green-tunnel 2.0.2 → 3.0.2

package/dist/core/system-proxy/linux.js

@@ -0,0 +1,100 @@
+import { SystemProxyError } from '../errors.js';
+import { exec, isAvailable, settle, tryExec } from './exec.js';
+const GSETTINGS = 'gsettings';
+const SCHEMA = 'org.gnome.system.proxy';
+/**
+ * Linux driver, GNOME/GSettings flavour — which also covers Unity, Cinnamon,
+ * Budgie and anything else reading the same schema.
+ *
+ * Note this only affects applications that honour the desktop proxy settings.
+ * Terminal tools read `http_proxy`/`https_proxy`, which no process can set for
+ * another; the CLI prints them for you to export.
+ */
+export class LinuxSystemProxy {
+    platform = 'linux';
+    async snapshot() {
+        await this.#assertAvailable();
+        const mode = unquote(await exec(GSETTINGS, ['get', SCHEMA, 'mode']));
+        const enabled = mode === 'manual';
+        return {
+            platform: 'linux',
+            entries: [
+                {
+                    target: 'mode',
+                    enabled,
+                    ...(await readEndpoint('http')),
+                    secure: { enabled, ...(await readEndpoint('https')) },
+                    bypass: parseGVariantList((await tryExec(GSETTINGS, ['get', SCHEMA, 'ignore-hosts'])) ?? ''),
+                },
+            ],
+        };
+    }
+    async apply(settings) {
+        await this.#assertAvailable();
+        const port = String(settings.port);
+        for (const protocol of ['http', 'https']) {
+            await exec(GSETTINGS, ['set', `${SCHEMA}.${protocol}`, 'host', settings.host]);
+            await exec(GSETTINGS, ['set', `${SCHEMA}.${protocol}`, 'port', port]);
+        }
+        await exec(GSETTINGS, ['set', SCHEMA, 'ignore-hosts', toGVariantList(settings.bypass)]);
+        // Flip the mode last, so nothing is ever routed at a half-written config.
+        await exec(GSETTINGS, ['set', SCHEMA, 'mode', 'manual']);
+    }
+    async restore(snapshot) {
+        await this.#assertAvailable();
+        const previous = snapshot.entries[0];
+        if (!previous)
+            return;
+        // Turn the mode off *first*: until it is `none`, every write below is live
+        // configuration that apps may pick up.
+        await settle([
+            async () => {
+                if (!previous.enabled)
+                    await exec(GSETTINGS, ['set', SCHEMA, 'mode', 'none']);
+            },
+            () => writeEndpoint('http', previous),
+            () => writeEndpoint('https', previous.secure ?? previous),
+            () => exec(GSETTINGS, [
+                'set',
+                SCHEMA,
+                'ignore-hosts',
+                toGVariantList(previous.bypass ?? []),
+            ]).then(() => undefined),
+            async () => {
+                if (previous.enabled)
+                    await exec(GSETTINGS, ['set', SCHEMA, 'mode', 'manual']);
+            },
+        ]);
+    }
+    async #assertAvailable() {
+        if (!(await isAvailable(GSETTINGS, ['--version']))) {
+            throw new SystemProxyError('gsettings is not available — set the system proxy manually, or use the ' +
+                'proxy directly at the address GreenTunnel printed.');
+        }
+    }
+}
+async function readEndpoint(protocol) {
+    const host = unquote((await tryExec(GSETTINGS, ['get', `${SCHEMA}.${protocol}`, 'host'])) ?? '');
+    const port = Number.parseInt((await tryExec(GSETTINGS, ['get', `${SCHEMA}.${protocol}`, 'port'])) ?? '0', 10);
+    return { host, port: port || 0 };
+}
+async function writeEndpoint(protocol, state) {
+    await exec(GSETTINGS, ['set', `${SCHEMA}.${protocol}`, 'host', state.host]);
+    await exec(GSETTINGS, ['set', `${SCHEMA}.${protocol}`, 'port', String(state.port)]);
+}
+/** `gsettings get` wraps strings in single quotes. */
+function unquote(value) {
+    return value.trim().replace(/^'(.*)'$/s, '$1');
+}
+function toGVariantList(values) {
+    return `[${values.map((value) => `'${value.replace(/'/g, "\\'")}'`).join(', ')}]`;
+}
+/** `['localhost', '127.0.0.0/8']` — or `@as []` for an empty list. */
+function parseGVariantList(value) {
+    const items = [];
+    for (const match of value.matchAll(/'((?:[^'\\]|\\.)*)'/g)) {
+        items.push((match[1] ?? '').replace(/\\(.)/g, '$1'));
+    }
+    return items;
+}
+//# sourceMappingURL=linux.js.map

package/dist/core/system-proxy/linux.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"linux.js","sourceRoot":"","sources":["../../../src/core/system-proxy/linux.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGhD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE/D,MAAM,SAAS,GAAG,WAAW,CAAC;AAC9B,MAAM,MAAM,GAAG,wBAAwB,CAAC;AAExC;;;;;;;GAOG;AACH,MAAM,OAAO,gBAAgB;IAClB,QAAQ,GAAoB,OAAO,CAAC;IAE7C,KAAK,CAAC,QAAQ;QACZ,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QACrE,MAAM,OAAO,GAAG,IAAI,KAAK,QAAQ,CAAC;QAElC,OAAO;YACL,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE;gBACP;oBACE,MAAM,EAAE,MAAM;oBACd,OAAO;oBACP,GAAG,CAAC,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;oBAC/B,MAAM,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE;oBACrD,MAAM,EAAE,iBAAiB,CACvB,CAAC,MAAM,OAAO,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,CAClE;iBACF;aACF;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,QAA6B;QACvC,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAEnC,KAAK,MAAM,QAAQ,IAAI,CAAC,MAAM,EAAE,OAAO,CAAU,EAAE,CAAC;YAClD,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,GAAG,MAAM,IAAI,QAAQ,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/E,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,GAAG,MAAM,IAAI,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACxF,0EAA0E;QAC1E,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAA6B;QACzC,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACrC,IAAI,CAAC,QAAQ;YAAE,OAAO;QAEtB,2EAA2E;QAC3E,uCAAuC;QACvC,MAAM,MAAM,CAAC;YACX,KAAK,IAAI,EAAE;gBACT,IAAI,CAAC,QAAQ,CAAC,OAAO;oBAAE,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;YAChF,CAAC;YACD,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC;YACrC,GAAG,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC;YACzD,GAAG,EAAE,CACH,IAAI,CAAC,SAAS,EAAE;gBACd,KAAK;gBACL,MAAM;gBACN,cAAc;gBACd,cAAc,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC;aACtC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;YAC1B,KAAK,IAAI,EAAE;gBACT,IAAI,QAAQ,CAAC,OAAO;oBAAE,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;YACjF,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,gBAAgB;QACpB,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,SAAS,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,gBAAgB,CACxB,yEAAyE;gBACvE,oDAAoD,CACvD,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAED,KAAK,UAAU,YAAY,CAAC,QAA0B;IACpD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,MAAM,OAAO,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,GAAG,MAAM,IAAI,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACjG,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAC1B,CAAC,MAAM,OAAO,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,GAAG,MAAM,IAAI,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,EAC3E,EAAE,CACH,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;AACnC,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,QAA0B,EAAE,KAAyB;IAChF,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,GAAG,MAAM,IAAI,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5E,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,GAAG,MAAM,IAAI,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,sDAAsD;AACtD,SAAS,OAAO,CAAC,KAAa;IAC5B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,cAAc,CAAC,MAAyB;IAC/C,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AACpF,CAAC;AAED,sEAAsE;AACtE,SAAS,iBAAiB,CAAC,KAAa;IACtC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC3D,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/core/system-proxy/recovery.d.ts

@@ -0,0 +1,23 @@
+import type { SystemProxySnapshot } from '../types.js';
+/**
+ * Where the pending snapshot lives while the proxy is active.
+ *
+ * Deliberately *shared* between the CLI and the desktop app: if the CLI is
+ * killed mid-run, the next launch of either one can put the machine back.
+ * Deliberately *not* in `os.tmpdir()`, which macOS periodically sweeps — the
+ * whole value of this file is surviving a crash and a reboot.
+ */
+export declare function defaultRecoveryPath(): string;
+/** Record a snapshot before touching the OS, so a crash is still recoverable. */
+export declare function writeRecoveryFile(path: string, snapshot: SystemProxySnapshot): Promise<void>;
+export declare function removeRecoveryFile(path: string): Promise<void>;
+/**
+ * Read a snapshot left behind by a previous run.
+ *
+ * Returns `undefined` when there is nothing to recover, when the file is
+ * unreadable or corrupt, when it came from a different OS, or when the process
+ * that wrote it is **still running** — that last case is a live owner, not an
+ * orphan, and stealing its snapshot would rip the proxy out from under it.
+ */
+export declare function readRecoveryFile(path: string): Promise<SystemProxySnapshot | undefined>;
+//# sourceMappingURL=recovery.d.ts.map

package/dist/core/system-proxy/recovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery.d.ts","sourceRoot":"","sources":["../../../src/core/system-proxy/recovery.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAEV,mBAAmB,EAEpB,MAAM,aAAa,CAAC;AAErB;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAoB5C;AAED,iFAAiF;AACjF,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,mBAAmB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAGf;AAED,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpE;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAsB7F"}

package/dist/core/system-proxy/recovery.js

@@ -0,0 +1,147 @@
+import { mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import process from 'node:process';
+/**
+ * Where the pending snapshot lives while the proxy is active.
+ *
+ * Deliberately *shared* between the CLI and the desktop app: if the CLI is
+ * killed mid-run, the next launch of either one can put the machine back.
+ * Deliberately *not* in `os.tmpdir()`, which macOS periodically sweeps — the
+ * whole value of this file is surviving a crash and a reboot.
+ */
+export function defaultRecoveryPath() {
+    const file = 'system-proxy-snapshot.json';
+    const home = homedir();
+    switch (process.platform) {
+        case 'darwin':
+            return join(home, 'Library', 'Application Support', 'green-tunnel', file);
+        case 'win32':
+            return join(process.env['LOCALAPPDATA'] ?? join(home, 'AppData', 'Local'), 'green-tunnel', file);
+        default:
+            return join(process.env['XDG_STATE_HOME'] ?? join(home, '.local', 'state'), 'green-tunnel', file);
+    }
+}
+/** Record a snapshot before touching the OS, so a crash is still recoverable. */
+export async function writeRecoveryFile(path, snapshot) {
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, JSON.stringify({ ...snapshot, pid: process.pid }, null, 2), 'utf8');
+}
+export async function removeRecoveryFile(path) {
+    await rm(path, { force: true });
+}
+/**
+ * Read a snapshot left behind by a previous run.
+ *
+ * Returns `undefined` when there is nothing to recover, when the file is
+ * unreadable or corrupt, when it came from a different OS, or when the process
+ * that wrote it is **still running** — that last case is a live owner, not an
+ * orphan, and stealing its snapshot would rip the proxy out from under it.
+ */
+export async function readRecoveryFile(path) {
+    let text;
+    try {
+        text = await readFile(path, 'utf8');
+    }
+    catch {
+        return undefined;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+    const snapshot = parseSnapshot(parsed);
+    if (!snapshot)
+        return undefined;
+    if (snapshot.platform !== process.platform)
+        return undefined;
+    if (snapshot.pid !== undefined && snapshot.pid !== process.pid && isProcessAlive(snapshot.pid)) {
+        return undefined;
+    }
+    return snapshot;
+}
+/** Signal 0 tests for existence without delivering anything. */
+function isProcessAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        // EPERM means it exists but belongs to someone else — still alive.
+        return error.code === 'EPERM';
+    }
+}
+/**
+ * Validate rather than cast. This file is replayed straight into `networksetup`
+ * / `reg.exe` argument arrays, so a truncated or hand-edited file must be
+ * rejected outright instead of turning into nonsense arguments.
+ */
+function parseSnapshot(value) {
+    if (typeof value !== 'object' || value === null)
+        return undefined;
+    const raw = value;
+    const platform = raw['platform'];
+    const rawEntries = raw['entries'];
+    if (typeof platform !== 'string' || !Array.isArray(rawEntries))
+        return undefined;
+    const entries = [];
+    for (const candidate of rawEntries) {
+        const entry = parseEntry(candidate);
+        if (!entry)
+            return undefined;
+        entries.push(entry);
+    }
+    const pid = raw['pid'];
+    return {
+        platform: platform,
+        entries,
+        ...(typeof pid === 'number' ? { pid } : {}),
+    };
+}
+function parseEntry(value) {
+    const endpoint = parseEndpoint(value);
+    if (!endpoint)
+        return undefined;
+    const raw = value;
+    const target = raw['target'];
+    if (typeof target !== 'string' || target.length === 0)
+        return undefined;
+    const secure = raw['secure'] === undefined ? undefined : parseEndpoint(raw['secure']);
+    if (raw['secure'] !== undefined && !secure)
+        return undefined;
+    const rawBypass = raw['bypass'];
+    let bypass;
+    if (rawBypass !== undefined) {
+        if (!Array.isArray(rawBypass))
+            return undefined;
+        if (!rawBypass.every((item) => typeof item === 'string'))
+            return undefined;
+        bypass = rawBypass;
+    }
+    return {
+        target,
+        ...endpoint,
+        ...(secure ? { secure } : {}),
+        ...(bypass ? { bypass } : {}),
+    };
+}
+function parseEndpoint(value) {
+    if (typeof value !== 'object' || value === null)
+        return undefined;
+    const raw = value;
+    const { enabled, host, port } = {
+        enabled: raw['enabled'],
+        host: raw['host'],
+        port: raw['port'],
+    };
+    if (typeof enabled !== 'boolean' || typeof host !== 'string')
+        return undefined;
+    if (typeof port !== 'number' || !Number.isInteger(port) || port < 0 || port > 65_535) {
+        return undefined;
+    }
+    return { enabled, host, port };
+}
+//# sourceMappingURL=recovery.js.map

package/dist/core/system-proxy/recovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery.js","sourceRoot":"","sources":["../../../src/core/system-proxy/recovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,OAAO,MAAM,cAAc,CAAC;AAOnC;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,IAAI,GAAG,4BAA4B,CAAC;IAC1C,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,QAAQ,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzB,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;QAC5E,KAAK,OAAO;YACV,OAAO,IAAI,CACT,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,EAC7D,cAAc,EACd,IAAI,CACL,CAAC;QACJ;YACE,OAAO,IAAI,CACT,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,EAC9D,cAAc,EACd,IAAI,CACL,CAAC;IACN,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAY,EACZ,QAA6B;IAE7B,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AAC5F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAY;IACnD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAClC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY;IACjD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC7D,IAAI,QAAQ,CAAC,GAAG,KAAK,SAAS,IAAI,QAAQ,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/F,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,gEAAgE;AAChE,SAAS,cAAc,CAAC,GAAW;IACjC,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mEAAmE;QACnE,OAAQ,KAA+B,CAAC,IAAI,KAAK,OAAO,CAAC;IAC3D,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,GAAG,GAAG,KAAgC,CAAC;IAE7C,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;IACjC,MAAM,UAAU,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;IAClC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC;IAEjF,MAAM,OAAO,GAA+B,EAAE,CAAC;IAC/C,KAAK,MAAM,SAAS,IAAI,UAAuB,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,OAAO;QACL,QAAQ,EAAE,QAA2B;QACrC,OAAO;QACP,GAAG,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAEhC,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAExE,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtF,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,SAAS,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAE7D,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,MAA4B,CAAC;IACjC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAChD,IAAI,CAAE,SAAuB,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;YAAE,OAAO,SAAS,CAAC;QAC1F,MAAM,GAAG,SAAqB,CAAC;IACjC,CAAC;IAED,OAAO;QACL,MAAM;QACN,GAAG,QAAQ;QACX,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG;QAC9B,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC;QACvB,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC;QACjB,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC;KAClB,CAAC;IACF,IAAI,OAAO,OAAO,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC/E,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,MAAM,EAAE,CAAC;QACrF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACjC,CAAC"}

package/dist/core/system-proxy/windows.d.ts

@@ -0,0 +1,15 @@
+import type { SystemProxySettings, SystemProxySnapshot } from '../types.js';
+import type { SystemProxyDriver } from './driver.js';
+/**
+ * Windows driver, writing the WinINet settings every browser and most apps read.
+ *
+ * Uses `reg.exe` directly instead of the `winreg` package — one fewer
+ * dependency, and the argument-array form removes v2's quoting problems.
+ */
+export declare class WindowsSystemProxy implements SystemProxyDriver {
+    readonly platform: NodeJS.Platform;
+    snapshot(): Promise<SystemProxySnapshot>;
+    apply(settings: SystemProxySettings): Promise<void>;
+    restore(snapshot: SystemProxySnapshot): Promise<void>;
+}
+//# sourceMappingURL=windows.d.ts.map

package/dist/core/system-proxy/windows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"windows.d.ts","sourceRoot":"","sources":["../../../src/core/system-proxy/windows.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAMrD;;;;;GAKG;AACH,qBAAa,kBAAmB,YAAW,iBAAiB;IAC1D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAW;IAEvC,QAAQ,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAoBxC,KAAK,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAYnD,OAAO,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;CAqB5D"}

package/dist/core/system-proxy/windows.js

@@ -0,0 +1,96 @@
+import { exec, settle, tryExec } from './exec.js';
+const REG = 'reg.exe';
+const KEY = 'HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings';
+/**
+ * Windows driver, writing the WinINet settings every browser and most apps read.
+ *
+ * Uses `reg.exe` directly instead of the `winreg` package — one fewer
+ * dependency, and the argument-array form removes v2's quoting problems.
+ */
+export class WindowsSystemProxy {
+    platform = 'win32';
+    async snapshot() {
+        const enabled = (await readValue('ProxyEnable')) === '0x1';
+        const server = (await readValue('ProxyServer')) ?? '';
+        const [host = '', port = ''] = server.split(':');
+        const override = (await readValue('ProxyOverride')) ?? '';
+        return {
+            platform: 'win32',
+            entries: [
+                {
+                    target: KEY,
+                    enabled,
+                    host,
+                    port: Number.parseInt(port, 10) || 0,
+                    bypass: override.length > 0 ? override.split(';') : [],
+                },
+            ],
+        };
+    }
+    async apply(settings) {
+        await writeValue('ProxyServer', 'REG_SZ', `${settings.host}:${String(settings.port)}`);
+        await writeValue('ProxyOverride', 'REG_SZ', settings.bypass.length > 0 ? settings.bypass.join(';') : '<local>');
+        // Enable last: until this flips, the values above are inert.
+        await writeValue('ProxyEnable', 'REG_DWORD', '1');
+        await refreshWinInet();
+    }
+    async restore(snapshot) {
+        const previous = snapshot.entries[0];
+        if (!previous)
+            return;
+        const on = previous.enabled && previous.host.length > 0;
+        await settle([
+            // Disable first, so nothing is routed at a half-written config.
+            async () => {
+                if (!on)
+                    await writeValue('ProxyEnable', 'REG_DWORD', '0');
+            },
+            () => writeValue('ProxyServer', 'REG_SZ', on ? `${previous.host}:${String(previous.port)}` : ''),
+            () => writeValue('ProxyOverride', 'REG_SZ', (previous.bypass ?? []).join(';')),
+            async () => {
+                if (on)
+                    await writeValue('ProxyEnable', 'REG_DWORD', '1');
+            },
+            // Always tell WinINet to re-read, even if a write above failed.
+            refreshWinInet,
+        ]);
+    }
+}
+async function readValue(name) {
+    const output = await tryExec(REG, ['query', KEY, '/v', name]);
+    // `    ProxyEnable    REG_DWORD    0x1`
+    return output
+        ?.split('\n')
+        .find((line) => line.includes(name))
+        ?.trim()
+        .split(/\s{2,}/)[2];
+}
+async function writeValue(name, type, data) {
+    await exec(REG, ['add', KEY, '/v', name, '/t', type, '/d', data, '/f']);
+}
+/**
+ * Registry writes alone do not take effect until WinINet is told to re-read
+ * them. There is no CLI for `InternetSetOption`, so drive it through PowerShell
+ * — base64/UTF-16LE encoded to sidestep every layer of quoting.
+ */
+async function refreshWinInet() {
+    const script = `
+$signature = @'
+[DllImport("wininet.dll", SetLastError = true, CharSet = CharSet.Auto)]
+public static extern bool InternetSetOption(IntPtr hInternet, int dwOption, IntPtr lpBuffer, int dwBufferLength);
+'@
+$wininet = Add-Type -MemberDefinition $signature -Name WinInet -Namespace Native -PassThru
+# 39 = INTERNET_OPTION_SETTINGS_CHANGED, 37 = INTERNET_OPTION_REFRESH
+$wininet::InternetSetOption([IntPtr]::Zero, 39, [IntPtr]::Zero, 0) | Out-Null
+$wininet::InternetSetOption([IntPtr]::Zero, 37, [IntPtr]::Zero, 0) | Out-Null
+`.trim();
+    await tryExec('powershell.exe', [
+        '-NoProfile',
+        '-NonInteractive',
+        '-ExecutionPolicy',
+        'Bypass',
+        '-EncodedCommand',
+        Buffer.from(script, 'utf16le').toString('base64'),
+    ]);
+}
+//# sourceMappingURL=windows.js.map

package/dist/core/system-proxy/windows.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"windows.js","sourceRoot":"","sources":["../../../src/core/system-proxy/windows.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAElD,MAAM,GAAG,GAAG,SAAS,CAAC;AACtB,MAAM,GAAG,GAAG,uEAAuE,CAAC;AAEpF;;;;;GAKG;AACH,MAAM,OAAO,kBAAkB;IACpB,QAAQ,GAAoB,OAAO,CAAC;IAE7C,KAAK,CAAC,QAAQ;QACZ,MAAM,OAAO,GAAG,CAAC,MAAM,SAAS,CAAC,aAAa,CAAC,CAAC,KAAK,KAAK,CAAC;QAC3D,MAAM,MAAM,GAAG,CAAC,MAAM,SAAS,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,MAAM,CAAC,IAAI,GAAG,EAAE,EAAE,IAAI,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,CAAC,MAAM,SAAS,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,CAAC;QAE1D,OAAO;YACL,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE;gBACP;oBACE,MAAM,EAAE,GAAG;oBACX,OAAO;oBACP,IAAI;oBACJ,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC;oBACpC,MAAM,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;iBACvD;aACF;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,QAA6B;QACvC,MAAM,UAAU,CAAC,aAAa,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvF,MAAM,UAAU,CACd,eAAe,EACf,QAAQ,EACR,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CACnE,CAAC;QACF,6DAA6D;QAC7D,MAAM,UAAU,CAAC,aAAa,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;QAClD,MAAM,cAAc,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAA6B;QACzC,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACrC,IAAI,CAAC,QAAQ;YAAE,OAAO;QAEtB,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QAExD,MAAM,MAAM,CAAC;YACX,gEAAgE;YAChE,KAAK,IAAI,EAAE;gBACT,IAAI,CAAC,EAAE;oBAAE,MAAM,UAAU,CAAC,aAAa,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;YAC7D,CAAC;YACD,GAAG,EAAE,CACH,UAAU,CAAC,aAAa,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5F,GAAG,EAAE,CAAC,UAAU,CAAC,eAAe,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC9E,KAAK,IAAI,EAAE;gBACT,IAAI,EAAE;oBAAE,MAAM,UAAU,CAAC,aAAa,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;YAC5D,CAAC;YACD,gEAAgE;YAChE,cAAc;SACf,CAAC,CAAC;IACL,CAAC;CACF;AAED,KAAK,UAAU,SAAS,CAAC,IAAY;IACnC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9D,wCAAwC;IACxC,OAAO,MAAM;QACX,EAAE,KAAK,CAAC,IAAI,CAAC;SACZ,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpC,EAAE,IAAI,EAAE;SACP,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,IAAY,EAAE,IAAY;IAChE,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,cAAc;IAC3B,MAAM,MAAM,GAAG;;;;;;;;;CAShB,CAAC,IAAI,EAAE,CAAC;IAEP,MAAM,OAAO,CAAC,gBAAgB,EAAE;QAC9B,YAAY;QACZ,iBAAiB;QACjB,kBAAkB;QAClB,QAAQ;QACR,iBAAiB;QACjB,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;KAClD,CAAC,CAAC;AACL,CAAC"}

package/dist/core/tls/fragment.d.ts

@@ -0,0 +1,28 @@
+import type { FragmentSettings } from '../types.js';
+export declare const TLS_HEADER_SIZE = 5;
+/**
+ * True when `data` starts with a TLS handshake record carrying a ClientHello —
+ * i.e. the packet that contains the SNI a DPI box is looking for.
+ *
+ * v2 fragmented whatever the first client packet happened to be. Checking first
+ * means non-TLS tunnels (SSH over CONNECT, plain sockets) pass through intact.
+ */
+export declare function isClientHello(data: Buffer): boolean;
+/**
+ * Split a ClientHello so no single piece contains a complete SNI.
+ *
+ * Two strategies:
+ * - **TCP split** (`tlsRecords: false`) — one TLS record, chopped across
+ *   several `write()` calls. Beats boxes that inspect single segments.
+ * - **Record split** (`tlsRecords: true`) — the handshake payload is re-framed
+ *   into several individually valid TLS records. Beats boxes that reassemble
+ *   the TCP stream but inspect record-by-record. Legal per RFC 8446 §5.1: a
+ *   handshake message may span multiple records.
+ *
+ * Returns `[data]` unchanged when fragmentation is off or the payload is not a
+ * ClientHello.
+ */
+export declare function fragmentClientHello(data: Buffer, settings: FragmentSettings): Buffer[];
+/** Chop a buffer into `size`-byte pieces. */
+export declare function splitBytes(data: Buffer, size: number): Buffer[];
+//# sourceMappingURL=fragment.d.ts.map

package/dist/core/tls/fragment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fragment.d.ts","sourceRoot":"","sources":["../../../src/core/tls/fragment.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,eAAO,MAAM,eAAe,IAAI,CAAC;AAIjC;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMnD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,GAAG,MAAM,EAAE,CAOtF;AAED,6CAA6C;AAC7C,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAM/D"}

package/dist/core/tls/fragment.js

@@ -0,0 +1,81 @@
+export const TLS_HEADER_SIZE = 5;
+const CONTENT_TYPE_HANDSHAKE = 0x16;
+const HANDSHAKE_TYPE_CLIENT_HELLO = 0x01;
+/**
+ * True when `data` starts with a TLS handshake record carrying a ClientHello —
+ * i.e. the packet that contains the SNI a DPI box is looking for.
+ *
+ * v2 fragmented whatever the first client packet happened to be. Checking first
+ * means non-TLS tunnels (SSH over CONNECT, plain sockets) pass through intact.
+ */
+export function isClientHello(data) {
+    return (data.length > TLS_HEADER_SIZE &&
+        data[0] === CONTENT_TYPE_HANDSHAKE &&
+        data[TLS_HEADER_SIZE] === HANDSHAKE_TYPE_CLIENT_HELLO);
+}
+/**
+ * Split a ClientHello so no single piece contains a complete SNI.
+ *
+ * Two strategies:
+ * - **TCP split** (`tlsRecords: false`) — one TLS record, chopped across
+ *   several `write()` calls. Beats boxes that inspect single segments.
+ * - **Record split** (`tlsRecords: true`) — the handshake payload is re-framed
+ *   into several individually valid TLS records. Beats boxes that reassemble
+ *   the TCP stream but inspect record-by-record. Legal per RFC 8446 §5.1: a
+ *   handshake message may span multiple records.
+ *
+ * Returns `[data]` unchanged when fragmentation is off or the payload is not a
+ * ClientHello.
+ */
+export function fragmentClientHello(data, settings) {
+    if (!settings.enabled || settings.size < 1 || !isClientHello(data)) {
+        return [data];
+    }
+    return settings.tlsRecords
+        ? splitIntoRecords(data, settings.size)
+        : splitBytes(data, settings.size);
+}
+/** Chop a buffer into `size`-byte pieces. */
+export function splitBytes(data, size) {
+    const pieces = [];
+    for (let offset = 0; offset < data.length; offset += size) {
+        pieces.push(data.subarray(offset, offset + size));
+    }
+    return pieces;
+}
+/**
+ * Re-frame one TLS record's payload into N records of at most `size` bytes,
+ * reusing the original content type and legacy version.
+ *
+ * Anything after the first record (a coalesced second record, which does
+ * happen) is forwarded untouched as a final piece — v2 silently corrupted it by
+ * treating the whole buffer as one record's payload.
+ */
+function splitIntoRecords(data, size) {
+    const contentType = data[0];
+    const versionMajor = data[1];
+    const versionMinor = data[2];
+    if (contentType === undefined || versionMajor === undefined || versionMinor === undefined) {
+        return [data];
+    }
+    const declaredLength = data.readUInt16BE(3);
+    const payloadEnd = Math.min(TLS_HEADER_SIZE + declaredLength, data.length);
+    const payload = data.subarray(TLS_HEADER_SIZE, payloadEnd);
+    const records = [];
+    for (let offset = 0; offset < payload.length; offset += size) {
+        const slice = payload.subarray(offset, offset + size);
+        const record = Buffer.allocUnsafe(TLS_HEADER_SIZE + slice.length);
+        record[0] = contentType;
+        record[1] = versionMajor;
+        record[2] = versionMinor;
+        record.writeUInt16BE(slice.length, 3);
+        slice.copy(record, TLS_HEADER_SIZE);
+        records.push(record);
+    }
+    const trailing = data.subarray(payloadEnd);
+    if (trailing.length > 0) {
+        records.push(trailing);
+    }
+    return records.length > 0 ? records : [data];
+}
+//# sourceMappingURL=fragment.js.map

package/dist/core/tls/fragment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fragment.js","sourceRoot":"","sources":["../../../src/core/tls/fragment.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC;AACjC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AACpC,MAAM,2BAA2B,GAAG,IAAI,CAAC;AAEzC;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,CACL,IAAI,CAAC,MAAM,GAAG,eAAe;QAC7B,IAAI,CAAC,CAAC,CAAC,KAAK,sBAAsB;QAClC,IAAI,CAAC,eAAe,CAAC,KAAK,2BAA2B,CACtD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,QAA0B;IAC1E,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QACnE,OAAO,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,QAAQ,CAAC,UAAU;QACxB,CAAC,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;QACvC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,IAAY;IACnD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC;QAC1D,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,gBAAgB,CAAC,IAAY,EAAE,IAAY;IAClD,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,MAAM,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,WAAW,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC1F,OAAO,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,GAAG,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAE3D,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC;QAC7D,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,eAAe,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QAClE,MAAM,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC;QACxB,MAAM,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC;QACzB,MAAM,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC;QACzB,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAC/C,CAAC"}