fest-gateway 0.1.0

package/dist/server/http/sse.js

@@ -0,0 +1,167 @@
+/**
+ * Incremental server-sent-event parser for the proxy's observation path.
+ *
+ * This parser is a *passive observer*. Upstream bytes are written to the client
+ * before they are ever handed here, so nothing in this file may mutate a chunk,
+ * throw on malformed input, or retain more than the event currently being
+ * assembled. A metering bug must never be able to damage a proxied request.
+ *
+ * Two independent kinds of chunk boundary have to survive, and both have caused
+ * real flaky metering:
+ *
+ *  1. A boundary mid-line — `data: {"usa` / `ge":{...}}\n\n`. Handled by the
+ *     `pending` line remainder.
+ *  2. A boundary mid-UTF-8-code-point — a 3-byte `→` arriving as 2 bytes then
+ *     1 byte. Handled by a *persistent* StringDecoder, which holds the partial
+ *     code point across calls. Do not replace it with `Buffer.toString("utf8")`
+ *     or `TextDecoder` without `{ stream: true }`: both would emit U+FFFD at
+ *     the split and silently corrupt the JSON that follows.
+ */
+import { StringDecoder } from "node:string_decoder";
+import { USAGE_EVENT_TYPES } from "../../shared/types.js";
+/**
+ * Cap on the data accumulated for a single event. A well-behaved Anthropic
+ * event is a few hundred bytes; anything past this is either a hostile upstream
+ * or a stream missing its blank-line separators. We drop the excess rather than
+ * throw, because losing usage for one request is strictly better than failing it.
+ */
+const MAX_EVENT_DATA_CHARS = 1024 * 1024;
+const DEFAULT_TYPE = "message";
+export function createSseParser(opts) {
+    const interesting = opts?.interestingTypes ?? USAGE_EVENT_TYPES;
+    const decoder = new StringDecoder("utf8");
+    /** Tail of the last chunk that did not end on a newline. */
+    let pending = "";
+    // ── Current event state ──
+    let eventType = null;
+    let dataParts = [];
+    let dataChars = 0;
+    let sawAnyField = false;
+    /**
+     * Set once we know this event's type is uninteresting. From that point its
+     * `data:` lines are counted but never retained — content deltas are the
+     * overwhelming bulk of stream bytes, and joining them would make the observer
+     * cost scale with the response body rather than with the usage metadata.
+     *
+     * Note we cannot decide this before the `event:` line is seen, because an
+     * event with no `event:` field defaults to "message". Anthropic always sends
+     * `event:` first, so in practice the drop begins before any data is held.
+     */
+    let dropData = false;
+    function resetEvent() {
+        eventType = null;
+        dataParts = [];
+        dataChars = 0;
+        sawAnyField = false;
+        dropData = false;
+    }
+    function isInteresting(type) {
+        return interesting.has(type);
+    }
+    /** Emit the assembled event if it is one we care about, then reset. */
+    function dispatch(out) {
+        if (!sawAnyField) {
+            // A stray blank line between events, or leading whitespace. Not an event.
+            resetEvent();
+            return;
+        }
+        const type = eventType ?? DEFAULT_TYPE;
+        if (isInteresting(type))
+            out.push({ type, data: dataParts.join("\n") });
+        resetEvent();
+    }
+    function handleLine(line, out) {
+        if (line.length === 0) {
+            dispatch(out);
+            return;
+        }
+        // ":" prefix is an SSE comment (Anthropic sends none, but proxies inject
+        // heartbeat comments). Never treat it as a field.
+        if (line.charCodeAt(0) === 58 /* : */)
+            return;
+        const colon = line.indexOf(":");
+        const field = colon === -1 ? line : line.slice(0, colon);
+        let value = colon === -1 ? "" : line.slice(colon + 1);
+        // Exactly one optional leading space is part of the framing, not the value.
+        if (value.charCodeAt(0) === 32)
+            value = value.slice(1);
+        if (field === "event") {
+            sawAnyField = true;
+            eventType = value;
+            if (!isInteresting(value)) {
+                // Release anything buffered before the type was known.
+                dropData = true;
+                dataParts = [];
+            }
+            return;
+        }
+        if (field === "data") {
+            sawAnyField = true;
+            if (dropData)
+                return;
+            if (dataChars + value.length > MAX_EVENT_DATA_CHARS) {
+                // Past the cap we stop retaining. The event is still emitted, and the
+                // usage accumulator will reject the truncated JSON on its own.
+                dropData = true;
+                dataParts = [];
+                return;
+            }
+            dataChars += value.length;
+            dataParts.push(value);
+            return;
+        }
+        // `id:` and `retry:` are valid framing we have no use for. Marking the
+        // event as "seen" keeps an id-only event from leaking into the next one.
+        if (field === "id" || field === "retry") {
+            sawAnyField = true;
+            return;
+        }
+        // Unknown field: ignore per the SSE spec.
+    }
+    function consume(text, out) {
+        if (text.length === 0)
+            return;
+        let start = 0;
+        for (;;) {
+            const nl = text.indexOf("\n", start);
+            if (nl === -1)
+                break;
+            let line = pending.length > 0 ? pending + text.slice(start, nl) : text.slice(start, nl);
+            pending = "";
+            start = nl + 1;
+            // Accept CRLF as well as LF. The CR is stripped from the *assembled*
+            // line, not from the chunk, because a chunk boundary can fall between
+            // the CR and the LF — in which case the CR is the tail of `pending`.
+            if (line.charCodeAt(line.length - 1) === 13 /* \r */)
+                line = line.slice(0, -1);
+            handleLine(line, out);
+        }
+        if (start < text.length)
+            pending += text.slice(start);
+    }
+    return {
+        push(chunk) {
+            const out = [];
+            // Buffer.from here is a view-free copy of the caller's bytes; we never
+            // write through it, so the forwarded chunk cannot be disturbed.
+            consume(decoder.write(Buffer.from(chunk.buffer, chunk.byteOffset, chunk.byteLength)), out);
+            return out;
+        },
+        flush() {
+            const out = [];
+            // end() yields any bytes the decoder was holding. An incomplete code
+            // point at true end-of-stream becomes U+FFFD, which is correct: the
+            // stream really was truncated.
+            consume(decoder.end(), out);
+            if (pending.length > 0) {
+                const line = pending;
+                pending = "";
+                handleLine(line, out);
+            }
+            // A stream that ends without its final blank line still produced an event.
+            dispatch(out);
+            return out;
+        },
+    };
+}
+//# sourceMappingURL=sse.js.map

package/dist/server/http/sse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse.js","sourceRoot":"","sources":["../../../server/http/sse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAiB,MAAM,uBAAuB,CAAC;AASzE;;;;;GAKG;AACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,IAAI,CAAC;AAEzC,MAAM,YAAY,GAAG,SAAS,CAAC;AAE/B,MAAM,UAAU,eAAe,CAAC,IAAiD;IAC/E,MAAM,WAAW,GAAG,IAAI,EAAE,gBAAgB,IAAI,iBAAiB,CAAC;IAChE,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;IAE1C,4DAA4D;IAC5D,IAAI,OAAO,GAAG,EAAE,CAAC;IAEjB,4BAA4B;IAC5B,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,SAAS,GAAa,EAAE,CAAC;IAC7B,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB;;;;;;;;;OASG;IACH,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,SAAS,UAAU;QACjB,SAAS,GAAG,IAAI,CAAC;QACjB,SAAS,GAAG,EAAE,CAAC;QACf,SAAS,GAAG,CAAC,CAAC;QACd,WAAW,GAAG,KAAK,CAAC;QACpB,QAAQ,GAAG,KAAK,CAAC;IACnB,CAAC;IAED,SAAS,aAAa,CAAC,IAAY;QACjC,OAAO,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,uEAAuE;IACvE,SAAS,QAAQ,CAAC,GAAe;QAC/B,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,0EAA0E;YAC1E,UAAU,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,SAAS,IAAI,YAAY,CAAC;QACvC,IAAI,aAAa,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxE,UAAU,EAAE,CAAC;IACf,CAAC;IAED,SAAS,UAAU,CAAC,IAAY,EAAE,GAAe;QAC/C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,QAAQ,CAAC,GAAG,CAAC,CAAC;YACd,OAAO;QACT,CAAC;QACD,yEAAyE;QACzE,kDAAkD;QAClD,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,OAAO;YAAE,OAAO;QAE9C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,KAAK,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACzD,IAAI,KAAK,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACtD,4EAA4E;QAC5E,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE;YAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAEvD,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;YACtB,WAAW,GAAG,IAAI,CAAC;YACnB,SAAS,GAAG,KAAK,CAAC;YAClB,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1B,uDAAuD;gBACvD,QAAQ,GAAG,IAAI,CAAC;gBAChB,SAAS,GAAG,EAAE,CAAC;YACjB,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YACrB,WAAW,GAAG,IAAI,CAAC;YACnB,IAAI,QAAQ;gBAAE,OAAO;YACrB,IAAI,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;gBACpD,sEAAsE;gBACtE,+DAA+D;gBAC/D,QAAQ,GAAG,IAAI,CAAC;gBAChB,SAAS,GAAG,EAAE,CAAC;gBACf,OAAO;YACT,CAAC;YACD,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;YAC1B,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACtB,OAAO;QACT,CAAC;QACD,uEAAuE;QACvE,yEAAyE;QACzE,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;YACxC,WAAW,GAAG,IAAI,CAAC;YACnB,OAAO;QACT,CAAC;QACD,0CAA0C;IAC5C,CAAC;IAED,SAAS,OAAO,CAAC,IAAY,EAAE,GAAe;QAC5C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC9B,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,SAAS,CAAC;YACR,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACrC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAAE,MAAM;YACrB,IAAI,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACxF,OAAO,GAAG,EAAE,CAAC;YACb,KAAK,GAAG,EAAE,GAAG,CAAC,CAAC;YACf,qEAAqE;YACrE,sEAAsE;YACtE,qEAAqE;YACrE,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ;gBAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC/E,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,KAAK,GAAG,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC;IAED,OAAO;QACL,IAAI,CAAC,KAAiB;YACpB,MAAM,GAAG,GAAe,EAAE,CAAC;YAC3B,uEAAuE;YACvE,gEAAgE;YAChE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC3F,OAAO,GAAG,CAAC;QACb,CAAC;QAED,KAAK;YACH,MAAM,GAAG,GAAe,EAAE,CAAC;YAC3B,qEAAqE;YACrE,oEAAoE;YACpE,+BAA+B;YAC/B,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;YAC5B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,GAAG,OAAO,CAAC;gBACrB,OAAO,GAAG,EAAE,CAAC;gBACb,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACxB,CAAC;YACD,2EAA2E;YAC3E,QAAQ,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,GAAG,CAAC;QACb,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/server/http/static.js

@@ -0,0 +1,138 @@
+/**
+ * Static hosting for the built dashboard (`web/dist`).
+ *
+ * Optional by design: if the bundle has not been built, this returns false for
+ * everything and the gateway runs headless. A proxy that refuses to start
+ * because a dashboard asset is missing would be a self-inflicted outage on the
+ * one path that must never go down.
+ *
+ * Path handling is the whole security surface here, so it is done once, at the
+ * top: resolve the candidate and require the result to still be inside the
+ * root. `..` in a URL, a percent-encoded `%2e%2e`, and an absolute path all
+ * collapse to the same check rather than three separate ones that can disagree.
+ *
+ * The SPA fallback deliberately does NOT catch everything. An unknown
+ * `/v1/whatever` must keep reaching the 404 in `server.ts`, because that warn
+ * line is how a new Claude Code endpoint gets noticed before users hit it —
+ * answering it with an HTML page would hide exactly the signal we built it for.
+ */
+import { createReadStream, readFileSync, statSync } from "node:fs";
+import { extname, join, normalize, resolve, sep } from "node:path";
+const TYPES = {
+    ".html": "text/html; charset=utf-8",
+    ".js": "text/javascript; charset=utf-8",
+    ".css": "text/css; charset=utf-8",
+    ".json": "application/json; charset=utf-8",
+    ".svg": "image/svg+xml",
+    ".png": "image/png",
+    ".ico": "image/x-icon",
+    ".woff2": "font/woff2",
+    ".map": "application/json; charset=utf-8",
+};
+function fileSize(path) {
+    try {
+        const st = statSync(path);
+        return st.isFile() ? st.size : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Point the document's `<base href>` at wherever Fest is actually mounted.
+ *
+ * The built bundle is emitted with `base: "./"`, so its asset URLs are already
+ * relative; what they resolve *against* is this tag. Rewriting it here rather
+ * than at build time is what keeps one artifact servable from `/` and from
+ * `/fest` — including when a reader arrives at `/fest` with no trailing slash,
+ * where the document's own URL would otherwise resolve `./assets/…` against
+ * the origin root and 404.
+ */
+export function withBaseHref(html, basePath) {
+    const href = `${basePath}/`;
+    const tag = `<base href="${href}" />`;
+    // Test for the tag rather than comparing before/after: rewriting a document
+    // that already carries the right href is a no-op, and reading that as "no tag
+    // found" would append a second one on every serve.
+    if (/<base\b[^>]*>/i.test(html))
+        return html.replace(/<base\b[^>]*>/i, tag);
+    // No tag to rewrite (a hand-edited or third-party index.html). Insert one,
+    // since a sub-path deployment is broken without it.
+    return html.replace(/<head\b[^>]*>/i, (head) => `${head}\n    ${tag}`);
+}
+export function createStaticHost(rootDir, basePath = "") {
+    const root = resolve(rootDir);
+    const index = join(root, "index.html");
+    const available = fileSize(index) !== null;
+    /**
+     * Read at request time, not cached at boot: `npm run dev` rebuilds the bundle
+     * under a running server, and a cached copy would serve the previous deploy's
+     * HTML until restart. It is ~1.5KB, and only the document hits this path.
+     */
+    function sendIndex(res) {
+        let html;
+        try {
+            html = readFileSync(index, "utf8");
+        }
+        catch {
+            return false;
+        }
+        const body = Buffer.from(withBaseHref(html, basePath), "utf8");
+        res.writeHead(200, {
+            "content-type": TYPES[".html"] ?? "text/html; charset=utf-8",
+            "content-length": String(body.byteLength),
+            "cache-control": "no-cache",
+        });
+        res.end(body);
+        return true;
+    }
+    function send(res, file, size, immutable) {
+        const ext = extname(file).toLowerCase();
+        res.writeHead(200, {
+            "content-type": TYPES[ext] ?? "application/octet-stream",
+            "content-length": String(size),
+            // Vite fingerprints everything under /assets/, so those are safe to cache
+            // forever. index.html must never be, or a deploy is invisible until the
+            // browser feels like revalidating.
+            "cache-control": immutable ? "public, max-age=31536000, immutable" : "no-cache",
+        });
+        createReadStream(file).pipe(res);
+    }
+    return {
+        available,
+        serve(res, path) {
+            if (!available)
+                return false;
+            let decoded;
+            try {
+                decoded = decodeURIComponent(path);
+            }
+            catch {
+                // A malformed escape is not a file request; let it 404 normally.
+                return false;
+            }
+            const candidate = resolve(join(root, normalize(decoded)));
+            // `startsWith(root + sep)` and not `startsWith(root)`: the latter would
+            // also accept a sibling directory named `dist-backup`.
+            const inRoot = candidate === root || candidate.startsWith(root + sep);
+            if (inRoot) {
+                // index.html goes through sendIndex wherever it is asked for, so a
+                // direct request for it cannot bypass the <base href> rewrite that the
+                // fallback below applies.
+                if (candidate === index)
+                    return sendIndex(res);
+                const size = fileSize(candidate);
+                if (size !== null) {
+                    send(res, candidate, size, candidate.startsWith(join(root, "assets") + sep));
+                    return true;
+                }
+            }
+            // SPA fallback: extensionless, non-API, non-proxy paths are client routes.
+            if (extname(decoded) === "" && !decoded.startsWith("/v1/") && !decoded.startsWith("/api/")) {
+                return sendIndex(res);
+            }
+            return false;
+        },
+    };
+}
+//# sourceMappingURL=static.js.map

package/dist/server/http/static.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"static.js","sourceRoot":"","sources":["../../../server/http/static.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAGnE,MAAM,KAAK,GAAqC;IAC9C,OAAO,EAAE,0BAA0B;IACnC,KAAK,EAAE,gCAAgC;IACvC,MAAM,EAAE,yBAAyB;IACjC,OAAO,EAAE,iCAAiC;IAC1C,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,cAAc;IACtB,QAAQ,EAAE,YAAY;IACtB,MAAM,EAAE,iCAAiC;CAC1C,CAAC;AAQF,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1B,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,QAAgB;IACzD,MAAM,IAAI,GAAG,GAAG,QAAQ,GAAG,CAAC;IAC5B,MAAM,GAAG,GAAG,eAAe,IAAI,MAAM,CAAC;IACtC,4EAA4E;IAC5E,8EAA8E;IAC9E,mDAAmD;IACnD,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;IAC5E,2EAA2E;IAC3E,oDAAoD;IACpD,OAAO,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,SAAS,GAAG,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,QAAQ,GAAG,EAAE;IAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;IAE3C;;;;OAIG;IACH,SAAS,SAAS,CAAC,GAAmB;QACpC,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;QAC/D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YACjB,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,0BAA0B;YAC5D,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;YACzC,eAAe,EAAE,UAAU;SAC5B,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAED,SAAS,IAAI,CAAC,GAAmB,EAAE,IAAY,EAAE,IAAY,EAAE,SAAkB;QAC/E,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QACxC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YACjB,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,0BAA0B;YACxD,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC;YAC9B,0EAA0E;YAC1E,wEAAwE;YACxE,mCAAmC;YACnC,eAAe,EAAE,SAAS,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,UAAU;SAChF,CAAC,CAAC;QACH,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IAED,OAAO;QACL,SAAS;QAET,KAAK,CAAC,GAAmB,EAAE,IAAY;YACrC,IAAI,CAAC,SAAS;gBAAE,OAAO,KAAK,CAAC;YAE7B,IAAI,OAAe,CAAC;YACpB,IAAI,CAAC;gBACH,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;YACrC,CAAC;YAAC,MAAM,CAAC;gBACP,iEAAiE;gBACjE,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAC1D,wEAAwE;YACxE,uDAAuD;YACvD,MAAM,MAAM,GAAG,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;YAEtE,IAAI,MAAM,EAAE,CAAC;gBACX,mEAAmE;gBACnE,uEAAuE;gBACvE,0BAA0B;gBAC1B,IAAI,SAAS,KAAK,KAAK;oBAAE,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;gBAC/C,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;gBACjC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAClB,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;oBAC7E,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YAED,2EAA2E;YAC3E,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3F,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;YACxB,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/server/ingest/live-bus.js

@@ -0,0 +1,67 @@
+/**
+ * In-process fan-out of usage records to connected dashboards.
+ *
+ * Deliberately fed from the sink's FLUSH, not from `record()`: the request path
+ * stays allocation-only, and a dashboard that is connected must never be able
+ * to add work to a developer's in-flight stream. The cost is that "live" means
+ * "within one flush interval" (250ms), which is indistinguishable from instant
+ * to a human watching a feed.
+ *
+ * A subscriber that cannot keep up is DROPPED FROM, not buffered for. Growing a
+ * buffer for a stalled browser tab would trade a developer's memory for a
+ * dashboard's completeness; the feed is a tail, and the paged `/api/requests`
+ * view is the authoritative history. Drops are counted so the gap is visible
+ * rather than silent — the same rule the sink's queue follows.
+ */
+export function createLiveBus() {
+    const subscribers = new Set();
+    const closers = new Map();
+    let published = 0;
+    let dropped = 0;
+    return {
+        publish(records) {
+            if (records.length === 0 || subscribers.size === 0)
+                return;
+            published += records.length;
+            for (const fn of subscribers) {
+                let accepted = false;
+                try {
+                    accepted = fn(records);
+                }
+                catch {
+                    // A throwing subscriber is a broken socket, not our problem to retry.
+                    // Unsubscribe it so one bad tab cannot be tried again on every flush.
+                    subscribers.delete(fn);
+                    continue;
+                }
+                if (!accepted)
+                    dropped += records.length;
+            }
+        },
+        subscribe(fn, onClose) {
+            subscribers.add(fn);
+            if (onClose !== undefined)
+                closers.set(fn, onClose);
+            return () => {
+                subscribers.delete(fn);
+                closers.delete(fn);
+            };
+        },
+        closeAll() {
+            for (const close of [...closers.values()]) {
+                try {
+                    close();
+                }
+                catch {
+                    // A socket that is already gone is the outcome we wanted anyway.
+                }
+            }
+            subscribers.clear();
+            closers.clear();
+        },
+        stats() {
+            return { subscribers: subscribers.size, published, dropped };
+        },
+    };
+}
+//# sourceMappingURL=live-bus.js.map

package/dist/server/ingest/live-bus.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-bus.js","sourceRoot":"","sources":["../../../server/ingest/live-bus.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAgCH,MAAM,UAAU,aAAa;IAC3B,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC9C,MAAM,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;IACtD,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,OAAO;QACL,OAAO,CAAC,OAA+B;YACrC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC;gBAAE,OAAO;YAC3D,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC;YAC5B,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;gBAC7B,IAAI,QAAQ,GAAG,KAAK,CAAC;gBACrB,IAAI,CAAC;oBACH,QAAQ,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;gBACzB,CAAC;gBAAC,MAAM,CAAC;oBACP,sEAAsE;oBACtE,sEAAsE;oBACtE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBACvB,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,QAAQ;oBAAE,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;YAC3C,CAAC;QACH,CAAC;QAED,SAAS,CAAC,EAAkB,EAAE,OAAoB;YAChD,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACpB,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YACpD,OAAO,GAAG,EAAE;gBACV,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACvB,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACrB,CAAC,CAAC;QACJ,CAAC;QAED,QAAQ;YACN,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;gBAC1C,IAAI,CAAC;oBACH,KAAK,EAAE,CAAC;gBACV,CAAC;gBAAC,MAAM,CAAC;oBACP,iEAAiE;gBACnE,CAAC;YACH,CAAC;YACD,WAAW,CAAC,KAAK,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC;QAED,KAAK;YACH,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;QAC/D,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/server/ingest/sink.js

@@ -0,0 +1,141 @@
+/**
+ * Usage record sink: bounded queue in front of batched appends.
+ *
+ * `record()` is called from the request path, so it is allocation-only: push
+ * onto an array and return. No I/O, no JSON, no pricing, no awaiting. Pricing
+ * happens in the flush, where a slow lookup cannot add latency to a stream.
+ *
+ * On overload the queue drops the OLDEST record and increments a counter. That
+ * is deliberate: we degrade the metric rather than the product. The counter is
+ * exposed so the loss can never be silent — a dashboard that quietly
+ * under-reports is worse than one that admits it dropped 4,102 records.
+ *
+ * Phase 1 writes JSONL. The queue/flush seam is where SQLite lands in Phase 2
+ * without the request path changing.
+ */
+import { appendFile } from "node:fs/promises";
+import { log } from "../log.js";
+export function createUsageSink(opts) {
+    const flushMs = opts.flushMs ?? 250;
+    const maxQueue = opts.maxQueue ?? 10_000;
+    const maxBatch = opts.maxBatch ?? 200;
+    const ringSize = opts.ringSize ?? 500;
+    let queue = [];
+    const ring = [];
+    let written = 0;
+    let dropped = 0;
+    let writeErrors = 0;
+    let trailErrors = 0;
+    let lastFlushMs = null;
+    /**
+     * The in-flight flush, if any. Held as a promise rather than a boolean so
+     * that `await flush()` awaits the *actual work* even when a fire-and-forget
+     * flush is already running. With a boolean guard, `close()` could return
+     * while a flush was mid-append and silently drop whatever was still queued.
+     */
+    let inFlight = null;
+    let closed = false;
+    let timer = setInterval(() => {
+        void flush();
+    }, flushMs);
+    // Never hold the process open just to flush metrics.
+    timer.unref();
+    function flush() {
+        // Overlapping flushes would interleave appends, so callers join the
+        // in-flight one instead of starting a second.
+        if (inFlight)
+            return inFlight;
+        if (queue.length === 0)
+            return Promise.resolve();
+        inFlight = doFlush().finally(() => {
+            inFlight = null;
+        });
+        return inFlight;
+    }
+    async function doFlush() {
+        const startedAt = Date.now();
+        const batch = queue.splice(0, maxBatch);
+        // The store is the system of record, so it goes first and its outcome
+        // decides whether the batch is safe to let go of.
+        let persisted = true;
+        if (opts.onBatch !== undefined) {
+            try {
+                opts.onBatch(batch);
+            }
+            catch (err) {
+                persisted = false;
+                writeErrors += 1;
+                log.warn("usage store write failed", { error: String(err).slice(0, 200), writeErrors });
+            }
+        }
+        // The JSONL file is a convenience trail, not the record. Its failure is
+        // logged and counted but never requeues the batch: retrying purely for the
+        // trail's sake would re-run onBatch and duplicate rows in the store.
+        try {
+            const payload = batch.map((r) => JSON.stringify(r)).join("\n") + "\n";
+            await appendFile(opts.path, payload, "utf8");
+        }
+        catch (err) {
+            trailErrors += 1;
+            log.warn("usage trail write failed", { error: String(err).slice(0, 200), trailErrors });
+        }
+        if (persisted) {
+            written += batch.length;
+        }
+        else if (queue.length + batch.length <= maxQueue) {
+            // Requeue once at the front. Beyond that, drop rather than grow without
+            // bound against a persistently failing store.
+            queue = [...batch, ...queue];
+        }
+        else {
+            dropped += batch.length;
+        }
+        lastFlushMs = Date.now() - startedAt;
+    }
+    return {
+        record(rec) {
+            if (closed)
+                return;
+            if (queue.length >= maxQueue) {
+                queue.shift();
+                dropped += 1;
+            }
+            queue.push(rec);
+            ring.push(rec);
+            if (ring.length > ringSize)
+                ring.shift();
+            // Size trigger, so a burst is not held for the full timer interval.
+            if (queue.length >= maxBatch)
+                void flush();
+        },
+        flush,
+        async close() {
+            closed = true;
+            if (timer) {
+                clearInterval(timer);
+                timer = null;
+            }
+            // Let any fire-and-forget flush settle first. Joining it would make no
+            // progress on our own backlog, because it has already taken its batch —
+            // which would make the no-progress check below break out immediately and
+            // silently discard the remainder.
+            if (inFlight)
+                await inFlight;
+            // Now drain in fresh batches. A batch that fails to shrink the queue
+            // means the disk is not accepting writes; stop rather than spin forever.
+            while (queue.length > 0) {
+                const before = queue.length;
+                await flush();
+                if (queue.length >= before)
+                    break;
+            }
+        },
+        stats() {
+            return { queued: queue.length, written, dropped, writeErrors, trailErrors, lastFlushMs };
+        },
+        recent(limit = 100) {
+            return ring.slice(-limit).reverse();
+        },
+    };
+}
+//# sourceMappingURL=sink.js.map

package/dist/server/ingest/sink.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sink.js","sourceRoot":"","sources":["../../../server/ingest/sink.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAuChC,MAAM,UAAU,eAAe,CAAC,IAAiB;IAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC;IACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC;IAEtC,IAAI,KAAK,GAAkB,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAkB,EAAE,CAAC;IAC/B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC;;;;;OAKG;IACH,IAAI,QAAQ,GAAyB,IAAI,CAAC;IAC1C,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,IAAI,KAAK,GAA0B,WAAW,CAAC,GAAG,EAAE;QAClD,KAAK,KAAK,EAAE,CAAC;IACf,CAAC,EAAE,OAAO,CAAC,CAAC;IACZ,qDAAqD;IACrD,KAAK,CAAC,KAAK,EAAE,CAAC;IAEd,SAAS,KAAK;QACZ,oEAAoE;QACpE,8CAA8C;QAC9C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QACjD,QAAQ,GAAG,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YAChC,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,UAAU,OAAO;QACpB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QAExC,sEAAsE;QACtE,kDAAkD;QAClD,IAAI,SAAS,GAAG,IAAI,CAAC;QACrB,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,GAAG,KAAK,CAAC;gBAClB,WAAW,IAAI,CAAC,CAAC;gBACjB,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;YAC1F,CAAC;QACH,CAAC;QAED,wEAAwE;QACxE,2EAA2E;QAC3E,qEAAqE;QACrE,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;YACtE,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,IAAI,CAAC,CAAC;YACjB,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC;QAC1B,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC;YACnD,wEAAwE;YACxE,8CAA8C;YAC9C,KAAK,GAAG,CAAC,GAAG,KAAK,EAAE,GAAG,KAAK,CAAC,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC;QAC1B,CAAC;QAED,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACvC,CAAC;IAED,OAAO;QACL,MAAM,CAAC,GAAgB;YACrB,IAAI,MAAM;gBAAE,OAAO;YACnB,IAAI,KAAK,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC;gBAC7B,KAAK,CAAC,KAAK,EAAE,CAAC;gBACd,OAAO,IAAI,CAAC,CAAC;YACf,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACf,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ;gBAAE,IAAI,CAAC,KAAK,EAAE,CAAC;YACzC,oEAAoE;YACpE,IAAI,KAAK,CAAC,MAAM,IAAI,QAAQ;gBAAE,KAAK,KAAK,EAAE,CAAC;QAC7C,CAAC;QACD,KAAK;QACL,KAAK,CAAC,KAAK;YACT,MAAM,GAAG,IAAI,CAAC;YACd,IAAI,KAAK,EAAE,CAAC;gBACV,aAAa,CAAC,KAAK,CAAC,CAAC;gBACrB,KAAK,GAAG,IAAI,CAAC;YACf,CAAC;YACD,uEAAuE;YACvE,wEAAwE;YACxE,yEAAyE;YACzE,kCAAkC;YAClC,IAAI,QAAQ;gBAAE,MAAM,QAAQ,CAAC;YAE7B,qEAAqE;YACrE,yEAAyE;YACzE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;gBAC5B,MAAM,KAAK,EAAE,CAAC;gBACd,IAAI,KAAK,CAAC,MAAM,IAAI,MAAM;oBAAE,MAAM;YACpC,CAAC;QACH,CAAC;QACD,KAAK;YACH,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;QAC3F,CAAC;QACD,MAAM,CAAC,KAAK,GAAG,GAAG;YAChB,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;QACtC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/server/log.js

@@ -0,0 +1,31 @@
+/**
+ * Structured logging with mandatory redaction.
+ *
+ * Every line passes through `redactSecrets` regardless of origin. Redaction
+ * that depends on each call site remembering to sanitise its own input fails
+ * eventually, and in Fest the thing that leaks would be a developer's live
+ * subscription credential. So the scrubber is applied here, once, to the
+ * serialised output — belt and braces over the structured fingerprinting that
+ * should already have happened upstream.
+ */
+import { redactSecrets } from "./secret/fingerprint.js";
+const LEVEL_ORDER = { debug: 10, info: 20, warn: 30, error: 40 };
+let threshold = LEVEL_ORDER.info;
+export function setLogLevel(level) {
+    threshold = LEVEL_ORDER[level];
+}
+function emit(level, msg, fields) {
+    if (LEVEL_ORDER[level] < threshold)
+        return;
+    const line = JSON.stringify({ at: new Date().toISOString(), level, msg, ...fields });
+    const safe = redactSecrets(line);
+    // Logs go to stderr so stdout stays free for machine-readable output.
+    process.stderr.write(safe + "\n");
+}
+export const log = {
+    debug: (msg, fields) => emit("debug", msg, fields),
+    info: (msg, fields) => emit("info", msg, fields),
+    warn: (msg, fields) => emit("warn", msg, fields),
+    error: (msg, fields) => emit("error", msg, fields),
+};
+//# sourceMappingURL=log.js.map

package/dist/server/log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.js","sourceRoot":"","sources":["../../server/log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAIxD,MAAM,WAAW,GAA6B,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AAE3F,IAAI,SAAS,GAAW,WAAW,CAAC,IAAI,CAAC;AAEzC,MAAM,UAAU,WAAW,CAAC,KAAe;IACzC,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,IAAI,CAAC,KAAe,EAAE,GAAW,EAAE,MAAgC;IAC1E,IAAI,WAAW,CAAC,KAAK,CAAC,GAAG,SAAS;QAAE,OAAO;IAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IACrF,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACjC,sEAAsE;IACtE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAG;IACjB,KAAK,EAAE,CAAC,GAAW,EAAE,MAAgC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC;IACpF,IAAI,EAAE,CAAC,GAAW,EAAE,MAAgC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC;IAClF,IAAI,EAAE,CAAC,GAAW,EAAE,MAAgC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC;IAClF,KAAK,EAAE,CAAC,GAAW,EAAE,MAAgC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC;CACrF,CAAC"}

package/dist/server/pipeline/count-tokens.js

@@ -0,0 +1,48 @@
+/**
+ * `POST /v1/messages/count_tokens`.
+ *
+ * Relayed, but deliberately NOT metered. It consumes no tokens and produces no
+ * usage, so recording it would inflate request counts and drag every per-request
+ * average toward zero — a dashboard that counts questions about work as work.
+ *
+ * It is relayed rather than answered locally because only the provider knows its
+ * own tokenizer. A plausible local estimate would be worse than no answer: it
+ * feeds Claude Code's context-window accounting, and a wrong number there causes
+ * either premature compaction or an overflow at the worst moment.
+ */
+import { anthropicError } from "../http/errors.js";
+import { readBodyBytes, isTooLarge } from "../http/body.js";
+import { buildUpstreamHeaders } from "../http/headers.js";
+import { log } from "../log.js";
+const MAX_BODY_BYTES = 8 * 1024 * 1024;
+export async function handleCountTokens(req, res, opts) {
+    const body = await readBodyBytes(req, MAX_BODY_BYTES);
+    if (isTooLarge(body)) {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(anthropicError("invalid_request_error", "Fest: count_tokens body too large."));
+        return;
+    }
+    const target = new URL(opts.path, opts.upstreamBaseUrl);
+    try {
+        const upstream = await fetch(target, {
+            method: "POST",
+            headers: buildUpstreamHeaders(req.headers, {
+                posture: opts.posture,
+                upstreamHost: target.host,
+            }),
+            body,
+            redirect: "error",
+        });
+        const text = await upstream.text();
+        res.writeHead(upstream.status, { "content-type": "application/json" });
+        res.end(text);
+    }
+    catch (err) {
+        log.warn("count_tokens relay failed", { error: String(err).slice(0, 200) });
+        // Claude Code treats a failure here as "estimate unavailable" and carries
+        // on, so failing cleanly is better than failing loudly.
+        res.writeHead(502, { "content-type": "application/json" });
+        res.end(anthropicError("api_error", "Fest: could not reach upstream for count_tokens."));
+    }
+}
+//# sourceMappingURL=count-tokens.js.map

package/dist/server/pipeline/count-tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"count-tokens.js","sourceRoot":"","sources":["../../../server/pipeline/count-tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAEhC,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAEvC,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAoB,EACpB,GAAmB,EACnB,IAAiE;IAEjE,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IACtD,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,uBAAuB,EAAE,oCAAoC,CAAC,CAAC,CAAC;QACvF,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE;YACnC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,oBAAoB,CAAC,GAAG,CAAC,OAAO,EAAE;gBACzC,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,YAAY,EAAE,MAAM,CAAC,IAAI;aAC1B,CAAC;YACF,IAAI;YACJ,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACvE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5E,0EAA0E;QAC1E,wDAAwD;QACxD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,EAAE,kDAAkD,CAAC,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC"}