fest-gateway 0.1.0

package/dist/server/adapters/url.js

@@ -0,0 +1,24 @@
+/**
+ * Join an upstream base URL to an inbound request path.
+ *
+ * Deliberately NOT `new URL(path, base)`. URL resolution treats a path starting
+ * with `/` as absolute and throws away the base's own path, so
+ *
+ *   new URL("/v1/messages", "https://api.fireworks.ai/inference/")
+ *     -> https://api.fireworks.ai/v1/messages          ✗ /inference is gone
+ *
+ * which is a 404 from the provider, at runtime, only for base URLs that carry a
+ * path prefix. A mock upstream at `http://127.0.0.1:PORT` has no prefix, so this
+ * is invisible to tests that do not deliberately use one. It was found by
+ * pointing it at the real Fireworks endpoint.
+ *
+ * So: concatenate, and normalise the seam. `baseUrl` is already stripped of
+ * trailing slashes when the routing table is parsed; this tolerates them anyway
+ * rather than depending on that at a distance.
+ */
+export function joinUpstreamUrl(baseUrl, path) {
+    const base = baseUrl.replace(/\/+$/, "");
+    const suffix = path.startsWith("/") ? path : `/${path}`;
+    return new URL(`${base}${suffix}`);
+}
+//# sourceMappingURL=url.js.map

package/dist/server/adapters/url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url.js","sourceRoot":"","sources":["../../../server/adapters/url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,IAAY;IAC3D,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IACxD,OAAO,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,MAAM,EAAE,CAAC,CAAC;AACrC,CAAC"}

package/dist/server/api/auth.js

@@ -0,0 +1,213 @@
+/**
+ * Sign in, sign out, and "who am I".
+ *
+ * These are the only mutating endpoints Fest exposes over HTTP, so this file
+ * also owns the rules that apply to mutation: the origin check, the login
+ * throttle, and the audit entries.
+ */
+import { authenticate, hasAnyOwner, normaliseEmail } from "../auth/accounts.js";
+import { createSession, revokeSession, serializeCookie, clearedCookie, ABSOLUTE_MS, } from "../auth/session.js";
+import { originAllowed, clientIp, sessionFromRequest } from "../auth/guard.js";
+import { recordAudit } from "../store/audit.js";
+import { log } from "../log.js";
+import { handleOauth } from "./oauth.js";
+import { configuredProviders } from "../auth/oauth.js";
+const MAX_BODY_BYTES = 4 * 1024;
+function json(res, status, body, extra = {}) {
+    res.writeHead(status, { "content-type": "application/json", "cache-control": "no-store", ...extra });
+    res.end(JSON.stringify(body));
+}
+/**
+ * Login throttle, in memory and per (email, ip).
+ *
+ * In memory because Fest is one process per deployment, and putting this in
+ * SQLite would let an unauthenticated caller drive writes into the same
+ * single-writer database the metering flush needs. The trade is that a restart
+ * clears the counters — acceptable against online guessing, which is what this
+ * defends; offline guessing is scrypt's job.
+ */
+const ATTEMPT_WINDOW_MS = 15 * 60_000;
+const MAX_ATTEMPTS = 10;
+const attempts = new Map();
+function throttled(key, now) {
+    const entry = attempts.get(key);
+    if (entry === undefined)
+        return false;
+    if (now - entry.first > ATTEMPT_WINDOW_MS) {
+        attempts.delete(key);
+        return false;
+    }
+    return entry.count >= MAX_ATTEMPTS;
+}
+function noteFailure(key, now) {
+    const entry = attempts.get(key);
+    if (entry === undefined || now - entry.first > ATTEMPT_WINDOW_MS) {
+        attempts.set(key, { count: 1, first: now });
+        return;
+    }
+    entry.count += 1;
+    // Unbounded growth is a memory DoS from unauthenticated input.
+    if (attempts.size > 10_000)
+        attempts.clear();
+}
+export function clearLoginThrottle() {
+    attempts.clear();
+}
+async function readJsonBody(req) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        size += chunk.length;
+        if (size > MAX_BODY_BYTES)
+            return null;
+        chunks.push(chunk);
+    }
+    try {
+        const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+        return typeof parsed === "object" && parsed !== null ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+const str = (v) => (typeof v === "string" ? v : "");
+/**
+ * Handle `/api/auth/*`. Returns false when the path is not ours.
+ *
+ * `session` is passed in rather than re-resolved so there is exactly one place
+ * a cookie is turned into an identity per request.
+ */
+export async function handleAuth(req, res, path, deps, session) {
+    if (!path.startsWith("/api/auth/"))
+        return false;
+    const method = req.method ?? "GET";
+    // OAuth is a redirect-driven, GET-only surface, and Bearer/X-Fest-Token
+    // authenticated on /api/auth/identity — neither fits the POST + Origin +
+    // cookie-session shape the rest of this file enforces, so it's handled
+    // entirely separately.
+    if (await handleOauth(req, res, path, { store: deps.store, orgId: deps.orgId, config: deps.config })) {
+        return true;
+    }
+    if (path === "/api/auth/me" && method === "GET") {
+        json(res, 200, {
+            // Not 401: "am I signed in" is a question an anonymous caller is allowed
+            // to ask, and answering it with an error makes the login page's first
+            // render look like a failure.
+            authenticated: session !== null,
+            ...(session === null
+                ? {}
+                : { user: { id: session.userId, email: session.email, role: session.role } }),
+            // The dashboard shows a setup banner rather than a login form when
+            // nobody has claimed this deployment yet.
+            setupRequired: !hasAnyOwner(deps.store, deps.orgId),
+            oauthProviders: configuredProviders(deps.config),
+        });
+        return true;
+    }
+    if (method !== "POST") {
+        json(res, 405, { error: "method not allowed" });
+        return true;
+    }
+    if (!originAllowed(req)) {
+        json(res, 403, { error: "cross-origin request refused" });
+        return true;
+    }
+    if (path === "/api/auth/login") {
+        await handleLogin(req, res, deps);
+        return true;
+    }
+    if (path === "/api/auth/logout") {
+        if (session !== null) {
+            revokeSession(deps.store, session.sessionId);
+            recordAudit(deps.store, {
+                orgId: deps.orgId,
+                actorUserId: session.userId,
+                actorLabel: session.email,
+                action: "auth.logout",
+                outcome: "ok",
+                ip: clientIp(req),
+            });
+        }
+        // Cleared unconditionally: a request with a stale cookie should come back
+        // without one, whether or not the session was still live.
+        json(res, 200, { ok: true }, { "set-cookie": clearedCookie(deps.secureCookies) });
+        return true;
+    }
+    json(res, 404, { error: `no such endpoint: ${path}` });
+    return true;
+}
+async function handleLogin(req, res, deps) {
+    const body = await readJsonBody(req);
+    if (body === null) {
+        json(res, 400, { error: "expected a small JSON body" });
+        return;
+    }
+    const email = normaliseEmail(str(body["email"]));
+    const password = str(body["password"]);
+    const ip = clientIp(req);
+    const now = Date.now();
+    const key = `${email}|${ip}`;
+    if (email === "" || password === "") {
+        json(res, 400, { error: "email and password are required" });
+        return;
+    }
+    if (throttled(key, now)) {
+        recordAudit(deps.store, {
+            orgId: deps.orgId,
+            actorLabel: email,
+            action: "auth.login",
+            outcome: "denied",
+            detail: { reason: "throttled" },
+            ip,
+        });
+        // 429 and not 401: a caller being rate-limited needs to know that retrying
+        // with better credentials will not help until the window passes.
+        json(res, 429, { error: "too many attempts; try again later" });
+        return;
+    }
+    const outcome = await authenticate(deps.store, deps.orgId, email, password);
+    if (!outcome.ok || outcome.user === null) {
+        noteFailure(key, now);
+        // The reason is recorded for the operator and withheld from the client:
+        // "no such account" vs "wrong password" is an account enumeration oracle.
+        recordAudit(deps.store, {
+            orgId: deps.orgId,
+            actorLabel: email,
+            action: "auth.login",
+            outcome: "denied",
+            detail: { reason: outcome.reason },
+            ip,
+        });
+        log.warn("login failed", { email, reason: outcome.reason, ip });
+        json(res, 401, { error: "invalid email or password" });
+        return;
+    }
+    attempts.delete(key);
+    const created = createSession(deps.store, {
+        orgId: deps.orgId,
+        userId: outcome.user.id,
+        userAgent: String(req.headers["user-agent"] ?? ""),
+        ip,
+    });
+    recordAudit(deps.store, {
+        orgId: deps.orgId,
+        actorUserId: outcome.user.id,
+        actorLabel: outcome.user.email,
+        action: "auth.login",
+        target: created.sessionId,
+        outcome: "ok",
+        ip,
+    });
+    json(res, 200, {
+        authenticated: true,
+        user: { id: outcome.user.id, email: outcome.user.email, role: outcome.user.role },
+        setupRequired: false,
+        oauthProviders: configuredProviders(deps.config),
+    }, {
+        "set-cookie": serializeCookie(created.raw, {
+            secure: deps.secureCookies,
+            maxAgeSeconds: Math.floor(ABSOLUTE_MS / 1000),
+        }),
+    });
+}
+//# sourceMappingURL=auth.js.map

package/dist/server/api/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../server/api/auth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAChF,OAAO,EACL,aAAa,EACb,aAAa,EACb,eAAe,EACf,aAAa,EACb,WAAW,GACZ,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAGhC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,CAAC;AAShC,SAAS,IAAI,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa,EAAE,QAAgC,EAAE;IAClG,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;IACrG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,iBAAiB,GAAG,EAAE,GAAG,MAAM,CAAC;AACtC,MAAM,YAAY,GAAG,EAAE,CAAC;AACxB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA4C,CAAC;AAErE,SAAS,SAAS,CAAC,GAAW,EAAE,GAAW;IACzC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,GAAG,GAAG,KAAK,CAAC,KAAK,GAAG,iBAAiB,EAAE,CAAC;QAC1C,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,IAAI,YAAY,CAAC;AACrC,CAAC;AAED,SAAS,WAAW,CAAC,GAAW,EAAE,GAAW;IAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,KAAK,SAAS,IAAI,GAAG,GAAG,KAAK,CAAC,KAAK,GAAG,iBAAiB,EAAE,CAAC;QACjE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5C,OAAO;IACT,CAAC;IACD,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;IACjB,+DAA+D;IAC/D,IAAI,QAAQ,CAAC,IAAI,GAAG,MAAM;QAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,QAAQ,CAAC,KAAK,EAAE,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,GAAoB;IAC9C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,IAAI,IAAK,KAAgB,CAAC,MAAM,CAAC;QACjC,IAAI,IAAI,GAAG,cAAc;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3E,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAErE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAoB,EACpB,GAAmB,EACnB,IAAY,EACZ,IAAc,EACd,OAAuB;IAEvB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;IAEnC,wEAAwE;IACxE,yEAAyE;IACzE,uEAAuE;IACvE,uBAAuB;IACvB,IAAI,MAAM,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;QACrG,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,IAAI,KAAK,cAAc,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QAChD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;YACb,yEAAyE;YACzE,sEAAsE;YACtE,8BAA8B;YAC9B,aAAa,EAAE,OAAO,KAAK,IAAI;YAC/B,GAAG,CAAC,OAAO,KAAK,IAAI;gBAClB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YAC/E,mEAAmE;YACnE,0CAA0C;YAC1C,aAAa,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC;YACnD,cAAc,EAAE,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC;SAC5B,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC/B,MAAM,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAChC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;YAC7C,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE;gBACtB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,WAAW,EAAE,OAAO,CAAC,MAAM;gBAC3B,UAAU,EAAE,OAAO,CAAC,KAAK;gBACzB,MAAM,EAAE,aAAa;gBACrB,OAAO,EAAE,IAAI;gBACb,EAAE,EAAE,QAAQ,CAAC,GAAG,CAAC;aAClB,CAAC,CAAC;QACL,CAAC;QACD,0EAA0E;QAC1E,0DAA0D;QAC1D,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,YAAY,EAAE,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,qBAAqB,IAAI,EAAE,EAAE,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAoB,EAAE,GAAmB,EAAE,IAAc;IAClF,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;QACxD,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IACvC,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,GAAG,KAAK,IAAI,EAAE,EAAE,CAAC;IAE7B,IAAI,KAAK,KAAK,EAAE,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QACpC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC7D,OAAO;IACT,CAAC;IAED,IAAI,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;QACxB,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE;YACtB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU,EAAE,KAAK;YACjB,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;YAC/B,EAAE;SACH,CAAC,CAAC;QACH,2EAA2E;QAC3E,iEAAiE;QACjE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;QAChE,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC5E,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACzC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtB,wEAAwE;QACxE,0EAA0E;QAC1E,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE;YACtB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU,EAAE,KAAK;YACjB,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;YAClC,EAAE;SACH,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACvD,OAAO;IACT,CAAC;IAED,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACrB,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE;QACxC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;QACvB,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAClD,EAAE;KACH,CAAC,CAAC;IAEH,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE;QACtB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;QAC5B,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK;QAC9B,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,OAAO,CAAC,SAAS;QACzB,OAAO,EAAE,IAAI;QACb,EAAE;KACH,CAAC,CAAC;IAEH,IAAI,CACF,GAAG,EACH,GAAG,EACH;QACE,aAAa,EAAE,IAAI;QACnB,IAAI,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE;QACjF,aAAa,EAAE,KAAK;QACpB,cAAc,EAAE,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC;KAC5B,EACtB;QACE,YAAY,EAAE,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE;YACzC,MAAM,EAAE,IAAI,CAAC,aAAa;YAC1B,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC;SAC9C,CAAC;KACH,CACF,CAAC;AACJ,CAAC"}

package/dist/server/api/live.js

@@ -0,0 +1,108 @@
+/**
+ * `GET /api/live` — server-sent events for the dashboard's live feed.
+ *
+ * Subscribes to the flush-time bus, so nothing here can ever run on a
+ * developer's request path. See `ingest/live-bus.ts` for why that seam exists.
+ *
+ * Backpressure: a browser tab that stops reading makes the kernel socket buffer
+ * fill, and `res.write` starts queueing in userspace. Rather than let that grow,
+ * the subscriber refuses a frame once `writableLength` exceeds a modest high
+ * water mark and returns false, which the bus counts as a drop. A dashboard
+ * that falls behind loses the tail of its live view and keeps its authoritative
+ * history in `/api/requests` — that trade is the right way round.
+ *
+ * The anti-buffering headers are the same set the proxy path uses; without them
+ * a reverse proxy will happily hold these frames for a minute and the feed will
+ * look broken in exactly the deployment where you cannot debug it.
+ */
+/** Beyond this many bytes pending, the client is not keeping up. */
+const HIGH_WATER_MARK = 1 << 20;
+const HEARTBEAT_MS = 20_000;
+/**
+ * Project a usage record onto the feed row the dashboard renders.
+ *
+ * Explicit field-by-field, not a spread: `UsageRecord` carries fields the
+ * dashboard has no business seeing (`callerFingerprint`, `tokenId`,
+ * `errorMessage`, upstream ids), and a spread would ship every future field
+ * added to the record straight to the browser. Enumerating them means a new
+ * record field is invisible until someone decides it should be visible.
+ */
+export function toLiveRow(rec) {
+    return {
+        seq: null,
+        id: rec.id,
+        startedAt: rec.startedAt,
+        userId: rec.userId,
+        sessionId: rec.sessionId,
+        requestedModel: rec.requestedModel,
+        servedModel: rec.servedModel,
+        posture: rec.posture,
+        credentialOrigin: rec.credentialOrigin,
+        credentialFingerprint: rec.credentialFingerprint,
+        status: rec.status,
+        httpStatus: rec.httpStatus,
+        errorType: rec.errorType ?? null,
+        stream: rec.stream,
+        partial: rec.partial,
+        usage: rec.usage,
+        costUsd: rec.costUsd,
+        costBasis: rec.costBasis,
+        notionalCostUsd: rec.notionalCostUsd,
+        ttfbMs: rec.ttfbMs,
+        durationMs: rec.durationMs,
+        rl5hUtilization: rec.rateLimit?.fiveHourUtilization ?? null,
+        rlClaim: rec.rateLimit?.representativeClaim ?? null,
+        clientVersion: rec.clientVersion,
+        pipeline: rec.pipeline,
+        routeId: rec.routeId,
+        credentialsConsidered: rec.credentialsConsidered,
+    };
+}
+export function handleLive(req, res, bus) {
+    res.writeHead(200, {
+        "content-type": "text/event-stream",
+        "cache-control": "no-cache, no-transform",
+        connection: "keep-alive",
+        "x-accel-buffering": "no",
+    });
+    res.socket?.setNoDelay(true);
+    res.flushHeaders();
+    // An immediate comment gives EventSource something to see, so the browser
+    // reports "open" rather than sitting in "connecting" until the first request
+    // happens to arrive — which on a quiet gateway could be hours.
+    res.write(": connected\n\n");
+    const unsubscribe = bus.subscribe((records) => {
+        if (res.writableEnded)
+            return false;
+        if (res.writableLength > HIGH_WATER_MARK)
+            return false;
+        const frame = { rows: records.map(toLiveRow) };
+        res.write(`event: usage\ndata: ${JSON.stringify(frame)}\n\n`);
+        return true;
+    }, 
+    // Shutdown hook: an event stream never ends on its own, so the server must
+    // be able to hang up on us or `server.close()` waits forever.
+    () => {
+        if (!res.writableEnded) {
+            // A comment, not an error: the client's EventSource will reconnect on
+            // its own once the new process is listening, which under --watch is
+            // about a second.
+            res.write(": server shutting down\n\n");
+            res.end();
+        }
+    });
+    // Proxies and load balancers close idle connections; a comment costs three
+    // bytes and keeps the stream alive through them.
+    const heartbeat = setInterval(() => {
+        if (!res.writableEnded)
+            res.write(": ping\n\n");
+    }, HEARTBEAT_MS);
+    heartbeat.unref();
+    const close = () => {
+        clearInterval(heartbeat);
+        unsubscribe();
+    };
+    res.on("close", close);
+    req.on("aborted", close);
+}
+//# sourceMappingURL=live.js.map

package/dist/server/api/live.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"live.js","sourceRoot":"","sources":["../../../server/api/live.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAOH,oEAAoE;AACpE,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,CAAC;AAChC,MAAM,YAAY,GAAG,MAAM,CAAC;AAE5B;;;;;;;;GAQG;AACH,MAAM,UAAU,SAAS,CAAC,GAAgB;IACxC,OAAO;QACL,GAAG,EAAE,IAAI;QACT,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;QACtC,qBAAqB,EAAE,GAAG,CAAC,qBAAqB;QAChD,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;QAChC,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,eAAe,EAAE,GAAG,CAAC,eAAe;QACpC,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,eAAe,EAAE,GAAG,CAAC,SAAS,EAAE,mBAAmB,IAAI,IAAI;QAC3D,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,mBAAmB,IAAI,IAAI;QACnD,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,qBAAqB,EAAE,GAAG,CAAC,qBAAqB;KACjD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAoB,EAAE,GAAmB,EAAE,GAAY;IAChF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;QACjB,cAAc,EAAE,mBAAmB;QACnC,eAAe,EAAE,wBAAwB;QACzC,UAAU,EAAE,YAAY;QACxB,mBAAmB,EAAE,IAAI;KAC1B,CAAC,CAAC;IACH,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;IAC7B,GAAG,CAAC,YAAY,EAAE,CAAC;IACnB,0EAA0E;IAC1E,6EAA6E;IAC7E,+DAA+D;IAC/D,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAE7B,MAAM,WAAW,GAAG,GAAG,CAAC,SAAS,CAC/B,CAAC,OAAO,EAAE,EAAE;QACV,IAAI,GAAG,CAAC,aAAa;YAAE,OAAO,KAAK,CAAC;QACpC,IAAI,GAAG,CAAC,cAAc,GAAG,eAAe;YAAE,OAAO,KAAK,CAAC;QACvD,MAAM,KAAK,GAAc,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,KAAK,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,2EAA2E;IAC3E,8DAA8D;IAC9D,GAAG,EAAE;QACH,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;YACvB,sEAAsE;YACtE,oEAAoE;YACpE,kBAAkB;YAClB,GAAG,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;YACxC,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CACF,CAAC;IAEF,2EAA2E;IAC3E,iDAAiD;IACjD,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;QACjC,IAAI,CAAC,GAAG,CAAC,aAAa;YAAE,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAClD,CAAC,EAAE,YAAY,CAAC,CAAC;IACjB,SAAS,CAAC,KAAK,EAAE,CAAC;IAElB,MAAM,KAAK,GAAG,GAAS,EAAE;QACvB,aAAa,CAAC,SAAS,CAAC,CAAC;QACzB,WAAW,EAAE,CAAC;IAChB,CAAC,CAAC;IACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACvB,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;AAC3B,CAAC"}

package/dist/server/api/models.js

@@ -0,0 +1,129 @@
+/**
+ * `GET /v1/models` — the model menu Claude Code shows under `/model`.
+ *
+ * Claude Code fetches `{base}/v1/models?limit=1000`, expects
+ * `{"data":[{id, display_name?, description?}]}`, and renders the result
+ * labelled "From gateway". Three details, all verified against the client and
+ * all easy to get wrong:
+ *
+ *  1. **Ids are filtered client-side by `/(claude|anthropic)/i`.** A menu entry
+ *     whose id does not match that pattern is silently dropped. So a route to
+ *     `accounts/fireworks/models/kimi-k2p7-code` must be published under the id
+ *     the developer actually types — the route's `match` — not the provider's
+ *     id. That is also the correct thing semantically: `match` is what the
+ *     client sends, and the rewrite is Fest's business, not theirs.
+ *  2. **The default timeout is 3 seconds.** This handler therefore touches no
+ *     network and no database — it is a projection of already-parsed config.
+ *  3. **The response is cached by the client** at `<cache>/gateway-models.json`
+ *     (mode 0600), so a stale menu outlives a restart. `ETag` is served from the
+ *     routing table's content hash to make that cache correct rather than
+ *     merely fast.
+ *  4. **Entries are DEDUPED against the client's built-in list.** Publishing
+ *     `claude-sonnet-5` collides with the built-in Sonnet and is dropped
+ *     silently — so a substituted model never shows its destination in the
+ *     picker, which is the one place a developer would notice. Verified by
+ *     reading the merge in 2.1.278: gateway options are added only
+ *     `if(!s.some((he)=>uT(he,U)))`. A route's `expose` alias exists to survive
+ *     that: a distinct id like `claude-sonnet-5-fireworks` appears, labelled,
+ *     and routes to the same place.
+ *
+ * ⚠ Discovery is also gated on **`CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY`**
+ * being set on the CLIENT. Without it the client never calls this endpoint at
+ * all — confirmed empirically (zero requests) and in the binary
+ * (`[Bootstrap] Skipped gateway /v1/models (… not set)`).
+ *
+ * ⚠ Discovery only happens in the KEY posture. It requires a credential in
+ * `ANTHROPIC_AUTH_TOKEN` / `apiKeyHelper` / an API key — which is precisely what
+ * disables subscription auth. In 2.1.278 a server-published menu and
+ * subscription pass-through are mutually exclusive. Do not design around having
+ * both.
+ */
+// The menu is reached ONLY in the key posture — discovery requires a credential
+// that disables subscription auth — so the resolver that assumes no caller
+// credential is the one the request path will actually use. Using the plain
+// `resolveRoute` here would omit every model served by the `anthropic` default,
+// i.e. advertise less than the gateway can serve.
+import { resolveWithoutCallerCredential } from "../routes/resolve.js";
+// Anthropic's own current models, offered as menu candidates when a route does
+// not already cover them. Shared with the `fest claude` preflight, which warns
+// about any of them this gateway cannot serve — one list, so the menu and the
+// warning cannot drift apart.
+import { BASE_MODELS } from "../../shared/base-models.js";
+/** Claude Code drops any id that does not look Anthropic-ish. */
+const CLIENT_VISIBLE = /(claude|anthropic)/i;
+/**
+ * The menu must advertise only what this gateway can actually serve.
+ *
+ * `/v1/models` is reached ONLY in the key posture — discovery requires a
+ * credential that disables subscription auth — and in that posture there is no
+ * caller credential to fall back on. So any published id without a route to a
+ * server-held credential is a guaranteed failure the moment someone selects it.
+ *
+ * The first version published Anthropic's built-in models unconditionally
+ * "so routing never loses Opus". That was exactly backwards: it produced a menu
+ * entry that 401s on selection. A menu is a promise, and this one must only
+ * promise what it can keep.
+ */
+export function buildModelMenu(table) {
+    const candidates = new Map();
+    for (const model of BASE_MODELS)
+        candidates.set(model.id, model.name);
+    for (const route of table.routes) {
+        if (!route.match.includes("*"))
+            candidates.set(route.match, candidates.get(route.match) ?? route.match);
+        // An alias exists precisely to survive the client's dedupe, so it is always
+        // a candidate.
+        if (route.expose !== null)
+            candidates.set(route.expose, route.expose);
+    }
+    const entries = [];
+    for (const [id, name] of candidates) {
+        // Client-side, Claude Code drops any id not matching /(claude|anthropic)/i,
+        // so publishing one would make the entry vanish rather than appear.
+        if (!CLIENT_VISIBLE.test(id))
+            continue;
+        // Resolve through the REAL router rather than re-implementing matching, so
+        // the menu and the request path cannot disagree.
+        const decision = resolveWithoutCallerCredential(table, id);
+        // Unservable in this posture — do not offer it.
+        if (decision.pipeline !== "substitute" || decision.upstream === null)
+            continue;
+        entries.push({
+            type: "model",
+            id,
+            // Naming the destination is the point. A developer choosing "Sonnet 5"
+            // and silently getting Kimi is the substitution this project exists to
+            // prevent, and the model picker is the first place they would not notice.
+            display_name: `${name} → ${decision.upstream.id}`,
+            created_at: "1970-01-01T00:00:00Z",
+        });
+    }
+    return entries;
+}
+export function handleModels(res, table, ifNoneMatch) {
+    const models = buildModelMenu(table);
+    // Nothing to offer: 404 rather than an empty list. The client treats 404 as
+    // "no gateway menu" and falls back to its own built-in models — which is both
+    // documented behaviour and the right outcome, since an empty `data` array
+    // would leave a developer with a picker that offers nothing.
+    if (models.length === 0) {
+        res.writeHead(404, { "content-type": "application/json", "x-should-retry": "false" });
+        res.end(JSON.stringify({ type: "error", error: { type: "not_found_error", message: "no gateway models configured" } }));
+        return;
+    }
+    const etag = `"models-${table.version}"`;
+    if (ifNoneMatch === etag) {
+        res.writeHead(304, { etag });
+        res.end();
+        return;
+    }
+    res.writeHead(200, {
+        "content-type": "application/json",
+        etag,
+        // The menu changes only when routing config does, and the client caches it
+        // to disk anyway.
+        "cache-control": "no-cache",
+    });
+    res.end(JSON.stringify({ data: models, has_more: false, first_id: null, last_id: null }));
+}
+//# sourceMappingURL=models.js.map

package/dist/server/api/models.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"models.js","sourceRoot":"","sources":["../../../server/api/models.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAIH,gFAAgF;AAChF,2EAA2E;AAC3E,4EAA4E;AAC5E,gFAAgF;AAChF,kDAAkD;AAClD,OAAO,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAC;AACtE,+EAA+E;AAC/E,+EAA+E;AAC/E,8EAA8E;AAC9E,8BAA8B;AAC9B,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAS1D,iEAAiE;AACjE,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAE7C;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAAC,KAAiB;IAC9C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,KAAK,MAAM,KAAK,IAAI,WAAW;QAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACtE,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;QACxG,4EAA4E;QAC5E,eAAe;QACf,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;YAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,UAAU,EAAE,CAAC;QACpC,4EAA4E;QAC5E,oEAAoE;QACpE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,SAAS;QAEvC,2EAA2E;QAC3E,iDAAiD;QACjD,MAAM,QAAQ,GAAG,8BAA8B,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAE3D,gDAAgD;QAChD,IAAI,QAAQ,CAAC,QAAQ,KAAK,YAAY,IAAI,QAAQ,CAAC,QAAQ,KAAK,IAAI;YAAE,SAAS;QAE/E,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,OAAO;YACb,EAAE;YACF,uEAAuE;YACvE,uEAAuE;YACvE,0EAA0E;YAC1E,YAAY,EAAE,GAAG,IAAI,MAAM,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE;YACjD,UAAU,EAAE,sBAAsB;SACnC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAmB,EAAE,KAAiB,EAAE,WAAoB;IACvF,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAErC,4EAA4E;IAC5E,8EAA8E;IAC9E,0EAA0E;IAC1E,6DAA6D;IAC7D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,CAAC;QACtF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,8BAA8B,EAAE,EAAE,CAAC,CAAC,CAAC;QACxH,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,WAAW,KAAK,CAAC,OAAO,GAAG,CAAC;IACzC,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7B,GAAG,CAAC,GAAG,EAAE,CAAC;QACV,OAAO;IACT,CAAC;IACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;QACjB,cAAc,EAAE,kBAAkB;QAClC,IAAI;QACJ,2EAA2E;QAC3E,kBAAkB;QAClB,eAAe,EAAE,UAAU;KAC5B,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC5F,CAAC"}