@symbo.ls/tunnel 3.14.0

package/.wrangler/cache/cf.json

@@ -0,0 +1 @@
+{"httpProtocol":"HTTP/1.1","clientAcceptEncoding":"gzip, deflate, br","requestPriority":"","edgeRequestKeepAliveStatus":1,"requestHeaderNames":{},"clientTcpRtt":7,"clientQuicRtt":0,"colo":"TBS","asn":16010,"asOrganization":"Caucasus Online LLC","country":"GE","isEUCountry":false,"city":"Tbilisi","continent":"AS","region":"Tbilisi","regionCode":"TB","timezone":"Asia/Tbilisi","longitude":"44.83412","latitude":"41.69143","tlsVersion":"TLSv1.3","tlsCipher":"AEAD-AES256-GCM-SHA384","tlsClientRandom":"f1ZBvvH8HtvDoYpg3t6OzwIx8Ks/1zG9HNR394Dfg8c=","tlsClientCiphersSha1":"kXrN3VEKDdzz2cPKTQaKzpxVTxQ=","tlsClientExtensionsSha1":"1eY97BUYYO8vDaTfHQywB1pcNdM=","tlsClientExtensionsSha1Le":"u4wtEMFQBY18l3BzHAvORm+KGRw=","tlsExportedAuthenticator":{"clientHandshake":"9b50ff71340861fedd458ff983032727ef9d477d0c55e523f70ed4a49decc68333024cd0eaf72d0c6ea8dbc04b46aa04","serverHandshake":"f09a1c6c05a4a967ebf1fd6dbbe8b153749e808b0ac8bdea102be1900a5a6b162bd49a2040977bd0fee0d46e9acc315a","clientFinished":"e34c7dcc4aabb8eb057841cc90d5ae810804177894505fbc7858ed21956e29fbb3760113c6b673726c9e9a1de9576216","serverFinished":"77097e6fa8669d551ba1770b0a4a9caf700910f090751e5d1cb2692466221dfb6b7a4062eda8f271725d90c84794dd71"},"tlsClientHelloLength":"1605","tlsClientAuth":{"certPresented":"0","certVerified":"NONE","certRevoked":"0","certIssuerDN":"","certSubjectDN":"","certIssuerDNRFC2253":"","certSubjectDNRFC2253":"","certIssuerDNLegacy":"","certSubjectDNLegacy":"","certSerial":"","certIssuerSerial":"","certSKI":"","certIssuerSKI":"","certFingerprintSHA1":"","certFingerprintSHA256":"","certNotBefore":"","certNotAfter":"","certRFC9440":"","certRFC9440TooLarge":false,"certChainRFC9440":"","certChainRFC9440TooLarge":false},"verifiedBotCategory":"","edgeL4":{"deliveryRate":755939},"botManagement":{"corporateProxy":false,"verifiedBot":false,"jsDetection":{"passed":false},"staticResource":false,"detectionIds":{},"score":99}}

package/README.md

@@ -0,0 +1,46 @@
+# @symbo.ls/tunnel
+
+Expose a local HTTP server to the internet through `tunnel.symbo.ls`.
+
+## Client (CLI)
+
+```bash
+smbls tunnel 1234                         # → https://<random>.tunnel.symbo.ls
+smbls tunnel 1234 --subdomain myapp       # → https://myapp.tunnel.symbo.ls
+smbls tunnel 1234 --host tunnel.symbo.ls --token $TUNNEL_AUTH_TOKEN
+smbls tunnel 1234 --host localhost:3000 --insecure
+```
+
+Or standalone:
+
+```bash
+npx smbls-tunnel 1234 --subdomain myapp
+```
+
+## Server (hosted at tunnel.symbo.ls)
+
+```bash
+PORT=3000 TUNNEL_ROOT_DOMAIN=tunnel.symbo.ls node bin/server.js
+```
+
+Optional: set `TUNNEL_AUTH_TOKEN` to require a token from clients.
+
+### DNS / reverse proxy
+
+Point `*.tunnel.symbo.ls` and `tunnel.symbo.ls` at the box running the server.
+Terminate TLS at your reverse proxy (nginx / caddy) and forward both HTTP and
+WebSocket upgrades to the tunnel server's `PORT`.
+
+## Protocol
+
+Clients open `wss://tunnel.symbo.ls/_tunnel?subdomain=<name>`. Each HTTP request
+to `<sub>.tunnel.symbo.ls` is framed as JSON messages (`request` /
+`request_body` / `request_end`) and replies stream back as `response` /
+`response_body` / `response_end`. Bodies are base64.
+
+## Programmatic
+
+```js
+import { createTunnelClient } from '@symbo.ls/tunnel/client'
+createTunnelClient({ localPort: 1234, subdomain: 'myapp' })
+```

package/bin/client.js

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+import { createTunnelClient } from '../src/client.js'
+
+const args = process.argv.slice(2)
+const opts = { localPort: null }
+for (let i = 0; i < args.length; i++) {
+  const a = args[i]
+  if (a === '--host') opts.host = args[++i]
+  else if (a === '--subdomain' || a === '-s') opts.subdomain = args[++i]
+  else if (a === '--token') opts.token = args[++i]
+  else if (a === '--insecure') { opts.secure = false; opts.port = 80 }
+  else if (/^\d+$/.test(a)) opts.localPort = parseInt(a, 10)
+}
+if (!opts.localPort) {
+  console.error('Usage: smbls-tunnel <localPort> [--subdomain name] [--host tunnel.symbo.ls] [--token X] [--insecure]')
+  process.exit(1)
+}
+createTunnelClient(opts)

package/bin/server.js

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+import { createTunnelServer } from '../src/server.js'
+
+const port = parseInt(process.env.PORT || '3000', 10)
+const { httpServer, rootDomain } = createTunnelServer()
+httpServer.listen(port, () => {
+  console.log(`tunnel server listening on :${port} (root: ${rootDomain})`)
+})

package/dist-worker/README.md

@@ -0,0 +1 @@
+This folder contains the built output assets for the worker "symbols-tunnel" generated at 2026-04-19T12:26:26.957Z.

package/dist-worker/index.js

@@ -0,0 +1,222 @@
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+
+// src/protocol.js
+var MSG = {
+  REGISTER: "register",
+  REGISTERED: "registered",
+  ERROR: "error",
+  REQUEST: "request",
+  REQUEST_BODY: "request_body",
+  REQUEST_END: "request_end",
+  RESPONSE: "response",
+  RESPONSE_BODY: "response_body",
+  RESPONSE_END: "response_end",
+  PING: "ping",
+  PONG: "pong"
+};
+var randomId = /* @__PURE__ */ __name(() => Math.random().toString(36).slice(2) + Date.now().toString(36), "randomId");
+var randomSubdomain = /* @__PURE__ */ __name(() => {
+  const adj = ["calm", "bold", "brisk", "quick", "bright", "soft", "warm", "cool", "keen", "lush"];
+  const noun = ["fox", "owl", "wolf", "hawk", "lark", "wren", "seal", "deer", "moth", "cub"];
+  const a = adj[Math.floor(Math.random() * adj.length)];
+  const n = noun[Math.floor(Math.random() * noun.length)];
+  const s = Math.random().toString(36).slice(2, 6);
+  return `${a}-${n}-${s}`;
+}, "randomSubdomain");
+
+// worker/tunnel-room.js
+var TunnelRoom = class {
+  static {
+    __name(this, "TunnelRoom");
+  }
+  constructor(state, env) {
+    this.state = state;
+    this.env = env;
+    this.client = null;
+    this.subdomain = null;
+    this.root = "tunnel.symbo.ls";
+    this.pending = /* @__PURE__ */ new Map();
+  }
+  async fetch(request) {
+    const url = new URL(request.url);
+    if (url.pathname === "/_register") {
+      return this.register(request, url);
+    }
+    if (!this.client || this.client.readyState !== 1) {
+      return new Response(`No tunnel registered for ${this.subdomain || "this subdomain"}.`, { status: 502 });
+    }
+    return this.proxyRequest(request);
+  }
+  async register(request, url) {
+    if (request.headers.get("upgrade") !== "websocket") {
+      return new Response("expected websocket", { status: 426 });
+    }
+    this.subdomain = url.searchParams.get("subdomain");
+    this.root = url.searchParams.get("root") || this.root;
+    if (this.client) {
+      try {
+        this.client.close(1e3, "replaced");
+      } catch {
+      }
+    }
+    const pair = new WebSocketPair();
+    const [clientSide, serverSide] = [pair[0], pair[1]];
+    serverSide.accept();
+    this.client = serverSide;
+    serverSide.addEventListener("message", (event) => this.onClientMessage(event));
+    const onClose = /* @__PURE__ */ __name(() => {
+      this.client = null;
+      this.failAllPending("tunnel closed");
+    }, "onClose");
+    serverSide.addEventListener("close", onClose);
+    serverSide.addEventListener("error", onClose);
+    serverSide.send(JSON.stringify({
+      type: MSG.REGISTERED,
+      subdomain: this.subdomain,
+      publicUrl: `https://${this.subdomain}.${this.root}`
+    }));
+    return new Response(null, { status: 101, webSocket: clientSide });
+  }
+  failAllPending(reason) {
+    for (const [, p] of this.pending) {
+      if (!p.headSent) {
+        p.resolveHead(new Response(reason, { status: 502 }));
+      } else {
+        try {
+          p.controller.error(new Error(reason));
+        } catch {
+        }
+      }
+    }
+    this.pending.clear();
+  }
+  onClientMessage(event) {
+    let msg;
+    try {
+      msg = JSON.parse(typeof event.data === "string" ? event.data : new TextDecoder().decode(event.data));
+    } catch {
+      return;
+    }
+    const entry = msg.id && this.pending.get(msg.id);
+    if (!entry) return;
+    if (msg.type === MSG.RESPONSE) {
+      const stream = new ReadableStream({
+        start: /* @__PURE__ */ __name((controller) => {
+          entry.controller = controller;
+        }, "start")
+      });
+      entry.headSent = true;
+      entry.resolveHead(new Response(stream, {
+        status: msg.status || 200,
+        headers: sanitizeHeaders(msg.headers || {})
+      }));
+    } else if (msg.type === MSG.RESPONSE_BODY) {
+      if (msg.chunk && entry.controller) {
+        entry.controller.enqueue(base64ToBytes(msg.chunk));
+      }
+    } else if (msg.type === MSG.RESPONSE_END) {
+      try {
+        entry.controller && entry.controller.close();
+      } catch {
+      }
+      this.pending.delete(msg.id);
+    }
+  }
+  async proxyRequest(request) {
+    const id = randomId();
+    const url = new URL(request.url);
+    const headers = {};
+    for (const [k, v] of request.headers) headers[k] = v;
+    const bodyBuf = ["GET", "HEAD"].includes(request.method) ? null : new Uint8Array(await request.arrayBuffer());
+    const entry = { controller: null, headSent: false };
+    const headPromise = new Promise((resolve) => {
+      entry.resolveHead = resolve;
+    });
+    this.pending.set(id, entry);
+    this.client.send(JSON.stringify({
+      type: MSG.REQUEST,
+      id,
+      method: request.method,
+      url: url.pathname + url.search,
+      headers
+    }));
+    if (bodyBuf && bodyBuf.byteLength) {
+      this.client.send(JSON.stringify({ type: MSG.REQUEST_BODY, id, chunk: bytesToBase64(bodyBuf) }));
+    }
+    this.client.send(JSON.stringify({ type: MSG.REQUEST_END, id }));
+    const timeout = new Promise((resolve) => setTimeout(() => {
+      if (this.pending.has(id)) {
+        this.pending.delete(id);
+        resolve(new Response("Tunnel request timed out", { status: 504 }));
+      }
+    }, 3e4));
+    return Promise.race([headPromise, timeout]);
+  }
+};
+var HOP_BY_HOP = /* @__PURE__ */ new Set(["connection", "keep-alive", "transfer-encoding", "upgrade", "proxy-authenticate", "proxy-authorization", "te", "trailer", "content-length"]);
+var sanitizeHeaders = /* @__PURE__ */ __name((h) => {
+  const out = {};
+  for (const [k, v] of Object.entries(h)) {
+    if (!HOP_BY_HOP.has(k.toLowerCase())) out[k] = v;
+  }
+  return out;
+}, "sanitizeHeaders");
+var bytesToBase64 = /* @__PURE__ */ __name((bytes) => {
+  let s = "";
+  for (let i = 0; i < bytes.length; i++) s += String.fromCharCode(bytes[i]);
+  return btoa(s);
+}, "bytesToBase64");
+var base64ToBytes = /* @__PURE__ */ __name((b64) => {
+  const s = atob(b64);
+  const out = new Uint8Array(s.length);
+  for (let i = 0; i < s.length; i++) out[i] = s.charCodeAt(i);
+  return out;
+}, "base64ToBytes");
+
+// worker/index.js
+var extractSubdomain = /* @__PURE__ */ __name((host, root) => {
+  if (!host) return null;
+  host = host.split(":")[0].toLowerCase();
+  if (host === root) return null;
+  if (!host.endsWith("." + root)) return null;
+  return host.slice(0, -("." + root).length);
+}, "extractSubdomain");
+var index_default = {
+  async fetch(request, env) {
+    const url = new URL(request.url);
+    const root = env.TUNNEL_ROOT_DOMAIN || "tunnel.symbo.ls";
+    const host = request.headers.get("host") || "";
+    if (url.pathname === "/_tunnel" && request.headers.get("upgrade") === "websocket") {
+      if (env.TUNNEL_AUTH_TOKEN) {
+        const token = url.searchParams.get("token") || request.headers.get("x-tunnel-token");
+        if (token !== env.TUNNEL_AUTH_TOKEN) return new Response("unauthorized", { status: 401 });
+      }
+      const requested = url.searchParams.get("subdomain");
+      const sub2 = requested && /^[a-z0-9-]{2,40}$/.test(requested) ? requested : randomSubdomain();
+      const id2 = env.TUNNEL_ROOM.idFromName(sub2);
+      const stub2 = env.TUNNEL_ROOM.get(id2);
+      const rewritten = new Request(`https://internal/_register?subdomain=${sub2}&root=${encodeURIComponent(root)}`, request);
+      return stub2.fetch(rewritten);
+    }
+    const sub = extractSubdomain(host, root);
+    if (!sub) {
+      if (url.pathname === "/health") {
+        return new Response(JSON.stringify({ ok: true }), { headers: { "content-type": "application/json" } });
+      }
+      return new Response(
+        `tunnel.symbo.ls \u2014 run \`smbls tunnel <port>\` to expose a local server.
+`,
+        { headers: { "content-type": "text/plain" } }
+      );
+    }
+    const id = env.TUNNEL_ROOM.idFromName(sub);
+    const stub = env.TUNNEL_ROOM.get(id);
+    return stub.fetch(request);
+  }
+};
+export {
+  TunnelRoom,
+  index_default as default
+};
+//# sourceMappingURL=index.js.map

package/dist-worker/index.js.map

@@ -0,0 +1,8 @@
+{
+  "version": 3,
+  "sources": ["../src/protocol.js", "../worker/tunnel-room.js", "../worker/index.js"],
+  "sourceRoot": "dist-worker",
+  "sourcesContent": ["export const MSG = {\n  REGISTER: 'register',\n  REGISTERED: 'registered',\n  ERROR: 'error',\n  REQUEST: 'request',\n  REQUEST_BODY: 'request_body',\n  REQUEST_END: 'request_end',\n  RESPONSE: 'response',\n  RESPONSE_BODY: 'response_body',\n  RESPONSE_END: 'response_end',\n  PING: 'ping',\n  PONG: 'pong'\n}\n\nexport const randomId = () => Math.random().toString(36).slice(2) + Date.now().toString(36)\n\nexport const randomSubdomain = () => {\n  const adj = ['calm', 'bold', 'brisk', 'quick', 'bright', 'soft', 'warm', 'cool', 'keen', 'lush']\n  const noun = ['fox', 'owl', 'wolf', 'hawk', 'lark', 'wren', 'seal', 'deer', 'moth', 'cub']\n  const a = adj[Math.floor(Math.random() * adj.length)]\n  const n = noun[Math.floor(Math.random() * noun.length)]\n  const s = Math.random().toString(36).slice(2, 6)\n  return `${a}-${n}-${s}`\n}\n", "import { MSG, randomId } from '../src/protocol.js'\n\n// One Durable Object per subdomain. Holds the client WebSocket connection\n// and bridges incoming HTTP requests over JSON frames (see ../src/protocol.js).\n\nexport class TunnelRoom {\n  constructor (state, env) {\n    this.state = state\n    this.env = env\n    this.client = null        // WebSocket accepted from the CLI client\n    this.subdomain = null\n    this.root = 'tunnel.symbo.ls'\n    this.pending = new Map()  // reqId -> { controller, resolveHead, rejectHead, headSent }\n  }\n\n  async fetch (request) {\n    const url = new URL(request.url)\n\n    if (url.pathname === '/_register') {\n      return this.register(request, url)\n    }\n\n    if (!this.client || this.client.readyState !== 1 /* OPEN */) {\n      return new Response(`No tunnel registered for ${this.subdomain || 'this subdomain'}.`, { status: 502 })\n    }\n\n    return this.proxyRequest(request)\n  }\n\n  async register (request, url) {\n    if (request.headers.get('upgrade') !== 'websocket') {\n      return new Response('expected websocket', { status: 426 })\n    }\n    this.subdomain = url.searchParams.get('subdomain')\n    this.root = url.searchParams.get('root') || this.root\n\n    // If a previous client is still attached, close it \u2014 a new client wins.\n    if (this.client) {\n      try { this.client.close(1000, 'replaced') } catch {}\n    }\n\n    const pair = new WebSocketPair()\n    const [clientSide, serverSide] = [pair[0], pair[1]]\n    serverSide.accept()\n    this.client = serverSide\n\n    serverSide.addEventListener('message', (event) => this.onClientMessage(event))\n    const onClose = () => { this.client = null; this.failAllPending('tunnel closed') }\n    serverSide.addEventListener('close', onClose)\n    serverSide.addEventListener('error', onClose)\n\n    serverSide.send(JSON.stringify({\n      type: MSG.REGISTERED,\n      subdomain: this.subdomain,\n      publicUrl: `https://${this.subdomain}.${this.root}`\n    }))\n\n    return new Response(null, { status: 101, webSocket: clientSide })\n  }\n\n  failAllPending (reason) {\n    for (const [, p] of this.pending) {\n      if (!p.headSent) {\n        p.resolveHead(new Response(reason, { status: 502 }))\n      } else {\n        try { p.controller.error(new Error(reason)) } catch {}\n      }\n    }\n    this.pending.clear()\n  }\n\n  onClientMessage (event) {\n    let msg\n    try { msg = JSON.parse(typeof event.data === 'string' ? event.data : new TextDecoder().decode(event.data)) } catch { return }\n    const entry = msg.id && this.pending.get(msg.id)\n    if (!entry) return\n\n    if (msg.type === MSG.RESPONSE) {\n      const stream = new ReadableStream({\n        start: (controller) => { entry.controller = controller }\n      })\n      entry.headSent = true\n      entry.resolveHead(new Response(stream, {\n        status: msg.status || 200,\n        headers: sanitizeHeaders(msg.headers || {})\n      }))\n    } else if (msg.type === MSG.RESPONSE_BODY) {\n      if (msg.chunk && entry.controller) {\n        entry.controller.enqueue(base64ToBytes(msg.chunk))\n      }\n    } else if (msg.type === MSG.RESPONSE_END) {\n      try { entry.controller && entry.controller.close() } catch {}\n      this.pending.delete(msg.id)\n    }\n  }\n\n  async proxyRequest (request) {\n    const id = randomId()\n    const url = new URL(request.url)\n    const headers = {}\n    for (const [k, v] of request.headers) headers[k] = v\n\n    const bodyBuf = ['GET', 'HEAD'].includes(request.method) ? null : new Uint8Array(await request.arrayBuffer())\n\n    const entry = { controller: null, headSent: false }\n    const headPromise = new Promise((resolve) => { entry.resolveHead = resolve })\n    this.pending.set(id, entry)\n\n    this.client.send(JSON.stringify({\n      type: MSG.REQUEST,\n      id,\n      method: request.method,\n      url: url.pathname + url.search,\n      headers\n    }))\n    if (bodyBuf && bodyBuf.byteLength) {\n      this.client.send(JSON.stringify({ type: MSG.REQUEST_BODY, id, chunk: bytesToBase64(bodyBuf) }))\n    }\n    this.client.send(JSON.stringify({ type: MSG.REQUEST_END, id }))\n\n    const timeout = new Promise((resolve) => setTimeout(() => {\n      if (this.pending.has(id)) {\n        this.pending.delete(id)\n        resolve(new Response('Tunnel request timed out', { status: 504 }))\n      }\n    }, 30000))\n\n    return Promise.race([headPromise, timeout])\n  }\n}\n\nconst HOP_BY_HOP = new Set(['connection', 'keep-alive', 'transfer-encoding', 'upgrade', 'proxy-authenticate', 'proxy-authorization', 'te', 'trailer', 'content-length'])\nconst sanitizeHeaders = (h) => {\n  const out = {}\n  for (const [k, v] of Object.entries(h)) {\n    if (!HOP_BY_HOP.has(k.toLowerCase())) out[k] = v\n  }\n  return out\n}\n\nconst bytesToBase64 = (bytes) => {\n  let s = ''\n  for (let i = 0; i < bytes.length; i++) s += String.fromCharCode(bytes[i])\n  return btoa(s)\n}\nconst base64ToBytes = (b64) => {\n  const s = atob(b64)\n  const out = new Uint8Array(s.length)\n  for (let i = 0; i < s.length; i++) out[i] = s.charCodeAt(i)\n  return out\n}\n", "// Cloudflare Worker entry for tunnel.symbo.ls.\n// Routes:\n//   - `tunnel.symbo.ls/_tunnel?subdomain=X` (WS upgrade) \u2192 TunnelRoom DO named X\n//   - `<sub>.tunnel.symbo.ls/*`                          \u2192 TunnelRoom DO named <sub>\n//   - `tunnel.symbo.ls/health`                           \u2192 JSON ok\n//   - `tunnel.symbo.ls/*`                                \u2192 landing\n\nimport { randomSubdomain } from '../src/protocol.js'\nexport { TunnelRoom } from './tunnel-room.js'\n\nconst extractSubdomain = (host, root) => {\n  if (!host) return null\n  host = host.split(':')[0].toLowerCase()\n  if (host === root) return null\n  if (!host.endsWith('.' + root)) return null\n  return host.slice(0, -('.' + root).length)\n}\n\nexport default {\n  async fetch (request, env) {\n    const url = new URL(request.url)\n    const root = env.TUNNEL_ROOT_DOMAIN || 'tunnel.symbo.ls'\n    const host = request.headers.get('host') || ''\n\n    // Client registration WS upgrade.\n    if (url.pathname === '/_tunnel' && request.headers.get('upgrade') === 'websocket') {\n      if (env.TUNNEL_AUTH_TOKEN) {\n        const token = url.searchParams.get('token') || request.headers.get('x-tunnel-token')\n        if (token !== env.TUNNEL_AUTH_TOKEN) return new Response('unauthorized', { status: 401 })\n      }\n      const requested = url.searchParams.get('subdomain')\n      const sub = requested && /^[a-z0-9-]{2,40}$/.test(requested) ? requested : randomSubdomain()\n      const id = env.TUNNEL_ROOM.idFromName(sub)\n      const stub = env.TUNNEL_ROOM.get(id)\n      const rewritten = new Request(`https://internal/_register?subdomain=${sub}&root=${encodeURIComponent(root)}`, request)\n      return stub.fetch(rewritten)\n    }\n\n    const sub = extractSubdomain(host, root)\n    if (!sub) {\n      if (url.pathname === '/health') {\n        return new Response(JSON.stringify({ ok: true }), { headers: { 'content-type': 'application/json' } })\n      }\n      return new Response(\n        `tunnel.symbo.ls \u2014 run \\`smbls tunnel <port>\\` to expose a local server.\\n`,\n        { headers: { 'content-type': 'text/plain' } }\n      )\n    }\n\n    const id = env.TUNNEL_ROOM.idFromName(sub)\n    const stub = env.TUNNEL_ROOM.get(id)\n    return stub.fetch(request)\n  }\n}\n"],
+  "mappings": ";;;;AAAO,IAAM,MAAM;AAAA,EACjB,UAAU;AAAA,EACV,YAAY;AAAA,EACZ,OAAO;AAAA,EACP,SAAS;AAAA,EACT,cAAc;AAAA,EACd,aAAa;AAAA,EACb,UAAU;AAAA,EACV,eAAe;AAAA,EACf,cAAc;AAAA,EACd,MAAM;AAAA,EACN,MAAM;AACR;AAEO,IAAM,WAAW,6BAAM,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,SAAS,EAAE,GAAlE;AAEjB,IAAM,kBAAkB,6BAAM;AACnC,QAAM,MAAM,CAAC,QAAQ,QAAQ,SAAS,SAAS,UAAU,QAAQ,QAAQ,QAAQ,QAAQ,MAAM;AAC/F,QAAM,OAAO,CAAC,OAAO,OAAO,QAAQ,QAAQ,QAAQ,QAAQ,QAAQ,QAAQ,QAAQ,KAAK;AACzF,QAAM,IAAI,IAAI,KAAK,MAAM,KAAK,OAAO,IAAI,IAAI,MAAM,CAAC;AACpD,QAAM,IAAI,KAAK,KAAK,MAAM,KAAK,OAAO,IAAI,KAAK,MAAM,CAAC;AACtD,QAAM,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC;AAC/C,SAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;AACvB,GAP+B;;;ACXxB,IAAM,aAAN,MAAiB;AAAA,EALxB,OAKwB;AAAA;AAAA;AAAA,EACtB,YAAa,OAAO,KAAK;AACvB,SAAK,QAAQ;AACb,SAAK,MAAM;AACX,SAAK,SAAS;AACd,SAAK,YAAY;AACjB,SAAK,OAAO;AACZ,SAAK,UAAU,oBAAI,IAAI;AAAA,EACzB;AAAA,EAEA,MAAM,MAAO,SAAS;AACpB,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAE/B,QAAI,IAAI,aAAa,cAAc;AACjC,aAAO,KAAK,SAAS,SAAS,GAAG;AAAA,IACnC;AAEA,QAAI,CAAC,KAAK,UAAU,KAAK,OAAO,eAAe,GAAc;AAC3D,aAAO,IAAI,SAAS,4BAA4B,KAAK,aAAa,gBAAgB,KAAK,EAAE,QAAQ,IAAI,CAAC;AAAA,IACxG;AAEA,WAAO,KAAK,aAAa,OAAO;AAAA,EAClC;AAAA,EAEA,MAAM,SAAU,SAAS,KAAK;AAC5B,QAAI,QAAQ,QAAQ,IAAI,SAAS,MAAM,aAAa;AAClD,aAAO,IAAI,SAAS,sBAAsB,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3D;AACA,SAAK,YAAY,IAAI,aAAa,IAAI,WAAW;AACjD,SAAK,OAAO,IAAI,aAAa,IAAI,MAAM,KAAK,KAAK;AAGjD,QAAI,KAAK,QAAQ;AACf,UAAI;AAAE,aAAK,OAAO,MAAM,KAAM,UAAU;AAAA,MAAE,QAAQ;AAAA,MAAC;AAAA,IACrD;AAEA,UAAM,OAAO,IAAI,cAAc;AAC/B,UAAM,CAAC,YAAY,UAAU,IAAI,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,CAAC;AAClD,eAAW,OAAO;AAClB,SAAK,SAAS;AAEd,eAAW,iBAAiB,WAAW,CAAC,UAAU,KAAK,gBAAgB,KAAK,CAAC;AAC7E,UAAM,UAAU,6BAAM;AAAE,WAAK,SAAS;AAAM,WAAK,eAAe,eAAe;AAAA,IAAE,GAAjE;AAChB,eAAW,iBAAiB,SAAS,OAAO;AAC5C,eAAW,iBAAiB,SAAS,OAAO;AAE5C,eAAW,KAAK,KAAK,UAAU;AAAA,MAC7B,MAAM,IAAI;AAAA,MACV,WAAW,KAAK;AAAA,MAChB,WAAW,WAAW,KAAK,SAAS,IAAI,KAAK,IAAI;AAAA,IACnD,CAAC,CAAC;AAEF,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,WAAW,WAAW,CAAC;AAAA,EAClE;AAAA,EAEA,eAAgB,QAAQ;AACtB,eAAW,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS;AAChC,UAAI,CAAC,EAAE,UAAU;AACf,UAAE,YAAY,IAAI,SAAS,QAAQ,EAAE,QAAQ,IAAI,CAAC,CAAC;AAAA,MACrD,OAAO;AACL,YAAI;AAAE,YAAE,WAAW,MAAM,IAAI,MAAM,MAAM,CAAC;AAAA,QAAE,QAAQ;AAAA,QAAC;AAAA,MACvD;AAAA,IACF;AACA,SAAK,QAAQ,MAAM;AAAA,EACrB;AAAA,EAEA,gBAAiB,OAAO;AACtB,QAAI;AACJ,QAAI;AAAE,YAAM,KAAK,MAAM,OAAO,MAAM,SAAS,WAAW,MAAM,OAAO,IAAI,YAAY,EAAE,OAAO,MAAM,IAAI,CAAC;AAAA,IAAE,QAAQ;AAAE;AAAA,IAAO;AAC5H,UAAM,QAAQ,IAAI,MAAM,KAAK,QAAQ,IAAI,IAAI,EAAE;AAC/C,QAAI,CAAC,MAAO;AAEZ,QAAI,IAAI,SAAS,IAAI,UAAU;AAC7B,YAAM,SAAS,IAAI,eAAe;AAAA,QAChC,OAAO,wBAAC,eAAe;AAAE,gBAAM,aAAa;AAAA,QAAW,GAAhD;AAAA,MACT,CAAC;AACD,YAAM,WAAW;AACjB,YAAM,YAAY,IAAI,SAAS,QAAQ;AAAA,QACrC,QAAQ,IAAI,UAAU;AAAA,QACtB,SAAS,gBAAgB,IAAI,WAAW,CAAC,CAAC;AAAA,MAC5C,CAAC,CAAC;AAAA,IACJ,WAAW,IAAI,SAAS,IAAI,eAAe;AACzC,UAAI,IAAI,SAAS,MAAM,YAAY;AACjC,cAAM,WAAW,QAAQ,cAAc,IAAI,KAAK,CAAC;AAAA,MACnD;AAAA,IACF,WAAW,IAAI,SAAS,IAAI,cAAc;AACxC,UAAI;AAAE,cAAM,cAAc,MAAM,WAAW,MAAM;AAAA,MAAE,QAAQ;AAAA,MAAC;AAC5D,WAAK,QAAQ,OAAO,IAAI,EAAE;AAAA,IAC5B;AAAA,EACF;AAAA,EAEA,MAAM,aAAc,SAAS;AAC3B,UAAM,KAAK,SAAS;AACpB,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,UAAU,CAAC;AACjB,eAAW,CAAC,GAAG,CAAC,KAAK,QAAQ,QAAS,SAAQ,CAAC,IAAI;AAEnD,UAAM,UAAU,CAAC,OAAO,MAAM,EAAE,SAAS,QAAQ,MAAM,IAAI,OAAO,IAAI,WAAW,MAAM,QAAQ,YAAY,CAAC;AAE5G,UAAM,QAAQ,EAAE,YAAY,MAAM,UAAU,MAAM;AAClD,UAAM,cAAc,IAAI,QAAQ,CAAC,YAAY;AAAE,YAAM,cAAc;AAAA,IAAQ,CAAC;AAC5E,SAAK,QAAQ,IAAI,IAAI,KAAK;AAE1B,SAAK,OAAO,KAAK,KAAK,UAAU;AAAA,MAC9B,MAAM,IAAI;AAAA,MACV;AAAA,MACA,QAAQ,QAAQ;AAAA,MAChB,KAAK,IAAI,WAAW,IAAI;AAAA,MACxB;AAAA,IACF,CAAC,CAAC;AACF,QAAI,WAAW,QAAQ,YAAY;AACjC,WAAK,OAAO,KAAK,KAAK,UAAU,EAAE,MAAM,IAAI,cAAc,IAAI,OAAO,cAAc,OAAO,EAAE,CAAC,CAAC;AAAA,IAChG;AACA,SAAK,OAAO,KAAK,KAAK,UAAU,EAAE,MAAM,IAAI,aAAa,GAAG,CAAC,CAAC;AAE9D,UAAM,UAAU,IAAI,QAAQ,CAAC,YAAY,WAAW,MAAM;AACxD,UAAI,KAAK,QAAQ,IAAI,EAAE,GAAG;AACxB,aAAK,QAAQ,OAAO,EAAE;AACtB,gBAAQ,IAAI,SAAS,4BAA4B,EAAE,QAAQ,IAAI,CAAC,CAAC;AAAA,MACnE;AAAA,IACF,GAAG,GAAK,CAAC;AAET,WAAO,QAAQ,KAAK,CAAC,aAAa,OAAO,CAAC;AAAA,EAC5C;AACF;AAEA,IAAM,aAAa,oBAAI,IAAI,CAAC,cAAc,cAAc,qBAAqB,WAAW,sBAAsB,uBAAuB,MAAM,WAAW,gBAAgB,CAAC;AACvK,IAAM,kBAAkB,wBAAC,MAAM;AAC7B,QAAM,MAAM,CAAC;AACb,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,CAAC,GAAG;AACtC,QAAI,CAAC,WAAW,IAAI,EAAE,YAAY,CAAC,EAAG,KAAI,CAAC,IAAI;AAAA,EACjD;AACA,SAAO;AACT,GANwB;AAQxB,IAAM,gBAAgB,wBAAC,UAAU;AAC/B,MAAI,IAAI;AACR,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,IAAK,MAAK,OAAO,aAAa,MAAM,CAAC,CAAC;AACxE,SAAO,KAAK,CAAC;AACf,GAJsB;AAKtB,IAAM,gBAAgB,wBAAC,QAAQ;AAC7B,QAAM,IAAI,KAAK,GAAG;AAClB,QAAM,MAAM,IAAI,WAAW,EAAE,MAAM;AACnC,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,IAAK,KAAI,CAAC,IAAI,EAAE,WAAW,CAAC;AAC1D,SAAO;AACT,GALsB;;;ACvItB,IAAM,mBAAmB,wBAAC,MAAM,SAAS;AACvC,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,KAAK,MAAM,GAAG,EAAE,CAAC,EAAE,YAAY;AACtC,MAAI,SAAS,KAAM,QAAO;AAC1B,MAAI,CAAC,KAAK,SAAS,MAAM,IAAI,EAAG,QAAO;AACvC,SAAO,KAAK,MAAM,GAAG,EAAE,MAAM,MAAM,MAAM;AAC3C,GANyB;AAQzB,IAAO,gBAAQ;AAAA,EACb,MAAM,MAAO,SAAS,KAAK;AACzB,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,OAAO,IAAI,sBAAsB;AACvC,UAAM,OAAO,QAAQ,QAAQ,IAAI,MAAM,KAAK;AAG5C,QAAI,IAAI,aAAa,cAAc,QAAQ,QAAQ,IAAI,SAAS,MAAM,aAAa;AACjF,UAAI,IAAI,mBAAmB;AACzB,cAAM,QAAQ,IAAI,aAAa,IAAI,OAAO,KAAK,QAAQ,QAAQ,IAAI,gBAAgB;AACnF,YAAI,UAAU,IAAI,kBAAmB,QAAO,IAAI,SAAS,gBAAgB,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC1F;AACA,YAAM,YAAY,IAAI,aAAa,IAAI,WAAW;AAClD,YAAMA,OAAM,aAAa,oBAAoB,KAAK,SAAS,IAAI,YAAY,gBAAgB;AAC3F,YAAMC,MAAK,IAAI,YAAY,WAAWD,IAAG;AACzC,YAAME,QAAO,IAAI,YAAY,IAAID,GAAE;AACnC,YAAM,YAAY,IAAI,QAAQ,wCAAwCD,IAAG,SAAS,mBAAmB,IAAI,CAAC,IAAI,OAAO;AACrH,aAAOE,MAAK,MAAM,SAAS;AAAA,IAC7B;AAEA,UAAM,MAAM,iBAAiB,MAAM,IAAI;AACvC,QAAI,CAAC,KAAK;AACR,UAAI,IAAI,aAAa,WAAW;AAC9B,eAAO,IAAI,SAAS,KAAK,UAAU,EAAE,IAAI,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,gBAAgB,mBAAmB,EAAE,CAAC;AAAA,MACvG;AACA,aAAO,IAAI;AAAA,QACT;AAAA;AAAA,QACA,EAAE,SAAS,EAAE,gBAAgB,aAAa,EAAE;AAAA,MAC9C;AAAA,IACF;AAEA,UAAM,KAAK,IAAI,YAAY,WAAW,GAAG;AACzC,UAAM,OAAO,IAAI,YAAY,IAAI,EAAE;AACnC,WAAO,KAAK,MAAM,OAAO;AAAA,EAC3B;AACF;",
+  "names": ["sub", "id", "stub"]
+}

package/package.json

@@ -0,0 +1,25 @@
+{
+  "name": "@symbo.ls/tunnel",
+  "version": "3.14.0",
+  "description": "Expose localhost through tunnel.symbo.ls",
+  "type": "module",
+  "main": "src/client.js",
+  "exports": {
+    ".": "./src/client.js",
+    "./server": "./src/server.js",
+    "./client": "./src/client.js"
+  },
+  "bin": {
+    "smbls-tunnel-server": "bin/server.js",
+    "smbls-tunnel": "bin/client.js"
+  },
+  "scripts": {
+    "start": "node bin/server.js"
+  },
+  "dependencies": {
+    "ws": "^8.18.0"
+  },
+  "author": "Symbols",
+  "license": "CC-BY-NC-4.0",
+  "publishConfig": { "access": "public" }
+}

package/src/client.js

@@ -0,0 +1,152 @@
+import WebSocket from 'ws'
+import http from 'node:http'
+import https from 'node:https'
+import { MSG } from './protocol.js'
+
+// Connect to a tunnel server and forward requests to a local HTTP server.
+// Returns an EventEmitter-like handle with .close() and `onRegistered` callback.
+
+export const createTunnelClient = (options = {}) => {
+  const {
+    host = process.env.TUNNEL_HOST || 'tunnel.symbo.ls',
+    port = 443,
+    secure = port === 443,
+    localPort,
+    localHost = '127.0.0.1',
+    subdomain = null,
+    token = process.env.TUNNEL_AUTH_TOKEN || null,
+    reconnect = true,
+    reconnectDelayMs = 2000,
+    onRegistered = () => {},
+    onError = (err) => console.error('[tunnel] error:', err.message || err),
+    onClose = () => {},
+    onRequest = () => {},
+    onResponse = () => {},
+    log = (...a) => console.log('[tunnel]', ...a)
+  } = options
+
+  if (!localPort) throw new Error('createTunnelClient: localPort is required')
+
+  let ws = null
+  let closed = false
+  const activeRequests = new Map() // reqId -> { req, chunks }
+
+  const buildUrl = () => {
+    const scheme = secure ? 'wss' : 'ws'
+    const params = new URLSearchParams()
+    if (subdomain) params.set('subdomain', subdomain)
+    const qs = params.toString()
+    return `${scheme}://${host}${port && port !== 80 && port !== 443 ? ':' + port : ''}/_tunnel${qs ? '?' + qs : ''}`
+  }
+
+  const send = (msg) => {
+    if (ws && ws.readyState === WebSocket.OPEN) ws.send(JSON.stringify(msg))
+  }
+
+  const startLocalRequest = (msg) => {
+    const startedAt = Date.now()
+    onRequest({ id: msg.id, method: msg.method, url: msg.url, headers: msg.headers })
+    let bytes = 0
+    let status = 0
+    const localReq = http.request({
+      host: localHost,
+      port: localPort,
+      method: msg.method,
+      path: msg.url,
+      headers: { ...msg.headers, host: `${localHost}:${localPort}` }
+    }, (localRes) => {
+      status = localRes.statusCode
+      send({ type: MSG.RESPONSE, id: msg.id, status, headers: localRes.headers })
+      localRes.on('data', (chunk) => {
+        bytes += chunk.length
+        send({ type: MSG.RESPONSE_BODY, id: msg.id, chunk: chunk.toString('base64') })
+      })
+      localRes.on('end', () => {
+        send({ type: MSG.RESPONSE_END, id: msg.id })
+        activeRequests.delete(msg.id)
+        onResponse({ id: msg.id, method: msg.method, url: msg.url, status, bytes, durationMs: Date.now() - startedAt })
+      })
+    })
+    localReq.on('error', (err) => {
+      send({ type: MSG.RESPONSE, id: msg.id, status: 502, headers: { 'content-type': 'text/plain' } })
+      send({ type: MSG.RESPONSE_BODY, id: msg.id, chunk: Buffer.from(`Local server error: ${err.message}`).toString('base64') })
+      send({ type: MSG.RESPONSE_END, id: msg.id })
+      activeRequests.delete(msg.id)
+      onResponse({ id: msg.id, method: msg.method, url: msg.url, status: 502, bytes: 0, durationMs: Date.now() - startedAt, error: err.message })
+    })
+    activeRequests.set(msg.id, { localReq })
+  }
+
+  const connect = () => {
+    const url = buildUrl()
+    log(`connecting to ${url}`)
+    ws = new WebSocket(url, {
+      headers: token ? { 'x-tunnel-token': token } : {}
+    })
+
+    let pingTimer = null
+    ws.on('open', () => {
+      log('connected')
+      pingTimer = setInterval(() => {
+        if (ws.readyState === WebSocket.OPEN) send({ type: MSG.PING, id: 'keepalive' })
+      }, 25000)
+    })
+
+    ws.on('message', (raw) => {
+      let msg
+      try { msg = JSON.parse(raw.toString()) } catch { return }
+
+      if (msg.type === MSG.REGISTERED) {
+        log(`registered → ${msg.publicUrl}`)
+        onRegistered(msg)
+        return
+      }
+      if (msg.type === MSG.ERROR) {
+        onError(new Error(msg.message || 'tunnel error'))
+        return
+      }
+      if (msg.type === MSG.REQUEST) {
+        startLocalRequest(msg)
+        return
+      }
+      const entry = activeRequests.get(msg.id)
+      if (!entry) return
+      if (msg.type === MSG.REQUEST_BODY) {
+        if (msg.chunk) entry.localReq.write(Buffer.from(msg.chunk, 'base64'))
+      } else if (msg.type === MSG.REQUEST_END) {
+        entry.localReq.end()
+      }
+    })
+
+    ws.on('close', () => {
+      if (pingTimer) { clearInterval(pingTimer); pingTimer = null }
+      onClose()
+      if (closed || !reconnect) return
+      setTimeout(connect, reconnectDelayMs)
+    })
+
+    // Surface the HTTP error body when the WS upgrade is rejected (4xx/5xx).
+    // Without this, the user only sees "Unexpected server response: 403" with
+    // no indication of what to fix (e.g. missing <owner>-- prefix).
+    ws.on('unexpected-response', async (req, res) => {
+      let body = ''
+      try {
+        for await (const chunk of res) body += chunk.toString('utf8')
+      } catch { /* ignore read errors — we already have the status */ }
+      onError(new Error(`HTTP ${res.statusCode}: ${body.slice(0, 480) || '(empty body)'}`))
+      if (pingTimer) { clearInterval(pingTimer); pingTimer = null }
+      if (!closed && reconnect) setTimeout(connect, reconnectDelayMs)
+    })
+
+    ws.on('error', (err) => onError(err))
+  }
+
+  connect()
+
+  return {
+    close: () => {
+      closed = true
+      if (ws) ws.close()
+    }
+  }
+}

package/src/protocol.js

@@ -0,0 +1,24 @@
+export const MSG = {
+  REGISTER: 'register',
+  REGISTERED: 'registered',
+  ERROR: 'error',
+  REQUEST: 'request',
+  REQUEST_BODY: 'request_body',
+  REQUEST_END: 'request_end',
+  RESPONSE: 'response',
+  RESPONSE_BODY: 'response_body',
+  RESPONSE_END: 'response_end',
+  PING: 'ping',
+  PONG: 'pong'
+}
+
+export const randomId = () => Math.random().toString(36).slice(2) + Date.now().toString(36)
+
+export const randomSubdomain = () => {
+  const adj = ['calm', 'bold', 'brisk', 'quick', 'bright', 'soft', 'warm', 'cool', 'keen', 'lush']
+  const noun = ['fox', 'owl', 'wolf', 'hawk', 'lark', 'wren', 'seal', 'deer', 'moth', 'cub']
+  const a = adj[Math.floor(Math.random() * adj.length)]
+  const n = noun[Math.floor(Math.random() * noun.length)]
+  const s = Math.random().toString(36).slice(2, 6)
+  return `${a}-${n}-${s}`
+}

package/src/server.js

@@ -0,0 +1,177 @@
+import http from 'node:http'
+import { WebSocketServer } from 'ws'
+import { URL } from 'node:url'
+import { MSG, randomId, randomSubdomain } from './protocol.js'
+
+// Server hosted at tunnel.symbo.ls.
+// - HTTP requests to `<sub>.tunnel.symbo.ls` are proxied over a WebSocket
+//   connection held open by the CLI client that owns that subdomain.
+// - Clients register by opening `wss://tunnel.symbo.ls/_tunnel?subdomain=<sub>`.
+
+export const createTunnelServer = (options = {}) => {
+  const {
+    rootDomain = process.env.TUNNEL_ROOT_DOMAIN || 'tunnel.symbo.ls',
+    authToken = process.env.TUNNEL_AUTH_TOKEN || null,
+    requestTimeoutMs = 30000
+  } = options
+
+  const tunnels = new Map() // subdomain -> { ws, pending: Map<reqId, { res, bodyChunks }> }
+
+  const send = (ws, msg) => {
+    if (ws.readyState === ws.OPEN) ws.send(JSON.stringify(msg))
+  }
+
+  const extractSubdomain = (hostHeader) => {
+    if (!hostHeader) return null
+    const host = hostHeader.split(':')[0].toLowerCase()
+    if (host === rootDomain) return null
+    if (!host.endsWith('.' + rootDomain)) return null
+    return host.slice(0, -('.' + rootDomain).length)
+  }
+
+  const httpServer = http.createServer((req, res) => {
+    const sub = extractSubdomain(req.headers.host)
+
+    if (!sub) {
+      if (req.url === '/health') {
+        res.writeHead(200, { 'content-type': 'application/json' })
+        res.end(JSON.stringify({ ok: true, tunnels: tunnels.size }))
+        return
+      }
+      res.writeHead(200, { 'content-type': 'text/plain' })
+      res.end(`tunnel.symbo.ls — point a CLI client at this host to expose localhost.\nActive tunnels: ${tunnels.size}\n`)
+      return
+    }
+
+    const tunnel = tunnels.get(sub)
+    if (!tunnel) {
+      res.writeHead(502, { 'content-type': 'text/plain' })
+      res.end(`No tunnel registered for ${sub}.${rootDomain}`)
+      return
+    }
+
+    const reqId = randomId()
+    const pending = { res, timeout: null }
+    tunnel.pending.set(reqId, pending)
+
+    pending.timeout = setTimeout(() => {
+      if (!tunnel.pending.has(reqId)) return
+      tunnel.pending.delete(reqId)
+      if (!res.headersSent) {
+        res.writeHead(504, { 'content-type': 'text/plain' })
+        res.end('Tunnel request timed out')
+      } else {
+        res.end()
+      }
+    }, requestTimeoutMs)
+
+    send(tunnel.ws, {
+      type: MSG.REQUEST,
+      id: reqId,
+      method: req.method,
+      url: req.url,
+      headers: req.headers
+    })
+
+    req.on('data', (chunk) => {
+      send(tunnel.ws, { type: MSG.REQUEST_BODY, id: reqId, chunk: chunk.toString('base64') })
+    })
+    req.on('end', () => send(tunnel.ws, { type: MSG.REQUEST_END, id: reqId }))
+    req.on('error', () => {
+      tunnel.pending.delete(reqId)
+      clearTimeout(pending.timeout)
+    })
+
+    res.on('close', () => {
+      tunnel.pending.delete(reqId)
+      clearTimeout(pending.timeout)
+    })
+  })
+
+  const wss = new WebSocketServer({ noServer: true })
+
+  httpServer.on('upgrade', (req, socket, head) => {
+    const url = new URL(req.url, `http://${req.headers.host}`)
+    if (url.pathname !== '/_tunnel') {
+      // Proxy websocket upgrades to subdomain owners.
+      const sub = extractSubdomain(req.headers.host)
+      const tunnel = sub && tunnels.get(sub)
+      if (!tunnel) {
+        socket.write('HTTP/1.1 502 Bad Gateway\r\n\r\n')
+        socket.destroy()
+        return
+      }
+      // Minimal: websocket-through-tunnel not implemented; reject for now.
+      socket.write('HTTP/1.1 501 Not Implemented\r\n\r\n')
+      socket.destroy()
+      return
+    }
+
+    if (authToken) {
+      const token = url.searchParams.get('token') || req.headers['x-tunnel-token']
+      if (token !== authToken) {
+        socket.write('HTTP/1.1 401 Unauthorized\r\n\r\n')
+        socket.destroy()
+        return
+      }
+    }
+
+    wss.handleUpgrade(req, socket, head, (ws) => {
+      const requested = url.searchParams.get('subdomain')
+      let sub = requested && /^[a-z0-9-]{2,40}$/.test(requested) ? requested : randomSubdomain()
+      if (tunnels.has(sub)) sub = `${sub}-${Math.random().toString(36).slice(2, 5)}`
+
+      const tunnel = { ws, pending: new Map() }
+      tunnels.set(sub, tunnel)
+
+      send(ws, {
+        type: MSG.REGISTERED,
+        subdomain: sub,
+        publicUrl: `https://${sub}.${rootDomain}`
+      })
+
+      ws.on('message', (raw) => {
+        let msg
+        try { msg = JSON.parse(raw.toString()) } catch { return }
+        const pending = msg.id && tunnel.pending.get(msg.id)
+        if (!pending) return
+        const { res } = pending
+
+        if (msg.type === MSG.RESPONSE) {
+          if (!res.headersSent) res.writeHead(msg.status || 200, msg.headers || {})
+        } else if (msg.type === MSG.RESPONSE_BODY) {
+          if (msg.chunk) res.write(Buffer.from(msg.chunk, 'base64'))
+        } else if (msg.type === MSG.RESPONSE_END) {
+          clearTimeout(pending.timeout)
+          tunnel.pending.delete(msg.id)
+          res.end()
+        }
+      })
+
+      const cleanup = () => {
+        tunnels.delete(sub)
+        for (const [, p] of tunnel.pending) {
+          clearTimeout(p.timeout)
+          if (!p.res.headersSent) {
+            p.res.writeHead(502, { 'content-type': 'text/plain' })
+            p.res.end('Tunnel closed')
+          } else p.res.end()
+        }
+        tunnel.pending.clear()
+      }
+      ws.on('close', cleanup)
+      ws.on('error', cleanup)
+    })
+  })
+
+  return { httpServer, tunnels, rootDomain }
+}
+
+// Allow `node src/server.js` for local testing.
+if (import.meta.url === `file://${process.argv[1]}`) {
+  const port = parseInt(process.env.PORT || '3000', 10)
+  const { httpServer, rootDomain } = createTunnelServer()
+  httpServer.listen(port, () => {
+    console.log(`tunnel server listening on :${port} (root: ${rootDomain})`)
+  })
+}

package/worker/index.js

@@ -0,0 +1,110 @@
+// Cloudflare Worker entry for tunnel.symbo.ls.
+// Routes:
+//   - `tunnel.symbo.ls/_tunnel?subdomain=X` (WS upgrade) → TunnelRoom DO named X
+//   - `<sub>.tunnel.symbo.ls/*`                          → TunnelRoom DO named <sub>
+//   - `tunnel.symbo.ls/health`                           → JSON ok
+//   - `tunnel.symbo.ls/*`                                → landing
+
+import { randomSubdomain } from '../src/protocol.js'
+export { TunnelRoom } from './tunnel-room.js'
+
+// Validate a Symbols auth token via the Symbols API's /core/auth/me endpoint.
+// Returns an array of lowercase owner slugs the user may claim, or null if
+// the token is invalid. Results are cached in a Map (per-isolate) for 60s to
+// avoid a round-trip per reconnect.
+const authCache = new Map()
+const AUTH_TTL_MS = 60_000
+
+const authenticate = async (token, env) => {
+  const cached = authCache.get(token)
+  if (cached && cached.expires > Date.now()) return cached.owners
+
+  const apiBase = (env.SYMBOLS_API_URL || 'https://api.symbols.app').replace(/\/+$/, '')
+  const res = await fetch(`${apiBase}/core/auth/me`, {
+    headers: { Authorization: `Bearer ${token}` },
+    cf: { cacheTtl: 0 }
+  }).catch(() => null)
+  if (!res || !res.ok) return null
+
+  const data = await res.json().catch(() => null)
+  const user = data?.data?.user || data?.user || data?.data || data
+  if (!user) return null
+
+  const owners = new Set()
+  const add = (v) => { if (typeof v === 'string' && v.trim()) owners.add(v.toLowerCase()) }
+  add(user.username); add(user.handle); add(user.slug); add(user.ownerSlug); add(user.owner)
+  for (const o of user.owners || []) add(typeof o === 'string' ? o : (o?.slug || o?.key || o?.username))
+  for (const t of user.teams || []) add(typeof t === 'string' ? t : (t?.slug || t?.key))
+
+  if (!owners.size) return null
+  const list = [...owners]
+  authCache.set(token, { owners: list, expires: Date.now() + AUTH_TTL_MS })
+  return list
+}
+
+const extractSubdomain = (host, root) => {
+  if (!host) return null
+  host = host.split(':')[0].toLowerCase()
+  if (host === root) return null
+  if (!host.endsWith('.' + root)) return null
+  return host.slice(0, -('.' + root).length)
+}
+
+export default {
+  async fetch (request, env) {
+    const url = new URL(request.url)
+    const root = env.TUNNEL_ROOT_DOMAIN || 'tunnel.symbo.ls'
+    // In production, CF routes requests by Host header. For local `wrangler dev`
+    // Miniflare normalizes Host to `localhost`, so allow an `x-forwarded-host`
+    // override to test subdomain routing.
+    // In production, CF routes requests by real Host header. `x-forwarded-host`
+    // is honored for reverse-proxy / local-dev scenarios (Miniflare rewrites Host).
+    const host = (request.headers.get('x-forwarded-host') || request.headers.get('host') || url.hostname || '').toLowerCase()
+
+    // Client registration WS upgrade — authenticate and enforce owner scoping.
+    if (url.pathname === '/_tunnel' && request.headers.get('upgrade') === 'websocket') {
+      const token = url.searchParams.get('token') || request.headers.get('x-tunnel-token')
+      if (!token) return new Response('authentication required', { status: 401 })
+
+      const allowedOwners = await authenticate(token, env)
+      if (!allowedOwners) return new Response('invalid or expired token', { status: 401 })
+
+      const requested = (url.searchParams.get('subdomain') || '').toLowerCase()
+      const requestedOwner = requested.includes('--') ? requested.split('--', 1)[0] : null
+
+      let sub
+      if (requested) {
+        if (!/^[a-z0-9-]{2,63}$/.test(requested)) return new Response('invalid subdomain', { status: 400 })
+        if (!requestedOwner || !allowedOwners.includes(requestedOwner)) {
+          return new Response(
+            `forbidden: subdomain must start with one of your owner scopes (${allowedOwners.join(', ')}) followed by '--'`,
+            { status: 403 }
+          )
+        }
+        sub = requested
+      } else {
+        sub = `${allowedOwners[0]}--${randomSubdomain()}`
+      }
+
+      const id = env.TUNNEL_ROOM.idFromName(sub)
+      const stub = env.TUNNEL_ROOM.get(id)
+      const rewritten = new Request(`https://internal/_register?subdomain=${sub}&root=${encodeURIComponent(root)}`, request)
+      return stub.fetch(rewritten)
+    }
+
+    const sub = extractSubdomain(host, root)
+    if (!sub) {
+      if (url.pathname === '/health') {
+        return new Response(JSON.stringify({ ok: true }), { headers: { 'content-type': 'application/json' } })
+      }
+      return new Response(
+        `tunnel.symbo.ls — run \`smbls tunnel <port>\` to expose a local server.\n`,
+        { headers: { 'content-type': 'text/plain' } }
+      )
+    }
+
+    const id = env.TUNNEL_ROOM.idFromName(sub)
+    const stub = env.TUNNEL_ROOM.get(id)
+    return stub.fetch(request)
+  }
+}

package/worker/tunnel-room.js

@@ -0,0 +1,151 @@
+import { MSG, randomId } from '../src/protocol.js'
+
+// One Durable Object per subdomain. Holds the client WebSocket connection
+// and bridges incoming HTTP requests over JSON frames (see ../src/protocol.js).
+//
+// Uses the Hibernation API (`state.acceptWebSocket`) so the DO can be evicted
+// while the CLI client's WS stays open. `this.pending` lives only while the
+// DO is hot; if it wakes for a request and finds no client (`getWebSockets()`
+// empty), we return 502.
+
+export class TunnelRoom {
+  constructor (state, env) {
+    this.state = state
+    this.env = env
+    this.pending = new Map()  // reqId -> { controller, resolveHead, headSent }
+  }
+
+  async fetch (request) {
+    const url = new URL(request.url)
+    if (url.pathname === '/_register') return this.register(request, url)
+
+    const [ws] = this.state.getWebSockets('client')
+    if (!ws) {
+      const sub = (await this.state.storage.get('subdomain')) || 'this subdomain'
+      return new Response(`No tunnel registered for ${sub}.`, { status: 502 })
+    }
+    return this.proxyRequest(request, ws)
+  }
+
+  async register (request, url) {
+    if (request.headers.get('upgrade') !== 'websocket') {
+      return new Response('expected websocket', { status: 426 })
+    }
+    const subdomain = url.searchParams.get('subdomain')
+    const root = url.searchParams.get('root') || 'tunnel.symbo.ls'
+    await this.state.storage.put('subdomain', subdomain)
+    await this.state.storage.put('root', root)
+
+    // Close any previously attached client — a new registration wins.
+    for (const existing of this.state.getWebSockets('client')) {
+      try { existing.close(1000, 'replaced') } catch {}
+    }
+
+    const pair = new WebSocketPair()
+    const [clientSide, serverSide] = [pair[0], pair[1]]
+    this.state.acceptWebSocket(serverSide, ['client'])
+
+    serverSide.send(JSON.stringify({
+      type: MSG.REGISTERED,
+      subdomain,
+      publicUrl: `https://${subdomain}.${root}`
+    }))
+
+    return new Response(null, { status: 101, webSocket: clientSide })
+  }
+
+  // Hibernation handlers — called by the runtime even after the DO was evicted.
+  async webSocketMessage (ws, data) {
+    let msg
+    try { msg = JSON.parse(typeof data === 'string' ? data : new TextDecoder().decode(data)) } catch { return }
+    if (msg.type === MSG.PING) {
+      ws.send(JSON.stringify({ type: MSG.PONG, id: msg.id }))
+      return
+    }
+    const entry = msg.id && this.pending.get(msg.id)
+    if (!entry) return
+    if (msg.type === MSG.RESPONSE) {
+      const stream = new ReadableStream({ start: (c) => { entry.controller = c } })
+      entry.headSent = true
+      entry.resolveHead(new Response(stream, {
+        status: msg.status || 200,
+        headers: sanitizeHeaders(msg.headers || {})
+      }))
+    } else if (msg.type === MSG.RESPONSE_BODY) {
+      if (msg.chunk && entry.controller) entry.controller.enqueue(base64ToBytes(msg.chunk))
+    } else if (msg.type === MSG.RESPONSE_END) {
+      try { entry.controller && entry.controller.close() } catch {}
+      this.pending.delete(msg.id)
+    }
+  }
+
+  async webSocketClose (_ws, _code, _reason, _clean) {
+    this.failAllPending('tunnel closed')
+  }
+
+  async webSocketError (_ws, _err) {
+    this.failAllPending('tunnel error')
+  }
+
+  failAllPending (reason) {
+    for (const [, p] of this.pending) {
+      if (!p.headSent) p.resolveHead(new Response(reason, { status: 502 }))
+      else { try { p.controller.error(new Error(reason)) } catch {} }
+    }
+    this.pending.clear()
+  }
+
+  async proxyRequest (request, ws) {
+    const id = randomId()
+    const url = new URL(request.url)
+    const headers = {}
+    for (const [k, v] of request.headers) headers[k] = v
+
+    const bodyBuf = ['GET', 'HEAD'].includes(request.method) ? null : new Uint8Array(await request.arrayBuffer())
+
+    const entry = { controller: null, headSent: false }
+    const headPromise = new Promise((resolve) => { entry.resolveHead = resolve })
+    this.pending.set(id, entry)
+
+    ws.send(JSON.stringify({
+      type: MSG.REQUEST, id,
+      method: request.method,
+      url: url.pathname + url.search,
+      headers
+    }))
+    if (bodyBuf && bodyBuf.byteLength) {
+      ws.send(JSON.stringify({ type: MSG.REQUEST_BODY, id, chunk: bytesToBase64(bodyBuf) }))
+    }
+    ws.send(JSON.stringify({ type: MSG.REQUEST_END, id }))
+
+    const timeout = new Promise((resolve) => setTimeout(() => {
+      if (this.pending.has(id)) {
+        this.pending.delete(id)
+        resolve(new Response('Tunnel request timed out', { status: 504 }))
+      }
+    }, 30000))
+
+    return Promise.race([headPromise, timeout])
+  }
+}
+
+const HOP_BY_HOP = new Set(['connection', 'keep-alive', 'transfer-encoding', 'upgrade', 'proxy-authenticate', 'proxy-authorization', 'te', 'trailer', 'content-length'])
+const sanitizeHeaders = (h) => {
+  const out = {}
+  for (const [k, v] of Object.entries(h)) {
+    if (!HOP_BY_HOP.has(k.toLowerCase())) out[k] = v
+  }
+  return out
+}
+
+const bytesToBase64 = (bytes) => {
+  let s = ''
+  for (let i = 0; i < bytes.length; i++) s += String.fromCharCode(bytes[i])
+  return btoa(s)
+}
+const base64ToBytes = (b64) => {
+  const s = atob(b64)
+  const out = new Uint8Array(s.length)
+  for (let i = 0; i < s.length; i++) out[i] = s.charCodeAt(i)
+  return out
+}

package/wrangler.toml

@@ -0,0 +1,49 @@
+name = "symbols-tunnel"
+main = "worker/index.js"
+compatibility_date = "2025-01-01"
+account_id = "98091ed46ea209bb648b108950bd78e7"
+
+[vars]
+TUNNEL_ROOT_DOMAIN = "tunnel.symbo.ls"
+# Tokens issued by next.api.symbols.app verify here.
+# For a main-channel deployment override this per-env (see [env.main] below).
+SYMBOLS_API_URL = "https://next.api.symbols.app"
+
+# Main-channel deployment: wrangler deploy --env main
+[env.main.vars]
+TUNNEL_ROOT_DOMAIN = "tunnel.symbo.ls"
+SYMBOLS_API_URL = "https://api.symbols.app"
+
+# Next-channel deployment (default above): wrangler deploy
+[env.next.vars]
+TUNNEL_ROOT_DOMAIN = "tunnel.symbo.ls"
+SYMBOLS_API_URL = "https://next.api.symbols.app"
+
+[[durable_objects.bindings]]
+name = "TUNNEL_ROOM"
+class_name = "TunnelRoom"
+
+[[migrations]]
+tag = "v1"
+new_sqlite_classes = ["TunnelRoom"]
+
+# Attach once the DNS + zone are in place:
+#   wrangler deploy
+# Routes require *.tunnel.symbo.ls and tunnel.symbo.ls to be proxied through
+# the Cloudflare zone for symbo.ls.
+[[routes]]
+pattern = "tunnel.symbo.ls"
+custom_domain = true
+
+# Explicit apex path route — more specific than `*.symbo.ls/*` (mermaid) so
+# tunnel paths like `/_tunnel`, `/health` are not swallowed by other workers.
+[[routes]]
+pattern = "tunnel.symbo.ls/*"
+zone_name = "symbo.ls"
+
+# Wildcard subdomains require a wildcard DNS record (`*.tunnel` → proxied)
+# in the Cloudflare zone. Once present, this route activates for every
+# `<sub>.tunnel.symbo.ls`.
+[[routes]]
+pattern = "*.tunnel.symbo.ls/*"
+zone_name = "symbo.ls"