Move tunnels

COPY --from=docker.io/cloudflare/cloudflared:2026.3.0 \
	/usr/local/bin/cloudflared /usr/local/bin/cloudflared

const TUNNEL_ROOT = "/var/lib/tunnels";
const QUICK_URL = "https://[a-z0-9-]+\\.trycloudflare\\.com";

// Prints "connected" and any quick tunnel URL while cloudflared runs
// and serves requests.
const TUNNEL_STATUS = `${CURRENT}
dir=$1
current "$dir" && kill -0 "$pid" 2>/dev/null || exit 0
if grep -q 'Registered tunnel connection' "$dir/log"
then
	echo connected $(grep -o -m1 -E '${QUICK_URL}' "$dir/log")
fi`;

// Prints the port and URL of each connected quick tunnel.
const LIST = `status=$1
for dir in ${TUNNEL_ROOT}/*/; do
	[ -d "$dir" ] || continue
	set -- $(sh -c "$status" sh "$dir")
	[ "$1" = connected ] && [ -n "$2" ] &&
		echo "$(basename "$dir") $2"
done`;

async function capture(
	container: Container,
	argv: string[],
): Promise<string> {
	const process = await container.exec(argv);
	const output = await process.output();
	return new TextDecoder().decode(output.stdout).trim();
}

export class MySandbox extends DurableObject<Env> {
	// ...

	private async startTunnel(
		port: number,
		args: string[],
		env: Record<string, string> = {},
	): Promise<string> {
		const dir = `${TUNNEL_ROOT}/${port}`;
		const argv = ["cloudflared", "tunnel", "--no-autoupdate", ...args];
		await stopServer(this.container, dir);
		await startServer(this.container, dir, argv, { env });

		const deadline = Date.now() + 30_000;

		while (Date.now() < deadline) {
			const status = await capture(this.container, [
				"sh",
				"-c",
				TUNNEL_STATUS,
				"sh",
				dir,
			]);

			if (status.startsWith("connected")) {
				return status.slice("connected".length).trim();
			}

			const log = await serverExited(this.container, dir);

			if (log !== undefined) {
				throw new Error(`cloudflared exited: ${log}`);
			}

			await scheduler.wait(500);
		}

		await stopServer(this.container, dir);
		throw new Error("The tunnel did not connect within 30 seconds");
	}

	async openTunnel(port: number): Promise<string> {
		await this.ensureRunning();
		const url = `http://localhost:${port}`;
		return this.startTunnel(port, ["--url", url]);
	}
}

export class MySandbox extends DurableObject<Env> {
	// ...

	async listTunnels(): Promise<{ port: number; url: string }[]> {
		if (!this.container.running) {
			return [];
		}

		const output = await capture(this.container, [
			"sh",
			"-c",
			LIST,
			"sh",
			TUNNEL_STATUS,
		]);

		return output
			.split("\n")
			.filter((line) => line !== "")
			.map((line) => {
				const [port, url] = line.split(" ");
				return { port: Number(port), url };
			});
	}

	async closeTunnel(port: number): Promise<void> {
		if (!this.container.running) {
			return;
		}

		await stopServer(this.container, `${TUNNEL_ROOT}/${port}`);
	}
}

type Tunnels = Record<string, { id: string; hostname: string }>;
type TunnelsMeta = Record<
	string,
	{ accountId?: string; zoneId?: string; dnsRecordId?: string }
>;
type ApiBody<T> = { result: T; errors: unknown[] };

async function cloudflare<T>(
	env: Env,
	path: string,
	init: RequestInit = {},
): Promise<T> {
	const url = `https://api.cloudflare.com/client/v4${path}`;
	const response = await fetch(url, {
		...init,
		headers: {
			Authorization: `Bearer ${env.CLOUDFLARE_API_TOKEN}`,
		},
	});
	const body = await response.json<ApiBody<T>>();

	if (!response.ok) {
		const errors = JSON.stringify(body.errors);
		throw new Error(`Cloudflare API: ${errors}`);
	}

	return body.result;
}

export class MySandbox extends DurableObject<Env> {
	// ...

	private async namedTunnel(port: number) {
		const { storage } = this.ctx;
		const tunnels = await storage.get<Tunnels>("tunnels");
		const meta = await storage.get<TunnelsMeta>("tunnels:meta");
		const tunnel = tunnels?.[port];

		return tunnel && { ...tunnel, ...meta?.[port] };
	}

	async resumeTunnel(port: number): Promise<string | undefined> {
		const tunnel = await this.namedTunnel(port);

		if (!tunnel?.accountId) {
			return undefined;
		}

		const { accountId, id } = tunnel;
		const token = await cloudflare<string>(
			this.env,
			`/accounts/${accountId}/cfd_tunnel/${id}/token`,
		);

		await this.ensureRunning();
		// TUNNEL_TOKEN keeps the token out of the process list.
		await this.startTunnel(
			port,
			["run", "--url", `http://localhost:${port}`],
			{ TUNNEL_TOKEN: token },
		);

		return `https://${tunnel.hostname}`;
	}

	async deleteTunnel(port: number): Promise<void> {
		const tunnel = await this.namedTunnel(port);

		if (!tunnel?.accountId) {
			return;
		}

		const { accountId, id, zoneId, dnsRecordId } = tunnel;
		await this.closeTunnel(port);
		await cloudflare(
			this.env,
			`/accounts/${accountId}/cfd_tunnel/${id}`,
			{ method: "DELETE" },
		);

		if (zoneId && dnsRecordId) {
			await cloudflare(
				this.env,
				`/zones/${zoneId}/dns_records/${dnsRecordId}`,
				{ method: "DELETE" },
			);
		}

		await this.ctx.storage.transaction(async (txn) => {
			const tunnels = (await txn.get<Tunnels>("tunnels")) ?? {};
			const meta =
				(await txn.get<TunnelsMeta>("tunnels:meta")) ?? {};
			delete tunnels[port];
			delete meta[port];
			await txn.put({ tunnels, "tunnels:meta": meta });
		});
	}
}