green-tunnel 2.0.2 → 3.0.3

package/dist/core/config.d.ts

@@ -0,0 +1,13 @@
+import type { DnsSettings, FragmentSettings, ProxyOptions, ProxySettings } from './types.js';
+export declare const DEFAULT_DNS: DnsSettings;
+export declare const DEFAULT_FRAGMENT: FragmentSettings;
+export declare const DEFAULT_SETTINGS: ProxySettings;
+/**
+ * Merge user overrides onto the defaults. Explicit and shallow-per-section on
+ * purpose: a hand-written resolver keeps `exactOptionalPropertyTypes` honest
+ * and makes it obvious which keys exist.
+ */
+export declare function resolveSettings(options?: ProxyOptions): ProxySettings;
+/** Throws `RangeError` on values that would produce a broken proxy. */
+export declare function assertValidSettings(settings: ProxySettings): void;
+//# sourceMappingURL=config.d.ts.map

package/dist/core/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/core/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE7F,eAAO,MAAM,WAAW,EAAE,WAWzB,CAAC;AAEF,eAAO,MAAM,gBAAgB,EAAE,gBAK9B,CAAC;AAEF,eAAO,MAAM,gBAAgB,EAAE,aAQ9B,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,GAAE,YAAiB,GAAG,aAAa,CA0BzE;AAED,uEAAuE;AACvE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI,CA0BjE"}

package/dist/core/config.js

@@ -0,0 +1,87 @@
+export const DEFAULT_DNS = {
+    mode: 'doh',
+    dohUrl: 'https://cloudflare-dns.com/dns-query',
+    dotHost: '1.1.1.1',
+    dotPort: 853,
+    plainServers: [],
+    family: 'ipv4-first',
+    cacheSize: 1000,
+    minTtlSeconds: 30,
+    maxTtlSeconds: 3600,
+    timeoutMs: 5000,
+};
+export const DEFAULT_FRAGMENT = {
+    enabled: true,
+    size: 40,
+    tlsRecords: false,
+    delayMs: 0,
+};
+export const DEFAULT_SETTINGS = {
+    host: '127.0.0.1',
+    port: 8000,
+    httpsOnly: false,
+    connectTimeoutMs: 10_000,
+    idleTimeoutMs: 120_000,
+    fragment: DEFAULT_FRAGMENT,
+    dns: DEFAULT_DNS,
+};
+/**
+ * Merge user overrides onto the defaults. Explicit and shallow-per-section on
+ * purpose: a hand-written resolver keeps `exactOptionalPropertyTypes` honest
+ * and makes it obvious which keys exist.
+ */
+export function resolveSettings(options = {}) {
+    return {
+        host: options.host ?? DEFAULT_SETTINGS.host,
+        port: options.port ?? DEFAULT_SETTINGS.port,
+        httpsOnly: options.httpsOnly ?? DEFAULT_SETTINGS.httpsOnly,
+        connectTimeoutMs: options.connectTimeoutMs ?? DEFAULT_SETTINGS.connectTimeoutMs,
+        idleTimeoutMs: options.idleTimeoutMs ?? DEFAULT_SETTINGS.idleTimeoutMs,
+        fragment: {
+            enabled: options.fragment?.enabled ?? DEFAULT_FRAGMENT.enabled,
+            size: options.fragment?.size ?? DEFAULT_FRAGMENT.size,
+            tlsRecords: options.fragment?.tlsRecords ?? DEFAULT_FRAGMENT.tlsRecords,
+            delayMs: options.fragment?.delayMs ?? DEFAULT_FRAGMENT.delayMs,
+        },
+        dns: {
+            mode: options.dns?.mode ?? DEFAULT_DNS.mode,
+            dohUrl: options.dns?.dohUrl ?? DEFAULT_DNS.dohUrl,
+            dotHost: options.dns?.dotHost ?? DEFAULT_DNS.dotHost,
+            dotPort: options.dns?.dotPort ?? DEFAULT_DNS.dotPort,
+            plainServers: options.dns?.plainServers ?? DEFAULT_DNS.plainServers,
+            family: options.dns?.family ?? DEFAULT_DNS.family,
+            cacheSize: options.dns?.cacheSize ?? DEFAULT_DNS.cacheSize,
+            minTtlSeconds: options.dns?.minTtlSeconds ?? DEFAULT_DNS.minTtlSeconds,
+            maxTtlSeconds: options.dns?.maxTtlSeconds ?? DEFAULT_DNS.maxTtlSeconds,
+            timeoutMs: options.dns?.timeoutMs ?? DEFAULT_DNS.timeoutMs,
+        },
+    };
+}
+/** Throws `RangeError` on values that would produce a broken proxy. */
+export function assertValidSettings(settings) {
+    if (!Number.isInteger(settings.port) || settings.port < 0 || settings.port > 65_535) {
+        throw new RangeError(`port must be an integer in 0..65535, got ${String(settings.port)}`);
+    }
+    if (!Number.isInteger(settings.fragment.size) || settings.fragment.size < 1) {
+        throw new RangeError(`fragment.size must be a positive integer, got ${String(settings.fragment.size)}`);
+    }
+    if (settings.fragment.delayMs < 0) {
+        throw new RangeError(`fragment.delayMs must be >= 0, got ${String(settings.fragment.delayMs)}`);
+    }
+    if (settings.dns.minTtlSeconds > settings.dns.maxTtlSeconds) {
+        throw new RangeError('dns.minTtlSeconds must be <= dns.maxTtlSeconds');
+    }
+    if (settings.dns.mode === 'doh') {
+        let url;
+        try {
+            url = new URL(settings.dns.dohUrl);
+        }
+        catch {
+            throw new RangeError(`dns.dohUrl is not a valid URL: ${settings.dns.dohUrl}`);
+        }
+        if (url.protocol !== 'https:') {
+            throw new RangeError(`dns.dohUrl must use https, got ${url.protocol}`);
+        }
+    }
+}
+//# sourceMappingURL=config.js.map

package/dist/core/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/core/config.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,WAAW,GAAgB;IACtC,IAAI,EAAE,KAAK;IACX,MAAM,EAAE,sCAAsC;IAC9C,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,GAAG;IACZ,YAAY,EAAE,EAAE;IAChB,MAAM,EAAE,YAAY;IACpB,SAAS,EAAE,IAAI;IACf,aAAa,EAAE,EAAE;IACjB,aAAa,EAAE,IAAI;IACnB,SAAS,EAAE,IAAI;CAChB,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAqB;IAChD,OAAO,EAAE,IAAI;IACb,IAAI,EAAE,EAAE;IACR,UAAU,EAAE,KAAK;IACjB,OAAO,EAAE,CAAC;CACX,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAkB;IAC7C,IAAI,EAAE,WAAW;IACjB,IAAI,EAAE,IAAI;IACV,SAAS,EAAE,KAAK;IAChB,gBAAgB,EAAE,MAAM;IACxB,aAAa,EAAE,OAAO;IACtB,QAAQ,EAAE,gBAAgB;IAC1B,GAAG,EAAE,WAAW;CACjB,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,UAAwB,EAAE;IACxD,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,gBAAgB,CAAC,IAAI;QAC3C,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,gBAAgB,CAAC,IAAI;QAC3C,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,gBAAgB,CAAC,SAAS;QAC1D,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,gBAAgB,CAAC,gBAAgB;QAC/E,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,gBAAgB,CAAC,aAAa;QACtE,QAAQ,EAAE;YACR,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,IAAI,gBAAgB,CAAC,OAAO;YAC9D,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,IAAI,gBAAgB,CAAC,IAAI;YACrD,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,UAAU,IAAI,gBAAgB,CAAC,UAAU;YACvE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,IAAI,gBAAgB,CAAC,OAAO;SAC/D;QACD,GAAG,EAAE;YACH,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,IAAI,WAAW,CAAC,IAAI;YAC3C,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,IAAI,WAAW,CAAC,MAAM;YACjD,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,IAAI,WAAW,CAAC,OAAO;YACpD,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,IAAI,WAAW,CAAC,OAAO;YACpD,YAAY,EAAE,OAAO,CAAC,GAAG,EAAE,YAAY,IAAI,WAAW,CAAC,YAAY;YACnE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,IAAI,WAAW,CAAC,MAAM;YACjD,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,IAAI,WAAW,CAAC,SAAS;YAC1D,aAAa,EAAE,OAAO,CAAC,GAAG,EAAE,aAAa,IAAI,WAAW,CAAC,aAAa;YACtE,aAAa,EAAE,OAAO,CAAC,GAAG,EAAE,aAAa,IAAI,WAAW,CAAC,aAAa;YACtE,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,IAAI,WAAW,CAAC,SAAS;SAC3D;KACF,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,mBAAmB,CAAC,QAAuB;IACzD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,IAAI,QAAQ,CAAC,IAAI,GAAG,MAAM,EAAE,CAAC;QACpF,MAAM,IAAI,UAAU,CAAC,4CAA4C,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,UAAU,CAClB,iDAAiD,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAClF,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,UAAU,CAAC,sCAAsC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,QAAQ,CAAC,GAAG,CAAC,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;QAC5D,MAAM,IAAI,UAAU,CAAC,gDAAgD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAChC,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,UAAU,CAAC,kCAAkC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,UAAU,CAAC,kCAAkC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/core/dns/decode.d.ts

@@ -0,0 +1,12 @@
+import type dnsPacket from 'dns-packet';
+import type { DnsRecord } from '../types.js';
+import { type QueryType } from './resolver.js';
+/**
+ * Pull the address records out of a decoded DNS response.
+ *
+ * The two explicit literal comparisons are what narrow `Answer` (a union of
+ * ~18 record shapes) down to the string-valued one — comparing against the
+ * `type` variable alone does not discriminate the union.
+ */
+export declare function extractAddresses(packet: dnsPacket.Packet, type: QueryType): DnsRecord[];
+//# sourceMappingURL=decode.d.ts.map

package/dist/core/dns/decode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decode.d.ts","sourceRoot":"","sources":["../../../src/core/dns/decode.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,SAAS,MAAM,YAAY,CAAC;AACxC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAY,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AAEzD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,SAAS,EAAE,CAavF"}

package/dist/core/dns/decode.js

@@ -0,0 +1,23 @@
+import { familyOf } from './resolver.js';
+/**
+ * Pull the address records out of a decoded DNS response.
+ *
+ * The two explicit literal comparisons are what narrow `Answer` (a union of
+ * ~18 record shapes) down to the string-valued one — comparing against the
+ * `type` variable alone does not discriminate the union.
+ */
+export function extractAddresses(packet, type) {
+    const family = familyOf(type);
+    const records = [];
+    for (const answer of packet.answers ?? []) {
+        if (answer.type !== 'A' && answer.type !== 'AAAA')
+            continue;
+        // CNAMEs in the chain are skipped: the upstream resolver already followed
+        // them and returned the addresses they point at.
+        if (answer.type !== type)
+            continue;
+        records.push({ address: answer.data, family, ttl: answer.ttl ?? 0 });
+    }
+    return records;
+}
+//# sourceMappingURL=decode.js.map

package/dist/core/dns/decode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decode.js","sourceRoot":"","sources":["../../../src/core/dns/decode.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAkB,MAAM,eAAe,CAAC;AAEzD;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAwB,EAAE,IAAe;IACxE,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAgB,EAAE,CAAC;IAEhC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QAC1C,IAAI,MAAM,CAAC,IAAI,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;YAAE,SAAS;QAC5D,0EAA0E;QAC1E,iDAAiD;QACjD,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;YAAE,SAAS;QACnC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/core/dns/doh.d.ts

@@ -0,0 +1,19 @@
+import type { DnsRecord, DnsSettings } from '../types.js';
+import { CachingDnsResolver, type QueryType } from './resolver.js';
+/**
+ * DNS over HTTPS using the RFC 8484 wire format.
+ *
+ * v2 spoke the Google/Cloudflare JSON API, which meant it only worked with the
+ * handful of servers that implement it. Wire format works with essentially
+ * every DoH resolver (Cloudflare, Google, AdGuard, NextDNS, self-hosted …).
+ *
+ * We use the GET form rather than POST: it is cacheable, and it is what
+ * HTTP/1.1-only clients get served. Node's `fetch` does not speak HTTP/2, so a
+ * server that mandates it (Quad9 answers 505 to everything else) is out of
+ * reach — use `--dns dot --dot-host 9.9.9.9` for those.
+ */
+export declare class DohResolver extends CachingDnsResolver {
+    protected query(hostname: string, type: QueryType): Promise<DnsRecord[]>;
+}
+export declare function createDohResolver(settings: DnsSettings): DohResolver;
+//# sourceMappingURL=doh.d.ts.map

package/dist/core/dns/doh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doh.d.ts","sourceRoot":"","sources":["../../../src/core/dns/doh.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,EAAE,kBAAkB,EAAE,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AAEnE;;;;;;;;;;;GAWG;AACH,qBAAa,WAAY,SAAQ,kBAAkB;cACxB,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;CAoCxF;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,WAAW,GAAG,WAAW,CAEpE"}

package/dist/core/dns/doh.js

@@ -0,0 +1,54 @@
+import dnsPacket from 'dns-packet';
+import { DnsError, toError } from '../errors.js';
+import { extractAddresses } from './decode.js';
+import { CachingDnsResolver } from './resolver.js';
+/**
+ * DNS over HTTPS using the RFC 8484 wire format.
+ *
+ * v2 spoke the Google/Cloudflare JSON API, which meant it only worked with the
+ * handful of servers that implement it. Wire format works with essentially
+ * every DoH resolver (Cloudflare, Google, AdGuard, NextDNS, self-hosted …).
+ *
+ * We use the GET form rather than POST: it is cacheable, and it is what
+ * HTTP/1.1-only clients get served. Node's `fetch` does not speak HTTP/2, so a
+ * server that mandates it (Quad9 answers 505 to everything else) is out of
+ * reach — use `--dns dot --dot-host 9.9.9.9` for those.
+ */
+export class DohResolver extends CachingDnsResolver {
+    async query(hostname, type) {
+        const request = dnsPacket.encode({
+            type: 'query',
+            id: 0, // RFC 8484 §4.1 — id 0 keeps responses cacheable by intermediaries.
+            flags: dnsPacket.RECURSION_DESIRED,
+            questions: [{ type, name: hostname }],
+        });
+        const url = new URL(this.settings.dohUrl);
+        url.searchParams.set('dns', request.toString('base64url'));
+        let response;
+        try {
+            response = await fetch(url, {
+                headers: { accept: 'application/dns-message' },
+                signal: AbortSignal.timeout(this.settings.timeoutMs),
+            });
+        }
+        catch (cause) {
+            throw new DnsError(hostname, `DoH request failed: ${toError(cause).message}`, { cause });
+        }
+        if (!response.ok) {
+            throw new DnsError(hostname, `DoH server returned ${String(response.status)}`);
+        }
+        const body = Buffer.from(await response.arrayBuffer());
+        let decoded;
+        try {
+            decoded = dnsPacket.decode(body);
+        }
+        catch (cause) {
+            throw new DnsError(hostname, 'malformed DoH response', { cause });
+        }
+        return extractAddresses(decoded, type);
+    }
+}
+export function createDohResolver(settings) {
+    return new DohResolver(settings);
+}
+//# sourceMappingURL=doh.js.map

package/dist/core/dns/doh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doh.js","sourceRoot":"","sources":["../../../src/core/dns/doh.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAkB,MAAM,eAAe,CAAC;AAEnE;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,WAAY,SAAQ,kBAAkB;IAC9B,KAAK,CAAC,KAAK,CAAC,QAAgB,EAAE,IAAe;QAC9D,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC;YAC/B,IAAI,EAAE,OAAO;YACb,EAAE,EAAE,CAAC,EAAE,oEAAoE;YAC3E,KAAK,EAAE,SAAS,CAAC,iBAAiB;YAClC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;SACtC,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;QAE3D,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAC1B,OAAO,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE;gBAC9C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;aACrD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3F,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QAEvD,IAAI,OAAgC,CAAC;QACrC,IAAI,CAAC;YACH,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,QAAQ,CAAC,QAAQ,EAAE,wBAAwB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,OAAO,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;CACF;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAqB;IACrD,OAAO,IAAI,WAAW,CAAC,QAAQ,CAAC,CAAC;AACnC,CAAC"}

package/dist/core/dns/dot.d.ts

@@ -0,0 +1,13 @@
+import type { DnsRecord, DnsSettings } from '../types.js';
+import { CachingDnsResolver, type QueryType } from './resolver.js';
+/**
+ * DNS over TLS (RFC 7858). One short-lived TLS connection per uncached lookup —
+ * the resolver cache means that is a handful of connections per session, and it
+ * avoids the stale-socket handling a pooled connection would need.
+ */
+export declare class DotResolver extends CachingDnsResolver {
+    #private;
+    protected query(hostname: string, type: QueryType): Promise<DnsRecord[]>;
+}
+export declare function createDotResolver(settings: DnsSettings): DotResolver;
+//# sourceMappingURL=dot.d.ts.map

package/dist/core/dns/dot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dot.d.ts","sourceRoot":"","sources":["../../../src/core/dns/dot.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,EAAE,kBAAkB,EAAE,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AAEnE;;;;GAIG;AACH,qBAAa,WAAY,SAAQ,kBAAkB;;cACxB,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;CAwExF;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,WAAW,GAAG,WAAW,CAEpE"}

package/dist/core/dns/dot.js

@@ -0,0 +1,79 @@
+import { isIP } from 'node:net';
+import tls from 'node:tls';
+import dnsPacket from 'dns-packet';
+import { DnsError, toError } from '../errors.js';
+import { extractAddresses } from './decode.js';
+import { CachingDnsResolver } from './resolver.js';
+/**
+ * DNS over TLS (RFC 7858). One short-lived TLS connection per uncached lookup —
+ * the resolver cache means that is a handful of connections per session, and it
+ * avoids the stale-socket handling a pooled connection would need.
+ */
+export class DotResolver extends CachingDnsResolver {
+    async query(hostname, type) {
+        const request = dnsPacket.streamEncode({
+            type: 'query',
+            id: 0,
+            flags: dnsPacket.RECURSION_DESIRED,
+            questions: [{ type, name: hostname }],
+        });
+        const response = await this.#exchange(hostname, request);
+        let decoded;
+        try {
+            decoded = dnsPacket.streamDecode(response);
+        }
+        catch (cause) {
+            throw new DnsError(hostname, 'malformed DoT response', { cause });
+        }
+        return extractAddresses(decoded, type);
+    }
+    #exchange(hostname, request) {
+        const { dotHost, dotPort, timeoutMs } = this.settings;
+        return new Promise((resolve, reject) => {
+            const socket = tls.connect({
+                host: dotHost,
+                port: dotPort,
+                ALPNProtocols: ['dot'],
+                // Only send SNI when the server is addressed by name; certificates for
+                // IP-addressed resolvers (1.1.1.1, 9.9.9.9) carry IP SANs instead.
+                ...(isIP(dotHost) === 0 ? { servername: dotHost } : {}),
+            });
+            let chunks = Buffer.alloc(0);
+            const finish = (error, value) => {
+                socket.destroy();
+                if (error)
+                    reject(error);
+                else if (value)
+                    resolve(value);
+            };
+            socket.setTimeout(timeoutMs, () => {
+                finish(new DnsError(hostname, `DoT query timed out after ${String(timeoutMs)}ms`));
+            });
+            socket.once('secureConnect', () => {
+                socket.write(request);
+            });
+            socket.on('data', (chunk) => {
+                chunks = Buffer.concat([chunks, chunk]);
+                // Messages are framed with a two-byte big-endian length prefix.
+                if (chunks.length < 2)
+                    return;
+                const expected = chunks.readUInt16BE(0);
+                if (chunks.length >= expected + 2) {
+                    finish(undefined, chunks.subarray(0, expected + 2));
+                }
+            });
+            socket.once('error', (cause) => {
+                finish(new DnsError(hostname, `DoT connection failed: ${toError(cause).message}`, { cause }));
+            });
+            socket.once('close', () => {
+                if (chunks.length === 0) {
+                    finish(new DnsError(hostname, 'DoT connection closed before a response arrived'));
+                }
+            });
+        });
+    }
+}
+export function createDotResolver(settings) {
+    return new DotResolver(settings);
+}
+//# sourceMappingURL=dot.js.map

package/dist/core/dns/dot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dot.js","sourceRoot":"","sources":["../../../src/core/dns/dot.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,GAAG,MAAM,UAAU,CAAC;AAC3B,OAAO,SAAS,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAkB,MAAM,eAAe,CAAC;AAEnE;;;;GAIG;AACH,MAAM,OAAO,WAAY,SAAQ,kBAAkB;IAC9B,KAAK,CAAC,KAAK,CAAC,QAAgB,EAAE,IAAe;QAC9D,MAAM,OAAO,GAAG,SAAS,CAAC,YAAY,CAAC;YACrC,IAAI,EAAE,OAAO;YACb,EAAE,EAAE,CAAC;YACL,KAAK,EAAE,SAAS,CAAC,iBAAiB;YAClC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;SACtC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAEzD,IAAI,OAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,OAAO,GAAG,SAAS,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,QAAQ,CAAC,QAAQ,EAAE,wBAAwB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,OAAO,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,SAAS,CAAC,QAAgB,EAAE,OAAe;QACzC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAEtD,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC7C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC;gBACzB,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,OAAO;gBACb,aAAa,EAAE,CAAC,KAAK,CAAC;gBACtB,uEAAuE;gBACvE,mEAAmE;gBACnE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxD,CAAC,CAAC;YAEH,IAAI,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAE7B,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,KAAc,EAAQ,EAAE;gBACrD,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,IAAI,KAAK;oBAAE,MAAM,CAAC,KAAK,CAAC,CAAC;qBACpB,IAAI,KAAK;oBAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACjC,CAAC,CAAC;YAEF,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,GAAG,EAAE;gBAChC,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ,EAAE,6BAA6B,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YACrF,CAAC,CAAC,CAAC;YAEH,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE;gBAChC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACxB,CAAC,CAAC,CAAC;YAEH,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAClC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;gBACxC,gEAAgE;gBAChE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO;gBAC9B,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;gBACxC,IAAI,MAAM,CAAC,MAAM,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;oBAClC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC;gBACtD,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC7B,MAAM,CACJ,IAAI,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CACtF,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;gBACxB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACxB,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ,EAAE,iDAAiD,CAAC,CAAC,CAAC;gBACpF,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAqB;IACrD,OAAO,IAAI,WAAW,CAAC,QAAQ,CAAC,CAAC;AACnC,CAAC"}

package/dist/core/dns/index.d.ts

@@ -0,0 +1,8 @@
+import type { DnsSettings } from '../types.js';
+import type { DnsResolver } from './resolver.js';
+export { CachingDnsResolver, type DnsResolver, type QueryType } from './resolver.js';
+export { DohResolver } from './doh.js';
+export { DotResolver } from './dot.js';
+export { PlainResolver } from './plain.js';
+export declare function createDnsResolver(settings: DnsSettings): DnsResolver;
+//# sourceMappingURL=index.d.ts.map

package/dist/core/dns/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/dns/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAI/C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjD,OAAO,EAAE,kBAAkB,EAAE,KAAK,WAAW,EAAE,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AACrF,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,WAAW,GAAG,WAAW,CASpE"}

package/dist/core/dns/index.js

@@ -0,0 +1,18 @@
+import { createDohResolver } from './doh.js';
+import { createDotResolver } from './dot.js';
+import { createPlainResolver } from './plain.js';
+export { CachingDnsResolver } from './resolver.js';
+export { DohResolver } from './doh.js';
+export { DotResolver } from './dot.js';
+export { PlainResolver } from './plain.js';
+export function createDnsResolver(settings) {
+    switch (settings.mode) {
+        case 'doh':
+            return createDohResolver(settings);
+        case 'dot':
+            return createDotResolver(settings);
+        case 'plain':
+            return createPlainResolver(settings);
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/core/dns/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/dns/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAGjD,OAAO,EAAE,kBAAkB,EAAoC,MAAM,eAAe,CAAC;AACrF,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,MAAM,UAAU,iBAAiB,CAAC,QAAqB;IACrD,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,KAAK;YACR,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACrC,KAAK,KAAK;YACR,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACrC,KAAK,OAAO;YACV,OAAO,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;AACH,CAAC"}

package/dist/core/dns/plain.d.ts

@@ -0,0 +1,17 @@
+import type { DnsRecord, DnsSettings } from '../types.js';
+import { CachingDnsResolver, type QueryType } from './resolver.js';
+/**
+ * Unencrypted DNS over the platform resolver.
+ *
+ * v2 pulled in `dns-socket` and kept one module-level socket alive forever,
+ * then read `answers[0].data` without checking it existed. Node's own
+ * `dns.Resolver` does the same job with TTLs, retries and no dependency.
+ */
+export declare class PlainResolver extends CachingDnsResolver {
+    #private;
+    constructor(settings: DnsSettings);
+    protected query(hostname: string, type: QueryType): Promise<DnsRecord[]>;
+    close(): void;
+}
+export declare function createPlainResolver(settings: DnsSettings): PlainResolver;
+//# sourceMappingURL=plain.d.ts.map

package/dist/core/dns/plain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plain.d.ts","sourceRoot":"","sources":["../../../src/core/dns/plain.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAY,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AAE7E;;;;;;GAMG;AACH,qBAAa,aAAc,SAAQ,kBAAkB;;gBAGvC,QAAQ,EAAE,WAAW;cAQR,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAiB9E,KAAK,IAAI,IAAI;CAIvB;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,WAAW,GAAG,aAAa,CAExE"}

package/dist/core/dns/plain.js

@@ -0,0 +1,45 @@
+import { Resolver } from 'node:dns/promises';
+import { DnsError, toError } from '../errors.js';
+import { CachingDnsResolver, familyOf } from './resolver.js';
+/**
+ * Unencrypted DNS over the platform resolver.
+ *
+ * v2 pulled in `dns-socket` and kept one module-level socket alive forever,
+ * then read `answers[0].data` without checking it existed. Node's own
+ * `dns.Resolver` does the same job with TTLs, retries and no dependency.
+ */
+export class PlainResolver extends CachingDnsResolver {
+    #resolver;
+    constructor(settings) {
+        super(settings);
+        this.#resolver = new Resolver({ timeout: settings.timeoutMs, tries: 2 });
+        if (settings.plainServers.length > 0) {
+            this.#resolver.setServers([...settings.plainServers]);
+        }
+    }
+    async query(hostname, type) {
+        const family = familyOf(type);
+        try {
+            const answers = type === 'A'
+                ? await this.#resolver.resolve4(hostname, { ttl: true })
+                : await this.#resolver.resolve6(hostname, { ttl: true });
+            return answers.map((answer) => ({ address: answer.address, family, ttl: answer.ttl }));
+        }
+        catch (cause) {
+            const code = cause.code;
+            // "No records of this type" is a normal answer, not a failure — let the
+            // caller fall back to the other address family.
+            if (code === 'ENODATA' || code === 'ENOTFOUND')
+                return [];
+            throw new DnsError(hostname, toError(cause).message, { cause });
+        }
+    }
+    close() {
+        this.#resolver.cancel();
+        super.close();
+    }
+}
+export function createPlainResolver(settings) {
+    return new PlainResolver(settings);
+}
+//# sourceMappingURL=plain.js.map

package/dist/core/dns/plain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plain.js","sourceRoot":"","sources":["../../../src/core/dns/plain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEjD,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAkB,MAAM,eAAe,CAAC;AAE7E;;;;;;GAMG;AACH,MAAM,OAAO,aAAc,SAAQ,kBAAkB;IAC1C,SAAS,CAAW;IAE7B,YAAY,QAAqB;QAC/B,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChB,IAAI,CAAC,SAAS,GAAG,IAAI,QAAQ,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QACzE,IAAI,QAAQ,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAEkB,KAAK,CAAC,KAAK,CAAC,QAAgB,EAAE,IAAe;QAC9D,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,OAAO,GACX,IAAI,KAAK,GAAG;gBACV,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;gBACxD,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7D,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACzF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;YACnD,wEAAwE;YACxE,gDAAgD;YAChD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,WAAW;gBAAE,OAAO,EAAE,CAAC;YAC1D,MAAM,IAAI,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAEQ,KAAK;QACZ,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QACxB,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;CACF;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAqB;IACvD,OAAO,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC;AACrC,CAAC"}

package/dist/core/dns/resolver.d.ts

@@ -0,0 +1,27 @@
+import type { DnsRecord, DnsSettings } from '../types.js';
+export type QueryType = 'A' | 'AAAA';
+export interface DnsResolver {
+    /** Resolve to a single IP. Always rejects on failure — never returns undefined. */
+    resolve(hostname: string): Promise<string>;
+    close(): void;
+}
+/**
+ * Shared caching + family-preference logic.
+ *
+ * Two v2 bugs are fixed here:
+ * 1. `lookup()` caught every error and returned `undefined`, which the socket
+ *    layer then passed to `net.connect` — silently dialling localhost.
+ * 2. The cache never expired, so a rotated IP stayed wrong for the whole
+ *    session. Entries now expire on the record's own TTL (clamped).
+ */
+export declare abstract class CachingDnsResolver implements DnsResolver {
+    #private;
+    protected readonly settings: DnsSettings;
+    constructor(settings: DnsSettings);
+    protected abstract query(hostname: string, type: QueryType): Promise<DnsRecord[]>;
+    resolve(hostname: string): Promise<string>;
+    close(): void;
+}
+/** Family that matches a query type, for building `DnsRecord`s. */
+export declare function familyOf(type: QueryType): 4 | 6;
+//# sourceMappingURL=resolver.d.ts.map

package/dist/core/dns/resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../../src/core/dns/resolver.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1D,MAAM,MAAM,SAAS,GAAG,GAAG,GAAG,MAAM,CAAC;AAErC,MAAM,WAAW,WAAW;IAC1B,mFAAmF;IACnF,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C,KAAK,IAAI,IAAI,CAAC;CACf;AAED;;;;;;;;GAQG;AACH,8BAAsB,kBAAmB,YAAW,WAAW;;IAC7D,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;gBAI7B,QAAQ,EAAE,WAAW;IAQjC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAE3E,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAehD,KAAK,IAAI,IAAI;CAyBd;AAoBD,mEAAmE;AACnE,wBAAgB,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,CAAC,GAAG,CAAC,CAE/C"}

package/dist/core/dns/resolver.js

@@ -0,0 +1,81 @@
+import { isIP } from 'node:net';
+import { LRUCache } from 'lru-cache';
+import { DnsError } from '../errors.js';
+/**
+ * Shared caching + family-preference logic.
+ *
+ * Two v2 bugs are fixed here:
+ * 1. `lookup()` caught every error and returned `undefined`, which the socket
+ *    layer then passed to `net.connect` — silently dialling localhost.
+ * 2. The cache never expired, so a rotated IP stayed wrong for the whole
+ *    session. Entries now expire on the record's own TTL (clamped).
+ */
+export class CachingDnsResolver {
+    settings;
+    #cache;
+    #inflight = new Map();
+    constructor(settings) {
+        this.settings = settings;
+        this.#cache = new LRUCache({
+            max: Math.max(1, settings.cacheSize),
+            ttl: settings.maxTtlSeconds * 1000,
+        });
+    }
+    async resolve(hostname) {
+        if (isIP(hostname) !== 0)
+            return hostname;
+        const cached = this.#cache.get(hostname);
+        if (cached !== undefined)
+            return cached;
+        // Collapse concurrent lookups for the same name into one query.
+        const existing = this.#inflight.get(hostname);
+        if (existing)
+            return existing;
+        const pending = this.#lookup(hostname).finally(() => this.#inflight.delete(hostname));
+        this.#inflight.set(hostname, pending);
+        return pending;
+    }
+    close() {
+        this.#cache.clear();
+        this.#inflight.clear();
+    }
+    async #lookup(hostname) {
+        const [primary, fallback] = queryOrder(this.settings.family);
+        let record = await this.#tryQuery(hostname, primary);
+        if (!record && fallback) {
+            record = await this.#tryQuery(hostname, fallback);
+        }
+        if (!record) {
+            throw new DnsError(hostname, `no ${primary}${fallback ? `/${fallback}` : ''} records`);
+        }
+        const ttlSeconds = clamp(record.ttl, this.settings.minTtlSeconds, this.settings.maxTtlSeconds);
+        this.#cache.set(hostname, record.address, { ttl: ttlSeconds * 1000 });
+        return record.address;
+    }
+    async #tryQuery(hostname, type) {
+        const records = await this.query(hostname, type);
+        return records.find((record) => isIP(record.address) !== 0);
+    }
+}
+function queryOrder(family) {
+    switch (family) {
+        case 'ipv4':
+            return ['A'];
+        case 'ipv6':
+            return ['AAAA'];
+        case 'ipv6-first':
+            return ['AAAA', 'A'];
+        default:
+            return ['A', 'AAAA'];
+    }
+}
+function clamp(value, min, max) {
+    if (!Number.isFinite(value) || value <= 0)
+        return min;
+    return Math.min(Math.max(value, min), max);
+}
+/** Family that matches a query type, for building `DnsRecord`s. */
+export function familyOf(type) {
+    return type === 'A' ? 4 : 6;
+}
+//# sourceMappingURL=resolver.js.map

package/dist/core/dns/resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../../../src/core/dns/resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAWxC;;;;;;;;GAQG;AACH,MAAM,OAAgB,kBAAkB;IACnB,QAAQ,CAAc;IAChC,MAAM,CAA2B;IACjC,SAAS,GAAG,IAAI,GAAG,EAA2B,CAAC;IAExD,YAAY,QAAqB;QAC/B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,IAAI,QAAQ,CAAiB;YACzC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,SAAS,CAAC;YACpC,GAAG,EAAE,QAAQ,CAAC,aAAa,GAAG,IAAI;SACnC,CAAC,CAAC;IACL,CAAC;IAID,KAAK,CAAC,OAAO,CAAC,QAAgB;QAC5B,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;QAE1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;QAExC,gEAAgE;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QACtF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACtC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpB,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAAgB;QAC5B,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAE7D,IAAI,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC;YACxB,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,QAAQ,CAAC,QAAQ,EAAE,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAC/F,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,UAAU,GAAG,IAAI,EAAE,CAAC,CAAC;QACtE,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,QAAgB,EAAE,IAAe;QAC/C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACjD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9D,CAAC;CACF;AAED,SAAS,UAAU,CAAC,MAA6B;IAC/C,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,MAAM;YACT,OAAO,CAAC,GAAG,CAAC,CAAC;QACf,KAAK,MAAM;YACT,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,KAAK,YAAY;YACf,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACvB;YACE,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACzB,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,KAAa,EAAE,GAAW,EAAE,GAAW;IACpD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC;IACtD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,QAAQ,CAAC,IAAe;IACtC,OAAO,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC"}

package/dist/core/errors.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Typed errors. v2 swallowed nearly every failure into a debug log, which is
+ * why a broken DNS lookup silently became a connection to 127.0.0.1. Everything
+ * here is meant to reach the caller.
+ */
+export declare class GreenTunnelError extends Error {
+    readonly name: string;
+}
+export declare class DnsError extends GreenTunnelError {
+    readonly name = "DnsError";
+    readonly hostname: string;
+    constructor(hostname: string, message: string, options?: {
+        cause?: unknown;
+    });
+}
+export declare class ConnectError extends GreenTunnelError {
+    readonly name = "ConnectError";
+    readonly host: string;
+    readonly port: number;
+    constructor(host: string, port: number, message: string, options?: {
+        cause?: unknown;
+    });
+}
+export declare class ProtocolError extends GreenTunnelError {
+    readonly name = "ProtocolError";
+}
+export declare class SystemProxyError extends GreenTunnelError {
+    readonly name = "SystemProxyError";
+}
+/** Narrow an unknown catch binding to something with a message. */
+export declare function toError(value: unknown): Error;
+//# sourceMappingURL=errors.d.ts.map

package/dist/core/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/core/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,SAAkB,IAAI,EAAE,MAAM,CAAsB;CACrD;AAED,qBAAa,QAAS,SAAQ,gBAAgB;IAC5C,SAAkB,IAAI,cAAc;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;gBAEd,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAI7E;AAED,qBAAa,YAAa,SAAQ,gBAAgB;IAChD,SAAkB,IAAI,kBAAkB;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAEV,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAKvF;AAED,qBAAa,aAAc,SAAQ,gBAAgB;IACjD,SAAkB,IAAI,mBAAmB;CAC1C;AAED,qBAAa,gBAAiB,SAAQ,gBAAgB;IACpD,SAAkB,IAAI,sBAAsB;CAC7C;AAED,mEAAmE;AACnE,wBAAgB,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,CAE7C"}