@daemonitor/plugins 1.1.33 → 1.1.35

package/dist/plugins/index.js

@@ -13,6 +13,9 @@ import { createTplinkPlugin } from "./monitoring/TplinkPlugin.js";
 import { createPatroniPlugin } from "./monitoring/PatroniPlugin.js";
 import { createAdsensePlugin } from "./monitoring/AdsensePlugin.js";
 import { createGa4Plugin } from "./monitoring/Ga4Plugin.js";
+import { createNagiosPlugin } from "./monitoring/NagiosPlugin.js";
+import { createTplinkSwitchPlugin } from "./monitoring/TplinkSwitchPlugin.js";
+import { createCostPlugin } from "./monitoring/CostPlugin.js";
 // In future, implement other plugin factory functions using the same pattern
 // import { createOSPlugin } from "./monitoring/OSPlugin.js"
 // import { createMongoDBPlugin } from "./monitoring/MongoDBPlugin.js"
@@ -37,6 +40,9 @@ export default {
     Patroni: createPatroniPlugin,
     Adsense: createAdsensePlugin,
     Ga4: createGa4Plugin,
+    Nagios: createNagiosPlugin,
+    TplinkSwitch: createTplinkSwitchPlugin,
+    Cost: createCostPlugin,
     // CloudflarePlugin: createCloudflarePlugin,
     // EwelinkPlugin: createEwelinkPlugin,
     // MongoDBPlugin: createMongoDBPlugin,

package/dist/plugins/monitoring/CostPlugin.js

@@ -0,0 +1,124 @@
+import { createMonitoringPlugin } from "../../lib/MonitoringPlugin.js";
+import { PluginManager } from "../../lib/PluginManager.js";
+import { PROVIDERS } from "./CostProviders.js";
+const DEFAULT_INTERVAL = 3600000;
+const round2 = (n) => Math.round(n * 100) / 100;
+export function shiftDate(date, days) {
+    const t = new Date(`${date}T00:00:00Z`);
+    t.setUTCDate(t.getUTCDate() + days);
+    return t.toISOString().slice(0, 10);
+}
+export const todayUtc = (now = new Date()) => now.toISOString().slice(0, 10);
+/** Earlier of the 1st of this month and 29 days back: one fetch covers the month and a 30-day trace. */
+export function fetchStart(today) {
+    const monthStart = `${today.slice(0, 7)}-01`;
+    const back = shiftDate(today, -29);
+    return back < monthStart ? back : monthStart;
+}
+export function daysInMonth(today) {
+    const [y, m] = today.split("-").map(Number);
+    return new Date(Date.UTC(y, m, 0)).getUTCDate();
+}
+export function summarizeCost(f, today) {
+    const month = today.slice(0, 7);
+    const dom = Number(today.slice(8, 10));
+    const dim = daysInMonth(today);
+    if (!f.days) {
+        // ponytail: straight-line projection from MTD over elapsed days; today's
+        // partial day drags it low early in the month. Fine for an invoice-level API.
+        const mtd = Number(f.monthToDate) || 0;
+        return { monthToDate: round2(mtd), projected: round2((mtd / dom) * dim), daily: [] };
+    }
+    const by = new Map();
+    for (const d of f.days)
+        by.set(d.date, (by.get(d.date) || 0) + (Number(d.amount) || 0));
+    const at = (date) => by.get(date) || 0;
+    // Gap-filled, oldest first, one point per day for the trace.
+    const daily = [];
+    for (let i = 29; i >= 0; i--) {
+        const date = shiftDate(today, -i);
+        daily.push({ date, amount: round2(at(date)) });
+    }
+    let mtd = 0;
+    for (const [date, amount] of by)
+        if (date.startsWith(month) && date <= today)
+            mtd += amount;
+    const todayAmt = at(today);
+    // Project from COMPLETE days only: today is still filling in, and on the 1st
+    // there is nothing complete yet, so fall back to the partial day.
+    const projected = dom > 1 ? ((mtd - todayAmt) / (dom - 1)) * dim : mtd * dim;
+    // The 7 complete days before yesterday, the baseline a spike is judged against.
+    let prior = 0;
+    for (let i = 2; i <= 8; i++)
+        prior += at(shiftDate(today, -i));
+    return {
+        monthToDate: round2(mtd),
+        projected: round2(projected),
+        today: round2(todayAmt),
+        yesterday: round2(at(shiftDate(today, -1))),
+        avg7: round2(prior / 7),
+        last30: round2(daily.reduce((s, d) => s + d.amount, 0)),
+        daily,
+    };
+}
+export async function collectCost(p, today = todayUtc()) {
+    // `authFrom` borrows credentials from another config block, e.g. the
+    // top-level `workspace` block google-auth.mjs writes.
+    if (p.authFrom)
+        p = { ...PluginManager.getConfig(p.authFrom), ...p };
+    const fetcher = PROVIDERS[p.provider];
+    if (!fetcher)
+        throw new Error(`unknown cost provider "${p.provider}" (have: ${Object.keys(PROVIDERS).join(", ")})`);
+    const f = await fetcher(p, { start: fetchStart(today), end: today }, p.timeout || 20000);
+    return {
+        currency: (f.currency || "USD").toUpperCase(),
+        asOf: today,
+        ...summarizeCost(f, today),
+        breakdown: (f.breakdown || []).filter((b) => b.amount).sort((a, b) => b.amount - a.amount).slice(0, 12)
+            .map((b) => ({ name: b.name, amount: round2(b.amount) })),
+    };
+}
+export function createCostPlugin() {
+    let refreshTimer = null;
+    const refreshFn = async (plugin) => {
+        const cfg = (plugin.config || {});
+        const intervalMs = cfg.refreshInterval || DEFAULT_INTERVAL;
+        for (const p of cfg.providers || []) {
+            const id = p.id || p.provider;
+            const meta = {
+                name: p.name || p.provider,
+                provider: p.provider,
+                intervalMs,
+                ...(p.budget ? { budget: Number(p.budget) } : {}),
+                ...(p.spikeFactor ? { spikeFactor: Number(p.spikeFactor) } : {}),
+            };
+            try {
+                await plugin.send({ ...meta, ...(await collectCost(p)) }, `cost-${id}`);
+            }
+            catch (e) {
+                await plugin.send({
+                    ...meta,
+                    error: String(e?.message || e).slice(0, 160),
+                    ...(e?.status === 401 || e?.status === 403 ? { authExpired: true } : {}),
+                }, `cost-${id}`);
+            }
+        }
+    };
+    const monitorFn = async (plugin) => {
+        const cfg = (plugin.config || {});
+        if (!cfg.providers?.length) {
+            console.error("cost plugin: no providers configured");
+            return;
+        }
+        await refreshFn(plugin);
+        // Billing data lags by hours and AWS charges per Cost Explorer call, so hourly loses nothing.
+        refreshTimer = setInterval(() => refreshFn(plugin), cfg.refreshInterval || DEFAULT_INTERVAL);
+    };
+    const teardownFn = async () => {
+        if (refreshTimer)
+            clearInterval(refreshTimer);
+        refreshTimer = null;
+    };
+    return createMonitoringPlugin("cost", "cost", "Service spend per provider (daily, month to date, projection against a budget)", async () => { }, monitorFn, refreshFn, teardownFn);
+}
+export default createCostPlugin;

package/dist/plugins/monitoring/CostProviders.js

@@ -0,0 +1,353 @@
+import { createHash, createHmac } from "node:crypto";
+import { googleAccessToken } from "./AdsensePlugin.js";
+/** Thrown for non-2xx; `status` lets the plugin tell a dead key (401/403) from an outage. */
+export class HttpError extends Error {
+    status;
+    constructor(message, status) {
+        super(message);
+        this.status = status;
+    }
+}
+async function call(url, init, timeout) {
+    const res = await fetch(url, { ...init, signal: AbortSignal.timeout(timeout) });
+    if (!res.ok) {
+        const text = await res.text().catch(() => "");
+        let msg = text.slice(0, 160);
+        try {
+            const j = JSON.parse(text);
+            msg = j?.error?.message || j?.errors?.[0]?.message || j?.message || j?.detail || j?.msg || (typeof j?.error === "string" ? j.error : msg);
+        }
+        catch { /* not JSON */ }
+        throw new HttpError(`HTTP ${res.status}${msg ? `: ${msg}` : ""}`, res.status);
+    }
+    return res;
+}
+const json = async (url, init, timeout) => (await call(url, init, timeout)).json();
+const need = (cfg, ...keys) => {
+    const missing = keys.filter((k) => !cfg[k]);
+    if (missing.length)
+        throw new Error(`${cfg.provider} needs ${missing.join(", ")}`);
+};
+export const nextDay = (date) => {
+    const t = new Date(`${date}T00:00:00Z`);
+    t.setUTCDate(t.getUTCDate() + 1);
+    return t.toISOString().slice(0, 10);
+};
+const unixDay = (date) => Math.floor(Date.parse(`${date}T00:00:00Z`) / 1000);
+const isoDay = (unixSec) => new Date(unixSec * 1000).toISOString().slice(0, 10);
+/** Accumulates per-day amounts and per-item month-to-date amounts. */
+export function tally(month) {
+    const days = new Map();
+    const items = new Map();
+    return {
+        add(date, amount, item) {
+            if (!date || !Number.isFinite(amount))
+                return;
+            days.set(date, (days.get(date) || 0) + amount);
+            if (item && date.startsWith(month))
+                items.set(item, (items.get(item) || 0) + amount);
+        },
+        days: () => [...days].map(([date, amount]) => ({ date, amount })),
+        breakdown: () => [...items].map(([name, amount]) => ({ name, amount })),
+    };
+}
+// OpenAI: Costs API, admin key. Amounts are numbers in dollars. End is exclusive.
+const openai = async (cfg, { start, end }, timeout) => {
+    need(cfg, "adminKey");
+    const t = tally(end.slice(0, 7));
+    let page;
+    do {
+        const q = new URLSearchParams({ start_time: String(unixDay(start)), end_time: String(unixDay(nextDay(end))), bucket_width: "1d", limit: "31" });
+        q.append("group_by[]", "line_item");
+        if (page)
+            q.set("page", page);
+        const body = await json(`https://api.openai.com/v1/organization/costs?${q}`, { headers: { Authorization: `Bearer ${cfg.adminKey}` } }, timeout);
+        for (const b of body.data || []) {
+            for (const r of b.results || [])
+                t.add(isoDay(b.start_time), Number(r.amount?.value) || 0, r.line_item || undefined);
+        }
+        page = body.has_more ? body.next_page : undefined;
+    } while (page);
+    return { currency: "USD", days: t.days(), breakdown: t.breakdown() };
+};
+// Anthropic: Admin API cost report. Amount is a decimal STRING in CENTS.
+const anthropic = async (cfg, { start, end }, timeout) => {
+    need(cfg, "adminKey");
+    const t = tally(end.slice(0, 7));
+    let page;
+    do {
+        const q = new URLSearchParams({ starting_at: `${start}T00:00:00Z`, ending_at: `${nextDay(end)}T00:00:00Z`, bucket_width: "1d", limit: "31" });
+        q.append("group_by[]", "description");
+        if (page)
+            q.set("page", page);
+        const body = await json(`https://api.anthropic.com/v1/organizations/cost_report?${q}`, {
+            headers: { "x-api-key": cfg.adminKey, "anthropic-version": "2023-06-01" },
+        }, timeout);
+        for (const b of body.data || []) {
+            const date = String(b.starting_at || "").slice(0, 10);
+            for (const r of b.results || [])
+                t.add(date, (parseFloat(r.amount) || 0) / 100, r.model || r.description || r.cost_type || undefined);
+        }
+        page = body.has_more ? body.next_page : undefined;
+    } while (page);
+    return { currency: "USD", days: t.days(), breakdown: t.breakdown() };
+};
+/** AWS SigV4 for a JSON POST. Small enough not to pull in the SDK for one call. */
+export function sigv4(opts) {
+    const now = opts.now || new Date();
+    const amzDate = now.toISOString().replace(/[:-]|\.\d{3}/g, "");
+    const day = amzDate.slice(0, 8);
+    const sha = (s) => createHash("sha256").update(s).digest("hex");
+    const hmac = (k, s) => createHmac("sha256", k).update(s).digest();
+    const headers = {
+        "content-type": "application/x-amz-json-1.1",
+        host: opts.host,
+        "x-amz-date": amzDate,
+        "x-amz-target": opts.target,
+        ...(opts.sessionToken ? { "x-amz-security-token": opts.sessionToken } : {}),
+    };
+    const names = Object.keys(headers).sort();
+    const canonical = ["POST", "/", "", ...names.map((n) => `${n}:${headers[n]}`), "", names.join(";"), sha(opts.body)].join("\n");
+    const scope = `${day}/${opts.region}/${opts.service}/aws4_request`;
+    const toSign = ["AWS4-HMAC-SHA256", amzDate, scope, sha(canonical)].join("\n");
+    const key = hmac(hmac(hmac(hmac(`AWS4${opts.secretAccessKey}`, day), opts.region), opts.service), "aws4_request");
+    const sig = createHmac("sha256", key).update(toSign).digest("hex");
+    headers.authorization = `AWS4-HMAC-SHA256 Credential=${opts.accessKeyId}/${scope}, SignedHeaders=${names.join(";")}, Signature=${sig}`;
+    return headers;
+}
+// AWS: Cost Explorer GetCostAndUsage. $0.01 per request, so this is one call
+// (plus pages). Amounts are dollar strings. End is exclusive.
+const aws = async (cfg, { start, end }, timeout) => {
+    need(cfg, "accessKeyId", "secretAccessKey");
+    const t = tally(end.slice(0, 7));
+    let token;
+    let currency = "USD";
+    do {
+        const body = JSON.stringify({
+            TimePeriod: { Start: start, End: nextDay(end) },
+            Granularity: "DAILY",
+            Metrics: ["UnblendedCost"],
+            GroupBy: [{ Type: "DIMENSION", Key: "SERVICE" }],
+            ...(token ? { NextPageToken: token } : {}),
+        });
+        const host = "ce.us-east-1.amazonaws.com";
+        const headers = sigv4({
+            host, region: "us-east-1", service: "ce", target: "AWSInsightsIndexService.GetCostAndUsage", body,
+            accessKeyId: cfg.accessKeyId, secretAccessKey: cfg.secretAccessKey, sessionToken: cfg.sessionToken,
+        });
+        const res = await json(`https://${host}/`, { method: "POST", headers, body }, timeout);
+        for (const r of res.ResultsByTime || []) {
+            const date = r.TimePeriod?.Start;
+            for (const g of r.Groups || []) {
+                const m = g.Metrics?.UnblendedCost;
+                if (m?.Unit)
+                    currency = m.Unit;
+                t.add(date, parseFloat(m?.Amount) || 0, g.Keys?.[0]);
+            }
+        }
+        token = res.NextPageToken;
+    } while (token);
+    return { currency, days: t.days(), breakdown: t.breakdown() };
+};
+// Vercel: FOCUS billing charges, streamed as JSONL, many lines per day (one per SKU).
+const vercel = async (cfg, { start, end }, timeout) => {
+    need(cfg, "token", "teamId");
+    const t = tally(end.slice(0, 7));
+    const q = new URLSearchParams({ teamId: cfg.teamId, from: `${start}T00:00:00Z`, to: `${nextDay(end)}T00:00:00Z` });
+    const text = await (await call(`https://api.vercel.com/v1/billing/charges?${q}`, { headers: { Authorization: `Bearer ${cfg.token}` } }, timeout)).text();
+    let currency = "USD";
+    for (const line of text.split("\n")) {
+        if (!line.trim())
+            continue;
+        const c = JSON.parse(line);
+        if (c.BillingCurrency)
+            currency = c.BillingCurrency;
+        t.add(String(c.ChargePeriodStart || "").slice(0, 10), Number(c.BilledCost) || 0, c.ServiceName || undefined);
+    }
+    return { currency, days: t.days(), breakdown: t.breakdown() };
+};
+// Fastly: month-to-date invoice only. No daily data exists in the API.
+const fastly = async (cfg, _range, timeout) => {
+    need(cfg, "token");
+    const inv = await json("https://api.fastly.com/billing/v3/invoices/month-to-date", { headers: { "Fastly-Key": cfg.token, Accept: "application/json" } }, timeout);
+    const items = inv.transaction_line_items || [];
+    return {
+        currency: inv.currency_code || "USD",
+        monthToDate: Number(inv.monthly_transaction_amount) || items.reduce((s, i) => s + (Number(i.amount) || 0), 0),
+        breakdown: items.map((i) => ({ name: i.product_name || i.description || "item", amount: Number(i.amount) || 0 })),
+    };
+};
+// Cloudflare: billable usage (alpha, PayGo usage only, not plan fees). Called
+// with no range: it then returns the current billing period, which sidesteps
+// the rule that a range must include the subscription's billing-anchor day.
+const cloudflare = async (cfg, { end }, timeout) => {
+    need(cfg, "token", "accountId");
+    const t = tally(end.slice(0, 7));
+    const body = await json(`https://api.cloudflare.com/client/v4/accounts/${cfg.accountId}/billable-usage`, { headers: { Authorization: `Bearer ${cfg.token}` } }, timeout);
+    let currency = "USD";
+    for (const r of body.result || []) {
+        if (r.BillingCurrency)
+            currency = r.BillingCurrency;
+        t.add(String(r.ChargePeriodStart || "").slice(0, 10), Number(r.BilledCost) || 0, r.ServiceName || r.ChargeDescription || undefined);
+    }
+    return { currency, days: t.days(), breakdown: t.breakdown() };
+};
+// PostHog: daily spend series, personal API key with billing:read. End is INCLUSIVE.
+const posthog = async (cfg, { start, end }, timeout) => {
+    need(cfg, "apiKey");
+    const host = (cfg.host || "https://us.posthog.com").replace(/\/$/, "");
+    const t = tally(end.slice(0, 7));
+    const q = new URLSearchParams({ start_date: start, end_date: end, interval: "day", breakdowns: JSON.stringify(["type"]) });
+    let url = `${host}/api/billing/spend/?${q}`;
+    while (url) {
+        const body = await json(url, { headers: { Authorization: `Bearer ${cfg.apiKey}` } }, timeout);
+        for (const s of body.results || []) {
+            const dates = s.dates || [];
+            dates.forEach((d, i) => t.add(d, Number(s.data?.[i]) || 0, s.breakdown_value || s.label || undefined));
+        }
+        url = body.next || null;
+    }
+    return { currency: "USD", days: t.days(), breakdown: t.breakdown() };
+};
+// Google Ads: GAQL over searchStream. cost_micros is an int64 string. Dates are
+// the ACCOUNT's time zone, which this treats as UTC days (off by a few hours at most).
+const googleAds = async (cfg, { start, end }, timeout) => {
+    need(cfg, "clientId", "clientSecret", "refreshToken", "developerToken", "customerId");
+    const t = tally(end.slice(0, 7));
+    const customer = String(cfg.customerId).replace(/-/g, "");
+    const headers = {
+        Authorization: `Bearer ${await googleAccessToken({ clientId: cfg.clientId, clientSecret: cfg.clientSecret, refreshToken: cfg.refreshToken }, timeout)}`,
+        "developer-token": cfg.developerToken,
+        "Content-Type": "application/json",
+        ...(cfg.loginCustomerId ? { "login-customer-id": String(cfg.loginCustomerId).replace(/-/g, "") } : {}),
+    };
+    const query = `SELECT segments.date, customer.currency_code, campaign.name, metrics.cost_micros FROM campaign WHERE segments.date BETWEEN '${start}' AND '${end}'`;
+    const batches = await json(`https://googleads.googleapis.com/${cfg.apiVersion || "v26"}/customers/${customer}/googleAds:searchStream`, {
+        method: "POST", headers, body: JSON.stringify({ query }),
+    }, timeout);
+    let currency = "USD";
+    for (const b of Array.isArray(batches) ? batches : [batches]) {
+        for (const r of b.results || []) {
+            if (r.customer?.currencyCode)
+                currency = r.customer.currencyCode;
+            t.add(r.segments?.date, (Number(r.metrics?.costMicros) || 0) / 1e6, r.campaign?.name);
+        }
+    }
+    return { currency, days: t.days(), breakdown: t.breakdown() };
+};
+// Google Cloud: there is no spend REST API. The supported source is the Cloud
+// Billing export to BigQuery (standard usage cost), queried here with
+// jobs.query. Net cost = cost + credits (credits are negative). The export
+// lands hours late, so today and yesterday fill in after the fact.
+// ponytail: OAuth refresh token (scope bigquery.readonly), same as the other
+// Google sources. Add service-account JWT auth if a human token is unwelcome.
+const gcp = async (cfg, { start, end }, timeout) => {
+    need(cfg, "clientId", "clientSecret", "refreshToken", "projectId", "table");
+    // `project.dataset.gcp_billing_export_v1_XXXXXX`. Validated because it is
+    // spliced into SQL; BigQuery cannot bind a table name as a parameter.
+    if (!/^[\w-]+\.[\w]+\.[\w]+$/.test(cfg.table))
+        throw new Error("gcp table must look like project.dataset.gcp_billing_export_v1_XXXXXX");
+    const t = tally(end.slice(0, 7));
+    const query = `SELECT FORMAT_DATE('%F', DATE(usage_start_time)) AS day, service.description AS item, ANY_VALUE(currency) AS currency,
+      SUM(cost) + SUM(IFNULL((SELECT SUM(c.amount) FROM UNNEST(credits) c), 0)) AS amount
+    FROM \`${cfg.table}\`
+    WHERE DATE(_PARTITIONTIME) >= DATE_SUB(@start, INTERVAL 1 DAY) AND DATE(usage_start_time) BETWEEN @start AND @end
+    GROUP BY day, item`;
+    const body = await json(`https://bigquery.googleapis.com/bigquery/v2/projects/${cfg.projectId}/queries`, {
+        method: "POST",
+        headers: {
+            Authorization: `Bearer ${await googleAccessToken({ clientId: cfg.clientId, clientSecret: cfg.clientSecret, refreshToken: cfg.refreshToken }, timeout)}`,
+            "Content-Type": "application/json",
+        },
+        body: JSON.stringify({
+            query, useLegacySql: false, timeoutMs: timeout, parameterMode: "NAMED",
+            queryParameters: [
+                { name: "start", parameterType: { type: "DATE" }, parameterValue: { value: start } },
+                { name: "end", parameterType: { type: "DATE" }, parameterValue: { value: end } },
+            ],
+        }),
+    }, timeout + 5000);
+    if (body.jobComplete === false)
+        throw new Error("BigQuery query did not finish in time");
+    let currency = "USD";
+    // Rows come back as { f: [{ v }] } in SELECT order, every value a string.
+    for (const r of body.rows || []) {
+        const [day, item, cur, amount] = (r.f || []).map((c) => c?.v);
+        if (cur)
+            currency = cur;
+        t.add(day, Number(amount) || 0, item || undefined);
+    }
+    return { currency, days: t.days(), breakdown: t.breakdown() };
+};
+// Meta Ads: Marketing API insights, one row per day. spend is a numeric string.
+const metaAds = async (cfg, { start, end }, timeout) => {
+    need(cfg, "accessToken", "adAccountId");
+    const t = tally(end.slice(0, 7));
+    const acct = String(cfg.adAccountId).replace(/^act_/, "");
+    const v = cfg.apiVersion || "v26.0";
+    const auth = { headers: { Authorization: `Bearer ${cfg.accessToken}` } };
+    const { currency } = await json(`https://graph.facebook.com/${v}/act_${acct}?fields=currency`, auth, timeout);
+    const q = new URLSearchParams({
+        fields: "spend,campaign_name", level: "campaign", time_increment: "1",
+        time_range: JSON.stringify({ since: start, until: end }), limit: "500",
+    });
+    let url = `https://graph.facebook.com/${v}/act_${acct}/insights?${q}`;
+    while (url) {
+        const body = await json(url, auth, timeout);
+        for (const r of body.data || [])
+            t.add(r.date_start, parseFloat(r.spend) || 0, r.campaign_name);
+        url = body.paging?.next || null;
+    }
+    return { currency: currency || "USD", days: t.days(), breakdown: t.breakdown() };
+};
+// Google Workspace: there is no invoice API, so this is seats x price. The
+// Licensing API lists every assigned seat with its plan (SKU), and seats are
+// priced from Google's published list prices (USD per seat per month) unless
+// `prices` overrides them by SKU name or id. The bill accrues evenly through the
+// month, so each day carries 1/daysInMonth of it and the projection is the
+// monthly bill itself.
+// ponytail: today's seat count is applied to the whole 30-day trace (no seat
+// history), and Enterprise plans have no public price, so they cost 0 until
+// `prices` names one.
+export const WORKSPACE_LIST_PRICE = {
+    "1010020027": { flexible: 8.4, annual: 7 }, // Business Starter
+    "1010020028": { flexible: 16.8, annual: 14 }, // Business Standard
+    "1010020025": { flexible: 26.4, annual: 22 }, // Business Plus
+};
+const workspace = async (cfg, { start, end }, timeout) => {
+    need(cfg, "clientId", "clientSecret", "refreshToken", "customerId");
+    const auth = { headers: { Authorization: `Bearer ${await googleAccessToken({ clientId: cfg.clientId, clientSecret: cfg.clientSecret, refreshToken: cfg.refreshToken }, timeout)}` } };
+    const seats = new Map();
+    for (const product of cfg.products || ["Google-Apps"]) {
+        let page = "";
+        do {
+            const q = new URLSearchParams({ customerId: cfg.customerId, maxResults: "1000", ...(page ? { pageToken: page } : {}) });
+            const body = await json(`https://licensing.googleapis.com/apps/licensing/v1/product/${encodeURIComponent(product)}/users?${q}`, auth, timeout);
+            for (const a of body.items || []) {
+                const e = seats.get(a.skuId) || { name: a.skuName || a.skuId, count: 0 };
+                e.count++;
+                seats.set(a.skuId, e);
+            }
+            page = body.nextPageToken || "";
+        } while (page);
+    }
+    const plan = cfg.plan === "annual" ? "annual" : "flexible";
+    const priceOf = (sku, name) => Number(cfg.prices?.[sku] ?? cfg.prices?.[name] ?? WORKSPACE_LIST_PRICE[sku]?.[plan] ?? 0);
+    const lines = [...seats].map(([sku, { name, count }]) => ({ name: `${name} × ${count}`, monthly: count * priceOf(sku, name) }));
+    const monthly = lines.reduce((s, l) => s + l.monthly, 0);
+    const [y = 1970, m = 1] = end.split("-").map(Number);
+    const dim = new Date(Date.UTC(y, m, 0)).getUTCDate();
+    const days = [];
+    for (let d = start; d <= end; d = nextDay(d))
+        days.push({ date: d, amount: monthly / dim });
+    const dom = Number(end.slice(8, 10));
+    return {
+        currency: "USD",
+        days,
+        // Month to date per plan, so the breakdown sums to the row's MTD.
+        breakdown: lines.map((l) => ({ name: l.name, amount: (l.monthly / dim) * dom })),
+    };
+};
+export const PROVIDERS = {
+    openai, anthropic, aws, vercel, fastly, cloudflare, posthog, gcp, workspace, "google-ads": googleAds, "meta-ads": metaAds,
+};

package/dist/plugins/monitoring/NagiosPlugin.js

@@ -0,0 +1,138 @@
+import { execFile } from "node:child_process";
+import { createMonitoringPlugin } from "../../lib/MonitoringPlugin.js";
+const STATES = ["ok", "warning", "critical", "unknown"];
+// Output is capped: a check printing a megabyte would otherwise be sent every
+// minute and stored in history.
+const MAX_OUTPUT = 4000;
+export function stateOf(exitCode) {
+    return exitCode != null && exitCode >= 0 && exitCode <= 3 ? STATES[exitCode] : "unknown";
+}
+const num = (s) => (s == null || s === "" || Number.isNaN(Number(s)) ? undefined : Number(s));
+/**
+ * Parse performance data: space-separated `'label'=value[UOM];[warn];[crit];[min];[max]`.
+ * Labels may be quoted to contain spaces, with '' standing for a literal quote.
+ * Malformed items are skipped rather than failing the whole check.
+ */
+export function parsePerfdata(raw) {
+    const out = [];
+    const re = /\s*('(?:[^']|'')+'|[^\s=']+)=(\S+)/g;
+    let m;
+    while ((m = re.exec(raw))) {
+        const label = m[1].startsWith("'") ? m[1].slice(1, -1).replace(/''/g, "'") : m[1];
+        const [valueUom, warn, crit, min, max] = m[2].split(";");
+        const vm = valueUom.match(/^(-?[\d.]+(?:[eE][-+]?\d+)?)([a-zA-Z%]*)$/);
+        if (!vm)
+            continue; // "U" (undetermined) or garbage
+        out.push({
+            label,
+            value: Number(vm[1]),
+            ...(vm[2] ? { uom: vm[2] } : {}),
+            ...(warn ? { warn } : {}),
+            ...(crit ? { crit } : {}),
+            ...(num(min) != null ? { min: num(min) } : {}),
+            ...(num(max) != null ? { max: num(max) } : {}),
+        });
+    }
+    return out;
+}
+/**
+ * Split plugin output into the status line, the long output and perfdata.
+ * Perfdata can follow "|" on the first line and on any long-output line after
+ * a "|" there (the Nagios 3 multi-line form).
+ */
+export function parseOutput(stdout) {
+    const lines = stdout.replace(/\r/g, "").replace(/\n+$/, "").split("\n");
+    const [first = "", ...rest] = lines;
+    const [output, firstPerf = ""] = splitPipe(first);
+    let perf = firstPerf;
+    const long = [];
+    let inPerf = false;
+    for (const line of rest) {
+        if (inPerf) {
+            perf += " " + line;
+            continue;
+        }
+        const [text, more] = splitPipe(line);
+        if (text.trim())
+            long.push(text.trimEnd());
+        if (more != null) {
+            perf += " " + more;
+            inPerf = true;
+        }
+    }
+    return {
+        output: output.trim(),
+        ...(long.length ? { longOutput: long.join("\n").slice(0, MAX_OUTPUT) } : {}),
+        perfdata: parsePerfdata(perf),
+    };
+}
+function splitPipe(line) {
+    const i = line.indexOf("|");
+    return i < 0 ? [line] : [line.slice(0, i), line.slice(i + 1)];
+}
+export async function runCheck(check, defaults = {}) {
+    const [bin, ...args] = check.command;
+    const resolved = defaults.pluginDir && !bin.includes("/") ? `${defaults.pluginDir.replace(/\/$/, "")}/${bin}` : bin;
+    const timeoutMs = (check.timeout ?? defaults.timeout ?? 30) * 1000;
+    const started = Date.now();
+    return new Promise((resolve) => {
+        execFile(resolved, args, { timeout: timeoutMs, maxBuffer: 256 * 1024, env: { ...process.env, ...(check.env || {}) }, killSignal: "SIGKILL" }, (err, stdout, stderr) => {
+            const durationMs = Date.now() - started;
+            const base = { name: check.name, command: bin.split("/").pop() || bin, durationMs };
+            // A non-zero exit is the plugin reporting a state, not a failure to run.
+            const exitCode = err ? (typeof err.code === "number" ? err.code : null) : 0;
+            if (err && err.killed) {
+                return resolve({ ...base, state: "unknown", exitCode: null, output: `Check timed out after ${timeoutMs / 1000}s`, perfdata: [], timedOut: true });
+            }
+            if (err && exitCode == null) {
+                // Couldn't start it at all: ENOENT, EACCES and so on.
+                return resolve({ ...base, state: "unknown", exitCode: null, output: `Could not run ${base.command}: ${err.code || err.message}`, perfdata: [], error: String(err.message || err).slice(0, 300) });
+            }
+            const parsed = parseOutput(String(stdout || stderr || "").slice(0, MAX_OUTPUT));
+            resolve({ ...base, state: stateOf(exitCode), exitCode, ...parsed, output: parsed.output || "(no output)" });
+        });
+    });
+}
+function slug(s) {
+    return s.toLowerCase().replace(/[^a-z0-9_.-]+/g, "-").replace(/^-+|-+$/g, "");
+}
+export function createNagiosPlugin() {
+    let refreshTimer = null;
+    let running = false;
+    const checksOf = (plugin) => {
+        const cfg = (plugin.config || {});
+        return (Array.isArray(cfg.checks) ? cfg.checks : []).filter((c) => c?.name && Array.isArray(c.command) && c.command.length && c.command.every((a) => typeof a === "string"));
+    };
+    const refreshFn = async (plugin) => {
+        // A slow check must not pile up overlapping runs of itself.
+        if (running)
+            return;
+        running = true;
+        try {
+            const cfg = (plugin.config || {});
+            await Promise.all(checksOf(plugin).map(async (check) => {
+                const result = await runCheck(check, cfg);
+                // The interval tells the dashboard how long silence is normal, so a
+                // check that runs every 10 minutes doesn't read OFFLINE in between.
+                await plugin.send({ ...result, intervalMs: cfg.refreshInterval || 60000 }, `nagios-${slug(check.name)}`);
+            }));
+        }
+        finally {
+            running = false;
+        }
+    };
+    const monitorFn = async (plugin) => {
+        const n = checksOf(plugin).length;
+        if (!n)
+            console.warn("nagios: no valid checks configured (each needs a name and a command array)");
+        await refreshFn(plugin);
+        refreshTimer = setInterval(() => refreshFn(plugin), plugin.config?.refreshInterval || 60000);
+    };
+    const teardownFn = async () => {
+        if (refreshTimer)
+            clearInterval(refreshTimer);
+        refreshTimer = null;
+    };
+    return createMonitoringPlugin("nagios", "nagios", "Nagios-compatible check commands", async () => { }, monitorFn, refreshFn, teardownFn);
+}
+export default createNagiosPlugin;

package/dist/plugins/monitoring/TplinkSwitchPlugin.js

@@ -0,0 +1,163 @@
+import { createHash } from "node:crypto";
+import { createMonitoringPlugin } from "../../lib/MonitoringPlugin.js";
+const HEADERS = { "Content-Type": "application/json;charset=utf-8", "X-Requested-With": "XMLHttpRequest", SourceType: "switch_web" };
+const LOOP = { "0": "normal", "1": "blocked", "2": "loop" };
+export const md5Upper = (s) => createHash("md5").update(s).digest("hex").toUpperCase();
+/** Build the report from the raw API results. Pure, so the check can drive it. */
+export function buildReport(target, raw, rates) {
+    const info = raw.info || {};
+    const trafficById = new Map((raw.traffic?.port_list || []).map((p) => [p.port_id, p]));
+    const loopById = new Map((raw.loops?.port_list || []).map((p) => [p.port_id, p]));
+    const interfaces = (raw.ports?.port_list || []).map((p) => {
+        const speed = String(p.port_speed_actual || "");
+        const up = !!speed && speed !== "Link Down";
+        const t = trafficById.get(p.port_id);
+        const r = rates.get(p.port_id) || {};
+        return {
+            name: `port ${p.port_id}`,
+            up,
+            adminUp: p.port_state_cfg !== "0",
+            ...(up ? { speed, duplex: p.port_duplex_actual } : {}),
+            ...(t ? { rxBytes: t.rx_bytes, txBytes: t.tx_bytes } : {}),
+            ...(r.inBps != null ? { inBps: r.inBps, outBps: r.outBps } : {}),
+            loop: LOOP[String(loopById.get(p.port_id)?.port_state ?? "0")] || "normal",
+        };
+    });
+    const portIds = (raw.ports?.port_list || []).map((p) => p.port_id);
+    const downUplinks = (target.uplinkPorts || []).filter((id) => {
+        const i = portIds.indexOf(id);
+        return i < 0 || !interfaces[i].up;
+    });
+    return {
+        ip: target.host,
+        name: target.name || info.des || target.host,
+        kind: "switch",
+        model: info.hw_ver || info.des,
+        serial: info.serial_number,
+        mac: info.sys_mac_addr,
+        firmware: info.fw_ver,
+        sysDescr: [info.hw_ver || info.des, info.fw_ver && `firmware ${info.fw_ver}`].filter(Boolean).join(", "),
+        reachable: true,
+        portsUp: interfaces.filter((i) => i.up).length,
+        portsTotal: interfaces.length,
+        interfaces,
+        loops: interfaces.filter((i) => i.loop === "loop").map((i) => i.name),
+        blocked: interfaces.filter((i) => i.loop === "blocked").map((i) => i.name),
+        // Every configured uplink, so the dashboard can mark it while it's healthy too.
+        uplinks: (target.uplinkPorts || []).map((id) => `port ${id}`),
+        downUplinks: downUplinks.map((id) => `port ${id}`),
+    };
+}
+/** Byte rates from two counter readings. A counter that went backwards (reboot, clear) gives no rate. */
+export function ratesBetween(prev, now) {
+    const out = new Map();
+    if (!prev)
+        return out;
+    const dt = (now.at - prev.at) / 1000;
+    if (dt <= 0)
+        return out;
+    for (const [id, c] of now.ports) {
+        const p = prev.ports.get(id);
+        if (!p || c.rx < p.rx || c.tx < p.tx)
+            continue;
+        out.set(id, { inBps: Math.round((c.rx - p.rx) / dt), outBps: Math.round((c.tx - p.tx) / dt) });
+    }
+    return out;
+}
+export class LoginRefused extends Error {
+}
+async function call(host, path, opts) {
+    const res = await fetch(`http://${host}${path}`, {
+        method: opts.body !== undefined ? "POST" : "GET",
+        headers: opts.token ? { ...HEADERS, Authorization: opts.token } : HEADERS,
+        ...(opts.body !== undefined ? { body: JSON.stringify(opts.body) } : {}),
+        signal: AbortSignal.timeout(opts.timeoutMs),
+    });
+    if (!res.ok)
+        throw new Error(`${path} returned HTTP ${res.status}`);
+    const json = await res.json();
+    if (json?.error_code)
+        throw Object.assign(new Error(`${path} error_code ${json.error_code}`), { code: json.error_code });
+    return json?.result || {};
+}
+export const newSwitchState = () => ({ counters: new Map(), refusedUntil: new Map() });
+/** Log in, read one switch, log out. Throws LoginRefused or a network error. */
+export async function readSwitch(target, cfg, state) {
+    const { counters, refusedUntil } = state;
+    const timeoutMs = cfg.timeoutMs || 8000;
+    const wait = refusedUntil.get(target.host);
+    if (wait && Date.now() < wait) {
+        throw new LoginRefused(`login refused earlier; not retrying until ${new Date(wait).toISOString()} so the switch doesn't lock the account`);
+    }
+    let login;
+    try {
+        login = await call(target.host, "/login/status", { body: { login_user: target.username, login_pwd: md5Upper(target.password) }, timeoutMs });
+    }
+    catch (e) {
+        if (e?.code) {
+            refusedUntil.set(target.host, Date.now() + (cfg.loginBackoffMs || 30 * 60 * 1000));
+            throw new LoginRefused(`login refused (error_code ${e.code}); check the username and password`);
+        }
+        throw e;
+    }
+    refusedUntil.delete(target.host);
+    const token = login.token;
+    try {
+        const [info, ports, traffic, loops] = await Promise.all([
+            call(target.host, "/system_summary/system_information_status", { token, timeoutMs }),
+            call(target.host, "/switching/port_settings_status", { token, timeoutMs }),
+            call(target.host, "/traffic_summary/traffic_summary_port_status", { token, timeoutMs }),
+            call(target.host, "/loop_detection/loop_detection_status", { token, timeoutMs }).catch(() => ({})),
+        ]);
+        const now = {
+            at: Date.now(),
+            ports: new Map((traffic.port_list || []).map((p) => [p.port_id, { rx: Number(p.rx_bytes) || 0, tx: Number(p.tx_bytes) || 0 }])),
+        };
+        const rates = ratesBetween(counters.get(target.host), now);
+        counters.set(target.host, now);
+        return buildReport(target, { info, ports, traffic, loops }, rates);
+    }
+    finally {
+        // Log out every time: these switches allow few admin sessions, and an
+        // idle one held by the agent could lock someone out of the web UI.
+        await call(target.host, "/show_up/logout_status", { token, body: {}, timeoutMs }).catch(() => { });
+    }
+}
+export function createTplinkSwitchPlugin() {
+    let refreshTimer = null;
+    const state = newSwitchState();
+    const refreshFn = async (plugin) => {
+        const cfg = (plugin.config || {});
+        const targets = (cfg.switches || []).filter((s) => s?.host && s.username && s.password);
+        await Promise.all(targets.map(async (target) => {
+            let report;
+            try {
+                report = await readSwitch(target, cfg, state);
+            }
+            catch (e) {
+                report = {
+                    ip: target.host,
+                    name: target.name || target.host,
+                    kind: "switch",
+                    reachable: e instanceof LoginRefused,
+                    error: String(e?.message || e).slice(0, 200),
+                };
+            }
+            await plugin.send(report, `tplinkswitch-${target.host.replace(/[^0-9a-zA-Z]+/g, "-")}`);
+        }));
+    };
+    const monitorFn = async (plugin) => {
+        const cfg = (plugin.config || {});
+        if (!(cfg.switches || []).length)
+            console.warn("tplinkswitch: no switches configured");
+        await refreshFn(plugin);
+        refreshTimer = setInterval(() => refreshFn(plugin), cfg.refreshInterval || 60000);
+    };
+    const teardownFn = async () => {
+        if (refreshTimer)
+            clearInterval(refreshTimer);
+        refreshTimer = null;
+    };
+    return createMonitoringPlugin("tplinkswitch", "tplinkswitch", "TP-Link Omada Easy Managed switch (web API)", async () => { }, monitorFn, refreshFn, teardownFn);
+}
+export default createTplinkSwitchPlugin;

package/dist/plugins/monitoring/WebsitePlugin.js

@@ -129,11 +129,18 @@ export function createWebsitePlugin() {
         let publicResult;
         try {
             const ctrl = new AbortController();
-            const t = ep.timeout ? setTimeout(() => ctrl.abort(), ep.timeout) : null;
-            const res = await fetch(ep.url, { signal: ctrl.signal, redirect: "follow", headers: ep.headers });
-            if (t)
+            // Always bounded: with no timer the runtime's own 5 minute limit
+            // applied, and a hung page held up every check queued behind it.
+            // Cleared after the body, which can stall as well as the headers.
+            const t = setTimeout(() => ctrl.abort(), ep.timeout || 30000);
+            let res, body;
+            try {
+                res = await fetch(ep.url, { signal: ctrl.signal, redirect: "follow", headers: ep.headers });
+                body = await res.text();
+            }
+            finally {
                 clearTimeout(t);
-            const body = await res.text();
+            }
             const duration = Date.now() - start;
             const { ok, hasAllExpectedStrings, hasAnyUnexpectedStrings, missingExpected, matchedUnexpected } = evaluate(body, res.status, ep.expectedStrings || [], ep.unexpectedStrings || [], ep.expectedStatusCode);
             publicResult = {
@@ -226,11 +233,22 @@ export function createWebsitePlugin() {
             merged.set(key(e), e);
         return [...merged.values()];
     };
+    // One pass at a time. Overlapping passes report out of order, so a check
+    // that hung minutes ago lands after a newer success and re-raises the alert.
+    let running = false;
     const refreshFn = async (plugin) => {
-        const eps = await endpointsOf(plugin);
-        for (const ep of eps) {
-            if (ep?.url)
-                await check(plugin, ep);
+        if (running)
+            return;
+        running = true;
+        try {
+            const eps = await endpointsOf(plugin);
+            for (const ep of eps) {
+                if (ep?.url)
+                    await check(plugin, ep);
+            }
+        }
+        finally {
+            running = false;
         }
     };
     const monitorFn = async (plugin) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@daemonitor/plugins",
-  "version": "1.1.33",
+  "version": "1.1.35",
   "description": "daemonitor plugins",
   "types": "types/index.d.ts",
   "main": "dist/index.js",