fest-gateway 0.1.0

package/dist/cli/config.js

@@ -0,0 +1,59 @@
+/**
+ * The developer-facing `~/.fest` config.
+ *
+ * Distinct from `server/config.ts`: nothing here is read by the server, and
+ * nothing in `server/config.ts` is read by the CLI. `fest login` writes this
+ * file; `fest whoami`/`fest claude`/`fest logout` read or delete it. It never
+ * touches the database — everything under `cli/` runs entirely on a
+ * developer's own machine.
+ */
+import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+export const CONFIG_DIR = join(homedir(), ".fest");
+export const CONFIG_FILE = join(CONFIG_DIR, "config.json");
+function isCliConfig(v) {
+    if (typeof v !== "object" || v === null)
+        return false;
+    const r = v;
+    return (typeof r["serverUrl"] === "string" &&
+        typeof r["identityToken"] === "string" &&
+        typeof r["email"] === "string" &&
+        (r["provider"] === "google" || r["provider"] === "github" || r["provider"] === "env"));
+}
+/**
+ * `FEST_TOKEN` / `FEST_SERVER_URL` override the file when both are set — the
+ * CI path, where writing a config file to a shared runner's home directory
+ * would be the wrong kind of persistence.
+ */
+export async function readCliConfig() {
+    const envToken = process.env.FEST_TOKEN;
+    const envServer = process.env.FEST_SERVER_URL;
+    if (envToken !== undefined && envToken !== "" && envServer !== undefined && envServer !== "") {
+        return {
+            serverUrl: envServer.replace(/\/+$/, ""),
+            identityToken: envToken,
+            email: "(FEST_TOKEN)",
+            provider: "env",
+        };
+    }
+    let raw;
+    try {
+        raw = await readFile(CONFIG_FILE, "utf8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return null;
+        throw err;
+    }
+    const parsed = JSON.parse(raw);
+    return isCliConfig(parsed) ? parsed : null;
+}
+export async function writeCliConfig(cfg) {
+    await mkdir(CONFIG_DIR, { recursive: true, mode: 0o700 });
+    await writeFile(CONFIG_FILE, JSON.stringify(cfg, null, 2) + "\n", { mode: 0o600 });
+}
+export async function clearCliConfig() {
+    await rm(CONFIG_FILE, { force: true });
+}
+//# sourceMappingURL=config.js.map

package/dist/cli/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../cli/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;AACnD,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AAS3D,SAAS,WAAW,CAAC,CAAU;IAC7B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,OAAO,CACL,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,QAAQ;QAClC,OAAO,CAAC,CAAC,eAAe,CAAC,KAAK,QAAQ;QACtC,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ;QAC9B,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,KAAK,CAAC,CACtF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IACxC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC9C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QAC7F,OAAO;YACL,SAAS,EAAE,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YACxC,aAAa,EAAE,QAAQ;YACvB,KAAK,EAAE,cAAc;YACrB,QAAQ,EAAE,KAAK;SAChB,CAAC;IACJ,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAClE,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAc;IACjD,MAAM,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1D,MAAM,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACrF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACzC,CAAC"}

package/dist/cli/login.js

@@ -0,0 +1,130 @@
+/**
+ * `fest login`: the loopback OAuth flow.
+ *
+ * Opens the server's OAuth start URL in the developer's browser with a
+ * `cli_redirect_uri` pointing at a temporary local server on 127.0.0.1. The
+ * server, after completing Google/GitHub OAuth, redirects the browser back
+ * here with a freshly minted identity token in the query string — see
+ * `server/api/oauth.ts` and docs/CLI-AUTH.md. This is a loopback-redirect
+ * flow, not device-code polling: nothing is ever typed back into the CLI.
+ */
+import { createServer } from "node:http";
+import open from "open";
+import { writeCliConfig } from "./config.js";
+const PORT_RANGE_START = 8865;
+const PORT_RANGE_END = 8875;
+const TIMEOUT_MS = 5 * 60_000;
+function escapeHtml(s) {
+    const map = { "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" };
+    return s.replace(/[&<>"']/g, (c) => map[c]);
+}
+const SUCCESS_HTML = "<!doctype html><title>fest login</title>" +
+    '<body style="font-family:sans-serif">Signed in. You can close this window and return to your terminal.</body>';
+function errorHtml(message) {
+    return ("<!doctype html><title>fest login</title>" +
+        `<body style="font-family:sans-serif">Sign-in failed: ${escapeHtml(message)}</body>`);
+}
+async function listenOnFreePort(handler) {
+    for (let port = PORT_RANGE_START; port <= PORT_RANGE_END; port += 1) {
+        const server = createServer(handler);
+        try {
+            await new Promise((resolve, reject) => {
+                server.once("error", reject);
+                server.listen(port, "127.0.0.1", () => resolve());
+            });
+            return { server, port };
+        }
+        catch (err) {
+            if (err.code !== "EADDRINUSE")
+                throw err;
+        }
+    }
+    throw new Error(`no free port in ${PORT_RANGE_START}-${PORT_RANGE_END} for the login callback`);
+}
+/**
+ * `--server` must be the GATEWAY's own address — the same one you'd hand to
+ * `ANTHROPIC_BASE_URL` by hand — not the Vite dashboard dev server. The two
+ * are easy to confuse (`npm run dev` prints both, and the dashboard is the
+ * one you actually open in a browser), but Vite only proxies `/api/*`, not
+ * `/v1/messages`, so a `fest claude` pointed at the dashboard port fails
+ * downstream inside Claude Code with a confusing "issue with the selected
+ * model" rather than here, where the mistake is actually legible. Caught
+ * before ever opening a browser, not after minting a token that then quietly
+ * doesn't work.
+ */
+async function checkIsGateway(serverUrl) {
+    let ok = false;
+    try {
+        const res = await fetch(`${serverUrl}/healthz`);
+        const body = (await res.json().catch(() => null));
+        ok = res.ok && body?.ok === true;
+    }
+    catch {
+        ok = false;
+    }
+    if (!ok) {
+        throw new Error(`${serverUrl} does not look like a Fest gateway (GET /healthz failed).\n` +
+            "Use the gateway's own address — the same one you'd set ANTHROPIC_BASE_URL\n" +
+            "to by hand — not a dashboard dev server. `npm run dev` prints both; the\n" +
+            "one you want here is the \"gateway\" line, not the \"dashboard\" line.");
+    }
+}
+export async function runLogin(opts) {
+    const serverUrl = opts.serverUrl.replace(/\/+$/, "");
+    await checkIsGateway(serverUrl);
+    let resolveResult;
+    const done = new Promise((resolve) => {
+        resolveResult = resolve;
+    });
+    const { server, port } = await listenOnFreePort((req, res) => {
+        const url = new URL(req.url ?? "/", "http://127.0.0.1");
+        if (url.pathname !== "/callback") {
+            res.writeHead(404).end();
+            return;
+        }
+        const token = url.searchParams.get("token");
+        const email = url.searchParams.get("email");
+        const error = url.searchParams.get("error");
+        if (error !== null) {
+            res.writeHead(200, { "content-type": "text/html" }).end(errorHtml(error));
+            resolveResult({ error });
+            return;
+        }
+        if (token === null || email === null) {
+            res.writeHead(400, { "content-type": "text/html" }).end(errorHtml("missing token"));
+            resolveResult({ error: "callback did not include a token" });
+            return;
+        }
+        res.writeHead(200, { "content-type": "text/html" }).end(SUCCESS_HTML);
+        resolveResult({ token, email });
+    });
+    try {
+        const callbackUrl = `http://127.0.0.1:${port}/callback`;
+        const startUrl = `${serverUrl}/api/auth/oauth/${opts.provider}/start?cli_redirect_uri=${encodeURIComponent(callbackUrl)}`;
+        process.stdout.write(`Opening your browser to sign in with ${opts.provider}...\n`);
+        process.stdout.write(`If it doesn't open, visit:\n  ${startUrl}\n`);
+        (opts.openBrowser ?? open)(startUrl).catch(() => { });
+        const timeout = new Promise((resolve) => {
+            const t = setTimeout(() => resolve({ error: "timed out waiting for sign-in" }), TIMEOUT_MS);
+            t.unref();
+        });
+        const result = await Promise.race([done, timeout]);
+        if ("error" in result)
+            throw new Error(`login failed: ${result.error}`);
+        await writeCliConfig({
+            serverUrl,
+            identityToken: result.token,
+            email: result.email,
+            provider: opts.provider,
+        });
+        // The token is already written to disk; echoing it here would only add it
+        // to shell scrollback for no benefit, unlike `fest token create`, which is
+        // designed to be copied by hand into an env var.
+        process.stdout.write(`Logged in as ${result.email} via ${opts.provider}.\n`);
+        process.stdout.write("Token stored in ~/.fest/config.json (mode 600).\n");
+    }
+    finally {
+        await new Promise((resolve) => server.close(() => resolve()));
+    }
+}
+//# sourceMappingURL=login.js.map

package/dist/cli/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../cli/login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,MAAM,cAAc,GAAG,IAAI,CAAC;AAC5B,MAAM,UAAU,GAAG,CAAC,GAAG,MAAM,CAAC;AAE9B,SAAS,UAAU,CAAC,CAAS;IAC3B,MAAM,GAAG,GAA2B,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;IAC5G,OAAO,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,YAAY,GAChB,0CAA0C;IAC1C,+GAA+G,CAAC;AAElH,SAAS,SAAS,CAAC,OAAe;IAChC,OAAO,CACL,0CAA0C;QAC1C,wDAAwD,UAAU,CAAC,OAAO,CAAC,SAAS,CACrF,CAAC;AACJ,CAAC;AAID,KAAK,UAAU,gBAAgB,CAAC,OAAwB;IACtD,KAAK,IAAI,IAAI,GAAG,gBAAgB,EAAE,IAAI,IAAI,cAAc,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;QACpE,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YACpD,CAAC,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,YAAY;gBAAE,MAAM,GAAG,CAAC;QACtE,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,mBAAmB,gBAAgB,IAAI,cAAc,yBAAyB,CAAC,CAAC;AAClG,CAAC;AAID;;;;;;;;;;GAUG;AACH,KAAK,UAAU,cAAc,CAAC,SAAiB;IAC7C,IAAI,EAAE,GAAG,KAAK,CAAC;IACf,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,SAAS,UAAU,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAA4B,CAAC;QAC7E,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,IAAI,EAAE,EAAE,KAAK,IAAI,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,EAAE,GAAG,KAAK,CAAC;IACb,CAAC;IACD,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,KAAK,CACb,GAAG,SAAS,6DAA6D;YACvE,6EAA6E;YAC7E,2EAA2E;YAC3E,wEAAwE,CAC3E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAK9B;IACC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC;IAEhC,IAAI,aAA2C,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,OAAO,CAAiB,CAAC,OAAO,EAAE,EAAE;QACnD,aAAa,GAAG,OAAO,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,gBAAgB,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC3D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACxD,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;YACjC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1E,aAAa,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YACzB,OAAO;QACT,CAAC;QACD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACrC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,CAAC;YACpF,aAAa,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACtE,aAAa,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,oBAAoB,IAAI,WAAW,CAAC;QACxD,MAAM,QAAQ,GAAG,GAAG,SAAS,mBAAmB,IAAI,CAAC,QAAQ,2BAA2B,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;QAE1H,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wCAAwC,IAAI,CAAC,QAAQ,OAAO,CAAC,CAAC;QACnF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,QAAQ,IAAI,CAAC,CAAC;QACpE,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAErD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAiB,CAAC,OAAO,EAAE,EAAE;YACtD,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;YAC5F,CAAC,CAAC,KAAK,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QACnD,IAAI,OAAO,IAAI,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAExE,MAAM,cAAc,CAAC;YACnB,SAAS;YACT,aAAa,EAAE,MAAM,CAAC,KAAK;YAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;QACH,0EAA0E;QAC1E,2EAA2E;QAC3E,iDAAiD;QACjD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC,QAAQ,KAAK,CAAC,CAAC;QAC7E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAC5E,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACtE,CAAC;AACH,CAAC"}

package/dist/cli/logout.js

@@ -0,0 +1,20 @@
+/**
+ * `fest logout`: forget the local token.
+ *
+ * Deletes `~/.fest/config.json` only. It does NOT revoke the token
+ * server-side — that stays an explicit `fest token revoke <id>`, an operator
+ * action against the database. This command is "forget this on my machine",
+ * not a security control.
+ */
+import { clearCliConfig, readCliConfig } from "./config.js";
+export async function runLogout() {
+    const cfg = await readCliConfig();
+    await clearCliConfig();
+    if (cfg === null) {
+        process.stdout.write("was not logged in.\n");
+        return;
+    }
+    process.stdout.write(`removed local login for ${cfg.email}.\n`);
+    process.stdout.write("the token itself is still valid until an operator revokes it with `fest token revoke <id>`.\n");
+}
+//# sourceMappingURL=logout.js.map

package/dist/cli/logout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../cli/logout.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5D,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,MAAM,GAAG,GAAG,MAAM,aAAa,EAAE,CAAC;IAClC,MAAM,cAAc,EAAE,CAAC;IACvB,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC7C,OAAO;IACT,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,GAAG,CAAC,KAAK,KAAK,CAAC,CAAC;IAChE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+FAA+F,CAAC,CAAC;AACxH,CAAC"}

package/dist/cli/whoami.js

@@ -0,0 +1,34 @@
+/**
+ * `fest whoami`: what's stored locally, plus a live check against the server.
+ */
+import { readCliConfig } from "./config.js";
+const out = (s) => void process.stdout.write(s + "\n");
+export async function runWhoami() {
+    const cfg = await readCliConfig();
+    if (cfg === null) {
+        out("not logged in. Run `fest login` first.");
+        return;
+    }
+    out(`email    : ${cfg.email}`);
+    out(`provider : ${cfg.provider}`);
+    out(`server   : ${cfg.serverUrl}`);
+    try {
+        const res = await fetch(`${cfg.serverUrl}/api/auth/identity`, {
+            headers: { authorization: `Bearer ${cfg.identityToken}` },
+        });
+        if (res.ok) {
+            const body = (await res.json());
+            out(`status   : token is live (server sees ${body.email})`);
+        }
+        else if (res.status === 401) {
+            out("status   : token was revoked or is invalid. Run `fest login` again.");
+        }
+        else {
+            out(`status   : could not confirm (HTTP ${res.status})`);
+        }
+    }
+    catch (err) {
+        out(`status   : could not reach ${cfg.serverUrl} (${err instanceof Error ? err.message : String(err)})`);
+    }
+}
+//# sourceMappingURL=whoami.js.map

package/dist/cli/whoami.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"whoami.js","sourceRoot":"","sources":["../../cli/whoami.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,MAAM,GAAG,GAAG,CAAC,CAAS,EAAQ,EAAE,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AAErE,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,MAAM,GAAG,GAAG,MAAM,aAAa,EAAE,CAAC;IAClC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,GAAG,CAAC,wCAAwC,CAAC,CAAC;QAC9C,OAAO;IACT,CAAC;IAED,GAAG,CAAC,cAAc,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IAC/B,GAAG,CAAC,cAAc,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IAClC,GAAG,CAAC,cAAc,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;IAEnC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,CAAC,SAAS,oBAAoB,EAAE;YAC5D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,CAAC,aAAa,EAAE,EAAE;SAC1D,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAsB,CAAC;YACrD,GAAG,CAAC,yCAAyC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;QAC9D,CAAC;aAAM,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC9B,GAAG,CAAC,qEAAqE,CAAC,CAAC;QAC7E,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,sCAAsC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,8BAA8B,GAAG,CAAC,SAAS,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3G,CAAC;AACH,CAAC"}

package/dist/server/adapters/anthropic.js

@@ -0,0 +1,74 @@
+/**
+ * Anthropic as an EXPLICIT upstream — i.e. an org's own API key, not a
+ * developer's subscription.
+ *
+ * This is not the pass-through path and must not be confused with it. It exists
+ * for the case where an operator deliberately routes some model to Anthropic on
+ * a key the SERVER holds, which is org spend and is recorded as
+ * `fallback_server`. The subscription path never comes through here; it never
+ * touches an adapter at all.
+ */
+import { rewriteModel } from "./rewrite.js";
+import { joinUpstreamUrl } from "./url.js";
+/**
+ * The OAuth beta flag, which must NOT be forwarded from here.
+ *
+ * `oauth-2025-04-20` is the flag that says "this request authenticates with a
+ * Claude subscription OAuth bearer". This path authenticates with an org
+ * `x-api-key`, so sending it asserts something untrue about the credential in
+ * the very same request. The pass-through path forwards the beta list verbatim
+ * for the opposite reason — there the assertion is true, and the set is part of
+ * what the token is validated against.
+ */
+const OAUTH_BETA = "oauth-2025-04-20";
+/** Drop the OAuth flag, keep the order and spelling of everything else. */
+function forwardableBetas(raw) {
+    if (raw === null)
+        return null;
+    const kept = raw
+        .split(",")
+        .map((v) => v.trim())
+        .filter((v) => v !== "" && v !== OAUTH_BETA);
+    return kept.length === 0 ? null : kept.join(", ");
+}
+export const anthropicAdapter = {
+    id: "anthropic",
+    transforms: [
+        "model id rewritten to the configured id",
+        "server-held API key substituted for the caller's credential",
+        "Anthropic beta flags forwarded, except the OAuth one",
+    ],
+    plan(req) {
+        const url = joinUpstreamUrl(req.upstream.baseUrl, req.path);
+        const headers = new Headers({
+            // An org API key goes in x-api-key. Deliberately NOT `authorization`:
+            // that is where a subscription bearer lives, and the two must never be
+            // interchangeable in this codebase even by accident.
+            "x-api-key": req.secret.expose(),
+            "anthropic-version": "2023-06-01",
+            "content-type": "application/json",
+            accept: req.stream ? "text/event-stream" : "application/json",
+            "accept-encoding": "identity",
+            "user-agent": "fest",
+        });
+        /**
+         * Beta flags must ride along, because they are what makes the BODY legal.
+         *
+         * Claude Code sends top-level `context_management`, `output_config` and
+         * `safeguards`, each gated by a beta in this header. Anthropic validates
+         * the body strictly, so dropping the header does not degrade gracefully to
+         * "feature off" — it fails the whole request with
+         * `400 context_management: Extra inputs are not permitted`, on the first
+         * message, for a model the developer legitimately selected.
+         *
+         * Unlike the Fireworks adapter, which drops these because its destination
+         * cannot understand them, this destination IS Anthropic, so the flags mean
+         * exactly what they say.
+         */
+        const betas = forwardableBetas(req.betas);
+        if (betas !== null)
+            headers.set("anthropic-beta", betas);
+        return { url, headers, body: rewriteModel(req.body, req.servedModel) };
+    },
+};
+//# sourceMappingURL=anthropic.js.map

package/dist/server/adapters/anthropic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anthropic.js","sourceRoot":"","sources":["../../../server/adapters/anthropic.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAE3C;;;;;;;;;GASG;AACH,MAAM,UAAU,GAAG,kBAAkB,CAAC;AAEtC,2EAA2E;AAC3E,SAAS,gBAAgB,CAAC,GAAkB;IAC1C,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,IAAI,GAAG,GAAG;SACb,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,UAAU,CAAC,CAAC;IAC/C,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAY;IACvC,EAAE,EAAE,WAAW;IAEf,UAAU,EAAE;QACV,yCAAyC;QACzC,6DAA6D;QAC7D,sDAAsD;KACvD;IAED,IAAI,CAAC,GAAmB;QACtB,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAE5D,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;YAC1B,sEAAsE;YACtE,uEAAuE;YACvE,qDAAqD;YACrD,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE;YAChC,mBAAmB,EAAE,YAAY;YACjC,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,kBAAkB;YAC7D,iBAAiB,EAAE,UAAU;YAC7B,YAAY,EAAE,MAAM;SACrB,CAAC,CAAC;QAEH;;;;;;;;;;;;;WAaG;QACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;QAEzD,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;IACzE,CAAC;CACF,CAAC"}

package/dist/server/adapters/fireworks.js

@@ -0,0 +1,54 @@
+/**
+ * Fireworks.
+ *
+ * The important discovery, and the reason this adapter is twenty lines of
+ * substance rather than a wire-format translator: **Fireworks serves an
+ * Anthropic-compatible Messages API**. `fireconnect` points Claude Code
+ * straight at `https://api.fireworks.ai/inference` as `ANTHROPIC_BASE_URL`,
+ * which only works if `/v1/messages` speaks the Anthropic request and SSE
+ * format. So there is no Anthropic↔OpenAI translation here, and — critically —
+ * no need to re-frame the event stream, which means the existing SSE parser and
+ * usage accumulator keep working unchanged on this path.
+ *
+ * What the adapter therefore does:
+ *
+ *  - swaps the base URL,
+ *  - swaps the credential to the server-held one (`Authorization: Bearer`),
+ *  - rewrites the `model` field to the provider's id.
+ *
+ * That last one is the only body edit, and it is why this path is allowed to
+ * re-serialise the body at all: the request is going to a different vendor on a
+ * different credential, so there is no Anthropic-issued OAuth token whose
+ * signature depends on the exact bytes. The byte-for-byte rule protects the
+ * subscription path; it does not apply here, and pretending otherwise would
+ * make model rewriting impossible.
+ *
+ * ⚠ Not yet verified against the live API — there was no Fireworks key
+ * available when this was written. The compatibility claim is inferred from
+ * `fireconnect`'s configuration, which is strong evidence but not a test.
+ * Integration tests run against a mock. See docs/PHASE4.md.
+ */
+import { rewriteModel } from "./rewrite.js";
+import { joinUpstreamUrl } from "./url.js";
+export const fireworksAdapter = {
+    id: "fireworks",
+    transforms: [
+        "model id rewritten to the provider's id",
+        "server-held credential substituted for the caller's",
+        "Anthropic-specific beta headers dropped",
+    ],
+    plan(req) {
+        const url = joinUpstreamUrl(req.upstream.baseUrl, req.path);
+        const headers = new Headers({
+            // Fireworks authenticates with a bearer, not Anthropic's x-api-key.
+            authorization: `Bearer ${req.secret.expose()}`,
+            "content-type": "application/json",
+            accept: req.stream ? "text/event-stream" : "application/json",
+            // The tee needs unencoded bytes to meter, exactly as on the other path.
+            "accept-encoding": "identity",
+            "user-agent": "fest",
+        });
+        return { url, headers, body: rewriteModel(req.body, req.servedModel) };
+    },
+};
+//# sourceMappingURL=fireworks.js.map

package/dist/server/adapters/fireworks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fireworks.js","sourceRoot":"","sources":["../../../server/adapters/fireworks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAE3C,MAAM,CAAC,MAAM,gBAAgB,GAAY;IACvC,EAAE,EAAE,WAAW;IAEf,UAAU,EAAE;QACV,yCAAyC;QACzC,qDAAqD;QACrD,yCAAyC;KAC1C;IAED,IAAI,CAAC,GAAmB;QACtB,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAE5D,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;YAC1B,oEAAoE;YACpE,aAAa,EAAE,UAAU,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE;YAC9C,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,kBAAkB;YAC7D,wEAAwE;YACxE,iBAAiB,EAAE,UAAU;YAC7B,YAAY,EAAE,MAAM;SACrB,CAAC,CAAC;QAEH,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;IACzE,CAAC;CACF,CAAC"}

package/dist/server/adapters/index.js

@@ -0,0 +1,16 @@
+/**
+ * Provider adapters.
+ *
+ * An adapter's job is narrow by construction: given a validated request that is
+ * already in Anthropic Messages shape, produce the URL, headers and body to
+ * send to one provider, and describe how to read usage back.
+ *
+ * Note what an adapter is NOT allowed to be used for: the pass-through pipeline
+ * does not go through this interface at all. Adapters exist to transform;
+ * `pipeline/passthrough.ts` exists precisely not to. Keeping them apart is what
+ * makes "bytes are forwarded verbatim on the subscription path" a structural
+ * property rather than a convention someone can erode one helpful rewrite at a
+ * time.
+ */
+export {};
+//# sourceMappingURL=index.js.map

package/dist/server/adapters/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../server/adapters/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG"}

package/dist/server/adapters/registry.js

@@ -0,0 +1,38 @@
+/**
+ * Adapter descriptions, separated from the adapters themselves.
+ *
+ * The API layer needs to tell an operator what an adapter changes about a
+ * request, but importing `adapters/fireworks.ts` into the dashboard API would
+ * drag the whole request-building path — and a live secret type — into a module
+ * whose entire job is to emit JSON to a browser. This holds the descriptions
+ * and nothing else.
+ */
+export const ADAPTER_TRANSFORMS = {
+    fireworks: [
+        "model id rewritten to the provider's id",
+        "server-held credential substituted for the caller's",
+        "Anthropic beta headers not forwarded",
+    ],
+    anthropic: [
+        "model id rewritten to the configured id",
+        "server-held API key substituted for the caller's credential",
+        "Anthropic beta flags forwarded, except the OAuth one",
+    ],
+};
+/**
+ * Fest's adapter id → litellm's provider key, for price lookup.
+ *
+ * Needed because a substitute route sends a provider-native model id
+ * (`accounts/fireworks/models/deepseek-v4-pro`) that is ambiguous on its own —
+ * litellm files it under `fireworks_ai/accounts/fireworks/models/deepseek-v4-pro`.
+ *
+ * A new adapter that forgets to add a line here prices its traffic as unknown
+ * rather than as some other vendor's rate. That is the correct failure: an
+ * "n/a" on the dashboard is a question someone asks, and a wrong dollar figure
+ * is one nobody does.
+ */
+export const ADAPTER_PRICE_PROVIDERS = {
+    fireworks: "fireworks_ai",
+    anthropic: "anthropic",
+};
+//# sourceMappingURL=registry.js.map

package/dist/server/adapters/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../server/adapters/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,MAAM,CAAC,MAAM,kBAAkB,GAAmD;IAChF,SAAS,EAAE;QACT,yCAAyC;QACzC,qDAAqD;QACrD,sCAAsC;KACvC;IACD,SAAS,EAAE;QACT,yCAAyC;QACzC,6DAA6D;QAC7D,sDAAsD;KACvD;CACF,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAwC;IAC1E,SAAS,EAAE,cAAc;IACzB,SAAS,EAAE,WAAW;CACvB,CAAC"}

package/dist/server/adapters/rewrite.js

@@ -0,0 +1,152 @@
+/**
+ * Rewrite the `model` field of a request body, and nothing else.
+ *
+ * This is the one body edit Fest performs, and it is confined to the substitute
+ * path. It is safe there and would not be on the pass-through path: an
+ * Anthropic OAuth token is validated against the request shape, so a
+ * parse/re-serialise round trip (which changes key order, whitespace, number
+ * formatting and unicode escaping) can invalidate it. A substitute request goes
+ * to a different vendor on a different credential, so no signature depends on
+ * the bytes.
+ *
+ * The rewrite is still done surgically rather than by round-tripping the whole
+ * document, for two reasons that have nothing to do with signatures:
+ *
+ *  1. **Prompt caching.** `cache_control` markers must survive untouched, and
+ *     the cheapest way to guarantee that is to not re-serialise the parts of
+ *     the body that carry them.
+ *  2. **Size.** A Claude Code request is routinely megabytes of context.
+ *     `JSON.parse` → mutate → `JSON.stringify` copies all of it to change
+ *     twenty bytes, on the request path, for every request.
+ *
+ * So: find the top-level `"model"` string and splice. If anything about the
+ * body is not what we expect, the ORIGINAL bytes are returned unchanged. A
+ * failed rewrite must never corrupt a request — the worst acceptable outcome is
+ * that the provider rejects an unknown model id with its own clear error.
+ */
+/**
+ * Matches a top-level `"model": "..."` pair.
+ *
+ * Anchored to the start of the document and allowed to skip over preceding
+ * members only at nesting depth zero, which is checked separately below — the
+ * regex alone cannot express that, and a naive search would happily rewrite a
+ * `model` key nested inside a tool definition or a message.
+ */
+const MODEL_KEY = /"model"\s*:\s*"((?:[^"\\]|\\.)*)"/g;
+/** JSON string escaping for the replacement value. */
+function jsonString(value) {
+    return JSON.stringify(value);
+}
+/**
+ * Find the offset of the top-level `"model"` key, or -1.
+ *
+ * Walks the document tracking string state and brace/bracket depth, so a
+ * `"model"` inside a nested object, an array, or a string literal is skipped.
+ * This is the difference between rewriting the request's model and silently
+ * rewriting a model name a developer mentioned in a prompt.
+ */
+function findTopLevelModel(text) {
+    MODEL_KEY.lastIndex = 0;
+    let depth = 0;
+    let inString = false;
+    let escaped = false;
+    // Offsets at which a top-level key may begin.
+    const topLevelRanges = [];
+    let rangeStart = -1;
+    for (let i = 0; i < text.length; i += 1) {
+        const ch = text[i];
+        if (inString) {
+            if (escaped)
+                escaped = false;
+            else if (ch === "\\")
+                escaped = true;
+            else if (ch === '"')
+                inString = false;
+            continue;
+        }
+        if (ch === '"') {
+            inString = true;
+            continue;
+        }
+        if (ch === "{" || ch === "[") {
+            depth += 1;
+            if (depth === 1 && ch === "{")
+                rangeStart = i;
+            continue;
+        }
+        if (ch === "}" || ch === "]") {
+            if (depth === 1 && rangeStart !== -1) {
+                topLevelRanges.push([rangeStart, i]);
+                rangeStart = -1;
+            }
+            depth -= 1;
+            continue;
+        }
+    }
+    if (rangeStart !== -1)
+        topLevelRanges.push([rangeStart, text.length]);
+    // Re-scan only the top-level object, tracking depth so nested matches are
+    // rejected rather than merely deprioritised.
+    const range = topLevelRanges[0];
+    if (range === undefined)
+        return null;
+    let d = 0;
+    let str = false;
+    let esc = false;
+    for (let i = range[0]; i < range[1]; i += 1) {
+        const ch = text[i];
+        if (str) {
+            if (esc)
+                esc = false;
+            else if (ch === "\\")
+                esc = true;
+            else if (ch === '"')
+                str = false;
+            continue;
+        }
+        if (ch === "{" || ch === "[") {
+            d += 1;
+            continue;
+        }
+        if (ch === "}" || ch === "]") {
+            d -= 1;
+            continue;
+        }
+        if (ch === '"') {
+            // Only consider a key match when we are directly inside the root object.
+            if (d === 1) {
+                MODEL_KEY.lastIndex = i;
+                const m = MODEL_KEY.exec(text);
+                if (m !== null && m.index === i) {
+                    return { start: i, end: i + m[0].length };
+                }
+            }
+            str = true;
+        }
+    }
+    return null;
+}
+/**
+ * Replace the top-level `model` with `servedModel`.
+ *
+ * Returns the input unchanged when `servedModel` is null, when the body is not
+ * a JSON object, or when no top-level `model` key is present.
+ */
+export function rewriteModel(body, servedModel) {
+    if (servedModel === null || servedModel === "")
+        return body;
+    let text;
+    try {
+        text = new TextDecoder("utf-8", { fatal: true }).decode(body);
+    }
+    catch {
+        // Not UTF-8 text; nothing safe to do but pass it along.
+        return body;
+    }
+    const found = findTopLevelModel(text);
+    if (found === null)
+        return body;
+    const replaced = `${text.slice(0, found.start)}"model": ${jsonString(servedModel)}${text.slice(found.end)}`;
+    return new TextEncoder().encode(replaced);
+}
+//# sourceMappingURL=rewrite.js.map

package/dist/server/adapters/rewrite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rewrite.js","sourceRoot":"","sources":["../../../server/adapters/rewrite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH;;;;;;;GAOG;AACH,MAAM,SAAS,GAAG,oCAAoC,CAAC;AAEvD,sDAAsD;AACtD,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,iBAAiB,CAAC,IAAY;IACrC,SAAS,CAAC,SAAS,GAAG,CAAC,CAAC;IAExB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,8CAA8C;IAC9C,MAAM,cAAc,GAA4B,EAAE,CAAC;IACnD,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC;IAEpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAEnB,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,OAAO;gBAAE,OAAO,GAAG,KAAK,CAAC;iBACxB,IAAI,EAAE,KAAK,IAAI;gBAAE,OAAO,GAAG,IAAI,CAAC;iBAChC,IAAI,EAAE,KAAK,GAAG;gBAAE,QAAQ,GAAG,KAAK,CAAC;YACtC,SAAS;QACX,CAAC;QAED,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,QAAQ,GAAG,IAAI,CAAC;YAChB,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC7B,KAAK,IAAI,CAAC,CAAC;YACX,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,KAAK,GAAG;gBAAE,UAAU,GAAG,CAAC,CAAC;YAC9C,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC7B,IAAI,KAAK,KAAK,CAAC,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;gBACrC,cAAc,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;gBACrC,UAAU,GAAG,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;IACH,CAAC;IACD,IAAI,UAAU,KAAK,CAAC,CAAC;QAAE,cAAc,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAEtE,0EAA0E;IAC1E,6CAA6C;IAC7C,MAAM,KAAK,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAErC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,GAAG,EAAE,CAAC;YACR,IAAI,GAAG;gBAAE,GAAG,GAAG,KAAK,CAAC;iBAChB,IAAI,EAAE,KAAK,IAAI;gBAAE,GAAG,GAAG,IAAI,CAAC;iBAC5B,IAAI,EAAE,KAAK,GAAG;gBAAE,GAAG,GAAG,KAAK,CAAC;YACjC,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC7B,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC7B,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,yEAAyE;YACzE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACZ,SAAS,CAAC,SAAS,GAAG,CAAC,CAAC;gBACxB,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC/B,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;oBAChC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;gBAC5C,CAAC;YACH,CAAC;YACD,GAAG,GAAG,IAAI,CAAC;QACb,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,IAA6B,EAC7B,WAA0B;IAE1B,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAE5D,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,wDAAwD;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEhC,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY,UAAU,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;IAC5G,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC5C,CAAC"}