green-tunnel 2.0.2 → 3.0.2

package/dist/core/errors.js

@@ -0,0 +1,37 @@
+/**
+ * Typed errors. v2 swallowed nearly every failure into a debug log, which is
+ * why a broken DNS lookup silently became a connection to 127.0.0.1. Everything
+ * here is meant to reach the caller.
+ */
+export class GreenTunnelError extends Error {
+    name = 'GreenTunnelError';
+}
+export class DnsError extends GreenTunnelError {
+    name = 'DnsError';
+    hostname;
+    constructor(hostname, message, options) {
+        super(`DNS lookup failed for "${hostname}": ${message}`, options);
+        this.hostname = hostname;
+    }
+}
+export class ConnectError extends GreenTunnelError {
+    name = 'ConnectError';
+    host;
+    port;
+    constructor(host, port, message, options) {
+        super(`Cannot connect to ${host}:${String(port)}: ${message}`, options);
+        this.host = host;
+        this.port = port;
+    }
+}
+export class ProtocolError extends GreenTunnelError {
+    name = 'ProtocolError';
+}
+export class SystemProxyError extends GreenTunnelError {
+    name = 'SystemProxyError';
+}
+/** Narrow an unknown catch binding to something with a message. */
+export function toError(value) {
+    return value instanceof Error ? value : new Error(String(value));
+}
+//# sourceMappingURL=errors.js.map

package/dist/core/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/core/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACvB,IAAI,GAAW,kBAAkB,CAAC;CACrD;AAED,MAAM,OAAO,QAAS,SAAQ,gBAAgB;IAC1B,IAAI,GAAG,UAAU,CAAC;IAC3B,QAAQ,CAAS;IAE1B,YAAY,QAAgB,EAAE,OAAe,EAAE,OAA6B;QAC1E,KAAK,CAAC,0BAA0B,QAAQ,MAAM,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;QAClE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,OAAO,YAAa,SAAQ,gBAAgB;IAC9B,IAAI,GAAG,cAAc,CAAC;IAC/B,IAAI,CAAS;IACb,IAAI,CAAS;IAEtB,YAAY,IAAY,EAAE,IAAY,EAAE,OAAe,EAAE,OAA6B;QACpF,KAAK,CAAC,qBAAqB,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;QACxE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,OAAO,aAAc,SAAQ,gBAAgB;IAC/B,IAAI,GAAG,eAAe,CAAC;CAC1C;AAED,MAAM,OAAO,gBAAiB,SAAQ,gBAAgB;IAClC,IAAI,GAAG,kBAAkB,CAAC;CAC7C;AAED,mEAAmE;AACnE,MAAM,UAAU,OAAO,CAAC,KAAc;IACpC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACnE,CAAC"}

package/dist/core/http/head.d.ts

@@ -0,0 +1,40 @@
+export interface HeaderField {
+    readonly name: string;
+    readonly value: string;
+}
+export interface RequestHead {
+    readonly method: string;
+    /** Request target exactly as sent: origin-form, absolute-form or authority-form. */
+    readonly target: string;
+    readonly version: string;
+    /** Kept as an ordered list — duplicates and casing are significant on the wire. */
+    readonly headers: readonly HeaderField[];
+}
+/**
+ * Parse the head of an HTTP/1.x request (request line + fields, no trailing
+ * blank line). Throws `ProtocolError` rather than producing a half-built object.
+ */
+export declare function parseRequestHead(raw: string): RequestHead;
+/** Serialize a head back onto the wire, including the terminating blank line. */
+export declare function serializeRequestHead(head: RequestHead): string;
+export declare function getHeader(head: RequestHead, name: string): string | undefined;
+/**
+ * Turn a proxied request into one an origin server will accept:
+ * absolute-form target becomes origin-form, proxy-only headers are dropped, and
+ * a `Host` header is synthesized if the client relied on the absolute URI.
+ */
+export declare function toOriginForm(head: RequestHead): RequestHead;
+/** Resolve the upstream host and port a proxied request is aimed at. */
+export declare function resolveUpstream(head: RequestHead, defaultPort: number): {
+    host: string;
+    port: number;
+};
+/**
+ * Split `host:port`, `[::1]:443` or a bare host. Throws when there is no host,
+ * so we never end up dialling `undefined` (which resolves to localhost).
+ */
+export declare function splitAuthority(authority: string, defaultPort: number): {
+    host: string;
+    port: number;
+};
+//# sourceMappingURL=head.d.ts.map

package/dist/core/http/head.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"head.d.ts","sourceRoot":"","sources":["../../../src/core/http/head.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,oFAAoF;IACpF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,mFAAmF;IACnF,QAAQ,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,CAAC;CAC1C;AAKD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,CA2BzD;AAED,iFAAiF;AACjF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAM9D;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG7E;AAWD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,WAAW,GAAG,WAAW,CAa3D;AAcD,wEAAwE;AACxE,wBAAgB,eAAe,CAC7B,IAAI,EAAE,WAAW,EACjB,WAAW,EAAE,MAAM,GAClB;IACD,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,CAMA;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAClB;IACD,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,CAsBA"}

package/dist/core/http/head.js

@@ -0,0 +1,122 @@
+import { ProtocolError } from '../errors.js';
+/** Methods a client may legally send to a proxy. */
+const METHOD_PATTERN = /^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/;
+/**
+ * Parse the head of an HTTP/1.x request (request line + fields, no trailing
+ * blank line). Throws `ProtocolError` rather than producing a half-built object.
+ */
+export function parseRequestHead(raw) {
+    const lines = raw.split('\r\n');
+    const requestLine = lines.shift();
+    if (!requestLine) {
+        throw new ProtocolError('Empty HTTP request line');
+    }
+    const parts = requestLine.split(' ').filter((part) => part.length > 0);
+    const [method, target, version = 'HTTP/1.1'] = parts;
+    if (!method || !target || parts.length < 2) {
+        throw new ProtocolError(`Malformed HTTP request line: ${JSON.stringify(requestLine)}`);
+    }
+    if (!METHOD_PATTERN.test(method)) {
+        throw new ProtocolError(`Invalid HTTP method: ${JSON.stringify(method)}`);
+    }
+    const headers = [];
+    for (const line of lines) {
+        if (line.length === 0)
+            continue;
+        const separator = line.indexOf(':');
+        if (separator < 1) {
+            throw new ProtocolError(`Malformed HTTP header: ${JSON.stringify(line)}`);
+        }
+        headers.push({ name: line.slice(0, separator), value: line.slice(separator + 1).trim() });
+    }
+    return { method, target, version, headers };
+}
+/** Serialize a head back onto the wire, including the terminating blank line. */
+export function serializeRequestHead(head) {
+    const lines = [`${head.method} ${head.target} ${head.version}`];
+    for (const { name, value } of head.headers) {
+        lines.push(`${name}: ${value}`);
+    }
+    return `${lines.join('\r\n')}\r\n\r\n`;
+}
+export function getHeader(head, name) {
+    const wanted = name.toLowerCase();
+    return head.headers.find((field) => field.name.toLowerCase() === wanted)?.value;
+}
+/**
+ * Headers that address *this* proxy and must not be relayed upstream.
+ *
+ * Deliberately narrow: `Connection`, `Transfer-Encoding` and friends are left
+ * alone because we forward the body byte-for-byte, so the framing the client
+ * chose has to stay intact.
+ */
+const PROXY_ONLY_HEADERS = new Set(['proxy-connection', 'proxy-authorization']);
+/**
+ * Turn a proxied request into one an origin server will accept:
+ * absolute-form target becomes origin-form, proxy-only headers are dropped, and
+ * a `Host` header is synthesized if the client relied on the absolute URI.
+ */
+export function toOriginForm(head) {
+    const headers = head.headers.filter((field) => !PROXY_ONLY_HEADERS.has(field.name.toLowerCase()));
+    let target = head.target;
+    if (isAbsoluteForm(target)) {
+        const url = parseAbsoluteTarget(target);
+        target = `${url.pathname}${url.search}`;
+        if (!headers.some((field) => field.name.toLowerCase() === 'host')) {
+            headers.unshift({ name: 'Host', value: url.host });
+        }
+    }
+    return { method: head.method, target, version: head.version, headers };
+}
+function isAbsoluteForm(target) {
+    return /^[a-z][a-z0-9+.-]*:\/\//i.test(target);
+}
+function parseAbsoluteTarget(target) {
+    try {
+        return new URL(target);
+    }
+    catch (cause) {
+        throw new ProtocolError(`Invalid absolute request target: ${target}`, { cause });
+    }
+}
+/** Resolve the upstream host and port a proxied request is aimed at. */
+export function resolveUpstream(head, defaultPort) {
+    const authority = isAbsoluteForm(head.target)
+        ? parseAbsoluteTarget(head.target).host
+        : (getHeader(head, 'host') ?? '');
+    return splitAuthority(authority, defaultPort);
+}
+/**
+ * Split `host:port`, `[::1]:443` or a bare host. Throws when there is no host,
+ * so we never end up dialling `undefined` (which resolves to localhost).
+ */
+export function splitAuthority(authority, defaultPort) {
+    const trimmed = authority.trim();
+    if (trimmed.length === 0) {
+        throw new ProtocolError('Request has no target authority (missing Host header)');
+    }
+    if (trimmed.startsWith('[')) {
+        const end = trimmed.indexOf(']');
+        if (end < 0)
+            throw new ProtocolError(`Malformed IPv6 authority: ${authority}`);
+        const host = trimmed.slice(1, end);
+        const rest = trimmed.slice(end + 1);
+        return { host, port: rest.startsWith(':') ? parsePort(rest.slice(1), authority) : defaultPort };
+    }
+    const separator = trimmed.lastIndexOf(':');
+    if (separator < 0) {
+        return { host: trimmed, port: defaultPort };
+    }
+    return {
+        host: trimmed.slice(0, separator),
+        port: parsePort(trimmed.slice(separator + 1), authority),
+    };
+}
+function parsePort(raw, authority) {
+    const port = Number.parseInt(raw, 10);
+    if (!Number.isInteger(port) || port < 1 || port > 65_535) {
+        throw new ProtocolError(`Invalid port in authority: ${authority}`);
+    }
+    return port;
+}
+//# sourceMappingURL=head.js.map

package/dist/core/http/head.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"head.js","sourceRoot":"","sources":["../../../src/core/http/head.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAgB7C,oDAAoD;AACpD,MAAM,cAAc,GAAG,+BAA+B,CAAC;AAEvD;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;IAClC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,aAAa,CAAC,yBAAyB,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,UAAU,CAAC,GAAG,KAAK,CAAC;IACrD,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,aAAa,CAAC,gCAAgC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,aAAa,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAChC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,IAAI,aAAa,CAAC,0BAA0B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9C,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,oBAAoB,CAAC,IAAiB;IACpD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAChE,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3C,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAiB,EAAE,IAAY;IACvD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAClC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC;AAClF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,CAAC,CAAC;AAEhF;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAiB;IAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAElG,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IACzB,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QACxC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC;YAClE,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;AACzE,CAAC;AAED,SAAS,cAAc,CAAC,MAAc;IACpC,OAAO,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAc;IACzC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,aAAa,CAAC,oCAAoC,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,eAAe,CAC7B,IAAiB,EACjB,WAAmB;IAKnB,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC;QAC3C,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI;QACvC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAEpC,OAAO,cAAc,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,SAAiB,EACjB,WAAmB;IAKnB,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,aAAa,CAAC,uDAAuD,CAAC,CAAC;IACnF,CAAC;IAED,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,GAAG,GAAG,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,6BAA6B,SAAS,EAAE,CAAC,CAAC;QAC/E,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QACpC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAClG,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAClB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC9C,CAAC;IACD,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC;QACjC,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC;KACzD,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,GAAW,EAAE,SAAiB;IAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,MAAM,EAAE,CAAC;QACzD,MAAM,IAAI,aAAa,CAAC,8BAA8B,SAAS,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/core/http/rewriter.d.ts

@@ -0,0 +1,20 @@
+import { Transform } from 'node:stream';
+/**
+ * Rewrites every request head on a keep-alive proxy connection while forwarding
+ * bodies byte-for-byte.
+ *
+ * v2 ran its rewrite over *every* chunk and asked "does this look like a
+ * request?" — so a POST body that happened to start with the word `GET`, or any
+ * binary upload, was silently mangled. Tracking `Content-Length` / chunked
+ * framing is the only correct way to know where the next head actually begins.
+ */
+export declare class HttpRequestRewriter {
+    #private;
+    /** Feed raw client bytes in, get rewritten bytes out. */
+    transform(chunk: Buffer): Buffer[];
+    /** Flush whatever is still buffered when the client half-closes. */
+    flush(): Buffer[];
+}
+/** Stream wrapper so the rewriter can sit inside a `pipeline()`. */
+export declare function createRequestRewriteStream(): Transform;
+//# sourceMappingURL=rewriter.d.ts.map

package/dist/core/http/rewriter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rewriter.d.ts","sourceRoot":"","sources":["../../../src/core/http/rewriter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAA0B,MAAM,aAAa,CAAC;AAWhE;;;;;;;;GAQG;AACH,qBAAa,mBAAmB;;IAK9B,yDAAyD;IACzD,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE;IAkBlC,oEAAoE;IACpE,KAAK,IAAI,MAAM,EAAE;CAiIlB;AAED,oEAAoE;AACpE,wBAAgB,0BAA0B,IAAI,SAAS,CAqBtD"}

package/dist/core/http/rewriter.js

@@ -0,0 +1,184 @@
+import { Transform } from 'node:stream';
+import { ProtocolError, toError } from '../errors.js';
+import { getHeader, parseRequestHead, serializeRequestHead, toOriginForm } from './head.js';
+const MAX_HEAD_BYTES = 64 * 1024;
+const CRLF = '\r\n';
+const HEAD_TERMINATOR = '\r\n\r\n';
+/**
+ * Rewrites every request head on a keep-alive proxy connection while forwarding
+ * bodies byte-for-byte.
+ *
+ * v2 ran its rewrite over *every* chunk and asked "does this look like a
+ * request?" — so a POST body that happened to start with the word `GET`, or any
+ * binary upload, was silently mangled. Tracking `Content-Length` / chunked
+ * framing is the only correct way to know where the next head actually begins.
+ */
+export class HttpRequestRewriter {
+    #state = 'head';
+    #buffer = Buffer.alloc(0);
+    #remaining = 0;
+    /** Feed raw client bytes in, get rewritten bytes out. */
+    transform(chunk) {
+        this.#buffer = this.#buffer.length === 0 ? chunk : Buffer.concat([this.#buffer, chunk]);
+        const out = [];
+        for (;;) {
+            if (this.#state === 'passthrough') {
+                if (this.#buffer.length > 0) {
+                    out.push(this.#buffer);
+                    this.#buffer = Buffer.alloc(0);
+                }
+                return out;
+            }
+            const progressed = this.#step(out);
+            if (!progressed)
+                return out;
+        }
+    }
+    /** Flush whatever is still buffered when the client half-closes. */
+    flush() {
+        if (this.#buffer.length === 0)
+            return [];
+        const rest = this.#buffer;
+        this.#buffer = Buffer.alloc(0);
+        return [rest];
+    }
+    /** Returns false when it needs more bytes. */
+    #step(out) {
+        switch (this.#state) {
+            case 'head':
+                return this.#stepHead(out);
+            case 'body-length':
+            case 'chunk-data':
+                return this.#stepCountedBytes(out);
+            case 'chunk-size':
+                return this.#stepChunkSize(out);
+            case 'chunk-crlf':
+                return this.#stepChunkCrlf(out);
+            case 'trailers':
+                return this.#stepTrailers(out);
+            default:
+                return false;
+        }
+    }
+    #stepHead(out) {
+        const end = this.#buffer.indexOf(HEAD_TERMINATOR);
+        if (end < 0) {
+            if (this.#buffer.length > MAX_HEAD_BYTES) {
+                throw new ProtocolError(`HTTP request head exceeds ${String(MAX_HEAD_BYTES)} bytes`);
+            }
+            return false;
+        }
+        const raw = this.#buffer.subarray(0, end).toString('latin1');
+        this.#consume(end + HEAD_TERMINATOR.length);
+        const head = toOriginForm(parseRequestHead(raw));
+        out.push(Buffer.from(serializeRequestHead(head), 'latin1'));
+        // A successful Upgrade turns the rest of the connection into an opaque
+        // tunnel — stop trying to parse it as HTTP.
+        if (getHeader(head, 'upgrade')) {
+            this.#state = 'passthrough';
+            return true;
+        }
+        const encoding = getHeader(head, 'transfer-encoding')?.toLowerCase();
+        if (encoding?.includes('chunked')) {
+            this.#state = 'chunk-size';
+            return true;
+        }
+        const length = getHeader(head, 'content-length');
+        if (length !== undefined) {
+            const parsed = Number.parseInt(length, 10);
+            if (!Number.isInteger(parsed) || parsed < 0) {
+                throw new ProtocolError(`Invalid Content-Length: ${length}`);
+            }
+            this.#remaining = parsed;
+            this.#state = parsed > 0 ? 'body-length' : 'head';
+            return true;
+        }
+        this.#state = 'head';
+        return true;
+    }
+    /** Forward exactly `#remaining` bytes verbatim, then advance. */
+    #stepCountedBytes(out) {
+        const take = Math.min(this.#remaining, this.#buffer.length);
+        if (take > 0) {
+            out.push(this.#buffer.subarray(0, take));
+            this.#consume(take);
+            this.#remaining -= take;
+        }
+        if (this.#remaining > 0)
+            return false;
+        this.#state = this.#state === 'body-length' ? 'head' : 'chunk-crlf';
+        return true;
+    }
+    #stepChunkSize(out) {
+        const end = this.#buffer.indexOf(CRLF);
+        if (end < 0) {
+            if (this.#buffer.length > MAX_HEAD_BYTES) {
+                throw new ProtocolError('Chunk size line is implausibly long');
+            }
+            return false;
+        }
+        const line = this.#buffer.subarray(0, end).toString('latin1');
+        out.push(this.#buffer.subarray(0, end + CRLF.length));
+        this.#consume(end + CRLF.length);
+        const size = Number.parseInt(line.split(';', 1)[0]?.trim() ?? '', 16);
+        if (!Number.isInteger(size) || size < 0) {
+            throw new ProtocolError(`Invalid chunk size: ${JSON.stringify(line)}`);
+        }
+        if (size === 0) {
+            this.#state = 'trailers';
+        }
+        else {
+            this.#remaining = size;
+            this.#state = 'chunk-data';
+        }
+        return true;
+    }
+    #stepChunkCrlf(out) {
+        if (this.#buffer.length < CRLF.length)
+            return false;
+        out.push(this.#buffer.subarray(0, CRLF.length));
+        this.#consume(CRLF.length);
+        this.#state = 'chunk-size';
+        return true;
+    }
+    #stepTrailers(out) {
+        const end = this.#buffer.indexOf(CRLF);
+        if (end < 0)
+            return false;
+        out.push(this.#buffer.subarray(0, end + CRLF.length));
+        this.#consume(end + CRLF.length);
+        if (end === 0)
+            this.#state = 'head';
+        return true;
+    }
+    #consume(bytes) {
+        this.#buffer = this.#buffer.subarray(bytes);
+    }
+}
+/** Stream wrapper so the rewriter can sit inside a `pipeline()`. */
+export function createRequestRewriteStream() {
+    const rewriter = new HttpRequestRewriter();
+    return new Transform({
+        transform(chunk, _encoding, callback) {
+            try {
+                for (const piece of rewriter.transform(chunk))
+                    this.push(piece);
+                callback();
+            }
+            catch (error) {
+                callback(toError(error));
+            }
+        },
+        flush(callback) {
+            try {
+                for (const piece of rewriter.flush())
+                    this.push(piece);
+                callback();
+            }
+            catch (error) {
+                callback(toError(error));
+            }
+        },
+    });
+}
+//# sourceMappingURL=rewriter.js.map

package/dist/core/http/rewriter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rewriter.js","sourceRoot":"","sources":["../../../src/core/http/rewriter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAA0B,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAE5F,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,CAAC;AACjC,MAAM,IAAI,GAAG,MAAM,CAAC;AACpB,MAAM,eAAe,GAAG,UAAU,CAAC;AAKnC;;;;;;;;GAQG;AACH,MAAM,OAAO,mBAAmB;IAC9B,MAAM,GAAU,MAAM,CAAC;IACvB,OAAO,GAAW,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClC,UAAU,GAAG,CAAC,CAAC;IAEf,yDAAyD;IACzD,SAAS,CAAC,KAAa;QACrB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QACxF,MAAM,GAAG,GAAa,EAAE,CAAC;QAEzB,SAAS,CAAC;YACR,IAAI,IAAI,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;gBAClC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC5B,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBACvB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACjC,CAAC;gBACD,OAAO,GAAG,CAAC;YACb,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,CAAC,UAAU;gBAAE,OAAO,GAAG,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,KAAK;QACH,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC;QAC1B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;IAED,8CAA8C;IAC9C,KAAK,CAAC,GAAa;QACjB,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YACpB,KAAK,MAAM;gBACT,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAC7B,KAAK,aAAa,CAAC;YACnB,KAAK,YAAY;gBACf,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACrC,KAAK,YAAY;gBACf,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;YAClC,KAAK,YAAY;gBACf,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;YAClC,KAAK,UAAU;gBACb,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;YACjC;gBACE,OAAO,KAAK,CAAC;QACjB,CAAC;IACH,CAAC;IAED,SAAS,CAAC,GAAa;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAClD,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YACZ,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;gBACzC,MAAM,IAAI,aAAa,CAAC,6BAA6B,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YACvF,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC7D,IAAI,CAAC,QAAQ,CAAC,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAE5C,MAAM,IAAI,GAAG,YAAY,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;QACjD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QAE5D,uEAAuE;QACvE,4CAA4C;QAC5C,IAAI,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,GAAG,aAAa,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,EAAE,mBAAmB,CAAC,EAAE,WAAW,EAAE,CAAC;QACrE,IAAI,QAAQ,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QACjD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5C,MAAM,IAAI,aAAa,CAAC,2BAA2B,MAAM,EAAE,CAAC,CAAC;YAC/D,CAAC;YACD,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC;YACzB,IAAI,CAAC,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC;YAClD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iEAAiE;IACjE,iBAAiB,CAAC,GAAa;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5D,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;YACzC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACpB,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC;QAC1B,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACtC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,cAAc,CAAC,GAAa;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YACZ,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;gBACzC,MAAM,IAAI,aAAa,CAAC,qCAAqC,CAAC,CAAC;YACjE,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC9D,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,QAAQ,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAEjC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,aAAa,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;YACvB,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC;QAC7B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,cAAc,CAAC,GAAa;QAC1B,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACpD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,aAAa,CAAC,GAAa;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,GAAG,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1B,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,QAAQ,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,GAAG,KAAK,CAAC;YAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,QAAQ,CAAC,KAAa;QACpB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC;CACF;AAED,oEAAoE;AACpE,MAAM,UAAU,0BAA0B;IACxC,MAAM,QAAQ,GAAG,IAAI,mBAAmB,EAAE,CAAC;IAE3C,OAAO,IAAI,SAAS,CAAC;QACnB,SAAS,CAAC,KAAa,EAAE,SAAS,EAAE,QAA2B;YAC7D,IAAI,CAAC;gBACH,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC;oBAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAChE,QAAQ,EAAE,CAAC;YACb,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,KAAK,CAAC,QAA2B;YAC/B,IAAI,CAAC;gBACH,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,KAAK,EAAE;oBAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACvD,QAAQ,EAAE,CAAC;YACb,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/core/index.d.ts

@@ -0,0 +1,28 @@
+/**
+ * The engine. No Electron, no CLI — nothing under this directory may import
+ * from outside it, which ESLint enforces (see `eslint.config.js`).
+ *
+ * Re-exported wholesale by `../index.js`, so consumers reach all of this as
+ * `green-tunnel`:
+ *
+ * ```ts
+ * import { Proxy, SystemProxy, DEFAULT_BYPASS } from 'green-tunnel';
+ *
+ * const proxy = new Proxy({ port: 8000, dns: { mode: 'doh' } });
+ * const { host, port } = await proxy.start();
+ *
+ * const system = new SystemProxy();
+ * await system.enable({ host, port, bypass: DEFAULT_BYPASS });
+ * ```
+ */
+export { Proxy, type ProxyDependencies } from './proxy/index.js';
+export { DEFAULT_DNS, DEFAULT_FRAGMENT, DEFAULT_SETTINGS, assertValidSettings, resolveSettings, } from './config.js';
+export { ConnectError, DnsError, GreenTunnelError, ProtocolError, SystemProxyError, toError, } from './errors.js';
+export { LOG_LEVELS, Logger, createLogger, isLogLevel, stderrSink, type LogLevel, type LogRecord, type LogSink, type LoggerOptions, } from './logger.js';
+export { CachingDnsResolver, DohResolver, DotResolver, PlainResolver, createDnsResolver, type DnsResolver, type QueryType, } from './dns/index.js';
+export { DEFAULT_BYPASS, SystemProxy, createSystemProxyDriver, defaultRecoveryPath, isSystemProxySupported, recoverSystemProxy, type SystemProxyDriver, type SystemProxyOptions, } from './system-proxy/index.js';
+export { fragmentClientHello, isClientHello, splitBytes } from './tls/fragment.js';
+export { HttpRequestRewriter, createRequestRewriteStream } from './http/rewriter.js';
+export { getHeader, parseRequestHead, resolveUpstream, serializeRequestHead, splitAuthority, toOriginForm, type HeaderField, type RequestHead, } from './http/head.js';
+export type { DeepPartial, DnsMode, DnsRecord, DnsSettings, FragmentSettings, IpFamilyPreference, ProxyAddress, ProxyEndpointState, ProxyEventMap, ProxyOptions, ProxySettings, ProxyStats, SystemProxySettings, SystemProxySnapshot, SystemProxySnapshotEntry, TunnelInfo, TunnelKind, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,KAAK,EAAE,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAEjE,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,GAChB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,YAAY,EACZ,QAAQ,EACR,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,OAAO,GACR,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,UAAU,EACV,MAAM,EACN,YAAY,EACZ,UAAU,EACV,UAAU,EACV,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,KAAK,OAAO,EACZ,KAAK,aAAa,GACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,kBAAkB,EAClB,WAAW,EACX,WAAW,EACX,aAAa,EACb,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,SAAS,GACf,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,cAAc,EACd,WAAW,EACX,uBAAuB,EACvB,mBAAmB,EACnB,sBAAsB,EACtB,kBAAkB,EAClB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,GACxB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEnF,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAErF,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,eAAe,EACf,oBAAoB,EACpB,cAAc,EACd,YAAY,EACZ,KAAK,WAAW,EAChB,KAAK,WAAW,GACjB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,WAAW,EACX,OAAO,EACP,SAAS,EACT,WAAW,EACX,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,aAAa,EACb,UAAU,EACV,mBAAmB,EACnB,mBAAmB,EACnB,wBAAwB,EACxB,UAAU,EACV,UAAU,GACX,MAAM,YAAY,CAAC"}

package/dist/core/index.js

@@ -0,0 +1,27 @@
+/**
+ * The engine. No Electron, no CLI — nothing under this directory may import
+ * from outside it, which ESLint enforces (see `eslint.config.js`).
+ *
+ * Re-exported wholesale by `../index.js`, so consumers reach all of this as
+ * `green-tunnel`:
+ *
+ * ```ts
+ * import { Proxy, SystemProxy, DEFAULT_BYPASS } from 'green-tunnel';
+ *
+ * const proxy = new Proxy({ port: 8000, dns: { mode: 'doh' } });
+ * const { host, port } = await proxy.start();
+ *
+ * const system = new SystemProxy();
+ * await system.enable({ host, port, bypass: DEFAULT_BYPASS });
+ * ```
+ */
+export { Proxy } from './proxy/index.js';
+export { DEFAULT_DNS, DEFAULT_FRAGMENT, DEFAULT_SETTINGS, assertValidSettings, resolveSettings, } from './config.js';
+export { ConnectError, DnsError, GreenTunnelError, ProtocolError, SystemProxyError, toError, } from './errors.js';
+export { LOG_LEVELS, Logger, createLogger, isLogLevel, stderrSink, } from './logger.js';
+export { CachingDnsResolver, DohResolver, DotResolver, PlainResolver, createDnsResolver, } from './dns/index.js';
+export { DEFAULT_BYPASS, SystemProxy, createSystemProxyDriver, defaultRecoveryPath, isSystemProxySupported, recoverSystemProxy, } from './system-proxy/index.js';
+export { fragmentClientHello, isClientHello, splitBytes } from './tls/fragment.js';
+export { HttpRequestRewriter, createRequestRewriteStream } from './http/rewriter.js';
+export { getHeader, parseRequestHead, resolveUpstream, serializeRequestHead, splitAuthority, toOriginForm, } from './http/head.js';
+//# sourceMappingURL=index.js.map

package/dist/core/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,KAAK,EAA0B,MAAM,kBAAkB,CAAC;AAEjE,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,GAChB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,YAAY,EACZ,QAAQ,EACR,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,OAAO,GACR,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,UAAU,EACV,MAAM,EACN,YAAY,EACZ,UAAU,EACV,UAAU,GAKX,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,kBAAkB,EAClB,WAAW,EACX,WAAW,EACX,aAAa,EACb,iBAAiB,GAGlB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,cAAc,EACd,WAAW,EACX,uBAAuB,EACvB,mBAAmB,EACnB,sBAAsB,EACtB,kBAAkB,GAGnB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEnF,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAErF,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,eAAe,EACf,oBAAoB,EACpB,cAAc,EACd,YAAY,GAGb,MAAM,gBAAgB,CAAC"}

package/dist/core/logger.d.ts

@@ -0,0 +1,38 @@
+export type LogLevel = 'silent' | 'error' | 'warn' | 'info' | 'debug' | 'trace';
+export interface LogRecord {
+    readonly level: Exclude<LogLevel, 'silent'>;
+    readonly scope: string;
+    readonly message: string;
+    readonly time: number;
+    readonly error?: Error;
+}
+export type LogSink = (record: LogRecord) => void;
+export interface LoggerOptions {
+    readonly level?: LogLevel;
+    /** Where records go. Defaults to a coloured stderr writer. */
+    readonly sink?: LogSink;
+}
+/** Every level, quietest first — for `--log-level` help and level pickers. */
+export declare const LOG_LEVELS: readonly LogLevel[];
+export declare function isLogLevel(value: string): value is LogLevel;
+export declare const stderrSink: LogSink;
+/**
+ * A ~50-line replacement for `debug`. Levelled, scoped, and pluggable so the
+ * Electron main process can forward records straight into the UI.
+ */
+export declare class Logger {
+    #private;
+    readonly scope: string;
+    constructor(scope?: string, options?: LoggerOptions);
+    get level(): LogLevel;
+    setLevel(level: LogLevel): void;
+    setSink(sink: LogSink): void;
+    child(scope: string): Logger;
+    error(message: string, error?: Error): void;
+    warn(message: string): void;
+    info(message: string): void;
+    debug(message: string): void;
+    trace(message: string): void;
+}
+export declare function createLogger(options?: LoggerOptions): Logger;
+//# sourceMappingURL=logger.d.ts.map

package/dist/core/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/core/logger.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;AAEhF,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACxB;AAED,MAAM,MAAM,OAAO,GAAG,CAAC,MAAM,EAAE,SAAS,KAAK,IAAI,CAAC;AAElD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB;AAWD,8EAA8E;AAC9E,eAAO,MAAM,UAAU,EAAE,SAAS,QAAQ,EAOzC,CAAC;AAUF,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,QAAQ,CAE3D;AAED,eAAO,MAAM,UAAU,EAAE,OAOxB,CAAC;AAQF;;;GAGG;AACH,qBAAa,MAAM;;IACjB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;gBAGX,KAAK,SAAiB,EAAE,OAAO,GAAE,aAAkB;IAK/D,IAAI,KAAK,IAAI,QAAQ,CAEpB;IAED,QAAQ,CAAC,KAAK,EAAE,QAAQ,GAAG,IAAI;IAI/B,OAAO,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI;IAI5B,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAU5B,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI;IAI3C,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAI3B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAI3B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAI5B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;CAY7B;AAED,wBAAgB,YAAY,CAAC,OAAO,GAAE,aAAkB,GAAG,MAAM,CAEhE"}

package/dist/core/logger.js

@@ -0,0 +1,92 @@
+import { styleText } from 'node:util';
+const RANK = {
+    silent: 0,
+    error: 1,
+    warn: 2,
+    info: 3,
+    debug: 4,
+    trace: 5,
+};
+/** Every level, quietest first — for `--log-level` help and level pickers. */
+export const LOG_LEVELS = [
+    'silent',
+    'error',
+    'warn',
+    'info',
+    'debug',
+    'trace',
+];
+const COLOR = {
+    error: 'red',
+    warn: 'yellow',
+    info: 'cyan',
+    debug: 'gray',
+    trace: 'gray',
+};
+export function isLogLevel(value) {
+    return Object.hasOwn(RANK, value);
+}
+export const stderrSink = (record) => {
+    const time = new Date(record.time).toISOString().slice(11, 23);
+    const head = styleText(COLOR[record.level], `${record.level.padEnd(5)} ${record.scope}`);
+    console.error(`${styleText('gray', time)} ${head} ${record.message}`);
+    if (record.error?.stack) {
+        console.error(styleText('gray', record.error.stack));
+    }
+};
+/**
+ * A ~50-line replacement for `debug`. Levelled, scoped, and pluggable so the
+ * Electron main process can forward records straight into the UI.
+ */
+export class Logger {
+    scope;
+    #state;
+    constructor(scope = 'green-tunnel', options = {}) {
+        this.scope = scope;
+        this.#state = { level: options.level ?? 'error', sink: options.sink ?? stderrSink };
+    }
+    get level() {
+        return this.#state.level;
+    }
+    setLevel(level) {
+        this.#state.level = level;
+    }
+    setSink(sink) {
+        this.#state.sink = sink;
+    }
+    child(scope) {
+        const child = new Logger(`${this.scope}:${scope}`);
+        // Deliberately the *same* state object, not a copy of the values: the log
+        // panel raises the level while the app is running, and a child created
+        // before that would otherwise stay stuck at whatever the level was when it
+        // was made — silently swallowing exactly the records the user asked for.
+        child.#state = this.#state;
+        return child;
+    }
+    error(message, error) {
+        this.#emit('error', message, error);
+    }
+    warn(message) {
+        this.#emit('warn', message);
+    }
+    info(message) {
+        this.#emit('info', message);
+    }
+    debug(message) {
+        this.#emit('debug', message);
+    }
+    trace(message) {
+        this.#emit('trace', message);
+    }
+    #emit(level, message, error) {
+        if (RANK[level] > RANK[this.#state.level])
+            return;
+        this.#state.sink(error
+            ? { level, scope: this.scope, message, time: Date.now(), error }
+            : { level, scope: this.scope, message, time: Date.now() });
+    }
+}
+export function createLogger(options = {}) {
+    return new Logger('green-tunnel', options);
+}
+//# sourceMappingURL=logger.js.map

package/dist/core/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/core/logger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAoBtC,MAAM,IAAI,GAA6B;IACrC,MAAM,EAAE,CAAC;IACT,KAAK,EAAE,CAAC;IACR,IAAI,EAAE,CAAC;IACP,IAAI,EAAE,CAAC;IACP,KAAK,EAAE,CAAC;IACR,KAAK,EAAE,CAAC;CACT,CAAC;AAEF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,UAAU,GAAwB;IAC7C,QAAQ;IACR,OAAO;IACP,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;CACR,CAAC;AAEF,MAAM,KAAK,GAAyE;IAClF,KAAK,EAAE,KAAK;IACZ,IAAI,EAAE,QAAQ;IACd,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,MAAM;IACb,KAAK,EAAE,MAAM;CACd,CAAC;AAEF,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAY,CAAC,MAAM,EAAE,EAAE;IAC5C,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACzF,OAAO,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACtE,IAAI,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACvD,CAAC;AACH,CAAC,CAAC;AAQF;;;GAGG;AACH,MAAM,OAAO,MAAM;IACR,KAAK,CAAS;IACvB,MAAM,CAAc;IAEpB,YAAY,KAAK,GAAG,cAAc,EAAE,UAAyB,EAAE;QAC7D,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,MAAM,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,UAAU,EAAE,CAAC;IACtF,CAAC;IAED,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;IAC3B,CAAC;IAED,QAAQ,CAAC,KAAe;QACtB,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IAC5B,CAAC;IAED,OAAO,CAAC,IAAa;QACnB,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,KAAa;QACjB,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,EAAE,CAAC,CAAC;QACnD,0EAA0E;QAC1E,uEAAuE;QACvE,2EAA2E;QAC3E,yEAAyE;QACzE,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,OAAe,EAAE,KAAa;QAClC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,CAAC,OAAe;QAClB,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED,IAAI,CAAC,OAAe;QAClB,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,OAAe;QACnB,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,OAAe;QACnB,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,KAAkC,EAAE,OAAe,EAAE,KAAa;QACtE,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO;QAClD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,KAAK;YACH,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE;YAChE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAC5D,CAAC;IACJ,CAAC;CACF;AAED,MAAM,UAAU,YAAY,CAAC,UAAyB,EAAE;IACtD,OAAO,IAAI,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;AAC7C,CAAC"}