gloomberb 0.15.2 → 0.15.4

package/src/remote/controller.ts

@@ -3,9 +3,9 @@ import {
   dockPane,
   floatPane,
   getDockLeafLayouts,
-  gridlockAllPanes,
   insertAtRootEdge,
   removeFloatingPanes,
+  tidyWindows,
 } from "../plugins/pane-manager";
 import type { PluginRegistry } from "../plugins/registry";
 import type { AppAction, AppState } from "../state/app/context";
@@ -17,7 +17,7 @@ import {
   customViewInstanceSettings,
   parseViewSpecOr,
 } from "../plugins/builtin/custom-view";
-import { findPaneInstance, type PaneInstanceConfig, resolvePaneInstance } from "../types/config";
+import { findPaneInstance, getPlacedPaneInstanceIds, type PaneInstanceConfig, resolvePaneInstance } from "../types/config";
 import type { DesktopWindowBridge } from "../types/desktop-window";
 import { applyJsonPatch } from "./json-patch";
 import { revisionFor } from "./revision";
@@ -32,7 +32,6 @@ import type { RemoteUiRegistry } from "./semantic-tree";
 import { commandBarResultsFromNodes, isCommandBarInputNode } from "./command-bar";
 import { REMOTE_AGENT_HELP, remoteControlSchema } from "./schema";
 import {
-  asRecord,
   fail,
   mutationSummary,
   numberInput,
@@ -46,9 +45,10 @@ import {
   regionToDockPosition,
   regionToRootEdge,
   requirePaneInstance,
-  visiblePaneIds,
 } from "./layout-helpers";
 import { createRemoteResources } from "./resources";
+import { asRecord } from "../utils/guards";
+import { runAutomated } from "../telemetry/usage-counts";
 
 interface AppRemoteControllerOptions {
   dispatch: Dispatch<AppAction>;
@@ -293,7 +293,12 @@ export function createAppRemoteController({
     return getAfterMutationSummary({ invokedNode: node, result });
   };
 
-  const call = async (operation: string, rawInput: unknown, dryRun?: boolean): Promise<unknown> => {
+  // What remote control opens is automation, not the user opening a function.
+  const call = (operation: string, rawInput: unknown, dryRun?: boolean): Promise<unknown> => (
+    runAutomated(() => callOperation(operation, rawInput, dryRun))
+  );
+
+  const callOperation = async (operation: string, rawInput: unknown, dryRun?: boolean): Promise<unknown> => {
     const input = asRecord(rawInput);
     const dryRunResult = () => ({ operation, input, dryRun: true });
     if (dryRun) return dryRunResult();
@@ -426,15 +431,14 @@ export function createAppRemoteController({
       case "layout.redo":
         dispatch({ type: "REDO_LAYOUT" });
         return getAfterMutationSummary();
-      case "layout.gridlock": {
-        const { width, height } = pluginRegistry.getTermSizeFn();
-        pluginRegistry.updateLayoutFn(gridlockAllPanes(
-          getState().config.layout,
-          { x: 0, y: 0, width, height },
-          pluginRegistry.panes,
-        ));
+      case "layout.gridlock":
+        tidyWindows({
+          layout: getState().config.layout,
+          size: pluginRegistry.getTermSizeFn(),
+          paneTypes: pluginRegistry.panes,
+          apply: pluginRegistry.updateLayoutFn,
+        });
         return getAfterMutationSummary();
-      }
       case "layout.closeFloating": {
         const floatingPaneIds = getState().config.layout.floating.map((entry) => entry.instanceId);
         pluginRegistry.updateLayoutFn(removeFloatingPanes(getState().config.layout));
@@ -477,7 +481,7 @@ export function createAppRemoteController({
         return getAfterMutationSummary({ affectedPaneIds: [target.instanceId] });
       }
       case "layout.setGrid": {
-        const rawPaneIds = Array.isArray(input.paneIds) ? input.paneIds : visiblePaneIds(getState().config.layout);
+        const rawPaneIds = Array.isArray(input.paneIds) ? input.paneIds : getPlacedPaneInstanceIds(getState().config.layout);
         const paneIds = rawPaneIds.map((id) => requirePaneInstance(getState().config.layout, String(id)).instanceId);
         const nextLayout = {
           ...getState().config.layout,

package/src/remote/layout-helpers.ts

@@ -1,8 +1,7 @@
-import {
-  getPlacedPaneInstanceIds,
-  type DockLayoutNode,
-  type LayoutConfig,
-  type PaneInstanceConfig,
+import type {
+  DockLayoutNode,
+  LayoutConfig,
+  PaneInstanceConfig,
 } from "../types/config";
 
 export function requirePaneInstance(layout: LayoutConfig, paneId: string): PaneInstanceConfig {
@@ -28,10 +27,6 @@ export function buildGridDockRoot(paneIds: string[], columns?: number): DockLayo
   return buildSplit(rows, "vertical");
 }
 
-export function visiblePaneIds(layout: LayoutConfig): string[] {
-  return getPlacedPaneInstanceIds(layout);
-}
-
 export function regionToDockPosition(region: string): "left" | "right" | "above" | "below" {
   if (region === "left" || region === "right") return region;
   if (region === "top") return "above";

package/src/remote/resources.ts

@@ -15,6 +15,7 @@ import {
   paneSnapshot,
   type PatchTarget,
 } from "./controller-utils";
+import { finiteOrNull } from "../utils/guards";
 
 interface RemoteResourceContext {
   dispatch: Dispatch<AppAction>;
@@ -23,6 +24,38 @@ interface RemoteResourceContext {
   uiRegistry: RemoteUiRegistry | null;
 }
 
+/**
+ * Broker accounts as last imported, with the figures an agent needs to answer
+ * questions about cash, margin and the day, and where each figure came from.
+ */
+function brokerAccountsResource(state: AppState) {
+  return state.config.brokerInstances.map((instance) => ({
+    brokerInstanceId: instance.id,
+    brokerType: instance.brokerType,
+    label: instance.label,
+    connectionMode: instance.connectionMode ?? null,
+    enabled: instance.enabled !== false,
+    portfolioIds: state.config.portfolios
+      .filter((portfolio) => portfolio.brokerInstanceId === instance.id)
+      .map((portfolio) => portfolio.id),
+    accounts: (state.brokerAccounts[instance.id] ?? []).map((account) => {
+      const netLiquidation = finiteOrNull(account.netLiquidation);
+      const grossPositionValue = finiteOrNull(account.grossPositionValue);
+      const totalCashValue = finiteOrNull(account.totalCashValue);
+      return {
+        ...account,
+        updatedAt: account.updatedAt ? new Date(account.updatedAt).toISOString() : null,
+        dailyPnlAsOf: account.dailyPnlAsOf ? new Date(account.dailyPnlAsOf).toISOString() : null,
+        /** Borrowed cash, in the account currency, when net cash is negative. */
+        marginLoan: totalCashValue != null && totalCashValue < 0 ? -totalCashValue : 0,
+        leverage: netLiquidation && grossPositionValue != null ? grossPositionValue / netLiquidation : null,
+        /** "broker": the broker's own day P&L. "quotes": none reported; the app estimates it from quotes. */
+        dailyPnlBasis: finiteOrNull(account.dailyPnl) != null ? "broker" : "quotes",
+      };
+    }),
+  }));
+}
+
 export function createRemoteResources({
   dispatch,
   getState,
@@ -101,6 +134,7 @@ export function createRemoteResources({
     if (resource === "app://command-bar/results") return commandBarResultsFromNodes(uiNodes);
     if (resource === "app://capabilities") return pluginRegistry.capabilities.manifests();
     if (resource === "app://auth") return apiClient.describeAuthState();
+    if (resource === "app://accounts") return brokerAccountsResource(state);
     if (resource === "app://remote/help") return REMOTE_AGENT_HELP;
     if (resource === "ui://tree") return uiNodes;
     throw new Error(`Unknown remote resource "${resource}".`);

package/src/remote/revision.ts

@@ -1,18 +1,5 @@
-export function stableStringify(value: unknown): string {
-  if (value == null || typeof value !== "object") return JSON.stringify(value);
-  if (Array.isArray(value)) return `[${value.map((entry) => stableStringify(entry)).join(",")}]`;
-  const object = value as Record<string, unknown>;
-  return `{${Object.keys(object).sort().map((key) => (
-    `${JSON.stringify(key)}:${stableStringify(object[key])}`
-  )).join(",")}}`;
-}
+import { fnv1aHex, stableStringify } from "../utils/hash";
 
 export function revisionFor(value: unknown): string {
-  const input = stableStringify(value);
-  let hash = 0x811c9dc5;
-  for (let index = 0; index < input.length; index += 1) {
-    hash ^= input.charCodeAt(index);
-    hash = Math.imul(hash, 0x01000193);
-  }
-  return (hash >>> 0).toString(16).padStart(8, "0");
+  return fnv1aHex(stableStringify(value));
 }

package/src/remote/schema.ts

@@ -22,6 +22,7 @@ export const REMOTE_RESOURCES: RemoteResourceSchema[] = [
   { uri: "app://command-bar", description: "Current command-bar state and semantic result rows." },
   { uri: "app://command-bar/results", description: "Current semantic command-bar result rows." },
   { uri: "app://capabilities", description: "Registered plugin capability manifests." },
+  { uri: "app://accounts", description: "Broker profiles and their accounts: net liquidation, cash by currency, margin requirements, margin loan, leverage, day and unrealized P&L, with source and as-of times." },
   { uri: "app://auth", description: "What the client believes about its cloud session: credential present, checked, cached user plan and verification. No secrets." },
   { uri: "app://remote/help", description: "Agent-oriented remote usage guide with efficient recipes and caveats." },
   { uri: "ui://tree", description: "Live semantic UI node tree populated by shared controls and interactive primitives." },

package/src/renderers/browser/app-services.ts

@@ -25,7 +25,7 @@ export function createBrowserAppServices({ config, plugins, externalPlugins }: A
         priority: 0,
         provider: { fetchNews: (query) => cloudNews?.provider.fetchNews(query) ?? Promise.resolve([]) },
       }));
-      return pluginRegistry.events.on("command-bar:portfolio-membership-persisted", () => recordResearchActivity("ticker_saved"));
+      return pluginRegistry.events.on("host:portfolio-ticker-saved", () => recordResearchActivity("ticker_saved"));
     },
   });
 }

package/src/renderers/browser/bundled-plugins.ts

@@ -1,7 +1,9 @@
 import { installPluginHostModules } from "../../plugins/host-modules";
 import type { LoadedExternalPlugin } from "../../plugins/loader";
+import { pluginFromModule } from "../../plugins/plugin-export";
 import type { WebBundledPluginDescriptor } from "../../plugins/web-bundled";
 import type { GloomPlugin } from "../../types/plugin";
+import { reportCrash } from "../../telemetry/crash-reports";
 import { debugLog } from "../../utils/debug-log";
 
 const log = debugLog.createLogger("web-plugins");
@@ -39,19 +41,18 @@ export async function loadWebBundledPlugins(
       path: descriptor.url,
     };
     try {
-      const mod = await import(/* @vite-ignore */ descriptor.url) as {
-        default?: GloomPlugin;
-        plugin?: GloomPlugin;
-      };
-      const plugin = mod.default ?? mod.plugin;
-      if (!plugin?.id || !plugin?.name) {
-        return { ...fallback, error: "Bundle did not export a valid GloomPlugin." };
+      const plugin = pluginFromModule(await import(/* @vite-ignore */ descriptor.url));
+      if (!plugin) {
+        const error = "Bundle did not export a valid GloomPlugin.";
+        reportCrash(error, { kind: "plugin", plugin: descriptor.id });
+        return { ...fallback, error };
       }
       log.info(`Loaded bundled plugin: ${plugin.id} v${plugin.version ?? "0.0.0"}`);
       return { plugin, path: descriptor.url };
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
       log.error(`Loading ${descriptor.id} failed: ${message}`);
+      reportCrash(error, { kind: "plugin", plugin: descriptor.id });
       return { ...fallback, error: message };
     }
   }));

package/src/renderers/browser/cloud-transport.ts

@@ -1,8 +1,8 @@
 import { apiClient, setCloudApiFetchTransport } from "../../api-client";
+import { settleWithin } from "../../utils/async-deadline";
 import { setHttpFetchTransport } from "../../utils/http-transport";
 import { createBrowserHttpProxyTransport } from "./http-proxy-transport";
-
-const SESSION_COOKIE_NAMES = ["__Secure-gloomberb.session_token", "gloomberb.session_token"] as const;
+import { SESSION_COOKIE_NAMES } from "../../api-client/session-cookie";
 
 function plantBrowserSessionCookies(cookieHeader: string): void {
   if (typeof document === "undefined") return;
@@ -42,13 +42,5 @@ export function installBrowserFetchTransports(): void {
 }
 
 export async function restoreBrowserCloudSession(budgetMs = 5_000): Promise<void> {
-  let timer: ReturnType<typeof setTimeout> | undefined;
-  const deadline = new Promise<null>((resolve) => {
-    timer = setTimeout(() => resolve(null), budgetMs);
-  });
-  try {
-    await Promise.race([apiClient.getSession().catch(() => null), deadline]);
-  } finally {
-    clearTimeout(timer);
-  }
+  await settleWithin(apiClient.getSession(), budgetMs);
 }

package/src/renderers/browser/config-host.ts

@@ -25,13 +25,10 @@ function browserReady(config: AppConfig): AppConfig {
 
 export const BROWSER_RESEARCH_PANE_ID = "ticker-detail:main";
 export const BROWSER_RESEARCH_CHART_ID = "chart-composer:research";
-export const BROWSER_RESEARCH_NEWS_ID = "ticker-news:research";
-export const BROWSER_WORLD_INDICES_ID = "world-indices:main";
-export const BROWSER_SECTORS_ID = "sectors:main";
-export const BROWSER_ECON_CALENDAR_ID = "econ-calendar:main";
-
-/** The browser ships the monochrome theme the website uses. */
-export const BROWSER_DEFAULT_THEME = "white";
+const BROWSER_RESEARCH_NEWS_ID = "ticker-news:research";
+const BROWSER_WORLD_INDICES_ID = "world-indices:main";
+const BROWSER_SECTORS_ID = "sectors:main";
+const BROWSER_ECON_CALENDAR_ID = "econ-calendar:main";
 
 function column(first: string, second: string, ratio = 0.5): DockLayoutNode {
   return {
@@ -85,7 +82,6 @@ export function createBrowserResearchLayout(symbol: string): LayoutConfig {
 
 function createBrowserDefaultConfig(dataDir: string, search = ""): AppConfig {
   const config = createDefaultConfig(dataDir);
-  config.theme = BROWSER_DEFAULT_THEME;
   const entry = researchEntryFromSearch(search) ?? { symbol: "NVDA", tab: "overview" };
   // A first visit starts with a research workspace around one company. Saved
   // layouts retain their existing panes and bindings when a visitor returns.
@@ -133,6 +129,15 @@ export function createBrowserConfigStore(storage: StorageLike, search = ""): Con
   };
 }
 
+/** False on a first visit, which opens the starter workspace rather than a saved one. */
+export function hasSavedBrowserConfig(storage: StorageLike = localStorage): boolean {
+  try {
+    return storage.getItem(BROWSER_STORAGE_KEYS.config) !== null;
+  } catch {
+    return false;
+  }
+}
+
 export function installBrowserConfigStore(storage: StorageLike = localStorage): void {
   setConfigStoreHost(createBrowserConfigStore(storage, typeof location !== "undefined" ? location.search : ""));
 }

package/src/renderers/browser/http-proxy-transport.ts

@@ -1,6 +1,20 @@
-import { createProxyResponse, type HttpProxyResponseEnvelope } from "../../utils/http-proxy-response";
+import {
+  createProxyResponse,
+  toRequestEnvelope,
+  type HttpProxyResponseEnvelope,
+} from "../../utils/http-proxy-response";
 import type { HttpFetchTransport } from "../../utils/http-transport";
-import { isProxiedHost, PROXY_ALLOWED_HOSTS } from "../../utils/plugin-proxy-hosts";
+import { HTTP_PROXY_PATH, isProxiedHost, PROXY_ALLOWED_HOSTS } from "../../utils/plugin-proxy-hosts";
+
+function needsProxy(url: string, hosts: readonly string[]): boolean {
+  try {
+    const target = new URL(url, typeof location === "undefined" ? undefined : location.href);
+    if (typeof location !== "undefined" && target.origin === location.origin) return false;
+    return isProxiedHost(target.hostname, hosts);
+  } catch {
+    return false;
+  }
+}
 
 /**
  * Client half of the plugin HTTP transport for the hosted web app.
@@ -17,40 +31,6 @@ import { isProxiedHost, PROXY_ALLOWED_HOSTS } from "../../utils/plugin-proxy-hos
  * those through the proxy would cost a round trip, lose streaming, and be
  * refused by the worker anyway.
  */
-export const HTTP_PROXY_PATH = "/http-proxy";
-
-function needsProxy(url: string, hosts: readonly string[]): boolean {
-  try {
-    const target = new URL(url, typeof location === "undefined" ? undefined : location.href);
-    if (typeof location !== "undefined" && target.origin === location.origin) return false;
-    return isProxiedHost(target.hostname, hosts);
-  } catch {
-    return false;
-  }
-}
-
-function headersToRecord(headers: HeadersInit | undefined): Record<string, string> {
-  const record: Record<string, string> = {};
-  if (!headers) return record;
-  if (headers instanceof Headers) {
-    headers.forEach((value, key) => {
-      record[key] = value;
-    });
-    return record;
-  }
-  if (Array.isArray(headers)) {
-    for (const [key, value] of headers) record[key] = value;
-    return record;
-  }
-  return { ...headers };
-}
-
-async function serializeBody(body: BodyInit | null | undefined): Promise<string | undefined> {
-  if (body == null) return undefined;
-  if (typeof body === "string") return body;
-  return new Response(body).text();
-}
-
 export function createBrowserHttpProxyTransport(
   send: typeof fetch = fetch,
   hosts: readonly string[] = PROXY_ALLOWED_HOSTS,
@@ -63,15 +43,7 @@ export function createBrowserHttpProxyTransport(
       headers: { "content-type": "application/json" },
       credentials: "include",
       signal: init?.signal ?? null,
-      body: JSON.stringify({
-        url,
-        init: {
-          method: init?.method,
-          headers: headersToRecord(init?.headers),
-          body: await serializeBody(init?.body),
-          redirect: init?.redirect,
-        },
-      }),
+      body: JSON.stringify(await toRequestEnvelope(url, init)),
     });
 
     if (!proxied.ok) {

package/src/renderers/browser/main.tsx

@@ -6,29 +6,38 @@ import { App } from "../../app";
 import { loadConfig } from "../../data/config/store";
 import { applyLanguageFromConfig } from "../../i18n";
 import { getBrowserPlugins } from "../../plugins/catalog-browser";
-import { UiHostProvider } from "../../ui/host";
-import { WebDialogHostProvider } from "../electrobun/view/dialog-host";
-import { BrowserErrorBoundary } from "./error-boundary";
+import { DomErrorBoundary, DomHostProviders } from "../electrobun/view/dom-host-providers";
 import { installFocusScopeRelease } from "../electrobun/view/host/focus-scope";
 import { installDomMarketDataFrames } from "../electrobun/view/data-frames";
-import { WebInputHostProvider } from "../electrobun/view/input-host";
-import { webNativeRenderer } from "../electrobun/view/native-renderer";
-import { WebToastHostProvider } from "../electrobun/view/toast-host";
 import { createBrowserAppServices } from "./app-services";
 import {
   installBrowserFetchTransports,
   restoreBrowserCloudSession,
 } from "./cloud-transport";
 import { loadWebBundledPlugins } from "./bundled-plugins";
-import { BROWSER_DATA_DIR, installBrowserConfigStore } from "./config-host";
+import { BROWSER_DATA_DIR, hasSavedBrowserConfig, installBrowserConfigStore } from "./config-host";
 import { browserRendererHost, browserUiHost } from "./ui-host";
 import { createBrowserDeepLinkBridge } from "./deeplink-bridge";
 import { initializeBrowserResearchActivity, recordResearchActivity } from "../../api-client/research-activity";
 import { flushPendingPersistence } from "../../state/persist-scheduler";
+import { loadOfficialPluginIds } from "../../plugins/builtin/plugin-marketplace/feed";
+import { crashReportsEnabled, installCrashReporter, reportCrash } from "../../telemetry/crash-reports";
+import {
+  browserDoNotTrack,
+  describeBrowserOs,
+  installWindowCrashListeners,
+  readOrCreateBrowserInstallId,
+} from "../../telemetry/crash-reports-dom";
+import { currentTelemetryConfig } from "../../telemetry/live-config";
+import { installUsageCounter, recordRestoredFunctions, usageCountsEnabled } from "../../telemetry/usage-counts";
+import { installWindowUsageFlush } from "../../telemetry/usage-counts-dom";
+import type { AppConfig } from "../../types/config";
 
 // Declared here rather than sniffed: the desktop view and the hosted browser
 // app are both browser contexts but differ in what plugins may do.
 setCurrentPluginTarget("web");
+installWindowCrashListeners();
+installWindowUsageFlush();
 
 const rootElement = document.getElementById("root");
 if (!rootElement) throw new Error("Missing root element");
@@ -39,6 +48,20 @@ root.render(<div className="gloom-loading">Starting Gloomberb...</div>);
 
 async function boot(): Promise<void> {
   installBrowserConfigStore();
+  let loadedConfig: AppConfig | null = null;
+  installCrashReporter({
+    surface: "web",
+    os: describeBrowserOs(),
+    isEnabled: () => !browserDoNotTrack() && crashReportsEnabled(currentTelemetryConfig(loadedConfig)),
+    getInstallId: () => readOrCreateBrowserInstallId(),
+  });
+  installUsageCounter({
+    surface: "web",
+    os: describeBrowserOs(),
+    isEnabled: () => !browserDoNotTrack() && usageCountsEnabled(currentTelemetryConfig(loadedConfig)),
+    getInstallId: () => readOrCreateBrowserInstallId(),
+    officialPluginIds: loadOfficialPluginIds,
+  });
   // A document reload does not unmount React. Flush both config and session
   // timers while localStorage is still available, including background tabs.
   window.addEventListener("pagehide", () => { void flushPendingPersistence(); });
@@ -57,34 +80,38 @@ async function boot(): Promise<void> {
   const bundledPlugins = loadWebBundledPlugins().catch(() => []);
   await restoreBrowserCloudSession();
   recordResearchActivity("workspace_opened");
+  // Nothing was restored on a first visit, only the starter workspace shown.
+  if (!hasSavedBrowserConfig()) recordRestoredFunctions([]);
   const config = await loadConfig(BROWSER_DATA_DIR);
+  loadedConfig = config;
   applyLanguageFromConfig(config);
   const externalPlugins = await bundledPlugins;
   const deepLinkBridge = createBrowserDeepLinkBridge();
   root.render(
-    <BrowserErrorBoundary>
-      <UiHostProvider ui={browserUiHost} renderer={browserRendererHost} nativeRenderer={webNativeRenderer}>
-        <WebInputHostProvider>
-          <WebToastHostProvider>
-            <WebDialogHostProvider>
-              <App
-                config={config}
-                servicesFactory={createBrowserAppServices}
-                externalPlugins={externalPlugins}
-                plugins={getBrowserPlugins(externalPlugins)}
-                desktopDeepLinkBridge={deepLinkBridge}
-                updatesEnabled={false}
-              />
-            </WebDialogHostProvider>
-          </WebToastHostProvider>
-        </WebInputHostProvider>
-      </UiHostProvider>
-    </BrowserErrorBoundary>,
+    <DomErrorBoundary label="Browser renderer crashed" fallback={(error) => (
+      <div className="gloom-fatal">
+        <h1>Gloomberb crashed</h1>
+        <pre>{error instanceof Error ? error.message : String(error)}</pre>
+        <button onClick={() => window.location.reload()}>Reload</button>
+      </div>
+    )}>
+      <DomHostProviders ui={browserUiHost} renderer={browserRendererHost}>
+        <App
+          config={config}
+          servicesFactory={createBrowserAppServices}
+          externalPlugins={externalPlugins}
+          plugins={getBrowserPlugins(externalPlugins)}
+          desktopDeepLinkBridge={deepLinkBridge}
+          updatesEnabled={false}
+        />
+      </DomHostProviders>
+    </DomErrorBoundary>,
   );
   appRootElement.focus({ preventScroll: true });
 }
 
 void boot().catch((error) => {
+  reportCrash(error, { kind: "uncaught" });
   const message = error instanceof Error ? error.message : String(error);
   root.render(<div className="gloom-fatal"><h1>Gloomberb failed to start</h1><pre>{message}</pre></div>);
 });

package/src/renderers/cloudflare/http-proxy.ts

@@ -14,10 +14,11 @@
  * running on our bandwidth and our IP reputation. Everything below exists to
  * keep that from happening.
  */
+import { readRequestInit, toResponseEnvelope } from "../../utils/http-proxy-response";
 import { isProxiedHost, PROXY_ALLOWED_HOSTS } from "../../utils/plugin-proxy-hosts";
+import { SESSION_COOKIE_NAMES } from "../../api-client/session-cookie";
 
 const PROXY_METHODS = new Set(["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE"]);
-const SESSION_COOKIE_NAMES = ["__Secure-gloomberb.session_token", "gloomberb.session_token"];
 /** Set by the caller's browser or meaningful only to the hop it came from. */
 const STRIPPED_REQUEST_HEADERS = new Set([
   "connection",
@@ -34,14 +35,6 @@ const MAX_BODY_BYTES = 5 * 1024 * 1024;
 const MAX_TIMEOUT_MS = 30_000;
 const DEFAULT_TIMEOUT_MS = 20_000;
 
-export interface HttpProxyEnvelope {
-  status: number;
-  statusText: string;
-  headers: Record<string, string>;
-  setCookie: string[];
-  body: string;
-}
-
 /**
  * Rejects anything that is not a plain https host on the allowlist.
  *
@@ -86,11 +79,9 @@ function hasSessionCookie(request: Request): boolean {
   return SESSION_COOKIE_NAMES.some((name) => new RegExp(`(?:^|;\\s*)${name}=[^;]`).test(cookie));
 }
 
-function upstreamHeaders(raw: unknown): Headers {
+function upstreamHeaders(raw: Record<string, string>): Headers {
   const headers = new Headers();
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return headers;
-  for (const [name, value] of Object.entries(raw as Record<string, unknown>)) {
-    if (typeof value !== "string") continue;
+  for (const [name, value] of Object.entries(raw)) {
     if (STRIPPED_REQUEST_HEADERS.has(name.toLowerCase())) continue;
     try {
       headers.set(name, value);
@@ -102,12 +93,6 @@ function upstreamHeaders(raw: unknown): Headers {
   return headers;
 }
 
-function clampTimeout(value: unknown): number {
-  return typeof value === "number" && Number.isFinite(value) && value > 0
-    ? Math.min(value, MAX_TIMEOUT_MS)
-    : DEFAULT_TIMEOUT_MS;
-}
-
 function proxyError(message: string, status: number): Response {
   return Response.json({ error: message }, { status, headers: { "cache-control": "no-store" } });
 }
@@ -143,55 +128,30 @@ export async function handleHttpProxy(
   const target = validateProxyTarget(payload.url, hosts);
   if ("error" in target) return proxyError(target.error, target.status);
 
-  const init = payload.init && typeof payload.init === "object" && !Array.isArray(payload.init)
-    ? payload.init as Record<string, unknown>
-    : {};
-  const method = typeof init.method === "string" && init.method.trim()
-    ? init.method.trim().toUpperCase()
-    : "GET";
-  if (!PROXY_METHODS.has(method)) {
+  const init = readRequestInit(payload.init);
+  if (!PROXY_METHODS.has(init.method)) {
     return proxyError("Method not allowed", 405);
   }
-  const body = typeof init.body === "string" && method !== "GET" && method !== "HEAD"
-    ? init.body
-    : undefined;
 
   let response: Response;
   try {
     response = await fetchUpstream(target.url, {
-      method,
+      method: init.method,
       headers: upstreamHeaders(init.headers),
-      body,
-      redirect: init.redirect === "manual" || init.redirect === "error" ? init.redirect : "follow",
-      signal: AbortSignal.timeout(clampTimeout(init.timeoutMs)),
+      body: init.body,
+      redirect: init.redirect ?? "follow",
+      signal: AbortSignal.timeout(Math.min(init.timeoutMs ?? DEFAULT_TIMEOUT_MS, MAX_TIMEOUT_MS)),
     });
   } catch (error) {
     const timedOut = error instanceof Error && error.name === "TimeoutError";
     return proxyError(timedOut ? "The upstream request timed out." : "The upstream request failed.", 504);
   }
 
-  const text = await response.text();
-  if (text.length > MAX_BODY_BYTES) {
+  // `set-cookie` comes back in `setCookie`, never as a header, so a third party
+  // cannot set cookies on the Gloomberb origin.
+  const envelope = await toResponseEnvelope(response);
+  if (envelope.body.length > MAX_BODY_BYTES) {
     return proxyError("The upstream response is too large.", 502);
   }
-
-  const headers: Record<string, string> = {};
-  response.headers.forEach((value, key) => {
-    // Carried in `setCookie` instead. Emitting it here would let a third party
-    // set cookies on the Gloomberb origin.
-    if (key.toLowerCase() === "set-cookie") return;
-    headers[key] = value;
-  });
-  const setCookie = [...(response.headers.getSetCookie?.() ?? [])];
-  const singleSetCookie = response.headers.get("set-cookie");
-  if (setCookie.length === 0 && singleSetCookie) setCookie.push(singleSetCookie);
-
-  const envelope: HttpProxyEnvelope = {
-    status: response.status,
-    statusText: response.statusText,
-    headers,
-    setCookie,
-    body: text,
-  };
   return Response.json(envelope, { headers: { "cache-control": "no-store" } });
 }