@seedprotocol/gateway-hyper 0.7.10-next.1353.g74aeeed → 0.7.10

package/dist/src-DHEkxp5F.js

@@ -0,0 +1,943 @@
+import e from "node:fs";
+import t from "node:path";
+import n from "hyperdht";
+import r from "hypercore-id-encoding";
+import i from "node:http";
+import { URL as a } from "node:url";
+import o from "node:net";
+//#region src/keys.ts
+function s(e) {
+	return e.toString("hex");
+}
+function c(e) {
+	return Buffer.from(e, "hex");
+}
+function l(e) {
+	return r.encode(e);
+}
+function u(e) {
+	let t = e.trim();
+	if (!t) throw Error("Gateway Hyper key is empty");
+	try {
+		return Buffer.from(r.decode(t));
+	} catch {
+		if (/^[a-fA-F0-9]{64}$/.test(t)) return c(t);
+		throw Error(`Invalid Gateway Hyper key (expected z32 or 64-char hex): ${t.slice(0, 12)}…`);
+	}
+}
+function d(r) {
+	let i = t.resolve(r);
+	if (e.existsSync(i)) {
+		let t = e.readFileSync(i, "utf8"), n = JSON.parse(t);
+		if (!n.publicKey || !n.secretKey) throw Error(`Invalid key file at ${i}: missing publicKey or secretKey`);
+		let r = c(n.publicKey);
+		return {
+			publicKey: r,
+			secretKey: c(n.secretKey),
+			z32: l(r)
+		};
+	}
+	let a = t.dirname(i);
+	e.mkdirSync(a, { recursive: !0 });
+	let o = n.keyPair(), u = {
+		publicKey: s(o.publicKey),
+		secretKey: s(o.secretKey),
+		encoding: "hex"
+	};
+	return e.writeFileSync(i, `${JSON.stringify(u, null, 2)}\n`, { mode: 384 }), {
+		publicKey: o.publicKey,
+		secretKey: o.secretKey,
+		z32: l(o.publicKey)
+	};
+}
+function f(e) {
+	let { publicKey: t, secretKey: n } = e;
+	if (t?.length !== 32 || n?.length !== 64) throw Error("Invalid keyPair: expected a 32-byte publicKey and a 64-byte secretKey");
+	if (!Buffer.from(n.subarray(32)).equals(Buffer.from(t))) throw Error("Invalid keyPair: publicKey does not belong to secretKey");
+	return {
+		publicKey: t,
+		secretKey: n,
+		z32: l(t)
+	};
+}
+function p(e) {
+	if (e.keyFile && e.keyPair) throw Error("Pass keyFile or keyPair, not both");
+	return e.keyPair ? f(e.keyPair) : e.keyFile ? d(e.keyFile) : m();
+}
+function m() {
+	let e = n.keyPair();
+	return {
+		publicKey: e.publicKey,
+		secretKey: e.secretKey,
+		z32: l(e.publicKey)
+	};
+}
+//#endregion
+//#region src/tunnel/protocol.ts
+var h = 67108864, g = 1048576, _ = class {
+	buffer = Buffer.alloc(0);
+	waiters = [];
+	failure = null;
+	constructor(e) {
+		e.on("data", (e) => {
+			this.buffer = Buffer.concat([this.buffer, e]), this.drain();
+		}), e.on("error", (e) => this.fail(e)), e.on("end", () => this.fail(/* @__PURE__ */ Error("Unexpected end of stream"))), e.on("close", () => this.fail(/* @__PURE__ */ Error("Stream closed")));
+	}
+	readExact(e) {
+		return new Promise((t, n) => {
+			e === 0 ? t(Buffer.alloc(0)) : (this.waiters.push({
+				length: e,
+				resolve: t,
+				reject: n
+			}), this.drain(), this.rejectWaiters());
+		});
+	}
+	fail(e) {
+		this.failure ??= e, this.drain(), this.rejectWaiters();
+	}
+	rejectWaiters() {
+		if (!this.failure || this.waiters.length === 0) return;
+		let e = this.waiters.splice(0);
+		for (let t of e) t.reject(/* @__PURE__ */ Error(`${this.failure.message} (expected ${t.length} bytes, got ${this.buffer.length})`));
+	}
+	drain() {
+		for (; this.waiters.length > 0;) {
+			let e = this.waiters[0];
+			if (!e || this.buffer.length < e.length) break;
+			this.waiters.shift();
+			let t = this.buffer.subarray(0, e.length);
+			this.buffer = this.buffer.subarray(e.length), e.resolve(t);
+		}
+	}
+}, v = /* @__PURE__ */ new WeakMap();
+function y(e) {
+	let t = v.get(e);
+	return t || (t = new _(e), v.set(e, t)), t;
+}
+function b(e, t) {
+	return y(e).readExact(t);
+}
+function x(e, t) {
+	return new Promise((n, r) => {
+		if (e.destroyed) r(/* @__PURE__ */ Error("Stream closed"));
+		else try {
+			if (e.write(t)) {
+				n();
+				return;
+			}
+			let i = () => {
+				e.off("drain", a), e.off("error", o), e.off("close", s);
+			}, a = () => {
+				i(), n();
+			}, o = (e) => {
+				i(), r(e);
+			}, s = () => {
+				i(), r(/* @__PURE__ */ Error("Stream closed"));
+			};
+			e.once("drain", a), e.once("error", o), e.once("close", s);
+		} catch (e) {
+			r(e instanceof Error ? e : Error(String(e)));
+		}
+	});
+}
+function S(e) {
+	if (e > 67108864) throw Error(`Frame too large: ${e} bytes (max ${h})`);
+}
+async function C(e, t) {
+	S(t.length);
+	let n = Buffer.alloc(4);
+	n.writeUInt32BE(t.length, 0);
+	let r = t.subarray(0, g);
+	await x(e, Buffer.concat([n, r]));
+	for (let n = r.length; n < t.length; n += g) await x(e, t.subarray(n, n + g));
+}
+async function w(e) {
+	let t = (await b(e, 4)).readUInt32BE(0);
+	return t === 0 ? Buffer.alloc(0) : (S(t), b(e, t));
+}
+async function T(e, t, n) {
+	S(n.length), await C(e, Buffer.from(JSON.stringify(t), "utf8")), await C(e, n);
+}
+async function E(e) {
+	let t = await w(e), n = JSON.parse(t.toString("utf8"));
+	if (!n.method || !n.path) throw Error("Invalid tunnel request meta: missing method or path");
+	return n.headers = n.headers ?? {}, {
+		meta: n,
+		body: await w(e)
+	};
+}
+async function D(e, t, n) {
+	S(n.length), await C(e, Buffer.from(JSON.stringify(t), "utf8")), await C(e, n);
+}
+async function O(e) {
+	let t = await w(e), n = JSON.parse(t.toString("utf8"));
+	if (typeof n.status != "number") throw Error("Invalid tunnel response meta: missing status");
+	return n.headers = n.headers ?? {}, {
+		meta: n,
+		body: await w(e)
+	};
+}
+function k(e) {
+	let t = {};
+	for (let [n, r] of Object.entries(e)) r != null && (t[n] = Array.isArray(r) ? r.join(", ") : r);
+	return t;
+}
+function A(e) {
+	let t = /* @__PURE__ */ new Set([
+		"connection",
+		"keep-alive",
+		"transfer-encoding",
+		"upgrade"
+	]), n = {};
+	for (let [r, i] of Object.entries(e)) t.has(r.toLowerCase()) || i != null && (n[r] = Array.isArray(i) ? i.join(", ") : i);
+	return n;
+}
+//#endregion
+//#region src/tunnel/errors.ts
+var j = class extends Error {
+	timeoutMs;
+	code = "TUNNEL_TIMEOUT";
+	constructor(e) {
+		super(`No bytes sent or received on the tunnel for ${e} ms`), this.timeoutMs = e, this.name = "TunnelTimeoutError";
+	}
+}, M = class extends Error {
+	timeoutMs;
+	code = "TUNNEL_CONNECT_TIMEOUT";
+	constructor(e) {
+		super(`Could not connect to the operator within ${e} ms`), this.timeoutMs = e, this.name = "TunnelConnectTimeoutError";
+	}
+}, N = class extends Error {
+	timeoutMs;
+	code = "UPSTREAM_TIMEOUT";
+	constructor(e) {
+		super(`No response from upstream for ${e} ms`), this.timeoutMs = e, this.name = "UpstreamTimeoutError";
+	}
+}, ee = 3e4;
+function te(e, t) {
+	if (!t) return e;
+	let n = new Set(Object.keys(t).map((e) => e.toLowerCase())), r = {};
+	for (let [t, i] of Object.entries(e)) n.has(t.toLowerCase()) || (r[t] = i);
+	return {
+		...r,
+		...t
+	};
+}
+var ne = /* @__PURE__ */ new Set([
+	"connection",
+	"keep-alive",
+	"proxy-connection",
+	"te",
+	"trailer",
+	"transfer-encoding",
+	"upgrade"
+]);
+function P(e) {
+	let t = new Set((Object.entries(e).find(([e]) => e.toLowerCase() === "connection")?.[1] ?? "").split(",").map((e) => e.trim().toLowerCase()).filter(Boolean)), n = {}, r;
+	for (let [i, a] of Object.entries(e)) {
+		let e = i.toLowerCase();
+		e === "host" ? r = a : e === "content-length" || ne.has(e) || t.has(e) || (n[i] = a);
+	}
+	return r && !Object.keys(n).some((e) => e.toLowerCase() === "x-forwarded-host") && (n["x-forwarded-host"] = r), n;
+}
+async function re(e, t, n, r = {}) {
+	let o = e.replace(/\/$/, ""), s = new a(t.path, `${o}/`), c = r.timeoutMs ?? 3e4, { observer: l } = r;
+	return new Promise((e, a) => {
+		l?.onPhase?.("send");
+		let o = i.request(s, {
+			method: t.method,
+			headers: te(P(t.headers), r.extraHeaders),
+			signal: r.signal
+		}, (t) => {
+			l && (l.onPhase?.("body"), l.onResponse?.(t.statusCode ?? 502));
+			let n = [], r = 0;
+			t.on("data", (e) => {
+				r += e.length, r > 67108864 ? o.destroy(/* @__PURE__ */ Error(`Upstream response exceeds ${h} bytes, the tunnel's limit`)) : n.push(e);
+			}), t.on("end", () => {
+				l?.onDone?.(t.statusCode ?? 502, r), e({
+					status: t.statusCode ?? 502,
+					headers: A(t.headers),
+					body: Buffer.concat(n)
+				});
+			}), t.on("error", a);
+		});
+		c > 0 && o.setTimeout(c, () => o.destroy(new N(c))), o.on("error", a), l?.onPhase && o.once("finish", () => l.onPhase?.("wait")), n.length > 0 ? o.end(n) : o.end();
+	});
+}
+//#endregion
+//#region src/tunnel/allowlist.ts
+function F(e) {
+	return o.isIPv4(e) ? "ipv4" : o.isIPv6(e) ? "ipv6" : null;
+}
+function ie(e) {
+	let t = new o.BlockList();
+	for (let n of e) {
+		let [e = "", r, i] = n.split("/"), a = F(e);
+		if (!a || i !== void 0) throw Error(`Invalid allowlist IP (expected an address or CIDR): ${n}`);
+		if (r === void 0) {
+			t.addAddress(e, a);
+			continue;
+		}
+		let o = Number(r), s = a === "ipv4" ? 32 : 128;
+		if (!/^\d+$/.test(r) || o > s) throw Error(`Invalid allowlist CIDR prefix (expected 0–${s}): ${n}`);
+		t.addSubnet(e, o, a);
+	}
+	return t;
+}
+function ae(e) {
+	let t = /* @__PURE__ */ new Set();
+	for (let n of e) t.add(u(n).toString("hex"));
+	return t;
+}
+function I(e) {
+	if (!e) return null;
+	let t = e.toLowerCase().startsWith("::ffff:") ? e.slice(7) : null;
+	return t && o.isIPv4(t) ? t : e;
+}
+function L(e) {
+	return (e ?? []).map((e) => e.trim()).filter(Boolean);
+}
+function R(e = {}) {
+	let t = L(e.keys), n = L(e.ips), r = ae(t), i = ie(n), a = r.size > 0 || n.length > 0, o = (e) => e != null && r.has(Buffer.from(e).toString("hex")), s = (e) => {
+		if (!e) return !1;
+		let t = F(e);
+		return t !== null && i.check(e, t);
+	};
+	return {
+		enabled: a,
+		summary: a ? `keys=${r.size} ips=${n.join(",") || "none"}` : "off",
+		firewall: (e) => !a || n.length > 0 ? !1 : !o(e),
+		check: (e) => {
+			let t = I(e.rawStream?.remoteHost);
+			return a ? o(e.remotePublicKey) ? {
+				ok: !0,
+				host: t,
+				by: "key"
+			} : s(t) ? {
+				ok: !0,
+				host: t,
+				by: "ip"
+			} : {
+				ok: !1,
+				host: t,
+				by: "none"
+			} : {
+				ok: !0,
+				host: t,
+				by: "open"
+			};
+		}
+	};
+}
+//#endregion
+//#region src/tunnel/events.ts
+function z(e) {
+	if (e) return (t) => {
+		try {
+			e(t);
+		} catch {}
+	};
+}
+function B(e) {
+	let t = e instanceof Error ? e.message : String(e), n = e?.code;
+	return typeof n == "string" ? {
+		error: t,
+		code: n
+	} : { error: t };
+}
+function V() {
+	let e = Date.now().toString(36), t = 0, n = 0;
+	return {
+		stream: () => `s${++t}`,
+		request: () => `${e}-r${++n}`
+	};
+}
+//#endregion
+//#region src/tunnel/serve.ts
+function H(e, t) {
+	return {
+		status: e,
+		headers: { "content-type": "text/plain; charset=utf-8" },
+		body: Buffer.from(t, "utf8")
+	};
+}
+async function oe(e, t, n = {}) {
+	let r = z(n.onEvent), { requestIdHeader: i } = n, a = n.streamId ?? "s0", o = r || i ? n.nextRequestId ?? V().request : null, s = new AbortController(), c = () => s.abort();
+	e.once("end", c), e.once("close", c), e.on("error", c);
+	let l = performance.now(), u = 0, d = 0, f = null, p = null;
+	r && (e.on("data", (e) => {
+		d += e.length, f ??= performance.now();
+	}), e.on("error", (e) => r({
+		name: "stream.error",
+		stream: a,
+		...B(e)
+	})), e.once("close", () => r({
+		name: "stream.close",
+		stream: a,
+		requests: u,
+		bytesIn: d,
+		durationMs: Math.round(performance.now() - l),
+		inflight: p
+	})));
+	let m = E(e);
+	try {
+		for (;;) {
+			let { meta: c, body: l } = await m, d = o?.() ?? null, h = f ?? performance.now();
+			f = null;
+			let g = 0, _ = "send";
+			r && d && (u++, p = d, r({
+				name: "req.recv",
+				request: d,
+				stream: a,
+				method: c.method,
+				path: c.path,
+				bodyBytes: l.length,
+				receiveMs: Math.round(performance.now() - h)
+			}), g = performance.now());
+			let v = () => Math.round(performance.now() - g), y;
+			try {
+				y = await re(t, c, l, {
+					timeoutMs: n.upstreamTimeoutMs,
+					signal: s.signal,
+					extraHeaders: i && d ? { [i]: d } : void 0,
+					observer: r && d ? {
+						onPhase: (e) => {
+							(e !== "wait" || _ !== "body") && (_ = e);
+						},
+						onResponse: (e) => r({
+							name: "up.response",
+							request: d,
+							status: e,
+							upstreamMs: v()
+						}),
+						onDone: (e, t) => r({
+							name: "up.done",
+							request: d,
+							status: e,
+							bytes: t,
+							upstreamMs: v()
+						})
+					} : void 0
+				});
+			} catch (e) {
+				if (r && d && r(e instanceof N && !s.signal.aborted ? {
+					name: "up.timeout",
+					request: d,
+					phase: _,
+					timeoutMs: e.timeoutMs
+				} : {
+					name: "up.error",
+					request: d,
+					phase: _,
+					...B(e),
+					aborted: s.signal.aborted
+				}), s.signal.aborted) return;
+				let t = e instanceof Error ? e.message : String(e);
+				y = e instanceof N ? H(504, `Gateway Hyper upstream timeout: ${t}`) : H(502, `Gateway Hyper upstream error: ${t}`);
+			}
+			await D(e, {
+				status: y.status,
+				headers: y.headers
+			}, y.body), r && d && (p = null, r({
+				name: "res.sent",
+				request: d,
+				status: y.status,
+				bytes: y.body.length,
+				totalMs: Math.round(performance.now() - h)
+			})), m = E(e);
+		}
+	} catch {
+		e.destroy();
+	}
+}
+async function se(e) {
+	let t = e.upstream.replace(/\/$/, ""), r = e.keyFile ?? ".seed/gateway-tunnel/operator.key.json", i = R(e.allowlist), a = d(r), o = z(e.onEvent), s = V(), c = new n(e.bootstrap ? { bootstrap: e.bootstrap } : {}), u = c.createServer({ firewall: (e) => {
+		let t = i.firewall(e);
+		return t && o && o({
+			name: "stream.refused",
+			remoteKey: l(e),
+			stage: "handshake",
+			host: null
+		}), t;
+	} }, (n) => {
+		let r = i.check(n);
+		if (!r.ok) {
+			o?.({
+				name: "stream.refused",
+				remoteKey: l(n.remotePublicKey),
+				stage: "connection",
+				host: r.host
+			}), n.on("error", () => {}), n.destroy();
+			return;
+		}
+		let a = s.stream();
+		o?.({
+			name: "stream.open",
+			stream: a,
+			remoteKey: l(n.remotePublicKey),
+			host: r.host,
+			by: r.by
+		}), oe(n, t, {
+			upstreamTimeoutMs: e.upstreamTimeoutMs,
+			onEvent: e.onEvent,
+			requestIdHeader: e.requestIdHeader,
+			streamId: a,
+			nextRequestId: s.request
+		});
+	});
+	return await u.listen(a), {
+		key: a.z32,
+		upstream: t,
+		close: async () => {
+			await u.close(), await c.destroy();
+		}
+	};
+}
+//#endregion
+//#region src/tunnel/rawPipe.ts
+var ce = 3e4;
+function U(e, t) {
+	let n = t?.code, r = t instanceof Error ? t.message : String(t);
+	return `${e}:${typeof n == "string" ? n : r}`;
+}
+function W(e, t, n = {}) {
+	let r = n.graceMs ?? 3e4, i = performance.now(), a = null, o = 0;
+	e.on("data", (n) => {
+		t.write(n) || e.pause();
+	}), t.on("drain", () => e.resume()), e.on("end", () => t.end()), t.pipe(e), e.on("error", (e) => {
+		a ??= U("hyper", e);
+	}), t.on("error", (e) => {
+		a ??= U("tcp", e);
+	});
+	let s = (e) => () => {
+		e.destroyed || (a ? e.destroy() : (e.end(), setTimeout(() => e.destroy(), r).unref()));
+	}, c = () => {
+		++o < 2 || n.onClose?.({
+			tcpBytesRead: t.bytesRead,
+			tcpBytesWritten: t.bytesWritten,
+			durationMs: Math.round(performance.now() - i),
+			error: a
+		});
+	};
+	return e.on("close", s(t)), t.on("close", s(e)), e.on("close", c), t.on("close", c), { fail: (e) => {
+		a ??= e;
+	} };
+}
+//#endregion
+//#region src/tunnel/rawServe.ts
+var le = ".seed/gateway-tunnel/raw-operator.key.json";
+function ue(e) {
+	let t = e.trim(), n = new URL(/^[a-z][a-z0-9+.-]*:\/\//i.test(t) ? t : `tcp://${t}`), r = n.protocol === "http:" ? 80 : n.protocol === "https:" ? 443 : NaN, i = n.port ? Number(n.port) : r, a = n.hostname.replace(/^\[(.*)\]$/, "$1");
+	if (!a || !Number.isInteger(i)) throw Error(`Invalid raw upstream (expected http://host:port or host:port): ${e}`);
+	return {
+		host: a,
+		port: i
+	};
+}
+async function G(e) {
+	let t = ue(e.upstream), r = R(e.allowlist), i = e.keyPair ? f(e.keyPair) : d(e.keyFile ?? ".seed/gateway-tunnel/raw-operator.key.json"), a = z(e.onEvent), s = /* @__PURE__ */ new Set(), c = 0, u = new n(e.bootstrap ? { bootstrap: e.bootstrap } : {}), p = u.createServer({ firewall: (e) => {
+		let t = r.firewall(e);
+		return t && a && a({
+			name: "stream.refused",
+			remoteKey: l(e),
+			stage: "handshake",
+			host: null
+		}), t;
+	} }, (n) => {
+		let i = r.check(n);
+		if (!i.ok) {
+			a?.({
+				name: "stream.refused",
+				remoteKey: l(n.remotePublicKey),
+				stage: "connection",
+				host: i.host
+			}), n.on("error", () => {}), n.destroy();
+			return;
+		}
+		let u = `c${++c}`;
+		a?.({
+			name: "conn.open",
+			conn: u,
+			remoteKey: l(n.remotePublicKey),
+			host: i.host,
+			by: i.by
+		});
+		let d = o.connect({
+			host: t.host,
+			port: t.port,
+			allowHalfOpen: !0
+		});
+		d.setNoDelay(!0), s.add(n), s.add(d), W(n, d, {
+			graceMs: e.closeGraceMs,
+			onClose: (e) => {
+				s.delete(n), s.delete(d), a?.({
+					name: "conn.close",
+					conn: u,
+					bytesUp: e.tcpBytesWritten,
+					bytesDown: e.tcpBytesRead,
+					durationMs: e.durationMs,
+					error: e.error
+				});
+			}
+		});
+	});
+	return await p.listen(i), {
+		key: i.z32,
+		upstream: `${t.host}:${t.port}`,
+		close: async () => {
+			for (let e of s) e.destroy();
+			await p.close(), await u.destroy();
+		}
+	};
+}
+//#endregion
+//#region src/tunnel/session.ts
+var K = 6e4, de = 3e4, fe = 4;
+function q(e) {
+	let t = e.reason;
+	if (t instanceof Error) return t;
+	let n = /* @__PURE__ */ Error("The request was aborted");
+	return n.name = "AbortError", n;
+}
+function pe(e, t) {
+	return t.aborted ? Promise.reject(q(t)) : new Promise((n, r) => {
+		let i = () => r(q(t));
+		t.addEventListener("abort", i, { once: !0 }), e.then((e) => {
+			t.removeEventListener("abort", i), n(e);
+		}, (e) => {
+			t.removeEventListener("abort", i), r(e);
+		});
+	});
+}
+function me(e, t = K) {
+	let n = async (n, r) => {
+		let { signal: i } = r, a = r.timeoutMs ?? t;
+		if (i?.aborted) throw q(i);
+		let o = await e();
+		if (i?.aborted) throw q(i);
+		return new Promise((e, t) => {
+			let r = !1, s = null, c = () => {
+				a <= 0 || (s && clearTimeout(s), s = setTimeout(() => u(new j(a)), a));
+			}, l = () => {
+				s && clearTimeout(s), o.off("data", c), o.off("drain", c), i?.removeEventListener("abort", d);
+			}, u = (e) => {
+				r || (r = !0, l(), o.destroy(), t(e));
+			}, d = () => u(q(i));
+			c(), o.on("data", c), o.on("drain", c), i?.addEventListener("abort", d, { once: !0 }), n(o).then((t) => {
+				r || (r = !0, l(), e(t));
+			}, u);
+		});
+	}, r = Promise.resolve();
+	return (e, t = {}) => {
+		let i = r.then(() => n(e, t));
+		return r = i.catch(() => {}), t.signal ? pe(i, t.signal) : i;
+	};
+}
+function J() {
+	return /* @__PURE__ */ Error("Tunnel session is closed");
+}
+function he(e, t = {}) {
+	let n = Math.max(1, Math.floor(t.maxStreams ?? 4)), r = t.requestTimeoutMs ?? 6e4, i = [], a = [], o = !1, s = () => {
+		let t = {
+			run: null,
+			socket: null,
+			busy: !1
+		};
+		return t.run = me(async () => {
+			if (o) throw J();
+			if (t.socket && !t.socket.destroyed) return t.socket;
+			let n = await e();
+			if (o) throw n.destroy(), J();
+			return t.socket = n, n;
+		}, r), i.push(t), t;
+	}, c = () => {
+		let e = i.filter((e) => !e.busy), t = e.find((e) => e.socket !== null && !e.socket.destroyed) ?? e[0] ?? (i.length < n ? s() : void 0);
+		return t ? (t.busy = !0, t) : null;
+	}, l = (e) => {
+		let t = a.shift();
+		t ? t.resolve(e) : e.busy = !1;
+	}, u = (e) => {
+		let t = c();
+		return t ? Promise.resolve(t) : new Promise((t, n) => {
+			let r = () => {
+				let t = a.indexOf(i);
+				t >= 0 && a.splice(t, 1), n(q(e));
+			}, i = {
+				resolve: (n) => {
+					e?.removeEventListener("abort", r), t(n);
+				},
+				reject: (t) => {
+					e?.removeEventListener("abort", r), n(t);
+				}
+			};
+			a.push(i), e?.addEventListener("abort", r, { once: !0 });
+		});
+	};
+	return {
+		runOnTunnel: async (e, t = {}) => {
+			if (t.signal?.aborted) throw q(t.signal);
+			if (o) throw J();
+			let n = await u(t.signal);
+			try {
+				return await n.run(e, t);
+			} finally {
+				l(n);
+			}
+		},
+		close: () => {
+			o = !0;
+			for (let e of a.splice(0)) e.reject(J());
+			for (let e of i) e.socket?.destroy();
+		}
+	};
+}
+async function Y(e) {
+	let t = u(e.key), r = p(e), i = e.connectTimeoutMs ?? 3e4, a = new n(e.bootstrap ? { bootstrap: e.bootstrap } : {}), o = he(() => new Promise((e, n) => {
+		let o = a.connect(t, { keyPair: {
+			publicKey: r.publicKey,
+			secretKey: r.secretKey
+		} }), s = !1, c = i > 0 ? setTimeout(() => l(new M(i)), i) : null, l = (e) => {
+			s || (s = !0, c && clearTimeout(c), o.destroy(), n(e));
+		}, u = () => {
+			s || (s = !0, c && clearTimeout(c), e(o));
+		};
+		o.on("error", (e) => l(e)), o.once("close", () => l(/* @__PURE__ */ Error("Tunnel connection closed before it opened"))), o.once("open", u), o.once("connect", u);
+	}), {
+		maxStreams: e.maxStreams,
+		requestTimeoutMs: e.requestTimeoutMs
+	}), { runOnTunnel: s } = o;
+	return {
+		key: e.key,
+		clientKey: r.z32,
+		runOnTunnel: s,
+		forwardHttp: async (e, t, n) => s(async (n) => (await T(n, e, t), O(n)), n),
+		close: async () => {
+			o.close(), await a.destroy();
+		}
+	};
+}
+//#endregion
+//#region src/tunnel/rawConnect.ts
+var ge = 1985, _e = 64;
+async function ve(e) {
+	let t = u(e.key), r = p(e), i = e.host ?? "127.0.0.1", a = e.maxConnections ?? 64, s = e.connectTimeoutMs ?? 3e4, c = z(e.onEvent), l = /* @__PURE__ */ new Set(), d = 0, f = new n(e.bootstrap ? { bootstrap: e.bootstrap } : {}), m = o.createServer({ allowHalfOpen: !0 }, (n) => {
+		if (l.size >= a) {
+			c?.({
+				name: "conn.refused",
+				open: l.size,
+				max: a
+			}), n.destroy();
+			return;
+		}
+		let i = `c${++d}`, o = performance.now();
+		l.add(n), n.setNoDelay(!0);
+		let u = f.connect(t, { keyPair: {
+			publicKey: r.publicKey,
+			secretKey: r.secretKey
+		} }), p = null, m = W(u, n, {
+			graceMs: e.closeGraceMs,
+			onClose: (e) => {
+				p && clearTimeout(p), l.delete(n), c?.({
+					name: "conn.close",
+					conn: i,
+					bytesUp: e.tcpBytesRead,
+					bytesDown: e.tcpBytesWritten,
+					durationMs: e.durationMs,
+					error: e.error
+				});
+			}
+		});
+		s > 0 && (p = setTimeout(() => {
+			m.fail("connect-timeout"), u.destroy(new M(s));
+		}, s)), u.once("open", () => {
+			p && clearTimeout(p), c?.({
+				name: "conn.open",
+				conn: i,
+				connectMs: Math.round(performance.now() - o)
+			});
+		});
+	});
+	await new Promise((t, n) => {
+		m.once("error", n), m.listen(e.port ?? 1985, i, () => t());
+	});
+	let h = m.address(), g = h && typeof h == "object" ? h.port : e.port ?? 1985;
+	return {
+		key: e.key,
+		clientKey: r.z32,
+		host: i,
+		port: g,
+		close: async () => {
+			for (let e of l) e.destroy();
+			await new Promise((e) => m.close(() => e())), await f.destroy();
+		}
+	};
+}
+//#endregion
+//#region src/tunnel/mountPath.ts
+function X(e, t) {
+	let n = e || "/", r = n.indexOf("?"), i = r === -1 ? n : n.slice(0, r), a = r === -1 ? "" : n.slice(r), o = (t || "").replace(/\/$/, "");
+	if (!o || o === "/") return `${i.startsWith("/") ? i : `/${i}`}${a}` || "/";
+	if (i === o || i.startsWith(`${o}/`)) {
+		let e = i.slice(o.length);
+		return `${e.startsWith("/") ? e : e ? `/${e}` : "/"}${a}`;
+	}
+	return `${i.startsWith("/") ? i : `/${i}`}${a}`;
+}
+//#endregion
+//#region src/tunnel/forward.ts
+async function ye(e) {
+	let t = [];
+	for await (let n of e) t.push(Buffer.isBuffer(n) ? n : Buffer.from(n));
+	return Buffer.concat(t);
+}
+function Z(e) {
+	return e instanceof j ? 504 : 502;
+}
+function Q(e) {
+	return `Gateway Hyper tunnel error: ${e instanceof Error ? e.message : String(e)}`;
+}
+async function $(e, t, n, r) {
+	let i = new AbortController(), a = () => {
+		n.writableEnded || i.abort();
+	};
+	n.once("close", a);
+	try {
+		let a = await ye(t), o = X(t.url ?? "/", r), s = {
+			method: t.method ?? "GET",
+			path: o,
+			headers: k(t.headers)
+		}, { meta: c, body: l } = await e.forwardHttp(s, a, { signal: i.signal });
+		be(n, c, l);
+	} catch (e) {
+		if (i.signal.aborted) return;
+		n.headersSent || n.writeHead(Z(e), { "Content-Type": "text/plain; charset=utf-8" }), n.end(Q(e));
+	} finally {
+		n.off("close", a);
+	}
+}
+function be(e, t, n) {
+	e.writeHead(t.status, A(t.headers)), e.end(n);
+}
+async function xe(e, t, n) {
+	try {
+		let r = new URL(t.url), i = X(`${r.pathname}${r.search}`, n), a = Buffer.from(await t.arrayBuffer()), o = {};
+		t.headers.forEach((e, t) => {
+			o[t] = e;
+		});
+		let s = {
+			method: t.method || "GET",
+			path: i,
+			headers: k(o)
+		}, { meta: c, body: l } = await e.forwardHttp(s, a, { signal: t.signal });
+		return new Response(l, {
+			status: c.status,
+			headers: A(c.headers)
+		});
+	} catch (e) {
+		return new Response(Q(e), {
+			status: Z(e),
+			headers: { "Content-Type": "text/plain; charset=utf-8" }
+		});
+	}
+}
+//#endregion
+//#region src/tunnel/connect.ts
+async function Se(e) {
+	let t = e.host ?? "127.0.0.1", n = e.port ?? 1984, r = await Y({
+		key: e.key,
+		keyFile: e.keyFile,
+		keyPair: e.keyPair,
+		storePath: e.storePath,
+		bootstrap: e.bootstrap,
+		requestTimeoutMs: e.requestTimeoutMs,
+		connectTimeoutMs: e.connectTimeoutMs,
+		maxStreams: e.maxStreams
+	}), a = i.createServer((e, t) => {
+		$(r, e, t, "");
+	});
+	await new Promise((e, r) => {
+		a.once("error", r), a.listen(n, t, () => e());
+	});
+	let o = a.address(), s = o && typeof o == "object" ? o.port : n, c = `http://${t}:${s}`;
+	return {
+		key: e.key,
+		clientKey: r.clientKey,
+		host: t,
+		port: s,
+		baseUrl: c,
+		close: async () => {
+			await new Promise((e) => a.close(() => e())), await r.close();
+		}
+	};
+}
+function Ce(e, t = "") {
+	let n = e.replace(/\/$/, "");
+	return t ? t.startsWith("/") ? `${n}${t}` : `${n}/${t}` : n;
+}
+//#endregion
+//#region src/tunnel/proxyApp.ts
+function we(e) {
+	let t = e.key?.trim() || (typeof process < "u" ? process.env.SEED_GATEWAY_HYPER_KEY?.trim() : "") || "";
+	if (!t) throw Error("createGatewayProxy requires options.key or SEED_GATEWAY_HYPER_KEY environment variable");
+	return t;
+}
+function Te(e = {}) {
+	let t = e.mountPath?.trim() || "/api/seed-gateway", n = we(e), r = null, i = null, a = async () => {
+		if (r) return r;
+		if (i) return i;
+		i = Y({
+			key: n,
+			keyFile: e.keyFile,
+			keyPair: e.keyPair,
+			storePath: e.storePath,
+			bootstrap: e.bootstrap,
+			requestTimeoutMs: e.requestTimeoutMs,
+			connectTimeoutMs: e.connectTimeoutMs,
+			maxStreams: e.maxStreams
+		}).then((e) => (r = e, i = null, e));
+		try {
+			return await i;
+		} catch (e) {
+			throw i = null, e;
+		}
+	}, o = {
+		mountPath: t,
+		start: async () => {
+			await a();
+		},
+		close: async () => {
+			if (i) try {
+				await i;
+			} catch {}
+			r &&= (await r.close(), null);
+		},
+		handleNode: (e, n) => {
+			(async () => {
+				try {
+					await $(await a(), e, n, t);
+				} catch (e) {
+					let t = e instanceof Error ? e.message : String(e);
+					n.headersSent || n.writeHead(502, { "Content-Type": "text/plain; charset=utf-8" }), n.end(`Gateway Hyper tunnel error: ${t}`);
+				}
+			})();
+		},
+		handleFetch: async (e) => {
+			try {
+				return await xe(await a(), e, t);
+			} catch (e) {
+				let t = e instanceof Error ? e.message : String(e);
+				return new Response(`Gateway Hyper tunnel error: ${t}`, {
+					status: 502,
+					headers: { "Content-Type": "text/plain; charset=utf-8" }
+				});
+			}
+		}
+	};
+	return e.eager && o.start().catch(() => {}), o;
+}
+//#endregion
+//#region src/constants.ts
+var Ee = "";
+//#endregion
+export { T as A, h as C, E as D, w as E, u as M, l as N, O, d as P, N as S, k as T, R as _, X as a, M as b, ve as c, K as d, Y as f, se as g, ce as h, Ce as i, D as j, C as k, de as l, G as m, Te as n, _e as o, le as p, Se as r, ge as s, Ee as t, fe as u, ee as v, A as w, j as x, P as y };
+
+//# sourceMappingURL=src-DHEkxp5F.js.map