@seedprotocol/gateway-hyper 0.7.10-next.1353.g74aeeed → 0.7.10

package/README.md

@@ -25,10 +25,29 @@ Requires Node 20+ and Holepunch native addons. Prefer Node over Bun. Installs th
 # Operator
 seed-gateway serve --upstream http://127.0.0.1:80 --key-file ./.seed/gateway-tunnel/operator.key.json
 
+# Operator accepting only listed clients
+seed-gateway serve --upstream http://127.0.0.1:80 --allow-keys <client-z32> --allow-ips 192.168.1.0/24
+
 # Client sidecar (Path A)
 seed-gateway connect <z32-key> --host 127.0.0.1 --port 1984
+
+# Operator logging every stream and request, with a request id header upstream
+seed-gateway serve --upstream http://127.0.0.1:80 --trace --request-id-header x-seed-tunnel-request-id
+
+# Raw TCP mode, for an HTTP proxy in front (no size limit, streaming, WebSockets)
+seed-gateway serve --raw --upstream http://127.0.0.1:80
+seed-gateway connect --raw <raw-z32-key> --port 1985
+
+# Client with a fixed key the operator can list
+seed-gateway connect --print-key --key-file ./client.key.json
+seed-gateway connect <z32-key> --key-file ./client.key.json
 ```
 
+A client on the operator's LAN connects over the LAN and shows its LAN address, so list the
+LAN range rather than the public IP. A connection relayed through another HyperDHT node shows
+the relay's address and is refused unless its key is listed. See
+[Restricting who can connect](https://github.com/JournoLabs/seed-protocol-sdk/blob/main/docs/GATEWAY_HYPER.md#restricting-who-can-connect).
+
 ## Library
 
 ```ts
@@ -36,6 +55,8 @@ import {
   serveTunnel,
   connectTunnel,
   createGatewayProxy,
+  serveRawTunnel,
+  connectRawTunnel,
 } from '@seedprotocol/gateway-hyper'
 
 const operator = await serveTunnel({ upstream: 'http://127.0.0.1:80' })
@@ -67,8 +88,9 @@ Keep `SEED_GATEWAY_HYPER_KEY` on the server only. Authenticate / rate-limit the
 
 ## Tests
 
-- Unit tests always run.
-- DHT integration: `GATEWAY_HYPER_TESTS=1 bun run test` (from a checkout of the monorepo)
+- All tests run with `bun run test` (from a checkout of the monorepo). DHT tests use a local
+  `hyperdht/testnet`.
+- Public-DHT smoke test: `GATEWAY_HYPER_TESTS=1 bun run test`
 
 ## License
 

package/dist/bin.js

@@ -1,86 +1,202 @@
 #!/usr/bin/env node
-import { r as e, u as t } from "./src-qIlmrs1H.js";
-import n from "node:path";
-import r from "node:process";
-import { parseArgs as i } from "node:util";
-//#region src/bin.ts
-var a = "Usage:\n  seed-gateway serve [--upstream http://127.0.0.1:80] [--key-file <path>] [--upstream-timeout-ms 30000]\n      Operator: accept Hyper connections and proxy them to a local upstream (Traefik).\n      Default --key-file: ./.seed/gateway-tunnel/operator.key.json (created on first run).\n      Answers 504 when the upstream is idle for --upstream-timeout-ms (0 disables).\n\n  seed-gateway connect <key> [--host 127.0.0.1] [--port 1984] [--request-timeout-ms 60000]\n      Client: dial an operator key and expose a localhost HTTP sidecar.\n      Abandons a request and reconnects when the tunnel is idle for --request-timeout-ms.\n      [--max-streams 4] opens up to that many streams to the operator, one request each.";
-function o(e) {
-	console.error(`[Seed Protocol] ${e}`), console.error(a), r.exit(1);
+import { P as e, _ as t, c as n, g as r, m as i, p as a, r as o, s } from "./src-DHEkxp5F.js";
+import c from "node:path";
+import l from "node:process";
+import { parseArgs as u } from "node:util";
+//#region src/cli.ts
+var d = c.join(".seed", "gateway-tunnel", "operator.key.json"), f = 1984, p = `Usage:
+  seed-gateway serve [--upstream http://127.0.0.1:80] [--key-file <path>] [--upstream-timeout-ms 30000]
+                     [--allow-keys k1,k2] [--allow-ips 192.168.1.0/24,203.0.113.7]
+      Operator: accept Hyper connections and proxy them to a local upstream (Traefik).
+      Default --key-file: ./.seed/gateway-tunnel/operator.key.json (created on first run).
+      Answers 504 when the upstream is idle for --upstream-timeout-ms (0 disables).
+      With --allow-keys or --allow-ips, only clients whose public key or address is listed
+      can connect. A client on the operator's LAN shows its LAN address.
+      --trace logs each stream and request event as a \`tunnel-trace <event> key=value\` line.
+      --request-id-header <name> sends each request's id upstream under that header.
+
+  seed-gateway connect <key> [--host 127.0.0.1] [--port 1984] [--request-timeout-ms 60000]
+                       [--connect-timeout-ms 30000] [--key-file <path>]
+      Client: dial an operator key and expose a localhost HTTP sidecar.
+      Abandons a request and reconnects when the tunnel is idle for --request-timeout-ms.
+      [--max-streams 4] opens up to that many streams to the operator, one request each.
+      --key-file keeps this client's key in a file (created on first run), so the operator
+      can list it with --allow-keys. Without it, each run uses a new key.
+
+  seed-gateway connect --print-key --key-file <path>
+      Print the client public key (z32) in the key file, creating the file if missing.
+
+  seed-gateway serve --raw [--upstream http://127.0.0.1:80] [--key-file <path>]
+                           [--allow-keys ...] [--allow-ips ...] [--trace]
+      Operator, raw mode: pipe each Hyper connection byte for byte to a new TCP connection to
+      the upstream, so HTTP runs end to end with no size limit, streaming and WebSockets.
+      Default --key-file: ./${a}. Raw and framed servers need
+      separate keys; clients of one can't talk to the other.
+
+  seed-gateway connect --raw <key> [--host 127.0.0.1] [--port ${s}] [--key-file <path>]
+                                   [--max-connections 64] [--connect-timeout-ms 30000] [--trace]
+      Client, raw mode: listen on a local TCP port and carry each connection to a raw operator
+      over its own Hyper stream. Put a client that keeps connections alive (nginx with
+      keepalive) in front; each new connection costs a DHT lookup and handshake.`;
+function m(e) {
+	console.error(`[Seed Protocol] ${e}`), console.error(p), l.exit(1);
 }
-function s(e, t) {
+function h(e, t) {
 	if (e === void 0) return;
 	let n = Number(e);
-	return (!Number.isInteger(n) || n < 0) && o(`${t} must be a whole number of milliseconds`), n;
+	return (!Number.isInteger(n) || n < 0) && m(`${t} must be a whole number of milliseconds`), n;
 }
-function c(e, t) {
+function g(e, t) {
 	if (e === void 0) return;
 	let n = Number(e);
-	return (!Number.isInteger(n) || n < 1) && o(`${t} must be a whole number of at least 1`), n;
+	return (!Number.isInteger(n) || n < 1) && m(`${t} must be a whole number of at least 1`), n;
+}
+function _(e, t = /* @__PURE__ */ new Date()) {
+	let n = [
+		t.toISOString(),
+		"tunnel-trace",
+		e.name
+	];
+	for (let [t, r] of Object.entries(e)) {
+		if (t === "name" || r == null) continue;
+		let e = String(r);
+		n.push(`${t}=${/[\s"=]/.test(e) ? JSON.stringify(e) : e}`);
+	}
+	return n.join(" ");
+}
+function v(e) {
+	console.log(_(e));
+}
+function y(e, t) {
+	if (e === void 0) return t;
+	let n = Number(e);
+	return (!Number.isInteger(n) || n < 0 || n > 65535) && m("--port must be 0–65535"), n;
+}
+function b(e) {
+	return (e ?? "").split(",").map((e) => e.trim()).filter(Boolean);
 }
-function l() {
+function x() {
 	return new Promise((e) => {
 		let t = () => {
-			r.off("SIGINT", t), r.off("SIGTERM", t), e();
+			l.off("SIGINT", t), l.off("SIGTERM", t), e();
 		};
-		r.on("SIGINT", t), r.on("SIGTERM", t);
+		l.on("SIGINT", t), l.on("SIGTERM", t);
 	});
 }
-async function u(r) {
-	let [u, ...d] = r;
-	if (!u || u === "--help" || u === "-h" || u === "help") {
-		console.log(a);
+async function S(a) {
+	let [l, ..._] = a;
+	if (!l || l === "--help" || l === "-h" || l === "help") {
+		console.log(p);
 		return;
 	}
-	let { values: f, positionals: p } = i({
-		args: d,
+	let { values: S, positionals: C } = u({
+		args: _,
 		allowPositionals: !0,
 		options: {
 			upstream: {
 				type: "string",
 				default: "http://127.0.0.1:80"
 			},
-			"key-file": {
-				type: "string",
-				default: n.join(".seed", "gateway-tunnel", "operator.key.json")
+			"key-file": { type: "string" },
+			"print-key": {
+				type: "boolean",
+				default: !1
 			},
 			host: {
 				type: "string",
 				default: "127.0.0.1"
 			},
-			port: {
-				type: "string",
-				default: "1984"
+			port: { type: "string" },
+			raw: {
+				type: "boolean",
+				default: !1
 			},
+			"max-connections": { type: "string" },
+			"connect-timeout-ms": { type: "string" },
 			"upstream-timeout-ms": { type: "string" },
 			"request-timeout-ms": { type: "string" },
-			"max-streams": { type: "string" }
+			"max-streams": { type: "string" },
+			"allow-keys": { type: "string" },
+			"allow-ips": { type: "string" },
+			trace: {
+				type: "boolean",
+				default: !1
+			},
+			"request-id-header": { type: "string" }
 		}
 	});
-	if (u === "serve") {
-		let e = f.upstream.trim(), r = n.resolve(f["key-file"]);
-		console.log(`[Seed Protocol] Gateway tunnel upstream: ${e}`), console.log(`[Seed Protocol] Operator key file: ${r}`);
-		let i = await t({
+	if (l === "serve" && S.raw) {
+		let e = S.upstream.trim(), n = c.resolve(S["key-file"] ?? ".seed/gateway-tunnel/raw-operator.key.json");
+		console.log(`[Seed Protocol] Raw tunnel upstream: ${e}`), console.log(`[Seed Protocol] Raw operator key file: ${n}`);
+		let r = {
+			keys: b(S["allow-keys"]),
+			ips: b(S["allow-ips"])
+		};
+		console.log(`[Seed Protocol] Allowlist: ${t(r).summary}`);
+		let a = await i({
 			upstream: e,
-			keyFile: r,
-			upstreamTimeoutMs: s(f["upstream-timeout-ms"], "--upstream-timeout-ms")
+			keyFile: n,
+			allowlist: r,
+			onEvent: S.trace ? v : void 0
 		});
-		console.log(`[Seed Protocol] Operator key (z32): ${i.key}`), console.log("[Seed Protocol] Share this key with SDK users (gatewayHyperKey)."), console.log("[Seed Protocol] Press Ctrl+C to stop."), await l(), await i.close(), console.log("[Seed Protocol] Gateway tunnel stopped.");
-	} else if (u === "connect") {
-		let t = p[0];
-		t || o("seed-gateway connect requires an operator public key (z32 or hex)"), console.log(`[Seed Protocol] Connecting to operator ${t}`);
-		let n = await e({
-			key: t,
-			host: f.host,
-			port: parseInt(f.port, 10) || 1984,
-			requestTimeoutMs: s(f["request-timeout-ms"], "--request-timeout-ms"),
-			maxStreams: c(f["max-streams"], "--max-streams")
+		console.log(`[Seed Protocol] Raw operator key (z32): ${a.key}`), console.log("[Seed Protocol] Clients connect with: seed-gateway connect --raw <key>"), console.log("[Seed Protocol] Press Ctrl+C to stop."), await x(), await a.close(), console.log("[Seed Protocol] Raw tunnel stopped.");
+	} else if (l === "serve") {
+		let e = S.upstream.trim(), n = c.resolve(S["key-file"] ?? d);
+		console.log(`[Seed Protocol] Gateway tunnel upstream: ${e}`), console.log(`[Seed Protocol] Operator key file: ${n}`);
+		let i = {
+			keys: b(S["allow-keys"]),
+			ips: b(S["allow-ips"])
+		};
+		console.log(`[Seed Protocol] Allowlist: ${t(i).summary}`);
+		let a = await r({
+			upstream: e,
+			keyFile: n,
+			allowlist: i,
+			onEvent: S.trace ? v : void 0,
+			requestIdHeader: S["request-id-header"]?.trim() || void 0,
+			upstreamTimeoutMs: h(S["upstream-timeout-ms"], "--upstream-timeout-ms")
 		});
-		console.log(`[Seed Protocol] Local sidecar: ${n.baseUrl}`), console.log("[Seed Protocol] Point SDK transport=hyper or hybrid at this URL (default sidecar port 1984)."), console.log("[Seed Protocol] Press Ctrl+C to stop."), await l(), await n.close(), console.log("[Seed Protocol] Gateway sidecar stopped.");
-	} else o(`Unknown command: ${u}`);
+		console.log(`[Seed Protocol] Operator key (z32): ${a.key}`), console.log("[Seed Protocol] Share this key with SDK users (gatewayHyperKey)."), console.log("[Seed Protocol] Press Ctrl+C to stop."), await x(), await a.close(), console.log("[Seed Protocol] Gateway tunnel stopped.");
+	} else if (l === "connect") {
+		let t = S["key-file"] ? c.resolve(S["key-file"]) : void 0;
+		if (S["print-key"]) {
+			t || m("--print-key requires --key-file"), console.log(e(t).z32);
+			return;
+		}
+		let r = C[0];
+		r || m("seed-gateway connect requires an operator public key (z32 or hex)");
+		let i = h(S["connect-timeout-ms"], "--connect-timeout-ms");
+		if (S.raw) {
+			console.log(`[Seed Protocol] Connecting to raw operator ${r}`);
+			let e = await n({
+				key: r,
+				keyFile: t,
+				host: S.host,
+				port: y(S.port, s),
+				maxConnections: g(S["max-connections"], "--max-connections"),
+				connectTimeoutMs: i,
+				onEvent: S.trace ? v : void 0
+			});
+			console.log(`[Seed Protocol] Client key (z32): ${e.clientKey}${t ? "" : " (new for this run)"}`), console.log(`[Seed Protocol] Raw tunnel listening on ${e.host}:${e.port}`), console.log("[Seed Protocol] Press Ctrl+C to stop."), await x(), await e.close(), console.log("[Seed Protocol] Raw tunnel client stopped.");
+			return;
+		}
+		console.log(`[Seed Protocol] Connecting to operator ${r}`);
+		let a = await o({
+			key: r,
+			keyFile: t,
+			host: S.host,
+			port: y(S.port, f),
+			connectTimeoutMs: i,
+			requestTimeoutMs: h(S["request-timeout-ms"], "--request-timeout-ms"),
+			maxStreams: g(S["max-streams"], "--max-streams")
+		});
+		console.log(`[Seed Protocol] Client key (z32): ${a.clientKey}${t ? "" : " (new for this run)"}`), console.log(`[Seed Protocol] Local sidecar: ${a.baseUrl}`), console.log("[Seed Protocol] Point SDK transport=hyper or hybrid at this URL (default sidecar port 1984)."), console.log("[Seed Protocol] Press Ctrl+C to stop."), await x(), await a.close(), console.log("[Seed Protocol] Gateway sidecar stopped.");
+	} else m(`Unknown command: ${l}`);
 }
-u(r.argv.slice(2)).catch((e) => {
-	console.error("[Seed Protocol]", e instanceof Error ? e.message : e), r.exit(1);
+//#endregion
+//#region src/bin.ts
+S(l.argv.slice(2)).catch((e) => {
+	console.error("[Seed Protocol]", e instanceof Error ? e.message : e), l.exit(1);
 });
 //#endregion
 

package/dist/bin.js.map

@@ -1 +1 @@
-{"version":3,"file":"bin.js","names":["connectTunnel","serveTunnel","path","process","USAGE","fail","message","parseMs","value","ms","flag","parseCount","count","waitForSignal","onStop","resolve","main","command","rest","argv","parseArgs","upstream","values","keyFile","session","key","positionals","err"],"sources":["../src/bin.ts"],"sourcesContent":["/**\n * `seed-gateway serve|connect` — HTTP tunnel to Seed gateway + upload API infrastructure over HyperDHT.\n * Run under Node (Holepunch natives may crash under Bun).\n */\nimport path from 'node:path'\nimport process from 'node:process'\nimport { parseArgs } from 'node:util'\nimport { connectTunnel, serveTunnel } from './index'\n\nconst USAGE = `Usage:\n  seed-gateway serve [--upstream http://127.0.0.1:80] [--key-file <path>] [--upstream-timeout-ms 30000]\n      Operator: accept Hyper connections and proxy them to a local upstream (Traefik).\n      Default --key-file: ./.seed/gateway-tunnel/operator.key.json (created on first run).\n      Answers 504 when the upstream is idle for --upstream-timeout-ms (0 disables).\n\n  seed-gateway connect <key> [--host 127.0.0.1] [--port 1984] [--request-timeout-ms 60000]\n      Client: dial an operator key and expose a localhost HTTP sidecar.\n      Abandons a request and reconnects when the tunnel is idle for --request-timeout-ms.\n      [--max-streams 4] opens up to that many streams to the operator, one request each.`\n\nfunction fail(message: string): never {\n  console.error(`[Seed Protocol] ${message}`)\n  console.error(USAGE)\n  process.exit(1)\n}\n\nfunction parseMs(value: string | undefined, flag: string): number | undefined {\n  if (value === undefined) return undefined\n  const ms = Number(value)\n  if (!Number.isInteger(ms) || ms < 0) fail(`${flag} must be a whole number of milliseconds`)\n  return ms\n}\n\nfunction parseCount(value: string | undefined, flag: string): number | undefined {\n  if (value === undefined) return undefined\n  const count = Number(value)\n  if (!Number.isInteger(count) || count < 1) fail(`${flag} must be a whole number of at least 1`)\n  return count\n}\n\nfunction waitForSignal(): Promise<void> {\n  return new Promise((resolve) => {\n    const onStop = () => {\n      process.off('SIGINT', onStop)\n      process.off('SIGTERM', onStop)\n      resolve()\n    }\n    process.on('SIGINT', onStop)\n    process.on('SIGTERM', onStop)\n  })\n}\n\nasync function main(argv: string[]): Promise<void> {\n  const [command, ...rest] = argv\n  if (!command || command === '--help' || command === '-h' || command === 'help') {\n    console.log(USAGE)\n    return\n  }\n\n  const { values, positionals } = parseArgs({\n    args: rest,\n    allowPositionals: true,\n    options: {\n      upstream: { type: 'string', default: 'http://127.0.0.1:80' },\n      'key-file': {\n        type: 'string',\n        default: path.join('.seed', 'gateway-tunnel', 'operator.key.json'),\n      },\n      host: { type: 'string', default: '127.0.0.1' },\n      port: { type: 'string', default: '1984' },\n      'upstream-timeout-ms': { type: 'string' },\n      'request-timeout-ms': { type: 'string' },\n      'max-streams': { type: 'string' },\n    },\n  })\n\n  if (command === 'serve') {\n    const upstream = values.upstream.trim()\n    const keyFile = path.resolve(values['key-file'])\n    console.log(`[Seed Protocol] Gateway tunnel upstream: ${upstream}`)\n    console.log(`[Seed Protocol] Operator key file: ${keyFile}`)\n\n    const session = await serveTunnel({\n      upstream,\n      keyFile,\n      upstreamTimeoutMs: parseMs(values['upstream-timeout-ms'], '--upstream-timeout-ms'),\n    })\n    console.log(`[Seed Protocol] Operator key (z32): ${session.key}`)\n    console.log('[Seed Protocol] Share this key with SDK users (gatewayHyperKey).')\n    console.log('[Seed Protocol] Press Ctrl+C to stop.')\n    await waitForSignal()\n    await session.close()\n    console.log('[Seed Protocol] Gateway tunnel stopped.')\n    return\n  }\n\n  if (command === 'connect') {\n    const key = positionals[0]\n    if (!key) fail('seed-gateway connect requires an operator public key (z32 or hex)')\n\n    console.log(`[Seed Protocol] Connecting to operator ${key}`)\n    const session = await connectTunnel({\n      key,\n      host: values.host,\n      port: parseInt(values.port, 10) || 1984,\n      requestTimeoutMs: parseMs(values['request-timeout-ms'], '--request-timeout-ms'),\n      maxStreams: parseCount(values['max-streams'], '--max-streams'),\n    })\n    console.log(`[Seed Protocol] Local sidecar: ${session.baseUrl}`)\n    console.log(\n      '[Seed Protocol] Point SDK transport=hyper or hybrid at this URL (default sidecar port 1984).',\n    )\n    console.log('[Seed Protocol] Press Ctrl+C to stop.')\n    await waitForSignal()\n    await session.close()\n    console.log('[Seed Protocol] Gateway sidecar stopped.')\n    return\n  }\n\n  fail(`Unknown command: ${command}`)\n}\n\nmain(process.argv.slice(2)).catch((err) => {\n  console.error('[Seed Protocol]', err instanceof Error ? err.message : err)\n  process.exit(1)\n})\n"],"mappings":";;;;;;AASA,IAAMI,IAAQ;AAWd,SAASC,EAAK,GAAwB;CAGpC,AAFA,QAAQ,MAAM,mBAAmBC,GAAS,GAC1C,QAAQ,MAAMF,CAAK,GACnBD,EAAQ,KAAK,CAAC;AAChB;AAEA,SAASI,EAAQ,GAA2B,GAAkC;CAC5E,IAAIC,MAAU,KAAA,GAAW;CACzB,IAAMC,IAAK,OAAOD,CAAK;CAEvB,QADI,CAAC,OAAO,UAAUC,CAAE,KAAKA,IAAK,MAAGJ,EAAK,GAAGK,EAAK,wCAAwC,GACnFD;AACT;AAEA,SAASE,EAAW,GAA2B,GAAkC;CAC/E,IAAIH,MAAU,KAAA,GAAW;CACzB,IAAMI,IAAQ,OAAOJ,CAAK;CAE1B,QADI,CAAC,OAAO,UAAUI,CAAK,KAAKA,IAAQ,MAAGP,EAAK,GAAGK,EAAK,sCAAsC,GACvFE;AACT;AAEA,SAASC,IAA+B;CACtC,OAAO,IAAI,SAAS,MAAY;EAC9B,IAAMC,UAAe;GAGnB,AAFAX,EAAQ,IAAI,UAAUW,CAAM,GAC5BX,EAAQ,IAAI,WAAWW,CAAM,GAC7BC,EAAQ;EACV;EAEA,AADAZ,EAAQ,GAAG,UAAUW,CAAM,GAC3BX,EAAQ,GAAG,WAAWW,CAAM;CAC9B,CAAC;AACH;AAEA,eAAeE,EAAK,GAA+B;CACjD,IAAM,CAACC,GAAS,GAAGC,KAAQC;CAC3B,IAAI,CAACF,KAAWA,MAAY,YAAYA,MAAY,QAAQA,MAAY,QAAQ;EAC9E,QAAQ,IAAIb,CAAK;EACjB;CACF;CAEA,IAAM,EAAE,WAAQ,mBAAgBgB,EAAU;EACxC,MAAMF;EACN,kBAAkB;EAClB,SAAS;GACP,UAAU;IAAE,MAAM;IAAU,SAAS;GAAsB;GAC3D,YAAY;IACV,MAAM;IACN,SAAShB,EAAK,KAAK,SAAS,kBAAkB,mBAAmB;GACnE;GACA,MAAM;IAAE,MAAM;IAAU,SAAS;GAAY;GAC7C,MAAM;IAAE,MAAM;IAAU,SAAS;GAAO;GACxC,uBAAuB,EAAE,MAAM,SAAS;GACxC,sBAAsB,EAAE,MAAM,SAAS;GACvC,eAAe,EAAE,MAAM,SAAS;EAClC;CACF,CAAC;CAED,IAAIe,MAAY,SAAS;EACvB,IAAMI,IAAWC,EAAO,SAAS,KAAK,GAChCC,IAAUrB,EAAK,QAAQoB,EAAO,WAAW;EAE/C,AADA,QAAQ,IAAI,4CAA4CD,GAAU,GAClE,QAAQ,IAAI,sCAAsCE,GAAS;EAE3D,IAAMC,IAAU,MAAMvB,EAAY;GAChC;GACA;GACA,mBAAmBM,EAAQe,EAAO,wBAAwB,uBAAuB;EACnF,CAAC;EAMD,AALA,QAAQ,IAAI,uCAAuCE,EAAQ,KAAK,GAChE,QAAQ,IAAI,kEAAkE,GAC9E,QAAQ,IAAI,uCAAuC,GACnD,MAAMX,EAAc,GACpB,MAAMW,EAAQ,MAAM,GACpB,QAAQ,IAAI,yCAAyC;CAEvD,OAEA,IAAIP,MAAY,WAAW;EACzB,IAAMQ,IAAMC,EAAY;EAGxB,AAFKD,KAAKpB,EAAK,mEAAmE,GAElF,QAAQ,IAAI,0CAA0CoB,GAAK;EAC3D,IAAMD,IAAU,MAAMxB,EAAc;GAClC;GACA,MAAMsB,EAAO;GACb,MAAM,SAASA,EAAO,MAAM,EAAE,KAAK;GACnC,kBAAkBf,EAAQe,EAAO,uBAAuB,sBAAsB;GAC9E,YAAYX,EAAWW,EAAO,gBAAgB,eAAe;EAC/D,CAAC;EAQD,AAPA,QAAQ,IAAI,kCAAkCE,EAAQ,SAAS,GAC/D,QAAQ,IACN,8FACF,GACA,QAAQ,IAAI,uCAAuC,GACnD,MAAMX,EAAc,GACpB,MAAMW,EAAQ,MAAM,GACpB,QAAQ,IAAI,0CAA0C;CAExD,OAEA,EAAK,oBAAoBP,GAAS;AACpC;AAEAD,EAAKb,EAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,MAAQ;CAEzC,AADA,QAAQ,MAAM,mBAAmBwB,aAAe,QAAQA,EAAI,UAAUA,CAAG,GACzExB,EAAQ,KAAK,CAAC;AAChB,CAAC"}
+{"version":3,"file":"bin.js","names":["loadOrCreateOperatorKeypair","createAllowlist","connectRawTunnel","serveTunnel","serveRawTunnel","DEFAULT_RAW_OPERATOR_KEY_FILE","connectTunnel","path","process","DEFAULT_OPERATOR_KEY_FILE","DEFAULT_PORT","USAGE","DEFAULT_RAW_PORT","fail","message","parseMs","value","ms","flag","parseCount","count","formatTunnelEvent","parts","now","event","key","text","logTunnelEvent","parsePort","fallback","port","splitList","entry","waitForSignal","onStop","resolve","main","command","rest","argv","parseArgs","values","upstream","keyFile","allowlist","session","positionals","connectTimeoutMs","err"],"sources":["../src/cli.ts","../src/bin.ts"],"sourcesContent":["/**\n * `seed-gateway serve|connect`, run by `bin.ts`. Separate so tests can call `main`.\n */\nimport path from 'node:path'\nimport process from 'node:process'\nimport { parseArgs } from 'node:util'\nimport {\n  connectRawTunnel,\n  connectTunnel,\n  createAllowlist,\n  DEFAULT_RAW_OPERATOR_KEY_FILE,\n  DEFAULT_RAW_PORT,\n  loadOrCreateOperatorKeypair,\n  serveRawTunnel,\n  serveTunnel,\n  type RawClientEvent,\n  type RawTunnelEvent,\n  type TunnelEvent,\n} from './index'\n\nconst DEFAULT_OPERATOR_KEY_FILE = path.join('.seed', 'gateway-tunnel', 'operator.key.json')\nconst DEFAULT_PORT = 1984\n\nconst USAGE = `Usage:\n  seed-gateway serve [--upstream http://127.0.0.1:80] [--key-file <path>] [--upstream-timeout-ms 30000]\n                     [--allow-keys k1,k2] [--allow-ips 192.168.1.0/24,203.0.113.7]\n      Operator: accept Hyper connections and proxy them to a local upstream (Traefik).\n      Default --key-file: ./.seed/gateway-tunnel/operator.key.json (created on first run).\n      Answers 504 when the upstream is idle for --upstream-timeout-ms (0 disables).\n      With --allow-keys or --allow-ips, only clients whose public key or address is listed\n      can connect. A client on the operator's LAN shows its LAN address.\n      --trace logs each stream and request event as a \\`tunnel-trace <event> key=value\\` line.\n      --request-id-header <name> sends each request's id upstream under that header.\n\n  seed-gateway connect <key> [--host 127.0.0.1] [--port 1984] [--request-timeout-ms 60000]\n                       [--connect-timeout-ms 30000] [--key-file <path>]\n      Client: dial an operator key and expose a localhost HTTP sidecar.\n      Abandons a request and reconnects when the tunnel is idle for --request-timeout-ms.\n      [--max-streams 4] opens up to that many streams to the operator, one request each.\n      --key-file keeps this client's key in a file (created on first run), so the operator\n      can list it with --allow-keys. Without it, each run uses a new key.\n\n  seed-gateway connect --print-key --key-file <path>\n      Print the client public key (z32) in the key file, creating the file if missing.\n\n  seed-gateway serve --raw [--upstream http://127.0.0.1:80] [--key-file <path>]\n                           [--allow-keys ...] [--allow-ips ...] [--trace]\n      Operator, raw mode: pipe each Hyper connection byte for byte to a new TCP connection to\n      the upstream, so HTTP runs end to end with no size limit, streaming and WebSockets.\n      Default --key-file: ./${DEFAULT_RAW_OPERATOR_KEY_FILE}. Raw and framed servers need\n      separate keys; clients of one can't talk to the other.\n\n  seed-gateway connect --raw <key> [--host 127.0.0.1] [--port ${DEFAULT_RAW_PORT}] [--key-file <path>]\n                                   [--max-connections 64] [--connect-timeout-ms 30000] [--trace]\n      Client, raw mode: listen on a local TCP port and carry each connection to a raw operator\n      over its own Hyper stream. Put a client that keeps connections alive (nginx with\n      keepalive) in front; each new connection costs a DHT lookup and handshake.`\n\nfunction fail(message: string): never {\n  console.error(`[Seed Protocol] ${message}`)\n  console.error(USAGE)\n  process.exit(1)\n}\n\nfunction parseMs(value: string | undefined, flag: string): number | undefined {\n  if (value === undefined) return undefined\n  const ms = Number(value)\n  if (!Number.isInteger(ms) || ms < 0) fail(`${flag} must be a whole number of milliseconds`)\n  return ms\n}\n\nfunction parseCount(value: string | undefined, flag: string): number | undefined {\n  if (value === undefined) return undefined\n  const count = Number(value)\n  if (!Number.isInteger(count) || count < 1) fail(`${flag} must be a whole number of at least 1`)\n  return count\n}\n\n/** One `tunnel-trace` line per event: ISO time, event name, then `key=value` fields. */\nexport function formatTunnelEvent(\n  event: TunnelEvent | RawTunnelEvent | RawClientEvent,\n  now = new Date(),\n): string {\n  const parts = [now.toISOString(), 'tunnel-trace', event.name]\n  for (const [key, value] of Object.entries(event)) {\n    if (key === 'name' || value === undefined || value === null) continue\n    const text = String(value)\n    parts.push(`${key}=${/[\\s\"=]/.test(text) ? JSON.stringify(text) : text}`)\n  }\n  return parts.join(' ')\n}\n\nfunction logTunnelEvent(event: TunnelEvent | RawTunnelEvent | RawClientEvent): void {\n  console.log(formatTunnelEvent(event))\n}\n\nfunction parsePort(value: string | undefined, fallback: number): number {\n  if (value === undefined) return fallback\n  const port = Number(value)\n  if (!Number.isInteger(port) || port < 0 || port > 65535) fail('--port must be 0–65535')\n  return port\n}\n\nfunction splitList(value: string | undefined): string[] {\n  return (value ?? '')\n    .split(',')\n    .map((entry) => entry.trim())\n    .filter(Boolean)\n}\n\nfunction waitForSignal(): Promise<void> {\n  return new Promise((resolve) => {\n    const onStop = () => {\n      process.off('SIGINT', onStop)\n      process.off('SIGTERM', onStop)\n      resolve()\n    }\n    process.on('SIGINT', onStop)\n    process.on('SIGTERM', onStop)\n  })\n}\n\nexport async function main(argv: string[]): Promise<void> {\n  const [command, ...rest] = argv\n  if (!command || command === '--help' || command === '-h' || command === 'help') {\n    console.log(USAGE)\n    return\n  }\n\n  const { values, positionals } = parseArgs({\n    args: rest,\n    allowPositionals: true,\n    options: {\n      upstream: { type: 'string', default: 'http://127.0.0.1:80' },\n      // No default here: serve and connect default differently.\n      'key-file': { type: 'string' },\n      'print-key': { type: 'boolean', default: false },\n      host: { type: 'string', default: '127.0.0.1' },\n      // No default here: framed and raw connect default differently.\n      port: { type: 'string' },\n      raw: { type: 'boolean', default: false },\n      'max-connections': { type: 'string' },\n      'connect-timeout-ms': { type: 'string' },\n      'upstream-timeout-ms': { type: 'string' },\n      'request-timeout-ms': { type: 'string' },\n      'max-streams': { type: 'string' },\n      'allow-keys': { type: 'string' },\n      'allow-ips': { type: 'string' },\n      trace: { type: 'boolean', default: false },\n      'request-id-header': { type: 'string' },\n    },\n  })\n\n  if (command === 'serve' && values.raw) {\n    const upstream = values.upstream.trim()\n    const keyFile = path.resolve(values['key-file'] ?? DEFAULT_RAW_OPERATOR_KEY_FILE)\n    console.log(`[Seed Protocol] Raw tunnel upstream: ${upstream}`)\n    console.log(`[Seed Protocol] Raw operator key file: ${keyFile}`)\n    const allowlist = { keys: splitList(values['allow-keys']), ips: splitList(values['allow-ips']) }\n    console.log(`[Seed Protocol] Allowlist: ${createAllowlist(allowlist).summary}`)\n\n    const session = await serveRawTunnel({\n      upstream,\n      keyFile,\n      allowlist,\n      onEvent: values.trace ? logTunnelEvent : undefined,\n    })\n    console.log(`[Seed Protocol] Raw operator key (z32): ${session.key}`)\n    console.log('[Seed Protocol] Clients connect with: seed-gateway connect --raw <key>')\n    console.log('[Seed Protocol] Press Ctrl+C to stop.')\n    await waitForSignal()\n    await session.close()\n    console.log('[Seed Protocol] Raw tunnel stopped.')\n    return\n  }\n\n  if (command === 'serve') {\n    const upstream = values.upstream.trim()\n    const keyFile = path.resolve(values['key-file'] ?? DEFAULT_OPERATOR_KEY_FILE)\n    console.log(`[Seed Protocol] Gateway tunnel upstream: ${upstream}`)\n    console.log(`[Seed Protocol] Operator key file: ${keyFile}`)\n    const allowlist = { keys: splitList(values['allow-keys']), ips: splitList(values['allow-ips']) }\n    console.log(`[Seed Protocol] Allowlist: ${createAllowlist(allowlist).summary}`)\n\n    const session = await serveTunnel({\n      upstream,\n      keyFile,\n      allowlist,\n      onEvent: values.trace ? logTunnelEvent : undefined,\n      requestIdHeader: values['request-id-header']?.trim() || undefined,\n      upstreamTimeoutMs: parseMs(values['upstream-timeout-ms'], '--upstream-timeout-ms'),\n    })\n    console.log(`[Seed Protocol] Operator key (z32): ${session.key}`)\n    console.log('[Seed Protocol] Share this key with SDK users (gatewayHyperKey).')\n    console.log('[Seed Protocol] Press Ctrl+C to stop.')\n    await waitForSignal()\n    await session.close()\n    console.log('[Seed Protocol] Gateway tunnel stopped.')\n    return\n  }\n\n  if (command === 'connect') {\n    const keyFile = values['key-file'] ? path.resolve(values['key-file']) : undefined\n    if (values['print-key']) {\n      if (!keyFile) fail('--print-key requires --key-file')\n      console.log(loadOrCreateOperatorKeypair(keyFile).z32)\n      return\n    }\n\n    const key = positionals[0]\n    if (!key) fail('seed-gateway connect requires an operator public key (z32 or hex)')\n    const connectTimeoutMs = parseMs(values['connect-timeout-ms'], '--connect-timeout-ms')\n\n    if (values.raw) {\n      console.log(`[Seed Protocol] Connecting to raw operator ${key}`)\n      const session = await connectRawTunnel({\n        key,\n        keyFile,\n        host: values.host,\n        port: parsePort(values.port, DEFAULT_RAW_PORT),\n        maxConnections: parseCount(values['max-connections'], '--max-connections'),\n        connectTimeoutMs,\n        onEvent: values.trace ? logTunnelEvent : undefined,\n      })\n      console.log(\n        `[Seed Protocol] Client key (z32): ${session.clientKey}${keyFile ? '' : ' (new for this run)'}`,\n      )\n      console.log(`[Seed Protocol] Raw tunnel listening on ${session.host}:${session.port}`)\n      console.log('[Seed Protocol] Press Ctrl+C to stop.')\n      await waitForSignal()\n      await session.close()\n      console.log('[Seed Protocol] Raw tunnel client stopped.')\n      return\n    }\n\n    console.log(`[Seed Protocol] Connecting to operator ${key}`)\n    const session = await connectTunnel({\n      key,\n      keyFile,\n      host: values.host,\n      port: parsePort(values.port, DEFAULT_PORT),\n      connectTimeoutMs,\n      requestTimeoutMs: parseMs(values['request-timeout-ms'], '--request-timeout-ms'),\n      maxStreams: parseCount(values['max-streams'], '--max-streams'),\n    })\n    console.log(\n      `[Seed Protocol] Client key (z32): ${session.clientKey}${keyFile ? '' : ' (new for this run)'}`,\n    )\n    console.log(`[Seed Protocol] Local sidecar: ${session.baseUrl}`)\n    console.log(\n      '[Seed Protocol] Point SDK transport=hyper or hybrid at this URL (default sidecar port 1984).',\n    )\n    console.log('[Seed Protocol] Press Ctrl+C to stop.')\n    await waitForSignal()\n    await session.close()\n    console.log('[Seed Protocol] Gateway sidecar stopped.')\n    return\n  }\n\n  fail(`Unknown command: ${command}`)\n}\n","/**\n * `seed-gateway serve|connect` — HTTP tunnel to Seed gateway + upload API infrastructure over HyperDHT.\n * Run under Node (Holepunch natives may crash under Bun).\n */\nimport process from 'node:process'\nimport { main } from './cli'\n\nmain(process.argv.slice(2)).catch((err) => {\n  console.error('[Seed Protocol]', err instanceof Error ? err.message : err)\n  process.exit(1)\n})\n"],"mappings":";;;;;;AAoBA,IAAMS,IAA4BF,EAAK,KAAK,SAAS,kBAAkB,mBAAmB,GACpFG,IAAe,MAEfC,IAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;8BA0BgBN,EAA8B;;;gEAGIO,EAAiB;;;;;AAMjF,SAASC,EAAK,GAAwB;CAGpC,AAFA,QAAQ,MAAM,mBAAmBC,GAAS,GAC1C,QAAQ,MAAMH,CAAK,GACnBH,EAAQ,KAAK,CAAC;AAChB;AAEA,SAASO,EAAQ,GAA2B,GAAkC;CAC5E,IAAIC,MAAU,KAAA,GAAW;CACzB,IAAMC,IAAK,OAAOD,CAAK;CAEvB,QADI,CAAC,OAAO,UAAUC,CAAE,KAAKA,IAAK,MAAGJ,EAAK,GAAGK,EAAK,wCAAwC,GACnFD;AACT;AAEA,SAASE,EAAW,GAA2B,GAAkC;CAC/E,IAAIH,MAAU,KAAA,GAAW;CACzB,IAAMI,IAAQ,OAAOJ,CAAK;CAE1B,QADI,CAAC,OAAO,UAAUI,CAAK,KAAKA,IAAQ,MAAGP,EAAK,GAAGK,EAAK,sCAAsC,GACvFE;AACT;AAGA,SAAgBC,EACd,GACA,oBAAM,IAAI,KAAK,GACP;CACR,IAAMC,IAAQ;EAACC,EAAI,YAAY;EAAG;EAAgBC,EAAM;CAAI;CAC5D,KAAK,IAAM,CAACC,GAAKT,MAAU,OAAO,QAAQQ,CAAK,GAAG;EAChD,IAAIC,MAAQ,UAAUT,KAAiC,MAAM;EAC7D,IAAMU,IAAO,OAAOV,CAAK;EACzB,EAAM,KAAK,GAAGS,EAAI,GAAG,SAAS,KAAKC,CAAI,IAAI,KAAK,UAAUA,CAAI,IAAIA,GAAM;CAC1E;CACA,OAAOJ,EAAM,KAAK,GAAG;AACvB;AAEA,SAASK,EAAe,GAA4D;CAClF,QAAQ,IAAIN,EAAkBG,CAAK,CAAC;AACtC;AAEA,SAASI,EAAU,GAA2B,GAA0B;CACtE,IAAIZ,MAAU,KAAA,GAAW,OAAOa;CAChC,IAAMC,IAAO,OAAOd,CAAK;CAEzB,QADI,CAAC,OAAO,UAAUc,CAAI,KAAKA,IAAO,KAAKA,IAAO,UAAOjB,EAAK,wBAAwB,GAC/EiB;AACT;AAEA,SAASC,EAAU,GAAqC;CACtD,QAAQf,KAAS,GAAA,CACd,MAAM,GAAG,CAAC,CACV,KAAK,MAAUgB,EAAM,KAAK,CAAC,CAAC,CAC5B,OAAO,OAAO;AACnB;AAEA,SAASC,IAA+B;CACtC,OAAO,IAAI,SAAS,MAAY;EAC9B,IAAMC,UAAe;GAGnB,AAFA1B,EAAQ,IAAI,UAAU0B,CAAM,GAC5B1B,EAAQ,IAAI,WAAW0B,CAAM,GAC7BC,EAAQ;EACV;EAEA,AADA3B,EAAQ,GAAG,UAAU0B,CAAM,GAC3B1B,EAAQ,GAAG,WAAW0B,CAAM;CAC9B,CAAC;AACH;AAEA,eAAsBE,EAAK,GAA+B;CACxD,IAAM,CAACC,GAAS,GAAGC,KAAQC;CAC3B,IAAI,CAACF,KAAWA,MAAY,YAAYA,MAAY,QAAQA,MAAY,QAAQ;EAC9E,QAAQ,IAAI1B,CAAK;EACjB;CACF;CAEA,IAAM,EAAE,WAAQ,mBAAgB6B,EAAU;EACxC,MAAMF;EACN,kBAAkB;EAClB,SAAS;GACP,UAAU;IAAE,MAAM;IAAU,SAAS;GAAsB;GAE3D,YAAY,EAAE,MAAM,SAAS;GAC7B,aAAa;IAAE,MAAM;IAAW,SAAS;GAAM;GAC/C,MAAM;IAAE,MAAM;IAAU,SAAS;GAAY;GAE7C,MAAM,EAAE,MAAM,SAAS;GACvB,KAAK;IAAE,MAAM;IAAW,SAAS;GAAM;GACvC,mBAAmB,EAAE,MAAM,SAAS;GACpC,sBAAsB,EAAE,MAAM,SAAS;GACvC,uBAAuB,EAAE,MAAM,SAAS;GACxC,sBAAsB,EAAE,MAAM,SAAS;GACvC,eAAe,EAAE,MAAM,SAAS;GAChC,cAAc,EAAE,MAAM,SAAS;GAC/B,aAAa,EAAE,MAAM,SAAS;GAC9B,OAAO;IAAE,MAAM;IAAW,SAAS;GAAM;GACzC,qBAAqB,EAAE,MAAM,SAAS;EACxC;CACF,CAAC;CAED,IAAID,MAAY,WAAWI,EAAO,KAAK;EACrC,IAAMC,IAAWD,EAAO,SAAS,KAAK,GAChCE,IAAUpC,EAAK,QAAQkC,EAAO,eAAA,4CAA4C;EAEhF,AADA,QAAQ,IAAI,wCAAwCC,GAAU,GAC9D,QAAQ,IAAI,0CAA0CC,GAAS;EAC/D,IAAMC,IAAY;GAAE,MAAMb,EAAUU,EAAO,aAAa;GAAG,KAAKV,EAAUU,EAAO,YAAY;EAAE;EAC/F,QAAQ,IAAI,8BAA8BxC,EAAgB2C,CAAS,CAAC,CAAC,SAAS;EAE9E,IAAMC,IAAU,MAAMzC,EAAe;GACnC;GACA;GACA;GACA,SAASqC,EAAO,QAAQd,IAAiB,KAAA;EAC3C,CAAC;EAMD,AALA,QAAQ,IAAI,2CAA2CkB,EAAQ,KAAK,GACpE,QAAQ,IAAI,wEAAwE,GACpF,QAAQ,IAAI,uCAAuC,GACnD,MAAMZ,EAAc,GACpB,MAAMY,EAAQ,MAAM,GACpB,QAAQ,IAAI,qCAAqC;CAEnD,OAEA,IAAIR,MAAY,SAAS;EACvB,IAAMK,IAAWD,EAAO,SAAS,KAAK,GAChCE,IAAUpC,EAAK,QAAQkC,EAAO,eAAehC,CAAyB;EAE5E,AADA,QAAQ,IAAI,4CAA4CiC,GAAU,GAClE,QAAQ,IAAI,sCAAsCC,GAAS;EAC3D,IAAMC,IAAY;GAAE,MAAMb,EAAUU,EAAO,aAAa;GAAG,KAAKV,EAAUU,EAAO,YAAY;EAAE;EAC/F,QAAQ,IAAI,8BAA8BxC,EAAgB2C,CAAS,CAAC,CAAC,SAAS;EAE9E,IAAMC,IAAU,MAAM1C,EAAY;GAChC;GACA;GACA;GACA,SAASsC,EAAO,QAAQd,IAAiB,KAAA;GACzC,iBAAiBc,EAAO,oBAAoB,EAAE,KAAK,KAAK,KAAA;GACxD,mBAAmB1B,EAAQ0B,EAAO,wBAAwB,uBAAuB;EACnF,CAAC;EAMD,AALA,QAAQ,IAAI,uCAAuCI,EAAQ,KAAK,GAChE,QAAQ,IAAI,kEAAkE,GAC9E,QAAQ,IAAI,uCAAuC,GACnD,MAAMZ,EAAc,GACpB,MAAMY,EAAQ,MAAM,GACpB,QAAQ,IAAI,yCAAyC;CAEvD,OAEA,IAAIR,MAAY,WAAW;EACzB,IAAMM,IAAUF,EAAO,cAAclC,EAAK,QAAQkC,EAAO,WAAW,IAAI,KAAA;EACxE,IAAIA,EAAO,cAAc;GAEvB,AADKE,KAAS9B,EAAK,iCAAiC,GACpD,QAAQ,IAAIb,EAA4B2C,CAAO,CAAC,CAAC,GAAG;GACpD;EACF;EAEA,IAAMlB,IAAMqB,EAAY;EACxB,AAAKrB,KAAKZ,EAAK,mEAAmE;EAClF,IAAMkC,IAAmBhC,EAAQ0B,EAAO,uBAAuB,sBAAsB;EAErF,IAAIA,EAAO,KAAK;GACd,QAAQ,IAAI,8CAA8ChB,GAAK;GAC/D,IAAMoB,IAAU,MAAM3C,EAAiB;IACrC;IACA;IACA,MAAMuC,EAAO;IACb,MAAMb,EAAUa,EAAO,MAAM7B,CAAgB;IAC7C,gBAAgBO,EAAWsB,EAAO,oBAAoB,mBAAmB;IACzE;IACA,SAASA,EAAO,QAAQd,IAAiB,KAAA;GAC3C,CAAC;GAQD,AAPA,QAAQ,IACN,qCAAqCkB,EAAQ,YAAYF,IAAU,KAAK,uBAC1E,GACA,QAAQ,IAAI,2CAA2CE,EAAQ,KAAK,GAAGA,EAAQ,MAAM,GACrF,QAAQ,IAAI,uCAAuC,GACnD,MAAMZ,EAAc,GACpB,MAAMY,EAAQ,MAAM,GACpB,QAAQ,IAAI,4CAA4C;GACxD;EACF;EAEA,QAAQ,IAAI,0CAA0CpB,GAAK;EAC3D,IAAMoB,IAAU,MAAMvC,EAAc;GAClC;GACA;GACA,MAAMmC,EAAO;GACb,MAAMb,EAAUa,EAAO,MAAM/B,CAAY;GACzC;GACA,kBAAkBK,EAAQ0B,EAAO,uBAAuB,sBAAsB;GAC9E,YAAYtB,EAAWsB,EAAO,gBAAgB,eAAe;EAC/D,CAAC;EAWD,AAVA,QAAQ,IACN,qCAAqCI,EAAQ,YAAYF,IAAU,KAAK,uBAC1E,GACA,QAAQ,IAAI,kCAAkCE,EAAQ,SAAS,GAC/D,QAAQ,IACN,8FACF,GACA,QAAQ,IAAI,uCAAuC,GACnD,MAAMZ,EAAc,GACpB,MAAMY,EAAQ,MAAM,GACpB,QAAQ,IAAI,0CAA0C;CAExD,OAEA,EAAK,oBAAoBR,GAAS;AACpC;;;AC7PAD,EAAK5B,EAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,MAAQ;CAEzC,AADA,QAAQ,MAAM,mBAAmBwC,aAAe,QAAQA,EAAI,UAAUA,CAAG,GACzExC,EAAQ,KAAK,CAAC;AAChB,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,5 @@
+import { type RawClientEvent, type RawTunnelEvent, type TunnelEvent } from './index';
+/** One `tunnel-trace` line per event: ISO time, event name, then `key=value` fields. */
+export declare function formatTunnelEvent(event: TunnelEvent | RawTunnelEvent | RawClientEvent, now?: Date): string;
+export declare function main(argv: string[]): Promise<void>;
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAMA,OAAO,EASL,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,WAAW,EACjB,MAAM,SAAS,CAAA;AA4DhB,wFAAwF;AACxF,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,WAAW,GAAG,cAAc,GAAG,cAAc,EACpD,GAAG,OAAa,GACf,MAAM,CAQR;AAgCD,wBAAsB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA0IxD"}

package/dist/index.d.ts

@@ -1,13 +1,19 @@
 export { encodePublicKeyZ32, decodePublicKey, loadOrCreateOperatorKeypair } from './keys';
 export { serveTunnel } from './tunnel/serve';
+export { createAllowlist } from './tunnel/allowlist';
+export { serveRawTunnel, DEFAULT_RAW_OPERATOR_KEY_FILE } from './tunnel/rawServe';
+export { connectRawTunnel, DEFAULT_MAX_RAW_CONNECTIONS, DEFAULT_RAW_PORT, } from './tunnel/rawConnect';
+export { RAW_CLOSE_GRACE_MS } from './tunnel/rawPipe';
+export type { RawClientEvent, RawClientEventListener, RawTunnelEvent, RawTunnelEventListener, TunnelEvent, TunnelEventListener, TunnelEventName, UpstreamPhase, } from './tunnel/events';
+export type { Allowlist, AllowlistOptions, AllowlistStream, AllowlistVerdict, AllowedBy, } from './tunnel/allowlist';
 export { connectTunnel, localGatewayUrl } from './tunnel/connect';
 export { createGatewayProxy } from './tunnel/proxyApp';
 export { stripMountPath } from './tunnel/mountPath';
 export { createTunnelSession, DEFAULT_CONNECT_TIMEOUT_MS, DEFAULT_MAX_STREAMS, DEFAULT_REQUEST_TIMEOUT_MS, } from './tunnel/session';
 export type { TunnelRequestOptions, TunnelSession, TunnelSessionOptions } from './tunnel/session';
-export { DEFAULT_UPSTREAM_TIMEOUT_MS } from './tunnel/proxy';
+export { DEFAULT_UPSTREAM_TIMEOUT_MS, upstreamRequestHeaders } from './tunnel/proxy';
 export { TunnelConnectTimeoutError, TunnelTimeoutError, UpstreamTimeoutError, } from './tunnel/errors';
 export { writeFrame, readFrame, writeTunnelRequest, readTunnelRequest, writeTunnelResponse, readTunnelResponse, flattenRequestHeaders, filterResponseHeaders, MAX_FRAME_BYTES, } from './tunnel/protocol';
-export type { TunnelMeta, TunnelResponseMeta, ServeTunnelOptions, ServeTunnelResult, ConnectTunnelOptions, ConnectTunnelResult, OperatorKeyPair, CreateGatewayProxyOptions, GatewayProxy, } from './types';
+export type { DhtBootstrapNode, TunnelMeta, TunnelResponseMeta, ServeTunnelOptions, ServeTunnelResult, ConnectTunnelOptions, ConnectTunnelResult, ServeRawTunnelOptions, ServeRawTunnelResult, ConnectRawTunnelOptions, ConnectRawTunnelResult, OperatorKeyPair, CreateGatewayProxyOptions, GatewayProxy, } from './types';
 export { DEFAULT_SEED_GATEWAY_HYPER_KEY } from './constants';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,2BAA2B,EAAE,MAAM,QAAQ,CAAA;AAEzF,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,oBAAoB,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AACjG,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAA;AAC5D,OAAO,EACL,yBAAyB,EACzB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,iBAAiB,CAAA;AAExB,OAAO,EACL,UAAU,EACV,SAAS,EACT,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,GAChB,MAAM,mBAAmB,CAAA;AAE1B,YAAY,EACV,UAAU,EACV,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,eAAe,EACf,yBAAyB,EACzB,YAAY,GACb,MAAM,SAAS,CAAA;AAEhB,OAAO,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,2BAA2B,EAAE,MAAM,QAAQ,CAAA;AAEzF,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,cAAc,EAAE,6BAA6B,EAAE,MAAM,mBAAmB,CAAA;AACjF,OAAO,EACL,gBAAgB,EAChB,2BAA2B,EAC3B,gBAAgB,GACjB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,YAAY,EACV,cAAc,EACd,sBAAsB,EACtB,cAAc,EACd,sBAAsB,EACtB,WAAW,EACX,mBAAmB,EACnB,eAAe,EACf,aAAa,GACd,MAAM,iBAAiB,CAAA;AACxB,YAAY,EACV,SAAS,EACT,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,SAAS,GACV,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,oBAAoB,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AACjG,OAAO,EAAE,2BAA2B,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AACpF,OAAO,EACL,yBAAyB,EACzB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,iBAAiB,CAAA;AAExB,OAAO,EACL,UAAU,EACV,SAAS,EACT,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,GAChB,MAAM,mBAAmB,CAAA;AAE1B,YAAY,EACV,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,eAAe,EACf,yBAAyB,EACzB,YAAY,GACb,MAAM,SAAS,CAAA;AAEhB,OAAO,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAA"}

package/dist/index.js

@@ -1 +1 @@
-export { a as DEFAULT_CONNECT_TIMEOUT_MS, o as DEFAULT_MAX_STREAMS, s as DEFAULT_REQUEST_TIMEOUT_MS, t as DEFAULT_SEED_GATEWAY_HYPER_KEY, d as DEFAULT_UPSTREAM_TIMEOUT_MS, h as MAX_FRAME_BYTES, f as TunnelConnectTimeoutError, p as TunnelTimeoutError, m as UpstreamTimeoutError, r as connectTunnel, n as createGatewayProxy, c as createTunnelSession, w as decodePublicKey, T as encodePublicKeyZ32, g as filterResponseHeaders, _ as flattenRequestHeaders, E as loadOrCreateOperatorKeypair, i as localGatewayUrl, v as readFrame, y as readTunnelRequest, b as readTunnelResponse, u as serveTunnel, l as stripMountPath, x as writeFrame, S as writeTunnelRequest, C as writeTunnelResponse } from "./src-qIlmrs1H.js";
+export { l as DEFAULT_CONNECT_TIMEOUT_MS, o as DEFAULT_MAX_RAW_CONNECTIONS, u as DEFAULT_MAX_STREAMS, p as DEFAULT_RAW_OPERATOR_KEY_FILE, s as DEFAULT_RAW_PORT, d as DEFAULT_REQUEST_TIMEOUT_MS, t as DEFAULT_SEED_GATEWAY_HYPER_KEY, v as DEFAULT_UPSTREAM_TIMEOUT_MS, C as MAX_FRAME_BYTES, h as RAW_CLOSE_GRACE_MS, b as TunnelConnectTimeoutError, x as TunnelTimeoutError, S as UpstreamTimeoutError, c as connectRawTunnel, r as connectTunnel, _ as createAllowlist, n as createGatewayProxy, f as createTunnelSession, M as decodePublicKey, N as encodePublicKeyZ32, w as filterResponseHeaders, T as flattenRequestHeaders, P as loadOrCreateOperatorKeypair, i as localGatewayUrl, E as readFrame, D as readTunnelRequest, O as readTunnelResponse, m as serveRawTunnel, g as serveTunnel, a as stripMountPath, y as upstreamRequestHeaders, k as writeFrame, A as writeTunnelRequest, j as writeTunnelResponse } from "./src-DHEkxp5F.js";

package/dist/keys.d.ts

@@ -7,5 +7,21 @@ export interface PersistedKeyFile {
 export declare function encodePublicKeyZ32(publicKey: Buffer): string;
 export declare function decodePublicKey(key: string): Buffer;
 export declare function loadOrCreateOperatorKeypair(keyFile: string): OperatorKeyPair;
+/** Check a keypair passed in code and add its z32 key. */
+export declare function toOperatorKeypair(keyPair: {
+    publicKey: Buffer;
+    secretKey: Buffer;
+}): OperatorKeyPair;
+/**
+ * The keypair a client presents to the operator: `keyPair` if given, else the one in
+ * `keyFile` (created on first use), else a new one for this run only.
+ */
+export declare function resolveClientKeypair(options: {
+    keyFile?: string;
+    keyPair?: {
+        publicKey: Buffer;
+        secretKey: Buffer;
+    };
+}): OperatorKeyPair;
 export declare function createEphemeralClientKeypair(): OperatorKeyPair;
 //# sourceMappingURL=keys.d.ts.map

package/dist/keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAE9C,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,KAAK,CAAA;CAChB;AAUD,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAanD;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,CA+B5E;AAED,wBAAgB,4BAA4B,IAAI,eAAe,CAO9D"}
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAE9C,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,KAAK,CAAA;CAChB;AAUD,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAanD;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,CA+B5E;AAED,0DAA0D;AAC1D,wBAAgB,iBAAiB,CAAC,OAAO,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,eAAe,CAUpG;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAA;CACnD,GAAG,eAAe,CAOlB;AAED,wBAAgB,4BAA4B,IAAI,eAAe,CAO9D"}