EACnC;CACF;CAEA,IAAM,IAAM,EAAK,QAAQ,CAAQ;CACjC,EAAG,UAAU,GAAK,EAAE,WAAW,GAAK,CAAC;CACrC,IAAM,IAAK,EAAS,QAAQ,GACtB,IAA8B;EAClC,WAAW,EAAM,EAAG,SAAS;EAC7B,WAAW,EAAM,EAAG,SAAS;EAC7B,UAAU;CACZ;CAEA,OADA,EAAG,cAAc,GAAU,GAAG,KAAK,UAAU,GAAW,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,IAAM,CAAC,GAC9E;EACL,WAAW,EAAG;EACd,WAAW,EAAG;EACd,KAAK,EAAmB,EAAG,SAAS;CACtC;AACF;AAEA,SAAgB,IAAgD;CAC9D,IAAM,IAAK,EAAS,QAAQ;CAC5B,OAAO;EACL,WAAW,EAAG;EACd,WAAW,EAAG;EACd,KAAK,EAAmB,EAAG,SAAS;CACtC;AACF;;;AC3EA,IAAa,IAAkB,KAAK,OAAO;AAE3C,SAAS,EAAU,GAAkB,GAAiC;CACpE,OAAO,IAAI,SAAS,GAAS,MAAW;EACtC,IAAM,IAAmB,CAAC,GACtB,IAAQ,GAEN,KAAU,MAAkB;GAGhC,IAFA,EAAO,KAAK,CAAK,GACjB,KAAS,EAAM,QACX,KAAS,GAAQ;IACnB,EAAQ;IACR,IAAM,IAAM,OAAO,OAAO,CAAM;IAChC,EAAQ,EAAI,SAAS,GAAG,CAAM,CAAC;IAC/B,IAAM,IAAQ,EAAI,SAAS,CAAM;IACjC,AAAI,EAAM,SAAS,KACjB,EAAO,QAAQ,CAAK;GAExB;EACF,GAEM,KAAW,MAAe;GAE9B,AADA,EAAQ,GACR,EAAO,CAAG;EACZ,GAEM,UAAc;GAElB,AADA,EAAQ,GACR,EAAO,gBAAI,MAAM,sCAAsC,EAAO,cAAc,EAAM,EAAE,CAAC;EACvF,GAEM,UAAgB;GAGpB,AAFA,EAAO,IAAI,QAAQ,CAAM,GACzB,EAAO,IAAI,SAAS,CAAO,GAC3B,EAAO,IAAI,OAAO,CAAK;EACzB;EAIA,AAFA,EAAO,GAAG,QAAQ,CAAM,GACxB,EAAO,GAAG,SAAS,CAAO,GAC1B,EAAO,GAAG,OAAO,CAAK;CACxB,CAAC;AACH;AAEA,SAAS,EAAY,GAAkB,GAA4B;CACjE,OAAO,IAAI,SAAS,GAAS,MAAW;EACtC,EAAO,MAAM,IAAM,MAAQ;GACzB,AAAI,IAAK,EAAO,CAAG,IACd,EAAQ;EACf,CAAC;CACH,CAAC;AACH;AAEA,eAAsB,EAAW,GAAkB,GAAgC;CACjF,IAAI,EAAQ,SAAA,UACV,MAAU,MAAM,oBAAoB,EAAQ,OAAO,cAAc,EAAgB,EAAE;CAErF,IAAM,IAAS,OAAO,MAAM,CAAC;CAG7B,AAFA,EAAO,cAAc,EAAQ,QAAQ,CAAC,GACtC,MAAM,EAAY,GAAQ,CAAM,GAC5B,EAAQ,SAAS,KACnB,MAAM,EAAY,GAAQ,CAAO;AAErC;AAEA,eAAsB,EAAU,GAAmC;CAEjE,IAAM,KAAS,MADM,EAAU,GAAQ,CAAC,GAClB,aAAa,CAAC;CACpC,IAAI,MAAW,GACb,OAAO,OAAO,MAAM,CAAC;CAEvB,IAAI,IAAA,UACF,MAAU,MAAM,oBAAoB,EAAO,cAAc,EAAgB,EAAE;CAE7E,OAAO,EAAU,GAAQ,CAAM;AACjC;AAEA,eAAsB,EACpB,GACA,GACA,GACe;CAGf,AADA,MAAM,EAAW,GADC,OAAO,KAAK,KAAK,UAAU,CAAI,GAAG,MAC3B,CAAS,GAClC,MAAM,EAAW,GAAQ,CAAI;AAC/B;AAEA,eAAsB,EACpB,GAC6C;CAC7C,IAAM,IAAU,MAAM,EAAU,CAAM,GAChC,IAAO,KAAK,MAAM,EAAQ,SAAS,MAAM,CAAC;CAChD,IAAI,CAAC,EAAK,UAAU,CAAC,EAAK,MACxB,MAAU,MAAM,qDAAqD;CAIvE,OAFA,EAAK,UAAU,EAAK,WAAW,CAAC,GAEzB;EAAE;EAAM,MAAA,MADI,EAAU,CAAM;CACf;AACtB;AAEA,eAAsB,EACpB,GACA,GACA,GACe;CAGf,AADA,MAAM,EAAW,GADC,OAAO,KAAK,KAAK,UAAU,CAAI,GAAG,MAC3B,CAAS,GAClC,MAAM,EAAW,GAAQ,CAAI;AAC/B;AAEA,eAAsB,EACpB,GACqD;CACrD,IAAM,IAAU,MAAM,EAAU,CAAM,GAChC,IAAO,KAAK,MAAM,EAAQ,SAAS,MAAM,CAAC;CAChD,IAAI,OAAO,EAAK,UAAW,UACzB,MAAU,MAAM,8CAA8C;CAIhE,OAFA,EAAK,UAAU,EAAK,WAAW,CAAC,GAEzB;EAAE;EAAM,MAAA,MADI,EAAU,CAAM;CACf;AACtB;AAGA,SAAgB,EACd,GACwB;CACxB,IAAM,IAA8B,CAAC;CACrC,KAAK,IAAM,CAAC,GAAK,MAAU,OAAO,QAAQ,CAAO,GAC3C,KAAS,SACb,EAAI,KAAO,MAAM,QAAQ,CAAK,IAAI,EAAM,KAAK,IAAI,IAAI;CAEvD,OAAO;AACT;AAGA,SAAgB,EACd,GACwB;CACxB,IAAM,IAAO,IAAI,IAAI;EACnB;EACA;EACA;EACA;CACF,CAAC,GACK,IAA8B,CAAC;CACrC,KAAK,IAAM,CAAC,GAAK,MAAU,OAAO,QAAQ,CAAO,GAC3C,EAAK,IAAI,EAAI,YAAY,CAAC,KAC1B,KAAS,SACb,EAAI,KAAO,MAAM,QAAQ,CAAK,IAAI,EAAM,KAAK,IAAI,IAAI;CAEvD,OAAO;AACT;;;ACtJA,eAAsB,EACpB,GACA,GACA,GAC4E;CAC5E,IAAM,IAAO,EAAa,QAAQ,OAAO,EAAE,GACrC,IAAY,IAAI,EAAI,EAAK,MAAM,GAAG,EAAK,EAAE;CAE/C,OAAO,IAAI,SAAS,GAAS,MAAW;EACtC,IAAM,IAAM,EAAK,QACf,GACA;GACE,QAAQ,EAAK;GACb,SAAS,EAAK;EAChB,IACC,MAAQ;GACP,IAAM,IAAmB,CAAC;GAS1B,AARA,EAAI,GAAG,SAAS,MAAkB,EAAO,KAAK,CAAK,CAAC,GACpD,EAAI,GAAG,aAAa;IAClB,EAAQ;KACN,QAAQ,EAAI,cAAc;KAC1B,SAAS,EAAsB,EAAI,OAAwD;KAC3F,MAAM,OAAO,OAAO,CAAM;IAC5B,CAAC;GACH,CAAC,GACD,EAAI,GAAG,SAAS,CAAM;EACxB,CACF;EAKA,AAJA,EAAI,GAAG,SAAS,CAAM,GAClB,EAAK,SAAS,KAChB,EAAI,MAAM,CAAI,GAEhB,EAAI,IAAI;CACV,CAAC;AACH;;;AChCA,SAAS,EACP,GACA,GACM;CACN,CAAM,YAAY;EAChB,IAAI;GACF,SAAa;IACX,IAAM,EAAE,SAAM,YAAS,MAAM,EAAkB,CAAM,GAC/C,IAAS,MAAM,EAAmB,GAAU,GAAM,CAAI;IAC5D,MAAM,EACJ,GACA;KAAE,QAAQ,EAAO;KAAQ,SAAS,EAAO;IAAQ,GACjD,EAAO,IACT;GACF;EACF,QAAQ;GACN,EAAO,QAAQ;EACjB;CACF,GAAG;AACL;AAKA,eAAsB,EAAY,GAAyD;CACzF,IAAM,IAAW,EAAQ,SAAS,QAAQ,OAAO,EAAE,GAE7C,IAAU,EADA,EAAQ,WAAW,wCACgB,GAE7C,IAAM,IAAI,EAAS,GACnB,IAAS,EAAI,cAAc,MAAW;EAC1C,EAAiB,GAAkB,CAAQ;CAC7C,CAAC;CAID,OAFA,MAAM,EAAO,OAAO,CAAO,GAEpB;EACL,KAAK,EAAQ;EACb;EACA,OAAO,YAAY;GAEjB,AADA,MAAM,EAAO,MAAM,GACnB,MAAM,EAAI,QAAQ;EACpB;CACF;AACF;;;ACvCA,eAAe,EAAgB,GAAuC;CACpE,IAAM,IAAmB,CAAC;CAC1B,WAAW,IAAM,KAAS,GACxB,EAAO,KAAK,OAAO,SAAS,CAAK,IAAI,IAAQ,OAAO,KAAK,CAAK,CAAC;CAEjE,OAAO,OAAO,OAAO,CAAM;AAC7B;AAEA,SAAS,EACP,GACa;CACb,OAAO,EAAK,cAAc,GAAK,MAAQ;EACrC,CAAM,YAAY;GAChB,IAAI;IACF,IAAM,IAAO,MAAM,EAAgB,CAAG,GAChC,IAAO,EAAI,OAAO,KAClB,IAAO;KACX,QAAQ,EAAI,UAAU;KACtB;KACA,SAAS,EAAsB,EAAI,OAAwD;IAC7F,GAEM,EAAE,MAAM,GAAc,MAAM,MAAiB,MAAM,EAAY,OAAO,OAC1E,MAAM,EAAmB,GAAQ,GAAM,CAAI,GACpC,EAAmB,CAAM,EACjC;IAGD,AADA,EAAI,UAAU,EAAa,QAAQ,EAAa,OAAO,GACvD,EAAI,IAAI,CAAY;GACtB,SAAS,GAAK;IACZ,IAAM,IAAU,aAAe,QAAQ,EAAI,UAAU,OAAO,CAAG;IAI/D,AAHK,EAAI,eACP,EAAI,UAAU,KAAK,EAAE,gBAAgB,4BAA4B,CAAC,GAEpE,EAAI,IAAI,+BAA+B,GAAS;GAClD;EACF,GAAG;CACL,CAAC;AACH;AAKA,eAAsB,EAAc,GAA6D;CAC/F,IAAM,IAAO,EAAQ,QAAQ,aACvB,IAAO,EAAQ,QAAQ,MACvB,IAAkB,EAAgB,EAAQ,GAAG,GAC7C,IAAY,EAA6B,GAEzC,IAAM,IAAI,EAAS,GACrB,IAA8B,MAC9B,IAAqC,MAEnC,IAAY,YACZ,KAAgB,CAAC,EAAa,YACzB,IAEL,MAGJ,IAAa,IAAI,SAAiB,GAAS,MAAW;EACpD,IAAM,IAAS,EAAI,QAAQ,GAAiB,EAC1C,SAAS;GAAE,WAAW,EAAU;GAAW,WAAW,EAAU;EAAU,EAC5E,CAAC,GACK,UAAgB;GAGpB,AAFA,IAAe,GACf,IAAa,MACb,EAAQ,CAAM;EAChB;EAGA,AAFA,EAAO,KAAK,QAAQ,CAAO,GAC3B,EAAO,KAAK,WAAW,CAAO,GAC9B,EAAO,KAAK,UAAU,MAAe;GAEnC,AADA,IAAa,MACb,EAAO,CAAG;EACZ,CAAC;CACH,CAAC,GACM,IAIL,IAAgC,QAAQ,QAAQ,GAC9C,IAAc,OAAU,MAAmD;EAC/E,IAAM,IAAM,EAAY,WAAW,EAAU,CAAC,EAAE,KAAK,CAAE;EAEvD,OADA,IAAc,EAAI,YAAY,CAAC,CAAC,GACzB;CACT,GAEM,IAAS,GAAmB,MAAY,EAAY,CAAO,CAAC;CAElE,MAAM,IAAI,SAAe,GAAS,MAAW;EAE3C,AADA,EAAO,KAAK,SAAS,CAAM,GAC3B,EAAO,OAAO,GAAM,SAAY,EAAQ,CAAC;CAC3C,CAAC;CAED,IAAM,IAAU,EAAO,QAAQ,GACzB,IACJ,KAAW,OAAO,KAAY,WAAW,EAAQ,OAAO,GAEpD,IAAU,UAAU,EAAK,GAAG;CAElC,OAAO;EACL,KAAK,EAAQ;EACb;EACA,MAAM;EACN;EACA,OAAO,YAAY;GAKjB,AAJA,MAAM,IAAI,SAAe,MAAY,EAAO,YAAY,EAAQ,CAAC,CAAC,GAC9D,KAAgB,CAAC,EAAa,aAChC,EAAa,QAAQ,GAEvB,MAAM,EAAI,QAAQ;EACpB;CACF;AACF;AAEA,SAAgB,EAAgB,GAAiB,IAAO,IAAY;CAClE,IAAM,IAAO,EAAQ,QAAQ,OAAO,EAAE;CAEtC,OADK,IACE,EAAK,WAAW,GAAG,IAAI,GAAG,IAAO,MAAS,GAAG,EAAK,GAAG,MAD1C;AAEpB;;;AC/HA,IAAa,IAAiC"}

package/dist/keys.d.ts

@@ -0,0 +1,11 @@
+import type { OperatorKeyPair } from './types';
+export interface PersistedKeyFile {
+    publicKey: string;
+    secretKey: string;
+    encoding: 'hex';
+}
+export declare function encodePublicKeyZ32(publicKey: Buffer): string;
+export declare function decodePublicKey(key: string): Buffer;
+export declare function loadOrCreateOperatorKeypair(keyFile: string): OperatorKeyPair;
+export declare function createEphemeralClientKeypair(): OperatorKeyPair;
+//# sourceMappingURL=keys.d.ts.map

package/dist/keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAE9C,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,KAAK,CAAA;CAChB;AAUD,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAanD;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,CA+B5E;AAED,wBAAgB,4BAA4B,IAAI,eAAe,CAO9D"}

package/dist/tunnel/connect.d.ts

@@ -0,0 +1,7 @@
+import type { ConnectTunnelOptions, ConnectTunnelResult } from '../types';
+/**
+ * Client: dial operator key and expose a localhost HTTP server that forwards through the tunnel.
+ */
+export declare function connectTunnel(options: ConnectTunnelOptions): Promise<ConnectTunnelResult>;
+export declare function localGatewayUrl(baseUrl: string, path?: string): string;
+//# sourceMappingURL=connect.d.ts.map

package/dist/tunnel/connect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect.d.ts","sourceRoot":"","sources":["../../src/tunnel/connect.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AA0CzE;;GAEG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAsE/F;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,SAAK,GAAG,MAAM,CAIlE"}

package/dist/tunnel/protocol.d.ts

@@ -0,0 +1,21 @@
+import type { Readable, Writable } from 'node:stream';
+import type { TunnelMeta, TunnelResponseMeta } from '../types';
+/** Maximum single frame payload (64 MiB). */
+export declare const MAX_FRAME_BYTES: number;
+export declare function writeFrame(stream: Writable, payload: Buffer): Promise<void>;
+export declare function readFrame(stream: Readable): Promise<Buffer>;
+export declare function writeTunnelRequest(stream: Writable, meta: TunnelMeta, body: Buffer): Promise<void>;
+export declare function readTunnelRequest(stream: Readable): Promise<{
+    meta: TunnelMeta;
+    body: Buffer;
+}>;
+export declare function writeTunnelResponse(stream: Writable, meta: TunnelResponseMeta, body: Buffer): Promise<void>;
+export declare function readTunnelResponse(stream: Readable): Promise<{
+    meta: TunnelResponseMeta;
+    body: Buffer;
+}>;
+/** Normalize header values to strings for tunnel transport. */
+export declare function flattenRequestHeaders(headers: Record<string, string | string[] | undefined>): Record<string, string>;
+/** Pick response headers safe to forward to the local HTTP client. */
+export declare function filterResponseHeaders(headers: Record<string, string | string[] | undefined>): Record<string, string>;
+//# sourceMappingURL=protocol.d.ts.map

package/dist/tunnel/protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../../src/tunnel/protocol.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAE9D,6CAA6C;AAC7C,eAAO,MAAM,eAAe,QAAmB,CAAA;AAoD/C,wBAAsB,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAUjF;AAED,wBAAsB,SAAS,CAAC,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAUjE;AAED,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,QAAQ,EAChB,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC,CAIf;AAED,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,QAAQ,GACf,OAAO,CAAC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAS7C;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,QAAQ,EAChB,IAAI,EAAE,kBAAkB,EACxB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC,CAIf;AAED,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,QAAQ,GACf,OAAO,CAAC;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CASrD;AAED,+DAA+D;AAC/D,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GACrD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOxB;AAED,sEAAsE;AACtE,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GACrD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAcxB"}

package/dist/tunnel/proxy.d.ts

@@ -0,0 +1,7 @@
+import type { TunnelMeta } from '../types';
+export declare function proxyTunnelRequest(upstreamBase: string, meta: TunnelMeta, body: Buffer): Promise<{
+    status: number;
+    headers: Record<string, string>;
+    body: Buffer;
+}>;
+//# sourceMappingURL=proxy.d.ts.map

package/dist/tunnel/proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../src/tunnel/proxy.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AAE1C,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CA8B5E"}

package/dist/tunnel/serve.d.ts

@@ -0,0 +1,6 @@
+import type { ServeTunnelOptions, ServeTunnelResult } from '../types';
+/**
+ * Operator: accept Hyperswarm/DHT connections and proxy framed HTTP to upstream Traefik.
+ */
+export declare function serveTunnel(options: ServeTunnelOptions): Promise<ServeTunnelResult>;
+//# sourceMappingURL=serve.d.ts.map

package/dist/tunnel/serve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../src/tunnel/serve.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAA;AAuBrE;;GAEG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAoBzF"}

package/dist/types.d.ts

@@ -0,0 +1,46 @@
+export type TunnelMeta = {
+    method: string;
+    path: string;
+    headers: Record<string, string>;
+};
+export type TunnelResponseMeta = {
+    status: number;
+    headers: Record<string, string>;
+};
+export type ServeTunnelOptions = {
+    /** Upstream HTTP origin (e.g. http://127.0.0.1:80) */
+    upstream: string;
+    /** Operator Ed25519 keypair file (JSON) — created on first run if missing */
+    keyFile?: string;
+    /** Directory for DHT state (optional, in-memory if unset) */
+    storePath?: string;
+};
+export type ServeTunnelResult = {
+    /** Operator public key (z32) */
+    key: string;
+    upstream: string;
+    close: () => Promise<void>;
+};
+export type ConnectTunnelOptions = {
+    /** Operator public key (z32 or hex) */
+    key: string;
+    /** Local HTTP bind host */
+    host?: string;
+    /** Local HTTP bind port */
+    port?: number;
+    /** Optional store path for DHT client state */
+    storePath?: string;
+};
+export type ConnectTunnelResult = {
+    key: string;
+    host: string;
+    port: number;
+    baseUrl: string;
+    close: () => Promise<void>;
+};
+export type OperatorKeyPair = {
+    publicKey: Buffer;
+    secretKey: Buffer;
+    z32: string;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAAG;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAChC,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAChC,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,sDAAsD;IACtD,QAAQ,EAAE,MAAM,CAAA;IAChB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,gCAAgC;IAChC,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3B,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,uCAAuC;IACvC,GAAG,EAAE,MAAM,CAAA;IACX,2BAA2B;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,2BAA2B;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3B,CAAA;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA"}

package/package.json

@@ -0,0 +1,49 @@
+{
+  "name": "@seedprotocol/gateway-hyper",
+  "version": "0.5.1",
+  "description": "Hyperswarm HTTP tunnel for Seed Protocol gateway + upload API infrastructure",
+  "type": "module",
+  "main": "./dist/index.js",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      }
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "rimraf dist && tsc -p tsconfig.build.json && vite build",
+    "test": "vitest run --reporter=default",
+    "prepublishOnly": "bun run build && node ../../scripts/sync-versions.js"
+  },
+  "dependencies": {
+    "b4a": "^1.6.7",
+    "hypercore-id-encoding": "^1.3.0",
+    "hyperdht": "^6.20.0"
+  },
+  "devDependencies": {
+    "@types/bun": "latest",
+    "@types/node": "^24.10.1",
+    "rimraf": "^6.0.1",
+    "typescript": "~5.9.3",
+    "vite": "^8.0.0",
+    "vitest": "^3.0.0"
+  },
+  "author": "Keith Axline <keith@journodao.xyz>",
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  }
+}