@tesser-sh/gateway 0.0.1 → 0.53.2

package/index.js

@@ -1,6 +1,3 @@
-// src/cloudflare.ts
-import { DurableObject } from "cloudflare:workers";
-
 // ../front/src/page.ts
 var FAVICON = `data:image/svg+xml,${encodeURIComponent('<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><rect width="24" height="24" rx="4" fill="#000000"/><g transform="translate(2.4 2.4) scale(0.8)"><path fill="#f0f1e9" d="M11.5 11.5H2A9.5 9.5 0 0 1 11.5 2ZM12.5 12.5H22A9.5 9.5 0 0 1 12.5 22Z"/><path fill="#fbffc9" d="M12.5 2H22V11.5H12.5Z"/></g></svg>')}`;
 function escapeHtml(text) {
@@ -220,6 +217,12 @@ function parseGatewayLabel(label) {
     return null;
   return { boxId, port: Number(port) };
 }
+function gatewayHostBox(gatewayHost, hostname) {
+  let suffix = `.${gatewayHost.toLowerCase()}`, host = hostname.toLowerCase().replace(/\.$/, "");
+  if (!host.endsWith(suffix))
+    return null;
+  return parseGatewayLabel(host.slice(0, -suffix.length).split(".").pop())?.boxId ?? null;
+}
 
 // ../protocol/src/mux.ts
 var MUX_WINDOW = 262144, MUX_CHUNK = 65536;
@@ -317,6 +320,68 @@ function decodeFrame(buf) {
 }
 
 // src/cloudflare.ts
+import { Effect as Effect4, Schema as Schema3 } from "effect";
+
+// src/jwt.ts
+import { Clock, Effect, Option } from "effect";
+var KEYS_TTL_MS = 600000, REFETCH_MIN_MS = 30000, CLOCK_SKEW_S = 60, keySets = /* @__PURE__ */ new Map;
+function base64url(text) {
+  let b64 = text.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(text.length / 4) * 4, "=");
+  return Uint8Array.from(atob(b64), (c) => c.charCodeAt(0));
+}
+function json2(part) {
+  try {
+    let value = JSON.parse((/* @__PURE__ */ new TextDecoder()).decode(base64url(part)));
+    return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
+  } catch {
+    return null;
+  }
+}
+var fetchKeys = (jwksUri, now) => Effect.tryPromise(async () => {
+  let res = await fetch(jwksUri);
+  if (!res.ok)
+    throw Error(`${jwksUri} answered ${res.status}`);
+  let body = await res.json(), keys = /* @__PURE__ */ new Map;
+  for (let jwk of body.keys ?? []) {
+    if (typeof jwk.kid !== "string" || jwk.kty !== "RSA")
+      continue;
+    keys.set(jwk.kid, await crypto.subtle.importKey("jwk", jwk, { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" }, !1, ["verify"]));
+  }
+  let set = { keys, fetchedAt: now };
+  return keySets.set(jwksUri, set), set;
+}).pipe(Effect.option), keyFor = Effect.fn("Jwt.keyFor")(function* (jwksUri, kid, now) {
+  let set = keySets.get(jwksUri);
+  if (set === void 0 || now - set.fetchedAt > KEYS_TTL_MS)
+    set = Option.getOrElse(yield* fetchKeys(jwksUri, now), () => set);
+  if (set !== void 0 && !set.keys.has(kid) && now - set.fetchedAt > REFETCH_MIN_MS)
+    set = Option.getOrElse(yield* fetchKeys(jwksUri, now), () => set);
+  return set?.keys.get(kid) ?? null;
+}), verifyRs256 = Effect.fn("Jwt.verifyRs256")(function* (token, issuer, jwksUri) {
+  let parts = token.split(".");
+  if (parts.length !== 3)
+    return null;
+  let [h, p, s] = parts, header = json2(h), claims = json2(p);
+  if (header === null || claims === null || header.alg !== "RS256" || typeof header.kid !== "string" || claims.iss !== issuer)
+    return null;
+  let nowMs = yield* Clock.currentTimeMillis, key = yield* keyFor(jwksUri, header.kid, nowMs);
+  if (key === null)
+    return null;
+  let signature = base64url(s);
+  if (!(yield* Effect.tryPromise(() => crypto.subtle.verify("RSASSA-PKCS1-v1_5", key, signature, (/* @__PURE__ */ new TextEncoder()).encode(`${h}.${p}`))).pipe(Effect.orElseSucceed(() => !1))))
+    return null;
+  let now = Math.floor(nowMs / 1000);
+  if (typeof claims.exp !== "number" || claims.exp + CLOCK_SKEW_S < now)
+    return null;
+  if (typeof claims.nbf === "number" && claims.nbf - CLOCK_SKEW_S > now)
+    return null;
+  return claims;
+});
+function audienceIncludes(aud, expected) {
+  return aud === expected || Array.isArray(aud) && aud.includes(expected);
+}
+
+// src/relay.ts
+import { DurableObject } from "cloudflare:workers";
 import { Clock as Clock3, Duration as Duration2, Effect as Effect3, Layer, Schema as Schema2 } from "effect";
 
 // ../front/src/csp.ts
@@ -368,10 +433,10 @@ var HOP_BY_HOP = [
   "upgrade"
 ];
 function withoutHopByHop(source) {
-  let headers2 = new Headers(source), connectionHeaders = headers2.get("connection")?.split(",").map((name) => name.trim()).filter(Boolean) ?? [];
+  let headers = new Headers(source), connectionHeaders = headers.get("connection")?.split(",").map((name) => name.trim()).filter(Boolean) ?? [];
   for (let name of [...HOP_BY_HOP, ...connectionHeaders])
-    headers2.delete(name);
-  return headers2;
+    headers.delete(name);
+  return headers;
 }
 function wantsDocument(request) {
   return request.method === "GET" && (request.headers.get("sec-fetch-mode") === "navigate" || request.headers.get("accept")?.toLowerCase().includes("text/html") === !0);
@@ -396,7 +461,16 @@ function rewriteUrl(input, ws, ctx) {
   let port = Number(url.port || (url.protocol === "https:" || url.protocol === "wss:" ? 443 : 80));
   if (!ctx.ports.includes(port))
     return input;
-  return url.pathname = `${port === ctx.port ? "" : `/__tesser/${port}`}${url.pathname}`, url.protocol = ws ? page.protocol === "https:" ? "wss:" : "ws:" : page.protocol, url.port = "", url.host = name === page.hostname ? page.host : sub === null ? ctx.host : `${sub}.${ctx.host}`, url.href;
+  return url.pathname = `${sub !== null ? `/__tesser/${sub}.${port}` : port === ctx.port ? "" : `/__tesser/${port}`}${url.pathname}`, url.protocol = ws ? page.protocol === "https:" ? "wss:" : "ws:" : page.protocol, url.port = "", url.host = name === page.hostname || sub !== null ? page.host : ctx.host, url.href;
+}
+function rewriteSrcset(value, to) {
+  let changed = !1, candidates = value.split(",").map((candidate) => {
+    let [url = "", ...descriptors] = candidate.trim().split(/\s+/), rewritten = to(url);
+    if (rewritten !== url)
+      changed = !0;
+    return [rewritten, ...descriptors].join(" ");
+  });
+  return changed ? candidates.join(", ") : value;
 }
 function shimSource() {
   return `(() => {
@@ -410,6 +484,7 @@ function shimSource() {
   const port = Number(params.get("port"));
   const rewriteUrl = ${rewriteUrl.toString()};
   const to = (input, ws) => rewriteUrl(String(input), ws, { href: location.href, host, ports, port });
+  const rewriteSrcset = ${rewriteSrcset.toString()};
   const fetch = window.fetch;
   window.fetch = function (input, init) {
     if (!(input instanceof Request)) return fetch.call(this, to(input, false), init);
@@ -437,6 +512,51 @@ function shimSource() {
   };
   wrap("WebSocket", true);
   wrap("EventSource", false);
+  const loads = [
+    ["HTMLImageElement", ["src", "srcset"]],
+    ["HTMLSourceElement", ["src", "srcset"]],
+    ["HTMLScriptElement", ["src"]],
+    ["HTMLIFrameElement", ["src"]],
+    ["HTMLMediaElement", ["src"]],
+    ["HTMLVideoElement", ["poster"]],
+    ["HTMLEmbedElement", ["src"]],
+    ["HTMLTrackElement", ["src"]],
+    ["HTMLLinkElement", ["href"]],
+  ].filter(([name]) => window[name]);
+  const fix = (name, value) => name === "srcset" ? rewriteSrcset(String(value), (url) => to(url, false)) : to(value, false);
+  const loaded = (element, name) => loads.some(([type, names]) => element instanceof window[type] && names.includes(name));
+  const setAttribute = Element.prototype.setAttribute;
+  Element.prototype.setAttribute = function (name, value) {
+    const lower = String(name).toLowerCase();
+    return setAttribute.call(this, name, loaded(this, lower) ? fix(lower, value) : value);
+  };
+  for (const [type, names] of loads) {
+    for (const name of names) {
+      const proto = window[type].prototype;
+      const descriptor = Object.getOwnPropertyDescriptor(proto, name);
+      if (!descriptor?.set) continue;
+      Object.defineProperty(proto, name, { ...descriptor, set(value) { descriptor.set.call(this, fix(name, value)); } });
+    }
+  }
+  const selector = "img, source, script, iframe, video, audio, embed, track, link";
+  const sweep = (element) => {
+    for (const name of ["src", "srcset", "poster", "href"]) {
+      const value = element.getAttribute(name);
+      if (value !== null && loaded(element, name)) {
+        const rewritten = fix(name, value);
+        if (rewritten !== value) setAttribute.call(element, name, rewritten);
+      }
+    }
+  };
+  new MutationObserver((records) => {
+    for (const record of records) {
+      for (const node of record.addedNodes) {
+        if (!(node instanceof Element)) continue;
+        if (node.matches(selector)) sweep(node);
+        for (const element of node.querySelectorAll(selector)) sweep(element);
+      }
+    }
+  }).observe(document, { childList: true, subtree: true });
   const follow = (element, attribute) => {
     const value = element?.getAttribute(attribute);
     if (!value) return;
@@ -459,10 +579,10 @@ function shimTag(params, nonce) {
 }
 
 // src/core.ts
-import { Clock, Context, Duration, Effect, Schedule, Schema } from "effect";
+import { Clock as Clock2, Context, Duration, Effect as Effect2, Schedule, Schema } from "effect";
 
 // src/route.ts
-var PORT_PATH = /^\/__tesser\/(\d{1,5})(\/.*)?$/;
+var PORT_PATH = /^\/__tesser\/(?:([a-z0-9-]+(?:\.[a-z0-9-]+)*)\.)?(\d{1,5})(\/.*)?$/;
 function parseTarget(gatewayHost, url) {
   let bare = url.hostname.toLowerCase().replace(/\.$/, ""), suffix = `.${gatewayHost.toLowerCase()}`;
   if (!bare.endsWith(suffix))
@@ -470,14 +590,14 @@ function parseTarget(gatewayHost, url) {
   let labels = bare.slice(0, -suffix.length).split("."), label = labels[labels.length - 1], parsed = parseGatewayLabel(label);
   if (parsed === null)
     return null;
-  let gateway = `${gatewayHost}${url.port ? `:${url.port}` : ""}`, base = { boxId: parsed.boxId, sub: labels.slice(0, -1).join("."), boxHost: `${label}.${gateway}`, gateway, root: parsed.port }, match = PORT_PATH.exec(url.pathname);
+  let gateway = `${gatewayHost}${url.port ? `:${url.port}` : ""}`, sub = labels.slice(0, -1).join("."), base = { boxId: parsed.boxId, sub, pageSub: sub, boxHost: `${label}.${gateway}`, gateway, root: parsed.port }, match = PORT_PATH.exec(url.pathname);
   if (match === null)
     return { ...base, port: null, path: `${url.pathname}${url.search}` };
-  return { ...base, port: Number(match[1]), path: `${match[2] ?? "/"}${url.search}` };
+  return { ...base, sub: match[1] ?? base.sub, port: Number(match[2]), path: `${match[3] ?? "/"}${url.search}` };
 }
-function parseUrl(raw) {
+function parseUrl(raw, base) {
   try {
-    return new URL(raw);
+    return new URL(raw, base);
   } catch {
     return null;
   }
@@ -510,7 +630,7 @@ class Waker extends Context.Service()("@tesser/gateway/Waker") {
 
 class Upstream extends Context.Service()("@tesser/gateway/Upstream") {
 }
-var WAKING_WINDOW = Duration.minutes(5), startingRetry = { schedule: Schedule.spaced(Duration.seconds(1)), times: 60 }, respond = (response) => ({ _tag: "response", response });
+var VIEWER_COOKIE = "__Host-tesser-viewer", GATEWAY_COOKIES = /* @__PURE__ */ new Set(["CF_Authorization", VIEWER_COOKIE]), WAKING_WINDOW = Duration.minutes(5), startingRetry = { schedule: Schedule.spaced(Duration.seconds(1)), times: 60 }, respond = (response) => ({ _tag: "response", response });
 function page(request, state) {
   let status = viewerStatus(state);
   if (wantsDocument(request))
@@ -522,21 +642,21 @@ function viewerBox(box) {
   return { name: box.name, sharedBy: box.sharedBy };
 }
 function upstreamHeaders(request, target, port, root) {
-  let headers2 = withoutHopByHop(request.headers);
-  for (let name of [...headers2.keys()])
+  let headers = withoutHopByHop(request.headers);
+  for (let name of [...headers.keys()])
     if (name.startsWith("cf-access-") || name.startsWith("x-forwarded-"))
-      headers2.delete(name);
-  headers2.delete("forwarded");
-  let cookie = headers2.get("cookie")?.split(";").filter((c) => c.trim().split("=")[0] !== "CF_Authorization").join(";").trim();
+      headers.delete(name);
+  headers.delete("forwarded"), headers.delete("x-tesser-viewer"), headers.delete("x-tesser-ticket");
+  let cookie = headers.get("cookie")?.split(";").filter((c) => !GATEWAY_COOKIES.has(c.trim().split("=")[0])).join(";").trim();
   if (cookie)
-    headers2.set("cookie", cookie);
+    headers.set("cookie", cookie);
   else
-    headers2.delete("cookie");
-  headers2.set("host", presentedHost(target.sub, port)), headers2.set("x-forwarded-for", "127.0.0.1"), headers2.set("x-forwarded-proto", "http"), headers2.set("accept-encoding", "identity");
+    headers.delete("cookie");
+  headers.set("host", presentedHost(target.sub, port)), headers.set("x-forwarded-for", "127.0.0.1"), headers.set("x-forwarded-proto", "http"), headers.set("accept-encoding", "identity");
   let origin = request.headers.get("origin");
   if (origin !== null && parseUrl(origin)?.host === new URL(request.url).host)
-    headers2.set("origin", `http://${presentedHost(target.sub, root)}`);
-  return headers2;
+    headers.set("origin", `http://${presentedHost(target.pageSub, root)}`);
+  return headers;
 }
 function isHtmlDocument(request, response) {
   if (!wantsDocument(request) || response.status < 200 || response.status >= 300)
@@ -544,62 +664,62 @@ function isHtmlDocument(request, response) {
   return (response.headers.get("content-type")?.toLowerCase() ?? "").includes("text/html") && !response.headers.has("content-range");
 }
 function downstream(request, response, upstreamUrl, ctx, shownOrigin) {
-  let headers2 = withoutHopByHop(response.headers);
-  headers2.delete("content-encoding"), headers2.delete("content-length");
-  let location = headers2.get("location");
+  let headers = withoutHopByHop(response.headers);
+  headers.delete("content-encoding"), headers.delete("content-length");
+  let location = headers.get("location");
   if (location !== null)
-    headers2.set("location", rewriteUrl(parseUrl(location) === null ? new URL(location, upstreamUrl).href : location, !1, ctx));
+    headers.set("location", rewriteUrl(parseUrl(location) === null ? new URL(location, upstreamUrl).href : location, !1, ctx));
   let origin = request.headers.get("origin");
-  if (origin !== null && shownOrigin !== null && headers2.get("access-control-allow-origin") === shownOrigin)
-    headers2.set("access-control-allow-origin", origin);
-  let init = { status: response.status, statusText: response.statusText, headers: headers2 };
+  if (origin !== null && shownOrigin !== null && headers.get("access-control-allow-origin") === shownOrigin)
+    headers.set("access-control-allow-origin", origin);
+  let init = { status: response.status, statusText: response.statusText, headers };
   if (!isHtmlDocument(request, response))
     return new Response(response.body, init);
-  let csp = headers2.get("content-security-policy");
+  let csp = headers.get("content-security-policy");
   if (csp !== null)
-    headers2.set("content-security-policy", allowSelfScripts(csp));
+    headers.set("content-security-policy", allowSelfScripts(csp));
   let tag = shimTag({ host: ctx.host, ports: ctx.ports, port: ctx.port }, csp === null ? void 0 : scriptNonce(csp)), placed = !1, inject = {
     element(element) {
       if (placed)
         return;
       placed = !0, element.prepend(tag, { html: !0 });
     }
-  }, link = (attribute) => ({
+  }, link = (attribute, rewrite = (value) => rewriteUrl(value, !1, ctx)) => ({
     element(element) {
       let value = element.getAttribute(attribute);
       if (value === null)
         return;
-      let rewritten = rewriteUrl(value, !1, ctx);
+      let rewritten = rewrite(value);
       if (rewritten !== value)
         element.setAttribute(attribute, rewritten);
     }
   });
-  return new HTMLRewriter().on("head", inject).on("body", inject).on("a[href], area[href], link[href]", link("href")).on("form[action]", link("action")).on("button[formaction], input[formaction]", link("formaction")).on("script[src], img[src], iframe[src], source[src], video[src], audio[src], embed[src]", link("src")).transform(new Response(response.body, init));
+  return new HTMLRewriter().on("head", inject).on("body", inject).on("a[href], area[href], link[href]", link("href")).on("form[action]", link("action")).on("button[formaction], input[formaction]", link("formaction")).on("script[src], img[src], iframe[src], source[src], video[src], audio[src], embed[src]", link("src")).on("img[srcset], source[srcset]", link("srcset", (value) => rewriteSrcset(value, (url) => rewriteUrl(url, !1, ctx)))).transform(new Response(response.body, init));
 }
-var wakingPage = Effect.fn("Gateway.wakingPage")(function* (request, box, port, stage, since) {
-  let now = yield* Clock.currentTimeMillis;
+var wakingPage = Effect2.fn("Gateway.wakingPage")(function* (request, box, port, stage, since) {
+  let now = yield* Clock2.currentTimeMillis;
   return page(request, { kind: "waking", box: viewerBox(box), stage, port, seconds: Math.max(0, Math.round((now - since) / 1000)) });
-}), refused = Effect.fn("Gateway.refused")(function* (request, box, port) {
-  let status = yield* (yield* Waker).status(box.boxId), now = yield* Clock.currentTimeMillis;
+}), refused = Effect2.fn("Gateway.refused")(function* (request, box, port) {
+  let status = yield* (yield* Waker).status(box.boxId), now = yield* Clock2.currentTimeMillis;
   if (box.app === "exited")
     return page(request, { kind: "stopped", box: viewerBox(box) });
   if (status !== null && now - status.since < Duration.toMillis(WAKING_WINDOW))
     return yield* wakingPage(request, box, port, box.app === "running" ? "port" : "app", status.since);
   return page(request, { kind: "not-answering", box: viewerBox(box), port });
-}), serve = Effect.fn("Gateway.serve")(function* (request, target, box, port, root) {
-  let headers2 = upstreamHeaders(request, target, port, root);
+}), serve = Effect2.fn("Gateway.serve")(function* (request, target, box, port, root) {
+  let headers = upstreamHeaders(request, target, port, root);
   if (request.headers.get("upgrade")?.toLowerCase() === "websocket")
-    return { _tag: "websocket", box, port, path: target.path, headers: headers2 };
-  let ctx = { href: request.url, host: target.boxHost, ports: box.ports, port: root }, upstreamUrl = `http://${headers2.get("host")}${target.path}`, shownOrigin = headers2.get("origin"), replayable = request.method === "GET" || request.method === "HEAD", document = wantsDocument(request), upstream = yield* Upstream, attempt = Effect.suspend(() => upstream.fetch(box, port, new Request(upstreamUrl, {
+    return { _tag: "websocket", box, port, path: target.path, headers };
+  let ctx = { href: request.url, host: target.boxHost, ports: box.ports, port: root }, upstreamUrl = `http://${headers.get("host")}${target.path}`, shownOrigin = headers.get("origin"), replayable = request.method === "GET" || request.method === "HEAD", document = wantsDocument(request), upstream = yield* Upstream, attempt = Effect2.suspend(() => upstream.fetch(box, port, new Request(upstreamUrl, {
     method: request.method,
-    headers: headers2,
+    headers,
     body: replayable ? void 0 : request.body,
     redirect: "manual",
     signal: request.signal,
     ...replayable ? {} : { duplex: "half" }
   })));
-  return yield* (document || !replayable ? attempt : attempt.pipe(Effect.retry(startingRetry))).pipe(Effect.map((response) => respond(downstream(request, response, upstreamUrl, ctx, shownOrigin))), Effect.catchTag("UpstreamRefused", () => document ? refused(request, box, port) : Effect.succeed(page(request, { kind: "not-answering", box: viewerBox(box), port }))));
-}), handle = Effect.fn("Gateway.handle")(function* (request) {
+  return yield* (document || !replayable ? attempt : attempt.pipe(Effect2.retry(startingRetry))).pipe(Effect2.map((response) => respond(downstream(request, response, upstreamUrl, ctx, shownOrigin))), Effect2.catchTag("UpstreamRefused", () => document ? refused(request, box, port) : Effect2.succeed(page(request, { kind: "not-answering", box: viewerBox(box), port }))));
+}), handle = Effect2.fn("Gateway.handle")(function* (request) {
   let directory = yield* BoxDirectory, waker = yield* Waker, url = new URL(request.url), host = yield* directory.host, target = parseTarget(host, url);
   if (target === null)
     return page(request, { kind: "not-shared" });
@@ -625,75 +745,17 @@ var wakingPage = Effect.fn("Gateway.wakingPage")(function* (request, box, port,
     if (wantsDocument(request)) {
       if (box.power === "launching" && status === null)
         return page(request, { kind: "booting", box: viewerBox(box) });
-      return yield* wakingPage(request, box, port, "machine", status?.since ?? (yield* Clock.currentTimeMillis));
+      return yield* wakingPage(request, box, port, "machine", status?.since ?? (yield* Clock2.currentTimeMillis));
     }
     return yield* serve(request, target, yield* waker.awake(box.boxId), port, root);
   }
   return yield* serve(request, target, box, port, root);
-}, (effect, request) => effect.pipe(Effect.catchTags({
-  BoxNotShared: () => Effect.succeed(page(request, { kind: "not-shared" })),
-  DirectoryUnavailable: () => Effect.succeed(page(request, { kind: "unavailable" })),
-  WakeFailed: (e) => Effect.succeed(page(request, { kind: "wake-failed", box: { name: e.boxId, sharedBy: null }, reason: e.reason }))
+}, (effect, request) => effect.pipe(Effect2.catchTags({
+  BoxNotShared: () => Effect2.succeed(page(request, { kind: "not-shared" })),
+  DirectoryUnavailable: () => Effect2.succeed(page(request, { kind: "unavailable" })),
+  WakeFailed: (e) => Effect2.succeed(page(request, { kind: "wake-failed", box: { name: e.boxId, sharedBy: null }, reason: e.reason }))
 })));
 
-// src/jwt.ts
-import { Clock as Clock2, Effect as Effect2, Option } from "effect";
-var KEYS_TTL_MS = 600000, REFETCH_MIN_MS = 30000, CLOCK_SKEW_S = 60, keySets = /* @__PURE__ */ new Map;
-function base64url(text2) {
-  let b64 = text2.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(text2.length / 4) * 4, "=");
-  return Uint8Array.from(atob(b64), (c) => c.charCodeAt(0));
-}
-function json2(part) {
-  try {
-    let value = JSON.parse((/* @__PURE__ */ new TextDecoder()).decode(base64url(part)));
-    return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
-  } catch {
-    return null;
-  }
-}
-var fetchKeys = (jwksUri, now) => Effect2.tryPromise(async () => {
-  let res = await fetch(jwksUri);
-  if (!res.ok)
-    throw Error(`${jwksUri} answered ${res.status}`);
-  let body2 = await res.json(), keys = /* @__PURE__ */ new Map;
-  for (let jwk of body2.keys ?? []) {
-    if (typeof jwk.kid !== "string" || jwk.kty !== "RSA")
-      continue;
-    keys.set(jwk.kid, await crypto.subtle.importKey("jwk", jwk, { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" }, !1, ["verify"]));
-  }
-  let set = { keys, fetchedAt: now };
-  return keySets.set(jwksUri, set), set;
-}).pipe(Effect2.option), keyFor = Effect2.fn("Jwt.keyFor")(function* (jwksUri, kid, now) {
-  let set = keySets.get(jwksUri);
-  if (set === void 0 || now - set.fetchedAt > KEYS_TTL_MS)
-    set = Option.getOrElse(yield* fetchKeys(jwksUri, now), () => set);
-  if (set !== void 0 && !set.keys.has(kid) && now - set.fetchedAt > REFETCH_MIN_MS)
-    set = Option.getOrElse(yield* fetchKeys(jwksUri, now), () => set);
-  return set?.keys.get(kid) ?? null;
-}), verifyRs256 = Effect2.fn("Jwt.verifyRs256")(function* (token, issuer, jwksUri) {
-  let parts = token.split(".");
-  if (parts.length !== 3)
-    return null;
-  let [h, p, s] = parts, header = json2(h), claims = json2(p);
-  if (header === null || claims === null || header.alg !== "RS256" || typeof header.kid !== "string" || claims.iss !== issuer)
-    return null;
-  let nowMs = yield* Clock2.currentTimeMillis, key = yield* keyFor(jwksUri, header.kid, nowMs);
-  if (key === null)
-    return null;
-  let signature = base64url(s);
-  if (!(yield* Effect2.tryPromise(() => crypto.subtle.verify("RSASSA-PKCS1-v1_5", key, signature, (/* @__PURE__ */ new TextEncoder()).encode(`${h}.${p}`))).pipe(Effect2.orElseSucceed(() => !1))))
-    return null;
-  let now = Math.floor(nowMs / 1000);
-  if (typeof claims.exp !== "number" || claims.exp + CLOCK_SKEW_S < now)
-    return null;
-  if (typeof claims.nbf === "number" && claims.nbf - CLOCK_SKEW_S > now)
-    return null;
-  return claims;
-});
-function audienceIncludes(aud, expected) {
-  return aud === expected || Array.isArray(aud) && aud.includes(expected);
-}
-
 // src/tunnel.ts
 var UPGRADE_TIMEOUT_MS = 30000, NULL_BODY = /* @__PURE__ */ new Set([101, 204, 205, 304]);
 
@@ -708,12 +770,12 @@ class Tunnel {
     this.socket = socket;
     this.inUse = inUse;
   }
-  send(frame2) {
+  send(frame) {
     let ws = this.socket();
     if (ws === null)
       return !1;
     try {
-      return ws.send(encodeFrame(frame2)), !0;
+      return ws.send(encodeFrame(frame)), !0;
     } catch {
       return !1;
     }
@@ -728,14 +790,14 @@ class Tunnel {
   async fetch(port, request) {
     let url = new URL(request.url), stream = this.newStream(), s = { kind: "http", head: null, controller: null, buffered: [], owed: 0, window: MUX_WINDOW, onCredit: null, closed: !1 }, head = new Promise((resolve, reject) => s.head = { resolve, reject });
     this.streams.set(stream, s);
-    let headers2 = [...request.headers];
-    if (!this.send({ type: "open", stream, port, method: request.method, path: `${url.pathname}${url.search}`, headers: headers2, ws: !1 }))
+    let headers = [...request.headers];
+    if (!this.send({ type: "open", stream, port, method: request.method, path: `${url.pathname}${url.search}`, headers, ws: !1 }))
       throw this.streams.delete(stream), new StreamRefused("the box is not connected");
     request.signal.addEventListener("abort", () => this.abort(stream, "the viewer went away")), this.pump(stream, s, request.body);
     let h = await head;
     if (NULL_BODY.has(h.status) || request.method === "HEAD")
       return this.abort(stream, "no body expected"), new Response(null, { status: h.status, statusText: h.statusText, headers: h.headers });
-    let body2 = new ReadableStream({
+    let body = new ReadableStream({
       start: (controller) => {
         s.controller = controller;
         for (let chunk of s.buffered.splice(0))
@@ -746,11 +808,11 @@ class Tunnel {
       pull: () => this.credit(stream, s),
       cancel: () => this.abort(stream, "the viewer stopped reading")
     }, { highWaterMark: MUX_WINDOW, size: (chunk) => chunk.byteLength });
-    return new Response(body2, { status: h.status, statusText: h.statusText, headers: h.headers });
+    return new Response(body, { status: h.status, statusText: h.statusText, headers: h.headers });
   }
-  async upgrade(port, path, headers2) {
+  async upgrade(port, path, headers) {
     let stream = this.newStream(), head = new Promise((resolve, reject) => this.streams.set(stream, { kind: "ws", resolve, reject }));
-    if (!this.send({ type: "open", stream, port, method: "GET", path, headers: headers2, ws: !0 }))
+    if (!this.send({ type: "open", stream, port, method: "GET", path, headers, ws: !0 }))
       throw this.streams.delete(stream), new StreamRefused("the box is not connected");
     let timeout = setTimeout(() => {
       this.fail(stream, new StreamRefused("the app did not answer the websocket upgrade")), this.send({ type: "reset", stream, reason: "the upgrade timed out" });
@@ -761,12 +823,12 @@ class Tunnel {
       clearTimeout(timeout);
     }
   }
-  async pump(stream, s, body2) {
-    if (body2 === null) {
+  async pump(stream, s, body) {
+    if (body === null) {
       this.send({ type: "end", stream });
       return;
     }
-    let reader = body2.getReader();
+    let reader = body.getReader();
     try {
       for (;; ) {
         let { done, value } = await reader.read();
@@ -815,41 +877,41 @@ class Tunnel {
       s.controller?.error(err);
     } catch {}
   }
-  onFrame(frame2) {
-    let s = this.streams.get(frame2.stream);
+  onFrame(frame) {
+    let s = this.streams.get(frame.stream);
     if (s === void 0)
       return !1;
     if (s.kind === "ws") {
-      if (frame2.type === "head")
-        this.streams.delete(frame2.stream), s.resolve(frame2);
-      else if (frame2.type === "reset")
-        this.streams.delete(frame2.stream), s.reject(new StreamRefused(frame2.reason));
+      if (frame.type === "head")
+        this.streams.delete(frame.stream), s.resolve(frame);
+      else if (frame.type === "reset")
+        this.streams.delete(frame.stream), s.reject(new StreamRefused(frame.reason));
       return !0;
     }
-    switch (frame2.type) {
+    switch (frame.type) {
       case "head":
-        return s.head?.resolve(frame2), s.head = null, !0;
+        return s.head?.resolve(frame), s.head = null, !0;
       case "data":
         if (s.controller === null)
-          return s.buffered.push(frame2.data), s.owed += frame2.data.byteLength, !0;
+          return s.buffered.push(frame.data), s.owed += frame.data.byteLength, !0;
         try {
-          s.controller.enqueue(frame2.data);
+          s.controller.enqueue(frame.data);
         } catch {
           return !0;
         }
-        if (s.owed += frame2.data.byteLength, (s.controller.desiredSize ?? 0) > 0)
-          this.credit(frame2.stream, s);
+        if (s.owed += frame.data.byteLength, (s.controller.desiredSize ?? 0) > 0)
+          this.credit(frame.stream, s);
         return !0;
       case "end":
-        this.streams.delete(frame2.stream), s.closed = !0;
+        this.streams.delete(frame.stream), s.closed = !0;
         try {
           s.controller?.close();
         } catch {}
         return !0;
       case "reset":
-        return this.fail(frame2.stream, new StreamRefused(frame2.reason)), !0;
+        return this.fail(frame.stream, new StreamRefused(frame.reason)), !0;
       case "credit":
-        return s.window += frame2.bytes, s.onCredit?.(), s.onCredit = null, !0;
+        return s.window += frame.bytes, s.onCredit?.(), s.onCredit = null, !0;
       default:
         return !0;
     }
@@ -860,8 +922,9 @@ class Tunnel {
   }
 }
 
-// src/cloudflare.ts
-var TICKET_HEADER = "x-tesser-ticket", ACCESS_HEADER = "cf-access-jwt-assertion", WAKE_TIMEOUT = Duration2.minutes(5), WAKE_RETRY_MS = 30000, DIAL_GRACE = Duration2.seconds(30), RECHECK_MS = 60000, RETRYABLE = /* @__PURE__ */ new Set([0, 408, 409, 429]), Ticket = Schema2.Struct({
+// src/relay.ts
+var TICKET_HEADER = "x-tesser-ticket", WAKE_TIMEOUT = Duration2.minutes(5), WAKE_RETRY_MS = 30000, DIAL_GRACE = Duration2.seconds(30), RECHECK_MS = 60000, STALE_MS = 300000, RETRYABLE = /* @__PURE__ */ new Set([0, 408, 409, 429]), Ticket = Schema2.Struct({
+  org: Schema2.String,
   box: Schema2.String,
   name: Schema2.String,
   sharedBy: Schema2.NullOr(Schema2.String),
@@ -878,63 +941,18 @@ var TICKET_HEADER = "x-tesser-ticket", ACCESS_HEADER = "cf-access-jwt-assertion"
     app: Schema2.NullOr(Schema2.Literals(["none", "running", "unsupervised", "exited"]))
   })
 }), ErrorBody = Schema2.Struct({ error: Schema2.Struct({ message: Schema2.String }) });
-function plain(status, text2) {
-  return new Response(`${text2}
+function plain(status, text) {
+  return new Response(`${text}
 `, { status, headers: { "content-type": "text/plain; charset=utf-8", "cache-control": "no-store" } });
 }
-var verifyTicket = Effect3.fn("Gateway.verifyTicket")(function* (env, request) {
-  let token = request.headers.get("authorization")?.match(/^Bearer (\S+)$/)?.[1];
-  if (token === void 0)
-    return null;
-  let issuer = env.TESSER_URL.replace(/\/$/, ""), claims = yield* verifyRs256(token, issuer, `${issuer}/.well-known/jwks.json`);
-  if (claims === null || !audienceIncludes(claims.aud, `https://${env.GATEWAY_HOST}`) || claims.org !== env.TESSER_ORG)
-    return null;
-  if (claims.sub !== `box:${env.TESSER_ORG}:${String(claims.box)}`)
-    return null;
-  return yield* Schema2.decodeUnknownEffect(Ticket)(claims).pipe(Effect3.option);
-}), verifyViewer = Effect3.fn("Gateway.verifyViewer")(function* (env, request) {
-  let token = request.headers.get(ACCESS_HEADER);
-  if (token === null)
-    return null;
-  let issuer = `https://${env.ACCESS_TEAM}`, claims = yield* verifyRs256(token, issuer, `${issuer}/cdn-cgi/access/certs`);
-  return claims !== null && audienceIncludes(claims.aud, env.ACCESS_AUD) ? claims : null;
-});
-function boxIdFromHost(env, hostname) {
-  let suffix = `.${env.GATEWAY_HOST.toLowerCase()}`, host = hostname.toLowerCase();
-  if (!host.endsWith(suffix))
-    return null;
-  let label = host.slice(0, -suffix.length).split(".").pop(), match = /^box-([0-9a-z]+)(?:--\d{1,5})?$/.exec(label);
-  return match === null ? null : `box_${match[1]}`;
-}
-var cloudflare_default = {
-  async fetch(request, env) {
-    let url = new URL(request.url), apex = url.hostname.toLowerCase() === env.GATEWAY_HOST.toLowerCase();
-    if (apex && url.pathname === GATEWAY_DIAL_PATH) {
-      if (request.headers.get("upgrade")?.toLowerCase() !== "websocket")
-        return plain(426, "boxes dial this with a websocket");
-      let ticket = await Effect3.runPromise(verifyTicket(env, request));
-      if (ticket === null || ticket._tag === "None")
-        return plain(401, "a box dials in with a share ticket signed by tesser");
-      let headers3 = new Headers(request.headers);
-      return headers3.delete("authorization"), headers3.set(TICKET_HEADER, JSON.stringify(ticket.value)), env.BOXES.get(env.BOXES.idFromName(ticket.value.box)).fetch(new Request(request, { headers: headers3 }));
-    }
-    if (apex && url.pathname === "/__tesser/health")
-      return plain(200, "ok");
-    let boxId = boxIdFromHost(env, url.hostname);
-    if (boxId === null)
-      return new Response(viewerPage({ kind: "not-shared" }), { status: 404, headers: STATUS_HEADERS });
-    if (await Effect3.runPromise(verifyViewer(env, request)) === null)
-      return plain(403, "this gateway only answers requests Cloudflare Access let through");
-    let headers2 = new Headers(request.headers);
-    return headers2.delete(TICKET_HEADER), env.BOXES.get(env.BOXES.idFromName(boxId)).fetch(new Request(request, { headers: headers2 }));
-  }
-};
 
-class GatewayBoxes extends DurableObject {
+class BoxRelay extends DurableObject {
   tunnel = new Tunnel(() => this.boxSocket(), (stream) => this.ctx.getWebSockets(`v:${stream}`).length > 0);
   waking = null;
   connected = [];
-  verifiedAt = 0;
+  verifiedAt = /* @__PURE__ */ new Map;
+  unstored = /* @__PURE__ */ new Map;
+  failingSince = /* @__PURE__ */ new Map;
   constructor(ctx, env) {
     super(ctx, env);
     ctx.setWebSocketAutoResponse(new WebSocketRequestResponsePair(MUX_PING, MUX_PONG));
@@ -963,9 +981,13 @@ class GatewayBoxes extends DurableObject {
   }
   async fetch(request) {
     let ticket = request.headers.get(TICKET_HEADER);
-    if (ticket !== null)
-      return this.acceptBox(JSON.parse(ticket));
-    let handled = await Effect3.runPromise(handle(request).pipe(Effect3.provide(this.layer(request.headers.get(ACCESS_HEADER)))));
+    if (ticket !== null) {
+      let decoded = Schema2.decodeUnknownOption(Ticket)(JSON.parse(ticket));
+      if (decoded._tag === "None" || !this.admits(decoded.value))
+        return plain(403, "this box answers for another org here");
+      return this.acceptBox(decoded.value);
+    }
+    let handled = await Effect3.runPromise(handle(request).pipe(Effect3.provide(this.layer(this.viewer(request)))));
     if (handled._tag === "response")
       return handled.response;
     return this.bridge(request, handled);
@@ -975,32 +997,99 @@ class GatewayBoxes extends DurableObject {
     if (previous !== null)
       this.retire(previous, 4000, "replaced by a newer connection");
     let [client, server] = Object.values(new WebSocketPair);
-    this.ctx.acceptWebSocket(server, ["box"]), server.serializeAttachment({ ticket }), this.waking = null, this.verifiedAt = Date.now();
+    this.ctx.acceptWebSocket(server, ["box"]), server.serializeAttachment({ ticket }), this.waking = null, this.verifiedAt.clear(), this.failingSince.clear();
     for (let resolve of this.connected.splice(0))
       resolve();
-    return this.ctx.waitUntil(this.ctx.storage.setAlarm(ticket.exp * 1000)), new Response(null, { status: 101, webSocket: client });
+    return this.ctx.waitUntil(this.armAlarm(ticket)), new Response(null, { status: 101, webSocket: client });
+  }
+  socketViewer(ws) {
+    let { stream, viewer } = ws.deserializeAttachment();
+    return { stream, viewer: viewer ?? this.unstored.get(stream) ?? null };
+  }
+  viewers() {
+    return new Set(this.ctx.getWebSockets("viewer").flatMap((ws) => this.socketViewer(ws).viewer ?? []));
+  }
+  async armAlarm(ticket) {
+    let want = this.viewers().size > 0 ? Math.min(ticket.exp * 1000, Date.now() + RECHECK_MS) : ticket.exp * 1000, pending = await this.ctx.storage.getAlarm();
+    if (pending === null || pending <= Date.now() || want < pending)
+      await this.ctx.storage.setAlarm(want);
+  }
+  closeViewer(viewer, reason) {
+    for (let ws of this.ctx.getWebSockets("viewer")) {
+      let { stream, viewer: who } = this.socketViewer(ws);
+      if (who !== viewer)
+        continue;
+      this.tunnel.send({ type: "close", stream, code: 1008, reason });
+      try {
+        ws.close(1008, reason);
+      } catch {}
+    }
+  }
+  verdict(viewer, answer, now, open) {
+    if (answer?.status === 200) {
+      for (let [key, at] of this.verifiedAt)
+        if (now - at > STALE_MS)
+          this.verifiedAt.delete(key);
+      return this.verifiedAt.set(viewer, now), this.failingSince.delete(viewer), "ok";
+    }
+    if (answer?.status === 404 || answer?.status === 403)
+      this.verifiedAt.delete(viewer), this.failingSince.delete(viewer);
+    let box = this.boxSocket();
+    if (answer?.status === 404) {
+      if (box !== null)
+        this.retire(box, 4003, "share revoked");
+      return "revoked";
+    }
+    if (answer?.status === 403)
+      return this.closeViewer(viewer, "access ended"), "refused";
+    let verified = this.verifiedAt.get(viewer);
+    if (open && verified === void 0 && !this.failingSince.has(viewer))
+      this.failingSince.set(viewer, now);
+    let since = verified ?? (open ? this.failingSince.get(viewer) : 0);
+    if (now - since > STALE_MS) {
+      if (open)
+        this.closeViewer(viewer, "tesser can't confirm access right now");
+      return "stale";
+    }
+    return "unknown";
   }
   async alarm() {
     let ws = this.boxSocket();
     if (ws === null)
       return;
     let { ticket } = ws.deserializeAttachment();
-    if (ticket.exp * 1000 <= Date.now())
+    if (ticket.exp * 1000 <= Date.now()) {
       this.retire(ws, 4001, "share expired");
-    else
-      await this.ctx.storage.setAlarm(ticket.exp * 1000);
+      return;
+    }
+    for (let viewer of this.viewers()) {
+      let answer = await this.lookupBox(ticket.box, viewer).catch(() => null);
+      if (this.verdict(viewer, answer, Date.now(), !0) === "revoked")
+        return;
+    }
+    await this.armAlarm(ticket);
   }
   async bridge(request, target) {
-    let headers2 = [...target.headers].filter(([name]) => !/^sec-websocket-(key|version|extensions)$/i.test(name)), upgraded;
+    let headers = [...target.headers].filter(([name]) => !/^sec-websocket-(key|version|extensions)$/i.test(name)), upgraded;
     try {
-      upgraded = await this.tunnel.upgrade(target.port, target.path, headers2);
+      upgraded = await this.tunnel.upgrade(target.port, target.path, headers);
     } catch (err) {
       return plain(502, `${target.box.name} refused the websocket: ${err instanceof Error ? err.message : String(err)}`);
     }
     if (upgraded.head.status !== 101)
       return plain(502, `${target.box.name} answered ${upgraded.head.status} to the websocket`);
     let [client, server] = Object.values(new WebSocketPair);
-    this.ctx.acceptWebSocket(server, ["viewer", `v:${upgraded.stream}`]), server.serializeAttachment({ stream: upgraded.stream });
+    this.ctx.acceptWebSocket(server, ["viewer", `v:${upgraded.stream}`]);
+    let viewer = this.viewer(request);
+    try {
+      server.serializeAttachment({ stream: upgraded.stream, viewer });
+    } catch {
+      if (server.serializeAttachment({ stream: upgraded.stream, viewer: null }), viewer !== null)
+        this.unstored.set(upgraded.stream, viewer);
+    }
+    let ticket = this.live();
+    if (ticket !== null)
+      await this.armAlarm(ticket);
     let protocol = upgraded.head.headers.find(([name]) => name.toLowerCase() === "sec-websocket-protocol")?.[1];
     return new Response(null, { status: 101, webSocket: client, headers: protocol === void 0 ? {} : { "sec-websocket-protocol": protocol } });
   }
@@ -1008,29 +1097,29 @@ class GatewayBoxes extends DurableObject {
     if (this.ctx.getTags(ws).includes("box")) {
       if (typeof message === "string")
         return;
-      let frame2;
+      let frame;
       try {
-        frame2 = decodeFrame(new Uint8Array(message));
+        frame = decodeFrame(new Uint8Array(message));
       } catch {
         return;
       }
-      if (this.tunnel.onFrame(frame2))
+      if (this.tunnel.onFrame(frame))
         return;
-      let viewer = this.ctx.getWebSockets(`v:${frame2.stream}`)[0];
+      let viewer = this.ctx.getWebSockets(`v:${frame.stream}`)[0];
       if (viewer === void 0) {
-        if (frame2.type === "text" || frame2.type === "binary")
-          this.tunnel.send({ type: "close", stream: frame2.stream, code: 1001, reason: "the viewer went away" });
+        if (frame.type === "text" || frame.type === "binary")
+          this.tunnel.send({ type: "close", stream: frame.stream, code: 1001, reason: "the viewer went away" });
         return;
       }
       try {
-        if (frame2.type === "text")
-          viewer.send(frame2.text);
-        else if (frame2.type === "binary")
-          viewer.send(frame2.data);
-        else if (frame2.type === "close")
-          viewer.close(frame2.code, frame2.reason);
-        else if (frame2.type === "reset")
-          viewer.close(1011, frame2.reason.slice(0, 120));
+        if (frame.type === "text")
+          viewer.send(frame.text);
+        else if (frame.type === "binary")
+          viewer.send(frame.data);
+        else if (frame.type === "close")
+          viewer.close(frame.code, frame.reason);
+        else if (frame.type === "reset")
+          viewer.close(1011, frame.reason.slice(0, 120));
       } catch {}
       return;
     }
@@ -1044,52 +1133,43 @@ class GatewayBoxes extends DurableObject {
       this.retire(ws, 1000, "box hung up");
       return;
     }
-    let { stream } = ws.deserializeAttachment(), sendable = code === 1005 ? 1000 : code === 1004 || code === 1006 || code === 1015 || code < 1000 || code > 4999 ? 1001 : code;
+    let { stream } = ws.deserializeAttachment();
+    this.unstored.delete(stream);
+    let sendable = code === 1005 ? 1000 : code === 1004 || code === 1006 || code === 1015 || code < 1000 || code > 4999 ? 1001 : code;
     this.tunnel.send({ type: "close", stream, code: sendable, reason: reason.slice(0, 120) });
   }
   webSocketError(ws) {
     this.webSocketClose(ws, 1006, "socket error");
   }
-  tesser(method, path, jwt) {
-    let env = this.env;
-    return Effect3.tryPromise({
-      try: async () => {
-        let res = await fetch(`${env.TESSER_URL.replace(/\/$/, "")}/v1/${env.TESSER_ORG}${path}`, { method, headers: jwt === null ? {} : { [ACCESS_HEADER]: jwt } }), body2 = await res.json().catch(() => null);
-        return { status: res.status, body: body2 };
-      },
-      catch: (err) => new DirectoryUnavailable({ reason: err instanceof Error ? err.message : String(err) })
-    });
+  ask(call) {
+    return Effect3.tryPromise({ try: call, catch: (err) => new DirectoryUnavailable({ reason: err instanceof Error ? err.message : String(err) }) });
   }
-  layer(jwt) {
-    let self = this, remote = Effect3.fn("Cloudflare.remote")(function* (boxId) {
-      let { status: status2, body: body2 } = yield* self.tesser("GET", `/gateway/boxes/${boxId}`, jwt);
-      if (status2 === 403 || status2 === 404)
+  layer(viewer) {
+    let self = this, remote = Effect3.fn("Relay.remote")(function* (boxId) {
+      let { status, body } = yield* self.ask(() => self.lookupBox(boxId, viewer));
+      if (status === 403 || status === 404)
         return yield* new BoxNotShared({ boxId });
-      if (status2 !== 200) {
-        let message = Schema2.decodeUnknownOption(ErrorBody)(body2);
-        return yield* new DirectoryUnavailable({ reason: message._tag === "Some" ? message.value.error.message : `tesser answered ${status2}` });
+      if (status !== 200) {
+        let message = Schema2.decodeUnknownOption(ErrorBody)(body);
+        return yield* new DirectoryUnavailable({ reason: message._tag === "Some" ? message.value.error.message : `tesser answered ${status}` });
       }
-      return (yield* Schema2.decodeUnknownEffect(BoxResponse)(body2).pipe(Effect3.mapError(() => new DirectoryUnavailable({ reason: "tesser answered with a box this gateway can't read" })))).box;
-    }), lookup = Effect3.fn("Cloudflare.lookup")(function* (boxId) {
+      return (yield* Schema2.decodeUnknownEffect(BoxResponse)(body).pipe(Effect3.mapError(() => new DirectoryUnavailable({ reason: "tesser answered with a box this gateway can't read" })))).box;
+    }), lookup = Effect3.fn("Relay.lookup")(function* (boxId) {
       let ticket = self.live();
       if (ticket === null) {
         let box = yield* remote(boxId);
         return { ...box, power: box.power === "awake" ? "launching" : box.power };
       }
       let now = yield* Clock3.currentTimeMillis;
-      if (jwt !== null && now - self.verifiedAt > RECHECK_MS) {
-        let checked = yield* remote(boxId).pipe(Effect3.result);
-        if (checked._tag === "Success")
-          self.verifiedAt = now;
-        else if (checked.failure._tag === "BoxNotShared") {
-          let ws = self.boxSocket();
-          if (ws !== null)
-            self.retire(ws, 4003, "share revoked");
-          return yield* checked.failure;
-        }
+      if (viewer !== null && now - (self.verifiedAt.get(viewer) ?? 0) > RECHECK_MS) {
+        let answer = yield* self.ask(() => self.lookupBox(boxId, viewer)).pipe(Effect3.orElseSucceed(() => null)), verdict = self.verdict(viewer, answer, now, !1);
+        if (verdict === "revoked" || verdict === "refused")
+          return yield* new BoxNotShared({ boxId });
+        if (verdict === "stale")
+          return yield* new DirectoryUnavailable({ reason: "tesser didn't answer whether you can still open this box" });
       }
       return { boxId, name: ticket.name, sharedBy: ticket.sharedBy, privateIp: "", ports: ticket.ports, power: "awake", app: "running" };
-    }), wake = Effect3.fn("Cloudflare.wake")(function* (boxId, retry) {
+    }), wake = Effect3.fn("Relay.wake")(function* (boxId, retry) {
       let now = yield* Clock3.currentTimeMillis, current = self.waking;
       if (current?.inflight)
         return;
@@ -1099,20 +1179,20 @@ class GatewayBoxes extends DurableObject {
         return;
       let waking = { since: current === null || current.failure !== null || now - current.since > Duration2.toMillis(WAKE_TIMEOUT) ? now : current.since, kickedAt: now, failure: null, inflight: !0 };
       self.waking = waking;
-      let kicked = yield* self.tesser("POST", `/gateway/boxes/${boxId}/wake`, jwt).pipe(Effect3.result, Effect3.ensuring(Effect3.sync(() => waking.inflight = !1)));
+      let kicked = yield* self.ask(() => self.wakeBox(boxId, viewer)).pipe(Effect3.result, Effect3.ensuring(Effect3.sync(() => waking.inflight = !1)));
       if (kicked._tag === "Failure")
         return;
-      let { status: status2, body: body2 } = kicked.success;
-      if (status2 < 300 || status2 >= 500 || RETRYABLE.has(status2))
+      let { status, body } = kicked.success;
+      if (status < 300 || status >= 500 || RETRYABLE.has(status))
         return;
-      let message = Schema2.decodeUnknownOption(ErrorBody)(body2);
-      waking.failure = message._tag === "Some" ? message.value.error.message : `tesser answered ${status2}`;
-    }), status = Effect3.fn("Cloudflare.status")(function* (_boxId) {
+      let message = Schema2.decodeUnknownOption(ErrorBody)(body);
+      waking.failure = message._tag === "Some" ? message.value.error.message : `tesser answered ${status}`;
+    }), status = Effect3.fn("Relay.status")(function* (_boxId) {
       let now = yield* Clock3.currentTimeMillis, w = self.waking;
       if (w === null || w.failure === null && now - w.since > Duration2.toMillis(WAKE_TIMEOUT))
         return null;
       return { since: w.since, failure: w.failure };
-    }), dialed = (boxId, within, reason) => Effect3.promise(() => new Promise((resolve) => self.connected.push(resolve))).pipe(Effect3.timeoutOrElse({ duration: within, orElse: () => Effect3.fail(new WakeFailed({ boxId, reason })) })), awake = Effect3.fn("Cloudflare.awake")(function* (boxId) {
+    }), dialed = (boxId, within, reason) => Effect3.promise(() => new Promise((resolve) => self.connected.push(resolve))).pipe(Effect3.timeoutOrElse({ duration: within, orElse: () => Effect3.fail(new WakeFailed({ boxId, reason })) })), awake = Effect3.fn("Relay.awake")(function* (boxId) {
       if (self.live() === null)
         if ((yield* remote(boxId)).power === "awake")
           yield* dialed(boxId, DIAL_GRACE, "the box is up but hasn't connected to this gateway; its boxd may need an update");
@@ -1125,10 +1205,73 @@ class GatewayBoxes extends DurableObject {
         }
       return yield* lookup(boxId);
     }), upstream = (box, port, request) => Effect3.tryPromise({ try: () => self.tunnel.fetch(port, request), catch: () => new UpstreamRefused({ boxId: box.boxId, port }) });
-    return Layer.mergeAll(Layer.succeed(BoxDirectory)({ host: Effect3.succeed(self.env.GATEWAY_HOST), lookup }), Layer.succeed(Waker)({ wake, status, awake }), Layer.succeed(Upstream)({ fetch: upstream }));
+    return Layer.mergeAll(Layer.succeed(BoxDirectory)({ host: Effect3.succeed(self.host()), lookup }), Layer.succeed(Waker)({ wake, status, awake }), Layer.succeed(Upstream)({ fetch: upstream }));
+  }
+}
+
+// src/cloudflare.ts
+var ACCESS_HEADER = "cf-access-jwt-assertion", verifyTicket = Effect4.fn("Gateway.verifyTicket")(function* (env, request) {
+  let token = request.headers.get("authorization")?.match(/^Bearer (\S+)$/)?.[1];
+  if (token === void 0)
+    return null;
+  let issuer = env.TESSER_URL.replace(/\/$/, ""), claims = yield* verifyRs256(token, issuer, `${issuer}/.well-known/jwks.json`);
+  if (claims === null || !audienceIncludes(claims.aud, `https://${env.GATEWAY_HOST}`) || claims.org !== env.TESSER_ORG)
+    return null;
+  if (claims.sub !== `box:${env.TESSER_ORG}:${String(claims.box)}`)
+    return null;
+  return yield* Schema3.decodeUnknownEffect(Ticket)(claims).pipe(Effect4.option);
+}), verifyViewer = Effect4.fn("Gateway.verifyViewer")(function* (env, request) {
+  let token = request.headers.get(ACCESS_HEADER);
+  if (token === null)
+    return null;
+  let issuer = `https://${env.ACCESS_TEAM}`, claims = yield* verifyRs256(token, issuer, `${issuer}/cdn-cgi/access/certs`);
+  return claims !== null && audienceIncludes(claims.aud, env.ACCESS_AUD) ? claims : null;
+}), cloudflare_default = {
+  async fetch(request, env) {
+    let url = new URL(request.url), apex = url.hostname.toLowerCase() === env.GATEWAY_HOST.toLowerCase();
+    if (apex && url.pathname === GATEWAY_DIAL_PATH) {
+      if (request.headers.get("upgrade")?.toLowerCase() !== "websocket")
+        return plain(426, "boxes dial this with a websocket");
+      let ticket = await Effect4.runPromise(verifyTicket(env, request));
+      if (ticket === null || ticket._tag === "None")
+        return plain(401, "a box dials in with a share ticket signed by tesser");
+      let headers = new Headers(request.headers);
+      return headers.delete("authorization"), headers.set(TICKET_HEADER, JSON.stringify(ticket.value)), env.BOXES.get(env.BOXES.idFromName(ticket.value.box)).fetch(new Request(request, { headers }));
+    }
+    if (apex && url.pathname === "/__tesser/health")
+      return plain(200, "ok");
+    let boxId = gatewayHostBox(env.GATEWAY_HOST, url.hostname);
+    if (boxId === null)
+      return new Response(viewerPage({ kind: "not-shared" }), { status: 404, headers: STATUS_HEADERS });
+    if (await Effect4.runPromise(verifyViewer(env, request)) === null)
+      return plain(403, "this gateway only answers requests Cloudflare Access let through");
+    let headers = new Headers(request.headers);
+    return headers.delete(TICKET_HEADER), env.BOXES.get(env.BOXES.idFromName(boxId)).fetch(new Request(request, { headers }));
+  }
+};
+
+class GatewayBoxes extends BoxRelay {
+  host() {
+    return this.env.GATEWAY_HOST;
+  }
+  viewer(request) {
+    return request.headers.get(ACCESS_HEADER);
+  }
+  admits(ticket) {
+    return ticket.org === this.env.TESSER_ORG;
+  }
+  lookupBox(boxId, viewer) {
+    return this.tesser("GET", `/gateway/boxes/${boxId}`, viewer);
+  }
+  wakeBox(boxId, viewer) {
+    return this.tesser("POST", `/gateway/boxes/${boxId}/wake`, viewer);
+  }
+  async tesser(method, path, jwt) {
+    let res = await fetch(`${this.env.TESSER_URL.replace(/\/$/, "")}/v1/${this.env.TESSER_ORG}${path}`, { method, headers: jwt === null ? {} : { [ACCESS_HEADER]: jwt } }), body = await res.json().catch(() => null);
+    return { status: res.status, body };
   }
 }
 export {
-  cloudflare_default as default,
-  GatewayBoxes
+  GatewayBoxes,
+  cloudflare_default as default
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tesser-sh/gateway",
-  "version": "0.0.1",
+  "version": "0.53.2",
   "description": "Tesser's share gateway as a Cloudflare Worker and Durable Object, deployed in your own account",
   "license": "MIT",
   "type": "module",