npm - @convex-dev/ai-budget - Versions diffs - 0.0.2-alpha.7 → 0.0.2-alpha.9 - Mend

@convex-dev/ai-budget 0.0.2-alpha.7 → 0.0.2-alpha.9

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (5) hide show

package/dist/client/dashboard.js CHANGED Viewed

@@ -54,8 +54,16 @@ export const DASHBOARD_HTML = String.raw `<!doctype html>
 </nav>
 <main id="main"></main>
 <script>
-const API = "__API_BASE__";
-const TOKEN = "__TOKEN__";
+// Injected as JSON literals by registerRoutes (no surrounding quotes here).
+const API = __API_BASE__;
+const TOKEN = __TOKEN__;
+// If we were opened with ?token=… (needed for the initial navigation, which
+// can't set headers), drop it from the address bar so it doesn't linger in
+// history; API calls below use the Authorization header instead.
+try {
+  const u = new URL(location.href);
+  if (u.searchParams.has("token")) { u.searchParams.delete("token"); history.replaceState(null, "", u.toString()); }
+} catch (e) {}
 const H = TOKEN ? { Authorization: "Bearer " + TOKEN } : {};
 const NANOS = 1e9;
 const usd = (n) => n == null ? "—" : "$" + (n / NANOS).toFixed(n && n < NANOS/100 ? 6 : 2);

package/dist/client/index.js CHANGED Viewed

@@ -51,20 +51,25 @@ function extractUsage(usage) {
             usage?.cached_tokens),
     };
 }
-// The gateway doesn't report a dollar cost today, but if a future response ever
-// carries an unambiguous nanodollar cost we pass it straight through as
-// authoritative (finishRequest prefers it over the token-based estimate). Only
-// an explicitly nano-denominated field is trusted — a bare `cost` could be in
-// dollars and silently mis-bill by 1e9×.
+// The AI Gateway reports the authoritative dollar cost of each request.
+// @convex-dev/ai-sdk-provider surfaces it at
+// `providerMetadata.convexGateway.cost` (USD); convert to nanodollars and pass
+// it through as authoritative (finishRequest prefers it over the token-based
+// estimate). No-op on older provider versions that don't surface it.
 function extractGatewayCostNanos(result) {
     const meta = result?.providerMetadata?.convexGateway;
-    const candidates = [meta?.costNanos, result?.usage?.costNanos];
-    for (const c of candidates) {
-        if (typeof c === "number" && Number.isFinite(c) && c >= 0)
-            return c;
+    const costUsd = meta?.cost;
+    if (typeof costUsd === "number" && Number.isFinite(costUsd) && costUsd >= 0) {
+        return Math.round(costUsd * NANOS_PER_DOLLAR);
+    }
+    // Back-compat: honor an explicitly nano-denominated field if ever present.
+    const costNanos = meta?.costNanos ?? result?.usage?.costNanos;
+    if (typeof costNanos === "number" && Number.isFinite(costNanos) && costNanos >= 0) {
+        return Math.round(costNanos);
     }
     return undefined;
 }
+const NANOS_PER_DOLLAR = 1e9;
 // Flatten an AI SDK prompt (roles + content parts) into simple storable messages.
 function simplifyPrompt(prompt) {
     if (!Array.isArray(prompt))
@@ -96,6 +101,17 @@ function extractText(result) {
     }
     return "";
 }
+// ---------- client ----------
+// Length-independent-branch string compare, so the dashboard token check
+// doesn't leak the token via response timing. (Length itself is not secret.)
+function timingSafeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let r = 0;
+    for (let i = 0; i < a.length; i++)
+        r |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    return r === 0;
+}
 export class AIBudget {
     component;
     defaultModel;
@@ -275,6 +291,7 @@ export class AIBudget {
                     const start = Date.now();
                     let text = "";
                     let usage = undefined;
+                    let providerMetadata = undefined;
                     try {
                         const result = await doStream();
                         // finishRequest is idempotent (terminal-guarded server-side), so
@@ -291,6 +308,7 @@ export class AIBudget {
                                 responseText: text,
                                 error,
                                 ...extractUsage(usage),
+                                costNanos: extractGatewayCostNanos({ providerMetadata }),
                                 latencyMs: Date.now() - start,
                             });
                         };
@@ -299,8 +317,10 @@ export class AIBudget {
                                 if (chunk?.type === "text-delta") {
                                     text += chunk.delta ?? chunk.textDelta ?? "";
                                 }
-                                if (chunk?.type === "finish")
+                                if (chunk?.type === "finish") {
                                     usage = chunk.usage;
+                                    providerMetadata = chunk.providerMetadata ?? providerMetadata;
+                                }
                                 if (chunk?.type === "error")
                                     void settle(String(chunk.error));
                                 controller.enqueue(chunk);
@@ -485,8 +505,11 @@ export class AIBudget {
                 return { ok: false, token: "" };
             const url = new URL(request.url);
             const bearer = (request.headers.get("authorization") ?? "").replace(/^Bearer\s+/i, "");
+            // `?token=` is accepted only for the initial page navigation (a browser
+            // GET can't set headers); the page strips it from the URL on load and the
+            // JSON API is called with the bearer header. Compared in constant time.
             const provided = bearer || url.searchParams.get("token") || "";
-            return { ok: provided === token, token };
+            return { ok: timingSafeEqual(provided, token), token };
         };
         const json = (data, status = 200) => new Response(JSON.stringify(data ?? null), {
             status,
@@ -548,7 +571,10 @@ export class AIBudget {
                         return json({ error: "not found" }, 404);
                 }
             }
-            const html = DASHBOARD_HTML.replace(/__API_BASE__/g, `${prefix}/api`).replace(/__TOKEN__/g, token);
+            // Inject as JSON literals (function replacers so `$` in the value isn't
+            // treated as a replacement pattern). This keeps a token/prefix containing
+            // quotes, backslashes, or `</script>` from breaking out of the JS string.
+            const html = DASHBOARD_HTML.replace(/__API_BASE__/g, () => JSON.stringify(`${prefix}/api`)).replace(/__TOKEN__/g, () => JSON.stringify(token));
             return new Response(html, {
                 headers: { "content-type": "text/html; charset=utf-8" },
             });

package/package.json CHANGED Viewed

@@ -7,7 +7,7 @@
     "email": "support@convex.dev",
     "url": "https://github.com/get-convex/ai-budget/issues"
   },
-  "version": "0.0.2-alpha.7",
+  "version": "0.0.2-alpha.9",
   "license": "Apache-2.0",
   "type": "module",
   "keywords": [

package/src/client/dashboard.ts CHANGED Viewed

@@ -54,8 +54,16 @@ export const DASHBOARD_HTML = String.raw`<!doctype html>
 </nav>
 <main id="main"></main>
 <script>
-const API = "__API_BASE__";
-const TOKEN = "__TOKEN__";
+// Injected as JSON literals by registerRoutes (no surrounding quotes here).
+const API = __API_BASE__;
+const TOKEN = __TOKEN__;
+// If we were opened with ?token=… (needed for the initial navigation, which
+// can't set headers), drop it from the address bar so it doesn't linger in
+// history; API calls below use the Authorization header instead.
+try {
+  const u = new URL(location.href);
+  if (u.searchParams.has("token")) { u.searchParams.delete("token"); history.replaceState(null, "", u.toString()); }
+} catch (e) {}
 const H = TOKEN ? { Authorization: "Bearer " + TOKEN } : {};
 const NANOS = 1e9;
 const usd = (n) => n == null ? "—" : "$" + (n / NANOS).toFixed(n && n < NANOS/100 ? 6 : 2);

package/src/client/index.ts CHANGED Viewed

@@ -174,20 +174,27 @@ function extractUsage(usage: any): {
   };
 }
-// The gateway doesn't report a dollar cost today, but if a future response ever
-// carries an unambiguous nanodollar cost we pass it straight through as
-// authoritative (finishRequest prefers it over the token-based estimate). Only
-// an explicitly nano-denominated field is trusted — a bare `cost` could be in
-// dollars and silently mis-bill by 1e9×.
+// The AI Gateway reports the authoritative dollar cost of each request.
+// @convex-dev/ai-sdk-provider surfaces it at
+// `providerMetadata.convexGateway.cost` (USD); convert to nanodollars and pass
+// it through as authoritative (finishRequest prefers it over the token-based
+// estimate). No-op on older provider versions that don't surface it.
 function extractGatewayCostNanos(result: any): number | undefined {
   const meta = result?.providerMetadata?.convexGateway;
-  const candidates = [meta?.costNanos, result?.usage?.costNanos];
-  for (const c of candidates) {
-    if (typeof c === "number" && Number.isFinite(c) && c >= 0) return c;
+  const costUsd = meta?.cost;
+  if (typeof costUsd === "number" && Number.isFinite(costUsd) && costUsd >= 0) {
+    return Math.round(costUsd * NANOS_PER_DOLLAR);
+  }
+  // Back-compat: honor an explicitly nano-denominated field if ever present.
+  const costNanos = meta?.costNanos ?? result?.usage?.costNanos;
+  if (typeof costNanos === "number" && Number.isFinite(costNanos) && costNanos >= 0) {
+    return Math.round(costNanos);
   }
   return undefined;
 }
+const NANOS_PER_DOLLAR = 1e9;
 // Flatten an AI SDK prompt (roles + content parts) into simple storable messages.
 function simplifyPrompt(prompt: any): Message[] {
   if (!Array.isArray(prompt)) return [];
@@ -221,6 +228,15 @@ function extractText(result: any): string {
 // ---------- client ----------
+// Length-independent-branch string compare, so the dashboard token check
+// doesn't leak the token via response timing. (Length itself is not secret.)
+function timingSafeEqual(a: string, b: string): boolean {
+  if (a.length !== b.length) return false;
+  let r = 0;
+  for (let i = 0; i < a.length; i++) r |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return r === 0;
+}
 /** Limits/controls settable on any budget bucket (user, action, or tag). */
 export type BucketLimits = {
   requestsPerMinute?: number;
@@ -474,6 +490,7 @@ export class AIBudget {
           const start = Date.now();
           let text = "";
           let usage: any = undefined;
+          let providerMetadata: any = undefined;
           try {
             const result = await doStream();
             // finishRequest is idempotent (terminal-guarded server-side), so
@@ -489,6 +506,7 @@ export class AIBudget {
                 responseText: text,
                 error,
                 ...extractUsage(usage),
+                costNanos: extractGatewayCostNanos({ providerMetadata }),
                 latencyMs: Date.now() - start,
               });
             };
@@ -498,7 +516,10 @@ export class AIBudget {
                   if (chunk?.type === "text-delta") {
                     text += chunk.delta ?? chunk.textDelta ?? "";
                   }
-                  if (chunk?.type === "finish") usage = chunk.usage;
+                  if (chunk?.type === "finish") {
+                    usage = chunk.usage;
+                    providerMetadata = chunk.providerMetadata ?? providerMetadata;
+                  }
                   if (chunk?.type === "error") void settle(String(chunk.error));
                   controller.enqueue(chunk);
                 },
@@ -756,8 +777,11 @@ export class AIBudget {
       if (!token) return { ok: false, token: "" };
       const url = new URL(request.url);
       const bearer = (request.headers.get("authorization") ?? "").replace(/^Bearer\s+/i, "");
+      // `?token=` is accepted only for the initial page navigation (a browser
+      // GET can't set headers); the page strips it from the URL on load and the
+      // JSON API is called with the bearer header. Compared in constant time.
       const provided = bearer || url.searchParams.get("token") || "";
-      return { ok: provided === token, token };
+      return { ok: timingSafeEqual(provided, token), token };
     };
     const json = (data: unknown, status = 200) =>
       new Response(JSON.stringify(data ?? null), {
@@ -827,10 +851,13 @@ export class AIBudget {
         }
       }
-      const html = DASHBOARD_HTML.replace(/__API_BASE__/g, `${prefix}/api`).replace(
-        /__TOKEN__/g,
-        token
-      );
+      // Inject as JSON literals (function replacers so `$` in the value isn't
+      // treated as a replacement pattern). This keeps a token/prefix containing
+      // quotes, backslashes, or `</script>` from breaking out of the JS string.
+      const html = DASHBOARD_HTML.replace(
+        /__API_BASE__/g,
+        () => JSON.stringify(`${prefix}/api`)
+      ).replace(/__TOKEN__/g, () => JSON.stringify(token));
       return new Response(html, {
         headers: { "content-type": "text/html; charset=utf-8" },
       });