aweshare 0.2.0

package/apps/hub/dist/meter.js

@@ -0,0 +1,135 @@
+/**
+ * Best-effort usage extraction from a response stream, on a side channel.
+ * Never throws, never blocks the relay; failures simply yield null counts.
+ * No content is retained beyond the bytes needed to read token counts.
+ */
+export class UsageExtractor {
+    protocol;
+    text = '';
+    promptTokens = null;
+    completionTokens = null;
+    isSse;
+    done = false;
+    constructor(protocol, contentType) {
+        this.protocol = protocol;
+        this.isSse = (contentType ?? '').includes('text/event-stream');
+    }
+    get streaming() {
+        return this.isSse;
+    }
+    onChunk(bytes) {
+        if (this.done)
+            return;
+        if (!this.isSse) {
+            // whole-body JSON: keep up to 4MB, parse once at finish
+            if (this.text.length < 4 * 1024 * 1024)
+                this.text += Buffer.from(bytes).toString('utf8');
+            return;
+        }
+        this.text += Buffer.from(bytes).toString('utf8');
+        // process complete SSE events, keep the partial tail
+        const boundary = this.text.lastIndexOf('\n\n');
+        if (boundary === -1)
+            return;
+        const complete = this.text.slice(0, boundary + 2);
+        this.text = this.text.slice(boundary + 2);
+        for (const event of complete.split('\n\n'))
+            this.consumeSseEvent(event);
+    }
+    finish() {
+        if (this.done)
+            return this.result();
+        this.done = true;
+        if (this.isSse && this.text.trim())
+            this.consumeSseEvent(this.text);
+        if (!this.isSse) {
+            try {
+                const json = JSON.parse(this.text);
+                this.consumeUsage(json);
+            }
+            catch {
+                // malformed or truncated body: counts stay null
+            }
+        }
+        return this.result();
+    }
+    consumeSseEvent(event) {
+        const data = event
+            .split('\n')
+            .filter((line) => line.startsWith('data:'))
+            .map((line) => line.slice(5).trim())
+            .join('');
+        if (!data || data === '[DONE]')
+            return;
+        try {
+            const json = JSON.parse(data);
+            this.consumeUsage(json);
+        }
+        catch {
+            // non-JSON data lines are ignored
+        }
+    }
+    consumeUsage(json) {
+        if (this.protocol === 'openai') {
+            const usage = json.usage;
+            if (usage && typeof usage === 'object') {
+                if (typeof usage.prompt_tokens === 'number')
+                    this.promptTokens = usage.prompt_tokens;
+                if (typeof usage.completion_tokens === 'number') {
+                    this.completionTokens = usage.completion_tokens;
+                }
+            }
+            return;
+        }
+        if (this.protocol === 'responses') {
+            // streaming: usage rides on the response.completed event
+            if (json.type === 'response.completed') {
+                const response = json.response;
+                const usage = response?.usage;
+                if (typeof usage?.input_tokens === 'number')
+                    this.promptTokens = usage.input_tokens;
+                if (typeof usage?.output_tokens === 'number') {
+                    this.completionTokens = usage.output_tokens;
+                }
+            }
+            // non-streaming message body
+            const usage = json.usage;
+            if (usage && typeof usage === 'object') {
+                if (typeof usage.input_tokens === 'number')
+                    this.promptTokens = usage.input_tokens;
+                if (typeof usage.output_tokens === 'number')
+                    this.completionTokens = usage.output_tokens;
+            }
+            return;
+        }
+        // anthropic: message_start carries input_tokens, message_delta carries output_tokens
+        if (json.type === 'message_start') {
+            const message = json.message;
+            const usage = message?.usage;
+            if (typeof usage?.input_tokens === 'number')
+                this.promptTokens = usage.input_tokens;
+        }
+        if (json.type === 'message_delta') {
+            const usage = json.usage;
+            if (typeof usage?.output_tokens === 'number') {
+                this.completionTokens = usage.output_tokens;
+            }
+        }
+        // non-streaming message body
+        const usage = json.usage;
+        if (usage && typeof usage === 'object') {
+            if (typeof usage.input_tokens === 'number' && this.promptTokens === null) {
+                this.promptTokens = usage.input_tokens;
+            }
+            if (typeof usage.output_tokens === 'number' && this.completionTokens === null) {
+                this.completionTokens = usage.output_tokens;
+            }
+        }
+    }
+    result() {
+        if (this.promptTokens === null && this.completionTokens === null)
+            return null;
+        return { promptTokens: this.promptTokens, completionTokens: this.completionTokens };
+    }
+}
+//# sourceMappingURL=meter.js.map

package/apps/hub/dist/meter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"meter.js","sourceRoot":"","sources":["../src/meter.ts"],"names":[],"mappings":"AAOA;;;;GAIG;AACH,MAAM,OAAO,cAAc;IAQN;IAPX,IAAI,GAAG,EAAE,CAAA;IACT,YAAY,GAAkB,IAAI,CAAA;IAClC,gBAAgB,GAAkB,IAAI,CAAA;IAC7B,KAAK,CAAS;IACvB,IAAI,GAAG,KAAK,CAAA;IAEpB,YACmB,QAAkB,EACnC,WAA+B;QADd,aAAQ,GAAR,QAAQ,CAAU;QAGnC,IAAI,CAAC,KAAK,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAA;IAChE,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,KAAK,CAAA;IACnB,CAAC;IAED,OAAO,CAAC,KAAiB;QACvB,IAAI,IAAI,CAAC,IAAI;YAAE,OAAM;QACrB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,wDAAwD;YACxD,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI;gBAAE,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YACxF,OAAM;QACR,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAChD,qDAAqD;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QAC9C,IAAI,QAAQ,KAAK,CAAC,CAAC;YAAE,OAAM;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAA;QACjD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAA;QACzC,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;IACzE,CAAC;IAED,MAAM;QACJ,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC,MAAM,EAAE,CAAA;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACnE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAA4B,CAAA;gBAC7D,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,gDAAgD;YAClD,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,EAAE,CAAA;IACtB,CAAC;IAEO,eAAe,CAAC,KAAa;QACnC,MAAM,IAAI,GAAG,KAAK;aACf,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;aAC1C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACnC,IAAI,CAAC,EAAE,CAAC,CAAA;QACX,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAM;QACtC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAA;YACxD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,kCAAkC;QACpC,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,IAA6B;QAChD,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAA4C,CAAA;YAC/D,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACvC,IAAI,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ;oBAAE,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,aAAa,CAAA;gBACpF,IAAI,OAAO,KAAK,CAAC,iBAAiB,KAAK,QAAQ,EAAE,CAAC;oBAChD,IAAI,CAAC,gBAAgB,GAAG,KAAK,CAAC,iBAAiB,CAAA;gBACjD,CAAC;YACH,CAAC;YACD,OAAM;QACR,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;YAClC,yDAAyD;YACzD,IAAI,IAAI,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;gBACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAA+C,CAAA;gBACrE,MAAM,KAAK,GAAG,QAAQ,EAAE,KAA4C,CAAA;gBACpE,IAAI,OAAO,KAAK,EAAE,YAAY,KAAK,QAAQ;oBAAE,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAA;gBACnF,IAAI,OAAO,KAAK,EAAE,aAAa,KAAK,QAAQ,EAAE,CAAC;oBAC7C,IAAI,CAAC,gBAAgB,GAAG,KAAK,CAAC,aAAa,CAAA;gBAC7C,CAAC;YACH,CAAC;YACD,6BAA6B;YAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAA4C,CAAA;YAC/D,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACvC,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;oBAAE,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAA;gBAClF,IAAI,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ;oBAAE,IAAI,CAAC,gBAAgB,GAAG,KAAK,CAAC,aAAa,CAAA;YAC1F,CAAC;YACD,OAAM;QACR,CAAC;QACD,qFAAqF;QACrF,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,IAAI,CAAC,OAA8C,CAAA;YACnE,MAAM,KAAK,GAAG,OAAO,EAAE,KAA4C,CAAA;YACnE,IAAI,OAAO,KAAK,EAAE,YAAY,KAAK,QAAQ;gBAAE,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAA;QACrF,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,IAAI,CAAC,KAA4C,CAAA;YAC/D,IAAI,OAAO,KAAK,EAAE,aAAa,KAAK,QAAQ,EAAE,CAAC;gBAC7C,IAAI,CAAC,gBAAgB,GAAG,KAAK,CAAC,aAAa,CAAA;YAC7C,CAAC;QACH,CAAC;QACD,6BAA6B;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAA4C,CAAA;QAC/D,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvC,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;gBACzE,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAA;YACxC,CAAC;YACD,IAAI,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ,IAAI,IAAI,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;gBAC9E,IAAI,CAAC,gBAAgB,GAAG,KAAK,CAAC,aAAa,CAAA;YAC7C,CAAC;QACH,CAAC;IACH,CAAC;IAEO,MAAM;QACZ,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,IAAI,IAAI,CAAC,gBAAgB,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QAC7E,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAA;IACrF,CAAC;CACF"}

package/apps/hub/dist/sanitize.d.ts

@@ -0,0 +1,3 @@
+import type { IncomingMessage } from 'node:http';
+export declare function sanitizeTunnelRequestHeaders(req: IncomingMessage): Record<string, string>;
+export declare function sanitizeUpstreamResponseHeaders(headers: Record<string, string>): Record<string, string>;

package/apps/hub/dist/sanitize.js

@@ -0,0 +1,56 @@
+/** Hop-by-hop and credential headers that must never enter the tunnel. */
+const STRIP_REQUEST = new Set([
+    'host',
+    'connection',
+    'keep-alive',
+    'transfer-encoding',
+    'upgrade',
+    'te',
+    'trailer',
+    'content-length',
+    'expect',
+    // consumer credentials — the agent injects the upstream key, the two never meet
+    'authorization',
+    'x-api-key',
+    // cookies authenticate the consumer to the hub domain; upstream must never see them
+    'cookie',
+]);
+const STRIP_RESPONSE = new Set([
+    'connection',
+    'keep-alive',
+    'transfer-encoding',
+    'upgrade',
+    'te',
+    'trailer',
+    // we relay chunked; byte count is identical so a stale length is never correct
+    'content-length',
+    // agent-side pickHeaders already drops it; strip again in depth
+    'set-cookie',
+]);
+export function sanitizeTunnelRequestHeaders(req) {
+    const out = {};
+    for (const [key, value] of Object.entries(req.headers)) {
+        const lower = key.toLowerCase();
+        if (STRIP_REQUEST.has(lower) || lower.startsWith('proxy-'))
+            continue;
+        if (typeof value === 'string') {
+            out[lower] = value;
+        }
+        else if (Array.isArray(value)) {
+            out[lower] = value.join(', ');
+        }
+    }
+    out['content-type'] = out['content-type'] ?? 'application/json';
+    return out;
+}
+export function sanitizeUpstreamResponseHeaders(headers) {
+    const out = {};
+    for (const [key, value] of Object.entries(headers)) {
+        const lower = key.toLowerCase();
+        if (STRIP_RESPONSE.has(lower) || lower.startsWith('proxy-'))
+            continue;
+        out[lower] = value;
+    }
+    return out;
+}
+//# sourceMappingURL=sanitize.js.map

package/apps/hub/dist/sanitize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../src/sanitize.ts"],"names":[],"mappings":"AAEA,0EAA0E;AAC1E,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,MAAM;IACN,YAAY;IACZ,YAAY;IACZ,mBAAmB;IACnB,SAAS;IACT,IAAI;IACJ,SAAS;IACT,gBAAgB;IAChB,QAAQ;IACR,gFAAgF;IAChF,eAAe;IACf,WAAW;IACX,oFAAoF;IACpF,QAAQ;CACT,CAAC,CAAA;AAEF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,YAAY;IACZ,YAAY;IACZ,mBAAmB;IACnB,SAAS;IACT,IAAI;IACJ,SAAS;IACT,+EAA+E;IAC/E,gBAAgB;IAChB,gEAAgE;IAChE,YAAY;CACb,CAAC,CAAA;AAEF,MAAM,UAAU,4BAA4B,CAAC,GAAoB;IAC/D,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACvD,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAA;QAC/B,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,SAAQ;QACpE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,CAAA;QACpB,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/B,CAAC;IACH,CAAC;IACD,GAAG,CAAC,cAAc,CAAC,GAAG,GAAG,CAAC,cAAc,CAAC,IAAI,kBAAkB,CAAA;IAC/D,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,OAA+B;IAE/B,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAA;QAC/B,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,SAAQ;QACrE,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,CAAA;IACpB,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/apps/hub/dist/server.d.ts

@@ -0,0 +1,25 @@
+import { type Server } from 'node:http';
+import type Database from 'better-sqlite3';
+import Logger from 'pino';
+import type { AuthContext } from './auth.js';
+import { type HubConfig, type HubPaths } from './config.js';
+import { Router } from './http.js';
+import { Tunnel } from './tunnel.js';
+export interface HubServer {
+    server: Server;
+    db: Database.Database;
+    router: Router;
+    auth: AuthContext;
+    tunnel: Tunnel;
+    paths: HubPaths;
+    config: HubConfig;
+    log: Logger.Logger;
+    close: () => Promise<void>;
+}
+export interface CreateHubOptions {
+    paths?: HubPaths;
+    config?: HubConfig;
+    log?: Logger.Logger;
+}
+/** Assemble the hub: db + admin API + healthz. Tunnel and /v1 routes attach in later phases. */
+export declare function createHubServer(opts?: CreateHubOptions): HubServer;

package/apps/hub/dist/server.js

@@ -0,0 +1,77 @@
+import { createServer } from 'node:http';
+import Logger from 'pino';
+import { registerAdminRoutes } from './admin.js';
+import { ensureDataDir, hubConfigFromEnv, readAdminToken, resolvePaths, } from './config.js';
+import { registerConsumerRoutes } from './consumer.js';
+import { openDb } from './db.js';
+import { Router, sendError, sendJson } from './http.js';
+import { AliasSlots, ConsumerLimiter, TokenWindow } from './limiter.js';
+import { loadOrCreateAdminToken, loadOrCreatePepper } from './tokens.js';
+import { Tunnel } from './tunnel.js';
+/** Assemble the hub: db + admin API + healthz. Tunnel and /v1 routes attach in later phases. */
+export function createHubServer(opts = {}) {
+    const paths = opts.paths ?? resolvePaths();
+    const config = opts.config ?? hubConfigFromEnv();
+    const log = opts.log ?? Logger({ level: process.env.AWESHARE_LOG ?? 'info' });
+    ensureDataDir(paths);
+    const db = openDb(paths.dbFile);
+    const pepper = loadOrCreatePepper(paths);
+    const adminToken = readAdminToken(paths) ?? loadOrCreateAdminToken(paths);
+    const auth = { db, pepper, adminToken };
+    const router = new Router();
+    router.add('GET', '/healthz', (ctx) => sendJson(ctx.res, 200, { ok: true }));
+    registerAdminRoutes(router, { db, auth, log });
+    const tunnel = new Tunnel(db, auth, config, log);
+    registerConsumerRoutes(router, {
+        db,
+        auth,
+        config,
+        tunnel,
+        limiter: new ConsumerLimiter(),
+        tpm: new TokenWindow(),
+        slots: new AliasSlots(),
+        log,
+    });
+    const server = createServer(async (req, res) => {
+        try {
+            const url = new URL(req.url ?? '/', 'http://local');
+            const matched = router.match(req.method ?? 'GET', url.pathname);
+            if (matched === 'not-found') {
+                sendJson(res, 404, { error: { code: 'NOT_FOUND', message: url.pathname } });
+                return;
+            }
+            if (matched === 'method-not-allowed') {
+                sendJson(res, 405, { error: { code: 'METHOD_NOT_ALLOWED', message: url.pathname } });
+                return;
+            }
+            await matched.handler({
+                req,
+                res,
+                params: matched.params,
+                query: url.searchParams,
+                url,
+            });
+        }
+        catch (err) {
+            sendError(res, err);
+        }
+    });
+    server.on('clientError', (_err, socket) => socket.end('HTTP/1.1 400 Bad Request\r\n\r\n'));
+    tunnel.attach(server);
+    return {
+        server,
+        db,
+        router,
+        auth,
+        tunnel,
+        paths,
+        config,
+        log,
+        close: async () => {
+            tunnel.close();
+            await new Promise((resolve) => server.close(() => resolve()));
+            db.close();
+        },
+    };
+}
+//# sourceMappingURL=server.js.map

package/apps/hub/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAA;AAErD,OAAO,MAAM,MAAM,MAAM,CAAA;AACzB,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAEhD,OAAO,EACL,aAAa,EAGb,gBAAgB,EAChB,cAAc,EACd,YAAY,GACb,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AACvD,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AACvE,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAoBpC,gGAAgG;AAChG,MAAM,UAAU,eAAe,CAAC,OAAyB,EAAE;IACzD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,EAAE,CAAA;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,gBAAgB,EAAE,CAAA;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,MAAM,EAAE,CAAC,CAAA;IAE7E,aAAa,CAAC,KAAK,CAAC,CAAA;IACpB,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAC/B,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;IACxC,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,sBAAsB,CAAC,KAAK,CAAC,CAAA;IAEzE,MAAM,IAAI,GAAgB,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;IACpD,MAAM,MAAM,GAAG,IAAI,MAAM,EAAE,CAAA;IAE3B,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAC5E,mBAAmB,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9C,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAA;IAChD,sBAAsB,CAAC,MAAM,EAAE;QAC7B,EAAE;QACF,IAAI;QACJ,MAAM;QACN,MAAM;QACN,OAAO,EAAE,IAAI,eAAe,EAAE;QAC9B,GAAG,EAAE,IAAI,WAAW,EAAE;QACtB,KAAK,EAAE,IAAI,UAAU,EAAE;QACvB,GAAG;KACJ,CAAC,CAAA;IAEF,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,cAAc,CAAC,CAAA;YACnD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAA;YAC/D,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;gBAC5B,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;gBAC3E,OAAM;YACR,CAAC;YACD,IAAI,OAAO,KAAK,oBAAoB,EAAE,CAAC;gBACrC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;gBACpF,OAAM;YACR,CAAC;YACD,MAAM,OAAO,CAAC,OAAO,CAAC;gBACpB,GAAG;gBACH,GAAG;gBACH,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,KAAK,EAAE,GAAG,CAAC,YAAY;gBACvB,GAAG;aACJ,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QACrB,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,EAAE,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC,CAAA;IAC1F,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAErB,OAAO;QACL,MAAM;QACN,EAAE;QACF,MAAM;QACN,IAAI;QACJ,MAAM;QACN,KAAK;QACL,MAAM;QACN,GAAG;QACH,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,CAAC,KAAK,EAAE,CAAA;YACd,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;YACnE,EAAE,CAAC,KAAK,EAAE,CAAA;QACZ,CAAC;KACF,CAAA;AACH,CAAC"}

package/apps/hub/dist/tokens.d.ts

@@ -0,0 +1,9 @@
+import type { TokenRole } from 'aweshare-protocol';
+import type { HubPaths } from './config.js';
+/** 32 random bytes -> 43 base64url chars; matches TOKEN_PATTERN. */
+export declare function generateToken(role: TokenRole): string;
+export declare function hashToken(token: string, pepper: string): string;
+export declare function loadOrCreatePepper(paths: HubPaths): string;
+/** Admin token lives only in a server-local file; shown once at init. */
+export declare function loadOrCreateAdminToken(paths: HubPaths): string;
+export declare function safeEqual(a: string, b: string): boolean;

package/apps/hub/dist/tokens.js

@@ -0,0 +1,35 @@
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { TOKEN_PREFIXES } from 'aweshare-protocol';
+/** 32 random bytes -> 43 base64url chars; matches TOKEN_PATTERN. */
+export function generateToken(role) {
+    return TOKEN_PREFIXES[role] + randomBytes(32).toString('base64url');
+}
+export function hashToken(token, pepper) {
+    return createHash('sha256').update(`${pepper}:${token}`).digest('hex');
+}
+export function loadOrCreatePepper(paths) {
+    if (existsSync(paths.pepperFile)) {
+        return readFileSync(paths.pepperFile, 'utf8').trim();
+    }
+    const pepper = randomBytes(32).toString('hex');
+    writeFileSync(paths.pepperFile, `${pepper}\n`, { mode: 0o600 });
+    return pepper;
+}
+/** Admin token lives only in a server-local file; shown once at init. */
+export function loadOrCreateAdminToken(paths) {
+    if (existsSync(paths.adminTokenFile)) {
+        return readFileSync(paths.adminTokenFile, 'utf8').trim();
+    }
+    const token = generateToken('admin');
+    writeFileSync(paths.adminTokenFile, `${token}\n`, { mode: 0o600 });
+    return token;
+}
+export function safeEqual(a, b) {
+    const ba = Buffer.from(a);
+    const bb = Buffer.from(b);
+    if (ba.length !== bb.length)
+        return false;
+    return timingSafeEqual(ba, bb);
+}
+//# sourceMappingURL=tokens.js.map

package/apps/hub/dist/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AACtE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAEjE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAGlD,oEAAoE;AACpE,MAAM,UAAU,aAAa,CAAC,IAAe;IAC3C,OAAO,cAAc,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AACrE,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,MAAc;IACrD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACxE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAe;IAChD,IAAI,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,OAAO,YAAY,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;IACtD,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC9C,aAAa,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,MAAM,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC/D,OAAO,MAAM,CAAA;AACf,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,sBAAsB,CAAC,KAAe;IACpD,IAAI,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;QACrC,OAAO,YAAY,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;IAC1D,CAAC;IACD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;IACpC,aAAa,CAAC,KAAK,CAAC,cAAc,EAAE,GAAG,KAAK,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAClE,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,CAAS,EAAE,CAAS;IAC5C,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACzB,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACzB,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACzC,OAAO,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;AAChC,CAAC"}

package/apps/hub/dist/tunnel.d.ts

@@ -0,0 +1,108 @@
+import { EventEmitter } from 'node:events';
+import type { Server } from 'node:http';
+import { type BackendStatus, type Protocol } from 'aweshare-protocol';
+import type Database from 'better-sqlite3';
+import type { Logger } from 'pino';
+import { WebSocket } from 'ws';
+import type { AuthContext } from './auth.js';
+import type { HubConfig } from './config.js';
+import { type OfferingRow } from './db.js';
+export declare const HEARTBEAT_TIMEOUT_MS = 45000;
+export interface Session {
+    producerId: number;
+    name: string;
+    ws: WebSocket;
+    backendStatus: Map<string, BackendStatus>;
+    lastHeartbeat: number;
+    requests: Map<string, TunnelRequest>;
+}
+export interface DispatchInit {
+    protocol: Protocol;
+    backendId: string;
+    method: string;
+    path: string;
+    query: Record<string, string> | null;
+    headers: Record<string, string>;
+    body: Uint8Array;
+}
+export interface RelayResult {
+    status: number | null;
+    errorCode: string | null;
+    canceled: boolean;
+    durationMs: number;
+    bytesOut: number;
+}
+export interface RelayFailure {
+    code: string;
+    message: string;
+    status: number;
+}
+export declare function statusForCode(code: string): number;
+/**
+ * One dispatched consumer request: ticket + dispatch + response pump.
+ * Emits: 'head' {status, headers}, 'chunk' (Uint8Array), 'end', 'error' (RelayFailure).
+ * waitFinished() always resolves — never rejects — with the final RelayResult.
+ */
+export declare class TunnelRequest extends EventEmitter {
+    private readonly session;
+    private readonly init;
+    private readonly config;
+    readonly requestId: string;
+    readonly startedAt: number;
+    bytesOut: number;
+    private headPromise;
+    private resolveHead;
+    private rejectHead;
+    private finishedPromise;
+    private settleFinished;
+    private result;
+    private finished;
+    private headArrived;
+    private streamingStarted;
+    private bufferedChunks;
+    private pendingEnd;
+    private headTimer;
+    private idleTimer;
+    constructor(session: Session, init: DispatchInit, config: HubConfig);
+    dispatch(): Promise<void>;
+    waitHead(): Promise<{
+        status: number;
+        headers: Record<string, string>;
+    }>;
+    /** Flush chunks buffered between head and consumer attach; after this, chunks emit live. */
+    startStreaming(): void;
+    waitFinished(): Promise<RelayResult>;
+    /** Consumer went away; tell the agent to abort upstream. */
+    cancel(): void;
+    handleHead(status: number, headers: Record<string, string>): void;
+    handleChunk(payload: Uint8Array): void;
+    handleEnd(): void;
+    handleError(code: string, message: string): void;
+    handleSessionClosed(): void;
+    private fail;
+    private finalize;
+    private armIdleTimer;
+    private clearTimers;
+    private send;
+    private sendBestEffort;
+}
+/** WS endpoint /ws/v1/producer: upgrade auth, register, heartbeat, request routing. */
+export declare class Tunnel {
+    private readonly db;
+    private readonly auth;
+    private readonly config;
+    private readonly log;
+    private sessions;
+    private wss;
+    private sweeper;
+    constructor(db: Database.Database, auth: AuthContext, config: HubConfig, log: Logger);
+    attach(server: Server): void;
+    getSession(producerId: number): Session | undefined;
+    offeringStatus(offering: OfferingRow): 'online' | 'degraded' | 'offline';
+    openRequest(session: Session, init: DispatchInit): TunnelRequest;
+    close(): void;
+    private onConnection;
+    private handleControl;
+    private validateOffering;
+    private sweep;
+}