@tesser-sh/gateway 0.53.2 → 0.55.0

package/index.js

@@ -43,10 +43,8 @@ li .name { flex: 1; min-width: 0; overflow-wrap: anywhere; }
 .ports a { color: inherit; text-decoration: none; }
 .ports a:hover { color: var(--bone); text-decoration: underline; text-decoration-color: var(--remote); text-underline-offset: 3px; }
 tesser-use { color: var(--faint); }
-tesser-wake { display: block; margin-top: 24px; }
 .bad { margin-top: 24px; color: var(--bad); font-size: 13px; }
 .open { margin-top: 24px; padding: 9px 16px; background: var(--remote); color: #171717; border: 0; font: 500 14px var(--sans); cursor: pointer; }
-.open:disabled { background: var(--rule); color: var(--dim); cursor: default; }
 a.open { display: inline-block; text-decoration: none; }
 .sub { margin-top: 8px; color: var(--dim); }
 .steps { list-style: none; padding: 0; margin-top: 24px; }
@@ -98,9 +96,11 @@ document.addEventListener("click", (event) => {
 // ../front/src/viewer.ts
 var STATUS = {
   waking: 503,
+  asleep: 503,
   booting: 503,
   "not-answering": 504,
   stopped: 502,
+  idle: 502,
   "wake-failed": 503,
   "no-port": 404,
   "not-shared": 404,
@@ -113,12 +113,16 @@ function viewerText(state) {
   switch (state.kind) {
     case "waking":
       return `${state.box.name} is waking up; retry shortly`;
+    case "asleep":
+      return `${state.box.name} is asleep; open it in a browser to wake it`;
     case "booting":
       return `${state.box.name} is booting; retry shortly`;
     case "not-answering":
       return `${state.box.name} isn't answering on port ${state.port}`;
     case "stopped":
       return `${state.box.name} has stopped`;
+    case "idle":
+      return `nothing is running on ${state.box.name}`;
     case "wake-failed":
       return `${state.box.name} didn't wake up: ${state.reason}`;
     case "no-port":
@@ -143,7 +147,10 @@ function steps(stage, port, seconds) {
 function who(box) {
   return box.sharedBy === null ? "" : `<p class="who">Shared by ${escapeHtml(box.sharedBy)}</p>`;
 }
-function body(state) {
+function cmd(command) {
+  return `<div class="cmd"><code>${escapeHtml(command)}</code><button type="button" data-copy="${escapeHtml(command)}">Copy</button></div>`;
+}
+function body(state, owner) {
   switch (state.kind) {
     case "waking":
       return {
@@ -152,6 +159,13 @@ function body(state) {
         retry: !0,
         rest: `${who(state.box)}${steps(state.stage, state.port, state.seconds)}<p class="hint">Usually about 30 seconds. This page opens the app by itself.</p>`
       };
+    case "asleep":
+      return {
+        headline: `${state.box.name} is asleep`,
+        spinner: !1,
+        retry: !1,
+        rest: `${who(state.box)}<p class="sub">It went to sleep while nobody was using it.</p><a class="open" href="">Wake it</a>`
+      };
     case "booting":
       return { headline: `${state.box.name} is booting`, spinner: !0, retry: !0, rest: `${who(state.box)}<p class="hint">A fresh machine takes a minute or two. This page opens the app by itself.</p>` };
     case "not-answering":
@@ -159,21 +173,28 @@ function body(state) {
         headline: `${state.box.name} isn't answering on port ${state.port}`,
         spinner: !0,
         retry: !0,
-        rest: `${who(state.box)}<p class="hint">The box is up but the app hasn't answered yet. Still trying.</p>`
+        rest: `${who(state.box)}<p class="hint">The box is up but the app hasn't answered yet. Still trying.</p>${owner ? cmd(`tesser logs ${state.box.boxId} -f`) : ""}`
       };
     case "stopped":
       return {
         headline: `${state.box.name} has stopped`,
         spinner: !1,
         retry: !0,
-        rest: `${who(state.box)}<p class="sub">The app on this box exited. ${state.box.sharedBy === null ? "Ask whoever shared it" : "Ask them"} to restart it.</p>`
+        rest: owner ? cmd(`tesser logs ${state.box.boxId}`) : `${who(state.box)}<p class="sub">The app on this box exited. ${state.box.sharedBy === null ? "Ask whoever shared it" : "Ask them"} to restart it.</p>`
+      };
+    case "idle":
+      return {
+        headline: `Nothing is running on ${state.box.name}`,
+        spinner: !1,
+        retry: !0,
+        rest: owner ? cmd("tesser dev") : `${who(state.box)}<p class="sub">${state.box.sharedBy === null ? "Ask whoever shared it" : "Ask them"} to start the app.</p>`
       };
     case "wake-failed":
       return {
         headline: `${state.box.name} didn't wake up`,
         spinner: !1,
         retry: !1,
-        rest: `${who(state.box)}<p class="bad">${escapeHtml(state.reason)}</p><button type="button" class="open" onclick="location.reload()">Try again</button>`
+        rest: `${who(state.box)}<p class="bad">${escapeHtml(state.reason)}</p><a class="open" href="">Try again</a>`
       };
     case "no-port":
       return {
@@ -188,12 +209,12 @@ function body(state) {
       return { headline: "Can't check what's shared", spinner: !0, retry: !0, rest: `<p class="sub">This gateway can't reach tesser right now. Retrying.</p>` };
   }
 }
-function viewerPage(state) {
-  let { headline, spinner, retry, rest } = body(state), main = `<main>
+function viewerPage(state, owner = !1) {
+  let { headline, spinner, retry, rest } = body(state, owner), main = `<main>
 <h1>${spinner ? '<span class="sq"></span>' : ""}${escapeHtml(headline)}</h1>
 ${rest}
 </main>`;
-  return shell(`${headline} · tesser`, main, retry ? RETRY : "", !1);
+  return shell(`${headline} · tesser`, main, retry ? RETRY : "", owner);
 }
 
 // ../protocol/src/table.ts
@@ -320,7 +341,7 @@ function decodeFrame(buf) {
 }
 
 // src/cloudflare.ts
-import { Effect as Effect4, Schema as Schema3 } from "effect";
+import { Effect as Effect5, Schema as Schema3 } from "effect";
 
 // src/jwt.ts
 import { Clock, Effect, Option } from "effect";
@@ -382,7 +403,120 @@ function audienceIncludes(aud, expected) {
 
 // src/relay.ts
 import { DurableObject } from "cloudflare:workers";
-import { Clock as Clock3, Duration as Duration2, Effect as Effect3, Layer, Schema as Schema2 } from "effect";
+import { Clock as Clock3, Duration as Duration2, Effect as Effect4, Layer as Layer2, Schema as Schema2 } from "effect";
+
+// ../front/src/http.ts
+var HOP_BY_HOP = [
+  "connection",
+  "keep-alive",
+  "proxy-authenticate",
+  "proxy-authorization",
+  "proxy-connection",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade"
+];
+function withoutHopByHop(source) {
+  let headers = new Headers(source), connectionHeaders = headers.get("connection")?.split(",").map((name) => name.trim()).filter(Boolean) ?? [];
+  for (let name of [...HOP_BY_HOP, ...connectionHeaders])
+    headers.delete(name);
+  return headers;
+}
+function wantsDocument(request) {
+  return request.method === "GET" && (request.headers.get("sec-fetch-mode") === "navigate" || request.headers.get("accept")?.toLowerCase().includes("text/html") === !0);
+}
+function userNavigation(request) {
+  return request.headers.get("sec-fetch-mode") === "navigate" && request.headers.get("sec-fetch-user") === "?1";
+}
+
+// ../proxy/src/core.ts
+import { Clock as Clock2, Context, Duration, Effect as Effect2, Schedule, Schema } from "effect";
+
+class BoxNotShared extends Schema.TaggedError()("BoxNotShared", { boxId: Schema.String }) {
+}
+
+class DirectoryUnavailable extends Schema.TaggedError()("DirectoryUnavailable", { reason: Schema.String }) {
+}
+
+class BoxAsleep extends Schema.TaggedError()("BoxAsleep", { boxId: Schema.String }) {
+}
+
+class WakeFailed extends Schema.TaggedError()("WakeFailed", { boxId: Schema.String, reason: Schema.String }) {
+}
+
+class UpstreamRefused extends Schema.TaggedError()("UpstreamRefused", { boxId: Schema.String, port: Schema.Number }) {
+}
+
+class Resolver extends Context.Service()("@tesser/proxy/Resolver") {
+}
+
+class Waker extends Context.Service()("@tesser/proxy/Waker") {
+}
+var WAKING_WINDOW = Duration.minutes(5), startingRetry = { schedule: Schedule.spaced(Duration.seconds(1)), times: 60 }, respond = (response) => ({ _tag: "response", response });
+function viewerResponse(request, state, owner = !1) {
+  let status = viewerStatus(state);
+  if (wantsDocument(request))
+    return new Response(viewerPage(state, owner), { status, headers: STATUS_HEADERS });
+  return new Response(`${viewerText(state)}
+`, { status, headers: { "content-type": "text/plain; charset=utf-8", "cache-control": "no-store", "x-tesser-status": "1" } });
+}
+var page = (request, state) => Effect2.map(Resolver, ({ owner }) => respond(viewerResponse(request, state, owner)));
+function viewerBox(box) {
+  return { boxId: box.boxId, name: box.name, sharedBy: box.sharedBy };
+}
+var wakingPage = Effect2.fn("Proxy.wakingPage")(function* (request, box, port, stage, since) {
+  let now = yield* Clock2.currentTimeMillis;
+  return yield* page(request, { kind: "waking", box: viewerBox(box), stage, port, seconds: Math.max(0, Math.round((now - since) / 1000)) });
+}), refused = Effect2.fn("Proxy.refused")(function* (request, box, port) {
+  let status = yield* (yield* Waker).status(box.boxId), now = yield* Clock2.currentTimeMillis;
+  if (box.app === "exited")
+    return yield* page(request, { kind: "stopped", box: viewerBox(box) });
+  if (status !== null && now - status.since < Duration.toMillis(WAKING_WINDOW))
+    return yield* wakingPage(request, box, port, box.app === "running" ? "port" : "app", status.since);
+  if (box.app === "none")
+    return yield* page(request, { kind: "idle", box: viewerBox(box) });
+  return yield* page(request, { kind: "not-answering", box: viewerBox(box), port });
+}), serve = Effect2.fn("Proxy.serve")(function* (request, route, box) {
+  let { port, path, headers } = route;
+  if (request.headers.get("upgrade")?.toLowerCase() === "websocket")
+    return { _tag: "websocket", box, port, path, headers };
+  let replayable = request.method === "GET" || request.method === "HEAD", document = wantsDocument(request), attempt = Effect2.suspend(() => route.fetch(box, new Request(`http://${headers.get("host")}${path}`, {
+    method: request.method,
+    headers,
+    body: replayable ? void 0 : request.body,
+    redirect: "manual",
+    signal: request.signal,
+    ...replayable ? {} : { duplex: "half" }
+  })));
+  return yield* (document || !replayable ? attempt : attempt.pipe(Effect2.retry(startingRetry))).pipe(Effect2.flatMap((response) => Effect2.map(route.present(box, response), respond)), Effect2.catchTag("UpstreamRefused", () => document ? refused(request, box, port) : page(request, { kind: "not-answering", box: viewerBox(box), port })));
+}), handle = Effect2.fn("Proxy.handle")(function* (request) {
+  let resolved = yield* (yield* Resolver).resolve(request);
+  if (resolved instanceof Response)
+    return respond(resolved);
+  let { box, port } = resolved, waker = yield* Waker;
+  if (box.power !== "awake") {
+    if (box.power === "asleep" && userNavigation(request))
+      yield* waker.wake(box.boxId);
+    let status = yield* waker.status(box.boxId);
+    if (box.power === "asleep" && status?.failure)
+      return yield* page(request, { kind: "wake-failed", box: viewerBox(box), reason: status.failure });
+    if (box.power === "asleep" && status === null)
+      return yield* page(request, { kind: "asleep", box: viewerBox(box) });
+    if (wantsDocument(request)) {
+      if (box.power === "launching" && status === null)
+        return yield* page(request, { kind: "booting", box: viewerBox(box) });
+      return yield* wakingPage(request, box, port, "machine", status?.since ?? (yield* Clock2.currentTimeMillis));
+    }
+    return yield* serve(request, resolved, yield* waker.awake(box.boxId));
+  }
+  return yield* serve(request, resolved, box);
+}, (effect, request) => effect.pipe(Effect2.catchTags({
+  BoxAsleep: (e) => page(request, { kind: "asleep", box: { boxId: e.boxId, name: e.boxId, sharedBy: null } }),
+  BoxNotShared: () => page(request, { kind: "not-shared" }),
+  DirectoryUnavailable: () => page(request, { kind: "unavailable" }),
+  WakeFailed: (e) => page(request, { kind: "wake-failed", box: { boxId: e.boxId, name: e.boxId, sharedBy: null }, reason: e.reason })
+})));
 
 // ../front/src/csp.ts
 var SCRIPT_DIRECTIVES = ["connect-src", "script-src"];
@@ -420,28 +554,6 @@ function scriptNonce(policy) {
   return;
 }
 
-// ../front/src/http.ts
-var HOP_BY_HOP = [
-  "connection",
-  "keep-alive",
-  "proxy-authenticate",
-  "proxy-authorization",
-  "proxy-connection",
-  "te",
-  "trailer",
-  "transfer-encoding",
-  "upgrade"
-];
-function withoutHopByHop(source) {
-  let headers = new Headers(source), connectionHeaders = headers.get("connection")?.split(",").map((name) => name.trim()).filter(Boolean) ?? [];
-  for (let name of [...HOP_BY_HOP, ...connectionHeaders])
-    headers.delete(name);
-  return headers;
-}
-function wantsDocument(request) {
-  return request.method === "GET" && (request.headers.get("sec-fetch-mode") === "navigate" || request.headers.get("accept")?.toLowerCase().includes("text/html") === !0);
-}
-
 // ../front/src/shim.ts
 function rewriteUrl(input, ws, ctx) {
   let url;
@@ -578,10 +690,10 @@ function shimTag(params, nonce) {
   return `<script${nonce ? ` nonce="${nonce}"` : ""} src="/__tesser/shim.js?${query.toString().replace(/&/g, "&amp;")}"></script>`;
 }
 
-// src/core.ts
-import { Clock as Clock2, Context, Duration, Effect as Effect2, Schedule, Schema } from "effect";
+// ../proxy/src/share.ts
+import { Context as Context2, Effect as Effect3, Layer } from "effect";
 
-// src/route.ts
+// ../proxy/src/route.ts
 var PORT_PATH = /^\/__tesser\/(?:([a-z0-9-]+(?:\.[a-z0-9-]+)*)\.)?(\d{1,5})(\/.*)?$/;
 function parseTarget(gatewayHost, url) {
   let bare = url.hostname.toLowerCase().replace(/\.$/, ""), suffix = `.${gatewayHost.toLowerCase()}`;
@@ -609,38 +721,13 @@ function portOrigin(protocol, target, port, first) {
   return `${protocol}//${target.sub === "" ? "" : `${target.sub}.`}${gatewayLabel(target.boxId, port === first ? null : port)}.${target.gateway}`;
 }
 
-// src/core.ts
-class BoxNotShared extends Schema.TaggedError()("BoxNotShared", { boxId: Schema.String }) {
+// ../proxy/src/share.ts
+class BoxDirectory extends Context2.Service()("@tesser/proxy/BoxDirectory") {
 }
 
-class DirectoryUnavailable extends Schema.TaggedError()("DirectoryUnavailable", { reason: Schema.String }) {
-}
-
-class WakeFailed extends Schema.TaggedError()("WakeFailed", { boxId: Schema.String, reason: Schema.String }) {
-}
-
-class UpstreamRefused extends Schema.TaggedError()("UpstreamRefused", { boxId: Schema.String, port: Schema.Number }) {
-}
-
-class BoxDirectory extends Context.Service()("@tesser/gateway/BoxDirectory") {
-}
-
-class Waker extends Context.Service()("@tesser/gateway/Waker") {
-}
-
-class Upstream extends Context.Service()("@tesser/gateway/Upstream") {
-}
-var VIEWER_COOKIE = "__Host-tesser-viewer", GATEWAY_COOKIES = /* @__PURE__ */ new Set(["CF_Authorization", VIEWER_COOKIE]), WAKING_WINDOW = Duration.minutes(5), startingRetry = { schedule: Schedule.spaced(Duration.seconds(1)), times: 60 }, respond = (response) => ({ _tag: "response", response });
-function page(request, state) {
-  let status = viewerStatus(state);
-  if (wantsDocument(request))
-    return respond(new Response(viewerPage(state), { status, headers: STATUS_HEADERS }));
-  return respond(new Response(`${viewerText(state)}
-`, { status, headers: { "content-type": "text/plain; charset=utf-8", "cache-control": "no-store", "x-tesser-status": "1" } }));
-}
-function viewerBox(box) {
-  return { name: box.name, sharedBy: box.sharedBy };
+class Upstream extends Context2.Service()("@tesser/proxy/Upstream") {
 }
+var VIEWER_COOKIE = "__Host-tesser-viewer", GATEWAY_COOKIES = /* @__PURE__ */ new Set(["CF_Authorization", VIEWER_COOKIE]);
 function upstreamHeaders(request, target, port, root) {
   let headers = withoutHopByHop(request.headers);
   for (let name of [...headers.keys()])
@@ -696,65 +783,35 @@ function downstream(request, response, upstreamUrl, ctx, shownOrigin) {
   });
   return new HTMLRewriter().on("head", inject).on("body", inject).on("a[href], area[href], link[href]", link("href")).on("form[action]", link("action")).on("button[formaction], input[formaction]", link("formaction")).on("script[src], img[src], iframe[src], source[src], video[src], audio[src], embed[src]", link("src")).on("img[srcset], source[srcset]", link("srcset", (value) => rewriteSrcset(value, (url) => rewriteUrl(url, !1, ctx)))).transform(new Response(response.body, init));
 }
-var wakingPage = Effect2.fn("Gateway.wakingPage")(function* (request, box, port, stage, since) {
-  let now = yield* Clock2.currentTimeMillis;
-  return page(request, { kind: "waking", box: viewerBox(box), stage, port, seconds: Math.max(0, Math.round((now - since) / 1000)) });
-}), refused = Effect2.fn("Gateway.refused")(function* (request, box, port) {
-  let status = yield* (yield* Waker).status(box.boxId), now = yield* Clock2.currentTimeMillis;
-  if (box.app === "exited")
-    return page(request, { kind: "stopped", box: viewerBox(box) });
-  if (status !== null && now - status.since < Duration.toMillis(WAKING_WINDOW))
-    return yield* wakingPage(request, box, port, box.app === "running" ? "port" : "app", status.since);
-  return page(request, { kind: "not-answering", box: viewerBox(box), port });
-}), serve = Effect2.fn("Gateway.serve")(function* (request, target, box, port, root) {
-  let headers = upstreamHeaders(request, target, port, root);
-  if (request.headers.get("upgrade")?.toLowerCase() === "websocket")
-    return { _tag: "websocket", box, port, path: target.path, headers };
-  let ctx = { href: request.url, host: target.boxHost, ports: box.ports, port: root }, upstreamUrl = `http://${headers.get("host")}${target.path}`, shownOrigin = headers.get("origin"), replayable = request.method === "GET" || request.method === "HEAD", document = wantsDocument(request), upstream = yield* Upstream, attempt = Effect2.suspend(() => upstream.fetch(box, port, new Request(upstreamUrl, {
-    method: request.method,
-    headers,
-    body: replayable ? void 0 : request.body,
-    redirect: "manual",
-    signal: request.signal,
-    ...replayable ? {} : { duplex: "half" }
-  })));
-  return yield* (document || !replayable ? attempt : attempt.pipe(Effect2.retry(startingRetry))).pipe(Effect2.map((response) => respond(downstream(request, response, upstreamUrl, ctx, shownOrigin))), Effect2.catchTag("UpstreamRefused", () => document ? refused(request, box, port) : Effect2.succeed(page(request, { kind: "not-answering", box: viewerBox(box), port }))));
-}), handle = Effect2.fn("Gateway.handle")(function* (request) {
-  let directory = yield* BoxDirectory, waker = yield* Waker, url = new URL(request.url), host = yield* directory.host, target = parseTarget(host, url);
-  if (target === null)
-    return page(request, { kind: "not-shared" });
-  if (target.port === null && url.pathname === "/__tesser/shim.js")
-    return respond(new Response(shimSource(), { headers: { "content-type": "text/javascript; charset=utf-8", "cache-control": "public, max-age=300" } }));
-  let box = yield* directory.lookup(target.boxId), first = box.ports[0];
-  if (first === void 0)
-    return page(request, { kind: "no-port", box: viewerBox(box), port: target.port ?? target.root ?? 0, ports: [] });
-  let root = target.root ?? first, port = target.port ?? root;
-  if (!box.ports.includes(root) || !box.ports.includes(port)) {
-    let ports = box.ports.map((p) => ({ port: p, href: `${portOrigin(url.protocol, target, p, first)}/` }));
-    return page(request, { kind: "no-port", box: viewerBox(box), port: box.ports.includes(root) ? port : root, ports });
-  }
-  if (target.port !== null && request.headers.get("sec-fetch-mode") === "navigate")
-    return respond(new Response(null, { status: 307, headers: { location: `${portOrigin(url.protocol, target, port, first)}${target.path}`, "cache-control": "no-store" } }));
-  if (box.power !== "awake") {
-    let navigate = request.headers.get("sec-fetch-mode") === "navigate";
-    if (box.power === "asleep")
-      yield* waker.wake(box.boxId, navigate);
-    let status = yield* waker.status(box.boxId);
-    if (status?.failure && box.power === "asleep")
-      return page(request, { kind: "wake-failed", box: viewerBox(box), reason: status.failure });
-    if (wantsDocument(request)) {
-      if (box.power === "launching" && status === null)
-        return page(request, { kind: "booting", box: viewerBox(box) });
-      return yield* wakingPage(request, box, port, "machine", status?.since ?? (yield* Clock2.currentTimeMillis));
+var shareResolver = Layer.effect(Resolver, Effect3.gen(function* () {
+  let directory = yield* BoxDirectory, upstream = yield* Upstream;
+  return { owner: !1, resolve: Effect3.fn("Share.resolve")(function* (request) {
+    let url = new URL(request.url), target = parseTarget(yield* directory.host, url);
+    if (target === null)
+      return viewerResponse(request, { kind: "not-shared" });
+    if (target.port === null && url.pathname === "/__tesser/shim.js")
+      return new Response(shimSource(), { headers: { "content-type": "text/javascript; charset=utf-8", "cache-control": "public, max-age=300" } });
+    let box = yield* directory.lookup(target.boxId), first = box.ports[0];
+    if (first === void 0)
+      return viewerResponse(request, { kind: "no-port", box: viewerBox(box), port: target.port ?? target.root ?? 0, ports: [] });
+    let root = target.root ?? first, port = target.port ?? root;
+    if (!box.ports.includes(root) || !box.ports.includes(port)) {
+      let ports = box.ports.map((p) => ({ port: p, href: `${portOrigin(url.protocol, target, p, first)}/` }));
+      return viewerResponse(request, { kind: "no-port", box: viewerBox(box), port: box.ports.includes(root) ? port : root, ports });
     }
-    return yield* serve(request, target, yield* waker.awake(box.boxId), port, root);
-  }
-  return yield* serve(request, target, box, port, root);
-}, (effect, request) => effect.pipe(Effect2.catchTags({
-  BoxNotShared: () => Effect2.succeed(page(request, { kind: "not-shared" })),
-  DirectoryUnavailable: () => Effect2.succeed(page(request, { kind: "unavailable" })),
-  WakeFailed: (e) => Effect2.succeed(page(request, { kind: "wake-failed", box: { name: e.boxId, sharedBy: null }, reason: e.reason }))
-})));
+    if (target.port !== null && request.headers.get("sec-fetch-mode") === "navigate")
+      return new Response(null, { status: 307, headers: { location: `${portOrigin(url.protocol, target, port, first)}${target.path}`, "cache-control": "no-store" } });
+    let headers = upstreamHeaders(request, target, port, root), upstreamUrl = `http://${headers.get("host")}${target.path}`, shownOrigin = headers.get("origin");
+    return {
+      box,
+      port,
+      path: target.path,
+      headers,
+      fetch: (served, upstreamRequest) => upstream.fetch(served, port, upstreamRequest),
+      present: (served, response) => Effect3.sync(() => downstream(request, response, upstreamUrl, { href: request.url, host: target.boxHost, ports: served.ports, port: root }, shownOrigin))
+    };
+  }) };
+}));
 
 // src/tunnel.ts
 var UPGRADE_TIMEOUT_MS = 30000, NULL_BODY = /* @__PURE__ */ new Set([101, 204, 205, 304]);
@@ -987,7 +1044,7 @@ class BoxRelay extends DurableObject {
         return plain(403, "this box answers for another org here");
       return this.acceptBox(decoded.value);
     }
-    let handled = await Effect3.runPromise(handle(request).pipe(Effect3.provide(this.layer(this.viewer(request)))));
+    let handled = await Effect4.runPromise(handle(request).pipe(Effect4.provide(this.layer(this.viewer(request)))));
     if (handled._tag === "response")
       return handled.response;
     return this.bridge(request, handled);
@@ -1142,10 +1199,10 @@ class BoxRelay extends DurableObject {
     this.webSocketClose(ws, 1006, "socket error");
   }
   ask(call) {
-    return Effect3.tryPromise({ try: call, catch: (err) => new DirectoryUnavailable({ reason: err instanceof Error ? err.message : String(err) }) });
+    return Effect4.tryPromise({ try: call, catch: (err) => new DirectoryUnavailable({ reason: err instanceof Error ? err.message : String(err) }) });
   }
   layer(viewer) {
-    let self = this, remote = Effect3.fn("Relay.remote")(function* (boxId) {
+    let self = this, remote = Effect4.fn("Relay.remote")(function* (boxId) {
       let { status, body } = yield* self.ask(() => self.lookupBox(boxId, viewer));
       if (status === 403 || status === 404)
         return yield* new BoxNotShared({ boxId });
@@ -1153,33 +1210,19 @@ class BoxRelay extends DurableObject {
         let message = Schema2.decodeUnknownOption(ErrorBody)(body);
         return yield* new DirectoryUnavailable({ reason: message._tag === "Some" ? message.value.error.message : `tesser answered ${status}` });
       }
-      return (yield* Schema2.decodeUnknownEffect(BoxResponse)(body).pipe(Effect3.mapError(() => new DirectoryUnavailable({ reason: "tesser answered with a box this gateway can't read" })))).box;
-    }), lookup = Effect3.fn("Relay.lookup")(function* (boxId) {
-      let ticket = self.live();
-      if (ticket === null) {
-        let box = yield* remote(boxId);
-        return { ...box, power: box.power === "awake" ? "launching" : box.power };
-      }
-      let now = yield* Clock3.currentTimeMillis;
-      if (viewer !== null && now - (self.verifiedAt.get(viewer) ?? 0) > RECHECK_MS) {
-        let answer = yield* self.ask(() => self.lookupBox(boxId, viewer)).pipe(Effect3.orElseSucceed(() => null)), verdict = self.verdict(viewer, answer, now, !1);
-        if (verdict === "revoked" || verdict === "refused")
-          return yield* new BoxNotShared({ boxId });
-        if (verdict === "stale")
-          return yield* new DirectoryUnavailable({ reason: "tesser didn't answer whether you can still open this box" });
-      }
-      return { boxId, name: ticket.name, sharedBy: ticket.sharedBy, privateIp: "", ports: ticket.ports, power: "awake", app: "running" };
-    }), wake = Effect3.fn("Relay.wake")(function* (boxId, retry) {
+      return (yield* Schema2.decodeUnknownEffect(BoxResponse)(body).pipe(Effect4.mapError(() => new DirectoryUnavailable({ reason: "tesser answered with a box this gateway can't read" })))).box;
+    }), kick = Effect4.fn("Relay.kick")(function* (boxId, asked) {
       let now = yield* Clock3.currentTimeMillis, current = self.waking;
       if (current?.inflight)
         return;
-      if (current?.failure && !retry)
-        return;
       if (current !== null && current.failure === null && now - current.kickedAt < WAKE_RETRY_MS)
         return;
-      let waking = { since: current === null || current.failure !== null || now - current.since > Duration2.toMillis(WAKE_TIMEOUT) ? now : current.since, kickedAt: now, failure: null, inflight: !0 };
+      let fresh = current === null || current.failure !== null || now - current.since > Duration2.toMillis(WAKE_TIMEOUT);
+      if (fresh && !asked)
+        return;
+      let waking = { since: fresh ? now : current.since, kickedAt: now, failure: null, inflight: !0 };
       self.waking = waking;
-      let kicked = yield* self.ask(() => self.wakeBox(boxId, viewer)).pipe(Effect3.result, Effect3.ensuring(Effect3.sync(() => waking.inflight = !1)));
+      let kicked = yield* self.ask(() => self.wakeBox(boxId, viewer)).pipe(Effect4.result, Effect4.ensuring(Effect4.sync(() => waking.inflight = !1)));
       if (kicked._tag === "Failure")
         return;
       let { status, body } = kicked.success;
@@ -1187,30 +1230,50 @@ class BoxRelay extends DurableObject {
         return;
       let message = Schema2.decodeUnknownOption(ErrorBody)(body);
       waking.failure = message._tag === "Some" ? message.value.error.message : `tesser answered ${status}`;
-    }), status = Effect3.fn("Relay.status")(function* (_boxId) {
+    }), wake = (boxId) => kick(boxId, !0), lookup = Effect4.fn("Relay.lookup")(function* (boxId) {
+      let ticket = self.live();
+      if (ticket === null) {
+        let box = yield* remote(boxId);
+        if (box.power === "asleep")
+          yield* kick(boxId, !1);
+        return { ...box, power: box.power === "awake" ? "launching" : box.power };
+      }
+      let now = yield* Clock3.currentTimeMillis;
+      if (viewer !== null && now - (self.verifiedAt.get(viewer) ?? 0) > RECHECK_MS) {
+        let answer = yield* self.ask(() => self.lookupBox(boxId, viewer)).pipe(Effect4.orElseSucceed(() => null)), verdict = self.verdict(viewer, answer, now, !1);
+        if (verdict === "revoked" || verdict === "refused")
+          return yield* new BoxNotShared({ boxId });
+        if (verdict === "stale")
+          return yield* new DirectoryUnavailable({ reason: "tesser didn't answer whether you can still open this box" });
+      }
+      return { boxId, name: ticket.name, sharedBy: ticket.sharedBy, privateIp: "", ports: ticket.ports, power: "awake", app: "running" };
+    }), status = Effect4.fn("Relay.status")(function* (_boxId) {
       let now = yield* Clock3.currentTimeMillis, w = self.waking;
       if (w === null || w.failure === null && now - w.since > Duration2.toMillis(WAKE_TIMEOUT))
         return null;
       return { since: w.since, failure: w.failure };
-    }), dialed = (boxId, within, reason) => Effect3.promise(() => new Promise((resolve) => self.connected.push(resolve))).pipe(Effect3.timeoutOrElse({ duration: within, orElse: () => Effect3.fail(new WakeFailed({ boxId, reason })) })), awake = Effect3.fn("Relay.awake")(function* (boxId) {
-      if (self.live() === null)
-        if ((yield* remote(boxId)).power === "awake")
+    }), dialed = (boxId, within, reason) => Effect4.promise(() => new Promise((resolve) => self.connected.push(resolve))).pipe(Effect4.timeoutOrElse({ duration: within, orElse: () => Effect4.fail(new WakeFailed({ boxId, reason })) })), awake = Effect4.fn("Relay.awake")(function* (boxId) {
+      if (self.live() === null) {
+        let box = yield* remote(boxId);
+        if (box.power === "awake")
           yield* dialed(boxId, DIAL_GRACE, "the box is up but hasn't connected to this gateway; its boxd may need an update");
         else {
-          yield* wake(boxId, !1);
-          let failure = self.waking?.failure;
-          if (failure)
-            return yield* new WakeFailed({ boxId, reason: failure });
+          let waking = yield* status(boxId);
+          if (waking?.failure)
+            return yield* new WakeFailed({ boxId, reason: waking.failure });
+          if (box.power === "asleep" && waking === null)
+            return yield* new BoxAsleep({ boxId });
           yield* dialed(boxId, WAKE_TIMEOUT, "it didn't wake up within 5 minutes");
         }
+      }
       return yield* lookup(boxId);
-    }), upstream = (box, port, request) => Effect3.tryPromise({ try: () => self.tunnel.fetch(port, request), catch: () => new UpstreamRefused({ boxId: box.boxId, port }) });
-    return Layer.mergeAll(Layer.succeed(BoxDirectory)({ host: Effect3.succeed(self.host()), lookup }), Layer.succeed(Waker)({ wake, status, awake }), Layer.succeed(Upstream)({ fetch: upstream }));
+    }), upstream = (box, port, request) => Effect4.tryPromise({ try: () => self.tunnel.fetch(port, request), catch: () => new UpstreamRefused({ boxId: box.boxId, port }) });
+    return Layer2.merge(Layer2.provide(shareResolver, Layer2.merge(Layer2.succeed(BoxDirectory)({ host: Effect4.succeed(self.host()), lookup }), Layer2.succeed(Upstream)({ fetch: upstream }))), Layer2.succeed(Waker)({ wake, status, awake }));
   }
 }
 
 // src/cloudflare.ts
-var ACCESS_HEADER = "cf-access-jwt-assertion", verifyTicket = Effect4.fn("Gateway.verifyTicket")(function* (env, request) {
+var ACCESS_HEADER = "cf-access-jwt-assertion", verifyTicket = Effect5.fn("Gateway.verifyTicket")(function* (env, request) {
   let token = request.headers.get("authorization")?.match(/^Bearer (\S+)$/)?.[1];
   if (token === void 0)
     return null;
@@ -1219,8 +1282,8 @@ var ACCESS_HEADER = "cf-access-jwt-assertion", verifyTicket = Effect4.fn("Gatewa
     return null;
   if (claims.sub !== `box:${env.TESSER_ORG}:${String(claims.box)}`)
     return null;
-  return yield* Schema3.decodeUnknownEffect(Ticket)(claims).pipe(Effect4.option);
-}), verifyViewer = Effect4.fn("Gateway.verifyViewer")(function* (env, request) {
+  return yield* Schema3.decodeUnknownEffect(Ticket)(claims).pipe(Effect5.option);
+}), verifyViewer = Effect5.fn("Gateway.verifyViewer")(function* (env, request) {
   let token = request.headers.get(ACCESS_HEADER);
   if (token === null)
     return null;
@@ -1232,7 +1295,7 @@ var ACCESS_HEADER = "cf-access-jwt-assertion", verifyTicket = Effect4.fn("Gatewa
     if (apex && url.pathname === GATEWAY_DIAL_PATH) {
       if (request.headers.get("upgrade")?.toLowerCase() !== "websocket")
         return plain(426, "boxes dial this with a websocket");
-      let ticket = await Effect4.runPromise(verifyTicket(env, request));
+      let ticket = await Effect5.runPromise(verifyTicket(env, request));
       if (ticket === null || ticket._tag === "None")
         return plain(401, "a box dials in with a share ticket signed by tesser");
       let headers = new Headers(request.headers);
@@ -1243,7 +1306,7 @@ var ACCESS_HEADER = "cf-access-jwt-assertion", verifyTicket = Effect4.fn("Gatewa
     let boxId = gatewayHostBox(env.GATEWAY_HOST, url.hostname);
     if (boxId === null)
       return new Response(viewerPage({ kind: "not-shared" }), { status: 404, headers: STATUS_HEADERS });
-    if (await Effect4.runPromise(verifyViewer(env, request)) === null)
+    if (await Effect5.runPromise(verifyViewer(env, request)) === null)
       return plain(403, "this gateway only answers requests Cloudflare Access let through");
     let headers = new Headers(request.headers);
     return headers.delete(TICKET_HEADER), env.BOXES.get(env.BOXES.idFromName(boxId)).fetch(new Request(request, { headers }));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tesser-sh/gateway",
-  "version": "0.53.2",
+  "version": "0.55.0",
   "description": "Tesser's share gateway as a Cloudflare Worker and Durable Object, deployed in your own account",
   "license": "MIT",
   "type": "module",