@outray/runtime-shared 0.0.0-stage → 0.1.1

package/dist/tinybird-records.cjs

@@ -0,0 +1,160 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/tinybird-records.ts
+var tinybird_records_exports = {};
+__export(tinybird_records_exports, {
+  TunnelTinybirdClient: () => TunnelTinybirdClient,
+  captureRecordIsCurrent: () => captureRecordIsCurrent,
+  normalizeRetentionDays: () => normalizeRetentionDays,
+  protocolEventRecord: () => protocolEventRecord,
+  requestCaptureRecord: () => requestCaptureRecord,
+  tinybirdTimestamp: () => tinybirdTimestamp,
+  tunnelEventRecord: () => tunnelEventRecord
+});
+module.exports = __toCommonJS(tinybird_records_exports);
+var import_node_crypto = require("crypto");
+function normalizeRetentionDays(retentionDays) {
+  if (!Number.isFinite(retentionDays)) return 3;
+  return Math.min(90, Math.max(1, Math.trunc(retentionDays)));
+}
+function tinybirdTimestamp(timestamp) {
+  return new Date(timestamp).toISOString().replace("T", " ").replace("Z", "");
+}
+function tunnelEventRecord(event) {
+  return {
+    ...event,
+    request_id: event.request_id || "",
+    event_id: event.request_id || (0, import_node_crypto.randomUUID)(),
+    timestamp: tinybirdTimestamp(event.timestamp),
+    ingested_at: tinybirdTimestamp(Date.now()),
+    retention_days: normalizeRetentionDays(event.retention_days)
+  };
+}
+function requestCaptureRecord(capture) {
+  return {
+    ...capture,
+    timestamp: tinybirdTimestamp(capture.timestamp),
+    ingested_at: tinybirdTimestamp(Date.now()),
+    retention_days: normalizeRetentionDays(capture.retention_days),
+    request_headers: JSON.stringify(capture.request_headers),
+    response_headers: JSON.stringify(capture.response_headers)
+  };
+}
+function protocolEventRecord(event) {
+  return {
+    ...event,
+    event_id: (0, import_node_crypto.randomUUID)(),
+    timestamp: tinybirdTimestamp(event.timestamp),
+    ingested_at: tinybirdTimestamp(Date.now()),
+    retention_days: normalizeRetentionDays(event.retention_days)
+  };
+}
+var TunnelTinybirdClient = class {
+  constructor(host, token) {
+    this.host = host;
+    this.token = token;
+  }
+  host;
+  token;
+  get configured() {
+    if (!this.host || !this.token) return false;
+    try {
+      const url = new URL(this.host);
+      return (url.protocol === "https:" || url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)) && !url.username && !url.password && !url.search && !url.hash && url.pathname === "/";
+    } catch {
+      return false;
+    }
+  }
+  async append(datasource, records) {
+    if (datasource === "tunnel_request_captures") {
+      const oversized = records.filter((record) => Buffer.byteLength(JSON.stringify(record)) > 3 * 1024 * 1024).length;
+      if (oversized) console.error(`Tinybird capture delivery rejected ${oversized} oversized records; other captures will continue`);
+      records = records.filter((record) => captureRecordIsCurrent(record) && Buffer.byteLength(JSON.stringify(record)) <= 3 * 1024 * 1024);
+    }
+    if (!records.length) return;
+    if (!this.configured) throw new Error("Tinybird tunnel ingestion is not configured");
+    const maxBytes = 4 * 1024 * 1024;
+    let lines = [];
+    let bytes = 0;
+    for (const record of records) {
+      const line = JSON.stringify(record);
+      const lineBytes = Buffer.byteLength(line) + 1;
+      if (lineBytes > maxBytes) {
+        throw new Error(`Tinybird ${datasource} record exceeds the ingestion size limit`);
+      }
+      if (bytes + lineBytes > maxBytes && lines.length) {
+        await this.appendBatch(datasource, lines);
+        lines = [];
+        bytes = 0;
+      }
+      lines.push(line);
+      bytes += lineBytes;
+    }
+    if (lines.length) await this.appendBatch(datasource, lines);
+  }
+  async appendBatch(datasource, lines) {
+    const response = await fetch(
+      `${this.host.replace(/\/$/, "")}/v0/events?name=${encodeURIComponent(datasource)}&wait=true`,
+      {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${this.token}`,
+          "Content-Type": "application/x-ndjson"
+        },
+        body: lines.join("\n"),
+        signal: AbortSignal.timeout(15e3)
+      }
+    );
+    if (!response.ok) {
+      await response.body?.cancel();
+      throw new Error(`Tinybird ${datasource} ingestion failed (${response.status})`);
+    }
+    let result;
+    try {
+      const candidate = await response.json();
+      if (!candidate || typeof candidate !== "object" || Array.isArray(candidate)) {
+        throw new Error("invalid acknowledgement");
+      }
+      result = candidate;
+    } catch {
+      throw new Error(`Tinybird ${datasource} ingestion returned an invalid acknowledgement`);
+    }
+    if (Number(result.quarantined_rows) > 0 || Number(result.successful_rows) !== lines.length) {
+      throw new Error(`Tinybird ${datasource} ingestion did not acknowledge the complete batch`);
+    }
+  }
+};
+function captureRecordIsCurrent(record, now = Date.now()) {
+  if (typeof record.timestamp !== "string") return false;
+  const timestamp = Date.parse(`${record.timestamp.replace(" ", "T").replace(/Z$/, "")}Z`);
+  const days = normalizeRetentionDays(Number(record.retention_days));
+  return Number.isFinite(timestamp) && timestamp + days * 24 * 60 * 60 * 1e3 > now;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  TunnelTinybirdClient,
+  captureRecordIsCurrent,
+  normalizeRetentionDays,
+  protocolEventRecord,
+  requestCaptureRecord,
+  tinybirdTimestamp,
+  tunnelEventRecord
+});
+//# sourceMappingURL=tinybird-records.cjs.map

package/dist/tinybird-records.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/tinybird-records.ts"],"sourcesContent":["import { randomUUID } from \"node:crypto\";\n\nexport interface TunnelEvent {\n  request_id?: string;\n  timestamp: number;\n  tunnel_id: string;\n  organization_id: string;\n  retention_days: number;\n  host: string;\n  method: string;\n  path: string;\n  status_code: number;\n  request_duration_ms: number;\n  bytes_in: number;\n  bytes_out: number;\n  client_ip: string;\n  user_agent: string;\n}\n\nexport interface RequestCapture {\n  id: string;\n  timestamp: number;\n  tunnel_id: string;\n  organization_id: string;\n  retention_days: number;\n  request_headers: Record<string, string | string[]>;\n  request_body: string | null;\n  request_body_size: number;\n  response_headers: Record<string, string | string[]>;\n  response_body: string | null;\n  response_body_size: number;\n}\n\nexport interface ProtocolEvent {\n  direction?: \"in\" | \"out\";\n  timestamp: number;\n  tunnel_id: string;\n  organization_id: string;\n  retention_days: number;\n  protocol: \"tcp\" | \"udp\";\n  event_type: \"connection\" | \"data\" | \"close\" | \"packet\";\n  connection_id: string;\n  client_ip: string;\n  client_port: number;\n  bytes_in: number;\n  bytes_out: number;\n  duration_ms: number;\n}\n\nexport type TinybirdTunnelRecord = Record<string, string | number | null>;\n\nexport function normalizeRetentionDays(retentionDays: number): number {\n  if (!Number.isFinite(retentionDays)) return 3;\n  return Math.min(90, Math.max(1, Math.trunc(retentionDays)));\n}\n\nexport function tinybirdTimestamp(timestamp: number | Date): string {\n  return new Date(timestamp).toISOString().replace(\"T\", \" \").replace(\"Z\", \"\");\n}\n\nexport function tunnelEventRecord(event: TunnelEvent): TinybirdTunnelRecord {\n  return {\n    ...event,\n    request_id: event.request_id || \"\",\n    event_id: event.request_id || randomUUID(),\n    timestamp: tinybirdTimestamp(event.timestamp),\n    ingested_at: tinybirdTimestamp(Date.now()),\n    retention_days: normalizeRetentionDays(event.retention_days),\n  };\n}\n\nexport function requestCaptureRecord(capture: RequestCapture): TinybirdTunnelRecord {\n  return {\n    ...capture,\n    timestamp: tinybirdTimestamp(capture.timestamp),\n    ingested_at: tinybirdTimestamp(Date.now()),\n    retention_days: normalizeRetentionDays(capture.retention_days),\n    request_headers: JSON.stringify(capture.request_headers),\n    response_headers: JSON.stringify(capture.response_headers),\n  };\n}\n\nexport function protocolEventRecord(event: ProtocolEvent): TinybirdTunnelRecord {\n  return {\n    ...event,\n    event_id: randomUUID(),\n    timestamp: tinybirdTimestamp(event.timestamp),\n    ingested_at: tinybirdTimestamp(Date.now()),\n    retention_days: normalizeRetentionDays(event.retention_days),\n  };\n}\n\nexport class TunnelTinybirdClient {\n  constructor(private readonly host: string, private readonly token: string) {}\n\n  get configured(): boolean {\n    if (!this.host || !this.token) return false;\n    try {\n      const url = new URL(this.host);\n      return (url.protocol === \"https:\" ||\n        (url.protocol === \"http:\" && [\"localhost\", \"127.0.0.1\", \"[::1]\"].includes(url.hostname))) &&\n        !url.username && !url.password && !url.search && !url.hash && url.pathname === \"/\";\n    } catch {\n      return false;\n    }\n  }\n\n  async append(datasource: string, records: TinybirdTunnelRecord[]): Promise<void> {\n    if (datasource === \"tunnel_request_captures\") {\n      const oversized = records.filter((record) => Buffer.byteLength(JSON.stringify(record)) > 3 * 1024 * 1024).length;\n      if (oversized) console.error(`Tinybird capture delivery rejected ${oversized} oversized records; other captures will continue`);\n      records = records.filter((record) => captureRecordIsCurrent(record) && Buffer.byteLength(JSON.stringify(record)) <= 3 * 1024 * 1024);\n    }\n    if (!records.length) return;\n    if (!this.configured) throw new Error(\"Tinybird tunnel ingestion is not configured\");\n    // Keep requests below the Events API payload ceiling, even when captures\n    // contain large base64 request/response bodies. Stable ids make retrying an\n    // already accepted prefix safe when a later request fails.\n    const maxBytes = 4 * 1024 * 1024;\n    let lines: string[] = [];\n    let bytes = 0;\n    for (const record of records) {\n      const line = JSON.stringify(record);\n      const lineBytes = Buffer.byteLength(line) + 1;\n      if (lineBytes > maxBytes) {\n        throw new Error(`Tinybird ${datasource} record exceeds the ingestion size limit`);\n      }\n      if (bytes + lineBytes > maxBytes && lines.length) {\n        await this.appendBatch(datasource, lines);\n        lines = [];\n        bytes = 0;\n      }\n      lines.push(line);\n      bytes += lineBytes;\n    }\n    if (lines.length) await this.appendBatch(datasource, lines);\n  }\n\n  private async appendBatch(datasource: string, lines: string[]): Promise<void> {\n    const response = await fetch(\n      `${this.host.replace(/\\/$/, \"\")}/v0/events?name=${encodeURIComponent(datasource)}&wait=true`,\n      {\n        method: \"POST\",\n        headers: {\n          Authorization: `Bearer ${this.token}`,\n          \"Content-Type\": \"application/x-ndjson\",\n        },\n        body: lines.join(\"\\n\"),\n        signal: AbortSignal.timeout(15_000),\n      },\n    );\n    // Error bodies can echo capture values. Never include them in logs/errors.\n    if (!response.ok) {\n      await response.body?.cancel();\n      throw new Error(`Tinybird ${datasource} ingestion failed (${response.status})`);\n    }\n    let result: { successful_rows?: number; quarantined_rows?: number };\n    try {\n      const candidate: unknown = await response.json();\n      if (!candidate || typeof candidate !== \"object\" || Array.isArray(candidate)) {\n        throw new Error(\"invalid acknowledgement\");\n      }\n      result = candidate as typeof result;\n    } catch {\n      throw new Error(`Tinybird ${datasource} ingestion returned an invalid acknowledgement`);\n    }\n    if (Number(result.quarantined_rows) > 0 || Number(result.successful_rows) !== lines.length) {\n      throw new Error(`Tinybird ${datasource} ingestion did not acknowledge the complete batch`);\n    }\n  }\n}\n\n/** Backlogs must never republish captures past their individual plan expiry. */\nexport function captureRecordIsCurrent(record: TinybirdTunnelRecord, now = Date.now()): boolean {\n  if (typeof record.timestamp !== \"string\") return false;\n  const timestamp = Date.parse(`${record.timestamp.replace(\" \", \"T\").replace(/Z$/, \"\")}Z`);\n  const days = normalizeRetentionDays(Number(record.retention_days));\n  return Number.isFinite(timestamp) && timestamp + days * 24 * 60 * 60 * 1000 > now;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,yBAA2B;AAmDpB,SAAS,uBAAuB,eAA+B;AACpE,MAAI,CAAC,OAAO,SAAS,aAAa,EAAG,QAAO;AAC5C,SAAO,KAAK,IAAI,IAAI,KAAK,IAAI,GAAG,KAAK,MAAM,aAAa,CAAC,CAAC;AAC5D;AAEO,SAAS,kBAAkB,WAAkC;AAClE,SAAO,IAAI,KAAK,SAAS,EAAE,YAAY,EAAE,QAAQ,KAAK,GAAG,EAAE,QAAQ,KAAK,EAAE;AAC5E;AAEO,SAAS,kBAAkB,OAA0C;AAC1E,SAAO;AAAA,IACL,GAAG;AAAA,IACH,YAAY,MAAM,cAAc;AAAA,IAChC,UAAU,MAAM,kBAAc,+BAAW;AAAA,IACzC,WAAW,kBAAkB,MAAM,SAAS;AAAA,IAC5C,aAAa,kBAAkB,KAAK,IAAI,CAAC;AAAA,IACzC,gBAAgB,uBAAuB,MAAM,cAAc;AAAA,EAC7D;AACF;AAEO,SAAS,qBAAqB,SAA+C;AAClF,SAAO;AAAA,IACL,GAAG;AAAA,IACH,WAAW,kBAAkB,QAAQ,SAAS;AAAA,IAC9C,aAAa,kBAAkB,KAAK,IAAI,CAAC;AAAA,IACzC,gBAAgB,uBAAuB,QAAQ,cAAc;AAAA,IAC7D,iBAAiB,KAAK,UAAU,QAAQ,eAAe;AAAA,IACvD,kBAAkB,KAAK,UAAU,QAAQ,gBAAgB;AAAA,EAC3D;AACF;AAEO,SAAS,oBAAoB,OAA4C;AAC9E,SAAO;AAAA,IACL,GAAG;AAAA,IACH,cAAU,+BAAW;AAAA,IACrB,WAAW,kBAAkB,MAAM,SAAS;AAAA,IAC5C,aAAa,kBAAkB,KAAK,IAAI,CAAC;AAAA,IACzC,gBAAgB,uBAAuB,MAAM,cAAc;AAAA,EAC7D;AACF;AAEO,IAAM,uBAAN,MAA2B;AAAA,EAChC,YAA6B,MAA+B,OAAe;AAA9C;AAA+B;AAAA,EAAgB;AAAA,EAA/C;AAAA,EAA+B;AAAA,EAE5D,IAAI,aAAsB;AACxB,QAAI,CAAC,KAAK,QAAQ,CAAC,KAAK,MAAO,QAAO;AACtC,QAAI;AACF,YAAM,MAAM,IAAI,IAAI,KAAK,IAAI;AAC7B,cAAQ,IAAI,aAAa,YACtB,IAAI,aAAa,WAAW,CAAC,aAAa,aAAa,OAAO,EAAE,SAAS,IAAI,QAAQ,MACtF,CAAC,IAAI,YAAY,CAAC,IAAI,YAAY,CAAC,IAAI,UAAU,CAAC,IAAI,QAAQ,IAAI,aAAa;AAAA,IACnF,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,YAAoB,SAAgD;AAC/E,QAAI,eAAe,2BAA2B;AAC5C,YAAM,YAAY,QAAQ,OAAO,CAAC,WAAW,OAAO,WAAW,KAAK,UAAU,MAAM,CAAC,IAAI,IAAI,OAAO,IAAI,EAAE;AAC1G,UAAI,UAAW,SAAQ,MAAM,sCAAsC,SAAS,kDAAkD;AAC9H,gBAAU,QAAQ,OAAO,CAAC,WAAW,uBAAuB,MAAM,KAAK,OAAO,WAAW,KAAK,UAAU,MAAM,CAAC,KAAK,IAAI,OAAO,IAAI;AAAA,IACrI;AACA,QAAI,CAAC,QAAQ,OAAQ;AACrB,QAAI,CAAC,KAAK,WAAY,OAAM,IAAI,MAAM,6CAA6C;AAInF,UAAM,WAAW,IAAI,OAAO;AAC5B,QAAI,QAAkB,CAAC;AACvB,QAAI,QAAQ;AACZ,eAAW,UAAU,SAAS;AAC5B,YAAM,OAAO,KAAK,UAAU,MAAM;AAClC,YAAM,YAAY,OAAO,WAAW,IAAI,IAAI;AAC5C,UAAI,YAAY,UAAU;AACxB,cAAM,IAAI,MAAM,YAAY,UAAU,0CAA0C;AAAA,MAClF;AACA,UAAI,QAAQ,YAAY,YAAY,MAAM,QAAQ;AAChD,cAAM,KAAK,YAAY,YAAY,KAAK;AACxC,gBAAQ,CAAC;AACT,gBAAQ;AAAA,MACV;AACA,YAAM,KAAK,IAAI;AACf,eAAS;AAAA,IACX;AACA,QAAI,MAAM,OAAQ,OAAM,KAAK,YAAY,YAAY,KAAK;AAAA,EAC5D;AAAA,EAEA,MAAc,YAAY,YAAoB,OAAgC;AAC5E,UAAM,WAAW,MAAM;AAAA,MACrB,GAAG,KAAK,KAAK,QAAQ,OAAO,EAAE,CAAC,mBAAmB,mBAAmB,UAAU,CAAC;AAAA,MAChF;AAAA,QACE,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,eAAe,UAAU,KAAK,KAAK;AAAA,UACnC,gBAAgB;AAAA,QAClB;AAAA,QACA,MAAM,MAAM,KAAK,IAAI;AAAA,QACrB,QAAQ,YAAY,QAAQ,IAAM;AAAA,MACpC;AAAA,IACF;AAEA,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,SAAS,MAAM,OAAO;AAC5B,YAAM,IAAI,MAAM,YAAY,UAAU,sBAAsB,SAAS,MAAM,GAAG;AAAA,IAChF;AACA,QAAI;AACJ,QAAI;AACF,YAAM,YAAqB,MAAM,SAAS,KAAK;AAC/C,UAAI,CAAC,aAAa,OAAO,cAAc,YAAY,MAAM,QAAQ,SAAS,GAAG;AAC3E,cAAM,IAAI,MAAM,yBAAyB;AAAA,MAC3C;AACA,eAAS;AAAA,IACX,QAAQ;AACN,YAAM,IAAI,MAAM,YAAY,UAAU,gDAAgD;AAAA,IACxF;AACA,QAAI,OAAO,OAAO,gBAAgB,IAAI,KAAK,OAAO,OAAO,eAAe,MAAM,MAAM,QAAQ;AAC1F,YAAM,IAAI,MAAM,YAAY,UAAU,mDAAmD;AAAA,IAC3F;AAAA,EACF;AACF;AAGO,SAAS,uBAAuB,QAA8B,MAAM,KAAK,IAAI,GAAY;AAC9F,MAAI,OAAO,OAAO,cAAc,SAAU,QAAO;AACjD,QAAM,YAAY,KAAK,MAAM,GAAG,OAAO,UAAU,QAAQ,KAAK,GAAG,EAAE,QAAQ,MAAM,EAAE,CAAC,GAAG;AACvF,QAAM,OAAO,uBAAuB,OAAO,OAAO,cAAc,CAAC;AACjE,SAAO,OAAO,SAAS,SAAS,KAAK,YAAY,OAAO,KAAK,KAAK,KAAK,MAAO;AAChF;","names":[]}

package/dist/tinybird-records.d.cts

@@ -0,0 +1,62 @@
+interface TunnelEvent {
+    request_id?: string;
+    timestamp: number;
+    tunnel_id: string;
+    organization_id: string;
+    retention_days: number;
+    host: string;
+    method: string;
+    path: string;
+    status_code: number;
+    request_duration_ms: number;
+    bytes_in: number;
+    bytes_out: number;
+    client_ip: string;
+    user_agent: string;
+}
+interface RequestCapture {
+    id: string;
+    timestamp: number;
+    tunnel_id: string;
+    organization_id: string;
+    retention_days: number;
+    request_headers: Record<string, string | string[]>;
+    request_body: string | null;
+    request_body_size: number;
+    response_headers: Record<string, string | string[]>;
+    response_body: string | null;
+    response_body_size: number;
+}
+interface ProtocolEvent {
+    direction?: "in" | "out";
+    timestamp: number;
+    tunnel_id: string;
+    organization_id: string;
+    retention_days: number;
+    protocol: "tcp" | "udp";
+    event_type: "connection" | "data" | "close" | "packet";
+    connection_id: string;
+    client_ip: string;
+    client_port: number;
+    bytes_in: number;
+    bytes_out: number;
+    duration_ms: number;
+}
+type TinybirdTunnelRecord = Record<string, string | number | null>;
+declare function normalizeRetentionDays(retentionDays: number): number;
+declare function tinybirdTimestamp(timestamp: number | Date): string;
+declare function tunnelEventRecord(event: TunnelEvent): TinybirdTunnelRecord;
+declare function requestCaptureRecord(capture: RequestCapture): TinybirdTunnelRecord;
+declare function protocolEventRecord(event: ProtocolEvent): TinybirdTunnelRecord;
+declare class TunnelTinybirdClient {
+    private readonly host;
+    private readonly token;
+    constructor(host: string, token: string);
+    get configured(): boolean;
+    append(datasource: string, records: TinybirdTunnelRecord[]): Promise<void>;
+    private appendBatch;
+}
+/** Backlogs must never republish captures past their individual plan expiry. */
+declare function captureRecordIsCurrent(record: TinybirdTunnelRecord, now?: number): boolean;
+
+export { type ProtocolEvent, type RequestCapture, type TinybirdTunnelRecord, type TunnelEvent, TunnelTinybirdClient, captureRecordIsCurrent, normalizeRetentionDays, protocolEventRecord, requestCaptureRecord, tinybirdTimestamp, tunnelEventRecord };

package/dist/tinybird-records.d.ts

@@ -0,0 +1,62 @@
+interface TunnelEvent {
+    request_id?: string;
+    timestamp: number;
+    tunnel_id: string;
+    organization_id: string;
+    retention_days: number;
+    host: string;
+    method: string;
+    path: string;
+    status_code: number;
+    request_duration_ms: number;
+    bytes_in: number;
+    bytes_out: number;
+    client_ip: string;
+    user_agent: string;
+}
+interface RequestCapture {
+    id: string;
+    timestamp: number;
+    tunnel_id: string;
+    organization_id: string;
+    retention_days: number;
+    request_headers: Record<string, string | string[]>;
+    request_body: string | null;
+    request_body_size: number;
+    response_headers: Record<string, string | string[]>;
+    response_body: string | null;
+    response_body_size: number;
+}
+interface ProtocolEvent {
+    direction?: "in" | "out";
+    timestamp: number;
+    tunnel_id: string;
+    organization_id: string;
+    retention_days: number;
+    protocol: "tcp" | "udp";
+    event_type: "connection" | "data" | "close" | "packet";
+    connection_id: string;
+    client_ip: string;
+    client_port: number;
+    bytes_in: number;
+    bytes_out: number;
+    duration_ms: number;
+}
+type TinybirdTunnelRecord = Record<string, string | number | null>;
+declare function normalizeRetentionDays(retentionDays: number): number;
+declare function tinybirdTimestamp(timestamp: number | Date): string;
+declare function tunnelEventRecord(event: TunnelEvent): TinybirdTunnelRecord;
+declare function requestCaptureRecord(capture: RequestCapture): TinybirdTunnelRecord;
+declare function protocolEventRecord(event: ProtocolEvent): TinybirdTunnelRecord;
+declare class TunnelTinybirdClient {
+    private readonly host;
+    private readonly token;
+    constructor(host: string, token: string);
+    get configured(): boolean;
+    append(datasource: string, records: TinybirdTunnelRecord[]): Promise<void>;
+    private appendBatch;
+}
+/** Backlogs must never republish captures past their individual plan expiry. */
+declare function captureRecordIsCurrent(record: TinybirdTunnelRecord, now?: number): boolean;
+
+export { type ProtocolEvent, type RequestCapture, type TinybirdTunnelRecord, type TunnelEvent, TunnelTinybirdClient, captureRecordIsCurrent, normalizeRetentionDays, protocolEventRecord, requestCaptureRecord, tinybirdTimestamp, tunnelEventRecord };

package/dist/tinybird-records.js

@@ -0,0 +1,129 @@
+// src/tinybird-records.ts
+import { randomUUID } from "crypto";
+function normalizeRetentionDays(retentionDays) {
+  if (!Number.isFinite(retentionDays)) return 3;
+  return Math.min(90, Math.max(1, Math.trunc(retentionDays)));
+}
+function tinybirdTimestamp(timestamp) {
+  return new Date(timestamp).toISOString().replace("T", " ").replace("Z", "");
+}
+function tunnelEventRecord(event) {
+  return {
+    ...event,
+    request_id: event.request_id || "",
+    event_id: event.request_id || randomUUID(),
+    timestamp: tinybirdTimestamp(event.timestamp),
+    ingested_at: tinybirdTimestamp(Date.now()),
+    retention_days: normalizeRetentionDays(event.retention_days)
+  };
+}
+function requestCaptureRecord(capture) {
+  return {
+    ...capture,
+    timestamp: tinybirdTimestamp(capture.timestamp),
+    ingested_at: tinybirdTimestamp(Date.now()),
+    retention_days: normalizeRetentionDays(capture.retention_days),
+    request_headers: JSON.stringify(capture.request_headers),
+    response_headers: JSON.stringify(capture.response_headers)
+  };
+}
+function protocolEventRecord(event) {
+  return {
+    ...event,
+    event_id: randomUUID(),
+    timestamp: tinybirdTimestamp(event.timestamp),
+    ingested_at: tinybirdTimestamp(Date.now()),
+    retention_days: normalizeRetentionDays(event.retention_days)
+  };
+}
+var TunnelTinybirdClient = class {
+  constructor(host, token) {
+    this.host = host;
+    this.token = token;
+  }
+  host;
+  token;
+  get configured() {
+    if (!this.host || !this.token) return false;
+    try {
+      const url = new URL(this.host);
+      return (url.protocol === "https:" || url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)) && !url.username && !url.password && !url.search && !url.hash && url.pathname === "/";
+    } catch {
+      return false;
+    }
+  }
+  async append(datasource, records) {
+    if (datasource === "tunnel_request_captures") {
+      const oversized = records.filter((record) => Buffer.byteLength(JSON.stringify(record)) > 3 * 1024 * 1024).length;
+      if (oversized) console.error(`Tinybird capture delivery rejected ${oversized} oversized records; other captures will continue`);
+      records = records.filter((record) => captureRecordIsCurrent(record) && Buffer.byteLength(JSON.stringify(record)) <= 3 * 1024 * 1024);
+    }
+    if (!records.length) return;
+    if (!this.configured) throw new Error("Tinybird tunnel ingestion is not configured");
+    const maxBytes = 4 * 1024 * 1024;
+    let lines = [];
+    let bytes = 0;
+    for (const record of records) {
+      const line = JSON.stringify(record);
+      const lineBytes = Buffer.byteLength(line) + 1;
+      if (lineBytes > maxBytes) {
+        throw new Error(`Tinybird ${datasource} record exceeds the ingestion size limit`);
+      }
+      if (bytes + lineBytes > maxBytes && lines.length) {
+        await this.appendBatch(datasource, lines);
+        lines = [];
+        bytes = 0;
+      }
+      lines.push(line);
+      bytes += lineBytes;
+    }
+    if (lines.length) await this.appendBatch(datasource, lines);
+  }
+  async appendBatch(datasource, lines) {
+    const response = await fetch(
+      `${this.host.replace(/\/$/, "")}/v0/events?name=${encodeURIComponent(datasource)}&wait=true`,
+      {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${this.token}`,
+          "Content-Type": "application/x-ndjson"
+        },
+        body: lines.join("\n"),
+        signal: AbortSignal.timeout(15e3)
+      }
+    );
+    if (!response.ok) {
+      await response.body?.cancel();
+      throw new Error(`Tinybird ${datasource} ingestion failed (${response.status})`);
+    }
+    let result;
+    try {
+      const candidate = await response.json();
+      if (!candidate || typeof candidate !== "object" || Array.isArray(candidate)) {
+        throw new Error("invalid acknowledgement");
+      }
+      result = candidate;
+    } catch {
+      throw new Error(`Tinybird ${datasource} ingestion returned an invalid acknowledgement`);
+    }
+    if (Number(result.quarantined_rows) > 0 || Number(result.successful_rows) !== lines.length) {
+      throw new Error(`Tinybird ${datasource} ingestion did not acknowledge the complete batch`);
+    }
+  }
+};
+function captureRecordIsCurrent(record, now = Date.now()) {
+  if (typeof record.timestamp !== "string") return false;
+  const timestamp = Date.parse(`${record.timestamp.replace(" ", "T").replace(/Z$/, "")}Z`);
+  const days = normalizeRetentionDays(Number(record.retention_days));
+  return Number.isFinite(timestamp) && timestamp + days * 24 * 60 * 60 * 1e3 > now;
+}
+export {
+  TunnelTinybirdClient,
+  captureRecordIsCurrent,
+  normalizeRetentionDays,
+  protocolEventRecord,
+  requestCaptureRecord,
+  tinybirdTimestamp,
+  tunnelEventRecord
+};
+//# sourceMappingURL=tinybird-records.js.map

package/dist/tinybird-records.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/tinybird-records.ts"],"sourcesContent":["import { randomUUID } from \"node:crypto\";\n\nexport interface TunnelEvent {\n  request_id?: string;\n  timestamp: number;\n  tunnel_id: string;\n  organization_id: string;\n  retention_days: number;\n  host: string;\n  method: string;\n  path: string;\n  status_code: number;\n  request_duration_ms: number;\n  bytes_in: number;\n  bytes_out: number;\n  client_ip: string;\n  user_agent: string;\n}\n\nexport interface RequestCapture {\n  id: string;\n  timestamp: number;\n  tunnel_id: string;\n  organization_id: string;\n  retention_days: number;\n  request_headers: Record<string, string | string[]>;\n  request_body: string | null;\n  request_body_size: number;\n  response_headers: Record<string, string | string[]>;\n  response_body: string | null;\n  response_body_size: number;\n}\n\nexport interface ProtocolEvent {\n  direction?: \"in\" | \"out\";\n  timestamp: number;\n  tunnel_id: string;\n  organization_id: string;\n  retention_days: number;\n  protocol: \"tcp\" | \"udp\";\n  event_type: \"connection\" | \"data\" | \"close\" | \"packet\";\n  connection_id: string;\n  client_ip: string;\n  client_port: number;\n  bytes_in: number;\n  bytes_out: number;\n  duration_ms: number;\n}\n\nexport type TinybirdTunnelRecord = Record<string, string | number | null>;\n\nexport function normalizeRetentionDays(retentionDays: number): number {\n  if (!Number.isFinite(retentionDays)) return 3;\n  return Math.min(90, Math.max(1, Math.trunc(retentionDays)));\n}\n\nexport function tinybirdTimestamp(timestamp: number | Date): string {\n  return new Date(timestamp).toISOString().replace(\"T\", \" \").replace(\"Z\", \"\");\n}\n\nexport function tunnelEventRecord(event: TunnelEvent): TinybirdTunnelRecord {\n  return {\n    ...event,\n    request_id: event.request_id || \"\",\n    event_id: event.request_id || randomUUID(),\n    timestamp: tinybirdTimestamp(event.timestamp),\n    ingested_at: tinybirdTimestamp(Date.now()),\n    retention_days: normalizeRetentionDays(event.retention_days),\n  };\n}\n\nexport function requestCaptureRecord(capture: RequestCapture): TinybirdTunnelRecord {\n  return {\n    ...capture,\n    timestamp: tinybirdTimestamp(capture.timestamp),\n    ingested_at: tinybirdTimestamp(Date.now()),\n    retention_days: normalizeRetentionDays(capture.retention_days),\n    request_headers: JSON.stringify(capture.request_headers),\n    response_headers: JSON.stringify(capture.response_headers),\n  };\n}\n\nexport function protocolEventRecord(event: ProtocolEvent): TinybirdTunnelRecord {\n  return {\n    ...event,\n    event_id: randomUUID(),\n    timestamp: tinybirdTimestamp(event.timestamp),\n    ingested_at: tinybirdTimestamp(Date.now()),\n    retention_days: normalizeRetentionDays(event.retention_days),\n  };\n}\n\nexport class TunnelTinybirdClient {\n  constructor(private readonly host: string, private readonly token: string) {}\n\n  get configured(): boolean {\n    if (!this.host || !this.token) return false;\n    try {\n      const url = new URL(this.host);\n      return (url.protocol === \"https:\" ||\n        (url.protocol === \"http:\" && [\"localhost\", \"127.0.0.1\", \"[::1]\"].includes(url.hostname))) &&\n        !url.username && !url.password && !url.search && !url.hash && url.pathname === \"/\";\n    } catch {\n      return false;\n    }\n  }\n\n  async append(datasource: string, records: TinybirdTunnelRecord[]): Promise<void> {\n    if (datasource === \"tunnel_request_captures\") {\n      const oversized = records.filter((record) => Buffer.byteLength(JSON.stringify(record)) > 3 * 1024 * 1024).length;\n      if (oversized) console.error(`Tinybird capture delivery rejected ${oversized} oversized records; other captures will continue`);\n      records = records.filter((record) => captureRecordIsCurrent(record) && Buffer.byteLength(JSON.stringify(record)) <= 3 * 1024 * 1024);\n    }\n    if (!records.length) return;\n    if (!this.configured) throw new Error(\"Tinybird tunnel ingestion is not configured\");\n    // Keep requests below the Events API payload ceiling, even when captures\n    // contain large base64 request/response bodies. Stable ids make retrying an\n    // already accepted prefix safe when a later request fails.\n    const maxBytes = 4 * 1024 * 1024;\n    let lines: string[] = [];\n    let bytes = 0;\n    for (const record of records) {\n      const line = JSON.stringify(record);\n      const lineBytes = Buffer.byteLength(line) + 1;\n      if (lineBytes > maxBytes) {\n        throw new Error(`Tinybird ${datasource} record exceeds the ingestion size limit`);\n      }\n      if (bytes + lineBytes > maxBytes && lines.length) {\n        await this.appendBatch(datasource, lines);\n        lines = [];\n        bytes = 0;\n      }\n      lines.push(line);\n      bytes += lineBytes;\n    }\n    if (lines.length) await this.appendBatch(datasource, lines);\n  }\n\n  private async appendBatch(datasource: string, lines: string[]): Promise<void> {\n    const response = await fetch(\n      `${this.host.replace(/\\/$/, \"\")}/v0/events?name=${encodeURIComponent(datasource)}&wait=true`,\n      {\n        method: \"POST\",\n        headers: {\n          Authorization: `Bearer ${this.token}`,\n          \"Content-Type\": \"application/x-ndjson\",\n        },\n        body: lines.join(\"\\n\"),\n        signal: AbortSignal.timeout(15_000),\n      },\n    );\n    // Error bodies can echo capture values. Never include them in logs/errors.\n    if (!response.ok) {\n      await response.body?.cancel();\n      throw new Error(`Tinybird ${datasource} ingestion failed (${response.status})`);\n    }\n    let result: { successful_rows?: number; quarantined_rows?: number };\n    try {\n      const candidate: unknown = await response.json();\n      if (!candidate || typeof candidate !== \"object\" || Array.isArray(candidate)) {\n        throw new Error(\"invalid acknowledgement\");\n      }\n      result = candidate as typeof result;\n    } catch {\n      throw new Error(`Tinybird ${datasource} ingestion returned an invalid acknowledgement`);\n    }\n    if (Number(result.quarantined_rows) > 0 || Number(result.successful_rows) !== lines.length) {\n      throw new Error(`Tinybird ${datasource} ingestion did not acknowledge the complete batch`);\n    }\n  }\n}\n\n/** Backlogs must never republish captures past their individual plan expiry. */\nexport function captureRecordIsCurrent(record: TinybirdTunnelRecord, now = Date.now()): boolean {\n  if (typeof record.timestamp !== \"string\") return false;\n  const timestamp = Date.parse(`${record.timestamp.replace(\" \", \"T\").replace(/Z$/, \"\")}Z`);\n  const days = normalizeRetentionDays(Number(record.retention_days));\n  return Number.isFinite(timestamp) && timestamp + days * 24 * 60 * 60 * 1000 > now;\n}\n"],"mappings":";AAAA,SAAS,kBAAkB;AAmDpB,SAAS,uBAAuB,eAA+B;AACpE,MAAI,CAAC,OAAO,SAAS,aAAa,EAAG,QAAO;AAC5C,SAAO,KAAK,IAAI,IAAI,KAAK,IAAI,GAAG,KAAK,MAAM,aAAa,CAAC,CAAC;AAC5D;AAEO,SAAS,kBAAkB,WAAkC;AAClE,SAAO,IAAI,KAAK,SAAS,EAAE,YAAY,EAAE,QAAQ,KAAK,GAAG,EAAE,QAAQ,KAAK,EAAE;AAC5E;AAEO,SAAS,kBAAkB,OAA0C;AAC1E,SAAO;AAAA,IACL,GAAG;AAAA,IACH,YAAY,MAAM,cAAc;AAAA,IAChC,UAAU,MAAM,cAAc,WAAW;AAAA,IACzC,WAAW,kBAAkB,MAAM,SAAS;AAAA,IAC5C,aAAa,kBAAkB,KAAK,IAAI,CAAC;AAAA,IACzC,gBAAgB,uBAAuB,MAAM,cAAc;AAAA,EAC7D;AACF;AAEO,SAAS,qBAAqB,SAA+C;AAClF,SAAO;AAAA,IACL,GAAG;AAAA,IACH,WAAW,kBAAkB,QAAQ,SAAS;AAAA,IAC9C,aAAa,kBAAkB,KAAK,IAAI,CAAC;AAAA,IACzC,gBAAgB,uBAAuB,QAAQ,cAAc;AAAA,IAC7D,iBAAiB,KAAK,UAAU,QAAQ,eAAe;AAAA,IACvD,kBAAkB,KAAK,UAAU,QAAQ,gBAAgB;AAAA,EAC3D;AACF;AAEO,SAAS,oBAAoB,OAA4C;AAC9E,SAAO;AAAA,IACL,GAAG;AAAA,IACH,UAAU,WAAW;AAAA,IACrB,WAAW,kBAAkB,MAAM,SAAS;AAAA,IAC5C,aAAa,kBAAkB,KAAK,IAAI,CAAC;AAAA,IACzC,gBAAgB,uBAAuB,MAAM,cAAc;AAAA,EAC7D;AACF;AAEO,IAAM,uBAAN,MAA2B;AAAA,EAChC,YAA6B,MAA+B,OAAe;AAA9C;AAA+B;AAAA,EAAgB;AAAA,EAA/C;AAAA,EAA+B;AAAA,EAE5D,IAAI,aAAsB;AACxB,QAAI,CAAC,KAAK,QAAQ,CAAC,KAAK,MAAO,QAAO;AACtC,QAAI;AACF,YAAM,MAAM,IAAI,IAAI,KAAK,IAAI;AAC7B,cAAQ,IAAI,aAAa,YACtB,IAAI,aAAa,WAAW,CAAC,aAAa,aAAa,OAAO,EAAE,SAAS,IAAI,QAAQ,MACtF,CAAC,IAAI,YAAY,CAAC,IAAI,YAAY,CAAC,IAAI,UAAU,CAAC,IAAI,QAAQ,IAAI,aAAa;AAAA,IACnF,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,YAAoB,SAAgD;AAC/E,QAAI,eAAe,2BAA2B;AAC5C,YAAM,YAAY,QAAQ,OAAO,CAAC,WAAW,OAAO,WAAW,KAAK,UAAU,MAAM,CAAC,IAAI,IAAI,OAAO,IAAI,EAAE;AAC1G,UAAI,UAAW,SAAQ,MAAM,sCAAsC,SAAS,kDAAkD;AAC9H,gBAAU,QAAQ,OAAO,CAAC,WAAW,uBAAuB,MAAM,KAAK,OAAO,WAAW,KAAK,UAAU,MAAM,CAAC,KAAK,IAAI,OAAO,IAAI;AAAA,IACrI;AACA,QAAI,CAAC,QAAQ,OAAQ;AACrB,QAAI,CAAC,KAAK,WAAY,OAAM,IAAI,MAAM,6CAA6C;AAInF,UAAM,WAAW,IAAI,OAAO;AAC5B,QAAI,QAAkB,CAAC;AACvB,QAAI,QAAQ;AACZ,eAAW,UAAU,SAAS;AAC5B,YAAM,OAAO,KAAK,UAAU,MAAM;AAClC,YAAM,YAAY,OAAO,WAAW,IAAI,IAAI;AAC5C,UAAI,YAAY,UAAU;AACxB,cAAM,IAAI,MAAM,YAAY,UAAU,0CAA0C;AAAA,MAClF;AACA,UAAI,QAAQ,YAAY,YAAY,MAAM,QAAQ;AAChD,cAAM,KAAK,YAAY,YAAY,KAAK;AACxC,gBAAQ,CAAC;AACT,gBAAQ;AAAA,MACV;AACA,YAAM,KAAK,IAAI;AACf,eAAS;AAAA,IACX;AACA,QAAI,MAAM,OAAQ,OAAM,KAAK,YAAY,YAAY,KAAK;AAAA,EAC5D;AAAA,EAEA,MAAc,YAAY,YAAoB,OAAgC;AAC5E,UAAM,WAAW,MAAM;AAAA,MACrB,GAAG,KAAK,KAAK,QAAQ,OAAO,EAAE,CAAC,mBAAmB,mBAAmB,UAAU,CAAC;AAAA,MAChF;AAAA,QACE,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,eAAe,UAAU,KAAK,KAAK;AAAA,UACnC,gBAAgB;AAAA,QAClB;AAAA,QACA,MAAM,MAAM,KAAK,IAAI;AAAA,QACrB,QAAQ,YAAY,QAAQ,IAAM;AAAA,MACpC;AAAA,IACF;AAEA,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,SAAS,MAAM,OAAO;AAC5B,YAAM,IAAI,MAAM,YAAY,UAAU,sBAAsB,SAAS,MAAM,GAAG;AAAA,IAChF;AACA,QAAI;AACJ,QAAI;AACF,YAAM,YAAqB,MAAM,SAAS,KAAK;AAC/C,UAAI,CAAC,aAAa,OAAO,cAAc,YAAY,MAAM,QAAQ,SAAS,GAAG;AAC3E,cAAM,IAAI,MAAM,yBAAyB;AAAA,MAC3C;AACA,eAAS;AAAA,IACX,QAAQ;AACN,YAAM,IAAI,MAAM,YAAY,UAAU,gDAAgD;AAAA,IACxF;AACA,QAAI,OAAO,OAAO,gBAAgB,IAAI,KAAK,OAAO,OAAO,eAAe,MAAM,MAAM,QAAQ;AAC1F,YAAM,IAAI,MAAM,YAAY,UAAU,mDAAmD;AAAA,IAC3F;AAAA,EACF;AACF;AAGO,SAAS,uBAAuB,QAA8B,MAAM,KAAK,IAAI,GAAY;AAC9F,MAAI,OAAO,OAAO,cAAc,SAAU,QAAO;AACjD,QAAM,YAAY,KAAK,MAAM,GAAG,OAAO,UAAU,QAAQ,KAAK,GAAG,EAAE,QAAQ,MAAM,EAAE,CAAC,GAAG;AACvF,QAAM,OAAO,uBAAuB,OAAO,OAAO,cAAc,CAAC;AACjE,SAAO,OAAO,SAAS,SAAS,KAAK,YAAY,OAAO,KAAK,KAAK,KAAK,MAAO;AAChF;","names":[]}

package/dist/tunnel-accounting.cjs

@@ -0,0 +1,71 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/tunnel-accounting.ts
+var tunnel_accounting_exports = {};
+__export(tunnel_accounting_exports, {
+  default: () => tunnel_accounting_default,
+  recordProductUsage: () => recordProductUsage,
+  tunnelUsageMetrics: () => tunnelUsageMetrics
+});
+module.exports = __toCommonJS(tunnel_accounting_exports);
+
+// src/usage-writer.ts
+async function recordUsageCounters(database, event, allowedMetrics) {
+  if (!event.organizationId || event.organizationId.length > 128 || !/^[a-z][a-z0-9-]{0,63}$/.test(event.source) || !event.id || event.id.length > 256 || !Number.isFinite(Date.parse(event.timestamp))) throw new Error("Invalid usage event");
+  const deltas = {};
+  for (const [key, value] of Object.entries(event.deltas).sort(([a], [b]) => a.localeCompare(b))) {
+    if (!allowedMetrics.has(key) || typeof value === "number" && !Number.isSafeInteger(value) || !/^\d+$/.test(String(value))) throw new Error("Invalid usage delta");
+    const count = BigInt(value);
+    if (count > 9223372036854775807n) throw new Error("Usage delta overflow");
+    if (count > 0n) deltas[key] = String(count);
+  }
+  if (!Object.keys(deltas).length) return false;
+  const result = await database.query("SELECT record_product_usage($1,$2,$3,$4::timestamptz,$5::jsonb) AS recorded", [event.organizationId, event.source, event.id, event.timestamp, JSON.stringify(deltas)]);
+  return result.rows[0]?.recorded === true;
+}
+
+// src/tunnel-accounting.ts
+var tunnelUsageMetrics = [
+  "tunnels.opens.http",
+  "tunnels.opens.tcp",
+  "tunnels.opens.udp",
+  "tunnels.registrations.http",
+  "tunnels.registrations.tcp",
+  "tunnels.registrations.udp",
+  "tunnels.http_requests",
+  "tunnels.tcp_connections",
+  "tunnels.udp_datagrams.in",
+  "tunnels.udp_datagrams.out",
+  "tunnels.bytes.http.in",
+  "tunnels.bytes.http.out",
+  "tunnels.bytes.tcp.in",
+  "tunnels.bytes.tcp.out",
+  "tunnels.bytes.udp.in",
+  "tunnels.bytes.udp.out"
+];
+var known = new Set(tunnelUsageMetrics);
+var recordProductUsage = (database, event) => recordUsageCounters(database, event, known);
+var tunnel_accounting_default = { recordProductUsage };
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  recordProductUsage,
+  tunnelUsageMetrics
+});
+//# sourceMappingURL=tunnel-accounting.cjs.map

package/dist/tunnel-accounting.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/tunnel-accounting.ts","../src/usage-writer.ts"],"sourcesContent":["import { recordUsageCounters, type CounterEvent, type UsageDatabase } from \"./usage-writer\";\nexport const tunnelUsageMetrics = [\n  \"tunnels.opens.http\", \"tunnels.opens.tcp\", \"tunnels.opens.udp\",\n  \"tunnels.registrations.http\", \"tunnels.registrations.tcp\", \"tunnels.registrations.udp\",\n  \"tunnels.http_requests\", \"tunnels.tcp_connections\", \"tunnels.udp_datagrams.in\", \"tunnels.udp_datagrams.out\",\n  \"tunnels.bytes.http.in\", \"tunnels.bytes.http.out\", \"tunnels.bytes.tcp.in\", \"tunnels.bytes.tcp.out\",\n  \"tunnels.bytes.udp.in\", \"tunnels.bytes.udp.out\",\n] as const;\nexport type UsageMetric = typeof tunnelUsageMetrics[number];\nexport type UsageEvent = CounterEvent<UsageMetric>;\nexport type { UsageDatabase };\nconst known = new Set<string>(tunnelUsageMetrics);\nexport const recordProductUsage = (database: UsageDatabase, event: UsageEvent) => recordUsageCounters(database, event, known);\nexport default { recordProductUsage };\n","export interface UsageDatabase { query(text: string, values?: any[]): Promise<any> }\nexport interface CounterEvent<Metric extends string = string> {\n  organizationId: string; source: string; id: string; timestamp: string;\n  deltas: Partial<Record<Metric, string | number>>;\n}\n/** Transport and validation only; callers supply their product's metric catalog. */\nexport async function recordUsageCounters<Metric extends string>(database: UsageDatabase, event: CounterEvent<Metric>, allowedMetrics: ReadonlySet<string>): Promise<boolean> {\n  if (!event.organizationId || event.organizationId.length > 128 || !/^[a-z][a-z0-9-]{0,63}$/.test(event.source) || !event.id || event.id.length > 256 || !Number.isFinite(Date.parse(event.timestamp))) throw new Error(\"Invalid usage event\");\n  const deltas: Record<string, string> = {};\n  for (const [key, value] of Object.entries(event.deltas).sort(([a], [b]) => a.localeCompare(b))) {\n    if (!allowedMetrics.has(key) || (typeof value === \"number\" && !Number.isSafeInteger(value)) || !/^\\d+$/.test(String(value))) throw new Error(\"Invalid usage delta\");\n    const count = BigInt(value as string | number);\n    if (count > 9223372036854775807n) throw new Error(\"Usage delta overflow\");\n    if (count > 0n) deltas[key] = String(count);\n  }\n  if (!Object.keys(deltas).length) return false;\n  const result = await database.query(\"SELECT record_product_usage($1,$2,$3,$4::timestamptz,$5::jsonb) AS recorded\", [event.organizationId, event.source, event.id, event.timestamp, JSON.stringify(deltas)]);\n  return result.rows[0]?.recorded === true;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACMA,eAAsB,oBAA2C,UAAyB,OAA6B,gBAAuD;AAC5K,MAAI,CAAC,MAAM,kBAAkB,MAAM,eAAe,SAAS,OAAO,CAAC,yBAAyB,KAAK,MAAM,MAAM,KAAK,CAAC,MAAM,MAAM,MAAM,GAAG,SAAS,OAAO,CAAC,OAAO,SAAS,KAAK,MAAM,MAAM,SAAS,CAAC,EAAG,OAAM,IAAI,MAAM,qBAAqB;AAC5O,QAAM,SAAiC,CAAC;AACxC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,GAAG;AAC9F,QAAI,CAAC,eAAe,IAAI,GAAG,KAAM,OAAO,UAAU,YAAY,CAAC,OAAO,cAAc,KAAK,KAAM,CAAC,QAAQ,KAAK,OAAO,KAAK,CAAC,EAAG,OAAM,IAAI,MAAM,qBAAqB;AAClK,UAAM,QAAQ,OAAO,KAAwB;AAC7C,QAAI,QAAQ,qBAAsB,OAAM,IAAI,MAAM,sBAAsB;AACxE,QAAI,QAAQ,GAAI,QAAO,GAAG,IAAI,OAAO,KAAK;AAAA,EAC5C;AACA,MAAI,CAAC,OAAO,KAAK,MAAM,EAAE,OAAQ,QAAO;AACxC,QAAM,SAAS,MAAM,SAAS,MAAM,+EAA+E,CAAC,MAAM,gBAAgB,MAAM,QAAQ,MAAM,IAAI,MAAM,WAAW,KAAK,UAAU,MAAM,CAAC,CAAC;AAC1M,SAAO,OAAO,KAAK,CAAC,GAAG,aAAa;AACtC;;;ADjBO,IAAM,qBAAqB;AAAA,EAChC;AAAA,EAAsB;AAAA,EAAqB;AAAA,EAC3C;AAAA,EAA8B;AAAA,EAA6B;AAAA,EAC3D;AAAA,EAAyB;AAAA,EAA2B;AAAA,EAA4B;AAAA,EAChF;AAAA,EAAyB;AAAA,EAA0B;AAAA,EAAwB;AAAA,EAC3E;AAAA,EAAwB;AAC1B;AAIA,IAAM,QAAQ,IAAI,IAAY,kBAAkB;AACzC,IAAM,qBAAqB,CAAC,UAAyB,UAAsB,oBAAoB,UAAU,OAAO,KAAK;AAC5H,IAAO,4BAAQ,EAAE,mBAAmB;","names":[]}

package/dist/tunnel-accounting.d.cts

@@ -0,0 +1,12 @@
+import { CounterEvent, UsageDatabase } from './usage-writer.cjs';
+
+declare const tunnelUsageMetrics: readonly ["tunnels.opens.http", "tunnels.opens.tcp", "tunnels.opens.udp", "tunnels.registrations.http", "tunnels.registrations.tcp", "tunnels.registrations.udp", "tunnels.http_requests", "tunnels.tcp_connections", "tunnels.udp_datagrams.in", "tunnels.udp_datagrams.out", "tunnels.bytes.http.in", "tunnels.bytes.http.out", "tunnels.bytes.tcp.in", "tunnels.bytes.tcp.out", "tunnels.bytes.udp.in", "tunnels.bytes.udp.out"];
+type UsageMetric = typeof tunnelUsageMetrics[number];
+type UsageEvent = CounterEvent<UsageMetric>;
+
+declare const recordProductUsage: (database: UsageDatabase, event: UsageEvent) => Promise<boolean>;
+declare const _default: {
+    recordProductUsage: (database: UsageDatabase, event: UsageEvent) => Promise<boolean>;
+};
+
+export { UsageDatabase, type UsageEvent, type UsageMetric, _default as default, recordProductUsage, tunnelUsageMetrics };

package/dist/tunnel-accounting.d.ts

@@ -0,0 +1,12 @@
+import { CounterEvent, UsageDatabase } from './usage-writer.js';
+
+declare const tunnelUsageMetrics: readonly ["tunnels.opens.http", "tunnels.opens.tcp", "tunnels.opens.udp", "tunnels.registrations.http", "tunnels.registrations.tcp", "tunnels.registrations.udp", "tunnels.http_requests", "tunnels.tcp_connections", "tunnels.udp_datagrams.in", "tunnels.udp_datagrams.out", "tunnels.bytes.http.in", "tunnels.bytes.http.out", "tunnels.bytes.tcp.in", "tunnels.bytes.tcp.out", "tunnels.bytes.udp.in", "tunnels.bytes.udp.out"];
+type UsageMetric = typeof tunnelUsageMetrics[number];
+type UsageEvent = CounterEvent<UsageMetric>;
+
+declare const recordProductUsage: (database: UsageDatabase, event: UsageEvent) => Promise<boolean>;
+declare const _default: {
+    recordProductUsage: (database: UsageDatabase, event: UsageEvent) => Promise<boolean>;
+};
+
+export { UsageDatabase, type UsageEvent, type UsageMetric, _default as default, recordProductUsage, tunnelUsageMetrics };

package/dist/tunnel-accounting.js

@@ -0,0 +1,32 @@
+import {
+  recordUsageCounters
+} from "./chunk-XAMVXW6B.js";
+
+// src/tunnel-accounting.ts
+var tunnelUsageMetrics = [
+  "tunnels.opens.http",
+  "tunnels.opens.tcp",
+  "tunnels.opens.udp",
+  "tunnels.registrations.http",
+  "tunnels.registrations.tcp",
+  "tunnels.registrations.udp",
+  "tunnels.http_requests",
+  "tunnels.tcp_connections",
+  "tunnels.udp_datagrams.in",
+  "tunnels.udp_datagrams.out",
+  "tunnels.bytes.http.in",
+  "tunnels.bytes.http.out",
+  "tunnels.bytes.tcp.in",
+  "tunnels.bytes.tcp.out",
+  "tunnels.bytes.udp.in",
+  "tunnels.bytes.udp.out"
+];
+var known = new Set(tunnelUsageMetrics);
+var recordProductUsage = (database, event) => recordUsageCounters(database, event, known);
+var tunnel_accounting_default = { recordProductUsage };
+export {
+  tunnel_accounting_default as default,
+  recordProductUsage,
+  tunnelUsageMetrics
+};
+//# sourceMappingURL=tunnel-accounting.js.map

package/dist/tunnel-accounting.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/tunnel-accounting.ts"],"sourcesContent":["import { recordUsageCounters, type CounterEvent, type UsageDatabase } from \"./usage-writer\";\nexport const tunnelUsageMetrics = [\n  \"tunnels.opens.http\", \"tunnels.opens.tcp\", \"tunnels.opens.udp\",\n  \"tunnels.registrations.http\", \"tunnels.registrations.tcp\", \"tunnels.registrations.udp\",\n  \"tunnels.http_requests\", \"tunnels.tcp_connections\", \"tunnels.udp_datagrams.in\", \"tunnels.udp_datagrams.out\",\n  \"tunnels.bytes.http.in\", \"tunnels.bytes.http.out\", \"tunnels.bytes.tcp.in\", \"tunnels.bytes.tcp.out\",\n  \"tunnels.bytes.udp.in\", \"tunnels.bytes.udp.out\",\n] as const;\nexport type UsageMetric = typeof tunnelUsageMetrics[number];\nexport type UsageEvent = CounterEvent<UsageMetric>;\nexport type { UsageDatabase };\nconst known = new Set<string>(tunnelUsageMetrics);\nexport const recordProductUsage = (database: UsageDatabase, event: UsageEvent) => recordUsageCounters(database, event, known);\nexport default { recordProductUsage };\n"],"mappings":";;;;;AACO,IAAM,qBAAqB;AAAA,EAChC;AAAA,EAAsB;AAAA,EAAqB;AAAA,EAC3C;AAAA,EAA8B;AAAA,EAA6B;AAAA,EAC3D;AAAA,EAAyB;AAAA,EAA2B;AAAA,EAA4B;AAAA,EAChF;AAAA,EAAyB;AAAA,EAA0B;AAAA,EAAwB;AAAA,EAC3E;AAAA,EAAwB;AAC1B;AAIA,IAAM,QAAQ,IAAI,IAAY,kBAAkB;AACzC,IAAM,qBAAqB,CAAC,UAAyB,UAAsB,oBAAoB,UAAU,OAAO,KAAK;AAC5H,IAAO,4BAAQ,EAAE,mBAAmB;","names":[]}