create-walle 0.10.1 → 0.10.2

package/template/wall-e/coding/session-journal.js

@@ -5,11 +5,13 @@ const crypto = require('node:crypto');
 const os = require('node:os');
 const path = require('node:path');
 const runtimeHealth = require('../lib/runtime-health');
+const errorSink = require('../lib/error-sink');
 const { redactSecrets } = require('../llm/provider-error');
 const { redactPositionalSecretArray, redactSecretText } = require('../lib/secret-redaction');
 const { defaultSessionsDir } = require('./workspace-replay');
 const { canonicalRepoKey } = require('./repo-identity');
 const transcriptSource = require('../../coding-task-manager/lib/transcript-source');
+const { selectJournalDispatcher } = require('./journal-dispatcher');
 
 const MAX_BODY_CHARS = 1500;
 const MAX_SEGMENT_CHARS = 4000;
@@ -311,38 +313,9 @@ async function handleDurableFailure(kind, entry, error, options = {}, startedAt
 }
 
 function recoveryJournalDispatcher(options = {}) {
-  if (options.dispatcher) return options.dispatcher;
-  const { getSharedBrainOwnerClient } = require('../lib/brain-owner-worker-client');
-  const shared = getSharedBrainOwnerClient();
-  if (shared) return createJournalWriteDispatcher({ client: shared });
-  // Stop hooks and standalone lifecycle processes cannot see the daemon's
-  // process-local singleton. The bounded one-shot child owns SQLite and keeps
-  // this process free from better-sqlite3 teardown hazards.
-  const { writeJournalEntryInChild } = require('../lib/coding-journal-writer-child-client');
-  return createJournalWriteDispatcher({
-    client: {
-      persistCodingJournal(entry) {
-        const dbPath = options.dbPath || defaultBrainDbPath(options.env);
-        // J-1: no daemon is actually serving a brain (no explicit dbPath, no
-        // WALL_E_DATA_DIR, no live-data instance-id.json) — never spawn the
-        // one-shot child, which holds an owner grant and would create/migrate
-        // the phantom ~/.walle/data brain. Write nothing; skip loudly.
-        if (!dbPath) {
-          console.error('[wall-e] coding journal write skipped: reason=no_served_brain (no daemon-served brain to write to)');
-          return Promise.resolve({ ok: true, skipped: true, reason: 'no_served_brain' });
-        }
-        return writeJournalEntryInChild(entry, {
-          dbPath,
-          // S-8: state THIS process's schema generation so the fresh-code child
-          // refuses rather than migrating the brain out from under us.
-          parentSchemaVersion: require('../brain').SCHEMA_VERSION,
-          timeoutMs: options.timeoutMs,
-          forkImpl: options.forkImpl,
-          env: options.env,
-        });
-      },
-    },
-  });
+  return selectJournalDispatcher(options, {
+    createJournalWriteDispatcher, defaultBrainDbPath,
+  }).dispatcher;
 }
 
 async function readJournalRetryMarker(markerPath) {
@@ -1001,7 +974,11 @@ function dispatchOffThread(kind, dispatcher, prepare, options = {}) {
         narrativeOp.end({ ok: true, meta: { applied } });
       } catch (error) {
         narrativeOp.end({ ok: false, error });
-        options.logger?.warn?.(`[coding-journal] narrative polisher failed open: ${redactJournalString(error?.message || error, 240)}`);
+        try {
+          options.logger?.warn?.(`[coding-journal] narrative polisher failed open: ${redactJournalString(error?.message || error, 240)}`);
+        } catch (warningError) {
+          errorSink.report('coding-journal', 'narrative-warning', warningError);
+        }
       }
     }
 
@@ -1251,14 +1228,24 @@ function journalInputForRun({
   });
 }
 
-function scheduleRunJournal(input = {}, options = {}) {
+function startRunJournal(input = {}, options = {}) {
   const timestamp = String(input.timestamp || new Date().toISOString());
-  return dispatchOffThread(
-    'entry',
-    options.dispatcher || defaultJournalDispatcher(options),
-    () => buildJournalEntry({ ...journalInputForRun(input), timestamp }),
-    options,
-  );
+  const selection = selectJournalDispatcher(options, {
+    createJournalWriteDispatcher, defaultBrainDbPath,
+  });
+  return Object.freeze({
+    completion: dispatchOffThread(
+      'entry',
+      selection.dispatcher,
+      () => buildJournalEntry({ ...journalInputForRun(input), timestamp }),
+      options,
+    ),
+    defaultAwaitTerminalJournal: selection.defaultAwaitTerminalJournal,
+  });
+}
+
+function scheduleRunJournal(input = {}, options = {}) {
+  return startRunJournal(input, options).completion;
 }
 
 function transcriptText(record = {}) {
@@ -1577,6 +1564,7 @@ module.exports = {
   persistJournalEntry,
   persistJournalSegment,
   scheduleJournalEntry,
+  startRunJournal,
   scheduleRunJournal,
   scheduleJournalSegment,
   extractDecisionContent,

package/template/wall-e/coding-orchestrator.js

@@ -3393,18 +3393,13 @@ async function runAgentLoopUnaccounted(prompt, opts = {}) {
   // that stable session when the caller omitted runId.
   const runId = String(opts.runId || crypto.randomUUID());
   const sessionId = String(opts.chatSessionId || opts.session_id || runId);
-  let awaitTerminalJournal = opts.awaitTerminalJournal;
-  if (awaitTerminalJournal == null) {
-    try {
-      const { getSharedBrainOwnerClient } = require('./lib/brain-owner-worker-client');
-      // Daemon CTM turns enqueue to the already-running owner and return without
-      // gating user-visible completion on SQLite. Standalone/CLI runs own their
-      // process lifetime, so they drain the one-shot writer before exiting.
-      awaitTerminalJournal = Boolean(opts.journalDispatcher) || !getSharedBrainOwnerClient();
-    } catch {
-      awaitTerminalJournal = true;
-    }
-  }
+  // The wait policy belongs to the dispatcher actually selected at the terminal
+  // boundary, which is why this is only the caller's explicit override, read
+  // once at run start (see flushTerminalJournal). A daemon turn enqueues to the
+  // already-running owner and returns without gating user-visible completion on
+  // SQLite; a standalone/CLI run owns its process lifetime and drains the
+  // one-shot writer before exiting.
+  const explicitJournalAwait = opts.awaitTerminalJournal;
   const cwd = await realpathBestEffort(opts.cwd || process.cwd());
   let repoKey = String(opts.repoKey || '');
   if (!repoKey) {
@@ -3428,10 +3423,10 @@ async function runAgentLoopUnaccounted(prompt, opts = {}) {
       opts.journalNarrativeLogger?.warn?.(`[coding-journal] narrative setup skipped: ${error?.message || String(error)}`);
     }
   }
-  let terminalJournalPromise = null;
+  let terminalJournalOperation = null;
   const scheduleTerminalJournal = ({ result = null, error = null } = {}) => {
-    const { scheduleRunJournal } = require('./coding/session-journal');
-    terminalJournalPromise = scheduleRunJournal({
+    const { startRunJournal } = require('./coding/session-journal');
+    terminalJournalOperation = startRunJournal({
       runId,
       sessionId,
       repoKey,
@@ -3452,20 +3447,22 @@ async function runAgentLoopUnaccounted(prompt, opts = {}) {
     });
   };
   const flushTerminalJournal = async () => {
-    if (!terminalJournalPromise || !awaitTerminalJournal) return;
-    const timeoutMs = Math.min(Math.max(Number(opts.journalFlushTimeoutMs) || 12000, 1000), 60000);
-    let timer = null;
+    if (!terminalJournalOperation) return;
+    const shouldAwait = explicitJournalAwait == null
+      ? terminalJournalOperation.defaultAwaitTerminalJournal !== false
+      : explicitJournalAwait;
+    if (!shouldAwait) return;
+    // The awaited caller joins the journal scheduler's own promise, so the
+    // dispatch enqueue and the scheduler's durable-failure handling finish before
+    // the run boundary returns; when the selected dispatcher is the native
+    // writer, that same promise also covers its real child close. A caller-side
+    // race would abandon that ownership while the write is still in flight. A
+    // custom dispatcher proves only what its own promise proves: its resolved
+    // Promise is not physical-effect evidence, and no timer can supply one.
     try {
-      await Promise.race([
-        terminalJournalPromise,
-        new Promise((resolve) => {
-          timer = setTimeout(() => resolve({ ok: false, timedOut: true }), timeoutMs);
-        }),
-      ]);
+      await terminalJournalOperation.completion;
     } catch (error) {
       console.warn?.(`[coding-journal] terminal flush failed: ${error.message}`);
-    } finally {
-      if (timer) clearTimeout(timer);
     }
   };
   let actionMemoryWriter = opts.actionMemoryWriter || null;

package/template/wall-e/http/auth.js

@@ -8,6 +8,11 @@ const PUBLIC_ROUTES = new Set([
   '/api/wall-e/health',
   '/api/wall-e/webhook',
   '/api/wall-e/feedback/submit',
+  // WP-1 (blog-view-counts): the public aggregate counter for the three static
+  // articles. Public at this outer gate ONLY — the handler itself accepts a POST
+  // solely from the two published site origins (getBlogViewOrigin), and its
+  // writes are capped by the store's receipt bound.
+  '/api/wall-e/telemetry/blog-views',
   '/api/wall-e/telemetry/ingest',
   '/api/wall-e/telemetry/summary',
   '/api/wall-e/telemetry/storage',
@@ -17,6 +22,7 @@ const PUBLIC_ROUTES = new Set([
 ]);
 
 const { ctmPort: resolveCtmPort } = require('../lib/ctm-endpoint');
+const { getBlogViewOrigin, isBlogViewsPath } = require('../lib/blog-view-policy');
 // WP-7: request provenance comes from the VENDORED standalone copy of the
 // canonical shared module (byte-identical sibling) — the standalone product
 // never imports the CTM checkout.
@@ -24,8 +30,19 @@ const { inspectRequestOrigin, isLoopbackRequest } = require('../shared/request-p
 
 function getAllowedOrigin(req) {
   const ctmPort = process.env.CTM_PORT || resolveCtmPort();
-  if (process.env.CTM_ORIGIN) return process.env.CTM_ORIGIN;
   const origin = req?.headers?.origin;
+  // WP-1 (blog-view-counts, D-4): ROUTE-SCOPED exception for the public blog
+  // counter only. The static site is served from walle.sh, so its two exact
+  // origins are reflected for this one path — walle.sh is NEVER added to the
+  // private routes' set (which stays the local CTM origin), and an unrecognized
+  // origin still falls through to the existing local answer.
+  //
+  // Deliberately FIRST, ahead of the CTM_ORIGIN override below: a private
+  // deployment's custom origin setting must never be able to break this exact
+  // public route's two published site origins. Every other route still answers
+  // with CTM_ORIGIN / the local set exactly as before.
+  if (isBlogViewsPath(String(req?.url || '').split('?')[0]) && getBlogViewOrigin(origin)) return origin;
+  if (process.env.CTM_ORIGIN) return process.env.CTM_ORIGIN;
   const allowed = new Set([
     `http://127.0.0.1:${ctmPort}`,
     `http://localhost:${ctmPort}`,

package/template/wall-e/http/blog-views-api.js

@@ -0,0 +1,318 @@
+'use strict';
+
+// WP-1 (docs/blog-view-counts-2026-10-22.html §5 D-4/D-5, §6): the ONE public,
+// unauthenticated blog-view counter endpoint (GET totals for the index, POST one
+// visible article opening) at the exact path the policy module names —
+// /api/wall-e/telemetry/blog-views, which api-walle.js already routes into the
+// isolated telemetry process in the daemon role. Dispatched from
+// http/telemetry-api.js with
+// {getTelemetryDb, errorSink} — the same deps the telemetry routes already get —
+// and deliberately narrow: only the exact path, no query parameters, no cookies,
+// no Set-Cookie, no CORS header of its own (server.js reflects the route-scoped
+// origin from http/auth.js), and never an exception detail in a response body.
+//
+// Bounded by construction: the 1024-byte body cap, a separate in-memory per-IP
+// POST limiter (60/min, 10000 buckets, lazily pruned) and the store's receipt
+// cap. The client's raw address is only ever a limiter key in this process's
+// memory — never persisted, never logged, never forwarded to the error sink.
+//
+// Test seams (no environment flag): callers may inject `now` and a `rateLimiter`
+// built by createBlogViewRateLimiter() for deterministic windows.
+
+const net = require('node:net');
+const { readBody } = require('./api-utils');
+const {
+  BLOG_VIEW_MAX_BODY_BYTES,
+  getBlogViewOrigin,
+  isBlogPostSlug,
+  isBlogViewsPath,
+  isBlogViewToken,
+  isKnownBotUserAgent,
+} = require('../lib/blog-view-policy');
+const {
+  BLOG_VIEW_CAPACITY,
+  BLOG_VIEW_OVERFLOW,
+  getBlogViewCounts,
+  recordBlogView,
+} = require('../lib/blog-view-store');
+
+const BLOG_VIEW_RATE_MAX_PER_WINDOW = 60;
+const BLOG_VIEW_RATE_WINDOW_MS = 60000;
+const BLOG_VIEW_RATE_MAX_BUCKETS = 10000;
+const UNKNOWN_CLIENT_KEY = 'unknown';
+
+// Bounded fixed-window limiter. check(key, nowMs) never allocates for a key it
+// refuses, and a full bucket map refuses the NEW key instead of evicting live
+// counters (a flood must not be able to reset everyone's window). Expired buckets
+// are pruned lazily, at most once per window, so no timer is needed.
+function createBlogViewRateLimiter(options = {}) {
+  const maxPerWindow = Number.isInteger(options.maxPerWindow) ? options.maxPerWindow : BLOG_VIEW_RATE_MAX_PER_WINDOW;
+  const windowMs = Number.isInteger(options.windowMs) ? options.windowMs : BLOG_VIEW_RATE_WINDOW_MS;
+  const maxBuckets = Number.isInteger(options.maxBuckets) ? options.maxBuckets : BLOG_VIEW_RATE_MAX_BUCKETS;
+  const buckets = new Map();
+  let lastPruneMs = 0;
+
+  function prune(nowMs) {
+    if (nowMs - lastPruneMs < windowMs) return;
+    lastPruneMs = nowMs;
+    for (const [key, bucket] of buckets) {
+      if (bucket.startMs + windowMs <= nowMs) buckets.delete(key);
+    }
+  }
+
+  function check(key, nowMs) {
+    const now = Number.isFinite(nowMs) ? nowMs : Date.now();
+    prune(now);
+    const existing = buckets.get(key);
+    if (!existing) {
+      if (buckets.size >= maxBuckets) {
+        return { ok: false, retryAfterSeconds: Math.max(1, Math.ceil(windowMs / 1000)) };
+      }
+      buckets.set(key, { startMs: now, count: 1 });
+      return { ok: true, retryAfterSeconds: 0 };
+    }
+    if (now - existing.startMs >= windowMs) {
+      existing.startMs = now;
+      existing.count = 1;
+      return { ok: true, retryAfterSeconds: 0 };
+    }
+    existing.count += 1;
+    if (existing.count > maxPerWindow) {
+      const remainingMs = existing.startMs + windowMs - now;
+      return { ok: false, retryAfterSeconds: Math.max(1, Math.ceil(remainingMs / 1000)) };
+    }
+    return { ok: true, retryAfterSeconds: 0 };
+  }
+
+  return {
+    check,
+    size: () => buckets.size,
+    reset: () => { buckets.clear(); lastPruneMs = 0; },
+  };
+}
+
+// The process-wide limiter the API dispatch path uses. Exported so a test can
+// reset or exercise it without reaching into module state.
+const blogViewRateLimiter = createBlogViewRateLimiter();
+
+function readHeaderString(headers, name) {
+  const raw = headers ? headers[name] : undefined;
+  return typeof raw === 'string' ? raw : '';
+}
+
+// Every counter response is uncacheable at the edge and varies by Origin; none of
+// them carries a cookie or a secret.
+function sendJson(res, status, body, extraHeaders) {
+  const payload = JSON.stringify(body);
+  res.writeHead(status, {
+    'Content-Type': 'application/json',
+    'Content-Length': Buffer.byteLength(payload),
+    'Cache-Control': 'no-store',
+    'Vary': 'Origin',
+    ...(extraHeaders || {}),
+  });
+  res.end(payload);
+}
+
+function isJsonContentType(value) {
+  if (typeof value !== 'string') return false;
+  const [type, ...parameters] = value.split(';');
+  if (type.trim().toLowerCase() !== 'application/json') return false;
+  return parameters.every((parameter) => {
+    const trimmed = parameter.trim().toLowerCase();
+    return trimmed === '' || trimmed.startsWith('charset=');
+  });
+}
+
+// Fly terminates TLS and forwards the peer it saw in Fly-Client-IP; that header is
+// trusted ONLY when this process really is a Fly app. Otherwise the socket address
+// is the truth. X-Forwarded-For is client-controlled here and is never read.
+function resolveClientIp(req) {
+  const headers = (req && req.headers) || {};
+  if (process.env.FLY_APP_NAME) {
+    const flyClientIp = readHeaderString(headers, 'fly-client-ip').trim().slice(0, 64);
+    if (net.isIP(flyClientIp)) return flyClientIp;
+  }
+  const socketAddress = req && req.socket ? req.socket.remoteAddress : undefined;
+  if (typeof socketAddress === 'string') {
+    const trimmed = socketAddress.trim().slice(0, 64);
+    if (net.isIP(trimmed)) return trimmed;
+  }
+  // Missing/invalid address: one shared bucket, never a per-garbage-value one.
+  return UNKNOWN_CLIENT_KEY;
+}
+
+// Strict envelope: exactly {slug, token}, both strings. Anything else (an array,
+// null, extra keys, a nested object) is a malformed payload.
+function parseBlogViewPayload(body) {
+  if (!body || typeof body !== 'object' || Array.isArray(body)) return null;
+  if (Object.keys(body).length !== 2) return null;
+  if (!Object.prototype.hasOwnProperty.call(body, 'slug')) return null;
+  if (!Object.prototype.hasOwnProperty.call(body, 'token')) return null;
+  if (typeof body.slug !== 'string' || typeof body.token !== 'string') return null;
+  return { slug: body.slug, token: body.token };
+}
+
+function handleBlogViewsApi(req, res, url, deps = {}) {
+  if (!url || !isBlogViewsPath(url.pathname)) return false;
+
+  const getTelemetryDb = typeof deps.getTelemetryDb === 'function' ? deps.getTelemetryDb : () => null;
+  const now = typeof deps.now === 'function' ? deps.now : Date.now;
+  const rateLimiter = deps.rateLimiter || blogViewRateLimiter;
+  const errorSink = deps.errorSink;
+  const headers = (req && req.headers) || {};
+
+  // The sink receives a static, sanitized error only: no request headers, no
+  // payload, no visitor address and no driver message ever reach it.
+  function reportRecordFailure() {
+    if (!errorSink || typeof errorSink.report !== 'function') return;
+    try {
+      errorSink.report('wall-e', 'blog_view_record_failed', new Error('blog view record failed'));
+    } catch { /* expected: a reporting sink is contractually fail-open and must never break the response it reports on */ }
+  }
+
+  // The ONE 503 shape. `expectedRefusal` marks a policy outcome — a full receipt
+  // table or a counter at the safe-integer ceiling — which is answered the same
+  // way but is not reported as a failure. Every other error is reported (with a
+  // static error object, never the driver's), and the response is written at most
+  // once.
+  function failClosed(expectedRefusal) {
+    if (!expectedRefusal) reportRecordFailure();
+    if (!res.headersSent) sendJson(res, 503, { error: 'View count unavailable' });
+  }
+
+  // getTelemetryDb() is a real open: it can DECLINE (telemetry server mode off →
+  // a null handle, answered 404 "not enabled") or THROW (an unusable database,
+  // answered 503 like every other internal failure). Both are caught here so no
+  // path can leak an exception out of the handler — and for BOTH methods.
+  function resolveDb() {
+    try {
+      return { db: getTelemetryDb() || null, thrown: false };
+    } catch {
+      return { db: null, thrown: true };
+    }
+  }
+
+  // Writes the generic refusal for a failed resolveDb(): 503 when the open threw,
+  // 404 when the counter is simply not enabled in this deployment mode.
+  function refuseUnavailable(resolved) {
+    if (resolved.thrown) failClosed(false);
+    else if (!res.headersSent) sendJson(res, 404, { error: 'View count unavailable' });
+  }
+
+  // The counter takes no query string at all: url.search is empty or the request
+  // is malformed (a cache-buster or an extra parameter is not a documented input,
+  // and silently ignoring one would make the surface wider than the design's
+  // "no queries"). Refused for both methods, before anything is read or written.
+  if (url.search) {
+    sendJson(res, 400, { error: 'query_not_allowed' });
+    return true;
+  }
+
+  const method = String(req.method || '').toUpperCase();
+  const hasOrigin = Object.prototype.hasOwnProperty.call(headers, 'origin');
+  const allowedOrigin = getBlogViewOrigin(readHeaderString(headers, 'origin'));
+
+  if (method === 'GET') {
+    // The public listing may be read without an Origin; a present Origin must be
+    // exactly one of the two published site origins.
+    if (hasOrigin && !allowedOrigin) {
+      sendJson(res, 403, { error: 'origin_not_allowed' });
+      return true;
+    }
+    const resolved = resolveDb();
+    if (!resolved.db) {
+      refuseUnavailable(resolved);
+      return true;
+    }
+    try {
+      sendJson(res, 200, { views: getBlogViewCounts(resolved.db) });
+    } catch {
+      failClosed(false);
+    }
+    return true;
+  }
+
+  if (method !== 'POST') {
+    sendJson(res, 405, { error: 'method_not_allowed' }, { Allow: 'GET, POST' });
+    return true;
+  }
+
+  // A write must come from the published site itself and be JSON.
+  if (!allowedOrigin) {
+    sendJson(res, 403, { error: 'origin_not_allowed' });
+    return true;
+  }
+  if (!isJsonContentType(readHeaderString(headers, 'content-type'))) {
+    sendJson(res, 415, { error: 'unsupported_media_type' });
+    return true;
+  }
+  const gate = rateLimiter.check(resolveClientIp(req), now());
+  if (!gate.ok) {
+    sendJson(res, 429, { error: 'rate_limited' }, { 'Retry-After': String(gate.retryAfterSeconds) });
+    return true;
+  }
+
+  // Body handling is asynchronous, exactly like the existing ingest route: the
+  // request is already claimed, so the boolean is true now and the response is
+  // written when the bounded read finishes.
+  readBody(req, { maxBytes: BLOG_VIEW_MAX_BODY_BYTES }).then((body) => {
+    try {
+      const payload = parseBlogViewPayload(body);
+      if (!payload) {
+        sendJson(res, 400, { error: 'invalid_payload' });
+        return;
+      }
+      if (!isBlogPostSlug(payload.slug)) {
+        sendJson(res, 404, { error: 'unknown_post' });
+        return;
+      }
+      if (!isBlogViewToken(payload.token)) {
+        sendJson(res, 400, { error: 'invalid_payload' });
+        return;
+      }
+      const resolved = resolveDb();
+      if (!resolved.db) {
+        refuseUnavailable(resolved);
+        return;
+      }
+      if (isKnownBotUserAgent(readHeaderString(headers, 'user-agent'))) {
+        // A recognized crawler is answered honestly with the current total and no
+        // write at all — the counter never claims a view it did not record.
+        sendJson(res, 200, { slug: payload.slug, views: getBlogViewCounts(resolved.db)[payload.slug], counted: false });
+        return;
+      }
+      const result = recordBlogView(resolved.db, payload.slug, payload.token, now());
+      sendJson(res, 200, { slug: result.slug, views: result.views, counted: result.counted });
+    } catch (error) {
+      // Every INTERNAL exception lands here — a store/driver failure, a broken
+      // getTelemetryDb(), a failed query — and answers 503. Capacity/overflow are
+      // policy refusals: identical body, no failure report. Neither leaks a driver
+      // message, and the `headersSent` guard in failClosed() keeps this to one
+      // response even when a body write already started.
+      failClosed(!!error && (error.code === BLOG_VIEW_CAPACITY || error.code === BLOG_VIEW_OVERFLOW));
+    }
+  }).catch((error) => {
+    // readBody rejects ONLY on a client-side body problem: an oversized body is a
+    // 413, an aborted or malformed one a 400. The fulfillment handler above never
+    // rethrows (it answers 503 itself), so nothing internal can be misclassified
+    // as a client error here.
+    if (res.headersSent) return;
+    if (error && error.code === 'BODY_TOO_LARGE') {
+      sendJson(res, 413, { error: 'payload_too_large' });
+      return;
+    }
+    // A malformed/aborted body is a client problem, never a 500 with details.
+    sendJson(res, 400, { error: 'invalid_payload' });
+  });
+  return true;
+}
+
+module.exports = {
+  BLOG_VIEW_RATE_MAX_BUCKETS,
+  BLOG_VIEW_RATE_MAX_PER_WINDOW,
+  BLOG_VIEW_RATE_WINDOW_MS,
+  blogViewRateLimiter,
+  createBlogViewRateLimiter,
+  handleBlogViewsApi,
+};