tunnelmate 0.1.0 → 0.2.0

package/README.md

@@ -28,11 +28,14 @@ Once published to npm (package name `tunnelmate`, command stays `tunnelme`):
 npm install -g tunnelmate
 ```
 
-For local development against this source tree instead:
+For local development against this source tree instead (the source is
+TypeScript, compiled to `dist/` — the `tunnelme` bin points at the compiled
+output, so build once before linking, and after any source change):
 
 ```powershell
 cd C:\codes\tunnel
 npm install
+npm run build
 npm link
 ```
 
@@ -66,6 +69,53 @@ internet (used for the HTTP-01 challenge) — both of which you already have.
 If you want to test the flow without hitting Let's Encrypt's rate limits,
 add `--staging` first, then drop it once it's working end-to-end.
 
+## Skipping the manual setup
+
+Everything above (port-forwarding, DNS, firewall, Administrator privileges)
+is inherent to being reachable from the internet without relying on someone
+else's infrastructure (unlike, say, Cloudflare Tunnel, which avoids all of
+that specifically by routing your traffic through Cloudflare's network
+instead of yours). A few flags automate what can be automated:
+
+**`--quick`** — don't own a domain, or just want to test something right
+now? Skip `--url` entirely:
+
+```powershell
+tunnelme serve --tls acme --email you@example.com --port 3000 --quick
+```
+
+This detects your public IP and builds a working URL via
+[sslip.io](https://sslip.io)'s wildcard DNS (e.g.
+`https://p3000.24-78-95-66.sslip.io`) — no domain registration, no DNS
+records to configure, and no traffic relay (sslip.io only ever answers a DNS
+query; your data goes straight from the visitor to your machine, same as
+with a real domain).
+
+**`--upnp`** — attempts to configure port forwarding on your router
+automatically via UPnP/NAT-PMP, instead of doing it by hand in the router's
+admin page:
+
+```powershell
+tunnelme serve --tls acme --email you@example.com --port 3000 --quick --upnp
+```
+
+Not all routers support or allow this (many ISP-provided routers disable it
+by default) — if none is found, it logs that and falls back to needing
+manual port-forwarding, same as before.
+
+**`--setup-firewall`** — adds the Windows Firewall inbound rules for you
+(needs an Administrator terminal; safe to run repeatedly):
+
+```powershell
+tunnelme serve --tls acme --email you@example.com --port 3000 --quick --setup-firewall
+```
+
+Put together, `--quick --upnp --setup-firewall` (run as Administrator) gets
+about as close to "one command, zero manual network configuration" as a
+fully self-hosted tunnel can get — the one thing that still can't be
+automated is your static IP itself, since that's an ISP-level property, not
+something software on your machine controls.
+
 ## Expose a local dev server
 
 If your app and `serve` run on the **same machine**, skip the second
@@ -162,7 +212,8 @@ tunnelme --config <path> [--server <ws-url>] [--token <token>]
 tunnelme serve [--http-port 80] [--https-port 443] [--control-port 7000]
                [--tls acme|self-signed] [--email <email>] [--staging]
                [--certs-dir <path>] [--token <token>]
-               [--port <port> --url <domain>] [--config <path>]
+               [--port <port> [--url <domain> | --quick]] [--config <path>]
+               [--upnp] [--setup-firewall]
 ```
 
 The last line of `serve`'s options is optional: pass `--port`/`--url` (or

package/dist/bin/tunnelme.js

@@ -0,0 +1,182 @@
+#!/usr/bin/env node
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+const fs = __importStar(require("fs"));
+const commander_1 = require("commander");
+const config_1 = require("../src/config");
+const client_1 = require("../src/client");
+const server_1 = require("../src/server");
+const network_1 = require("../src/network");
+const firewall_1 = require("../src/firewall");
+const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, '..', '..', 'package.json'), 'utf8'));
+const program = new commander_1.Command();
+program
+    .name('tunnelme')
+    .description('Reverse-proxy a public domain to a localhost port, for dev/testing.')
+    .version(pkg.version);
+program
+    .command('run', { isDefault: true })
+    .description('Start the client: expose a local port under a public domain')
+    .option('-p, --port <port>', 'local port to expose', (v) => parseInt(v, 10))
+    .option('-u, --url <domain>', 'public domain to route to the local port')
+    .option('-c, --config <path>', 'config file with multiple tunnels (.yaml/.json)')
+    .option('-s, --server <url>', 'tunnelme server control address')
+    .option('-t, --token <token>', 'shared secret expected by the server')
+    .action((opts) => {
+    const DEFAULT_SERVER = 'ws://localhost:7000';
+    let serverUrl;
+    let token = opts.token || null;
+    let tunnels;
+    if (opts.config) {
+        const cfg = (0, config_1.loadConfig)(opts.config);
+        serverUrl = opts.server || cfg.server || DEFAULT_SERVER;
+        token = opts.token || cfg.token || null;
+        tunnels = cfg.tunnels.map((t) => ({ port: t.port, domain: t.url }));
+    }
+    else {
+        serverUrl = opts.server || DEFAULT_SERVER;
+        if (opts.port === undefined || Number.isNaN(opts.port) || !opts.url) {
+            console.error('Error: --port and --url are required (or pass --config)');
+            process.exit(1);
+        }
+        tunnels = [{ port: opts.port, domain: opts.url }];
+    }
+    (0, client_1.startClient)({ serverUrl, token, tunnels });
+});
+program
+    .command('serve')
+    .description('Start the tunnel server (run this on the internet-facing machine)')
+    .option('--http-port <port>', 'plain HTTP port (ACME challenges + redirect)', (v) => parseInt(v, 10), 80)
+    .option('--https-port <port>', 'public HTTPS entrypoint', (v) => parseInt(v, 10), 443)
+    .option('--control-port <port>', 'control channel port for clients to connect to', (v) => parseInt(v, 10), 7000)
+    .option('--certs-dir <path>', 'where to store certificates', path.join(os.homedir(), '.tunnelme', 'certs'))
+    .option('--tls <mode>', "acme (Let's Encrypt) or self-signed", 'acme')
+    .option('--email <email>', "contact email for Let's Encrypt")
+    .option('--staging', "use Let's Encrypt staging directory (for testing)", false)
+    .option('-t, --token <token>', 'require clients to present this shared secret')
+    .option('-p, --port <port>', 'also run a local tunnel: local port to expose', (v) => parseInt(v, 10))
+    .option('-u, --url <domain>', 'also run a local tunnel: public domain for --port')
+    .option('-c, --config <path>', 'also run local tunnel(s) from a config file (.yaml/.json)')
+    .option('-q, --quick', 'auto-generate a public URL for --port via sslip.io -- no domain to own or configure', false)
+    .option('--upnp', 'attempt automatic router port forwarding via UPnP/NAT-PMP', false)
+    .option('--setup-firewall', 'automatically add Windows Firewall inbound rules for the configured ports', false)
+    .action(async (opts) => {
+    if (opts.tls === 'acme' && !opts.email) {
+        console.error("Error: --email is required when --tls=acme (Let's Encrypt requires a contact email)");
+        process.exit(1);
+    }
+    if (opts.url && opts.quick) {
+        console.error('Error: --url and --quick are mutually exclusive');
+        process.exit(1);
+    }
+    if ((opts.url || opts.quick) && opts.port === undefined) {
+        console.error('Error: --url/--quick require --port');
+        process.exit(1);
+    }
+    if (opts.port !== undefined && !opts.url && !opts.quick) {
+        console.error('Error: --port requires --url (or pass --quick to auto-generate one)');
+        process.exit(1);
+    }
+    const { controlHttp } = (0, server_1.startServer)({
+        httpPort: opts.httpPort,
+        httpsPort: opts.httpsPort,
+        controlPort: opts.controlPort,
+        certsDir: opts.certsDir,
+        tlsMode: opts.tls,
+        acmeEmail: opts.email,
+        staging: opts.staging,
+        token: opts.token || null,
+    });
+    let stopUpnp = null;
+    if (opts.upnp) {
+        stopUpnp = await (0, network_1.autoPortForward)([opts.httpPort, opts.httpsPort]);
+    }
+    if (opts.setupFirewall) {
+        (0, firewall_1.setupWindowsFirewall)([opts.httpPort, opts.httpsPort]);
+    }
+    let quickUrl = null;
+    if (opts.quick && opts.port !== undefined) {
+        console.error(`Detecting public IP for --quick (port ${opts.port})...`);
+        try {
+            const ip = await (0, network_1.detectPublicIp)();
+            quickUrl = (0, network_1.quickDomain)(opts.port, ip);
+            console.error(`--quick: using https://${quickUrl} (sslip.io resolves this to ${ip} -- no traffic relay, just DNS)`);
+        }
+        catch (err) {
+            console.error(`Error: --quick failed to detect a public IP: ${err.message}`);
+            process.exit(1);
+        }
+    }
+    // Optionally also run the client in this same process, against the
+    // server's own control port, so `serve` + a tunnel can run from one
+    // terminal instead of two. Wait for the control channel to actually be
+    // listening first, so the client's first connection attempt doesn't race it.
+    if (opts.config || opts.port !== undefined) {
+        await new Promise((resolve) => {
+            if (controlHttp.listening)
+                resolve();
+            else
+                controlHttp.once('listening', () => resolve());
+        });
+        if (opts.config) {
+            const cfg = (0, config_1.loadConfig)(opts.config);
+            (0, client_1.startClient)({
+                serverUrl: `ws://localhost:${opts.controlPort}`,
+                token: opts.token || cfg.token || null,
+                tunnels: cfg.tunnels.map((t) => ({ port: t.port, domain: t.url })),
+            });
+        }
+        else if (opts.port !== undefined) {
+            (0, client_1.startClient)({
+                serverUrl: `ws://localhost:${opts.controlPort}`,
+                token: opts.token || null,
+                tunnels: [{ port: opts.port, domain: (opts.url || quickUrl) }],
+            });
+        }
+    }
+    if (stopUpnp) {
+        const stop = stopUpnp;
+        const cleanup = async () => {
+            await stop();
+            process.exit(0);
+        };
+        process.on('SIGINT', cleanup);
+        process.on('SIGTERM', cleanup);
+    }
+});
+program.parse();

package/dist/src/certStore.js

@@ -0,0 +1,199 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CertStore = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const tls = __importStar(require("tls"));
+const crypto = __importStar(require("crypto"));
+const acme = __importStar(require("acme-client"));
+const selfsigned = __importStar(require("selfsigned"));
+const LETS_ENCRYPT_PROD = 'https://acme-v02.api.letsencrypt.org/directory';
+const LETS_ENCRYPT_STAGING = 'https://acme-v02.api.letsencrypt.org/directory'.replace('acme-v02', 'acme-staging-v02');
+const RENEW_WITHIN_MS = 30 * 24 * 60 * 60 * 1000; // renew if <30 days left
+class CertStore {
+    certsDir;
+    mode;
+    acmeEmail;
+    staging;
+    cache = new Map();
+    pending = new Map();
+    challenges = new Map();
+    acmeClient = null;
+    constructor(opts) {
+        this.certsDir = opts.certsDir;
+        this.mode = opts.mode;
+        this.acmeEmail = opts.acmeEmail;
+        this.staging = !!opts.staging;
+        fs.mkdirSync(this.certsDir, { recursive: true });
+    }
+    domainDir(domain) {
+        return path.join(this.certsDir, domain);
+    }
+    loadFromDisk(domain) {
+        const dir = this.domainDir(domain);
+        const certPath = path.join(dir, 'cert.pem');
+        const keyPath = path.join(dir, 'key.pem');
+        if (!fs.existsSync(certPath) || !fs.existsSync(keyPath))
+            return null;
+        const cert = fs.readFileSync(certPath, 'utf8');
+        const key = fs.readFileSync(keyPath, 'utf8');
+        const expiresAt = this.certExpiry(cert);
+        return { cert, key, expiresAt };
+    }
+    saveToDisk(domain, { cert, key }) {
+        const dir = this.domainDir(domain);
+        fs.mkdirSync(dir, { recursive: true });
+        fs.writeFileSync(path.join(dir, 'cert.pem'), cert, { mode: 0o644 });
+        fs.writeFileSync(path.join(dir, 'key.pem'), key, { mode: 0o600 });
+    }
+    certExpiry(certPem) {
+        try {
+            const cert = new crypto.X509Certificate(certPem);
+            return new Date(cert.validTo).getTime();
+        }
+        catch {
+            return 0;
+        }
+    }
+    /** Returns a tls.SecureContext for the given domain, provisioning/renewing as needed. */
+    async getSecureContext(domain) {
+        const cached = this.cache.get(domain);
+        if (cached && cached.expiresAt - Date.now() > RENEW_WITHIN_MS) {
+            return cached.ctx;
+        }
+        const fromDisk = this.loadFromDisk(domain);
+        if (fromDisk && fromDisk.expiresAt - Date.now() > RENEW_WITHIN_MS) {
+            const ctx = tls.createSecureContext({ cert: fromDisk.cert, key: fromDisk.key });
+            this.cache.set(domain, { ctx, expiresAt: fromDisk.expiresAt });
+            return ctx;
+        }
+        const existingPending = this.pending.get(domain);
+        if (existingPending)
+            return existingPending;
+        const provisioning = this.provision(domain)
+            .then(({ cert, key }) => {
+            this.saveToDisk(domain, { cert, key });
+            const ctx = tls.createSecureContext({ cert, key });
+            this.cache.set(domain, { ctx, expiresAt: this.certExpiry(cert) });
+            this.pending.delete(domain);
+            return ctx;
+        })
+            .catch((err) => {
+            this.pending.delete(domain);
+            throw err;
+        });
+        this.pending.set(domain, provisioning);
+        return provisioning;
+    }
+    async provision(domain) {
+        if (this.mode === 'self-signed')
+            return this.provisionSelfSigned(domain);
+        return this.provisionAcme(domain);
+    }
+    provisionSelfSigned(domain) {
+        const attrs = [{ name: 'commonName', value: domain }];
+        const pems = selfsigned.generate(attrs, {
+            days: 365,
+            keySize: 2048,
+            extensions: [
+                { name: 'basicConstraints', cA: false },
+                { name: 'subjectAltName', altNames: [{ type: 2, value: domain }] },
+            ],
+        });
+        return { cert: pems.cert, key: pems.private };
+    }
+    async getAcmeClient() {
+        if (this.acmeClient)
+            return this.acmeClient;
+        const accountKeyPath = path.join(this.certsDir, 'account-key.pem');
+        let accountKey;
+        if (fs.existsSync(accountKeyPath)) {
+            accountKey = fs.readFileSync(accountKeyPath);
+        }
+        else {
+            accountKey = await acme.forge.createPrivateKey();
+            fs.writeFileSync(accountKeyPath, accountKey, { mode: 0o600 });
+        }
+        this.acmeClient = new acme.Client({
+            directoryUrl: this.staging ? LETS_ENCRYPT_STAGING : LETS_ENCRYPT_PROD,
+            accountKey,
+        });
+        return this.acmeClient;
+    }
+    async provisionAcme(domain) {
+        const client = await this.getAcmeClient();
+        const [key, csr] = await acme.forge.createCsr({ commonName: domain });
+        let cert;
+        try {
+            cert = await client.auto({
+                csr,
+                email: this.acmeEmail,
+                termsOfServiceAgreed: true,
+                challengePriority: ['http-01'],
+                challengeCreateFn: async (_authz, challenge, keyAuthorization) => {
+                    if (challenge.type !== 'http-01')
+                        return;
+                    this.challenges.set(challenge.token, keyAuthorization);
+                },
+                challengeRemoveFn: async (_authz, challenge) => {
+                    this.challenges.delete(challenge.token);
+                },
+            });
+        }
+        catch (err) {
+            // acme-client's retry logic has a known bug: a pure network failure
+            // (no HTTP response at all) talking to Let's Encrypt, after retries
+            // are exhausted, throws this exact confusing TypeError instead of the
+            // real network error. Surface a clearer, actionable message instead.
+            if (err instanceof TypeError && /reading 'config'/.test(err.message)) {
+                throw new Error(`Failed to reach Let's Encrypt while requesting a certificate for ${domain} ` +
+                    "(a network-level failure was hidden by a bug in the acme-client library). " +
+                    'Check outbound internet access from this machine to acme-v02.api.letsencrypt.org, ' +
+                    'and that inbound port 80 is reachable from the internet for the HTTP-01 challenge ' +
+                    "(Let's Encrypt must be able to fetch http://" +
+                    domain +
+                    '/.well-known/acme-challenge/... from outside your network). Then try again.');
+            }
+            throw err;
+        }
+        return { cert: cert.toString(), key: key.toString() };
+    }
+    /** Used by the plain :80 server to answer ACME http-01 challenge requests. */
+    getChallengeResponse(token) {
+        return this.challenges.get(token) || null;
+    }
+}
+exports.CertStore = CertStore;

package/dist/src/client.js

@@ -0,0 +1,123 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.startClient = startClient;
+const net = __importStar(require("net"));
+const ws_1 = __importStar(require("ws"));
+const util_1 = require("./util");
+const RECONNECT_DELAYS_MS = [1000, 2000, 5000, 10000, 15000];
+function startClient(opts) {
+    const { serverUrl, token = null, tunnels } = opts;
+    const portByDomain = new Map(tunnels.map((t) => [t.domain, t.port]));
+    let attempt = 0;
+    let stopped = false;
+    let currentWs = null;
+    function connect() {
+        if (stopped)
+            return;
+        const ws = new ws_1.default(`${serverUrl}/_tunnelme/control`);
+        currentWs = ws;
+        ws.on('open', () => {
+            attempt = 0;
+            (0, util_1.log)('connected to tunnel server, registering...');
+            ws.send(JSON.stringify({
+                type: 'register',
+                token,
+                tunnels: tunnels.map((t) => ({ domain: t.domain, port: t.port })),
+            }));
+        });
+        ws.on('message', (raw) => {
+            let msg;
+            try {
+                msg = JSON.parse(raw.toString());
+            }
+            catch {
+                return;
+            }
+            if (msg.type === 'registered') {
+                if (!Array.isArray(msg.domains))
+                    return;
+                for (const domain of msg.domains) {
+                    const port = portByDomain.get(domain);
+                    (0, util_1.log)(`tunnel active: https://${domain} -> localhost:${port}`);
+                }
+            }
+            else if (msg.type === 'error') {
+                (0, util_1.log)('server error:', msg.message);
+            }
+            else if (msg.type === 'conn' && msg.id && msg.domain) {
+                handleConnRequest(msg.id, msg.domain);
+            }
+        });
+        ws.on('close', () => {
+            if (stopped)
+                return;
+            (0, util_1.log)('disconnected from tunnel server, reconnecting...');
+            scheduleReconnect();
+        });
+        ws.on('error', (err) => {
+            (0, util_1.log)('control connection error:', (0, util_1.describeError)(err));
+        });
+    }
+    function scheduleReconnect() {
+        if (stopped)
+            return;
+        const delay = RECONNECT_DELAYS_MS[Math.min(attempt, RECONNECT_DELAYS_MS.length - 1)];
+        attempt += 1;
+        setTimeout(connect, delay);
+    }
+    function handleConnRequest(id, domain) {
+        const port = portByDomain.get(domain);
+        if (!port)
+            return;
+        const dataWs = new ws_1.default(`${serverUrl}/_tunnelme/data?id=${encodeURIComponent(id)}`);
+        dataWs.on('open', () => {
+            const dataStream = (0, ws_1.createWebSocketStream)(dataWs, { decodeStrings: false });
+            const localSocket = net.connect(port, 'localhost');
+            (0, util_1.pipeBidirectional)(localSocket, dataStream);
+        });
+        dataWs.on('error', (err) => {
+            (0, util_1.log)(`data connection error for ${domain}:`, (0, util_1.describeError)(err));
+        });
+    }
+    connect();
+    return {
+        stop() {
+            stopped = true;
+            if (currentWs)
+                currentWs.close();
+        },
+    };
+}

package/dist/src/config.js

@@ -0,0 +1,66 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadConfig = loadConfig;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const yaml = __importStar(require("js-yaml"));
+/**
+ * Loads a tunnelme config file (.yaml/.yml/.json).
+ * Shape:
+ * {
+ *   server: "ws://localhost:7000",   // control-channel address of `tunnelme serve`
+ *   token: "shared-secret",           // optional, must match server --token
+ *   tunnels: [ { port: 3000, url: "app.example.com" }, ... ]
+ * }
+ */
+function loadConfig(configPath) {
+    const resolved = path.resolve(configPath);
+    const raw = fs.readFileSync(resolved, 'utf8');
+    const ext = path.extname(resolved).toLowerCase();
+    const data = (ext === '.json' ? JSON.parse(raw) : yaml.load(raw));
+    if (!data || typeof data !== 'object') {
+        throw new Error(`Config file ${resolved} did not parse to an object`);
+    }
+    if (!Array.isArray(data.tunnels) || data.tunnels.length === 0) {
+        throw new Error(`Config file ${resolved} must define a non-empty "tunnels" array`);
+    }
+    for (const [i, t] of data.tunnels.entries()) {
+        if (t.port === undefined || t.port === null || !t.url) {
+            throw new Error(`tunnels[${i}] must have both "port" and "url"`);
+        }
+    }
+    return data;
+}