@scoutline-ai/middleware 0.0.0-stage → 0.2.0

package/dist/index.d.ts

@@ -0,0 +1,86 @@
+export { classify } from "./classify.js";
+/**
+ * What your app knows about a request that Scoutline can't see. Everything is
+ * optional, and only what you return here leaves your server.
+ */
+export type RequestContext = {
+    /** Your id for the piece of work, shared by the requests and outcomes in it. */
+    taskId?: string | null;
+    sessionId?: string | null;
+    /** The business object, such as a product, so its URLs count as one. */
+    resourceId?: string | null;
+    contentVersion?: string | null;
+};
+export type ScoutlineOptions = {
+    /** Ingest key. Falls back to the SCOUTLINE_KEY environment variable. */
+    key?: string;
+    /** Collector URL, for self-hosting or testing. Falls back to SCOUTLINE_ENDPOINT. */
+    endpoint?: string;
+    /** Share of unclassified traffic to send, from 0 to 1. Default 1. */
+    sampleUnknown?: number;
+    /** Skip a path entirely. Runs on the pathname only. */
+    ignore?: (pathname: string) => boolean;
+    /** Adds your own ids to a request. A failure here only leaves them out. */
+    context?: (request: Request) => RequestContext | null | undefined;
+    /**
+     * Sends the visitor's IP so the collector can find its country and network.
+     * The collector never stores it. Default true.
+     */
+    sendClientIp?: boolean;
+};
+export type Observation = {
+    /** Set by adapters that must announce the id before the response finishes. */
+    eventId?: string;
+    /** Set by adapters that can see the connection, not just the headers. */
+    clientIp?: string;
+    /** Null when the response isn't visible from this position in the stack. */
+    status?: number | null;
+    durationMs?: number | null;
+    bytes?: number | null;
+    cacheStatus?: string | null;
+};
+export type Scoutline = {
+    /**
+     * Records a request and returns its event id. Synchronous and never throws,
+     * so it can't break a site. Returns nothing if the request was skipped.
+     */
+    observe(request: Request, observation?: Observation): string | undefined;
+    /** Sends what is queued. Never rejects. Pass this to `waitUntil`. */
+    flush(): Promise<void>;
+    /**
+     * Serves the browser script and its events from the site's own domain.
+     * Returns null for every other path. Must run before any auth check.
+     */
+    handle(request: Request, clientIp?: string): Promise<Response> | null;
+};
+/** Only full page loads carry a server id for the browser script to read. */
+export declare function isDocumentRequest(request: Request): boolean;
+export declare function serverTiming(eventId: string): string;
+/** A proxy may list several hosts, nearest client first. */
+export declare function hostFromHeaders(headers: Headers): string | null;
+/** The site's hostname. */
+export declare function hostOf(request: Request): string | undefined;
+/**
+ * What the collector needs to classify a request. Only whether these headers
+ * exist is sent, never their values, and rules live there so they can change
+ * without a new release of this package.
+ */
+export declare function requestFacts(headers: Headers, options: {
+    sendClientIp?: boolean;
+    clientIp?: string;
+}): {
+    userAgent: string | undefined;
+    clientIp: string | undefined;
+    requestShape: {
+        clientHints: boolean;
+        fetchMetadata: boolean;
+        acceptLanguage: boolean;
+    };
+};
+/** The W3C trace id from `traceparent`, a claim until something validates it. */
+export declare function traceId(headers: Headers): string | undefined;
+/**
+ * Failure here must never reach the customer's site. A missing key turns the
+ * client into a no-op, and a full queue drops the oldest events.
+ */
+export declare function createScoutline(options?: ScoutlineOptions): Scoutline;

package/dist/index.js

@@ -0,0 +1,324 @@
+import { EVENTS_PATH, isSameOrigin, parseBrowserBody, SCRIPT_PATH, toBrowserEvent, } from "./browser.js";
+import { BROWSER_SCRIPT } from "./browser-script.js";
+import { classify, CLASSIFIER_VERSION } from "./classify.js";
+import { clientIpFromHeaders } from "./client-ip.js";
+import { DEFAULT_ENDPOINT, env } from "./config.js";
+export { classify } from "./classify.js";
+const MAX_QUEUED = 500;
+const MAX_BATCH = 100;
+const SEND_TIMEOUT_MS = 2000;
+const FLUSH_INTERVAL_MS = 5000;
+const HEARTBEAT_INTERVAL_MS = 5 * 60 * 1000;
+const REJECTED_BACKOFF_MS = 60 * 1000;
+const RATE_LIMITED_BACKOFF_MS = 60 * 1000;
+const MAX_FIELD_CHARS = 128;
+const MAX_URL_CHARS = 2048;
+const MAX_USER_AGENT_CHARS = 512;
+/** Caps browser events per server instance, so a page can't flood the queue. */
+const MAX_BROWSER_EVENTS_PER_MINUTE = 2000;
+const SCRIPT_CACHE_SECONDS = 3600;
+const FRAMEWORK_PATH = /^\/(?:_next|_vercel|\.well-known\/vercel)\//;
+/**
+ * A person's page load fetches these as a side effect, so they would only add
+ * noise. A crawler chooses to fetch them, and they can be most of what it costs
+ * to serve, so they stay for anyone identified. PDFs always stay.
+ */
+const ASSET_PATH = /\.(?:css|js|mjs|map|png|jpe?g|gif|webp|avif|svg|ico|woff2?|ttf|otf|mp4|m4v|webm|mov|ogv|mp3|m4a|aac|flac|wav|ogg|opus)$/i;
+/** Only full page loads carry a server id for the browser script to read. */
+export function isDocumentRequest(request) {
+    return (request.method === "GET" &&
+        request.headers.get("accept")?.includes("text/html") === true &&
+        !isPrefetch(request.headers));
+}
+export function serverTiming(eventId) {
+    return `scoutline;desc="${eventId}"`;
+}
+function scriptResponse() {
+    return new Response(BROWSER_SCRIPT, {
+        headers: {
+            "Content-Type": "text/javascript; charset=utf-8",
+            "Cache-Control": `public, max-age=${SCRIPT_CACHE_SECONDS}`,
+        },
+    });
+}
+function emptyResponse(status) {
+    return new Response(null, { status });
+}
+function ownRoute(request) {
+    const { pathname } = new URL(request.url);
+    return pathname === SCRIPT_PATH || pathname === EVENTS_PATH ? pathname : null;
+}
+function limited(value, max = MAX_FIELD_CHARS) {
+    return value && value.length <= max ? value : undefined;
+}
+function interfaceFor(pathname, headers) {
+    if (pathname === "/mcp" || pathname.startsWith("/mcp/"))
+        return "tool";
+    if (pathname.startsWith("/api/"))
+        return "api";
+    return headers.get("accept")?.includes("application/json") ? "api" : "web";
+}
+/** A proxy may list several hosts, nearest client first. */
+export function hostFromHeaders(headers) {
+    const forwarded = headers.get("x-forwarded-host")?.split(",")[0];
+    return forwarded?.trim() || headers.get("host") || null;
+}
+/** The site's hostname. */
+export function hostOf(request) {
+    const host = hostFromHeaders(request.headers) ?? new URL(request.url).host;
+    return limited(host.toLowerCase(), 255);
+}
+/**
+ * What the collector needs to classify a request. Only whether these headers
+ * exist is sent, never their values, and rules live there so they can change
+ * without a new release of this package.
+ */
+export function requestFacts(headers, options) {
+    return {
+        userAgent: limited(headers.get("user-agent"), MAX_USER_AGENT_CHARS),
+        clientIp: options.sendClientIp === false
+            ? undefined
+            : (options.clientIp ?? clientIpFromHeaders(headers)),
+        requestShape: {
+            clientHints: headers.has("sec-ch-ua"),
+            fetchMetadata: headers.has("sec-fetch-mode") || headers.has("sec-fetch-site"),
+            acceptLanguage: headers.has("accept-language"),
+        },
+    };
+}
+function isPrefetch(headers) {
+    return (headers.has("next-router-prefetch") ||
+        headers.get("purpose") === "prefetch" ||
+        headers.get("sec-purpose")?.includes("prefetch") === true);
+}
+/** The W3C trace id from `traceparent`, a claim until something validates it. */
+export function traceId(headers) {
+    return limited(headers.get("traceparent")?.split("-")[1] ?? null);
+}
+function contextOf(request, read) {
+    try {
+        return read?.(request) ?? {};
+    }
+    catch {
+        return {};
+    }
+}
+function toEvent(request, observation, sampleUnknown, options) {
+    const { pathname } = new URL(request.url);
+    if (FRAMEWORK_PATH.test(pathname) || options.ignore?.(pathname))
+        return null;
+    const { headers } = request;
+    if (isPrefetch(headers))
+        return null;
+    const actor = classify(headers.get("user-agent"));
+    if (actor.class === "unknown" && ASSET_PATH.test(pathname))
+        return null;
+    const sampled = actor.class === "unknown" && sampleUnknown < 1;
+    if (sampled && Math.random() >= sampleUnknown)
+        return null;
+    const context = contextOf(request, options.context);
+    return {
+        eventId: observation.eventId ?? crypto.randomUUID(),
+        occurredAt: Date.now(),
+        family: "resource_access",
+        actor,
+        action: request.method.slice(0, 64),
+        // The pathname only: queries, cookies, headers and bodies never leave here.
+        url: pathname.slice(0, MAX_URL_CHARS),
+        host: hostOf(request),
+        ...requestFacts(headers, {
+            sendClientIp: options.sendClientIp,
+            clientIp: observation.clientIp,
+        }),
+        interface: interfaceFor(pathname, headers),
+        requestId: limited(headers.get("x-vercel-id") ??
+            headers.get("cf-ray") ??
+            headers.get("x-request-id")),
+        traceId: traceId(headers),
+        taskId: limited(context.taskId ?? null),
+        sessionId: limited(context.sessionId ?? null),
+        resourceId: limited(context.resourceId ?? null),
+        contentVersion: limited(context.contentVersion ?? null),
+        status: observation.status ?? undefined,
+        durationMs: observation.durationMs ?? undefined,
+        bytes: observation.bytes ?? undefined,
+        cacheStatus: limited(observation.cacheStatus ?? null, 32),
+        sampleRate: sampled ? sampleUnknown : 1,
+        classifierVersion: CLASSIFIER_VERSION,
+    };
+}
+/**
+ * Failure here must never reach the customer's site. A missing key turns the
+ * client into a no-op, and a full queue drops the oldest events.
+ */
+export function createScoutline(options = {}) {
+    const key = options.key ?? env("SCOUTLINE_KEY");
+    const endpoint = (options.endpoint ||
+        env("SCOUTLINE_ENDPOINT") ||
+        DEFAULT_ENDPOINT).replace(/\/+$/, "");
+    if (!key) {
+        console.warn("[scoutline] Missing SCOUTLINE_KEY, so nothing is collected.");
+        return {
+            observe: () => undefined,
+            flush: async () => { },
+            // The script tag still gets a valid answer, so pages don't log a 404.
+            handle(request) {
+                const route = ownRoute(request);
+                if (route === SCRIPT_PATH)
+                    return Promise.resolve(scriptResponse());
+                return route ? Promise.resolve(emptyResponse(204)) : null;
+            },
+        };
+    }
+    const sampleUnknown = options.sampleUnknown ?? 1;
+    let queue = [];
+    let timer;
+    let lastSentAt = 0;
+    let pausedUntil = 0;
+    let browserWindowStart = 0;
+    let browserEventsInWindow = 0;
+    async function post(events) {
+        const response = await fetch(`${endpoint}/v1/events`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${key}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ events }),
+            signal: AbortSignal.timeout(SEND_TIMEOUT_MS),
+        });
+        await response.body?.cancel();
+        return response.status;
+    }
+    async function drain() {
+        while (queue.length > 0 && Date.now() >= pausedUntil) {
+            const batch = queue.slice(0, MAX_BATCH);
+            queue = queue.slice(batch.length);
+            let status;
+            try {
+                status = await post(batch);
+            }
+            catch {
+                status = undefined;
+            }
+            if (status === 401) {
+                // Retrying can't fix a bad key, so don't spend the site's time on it.
+                console.warn("[scoutline] The collector refused this key.");
+                pausedUntil = Date.now() + REJECTED_BACKOFF_MS;
+                return;
+            }
+            if (status === 429) {
+                // The collector asked us to slow down, so hold these and try later.
+                pausedUntil = Date.now() + RATE_LIMITED_BACKOFF_MS;
+                queue = [...batch, ...queue].slice(-MAX_QUEUED);
+                return;
+            }
+            if (status === undefined || status >= 500) {
+                // Event ids are stable, so a repeat of a partial send dedupes downstream.
+                queue = [...batch, ...queue].slice(-MAX_QUEUED);
+                return;
+            }
+            lastSentAt = Date.now();
+        }
+    }
+    /** A quiet site isn't a broken collector. An empty batch says so. */
+    async function heartbeat() {
+        if (Date.now() - lastSentAt < HEARTBEAT_INTERVAL_MS)
+            return;
+        if (Date.now() < pausedUntil)
+            return;
+        lastSentAt = Date.now();
+        await post([]).catch(() => { });
+    }
+    /**
+     * Each call drains by itself rather than sharing one in-flight promise,
+     * because Cloudflare doesn't let a request wait on another request's work.
+     * The queue hands each batch out once, so overlapping calls are safe.
+     */
+    function flush() {
+        return drain()
+            .then(heartbeat)
+            .catch(() => { });
+    }
+    function enqueue(event) {
+        queue.push(event);
+        if (queue.length > MAX_QUEUED)
+            queue = queue.slice(-MAX_QUEUED);
+        // Keeps long-running servers sending. Serverless flushes via waitUntil.
+        if (!timer) {
+            timer = setTimeout(() => {
+                timer = undefined;
+                void flush();
+            }, FLUSH_INTERVAL_MS);
+            timer.unref?.();
+        }
+    }
+    function observe(request, observation = {}) {
+        try {
+            const event = toEvent(request, observation, sampleUnknown, options);
+            if (!event)
+                return undefined;
+            enqueue(event);
+            return event.eventId;
+        }
+        catch {
+            // Observation is optional. The customer's request is not.
+            return undefined;
+        }
+    }
+    function withinBrowserLimit(count) {
+        const now = Date.now();
+        if (now - browserWindowStart > 60 * 1000) {
+            browserWindowStart = now;
+            browserEventsInWindow = 0;
+        }
+        browserEventsInWindow += count;
+        return browserEventsInWindow <= MAX_BROWSER_EVENTS_PER_MINUTE;
+    }
+    /** The class comes from the server's view. A page may only make it weaker. */
+    function browserActor(request, automated) {
+        const actor = classify(request.headers.get("user-agent"));
+        if (actor.class === "unknown" && automated) {
+            return { class: "inferred", mode: "browser" };
+        }
+        return actor;
+    }
+    async function acceptBrowserEvents(request, clientIp) {
+        try {
+            if (request.method !== "POST")
+                return emptyResponse(405);
+            if (!isSameOrigin(request.headers))
+                return emptyResponse(403);
+            const body = parseBrowserBody(await request.text());
+            if (!body)
+                return emptyResponse(400);
+            if (!withinBrowserLimit(body.events.length))
+                return emptyResponse(204);
+            const actor = browserActor(request, body.automated);
+            const sampled = actor.class === "unknown" && sampleUnknown < 1;
+            if (sampled && Math.random() >= sampleUnknown)
+                return emptyResponse(204);
+            const now = Date.now();
+            const facts = requestFacts(request.headers, {
+                sendClientIp: options.sendClientIp,
+                clientIp,
+            });
+            for (const raw of body.events) {
+                const event = toBrowserEvent(raw, actor, now, sampled ? sampleUnknown : 1);
+                if (event)
+                    enqueue({ ...event, ...facts, host: hostOf(request) });
+            }
+            return emptyResponse(204);
+        }
+        catch {
+            return emptyResponse(204);
+        }
+    }
+    function handle(request, clientIp) {
+        const route = ownRoute(request);
+        if (route === SCRIPT_PATH)
+            return Promise.resolve(scriptResponse());
+        return route ? acceptBrowserEvents(request, clientIp) : null;
+    }
+    return { observe, flush, handle };
+}

package/dist/next.d.ts

@@ -0,0 +1,20 @@
+import { type ScoutlineOptions } from "./index.js";
+type WaitUntil = {
+    waitUntil(promise: Promise<unknown>): void;
+};
+type Proxy<Req extends Request, Event extends WaitUntil> = (request: Req, event: Event) => Response | null | undefined | void | Promise<Response | null | undefined | void>;
+/**
+ * Wraps a Next.js `proxy.ts`. It adds no latency, because sending happens in
+ * `waitUntil` after the response is on its way.
+ *
+ * A proxy runs before the page renders, so a pass-through has no status or
+ * duration to report. Those stay empty rather than guessed. A status is only
+ * recorded when the proxy itself answered, such as a redirect or a 401.
+ *
+ *   export default withScoutline(clerkMiddleware());
+ *
+ * It also serves the browser script and its events on the site's own domain,
+ * ahead of the wrapped proxy, so a signed-out page can still report.
+ */
+export declare function withScoutline<Req extends Request, Event extends WaitUntil>(proxy?: Proxy<Req, Event>, options?: ScoutlineOptions): (request: Req, event: Event) => Promise<void | Response | null>;
+export {};

package/dist/next.js

@@ -0,0 +1,58 @@
+import { createScoutline, isDocumentRequest, serverTiming, } from "./index.js";
+/**
+ * Wraps a Next.js `proxy.ts`. It adds no latency, because sending happens in
+ * `waitUntil` after the response is on its way.
+ *
+ * A proxy runs before the page renders, so a pass-through has no status or
+ * duration to report. Those stay empty rather than guessed. A status is only
+ * recorded when the proxy itself answered, such as a redirect or a 401.
+ *
+ *   export default withScoutline(clerkMiddleware());
+ *
+ * It also serves the browser script and its events on the site's own domain,
+ * ahead of the wrapped proxy, so a signed-out page can still report.
+ */
+export function withScoutline(proxy, options) {
+    const scoutline = createScoutline(options);
+    return async function scoutlineProxy(request, event) {
+        // Before the wrapped proxy, so an auth check can't block the page's events.
+        const own = scoutline.handle(request);
+        if (own) {
+            const answer = await own;
+            event.waitUntil(scoutline.flush());
+            return answer;
+        }
+        let response;
+        try {
+            response = await proxy?.(request, event);
+        }
+        catch (error) {
+            scoutline.observe(request);
+            event.waitUntil(scoutline.flush());
+            throw error;
+        }
+        const answered = response instanceof Response &&
+            !response.headers.has("x-middleware-next") &&
+            !response.headers.has("x-middleware-rewrite");
+        const eventId = scoutline.observe(request, answered ? { status: response.status } : {});
+        event.waitUntil(scoutline.flush());
+        if (!eventId || answered || !isDocumentRequest(request))
+            return response;
+        return withServerId(response, eventId);
+    };
+}
+/**
+ * Hands the page its server event id, so the browser script can link to this
+ * request without a cookie. `x-middleware-next` is what `NextResponse.next()`
+ * sets, so a proxy with nothing to return can still pass the header on.
+ */
+function withServerId(response, id) {
+    try {
+        const target = response ?? new Response(null, { headers: { "x-middleware-next": "1" } });
+        target.headers.append("Server-Timing", serverTiming(id));
+        return target;
+    }
+    catch {
+        return response;
+    }
+}

package/dist/node.d.ts

@@ -0,0 +1,26 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { type ScoutlineOptions } from "./index.js";
+/**
+ * Express middleware. Add it before your routes and body parsers.
+ *
+ *   app.use(scoutlineExpress());
+ */
+export declare function scoutlineExpress(options?: ScoutlineOptions): (request: IncomingMessage, response: ServerResponse, next: (error?: unknown) => void) => void;
+type FastifyLike = {
+    addHook(name: "onRequest", hook: (request: {
+        raw: IncomingMessage;
+    }, reply: {
+        raw: ServerResponse;
+        hijack(): void;
+    }, done: () => void) => void): void;
+};
+/**
+ * Fastify plugin. `skip-override` applies it to the whole app rather than only
+ * the plugin's own scope, the same thing `fastify-plugin` does.
+ *
+ *   app.register(scoutlineFastify);
+ */
+export declare const scoutlineFastify: ((app: FastifyLike, options?: ScoutlineOptions) => Promise<void>) & {
+    [x: symbol]: boolean;
+};
+export {};

package/dist/node.js

@@ -0,0 +1,129 @@
+import { EVENTS_PATH, SCRIPT_PATH } from "./browser.js";
+import { usableIp } from "./client-ip.js";
+import { createScoutline, isDocumentRequest, serverTiming, } from "./index.js";
+const MAX_BODY_BYTES = 32 * 1024;
+function toRequest(request, body) {
+    const headers = new Headers();
+    for (const [name, value] of Object.entries(request.headers)) {
+        if (value !== undefined) {
+            headers.set(name, Array.isArray(value) ? value.join(", ") : value);
+        }
+    }
+    const host = headers.get("host") ?? "localhost";
+    const path = request.originalUrl ?? request.url ?? "/";
+    return new Request(`http://${host}${path}`, {
+        method: request.method,
+        headers,
+        body,
+    });
+}
+/**
+ * A public peer is the visitor, and can't fake that the way it can fake a
+ * header. A private one is a proxy, so its headers are used instead.
+ */
+function connectionIp(request) {
+    return usableIp(request.socket?.remoteAddress);
+}
+/** A body parser may have run first, and a stream can only be read once. */
+async function readBody(request) {
+    if (typeof request.body === "string")
+        return request.body;
+    if (request.body !== undefined)
+        return JSON.stringify(request.body);
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of request) {
+        size += chunk.length;
+        if (size > MAX_BODY_BYTES)
+            break;
+        chunks.push(chunk);
+    }
+    return Buffer.concat(chunks).toString("utf8");
+}
+async function serveOwnRoute(scoutline, request, response) {
+    const body = request.method === "POST" ? await readBody(request) : undefined;
+    const answer = await scoutline.handle(toRequest(request, body), connectionIp(request));
+    const text = (await answer?.text()) ?? "";
+    response.writeHead(answer?.status ?? 204, Object.fromEntries(answer?.headers ?? []));
+    response.end(text);
+    void scoutline.flush();
+}
+function contentLength(response) {
+    const value = Number(response.getHeader("content-length"));
+    return Number.isFinite(value) && value > 0 ? value : null;
+}
+/**
+ * Records the request once the response has finished, so status and duration
+ * are real. A client that hangs up early never got a status, so none is sent.
+ * The event id goes out first, because headers can't change after that.
+ */
+function track(scoutline, request, response) {
+    const started = Date.now();
+    const web = toRequest(request);
+    const eventId = crypto.randomUUID();
+    if (isDocumentRequest(web)) {
+        response.appendHeader("Server-Timing", serverTiming(eventId));
+    }
+    let done = false;
+    const finish = (completed) => {
+        if (done)
+            return;
+        done = true;
+        scoutline.observe(web, {
+            eventId,
+            clientIp: connectionIp(request),
+            status: completed ? response.statusCode : null,
+            bytes: completed ? contentLength(response) : null,
+            durationMs: Date.now() - started,
+        });
+    };
+    response.once("finish", () => finish(true));
+    response.once("close", () => finish(false));
+}
+/** Returns true when the request was one of Scoutline's own routes. */
+function handleRequest(scoutline, request, response) {
+    const path = (request.originalUrl ?? request.url ?? "/").split("?")[0];
+    if (path === SCRIPT_PATH || path === EVENTS_PATH) {
+        serveOwnRoute(scoutline, request, response).catch(() => {
+            if (!response.headersSent)
+                response.writeHead(204);
+            response.end();
+        });
+        return true;
+    }
+    try {
+        track(scoutline, request, response);
+    }
+    catch {
+        // Observation is optional. The customer's request is not.
+    }
+    return false;
+}
+/**
+ * Express middleware. Add it before your routes and body parsers.
+ *
+ *   app.use(scoutlineExpress());
+ */
+export function scoutlineExpress(options) {
+    const scoutline = createScoutline(options);
+    return function scoutlineMiddleware(request, response, next) {
+        if (!handleRequest(scoutline, request, response))
+            next();
+    };
+}
+/**
+ * Fastify plugin. `skip-override` applies it to the whole app rather than only
+ * the plugin's own scope, the same thing `fastify-plugin` does.
+ *
+ *   app.register(scoutlineFastify);
+ */
+export const scoutlineFastify = Object.assign(async function scoutlinePlugin(app, options) {
+    const scoutline = createScoutline(options);
+    app.addHook("onRequest", (request, reply, done) => {
+        const path = (request.raw.url ?? "/").split("?")[0];
+        if (path === SCRIPT_PATH || path === EVENTS_PATH)
+            reply.hijack();
+        if (!handleRequest(scoutline, request.raw, reply.raw))
+            done();
+    });
+}, { [Symbol.for("skip-override")]: true });