@kaitranntt/ccs 8.2.0 → 8.3.0-dev.1

package/dist/web-server/routes/bar-routes.js

@@ -0,0 +1,415 @@
+"use strict";
+/**
+ * Bar Routes — /api/bar/summary aggregator
+ *
+ * One GET returns the full glance array for CCS Bar (macOS MenuBarExtra).
+ * Supports cached (instant) and ?refresh=true (live provider pull) modes.
+ *
+ * Design:
+ * - Calls data sources DIRECTLY (not via HTTP routes) so rate-limiters are irrelevant.
+ * - Force-fresh = invalidate quota-response-cache then call the fetcher server-side.
+ * - Debounce: if a fresh pull happened < 15s ago, serve cache even when refresh=true.
+ * - Per-account failure degrades THAT row (null fields + needsReauth/health:error);
+ *   other rows are unaffected — the payload always returns HTTP 200.
+ * - today_cost sourced from getTodayCostByAccount() (Phase 1A output).
+ * - health derived from runHealthChecks() summary (overall, not per-account for v1).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createBarRouter = exports.resetForceFreshDebounce = void 0;
+const express_1 = require("express");
+const bar_analytics_1 = require("../usage/bar-analytics");
+// ============================================================================
+// Timing budgets (module-level; the bar must NEVER block on a slow provider)
+// ============================================================================
+/** Debounce window: skip force-fresh if last fresh pull was < 15s ago */
+const FORCE_FRESH_DEBOUNCE_MS = 15000;
+/** Hard ceiling for the whole /summary response. Past this we paint from cache. */
+const REQUEST_DEADLINE_MS = 2500;
+/** Per-account synchronous wait before falling back to stale cache (bg fetch continues). */
+const PER_ACCOUNT_TIMEOUT_MS = 5000;
+/** Bound for the cost side-load so a slow snapshot read can't dominate the response. */
+const SIDELOAD_TIMEOUT_MS = 1500;
+/**
+ * Bound for the native-subscription side-load. A slow or failed native fetch
+ * resolves to [] so the response paints CLIProxy rows only — never errors, never
+ * blocks. Native rows have their own 10-min cache, so the common path is instant.
+ */
+const NATIVE_SIDELOAD_TIMEOUT_MS = 1500;
+/** Timestamp of the last successful force-fresh pull (epoch ms, 0 = never) */
+let lastForceFreshAt = 0;
+/** Reset module state — called in tests to prevent cross-test pollution */
+function resetForceFreshDebounce() {
+    lastForceFreshAt = 0;
+}
+exports.resetForceFreshDebounce = resetForceFreshDebounce;
+/**
+ * Resolve a promise to its value, or to null if it doesn't settle within `ms`.
+ * The underlying promise keeps running (used to let a slow fetch warm the cache
+ * for the next open while the current response degrades gracefully).
+ */
+function withTimeout(p, ms) {
+    return new Promise((resolve) => {
+        let settled = false;
+        const timer = setTimeout(() => {
+            if (!settled) {
+                settled = true;
+                resolve(null);
+            }
+        }, ms);
+        p.then((v) => {
+            if (!settled) {
+                settled = true;
+                clearTimeout(timer);
+                resolve(v);
+            }
+        }, () => {
+            if (!settled) {
+                settled = true;
+                clearTimeout(timer);
+                resolve(null);
+            }
+        });
+    });
+}
+/**
+ * Map a row to its wire shape. The native-only additions use snake_case parent
+ * keys ("quota_windows" / "stale_as_of") to match the existing payload's mixed
+ * casing; inner QuotaWindowDetail keys stay camelCase and pass through as-is.
+ * Rows without the native fields serialize byte-identically to before, so
+ * CLIProxy decode/encode tests are unaffected.
+ */
+function serializeBarRow(row) {
+    const { quotaWindows, staleAsOf, ...rest } = row;
+    const wire = { ...rest };
+    if (quotaWindows !== undefined)
+        wire.quota_windows = quotaWindows;
+    if (staleAsOf !== undefined && staleAsOf !== null)
+        wire.stale_as_of = staleAsOf;
+    return wire;
+}
+// ============================================================================
+// Per-account health derivation
+// ============================================================================
+/**
+ * Tri-state quota availability derived from the QuotaResult.
+ *
+ * We branch ONLY on the result's stable errorCode, never on a provider
+ * registry: ghcp is listed in MANAGED_QUOTA_PROVIDERS, yet fetchAccountQuota
+ * returns unsupported for every provider !== 'agy'. The result's
+ * 'quota_not_supported' code is the only honest signal that a provider has no
+ * quota API, so we use it here.
+ *
+ *   success                         → 'ok'
+ *   errorCode 'quota_not_supported' → 'unsupported' (no quota API; healthy)
+ *   anything else (null/timeout/reauth/other failure) → 'error'
+ */
+function deriveQuotaStatus(quota) {
+    if (quota?.success === true)
+        return 'ok';
+    if (quota && quota.errorCode === 'quota_not_supported')
+        return 'unsupported';
+    return 'error';
+}
+/**
+ * Health for a single account, derived from its own quota-fetch result.
+ *
+ * The menu bar is a per-account glance, so health is per-row — NOT the global
+ * system audit. (The system audit is also unsafe here: it shells out via a
+ * synchronous execSync that would block the event loop on the request path.)
+ *
+ * A provider with no quota API (quotaStatus 'unsupported', e.g. ghcp/kiro) is
+ * healthy — it must not show a permanent warning dot. 'warning' is reserved for
+ * genuine transient fetch failures, 'error' for accounts needing reauth.
+ *
+ *   needsReauth      → 'error'   (token expired; user action required)
+ *   quota unsupported → 'ok'     (no quota API is not a fault)
+ *   fetch failed      → 'warning' (transient/unknown; row degrades but isn't fatal)
+ *   success           → 'ok'
+ */
+function deriveHealth(quota, quotaStatus) {
+    if (quota?.needsReauth)
+        return 'error';
+    if (quotaStatus === 'unsupported')
+        return 'ok';
+    if (!quota || !quota.success)
+        return 'warning';
+    return 'ok';
+}
+// ============================================================================
+// Quota → bar row mapping
+// ============================================================================
+/**
+ * Extract the primary quota percentage from a QuotaResult.
+ * For Antigravity accounts: use the first model's percentage.
+ * Returns null on failure or missing data.
+ */
+function extractQuotaPercentage(quota) {
+    if (!quota.success || quota.models.length === 0)
+        return null;
+    // Use the first model (highest weight) as the representative percentage
+    return quota.models[0].percentage ?? null;
+}
+/**
+ * Extract the next reset timestamp from a QuotaResult.
+ * Returns null if not available.
+ */
+function extractNextReset(quota) {
+    if (!quota.success || quota.models.length === 0)
+        return null;
+    return quota.models[0].resetTime ?? null;
+}
+async function fetchAccountData(account, forceRefresh, deps) {
+    const provider = account.provider;
+    const accountId = account.id;
+    const now = new Date().toISOString();
+    // Read any prior cache up front so it survives as a stale fallback even when a
+    // refresh fetch is slow or fails (stale-while-revalidate).
+    const cached = deps.getCachedQuota(provider, accountId);
+    // Paused accounts: serve cache if present, otherwise degrade.
+    // Never trigger a live fetch for a user-paused account.
+    if (account.paused === true) {
+        return { quota: cached ?? null, cached: cached !== null, fetchedAt: now };
+    }
+    // Default mode serves a present cache instantly (no provider call).
+    if (!forceRefresh && cached) {
+        return { quota: cached, cached: true, fetchedAt: now };
+    }
+    // Force-fresh busts the route cache first (the stale value captured above
+    // still backs the fallback below).
+    if (forceRefresh) {
+        deps.invalidateQuotaCache(provider, accountId);
+    }
+    // Live fetch (force-refresh, or default-mode cache miss). It overwrites the
+    // cache on success and is bounded by PER_ACCOUNT_TIMEOUT_MS; if it overruns,
+    // the fetch keeps running (warming the cache for the next open) while this row
+    // degrades to the stale value so the payload never blocks.
+    const live = deps.fetchAccountQuota(provider, accountId).then((quota) => {
+        deps.setCachedQuota(provider, accountId, quota);
+        return quota;
+    });
+    const fresh = await withTimeout(live, PER_ACCOUNT_TIMEOUT_MS);
+    if (fresh)
+        return { quota: fresh, cached: false, fetchedAt: now };
+    return { quota: cached ?? null, cached: cached !== null, fetchedAt: now };
+}
+// ============================================================================
+// Row builder
+// ============================================================================
+/**
+ * Resolve the cost-lookup key for an account.
+ *
+ * The attribution pipeline (buildAuthIndexToAccountMap) stores email as the
+ * map value, so costByAccount keys are emails. For providers where
+ * account.id == email (agy, gemini, anthropic, etc.) this is a no-op.
+ * For duplicate-email providers like codex, account.id may be "email#variant",
+ * so we prefer account.email for the lookup to ensure the keys match.
+ * Falls back to account.id when email is absent (e.g. kiro/ghcp).
+ */
+function resolveCostKey(account) {
+    return account.email ?? account.id;
+}
+function buildRow(account, fetchResult, costByAccount, 
+/** Set of cost-keys that are shared by more than one account. Cost is unknowable for these. */
+sharedCostKeys) {
+    const { quota, cached, fetchedAt } = fetchResult;
+    const costKey = resolveCostKey(account);
+    const quotaStatus = deriveQuotaStatus(quota);
+    const health = deriveHealth(quota, quotaStatus);
+    const isDefault = account.isDefault ?? false;
+    const lastActivityAt = account.lastUsedAt ?? null;
+    // When multiple accounts share the same cost-key (e.g. two codex accounts with
+    // the same email), we cannot attribute the combined cost to either individual
+    // account, so it is null=unknowable. A missing key on a single-owner account is
+    // ALSO null=unknown (no usage record on a possibly-stale snapshot), distinct from
+    // a genuine 0 spend — the UI renders "no data" vs "$0.00" honestly.
+    const todayCost = sharedCostKeys.has(costKey) ? null : (costByAccount[costKey] ?? null);
+    if (!quota || !quota.success) {
+        // Degraded row: preserve identity fields, null out quota data
+        return {
+            account_id: account.id,
+            provider: account.provider,
+            displayName: account.nickname ?? account.id,
+            tier: account.tier ?? null,
+            paused: account.paused ?? false,
+            quota_percentage: null,
+            quotaStatus,
+            next_reset: null,
+            is_default: isDefault,
+            last_activity_at: lastActivityAt,
+            today_cost: todayCost,
+            health,
+            cached,
+            fetchedAt,
+            needsReauth: quota?.needsReauth ?? false,
+        };
+    }
+    return {
+        account_id: account.id,
+        provider: account.provider,
+        displayName: account.nickname ?? account.id,
+        tier: quota.tier ?? account.tier ?? null,
+        paused: account.paused ?? false,
+        quota_percentage: extractQuotaPercentage(quota),
+        quotaStatus,
+        next_reset: extractNextReset(quota),
+        is_default: isDefault,
+        last_activity_at: lastActivityAt,
+        today_cost: todayCost,
+        health,
+        cached,
+        fetchedAt,
+        needsReauth: quota.needsReauth ?? false,
+    };
+}
+// ============================================================================
+// Router factory
+// ============================================================================
+/**
+ * Create the bar router with injected dependencies.
+ *
+ * Production usage: call without arguments (defaults resolve from real modules).
+ * Test usage: pass mock implementations for each dep.
+ */
+function createBarRouter(deps) {
+    const router = (0, express_1.Router)();
+    /**
+     * GET /summary[?refresh=true]
+     *
+     * Returns the menu-bar glance array for all CLIProxy accounts.
+     *
+     * Query params:
+     *   refresh=true  — force-fresh from provider (debounced to once per 15s)
+     */
+    router.get('/summary', async (req, res) => {
+        try {
+            const wantsRefresh = req.query['refresh'] === 'true';
+            // Determine effective refresh mode after applying debounce.
+            // IMPORTANT: set lastForceFreshAt at decision time (before awaiting any
+            // fetches) to prevent a read-modify-write race where two concurrent
+            // refresh=true requests both pass the debounce check before either
+            // records the timestamp.
+            let doForceRefresh = false;
+            if (wantsRefresh) {
+                const sinceLastFresh = Date.now() - lastForceFreshAt;
+                if (sinceLastFresh >= FORCE_FRESH_DEBOUNCE_MS) {
+                    doForceRefresh = true;
+                    lastForceFreshAt = Date.now(); // claim the window before any async work
+                }
+                // else: debounce active — fall through to cache path
+            }
+            // Cost side-load is bounded so a slow usage-snapshot read can't stall the
+            // glance. (Health is per-account, derived from each quota result below —
+            // no blocking system audit on the request path.)
+            const details = await withTimeout(deps.loadCliproxyDetails(), SIDELOAD_TIMEOUT_MS);
+            const costByAccount = details
+                ? deps.getTodayCostByAccount(details)
+                : {};
+            // Flatten all accounts across providers
+            const summary = deps.getAllAccountsSummary();
+            const allAccounts = Object.values(summary).flat();
+            // Fix #11: compute which cost-keys are shared by >1 account so buildRow can
+            // report null (unknowable) rather than the combined total for those rows.
+            const costKeyCount = new Map();
+            for (const account of allAccounts) {
+                const key = resolveCostKey(account);
+                costKeyCount.set(key, (costKeyCount.get(key) ?? 0) + 1);
+            }
+            const sharedCostKeys = new Set(Array.from(costKeyCount.entries())
+                .filter(([, count]) => count > 1)
+                .map(([key]) => key));
+            // Build every row synchronously from whatever is in cache right now. This
+            // is the instant-paint fallback and the source of truth when the deadline
+            // fires before live fetches finish.
+            const cacheRows = () => {
+                const at = new Date().toISOString();
+                return allAccounts.map((account) => {
+                    const cached = deps.getCachedQuota(account.provider, account.id);
+                    return buildRow(account, { quota: cached ?? null, cached: cached !== null, fetchedAt: at }, costByAccount, sharedCostKeys);
+                });
+            };
+            // Fetch quota in parallel with per-account error isolation. Each row is
+            // bounded inside fetchAccountData; the whole gather is additionally raced
+            // against REQUEST_DEADLINE_MS so the response NEVER hangs on a slow
+            // provider — past the deadline we paint from cache and let background
+            // fetches warm the next open.
+            const CONCURRENCY_CAP = 5;
+            const gather = (async () => {
+                const rows = [];
+                for (let i = 0; i < allAccounts.length; i += CONCURRENCY_CAP) {
+                    const batch = allAccounts.slice(i, i + CONCURRENCY_CAP);
+                    const batchRows = await Promise.all(batch.map(async (account) => {
+                        const fetchResult = await fetchAccountData(account, doForceRefresh, deps);
+                        return buildRow(account, fetchResult, costByAccount, sharedCostKeys);
+                    }));
+                    rows.push(...batchRows);
+                }
+                return rows;
+            })();
+            const deadline = new Promise((resolve) => {
+                setTimeout(() => resolve(cacheRows()), REQUEST_DEADLINE_MS);
+            });
+            const rows = await Promise.race([gather, deadline]);
+            // Native subscription rows (Claude Code + Codex) are side-loaded AFTER the
+            // CLIProxy rows resolve, bounded so a slow/failed native fetch degrades to
+            // [] rather than blocking or erroring the response.
+            const getNative = deps.getNativeAccountRows ?? (async () => []);
+            const nativeRows = (await withTimeout(getNative(), NATIVE_SIDELOAD_TIMEOUT_MS)) ?? [];
+            res.json([...rows, ...nativeRows].map(serializeBarRow));
+        }
+        catch (err) {
+            console.error('[bar-routes] /summary error:', err.message);
+            res.status(500).json({ error: 'Internal server error' });
+        }
+    });
+    /**
+     * GET /analytics
+     *
+     * Rolls up the merged, multi-source usage (Claude Code, Codex, Droid, CLIProxy)
+     * into today / 7-day / 30-day spend, a 30-day sparkline, top models, and a
+     * per-surface breakdown. Reads the dashboard's stale-while-revalidate caches so
+     * recent activity shows even when the CLIProxy snapshot is frozen by a restart.
+     * Both loads are bounded so a slow read can't stall the menu; on miss the
+     * windows degrade to empty rather than failing the payload.
+     */
+    router.get('/analytics', async (_req, res) => {
+        try {
+            const [daily, hourly] = await Promise.all([
+                withTimeout(deps.loadDailyUsage(), SIDELOAD_TIMEOUT_MS).catch(() => []),
+                withTimeout(deps.loadHourlyUsage(), SIDELOAD_TIMEOUT_MS).catch(() => []),
+            ]);
+            const analytics = (0, bar_analytics_1.computeBarAnalyticsFromDaily)(daily ?? [], hourly ?? [], new Date());
+            res.json(analytics);
+        }
+        catch (err) {
+            console.error('[bar-routes] /analytics error:', err.message);
+            res.status(500).json({ error: 'Internal server error' });
+        }
+    });
+    return router;
+}
+exports.createBarRouter = createBarRouter;
+// ============================================================================
+// Default production router (sync imports — matches all other route modules)
+// ============================================================================
+const query_1 = require("../../cliproxy/accounts/query");
+const quota_response_cache_1 = require("../../cliproxy/quota/quota-response-cache");
+const quota_fetcher_1 = require("../../cliproxy/quota/quota-fetcher");
+const data_aggregator_1 = require("../usage/data-aggregator");
+const cliproxy_snapshot_reader_1 = require("../usage/cliproxy-snapshot-reader");
+const aggregator_1 = require("../usage/aggregator");
+const native_quota_collector_1 = require("../usage/native-quota-collector");
+/** Production bar router — wired to real dependencies */
+const barRouter = createBarRouter({
+    getAllAccountsSummary: query_1.getAllAccountsSummary,
+    getCachedQuota: quota_response_cache_1.getCachedQuota,
+    setCachedQuota: quota_response_cache_1.setCachedQuota,
+    invalidateQuotaCache: quota_response_cache_1.invalidateQuotaCache,
+    fetchAccountQuota: quota_fetcher_1.fetchAccountQuota,
+    getTodayCostByAccount: data_aggregator_1.getTodayCostByAccount,
+    loadCliproxyDetails: cliproxy_snapshot_reader_1.loadCliproxySnapshotDetails,
+    loadDailyUsage: () => (0, aggregator_1.getCachedDailyData)(),
+    loadHourlyUsage: () => (0, aggregator_1.getCachedHourlyData)(),
+    getNativeAccountRows: () => (0, native_quota_collector_1.getNativeAccountRows)(),
+});
+exports.default = barRouter;
+//# sourceMappingURL=bar-routes.js.map

package/dist/web-server/routes/bar-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bar-routes.js","sourceRoot":"","sources":["../../../src/web-server/routes/bar-routes.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;AAEH,qCAAiC;AAOjC,0DAAsE;AAkItE,+EAA+E;AAC/E,6EAA6E;AAC7E,+EAA+E;AAE/E,yEAAyE;AACzE,MAAM,uBAAuB,GAAG,KAAM,CAAC;AAEvC,mFAAmF;AACnF,MAAM,mBAAmB,GAAG,IAAK,CAAC;AAElC,4FAA4F;AAC5F,MAAM,sBAAsB,GAAG,IAAK,CAAC;AAErC,wFAAwF;AACxF,MAAM,mBAAmB,GAAG,IAAK,CAAC;AAElC;;;;GAIG;AACH,MAAM,0BAA0B,GAAG,IAAK,CAAC;AAEzC,8EAA8E;AAC9E,IAAI,gBAAgB,GAAG,CAAC,CAAC;AAEzB,2EAA2E;AAC3E,SAAgB,uBAAuB;IACrC,gBAAgB,GAAG,CAAC,CAAC;AACvB,CAAC;AAFD,0DAEC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAI,CAAa,EAAE,EAAU;IAC/C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC;QACH,CAAC,EAAE,EAAE,CAAC,CAAC;QACP,CAAC,CAAC,IAAI,CACJ,CAAC,CAAC,EAAE,EAAE;YACJ,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,CAAC,CAAC,CAAC,CAAC;YACb,CAAC;QACH,CAAC,EACD,GAAG,EAAE;YACH,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,GAAkB;IACzC,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC;IACjD,MAAM,IAAI,GAA4B,EAAE,GAAG,IAAI,EAAE,CAAC;IAClD,IAAI,YAAY,KAAK,SAAS;QAAE,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC;IAClE,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,IAAI;QAAE,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;IAChF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,gCAAgC;AAChC,+EAA+E;AAE/E;;;;;;;;;;;;GAYG;AACH,SAAS,iBAAiB,CAAC,KAAyB;IAClD,IAAI,KAAK,EAAE,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,qBAAqB;QAAE,OAAO,aAAa,CAAC;IAC7E,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,YAAY,CACnB,KAAyB,EACzB,WAA2C;IAE3C,IAAI,KAAK,EAAE,WAAW;QAAE,OAAO,OAAO,CAAC;IACvC,IAAI,WAAW,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,0BAA0B;AAC1B,+EAA+E;AAE/E;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,KAAkB;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,wEAAwE;IACxE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,KAAkB;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC;AAC3C,CAAC;AAYD,KAAK,UAAU,gBAAgB,CAC7B,OAAoB,EACpB,YAAqB,EACrB,IAAmB;IAEnB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,MAAM,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAErC,+EAA+E;IAC/E,2DAA2D;IAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAc,QAAQ,EAAE,SAAS,CAAC,CAAC;IAErE,8DAA8D;IAC9D,wDAAwD;IACxD,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC5B,OAAO,EAAE,KAAK,EAAE,MAAM,IAAI,IAAI,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IAC5E,CAAC;IAED,oEAAoE;IACpE,IAAI,CAAC,YAAY,IAAI,MAAM,EAAE,CAAC;QAC5B,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IACzD,CAAC;IAED,0EAA0E;IAC1E,mCAAmC;IACnC,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACjD,CAAC;IAED,4EAA4E;IAC5E,6EAA6E;IAC7E,+EAA+E;IAC/E,2DAA2D;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAA4B,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QAC1F,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;IAC9D,IAAI,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IAClE,OAAO,EAAE,KAAK,EAAE,MAAM,IAAI,IAAI,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;AAC5E,CAAC;AAED,+EAA+E;AAC/E,cAAc;AACd,+EAA+E;AAE/E;;;;;;;;;GASG;AACH,SAAS,cAAc,CAAC,OAAoB;IAC1C,OAAO,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,QAAQ,CACf,OAAoB,EACpB,WAA+B,EAC/B,aAAqC;AACrC,+FAA+F;AAC/F,cAAmC;IAEnC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,WAAW,CAAC;IACjD,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,MAAM,cAAc,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC;IAElD,+EAA+E;IAC/E,8EAA8E;IAC9E,gFAAgF;IAChF,kFAAkF;IAClF,oEAAoE;IACpE,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;IAExF,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAC7B,8DAA8D;QAC9D,OAAO;YACL,UAAU,EAAE,OAAO,CAAC,EAAE;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,WAAW,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,EAAE;YAC3C,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,IAAI;YAC1B,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,KAAK;YAC/B,gBAAgB,EAAE,IAAI;YACtB,WAAW;YACX,UAAU,EAAE,IAAI;YAChB,UAAU,EAAE,SAAS;YACrB,gBAAgB,EAAE,cAAc;YAChC,UAAU,EAAE,SAAS;YACrB,MAAM;YACN,MAAM;YACN,SAAS;YACT,WAAW,EAAE,KAAK,EAAE,WAAW,IAAI,KAAK;SACzC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,EAAE;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,WAAW,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,EAAE;QAC3C,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI;QACxC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,KAAK;QAC/B,gBAAgB,EAAE,sBAAsB,CAAC,KAAK,CAAC;QAC/C,WAAW;QACX,UAAU,EAAE,gBAAgB,CAAC,KAAK,CAAC;QACnC,UAAU,EAAE,SAAS;QACrB,gBAAgB,EAAE,cAAc;QAChC,UAAU,EAAE,SAAS;QACrB,MAAM;QACN,MAAM;QACN,SAAS;QACT,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,KAAK;KACxC,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,iBAAiB;AACjB,+EAA+E;AAE/E;;;;;GAKG;AACH,SAAgB,eAAe,CAAC,IAAmB;IACjD,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAC;IAExB;;;;;;;OAOG;IACH,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAiB,EAAE;QAC1E,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC;YAErD,4DAA4D;YAC5D,wEAAwE;YACxE,oEAAoE;YACpE,mEAAmE;YACnE,yBAAyB;YACzB,IAAI,cAAc,GAAG,KAAK,CAAC;YAC3B,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,CAAC;gBACrD,IAAI,cAAc,IAAI,uBAAuB,EAAE,CAAC;oBAC9C,cAAc,GAAG,IAAI,CAAC;oBACtB,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,yCAAyC;gBAC1E,CAAC;gBACD,qDAAqD;YACvD,CAAC;YAED,0EAA0E;YAC1E,yEAAyE;YACzE,iDAAiD;YACjD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,mBAAmB,CAAC,CAAC;YACnF,MAAM,aAAa,GAA2B,OAAO;gBACnD,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC;gBACrC,CAAC,CAAC,EAAE,CAAC;YAEP,wCAAwC;YACxC,MAAM,OAAO,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC7C,MAAM,WAAW,GAAkB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YAEjE,4EAA4E;YAC5E,0EAA0E;YAC1E,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;YAC/C,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE,CAAC;gBAClC,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;gBACpC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1D,CAAC;YACD,MAAM,cAAc,GAAG,IAAI,GAAG,CAC5B,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;iBAC/B,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC;iBAChC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CACvB,CAAC;YAEF,0EAA0E;YAC1E,0EAA0E;YAC1E,oCAAoC;YACpC,MAAM,SAAS,GAAG,GAAoB,EAAE;gBACtC,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBACpC,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;oBACjC,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAc,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;oBAC9E,OAAO,QAAQ,CACb,OAAO,EACP,EAAE,KAAK,EAAE,MAAM,IAAI,IAAI,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EACjE,aAAa,EACb,cAAc,CACf,CAAC;gBACJ,CAAC,CAAC,CAAC;YACL,CAAC,CAAC;YAEF,wEAAwE;YACxE,0EAA0E;YAC1E,oEAAoE;YACpE,sEAAsE;YACtE,8BAA8B;YAC9B,MAAM,eAAe,GAAG,CAAC,CAAC;YAC1B,MAAM,MAAM,GAAG,CAAC,KAAK,IAA8B,EAAE;gBACnD,MAAM,IAAI,GAAoB,EAAE,CAAC;gBACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,IAAI,eAAe,EAAE,CAAC;oBAC7D,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC;oBACxD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CACjC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAA0B,EAAE;wBAClD,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;wBAC1E,OAAO,QAAQ,CAAC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC;oBACvE,CAAC,CAAC,CACH,CAAC;oBACF,IAAI,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC;gBAC1B,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,EAAE,CAAC;YAEL,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAkB,CAAC,OAAO,EAAE,EAAE;gBACxD,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC;YAC9D,CAAC,CAAC,CAAC;YAEH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;YAEpD,2EAA2E;YAC3E,2EAA2E;YAC3E,oDAAoD;YACpD,MAAM,SAAS,GAAG,IAAI,CAAC,oBAAoB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,EAAqB,CAAC,CAAC;YACnF,MAAM,UAAU,GAAG,CAAC,MAAM,WAAW,CAAC,SAAS,EAAE,EAAE,0BAA0B,CAAC,CAAC,IAAI,EAAE,CAAC;YAEtF,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,UAAU,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;YACtE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;;;;;;;;OASG;IACH,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,IAAa,EAAE,GAAa,EAAiB,EAAE;QAC7E,IAAI,CAAC;YACH,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACxC,WAAW,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,mBAAmB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAkB,CAAC;gBACvF,WAAW,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,mBAAmB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAmB,CAAC;aAC1F,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,IAAA,4CAA4B,EAAC,KAAK,IAAI,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;YACtF,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;YACxE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAxID,0CAwIC;AAED,+EAA+E;AAC/E,6EAA6E;AAC7E,+EAA+E;AAE/E,yDAAsE;AACtE,oFAImD;AACnD,sEAAuE;AACvE,8DAAiE;AACjE,gFAAgF;AAChF,oDAA8E;AAC9E,4EAAuE;AAEvE,yDAAyD;AACzD,MAAM,SAAS,GAAW,eAAe,CAAC;IACxC,qBAAqB,EAArB,6BAAqB;IACrB,cAAc,EAAd,qCAAc;IACd,cAAc,EAAd,qCAAc;IACd,oBAAoB,EAApB,2CAAoB;IACpB,iBAAiB,EAAjB,iCAAiB;IACjB,qBAAqB,EAArB,uCAAqB;IACrB,mBAAmB,EAAE,sDAA2B;IAChD,cAAc,EAAE,GAAG,EAAE,CAAC,IAAA,+BAAkB,GAAE;IAC1C,eAAe,EAAE,GAAG,EAAE,CAAC,IAAA,gCAAmB,GAAE;IAC5C,oBAAoB,EAAE,GAAG,EAAE,CAAC,IAAA,6CAAoB,GAAE;CACnD,CAAC,CAAC;AAEH,kBAAe,SAAS,CAAC"}

package/dist/web-server/routes/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/web-server/routes/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAmCH,eAAO,MAAM,SAAS,4CAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/web-server/routes/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAoCH,eAAO,MAAM,SAAS,4CAAW,CAAC"}

package/dist/web-server/routes/index.js

@@ -40,9 +40,15 @@ const persist_routes_1 = __importDefault(require("./persist-routes"));
 const catalog_routes_1 = __importDefault(require("./catalog-routes"));
 const claude_extension_routes_1 = __importDefault(require("./claude-extension-routes"));
 const logs_routes_1 = __importDefault(require("./logs-routes"));
+const bar_routes_1 = __importDefault(require("./bar-routes"));
 // Create the main API router
 exports.apiRoutes = (0, express_1.Router)();
 const REMOTE_WRITE_ACCESS_ERROR = 'Remote dashboard writes require localhost access when dashboard auth is disabled.';
+// CCS Bar endpoints (/api/bar/*) expose the user's native quota, tier, and cost
+// snapshot. Unlike the rest of the read API these are sensitive even on GET, so
+// they are gated for ALL methods (not just mutations) by the same
+// localhost-when-auth-disabled choke point.
+const BAR_LOCAL_ACCESS_ERROR = 'CCS Bar endpoints require localhost access when dashboard auth is disabled.';
 function isMutationMethod(method) {
     const normalized = method.toUpperCase();
     return (normalized === 'POST' ||
@@ -51,6 +57,16 @@ function isMutationMethod(method) {
         normalized === 'DELETE');
 }
 exports.apiRoutes.use((req, res, next) => {
+    // /api/bar/* leaks native quota/tier/cost data; gate it for every method.
+    // This middleware runs before the '/bar' mount below, so req.path still
+    // carries the '/bar' prefix here.
+    // Exact segment match so a future sibling like '/barbaz' isn't accidentally gated.
+    if (req.path === '/bar' || req.path.startsWith('/bar/')) {
+        if ((0, auth_middleware_1.requireLocalAccessWhenAuthDisabled)(req, res, BAR_LOCAL_ACCESS_ERROR)) {
+            next();
+        }
+        return;
+    }
     if (!isMutationMethod(req.method)) {
         next();
         return;
@@ -100,6 +116,8 @@ exports.apiRoutes.use('/droid', droid_routes_1.default);
 exports.apiRoutes.use('/codex', codex_routes_1.default);
 // ==================== CLIProxy Server Settings ====================
 exports.apiRoutes.use('/cliproxy-server', proxy_routes_1.default);
+// ==================== Bar (Menu Bar Glance) ====================
+exports.apiRoutes.use('/bar', bar_routes_1.default);
 // ==================== Misc (File API, Global Env) ====================
 exports.apiRoutes.use('/', misc_routes_1.default);
 exports.apiRoutes.use('/logs', logs_routes_1.default);

package/dist/web-server/routes/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/web-server/routes/index.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;AAEH,qCAAiC;AACjC,mEAAmF;AAEnF,wBAAwB;AACxB,sEAA6C;AAC7C,sEAA6C;AAC7C,oEAA2C;AAC3C,oEAA2C;AAC3C,wEAA+C;AAC/C,sEAA6C;AAC7C,wEAA+C;AAC/C,wEAA+C;AAC/C,0EAAiD;AACjD,oFAA0D;AAC1D,sEAA6C;AAC7C,kFAAwD;AACxD,oFAA0D;AAC1D,wFAA8D;AAC9D,kFAAwD;AACxD,8EAAoD;AACpD,sEAA6C;AAC7C,oEAA2C;AAC3C,kEAAyC;AACzC,kEAAyC;AACzC,gEAAuC;AACvC,kEAAkD;AAClD,gEAAuC;AACvC,sEAA6C;AAC7C,sEAA6C;AAC7C,wFAA8D;AAC9D,gEAAuC;AAEvC,6BAA6B;AAChB,QAAA,SAAS,GAAG,IAAA,gBAAM,GAAE,CAAC;AAElC,MAAM,yBAAyB,GAC7B,mFAAmF,CAAC;AAEtF,SAAS,gBAAgB,CAAC,MAAc;IACtC,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACxC,OAAO,CACL,UAAU,KAAK,MAAM;QACrB,UAAU,KAAK,KAAK;QACpB,UAAU,KAAK,OAAO;QACtB,UAAU,KAAK,QAAQ,CACxB,CAAC;AACJ,CAAC;AAED,iBAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IAC/B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,IAAI,IAAA,oDAAkC,EAAC,GAAG,EAAE,GAAG,EAAE,yBAAyB,CAAC,EAAE,CAAC;QAC5E,IAAI,EAAE,CAAC;IACT,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,+DAA+D;AAC/D,uDAAuD;AACvD,iBAAS,CAAC,GAAG,CAAC,WAAW,EAAE,wBAAa,CAAC,CAAC;AAC1C,iBAAS,CAAC,GAAG,CAAC,WAAW,EAAE,yBAAc,CAAC,CAAC;AAC3C,iBAAS,CAAC,GAAG,CAAC,WAAW,EAAE,yBAAc,CAAC,CAAC;AAC3C,iBAAS,CAAC,GAAG,CAAC,WAAW,EAAE,wBAAa,CAAC,CAAC;AAE1C,2DAA2D;AAC3D,2BAA2B;AAC3B,iBAAS,CAAC,GAAG,CAAC,SAAS,EAAE,uBAAY,CAAC,CAAC;AAEvC,0DAA0D;AAC1D,iBAAS,CAAC,GAAG,CAAC,SAAS,EAAE,uBAAY,CAAC,CAAC;AAEvC,2DAA2D;AAC3D,iBAAS,CAAC,GAAG,CAAC,OAAO,EAAE,qBAAU,CAAC,CAAC;AAEnC,wEAAwE;AACxE,iBAAS,CAAC,GAAG,CAAC,UAAU,EAAE,wBAAa,CAAC,CAAC;AACzC,iBAAS,CAAC,GAAG,CAAC,mBAAmB,EAAE,iCAAqB,CAAC,CAAC;AAE1D,qDAAqD;AACrD,8DAA8D;AAC9D,iBAAS,CAAC,GAAG,CAAC,WAAW,EAAE,iCAAqB,CAAC,CAAC;AAClD,iBAAS,CAAC,GAAG,CAAC,WAAW,EAAE,wBAAa,CAAC,CAAC;AAC1C,iBAAS,CAAC,GAAG,CAAC,gBAAgB,EAAE,8BAAkB,CAAC,CAAC;AACpD,iBAAS,CAAC,GAAG,CAAC,WAAW,EAAE,+BAAmB,CAAC,CAAC;AAChD,iBAAS,CAAC,GAAG,CAAC,gBAAgB,EAAE,8BAAkB,CAAC,CAAC;AACpD,iBAAS,CAAC,GAAG,CAAC,mBAAmB,EAAE,wBAAa,CAAC,CAAC;AAClD,iBAAS,CAAC,GAAG,CAAC,wBAAwB,EAAE,4BAAgB,CAAC,CAAC;AAC1D,iBAAS,CAAC,GAAG,CAAC,yBAAyB,EAAE,yBAAc,CAAC,CAAC;AAEzD,sDAAsD;AACtD,iBAAS,CAAC,GAAG,CAAC,YAAY,EAAE,0BAAe,CAAC,CAAC;AAC7C,iBAAS,CAAC,GAAG,CAAC,UAAU,EAAE,wBAAa,CAAC,CAAC;AACzC,iBAAS,CAAC,GAAG,CAAC,iBAAiB,EAAE,+BAAmB,CAAC,CAAC;AAEtD,oDAAoD;AACpD,iBAAS,CAAC,GAAG,CAAC,UAAU,EAAE,wBAAa,CAAC,CAAC;AAEzC,mDAAmD;AACnD,iBAAS,CAAC,GAAG,CAAC,SAAS,EAAE,uBAAY,CAAC,CAAC;AACvC,iBAAS,CAAC,GAAG,CAAC,gBAAgB,EAAE,uBAAY,CAAC,CAAC;AAE9C,kDAAkD;AAClD,iBAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,sBAAW,CAAC,CAAC;AAErC,kDAAkD;AAClD,iBAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,sBAAW,CAAC,CAAC;AAErC,qEAAqE;AACrE,iBAAS,CAAC,GAAG,CAAC,kBAAkB,EAAE,sBAAoB,CAAC,CAAC;AAExD,wEAAwE;AACxE,iBAAS,CAAC,GAAG,CAAC,GAAG,EAAE,qBAAU,CAAC,CAAC;AAC/B,iBAAS,CAAC,GAAG,CAAC,OAAO,EAAE,qBAAU,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/web-server/routes/index.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;AAEH,qCAAiC;AACjC,mEAAmF;AAEnF,wBAAwB;AACxB,sEAA6C;AAC7C,sEAA6C;AAC7C,oEAA2C;AAC3C,oEAA2C;AAC3C,wEAA+C;AAC/C,sEAA6C;AAC7C,wEAA+C;AAC/C,wEAA+C;AAC/C,0EAAiD;AACjD,oFAA0D;AAC1D,sEAA6C;AAC7C,kFAAwD;AACxD,oFAA0D;AAC1D,wFAA8D;AAC9D,kFAAwD;AACxD,8EAAoD;AACpD,sEAA6C;AAC7C,oEAA2C;AAC3C,kEAAyC;AACzC,kEAAyC;AACzC,gEAAuC;AACvC,kEAAkD;AAClD,gEAAuC;AACvC,sEAA6C;AAC7C,sEAA6C;AAC7C,wFAA8D;AAC9D,gEAAuC;AACvC,8DAAqC;AAErC,6BAA6B;AAChB,QAAA,SAAS,GAAG,IAAA,gBAAM,GAAE,CAAC;AAElC,MAAM,yBAAyB,GAC7B,mFAAmF,CAAC;AAEtF,gFAAgF;AAChF,gFAAgF;AAChF,kEAAkE;AAClE,4CAA4C;AAC5C,MAAM,sBAAsB,GAC1B,6EAA6E,CAAC;AAEhF,SAAS,gBAAgB,CAAC,MAAc;IACtC,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACxC,OAAO,CACL,UAAU,KAAK,MAAM;QACrB,UAAU,KAAK,KAAK;QACpB,UAAU,KAAK,OAAO;QACtB,UAAU,KAAK,QAAQ,CACxB,CAAC;AACJ,CAAC;AAED,iBAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IAC/B,0EAA0E;IAC1E,wEAAwE;IACxE,kCAAkC;IAClC,mFAAmF;IACnF,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,IAAI,IAAA,oDAAkC,EAAC,GAAG,EAAE,GAAG,EAAE,sBAAsB,CAAC,EAAE,CAAC;YACzE,IAAI,EAAE,CAAC;QACT,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,IAAI,IAAA,oDAAkC,EAAC,GAAG,EAAE,GAAG,EAAE,yBAAyB,CAAC,EAAE,CAAC;QAC5E,IAAI,EAAE,CAAC;IACT,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,+DAA+D;AAC/D,uDAAuD;AACvD,iBAAS,CAAC,GAAG,CAAC,WAAW,EAAE,wBAAa,CAAC,CAAC;AAC1C,iBAAS,CAAC,GAAG,CAAC,WAAW,EAAE,yBAAc,CAAC,CAAC;AAC3C,iBAAS,CAAC,GAAG,CAAC,WAAW,EAAE,yBAAc,CAAC,CAAC;AAC3C,iBAAS,CAAC,GAAG,CAAC,WAAW,EAAE,wBAAa,CAAC,CAAC;AAE1C,2DAA2D;AAC3D,2BAA2B;AAC3B,iBAAS,CAAC,GAAG,CAAC,SAAS,EAAE,uBAAY,CAAC,CAAC;AAEvC,0DAA0D;AAC1D,iBAAS,CAAC,GAAG,CAAC,SAAS,EAAE,uBAAY,CAAC,CAAC;AAEvC,2DAA2D;AAC3D,iBAAS,CAAC,GAAG,CAAC,OAAO,EAAE,qBAAU,CAAC,CAAC;AAEnC,wEAAwE;AACxE,iBAAS,CAAC,GAAG,CAAC,UAAU,EAAE,wBAAa,CAAC,CAAC;AACzC,iBAAS,CAAC,GAAG,CAAC,mBAAmB,EAAE,iCAAqB,CAAC,CAAC;AAE1D,qDAAqD;AACrD,8DAA8D;AAC9D,iBAAS,CAAC,GAAG,CAAC,WAAW,EAAE,iCAAqB,CAAC,CAAC;AAClD,iBAAS,CAAC,GAAG,CAAC,WAAW,EAAE,wBAAa,CAAC,CAAC;AAC1C,iBAAS,CAAC,GAAG,CAAC,gBAAgB,EAAE,8BAAkB,CAAC,CAAC;AACpD,iBAAS,CAAC,GAAG,CAAC,WAAW,EAAE,+BAAmB,CAAC,CAAC;AAChD,iBAAS,CAAC,GAAG,CAAC,gBAAgB,EAAE,8BAAkB,CAAC,CAAC;AACpD,iBAAS,CAAC,GAAG,CAAC,mBAAmB,EAAE,wBAAa,CAAC,CAAC;AAClD,iBAAS,CAAC,GAAG,CAAC,wBAAwB,EAAE,4BAAgB,CAAC,CAAC;AAC1D,iBAAS,CAAC,GAAG,CAAC,yBAAyB,EAAE,yBAAc,CAAC,CAAC;AAEzD,sDAAsD;AACtD,iBAAS,CAAC,GAAG,CAAC,YAAY,EAAE,0BAAe,CAAC,CAAC;AAC7C,iBAAS,CAAC,GAAG,CAAC,UAAU,EAAE,wBAAa,CAAC,CAAC;AACzC,iBAAS,CAAC,GAAG,CAAC,iBAAiB,EAAE,+BAAmB,CAAC,CAAC;AAEtD,oDAAoD;AACpD,iBAAS,CAAC,GAAG,CAAC,UAAU,EAAE,wBAAa,CAAC,CAAC;AAEzC,mDAAmD;AACnD,iBAAS,CAAC,GAAG,CAAC,SAAS,EAAE,uBAAY,CAAC,CAAC;AACvC,iBAAS,CAAC,GAAG,CAAC,gBAAgB,EAAE,uBAAY,CAAC,CAAC;AAE9C,kDAAkD;AAClD,iBAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,sBAAW,CAAC,CAAC;AAErC,kDAAkD;AAClD,iBAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,sBAAW,CAAC,CAAC;AAErC,qEAAqE;AACrE,iBAAS,CAAC,GAAG,CAAC,kBAAkB,EAAE,sBAAoB,CAAC,CAAC;AAExD,kEAAkE;AAClE,iBAAS,CAAC,GAAG,CAAC,MAAM,EAAE,oBAAS,CAAC,CAAC;AAEjC,wEAAwE;AACxE,iBAAS,CAAC,GAAG,CAAC,GAAG,EAAE,qBAAU,CAAC,CAAC;AAC/B,iBAAS,CAAC,GAAG,CAAC,OAAO,EAAE,qBAAU,CAAC,CAAC"}

package/dist/web-server/usage/bar-analytics.d.ts

@@ -0,0 +1,101 @@
+/**
+ * Bar Analytics Aggregator
+ *
+ * Pure functions that roll up the flat CliproxyUsageHistoryDetail array (the
+ * same snapshot the bar already loads for per-account cost) into the small,
+ * glanceable analytics the menu bar surfaces: today / 7-day / 30-day spend,
+ * a 7-day cost sparkline, and the top models by spend.
+ *
+ * Kept dependency-free and deterministic (the reference "now" is injected) so
+ * it is trivially unit-testable and cheap enough to run on every bar open.
+ */
+import type { CliproxyUsageHistoryDetail } from './cliproxy-usage-transformer';
+import type { DailyUsage, HourlyUsage } from './types';
+/** A single day's roll-up (local-day granularity). */
+export interface BarAnalyticsDay {
+    /** Local calendar day, YYYY-MM-DD. */
+    date: string;
+    cost: number;
+    requests: number;
+}
+/**
+ * One usage surface's contribution to spend over the active window.
+ * A "surface" is the tool/origin a request came from (Claude Code, Codex, the
+ * CLIProxy router, Droid, …) — the dimension the menu bar uses to answer
+ * "where is my usage actually going".
+ */
+export interface BarAnalyticsSurface {
+    /** Raw pipeline source key (custom-parser | codex-native | cliproxy | droid-native | …). */
+    source: string;
+    /** Human label shown in the bar (Claude Code, Codex, CLIProxy, Droid, …). */
+    surface: string;
+    cost: number;
+    requests: number;
+}
+/** Aggregate spend over a rolling window. */
+export interface BarAnalyticsWindow {
+    cost: number;
+    requests: number;
+}
+/** One model's contribution to spend over the trailing 7 days. */
+export interface BarAnalyticsModel {
+    model: string;
+    cost: number;
+    requests: number;
+}
+/** The full analytics payload returned by GET /api/bar/analytics. */
+export interface BarAnalytics {
+    today: BarAnalyticsWindow;
+    last7d: BarAnalyticsWindow;
+    last30d: BarAnalyticsWindow;
+    /**
+     * Honest calendar month-to-date (1st of the current local month → now), NOT a
+     * rolling 30 days. A fresh month resets this toward ~0 even when `last30d`
+     * stays populated, so a monthly-cap alert measures the real billing month.
+     */
+    monthToDate: BarAnalyticsWindow;
+    /** Lifetime totals across every record in the snapshot. */
+    allTime: BarAnalyticsWindow;
+    /** Oldest → newest, exactly 30 entries (zero-filled), for the sparkline. */
+    byDay: BarAnalyticsDay[];
+    /** Highest-spend models (descending, capped) for the window in `topModelsWindow`. */
+    topModels: BarAnalyticsModel[];
+    /** Which window `topModels` covers — the most recent one that has data. */
+    topModelsWindow: '30d' | 'all';
+    /**
+     * Spend/requests broken down by usage surface (tool/origin), for the same
+     * window as `topModels`. Descending by cost. Empty when no source is known
+     * (e.g. the legacy snapshot-only path that carries no surface dimension).
+     */
+    bySurface: BarAnalyticsSurface[];
+    /** ISO timestamp of the most recent non-failed usage record, null if none. */
+    lastActivityAt: string | null;
+    /** Whole local-days since `lastActivityAt`, null if no usable records. */
+    daysSinceLastActivity: number | null;
+    /**
+     * True when the trailing 30 days carry any spend or requests. The UI pivots
+     * its empty/stale presentation on this without re-deriving it.
+     */
+    hasRecentData: boolean;
+    /** ISO timestamp the payload was generated. */
+    generatedAt: string;
+}
+/** Local-time YYYY-MM-DD key for a Date (matches the user's calendar day). */
+export declare function localDayKey(d: Date): string;
+/**
+ * Roll the raw details into the bar analytics payload, relative to `now`.
+ * Failed requests are excluded from spend (they carry no real cost).
+ */
+export declare function computeBarAnalytics(details: CliproxyUsageHistoryDetail[], now: Date): BarAnalytics;
+/**
+ * Roll the merged, multi-source usage aggregates into the bar analytics payload.
+ *
+ * Unlike `computeBarAnalytics` (which reads only the CLIProxy snapshot — frozen
+ * whenever the proxy restarts), this consumes the same merged daily/hourly data
+ * the dashboard uses, so recent activity from Claude Code, Codex, Droid, and the
+ * CLIProxy router all show up. `daily` carries cost+models+source; `hourly`
+ * carries the request counts (daily aggregates don't), so the two are combined:
+ * cost/models/surface-cost from daily, request counts from hourly.
+ */
+export declare function computeBarAnalyticsFromDaily(daily: DailyUsage[], hourly: HourlyUsage[], now: Date): BarAnalytics;
+//# sourceMappingURL=bar-analytics.d.ts.map

package/dist/web-server/usage/bar-analytics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bar-analytics.d.ts","sourceRoot":"","sources":["../../../src/web-server/usage/bar-analytics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC/E,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAEvD,sDAAsD;AACtD,MAAM,WAAW,eAAe;IAC9B,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,4FAA4F;IAC5F,MAAM,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,6CAA6C;AAC7C,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,kEAAkE;AAClE,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,qEAAqE;AACrE,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,kBAAkB,CAAC;IAC1B,MAAM,EAAE,kBAAkB,CAAC;IAC3B,OAAO,EAAE,kBAAkB,CAAC;IAC5B;;;;OAIG;IACH,WAAW,EAAE,kBAAkB,CAAC;IAChC,2DAA2D;IAC3D,OAAO,EAAE,kBAAkB,CAAC;IAC5B,4EAA4E;IAC5E,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,qFAAqF;IACrF,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B,2EAA2E;IAC3E,eAAe,EAAE,KAAK,GAAG,KAAK,CAAC;IAC/B;;;;OAIG;IACH,SAAS,EAAE,mBAAmB,EAAE,CAAC;IACjC,8EAA8E;IAC9E,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,0EAA0E;IAC1E,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC;;;OAGG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB,+CAA+C;IAC/C,WAAW,EAAE,MAAM,CAAC;CACrB;AAOD,8EAA8E;AAC9E,wBAAgB,WAAW,CAAC,CAAC,EAAE,IAAI,GAAG,MAAM,CAK3C;AAoBD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,0BAA0B,EAAE,EACrC,GAAG,EAAE,IAAI,GACR,YAAY,CAmHd;AAwBD;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,UAAU,EAAE,EACnB,MAAM,EAAE,WAAW,EAAE,EACrB,GAAG,EAAE,IAAI,GACR,YAAY,CA0Id"}