@oxy.so/telemetry 1.1.1 → 2.0.0

package/src/collector.ts

@@ -21,11 +21,34 @@ export interface TrafficAggregate extends TrafficFlow {
 }
 
 const TYPES: Record<string, TrafficType> = {
-  auth: 'identity', session: 'identity', users: 'identity', profiles: 'identity', accounts: 'identity',
-  ai: 'ai', inference: 'ai', models: 'ai', chat: 'ai', completions: 'ai',
-  stream: 'media', tracks: 'media', episodes: 'media', recordings: 'media', rooms: 'media',
-  messages: 'communication', notifications: 'communication', mail: 'communication',
-  media: 'media', files: 'media', assets: 'media', upload: 'media', uploads: 'media', cdn: 'media', storage: 'media', images: 'media', audio: 'media', videos: 'media',
+  auth: 'identity',
+  session: 'identity',
+  users: 'identity',
+  profiles: 'identity',
+  accounts: 'identity',
+  ai: 'ai',
+  inference: 'ai',
+  models: 'ai',
+  chat: 'ai',
+  completions: 'ai',
+  stream: 'media',
+  tracks: 'media',
+  episodes: 'media',
+  recordings: 'media',
+  rooms: 'media',
+  messages: 'communication',
+  notifications: 'communication',
+  mail: 'communication',
+  media: 'media',
+  files: 'media',
+  assets: 'media',
+  upload: 'media',
+  uploads: 'media',
+  cdn: 'media',
+  storage: 'media',
+  images: 'media',
+  audio: 'media',
+  videos: 'media',
 };
 export function trafficType(path: string): TrafficType {
   const parts = path.split('?')[0].split('/').filter(Boolean);
@@ -35,7 +58,10 @@ export function trafficType(path: string): TrafficType {
   return TYPES[parts[0] ?? ''] ?? 'platform';
 }
 
-export function createTrafficCollector(publish: (events: TrafficAggregate[]) => Promise<unknown>, now = Date.now) {
+export function createTrafficCollector(
+  publish: (events: TrafficAggregate[]) => Promise<unknown>,
+  now = Date.now,
+) {
   const pending = new Map<string, { flow: TrafficFlow; requests: number; startedAt: number }>();
   let flushing: Promise<void> | null = null;
   return {
@@ -49,12 +75,22 @@ export function createTrafficCollector(publish: (events: TrafficAggregate[]) =>
       while (flushing) await flushing;
       if (pending.size === 0) return;
       const emittedAt = new Date(now()).toISOString();
-      const events = [...pending.values()].map(({ flow, requests, startedAt }) => ({ ...flow, requests, windowStartedAt: new Date(startedAt).toISOString(), emittedAt }));
+      const events = [...pending.values()].map(({ flow, requests, startedAt }) => ({
+        ...flow,
+        requests,
+        windowStartedAt: new Date(startedAt).toISOString(),
+        emittedAt,
+      }));
       pending.clear();
       flushing = (async () => {
-        for (let offset = 0; offset < events.length; offset += 256) await publish(events.slice(offset, offset + 256));
+        for (let offset = 0; offset < events.length; offset += 256)
+          await publish(events.slice(offset, offset + 256));
       })();
-      try { await flushing; } finally { flushing = null; }
+      try {
+        await flushing;
+      } finally {
+        flushing = null;
+      }
     },
   };
 }
@@ -65,7 +101,10 @@ interface HttpRequest {
   url?: string;
   serviceApp?: { appName?: string };
 }
-interface HttpResponse { once(event: string, listener: () => void): unknown; setHeader?(name: string, value: string): unknown }
+interface HttpResponse {
+  once(event: string, listener: () => void): unknown;
+  setHeader?(name: string, value: string): unknown;
+}
 
 export function trafficMiddleware(
   collector: Pick<ReturnType<typeof createTrafficCollector>, 'record'>,
@@ -76,24 +115,58 @@ export function trafficMiddleware(
     response.setHeader?.('X-Oxy-Region', region);
     const path = request.path ?? request.url ?? '/';
     // Never report collection itself, probes or the dashboard transport.
-    if (/^\/(?:api\/)?(?:health|ready|live|platform-stats|platform-activity|platform-infrastructure|infra-status)(?:\/|$)/.test(path) || path.startsWith('/internal/activity') || path.startsWith('/auth/service-token') || path.startsWith('/cdn-cgi/')) { next(); return; }
+    if (
+      /^\/(?:api\/)?(?:health|ready|live|platform-stats|platform-activity|platform-infrastructure|infra-status)(?:\/|$)/.test(
+        path,
+      ) ||
+      path.startsWith('/internal/activity') ||
+      path.startsWith('/auth/service-token') ||
+      path.startsWith('/cdn-cgi/')
+    ) {
+      next();
+      return;
+    }
     const { edgePop } = metadataFromHeaders(request.headers);
     const activityType = trafficType(path);
     let finished = false;
     const inboundFlow = (): TrafficFlow => {
       // Read service identity AFTER the route's shared auth middleware resolved it.
-      const name = request.serviceApp?.appName?.toLowerCase().replace(/[^a-z0-9-]/g, '-').slice(0, 40);
+      const name = request.serviceApp?.appName
+        ?.toLowerCase()
+        .replace(/[^a-z0-9-]/g, '-')
+        .slice(0, 40);
       const internal = Boolean(name);
       const forwardedRegion = request.headers['x-oxy-source-region'];
-      const peerRegion = internal ? normalizeInfrastructureRegion(forwardedRegion) : edgePop ? `edge-${edgePop}` : undefined;
-      return { region, service, activityType, scope: internal ? 'internal' : 'external', direction: 'inbound', sourceRegion: peerRegion, targetRegion: region, sourceService: name, targetService: service };
+      const peerRegion = internal
+        ? normalizeInfrastructureRegion(forwardedRegion)
+        : edgePop
+          ? `edge-${edgePop}`
+          : undefined;
+      return {
+        region,
+        service,
+        activityType,
+        scope: internal ? 'internal' : 'external',
+        direction: 'inbound',
+        sourceRegion: peerRegion,
+        targetRegion: region,
+        sourceService: name,
+        targetService: service,
+      };
     };
     const finish = () => {
       if (finished) return;
       finished = true;
       const flow = inboundFlow();
       collector.record(flow);
-      collector.record({ ...flow, direction: 'outbound', sourceRegion: region, targetRegion: flow.sourceRegion, sourceService: service, targetService: flow.sourceService });
+      collector.record({
+        ...flow,
+        direction: 'outbound',
+        sourceRegion: region,
+        targetRegion: flow.sourceRegion,
+        sourceService: service,
+        targetService: flow.sourceService,
+      });
     };
     response.once('finish', finish);
     // Failed/aborted requests are still real inbound activity. Do not invent a
@@ -107,7 +180,10 @@ export function trafficMiddleware(
   };
 }
 
-export interface ServiceEndpoint { service: string; region: string }
+export interface ServiceEndpoint {
+  service: string;
+  region: string;
+}
 export function instrumentTrafficFetch(
   fetcher: typeof fetch,
   collector: Pick<ReturnType<typeof createTrafficCollector>, 'record'>,
@@ -116,23 +192,51 @@ export function instrumentTrafficFetch(
   resolveEndpoint: (url: URL) => ServiceEndpoint | undefined,
 ): typeof fetch {
   return Object.assign(async (input: RequestInfo | URL, init?: RequestInit) => {
-    const url = new URL(typeof input === 'string' ? input : input instanceof URL ? input.href : input.url);
+    const url = new URL(
+      typeof input === 'string' ? input : input instanceof URL ? input.href : input.url,
+    );
     // Collection/auth control traffic cannot generate a feedback loop.
-    if (url.pathname.startsWith('/internal/activity') || url.pathname.startsWith('/auth/service-token') || url.pathname === '/platform-infrastructure') return fetcher(input, init);
+    if (
+      url.pathname.startsWith('/internal/activity') ||
+      url.pathname.startsWith('/auth/service-token') ||
+      url.pathname === '/platform-infrastructure'
+    )
+      return fetcher(input, init);
     const peer = resolveEndpoint(url);
     const flow: TrafficFlow = {
-      service, region, scope: peer ? 'internal' : 'external', direction: 'outbound',
-      activityType: trafficType(url.pathname), sourceRegion: region, targetRegion: peer?.region,
-      sourceService: service, targetService: peer?.service,
+      service,
+      region,
+      scope: peer ? 'internal' : 'external',
+      direction: 'outbound',
+      activityType: trafficType(url.pathname),
+      sourceRegion: region,
+      targetRegion: peer?.region,
+      sourceService: service,
+      targetService: peer?.service,
     };
-    const headers = new Headers(init?.headers ?? (input instanceof Request ? input.headers : undefined));
+    const headers = new Headers(
+      init?.headers ?? (input instanceof Request ? input.headers : undefined),
+    );
     if (peer) headers.set('X-Oxy-Source-Region', region);
     let response: Response;
-    try { response = await fetcher(input, { ...init, headers }); }
-    catch (error) { collector.record({ ...flow, targetRegion: undefined }); throw error; }
-    const targetRegion = peer ? normalizeInfrastructureRegion(response.headers.get('X-Oxy-Region') ?? undefined) : undefined;
+    try {
+      response = await fetcher(input, { ...init, headers });
+    } catch (error) {
+      collector.record({ ...flow, targetRegion: undefined });
+      throw error;
+    }
+    const targetRegion = peer
+      ? normalizeInfrastructureRegion(response.headers.get('X-Oxy-Region') ?? undefined)
+      : undefined;
     collector.record({ ...flow, targetRegion });
-    collector.record({ ...flow, direction: 'inbound', sourceRegion: targetRegion, targetRegion: region, sourceService: peer?.service, targetService: service });
+    collector.record({
+      ...flow,
+      direction: 'inbound',
+      sourceRegion: targetRegion,
+      targetRegion: region,
+      sourceService: peer?.service,
+      targetService: service,
+    });
     return response;
   }, fetcher) as typeof fetch;
 }
@@ -140,14 +244,25 @@ export function instrumentTrafficFetch(
 // Exact deployed API hosts; an arbitrary caller-supplied hostname cannot claim
 // to be an internal service. Region is infrastructure metadata, never IP geo.
 const OXY_API_SERVICES: Record<string, string> = {
-  'api.oxy.so': 'oxy-api', 'api.website.oxy.so': 'website',
-  'website-api.oxy.so': 'website', 'api.mention.earth': 'mention',
-  'api.mercaria.co': 'mercaria', 'api.alia.onl': 'alia', 'kaana.ai': 'kaana',
-  'api.homiio.com': 'homiio', 'api.syra.fm': 'syra',
-  'mention.earth': 'mention', 'mcp.mention.earth': 'mention-mcp',
-  'api.clarity.surf': 'clarity', 'api.peable.to': 'peable',
-  'api.crowdsource.oxy.so': 'crowdsource', 'api.moovo.now': 'moovo',
-  'api.allo.you': 'allo', 'api.noted.oxy.so': 'noted', 'api.schedio.app': 'schedio', 'api.tnp.network': 'tnp-api',
+  'api.oxy.so': 'oxy-api',
+  'api.website.oxy.so': 'website',
+  'website-api.oxy.so': 'website',
+  'api.mention.earth': 'mention',
+  'api.mercaria.co': 'mercaria',
+  'api.alia.onl': 'alia',
+  'kaana.ai': 'kaana',
+  'api.homiio.com': 'homiio',
+  'api.syra.fm': 'syra',
+  'mention.earth': 'mention',
+  'mcp.mention.earth': 'mention-mcp',
+  'api.clarity.surf': 'clarity',
+  'api.peable.to': 'peable',
+  'api.crowdsource.oxy.so': 'crowdsource',
+  'api.moovo.now': 'moovo',
+  'api.allo.you': 'allo',
+  'api.noted.oxy.so': 'noted',
+  'api.schedio.app': 'schedio',
+  'api.tnp.network': 'tnp-api',
 };
 export function resolveOxyServiceEndpoint(url: URL): ServiceEndpoint | undefined {
   const service = OXY_API_SERVICES[url.hostname];
@@ -185,7 +300,9 @@ const REGION_LOCATIONS: Record<string, { label: string; coordinates: [number, nu
   'me-central-1': { label: 'UAE', coordinates: [54.37, 24.45] },
   'il-central-1': { label: 'Tel Aviv', coordinates: [34.78, 32.09] },
 };
-export function infrastructureLocation(region: string) { return REGION_LOCATIONS[region]; }
+export function infrastructureLocation(region: string) {
+  return REGION_LOCATIONS[region];
+}
 
 export function normalizeInfrastructureRegion(value: unknown): string | undefined {
   return typeof value === 'string' && /^[a-z]{2}(?:-[a-z]+)+-\d$/.test(value) ? value : undefined;

package/src/server.ts

@@ -24,7 +24,9 @@ function firstHeaderValue(value: TelemetryHeaderValue): string | undefined {
 }
 
 export function normalizeEdgePop(value: TelemetryHeaderValue): string | undefined {
-  return firstHeaderValue(value)?.match(/^[a-z]{3}$/i)?.[0]?.toLowerCase();
+  return firstHeaderValue(value)
+    ?.match(/^[a-z]{3}$/i)?.[0]
+    ?.toLowerCase();
 }
 
 export function normalizeActivityId(value: TelemetryHeaderValue): string | undefined {
@@ -59,7 +61,11 @@ export function presenceBucket(observedAt: number, bucketMs = DEFAULT_PRESENCE_B
   return Math.floor(observedAt / bucketMs);
 }
 
-export function presenceKeys(sourceRegion: string, observedAt: number, bucketMs = DEFAULT_PRESENCE_BUCKET_MS): readonly [string, string] {
+export function presenceKeys(
+  sourceRegion: string,
+  observedAt: number,
+  bucketMs = DEFAULT_PRESENCE_BUCKET_MS,
+): readonly [string, string] {
   const current = presenceBucket(observedAt, bucketMs);
   return [
     `platform-activity:clients:${sourceRegion}:${current}`,

package/src/socket.ts

@@ -13,11 +13,26 @@ export interface TrafficSocket {
 }
 
 const CATEGORIES: Record<string, TrafficType> = {
-  auth: 'identity', session: 'identity', user: 'identity', profile: 'identity',
-  chat: 'ai', agent: 'ai', inference: 'ai', completion: 'ai',
-  message: 'communication', notification: 'communication', typing: 'communication',
-  media: 'media', audio: 'media', video: 'media', stream: 'media', player: 'media',
-  track: 'media', playback: 'media', playlist: 'media', room: 'media',
+  auth: 'identity',
+  session: 'identity',
+  user: 'identity',
+  profile: 'identity',
+  chat: 'ai',
+  agent: 'ai',
+  inference: 'ai',
+  completion: 'ai',
+  message: 'communication',
+  notification: 'communication',
+  typing: 'communication',
+  media: 'media',
+  audio: 'media',
+  video: 'media',
+  stream: 'media',
+  player: 'media',
+  track: 'media',
+  playback: 'media',
+  playlist: 'media',
+  room: 'media',
 };
 
 /** Event names are reduced locally to five categories; payloads are never read. */
@@ -43,11 +58,19 @@ export function observeTrafficSocket(
   const record = (event: string, direction: 'inbound' | 'outbound') => {
     if (stopped) return;
     const peer = options.getPeer?.();
-    const peerService = peer && /^[a-z][a-z0-9-]{0,39}$/.test(peer.service) ? peer.service : undefined;
+    const peerService =
+      peer && /^[a-z][a-z0-9-]{0,39}$/.test(peer.service) ? peer.service : undefined;
     const edgePop = metadataFromHeaders(socket.handshake.headers).edgePop;
-    const peerRegion = peerService ? normalizeInfrastructureRegion(peer?.region) : edgePop ? `edge-${edgePop}` : undefined;
+    const peerRegion = peerService
+      ? normalizeInfrastructureRegion(peer?.region)
+      : edgePop
+        ? `edge-${edgePop}`
+        : undefined;
     collector.record({
-      region, service, scope: peerService ? 'internal' : 'external', direction,
+      region,
+      service,
+      scope: peerService ? 'internal' : 'external',
+      direction,
       activityType: socketTrafficType(event),
       sourceRegion: direction === 'inbound' ? peerRegion : region,
       targetRegion: direction === 'inbound' ? region : peerRegion,
@@ -74,6 +97,7 @@ export interface TrafficWebSocket {
   readonly readyState: number;
   // ws accepts data/options overloads; they are forwarded without inspecting
   // or changing them. Keep this boundary permissive for Node ws versions.
+  // biome-ignore lint/suspicious/noExplicitAny: ws overloads are forwarded unchanged; this boundary stays permissive for Node ws versions
   send(...args: any[]): unknown;
   on(event: 'message', listener: () => void): unknown;
   once(event: 'close', listener: () => void): unknown;
@@ -96,11 +120,19 @@ export function observeTrafficWebSocket(
   const record = (direction: 'inbound' | 'outbound') => {
     if (stopped) return;
     const peer = options.getPeer?.();
-    const peerService = peer && /^[a-z][a-z0-9-]{0,39}$/.test(peer.service) ? peer.service : undefined;
+    const peerService =
+      peer && /^[a-z][a-z0-9-]{0,39}$/.test(peer.service) ? peer.service : undefined;
     const edgePop = metadataFromHeaders(options.headers ?? {}).edgePop;
-    const peerRegion = peerService ? normalizeInfrastructureRegion(peer?.region) : edgePop ? `edge-${edgePop}` : undefined;
+    const peerRegion = peerService
+      ? normalizeInfrastructureRegion(peer?.region)
+      : edgePop
+        ? `edge-${edgePop}`
+        : undefined;
     collector.record({
-      service, region, scope: peerService ? 'internal' : 'external', direction,
+      service,
+      region,
+      scope: peerService ? 'internal' : 'external',
+      direction,
       activityType: options.activityType ?? 'communication',
       sourceRegion: direction === 'inbound' ? peerRegion : region,
       targetRegion: direction === 'inbound' ? region : peerRegion,

package/dist/cjs/edge.js

@@ -1,137 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.observeEdgeRequest = observeEdgeRequest;
-const collector_js_1 = require("./collector.js");
-const server_js_1 = require("./server.js");
-// Share values only: Workers prohibit I/O promises/bodies crossing request contexts.
-const tokens = new WeakMap();
-const CONTROL = /^\/(?:api\/)?(?:health|ready|live|platform-stats|platform-activity|platform-infrastructure|infra-status|internal\/activity|auth\/service-token|cdn-cgi)(?:\/|$)/;
-async function smallJson(response) {
-    if (!response.body)
-        throw new Error('Missing token response');
-    const reader = response.body.getReader();
-    const chunks = [];
-    let size = 0;
-    try {
-        for (;;) {
-            const { done, value } = await reader.read();
-            if (done)
-                break;
-            size += value.byteLength;
-            if (size > 16384) {
-                await reader.cancel();
-                throw new Error('Oversized token response');
-            }
-            chunks.push(value);
-        }
-    }
-    finally {
-        reader.releaseLock();
-    }
-    const bytes = new Uint8Array(size);
-    let offset = 0;
-    for (const chunk of chunks) {
-        bytes.set(chunk, offset);
-        offset += chunk.byteLength;
-    }
-    return JSON.parse(new TextDecoder().decode(bytes));
-}
-async function publish(options, events) {
-    const { env } = options;
-    const base = new URL(env.OXY_EDGE_ACTIVITY_API_URL ?? 'https://api.oxy.so');
-    if (base.protocol !== 'https:' || base.username || base.password || base.pathname !== '/' || base.search || base.hash)
-        throw new Error('Invalid activity origin');
-    const fetcher = options.fetcher ?? fetch;
-    const abort = new AbortController();
-    const timeout = setTimeout(() => abort.abort(), 4000);
-    try {
-        let token;
-        if (options.credential)
-            token = await Promise.race([
-                options.credential(),
-                new Promise((_, reject) => abort.signal.addEventListener('abort', () => reject(new Error('Activity credential timeout')), { once: true })),
-            ]);
-        else {
-            const key = env.OXY_EDGE_ACTIVITY_API_KEY;
-            const secret = env.OXY_EDGE_ACTIVITY_API_SECRET;
-            if (!key || !secret)
-                throw new Error('Missing edge activity credentials');
-            const cached = tokens.get(env);
-            if (cached && cached.key === key && cached.secret === secret && cached.origin === base.origin && cached.expiresAt > Date.now() + 60000)
-                token = cached.token;
-            else {
-                // Same exchange and expiry margin as OxyServices.getServiceToken().
-                const response = await fetcher(new URL('/auth/service-token', base), {
-                    method: 'POST', headers: { 'Content-Type': 'application/json' },
-                    body: JSON.stringify({ apiKey: key, apiSecret: secret }), signal: abort.signal,
-                });
-                if (!response.ok) {
-                    await response.body?.cancel();
-                    throw new Error('Activity authentication failed');
-                }
-                const data = await smallJson(response);
-                if (typeof data.token !== 'string' || !data.token || typeof data.expiresIn !== 'number' || !Number.isFinite(data.expiresIn) || data.expiresIn <= 0)
-                    throw new Error('Invalid activity token');
-                token = data.token;
-                tokens.set(env, { key, secret, origin: base.origin, token, expiresAt: Date.now() + data.expiresIn * 1000 });
-            }
-        }
-        const response = await fetcher(new URL('/internal/activity', base), {
-            method: 'POST', headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },
-            body: JSON.stringify(events), signal: abort.signal,
-        });
-        if (response.status === 401)
-            tokens.delete(env);
-        await response.body?.cancel();
-        if (!response.ok)
-            throw new Error('Activity ingestion failed');
-    }
-    finally {
-        clearTimeout(timeout);
-    }
-}
-/** Returns the original response/stream and preserves original handler errors. */
-async function observeEdgeRequest(options) {
-    const report = () => { try {
-        (options.onError ?? console.error)('Edge activity publication failed');
-    }
-    catch { /* Never break serving. */ } };
-    const enabled = options.env.OXY_EDGE_ACTIVITY_ENABLED;
-    if (enabled === undefined || enabled === 'false')
-        return options.next();
-    if (enabled !== 'true' || !/^[a-z][a-z0-9-]{0,39}$/.test(options.service)) {
-        report();
-        return options.next();
-    }
-    const path = new URL(options.request.url).pathname;
-    if (CONTROL.test(path))
-        return options.next();
-    const pop = (0, server_js_1.normalizeEdgePop)(typeof options.request.cf?.colo === 'string' ? options.request.cf.colo : undefined);
-    const region = pop ? `edge-${pop}` : 'unknown';
-    const startedAt = new Date().toISOString();
-    const complete = (response) => {
-        const contentType = response?.headers.get('Content-Type') ?? '';
-        const activityType = /^(?:image|audio|video)\//i.test(contentType) ? 'media' : (0, collector_js_1.trafficType)(path);
-        const common = { service: options.service, region, scope: options.peer ? 'internal' : 'external', activityType, requests: 1, windowStartedAt: startedAt, emittedAt: new Date().toISOString() };
-        // The serving PoP is infrastructure metadata. Do not invent visitor location.
-        const events = [{ ...common, direction: 'inbound', sourceRegion: options.peer?.region, sourceService: options.peer?.service, targetRegion: region, targetService: options.service }];
-        if (response)
-            events.push({ ...common, direction: 'outbound', sourceRegion: region, sourceService: options.service, targetRegion: options.peer?.region, targetService: options.peer?.service });
-        try {
-            options.ctx.waitUntil(publish(options, events).catch(report));
-        }
-        catch {
-            report();
-        }
-    };
-    let response;
-    try {
-        response = await options.next();
-    }
-    catch (error) {
-        complete();
-        throw error;
-    }
-    complete(response);
-    return response;
-}

package/dist/esm/edge.js

@@ -1,134 +0,0 @@
-import { trafficType } from './collector.js';
-import { normalizeEdgePop } from './server.js';
-// Share values only: Workers prohibit I/O promises/bodies crossing request contexts.
-const tokens = new WeakMap();
-const CONTROL = /^\/(?:api\/)?(?:health|ready|live|platform-stats|platform-activity|platform-infrastructure|infra-status|internal\/activity|auth\/service-token|cdn-cgi)(?:\/|$)/;
-async function smallJson(response) {
-    if (!response.body)
-        throw new Error('Missing token response');
-    const reader = response.body.getReader();
-    const chunks = [];
-    let size = 0;
-    try {
-        for (;;) {
-            const { done, value } = await reader.read();
-            if (done)
-                break;
-            size += value.byteLength;
-            if (size > 16384) {
-                await reader.cancel();
-                throw new Error('Oversized token response');
-            }
-            chunks.push(value);
-        }
-    }
-    finally {
-        reader.releaseLock();
-    }
-    const bytes = new Uint8Array(size);
-    let offset = 0;
-    for (const chunk of chunks) {
-        bytes.set(chunk, offset);
-        offset += chunk.byteLength;
-    }
-    return JSON.parse(new TextDecoder().decode(bytes));
-}
-async function publish(options, events) {
-    const { env } = options;
-    const base = new URL(env.OXY_EDGE_ACTIVITY_API_URL ?? 'https://api.oxy.so');
-    if (base.protocol !== 'https:' || base.username || base.password || base.pathname !== '/' || base.search || base.hash)
-        throw new Error('Invalid activity origin');
-    const fetcher = options.fetcher ?? fetch;
-    const abort = new AbortController();
-    const timeout = setTimeout(() => abort.abort(), 4000);
-    try {
-        let token;
-        if (options.credential)
-            token = await Promise.race([
-                options.credential(),
-                new Promise((_, reject) => abort.signal.addEventListener('abort', () => reject(new Error('Activity credential timeout')), { once: true })),
-            ]);
-        else {
-            const key = env.OXY_EDGE_ACTIVITY_API_KEY;
-            const secret = env.OXY_EDGE_ACTIVITY_API_SECRET;
-            if (!key || !secret)
-                throw new Error('Missing edge activity credentials');
-            const cached = tokens.get(env);
-            if (cached && cached.key === key && cached.secret === secret && cached.origin === base.origin && cached.expiresAt > Date.now() + 60000)
-                token = cached.token;
-            else {
-                // Same exchange and expiry margin as OxyServices.getServiceToken().
-                const response = await fetcher(new URL('/auth/service-token', base), {
-                    method: 'POST', headers: { 'Content-Type': 'application/json' },
-                    body: JSON.stringify({ apiKey: key, apiSecret: secret }), signal: abort.signal,
-                });
-                if (!response.ok) {
-                    await response.body?.cancel();
-                    throw new Error('Activity authentication failed');
-                }
-                const data = await smallJson(response);
-                if (typeof data.token !== 'string' || !data.token || typeof data.expiresIn !== 'number' || !Number.isFinite(data.expiresIn) || data.expiresIn <= 0)
-                    throw new Error('Invalid activity token');
-                token = data.token;
-                tokens.set(env, { key, secret, origin: base.origin, token, expiresAt: Date.now() + data.expiresIn * 1000 });
-            }
-        }
-        const response = await fetcher(new URL('/internal/activity', base), {
-            method: 'POST', headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },
-            body: JSON.stringify(events), signal: abort.signal,
-        });
-        if (response.status === 401)
-            tokens.delete(env);
-        await response.body?.cancel();
-        if (!response.ok)
-            throw new Error('Activity ingestion failed');
-    }
-    finally {
-        clearTimeout(timeout);
-    }
-}
-/** Returns the original response/stream and preserves original handler errors. */
-export async function observeEdgeRequest(options) {
-    const report = () => { try {
-        (options.onError ?? console.error)('Edge activity publication failed');
-    }
-    catch { /* Never break serving. */ } };
-    const enabled = options.env.OXY_EDGE_ACTIVITY_ENABLED;
-    if (enabled === undefined || enabled === 'false')
-        return options.next();
-    if (enabled !== 'true' || !/^[a-z][a-z0-9-]{0,39}$/.test(options.service)) {
-        report();
-        return options.next();
-    }
-    const path = new URL(options.request.url).pathname;
-    if (CONTROL.test(path))
-        return options.next();
-    const pop = normalizeEdgePop(typeof options.request.cf?.colo === 'string' ? options.request.cf.colo : undefined);
-    const region = pop ? `edge-${pop}` : 'unknown';
-    const startedAt = new Date().toISOString();
-    const complete = (response) => {
-        const contentType = response?.headers.get('Content-Type') ?? '';
-        const activityType = /^(?:image|audio|video)\//i.test(contentType) ? 'media' : trafficType(path);
-        const common = { service: options.service, region, scope: options.peer ? 'internal' : 'external', activityType, requests: 1, windowStartedAt: startedAt, emittedAt: new Date().toISOString() };
-        // The serving PoP is infrastructure metadata. Do not invent visitor location.
-        const events = [{ ...common, direction: 'inbound', sourceRegion: options.peer?.region, sourceService: options.peer?.service, targetRegion: region, targetService: options.service }];
-        if (response)
-            events.push({ ...common, direction: 'outbound', sourceRegion: region, sourceService: options.service, targetRegion: options.peer?.region, targetService: options.peer?.service });
-        try {
-            options.ctx.waitUntil(publish(options, events).catch(report));
-        }
-        catch {
-            report();
-        }
-    };
-    let response;
-    try {
-        response = await options.next();
-    }
-    catch (error) {
-        complete();
-        throw error;
-    }
-    complete(response);
-    return response;
-}