sfbench 0.1.0

package/dist/server/http/server.js

@@ -0,0 +1,778 @@
+// The local HTTP server: the web UI's static files and the /api endpoints.
+// See docs/design.md ("ローカルサーバー").
+import { randomBytes, randomUUID, timingSafeEqual } from 'node:crypto';
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { createServer } from 'node:http';
+import { extname, join, relative, sep } from 'node:path';
+import { isValidTimeout, MAX_TIMEOUT_SECONDS, MIN_TIMEOUT_SECONDS, MAX_APEX_CODE, } from "../../shared/api.js";
+import { log } from "../log.js";
+import { InvalidPathError, UnsupportedVersionError, OrgClient, SalesforceError, SalesforceTimeoutError, SalesforceUnreachableError, salesforcePath, } from "../salesforce.js";
+import { checkRestRequest, MAX_REST_RESPONSE_BYTES, restLaunch, restResponseBody, RestRequestError } from "../rest.js";
+import { checkDelete, checkUpdate, recordResults, RecordsRequestError, updateBody } from "../records.js";
+import { NotJsonBodyError } from "../sf/apiRequest.js";
+import { ApexFileError, ApexRunError, runApex } from "../sf/apexRun.js";
+import { openOrg, reloginCommand } from "../sf/commands.js";
+import { OrgAuthError, SfCliError, SfNotFoundError, SfTimeoutError } from "../sf/errors.js";
+import { AiError } from "../ai/errors.js";
+import { NO_METADATA, runAgent, TEST_AGENT_REQUEST } from "../ai/agent.js";
+import { invalidAgentRequest, tooLongInput } from "../ai/agentTasks.js";
+import { addApexPending, addHistory, addRestPending, finishApex, loadApexHistory, AiSettingsError, finishRest, loadHistory, loadRestHistory, mergeAiSettings, settingsView } from "../store.js";
+import { isAdminRequestOrigin, isAllowedHost, isSameOriginRequest } from "./security.js";
+const MAX_BODY_BYTES = 5 * 1024 * 1024;
+/** The web UI keeps what it sends to the AI within 100 KB; this is the last guard (docs/ai.md "送る量"). */
+const MAX_AI_INPUT_BYTES = 200 * 1024;
+const LAUNCH_CODE_TTL_MS = 60_000;
+const LAUNCH_CODE_TTL_NO_OPEN_MS = 10 * 60_000;
+export const DEV_LAUNCH_CODE = 'dev';
+class HttpError extends Error {
+    status;
+    code;
+    constructor(status, code, message) {
+        super(message);
+        this.status = status;
+        this.code = code;
+    }
+}
+const CONTENT_TYPES = {
+    '.html': 'text/html; charset=utf-8',
+    '.js': 'text/javascript; charset=utf-8',
+    '.css': 'text/css; charset=utf-8',
+    '.svg': 'image/svg+xml',
+    '.png': 'image/png',
+    '.json': 'application/json; charset=utf-8',
+    '.txt': 'text/plain; charset=utf-8',
+    '.woff2': 'font/woff2',
+};
+/**
+ * Only the files under /assets/ have a hash in their names, so only they keep
+ * their content for good. The page, the favicon and licenses.txt change with
+ * the version under the same name.
+ */
+export function cacheControl(pathname) {
+    return pathname.startsWith('/assets/') ? 'public, max-age=31536000, immutable' : 'no-store';
+}
+const SECURITY_HEADERS = {
+    'X-Content-Type-Options': 'nosniff',
+    'Referrer-Policy': 'no-referrer',
+    'Content-Security-Policy': "default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'none'; base-uri 'none'; form-action 'none'",
+    'Cross-Origin-Opener-Policy': 'same-origin',
+};
+/**
+ * Static files are read into memory at startup: the server runs from npx's
+ * cache, which can be replaced while the server is running.
+ */
+function loadStaticFiles(root) {
+    const files = new Map();
+    if (!root || !existsSync(root))
+        return files;
+    const walk = (dir) => {
+        for (const name of readdirSync(dir)) {
+            const full = join(dir, name);
+            if (statSync(full).isDirectory())
+                walk(full);
+            else
+                files.set(`/${relative(root, full).split(sep).join('/')}`, readFileSync(full));
+        }
+    };
+    walk(root);
+    return files;
+}
+export class App {
+    /** The port the server listens on; checked against the Host header. */
+    port;
+    options;
+    staticFiles;
+    sessions = new Set();
+    launches = new Map();
+    /** This run of the server: a REST request still pending from another run was cut off (docs/rest.md "実行履歴"). */
+    bootId = randomUUID();
+    constructor(options) {
+        this.options = options;
+        this.port = options.port;
+        this.staticFiles = loadStaticFiles(options.webRoot);
+        if (options.devSessionToken)
+            this.sessions.add(options.devSessionToken);
+    }
+    createServer() {
+        return createServer((req, res) => {
+            this.handle(req, res).catch((e) => {
+                log.error(`unhandled error: ${e.stack ?? String(e)}`);
+                if (!res.headersSent)
+                    sendJson(res, 500, errorBody('INTERNAL_ERROR', 'Internal error'));
+                else
+                    res.end();
+            });
+        });
+    }
+    async handle(req, res) {
+        if (!isAllowedHost(req.headers.host, this.port, this.options.dev)) {
+            sendJson(res, 421, errorBody('BAD_REQUEST', 'Unexpected Host header'));
+            return;
+        }
+        const url = new URL(req.url ?? '/', `http://${req.headers.host}`);
+        try {
+            if (url.pathname.startsWith('/api/'))
+                await this.handleApi(req, res, url);
+            else
+                this.serveStatic(req, res, url.pathname);
+        }
+        catch (e) {
+            await this.sendError(res, e);
+        }
+    }
+    // ---- API ----
+    async handleApi(req, res, url) {
+        const path = url.pathname;
+        const method = req.method ?? 'GET';
+        // Admin endpoints, called by the CLI entry point.
+        if (path === '/api/health' || path === '/api/launch' || path === '/api/shutdown') {
+            this.requireAdmin(req);
+            if (path === '/api/health' && method === 'GET') {
+                sendJson(res, 200, { version: this.options.version, pid: process.pid });
+                return;
+            }
+            if (path === '/api/launch' && method === 'POST') {
+                sendJson(res, 200, this.createLaunch(await readJsonObject(req)));
+                return;
+            }
+            if (path === '/api/shutdown' && method === 'POST') {
+                sendJson(res, 200, { ok: true });
+                setImmediate(this.options.onShutdown);
+                return;
+            }
+            throw new HttpError(405, 'BAD_REQUEST', 'Method not allowed');
+        }
+        if (!isSameOriginRequest(req.headers))
+            throw new HttpError(403, 'UNAUTHORIZED', 'Cross-origin request');
+        if (path === '/api/session' && method === 'POST') {
+            sendJson(res, 200, this.exchangeCode(await readJsonObject(req)));
+            return;
+        }
+        const session = req.headers['x-sfbench-session'];
+        if (typeof session !== 'string' || !this.sessions.has(session)) {
+            throw new HttpError(401, 'UNAUTHORIZED', 'No valid session. Run `npx sfbench` to open sfbench again.');
+        }
+        if (path === '/api/settings') {
+            if (method === 'GET') {
+                sendJson(res, 200, settingsView(this.options.settings.get()));
+                return;
+            }
+            if (method === 'PUT') {
+                const body = (await readJsonObject(req));
+                const settings = { ...this.options.settings.get() };
+                if (typeof body.omitNamespace === 'boolean')
+                    settings.omitNamespace = body.omitNamespace;
+                if (body.requestTimeoutSeconds !== undefined) {
+                    if (!isValidTimeout(body.requestTimeoutSeconds)) {
+                        throw new HttpError(400, 'BAD_REQUEST', `requestTimeoutSeconds must be an integer from ${MIN_TIMEOUT_SECONDS} to ${MAX_TIMEOUT_SECONDS}`);
+                    }
+                    settings.requestTimeoutSeconds = body.requestTimeoutSeconds;
+                }
+                // Without ai, the saved AI settings stay as they are (docs/ai.md "API").
+                if (body.ai !== undefined)
+                    settings.ai = mergeAiSettings(settings.ai, body.ai);
+                sendJson(res, 200, settingsView(this.options.settings.set(settings)));
+                return;
+            }
+        }
+        if (path === '/api/ai/test' && method === 'POST') {
+            const body = (await readJsonObject(req));
+            // The settings being edited, with the saved key when none is typed (same rule as saving).
+            const ai = mergeAiSettings(this.options.settings.get().ai, body.ai);
+            const started = Date.now();
+            await this.runAi(res, async (signal) => {
+                // Every screen's AI calls tools: a model that cannot is found here (docs/ai-agent.md "接続を確かめる").
+                await runAgent(ai, TEST_AGENT_REQUEST, NO_METADATA, '66.0', signal);
+                return { elapsedMs: Date.now() - started };
+            });
+            return;
+        }
+        if (path === '/api/orgs' && method === 'GET') {
+            // waitForCheck=1: answer when the background connection check has finished.
+            if (url.searchParams.get('waitForCheck') === '1')
+                await this.options.orgs.waitForCheck();
+            const body = await this.options.orgs.listWithAvailability(url.searchParams.get('refresh') === '1');
+            sendJson(res, 200, body);
+            return;
+        }
+        if (path === '/api/orgs/check' && method === 'POST') {
+            await this.options.orgs.list(true);
+            await this.options.orgs.checkConnections();
+            sendJson(res, 200, (await this.options.orgs.listWithAvailability()));
+            return;
+        }
+        const m = /^\/api\/orgs\/([^/]+)\/(.+)$/.exec(path);
+        if (m) {
+            let username;
+            try {
+                username = decodeURIComponent(m[1]);
+            }
+            catch {
+                throw new HttpError(400, 'BAD_REQUEST', 'Invalid org in the path');
+            }
+            await this.handleOrgApi(req, res, url, username, m[2], method);
+            return;
+        }
+        throw new HttpError(404, 'NOT_FOUND', 'Not found');
+    }
+    async handleOrgApi(req, res, url, username, rest, method) {
+        const client = await this.options.orgs.client(username);
+        if (!client)
+            throw unknownOrg(username);
+        const refresh = url.searchParams.get('refresh') === '1';
+        const withUsage = (body) => ({ ...body, apiUsage: client.apiUsage });
+        if (rest === 'summary' && method === 'GET') {
+            sendJson(res, 200, withUsage(await this.options.orgs.summary(client)));
+            return;
+        }
+        if (rest === 'history' && method === 'GET') {
+            sendJson(res, 200, { entries: loadHistory(this.options.paths.historyDir, username) });
+            return;
+        }
+        if (rest === 'versions' && method === 'GET') {
+            sendJson(res, 200, { versions: await client.versions() });
+            return;
+        }
+        if (rest === 'sobjects' && method === 'GET') {
+            const at = { tooling: url.searchParams.get('tooling') === '1', version: versionOf(url.searchParams.get('version') ?? undefined) };
+            const described = await this.options.orgs.describeGlobal(client, at, refresh);
+            sendJson(res, 200, withUsage({ ...described.body, fetchedAt: described.fetchedAt }));
+            return;
+        }
+        const describe = /^sobjects\/([A-Za-z0-9_]+)$/.exec(rest);
+        if (describe && method === 'GET') {
+            const at = { tooling: url.searchParams.get('tooling') === '1', version: versionOf(url.searchParams.get('version') ?? undefined) };
+            const described = await this.options.orgs.describeObject(client, describe[1], at, refresh);
+            sendJson(res, 200, withUsage({ ...described.body, fetchedAt: described.fetchedAt }));
+            return;
+        }
+        if (rest === 'query' && method === 'POST') {
+            const q = (await readJsonObject(req));
+            if (typeof q.soql !== 'string' || !q.soql.trim())
+                throw new HttpError(400, 'BAD_REQUEST', 'soql is required');
+            const tooling = q.tooling === true;
+            const queryAll = q.queryAll === true;
+            if (tooling && queryAll)
+                throw new HttpError(400, 'BAD_REQUEST', 'The Tooling API does not support Query All');
+            const apiVersion = versionOf(q.apiVersion);
+            const version = await client.version(apiVersion);
+            const endpoint = tooling ? 'tooling/query' : queryAll ? 'queryAll' : 'query';
+            const result = await client.request({
+                method: 'GET',
+                path: `/services/data/v${version}/${endpoint}?q=${encodeURIComponent(q.soql)}`,
+                headers: await this.queryHeaders(client),
+            });
+            addHistory(this.options.paths.historyDir, username, {
+                soql: q.soql,
+                tooling,
+                queryAll,
+                executedAt: new Date().toISOString(),
+                ...(apiVersion ? { apiVersion } : {}),
+                ...(typeof q.prompt === 'string' && q.prompt.trim() ? { prompt: q.prompt.trim().slice(0, 2000) } : {}),
+            });
+            sendJson(res, 200, withUsage(result.body));
+            return;
+        }
+        if (rest === 'query/next' && method === 'POST') {
+            const q = (await readJsonObject(req));
+            if (typeof q.nextRecordsUrl !== 'string')
+                throw new HttpError(400, 'BAD_REQUEST', 'nextRecordsUrl is required');
+            const result = await client.request({ method: 'GET', path: q.nextRecordsUrl, headers: await this.queryHeaders(client) });
+            sendJson(res, 200, withUsage(result.body));
+            return;
+        }
+        if (rest === 'rest' && method === 'POST') {
+            await this.sendRest(req, res, client);
+            return;
+        }
+        if (rest === 'ai/agent' && method === 'POST') {
+            await this.runAgentRequest(req, res, client);
+            return;
+        }
+        if (rest === 'records/update' && method === 'POST') {
+            await this.updateRecords(req, res, client);
+            return;
+        }
+        if (rest === 'records/delete' && method === 'POST') {
+            await this.deleteRecords(req, res, client);
+            return;
+        }
+        if (rest === 'rest/history' && method === 'GET') {
+            sendJson(res, 200, { entries: loadRestHistory(this.options.paths.restHistoryDir, username, this.bootId) });
+            return;
+        }
+        if (rest === 'apex' && method === 'POST') {
+            await this.runApexRequest(req, res, client);
+            return;
+        }
+        if (rest === 'apex/history' && method === 'GET') {
+            sendJson(res, 200, { entries: loadApexHistory(this.options.paths.apexHistoryDir, username, this.bootId) });
+            return;
+        }
+        if (rest === 'open' && method === 'POST') {
+            await openOrg(username, this.options.paths.tmpDir);
+            sendJson(res, 200, { ok: true });
+            return;
+        }
+        throw new HttpError(404, 'NOT_FOUND', 'Not found');
+    }
+    /**
+     * Sends a request from the REST API screen (docs/rest.md "サーバーの `/rest`").
+     * It is recorded as pending just before it is sent and updated when it ends,
+     * so that what was sent can be told even if the screen goes away meanwhile.
+     * The screen going away does not stop it.
+     */
+    async sendRest(req, res, client) {
+        const request = checkRestRequest(await readJsonObject(req));
+        // A path refused here was never sent, so it is checked before it is recorded.
+        const pathname = new URL(salesforcePath(request.path, client.instanceUrl), client.instanceUrl).pathname;
+        const dir = this.options.paths.restHistoryDir;
+        const warn = (e) => log.warn(`${client.username}: could not write the REST history (${e.message})`);
+        // Without a record (it could not be written), the request is still sent.
+        let id;
+        try {
+            id = addRestPending(dir, client.username, request, this.bootId);
+        }
+        catch (e) {
+            warn(e);
+        }
+        const finish = (outcome) => {
+            if (!id)
+                return;
+            try {
+                finishRest(dir, client.username, id, outcome);
+            }
+            catch (e) {
+                warn(e);
+            }
+        };
+        const started = performance.now();
+        let raw;
+        try {
+            // Never sent twice, whatever the method (docs/rest.md "送り方").
+            raw = await client.requestRaw({ ...request, changesData: true }, { maxBodyBytes: MAX_REST_RESPONSE_BYTES });
+        }
+        catch (e) {
+            finish(restOutcomeOf(e));
+            log.info(`rest ${request.method} ${pathname} ${e.name} ${Math.round(performance.now() - started)}ms`);
+            throw e;
+        }
+        // From here Salesforce has answered: whatever fails below, the record says so.
+        const elapsedMs = Math.round(performance.now() - started);
+        finish({ state: 'done', status: raw.status, elapsedMs });
+        // No query string, body or header values in the log: they may hold record data.
+        log.info(`rest ${request.method} ${pathname} ${raw.status} ${elapsedMs}ms`);
+        sendJson(res, 200, { ...{ id, status: raw.status, ...restResponseBody(raw), elapsedMs }, apiUsage: client.apiUsage });
+    }
+    /**
+     * The AI writing SOQL, a REST API request or Apex, reading this org's metadata
+     * through tools (docs/ai-agent.md "サーバー"). Logs counts only.
+     */
+    async runAgentRequest(req, res, client) {
+        const body = await readJsonObject(req, { bytes: MAX_AI_INPUT_BYTES, code: 'PAYLOAD_TOO_LARGE', message: 'Too much to send to the AI.' });
+        const invalid = invalidAgentRequest(body);
+        if (invalid)
+            throw new HttpError(400, 'BAD_REQUEST', invalid);
+        const tooLong = tooLongInput(body);
+        if (tooLong)
+            throw new HttpError(400, 'AI_INPUT_TOO_LONG', tooLong);
+        const request = body;
+        const requested = versionOf(request.apiVersion);
+        const version = await client.version(requested);
+        const orgs = this.options.orgs;
+        const soql = request.task === 'generateSoql' || request.task === 'fixSoql';
+        // One API and one version for the whole request (docs/ai-agent.md "SOQL のときのツール").
+        const at = { tooling: soql && request.input.tooling, version: requested };
+        const source = {
+            objects: async () => (await orgs.describeGlobal(client, at)).body.sobjects,
+            describe: async (name) => {
+                try {
+                    return (await orgs.describeObject(client, name, at)).body;
+                }
+                catch (e) {
+                    // An object the org does not have is the AI's mistake to correct, not a failure of the request.
+                    if (e instanceof SalesforceError && e.status === 404)
+                        return undefined;
+                    throw e;
+                }
+            },
+            ...(soql ? { soql: true, omitNamespace: await this.defaultNamespace(client) } : {}),
+        };
+        const started = performance.now();
+        await this.runAi(res, async (signal) => {
+            const run = await runAgent(this.options.settings.get().ai, request, source, version, signal);
+            log.info(`ai agent ${request.task} ${run.aiCalls} ai ${run.toolCalls} tools ${Math.round(performance.now() - started)}ms`);
+            return { output: run.output };
+        });
+    }
+    /**
+     * Saves records from the result table, at most one sObject Collections call
+     * (docs/edit.md "サーバー"). Never sent twice: PATCH changes data.
+     */
+    async updateRecords(req, res, client) {
+        const input = await readJsonObject(req);
+        const request = checkUpdate(input);
+        const version = await client.version(versionOf(input.apiVersion));
+        const started = performance.now();
+        const answer = await client.request({ method: 'PATCH', path: `/services/data/v${version}/composite/sobjects`, body: updateBody(request) });
+        const results = recordResults(request.records.map((r) => r.id), answer.body);
+        // Counts only: the values and Salesforce's messages can hold record data.
+        log.info(`records update ${request.object} ${results.length} ${results.filter((r) => !r.success).length} ${Math.round(performance.now() - started)}ms`);
+        sendJson(res, 200, { ...{ results }, apiUsage: client.apiUsage });
+    }
+    /** Deletes records from the result table, at most one sObject Collections call. */
+    async deleteRecords(req, res, client) {
+        const input = await readJsonObject(req);
+        const request = checkDelete(input);
+        const version = await client.version(versionOf(input.apiVersion));
+        const started = performance.now();
+        const query = `ids=${request.ids.join(',')}&allOrNone=${request.allOrNone}`;
+        const answer = await client.request({ method: 'DELETE', path: `/services/data/v${version}/composite/sobjects?${query}` });
+        const results = recordResults(request.ids, answer.body);
+        log.info(`records delete ${results.length} ${results.filter((r) => !r.success).length} ${Math.round(performance.now() - started)}ms`);
+        sendJson(res, 200, { ...{ results }, apiUsage: client.apiUsage });
+    }
+    /**
+     * Runs anonymous Apex from the Apex screen (docs/apex.md). It is recorded as
+     * pending just before it runs, and not run at all if that record cannot be
+     * written: Apex may always change data. The screen going away does not stop it.
+     */
+    async runApexRequest(req, res, client) {
+        const { code, apiVersion } = (await readJsonObject(req));
+        if (typeof code !== 'string' || !code.trim())
+            throw new HttpError(400, 'BAD_REQUEST', 'code is required');
+        if (code.length > MAX_APEX_CODE)
+            throw new HttpError(400, 'BAD_REQUEST', `Anonymous Apex can be at most ${MAX_APEX_CODE} characters.`);
+        // Checked before anything is recorded or run: sf would refuse a version the org does not have only after starting.
+        const requested = versionOf(apiVersion);
+        if (requested !== undefined)
+            await client.version(requested);
+        const dir = this.options.paths.apexHistoryDir;
+        let id;
+        try {
+            id = addApexPending(dir, client.username, code, this.bootId);
+        }
+        catch (e) {
+            log.warn(`${client.username}: could not write the Apex history (${e.message}); not running`);
+            throw new HttpError(500, 'NOT_RUN', 'The Apex history could not be written, so the code was not run.');
+        }
+        const finish = (outcome) => {
+            try {
+                finishApex(dir, client.username, id, outcome);
+            }
+            catch (e) {
+                log.warn(`${client.username}: could not write the Apex history (${e.message})`);
+            }
+        };
+        const started = performance.now();
+        // The setting's wait for Salesforce, and time for sf itself to start.
+        const timeoutMs = this.options.settings.get().requestTimeoutSeconds * 1000 + SF_START_MS;
+        let run;
+        try {
+            run = await runApex(client.username, code, this.options.paths.tmpDir, timeoutMs, requested);
+        }
+        catch (e) {
+            finish(apexOutcomeOf(e));
+            // The name only: sf's message can hold an exception's text.
+            log.info(`apex ${e instanceof ApexRunError ? e.sfName : e.name} ${Math.round(performance.now() - started)}ms`);
+            throw e instanceof SfTimeoutError ? new SalesforceTimeoutError() : e;
+        }
+        const elapsedMs = Math.round(performance.now() - started);
+        finish({
+            state: 'done',
+            result: run.result,
+            ...(run.line !== undefined ? { line: run.line } : {}),
+            ...(run.column !== undefined ? { column: run.column } : {}),
+            ...(run.compileProblem !== undefined ? { compileProblem: run.compileProblem } : {}),
+            ...exceptionTypeOf(run.exceptionMessage),
+            elapsedMs,
+        });
+        log.info(`apex ${run.result} ${elapsedMs}ms`);
+        const tooLarge = Buffer.byteLength(run.logs) > MAX_APEX_LOG_BYTES;
+        sendJson(res, 200, { id, ...run, logs: tooLarge ? '' : run.logs, ...(tooLarge ? { logsOmitted: 'tooLarge' } : {}), elapsedMs });
+    }
+    /**
+     * The namespace header goes on queries only, as in lwc-soql-builder. If the
+     * namespace cannot be read (for example, the user cannot query
+     * Organization), the query still runs, without the header.
+     */
+    async queryHeaders(client) {
+        const ns = await this.defaultNamespace(client);
+        return ns ? { 'Sforce-Call-Options': `defaultNamespace=${ns}` } : {};
+    }
+    /**
+     * The namespace queries run with as their default, if any: the org's own,
+     * when the setting omits it. The SOQL AI's tools leave out exactly this
+     * one, so that what the AI writes runs (docs/ai-agent.md "SOQL のときのツール").
+     */
+    async defaultNamespace(client) {
+        if (!this.options.settings.get().omitNamespace)
+            return undefined;
+        try {
+            return (await this.options.orgs.summary(client)).namespacePrefix ?? undefined;
+        }
+        catch (e) {
+            if (e instanceof OrgAuthError || e instanceof SfNotFoundError)
+                throw e;
+            log.warn(`${client.username}: could not read the namespace; querying without it`);
+            return undefined;
+        }
+    }
+    requireAdmin(req) {
+        const token = req.headers['x-sfbench-admin'];
+        if (!isAdminRequestOrigin(req.headers) || typeof token !== 'string' || !sameSecret(token, this.options.adminToken)) {
+            throw new HttpError(401, 'UNAUTHORIZED', 'Admin token required');
+        }
+    }
+    /**
+     * Issues a one-time launch code. The org is kept as given (alias or
+     * username): the web UI resolves it against the org list, so that the
+     * browser opens without waiting for `sf org list`.
+     */
+    createLaunch(body) {
+        const b = body;
+        const launch = {};
+        if (typeof b.org === 'string' && b.org) {
+            if (b.org.length > 255)
+                throw new HttpError(400, 'BAD_REQUEST', 'Org name too long');
+            launch.org = b.org;
+        }
+        if (typeof b.query === 'string' && b.query)
+            launch.query = b.query;
+        if (b.run === true)
+            launch.run = true;
+        if (b.rest !== undefined) {
+            if (!b.rest || typeof b.rest !== 'object')
+                throw new HttpError(400, 'BAD_REQUEST', 'rest must be an object');
+            const r = b.rest;
+            try {
+                launch.rest = restLaunch({ path: r.path, method: r.method, body: r.body });
+            }
+            catch (e) {
+                throw new HttpError(400, 'BAD_REQUEST', e.message);
+            }
+        }
+        if (b.apex !== undefined) {
+            const code = b.apex?.code;
+            if (typeof code !== 'string' || !code.trim() || code.length > MAX_APEX_CODE)
+                throw new HttpError(400, 'BAD_REQUEST', 'apex.code must be Apex of at most 32000 characters');
+            launch.apex = { code };
+        }
+        this.pruneLaunches();
+        const code = randomBytes(24).toString('base64url');
+        const expiresAt = Date.now() + (b.noOpen === true ? LAUNCH_CODE_TTL_NO_OPEN_MS : LAUNCH_CODE_TTL_MS);
+        this.launches.set(code, { launch, expiresAt });
+        return { code, expiresAt };
+    }
+    exchangeCode(body) {
+        const code = body?.code;
+        if (this.options.dev && code === DEV_LAUNCH_CODE && this.options.devSessionToken) {
+            return { sessionToken: this.options.devSessionToken, launch: {} };
+        }
+        const pending = typeof code === 'string' ? this.launches.get(code) : undefined;
+        if (typeof code === 'string')
+            this.launches.delete(code);
+        if (!pending || pending.expiresAt < Date.now()) {
+            throw new HttpError(410, 'UNAUTHORIZED', 'This URL has expired or was already used. Run `npx sfbench` to open sfbench again.');
+        }
+        const sessionToken = randomBytes(32).toString('base64url');
+        this.sessions.add(sessionToken);
+        return { sessionToken, launch: pending.launch };
+    }
+    pruneLaunches() {
+        const now = Date.now();
+        for (const [code, pending] of this.launches)
+            if (pending.expiresAt < now)
+                this.launches.delete(code);
+    }
+    async sendError(res, e) {
+        if (e instanceof OrgAuthError) {
+            sendJson(res, 409, {
+                error: {
+                    code: 'ORG_AUTH_ERROR',
+                    message: e.message,
+                    reloginCommand: await this.reloginCommand(e.username),
+                },
+            });
+            return;
+        }
+        const { status, body } = errorResponse(e);
+        sendJson(res, status, body);
+    }
+    /**
+     * Runs an AI call that stops when the web UI goes away (Cancel, a closed
+     * tab): the request to the AI is aborted too, and nothing is sent back.
+     */
+    async runAi(res, call) {
+        // Already gone while the body was read: 'close' has fired, so do not call the AI at all.
+        if (res.destroyed || res.socket?.destroyed)
+            return;
+        const gone = new AbortController();
+        res.on('close', () => {
+            if (!res.writableEnded)
+                gone.abort();
+        });
+        try {
+            sendJson(res, 200, await call(gone.signal));
+        }
+        catch (e) {
+            if (gone.signal.aborted)
+                return;
+            throw e;
+        }
+    }
+    async reloginCommand(username) {
+        const org = (await this.options.orgs.list().catch(() => [])).find((o) => o.username === username);
+        return org ? reloginCommand(org) : 'sf org login web';
+    }
+    // ---- Static files ----
+    serveStatic(req, res, pathname) {
+        if (req.method !== 'GET' && req.method !== 'HEAD') {
+            sendJson(res, 405, errorBody('BAD_REQUEST', 'Method not allowed'));
+            return;
+        }
+        // The UI is a single page: / and /launch/<code> both get index.html.
+        const isPage = pathname === '/' || pathname.startsWith('/launch/');
+        const file = this.staticFiles.get(isPage ? '/index.html' : pathname);
+        if (!file) {
+            res.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8', ...SECURITY_HEADERS });
+            res.end(this.staticFiles.size === 0 ? 'The web UI is not built. Run `npm run build`.' : 'Not found');
+            return;
+        }
+        res.writeHead(200, {
+            'Content-Type': CONTENT_TYPES[extname(isPage ? '/index.html' : pathname)] ?? 'application/octet-stream',
+            'Cache-Control': cacheControl(pathname),
+            ...SECURITY_HEADERS,
+        });
+        res.end(req.method === 'HEAD' ? undefined : file);
+    }
+}
+/** Constant-time comparison, so that response times do not reveal the token. */
+function sameSecret(a, b) {
+    const ba = Buffer.from(a);
+    const bb = Buffer.from(b);
+    return ba.length === bb.length && timingSafeEqual(ba, bb);
+}
+/**
+ * The response for an error, apart from an org's login error (which needs the
+ * relogin command). The codes are what the web UI sorts by (docs/web.md "エラーの扱い").
+ */
+export function errorResponse(e) {
+    if (e instanceof HttpError)
+        return { status: e.status, body: errorBody(e.code, e.message) };
+    if (e instanceof SalesforceError) {
+        const status = e.status >= 400 && e.status < 500 ? e.status : 502;
+        return { status, body: { error: { code: 'SALESFORCE_ERROR', message: e.message, status: e.status, details: e.body } } };
+    }
+    if (e instanceof SalesforceUnreachableError)
+        return { status: 502, body: errorBody('SALESFORCE_UNREACHABLE', e.message) };
+    if (e instanceof SalesforceTimeoutError)
+        return { status: 504, body: errorBody('SALESFORCE_TIMEOUT', e.message) };
+    if (e instanceof InvalidPathError || e instanceof RestRequestError || e instanceof RecordsRequestError || e instanceof NotJsonBodyError || e instanceof UnsupportedVersionError)
+        return { status: 400, body: errorBody('BAD_REQUEST', e.message) };
+    if (e instanceof SfNotFoundError)
+        return { status: 503, body: errorBody('SF_CLI_NOT_FOUND', e.message) };
+    if (e instanceof AiError) {
+        const status = { AI_NOT_CONFIGURED: 400, AI_ERROR: 502, AI_BAD_OUTPUT: 502, AI_TIMEOUT: 504 }[e.code];
+        return { status, body: { error: { code: e.code, message: e.message, details: e.details } } };
+    }
+    if (e instanceof AiSettingsError)
+        return { status: 400, body: errorBody('BAD_REQUEST', e.message) };
+    // Its message can hold an exception's text: for the screen only, not the log.
+    if (e instanceof ApexRunError)
+        return { status: 502, body: errorBody('SF_CLI_ERROR', e.message) };
+    if (e instanceof ApexFileError) {
+        log.warn(`could not write the Apex file (${e.message}); not running`);
+        return { status: 500, body: errorBody('NOT_RUN', 'The code could not be written to a temporary file, so it was not run.') };
+    }
+    if (e instanceof SfCliError) {
+        log.warn(`sf error: ${e.message}`);
+        return { status: 502, body: errorBody('SF_CLI_ERROR', e.message) };
+    }
+    log.error(`error: ${e.stack ?? String(e)}`);
+    return { status: 500, body: errorBody('INTERNAL_ERROR', 'Internal error') };
+}
+/**
+ * How a failed REST request ends in the history: undefined when Salesforce
+ * never processed it (the record is removed), else unknown.
+ */
+export function restOutcomeOf(e) {
+    // Not sent, or refused by Salesforce for the session before it ran anything.
+    if (e instanceof OrgAuthError || e instanceof SfNotFoundError || e instanceof NotJsonBodyError)
+        return undefined;
+    if (e instanceof SalesforceTimeoutError)
+        return { state: 'unknown', reason: 'timeout' };
+    if (e instanceof SalesforceUnreachableError)
+        return { state: 'unknown', reason: 'unreachable' };
+    return { state: 'unknown', reason: 'error' };
+}
+/** Time for sf itself to start, on top of the wait for Salesforce. */
+const SF_START_MS = 15_000;
+/** A longer debug log is not passed back (Salesforce's own limit for a debug log). */
+const MAX_APEX_LOG_BYTES = 20 * 1024 * 1024;
+/**
+ * The API version the screen chose, or undefined for the latest. Only the
+ * shape is checked here; whether the org supports it, by OrgClient.version.
+ */
+export function versionOf(value) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== 'string' || !/^\d{1,3}\.0$/.test(value))
+        throw new HttpError(400, 'BAD_REQUEST', 'apiVersion must look like 66.0');
+    return value;
+}
+/**
+ * How a failed Apex run ends in the history: undefined when it did not run
+ * (the record is removed), else unknown (docs/apex.md "実行履歴").
+ */
+export function apexOutcomeOf(e) {
+    if (e instanceof OrgAuthError || e instanceof SfNotFoundError || e instanceof ApexFileError)
+        return undefined;
+    if (e instanceof SfTimeoutError)
+        return { state: 'unknown', reason: 'timeout' };
+    return { state: 'unknown', reason: 'error' };
+}
+/** Only the type of an exception is kept, never its text, which can hold record data. */
+export function exceptionTypeOf(message) {
+    const type = message?.split(':', 1)[0].trim();
+    return type && /^[A-Za-z_][\w.]*$/.test(type) ? { exceptionType: type } : {};
+}
+/** An org that is not in the org list: not the 404 of an unknown path, which the UI must not take for a gone org. */
+export function unknownOrg(username) {
+    return new HttpError(404, 'ORG_NOT_FOUND', `Unknown org: ${username}`);
+}
+function errorBody(code, message) {
+    return { error: { code, message } };
+}
+function sendJson(res, status, body) {
+    const data = JSON.stringify(body ?? null);
+    res.writeHead(status, {
+        'Content-Type': 'application/json; charset=utf-8',
+        'Cache-Control': 'no-store',
+        ...SECURITY_HEADERS,
+    });
+    res.end(data);
+}
+/** Reads a JSON object body. Anything else (empty, null, an array, a string) is a 400. */
+async function readJsonObject(req, limit = { bytes: MAX_BODY_BYTES, code: 'BAD_REQUEST', message: 'Request body too large' }) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        size += chunk.length;
+        if (size > limit.bytes)
+            throw new HttpError(413, limit.code, limit.message);
+        chunks.push(chunk);
+    }
+    const text = Buffer.concat(chunks).toString('utf8');
+    let value;
+    try {
+        value = JSON.parse(text);
+    }
+    catch {
+        throw new HttpError(400, 'BAD_REQUEST', 'The request body must be a JSON object');
+    }
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        throw new HttpError(400, 'BAD_REQUEST', 'The request body must be a JSON object');
+    }
+    return value;
+}