@edgehero/pi-dispatch-sandbox-gateway 0.0.0-stage → 5.1.0

package/dist/static/gateway.js

@@ -0,0 +1,151 @@
+(() => {
+  var __create = Object.create;
+  var __defProp = Object.defineProperty;
+  var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+  var __getOwnPropNames = Object.getOwnPropertyNames;
+  var __getProtoOf = Object.getPrototypeOf;
+  var __hasOwnProp = Object.prototype.hasOwnProperty;
+  var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+    get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+  }) : x)(function(x) {
+    if (typeof require !== "undefined") return require.apply(this, arguments);
+    throw Error('Dynamic require of "' + x + '" is not supported');
+  });
+  var __copyProps = (to, from, except, desc) => {
+    if (from && typeof from === "object" || typeof from === "function") {
+      for (let key of __getOwnPropNames(from))
+        if (!__hasOwnProp.call(to, key) && key !== except)
+          __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+    }
+    return to;
+  };
+  var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+    // If the importer is in node compatibility mode or this is not an ESM
+    // file that has been converted to a CommonJS file using a Babel-
+    // compatible transform (i.e. "__esModule" has not been set), then set
+    // "default" to the CommonJS "module.exports" for node compatibility.
+    isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+    mod
+  ));
+
+  // src/bootstrap.mjs
+  var PUBLIC_ID = /^[A-Za-z0-9_-]{43}$/;
+  var GATEWAY_BROWSER_MIN_WIDTH = 761;
+  var GATEWAY_BOOT_TIMEOUT_MS = 1e4;
+  var GATEWAY_BOOT_WORDS = Object.freeze({
+    phone: ["Use your own terminal", "Browser terminals require a window wider than 760 pixels. Return to Sandboxes and copy the command."],
+    invalid: ["This launch is not usable", "Return to Sandboxes and start a new browser launch. A public request id alone cannot open a terminal."],
+    unavailable: ["The gateway could not authorize this launch", "No terminal opened. Return to Sandboxes, check the gateway and sign in again for a new launch."],
+    expired: ["This launch has ended", "The one-use authorization expired or was already used. Return to Sandboxes and start a new browser launch."],
+    loading: ["Opening the terminal", "Authorization was accepted. The terminal connects only to this gateway."],
+    coordination: ["Use your own terminal", "This browser cannot coordinate secure gateway launches. Return to Sandboxes and use Open in Terminal or copy the command."],
+    busy: ["Already open", "This exact browser attachment is already open. Use its existing workspace window, or disconnect it before authorizing a fresh launch."],
+    runtime: ["Sandbox runtime unavailable", "The gateway could not verify this existing shell. Inspect its host before authorizing a fresh launch. No container was started."],
+    session: ["This workspace uses another sign-in", "An existing workspace keeps its original sign-in even when all its tabs are closed. Close that workspace before opening a terminal with a different sign-in."],
+    limited: ["The gateway is at its connection limit", "No terminal opened. Disconnect an existing browser attachment or wait, then start a fresh launch from Sandboxes."]
+  });
+  function readGatewayLaunch(location, history) {
+    const url = new URL(location.href);
+    const fragment = url.hash;
+    if (fragment) history.replaceState(null, "", `${url.pathname}${url.search}`);
+    const match = /^\/s\/([A-Za-z0-9_-]{43})$/.exec(url.pathname);
+    if (!match || url.search) return null;
+    const values = new URLSearchParams(fragment.slice(1));
+    if ([...values.keys()].some((key) => key !== "handoff") || values.getAll("handoff").length > 1) return null;
+    const handoff = values.get("handoff");
+    if (fragment && (!handoff || !PUBLIC_ID.test(handoff))) return null;
+    return { intentId: match[1], handoff };
+  }
+  function gatewayAuthorizeUrl(raw, consoleOrigin, intentId) {
+    try {
+      const url = new URL(raw);
+      return url.origin === consoleOrigin && !url.username && !url.password && url.pathname === "/sandbox/gateway/authorize" && !url.hash && url.search === `?intent=${intentId}` ? url.href : null;
+    } catch {
+      return null;
+    }
+  }
+  function gatewayBootRefusal(status, reason) {
+    if (reason === "workbench-session-changed") return "session";
+    if (reason === "window-busy") return "busy";
+    if (reason === "runtime-unavailable" || reason === "runtime-environment") return "runtime";
+    if (status === 429) return "limited";
+    return status === 409 || status === 410 ? "expired" : "unavailable";
+  }
+  async function boundedGatewayCall(window2, action) {
+    const controller = new window2.AbortController();
+    let timer;
+    try {
+      return await Promise.race([action(controller.signal), new Promise((_, reject) => {
+        timer = window2.setTimeout(() => {
+          controller.abort();
+          reject(new Error("gateway-request-timeout"));
+        }, GATEWAY_BOOT_TIMEOUT_MS);
+      })]);
+    } finally {
+      window2.clearTimeout(timer);
+    }
+  }
+  async function requestGateway(fetch, path, body, signal) {
+    const response = await fetch(path, { method: "POST", credentials: "same-origin", cache: "no-store", headers: { "Content-Type": "application/json" }, body: JSON.stringify(body), signal });
+    let data;
+    try {
+      data = await response.json();
+    } catch {
+      data = null;
+    }
+    return { ok: response.ok, status: response.status, data };
+  }
+  async function startGatewayPage(options = {}) {
+    var _a, _b, _c, _d;
+    const window2 = options.window, document2 = options.document, fetch = options.fetch;
+    const importTerminal = options.importTerminal ?? (() => import("/static/terminal.js"));
+    const launch = readGatewayLaunch(window2.location, window2.history);
+    const say = (key) => {
+      const words = GATEWAY_BOOT_WORDS[key] ?? GATEWAY_BOOT_WORDS.unavailable;
+      document2.getElementById("gateway-state-title").textContent = words[0];
+      document2.getElementById("gateway-state-text").textContent = words[1];
+    };
+    if (!launch) {
+      say("invalid");
+      return { state: "invalid" };
+    }
+    if (window2.matchMedia(`(max-width: ${GATEWAY_BROWSER_MIN_WIDTH - 1}px)`).matches) {
+      say("phone");
+      return { state: "phone" };
+    }
+    const consoleOrigin = (_a = document2.querySelector('meta[name="gateway-console-origin"]')) == null ? void 0 : _a.getAttribute("content");
+    try {
+      if (launch.handoff) {
+        if (typeof ((_c = (_b = window2.navigator) == null ? void 0 : _b.locks) == null ? void 0 : _c.request) !== "function") {
+          say("coordination");
+          return { state: "coordination" };
+        }
+        const exchange = await boundedGatewayCall(window2, (signal) => window2.navigator.locks.request("pi-dispatch-sandbox-bootstrap", { mode: "exclusive", signal }, () => requestGateway(fetch, "/api/bootstrap", launch, signal)));
+        if (!exchange.ok) {
+          say(gatewayBootRefusal(exchange.status, (_d = exchange.data) == null ? void 0 : _d.error));
+          return { state: "refused" };
+        }
+        const result = exchange.data;
+        const destination = gatewayAuthorizeUrl(result.authorizeUrl, consoleOrigin, launch.intentId);
+        if (!destination || !/^[A-Za-z0-9_-]{43}$/.test(result.receipt ?? "")) {
+          say("invalid");
+          return { state: "invalid" };
+        }
+        window2.location.replace(`${destination}#receipt=${result.receipt}`);
+        return { state: "authorize" };
+      }
+      const deadline = window2.performance.now() + 15e3;
+      say("loading");
+      const terminal = await boundedGatewayCall(window2, () => importTerminal());
+      if (typeof terminal.startWorkbenchLaunch !== "function") {
+        say("unavailable");
+        return { state: "unavailable" };
+      }
+      return await terminal.startWorkbenchLaunch({ window: window2, document: document2, intentId: launch.intentId, fetch, deadline, onRefusal: (status, reason) => say(gatewayBootRefusal(status, reason)) });
+    } catch {
+      say("unavailable");
+      return { state: "unavailable" };
+    }
+  }
+  if (typeof window !== "undefined" && typeof document !== "undefined") void startGatewayPage({ window, document, fetch: window.fetch.bind(window) });
+})();