@xopcai/xopc 0.0.77 → 0.0.78

package/dist/src/tunnel/gateway-lifecycle.js.map

@@ -1 +1 @@
-{"version":3,"file":"gateway-lifecycle.js","names":[],"sources":["../../../src/tunnel/gateway-lifecycle.ts"],"sourcesContent":["import type { Config } from '../config/schema.js';\nimport { resolveGatewayEffectiveHost } from '../config/gateway-bind.js';\nimport { createLogger } from '../utils/logger.js';\nimport { hasValidTunnelConsent } from './consent.js';\nimport { subscribeCertStatus } from './acme-cert-store.js';\nimport { resolveTunnelBrokerUrl, resolveTunnelRegistrationSecret } from './env.js';\nimport { getTunnelService } from './tunnel-service.js';\nimport { resolveFrpSubdomainHost, resolveTunnelE2eConfig } from './tunnel-e2e-config.js';\nimport { fetchTunnelWellKnown } from './well-known.js';\n\nconst log = createLogger('Tunnel');\n\ntype TunnelEventSink = { emit(type: string, payload: unknown): void };\n\nlet tunnelSseWired = false;\n\n/** Publish `tunnel.status` on gateway SSE when tunnel lifecycle changes. */\nexport function wireTunnelEventsToGateway(service: TunnelEventSink): void {\n  if (tunnelSseWired) return;\n  tunnelSseWired = true;\n\n  const tunnel = getTunnelService();\n  const publish = () => {\n    service.emit('tunnel.status', tunnel.getStatus());\n  };\n\n  tunnel.on('tunnel:connecting', publish);\n  tunnel.on('tunnel:connected', publish);\n  tunnel.on('tunnel:disconnected', publish);\n  tunnel.on('tunnel:error', publish);\n  tunnel.on('tunnel:progress', publish);\n\n  subscribeCertStatus((cert) => {\n    service.emit('tunnel.cert.status', cert);\n    publish();\n  });\n}\n\nexport type ConfigureTunnelFromGatewayConfigOptions = {\n  force?: boolean;\n  /** Apply config/env broker URL immediately; refresh from well-known in the background. */\n  deferWellKnownFetch?: boolean;\n};\n\nfunction applyTunnelServiceFromGatewayConfig(config: Config, brokerUrl: string): void {\n  const gateway = config.gateway ?? {};\n  const gatewayPort = gateway.port ?? 18790;\n\n  let registrationSecret: string;\n  try {\n    registrationSecret = resolveTunnelRegistrationSecret(\n      process.env,\n      brokerUrl,\n      config.tunnel?.registrationSecret,\n    );\n  } catch (err) {\n    const em = err instanceof Error ? err.message : String(err);\n    log.warn({ phase: 'tunnel_configure', errorMessage: em }, em);\n    throw err;\n  }\n\n  getTunnelService().configure({\n    brokerUrl,\n    registrationSecret,\n    autoStart: config.tunnel?.autoStart ?? false,\n    gatewayHost: resolveGatewayEffectiveHost(config),\n    e2e: resolveTunnelE2eConfig(config.tunnel, gatewayPort),\n    frpSubdomainHost: resolveFrpSubdomainHost(brokerUrl),\n  });\n}\n\nasync function resolveBrokerUrlFromWellKnown(initialBrokerUrl: string): Promise<string> {\n  let brokerUrl = initialBrokerUrl;\n  try {\n    const wellKnown = await fetchTunnelWellKnown(brokerUrl);\n    if (wellKnown.brokerUrl?.trim()) {\n      brokerUrl = wellKnown.brokerUrl.trim();\n    }\n  } catch (err) {\n    log.debug(\n      { err, brokerUrl, phase: 'tunnel_well_known' },\n      'Tunnel well-known fetch skipped (using config/env broker URL)',\n    );\n  }\n  return brokerUrl;\n}\n\nlet deferredWellKnownRefresh: Promise<void> | null = null;\n\nfunction scheduleDeferredWellKnownRefresh(config: Config, initialBrokerUrl: string): void {\n  if (deferredWellKnownRefresh) return;\n\n  deferredWellKnownRefresh = resolveBrokerUrlFromWellKnown(initialBrokerUrl)\n    .then((resolvedBrokerUrl) => {\n      if (resolvedBrokerUrl === initialBrokerUrl) return;\n      applyTunnelServiceFromGatewayConfig(config, resolvedBrokerUrl);\n    })\n    .catch((err) => {\n      const em = err instanceof Error ? err.message : String(err);\n      log.warn(\n        { err, phase: 'tunnel_well_known_deferred', errorMessage: em },\n        `Deferred tunnel well-known refresh failed: ${em}`,\n      );\n    })\n    .finally(() => {\n      deferredWellKnownRefresh = null;\n    });\n}\n\nexport async function configureTunnelFromGatewayConfig(\n  config: Config,\n  opts?: ConfigureTunnelFromGatewayConfigOptions,\n): Promise<void> {\n  if (!opts?.force && !config.tunnel?.enabled) return;\n\n  const initialBrokerUrl = resolveTunnelBrokerUrl(config.tunnel?.brokerUrl);\n\n  if (opts?.deferWellKnownFetch) {\n    applyTunnelServiceFromGatewayConfig(config, initialBrokerUrl);\n    scheduleDeferredWellKnownRefresh(config, initialBrokerUrl);\n    return;\n  }\n\n  if (deferredWellKnownRefresh) {\n    await deferredWellKnownRefresh;\n  }\n\n  const brokerUrl = await resolveBrokerUrlFromWellKnown(initialBrokerUrl);\n  applyTunnelServiceFromGatewayConfig(config, brokerUrl);\n}\n\n/**\n * Start FRP tunnel when `tunnel.autoStart` is set (CLI gateway / GatewayServer after HTTP listen).\n */\nexport async function maybeAutoStartTunnelFromConfig(\n  config: Config,\n  gatewayToken: string | undefined,\n): Promise<void> {\n  if (!config.tunnel?.autoStart) return;\n\n  if (!hasValidTunnelConsent(config)) {\n    log.warn(\n      { phase: 'tunnel_autostart', consentVersion: config.tunnel?.consent?.version ?? null },\n      'tunnel.autoStart skipped: security consent required or outdated',\n    );\n    return;\n  }\n\n  if (config.tunnel.enabled !== true) {\n    log.debug(\n      { phase: 'tunnel_autostart' },\n      'tunnel.autoStart skipped: tunnel.enabled is false (start remote access once)',\n    );\n    return;\n  }\n\n  const gateway = config.gateway ?? {};\n  const port = gateway.port ?? 18790;\n  const host = resolveGatewayEffectiveHost(config);\n\n  await configureTunnelFromGatewayConfig(config);\n\n  if (!gatewayToken) {\n    log.warn(\n      { phase: 'tunnel_autostart' },\n      'tunnel.autoStart is enabled but gateway auth token is unavailable (auth mode may be none)',\n    );\n    return;\n  }\n\n  const tunnel = getTunnelService();\n  const { state } = tunnel.getStatus();\n  if (state === 'connected' || state === 'connecting' || state === 'reconnecting') {\n    log.debug({ phase: 'tunnel_autostart', state }, 'Tunnel already active — skip autostart');\n    return;\n  }\n\n  try {\n    await tunnel.start(port, gatewayToken);\n    log.info(\n      { phase: 'tunnel_autostart', host, port },\n      'Tunnel auto-started after gateway HTTP listen',\n    );\n  } catch (err) {\n    const em = err instanceof Error ? err.message : String(err);\n    log.error({ err, phase: 'tunnel_autostart', errorMessage: em }, `Tunnel autostart failed: ${em}`);\n  }\n}\n"],"mappings":";;;;;;;;;;aAEkD;AAQlD,MAAM,MAAM,aAAa,SAAS;AAIlC,IAAI,iBAAiB;;AAGrB,SAAgB,0BAA0B,SAAgC;AACxE,KAAI,eAAgB;AACpB,kBAAiB;CAEjB,MAAM,SAAS,kBAAkB;CACjC,MAAM,gBAAgB;AACpB,UAAQ,KAAK,iBAAiB,OAAO,WAAW,CAAC;;AAGnD,QAAO,GAAG,qBAAqB,QAAQ;AACvC,QAAO,GAAG,oBAAoB,QAAQ;AACtC,QAAO,GAAG,uBAAuB,QAAQ;AACzC,QAAO,GAAG,gBAAgB,QAAQ;AAClC,QAAO,GAAG,mBAAmB,QAAQ;AAErC,sBAAqB,SAAS;AAC5B,UAAQ,KAAK,sBAAsB,KAAK;AACxC,WAAS;GACT;;AASJ,SAAS,oCAAoC,QAAgB,WAAyB;CAEpF,MAAM,eADU,OAAO,WAAW,EAAE,EACR,QAAQ;CAEpC,IAAI;AACJ,KAAI;AACF,uBAAqB,gCACnB,QAAQ,KACR,WACA,OAAO,QAAQ,mBAChB;UACM,KAAK;EACZ,MAAM,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC3D,MAAI,KAAK;GAAE,OAAO;GAAoB,cAAc;GAAI,EAAE,GAAG;AAC7D,QAAM;;AAGR,mBAAkB,CAAC,UAAU;EAC3B;EACA;EACA,WAAW,OAAO,QAAQ,aAAa;EACvC,aAAa,4BAA4B,OAAO;EAChD,KAAK,uBAAuB,OAAO,QAAQ,YAAY;EACvD,kBAAkB,wBAAwB,UAAU;EACrD,CAAC;;AAGJ,eAAe,8BAA8B,kBAA2C;CACtF,IAAI,YAAY;AAChB,KAAI;EACF,MAAM,YAAY,MAAM,qBAAqB,UAAU;AACvD,MAAI,UAAU,WAAW,MAAM,CAC7B,aAAY,UAAU,UAAU,MAAM;UAEjC,KAAK;AACZ,MAAI,MACF;GAAE;GAAK;GAAW,OAAO;GAAqB,EAC9C,gEACD;;AAEH,QAAO;;AAGT,IAAI,2BAAiD;AAErD,SAAS,iCAAiC,QAAgB,kBAAgC;AACxF,KAAI,yBAA0B;AAE9B,4BAA2B,8BAA8B,iBAAiB,CACvE,MAAM,sBAAsB;AAC3B,MAAI,sBAAsB,iBAAkB;AAC5C,sCAAoC,QAAQ,kBAAkB;GAC9D,CACD,OAAO,QAAQ;EACd,MAAM,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC3D,MAAI,KACF;GAAE;GAAK,OAAO;GAA8B,cAAc;GAAI,EAC9D,8CAA8C,KAC/C;GACD,CACD,cAAc;AACb,6BAA2B;GAC3B;;AAGN,eAAsB,iCACpB,QACA,MACe;AACf,KAAI,CAAC,MAAM,SAAS,CAAC,OAAO,QAAQ,QAAS;CAE7C,MAAM,mBAAmB,uBAAuB,OAAO,QAAQ,UAAU;AAEzE,KAAI,MAAM,qBAAqB;AAC7B,sCAAoC,QAAQ,iBAAiB;AAC7D,mCAAiC,QAAQ,iBAAiB;AAC1D;;AAGF,KAAI,yBACF,OAAM;AAIR,qCAAoC,QAAQ,MADpB,8BAA8B,iBAAiB,CACjB;;;;;AAMxD,eAAsB,+BACpB,QACA,cACe;AACf,KAAI,CAAC,OAAO,QAAQ,UAAW;AAE/B,KAAI,CAAC,sBAAsB,OAAO,EAAE;AAClC,MAAI,KACF;GAAE,OAAO;GAAoB,gBAAgB,OAAO,QAAQ,SAAS,WAAW;GAAM,EACtF,kEACD;AACD;;AAGF,KAAI,OAAO,OAAO,YAAY,MAAM;AAClC,MAAI,MACF,EAAE,OAAO,oBAAoB,EAC7B,+EACD;AACD;;CAIF,MAAM,QADU,OAAO,WAAW,EAAE,EACf,QAAQ;CAC7B,MAAM,OAAO,4BAA4B,OAAO;AAEhD,OAAM,iCAAiC,OAAO;AAE9C,KAAI,CAAC,cAAc;AACjB,MAAI,KACF,EAAE,OAAO,oBAAoB,EAC7B,4FACD;AACD;;CAGF,MAAM,SAAS,kBAAkB;CACjC,MAAM,EAAE,UAAU,OAAO,WAAW;AACpC,KAAI,UAAU,eAAe,UAAU,gBAAgB,UAAU,gBAAgB;AAC/E,MAAI,MAAM;GAAE,OAAO;GAAoB;GAAO,EAAE,yCAAyC;AACzF;;AAGF,KAAI;AACF,QAAM,OAAO,MAAM,MAAM,aAAa;AACtC,MAAI,KACF;GAAE,OAAO;GAAoB;GAAM;GAAM,EACzC,gDACD;UACM,KAAK;EACZ,MAAM,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC3D,MAAI,MAAM;GAAE;GAAK,OAAO;GAAoB,cAAc;GAAI,EAAE,4BAA4B,KAAK"}
+{"version":3,"file":"gateway-lifecycle.js","names":[],"sources":["../../../src/tunnel/gateway-lifecycle.ts"],"sourcesContent":["import type { Config } from '../config/schema.js';\nimport { resolveGatewayEffectiveHost } from '../config/gateway-bind.js';\nimport { createLogger } from '../utils/logger.js';\nimport { hasValidTunnelConsent } from './consent.js';\nimport { resolveTunnelBrokerUrl, resolveTunnelRegistrationSecret } from './env.js';\nimport { getTunnelService } from './tunnel-service.js';\nimport { resolveFrpSubdomainHost } from './frp-subdomain-host.js';\nimport { fetchTunnelWellKnown } from './well-known.js';\n\nconst log = createLogger('Tunnel');\n\ntype TunnelEventSink = { emit(type: string, payload: unknown): void };\n\nlet tunnelSseWired = false;\n\n/** Publish `tunnel.status` on gateway SSE when tunnel lifecycle changes. */\nexport function wireTunnelEventsToGateway(service: TunnelEventSink): void {\n  if (tunnelSseWired) return;\n  tunnelSseWired = true;\n\n  const tunnel = getTunnelService();\n  const publish = () => {\n    service.emit('tunnel.status', tunnel.getStatus());\n  };\n\n  tunnel.on('tunnel:connecting', publish);\n  tunnel.on('tunnel:connected', publish);\n  tunnel.on('tunnel:disconnected', publish);\n  tunnel.on('tunnel:error', publish);\n  tunnel.on('tunnel:progress', publish);\n}\n\nexport type ConfigureTunnelFromGatewayConfigOptions = {\n  force?: boolean;\n  deferWellKnownFetch?: boolean;\n};\n\nfunction applyTunnelServiceFromGatewayConfig(config: Config, brokerUrl: string): void {\n  let registrationSecret: string;\n  try {\n    registrationSecret = resolveTunnelRegistrationSecret(\n      process.env,\n      brokerUrl,\n      config.tunnel?.registrationSecret,\n    );\n  } catch (err) {\n    const em = err instanceof Error ? err.message : String(err);\n    log.warn({ phase: 'tunnel_configure', errorMessage: em }, em);\n    throw err;\n  }\n\n  getTunnelService().configure({\n    brokerUrl,\n    registrationSecret,\n    autoStart: config.tunnel?.autoStart ?? false,\n    gatewayHost: resolveGatewayEffectiveHost(config),\n    frpSubdomainHost: resolveFrpSubdomainHost(brokerUrl),\n  });\n}\n\nasync function resolveBrokerUrlFromWellKnown(initialBrokerUrl: string): Promise<string> {\n  let brokerUrl = initialBrokerUrl;\n  try {\n    const wellKnown = await fetchTunnelWellKnown(brokerUrl);\n    if (wellKnown.brokerUrl?.trim()) {\n      brokerUrl = wellKnown.brokerUrl.trim();\n    }\n    if (wellKnown.transport?.tls === 'broker_terminated') {\n      log.debug({ brokerUrl, phase: 'tunnel_well_known' }, 'Broker uses wildcard TLS termination');\n    } else if (wellKnown.transport?.tls) {\n      log.warn(\n        { tls: wellKnown.transport.tls, phase: 'tunnel_well_known' },\n        'Unexpected broker transport mode — expect broker_terminated',\n      );\n    }\n  } catch (err) {\n    log.debug(\n      { err, brokerUrl, phase: 'tunnel_well_known' },\n      'Tunnel well-known fetch skipped (using config/env broker URL)',\n    );\n  }\n  return brokerUrl;\n}\n\nlet deferredWellKnownRefresh: Promise<void> | null = null;\n\nfunction scheduleDeferredWellKnownRefresh(config: Config, initialBrokerUrl: string): void {\n  if (deferredWellKnownRefresh) return;\n\n  deferredWellKnownRefresh = resolveBrokerUrlFromWellKnown(initialBrokerUrl)\n    .then((resolvedBrokerUrl) => {\n      if (resolvedBrokerUrl === initialBrokerUrl) return;\n      applyTunnelServiceFromGatewayConfig(config, resolvedBrokerUrl);\n    })\n    .catch((err) => {\n      const em = err instanceof Error ? err.message : String(err);\n      log.warn(\n        { err, phase: 'tunnel_well_known_deferred', errorMessage: em },\n        `Deferred tunnel well-known refresh failed: ${em}`,\n      );\n    })\n    .finally(() => {\n      deferredWellKnownRefresh = null;\n    });\n}\n\nexport async function configureTunnelFromGatewayConfig(\n  config: Config,\n  opts?: ConfigureTunnelFromGatewayConfigOptions,\n): Promise<void> {\n  if (!opts?.force && !config.tunnel?.enabled) return;\n\n  const initialBrokerUrl = resolveTunnelBrokerUrl(config.tunnel?.brokerUrl);\n\n  if (opts?.deferWellKnownFetch) {\n    applyTunnelServiceFromGatewayConfig(config, initialBrokerUrl);\n    scheduleDeferredWellKnownRefresh(config, initialBrokerUrl);\n    return;\n  }\n\n  if (deferredWellKnownRefresh) {\n    await deferredWellKnownRefresh;\n  }\n\n  const brokerUrl = await resolveBrokerUrlFromWellKnown(initialBrokerUrl);\n  applyTunnelServiceFromGatewayConfig(config, brokerUrl);\n}\n\nexport async function maybeAutoStartTunnelFromConfig(\n  config: Config,\n  gatewayToken: string | undefined,\n): Promise<void> {\n  if (!config.tunnel?.autoStart) return;\n\n  if (!hasValidTunnelConsent(config)) {\n    log.warn(\n      { phase: 'tunnel_autostart', consentVersion: config.tunnel?.consent?.version ?? null },\n      'tunnel.autoStart skipped: security consent required or outdated',\n    );\n    return;\n  }\n\n  if (config.tunnel.enabled !== true) {\n    log.debug(\n      { phase: 'tunnel_autostart' },\n      'tunnel.autoStart skipped: tunnel.enabled is false (start remote access once)',\n    );\n    return;\n  }\n\n  const gateway = config.gateway ?? {};\n  const port = gateway.port ?? 18790;\n  const host = resolveGatewayEffectiveHost(config);\n\n  await configureTunnelFromGatewayConfig(config);\n\n  if (!gatewayToken) {\n    log.warn(\n      { phase: 'tunnel_autostart' },\n      'tunnel.autoStart is enabled but gateway auth token is unavailable (auth mode may be none)',\n    );\n    return;\n  }\n\n  const tunnel = getTunnelService();\n  const { state } = tunnel.getStatus();\n  if (state === 'connected' || state === 'connecting' || state === 'reconnecting') {\n    log.debug({ phase: 'tunnel_autostart', state }, 'Tunnel already active — skip autostart');\n    return;\n  }\n\n  try {\n    await tunnel.start(port, gatewayToken);\n    log.info(\n      { phase: 'tunnel_autostart', host, port },\n      'Tunnel auto-started after gateway HTTP listen',\n    );\n  } catch (err) {\n    const em = err instanceof Error ? err.message : String(err);\n    log.error({ err, phase: 'tunnel_autostart', errorMessage: em }, `Tunnel autostart failed: ${em}`);\n  }\n}\n"],"mappings":";;;;;;;;;aAEkD;AAOlD,MAAM,MAAM,aAAa,SAAS;AAIlC,IAAI,iBAAiB;;AAGrB,SAAgB,0BAA0B,SAAgC;AACxE,KAAI,eAAgB;AACpB,kBAAiB;CAEjB,MAAM,SAAS,kBAAkB;CACjC,MAAM,gBAAgB;AACpB,UAAQ,KAAK,iBAAiB,OAAO,WAAW,CAAC;;AAGnD,QAAO,GAAG,qBAAqB,QAAQ;AACvC,QAAO,GAAG,oBAAoB,QAAQ;AACtC,QAAO,GAAG,uBAAuB,QAAQ;AACzC,QAAO,GAAG,gBAAgB,QAAQ;AAClC,QAAO,GAAG,mBAAmB,QAAQ;;AAQvC,SAAS,oCAAoC,QAAgB,WAAyB;CACpF,IAAI;AACJ,KAAI;AACF,uBAAqB,gCACnB,QAAQ,KACR,WACA,OAAO,QAAQ,mBAChB;UACM,KAAK;EACZ,MAAM,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC3D,MAAI,KAAK;GAAE,OAAO;GAAoB,cAAc;GAAI,EAAE,GAAG;AAC7D,QAAM;;AAGR,mBAAkB,CAAC,UAAU;EAC3B;EACA;EACA,WAAW,OAAO,QAAQ,aAAa;EACvC,aAAa,4BAA4B,OAAO;EAChD,kBAAkB,wBAAwB,UAAU;EACrD,CAAC;;AAGJ,eAAe,8BAA8B,kBAA2C;CACtF,IAAI,YAAY;AAChB,KAAI;EACF,MAAM,YAAY,MAAM,qBAAqB,UAAU;AACvD,MAAI,UAAU,WAAW,MAAM,CAC7B,aAAY,UAAU,UAAU,MAAM;AAExC,MAAI,UAAU,WAAW,QAAQ,oBAC/B,KAAI,MAAM;GAAE;GAAW,OAAO;GAAqB,EAAE,uCAAuC;WACnF,UAAU,WAAW,IAC9B,KAAI,KACF;GAAE,KAAK,UAAU,UAAU;GAAK,OAAO;GAAqB,EAC5D,8DACD;UAEI,KAAK;AACZ,MAAI,MACF;GAAE;GAAK;GAAW,OAAO;GAAqB,EAC9C,gEACD;;AAEH,QAAO;;AAGT,IAAI,2BAAiD;AAErD,SAAS,iCAAiC,QAAgB,kBAAgC;AACxF,KAAI,yBAA0B;AAE9B,4BAA2B,8BAA8B,iBAAiB,CACvE,MAAM,sBAAsB;AAC3B,MAAI,sBAAsB,iBAAkB;AAC5C,sCAAoC,QAAQ,kBAAkB;GAC9D,CACD,OAAO,QAAQ;EACd,MAAM,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC3D,MAAI,KACF;GAAE;GAAK,OAAO;GAA8B,cAAc;GAAI,EAC9D,8CAA8C,KAC/C;GACD,CACD,cAAc;AACb,6BAA2B;GAC3B;;AAGN,eAAsB,iCACpB,QACA,MACe;AACf,KAAI,CAAC,MAAM,SAAS,CAAC,OAAO,QAAQ,QAAS;CAE7C,MAAM,mBAAmB,uBAAuB,OAAO,QAAQ,UAAU;AAEzE,KAAI,MAAM,qBAAqB;AAC7B,sCAAoC,QAAQ,iBAAiB;AAC7D,mCAAiC,QAAQ,iBAAiB;AAC1D;;AAGF,KAAI,yBACF,OAAM;AAIR,qCAAoC,QAAQ,MADpB,8BAA8B,iBAAiB,CACjB;;AAGxD,eAAsB,+BACpB,QACA,cACe;AACf,KAAI,CAAC,OAAO,QAAQ,UAAW;AAE/B,KAAI,CAAC,sBAAsB,OAAO,EAAE;AAClC,MAAI,KACF;GAAE,OAAO;GAAoB,gBAAgB,OAAO,QAAQ,SAAS,WAAW;GAAM,EACtF,kEACD;AACD;;AAGF,KAAI,OAAO,OAAO,YAAY,MAAM;AAClC,MAAI,MACF,EAAE,OAAO,oBAAoB,EAC7B,+EACD;AACD;;CAIF,MAAM,QADU,OAAO,WAAW,EAAE,EACf,QAAQ;CAC7B,MAAM,OAAO,4BAA4B,OAAO;AAEhD,OAAM,iCAAiC,OAAO;AAE9C,KAAI,CAAC,cAAc;AACjB,MAAI,KACF,EAAE,OAAO,oBAAoB,EAC7B,4FACD;AACD;;CAGF,MAAM,SAAS,kBAAkB;CACjC,MAAM,EAAE,UAAU,OAAO,WAAW;AACpC,KAAI,UAAU,eAAe,UAAU,gBAAgB,UAAU,gBAAgB;AAC/E,MAAI,MAAM;GAAE,OAAO;GAAoB;GAAO,EAAE,yCAAyC;AACzF;;AAGF,KAAI;AACF,QAAM,OAAO,MAAM,MAAM,aAAa;AACtC,MAAI,KACF;GAAE,OAAO;GAAoB;GAAM;GAAM,EACzC,gDACD;UACM,KAAK;EACZ,MAAM,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC3D,MAAI,MAAM;GAAE;GAAK,OAAO;GAAoB,cAAc;GAAI,EAAE,4BAA4B,KAAK"}

package/dist/src/tunnel/index.d.ts

@@ -5,6 +5,7 @@ export { clearFrpcPathForProcess, ensureFrpcBinary, FRPC_VERSION, publishFrpcPat
 export type { EnsureFrpcBinaryOptions, FrpcDownloadProgress } from './frpc-binary.js';
 export { configureTunnelFromGatewayConfig, maybeAutoStartTunnelFromConfig, wireTunnelEventsToGateway, } from './gateway-lifecycle.js';
 export { fetchTunnelWellKnown, clearTunnelWellKnownCache } from './well-known.js';
+export type { TunnelWellKnownConfig, TunnelWellKnownTransport } from './well-known.js';
 export { getTunnelRegistrationSecretMeta, isProductionTunnelBroker, isMaskedTunnelSecretPatchValue, resolveTunnelBrokerUrl, resolveTunnelRegistrationSecret, } from './env.js';
 export type { TunnelRegistrationSecretMeta, TunnelRegistrationSecretSource } from './env.js';
 export { logTunnelAudit } from './tunnel-audit.js';
@@ -12,10 +13,7 @@ export type { TunnelAuditEvent } from './tunnel-audit.js';
 export { consumeTunnelMutationLimit, resetTunnelMutationLimitsForTests } from './tunnel-rate-limit.js';
 export { getTunnelService, hashGatewayToken, TunnelService } from './tunnel-service.js';
 export type { TunnelServiceConfig } from './tunnel-service.js';
-export { resolveFrpSubdomainHost, resolveTunnelE2eConfig } from './tunnel-e2e-config.js';
-export type { ResolvedTunnelE2eConfig } from './tunnel-e2e-config.js';
-export { getCertStatusSummary, subscribeCertStatus, recordRenewalFailure } from './acme-cert-store.js';
-export { getActiveTlsCert, stopTunnelTlsServer } from './tls-server.js';
+export { resolveFrpSubdomainHost } from './frp-subdomain-host.js';
 export { createPairingSecret, consumePairingSecret, resetPairingSessionsForTests } from './pairing.js';
 export type { PairingSecretResult } from './pairing.js';
 export { buildMobileConnectQrPayload, resolveLanGatewayUrl } from './tunnel-qr.js';

package/dist/src/tunnel/index.js

@@ -1,5 +1,4 @@
 import { CURRENT_TUNNEL_CONSENT_VERSION, TUNNEL_CONSENT_REQUIRED_CODE, TUNNEL_RISK_SUMMARY_LINES, TunnelConsentError, assertTunnelMayStart, getTunnelConsentState, hasValidTunnelConsent } from "./consent.js";
-import { getCertStatusSummary, recordRenewalFailure, subscribeCertStatus } from "./acme-cert-store.js";
 import { getTunnelRegistrationSecretMeta, isMaskedTunnelSecretPatchValue, isProductionTunnelBroker, resolveTunnelBrokerUrl, resolveTunnelRegistrationSecret } from "./env.js";
 import { TunnelBrokerClient, resolveBrokerApiBase } from "./broker-client.js";
 import { FRPC_VERSION, clearFrpcPathForProcess, ensureFrpcBinary, publishFrpcPathForProcess } from "./frpc-binary.js";
@@ -7,11 +6,10 @@ import { buildMobileConnectQrPayload, resolveLanGatewayUrl } from "./tunnel-qr.j
 import { consumePairingSecret, createPairingSecret, resetPairingSessionsForTests } from "./pairing.js";
 import { loadTunnelState, resolveTunnelStatePath, saveTunnelState } from "./tunnel-state.js";
 import { logTunnelAudit } from "./tunnel-audit.js";
-import { getActiveTlsCert, stopTunnelTlsServer } from "./tls-server.js";
 import { TunnelService, getTunnelService, hashGatewayToken } from "./tunnel-service.js";
-import { resolveFrpSubdomainHost, resolveTunnelE2eConfig } from "./tunnel-e2e-config.js";
+import { resolveFrpSubdomainHost } from "./frp-subdomain-host.js";
 import { clearTunnelWellKnownCache, fetchTunnelWellKnown } from "./well-known.js";
 import { configureTunnelFromGatewayConfig, maybeAutoStartTunnelFromConfig, wireTunnelEventsToGateway } from "./gateway-lifecycle.js";
 import { applyTunnelConsentToConfig, mergeTunnelConfigPatch, sanitizeTunnelConfig, setTunnelEnabledInConfig } from "./tunnel-config.js";
 import { consumeTunnelMutationLimit, resetTunnelMutationLimitsForTests } from "./tunnel-rate-limit.js";
-export { CURRENT_TUNNEL_CONSENT_VERSION, FRPC_VERSION, TUNNEL_CONSENT_REQUIRED_CODE, TUNNEL_RISK_SUMMARY_LINES, TunnelBrokerClient, TunnelConsentError, TunnelService, applyTunnelConsentToConfig, assertTunnelMayStart, buildMobileConnectQrPayload, clearFrpcPathForProcess, clearTunnelWellKnownCache, configureTunnelFromGatewayConfig, consumePairingSecret, consumeTunnelMutationLimit, createPairingSecret, ensureFrpcBinary, fetchTunnelWellKnown, getActiveTlsCert, getCertStatusSummary, getTunnelConsentState, getTunnelRegistrationSecretMeta, getTunnelService, hasValidTunnelConsent, hashGatewayToken, isMaskedTunnelSecretPatchValue, isProductionTunnelBroker, loadTunnelState, logTunnelAudit, maybeAutoStartTunnelFromConfig, mergeTunnelConfigPatch, publishFrpcPathForProcess, recordRenewalFailure, resetPairingSessionsForTests, resetTunnelMutationLimitsForTests, resolveBrokerApiBase, resolveFrpSubdomainHost, resolveLanGatewayUrl, resolveTunnelBrokerUrl, resolveTunnelE2eConfig, resolveTunnelRegistrationSecret, resolveTunnelStatePath, sanitizeTunnelConfig, saveTunnelState, setTunnelEnabledInConfig, stopTunnelTlsServer, subscribeCertStatus, wireTunnelEventsToGateway };
+export { CURRENT_TUNNEL_CONSENT_VERSION, FRPC_VERSION, TUNNEL_CONSENT_REQUIRED_CODE, TUNNEL_RISK_SUMMARY_LINES, TunnelBrokerClient, TunnelConsentError, TunnelService, applyTunnelConsentToConfig, assertTunnelMayStart, buildMobileConnectQrPayload, clearFrpcPathForProcess, clearTunnelWellKnownCache, configureTunnelFromGatewayConfig, consumePairingSecret, consumeTunnelMutationLimit, createPairingSecret, ensureFrpcBinary, fetchTunnelWellKnown, getTunnelConsentState, getTunnelRegistrationSecretMeta, getTunnelService, hasValidTunnelConsent, hashGatewayToken, isMaskedTunnelSecretPatchValue, isProductionTunnelBroker, loadTunnelState, logTunnelAudit, maybeAutoStartTunnelFromConfig, mergeTunnelConfigPatch, publishFrpcPathForProcess, resetPairingSessionsForTests, resetTunnelMutationLimitsForTests, resolveBrokerApiBase, resolveFrpSubdomainHost, resolveLanGatewayUrl, resolveTunnelBrokerUrl, resolveTunnelRegistrationSecret, resolveTunnelStatePath, sanitizeTunnelConfig, saveTunnelState, setTunnelEnabledInConfig, wireTunnelEventsToGateway };

package/dist/src/tunnel/pair-url.js

@@ -60,7 +60,13 @@ function parseMobileConnectDeepLink(raw) {
 		const u = new URL(trimmed);
 		if (u.protocol !== "xopc:" || u.hostname !== "gateway" || u.pathname !== "/mobile-connect") return null;
 		const baseUrl = u.searchParams.get("baseUrl")?.trim() ?? "";
-		const pairingSecret = u.searchParams.get("ps")?.trim() ?? "";
+		const psRaw = u.searchParams.get("ps")?.trim() ?? "";
+		let pairingSecret = psRaw;
+		if (psRaw) try {
+			pairingSecret = decodeURIComponent(psRaw);
+		} catch {
+			pairingSecret = psRaw;
+		}
 		if (!baseUrl || !pairingSecret) return null;
 		const lanRaw = u.searchParams.get("lanUrl")?.trim() ?? "";
 		const lanUrl = lanRaw ? normalizeGatewayBaseUrl(lanRaw) : null;

package/dist/src/tunnel/pair-url.js.map

@@ -1 +1 @@
-{"version":3,"file":"pair-url.js","names":[],"sources":["../../../src/tunnel/pair-url.ts"],"sourcesContent":["import net from 'node:net';\n\nimport { isNetworkAccessibleBindHost, resolveGatewayEffectiveHost } from '../config/gateway-bind.js';\nimport type { Config } from '../config/schema.js';\nimport { enumerateLanGatewayCandidates } from './tunnel-qr.js';\n\nexport type MobilePairUrlValidationCode = 'INVALID_URL' | 'LOOPBACK_NOT_REACHABLE';\n\nexport type MobilePairUrlValidationResult =\n  | { ok: true; url: string; loopback: false }\n  | { ok: false; code: MobilePairUrlValidationCode; message: string };\n\n/** Normalize a gateway root URL (no trailing slash, no path). */\nexport function normalizeGatewayBaseUrl(raw: string): string | null {\n  const trimmed = raw.trim();\n  if (!trimmed) return null;\n  try {\n    const u = new URL(trimmed);\n    if (u.protocol !== 'http:' && u.protocol !== 'https:') {\n      return null;\n    }\n    if (u.username || u.password) return null;\n    if (u.pathname && u.pathname !== '/') return null;\n    if (u.search || u.hash) return null;\n    const portSuffix = u.port ? `:${u.port}` : '';\n    return `${u.protocol}//${u.hostname}${portSuffix}`;\n  } catch {\n    return null;\n  }\n}\n\n/** True when a phone on the network cannot reach this gateway root URL. */\nexport function isLoopbackGatewayBaseUrl(raw: string): boolean {\n  const normalized = normalizeGatewayBaseUrl(raw);\n  if (!normalized) return false;\n  try {\n    const u = new URL(normalized);\n    const host = u.hostname.trim().toLowerCase();\n    if (host === 'localhost' || host === '127.0.0.1' || host === '::1' || host === '[::1]') {\n      return true;\n    }\n    const ipVersion = net.isIP(host);\n    if (ipVersion === 4) {\n      const parts = host.split('.').map((p) => Number(p));\n      if (parts.length === 4 && parts.every((n) => Number.isInteger(n)) && parts[0] === 127) {\n        return true;\n      }\n    }\n    return false;\n  } catch {\n    return false;\n  }\n}\n\nexport function validateMobilePairBaseUrl(raw: string): MobilePairUrlValidationResult {\n  const url = normalizeGatewayBaseUrl(raw);\n  if (!url) {\n    return {\n      ok: false,\n      code: 'INVALID_URL',\n      message: 'Enter an absolute gateway URL starting with http:// or https:// (no path).',\n    };\n  }\n  if (isLoopbackGatewayBaseUrl(url)) {\n    return {\n      ok: false,\n      code: 'LOOPBACK_NOT_REACHABLE',\n      message:\n        '127.0.0.1 and localhost only work on the gateway machine. Use a LAN IP or tunnel URL instead.',\n    };\n  }\n  return { ok: true, url, loopback: false };\n}\n\nexport type ParsedMobileConnectDeepLink = {\n  baseUrl: string;\n  lanUrl: string | null;\n  pairingSecret: string;\n};\n\n/** Parse `xopc://gateway/mobile-connect?...` payloads from QR codes. */\nexport function parseMobileConnectDeepLink(raw: string): ParsedMobileConnectDeepLink | null {\n  const trimmed = raw.trim();\n  if (!trimmed) return null;\n  try {\n    const u = new URL(trimmed);\n    if (u.protocol !== 'xopc:' || u.hostname !== 'gateway' || u.pathname !== '/mobile-connect') {\n      return null;\n    }\n    const baseUrl = u.searchParams.get('baseUrl')?.trim() ?? '';\n    const pairingSecret = u.searchParams.get('ps')?.trim() ?? '';\n    if (!baseUrl || !pairingSecret) return null;\n    const lanRaw = u.searchParams.get('lanUrl')?.trim() ?? '';\n    const lanUrl = lanRaw ? normalizeGatewayBaseUrl(lanRaw) : null;\n    const normalizedBase = normalizeGatewayBaseUrl(baseUrl);\n    if (!normalizedBase) return null;\n    return {\n      baseUrl: normalizedBase,\n      lanUrl,\n      pairingSecret,\n    };\n  } catch {\n    return null;\n  }\n}\n\n/** Ordered URLs for mobile clients: prefer LAN on the same network, then tunnel/base. */\nexport function buildMobileConnectUrlOrder(params: {\n  baseUrl: string | null | undefined;\n  lanUrl: string | null | undefined;\n}): string[] {\n  const ordered: string[] = [];\n  const seen = new Set<string>();\n\n  const push = (raw: string | null | undefined) => {\n    const url = raw ? normalizeGatewayBaseUrl(raw) : null;\n    if (!url || isLoopbackGatewayBaseUrl(url) || seen.has(url)) return;\n    seen.add(url);\n    ordered.push(url);\n  };\n\n  push(params.lanUrl);\n  push(params.baseUrl);\n  return ordered;\n}\n\n/** First LAN URL when the gateway listens on a network-accessible bind host. */\nexport function resolveMobilePairLanUrl(config: Config): string | null {\n  const listenHost = resolveGatewayEffectiveHost(config);\n  if (!isNetworkAccessibleBindHost(listenHost)) return null;\n  const port = config.gateway?.port ?? 18790;\n  return enumerateLanGatewayCandidates(port)[0]?.url ?? null;\n}\n"],"mappings":";;;;;AAaA,SAAgB,wBAAwB,KAA4B;CAClE,MAAM,UAAU,IAAI,MAAM;AAC1B,KAAI,CAAC,QAAS,QAAO;AACrB,KAAI;EACF,MAAM,IAAI,IAAI,IAAI,QAAQ;AAC1B,MAAI,EAAE,aAAa,WAAW,EAAE,aAAa,SAC3C,QAAO;AAET,MAAI,EAAE,YAAY,EAAE,SAAU,QAAO;AACrC,MAAI,EAAE,YAAY,EAAE,aAAa,IAAK,QAAO;AAC7C,MAAI,EAAE,UAAU,EAAE,KAAM,QAAO;EAC/B,MAAM,aAAa,EAAE,OAAO,IAAI,EAAE,SAAS;AAC3C,SAAO,GAAG,EAAE,SAAS,IAAI,EAAE,WAAW;SAChC;AACN,SAAO;;;;AAKX,SAAgB,yBAAyB,KAAsB;CAC7D,MAAM,aAAa,wBAAwB,IAAI;AAC/C,KAAI,CAAC,WAAY,QAAO;AACxB,KAAI;EAEF,MAAM,OAAO,IADC,IAAI,WACJ,CAAC,SAAS,MAAM,CAAC,aAAa;AAC5C,MAAI,SAAS,eAAe,SAAS,eAAe,SAAS,SAAS,SAAS,QAC7E,QAAO;AAGT,MADkB,IAAI,KAAK,KACd,KAAK,GAAG;GACnB,MAAM,QAAQ,KAAK,MAAM,IAAI,CAAC,KAAK,MAAM,OAAO,EAAE,CAAC;AACnD,OAAI,MAAM,WAAW,KAAK,MAAM,OAAO,MAAM,OAAO,UAAU,EAAE,CAAC,IAAI,MAAM,OAAO,IAChF,QAAO;;AAGX,SAAO;SACD;AACN,SAAO;;;AAIX,SAAgB,0BAA0B,KAA4C;CACpF,MAAM,MAAM,wBAAwB,IAAI;AACxC,KAAI,CAAC,IACH,QAAO;EACL,IAAI;EACJ,MAAM;EACN,SAAS;EACV;AAEH,KAAI,yBAAyB,IAAI,CAC/B,QAAO;EACL,IAAI;EACJ,MAAM;EACN,SACE;EACH;AAEH,QAAO;EAAE,IAAI;EAAM;EAAK,UAAU;EAAO;;;AAU3C,SAAgB,2BAA2B,KAAiD;CAC1F,MAAM,UAAU,IAAI,MAAM;AAC1B,KAAI,CAAC,QAAS,QAAO;AACrB,KAAI;EACF,MAAM,IAAI,IAAI,IAAI,QAAQ;AAC1B,MAAI,EAAE,aAAa,WAAW,EAAE,aAAa,aAAa,EAAE,aAAa,kBACvE,QAAO;EAET,MAAM,UAAU,EAAE,aAAa,IAAI,UAAU,EAAE,MAAM,IAAI;EACzD,MAAM,gBAAgB,EAAE,aAAa,IAAI,KAAK,EAAE,MAAM,IAAI;AAC1D,MAAI,CAAC,WAAW,CAAC,cAAe,QAAO;EACvC,MAAM,SAAS,EAAE,aAAa,IAAI,SAAS,EAAE,MAAM,IAAI;EACvD,MAAM,SAAS,SAAS,wBAAwB,OAAO,GAAG;EAC1D,MAAM,iBAAiB,wBAAwB,QAAQ;AACvD,MAAI,CAAC,eAAgB,QAAO;AAC5B,SAAO;GACL,SAAS;GACT;GACA;GACD;SACK;AACN,SAAO;;;;AAKX,SAAgB,2BAA2B,QAG9B;CACX,MAAM,UAAoB,EAAE;CAC5B,MAAM,uBAAO,IAAI,KAAa;CAE9B,MAAM,QAAQ,QAAmC;EAC/C,MAAM,MAAM,MAAM,wBAAwB,IAAI,GAAG;AACjD,MAAI,CAAC,OAAO,yBAAyB,IAAI,IAAI,KAAK,IAAI,IAAI,CAAE;AAC5D,OAAK,IAAI,IAAI;AACb,UAAQ,KAAK,IAAI;;AAGnB,MAAK,OAAO,OAAO;AACnB,MAAK,OAAO,QAAQ;AACpB,QAAO;;;AAIT,SAAgB,wBAAwB,QAA+B;AAErE,KAAI,CAAC,4BADc,4BAA4B,OACJ,CAAC,CAAE,QAAO;AAErD,QAAO,8BADM,OAAO,SAAS,QAAQ,MACK,CAAC,IAAI,OAAO"}
+{"version":3,"file":"pair-url.js","names":[],"sources":["../../../src/tunnel/pair-url.ts"],"sourcesContent":["import net from 'node:net';\n\nimport { isNetworkAccessibleBindHost, resolveGatewayEffectiveHost } from '../config/gateway-bind.js';\nimport type { Config } from '../config/schema.js';\nimport { enumerateLanGatewayCandidates } from './tunnel-qr.js';\n\nexport type MobilePairUrlValidationCode = 'INVALID_URL' | 'LOOPBACK_NOT_REACHABLE';\n\nexport type MobilePairUrlValidationResult =\n  | { ok: true; url: string; loopback: false }\n  | { ok: false; code: MobilePairUrlValidationCode; message: string };\n\n/** Normalize a gateway root URL (no trailing slash, no path). */\nexport function normalizeGatewayBaseUrl(raw: string): string | null {\n  const trimmed = raw.trim();\n  if (!trimmed) return null;\n  try {\n    const u = new URL(trimmed);\n    if (u.protocol !== 'http:' && u.protocol !== 'https:') {\n      return null;\n    }\n    if (u.username || u.password) return null;\n    if (u.pathname && u.pathname !== '/') return null;\n    if (u.search || u.hash) return null;\n    const portSuffix = u.port ? `:${u.port}` : '';\n    return `${u.protocol}//${u.hostname}${portSuffix}`;\n  } catch {\n    return null;\n  }\n}\n\n/** True when a phone on the network cannot reach this gateway root URL. */\nexport function isLoopbackGatewayBaseUrl(raw: string): boolean {\n  const normalized = normalizeGatewayBaseUrl(raw);\n  if (!normalized) return false;\n  try {\n    const u = new URL(normalized);\n    const host = u.hostname.trim().toLowerCase();\n    if (host === 'localhost' || host === '127.0.0.1' || host === '::1' || host === '[::1]') {\n      return true;\n    }\n    const ipVersion = net.isIP(host);\n    if (ipVersion === 4) {\n      const parts = host.split('.').map((p) => Number(p));\n      if (parts.length === 4 && parts.every((n) => Number.isInteger(n)) && parts[0] === 127) {\n        return true;\n      }\n    }\n    return false;\n  } catch {\n    return false;\n  }\n}\n\nexport function validateMobilePairBaseUrl(raw: string): MobilePairUrlValidationResult {\n  const url = normalizeGatewayBaseUrl(raw);\n  if (!url) {\n    return {\n      ok: false,\n      code: 'INVALID_URL',\n      message: 'Enter an absolute gateway URL starting with http:// or https:// (no path).',\n    };\n  }\n  if (isLoopbackGatewayBaseUrl(url)) {\n    return {\n      ok: false,\n      code: 'LOOPBACK_NOT_REACHABLE',\n      message:\n        '127.0.0.1 and localhost only work on the gateway machine. Use a LAN IP or tunnel URL instead.',\n    };\n  }\n  return { ok: true, url, loopback: false };\n}\n\nexport type ParsedMobileConnectDeepLink = {\n  baseUrl: string;\n  lanUrl: string | null;\n  pairingSecret: string;\n};\n\n/** Parse `xopc://gateway/mobile-connect?...` payloads from QR codes. */\nexport function parseMobileConnectDeepLink(raw: string): ParsedMobileConnectDeepLink | null {\n  const trimmed = raw.trim();\n  if (!trimmed) return null;\n  try {\n    const u = new URL(trimmed);\n    if (u.protocol !== 'xopc:' || u.hostname !== 'gateway' || u.pathname !== '/mobile-connect') {\n      return null;\n    }\n    const baseUrl = u.searchParams.get('baseUrl')?.trim() ?? '';\n    const psRaw = u.searchParams.get('ps')?.trim() ?? '';\n    let pairingSecret = psRaw;\n    if (psRaw) {\n      try {\n        pairingSecret = decodeURIComponent(psRaw);\n      } catch {\n        pairingSecret = psRaw;\n      }\n    }\n    if (!baseUrl || !pairingSecret) return null;\n    const lanRaw = u.searchParams.get('lanUrl')?.trim() ?? '';\n    const lanUrl = lanRaw ? normalizeGatewayBaseUrl(lanRaw) : null;\n    const normalizedBase = normalizeGatewayBaseUrl(baseUrl);\n    if (!normalizedBase) return null;\n    return {\n      baseUrl: normalizedBase,\n      lanUrl,\n      pairingSecret,\n    };\n  } catch {\n    return null;\n  }\n}\n\n/** Ordered URLs for mobile clients: prefer LAN on the same network, then tunnel/base. */\nexport function buildMobileConnectUrlOrder(params: {\n  baseUrl: string | null | undefined;\n  lanUrl: string | null | undefined;\n}): string[] {\n  const ordered: string[] = [];\n  const seen = new Set<string>();\n\n  const push = (raw: string | null | undefined) => {\n    const url = raw ? normalizeGatewayBaseUrl(raw) : null;\n    if (!url || isLoopbackGatewayBaseUrl(url) || seen.has(url)) return;\n    seen.add(url);\n    ordered.push(url);\n  };\n\n  push(params.lanUrl);\n  push(params.baseUrl);\n  return ordered;\n}\n\n/** First LAN URL when the gateway listens on a network-accessible bind host. */\nexport function resolveMobilePairLanUrl(config: Config): string | null {\n  const listenHost = resolveGatewayEffectiveHost(config);\n  if (!isNetworkAccessibleBindHost(listenHost)) return null;\n  const port = config.gateway?.port ?? 18790;\n  return enumerateLanGatewayCandidates(port)[0]?.url ?? null;\n}\n"],"mappings":";;;;;AAaA,SAAgB,wBAAwB,KAA4B;CAClE,MAAM,UAAU,IAAI,MAAM;AAC1B,KAAI,CAAC,QAAS,QAAO;AACrB,KAAI;EACF,MAAM,IAAI,IAAI,IAAI,QAAQ;AAC1B,MAAI,EAAE,aAAa,WAAW,EAAE,aAAa,SAC3C,QAAO;AAET,MAAI,EAAE,YAAY,EAAE,SAAU,QAAO;AACrC,MAAI,EAAE,YAAY,EAAE,aAAa,IAAK,QAAO;AAC7C,MAAI,EAAE,UAAU,EAAE,KAAM,QAAO;EAC/B,MAAM,aAAa,EAAE,OAAO,IAAI,EAAE,SAAS;AAC3C,SAAO,GAAG,EAAE,SAAS,IAAI,EAAE,WAAW;SAChC;AACN,SAAO;;;;AAKX,SAAgB,yBAAyB,KAAsB;CAC7D,MAAM,aAAa,wBAAwB,IAAI;AAC/C,KAAI,CAAC,WAAY,QAAO;AACxB,KAAI;EAEF,MAAM,OAAO,IADC,IAAI,WACJ,CAAC,SAAS,MAAM,CAAC,aAAa;AAC5C,MAAI,SAAS,eAAe,SAAS,eAAe,SAAS,SAAS,SAAS,QAC7E,QAAO;AAGT,MADkB,IAAI,KAAK,KACd,KAAK,GAAG;GACnB,MAAM,QAAQ,KAAK,MAAM,IAAI,CAAC,KAAK,MAAM,OAAO,EAAE,CAAC;AACnD,OAAI,MAAM,WAAW,KAAK,MAAM,OAAO,MAAM,OAAO,UAAU,EAAE,CAAC,IAAI,MAAM,OAAO,IAChF,QAAO;;AAGX,SAAO;SACD;AACN,SAAO;;;AAIX,SAAgB,0BAA0B,KAA4C;CACpF,MAAM,MAAM,wBAAwB,IAAI;AACxC,KAAI,CAAC,IACH,QAAO;EACL,IAAI;EACJ,MAAM;EACN,SAAS;EACV;AAEH,KAAI,yBAAyB,IAAI,CAC/B,QAAO;EACL,IAAI;EACJ,MAAM;EACN,SACE;EACH;AAEH,QAAO;EAAE,IAAI;EAAM;EAAK,UAAU;EAAO;;;AAU3C,SAAgB,2BAA2B,KAAiD;CAC1F,MAAM,UAAU,IAAI,MAAM;AAC1B,KAAI,CAAC,QAAS,QAAO;AACrB,KAAI;EACF,MAAM,IAAI,IAAI,IAAI,QAAQ;AAC1B,MAAI,EAAE,aAAa,WAAW,EAAE,aAAa,aAAa,EAAE,aAAa,kBACvE,QAAO;EAET,MAAM,UAAU,EAAE,aAAa,IAAI,UAAU,EAAE,MAAM,IAAI;EACzD,MAAM,QAAQ,EAAE,aAAa,IAAI,KAAK,EAAE,MAAM,IAAI;EAClD,IAAI,gBAAgB;AACpB,MAAI,MACF,KAAI;AACF,mBAAgB,mBAAmB,MAAM;UACnC;AACN,mBAAgB;;AAGpB,MAAI,CAAC,WAAW,CAAC,cAAe,QAAO;EACvC,MAAM,SAAS,EAAE,aAAa,IAAI,SAAS,EAAE,MAAM,IAAI;EACvD,MAAM,SAAS,SAAS,wBAAwB,OAAO,GAAG;EAC1D,MAAM,iBAAiB,wBAAwB,QAAQ;AACvD,MAAI,CAAC,eAAgB,QAAO;AAC5B,SAAO;GACL,SAAS;GACT;GACA;GACD;SACK;AACN,SAAO;;;;AAKX,SAAgB,2BAA2B,QAG9B;CACX,MAAM,UAAoB,EAAE;CAC5B,MAAM,uBAAO,IAAI,KAAa;CAE9B,MAAM,QAAQ,QAAmC;EAC/C,MAAM,MAAM,MAAM,wBAAwB,IAAI,GAAG;AACjD,MAAI,CAAC,OAAO,yBAAyB,IAAI,IAAI,KAAK,IAAI,IAAI,CAAE;AAC5D,OAAK,IAAI,IAAI;AACb,UAAQ,KAAK,IAAI;;AAGnB,MAAK,OAAO,OAAO;AACnB,MAAK,OAAO,QAAQ;AACpB,QAAO;;;AAIT,SAAgB,wBAAwB,QAA+B;AAErE,KAAI,CAAC,4BADc,4BAA4B,OACJ,CAAC,CAAE,QAAO;AAErD,QAAO,8BADM,OAAO,SAAS,QAAQ,MACK,CAAC,IAAI,OAAO"}

package/dist/src/tunnel/pairing.d.ts

@@ -2,6 +2,19 @@ export type PairingSecretResult = {
     secret: string;
     expiresAt: Date;
 };
+export type PairingExchangePayload = {
+    token: string;
+    baseUrl: string | null;
+    lanUrl: string | null;
+    connectUrls: string[];
+};
+export declare function cachePairingExchange(secret: string, payload: PairingExchangePayload): void;
+export declare function getCachedPairingExchange(secret: string): PairingExchangePayload | null;
+/**
+ * Consume a pairing secret once and build the exchange payload.
+ * Concurrent requests for the same secret share one in-flight exchange (mobile cold-start deeplink).
+ */
+export declare function exchangePairingSecretOnce(secret: string, buildPayload: () => PairingExchangePayload): Promise<PairingExchangePayload | null>;
 export declare function createPairingSecret(): PairingSecretResult;
 export declare function consumePairingSecret(secret: string): boolean;
 /** @internal */

package/dist/src/tunnel/pairing.js

@@ -16,6 +16,51 @@ function ensureCleanupTimer() {
 	}, CLEANUP_INTERVAL_MS);
 	cleanupTimer.unref?.();
 }
+const EXCHANGE_REPLAY_MS = 6e4;
+const exchangeReplayCache = /* @__PURE__ */ new Map();
+function cachePairingExchange(secret, payload) {
+	exchangeReplayCache.set(secret, {
+		expiresAt: Date.now() + EXCHANGE_REPLAY_MS,
+		payload
+	});
+}
+function getCachedPairingExchange(secret) {
+	const entry = exchangeReplayCache.get(secret);
+	if (!entry) return null;
+	if (Date.now() > entry.expiresAt) {
+		exchangeReplayCache.delete(secret);
+		return null;
+	}
+	return entry.payload;
+}
+const inflightExchanges = /* @__PURE__ */ new Map();
+/**
+* Consume a pairing secret once and build the exchange payload.
+* Concurrent requests for the same secret share one in-flight exchange (mobile cold-start deeplink).
+*/
+async function exchangePairingSecretOnce(secret, buildPayload) {
+	const key = secret.trim();
+	if (!key) return null;
+	const replay = getCachedPairingExchange(key);
+	if (replay) return replay;
+	let inflight = inflightExchanges.get(key);
+	if (!inflight) {
+		inflight = (async () => {
+			const cached = getCachedPairingExchange(key);
+			if (cached) return cached;
+			if (!consumePairingSecret(key)) return getCachedPairingExchange(key);
+			const payload = buildPayload();
+			cachePairingExchange(key, payload);
+			return payload;
+		})();
+		inflightExchanges.set(key, inflight);
+	}
+	try {
+		return await inflight;
+	} finally {
+		if (inflightExchanges.get(key) === inflight) inflightExchanges.delete(key);
+	}
+}
 function createPairingSecret() {
 	ensureCleanupTimer();
 	const secret = randomBytes(32).toString("base64url");
@@ -47,12 +92,14 @@ function consumePairingSecret(secret) {
 /** @internal */
 function resetPairingSessionsForTests() {
 	sessions.clear();
+	exchangeReplayCache.clear();
+	inflightExchanges.clear();
 	if (cleanupTimer) {
 		clearInterval(cleanupTimer);
 		cleanupTimer = null;
 	}
 }
 //#endregion
-export { consumePairingSecret, createPairingSecret, resetPairingSessionsForTests };
+export { cachePairingExchange, consumePairingSecret, createPairingSecret, exchangePairingSecretOnce, getCachedPairingExchange, resetPairingSessionsForTests };
 
 //# sourceMappingURL=pairing.js.map

package/dist/src/tunnel/pairing.js.map

@@ -1 +1 @@
-{"version":3,"file":"pairing.js","names":[],"sources":["../../../src/tunnel/pairing.ts"],"sourcesContent":["import { randomBytes } from 'node:crypto';\n\nimport { createLogger } from '../utils/logger.js';\n\nconst log = createLogger('TunnelPairing');\n\nconst PAIRING_TTL_MS = 5 * 60_000;\nconst CLEANUP_INTERVAL_MS = 60_000;\n\ntype PairingSession = {\n  expiresAt: Date;\n  consumed: boolean;\n};\n\nconst sessions = new Map<string, PairingSession>();\n\nlet cleanupTimer: ReturnType<typeof setInterval> | null = null;\n\nfunction ensureCleanupTimer(): void {\n  if (cleanupTimer) return;\n  cleanupTimer = setInterval(() => {\n    const now = Date.now();\n    for (const [key, session] of sessions) {\n      if (now > session.expiresAt.getTime()) sessions.delete(key);\n    }\n  }, CLEANUP_INTERVAL_MS);\n  cleanupTimer.unref?.();\n}\n\nexport type PairingSecretResult = {\n  secret: string;\n  expiresAt: Date;\n};\n\nexport function createPairingSecret(): PairingSecretResult {\n  ensureCleanupTimer();\n  const secret = randomBytes(32).toString('base64url');\n  const expiresAt = new Date(Date.now() + PAIRING_TTL_MS);\n  sessions.set(secret, { expiresAt, consumed: false });\n  log.info({ expiresAt: expiresAt.toISOString() }, 'Pairing session created');\n  return { secret, expiresAt };\n}\n\nexport function consumePairingSecret(secret: string): boolean {\n  if (!secret.trim()) return false;\n  const session = sessions.get(secret);\n  if (!session) return false;\n  if (session.consumed) return false;\n  if (Date.now() > session.expiresAt.getTime()) {\n    sessions.delete(secret);\n    return false;\n  }\n  session.consumed = true;\n  sessions.delete(secret);\n  log.info('Pairing session consumed');\n  return true;\n}\n\n/** @internal */\nexport function resetPairingSessionsForTests(): void {\n  sessions.clear();\n  if (cleanupTimer) {\n    clearInterval(cleanupTimer);\n    cleanupTimer = null;\n  }\n}\n"],"mappings":";;;;aAEkD;AAElD,MAAM,MAAM,aAAa,gBAAgB;AAEzC,MAAM,iBAAiB,IAAI;AAC3B,MAAM,sBAAsB;AAO5B,MAAM,2BAAW,IAAI,KAA6B;AAElD,IAAI,eAAsD;AAE1D,SAAS,qBAA2B;AAClC,KAAI,aAAc;AAClB,gBAAe,kBAAkB;EAC/B,MAAM,MAAM,KAAK,KAAK;AACtB,OAAK,MAAM,CAAC,KAAK,YAAY,SAC3B,KAAI,MAAM,QAAQ,UAAU,SAAS,CAAE,UAAS,OAAO,IAAI;IAE5D,oBAAoB;AACvB,cAAa,SAAS;;AAQxB,SAAgB,sBAA2C;AACzD,qBAAoB;CACpB,MAAM,SAAS,YAAY,GAAG,CAAC,SAAS,YAAY;CACpD,MAAM,YAAY,IAAI,KAAK,KAAK,KAAK,GAAG,eAAe;AACvD,UAAS,IAAI,QAAQ;EAAE;EAAW,UAAU;EAAO,CAAC;AACpD,KAAI,KAAK,EAAE,WAAW,UAAU,aAAa,EAAE,EAAE,0BAA0B;AAC3E,QAAO;EAAE;EAAQ;EAAW;;AAG9B,SAAgB,qBAAqB,QAAyB;AAC5D,KAAI,CAAC,OAAO,MAAM,CAAE,QAAO;CAC3B,MAAM,UAAU,SAAS,IAAI,OAAO;AACpC,KAAI,CAAC,QAAS,QAAO;AACrB,KAAI,QAAQ,SAAU,QAAO;AAC7B,KAAI,KAAK,KAAK,GAAG,QAAQ,UAAU,SAAS,EAAE;AAC5C,WAAS,OAAO,OAAO;AACvB,SAAO;;AAET,SAAQ,WAAW;AACnB,UAAS,OAAO,OAAO;AACvB,KAAI,KAAK,2BAA2B;AACpC,QAAO;;;AAIT,SAAgB,+BAAqC;AACnD,UAAS,OAAO;AAChB,KAAI,cAAc;AAChB,gBAAc,aAAa;AAC3B,iBAAe"}
+{"version":3,"file":"pairing.js","names":[],"sources":["../../../src/tunnel/pairing.ts"],"sourcesContent":["import { randomBytes } from 'node:crypto';\n\nimport { createLogger } from '../utils/logger.js';\n\nconst log = createLogger('TunnelPairing');\n\nconst PAIRING_TTL_MS = 5 * 60_000;\nconst CLEANUP_INTERVAL_MS = 60_000;\n\ntype PairingSession = {\n  expiresAt: Date;\n  consumed: boolean;\n};\n\nconst sessions = new Map<string, PairingSession>();\n\nlet cleanupTimer: ReturnType<typeof setInterval> | null = null;\n\nfunction ensureCleanupTimer(): void {\n  if (cleanupTimer) return;\n  cleanupTimer = setInterval(() => {\n    const now = Date.now();\n    for (const [key, session] of sessions) {\n      if (now > session.expiresAt.getTime()) sessions.delete(key);\n    }\n  }, CLEANUP_INTERVAL_MS);\n  cleanupTimer.unref?.();\n}\n\nexport type PairingSecretResult = {\n  secret: string;\n  expiresAt: Date;\n};\n\nexport type PairingExchangePayload = {\n  token: string;\n  baseUrl: string | null;\n  lanUrl: string | null;\n  connectUrls: string[];\n};\n\nconst EXCHANGE_REPLAY_MS = 60_000;\nconst exchangeReplayCache = new Map<string, { expiresAt: number; payload: PairingExchangePayload }>();\n\nexport function cachePairingExchange(secret: string, payload: PairingExchangePayload): void {\n  exchangeReplayCache.set(secret, { expiresAt: Date.now() + EXCHANGE_REPLAY_MS, payload });\n}\n\nexport function getCachedPairingExchange(secret: string): PairingExchangePayload | null {\n  const entry = exchangeReplayCache.get(secret);\n  if (!entry) return null;\n  if (Date.now() > entry.expiresAt) {\n    exchangeReplayCache.delete(secret);\n    return null;\n  }\n  return entry.payload;\n}\n\nconst inflightExchanges = new Map<string, Promise<PairingExchangePayload | null>>();\n\n/**\n * Consume a pairing secret once and build the exchange payload.\n * Concurrent requests for the same secret share one in-flight exchange (mobile cold-start deeplink).\n */\nexport async function exchangePairingSecretOnce(\n  secret: string,\n  buildPayload: () => PairingExchangePayload,\n): Promise<PairingExchangePayload | null> {\n  const key = secret.trim();\n  if (!key) return null;\n\n  const replay = getCachedPairingExchange(key);\n  if (replay) return replay;\n\n  let inflight = inflightExchanges.get(key);\n  if (!inflight) {\n    inflight = (async (): Promise<PairingExchangePayload | null> => {\n      const cached = getCachedPairingExchange(key);\n      if (cached) return cached;\n      if (!consumePairingSecret(key)) {\n        return getCachedPairingExchange(key);\n      }\n      const payload = buildPayload();\n      cachePairingExchange(key, payload);\n      return payload;\n    })();\n    inflightExchanges.set(key, inflight);\n  }\n\n  try {\n    return await inflight;\n  } finally {\n    if (inflightExchanges.get(key) === inflight) inflightExchanges.delete(key);\n  }\n}\n\nexport function createPairingSecret(): PairingSecretResult {\n  ensureCleanupTimer();\n  const secret = randomBytes(32).toString('base64url');\n  const expiresAt = new Date(Date.now() + PAIRING_TTL_MS);\n  sessions.set(secret, { expiresAt, consumed: false });\n  log.info({ expiresAt: expiresAt.toISOString() }, 'Pairing session created');\n  return { secret, expiresAt };\n}\n\nexport function consumePairingSecret(secret: string): boolean {\n  if (!secret.trim()) return false;\n  const session = sessions.get(secret);\n  if (!session) return false;\n  if (session.consumed) return false;\n  if (Date.now() > session.expiresAt.getTime()) {\n    sessions.delete(secret);\n    return false;\n  }\n  session.consumed = true;\n  sessions.delete(secret);\n  log.info('Pairing session consumed');\n  return true;\n}\n\n/** @internal */\nexport function resetPairingSessionsForTests(): void {\n  sessions.clear();\n  exchangeReplayCache.clear();\n  inflightExchanges.clear();\n  if (cleanupTimer) {\n    clearInterval(cleanupTimer);\n    cleanupTimer = null;\n  }\n}\n"],"mappings":";;;;aAEkD;AAElD,MAAM,MAAM,aAAa,gBAAgB;AAEzC,MAAM,iBAAiB,IAAI;AAC3B,MAAM,sBAAsB;AAO5B,MAAM,2BAAW,IAAI,KAA6B;AAElD,IAAI,eAAsD;AAE1D,SAAS,qBAA2B;AAClC,KAAI,aAAc;AAClB,gBAAe,kBAAkB;EAC/B,MAAM,MAAM,KAAK,KAAK;AACtB,OAAK,MAAM,CAAC,KAAK,YAAY,SAC3B,KAAI,MAAM,QAAQ,UAAU,SAAS,CAAE,UAAS,OAAO,IAAI;IAE5D,oBAAoB;AACvB,cAAa,SAAS;;AAexB,MAAM,qBAAqB;AAC3B,MAAM,sCAAsB,IAAI,KAAqE;AAErG,SAAgB,qBAAqB,QAAgB,SAAuC;AAC1F,qBAAoB,IAAI,QAAQ;EAAE,WAAW,KAAK,KAAK,GAAG;EAAoB;EAAS,CAAC;;AAG1F,SAAgB,yBAAyB,QAA+C;CACtF,MAAM,QAAQ,oBAAoB,IAAI,OAAO;AAC7C,KAAI,CAAC,MAAO,QAAO;AACnB,KAAI,KAAK,KAAK,GAAG,MAAM,WAAW;AAChC,sBAAoB,OAAO,OAAO;AAClC,SAAO;;AAET,QAAO,MAAM;;AAGf,MAAM,oCAAoB,IAAI,KAAqD;;;;;AAMnF,eAAsB,0BACpB,QACA,cACwC;CACxC,MAAM,MAAM,OAAO,MAAM;AACzB,KAAI,CAAC,IAAK,QAAO;CAEjB,MAAM,SAAS,yBAAyB,IAAI;AAC5C,KAAI,OAAQ,QAAO;CAEnB,IAAI,WAAW,kBAAkB,IAAI,IAAI;AACzC,KAAI,CAAC,UAAU;AACb,cAAY,YAAoD;GAC9D,MAAM,SAAS,yBAAyB,IAAI;AAC5C,OAAI,OAAQ,QAAO;AACnB,OAAI,CAAC,qBAAqB,IAAI,CAC5B,QAAO,yBAAyB,IAAI;GAEtC,MAAM,UAAU,cAAc;AAC9B,wBAAqB,KAAK,QAAQ;AAClC,UAAO;MACL;AACJ,oBAAkB,IAAI,KAAK,SAAS;;AAGtC,KAAI;AACF,SAAO,MAAM;WACL;AACR,MAAI,kBAAkB,IAAI,IAAI,KAAK,SAAU,mBAAkB,OAAO,IAAI;;;AAI9E,SAAgB,sBAA2C;AACzD,qBAAoB;CACpB,MAAM,SAAS,YAAY,GAAG,CAAC,SAAS,YAAY;CACpD,MAAM,YAAY,IAAI,KAAK,KAAK,KAAK,GAAG,eAAe;AACvD,UAAS,IAAI,QAAQ;EAAE;EAAW,UAAU;EAAO,CAAC;AACpD,KAAI,KAAK,EAAE,WAAW,UAAU,aAAa,EAAE,EAAE,0BAA0B;AAC3E,QAAO;EAAE;EAAQ;EAAW;;AAG9B,SAAgB,qBAAqB,QAAyB;AAC5D,KAAI,CAAC,OAAO,MAAM,CAAE,QAAO;CAC3B,MAAM,UAAU,SAAS,IAAI,OAAO;AACpC,KAAI,CAAC,QAAS,QAAO;AACrB,KAAI,QAAQ,SAAU,QAAO;AAC7B,KAAI,KAAK,KAAK,GAAG,QAAQ,UAAU,SAAS,EAAE;AAC5C,WAAS,OAAO,OAAO;AACvB,SAAO;;AAET,SAAQ,WAAW;AACnB,UAAS,OAAO,OAAO;AACvB,KAAI,KAAK,2BAA2B;AACpC,QAAO;;;AAIT,SAAgB,+BAAqC;AACnD,UAAS,OAAO;AAChB,qBAAoB,OAAO;AAC3B,mBAAkB,OAAO;AACzB,KAAI,cAAc;AAChB,gBAAc,aAAa;AAC3B,iBAAe"}

package/dist/src/tunnel/tunnel-config.js

@@ -1,22 +1,16 @@
-import { TunnelConfigSchema, TunnelConsentSchema, TunnelE2eSchema, init_schema } from "../config/schema.js";
+import { TunnelConfigSchema, TunnelConsentSchema, init_schema } from "../config/schema.js";
 import { assertTunnelAutoStartAllowed, buildTunnelConsentRecord, hasValidTunnelConsent } from "./consent.js";
 import { isMaskedTunnelSecretPatchValue } from "./env.js";
 import { z } from "zod";
 //#region src/tunnel/tunnel-config.ts
 init_schema();
-const TunnelE2ePatchSchema = z.object({
-	enabled: z.boolean().optional(),
-	tlsPort: z.number().int().min(1024).max(65535).optional(),
-	staging: z.boolean().optional()
-});
 const TunnelConfigPatchSchema = z.object({
 	enabled: z.boolean().optional(),
 	brokerUrl: z.string().url().optional(),
 	registrationSecret: z.union([z.string(), z.null()]).optional(),
 	autoStart: z.boolean().optional(),
 	subdomain: z.string().optional(),
-	consent: TunnelConsentSchema.optional(),
-	e2e: TunnelE2ePatchSchema.optional()
+	consent: TunnelConsentSchema.optional()
 });
 function mergeTunnelConfigPatch(config, patch) {
 	const parsed = TunnelConfigPatchSchema.safeParse(patch);
@@ -61,14 +55,6 @@ function mergeTunnelConfigPatch(config, patch) {
 		ok: false,
 		message: "Cannot enable tunnel without accepting the security notice. Start remote access from settings or record consent first."
 	};
-	if (parsed.data.e2e !== void 0) next.e2e = TunnelE2eSchema.parse({
-		...next.e2e ?? {
-			enabled: true,
-			tlsPort: 18791,
-			staging: false
-		},
-		...parsed.data.e2e
-	});
 	config.tunnel = TunnelConfigSchema.parse(next);
 	return { ok: true };
 }

package/dist/src/tunnel/tunnel-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"tunnel-config.js","names":[],"sources":["../../../src/tunnel/tunnel-config.ts"],"sourcesContent":["import { z } from 'zod';\n\nimport type { Config } from '../config/schema.js';\nimport { TunnelConfigSchema, TunnelConsentSchema, TunnelE2eSchema } from '../config/schema.js';\n\nimport {\n  assertTunnelAutoStartAllowed,\n  buildTunnelConsentRecord,\n  hasValidTunnelConsent,\n} from './consent.js';\nimport { isMaskedTunnelSecretPatchValue } from './env.js';\n\nconst TunnelE2ePatchSchema = z.object({\n  enabled: z.boolean().optional(),\n  tlsPort: z.number().int().min(1024).max(65535).optional(),\n  staging: z.boolean().optional(),\n});\n\nconst TunnelConfigPatchSchema = z.object({\n  enabled: z.boolean().optional(),\n  brokerUrl: z.string().url().optional(),\n  registrationSecret: z.union([z.string(), z.null()]).optional(),\n  autoStart: z.boolean().optional(),\n  subdomain: z.string().optional(),\n  consent: TunnelConsentSchema.optional(),\n  e2e: TunnelE2ePatchSchema.optional(),\n});\n\nexport function mergeTunnelConfigPatch(\n  config: Config,\n  patch: Record<string, unknown>,\n): { ok: true } | { ok: false; message: string } {\n  const parsed = TunnelConfigPatchSchema.safeParse(patch);\n  if (!parsed.success) {\n    return { ok: false, message: parsed.error.issues.map((i) => i.message).join('; ') };\n  }\n\n  const patchFields = { ...parsed.data };\n  if (parsed.data.registrationSecret !== undefined) {\n    if (parsed.data.registrationSecret === null) {\n      delete patchFields.registrationSecret;\n    } else {\n      const trimmed = parsed.data.registrationSecret.trim();\n      if (!trimmed || isMaskedTunnelSecretPatchValue(trimmed)) {\n        delete patchFields.registrationSecret;\n      } else {\n        patchFields.registrationSecret = trimmed;\n      }\n    }\n  }\n\n  const next = {\n    ...(config.tunnel ?? TunnelConfigSchema.parse({})),\n    ...patchFields,\n  };\n\n  if (parsed.data.registrationSecret === null) {\n    delete next.registrationSecret;\n  }\n\n  if (parsed.data.autoStart === true) {\n    const probeTunnel = TunnelConfigSchema.parse({ ...next, autoStart: true });\n    const probe: Config = { ...config, tunnel: probeTunnel };\n    try {\n      assertTunnelAutoStartAllowed(probe);\n    } catch (err) {\n      const em = err instanceof Error ? err.message : String(err);\n      return { ok: false, message: em };\n    }\n  }\n\n  if (\n    parsed.data.enabled === true &&\n    !hasValidTunnelConsent({ ...config, tunnel: TunnelConfigSchema.parse(next) })\n  ) {\n    return {\n      ok: false,\n      message:\n        'Cannot enable tunnel without accepting the security notice. Start remote access from settings or record consent first.',\n    };\n  }\n\n  if (parsed.data.e2e !== undefined) {\n    next.e2e = TunnelE2eSchema.parse({\n      ...(next.e2e ?? { enabled: true, tlsPort: 18791, staging: false }),\n      ...parsed.data.e2e,\n    });\n  }\n\n  config.tunnel = TunnelConfigSchema.parse(next);\n  return { ok: true };\n}\n\nexport function applyTunnelConsentToConfig(config: Config): void {\n  if (!config.tunnel) {\n    config.tunnel = TunnelConfigSchema.parse({});\n  }\n  config.tunnel.consent = buildTunnelConsentRecord();\n}\n\nexport function setTunnelEnabledInConfig(config: Config, enabled: boolean): void {\n  if (!config.tunnel) {\n    config.tunnel = TunnelConfigSchema.parse({});\n  }\n  config.tunnel.enabled = enabled;\n}\n\n/**\n * Clear stale tunnel flags when consent is missing or outdated (Phase 2: config/runtime alignment).\n * Returns true when `config.tunnel` was modified.\n */\nexport function sanitizeTunnelConfig(config: Config): boolean {\n  const tunnel = config.tunnel;\n  if (!tunnel) return false;\n  if (hasValidTunnelConsent(config)) return false;\n\n  let changed = false;\n  if (tunnel.enabled) {\n    tunnel.enabled = false;\n    changed = true;\n  }\n  if (tunnel.autoStart) {\n    tunnel.autoStart = false;\n    changed = true;\n  }\n  return changed;\n}\n"],"mappings":";;;;;aAG+F;AAS/F,MAAM,uBAAuB,EAAE,OAAO;CACpC,SAAS,EAAE,SAAS,CAAC,UAAU;CAC/B,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,UAAU;CACzD,SAAS,EAAE,SAAS,CAAC,UAAU;CAChC,CAAC;AAEF,MAAM,0BAA0B,EAAE,OAAO;CACvC,SAAS,EAAE,SAAS,CAAC,UAAU;CAC/B,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;CACtC,oBAAoB,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU;CAC9D,WAAW,EAAE,SAAS,CAAC,UAAU;CACjC,WAAW,EAAE,QAAQ,CAAC,UAAU;CAChC,SAAS,oBAAoB,UAAU;CACvC,KAAK,qBAAqB,UAAU;CACrC,CAAC;AAEF,SAAgB,uBACd,QACA,OAC+C;CAC/C,MAAM,SAAS,wBAAwB,UAAU,MAAM;AACvD,KAAI,CAAC,OAAO,QACV,QAAO;EAAE,IAAI;EAAO,SAAS,OAAO,MAAM,OAAO,KAAK,MAAM,EAAE,QAAQ,CAAC,KAAK,KAAK;EAAE;CAGrF,MAAM,cAAc,EAAE,GAAG,OAAO,MAAM;AACtC,KAAI,OAAO,KAAK,uBAAuB,KAAA,EACrC,KAAI,OAAO,KAAK,uBAAuB,KACrC,QAAO,YAAY;MACd;EACL,MAAM,UAAU,OAAO,KAAK,mBAAmB,MAAM;AACrD,MAAI,CAAC,WAAW,+BAA+B,QAAQ,CACrD,QAAO,YAAY;MAEnB,aAAY,qBAAqB;;CAKvC,MAAM,OAAO;EACX,GAAI,OAAO,UAAU,mBAAmB,MAAM,EAAE,CAAC;EACjD,GAAG;EACJ;AAED,KAAI,OAAO,KAAK,uBAAuB,KACrC,QAAO,KAAK;AAGd,KAAI,OAAO,KAAK,cAAc,MAAM;EAClC,MAAM,cAAc,mBAAmB,MAAM;GAAE,GAAG;GAAM,WAAW;GAAM,CAAC;EAC1E,MAAM,QAAgB;GAAE,GAAG;GAAQ,QAAQ;GAAa;AACxD,MAAI;AACF,gCAA6B,MAAM;WAC5B,KAAK;AAEZ,UAAO;IAAE,IAAI;IAAO,SADT,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;IAC1B;;;AAIrC,KACE,OAAO,KAAK,YAAY,QACxB,CAAC,sBAAsB;EAAE,GAAG;EAAQ,QAAQ,mBAAmB,MAAM,KAAK;EAAE,CAAC,CAE7E,QAAO;EACL,IAAI;EACJ,SACE;EACH;AAGH,KAAI,OAAO,KAAK,QAAQ,KAAA,EACtB,MAAK,MAAM,gBAAgB,MAAM;EAC/B,GAAI,KAAK,OAAO;GAAE,SAAS;GAAM,SAAS;GAAO,SAAS;GAAO;EACjE,GAAG,OAAO,KAAK;EAChB,CAAC;AAGJ,QAAO,SAAS,mBAAmB,MAAM,KAAK;AAC9C,QAAO,EAAE,IAAI,MAAM;;AAGrB,SAAgB,2BAA2B,QAAsB;AAC/D,KAAI,CAAC,OAAO,OACV,QAAO,SAAS,mBAAmB,MAAM,EAAE,CAAC;AAE9C,QAAO,OAAO,UAAU,0BAA0B;;AAGpD,SAAgB,yBAAyB,QAAgB,SAAwB;AAC/E,KAAI,CAAC,OAAO,OACV,QAAO,SAAS,mBAAmB,MAAM,EAAE,CAAC;AAE9C,QAAO,OAAO,UAAU;;;;;;AAO1B,SAAgB,qBAAqB,QAAyB;CAC5D,MAAM,SAAS,OAAO;AACtB,KAAI,CAAC,OAAQ,QAAO;AACpB,KAAI,sBAAsB,OAAO,CAAE,QAAO;CAE1C,IAAI,UAAU;AACd,KAAI,OAAO,SAAS;AAClB,SAAO,UAAU;AACjB,YAAU;;AAEZ,KAAI,OAAO,WAAW;AACpB,SAAO,YAAY;AACnB,YAAU;;AAEZ,QAAO"}
+{"version":3,"file":"tunnel-config.js","names":[],"sources":["../../../src/tunnel/tunnel-config.ts"],"sourcesContent":["import { z } from 'zod';\n\nimport type { Config } from '../config/schema.js';\nimport { TunnelConfigSchema, TunnelConsentSchema } from '../config/schema.js';\n\nimport {\n  assertTunnelAutoStartAllowed,\n  buildTunnelConsentRecord,\n  hasValidTunnelConsent,\n} from './consent.js';\nimport { isMaskedTunnelSecretPatchValue } from './env.js';\n\nconst TunnelConfigPatchSchema = z.object({\n  enabled: z.boolean().optional(),\n  brokerUrl: z.string().url().optional(),\n  registrationSecret: z.union([z.string(), z.null()]).optional(),\n  autoStart: z.boolean().optional(),\n  subdomain: z.string().optional(),\n  consent: TunnelConsentSchema.optional(),\n});\n\nexport function mergeTunnelConfigPatch(\n  config: Config,\n  patch: Record<string, unknown>,\n): { ok: true } | { ok: false; message: string } {\n  const parsed = TunnelConfigPatchSchema.safeParse(patch);\n  if (!parsed.success) {\n    return { ok: false, message: parsed.error.issues.map((i) => i.message).join('; ') };\n  }\n\n  const patchFields = { ...parsed.data };\n  if (parsed.data.registrationSecret !== undefined) {\n    if (parsed.data.registrationSecret === null) {\n      delete patchFields.registrationSecret;\n    } else {\n      const trimmed = parsed.data.registrationSecret.trim();\n      if (!trimmed || isMaskedTunnelSecretPatchValue(trimmed)) {\n        delete patchFields.registrationSecret;\n      } else {\n        patchFields.registrationSecret = trimmed;\n      }\n    }\n  }\n\n  const next = {\n    ...(config.tunnel ?? TunnelConfigSchema.parse({})),\n    ...patchFields,\n  };\n\n  if (parsed.data.registrationSecret === null) {\n    delete next.registrationSecret;\n  }\n\n  if (parsed.data.autoStart === true) {\n    const probeTunnel = TunnelConfigSchema.parse({ ...next, autoStart: true });\n    const probe: Config = { ...config, tunnel: probeTunnel };\n    try {\n      assertTunnelAutoStartAllowed(probe);\n    } catch (err) {\n      const em = err instanceof Error ? err.message : String(err);\n      return { ok: false, message: em };\n    }\n  }\n\n  if (\n    parsed.data.enabled === true &&\n    !hasValidTunnelConsent({ ...config, tunnel: TunnelConfigSchema.parse(next) })\n  ) {\n    return {\n      ok: false,\n      message:\n        'Cannot enable tunnel without accepting the security notice. Start remote access from settings or record consent first.',\n    };\n  }\n\n  config.tunnel = TunnelConfigSchema.parse(next);\n  return { ok: true };\n}\n\nexport function applyTunnelConsentToConfig(config: Config): void {\n  if (!config.tunnel) {\n    config.tunnel = TunnelConfigSchema.parse({});\n  }\n  config.tunnel.consent = buildTunnelConsentRecord();\n}\n\nexport function setTunnelEnabledInConfig(config: Config, enabled: boolean): void {\n  if (!config.tunnel) {\n    config.tunnel = TunnelConfigSchema.parse({});\n  }\n  config.tunnel.enabled = enabled;\n}\n\n/**\n * Clear stale tunnel flags when consent is missing or outdated (Phase 2: config/runtime alignment).\n * Returns true when `config.tunnel` was modified.\n */\nexport function sanitizeTunnelConfig(config: Config): boolean {\n  const tunnel = config.tunnel;\n  if (!tunnel) return false;\n  if (hasValidTunnelConsent(config)) return false;\n\n  let changed = false;\n  if (tunnel.enabled) {\n    tunnel.enabled = false;\n    changed = true;\n  }\n  if (tunnel.autoStart) {\n    tunnel.autoStart = false;\n    changed = true;\n  }\n  return changed;\n}\n"],"mappings":";;;;;aAG8E;AAS9E,MAAM,0BAA0B,EAAE,OAAO;CACvC,SAAS,EAAE,SAAS,CAAC,UAAU;CAC/B,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;CACtC,oBAAoB,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU;CAC9D,WAAW,EAAE,SAAS,CAAC,UAAU;CACjC,WAAW,EAAE,QAAQ,CAAC,UAAU;CAChC,SAAS,oBAAoB,UAAU;CACxC,CAAC;AAEF,SAAgB,uBACd,QACA,OAC+C;CAC/C,MAAM,SAAS,wBAAwB,UAAU,MAAM;AACvD,KAAI,CAAC,OAAO,QACV,QAAO;EAAE,IAAI;EAAO,SAAS,OAAO,MAAM,OAAO,KAAK,MAAM,EAAE,QAAQ,CAAC,KAAK,KAAK;EAAE;CAGrF,MAAM,cAAc,EAAE,GAAG,OAAO,MAAM;AACtC,KAAI,OAAO,KAAK,uBAAuB,KAAA,EACrC,KAAI,OAAO,KAAK,uBAAuB,KACrC,QAAO,YAAY;MACd;EACL,MAAM,UAAU,OAAO,KAAK,mBAAmB,MAAM;AACrD,MAAI,CAAC,WAAW,+BAA+B,QAAQ,CACrD,QAAO,YAAY;MAEnB,aAAY,qBAAqB;;CAKvC,MAAM,OAAO;EACX,GAAI,OAAO,UAAU,mBAAmB,MAAM,EAAE,CAAC;EACjD,GAAG;EACJ;AAED,KAAI,OAAO,KAAK,uBAAuB,KACrC,QAAO,KAAK;AAGd,KAAI,OAAO,KAAK,cAAc,MAAM;EAClC,MAAM,cAAc,mBAAmB,MAAM;GAAE,GAAG;GAAM,WAAW;GAAM,CAAC;EAC1E,MAAM,QAAgB;GAAE,GAAG;GAAQ,QAAQ;GAAa;AACxD,MAAI;AACF,gCAA6B,MAAM;WAC5B,KAAK;AAEZ,UAAO;IAAE,IAAI;IAAO,SADT,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;IAC1B;;;AAIrC,KACE,OAAO,KAAK,YAAY,QACxB,CAAC,sBAAsB;EAAE,GAAG;EAAQ,QAAQ,mBAAmB,MAAM,KAAK;EAAE,CAAC,CAE7E,QAAO;EACL,IAAI;EACJ,SACE;EACH;AAGH,QAAO,SAAS,mBAAmB,MAAM,KAAK;AAC9C,QAAO,EAAE,IAAI,MAAM;;AAGrB,SAAgB,2BAA2B,QAAsB;AAC/D,KAAI,CAAC,OAAO,OACV,QAAO,SAAS,mBAAmB,MAAM,EAAE,CAAC;AAE9C,QAAO,OAAO,UAAU,0BAA0B;;AAGpD,SAAgB,yBAAyB,QAAgB,SAAwB;AAC/E,KAAI,CAAC,OAAO,OACV,QAAO,SAAS,mBAAmB,MAAM,EAAE,CAAC;AAE9C,QAAO,OAAO,UAAU;;;;;;AAO1B,SAAgB,qBAAqB,QAAyB;CAC5D,MAAM,SAAS,OAAO;AACtB,KAAI,CAAC,OAAQ,QAAO;AACpB,KAAI,sBAAsB,OAAO,CAAE,QAAO;CAE1C,IAAI,UAAU;AACd,KAAI,OAAO,SAAS;AAClB,SAAO,UAAU;AACjB,YAAU;;AAEZ,KAAI,OAAO,WAAW;AACpB,SAAO,YAAY;AACnB,YAAU;;AAEZ,QAAO"}

package/dist/src/tunnel/tunnel-service.d.ts

@@ -1,20 +1,16 @@
 import { EventEmitter } from 'node:events';
 import type { TunnelQrPayload, TunnelStatus } from './tunnel-types.js';
-import type { ResolvedTunnelE2eConfig } from './tunnel-e2e-config.js';
 export type TunnelServiceConfig = {
     brokerUrl: string;
     registrationSecret: string;
     autoStart: boolean;
     gatewayHost: string;
-    e2e: ResolvedTunnelE2eConfig;
     frpSubdomainHost: string;
-    gatewayFetch?: typeof fetch;
 };
 export declare function hashGatewayToken(token: string): string;
 export declare function getTunnelService(): TunnelService;
 export declare class TunnelService extends EventEmitter {
     private serviceConfig;
-    private pendingGatewayFetch;
     private frpcHandle;
     private heartbeatTimer;
     private connectedSince;
@@ -27,24 +23,19 @@ export declare class TunnelService extends EventEmitter {
     private frpcDownload;
     private startProgress;
     configure(cfg: TunnelServiceConfig): void;
-    setGatewayFetch(fetchFn: typeof fetch): void;
     getStatus(): TunnelStatus;
     private setStartPhase;
     private clearStartProgress;
-    buildQr(gatewayPort: number, gatewayHost: string): TunnelQrPayload;
+    buildQr(gatewayPort: number, gatewayHost: string): Promise<TunnelQrPayload>;
     start(gatewayPort: number, gatewayToken: string): Promise<TunnelQrPayload>;
     stop(opts?: {
         release?: boolean;
     }): Promise<{
         released: boolean;
     }>;
-    /**
-     * Reuse Broker registration when possible so subdomain and URLs stay stable across stop/start.
-     */
     private resolveRegistration;
     private spawnAndWait;
     private scheduleReconnect;
     private startHeartbeat;
     private clearHeartbeat;
-    private prepareFrpcTarget;
 }

package/dist/src/tunnel/tunnel-service.js

@@ -1,7 +1,6 @@
 import { PACKAGE_VERSION, init_package_version } from "../package-version.js";
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { getCertStatusSummary } from "./acme-cert-store.js";
 import { TunnelBrokerClient, resolveBrokerApiBase } from "./broker-client.js";
 import { clearFrpcPathForProcess, ensureFrpcBinary, publishFrpcPathForProcess } from "./frpc-binary.js";
 import { writeFrpcConfig } from "./frpc-config.js";
@@ -11,7 +10,6 @@ import { createPairingSecret } from "./pairing.js";
 import { canResumePersistedTunnel, persistedFromRegistration, registrationFromPersisted } from "./tunnel-persist.js";
 import { clearTunnelState, loadTunnelState, saveTunnelState, updateTunnelState } from "./tunnel-state.js";
 import { logTunnelAudit } from "./tunnel-audit.js";
-import { startTunnelTlsServer, stopTunnelTlsServer } from "./tls-server.js";
 import { createHash } from "node:crypto";
 import { EventEmitter } from "node:events";
 //#region src/tunnel/tunnel-service.ts
@@ -31,7 +29,6 @@ function getTunnelService() {
 }
 var TunnelService = class extends EventEmitter {
 	serviceConfig = null;
-	pendingGatewayFetch;
 	frpcHandle = null;
 	heartbeatTimer = null;
 	connectedSince = null;
@@ -44,14 +41,7 @@ var TunnelService = class extends EventEmitter {
 	frpcDownload = null;
 	startProgress = null;
 	configure(cfg) {
-		this.serviceConfig = {
-			...cfg,
-			gatewayFetch: cfg.gatewayFetch ?? this.pendingGatewayFetch ?? this.serviceConfig?.gatewayFetch
-		};
-	}
-	setGatewayFetch(fetchFn) {
-		this.pendingGatewayFetch = fetchFn;
-		if (this.serviceConfig) this.serviceConfig.gatewayFetch = fetchFn;
+		this.serviceConfig = cfg;
 	}
 	getStatus() {
 		const cfg = this.serviceConfig;
@@ -70,13 +60,8 @@ var TunnelService = class extends EventEmitter {
 			config: {
 				autoStart: cfg?.autoStart ?? false,
 				brokerUrl: cfg?.brokerUrl ?? "https://frp.xopc.ai/api",
-				e2e: {
-					enabled: cfg?.e2e.enabled ?? true,
-					tlsPort: cfg?.e2e.tlsPort ?? 18791,
-					staging: cfg?.e2e.staging ?? false
-				}
-			},
-			cert: getCertStatusSummary()
+				transport: { tls: "broker_terminated" }
+			}
 		};
 	}
 	setStartPhase(phase, patch) {
@@ -85,7 +70,6 @@ var TunnelService = class extends EventEmitter {
 		this.startProgress = {
 			phase,
 			startedAt: samePhase && prev ? prev.startedAt : (/* @__PURE__ */ new Date()).toISOString(),
-			acmeStep: patch?.acmeStep !== void 0 ? patch.acmeStep : samePhase ? prev?.acmeStep ?? null : null,
 			publicUrl: patch?.publicUrl !== void 0 ? patch.publicUrl : samePhase ? prev?.publicUrl ?? null : prev?.publicUrl ?? null
 		};
 		this.emit("tunnel:progress");
@@ -95,7 +79,7 @@ var TunnelService = class extends EventEmitter {
 		this.startProgress = null;
 		this.emit("tunnel:progress");
 	}
-	buildQr(gatewayPort, gatewayHost) {
+	async buildQr(gatewayPort, gatewayHost) {
 		const publicUrl = loadTunnelState()?.publicUrl ?? null;
 		if (!publicUrl) return {
 			qrPayload: "",
@@ -158,8 +142,7 @@ var TunnelService = class extends EventEmitter {
 		saveTunnelState(state);
 		this.setStartPhase("registering", { publicUrl: registration.publicUrl });
 		try {
-			const { frpcLocalPort, frpcMode } = await this.prepareFrpcTarget(broker, registration, cfg, gatewayPort);
-			const configPath = writeFrpcConfig(registration, frpcLocalPort, "127.0.0.1", frpcMode);
+			const configPath = writeFrpcConfig(registration, gatewayPort, "127.0.0.1", "http");
 			this.setStartPhase("starting_frpc", { publicUrl: registration.publicUrl });
 			await this.spawnAndWait(frpcBin, configPath, broker, state, registration.heartbeatIntervalMs);
 		} catch (err) {
@@ -174,7 +157,7 @@ var TunnelService = class extends EventEmitter {
 		this.connectedSince = (/* @__PURE__ */ new Date()).toISOString();
 		this.reconnectAttempt = 0;
 		this.emit("tunnel:connected");
-		const qr = this.buildQr(gatewayPort, cfg.gatewayHost);
+		const qr = await this.buildQr(gatewayPort, cfg.gatewayHost);
 		logTunnelAudit("tunnel.start", {
 			subdomain: registration.subdomain,
 			publicUrl: registration.publicUrl,
@@ -187,7 +170,6 @@ var TunnelService = class extends EventEmitter {
 		const release = opts?.release === true;
 		this.stopping = true;
 		this.clearHeartbeat();
-		stopTunnelTlsServer();
 		if (this.frpcHandle) {
 			await this.frpcHandle.kill();
 			this.frpcHandle = null;
@@ -228,9 +210,6 @@ var TunnelService = class extends EventEmitter {
 		this.emit("tunnel:disconnected");
 		return { released };
 	}
-	/**
-	* Reuse Broker registration when possible so subdomain and URLs stay stable across stop/start.
-	*/
 	async resolveRegistration(broker, cfg, gatewayToken, persisted) {
 		if (canResumePersistedTunnel(persisted)) try {
 			await broker.heartbeat(persisted.tunnelId, persisted.tunnelToken);
@@ -339,8 +318,7 @@ var TunnelService = class extends EventEmitter {
 					const next = persistedFromRegistration(registration);
 					saveTunnelState(next);
 					const frpcBin = await ensureFrpcBinary();
-					const { frpcLocalPort, frpcMode } = await this.prepareFrpcTarget(broker, registration, cfg, ctx.gatewayPort);
-					const configPath = writeFrpcConfig(registration, frpcLocalPort, "127.0.0.1", frpcMode);
+					const configPath = writeFrpcConfig(registration, ctx.gatewayPort, "127.0.0.1", "http");
 					await this.spawnAndWait(frpcBin, configPath, broker, next, registration.heartbeatIntervalMs);
 				} catch (reErr) {
 					this.lastError = reErr instanceof Error ? reErr.message : String(reErr);
@@ -358,37 +336,6 @@ var TunnelService = class extends EventEmitter {
 			this.heartbeatTimer = null;
 		}
 	}
-	async prepareFrpcTarget(broker, registration, cfg, gatewayPort) {
-		if (!cfg.e2e.enabled) return {
-			frpcLocalPort: gatewayPort,
-			frpcMode: "http"
-		};
-		this.setStartPhase("provisioning_tls", { publicUrl: registration.publicUrl });
-		const acmeConfig = {
-			broker,
-			tunnelId: registration.tunnelId,
-			tunnelToken: registration.tunnelToken,
-			subdomain: registration.subdomain,
-			frpSubdomainHost: cfg.frpSubdomainHost,
-			staging: cfg.e2e.staging,
-			onProgress: (step) => {
-				this.setStartPhase("provisioning_tls", {
-					publicUrl: registration.publicUrl,
-					acmeStep: step
-				});
-			}
-		};
-		await startTunnelTlsServer({
-			tlsPort: cfg.e2e.tlsPort,
-			gatewayPort,
-			acmeConfig,
-			fetch: cfg.gatewayFetch
-		});
-		return {
-			frpcLocalPort: cfg.e2e.tlsPort,
-			frpcMode: "https"
-		};
-	}
 };
 //#endregion
 export { TunnelService, getTunnelService, hashGatewayToken };