@tesser-sh/gateway 0.0.0-stage → 0.53.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Tesser Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/index.d.ts

@@ -0,0 +1,15 @@
+import { DurableObject } from "cloudflare:workers";
+
+export interface GatewayEnv {
+  readonly BOXES: DurableObjectNamespace<GatewayBoxes>;
+  readonly GATEWAY_HOST: string;
+  readonly TESSER_URL: string;
+  readonly TESSER_ORG: string;
+  readonly ACCESS_TEAM: string;
+  readonly ACCESS_AUD: string;
+}
+
+declare const gateway: { fetch(request: Request, env: GatewayEnv): Promise<Response> };
+export default gateway;
+
+export declare class GatewayBoxes extends DurableObject<GatewayEnv> {}

package/index.js

@@ -0,0 +1,1277 @@
+// ../front/src/page.ts
+var FAVICON = `data:image/svg+xml,${encodeURIComponent('<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><rect width="24" height="24" rx="4" fill="#000000"/><g transform="translate(2.4 2.4) scale(0.8)"><path fill="#f0f1e9" d="M11.5 11.5H2A9.5 9.5 0 0 1 11.5 2ZM12.5 12.5H22A9.5 9.5 0 0 1 12.5 22Z"/><path fill="#fbffc9" d="M12.5 2H22V11.5H12.5Z"/></g></svg>')}`;
+function escapeHtml(text) {
+  return text.replace(/[&<>"]/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;" })[c]);
+}
+function shell(title, main, script = "", panel = !0) {
+  return `<!doctype html>
+<html lang="en">
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${escapeHtml(title)}</title>
+<link rel="icon" href="${FAVICON}">
+<style>
+:root {
+  --ground: #171717; --well: #1f1f1f; --rule: #2e2e2e; --rule-strong: #444444;
+  --bone: #f0f1e9; --dim: #a8a8a8; --faint: #8f8f8f; --remote: #fbffc9; --bad: #f87171;
+  --sans: ui-sans-serif, system-ui, -apple-system, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
+  --mono: ui-monospace, SFMono-Regular, Menlo, Consolas, "Liberation Mono", monospace;
+  color-scheme: dark;
+}
+* { box-sizing: border-box; margin: 0; }
+body { background: var(--ground); color: var(--bone); font: 14px/1.5 var(--sans); -webkit-font-smoothing: antialiased; }
+.page { max-width: 520px; margin: 0 auto; padding: 18vh 16px 96px; }
+header { display: flex; align-items: center; gap: 8px; margin-bottom: 28px; font-size: 13px; font-weight: 500; }
+.mark { width: 16px; height: 16px; fill: var(--bone); }
+.mark .remote { fill: var(--remote); }
+h1 { font-size: 22px; line-height: 1.25; font-weight: 500; letter-spacing: -0.01em; text-wrap: balance; overflow-wrap: anywhere; }
+.sq { display: inline-block; width: 8px; height: 8px; margin-right: 10px; vertical-align: 2px; background: var(--remote); animation: wait 1.2s steps(2, jump-none) infinite; }
+@keyframes wait { to { opacity: 0.25; } }
+@media (prefers-reduced-motion: reduce) { .sq { animation: none; } }
+code, .mono { font-family: var(--mono); font-size: 13px; }
+:focus-visible { outline: 2px solid var(--remote); outline-offset: 2px; }
+.cmd { display: flex; margin-top: 24px; background: var(--well); border: 1px solid var(--rule); }
+.cmd code { flex: 1; min-width: 0; padding: 11px 14px; overflow-x: auto; white-space: nowrap; }
+.cmd code::before { content: "$ "; color: var(--faint); }
+.cmd button { padding: 0 14px; background: none; border: 0; border-left: 1px solid var(--rule); color: var(--dim); font: 12.5px var(--sans); cursor: pointer; }
+.cmd button:hover { color: var(--bone); background: var(--rule); }
+ul { list-style: none; padding: 0; margin-top: 24px; border: 1px solid var(--rule); }
+li { display: flex; align-items: center; gap: 16px; min-height: 48px; padding: 8px 8px 8px 14px; border-top: 1px solid var(--rule); }
+li:first-child { border-top: 0; }
+li .name { flex: 1; min-width: 0; overflow-wrap: anywhere; }
+.ports { color: var(--dim); white-space: nowrap; padding-right: 6px; }
+.ports a { color: inherit; text-decoration: none; }
+.ports a:hover { color: var(--bone); text-decoration: underline; text-decoration-color: var(--remote); text-underline-offset: 3px; }
+tesser-use { color: var(--faint); }
+tesser-wake { display: block; margin-top: 24px; }
+.bad { margin-top: 24px; color: var(--bad); font-size: 13px; }
+.open { margin-top: 24px; padding: 9px 16px; background: var(--remote); color: #171717; border: 0; font: 500 14px var(--sans); cursor: pointer; }
+.open:disabled { background: var(--rule); color: var(--dim); cursor: default; }
+a.open { display: inline-block; text-decoration: none; }
+.sub { margin-top: 8px; color: var(--dim); }
+.steps { list-style: none; padding: 0; margin-top: 24px; }
+.steps li { display: flex; align-items: flex-start; gap: 0; min-height: 0; padding: 4px 0; border: 0; color: var(--dim); overflow-wrap: anywhere; }
+.steps li.now { color: var(--bone); }
+.steps .done { flex: none; width: 8px; margin-right: 10px; color: var(--faint); font-size: 11px; line-height: 21px; }
+.steps .failed { color: var(--bad); }
+.steps .sq { flex: none; margin-top: 7px; }
+.elapsed { flex: none; margin-left: auto; padding-left: 16px; color: var(--faint); white-space: nowrap; }
+.code { margin-top: 28px; padding: 18px 0; background: var(--well); border: 1px solid var(--rule); font: 500 32px/1 var(--mono); letter-spacing: 0.12em; text-align: center; }
+.hint { margin-top: 16px; color: var(--faint); font-size: 13px; }
+.who { margin-top: 8px; color: var(--faint); font-size: 13px; }
+</style>
+<div class="page">
+<header><svg class="mark" viewBox="0 0 24 24" aria-hidden="true"><path d="M11.5 11.5H2A9.5 9.5 0 0 1 11.5 2ZM12.5 12.5H22A9.5 9.5 0 0 1 12.5 22Z"/><path class="remote" d="M12.5 2H22V11.5H12.5Z"/></svg>tesser</header>
+${main}
+</div>
+${script}
+${panel ? '<script src="/__tesser/panel.js" defer></script>' : ""}
+</html>`;
+}
+var RETRY = `<script>
+document.addEventListener("click", (event) => {
+  const button = event.target.closest("[data-copy]");
+  if (!button) return;
+  navigator.clipboard.writeText(button.dataset.copy).then(() => {
+    button.textContent = "Copied";
+    setTimeout(() => { button.textContent = "Copy"; }, 1200);
+  });
+});
+(async () => {
+  let shown = document.querySelector("main").outerHTML;
+  for (;;) {
+    await new Promise((resolve) => setTimeout(resolve, 1500));
+    try {
+      const response = await fetch(location.href, { headers: { accept: "text/html" }, cache: "no-store" });
+      if (!response.headers.has("x-tesser-status")) return location.reload();
+      const page = new DOMParser().parseFromString(await response.text(), "text/html");
+      const next = page.querySelector("main");
+      if (!next || next.outerHTML === shown) continue;
+      shown = next.outerHTML;
+      document.title = page.title;
+      document.querySelector("main").replaceWith(next);
+    } catch {}
+  }
+})();
+</script>`, STATUS_HEADERS = { "content-type": "text/html; charset=utf-8", "cache-control": "no-store", "x-tesser-status": "1" };
+
+// ../front/src/viewer.ts
+var STATUS = {
+  waking: 503,
+  booting: 503,
+  "not-answering": 504,
+  stopped: 502,
+  "wake-failed": 503,
+  "no-port": 404,
+  "not-shared": 404,
+  unavailable: 503
+};
+function viewerStatus(state) {
+  return STATUS[state.kind];
+}
+function viewerText(state) {
+  switch (state.kind) {
+    case "waking":
+      return `${state.box.name} is waking up; retry shortly`;
+    case "booting":
+      return `${state.box.name} is booting; retry shortly`;
+    case "not-answering":
+      return `${state.box.name} isn't answering on port ${state.port}`;
+    case "stopped":
+      return `${state.box.name} has stopped`;
+    case "wake-failed":
+      return `${state.box.name} didn't wake up: ${state.reason}`;
+    case "no-port":
+      return `${state.box.name} has no port ${state.port}`;
+    case "not-shared":
+      return "nothing is shared here";
+    case "unavailable":
+      return "this gateway can't reach tesser to check what is shared";
+  }
+}
+var STAGES = ["machine", "app", "port"];
+function steps(stage, port, seconds) {
+  let label = { machine: "Starting the machine", app: "Starting the app", port: `Waiting for port ${port}` }, at = STAGES.indexOf(stage);
+  return `<ol class="steps">${STAGES.map((step, i) => {
+    if (i < at)
+      return `<li><span class="done">✓</span><span>${label[step]}</span></li>`;
+    if (i === at)
+      return `<li class="now"><span class="sq"></span><span>${escapeHtml(label[step])}</span><span class="elapsed mono">${seconds}s</span></li>`;
+    return `<li><span class="done"></span><span>${escapeHtml(label[step])}</span></li>`;
+  }).join("")}</ol>`;
+}
+function who(box) {
+  return box.sharedBy === null ? "" : `<p class="who">Shared by ${escapeHtml(box.sharedBy)}</p>`;
+}
+function body(state) {
+  switch (state.kind) {
+    case "waking":
+      return {
+        headline: `Waking ${state.box.name}`,
+        spinner: !0,
+        retry: !0,
+        rest: `${who(state.box)}${steps(state.stage, state.port, state.seconds)}<p class="hint">Usually about 30 seconds. This page opens the app by itself.</p>`
+      };
+    case "booting":
+      return { headline: `${state.box.name} is booting`, spinner: !0, retry: !0, rest: `${who(state.box)}<p class="hint">A fresh machine takes a minute or two. This page opens the app by itself.</p>` };
+    case "not-answering":
+      return {
+        headline: `${state.box.name} isn't answering on port ${state.port}`,
+        spinner: !0,
+        retry: !0,
+        rest: `${who(state.box)}<p class="hint">The box is up but the app hasn't answered yet. Still trying.</p>`
+      };
+    case "stopped":
+      return {
+        headline: `${state.box.name} has stopped`,
+        spinner: !1,
+        retry: !0,
+        rest: `${who(state.box)}<p class="sub">The app on this box exited. ${state.box.sharedBy === null ? "Ask whoever shared it" : "Ask them"} to restart it.</p>`
+      };
+    case "wake-failed":
+      return {
+        headline: `${state.box.name} didn't wake up`,
+        spinner: !1,
+        retry: !1,
+        rest: `${who(state.box)}<p class="bad">${escapeHtml(state.reason)}</p><button type="button" class="open" onclick="location.reload()">Try again</button>`
+      };
+    case "no-port":
+      return {
+        headline: `${state.box.name} has no port ${state.port}`,
+        spinner: !1,
+        retry: !1,
+        rest: `${who(state.box)}<ul>${state.ports.map((p) => `<li><span class="name ports mono"><a href="${escapeHtml(p.href)}">:${p.port}</a></span></li>`).join("")}</ul>`
+      };
+    case "not-shared":
+      return { headline: "Nothing is shared here", spinner: !1, retry: !1, rest: '<p class="sub">This link was never shared, or it was unshared. Ask whoever sent it for a new one.</p>' };
+    case "unavailable":
+      return { headline: "Can't check what's shared", spinner: !0, retry: !0, rest: `<p class="sub">This gateway can't reach tesser right now. Retrying.</p>` };
+  }
+}
+function viewerPage(state) {
+  let { headline, spinner, retry, rest } = body(state), main = `<main>
+<h1>${spinner ? '<span class="sq"></span>' : ""}${escapeHtml(headline)}</h1>
+${rest}
+</main>`;
+  return shell(`${headline} · tesser`, main, retry ? RETRY : "", !1);
+}
+
+// ../protocol/src/table.ts
+function boxIdFromLabel(label) {
+  let m = /^box(?:[-_]([0-9a-z]+)|([0-9a-f]+))$/i.exec(label);
+  return m === null ? null : `box_${(m[1] ?? m[2]).toLowerCase()}`;
+}
+
+// ../protocol/src/gateway.ts
+var GATEWAY_DIAL_PATH = "/__tesser/box";
+function gatewayLabel(boxId, port) {
+  return `box-${boxId.slice(4)}${port === null ? "" : `--${port}`}`;
+}
+function parseGatewayLabel(label) {
+  let [head, port, ...rest] = label.split("--"), boxId = boxIdFromLabel(head);
+  if (boxId === null || rest.length > 0)
+    return null;
+  if (port === void 0)
+    return { boxId, port: null };
+  if (!/^[1-9]\d{0,4}$/.test(port) || Number(port) > 65535)
+    return null;
+  return { boxId, port: Number(port) };
+}
+function gatewayHostBox(gatewayHost, hostname) {
+  let suffix = `.${gatewayHost.toLowerCase()}`, host = hostname.toLowerCase().replace(/\.$/, "");
+  if (!host.endsWith(suffix))
+    return null;
+  return parseGatewayLabel(host.slice(0, -suffix.length).split(".").pop())?.boxId ?? null;
+}
+
+// ../protocol/src/mux.ts
+var MUX_WINDOW = 262144, MUX_CHUNK = 65536;
+var MUX_PING = "tesser:ping", MUX_PONG = "tesser:pong", CODES = { open: 1, head: 2, data: 3, end: 4, reset: 5, credit: 6, text: 7, binary: 8, close: 9 }, TYPES = Object.fromEntries(Object.entries(CODES).map(([k, v]) => [v, k])), encoder = /* @__PURE__ */ new TextEncoder, decoder = new TextDecoder("utf-8", { fatal: !0, ignoreBOM: !1 });
+function frame(type, stream, payload) {
+  let out = new Uint8Array(5 + payload.byteLength);
+  return out[0] = CODES[type], new DataView(out.buffer).setUint32(1, stream), out.set(payload, 5), out;
+}
+function encodeFrame(f) {
+  switch (f.type) {
+    case "open":
+      return frame(f.type, f.stream, encoder.encode(JSON.stringify({ port: f.port, method: f.method, path: f.path, headers: f.headers, ws: f.ws })));
+    case "head":
+      return frame(f.type, f.stream, encoder.encode(JSON.stringify({ status: f.status, statusText: f.statusText, headers: f.headers })));
+    case "data":
+    case "binary":
+      return frame(f.type, f.stream, f.data);
+    case "end":
+      return frame(f.type, f.stream, new Uint8Array);
+    case "reset":
+      return frame(f.type, f.stream, encoder.encode(f.reason));
+    case "credit": {
+      let payload = new Uint8Array(4);
+      return new DataView(payload.buffer).setUint32(0, f.bytes), frame(f.type, f.stream, payload);
+    }
+    case "text":
+      return frame(f.type, f.stream, encoder.encode(f.text));
+    case "close":
+      return frame(f.type, f.stream, encoder.encode(JSON.stringify({ code: f.code, reason: f.reason })));
+  }
+}
+function json(payload, what) {
+  let value = JSON.parse(decoder.decode(payload));
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    throw Error(`mux ${what}: expected an object`);
+  return value;
+}
+function int(o, key, what, min, max) {
+  let v = o[key];
+  if (typeof v !== "number" || !Number.isInteger(v) || v < min || v > max)
+    throw Error(`mux ${what}.${key}: expected an integer in ${min}..${max}`);
+  return v;
+}
+function text(o, key, what) {
+  let v = o[key];
+  if (typeof v !== "string")
+    throw Error(`mux ${what}.${key}: expected a string`);
+  return v;
+}
+function headers(o, what) {
+  let v = o.headers;
+  if (!Array.isArray(v) || !v.every((h) => Array.isArray(h) && h.length === 2 && typeof h[0] === "string" && typeof h[1] === "string"))
+    throw Error(`mux ${what}.headers: expected [name, value] pairs`);
+  return v;
+}
+function decodeFrame(buf) {
+  if (buf.byteLength < 5)
+    throw Error("mux frame: shorter than its header");
+  let type = TYPES[buf[0]];
+  if (type === void 0)
+    throw Error(`mux frame: unknown type ${buf[0]}`);
+  let stream = new DataView(buf.buffer, buf.byteOffset, buf.byteLength).getUint32(1), payload = buf.subarray(5);
+  switch (type) {
+    case "open": {
+      let o = json(payload, type);
+      if (typeof o.ws !== "boolean")
+        throw Error("mux open.ws: expected a boolean");
+      let path = text(o, "path", type);
+      if (!path.startsWith("/"))
+        throw Error("mux open.path: must start with /");
+      return { type, stream, port: int(o, "port", type, 1, 65535), method: text(o, "method", type), path, headers: headers(o, type), ws: o.ws };
+    }
+    case "head": {
+      let o = json(payload, type);
+      return { type, stream, status: int(o, "status", type, 100, 599), statusText: text(o, "statusText", type), headers: headers(o, type) };
+    }
+    case "data":
+    case "binary":
+      return { type, stream, data: payload };
+    case "end":
+      return { type, stream };
+    case "reset":
+      return { type, stream, reason: decoder.decode(payload) };
+    case "credit":
+      if (payload.byteLength !== 4)
+        throw Error("mux credit: expected 4 bytes");
+      return { type, stream, bytes: new DataView(payload.buffer, payload.byteOffset, 4).getUint32(0) };
+    case "text":
+      return { type, stream, text: decoder.decode(payload) };
+    case "close": {
+      let o = json(payload, type);
+      return { type, stream, code: int(o, "code", type, 1000, 4999), reason: text(o, "reason", type) };
+    }
+  }
+}
+
+// src/cloudflare.ts
+import { Effect as Effect4, Schema as Schema3 } from "effect";
+
+// src/jwt.ts
+import { Clock, Effect, Option } from "effect";
+var KEYS_TTL_MS = 600000, REFETCH_MIN_MS = 30000, CLOCK_SKEW_S = 60, keySets = /* @__PURE__ */ new Map;
+function base64url(text) {
+  let b64 = text.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(text.length / 4) * 4, "=");
+  return Uint8Array.from(atob(b64), (c) => c.charCodeAt(0));
+}
+function json2(part) {
+  try {
+    let value = JSON.parse((/* @__PURE__ */ new TextDecoder()).decode(base64url(part)));
+    return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
+  } catch {
+    return null;
+  }
+}
+var fetchKeys = (jwksUri, now) => Effect.tryPromise(async () => {
+  let res = await fetch(jwksUri);
+  if (!res.ok)
+    throw Error(`${jwksUri} answered ${res.status}`);
+  let body = await res.json(), keys = /* @__PURE__ */ new Map;
+  for (let jwk of body.keys ?? []) {
+    if (typeof jwk.kid !== "string" || jwk.kty !== "RSA")
+      continue;
+    keys.set(jwk.kid, await crypto.subtle.importKey("jwk", jwk, { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" }, !1, ["verify"]));
+  }
+  let set = { keys, fetchedAt: now };
+  return keySets.set(jwksUri, set), set;
+}).pipe(Effect.option), keyFor = Effect.fn("Jwt.keyFor")(function* (jwksUri, kid, now) {
+  let set = keySets.get(jwksUri);
+  if (set === void 0 || now - set.fetchedAt > KEYS_TTL_MS)
+    set = Option.getOrElse(yield* fetchKeys(jwksUri, now), () => set);
+  if (set !== void 0 && !set.keys.has(kid) && now - set.fetchedAt > REFETCH_MIN_MS)
+    set = Option.getOrElse(yield* fetchKeys(jwksUri, now), () => set);
+  return set?.keys.get(kid) ?? null;
+}), verifyRs256 = Effect.fn("Jwt.verifyRs256")(function* (token, issuer, jwksUri) {
+  let parts = token.split(".");
+  if (parts.length !== 3)
+    return null;
+  let [h, p, s] = parts, header = json2(h), claims = json2(p);
+  if (header === null || claims === null || header.alg !== "RS256" || typeof header.kid !== "string" || claims.iss !== issuer)
+    return null;
+  let nowMs = yield* Clock.currentTimeMillis, key = yield* keyFor(jwksUri, header.kid, nowMs);
+  if (key === null)
+    return null;
+  let signature = base64url(s);
+  if (!(yield* Effect.tryPromise(() => crypto.subtle.verify("RSASSA-PKCS1-v1_5", key, signature, (/* @__PURE__ */ new TextEncoder()).encode(`${h}.${p}`))).pipe(Effect.orElseSucceed(() => !1))))
+    return null;
+  let now = Math.floor(nowMs / 1000);
+  if (typeof claims.exp !== "number" || claims.exp + CLOCK_SKEW_S < now)
+    return null;
+  if (typeof claims.nbf === "number" && claims.nbf - CLOCK_SKEW_S > now)
+    return null;
+  return claims;
+});
+function audienceIncludes(aud, expected) {
+  return aud === expected || Array.isArray(aud) && aud.includes(expected);
+}
+
+// src/relay.ts
+import { DurableObject } from "cloudflare:workers";
+import { Clock as Clock3, Duration as Duration2, Effect as Effect3, Layer, Schema as Schema2 } from "effect";
+
+// ../front/src/csp.ts
+var SCRIPT_DIRECTIVES = ["connect-src", "script-src"];
+function directiveIndex(directives, name) {
+  return directives.findIndex((directive) => {
+    let lower = directive.toLowerCase();
+    return lower === name || lower.startsWith(`${name} `);
+  });
+}
+function allowSelfScripts(policy) {
+  return policy.split(",").map((single) => {
+    let directives = single.split(";").map((directive) => directive.trim()).filter(Boolean), fallback = directives[directiveIndex(directives, "default-src")];
+    for (let name of SCRIPT_DIRECTIVES) {
+      let index = directiveIndex(directives, name), current = index === -1 ? fallback?.replace(/^default-src/i, name) : directives[index];
+      if (!current)
+        continue;
+      let values = current.split(/\s+/).slice(1);
+      if (values.some((value) => value === "'self'" || value === "*"))
+        continue;
+      let next = [name, ...values.filter((value) => value !== "'none'"), "'self'"].join(" ");
+      if (index === -1)
+        directives.push(next);
+      else
+        directives[index] = next;
+    }
+    return directives.join("; ");
+  }).join(", ");
+}
+function scriptNonce(policy) {
+  for (let single of policy.split(",")) {
+    let directives = single.split(";").map((directive) => directive.trim()), nonce = (directives[directiveIndex(directives, "script-src")] ?? directives[directiveIndex(directives, "default-src")])?.match(/'nonce-([^']+)'/)?.[1];
+    if (nonce)
+      return nonce;
+  }
+  return;
+}
+
+// ../front/src/http.ts
+var HOP_BY_HOP = [
+  "connection",
+  "keep-alive",
+  "proxy-authenticate",
+  "proxy-authorization",
+  "proxy-connection",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade"
+];
+function withoutHopByHop(source) {
+  let headers = new Headers(source), connectionHeaders = headers.get("connection")?.split(",").map((name) => name.trim()).filter(Boolean) ?? [];
+  for (let name of [...HOP_BY_HOP, ...connectionHeaders])
+    headers.delete(name);
+  return headers;
+}
+function wantsDocument(request) {
+  return request.method === "GET" && (request.headers.get("sec-fetch-mode") === "navigate" || request.headers.get("accept")?.toLowerCase().includes("text/html") === !0);
+}
+
+// ../front/src/shim.ts
+function rewriteUrl(input, ws, ctx) {
+  let url;
+  try {
+    url = new URL(input, ctx.href);
+  } catch {
+    return input;
+  }
+  if (!["http:", "https:", "ws:", "wss:"].includes(url.protocol))
+    return input;
+  let page = new URL(ctx.href);
+  if (url.host === page.host)
+    return input;
+  let name = url.hostname, loopback = name === "localhost" || name === "127.0.0.1" || name === "[::1]" || name === "0.0.0.0", sub = name.endsWith(".localhost") ? name.slice(0, -10) : null;
+  if (!loopback && sub === null && name !== page.hostname)
+    return input;
+  let port = Number(url.port || (url.protocol === "https:" || url.protocol === "wss:" ? 443 : 80));
+  if (!ctx.ports.includes(port))
+    return input;
+  return url.pathname = `${sub !== null ? `/__tesser/${sub}.${port}` : port === ctx.port ? "" : `/__tesser/${port}`}${url.pathname}`, url.protocol = ws ? page.protocol === "https:" ? "wss:" : "ws:" : page.protocol, url.port = "", url.host = name === page.hostname || sub !== null ? page.host : ctx.host, url.href;
+}
+function rewriteSrcset(value, to) {
+  let changed = !1, candidates = value.split(",").map((candidate) => {
+    let [url = "", ...descriptors] = candidate.trim().split(/\s+/), rewritten = to(url);
+    if (rewritten !== url)
+      changed = !0;
+    return [rewritten, ...descriptors].join(" ");
+  });
+  return changed ? candidates.join(", ") : value;
+}
+function shimSource() {
+  return `(() => {
+  if (window.__tesserShim) return;
+  window.__tesserShim = true;
+  const script = document.currentScript;
+  const params = new URL(script.src).searchParams;
+  script.remove();
+  const host = params.get("host");
+  const ports = (params.get("ports") || "").split(",").filter(Boolean).map(Number);
+  const port = Number(params.get("port"));
+  const rewriteUrl = ${rewriteUrl.toString()};
+  const to = (input, ws) => rewriteUrl(String(input), ws, { href: location.href, host, ports, port });
+  const rewriteSrcset = ${rewriteSrcset.toString()};
+  const fetch = window.fetch;
+  window.fetch = function (input, init) {
+    if (!(input instanceof Request)) return fetch.call(this, to(input, false), init);
+    const url = to(input.url, false);
+    if (url === input.url) return fetch.call(this, input, init);
+    const { method, headers, credentials, cache, redirect, referrer, referrerPolicy, integrity, keepalive, signal } = input;
+    const rebuilt = { method, headers, credentials, cache, redirect, referrer, referrerPolicy, integrity, keepalive, signal };
+    if (method === "GET" || method === "HEAD") return fetch.call(this, new Request(url, rebuilt), init);
+    return input.blob().then((body) => fetch.call(this, new Request(url, { ...rebuilt, body }), init));
+  };
+  const open = XMLHttpRequest.prototype.open;
+  XMLHttpRequest.prototype.open = function (method, url, ...rest) {
+    return open.call(this, method, to(url, false), ...rest);
+  };
+  const beacon = navigator.sendBeacon?.bind(navigator);
+  if (beacon) navigator.sendBeacon = (url, data) => beacon(to(url, false), data);
+  const wrap = (name, ws) => {
+    if (!window[name]) return;
+    window[name] = new Proxy(window[name], {
+      construct(target, args, newTarget) {
+        args[0] = to(args[0], ws);
+        return Reflect.construct(target, args, newTarget);
+      },
+    });
+  };
+  wrap("WebSocket", true);
+  wrap("EventSource", false);
+  const loads = [
+    ["HTMLImageElement", ["src", "srcset"]],
+    ["HTMLSourceElement", ["src", "srcset"]],
+    ["HTMLScriptElement", ["src"]],
+    ["HTMLIFrameElement", ["src"]],
+    ["HTMLMediaElement", ["src"]],
+    ["HTMLVideoElement", ["poster"]],
+    ["HTMLEmbedElement", ["src"]],
+    ["HTMLTrackElement", ["src"]],
+    ["HTMLLinkElement", ["href"]],
+  ].filter(([name]) => window[name]);
+  const fix = (name, value) => name === "srcset" ? rewriteSrcset(String(value), (url) => to(url, false)) : to(value, false);
+  const loaded = (element, name) => loads.some(([type, names]) => element instanceof window[type] && names.includes(name));
+  const setAttribute = Element.prototype.setAttribute;
+  Element.prototype.setAttribute = function (name, value) {
+    const lower = String(name).toLowerCase();
+    return setAttribute.call(this, name, loaded(this, lower) ? fix(lower, value) : value);
+  };
+  for (const [type, names] of loads) {
+    for (const name of names) {
+      const proto = window[type].prototype;
+      const descriptor = Object.getOwnPropertyDescriptor(proto, name);
+      if (!descriptor?.set) continue;
+      Object.defineProperty(proto, name, { ...descriptor, set(value) { descriptor.set.call(this, fix(name, value)); } });
+    }
+  }
+  const selector = "img, source, script, iframe, video, audio, embed, track, link";
+  const sweep = (element) => {
+    for (const name of ["src", "srcset", "poster", "href"]) {
+      const value = element.getAttribute(name);
+      if (value !== null && loaded(element, name)) {
+        const rewritten = fix(name, value);
+        if (rewritten !== value) setAttribute.call(element, name, rewritten);
+      }
+    }
+  };
+  new MutationObserver((records) => {
+    for (const record of records) {
+      for (const node of record.addedNodes) {
+        if (!(node instanceof Element)) continue;
+        if (node.matches(selector)) sweep(node);
+        for (const element of node.querySelectorAll(selector)) sweep(element);
+      }
+    }
+  }).observe(document, { childList: true, subtree: true });
+  const follow = (element, attribute) => {
+    const value = element?.getAttribute(attribute);
+    if (!value) return;
+    const rewritten = to(value, false);
+    if (rewritten !== value) element.setAttribute(attribute, rewritten);
+  };
+  const click = (event) => follow(event.target instanceof Element ? event.target.closest("a[href], area[href]") : null, "href");
+  document.addEventListener("click", click, true);
+  document.addEventListener("auxclick", click, true);
+  document.addEventListener("submit", (event) => {
+    follow(event.target, "action");
+    follow(event.submitter, "formaction");
+  }, true);
+})();
+`;
+}
+function shimTag(params, nonce) {
+  let query = new URLSearchParams({ host: params.host, ports: params.ports.join(","), port: String(params.port) });
+  return `<script${nonce ? ` nonce="${nonce}"` : ""} src="/__tesser/shim.js?${query.toString().replace(/&/g, "&amp;")}"></script>`;
+}
+
+// src/core.ts
+import { Clock as Clock2, Context, Duration, Effect as Effect2, Schedule, Schema } from "effect";
+
+// src/route.ts
+var PORT_PATH = /^\/__tesser\/(?:([a-z0-9-]+(?:\.[a-z0-9-]+)*)\.)?(\d{1,5})(\/.*)?$/;
+function parseTarget(gatewayHost, url) {
+  let bare = url.hostname.toLowerCase().replace(/\.$/, ""), suffix = `.${gatewayHost.toLowerCase()}`;
+  if (!bare.endsWith(suffix))
+    return null;
+  let labels = bare.slice(0, -suffix.length).split("."), label = labels[labels.length - 1], parsed = parseGatewayLabel(label);
+  if (parsed === null)
+    return null;
+  let gateway = `${gatewayHost}${url.port ? `:${url.port}` : ""}`, sub = labels.slice(0, -1).join("."), base = { boxId: parsed.boxId, sub, pageSub: sub, boxHost: `${label}.${gateway}`, gateway, root: parsed.port }, match = PORT_PATH.exec(url.pathname);
+  if (match === null)
+    return { ...base, port: null, path: `${url.pathname}${url.search}` };
+  return { ...base, sub: match[1] ?? base.sub, port: Number(match[2]), path: `${match[3] ?? "/"}${url.search}` };
+}
+function parseUrl(raw, base) {
+  try {
+    return new URL(raw, base);
+  } catch {
+    return null;
+  }
+}
+function presentedHost(sub, port) {
+  return `${sub === "" ? "localhost" : `${sub}.localhost`}:${port}`;
+}
+function portOrigin(protocol, target, port, first) {
+  return `${protocol}//${target.sub === "" ? "" : `${target.sub}.`}${gatewayLabel(target.boxId, port === first ? null : port)}.${target.gateway}`;
+}
+
+// src/core.ts
+class BoxNotShared extends Schema.TaggedError()("BoxNotShared", { boxId: Schema.String }) {
+}
+
+class DirectoryUnavailable extends Schema.TaggedError()("DirectoryUnavailable", { reason: Schema.String }) {
+}
+
+class WakeFailed extends Schema.TaggedError()("WakeFailed", { boxId: Schema.String, reason: Schema.String }) {
+}
+
+class UpstreamRefused extends Schema.TaggedError()("UpstreamRefused", { boxId: Schema.String, port: Schema.Number }) {
+}
+
+class BoxDirectory extends Context.Service()("@tesser/gateway/BoxDirectory") {
+}
+
+class Waker extends Context.Service()("@tesser/gateway/Waker") {
+}
+
+class Upstream extends Context.Service()("@tesser/gateway/Upstream") {
+}
+var VIEWER_COOKIE = "__Host-tesser-viewer", GATEWAY_COOKIES = /* @__PURE__ */ new Set(["CF_Authorization", VIEWER_COOKIE]), WAKING_WINDOW = Duration.minutes(5), startingRetry = { schedule: Schedule.spaced(Duration.seconds(1)), times: 60 }, respond = (response) => ({ _tag: "response", response });
+function page(request, state) {
+  let status = viewerStatus(state);
+  if (wantsDocument(request))
+    return respond(new Response(viewerPage(state), { status, headers: STATUS_HEADERS }));
+  return respond(new Response(`${viewerText(state)}
+`, { status, headers: { "content-type": "text/plain; charset=utf-8", "cache-control": "no-store", "x-tesser-status": "1" } }));
+}
+function viewerBox(box) {
+  return { name: box.name, sharedBy: box.sharedBy };
+}
+function upstreamHeaders(request, target, port, root) {
+  let headers = withoutHopByHop(request.headers);
+  for (let name of [...headers.keys()])
+    if (name.startsWith("cf-access-") || name.startsWith("x-forwarded-"))
+      headers.delete(name);
+  headers.delete("forwarded"), headers.delete("x-tesser-viewer"), headers.delete("x-tesser-ticket");
+  let cookie = headers.get("cookie")?.split(";").filter((c) => !GATEWAY_COOKIES.has(c.trim().split("=")[0])).join(";").trim();
+  if (cookie)
+    headers.set("cookie", cookie);
+  else
+    headers.delete("cookie");
+  headers.set("host", presentedHost(target.sub, port)), headers.set("x-forwarded-for", "127.0.0.1"), headers.set("x-forwarded-proto", "http"), headers.set("accept-encoding", "identity");
+  let origin = request.headers.get("origin");
+  if (origin !== null && parseUrl(origin)?.host === new URL(request.url).host)
+    headers.set("origin", `http://${presentedHost(target.pageSub, root)}`);
+  return headers;
+}
+function isHtmlDocument(request, response) {
+  if (!wantsDocument(request) || response.status < 200 || response.status >= 300)
+    return !1;
+  return (response.headers.get("content-type")?.toLowerCase() ?? "").includes("text/html") && !response.headers.has("content-range");
+}
+function downstream(request, response, upstreamUrl, ctx, shownOrigin) {
+  let headers = withoutHopByHop(response.headers);
+  headers.delete("content-encoding"), headers.delete("content-length");
+  let location = headers.get("location");
+  if (location !== null)
+    headers.set("location", rewriteUrl(parseUrl(location) === null ? new URL(location, upstreamUrl).href : location, !1, ctx));
+  let origin = request.headers.get("origin");
+  if (origin !== null && shownOrigin !== null && headers.get("access-control-allow-origin") === shownOrigin)
+    headers.set("access-control-allow-origin", origin);
+  let init = { status: response.status, statusText: response.statusText, headers };
+  if (!isHtmlDocument(request, response))
+    return new Response(response.body, init);
+  let csp = headers.get("content-security-policy");
+  if (csp !== null)
+    headers.set("content-security-policy", allowSelfScripts(csp));
+  let tag = shimTag({ host: ctx.host, ports: ctx.ports, port: ctx.port }, csp === null ? void 0 : scriptNonce(csp)), placed = !1, inject = {
+    element(element) {
+      if (placed)
+        return;
+      placed = !0, element.prepend(tag, { html: !0 });
+    }
+  }, link = (attribute, rewrite = (value) => rewriteUrl(value, !1, ctx)) => ({
+    element(element) {
+      let value = element.getAttribute(attribute);
+      if (value === null)
+        return;
+      let rewritten = rewrite(value);
+      if (rewritten !== value)
+        element.setAttribute(attribute, rewritten);
+    }
+  });
+  return new HTMLRewriter().on("head", inject).on("body", inject).on("a[href], area[href], link[href]", link("href")).on("form[action]", link("action")).on("button[formaction], input[formaction]", link("formaction")).on("script[src], img[src], iframe[src], source[src], video[src], audio[src], embed[src]", link("src")).on("img[srcset], source[srcset]", link("srcset", (value) => rewriteSrcset(value, (url) => rewriteUrl(url, !1, ctx)))).transform(new Response(response.body, init));
+}
+var wakingPage = Effect2.fn("Gateway.wakingPage")(function* (request, box, port, stage, since) {
+  let now = yield* Clock2.currentTimeMillis;
+  return page(request, { kind: "waking", box: viewerBox(box), stage, port, seconds: Math.max(0, Math.round((now - since) / 1000)) });
+}), refused = Effect2.fn("Gateway.refused")(function* (request, box, port) {
+  let status = yield* (yield* Waker).status(box.boxId), now = yield* Clock2.currentTimeMillis;
+  if (box.app === "exited")
+    return page(request, { kind: "stopped", box: viewerBox(box) });
+  if (status !== null && now - status.since < Duration.toMillis(WAKING_WINDOW))
+    return yield* wakingPage(request, box, port, box.app === "running" ? "port" : "app", status.since);
+  return page(request, { kind: "not-answering", box: viewerBox(box), port });
+}), serve = Effect2.fn("Gateway.serve")(function* (request, target, box, port, root) {
+  let headers = upstreamHeaders(request, target, port, root);
+  if (request.headers.get("upgrade")?.toLowerCase() === "websocket")
+    return { _tag: "websocket", box, port, path: target.path, headers };
+  let ctx = { href: request.url, host: target.boxHost, ports: box.ports, port: root }, upstreamUrl = `http://${headers.get("host")}${target.path}`, shownOrigin = headers.get("origin"), replayable = request.method === "GET" || request.method === "HEAD", document = wantsDocument(request), upstream = yield* Upstream, attempt = Effect2.suspend(() => upstream.fetch(box, port, new Request(upstreamUrl, {
+    method: request.method,
+    headers,
+    body: replayable ? void 0 : request.body,
+    redirect: "manual",
+    signal: request.signal,
+    ...replayable ? {} : { duplex: "half" }
+  })));
+  return yield* (document || !replayable ? attempt : attempt.pipe(Effect2.retry(startingRetry))).pipe(Effect2.map((response) => respond(downstream(request, response, upstreamUrl, ctx, shownOrigin))), Effect2.catchTag("UpstreamRefused", () => document ? refused(request, box, port) : Effect2.succeed(page(request, { kind: "not-answering", box: viewerBox(box), port }))));
+}), handle = Effect2.fn("Gateway.handle")(function* (request) {
+  let directory = yield* BoxDirectory, waker = yield* Waker, url = new URL(request.url), host = yield* directory.host, target = parseTarget(host, url);
+  if (target === null)
+    return page(request, { kind: "not-shared" });
+  if (target.port === null && url.pathname === "/__tesser/shim.js")
+    return respond(new Response(shimSource(), { headers: { "content-type": "text/javascript; charset=utf-8", "cache-control": "public, max-age=300" } }));
+  let box = yield* directory.lookup(target.boxId), first = box.ports[0];
+  if (first === void 0)
+    return page(request, { kind: "no-port", box: viewerBox(box), port: target.port ?? target.root ?? 0, ports: [] });
+  let root = target.root ?? first, port = target.port ?? root;
+  if (!box.ports.includes(root) || !box.ports.includes(port)) {
+    let ports = box.ports.map((p) => ({ port: p, href: `${portOrigin(url.protocol, target, p, first)}/` }));
+    return page(request, { kind: "no-port", box: viewerBox(box), port: box.ports.includes(root) ? port : root, ports });
+  }
+  if (target.port !== null && request.headers.get("sec-fetch-mode") === "navigate")
+    return respond(new Response(null, { status: 307, headers: { location: `${portOrigin(url.protocol, target, port, first)}${target.path}`, "cache-control": "no-store" } }));
+  if (box.power !== "awake") {
+    let navigate = request.headers.get("sec-fetch-mode") === "navigate";
+    if (box.power === "asleep")
+      yield* waker.wake(box.boxId, navigate);
+    let status = yield* waker.status(box.boxId);
+    if (status?.failure && box.power === "asleep")
+      return page(request, { kind: "wake-failed", box: viewerBox(box), reason: status.failure });
+    if (wantsDocument(request)) {
+      if (box.power === "launching" && status === null)
+        return page(request, { kind: "booting", box: viewerBox(box) });
+      return yield* wakingPage(request, box, port, "machine", status?.since ?? (yield* Clock2.currentTimeMillis));
+    }
+    return yield* serve(request, target, yield* waker.awake(box.boxId), port, root);
+  }
+  return yield* serve(request, target, box, port, root);
+}, (effect, request) => effect.pipe(Effect2.catchTags({
+  BoxNotShared: () => Effect2.succeed(page(request, { kind: "not-shared" })),
+  DirectoryUnavailable: () => Effect2.succeed(page(request, { kind: "unavailable" })),
+  WakeFailed: (e) => Effect2.succeed(page(request, { kind: "wake-failed", box: { name: e.boxId, sharedBy: null }, reason: e.reason }))
+})));
+
+// src/tunnel.ts
+var UPGRADE_TIMEOUT_MS = 30000, NULL_BODY = /* @__PURE__ */ new Set([101, 204, 205, 304]);
+
+class StreamRefused extends Error {
+}
+
+class Tunnel {
+  socket;
+  inUse;
+  streams = /* @__PURE__ */ new Map;
+  constructor(socket, inUse) {
+    this.socket = socket;
+    this.inUse = inUse;
+  }
+  send(frame) {
+    let ws = this.socket();
+    if (ws === null)
+      return !1;
+    try {
+      return ws.send(encodeFrame(frame)), !0;
+    } catch {
+      return !1;
+    }
+  }
+  newStream() {
+    for (;; ) {
+      let id = crypto.getRandomValues(new Uint32Array(1))[0];
+      if (id !== 0 && !this.streams.has(id) && !this.inUse(id))
+        return id;
+    }
+  }
+  async fetch(port, request) {
+    let url = new URL(request.url), stream = this.newStream(), s = { kind: "http", head: null, controller: null, buffered: [], owed: 0, window: MUX_WINDOW, onCredit: null, closed: !1 }, head = new Promise((resolve, reject) => s.head = { resolve, reject });
+    this.streams.set(stream, s);
+    let headers = [...request.headers];
+    if (!this.send({ type: "open", stream, port, method: request.method, path: `${url.pathname}${url.search}`, headers, ws: !1 }))
+      throw this.streams.delete(stream), new StreamRefused("the box is not connected");
+    request.signal.addEventListener("abort", () => this.abort(stream, "the viewer went away")), this.pump(stream, s, request.body);
+    let h = await head;
+    if (NULL_BODY.has(h.status) || request.method === "HEAD")
+      return this.abort(stream, "no body expected"), new Response(null, { status: h.status, statusText: h.statusText, headers: h.headers });
+    let body = new ReadableStream({
+      start: (controller) => {
+        s.controller = controller;
+        for (let chunk of s.buffered.splice(0))
+          controller.enqueue(chunk);
+        if (s.closed)
+          controller.close();
+      },
+      pull: () => this.credit(stream, s),
+      cancel: () => this.abort(stream, "the viewer stopped reading")
+    }, { highWaterMark: MUX_WINDOW, size: (chunk) => chunk.byteLength });
+    return new Response(body, { status: h.status, statusText: h.statusText, headers: h.headers });
+  }
+  async upgrade(port, path, headers) {
+    let stream = this.newStream(), head = new Promise((resolve, reject) => this.streams.set(stream, { kind: "ws", resolve, reject }));
+    if (!this.send({ type: "open", stream, port, method: "GET", path, headers, ws: !0 }))
+      throw this.streams.delete(stream), new StreamRefused("the box is not connected");
+    let timeout = setTimeout(() => {
+      this.fail(stream, new StreamRefused("the app did not answer the websocket upgrade")), this.send({ type: "reset", stream, reason: "the upgrade timed out" });
+    }, UPGRADE_TIMEOUT_MS);
+    try {
+      return { stream, head: await head };
+    } finally {
+      clearTimeout(timeout);
+    }
+  }
+  async pump(stream, s, body) {
+    if (body === null) {
+      this.send({ type: "end", stream });
+      return;
+    }
+    let reader = body.getReader();
+    try {
+      for (;; ) {
+        let { done, value } = await reader.read();
+        if (done)
+          break;
+        for (let at = 0;at < value.byteLength; at += MUX_CHUNK) {
+          let piece = value.subarray(at, at + MUX_CHUNK);
+          while (s.window < piece.byteLength) {
+            if (this.streams.get(stream) !== s)
+              return;
+            await new Promise((resolve) => s.onCredit = resolve);
+          }
+          if (this.streams.get(stream) !== s)
+            return;
+          s.window -= piece.byteLength, this.send({ type: "data", stream, data: piece });
+        }
+      }
+      if (this.streams.get(stream) === s)
+        this.send({ type: "end", stream });
+    } catch {
+      this.abort(stream, "the viewer's request body failed");
+    }
+  }
+  credit(stream, s) {
+    if (s.owed === 0 || this.streams.get(stream) !== s)
+      return;
+    this.send({ type: "credit", stream, bytes: s.owed }), s.owed = 0;
+  }
+  abort(stream, reason) {
+    let s = this.streams.get(stream);
+    if (s === void 0)
+      return;
+    if (this.streams.delete(stream), s.kind === "http")
+      s.onCredit?.(), s.head?.reject(new StreamRefused(reason));
+    this.send({ type: "reset", stream, reason });
+  }
+  fail(stream, err) {
+    let s = this.streams.get(stream);
+    if (s === void 0)
+      return;
+    if (this.streams.delete(stream), s.kind === "ws")
+      return s.reject(err);
+    if (s.onCredit?.(), s.head !== null)
+      return s.head.reject(err);
+    try {
+      s.controller?.error(err);
+    } catch {}
+  }
+  onFrame(frame) {
+    let s = this.streams.get(frame.stream);
+    if (s === void 0)
+      return !1;
+    if (s.kind === "ws") {
+      if (frame.type === "head")
+        this.streams.delete(frame.stream), s.resolve(frame);
+      else if (frame.type === "reset")
+        this.streams.delete(frame.stream), s.reject(new StreamRefused(frame.reason));
+      return !0;
+    }
+    switch (frame.type) {
+      case "head":
+        return s.head?.resolve(frame), s.head = null, !0;
+      case "data":
+        if (s.controller === null)
+          return s.buffered.push(frame.data), s.owed += frame.data.byteLength, !0;
+        try {
+          s.controller.enqueue(frame.data);
+        } catch {
+          return !0;
+        }
+        if (s.owed += frame.data.byteLength, (s.controller.desiredSize ?? 0) > 0)
+          this.credit(frame.stream, s);
+        return !0;
+      case "end":
+        this.streams.delete(frame.stream), s.closed = !0;
+        try {
+          s.controller?.close();
+        } catch {}
+        return !0;
+      case "reset":
+        return this.fail(frame.stream, new StreamRefused(frame.reason)), !0;
+      case "credit":
+        return s.window += frame.bytes, s.onCredit?.(), s.onCredit = null, !0;
+      default:
+        return !0;
+    }
+  }
+  closeAll(reason) {
+    for (let stream of [...this.streams.keys()])
+      this.fail(stream, new StreamRefused(reason));
+  }
+}
+
+// src/relay.ts
+var TICKET_HEADER = "x-tesser-ticket", WAKE_TIMEOUT = Duration2.minutes(5), WAKE_RETRY_MS = 30000, DIAL_GRACE = Duration2.seconds(30), RECHECK_MS = 60000, STALE_MS = 300000, RETRYABLE = /* @__PURE__ */ new Set([0, 408, 409, 429]), Ticket = Schema2.Struct({
+  org: Schema2.String,
+  box: Schema2.String,
+  name: Schema2.String,
+  sharedBy: Schema2.NullOr(Schema2.String),
+  ports: Schema2.Array(Schema2.Number),
+  exp: Schema2.Number
+}), BoxResponse = Schema2.Struct({
+  box: Schema2.Struct({
+    boxId: Schema2.String,
+    name: Schema2.String,
+    sharedBy: Schema2.NullOr(Schema2.String),
+    privateIp: Schema2.String,
+    ports: Schema2.Array(Schema2.Number),
+    power: Schema2.Literals(["launching", "awake", "asleep", "removing", "gone"]),
+    app: Schema2.NullOr(Schema2.Literals(["none", "running", "unsupervised", "exited"]))
+  })
+}), ErrorBody = Schema2.Struct({ error: Schema2.Struct({ message: Schema2.String }) });
+function plain(status, text) {
+  return new Response(`${text}
+`, { status, headers: { "content-type": "text/plain; charset=utf-8", "cache-control": "no-store" } });
+}
+
+class BoxRelay extends DurableObject {
+  tunnel = new Tunnel(() => this.boxSocket(), (stream) => this.ctx.getWebSockets(`v:${stream}`).length > 0);
+  waking = null;
+  connected = [];
+  verifiedAt = /* @__PURE__ */ new Map;
+  unstored = /* @__PURE__ */ new Map;
+  failingSince = /* @__PURE__ */ new Map;
+  constructor(ctx, env) {
+    super(ctx, env);
+    ctx.setWebSocketAutoResponse(new WebSocketRequestResponsePair(MUX_PING, MUX_PONG));
+  }
+  boxSocket() {
+    return this.ctx.getWebSockets("box").find((ws) => ws.deserializeAttachment()?.replaced !== !0) ?? null;
+  }
+  live() {
+    let ws = this.boxSocket();
+    if (ws === null)
+      return null;
+    let { ticket } = ws.deserializeAttachment();
+    if (ticket.exp * 1000 > Date.now())
+      return ticket;
+    return this.retire(ws, 4001, "share expired"), null;
+  }
+  retire(ws, code, reason) {
+    ws.serializeAttachment({ ...ws.deserializeAttachment(), replaced: !0 }), this.tunnel.closeAll(reason);
+    for (let viewer of this.ctx.getWebSockets("viewer"))
+      try {
+        viewer.close(1012, reason.slice(0, 120));
+      } catch {}
+    try {
+      ws.close(code, reason);
+    } catch {}
+  }
+  async fetch(request) {
+    let ticket = request.headers.get(TICKET_HEADER);
+    if (ticket !== null) {
+      let decoded = Schema2.decodeUnknownOption(Ticket)(JSON.parse(ticket));
+      if (decoded._tag === "None" || !this.admits(decoded.value))
+        return plain(403, "this box answers for another org here");
+      return this.acceptBox(decoded.value);
+    }
+    let handled = await Effect3.runPromise(handle(request).pipe(Effect3.provide(this.layer(this.viewer(request)))));
+    if (handled._tag === "response")
+      return handled.response;
+    return this.bridge(request, handled);
+  }
+  acceptBox(ticket) {
+    let previous = this.boxSocket();
+    if (previous !== null)
+      this.retire(previous, 4000, "replaced by a newer connection");
+    let [client, server] = Object.values(new WebSocketPair);
+    this.ctx.acceptWebSocket(server, ["box"]), server.serializeAttachment({ ticket }), this.waking = null, this.verifiedAt.clear(), this.failingSince.clear();
+    for (let resolve of this.connected.splice(0))
+      resolve();
+    return this.ctx.waitUntil(this.armAlarm(ticket)), new Response(null, { status: 101, webSocket: client });
+  }
+  socketViewer(ws) {
+    let { stream, viewer } = ws.deserializeAttachment();
+    return { stream, viewer: viewer ?? this.unstored.get(stream) ?? null };
+  }
+  viewers() {
+    return new Set(this.ctx.getWebSockets("viewer").flatMap((ws) => this.socketViewer(ws).viewer ?? []));
+  }
+  async armAlarm(ticket) {
+    let want = this.viewers().size > 0 ? Math.min(ticket.exp * 1000, Date.now() + RECHECK_MS) : ticket.exp * 1000, pending = await this.ctx.storage.getAlarm();
+    if (pending === null || pending <= Date.now() || want < pending)
+      await this.ctx.storage.setAlarm(want);
+  }
+  closeViewer(viewer, reason) {
+    for (let ws of this.ctx.getWebSockets("viewer")) {
+      let { stream, viewer: who } = this.socketViewer(ws);
+      if (who !== viewer)
+        continue;
+      this.tunnel.send({ type: "close", stream, code: 1008, reason });
+      try {
+        ws.close(1008, reason);
+      } catch {}
+    }
+  }
+  verdict(viewer, answer, now, open) {
+    if (answer?.status === 200) {
+      for (let [key, at] of this.verifiedAt)
+        if (now - at > STALE_MS)
+          this.verifiedAt.delete(key);
+      return this.verifiedAt.set(viewer, now), this.failingSince.delete(viewer), "ok";
+    }
+    if (answer?.status === 404 || answer?.status === 403)
+      this.verifiedAt.delete(viewer), this.failingSince.delete(viewer);
+    let box = this.boxSocket();
+    if (answer?.status === 404) {
+      if (box !== null)
+        this.retire(box, 4003, "share revoked");
+      return "revoked";
+    }
+    if (answer?.status === 403)
+      return this.closeViewer(viewer, "access ended"), "refused";
+    let verified = this.verifiedAt.get(viewer);
+    if (open && verified === void 0 && !this.failingSince.has(viewer))
+      this.failingSince.set(viewer, now);
+    let since = verified ?? (open ? this.failingSince.get(viewer) : 0);
+    if (now - since > STALE_MS) {
+      if (open)
+        this.closeViewer(viewer, "tesser can't confirm access right now");
+      return "stale";
+    }
+    return "unknown";
+  }
+  async alarm() {
+    let ws = this.boxSocket();
+    if (ws === null)
+      return;
+    let { ticket } = ws.deserializeAttachment();
+    if (ticket.exp * 1000 <= Date.now()) {
+      this.retire(ws, 4001, "share expired");
+      return;
+    }
+    for (let viewer of this.viewers()) {
+      let answer = await this.lookupBox(ticket.box, viewer).catch(() => null);
+      if (this.verdict(viewer, answer, Date.now(), !0) === "revoked")
+        return;
+    }
+    await this.armAlarm(ticket);
+  }
+  async bridge(request, target) {
+    let headers = [...target.headers].filter(([name]) => !/^sec-websocket-(key|version|extensions)$/i.test(name)), upgraded;
+    try {
+      upgraded = await this.tunnel.upgrade(target.port, target.path, headers);
+    } catch (err) {
+      return plain(502, `${target.box.name} refused the websocket: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (upgraded.head.status !== 101)
+      return plain(502, `${target.box.name} answered ${upgraded.head.status} to the websocket`);
+    let [client, server] = Object.values(new WebSocketPair);
+    this.ctx.acceptWebSocket(server, ["viewer", `v:${upgraded.stream}`]);
+    let viewer = this.viewer(request);
+    try {
+      server.serializeAttachment({ stream: upgraded.stream, viewer });
+    } catch {
+      if (server.serializeAttachment({ stream: upgraded.stream, viewer: null }), viewer !== null)
+        this.unstored.set(upgraded.stream, viewer);
+    }
+    let ticket = this.live();
+    if (ticket !== null)
+      await this.armAlarm(ticket);
+    let protocol = upgraded.head.headers.find(([name]) => name.toLowerCase() === "sec-websocket-protocol")?.[1];
+    return new Response(null, { status: 101, webSocket: client, headers: protocol === void 0 ? {} : { "sec-websocket-protocol": protocol } });
+  }
+  webSocketMessage(ws, message) {
+    if (this.ctx.getTags(ws).includes("box")) {
+      if (typeof message === "string")
+        return;
+      let frame;
+      try {
+        frame = decodeFrame(new Uint8Array(message));
+      } catch {
+        return;
+      }
+      if (this.tunnel.onFrame(frame))
+        return;
+      let viewer = this.ctx.getWebSockets(`v:${frame.stream}`)[0];
+      if (viewer === void 0) {
+        if (frame.type === "text" || frame.type === "binary")
+          this.tunnel.send({ type: "close", stream: frame.stream, code: 1001, reason: "the viewer went away" });
+        return;
+      }
+      try {
+        if (frame.type === "text")
+          viewer.send(frame.text);
+        else if (frame.type === "binary")
+          viewer.send(frame.data);
+        else if (frame.type === "close")
+          viewer.close(frame.code, frame.reason);
+        else if (frame.type === "reset")
+          viewer.close(1011, frame.reason.slice(0, 120));
+      } catch {}
+      return;
+    }
+    let { stream } = ws.deserializeAttachment();
+    this.tunnel.send(typeof message === "string" ? { type: "text", stream, text: message } : { type: "binary", stream, data: new Uint8Array(message) });
+  }
+  webSocketClose(ws, code, reason) {
+    if (this.ctx.getTags(ws).includes("box")) {
+      if (ws.deserializeAttachment().replaced === !0)
+        return;
+      this.retire(ws, 1000, "box hung up");
+      return;
+    }
+    let { stream } = ws.deserializeAttachment();
+    this.unstored.delete(stream);
+    let sendable = code === 1005 ? 1000 : code === 1004 || code === 1006 || code === 1015 || code < 1000 || code > 4999 ? 1001 : code;
+    this.tunnel.send({ type: "close", stream, code: sendable, reason: reason.slice(0, 120) });
+  }
+  webSocketError(ws) {
+    this.webSocketClose(ws, 1006, "socket error");
+  }
+  ask(call) {
+    return Effect3.tryPromise({ try: call, catch: (err) => new DirectoryUnavailable({ reason: err instanceof Error ? err.message : String(err) }) });
+  }
+  layer(viewer) {
+    let self = this, remote = Effect3.fn("Relay.remote")(function* (boxId) {
+      let { status, body } = yield* self.ask(() => self.lookupBox(boxId, viewer));
+      if (status === 403 || status === 404)
+        return yield* new BoxNotShared({ boxId });
+      if (status !== 200) {
+        let message = Schema2.decodeUnknownOption(ErrorBody)(body);
+        return yield* new DirectoryUnavailable({ reason: message._tag === "Some" ? message.value.error.message : `tesser answered ${status}` });
+      }
+      return (yield* Schema2.decodeUnknownEffect(BoxResponse)(body).pipe(Effect3.mapError(() => new DirectoryUnavailable({ reason: "tesser answered with a box this gateway can't read" })))).box;
+    }), lookup = Effect3.fn("Relay.lookup")(function* (boxId) {
+      let ticket = self.live();
+      if (ticket === null) {
+        let box = yield* remote(boxId);
+        return { ...box, power: box.power === "awake" ? "launching" : box.power };
+      }
+      let now = yield* Clock3.currentTimeMillis;
+      if (viewer !== null && now - (self.verifiedAt.get(viewer) ?? 0) > RECHECK_MS) {
+        let answer = yield* self.ask(() => self.lookupBox(boxId, viewer)).pipe(Effect3.orElseSucceed(() => null)), verdict = self.verdict(viewer, answer, now, !1);
+        if (verdict === "revoked" || verdict === "refused")
+          return yield* new BoxNotShared({ boxId });
+        if (verdict === "stale")
+          return yield* new DirectoryUnavailable({ reason: "tesser didn't answer whether you can still open this box" });
+      }
+      return { boxId, name: ticket.name, sharedBy: ticket.sharedBy, privateIp: "", ports: ticket.ports, power: "awake", app: "running" };
+    }), wake = Effect3.fn("Relay.wake")(function* (boxId, retry) {
+      let now = yield* Clock3.currentTimeMillis, current = self.waking;
+      if (current?.inflight)
+        return;
+      if (current?.failure && !retry)
+        return;
+      if (current !== null && current.failure === null && now - current.kickedAt < WAKE_RETRY_MS)
+        return;
+      let waking = { since: current === null || current.failure !== null || now - current.since > Duration2.toMillis(WAKE_TIMEOUT) ? now : current.since, kickedAt: now, failure: null, inflight: !0 };
+      self.waking = waking;
+      let kicked = yield* self.ask(() => self.wakeBox(boxId, viewer)).pipe(Effect3.result, Effect3.ensuring(Effect3.sync(() => waking.inflight = !1)));
+      if (kicked._tag === "Failure")
+        return;
+      let { status, body } = kicked.success;
+      if (status < 300 || status >= 500 || RETRYABLE.has(status))
+        return;
+      let message = Schema2.decodeUnknownOption(ErrorBody)(body);
+      waking.failure = message._tag === "Some" ? message.value.error.message : `tesser answered ${status}`;
+    }), status = Effect3.fn("Relay.status")(function* (_boxId) {
+      let now = yield* Clock3.currentTimeMillis, w = self.waking;
+      if (w === null || w.failure === null && now - w.since > Duration2.toMillis(WAKE_TIMEOUT))
+        return null;
+      return { since: w.since, failure: w.failure };
+    }), dialed = (boxId, within, reason) => Effect3.promise(() => new Promise((resolve) => self.connected.push(resolve))).pipe(Effect3.timeoutOrElse({ duration: within, orElse: () => Effect3.fail(new WakeFailed({ boxId, reason })) })), awake = Effect3.fn("Relay.awake")(function* (boxId) {
+      if (self.live() === null)
+        if ((yield* remote(boxId)).power === "awake")
+          yield* dialed(boxId, DIAL_GRACE, "the box is up but hasn't connected to this gateway; its boxd may need an update");
+        else {
+          yield* wake(boxId, !1);
+          let failure = self.waking?.failure;
+          if (failure)
+            return yield* new WakeFailed({ boxId, reason: failure });
+          yield* dialed(boxId, WAKE_TIMEOUT, "it didn't wake up within 5 minutes");
+        }
+      return yield* lookup(boxId);
+    }), upstream = (box, port, request) => Effect3.tryPromise({ try: () => self.tunnel.fetch(port, request), catch: () => new UpstreamRefused({ boxId: box.boxId, port }) });
+    return Layer.mergeAll(Layer.succeed(BoxDirectory)({ host: Effect3.succeed(self.host()), lookup }), Layer.succeed(Waker)({ wake, status, awake }), Layer.succeed(Upstream)({ fetch: upstream }));
+  }
+}
+
+// src/cloudflare.ts
+var ACCESS_HEADER = "cf-access-jwt-assertion", verifyTicket = Effect4.fn("Gateway.verifyTicket")(function* (env, request) {
+  let token = request.headers.get("authorization")?.match(/^Bearer (\S+)$/)?.[1];
+  if (token === void 0)
+    return null;
+  let issuer = env.TESSER_URL.replace(/\/$/, ""), claims = yield* verifyRs256(token, issuer, `${issuer}/.well-known/jwks.json`);
+  if (claims === null || !audienceIncludes(claims.aud, `https://${env.GATEWAY_HOST}`) || claims.org !== env.TESSER_ORG)
+    return null;
+  if (claims.sub !== `box:${env.TESSER_ORG}:${String(claims.box)}`)
+    return null;
+  return yield* Schema3.decodeUnknownEffect(Ticket)(claims).pipe(Effect4.option);
+}), verifyViewer = Effect4.fn("Gateway.verifyViewer")(function* (env, request) {
+  let token = request.headers.get(ACCESS_HEADER);
+  if (token === null)
+    return null;
+  let issuer = `https://${env.ACCESS_TEAM}`, claims = yield* verifyRs256(token, issuer, `${issuer}/cdn-cgi/access/certs`);
+  return claims !== null && audienceIncludes(claims.aud, env.ACCESS_AUD) ? claims : null;
+}), cloudflare_default = {
+  async fetch(request, env) {
+    let url = new URL(request.url), apex = url.hostname.toLowerCase() === env.GATEWAY_HOST.toLowerCase();
+    if (apex && url.pathname === GATEWAY_DIAL_PATH) {
+      if (request.headers.get("upgrade")?.toLowerCase() !== "websocket")
+        return plain(426, "boxes dial this with a websocket");
+      let ticket = await Effect4.runPromise(verifyTicket(env, request));
+      if (ticket === null || ticket._tag === "None")
+        return plain(401, "a box dials in with a share ticket signed by tesser");
+      let headers = new Headers(request.headers);
+      return headers.delete("authorization"), headers.set(TICKET_HEADER, JSON.stringify(ticket.value)), env.BOXES.get(env.BOXES.idFromName(ticket.value.box)).fetch(new Request(request, { headers }));
+    }
+    if (apex && url.pathname === "/__tesser/health")
+      return plain(200, "ok");
+    let boxId = gatewayHostBox(env.GATEWAY_HOST, url.hostname);
+    if (boxId === null)
+      return new Response(viewerPage({ kind: "not-shared" }), { status: 404, headers: STATUS_HEADERS });
+    if (await Effect4.runPromise(verifyViewer(env, request)) === null)
+      return plain(403, "this gateway only answers requests Cloudflare Access let through");
+    let headers = new Headers(request.headers);
+    return headers.delete(TICKET_HEADER), env.BOXES.get(env.BOXES.idFromName(boxId)).fetch(new Request(request, { headers }));
+  }
+};
+
+class GatewayBoxes extends BoxRelay {
+  host() {
+    return this.env.GATEWAY_HOST;
+  }
+  viewer(request) {
+    return request.headers.get(ACCESS_HEADER);
+  }
+  admits(ticket) {
+    return ticket.org === this.env.TESSER_ORG;
+  }
+  lookupBox(boxId, viewer) {
+    return this.tesser("GET", `/gateway/boxes/${boxId}`, viewer);
+  }
+  wakeBox(boxId, viewer) {
+    return this.tesser("POST", `/gateway/boxes/${boxId}/wake`, viewer);
+  }
+  async tesser(method, path, jwt) {
+    let res = await fetch(`${this.env.TESSER_URL.replace(/\/$/, "")}/v1/${this.env.TESSER_ORG}${path}`, { method, headers: jwt === null ? {} : { [ACCESS_HEADER]: jwt } }), body = await res.json().catch(() => null);
+    return { status: res.status, body };
+  }
+}
+export {
+  GatewayBoxes,
+  cloudflare_default as default
+};

package/package.json

@@ -1,6 +1,29 @@
 {
   "name": "@tesser-sh/gateway",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.53.2",
+  "description": "Tesser's share gateway as a Cloudflare Worker and Durable Object, deployed in your own account",
+  "license": "MIT",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./index.d.ts",
+      "default": "./index.js"
+    }
+  },
+  "files": [
+    "index.js",
+    "index.d.ts",
+    "LICENSE"
+  ],
+  "dependencies": {
+    "effect": "^4.0.5"
+  },
+  "peerDependencies": {
+    "@cloudflare/workers-types": ">=4"
+  },
+  "peerDependenciesMeta": {
+    "@cloudflare/workers-types": {
+      "optional": true
+    }
+  }
+}

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.