@rubytech/create-maxy 1.0.801 → 1.0.803

package/payload/platform/plugins/cloudflare/scripts/_cdp-authorize-matcher.mjs

@@ -1,74 +0,0 @@
-// Tri-state DOM matcher for the Cloudflare argotunnel consent page (Task 855).
-//
-// `dash.cloudflare.com/argotunnel?...` legitimately renders three observable
-// states for our flow:
-//
-//   1. Pre-authorize — a <button> or <input type="submit"> whose trimmed text
-//      matches /^(authorize|connect)$/i (and is not disabled). Click it; the
-//      callback fires, cloudflared writes ~/.cloudflared/cert.pem.
-//
-//   2. Post-success — the dashboard renders a Success modal containing the
-//      stable substring "Cloudflared has installed a certificate". This shape
-//      is reached when the user already authorised this account before (or
-//      did so manually in VNC between cloudflared spawn and helper poll).
-//      The OAuth callback is idempotent on the cert side: when the helper
-//      sees this state, the running cloudflared subprocess will still write
-//      ~/.cloudflared/cert.pem because the callback URL is exercised by the
-//      navigation. The wrapper drops into the existing cert-poll afterwards.
-//
-//   3. Neither — the page is mid-load, blank, or in some other state. The
-//      caller polls again until BUTTON_POLL_TIMEOUT_MS, then exits 1.
-//
-// The matcher returns a discriminated union from a single DOM read:
-//
-//   { kind: 'button', descriptor: {tag,text,disabled} } | { kind: 'success' } | null
-//
-// PRIORITY: button > success modal. Page transitions can briefly render both
-// (e.g. during the success animation). If a clickable Authorize button exists,
-// click it — the click produces a fresh callback regardless of any leftover
-// modal text. Only when no button is present do we trust the modal as the
-// terminal state.
-//
-// EXPORTED SHAPES:
-//
-//   * findMatch(doc) — JS function form. Used by JSDOM-based unit tests
-//     (platform/ui/scripts/__tests__/cdp-authorize-matcher.test.ts) so future
-//     matcher edits replay against captured DOM fixtures offline (Success
-//     criterion 8 of Task 855).
-//
-//   * MATCH_EXPR — string form, evaluated by Chrome DevTools Protocol's
-//     Runtime.evaluate in _cdp-authorize.mjs's polling loop. Built from
-//     findMatch.toString() so the live page and the tests run identical
-//     logic — single source of truth.
-//
-// CONTRACT — DO NOT loosen the success-modal anchor. Tighter anchors regress
-// on Cloudflare copy edits; "Cloudflared has installed a certificate" is the
-// load-bearing claim of the modal. Wider anchors (e.g. matching just
-// "certificate") would false-positive on the pre-authorize page.
-
-export function findMatch(doc) {
-  const candidates = Array.from(doc.querySelectorAll('button, input[type="submit"]'));
-  const match = candidates.find((el) => {
-    const text = (el.textContent ?? el.value ?? '').trim();
-    return /^(authorize|connect)$/i.test(text) && !el.disabled;
-  });
-  if (match) {
-    const descriptor = {
-      tag: match.tagName.toLowerCase(),
-      text: (match.textContent ?? match.value ?? '').trim().slice(0, 40),
-      disabled: Boolean(match.disabled),
-    };
-    match.click();
-    return { kind: 'button', descriptor };
-  }
-  // textContent over innerText: jsdom's innerText is partial; the dashboard's
-  // success-modal text is plain DOM content (not visibility-gated by CSS for
-  // anyone reading the page) so textContent finds it on both runtimes.
-  const bodyText = doc.body ? doc.body.textContent || '' : '';
-  if (bodyText.includes('Cloudflared has installed a certificate')) {
-    return { kind: 'success' };
-  }
-  return null;
-}
-
-export const MATCH_EXPR = `(${findMatch.toString()})(document)`;

package/payload/platform/plugins/cloudflare/scripts/_cdp-authorize.mjs

@@ -1,284 +0,0 @@
-#!/usr/bin/env node
-// Drive the Cloudflare argotunnel consent page to a deterministic terminal
-// state via CDP WebSocket. Originally Task 588 (Authorize click from code,
-// collapsing a 180 s human-latency window). Task 855 widens the contract to
-// three states because the dashboard does not always render a button — once
-// the bound account has authorized this device's zones, navigating the same
-// (or a fresh) consent URL renders a Success modal verbatim, and the
-// pre-855 helper conflated "no button visible yet" with "no button will
-// ever appear" and exited error.
-//
-// Protocol: Chrome DevTools Protocol over WebSocket
-// (https://chromedevtools.github.io/devtools-protocol/):
-//   1. GET http://127.0.0.1:9222/json/list → find the target with matching id;
-//      extract webSocketDebuggerUrl.
-//   2. Open WS, enable Page + Runtime domains.
-//   3. Wait for Page.loadEventFired (or observe document.readyState==='complete').
-//   4. Poll Runtime.evaluate every 200 ms for up to ~3 s, evaluating the
-//      tri-state matcher from _cdp-authorize-matcher.mjs. The matcher
-//      returns one of:
-//        - { kind:'button', descriptor } — Authorize/Connect button found,
-//                                          click() fired in-page; emit
-//                                          reason=clicked, exit 0.
-//        - { kind:'success' }            — Success modal text detected
-//                                          ("Cloudflared has installed a
-//                                          certificate"); cert is bound to
-//                                          the account. Emit reason=
-//                                          cert-already-installed, exit 0.
-//                                          Caller's existing cert-poll picks
-//                                          up the cert (callback is
-//                                          idempotent on this navigation).
-//        - null                          — Neither anchor matched yet; loop.
-//      After BUTTON_POLL_TIMEOUT_MS with no terminal match, emit
-//      reason=authorize-button-not-found, exit 1.
-//
-// Exit codes:
-//   0 - terminal success (reason=clicked OR reason=cert-already-installed)
-//   1 - authorize-button-not-found (loud failure — button AND modal absent)
-//   2 - cdp-ws-unreachable or node-websocket-unavailable
-//   3 - target-not-found (the target_id isn't in /json/list)
-//   4 - click-evaluate-threw (Runtime.evaluate returned wasThrown=true)
-//   5 - protocol-error (malformed CDP response)
-//
-// Stdout contract (read by setup-tunnel.sh's awk-based reason parser):
-//   cdp-authorize result=<ok|error> reason=<…> elapsed_ms=<…> [detail=<…>]
-// Exactly ONE such line per invocation; the wrapper takes the LAST
-// `result=ok` line via awk so future debug-line additions cannot mis-route.
-
-import { MATCH_EXPR } from './_cdp-authorize-matcher.mjs';
-
-const CDP_HOST = '127.0.0.1';
-const CDP_PORT = 9222;
-const HTTP_TIMEOUT_MS = 3000;
-const BUTTON_POLL_TIMEOUT_MS = 3000;
-const BUTTON_POLL_INTERVAL_MS = 200;
-const LOAD_WAIT_TIMEOUT_MS = 5000;
-const WS_CONNECT_TIMEOUT_MS = 3000;
-const RESULT_WAIT_TIMEOUT_MS = 3000;
-
-function emit(result, reason, extra = {}) {
-  const parts = [`cdp-authorize result=${result} reason=${reason}`];
-  for (const [k, v] of Object.entries(extra)) {
-    if (v === undefined || v === null) continue;
-    const s = String(v).replace(/\s+/g, ' ');
-    parts.push(`${k}="${s.slice(0, 200)}"`);
-  }
-  process.stdout.write(parts.join(' ') + '\n');
-}
-
-function die(code, reason, extra) {
-  emit('error', reason, extra);
-  process.exit(code);
-}
-
-if (typeof WebSocket === 'undefined') {
-  die(2, 'node-websocket-unavailable', {
-    detail: `Node ${process.version} has no global WebSocket — upgrade to Node 22+`,
-  });
-}
-
-const targetId = process.argv[2];
-if (!targetId) {
-  die(2, 'missing-target-id', { detail: 'usage: _cdp-authorize.mjs <target-id>' });
-}
-
-const started = Date.now();
-
-async function fetchTargets() {
-  const ac = new AbortController();
-  const timer = setTimeout(() => ac.abort(), HTTP_TIMEOUT_MS);
-  try {
-    const res = await fetch(`http://${CDP_HOST}:${CDP_PORT}/json/list`, { signal: ac.signal });
-    if (!res.ok) throw new Error(`/json/list returned ${res.status}`);
-    return await res.json();
-  } finally {
-    clearTimeout(timer);
-  }
-}
-
-let targets;
-try {
-  targets = await fetchTargets();
-} catch (err) {
-  die(2, 'cdp-ws-unreachable', { detail: err instanceof Error ? err.message : String(err) });
-}
-
-const target = Array.isArray(targets) ? targets.find((t) => t && t.id === targetId) : undefined;
-if (!target || typeof target.webSocketDebuggerUrl !== 'string') {
-  die(3, 'target-not-found', { target_id: targetId, count: Array.isArray(targets) ? targets.length : -1 });
-}
-
-// Open WebSocket. Native Node 22 global.
-let ws;
-try {
-  ws = new WebSocket(target.webSocketDebuggerUrl);
-} catch (err) {
-  die(2, 'cdp-ws-unreachable', { detail: err instanceof Error ? err.message : String(err) });
-}
-
-// WS open with race guards. Three outcomes are possible:
-//   1. `open` fires before `error` / timeout → resolve and continue.
-//   2. `error` fires before `open` → reject; caller emits die() and exits.
-//   3. Timeout fires before either → reject; caller emits die() and exits.
-// The `.once` on `open`/`error` listeners handles the race where both fire
-// in quick succession (some proxy-protocol mismatches can emit `error`
-// before the open event is dispatched). The catch below awaits the die()
-// call and then `throw`s to guarantee execution does not fall through to
-// the Page.enable call with a dead socket — even if a future refactor
-// removes process.exit() from die().
-try {
-  await new Promise((resolveOpen, rejectOpen) => {
-    const timer = setTimeout(() => rejectOpen(new Error('ws open timeout')), WS_CONNECT_TIMEOUT_MS);
-    ws.addEventListener('open', () => { clearTimeout(timer); resolveOpen(); }, { once: true });
-    ws.addEventListener('error', (e) => { clearTimeout(timer); rejectOpen(new Error(`ws error: ${e.message ?? 'unknown'}`)); }, { once: true });
-  });
-} catch (err) {
-  die(2, 'cdp-ws-unreachable', { detail: err instanceof Error ? err.message : String(err) });
-  throw err; // unreachable — die() exits, but guards the type system and future refactors.
-}
-
-// Message router: CDP replies come back keyed by the `id` we sent. Events
-// arrive with no `id` but a `method` (e.g. "Page.loadEventFired").
-let nextId = 1;
-const pending = new Map();
-const eventListeners = new Map();
-
-ws.addEventListener('message', (evt) => {
-  let msg;
-  try {
-    msg = JSON.parse(typeof evt.data === 'string' ? evt.data : evt.data.toString());
-  } catch {
-    return;
-  }
-  if (typeof msg.id === 'number' && pending.has(msg.id)) {
-    const { resolveIt, rejectIt } = pending.get(msg.id);
-    pending.delete(msg.id);
-    if (msg.error) rejectIt(new Error(`CDP error: ${msg.error.message ?? JSON.stringify(msg.error)}`));
-    else resolveIt(msg.result);
-  } else if (typeof msg.method === 'string') {
-    const listeners = eventListeners.get(msg.method);
-    if (listeners) for (const l of listeners) l(msg.params);
-  }
-});
-
-ws.addEventListener('close', () => {
-  for (const { rejectIt } of pending.values()) {
-    rejectIt(new Error('ws closed while awaiting response'));
-  }
-  pending.clear();
-});
-
-function send(method, params = {}) {
-  const id = nextId++;
-  return new Promise((resolveIt, rejectIt) => {
-    const timer = setTimeout(() => {
-      pending.delete(id);
-      rejectIt(new Error(`CDP ${method} timed out after ${RESULT_WAIT_TIMEOUT_MS}ms`));
-    }, RESULT_WAIT_TIMEOUT_MS);
-    pending.set(id, {
-      resolveIt: (r) => { clearTimeout(timer); resolveIt(r); },
-      rejectIt: (e) => { clearTimeout(timer); rejectIt(e); },
-    });
-    ws.send(JSON.stringify({ id, method, params }));
-  });
-}
-
-function onEvent(method, listener) {
-  let set = eventListeners.get(method);
-  if (!set) { set = new Set(); eventListeners.set(method, set); }
-  set.add(listener);
-  return () => set.delete(listener);
-}
-
-// Enable the two domains we need. Page.enable fires events; Runtime.enable
-// lets us run expressions in the page context.
-try {
-  await send('Page.enable');
-  await send('Runtime.enable');
-} catch (err) {
-  die(5, 'protocol-error', { detail: err.message });
-}
-
-// Wait for load — if the page is already loaded (navigated before this helper
-// ran), Page.loadEventFired may never fire again; poll document.readyState
-// as a fallback. The first of the two to resolve wins.
-async function waitForLoad() {
-  const loadFired = new Promise((resolveIt) => {
-    const off = onEvent('Page.loadEventFired', () => { off(); resolveIt('loadEvent'); });
-  });
-  const readyStatePoll = (async () => {
-    const deadline = Date.now() + LOAD_WAIT_TIMEOUT_MS;
-    while (Date.now() < deadline) {
-      try {
-        const r = await send('Runtime.evaluate', {
-          expression: 'document.readyState',
-          returnByValue: true,
-        });
-        if (r?.result?.value === 'complete' || r?.result?.value === 'interactive') return 'readyState';
-      } catch { /* keep polling */ }
-      await new Promise((res) => setTimeout(res, 200));
-    }
-    throw new Error('load-wait-timeout');
-  })();
-  return Promise.race([loadFired, readyStatePoll]);
-}
-
-try {
-  await waitForLoad();
-} catch (err) {
-  die(1, 'page-load-timeout', { detail: err.message, elapsed_ms: Date.now() - started });
-}
-
-// Poll the consent page until one of the three terminal states resolves.
-// MATCH_EXPR is built from _cdp-authorize-matcher.mjs's findMatch so the
-// JSDOM unit tests and the live CDP path execute literally identical logic.
-const matchDeadline = Date.now() + BUTTON_POLL_TIMEOUT_MS;
-let matched = null;
-while (Date.now() < matchDeadline) {
-  let r;
-  try {
-    r = await send('Runtime.evaluate', {
-      expression: MATCH_EXPR,
-      returnByValue: true,
-      awaitPromise: false,
-    });
-  } catch (err) {
-    die(5, 'protocol-error', { detail: err.message });
-  }
-  if (r?.exceptionDetails) {
-    die(4, 'click-evaluate-threw', {
-      detail: r.exceptionDetails.text ?? 'unknown exception',
-      elapsed_ms: Date.now() - started,
-    });
-  }
-  const val = r?.result?.value;
-  if (val && typeof val === 'object' && (val.kind === 'button' || val.kind === 'success')) {
-    matched = val;
-    break;
-  }
-  await new Promise((res) => setTimeout(res, BUTTON_POLL_INTERVAL_MS));
-}
-
-if (!matched) {
-  die(1, 'authorize-button-not-found', { elapsed_ms: Date.now() - started });
-}
-
-if (matched.kind === 'button') {
-  const d = matched.descriptor ?? {};
-  emit('ok', 'clicked', {
-    tag: d.tag,
-    text: d.text,
-    elapsed_ms: Date.now() - started,
-  });
-} else {
-  // matched.kind === 'success' — Success modal text is on the page; the
-  // bound account already has a cert. Caller drops into the cert-poll loop;
-  // the in-flight cloudflared subprocess receives the idempotent callback
-  // and writes ~/.cloudflared/cert.pem.
-  emit('ok', 'cert-already-installed', {
-    elapsed_ms: Date.now() - started,
-  });
-}
-
-try { ws.close(); } catch { /* best-effort */ }
-process.exit(0);