green-tunnel 2.0.2 → 3.0.3

package/dist/core/net/socket.d.ts

@@ -0,0 +1,30 @@
+import net from 'node:net';
+export interface ConnectOptions {
+    readonly host: string;
+    readonly port: number;
+    readonly timeoutMs: number;
+    readonly signal?: AbortSignal;
+}
+/**
+ * Open a TCP connection, rejecting on error, timeout or abort.
+ *
+ * v2's `createConnection` only ever resolved: a refused or black-holed upstream
+ * left the promise — and the client socket — hanging forever.
+ */
+export declare function connect(options: ConnectOptions): Promise<net.Socket>;
+/**
+ * Write pieces one at a time, honouring backpressure and an optional pause
+ * between them. Ignoring the return value of `write()` — as v2 did — lets a
+ * fast peer balloon the kernel-side buffer in memory.
+ */
+export declare function writeSequentially(socket: net.Socket, pieces: readonly Buffer[], delayMs?: number): Promise<void>;
+/** Promisified `socket.write` that waits for `drain` when the buffer is full. */
+export declare function write(socket: net.Socket, chunk: Buffer): Promise<void>;
+/** Destroy every socket, ignoring already-destroyed ones. */
+export declare function destroyAll(...sockets: readonly (net.Socket | undefined)[]): void;
+/**
+ * Arm an inactivity timeout that destroys the socket. `0` disables it.
+ * Returns a disposer.
+ */
+export declare function armIdleTimeout(socket: net.Socket, idleTimeoutMs: number): () => void;
+//# sourceMappingURL=socket.d.ts.map

package/dist/core/net/socket.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"socket.d.ts","sourceRoot":"","sources":["../../../src/core/net/socket.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,UAAU,CAAC;AAI3B,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED;;;;;GAKG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAyC1E;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,GAAG,CAAC,MAAM,EAClB,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,OAAO,SAAI,GACV,OAAO,CAAC,IAAI,CAAC,CAMf;AAED,iFAAiF;AACjF,wBAAgB,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQtE;AAED,6DAA6D;AAC7D,wBAAgB,UAAU,CAAC,GAAG,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GAAG,IAAI,CAIhF;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,IAAI,CAUpF"}

package/dist/core/net/socket.js

@@ -0,0 +1,98 @@
+import net from 'node:net';
+import { setTimeout as delay } from 'node:timers/promises';
+import { ConnectError, toError } from '../errors.js';
+/**
+ * Open a TCP connection, rejecting on error, timeout or abort.
+ *
+ * v2's `createConnection` only ever resolved: a refused or black-holed upstream
+ * left the promise — and the client socket — hanging forever.
+ */
+export async function connect(options) {
+    const { host, port, timeoutMs, signal } = options;
+    signal?.throwIfAborted();
+    return new Promise((resolve, reject) => {
+        const socket = net.connect({ host, port, noDelay: true });
+        const cleanup = () => {
+            socket.setTimeout(0);
+            socket.off('connect', onConnect);
+            socket.off('error', onError);
+            socket.off('timeout', onTimeout);
+            signal?.removeEventListener('abort', onAbort);
+        };
+        const fail = (message, cause) => {
+            cleanup();
+            socket.destroy();
+            reject(new ConnectError(host, port, message, cause ? { cause } : undefined));
+        };
+        function onConnect() {
+            cleanup();
+            resolve(socket);
+        }
+        function onError(error) {
+            fail(error.message, error);
+        }
+        function onTimeout() {
+            fail(`timed out after ${String(timeoutMs)}ms`);
+        }
+        function onAbort() {
+            fail('aborted');
+        }
+        if (timeoutMs > 0)
+            socket.setTimeout(timeoutMs);
+        socket.once('connect', onConnect);
+        socket.once('error', onError);
+        socket.once('timeout', onTimeout);
+        signal?.addEventListener('abort', onAbort, { once: true });
+    });
+}
+/**
+ * Write pieces one at a time, honouring backpressure and an optional pause
+ * between them. Ignoring the return value of `write()` — as v2 did — lets a
+ * fast peer balloon the kernel-side buffer in memory.
+ */
+export async function writeSequentially(socket, pieces, delayMs = 0) {
+    for (const [index, piece] of pieces.entries()) {
+        if (socket.destroyed)
+            return;
+        if (delayMs > 0 && index > 0)
+            await delay(delayMs);
+        await write(socket, piece);
+    }
+}
+/** Promisified `socket.write` that waits for `drain` when the buffer is full. */
+export function write(socket, chunk) {
+    return new Promise((resolve, reject) => {
+        const flushed = socket.write(chunk, (error) => {
+            if (error)
+                reject(toError(error));
+            else if (flushed)
+                resolve();
+        });
+        if (!flushed)
+            socket.once('drain', resolve);
+    });
+}
+/** Destroy every socket, ignoring already-destroyed ones. */
+export function destroyAll(...sockets) {
+    for (const socket of sockets) {
+        if (socket && !socket.destroyed)
+            socket.destroy();
+    }
+}
+/**
+ * Arm an inactivity timeout that destroys the socket. `0` disables it.
+ * Returns a disposer.
+ */
+export function armIdleTimeout(socket, idleTimeoutMs) {
+    if (idleTimeoutMs <= 0)
+        return () => undefined;
+    const onTimeout = () => {
+        socket.destroy();
+    };
+    socket.setTimeout(idleTimeoutMs, onTimeout);
+    return () => {
+        socket.setTimeout(0);
+        socket.off('timeout', onTimeout);
+    };
+}
+//# sourceMappingURL=socket.js.map

package/dist/core/net/socket.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"socket.js","sourceRoot":"","sources":["../../../src/core/net/socket.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,UAAU,CAAC;AAC3B,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AASrD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,OAAuB;IACnD,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAClD,MAAM,EAAE,cAAc,EAAE,CAAC;IAEzB,OAAO,IAAI,OAAO,CAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACjD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1D,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACrB,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YACjC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7B,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YACjC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChD,CAAC,CAAC;QAEF,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,KAAe,EAAQ,EAAE;YACtD,OAAO,EAAE,CAAC;YACV,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAC/E,CAAC,CAAC;QAEF,SAAS,SAAS;YAChB,OAAO,EAAE,CAAC;YACV,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC;QACD,SAAS,OAAO,CAAC,KAAY;YAC3B,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC7B,CAAC;QACD,SAAS,SAAS;YAChB,IAAI,CAAC,mBAAmB,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC;QACD,SAAS,OAAO;YACd,IAAI,CAAC,SAAS,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,SAAS,GAAG,CAAC;YAAE,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAClC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAkB,EAClB,MAAyB,EACzB,OAAO,GAAG,CAAC;IAEX,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9C,IAAI,MAAM,CAAC,SAAS;YAAE,OAAO;QAC7B,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC;YAAE,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;QACnD,MAAM,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,KAAK,CAAC,MAAkB,EAAE,KAAa;IACrD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YAC5C,IAAI,KAAK;gBAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;iBAC7B,IAAI,OAAO;gBAAE,OAAO,EAAE,CAAC;QAC9B,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,OAAO;YAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,UAAU,CAAC,GAAG,OAA4C;IACxE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IACpD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAkB,EAAE,aAAqB;IACtE,IAAI,aAAa,IAAI,CAAC;QAAE,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC;IAC/C,MAAM,SAAS,GAAG,GAAS,EAAE;QAC3B,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC,CAAC;IACF,MAAM,CAAC,UAAU,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IAC5C,OAAO,GAAG,EAAE;QACV,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACrB,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACnC,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/proxy/connect-tunnel.d.ts

@@ -0,0 +1,14 @@
+import type net from 'node:net';
+import type { TunnelContext } from './context.js';
+/**
+ * The CONNECT path — this is where GreenTunnel actually does its job.
+ *
+ * Once the tunnel is up, the client's first payload is the TLS ClientHello
+ * carrying the SNI. We split it so no single TCP segment (or TLS record)
+ * contains a whole hostname, then get out of the way.
+ */
+export declare function openConnectTunnel(client: net.Socket, leftover: Buffer, target: {
+    host: string;
+    port: number;
+}, ctx: TunnelContext): Promise<void>;
+//# sourceMappingURL=connect-tunnel.d.ts.map

package/dist/core/proxy/connect-tunnel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-tunnel.d.ts","sourceRoot":"","sources":["../../../src/core/proxy/connect-tunnel.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAKhC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAIlD;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,GAAG,CAAC,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACtC,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,IAAI,CAAC,CAoCf"}

package/dist/core/proxy/connect-tunnel.js

@@ -0,0 +1,44 @@
+import { connect, write, writeSequentially } from '../net/socket.js';
+import { fragmentClientHello, isClientHello } from '../tls/fragment.js';
+import { readChunk } from './connection.js';
+import { tunnel } from './pipe.js';
+const CONNECTION_ESTABLISHED = Buffer.from('HTTP/1.1 200 Connection Established\r\n\r\n', 'latin1');
+/**
+ * The CONNECT path — this is where GreenTunnel actually does its job.
+ *
+ * Once the tunnel is up, the client's first payload is the TLS ClientHello
+ * carrying the SNI. We split it so no single TCP segment (or TLS record)
+ * contains a whole hostname, then get out of the way.
+ */
+export async function openConnectTunnel(client, leftover, target, ctx) {
+    const { settings, dns, logger } = ctx;
+    const address = await dns.resolve(target.host);
+    const server = await connect({
+        host: address,
+        port: target.port,
+        timeoutMs: settings.connectTimeoutMs,
+        signal: ctx.signal,
+    });
+    ctx.onOpen({
+        id: ctx.nextTunnelId(),
+        kind: 'https',
+        host: target.host,
+        port: target.port,
+        startedAt: Date.now(),
+    });
+    await write(client, CONNECTION_ESTABLISHED);
+    // Either the client pipelined the ClientHello behind the CONNECT head, or we
+    // wait one round-trip for it.
+    const hello = leftover.length > 0 ? leftover : await readChunk(client, settings.connectTimeoutMs);
+    const pieces = fragmentClientHello(hello, settings.fragment);
+    if (pieces.length > 1) {
+        const unit = settings.fragment.tlsRecords ? 'records' : 'segments';
+        logger.debug(`${target.host}: split ClientHello into ${String(pieces.length)} ${unit}`);
+    }
+    else if (settings.fragment.enabled && !isClientHello(hello)) {
+        logger.debug(`${target.host}: not a ClientHello, forwarding untouched`);
+    }
+    await writeSequentially(server, pieces, settings.fragment.delayMs);
+    await tunnel(client, server, settings.idleTimeoutMs);
+}
+//# sourceMappingURL=connect-tunnel.js.map

package/dist/core/proxy/connect-tunnel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-tunnel.js","sourceRoot":"","sources":["../../../src/core/proxy/connect-tunnel.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAGnC,MAAM,sBAAsB,GAAG,MAAM,CAAC,IAAI,CAAC,6CAA6C,EAAE,QAAQ,CAAC,CAAC;AAEpG;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAkB,EAClB,QAAgB,EAChB,MAAsC,EACtC,GAAkB;IAElB,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;IAEtC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;QAC3B,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,SAAS,EAAE,QAAQ,CAAC,gBAAgB;QACpC,MAAM,EAAE,GAAG,CAAC,MAAM;KACnB,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC;QACT,EAAE,EAAE,GAAG,CAAC,YAAY,EAAE;QACtB,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC,CAAC;IAEH,MAAM,KAAK,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAE5C,6EAA6E;IAC7E,8BAA8B;IAC9B,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAClG,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAE7D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;QACnE,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,IAAI,4BAA4B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC1F,CAAC;SAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,IAAI,2CAA2C,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAEnE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;AACvD,CAAC"}

package/dist/core/proxy/connection.d.ts

@@ -0,0 +1,12 @@
+import type net from 'node:net';
+import type { TunnelContext } from './context.js';
+/**
+ * Read the first request head off a freshly accepted socket and route it.
+ *
+ * The server is created with `pauseOnConnect`, so nothing is read until we ask.
+ * Whatever we over-read is handed to the tunnel rather than dropped.
+ */
+export declare function handleConnection(client: net.Socket, ctx: TunnelContext): Promise<void>;
+/** Read exactly one more chunk, or throw if the client goes away first. */
+export declare function readChunk(socket: net.Socket, timeoutMs: number): Promise<Buffer>;
+//# sourceMappingURL=connection.d.ts.map

package/dist/core/proxy/connection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../../../src/core/proxy/connection.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAKhC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAKlD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAgB5F;AAgCD,2EAA2E;AAC3E,wBAAsB,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAUtF"}

package/dist/core/proxy/connection.js

@@ -0,0 +1,88 @@
+import { on } from 'node:events';
+import { ProtocolError } from '../errors.js';
+import { parseRequestHead, resolveUpstream, splitAuthority } from '../http/head.js';
+import { openConnectTunnel } from './connect-tunnel.js';
+import { openPlainTunnel } from './plain-tunnel.js';
+const HEAD_TERMINATOR = '\r\n\r\n';
+const MAX_HEAD_BYTES = 64 * 1024;
+/**
+ * Read the first request head off a freshly accepted socket and route it.
+ *
+ * The server is created with `pauseOnConnect`, so nothing is read until we ask.
+ * Whatever we over-read is handed to the tunnel rather than dropped.
+ */
+export async function handleConnection(client, ctx) {
+    const { raw, rest } = await readRequestHead(client, ctx.settings.connectTimeoutMs);
+    const head = parseRequestHead(raw);
+    if (head.method.toUpperCase() === 'CONNECT') {
+        await openConnectTunnel(client, rest, splitAuthority(head.target, 443), ctx);
+        return;
+    }
+    if (ctx.settings.httpsOnly) {
+        respond(client, 403, 'Forbidden', 'GreenTunnel is running in HTTPS-only mode.\n');
+        throw new ProtocolError(`Blocked plain HTTP request to ${head.target}`);
+    }
+    const initial = Buffer.concat([Buffer.from(raw + HEAD_TERMINATOR, 'latin1'), rest]);
+    await openPlainTunnel(client, initial, resolveUpstream(head, 80), ctx);
+}
+/** Accumulate bytes until the blank line that ends an HTTP head. */
+async function readRequestHead(socket, timeoutMs) {
+    let buffer = Buffer.alloc(0);
+    socket.resume();
+    try {
+        for await (const chunk of readChunks(socket, timeoutMs)) {
+            buffer = buffer.length === 0 ? chunk : Buffer.concat([buffer, chunk]);
+            const end = buffer.indexOf(HEAD_TERMINATOR);
+            if (end >= 0) {
+                return {
+                    raw: buffer.subarray(0, end).toString('latin1'),
+                    rest: buffer.subarray(end + HEAD_TERMINATOR.length),
+                };
+            }
+            if (buffer.length > MAX_HEAD_BYTES) {
+                throw new ProtocolError(`Request head exceeds ${String(MAX_HEAD_BYTES)} bytes`);
+            }
+        }
+    }
+    finally {
+        socket.pause();
+    }
+    throw new ProtocolError('Client closed before sending a complete request head');
+}
+/** Read exactly one more chunk, or throw if the client goes away first. */
+export async function readChunk(socket, timeoutMs) {
+    socket.resume();
+    try {
+        for await (const chunk of readChunks(socket, timeoutMs)) {
+            return chunk;
+        }
+    }
+    finally {
+        socket.pause();
+    }
+    throw new ProtocolError('Client closed before sending any payload');
+}
+/**
+ * `events.on` as a typed async iterator that also stops on `end`/`close` and
+ * rejects on `error` — so a stalled client can never leak the connection the
+ * way v2's bare `once('data')` promise did.
+ */
+function readChunks(socket, timeoutMs) {
+    const iterator = on(socket, 'data', {
+        signal: AbortSignal.timeout(timeoutMs),
+        close: ['end', 'close'],
+    });
+    return (async function* unwrap() {
+        for await (const [chunk] of iterator)
+            yield chunk;
+    })();
+}
+function respond(socket, status, reason, body) {
+    const payload = Buffer.from(body, 'utf8');
+    socket.write(`HTTP/1.1 ${String(status)} ${reason}\r\n` +
+        'Content-Type: text/plain; charset=utf-8\r\n' +
+        `Content-Length: ${String(payload.length)}\r\n` +
+        'Connection: close\r\n\r\n');
+    socket.end(payload);
+}
+//# sourceMappingURL=connection.js.map

package/dist/core/proxy/connection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.js","sourceRoot":"","sources":["../../../src/core/proxy/connection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACpF,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAGpD,MAAM,eAAe,GAAG,UAAU,CAAC;AACnC,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,CAAC;AAEjC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAkB,EAAE,GAAkB;IAC3E,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IACnF,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAEnC,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,SAAS,EAAE,CAAC;QAC5C,MAAM,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QAC7E,OAAO;IACT,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC3B,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,8CAA8C,CAAC,CAAC;QAClF,MAAM,IAAI,aAAa,CAAC,iCAAiC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,eAAe,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACpF,MAAM,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,eAAe,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;AACzE,CAAC;AAED,oEAAoE;AACpE,KAAK,UAAU,eAAe,CAC5B,MAAkB,EAClB,SAAiB;IAEjB,IAAI,MAAM,GAAW,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,MAAM,EAAE,CAAC;IAEhB,IAAI,CAAC;QACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;YACxD,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;YAEtE,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YAC5C,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBACb,OAAO;oBACL,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBAC/C,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC;iBACpD,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;gBACnC,MAAM,IAAI,aAAa,CAAC,wBAAwB,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAClF,CAAC;QACH,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC;IAED,MAAM,IAAI,aAAa,CAAC,sDAAsD,CAAC,CAAC;AAClF,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAAkB,EAAE,SAAiB;IACnE,MAAM,CAAC,MAAM,EAAE,CAAC;IAChB,IAAI,CAAC;QACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;YACxD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC;IACD,MAAM,IAAI,aAAa,CAAC,0CAA0C,CAAC,CAAC;AACtE,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,MAAkB,EAAE,SAAiB;IACvD,MAAM,QAAQ,GAAG,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE;QAClC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;QACtC,KAAK,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;KACxB,CAAoC,CAAC;IAEtC,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,MAAM;QAC5B,IAAI,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,QAAQ;YAAE,MAAM,KAAK,CAAC;IACpD,CAAC,CAAC,EAAE,CAAC;AACP,CAAC;AAED,SAAS,OAAO,CAAC,MAAkB,EAAE,MAAc,EAAE,MAAc,EAAE,IAAY;IAC/E,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1C,MAAM,CAAC,KAAK,CACV,YAAY,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,MAAM;QACxC,6CAA6C;QAC7C,mBAAmB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM;QAC/C,2BAA2B,CAC9B,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACtB,CAAC"}

package/dist/core/proxy/context.d.ts

@@ -0,0 +1,15 @@
+import type { DnsResolver } from '../dns/index.js';
+import type { Logger } from '../logger.js';
+import type { ProxySettings, TunnelInfo } from '../types.js';
+/** Everything a single connection needs, injected rather than reached for. */
+export interface TunnelContext {
+    readonly settings: ProxySettings;
+    readonly dns: DnsResolver;
+    readonly logger: Logger;
+    /** Aborted when the proxy shuts down. */
+    readonly signal: AbortSignal;
+    readonly nextTunnelId: () => number;
+    /** Called once the upstream target is known and the tunnel is live. */
+    readonly onOpen: (info: TunnelInfo) => void;
+}
+//# sourceMappingURL=context.d.ts.map

package/dist/core/proxy/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../../src/core/proxy/context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE7D,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,yCAAyC;IACzC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,MAAM,CAAC;IACpC,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,IAAI,CAAC;CAC7C"}

package/dist/core/proxy/context.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=context.js.map

package/dist/core/proxy/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../../src/core/proxy/context.ts"],"names":[],"mappings":""}

package/dist/core/proxy/index.d.ts

@@ -0,0 +1,33 @@
+import { EventEmitter } from 'node:events';
+import { type DnsResolver } from '../dns/index.js';
+import { Logger } from '../logger.js';
+import type { ProxyAddress, ProxyEventMap, ProxyOptions, ProxySettings, ProxyStats } from '../types.js';
+export interface ProxyDependencies {
+    readonly logger?: Logger;
+    /** Override the resolver, mainly for tests. */
+    readonly dns?: DnsResolver;
+}
+/**
+ * The DPI-evading proxy server.
+ *
+ * Unlike v2 this class does **not** touch the OS proxy configuration — that is
+ * `SystemProxy`'s job. Keeping them apart means the engine is testable without
+ * root, and a crash can't leave the machine pointed at a dead port.
+ *
+ * Emits `error` in the Node convention: attach a listener or an emitted error
+ * will throw.
+ */
+export declare class Proxy extends EventEmitter<ProxyEventMap> {
+    #private;
+    readonly settings: ProxySettings;
+    constructor(options?: ProxyOptions, dependencies?: ProxyDependencies);
+    get running(): boolean;
+    /** The bound address, or `null` while stopped. */
+    get address(): ProxyAddress | null;
+    get stats(): ProxyStats;
+    /** Idempotent: starting an already-running proxy returns its address. */
+    start(): Promise<ProxyAddress>;
+    /** Idempotent. Tears down every live tunnel, then the listener. */
+    stop(): Promise<void>;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/core/proxy/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/proxy/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEtE,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC,OAAO,KAAK,EACV,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,aAAa,EACb,UAAU,EAEX,MAAM,aAAa,CAAC;AAIrB,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,+CAA+C;IAC/C,QAAQ,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC;CAC5B;AAED;;;;;;;;;GASG;AACH,qBAAa,KAAM,SAAQ,YAAY,CAAC,aAAa,CAAC;;IACpD,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;gBAerB,OAAO,GAAE,YAAiB,EAAE,YAAY,GAAE,iBAAsB;IAQ5E,IAAI,OAAO,IAAI,OAAO,CAErB;IAED,kDAAkD;IAClD,IAAI,OAAO,IAAI,YAAY,GAAG,IAAI,CAIjC;IAED,IAAI,KAAK,IAAI,UAAU,CAStB;IAED,yEAAyE;IACnE,KAAK,IAAI,OAAO,CAAC,YAAY,CAAC;IA4CpC,mEAAmE;IAC7D,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAkE5B"}

package/dist/core/proxy/index.js

@@ -0,0 +1,162 @@
+import { EventEmitter } from 'node:events';
+import net from 'node:net';
+import { assertValidSettings, resolveSettings } from '../config.js';
+import { createDnsResolver } from '../dns/index.js';
+import { GreenTunnelError, toError } from '../errors.js';
+import { Logger } from '../logger.js';
+import { destroyAll } from '../net/socket.js';
+import { handleConnection } from './connection.js';
+/**
+ * The DPI-evading proxy server.
+ *
+ * Unlike v2 this class does **not** touch the OS proxy configuration — that is
+ * `SystemProxy`'s job. Keeping them apart means the engine is testable without
+ * root, and a crash can't leave the machine pointed at a dead port.
+ *
+ * Emits `error` in the Node convention: attach a listener or an emitted error
+ * will throw.
+ */
+export class Proxy extends EventEmitter {
+    settings;
+    #logger;
+    #dns;
+    #sockets = new Set();
+    #server = null;
+    #abort = null;
+    #startedAt = null;
+    #nextTunnelId = 1;
+    #totalTunnels = 0;
+    #failedTunnels = 0;
+    #bytesSent = 0;
+    #bytesReceived = 0;
+    constructor(options = {}, dependencies = {}) {
+        super();
+        this.settings = resolveSettings(options);
+        assertValidSettings(this.settings);
+        this.#logger = dependencies.logger ?? new Logger('green-tunnel');
+        this.#dns = dependencies.dns ?? createDnsResolver(this.settings.dns);
+    }
+    get running() {
+        return this.#server !== null;
+    }
+    /** The bound address, or `null` while stopped. */
+    get address() {
+        const address = this.#server?.address();
+        if (address === null || address === undefined || typeof address === 'string')
+            return null;
+        return { host: address.address, port: address.port };
+    }
+    get stats() {
+        return {
+            activeTunnels: this.#sockets.size,
+            totalTunnels: this.#totalTunnels,
+            failedTunnels: this.#failedTunnels,
+            bytesSent: this.#bytesSent,
+            bytesReceived: this.#bytesReceived,
+            startedAt: this.#startedAt,
+        };
+    }
+    /** Idempotent: starting an already-running proxy returns its address. */
+    async start() {
+        const current = this.address;
+        if (current)
+            return current;
+        const abort = new AbortController();
+        const server = net.createServer({ pauseOnConnect: true, noDelay: true });
+        server.on('connection', (socket) => {
+            void this.#onConnection(socket, abort.signal);
+        });
+        server.on('error', (error) => {
+            this.emit('error', toError(error));
+        });
+        await new Promise((resolve, reject) => {
+            const onError = (error) => {
+                reject(toError(error));
+            };
+            server.once('error', onError);
+            server.listen({ host: this.settings.host, port: this.settings.port }, () => {
+                server.off('error', onError);
+                resolve();
+            });
+        });
+        // Read the address off the server directly rather than via `this.address`:
+        // the early-return above narrowed that getter to `null` for the rest of the
+        // function, and TypeScript has no way to know `#server` changed underneath.
+        const bound = server.address();
+        if (bound === null || typeof bound === 'string') {
+            server.close();
+            throw new GreenTunnelError('Proxy started but reported no address');
+        }
+        const address = { host: bound.address, port: bound.port };
+        this.#server = server;
+        this.#abort = abort;
+        this.#startedAt = Date.now();
+        this.#logger.info(`listening on ${address.host}:${String(address.port)}`);
+        this.emit('listening', address);
+        return address;
+    }
+    /** Idempotent. Tears down every live tunnel, then the listener. */
+    async stop() {
+        const server = this.#server;
+        if (!server)
+            return;
+        this.#server = null;
+        this.#abort?.abort();
+        this.#abort = null;
+        this.#startedAt = null;
+        destroyAll(...this.#sockets);
+        this.#sockets.clear();
+        await new Promise((resolve) => {
+            server.close(() => {
+                resolve();
+            });
+        });
+        this.#dns.close();
+        this.#logger.info('stopped');
+        this.emit('close');
+    }
+    async #onConnection(client, signal) {
+        this.#sockets.add(client);
+        // A socket that errors with no listener would take the process down.
+        client.on('error', () => undefined);
+        client.once('close', () => this.#sockets.delete(client));
+        let info;
+        const context = {
+            settings: this.settings,
+            dns: this.#dns,
+            logger: this.#logger,
+            signal,
+            nextTunnelId: () => this.#nextTunnelId++,
+            onOpen: (tunnel) => {
+                info = tunnel;
+                this.#totalTunnels++;
+                this.emit('tunnel:open', tunnel);
+                client.once('close', () => {
+                    // `bytesRead` is what the client sent us; `bytesWritten` is what we
+                    // sent back. No counting streams needed.
+                    this.#bytesSent += client.bytesRead;
+                    this.#bytesReceived += client.bytesWritten;
+                    this.emit('tunnel:close', {
+                        ...tunnel,
+                        bytesSent: client.bytesRead,
+                        bytesReceived: client.bytesWritten,
+                    });
+                });
+            },
+        };
+        try {
+            await handleConnection(client, context);
+        }
+        catch (cause) {
+            const error = toError(cause);
+            this.#failedTunnels++;
+            this.#logger.debug(`connection failed: ${error.message}`);
+            if (info)
+                this.emit('tunnel:error', info, error);
+        }
+        finally {
+            destroyAll(client);
+        }
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/core/proxy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/proxy/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,GAAG,MAAM,UAAU,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAoB,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAS9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AASnD;;;;;;;;;GASG;AACH,MAAM,OAAO,KAAM,SAAQ,YAA2B;IAC3C,QAAQ,CAAgB;IAExB,OAAO,CAAS;IAChB,IAAI,CAAc;IAClB,QAAQ,GAAG,IAAI,GAAG,EAAc,CAAC;IAE1C,OAAO,GAAsB,IAAI,CAAC;IAClC,MAAM,GAA2B,IAAI,CAAC;IACtC,UAAU,GAAkB,IAAI,CAAC;IACjC,aAAa,GAAG,CAAC,CAAC;IAClB,aAAa,GAAG,CAAC,CAAC;IAClB,cAAc,GAAG,CAAC,CAAC;IACnB,UAAU,GAAG,CAAC,CAAC;IACf,cAAc,GAAG,CAAC,CAAC;IAEnB,YAAY,UAAwB,EAAE,EAAE,eAAkC,EAAE;QAC1E,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QACzC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,YAAY,CAAC,MAAM,IAAI,IAAI,MAAM,CAAC,cAAc,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC;IAC/B,CAAC;IAED,kDAAkD;IAClD,IAAI,OAAO;QACT,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;QACxC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC1F,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IACvD,CAAC;IAED,IAAI,KAAK;QACP,OAAO;YACL,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;YACjC,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,aAAa,EAAE,IAAI,CAAC,cAAc;YAClC,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,aAAa,EAAE,IAAI,CAAC,cAAc;YAClC,SAAS,EAAE,IAAI,CAAC,UAAU;SAC3B,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,KAAK;QACT,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7B,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAE5B,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAEzE,MAAM,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE;YACjC,KAAK,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC3B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,OAAO,GAAG,CAAC,KAAY,EAAQ,EAAE;gBACrC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;YACzB,CAAC,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9B,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE;gBACzE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC7B,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,2EAA2E;QAC3E,4EAA4E;QAC5E,4EAA4E;QAC5E,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,gBAAgB,CAAC,uCAAuC,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,OAAO,GAAiB,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;QAExE,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAChC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,mEAAmE;IACnE,KAAK,CAAC,IAAI;QACR,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,MAAM;YAAE,OAAO;QAEpB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QAEvB,UAAU,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QAEtB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;gBAChB,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAClB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,MAAkB,EAAE,MAAmB;QACzD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1B,qEAAqE;QACrE,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAEzD,IAAI,IAA4B,CAAC;QAEjC,MAAM,OAAO,GAAkB;YAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,EAAE,IAAI,CAAC,IAAI;YACd,MAAM,EAAE,IAAI,CAAC,OAAO;YACpB,MAAM;YACN,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE;YACxC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE;gBACjB,IAAI,GAAG,MAAM,CAAC;gBACd,IAAI,CAAC,aAAa,EAAE,CAAC;gBACrB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;gBACjC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;oBACxB,oEAAoE;oBACpE,yCAAyC;oBACzC,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,SAAS,CAAC;oBACpC,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,YAAY,CAAC;oBAC3C,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE;wBACxB,GAAG,MAAM;wBACT,SAAS,EAAE,MAAM,CAAC,SAAS;wBAC3B,aAAa,EAAE,MAAM,CAAC,YAAY;qBACnC,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;YACL,CAAC;SACF,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;YAC7B,IAAI,CAAC,cAAc,EAAE,CAAC;YACtB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,sBAAsB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC1D,IAAI,IAAI;gBAAE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACnD,CAAC;gBAAS,CAAC;YACT,UAAU,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;CACF"}

package/dist/core/proxy/pipe.d.ts

@@ -0,0 +1,12 @@
+import type net from 'node:net';
+/**
+ * Join two sockets into a bidirectional tunnel and resolve when both halves are
+ * done.
+ *
+ * `pipeline` (rather than v2's raw `.on('data')` + `.write()`) gives us
+ * backpressure, half-close propagation and guaranteed teardown on error.
+ * `allSettled` matters: when one direction fails the other almost always fails
+ * too, and an unobserved rejection there would crash the process.
+ */
+export declare function tunnel(client: net.Socket, server: net.Socket, idleTimeoutMs: number, transform?: NodeJS.ReadWriteStream): Promise<void>;
+//# sourceMappingURL=pipe.d.ts.map

package/dist/core/proxy/pipe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipe.d.ts","sourceRoot":"","sources":["../../../src/core/proxy/pipe.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAmBhC;;;;;;;;GAQG;AACH,wBAAsB,MAAM,CAC1B,MAAM,EAAE,GAAG,CAAC,MAAM,EAClB,MAAM,EAAE,GAAG,CAAC,MAAM,EAClB,aAAa,EAAE,MAAM,EACrB,SAAS,CAAC,EAAE,MAAM,CAAC,eAAe,GACjC,OAAO,CAAC,IAAI,CAAC,CAkBf"}

package/dist/core/proxy/pipe.js

@@ -0,0 +1,42 @@
+import { pipeline } from 'node:stream/promises';
+import { armIdleTimeout, destroyAll } from '../net/socket.js';
+import { toError } from '../errors.js';
+/** Errors that just mean "the other side hung up" — not worth reporting. */
+const BENIGN_CODES = new Set([
+    'ECONNRESET',
+    'EPIPE',
+    'ERR_STREAM_PREMATURE_CLOSE',
+    'ERR_STREAM_DESTROYED',
+    'ABORT_ERR',
+]);
+function isBenign(error) {
+    const code = error?.code;
+    return code !== undefined && BENIGN_CODES.has(code);
+}
+/**
+ * Join two sockets into a bidirectional tunnel and resolve when both halves are
+ * done.
+ *
+ * `pipeline` (rather than v2's raw `.on('data')` + `.write()`) gives us
+ * backpressure, half-close propagation and guaranteed teardown on error.
+ * `allSettled` matters: when one direction fails the other almost always fails
+ * too, and an unobserved rejection there would crash the process.
+ */
+export async function tunnel(client, server, idleTimeoutMs, transform) {
+    const disarm = [armIdleTimeout(client, idleTimeoutMs), armIdleTimeout(server, idleTimeoutMs)];
+    const upstream = transform ? pipeline(client, transform, server) : pipeline(client, server);
+    const downstream = pipeline(server, client);
+    try {
+        const results = await Promise.allSettled([upstream, downstream]);
+        const failure = results.find((result) => result.status === 'rejected' && !isBenign(result.reason));
+        if (failure?.status === 'rejected') {
+            throw toError(failure.reason);
+        }
+    }
+    finally {
+        for (const off of disarm)
+            off();
+        destroyAll(client, server);
+    }
+}
+//# sourceMappingURL=pipe.js.map

package/dist/core/proxy/pipe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipe.js","sourceRoot":"","sources":["../../../src/core/proxy/pipe.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,4EAA4E;AAC5E,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,YAAY;IACZ,OAAO;IACP,4BAA4B;IAC5B,sBAAsB;IACtB,WAAW;CACZ,CAAC,CAAC;AAEH,SAAS,QAAQ,CAAC,KAAc;IAC9B,MAAM,IAAI,GAAI,KAA2C,EAAE,IAAI,CAAC;IAChE,OAAO,IAAI,KAAK,SAAS,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,MAAkB,EAClB,MAAkB,EAClB,aAAqB,EACrB,SAAkC;IAElC,MAAM,MAAM,GAAG,CAAC,cAAc,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,cAAc,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;IAE9F,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5F,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE5C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAC1B,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CACrE,CAAC;QACF,IAAI,OAAO,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;YACnC,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;YAAS,CAAC;QACT,KAAK,MAAM,GAAG,IAAI,MAAM;YAAE,GAAG,EAAE,CAAC;QAChC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC"}

package/dist/core/proxy/plain-tunnel.d.ts

@@ -0,0 +1,12 @@
+import type net from 'node:net';
+import type { TunnelContext } from './context.js';
+/**
+ * Plain-HTTP proxying. No fragmentation happens here — there is no SNI to hide,
+ * and the Host header is in cleartext regardless. Its only job is to relay the
+ * stream while rewriting absolute-form request targets into origin-form.
+ */
+export declare function openPlainTunnel(client: net.Socket, initial: Buffer, target: {
+    host: string;
+    port: number;
+}, ctx: TunnelContext): Promise<void>;
+//# sourceMappingURL=plain-tunnel.d.ts.map